From: Sasha Levin Date: Sun, 22 Aug 2021 02:39:18 +0000 (-0400) Subject: Fixes for 5.13 X-Git-Tag: v5.13.13~23 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1dc916c93753043b5c69c1e023c96717d7642625;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.13 Signed-off-by: Sasha Levin --- diff --git a/queue-5.13/arm64-dts-qcom-c630-fix-correct-powerdown-pin-for-ws.patch b/queue-5.13/arm64-dts-qcom-c630-fix-correct-powerdown-pin-for-ws.patch new file mode 100644 index 00000000000..b5cf3073e1c --- /dev/null +++ b/queue-5.13/arm64-dts-qcom-c630-fix-correct-powerdown-pin-for-ws.patch @@ -0,0 +1,53 @@ +From 49bcaf49bda75e70ca8fd068c3f1548281118a8c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jul 2021 09:35:23 +0100 +Subject: arm64: dts: qcom: c630: fix correct powerdown pin for WSA881x + +From: Srinivas Kandagatla + +[ Upstream commit 9a253bb42f190efd1a1c156939ad7298b3529dca ] + +WSA881x powerdown pin is connected to GPIO1, GPIO2 not GPIO2 and GPIO3, +so correct this. This was working so far due to a shift bug in gpio driver, +however once that is fixed this will stop working, so fix this! + +For some reason we forgot to add this dts change in last merge cycle so +currently audio is broken in 5.13 as the gpio driver fix already landed +in 5.13. + +Reported-by: Shawn Guo +Fixes: 45021d35fcb2 ("arm64: dts: qcom: c630: Enable audio support") +Signed-off-by: Srinivas Kandagatla +Tested-by: Shawn Guo +Link: https://lore.kernel.org/r/20210706083523.10601-1-srinivas.kandagatla@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts +index c2a709a384e9..d7591a4621a2 100644 +--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts ++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts +@@ -700,7 +700,7 @@ + left_spkr: wsa8810-left{ + compatible = "sdw10217211000"; + reg = <0 3>; +- powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>; ++ powerdown-gpios = <&wcdgpio 1 GPIO_ACTIVE_HIGH>; + #thermal-sensor-cells = <0>; + sound-name-prefix = "SpkrLeft"; + #sound-dai-cells = <0>; +@@ -708,7 +708,7 @@ + + right_spkr: wsa8810-right{ + compatible = "sdw10217211000"; +- powerdown-gpios = <&wcdgpio 3 GPIO_ACTIVE_HIGH>; ++ powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>; + reg = <0 4>; + #thermal-sensor-cells = <0>; + sound-name-prefix = "SpkrRight"; +-- +2.30.2 + diff --git a/queue-5.13/arm64-dts-qcom-msm8992-bullhead-fix-cont_splash_mem-.patch b/queue-5.13/arm64-dts-qcom-msm8992-bullhead-fix-cont_splash_mem-.patch new file mode 100644 index 00000000000..68afd9e9d63 --- /dev/null +++ b/queue-5.13/arm64-dts-qcom-msm8992-bullhead-fix-cont_splash_mem-.patch @@ -0,0 +1,54 @@ +From 79de348bb0fa56e51288294d5986d6b0350825e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 20:57:34 +0200 +Subject: arm64: dts: qcom: msm8992-bullhead: Fix cont_splash_mem mapping + +From: Petr Vorel + +[ Upstream commit 3cb6a271f4b04f11270111638c24fa5c0b846dec ] + +cont_splash_mem has different memory mapping than generic from msm8994.dtsi: + +[ 0.000000] cma: Found cont_splash_mem@0, memory base 0x0000000003400000, size 12 MiB, limit 0xffffffffffffffff +[ 0.000000] cma: CMA: reserved 12 MiB at 0x0000000003400000 for cont_splash_mem + +This fixes boot. + +Fixes: 976d321f32dc ("arm64: dts: qcom: msm8992: Make the DT an overlay on top of 8994") +Signed-off-by: Petr Vorel +Link: https://lore.kernel.org/r/20210713185734.380-3-petr.vorel@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +index 5c6e17f11ee9..1ccca83292ac 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +@@ -10,6 +10,9 @@ + #include "pm8994.dtsi" + #include "pmi8994.dtsi" + ++/* cont_splash_mem has different memory mapping */ ++/delete-node/ &cont_splash_mem; ++ + / { + model = "LG Nexus 5X"; + compatible = "lg,bullhead", "qcom,msm8992"; +@@ -42,6 +45,11 @@ + ftrace-size = <0x10000>; + pmsg-size = <0x20000>; + }; ++ ++ cont_splash_mem: memory@3400000 { ++ reg = <0 0x03400000 0 0x1200000>; ++ no-map; ++ }; + }; + }; + +-- +2.30.2 + diff --git a/queue-5.13/arm64-dts-qcom-msm8992-bullhead-remove-psci.patch b/queue-5.13/arm64-dts-qcom-msm8992-bullhead-remove-psci.patch new file mode 100644 index 00000000000..dd7d1c80f16 --- /dev/null +++ b/queue-5.13/arm64-dts-qcom-msm8992-bullhead-remove-psci.patch @@ -0,0 +1,46 @@ +From ae08d4013dbd6a7247fc704079e9827b9534e1df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 20:57:33 +0200 +Subject: arm64: dts: qcom: msm8992-bullhead: Remove PSCI + +From: Petr Vorel + +[ Upstream commit 9d1fc2e4f5a94a492c7dd1ca577c66fdb7571c84 ] + +Bullhead firmware obviously doesn't support PSCI as it fails to boot +with this definition. + +Fixes: 329e16d5f8fc ("arm64: dts: qcom: msm8992: Add PSCI support.") +Signed-off-by: Petr Vorel +Link: https://lore.kernel.org/r/20210713185734.380-2-petr.vorel@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +index 23cdcc9f7c72..5c6e17f11ee9 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* Copyright (c) 2015, LGE Inc. All rights reserved. + * Copyright (c) 2016, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2021, Petr Vorel + */ + + /dts-v1/; +@@ -17,6 +18,9 @@ + qcom,board-id = <0xb64 0>; + qcom,pmic-id = <0x10009 0x1000A 0x0 0x0>; + ++ /* Bullhead firmware doesn't support PSCI */ ++ /delete-node/ psci; ++ + aliases { + serial0 = &blsp1_uart2; + }; +-- +2.30.2 + diff --git a/queue-5.13/arm64-dts-qcom-msm8994-angler-disable-cont_splash_me.patch b/queue-5.13/arm64-dts-qcom-msm8994-angler-disable-cont_splash_me.patch new file mode 100644 index 00000000000..5e2fbab39af --- /dev/null +++ b/queue-5.13/arm64-dts-qcom-msm8994-angler-disable-cont_splash_me.patch @@ -0,0 +1,60 @@ +From 0e8c4e559b67a02185c6b56c0f079ef1a3205457 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 21:10:19 +0200 +Subject: arm64: dts: qcom: msm8994-angler: Disable cont_splash_mem + +From: Petr Vorel + +[ Upstream commit 0e5ded926f2a0f8b57dfa7f0d69a30767e1ea2ce ] + +As the default definition breaks booting angler: +[ 1.862561] printk: console [ttyMSM0] enabled +[ 1.872260] msm_serial: driver initialized +D - 15524 - pm_driver_init, Delta + +cont_splash_mem was introduced in 74d6d0a145835, but the problem +manifested after commit '86588296acbf ("fdt: Properly handle "no-map" +field in the memory region")'. + +Disabling it because Angler's firmware does not report where the memory +is allocated (dmesg from downstream kernel): +[ 0.000000] cma: Found cont_splash_mem@0, memory base 0x0000000000000000, size 16 MiB, limit 0x0000000000000000 +[ 0.000000] cma: CMA: reserved 16 MiB at 0x0000000000000000 for cont_splash_mem + +Similar issue might be on Google Nexus 5X (lg-bullhead). Other MSM8992/4 +are known to report correct address. + +Fixes: 74d6d0a145835 ("arm64: dts: qcom: msm8994/8994-kitakami: Fix up the memory map") +Suggested-by: Konrad Dybcio +Signed-off-by: Petr Vorel +Link: https://lore.kernel.org/r/20210622191019.23771-1-petr.vorel@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts +index baa55643b40f..801995af3dfc 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts +@@ -1,12 +1,16 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* Copyright (c) 2015, Huawei Inc. All rights reserved. + * Copyright (c) 2016, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2021, Petr Vorel + */ + + /dts-v1/; + + #include "msm8994.dtsi" + ++/* Angler's firmware does not report where the memory is allocated */ ++/delete-node/ &cont_splash_mem; ++ + / { + model = "Huawei Nexus 6P"; + compatible = "huawei,angler", "qcom,msm8994"; +-- +2.30.2 + diff --git a/queue-5.13/arm64-dts-qcom-sdm845-oneplus-fix-reserved-mem.patch b/queue-5.13/arm64-dts-qcom-sdm845-oneplus-fix-reserved-mem.patch new file mode 100644 index 00000000000..a9c87f2cfd7 --- /dev/null +++ b/queue-5.13/arm64-dts-qcom-sdm845-oneplus-fix-reserved-mem.patch @@ -0,0 +1,48 @@ +From 06b6ac0803817885428e97639c4515c5c8db96bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Jul 2021 15:33:38 +0000 +Subject: arm64: dts: qcom: sdm845-oneplus: fix reserved-mem + +From: Caleb Connolly + +[ Upstream commit d77c95bf9a64d8620662151b2b10efd8221f4bcc ] + +Fix the upper guard and the "removed_region", this fixes the random +crashes which used to occur in memory intensive loads. I'm not sure WHY +the upper guard being 0x2000 instead of 0x1000 doesn't fix this, but it +HAS to be 0x1000. + +Fixes: e60fd5ac1f68 ("arm64: dts: qcom: sdm845-oneplus-common: guard rmtfs-mem") +Signed-off-by: Caleb Connolly +Link: https://lore.kernel.org/r/20210720153125.43389-2-caleb@connolly.tech +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi +index f712771df0c7..846eebebd831 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845-oneplus-common.dtsi +@@ -69,7 +69,7 @@ + }; + rmtfs_upper_guard: memory@f5d01000 { + no-map; +- reg = <0 0xf5d01000 0 0x2000>; ++ reg = <0 0xf5d01000 0 0x1000>; + }; + + /* +@@ -78,7 +78,7 @@ + */ + removed_region: memory@88f00000 { + no-map; +- reg = <0 0x88f00000 0 0x200000>; ++ reg = <0 0x88f00000 0 0x1c00000>; + }; + + ramoops: ramoops@ac300000 { +-- +2.30.2 + diff --git a/queue-5.13/bnxt-count-tx-drops.patch b/queue-5.13/bnxt-count-tx-drops.patch new file mode 100644 index 00000000000..085078d33d4 --- /dev/null +++ b/queue-5.13/bnxt-count-tx-drops.patch @@ -0,0 +1,43 @@ +From a6f804dcee06114d515767bd4b3f6e3d6d8e0d88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:42:42 -0700 +Subject: bnxt: count Tx drops + +From: Jakub Kicinski + +[ Upstream commit fb9f7190092d2bbd1f8f0b1cc252732cbe99a87e ] + +Drivers should count packets they are dropping. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reviewed-by: Michael Chan +Reviewed-by: Edwin Peer +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index ea67c8c07a8b..a30ded73bba1 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -409,6 +409,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + i = skb_get_queue_mapping(skb); + if (unlikely(i >= bp->tx_nr_rings)) { + dev_kfree_skb_any(skb); ++ atomic_long_inc(&dev->tx_dropped); + return NETDEV_TX_OK; + } + +@@ -663,6 +664,7 @@ tx_kick_pending: + if (txr->kick_pending) + bnxt_txr_db_kick(bp, txr, txr->tx_prod); + txr->tx_buf_ring[txr->tx_prod].skb = NULL; ++ atomic_long_inc(&dev->tx_dropped); + return NETDEV_TX_OK; + } + +-- +2.30.2 + diff --git a/queue-5.13/bnxt-disable-napi-before-canceling-dim.patch b/queue-5.13/bnxt-disable-napi-before-canceling-dim.patch new file mode 100644 index 00000000000..ae23fd653ac --- /dev/null +++ b/queue-5.13/bnxt-disable-napi-before-canceling-dim.patch @@ -0,0 +1,43 @@ +From be11f5a1d0ca152eb79926391b4c2398be1fbce9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:42:40 -0700 +Subject: bnxt: disable napi before canceling DIM + +From: Jakub Kicinski + +[ Upstream commit 01cca6b9330ac7460de44eeeb3a0607f8aae69ff ] + +napi schedules DIM, napi has to be disabled first, +then DIM canceled. + +Noticed while reading the code. + +Fixes: 0bc0b97fca73 ("bnxt_en: cleanup DIM work on device shutdown") +Fixes: 6a8788f25625 ("bnxt_en: add support for software dynamic interrupt moderation") +Reviewed-by: Michael Chan +Reviewed-by: Edwin Peer +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index d0b3be7b1c1a..17ee5c436069 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -9024,10 +9024,9 @@ static void bnxt_disable_napi(struct bnxt *bp) + for (i = 0; i < bp->cp_nr_rings; i++) { + struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring; + ++ napi_disable(&bp->bnapi[i]->napi); + if (bp->bnapi[i]->rx_ring) + cancel_work_sync(&cpr->dim.work); +- +- napi_disable(&bp->bnapi[i]->napi); + } + } + +-- +2.30.2 + diff --git a/queue-5.13/bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch b/queue-5.13/bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch new file mode 100644 index 00000000000..f5e9e83bda7 --- /dev/null +++ b/queue-5.13/bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch @@ -0,0 +1,141 @@ +From 141e6866975bd90173325522bb449d74973c42d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:42:39 -0700 +Subject: bnxt: don't lock the tx queue from napi poll + +From: Jakub Kicinski + +[ Upstream commit 3c603136c9f82833813af77185618de5af67676c ] + +We can't take the tx lock from the napi poll routine, because +netpoll can poll napi at any moment, including with the tx lock +already held. + +The tx lock is protecting against two paths - the disable +path, and (as Michael points out) the NETDEV_TX_BUSY case +which may occur if NAPI completions race with start_xmit +and both decide to re-enable the queue. + +For the disable/ifdown path use synchronize_net() to make sure +closing the device does not race we restarting the queues. +Annotate accesses to dev_state against data races. + +For the NAPI cleanup vs start_xmit path - appropriate barriers +are already in place in the main spot where Tx queue is stopped +but we need to do the same careful dance in the TX_BUSY case. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reviewed-by: Michael Chan +Reviewed-by: Edwin Peer +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 54 ++++++++++++++--------- + 1 file changed, 32 insertions(+), 22 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 3c3aa9467310..d0b3be7b1c1a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -362,6 +362,26 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb) + return md_dst->u.port_info.port_id; + } + ++static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp, ++ struct bnxt_tx_ring_info *txr, ++ struct netdev_queue *txq) ++{ ++ netif_tx_stop_queue(txq); ++ ++ /* netif_tx_stop_queue() must be done before checking ++ * tx index in bnxt_tx_avail() below, because in ++ * bnxt_tx_int(), we update tx index before checking for ++ * netif_tx_queue_stopped(). ++ */ ++ smp_mb(); ++ if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) { ++ netif_tx_wake_queue(txq); ++ return false; ++ } ++ ++ return true; ++} ++ + static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct bnxt *bp = netdev_priv(dev); +@@ -390,8 +410,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + free_size = bnxt_tx_avail(bp, txr); + if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) { +- netif_tx_stop_queue(txq); +- return NETDEV_TX_BUSY; ++ if (bnxt_txr_netif_try_stop_queue(bp, txr, txq)) ++ return NETDEV_TX_BUSY; + } + + length = skb->len; +@@ -605,16 +625,7 @@ tx_done: + if (netdev_xmit_more() && !tx_buf->is_push) + bnxt_db_write(bp, &txr->tx_db, prod); + +- netif_tx_stop_queue(txq); +- +- /* netif_tx_stop_queue() must be done before checking +- * tx index in bnxt_tx_avail() below, because in +- * bnxt_tx_int(), we update tx index before checking for +- * netif_tx_queue_stopped(). +- */ +- smp_mb(); +- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) +- netif_tx_wake_queue(txq); ++ bnxt_txr_netif_try_stop_queue(bp, txr, txq); + } + return NETDEV_TX_OK; + +@@ -698,14 +709,9 @@ next_tx_int: + smp_mb(); + + if (unlikely(netif_tx_queue_stopped(txq)) && +- (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)) { +- __netif_tx_lock(txq, smp_processor_id()); +- if (netif_tx_queue_stopped(txq) && +- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && +- txr->dev_state != BNXT_DEV_STATE_CLOSING) +- netif_tx_wake_queue(txq); +- __netif_tx_unlock(txq); +- } ++ bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && ++ READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING) ++ netif_tx_wake_queue(txq); + } + + static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping, +@@ -9055,9 +9061,11 @@ void bnxt_tx_disable(struct bnxt *bp) + if (bp->tx_ring) { + for (i = 0; i < bp->tx_nr_rings; i++) { + txr = &bp->tx_ring[i]; +- txr->dev_state = BNXT_DEV_STATE_CLOSING; ++ WRITE_ONCE(txr->dev_state, BNXT_DEV_STATE_CLOSING); + } + } ++ /* Make sure napi polls see @dev_state change */ ++ synchronize_net(); + /* Drop carrier first to prevent TX timeout */ + netif_carrier_off(bp->dev); + /* Stop all TX queues */ +@@ -9071,8 +9079,10 @@ void bnxt_tx_enable(struct bnxt *bp) + + for (i = 0; i < bp->tx_nr_rings; i++) { + txr = &bp->tx_ring[i]; +- txr->dev_state = 0; ++ WRITE_ONCE(txr->dev_state, 0); + } ++ /* Make sure napi polls see @dev_state change */ ++ synchronize_net(); + netif_tx_wake_all_queues(bp->dev); + if (bp->link_info.link_up) + netif_carrier_on(bp->dev); +-- +2.30.2 + diff --git a/queue-5.13/bnxt-make-sure-xmit_more-errors-does-not-miss-doorbe.patch b/queue-5.13/bnxt-make-sure-xmit_more-errors-does-not-miss-doorbe.patch new file mode 100644 index 00000000000..7d6e8b39a37 --- /dev/null +++ b/queue-5.13/bnxt-make-sure-xmit_more-errors-does-not-miss-doorbe.patch @@ -0,0 +1,152 @@ +From 6aab1d0181026b28a6914b62bd4276c6adb664c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:42:41 -0700 +Subject: bnxt: make sure xmit_more + errors does not miss doorbells + +From: Jakub Kicinski + +[ Upstream commit e8d8c5d80f5e9d4586c68061b62c642752289095 ] + +skbs are freed on error and not put on the ring. We may, however, +be in a situation where we're freeing the last skb of a batch, +and there is a doorbell ring pending because of xmit_more() being +true earlier. Make sure we ring the door bell in such situations. + +Since errors are rare don't pay attention to xmit_more() and just +always flush the pending frames. + +The busy case should be safe to be left alone because it can +only happen if start_xmit races with completions and they +both enable the queue. In that case the kick can't be pending. + +Noticed while reading the code. + +Fixes: 4d172f21cefe ("bnxt_en: Implement xmit_more.") +Reviewed-by: Michael Chan +Reviewed-by: Edwin Peer +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 39 +++++++++++++++-------- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + + 2 files changed, 27 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 17ee5c436069..ea67c8c07a8b 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -69,7 +69,8 @@ + #include "bnxt_debugfs.h" + + #define BNXT_TX_TIMEOUT (5 * HZ) +-#define BNXT_DEF_MSG_ENABLE (NETIF_MSG_DRV | NETIF_MSG_HW) ++#define BNXT_DEF_MSG_ENABLE (NETIF_MSG_DRV | NETIF_MSG_HW | \ ++ NETIF_MSG_TX_ERR) + + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Broadcom BCM573xx network driver"); +@@ -362,6 +363,13 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb) + return md_dst->u.port_info.port_id; + } + ++static void bnxt_txr_db_kick(struct bnxt *bp, struct bnxt_tx_ring_info *txr, ++ u16 prod) ++{ ++ bnxt_db_write(bp, &txr->tx_db, prod); ++ txr->kick_pending = 0; ++} ++ + static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp, + struct bnxt_tx_ring_info *txr, + struct netdev_queue *txq) +@@ -410,6 +418,10 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + free_size = bnxt_tx_avail(bp, txr); + if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) { ++ /* We must have raced with NAPI cleanup */ ++ if (net_ratelimit() && txr->kick_pending) ++ netif_warn(bp, tx_err, dev, ++ "bnxt: ring busy w/ flush pending!