From: Sasha Levin Date: Sun, 10 Oct 2021 18:58:38 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v5.14.12~24 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=28b755cb3aade0559ab71d07086f0beb581076dc;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arm-dts-imx-add-missing-pinctrl-names-for-panel-on-m.patch b/queue-5.4/arm-dts-imx-add-missing-pinctrl-names-for-panel-on-m.patch new file mode 100644 index 00000000000..aa4c57bf875 --- /dev/null +++ b/queue-5.4/arm-dts-imx-add-missing-pinctrl-names-for-panel-on-m.patch @@ -0,0 +1,41 @@ +From b40c394fd322392360049707c10161e55ae734ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 02:00:48 +0200 +Subject: ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo + +From: Marek Vasut + +[ Upstream commit c8c1efe14a4aadcfe93a158b1272e48298d2de15 ] + +The panel already contains pinctrl-0 phandle, but it is missing +the default pinctrl-names property, so the pin configuration is +ignored. Fill in the missing pinctrl-names property, so the pin +configuration is applied. + +Fixes: d81765d693db6 ("ARM: dts: imx53: Update LCD panel node on M53Menlo") +Signed-off-by: Marek Vasut +Cc: Shawn Guo +Cc: Fabio Estevam +Cc: NXP Linux Team +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx53-m53menlo.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts +index 64faf5b46d92..a6eb8319f321 100644 +--- a/arch/arm/boot/dts/imx53-m53menlo.dts ++++ b/arch/arm/boot/dts/imx53-m53menlo.dts +@@ -56,6 +56,7 @@ + panel { + compatible = "edt,etm0700g0dh6"; + pinctrl-0 = <&pinctrl_display_gpio>; ++ pinctrl-names = "default"; + enable-gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>; + + port { +-- +2.33.0 + diff --git a/queue-5.4/arm-dts-imx-fix-usb-host-power-regulator-polarity-on.patch b/queue-5.4/arm-dts-imx-fix-usb-host-power-regulator-polarity-on.patch new file mode 100644 index 00000000000..c327899858b --- /dev/null +++ b/queue-5.4/arm-dts-imx-fix-usb-host-power-regulator-polarity-on.patch @@ -0,0 +1,43 @@ +From d4786f3d1593574a9da987e26f1b9acda30075c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 02:01:37 +0200 +Subject: ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo + +From: Marek Vasut + +[ Upstream commit 5c187e2eb3f92daa38cb3d4ab45e1107ea34108e ] + +The MIC2025 switch input signal nEN is active low, describe it as such +in the DT. The previous change to this regulator polarity was incorrectly +influenced by broken quirks in gpiolib-of.c, which is now long fixed. So +fix this regulator polarity setting here once and for all. + +Fixes: 3c3601cd6a6d3 ("ARM: dts: imx53: Update USB configuration on M53Menlo") +Signed-off-by: Marek Vasut +Cc: Shawn Guo +Cc: Fabio Estevam +Cc: NXP Linux Team +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx53-m53menlo.dts | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts +index a6eb8319f321..03c43c1912a7 100644 +--- a/arch/arm/boot/dts/imx53-m53menlo.dts ++++ b/arch/arm/boot/dts/imx53-m53menlo.dts +@@ -77,8 +77,7 @@ + regulator-name = "vbus"; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; +- gpio = <&gpio1 2 GPIO_ACTIVE_HIGH>; +- enable-active-high; ++ gpio = <&gpio1 2 0>; + }; + }; + +-- +2.33.0 + diff --git a/queue-5.4/arm-dts-qcom-apq8064-use-27mhz-pxo-clock-as-dsi-pll-.patch b/queue-5.4/arm-dts-qcom-apq8064-use-27mhz-pxo-clock-as-dsi-pll-.patch new file mode 100644 index 00000000000..6bf706d52f7 --- /dev/null +++ b/queue-5.4/arm-dts-qcom-apq8064-use-27mhz-pxo-clock-as-dsi-pll-.patch @@ -0,0 +1,53 @@ +From 6044f59b265ae286da5d8d272c57275499f7393f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Aug 2021 22:30:25 +0200 +Subject: ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference + +From: Marijn Suijten + +[ Upstream commit f1db21c315f4b4f8c3fbea56aac500673132d317 ] + +The 28NM DSI PLL driver for msm8960 calculates with a 27MHz reference +clock and should hence use PXO, not CXO which runs at 19.2MHz. + +Note that none of the DSI PHY/PLL drivers currently use this "ref" +clock; they all rely on (sometimes inexistant) global clock names and +usually function normally without a parent clock. This discrepancy will +be corrected in a future patch, for which this change needs to be in +place first. + +Fixes: 6969d1d9c615 ("ARM: dts: qcom-apq8064: Set 'cxo_board' as ref clock of the DSI PHY") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Marijn Suijten +Link: https://lore.kernel.org/r/20210829203027.276143-2-marijn.suijten@somainline.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-apq8064.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi +index 27accc164df3..764984c95c68 100644 +--- a/arch/arm/boot/dts/qcom-apq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi +@@ -198,7 +198,7 @@ + clock-frequency = <19200000>; + }; + +- pxo_board { ++ pxo_board: pxo_board { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <27000000>; +@@ -1304,7 +1304,7 @@ + reg-names = "dsi_pll", "dsi_phy", "dsi_phy_regulator"; + clock-names = "iface_clk", "ref"; + clocks = <&mmcc DSI_M_AHB_CLK>, +- <&cxo_board>; ++ <&pxo_board>; + }; + + +-- +2.33.0 + diff --git a/queue-5.4/arm-imx6-disable-the-gic-cpu-interface-before-callin.patch b/queue-5.4/arm-imx6-disable-the-gic-cpu-interface-before-callin.patch new file mode 100644 index 00000000000..f3140c666c1 --- /dev/null +++ b/queue-5.4/arm-imx6-disable-the-gic-cpu-interface-before-callin.patch @@ -0,0 +1,44 @@ +From a3f42beecac7a10e2f94404d48dc853c2b875bf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 15:49:40 +0200 +Subject: ARM: imx6: disable the GIC CPU interface before calling stby-poweroff + sequence + +From: Oleksij Rempel + +[ Upstream commit 783f3db030563f7bcdfe2d26428af98ea1699a8e ] + +Any pending interrupt can prevent entering standby based power off state. +To avoid it, disable the GIC CPU interface. + +Fixes: 8148d2136002 ("ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set") +Signed-off-by: Oleksij Rempel +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/pm-imx6.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c +index baf3b47601af..1b73e4e76310 100644 +--- a/arch/arm/mach-imx/pm-imx6.c ++++ b/arch/arm/mach-imx/pm-imx6.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -618,6 +619,7 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata + + static void imx6_pm_stby_poweroff(void) + { ++ gic_cpu_if_down(0); + imx6_set_lpm(STOP_POWER_OFF); + imx6q_suspend_finish(0); + +-- +2.33.0 + diff --git a/queue-5.4/arm64-dts-freescale-fix-sp805-clock-names.patch b/queue-5.4/arm64-dts-freescale-fix-sp805-clock-names.patch new file mode 100644 index 00000000000..6f865d60271 --- /dev/null +++ b/queue-5.4/arm64-dts-freescale-fix-sp805-clock-names.patch @@ -0,0 +1,187 @@ +From 24445e793d96d4dbdec90b84400ac03f49ba58d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 14:05:56 +0100 +Subject: arm64: dts: freescale: Fix SP805 clock-names + +From: Andre Przywara + +[ Upstream commit f2dc2359b75e1fd345fd710862f73db20dc55864 ] + +The SP805 binding sets the order of the clock-names to be: "wdog_clk", +"apb_pclk" (in exactly that order). + +Change the order in the DTs for Freescale platforms to match that. The +two clocks given in all nodes are actually the same, so that does not +change any behaviour. + +Signed-off-by: Andre Przywara +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 4 ++-- + arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 16 ++++++++-------- + arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 16 ++++++++-------- + 3 files changed, 18 insertions(+), 18 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index 5716ac20bddd..963091069ab3 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -496,14 +496,14 @@ + compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc000000 0x0 0x1000>; + clocks = <&clockgen 4 15>, <&clockgen 4 15>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core1_watchdog: watchdog@c010000 { + compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc010000 0x0 0x1000>; + clocks = <&clockgen 4 15>, <&clockgen 4 15>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + sai1: audio-controller@f100000 { +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +index c676d0771762..407ebdb35cd2 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +@@ -640,56 +640,56 @@ + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc000000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core1_watchdog: wdt@c010000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc010000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core2_watchdog: wdt@c020000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc020000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core3_watchdog: wdt@c030000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc030000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core0_watchdog: wdt@c100000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc100000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core1_watchdog: wdt@c110000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc110000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core2_watchdog: wdt@c120000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc120000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core3_watchdog: wdt@c130000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc130000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + fsl_mc: