From: Sasha Levin Date: Sun, 10 Oct 2021 18:58:37 +0000 (-0400) Subject: Fixes for 5.14 X-Git-Tag: v5.14.12~26 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4d012d6860bf853a983a3b554353308a4aa2857f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.14 Signed-off-by: Sasha Levin --- diff --git a/queue-5.14/afs-fix-afs_launder_page-to-set-correct-start-file-p.patch b/queue-5.14/afs-fix-afs_launder_page-to-set-correct-start-file-p.patch new file mode 100644 index 00000000000..2a54162beed --- /dev/null +++ b/queue-5.14/afs-fix-afs_launder_page-to-set-correct-start-file-p.patch @@ -0,0 +1,54 @@ +From b44b39cb79cb20205d6fe7df4d5af0f29a66eadf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 23:08:54 +0100 +Subject: afs: Fix afs_launder_page() to set correct start file position + +From: David Howells + +[ Upstream commit 5c0522484eb54b90f2e46a5db8d7a4ff3ff86e5d ] + +Fix afs_launder_page() to set the starting position of the StoreData RPC at +the offset into the page at which the modified data starts instead of at +the beginning of the page (the iov_iter is correctly offset). + +The offset got lost during the conversion to passing an iov_iter into +afs_store_data(). + +Changes: +ver #2: + - Use page_offset() rather than manually calculating it[1]. + +Fixes: bd80d8a80e12 ("afs: Use ITER_XARRAY for writing") +Signed-off-by: David Howells +Reviewed-by: Jeffrey Altman +cc: Marc Dionne +cc: linux-afs@lists.infradead.org +Link: https://lore.kernel.org/r/YST/0e92OdSH0zjg@casper.infradead.org/ [1] +Link: https://lore.kernel.org/r/162880783179.3421678.7795105718190440134.stgit@warthog.procyon.org.uk/ # v1 +Link: https://lore.kernel.org/r/162937512409.1449272.18441473411207824084.stgit@warthog.procyon.org.uk/ # v1 +Link: https://lore.kernel.org/r/162981148752.1901565.3663780601682206026.stgit@warthog.procyon.org.uk/ # v1 +Link: https://lore.kernel.org/r/163005741670.2472992.2073548908229887941.stgit@warthog.procyon.org.uk/ # v2 +Link: https://lore.kernel.org/r/163221839087.3143591.14278359695763025231.stgit@warthog.procyon.org.uk/ # v2 +Link: https://lore.kernel.org/r/163292980654.4004896.7134735179887998551.stgit@warthog.procyon.org.uk/ # v2 +Signed-off-by: Sasha Levin +--- + fs/afs/write.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/afs/write.c b/fs/afs/write.c +index 2dfe3b3a53d6..f24370f5c774 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -974,8 +974,7 @@ int afs_launder_page(struct page *page) + iov_iter_bvec(&iter, WRITE, bv, 1, bv[0].bv_len); + + trace_afs_page_dirty(vnode, tracepoint_string("launder"), page); +- ret = afs_store_data(vnode, &iter, (loff_t)page->index * PAGE_SIZE, +- true); ++ ret = afs_store_data(vnode, &iter, page_offset(page) + f, true); + } + + trace_afs_page_dirty(vnode, tracepoint_string("laundered"), page); +-- +2.33.0 + diff --git a/queue-5.14/arm-at91-pm-do-not-panic-if-ram-controllers-are-not-.patch b/queue-5.14/arm-at91-pm-do-not-panic-if-ram-controllers-are-not-.patch new file mode 100644 index 00000000000..960bf69fcc7 --- /dev/null +++ b/queue-5.14/arm-at91-pm-do-not-panic-if-ram-controllers-are-not-.patch @@ -0,0 +1,185 @@ +From 6722dd1c015e831d75c886c964e20cc81dc8c26f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Aug 2021 16:19:12 +0300 +Subject: ARM: at91: pm: do not panic if ram controllers are not enabled + +From: Claudiu Beznea + +[ Upstream commit 1605de1b3ca66e3eddbca4b3c353c13c26476fe2 ] + +In case PM is enabled but there is no RAM controller information +in DT the code will panic. Avoid such scenarios by not initializing +platform specific PM code in case RAM controller is not provided +via DT. + +Reported-by: Eugen Hristev +Fixes: 827de1f123ba0 ("ARM: at91: remove at91_dt_initialize and machine init_early()") +Fixes: 892e1f4a3ae58 ("ARM: at91: pm: add sama7g5 ddr phy controller") +Signed-off-by: Claudiu Beznea +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20210823131915.23857-2-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm.c | 58 +++++++++++++++++++++++++++++++++-------- + 1 file changed, 47 insertions(+), 11 deletions(-) + +diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c +index 90dcdfe3b3d0..2dee383f9050 100644 +--- a/arch/arm/mach-at91/pm.c ++++ b/arch/arm/mach-at91/pm.c +@@ -514,18 +514,22 @@ static const struct of_device_id ramc_ids[] __initconst = { + { /*sentinel*/ } + }; + +-static __init void at91_dt_ramc(void) ++static __init int at91_dt_ramc(void) + { + struct device_node *np; + const struct of_device_id *of_id; + int idx = 0; + void *standby = NULL; + const struct ramc_info *ramc; ++ int ret; + + for_each_matching_node_and_match(np, ramc_ids, &of_id) { + soc_pm.data.ramc[idx] = of_iomap(np, 0); +- if (!soc_pm.data.ramc[idx]) +- panic(pr_fmt("unable to map ramc[%d] cpu registers\n"), idx); ++ if (!soc_pm.data.ramc[idx]) { ++ pr_err("unable to map ramc[%d] cpu registers\n", idx); ++ ret = -ENOMEM; ++ goto unmap_ramc; ++ } + + ramc = of_id->data; + if (!standby) +@@ -535,15 +539,26 @@ static __init void at91_dt_ramc(void) + idx++; + } + +- if (!idx) +- panic(pr_fmt("unable to find compatible ram controller node in dtb\n")); ++ if (!idx) { ++ pr_err("unable to find compatible ram controller node in dtb\n"); ++ ret = -ENODEV; ++ goto unmap_ramc; ++ } + + if (!standby) { + pr_warn("ramc no standby function available\n"); +- return; ++ return 0; + } + + at91_cpuidle_device.dev.platform_data = standby; ++ ++ return 0; ++ ++unmap_ramc: ++ while (idx) ++ iounmap(soc_pm.data.ramc[--idx]); ++ ++ return ret; + } + + static void at91rm9200_idle(void) +@@ -866,6 +881,8 @@ static void __init at91_pm_init(void (*pm_idle)(void)) + + void __init at91rm9200_pm_init(void) + { ++ int ret; ++ + if (!IS_ENABLED(CONFIG_SOC_AT91RM9200)) + return; + +@@ -877,7 +894,9 @@ void __init at91rm9200_pm_init(void) + soc_pm.data.standby_mode = AT91_PM_STANDBY; + soc_pm.data.suspend_mode = AT91_PM_ULP0; + +- at91_dt_ramc(); ++ ret = at91_dt_ramc(); ++ if (ret) ++ return; + + /* + * AT91RM9200 SDRAM low-power mode cannot be used with self-refresh. +@@ -892,13 +911,17 @@ void __init sam9x60_pm_init(void) + static const int modes[] __initconst = { + AT91_PM_STANDBY, AT91_PM_ULP0, AT91_PM_ULP0_FAST, AT91_PM_ULP1, + }; ++ int ret; + + if (!IS_ENABLED(CONFIG_SOC_SAM9X60)) + return; + + at91_pm_modes_validate(modes, ARRAY_SIZE(modes)); + at91_pm_modes_init(); +- at91_dt_ramc(); ++ ret = at91_dt_ramc(); ++ if (ret) ++ return; ++ + at91_pm_init(NULL); + + soc_pm.ws_ids = sam9x60_ws_ids; +@@ -907,6 +930,8 @@ void __init sam9x60_pm_init(void) + + void __init at91sam9_pm_init(void) + { ++ int ret; ++ + if (!IS_ENABLED(CONFIG_SOC_AT91SAM9)) + return; + +@@ -918,7 +943,10 @@ void __init at91sam9_pm_init(void) + soc_pm.data.standby_mode = AT91_PM_STANDBY; + soc_pm.data.suspend_mode = AT91_PM_ULP0; + +- at91_dt_ramc(); ++ ret = at91_dt_ramc(); ++ if (ret) ++ return; ++ + at91_pm_init(at91sam9_idle); + } + +@@ -927,12 +955,16 @@ void __init sama5_pm_init(void) + static const int modes[] __initconst = { + AT91_PM_STANDBY, AT91_PM_ULP0, AT91_PM_ULP0_FAST, + }; ++ int ret; + + if (!IS_ENABLED(CONFIG_SOC_SAMA5)) + return; + + at91_pm_modes_validate(modes, ARRAY_SIZE(modes)); +- at91_dt_ramc(); ++ ret = at91_dt_ramc(); ++ if (ret) ++ return; ++ + at91_pm_init(NULL); + } + +@@ -942,13 +974,17 @@ void __init sama5d2_pm_init(void) + AT91_PM_STANDBY, AT91_PM_ULP0, AT91_PM_ULP0_FAST, AT91_PM_ULP1, + AT91_PM_BACKUP, + }; ++ int ret; + + if (!IS_ENABLED(CONFIG_SOC_SAMA5D2)) + return; + + at91_pm_modes_validate(modes, ARRAY_SIZE(modes)); + at91_pm_modes_init(); +- at91_dt_ramc(); ++ ret = at91_dt_ramc(); ++ if (ret) ++ return; ++ + at91_pm_init(NULL); + + soc_pm.ws_ids = sama5d2_ws_ids; +-- +2.33.0 + diff --git a/queue-5.14/arm-defconfig-gemini-restore-framebuffer.patch b/queue-5.14/arm-defconfig-gemini-restore-framebuffer.patch new file mode 100644 index 00000000000..d0ce6f2dcd9 --- /dev/null +++ b/queue-5.14/arm-defconfig-gemini-restore-framebuffer.patch @@ -0,0 +1,36 @@ +From 5d933835878718f7f9c1f90b3624c67f41245959 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Sep 2021 22:09:33 +0200 +Subject: ARM: defconfig: gemini: Restore framebuffer + +From: Linus Walleij + +[ Upstream commit a6949059318a064880050c76a9d8fb070156385f ] + +The framebuffer is gone on the D-Link DIR-685, restore it. + +Fixes: f611b1e7624c ("drm: Avoid circular dependencies for CONFIG_FB") +Signed-off-by: Linus Walleij +Cc: Kees Cook +Link: https://lore.kernel.org/r/20210922200933.1825752-1-linus.walleij@linaro.org' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/configs/gemini_defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/configs/gemini_defconfig b/arch/arm/configs/gemini_defconfig +index d2d5f1cf815f..e6ff844821cf 100644 +--- a/arch/arm/configs/gemini_defconfig ++++ b/arch/arm/configs/gemini_defconfig +@@ -76,6 +76,7 @@ CONFIG_REGULATOR_FIXED_VOLTAGE=y + CONFIG_DRM=y + CONFIG_DRM_PANEL_ILITEK_IL9322=y + CONFIG_DRM_TVE200=y ++CONFIG_FB=y + CONFIG_LOGO=y + CONFIG_USB=y + CONFIG_USB_MON=y +-- +2.33.0 + diff --git a/queue-5.14/arm-dts-imx-add-missing-pinctrl-names-for-panel-on-m.patch b/queue-5.14/arm-dts-imx-add-missing-pinctrl-names-for-panel-on-m.patch new file mode 100644 index 00000000000..23f8f0056d1 --- /dev/null +++ b/queue-5.14/arm-dts-imx-add-missing-pinctrl-names-for-panel-on-m.patch @@ -0,0 +1,41 @@ +From acb5e754f8fb8e6ab7d900c7e0ea249fac3698f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 02:00:48 +0200 +Subject: ARM: dts: imx: Add missing pinctrl-names for panel on M53Menlo + +From: Marek Vasut + +[ Upstream commit c8c1efe14a4aadcfe93a158b1272e48298d2de15 ] + +The panel already contains pinctrl-0 phandle, but it is missing +the default pinctrl-names property, so the pin configuration is +ignored. Fill in the missing pinctrl-names property, so the pin +configuration is applied. + +Fixes: d81765d693db6 ("ARM: dts: imx53: Update LCD panel node on M53Menlo") +Signed-off-by: Marek Vasut +Cc: Shawn Guo +Cc: Fabio Estevam +Cc: NXP Linux Team +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx53-m53menlo.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts +index d3082b9774e4..48adcfd32cea 100644 +--- a/arch/arm/boot/dts/imx53-m53menlo.dts ++++ b/arch/arm/boot/dts/imx53-m53menlo.dts +@@ -56,6 +56,7 @@ + panel { + compatible = "edt,etm0700g0dh6"; + pinctrl-0 = <&pinctrl_display_gpio>; ++ pinctrl-names = "default"; + enable-gpios = <&gpio6 0 GPIO_ACTIVE_HIGH>; + + port { +-- +2.33.0 + diff --git a/queue-5.14/arm-dts-imx-change-the-spi-nor-tx.patch b/queue-5.14/arm-dts-imx-change-the-spi-nor-tx.patch new file mode 100644 index 00000000000..24bbcc5cef9 --- /dev/null +++ b/queue-5.14/arm-dts-imx-change-the-spi-nor-tx.patch @@ -0,0 +1,70 @@ +From 972e8e1d7d2383c44416b96aaaa144690bcacbc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 17:29:49 +0800 +Subject: ARM: dts: imx: change the spi-nor tx + +From: Haibo Chen + +[ Upstream commit b2a4f4a302b83976ad0d2930abe0f38e6119a144 ] + +Before commit 0e30f47232ab5 ("mtd: spi-nor: add support for DTR protocol"), +for all PP command, it only support 1-1-1 mode, no matter the tx setting +in dts. But after the upper commit, the logic change. It will choose +the best mode(fastest mode) which flash device and spi-nor host controller +both support. + +Though the spi-nor device on imx6sx-sdb/imx6ul(l/z)-14x14-evk board +do not support PP-1-4-4/PP-1-1-4, but if tx is 4 in dts file, it will also +impact the read mode selection. For the spi-nor device on the upper mentioned +boards, they support read 1-4-4 mode and read 1-1-4 mode according to the +device internal sfdp register. But qspi host controller do not support +read 1-4-4 mode. so need to set the tx to 1, let the common code finally +select read 1-1-4 mode, PP-1-1-1 mode. + +Signed-off-by: Haibo Chen +Fixes: 0e30f47232ab ("mtd: spi-nor: add support for DTR protocol") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6sx-sdb.dts | 4 ++-- + arch/arm/boot/dts/imx6ul-14x14-evk.dtsi | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6sx-sdb.dts b/arch/arm/boot/dts/imx6sx-sdb.dts +index 5a63ca615722..99f4cf777a38 100644 +--- a/arch/arm/boot/dts/imx6sx-sdb.dts ++++ b/arch/arm/boot/dts/imx6sx-sdb.dts +@@ -114,7 +114,7 @@ + compatible = "micron,n25q256a", "jedec,spi-nor"; + spi-max-frequency = <29000000>; + spi-rx-bus-width = <4>; +- spi-tx-bus-width = <4>; ++ spi-tx-bus-width = <1>; + reg = <0>; + }; + +@@ -124,7 +124,7 @@ + compatible = "micron,n25q256a", "jedec,spi-nor"; + spi-max-frequency = <29000000>; + spi-rx-bus-width = <4>; +- spi-tx-bus-width = <4>; ++ spi-tx-bus-width = <1>; + reg = <2>; + }; + }; +diff --git a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi +index 779cc536566d..a3fde3316c73 100644 +--- a/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi ++++ b/arch/arm/boot/dts/imx6ul-14x14-evk.dtsi +@@ -292,7 +292,7 @@ + compatible = "micron,n25q256a", "jedec,spi-nor"; + spi-max-frequency = <29000000>; + spi-rx-bus-width = <4>; +- spi-tx-bus-width = <4>; ++ spi-tx-bus-width = <1>; + reg = <0>; + }; + }; +-- +2.33.0 + diff --git a/queue-5.14/arm-dts-imx-fix-usb-host-power-regulator-polarity-on.patch b/queue-5.14/arm-dts-imx-fix-usb-host-power-regulator-polarity-on.patch new file mode 100644 index 00000000000..ce295dce1d1 --- /dev/null +++ b/queue-5.14/arm-dts-imx-fix-usb-host-power-regulator-polarity-on.patch @@ -0,0 +1,43 @@ +From e08df35827c4f0db34eb4e4ead468bbb19e30335 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 5 Sep 2021 02:01:37 +0200 +Subject: ARM: dts: imx: Fix USB host power regulator polarity on M53Menlo + +From: Marek Vasut + +[ Upstream commit 5c187e2eb3f92daa38cb3d4ab45e1107ea34108e ] + +The MIC2025 switch input signal nEN is active low, describe it as such +in the DT. The previous change to this regulator polarity was incorrectly +influenced by broken quirks in gpiolib-of.c, which is now long fixed. So +fix this regulator polarity setting here once and for all. + +Fixes: 3c3601cd6a6d3 ("ARM: dts: imx53: Update USB configuration on M53Menlo") +Signed-off-by: Marek Vasut +Cc: Shawn Guo +Cc: Fabio Estevam +Cc: NXP Linux Team +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx53-m53menlo.dts | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts +index 48adcfd32cea..4f88e96d81dd 100644 +--- a/arch/arm/boot/dts/imx53-m53menlo.dts ++++ b/arch/arm/boot/dts/imx53-m53menlo.dts +@@ -77,8 +77,7 @@ + regulator-name = "vbus"; + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; +- gpio = <&gpio1 2 GPIO_ACTIVE_HIGH>; +- enable-active-high; ++ gpio = <&gpio1 2 0>; + }; + }; + +-- +2.33.0 + diff --git a/queue-5.14/arm-dts-imx6qdl-pico-fix-ethernet-support.patch b/queue-5.14/arm-dts-imx6qdl-pico-fix-ethernet-support.patch new file mode 100644 index 00000000000..5fd16730224 --- /dev/null +++ b/queue-5.14/arm-dts-imx6qdl-pico-fix-ethernet-support.patch @@ -0,0 +1,53 @@ +From 1b61cd95323c21d42cfb0cd9d1b51e9688a854a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Sep 2021 14:17:15 -0300 +Subject: ARM: dts: imx6qdl-pico: Fix Ethernet support + +From: Fabio Estevam + +[ Upstream commit 450e7fe9b1b3c90eeed74a2fe0eeb13a7b57f3da ] + +Currently, it is no longer possible to retrieve a DHCP address +on the imx6qdl-pico board. + +This issue has been exposed by commit f5d9aa79dfdf ("ARM: imx6q: +remove clk-out fixup for the Atheros AR8031 and AR8035 PHYs"). + +Fix it by describing the qca,clk-out-frequency property as suggested +by the commit above. + +Fixes: 98670a0bb0ef14bbb3 ("ARM: dts: imx6qdl: Add imx6qdl-pico support") +Signed-off-by: Fabio Estevam +Reviewed-by: Andrew Lunn +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-pico.dtsi | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/arch/arm/boot/dts/imx6qdl-pico.dtsi b/arch/arm/boot/dts/imx6qdl-pico.dtsi +index 5de4ccb97916..f7a56d6b160c 100644 +--- a/arch/arm/boot/dts/imx6qdl-pico.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-pico.dtsi +@@ -176,7 +176,18 @@ + pinctrl-0 = <&pinctrl_enet>; + phy-mode = "rgmii-id"; + phy-reset-gpios = <&gpio1 26 GPIO_ACTIVE_LOW>; ++ phy-handle = <&phy>; + status = "okay"; ++ ++ mdio { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ phy: ethernet-phy@1 { ++ reg = <1>; ++ qca,clk-out-frequency = <125000000>; ++ }; ++ }; + }; + + &hdmi { +-- +2.33.0 + diff --git a/queue-5.14/arm-dts-qcom-apq8064-use-27mhz-pxo-clock-as-dsi-pll-.patch b/queue-5.14/arm-dts-qcom-apq8064-use-27mhz-pxo-clock-as-dsi-pll-.patch new file mode 100644 index 00000000000..aab304e69bb --- /dev/null +++ b/queue-5.14/arm-dts-qcom-apq8064-use-27mhz-pxo-clock-as-dsi-pll-.patch @@ -0,0 +1,53 @@ +From 922451ccc9e3496916178ae287f7fa1b4f891e17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Aug 2021 22:30:25 +0200 +Subject: ARM: dts: qcom: apq8064: Use 27MHz PXO clock as DSI PLL reference + +From: Marijn Suijten + +[ Upstream commit f1db21c315f4b4f8c3fbea56aac500673132d317 ] + +The 28NM DSI PLL driver for msm8960 calculates with a 27MHz reference +clock and should hence use PXO, not CXO which runs at 19.2MHz. + +Note that none of the DSI PHY/PLL drivers currently use this "ref" +clock; they all rely on (sometimes inexistant) global clock names and +usually function normally without a parent clock. This discrepancy will +be corrected in a future patch, for which this change needs to be in +place first. + +Fixes: 6969d1d9c615 ("ARM: dts: qcom-apq8064: Set 'cxo_board' as ref clock of the DSI PHY") +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Marijn Suijten +Link: https://lore.kernel.org/r/20210829203027.276143-2-marijn.suijten@somainline.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-apq8064.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi +index 01ea4590ffce..72c4a9fc41a2 100644 +--- a/arch/arm/boot/dts/qcom-apq8064.dtsi ++++ b/arch/arm/boot/dts/qcom-apq8064.dtsi +@@ -198,7 +198,7 @@ + clock-frequency = <19200000>; + }; + +- pxo_board { ++ pxo_board: pxo_board { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <27000000>; +@@ -1305,7 +1305,7 @@ + reg-names = "dsi_pll", "dsi_phy", "dsi_phy_regulator"; + clock-names = "iface_clk", "ref"; + clocks = <&mmcc DSI_M_AHB_CLK>, +- <&cxo_board>; ++ <&pxo_board>; + }; + + +-- +2.33.0 + diff --git a/queue-5.14/arm-imx6-disable-the-gic-cpu-interface-before-callin.patch b/queue-5.14/arm-imx6-disable-the-gic-cpu-interface-before-callin.patch new file mode 100644 index 00000000000..0a14e47dbb8 --- /dev/null +++ b/queue-5.14/arm-imx6-disable-the-gic-cpu-interface-before-callin.patch @@ -0,0 +1,44 @@ +From 603afdfc4543c8a161779e89de83ff6ef3269cb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 15:49:40 +0200 +Subject: ARM: imx6: disable the GIC CPU interface before calling stby-poweroff + sequence + +From: Oleksij Rempel + +[ Upstream commit 783f3db030563f7bcdfe2d26428af98ea1699a8e ] + +Any pending interrupt can prevent entering standby based power off state. +To avoid it, disable the GIC CPU interface. + +Fixes: 8148d2136002 ("ARM: imx6: register pm_power_off handler if "fsl,pmic-stby-poweroff" is set") +Signed-off-by: Oleksij Rempel +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/pm-imx6.