From: Sasha Levin Date: Mon, 16 Nov 2020 13:58:15 +0000 (-0500) Subject: Fixes for 5.9 X-Git-Tag: v4.4.244~57 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3429e04d9134064c3f1097159b2774c73fe2b22d;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.9 Signed-off-by: Sasha Levin --- diff --git a/queue-5.9/afs-fix-afs_write_end-when-called-with-copied-0-ver-.patch b/queue-5.9/afs-fix-afs_write_end-when-called-with-copied-0-ver-.patch new file mode 100644 index 00000000000..a2d6bf549fe --- /dev/null +++ b/queue-5.9/afs-fix-afs_write_end-when-called-with-copied-0-ver-.patch @@ -0,0 +1,51 @@ +From 6fee2d43069003d5b44626a343ac931f6e45b8a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 17:27:57 +0000 +Subject: afs: Fix afs_write_end() when called with copied == 0 [ver #3] + +From: David Howells + +[ Upstream commit 3ad216ee73abc554ed8f13f4f8b70845a7bef6da ] + +When afs_write_end() is called with copied == 0, it tries to set the +dirty region, but there's no way to actually encode a 0-length region in +the encoding in page->private. + +"0,0", for example, indicates a 1-byte region at offset 0. The maths +miscalculates this and sets it incorrectly. + +Fix it to just do nothing but unlock and put the page in this case. We +don't actually need to mark the page dirty as nothing presumably +changed. + +Fixes: 65dd2d6072d3 ("afs: Alter dirty range encoding in page->private") +Signed-off-by: David Howells +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/write.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/afs/write.c b/fs/afs/write.c +index 50371207f3273..c9195fc67fd8f 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -169,11 +169,14 @@ int afs_write_end(struct file *file, struct address_space *mapping, + unsigned int f, from = pos & (PAGE_SIZE - 1); + unsigned int t, to = from + copied; + loff_t i_size, maybe_i_size; +- int ret; ++ int ret = 0; + + _enter("{%llx:%llu},{%lx}", + vnode->fid.vid, vnode->fid.vnode, page->index); + ++ if (copied == 0) ++ goto out; ++ + maybe_i_size = pos + copied; + + i_size = i_size_read(&vnode->vfs_inode); +-- +2.27.0 + diff --git a/queue-5.9/arm-9019-1-kprobes-avoid-fortify_panic-when-copying-.patch b/queue-5.9/arm-9019-1-kprobes-avoid-fortify_panic-when-copying-.patch new file mode 100644 index 00000000000..e78956b509c --- /dev/null +++ b/queue-5.9/arm-9019-1-kprobes-avoid-fortify_panic-when-copying-.patch @@ -0,0 +1,228 @@ +From 0d3cd3a520be6008f9ed6865990b33511a13131a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 01:43:59 +0100 +Subject: ARM: 9019/1: kprobes: Avoid fortify_panic() when copying optprobe + template + +From: Andrew Jeffery + +[ Upstream commit 9fa2e7af3d53a4b769136eccc32c02e128a4ee51 ] + +Setting both CONFIG_KPROBES=y and CONFIG_FORTIFY_SOURCE=y on ARM leads +to a panic in memcpy() when injecting a kprobe despite the fixes found +in commit e46daee53bb5 ("ARM: 8806/1: kprobes: Fix false positive with +FORTIFY_SOURCE") and commit 0ac569bf6a79 ("ARM: 8834/1: Fix: kprobes: +optimized kprobes illegal instruction"). + +arch/arm/include/asm/kprobes.h effectively declares +the target type of the optprobe_template_entry assembly label as a u32 +which leads memcpy()'s __builtin_object_size() call to determine that +the pointed-to object is of size four. However, the symbol is used as a handle +for the optimised probe assembly template that is at least 96 bytes in size. +The symbol's use despite its type blows up the memcpy() in ARM's +arch_prepare_optimized_kprobe() with a false-positive fortify_panic() when it +should instead copy the optimised probe template into place: + +``` +$ sudo perf probe -a aspeed_g6_pinctrl_probe +[ 158.457252] detected buffer overflow in memcpy +[ 158.458069] ------------[ cut here ]------------ +[ 158.458283] kernel BUG at lib/string.c:1153! +[ 158.458436] Internal error: Oops - BUG: 0 [#1] SMP ARM +[ 158.458768] Modules linked in: +[ 158.459043] CPU: 1 PID: 99 Comm: perf Not tainted 5.9.0-rc7-00038-gc53ebf8167e9 #158 +[ 158.459296] Hardware name: Generic DT based system +[ 158.459529] PC is at fortify_panic+0x18/0x20 +[ 158.459658] LR is at __irq_work_queue_local+0x3c/0x74 +[ 158.459831] pc : [<8047451c>] lr : [<8020ecd4>] psr: 60000013 +[ 158.460032] sp : be2d1d50 ip : be2d1c58 fp : be2d1d5c +[ 158.460174] r10: 00000006 r9 : 00000000 r8 : 00000060 +[ 158.460348] r7 : 8011e434 r6 : b9e0b800 r5 : 7f000000 r4 : b9fe4f0c +[ 158.460557] r3 : 80c04cc8 r2 : 00000000 r1 : be7c03cc r0 : 00000022 +[ 158.460801] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none +[ 158.461037] Control: 10c5387d Table: b9cd806a DAC: 00000051 +[ 158.461251] Process perf (pid: 99, stack limit = 0x81c71a69) +[ 158.461472] Stack: (0xbe2d1d50 to 0xbe2d2000) +[ 158.461757] 1d40: be2d1d84 be2d1d60 8011e724 80474510 +[ 158.462104] 1d60: b9e0b800 b9fe4f0c 00000000 b9fe4f14 80c8ec80 be235000 be2d1d9c be2d1d88 +[ 158.462436] 1d80: 801cee44 8011e57c b9fe4f0c 00000000 be2d1dc4 be2d1da0 801d0ad0 801cedec +[ 158.462742] 1da0: 00000000 00000000 b9fe4f00 ffffffea 00000000 be235000 be2d1de4 be2d1dc8 +[ 158.463087] 1dc0: 80204604 801d0738 00000000 00000000 b9fe4004 ffffffea be2d1e94 be2d1de8 +[ 158.463428] 1de0: 80205434 80204570 00385c00 00000000 00000000 00000000 be2d1e14 be2d1e08 +[ 158.463880] 1e00: 802ba014 b9fe4f00 b9e718c0 b9fe4f84 b9e71ec8 be2d1e24 00000000 00385c00 +[ 158.464365] 1e20: 00000000 626f7270 00000065 802b905c be2d1e94 0000002e 00000000 802b9914 +[ 158.464829] 1e40: be2d1e84 be2d1e50 802b9914 8028ff78 804629d0 b9e71ec0 0000002e b9e71ec0 +[ 158.465141] 1e60: be2d1ea8 80c04cc8 00000cc0 b9e713c4 00000002 80205834 80205834 0000002e +[ 158.465488] 1e80: be235000 be235000 be2d1ea4 be2d1e98 80205854 80204e94 be2d1ecc be2d1ea8 +[ 158.465806] 1ea0: 801ee4a0 80205840 00000002 80c04cc8 00000000 0000002e 0000002e 00000000 +[ 158.466110] 1ec0: be2d1f0c be2d1ed0 801ee5c8 801ee428 00000000 be2d0000 006b1fd0 00000051 +[ 158.466398] 1ee0: 00000000 b9eedf00 0000002e 80204410 006b1fd0 be2d1f60 00000000 00000004 +[ 158.466763] 1f00: be2d1f24 be2d1f10 8020442c 801ee4c4 80205834 802c613c be2d1f5c be2d1f28 +[ 158.467102] 1f20: 802c60ac 8020441c be2d1fac be2d1f38 8010c764 802e9888 be2d1f5c b9eedf00 +[ 158.467447] 1f40: b9eedf00 006b1fd0 0000002e 00000000 be2d1f94 be2d1f60 802c634c 802c5fec +[ 158.467812] 1f60: 00000000 00000000 00000000 80c04cc8 006b1fd0 00000003 76f7a610 00000004 +[ 158.468155] 1f80: 80100284 be2d0000 be2d1fa4 be2d1f98 802c63ec 802c62e8 00000000 be2d1fa8 +[ 158.468508] 1fa0: 80100080 802c63e0 006b1fd0 00000003 00000003 006b1fd0 0000002e 00000000 +[ 158.468858] 1fc0: 006b1fd0 00000003 76f7a610 00000004 006b1fb0 0026d348 00000017 7ef2738c +[ 158.469202] 1fe0: 76f3431c 7ef272d8 0014ec50 76f34338 60000010 00000003 00000000 00000000 +[ 158.469461] Backtrace: +[ 158.469683] [<80474504>] (fortify_panic) from [<8011e724>] (arch_prepare_optimized_kprobe+0x1b4/0x1f8) +[ 158.470021] [<8011e570>] (arch_prepare_optimized_kprobe) from [<801cee44>] (alloc_aggr_kprobe+0x64/0x70) +[ 158.470287] r9:be235000 r8:80c8ec80 r7:b9fe4f14 r6:00000000 r5:b9fe4f0c r4:b9e0b800 +[ 158.470478] [<801cede0>] (alloc_aggr_kprobe) from [<801d0ad0>] (register_kprobe+0x3a4/0x5a0) +[ 158.470685] r5:00000000 r4:b9fe4f0c +[ 158.470790] [<801d072c>] (register_kprobe) from [<80204604>] (__register_trace_kprobe+0xa0/0xa4) +[ 158.471001] r9:be235000 r8:00000000 r7:ffffffea r6:b9fe4f00 r5:00000000 r4:00000000 +[ 158.471188] [<80204564>] (__register_trace_kprobe) from [<80205434>] (trace_kprobe_create+0x5ac/0x9ac) +[ 158.471408] r7:ffffffea r6:b9fe4004 r5:00000000 r4:00000000 +[ 158.471553] [<80204e88>] (trace_kprobe_create) from [<80205854>] (create_or_delete_trace_kprobe+0x20/0x3c) +[ 158.471766] r10:be235000 r9:be235000 r8:0000002e r7:80205834 r6:80205834 r5:00000002 +[ 158.471949] r4:b9e713c4 +[ 158.472027] [<80205834>] (create_or_delete_trace_kprobe) from [<801ee4a0>] (trace_run_command+0x84/0x9c) +[ 158.472255] [<801ee41c>] (trace_run_command) from [<801ee5c8>] (trace_parse_run_command+0x110/0x1f8) +[ 158.472471] r6:00000000 r5:0000002e r4:0000002e +[ 158.472594] [<801ee4b8>] (trace_parse_run_command) from [<8020442c>] (probes_write+0x1c/0x28) +[ 158.472800] r10:00000004 r9:00000000 r8:be2d1f60 r7:006b1fd0 r6:80204410 r5:0000002e +[ 158.472968] r4:b9eedf00 +[ 158.473046] [<80204410>] (probes_write) from [<802c60ac>] (vfs_write+0xcc/0x1e8) +[ 158.473226] [<802c5fe0>] (vfs_write) from [<802c634c>] (ksys_write+0x70/0xf8) +[ 158.473400] r8:00000000 r7:0000002e r6:006b1fd0 r5:b9eedf00 r4:b9eedf00 +[ 158.473567] [<802c62dc>] (ksys_write) from [<802c63ec>] (sys_write+0x18/0x1c) +[ 158.473745] r9:be2d0000 r8:80100284 r7:00000004 r6:76f7a610 r5:00000003 r4:006b1fd0 +[ 158.473932] [<802c63d4>] (sys_write) from [<80100080>] (ret_fast_syscall+0x0/0x54) +[ 158.474126] Exception stack(0xbe2d1fa8 to 0xbe2d1ff0) +[ 158.474305] 1fa0: 006b1fd0 00000003 00000003 006b1fd0 0000002e 00000000 +[ 158.474573] 1fc0: 006b1fd0 00000003 76f7a610 00000004 006b1fb0 0026d348 00000017 7ef2738c +[ 158.474811] 1fe0: 76f3431c 7ef272d8 0014ec50 76f34338 +[ 158.475171] Code: e24cb004 e1a01000 e59f0004 ebf40dd3 (e7f001f2) +[ 158.475847] ---[ end trace 55a5b31c08a29f00 ]--- +[ 158.476088] Kernel panic - not syncing: Fatal exception +[ 158.476375] CPU0: stopping +[ 158.476709] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G D 5.9.0-rc7-00038-gc53ebf8167e9 #158 +[ 158.477176] Hardware name: Generic DT based system +[ 158.477411] Backtrace: +[ 158.477604] [<8010dd28>] (dump_backtrace) from [<8010dfd4>] (show_stack+0x20/0x24) +[ 158.477990] r7:00000000 r6:60000193 r5:00000000 r4:80c2f634 +[ 158.478323] [<8010dfb4>] (show_stack) from [<8046390c>] (dump_stack+0xcc/0xe8) +[ 158.478686] [<80463840>] (dump_stack) from [<80110750>] (handle_IPI+0x334/0x3a0) +[ 158.479063] r7:00000000 r6:00000004 r5:80b65cc8 r4:80c78278 +[ 158.479352] [<8011041c>] (handle_IPI) from [<801013f8>] (gic_handle_irq+0x88/0x94) +[ 158.479757] r10:10c5387d r9:80c01ed8 r8:00000000 r7:c0802000 r6:80c0537c r5:000003ff +[ 158.480146] r4:c080200c r3:fffffff4 +[ 158.480364] [<80101370>] (gic_handle_irq) from [<80100b6c>] (__irq_svc+0x6c/0x90) +[ 158.480748] Exception stack(0x80c01ed8 to 0x80c01f20) +[ 158.481031] 1ec0: 000128bc 00000000 +[ 158.481499] 1ee0: be7b8174 8011d3a0 80c00000 00000000 80c04cec 80c04d28 80c5d7c2 80a026d4 +[ 158.482091] 1f00: 10c5387d 80c01f34 80c01f38 80c01f28 80109554 80109558 60000013 ffffffff +[ 158.482621] r9:80c00000 r8:80c5d7c2 r7:80c01f0c r6:ffffffff r5:60000013 r4:80109558 +[ 158.482983] [<80109518>] (arch_cpu_idle) from [<80818780>] (default_idle_call+0x38/0x120) +[ 158.483360] [<80818748>] (default_idle_call) from [<801585a8>] (do_idle+0xd4/0x158) +[ 158.483945] r5:00000000 r4:80c00000 +[ 158.484237] [<801584d4>] (do_idle) from [<801588f4>] (cpu_startup_entry+0x28/0x2c) +[ 158.484784] r9:80c78000 r8:00000000 r7:80c78000 r6:80c78040 r5:80c04cc0 r4:000000d6 +[ 158.485328] [<801588cc>] (cpu_startup_entry) from [<80810a78>] (rest_init+0x9c/0xbc) +[ 158.485930] [<808109dc>] (rest_init) from [<80b00ae4>] (arch_call_rest_init+0x18/0x1c) +[ 158.486503] r5:80c04cc0 r4:00000001 +[ 158.486857] [<80b00acc>] (arch_call_rest_init) from [<80b00fcc>] (start_kernel+0x46c/0x548) +[ 158.487589] [<80b00b60>] (start_kernel) from [<00000000>] (0x0) +``` + +Fixes: e46daee53bb5 ("ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE") +Fixes: 0ac569bf6a79 ("ARM: 8834/1: Fix: kprobes: optimized kprobes illegal instruction") +Suggested-by: Kees Cook +Signed-off-by: Andrew Jeffery +Tested-by: Luka Oreskovic +Tested-by: Joel Stanley +Reviewed-by: Joel Stanley +Acked-by: Masami Hiramatsu +Cc: Luka Oreskovic +Cc: Juraj Vijtiuk +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/include/asm/kprobes.h | 22 +++++++++++----------- + arch/arm/probes/kprobes/opt-arm.c | 18 +++++++++--------- + 2 files changed, 20 insertions(+), 20 deletions(-) + +diff --git a/arch/arm/include/asm/kprobes.h b/arch/arm/include/asm/kprobes.h +index 213607a1f45c1..e26a278d301ab 100644 +--- a/arch/arm/include/asm/kprobes.h ++++ b/arch/arm/include/asm/kprobes.h +@@ -44,20 +44,20 @@ int kprobe_exceptions_notify(struct notifier_block *self, + unsigned long val, void *data); + + /* optinsn template addresses */ +-extern __visible kprobe_opcode_t optprobe_template_entry; +-extern __visible kprobe_opcode_t optprobe_template_val; +-extern __visible kprobe_opcode_t optprobe_template_call; +-extern __visible kprobe_opcode_t optprobe_template_end; +-extern __visible kprobe_opcode_t optprobe_template_sub_sp; +-extern __visible kprobe_opcode_t optprobe_template_add_sp; +-extern __visible kprobe_opcode_t optprobe_template_restore_begin; +-extern __visible kprobe_opcode_t optprobe_template_restore_orig_insn; +-extern __visible kprobe_opcode_t optprobe_template_restore_end; ++extern __visible kprobe_opcode_t optprobe_template_entry[]; ++extern __visible kprobe_opcode_t optprobe_template_val[]; ++extern __visible kprobe_opcode_t optprobe_template_call[]; ++extern __visible kprobe_opcode_t optprobe_template_end[]; ++extern __visible kprobe_opcode_t optprobe_template_sub_sp[]; ++extern __visible kprobe_opcode_t optprobe_template_add_sp[]; ++extern __visible kprobe_opcode_t optprobe_template_restore_begin[]; ++extern __visible kprobe_opcode_t optprobe_template_restore_orig_insn[]; ++extern __visible kprobe_opcode_t optprobe_template_restore_end[]; + + #define MAX_OPTIMIZED_LENGTH 4 + #define MAX_OPTINSN_SIZE \ +- ((unsigned long)&optprobe_template_end - \ +- (unsigned long)&optprobe_template_entry) ++ ((unsigned long)optprobe_template_end - \ ++ (unsigned long)optprobe_template_entry) + #define RELATIVEJUMP_SIZE 4 + + struct arch_optimized_insn { +diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c +index 7a449df0b3591..c78180172120f 100644 +--- a/arch/arm/probes/kprobes/opt-arm.c ++++ b/arch/arm/probes/kprobes/opt-arm.c +@@ -85,21 +85,21 @@ asm ( + "optprobe_template_end:\n"); + + #define TMPL_VAL_IDX \ +- ((unsigned long *)&optprobe_template_val - (unsigned long *)&optprobe_template_entry) ++ ((unsigned long *)optprobe_template_val - (unsigned long *)optprobe_template_entry) + #define TMPL_CALL_IDX \ +- ((unsigned long *)&optprobe_template_call - (unsigned long *)&optprobe_template_entry) ++ ((unsigned long *)optprobe_template_call - (unsigned long *)optprobe_template_entry) + #define TMPL_END_IDX \ +- ((unsigned long *)&optprobe_template_end - (unsigned long *)&optprobe_template_entry) ++ ((unsigned long *)optprobe_template_end - (unsigned long *)optprobe_template_entry) + #define TMPL_ADD_SP \ +- ((unsigned long *)&optprobe_template_add_sp - (unsigned long *)&optprobe_template_entry) ++ ((unsigned long *)optprobe_template_add_sp - (unsigned long *)optprobe_template_entry) + #define TMPL_SUB_SP \ +- ((unsigned long *)&optprobe_template_sub_sp - (unsigned long *)&optprobe_template_entry) ++ ((unsigned long *)optprobe_template_sub_sp - (unsigned long *)optprobe_template_entry) + #define TMPL_RESTORE_BEGIN \ +- ((unsigned long *)&optprobe_template_restore_begin - (unsigned long *)&optprobe_template_entry) ++ ((unsigned long *)optprobe_template_restore_begin - (unsigned long *)optprobe_template_entry) + #define TMPL_RESTORE_ORIGN_INSN \ +- ((unsigned long *)&optprobe_template_restore_orig_insn - (unsigned long *)&optprobe_template_entry) ++ ((unsigned long *)optprobe_template_restore_orig_insn - (unsigned long *)optprobe_template_entry) + #define TMPL_RESTORE_END \ +- ((unsigned long *)&optprobe_template_restore_end - (unsigned long *)&optprobe_template_entry) ++ ((unsigned long *)optprobe_template_restore_end - (unsigned long *)optprobe_template_entry) + + /* + * ARM can always optimize an instruction when using ARM ISA, except +@@ -234,7 +234,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or + } + + /* Copy arch-dep-instance from template. */ +- memcpy(code, (unsigned long *)&optprobe_template_entry, ++ memcpy(code, (unsigned long *)optprobe_template_entry, + TMPL_END_IDX * sizeof(kprobe_opcode_t)); + + /* Adjust buffer according to instruction. */ +-- +2.27.0 + diff --git a/queue-5.9/arm64-mm-validate-hotplug-range-before-creating-line.patch b/queue-5.9/arm64-mm-validate-hotplug-range-before-creating-line.patch new file mode 100644 index 00000000000..5fcb3d2fad9 --- /dev/null +++ b/queue-5.9/arm64-mm-validate-hotplug-range-before-creating-line.patch @@ -0,0 +1,77 @@ +From 27d115096e6f502eecaae44ef2a1583b0cb34f5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 13:00:14 +0530 +Subject: arm64/mm: Validate hotplug range before creating linear mapping + +From: Anshuman Khandual + +[ Upstream commit 58284a901b426e6130672e9f14c30dfd5a9dbde0 ] + +During memory hotplug process, the linear mapping should not be created for +a given memory range if that would fall outside the maximum allowed linear +range. Else it might cause memory corruption in the kernel virtual space. + +Maximum linear mapping region is [PAGE_OFFSET..(PAGE_END -1)] accommodating +both its ends but excluding PAGE_END. Max physical range that can be mapped +inside this linear mapping range, must also be derived from its end points. + +This ensures that arch_add_memory() validates memory hot add range for its +potential linear mapping requirements, before creating it with +__create_pgd_mapping(). + +Fixes: 4ab215061554 ("arm64: Add memory hotplug support") +Signed-off-by: Anshuman Khandual +Reviewed-by: Ard Biesheuvel +Cc: Catalin Marinas +Cc: Will Deacon +Cc: Mark Rutland +Cc: Ard Biesheuvel +Cc: Steven Price +Cc: Robin Murphy +Cc: David Hildenbrand +Cc: Andrew Morton +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Link: https://lore.kernel.org/r/1605252614-761-1-git-send-email-anshuman.khandual@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/mmu.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index 75df62fea1b68..a834e7fb0e250 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -1433,11 +1433,28 @@ static void __remove_pgd_mapping(pgd_t *pgdir, unsigned long start, u64 size) + free_empty_tables(start, end, PAGE_OFFSET, PAGE_END); + } + ++static bool inside_linear_region(u64 start, u64 size) ++{ ++ /* ++ * Linear mapping region is the range [PAGE_OFFSET..