From: Sasha Levin Date: Sun, 22 Aug 2021 02:39:19 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v5.13.13~22 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4304874b6ef59caa5560c55b0671101985b00888;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/arm64-dts-qcom-c630-fix-correct-powerdown-pin-for-ws.patch b/queue-5.10/arm64-dts-qcom-c630-fix-correct-powerdown-pin-for-ws.patch new file mode 100644 index 00000000000..26112e3b91a --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-c630-fix-correct-powerdown-pin-for-ws.patch @@ -0,0 +1,53 @@ +From 45c4e3b0b07c06237da188666eeec1d9223da10f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jul 2021 09:35:23 +0100 +Subject: arm64: dts: qcom: c630: fix correct powerdown pin for WSA881x + +From: Srinivas Kandagatla + +[ Upstream commit 9a253bb42f190efd1a1c156939ad7298b3529dca ] + +WSA881x powerdown pin is connected to GPIO1, GPIO2 not GPIO2 and GPIO3, +so correct this. This was working so far due to a shift bug in gpio driver, +however once that is fixed this will stop working, so fix this! + +For some reason we forgot to add this dts change in last merge cycle so +currently audio is broken in 5.13 as the gpio driver fix already landed +in 5.13. + +Reported-by: Shawn Guo +Fixes: 45021d35fcb2 ("arm64: dts: qcom: c630: Enable audio support") +Signed-off-by: Srinivas Kandagatla +Tested-by: Shawn Guo +Link: https://lore.kernel.org/r/20210706083523.10601-1-srinivas.kandagatla@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts +index 888dc23a530e..ad6561843ba2 100644 +--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts ++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts +@@ -564,7 +564,7 @@ + left_spkr: wsa8810-left{ + compatible = "sdw10217211000"; + reg = <0 3>; +- powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>; ++ powerdown-gpios = <&wcdgpio 1 GPIO_ACTIVE_HIGH>; + #thermal-sensor-cells = <0>; + sound-name-prefix = "SpkrLeft"; + #sound-dai-cells = <0>; +@@ -572,7 +572,7 @@ + + right_spkr: wsa8810-right{ + compatible = "sdw10217211000"; +- powerdown-gpios = <&wcdgpio 3 GPIO_ACTIVE_HIGH>; ++ powerdown-gpios = <&wcdgpio 2 GPIO_ACTIVE_HIGH>; + reg = <0 4>; + #thermal-sensor-cells = <0>; + sound-name-prefix = "SpkrRight"; +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-qcom-msm8992-bullhead-remove-psci.patch b/queue-5.10/arm64-dts-qcom-msm8992-bullhead-remove-psci.patch new file mode 100644 index 00000000000..50ea4587014 --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-msm8992-bullhead-remove-psci.patch @@ -0,0 +1,46 @@ +From 76c3c824ca52306c698b74d2baf985727272a5f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 20:57:33 +0200 +Subject: arm64: dts: qcom: msm8992-bullhead: Remove PSCI + +From: Petr Vorel + +[ Upstream commit 9d1fc2e4f5a94a492c7dd1ca577c66fdb7571c84 ] + +Bullhead firmware obviously doesn't support PSCI as it fails to boot +with this definition. + +Fixes: 329e16d5f8fc ("arm64: dts: qcom: msm8992: Add PSCI support.") +Signed-off-by: Petr Vorel +Link: https://lore.kernel.org/r/20210713185734.380-2-petr.vorel@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +index 5969b5cfdc85..cb82864a90ef 100644 +--- a/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8992-bullhead-rev-101.dts +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* Copyright (c) 2015, LGE Inc. All rights reserved. + * Copyright (c) 2016, The Linux Foundation. All rights reserved. ++ * Copyright (c) 2021, Petr Vorel + */ + + /dts-v1/; +@@ -15,6 +16,9 @@ + qcom,board-id = <0xb64 0>; + qcom,pmic-id = <0x10009 0x1000A 0x0 0x0>; + ++ /* Bullhead firmware doesn't support PSCI */ ++ /delete-node/ psci; ++ + aliases { + serial0 = &blsp1_uart2; + }; +-- +2.30.2 + diff --git a/queue-5.10/bnxt-count-tx-drops.patch b/queue-5.10/bnxt-count-tx-drops.patch new file mode 100644 index 00000000000..c32269d1d41 --- /dev/null +++ b/queue-5.10/bnxt-count-tx-drops.patch @@ -0,0 +1,43 @@ +From a4700bae675c3f67bee218d09744c3cdca739c75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:42:42 -0700 +Subject: bnxt: count Tx drops + +From: Jakub Kicinski + +[ Upstream commit fb9f7190092d2bbd1f8f0b1cc252732cbe99a87e ] + +Drivers should count packets they are dropping. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reviewed-by: Michael Chan +Reviewed-by: Edwin Peer +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index dd03e1e6279a..96b76b713dd8 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -406,6 +406,7 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + i = skb_get_queue_mapping(skb); + if (unlikely(i >= bp->tx_nr_rings)) { + dev_kfree_skb_any(skb); ++ atomic_long_inc(&dev->tx_dropped); + return NETDEV_TX_OK; + } + +@@ -655,6 +656,7 @@ tx_kick_pending: + if (txr->kick_pending) + bnxt_txr_db_kick(bp, txr, txr->tx_prod); + txr->tx_buf_ring[txr->tx_prod].skb = NULL; ++ atomic_long_inc(&dev->tx_dropped); + return NETDEV_TX_OK; + } + +-- +2.30.2 + diff --git a/queue-5.10/bnxt-disable-napi-before-canceling-dim.patch b/queue-5.10/bnxt-disable-napi-before-canceling-dim.patch new file mode 100644 index 00000000000..af2aab493ea --- /dev/null +++ b/queue-5.10/bnxt-disable-napi-before-canceling-dim.patch @@ -0,0 +1,43 @@ +From c669f1b8ea3b884f4c4467ef1dc0c16d79bb34ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:42:40 -0700 +Subject: bnxt: disable napi before canceling DIM + +From: Jakub Kicinski + +[ Upstream commit 01cca6b9330ac7460de44eeeb3a0607f8aae69ff ] + +napi schedules DIM, napi has to be disabled first, +then DIM canceled. + +Noticed while reading the code. + +Fixes: 0bc0b97fca73 ("bnxt_en: cleanup DIM work on device shutdown") +Fixes: 6a8788f25625 ("bnxt_en: add support for software dynamic interrupt moderation") +Reviewed-by: Michael Chan +Reviewed-by: Edwin Peer +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 65e41612b9da..621346656af3 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8855,10 +8855,9 @@ static void bnxt_disable_napi(struct bnxt *bp) + for (i = 0; i < bp->cp_nr_rings; i++) { + struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring; + ++ napi_disable(&bp->bnapi[i]->napi); + if (bp->bnapi[i]->rx_ring) + cancel_work_sync(&cpr->dim.work); +- +- napi_disable(&bp->bnapi[i]->napi); + } + } + +-- +2.30.2 + diff --git a/queue-5.10/bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch b/queue-5.10/bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch new file mode 100644 index 00000000000..2149c51eac4 --- /dev/null +++ b/queue-5.10/bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch @@ -0,0 +1,141 @@ +From f62a60e55193601b9c2c7c26c72b888d5bc3141d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:42:39 -0700 +Subject: bnxt: don't lock the tx queue from napi poll + +From: Jakub Kicinski + +[ Upstream commit 3c603136c9f82833813af77185618de5af67676c ] + +We can't take the tx lock from the napi poll routine, because +netpoll can poll napi at any moment, including with the tx lock +already held. + +The tx lock is protecting against two paths - the disable +path, and (as Michael points out) the NETDEV_TX_BUSY case +which may occur if NAPI completions race with start_xmit +and both decide to re-enable the queue. + +For the disable/ifdown path use synchronize_net() to make sure +closing the device does not race we restarting the queues. +Annotate accesses to dev_state against data races. + +For the NAPI cleanup vs start_xmit path - appropriate barriers +are already in place in the main spot where Tx queue is stopped +but we need to do the same careful dance in the TX_BUSY case. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reviewed-by: Michael Chan +Reviewed-by: Edwin Peer +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 54 ++++++++++++++--------- + 1 file changed, 32 insertions(+), 22 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 8f169508a90a..65e41612b9da 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -360,6 +360,26 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb) + return md_dst->u.port_info.port_id; + } + ++static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp, ++ struct bnxt_tx_ring_info *txr, ++ struct netdev_queue *txq) ++{ ++ netif_tx_stop_queue(txq); ++ ++ /* netif_tx_stop_queue() must be done before checking ++ * tx index in bnxt_tx_avail() below, because in ++ * bnxt_tx_int(), we update tx index before checking for ++ * netif_tx_queue_stopped(). ++ */ ++ smp_mb(); ++ if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) { ++ netif_tx_wake_queue(txq); ++ return false; ++ } ++ ++ return true; ++} ++ + static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + { + struct bnxt *bp = netdev_priv(dev); +@@ -387,8 +407,8 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + free_size = bnxt_tx_avail(bp, txr); + if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) { +- netif_tx_stop_queue(txq); +- return NETDEV_TX_BUSY; ++ if (bnxt_txr_netif_try_stop_queue(bp, txr, txq)) ++ return NETDEV_TX_BUSY; + } + + length = skb->len; +@@ -597,16 +617,7 @@ tx_done: + if (netdev_xmit_more() && !tx_buf->is_push) + bnxt_db_write(bp, &txr->tx_db, prod); + +- netif_tx_stop_queue(txq); +- +- /* netif_tx_stop_queue() must be done before checking +- * tx index in bnxt_tx_avail() below, because in +- * bnxt_tx_int(), we update tx index before checking for +- * netif_tx_queue_stopped(). +- */ +- smp_mb(); +- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) +- netif_tx_wake_queue(txq); ++ bnxt_txr_netif_try_stop_queue(bp, txr, txq); + } + return NETDEV_TX_OK; + +@@ -690,14 +701,9 @@ next_tx_int: + smp_mb(); + + if (unlikely(netif_tx_queue_stopped(txq)) && +- (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh)) { +- __netif_tx_lock(txq, smp_processor_id()); +- if (netif_tx_queue_stopped(txq) && +- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && +- txr->dev_state != BNXT_DEV_STATE_CLOSING) +- netif_tx_wake_queue(txq); +- __netif_tx_unlock(txq); +- } ++ bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && ++ READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING) ++ netif_tx_wake_queue(txq); + } + + static struct page *__bnxt_alloc_rx_page(struct bnxt *bp, dma_addr_t *mapping, +@@ -8885,9 +8891,11 @@ void bnxt_tx_disable(struct bnxt *bp) + if (bp->tx_ring) { + for (i = 0; i < bp->tx_nr_rings; i++) { + txr = &bp->tx_ring[i]; +- txr->dev_state = BNXT_DEV_STATE_CLOSING; ++ WRITE_ONCE(txr->dev_state, BNXT_DEV_STATE_CLOSING); + } + } ++ /* Make sure napi polls see @dev_state change */ ++ synchronize_net(); + /* Drop carrier first to prevent TX timeout */ + netif_carrier_off(bp->dev); + /* Stop all TX queues */ +@@ -8901,8 +8909,10 @@ void bnxt_tx_enable(struct bnxt *bp) + + for (i = 0; i < bp->tx_nr_rings; i++) { + txr = &bp->tx_ring[i]; +- txr->dev_state = 0; ++ WRITE_ONCE(txr->dev_state, 0); + } ++ /* Make sure napi polls see @dev_state change */ ++ synchronize_net(); + netif_tx_wake_all_queues(bp->dev); + if (bp->link_info.link_up) + netif_carrier_on(bp->dev); +-- +2.30.2 + diff --git a/queue-5.10/bnxt-make-sure-xmit_more-errors-does-not-miss-doorbe.patch b/queue-5.10/bnxt-make-sure-xmit_more-errors-does-not-miss-doorbe.patch new file mode 100644 index 00000000000..52a97011be4 --- /dev/null +++ b/queue-5.10/bnxt-make-sure-xmit_more-errors-does-not-miss-doorbe.patch @@ -0,0 +1,152 @@ +From 780a75bbd71ae1e4f8fe5d63dd994e0eb0a03462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 14:42:41 -0700 +Subject: bnxt: make sure xmit_more + errors does not miss doorbells + +From: Jakub Kicinski + +[ Upstream commit e8d8c5d80f5e9d4586c68061b62c642752289095 ] + +skbs are freed on error and not put on the ring. We may, however, +be in a situation where we're freeing the last skb of a batch, +and there is a doorbell ring pending because of xmit_more() being +true earlier. Make sure we ring the door bell in such situations. + +Since errors are rare don't pay attention to xmit_more() and just +always flush the pending frames. + +The busy case should be safe to be left alone because it can +only happen if start_xmit races with completions and they +both enable the queue. In that case the kick can't be pending. + +Noticed while reading the code. + +Fixes: 4d172f21cefe ("bnxt_en: Implement xmit_more.") +Reviewed-by: Michael Chan +Reviewed-by: Edwin Peer +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 39 +++++++++++++++-------- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 + + 2 files changed, 27 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 621346656af3..dd03e1e6279a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -69,7 +69,8 @@ + #include "bnxt_debugfs.h" + + #define BNXT_TX_TIMEOUT (5 * HZ) +-#define BNXT_DEF_MSG_ENABLE (NETIF_MSG_DRV | NETIF_MSG_HW) ++#define BNXT_DEF_MSG_ENABLE (NETIF_MSG_DRV | NETIF_MSG_HW | \ ++ NETIF_MSG_TX_ERR) + + MODULE_LICENSE("GPL"); + MODULE_DESCRIPTION("Broadcom BCM573xx network driver"); +@@ -360,6 +361,13 @@ static u16 bnxt_xmit_get_cfa_action(struct sk_buff *skb) + return md_dst->u.port_info.port_id; + } + ++static void bnxt_txr_db_kick(struct bnxt *bp, struct bnxt_tx_ring_info *txr, ++ u16 prod) ++{ ++ bnxt_db_write(bp, &txr->tx_db, prod); ++ txr->kick_pending = 0; ++} ++ + static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp, + struct bnxt_tx_ring_info *txr, + struct netdev_queue *txq) +@@ -407,6 +415,10 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + + free_size = bnxt_tx_avail(bp, txr); + if (unlikely(free_size < skb_shinfo(skb)->nr_frags + 2)) { ++ /* We must have raced with NAPI cleanup */ ++ if (net_ratelimit() && txr->kick_pending) ++ netif_warn(bp, tx_err, dev, ++ "bnxt: ring busy w/ flush pending!