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c +index 9244437cb1b9..f2ecca339910 100644 +--- a/arch/arm/mach-imx/pm-imx6.c ++++ b/arch/arm/mach-imx/pm-imx6.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -619,6 +620,7 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata + + static void imx6_pm_stby_poweroff(void) + { ++ gic_cpu_if_down(0); + imx6_set_lpm(STOP_POWER_OFF); + imx6q_suspend_finish(0); + +-- +2.33.0 + diff --git a/queue-5.14/arm64-dts-imx8-change-the-spi-nor-tx.patch b/queue-5.14/arm64-dts-imx8-change-the-spi-nor-tx.patch new file mode 100644 index 00000000000..66d622d4dfa --- /dev/null +++ b/queue-5.14/arm64-dts-imx8-change-the-spi-nor-tx.patch @@ -0,0 +1,112 @@ +From 4f7bf7dbd2e4cf3194741f45a45f3a3ba77ed92e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 17:29:50 +0800 +Subject: arm64: dts: imx8: change the spi-nor tx + +From: Haibo Chen + +[ Upstream commit 04aa946d57b20c40e541fb4ba2bcb390a22f404c ] + +Before commit 0e30f47232ab5 ("mtd: spi-nor: add support for DTR protocol"), +for all PP command, it only support 1-1-1 mode, no matter the tx setting +in dts. But after the upper commit, the logic change. It will choose +the best mode(fastest mode) which flash device and spi-nor host controller +both support. + +qspi and fspi host controller do not support read 1-4-4 mode. so need to +set the tx to 1, let the common code finally select read 1-1-4 mode. + +Signed-off-by: Haibo Chen +Fixes: 0e30f47232ab ("mtd: spi-nor: add support for DTR protocol") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mm-evk.dts | 2 +- + arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi | 2 +- + arch/arm64/boot/dts/freescale/imx8mq-evk.dts | 2 ++ + arch/arm64/boot/dts/freescale/imx8mq-kontron-pitx-imx8m.dts | 2 +- + 6 files changed, 7 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi +index 988f8ab679ad..40f5e7a3b064 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-beacon-som.dtsi +@@ -91,7 +91,7 @@ + #size-cells = <1>; + compatible = "jedec,spi-nor"; + spi-max-frequency = <80000000>; +- spi-tx-bus-width = <4>; ++ spi-tx-bus-width = <1>; + spi-rx-bus-width = <4>; + }; + }; +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-evk.dts b/arch/arm64/boot/dts/freescale/imx8mm-evk.dts +index 4e2820d19244..a2b24d4d4e3e 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mm-evk.dts +@@ -48,7 +48,7 @@ + #size-cells = <1>; + compatible = "jedec,spi-nor"; + spi-max-frequency = <80000000>; +- spi-tx-bus-width = <4>; ++ spi-tx-bus-width = <1>; + spi-rx-bus-width = <4>; + }; + }; +diff --git a/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi +index 54eaf3d6055b..3b2d627a0342 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mn-beacon-som.dtsi +@@ -101,7 +101,7 @@ + #size-cells = <1>; + compatible = "jedec,spi-nor"; + spi-max-frequency = <80000000>; +- spi-tx-bus-width = <4>; ++ spi-tx-bus-width = <1>; + spi-rx-bus-width = <4>; + }; + }; +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi +index aa78e0d8c72b..fc178eebf8aa 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-phycore-som.dtsi +@@ -74,7 +74,7 @@ + compatible = "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <80000000>; +- spi-tx-bus-width = <4>; ++ spi-tx-bus-width = <1>; + spi-rx-bus-width = <4>; + }; + }; +diff --git a/arch/arm64/boot/dts/freescale/imx8mq-evk.dts b/arch/arm64/boot/dts/freescale/imx8mq-evk.dts +index 4d2035e3dd7c..4886f3e31587 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq-evk.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mq-evk.dts +@@ -337,6 +337,8 @@ + #size-cells = <1>; + compatible = "micron,n25q256a", "jedec,spi-nor"; + spi-max-frequency = <29000000>; ++ spi-tx-bus-width = <1>; ++ spi-rx-bus-width = <4>; + }; + }; + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq-kontron-pitx-imx8m.dts b/arch/arm64/boot/dts/freescale/imx8mq-kontron-pitx-imx8m.dts +index f593e4ff62e1..564746d5000d 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq-kontron-pitx-imx8m.dts ++++ b/arch/arm64/boot/dts/freescale/imx8mq-kontron-pitx-imx8m.dts +@@ -281,7 +281,7 @@ + #address-cells = <1>; + #size-cells = <1>; + reg = <0>; +- spi-tx-bus-width = <4>; ++ spi-tx-bus-width = <1>; + spi-rx-bus-width = <4>; + m25p,fast-read; + spi-max-frequency = <50000000>; +-- +2.33.0 + diff --git a/queue-5.14/arm64-dts-imx8mm-kontron-n801x-som-do-not-allow-to-s.patch b/queue-5.14/arm64-dts-imx8mm-kontron-n801x-som-do-not-allow-to-s.patch new file mode 100644 index 00000000000..a217f3a7098 --- /dev/null +++ b/queue-5.14/arm64-dts-imx8mm-kontron-n801x-som-do-not-allow-to-s.patch @@ -0,0 +1,38 @@ +From 59b21dd13186c9da5ba5d32b87c0425ea4294777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 14:03:26 +0200 +Subject: arm64: dts: imx8mm-kontron-n801x-som: do not allow to switch off + buck2 + +From: Heiko Thiery + +[ Upstream commit 9786cca4b477f2b2f9d573d474c929d87579b501 ] + +The buck2 output of the PMIC is the VDD core voltage of the cpu. +Switching off this will poweroff the CPU. Add the 'regulator-always-on' +property to avoid this. + +Fixes: 8668d8b2e67f ("arm64: dts: Add the Kontron i.MX8M Mini SoMs and baseboards") +Signed-off-by: Heiko Thiery +Reviewed-by: Frieder Schrempf +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi +index d0456daefda8..9db9b90bf2bc 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mm-kontron-n801x-som.dtsi +@@ -102,6 +102,7 @@ + regulator-min-microvolt = <850000>; + regulator-max-microvolt = <950000>; + regulator-boot-on; ++ regulator-always-on; + regulator-ramp-delay = <3125>; + nxp,dvs-run-voltage = <950000>; + nxp,dvs-standby-voltage = <850000>; +-- +2.33.0 + diff --git a/queue-5.14/arm64-dts-ls1028a-fix-esdhc2-node.patch b/queue-5.14/arm64-dts-ls1028a-fix-esdhc2-node.patch new file mode 100644 index 00000000000..4ef3df01c87 --- /dev/null +++ b/queue-5.14/arm64-dts-ls1028a-fix-esdhc2-node.patch @@ -0,0 +1,43 @@ +From c7a5779ea53ab3d7a13dcc924c308f38103b8781 