fsl-mc@80c000000 { +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +index cdb2fa47637d..82f0fe6acbfb 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +@@ -230,56 +230,56 @@ + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc000000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core1_watchdog: wdt@c010000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc010000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core0_watchdog: wdt@c100000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc100000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core1_watchdog: wdt@c110000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc110000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster3_core0_watchdog: wdt@c200000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc200000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster3_core1_watchdog: wdt@c210000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc210000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster4_core0_watchdog: wdt@c300000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc300000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster4_core1_watchdog: wdt@c310000 { + compatible = "arm,sp805-wdt", "arm,primecell"; + reg = <0x0 0xc310000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; +- clock-names = "apb_pclk", "wdog_clk"; ++ clock-names = "wdog_clk", "apb_pclk"; + }; + + crypto: crypto@8000000 { +-- +2.33.0 + diff --git a/queue-5.4/arm64-dts-ls1028a-add-missing-can-nodes.patch b/queue-5.4/arm64-dts-ls1028a-add-missing-can-nodes.patch new file mode 100644 index 00000000000..3059cfadb3f --- /dev/null +++ b/queue-5.4/arm64-dts-ls1028a-add-missing-can-nodes.patch @@ -0,0 +1,53 @@ +From c7baf66faa7235448f8305f8f482f3dd85688ffc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Oct 2020 11:11:30 +0200 +Subject: arm64: dts: ls1028a: add missing CAN nodes + +From: Michael Walle + +[ Upstream commit 04fa4f03e3533f51b4db19cb487435f5862a0514 ] + +The LS1028A has two FlexCAN controller. These are compatible with +the ones from the LX2160A. Add the nodes. + +The first controller was tested on the Kontron sl28 board. + +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index 963091069ab3..02ae6bfff565 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -287,6 +287,24 @@ + status = "disabled"; + }; + ++ can0: can@2180000 { ++ compatible = "fsl,ls1028ar1-flexcan", "fsl,lx2160ar1-flexcan"; ++ reg = <0x0 0x2180000 0x0 0x10000>; ++ interrupts = ; ++ clocks = <&sysclk>, <&clockgen 4 1>; ++ clock-names = "ipg", "per"; ++ status = "disabled"; ++ }; ++ ++ can1: can@2190000 { ++ compatible = "fsl,ls1028ar1-flexcan", "fsl,lx2160ar1-flexcan"; ++ reg = <0x0 0x2190000 0x0 0x10000>; ++ interrupts = ; ++ clocks = <&sysclk>, <&clockgen 4 1>; ++ clock-names = "ipg", "per"; ++ status = "disabled"; ++ }; ++ + duart0: serial@21c0500 { + compatible = "fsl,ns16550", "ns16550a"; + reg = <0x00 0x21c0500 0x0 0x100>; +-- +2.33.0 + diff --git a/queue-5.4/arm64-dts-qcom-pm8150-use-qcom-pm8998-pon-binding.patch b/queue-5.4/arm64-dts-qcom-pm8150-use-qcom-pm8998-pon-binding.patch new file mode 100644 index 00000000000..6669dd70efc --- /dev/null +++ b/queue-5.4/arm64-dts-qcom-pm8150-use-qcom-pm8998-pon-binding.patch @@ -0,0 +1,38 @@ +From f7ead9774e8efd010afb2861b7a6b01b20542b62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Sep 2021 18:13:39 +0300 +Subject: arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding + +From: Dmitry Baryshkov + +[ Upstream commit a153d317168aa3d61a204fadc85bac3995381d33 ] + +Change pm8150 to use the qcom,pm8998-pon compatible string for the pon +in order to pass reboot mode properly. + +Fixes: 5101f22a5c37 ("arm64: dts: qcom: pm8150: Add base dts file") +Signed-off-by: Dmitry Baryshkov +Tested-by: Amit Pundir +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210916151341.1797512-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pm8150.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pm8150.dtsi b/arch/arm64/boot/dts/qcom/pm8150.dtsi +index c0b197458665..6f7dfcb8c042 100644 +--- a/arch/arm64/boot/dts/qcom/pm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/pm8150.dtsi +@@ -17,7 +17,7 @@ + #size-cells = <0>; + + pon: power-on@800 { +- compatible = "qcom,pm8916-pon"; ++ compatible = "qcom,pm8998-pon"; + reg = <0x0800>; + pwrkey { + compatible = "qcom,pm8941-pwrkey"; +-- +2.33.0 + diff --git a/queue-5.4/bpf-arm-fix-register-clobbering-in-div-mod-implement.patch b/queue-5.4/bpf-arm-fix-register-clobbering-in-div-mod-implement.patch new file mode 100644 index 00000000000..bcf27ced434 --- /dev/null +++ b/queue-5.4/bpf-arm-fix-register-clobbering-in-div-mod-implement.patch @@ -0,0 +1,94 @@ +From 8f524d632d2d20bb0b4ee7d62bc858d121e068b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 11:13:10 +0200 +Subject: bpf, arm: Fix register clobbering in div/mod implementation + +From: Johan Almbladh + +[ Upstream commit 79e3445b38e0cab94264a3894c0c3d57c930b97e ] + +On ARM CPUs that lack div/mod instructions, ALU32 BPF_DIV and BPF_MOD are +implemented using a call to a helper function. Before, the emitted code +for those function calls failed to preserve caller-saved ARM registers. +Since some of those registers happen to be mapped to BPF registers, it +resulted in eBPF register values being overwritten. + +This patch emits code to push and pop the remaining caller-saved ARM +registers r2-r3 into the stack during the div/mod function call. ARM +registers r0-r1 are used as arguments and return value, and those were +already saved and restored correctly. + +Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler") +Signed-off-by: Johan Almbladh +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + arch/arm/net/bpf_jit_32.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c +index b51a8c7b0111..1c6e57f1dbc4 100644 +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -36,6 +36,10 @@ + * +-----+ + * |RSVD | JIT scratchpad + * current ARM_SP => +-----+ <= (BPF_FP - STACK_SIZE + SCRATCH_SIZE) ++ * | ... | caller-saved registers ++ * +-----+ ++ * | ... | arguments passed on stack ++ * ARM_SP during call => +-----| + * | | + * | ... | Function call stack + * | | +@@ -63,6 +67,12 @@ + * + * When popping registers off the stack at the end of a BPF function, we + * reference them via the current ARM_FP register. ++ * ++ * Some eBPF operations are implemented via a call to a helper function. ++ * Such calls are "invisible" in the eBPF code, so it is up to the calling ++ * program to preserve any caller-saved ARM registers during the call. The ++ * JIT emits code to push and pop those registers onto the stack, immediately ++ * above the callee stack frame. + */ + #define CALLEE_MASK (1 << ARM_R4 | 1 << ARM_R5 | 1 << ARM_R6 | \ + 1 << ARM_R7 | 1 << ARM_R8 | 1 << ARM_R9 | \ +@@ -70,6 +80,8 @@ + #define CALLEE_PUSH_MASK (CALLEE_MASK | 1 << ARM_LR) + #define CALLEE_POP_MASK (CALLEE_MASK | 1 << ARM_PC) + ++#define CALLER_MASK (1 << ARM_R0 | 1 << ARM_R1 | 1 << ARM_R2 | 1 << ARM_R3) ++ + enum { + /* Stack layout - these are offsets from (top of stack - 4) */ + BPF_R2_HI, +@@ -464,6 +476,7 @@ static inline int epilogue_offset(const struct jit_ctx *ctx) + + static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op) + { ++ const int exclude_mask = BIT(ARM_R0) | BIT(ARM_R1); + const s8 *tmp = bpf2a32[TMP_REG_1]; + + #if __LINUX_ARM_ARCH__ == 7 +@@ -495,11 +508,17 @@ static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op) + emit(ARM_MOV_R(ARM_R0, rm), ctx); + } + ++ /* Push caller-saved registers on stack */ ++ emit(ARM_PUSH(CALLER_MASK & ~exclude_mask), ctx); ++ + /* Call appropriate function */ + emit_mov_i(ARM_IP, op == BPF_DIV ? + (u32)jit_udiv32 : (u32)jit_mod32, ctx); + emit_blx_r(ARM_IP, ctx); + ++ /* Restore caller-saved registers from stack */ ++ emit(ARM_POP(CALLER_MASK & ~exclude_mask), ctx); ++ + /* Save return value */ + if (rd != ARM_R0) + emit(ARM_MOV_R(rd, ARM_R0), ctx); +-- +2.33.0 + diff --git a/queue-5.4/bpf-fix-integer-overflow-in-prealloc_elems_and_freel.patch b/queue-5.4/bpf-fix-integer-overflow-in-prealloc_elems_and_freel.patch new file mode 100644 index 00000000000..a33995fd7dd --- /dev/null +++ b/queue-5.4/bpf-fix-integer-overflow-in-prealloc_elems_and_freel.patch @@ -0,0 +1,65 @@ +From 80ef8812ed166e4ddaf7d108b391d6b377366f5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 22:55:45 +0900 +Subject: bpf: Fix integer overflow in prealloc_elems_and_freelist() + +From: Tatsuhiko Yasumatsu + +[ Upstream commit 30e29a9a2bc6a4888335a6ede968b75cd329657a ] + +In prealloc_elems_and_freelist(), the multiplication to calculate the +size passed to bpf_map_area_alloc() could lead to an integer overflow. +As a result, out-of-bounds write could occur in pcpu_freelist_populate() +as reported by KASAN: + +[...] +[ 16.968613] BUG: KASAN: slab-out-of-bounds in pcpu_freelist_populate+0xd9/0x100 +[ 16.969408] Write of size 8 at addr ffff888104fc6ea0 by task crash/78 +[ 16.970038] +[ 16.970195] CPU: 0 PID: 78 Comm: crash Not tainted 5.15.0-rc2+ #1 +[ 16.970878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 +[ 16.972026] Call Trace: +[ 16.972306] dump_stack_lvl+0x34/0x44 +[ 16.972687] print_address_description.constprop.0+0x21/0x140 +[ 16.973297] ? pcpu_freelist_populate+0xd9/0x100 +[ 16.973777] ? pcpu_freelist_populate+0xd9/0x100 +[ 16.974257] kasan_report.cold+0x7f/0x11b +[ 16.974681] ? pcpu_freelist_populate+0xd9/0x100 +[ 16.975190] pcpu_freelist_populate+0xd9/0x100 +[ 16.975669] stack_map_alloc+0x209/0x2a0 +[ 16.976106] __sys_bpf+0xd83/0x2ce0 +[...] + +The possibility of this overflow was originally discussed in [0], but +was overlooked. + +Fix the integer overflow by changing elem_size to u64 from u32. + + [0] https://lore.kernel.org/bpf/728b238e-a481-eb50-98e9-b0f430ab01e7@gmail.com/ + +Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation") +Signed-off-by: Tatsuhiko Yasumatsu +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210930135545.173698-1-th.yasumatsu@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/stackmap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index fba2ade28fb3..49c7a09d688d 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -60,7 +60,8 @@ static inline int stack_map_data_size(struct bpf_map *map) + + static int prealloc_elems_and_freelist(struct bpf_stack_map *smap) + { +- u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size; ++ u64 elem_size = sizeof(struct stack_map_bucket) + ++ (u64)smap->map.value_size; + int err; + + smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries, +-- +2.33.0 + diff --git a/queue-5.4/bus-ti-sysc-use-clkdm_noauto-for-dra7-dcan1-for-erra.patch b/queue-5.4/bus-ti-sysc-use-clkdm_noauto-for-dra7-dcan1-for-erra.patch new file mode 100644 index 00000000000..5dbccefca30 --- /dev/null +++ b/queue-5.4/bus-ti-sysc-use-clkdm_noauto-for-dra7-dcan1-for-erra.patch @@ -0,0 +1,55 @@ +From 235f1122bab514664930a7071e250264e4a3fc29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Sep 2021 08:49:36 +0300 +Subject: bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893 + +From: Tony Lindgren + +[ Upstream commit b13a270ace2e4c70653aa1d1d0394c553905802f ] + +Commit 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for +CLKDM_NOAUTO") should have also added the quirk for dra7 dcan1 in +addition to dcan2 for errata i893 handling. + +Let's also pass the quirk flag for legacy mode booting for if "ti,hwmods" +dts property is used with related dcan hwmod data. This should be only +needed if anybody needs to git bisect earlier stable trees though. + +Fixes: 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap_hwmod.c | 2 ++ + drivers/bus/ti-sysc.c | 3 +++ + 2 files changed, 5 insertions(+) + +diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c +index eb74aa182661..6289b288d60a 100644 +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -3656,6 +3656,8 @@ int omap_hwmod_init_module(struct device *dev, + oh->flags |= HWMOD_SWSUP_SIDLE_ACT; + if (data->cfg->quirks & SYSC_QUIRK_SWSUP_MSTANDBY) + oh->flags |= HWMOD_SWSUP_MSTANDBY; ++ if (data->cfg->quirks & SYSC_QUIRK_CLKDM_NOAUTO) ++ oh->flags |= HWMOD_CLKDM_NOAUTO; + + error = omap_hwmod_check_module(dev, oh, data, sysc_fields, + rev_offs, sysc_offs, syss_offs, +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 90053c4a8290..469ca73de4ce 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1388,6 +1388,9 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { + /* Quirks that need to be set based on detected module */ + SYSC_QUIRK("aess", 0, 0, 0x10, -ENODEV, 0x40000000, 0xffffffff, + SYSC_MODULE_QUIRK_AESS), ++ /* Errata i893 handling for dra7 dcan1 and 2 */ ++ SYSC_QUIRK("dcan", 0x4ae3c000, 0x20, -ENODEV, -ENODEV, 0xa3170504, 0xffffffff, ++ SYSC_QUIRK_CLKDM_NOAUTO), + SYSC_QUIRK("dcan", 0x48480000, 0x20, -ENODEV, -ENODEV, 0xa3170504, 0xffffffff, + SYSC_QUIRK_CLKDM_NOAUTO), + SYSC_QUIRK("dss", 0x4832a000, 0, 0x10, 0x14, 0x00000020, 0xffffffff, +-- +2.33.0 + diff --git a/queue-5.4/drm-nouveau-debugfs-fix-file-release-memory-leak.patch b/queue-5.4/drm-nouveau-debugfs-fix-file-release-memory-leak.patch new file mode 100644 index 00000000000..a70f92269f2 --- /dev/null +++ b/queue-5.4/drm-nouveau-debugfs-fix-file-release-memory-leak.patch @@ -0,0 +1,39 @@ +From 0805ed4fce62a9186f0d9e2231484c3b8f144558 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Sep 2021 15:50:23 +0800 +Subject: drm/nouveau/debugfs: fix file release memory leak + +From: Yang Yingliang + +[ Upstream commit f5a8703a9c418c6fc54eb772712dfe7641e3991c ] + +When using single_open() for opening, single_release() should be +called, otherwise the 'op' allocated in single_open() will be leaked. + +Fixes: 6e9fc177399f ("drm/nouveau/debugfs: add copy of sysfs pstate interface ported to debugfs") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Reviewed-by: Karol Herbst +Signed-off-by: Karol Herbst +Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-2-yangyingliang@huawei.com +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +index 3b13feca970f..3c54d61e4fa9 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c ++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +@@ -207,6 +207,7 @@ static const struct file_operations nouveau_pstate_fops = { + .open = nouveau_debugfs_pstate_open, + .read = seq_read, + .write = nouveau_debugfs_pstate_set, ++ .release = single_release, + }; + + static struct drm_info_list nouveau_debugfs_list[] = { +-- +2.33.0 + diff --git a/queue-5.4/gve-correct-available-tx-qpl-check.patch b/queue-5.4/gve-correct-available-tx-qpl-check.patch new file mode 100644 index 00000000000..4883539065e --- /dev/null +++ b/queue-5.4/gve-correct-available-tx-qpl-check.patch @@ -0,0 +1,37 @@ +From 820ee4ec2f8b07e464001106a04096daf692b7a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 19:42:19 -0700 +Subject: gve: Correct available tx qpl check + +From: Catherine Sullivan + +[ Upstream commit d03477ee10f4bc35d3573cf1823814378ef2dca2 ] + +The qpl_map_size is rounded up to a multiple of sizeof(long), but the +number of qpls doesn't have to be. + +Fixes: f5cedc84a30d2 ("gve: Add transmit and receive support") +Signed-off-by: Catherine Sullivan +Signed-off-by: Jeroen de Borst +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h +index ebc37e256922..f19edd4c6c5b 100644 +--- a/drivers/net/ethernet/google/gve/gve.h ++++ b/drivers/net/ethernet/google/gve/gve.h +@@ -391,7 +391,7 @@ struct gve_queue_page_list *gve_assign_rx_qpl(struct gve_priv *priv) + gve_num_tx_qpls(priv)); + + /* we are out of rx qpls */ +- if (id == priv->qpl_cfg.qpl_map_size) ++ if (id == gve_num_tx_qpls(priv) + gve_num_rx_qpls(priv)) + return NULL; + + set_bit(id, priv->qpl_cfg.qpl_id_map); +-- +2.33.0 + diff --git a/queue-5.4/gve-fix-gve_get_stats.patch b/queue-5.4/gve-fix-gve_get_stats.patch new file mode 100644 index 00000000000..d512c65aa0c --- /dev/null +++ b/queue-5.4/gve-fix-gve_get_stats.patch @@ -0,0 +1,75 @@ +From bf85aff37a6b51584ad8b8b95ea8845da6782abd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 17:30:30 -0700 +Subject: gve: fix gve_get_stats() + +From: Eric Dumazet + +[ Upstream commit 2f57d4975fa027eabd35fdf23a49f8222ef3abf2 ] + +gve_get_stats() can report wrong numbers if/when u64_stats_fetch_retry() +returns true. + +What is needed here is to sample values in temporary variables, +and only use them after each loop is ended. + +Fixes: f5cedc84a30d ("gve: Add transmit and receive support") +Signed-off-by: Eric Dumazet +Cc: Catherine Sullivan +Cc: Sagi Shahar +Cc: Jon Olson +Cc: Willem de Bruijn +Cc: Luigi Rizzo +Cc: Jeroen de Borst +Cc: Tao Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_main.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c +index f8dfa7501f65..5b450c6100ad 100644 +--- a/drivers/net/ethernet/google/gve/gve_main.c ++++ b/drivers/net/ethernet/google/gve/gve_main.c +@@ -30,6 +30,7 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) + { + struct gve_priv *priv = netdev_priv(dev); + unsigned int start; ++ u64 packets, bytes; + int ring; + + if (priv->rx) { +@@ -37,10 +38,12 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) + do { + start = + u64_stats_fetch_begin(&priv->rx[ring].statss); +- s->rx_packets += priv->rx[ring].rpackets; +- s->rx_bytes += priv->rx[ring].rbytes; ++ packets = priv->rx[ring].rpackets; ++ bytes = priv->rx[ring].rbytes; + } while (u64_stats_fetch_retry(&priv->rx[ring].statss, + start)); ++ s->rx_packets += packets; ++ s->rx_bytes += bytes; + } + } + if (priv->tx) { +@@ -48,10 +51,12 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) + do { + start = + u64_stats_fetch_begin(&priv->tx[ring].statss); +- s->tx_packets += priv->tx[ring].pkt_done; +- s->tx_bytes += priv->tx[ring].bytes_done; ++ packets = priv->tx[ring].pkt_done; ++ bytes = priv->tx[ring].bytes_done; + } while (u64_stats_fetch_retry(&priv->tx[ring].statss, + start)); ++ s->tx_packets += packets; ++ s->tx_bytes += bytes; + } + } + } +-- +2.33.0 + diff --git a/queue-5.4/i40e-fix-endless-loop-under-rtnl.patch b/queue-5.4/i40e-fix-endless-loop-under-rtnl.patch new file mode 100644 index 00000000000..f44462ef783 --- /dev/null +++ b/queue-5.4/i40e-fix-endless-loop-under-rtnl.patch @@ -0,0 +1,58 @@ +From b32a118cbe88cdfd734652c77b109c789edf5721 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Sep 2021 10:54:42 +0200 +Subject: i40e: fix endless loop under rtnl + +From: Jiri Benc + +[ Upstream commit 857b6c6f665cca9828396d9743faf37fd09e9ac3 ] + +The loop in i40e_get_capabilities can never end. The problem is that +although i40e_aq_discover_capabilities returns with an error if there's +a firmware problem, the returned error is not checked. There is a check for +pf->hw.aq.asq_last_status but that value is set to I40E_AQ_RC_OK on most +firmware