\n"); + if (bnxt_txr_netif_try_stop_queue(bp, txr, txq)) + return NETDEV_TX_BUSY; + } +@@ -510,21 +522,16 @@ static netdev_tx_t bnxt_start_xmit(struct sk_buff *skb, struct net_device *dev) + normal_tx: + if (length < BNXT_MIN_PKT_SIZE) { + pad = BNXT_MIN_PKT_SIZE - length; +- if (skb_pad(skb, pad)) { ++ if (skb_pad(skb, pad)) + /* SKB already freed. */ +- tx_buf->skb = NULL; +- return NETDEV_TX_OK; +- } ++ goto tx_kick_pending; + length = BNXT_MIN_PKT_SIZE; + } + + mapping = dma_map_single(&pdev->dev, skb->data, len, DMA_TO_DEVICE); + +- if (unlikely(dma_mapping_error(&pdev->dev, mapping))) { +- dev_kfree_skb_any(skb); +- tx_buf->skb = NULL; +- return NETDEV_TX_OK; +- } ++ if (unlikely(dma_mapping_error(&pdev->dev, mapping))) ++ goto tx_free; + + dma_unmap_addr_set(tx_buf, mapping, mapping); + flags = (len << TX_BD_LEN_SHIFT) | TX_BD_TYPE_LONG_TX_BD | +@@ -609,13 +616,15 @@ normal_tx: + txr->tx_prod = prod; + + if (!netdev_xmit_more() || netif_xmit_stopped(txq)) +- bnxt_db_write(bp, &txr->tx_db, prod); ++ bnxt_txr_db_kick(bp, txr, prod); ++ else ++ txr->kick_pending = 1; + + tx_done: + + if (unlikely(bnxt_tx_avail(bp, txr) <= MAX_SKB_FRAGS + 1)) { + if (netdev_xmit_more() && !tx_buf->is_push) +- bnxt_db_write(bp, &txr->tx_db, prod); ++ bnxt_txr_db_kick(bp, txr, prod); + + bnxt_txr_netif_try_stop_queue(bp, txr, txq); + } +@@ -627,7 +636,6 @@ tx_dma_error: + /* start back at beginning and unmap skb */ + prod = txr->tx_prod; + tx_buf = &txr->tx_buf_ring[prod]; +- tx_buf->skb = NULL; + dma_unmap_single(&pdev->dev, dma_unmap_addr(tx_buf, mapping), + skb_headlen(skb), PCI_DMA_TODEVICE); + prod = NEXT_TX(prod); +@@ -641,7 +649,12 @@ tx_dma_error: + PCI_DMA_TODEVICE); + } + ++tx_free: + dev_kfree_skb_any(skb); ++tx_kick_pending: ++ if (txr->kick_pending) ++ bnxt_txr_db_kick(bp, txr, txr->tx_prod); ++ txr->tx_buf_ring[txr->tx_prod].skb = NULL; + return NETDEV_TX_OK; + } + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index a95c5afa2f01..95d10e7bbb04 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -770,6 +770,7 @@ struct bnxt_tx_ring_info { + u16 tx_prod; + u16 tx_cons; + u16 txq_index; ++ u8 kick_pending; + struct bnxt_db_info tx_db; + + struct tx_bd *tx_desc_ring[MAX_TX_PAGES]; +-- +2.30.2 + diff --git a/queue-5.10/bnxt_en-add-missing-dma-memory-barriers.patch b/queue-5.10/bnxt_en-add-missing-dma-memory-barriers.patch new file mode 100644 index 00000000000..fcb765a52dc --- /dev/null +++ b/queue-5.10/bnxt_en-add-missing-dma-memory-barriers.patch @@ -0,0 +1,70 @@ +From 191939bd2eea404f0dcf4fc2b8b5eedb59960cfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Aug 2021 16:15:37 -0400 +Subject: bnxt_en: Add missing DMA memory barriers + +From: Michael Chan + +[ Upstream commit 828affc27ed43441bd1efdaf4e07e96dd43a0362 ] + +Each completion ring entry has a valid bit to indicate that the entry +contains a valid completion event. The driver's main poll loop +__bnxt_poll_work() has the proper dma_rmb() to make sure the valid +bit of the next entry has been checked before proceeding further. +But when we call bnxt_rx_pkt() to process the RX event, the RX +completion event consists of two completion entries and only the +first entry has been checked to be valid. We need the same barrier +after checking the next completion entry. Add missing dma_rmb() +barriers in bnxt_rx_pkt() and other similar locations. + +Fixes: 67a95e2022c7 ("bnxt_en: Need memory barrier when processing the completion ring.") +Reported-by: Lance Richardson +Reviewed-by: Andy Gospodarek +Reviewed-by: Lance Richardson +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index dbd99a8fd9c9..849ae99a955a 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1747,6 +1747,10 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons)) + return -EBUSY; + ++ /* The valid test of the entry must be done first before ++ * reading any further. ++ */ ++ dma_rmb(); + prod = rxr->rx_prod; + + if (cmp_type == CMP_TYPE_RX_L2_TPA_START_CMP) { +@@ -1950,6 +1954,10 @@ static int bnxt_force_rx_discard(struct bnxt *bp, + if (!RX_CMP_VALID(rxcmp1, tmp_raw_cons)) + return -EBUSY; + ++ /* The valid test of the entry must be done first before ++ * reading any further. ++ */ ++ dma_rmb(); + cmp_type = RX_CMP_TYPE(rxcmp); + if (cmp_type == CMP_TYPE_RX_L2_CMP) { + rxcmp1->rx_cmp_cfa_code_errors_v2 |= +@@ -2394,6 +2402,10 @@ static int bnxt_poll_nitroa0(struct napi_struct *napi, int budget) + if (!TX_CMP_VALID(txcmp, raw_cons)) + break; + ++ /* The valid test of the entry must be done first before ++ * reading any further. ++ */ ++ dma_rmb(); + if ((TX_CMP_TYPE(txcmp) & 0x30) == 0x10) { + tmp_raw_cons = NEXT_RAW_CMP(raw_cons); + cp_cons = RING_CMP(tmp_raw_cons); +-- +2.30.2 + diff --git a/queue-5.10/bnxt_en-disable-arfs-if-running-on-212-firmware.patch b/queue-5.10/bnxt_en-disable-arfs-if-running-on-212-firmware.patch new file mode 100644 index 00000000000..f0098221801 --- /dev/null +++ b/queue-5.10/bnxt_en-disable-arfs-if-running-on-212-firmware.patch @@ -0,0 +1,38 @@ +From a025cf17f6050ab9440d7177712ab942f889d6ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Aug 2021 16:15:36 -0400 +Subject: bnxt_en: Disable aRFS if running on 212 firmware + +From: Michael Chan + +[ Upstream commit 976e52b718c3de9077fff8f3f674afb159c57fb1 ] + +212 firmware broke aRFS, so disable it. Traffic may stop after ntuple +filters are inserted and deleted by the 212 firmware. + +Fixes: ae10ae740ad2 ("bnxt_en: Add new hardware RFS mode.") +Reviewed-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 96b76b713dd8..dbd99a8fd9c9 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10396,6 +10396,9 @@ static bool bnxt_rfs_supported(struct bnxt *bp) + return true; + return false; + } ++ /* 212 firmware is broken for aRFS */ ++ if (BNXT_FW_MAJ(bp) == 212) ++ return false; + if (BNXT_PF(bp) && !BNXT_CHIP_TYPE_NITRO_A0(bp)) + return true; + if (bp->flags & BNXT_FLAG_NEW_RSS_CAP) +-- +2.30.2 + diff --git a/queue-5.10/bpf-clear-zext_dst-of-dead-insns.patch b/queue-5.10/bpf-clear-zext_dst-of-dead-insns.patch new file mode 100644 index 00000000000..53621d53dc9 --- /dev/null +++ b/queue-5.10/bpf-clear-zext_dst-of-dead-insns.patch @@ -0,0 +1,65 @@ +From e91a1f9dff88ab4f599a736c3e1eaec73d5f4c72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 17:18:10 +0200 +Subject: bpf: Clear zext_dst of dead insns + +From: Ilya Leoshkevich + +[ Upstream commit 45c709f8c71b525b51988e782febe84ce933e7e0 ] + +"access skb fields ok" verifier test fails on s390 with the "verifier +bug. zext_dst is set, but no reg is defined" message. The first insns +of the test prog are ... + + 0: 61 01 00 00 00 00 00 00 ldxw %r0,[%r1+0] + 8: 35 00 00 01 00 00 00 00 jge %r0,0,1 + 10: 61 01 00 08 00 00 00 00 ldxw %r0,[%r1+8] + +... and the 3rd one is dead (this does not look intentional to me, but +this is a separate topic). + +sanitize_dead_code() converts dead insns into "ja -1", but keeps +zext_dst. When opt_subreg_zext_lo32_rnd_hi32() tries to parse such +an insn, it sees this discrepancy and bails. This problem can be seen +only with JITs whose bpf_jit_needs_zext() returns true. + +Fix by clearning dead insns' zext_dst. + +The commits that contributed to this problem are: + +1. 5aa5bd14c5f8 ("bpf: add initial suite for selftests"), which + introduced the test with the dead code. +2. 5327ed3d44b7 ("bpf: verifier: mark verified-insn with + sub-register zext flag"), which introduced the zext_dst flag. +3. 83a2881903f3 ("bpf: Account for BPF_FETCH in + insn_has_def32()"), which introduced the sanity check. +4. 9183671af6db ("bpf: Fix leakage under speculation on + mispredicted branches"), which bisect points to. + +It's best to fix this on stable branches that contain the second one, +since that's the point where the inconsistency was introduced. + +Fixes: 5327ed3d44b7 ("bpf: verifier: mark verified-insn with sub-register zext flag") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210812151811.184086-2-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index ce1e9193365f..1410f128c404 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -10705,6 +10705,7 @@ static void sanitize_dead_code(struct bpf_verifier_env *env) + if (aux_data[i].seen) + continue; + memcpy(insn + i, &trap, sizeof(trap)); ++ aux_data[i].zext_dst = false; + } + } + +-- +2.30.2 + diff --git a/queue-5.10/bus-ti-sysc-fix-error-handling-for-sysc_check_active.patch b/queue-5.10/bus-ti-sysc-fix-error-handling-for-sysc_check_active.patch new file mode 100644 index 00000000000..1727ac7bb15 --- /dev/null +++ b/queue-5.10/bus-ti-sysc-fix-error-handling-for-sysc_check_active.patch @@ -0,0 +1,52 @@ +From bf7ce78bb27c9541a76a5675eb80fffb1e2b4d75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 08:34:46 +0300 +Subject: bus: ti-sysc: Fix error handling for sysc_check_active_timer() + +From: Tony Lindgren + +[ Upstream commit 06a089ef644934372a3062528244fca3417d3430 ] + +We have changed the return type for sysc_check_active_timer() from -EBUSY +to -ENXIO, but the gpt12 system timer fix still checks for -EBUSY. We are +also not returning on other errors like we did earlier as noted by +Pavel Machek . + +Commit 3ff340e24c9d ("bus: ti-sysc: Fix gpt12 system timer issue with +reserved status") should have been updated for commit 65fb73676112 +("bus: ti-sysc: suppress err msg for timers used as clockevent/source"). + +Let's fix the issue by checking for -ENXIO and returning on any other +errors as suggested by Pavel Machek . + +Fixes: 3ff340e24c9d ("bus: ti-sysc: Fix gpt12 system timer issue with reserved status") +Depends-on: 65fb73676112 ("bus: ti-sysc: suppress err msg for timers used as clockevent/source") +Reported-by: Pavel Machek +Reviewed-by: Pavel Machek (CIP) +Cc: Grygorii Strashko +Cc: Jarkko Nikula +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index c3d8d44f28d7..159b57c6dc4d 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -3061,8 +3061,10 @@ static int sysc_probe(struct platform_device *pdev) + return error; + + error = sysc_check_active_timer(ddata); +- if (error == -EBUSY) ++ if (error == -ENXIO) + ddata->reserved = true; ++ else if (error) ++ return error; + + error = sysc_get_clocks(ddata); + if (error) +-- +2.30.2 + diff --git a/queue-5.10/cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch b/queue-5.10/cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch new file mode 100644 index 00000000000..03e2c18531a --- /dev/null +++ b/queue-5.10/cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch @@ -0,0 +1,54 @@ +From cc55c4f0243ab22e9408c38a3775e073ba62f696 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jul 2021 00:56:01 +0200 +Subject: cpufreq: armada-37xx: forbid cpufreq for 1.2 GHz variant +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 484f2b7c61b9ae58cc00c5127bcbcd9177af8dfe ] + +The 1.2 GHz variant of the Armada 3720 SOC is unstable with DVFS: when +the SOC boots, the WTMI firmware sets clocks and AVS values that work +correctly with 1.2 GHz CPU frequency, but random crashes occur once +cpufreq driver starts scaling. + +We do not know currently what is the reason: +- it may be that the voltage value for L0 for 1.2 GHz variant provided + by the vendor in the OTP is simply incorrect when scaling is used, +- it may be that some delay is needed somewhere, +- it may be something else. + +The most sane solution now seems to be to simply forbid the cpufreq +driver on 1.2 GHz variant. + +Signed-off-by: Marek Behún +Fixes: 92ce45fb875d ("cpufreq: Add DVFS support for Armada 37xx") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index e4782f562e7a..2de7fd18f66a 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -102,7 +102,11 @@ struct armada_37xx_dvfs { + }; + + static struct armada_37xx_dvfs armada_37xx_dvfs[] = { +- {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, ++ /* ++ * The cpufreq scaling for 1.2 GHz variant of the SOC is currently ++ * unstable because we do not know how to configure it properly. ++ */ ++ /* {.cpu_freq_max = 1200*1000*1000, .divider = {1, 2, 4, 6} }, */ + {.cpu_freq_max = 1000*1000*1000, .divider = {1, 2, 4, 5} }, + {.cpu_freq_max = 800*1000*1000, .divider = {1, 2, 3, 4} }, + {.cpu_freq_max = 600*1000*1000, .divider = {2, 4, 5, 6} }, +-- +2.30.2 + diff --git a/queue-5.10/dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch b/queue-5.10/dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch new file mode 100644 index 00000000000..34525cce241 --- /dev/null +++ b/queue-5.10/dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch @@ -0,0 +1,54 @@ +From b9721271bd00e73bcfdbf3c9f9f6e0f489b92c47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Aug 2021 16:04:40 -0700 +Subject: dccp: add do-while-0 stubs for dccp_pr_debug macros + +From: Randy Dunlap + +[ Upstream commit 86aab09a4870bb8346c9579864588c3d7f555299 ] + +GCC complains about empty macros in an 'if' statement, so convert +them to 'do {} while (0)' macros. + +Fixes these build warnings: + +net/dccp/output.c: In function 'dccp_xmit_packet': +../net/dccp/output.c:283:71: warning: suggest braces around empty body in an 'if' statement [-Wempty-body] + 283 | dccp_pr_debug("transmit_skb() returned err=%d\n", err); +net/dccp/ackvec.c: In function 'dccp_ackvec_update_old': +../net/dccp/ackvec.c:163:80: warning: suggest braces around empty body in an 'else' statement [-Wempty-body] + 163 | (unsigned long long)seqno, state); + +Fixes: dc841e30eaea ("dccp: Extend CCID packet dequeueing interface") +Fixes: 380240864451 ("dccp ccid-2: Update code for the Ack Vector input/registration routine") +Signed-off-by: Randy Dunlap +Cc: dccp@vger.kernel.org +Cc: "David S. Miller" +Cc: Jakub Kicinski +Cc: Gerrit Renker +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dccp/dccp.