From: Sasha Levin Date: Sun, 2 Apr 2023 13:40:18 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v4.14.312~49 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=087cd31f26ec82097a6c8aaa6a9223b848106c87;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/alsa-ymfpci-fix-assignment-in-if-condition.patch b/queue-5.10/alsa-ymfpci-fix-assignment-in-if-condition.patch new file mode 100644 index 00000000000..83afb58937d --- /dev/null +++ b/queue-5.10/alsa-ymfpci-fix-assignment-in-if-condition.patch @@ -0,0 +1,386 @@ +From 53987e309af1ad2ee31b566c21ebce62e237d040 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 16:05:26 +0200 +Subject: ALSA: ymfpci: Fix assignment in if condition + +From: Takashi Iwai + +[ Upstream commit e7daaeedb4f270126792ae216f406c1ba2b8f4d9 ] + +PCI YMFPCI driver code contains lots of assignments in if condition, +which is a bad coding style that may confuse readers and occasionally +lead to bugs. + +This patch is merely for coding-style fixes, no functional changes. + +Link: https://lore.kernel.org/r/20210608140540.17885-53-tiwai@suse.de +Signed-off-by: Takashi Iwai +Stable-dep-of: 6be2e7522eb5 ("ALSA: ymfpci: Fix BUG_ON in probe function") +Signed-off-by: Sasha Levin +--- + sound/pci/ymfpci/ymfpci.c | 71 +++++++++++++++++++-------------- + sound/pci/ymfpci/ymfpci_main.c | 72 +++++++++++++++++++++++----------- + 2 files changed, 91 insertions(+), 52 deletions(-) + +diff --git a/sound/pci/ymfpci/ymfpci.c b/sound/pci/ymfpci/ymfpci.c +index 9b0d18a7bf356..27fd10b976f77 100644 +--- a/sound/pci/ymfpci/ymfpci.c ++++ b/sound/pci/ymfpci/ymfpci.c +@@ -78,7 +78,8 @@ static int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev, + + if (io_port == 1) { + /* auto-detect */ +- if (!(io_port = pci_resource_start(chip->pci, 2))) ++ io_port = pci_resource_start(chip->pci, 2); ++ if (!io_port) + return -ENODEV; + } + } else { +@@ -87,7 +88,8 @@ static int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev, + for (io_port = 0x201; io_port <= 0x205; io_port++) { + if (io_port == 0x203) + continue; +- if ((r = request_region(io_port, 1, "YMFPCI gameport")) != NULL) ++ r = request_region(io_port, 1, "YMFPCI gameport"); ++ if (r) + break; + } + if (!r) { +@@ -108,10 +110,13 @@ static int snd_ymfpci_create_gameport(struct snd_ymfpci *chip, int dev, + } + } + +- if (!r && !(r = request_region(io_port, 1, "YMFPCI gameport"))) { +- dev_err(chip->card->dev, +- "joystick port %#x is in use.\n", io_port); +- return -EBUSY; ++ if (!r) { ++ r = request_region(io_port, 1, "YMFPCI gameport"); ++ if (!r) { ++ dev_err(chip->card->dev, ++ "joystick port %#x is in use.\n", io_port); ++ return -EBUSY; ++ } + } + + chip->gameport = gp = gameport_allocate_port(); +@@ -199,8 +204,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, + /* auto-detect */ + fm_port[dev] = pci_resource_start(pci, 1); + } +- if (fm_port[dev] > 0 && +- (fm_res = request_region(fm_port[dev], 4, "YMFPCI OPL3")) != NULL) { ++ if (fm_port[dev] > 0) ++ fm_res = request_region(fm_port[dev], 4, "YMFPCI OPL3"); ++ if (fm_res) { + legacy_ctrl |= YMFPCI_LEGACY_FMEN; + pci_write_config_word(pci, PCIR_DSXG_FMBASE, fm_port[dev]); + } +@@ -208,8 +214,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, + /* auto-detect */ + mpu_port[dev] = pci_resource_start(pci, 1) + 0x20; + } +- if (mpu_port[dev] > 0 && +- (mpu_res = request_region(mpu_port[dev], 2, "YMFPCI MPU401")) != NULL) { ++ if (mpu_port[dev] > 0) ++ mpu_res = request_region(mpu_port[dev], 2, "YMFPCI MPU401"); ++ if (mpu_res) { + legacy_ctrl |= YMFPCI_LEGACY_MEN; + pci_write_config_word(pci, PCIR_DSXG_MPU401BASE, mpu_port[dev]); + } +@@ -221,8 +228,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, + case 0x3a8: legacy_ctrl2 |= 3; break; + default: fm_port[dev] = 0; break; + } +- if (fm_port[dev] > 0 && +- (fm_res = request_region(fm_port[dev], 4, "YMFPCI OPL3")) != NULL) { ++ if (fm_port[dev] > 0) ++ fm_res = request_region(fm_port[dev], 4, "YMFPCI OPL3"); ++ if (fm_res) { + legacy_ctrl |= YMFPCI_LEGACY_FMEN; + } else { + legacy_ctrl2 &= ~YMFPCI_LEGACY2_FMIO; +@@ -235,8 +243,9 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, + case 0x334: legacy_ctrl2 |= 3 << 4; break; + default: mpu_port[dev] = 0; break; + } +- if (mpu_port[dev] > 0 && +- (mpu_res = request_region(mpu_port[dev], 2, "YMFPCI MPU401")) != NULL) { ++ if (mpu_port[dev] > 0) ++ mpu_res = request_region(mpu_port[dev], 2, "YMFPCI MPU401"); ++ if (mpu_res) { + legacy_ctrl |= YMFPCI_LEGACY_MEN; + } else { + legacy_ctrl2 &= ~YMFPCI_LEGACY2_MPUIO; +@@ -250,9 +259,8 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, + pci_read_config_word(pci, PCIR_DSXG_LEGACY, &old_legacy_ctrl); + pci_write_config_word(pci, PCIR_DSXG_LEGACY, legacy_ctrl); + pci_write_config_word(pci, PCIR_DSXG_ELEGACY, legacy_ctrl2); +- if ((err = snd_ymfpci_create(card, pci, +- old_legacy_ctrl, +- &chip)) < 0) { ++ err = snd_ymfpci_create(card, pci, old_legacy_ctrl, &chip); ++ if (err < 0) { + release_and_free_resource(mpu_res); + release_and_free_resource(fm_res); + goto free_card; +@@ -293,11 +301,12 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, + goto free_card; + + if (chip->mpu_res) { +- if ((err = snd_mpu401_uart_new(card, 0, MPU401_HW_YMFPCI, +- mpu_port[dev], +- MPU401_INFO_INTEGRATED | +- MPU401_INFO_IRQ_HOOK, +- -1, &chip->rawmidi)) < 0) { ++ err = snd_mpu401_uart_new(card, 0, MPU401_HW_YMFPCI, ++ mpu_port[dev], ++ MPU401_INFO_INTEGRATED | ++ MPU401_INFO_IRQ_HOOK, ++ -1, &chip->rawmidi); ++ if (err < 0) { + dev_warn(card->dev, + "cannot initialize MPU401 at 0x%lx, skipping...\n", + mpu_port[dev]); +@@ -306,18 +315,22 @@ static int snd_card_ymfpci_probe(struct pci_dev *pci, + } + } + if (chip->fm_res) { +- if ((err = snd_opl3_create(card, +- fm_port[dev], +- fm_port[dev] + 2, +- OPL3_HW_OPL3, 1, &opl3)) < 0) { ++ err = snd_opl3_create(card, ++ fm_port[dev], ++ fm_port[dev] + 2, ++ OPL3_HW_OPL3, 1, &opl3); ++ if (err < 0) { + dev_warn(card->dev, + "cannot initialize FM OPL3 at 0x%lx, skipping...\n", + fm_port[dev]); + legacy_ctrl &= ~YMFPCI_LEGACY_FMEN; + pci_write_config_word(pci, PCIR_DSXG_LEGACY, legacy_ctrl); +- } else if ((err = snd_opl3_hwdep_new(opl3, 0, 1, NULL)) < 0) { +- dev_err(card->dev, "cannot create opl3 hwdep\n"); +- goto free_card; ++ } else { ++ err = snd_opl3_hwdep_new(opl3, 0, 1, NULL); ++ if (err < 0) { ++ dev_err(card->dev, "cannot create opl3 hwdep\n"); ++ goto free_card; ++ } + } + } + +diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c +index cacc6a9d14c8b..8fd0607698820 100644 +--- a/sound/pci/ymfpci/ymfpci_main.c ++++ b/sound/pci/ymfpci/ymfpci_main.c +@@ -292,7 +292,8 @@ static void snd_ymfpci_pcm_interrupt(struct snd_ymfpci *chip, struct snd_ymfpci_ + struct snd_ymfpci_pcm *ypcm; + u32 pos, delta; + +- if ((ypcm = voice->ypcm) == NULL) ++ ypcm = voice->ypcm; ++ if (!ypcm) + return; + if (ypcm->substream == NULL) + return; +@@ -628,7 +629,8 @@ static int snd_ymfpci_playback_hw_params(struct snd_pcm_substream *substream, + struct snd_ymfpci_pcm *ypcm = runtime->private_data; + int err; + +- if ((err = snd_ymfpci_pcm_voice_alloc(ypcm, params_channels(hw_params))) < 0) ++ err = snd_ymfpci_pcm_voice_alloc(ypcm, params_channels(hw_params)); ++ if (err < 0) + return err; + return 0; + } +@@ -932,7 +934,8 @@ static int snd_ymfpci_playback_open(struct snd_pcm_substream *substream) + struct snd_ymfpci_pcm *ypcm; + int err; + +- if ((err = snd_ymfpci_playback_open_1(substream)) < 0) ++ err = snd_ymfpci_playback_open_1(substream); ++ if (err < 0) + return err; + ypcm = runtime->private_data; + ypcm->output_front = 1; +@@ -954,7 +957,8 @@ static int snd_ymfpci_playback_spdif_open(struct snd_pcm_substream *substream) + struct snd_ymfpci_pcm *ypcm; + int err; + +- if ((err = snd_ymfpci_playback_open_1(substream)) < 0) ++ err = snd_ymfpci_playback_open_1(substream); ++ if (err < 0) + return err; + ypcm = runtime->private_data; + ypcm->output_front = 0; +@@ -982,7 +986,8 @@ static int snd_ymfpci_playback_4ch_open(struct snd_pcm_substream *substream) + struct snd_ymfpci_pcm *ypcm; + int err; + +- if ((err = snd_ymfpci_playback_open_1(substream)) < 0) ++ err = snd_ymfpci_playback_open_1(substream); ++ if (err < 0) + return err; + ypcm = runtime->private_data; + ypcm->output_front = 0; +@@ -1124,7 +1129,8 @@ int snd_ymfpci_pcm(struct snd_ymfpci *chip, int device) + struct snd_pcm *pcm; + int err; + +- if ((err = snd_pcm_new(chip->card, "YMFPCI", device, 32, 1, &pcm)) < 0) ++ err = snd_pcm_new(chip->card, "YMFPCI", device, 32, 1, &pcm); ++ if (err < 0) + return err; + pcm->private_data = chip; + +@@ -1157,7 +1163,8 @@ int snd_ymfpci_pcm2(struct snd_ymfpci *chip, int device) + struct snd_pcm *pcm; + int err; + +- if ((err = snd_pcm_new(chip->card, "YMFPCI - PCM2", device, 0, 1, &pcm)) < 0) ++ err = snd_pcm_new(chip->card, "YMFPCI - PCM2", device, 0, 1, &pcm); ++ if (err < 0) + return err; + pcm->private_data = chip; + +@@ -1190,7 +1197,8 @@ int snd_ymfpci_pcm_spdif(struct snd_ymfpci *chip, int device) + struct snd_pcm *pcm; + int err; + +- if ((err = snd_pcm_new(chip->card, "YMFPCI - IEC958", device, 1, 0, &pcm)) < 0) ++ err = snd_pcm_new(chip->card, "YMFPCI - IEC958", device, 1, 0, &pcm); ++ if (err < 0) + return err; + pcm->private_data = chip; + +@@ -1230,7 +1238,8 @@ int snd_ymfpci_pcm_4ch(struct snd_ymfpci *chip, int device) + struct