problems. + +When i40e_aq_discover_capabilities encounters a firmware problem, it will +encounter the same problem on its next invocation. As the result, the loop +becomes endless. We hit this with I40E_ERR_ADMIN_QUEUE_TIMEOUT but looking +at the code, it can happen with a range of other firmware errors. + +I don't know what the correct behavior should be: whether the firmware +should be retried a few times, or whether pf->hw.aq.asq_last_status should +be always set to the encountered firmware error (but then it would be +pointless and can be just replaced by the i40e_aq_discover_capabilities +return value). However, the current behavior with an endless loop under the +rtnl mutex(!) is unacceptable and Intel has not submitted a fix, although we +explained the bug to them 7 months ago. + +This may not be the best possible fix but it's better than hanging the whole +system on a firmware bug. + +Fixes: 56a62fc86895 ("i40e: init code and hardware support") +Tested-by: Stefan Assmann +Signed-off-by: Jiri Benc +Reviewed-by: Jesse Brandeburg +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 21ab7d2caddf..8434067566db 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -9616,7 +9616,7 @@ static int i40e_get_capabilities(struct i40e_pf *pf, + if (pf->hw.aq.asq_last_status == I40E_AQ_RC_ENOMEM) { + /* retry with a larger buffer */ + buf_len = data_size; +- } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK) { ++ } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK || err) { + dev_info(&pf->pdev->dev, + "capability discovery failed, err %s aq_err %s\n", + i40e_stat_str(&pf->hw, err), +-- +2.33.0 + diff --git a/queue-5.4/i40e-fix-freeing-of-uninitialized-misc-irq-vector.patch b/queue-5.4/i40e-fix-freeing-of-uninitialized-misc-irq-vector.patch new file mode 100644 index 00000000000..44b4c48666c --- /dev/null +++ b/queue-5.4/i40e-fix-freeing-of-uninitialized-misc-irq-vector.patch @@ -0,0 +1,79 @@ +From 1374669a0ab41f31a01e1213f55fd3c46f4de733 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 11:40:41 +0200 +Subject: i40e: Fix freeing of uninitialized misc IRQ vector + +From: Sylwester Dziedziuch + +[ Upstream commit 2e5a20573a926302b233b0c2e1077f5debc7ab2e ] + +When VSI set up failed in i40e_probe() as part of PF switch set up +driver was trying to free misc IRQ vectors in +i40e_clear_interrupt_scheme and produced a kernel Oops: + + Trying to free already-free IRQ 266 + WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300 + Workqueue: events work_for_cpu_fn + RIP: 0010:__free_irq+0x9a/0x300 + Call Trace: + ? synchronize_irq+0x3a/0xa0 + free_irq+0x2e/0x60 + i40e_clear_interrupt_scheme+0x53/0x190 [i40e] + i40e_probe.part.108+0x134b/0x1a40 [i40e] + ? kmem_cache_alloc+0x158/0x1c0 + ? acpi_ut_update_ref_count.part.1+0x8e/0x345 + ? acpi_ut_update_object_reference+0x15e/0x1e2 + ? strstr+0x21/0x70 + ? irq_get_irq_data+0xa/0x20 + ? mp_check_pin_attr+0x13/0xc0 + ? irq_get_irq_data+0xa/0x20 + ? mp_map_pin_to_irq+0xd3/0x2f0 + ? acpi_register_gsi_ioapic+0x93/0x170 + ? pci_conf1_read+0xa4/0x100 + ? pci_bus_read_config_word+0x49/0x70 + ? do_pci_enable_device+0xcc/0x100 + local_pci_probe+0x41/0x90 + work_for_cpu_fn+0x16/0x20 + process_one_work+0x1a7/0x360 + worker_thread+0x1cf/0x390 + ? create_worker+0x1a0/0x1a0 + kthread+0x112/0x130 + ? kthread_flush_work_fn+0x10/0x10 + ret_from_fork+0x1f/0x40 + +The problem is that at that point misc IRQ vectors +were not allocated yet and we get a call trace +that driver is trying to free already free IRQ vectors. + +Add a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED +PF state before calling i40e_free_misc_vector. This state is set only if +misc IRQ vectors were properly initialized. + +Fixes: c17401a1dd21 ("i40e: use separate state bit for miscellaneous IRQ setup") +Reported-by: PJ Waskiewicz +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Mateusz Palczewski +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 8434067566db..917be10a5cf5 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -4817,7 +4817,8 @@ static void i40e_clear_interrupt_scheme(struct i40e_pf *pf) + { + int i; + +- i40e_free_misc_vector(pf); ++ if (test_bit(__I40E_MISC_IRQ_REQUESTED, pf->state)) ++ i40e_free_misc_vector(pf); + + i40e_put_lump(pf->irq_pile, pf->iwarp_base_vector, + I40E_IWARP_IRQ_PILE_ID); +-- +2.33.0 + diff --git a/queue-5.4/net-bridge-use-nla_total_size_64bit-in-br_get_linkxs.patch b/queue-5.4/net-bridge-use-nla_total_size_64bit-in-br_get_linkxs.patch new file mode 100644 index 00000000000..fd963a4e33b --- /dev/null +++ b/queue-5.4/net-bridge-use-nla_total_size_64bit-in-br_get_linkxs.patch @@ -0,0 +1,41 @@ +From 1349e84e03e92dd8d7db2e7eaf219766f249bc43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 18:05:07 -0700 +Subject: net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() + +From: Eric Dumazet + +[ Upstream commit dbe0b88064494b7bb6a9b2aa7e085b14a3112d44 ] + +bridge_fill_linkxstats() is using nla_reserve_64bit(). + +We must use nla_total_size_64bit() instead of nla_total_size() +for corresponding data structure. + +Fixes: 1080ab95e3c7 ("net: bridge: add support for IGMP/MLD stats and export them via netlink") +Signed-off-by: Eric Dumazet +Cc: Nikolay Aleksandrov +Cc: Vivien Didelot +Acked-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index 8a664148f57a..cbcbc19efcb3 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -1536,7 +1536,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr) + } + + return numvls * nla_total_size(sizeof(struct bridge_vlan_xstats)) + +- nla_total_size(sizeof(struct br_mcast_stats)) + ++ nla_total_size_64bit(sizeof(struct br_mcast_stats)) + + nla_total_size(0); + } + +-- +2.33.0 + diff --git a/queue-5.4/net-prefer-socket-bound-to-interface-when-not-in-vrf.patch b/queue-5.4/net-prefer-socket-bound-to-interface-when-not-in-vrf.patch new file mode 100644 index 00000000000..1b04a629338 --- /dev/null +++ b/queue-5.4/net-prefer-socket-bound-to-interface-when-not-in-vrf.patch @@ -0,0 +1,98 @@ +From 6bf04d7b3ebcb28e2f7b4cda3f7c35e9d9d50e7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 14:03:42 +0100 +Subject: net: prefer socket bound to interface when not in VRF + +From: Mike Manning + +[ Upstream commit 8d6c414cd2fb74aa6812e9bfec6178f8246c4f3a ] + +The commit 6da5b0f027a8 ("net: ensure unbound datagram socket to be +chosen when not in a VRF") modified compute_score() so that a device +match is always made, not just in the case of an l3mdev skb, then +increments the score also for unbound sockets. This ensures that +sockets bound to an l3mdev are never selected when not in a VRF. +But as unbound and bound sockets are now scored equally, this results +in the last opened socket being selected if there are matches in the +default VRF for an unbound socket and a socket bound to a dev that is +not an l3mdev. However, handling prior to this commit was to always +select the bound socket in this case. Reinstate this handling by +incrementing the score only for bound sockets. The required isolation +due to choosing between an unbound socket and a socket bound to an +l3mdev remains in place due to the device match always being made. +The same approach is taken for compute_score() for stream sockets. + +Fixes: 6da5b0f027a8 ("net: ensure unbound datagram socket to be chosen when not in a VRF") +Fixes: e78190581aff ("net: ensure unbound stream socket to be chosen when not in a VRF") +Signed-off-by: Mike Manning +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/cf0a8523-b362-1edf-ee78-eef63cbbb428@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_hashtables.c | 4 +++- + net/ipv4/udp.c | 3 ++- + net/ipv6/inet6_hashtables.c | 2 +- + net/ipv6/udp.c | 3 ++- + 4 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 006a34b18537..72fdf1fcbcaa 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -239,8 +239,10 @@ static inline int compute_score(struct sock *sk, struct net *net, + + if (!inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif)) + return -1; ++ score = sk->sk_bound_dev_if ? 2 : 1; + +- score = sk->sk_family == PF_INET ? 2 : 1; ++ if (sk->sk_family == PF_INET) ++ score++; + if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id()) + score++; + } +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index de04d9941885..fdbd56ee1300 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -386,7 +386,8 @@ static int compute_score(struct sock *sk, struct net *net, + dif, sdif); + if (!dev_match) + return -1; +- score += 4; ++ if (sk->sk_bound_dev_if) ++ score += 4; + + if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id()) + score++; +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c +index fbe9d4295eac..ab12e00f6bff 100644 +--- a/net/ipv6/inet6_hashtables.c ++++ b/net/ipv6/inet6_hashtables.c +@@ -104,7 +104,7 @@ static inline int compute_score(struct sock *sk, struct net *net, + if (!inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif)) + return -1; + +- score = 1; ++ score = sk->sk_bound_dev_if ? 