\n"); + if (bnxt_txr_netif_try_stop_queue(bp, txr, txq)) + return NETDEV_TX_BUSY; + } +@@ -518,21 +530,16 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + normal_tx: + if (length < BNXT_MIN_PKT_SIZE) { + pad = BNXT_MIN_PKT_SIZE - length; +- if (skb_pad(skb, pad)) { ++ if (skb_pad(skb, pad)) + /* SKB already freed. */ +- tx_buf->skb = NULL; +- return NETDEV_TX_OK; +- } ++ goto tx_kick_pending; + length = BNXT_MIN_PKT_SIZE; + } + + mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE); + +- if (unlikely(dma_mapping_error(&pdev->dev, mapping))) { +- dev_kfree_skb_any(skb); +- tx_buf->skb = NULL; +- return NETDEV_TX_OK; +- } ++ if (unlikely(dma_mapping_error(&pdev->dev, mapping))) ++ goto tx_free; + + dma_unmap_addr_set(tx_buf, mapping, mapping); + flags = (len << TX_BD_LEN_SHIFT) | TX_BD_TYPE_LONG_TX_BD | +@@ -617,13 +624,15 @@ normal_tx: + txr->tx_prod = prod; + + if (!netdev_xmit_more() || netif_xmit_stopped(txq)) +- bnxt_db_write(bp, &txr->tx_db, prod); ++ bnxt_txr_db_kick(bp, txr, prod); ++ else ++ txr->kick_pending = 1; + + tx_done: + + if (unlikely(bnxt_tx_avail(bp, txr) <= MAX_SKB_FRAGS + 1)) { + if (netdev_xmit_more() && !tx_buf->is_push) +- bnxt_db_write(bp, &txr->tx_db, prod); ++ bnxt_txr_db_kick(bp, txr, prod); + + bnxt_txr_netif_try_stop_queue(bp, txr, txq); + } +@@ -635,7 +644,6 @@ tx_dma_error: + /* start back at beginning and unmap skb */ + prod = txr->tx_prod; + tx_buf = &txr->tx_buf_ring[prod]; +- tx_buf->skb = NULL; + dma_unmap_single(&pdev->dev, dma_unmap_addr(tx_buf, mapping), + skb_headlen(skb), PCI_DMA_TODEVICE); + prod = NEXT_TX(prod); +@@ -649,7 +657,12 @@ tx_dma_error: + PCI_DMA_TODEVICE); + } + ++tx_free: + dev_kfree_skb_any(skb); ++tx_kick_pending: ++ if (txr->kick_pending) ++ bnxt_txr_db_kick(bp, txr, txr->tx_prod); ++ txr->tx_buf_ring[txr->tx_prod].skb = NULL; + return NETDEV_TX_OK; + } + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 30e47ea343f9..e2f38aaa474b 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -783,6 +783,7 @@ struct bnxt_tx_ring_info { + u16 tx_prod; + u16 tx_cons; + u16 txq_index; ++ u8 kick_pending; + struct bnxt_db_info tx_db; + + struct tx_bd *tx_desc_ring[MAX_TX_PAGES]; +-- +2.30.2 + diff --git a/queue-5.13/bnxt_en-add-missing-dma-memory-barriers.patch b/queue-5.13/bnxt_en-add-missing-dma-memory-barriers.patch new file mode 100644 index 00000000000..c271d07a020 --- /dev/null +++ b/queue-5.13/bnxt_en-add-missing-dma-memory-barriers.patch @@ -0,0 +1,70 @@ +From 9484be931ffacc935ffba4fd30d3df0d736efb78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Aug 2021 16:15:37 -0400 +Subject: bnxt_en: Add missing DMA memory barriers + +From: Michael Chan + +[ Upstream commit 828affc27ed43441bd1efdaf4e07e96dd43a0362 ] + +Each completion ring entry has a valid bit to indicate that the entry +contains a valid completion event. The driver's main poll loop +__bnxt_poll_work() has the proper dma_rmb() to make sure the valid +bit of the next entry has been checked before proceeding further. +But when we call bnxt_rx_pkt() to process the RX event, the RX +completion event consists of two completion entries and only the +first entry has been checked to be valid. We need the same barrier +after checking the next completion entry. Add missing dma_rmb() +barriers in bnxt_rx_pkt() and other similar locations. + +Fixes: 67a95e2022c7 ("bnxt_en: Need memory barrier when processing the completion ring.") +Reported-by: Lance Richardson +Reviewed-by: Andy Gospodarek +Reviewed-by: Lance Richardson +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index e4c8c681a3af..b365768a2bda 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1754,6 +1754,10 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons)) + return -EBUSY; + ++ /* The valid test of the entry must be done first before ++ * reading any further. ++ */ ++ dma_rmb(); + prod = rxr->rx_prod; + + if (cmp_type == CMP_TYPE_RX_L2_TPA_START_CMP) { +@@ -1957,6 +1961,10 @@ static int bnxt_force_rx_discard(struct bnxt *bp, + if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons)) + return -EBUSY; + ++ /* The valid test of the entry must be done first before ++ * reading any further. ++ */ ++ dma_rmb(); + cmp_type = RX_CMP_TYPE(rxcmp); + if (cmp_type == CMP_TYPE_RX_L2_CMP) { + rxcmp1->rx_cmp_cfa_code_errors_v2 |= +@@ -2421,6 +2429,10 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget) + if (!TX_CMP_VALID(txcmp, raw_cons)) + break; + ++ /* The valid test of the entry must be done first before ++ * reading any further. ++ */ ++ dma_rmb(); + if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) { + tmp_raw_cons = NEXT_RAW_CMP(raw_cons); + cp_cons = RING_CMP(tmp_raw_cons); +-- +2.30.2 + diff --git a/queue-5.13/bnxt_en-disable-arfs-if-running-on-212-firmware.patch b/queue-5.13/bnxt_en-disable-arfs-if-running-on-212-firmware.patch new file mode 100644 index 00000000000..a4f72fe21d8 --- /dev/null +++ b/queue-5.13/bnxt_en-disable-arfs-if-running-on-212-firmware.patch @@ -0,0 +1,38 @@ +From c37e36f84c67f42fb20a1276692f672af3001904 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Aug 2021 16:15:36 -0400 +Subject: bnxt_en: Disable aRFS if running on 212 firmware + +From: Michael Chan + +[ Upstream commit 976e52b718c3de9077fff8f3f674afb159c57fb1 ] + +212 firmware broke aRFS, so disable it. Traffic may stop after ntuple +filters are inserted and deleted by the 212 firmware. + +Fixes: ae10ae740ad2 ("bnxt_en: Add new hardware RFS mode.") +Reviewed-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index a30ded73bba1..e4c8c681a3af 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10668,6 +10668,9 @@ static bool bnxt_rfs_supported(struct bnxt *bp) + return true; + return false; + } ++ /* 212 firmware is broken for aRFS */ ++ if (BNXT_FW_MAJ(bp) == 212) ++ return false; + if (BNXT_PF(bp) && !BNXT_CHIP_TYPE_NITRO_A0(bp)) + return true; + if (bp->flags & BNXT_FLAG_NEW_RSS_CAP) +-- +2.30.2 + diff --git a/queue-5.13/bpf-clear-zext_dst-of-dead-insns.patch b/queue-5.13/bpf-clear-zext_dst-of-dead-insns.patch new file mode 100644 index 00000000000..476a085dd13 --- /dev/null +++ b/queue-5.13/bpf-clear-zext_dst-of-dead-insns.patch @@ -0,0 +1,65 @@ +From b3783109872464936d99a7d3e1629d2ff9e46778 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 17:18:10 +0200 +Subject: bpf: Clear zext_dst of dead insns + +From: Ilya Leoshkevich + +[ Upstream commit 45c709f8c71b525b51988e782febe84ce933e7e0 ] + +"access skb fields ok" verifier test fails on s390 with the "verifier +bug. zext_dst is set, but no reg is defined" message. The first insns +of the test prog are ... + + 0: 61 01 00 00 00 00 00 00 ldxw %r0,[%r1+0] + 8: 35 00 00 01 00 00 00 00 jge %r0,0,1 + 10: 61 01 00 08 00 00 00 00 ldxw %r0,[%r1+8] + +... and the 3rd one is dead (this does not look intentional to me, but +this is a separate topic). + +sanitize_dead_code() converts dead insns into "ja -1", but keeps +zext_dst. When opt_subreg_zext_lo32_rnd_hi32() tries to parse such +an insn, it sees this discrepancy and bails. This problem can be seen +only with JITs whose bpf_jit_needs_zext() returns true. + +Fix by clearning dead insns' zext_dst. + +The commits that contributed to this problem are: + +1. 5aa5bd14c5f8 ("bpf: add initial suite for selftests"), which + introduced the test with the dead code. +2. 5327ed3d44b7 ("bpf: verifier: mark verified-insn with + sub-register zext flag"), which introduced the zext_dst flag. +3. 83a2881903f3 ("bpf: Account for BPF_FETCH in + insn_has_def32()"), which introduced the sanity check. +4. 9183671af6db ("bpf: Fix leakage under speculation on + mispredicted branches"), which bisect points to. + +It's best to fix this on stable branches that contain the second one, +since that's the point where the inconsistency was introduced. + +Fixes: 5327ed3d44b7 ("bpf: verifier: mark verified-insn with sub-register zext flag") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210812151811.184086-2-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index eab48745231f..0fbe7ef6b155 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -11632,6 +11632,7 @@ static void sanitize_dead_code(struct bpf_verifier_env *env) + if (aux_data[i].seen) + continue; + memcpy(insn + i, &trap, sizeof(trap)); ++ aux_data[i].zext_dst = false; + } + } + +-- +2.30.2 + diff --git a/queue-5.13/bus-ti-sysc-fix-error-handling-for-sysc_check_active.patch b/queue-5.13/bus-ti-sysc-fix-error-handling-for-sysc_check_active.patch new file mode 100644 index 00000000000..d19fa4dfe25 --- /dev/null +++ b/queue-5.13/bus-ti-sysc-fix-error-handling-for-sysc_check_active.patch @@ -0,0 +1,52 @@ +From bef7240f78592eec3b636e59fdec1bee1e49340f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 08:34:46 +0300 +Subject: bus: ti-sysc: Fix error handling for sysc_check_active_timer() + +From: Tony Lindgren + +[ Upstream commit 06a089ef644934372a3062528244fca3417d3430 ] + +We have changed the return type for sysc_check_active_timer() from -EBUSY +to -ENXIO, but the gpt12 system timer fix still checks for -EBUSY. We are +also not returning on other errors like we did earlier as noted by +Pavel Machek . + +Commit 3ff340e24c9d ("bus: ti-sysc: Fix gpt12 system timer issue with +reserved status") should have been updated for commit 65fb73676112 +("bus: ti-sysc: suppress err msg for timers used as clockevent/source"). + +Let's fix the issue by checking for -ENXIO and returning on any other +errors as suggested by Pavel Machek . + +Fixes: 3ff340e24c9d ("bus: ti-sysc: Fix gpt12 system timer issue with reserved status") +Depends-on: 65fb73676112 ("bus: ti-sysc: suppress err msg for timers used as clockevent/source") +Reported-by: Pavel Machek +Reviewed-by: Pavel Machek (CIP) +Cc: Grygorii Strashko +Cc: Jarkko Nikula +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 0ef98e3ba341..148a4dd8cb9a 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -3097,8 +3097,10 @@ static int sysc_probe(struct platform_device *pdev) + return error; + + error = sysc_check_active_timer(ddata); +- if (error == -EBUSY) ++ if (error == -ENXIO) + ddata->reserved = true; ++ else if (error) ++ return error; + + error = sysc_get_clocks(ddata); + if (error) +-- +2.30.2 + diff --git a/queue-5.13/cpufreq-arm_scmi-fix-error-path-when-allocation-fail.patch b/queue-5.13/cpufreq-arm_scmi-fix-error-path-when-allocation-fail.patch new file mode 100644 index 00000000000..b1ec1c94152 --- /dev/null +++ b/queue-5.13/cpufreq-arm_scmi-fix-error-path-when-allocation-fail.patch @@ -0,0 +1,37 @@ +From f8d69ac96c32839bb2b6a1e64dd111fde69db21b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 10:07:44 +0100 +Subject: cpufreq: arm_scmi: Fix error path when allocation failed + +From: Lukasz Luba + +[ Upstream commit f7d635883fb73414c7c4e2648b42adc296c5d40d ] + +Stop the initialization when cpumask allocation failed and return an +error. + +Fixes: 80a064dbd556 ("scmi-cpufreq: Get opp_shared_cpus from opp-v2 for EM") +Signed-off-by: Lukasz Luba +Reviewed-by: Sudeep Holla +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scmi-cpufreq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c +index ec9a87ca2dbb..75f818d04b48 100644 +--- a/drivers/cpufreq/scmi-cpufreq.c ++++ b/drivers/cpufreq/scmi-cpufreq.c +@@ -134,7 +134,7 @@ static int scmi_cpufreq_init(struct cpufreq_policy *policy) + } + + if (!zalloc_cpumask_var(&opp_shared_cpus, GFP_KERNEL)) +- ret = -ENOMEM; ++ return -ENOMEM; + + /* Obtain CPUs that share SCMI performance controls */ + ret = scmi_get_sharing_cpus(cpu_dev, policy->cpus); +-- +2.30.2 + diff --git a/queue-5.13/cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch b/queue-5.13/cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch new file mode 100644 index 00000000000..96aa02eb228 --- /dev/null +++ b/queue-5.13/cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch @@ -0,0 +1,54 @@ +From 2ff2f02916676ebed26489f64a91461465e305c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jul 2021 00:56:01 +0200 +Subject: cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 484f2b7c61b9ae58cc00c5127bcbcd9177af8dfe ] + +The 1.2 GHz variant of the Armada 3720 SOC is unstable with DVFS: when +the SOC boots, the WTMI firmware sets clocks and AVS values that work +correctly with 1.2 GHz CPU frequency, but random crashes occur once +cpufreq driver starts scaling. + +We do not know currently what is the reason: +- it may be that the voltage value for L0 for 1.2 GHz variant provided + by the vendor in the OTP is simply incorrect when scaling is used, +- it may be that some delay is needed somewhere, +- it may be something else. + +The most sane solution now seems to be to simply forbid the cpufreq +driver on 1.2 GHz variant. + +Signed-off-by: Marek Behún +Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index 3fc98a3ffd91..c10fc33b29b1 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -104,7 +104,11 @@ struct armada_37xx_dvfs { + }; + + static struct armada_37xx_dvfs armada_37xx_dvfs[] = { +- {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, ++ /* ++ * The cpufreq scaling for 1.2 GHz variant of the SOC is currently ++ * unstable because we do not know how to configure it properly. ++ */ ++ /* {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, */ + {.cpu_freq_max = 1000*1000*1000, .divider = {1, 2, 4, 5} }, + {.cpu_freq_max = 800*1000*1000, .divider = {1, 2, 3, 4} }, + {.cpu_freq_max = 600*1000*1000, .divider = {2, 4, 5, 6} }, +-- +2.30.2 + diff --git a/queue-5.13/dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch b/queue-5.13/dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch new file mode 100644 index 00000000000..a25342b44be --- /dev/null +++ b/queue-5.13/dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch @@ -0,0 +1,54 @@ +From dd40e384c1f01cbf1274eac47f98173b7af54fb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Aug 2021 16:04:40 -0700 +Subject: dccp: add do-while-0 stubs for dccp_pr_debug macros + +From: Randy Dunlap + +[ Upstream commit 86aab09a4870bb8346c9579864588c3d7f555299 ] + +GCC complains about empty macros in an 'if' statement, so convert +them to 'do {} while (0)' macros. + +Fixes these build warnings: + +net/dccp/output.c: In function 'dccp_xmit_packet': +../net/dccp/output.c:283:71: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] + 283 | dccp_pr_debug("transmit_skb() returned err=%d\n", err); +net/dccp/ackvec.c: In function 'dccp_ackvec_update_old': +../net/dccp/ackvec.c:163:80: warning: suggest braces around empty body in an 'else' statement [-Wempty-body] + 163 | (unsigned long long)seqno, state); + +Fixes: dc841e30eaea ("dccp: Extend CCID packet dequeueing interface") +Fixes: 380240864451 ("dccp ccid-2: Update code for the Ack Vector input/registration routine") +Signed-off-by: Randy Dunlap +Cc: dccp@vger.kernel.org +Cc: "David S. Miller" +Cc: Jakub Kicinski +Cc: Gerrit Renker +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dccp/dccp.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h +index 9cc9d1ee6cdb..c5c1d2b8045e 100644 +--- a/net/dccp/dccp.h ++++ b/net/dccp/dccp.h +@@ -41,9 +41,9 @@ extern bool dccp_debug; + #define dccp_pr_debug_cat(format, a...) DCCP_PRINTK(dccp_debug, format, ##a) + #define dccp_debug(fmt, a...) dccp_pr_debug_cat(KERN_DEBUG fmt, ##a) + #else +-#define dccp_pr_debug(format, a...) +-#define dccp_pr_debug_cat(format, a...) +-#define dccp_debug(format, a...) ++#define dccp_pr_debug(format, a...) do {} while (0) ++#define dccp_pr_debug_cat(format, a...) do {} while (0) ++#define dccp_debug(format, a...) do {} while (0) + #endif + + extern struct inet_hashinfo dccp_hashinfo; +-- +2.30.2 + diff --git a/queue-5.13/drm-amd-display-use-dcn30-watermark-calc-for-dcn301.patch b/queue-5.13/drm-amd-display-use-dcn30-watermark-calc-for-dcn301.patch new file mode 100644 index 00000000000..1e8bcd3ccf4 --- /dev/null +++ b/queue-5.13/drm-amd-display-use-dcn30-watermark-calc-for-dcn301.patch @@ -0,0 +1,148 @@ +From 357a99201250f415086556ac25efcbeba47875ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 08:31:04 -0700 +Subject: drm/amd/display: Use DCN30 watermark calc for DCN301 + +From: Zhan Liu + +[ Upstream commit 37717b8c9f0e8c4dd73fc522769cc14649b4f657 ] + +[why] +dcn301_calculate_wm_and_dl() causes flickering when external monitor is +connected. + +This issue has been fixed before by commit 0e4c0ae59d7e +("drm/amdgpu/display: drop dcn301_calculate_wm_and_dl for now"), however +part of the fix was gone after commit 2cbcb78c9ee5 ("Merge tag 'amd-drm-next-5.13-2021-03-23' of https://gitlab.freedesktop.org/agd5f/linux into drm-next"). + +[how] +Use dcn30_calculate_wm_and_dlg() instead as in the original fix. + +Fixes: 2cbcb78c9ee5 ("Merge tag 'amd-drm-next-5.13-2021-03-23' of https://gitlab.freedesktop.org/agd5f/linux into drm-next") + +Signed-off-by: Nikola Cornij +Reviewed-by: Zhan Liu +Tested-by: Zhan Liu +Tested-by: Oliver Logush +Signed-off-by: Zhan Liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/dcn301/dcn301_resource.c | 96 +------------------ + 1 file changed, 1 insertion(+), 95 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c +index 472696f949ac..63b09c1124c4 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn301/dcn301_resource.c +@@ -1622,106 +1622,12 @@ static void dcn301_update_bw_bounding_box(struct dc *dc, struct clk_bw_params *b + dml_init_instance(&dc->dml, &dcn3_01_soc, &dcn3_01_ip, DML_PROJECT_DCN30); + } + +-static void calculate_wm_set_for_vlevel( +- int vlevel, +- struct wm_range_table_entry *table_entry, +- struct dcn_watermarks *wm_set, +- struct display_mode_lib *dml, +- display_e2e_pipe_params_st *pipes, +- int pipe_cnt) +-{ +- double dram_clock_change_latency_cached = dml->soc.dram_clock_change_latency_us; +- +- ASSERT(vlevel < dml->soc.num_states); +- /* only pipe 0 is read for voltage and dcf/soc clocks */ +- pipes[0].clks_cfg.voltage = vlevel; +- pipes[0].clks_cfg.dcfclk_mhz = dml->soc.clock_limits[vlevel].dcfclk_mhz; +- pipes[0].clks_cfg.socclk_mhz = dml->soc.clock_limits[vlevel].socclk_mhz; +- +- dml->soc.dram_clock_change_latency_us = table_entry->pstate_latency_us; +- dml->soc.sr_exit_time_us = table_entry->sr_exit_time_us; +- dml->soc.sr_enter_plus_exit_time_us = table_entry->sr_enter_plus_exit_time_us; +- +- wm_set->urgent_ns = get_wm_urgent(dml, pipes, pipe_cnt) * 1000; +- wm_set->cstate_pstate.cstate_enter_plus_exit_ns = get_wm_stutter_enter_exit(dml, pipes, pipe_cnt) * 1000; +- wm_set->cstate_pstate.cstate_exit_ns = get_wm_stutter_exit(dml, pipes, pipe_cnt) * 1000; +- wm_set->cstate_pstate.pstate_change_ns = get_wm_dram_clock_change(dml, pipes, pipe_cnt) * 1000; +- wm_set->pte_meta_urgent_ns = get_wm_memory_trip(dml, pipes, pipe_cnt) * 1000; +- wm_set->frac_urg_bw_nom = get_fraction_of_urgent_bandwidth(dml, pipes, pipe_cnt) * 1000; +- wm_set->frac_urg_bw_flip = get_fraction_of_urgent_bandwidth_imm_flip(dml, pipes, pipe_cnt) * 1000; +- wm_set->urgent_latency_ns = get_urgent_latency(dml, pipes, pipe_cnt) * 1000; +- dml->soc.dram_clock_change_latency_us = dram_clock_change_latency_cached; +- +-} +- +-static void dcn301_calculate_wm_and_dlg( +- struct dc *dc, struct dc_state *context, +- display_e2e_pipe_params_st *pipes, +- int pipe_cnt, +- int vlevel_req) +-{ +- int i, pipe_idx; +- int vlevel, vlevel_max; +- struct wm_range_table_entry *table_entry; +- struct clk_bw_params *bw_params = dc->clk_mgr->bw_params; +- +- ASSERT(bw_params); +- +- vlevel_max = bw_params->clk_table.num_entries - 1; +- +- /* WM Set D */ +- table_entry = &bw_params->wm_table.entries[WM_D]; +- if (table_entry->wm_type == WM_TYPE_RETRAINING) +- vlevel = 0; +- else +- vlevel = vlevel_max; +- calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.d, +- &context->bw_ctx.dml, pipes, pipe_cnt); +- /* WM Set C */ +- table_entry = &bw_params->wm_table.entries[WM_C]; +- vlevel = min(max(vlevel_req, 2), vlevel_max); +- calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.c, +- &context->bw_ctx.dml, pipes, pipe_cnt); +- /* WM Set B */ +- table_entry = &bw_params->wm_table.entries[WM_B]; +- vlevel = min(max(vlevel_req, 1), vlevel_max); +- calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.b, +- &context->bw_ctx.dml, pipes, pipe_cnt); +- +- /* WM Set A */ +- table_entry = &bw_params->wm_table.entries[WM_A]; +- vlevel = min(vlevel_req, vlevel_max); +- calculate_wm_set_for_vlevel(vlevel, table_entry, &context->bw_ctx.bw.dcn.watermarks.a, +- &context->bw_ctx.dml, pipes, pipe_cnt); +- +- for (i = 0, pipe_idx = 0; i < dc->res_pool->pipe_count; i++) { +- if (!context->res_ctx.pipe_ctx[i].stream) +- continue; +- +- pipes[pipe_idx].clks_cfg.dispclk_mhz = get_dispclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt); +- pipes[pipe_idx].clks_cfg.dppclk_mhz = get_dppclk_calculated(&context->bw_ctx.dml, pipes, pipe_cnt, pipe_idx); +- +- if (dc->config.forced_clocks) { +- pipes[pipe_idx].clks_cfg.dispclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dispclk_mhz; +- pipes[pipe_idx].clks_cfg.dppclk_mhz = context->bw_ctx.dml.soc.clock_limits[0].dppclk_mhz; +- } +- if (dc->debug.min_disp_clk_khz > pipes[pipe_idx].clks_cfg.dispclk_mhz * 1000) +- pipes[pipe_idx].clks_cfg.dispclk_mhz = dc->debug.min_disp_clk_khz / 1000.0; +- if (dc->debug.min_dpp_clk_khz > pipes[pipe_idx].clks_cfg.dppclk_mhz * 1000) +- pipes[pipe_idx].clks_cfg.dppclk_mhz = dc->debug.min_dpp_clk_khz / 1000.0; +- +- pipe_idx++; +- } +- +- dcn20_calculate_dlg_params(dc, context, pipes, pipe_cnt, vlevel); +-} +- + static struct resource_funcs dcn301_res_pool_funcs = { + .destroy = dcn301_destroy_resource_pool, + .link_enc_create = dcn301_link_encoder_create, + .panel_cntl_create = dcn301_panel_cntl_create, + .validate_bandwidth = dcn30_validate_bandwidth, +- .calculate_wm_and_dlg = dcn301_calculate_wm_and_dlg, ++ .calculate_wm_and_dlg = dcn30_calculate_wm_and_dlg, + .update_soc_for_wm_a = dcn30_update_soc_for_wm_a, + .populate_dml_pipes = dcn30_populate_dml_pipes_from_context, + .acquire_idle_pipe_for_layer = dcn20_acquire_idle_pipe_for_layer, +-- +2.30.2 + diff --git a/queue-5.13/drm-i915-skip-display-interruption-setup-when-displa.patch b/queue-5.13/drm-i915-skip-display-interruption-setup-when-displa.patch new file mode 100644 index 00000000000..e9c003d35aa --- /dev/null +++ b/queue-5.13/drm-i915-skip-display-interruption-setup-when-displa.patch @@ -0,0 +1,130 @@ +From da5b61ed5f9bfe3d16e61b56d00c7b660f0caf9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 13:31:48 -0700 +Subject: drm/i915: Skip display interruption setup when display is not + available +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Roberto de Souza + +[ Upstream commit a844cfbe648d15d9f1031c45508c194f2d61c917 ] + +Return ealier in the functions doing interruption setup for GEN8+ also +adding a warning in gen8_de_irq_handler() to let us know that +something else is still missing. + +Reviewed-by: Radhakrishna Sripada +Cc: Ville Syrjälä +Cc: Lucas De Marchi +Signed-off-by: José Roberto de Souza +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20210408203150.237947-1-jose.souza@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/i915_irq.c | 39 +++++++++++++++++++++++++++------ + 1 file changed, 32 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c +index 7eefbdec25a2..e0d0b300c4aa 100644 +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -2421,6 +2421,8 @@ gen8_de_irq_handler(struct drm_i915_private *dev_priv, u32 master_ctl) + u32 iir; + enum pipe pipe; + ++ drm_WARN_ON_ONCE(&dev_priv->drm, !HAS_DISPLAY(dev_priv)); ++ + if (master_ctl & GEN8_DE_MISC_IRQ) { + iir = intel_uncore_read(&dev_priv->uncore, GEN8_DE_MISC_IIR); + if (iir) { +@@ -3058,14 +3060,13 @@ static void cnp_display_clock_wa(struct drm_i915_private *dev_priv) + } + } + +-static void gen8_irq_reset(struct drm_i915_private *dev_priv) ++static void gen8_display_irq_reset(struct drm_i915_private *dev_priv) + { + struct intel_uncore *uncore = &dev_priv->uncore; + enum pipe pipe; + +- gen8_master_intr_disable(dev_priv->uncore.regs); +- +- gen8_gt_irq_reset(&dev_priv->gt); ++ if (!HAS_DISPLAY(dev_priv)) ++ return; + + intel_uncore_write(uncore, EDP_PSR_IMR, 0xffffffff); + intel_uncore_write(uncore, EDP_PSR_IIR, 0xffffffff); +@@ -3077,6 +3078,16 @@ static void gen8_irq_reset(struct drm_i915_private *dev_priv) + + GEN3_IRQ_RESET(uncore, GEN8_DE_PORT_); + GEN3_IRQ_RESET(uncore, GEN8_DE_MISC_); ++} ++ ++static void gen8_irq_reset(struct drm_i915_private *dev_priv) ++{ ++ struct intel_uncore *uncore = &dev_priv->uncore; ++ ++ gen8_master_intr_disable(dev_priv->uncore.regs); ++ ++ gen8_gt_irq_reset(&dev_priv->gt); ++ gen8_display_irq_reset(dev_priv); + GEN3_IRQ_RESET(uncore, GEN8_PCU_); + + if (HAS_PCH_SPLIT(dev_priv)) +@@ -3092,6 +3103,9 @@ static void gen11_display_irq_reset(struct drm_i915_private *dev_priv) + u32 trans_mask = BIT(TRANSCODER_A) | BIT(TRANSCODER_B) | + BIT(TRANSCODER_C) | BIT(TRANSCODER_D); + ++ if (!HAS_DISPLAY(dev_priv)) ++ return; ++ + intel_uncore_write(uncore, GEN11_DISPLAY_INT_CTL, 0); + + if (DISPLAY_VER(dev_priv) >= 12) { +@@ -3714,6 +3728,9 @@ static void gen8_de_irq_postinstall(struct drm_i915_private *dev_priv) + BIT(TRANSCODER_C) | BIT(TRANSCODER_D); + enum pipe pipe; + ++ if (!HAS_DISPLAY(dev_priv)) ++ return; ++ + if (DISPLAY_VER(dev_priv) <= 10) + de_misc_masked |= GEN8_DE_MISC_GSE; + +@@ -3797,6 +3814,16 @@ static void gen8_irq_postinstall(struct drm_i915_private *dev_priv) + gen8_master_intr_enable(dev_priv->uncore.regs); + } + ++static void gen11_de_irq_postinstall(struct drm_i915_private *dev_priv) ++{ ++ if (!HAS_DISPLAY(dev_priv)) ++ return; ++ ++ gen8_de_irq_postinstall(dev_priv); ++ ++ intel_uncore_write(&dev_priv->uncore, GEN11_DISPLAY_INT_CTL, ++ GEN11_DISPLAY_IRQ_ENABLE); ++} + + static void gen11_irq_postinstall(struct drm_i915_private *dev_priv) + { +@@ -3807,12 +3834,10 @@ static void gen11_irq_postinstall(struct drm_i915_private *dev_priv) + icp_irq_postinstall(dev_priv); + + gen11_gt_irq_postinstall(&dev_priv->gt); +- gen8_de_irq_postinstall(dev_priv); ++ gen11_de_irq_postinstall(dev_priv); + + GEN3_IRQ_INIT(uncore, GEN11_GU_MISC_, ~gu_misc_masked, gu_misc_masked); + +- intel_uncore_write(&dev_priv->uncore, GEN11_DISPLAY_INT_CTL, GEN11_DISPLAY_IRQ_ENABLE); +- + if (HAS_MASTER_UNIT_IRQ(dev_priv)) { + dg1_master_intr_enable(uncore->regs); + intel_uncore_posting_read(&dev_priv->uncore, DG1_MSTR_UNIT_INTR); +-- +2.30.2 + diff --git a/queue-5.13/drm-i915-tweaked-wa_14010685332-for-all-pchs.patch b/queue-5.13/drm-i915-tweaked-wa_14010685332-for-all-pchs.patch new file mode 100644 index 00000000000..5999ed1e6f8 --- /dev/null +++ b/queue-5.13/drm-i915-tweaked-wa_14010685332-for-all-pchs.patch @@ -0,0 +1,123 @@ +From 57531da98216b3d9f09f9819030c963d5fcb74a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 17:01:12 +0530 +Subject: drm/i915: Tweaked Wa_14010685332 for all PCHs + +From: Anshuman Gupta + +[ Upstream commit b8441b288d6031eac21390891ba36487b2cb398b ] + +dispcnlunit1_cp_xosc_clkreq clock observed to be active on TGL-H platform +despite Wa_14010685332 original sequence, +thus blocks entry to deeper s0ix state. + +The Tweaked Wa_14010685332 sequence fixes this issue, therefore use tweaked +Wa_14010685332 sequence for every PCH since PCH_CNP. + +v2: +- removed RKL from comment and simplified condition. [Rodrigo] + +Fixes: b896898c7369 ("drm/i915: Tweaked Wa_14010685332 for PCHs used on gen11 platforms") +Cc: Matt Roper +Cc: Rodrigo Vivi +Cc: Imre Deak +Signed-off-by: Anshuman Gupta +Reviewed-by: Rodrigo Vivi +Link: https://patchwork.freedesktop.org/patch/msgid/20210810113112.31739-2-anshuman.gupta@intel.com +(cherry picked from commit 8b46cc6577f4bbef7e5909bb926da31d705f350f) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + .../drm/i915/display/intel_display_power.c | 16 +++++++------- + drivers/gpu/drm/i915/i915_irq.c | 21 ------------------- + 2 files changed, 8 insertions(+), 29 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_display_power.c b/drivers/gpu/drm/i915/display/intel_display_power.c +index 99126caf5747..a8597444d515 100644 +--- a/drivers/gpu/drm/i915/display/intel_display_power.c ++++ b/drivers/gpu/drm/i915/display/intel_display_power.c +@@ -5910,13 +5910,13 @@ void intel_display_power_suspend_late(struct drm_i915_private *i915) + { + if (DISPLAY_VER(i915) >= 11 || IS_GEN9_LP(i915)) { + bxt_enable_dc9(i915); +- /* Tweaked Wa_14010685332:icp,jsp,mcc */ +- if (INTEL_PCH_TYPE(i915) >= PCH_ICP && INTEL_PCH_TYPE(i915) <= PCH_MCC) +- intel_de_rmw(i915, SOUTH_CHICKEN1, +- SBCLK_RUN_REFCLK_DIS, SBCLK_RUN_REFCLK_DIS); + } else if (IS_HASWELL(i915) || IS_BROADWELL(i915)) { + hsw_enable_pc8(i915); + } ++ ++ /* Tweaked Wa_14010685332:cnp,icp,jsp,mcc,tgp,adp */ ++ if (INTEL_PCH_TYPE(i915) >= PCH_CNP && INTEL_PCH_TYPE(i915) < PCH_DG1) ++ intel_de_rmw(i915, SOUTH_CHICKEN1, SBCLK_RUN_REFCLK_DIS, SBCLK_RUN_REFCLK_DIS); + } + + void intel_display_power_resume_early(struct drm_i915_private *i915) +@@ -5924,13 +5924,13 @@ void intel_display_power_resume_early(struct drm_i915_private *i915) + if (DISPLAY_VER(i915) >= 11 || IS_GEN9_LP(i915)) { + gen9_sanitize_dc_state(i915); + bxt_disable_dc9(i915); +- /* Tweaked Wa_14010685332:icp,jsp,mcc */ +- if (INTEL_PCH_TYPE(i915) >= PCH_ICP && INTEL_PCH_TYPE(i915) <= PCH_MCC) +- intel_de_rmw(i915, SOUTH_CHICKEN1, SBCLK_RUN_REFCLK_DIS, 0); +- + } else if (IS_HASWELL(i915) || IS_BROADWELL(i915)) { + hsw_disable_pc8(i915); + } ++ ++ /* Tweaked Wa_14010685332:cnp,icp,jsp,mcc,tgp,adp */ ++ if (INTEL_PCH_TYPE(i915) >= PCH_CNP && INTEL_PCH_TYPE(i915) < PCH_DG1) ++ intel_de_rmw(i915, SOUTH_CHICKEN1, SBCLK_RUN_REFCLK_DIS, 0); + } + + void intel_display_power_suspend(struct drm_i915_private *i915) +diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c +index e0d0b300c4aa..783f25920d00 100644 +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -3042,24 +3042,6 @@ static void valleyview_irq_reset(struct drm_i915_private *dev_priv) + spin_unlock_irq(&dev_priv->irq_lock); + } + +-static void cnp_display_clock_wa(struct drm_i915_private *dev_priv) +-{ +- struct intel_uncore *uncore = &dev_priv->uncore; +- +- /* +- * Wa_14010685332:cnp/cmp,tgp,adp +- * TODO: Clarify which platforms this applies to +- * TODO: Figure out if this workaround can be applied in the s0ix suspend/resume handlers as +- * on earlier platforms and whether the workaround is also needed for runtime suspend/resume +- */ +- if (INTEL_PCH_TYPE(dev_priv) == PCH_CNP || +- (INTEL_PCH_TYPE(dev_priv) >= PCH_TGP && INTEL_PCH_TYPE(dev_priv) < PCH_DG1)) { +- intel_uncore_rmw(uncore, SOUTH_CHICKEN1, SBCLK_RUN_REFCLK_DIS, +- SBCLK_RUN_REFCLK_DIS); +- intel_uncore_rmw(uncore, SOUTH_CHICKEN1, SBCLK_RUN_REFCLK_DIS, 0); +- } +-} +- + static void gen8_display_irq_reset(struct drm_i915_private *dev_priv) + { + struct intel_uncore *uncore = &dev_priv->uncore; +@@ -3093,7 +3075,6 @@ static void gen8_irq_reset(struct drm_i915_private *dev_priv) + if (HAS_PCH_SPLIT(dev_priv)) + ibx_irq_reset(dev_priv); + +- cnp_display_clock_wa(dev_priv); + } + + static void gen11_display_irq_reset(struct drm_i915_private *dev_priv) +@@ -3137,8 +3118,6 @@ static void gen11_display_irq_reset(struct drm_i915_private *dev_priv) + + if (INTEL_PCH_TYPE(dev_priv) >= PCH_ICP) + GEN3_IRQ_RESET(uncore, SDE); +- +- cnp_display_clock_wa(dev_priv); + } + + static void gen11_irq_reset(struct drm_i915_private *dev_priv) +-- +2.30.2 + diff --git a/queue-5.13/drm-mediatek-add-aal-output-size-configuration.patch b/queue-5.13/drm-mediatek-add-aal-output-size-configuration.patch new file mode 100644 index 00000000000..3a270fe0616 --- /dev/null +++ b/queue-5.13/drm-mediatek-add-aal-output-size-configuration.patch @@ -0,0 +1,43 @@ +From 692565da692c4d1a906d2ef50ccf58ebc001090e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 10:55:03 +0800 +Subject: drm/mediatek: Add AAL output size configuration + +From: jason-jh.lin + +[ Upstream commit 71ac6f390f6a3017f58d05d677b961bb1f851338 ] + +To avoid the output width and height is incorrect, +AAL_OUTPUT_SIZE configuration should be set. + +Fixes: 0664d1392c26 ("drm/mediatek: Add AAL engine basic function") +Signed-off-by: jason-jh.lin +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +index 75bc00e17fc4..50d20562e612 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +@@ -34,6 +34,7 @@ + + #define DISP_AAL_EN 0x0000 + #define DISP_AAL_SIZE 0x0030 ++#define DISP_AAL_OUTPUT_SIZE 0x04d8 + + #define DISP_DITHER_EN 0x0000 + #define DITHER_EN BIT(0) +@@ -197,6 +198,7 @@ static void mtk_aal_config(struct device *dev, unsigned int w, + struct mtk_ddp_comp_dev *priv = dev_get_drvdata(dev); + + mtk_ddp_write(cmdq_pkt, w << 16 | h, &priv->cmdq_reg, priv->regs, DISP_AAL_SIZE); ++ mtk_ddp_write(cmdq_pkt, w << 16 | h, &priv->cmdq_reg, priv->regs, DISP_AAL_OUTPUT_SIZE); + } + + static void mtk_aal_gamma_set(struct device *dev, struct drm_crtc_state *state) +-- +2.30.2 + diff --git a/queue-5.13/drm-mediatek-add-component_del-in-ovl-and-color-remo.patch b/queue-5.13/drm-mediatek-add-component_del-in-ovl-and-color-remo.patch new file mode 100644 index 00000000000..41ed50c2957 --- /dev/null +++ b/queue-5.13/drm-mediatek-add-component_del-in-ovl-and-color-remo.patch @@ -0,0 +1,49 @@ +From 3c3fa4fa41960183b1338ca34eb27ee4848e840d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 12:01:48 +0800 +Subject: drm/mediatek: Add component_del in OVL and COLOR remove function + +From: jason-jh.lin + +[ Upstream commit da4d4517ba70216799e3eb3b9bd71aa9dca065da ] + +Add component_del in OVL and COLOR remove function. + +Fixes: ff1395609e20 ("drm/mediatek: Move mtk_ddp_comp_init() from sub driver to DRM driver") +Signed-off-by: jason-jh.lin +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_disp_color.c | 2 ++ + drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 2 ++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_disp_color.c b/drivers/gpu/drm/mediatek/mtk_disp_color.c +index 63f411ab393b..bcb470caf009 100644 +--- a/drivers/gpu/drm/mediatek/mtk_disp_color.c ++++ b/drivers/gpu/drm/mediatek/mtk_disp_color.c +@@ -134,6 +134,8 @@ static int mtk_disp_color_probe(struct platform_device *pdev) + + static int mtk_disp_color_remove(struct platform_device *pdev) + { ++ component_del(&pdev->dev, &mtk_disp_color_component_ops); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +index 961f87f8d4d1..32a2922bbe5f 100644 +--- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c ++++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c +@@ -424,6 +424,8 @@ static int mtk_disp_ovl_probe(struct platform_device *pdev) + + static int mtk_disp_ovl_remove(struct platform_device *pdev) + { ++ component_del(&pdev->dev, &mtk_disp_ovl_component_ops); ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.13/i40e-fix-atr-queue-selection.patch b/queue-5.13/i40e-fix-atr-queue-selection.patch new file mode 100644 index 00000000000..113110604f8 --- /dev/null +++ b/queue-5.13/i40e-fix-atr-queue-selection.patch @@ -0,0 +1,59 @@ +From f540f96d8e484113b229dc5e8a79837d5243abfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 10:42:16 -0700 +Subject: i40e: Fix ATR queue selection + +From: Arkadiusz Kubalewski + +[ Upstream commit a222be597e316389f9f8c26033352c124ce93056 ] + +Without this patch, ATR does not work. Receive/transmit uses queue +selection based on SW DCB hashing method. + +If traffic classes are not configured for PF, then use +netdev_pick_tx function for selecting queue for packet transmission. +Instead of calling i40e_swdcb_skb_tx_hash, call netdev_pick_tx, +which ensures that packet is transmitted/received from CPU that is +running the application. + +Reproduction steps: +1. Load i40e driver +2. Map each MSI interrupt of i40e port for each CPU +3. Disable ntuple, enable ATR i.e.: +ethtool -K $interface ntuple off +ethtool --set-priv-flags $interface flow-director-atr +4. Run application that is generating traffic and is bound to a +single CPU, i.e.: +taskset -c 9 netperf -H 1.1.1.1 -t TCP_RR -l 10 +5. Observe behavior: +Application's traffic should be restricted to the CPU provided in +taskset. + +Fixes: 89ec1f0886c1 ("i40e: Fix queue-to-TC mapping on Tx") +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Arkadiusz Kubalewski +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 107fb472319e..b18ff0ed8527 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -3665,8 +3665,7 @@ u16 i40e_lan_select_queue(struct net_device *netdev, + + /* is DCB enabled at all? */ + if (vsi->tc_config.numtc == 1) +- return i40e_swdcb_skb_tx_hash(netdev, skb, +- netdev->real_num_tx_queues); ++ return netdev_pick_tx(netdev, skb, sb_dev); + + prio = skb->priority; + hw = &vsi->back->hw; +-- +2.30.2 + diff --git a/queue-5.13/iavf-fix-ping-is-lost-after-untrusted-vf-had-tried-t.patch b/queue-5.13/iavf-fix-ping-is-lost-after-untrusted-vf-had-tried-t.patch new file mode 100644 index 00000000000..d3cdea3e124 --- /dev/null +++ b/queue-5.13/iavf-fix-ping-is-lost-after-untrusted-vf-had-tried-t.patch @@ -0,0 +1,133 @@ +From ce0e26d240dbb6c129523534d7105193e16bfb29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 10:42:17 -0700 +Subject: iavf: Fix ping is lost after untrusted VF had tried to change MAC + +From: Sylwester Dziedziuch + +[ Upstream commit 8da80c9d50220a8e4190a4eaa0dd6aeefcbbb5bf ] + +Make changes to MAC address dependent on the response of PF. +Disallow changes to HW MAC address and MAC filter from untrusted +VF, thanks to that ping is not lost if VF tries to change MAC. +Add a new field in iavf_mac_filter, to indicate whether there +was response from PF for given filter. Based on this field pass +or discard the filter. +If untrusted VF tried to change it's address, it's not changed. +Still filter was changed, because of that ping couldn't go through. + +Fixes: c5c922b3e09b ("iavf: fix MAC address setting for VFs when filter is rejected") +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Mateusz Palczewski +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf.h | 1 + + drivers/net/ethernet/intel/iavf/iavf_main.c | 1 + + .../net/ethernet/intel/iavf/iavf_virtchnl.c | 47 ++++++++++++++++++- + 3 files changed, 47 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index e8bd04100ecd..90793b36126e 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -136,6 +136,7 @@ struct iavf_q_vector { + struct iavf_mac_filter { + struct list_head list; + u8 macaddr[ETH_ALEN]; ++ bool is_new_mac; /* filter is new, wait for PF decision */ + bool remove; /* filter needs to be removed */ + bool add; /* filter needs to be added */ + }; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 244ec74ceca7..606a01ce4073 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -751,6 +751,7 @@ struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter, + + list_add_tail(&f->list, &adapter->mac_filter_list); + f->add = true; ++ f->is_new_mac = true; + adapter->aq_required |= IAVF_FLAG_AQ_ADD_MAC_FILTER; + } else { + f->remove = false; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index 0eab3c43bdc5..3c735968e1b8 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -540,6 +540,47 @@ void iavf_del_ether_addrs(struct iavf_adapter *adapter) + kfree(veal); + } + ++/** ++ * iavf_mac_add_ok ++ * @adapter: adapter structure ++ * ++ * Submit list of filters based on PF response. ++ **/ ++static void iavf_mac_add_ok(struct iavf_adapter *adapter) ++{ ++ struct iavf_mac_filter *f, *ftmp; ++ ++ spin_lock_bh(&adapter->mac_vlan_list_lock); ++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) { ++ f->is_new_mac = false; ++ } ++ spin_unlock_bh(&adapter->mac_vlan_list_lock); ++} ++ ++/** ++ * iavf_mac_add_reject ++ * @adapter: adapter structure ++ * ++ * Remove filters from list based on PF response. ++ **/ ++static void iavf_mac_add_reject(struct iavf_adapter *adapter) ++{ ++ struct net_device *netdev = adapter->netdev; ++ struct iavf_mac_filter *f, *ftmp; ++ ++ spin_lock_bh(&adapter->mac_vlan_list_lock); ++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) { ++ if (f->remove && ether_addr_equal(f->macaddr, netdev->dev_addr)) ++ f->remove = false; ++ ++ if (f->is_new_mac) { ++ list_del(&f->list); ++ kfree(f); ++ } ++ } ++ spin_unlock_bh(&adapter->mac_vlan_list_lock); ++} ++ + /** + * iavf_add_vlans + * @adapter: adapter structure +@@ -1492,6 +1533,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + case VIRTCHNL_OP_ADD_ETH_ADDR: + dev_err(&adapter->pdev->dev, "Failed to add MAC filter, error %s\n", + iavf_stat_str(&adapter->hw, v_retval)); ++ iavf_mac_add_reject(adapter); + /* restore administratively set MAC address */ + ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr); + break; +@@ -1639,10 +1681,11 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + } + } + switch (v_opcode) { +- case VIRTCHNL_OP_ADD_ETH_ADDR: { ++ case VIRTCHNL_OP_ADD_ETH_ADDR: ++ if (!v_retval) ++ iavf_mac_add_ok(adapter); + if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr)) + ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr); +- } + break; + case VIRTCHNL_OP_GET_STATS: { + struct iavf_eth_stats *stats = +-- +2.30.2 + diff --git a/queue-5.13/iommu-check-if-group-is-null-before-remove-device.patch b/queue-5.13/iommu-check-if-group-is-null-before-remove-device.patch new file mode 100644 index 00000000000..907dfc06498 --- /dev/null +++ b/queue-5.13/iommu-check-if-group-is-null-before-remove-device.patch @@ -0,0 +1,55 @@ +From d81e8aca67f40e662dcc2cd351e7d2e700a7a31b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jul 2021 09:47:37 +0200 +Subject: iommu: Check if group is NULL before remove device + +From: Frank Wunderlich + +[ Upstream commit 5aa95d8834e07907e64937d792c12ffef7fb271f ] + +If probe_device is failing, iommu_group is not initialized because +iommu_group_add_device is not reached, so freeing it will result +in NULL pointer access. + +iommu_bus_init + ->bus_iommu_probe + ->probe_iommu_group in for each:/* return -22 in fail case */ + ->iommu_probe_device + ->__iommu_probe_device /* return -22 here.