snd_pcm *pcm; + int err; + +- if ((err = snd_pcm_new(chip->card, "YMFPCI - Rear", device, 1, 0, &pcm)) < 0) ++ err = snd_pcm_new(chip->card, "YMFPCI - Rear", device, 1, 0, &pcm); ++ if (err < 0) + return err; + pcm->private_data = chip; + +@@ -1785,7 +1794,8 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch) + .read = snd_ymfpci_codec_read, + }; + +- if ((err = snd_ac97_bus(chip->card, 0, &ops, chip, &chip->ac97_bus)) < 0) ++ err = snd_ac97_bus(chip->card, 0, &ops, chip, &chip->ac97_bus); ++ if (err < 0) + return err; + chip->ac97_bus->private_free = snd_ymfpci_mixer_free_ac97_bus; + chip->ac97_bus->no_vra = 1; /* YMFPCI doesn't need VRA */ +@@ -1793,7 +1803,8 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch) + memset(&ac97, 0, sizeof(ac97)); + ac97.private_data = chip; + ac97.private_free = snd_ymfpci_mixer_free_ac97; +- if ((err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97)) < 0) ++ err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97); ++ if (err < 0) + return err; + + /* to be sure */ +@@ -1801,7 +1812,8 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch) + AC97_EA_VRA|AC97_EA_VRM, 0); + + for (idx = 0; idx < ARRAY_SIZE(snd_ymfpci_controls); idx++) { +- if ((err = snd_ctl_add(chip->card, snd_ctl_new1(&snd_ymfpci_controls[idx], chip))) < 0) ++ err = snd_ctl_add(chip->card, snd_ctl_new1(&snd_ymfpci_controls[idx], chip)); ++ if (err < 0) + return err; + } + if (chip->ac97->ext_id & AC97_EI_SDAC) { +@@ -1814,27 +1826,37 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch) + /* add S/PDIF control */ + if (snd_BUG_ON(!chip->pcm_spdif)) + return -ENXIO; +- if ((err = snd_ctl_add(chip->card, kctl = snd_ctl_new1(&snd_ymfpci_spdif_default, chip))) < 0) ++ kctl = snd_ctl_new1(&snd_ymfpci_spdif_default, chip); ++ err = snd_ctl_add(chip->card, kctl); ++ if (err < 0) + return err; + kctl->id.device = chip->pcm_spdif->device; +- if ((err = snd_ctl_add(chip->card, kctl = snd_ctl_new1(&snd_ymfpci_spdif_mask, chip))) < 0) ++ kctl = snd_ctl_new1(&snd_ymfpci_spdif_mask, chip); ++ err = snd_ctl_add(chip->card, kctl); ++ if (err < 0) + return err; + kctl->id.device = chip->pcm_spdif->device; +- if ((err = snd_ctl_add(chip->card, kctl = snd_ctl_new1(&snd_ymfpci_spdif_stream, chip))) < 0) ++ kctl = snd_ctl_new1(&snd_ymfpci_spdif_stream, chip); ++ err = snd_ctl_add(chip->card, kctl); ++ if (err < 0) + return err; + kctl->id.device = chip->pcm_spdif->device; + chip->spdif_pcm_ctl = kctl; + + /* direct recording source */ +- if (chip->device_id == PCI_DEVICE_ID_YAMAHA_754 && +- (err = snd_ctl_add(chip->card, kctl = snd_ctl_new1(&snd_ymfpci_drec_source, chip))) < 0) +- return err; ++ if (chip->device_id == PCI_DEVICE_ID_YAMAHA_754) { ++ kctl = snd_ctl_new1(&snd_ymfpci_drec_source, chip); ++ err = snd_ctl_add(chip->card, kctl); ++ if (err < 0) ++ return err; ++ } + + /* + * shared rear/line-in + */ + if (rear_switch) { +- if ((err = snd_ctl_add(chip->card, snd_ctl_new1(&snd_ymfpci_rear_shared, chip))) < 0) ++ err = snd_ctl_add(chip->card, snd_ctl_new1(&snd_ymfpci_rear_shared, chip)); ++ if (err < 0) + return err; + } + +@@ -1847,7 +1869,8 @@ int snd_ymfpci_mixer(struct snd_ymfpci *chip, int rear_switch) + kctl->id.device = chip->pcm->device; + kctl->id.subdevice = idx; + kctl->private_value = (unsigned long)substream; +- if ((err = snd_ctl_add(chip->card, kctl)) < 0) ++ err = snd_ctl_add(chip->card, kctl); ++ if (err < 0) + return err; + chip->pcm_mixer[idx].left = 0x8000; + chip->pcm_mixer[idx].right = 0x8000; +@@ -1928,7 +1951,8 @@ int snd_ymfpci_timer(struct snd_ymfpci *chip, int device) + tid.card = chip->card->number; + tid.device = device; + tid.subdevice = 0; +- if ((err = snd_timer_new(chip->card, "YMFPCI", &tid, &timer)) >= 0) { ++ err = snd_timer_new(chip->card, "YMFPCI", &tid, &timer); ++ if (err >= 0) { + strcpy(timer->name, "YMFPCI timer"); + timer->private_data = chip; + timer->hw = snd_ymfpci_timer_hw; +@@ -2334,7 +2358,8 @@ int snd_ymfpci_create(struct snd_card *card, + *rchip = NULL; + + /* enable PCI device */ +- if ((err = pci_enable_device(pci)) < 0) ++ err = pci_enable_device(pci); ++ if (err < 0) + return err; + + chip = kzalloc(sizeof(*chip), GFP_KERNEL); +@@ -2357,7 +2382,8 @@ int snd_ymfpci_create(struct snd_card *card, + pci_set_master(pci); + chip->src441_used = -1; + +- if ((chip->res_reg_area = request_mem_region(chip->reg_area_phys, 0x8000, "YMFPCI")) == NULL) { ++ chip->res_reg_area = request_mem_region(chip->reg_area_phys, 0x8000, "YMFPCI"); ++ if (!chip->res_reg_area) { + dev_err(chip->card->dev, + "unable to grab memory region 0x%lx-0x%lx\n", + chip->reg_area_phys, chip->reg_area_phys + 0x8000 - 1); +-- +2.39.2 + diff --git a/queue-5.10/alsa-ymfpci-fix-bug_on-in-probe-function.patch b/queue-5.10/alsa-ymfpci-fix-bug_on-in-probe-function.patch new file mode 100644 index 00000000000..22b298ab0dc --- /dev/null +++ b/queue-5.10/alsa-ymfpci-fix-bug_on-in-probe-function.patch @@ -0,0 +1,69 @@ +From d5ed8d0a12358497d685ea6146005058897de3cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 06:28:08 +0300 +Subject: ALSA: ymfpci: Fix BUG_ON in probe function + +From: Tasos Sahanidis + +[ Upstream commit 6be2e7522eb529b41c16d459f33bbdbcddbf5c15 ] + +The snd_dma_buffer.bytes field now contains the aligned size, which this +snd_BUG_ON() did not account for, resulting in the following: + +[ 9.625915] ------------[ cut here ]------------ +[ 9.633440] WARNING: CPU: 0 PID: 126 at sound/pci/ymfpci/ymfpci_main.c:2168 snd_ymfpci_create+0x681/0x698 [snd_ymfpci] +[ 9.648926] Modules linked in: snd_ymfpci(+) snd_intel_dspcfg kvm(+) snd_intel_sdw_acpi snd_ac97_codec snd_mpu401_uart snd_opl3_lib irqbypass snd_hda_codec gameport snd_rawmidi crct10dif_pclmul crc32_pclmul cfg80211 snd_hda_core polyval_clmulni polyval_generic gf128mul snd_seq_device ghash_clmulni_intel snd_hwdep ac97_bus sha512_ssse3 rfkill snd_pcm aesni_intel tg3 snd_timer crypto_simd snd mxm_wmi libphy cryptd k10temp fam15h_power pcspkr soundcore sp5100_tco wmi acpi_cpufreq mac_hid dm_multipath sg loop fuse dm_mod bpf_preload ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 sr_mod cdrom ata_generic pata_acpi firewire_ohci crc32c_intel firewire_core xhci_pci crc_itu_t pata_via xhci_pci_renesas floppy +[ 9.711849] CPU: 0 PID: 126 Comm: kworker/0:2 Not tainted 6.1.21-1-lts #1 08d2e5ece03136efa7c6aeea9a9c40916b1bd8da +[ 9.722200] Hardware name: To Be Filled By O.E.M. To Be Filled By O.E.M./990FX Extreme4, BIOS P2.70 06/05/2014 +[ 9.732204] Workqueue: events work_for_cpu_fn +[ 9.736580] RIP: 0010:snd_ymfpci_create+0x681/0x698 [snd_ymfpci] +[ 9.742594] Code: 8c c0 4c 89 e2 48 89 df 48 c7 c6 92 c6 8c c0 e8 15 d0 e9 ff 48 83 c4 08 44 89 e8 5b 5d 41 5c 41 5d 41 5e 41 5f e9 d3 7a 33 e3 <0f> 0b e9 cb fd ff ff 41 bd fb ff ff ff eb db 41 bd f4 ff ff ff eb +[ 9.761358] RSP: 0018:ffffab64804e7da0 EFLAGS: 00010287 +[ 9.766594] RAX: ffff8fa2df06c400 RBX: ffff8fa3073a8000 RCX: ffff8fa303fbc4a8 +[ 9.773734] RDX: ffff8fa2df06d000 RSI: 0000000000000010 RDI: 0000000000000020 +[ 9.780876] RBP: ffff8fa300b5d0d0 R08: ffff8fa3073a8e50 R09: 00000000df06bf00 +[ 9.788018] R10: ffff8fa2df06bf00 R11: 00000000df068200 R12: ffff8fa3073a8918 +[ 9.795159] R13: 0000000000000000 R14: 0000000000000080 R15: ffff8fa2df068200 +[ 9.802317] FS: 0000000000000000(0000) GS:ffff8fa9fec00000(0000) knlGS:0000000000000000 +[ 9.810414] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 9.816158] CR2: 000055febaf66500 CR3: 0000000101a2e000 CR4: 00000000000406f0 +[ 9.823301] Call Trace: +[ 9.825747] +[ 9.827889] snd_card_ymfpci_probe+0x194/0x950 [snd_ymfpci b78a5fe64b5663a6390a909c67808567e3e73615] +[ 9.837030] ? finish_task_switch.isra.0+0x90/0x2d0 +[ 9.841918] local_pci_probe+0x45/0x80 +[ 9.845680] work_for_cpu_fn+0x1a/0x30 +[ 9.849431] process_one_work+0x1c7/0x380 +[ 9.853464] worker_thread+0x1af/0x390 +[ 9.857225] ? rescuer_thread+0x3b0/0x3b0 +[ 9.861254] kthread+0xde/0x110 +[ 9.864414] ? kthread_complete_and_exit+0x20/0x20 +[ 9.869210] ret_from_fork+0x22/0x30 +[ 9.872792] +[ 9.874985] ---[ end trace 0000000000000000 ]--- + +Fixes: 5c1733e33c88 ("ALSA: memalloc: Align buffer allocations in page size") +Signed-off-by: Tasos Sahanidis +Link: https://lore.kernel.org/r/20230329032808.170403-1-tasos@tasossah.