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h +index 9cc9d1ee6cdb..c5c1d2b8045e 100644 +--- a/net/dccp/dccp.h ++++ b/net/dccp/dccp.h +@@ -41,9 +41,9 @@ extern bool dccp_debug; + #define dccp_pr_debug_cat(format, a...) DCCP_PRINTK(dccp_debug, format, ##a) + #define dccp_debug(fmt, a...) dccp_pr_debug_cat(KERN_DEBUG fmt, ##a) + #else +-#define dccp_pr_debug(format, a...) +-#define dccp_pr_debug_cat(format, a...) +-#define dccp_debug(format, a...) ++#define dccp_pr_debug(format, a...) do {} while (0) ++#define dccp_pr_debug_cat(format, a...) do {} while (0) ++#define dccp_debug(format, a...) do {} while (0) + #endif + + extern struct inet_hashinfo dccp_hashinfo; +-- +2.30.2 + diff --git a/queue-5.10/drm-mediatek-add-aal-output-size-configuration.patch b/queue-5.10/drm-mediatek-add-aal-output-size-configuration.patch new file mode 100644 index 00000000000..455f460a5d5 --- /dev/null +++ b/queue-5.10/drm-mediatek-add-aal-output-size-configuration.patch @@ -0,0 +1,43 @@ +From 48203b3edb0830ef49bbee9d97e8162f83288f3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Aug 2021 10:55:03 +0800 +Subject: drm/mediatek: Add AAL output size configuration + +From: jason-jh.lin + +[ Upstream commit 71ac6f390f6a3017f58d05d677b961bb1f851338 ] + +To avoid the output width and height is incorrect, +AAL_OUTPUT_SIZE configuration should be set. + +Fixes: 0664d1392c26 ("drm/mediatek: Add AAL engine basic function") +Signed-off-by: jason-jh.lin +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +index fe58edcf57b5..e747ff7ba3dc 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +@@ -34,6 +34,7 @@ + + #define DISP_AAL_EN 0x0000 + #define DISP_AAL_SIZE 0x0030 ++#define DISP_AAL_OUTPUT_SIZE 0x04d8 + + #define DISP_CCORR_EN 0x0000 + #define CCORR_EN BIT(0) +@@ -181,6 +182,7 @@ static void mtk_aal_config(struct mtk_ddp_comp *comp, unsigned int w, + unsigned int bpc, struct cmdq_pkt *cmdq_pkt) + { + mtk_ddp_write(cmdq_pkt, w << 16 | h, comp, DISP_AAL_SIZE); ++ mtk_ddp_write(cmdq_pkt, w << 16 | h, comp, DISP_AAL_OUTPUT_SIZE); + } + + static void mtk_aal_start(struct mtk_ddp_comp *comp) +-- +2.30.2 + diff --git a/queue-5.10/drm-mediatek-fix-aal-size-config.patch b/queue-5.10/drm-mediatek-fix-aal-size-config.patch new file mode 100644 index 00000000000..49a5e6864d8 --- /dev/null +++ b/queue-5.10/drm-mediatek-fix-aal-size-config.patch @@ -0,0 +1,38 @@ +From 5f514173fc833fbff802adbc7ba6b7398078e6ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Jan 2021 15:43:47 +0800 +Subject: drm/mediatek: Fix aal size config + +From: Yongqiang Niu + +[ Upstream commit 71dcadba34203d8dd35152e368720f977e9cdb81 ] + +The orginal setting is not correct, fix it to follow hardware data sheet. +If keep this error setting, mt8173/mt8183 display ok +but mt8192 display abnormal. + +Fixes: 0664d1392c26 ("drm/mediatek: Add AAL engine basic function") + +Signed-off-by: Yongqiang Niu +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +index 3064eac1a750..fe58edcf57b5 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +@@ -180,7 +180,7 @@ static void mtk_aal_config(struct mtk_ddp_comp *comp, unsigned int w, + unsigned int h, unsigned int vrefresh, + unsigned int bpc, struct cmdq_pkt *cmdq_pkt) + { +- mtk_ddp_write(cmdq_pkt, h << 16 | w, comp, DISP_AAL_SIZE); ++ mtk_ddp_write(cmdq_pkt, w << 16 | h, comp, DISP_AAL_SIZE); + } + + static void mtk_aal_start(struct mtk_ddp_comp *comp) +-- +2.30.2 + diff --git a/queue-5.10/i40e-fix-atr-queue-selection.patch b/queue-5.10/i40e-fix-atr-queue-selection.patch new file mode 100644 index 00000000000..9abc27ddcef --- /dev/null +++ b/queue-5.10/i40e-fix-atr-queue-selection.patch @@ -0,0 +1,59 @@ +From b805bc18bb56d1e2783cf4c2a6948568dd17a266 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 10:42:16 -0700 +Subject: i40e: Fix ATR queue selection + +From: Arkadiusz Kubalewski + +[ Upstream commit a222be597e316389f9f8c26033352c124ce93056 ] + +Without this patch, ATR does not work. Receive/transmit uses queue +selection based on SW DCB hashing method. + +If traffic classes are not configured for PF, then use +netdev_pick_tx function for selecting queue for packet transmission. +Instead of calling i40e_swdcb_skb_tx_hash, call netdev_pick_tx, +which ensures that packet is transmitted/received from CPU that is +running the application. + +Reproduction steps: +1. Load i40e driver +2. Map each MSI interrupt of i40e port for each CPU +3. Disable ntuple, enable ATR i.e.: +ethtool -K $interface ntuple off +ethtool --set-priv-flags $interface flow-director-atr +4. Run application that is generating traffic and is bound to a +single CPU, i.e.: +taskset -c 9 netperf -H 1.1.1.1 -t TCP_RR -l 10 +5. Observe behavior: +Application's traffic should be restricted to the CPU provided in +taskset. + +Fixes: 89ec1f0886c1 ("i40e: Fix queue-to-TC mapping on Tx") +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Arkadiusz Kubalewski +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 615802b07521..5ad28129fab2 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -3556,8 +3556,7 @@ u16 i40e_lan_select_queue(struct net_device *netdev, + + /* is DCB enabled at all? */ + if (vsi->tc_config.numtc == 1) +- return i40e_swdcb_skb_tx_hash(netdev, skb, +- netdev->real_num_tx_queues); ++ return netdev_pick_tx(netdev, skb, sb_dev); + + prio = skb->priority; + hw = &vsi->back->hw; +-- +2.30.2 + diff --git a/queue-5.10/iavf-fix-ping-is-lost-after-untrusted-vf-had-tried-t.patch b/queue-5.10/iavf-fix-ping-is-lost-after-untrusted-vf-had-tried-t.patch new file mode 100644 index 00000000000..a2fa5656e8f --- /dev/null +++ b/queue-5.10/iavf-fix-ping-is-lost-after-untrusted-vf-had-tried-t.patch @@ -0,0 +1,133 @@ +From abc6a7bcfb9e4802ae18ab5036d6308ae76d9f61 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 10:42:17 -0700 +Subject: iavf: Fix ping is lost after untrusted VF had tried to change MAC + +From: Sylwester Dziedziuch + +[ Upstream commit 8da80c9d50220a8e4190a4eaa0dd6aeefcbbb5bf ] + +Make changes to MAC address dependent on the response of PF. +Disallow changes to HW MAC address and MAC filter from untrusted +VF, thanks to that ping is not lost if VF tries to change MAC. +Add a new field in iavf_mac_filter, to indicate whether there +was response from PF for given filter. Based on this field pass +or discard the filter. +If untrusted VF tried to change it's address, it's not changed. +Still filter was changed, because of that ping couldn't go through. + +Fixes: c5c922b3e09b ("iavf: fix MAC address setting for VFs when filter is rejected") +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Mateusz Palczewski +Tested-by: Gurucharan G +Signed-off-by: Tony Nguyen +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf.h | 1 + + drivers/net/ethernet/intel/iavf/iavf_main.c | 1 + + .../net/ethernet/intel/iavf/iavf_virtchnl.c | 47 ++++++++++++++++++- + 3 files changed, 47 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index 8a65525a7c0d..6766446a33f4 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -134,6 +134,7 @@ struct iavf_q_vector { + struct iavf_mac_filter { + struct list_head list; + u8 macaddr[ETH_ALEN]; ++ bool is_new_mac; /* filter is new, wait for PF decision */ + bool remove; /* filter needs to be removed */ + bool add; /* filter needs to be added */ + }; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index c4ec9a91c7c5..7023aa147043 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -751,6 +751,7 @@ struct iavf_mac_filter *iavf_add_filter(struct iavf_adapter *adapter, + + list_add_tail(&f->list, &adapter->mac_filter_list); + f->add = true; ++ f->is_new_mac = true; + adapter->aq_required |= IAVF_FLAG_AQ_ADD_MAC_FILTER; + } else { + f->remove = false; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index ed08ace4f05a..8be3151f2c62 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -537,6 +537,47 @@ void iavf_del_ether_addrs(struct iavf_adapter *adapter) + kfree(veal); + } + ++/** ++ * iavf_mac_add_ok ++ * @adapter: adapter structure ++ * ++ * Submit list of filters based on PF response. ++ **/ ++static void iavf_mac_add_ok(struct iavf_adapter *adapter) ++{ ++ struct iavf_mac_filter *f, *ftmp; ++ ++ spin_lock_bh(&adapter->mac_vlan_list_lock); ++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) { ++ f->is_new_mac = false; ++ } ++ spin_unlock_bh(&adapter->mac_vlan_list_lock); ++} ++ ++/** ++ * iavf_mac_add_reject ++ * @adapter: adapter structure ++ * ++ * Remove filters from list based on PF response. ++ **/ ++static void iavf_mac_add_reject(struct iavf_adapter *adapter) ++{ ++ struct net_device *netdev = adapter->netdev; ++ struct iavf_mac_filter *f, *ftmp; ++ ++ spin_lock_bh(&adapter->mac_vlan_list_lock); ++ list_for_each_entry_safe(f, ftmp, &adapter->mac_filter_list, list) { ++ if (f->remove && ether_addr_equal(f->macaddr, netdev->dev_addr)) ++ f->remove = false; ++ ++ if (f->is_new_mac) { ++ list_del(&f->list); ++ kfree(f); ++ } ++ } ++ spin_unlock_bh(&adapter->mac_vlan_list_lock); ++} ++ + /** + * iavf_add_vlans + * @adapter: adapter structure +@@ -1295,6 +1336,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + case VIRTCHNL_OP_ADD_ETH_ADDR: + dev_err(&adapter->pdev->dev, "Failed to add MAC filter, error %s\n", + iavf_stat_str(&adapter->hw, v_retval)); ++ iavf_mac_add_reject(adapter); + /* restore administratively set MAC address */ + ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr); + break; +@@ -1364,10 +1406,11 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + } + } + switch (v_opcode) { +- case VIRTCHNL_OP_ADD_ETH_ADDR: { ++ case VIRTCHNL_OP_ADD_ETH_ADDR: ++ if (!v_retval) ++ iavf_mac_add_ok(adapter); + if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr)) + ether_addr_copy(netdev->dev_addr, adapter->hw.mac.addr); +- } + break; + case VIRTCHNL_OP_GET_STATS: { + struct iavf_eth_stats *stats = +-- +2.30.2 + diff --git a/queue-5.10/iommu-check-if-group-is-null-before-remove-device.patch b/queue-5.10/iommu-check-if-group-is-null-before-remove-device.patch new file mode 100644 index 00000000000..36660bc68b0 --- /dev/null +++ b/queue-5.10/iommu-check-if-group-is-null-before-remove-device.patch @@ -0,0 +1,55 @@ +From a7e6ef9ce115b47b33173103ae0f597851483828 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jul 2021 09:47:37 +0200 +Subject: iommu: Check if group is NULL before remove device + +From: Frank Wunderlich + +[ Upstream commit 5aa95d8834e07907e64937d792c12ffef7fb271f ] + +If probe_device is failing, iommu_group is not initialized because +iommu_group_add_device is not reached, so freeing it will result +in NULL pointer access. + +iommu_bus_init + ->bus_iommu_probe + ->probe_iommu_group in for each:/* return -22 in fail case */ + ->iommu_probe_device + ->__iommu_probe_device /* return -22 here.*/ + -> ops->probe_device /* return -22 here.*/ + -> iommu_group_get_for_dev + -> ops->device_group + -> iommu_group_add_device //good case + ->remove_iommu_group //in fail case, it will remove group + ->iommu_release_device + ->iommu_group_remove_device // here we don't have group + +In my case ops->probe_device (mtk_iommu_probe_device from +mtk_iommu_v1.c) is due to failing fwspec->ops mismatch. + +Fixes: d72e31c93746 ("iommu: IOMMU Groups") +Signed-off-by: Frank Wunderlich +Link: https://lore.kernel.org/r/20210731074737.4573-1-linux@fw-web.de +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/iommu.