2 : 1; + if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id()) + score++; + } +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 5b8266f3e47f..0f57c682afdd 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -133,7 +133,8 @@ static int compute_score(struct sock *sk, struct net *net, + dev_match = udp_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif); + if (!dev_match) + return -1; +- score++; ++ if (sk->sk_bound_dev_if) ++ score++; + + if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id()) + score++; +-- +2.33.0 + diff --git a/queue-5.4/net-sched-sch_taprio-properly-cancel-timer-from-tapr.patch b/queue-5.4/net-sched-sch_taprio-properly-cancel-timer-from-tapr.patch new file mode 100644 index 00000000000..9bfa0956ec5 --- /dev/null +++ b/queue-5.4/net-sched-sch_taprio-properly-cancel-timer-from-tapr.patch @@ -0,0 +1,94 @@ +From bd5142f16d42042beaa7443f15d08964cfce66bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 12:55:22 -0700 +Subject: net/sched: sch_taprio: properly cancel timer from taprio_destroy() + +From: Eric Dumazet + +[ Upstream commit a56d447f196fa9973c568f54c0d76d5391c3b0c0 ] + +There is a comment in qdisc_create() about us not calling ops->reset() +in some cases. + +err_out4: + /* + * Any broken qdiscs that would require a ops->reset() here? + * The qdisc was never in action so it shouldn't be necessary. + */ + +As taprio sets a timer before actually receiving a packet, we need +to cancel it from ops->destroy, just in case ops->reset has not +been called. + +syzbot reported: + +ODEBUG: free active (active state 0) object type: hrtimer hint: advance_sched+0x0/0x9a0 arch/x86/include/asm/atomic64_64.h:22 +WARNING: CPU: 0 PID: 8441 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505 +Modules linked in: +CPU: 0 PID: 8441 Comm: syz-executor813 Not tainted 5.14.0-rc6-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505 +Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 d3 e3 89 4c 89 ee 48 c7 c7 e0 c7 e3 89 e8 5b 86 11 05 <0f> 0b 83 05 85 03 92 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3 +RSP: 0018:ffffc9000130f330 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 +RDX: ffff88802baeb880 RSI: ffffffff815d87b5 RDI: fffff52000261e58 +RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 +R10: ffffffff815d25ee R11: 0000000000000000 R12: ffffffff898dd020 +R13: ffffffff89e3ce20 R14: ffffffff81653630 R15: dffffc0000000000 +FS: 0000000000f0d300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffb64b3e000 CR3: 0000000036557000 CR4: 00000000001506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + __debug_check_no_obj_freed lib/debugobjects.c:987 [inline] + debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1018 + slab_free_hook mm/slub.c:1603 [inline] + slab_free_freelist_hook+0x171/0x240 mm/slub.c:1653 + slab_free mm/slub.c:3213 [inline] + kfree+0xe4/0x540 mm/slub.c:4267 + qdisc_create+0xbcf/0x1320 net/sched/sch_api.c:1299 + tc_modify_qdisc+0x4c8/0x1a60 net/sched/sch_api.c:1663 + rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 + netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 + netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:724 + ____sys_sendmsg+0x6e8/0x810 net/socket.c:2403 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2457 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + +Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them") +Signed-off-by: Eric Dumazet +Cc: Davide Caratti +Reported-by: syzbot +Acked-by: Vinicius Costa Gomes +Acked-by: Davide Caratti +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_taprio.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index da9ed0613eb7..e14a66ce4884 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1630,6 +1630,10 @@ static void taprio_destroy(struct Qdisc *sch) + list_del(&q->taprio_list); + spin_unlock(&taprio_list_lock); + ++ /* Note that taprio_reset() might not be called if an error ++ * happens in qdisc_create(), after taprio_init() has been called. ++ */ ++ hrtimer_cancel(&q->advance_timer); + + taprio_disable_offload(dev, q, NULL); + +-- +2.33.0 + diff --git a/queue-5.4/net-sfp-fix-typo-in-state-machine-debug-string.patch b/queue-5.4/net-sfp-fix-typo-in-state-machine-debug-string.patch new file mode 100644 index 00000000000..b341dfbf771 --- /dev/null +++ b/queue-5.4/net-sfp-fix-typo-in-state-machine-debug-string.patch @@ -0,0 +1,36 @@ +From 6a2ed01c5d7843b1e57427168b5b68127f016b31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 17:50:02 -0400 +Subject: net: sfp: Fix typo in state machine debug string + +From: Sean Anderson + +[ Upstream commit 25a9da6641f1f66006e93ddbefee13a437efa8c0 ] + +The string should be "tx_disable" to match the state enum. + +Fixes: 4005a7cb4f55 ("net: phy: sftp: print debug message with text, not numbers") +Signed-off-by: Sean Anderson +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/sfp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index 27b67f12ec45..5657c604602e 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -115,7 +115,7 @@ static const char * const sm_state_strings[] = { + [SFP_S_LINK_UP] = "link_up", + [SFP_S_TX_FAULT] = "tx_fault", + [SFP_S_REINIT] = "reinit", +- [SFP_S_TX_DISABLE] = "rx_disable", ++ [SFP_S_TX_DISABLE] = "tx_disable", + }; + + static const char *sm_state_to_str(unsigned short sm_state) +-- +2.33.0 + diff --git a/queue-5.4/net_sched-fix-null-deref-in-fifo_set_limit.patch b/queue-5.4/net_sched-fix-null-deref-in-fifo_set_limit.patch new file mode 100644 index 00000000000..f762f9a823f --- /dev/null +++ b/queue-5.4/net_sched-fix-null-deref-in-fifo_set_limit.patch @@ -0,0 +1,87 @@ +From 3c56bd366e15e085c2e259020a1996e4706d7167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 14:22:39 -0700 +Subject: net_sched: fix NULL deref in fifo_set_limit() + +From: Eric Dumazet + +[ Upstream commit 560ee196fe9e5037e5015e2cdb14b3aecb1cd7dc ] + +syzbot reported another NULL deref in fifo_set_limit() [1] + +I could repro the issue with : + +unshare -n +tc qd add dev lo root handle 1:0 tbf limit 200000 burst 70000 rate 100Mbit +tc qd replace dev lo parent 1:0 pfifo_fast +tc qd change dev lo root handle 1:0 tbf limit 300000 burst 70000 rate 100Mbit + +pfifo_fast does not have a change() operation. +Make fifo_set_limit() more robust about this. + +[1] +BUG: kernel NULL pointer dereference, address: 0000000000000000 +PGD 1cf99067 P4D 1cf99067 PUD 7ca49067 PMD 0 +Oops: 0010 [#1] PREEMPT SMP KASAN +CPU: 1 PID: 14443 Comm: syz-executor959 Not tainted 5.15.0-rc3-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +RIP: 0010:0x0 +Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. +RSP: 0018:ffffc9000e2f7310 EFLAGS: 00010246 +RAX: dffffc0000000000 RBX: ffffffff8d6ecc00 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: ffff888024c27910 RDI: ffff888071e34000 +RBP: ffff888071e34000 R08: 0000000000000001 R09: ffffffff8fcfb947 +R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024c27910 +R13: ffff888071e34018 R14: 0000000000000000 R15: ffff88801ef74800 +FS: 00007f321d897700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: ffffffffffffffd6 CR3: 00000000722c3000 CR4: 00000000003506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + fifo_set_limit net/sched/sch_fifo.c:242 [inline] + fifo_set_limit+0x198/0x210 net/sched/sch_fifo.c:227 + tbf_change+0x6ec/0x16d0 net/sched/sch_tbf.c:418 + qdisc_change net/sched/sch_api.c:1332 [inline] + tc_modify_qdisc+0xd9a/0x1a60 net/sched/sch_api.c:1634 + rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 + netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 + netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:724 + ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2463 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: fb0305ce1b03 ("net-sched: consolidate default fifo qdisc setup") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Link: https://lore.kernel.org/r/20210930212239.3430364-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_fifo.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c +index 37c8aa75d70c..56f4c1621e44 100644 +--- a/net/sched/sch_fifo.c ++++ b/net/sched/sch_fifo.c +@@ -148,6 +148,9 @@ int fifo_set_limit(struct Qdisc *q, unsigned int limit) + if (strncmp(q->ops->id + 1, "fifo", 4) != 0) + return 0; + ++ if (!q->ops->change) ++ return 0; ++ + nla = kmalloc(nla_attr_size(sizeof(struct tc_fifo_qopt)), GFP_KERNEL); + if (nla) { + nla->nla_type = RTM_NEWQDISC; +-- +2.33.0 + diff --git a/queue-5.4/netlink-annotate-data-races-around-nlk-bound.patch b/queue-5.4/netlink-annotate-data-races-around-nlk-bound.patch new file mode 100644 index 00000000000..07024c24664 --- /dev/null +++ b/queue-5.4/netlink-annotate-data-races-around-nlk-bound.patch @@ -0,0 +1,111 @@ +From eec5418e049f5ca0ac341da6d1bc586410706397 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 14:24:15 -0700 +Subject: netlink: annotate data races around nlk->bound + +From: Eric Dumazet + +[ Upstream commit 7707a4d01a648e4c655101a469c956cb11273655 ] + +While existing code is correct, KCSAN is reporting +a data-race in netlink_insert / netlink_sendmsg [1] + +It is correct to read nlk->bound without a lock, as netlink_autobind() +will acquire all needed locks. + +[1] +BUG: KCSAN: data-race in netlink_insert / netlink_sendmsg + +write to 0xffff8881031c8b30 of 1 bytes by task 18752 on cpu 0: + netlink_insert+0x5cc/0x7f0 net/netlink/af_netlink.c:597 + netlink_autobind+0xa9/0x150 net/netlink/af_netlink.c:842 + netlink_sendmsg+0x479/0x7c0 net/netlink/af_netlink.c:1892 + sock_sendmsg_nosec net/socket.c:703 [inline] + sock_sendmsg net/socket.c:723 [inline] + ____sys_sendmsg+0x360/0x4d0 net/socket.c:2392 + ___sys_sendmsg net/socket.c:2446 [inline] + __sys_sendmsg+0x1ed/0x270 net/socket.c:2475 + __do_sys_sendmsg