*/ + -> ops->probe_device /* return -22 here.*/ + -> iommu_group_get_for_dev + -> ops->device_group + -> iommu_group_add_device //good case + ->remove_iommu_group //in fail case, it will remove group + ->iommu_release_device + ->iommu_group_remove_device // here we don't have group + +In my case ops->probe_device (mtk_iommu_probe_device from +mtk_iommu_v1.c) is due to failing fwspec->ops mismatch. + +Fixes: d72e31c93746 ("iommu: IOMMU Groups") +Signed-off-by: Frank Wunderlich +Link: https://lore.kernel.org/r/20210731074737.4573-1-linux@fw-web.de +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 808ab70d5df5..db966a7841fe 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -924,6 +924,9 @@ void iommu_group_remove_device(struct device *dev) + struct iommu_group *group = dev->iommu_group; + struct group_device *tmp_device, *device = NULL; + ++ if (!group) ++ return; ++ + dev_info(dev, "Removing from iommu group %d\n", group->id); + + /* Pre-notify listeners that a device is being removed. */ +-- +2.30.2 + diff --git a/queue-5.13/iommu-vt-d-fix-incomplete-cache-flush-in-intel_pasid.patch b/queue-5.13/iommu-vt-d-fix-incomplete-cache-flush-in-intel_pasid.patch new file mode 100644 index 00000000000..c4428b68263 --- /dev/null +++ b/queue-5.13/iommu-vt-d-fix-incomplete-cache-flush-in-intel_pasid.patch @@ -0,0 +1,92 @@ +From 16bc0fb398c19f3441c2dd95dd799297cab7ac13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 20:43:21 +0800 +Subject: iommu/vt-d: Fix incomplete cache flush in + intel_pasid_tear_down_entry() + +From: Liu Yi L + +[ Upstream commit 8798d36411196da86e70b994725349c16c1119f6 ] + +This fixes improper iotlb invalidation in intel_pasid_tear_down_entry(). +When a PASID was used as nested mode, released and reused, the following +error message will appear: + +[ 180.187556] Unexpected page request in Privilege Mode +[ 180.187565] Unexpected page request in Privilege Mode +[ 180.279933] Unexpected page request in Privilege Mode +[ 180.279937] Unexpected page request in Privilege Mode + +Per chapter 6.5.3.3 of VT-d spec 3.3, when tear down a pasid entry, the +software should use Domain selective IOTLB flush if the PGTT of the pasid +entry is SL only or Nested, while for the pasid entries whose PGTT is FL +only or PT using PASID-based IOTLB flush is enough. + +Fixes: 2cd1311a26673 ("iommu/vt-d: Add set domain DOMAIN_ATTR_NESTING attr") +Signed-off-by: Kumar Sanjay K +Signed-off-by: Liu Yi L +Tested-by: Yi Sun +Link: https://lore.kernel.org/r/20210817042425.1784279-1-yi.l.liu@intel.com +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20210817124321.1517985-3-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/pasid.c | 10 ++++++++-- + drivers/iommu/intel/pasid.h | 6 ++++++ + 2 files changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c +index 72dc84821dad..581c694b7cf4 100644 +--- a/drivers/iommu/intel/pasid.c ++++ b/drivers/iommu/intel/pasid.c +@@ -511,7 +511,7 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu, struct device *dev, + u32 pasid, bool fault_ignore) + { + struct pasid_entry *pte; +- u16 did; ++ u16 did, pgtt; + + pte = intel_pasid_get_entry(dev, pasid); + if (WARN_ON(!pte)) +@@ -521,13 +521,19 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu, struct device *dev, + return; + + did = pasid_get_domain_id(pte); ++ pgtt = pasid_pte_get_pgtt(pte); ++ + intel_pasid_clear_entry(dev, pasid, fault_ignore); + + if (!ecap_coherent(iommu->ecap)) + clflush_cache_range(pte, sizeof(*pte)); + + pasid_cache_invalidation_with_pasid(iommu, did, pasid); +- qi_flush_piotlb(iommu, did, pasid, 0, -1, 0); ++ ++ if (pgtt == PASID_ENTRY_PGTT_PT || pgtt == PASID_ENTRY_PGTT_FL_ONLY) ++ qi_flush_piotlb(iommu, did, pasid, 0, -1, 0); ++ else ++ iommu->flush.flush_iotlb(iommu, did, 0, 0, DMA_TLB_DSI_FLUSH); + + /* Device IOTLB doesn't need to be flushed in caching mode. */ + if (!cap_caching_mode(iommu->cap)) +diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h +index 5ff61c3d401f..c11bc8b833b8 100644 +--- a/drivers/iommu/intel/pasid.h ++++ b/drivers/iommu/intel/pasid.h +@@ -99,6 +99,12 @@ static inline bool pasid_pte_is_present(struct pasid_entry *pte) + return READ_ONCE(pte->val[0]) & PASID_PTE_PRESENT; + } + ++/* Get PGTT field of a PASID table entry */ ++static inline u16 pasid_pte_get_pgtt(struct pasid_entry *pte) ++{ ++ return (u16)((READ_ONCE(pte->val[0]) >> 6) & 0x7); ++} ++ + extern unsigned int intel_pasid_max_id; + int intel_pasid_alloc_table(struct device *dev); + void intel_pasid_free_table(struct device *dev); +-- +2.30.2 + diff --git a/queue-5.13/ixgbe-xsk-clean-up-the-resources-in-ixgbe_xsk_pool_e.patch b/queue-5.13/ixgbe-xsk-clean-up-the-resources-in-ixgbe_xsk_pool_e.patch new file mode 100644 index 00000000000..1b368fe5ffc --- /dev/null +++ b/queue-5.13/ixgbe-xsk-clean-up-the-resources-in-ixgbe_xsk_pool_e.patch @@ -0,0 +1,48 @@ +From 1c04848ba4030b0479ffa1528dc635d5f6a6be63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 13:37:36 -0700 +Subject: ixgbe, xsk: clean up the resources in ixgbe_xsk_pool_enable error + path + +From: Wang Hai + +[ Upstream commit 1b80fec7b043552e01609bae7d0aad07aa742adc ] + +In ixgbe_xsk_pool_enable(), if ixgbe_xsk_wakeup() fails, +We should restore the previous state and clean up the +resources. Add the missing clear af_xdp_zc_qps and unmap dma +to fix this bug. + +Fixes: d49e286d354e ("ixgbe: add tracking of AF_XDP zero-copy state for each queue pair") +Fixes: 4a9b32f30f80 ("ixgbe: fix potential RX buffer starvation for AF_XDP") +Signed-off-by: Wang Hai +Acked-by: Magnus Karlsson +Tested-by: Sandeep Penigalapati +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20210817203736.3529939-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c +index f72d2978263b..d60da7a89092 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c +@@ -52,8 +52,11 @@ static int ixgbe_xsk_pool_enable(struct ixgbe_adapter *adapter, + + /* Kick start the NAPI context so that receiving will start */ + err = ixgbe_xsk_wakeup(adapter->netdev, qid, XDP_WAKEUP_RX); +- if (err) ++ if (err) { ++ clear_bit(qid, adapter->af_xdp_zc_qps); ++ xsk_pool_dma_unmap(pool, IXGBE_RX_DMA_ATTR); + return err; ++ } + } + + return 0; +-- +2.30.2 + diff --git a/queue-5.13/mac80211-fix-locking-in-ieee80211_restart_work.patch b/queue-5.13/mac80211-fix-locking-in-ieee80211_restart_work.patch new file mode 100644 index 00000000000..15b5e68d394 --- /dev/null +++ b/queue-5.13/mac80211-fix-locking-in-ieee80211_restart_work.patch @@ -0,0 +1,37 @@ +From 7b77e7cb5eead926402345fb294a8331ddd7659a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 12:12:22 +0200 +Subject: mac80211: fix locking in ieee80211_restart_work() + +From: Johannes Berg + +[ Upstream commit 276e189f8e4e3cce1634d6bac4ed0d9ca242441b ] + +Ilan's change to move locking around accidentally lost the +wiphy_lock() during some porting, add it back. + +Fixes: 45daaa131841 ("mac80211: Properly WARN on HW scan before restart") +Signed-off-by: Johannes Berg +Link: https://lore.kernel.org/r/20210817121210.47bdb177064f.Ib1ef79440cd27f318c028ddfc0c642406917f512@changeid +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mac80211/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 2481bfdfafd0..efe5c3295455 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -260,6 +260,8 @@ static void ieee80211_restart_work(struct work_struct *work) + flush_work(&local->radar_detected_work); + + rtnl_lock(); ++ /* we might do interface manipulations, so need both */ ++ wiphy_lock(local->hw.wiphy); + + WARN(test_bit(SCAN_HW_SCANNING, &local->scanning), + "%s called with hardware scan in progress\n", __func__); +-- +2.30.2 + diff --git a/queue-5.13/mptcp-fix-memory-leak-on-address-flush.patch b/queue-5.13/mptcp-fix-memory-leak-on-address-flush.patch new file mode 100644 index 00000000000..b379b6a1c9f --- /dev/null +++ b/queue-5.13/mptcp-fix-memory-leak-on-address-flush.patch @@ -0,0 +1,145 @@ +From d7909f425be4cb0f1873ddb33be3bb4201c6c65b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 16:42:36 -0700 +Subject: mptcp: fix memory leak on address flush + +From: Paolo Abeni + +[ Upstream commit a0eea5f10eeb5180d115452b0d77afa6603dfe18 ] + +The endpoint cleanup path is prone to a memory leak, as reported +by syzkaller: + + BUG: memory leak + unreferenced object 0xffff88810680ea00 (size 64): + comm "syz-executor.6", pid 6191, jiffies 4295756280 (age 24.138s) + hex dump (first 32 bytes): + 58 75 7d 3c 80 88 ff ff 22 01 00 00 00 00 ad de Xu}<...."....... + 01 00 02 00 00 00 00 00 ac 1e 00 07 00 00 00 00 ................ + backtrace: + [<0000000072a9f72a>] kmalloc include/linux/slab.h:591 [inline] + [<0000000072a9f72a>] mptcp_nl_cmd_add_addr+0x287/0x9f0 net/mptcp/pm_netlink.c:1170 + [<00000000f6e931bf>] genl_family_rcv_msg_doit.isra.0+0x225/0x340 net/netlink/genetlink.c:731 + [<00000000f1504a2c>] genl_family_rcv_msg net/netlink/genetlink.c:775 [inline] + [<00000000f1504a2c>] genl_rcv_msg+0x341/0x5b0 net/netlink/genetlink.c:792 + [<0000000097e76f6a>] netlink_rcv_skb+0x148/0x430 net/netlink/af_netlink.c:2504 + [<00000000ceefa2b8>] genl_rcv+0x24/0x40 net/netlink/genetlink.c:803 + [<000000008ff91aec>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + [<000000008ff91aec>] netlink_unicast+0x537/0x750 net/netlink/af_netlink.c:1340 + [<0000000041682c35>] netlink_sendmsg+0x846/0xd80 net/netlink/af_netlink.c:1929 + [<00000000df3aa8e7>] sock_sendmsg_nosec net/socket.c:704 [inline] + [<00000000df3aa8e7>] sock_sendmsg+0x14e/0x190 net/socket.c:724 + [<000000002154c54c>] ____sys_sendmsg+0x709/0x870 net/socket.c:2403 + [<000000001aab01d7>] ___sys_sendmsg+0xff/0x170 net/socket.c:2457 + [<00000000fa3b1446>] __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486 + [<00000000db2ee9c7>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] + [<00000000db2ee9c7>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + [<000000005873517d>] entry_SYSCALL_64_after_hwframe+0x44/0xae + +We should not require an allocation to cleanup stuff. + +Rework the code a bit so that the additional RCU work is no more needed. + +Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port") +Signed-off-by: Paolo Abeni +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/pm_netlink.c | 44 ++++++++++++------------------------------ + 1 file changed, 12 insertions(+), 32 deletions(-) + +diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c +index fce1d057d19e..45b414efc001 100644 +--- a/net/mptcp/pm_netlink.c ++++ b/net/mptcp/pm_netlink.c +@@ -1135,36 +1135,12 @@ next: + return 0; + } + +-struct addr_entry_release_work { +- struct rcu_work rwork; +- struct mptcp_pm_addr_entry *entry; +-}; +- +-static void mptcp_pm_release_addr_entry(struct work_struct *work) ++/* caller must ensure the RCU grace period is already elapsed */ ++static void __mptcp_pm_release_addr_entry(struct mptcp_pm_addr_entry *entry) + { +- struct addr_entry_release_work *w; +- struct mptcp_pm_addr_entry *entry; +- +- w = container_of(to_rcu_work(work), struct addr_entry_release_work, rwork); +- entry = w->entry; +- if (entry) { +- if (entry->lsk) +- sock_release(entry->lsk); +- kfree(entry); +- } +- kfree(w); +-} +- +-static void mptcp_pm_free_addr_entry(struct mptcp_pm_addr_entry *entry) +-{ +- struct addr_entry_release_work *w; +- +- w = kmalloc(sizeof(*w), GFP_ATOMIC); +- if (w) { +- INIT_RCU_WORK(&w->rwork, mptcp_pm_release_addr_entry); +- w->entry = entry; +- queue_rcu_work(system_wq, &w->rwork); +- } ++ if (entry->lsk) ++ sock_release(entry->lsk); ++ kfree(entry); + } + + static int mptcp_nl_remove_id_zero_address(struct net *net, +@@ -1244,7 +1220,8 @@ static int mptcp_nl_cmd_del_addr(struct sk_buff *skb, struct genl_info *info) + spin_unlock_bh(&pernet->lock); + + mptcp_nl_remove_subflow_and_signal_addr(sock_net(skb->sk), &entry->addr); +- mptcp_pm_free_addr_entry(entry); ++ synchronize_rcu(); ++ __mptcp_pm_release_addr_entry(entry); + + return ret; + } +@@ -1297,6 +1274,7 @@ static void mptcp_nl_remove_addrs_list(struct net *net, + } + } + ++/* caller must ensure the RCU grace period is already elapsed */ + static void __flush_addrs(struct list_head *list) + { + while (!list_empty(list)) { +@@ -1305,7 +1283,7 @@ static void __flush_addrs(struct list_head *list) + cur = list_entry(list->next, + struct mptcp_pm_addr_entry, list); + list_del_rcu(&cur->list); +- mptcp_pm_free_addr_entry(cur); ++ __mptcp_pm_release_addr_entry(cur); + } + } + +@@ -1329,6 +1307,7 @@ static int mptcp_nl_cmd_flush_addrs(struct sk_buff *skb, struct genl_info *info) + bitmap_zero(pernet->id_bitmap, MAX_ADDR_ID + 1); + spin_unlock_bh(&pernet->lock); + mptcp_nl_remove_addrs_list(sock_net(skb->sk), &free_list); ++ synchronize_rcu(); + __flush_addrs(&free_list); + return 0; + } +@@ -1936,7 +1915,8 @@ static void __net_exit pm_nl_exit_net(struct list_head *net_list) + struct pm_nl_pernet *pernet = net_generic(net, pm_nl_pernet_id); + + /* net is removed from namespace list, can't race with +- * other modifiers ++ * other modifiers, also netns core already waited for a ++ * RCU grace period. + */ + __flush_addrs(&pernet->local_addr_list); + } +-- +2.30.2 + diff --git a/queue-5.13/mptcp-full-fully-established-support-after-add_addr.patch b/queue-5.13/mptcp-full-fully-established-support-after-add_addr.patch new file mode 100644 index 00000000000..b96d7846bb8 --- /dev/null +++ b/queue-5.13/mptcp-full-fully-established-support-after-add_addr.patch @@ -0,0 +1,64 @@ +From c4f5123a2aa852a235984fd7c739b55ab7919eb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 16:42:37 -0700 +Subject: mptcp: full fully established support after ADD_ADDR + +From: Matthieu Baerts + +[ Upstream commit 67b12f792d5eaeb8b4fca3b2053e6b819eb3bf0f ] + +If directly after an MP_CAPABLE 3WHS, the client receives an ADD_ADDR +with HMAC from the server, it is enough to switch to a "fully +established" mode because it has received more MPTCP options. + +It was then OK to enable the "fully_established" flag on the MPTCP +socket. Still, best to check if the ADD_ADDR looks valid by looking if +it contains an HMAC (no 'echo' bit). If an ADD_ADDR echo is received +while we are not in "fully established" mode, it is strange and then +we should not switch to this mode now. + +But that is not enough. On one hand, the path-manager has be notified +the state has changed. On the other hand, the "fully_established" flag +on the subflow socket should be turned on as well not to re-send the +MP_CAPABLE 3rd ACK content with the next ACK. + +Fixes: 84dfe3677a6f ("mptcp: send out dedicated ADD_ADDR packet") +Signed-off-by: Matthieu Baerts +Signed-off-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/options.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/net/mptcp/options.c b/net/mptcp/options.c +index 4f08e04e1ab7..f3ec85779733 100644 +--- a/net/mptcp/options.c ++++ b/net/mptcp/options.c +@@ -843,20 +843,16 @@ static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk, + return subflow->mp_capable; + } + +- if (mp_opt->dss && mp_opt->use_ack) { ++ if ((mp_opt->dss && mp_opt->use_ack) || ++ (mp_opt->add_addr && !mp_opt->echo)) { + /* subflows are fully established as soon as we get any +- * additional ack. ++ * additional ack, including ADD_ADDR. + */ + subflow->fully_established = 1; + WRITE_ONCE(msk->fully_established, true); + goto fully_established; + } + +- if (mp_opt->add_addr) { +- WRITE_ONCE(msk->fully_established, true); +- return true; +- } +- + /* If the first established packet does not contain MP_CAPABLE + data + * then fallback to TCP. Fallback scenarios requires a reset for + * MP_JOIN subflows. +-- +2.30.2 + diff --git a/queue-5.13/mt76-fix-enum-type-mismatch.patch b/queue-5.13/mt76-fix-enum-type-mismatch.patch new file mode 100644 index 00000000000..d1d6ed8bb1a --- /dev/null +++ b/queue-5.13/mt76-fix-enum-type-mismatch.patch @@ -0,0 +1,89 @@ +From 5291628fed5ac3a1b5f4316eccc0d10a352df643 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 17:06:56 +0200 +Subject: mt76: fix enum type mismatch + +From: Arnd Bergmann + +[ Upstream commit abf3d98dee7c4038152ce88833ddc2189f68cbd4 ] + +There is no 'NONE' version of 'enum mcu_cipher_type', and returning +'MT_CIPHER_NONE' causes a warning: + +drivers/net/wireless/mediatek/mt76/mt7921/mcu.c: In function 'mt7921_mcu_get_cipher': +drivers/net/wireless/mediatek/mt76/mt7921/mcu.c:114:24: error: implicit conversion from 'enum mt76_cipher_type' to 'enum mcu_cipher_type' [-Werror=enum-conversion] + 114 | return MT_CIPHER_NONE; + | ^~~~~~~~~~~~~~ + +Add the missing MCU_CIPHER_NONE defintion that fits in here with +the same value. + +Fixes: c368362c36d3 ("mt76: fix iv and CCMP header insertion") +Signed-off-by: Arnd Bergmann +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210721150745.1914829-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +- + drivers/net/wireless/mediatek/mt76/mt7915/mcu.h | 3 ++- + drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 2 +- + drivers/net/wireless/mediatek/mt76/mt7921/mcu.h | 3 ++- + 4 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index 607980321d27..106177072d18 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -111,7 +111,7 @@ mt7915_mcu_get_cipher(int cipher) + case WLAN_CIPHER_SUITE_SMS4: + return MCU_CIPHER_WAPI; + default: +- return MT_CIPHER_NONE; ++ return MCU_CIPHER_NONE; + } + } + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h +index 517621044d9e..c0255c3ac7d0 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.h +@@ -1035,7 +1035,8 @@ enum { + }; + + enum mcu_cipher_type { +- MCU_CIPHER_WEP40 = 1, ++ MCU_CIPHER_NONE = 0, ++ MCU_CIPHER_WEP40, + MCU_CIPHER_WEP104, + MCU_CIPHER_WEP128, + MCU_CIPHER_TKIP, +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +index 47843b055959..fc0d7dc3a5f3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +@@ -111,7 +111,7 @@ mt7921_mcu_get_cipher(int cipher) + case WLAN_CIPHER_SUITE_SMS4: + return MCU_CIPHER_WAPI; + default: +- return MT_CIPHER_NONE; ++ return MCU_CIPHER_NONE; + } + } + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h +index 07abe86f07a9..adad20819341 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.h +@@ -198,7 +198,8 @@ struct sta_rec_sec { + } __packed; + + enum mcu_cipher_type { +- MCU_CIPHER_WEP40 = 1, ++ MCU_CIPHER_NONE = 0, ++ MCU_CIPHER_WEP40, + MCU_CIPHER_WEP104, + MCU_CIPHER_WEP128, + MCU_CIPHER_TKIP, +-- +2.30.2 + diff --git a/queue-5.13/mtd-rawnand-add-a-check-in-of_get_nand_secure_region.patch b/queue-5.13/mtd-rawnand-add-a-check-in-of_get_nand_secure_region.patch new file mode 100644 index 00000000000..8fc9c863c62 --- /dev/null +++ b/queue-5.13/mtd-rawnand-add-a-check-in-of_get_nand_secure_region.patch @@ -0,0 +1,40 @@ +From 6f280aeb21ff4c593303e4b4e712073ed93494fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 16:37:25 +0300 +Subject: mtd: rawnand: Add a check in of_get_nand_secure_regions() + +From: Dan Carpenter + +[ Upstream commit 14f97f0b8e2b9950c028d0cb7311ffe26a3cc1c0 ] + +Check for whether of_property_count_elems_of_size() returns a negative +error code. + +Fixes: 13b89768275d ("mtd: rawnand: Add support for secure regions in NAND memory") +Signed-off-by: Dan Carpenter +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/YMtQFXE0F1w7mUh+@mwanda +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/nand_base.