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 22:22:59 +0200 +Subject: arm64: dts: ls1028a: fix eSDHC2 node + +From: Michael Walle + +[ Upstream commit 8b94aa318aa746fbbc668d6b9b3ad812c835230c ] + +On the LS1028A this instance of the eSDHC controller is intended for +either an eMMC or eSDIO card. It doesn't provide a card detect pin and +its IO voltage is fixed at 1.8V. + +Remove the bogus broken-cd property, instead add the non-removable +property. Fix the voltage-ranges property and set it to 1.8V only. + +Fixes: 491d3a3fc113 ("arm64: dts: ls1028a: Add esdhc node in dts") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index 343ecf0e8973..06b36cc65865 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -405,9 +405,9 @@ + interrupts = ; + clock-frequency = <0>; /* fixed up by bootloader */ + clocks = <&clockgen QORIQ_CLK_HWACCEL 1>; +- voltage-ranges = <1800 1800 3300 3300>; ++ voltage-ranges = <1800 1800>; + sdhci,auto-cmd12; +- broken-cd; ++ non-removable; + little-endian; + bus-width = <4>; + status = "disabled"; +-- +2.33.0 + diff --git a/queue-5.14/arm64-dts-qcom-pm8150-use-qcom-pm8998-pon-binding.patch b/queue-5.14/arm64-dts-qcom-pm8150-use-qcom-pm8998-pon-binding.patch new file mode 100644 index 00000000000..4eb6dc11d70 --- /dev/null +++ b/queue-5.14/arm64-dts-qcom-pm8150-use-qcom-pm8998-pon-binding.patch @@ -0,0 +1,38 @@ +From 9b29b6851a24c4486e37dd796963b572adbffb9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Sep 2021 18:13:39 +0300 +Subject: arm64: dts: qcom: pm8150: use qcom,pm8998-pon binding + +From: Dmitry Baryshkov + +[ Upstream commit a153d317168aa3d61a204fadc85bac3995381d33 ] + +Change pm8150 to use the qcom,pm8998-pon compatible string for the pon +in order to pass reboot mode properly. + +Fixes: 5101f22a5c37 ("arm64: dts: qcom: pm8150: Add base dts file") +Signed-off-by: Dmitry Baryshkov +Tested-by: Amit Pundir +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210916151341.1797512-1-dmitry.baryshkov@linaro.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pm8150.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pm8150.dtsi b/arch/arm64/boot/dts/qcom/pm8150.dtsi +index c566a64b1373..00385b1fd358 100644 +--- a/arch/arm64/boot/dts/qcom/pm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/pm8150.dtsi +@@ -48,7 +48,7 @@ + #size-cells = <0>; + + pon: power-on@800 { +- compatible = "qcom,pm8916-pon"; ++ compatible = "qcom,pm8998-pon"; + reg = <0x0800>; + + pon_pwrkey: pwrkey { +-- +2.33.0 + diff --git a/queue-5.14/ath5k-fix-building-with-leds-m.patch b/queue-5.14/ath5k-fix-building-with-leds-m.patch new file mode 100644 index 00000000000..4b8b5ead55b --- /dev/null +++ b/queue-5.14/ath5k-fix-building-with-leds-m.patch @@ -0,0 +1,97 @@ +From e65ee3f05d919c6b1a46e53ede433587864317e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Sep 2021 14:23:44 +0200 +Subject: ath5k: fix building with LEDS=m + +From: Arnd Bergmann + +[ Upstream commit fb8c3a3c52400512fc8b3b61150057b888c30b0d ] + +Randconfig builds still show a failure for the ath5k driver, +similar to the one that was fixed for ath9k earlier: + +WARNING: unmet direct dependencies detected for MAC80211_LEDS + Depends on [n]: NET [=y] && WIRELESS [=y] && MAC80211 [=y] && (LEDS_CLASS [=m]=y || LEDS_CLASS [=m]=MAC80211 [=y]) + Selected by [m]: + - ATH5K [=m] && NETDEVICES [=y] && WLAN [=y] && WLAN_VENDOR_ATH [=y] && (PCI [=y] || ATH25) && MAC80211 [=y] +net/mac80211/led.c: In function 'ieee80211_alloc_led_names': +net/mac80211/led.c:34:22: error: 'struct led_trigger' has no member named 'name' + 34 | local->rx_led.name = kasprintf(GFP_KERNEL, "%srx", + | ^ + +Copying the same logic from my ath9k patch makes this one work +as well, stubbing out the calls to the LED subsystem. + +Fixes: b64acb28da83 ("ath9k: fix build error with LEDS_CLASS=m") +Fixes: 72cdab808714 ("ath9k: Do not select MAC80211_LEDS by default") +Fixes: 3a078876caee ("ath5k: convert LED code to use mac80211 triggers") +Link: https://lore.kernel.org/all/20210722105501.1000781-1-arnd@kernel.org/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210920122359.353810-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath5k/Kconfig | 4 +--- + drivers/net/wireless/ath/ath5k/led.c | 10 ++++++---- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath5k/Kconfig b/drivers/net/wireless/ath/ath5k/Kconfig +index f35cd8de228e..6914b37bb0fb 100644 +--- a/drivers/net/wireless/ath/ath5k/Kconfig ++++ b/drivers/net/wireless/ath/ath5k/Kconfig +@@ -3,9 +3,7 @@ config ATH5K + tristate "Atheros 5xxx wireless cards support" + depends on (PCI || ATH25) && MAC80211 + select ATH_COMMON +- select MAC80211_LEDS +- select LEDS_CLASS +- select NEW_LEDS ++ select MAC80211_LEDS if LEDS_CLASS=y || LEDS_CLASS=MAC80211 + select ATH5K_AHB if ATH25 + select ATH5K_PCI if !ATH25 + help +diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c +index 6a2a16856763..33e9928af363 100644 +--- a/drivers/net/wireless/ath/ath5k/led.c ++++ b/drivers/net/wireless/ath/ath5k/led.c +@@ -89,7 +89,8 @@ static const struct pci_device_id ath5k_led_devices[] = { + + void ath5k_led_enable(struct ath5k_hw *ah) + { +- if (test_bit(ATH_STAT_LEDSOFT, ah->status)) { ++ if (IS_ENABLED(CONFIG_MAC80211_LEDS) && ++ test_bit(ATH_STAT_LEDSOFT, ah->status)) { + ath5k_hw_set_gpio_output(ah, ah->led_pin); + ath5k_led_off(ah); + } +@@ -104,7 +105,8 @@ static void ath5k_led_on(struct ath5k_hw *ah) + + void ath5k_led_off(struct ath5k_hw *ah) + { +- if (!test_bit(ATH_STAT_LEDSOFT, ah->status)) ++ if (!IS_ENABLED(CONFIG_MAC80211_LEDS) || ++ !test_bit(ATH_STAT_LEDSOFT, ah->status)) + return; + ath5k_hw_set_gpio(ah, ah->led_pin, !ah->led_on); + } +@@ -146,7 +148,7 @@ ath5k_register_led(struct ath5k_hw *ah, struct ath5k_led *led, + static void + ath5k_unregister_led(struct ath5k_led *led) + { +- if (!led->ah) ++ if (!IS_ENABLED(CONFIG_MAC80211_LEDS) || !led->ah) + return; + led_classdev_unregister(&led->led_dev); + ath5k_led_off(led->ah); +@@ -169,7 +171,7 @@ int ath5k_init_leds(struct ath5k_hw *ah) + char name[ATH5K_LED_MAX_NAME_LEN + 1]; + const struct pci_device_id *match; + +- if (!ah->pdev) ++ if (!IS_ENABLED(CONFIG_MAC80211_LEDS) || !ah->pdev) + return 0; + + #ifdef CONFIG_ATH5K_AHB +-- +2.33.0 + diff --git