(PAGE_END - 1)] ++ * accommodating both its ends but excluding PAGE_END. Max physical ++ * range which can be mapped inside this linear mapping range, must ++ * also be derived from its end points. ++ */ ++ return start >= __pa(_PAGE_OFFSET(vabits_actual)) && ++ (start + size - 1) <= __pa(PAGE_END - 1); ++} ++ + int arch_add_memory(int nid, u64 start, u64 size, + struct mhp_params *params) + { + int ret, flags = 0; + ++ if (!inside_linear_region(start, size)) { ++ pr_err("[%llx %llx] is outside linear mapping region\n", start, start + size); ++ return -EINVAL; ++ } ++ + if (rodata_full || debug_pagealloc_enabled()) + flags = NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS; + +-- +2.27.0 + diff --git a/queue-5.9/bpf-don-t-rely-on-gcc-__attribute__-optimize-to-disa.patch b/queue-5.9/bpf-don-t-rely-on-gcc-__attribute__-optimize-to-disa.patch new file mode 100644 index 00000000000..0f4a5311f62 --- /dev/null +++ b/queue-5.9/bpf-don-t-rely-on-gcc-__attribute__-optimize-to-disa.patch @@ -0,0 +1,101 @@ +From 05b60ed168d933be7d4cd43355ec4ac2835cc880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 18:15:05 +0100 +Subject: bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE + +From: Ard Biesheuvel + +[ Upstream commit 080b6f40763565f65ebb9540219c71ce885cf568 ] + +Commit 3193c0836 ("bpf: Disable GCC -fgcse optimization for +___bpf_prog_run()") introduced a __no_fgcse macro that expands to a +function scope __attribute__((optimize("-fno-gcse"))), to disable a +GCC specific optimization that was causing trouble on x86 builds, and +was not expected to have any positive effect in the first place. + +However, as the GCC manual documents, __attribute__((optimize)) +is not for production use, and results in all other optimization +options to be forgotten for the function in question. This can +cause all kinds of trouble, but in one particular reported case, +it causes -fno-asynchronous-unwind-tables to be disregarded, +resulting in .eh_frame info to be emitted for the function. + +This reverts commit 3193c0836, and instead, it disables the -fgcse +optimization for the entire source file, but only when building for +X86 using GCC with CONFIG_BPF_JIT_ALWAYS_ON disabled. Note that the +original commit states that CONFIG_RETPOLINE=n triggers the issue, +whereas CONFIG_RETPOLINE=y performs better without the optimization, +so it is kept disabled in both cases. + +Fixes: 3193c0836f20 ("bpf: Disable GCC -fgcse optimization for ___bpf_prog_run()") +Signed-off-by: Ard Biesheuvel +Signed-off-by: Alexei Starovoitov +Tested-by: Geert Uytterhoeven +Reviewed-by: Nick Desaulniers +Link: https://lore.kernel.org/lkml/CAMuHMdUg0WJHEcq6to0-eODpXPOywLot6UD2=GFHpzoj_hCoBQ@mail.gmail.com/ +Link: https://lore.kernel.org/bpf/20201028171506.15682-2-ardb@kernel.org +Signed-off-by: Sasha Levin +--- + include/linux/compiler-gcc.h | 2 -- + include/linux/compiler_types.h | 4 ---- + kernel/bpf/Makefile | 6 +++++- + kernel/bpf/core.c | 2 +- + 4 files changed, 6 insertions(+), 8 deletions(-) + +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index 7a3769040d7dc..3017ebd400546 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -175,5 +175,3 @@ + #else + #define __diag_GCC_8(s) + #endif +- +-#define __no_fgcse __attribute__((optimize("-fno-gcse"))) +diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h +index 6e390d58a9f8c..ac3fa37a84f94 100644 +--- a/include/linux/compiler_types.h ++++ b/include/linux/compiler_types.h +@@ -247,10 +247,6 @@ struct ftrace_likely_data { + #define asm_inline asm + #endif + +-#ifndef __no_fgcse +-# define __no_fgcse +-#endif +- + /* Are two types/vars the same type (ignoring qualifiers)? */ + #define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b)) + +diff --git a/kernel/bpf/Makefile b/kernel/bpf/Makefile +index e6eb9c0402dab..0cc0de72163dc 100644 +--- a/kernel/bpf/Makefile ++++ b/kernel/bpf/Makefile +@@ -1,6 +1,10 @@ + # SPDX-License-Identifier: GPL-2.0 + obj-y := core.o +-CFLAGS_core.o += $(call cc-disable-warning, override-init) ++ifneq ($(CONFIG_BPF_JIT_ALWAYS_ON),y) ++# ___bpf_prog_run() needs GCSE disabled on x86; see 3193c0836f203 for details ++cflags-nogcse-$(CONFIG_X86)$(CONFIG_CC_IS_GCC) := -fno-gcse ++endif ++CFLAGS_core.o += $(call cc-disable-warning, override-init) $(cflags-nogcse-yy) + + obj-$(CONFIG_BPF_SYSCALL) += syscall.o verifier.o inode.o helpers.o tnum.o bpf_iter.o map_iter.o task_iter.o prog_iter.o + obj-$(CONFIG_BPF_SYSCALL) += hashtab.o arraymap.o percpu_freelist.o bpf_lru_list.o lpm_trie.o map_in_map.o +diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c +index ed0b3578867c0..3cb26e82549ac 100644 +--- a/kernel/bpf/core.c ++++ b/kernel/bpf/core.c +@@ -1364,7 +1364,7 @@ u64 __weak bpf_probe_read_kernel(void *dst, u32 size, const void *unsafe_ptr) + * + * Decode and execute eBPF instructions. + */ +-static u64 __no_fgcse ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack) ++static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack) + { + #define BPF_INSN_2_LBL(x, y) [BPF_##x | BPF_##y] = &&x##_##y + #define BPF_INSN_3_LBL(x, y, z) [BPF_##x | BPF_##y | BPF_##z] = &&x##_##y##_##z +-- +2.27.0 + diff --git a/queue-5.9/bpf-zero-fill-re-used-per-cpu-map-element.patch b/queue-5.9/bpf-zero-fill-re-used-per-cpu-map-element.patch new file mode 100644 index 00000000000..f50917be7b5 --- /dev/null +++ b/queue-5.9/bpf-zero-fill-re-used-per-cpu-map-element.patch @@ -0,0 +1,357 @@ +From 21ef4b3f365820533fb8683401ce1a52d5e78c4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 12:23:32 +0100 +Subject: bpf: Zero-fill re-used per-cpu map element + +From: David Verbeiren + +[ Upstream commit d3bec0138bfbe58606fc1d6f57a4cdc1a20218db ] + +Zero-fill element values for all other cpus than current, just as +when not using prealloc. This is the only way the bpf program can +ensure known initial values for all cpus ('onallcpus' cannot be +set when coming from the bpf program). + +The scenario is: bpf program inserts some elements in a per-cpu +map, then deletes some (or userspace does). When later adding +new elements using bpf_map_update_elem(), the bpf program can +only set the value of the new elements for the current cpu. +When prealloc is enabled, previously deleted elements are re-used. +Without the fix, values for other cpus remain whatever they were +when the re-used entry was previously freed. + +A selftest is added to validate correct operation in above +scenario as well as in case of LRU per-cpu map element re-use. + +Fixes: 6c9059817432 ("bpf: pre-allocate hash map elements") +Signed-off-by: David Verbeiren +Signed-off-by: Alexei Starovoitov +Acked-by: Matthieu Baerts +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20201104112332.15191-1-david.verbeiren@tessares.net +Signed-off-by: Sasha Levin +--- + kernel/bpf/hashtab.c | 30 ++- + .../selftests/bpf/prog_tests/map_init.c | 214 ++++++++++++++++++ + .../selftests/bpf/progs/test_map_init.c | 33 +++ + 3 files changed, 275 insertions(+), 2 deletions(-) + create mode 100644 tools/testing/selftests/bpf/prog_tests/map_init.c + create mode 100644 tools/testing/selftests/bpf/progs/test_map_init.c + +diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c +index 7df28a45c66bf..15364543b2c0f 100644 +--- a/kernel/bpf/hashtab.c ++++ b/kernel/bpf/hashtab.c +@@ -821,6 +821,32 @@ static void pcpu_copy_value(struct bpf_htab *htab, void __percpu *pptr, + } + } + ++static void pcpu_init_value(struct bpf_htab *htab, void __percpu *pptr, ++ void *value, bool onallcpus) ++{ ++ /* When using prealloc and not setting the initial value on all cpus, ++ * zero-fill element values for other cpus (just as what happens when ++ * not using prealloc). Otherwise, bpf program has no way to ensure ++ * known initial values for cpus other than current one ++ * (onallcpus=false always when coming from bpf prog). ++ */ ++ if (htab_is_prealloc(htab) && !onallcpus) { ++ u32 size = round_up(htab->map.value_size, 8); ++ int current_cpu = raw_smp_processor_id(); ++ int cpu; ++ ++ for_each_possible_cpu(cpu) { ++ if (cpu == current_cpu) ++ bpf_long_memcpy(per_cpu_ptr(pptr, cpu), value, ++ size); ++ else ++ memset(per_cpu_ptr(pptr, cpu), 0, size); ++ } ++ } else { ++ pcpu_copy_value(htab, pptr, value, onallcpus); ++ } ++} ++ + static bool fd_htab_map_needs_adjust(const struct bpf_htab *htab) + { + return htab->map.map_type == BPF_MAP_TYPE_HASH_OF_MAPS && +@@ -891,7 +917,7 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key, + } + } + +- pcpu_copy_value(htab, pptr, value, onallcpus); ++ pcpu_init_value(htab, pptr, value, onallcpus); + + if (!prealloc) + htab_elem_set_ptr(l_new, key_size, pptr); +@@ -1183,7 +1209,7 @@ static int __htab_lru_percpu_map_update_elem(struct bpf_map *map, void *key, + pcpu_copy_value(htab, htab_elem_get_ptr(l_old, key_size), + value, onallcpus); + } else { +- pcpu_copy_value(htab, htab_elem_get_ptr(l_new, key_size), ++ pcpu_init_value(htab, htab_elem_get_ptr(l_new, key_size), + value, onallcpus); + hlist_nulls_add_head_rcu(&l_new->hash_node, head); + l_new = NULL; +diff --git a/tools/testing/selftests/bpf/prog_tests/map_init.c b/tools/testing/selftests/bpf/prog_tests/map_init.c +new file mode 100644 +index 0000000000000..14a31109dd0e0 +--- /dev/null ++++ b/tools/testing/selftests/bpf/prog_tests/map_init.c +@@ -0,0 +1,214 @@ ++// SPDX-License-Identifier: GPL-2.0-only ++/* Copyright (c) 2020 Tessares SA */ ++ ++#include ++#include "test_map_init.skel.h" ++ ++#define TEST_VALUE 0x1234 ++#define FILL_VALUE 0xdeadbeef ++ ++static int nr_cpus; ++static int duration; ++ ++typedef unsigned long long map_key_t; ++typedef unsigned long long map_value_t; ++typedef struct { ++ map_value_t v; /* padding */ ++} __bpf_percpu_val_align pcpu_map_value_t; ++ ++ ++static int map_populate(int map_fd, int num) ++{ ++ pcpu_map_value_t value[nr_cpus]; ++ int i, err; ++ map_key_t key; ++ ++ for (i = 0; i < nr_cpus; i++) ++ bpf_percpu(value, i) = FILL_VALUE; ++ ++ for (key = 1; key <= num; key++) { ++ err = bpf_map_update_elem(map_fd, &key, value, BPF_NOEXIST); ++ if (!ASSERT_OK(err, "bpf_map_update_elem")) ++ return -1; ++ } ++ ++ return 0; ++} ++ ++static struct test_map_init *setup(enum bpf_map_type map_type, int map_sz, ++ int *map_fd, int populate) ++{ ++ struct test_map_init *skel; ++ int err; ++ ++ skel = test_map_init__open(); ++ if (!ASSERT_OK_PTR(skel, "skel_open")) ++ return NULL; ++ ++ err = bpf_map__set_type(skel->maps.hashmap1, map_type); ++ if (!ASSERT_OK(err, "bpf_map__set_type")) ++ goto error; ++ ++ err = bpf_map__set_max_entries(skel->maps.hashmap1, map_sz); ++ if (!ASSERT_OK(err, "bpf_map__set_max_entries")) ++ goto error; ++ ++ err = test_map_init__load(skel); ++ if (!ASSERT_OK(err, "skel_load")) ++ goto error; ++ ++ *map_fd = bpf_map__fd(skel->maps.hashmap1); ++ if (CHECK(*map_fd < 0, "bpf_map__fd", "failed\n")) ++ goto error; ++ ++ err = map_populate(*map_fd, populate); ++ if (!ASSERT_OK(err, "map_populate")) ++ goto error_map; ++ ++ return skel; ++ ++error_map: ++ close(*map_fd); ++error: ++ test_map_init__destroy(skel); ++ return NULL; ++} ++ ++/* executes bpf program that updates map with key, value */ ++static int prog_run_insert_elem(struct test_map_init *skel, map_key_t key, ++ map_value_t value) ++{ ++ struct test_map_init__bss *bss; ++ ++ bss = skel->bss; ++ ++ bss->inKey = key; ++ bss->inValue = value; ++ bss->inPid = getpid(); ++ ++ if (!ASSERT_OK(test_map_init__attach(skel), "skel_attach")) ++ return -1; ++ ++ /* Let tracepoint trigger */ ++ syscall(__NR_getpgid); ++ ++ test_map_init__detach(skel); ++ ++ return 0; ++} ++ ++static int check_values_one_cpu(pcpu_map_value_t *value, map_value_t expected) ++{ ++ int i, nzCnt = 0; ++ map_value_t val; ++ ++ for (i = 0; i < nr_cpus; i++) { ++ val = bpf_percpu(value, i); ++ if (val) { ++ if (CHECK(val != expected, "map value", ++ "unexpected for cpu %d: 0x%llx\n", i, val)) ++ return -1; ++ nzCnt++; ++ } ++ } ++ ++ if (CHECK(nzCnt != 1, "map value", "set for %d CPUs instead of 1!\n", ++ nzCnt)) ++ return -1; ++ ++ return 0; ++} ++ ++/* Add key=1 elem with values set for all CPUs ++ * Delete elem key=1 ++ * Run bpf prog that inserts new key=1 elem with value=0x1234 ++ * (bpf prog can only set value for current CPU) ++ * Lookup Key=1 and check value is as expected for all CPUs: ++ * value set by bpf prog for one CPU, 0 for all others ++ */ ++static void test_pcpu_map_init(void) ++{ ++ pcpu_map_value_t value[nr_cpus]; ++ struct test_map_init *skel; ++ int map_fd, err; ++ map_key_t key; ++ ++ /* max 1 elem in map so insertion is forced to reuse freed entry */ ++ skel = setup(BPF_MAP_TYPE_PERCPU_HASH, 1, &map_fd, 1); ++ if (!ASSERT_OK_PTR(skel, "prog_setup")) ++ return; ++ ++ /* delete element so the entry can be re-used*/ ++ key = 1; ++ err = bpf_map_delete_elem(map_fd, &key); ++ if (!ASSERT_OK(err, "bpf_map_delete_elem")) ++ goto cleanup; ++ ++ /* run bpf prog that inserts new elem, re-using the slot just freed */ ++ err = prog_run_insert_elem(skel, key, TEST_VALUE); ++ if (!ASSERT_OK(err, "prog_run_insert_elem")) ++ goto cleanup; ++ ++ /* check that key=1 was re-created by bpf prog */ ++ err = bpf_map_lookup_elem(map_fd, &key, value); ++ if (!ASSERT_OK(err, "bpf_map_lookup_elem")) ++ goto cleanup; ++ ++ /* and has expected values */ ++ check_values_one_cpu(value, TEST_VALUE); ++ ++cleanup: ++ test_map_init__destroy(skel); ++} ++ ++/* Add key=1 and key=2 elems with values set for all CPUs ++ * Run bpf prog that inserts new key=3 elem ++ * (only for current cpu; other cpus should have initial value = 0) ++ * Lookup Key=1 and check value is as expected for all CPUs ++ */ ++static void test_pcpu_lru_map_init(void) ++{ ++ pcpu_map_value_t value[nr_cpus]; ++ struct test_map_init *skel; ++ int map_fd, err; ++ map_key_t key; ++ ++ /* Set up LRU map with 2 elements, values filled for all CPUs. ++ * With these 2 elements, the LRU map is full ++ */ ++ skel = setup(BPF_MAP_TYPE_LRU_PERCPU_HASH, 2, &map_fd, 2); ++ if (!ASSERT_OK_PTR(skel, "prog_setup")) ++ return; ++ ++ /* run bpf prog that inserts new key=3 element, re-using LRU slot */ ++ key = 3; ++ err = prog_run_insert_elem(skel, key, TEST_VALUE); ++ if (!ASSERT_OK(err, "prog_run_insert_elem")) ++ goto cleanup; ++ ++ /* check that key=3 replaced one of earlier elements */ ++ err = bpf_map_lookup_elem(map_fd, &key, value); ++ if (!ASSERT_OK(err, "bpf_map_lookup_elem")) ++ goto cleanup; ++ ++ /* and has expected values */ ++ check_values_one_cpu(value, TEST_VALUE); ++ ++cleanup: ++ test_map_init__destroy(skel); ++} ++ ++void test_map_init(void) ++{ ++ nr_cpus = bpf_num_possible_cpus(); ++ if (nr_cpus <= 1) { ++ printf("%s:SKIP: >1 cpu needed for this test\n", __func__); ++ test__skip(); ++ return; ++ } ++ ++ if (test__start_subtest("pcpu_map_init")) ++ test_pcpu_map_init(); ++ if (test__start_subtest("pcpu_lru_map_init")) ++ test_pcpu_lru_map_init(); ++} +diff --git a/tools/testing/selftests/bpf/progs/test_map_init.c b/tools/testing/selftests/bpf/progs/test_map_init.c +new file mode 100644 +index 0000000000000..c89d28ead6737 +--- /dev/null ++++ b/tools/testing/selftests/bpf/progs/test_map_init.c +@@ -0,0 +1,33 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* Copyright (c) 2020 Tessares SA */ ++ ++#include "vmlinux.h" ++#include ++ ++__u64 inKey = 0; ++__u64 inValue = 0; ++__u32 inPid = 0; ++ ++struct { ++ __uint(type, BPF_MAP_TYPE_PERCPU_HASH); ++ __uint(max_entries, 2); ++ __type(key, __u64); ++ __type(value, __u64); ++} hashmap1 SEC(".maps"); ++ ++ ++SEC("tp/syscalls/sys_enter_getpgid") ++int sysenter_getpgid(const void *ctx) ++{ ++ /* Just do it for once, when called from our own test prog. This ++ * ensures the map value is only updated for a single CPU. ++ */ ++ int cur_pid = bpf_get_current_pid_tgid() >> 32; ++ ++ if (cur_pid == inPid) ++ bpf_map_update_elem(&hashmap1, &inKey, &inValue, BPF_NOEXIST); ++ ++ return 0; ++} ++ ++char _license[] SEC("license") = "GPL"; +-- +2.27.0 + diff --git a/queue-5.9/ch_ktls-tcb-update-fails-sometimes.patch b/queue-5.9/ch_ktls-tcb-update-fails-sometimes.patch new file mode 100644 index 00000000000..605c13cb522 --- /dev/null +++ b/queue-5.9/ch_ktls-tcb-update-fails-sometimes.patch @@ -0,0 +1,66 @@ +From 2a5c7d140e2dab74b26a9cc86d4d8e65d1fff386 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 16:21:41 +0530 +Subject: ch_ktls: tcb update fails sometimes + +From: Rohit Maheshwari + +[ Upstream commit 7d01c428c86b525dc780226924d74df2048cf411 ] + +context id and port id should be filled while sending tcb update. + +Fixes: 5a4b9fe7fece ("cxgb4/chcr: complete record tx handling") +Signed-off-by: Rohit Maheshwari +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/crypto/chelsio/chcr_ktls.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/chelsio/chcr_ktls.c b/drivers/crypto/chelsio/chcr_ktls.c +index 026689d091102..dc5e22bc64b39 100644 +--- a/drivers/crypto/chelsio/chcr_ktls.c ++++ b/drivers/crypto/chelsio/chcr_ktls.c +@@ -659,7 +659,8 @@ int chcr_ktls_cpl_set_tcb_rpl(struct adapter *adap, unsigned char *input) + } + + static void *__chcr_write_cpl_set_tcb_ulp(struct chcr_ktls_info *tx_info, +- u32 tid, void *pos, u16 word, u64 mask, ++ u32 tid, void *pos, u16 word, ++ struct sge_eth_txq *q, u64 mask, + u64 val, u32 reply) + { + struct cpl_set_tcb_field_core *cpl; +@@ -668,7 +669,10 @@ static void *__chcr_write_cpl_set_tcb_ulp(struct chcr_ktls_info *tx_info, + + /* ULP_TXPKT */ + txpkt = pos; +- txpkt->cmd_dest = htonl(ULPTX_CMD_V(ULP_TX_PKT) | ULP_TXPKT_DEST_V(0)); ++ txpkt->cmd_dest = htonl(ULPTX_CMD_V(ULP_TX_PKT) | ++ ULP_TXPKT_CHANNELID_V(tx_info->port_id) | ++ ULP_TXPKT_FID_V(q->q.cntxt_id) | ++ ULP_TXPKT_RO_F); + txpkt->len = htonl(DIV_ROUND_UP(CHCR_SET_TCB_FIELD_LEN, 16)); + + /* ULPTX_IDATA sub-command */ +@@ -723,7 +727,7 @@ static void *chcr_write_cpl_set_tcb_ulp(struct chcr_ktls_info *tx_info, + } else { + u8 buf[48] = {0}; + +- __chcr_write_cpl_set_tcb_ulp(tx_info, tid, buf, word, ++ __chcr_write_cpl_set_tcb_ulp(tx_info, tid, buf, word, q, + mask, val, reply); + + return chcr_copy_to_txd(buf, &q->q, pos, +@@ -731,7 +735,7 @@ static void *chcr_write_cpl_set_tcb_ulp(struct chcr_ktls_info *tx_info, + } + } + +- pos = __chcr_write_cpl_set_tcb_ulp(tx_info, tid, pos, word, ++ pos = __chcr_write_cpl_set_tcb_ulp(tx_info, tid, pos, word, q, + mask, val, reply); + + /* check again if we are at the end of the queue */ +-- +2.27.0 + diff --git a/queue-5.9/ch_ktls-update-cheksum-information.patch b/queue-5.9/ch_ktls-update-cheksum-information.patch new file mode 100644 index 00000000000..524c51deecb --- /dev/null +++ b/queue-5.9/ch_ktls-update-cheksum-information.patch @@ -0,0 +1,67 @@ +From b5bab96eb8184fde2a8397dec9d74cb51cfe47a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 16:21:33 +0530 +Subject: ch_ktls: Update cheksum information + +From: Rohit Maheshwari + +[ Upstream commit 86716b51d14fc2201938939b323ba3ad99186910 ] + +Checksum update was missing in the WR. + +Fixes: 429765a149f1 ("chcr: handle partial end part of a record") +Signed-off-by: Rohit Maheshwari +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/crypto/chelsio/chcr_ktls.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/chelsio/chcr_ktls.c b/drivers/crypto/chelsio/chcr_ktls.c +index c5cce024886ac..026689d091102 100644 +--- a/drivers/crypto/chelsio/chcr_ktls.c ++++ b/drivers/crypto/chelsio/chcr_ktls.c +@@ -926,6 +926,7 @@ chcr_ktls_write_tcp_options(struct chcr_ktls_info *tx_info, struct sk_buff *skb, + struct iphdr *ip; + int credits; + u8 buf[150]; ++ u64 cntrl1; + void *pos; + + iplen = skb_network_header_len(skb); +@@ -964,22 +965,28 @@ chcr_ktls_write_tcp_options(struct chcr_ktls_info *tx_info, struct sk_buff *skb, + TXPKT_PF_V(tx_info->adap->pf)); + cpl->pack = 0; + cpl->len = htons(pktlen); +- /* checksum offload */ +- cpl->ctrl1 = 0; +- +- pos = cpl + 1; + + memcpy(buf, skb->data, pktlen); + if (tx_info->ip_family == AF_INET) { + /* we need to correct ip header len */ + ip = (struct iphdr *)(buf + maclen); + ip->tot_len = htons(pktlen - maclen); ++ cntrl1 = TXPKT_CSUM_TYPE_V(TX_CSUM_TCPIP); + #if IS_ENABLED(CONFIG_IPV6) + } else { + ip6 = (struct ipv6hdr *)(buf + maclen); + ip6->payload_len = htons(pktlen - maclen - iplen); ++ cntrl1 = TXPKT_CSUM_TYPE_V(TX_CSUM_TCPIP6); + #endif + } ++ ++ cntrl1 |= T6_TXPKT_ETHHDR_LEN_V(maclen - ETH_HLEN) | ++ TXPKT_IPHDR_LEN_V(iplen); ++ /* checksum offload */ ++ cpl->ctrl1 = cpu_to_be64(cntrl1); ++ ++ pos = cpl + 1; ++ + /* now take care of the tcp header, if fin is not set then clear push + * bit as well, and if fin is set, it will be sent at the last so we + * need to update the tcp sequence number as per the last packet. +-- +2.27.0 + diff --git a/queue-5.9/cosa-add-missing-kfree-in-error-path-of-cosa_write.patch b/queue-5.9/cosa-add-missing-kfree-in-error-path-of-cosa_write.patch new file mode 100644 index 00000000000..6c215ae6226 --- /dev/null +++ b/queue-5.9/cosa-add-missing-kfree-in-error-path-of-cosa_write.patch @@ -0,0 +1,39 @@ +From f3f08c5fe957ce3c92b1a207487b942ff64ee46e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Nov 2020 22:46:14 +0800 +Subject: cosa: Add missing kfree in error path of cosa_write + +From: Wang Hai + +[ Upstream commit 52755b66ddcef2e897778fac5656df18817b59ab ] + +If memory allocation for 'kbuf' succeed, cosa_write() doesn't have a +corresponding kfree() in exception handling. Thus add kfree() for this +function implementation. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Acked-by: Jan "Yenya" Kasprzak +Link: https://lore.kernel.org/r/20201110144614.43194-1-wanghai38@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wan/cosa.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c +index f8aed0696d775..2369ca250cd65 100644 +--- a/drivers/net/wan/cosa.c ++++ b/drivers/net/wan/cosa.c +@@ -889,6 +889,7 @@ static ssize_t cosa_write(struct file *file, + chan->tx_status = 1; + spin_unlock_irqrestore(&cosa->lock, flags); + up(&chan->wsem); ++ kfree(kbuf); + return -ERESTARTSYS; + } + } +-- +2.27.0 + diff --git a/queue-5.9/gpio-aspeed-fix-ast2600-bank-properties.patch b/queue-5.9/gpio-aspeed-fix-ast2600-bank-properties.patch new file mode 100644 index 00000000000..3392baa2997 --- /dev/null +++ b/queue-5.9/gpio-aspeed-fix-ast2600-bank-properties.patch @@ -0,0 +1,40 @@ +From 5e4389fb69d530d3eba17237c5d31b6dba6edbed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Oct 2020 12:50:26 +0800 +Subject: gpio: aspeed: fix ast2600 bank properties + +From: Billy Tsai + +[ Upstream commit 560b6ac37a87fcb78d580437e3e0bc2b6b5b0295 ] + +GPIO_T is mapped to the most significant byte of input/output mask, and +the byte in "output" mask should be 0 because GPIO_T is input only. All +the other bits need to be 1 because GPIO_Q/R/S support both input and +output modes. + +Fixes: ab4a85534c3e ("gpio: aspeed: Add in ast2600 details to Aspeed driver") +Signed-off-by: Billy Tsai +Reviewed-by: Tao Ren +Reviewed-by: Joel Stanley +Reviewed-by: Andrew Jeffery +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-aspeed.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c +index e44d5de2a1201..b966f5e28ebff 100644 +--- a/drivers/gpio/gpio-aspeed.c ++++ b/drivers/gpio/gpio-aspeed.c +@@ -1114,6 +1114,7 @@ static const struct aspeed_gpio_config ast2500_config = + + static const struct aspeed_bank_props ast2600_bank_props[] = { + /* input output */ ++ {4, 0xffffffff, 0x00ffffff}, /* Q/R/S/T */ + {5, 0xffffffff, 0xffffff00}, /* U/V/W/X */ + {6, 0x0000ffff, 0x0000ffff}, /* Y/Z */ + { }, +-- +2.27.0 + diff --git a/queue-5.9/hwmon-applesmc-re-work-smc-comms.patch b/queue-5.9/hwmon-applesmc-re-work-smc-comms.patch new file mode 100644 index 00000000000..f5c321fd890 --- /dev/null +++ b/queue-5.9/hwmon-applesmc-re-work-smc-comms.patch @@ -0,0 +1,257 @@ +From d693fcb5ed870c209e72f9104b88536fddbe883e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 14:08:23 +1100 +Subject: hwmon: (applesmc) Re-work SMC comms + +From: Brad Campbell + +[ Upstream commit 4d64bb4ba5ecf4831448cdb2fe16d0ae91b2b40b ] + +Commit fff2d0f701e6 ("hwmon: (applesmc) avoid overlong udelay()") +introduced an issue whereby communication with the SMC became +unreliable with write errors like : + +[ 120.378614] applesmc: send_byte(0x00, 0x0300) fail: 0x40 +[ 120.378621] applesmc: LKSB: write data fail +[ 120.512782] applesmc: send_byte(0x00, 0x0300) fail: 0x40 +[ 120.512787] applesmc: LKSB: write data fail + +The original code appeared to be timing sensitive and was not reliable +with the timing changes in the aforementioned commit. + +This patch re-factors the SMC communication to remove the timing +dependencies and restore function with the changes previously +committed. + +Tested on : MacbookAir6,2 MacBookPro11,1 iMac12,2, MacBookAir1,1, +MacBookAir3,1 + +Fixes: fff2d0f701e6 ("hwmon: (applesmc) avoid overlong udelay()") +Reported-by: Andreas Kemnade +Tested-by: Andreas Kemnade # MacBookAir6,2 +Acked-by: Arnd Bergmann +Signed-off-by: Brad Campbell +Signed-off-by: Henrik Rydberg +Link: https://lore.kernel.org/r/194a7d71-a781-765a-d177-c962ef296b90@fnarfbargle.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/applesmc.c | 130 ++++++++++++++++++++++++--------------- + 1 file changed, 82 insertions(+), 48 deletions(-) + +diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c +index a18887990f4a2..79b498f816fe9 100644 +--- a/drivers/hwmon/applesmc.c ++++ b/drivers/hwmon/applesmc.c +@@ -32,6 +32,7 @@ + #include + #include + #include ++#include + + /* data port used by Apple SMC */ + #define APPLESMC_DATA_PORT 0x300 +@@ -42,10 +43,13 @@ + + #define APPLESMC_MAX_DATA_LENGTH 32 + +-/* wait up to 128 ms for a status change. */ +-#define APPLESMC_MIN_WAIT 0x0010 +-#define APPLESMC_RETRY_WAIT 0x0100 +-#define APPLESMC_MAX_WAIT 0x20000 ++/* Apple SMC status bits */ ++#define SMC_STATUS_AWAITING_DATA BIT(0) /* SMC has data waiting to be read */ ++#define SMC_STATUS_IB_CLOSED BIT(1) /* Will ignore any input */ ++#define SMC_STATUS_BUSY BIT(2) /* Command in progress */ ++ ++/* Initial wait is 8us */ ++#define APPLESMC_MIN_WAIT 0x0008 + + #define APPLESMC_READ_CMD 0x10 + #define APPLESMC_WRITE_CMD 0x11 +@@ -151,65 +155,84 @@ static unsigned int key_at_index; + static struct workqueue_struct *applesmc_led_wq; + + /* +- * wait_read - Wait for a byte to appear on SMC port. Callers must +- * hold applesmc_lock. ++ * Wait for specific status bits with a mask on the SMC. ++ * Used before all transactions. ++ * This does 10 fast loops of 8us then exponentially backs off for a ++ * minimum total wait of 262ms. Depending on usleep_range this could ++ * run out past 500ms. + */ +-static int wait_read(void) ++ ++static int wait_status(u8 val, u8 mask) + { +- unsigned long end = jiffies + (APPLESMC_MAX_WAIT * HZ) / USEC_PER_SEC; + u8 status; + int us; ++ int i; + +- for (us = APPLESMC_MIN_WAIT; us < APPLESMC_MAX_WAIT; us <<= 1) { +- usleep_range(us, us * 16); ++ us = APPLESMC_MIN_WAIT; ++ for (i = 0; i < 24 ; i++) { + status = inb(APPLESMC_CMD_PORT); +- /* read: wait for smc to settle */ +- if (status & 0x01) ++ if ((status & mask) == val) + return 0; +- /* timeout: give up */ +- if (time_after(jiffies, end)) +- break; ++ usleep_range(us, us * 2); ++ if (i > 9) ++ us <<= 1; + } +- +- pr_warn("wait_read() fail: 0x%02x\n", status); + return -EIO; + } + +-/* +- * send_byte - Write to SMC port, retrying when necessary. Callers +- * must hold applesmc_lock. +- */ ++/* send_byte - Write to SMC data port. Callers must hold applesmc_lock. */ ++ + static int send_byte(u8 cmd, u16 port) + { +- u8 status; +- int us; +- unsigned long end = jiffies + (APPLESMC_MAX_WAIT * HZ) / USEC_PER_SEC; ++ int status; ++ ++ status = wait_status(0, SMC_STATUS_IB_CLOSED); ++ if (status) ++ return status; ++ /* ++ * This needs to be a separate read looking for bit 0x04 ++ * after bit 0x02 falls. If consolidated with the wait above ++ * this extra read may not happen if status returns both ++ * simultaneously and this would appear to be required. ++ */ ++ status = wait_status(SMC_STATUS_BUSY, SMC_STATUS_BUSY); ++ if (status) ++ return status; + + outb(cmd, port); +- for (us = APPLESMC_MIN_WAIT; us < APPLESMC_MAX_WAIT; us <<= 1) { +- usleep_range(us, us * 16); +- status = inb(APPLESMC_CMD_PORT); +- /* write: wait for smc to settle */ +- if (status & 0x02) +- continue; +- /* ready: cmd accepted, return */ +- if (status & 0x04) +- return 0; +- /* timeout: give up */ +- if (time_after(jiffies, end)) +- break; +- /* busy: long wait and resend */ +- udelay(APPLESMC_RETRY_WAIT); +- outb(cmd, port); +- } +- +- pr_warn("send_byte(0x%02x, 0x%04x) fail: 0x%02x\n", cmd, port, status); +- return -EIO; ++ return 0; + } + ++/* send_command - Write a command to the SMC. Callers must hold applesmc_lock. */ ++ + static int send_command(u8 cmd) + { +- return send_byte(cmd, APPLESMC_CMD_PORT); ++ int ret; ++ ++ ret = wait_status(0, SMC_STATUS_IB_CLOSED); ++ if (ret) ++ return ret; ++ outb(cmd, APPLESMC_CMD_PORT); ++ return 0; ++} ++ ++/* ++ * Based on logic from the Apple driver. This is issued before any interaction ++ * If busy is stuck high, issue a read command to reset the SMC state machine. ++ * If busy is stuck high after the command then the SMC is jammed. ++ */ ++ ++static int smc_sane(void) ++{ ++ int ret; ++ ++ ret = wait_status(0, SMC_STATUS_BUSY); ++ if (!ret) ++ return ret; ++ ret = send_command(APPLESMC_READ_CMD); ++ if (ret) ++ return ret; ++ return wait_status(0, SMC_STATUS_BUSY); + } + + static int send_argument(const char *key) +@@ -226,6 +249,11 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len) + { + u8 status, data = 0; + int i; ++ int ret; ++ ++ ret = smc_sane(); ++ if (ret) ++ return ret; + + if (send_command(cmd) || send_argument(key)) { + pr_warn("%.4s: read arg fail\n", key); +@@ -239,7 +267,8 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len) + } + + for (i = 0; i < len; i++) { +- if (wait_read()) { ++ if (wait_status(SMC_STATUS_AWAITING_DATA | SMC_STATUS_BUSY, ++ SMC_STATUS_AWAITING_DATA | SMC_STATUS_BUSY)) { + pr_warn("%.4s: read data[%d] fail\n", key, i); + return -EIO; + } +@@ -250,19 +279,24 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len) + for (i = 0; i < 16; i++) { + udelay(APPLESMC_MIN_WAIT); + status = inb(APPLESMC_CMD_PORT); +- if (!(status & 0x01)) ++ if (!(status & SMC_STATUS_AWAITING_DATA)) + break; + data = inb(APPLESMC_DATA_PORT); + } + if (i) + pr_warn("flushed %d bytes, last value is: %d\n", i, data); + +- return 0; ++ return wait_status(0, SMC_STATUS_BUSY); + } + + static int write_smc(u8 cmd, const char *key, const u8 *buffer, u8 len) + { + int i; ++ int ret; ++ ++ ret = smc_sane(); ++ if (ret) ++ return ret; + + if (send_command(cmd) || send_argument(key)) { + pr_warn("%s: write arg fail\n", key); +@@ -281,7 +315,7 @@ static int write_smc(u8 cmd, const char *key, const u8 *buffer, u8 len) + } + } + +- return 0; ++ return wait_status(0, SMC_STATUS_BUSY); + } + + static int read_register_count(unsigned int *count) +-- +2.27.0 + diff --git a/queue-5.9/i40e-fix-mac-address-setting-for-a-vf-via-host-vm.patch b/queue-5.9/i40e-fix-mac-address-setting-for-a-vf-via-host-vm.patch new file mode 100644 index 00000000000..98a8dfbab01 --- /dev/null +++ b/queue-5.9/i40e-fix-mac-address-setting-for-a-vf-via-host-vm.patch @@ -0,0 +1,104 @@ +From 78ca0b9372caf6add4e13c02446190b40f96e8c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Oct 2020 08:54:09 +0000 +Subject: i40e: Fix MAC address setting for a VF via Host/VM + +From: Slawomir Laba + +[ Upstream commit 3a7001788fed0311d6fb77ed0dabe7bed3567bc0 ] + +Fix MAC setting flow for the PF driver. + +Update the unicast VF's MAC address in VF structure if it is +a new setting in i40e_vc_add_mac_addr_msg. + +When unicast MAC address gets deleted, record that and +set the new unicast MAC address that is already waiting in the filter +list. This logic is based on the order of messages arriving to +the PF driver. + +Without this change the MAC address setting was interpreted +incorrectly in the following use cases: +1) Print incorrect VF MAC or zero MAC +ip link show dev $pf +2) Don't preserve MAC between driver reload +rmmod iavf; modprobe iavf +3) Update VF MAC when macvlan was set +ip link add link $vf address $mac $vf.1 type macvlan +4) Failed to update mac address when VF was trusted +ip link set dev $vf address $mac + +This includes all other configurations including above commands. + +Fixes: f657a6e1313b ("i40e: Fix VF driver MAC address configuration") +Signed-off-by: Slawomir Laba +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 26 +++++++++++++++++-- + 1 file changed, 24 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 47bfb2e95e2db..343177d71f70a 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2712,6 +2712,10 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + spin_unlock_bh(&vsi->mac_filter_hash_lock); + goto error_param; + } ++ if (is_valid_ether_addr(al->list[i].addr) && ++ is_zero_ether_addr(vf->default_lan_addr.addr)) ++ ether_addr_copy(vf->default_lan_addr.addr, ++ al->list[i].addr); + } + } + spin_unlock_bh(&vsi->mac_filter_hash_lock); +@@ -2739,6 +2743,7 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + { + struct virtchnl_ether_addr_list *al = + (struct virtchnl_ether_addr_list *)msg; ++ bool was_unimac_deleted = false; + struct i40e_pf *pf = vf->pf; + struct i40e_vsi *vsi = NULL; + i40e_status ret = 0; +@@ -2758,6 +2763,8 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + ret = I40E_ERR_INVALID_MAC_ADDR; + goto error_param; + } ++ if (ether_addr_equal(al->list[i].addr, vf->default_lan_addr.addr)) ++ was_unimac_deleted = true; + } + vsi = pf->vsi[vf->lan_vsi_idx]; + +@@ -2778,10 +2785,25 @@ static int i40e_vc_del_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + dev_err(&pf->pdev->dev, "Unable to program VF %d MAC filters, error %d\n", + vf->vf_id, ret); + ++ if (vf->trusted && was_unimac_deleted) { ++ struct i40e_mac_filter *f; ++ struct hlist_node *h; ++ u8 *macaddr = NULL; ++ int bkt; ++ ++ /* set last unicast mac address as default */ ++ spin_lock_bh(&vsi->mac_filter_hash_lock); ++ hash_for_each_safe(vsi->mac_filter_hash, bkt, h, f, hlist) { ++ if (is_valid_ether_addr(f->macaddr)) ++ macaddr = f->macaddr; ++ } ++ if (macaddr) ++ ether_addr_copy(vf->default_lan_addr.addr, macaddr); ++ spin_unlock_bh(&vsi->mac_filter_hash_lock); ++ } + error_param: + /* send the response to the VF */ +- return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_DEL_ETH_ADDR, +- ret); ++ return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_DEL_ETH_ADDR, ret); + } + + /** +-- +2.27.0 + diff --git a/queue-5.9/igc-fix-returning-wrong-statistics.patch b/queue-5.9/igc-fix-returning-wrong-statistics.patch new file mode 100644 index 00000000000..d31a5d50ecf --- /dev/null +++ b/queue-5.9/igc-fix-returning-wrong-statistics.patch @@ -0,0 +1,73 @@ +From cf4be9390c17a012be3b5d984241b7c3591af5c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 11:35:37 -0700 +Subject: igc: Fix returning wrong statistics + +From: Vinicius Costa Gomes + +[ Upstream commit 6b7ed22ae4c96a415001f0c3116ebee15bb8491a ] + +'igc_update_stats()' was not updating 'netdev->stats', so the returned +statistics, for example, requested by: + +$ ip -s link show dev enp3s0 + +were not being updated and were always zero. + +Fix by returning a set of statistics that are actually being +updated (adapter->stats64). + +Fixes: c9a11c23ceb6 ("igc: Add netdev") +Signed-off-by: Vinicius Costa Gomes +Tested-by: Aaron Brown +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/igc/igc_main.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c +index 9593aa4eea369..1358a39c34ad3 100644 +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -3890,21 +3890,23 @@ static int igc_change_mtu(struct net_device *netdev, int new_mtu) + } + + /** +- * igc_get_stats - Get System Network Statistics ++ * igc_get_stats64 - Get System Network Statistics + * @netdev: network interface device structure ++ * @stats: rtnl_link_stats64 pointer + * + * Returns the address of the device statistics structure. + * The statistics are updated here and also from the timer callback. + */ +-static struct net_device_stats *igc_get_stats(struct net_device *netdev) ++static void igc_get_stats64(struct net_device *netdev, ++ struct rtnl_link_stats64 *stats) + { + struct igc_adapter *adapter = netdev_priv(netdev); + ++ spin_lock(&adapter->stats64_lock); + if (!test_bit(__IGC_RESETTING, &adapter->state)) + igc_update_stats(adapter); +- +- /* only return the current stats */ +- return &netdev->stats; ++ memcpy(stats, &adapter->stats64, sizeof(*stats)); ++ spin_unlock(&adapter->stats64_lock); + } + + static netdev_features_t igc_fix_features(struct net_device *netdev, +@@ -4833,7 +4835,7 @@ static const struct net_device_ops igc_netdev_ops = { + .ndo_set_rx_mode = igc_set_rx_mode, + .ndo_set_mac_address = igc_set_mac, + .ndo_change_mtu = igc_change_mtu, +- .ndo_get_stats = igc_get_stats, ++ .ndo_get_stats64 = igc_get_stats64, + .ndo_fix_features = igc_fix_features, + .ndo_set_features = igc_set_features, + .ndo_features_check = igc_features_check, +-- +2.27.0 + diff --git a/queue-5.9/kernel-watchdog-fix-watchdog_allowed_mask-not-used-w.patch b/queue-5.9/kernel-watchdog-fix-watchdog_allowed_mask-not-used-w.patch new file mode 100644 index 00000000000..02c537f7646 --- /dev/null +++ b/queue-5.9/kernel-watchdog-fix-watchdog_allowed_mask-not-used-w.patch @@ -0,0 +1,48 @@ +From a6c0c32c3555abda2e5a87dde5b3c059e029b2c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 22:52:10 -0800 +Subject: kernel/watchdog: fix watchdog_allowed_mask not used warning + +From: Santosh Sivaraj + +[ Upstream commit e7e046155af04cdca5e1157f28b07e1651eb317b ] + +Define watchdog_allowed_mask only when SOFTLOCKUP_DETECTOR is enabled. + +Fixes: 7feeb9cd4f5b ("watchdog/sysctl: Clean up sysctl variable name space") +Signed-off-by: Santosh Sivaraj +Signed-off-by: Andrew Morton +Reviewed-by: Petr Mladek +Cc: Thomas Gleixner +Link: https://lkml.kernel.org/r/20201106015025.1281561-1-santosh@fossix.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + kernel/watchdog.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/watchdog.c b/kernel/watchdog.c +index 5abb5b22ad130..71109065bd8eb 100644 +--- a/kernel/watchdog.c ++++ b/kernel/watchdog.c +@@ -44,8 +44,6 @@ int __read_mostly soft_watchdog_user_enabled = 1; + int __read_mostly watchdog_thresh = 10; + static int __read_mostly nmi_watchdog_available; + +-static struct cpumask watchdog_allowed_mask __read_mostly; +- + struct cpumask watchdog_cpumask __read_mostly; + unsigned long *watchdog_cpumask_bits = cpumask_bits(&watchdog_cpumask); + +@@ -162,6 +160,8 @@ static void lockup_detector_update_enable(void) + int __read_mostly sysctl_softlockup_all_cpu_backtrace; + #endif + ++static struct cpumask watchdog_allowed_mask __read_mostly; ++ + /* Global variables, exported for sysctl */ + unsigned int __read_mostly softlockup_panic = + CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE; +-- +2.27.0 + diff --git a/queue-5.9/lan743x-correctly-handle-chips-with-internal-phy.patch b/queue-5.9/lan743x-correctly-handle-chips-with-internal-phy.patch new file mode 100644 index 00000000000..67c07afed4b --- /dev/null +++ b/queue-5.9/lan743x-correctly-handle-chips-with-internal-phy.patch @@ -0,0 +1,94 @@ +From 92d9dae9c1c6885a5f86730f83610bce249b2993 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 12:12:24 -0500 +Subject: lan743x: correctly handle chips with internal PHY + +From: Sven Van Asbroeck + +[ Upstream commit 902a66e08ceaadb9a7a1ab3a4f3af611cd1d8cba ] + +Commit 6f197fb63850 ("lan743x: Added fixed link and RGMII support") +assumes that chips with an internal PHY will never have a devicetree +entry. This is incorrect: even for these chips, a devicetree entry +can be useful e.g. to pass the mac address from bootloader to chip: + + &pcie { + status = "okay"; + + host@0 { + reg = <0 0 0 0 0>; + + #address-cells = <3>; + #size-cells = <2>; + + lan7430: ethernet@0 { + /* LAN7430 with internal PHY */ + compatible = "microchip,lan743x"; + status = "okay"; + reg = <0 0 0 0 0>; + /* filled in by bootloader */ + local-mac-address = [00 00 00 00 00 00]; + }; + }; + }; + +If a devicetree entry is present, the driver will not attach the chip +to its internal phy, and the chip will be non-operational. + +Fix by tweaking the phy connection algorithm: +- first try to connect to a phy specified in the devicetree + (could be 'real' phy, or just a 'fixed-link') +- if that doesn't succeed, try to connect to an internal phy, even + if the chip has a devnode + +Tested on a LAN7430 with internal PHY. I cannot test a device using +fixed-link, as I do not have access to one. + +Fixes: 6f197fb63850 ("lan743x: Added fixed link and RGMII support") +Tested-by: Sven Van Asbroeck # lan7430 +Reviewed-by: Andrew Lunn +Signed-off-by: Sven Van Asbroeck +Link: https://lore.kernel.org/r/20201108171224.23829-1-TheSven73@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/lan743x_main.