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c +index fb072c444495..b18c089a7dca 100644 +--- a/drivers/mtd/nand/raw/nand_base.c ++++ b/drivers/mtd/nand/raw/nand_base.c +@@ -5059,8 +5059,8 @@ static int of_get_nand_secure_regions(struct nand_chip *chip) + int nr_elem, i, j; + + nr_elem = of_property_count_elems_of_size(dn, "secure-regions", sizeof(u64)); +- if (!nr_elem) +- return 0; ++ if (nr_elem <= 0) ++ return nr_elem; + + chip->nr_secure_regions = nr_elem / 2; + chip->secure_regions = kcalloc(chip->nr_secure_regions, sizeof(*chip->secure_regions), +-- +2.30.2 + diff --git a/queue-5.13/mtd-rawnand-fix-probe-failure-due-to-of_get_nand_sec.patch b/queue-5.13/mtd-rawnand-fix-probe-failure-due-to-of_get_nand_sec.patch new file mode 100644 index 00000000000..08b58692bbc --- /dev/null +++ b/queue-5.13/mtd-rawnand-fix-probe-failure-due-to-of_get_nand_sec.patch @@ -0,0 +1,56 @@ +From fa5115d2e5783992db2fed7443ea62cc8ae64b8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 11:58:13 +0530 +Subject: mtd: rawnand: Fix probe failure due to of_get_nand_secure_regions() + +From: Manivannan Sadhasivam + +[ Upstream commit b48027083a78b13356695555a05b0e085e378687 ] + +Due to 14f97f0b8e2b, the rawnand platforms without "secure-regions" +property defined in DT fails to probe. The issue is, +of_get_nand_secure_regions() errors out if +of_property_count_elems_of_size() returns a negative error code. + +If the "secure-regions" property is not present in DT, then also we'll +get -EINVAL from of_property_count_elems_of_size() but it should not +be treated as an error for platforms not declaring "secure-regions" +in DT. + +So fix this behaviour by checking for the existence of that property in +DT and return 0 if it is not present. + +Fixes: 14f97f0b8e2b ("mtd: rawnand: Add a check in of_get_nand_secure_regions()") +Reported-by: Martin Kaiser +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Martin Kaiser +Tested-by: Martin Kaiser +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210727062813.32619-1-manivannan.sadhasivam@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/nand_base.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c +index b18c089a7dca..4412fdc240a2 100644 +--- a/drivers/mtd/nand/raw/nand_base.c ++++ b/drivers/mtd/nand/raw/nand_base.c +@@ -5056,8 +5056,14 @@ static bool of_get_nand_on_flash_bbt(struct device_node *np) + static int of_get_nand_secure_regions(struct nand_chip *chip) + { + struct device_node *dn = nand_get_flash_node(chip); ++ struct property *prop; + int nr_elem, i, j; + ++ /* Only proceed if the "secure-regions" property is present in DT */ ++ prop = of_find_property(dn, "secure-regions", NULL); ++ if (!prop) ++ return 0; ++ + nr_elem = of_property_count_elems_of_size(dn, "secure-regions", sizeof(u64)); + if (nr_elem <= 0) + return nr_elem; +-- +2.30.2 + diff --git a/queue-5.13/net-6pack-fix-slab-out-of-bounds-in-decode_data.patch b/queue-5.13/net-6pack-fix-slab-out-of-bounds-in-decode_data.patch new file mode 100644 index 00000000000..4da9f153597 --- /dev/null +++ b/queue-5.13/net-6pack-fix-slab-out-of-bounds-in-decode_data.patch @@ -0,0 +1,67 @@ +From fd01ef33c00610f097684ffe4572e149b0b611be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 18:14:33 +0300 +Subject: net: 6pack: fix slab-out-of-bounds in decode_data + +From: Pavel Skripkin + +[ Upstream commit 19d1532a187669ce86d5a2696eb7275310070793 ] + +Syzbot reported slab-out-of bounds write in decode_data(). +The problem was in missing validation checks. + +Syzbot's reproducer generated malicious input, which caused +decode_data() to be called a lot in sixpack_decode(). Since +rx_count_cooked is only 400 bytes and noone reported before, +that 400 bytes is not enough, let's just check if input is malicious +and complain about buffer overrun. + +Fail log: +================================================================== +BUG: KASAN: slab-out-of-bounds in drivers/net/hamradio/6pack.c:843 +Write of size 1 at addr ffff888087c5544e by task kworker/u4:0/7 + +CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.6.0-rc3-syzkaller #0 +... +Workqueue: events_unbound flush_to_ldisc +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x197/0x210 lib/dump_stack.c:118 + print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 + __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506 + kasan_report+0x12/0x20 mm/kasan/common.c:641 + __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:137 + decode_data.part.0+0x23b/0x270 drivers/net/hamradio/6pack.c:843 + decode_data drivers/net/hamradio/6pack.c:965 [inline] + sixpack_decode drivers/net/hamradio/6pack.c:968 [inline] + +Reported-and-tested-by: syzbot+fc8cd9a673d4577fb2e4@syzkaller.appspotmail.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Pavel Skripkin +Reviewed-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/hamradio/6pack.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index 80f41945709f..da6a2a4b6cc7 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -833,6 +833,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte) + return; + } + ++ if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) { ++ pr_err("6pack: cooked buffer overrun, data loss\n"); ++ sp->rx_count = 0; ++ return; ++ } ++ + buf = sp->raw_buf; + sp->cooked_buf[sp->rx_count_cooked++] = + buf[0] | ((buf[1] << 2) & 0xc0); +-- +2.30.2 + diff --git a/queue-5.13/net-dpaa2-switch-disable-the-control-interface-on-er.patch b/queue-5.13/net-dpaa2-switch-disable-the-control-interface-on-er.patch new file mode 100644 index 00000000000..9b335480c75 --- /dev/null +++ b/queue-5.13/net-dpaa2-switch-disable-the-control-interface-on-er.patch @@ -0,0 +1,164 @@ +From f273137eae967d3677ad7c82156e0523b6fb86ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 17:17:55 +0300 +Subject: net: dpaa2-switch: disable the control interface on error path + +From: Vladimir Oltean + +[ Upstream commit cd0a719fbd702eb4b455a6ad986483750125588a ] + +Currently dpaa2_switch_takedown has a funny name and does not do the +opposite of dpaa2_switch_init, which makes probing fail when we need to +handle an -EPROBE_DEFER. + +A sketch of what dpaa2_switch_init does: + + dpsw_open + + dpaa2_switch_detect_features + + dpsw_reset + + for (i = 0; i < ethsw->sw_attr.num_ifs; i++) { + dpsw_if_disable + + dpsw_if_set_stp + + dpsw_vlan_remove_if_untagged + + dpsw_if_set_tci + + dpsw_vlan_remove_if + } + + dpsw_vlan_remove + + alloc_ordered_workqueue + + dpsw_fdb_remove + + dpaa2_switch_ctrl_if_setup + +When dpaa2_switch_takedown is called from the error path of +dpaa2_switch_probe(), the control interface, enabled by +dpaa2_switch_ctrl_if_setup from dpaa2_switch_init, remains enabled, +because dpaa2_switch_takedown does not call +dpaa2_switch_ctrl_if_teardown. + +Since dpaa2_switch_probe might fail due to EPROBE_DEFER of a PHY, this +means that a second probe of the driver will happen with the control +interface directly enabled. + +This will trigger a second error: + +[ 93.273528] fsl_dpaa2_switch dpsw.0: dpsw_ctrl_if_set_pools() failed +[ 93.281966] fsl_dpaa2_switch dpsw.0: fsl_mc_driver_probe failed: -13 +[ 93.288323] fsl_dpaa2_switch: probe of dpsw.0 failed with error -13 + +Which if we investigate the /dev/dpaa2_mc_console log, we find out is +caused by: + +[E, ctrl_if_set_pools:2211, DPMNG] ctrl_if must be disabled + +So make dpaa2_switch_takedown do the opposite of dpaa2_switch_init (in +reasonable limits, no reason to change STP state, re-add VLANs etc), and +rename it to something more conventional, like dpaa2_switch_teardown. + +Fixes: 613c0a5810b7 ("staging: dpaa2-switch: enable the control interface") +Signed-off-by: Vladimir Oltean +Reviewed-by: Ioana Ciornei +Link: https://lore.kernel.org/r/20210819141755.1931423-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../ethernet/freescale/dpaa2/dpaa2-switch.c | 36 +++++++++---------- + 1 file changed, 18 insertions(+), 18 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +index 87321b7239cf..58964d22cb17 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +@@ -3038,26 +3038,30 @@ static int dpaa2_switch_port_init(struct ethsw_port_priv *port_priv, u16 port) + return err; + } + +-static void dpaa2_switch_takedown(struct fsl_mc_device *sw_dev) ++static void dpaa2_switch_ctrl_if_teardown(struct ethsw_core *ethsw) ++{ ++ dpsw_ctrl_if_disable(ethsw->mc_io, 0, ethsw->dpsw_handle); ++ dpaa2_switch_free_dpio(ethsw); ++ dpaa2_switch_destroy_rings(ethsw); ++ dpaa2_switch_drain_bp(ethsw); ++ dpaa2_switch_free_dpbp(ethsw); ++} ++ ++static void dpaa2_switch_teardown(struct fsl_mc_device *sw_dev) + { + struct device *dev = &sw_dev->dev; + struct ethsw_core *ethsw = dev_get_drvdata(dev); + int err; + ++ dpaa2_switch_ctrl_if_teardown(ethsw); ++ ++ destroy_workqueue(ethsw->workqueue); ++ + err = dpsw_close(ethsw->mc_io, 0, ethsw->dpsw_handle); + if (err) + dev_warn(dev, "dpsw_close err %d\n", err); + } + +-static void dpaa2_switch_ctrl_if_teardown(struct ethsw_core *ethsw) +-{ +- dpsw_ctrl_if_disable(ethsw->mc_io, 0, ethsw->dpsw_handle); +- dpaa2_switch_free_dpio(ethsw); +- dpaa2_switch_destroy_rings(ethsw); +- dpaa2_switch_drain_bp(ethsw); +- dpaa2_switch_free_dpbp(ethsw); +-} +- + static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev) + { + struct ethsw_port_priv *port_priv; +@@ -3068,8 +3072,6 @@ static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev) + dev = &sw_dev->dev; + ethsw = dev_get_drvdata(dev); + +- dpaa2_switch_ctrl_if_teardown(ethsw); +- + dpaa2_switch_teardown_irqs(sw_dev); + + dpsw_disable(ethsw->mc_io, 0, ethsw->dpsw_handle); +@@ -3084,9 +3086,7 @@ static int dpaa2_switch_remove(struct fsl_mc_device *sw_dev) + kfree(ethsw->acls); + kfree(ethsw->ports); + +- dpaa2_switch_takedown(sw_dev); +- +- destroy_workqueue(ethsw->workqueue); ++ dpaa2_switch_teardown(sw_dev); + + fsl_mc_portal_free(ethsw->mc_io); + +@@ -3199,7 +3199,7 @@ static int dpaa2_switch_probe(struct fsl_mc_device *sw_dev) + GFP_KERNEL); + if (!(ethsw->ports)) { + err = -ENOMEM; +- goto err_takedown; ++ goto err_teardown; + } + + ethsw->fdbs = kcalloc(ethsw->sw_attr.num_ifs, sizeof(*ethsw->fdbs), +@@ -3270,8 +3270,8 @@ err_free_fdbs: + err_free_ports: + kfree(ethsw->ports); + +-err_takedown: +- dpaa2_switch_takedown(sw_dev); ++err_teardown: ++ dpaa2_switch_teardown(sw_dev); + + err_free_cmdport: + fsl_mc_portal_free(ethsw->mc_io); +-- +2.30.2 + diff --git a/queue-5.13/net-mdio-mux-don-t-ignore-memory-allocation-errors.patch b/queue-5.13/net-mdio-mux-don-t-ignore-memory-allocation-errors.patch new file mode 100644 index 00000000000..e34c8b05e9b --- /dev/null +++ b/queue-5.13/net-mdio-mux-don-t-ignore-memory-allocation-errors.patch @@ -0,0 +1,96 @@ +From 982d76a6d0381e17567278c10ef9fb87b7d6589b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 20:38:02 -0700 +Subject: net: mdio-mux: Don't ignore memory allocation errors + +From: Saravana Kannan + +[ Upstream commit 99d81e942474cc7677d12f673f42a7ea699e2589 ] + +If we are seeing memory allocation errors, don't try to continue +registering child mdiobus devices. It's unlikely they'll succeed. + +Fixes: 342fa1964439 ("mdio: mux: make child bus walking more permissive and errors more verbose") +Signed-off-by: Saravana Kannan +Reviewed-by: Andrew Lunn +Acked-by: Marc Zyngier +Tested-by: Marc Zyngier +Acked-by: Kevin Hilman +Tested-by: Kevin Hilman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/mdio/mdio-mux.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/mdio/mdio-mux.c b/drivers/net/mdio/mdio-mux.c +index 110e4ee85785..d6ed9033339c 100644 +--- a/drivers/net/mdio/mdio-mux.c ++++ b/drivers/net/mdio/mdio-mux.c +@@ -82,6 +82,17 @@ out: + + static int parent_count; + ++static void mdio_mux_uninit_children(struct mdio_mux_parent_bus *pb) ++{ ++ struct mdio_mux_child_bus *cb = pb->children; ++ ++ while (cb) { ++ mdiobus_unregister(cb->mii_bus); ++ mdiobus_free(cb->mii_bus); ++ cb = cb->next; ++ } ++} ++ + int mdio_mux_init(struct device *dev, + struct device_node *mux_node, + int (*switch_fn)(int cur, int desired, void *data), +@@ -144,7 +155,7 @@ int mdio_mux_init(struct device *dev, + cb = devm_kzalloc(dev, sizeof(*cb), GFP_KERNEL); + if (!cb) { + ret_val = -ENOMEM; +- continue; ++ goto err_loop; + } + cb->bus_number = v; + cb->parent = pb; +@@ -152,8 +163,7 @@ int mdio_mux_init(struct device *dev, + cb->mii_bus = mdiobus_alloc(); + if (!cb->mii_bus) { + ret_val = -ENOMEM; +- devm_kfree(dev, cb); +- continue; ++ goto err_loop; + } + cb->mii_bus->priv = cb; + +@@ -182,6 +192,10 @@ int mdio_mux_init(struct device *dev, + + dev_err(dev, "Error: No acceptable child buses found\n"); + devm_kfree(dev, pb); ++ ++err_loop: ++ mdio_mux_uninit_children(pb); ++ of_node_put(child_bus_node); + err_pb_kz: + put_device(&parent_bus->dev); + err_parent_bus: +@@ -193,14 +207,8 @@ EXPORT_SYMBOL_GPL(mdio_mux_init); + void mdio_mux_uninit(void *mux_handle) + { + struct mdio_mux_parent_bus *pb = mux_handle; +- struct mdio_mux_child_bus *cb = pb->children; +- +- while (cb) { +- mdiobus_unregister(cb->mii_bus); +- mdiobus_free(cb->mii_bus); +- cb = cb->next; +- } + ++ mdio_mux_uninit_children(pb); + put_device(&pb->mii_bus->dev); + } + EXPORT_SYMBOL_GPL(mdio_mux_uninit); +-- +2.30.2 + diff --git a/queue-5.13/net-mdio-mux-handle-eprobe_defer-correctly.patch b/queue-5.13/net-mdio-mux-handle-eprobe_defer-correctly.patch new file mode 100644 index 00000000000..d0210dc4d1a --- /dev/null +++ b/queue-5.13/net-mdio-mux-handle-eprobe_defer-correctly.patch @@ -0,0 +1,58 @@ +From 5991a8634b50e3c851207ab5c2222906ad04bc19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 20:38:03 -0700 +Subject: net: mdio-mux: Handle -EPROBE_DEFER correctly + +From: Saravana Kannan + +[ Upstream commit 7bd0cef5dac685f09ef8b0b2a7748ff42d284dc7 ] + +When registering mdiobus children, if we get an -EPROBE_DEFER, we shouldn't +ignore it and continue registering the rest of the mdiobus children. This +would permanently prevent the deferring child mdiobus from working instead +of reattempting it in the future. So, if a child mdiobus needs to be +reattempted in the future, defer the entire mdio-mux initialization. + +This fixes the issue where PHYs sitting under the mdio-mux aren't +initialized correctly if the PHY's interrupt controller is not yet ready +when the mdio-mux is being probed. Additional context in the link below. + +Fixes: 0ca2997d1452 ("netdev/of/phy: Add MDIO bus multiplexer support.") +Link: https://lore.kernel.org/lkml/CAGETcx95kHrv8wA-O+-JtfH7H9biJEGJtijuPVN0V5dUKUAB3A@mail.gmail.com/#t +Signed-off-by: Saravana Kannan +Reviewed-by: Andrew Lunn +Acked-by: Marc Zyngier +Tested-by: Marc Zyngier +Acked-by: Kevin Hilman +Tested-by: Kevin Hilman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/mdio/mdio-mux.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/mdio/mdio-mux.c b/drivers/net/mdio/mdio-mux.c +index d6ed9033339c..3dde0c2b3e09 100644 +--- a/drivers/net/mdio/mdio-mux.c ++++ b/drivers/net/mdio/mdio-mux.c +@@ -175,11 +175,15 @@ int mdio_mux_init(struct device *dev, + cb->mii_bus->write = mdio_mux_write; + r = of_mdiobus_register(cb->mii_bus, child_bus_node); + if (r) { ++ mdiobus_free(cb->mii_bus); ++ if (r == -EPROBE_DEFER) { ++ ret_val = r; ++ goto err_loop; ++ } ++ devm_kfree(dev, cb); + dev_err(dev, + "Error: Failed to register MDIO bus for child %pOF\n", + child_bus_node); +- mdiobus_free(cb->mii_bus); +- devm_kfree(dev, cb); + } else { + cb->next = pb->children; + pb->children = cb; +-- +2.30.2 + diff --git a/queue-5.13/net-mscc-ocelot-allow-forwarding-from-bridge-ports-t.patch b/queue-5.13/net-mscc-ocelot-allow-forwarding-from-bridge-ports-t.patch new file mode 100644 index 00000000000..3a5b4379098 --- /dev/null +++ b/queue-5.13/net-mscc-ocelot-allow-forwarding-from-bridge-ports-t.patch @@ -0,0 +1,69 @@ +From 1df8e344f9436042bfb7365bf3d6d9d280bc53f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 19:04:25 +0300 +Subject: net: mscc: ocelot: allow forwarding from bridge ports to the + tag_8021q CPU port + +From: Vladimir Oltean + +[ Upstream commit c1930148a3941f891ddbd76fceaa4e10a957ccf2 ] + +Currently we are unable to ping a bridge on top of a felix switch which +uses the ocelot-8021q tagger. The packets are dropped on the ingress of +the user port and the 'drop_local' counter increments (the counter which +denotes drops due to no valid destinations). + +Dumping the PGID tables, it becomes clear that the PGID_SRC of the user +port is zero, so it has no valid destinations. + +But looking at the code, the cpu_fwd_mask (the bit mask of DSA tag_8021q +ports) is clearly missing from the forwarding mask of ports that are +under a bridge. So this has always been broken. + +Looking at the version history of the patch, in v7 +https://patchwork.kernel.org/project/netdevbpf/patch/20210125220333.1004365-12-olteanv@gmail.com/ +the code looked like this: + + /* Standalone ports forward only to DSA tag_8021q CPU ports */ + unsigned long mask = cpu_fwd_mask; + +(...) + } else if (ocelot->bridge_fwd_mask & BIT(port)) { + mask |= ocelot->bridge_fwd_mask & ~BIT(port); + +while in v8 (the merged version) +https://patchwork.kernel.org/project/netdevbpf/patch/20210129010009.3959398-12-olteanv@gmail.com/ +it looked like this: + + unsigned long mask; + +(...) + } else if (ocelot->bridge_fwd_mask & BIT(port)) { + mask = ocelot->bridge_fwd_mask & ~BIT(port); + +So the breakage was introduced between v7 and v8 of the patch. + +Fixes: e21268efbe26 ("net: dsa: felix: perform switch setup for tag_8021q") +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20210817160425.3702809-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c +index adfb9781799e..2948d731a1c1 100644 +--- a/drivers/net/ethernet/mscc/ocelot.c ++++ b/drivers/net/ethernet/mscc/ocelot.c +@@ -1334,6 +1334,7 @@ void ocelot_apply_bridge_fwd_mask(struct ocelot *ocelot) + struct net_device *bond = ocelot_port->bond; + + mask = ocelot_get_bridge_fwd_mask(ocelot, bridge); ++ mask |= cpu_fwd_mask; + mask &= ~BIT(port); + if (bond) { + mask &= ~ocelot_get_bond_mask(ocelot, bond, +-- +2.30.2 + diff --git a/queue-5.13/net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch b/queue-5.13/net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch new file mode 100644 index 00000000000..d032207c333 --- /dev/null +++ b/queue-5.13/net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch @@ -0,0 +1,42 @@ +From 4cf2f88ee730dae592ff8c7b1b972ff0f9e8e663 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 21:14:04 +0800 +Subject: net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 + +From: Dinghao Liu + +[ Upstream commit 0a298d133893c72c96e2156ed7cb0f0c4a306a3e ] + +qlcnic_83xx_unlock_flash() is called on all paths after we call +qlcnic_83xx_lock_flash(), except for one error path on failure +of QLCRD32(), which may cause a deadlock. This bug is suggested +by a static analysis tool, please advise. + +Fixes: 81d0aeb0a4fff ("qlcnic: flash template based firmware reset recovery") +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20210816131405.24024-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +index d8882d0b6b49..d51bac7ba5af 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +@@ -3156,8 +3156,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr, + + indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr); + ret = QLCRD32(adapter, indirect_addr, &err); +- if (err == -EIO) ++ if (err == -EIO) { ++ qlcnic_83xx_unlock_flash(adapter); + return err; ++ } + + word = ret; + *(u32 *)p_data = word; +-- +2.30.2 + diff --git a/queue-5.13/net-usb-asix-refactor-asix_read_phy_addr-and-handle-.patch b/queue-5.13/net-usb-asix-refactor-asix_read_phy_addr-and-handle-.patch new file mode 100644 index 00000000000..b90b7d013a4 --- /dev/null +++ b/queue-5.13/net-usb-asix-refactor-asix_read_phy_addr-and-handle-.patch @@ -0,0 +1,149 @@ +From 04368fb278bb6b0d01badb37d7ca590be4b0e7a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 10:27:21 +0200 +Subject: net: usb: asix: refactor asix_read_phy_addr() and handle errors on + return + +From: Oleksij Rempel + +[ Upstream commit 7e88b11a862afe59ee0c365123ea5fb96a26cb3b ] + +Refactor asix_read_phy_addr() to return usable error value directly and +make sure all callers handle this error. + +Signed-off-by: Oleksij Rempel +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/asix.h | 3 +-- + drivers/net/usb/asix_common.c | 31 ++++++++++++++++--------------- + drivers/net/usb/asix_devices.c | 15 ++++++++++++--- + drivers/net/usb/ax88172a.c | 5 +++++ + 4 files changed, 34 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/usb/asix.h b/drivers/net/usb/asix.h +index 3b53685301de..edb94efd265e 100644 +--- a/drivers/net/usb/asix.h ++++ b/drivers/net/usb/asix.h +@@ -205,8 +205,7 @@ struct sk_buff *asix_tx_fixup(struct usbnet *dev, struct sk_buff *skb, + int asix_set_sw_mii(struct usbnet *dev, int in_pm); + int asix_set_hw_mii(struct usbnet *dev, int in_pm); + +-int asix_read_phy_addr(struct usbnet *dev, int internal); +-int asix_get_phy_addr(struct usbnet *dev); ++int asix_read_phy_addr(struct usbnet *dev, bool internal); + + int asix_sw_reset(struct usbnet *dev, u8 flags, int in_pm); + +diff --git a/drivers/net/usb/asix_common.c b/drivers/net/usb/asix_common.c +index 7bc6e8f856fe..e1109f1a8dd5 100644 +--- a/drivers/net/usb/asix_common.c ++++ b/drivers/net/usb/asix_common.c +@@ -288,32 +288,33 @@ int asix_set_hw_mii(struct usbnet *dev, int in_pm) + return ret; + } + +-int asix_read_phy_addr(struct usbnet *dev, int internal) ++int asix_read_phy_addr(struct usbnet *dev, bool internal) + { +- int offset = (internal ? 