a/queue-5.14/bpf-arm-fix-register-clobbering-in-div-mod-implement.patch b/queue-5.14/bpf-arm-fix-register-clobbering-in-div-mod-implement.patch new file mode 100644 index 00000000000..75c17bda521 --- /dev/null +++ b/queue-5.14/bpf-arm-fix-register-clobbering-in-div-mod-implement.patch @@ -0,0 +1,94 @@ +From 8a4c05f8837dac39e59882aeb4685322d5abb117 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 11:13:10 +0200 +Subject: bpf, arm: Fix register clobbering in div/mod implementation + +From: Johan Almbladh + +[ Upstream commit 79e3445b38e0cab94264a3894c0c3d57c930b97e ] + +On ARM CPUs that lack div/mod instructions, ALU32 BPF_DIV and BPF_MOD are +implemented using a call to a helper function. Before, the emitted code +for those function calls failed to preserve caller-saved ARM registers. +Since some of those registers happen to be mapped to BPF registers, it +resulted in eBPF register values being overwritten. + +This patch emits code to push and pop the remaining caller-saved ARM +registers r2-r3 into the stack during the div/mod function call. ARM +registers r0-r1 are used as arguments and return value, and those were +already saved and restored correctly. + +Fixes: 39c13c204bb1 ("arm: eBPF JIT compiler") +Signed-off-by: Johan Almbladh +Signed-off-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + arch/arm/net/bpf_jit_32.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c +index a951276f0547..a903b26cde40 100644 +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -36,6 +36,10 @@ + * +-----+ + * |RSVD | JIT scratchpad + * current ARM_SP => +-----+ <= (BPF_FP - STACK_SIZE + SCRATCH_SIZE) ++ * | ... | caller-saved registers ++ * +-----+ ++ * | ... | arguments passed on stack ++ * ARM_SP during call => +-----| + * | | + * | ... | Function call stack + * | | +@@ -63,6 +67,12 @@ + * + * When popping registers off the stack at the end of a BPF function, we + * reference them via the current ARM_FP register. ++ * ++ * Some eBPF operations are implemented via a call to a helper function. ++ * Such calls are "invisible" in the eBPF code, so it is up to the calling ++ * program to preserve any caller-saved ARM registers during the call. The ++ * JIT emits code to push and pop those registers onto the stack, immediately ++ * above the callee stack frame. + */ + #define CALLEE_MASK (1 << ARM_R4 | 1 << ARM_R5 | 1 << ARM_R6 | \ + 1 << ARM_R7 | 1 << ARM_R8 | 1 << ARM_R9 | \ +@@ -70,6 +80,8 @@ + #define CALLEE_PUSH_MASK (CALLEE_MASK | 1 << ARM_LR) + #define CALLEE_POP_MASK (CALLEE_MASK | 1 << ARM_PC) + ++#define CALLER_MASK (1 << ARM_R0 | 1 << ARM_R1 | 1 << ARM_R2 | 1 << ARM_R3) ++ + enum { + /* Stack layout - these are offsets from (top of stack - 4) */ + BPF_R2_HI, +@@ -464,6 +476,7 @@ static inline int epilogue_offset(const struct jit_ctx *ctx) + + static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op) + { ++ const int exclude_mask = BIT(ARM_R0) | BIT(ARM_R1); + const s8 *tmp = bpf2a32[TMP_REG_1]; + + #if __LINUX_ARM_ARCH__ == 7 +@@ -495,11 +508,17 @@ static inline void emit_udivmod(u8 rd, u8 rm, u8 rn, struct jit_ctx *ctx, u8 op) + emit(ARM_MOV_R(ARM_R0, rm), ctx); + } + ++ /* Push caller-saved registers on stack */ ++ emit(ARM_PUSH(CALLER_MASK & ~exclude_mask), ctx); ++ + /* Call appropriate function */ + emit_mov_i(ARM_IP, op == BPF_DIV ? + (u32)jit_udiv32 : (u32)jit_mod32, ctx); + emit_blx_r(ARM_IP, ctx); + ++ /* Restore caller-saved registers from stack */ ++ emit(ARM_POP(CALLER_MASK & ~exclude_mask), ctx); ++ + /* Save return value */ + if (rd != ARM_R0) + emit(ARM_MOV_R(rd, ARM_R0), ctx); +-- +2.33.0 + diff --git a/queue-5.14/bpf-fix-integer-overflow-in-prealloc_elems_and_freel.patch b/queue-5.14/bpf-fix-integer-overflow-in-prealloc_elems_and_freel.patch new file mode 100644 index 00000000000..f6aaf40fcf3 --- /dev/null +++ b/queue-5.14/bpf-fix-integer-overflow-in-prealloc_elems_and_freel.patch @@ -0,0 +1,65 @@ +From 94c54be65b89190fa153184dec46992b67cd58e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 22:55:45 +0900 +Subject: bpf: Fix integer overflow in prealloc_elems_and_freelist() + +From: Tatsuhiko Yasumatsu + +[ Upstream commit 30e29a9a2bc6a4888335a6ede968b75cd329657a ] + +In prealloc_elems_and_freelist(), the multiplication to calculate the +size passed to bpf_map_area_alloc() could lead to an integer overflow. +As a result, out-of-bounds write could occur in pcpu_freelist_populate() +as reported by KASAN: + +[...] +[ 16.968613] BUG: KASAN: slab-out-of-bounds in pcpu_freelist_populate+0xd9/0x100 +[ 16.969408] Write of size 8 at addr ffff888104fc6ea0 by task crash/78 +[ 16.970038] +[ 16.970195] CPU: 0 PID: 78 Comm: crash Not tainted 5.15.0-rc2+ #1 +[ 16.970878] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 +[ 16.972026] Call Trace: +[ 16.972306] dump_stack_lvl+0x34/0x44 +[ 16.972687] print_address_description.constprop.0+0x21/0x140 +[ 16.973297] ? pcpu_freelist_populate+0xd9/0x100 +[ 16.973777] ? pcpu_freelist_populate+0xd9/0x100 +[ 16.974257] kasan_report.cold+0x7f/0x11b +[ 16.974681] ? pcpu_freelist_populate+0xd9/0x100 +[ 16.975190] pcpu_freelist_populate+0xd9/0x100 +[ 16.975669] stack_map_alloc+0x209/0x2a0 +[ 16.976106] __sys_bpf+0xd83/0x2ce0 +[...] + +The possibility of this overflow was originally discussed in [0], but +was overlooked. + +Fix the integer overflow by changing elem_size to u64 from u32. + + [0] https://lore.kernel.org/bpf/728b238e-a481-eb50-98e9-b0f430ab01e7@gmail.com/ + +Fixes: 557c0c6e7df8 ("bpf: convert stackmap to pre-allocation") +Signed-off-by: Tatsuhiko Yasumatsu +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210930135545.173698-1-th.yasumatsu@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/stackmap.