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/ymfpci/ymfpci_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/pci/ymfpci/ymfpci_main.c b/sound/pci/ymfpci/ymfpci_main.c +index 8fd0607698820..0cd9b4029dab1 100644 +--- a/sound/pci/ymfpci/ymfpci_main.c ++++ b/sound/pci/ymfpci/ymfpci_main.c +@@ -2164,7 +2164,7 @@ static int snd_ymfpci_memalloc(struct snd_ymfpci *chip) + chip->work_base = ptr; + chip->work_base_addr = ptr_addr; + +- snd_BUG_ON(ptr + chip->work_size != ++ snd_BUG_ON(ptr + PAGE_ALIGN(chip->work_size) != + chip->work_ptr.area + chip->work_ptr.bytes); + + snd_ymfpci_writel(chip, YDSXGR_PLAYCTRLBASE, chip->bank_base_playback_addr); +-- +2.39.2 + diff --git a/queue-5.10/bnxt_en-add-missing-200g-link-speed-reporting.patch b/queue-5.10/bnxt_en-add-missing-200g-link-speed-reporting.patch new file mode 100644 index 00000000000..14bf0a6b4ca --- /dev/null +++ b/queue-5.10/bnxt_en-add-missing-200g-link-speed-reporting.patch @@ -0,0 +1,51 @@ +From 3e814d0c577bfabd62f5c1a5f82b7de8a3f0c54b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 18:30:21 -0700 +Subject: bnxt_en: Add missing 200G link speed reporting + +From: Michael Chan + +[ Upstream commit 581bce7bcb7e7f100908728e7b292e266c76895b ] + +bnxt_fw_to_ethtool_speed() is missing the case statement for 200G +link speed reported by firmware. As a result, ethtool will report +unknown speed when the firmware reports 200G link speed. + +Fixes: 532262ba3b84 ("bnxt_en: ethtool: support PAM4 link speeds up to 200G") +Signed-off-by: Michael Chan +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 34affd1de91da..b7b07beb17ffb 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -1198,6 +1198,7 @@ struct bnxt_link_info { + #define BNXT_LINK_SPEED_40GB PORT_PHY_QCFG_RESP_LINK_SPEED_40GB + #define BNXT_LINK_SPEED_50GB PORT_PHY_QCFG_RESP_LINK_SPEED_50GB + #define BNXT_LINK_SPEED_100GB PORT_PHY_QCFG_RESP_LINK_SPEED_100GB ++#define BNXT_LINK_SPEED_200GB PORT_PHY_QCFG_RESP_LINK_SPEED_200GB + u16 support_speeds; + u16 support_pam4_speeds; + u16 auto_link_speeds; /* fw adv setting */ +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 81b63d1c2391f..1e67e86fc3344 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1653,6 +1653,8 @@ u32 bnxt_fw_to_ethtool_speed(u16 fw_link_speed) + return SPEED_50000; + case BNXT_LINK_SPEED_100GB: + return SPEED_100000; ++ case BNXT_LINK_SPEED_200GB: ++ return SPEED_200000; + default: + return SPEED_UNKNOWN; + } +-- +2.39.2 + diff --git a/queue-5.10/bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch b/queue-5.10/bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch new file mode 100644 index 00000000000..5786ecc72fa --- /dev/null +++ b/queue-5.10/bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch @@ -0,0 +1,47 @@ +From 8e86ae9f1e7ab6ce953a1598c0a0929b06d14af1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 18:30:20 -0700 +Subject: bnxt_en: Fix typo in PCI id to device description string mapping + +From: Kalesh AP + +[ Upstream commit 62aad36ed31abc80f35db11e187e690448a79f7d ] + +Fix 57502 and 57508 NPAR description string entries. The typos +caused these devices to not match up with lspci output. + +Fixes: 49c98421e6ab ("bnxt_en: Add PCI IDs for 57500 series NPAR devices.") +Reviewed-by: Pavan Chebbi +Signed-off-by: Kalesh AP +Signed-off-by: Michael Chan +Reviewed-by: Simon Horman +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 6928c0b578abb..3a9fcf942a6de 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -219,12 +219,12 @@ static const struct pci_device_id bnxt_pci_tbl[] = { + { PCI_VDEVICE(BROADCOM, 0x1750), .driver_data = BCM57508 }, + { PCI_VDEVICE(BROADCOM, 0x1751), .driver_data = BCM57504 }, + { PCI_VDEVICE(BROADCOM, 0x1752), .driver_data = BCM57502 }, +- { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1800), .driver_data = BCM57502_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1801), .driver_data = BCM57504_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57502_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1802), .driver_data = BCM57508_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1803), .driver_data = BCM57502_NPAR }, + { PCI_VDEVICE(BROADCOM, 0x1804), .driver_data = BCM57504_NPAR }, +- { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57502_NPAR }, ++ { PCI_VDEVICE(BROADCOM, 0x1805), .driver_data = BCM57508_NPAR }, + { PCI_VDEVICE(BROADCOM, 0xd802), .driver_data = BCM58802 }, + { PCI_VDEVICE(BROADCOM, 0xd804), .driver_data = BCM58804 }, + #ifdef CONFIG_BNXT_SRIOV +-- +2.39.2 + diff --git a/queue-5.10/ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch b/queue-5.10/ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch new file mode 100644 index 00000000000..7b73d3cbfd9 --- /dev/null +++ b/queue-5.10/ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch @@ -0,0 +1,48 @@ +From 93f5323eb87c0aa1c55bbbb59ff6e15cf83bb82a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Mar 2023 11:18:24 -0800 +Subject: ca8210: Fix unsigned mac_len comparison with zero in ca8210_skb_tx() + +From: Harshit Mogalapalli + +[ Upstream commit 748b2f5e82d17480404b3e2895388fc2925f7caf ] + +mac_len is of type unsigned, which can never be less than zero. + + mac_len = ieee802154_hdr_peek_addrs(skb, &header); + if (mac_len < 0) + return mac_len; + +Change this to type int as ieee802154_hdr_peek_addrs() can return negative +integers, this is found by static analysis with smatch. + +Fixes: 6c993779ea1d ("ca8210: fix mac_len negative array access") +Signed-off-by: Harshit Mogalapalli +Acked-by: Alexander Aring +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230306191824.4115839-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/ca8210.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index 5beb447529f9e..1c5d70c60354b 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -1945,10 +1945,9 @@ static int ca8210_skb_tx( + struct ca8210_priv *priv + ) + { +- int status; + struct ieee802154_hdr header = { }; + struct secspec secspec; +- unsigned int mac_len; ++ int mac_len, status; + + dev_dbg(&priv->spi->dev, "%s called\n", __func__); + +-- +2.39.2 + diff --git a/queue-5.10/can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch b/queue-5.10/can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch new file mode 100644 index 00000000000..828f0e86299 --- /dev/null +++ b/queue-5.10/can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch @@ -0,0 +1,118 @@ +From 0aea207d704b4484dc82b1e1a9af64cd7cb6360f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Mar 2023 16:04:45 +0400 +Subject: can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write + +From: Ivan Orlov + +[ Upstream commit 2b4c99f7d9a57ecd644eda9b1fb0a1072414959f ] + +Syzkaller reported the following issue: + +===================================================== +BUG: KMSAN: uninit-value in aio_rw_done fs/aio.c:1520 [inline] +BUG: KMSAN: uninit-value in aio_write+0x899/0x950 fs/aio.c:1600 + aio_rw_done fs/aio.c:1520 [inline] + aio_write+0x899/0x950 fs/aio.c:1600 + io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 + __do_sys_io_submit fs/aio.c:2078 [inline] + __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 + __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:766 [inline] + slab_alloc_node mm/slub.c:3452 [inline] + __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 + __do_kmalloc_node mm/slab_common.c:967 [inline] + __kmalloc+0x11d/0x3b0 mm/slab_common.c:981 + kmalloc_array include/linux/slab.h:636 [inline] + bcm_tx_setup+0x80e/0x29d0 net/can/bcm.c:930 + bcm_sendmsg+0x3a2/0xce0 net/can/bcm.c:1351 + sock_sendmsg_nosec net/socket.c:714 [inline] + sock_sendmsg net/socket.c:734 [inline] + sock_write_iter+0x495/0x5e0 net/socket.c:1108 + call_write_iter include/linux/fs.h:2189 [inline] + aio_write+0x63a/0x950 fs/aio.c:1600 + io_submit_one+0x1d1c/0x3bf0 fs/aio.c:2019 + __do_sys_io_submit fs/aio.c:2078 [inline] + __se_sys_io_submit+0x293/0x770 fs/aio.c:2048 + __x64_sys_io_submit+0x92/0xd0 fs/aio.c:2048 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +CPU: 1 PID: 5034 Comm: syz-executor350 Not tainted 6.2.0-rc6-syzkaller-80422-geda666ff2276 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 +===================================================== + +We can follow the call chain and find that 'bcm_tx_setup' function +calls 'memcpy_from_msg' to copy some content to the newly allocated +frame of 'op->frames'. After that the 'len' field of copied structure +being compared with some constant value (64 or 8). However, if +'memcpy_from_msg' returns an error, we will compare some uninitialized +memory. This triggers 'uninit-value' issue. + +This patch will add 'memcpy_from_msg' possible errors processing to +avoid uninit-value issue. + +Tested via syzkaller + +Reported-by: syzbot+c9bfd85eca611ebf5db1@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=47f897f8ad958bbde5790ebf389b5e7e0a345089 +Signed-off-by: Ivan Orlov +Fixes: 6f3b911d5f29b ("can: bcm: add support for CAN FD frames") +Acked-by: Oliver Hartkopp +Link: https://lore.kernel.org/all/20230314120445.12407-1-ivan.orlov0322@gmail.com +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/bcm.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/net/can/bcm.c b/net/can/bcm.c +index afa82adaf6cd5..ddba4e12da783 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -936,6 +936,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + + cf = op->frames + op->cfsiz * i; + err = memcpy_from_msg((u8 *)cf, msg, op->cfsiz); ++ if (err < 0) ++ goto free_op; + + if (op->flags & CAN_FD_FRAME) { + if (cf->len > 64) +@@ -945,12 +947,8 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + err = -EINVAL; + } + +- if (err < 0) { +- if (op->frames != &op->sframe) +- kfree(op->frames); +- kfree(op); +- return err; +- } ++ if (err < 0) ++ goto free_op; + + if (msg_head->flags & TX_CP_CAN_ID) { + /* copy can_id into frame */ +@@ -1021,6 +1019,12 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + bcm_tx_start_timer(op); + + return msg_head->nframes * op->cfsiz + MHSIZ; ++ ++free_op: ++ if (op->frames != &op->sframe) ++ kfree(op->frames); ++ kfree(op); ++ return err; + } + + /* +-- +2.39.2 + diff --git a/queue-5.10/i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch b/queue-5.10/i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch new file mode 100644 index 00000000000..6023778db79 --- /dev/null +++ b/queue-5.10/i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch @@ -0,0 +1,91 @@ +From 50956810a7064978a6b992c9ecff81c1089f47a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 10:26:59 -0700 +Subject: i40e: fix registers dump after run ethtool adapter self test + +From: Radoslaw Tyl + +[ Upstream commit c5cff16f461a4a434a9915a7be7ac9ced861a8a4 ] + +Fix invalid registers dump from ethtool -d ethX after adapter self test +by ethtool -t ethY. It causes invalid data display. + +The problem was caused by overwriting i40e_reg_list[].elements +which is common for ethtool self test and dump. + +Fixes: 22dd9ae8afcc ("i40e: Rework register diagnostic") +Signed-off-by: Radoslaw Tyl +Reviewed-by: Michal Swiatkowski +Tested-by: Arpana Arland (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230328172659.3906413-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_diag.c | 11 ++++++----- + drivers/net/ethernet/intel/i40e/i40e_diag.h | 2 +- + 2 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.c b/drivers/net/ethernet/intel/i40e/i40e_diag.c +index ef4d3762bf371..ca229b0efeb65 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_diag.