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c +index de93cc6ebc1ac..be58a941965b1 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -1027,9 +1027,9 @@ static int lan743x_phy_open(struct lan743x_adapter *adapter) + + netdev = adapter->netdev; + phynode = of_node_get(adapter->pdev->dev.of_node); +- adapter->phy_mode = PHY_INTERFACE_MODE_GMII; + + if (phynode) { ++ /* try devicetree phy, or fixed link */ + of_get_phy_mode(phynode, &adapter->phy_mode); + + if (of_phy_is_fixed_link(phynode)) { +@@ -1045,13 +1045,15 @@ static int lan743x_phy_open(struct lan743x_adapter *adapter) + lan743x_phy_link_status_change, 0, + adapter->phy_mode); + of_node_put(phynode); +- if (!phydev) +- goto return_error; +- } else { ++ } ++ ++ if (!phydev) { ++ /* try internal phy */ + phydev = phy_find_first(adapter->mdiobus); + if (!phydev) + goto return_error; + ++ adapter->phy_mode = PHY_INTERFACE_MODE_GMII; + ret = phy_connect_direct(netdev, phydev, + lan743x_phy_link_status_change, + adapter->phy_mode); +-- +2.27.0 + diff --git a/queue-5.9/lan743x-fix-bug-invalid-wait-context-when-setting-rx.patch b/queue-5.9/lan743x-fix-bug-invalid-wait-context-when-setting-rx.patch new file mode 100644 index 00000000000..d8b57ab08ce --- /dev/null +++ b/queue-5.9/lan743x-fix-bug-invalid-wait-context-when-setting-rx.patch @@ -0,0 +1,92 @@ +From be0b2ded3ebbcc0aa058cc8f603450a5ea125739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 15:38:28 -0500 +Subject: lan743x: fix "BUG: invalid wait context" when setting rx mode + +From: Sven Van Asbroeck + +[ Upstream commit 2b52a4b65bc8f14520fe6e996ea7fb3f7e400761 ] + +In the net core, the struct net_device_ops -> ndo_set_rx_mode() +callback is called with the dev->addr_list_lock spinlock held. + +However, this driver's ndo_set_rx_mode callback eventually calls +lan743x_dp_write(), which acquires a mutex. Mutex acquisition +may sleep, and this is not allowed when holding a spinlock. + +Fix by removing the dp_lock mutex entirely. Its purpose is to +prevent concurrent accesses to the data port. No concurrent +accesses are possible, because the dev->addr_list_lock +spinlock in the core only lets through one thread at a time. + +Fixes: 23f0703c125b ("lan743x: Add main source files for new lan743x driver") +Signed-off-by: Sven Van Asbroeck +Link: https://lore.kernel.org/r/20201109203828.5115-1-TheSven73@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/lan743x_main.c | 12 +++--------- + drivers/net/ethernet/microchip/lan743x_main.h | 3 --- + 2 files changed, 3 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c +index be58a941965b1..6c25c7c8b7cf8 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -675,14 +675,12 @@ clean_up: + static int lan743x_dp_write(struct lan743x_adapter *adapter, + u32 select, u32 addr, u32 length, u32 *buf) + { +- int ret = -EIO; + u32 dp_sel; + int i; + +- mutex_lock(&adapter->dp_lock); + if (lan743x_csr_wait_for_bit(adapter, DP_SEL, DP_SEL_DPRDY_, + 1, 40, 100, 100)) +- goto unlock; ++ return -EIO; + dp_sel = lan743x_csr_read(adapter, DP_SEL); + dp_sel &= ~DP_SEL_MASK_; + dp_sel |= select; +@@ -694,13 +692,10 @@ static int lan743x_dp_write(struct lan743x_adapter *adapter, + lan743x_csr_write(adapter, DP_CMD, DP_CMD_WRITE_); + if (lan743x_csr_wait_for_bit(adapter, DP_SEL, DP_SEL_DPRDY_, + 1, 40, 100, 100)) +- goto unlock; ++ return -EIO; + } +- ret = 0; + +-unlock: +- mutex_unlock(&adapter->dp_lock); +- return ret; ++ return 0; + } + + static u32 lan743x_mac_mii_access(u16 id, u16 index, int read) +@@ -2737,7 +2732,6 @@ static int lan743x_hardware_init(struct lan743x_adapter *adapter, + + adapter->intr.irq = adapter->pdev->irq; + lan743x_csr_write(adapter, INT_EN_CLR, 0xFFFFFFFF); +- mutex_init(&adapter->dp_lock); + + ret = lan743x_gpio_init(adapter); + if (ret) +diff --git a/drivers/net/ethernet/microchip/lan743x_main.h b/drivers/net/ethernet/microchip/lan743x_main.h +index c61a404113179..a536f4a4994df 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.h ++++ b/drivers/net/ethernet/microchip/lan743x_main.h +@@ -712,9 +712,6 @@ struct lan743x_adapter { + struct lan743x_csr csr; + struct lan743x_intr intr; + +- /* lock, used to prevent concurrent access to data port */ +- struct mutex dp_lock; +- + struct lan743x_gpio gpio; + struct lan743x_ptp ptp; + +-- +2.27.0 + diff --git a/queue-5.9/lan743x-fix-use-of-uninitialized-variable.patch b/queue-5.9/lan743x-fix-use-of-uninitialized-variable.patch new file mode 100644 index 00000000000..a975894040d --- /dev/null +++ b/queue-5.9/lan743x-fix-use-of-uninitialized-variable.patch @@ -0,0 +1,41 @@ +From 32c49bd0ce6764962eed67cb86f061c0a1ade9fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 10:25:13 -0500 +Subject: lan743x: fix use of uninitialized variable + +From: Sven Van Asbroeck + +[ Upstream commit edbc21113bde13ca3d06eec24b621b1f628583dd ] + +When no devicetree is present, the driver will use an +uninitialized variable. + +Fix by initializing this variable. + +Fixes: 902a66e08cea ("lan743x: correctly handle chips with internal PHY") +Reported-by: kernel test robot +Signed-off-by: Sven Van Asbroeck +Link: https://lore.kernel.org/r/20201112152513.1941-1-TheSven73@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/lan743x_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c +index 6c25c7c8b7cf8..bc368136bccc6 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -1015,8 +1015,8 @@ static void lan743x_phy_close(struct lan743x_adapter *adapter) + static int lan743x_phy_open(struct lan743x_adapter *adapter) + { + struct lan743x_phy *phy = &adapter->phy; ++ struct phy_device *phydev = NULL; + struct device_node *phynode; +- struct phy_device *phydev; + struct net_device *netdev; + int ret = -EIO; + +-- +2.27.0 + diff --git a/queue-5.9/libbpf-hashmap-fix-undefined-behavior-in-hash_bits.patch b/queue-5.9/libbpf-hashmap-fix-undefined-behavior-in-hash_bits.patch new file mode 100644 index 00000000000..bb414540a1f --- /dev/null +++ b/queue-5.9/libbpf-hashmap-fix-undefined-behavior-in-hash_bits.patch @@ -0,0 +1,69 @@ +From 13b2bdd63249d7680bc5dde3fa7c15045cf0ca54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 15:37:07 -0700 +Subject: libbpf, hashmap: Fix undefined behavior in hash_bits + +From: Ian Rogers + +[ Upstream commit 7a078d2d18801bba7bde7337a823d7342299acf7 ] + +If bits is 0, the case when the map is empty, then the >> is the size of +the register which is undefined behavior - on x86 it is the same as a +shift by 0. + +Fix by handling the 0 case explicitly and guarding calls to hash_bits for +empty maps in hashmap__for_each_key_entry and hashmap__for_each_entry_safe. + +Fixes: e3b924224028 ("libbpf: add resizable non-thread safe internal hashmap") +Suggested-by: Andrii Nakryiko , +Signed-off-by: Ian Rogers +Signed-off-by: Daniel Borkmann +Acked-by: Andrii Nakryiko +Acked-by: Song Liu +Link: https://lore.kernel.org/bpf/20201029223707.494059-1-irogers@google.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/hashmap.h | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +diff --git a/tools/lib/bpf/hashmap.h b/tools/lib/bpf/hashmap.h +index e0af36b0e5d83..6a3c3d8bb4ab8 100644 +--- a/tools/lib/bpf/hashmap.h ++++ b/tools/lib/bpf/hashmap.h +@@ -15,6 +15,9 @@ + static inline size_t hash_bits(size_t h, int bits) + { + /* shuffle bits and return requested number of upper bits */ ++ if (bits == 0) ++ return 0; ++ + #if (__SIZEOF_SIZE_T__ == __SIZEOF_LONG_LONG__) + /* LP64 case */ + return (h * 11400714819323198485llu) >> (__SIZEOF_LONG_LONG__ * 8 - bits); +@@ -162,17 +165,17 @@ bool hashmap__find(const struct hashmap *map, const void *key, void **value); + * @key: key to iterate entries for + */ + #define hashmap__for_each_key_entry(map, cur, _key) \ +- for (cur = ({ size_t bkt = hash_bits(map->hash_fn((_key), map->ctx),\ +- map->cap_bits); \ +- map->buckets ? map->buckets[bkt] : NULL; }); \ ++ for (cur = map->buckets \ ++ ? map->buckets[hash_bits(map->hash_fn((_key), map->ctx), map->cap_bits)] \ ++ : NULL; \ + cur; \ + cur = cur->next) \ + if (map->equal_fn(cur->key, (_key), map->ctx)) + + #define hashmap__for_each_key_entry_safe(map, cur, tmp, _key) \ +- for (cur = ({ size_t bkt = hash_bits(map->hash_fn((_key), map->ctx),\ +- map->cap_bits); \ +- cur = map->buckets ? map->buckets[bkt] : NULL; }); \ ++ for (cur = map->buckets \ ++ ? map->buckets[hash_bits(map->hash_fn((_key), map->ctx), map->cap_bits)] \ ++ : NULL; \ + cur && ({ tmp = cur->next; true; }); \ + cur = tmp) \ + if (map->equal_fn(cur->key, (_key), map->ctx)) +-- +2.27.0 + diff --git a/queue-5.9/mm-memcontrol-fix-missing-wakeup-polling-thread.patch b/queue-5.9/mm-memcontrol-fix-missing-wakeup-polling-thread.patch new file mode 100644 index 00000000000..f62d3c752d2 --- /dev/null +++ b/queue-5.9/mm-memcontrol-fix-missing-wakeup-polling-thread.patch @@ -0,0 +1,58 @@ +From 73439214e1b90b7135fb0f9e825591f5c6164217 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 22:52:13 -0800 +Subject: mm: memcontrol: fix missing wakeup polling thread + +From: Muchun Song + +[ Upstream commit 8b21ca0218d29cc6bb7028125c7e5a10dfb4730c ] + +When we poll the swap.events, we can miss being woken up when the swap +event occurs. Because we didn't notify. + +Fixes: f3a53a3a1e5b ("mm, memcontrol: implement memory.swap.events") +Signed-off-by: Muchun Song +Signed-off-by: Andrew Morton +Reviewed-by: Shakeel Butt +Acked-by: Johannes Weiner +Cc: Roman Gushchin +Cc: Michal Hocko +Cc: Yafang Shao +Cc: Chris Down +Cc: Tejun Heo +Link: https://lkml.kernel.org/r/20201105161936.98312-1-songmuchun@bytedance.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/memcontrol.h | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/include/linux/memcontrol.h b/include/linux/memcontrol.h +index d0b036123c6ab..fa635207fe96d 100644 +--- a/include/linux/memcontrol.h ++++ b/include/linux/memcontrol.h +@@ -897,12 +897,19 @@ static inline void count_memcg_event_mm(struct mm_struct *mm, + static inline void memcg_memory_event(struct mem_cgroup *memcg, + enum memcg_memory_event event) + { ++ bool swap_event = event == MEMCG_SWAP_HIGH || event == MEMCG_SWAP_MAX || ++ event == MEMCG_SWAP_FAIL; ++ + atomic_long_inc(&memcg->memory_events_local[event]); +- cgroup_file_notify(&memcg->events_local_file); ++ if (!swap_event) ++ cgroup_file_notify(&memcg->events_local_file); + + do { + atomic_long_inc(&memcg->memory_events[event]); +- cgroup_file_notify(&memcg->events_file); ++ if (swap_event) ++ cgroup_file_notify(&memcg->swap_events_file); ++ else ++ cgroup_file_notify(&memcg->events_file); + + if (!cgroup_subsys_on_dfl(memory_cgrp_subsys)) + break; +-- +2.27.0 + diff --git a/queue-5.9/nbd-fix-a-block_device-refcount-leak-in-nbd_release.patch b/queue-5.9/nbd-fix-a-block_device-refcount-leak-in-nbd_release.patch new file mode 100644 index 00000000000..513d4a0a36f --- /dev/null +++ b/queue-5.9/nbd-fix-a-block_device-refcount-leak-in-nbd_release.patch @@ -0,0 +1,36 @@ +From e0bfecf82bee9cd8311a1383933315cd98200fa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 18:30:59 +0100 +Subject: nbd: fix a block_device refcount leak in nbd_release + +From: Christoph Hellwig + +[ Upstream commit 2bd645b2d3f0bacadaa6037f067538e1cd4e42ef ] + +bdget_disk needs to be paired with bdput to not leak a reference +on the block device inode. + +Fixes: 08ba91ee6e2c ("nbd: Add the nbd NBD_DISCONNECT_ON_CLOSE config flag.") +Signed-off-by: Christoph Hellwig +Reviewed-by: Josef Bacik +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/nbd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index d76fca629c143..36c46fe078556 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1517,6 +1517,7 @@ static void nbd_release(struct gendisk *disk, fmode_t mode) + if (test_bit(NBD_RT_DISCONNECT_ON_CLOSE, &nbd->config->runtime_flags) && + bdev->bd_openers == 0) + nbd_disconnect_and_put(nbd); ++ bdput(bdev); + + nbd_config_put(nbd); + nbd_put(nbd); +-- +2.27.0 + diff --git a/queue-5.9/net-mlx5-e-switch-avoid-extack-error-log-for-disable.patch b/queue-5.9/net-mlx5-e-switch-avoid-extack-error-log-for-disable.patch new file mode 100644 index 00000000000..bc90d254d6c --- /dev/null +++ b/queue-5.9/net-mlx5-e-switch-avoid-extack-error-log-for-disable.patch @@ -0,0 +1,38 @@ +From 7c2a4f371f55930d03557b0b557085d7fb7946dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 12:41:28 +0200 +Subject: net/mlx5: E-switch, Avoid extack error log for disabled vport + +From: Parav Pandit + +[ Upstream commit ae35859445607f7f18dd4f332749219cd636ed59 ] + +When E-switch vport is disabled, querying its hardware address is +unsupported. +Avoid setting extack error log message in such case. + +Fixes: f099fde16db3 ("net/mlx5: E-switch, Support querying port function mac address") +Signed-off-by: Parav Pandit +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index 6e6a9a5639928..e8e6294c7ccae 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -1902,8 +1902,6 @@ int mlx5_devlink_port_function_hw_addr_get(struct devlink *devlink, + ether_addr_copy(hw_addr, vport->info.mac); + *hw_addr_len = ETH_ALEN; + err = 0; +- } else { +- NL_SET_ERR_MSG_MOD(extack, "Eswitch vport is disabled"); + } + mutex_unlock(&esw->state_lock); + return err; +-- +2.27.0 + diff --git a/queue-5.9/net-mlx5-fix-deletion-of-duplicate-rules.patch b/queue-5.9/net-mlx5-fix-deletion-of-duplicate-rules.patch new file mode 100644 index 00000000000..0326f2a2416 --- /dev/null +++ b/queue-5.9/net-mlx5-fix-deletion-of-duplicate-rules.patch @@ -0,0 +1,47 @@ +From d72dff24d2e0675fa9db47fd32d9990e7caf0db9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 08:42:49 +0300 +Subject: net/mlx5: Fix deletion of duplicate rules + +From: Maor Gottlieb + +[ Upstream commit 465e7baab6d93b399344f5868f84c177ab5cd16f ] + +When a rule is duplicated, the refcount of the rule is increased so only +the second deletion of the rule should cause destruction of the FTE. +Currently, the FTE will be destroyed in the first deletion of rule since +the modify_mask will be 0. +Fix it and call to destroy FTE only if all the rules (FTE's children) +have been removed. + +Fixes: 718ce4d601db ("net/mlx5: Consolidate update FTE for all removal changes") +Signed-off-by: Maor Gottlieb +Reviewed-by: Mark Bloch +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index 75fa44eee434d..d4755d61dd740 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -1994,10 +1994,11 @@ void mlx5_del_flow_rules(struct mlx5_flow_handle *handle) + down_write_ref_node(&fte->node, false); + for (i = handle->num_rules - 1; i >= 0; i--) + tree_remove_node(&handle->rule[i]->node, true); +- if (fte->modify_mask && fte->dests_size) { +- modify_fte(fte); ++ if (fte->dests_size) { ++ if (fte->modify_mask) ++ modify_fte(fte); + up_write_ref_node(&fte->node, false); +- } else { ++ } else if (list_empty(&fte->node.children)) { + del_hw_fte(&fte->node); + /* Avoid double call to del_hw_fte */ + fte->node.del_hw_func = NULL; +-- +2.27.0 + diff --git a/queue-5.9/net-mlx5e-fix-incorrect-access-of-rcu-protected-xdp_.patch b/queue-5.9/net-mlx5e-fix-incorrect-access-of-rcu-protected-xdp_.patch new file mode 100644 index 00000000000..f497917f253 --- /dev/null +++ b/queue-5.9/net-mlx5e-fix-incorrect-access-of-rcu-protected-xdp_.patch @@ -0,0 +1,42 @@ +From ce1c45688e165f7e96a952088325dacd3e763507 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 12:49:51 +0300 +Subject: net/mlx5e: Fix incorrect access of RCU-protected xdp_prog + +From: Maxim Mikityanskiy + +[ Upstream commit 1a50cf9a67ff2241c2949d30bc11c8dd4280eef8 ] + +rq->xdp_prog is RCU-protected and should be accessed only with +rcu_access_pointer for the NULL check in mlx5e_poll_rx_cq. + +rq->xdp_prog may change on the fly only from one non-NULL value to +another non-NULL value, so the checks in mlx5e_xdp_handle and +mlx5e_poll_rx_cq will have the same result during one NAPI cycle, +meaning that no additional synchronization is needed. + +Fixes: fe45386a2082 ("net/mlx5e: Use RCU to protect rq->xdp_prog") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +index 64c8ac5eabf6a..a0a4398408b85 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -1566,7 +1566,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget) + } while ((++work_done < budget) && (cqe = mlx5_cqwq_get_cqe(cqwq))); + + out: +- if (rq->xdp_prog) ++ if (rcu_access_pointer(rq->xdp_prog)) + mlx5e_xdp_rx_poll_complete(rq); + + mlx5_cqwq_update_db_record(cqwq); +-- +2.27.0 + diff --git a/queue-5.9/net-mlx5e-fix-modify-header-actions-memory-leak.patch b/queue-5.9/net-mlx5e-fix-modify-header-actions-memory-leak.patch new file mode 100644 index 00000000000..872a0fc061d --- /dev/null +++ b/queue-5.9/net-mlx5e-fix-modify-header-actions-memory-leak.patch @@ -0,0 +1,49 @@ +From 9a6ee78661655dfac3f772a0516d34b6c2cfb075 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Sep 2020 16:31:11 +0300 +Subject: net/mlx5e: Fix modify header actions memory leak + +From: Maor Dickman + +[ Upstream commit e68e28b4a9d71261e3f8fd05a72d6cf0b443a493 ] + +Modify header actions are allocated during parse tc actions and only +freed during the flow creation, however, on error flow the allocated +memory is wrongly unfreed. + +Fix this by calling dealloc_mod_hdr_actions in __mlx5e_add_fdb_flow +and mlx5e_add_nic_flow error flow. + +Fixes: d7e75a325cb2 ("net/mlx5e: Add offloading of E-Switch TC pedit (header re-write) actions") +Fixes: 2f4fe4cab073 ("net/mlx5e: Add offloading of NIC TC pedit (header re-write) actions") +Signed-off-by: Maor Dickman +Reviewed-by: Paul Blakey +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 1c93f92d9210a..44947b054dc4c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -4430,6 +4430,7 @@ __mlx5e_add_fdb_flow(struct mlx5e_priv *priv, + return flow; + + err_free: ++ dealloc_mod_hdr_actions(&parse_attr->mod_hdr_acts); + mlx5e_flow_put(priv, flow); + out: + return ERR_PTR(err); +@@ -4564,6 +4565,7 @@ mlx5e_add_nic_flow(struct mlx5e_priv *priv, + return 0; + + err_free: ++ dealloc_mod_hdr_actions(&parse_attr->mod_hdr_acts); + mlx5e_flow_put(priv, flow); + kvfree(parse_attr); + out: +-- +2.27.0 + diff --git a/queue-5.9/net-mlx5e-fix-vxlan-synchronization-after-function-r.patch b/queue-5.9/net-mlx5e-fix-vxlan-synchronization-after-function-r.patch new file mode 100644 index 00000000000..83493f336d5 --- /dev/null +++ b/queue-5.9/net-mlx5e-fix-vxlan-synchronization-after-function-r.patch @@ -0,0 +1,103 @@ +From a9458dc93c4f281c891d047b9d393ee421de6962 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Sep 2020 12:58:44 +0300 +Subject: net/mlx5e: Fix VXLAN synchronization after function reload + +From: Aya Levin + +[ Upstream commit c5eb51adf06b2644fa28d4af886bfdcc53e288da ] + +During driver reload, perform firmware tear-down which results in +firmware losing the configured VXLAN ports. These ports are still +available in the driver's database. Fix this by cleaning up driver's +VXLAN database in the nic unload flow, before firmware tear-down. With +that, minimize mlx5_vxlan_destroy() to remove only what was added in +mlx5_vxlan_create() and warn on leftover UDP ports. + +Fixes: 18a2b7f969c9 ("net/mlx5: convert to new udp_tunnel infrastructure") +Signed-off-by: Aya Levin +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en_main.c | 1 + + .../ethernet/mellanox/mlx5/core/lib/vxlan.c | 23 ++++++++++++++----- + .../ethernet/mellanox/mlx5/core/lib/vxlan.h | 2 ++ + 3 files changed, 20 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 42ec28e298348..f399973a44eb0 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -5226,6 +5226,7 @@ static void mlx5e_nic_disable(struct mlx5e_priv *priv) + + mlx5e_disable_async_events(priv); + mlx5_lag_remove(mdev); ++ mlx5_vxlan_reset_to_default(mdev->vxlan); + } + + int mlx5e_update_nic_rx(struct mlx5e_priv *priv) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c +index 3315afe2f8dce..38084400ee8fa 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c +@@ -167,6 +167,17 @@ struct mlx5_vxlan *mlx5_vxlan_create(struct mlx5_core_dev *mdev) + } + + void mlx5_vxlan_destroy(struct mlx5_vxlan *vxlan) ++{ ++ if (!mlx5_vxlan_allowed(vxlan)) ++ return; ++ ++ mlx5_vxlan_del_port(vxlan, IANA_VXLAN_UDP_PORT); ++ WARN_ON(!hash_empty(vxlan->htable)); ++ ++ kfree(vxlan); ++} ++ ++void mlx5_vxlan_reset_to_default(struct mlx5_vxlan *vxlan) + { + struct mlx5_vxlan_port *vxlanp; + struct hlist_node *tmp; +@@ -175,12 +186,12 @@ void mlx5_vxlan_destroy(struct mlx5_vxlan *vxlan) + if (!mlx5_vxlan_allowed(vxlan)) + return; + +- /* Lockless since we are the only hash table consumers*/ + hash_for_each_safe(vxlan->htable, bkt, tmp, vxlanp, hlist) { +- hash_del(&vxlanp->hlist); +- mlx5_vxlan_core_del_port_cmd(vxlan->mdev, vxlanp->udp_port); +- kfree(vxlanp); ++ /* Don't delete default UDP port added by the HW. ++ * Remove only user configured ports ++ */ ++ if (vxlanp->udp_port == IANA_VXLAN_UDP_PORT) ++ continue; ++ mlx5_vxlan_del_port(vxlan, vxlanp->udp_port); + } +- +- kfree(vxlan); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.h +index ec766529f49b6..34ef662da35ed 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.h +@@ -56,6 +56,7 @@ void mlx5_vxlan_destroy(struct mlx5_vxlan *vxlan); + int mlx5_vxlan_add_port(struct mlx5_vxlan *vxlan, u16 port); + int mlx5_vxlan_del_port(struct mlx5_vxlan *vxlan, u16 port); + bool mlx5_vxlan_lookup_port(struct mlx5_vxlan *vxlan, u16 port); ++void mlx5_vxlan_reset_to_default(struct mlx5_vxlan *vxlan); + #else + static inline struct mlx5_vxlan* + mlx5_vxlan_create(struct mlx5_core_dev *mdev) { return ERR_PTR(-EOPNOTSUPP); } +@@ -63,6 +64,7 @@ static inline void mlx5_vxlan_destroy(struct mlx5_vxlan *vxlan) { return; } + static inline int mlx5_vxlan_add_port(struct mlx5_vxlan *vxlan, u16 port) { return -EOPNOTSUPP; } + static inline int mlx5_vxlan_del_port(struct mlx5_vxlan *vxlan, u16 port) { return -EOPNOTSUPP; } + static inline bool mlx5_vxlan_lookup_port(struct mlx5_vxlan *vxlan, u16 port) { return false; } ++static inline void mlx5_vxlan_reset_to_default(struct mlx5_vxlan *vxlan) { return; } + #endif + + #endif /* __MLX5_VXLAN_H__ */ +-- +2.27.0 + diff --git a/queue-5.9/net-mlx5e-protect-encap-route-dev-from-concurrent-re.patch b/queue-5.9/net-mlx5e-protect-encap-route-dev-from-concurrent-re.patch new file mode 100644 index 00000000000..e4eeee4cdff --- /dev/null +++ b/queue-5.9/net-mlx5e-protect-encap-route-dev-from-concurrent-re.patch @@ -0,0 +1,249 @@ +From 7c3a41541ed653c61bda7557d8c31c60cf2416dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Aug 2020 16:17:29 +0300 +Subject: net/mlx5e: Protect encap route dev from concurrent release + +From: Vlad Buslov + +[ Upstream commit 78c906e430b13d30a8cfbdef4ccbbe1686841a9e ] + +In functions mlx5e_route_lookup_ipv{4|6}() route_dev can be arbitrary net +device and not necessary mlx5 eswitch port representor. As such, in order +to ensure that route_dev is not destroyed concurrent the code needs either +explicitly take reference to the device before releasing reference to +rtable instance or ensure that caller holds rtnl lock. First approach is +chosen as a fix since rtnl lock dependency was intentionally removed from +mlx5 TC layer. + +To prevent unprotected usage of route_dev in encap code take a reference to +the device before releasing rt. Don't save direct pointer to the device in +mlx5_encap_entry structure and use ifindex instead. Modify users of +route_dev pointer to properly obtain the net device instance from its +ifindex. + +Fixes: 61086f391044 ("net/mlx5e: Protect encap hash table with mutex") +Fixes: 6707f74be862 ("net/mlx5e: Update hw flows when encap source mac changed") +Signed-off-by: Vlad Buslov +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/en/rep/tc.c | 6 +- + .../ethernet/mellanox/mlx5/core/en/tc_tun.c | 72 ++++++++++++------- + .../net/ethernet/mellanox/mlx5/core/en_rep.h | 2 +- + 3 files changed, 52 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c +index 79cc42d88eec6..38ea249159f60 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/tc.c +@@ -107,12 +107,16 @@ void mlx5e_rep_update_flows(struct mlx5e_priv *priv, + mlx5e_tc_encap_flows_del(priv, e, &flow_list); + + if (neigh_connected && !(e->flags & MLX5_ENCAP_ENTRY_VALID)) { ++ struct net_device *route_dev; ++ + ether_addr_copy(e->h_dest, ha); + ether_addr_copy(eth->h_dest, ha); + /* Update the encap source mac, in case that we delete + * the flows when encap source mac changed. + */ +- ether_addr_copy(eth->h_source, e->route_dev->dev_addr); ++ route_dev = __dev_get_by_index(dev_net(priv->netdev), e->route_dev_ifindex); ++ if (route_dev) ++ ether_addr_copy(eth->h_source, route_dev->dev_addr); + + mlx5e_tc_encap_flows_add(priv, e, &flow_list); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +index 7cce85faa16fa..90930e54b6f28 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c +@@ -77,13 +77,13 @@ static int get_route_and_out_devs(struct mlx5e_priv *priv, + return 0; + } + +-static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv, +- struct net_device *mirred_dev, +- struct net_device **out_dev, +- struct net_device **route_dev, +- struct flowi4 *fl4, +- struct neighbour **out_n, +- u8 *out_ttl) ++static int mlx5e_route_lookup_ipv4_get(struct mlx5e_priv *priv, ++ struct net_device *mirred_dev, ++ struct net_device **out_dev, ++ struct net_device **route_dev, ++ struct flowi4 *fl4, ++ struct neighbour **out_n, ++ u8 *out_ttl) + { + struct neighbour *n; + struct rtable *rt; +@@ -117,18 +117,28 @@ static int mlx5e_route_lookup_ipv4(struct mlx5e_priv *priv, + ip_rt_put(rt); + return ret; + } ++ dev_hold(*route_dev); + + if (!(*out_ttl)) + *out_ttl = ip4_dst_hoplimit(&rt->dst); + n = dst_neigh_lookup(&rt->dst, &fl4->daddr); + ip_rt_put(rt); +- if (!n) ++ if (!n) { ++ dev_put(*route_dev); + return -ENOMEM; ++ } + + *out_n = n; + return 0; + } + ++static void mlx5e_route_lookup_ipv4_put(struct net_device *route_dev, ++ struct neighbour *n) ++{ ++ neigh_release(n); ++ dev_put(route_dev); ++} ++ + static const char *mlx5e_netdev_kind(struct net_device *dev) + { + if (dev->rtnl_link_ops) +@@ -193,8 +203,8 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv, + fl4.saddr = tun_key->u.ipv4.src; + ttl = tun_key->ttl; + +- err = mlx5e_route_lookup_ipv4(priv, mirred_dev, &out_dev, &route_dev, +- &fl4, &n, &ttl); ++ err = mlx5e_route_lookup_ipv4_get(priv, mirred_dev, &out_dev, &route_dev, ++ &fl4, &n, &ttl); + if (err) + return err; + +@@ -223,7 +233,7 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv, + e->m_neigh.family = n->ops->family; + memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len); + e->out_dev = out_dev; +- e->route_dev = route_dev; ++ e->route_dev_ifindex = route_dev->ifindex; + + /* It's important to add the neigh to the hash table before checking + * the neigh validity state. So if we'll get a notification, in case the +@@ -278,7 +288,7 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv, + + e->flags |= MLX5_ENCAP_ENTRY_VALID; + mlx5e_rep_queue_neigh_stats_work(netdev_priv(out_dev)); +- neigh_release(n); ++ mlx5e_route_lookup_ipv4_put(route_dev, n); + return err; + + destroy_neigh_entry: +@@ -286,18 +296,18 @@ destroy_neigh_entry: + free_encap: + kfree(encap_header); + release_neigh: +- neigh_release(n); ++ mlx5e_route_lookup_ipv4_put(route_dev, n); + return err; + } + + #if IS_ENABLED(CONFIG_INET) && IS_ENABLED(CONFIG_IPV6) +-static int mlx5e_route_lookup_ipv6(struct mlx5e_priv *priv, +- struct net_device *mirred_dev, +- struct net_device **out_dev, +- struct net_device **route_dev, +- struct flowi6 *fl6, +- struct neighbour **out_n, +- u8 *out_ttl) ++static int mlx5e_route_lookup_ipv6_get(struct mlx5e_priv *priv, ++ struct net_device *mirred_dev, ++ struct net_device **out_dev, ++ struct net_device **route_dev, ++ struct flowi6 *fl6, ++ struct neighbour **out_n, ++ u8 *out_ttl) + { + struct dst_entry *dst; + struct neighbour *n; +@@ -318,15 +328,25 @@ static int mlx5e_route_lookup_ipv6(struct mlx5e_priv *priv, + return ret; + } + ++ dev_hold(*route_dev); + n = dst_neigh_lookup(dst, &fl6->daddr); + dst_release(dst); +- if (!n) ++ if (!n) { ++ dev_put(*route_dev); + return -ENOMEM; ++ } + + *out_n = n; + return 0; + } + ++static void mlx5e_route_lookup_ipv6_put(struct net_device *route_dev, ++ struct neighbour *n) ++{ ++ neigh_release(n); ++ dev_put(route_dev); ++} ++ + int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, + struct net_device *mirred_dev, + struct mlx5e_encap_entry *e) +@@ -348,8 +368,8 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, + fl6.daddr = tun_key->u.ipv6.dst; + fl6.saddr = tun_key->u.ipv6.src; + +- err = mlx5e_route_lookup_ipv6(priv, mirred_dev, &out_dev, &route_dev, +- &fl6, &n, &ttl); ++ err = mlx5e_route_lookup_ipv6_get(priv, mirred_dev, &out_dev, &route_dev, ++ &fl6, &n, &ttl); + if (err) + return err; + +@@ -378,7 +398,7 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, + e->m_neigh.family = n->ops->family; + memcpy(&e->m_neigh.dst_ip, n->primary_key, n->tbl->key_len); + e->out_dev = out_dev; +- e->route_dev = route_dev; ++ e->route_dev_ifindex = route_dev->ifindex; + + /* It's importent to add the neigh to the hash table before checking + * the neigh validity state. So if we'll get a notification, in case the +@@ -433,7 +453,7 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv, + + e->flags |= MLX5_ENCAP_ENTRY_VALID; + mlx5e_rep_queue_neigh_stats_work(netdev_priv(out_dev)); +- neigh_release(n); ++ mlx5e_route_lookup_ipv6_put(route_dev, n); + return err; + + destroy_neigh_entry: +@@ -441,7 +461,7 @@ destroy_neigh_entry: + free_encap: + kfree(encap_header); + release_neigh: +- neigh_release(n); ++ mlx5e_route_lookup_ipv6_put(route_dev, n); + return err; + } + #endif +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h +index 0d1562e20118c..963a6d98840ac 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.h +@@ -187,7 +187,7 @@ struct mlx5e_encap_entry { + unsigned char h_dest[ETH_ALEN]; /* destination eth addr */ + + struct net_device *out_dev; +- struct net_device *route_dev; ++ int route_dev_ifindex; + struct mlx5e_tc_tunnel *tunnel; + int reformat_type; + u8 flags; +-- +2.27.0 + diff --git a/queue-5.9/net-mlx5e-use-spin_lock_bh-for-async_icosq_lock.patch b/queue-5.9/net-mlx5e-use-spin_lock_bh-for-async_icosq_lock.patch new file mode 100644 index 00000000000..aa149744e7a --- /dev/null +++ b/queue-5.9/net-mlx5e-use-spin_lock_bh-for-async_icosq_lock.patch @@ -0,0 +1,124 @@ +From 17408b2aac6f84f45282473c0ae872d80cbe8323 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 11:34:03 +0300 +Subject: net/mlx5e: Use spin_lock_bh for async_icosq_lock + +From: Maxim Mikityanskiy + +[ Upstream commit f42139ba49791ab6b12443c60044872705b74a1e ] + +async_icosq_lock may be taken from softirq and non-softirq contexts. It +requires protection with spin_lock_bh, otherwise a softirq may be +triggered in the middle of the critical section, and it may deadlock if +it tries to take the same lock. This patch fixes such a scenario by +using spin_lock_bh to disable softirqs on that CPU while inside the +critical section. + +Fixes: 8d94b590f1e4 ("net/mlx5e: Turn XSK ICOSQ into a general asynchronous one") +Signed-off-by: Maxim Mikityanskiy +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/en/xsk/setup.c | 4 ++-- + .../net/ethernet/mellanox/mlx5/core/en/xsk/tx.c | 4 ++-- + .../ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c | 14 +++++++------- + 3 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +index 55e65a438de70..fcaeb30778bc7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c +@@ -122,9 +122,9 @@ void mlx5e_activate_xsk(struct mlx5e_channel *c) + set_bit(MLX5E_RQ_STATE_ENABLED, &c->xskrq.state); + /* TX queue is created active. */ + +- spin_lock(&c->async_icosq_lock); ++ spin_lock_bh(&c->async_icosq_lock); + mlx5e_trigger_irq(&c->async_icosq); +- spin_unlock(&c->async_icosq_lock); ++ spin_unlock_bh(&c->async_icosq_lock); + } + + void mlx5e_deactivate_xsk(struct mlx5e_channel *c) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c +index 4d892f6cecb3e..4de70cee80c0a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/tx.c +@@ -36,9 +36,9 @@ int mlx5e_xsk_wakeup(struct net_device *dev, u32 qid, u32 flags) + if (test_and_set_bit(MLX5E_SQ_STATE_PENDING_XSK_TX, &c->async_icosq.state)) + return 0; + +- spin_lock(&c->async_icosq_lock); ++ spin_lock_bh(&c->async_icosq_lock); + mlx5e_trigger_irq(&c->async_icosq); +- spin_unlock(&c->async_icosq_lock); ++ spin_unlock_bh(&c->async_icosq_lock); + } + + return 0; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +index 6bbfcf18107d2..979ff5658a3f7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +@@ -188,7 +188,7 @@ static int post_rx_param_wqes(struct mlx5e_channel *c, + + err = 0; + sq = &c->async_icosq; +- spin_lock(&c->async_icosq_lock); ++ spin_lock_bh(&c->async_icosq_lock); + + cseg = post_static_params(sq, priv_rx); + if (IS_ERR(cseg)) +@@ -199,7 +199,7 @@ static int post_rx_param_wqes(struct mlx5e_channel *c, + + mlx5e_notify_hw(&sq->wq, sq->pc, sq->uar_map, cseg); + unlock: +- spin_unlock(&c->async_icosq_lock); ++ spin_unlock_bh(&c->async_icosq_lock); + + return err; + +@@ -265,10 +265,10 @@ resync_post_get_progress_params(struct mlx5e_icosq *sq, + + BUILD_BUG_ON(MLX5E_KTLS_GET_PROGRESS_WQEBBS != 1); + +- spin_lock(&sq->channel->async_icosq_lock); ++ spin_lock_bh(&sq->channel->async_icosq_lock); + + if (unlikely(!mlx5e_wqc_has_room_for(&sq->wq, sq->cc, sq->pc, 1))) { +- spin_unlock(&sq->channel->async_icosq_lock); ++ spin_unlock_bh(&sq->channel->async_icosq_lock); + err = -ENOSPC; + goto err_dma_unmap; + } +@@ -299,7 +299,7 @@ resync_post_get_progress_params(struct mlx5e_icosq *sq, + icosq_fill_wi(sq, pi, &wi); + sq->pc++; + mlx5e_notify_hw(&sq->wq, sq->pc, sq->uar_map, cseg); +- spin_unlock(&sq->channel->async_icosq_lock); ++ spin_unlock_bh(&sq->channel->async_icosq_lock); + + return 0; + +@@ -360,7 +360,7 @@ static int resync_handle_seq_match(struct mlx5e_ktls_offload_context_rx *priv_rx + err = 0; + + sq = &c->async_icosq; +- spin_lock(&c->async_icosq_lock); ++ spin_lock_bh(&c->async_icosq_lock); + + cseg = post_static_params(sq, priv_rx); + if (IS_ERR(cseg)) { +@@ -372,7 +372,7 @@ static int resync_handle_seq_match(struct mlx5e_ktls_offload_context_rx *priv_rx + mlx5e_notify_hw(&sq->wq, sq->pc, sq->uar_map, cseg); + priv_rx->stats->tls_resync_res_ok++; + unlock: +- spin_unlock(&c->async_icosq_lock); ++ spin_unlock_bh(&c->async_icosq_lock); + + return err; + } +-- +2.27.0 + diff --git a/queue-5.9/net-phy-realtek-support-paged-operations-on-rtl8201c.patch b/queue-5.9/net-phy-realtek-support-paged-operations-on-rtl8201c.patch new file mode 100644 index 00000000000..959b65be429 --- /dev/null +++ b/queue-5.9/net-phy-realtek-support-paged-operations-on-rtl8201c.patch @@ -0,0 +1,39 @@ +From 6ed62dfe8d72a9abb984ca95da1318666c208b02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 22:44:02 +0100 +Subject: net: phy: realtek: support paged operations on RTL8201CP + +From: Heiner Kallweit + +[ Upstream commit f3037c5a31b58a73b32a36e938ad0560085acadd ] + +The RTL8401-internal PHY identifies as RTL8201CP, and the init +sequence in r8169, copied from vendor driver r8168, uses paged +operations. Therefore set the same paged operation callbacks as +for the other Realtek PHY's. + +Fixes: cdafdc29ef75 ("r8169: sync support for RTL8401 with vendor driver") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/69882f7a-ca2f-e0c7-ae83-c9b6937282cd@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/realtek.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/phy/realtek.c b/drivers/net/phy/realtek.c +index 0f09609718007..81a614f903c4a 100644 +--- a/drivers/net/phy/realtek.c ++++ b/drivers/net/phy/realtek.c +@@ -542,6 +542,8 @@ static struct phy_driver realtek_drvs[] = { + { + PHY_ID_MATCH_EXACT(0x00008201), + .name = "RTL8201CP Ethernet", ++ .read_page = rtl821x_read_page, ++ .write_page = rtl821x_write_page, + }, { + PHY_ID_MATCH_EXACT(0x001cc816), + .name = "RTL8201F Fast Ethernet", +-- +2.27.0 + diff --git a/queue-5.9/nfs-fix-listxattr-receive-buffer-size.patch b/queue-5.9/nfs-fix-listxattr-receive-buffer-size.patch new file mode 100644 index 00000000000..2761bd3f893 --- /dev/null +++ b/queue-5.9/nfs-fix-listxattr-receive-buffer-size.patch @@ -0,0 +1,58 @@ +From 7d986b71c47e98ad6ff68443ff6db44afd7dcea1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Oct 2020 12:44:25 -0400 +Subject: NFS: Fix listxattr receive buffer size + +From: Chuck Lever + +[ Upstream commit 6c2190b3fcbc92cb79e39cc7e7531656b341e463 ] + +Certain NFSv4.2/RDMA tests fail with v5.9-rc1. + +rpcrdma_convert_kvec() runs off the end of the rl_segments array +because rq_rcv_buf.tail[0].iov_len holds a very large positive +value. The resultant kernel memory corruption is enough to crash +the client system. + +Callers of rpc_prepare_reply_pages() must reserve an extra XDR_UNIT +in the maximum decode size for a possible XDR pad of the contents +of the xdr_buf's pages. That guarantees the allocated receive buffer +will be large enough to accommodate the usual contents plus that XDR +pad word. + +encode_op_hdr() cannot add that extra word. If it does, +xdr_inline_pages() underruns the length of the tail iovec. + +Fixes: 3e1f02123fba ("NFSv4.2: add client side XDR handling for extended attributes") +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs42xdr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c +index cc50085e151c5..d0ddf90c9be48 100644 +--- a/fs/nfs/nfs42xdr.c ++++ b/fs/nfs/nfs42xdr.c +@@ -179,7 +179,7 @@ + 1 + nfs4_xattr_name_maxsz + 1) + #define decode_setxattr_maxsz (op_decode_hdr_maxsz + decode_change_info_maxsz) + #define encode_listxattrs_maxsz (op_encode_hdr_maxsz + 2 + 1) +-#define decode_listxattrs_maxsz (op_decode_hdr_maxsz + 2 + 1 + 1) ++#define decode_listxattrs_maxsz (op_decode_hdr_maxsz + 2 + 1 + 1 + 1) + #define encode_removexattr_maxsz (op_encode_hdr_maxsz + 1 + \ + nfs4_xattr_name_maxsz) + #define decode_removexattr_maxsz (op_decode_hdr_maxsz + \ +@@ -504,7 +504,7 @@ static void encode_listxattrs(struct xdr_stream *xdr, + { + __be32 *p; + +- encode_op_hdr(xdr, OP_LISTXATTRS, decode_listxattrs_maxsz + 1, hdr); ++ encode_op_hdr(xdr, OP_LISTXATTRS, decode_listxattrs_maxsz, hdr); + + p = reserve_space(xdr, 12); + if (unlikely(!p)) +-- +2.27.0 + diff --git a/queue-5.9/nfsd-fix-missing-refcount-in-nfsd4_copy-by-nfsd4_do_.patch b/queue-5.9/nfsd-fix-missing-refcount-in-nfsd4_copy-by-nfsd4_do_.patch new file mode 100644 index 00000000000..f3238403992 --- /dev/null +++ b/queue-5.9/nfsd-fix-missing-refcount-in-nfsd4_copy-by-nfsd4_do_.patch @@ -0,0 +1,35 @@ +From a2e97aa8a22b05b1c871320863abca53983eba0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 15:07:16 -0400 +Subject: NFSD: fix missing refcount in nfsd4_copy by nfsd4_do_async_copy + +From: Dai Ngo + +[ Upstream commit 49a361327332c9221438397059067f9b205f690d ] + +Need to initialize nfsd4_copy's refcount to 1 to avoid use-after-free +warning when nfs4_put_copy is called from nfsd4_cb_offload_release. + +Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy") +Signed-off-by: Dai Ngo +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4proc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 80effaa18b7b2..3ba17b5fc9286 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1486,6 +1486,7 @@ do_callback: + cb_copy = kzalloc(sizeof(struct nfsd4_copy), GFP_KERNEL); + if (!cb_copy) + goto out; ++ refcount_set(&cb_copy->refcount, 1); + memcpy(&cb_copy->cp_res, ©->cp_res, sizeof(copy->cp_res)); + cb_copy->cp_clp = copy->cp_clp; + cb_copy->nfserr = copy->nfserr; +-- +2.27.0 + diff --git a/queue-5.9/nfsd-fix-use-after-free-warning-when-doing-inter-ser.patch b/queue-5.9/nfsd-fix-use-after-free-warning-when-doing-inter-ser.patch new file mode 100644 index 00000000000..d144e18265e --- /dev/null +++ b/queue-5.9/nfsd-fix-use-after-free-warning-when-doing-inter-ser.patch @@ -0,0 +1,38 @@ +From 0b4977be487eabbdecf6197ef023ded08055b663 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 15:07:15 -0400 +Subject: NFSD: Fix use-after-free warning when doing inter-server copy + +From: Dai Ngo + +[ Upstream commit 36e1e5ba90fb3fba6888fae26e4dfc28bf70aaf1 ] + +The source file nfsd_file is not constructed the same as other +nfsd_file's via nfsd_file_alloc. nfsd_file_put should not be +called to free the object; nfsd_file_put is not the inverse of +kzalloc, instead kfree is called by nfsd4_do_async_copy when done. + +Fixes: ce0887ac96d3 ("NFSD add nfs4 inter ssc to nfsd4_copy") +Signed-off-by: Dai Ngo +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4proc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 84e10aef14175..80effaa18b7b2 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1299,7 +1299,7 @@ nfsd4_cleanup_inter_ssc(struct vfsmount *ss_mnt, struct nfsd_file *src, + struct nfsd_file *dst) + { + nfs42_ssc_close(src->nf_file); +- nfsd_file_put(src); ++ /* 'src' is freed by nfsd4_do_async_copy */ + nfsd_file_put(dst); + mntput(ss_mnt); + } +-- +2.27.0 + diff --git a/queue-5.9/nvme-factor-out-a-nvme_configure_metadata-helper.patch b/queue-5.9/nvme-factor-out-a-nvme_configure_metadata-helper.patch new file mode 100644 index 00000000000..540c9cd341a --- /dev/null +++ b/queue-5.9/nvme-factor-out-a-nvme_configure_metadata-helper.patch @@ -0,0 +1,123 @@ +From dd6e2d179de3c89137d44672775665e01117e310 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 07:19:13 +0200 +Subject: nvme: factor out a nvme_configure_metadata helper + +From: Christoph Hellwig + +[ Upstream commit d4609ea8b3d3fb3423f35805843a82774cb4ef2f ] + +Factor out a helper from nvme_update_ns_info that configures the +per-namespaces metadata and PI settings. Also make sure the helpers +clear the flags explicitly instead of all of ->features to allow for +potentially reusing ->features for future non-metadata flags. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 78 ++++++++++++++++++++++++---------------- + 1 file changed, 47 insertions(+), 31 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 59040bab5d6fa..be0cec51f5e6d 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1946,6 +1946,50 @@ static int nvme_setup_streams_ns(struct nvme_ctrl *ctrl, struct nvme_ns *ns, + return 0; + } + ++static int nvme_configure_metadata(struct nvme_ns *ns, struct nvme_id_ns *id) ++{ ++ struct nvme_ctrl *ctrl = ns->ctrl; ++ ++ /* ++ * The PI implementation requires the metadata size to be equal to the ++ * t10 pi tuple size. ++ */ ++ ns->ms = le16_to_cpu(id->lbaf[id->flbas & NVME_NS_FLBAS_LBA_MASK].ms); ++ if (ns->ms == sizeof(struct t10_pi_tuple)) ++ ns->pi_type = id->dps & NVME_NS_DPS_PI_MASK; ++ else ++ ns->pi_type = 0; ++ ++ ns->features &= ~(NVME_NS_METADATA_SUPPORTED | NVME_NS_EXT_LBAS); ++ if (!ns->ms || !(ctrl->ops->flags & NVME_F_METADATA_SUPPORTED)) ++ return 0; ++ if (ctrl->ops->flags & NVME_F_FABRICS) { ++ /* ++ * The NVMe over Fabrics specification only supports metadata as ++ * part of the extended data LBA. We rely on HCA/HBA support to ++ * remap the separate metadata buffer from the block layer. ++ */ ++ if (WARN_ON_ONCE(!(id->flbas & NVME_NS_FLBAS_META_EXT))) ++ return -EINVAL; ++ if (ctrl->max_integrity_segments) ++ ns->features |= ++ (NVME_NS_METADATA_SUPPORTED | NVME_NS_EXT_LBAS); ++ } else { ++ /* ++ * For PCIe controllers, we can't easily remap the separate ++ * metadata buffer from the block layer and thus require a ++ * separate metadata buffer for block layer metadata/PI support. ++ * We allow extended LBAs for the passthrough interface, though. ++ */ ++ if (id->flbas & NVME_NS_FLBAS_META_EXT) ++ ns->features |= NVME_NS_EXT_LBAS; ++ else ++ ns->features |= NVME_NS_METADATA_SUPPORTED; ++ } ++ ++ return 0; ++} ++ + static void nvme_update_disk_info(struct gendisk *disk, + struct nvme_ns *ns, struct nvme_id_ns *id) + { +@@ -2096,37 +2140,9 @@ static int __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id) + return -ENODEV; + } + +- ns->features = 0; +- ns->ms = le16_to_cpu(id->lbaf[lbaf].ms); +- /* the PI implementation requires metadata equal t10 pi tuple size */ +- if (ns->ms == sizeof(struct t10_pi_tuple)) +- ns->pi_type = id->dps & NVME_NS_DPS_PI_MASK; +- else +- ns->pi_type = 0; +- +- if (ns->ms) { +- /* +- * For PCIe only the separate metadata pointer is supported, +- * as the block layer supplies metadata in a separate bio_vec +- * chain. For Fabrics, only metadata as part of extended data +- * LBA is supported on the wire per the Fabrics specification, +- * but the HBA/HCA will do the remapping from the separate +- * metadata buffers for us. +- */ +- if (id->flbas & NVME_NS_FLBAS_META_EXT) { +- ns->features |= NVME_NS_EXT_LBAS; +- if ((ctrl->ops->flags & NVME_F_FABRICS) && +- (ctrl->ops->flags & NVME_F_METADATA_SUPPORTED) && +- ctrl->max_integrity_segments) +- ns->features |= NVME_NS_METADATA_SUPPORTED; +- } else { +- if (WARN_ON_ONCE(ctrl->ops->flags & NVME_F_FABRICS)) +- return -EINVAL; +- if (ctrl->ops->flags & NVME_F_METADATA_SUPPORTED) +- ns->features |= NVME_NS_METADATA_SUPPORTED; +- } +- } +- ++ ret = nvme_configure_metadata(ns, id); ++ if (ret) ++ return ret; + nvme_set_chunk_sectors(ns, id); + nvme_update_disk_info(disk, ns, id); + #ifdef CONFIG_NVME_MULTIPATH +-- +2.27.0 + diff --git a/queue-5.9/nvme-fix-incorrect-behavior-when-blkroset-is-called-.patch b/queue-5.9/nvme-fix-incorrect-behavior-when-blkroset-is-called-.patch new file mode 100644 index 00000000000..22ad7bbddf1 --- /dev/null +++ b/queue-5.9/nvme-fix-incorrect-behavior-when-blkroset-is-called-.patch @@ -0,0 +1,38 @@ +From 60381785be6b6018ea4171a7a7757dc2460bd17b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 02:57:34 -0800 +Subject: nvme: fix incorrect behavior when BLKROSET is called by the user + +From: Sagi Grimberg + +[ Upstream commit 65c5a055b0d567b7e7639d942c0605da9cc54c5e ] + +The offending commit breaks BLKROSET ioctl because a device +revalidation will blindly override BLKROSET setting. Hence, +we remove the disk rw setting in case NVME_NS_ATTR_RO is cleared +from by the controller. + +Fixes: 1293477f4f32 ("nvme: set gendisk read only based on nsattr") +Signed-off-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index b130696b00592..349fba056cb65 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2064,8 +2064,6 @@ static void nvme_update_disk_info(struct gendisk *disk, + + if (id->nsattr & NVME_NS_ATTR_RO) + set_disk_ro(disk, true); +- else +- set_disk_ro(disk, false); + } + + static inline bool nvme_first_scan(struct gendisk *disk) +-- +2.27.0 + diff --git a/queue-5.9/nvme-freeze-the-queue-over-lba_shift-updates.patch b/queue-5.9/nvme-freeze-the-queue-over-lba_shift-updates.patch new file mode 100644 index 00000000000..a7fa596adae --- /dev/null +++ b/queue-5.9/nvme-freeze-the-queue-over-lba_shift-updates.patch @@ -0,0 +1,94 @@ +From 58bb516bd006fc2315a04bce9222267c8ae4eb63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 17:07:55 -0500 +Subject: nvme: freeze the queue over ->lba_shift updates + +[ Upstream commit f9d5f4579feafa721dba2f350fc064a1852c6f8c ] + +Ensure that there can't be any I/O in flight went we change the disk +geometry in nvme_update_ns_info, most notable the LBA size by lifting +the queue free from nvme_update_disk_info into the caller + +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Damien Le Moal +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index be0cec51f5e6d..b130696b00592 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -2001,7 +2001,7 @@ static void nvme_update_disk_info(struct gendisk *disk, + /* unsupported block size, set capacity to 0 later */ + bs = (1 << 9); + } +- blk_mq_freeze_queue(disk->queue); ++ + blk_integrity_unregister(disk); + + atomic_bs = phys_bs = bs; +@@ -2066,8 +2066,6 @@ static void nvme_update_disk_info(struct gendisk *disk, + set_disk_ro(disk, true); + else + set_disk_ro(disk, false); +- +- blk_mq_unfreeze_queue(disk->queue); + } + + static inline bool nvme_first_scan(struct gendisk *disk) +@@ -2114,6 +2112,7 @@ static int __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id) + struct nvme_ctrl *ctrl = ns->ctrl; + int ret; + ++ blk_mq_freeze_queue(ns->disk->queue); + /* + * If identify namespace failed, use default 512 byte block size so + * block layer can use before failing read/write for 0 capacity. +@@ -2131,29 +2130,38 @@ static int __nvme_revalidate_disk(struct gendisk *disk, struct nvme_id_ns *id) + dev_warn(ctrl->device, + "failed to add zoned namespace:%u ret:%d\n", + ns->head->ns_id, ret); +- return ret; ++ goto out_unfreeze; + } + break; + default: + dev_warn(ctrl->device, "unknown csi:%u ns:%u\n", + ns->head->ids.csi, ns->head->ns_id); +- return -ENODEV; ++ ret = -ENODEV; ++ goto out_unfreeze; + } + + ret = nvme_configure_metadata(ns, id); + if (ret) +- return ret; ++ goto out_unfreeze; + nvme_set_chunk_sectors(ns, id); + nvme_update_disk_info(disk, ns, id); ++ blk_mq_unfreeze_queue(ns->disk->queue); ++ + #ifdef CONFIG_NVME_MULTIPATH + if (ns->head->disk) { ++ blk_mq_freeze_queue(ns->head->disk->queue); + nvme_update_disk_info(ns->head->disk, ns, id); + blk_stack_limits(&ns->head->disk->queue->limits, + &ns->queue->limits, 0); + nvme_mpath_update_disk_size(ns->head->disk); ++ blk_mq_unfreeze_queue(ns->head->disk->queue); + } + #endif + return 0; ++ ++out_unfreeze: ++ blk_mq_unfreeze_queue(ns->disk->queue); ++ return ret; + } + + static int _nvme_revalidate_disk(struct gendisk *disk) +-- +2.27.0 + diff --git a/queue-5.9/of-address-fix-of_node-memory-leak-in-of_dma_is_cohe.patch b/queue-5.9/of-address-fix-of_node-memory-leak-in-of_dma_is_cohe.patch new file mode 100644 index 00000000000..0ebe6a29971 --- /dev/null +++ b/queue-5.9/of-address-fix-of_node-memory-leak-in-of_dma_is_cohe.patch @@ -0,0 +1,47 @@ +From 5560234426e0974ae75609b4fdafb24391add8fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Nov 2020 15:28:25 +1300 +Subject: of/address: Fix of_node memory leak in of_dma_is_coherent + +From: Evan Nimmo + +[ Upstream commit a5bea04fcc0b3c0aec71ee1fd58fd4ff7ee36177 ] + +Commit dabf6b36b83a ("of: Add OF_DMA_DEFAULT_COHERENT & select it on +powerpc") added a check to of_dma_is_coherent which returns early +if OF_DMA_DEFAULT_COHERENT is enabled. This results in the of_node_put() +being skipped causing a memory leak. Moved the of_node_get() below this +check so we now we only get the node if OF_DMA_DEFAULT_COHERENT is not +enabled. + +Fixes: dabf6b36b83a ("of: Add OF_DMA_DEFAULT_COHERENT & select it on powerpc") +Signed-off-by: Evan Nimmo +Link: https://lore.kernel.org/r/20201110022825.30895-1-evan.nimmo@alliedtelesis.co.nz +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/address.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/of/address.c b/drivers/of/address.c +index da4f7341323f2..37ac311843090 100644 +--- a/drivers/of/address.c ++++ b/drivers/of/address.c +@@ -1043,11 +1043,13 @@ out: + */ + bool of_dma_is_coherent(struct device_node *np) + { +- struct device_node *node = of_node_get(np); ++ struct device_node *node; + + if (IS_ENABLED(CONFIG_OF_DMA_DEFAULT_COHERENT)) + return true; + ++ node = of_node_get(np); ++ + while (node) { + if (of_property_read_bool(node, "dma-coherent")) { + of_node_put(node); +-- +2.27.0 + diff --git a/queue-5.9/perf-fix-event-multiplexing-for-exclusive-groups.patch b/queue-5.9/perf-fix-event-multiplexing-for-exclusive-groups.patch new file mode 100644 index 00000000000..31347441533 --- /dev/null +++ b/queue-5.9/perf-fix-event-multiplexing-for-exclusive-groups.patch @@ -0,0 +1,48 @@ +From bb9a46bfe66f54443c68aaed039ad1fedeaf7679 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 16:29:53 +0100 +Subject: perf: Fix event multiplexing for exclusive groups + +From: Peter Zijlstra + +[ Upstream commit 2714c3962f304d031d5016c963c4b459337b0749 ] + +Commit 9e6302056f80 ("perf: Use hrtimers for event multiplexing") +placed the hrtimer (re)start call in the wrong place. Instead of +capturing all scheduling failures, it only considered the PMU failure. + +The result is that groups using perf_event_attr::exclusive are no +longer rotated. + +Fixes: 9e6302056f80 ("perf: Use hrtimers for event multiplexing") +Reported-by: Andi Kleen +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20201029162902.038667689@infradead.org +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index c245ccd426b71..a06ac60d346f1 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -2597,7 +2597,6 @@ group_error: + + error: + pmu->cancel_txn(pmu); +- perf_mux_hrtimer_restart(cpuctx); + return -EAGAIN; + } + +@@ -3653,6 +3652,7 @@ static int merge_sched_in(struct perf_event *event, void *data) + + *can_add_hw = 0; + ctx->rotate_necessary = 1; ++ perf_mux_hrtimer_restart(cpuctx); + } + + return 0; +-- +2.27.0 + diff --git a/queue-5.9/perf-fix-get_recursion_context.patch b/queue-5.9/perf-fix-get_recursion_context.patch new file mode 100644 index 00000000000..a7a45ebcde5 --- /dev/null +++ b/queue-5.9/perf-fix-get_recursion_context.patch @@ -0,0 +1,35 @@ +From 5730fe2a2f96e5f2dcbfeaa0a7c42244eeeccd46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 12:49:45 +0100 +Subject: perf: Fix get_recursion_context() + +From: Peter Zijlstra + +[ Upstream commit ce0f17fc93f63ee91428af10b7b2ddef38cd19e5 ] + +One should use in_serving_softirq() to detect SoftIRQ context. + +Fixes: 96f6d4444302 ("perf_counter: avoid recursion") +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20201030151955.120572175@infradead.org +Signed-off-by: Sasha Levin +--- + kernel/events/internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/events/internal.h b/kernel/events/internal.h +index fcbf5616a4411..402054e755f27 100644 +--- a/kernel/events/internal.h ++++ b/kernel/events/internal.h +@@ -211,7 +211,7 @@ static inline int get_recursion_context(int *recursion) + rctx = 3; + else if (in_irq()) + rctx = 2; +- else if (in_softirq()) ++ else if (in_serving_softirq()) + rctx = 1; + else + rctx = 0; +-- +2.27.0 + diff --git a/queue-5.9/perf-simplify-group_sched_in.patch b/queue-5.9/perf-simplify-group_sched_in.patch new file mode 100644 index 00000000000..f100cffa96a --- /dev/null +++ b/queue-5.9/perf-simplify-group_sched_in.patch @@ -0,0 +1,52 @@ +From 4de04202c7643c0bd577810e49bd482068dcf91d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 16:29:15 +0100 +Subject: perf: Simplify group_sched_in() + +From: Peter Zijlstra + +[ Upstream commit 251ff2d49347793d348babcff745289b11910e96 ] + +Collate the error paths. Code duplication only leads to divergence and +extra bugs. + +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20201029162901.972161394@infradead.org +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 98a603098f23e..c245ccd426b71 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -2565,11 +2565,8 @@ group_sched_in(struct perf_event *group_event, + + pmu->start_txn(pmu, PERF_PMU_TXN_ADD); + +- if (event_sched_in(group_event, cpuctx, ctx)) { +- pmu->cancel_txn(pmu); +- perf_mux_hrtimer_restart(cpuctx); +- return -EAGAIN; +- } ++ if (event_sched_in(group_event, cpuctx, ctx)) ++ goto error; + + /* + * Schedule in siblings as one group (if any): +@@ -2598,10 +2595,9 @@ group_error: + } + event_sched_out(group_event, cpuctx, ctx); + ++error: + pmu->cancel_txn(pmu); +- + perf_mux_hrtimer_restart(cpuctx); +- + return -EAGAIN; + } + +-- +2.27.0 + diff --git a/queue-5.9/pinctrl-aspeed-fix-gpi-only-function-problem.patch b/queue-5.9/pinctrl-aspeed-fix-gpi-only-function-problem.patch new file mode 100644 index 00000000000..b95d9d6b364 --- /dev/null +++ b/queue-5.9/pinctrl-aspeed-fix-gpi-only-function-problem.patch @@ -0,0 +1,50 @@ +From 03bc0d9ecdb368e5bcebd6eabfdb2d3e39b66af4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 13:54:50 +0800 +Subject: pinctrl: aspeed: Fix GPI only function problem. + +From: Billy Tsai + +[ Upstream commit 9b92f5c51e9a41352d665f6f956bd95085a56a83 ] + +Some gpio pin at aspeed soc is input only and the prefix name of these +pin is "GPI" only. +This patch fine-tune the condition of GPIO check from "GPIO" to "GPI" +and it will fix the usage error of banks D and E in the AST2400/AST2500 +and banks T and U in the AST2600. + +Fixes: 4d3d0e4272d8 ("pinctrl: Add core support for Aspeed SoCs") +Signed-off-by: Billy Tsai +Reviewed-by: Andrew Jeffery +Link: https://lore.kernel.org/r/20201030055450.29613-1-billy_tsai@aspeedtech.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/aspeed/pinctrl-aspeed.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed.c b/drivers/pinctrl/aspeed/pinctrl-aspeed.c +index 3e6567355d97d..1d603732903fe 100644 +--- a/drivers/pinctrl/aspeed/pinctrl-aspeed.c ++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed.c +@@ -286,13 +286,14 @@ int aspeed_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned int function, + static bool aspeed_expr_is_gpio(const struct aspeed_sig_expr *expr) + { + /* +- * The signal type is GPIO if the signal name has "GPIO" as a prefix. ++ * The signal type is GPIO if the signal name has "GPI" as a prefix. + * strncmp (rather than strcmp) is used to implement the prefix + * requirement. + * +- * expr->signal might look like "GPIOT3" in the GPIO case. ++ * expr->signal might look like "GPIOB1" in the GPIO case. ++ * expr->signal might look like "GPIT0" in the GPI case. + */ +- return strncmp(expr->signal, "GPIO", 4) == 0; ++ return strncmp(expr->signal, "GPI", 3) == 0; + } + + static bool aspeed_gpio_in_exprs(const struct aspeed_sig_expr **exprs) +-- +2.27.0 + diff --git a/queue-5.9/pinctrl-intel-fix-2-kohm-bias-which-is-833-ohm.patch b/queue-5.9/pinctrl-intel-fix-2-kohm-bias-which-is-833-ohm.patch new file mode 100644 index 00000000000..7e2b1ee96d9 --- /dev/null +++ b/queue-5.9/pinctrl-intel-fix-2-kohm-bias-which-is-833-ohm.patch @@ -0,0 +1,120 @@ +From 7e14b752bcf35bf0f909a9e679f3becb6217ba4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Oct 2020 13:46:37 +0300 +Subject: pinctrl: intel: Fix 2 kOhm bias which is 833 Ohm + +From: Andy Shevchenko + +[ Upstream commit dd26209bc56886cacdbd828571e54a6bca251e55 ] + +2 kOhm bias was never an option in Intel GPIO hardware, the available +matrix is: + + 000 none + 001 1 kOhm (if available) + 010 5 kOhm + 100 20 kOhm + +As easy to get the 3 resistors are gated separately and according to +parallel circuits calculations we may get combinations of the above where +the result is always strictly less than minimal resistance. Hence, +additional values can be: + + 011 ~833.3 Ohm + 101 ~952.4 Ohm + 110 ~4 kOhm + 111 ~800 Ohm + +That said, convert TERM definitions to be the bit masks to reflect the above. + +While at it, enable the same setting for pull down case. + +Fixes: 7981c0015af2 ("pinctrl: intel: Add Intel Sunrisepoint pin controller and GPIO support") +Cc: Jamie McClymont +Signed-off-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-intel.c | 32 ++++++++++++++++++--------- + 1 file changed, 22 insertions(+), 10 deletions(-) + +diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c +index b64997b303e0c..b738b28239bd4 100644 +--- a/drivers/pinctrl/intel/pinctrl-intel.c ++++ b/drivers/pinctrl/intel/pinctrl-intel.c +@@ -62,10 +62,10 @@ + #define PADCFG1_TERM_UP BIT(13) + #define PADCFG1_TERM_SHIFT 10 + #define PADCFG1_TERM_MASK GENMASK(12, 10) +-#define PADCFG1_TERM_20K 4 +-#define PADCFG1_TERM_2K 3 +-#define PADCFG1_TERM_5K 2 +-#define PADCFG1_TERM_1K 1 ++#define PADCFG1_TERM_20K BIT(2) ++#define PADCFG1_TERM_5K BIT(1) ++#define PADCFG1_TERM_1K BIT(0) ++#define PADCFG1_TERM_833 (BIT(1) | BIT(0)) + + #define PADCFG2 0x008 + #define PADCFG2_DEBEN BIT(0) +@@ -549,12 +549,12 @@ static int intel_config_get_pull(struct intel_pinctrl *pctrl, unsigned int pin, + return -EINVAL; + + switch (term) { ++ case PADCFG1_TERM_833: ++ *arg = 833; ++ break; + case PADCFG1_TERM_1K: + *arg = 1000; + break; +- case PADCFG1_TERM_2K: +- *arg = 2000; +- break; + case PADCFG1_TERM_5K: + *arg = 5000; + break; +@@ -570,6 +570,11 @@ static int intel_config_get_pull(struct intel_pinctrl *pctrl, unsigned int pin, + return -EINVAL; + + switch (term) { ++ case PADCFG1_TERM_833: ++ if (!