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c +index 6fbc2abe9c91..2553caf4f74a 100644 +--- a/kernel/bpf/stackmap.c ++++ b/kernel/bpf/stackmap.c +@@ -63,7 +63,8 @@ static inline int stack_map_data_size(struct bpf_map *map) + + static int prealloc_elems_and_freelist(struct bpf_stack_map *smap) + { +- u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size; ++ u64 elem_size = sizeof(struct stack_map_bucket) + ++ (u64)smap->map.value_size; + int err; + + smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries, +-- +2.33.0 + diff --git a/queue-5.14/bus-ti-sysc-add-break-in-switch-statement-in-sysc_in.patch b/queue-5.14/bus-ti-sysc-add-break-in-switch-statement-in-sysc_in.patch new file mode 100644 index 00000000000..cbe57a55045 --- /dev/null +++ b/queue-5.14/bus-ti-sysc-add-break-in-switch-statement-in-sysc_in.patch @@ -0,0 +1,51 @@ +From c8b166543b01cff8be9ea1f158d2ead0f66a7ed4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Aug 2021 12:18:52 -0700 +Subject: bus: ti-sysc: Add break in switch statement in sysc_init_soc() + +From: Nathan Chancellor + +[ Upstream commit e879f855e590b40fe3c79f2fbd8f65ca3c724120 ] + +After commit a6d90e9f2232 ("bus: ti-sysc: AM3: RNG is GP only"), clang +with -Wimplicit-fallthrough enabled warns: + +drivers/bus/ti-sysc.c:2958:3: warning: unannotated fall-through between +switch labels [-Wimplicit-fallthrough] + default: + ^ +drivers/bus/ti-sysc.c:2958:3: note: insert 'break;' to avoid +fall-through + default: + ^ + break; +1 warning generated. + +Clang's version of this warning is a little bit more pedantic than +GCC's. Add the missing break to satisfy it to match what has been done +all over the kernel tree. + +Fixes: a6d90e9f2232 ("bus: ti-sysc: AM3: RNG is GP only") +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 148a4dd8cb9a..10fcb75df68a 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -2955,6 +2955,7 @@ static int sysc_init_soc(struct sysc *ddata) + break; + case SOC_AM3: + sysc_add_disabled(0x48310000); /* rng */ ++ break; + default: + break; + } +-- +2.33.0 + diff --git a/queue-5.14/bus-ti-sysc-use-clkdm_noauto-for-dra7-dcan1-for-erra.patch b/queue-5.14/bus-ti-sysc-use-clkdm_noauto-for-dra7-dcan1-for-erra.patch new file mode 100644 index 00000000000..ccf94b6df35 --- /dev/null +++ b/queue-5.14/bus-ti-sysc-use-clkdm_noauto-for-dra7-dcan1-for-erra.patch @@ -0,0 +1,55 @@ +From d60530f52224117017bbb454357638dc65e27830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Sep 2021 08:49:36 +0300 +Subject: bus: ti-sysc: Use CLKDM_NOAUTO for dra7 dcan1 for errata i893 + +From: Tony Lindgren + +[ Upstream commit b13a270ace2e4c70653aa1d1d0394c553905802f ] + +Commit 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for +CLKDM_NOAUTO") should have also added the quirk for dra7 dcan1 in +addition to dcan2 for errata i893 handling. + +Let's also pass the quirk flag for legacy mode booting for if "ti,hwmods" +dts property is used with related dcan hwmod data. This should be only +needed if anybody needs to git bisect earlier stable trees though. + +Fixes: 94f6345712b3 ("bus: ti-sysc: Implement quirk handling for CLKDM_NOAUTO") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap_hwmod.c | 2 ++ + drivers/bus/ti-sysc.c | 3 +++ + 2 files changed, 5 insertions(+) + +diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c +index 12b26e04686f..0c2936c7a379 100644 +--- a/arch/arm/mach-omap2/omap_hwmod.c ++++ b/arch/arm/mach-omap2/omap_hwmod.c +@@ -3614,6 +3614,8 @@ int omap_hwmod_init_module(struct device *dev, + oh->flags |= HWMOD_SWSUP_SIDLE_ACT; + if (data->cfg->quirks & SYSC_QUIRK_SWSUP_MSTANDBY) + oh->flags |= HWMOD_SWSUP_MSTANDBY; ++ if (data->cfg->quirks & SYSC_QUIRK_CLKDM_NOAUTO) ++ oh->flags |= HWMOD_CLKDM_NOAUTO; + + error = omap_hwmod_check_module(dev, oh, data, sysc_fields, + rev_offs, sysc_offs, syss_offs, +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 10fcb75df68a..418ada474a85 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -1468,6 +1468,9 @@ static const struct sysc_revision_quirk sysc_revision_quirks[] = { + /* Quirks that need to be set based on detected module */ + SYSC_QUIRK("aess", 0, 0, 0x10, -ENODEV, 0x40000000, 0xffffffff, + SYSC_MODULE_QUIRK_AESS), ++ /* Errata i893 handling for dra7 dcan1 and 2 */ ++ SYSC_QUIRK("dcan", 0x4ae3c000, 0x20, -ENODEV, -ENODEV, 0xa3170504, 0xffffffff, ++ SYSC_QUIRK_CLKDM_NOAUTO), + SYSC_QUIRK("dcan", 0x48480000, 0x20, -ENODEV, -ENODEV, 0xa3170504, 0xffffffff, + SYSC_QUIRK_CLKDM_NOAUTO), + SYSC_QUIRK("dss", 0x4832a000, 0, 0x10, 0x14, 0x00000020, 0xffffffff, +-- +2.33.0 + diff --git a/queue-5.14/drm-amdgpu-handle-the-case-of-pci_channel_io_frozen-.patch b/queue-5.14/drm-amdgpu-handle-the-case-of-pci_channel_io_frozen-.patch new file mode 100644 index 00000000000..5ed6d2399b3 --- /dev/null +++ b/queue-5.14/drm-amdgpu-handle-the-case-of-pci_channel_io_frozen-.patch @@ -0,0 +1,72 @@ +From 136be2316eaac907a905eaa428f5571e61a638ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Oct 2021 09:48:50 +0800 +Subject: drm/amdgpu: handle the case of pci_channel_io_frozen only in + amdgpu_pci_resume + +From: Guchun Chen + +[ Upstream commit 248b061689a40f4fed05252ee2c89f87cf26d7d8 ] + +In current code, when a PCI error state pci_channel_io_normal is detectd, +it will report PCI_ERS_RESULT_CAN_RECOVER status to PCI driver, and PCI +driver will continue the execution of PCI resume callback report_resume by +pci_walk_bridge, and the callback will go into amdgpu_pci_resume +finally, where write lock is releasd unconditionally without acquiring +such lock first. In this case, a deadlock will happen when other threads +start to acquire the read lock. + +To fix this, add a member in amdgpu_device strucutre to cache +pci_channel_state, and only continue the execution in amdgpu_pci_resume +when it's pci_channel_io_frozen. + +Fixes: c9a6b82f45e2 ("drm/amdgpu: Implement DPC recovery") +Suggested-by: Andrey Grodzovsky +Signed-off-by: Guchun Chen +Reviewed-by: Andrey Grodzovsky +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 1 + + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++++++ + 2 files changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index 177a663a6a69..a1c5bd2859fc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -1082,6 +1082,7 @@ struct amdgpu_device { + + bool no_hw_access; + struct pci_saved_state *pci_state; ++ pci_channel_state_t pci_channel_state; + + struct amdgpu_reset_control *reset_cntl; + }; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index d3247a5cceb4..d60096b3b2c2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -5329,6 +5329,8 @@ pci_ers_result_t amdgpu_pci_error_detected(struct pci_dev *pdev, pci_channel_sta + return PCI_ERS_RESULT_DISCONNECT; + } + ++ adev->pci_channel_state = state; ++ + switch (state) { + case pci_channel_io_normal: + return PCI_ERS_RESULT_CAN_RECOVER; +@@ -5471,6 +5473,10 @@ void amdgpu_pci_resume(struct pci_dev *pdev) + + DRM_INFO("PCI error: resume callback!!