net/socket.c:2484 [inline] + __se_sys_sendmsg net/socket.c:2482 [inline] + __x64_sys_sendmsg+0x42/0x50 net/socket.c:2482 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +read to 0xffff8881031c8b30 of 1 bytes by task 18751 on cpu 1: + netlink_sendmsg+0x270/0x7c0 net/netlink/af_netlink.c:1891 + sock_sendmsg_nosec net/socket.c:703 [inline] + sock_sendmsg net/socket.c:723 [inline] + __sys_sendto+0x2a8/0x370 net/socket.c:2019 + __do_sys_sendto net/socket.c:2031 [inline] + __se_sys_sendto net/socket.c:2027 [inline] + __x64_sys_sendto+0x74/0x90 net/socket.c:2027 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 18751 Comm: syz-executor.0 Not tainted 5.14.0-rc1-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: da314c9923fe ("netlink: Replace rhash_portid with bound") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index acc76a738cfd..cb35680db9b2 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -585,7 +585,10 @@ static int netlink_insert(struct sock *sk, u32 portid) + + /* We need to ensure that the socket is hashed and visible. */ + smp_wmb(); +- nlk_sk(sk)->bound = portid; ++ /* Paired with lockless reads from netlink_bind(), ++ * netlink_connect() and netlink_sendmsg(). ++ */ ++ WRITE_ONCE(nlk_sk(sk)->bound, portid); + + err: + release_sock(sk); +@@ -1003,7 +1006,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, + if (nlk->ngroups < BITS_PER_LONG) + groups &= (1UL << nlk->ngroups) - 1; + +- bound = nlk->bound; ++ /* Paired with WRITE_ONCE() in netlink_insert() */ ++ bound = READ_ONCE(nlk->bound); + if (bound) { + /* Ensure nlk->portid is up-to-date. */ + smp_rmb(); +@@ -1089,8 +1093,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, + + /* No need for barriers here as we return to user-space without + * using any of the bound attributes. ++ * Paired with WRITE_ONCE() in netlink_insert(). + */ +- if (!nlk->bound) ++ if (!READ_ONCE(nlk->bound)) + err = netlink_autobind(sock); + + if (err == 0) { +@@ -1879,7 +1884,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + dst_group = nlk->dst_group; + } + +- if (!nlk->bound) { ++ /* Paired with WRITE_ONCE() in netlink_insert() */ ++ if (!READ_ONCE(nlk->bound)) { + err = netlink_autobind(sock); + if (err) + goto out; +-- +2.33.0 + diff --git a/queue-5.4/phy-mdio-fix-memory-leak.patch b/queue-5.4/phy-mdio-fix-memory-leak.patch new file mode 100644 index 00000000000..a3ee7aaf067 --- /dev/null +++ b/queue-5.4/phy-mdio-fix-memory-leak.patch @@ -0,0 +1,58 @@ +From 5fa945faceddef5b36026786aabe0912c217355f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 20:50:28 +0300 +Subject: phy: mdio: fix memory leak + +From: Pavel Skripkin + +[ Upstream commit ca6e11c337daf7925ff8a2aac8e84490a8691905 ] + +Syzbot reported memory leak in MDIO bus interface, the problem was in +wrong state logic. + +MDIOBUS_ALLOCATED indicates 2 states: + 1. Bus is only allocated + 2. Bus allocated and __mdiobus_register() fails, but + device_register() was called + +In case of device_register() has been called we should call put_device() +to correctly free the memory allocated for this device, but mdiobus_free() +calls just kfree(dev) in case of MDIOBUS_ALLOCATED state + +To avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED +_before_ calling device_register(), because put_device() should be +called even in case of device_register() failure. + +Link: https://lore.kernel.org/netdev/YVMRWNDZDUOvQjHL@shell.armlinux.org.uk/ +Fixes: 46abc02175b3 ("phylib: give mdio buses a device tree presence") +Reported-and-tested-by: syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com +Reviewed-by: Dan Carpenter +Signed-off-by: Pavel Skripkin +Link: https://lore.kernel.org/r/eceae1429fbf8fa5c73dd2a0d39d525aa905074d.1633024062.git.paskripkin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio_bus.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c +index 5bf06eac04ba..bec73f0640d0 100644 +--- a/drivers/net/phy/mdio_bus.c ++++ b/drivers/net/phy/mdio_bus.c +@@ -385,6 +385,13 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) + bus->dev.groups = NULL; + dev_set_name(&bus->dev, "%s", bus->id); + ++ /* We need to set state to MDIOBUS_UNREGISTERED to correctly release ++ * the device in mdiobus_free() ++ * ++ * State will be updated later in this function in case of success ++ */ ++ bus->state = MDIOBUS_UNREGISTERED; ++ + err = device_register(&bus->dev); + if (err) { + pr_err("mii_bus %s failed to register\n", bus->id); +-- +2.33.0 + diff --git a/queue-5.4/powerpc-fsl-dts-fix-phy-connection-type-for-fm1mac3.patch b/queue-5.4/powerpc-fsl-dts-fix-phy-connection-type-for-fm1mac3.patch new file mode 100644 index 00000000000..124cd3138c1 --- /dev/null +++ b/queue-5.4/powerpc-fsl-dts-fix-phy-connection-type-for-fm1mac3.patch @@ -0,0 +1,42 @@ +From ed88d29d1efe450de4ae947521af1470a3d4ddc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Oct 2021 11:04:09 +0200 +Subject: powerpc/fsl/dts: Fix phy-connection-type for fm1mac3 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit eed183abc0d3b8adb64fd1363b7cea7986cd58d6 ] + +Property phy-connection-type contains invalid value "sgmii-2500" per scheme +defined in file ethernet-controller.yaml. + +Correct phy-connection-type value should be "2500base-x". + +Signed-off-by: Pali Rohár +Fixes: 84e0f1c13806 ("powerpc/mpc85xx: Add MDIO bus muxing support to the board device tree(s)") +Acked-by: Scott Wood +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/fsl/t1023rdb.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/boot/dts/fsl/t1023rdb.dts b/arch/powerpc/boot/dts/fsl/t1023rdb.dts +index 5ba6fbfca274..f82f85c65964 100644 +--- a/arch/powerpc/boot/dts/fsl/t1023rdb.dts ++++ b/arch/powerpc/boot/dts/fsl/t1023rdb.dts +@@ -154,7 +154,7 @@ + + fm1mac3: ethernet@e4000 { + phy-handle = <&sgmii_aqr_phy3>; +- phy-connection-type = "sgmii-2500"; ++ phy-connection-type = "2500base-x"; + sleep = <&rcpm 0x20000000>; + }; + +-- +2.33.0 + diff --git a/queue-5.4/ptp_pch-load-module-automatically-if-id-matches.patch b/queue-5.4/ptp_pch-load-module-automatically-if-id-matches.patch new file mode 100644 index 00000000000..29d732c35f2 --- /dev/null +++ b/queue-5.4/ptp_pch-load-module-automatically-if-id-matches.patch @@ -0,0 +1,36 @@ +From f4161f4a4bcd8d229b4bd7e7165fa77707129e67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Oct 2021 19:20:33 +0300 +Subject: ptp_pch: Load module automatically if ID matches + +From: Andy Shevchenko + +[ Upstream commit 7cd8b1542a7ba0720c5a0a85ed414a122015228b ] + +The driver can't be loaded automatically because it misses +module alias to be provided. Add corresponding MODULE_DEVICE_TABLE() +call to the driver. + +Fixes: 863d08ece9bf ("supports eg20t ptp clock") +Signed-off-by: Andy Shevchenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_pch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ptp/ptp_pch.c b/drivers/ptp/ptp_pch.c +index dcd6e00c8046..a50656632df9 100644 +--- a/drivers/ptp/ptp_pch.c ++++ b/drivers/ptp/ptp_pch.c +@@ -683,6 +683,7 @@ static const struct pci_device_id pch_ieee1588_pcidev_id[] = { + }, + {0} + }; ++MODULE_DEVICE_TABLE(pci, pch_ieee1588_pcidev_id); + + static struct pci_driver pch_driver = { + .name = KBUILD_MODNAME, +-- +2.33.0 + diff --git a/queue-5.4/rtnetlink-fix-if_nlmsg_stats_size-under-estimation.patch b/queue-5.4/rtnetlink-fix-if_nlmsg_stats_size-under-estimation.patch new file mode 100644 index 00000000000..da6791bd7eb --- /dev/null +++ b/queue-5.4/rtnetlink-fix-if_nlmsg_stats_size-under-estimation.patch @@ -0,0 +1,45 @@ +From 9365141e051c43ee7c941e23b1d826b02d2dc4f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 14:04:17 -0700 +Subject: rtnetlink: fix if_nlmsg_stats_size() under estimation + +From: Eric Dumazet + +[ Upstream commit d34367991933d28bd7331f67a759be9a8c474014 ] + +rtnl_fill_statsinfo() is filling skb with one mandatory if_stats_msg structure. + +nlmsg_put(skb, pid, seq, type, sizeof(struct if_stats_msg), flags); + +But if_nlmsg_stats_size() never considered the needed storage. + +This bug did not show up because alloc_skb(X) allocates skb with +extra tailroom, because of added alignments. This could very well +be changed in the future to have deterministic behavior. + +Fixes: 10c9ead9f3c6 ("rtnetlink: add new RTM_GETSTATS message to dump link stats") +Signed-off-by: Eric Dumazet +Cc: Roopa Prabhu +Acked-by: Roopa Prabhu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 6fbc9cb09dc0..a53b101ce41a 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -4950,7 +4950,7 @@ nla_put_failure: + static size_t if_nlmsg_stats_size(const struct net_device *dev, + u32 filter_mask) + { +- size_t size = 0; ++ size_t size = NLMSG_ALIGN(sizeof(struct if_stats_msg)); + + if (stats_attr_valid(filter_mask, IFLA_STATS_LINK_64, 0)) + size += nla_total_size_64bit(sizeof(struct rtnl_link_stats64)); +-- +2.33.