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 9b8664d388af..bcf060b5cf85 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -879,6 +879,9 @@ void iommu_group_remove_device(struct device *dev) + struct iommu_group *group = dev->iommu_group; + struct group_device *tmp_device, *device = NULL; + ++ if (!group) ++ return; ++ + dev_info(dev, "Removing from iommu group %d\n", group->id); + + /* Pre-notify listeners that a device is being removed. */ +-- +2.30.2 + diff --git a/queue-5.10/iommu-vt-d-consolidate-duplicate-cache-invaliation-c.patch b/queue-5.10/iommu-vt-d-consolidate-duplicate-cache-invaliation-c.patch new file mode 100644 index 00000000000..10fae311ade --- /dev/null +++ b/queue-5.10/iommu-vt-d-consolidate-duplicate-cache-invaliation-c.patch @@ -0,0 +1,134 @@ +From 9b4b2c1b30796c5e543cf38fece4bb1d0761baeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Jan 2021 16:50:21 +0800 +Subject: iommu/vt-d: Consolidate duplicate cache invaliation code + +From: Lu Baolu + +[ Upstream commit 9872f9bd9dbd68f75e8db782717d71e8594f6a02 ] + +The pasid based IOTLB and devTLB invalidation code is duplicate in +several places. Consolidate them by using the common helpers. + +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20210114085021.717041-1-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/pasid.c | 18 ++---------- + drivers/iommu/intel/svm.c | 55 ++++++------------------------------- + 2 files changed, 11 insertions(+), 62 deletions(-) + +diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c +index 1e7c17989084..77fbe9908abd 100644 +--- a/drivers/iommu/intel/pasid.c ++++ b/drivers/iommu/intel/pasid.c +@@ -466,20 +466,6 @@ pasid_cache_invalidation_with_pasid(struct intel_iommu *iommu, + qi_submit_sync(iommu, &desc, 1, 0); + } + +-static void +-iotlb_invalidation_with_pasid(struct intel_iommu *iommu, u16 did, u32 pasid) +-{ +- struct qi_desc desc; +- +- desc.qw0 = QI_EIOTLB_PASID(pasid) | QI_EIOTLB_DID(did) | +- QI_EIOTLB_GRAN(QI_GRAN_NONG_PASID) | QI_EIOTLB_TYPE; +- desc.qw1 = 0; +- desc.qw2 = 0; +- desc.qw3 = 0; +- +- qi_submit_sync(iommu, &desc, 1, 0); +-} +- + static void + devtlb_invalidation_with_pasid(struct intel_iommu *iommu, + struct device *dev, u32 pasid) +@@ -524,7 +510,7 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu, struct device *dev, + clflush_cache_range(pte, sizeof(*pte)); + + pasid_cache_invalidation_with_pasid(iommu, did, pasid); +- iotlb_invalidation_with_pasid(iommu, did, pasid); ++ qi_flush_piotlb(iommu, did, pasid, 0, -1, 0); + + /* Device IOTLB doesn't need to be flushed in caching mode. */ + if (!cap_caching_mode(iommu->cap)) +@@ -540,7 +526,7 @@ static void pasid_flush_caches(struct intel_iommu *iommu, + + if (cap_caching_mode(iommu->cap)) { + pasid_cache_invalidation_with_pasid(iommu, did, pasid); +- iotlb_invalidation_with_pasid(iommu, did, pasid); ++ qi_flush_piotlb(iommu, did, pasid, 0, -1, 0); + } else { + iommu_flush_write_buffer(iommu); + } +diff --git a/drivers/iommu/intel/svm.c b/drivers/iommu/intel/svm.c +index 6168dec7cb40..aabf56272b86 100644 +--- a/drivers/iommu/intel/svm.c ++++ b/drivers/iommu/intel/svm.c +@@ -123,53 +123,16 @@ static void __flush_svm_range_dev(struct intel_svm *svm, + unsigned long address, + unsigned long pages, int ih) + { +- struct qi_desc desc; ++ struct device_domain_info *info = get_domain_info(sdev->dev); + +- if (pages == -1) { +- desc.qw0 = QI_EIOTLB_PASID(svm->pasid) | +- QI_EIOTLB_DID(sdev->did) | +- QI_EIOTLB_GRAN(QI_GRAN_NONG_PASID) | +- QI_EIOTLB_TYPE; +- desc.qw1 = 0; +- } else { +- int mask = ilog2(__roundup_pow_of_two(pages)); +- +- desc.qw0 = QI_EIOTLB_PASID(svm->pasid) | +- QI_EIOTLB_DID(sdev->did) | +- QI_EIOTLB_GRAN(QI_GRAN_PSI_PASID) | +- QI_EIOTLB_TYPE; +- desc.qw1 = QI_EIOTLB_ADDR(address) | +- QI_EIOTLB_IH(ih) | +- QI_EIOTLB_AM(mask); +- } +- desc.qw2 = 0; +- desc.qw3 = 0; +- qi_submit_sync(sdev->iommu, &desc, 1, 0); +- +- if (sdev->dev_iotlb) { +- desc.qw0 = QI_DEV_EIOTLB_PASID(svm->pasid) | +- QI_DEV_EIOTLB_SID(sdev->sid) | +- QI_DEV_EIOTLB_QDEP(sdev->qdep) | +- QI_DEIOTLB_TYPE; +- if (pages == -1) { +- desc.qw1 = QI_DEV_EIOTLB_ADDR(-1ULL >> 1) | +- QI_DEV_EIOTLB_SIZE; +- } else if (pages > 1) { +- /* The least significant zero bit indicates the size. So, +- * for example, an "address" value of 0x12345f000 will +- * flush from 0x123440000 to 0x12347ffff (256KiB). */ +- unsigned long last = address + ((unsigned long)(pages - 1) << VTD_PAGE_SHIFT); +- unsigned long mask = __rounddown_pow_of_two(address ^ last); +- +- desc.qw1 = QI_DEV_EIOTLB_ADDR((address & ~mask) | +- (mask - 1)) | QI_DEV_EIOTLB_SIZE; +- } else { +- desc.qw1 = QI_DEV_EIOTLB_ADDR(address); +- } +- desc.qw2 = 0; +- desc.qw3 = 0; +- qi_submit_sync(sdev->iommu, &desc, 1, 0); +- } ++ if (WARN_ON(!pages)) ++ return; ++ ++ qi_flush_piotlb(sdev->iommu, sdev->did, svm->pasid, address, pages, ih); ++ if (info->ats_enabled) ++ qi_flush_dev_iotlb_pasid(sdev->iommu, sdev->sid, info->pfsid, ++ svm->pasid, sdev->qdep, address, ++ order_base_2(pages)); + } + + static void intel_flush_svm_range_dev(struct intel_svm *svm, +-- +2.30.2 + diff --git a/queue-5.10/iommu-vt-d-fix-incomplete-cache-flush-in-intel_pasid.patch b/queue-5.10/iommu-vt-d-fix-incomplete-cache-flush-in-intel_pasid.patch new file mode 100644 index 00000000000..412daea3e5c --- /dev/null +++ b/queue-5.10/iommu-vt-d-fix-incomplete-cache-flush-in-intel_pasid.patch @@ -0,0 +1,91 @@ +From e86594c91d33b1de9aebd0685bce315a74858d1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 20:43:21 +0800 +Subject: iommu/vt-d: Fix incomplete cache flush in + intel_pasid_tear_down_entry() + +From: Liu Yi L + +[ Upstream commit 8798d36411196da86e70b994725349c16c1119f6 ] + +This fixes improper iotlb invalidation in intel_pasid_tear_down_entry(). +When a PASID was used as nested mode, released and reused, the following +error message will appear: + +[ 180.187556] Unexpected page request in Privilege Mode +[ 180.187565] Unexpected page request in Privilege Mode +[ 180.279933] Unexpected page request in Privilege Mode +[ 180.279937] Unexpected page request in Privilege Mode + +Per chapter 6.5.3.3 of VT-d spec 3.3, when tear down a pasid entry, the +software should use Domain selective IOTLB flush if the PGTT of the pasid +entry is SL only or Nested, while for the pasid entries whose PGTT is FL +only or PT using PASID-based IOTLB flush is enough. + +Fixes: 2cd1311a26673 ("iommu/vt-d: Add set domain DOMAIN_ATTR_NESTING attr") +Signed-off-by: Kumar Sanjay K +Signed-off-by: Liu Yi L +Tested-by: Yi Sun +Link: https://lore.kernel.org/r/20210817042425.1784279-1-yi.l.liu@intel.com +Signed-off-by: Lu Baolu +Link: https://lore.kernel.org/r/20210817124321.1517985-3-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/pasid.c | 10 ++++++++-- + drivers/iommu/intel/pasid.h | 6 ++++++ + 2 files changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c +index 77fbe9908abd..fb911b6c418f 100644 +--- a/drivers/iommu/intel/pasid.c ++++ b/drivers/iommu/intel/pasid.c +@@ -497,20 +497,26 @@ void intel_pasid_tear_down_entry(struct intel_iommu *iommu, struct device *dev, + u32 pasid, bool fault_ignore) + { + struct pasid_entry *pte; +- u16 did; ++ u16 did, pgtt; + + pte = intel_pasid_get_entry(dev, pasid); + if (WARN_ON(!pte)) + return; + + did = pasid_get_domain_id(pte); ++ pgtt = pasid_pte_get_pgtt(pte); ++ + intel_pasid_clear_entry(dev, pasid, fault_ignore); + + if (!ecap_coherent(iommu->ecap)) + clflush_cache_range(pte, sizeof(*pte)); + + pasid_cache_invalidation_with_pasid(iommu, did, pasid); +- qi_flush_piotlb(iommu, did, pasid, 0, -1, 0); ++ ++ if (pgtt == PASID_ENTRY_PGTT_PT || pgtt == PASID_ENTRY_PGTT_FL_ONLY) ++ qi_flush_piotlb(iommu, did, pasid, 0, -1, 0); ++ else ++ iommu->flush.flush_iotlb(iommu, did, 0, 0, DMA_TLB_DSI_FLUSH); + + /* Device IOTLB doesn't need to be flushed in caching mode. */ + if (!cap_caching_mode(iommu->cap)) +diff --git a/drivers/iommu/intel/pasid.h b/drivers/iommu/intel/pasid.h +index 086ebd697319..30cb30046b15 100644 +--- a/drivers/iommu/intel/pasid.h ++++ b/drivers/iommu/intel/pasid.h +@@ -99,6 +99,12 @@ static inline bool pasid_pte_is_present(struct pasid_entry *pte) + return READ_ONCE(pte->val[0]) & PASID_PTE_PRESENT; + } + ++/* Get PGTT field of a PASID table entry */ ++static inline u16 pasid_pte_get_pgtt(struct pasid_entry *pte) ++{ ++ return (u16)((READ_ONCE(pte->val[0]) >> 6) & 0x7); ++} ++ + extern unsigned int intel_pasid_max_id; + int intel_pasid_alloc_id(void *ptr, int start, int end, gfp_t gfp); + void intel_pasid_free_id(u32 pasid); +-- +2.30.2 + diff --git a/queue-5.10/ixgbe-xsk-clean-up-the-resources-in-ixgbe_xsk_pool_e.patch b/queue-5.10/ixgbe-xsk-clean-up-the-resources-in-ixgbe_xsk_pool_e.patch new file mode 100644 index 00000000000..73f7354f4ff --- /dev/null +++ b/queue-5.10/ixgbe-xsk-clean-up-the-resources-in-ixgbe_xsk_pool_e.patch @@ -0,0 +1,48 @@ +From 46369460f0752e5cb0486d0703870cbf6c059021 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 13:37:36 -0700 +Subject: ixgbe, xsk: clean up the resources in ixgbe_xsk_pool_enable error + path + +From: Wang Hai + +[ Upstream commit 1b80fec7b043552e01609bae7d0aad07aa742adc ] + +In ixgbe_xsk_pool_enable(), if ixgbe_xsk_wakeup() fails, +We should restore the previous state and clean up the +resources. Add the missing clear af_xdp_zc_qps and unmap dma +to fix this bug. + +Fixes: d49e286d354e ("ixgbe: add tracking of AF_XDP zero-copy state for each queue pair") +Fixes: 4a9b32f30f80 ("ixgbe: fix potential RX buffer starvation for AF_XDP") +Signed-off-by: Wang Hai +Acked-by: Magnus Karlsson +Tested-by: Sandeep Penigalapati +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20210817203736.3529939-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c +index f72d2978263b..d60da7a89092 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_xsk.c +@@ -52,8 +52,11 @@ static int ixgbe_xsk_pool_enable(struct ixgbe_adapter *adapter, + + /* Kick start the NAPI context so that receiving will start */ + err = ixgbe_xsk_wakeup(adapter->netdev, qid, XDP_WAKEUP_RX); +- if (err) ++ if (err) { ++ clear_bit(qid, adapter->af_xdp_zc_qps); ++ xsk_pool_dma_unmap(pool, IXGBE_RX_DMA_ATTR); + return err; ++ } + } + + return 0; +-- +2.30.2 + diff --git a/queue-5.10/net-6pack-fix-slab-out-of-bounds-in-decode_data.patch b/queue-5.10/net-6pack-fix-slab-out-of-bounds-in-decode_data.patch new file mode 100644 index 00000000000..58365eb5f4c --- /dev/null +++ b/queue-5.10/net-6pack-fix-slab-out-of-bounds-in-decode_data.patch @@ -0,0 +1,67 @@ +From c4e142995ccb88ba02d01f92a9cd9c4eee8c38dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 18:14:33 +0300 +Subject: net: 6pack: fix slab-out-of-bounds in decode_data + +From: Pavel Skripkin + +[ Upstream commit 19d1532a187669ce86d5a2696eb7275310070793 ] + +Syzbot reported slab-out-of bounds write in decode_data(). +The problem was in missing validation checks. + +Syzbot's reproducer generated malicious input, which caused +decode_data() to be called a lot in sixpack_decode(). Since +rx_count_cooked is only 400 bytes and noone reported before, +that 400 bytes is not enough, let's just check if input is malicious +and complain about buffer overrun. + +Fail log: +================================================================== +BUG: KASAN: slab-out-of-bounds in drivers/net/hamradio/6pack.c:843 +Write of size 1 at addr ffff888087c5544e by task kworker/u4:0/7 + +CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.6.0-rc3-syzkaller #0 +... +Workqueue: events_unbound flush_to_ldisc +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x197/0x210 lib/dump_stack.c:118 + print_address_description.constprop.0.cold+0xd4/0x30b mm/kasan/report.c:374 + __kasan_report.cold+0x1b/0x32 mm/kasan/report.c:506 + kasan_report+0x12/0x20 mm/kasan/common.c:641 + __asan_report_store1_noabort+0x17/0x20 mm/kasan/generic_report.c:137 + decode_data.part.0+0x23b/0x270 drivers/net/hamradio/6pack.c:843 + decode_data drivers/net/hamradio/6pack.c:965 [inline] + sixpack_decode drivers/net/hamradio/6pack.c:968 [inline] + +Reported-and-tested-by: syzbot+fc8cd9a673d4577fb2e4@syzkaller.appspotmail.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Pavel Skripkin +Reviewed-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/hamradio/6pack.