1 : 0); ++ int ret, offset; + u8 buf[2]; +- int ret = asix_read_cmd(dev, AX_CMD_READ_PHY_ID, 0, 0, 2, buf, 0); + +- netdev_dbg(dev->net, "asix_get_phy_addr()\n"); ++ ret = asix_read_cmd(dev, AX_CMD_READ_PHY_ID, 0, 0, 2, buf, 0); ++ if (ret < 0) ++ goto error; + + if (ret < 2) { +- netdev_err(dev->net, "Error reading PHYID register: %02x\n", ret); +- goto out; ++ ret = -EIO; ++ goto error; + } +- netdev_dbg(dev->net, "asix_get_phy_addr() returning 0x%04x\n", +- *((__le16 *)buf)); ++ ++ offset = (internal ? 1 : 0); + ret = buf[offset]; + +-out: ++ netdev_dbg(dev->net, "%s PHY address 0x%x\n", ++ internal ? "internal" : "external", ret); ++ + return ret; +-} + +-int asix_get_phy_addr(struct usbnet *dev) +-{ +- /* return the address of the internal phy */ +- return asix_read_phy_addr(dev, 1); +-} ++error: ++ netdev_err(dev->net, "Error reading PHY_ID register: %02x\n", ret); + ++ return ret; ++} + + int asix_sw_reset(struct usbnet *dev, u8 flags, int in_pm) + { +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index 19a8fafb8f04..fb523734bf31 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -262,7 +262,10 @@ static int ax88172_bind(struct usbnet *dev, struct usb_interface *intf) + dev->mii.mdio_write = asix_mdio_write; + dev->mii.phy_id_mask = 0x3f; + dev->mii.reg_num_mask = 0x1f; +- dev->mii.phy_id = asix_get_phy_addr(dev); ++ ++ dev->mii.phy_id = asix_read_phy_addr(dev, true); ++ if (dev->mii.phy_id < 0) ++ return dev->mii.phy_id; + + dev->net->netdev_ops = &ax88172_netdev_ops; + dev->net->ethtool_ops = &ax88172_ethtool_ops; +@@ -717,7 +720,10 @@ static int ax88772_bind(struct usbnet *dev, struct usb_interface *intf) + dev->mii.mdio_write = asix_mdio_write; + dev->mii.phy_id_mask = 0x1f; + dev->mii.reg_num_mask = 0x1f; +- dev->mii.phy_id = asix_get_phy_addr(dev); ++ ++ dev->mii.phy_id = asix_read_phy_addr(dev, true); ++ if (dev->mii.phy_id < 0) ++ return dev->mii.phy_id; + + dev->net->netdev_ops = &ax88772_netdev_ops; + dev->net->ethtool_ops = &ax88772_ethtool_ops; +@@ -1081,7 +1087,10 @@ static int ax88178_bind(struct usbnet *dev, struct usb_interface *intf) + dev->mii.phy_id_mask = 0x1f; + dev->mii.reg_num_mask = 0xff; + dev->mii.supports_gmii = 1; +- dev->mii.phy_id = asix_get_phy_addr(dev); ++ ++ dev->mii.phy_id = asix_read_phy_addr(dev, true); ++ if (dev->mii.phy_id < 0) ++ return dev->mii.phy_id; + + dev->net->netdev_ops = &ax88178_netdev_ops; + dev->net->ethtool_ops = &ax88178_ethtool_ops; +diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c +index b404c9462dce..c8ca5187eece 100644 +--- a/drivers/net/usb/ax88172a.c ++++ b/drivers/net/usb/ax88172a.c +@@ -220,6 +220,11 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) + } + + priv->phy_addr = asix_read_phy_addr(dev, priv->use_embdphy); ++ if (priv->phy_addr < 0) { ++ ret = priv->phy_addr; ++ goto free; ++ } ++ + ax88172a_reset_phy(dev, priv->use_embdphy); + + /* Asix framing packs multiple eth frames into a 2K usb bulk transfer */ +-- +2.30.2 + diff --git a/queue-5.13/ovs-clear-skb-tstamp-in-forwarding-path.patch b/queue-5.13/ovs-clear-skb-tstamp-in-forwarding-path.patch new file mode 100644 index 00000000000..13a9e3834e4 --- /dev/null +++ b/queue-5.13/ovs-clear-skb-tstamp-in-forwarding-path.patch @@ -0,0 +1,39 @@ +From 26e2aad1e4b930ae12ef48e17cf88ea0db00126b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 10:22:15 +0800 +Subject: ovs: clear skb->tstamp in forwarding path + +From: kaixi.fan + +[ Upstream commit 01634047bf0d5c2d9b7d8095bb4de1663dbeedeb ] + +fq qdisc requires tstamp to be cleared in the forwarding path. Now ovs +doesn't clear skb->tstamp. We encountered a problem with linux +version 5.4.56 and ovs version 2.14.1, and packets failed to +dequeue from qdisc when fq qdisc was attached to ovs port. + +Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") +Signed-off-by: kaixi.fan +Signed-off-by: xiexiaohui +Reviewed-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/openvswitch/vport.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c +index 88deb5b41429..cf2ce5812489 100644 +--- a/net/openvswitch/vport.c ++++ b/net/openvswitch/vport.c +@@ -507,6 +507,7 @@ void ovs_vport_send(struct vport *vport, struct sk_buff *skb, u8 mac_proto) + } + + skb->dev = vport->dev; ++ skb->tstamp = 0; + vport->ops->send(skb); + return; + +-- +2.30.2 + diff --git a/queue-5.13/pci-sysfs-use-correct-variable-for-the-legacy_mem-sy.patch b/queue-5.13/pci-sysfs-use-correct-variable-for-the-legacy_mem-sy.patch new file mode 100644 index 00000000000..c58f27bfba7 --- /dev/null +++ b/queue-5.13/pci-sysfs-use-correct-variable-for-the-legacy_mem-sy.patch @@ -0,0 +1,53 @@ +From 8e54829b8657913b6c2e8812adf28cef16137c27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 13:21:44 +0000 +Subject: PCI/sysfs: Use correct variable for the legacy_mem sysfs object +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Wilczyński + +[ Upstream commit 045a9277b5615846c7b662ffaba84e781f08a172 ] + +Two legacy PCI sysfs objects "legacy_io" and "legacy_mem" were updated +to use an unified address space in the commit 636b21b50152 ("PCI: Revoke +mappings like devmem"). This allows for revocations to be managed from +a single place when drivers want to take over and mmap() a /dev/mem +range. + +Following the update, both of the sysfs objects should leverage the +iomem_get_mapping() function to get an appropriate address range, but +only the "legacy_io" has been correctly updated - the second attribute +seems to be using a wrong variable to pass the iomem_get_mapping() +function to. + +Thus, correct the variable name used so that the "legacy_mem" sysfs +object would also correctly call the iomem_get_mapping() function. + +Fixes: 636b21b50152 ("PCI: Revoke mappings like devmem") +Link: https://lore.kernel.org/r/20210812132144.791268-1-kw@linux.com +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Reviewed-by: Daniel Vetter +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index beb8d1f4fafe..fb667d78e7b3 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -978,7 +978,7 @@ void pci_create_legacy_files(struct pci_bus *b) + b->legacy_mem->size = 1024*1024; + b->legacy_mem->attr.mode = 0600; + b->legacy_mem->mmap = pci_mmap_legacy_mem; +- b->legacy_io->mapping = iomem_get_mapping(); ++ b->legacy_mem->mapping = iomem_get_mapping(); + pci_adjust_legacy_attr(b, pci_mmap_mem); + error = device_create_bin_file(&b->dev, b->legacy_mem); + if (error) +-- +2.30.2 + diff --git a/queue-5.13/pipe-avoid-unnecessary-epollet-wakeups-under-normal-.patch b/queue-5.13/pipe-avoid-unnecessary-epollet-wakeups-under-normal-.patch new file mode 100644 index 00000000000..ad3c69368f3 --- /dev/null +++ b/queue-5.13/pipe-avoid-unnecessary-epollet-wakeups-under-normal-.patch @@ -0,0 +1,126 @@ +From e1a59cd6661205fa704484f06408751eb5451a5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 10:04:43 -0700 +Subject: pipe: avoid unnecessary EPOLLET wakeups under normal loads + +From: Linus Torvalds + +[ Upstream commit 3b844826b6c6affa80755254da322b017358a2f4 ] + +I had forgotten just how sensitive hackbench is to extra pipe wakeups, +and commit 3a34b13a88ca ("pipe: make pipe writes always wake up +readers") ended up causing a quite noticeable regression on larger +machines. + +Now, hackbench isn't necessarily a hugely meaningful benchmark, and it's +not clear that this matters in real life all that much, but as Mel +points out, it's used often enough when comparing kernels and so the +performance regression shows up like a sore thumb. + +It's easy enough to fix at least for the common cases where pipes are +used purely for data transfer, and you never have any exciting poll +usage at all. So set a special 'poll_usage' flag when there is polling +activity, and make the ugly "EPOLLET has crazy legacy expectations" +semantics explicit to only that case. + +I would love to limit it to just the broken EPOLLET case, but the pipe +code can't see the difference between epoll and regular select/poll, so +any non-read/write waiting will trigger the extra wakeup behavior. That +is sufficient for at least the hackbench case. + +Apart from making the odd extra wakeup cases more explicitly about +EPOLLET, this also makes the extra wakeup be at the _end_ of the pipe +write, not at the first write chunk. That is actually much saner +semantics (as much as you can call any of the legacy edge-triggered +expectations for EPOLLET "sane") since it means that you know the wakeup +will happen once the write is done, rather than possibly in the middle +of one. + +[ For stable people: I'm putting a "Fixes" tag on this, but I leave it + up to you to decide whether you actually want to backport it or not. + It likely has no impact outside of synthetic benchmarks - Linus ] + +Link: https://lore.kernel.org/lkml/20210802024945.GA8372@xsang-OptiPlex-9020/ +Fixes: 3a34b13a88ca ("pipe: make pipe writes always wake up readers") +Reported-by: kernel test robot +Tested-by: Sandeep Patil +Tested-by: Mel Gorman +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/pipe.c | 15 +++++++++------ + include/linux/pipe_fs_i.h | 2 ++ + 2 files changed, 11 insertions(+), 6 deletions(-) + +diff --git a/fs/pipe.c b/fs/pipe.c +index 8e6ef62aeb1c..678dee2a8228 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -444,9 +444,6 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from) + #endif + + /* +- * Epoll nonsensically wants a wakeup whether the pipe +- * was already empty or not. +- * + * If it wasn't empty we try to merge new data into + * the last buffer. + * +@@ -455,9 +452,9 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from) + * spanning multiple pages. + */ + head = pipe->head; +- was_empty = true; ++ was_empty = pipe_empty(head, pipe->tail); + chars = total_len & (PAGE_SIZE-1); +- if (chars && !pipe_empty(head, pipe->tail)) { ++ if (chars && !was_empty) { + unsigned int mask = pipe->ring_size - 1; + struct pipe_buffer *buf = &pipe->bufs[(head - 1) & mask]; + int offset = buf->offset + buf->len; +@@ -590,8 +587,11 @@ out: + * This is particularly important for small writes, because of + * how (for example) the GNU make jobserver uses small writes to + * wake up pending jobs ++ * ++ * Epoll nonsensically wants a wakeup whether the pipe ++ * was already empty or not. + */ +- if (was_empty) { ++ if (was_empty || pipe->poll_usage) { + wake_up_interruptible_sync_poll(&pipe->rd_wait, EPOLLIN | EPOLLRDNORM); + kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN); + } +@@ -654,6 +654,9 @@ pipe_poll(struct file *filp, poll_table *wait) + struct pipe_inode_info *pipe = filp->private_data; + unsigned int head, tail; + ++ /* Epoll has some historical nasty semantics, this enables them */ ++ pipe->poll_usage = 1; ++ + /* + * Reading pipe state only -- no need for acquiring the semaphore. + * +diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h +index 5d2705f1d01c..fc5642431b92 100644 +--- a/include/linux/pipe_fs_i.h ++++ b/include/linux/pipe_fs_i.h +@@ -48,6 +48,7 @@ struct pipe_buffer { + * @files: number of struct file referring this pipe (protected by ->i_lock) + * @r_counter: reader counter + * @w_counter: writer counter ++ * @poll_usage: is this pipe used for epoll, which has crazy wakeups? + * @fasync_readers: reader side fasync + * @fasync_writers: writer side fasync + * @bufs: the circular array of pipe buffers +@@ -70,6 +71,7 @@ struct pipe_inode_info { + unsigned int files; + unsigned int r_counter; + unsigned int w_counter; ++ unsigned int poll_usage; + struct page *tmp_page; + struct fasync_struct *fasync_readers; + struct fasync_struct *fasync_writers; +-- +2.30.2 + diff --git a/queue-5.13/ptp_pch-restore-dependency-on-pci.patch b/queue-5.13/ptp_pch-restore-dependency-on-pci.patch new file mode 100644 index 00000000000..8e925ed54f4 --- /dev/null +++ b/queue-5.13/ptp_pch-restore-dependency-on-pci.patch @@ -0,0 +1,38 @@ +From b35045213c53f49b4be7b5d27894c38bec22367e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 20:33:27 +0300 +Subject: ptp_pch: Restore dependency on PCI + +From: Andy Shevchenko + +[ Upstream commit 55c8fca1dae1fb0d11deaa21b65a647dedb1bc50 ] + +During the swap dependency on PCH_GBE to selection PTP_1588_CLOCK_PCH +incidentally dropped the implicit dependency on the PCI. Restore it. + +Fixes: 18d359ceb044 ("pch_gbe, ptp_pch: Fix the dependency direction between these drivers") +Reported-by: kernel test robot +Signed-off-by: Andy Shevchenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/ptp/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig +index 8c20e524e9ad..e085c255da0c 100644 +--- a/drivers/ptp/Kconfig ++++ b/drivers/ptp/Kconfig +@@ -90,7 +90,8 @@ config PTP_1588_CLOCK_INES + config PTP_1588_CLOCK_PCH + tristate "Intel PCH EG20T as PTP clock" + depends on X86_32 || COMPILE_TEST +- depends on HAS_IOMEM && NET ++ depends on HAS_IOMEM && PCI ++ depends on NET + imply PTP_1588_CLOCK + help + This driver adds support for using the PCH EG20T as a PTP +-- +2.30.2 + diff --git a/queue-5.13/r8152-fix-the-maximum-number-of-pla-bp-for-rtl8153c.patch b/queue-5.13/r8152-fix-the-maximum-number-of-pla-bp-for-rtl8153c.patch new file mode 100644 index 00000000000..35f71453fd1 --- /dev/null +++ b/queue-5.13/r8152-fix-the-maximum-number-of-pla-bp-for-rtl8153c.patch @@ -0,0 +1,75 @@ +From dc59f1cf674d85003daa3fe4c483c75d18888dd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 11:05:37 +0800 +Subject: r8152: fix the maximum number of PLA bp for RTL8153C + +From: Hayes Wang + +[ Upstream commit 6633fb83f1faddbfcac09e35edcae96bd0468335 ] + +The maximum PLA bp number of RTL8153C is 16, not 8. That is, the +bp 0 ~ 15 are at 0xfc28 ~ 0xfc46, and the bp_en is at 0xfc48. + +Fixes: 195aae321c82 ("r8152: support new chips") +Signed-off-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 21 +++++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index b2b77edf72b8..a044f37e87ae 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3953,13 +3953,24 @@ static void rtl_clear_bp(struct r8152 *tp, u16 type) + case RTL_VER_06: + ocp_write_byte(tp, type, PLA_BP_EN, 0); + break; ++ case RTL_VER_14: ++ ocp_write_word(tp, type, USB_BP2_EN, 0); ++ ++ ocp_write_word(tp, type, USB_BP_8, 0); ++ ocp_write_word(tp, type, USB_BP_9, 0); ++ ocp_write_word(tp, type, USB_BP_10, 0); ++ ocp_write_word(tp, type, USB_BP_11, 0); ++ ocp_write_word(tp, type, USB_BP_12, 0); ++ ocp_write_word(tp, type, USB_BP_13, 0); ++ ocp_write_word(tp, type, USB_BP_14, 0); ++ ocp_write_word(tp, type, USB_BP_15, 0); ++ break; + case RTL_VER_08: + case RTL_VER_09: + case RTL_VER_10: + case RTL_VER_11: + case RTL_VER_12: + case RTL_VER_13: +- case RTL_VER_14: + case RTL_VER_15: + default: + if (type == MCU_TYPE_USB) { +@@ -4329,7 +4340,6 @@ static bool rtl8152_is_fw_mac_ok(struct r8152 *tp, struct fw_mac *mac) + case RTL_VER_11: + case RTL_VER_12: + case RTL_VER_13: +- case RTL_VER_14: + case RTL_VER_15: + fw_reg = 0xf800; + bp_ba_addr = PLA_BP_BA; +@@ -4337,6 +4347,13 @@ static bool rtl8152_is_fw_mac_ok(struct r8152 *tp, struct fw_mac *mac) + bp_start = PLA_BP_0; + max_bp = 8; + break; ++ case RTL_VER_14: ++ fw_reg = 0xf800; ++ bp_ba_addr = PLA_BP_BA; ++ bp_en_addr = USB_BP2_EN; ++ bp_start = PLA_BP_0; ++ max_bp = 16; ++ break; + default: + goto out; + } +-- +2.30.2 + diff --git a/queue-5.13/r8152-fix-writing-usb_bp2_en.patch b/queue-5.13/r8152-fix-writing-usb_bp2_en.patch new file mode 100644 index 00000000000..96b002c06c6 --- /dev/null +++ b/queue-5.13/r8152-fix-writing-usb_bp2_en.patch @@ -0,0 +1,36 @@ +From 6ff23c8938a8c7786bbe744272b6d86a00d038e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 11:05:36 +0800 +Subject: r8152: fix writing USB_BP2_EN + +From: Hayes Wang + +[ Upstream commit a876a33d2a1102f99fc782fefb784f4dd4841d8c ] + +The register of USB_BP2_EN is 16 bits, so we should use +ocp_write_word(), not ocp_write_byte(). + +Fixes: 9370f2d05a2a ("support request_firmware for RTL8153") +Signed-off-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 2cf763b4ea84..b2b77edf72b8 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3963,7 +3963,7 @@ static void rtl_clear_bp(struct r8152 *tp, u16 type) + case RTL_VER_15: + default: + if (type == MCU_TYPE_USB) { +- ocp_write_byte(tp, MCU_TYPE_USB, USB_BP2_EN, 0); ++ ocp_write_word(tp, MCU_TYPE_USB, USB_BP2_EN, 0); + + ocp_write_word(tp, MCU_TYPE_USB, USB_BP_8, 0); + ocp_write_word(tp, MCU_TYPE_USB, USB_BP_9, 0); +-- +2.30.2 + diff --git a/queue-5.13/revert-flow_offload-action-should-not-be-null-when-i.patch b/queue-5.13/revert-flow_offload-action-should-not-be-null-when-i.patch new file mode 100644 index 00000000000..cddf45a4fa6 --- /dev/null +++ b/queue-5.13/revert-flow_offload-action-should-not-be-null-when-i.patch @@ -0,0 +1,62 @@ +From 1d7fb122f951eb5122368c6c3aec337c3213ecdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 13:58:42 +0300 +Subject: Revert "flow_offload: action should not be NULL when it is + referenced" + +From: Ido Schimmel + +[ Upstream commit fa05bdb89b01b098aad19ec0ebc4d1cc7b11177e ] + +This reverts commit 9ea3e52c5bc8bb4a084938dc1e3160643438927a. + +Cited commit added a check to make sure 'action' is not NULL, but +'action' is already dereferenced before the check, when calling +flow_offload_has_one_action(). + +Therefore, the check does not make any sense and results in a smatch +warning: + +include/net/flow_offload.h:322 flow_action_mixed_hw_stats_check() warn: +variable dereferenced before check 'action' (see line 319) + +Fix by reverting this commit. + +Cc: gushengxian +Fixes: 9ea3e52c5bc8 ("flow_offload: action should not be NULL when it is referenced") +Signed-off-by: Ido Schimmel +Acked-by: Jamal Hadi Salim +Link: https://lore.kernel.org/r/20210819105842.1315705-1-idosch@idosch.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/flow_offload.h | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/include/net/flow_offload.h b/include/net/flow_offload.h +index 69c9eabf8325..dc5c1e69cd9f 100644 +--- a/include/net/flow_offload.h ++++ b/include/net/flow_offload.h +@@ -319,14 +319,12 @@ flow_action_mixed_hw_stats_check(const struct flow_action *action, + if (flow_offload_has_one_action(action)) + return true; + +- if (action) { +- flow_action_for_each(i, action_entry, action) { +- if (i && action_entry->hw_stats != last_hw_stats) { +- NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported"); +- return false; +- } +- last_hw_stats = action_entry->hw_stats; ++ flow_action_for_each(i, action_entry, action) { ++ if (i && action_entry->hw_stats != last_hw_stats) { ++ NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported"); ++ return false; + } ++ last_hw_stats = action_entry->hw_stats; + } + return true; + } +-- +2.30.2 + diff --git a/queue-5.13/sch_cake-fix-srchost-dsthost-hashing-mode.patch b/queue-5.13/sch_cake-fix-srchost-dsthost-hashing-mode.patch new file mode 100644 index 00000000000..fbfdbabb3ff --- /dev/null +++ b/queue-5.13/sch_cake-fix-srchost-dsthost-hashing-mode.patch @@ -0,0 +1,45 @@ +From ba8932d9ff32980577edf79e64e4acc0bcba4dce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 13:59:17 +0200 +Subject: sch_cake: fix srchost/dsthost hashing mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 86b9bbd332d0510679c7fedcee3e3bd278be5756 ] + +When adding support for using the skb->hash value as the flow hash in CAKE, +I accidentally introduced a logic error that broke the host-only isolation +modes of CAKE (srchost and dsthost keywords). Specifically, the flow_hash +variable should stay initialised to 0 in cake_hash() in pure host-based +hashing mode. Add a check for this before using the skb->hash value as +flow_hash. + +Fixes: b0c19ed6088a ("sch_cake: Take advantage of skb->hash where appropriate") +Reported-by: Pete Heist +Tested-by: Pete Heist +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_cake.