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.c +@@ -44,7 +44,7 @@ static i40e_status i40e_diag_reg_pattern_test(struct i40e_hw *hw, + return 0; + } + +-struct i40e_diag_reg_test_info i40e_reg_list[] = { ++const struct i40e_diag_reg_test_info i40e_reg_list[] = { + /* offset mask elements stride */ + {I40E_QTX_CTL(0), 0x0000FFBF, 1, + I40E_QTX_CTL(1) - I40E_QTX_CTL(0)}, +@@ -78,27 +78,28 @@ i40e_status i40e_diag_reg_test(struct i40e_hw *hw) + { + i40e_status ret_code = 0; + u32 reg, mask; ++ u32 elements; + u32 i, j; + + for (i = 0; i40e_reg_list[i].offset != 0 && + !ret_code; i++) { + ++ elements = i40e_reg_list[i].elements; + /* set actual reg range for dynamically allocated resources */ + if (i40e_reg_list[i].offset == I40E_QTX_CTL(0) && + hw->func_caps.num_tx_qp != 0) +- i40e_reg_list[i].elements = hw->func_caps.num_tx_qp; ++ elements = hw->func_caps.num_tx_qp; + if ((i40e_reg_list[i].offset == I40E_PFINT_ITRN(0, 0) || + i40e_reg_list[i].offset == I40E_PFINT_ITRN(1, 0) || + i40e_reg_list[i].offset == I40E_PFINT_ITRN(2, 0) || + i40e_reg_list[i].offset == I40E_QINT_TQCTL(0) || + i40e_reg_list[i].offset == I40E_QINT_RQCTL(0)) && + hw->func_caps.num_msix_vectors != 0) +- i40e_reg_list[i].elements = +- hw->func_caps.num_msix_vectors - 1; ++ elements = hw->func_caps.num_msix_vectors - 1; + + /* test register access */ + mask = i40e_reg_list[i].mask; +- for (j = 0; j < i40e_reg_list[i].elements && !ret_code; j++) { ++ for (j = 0; j < elements && !ret_code; j++) { + reg = i40e_reg_list[i].offset + + (j * i40e_reg_list[i].stride); + ret_code = i40e_diag_reg_pattern_test(hw, reg, mask); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_diag.h b/drivers/net/ethernet/intel/i40e/i40e_diag.h +index c3340f320a18c..1db7c6d572311 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_diag.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_diag.h +@@ -20,7 +20,7 @@ struct i40e_diag_reg_test_info { + u32 stride; /* bytes between each element */ + }; + +-extern struct i40e_diag_reg_test_info i40e_reg_list[]; ++extern const struct i40e_diag_reg_test_info i40e_reg_list[]; + + i40e_status i40e_diag_reg_test(struct i40e_hw *hw); + i40e_status i40e_diag_eeprom_test(struct i40e_hw *hw); +-- +2.39.2 + diff --git a/queue-5.10/mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch b/queue-5.10/mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch new file mode 100644 index 00000000000..2f9c9a15bef --- /dev/null +++ b/queue-5.10/mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch @@ -0,0 +1,117 @@ +From bd2239725e5c0f2decf01e39498c6deb6498ab9f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Mar 2023 11:20:04 +0100 +Subject: mips: bmips: BCM6358: disable RAC flush for TP1 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Álvaro Fernández Rojas + +[ Upstream commit ab327f8acdf8d06601fbf058859a539a9422afff ] + +RAC flush causes kernel panics on BCM6358 with EHCI/OHCI when booting from TP1: +[ 3.881739] usb 1-1: new high-speed USB device number 2 using ehci-platform +[ 3.895011] Reserved instruction in kernel code[#1]: +[ 3.900113] CPU: 0 PID: 1 Comm: init Not tainted 5.10.16 #0 +[ 3.905829] $ 0 : 00000000 10008700 00000000 77d94060 +[ 3.911238] $ 4 : 7fd1f088 00000000 81431cac 81431ca0 +[ 3.916641] $ 8 : 00000000 ffffefff 8075cd34 00000000 +[ 3.922043] $12 : 806f8d40 f3e812b7 00000000 000d9aaa +[ 3.927446] $16 : 7fd1f068 7fd1f080 7ff559b8 81428470 +[ 3.932848] $20 : 00000000 00000000 55590000 77d70000 +[ 3.938251] $24 : 00000018 00000010 +[ 3.943655] $28 : 81430000 81431e60 81431f28 800157fc +[ 3.949058] Hi : 00000000 +[ 3.952013] Lo : 00000000 +[ 3.955019] epc : 80015808 setup_sigcontext+0x54/0x24c +[ 3.960464] ra : 800157fc setup_sigcontext+0x48/0x24c +[ 3.965913] Status: 10008703 KERNEL EXL IE +[ 3.970216] Cause : 00800028 (ExcCode 0a) +[ 3.974340] PrId : 0002a010 (Broadcom BMIPS4350) +[ 3.979170] Modules linked in: ohci_platform ohci_hcd fsl_mph_dr_of ehci_platform ehci_fsl ehci_hcd gpio_button_hotplug usbcore nls_base usb_common +[ 3.992907] Process init (pid: 1, threadinfo=(ptrval), task=(ptrval), tls=77e22ec8) +[ 4.000776] Stack : 81431ef4 7fd1f080 81431f28 81428470 7fd1f068 81431edc 7ff559b8 81428470 +[ 4.009467] 81431f28 7fd1f080 55590000 77d70000 77d5498c 80015c70 806f0000 8063ae74 +[ 4.018149] 08100002 81431f28 0000000a 08100002 81431f28 0000000a 77d6b418 00000003 +[ 4.026831] ffffffff 80016414 80080734 81431ecc 81431ecc 00000001 00000000 04000000 +[ 4.035512] 77d54874 00000000 00000000 00000000 00000000 00000012 00000002 00000000 +[ 4.044196] ... +[ 4.046706] Call Trace: +[ 4.049238] [<80015808>] setup_sigcontext+0x54/0x24c +[ 4.054356] [<80015c70>] setup_frame+0xdc/0x124 +[ 4.059015] [<80016414>] do_notify_resume+0x1dc/0x288 +[ 4.064207] [<80011b50>] work_notifysig+0x10/0x18 +[ 4.069036] +[ 4.070538] Code: 8fc300b4 00001025 26240008 ac830004 3c048063 0c0228aa 24846a00 26240010 +[ 4.080686] +[ 4.082517] ---[ end trace 22a8edb41f5f983b ]--- +[ 4.087374] Kernel panic - not syncing: Fatal exception +[ 4.092753] Rebooting in 1 seconds.. + +Because the bootloader (CFE) is not initializing the Read-ahead cache properly +on the second thread (TP1). Since the RAC was not initialized properly, we +should avoid flushing it at the risk of corrupting the instruction stream as +seen in the trace above. + +Fixes: d59098a0e9cb ("MIPS: bmips: use generic dma noncoherent ops") +Signed-off-by: Álvaro Fernández Rojas +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/bmips/dma.c | 5 +++++ + arch/mips/bmips/setup.c | 8 ++++++++ + 2 files changed, 13 insertions(+) + +diff --git a/arch/mips/bmips/dma.c b/arch/mips/bmips/dma.c +index 49061b870680b..daef44f682984 100644 +--- a/arch/mips/bmips/dma.c ++++ b/arch/mips/bmips/dma.c +@@ -64,6 +64,8 @@ phys_addr_t dma_to_phys(struct device *dev, dma_addr_t dma_addr) + return dma_addr; + } + ++bool bmips_rac_flush_disable; ++ + void arch_sync_dma_for_cpu_all(void) + { + void __iomem *cbr = BMIPS_GET_CBR(); +@@ -74,6 +76,9 @@ void arch_sync_dma_for_cpu_all(void) + boot_cpu_type() != CPU_BMIPS4380) + return; + ++ if (unlikely(bmips_rac_flush_disable)) ++ return; ++ + /* Flush stale data out of the readahead cache */ + cfg = __raw_readl(cbr + BMIPS_RAC_CONFIG); + __raw_writel(cfg | 0x100, cbr + BMIPS_RAC_CONFIG); +diff --git a/arch/mips/bmips/setup.c b/arch/mips/bmips/setup.c +index 1b06b25aea87d..16063081d61ec 100644 +--- a/arch/mips/bmips/setup.c ++++ b/arch/mips/bmips/setup.c +@@ -34,6 +34,8 @@ + #define REG_BCM6328_OTP ((void __iomem *)CKSEG1ADDR(0x1000062c)) + #define BCM6328_TP1_DISABLED BIT(9) + ++extern bool bmips_rac_flush_disable; ++ + static const unsigned long kbase = VMLINUX_LOAD_ADDRESS & 0xfff00000; + + struct bmips_quirk { +@@ -103,6 +105,12 @@ static void bcm6358_quirks(void) + * disable SMP for now + */ + bmips_smp_enabled = 0; ++ ++ /* ++ * RAC flush causes kernel panics on BCM6358 when booting from TP1 ++ * because the bootloader is not initializing it properly. ++ */ ++ bmips_rac_flush_disable = !!(read_c0_brcm_cmt_local() & (1 << 31)); + } + + static void bcm6368_quirks(void) +-- +2.39.2 + diff --git a/queue-5.10/mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch b/queue-5.10/mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch new file mode 100644 index 00000000000..0661fde750d --- /dev/null +++ b/queue-5.10/mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch @@ -0,0 +1,68 @@ +From 1b8be86c31cba2bf6a589c4275728080031c6317 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Mar 2023 10:32:44 +0300 +Subject: mtd: rawnand: meson: invalidate cache on polling ECC bit + +From: Arseniy Krasnov + +[ Upstream commit e732e39ed9929c05fd219035bc9653ba4100d4fa ] + +'info_buf' memory is cached and driver polls ECC bit in it. This bit +is set by the NAND controller. If 'usleep_range()' returns before device +sets this bit, 'info_buf' will be cached and driver won't see update of +this bit and will loop forever. + +Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") +Signed-off-by: Arseniy Krasnov +Reviewed-by: Neil Armstrong +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/d4ef0bd6-816e-f6fa-9385-f05f775f0ae2@sberdevices.ru +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/meson_nand.