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index 71d6629e65c9..da13683d52d1 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -839,6 +839,12 @@ static void decode_data(struct sixpack *sp, unsigned char inbyte) + return; + } + ++ if (sp->rx_count_cooked + 2 >= sizeof(sp->cooked_buf)) { ++ pr_err("6pack: cooked buffer overrun, data loss\n"); ++ sp->rx_count = 0; ++ return; ++ } ++ + buf = sp->raw_buf; + sp->cooked_buf[sp->rx_count_cooked++] = + buf[0] | ((buf[1] << 2) & 0xc0); +-- +2.30.2 + diff --git a/queue-5.10/net-mdio-mux-don-t-ignore-memory-allocation-errors.patch b/queue-5.10/net-mdio-mux-don-t-ignore-memory-allocation-errors.patch new file mode 100644 index 00000000000..9364d74d869 --- /dev/null +++ b/queue-5.10/net-mdio-mux-don-t-ignore-memory-allocation-errors.patch @@ -0,0 +1,96 @@ +From a8d2674555f302f07f8e6233a62fc1c0f5bb4c2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 20:38:02 -0700 +Subject: net: mdio-mux: Don't ignore memory allocation errors + +From: Saravana Kannan + +[ Upstream commit 99d81e942474cc7677d12f673f42a7ea699e2589 ] + +If we are seeing memory allocation errors, don't try to continue +registering child mdiobus devices. It's unlikely they'll succeed. + +Fixes: 342fa1964439 ("mdio: mux: make child bus walking more permissive and errors more verbose") +Signed-off-by: Saravana Kannan +Reviewed-by: Andrew Lunn +Acked-by: Marc Zyngier +Tested-by: Marc Zyngier +Acked-by: Kevin Hilman +Tested-by: Kevin Hilman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/mdio/mdio-mux.c | 28 ++++++++++++++++++---------- + 1 file changed, 18 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/mdio/mdio-mux.c b/drivers/net/mdio/mdio-mux.c +index 6a1d3540210b..c96ef3b3fa3a 100644 +--- a/drivers/net/mdio/mdio-mux.c ++++ b/drivers/net/mdio/mdio-mux.c +@@ -82,6 +82,17 @@ out: + + static int parent_count; + ++static void mdio_mux_uninit_children(struct mdio_mux_parent_bus *pb) ++{ ++ struct mdio_mux_child_bus *cb = pb->children; ++ ++ while (cb) { ++ mdiobus_unregister(cb->mii_bus); ++ mdiobus_free(cb->mii_bus); ++ cb = cb->next; ++ } ++} ++ + int mdio_mux_init(struct device *dev, + struct device_node *mux_node, + int (*switch_fn)(int cur, int desired, void *data), +@@ -144,7 +155,7 @@ int mdio_mux_init(struct device *dev, + cb = devm_kzalloc(dev, sizeof(*cb), GFP_KERNEL); + if (!cb) { + ret_val = -ENOMEM; +- continue; ++ goto err_loop; + } + cb->bus_number = v; + cb->parent = pb; +@@ -152,8 +163,7 @@ int mdio_mux_init(struct device *dev, + cb->mii_bus = mdiobus_alloc(); + if (!cb->mii_bus) { + ret_val = -ENOMEM; +- devm_kfree(dev, cb); +- continue; ++ goto err_loop; + } + cb->mii_bus->priv = cb; + +@@ -182,6 +192,10 @@ int mdio_mux_init(struct device *dev, + + dev_err(dev, "Error: No acceptable child buses found\n"); + devm_kfree(dev, pb); ++ ++err_loop: ++ mdio_mux_uninit_children(pb); ++ of_node_put(child_bus_node); + err_pb_kz: + put_device(&parent_bus->dev); + err_parent_bus: +@@ -193,14 +207,8 @@ EXPORT_SYMBOL_GPL(mdio_mux_init); + void mdio_mux_uninit(void *mux_handle) + { + struct mdio_mux_parent_bus *pb = mux_handle; +- struct mdio_mux_child_bus *cb = pb->children; +- +- while (cb) { +- mdiobus_unregister(cb->mii_bus); +- mdiobus_free(cb->mii_bus); +- cb = cb->next; +- } + ++ mdio_mux_uninit_children(pb); + put_device(&pb->mii_bus->dev); + } + EXPORT_SYMBOL_GPL(mdio_mux_uninit); +-- +2.30.2 + diff --git a/queue-5.10/net-mdio-mux-handle-eprobe_defer-correctly.patch b/queue-5.10/net-mdio-mux-handle-eprobe_defer-correctly.patch new file mode 100644 index 00000000000..b0b286b2cb7 --- /dev/null +++ b/queue-5.10/net-mdio-mux-handle-eprobe_defer-correctly.patch @@ -0,0 +1,58 @@ +From ff54e9bb2afcd37e8c23d0d799c3551f5421572a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 20:38:03 -0700 +Subject: net: mdio-mux: Handle -EPROBE_DEFER correctly + +From: Saravana Kannan + +[ Upstream commit 7bd0cef5dac685f09ef8b0b2a7748ff42d284dc7 ] + +When registering mdiobus children, if we get an -EPROBE_DEFER, we shouldn't +ignore it and continue registering the rest of the mdiobus children. This +would permanently prevent the deferring child mdiobus from working instead +of reattempting it in the future. So, if a child mdiobus needs to be +reattempted in the future, defer the entire mdio-mux initialization. + +This fixes the issue where PHYs sitting under the mdio-mux aren't +initialized correctly if the PHY's interrupt controller is not yet ready +when the mdio-mux is being probed. Additional context in the link below. + +Fixes: 0ca2997d1452 ("netdev/of/phy: Add MDIO bus multiplexer support.") +Link: https://lore.kernel.org/lkml/CAGETcx95kHrv8wA-O+-JtfH7H9biJEGJtijuPVN0V5dUKUAB3A@mail.gmail.com/#t +Signed-off-by: Saravana Kannan +Reviewed-by: Andrew Lunn +Acked-by: Marc Zyngier +Tested-by: Marc Zyngier +Acked-by: Kevin Hilman +Tested-by: Kevin Hilman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/mdio/mdio-mux.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/mdio/mdio-mux.c b/drivers/net/mdio/mdio-mux.c +index c96ef3b3fa3a..ccb3ee704eb1 100644 +--- a/drivers/net/mdio/mdio-mux.c ++++ b/drivers/net/mdio/mdio-mux.c +@@ -175,11 +175,15 @@ int mdio_mux_init(struct device *dev, + cb->mii_bus->write = mdio_mux_write; + r = of_mdiobus_register(cb->mii_bus, child_bus_node); + if (r) { ++ mdiobus_free(cb->mii_bus); ++ if (r == -EPROBE_DEFER) { ++ ret_val = r; ++ goto err_loop; ++ } ++ devm_kfree(dev, cb); + dev_err(dev, + "Error: Failed to register MDIO bus for child %pOF\n", + child_bus_node); +- mdiobus_free(cb->mii_bus); +- devm_kfree(dev, cb); + } else { + cb->next = pb->children; + pb->children = cb; +-- +2.30.2 + diff --git a/queue-5.10/net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch b/queue-5.10/net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch new file mode 100644 index 00000000000..1bdb2ae8189 --- /dev/null +++ b/queue-5.10/net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch @@ -0,0 +1,42 @@ +From 65717ed978a5b841ccf7cb8ebbe909b9a2f209e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 21:14:04 +0800 +Subject: net: qlcnic: add missed unlock in qlcnic_83xx_flash_read32 + +From: Dinghao Liu + +[ Upstream commit 0a298d133893c72c96e2156ed7cb0f0c4a306a3e ] + +qlcnic_83xx_unlock_flash() is called on all paths after we call +qlcnic_83xx_lock_flash(), except for one error path on failure +of QLCRD32(), which may cause a deadlock. This bug is suggested +by a static analysis tool, please advise. + +Fixes: 81d0aeb0a4fff ("qlcnic: flash template based firmware reset recovery") +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20210816131405.24024-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +index d8882d0b6b49..d51bac7ba5af 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c +@@ -3156,8 +3156,10 @@ int qlcnic_83xx_flash_read32(struct qlcnic_adapter *adapter, u32 flash_addr, + + indirect_addr = QLC_83XX_FLASH_DIRECT_DATA(addr); + ret = QLCRD32(adapter, indirect_addr, &err); +- if (err == -EIO) ++ if (err == -EIO) { ++ qlcnic_83xx_unlock_flash(adapter); + return err; ++ } + + word = ret; + *(u32 *)p_data = word; +-- +2.30.2 + diff --git a/queue-5.10/ovs-clear-skb-tstamp-in-forwarding-path.patch b/queue-5.10/ovs-clear-skb-tstamp-in-forwarding-path.patch new file mode 100644 index 00000000000..0af7798ffd6 --- /dev/null +++ b/queue-5.10/ovs-clear-skb-tstamp-in-forwarding-path.patch @@ -0,0 +1,39 @@ +From 8105e61167fcb04d2a26f52895a6d6c8efb93a2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 10:22:15 +0800 +Subject: ovs: clear skb->tstamp in forwarding path + +From: kaixi.fan + +[ Upstream commit 01634047bf0d5c2d9b7d8095bb4de1663dbeedeb ] + +fq qdisc requires tstamp to be cleared in the forwarding path. Now ovs +doesn't clear skb->tstamp. We encountered a problem with linux +version 5.4.56 and ovs version 2.14.1, and packets failed to +dequeue from qdisc when fq qdisc was attached to ovs port. + +Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") +Signed-off-by: kaixi.fan +Signed-off-by: xiexiaohui +Reviewed-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/openvswitch/vport.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/openvswitch/vport.c b/net/openvswitch/vport.c +index 82d801f063b7..1c05d4bef331 100644 +--- a/net/openvswitch/vport.c ++++ b/net/openvswitch/vport.c +@@ -503,6 +503,7 @@ void ovs_vport_send(struct vport *vport, struct sk_buff *skb, u8 mac_proto) + } + + skb->dev = vport->dev; ++ skb->tstamp = 0; + vport->ops->send(skb); + return; + +-- +2.30.2 + diff --git a/queue-5.10/pipe-avoid-unnecessary-epollet-wakeups-under-normal-.patch b/queue-5.10/pipe-avoid-unnecessary-epollet-wakeups-under-normal-.patch new file mode 100644 index 00000000000..a1271ffa3bd --- /dev/null +++ b/queue-5.10/pipe-avoid-unnecessary-epollet-wakeups-under-normal-.patch @@ -0,0 +1,126 @@ +From 3d99b5c3f24714d29215a6107be0a0b3d7063a20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 10:04:43 -0700 +Subject: pipe: avoid unnecessary EPOLLET wakeups under normal loads + +From: Linus Torvalds + +[ Upstream commit 3b844826b6c6affa80755254da322b017358a2f4 ] + +I had forgotten just how sensitive hackbench is to extra pipe wakeups, +and commit 3a34b13a88ca ("pipe: make pipe writes always wake up +readers") ended up causing a quite noticeable regression on larger +machines. + +Now, hackbench isn't necessarily a hugely meaningful benchmark, and it's +not clear that this matters in real life all that much, but as Mel +points out, it's used often enough when comparing kernels and so the +performance regression shows up like a sore thumb. + +It's easy enough to fix at least for the common cases where pipes are +used purely for data transfer, and you never have any exciting poll +usage at all. So set a special 'poll_usage' flag when there is polling +activity, and make the ugly "EPOLLET has crazy legacy expectations" +semantics explicit to only that case. + +I would love to limit it to just the broken EPOLLET case, but the pipe +code can't see the difference between epoll and regular select/poll, so +any non-read/write waiting will trigger the extra wakeup behavior. That +is sufficient for at least the hackbench case. + +Apart from making the odd extra wakeup cases more explicitly about +EPOLLET, this also makes the extra wakeup be at the _end_ of the pipe +write, not at the first write chunk. That is actually much saner +semantics (as much as you can call any of the legacy edge-triggered +expectations for EPOLLET "sane") since it means that you know the wakeup +will happen once the write is done, rather than possibly in the middle +of one. + +[ For stable people: I'm putting a "Fixes" tag on this, but I leave it + up to you to decide whether you actually want to backport it or not. + It likely has no impact outside of synthetic benchmarks - Linus ] + +Link: https://lore.kernel.org/lkml/20210802024945.GA8372@xsang-OptiPlex-9020/ +Fixes: 3a34b13a88ca ("pipe: make pipe writes always wake up readers") +Reported-by: kernel test robot +Tested-by: Sandeep Patil +Tested-by: Mel Gorman +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/pipe.c | 15 +++++++++------ + include/linux/pipe_fs_i.h | 2 ++ + 2 files changed, 11 insertions(+), 6 deletions(-) + +diff --git a/fs/pipe.c b/fs/pipe.c +index 28b2e973f10e..48abe65333c4 100644 +--- a/fs/pipe.c ++++ b/fs/pipe.c +@@ -444,9 +444,6 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from) + #endif + + /* +- * Epoll nonsensically wants a wakeup whether the pipe +- * was already empty or not. +- * + * If it wasn't empty we try to merge new data into + * the last buffer. + * +@@ -455,9 +452,9 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from) + * spanning multiple pages. + */ + head = pipe->head; +- was_empty = true; ++ was_empty = pipe_empty(head, pipe->tail); + chars = total_len & (PAGE_SIZE-1); +- if (chars && !pipe_empty(head, pipe->tail)) { ++ if (chars && !was_empty) { + unsigned int mask = pipe->ring_size - 1; + struct pipe_buffer *buf = &pipe->bufs[(head - 1) & mask]; + int offset = buf->offset + buf->len; +@@ -590,8 +587,11 @@ out: + * This is particularly important for small writes, because of + * how (for example) the GNU make jobserver uses small writes to + * wake up pending jobs ++ * ++ * Epoll nonsensically wants a wakeup whether the pipe ++ * was already empty or not. + */ +- if (was_empty) { ++ if (was_empty || pipe->poll_usage) { + wake_up_interruptible_sync_poll(&pipe->rd_wait, EPOLLIN | EPOLLRDNORM); + kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN); + } +@@ -654,6 +654,9 @@ pipe_poll(struct file *filp, poll_table *wait) + struct pipe_inode_info *pipe = filp->private_data; + unsigned int head, tail; + ++ /* Epoll has some historical nasty semantics, this enables them */ ++ pipe->poll_usage = 1; ++ + /* + * Reading pipe state only -- no need for acquiring the semaphore. + * +diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h +index 5d2705f1d01c..fc5642431b92 100644 +--- a/include/linux/pipe_fs_i.h ++++ b/include/linux/pipe_fs_i.h +@@ -48,6 +48,7 @@ struct pipe_buffer { + * @files: number of struct file referring this pipe (protected by ->i_lock) + * @r_counter: reader counter + * @w_counter: writer counter ++ * @poll_usage: is this pipe used for epoll, which has crazy wakeups? + * @fasync_readers: reader side fasync + * @fasync_writers: writer side fasync + * @bufs: the circular array of pipe buffers +@@ -70,6 +71,7 @@ struct pipe_inode_info { + unsigned int files; + unsigned int r_counter; + unsigned int w_counter; ++ unsigned int poll_usage; + struct page *tmp_page; + struct