(community->features & PINCTRL_FEATURE_1K_PD)) ++ return -EINVAL; ++ *arg = 833; ++ break; + case PADCFG1_TERM_1K: + if (!(community->features & PINCTRL_FEATURE_1K_PD)) + return -EINVAL; +@@ -685,12 +690,12 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin, + case 5000: + value |= PADCFG1_TERM_5K << PADCFG1_TERM_SHIFT; + break; +- case 2000: +- value |= PADCFG1_TERM_2K << PADCFG1_TERM_SHIFT; +- break; + case 1000: + value |= PADCFG1_TERM_1K << PADCFG1_TERM_SHIFT; + break; ++ case 833: ++ value |= PADCFG1_TERM_833 << PADCFG1_TERM_SHIFT; ++ break; + default: + ret = -EINVAL; + } +@@ -714,6 +719,13 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin, + } + value |= PADCFG1_TERM_1K << PADCFG1_TERM_SHIFT; + break; ++ case 833: ++ if (!(community->features & PINCTRL_FEATURE_1K_PD)) { ++ ret = -EINVAL; ++ break; ++ } ++ value |= PADCFG1_TERM_833 << PADCFG1_TERM_SHIFT; ++ break; + default: + ret = -EINVAL; + } +-- +2.27.0 + diff --git a/queue-5.9/pinctrl-intel-set-default-bias-in-case-no-particular.patch b/queue-5.9/pinctrl-intel-set-default-bias-in-case-no-particular.patch new file mode 100644 index 00000000000..b6a4b02868d --- /dev/null +++ b/queue-5.9/pinctrl-intel-set-default-bias-in-case-no-particular.patch @@ -0,0 +1,58 @@ +From 00440429c7e421b29f478bef176a526bed0e857a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Oct 2020 13:46:38 +0300 +Subject: pinctrl: intel: Set default bias in case no particular value given + +From: Andy Shevchenko + +[ Upstream commit f3c75e7a9349d1d33eb53ddc1b31640994969f73 ] + +When GPIO library asks pin control to set the bias, it doesn't pass +any value of it and argument is considered boolean (and this is true +for ACPI GpioIo() / GpioInt() resources, by the way). Thus, individual +drivers must behave well, when they got the resistance value of 1 Ohm, +i.e. transforming it to sane default. + +In case of Intel pin control hardware the 5 kOhm sounds plausible +because on one hand it's a minimum of resistors present in all +hardware generations and at the same time it's high enough to minimize +leakage current (will be only 200 uA with the above choice). + +Fixes: e57725eabf87 ("pinctrl: intel: Add support for hardware debouncer") +Reported-by: Jamie McClymont +Signed-off-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-intel.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c +index b738b28239bd4..31e7840bc5e25 100644 +--- a/drivers/pinctrl/intel/pinctrl-intel.c ++++ b/drivers/pinctrl/intel/pinctrl-intel.c +@@ -683,6 +683,10 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin, + + value |= PADCFG1_TERM_UP; + ++ /* Set default strength value in case none is given */ ++ if (arg == 1) ++ arg = 5000; ++ + switch (arg) { + case 20000: + value |= PADCFG1_TERM_20K << PADCFG1_TERM_SHIFT; +@@ -705,6 +709,10 @@ static int intel_config_set_pull(struct intel_pinctrl *pctrl, unsigned int pin, + case PIN_CONFIG_BIAS_PULL_DOWN: + value &= ~(PADCFG1_TERM_UP | PADCFG1_TERM_MASK); + ++ /* Set default strength value in case none is given */ ++ if (arg == 1) ++ arg = 5000; ++ + switch (arg) { + case 20000: + value |= PADCFG1_TERM_20K << PADCFG1_TERM_SHIFT; +-- +2.27.0 + diff --git a/queue-5.9/pinctrl-mcp23s08-use-full-chunk-of-memory-for-regmap.patch b/queue-5.9/pinctrl-mcp23s08-use-full-chunk-of-memory-for-regmap.patch new file mode 100644 index 00000000000..9647aa9a4f1 --- /dev/null +++ b/queue-5.9/pinctrl-mcp23s08-use-full-chunk-of-memory-for-regmap.patch @@ -0,0 +1,47 @@ +From 9675ee6daca1a5148fa14e5bcaded49584e34696 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 21:08:55 +0300 +Subject: pinctrl: mcp23s08: Use full chunk of memory for regmap configuration +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit 2b12c13637134897ba320bd8906a8d918ee7069b ] + +It appears that simplification of mcp23s08_spi_regmap_init() made +a regression due to wrong size calculation for dev_kmemdup() call. +It misses the fact that config variable is already a pointer, thus +the sizeof() calculation is wrong and only 4 or 8 bytes were copied. + +Fix the parameters to devm_kmemdup() to copy a full chunk of memory. + +Fixes: 0874758ecb2b ("pinctrl: mcp23s08: Refactor mcp23s08_spi_regmap_init()") +Reported-by: Martin Hundebøll +Signed-off-by: Andy Shevchenko +Tested-by: Martin Hundebøll +Link: https://lore.kernel.org/r/20201009180856.4738-1-andriy.shevchenko@linux.intel.com +Tested-by: Jan Kundrát +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-mcp23s08_spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-mcp23s08_spi.c b/drivers/pinctrl/pinctrl-mcp23s08_spi.c +index 1f47a661b0a79..7c72cffe14127 100644 +--- a/drivers/pinctrl/pinctrl-mcp23s08_spi.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08_spi.c +@@ -119,7 +119,7 @@ static int mcp23s08_spi_regmap_init(struct mcp23s08 *mcp, struct device *dev, + return -EINVAL; + } + +- copy = devm_kmemdup(dev, &config, sizeof(config), GFP_KERNEL); ++ copy = devm_kmemdup(dev, config, sizeof(*config), GFP_KERNEL); + if (!copy) + return -ENOMEM; + +-- +2.27.0 + diff --git a/queue-5.9/pinctrl-qcom-move-clearing-pending-irq-to-.irq_reque.patch b/queue-5.9/pinctrl-qcom-move-clearing-pending-irq-to-.irq_reque.patch new file mode 100644 index 00000000000..ebdd9dc357b --- /dev/null +++ b/queue-5.9/pinctrl-qcom-move-clearing-pending-irq-to-.irq_reque.patch @@ -0,0 +1,92 @@ +From 34a6f963a4a2b32d686e156b91f7fadfbf07e273 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 13:08:04 +0530 +Subject: pinctrl: qcom: Move clearing pending IRQ to .irq_request_resources + callback + +From: Maulik Shah + +[ Upstream commit 71266d9d39366c9b24b866d811b3facaf837f13f ] + +When GPIOs that are routed to PDC are used as output they can still latch +the IRQ pending at GIC. As a result the spurious IRQ was handled when the +client driver change the direction to input to starts using it as IRQ. + +Currently such erroneous latched IRQ are cleared with .irq_enable callback +however if the driver continue to use GPIO as interrupt and invokes +disable_irq() followed by enable_irq() then everytime during enable_irq() +previously latched interrupt gets cleared. + +This can make edge IRQs not seen after enable_irq() if they had arrived +after the driver has invoked disable_irq() and were pending at GIC. + +Move clearing erroneous IRQ to .irq_request_resources callback as this is +the place where GPIO direction is changed as input and its locked as IRQ. + +While at this add a missing check to invoke msm_gpio_irq_clear_unmask() +from .irq_enable callback only when GPIO is not routed to PDC. + +Fixes: e35a6ae0eb3a ("pinctrl/msm: Setup GPIO chip in hierarchy") +Signed-off-by: Maulik Shah +Link: https://lore.kernel.org/r/1604561884-10166-1-git-send-email-mkshah@codeaurora.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 32 ++++++++++++++++++------------ + 1 file changed, 19 insertions(+), 13 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index 1df232266f63a..1554f0275067e 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -815,21 +815,14 @@ static void msm_gpio_irq_clear_unmask(struct irq_data *d, bool status_clear) + + static void msm_gpio_irq_enable(struct irq_data *d) + { +- /* +- * Clear the interrupt that may be pending before we enable +- * the line. +- * This is especially a problem with the GPIOs routed to the +- * PDC. These GPIOs are direct-connect interrupts to the GIC. +- * Disabling the interrupt line at the PDC does not prevent +- * the interrupt from being latched at the GIC. The state at +- * GIC needs to be cleared before enabling. +- */ +- if (d->parent_data) { +- irq_chip_set_parent_state(d, IRQCHIP_STATE_PENDING, 0); ++ struct gpio_chip *gc = irq_data_get_irq_chip_data(d); ++ struct msm_pinctrl *pctrl = gpiochip_get_data(gc); ++ ++ if (d->parent_data) + irq_chip_enable_parent(d); +- } + +- msm_gpio_irq_clear_unmask(d, true); ++ if (!test_bit(d->hwirq, pctrl->skip_wake_irqs)) ++ msm_gpio_irq_clear_unmask(d, true); + } + + static void msm_gpio_irq_disable(struct irq_data *d) +@@ -1104,6 +1097,19 @@ static int msm_gpio_irq_reqres(struct irq_data *d) + ret = -EINVAL; + goto out; + } ++ ++ /* ++ * Clear the interrupt that may be pending before we enable ++ * the line. ++ * This is especially a problem with the GPIOs routed to the ++ * PDC. These GPIOs are direct-connect interrupts to the GIC. ++ * Disabling the interrupt line at the PDC does not prevent ++ * the interrupt from being latched at the GIC. The state at ++ * GIC needs to be cleared before enabling. ++ */ ++ if (d->parent_data && test_bit(d->hwirq, pctrl->skip_wake_irqs)) ++ irq_chip_set_parent_state(d, IRQCHIP_STATE_PENDING, 0); ++ + return 0; + out: + module_put(gc->owner); +-- +2.27.0 + diff --git a/queue-5.9/pinctrl-qcom-sm8250-specify-pdc-map.patch b/queue-5.9/pinctrl-qcom-sm8250-specify-pdc-map.patch new file mode 100644 index 00000000000..33d62fc402e --- /dev/null +++ b/queue-5.9/pinctrl-qcom-sm8250-specify-pdc-map.patch @@ -0,0 +1,60 @@ +From ac8ca44a483f6b9f68ed5062f1b41d84f7a4e471 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 21:36:42 -0700 +Subject: pinctrl: qcom: sm8250: Specify PDC map + +From: Bjorn Andersson + +[ Upstream commit b41efeed507addecb92e83dd444d86c1fbe38ae0 ] + +Specify the PDC mapping for SM8250, so that gpio interrupts are +propertly mapped to the wakeup IRQs of the PDC. + +Fixes: 4e3ec9e407ad ("pinctrl: qcom: Add sm8250 pinctrl driver.") +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20201028043642.1141723-1-bjorn.andersson@linaro.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-sm8250.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/pinctrl/qcom/pinctrl-sm8250.c b/drivers/pinctrl/qcom/pinctrl-sm8250.c +index 826df0d637eaa..af144e724bd9c 100644 +--- a/drivers/pinctrl/qcom/pinctrl-sm8250.c ++++ b/drivers/pinctrl/qcom/pinctrl-sm8250.c +@@ -1313,6 +1313,22 @@ static const struct msm_pingroup sm8250_groups[] = { + [183] = SDC_PINGROUP(sdc2_data, 0xb7000, 9, 0), + }; + ++static const struct msm_gpio_wakeirq_map sm8250_pdc_map[] = { ++ { 0, 79 }, { 1, 84 }, { 2, 80 }, { 3, 82 }, { 4, 107 }, { 7, 43 }, ++ { 11, 42 }, { 14, 44 }, { 15, 52 }, { 19, 67 }, { 23, 68 }, { 24, 105 }, ++ { 27, 92 }, { 28, 106 }, { 31, 69 }, { 35, 70 }, { 39, 37 }, ++ { 40, 108 }, { 43, 71 }, { 45, 72 }, { 47, 83 }, { 51, 74 }, { 55, 77 }, ++ { 59, 78 }, { 63, 75 }, { 64, 81 }, { 65, 87 }, { 66, 88 }, { 67, 89 }, ++ { 68, 54 }, { 70, 85 }, { 77, 46 }, { 80, 90 }, { 81, 91 }, { 83, 97 }, ++ { 84, 98 }, { 86, 99 }, { 87, 100 }, { 88, 101 }, { 89, 102 }, ++ { 92, 103 }, { 93, 104 }, { 100, 53 }, { 103, 47 }, { 104, 48 }, ++ { 108, 49 }, { 109, 94 }, { 110, 95 }, { 111, 96 }, { 112, 55 }, ++ { 113, 56 }, { 118, 50 }, { 121, 51 }, { 122, 57 }, { 123, 58 }, ++ { 124, 45 }, { 126, 59 }, { 128, 76 }, { 129, 86 }, { 132, 93 }, ++ { 133, 65 }, { 134, 66 }, { 136, 62 }, { 137, 63 }, { 138, 64 }, ++ { 142, 60 }, { 143, 61 } ++}; ++ + static const struct msm_pinctrl_soc_data sm8250_pinctrl = { + .pins = sm8250_pins, + .npins = ARRAY_SIZE(sm8250_pins), +@@ -1323,6 +1339,8 @@ static const struct msm_pinctrl_soc_data sm8250_pinctrl = { + .ngpios = 181, + .tiles = sm8250_tiles, + .ntiles = ARRAY_SIZE(sm8250_tiles), ++ .wakeirq_map = sm8250_pdc_map, ++ .nwakeirq_map = ARRAY_SIZE(sm8250_pdc_map), + }; + + static int sm8250_pinctrl_probe(struct platform_device *pdev) +-- +2.27.0 + diff --git a/queue-5.9/r8169-disable-hw-csum-for-short-packets-on-all-chip-.patch b/queue-5.9/r8169-disable-hw-csum-for-short-packets-on-all-chip-.patch new file mode 100644 index 00000000000..b152b47b24e --- /dev/null +++ b/queue-5.9/r8169-disable-hw-csum-for-short-packets-on-all-chip-.patch @@ -0,0 +1,57 @@ +From 6e6eaf0933f97d7a79b314250cf2238eb4e9a6c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 18:14:47 +0100 +Subject: r8169: disable hw csum for short packets on all chip versions + +From: Heiner Kallweit + +[ Upstream commit 847f0a2bfd2fe16d6afa537816b313b71f32e139 ] + +RTL8125B has same or similar short packet hw padding bug as RTL8168evl. +The main workaround has been extended accordingly, however we have to +disable also hw checksumming for short packets on affected new chip +versions. Instead of checking for an affected chip version let's +simply disable hw checksumming for short packets in general. + +v2: +- remove the version checks and disable short packet hw csum in general +- reflect this in commit title and message + +Fixes: 0439297be951 ("r8169: add support for RTL8125B") +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/7fbb35f0-e244-ef65-aa55-3872d7d38698@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 15 +++------------ + 1 file changed, 3 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index ed918c12bc5e9..515d9116dfadf 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4325,18 +4325,9 @@ static netdev_features_t rtl8169_features_check(struct sk_buff *skb, + rtl_chip_supports_csum_v2(tp)) + features &= ~NETIF_F_ALL_TSO; + } else if (skb->ip_summed == CHECKSUM_PARTIAL) { +- if (skb->len < ETH_ZLEN) { +- switch (tp->mac_version) { +- case RTL_GIGA_MAC_VER_11: +- case RTL_GIGA_MAC_VER_12: +- case RTL_GIGA_MAC_VER_17: +- case RTL_GIGA_MAC_VER_34: +- features &= ~NETIF_F_CSUM_MASK; +- break; +- default: +- break; +- } +- } ++ /* work around hw bug on some chip versions */ ++ if (skb->len < ETH_ZLEN) ++ features &= ~NETIF_F_CSUM_MASK; + + if (transport_offset > TCPHO_MAX && + rtl_chip_supports_csum_v2(tp)) +-- +2.27.0 + diff --git a/queue-5.9/r8169-fix-potential-skb-double-free-in-an-error-path.patch b/queue-5.9/r8169-fix-potential-skb-double-free-in-an-error-path.patch new file mode 100644 index 00000000000..afe19238136 --- /dev/null +++ b/queue-5.9/r8169-fix-potential-skb-double-free-in-an-error-path.patch @@ -0,0 +1,41 @@ +From b825ea2a4efa8779d5ebefdd13cbae4373030eb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 15:28:42 +0100 +Subject: r8169: fix potential skb double free in an error path + +From: Heiner Kallweit + +[ Upstream commit cc6528bc9a0c901c83b8220a2e2617f3354d6dd9 ] + +The caller of rtl8169_tso_csum_v2() frees the skb if false is returned. +eth_skb_pad() internally frees the skb on error what would result in a +double free. Therefore use __skb_put_padto() directly and instruct it +to not free the skb on error. + +Fixes: b423e9ae49d7 ("r8169: fix offloaded tx checksum for small packets.") +Reported-by: Jakub Kicinski +Signed-off-by: Heiner Kallweit +Link: https://lore.kernel.org/r/f7e68191-acff-9ded-4263-c016428a8762@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/realtek/r8169_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c +index c74d9c02a805f..ed918c12bc5e9 100644 +--- a/drivers/net/ethernet/realtek/r8169_main.c ++++ b/drivers/net/ethernet/realtek/r8169_main.c +@@ -4145,7 +4145,8 @@ static bool rtl8169_tso_csum_v2(struct rtl8169_private *tp, + opts[1] |= transport_offset << TCPHO_SHIFT; + } else { + if (unlikely(skb->len < ETH_ZLEN && rtl_test_hw_pad_bug(tp))) +- return !eth_skb_pad(skb); ++ /* eth_skb_pad would free the skb on error */ ++ return !__skb_put_padto(skb, ETH_ZLEN, false); + } + + return true; +-- +2.27.0 + diff --git a/queue-5.9/selftest-fix-flower-terse-dump-tests.patch b/queue-5.9/selftest-fix-flower-terse-dump-tests.patch new file mode 100644 index 00000000000..bbf870d17e3 --- /dev/null +++ b/queue-5.9/selftest-fix-flower-terse-dump-tests.patch @@ -0,0 +1,46 @@ +From 9f60398e6262e7628758e1a7af00133a28db830f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 13:19:28 +0200 +Subject: selftest: fix flower terse dump tests + +From: Vlad Buslov + +[ Upstream commit 97adb13dc9ba08ecd4758bc59efc0205f5cbf377 ] + +Iproute2 tc classifier terse dump has been accepted with modified syntax. +Update the tests accordingly. + +Signed-off-by: Vlad Buslov +Fixes: e7534fd42a99 ("selftests: implement flower classifier terse dump tests") +Link: https://lore.kernel.org/r/20201107111928.453534-1-vlad@buslov.dev +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../testing/selftests/tc-testing/tc-tests/filters/tests.json | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json +index bb543bf69d694..361235ad574be 100644 +--- a/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json ++++ b/tools/testing/selftests/tc-testing/tc-tests/filters/tests.json +@@ -100,7 +100,7 @@ + ], + "cmdUnderTest": "$TC filter add dev $DEV2 protocol ip pref 1 ingress flower dst_mac e4:11:22:11:4a:51 action drop", + "expExitCode": "0", +- "verifyCmd": "$TC filter show terse dev $DEV2 ingress", ++ "verifyCmd": "$TC -br filter show dev $DEV2 ingress", + "matchPattern": "filter protocol ip pref 1 flower.