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index 38f490088d764..dc631c5143187 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -172,6 +172,7 @@ struct meson_nfc { + + dma_addr_t daddr; + dma_addr_t iaddr; ++ u32 info_bytes; + + unsigned long assigned_cs; + }; +@@ -499,6 +500,7 @@ static int meson_nfc_dma_buffer_setup(struct nand_chip *nand, void *databuf, + nfc->daddr, datalen, dir); + return ret; + } ++ nfc->info_bytes = infolen; + cmd = GENCMDIADDRL(NFC_CMD_AIL, nfc->iaddr); + writel(cmd, nfc->reg_base + NFC_REG_CMD); + +@@ -516,8 +518,10 @@ static void meson_nfc_dma_buffer_release(struct nand_chip *nand, + struct meson_nfc *nfc = nand_get_controller_data(nand); + + dma_unmap_single(nfc->dev, nfc->daddr, datalen, dir); +- if (infolen) ++ if (infolen) { + dma_unmap_single(nfc->dev, nfc->iaddr, infolen, dir); ++ nfc->info_bytes = 0; ++ } + } + + static int meson_nfc_read_buf(struct nand_chip *nand, u8 *buf, int len) +@@ -706,6 +710,8 @@ static void meson_nfc_check_ecc_pages_valid(struct meson_nfc *nfc, + usleep_range(10, 15); + /* info is updated by nfc dma engine*/ + smp_rmb(); ++ dma_sync_single_for_cpu(nfc->dev, nfc->iaddr, nfc->info_bytes, ++ DMA_FROM_DEVICE); + ret = *info & ECC_COMPLETE; + } while (!ret); + } +-- +2.39.2 + diff --git a/queue-5.10/net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch b/queue-5.10/net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch new file mode 100644 index 00000000000..c4ef327c568 --- /dev/null +++ b/queue-5.10/net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch @@ -0,0 +1,55 @@ +From 20be5bb3abbe57b59f1106ee50fd25bc33462b10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Mar 2023 12:01:40 -0300 +Subject: net: dsa: mv88e6xxx: Enable IGMP snooping on user ports only +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Steffen Bätz + +[ Upstream commit 7bcad0f0e6fbc1d613e49e0ee35c8e5f2e685bb0 ] + +Do not set the MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP bit on CPU or DSA ports. + +This allows the host CPU port to be a regular IGMP listener by sending out +IGMP Membership Reports, which would otherwise not be forwarded by the +mv88exxx chip, but directly looped back to the CPU port itself. + +Fixes: 54d792f257c6 ("net: dsa: Centralise global and port setup code into mv88e6xxx.") +Signed-off-by: Steffen Bätz +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Reviewed-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Link: https://lore.kernel.org/r/20230329150140.701559-1-festevam@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index a253476a52b01..0b104a90c0d80 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -2611,9 +2611,14 @@ static int mv88e6xxx_setup_port(struct mv88e6xxx_chip *chip, int port) + * If this is the upstream port for this switch, enable + * forwarding of unknown unicasts and multicasts. + */ +- reg = MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP | +- MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP | ++ reg = MV88E6185_PORT_CTL0_USE_TAG | MV88E6185_PORT_CTL0_USE_IP | + MV88E6XXX_PORT_CTL0_STATE_FORWARDING; ++ /* Forward any IPv4 IGMP or IPv6 MLD frames received ++ * by a USER port to the CPU port to allow snooping. ++ */ ++ if (dsa_is_user_port(ds, port)) ++ reg |= MV88E6XXX_PORT_CTL0_IGMP_MLD_SNOOP; ++ + err = mv88e6xxx_port_write(chip, port, MV88E6XXX_PORT_CTL0, reg); + if (err) + return err; +-- +2.39.2 + diff --git a/queue-5.10/net-ipa-compute-dma-pool-size-properly.patch b/queue-5.10/net-ipa-compute-dma-pool-size-properly.patch new file mode 100644 index 00000000000..fe9f0df15fe --- /dev/null +++ b/queue-5.10/net-ipa-compute-dma-pool-size-properly.patch @@ -0,0 +1,56 @@ +From 2266be3f73dedb2a13cafa02a1022981bb4956ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Mar 2023 11:27:51 -0500 +Subject: net: ipa: compute DMA pool size properly + +From: Alex Elder + +[ Upstream commit 6c75dc94f2b27fff57b305af9236eea181a00b6c ] + +In gsi_trans_pool_init_dma(), the total size of a pool of memory +used for DMA transactions is calculated. However the calculation is +done incorrectly. + +For 4KB pages, this total size is currently always more than one +page, and as a result, the calculation produces a positive (though +incorrect) total size. The code still works in this case; we just +end up with fewer DMA pool entries than we intended. + +Bjorn Andersson tested booting a kernel with 16KB pages, and hit a +null pointer derereference in sg_alloc_append_table_from_pages(), +descending from gsi_trans_pool_init_dma(). The cause of this was +that a 16KB total size was going to be allocated, and with 16KB +pages the order of that allocation is 0. The total_size calculation +yielded 0, which eventually led to the crash. + +Correcting the total_size calculation fixes the problem. + +Reported-by: Bjorn Andersson +Tested-by: Bjorn Andersson +Fixes: 9dd441e4ed57 ("soc: qcom: ipa: GSI transactions") +Reviewed-by: Mark Bloch +Signed-off-by: Alex Elder +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20230328162751.2861791-1-elder@linaro.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ipa/gsi_trans.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ipa/gsi_trans.c b/drivers/net/ipa/gsi_trans.c +index 70c2b585f98d6..1e0d626393012 100644 +--- a/drivers/net/ipa/gsi_trans.c ++++ b/drivers/net/ipa/gsi_trans.c +@@ -159,7 +159,7 @@ int gsi_trans_pool_init_dma(struct device *dev, struct gsi_trans_pool *pool, + * gsi_trans_pool_exit_dma() can assume the total allocated + * size is exactly (count * size). + */ +- total_size = get_order(total_size) << PAGE_SHIFT; ++ total_size = PAGE_SIZE << get_order(total_size); + + virt = dma_alloc_coherent(dev, total_size, &addr, GFP_KERNEL); + if (!virt) +-- +2.39.2 + diff --git a/queue-5.10/net-net_failover-fix-txq-exceeding-warning.patch b/queue-5.10/net-net_failover-fix-txq-exceeding-warning.patch new file mode 100644 index 00000000000..d1d396df600 --- /dev/null +++ b/queue-5.10/net-net_failover-fix-txq-exceeding-warning.patch @@ -0,0 +1,90 @@ +From 514edffe9a013287bb3b425686251fd5b546de6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 17:19:54 +0800 +Subject: net/net_failover: fix txq exceeding warning + +From: Faicker Mo + +[ Upstream commit e3cbdcb0fbb61045ef3ce0e072927cc41737f787 ] + +The failover txq is inited as 16 queues. +when a packet is transmitted from the failover device firstly, +the failover device will select the queue which is returned from +the primary device if the primary device is UP and running. +If the primary device txq is bigger than the default 16, +it can lead to the following warning: +eth0 selects TX queue 18, but real number of TX queues is 16 + +The warning backtrace is: +[ 32.146376] CPU: 18 PID: 9134 Comm: chronyd Tainted: G E 6.2.8-1.el7.centos.x86_64 #1 +[ 32.147175] Hardware name: Red Hat KVM, BIOS 1.10.2-3.el7_4.1 04/01/2014 +[ 32.147730] Call Trace: +[ 32.147971] +[ 32.148183] dump_stack_lvl+0x48/0x70 +[ 32.148514] dump_stack+0x10/0x20 +[ 32.148820] netdev_core_pick_tx+0xb1/0xe0 +[ 32.149180] __dev_queue_xmit+0x529/0xcf0 +[ 32.149533] ? __check_object_size.part.0+0x21c/0x2c0 +[ 32.149967] ip_finish_output2+0x278/0x560 +[ 32.150327] __ip_finish_output+0x1fe/0x2f0 +[ 32.150690] ip_finish_output+0x2a/0xd0 +[ 32.151032] ip_output+0x7a/0x110 +[ 32.151337] ? __pfx_ip_finish_output+0x10/0x10 +[ 32.151733] ip_local_out+0x5e/0x70 +[ 32.152054] ip_send_skb+0x19/0x50 +[ 32.152366] udp_send_skb.isra.0+0x163/0x3a0 +[ 32.152736] udp_sendmsg+0xba8/0xec0 +[ 32.153060] ? __folio_memcg_unlock+0x25/0x60 +[ 32.153445] ? __pfx_ip_generic_getfrag+0x10/0x10 +[ 32.153854] ? sock_has_perm+0x85/0xa0 +[ 32.154190] inet_sendmsg+0x6d/0x80 +[ 32.154508] ? inet_sendmsg+0x6d/0x80 +[ 32.154838] sock_sendmsg+0x62/0x70 +[ 32.155152] ____sys_sendmsg+0x134/0x290 +[ 32.155499] ___sys_sendmsg+0x81/0xc0 +[ 32.155828] ? _get_random_bytes.part.0+0x79/0x1a0 +[ 32.156240] ? ip4_datagram_release_cb+0x5f/0x1e0 +[ 32.156649] ? get_random_u16+0x69/0xf0 +[ 32.156989] ? __fget_light+0xcf/0x110 +[ 32.157326] __sys_sendmmsg+0xc4/0x210 +[ 32.157657] ? __sys_connect+0xb7/0xe0 +[ 32.157995] ? __audit_syscall_entry+0xce/0x140 +[ 32.158388] ? syscall_trace_enter.isra.0+0x12c/0x1a0 +[ 32.158820] __x64_sys_sendmmsg+0x24/0x30 +[ 32.159171] do_syscall_64+0x38/0x90 +[ 32.159493] entry_SYSCALL_64_after_hwframe+0x72/0xdc + +Fix that by reducing txq number as the non-existent primary-dev does. + +Fixes: cfc80d9a1163 ("net: Introduce net_failover driver") +Signed-off-by: Faicker Mo +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/net_failover.