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 146ac9c57cd..d989b0b269f 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -12,3 +12,34 @@ arm-dts-omap3430-sdp-fix-nand-device-node.patch arm-dts-qcom-apq8064-use-compatible-which-contains-chipid.patch mips-bpf-restore-mips32-cbpf-jit.patch bpf-mips-validate-conditional-branch-offsets.patch +soc-qcom-socinfo-fixed-argument-passed-to-platform_s.patch +arm-dts-qcom-apq8064-use-27mhz-pxo-clock-as-dsi-pll-.patch +soc-qcom-mdt_loader-drop-pt_load-check-on-hash-segme.patch +arm-dts-imx-add-missing-pinctrl-names-for-panel-on-m.patch +arm-dts-imx-fix-usb-host-power-regulator-polarity-on.patch +arm64-dts-qcom-pm8150-use-qcom-pm8998-pon-binding.patch +xtensa-move-xchal_kio_-definitions-to-kmem_layout.h.patch +xtensa-use-config_use_of-instead-of-config_of.patch +xtensa-call-irqchip_init-only-when-config_use_of-is-.patch +bpf-arm-fix-register-clobbering-in-div-mod-implement.patch +bpf-fix-integer-overflow-in-prealloc_elems_and_freel.patch +phy-mdio-fix-memory-leak.patch +net_sched-fix-null-deref-in-fifo_set_limit.patch +powerpc-fsl-dts-fix-phy-connection-type-for-fm1mac3.patch +ptp_pch-load-module-automatically-if-id-matches.patch +arm64-dts-freescale-fix-sp805-clock-names.patch +arm64-dts-ls1028a-add-missing-can-nodes.patch +arm-imx6-disable-the-gic-cpu-interface-before-callin.patch +net-bridge-use-nla_total_size_64bit-in-br_get_linkxs.patch +net-sched-sch_taprio-properly-cancel-timer-from-tapr.patch +net-sfp-fix-typo-in-state-machine-debug-string.patch +netlink-annotate-data-races-around-nlk-bound.patch +bus-ti-sysc-use-clkdm_noauto-for-dra7-dcan1-for-erra.patch +video-fbdev-gbefb-only-instantiate-device-when-built.patch +drm-nouveau-debugfs-fix-file-release-memory-leak.patch +gve-correct-available-tx-qpl-check.patch +rtnetlink-fix-if_nlmsg_stats_size-under-estimation.patch +gve-fix-gve_get_stats.patch +i40e-fix-endless-loop-under-rtnl.patch +i40e-fix-freeing-of-uninitialized-misc-irq-vector.patch +net-prefer-socket-bound-to-interface-when-not-in-vrf.patch diff --git a/queue-5.4/soc-qcom-mdt_loader-drop-pt_load-check-on-hash-segme.patch b/queue-5.4/soc-qcom-mdt_loader-drop-pt_load-check-on-hash-segme.patch new file mode 100644 index 00000000000..7a827069a7d --- /dev/null +++ b/queue-5.4/soc-qcom-mdt_loader-drop-pt_load-check-on-hash-segme.patch @@ -0,0 +1,51 @@ +From a855318bc107f3af0394c5af6c33e847ad81f344 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Aug 2021 15:02:02 +0800 +Subject: soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment + +From: Shawn Guo + +[ Upstream commit 833d51d7c66d6708abbc02398892b96b950167b9 ] + +PT_LOAD type denotes that the segment should be loaded into the final +firmware memory region. Hash segment is not one such, because it's only +needed for PAS init and shouldn't be in the final firmware memory region. +That's why mdt_phdr_valid() explicitly reject non PT_LOAD segment and +hash segment. This actually makes the hash segment type check in +qcom_mdt_read_metadata() unnecessary and redundant. For a hash segment, +it won't be loaded into firmware memory region anyway, due to the +QCOM_MDT_TYPE_HASH check in mdt_phdr_valid(), even if it has a PT_LOAD +type for some reason (misusing or abusing?). + +Some firmware files on Sony phones are such examples, e.g WCNSS firmware +of Sony Xperia M4 Aqua phone. The type of hash segment is just PT_LOAD. +Drop the unnecessary hash segment type check in qcom_mdt_read_metadata() +to fix firmware loading failure on these phones, while hash segment is +still kept away from the final firmware memory region. + +Fixes: 498b98e93900 ("soc: qcom: mdt_loader: Support loading non-split images") +Signed-off-by: Shawn Guo +Reviewed-by: Marijn Suijten +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210828070202.7033-1-shawn.guo@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/mdt_loader.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c +index eba7f76f9d61..6034cd8992b0 100644 +--- a/drivers/soc/qcom/mdt_loader.c ++++ b/drivers/soc/qcom/mdt_loader.c +@@ -98,7 +98,7 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len) + if (ehdr->e_phnum < 2) + return ERR_PTR(-EINVAL); + +- if (phdrs[0].p_type == PT_LOAD || phdrs[1].p_type == PT_LOAD) ++ if (phdrs[0].p_type == PT_LOAD) + return ERR_PTR(-EINVAL); + + if ((phdrs[1].p_flags & QCOM_MDT_TYPE_MASK) != QCOM_MDT_TYPE_HASH) +-- +2.33.0 + diff --git a/queue-5.4/soc-qcom-socinfo-fixed-argument-passed-to-platform_s.patch b/queue-5.4/soc-qcom-socinfo-fixed-argument-passed-to-platform_s.patch new file mode 100644 index 00000000000..4b711520f0f --- /dev/null +++ b/queue-5.4/soc-qcom-socinfo-fixed-argument-passed-to-platform_s.patch @@ -0,0 +1,39 @@ +From 8d695be2f45b3c105878f109887db0970a84a805 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 17:24:39 -0700 +Subject: soc: qcom: socinfo: Fixed argument passed to platform_set_data() + +From: Antonio Martorana + +[ Upstream commit 9c5a4ec69bbf5951f84ada9e0db9c6c50de61808 ] + +Set qcom_socinfo pointer as data being stored instead of pointer +to soc_device structure. Aligns with future calls to platform_get_data() +which expects qcom_socinfo pointer. + +Fixes: efb448d0a3fc ("soc: qcom: Add socinfo driver") +Signed-off-by: Antonio Martorana +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1629159879-95777-1-git-send-email-amartora@codeaurora.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/socinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c +index 176696f8f38d..3303bcaf6715 100644 +--- a/drivers/soc/qcom/socinfo.c ++++ b/drivers/soc/qcom/socinfo.c +@@ -447,7 +447,7 @@ static int qcom_socinfo_probe(struct platform_device *pdev) + /* Feed the soc specific unique data into entropy pool */ + add_device_randomness(info, item_size); + +- platform_set_drvdata(pdev, qs->soc_dev); ++ platform_set_drvdata(pdev, qs); + + return 0; + } +-- +2.33.0 + diff --git a/queue-5.4/video-fbdev-gbefb-only-instantiate-device-when-built.patch b/queue-5.4/video-fbdev-gbefb-only-instantiate-device-when-built.patch new file mode 100644 index 00000000000..2fce81bf64e --- /dev/null +++ b/queue-5.4/video-fbdev-gbefb-only-instantiate-device-when-built.patch @@ -0,0 +1,44 @@ +From 7653d601e62b85ccd969f2c3ac0c9e0f7e35a93c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 22:21:02 +0100 +Subject: video: fbdev: gbefb: Only instantiate device when built for IP32 + +From: Mark Brown + +[ Upstream commit 11b8e2bb986d23157e82e267fb8cc6b281dfdee9 ] + +The gbefb driver not only registers a driver but also the device for that +driver. This is all well and good when run on the IP32 machines that are +supported by the driver but since the driver supports building with +COMPILE_TEST we might also be building on other platforms which do not have +this hardware and will crash instantiating the driver. Add an IS_ENABLED() +check so we compile out the device registration if we don't have the Kconfig +option for the machine enabled. + +Fixes: 552ccf6b259d290c0c ("video: fbdev: gbefb: add COMPILE_TEST support") +Signed-off-by: Mark Brown +Cc: Bartlomiej Zolnierkiewicz +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20210921212102.30803-1-broonie@kernel.org +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/gbefb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/gbefb.c b/drivers/video/fbdev/gbefb.c +index b9f6a82a0495..6fdc6ab3ceb8 100644 +--- a/drivers/video/fbdev/gbefb.c ++++ b/drivers/video/fbdev/gbefb.c +@@ -1269,7 +1269,7 @@ static struct platform_device *gbefb_device; + static int __init gbefb_init(void) + { + int ret = platform_driver_register(&gbefb_driver); +- if (!ret) { ++ if (IS_ENABLED(CONFIG_SGI_IP32) && !ret) { + gbefb_device = platform_device_alloc("gbefb", 0); + if (gbefb_device) { + ret = platform_device_add(gbefb_device); +-- +2.33.0 + diff --git a/queue-5.4/xtensa-call-irqchip_init-only-when-config_use_of-is-.patch b/queue-5.4/xtensa-call-irqchip_init-only-when-config_use_of-is-.patch new file mode 100644 index 00000000000..4ce4ce65fe0 --- /dev/null +++ b/queue-5.4/xtensa-call-irqchip_init-only-when-config_use_of-is-.patch @@ -0,0 +1,65 @@ +From eff5ae9cabc90f78036428b9d70f672b495fcddd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Sep 2021 09:46:33 -0700 +Subject: xtensa: call irqchip_init only when CONFIG_USE_OF is selected + +From: Max Filippov + +[ Upstream commit 6489f8d0e1d93a3603d8dad8125797559e4cf2a2 ] + +During boot time kernel configured with OF=y but USE_OF=n displays the +following warnings and hangs shortly after starting userspace: + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 0 at kernel/irq/irqdomain.c:695 irq_create_mapping_affinity+0x29/0xc0 +irq_create_mapping_affinity(, 6) called with NULL domain +CPU: 0 PID: 0 Comm: swapper Not tainted 5.15.0-rc3-00001-gd67ed2510d28 #30 +Call Trace: + __warn+0x69/0xc4 + warn_slowpath_fmt+0x6c/0x94 + irq_create_mapping_affinity+0x29/0xc0 + local_timer_setup+0x40/0x88 + time_init+0xb1/0xe8 + start_kernel+0x31d/0x3f4 + _startup+0x13b/0x13b +---[ end trace 1e6630e1c5eda35b ]--- +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 0 at arch/xtensa/kernel/time.c:141 local_timer_setup+0x58/0x88 +error: can't map timer irq +CPU: 0 PID: 0 Comm: swapper Tainted: G W 5.15.0-rc3-00001-gd67ed2510d28 #30 +Call Trace: + __warn+0x69/0xc4 + warn_slowpath_fmt+0x6c/0x94 + local_timer_setup+0x58/0x88 + time_init+0xb1/0xe8 + start_kernel+0x31d/0x3f4 + _startup+0x13b/0x13b +---[ end trace 1e6630e1c5eda35c ]--- +Failed to request irq 0 (timer) + +Fix that by calling irqchip_init only when CONFIG_USE_OF is selected and +calling legacy interrupt controller init otherwise. + +Fixes: da844a81779e ("xtensa: add device trees support") +Signed-off-by: Max Filippov +Signed-off-by: Sasha Levin +--- + arch/xtensa/kernel/irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c +index a48bf2d10ac2..80cc9770a8d2 100644 +--- a/arch/xtensa/kernel/irq.c ++++ b/arch/xtensa/kernel/irq.c +@@ -145,7 +145,7 @@ unsigned xtensa_get_ext_irq_no(unsigned irq) + + void __init init_IRQ(void) + { +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + irqchip_init(); + #else + #ifdef CONFIG_HAVE_SMP +-- +2.33.0 + diff --git a/queue-5.4/xtensa-move-xchal_kio_-definitions-to-kmem_layout.h.patch b/queue-5.4/xtensa-move-xchal_kio_-definitions-to-kmem_layout.h.patch new file mode 100644 index 00000000000..e8b563a818d --- /dev/null +++ b/queue-5.4/xtensa-move-xchal_kio_-definitions-to-kmem_layout.h.patch @@ -0,0 +1,127 @@ +From 8a603c2405df61b224baf043aa78358509341ec4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Sep 2019 21:28:47 -0700 +Subject: xtensa: move XCHAL_KIO_* definitions to kmem_layout.h + +From: Max Filippov + +[ Upstream commit 6591685d50043f615a1ad7ddd5bb263ef54808fc ] + +These address and size definitions define xtensa kernel memory layout, +move them from vectors.h to the kmem_layout.h + +Signed-off-by: Max Filippov +Signed-off-by: Sasha Levin +--- + arch/xtensa/include/asm/kmem_layout.h | 29 ++++++++++++++++++ + arch/xtensa/include/asm/vectors.h | 42 ++------------------------- + 2 files changed, 32 insertions(+), 39 deletions(-) + +diff --git a/arch/xtensa/include/asm/kmem_layout.h b/arch/xtensa/include/asm/kmem_layout.h +index 9c12babc016c..7cbf68ca7106 100644 +--- a/arch/xtensa/include/asm/kmem_layout.h ++++ b/arch/xtensa/include/asm/kmem_layout.h +@@ -11,6 +11,7 @@ + #ifndef _XTENSA_KMEM_LAYOUT_H + #define _XTENSA_KMEM_LAYOUT_H + ++#include + #include + + #ifdef CONFIG_MMU +@@ -65,6 +66,34 @@ + + #endif + ++/* KIO definition */ ++ ++#if XCHAL_HAVE_PTP_MMU ++#define XCHAL_KIO_CACHED_VADDR 0xe0000000 ++#define XCHAL_KIO_BYPASS_VADDR 0xf0000000 ++#define XCHAL_KIO_DEFAULT_PADDR 0xf0000000 ++#else ++#define XCHAL_KIO_BYPASS_VADDR XCHAL_KIO_PADDR ++#define XCHAL_KIO_DEFAULT_PADDR 0x90000000 ++#endif ++#define XCHAL_KIO_SIZE 0x10000000 ++ ++#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_OF) ++#define XCHAL_KIO_PADDR xtensa_get_kio_paddr() ++#ifndef __ASSEMBLY__ ++extern unsigned long xtensa_kio_paddr; ++ ++static inline unsigned long xtensa_get_kio_paddr(void) ++{ ++ return xtensa_kio_paddr; ++} ++#endif ++#else ++#define XCHAL_KIO_PADDR XCHAL_KIO_DEFAULT_PADDR ++#endif ++ ++/* KERNEL_STACK definition */ ++ + #ifndef CONFIG_KASAN + #define KERNEL_STACK_SHIFT 13 + #else +diff --git a/arch/xtensa/include/asm/vectors.h b/arch/xtensa/include/asm/vectors.h +index 79fe3007919e..4220c6dac44f 100644 +--- a/arch/xtensa/include/asm/vectors.h ++++ b/arch/xtensa/include/asm/vectors.h +@@ -21,50 +21,14 @@ + #include + #include + +-#if XCHAL_HAVE_PTP_MMU +-#define XCHAL_KIO_CACHED_VADDR 0xe0000000 +-#define XCHAL_KIO_BYPASS_VADDR 0xf0000000 +-#define XCHAL_KIO_DEFAULT_PADDR 0xf0000000 +-#else +-#define XCHAL_KIO_BYPASS_VADDR XCHAL_KIO_PADDR +-#define XCHAL_KIO_DEFAULT_PADDR 0x90000000 +-#endif +-#define XCHAL_KIO_SIZE 0x10000000 +- +-#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_OF) +-#define XCHAL_KIO_PADDR xtensa_get_kio_paddr() +-#ifndef __ASSEMBLY__ +-extern unsigned long xtensa_kio_paddr; +- +-static inline unsigned long xtensa_get_kio_paddr(void) +-{ +- return xtensa_kio_paddr; +-} +-#endif +-#else +-#define XCHAL_KIO_PADDR XCHAL_KIO_DEFAULT_PADDR +-#endif +- +-#if defined(CONFIG_MMU) +- +-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY +-/* Image Virtual Start Address */ +-#define KERNELOFFSET (XCHAL_KSEG_CACHED_VADDR + \ +- CONFIG_KERNEL_LOAD_ADDRESS - \ ++#if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY ++#define KERNELOFFSET (CONFIG_KERNEL_LOAD_ADDRESS + \ ++ XCHAL_KSEG_CACHED_VADDR - \ + XCHAL_KSEG_PADDR) + #else + #define KERNELOFFSET CONFIG_KERNEL_LOAD_ADDRESS + #endif + +-#else /* !defined(CONFIG_MMU) */ +- /* MMU Not being used - Virtual == Physical */ +- +-/* Location of the start of the kernel text, _start */ +-#define KERNELOFFSET CONFIG_KERNEL_LOAD_ADDRESS +- +- +-#endif /* CONFIG_MMU */ +- + #define RESET_VECTOR1_VADDR (XCHAL_RESET_VECTOR1_VADDR) + #ifdef CONFIG_VECTORS_OFFSET + #define VECBASE_VADDR (KERNELOFFSET - CONFIG_VECTORS_OFFSET) +-- +2.33.0 + diff --git a/queue-5.4/xtensa-use-config_use_of-instead-of-config_of.patch b/queue-5.4/xtensa-use-config_use_of-instead-of-config_of.patch new file mode 100644 index 00000000000..ac8ae70d6dd --- /dev/null +++ b/queue-5.4/xtensa-use-config_use_of-instead-of-config_of.patch @@ -0,0 +1,136 @@ +From c4b9aecdbc215bc69b4499074794b1581557aa5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 20:29:51 -0700 +Subject: xtensa: use CONFIG_USE_OF instead of CONFIG_OF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit d67ed2510d28a1eb33171010d35cf52178cfcbdd ] + +CONFIG_OF can be set by a randconfig or by a user -- without setting the +early flattree option (OF_EARLY_FLATTREE). This causes build errors. +However, if randconfig or a user sets USE_OF in the Xtensa config, +the right kconfig symbols are set to fix the build. + +Fixes these build errors: + +../arch/xtensa/kernel/setup.c:67:19: error: ‘__dtb_start’ undeclared here (not in a function); did you mean ‘dtb_start’? + 67 | void *dtb_start = __dtb_start; + | ^~~~~~~~~~~ +../arch/xtensa/kernel/setup.c: In function 'xtensa_dt_io_area': +../arch/xtensa/kernel/setup.c:201:14: error: implicit declaration of function 'of_flat_dt_is_compatible'; did you mean 'of_machine_is_compatible'? [-Werror=implicit-function-declaration] + 201 | if (!of_flat_dt_is_compatible(node, "simple-bus")) +../arch/xtensa/kernel/setup.c:204:18: error: implicit declaration of function 'of_get_flat_dt_prop' [-Werror=implicit-function-declaration] + 204 | ranges = of_get_flat_dt_prop(node, "ranges", &len); +../arch/xtensa/kernel/setup.c:204:16: error: assignment to 'const __be32 *' {aka 'const unsigned int *'} from 'int' makes pointer from integer without a cast [-Werror=int-conversion] + 204 | ranges = of_get_flat_dt_prop(node, "ranges", &len); + | ^ +../arch/xtensa/kernel/setup.c: In function 'early_init_devtree': +../arch/xtensa/kernel/setup.c:228:9: error: implicit declaration of function 'early_init_dt_scan'; did you mean 'early_init_devtree'? [-Werror=implicit-function-declaration] + 228 | early_init_dt_scan(params); +../arch/xtensa/kernel/setup.c:229:9: error: implicit declaration of function 'of_scan_flat_dt' [-Werror=implicit-function-declaration] + 229 | of_scan_flat_dt(xtensa_dt_io_area, NULL); + +xtensa-elf-ld: arch/xtensa/mm/mmu.o:(.text+0x0): undefined reference to `xtensa_kio_paddr' + +Fixes: da844a81779e ("xtensa: add device trees support") +Fixes: 6cb971114f63 ("xtensa: remap io area defined in device tree") +Signed-off-by: Randy Dunlap +Signed-off-by: Max Filippov +Signed-off-by: Sasha Levin +--- + arch/xtensa/include/asm/kmem_layout.h | 2 +- + arch/xtensa/kernel/setup.c | 12 ++++++------ + arch/xtensa/mm/mmu.c | 2 +- + 3 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/xtensa/include/asm/kmem_layout.h b/arch/xtensa/include/asm/kmem_layout.h +index 7cbf68ca7106..6fc05cba61a2 100644 +--- a/arch/xtensa/include/asm/kmem_layout.h ++++ b/arch/xtensa/include/asm/kmem_layout.h +@@ -78,7 +78,7 @@ + #endif + #define XCHAL_KIO_SIZE 0x10000000 + +-#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_OF) ++#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_USE_OF) + #define XCHAL_KIO_PADDR xtensa_get_kio_paddr() + #ifndef __ASSEMBLY__ + extern unsigned long xtensa_kio_paddr; +diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c +index d08172138369..5a25bc2b8052 100644 +--- a/arch/xtensa/kernel/setup.c ++++ b/arch/xtensa/kernel/setup.c +@@ -64,7 +64,7 @@ extern unsigned long initrd_end; + extern int initrd_below_start_ok; + #endif + +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + void *dtb_start = __dtb_start; + #endif + +@@ -126,7 +126,7 @@ __tagtable(BP_TAG_INITRD, parse_tag_initrd); + + #endif /* CONFIG_BLK_DEV_INITRD */ + +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + + static int __init parse_tag_fdt(const bp_tag_t *tag) + { +@@ -136,7 +136,7 @@ static int __init parse_tag_fdt(const bp_tag_t *tag) + + __tagtable(BP_TAG_FDT, parse_tag_fdt); + +-#endif /* CONFIG_OF */ ++#endif /* CONFIG_USE_OF */ + + static int __init parse_tag_cmdline(const bp_tag_t* tag) + { +@@ -184,7 +184,7 @@ static int __init parse_bootparam(const bp_tag_t *tag) + } + #endif + +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + + #if !XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY + unsigned long xtensa_kio_paddr = XCHAL_KIO_DEFAULT_PADDR; +@@ -233,7 +233,7 @@ void __init early_init_devtree(void *params) + strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE); + } + +-#endif /* CONFIG_OF */ ++#endif /* CONFIG_USE_OF */ + + /* + * Initialize architecture. (Early stage) +@@ -254,7 +254,7 @@ void __init init_arch(bp_tag_t *bp_start) + if (bp_start) + parse_bootparam(bp_start); + +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + early_init_devtree(dtb_start); + #endif + +diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c +index 03678c4afc39..bc858a7f98ba 100644 +--- a/arch/xtensa/mm/mmu.c ++++ b/arch/xtensa/mm/mmu.c +@@ -101,7 +101,7 @@ void init_mmu(void) + + void init_kio(void) + { +-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF) ++#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_USE_OF) + /* + * Update the IO area mapping in case xtensa_kio_paddr has changed + */ +-- +2.33.0 +