*handle", + "matchCount": "1", + "teardown": [ +@@ -119,7 +119,7 @@ + ], + "cmdUnderTest": "$TC filter add dev $DEV2 protocol ip pref 1 ingress flower dst_mac e4:11:22:11:4a:51 action drop", + "expExitCode": "0", +- "verifyCmd": "$TC filter show terse dev $DEV2 ingress", ++ "verifyCmd": "$TC -br filter show dev $DEV2 ingress", + "matchPattern": " dst_mac e4:11:22:11:4a:51", + "matchCount": "0", + "teardown": [ +-- +2.27.0 + diff --git a/queue-5.9/series b/queue-5.9/series index cb7249dd0b3..219915805e6 100644 --- a/queue-5.9/series +++ b/queue-5.9/series @@ -125,3 +125,57 @@ i2c-designware-slave-should-do-write_requested-befor.patch tpm_tis-disable-interrupts-on-thinkpad-t490s.patch spi-bcm2835-remove-use-of-uninitialized-gpio-flags-variable.patch mfd-sprd-add-wakeup-capability-for-pmic-irq.patch +pinctrl-intel-fix-2-kohm-bias-which-is-833-ohm.patch +pinctrl-intel-set-default-bias-in-case-no-particular.patch +gpio-aspeed-fix-ast2600-bank-properties.patch +arm-9019-1-kprobes-avoid-fortify_panic-when-copying-.patch +bpf-don-t-rely-on-gcc-__attribute__-optimize-to-disa.patch +libbpf-hashmap-fix-undefined-behavior-in-hash_bits.patch +pinctrl-mcp23s08-use-full-chunk-of-memory-for-regmap.patch +pinctrl-aspeed-fix-gpi-only-function-problem.patch +net-mlx5e-fix-modify-header-actions-memory-leak.patch +net-mlx5e-protect-encap-route-dev-from-concurrent-re.patch +net-mlx5e-use-spin_lock_bh-for-async_icosq_lock.patch +net-mlx5-fix-deletion-of-duplicate-rules.patch +net-mlx5-e-switch-avoid-extack-error-log-for-disable.patch +net-mlx5e-fix-vxlan-synchronization-after-function-r.patch +net-mlx5e-fix-incorrect-access-of-rcu-protected-xdp_.patch +sunrpc-fix-general-protection-fault-in-trace_rpc_xdr.patch +nfsd-fix-use-after-free-warning-when-doing-inter-ser.patch +nfsd-fix-missing-refcount-in-nfsd4_copy-by-nfsd4_do_.patch +tools-bpftool-fix-attaching-flow-dissector.patch +bpf-zero-fill-re-used-per-cpu-map-element.patch +r8169-fix-potential-skb-double-free-in-an-error-path.patch +r8169-disable-hw-csum-for-short-packets-on-all-chip-.patch +pinctrl-qcom-move-clearing-pending-irq-to-.irq_reque.patch +pinctrl-qcom-sm8250-specify-pdc-map.patch +nbd-fix-a-block_device-refcount-leak-in-nbd_release.patch +selftest-fix-flower-terse-dump-tests.patch +i40e-fix-mac-address-setting-for-a-vf-via-host-vm.patch +igc-fix-returning-wrong-statistics.patch +lan743x-correctly-handle-chips-with-internal-phy.patch +net-phy-realtek-support-paged-operations-on-rtl8201c.patch +xfs-fix-flags-argument-to-rmap-lookup-when-convertin.patch +xfs-set-the-unwritten-bit-in-rmap-lookup-flags-in-xc.patch +xfs-fix-rmap-key-and-record-comparison-functions.patch +xfs-fix-brainos-in-the-refcount-scrubber-s-rmap-frag.patch +lan743x-fix-bug-invalid-wait-context-when-setting-rx.patch +xfs-fix-a-missing-unlock-on-error-in-xfs_fs_map_bloc.patch +of-address-fix-of_node-memory-leak-in-of_dma_is_cohe.patch +ch_ktls-update-cheksum-information.patch +ch_ktls-tcb-update-fails-sometimes.patch +cosa-add-missing-kfree-in-error-path-of-cosa_write.patch +hwmon-applesmc-re-work-smc-comms.patch +nfs-fix-listxattr-receive-buffer-size.patch +vrf-fix-fast-path-output-packet-handling-with-async-.patch +lan743x-fix-use-of-uninitialized-variable.patch +arm64-mm-validate-hotplug-range-before-creating-line.patch +kernel-watchdog-fix-watchdog_allowed_mask-not-used-w.patch +mm-memcontrol-fix-missing-wakeup-polling-thread.patch +afs-fix-afs_write_end-when-called-with-copied-0-ver-.patch +perf-fix-get_recursion_context.patch +nvme-factor-out-a-nvme_configure_metadata-helper.patch +nvme-freeze-the-queue-over-lba_shift-updates.patch +nvme-fix-incorrect-behavior-when-blkroset-is-called-.patch +perf-simplify-group_sched_in.patch +perf-fix-event-multiplexing-for-exclusive-groups.patch diff --git a/queue-5.9/sunrpc-fix-general-protection-fault-in-trace_rpc_xdr.patch b/queue-5.9/sunrpc-fix-general-protection-fault-in-trace_rpc_xdr.patch new file mode 100644 index 00000000000..12d856e46a5 --- /dev/null +++ b/queue-5.9/sunrpc-fix-general-protection-fault-in-trace_rpc_xdr.patch @@ -0,0 +1,42 @@ +From b4e7cc0f6944081bfab85f7fc33b7a66a48deefc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Oct 2020 10:41:07 -0400 +Subject: SUNRPC: Fix general protection fault in trace_rpc_xdr_overflow() + +From: Chuck Lever + +[ Upstream commit d321ff589c16d8c2207485a6d7fbdb14e873d46e ] + +The TP_fast_assign() section is careful enough not to dereference +xdr->rqst if it's NULL. The TP_STRUCT__entry section is not. + +Fixes: 5582863f450c ("SUNRPC: Add XDR overflow trace event") +Signed-off-by: Chuck Lever +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + include/trace/events/sunrpc.h | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h +index 65d7dfbbc9cd7..ca2f27b9f919d 100644 +--- a/include/trace/events/sunrpc.h ++++ b/include/trace/events/sunrpc.h +@@ -607,10 +607,10 @@ TRACE_EVENT(rpc_xdr_overflow, + __field(size_t, tail_len) + __field(unsigned int, page_len) + __field(unsigned int, len) +- __string(progname, +- xdr->rqst->rq_task->tk_client->cl_program->name) +- __string(procedure, +- xdr->rqst->rq_task->tk_msg.rpc_proc->p_name) ++ __string(progname, xdr->rqst ? ++ xdr->rqst->rq_task->tk_client->cl_program->name : "unknown") ++ __string(procedure, xdr->rqst ? ++ xdr->rqst->rq_task->tk_msg.rpc_proc->p_name : "unknown") + ), + + TP_fast_assign( +-- +2.27.0 + diff --git a/queue-5.9/tools-bpftool-fix-attaching-flow-dissector.patch b/queue-5.9/tools-bpftool-fix-attaching-flow-dissector.patch new file mode 100644 index 00000000000..edfa8d2cc0a --- /dev/null +++ b/queue-5.9/tools-bpftool-fix-attaching-flow-dissector.patch @@ -0,0 +1,40 @@ +From 210f4b06fc395585334ad35396cf24dad96ac2fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 11:52:30 +0000 +Subject: tools/bpftool: Fix attaching flow dissector + +From: Lorenz Bauer + +[ Upstream commit f9b7ff0d7f7a466a920424246e7ddc2b84c87e52 ] + +My earlier patch to reject non-zero arguments to flow dissector attach +broke attaching via bpftool. Instead of 0 it uses -1 for target_fd. +Fix this by passing a zero argument when attaching the flow dissector. + +Fixes: 1b514239e859 ("bpf: flow_dissector: Check value of unused flags to BPF_PROG_ATTACH") +Reported-by: Jiri Benc +Signed-off-by: Lorenz Bauer +Signed-off-by: Alexei Starovoitov +Acked-by: Song Liu +Link: https://lore.kernel.org/bpf/20201105115230.296657-1-lmb@cloudflare.com +Signed-off-by: Sasha Levin +--- + tools/bpf/bpftool/prog.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c +index d393eb8263a60..994506540e564 100644 +--- a/tools/bpf/bpftool/prog.c ++++ b/tools/bpf/bpftool/prog.c +@@ -741,7 +741,7 @@ static int parse_attach_detach_args(int argc, char **argv, int *progfd, + } + + if (*attach_type == BPF_FLOW_DISSECTOR) { +- *mapfd = -1; ++ *mapfd = 0; + return 0; + } + +-- +2.27.0 + diff --git a/queue-5.9/vrf-fix-fast-path-output-packet-handling-with-async-.patch b/queue-5.9/vrf-fix-fast-path-output-packet-handling-with-async-.patch new file mode 100644 index 00000000000..ccab5a354c2 --- /dev/null +++ b/queue-5.9/vrf-fix-fast-path-output-packet-handling-with-async-.patch @@ -0,0 +1,197 @@ +From 1dda3b40a087f077277ce94d359b1df720d2bfba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 08:30:30 +0100 +Subject: vrf: Fix fast path output packet handling with async Netfilter rules + +From: Martin Willi + +[ Upstream commit 9e2b7fa2df4365e99934901da4fb4af52d81e820 ] + +VRF devices use an optimized direct path on output if a default qdisc +is involved, calling Netfilter hooks directly. This path, however, does +not consider Netfilter rules completing asynchronously, such as with +NFQUEUE. The Netfilter okfn() is called for asynchronously accepted +packets, but the VRF never passes that packet down the stack to send +it out over the slave device. Using the slower redirect path for this +seems not feasible, as we do not know beforehand if a Netfilter hook +has asynchronously completing rules. + +Fix the use of asynchronously completing Netfilter rules in OUTPUT and +POSTROUTING by using a special completion function that additionally +calls dst_output() to pass the packet down the stack. Also, slightly +adjust the use of nf_reset_ct() so that is called in the asynchronous +case, too. + +Fixes: dcdd43c41e60 ("net: vrf: performance improvements for IPv4") +Fixes: a9ec54d1b0cd ("net: vrf: performance improvements for IPv6") +Signed-off-by: Martin Willi +Link: https://lore.kernel.org/r/20201106073030.3974927-1-martin@strongswan.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/vrf.c | 92 +++++++++++++++++++++++++++++++++++------------ + 1 file changed, 69 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index 60c1aadece89a..f2793ffde1913 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -608,8 +608,7 @@ static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev) + return ret; + } + +-static int vrf_finish_direct(struct net *net, struct sock *sk, +- struct sk_buff *skb) ++static void vrf_finish_direct(struct sk_buff *skb) + { + struct net_device *vrf_dev = skb->dev; + +@@ -628,7 +627,8 @@ static int vrf_finish_direct(struct net *net, struct sock *sk, + skb_pull(skb, ETH_HLEN); + } + +- return 1; ++ /* reset skb device */ ++ nf_reset_ct(skb); + } + + #if IS_ENABLED(CONFIG_IPV6) +@@ -707,15 +707,41 @@ static struct sk_buff *vrf_ip6_out_redirect(struct net_device *vrf_dev, + return skb; + } + ++static int vrf_output6_direct_finish(struct net *net, struct sock *sk, ++ struct sk_buff *skb) ++{ ++ vrf_finish_direct(skb); ++ ++ return vrf_ip6_local_out(net, sk, skb); ++} ++ + static int vrf_output6_direct(struct net *net, struct sock *sk, + struct sk_buff *skb) + { ++ int err = 1; ++ + skb->protocol = htons(ETH_P_IPV6); + +- return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, +- net, sk, skb, NULL, skb->dev, +- vrf_finish_direct, +- !(IPCB(skb)->flags & IPSKB_REROUTED)); ++ if (!(IPCB(skb)->flags & IPSKB_REROUTED)) ++ err = nf_hook(NFPROTO_IPV6, NF_INET_POST_ROUTING, net, sk, skb, ++ NULL, skb->dev, vrf_output6_direct_finish); ++ ++ if (likely(err == 1)) ++ vrf_finish_direct(skb); ++ ++ return err; ++} ++ ++static int vrf_ip6_out_direct_finish(struct net *net, struct sock *sk, ++ struct sk_buff *skb) ++{ ++ int err; ++ ++ err = vrf_output6_direct(net, sk, skb); ++ if (likely(err == 1)) ++ err = vrf_ip6_local_out(net, sk, skb); ++ ++ return err; + } + + static struct sk_buff *vrf_ip6_out_direct(struct net_device *vrf_dev, +@@ -728,18 +754,15 @@ static struct sk_buff *vrf_ip6_out_direct(struct net_device *vrf_dev, + skb->dev = vrf_dev; + + err = nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, net, sk, +- skb, NULL, vrf_dev, vrf_output6_direct); ++ skb, NULL, vrf_dev, vrf_ip6_out_direct_finish); + + if (likely(err == 1)) + err = vrf_output6_direct(net, sk, skb); + +- /* reset skb device */ + if (likely(err == 1)) +- nf_reset_ct(skb); +- else +- skb = NULL; ++ return skb; + +- return skb; ++ return NULL; + } + + static struct sk_buff *vrf_ip6_out(struct net_device *vrf_dev, +@@ -919,15 +942,41 @@ static struct sk_buff *vrf_ip_out_redirect(struct net_device *vrf_dev, + return skb; + } + ++static int vrf_output_direct_finish(struct net *net, struct sock *sk, ++ struct sk_buff *skb) ++{ ++ vrf_finish_direct(skb); ++ ++ return vrf_ip_local_out(net, sk, skb); ++} ++ + static int vrf_output_direct(struct net *net, struct sock *sk, + struct sk_buff *skb) + { ++ int err = 1; ++ + skb->protocol = htons(ETH_P_IP); + +- return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, +- net, sk, skb, NULL, skb->dev, +- vrf_finish_direct, +- !(IPCB(skb)->flags & IPSKB_REROUTED)); ++ if (!(IPCB(skb)->flags & IPSKB_REROUTED)) ++ err = nf_hook(NFPROTO_IPV4, NF_INET_POST_ROUTING, net, sk, skb, ++ NULL, skb->dev, vrf_output_direct_finish); ++ ++ if (likely(err == 1)) ++ vrf_finish_direct(skb); ++ ++ return err; ++} ++ ++static int vrf_ip_out_direct_finish(struct net *net, struct sock *sk, ++ struct sk_buff *skb) ++{ ++ int err; ++ ++ err = vrf_output_direct(net, sk, skb); ++ if (likely(err == 1)) ++ err = vrf_ip_local_out(net, sk, skb); ++ ++ return err; + } + + static struct sk_buff *vrf_ip_out_direct(struct net_device *vrf_dev, +@@ -940,18 +989,15 @@ static struct sk_buff *vrf_ip_out_direct(struct net_device *vrf_dev, + skb->dev = vrf_dev; + + err = nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, net, sk, +- skb, NULL, vrf_dev, vrf_output_direct); ++ skb, NULL, vrf_dev, vrf_ip_out_direct_finish); + + if (likely(err == 1)) + err = vrf_output_direct(net, sk, skb); + +- /* reset skb device */ + if (likely(err == 1)) +- nf_reset_ct(skb); +- else +- skb = NULL; ++ return skb; + +- return skb; ++ return NULL; + } + + static struct sk_buff *vrf_ip_out(struct net_device *vrf_dev, +-- +2.27.0 + diff --git a/queue-5.9/xfs-fix-a-missing-unlock-on-error-in-xfs_fs_map_bloc.patch b/queue-5.9/xfs-fix-a-missing-unlock-on-error-in-xfs_fs_map_bloc.patch new file mode 100644 index 00000000000..45cdbce5c16 --- /dev/null +++ b/queue-5.9/xfs-fix-a-missing-unlock-on-error-in-xfs_fs_map_bloc.patch @@ -0,0 +1,37 @@ +From f3ce8ba1b5429de0be560d2fcfcc6e21bab49c94 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 08:07:37 -0800 +Subject: xfs: fix a missing unlock on error in xfs_fs_map_blocks + +From: Christoph Hellwig + +[ Upstream commit 2bd3fa793aaa7e98b74e3653fdcc72fa753913b5 ] + +We also need to drop the iolock when invalidate_inode_pages2 fails, not +only on all other error or successful cases. + +Fixes: 527851124d10 ("xfs: implement pNFS export operations") +Signed-off-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_pnfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/xfs/xfs_pnfs.c b/fs/xfs/xfs_pnfs.c +index b101feb2aab45..f3082a957d5e1 100644 +--- a/fs/xfs/xfs_pnfs.c ++++ b/fs/xfs/xfs_pnfs.c +@@ -134,7 +134,7 @@ xfs_fs_map_blocks( + goto out_unlock; + error = invalidate_inode_pages2(inode->i_mapping); + if (WARN_ON_ONCE(error)) +- return error; ++ goto out_unlock; + + end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + length); + offset_fsb = XFS_B_TO_FSBT(mp, offset); +-- +2.27.0 + diff --git a/queue-5.9/xfs-fix-brainos-in-the-refcount-scrubber-s-rmap-frag.patch b/queue-5.9/xfs-fix-brainos-in-the-refcount-scrubber-s-rmap-frag.patch new file mode 100644 index 00000000000..cac16623e7f --- /dev/null +++ b/queue-5.9/xfs-fix-brainos-in-the-refcount-scrubber-s-rmap-frag.patch @@ -0,0 +1,61 @@ +From 3e25c3c5839f37a685ee728bc36e4c7c4636e6d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 16:32:42 -0800 +Subject: xfs: fix brainos in the refcount scrubber's rmap fragment processor + +From: Darrick J. Wong + +[ Upstream commit 54e9b09e153842ab5adb8a460b891e11b39e9c3d ] + +Fix some serious WTF in the reference count scrubber's rmap fragment +processing. The code comment says that this loop is supposed to move +all fragment records starting at or before bno onto the worklist, but +there's no obvious reason why nr (the number of items added) should +increment starting from 1, and breaking the loop when we've added the +target number seems dubious since we could have more rmap fragments that +should have been added to the worklist. + +This seems to manifest in xfs/411 when adding one to the refcount field. + +Fixes: dbde19da9637 ("xfs: cross-reference the rmapbt data with the refcountbt") +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/scrub/refcount.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/fs/xfs/scrub/refcount.c b/fs/xfs/scrub/refcount.c +index beaeb6fa31197..dd672e6bbc75c 100644 +--- a/fs/xfs/scrub/refcount.c ++++ b/fs/xfs/scrub/refcount.c +@@ -170,7 +170,6 @@ xchk_refcountbt_process_rmap_fragments( + */ + INIT_LIST_HEAD(&worklist); + rbno = NULLAGBLOCK; +- nr = 1; + + /* Make sure the fragments actually /are/ in agbno order. */ + bno = 0; +@@ -184,15 +183,14 @@ xchk_refcountbt_process_rmap_fragments( + * Find all the rmaps that start at or before the refc extent, + * and put them on the worklist. + */ ++ nr = 0; + list_for_each_entry_safe(frag, n, &refchk->fragments, list) { +- if (frag->rm.rm_startblock > refchk->bno) +- goto done; ++ if (frag->rm.rm_startblock > refchk->bno || nr > target_nr) ++ break; + bno = frag->rm.rm_startblock + frag->rm.rm_blockcount; + if (bno < rbno) + rbno = bno; + list_move_tail(&frag->list, &worklist); +- if (nr == target_nr) +- break; + nr++; + } + +-- +2.27.0 + diff --git a/queue-5.9/xfs-fix-flags-argument-to-rmap-lookup-when-convertin.patch b/queue-5.9/xfs-fix-flags-argument-to-rmap-lookup-when-convertin.patch new file mode 100644 index 00000000000..ce5a8586d72 --- /dev/null +++ b/queue-5.9/xfs-fix-flags-argument-to-rmap-lookup-when-convertin.patch @@ -0,0 +1,39 @@ +From 26b9e0f7bcb7ace34805f189273ade94c31ce110 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 16:32:43 -0800 +Subject: xfs: fix flags argument to rmap lookup when converting shared file + rmaps + +From: Darrick J. Wong + +[ Upstream commit ea8439899c0b15a176664df62aff928010fad276 ] + +Pass the same oldext argument (which contains the existing rmapping's +unwritten state) to xfs_rmap_lookup_le_range at the start of +xfs_rmap_convert_shared. At this point in the code, flags is zero, +which means that we perform lookups using the wrong key. + +Fixes: 3f165b334e51 ("xfs: convert unwritten status of reverse mappings for shared files") +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_rmap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/xfs/libxfs/xfs_rmap.c b/fs/xfs/libxfs/xfs_rmap.c +index 27c39268c31f7..82117b1ee34cb 100644 +--- a/fs/xfs/libxfs/xfs_rmap.c ++++ b/fs/xfs/libxfs/xfs_rmap.c +@@ -1514,7 +1514,7 @@ xfs_rmap_convert_shared( + * record for our insertion point. This will also give us the record for + * start block contiguity tests. + */ +- error = xfs_rmap_lookup_le_range(cur, bno, owner, offset, flags, ++ error = xfs_rmap_lookup_le_range(cur, bno, owner, offset, oldext, + &PREV, &i); + if (error) + goto done; +-- +2.27.0 + diff --git a/queue-5.9/xfs-fix-rmap-key-and-record-comparison-functions.patch b/queue-5.9/xfs-fix-rmap-key-and-record-comparison-functions.patch new file mode 100644 index 00000000000..9730dd3baac --- /dev/null +++ b/queue-5.9/xfs-fix-rmap-key-and-record-comparison-functions.patch @@ -0,0 +1,92 @@ +From aeb90c68563d907fc704d383f0cadeb8a49bd006 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 16:32:44 -0800 +Subject: xfs: fix rmap key and record comparison functions + +From: Darrick J. Wong + +[ Upstream commit 6ff646b2ceb0eec916101877f38da0b73e3a5b7f ] + +Keys for extent interval records in the reverse mapping btree are +supposed to be computed as follows: + +(physical block, owner, fork, is_btree, is_unwritten, offset) + +This provides users the ability to look up a reverse mapping from a bmbt +record -- start with the physical block; then if there are multiple +records for the same block, move on to the owner; then the inode fork +type; and so on to the file offset. + +However, the key comparison functions incorrectly remove the +fork/btree/unwritten information that's encoded in the on-disk offset. +This means that lookup comparisons are only done with: + +(physical block, owner, offset) + +This means that queries can return incorrect results. On consistent +filesystems this hasn't been an issue because blocks are never shared +between forks or with bmbt blocks; and are never unwritten. However, +this bug means that online repair cannot always detect corruption in the +key information in internal rmapbt nodes. + +Found by fuzzing keys[1].attrfork = ones on xfs/371. + +Fixes: 4b8ed67794fe ("xfs: add rmap btree operations") +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_rmap_btree.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/fs/xfs/libxfs/xfs_rmap_btree.c b/fs/xfs/libxfs/xfs_rmap_btree.c +index beb81c84a9375..577a66381327c 100644 +--- a/fs/xfs/libxfs/xfs_rmap_btree.c ++++ b/fs/xfs/libxfs/xfs_rmap_btree.c +@@ -243,8 +243,8 @@ xfs_rmapbt_key_diff( + else if (y > x) + return -1; + +- x = XFS_RMAP_OFF(be64_to_cpu(kp->rm_offset)); +- y = rec->rm_offset; ++ x = be64_to_cpu(kp->rm_offset); ++ y = xfs_rmap_irec_offset_pack(rec); + if (x > y) + return 1; + else if (y > x) +@@ -275,8 +275,8 @@ xfs_rmapbt_diff_two_keys( + else if (y > x) + return -1; + +- x = XFS_RMAP_OFF(be64_to_cpu(kp1->rm_offset)); +- y = XFS_RMAP_OFF(be64_to_cpu(kp2->rm_offset)); ++ x = be64_to_cpu(kp1->rm_offset); ++ y = be64_to_cpu(kp2->rm_offset); + if (x > y) + return 1; + else if (y > x) +@@ -390,8 +390,8 @@ xfs_rmapbt_keys_inorder( + return 1; + else if (a > b) + return 0; +- a = XFS_RMAP_OFF(be64_to_cpu(k1->rmap.rm_offset)); +- b = XFS_RMAP_OFF(be64_to_cpu(k2->rmap.rm_offset)); ++ a = be64_to_cpu(k1->rmap.rm_offset); ++ b = be64_to_cpu(k2->rmap.rm_offset); + if (a <= b) + return 1; + return 0; +@@ -420,8 +420,8 @@ xfs_rmapbt_recs_inorder( + return 1; + else if (a > b) + return 0; +- a = XFS_RMAP_OFF(be64_to_cpu(r1->rmap.rm_offset)); +- b = XFS_RMAP_OFF(be64_to_cpu(r2->rmap.rm_offset)); ++ a = be64_to_cpu(r1->rmap.rm_offset); ++ b = be64_to_cpu(r2->rmap.rm_offset); + if (a <= b) + return 1; + return 0; +-- +2.27.0 + diff --git a/queue-5.9/xfs-set-the-unwritten-bit-in-rmap-lookup-flags-in-xc.patch b/queue-5.9/xfs-set-the-unwritten-bit-in-rmap-lookup-flags-in-xc.patch new file mode 100644 index 00000000000..ce40fc574be --- /dev/null +++ b/queue-5.9/xfs-set-the-unwritten-bit-in-rmap-lookup-flags-in-xc.patch @@ -0,0 +1,38 @@ +From 417734315af8e3b453a29377557f03049473a76a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 16:32:43 -0800 +Subject: xfs: set the unwritten bit in rmap lookup flags in + xchk_bmap_get_rmapextents + +From: Darrick J. Wong + +[ Upstream commit 5dda3897fd90783358c4c6115ef86047d8c8f503 ] + +When the bmbt scrubber is looking up rmap extents, we need to set the +extent flags from the bmbt record fully. This will matter once we fix +the rmap btree comparison functions to check those flags correctly. + +Fixes: d852657ccfc0 ("xfs: cross-reference reverse-mapping btree") +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/scrub/bmap.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/xfs/scrub/bmap.c b/fs/xfs/scrub/bmap.c +index 955302e7cdde9..412e2ec55e388 100644 +--- a/fs/xfs/scrub/bmap.c ++++ b/fs/xfs/scrub/bmap.c +@@ -113,6 +113,8 @@ xchk_bmap_get_rmap( + + if (info->whichfork == XFS_ATTR_FORK) + rflags |= XFS_RMAP_ATTR_FORK; ++ if (irec->br_state == XFS_EXT_UNWRITTEN) ++ rflags |= XFS_RMAP_UNWRITTEN; + + /* + * CoW staging extents are owned (on disk) by the refcountbt, so +-- +2.27.0 +