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/net_failover.c b/drivers/net/net_failover.c +index fb182bec8f062..6b7bba720d8c7 100644 +--- a/drivers/net/net_failover.c ++++ b/drivers/net/net_failover.c +@@ -130,14 +130,10 @@ static u16 net_failover_select_queue(struct net_device *dev, + txq = ops->ndo_select_queue(primary_dev, skb, sb_dev); + else + txq = netdev_pick_tx(primary_dev, skb, NULL); +- +- qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping; +- +- return txq; ++ } else { ++ txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0; + } + +- txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0; +- + /* Save the original txq to restore before passing to the driver */ + qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping; + +-- +2.39.2 + diff --git a/queue-5.10/net-stmmac-don-t-reject-vlans-when-iff_promisc-is-se.patch b/queue-5.10/net-stmmac-don-t-reject-vlans-when-iff_promisc-is-se.patch new file mode 100644 index 00000000000..53bdab5df0b --- /dev/null +++ b/queue-5.10/net-stmmac-don-t-reject-vlans-when-iff_promisc-is-se.patch @@ -0,0 +1,289 @@ +From 6da259d0b55fb5c59835d224ca1c753eb8f1ac63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Mar 2023 13:28:15 +0200 +Subject: net: stmmac: don't reject VLANs when IFF_PROMISC is set + +From: Vladimir Oltean + +[ Upstream commit a7602e7332b97cfbec7bacb0f1ade99a575fe104 ] + +The blamed commit has introduced the following tests to +dwmac4_add_hw_vlan_rx_fltr(), called from stmmac_vlan_rx_add_vid(): + + if (hw->promisc) { + netdev_err(dev, + "Adding VLAN in promisc mode not supported\n"); + return -EPERM; + } + +"VLAN promiscuous" mode is keyed in this driver to IFF_PROMISC, and so, +vlan_vid_add() and vlan_vid_del() calls cannot take place in IFF_PROMISC +mode. I have the following 2 arguments that this restriction is.... hm, +how shall I put it nicely... unproductive :) + +First, take the case of a Linux bridge. If the kernel is compiled with +CONFIG_BRIDGE_VLAN_FILTERING=y, then this bridge shall have a VLAN +database. The bridge shall try to call vlan_add_vid() on its bridge +ports for each VLAN in the VLAN table. It will do this irrespectively of +whether that port is *currently* VLAN-aware or not. So it will do this +even when the bridge was created with vlan_filtering 0. +But the Linux bridge, in VLAN-unaware mode, configures its ports in +promiscuous (IFF_PROMISC) mode, so that they accept packets with any +MAC DA (a switch must do this in order to forward those packets which +are not directly targeted to its MAC address). + +As a result, the stmmac driver does not work as a bridge port, when the +kernel is compiled with CONFIG_BRIDGE_VLAN_FILTERING=y. + +$ ip link add br0 type bridge && ip link set br0 up +$ ip link set eth0 master br0 && ip link set eth0 up +[ 2333.943296] br0: port 1(eth0) entered blocking state +[ 2333.943381] br0: port 1(eth0) entered disabled state +[ 2333.943782] device eth0 entered promiscuous mode +[ 2333.944080] 4033c000.ethernet eth0: Adding VLAN in promisc mode not supported +[ 2333.976509] 4033c000.ethernet eth0: failed to initialize vlan filtering on this port +RTNETLINK answers: Operation not permitted + +Secondly, take the case of stmmac as DSA master. Some switch tagging +protocols are based on 802.1Q VLANs (tag_sja1105.c), and as such, +tag_8021q.c uses vlan_vid_add() to work with VLAN-filtering DSA masters. +But also, when a DSA port becomes promiscuous (for example when it joins +a bridge), the DSA framework also makes the DSA master promiscuous. + +Moreover, for every VLAN that a DSA switch sends to the CPU, DSA also +programs a VLAN filter on the DSA master, because if the the DSA switch +uses a tail tag, then the hardware frame parser of the DSA master will +see VLAN as VLAN, and might filter them out, for being unknown. + +Due to the above 2 reasons, my belief is that the stmmac driver does not +get to choose to not accept vlan_vid_add() calls while IFF_PROMISC is +enabled, because the 2 are completely independent and there are code +paths in the network stack which directly lead to this situation +occurring, without the user's direct input. + +In fact, my belief is that "VLAN promiscuous" mode should have never +been keyed on IFF_PROMISC in the first place, but rather, on the +NETIF_F_HW_VLAN_CTAG_FILTER feature flag which can be toggled by the +user through ethtool -k, when present in netdev->hw_features. + +In the stmmac driver, NETIF_F_HW_VLAN_CTAG_FILTER is only present in +"features", making this feature "on [fixed]". + +I have this belief because I am unaware of any definition of promiscuity +which implies having an effect on anything other than MAC DA (therefore +not VLAN). However, I seem to be rather alone in having this opinion, +looking back at the disagreements from this discussion: +https://lore.kernel.org/netdev/20201110153958.ci5ekor3o2ekg3ky@ipetronik.com/ + +In any case, to remove the vlan_vid_add() dependency on !IFF_PROMISC, +one would need to remove the check and see what fails. I guess the test +was there because of the way in which dwmac4_vlan_promisc_enable() is +implemented. + +For context, the dwmac4 supports Perfect Filtering for a limited number +of VLANs - dwmac4_get_num_vlan(), priv->hw->num_vlan, with a fallback on +Hash Filtering - priv->dma_cap.vlhash - see stmmac_vlan_update(), also +visible in cat /sys/kernel/debug/stmmaceth/eth0/dma_cap | grep 'VLAN +Hash Filtering'. + +The perfect filtering is based on MAC_VLAN_Tag_Filter/MAC_VLAN_Tag_Data +registers, accessed in the driver through dwmac4_write_vlan_filter(). + +The hash filtering is based on the MAC_VLAN_Hash_Table register, named +GMAC_VLAN_HASH_TABLE in the driver and accessed by dwmac4_update_vlan_hash(). +The control bit for enabling hash filtering is GMAC_VLAN_VTHM +(MAC_VLAN_Tag_Ctrl bit VTHM: VLAN Tag Hash Table Match Enable). + +Now, the description of dwmac4_vlan_promisc_enable() is that it iterates +through the driver's cache of perfect filter entries (hw->vlan_filter[i], +added by dwmac4_add_hw_vlan_rx_fltr()), and evicts them from hardware by +unsetting their GMAC_VLAN_TAG_DATA_VEN (MAC_VLAN_Tag_Data bit VEN - VLAN +Tag Enable) bit. Then it unsets the GMAC_VLAN_VTHM bit, which disables +hash matching. + +This leaves the MAC, according to table "VLAN Match Status" from the +documentation, to always enter these data paths: + +VID |VLAN Perfect Filter |VTHM Bit |VLAN Hash Filter |Final VLAN Match + |Match Result | |Match Result |Status +-------|--------------------|---------|-----------------|---------------- +VID!=0 |Fail |0 |don't care |Pass + +So, dwmac4_vlan_promisc_enable() does its job, but by unsetting +GMAC_VLAN_VTHM, it conflicts with the other code path which controls +this bit: dwmac4_update_vlan_hash(), called through stmmac_update_vlan_hash() +from stmmac_vlan_rx_add_vid() and from stmmac_vlan_rx_kill_vid(). +This is, I guess, why dwmac4_add_hw_vlan_rx_fltr() is not allowed to run +after dwmac4_vlan_promisc_enable() has unset GMAC_VLAN_VTHM: because if +it did, then dwmac4_update_vlan_hash() would set GMAC_VLAN_VTHM again, +breaking the "VLAN promiscuity". + +It turns out that dwmac4_vlan_promisc_enable() is way too complicated +for what needs to be done. The MAC_Packet_Filter register also has the +VTFE bit (VLAN Tag Filter Enable), which simply controls whether VLAN +tagged packets which don't match the filtering tables (either perfect or +hash) are dropped or not. At the moment, this driver unconditionally +sets GMAC_PACKET_FILTER_VTFE if NETIF_F_HW_VLAN_CTAG_FILTER was detected +through the priv->dma_cap.vlhash capability bits of the device, in +stmmac_dvr_probe(). + +I would suggest deleting the unnecessarily complex logic from +dwmac4_vlan_promisc_enable(), and simply unsetting GMAC_PACKET_FILTER_VTFE +when becoming IFF_PROMISC, which has the same effect of allowing packets +with any VLAN tags, but has the additional benefit of being able to run +concurrently with stmmac_vlan_rx_add_vid() and stmmac_vlan_rx_kill_vid(). + +As much as I believe that the VTFE bit should have been exclusively +controlled by NETIF_F_HW_VLAN_CTAG_FILTER through ethtool, and not by +IFF_PROMISC, changing that is not a punctual fix to the problem, and it +would probably break the VFFQ feature added by the later commit +e0f9956a3862 ("net: stmmac: Add option for VLAN filter fail queue +enable"). From the commit description, VFFQ needs IFF_PROMISC=on and +VTFE=off in order to work (and this change respects that). But if VTFE +was changed to be controlled through ethtool -k, then a user-visible +change would have been introduced in Intel's scripts (a need to run +"ethtool -k eth0 rx-vlan-filter off" which did not exist before). + +The patch was tested with this set of commands: + + ip link set eth0 up + ip link add link eth0 name eth0.100 type vlan id 100 + ip addr add 192.168.100.2/24 dev eth0.100 && ip link set eth0.100 up + ip link set eth0 promisc on + ip link add link eth0 name eth0.101 type vlan id 101 + ip addr add 192.168.101.2/24 dev eth0.101 && ip link set eth0.101 up + ip link set eth0 promisc off + ping -c 5 192.168.100.1 + ping -c 5 192.168.101.1 + ip link set eth0 promisc on + ping -c 5 192.168.100.1 + ping -c 5 192.168.101.1 + ip link del eth0.100 + ip link del eth0.101 + # Wait for VLAN-tagged pings from the other end... + # Check with "tcpdump -i eth0 -e -n -p" and we should see them + ip link set eth0 promisc off + # Wait for VLAN-tagged pings from the other end... + # Check with "tcpdump -i eth0 -e -n -p" and we shouldn't see them + # anymore, but remove the "-p" argument from tcpdump and they're there. + +Fixes: c89f44ff10fd ("net: stmmac: Add support for VLAN promiscuous mode") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/common.h | 1 - + .../net/ethernet/stmicro/stmmac/dwmac4_core.c | 61 +------------------ + 2 files changed, 3 insertions(+), 59 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h +index df7de50497a0d..af43035239297 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -480,7 +480,6 @@ struct mac_device_info { + unsigned int xlgmac; + unsigned int num_vlan; + u32 vlan_filter[32]; +- unsigned int promisc; + bool vlan_fail_q_en; + u8 vlan_fail_q; + }; +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index 5b052fdd2696e..cd11be005390b 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -453,12 +453,6 @@ static int dwmac4_add_hw_vlan_rx_fltr(struct net_device *dev, + if (vid > 4095) + return -EINVAL; + +- if (hw->promisc) { +- netdev_err(dev, +- "Adding VLAN in promisc mode not supported\n"); +- return -EPERM; +- } +- + /* Single Rx VLAN Filter */ + if (hw->num_vlan == 1) { + /* For single VLAN filter, VID 0 means VLAN promiscuous */ +@@ -508,12 +502,6 @@ static int dwmac4_del_hw_vlan_rx_fltr(struct net_device *dev, + { + int i, ret = 0; + +- if (hw->promisc) { +- netdev_err(dev, +- "Deleting VLAN in promisc mode not supported\n"); +- return -EPERM; +- } +- + /* Single Rx VLAN Filter */ + if (hw->num_vlan == 1) { + if ((hw->vlan_filter[0] & GMAC_VLAN_TAG_VID) == vid) { +@@ -538,39 +526,6 @@ static int dwmac4_del_hw_vlan_rx_fltr(struct net_device *dev, + return ret; + } + +-static void dwmac4_vlan_promisc_enable(struct net_device *dev, +- struct mac_device_info *hw) +-{ +- void __iomem *ioaddr = hw->pcsr; +- u32 value; +- u32 hash; +- u32 val; +- int i; +- +- /* Single Rx VLAN Filter */ +- if (hw->num_vlan == 1) { +- dwmac4_write_single_vlan(dev, 0); +- return; +- } +- +- /* Extended Rx VLAN Filter Enable */ +- for (i = 0; i < hw->num_vlan; i++) { +- if (hw->vlan_filter[i] & GMAC_VLAN_TAG_DATA_VEN) { +- val = hw->vlan_filter[i] & ~GMAC_VLAN_TAG_DATA_VEN; +- dwmac4_write_vlan_filter(dev, hw, i, val); +- } +- } +- +- hash = readl(ioaddr + GMAC_VLAN_HASH_TABLE); +- if (hash & GMAC_VLAN_VLHT) { +- value = readl(ioaddr + GMAC_VLAN_TAG); +- if (value & GMAC_VLAN_VTHM) { +- value &= ~GMAC_VLAN_VTHM; +- writel(value, ioaddr + GMAC_VLAN_TAG); +- } +- } +-} +- + static void dwmac4_restore_hw_vlan_rx_fltr(struct net_device *dev, + struct mac_device_info *hw) + { +@@ -690,22 +645,12 @@ static void dwmac4_set_filter(struct mac_device_info *hw, + } + + /* VLAN filtering */ +- if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER) ++ if (dev->flags & IFF_PROMISC && !hw->vlan_fail_q_en) ++ value &= ~GMAC_PACKET_FILTER_VTFE; ++ else if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER) + value |= GMAC_PACKET_FILTER_VTFE; + + writel(value, ioaddr + GMAC_PACKET_FILTER); +- +- if (dev->flags & IFF_PROMISC && !hw->vlan_fail_q_en) { +- if (!hw->promisc) { +- hw->promisc = 1; +- dwmac4_vlan_promisc_enable(dev, hw); +- } +- } else { +- if (hw->promisc) { +- hw->promisc = 0; +- dwmac4_restore_hw_vlan_rx_fltr(dev, hw); +- } +- } + } + + static void dwmac4_flow_ctrl(struct mac_device_info *hw, unsigned int duplex, +-- +2.39.2 + diff --git a/queue-5.10/ptp_qoriq-fix-memory-leak-in-probe.patch b/queue-5.10/ptp_qoriq-fix-memory-leak-in-probe.patch new file mode 100644 index 00000000000..19f08974b5d --- /dev/null +++ b/queue-5.10/ptp_qoriq-fix-memory-leak-in-probe.patch @@ -0,0 +1,46 @@ +From 31f46ab079f11940c34a93417a2e75c68cc5b1fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 11:14:06 +0800 +Subject: ptp_qoriq: fix memory leak in probe() + +From: SongJingyi + +[ Upstream commit f33642224e38d7e0d59336e10e7b4e370b1c4506 ] + +Smatch complains that: +drivers/ptp/ptp_qoriq.c ptp_qoriq_probe() +warn: 'base' from ioremap() not released. + +Fix this by revising the parameter from 'ptp_qoriq->base' to 'base'. +This is only a bug if ptp_qoriq_init() returns on the +first -ENODEV error path. +For other error paths ptp_qoriq->base and base are the same. +And this change makes the code more readable. + +Fixes: 7f4399ba405b ("ptp_qoriq: fix NULL access if ptp dt node missing") +Signed-off-by: SongJingyi +Reviewed-by: Dan Carpenter +Reviewed-by: Dongliang Mu +Link: https://lore.kernel.org/r/20230324031406.1895159-1-u201912584@hust.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_qoriq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ptp/ptp_qoriq.c b/drivers/ptp/ptp_qoriq.c +index 08f4cf0ad9e3c..8fa9772acf79b 100644 +--- a/drivers/ptp/ptp_qoriq.c ++++ b/drivers/ptp/ptp_qoriq.c +@@ -601,7 +601,7 @@ static int ptp_qoriq_probe(struct platform_device *dev) + return 0; + + no_clock: +- iounmap(ptp_qoriq->base); ++ iounmap(base); + no_ioremap: + release_resource(ptp_qoriq->rsrc); + no_resource: +-- +2.39.2 + diff --git a/queue-5.10/r8169-fix-rtl8168h-and-rtl8107e-rx-crc-error.patch b/queue-5.10/r8169-fix-rtl8168h-and-rtl8107e-rx-crc-error.patch new file mode 100644 index 00000000000..1a50ee0edbd --- /dev/null +++ b/queue-5.10/r8169-fix-rtl8168h-and-rtl8107e-rx-crc-error.patch @@ -0,0 +1,42 @@ +From 859e4ce6c651c4c741447defc2c990b1598d89cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 22:33:09 +0800 +Subject: r8169: fix RTL8168H and RTL8107E rx crc error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: ChunHao Lin + +[ Upstream commit 33189f0a94b9639c058781fcf82e4ea3803b1682 ] + +When link speed is 10 Mbps and temperature is under -20°C, RTL8168H and +RTL8107E may have rx crc error. Disable phy 10 Mbps pll off to fix this +issue. + +Fixes: 6e1d0b898818 ("r8169:add support for RTL8168H and RTL8107E") +Signed-off-by: ChunHao Lin +Reviewed-by: Heiner Kallweit +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_phy_config.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/realtek/r8169_phy_config.c b/drivers/net/ethernet/realtek/r8169_phy_config.c +index 913d030d73eb4..e18a76f5049fd 100644 +--- a/drivers/net/ethernet/realtek/r8169_phy_config.c ++++ b/drivers/net/ethernet/realtek/r8169_phy_config.c +@@ -970,6 +970,9 @@ static void rtl8168h_2_hw_phy_config(struct rtl8169_private *tp, + /* disable phy pfm mode */ + phy_modify_paged(phydev, 0x0a44, 0x11, BIT(7), 0); + ++ /* disable 10m pll off */ ++ phy_modify_paged(phydev, 0x0a43, 0x10, BIT(0), 0); ++ + rtl8168g_disable_aldps(phydev); + rtl8168g_config_eee_phy(phydev); + } +-- +2.39.2 + diff --git a/queue-5.10/regulator-handle-deferred-clk.patch b/queue-5.10/regulator-handle-deferred-clk.patch new file mode 100644 index 00000000000..b97be7e247d --- /dev/null +++ b/queue-5.10/regulator-handle-deferred-clk.patch @@ -0,0 +1,39 @@ +From e49ee79b52f6a03ec596b2a5d2e77f875449beef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Mar 2023 10:29:33 +0200 +Subject: regulator: Handle deferred clk + +From: Christophe JAILLET + +[ Upstream commit 02bcba0b9f9da706d5bd1e8cbeb83493863e17b5 ] + +devm_clk_get() can return -EPROBE_DEFER. So it is better to return the +error code from devm_clk_get(), instead of a hard coded -ENOENT. + +This gives more opportunities to successfully probe the driver. + +Fixes: 8959e5324485 ("regulator: fixed: add possibility to enable by clock") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/18459fae3d017a66313699c7c8456b28158b2dd0.1679819354.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/fixed.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c +index 3de7709bdcd4c..4acfff1908072 100644 +--- a/drivers/regulator/fixed.c ++++ b/drivers/regulator/fixed.c +@@ -175,7 +175,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev) + drvdata->enable_clock = devm_clk_get(dev, NULL); + if (IS_ERR(drvdata->enable_clock)) { + dev_err(dev, "Can't get enable-clock from devicetree\n"); +- return -ENOENT; ++ return PTR_ERR(drvdata->enable_clock); + } + } else { + drvdata->desc.ops = &fixed_voltage_ops; +-- +2.39.2 + diff --git a/queue-5.10/s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch b/queue-5.10/s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch new file mode 100644 index 00000000000..12e334d1661 --- /dev/null +++ b/queue-5.10/s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch @@ -0,0 +1,48 @@ +From 0c59934184cd8798be105d9d9a984243f2a16c77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Mar 2023 11:04:47 -0400 +Subject: s390/vfio-ap: fix memory leak in vfio_ap device driver + +From: Tony Krowiak + +[ Upstream commit 8f8cf767589f2131ae5d40f3758429095c701c84 ] + +The device release callback function invoked to release the matrix device +uses the dev_get_drvdata(device *dev) function to retrieve the +pointer to the vfio_matrix_dev object in order to free its storage. The +problem is, this object is not stored as drvdata with the device; since the +kfree function will accept a NULL pointer, the memory for the +vfio_matrix_dev object is never freed. + +Since the device being released is contained within the vfio_matrix_dev +object, the container_of macro will be used to retrieve its pointer. + +Fixes: 1fde573413b5 ("s390: vfio-ap: base implementation of VFIO AP device driver") +Signed-off-by: Tony Krowiak +Reviewed-by: Harald Freudenberger +Link: https://lore.kernel.org/r/20230320150447.34557-1-akrowiak@linux.ibm.com +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + drivers/s390/crypto/vfio_ap_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/s390/crypto/vfio_ap_drv.c b/drivers/s390/crypto/vfio_ap_drv.c +index 7dc72cb718b0e..22128eb44f7fa 100644 +--- a/drivers/s390/crypto/vfio_ap_drv.c ++++ b/drivers/s390/crypto/vfio_ap_drv.c +@@ -82,8 +82,9 @@ static void vfio_ap_queue_dev_remove(struct ap_device *apdev) + + static void vfio_ap_matrix_dev_release(struct device *dev) + { +- struct ap_matrix_dev *matrix_dev = dev_get_drvdata(dev); ++ struct ap_matrix_dev *matrix_dev; + ++ matrix_dev = container_of(dev, struct ap_matrix_dev, device); + kfree(matrix_dev); + } + +-- +2.39.2 + diff --git a/queue-5.10/scsi-megaraid_sas-fix-crash-after-a-double-completio.patch b/queue-5.10/scsi-megaraid_sas-fix-crash-after-a-double-completio.patch new file mode 100644 index 00000000000..6a8bb1e101a --- /dev/null +++ b/queue-5.10/scsi-megaraid_sas-fix-crash-after-a-double-completio.patch @@ -0,0 +1,47 @@ +From 7fd8a7cd7b3e728cdd9e2b3e97b152562df3afeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Mar 2023 16:01:34 +0100 +Subject: scsi: megaraid_sas: Fix crash after a double completion + +From: Tomas Henzl + +[ Upstream commit 2309df27111a51734cb9240b4d3c25f2f3c6ab06 ] + +When a physical disk is attached directly "without JBOD MAP support" (see +megasas_get_tm_devhandle()) then there is no real error handling in the +driver. Return FAILED instead of SUCCESS. + +Fixes: 18365b138508 ("megaraid_sas: Task management support") +Signed-off-by: Tomas Henzl +Link: https://lore.kernel.org/r/20230324150134.14696-1-thenzl@redhat.com +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 7838c7911adde..8eb126d48462b 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -4656,7 +4656,7 @@ int megasas_task_abort_fusion(struct scsi_cmnd *scmd) + devhandle = megasas_get_tm_devhandle(scmd->device); + + if (devhandle == (u16)ULONG_MAX) { +- ret = SUCCESS; ++ ret = FAILED; + sdev_printk(KERN_INFO, scmd->device, + "task abort issued for invalid devhandle\n"); + mutex_unlock(&instance->reset_mutex); +@@ -4726,7 +4726,7 @@ int megasas_reset_target_fusion(struct scsi_cmnd *scmd) + devhandle = megasas_get_tm_devhandle(scmd->device); + + if (devhandle == (u16)ULONG_MAX) { +- ret = SUCCESS; ++ ret = FAILED; + sdev_printk(KERN_INFO, scmd->device, + "target reset issued for invalid devhandle\n"); + mutex_unlock(&instance->reset_mutex); +-- +2.39.2 + diff --git a/queue-5.10/series b/queue-5.10/series index 19bff609317..608e566a81e 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -122,3 +122,22 @@ fbdev-lxfb-fix-potential-divide-by-zero.patch fbdev-au1200fb-fix-potential-divide-by-zero.patch tools-power-turbostat-fix-dev-cpu_dma_latency-warnin.patch tracing-fix-wrong-return-in-kprobe_event_gen_test.c.patch +ca8210-fix-unsigned-mac_len-comparison-with-zero-in-.patch +mips-bmips-bcm6358-disable-rac-flush-for-tp1.patch +mtd-rawnand-meson-invalidate-cache-on-polling-ecc-bi.patch +sfc-ef10-don-t-overwrite-offload-features-at-nic-res.patch +scsi-megaraid_sas-fix-crash-after-a-double-completio.patch +ptp_qoriq-fix-memory-leak-in-probe.patch +r8169-fix-rtl8168h-and-rtl8107e-rx-crc-error.patch +regulator-handle-deferred-clk.patch +net-net_failover-fix-txq-exceeding-warning.patch +net-stmmac-don-t-reject-vlans-when-iff_promisc-is-se.patch +can-bcm-bcm_tx_setup-fix-kmsan-uninit-value-in-vfs_w.patch +s390-vfio-ap-fix-memory-leak-in-vfio_ap-device-drive.patch +alsa-ymfpci-fix-assignment-in-if-condition.patch +alsa-ymfpci-fix-bug_on-in-probe-function.patch +net-ipa-compute-dma-pool-size-properly.patch +i40e-fix-registers-dump-after-run-ethtool-adapter-se.patch +bnxt_en-fix-typo-in-pci-id-to-device-description-str.patch +bnxt_en-add-missing-200g-link-speed-reporting.patch +net-dsa-mv88e6xxx-enable-igmp-snooping-on-user-ports.patch diff --git a/queue-5.10/sfc-ef10-don-t-overwrite-offload-features-at-nic-res.patch b/queue-5.10/sfc-ef10-don-t-overwrite-offload-features-at-nic-res.patch new file mode 100644 index 00000000000..96c8aa3e33c --- /dev/null +++ b/queue-5.10/sfc-ef10-don-t-overwrite-offload-features-at-nic-res.patch @@ -0,0 +1,147 @@ +From cc49ac03034d1afce598c2ed6646a1240d107a09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Mar 2023 09:34:17 +0100 +Subject: sfc: ef10: don't overwrite offload features at NIC reset +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit ca4a80e4bb7e87daf33b27d2ab9e4f5311018a89 ] + +At NIC reset, some offload features related to encapsulated traffic +might have changed (this mainly happens if the firmware-variant is +changed with the sfboot userspace tool). Because of this, features are +checked and set again at reset time. + +However, this was not done right, and some features were improperly +overwritten at NIC reset: +- Tunneled IPv6 segmentation was always disabled +- Features disabled with ethtool were reenabled +- Features that becomes unsupported after the reset were not disabled + +Also, checking if the device supports IPV6_CSUM to enable TSO6 is no +longer necessary because all currently supported devices support it. +Additionally, move the assignment of some other features to the +EF10_OFFLOAD_FEATURES macro, like it is done in ef100, leaving the +selection of features in efx_pci_probe_post_io a bit cleaner. + +Fixes: ffffd2454a7a ("sfc: correctly advertise tunneled IPv6 segmentation") +Fixes: 24b2c3751aa3 ("sfc: advertise encapsulated offloads on EF10") +Reported-by: Tianhao Zhao +Suggested-by: Jonathan Cooper +Tested-by: Jonathan Cooper +Signed-off-by: Íñigo Huguet +Acked-by: Edward Cree +Link: https://lore.kernel.org/r/20230323083417.7345-1-ihuguet@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 38 ++++++++++++++++++++++----------- + drivers/net/ethernet/sfc/efx.c | 17 ++++++--------- + 2 files changed, 33 insertions(+), 22 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index eb1be73020822..32654fe1f8b59 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -1304,7 +1304,8 @@ static void efx_ef10_fini_nic(struct efx_nic *efx) + static int efx_ef10_init_nic(struct efx_nic *efx) + { + struct efx_ef10_nic_data *nic_data = efx->nic_data; +- netdev_features_t hw_enc_features = 0; ++ struct net_device *net_dev = efx->net_dev; ++ netdev_features_t tun_feats, tso_feats; + int rc; + + if (nic_data->must_check_datapath_caps) { +@@ -1349,20 +1350,30 @@ static int efx_ef10_init_nic(struct efx_nic *efx) + nic_data->must_restore_piobufs = false; + } + +- /* add encapsulated checksum offload features */ ++ /* encap features might change during reset if fw variant changed */ + if (efx_has_cap(efx, VXLAN_NVGRE) && !efx_ef10_is_vf(efx)) +- hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; +- /* add encapsulated TSO features */ +- if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) { +- netdev_features_t encap_tso_features; ++ net_dev->hw_enc_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; ++ else ++ net_dev->hw_enc_features &= ~(NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM); + +- encap_tso_features = NETIF_F_GSO_UDP_TUNNEL | NETIF_F_GSO_GRE | +- NETIF_F_GSO_UDP_TUNNEL_CSUM | NETIF_F_GSO_GRE_CSUM; ++ tun_feats = NETIF_F_GSO_UDP_TUNNEL | NETIF_F_GSO_GRE | ++ NETIF_F_GSO_UDP_TUNNEL_CSUM | NETIF_F_GSO_GRE_CSUM; ++ tso_feats = NETIF_F_TSO | NETIF_F_TSO6; + +- hw_enc_features |= encap_tso_features | NETIF_F_TSO; +- efx->net_dev->features |= encap_tso_features; ++ if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) { ++ /* If this is first nic_init, or if it is a reset and a new fw ++ * variant has added new features, enable them by default. ++ * If the features are not new, maintain their current value. ++ */ ++ if (!(net_dev->hw_features & tun_feats)) ++ net_dev->features |= tun_feats; ++ net_dev->hw_enc_features |= tun_feats | tso_feats; ++ net_dev->hw_features |= tun_feats; ++ } else { ++ net_dev->hw_enc_features &= ~(tun_feats | tso_feats); ++ net_dev->hw_features &= ~tun_feats; ++ net_dev->features &= ~tun_feats; + } +- efx->net_dev->hw_enc_features = hw_enc_features; + + /* don't fail init if RSS setup doesn't work */ + rc = efx->type->rx_push_rss_config(efx, false, +@@ -3977,7 +3988,10 @@ static unsigned int ef10_check_caps(const struct efx_nic *efx, + NETIF_F_HW_VLAN_CTAG_FILTER | \ + NETIF_F_IPV6_CSUM | \ + NETIF_F_RXHASH | \ +- NETIF_F_NTUPLE) ++ NETIF_F_NTUPLE | \ ++ NETIF_F_SG | \ ++ NETIF_F_RXCSUM | \ ++ NETIF_F_RXALL) + + const struct efx_nic_type efx_hunt_a0_vf_nic_type = { + .is_vf = true, +diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c +index 29c8d2c990044..c069659c9e2d0 100644 +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -1045,21 +1045,18 @@ static int efx_pci_probe_post_io(struct efx_nic *efx) + } + + /* Determine netdevice features */ +- net_dev->features |= (efx->type->offload_features | NETIF_F_SG | +- NETIF_F_TSO | NETIF_F_RXCSUM | NETIF_F_RXALL); +- if (efx->type->offload_features & (NETIF_F_IPV6_CSUM | NETIF_F_HW_CSUM)) { +- net_dev->features |= NETIF_F_TSO6; +- if (efx_has_cap(efx, TX_TSO_V2_ENCAP)) +- net_dev->hw_enc_features |= NETIF_F_TSO6; +- } +- /* Check whether device supports TSO */ +- if (!efx->type->tso_versions || !efx->type->tso_versions(efx)) +- net_dev->features &= ~NETIF_F_ALL_TSO; ++ net_dev->features |= efx->type->offload_features; ++ ++ /* Add TSO features */ ++ if (efx->type->tso_versions && efx->type->tso_versions(efx)) ++ net_dev->features |= NETIF_F_TSO | NETIF_F_TSO6; ++ + /* Mask for features that also apply to VLAN devices */ + net_dev->vlan_features |= (NETIF_F_HW_CSUM | NETIF_F_SG | + NETIF_F_HIGHDMA | NETIF_F_ALL_TSO | + NETIF_F_RXCSUM); + ++ /* Determine user configurable features */ + net_dev->hw_features |= net_dev->features & ~efx->fixed_features; + + /* Disable receiving frames with bad FCS, by default. */ +-- +2.39.2 +