fasync_struct *fasync_readers; + struct fasync_struct *fasync_writers; +-- +2.30.2 + diff --git a/queue-5.10/ptp_pch-restore-dependency-on-pci.patch b/queue-5.10/ptp_pch-restore-dependency-on-pci.patch new file mode 100644 index 00000000000..82f334e2cca --- /dev/null +++ b/queue-5.10/ptp_pch-restore-dependency-on-pci.patch @@ -0,0 +1,38 @@ +From 76adf1446a1be6da4b1182a4b27305f05c9ee520 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Aug 2021 20:33:27 +0300 +Subject: ptp_pch: Restore dependency on PCI + +From: Andy Shevchenko + +[ Upstream commit 55c8fca1dae1fb0d11deaa21b65a647dedb1bc50 ] + +During the swap dependency on PCH_GBE to selection PTP_1588_CLOCK_PCH +incidentally dropped the implicit dependency on the PCI. Restore it. + +Fixes: 18d359ceb044 ("pch_gbe, ptp_pch: Fix the dependency direction between these drivers") +Reported-by: kernel test robot +Signed-off-by: Andy Shevchenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/ptp/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/ptp/Kconfig b/drivers/ptp/Kconfig +index deb429a3dff1..3e377f3c69e5 100644 +--- a/drivers/ptp/Kconfig ++++ b/drivers/ptp/Kconfig +@@ -90,7 +90,8 @@ config PTP_1588_CLOCK_INES + config PTP_1588_CLOCK_PCH + tristate "Intel PCH EG20T as PTP clock" + depends on X86_32 || COMPILE_TEST +- depends on HAS_IOMEM && NET ++ depends on HAS_IOMEM && PCI ++ depends on NET + imply PTP_1588_CLOCK + help + This driver adds support for using the PCH EG20T as a PTP +-- +2.30.2 + diff --git a/queue-5.10/r8152-fix-writing-usb_bp2_en.patch b/queue-5.10/r8152-fix-writing-usb_bp2_en.patch new file mode 100644 index 00000000000..736faf8ed02 --- /dev/null +++ b/queue-5.10/r8152-fix-writing-usb_bp2_en.patch @@ -0,0 +1,36 @@ +From 06be8bb1b147f5d55f2ed7139d34a59b71548a07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 11:05:36 +0800 +Subject: r8152: fix writing USB_BP2_EN + +From: Hayes Wang + +[ Upstream commit a876a33d2a1102f99fc782fefb784f4dd4841d8c ] + +The register of USB_BP2_EN is 16 bits, so we should use +ocp_write_word(), not ocp_write_byte(). + +Fixes: 9370f2d05a2a ("support request_firmware for RTL8153") +Signed-off-by: Hayes Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/r8152.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index 105622e1defa..0bb5b1c78654 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3432,7 +3432,7 @@ static void rtl_clear_bp(struct r8152 *tp, u16 type) + case RTL_VER_09: + default: + if (type == MCU_TYPE_USB) { +- ocp_write_byte(tp, MCU_TYPE_USB, USB_BP2_EN, 0); ++ ocp_write_word(tp, MCU_TYPE_USB, USB_BP2_EN, 0); + + ocp_write_word(tp, MCU_TYPE_USB, USB_BP_8, 0); + ocp_write_word(tp, MCU_TYPE_USB, USB_BP_9, 0); +-- +2.30.2 + diff --git a/queue-5.10/revert-flow_offload-action-should-not-be-null-when-i.patch b/queue-5.10/revert-flow_offload-action-should-not-be-null-when-i.patch new file mode 100644 index 00000000000..9cca5dbb2ce --- /dev/null +++ b/queue-5.10/revert-flow_offload-action-should-not-be-null-when-i.patch @@ -0,0 +1,62 @@ +From 88617e79c6c9525b58779924c43bd2cf2f854f08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 13:58:42 +0300 +Subject: Revert "flow_offload: action should not be NULL when it is + referenced" + +From: Ido Schimmel + +[ Upstream commit fa05bdb89b01b098aad19ec0ebc4d1cc7b11177e ] + +This reverts commit 9ea3e52c5bc8bb4a084938dc1e3160643438927a. + +Cited commit added a check to make sure 'action' is not NULL, but +'action' is already dereferenced before the check, when calling +flow_offload_has_one_action(). + +Therefore, the check does not make any sense and results in a smatch +warning: + +include/net/flow_offload.h:322 flow_action_mixed_hw_stats_check() warn: +variable dereferenced before check 'action' (see line 319) + +Fix by reverting this commit. + +Cc: gushengxian +Fixes: 9ea3e52c5bc8 ("flow_offload: action should not be NULL when it is referenced") +Signed-off-by: Ido Schimmel +Acked-by: Jamal Hadi Salim +Link: https://lore.kernel.org/r/20210819105842.1315705-1-idosch@idosch.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/flow_offload.h | 12 +++++------- + 1 file changed, 5 insertions(+), 7 deletions(-) + +diff --git a/include/net/flow_offload.h b/include/net/flow_offload.h +index 161b90979038..123b1e9ea304 100644 +--- a/include/net/flow_offload.h ++++ b/include/net/flow_offload.h +@@ -312,14 +312,12 @@ flow_action_mixed_hw_stats_check(const struct flow_action *action, + if (flow_offload_has_one_action(action)) + return true; + +- if (action) { +- flow_action_for_each(i, action_entry, action) { +- if (i && action_entry->hw_stats != last_hw_stats) { +- NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported"); +- return false; +- } +- last_hw_stats = action_entry->hw_stats; ++ flow_action_for_each(i, action_entry, action) { ++ if (i && action_entry->hw_stats != last_hw_stats) { ++ NL_SET_ERR_MSG_MOD(extack, "Mixing HW stats types for actions is not supported"); ++ return false; + } ++ last_hw_stats = action_entry->hw_stats; + } + return true; + } +-- +2.30.2 + diff --git a/queue-5.10/sch_cake-fix-srchost-dsthost-hashing-mode.patch b/queue-5.10/sch_cake-fix-srchost-dsthost-hashing-mode.patch new file mode 100644 index 00000000000..4b38c8d1877 --- /dev/null +++ b/queue-5.10/sch_cake-fix-srchost-dsthost-hashing-mode.patch @@ -0,0 +1,45 @@ +From e4203030e0fb590793570d76e039146e8a607cac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 13:59:17 +0200 +Subject: sch_cake: fix srchost/dsthost hashing mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 86b9bbd332d0510679c7fedcee3e3bd278be5756 ] + +When adding support for using the skb->hash value as the flow hash in CAKE, +I accidentally introduced a logic error that broke the host-only isolation +modes of CAKE (srchost and dsthost keywords). Specifically, the flow_hash +variable should stay initialised to 0 in cake_hash() in pure host-based +hashing mode. Add a check for this before using the skb->hash value as +flow_hash. + +Fixes: b0c19ed6088a ("sch_cake: Take advantage of skb->hash where appropriate") +Reported-by: Pete Heist +Tested-by: Pete Heist +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_cake.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c +index 5c15968b5155..c2c37ffd94f2 100644 +--- a/net/sched/sch_cake.c ++++ b/net/sched/sch_cake.c +@@ -720,7 +720,7 @@ static u32 cake_hash(struct cake_tin_data *q, const struct sk_buff *skb, + skip_hash: + if (flow_override) + flow_hash = flow_override - 1; +- else if (use_skbhash) ++ else if (use_skbhash && (flow_mode & CAKE_FLOW_FLOWS)) + flow_hash = skb->hash; + if (host_override) { + dsthost_hash = host_override - 1; +-- +2.30.2 + diff --git a/queue-5.10/series b/queue-5.10/series index f7e062f19d2..2203c204a43 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -32,3 +32,41 @@ net-usb-lan78xx-don-t-modify-phy_device-state-concur.patch drm-amd-display-fix-dynamic-bpp-issue-with-8k30-with.patch drm-amd-display-workaround-for-hard-hang-on-hpd-on-n.patch bluetooth-hidp-use-correct-wait-queue-when-removing-.patch +arm64-dts-qcom-c630-fix-correct-powerdown-pin-for-ws.patch +arm64-dts-qcom-msm8992-bullhead-remove-psci.patch +iommu-check-if-group-is-null-before-remove-device.patch +cpufreq-armada-37xx-forbid-cpufreq-for-1.2-ghz-varia.patch +dccp-add-do-while-0-stubs-for-dccp_pr_debug-macros.patch +virtio-protect-vqs-list-access.patch +vhost-vdpa-fix-integer-overflow-in-vhost_vdpa_proces.patch +bus-ti-sysc-fix-error-handling-for-sysc_check_active.patch +vhost-fix-the-calculation-in-vhost_overflow.patch +vdpa-mlx5-avoid-destroying-mr-on-empty-iotlb.patch +soc-drm-mediatek-move-ddp-component-defines-into-mtk.patch +drm-mediatek-fix-aal-size-config.patch +drm-mediatek-add-aal-output-size-configuration.patch +bpf-clear-zext_dst-of-dead-insns.patch +bnxt-don-t-lock-the-tx-queue-from-napi-poll.patch +bnxt-disable-napi-before-canceling-dim.patch +bnxt-make-sure-xmit_more-errors-does-not-miss-doorbe.patch +bnxt-count-tx-drops.patch +net-6pack-fix-slab-out-of-bounds-in-decode_data.patch +ptp_pch-restore-dependency-on-pci.patch +bnxt_en-disable-arfs-if-running-on-212-firmware.patch +bnxt_en-add-missing-dma-memory-barriers.patch +vrf-reset-skb-conntrack-connection-on-vrf-rcv.patch +virtio-net-support-xdp-when-not-more-queues.patch +virtio-net-use-netif_f_gro_hw-instead-of-netif_f_lro.patch +net-qlcnic-add-missed-unlock-in-qlcnic_83xx_flash_re.patch +ixgbe-xsk-clean-up-the-resources-in-ixgbe_xsk_pool_e.patch +sch_cake-fix-srchost-dsthost-hashing-mode.patch +net-mdio-mux-don-t-ignore-memory-allocation-errors.patch +net-mdio-mux-handle-eprobe_defer-correctly.patch +ovs-clear-skb-tstamp-in-forwarding-path.patch +iommu-vt-d-consolidate-duplicate-cache-invaliation-c.patch +iommu-vt-d-fix-incomplete-cache-flush-in-intel_pasid.patch +pipe-avoid-unnecessary-epollet-wakeups-under-normal-.patch +r8152-fix-writing-usb_bp2_en.patch +i40e-fix-atr-queue-selection.patch +iavf-fix-ping-is-lost-after-untrusted-vf-had-tried-t.patch +revert-flow_offload-action-should-not-be-null-when-i.patch diff --git a/queue-5.10/soc-drm-mediatek-move-ddp-component-defines-into-mtk.patch b/queue-5.10/soc-drm-mediatek-move-ddp-component-defines-into-mtk.patch new file mode 100644 index 00000000000..03e80ce0c3b --- /dev/null +++ b/queue-5.10/soc-drm-mediatek-move-ddp-component-defines-into-mtk.patch @@ -0,0 +1,142 @@ +From 76836af482c148d81071d6e40f57168ab92a502c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Oct 2020 21:33:17 +0200 +Subject: soc / drm: mediatek: Move DDP component defines into mtk-mmsys.h + +From: Yongqiang Niu + +[ Upstream commit 51c0e618b219c025ddaaf14baea8942cb7e2105b ] + +MMSYS is the driver which controls the routing of these DDP components, +so the definition of the mtk_ddp_comp_id enum should be placed in mtk-mmsys.h + +Signed-off-by: Yongqiang Niu +Signed-off-by: Enric Balletbo i Serra +Reviewed-by: Chun-Kuang Hu +Link: https://lore.kernel.org/r/20201006193320.405529-2-enric.balletbo@collabora.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h | 34 +-------------------- + drivers/soc/mediatek/mtk-mmsys.c | 4 +-- + include/linux/soc/mediatek/mtk-mmsys.h | 33 ++++++++++++++++++++ + 3 files changed, 35 insertions(+), 36 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h +index 1d9e00b69462..5aa52b7afeec 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h ++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.h +@@ -7,6 +7,7 @@ + #define MTK_DRM_DDP_COMP_H + + #include ++#include + + struct device; + struct device_node; +@@ -35,39 +36,6 @@ enum mtk_ddp_comp_type { + MTK_DDP_COMP_TYPE_MAX, + }; + +-enum mtk_ddp_comp_id { +- DDP_COMPONENT_AAL0, +- DDP_COMPONENT_AAL1, +- DDP_COMPONENT_BLS, +- DDP_COMPONENT_CCORR, +- DDP_COMPONENT_COLOR0, +- DDP_COMPONENT_COLOR1, +- DDP_COMPONENT_DITHER, +- DDP_COMPONENT_DPI0, +- DDP_COMPONENT_DPI1, +- DDP_COMPONENT_DSI0, +- DDP_COMPONENT_DSI1, +- DDP_COMPONENT_DSI2, +- DDP_COMPONENT_DSI3, +- DDP_COMPONENT_GAMMA, +- DDP_COMPONENT_OD0, +- DDP_COMPONENT_OD1, +- DDP_COMPONENT_OVL0, +- DDP_COMPONENT_OVL_2L0, +- DDP_COMPONENT_OVL_2L1, +- DDP_COMPONENT_OVL1, +- DDP_COMPONENT_PWM0, +- DDP_COMPONENT_PWM1, +- DDP_COMPONENT_PWM2, +- DDP_COMPONENT_RDMA0, +- DDP_COMPONENT_RDMA1, +- DDP_COMPONENT_RDMA2, +- DDP_COMPONENT_UFOE, +- DDP_COMPONENT_WDMA0, +- DDP_COMPONENT_WDMA1, +- DDP_COMPONENT_ID_MAX, +-}; +- + struct mtk_ddp_comp; + struct cmdq_pkt; + struct mtk_ddp_comp_funcs { +diff --git a/drivers/soc/mediatek/mtk-mmsys.c b/drivers/soc/mediatek/mtk-mmsys.c +index a55f25511173..36ad66bb221b 100644 +--- a/drivers/soc/mediatek/mtk-mmsys.c ++++ b/drivers/soc/mediatek/mtk-mmsys.c +@@ -5,13 +5,11 @@ + */ + + #include ++#include + #include + #include + #include + +-#include "../../gpu/drm/mediatek/mtk_drm_ddp.h" +-#include "../../gpu/drm/mediatek/mtk_drm_ddp_comp.h" +- + #define DISP_REG_CONFIG_DISP_OVL0_MOUT_EN 0x040 + #define DISP_REG_CONFIG_DISP_OVL1_MOUT_EN 0x044 + #define DISP_REG_CONFIG_DISP_OD_MOUT_EN 0x048 +diff --git a/include/linux/soc/mediatek/mtk-mmsys.h b/include/linux/soc/mediatek/mtk-mmsys.h +index 7bab5d9a3d31..2228bf6133da 100644 +--- a/include/linux/soc/mediatek/mtk-mmsys.h ++++ b/include/linux/soc/mediatek/mtk-mmsys.h +@@ -9,6 +9,39 @@ + enum mtk_ddp_comp_id; + struct device; + ++enum mtk_ddp_comp_id { ++ DDP_COMPONENT_AAL0, ++ DDP_COMPONENT_AAL1, ++ DDP_COMPONENT_BLS, ++ DDP_COMPONENT_CCORR, ++ DDP_COMPONENT_COLOR0, ++ DDP_COMPONENT_COLOR1, ++ DDP_COMPONENT_DITHER, ++ DDP_COMPONENT_DPI0, ++ DDP_COMPONENT_DPI1, ++ DDP_COMPONENT_DSI0, ++ DDP_COMPONENT_DSI1, ++ DDP_COMPONENT_DSI2, ++ DDP_COMPONENT_DSI3, ++ DDP_COMPONENT_GAMMA, ++ DDP_COMPONENT_OD0, ++ DDP_COMPONENT_OD1, ++ DDP_COMPONENT_OVL0, ++ DDP_COMPONENT_OVL_2L0, ++ DDP_COMPONENT_OVL_2L1, ++ DDP_COMPONENT_OVL1, ++ DDP_COMPONENT_PWM0, ++ DDP_COMPONENT_PWM1, ++ DDP_COMPONENT_PWM2, ++ DDP_COMPONENT_RDMA0, ++ DDP_COMPONENT_RDMA1, ++ DDP_COMPONENT_RDMA2, ++ DDP_COMPONENT_UFOE, ++ DDP_COMPONENT_WDMA0, ++ DDP_COMPONENT_WDMA1, ++ DDP_COMPONENT_ID_MAX, ++}; ++ + void mtk_mmsys_ddp_connect(struct device *dev, + enum mtk_ddp_comp_id cur, + enum mtk_ddp_comp_id next); +-- +2.30.2 + diff --git a/queue-5.10/vdpa-mlx5-avoid-destroying-mr-on-empty-iotlb.patch b/queue-5.10/vdpa-mlx5-avoid-destroying-mr-on-empty-iotlb.patch new file mode 100644 index 00000000000..3de0105b9eb --- /dev/null +++ b/queue-5.10/vdpa-mlx5-avoid-destroying-mr-on-empty-iotlb.patch @@ -0,0 +1,62 @@ +From 8bc18ce78d58f28a029ad98894aa6dad07dfd555 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 08:37:13 +0300 +Subject: vdpa/mlx5: Avoid destroying MR on empty iotlb + +From: Eli Cohen + +[ Upstream commit 08dbd5660232bede7916d8568003012c1182cc9a ] + +The current code treats an empty iotlb provdied in set_map() as a +special case and destroy the memory region object. This must not be done +since the virtqueue objects reference this MR. Doing so will cause the +driver unload to emit errors and log timeouts caused by the firmware +complaining on busy resources. + +This patch treats an empty iotlb as any other change of mapping. In this +case, mlx5_vdpa_create_mr() will fail and the entire set_map() call to +fail. + +This issue has not been encountered before but was seen to occur in a +non-official version of qemu. Since qemu is a userspace program, the +driver must protect against such case. + +Fixes: 94abbccdf291 ("vdpa/mlx5: Add shared memory registration code") +Signed-off-by: Eli Cohen +Link: https://lore.kernel.org/r/20210811053713.66658-1-elic@nvidia.