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c +index 951542843cab..28af8b1e1bb1 100644 +--- a/net/sched/sch_cake.c ++++ b/net/sched/sch_cake.c +@@ -720,7 +720,7 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, + skip_hash: + if (flow_override) + flow_hash = flow_override - 1; +- else if (use_skbhash) ++ else if (use_skbhash && (flow_mode & CAKE_FLOW_FLOWS)) + flow_hash = skb->hash; + if (host_override) { + dsthost_hash = host_override - 1; +-- +2.30.2 + diff --git a/queue-5.13/series b/queue-5.13/series index 44e3c1ac381..52dc865c1d5 100644 --- a/queue-5.13/series +++ b/queue-5.13/series @@ -23,3 +23,62 @@ spi-cadence-quadspi-fix-check-condition-for-dtr-ops.patch drm-amd-display-fix-dynamic-bpp-issue-with-8k30-with.patch drm-amd-display-workaround-for-hard-hang-on-hpd-on-n.patch kyber-make-trace_block_rq-call-consistent-with-docum.patch +mtd-rawnand-add-a-check-in-of_get_nand_secure_region.patch +arm64-dts-qcom-c630-fix-correct-powerdown-pin-for-ws.patch +arm64-dts-qcom-msm8992-bullhead-remove-psci.patch +arm64-dts-qcom-msm8992-bullhead-fix-cont_splash_mem-.patch +iommu-check-if-group-is-null-before-remove-device.patch +cpufreq-arm_scmi-fix-error-path-when-allocation-fail.patch +arm64-dts-qcom-msm8994-angler-disable-cont_splash_me.patch +arm64-dts-qcom-sdm845-oneplus-fix-reserved-mem.patch +mt76-fix-enum-type-mismatch.patch +mtd-rawnand-fix-probe-failure-due-to-of_get_nand_sec.patch +soc-fsl-qe-convert-qe-interrupt-controller-to-platfo.patch +cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch +dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch +virtio-protect-vqs-list-access.patch +vhost-vdpa-fix-integer-overflow-in-vhost_vdpa_proces.patch +bus-ti-sysc-fix-error-handling-for-sysc_check_active.patch +vhost-fix-the-calculation-in-vhost_overflow.patch +vdpa_sim-fix-return-value-check-for-vdpa_alloc_devic.patch +vp_vdpa-fix-return-value-check-for-vdpa_alloc_device.patch +vdpa-ifcvf-fix-return-value-check-for-vdpa_alloc_dev.patch +vdpa-mlx5-avoid-destroying-mr-on-empty-iotlb.patch +vdpa-mlx5-fix-queue-type-selection-logic.patch +drm-mediatek-add-aal-output-size-configuration.patch +drm-mediatek-add-component_del-in-ovl-and-color-remo.patch +bpf-clear-zext_dst-of-dead-insns.patch +bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch +bnxt-disable-napi-before-canceling-dim.patch +bnxt-make-sure-xmit_more-errors-does-not-miss-doorbe.patch +bnxt-count-tx-drops.patch +soc-fsl-qe-fix-static-checker-warning.patch +net-6pack-fix-slab-out-of-bounds-in-decode_data.patch +ptp_pch-restore-dependency-on-pci.patch +bnxt_en-disable-arfs-if-running-on-212-firmware.patch +bnxt_en-add-missing-dma-memory-barriers.patch +vrf-reset-skb-conntrack-connection-on-vrf-rcv.patch +virtio-net-use-netif_f_gro_hw-instead-of-netif_f_lro.patch +mac80211-fix-locking-in-ieee80211_restart_work.patch +net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch +ixgbe-xsk-clean-up-the-resources-in-ixgbe_xsk_pool_e.patch +sch_cake-fix-srchost-dsthost-hashing-mode.patch +net-mdio-mux-don-t-ignore-memory-allocation-errors.patch +net-mdio-mux-handle-eprobe_defer-correctly.patch +ovs-clear-skb-tstamp-in-forwarding-path.patch +net-usb-asix-refactor-asix_read_phy_addr-and-handle-.patch +iommu-vt-d-fix-incomplete-cache-flush-in-intel_pasid.patch +drm-i915-skip-display-interruption-setup-when-displa.patch +drm-i915-tweaked-wa_14010685332-for-all-pchs.patch +pipe-avoid-unnecessary-epollet-wakeups-under-normal-.patch +drm-amd-display-use-dcn30-watermark-calc-for-dcn301.patch +net-mscc-ocelot-allow-forwarding-from-bridge-ports-t.patch +mptcp-fix-memory-leak-on-address-flush.patch +mptcp-full-fully-established-support-after-add_addr.patch +r8152-fix-writing-usb_bp2_en.patch +r8152-fix-the-maximum-number-of-pla-bp-for-rtl8153c.patch +pci-sysfs-use-correct-variable-for-the-legacy_mem-sy.patch +i40e-fix-atr-queue-selection.patch +iavf-fix-ping-is-lost-after-untrusted-vf-had-tried-t.patch +revert-flow_offload-action-should-not-be-null-when-i.patch +net-dpaa2-switch-disable-the-control-interface-on-er.patch diff --git a/queue-5.13/soc-fsl-qe-convert-qe-interrupt-controller-to-platfo.patch b/queue-5.13/soc-fsl-qe-convert-qe-interrupt-controller-to-platfo.patch new file mode 100644 index 00000000000..4f37bc901ba --- /dev/null +++ b/queue-5.13/soc-fsl-qe-convert-qe-interrupt-controller-to-platfo.patch @@ -0,0 +1,166 @@ +From 1131b9b5fa9a0fd47e7fad7e54e9fa085123511d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 14:35:38 +0300 +Subject: soc: fsl: qe: convert QE interrupt controller to platform_device + +From: Maxim Kochetkov + +[ Upstream commit be7ecbd240b2f9ec544d3ce6fccf4cec3cd15dca ] + +Since 5.13 QE's ucc nodes can't get interrupts from devicetree: + + ucc@2000 { + cell-index = <1>; + reg = <0x2000 0x200>; + interrupts = <32>; + interrupt-parent = <&qeic>; + }; + +Now fw_devlink expects driver to create and probe a struct device +for interrupt controller. + +So lets convert this driver to simple platform_device with probe(). +Also use platform_get_ and devm_ family function to get/allocate +resources and drop unused .compatible = "qeic". + +[1] - https://lore.kernel.org/lkml/CAGETcx9PiX==mLxB9PO8Myyk6u2vhPVwTMsA5NkD-ywH5xhusw@mail.gmail.com +Fixes: e590474768f1 ("driver core: Set fw_devlink=on by default") +Fixes: ea718c699055 ("Revert "Revert "driver core: Set fw_devlink=on by default""") +Signed-off-by: Maxim Kochetkov +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Acked-by: Saravana Kannan +Signed-off-by: Li Yang +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qe/qe_ic.c | 75 ++++++++++++++++++++++---------------- + 1 file changed, 44 insertions(+), 31 deletions(-) + +diff --git a/drivers/soc/fsl/qe/qe_ic.c b/drivers/soc/fsl/qe/qe_ic.c +index 3f711c1a0996..e710d554425d 100644 +--- a/drivers/soc/fsl/qe/qe_ic.c ++++ b/drivers/soc/fsl/qe/qe_ic.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -404,41 +405,40 @@ static void qe_ic_cascade_muxed_mpic(struct irq_desc *desc) + chip->irq_eoi(&desc->irq_data); + } + +-static void __init qe_ic_init(struct device_node *node) ++static int qe_ic_init(struct platform_device *pdev) + { ++ struct device *dev = &pdev->dev; + void (*low_handler)(struct irq_desc *desc); + void (*high_handler)(struct irq_desc *desc); + struct qe_ic *qe_ic; +- struct resource res; +- u32 ret; ++ struct resource *res; ++ struct device_node *node = pdev->dev.of_node; + +- ret = of_address_to_resource(node, 0, &res); +- if (ret) +- return; ++ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (res == NULL) { ++ dev_err(dev, "no memory resource defined\n"); ++ return -ENODEV; ++ } + +- qe_ic = kzalloc(sizeof(*qe_ic), GFP_KERNEL); ++ qe_ic = devm_kzalloc(dev, sizeof(*qe_ic), GFP_KERNEL); + if (qe_ic == NULL) +- return; ++ return -ENOMEM; + +- qe_ic->irqhost = irq_domain_add_linear(node, NR_QE_IC_INTS, +- &qe_ic_host_ops, qe_ic); +- if (qe_ic->irqhost == NULL) { +- kfree(qe_ic); +- return; ++ qe_ic->regs = devm_ioremap(dev, res->start, resource_size(res)); ++ if (qe_ic->regs == NULL) { ++ dev_err(dev, "failed to ioremap() registers\n"); ++ return -ENODEV; + } + +- qe_ic->regs = ioremap(res.start, resource_size(&res)); +- + qe_ic->hc_irq = qe_ic_irq_chip; + +- qe_ic->virq_high = irq_of_parse_and_map(node, 0); +- qe_ic->virq_low = irq_of_parse_and_map(node, 1); ++ qe_ic->virq_high = platform_get_irq(pdev, 0); ++ qe_ic->virq_low = platform_get_irq(pdev, 1); + +- if (!qe_ic->virq_low) { +- printk(KERN_ERR "Failed to map QE_IC low IRQ\n"); +- kfree(qe_ic); +- return; ++ if (qe_ic->virq_low < 0) { ++ return -ENODEV; + } ++ + if (qe_ic->virq_high != qe_ic->virq_low) { + low_handler = qe_ic_cascade_low; + high_handler = qe_ic_cascade_high; +@@ -447,6 +447,13 @@ static void __init qe_ic_init(struct device_node *node) + high_handler = NULL; + } + ++ qe_ic->irqhost = irq_domain_add_linear(node, NR_QE_IC_INTS, ++ &qe_ic_host_ops, qe_ic); ++ if (qe_ic->irqhost == NULL) { ++ dev_err(dev, "failed to add irq domain\n"); ++ return -ENODEV; ++ } ++ + qe_ic_write(qe_ic->regs, QEIC_CICR, 0); + + irq_set_handler_data(qe_ic->virq_low, qe_ic); +@@ -456,20 +463,26 @@ static void __init qe_ic_init(struct device_node *node) + irq_set_handler_data(qe_ic->virq_high, qe_ic); + irq_set_chained_handler(qe_ic->virq_high, high_handler); + } ++ return 0; + } ++static const struct of_device_id qe_ic_ids[] = { ++ { .compatible = "fsl,qe-ic"}, ++ { .type = "qeic"}, ++ {}, ++}; + +-static int __init qe_ic_of_init(void) ++static struct platform_driver qe_ic_driver = + { +- struct device_node *np; ++ .driver = { ++ .name = "qe-ic", ++ .of_match_table = qe_ic_ids, ++ }, ++ .probe = qe_ic_init, ++}; + +- np = of_find_compatible_node(NULL, NULL, "fsl,qe-ic"); +- if (!np) { +- np = of_find_node_by_type(NULL, "qeic"); +- if (!np) +- return -ENODEV; +- } +- qe_ic_init(np); +- of_node_put(np); ++static int __init qe_ic_of_init(void) ++{ ++ platform_driver_register(&qe_ic_driver); + return 0; + } + subsys_initcall(qe_ic_of_init); +-- +2.30.2 + diff --git a/queue-5.13/soc-fsl-qe-fix-static-checker-warning.patch b/queue-5.13/soc-fsl-qe-fix-static-checker-warning.patch new file mode 100644 index 00000000000..386107155aa --- /dev/null +++ b/queue-5.13/soc-fsl-qe-fix-static-checker-warning.patch @@ -0,0 +1,74 @@ +From 3f65ea470fc0fb58e68ae228bc0c4e11a09a2e66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 10:10:36 +0300 +Subject: soc: fsl: qe: fix static checker warning + +From: Maxim Kochetkov + +[ Upstream commit c1e64c0aec8cb0499e61af7ea086b59abba97945 ] + +The patch be7ecbd240b2: "soc: fsl: qe: convert QE interrupt +controller to platform_device" from Aug 3, 2021, leads to the +following static checker warning: + + drivers/soc/fsl/qe/qe_ic.c:438 qe_ic_init() + warn: unsigned 'qe_ic->virq_low' is never less than zero. + +In old variant irq_of_parse_and_map() returns zero if failed so +unsigned int for virq_high/virq_low was ok. +In new variant platform_get_irq() returns negative error codes +if failed so we need to use int for virq_high/virq_low. + +Also simplify high_handler checking and remove the curly braces +to make checkpatch happy. + +Fixes: be7ecbd240b2 ("soc: fsl: qe: convert QE interrupt controller to platform_device") +Signed-off-by: Maxim Kochetkov +Reported-by: Dan Carpenter +Signed-off-by: Li Yang +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qe/qe_ic.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/soc/fsl/qe/qe_ic.c b/drivers/soc/fsl/qe/qe_ic.c +index e710d554425d..bbae3d39c7be 100644 +--- a/drivers/soc/fsl/qe/qe_ic.c ++++ b/drivers/soc/fsl/qe/qe_ic.c +@@ -54,8 +54,8 @@ struct qe_ic { + struct irq_chip hc_irq; + + /* VIRQ numbers of QE high/low irqs */ +- unsigned int virq_high; +- unsigned int virq_low; ++ int virq_high; ++ int virq_low; + }; + + /* +@@ -435,11 +435,10 @@ static int qe_ic_init(struct platform_device *pdev) + qe_ic->virq_high = platform_get_irq(pdev, 0); + qe_ic->virq_low = platform_get_irq(pdev, 1); + +- if (qe_ic->virq_low < 0) { ++ if (qe_ic->virq_low <= 0) + return -ENODEV; +- } + +- if (qe_ic->virq_high != qe_ic->virq_low) { ++ if (qe_ic->virq_high > 0 && qe_ic->virq_high != qe_ic->virq_low) { + low_handler = qe_ic_cascade_low; + high_handler = qe_ic_cascade_high; + } else { +@@ -459,7 +458,7 @@ static int qe_ic_init(struct platform_device *pdev) + irq_set_handler_data(qe_ic->virq_low, qe_ic); + irq_set_chained_handler(qe_ic->virq_low, low_handler); + +- if (qe_ic->virq_high && qe_ic->virq_high != qe_ic->virq_low) { ++ if (high_handler) { + irq_set_handler_data(qe_ic->virq_high, qe_ic); + irq_set_chained_handler(qe_ic->virq_high, high_handler); + } +-- +2.30.2 + diff --git a/queue-5.13/vdpa-ifcvf-fix-return-value-check-for-vdpa_alloc_dev.patch b/queue-5.13/vdpa-ifcvf-fix-return-value-check-for-vdpa_alloc_dev.patch new file mode 100644 index 00000000000..2bd888eeea6 --- /dev/null +++ b/queue-5.13/vdpa-ifcvf-fix-return-value-check-for-vdpa_alloc_dev.patch @@ -0,0 +1,45 @@ +From 862b3800ff7c2521c2dcc1ea0b550c6a514432ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 16:00:25 +0800 +Subject: vDPA/ifcvf: Fix return value check for vdpa_alloc_device() + +From: Xie Yongji + +[ Upstream commit 1057afa0121db8bd3ca4718c8e0ca12388ab7759 ] + +The vdpa_alloc_device() returns an error pointer upon +failure, not NULL. To handle the failure correctly, this +replaces NULL check with IS_ERR() check and propagate the +error upwards. + +Fixes: 5a2414bc454e ("virtio: Intel IFC VF driver for VDPA") +Reported-by: Dan Carpenter +Signed-off-by: Xie Yongji +Link: https://lore.kernel.org/r/20210715080026.242-3-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Reviewed-by: Stefano Garzarella +Signed-off-by: Sasha Levin +--- + drivers/vdpa/ifcvf/ifcvf_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/vdpa/ifcvf/ifcvf_main.c b/drivers/vdpa/ifcvf/ifcvf_main.c +index ab0ab5cf0f6e..1c6cd5276a50 100644 +--- a/drivers/vdpa/ifcvf/ifcvf_main.c ++++ b/drivers/vdpa/ifcvf/ifcvf_main.c +@@ -477,9 +477,9 @@ static int ifcvf_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + adapter = vdpa_alloc_device(struct ifcvf_adapter, vdpa, + dev, &ifc_vdpa_ops, NULL); +- if (adapter == NULL) { ++ if (IS_ERR(adapter)) { + IFCVF_ERR(pdev, "Failed to allocate vDPA structure"); +- return -ENOMEM; ++ return PTR_ERR(adapter); + } + + pci_set_master(pdev); +-- +2.30.2 + diff --git a/queue-5.13/vdpa-mlx5-avoid-destroying-mr-on-empty-iotlb.patch b/queue-5.13/vdpa-mlx5-avoid-destroying-mr-on-empty-iotlb.patch new file mode 100644 index 00000000000..96f075d18e9 --- /dev/null +++ b/queue-5.13/vdpa-mlx5-avoid-destroying-mr-on-empty-iotlb.patch @@ -0,0 +1,62 @@ +From fb3c774132b1edc6a6ecdf53c3f6b8dc7f00fdca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 08:37:13 +0300 +Subject: vdpa/mlx5: Avoid destroying MR on empty iotlb + +From: Eli Cohen + +[ Upstream commit 08dbd5660232bede7916d8568003012c1182cc9a ] + +The current code treats an empty iotlb provdied in set_map() as a +special case and destroy the memory region object. This must not be done +since the virtqueue objects reference this MR. Doing so will cause the +driver unload to emit errors and log timeouts caused by the firmware +complaining on busy resources. + +This patch treats an empty iotlb as any other change of mapping. In this +case, mlx5_vdpa_create_mr() will fail and the entire set_map() call to +fail. + +This issue has not been encountered before but was seen to occur in a +non-official version of qemu. Since qemu is a userspace program, the +driver must protect against such case. + +Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code") +Signed-off-by: Eli Cohen +Link: https://lore.kernel.org/r/20210811053713.66658-1-elic@nvidia.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/core/mr.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c +index cfa56a58b271..0ca39ef20c6d 100644 +--- a/drivers/vdpa/mlx5/core/mr.c ++++ b/drivers/vdpa/mlx5/core/mr.c +@@ -454,11 +454,6 @@ out: + mutex_unlock(&mr->mkey_mtx); + } + +-static bool map_empty(struct vhost_iotlb *iotlb) +-{ +- return !vhost_iotlb_itree_first(iotlb, 0, U64_MAX); +-} +- + int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb, + bool *change_map) + { +@@ -466,10 +461,6 @@ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *io + int err = 0; + + *change_map = false; +- if (map_empty(iotlb)) { +- mlx5_vdpa_destroy_mr(mvdev); +- return 0; +- } + mutex_lock(&mr->mkey_mtx); + if (mr->initialized) { + mlx5_vdpa_info(mvdev, "memory map update\n"); +-- +2.30.2 + diff --git a/queue-5.13/vdpa-mlx5-fix-queue-type-selection-logic.patch b/queue-5.13/vdpa-mlx5-fix-queue-type-selection-logic.patch new file mode 100644 index 00000000000..b07c18ab78b --- /dev/null +++ b/queue-5.13/vdpa-mlx5-fix-queue-type-selection-logic.patch @@ -0,0 +1,88 @@ +From 843fb63200957788026aa40062ba0ddb5540a922 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 08:37:59 +0300 +Subject: vdpa/mlx5: Fix queue type selection logic + +From: Eli Cohen + +[ Upstream commit 879753c816dbbdb2a9a395aa4448d29feee92d1a ] + +get_queue_type() comments that splict virtqueue is preferred, however, +the actual logic preferred packed virtqueues. Since firmware has not +supported packed virtqueues we ended up using split virtqueues as was +desired. + +Since we do not advertise support for packed virtqueues, we add a check +to verify split virtqueues are indeed supported. + +Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices") +Signed-off-by: Eli Cohen +Link: https://lore.kernel.org/r/20210811053759.66752-1-elic@nvidia.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 14 ++++++++++---- + include/linux/mlx5/mlx5_ifc_vdpa.h | 10 ++++++---- + 2 files changed, 16 insertions(+), 8 deletions(-) + +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index f3495386698a..103d8f70df8e 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -752,12 +752,12 @@ static int get_queue_type(struct mlx5_vdpa_net *ndev) + type_mask = MLX5_CAP_DEV_VDPA_EMULATION(ndev->mvdev.mdev, virtio_queue_type); + + /* prefer split queue */ +- if (type_mask & MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_PACKED) +- return MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_PACKED; ++ if (type_mask & MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_SPLIT) ++ return MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_SPLIT; + +- WARN_ON(!(type_mask & MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_SPLIT)); ++ WARN_ON(!(type_mask & MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_PACKED)); + +- return MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_SPLIT; ++ return MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_PACKED; + } + + static bool vq_is_tx(u16 idx) +@@ -2010,6 +2010,12 @@ static int mlx5_vdpa_dev_add(struct vdpa_mgmt_dev *v_mdev, const char *name) + return -ENOSPC; + + mdev = mgtdev->madev->mdev; ++ if (!(MLX5_CAP_DEV_VDPA_EMULATION(mdev, virtio_queue_type) & ++ MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_SPLIT)) { ++ dev_warn(mdev->device, "missing support for split virtqueues\n"); ++ return -EOPNOTSUPP; ++ } ++ + /* we save one virtqueue for control virtqueue should we require it */ + max_vqs = MLX5_CAP_DEV_VDPA_EMULATION(mdev, max_num_virtio_queues); + max_vqs = min_t(u32, max_vqs, MLX5_MAX_SUPPORTED_VQS); +diff --git a/include/linux/mlx5/mlx5_ifc_vdpa.h b/include/linux/mlx5/mlx5_ifc_vdpa.h +index 98b56b75c625..1a9c9d94cb59 100644 +--- a/include/linux/mlx5/mlx5_ifc_vdpa.h ++++ b/include/linux/mlx5/mlx5_ifc_vdpa.h +@@ -11,13 +11,15 @@ enum { + }; + + enum { +- MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_SPLIT = 0x1, // do I check this caps? +- MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_PACKED = 0x2, ++ MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_SPLIT = 0, ++ MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_PACKED = 1, + }; + + enum { +- MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_SPLIT = 0, +- MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_PACKED = 1, ++ MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_SPLIT = ++ BIT(MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_SPLIT), ++ MLX5_VIRTIO_EMULATION_CAP_VIRTIO_QUEUE_TYPE_PACKED = ++ BIT(MLX5_VIRTIO_EMULATION_VIRTIO_QUEUE_TYPE_PACKED), + }; + + struct mlx5_ifc_virtio_q_bits { +-- +2.30.2 + diff --git a/queue-5.13/vdpa_sim-fix-return-value-check-for-vdpa_alloc_devic.patch b/queue-5.13/vdpa_sim-fix-return-value-check-for-vdpa_alloc_devic.patch new file mode 100644 index 00000000000..2e6484a3e48 --- /dev/null +++ b/queue-5.13/vdpa_sim-fix-return-value-check-for-vdpa_alloc_devic.patch @@ -0,0 +1,44 @@ +From d1f880a21b0c5f56d5382efb872b258510cff1bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 16:00:23 +0800 +Subject: vdpa_sim: Fix return value check for vdpa_alloc_device() + +From: Xie Yongji + +[ Upstream commit 2b847f21145d84e2e1dde99d3e2c00a5468f02e4 ] + +The vdpa_alloc_device() returns an error pointer upon +failure, not NULL. To handle the failure correctly, this +replaces NULL check with IS_ERR() check and propagate the +error upwards. + +Fixes: 2c53d0f64c06 ("vdpasim: vDPA device simulator") +Reported-by: Dan Carpenter +Signed-off-by: Xie Yongji +Link: https://lore.kernel.org/r/20210715080026.242-1-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Reviewed-by: Stefano Garzarella +Signed-off-by: Sasha Levin +--- + drivers/vdpa/vdpa_sim/vdpa_sim.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/vdpa/vdpa_sim/vdpa_sim.c b/drivers/vdpa/vdpa_sim/vdpa_sim.c +index 98f793bc9376..26337ba42445 100644 +--- a/drivers/vdpa/vdpa_sim/vdpa_sim.c ++++ b/drivers/vdpa/vdpa_sim/vdpa_sim.c +@@ -251,8 +251,10 @@ struct vdpasim *vdpasim_create(struct vdpasim_dev_attr *dev_attr) + + vdpasim = vdpa_alloc_device(struct vdpasim, vdpa, NULL, ops, + dev_attr->name); +- if (!vdpasim) ++ if (IS_ERR(vdpasim)) { ++ ret = PTR_ERR(vdpasim); + goto err_alloc; ++ } + + vdpasim->dev_attr = *dev_attr; + INIT_WORK(&vdpasim->work, dev_attr->work_fn); +-- +2.30.2 + diff --git a/queue-5.13/vhost-fix-the-calculation-in-vhost_overflow.patch b/queue-5.13/vhost-fix-the-calculation-in-vhost_overflow.patch new file mode 100644 index 00000000000..0dc16d0993b --- /dev/null +++ b/queue-5.13/vhost-fix-the-calculation-in-vhost_overflow.patch @@ -0,0 +1,49 @@ +From 7bae92a95ccc44bc165ffb07e6292938dfe05cc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 21:07:56 +0800 +Subject: vhost: Fix the calculation in vhost_overflow() + +From: Xie Yongji + +[ Upstream commit f7ad318ea0ad58ebe0e595e59aed270bb643b29b ] + +This fixes the incorrect calculation for integer overflow +when the last address of iova range is 0xffffffff. + +Fixes: ec33d031a14b ("vhost: detect 32 bit integer wrap around") +Reported-by: Jason Wang +Signed-off-by: Xie Yongji +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/20210728130756.97-2-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vhost.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 5ccb0705beae..f41463ab4031 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -735,10 +735,16 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz) + (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); + } + ++/* Make sure 64 bit math will not overflow. */ + static bool vhost_overflow(u64 uaddr, u64 size) + { +- /* Make sure 64 bit math will not overflow. */ +- return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size; ++ if (uaddr > ULONG_MAX || size > ULONG_MAX) ++ return true; ++ ++ if (!size) ++ return false; ++ ++ return uaddr > ULONG_MAX - size + 1; + } + + /* Caller should have vq mutex and device mutex. */ +-- +2.30.2 + diff --git a/queue-5.13/vhost-vdpa-fix-integer-overflow-in-vhost_vdpa_proces.patch b/queue-5.13/vhost-vdpa-fix-integer-overflow-in-vhost_vdpa_proces.patch new file mode 100644 index 00000000000..7a25be9021a --- /dev/null +++ b/queue-5.13/vhost-vdpa-fix-integer-overflow-in-vhost_vdpa_proces.patch @@ -0,0 +1,41 @@ +From 16b3e848bebd3560a27fb1a9b857d4e9b0c975cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 21:07:55 +0800 +Subject: vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update() + +From: Xie Yongji + +[ Upstream commit 0e398290cff997610b66e73573faaee70c9a700e ] + +The "msg->iova + msg->size" addition can have an integer overflow +if the iotlb message is from a malicious user space application. +So let's fix it. + +Fixes: 1b48dc03e575 ("vhost: vdpa: report iova range") +Reported-by: Dan Carpenter +Signed-off-by: Xie Yongji +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/20210728130756.97-1-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vdpa.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c +index fb41db3da611..b5201bedf93f 100644 +--- a/drivers/vhost/vdpa.c ++++ b/drivers/vhost/vdpa.c +@@ -614,7 +614,8 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v, + long pinned; + int ret = 0; + +- if (msg->iova < v->range.first || ++ if (msg->iova < v->range.first || !msg->size || ++ msg->iova > U64_MAX - msg->size + 1 || + msg->iova + msg->size - 1 > v->range.last) + return -EINVAL; + +-- +2.30.2 + diff --git a/queue-5.13/virtio-net-use-netif_f_gro_hw-instead-of-netif_f_lro.patch b/queue-5.13/virtio-net-use-netif_f_gro_hw-instead-of-netif_f_lro.patch new file mode 100644 index 00000000000..b83cabaa6e5 --- /dev/null +++ b/queue-5.13/virtio-net-use-netif_f_gro_hw-instead-of-netif_f_lro.patch @@ -0,0 +1,101 @@ +From 4dea7f1023c5d26885ea71d36f46aaddcd939598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 16:06:59 +0800 +Subject: virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO + +From: Jason Wang + +[ Upstream commit dbcf24d153884439dad30484a0e3f02350692e4c ] + +Commit a02e8964eaf92 ("virtio-net: ethtool configurable LRO") +maps LRO to virtio guest offloading features and allows the +administrator to enable and disable those features via ethtool. + +This leads to several issues: + +- For a device that doesn't support control guest offloads, the "LRO" + can't be disabled triggering WARN in dev_disable_lro() when turning + off LRO or when enabling forwarding bridging etc. + +- For a device that supports control guest offloads, the guest + offloads are disabled in cases of bridging, forwarding etc slowing + down the traffic. + +Fix this by using NETIF_F_GRO_HW instead. Though the spec does not +guarantee packets to be re-segmented as the original ones, +we can add that to the spec, possibly with a flag for devices to +differentiate between GRO and LRO. + +Further, we never advertised LRO historically before a02e8964eaf92 +("virtio-net: ethtool configurable LRO") and so bridged/forwarded +configs effectively always relied on virtio receive offloads behaving +like GRO - thus even if this breaks any configs it is at least not +a regression. + +Fixes: a02e8964eaf92 ("virtio-net: ethtool configurable LRO") +Acked-by: Michael S. Tsirkin +Reported-by: Ivan +Tested-by: Ivan +Signed-off-by: Jason Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 6af227964413..d397dc6b0ebf 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -63,7 +63,7 @@ static const unsigned long guest_offloads[] = { + VIRTIO_NET_F_GUEST_CSUM + }; + +-#define GUEST_OFFLOAD_LRO_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \ ++#define GUEST_OFFLOAD_GRO_HW_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \ + (1ULL << VIRTIO_NET_F_GUEST_TSO6) | \ + (1ULL << VIRTIO_NET_F_GUEST_ECN) | \ + (1ULL << VIRTIO_NET_F_GUEST_UFO)) +@@ -2490,7 +2490,7 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) || + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) || + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) { +- NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first"); ++ NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing GRO_HW/CSUM, disable GRO_HW/CSUM first"); + return -EOPNOTSUPP; + } + +@@ -2621,15 +2621,15 @@ static int virtnet_set_features(struct net_device *dev, + u64 offloads; + int err; + +- if ((dev->features ^ features) & NETIF_F_LRO) { ++ if ((dev->features ^ features) & NETIF_F_GRO_HW) { + if (vi->xdp_enabled) + return -EBUSY; + +- if (features & NETIF_F_LRO) ++ if (features & NETIF_F_GRO_HW) + offloads = vi->guest_offloads_capable; + else + offloads = vi->guest_offloads_capable & +- ~GUEST_OFFLOAD_LRO_MASK; ++ ~GUEST_OFFLOAD_GRO_HW_MASK; + + err = virtnet_set_guest_offloads(vi, offloads); + if (err) +@@ -3109,9 +3109,9 @@ static int virtnet_probe(struct virtio_device *vdev) + dev->features |= NETIF_F_RXCSUM; + if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) || + virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6)) +- dev->features |= NETIF_F_LRO; ++ dev->features |= NETIF_F_GRO_HW; + if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_GUEST_OFFLOADS)) +- dev->hw_features |= NETIF_F_LRO; ++ dev->hw_features |= NETIF_F_GRO_HW; + + dev->vlan_features = dev->features; + +-- +2.30.2 + diff --git a/queue-5.13/virtio-protect-vqs-list-access.patch b/queue-5.13/virtio-protect-vqs-list-access.patch new file mode 100644 index 00000000000..178c955d03c --- /dev/null +++ b/queue-5.13/virtio-protect-vqs-list-access.patch @@ -0,0 +1,97 @@ +From aefa1dd04e13c813eaeb800bfcb475b07ccd85a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 17:26:47 +0300 +Subject: virtio: Protect vqs list access + +From: Parav Pandit + +[ Upstream commit 0e566c8f0f2e8325e35f6f97e13cde5356b41814 ] + +VQs may be accessed to mark the device broken while they are +created/destroyed. Hence protect the access to the vqs list. + +Fixes: e2dcdfe95c0b ("virtio: virtio_break_device() to mark all virtqueues broken.") +Signed-off-by: Parav Pandit +Link: https://lore.kernel.org/r/20210721142648.1525924-4-parav@nvidia.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio.c | 1 + + drivers/virtio/virtio_ring.c | 8 ++++++++ + include/linux/virtio.h | 1 + + 3 files changed, 10 insertions(+) + +diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c +index 4b15c00c0a0a..49984d2cba24 100644 +--- a/drivers/virtio/virtio.c ++++ b/drivers/virtio/virtio.c +@@ -355,6 +355,7 @@ int register_virtio_device(struct virtio_device *dev) + virtio_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE); + + INIT_LIST_HEAD(&dev->vqs); ++ spin_lock_init(&dev->vqs_list_lock); + + /* + * device_add() causes the bus infrastructure to look for a matching +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 71e16b53e9c1..6b7aa26c5384 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -1668,7 +1668,9 @@ static struct virtqueue *vring_create_virtqueue_packed( + cpu_to_le16(vq->packed.event_flags_shadow); + } + ++ spin_lock(&vdev->vqs_list_lock); + list_add_tail(&vq->vq.list, &vdev->vqs); ++ spin_unlock(&vdev->vqs_list_lock); + return &vq->vq; + + err_desc_extra: +@@ -2126,7 +2128,9 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index, + memset(vq->split.desc_state, 0, vring.num * + sizeof(struct vring_desc_state_split)); + ++ spin_lock(&vdev->vqs_list_lock); + list_add_tail(&vq->vq.list, &vdev->vqs); ++ spin_unlock(&vdev->vqs_list_lock); + return &vq->vq; + } + EXPORT_SYMBOL_GPL(__vring_new_virtqueue); +@@ -2210,7 +2214,9 @@ void vring_del_virtqueue(struct virtqueue *_vq) + } + if (!vq->packed_ring) + kfree(vq->split.desc_state); ++ spin_lock(&vq->vq.vdev->vqs_list_lock); + list_del(&_vq->list); ++ spin_unlock(&vq->vq.vdev->vqs_list_lock); + kfree(vq); + } + EXPORT_SYMBOL_GPL(vring_del_virtqueue); +@@ -2274,10 +2280,12 @@ void virtio_break_device(struct virtio_device *dev) + { + struct virtqueue *_vq; + ++ spin_lock(&dev->vqs_list_lock); + list_for_each_entry(_vq, &dev->vqs, list) { + struct vring_virtqueue *vq = to_vvq(_vq); + vq->broken = true; + } ++ spin_unlock(&dev->vqs_list_lock); + } + EXPORT_SYMBOL_GPL(virtio_break_device); + +diff --git a/include/linux/virtio.h b/include/linux/virtio.h +index b1894e0323fa..41edbc01ffa4 100644 +--- a/include/linux/virtio.h ++++ b/include/linux/virtio.h +@@ -110,6 +110,7 @@ struct virtio_device { + bool config_enabled; + bool config_change_pending; + spinlock_t config_lock; ++ spinlock_t vqs_list_lock; /* Protects VQs list access */ + struct device dev; + struct virtio_device_id id; + const struct virtio_config_ops *config; +-- +2.30.2 + diff --git a/queue-5.13/vp_vdpa-fix-return-value-check-for-vdpa_alloc_device.patch b/queue-5.13/vp_vdpa-fix-return-value-check-for-vdpa_alloc_device.patch new file mode 100644 index 00000000000..1e68e5a140c --- /dev/null +++ b/queue-5.13/vp_vdpa-fix-return-value-check-for-vdpa_alloc_device.patch @@ -0,0 +1,45 @@ +From f05c1d7b03cd14215f64ae66cc6b86621ef80e77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 16:00:24 +0800 +Subject: vp_vdpa: Fix return value check for vdpa_alloc_device() + +From: Xie Yongji + +[ Upstream commit 9632e78e82648aa98340df78eab9106f63da151e ] + +The vdpa_alloc_device() returns an error pointer upon +failure, not NULL. To handle the failure correctly, this +replaces NULL check with IS_ERR() check and propagate the +error upwards. + +Fixes: 64b9f64f80a6 ("vdpa: introduce virtio pci driver") +Reported-by: Dan Carpenter +Signed-off-by: Xie Yongji +Link: https://lore.kernel.org/r/20210715080026.242-2-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Reviewed-by: Stefano Garzarella +Signed-off-by: Sasha Levin +--- + drivers/vdpa/virtio_pci/vp_vdpa.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/vdpa/virtio_pci/vp_vdpa.c b/drivers/vdpa/virtio_pci/vp_vdpa.c +index 9145e0624565..54b313e4e63f 100644 +--- a/drivers/vdpa/virtio_pci/vp_vdpa.c ++++ b/drivers/vdpa/virtio_pci/vp_vdpa.c +@@ -400,9 +400,9 @@ static int vp_vdpa_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + vp_vdpa = vdpa_alloc_device(struct vp_vdpa, vdpa, + dev, &vp_vdpa_ops, NULL); +- if (vp_vdpa == NULL) { ++ if (IS_ERR(vp_vdpa)) { + dev_err(dev, "vp_vdpa: Failed to allocate vDPA structure\n"); +- return -ENOMEM; ++ return PTR_ERR(vp_vdpa); + } + + mdev = &vp_vdpa->mdev; +-- +2.30.2 + diff --git a/queue-5.13/vrf-reset-skb-conntrack-connection-on-vrf-rcv.patch b/queue-5.13/vrf-reset-skb-conntrack-connection-on-vrf-rcv.patch new file mode 100644 index 00000000000..7a91a56db3e --- /dev/null +++ b/queue-5.13/vrf-reset-skb-conntrack-connection-on-vrf-rcv.patch @@ -0,0 +1,209 @@ +From d44c5d718c19b7c54d52d7da93e882758088d7a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Aug 2021 12:00:02 +0000 +Subject: vrf: Reset skb conntrack connection on VRF rcv + +From: Lahav Schlesinger + +[ Upstream commit 09e856d54bda5f288ef8437a90ab2b9b3eab83d1 ] + +To fix the "reverse-NAT" for replies. + +When a packet is sent over a VRF, the POST_ROUTING hooks are called +twice: Once from the VRF interface, and once from the "actual" +interface the packet will be sent from: +1) First SNAT: l3mdev_l3_out() -> vrf_l3_out() -> .. -> vrf_output_direct() + This causes the POST_ROUTING hooks to run. +2) Second SNAT: 'ip_output()' calls POST_ROUTING hooks again. + +Similarly for replies, first ip_rcv() calls PRE_ROUTING hooks, and +second vrf_l3_rcv() calls them again. + +As an example, consider the following SNAT rule: +> iptables -t nat -A POSTROUTING -p udp -m udp --dport 53 -j SNAT --to-source 2.2.2.2 -o vrf_1 + +In this case sending over a VRF will create 2 conntrack entries. +The first is from the VRF interface, which performs the IP SNAT. +The second will run the SNAT, but since the "expected reply" will remain +the same, conntrack randomizes the source port of the packet: +e..g With a socket bound to 1.1.1.1:10000, sending to 3.3.3.3:53, the conntrack +rules are: +udp 17 29 src=2.2.2.2 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=61033 packets=0 bytes=0 mark=0 use=1 +udp 17 29 src=1.1.1.1 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=10000 packets=0 bytes=0 mark=0 use=1 + +i.e. First SNAT IP from 1.1.1.1 --> 2.2.2.2, and second the src port is +SNAT-ed from 10000 --> 61033. + +But when a reply is sent (3.3.3.3:53 -> 2.2.2.2:61033) only the later +conntrack entry is matched: +udp 17 29 src=2.2.2.2 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 src=3.3.3.3 dst=2.2.2.2 sport=53 dport=61033 packets=1 bytes=49 mark=0 use=1 +udp 17 28 src=1.1.1.1 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=10000 packets=0 bytes=0 mark=0 use=1 + +And a "port 61033 unreachable" ICMP packet is sent back. + +The issue is that when PRE_ROUTING hooks are called from vrf_l3_rcv(), +the skb already has a conntrack flow attached to it, which means +nf_conntrack_in() will not resolve the flow again. + +This means only the dest port is "reverse-NATed" (61033 -> 10000) but +the dest IP remains 2.2.2.2, and since the socket is bound to 1.1.1.1 it's +not received. +This can be verified by logging the 4-tuple of the packet in '__udp4_lib_rcv()'. + +The fix is then to reset the flow when skb is received on a VRF, to let +conntrack resolve the flow again (which now will hit the earlier flow). + +To reproduce: (Without the fix "Got pkt_to_nat_port" will not be printed by + running 'bash ./repro'): + $ cat run_in_A1.py + import logging + logging.getLogger("scapy.runtime").setLevel(logging.ERROR) + from scapy.all import * + import argparse + + def get_packet_to_send(udp_dst_port, msg_name): + return Ether(src='11:22:33:44:55:66', dst=iface_mac)/ \ + IP(src='3.3.3.3', dst='2.2.2.2')/ \ + UDP(sport=53, dport=udp_dst_port)/ \ + Raw(f'{msg_name}\x0012345678901234567890') + + parser = argparse.ArgumentParser() + parser.add_argument('-iface_mac', dest="iface_mac", type=str, required=True, + help="From run_in_A3.py") + parser.add_argument('-socket_port', dest="socket_port", type=str, + required=True, help="From run_in_A3.py") + parser.add_argument('-v1_mac', dest="v1_mac", type=str, required=True, + help="From script") + + args, _ = parser.parse_known_args() + iface_mac = args.iface_mac + socket_port = int(args.socket_port) + v1_mac = args.v1_mac + + print(f'Source port before NAT: {socket_port}') + + while True: + pkts = sniff(iface='_v0', store=True, count=1, timeout=10) + if 0 == len(pkts): + print('Something failed, rerun the script :(', flush=True) + break + pkt = pkts[0] + if not pkt.haslayer('UDP'): + continue + + pkt_sport = pkt.getlayer('UDP').sport + print(f'Source port after NAT: {pkt_sport}', flush=True) + + pkt_to_send = get_packet_to_send(pkt_sport, 'pkt_to_nat_port') + sendp(pkt_to_send, '_v0', verbose=False) # Will not be received + + pkt_to_send = get_packet_to_send(socket_port, 'pkt_to_socket_port') + sendp(pkt_to_send, '_v0', verbose=False) + break + + $ cat run_in_A2.py + import socket + import netifaces + + print(f"{netifaces.ifaddresses('e00000')[netifaces.AF_LINK][0]['addr']}", + flush=True) + s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + s.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE, + str('vrf_1' + '\0').encode('utf-8')) + s.connect(('3.3.3.3', 53)) + print(f'{s. getsockname()[1]}', flush=True) + s.settimeout(5) + + while True: + try: + # Periodically send in order to keep the conntrack entry alive. + s.send(b'a'*40) + resp = s.recvfrom(1024) + msg_name = resp[0].decode('utf-8').split('\0')[0] + print(f"Got {msg_name}", flush=True) + except Exception as e: + pass + + $ cat repro.sh + ip netns del A1 2> /dev/null + ip netns del A2 2> /dev/null + ip netns add A1 + ip netns add A2 + + ip -n A1 link add _v0 type veth peer name _v1 netns A2 + ip -n A1 link set _v0 up + + ip -n A2 link add e00000 type bond + ip -n A2 link add lo0 type dummy + ip -n A2 link add vrf_1 type vrf table 10001 + ip -n A2 link set vrf_1 up + ip -n A2 link set e00000 master vrf_1 + + ip -n A2 addr add 1.1.1.1/24 dev e00000 + ip -n A2 link set e00000 up + ip -n A2 link set _v1 master e00000 + ip -n A2 link set _v1 up + ip -n A2 link set lo0 up + ip -n A2 addr add 2.2.2.2/32 dev lo0 + + ip -n A2 neigh add 1.1.1.10 lladdr 77:77:77:77:77:77 dev e00000 + ip -n A2 route add 3.3.3.3/32 via 1.1.1.10 dev e00000 table 10001 + + ip netns exec A2 iptables -t nat -A POSTROUTING -p udp -m udp --dport 53 -j \ + SNAT --to-source 2.2.2.2 -o vrf_1 + + sleep 5 + ip netns exec A2 python3 run_in_A2.py > x & + XPID=$! + sleep 5 + + IFACE_MAC=`sed -n 1p x` + SOCKET_PORT=`sed -n 2p x` + V1_MAC=`ip -n A2 link show _v1 | sed -n 2p | awk '{print $2'}` + ip netns exec A1 python3 run_in_A1.py -iface_mac ${IFACE_MAC} -socket_port \ + ${SOCKET_PORT} -v1_mac ${SOCKET_PORT} + sleep 5 + + kill -9 $XPID + wait $XPID 2> /dev/null + ip netns del A1 + ip netns del A2 + tail x -n 2 + rm x + set +x + +Fixes: 73e20b761acf ("net: vrf: Add support for PREROUTING rules on vrf device") +Signed-off-by: Lahav Schlesinger +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20210815120002.2787653-1-lschlesinger@drivenets.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/vrf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index 414afcb0a23f..b1c451d10a5d 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -1367,6 +1367,8 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev, + bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr); + bool is_ndisc = ipv6_ndisc_frame(skb); + ++ nf_reset_ct(skb); ++ + /* loopback, multicast & non-ND link-local traffic; do not push through + * packet taps again. Reset pkt_type for upper layers to process skb. + * For strict packets with a source LLA, determine the dst using the +@@ -1429,6 +1431,8 @@ static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev, + skb->skb_iif = vrf_dev->ifindex; + IPCB(skb)->flags |= IPSKB_L3SLAVE; + ++ nf_reset_ct(skb); ++ + if (ipv4_is_multicast(ip_hdr(skb)->daddr)) + goto out; + +-- +2.30.2 +