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/core/mr.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/vdpa/mlx5/core/mr.c b/drivers/vdpa/mlx5/core/mr.c +index aa656f57bf5b..32c9925de473 100644 +--- a/drivers/vdpa/mlx5/core/mr.c ++++ b/drivers/vdpa/mlx5/core/mr.c +@@ -454,11 +454,6 @@ out: + mutex_unlock(&mr->mkey_mtx); + } + +-static bool map_empty(struct vhost_iotlb *iotlb) +-{ +- return !vhost_iotlb_itree_first(iotlb, 0, U64_MAX); +-} +- + int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *iotlb, + bool *change_map) + { +@@ -466,10 +461,6 @@ int mlx5_vdpa_handle_set_map(struct mlx5_vdpa_dev *mvdev, struct vhost_iotlb *io + int err = 0; + + *change_map = false; +- if (map_empty(iotlb)) { +- mlx5_vdpa_destroy_mr(mvdev); +- return 0; +- } + mutex_lock(&mr->mkey_mtx); + if (mr->initialized) { + mlx5_vdpa_info(mvdev, "memory map update\n"); +-- +2.30.2 + diff --git a/queue-5.10/vhost-fix-the-calculation-in-vhost_overflow.patch b/queue-5.10/vhost-fix-the-calculation-in-vhost_overflow.patch new file mode 100644 index 00000000000..8648b144582 --- /dev/null +++ b/queue-5.10/vhost-fix-the-calculation-in-vhost_overflow.patch @@ -0,0 +1,49 @@ +From 1938851a5839b463757a9de857a3c1197d9eb23d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 21:07:56 +0800 +Subject: vhost: Fix the calculation in vhost_overflow() + +From: Xie Yongji + +[ Upstream commit f7ad318ea0ad58ebe0e595e59aed270bb643b29b ] + +This fixes the incorrect calculation for integer overflow +when the last address of iova range is 0xffffffff. + +Fixes: ec33d031a14b ("vhost: detect 32 bit integer wrap around") +Reported-by: Jason Wang +Signed-off-by: Xie Yongji +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/20210728130756.97-2-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vhost.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 5ccb0705beae..f41463ab4031 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -735,10 +735,16 @@ static bool log_access_ok(void __user *log_base, u64 addr, unsigned long sz) + (sz + VHOST_PAGE_SIZE * 8 - 1) / VHOST_PAGE_SIZE / 8); + } + ++/* Make sure 64 bit math will not overflow. */ + static bool vhost_overflow(u64 uaddr, u64 size) + { +- /* Make sure 64 bit math will not overflow. */ +- return uaddr > ULONG_MAX || size > ULONG_MAX || uaddr > ULONG_MAX - size; ++ if (uaddr > ULONG_MAX || size > ULONG_MAX) ++ return true; ++ ++ if (!size) ++ return false; ++ ++ return uaddr > ULONG_MAX - size + 1; + } + + /* Caller should have vq mutex and device mutex. */ +-- +2.30.2 + diff --git a/queue-5.10/vhost-vdpa-fix-integer-overflow-in-vhost_vdpa_proces.patch b/queue-5.10/vhost-vdpa-fix-integer-overflow-in-vhost_vdpa_proces.patch new file mode 100644 index 00000000000..36662c43347 --- /dev/null +++ b/queue-5.10/vhost-vdpa-fix-integer-overflow-in-vhost_vdpa_proces.patch @@ -0,0 +1,41 @@ +From 2b02d1dea8f0f73d4581d48048776bde55e065e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Jul 2021 21:07:55 +0800 +Subject: vhost-vdpa: Fix integer overflow in vhost_vdpa_process_iotlb_update() + +From: Xie Yongji + +[ Upstream commit 0e398290cff997610b66e73573faaee70c9a700e ] + +The "msg->iova + msg->size" addition can have an integer overflow +if the iotlb message is from a malicious user space application. +So let's fix it. + +Fixes: 1b48dc03e575 ("vhost: vdpa: report iova range") +Reported-by: Dan Carpenter +Signed-off-by: Xie Yongji +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/20210728130756.97-1-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vhost/vdpa.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c +index 80184153ac7d..c4d53ff06bf8 100644 +--- a/drivers/vhost/vdpa.c ++++ b/drivers/vhost/vdpa.c +@@ -623,7 +623,8 @@ static int vhost_vdpa_process_iotlb_update(struct vhost_vdpa *v, + long pinned; + int ret = 0; + +- if (msg->iova < v->range.first || ++ if (msg->iova < v->range.first || !msg->size || ++ msg->iova > U64_MAX - msg->size + 1 || + msg->iova + msg->size - 1 > v->range.last) + return -EINVAL; + +-- +2.30.2 + diff --git a/queue-5.10/virtio-net-support-xdp-when-not-more-queues.patch b/queue-5.10/virtio-net-support-xdp-when-not-more-queues.patch new file mode 100644 index 00000000000..2798b30ad31 --- /dev/null +++ b/queue-5.10/virtio-net-support-xdp-when-not-more-queues.patch @@ -0,0 +1,168 @@ +From 763e0b11d269494862e97eab8ea24d2d31fdce32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 10:24:45 +0800 +Subject: virtio-net: support XDP when not more queues + +From: Xuan Zhuo + +[ Upstream commit 97c2c69e1926260c78c7f1c0b2c987934f1dc7a1 ] + +The number of queues implemented by many virtio backends is limited, +especially some machines have a large number of CPUs. In this case, it +is often impossible to allocate a separate queue for +XDP_TX/XDP_REDIRECT, then xdp cannot be loaded to work, even xdp does +not use the XDP_TX/XDP_REDIRECT. + +This patch allows XDP_TX/XDP_REDIRECT to run by reuse the existing SQ +with __netif_tx_lock() hold when there are not enough queues. + +Signed-off-by: Xuan Zhuo +Reviewed-by: Dust Li +Acked-by: Jason Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 62 +++++++++++++++++++++++++++++++--------- + 1 file changed, 49 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 7d1f609306f9..a47cf77a0b08 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -195,6 +195,9 @@ struct virtnet_info { + /* # of XDP queue pairs currently used by the driver */ + u16 xdp_queue_pairs; + ++ /* xdp_queue_pairs may be 0, when xdp is already loaded. So add this. */ ++ bool xdp_enabled; ++ + /* I like... big packets and I cannot lie! */ + bool big_packets; + +@@ -485,12 +488,41 @@ static int __virtnet_xdp_xmit_one(struct virtnet_info *vi, + return 0; + } + +-static struct send_queue *virtnet_xdp_sq(struct virtnet_info *vi) +-{ +- unsigned int qp; +- +- qp = vi->curr_queue_pairs - vi->xdp_queue_pairs + smp_processor_id(); +- return &vi->sq[qp]; ++/* when vi->curr_queue_pairs > nr_cpu_ids, the txq/sq is only used for xdp tx on ++ * the current cpu, so it does not need to be locked. ++ * ++ * Here we use marco instead of inline functions because we have to deal with ++ * three issues at the same time: 1. the choice of sq. 2. judge and execute the ++ * lock/unlock of txq 3. make sparse happy. It is difficult for two inline ++ * functions to perfectly solve these three problems at the same time. ++ */ ++#define virtnet_xdp_get_sq(vi) ({ \ ++ struct netdev_queue *txq; \ ++ typeof(vi) v = (vi); \ ++ unsigned int qp; \ ++ \ ++ if (v->curr_queue_pairs > nr_cpu_ids) { \ ++ qp = v->curr_queue_pairs - v->xdp_queue_pairs; \ ++ qp += smp_processor_id(); \ ++ txq = netdev_get_tx_queue(v->dev, qp); \ ++ __netif_tx_acquire(txq); \ ++ } else { \ ++ qp = smp_processor_id() % v->curr_queue_pairs; \ ++ txq = netdev_get_tx_queue(v->dev, qp); \ ++ __netif_tx_lock(txq, raw_smp_processor_id()); \ ++ } \ ++ v->sq + qp; \ ++}) ++ ++#define virtnet_xdp_put_sq(vi, q) { \ ++ struct netdev_queue *txq; \ ++ typeof(vi) v = (vi); \ ++ \ ++ txq = netdev_get_tx_queue(v->dev, (q) - v->sq); \ ++ if (v->curr_queue_pairs > nr_cpu_ids) \ ++ __netif_tx_release(txq); \ ++ else \ ++ __netif_tx_unlock(txq); \ + } + + static int virtnet_xdp_xmit(struct net_device *dev, +@@ -516,7 +548,7 @@ static int virtnet_xdp_xmit(struct net_device *dev, + if (!xdp_prog) + return -ENXIO; + +- sq = virtnet_xdp_sq(vi); ++ sq = virtnet_xdp_get_sq(vi); + + if (unlikely(flags & ~XDP_XMIT_FLAGS_MASK)) { + ret = -EINVAL; +@@ -564,12 +596,13 @@ out: + sq->stats.kicks += kicks; + u64_stats_update_end(&sq->stats.syncp); + ++ virtnet_xdp_put_sq(vi, sq); + return ret; + } + + static unsigned int virtnet_get_headroom(struct virtnet_info *vi) + { +- return vi->xdp_queue_pairs ? VIRTIO_XDP_HEADROOM : 0; ++ return vi->xdp_enabled ? VIRTIO_XDP_HEADROOM : 0; + } + + /* We copy the packet for XDP in the following cases: +@@ -1473,12 +1506,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget) + xdp_do_flush(); + + if (xdp_xmit & VIRTIO_XDP_TX) { +- sq = virtnet_xdp_sq(vi); ++ sq = virtnet_xdp_get_sq(vi); + if (virtqueue_kick_prepare(sq->vq) && virtqueue_notify(sq->vq)) { + u64_stats_update_begin(&sq->stats.syncp); + sq->stats.kicks++; + u64_stats_update_end(&sq->stats.syncp); + } ++ virtnet_xdp_put_sq(vi, sq); + } + + return received; +@@ -2453,10 +2487,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, + + /* XDP requires extra queues for XDP_TX */ + if (curr_qp + xdp_qp > vi->max_queue_pairs) { +- NL_SET_ERR_MSG_MOD(extack, "Too few free TX rings available"); +- netdev_warn(dev, "request %i queues but max is %i\n", ++ netdev_warn(dev, "XDP request %i queues but max is %i. XDP_TX and XDP_REDIRECT will operate in a slower locked tx mode.\n", + curr_qp + xdp_qp, vi->max_queue_pairs); +- return -ENOMEM; ++ xdp_qp = 0; + } + + old_prog = rtnl_dereference(vi->rq[0].xdp_prog); +@@ -2490,11 +2523,14 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, + vi->xdp_queue_pairs = xdp_qp; + + if (prog) { ++ vi->xdp_enabled = true; + for (i = 0; i < vi->max_queue_pairs; i++) { + rcu_assign_pointer(vi->rq[i].xdp_prog, prog); + if (i == 0 && !old_prog) + virtnet_clear_guest_offloads(vi); + } ++ } else { ++ vi->xdp_enabled = false; + } + + for (i = 0; i < vi->max_queue_pairs; i++) { +@@ -2562,7 +2598,7 @@ static int virtnet_set_features(struct net_device *dev, + int err; + + if ((dev->features ^ features) & NETIF_F_LRO) { +- if (vi->xdp_queue_pairs) ++ if (vi->xdp_enabled) + return -EBUSY; + + if (features & NETIF_F_LRO) +-- +2.30.2 + diff --git a/queue-5.10/virtio-net-use-netif_f_gro_hw-instead-of-netif_f_lro.patch b/queue-5.10/virtio-net-use-netif_f_gro_hw-instead-of-netif_f_lro.patch new file mode 100644 index 00000000000..d449b2abd7f --- /dev/null +++ b/queue-5.10/virtio-net-use-netif_f_gro_hw-instead-of-netif_f_lro.patch @@ -0,0 +1,101 @@ +From c0441e76930e7798e0533ccacbe8221e16391f52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Aug 2021 16:06:59 +0800 +Subject: virtio-net: use NETIF_F_GRO_HW instead of NETIF_F_LRO + +From: Jason Wang + +[ Upstream commit dbcf24d153884439dad30484a0e3f02350692e4c ] + +Commit a02e8964eaf92 ("virtio-net: ethtool configurable LRO") +maps LRO to virtio guest offloading features and allows the +administrator to enable and disable those features via ethtool. + +This leads to several issues: + +- For a device that doesn't support control guest offloads, the "LRO" + can't be disabled triggering WARN in dev_disable_lro() when turning + off LRO or when enabling forwarding bridging etc. + +- For a device that supports control guest offloads, the guest + offloads are disabled in cases of bridging, forwarding etc slowing + down the traffic. + +Fix this by using NETIF_F_GRO_HW instead. Though the spec does not +guarantee packets to be re-segmented as the original ones, +we can add that to the spec, possibly with a flag for devices to +differentiate between GRO and LRO. + +Further, we never advertised LRO historically before a02e8964eaf92 +("virtio-net: ethtool configurable LRO") and so bridged/forwarded +configs effectively always relied on virtio receive offloads behaving +like GRO - thus even if this breaks any configs it is at least not +a regression. + +Fixes: a02e8964eaf92 ("virtio-net: ethtool configurable LRO") +Acked-by: Michael S. Tsirkin +Reported-by: Ivan +Tested-by: Ivan +Signed-off-by: Jason Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index a47cf77a0b08..cbe47eed7cc3 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -63,7 +63,7 @@ static const unsigned long guest_offloads[] = { + VIRTIO_NET_F_GUEST_CSUM + }; + +-#define GUEST_OFFLOAD_LRO_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \ ++#define GUEST_OFFLOAD_GRO_HW_MASK ((1ULL << VIRTIO_NET_F_GUEST_TSO4) | \ + (1ULL << VIRTIO_NET_F_GUEST_TSO6) | \ + (1ULL << VIRTIO_NET_F_GUEST_ECN) | \ + (1ULL << VIRTIO_NET_F_GUEST_UFO)) +@@ -2466,7 +2466,7 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_ECN) || + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_UFO) || + virtio_has_feature(vi->vdev, VIRTIO_NET_F_GUEST_CSUM))) { +- NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing LRO/CSUM, disable LRO/CSUM first"); ++ NL_SET_ERR_MSG_MOD(extack, "Can't set XDP while host is implementing GRO_HW/CSUM, disable GRO_HW/CSUM first"); + return -EOPNOTSUPP; + } + +@@ -2597,15 +2597,15 @@ static int virtnet_set_features(struct net_device *dev, + u64 offloads; + int err; + +- if ((dev->features ^ features) & NETIF_F_LRO) { ++ if ((dev->features ^ features) & NETIF_F_GRO_HW) { + if (vi->xdp_enabled) + return -EBUSY; + +- if (features & NETIF_F_LRO) ++ if (features & NETIF_F_GRO_HW) + offloads = vi->guest_offloads_capable; + else + offloads = vi->guest_offloads_capable & +- ~GUEST_OFFLOAD_LRO_MASK; ++ ~GUEST_OFFLOAD_GRO_HW_MASK; + + err = virtnet_set_guest_offloads(vi, offloads); + if (err) +@@ -3080,9 +3080,9 @@ static int virtnet_probe(struct virtio_device *vdev) + dev->features |= NETIF_F_RXCSUM; + if (virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO4) || + virtio_has_feature(vdev, VIRTIO_NET_F_GUEST_TSO6)) +- dev->features |= NETIF_F_LRO; ++ dev->features |= NETIF_F_GRO_HW; + if (virtio_has_feature(vdev, VIRTIO_NET_F_CTRL_GUEST_OFFLOADS)) +- dev->hw_features |= NETIF_F_LRO; ++ dev->hw_features |= NETIF_F_GRO_HW; + + dev->vlan_features = dev->features; + +-- +2.30.2 + diff --git a/queue-5.10/virtio-protect-vqs-list-access.patch b/queue-5.10/virtio-protect-vqs-list-access.patch new file mode 100644 index 00000000000..695ee83e24c --- /dev/null +++ b/queue-5.10/virtio-protect-vqs-list-access.patch @@ -0,0 +1,97 @@ +From 6eb9d7e5ed44b6101ff89dd5eeea889c470e83b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 17:26:47 +0300 +Subject: virtio: Protect vqs list access + +From: Parav Pandit + +[ Upstream commit 0e566c8f0f2e8325e35f6f97e13cde5356b41814 ] + +VQs may be accessed to mark the device broken while they are +created/destroyed. Hence protect the access to the vqs list. + +Fixes: e2dcdfe95c0b ("virtio: virtio_break_device() to mark all virtqueues broken.") +Signed-off-by: Parav Pandit +Link: https://lore.kernel.org/r/20210721142648.1525924-4-parav@nvidia.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio.c | 1 + + drivers/virtio/virtio_ring.c | 8 ++++++++ + include/linux/virtio.h | 1 + + 3 files changed, 10 insertions(+) + +diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c +index 42e09cc1b8ac..84b5dec5d29c 100644 +--- a/drivers/virtio/virtio.c ++++ b/drivers/virtio/virtio.c +@@ -357,6 +357,7 @@ int register_virtio_device(struct virtio_device *dev) + virtio_add_status(dev, VIRTIO_CONFIG_S_ACKNOWLEDGE); + + INIT_LIST_HEAD(&dev->vqs); ++ spin_lock_init(&dev->vqs_list_lock); + + /* + * device_add() causes the bus infrastructure to look for a matching +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 71e16b53e9c1..6b7aa26c5384 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -1668,7 +1668,9 @@ static struct virtqueue *vring_create_virtqueue_packed( + cpu_to_le16(vq->packed.event_flags_shadow); + } + ++ spin_lock(&vdev->vqs_list_lock); + list_add_tail(&vq->vq.list, &vdev->vqs); ++ spin_unlock(&vdev->vqs_list_lock); + return &vq->vq; + + err_desc_extra: +@@ -2126,7 +2128,9 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index, + memset(vq->split.desc_state, 0, vring.num * + sizeof(struct vring_desc_state_split)); + ++ spin_lock(&vdev->vqs_list_lock); + list_add_tail(&vq->vq.list, &vdev->vqs); ++ spin_unlock(&vdev->vqs_list_lock); + return &vq->vq; + } + EXPORT_SYMBOL_GPL(__vring_new_virtqueue); +@@ -2210,7 +2214,9 @@ void vring_del_virtqueue(struct virtqueue *_vq) + } + if (!vq->packed_ring) + kfree(vq->split.desc_state); ++ spin_lock(&vq->vq.vdev->vqs_list_lock); + list_del(&_vq->list); ++ spin_unlock(&vq->vq.vdev->vqs_list_lock); + kfree(vq); + } + EXPORT_SYMBOL_GPL(vring_del_virtqueue); +@@ -2274,10 +2280,12 @@ void virtio_break_device(struct virtio_device *dev) + { + struct virtqueue *_vq; + ++ spin_lock(&dev->vqs_list_lock); + list_for_each_entry(_vq, &dev->vqs, list) { + struct vring_virtqueue *vq = to_vvq(_vq); + vq->broken = true; + } ++ spin_unlock(&dev->vqs_list_lock); + } + EXPORT_SYMBOL_GPL(virtio_break_device); + +diff --git a/include/linux/virtio.h b/include/linux/virtio.h +index 55ea329fe72a..8ecc2e208d61 100644 +--- a/include/linux/virtio.h ++++ b/include/linux/virtio.h +@@ -110,6 +110,7 @@ struct virtio_device { + bool config_enabled; + bool config_change_pending; + spinlock_t config_lock; ++ spinlock_t vqs_list_lock; /* Protects VQs list access */ + struct device dev; + struct virtio_device_id id; + const struct virtio_config_ops *config; +-- +2.30.2 + diff --git a/queue-5.10/vrf-reset-skb-conntrack-connection-on-vrf-rcv.patch b/queue-5.10/vrf-reset-skb-conntrack-connection-on-vrf-rcv.patch new file mode 100644 index 00000000000..848b20cee71 --- /dev/null +++ b/queue-5.10/vrf-reset-skb-conntrack-connection-on-vrf-rcv.patch @@ -0,0 +1,209 @@ +From 887975d0f7a3ba97e25ffc3890ac05a2e924ce98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Aug 2021 12:00:02 +0000 +Subject: vrf: Reset skb conntrack connection on VRF rcv + +From: Lahav Schlesinger + +[ Upstream commit 09e856d54bda5f288ef8437a90ab2b9b3eab83d1 ] + +To fix the "reverse-NAT" for replies. + +When a packet is sent over a VRF, the POST_ROUTING hooks are called +twice: Once from the VRF interface, and once from the "actual" +interface the packet will be sent from: +1) First SNAT: l3mdev_l3_out() -> vrf_l3_out() -> .. -> vrf_output_direct() + This causes the POST_ROUTING hooks to run. +2) Second SNAT: 'ip_output()' calls POST_ROUTING hooks again. + +Similarly for replies, first ip_rcv() calls PRE_ROUTING hooks, and +second vrf_l3_rcv() calls them again. + +As an example, consider the following SNAT rule: +> iptables -t nat -A POSTROUTING -p udp -m udp --dport 53 -j SNAT --to-source 2.2.2.2 -o vrf_1 + +In this case sending over a VRF will create 2 conntrack entries. +The first is from the VRF interface, which performs the IP SNAT. +The second will run the SNAT, but since the "expected reply" will remain +the same, conntrack randomizes the source port of the packet: +e..g With a socket bound to 1.1.1.1:10000, sending to 3.3.3.3:53, the conntrack +rules are: +udp 17 29 src=2.2.2.2 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=61033 packets=0 bytes=0 mark=0 use=1 +udp 17 29 src=1.1.1.1 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=10000 packets=0 bytes=0 mark=0 use=1 + +i.e. First SNAT IP from 1.1.1.1 --> 2.2.2.2, and second the src port is +SNAT-ed from 10000 --> 61033. + +But when a reply is sent (3.3.3.3:53 -> 2.2.2.2:61033) only the later +conntrack entry is matched: +udp 17 29 src=2.2.2.2 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 src=3.3.3.3 dst=2.2.2.2 sport=53 dport=61033 packets=1 bytes=49 mark=0 use=1 +udp 17 28 src=1.1.1.1 dst=3.3.3.3 sport=10000 dport=53 packets=1 bytes=68 [UNREPLIED] src=3.3.3.3 dst=2.2.2.2 sport=53 dport=10000 packets=0 bytes=0 mark=0 use=1 + +And a "port 61033 unreachable" ICMP packet is sent back. + +The issue is that when PRE_ROUTING hooks are called from vrf_l3_rcv(), +the skb already has a conntrack flow attached to it, which means +nf_conntrack_in() will not resolve the flow again. + +This means only the dest port is "reverse-NATed" (61033 -> 10000) but +the dest IP remains 2.2.2.2, and since the socket is bound to 1.1.1.1 it's +not received. +This can be verified by logging the 4-tuple of the packet in '__udp4_lib_rcv()'. + +The fix is then to reset the flow when skb is received on a VRF, to let +conntrack resolve the flow again (which now will hit the earlier flow). + +To reproduce: (Without the fix "Got pkt_to_nat_port" will not be printed by + running 'bash ./repro'): + $ cat run_in_A1.py + import logging + logging.getLogger("scapy.runtime").setLevel(logging.ERROR) + from scapy.all import * + import argparse + + def get_packet_to_send(udp_dst_port, msg_name): + return Ether(src='11:22:33:44:55:66', dst=iface_mac)/ \ + IP(src='3.3.3.3', dst='2.2.2.2')/ \ + UDP(sport=53, dport=udp_dst_port)/ \ + Raw(f'{msg_name}\x0012345678901234567890') + + parser = argparse.ArgumentParser() + parser.add_argument('-iface_mac', dest="iface_mac", type=str, required=True, + help="From run_in_A3.py") + parser.add_argument('-socket_port', dest="socket_port", type=str, + required=True, help="From run_in_A3.py") + parser.add_argument('-v1_mac', dest="v1_mac", type=str, required=True, + help="From script") + + args, _ = parser.parse_known_args() + iface_mac = args.iface_mac + socket_port = int(args.socket_port) + v1_mac = args.v1_mac + + print(f'Source port before NAT: {socket_port}') + + while True: + pkts = sniff(iface='_v0', store=True, count=1, timeout=10) + if 0 == len(pkts): + print('Something failed, rerun the script :(', flush=True) + break + pkt = pkts[0] + if not pkt.haslayer('UDP'): + continue + + pkt_sport = pkt.getlayer('UDP').sport + print(f'Source port after NAT: {pkt_sport}', flush=True) + + pkt_to_send = get_packet_to_send(pkt_sport, 'pkt_to_nat_port') + sendp(pkt_to_send, '_v0', verbose=False) # Will not be received + + pkt_to_send = get_packet_to_send(socket_port, 'pkt_to_socket_port') + sendp(pkt_to_send, '_v0', verbose=False) + break + + $ cat run_in_A2.py + import socket + import netifaces + + print(f"{netifaces.ifaddresses('e00000')[netifaces.AF_LINK][0]['addr']}", + flush=True) + s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) + s.setsockopt(socket.SOL_SOCKET, socket.SO_BINDTODEVICE, + str('vrf_1' + '\0').encode('utf-8')) + s.connect(('3.3.3.3', 53)) + print(f'{s. getsockname()[1]}', flush=True) + s.settimeout(5) + + while True: + try: + # Periodically send in order to keep the conntrack entry alive. + s.send(b'a'*40) + resp = s.recvfrom(1024) + msg_name = resp[0].decode('utf-8').split('\0')[0] + print(f"Got {msg_name}", flush=True) + except Exception as e: + pass + + $ cat repro.sh + ip netns del A1 2> /dev/null + ip netns del A2 2> /dev/null + ip netns add A1 + ip netns add A2 + + ip -n A1 link add _v0 type veth peer name _v1 netns A2 + ip -n A1 link set _v0 up + + ip -n A2 link add e00000 type bond + ip -n A2 link add lo0 type dummy + ip -n A2 link add vrf_1 type vrf table 10001 + ip -n A2 link set vrf_1 up + ip -n A2 link set e00000 master vrf_1 + + ip -n A2 addr add 1.1.1.1/24 dev e00000 + ip -n A2 link set e00000 up + ip -n A2 link set _v1 master e00000 + ip -n A2 link set _v1 up + ip -n A2 link set lo0 up + ip -n A2 addr add 2.2.2.2/32 dev lo0 + + ip -n A2 neigh add 1.1.1.10 lladdr 77:77:77:77:77:77 dev e00000 + ip -n A2 route add 3.3.3.3/32 via 1.1.1.10 dev e00000 table 10001 + + ip netns exec A2 iptables -t nat -A POSTROUTING -p udp -m udp --dport 53 -j \ + SNAT --to-source 2.2.2.2 -o vrf_1 + + sleep 5 + ip netns exec A2 python3 run_in_A2.py > x & + XPID=$! + sleep 5 + + IFACE_MAC=`sed -n 1p x` + SOCKET_PORT=`sed -n 2p x` + V1_MAC=`ip -n A2 link show _v1 | sed -n 2p | awk '{print $2'}` + ip netns exec A1 python3 run_in_A1.py -iface_mac ${IFACE_MAC} -socket_port \ + ${SOCKET_PORT} -v1_mac ${SOCKET_PORT} + sleep 5 + + kill -9 $XPID + wait $XPID 2> /dev/null + ip netns del A1 + ip netns del A2 + tail x -n 2 + rm x + set +x + +Fixes: 73e20b761acf ("net: vrf: Add support for PREROUTING rules on vrf device") +Signed-off-by: Lahav Schlesinger +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20210815120002.2787653-1-lschlesinger@drivenets.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/vrf.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index 2746f77745e4..d406da82b4fb 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -1313,6 +1313,8 @@ static struct sk_buff *vrf_ip6_rcv(struct net_device *vrf_dev, + bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr); + bool is_ndisc = ipv6_ndisc_frame(skb); + ++ nf_reset_ct(skb); ++ + /* loopback, multicast & non-ND link-local traffic; do not push through + * packet taps again. Reset pkt_type for upper layers to process skb. + * For strict packets with a source LLA, determine the dst using the +@@ -1369,6 +1371,8 @@ static struct sk_buff *vrf_ip_rcv(struct net_device *vrf_dev, + skb->skb_iif = vrf_dev->ifindex; + IPCB(skb)->flags |= IPSKB_L3SLAVE; + ++ nf_reset_ct(skb); ++ + if (ipv4_is_multicast(ip_hdr(skb)->daddr)) + goto out; + +-- +2.30.2 +