\n"); + ++ /* Only continue execution for the case of pci_channel_io_frozen */ ++ if (adev->pci_channel_state != pci_channel_io_frozen) ++ return; ++ + for (i = 0; i < AMDGPU_MAX_RINGS; ++i) { + struct amdgpu_ring *ring = adev->rings[i]; + +-- +2.33.0 + diff --git a/queue-5.14/drm-amdkfd-fix-a-potential-ttm-sg-memory-leak.patch b/queue-5.14/drm-amdkfd-fix-a-potential-ttm-sg-memory-leak.patch new file mode 100644 index 00000000000..5739349e33d --- /dev/null +++ b/queue-5.14/drm-amdkfd-fix-a-potential-ttm-sg-memory-leak.patch @@ -0,0 +1,37 @@ +From a29aa2abe0d55114796bd425edca6dbc7d0b0abd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 14:54:39 +0800 +Subject: drm/amdkfd: fix a potential ttm->sg memory leak + +From: Lang Yu + +[ Upstream commit b072ef1215aca33186e3a10109e872e528a9e516 ] + +Memory is allocated for ttm->sg by kmalloc in kfd_mem_dmamap_userptr, +but isn't freed by kfree in kfd_mem_dmaunmap_userptr. Free it! + +Fixes: 264fb4d332f5 ("drm/amdgpu: Add multi-GPU DMA mapping helpers") + +Signed-off-by: Lang Yu +Reviewed-by: Felix Kuehling +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +index 4fb15750b9bb..b18c0697356c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +@@ -563,6 +563,7 @@ kfd_mem_dmaunmap_userptr(struct kgd_mem *mem, + + dma_unmap_sgtable(adev->dev, ttm->sg, direction, 0); + sg_free_table(ttm->sg); ++ kfree(ttm->sg); + ttm->sg = NULL; + } + +-- +2.33.0 + diff --git a/queue-5.14/drm-i915-audio-use-bios-provided-value-for-rkl-hda-l.patch b/queue-5.14/drm-i915-audio-use-bios-provided-value-for-rkl-hda-l.patch new file mode 100644 index 00000000000..80f69d1ec8d --- /dev/null +++ b/queue-5.14/drm-i915-audio-use-bios-provided-value-for-rkl-hda-l.patch @@ -0,0 +1,45 @@ +From 03934e9326857f56e8bb9fcad2e2fff569ded5a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 6 Sep 2021 12:12:59 +0800 +Subject: drm/i915/audio: Use BIOS provided value for RKL HDA link + +From: Kai-Heng Feng + +[ Upstream commit ffac30be2a06b2516b2ce2afa2dcb2cf8af65a52 ] + +Commit 989634fb49ad ("drm/i915/audio: set HDA link parameters in +driver") makes HDMI audio on Lenovo P350 disappear. + +So in addition to TGL, extend the logic to RKL to use BIOS provided +value to fix the regression. + +Fixes: 989634fb49ad ("drm/i915/audio: set HDA link parameters in driver") +Reviewed-by: Kai Vehmanen +Signed-off-by: Kai-Heng Feng +Link: https://patchwork.freedesktop.org/patch/msgid/20210906041300.508458-1-kai.heng.feng@canonical.com +(cherry picked from commit c6b40ee330fe09b332715bb7ec1467e4fcbe2e65) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_audio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_audio.c b/drivers/gpu/drm/i915/display/intel_audio.c +index 5f4f316b3ab5..4e4429535f9e 100644 +--- a/drivers/gpu/drm/i915/display/intel_audio.c ++++ b/drivers/gpu/drm/i915/display/intel_audio.c +@@ -1308,8 +1308,9 @@ static void i915_audio_component_init(struct drm_i915_private *dev_priv) + else + aud_freq = aud_freq_init; + +- /* use BIOS provided value for TGL unless it is a known bad value */ +- if (IS_TIGERLAKE(dev_priv) && aud_freq_init != AUD_FREQ_TGL_BROKEN) ++ /* use BIOS provided value for TGL and RKL unless it is a known bad value */ ++ if ((IS_TIGERLAKE(dev_priv) || IS_ROCKETLAKE(dev_priv)) && ++ aud_freq_init != AUD_FREQ_TGL_BROKEN) + aud_freq = aud_freq_init; + + drm_dbg_kms(&dev_priv->drm, "use AUD_FREQ_CNTRL of 0x%x (init value 0x%x)\n", +-- +2.33.0 + diff --git a/queue-5.14/drm-i915-bdb-fix-version-check.patch b/queue-5.14/drm-i915-bdb-fix-version-check.patch new file mode 100644 index 00000000000..103f40ecd89 --- /dev/null +++ b/queue-5.14/drm-i915-bdb-fix-version-check.patch @@ -0,0 +1,89 @@ +From 7a2e0f57d0c838de445fcfb66a2c356857c7cc2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 15:46:06 +0200 +Subject: drm/i915/bdb: Fix version check +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lukasz Majczak + +[ Upstream commit fdddf8c3a477f77b3a623f220e78d45e89fc50d5 ] + +With patch "drm/i915/vbt: Fix backlight parsing for VBT 234+" +the size of bdb_lfp_backlight_data structure has been increased, +causing if-statement in the parse_lfp_backlight function +that comapres this structure size to the one retrieved from BDB, +always to fail for older revisions. +This patch calculates expected size of the structure for a given +BDB version and compares it with the value gathered from BDB. +Tested on Chromebook Pixelbook (Nocturne) (reports bdb->version = 221) + +Fixes: d381baad29b4 ("drm/i915/vbt: Fix backlight parsing for VBT 234+") + +Tested-by: Lukasz Majczak +Signed-off-by: Lukasz Majczak +Reviewed-by: José Roberto de Souza +Signed-off-by: José Roberto de Souza +Link: https://patchwork.freedesktop.org/patch/msgid/20210930134606.227234-1-lma@semihalf.com +(cherry picked from commit 4378daf5d04eed59724e6d0e74755e17dce2e105) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/intel_bios.c | 22 ++++++++++++++----- + drivers/gpu/drm/i915/display/intel_vbt_defs.h | 5 +++++ + 2 files changed, 21 insertions(+), 6 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/intel_bios.c b/drivers/gpu/drm/i915/display/intel_bios.c +index aa667fa71158..106f696e50a0 100644 +--- a/drivers/gpu/drm/i915/display/intel_bios.c ++++ b/drivers/gpu/drm/i915/display/intel_bios.c +@@ -451,13 +451,23 @@ parse_lfp_backlight(struct drm_i915_private *i915, + } + + i915->vbt.backlight.type = INTEL_BACKLIGHT_DISPLAY_DDI; +- if (bdb->version >= 191 && +- get_blocksize(backlight_data) >= sizeof(*backlight_data)) { +- const struct lfp_backlight_control_method *method; ++ if (bdb->version >= 191) { ++ size_t exp_size; + +- method = &backlight_data->backlight_control[panel_type]; +- i915->vbt.backlight.type = method->type; +- i915->vbt.backlight.controller = method->controller; ++ if (bdb->version >= 236) ++ exp_size = sizeof(struct bdb_lfp_backlight_data); ++ else if (bdb->version >= 234) ++ exp_size = EXP_BDB_LFP_BL_DATA_SIZE_REV_234; ++ else ++ exp_size = EXP_BDB_LFP_BL_DATA_SIZE_REV_191; ++ ++ if (get_blocksize(backlight_data) >= exp_size) { ++ const struct lfp_backlight_control_method *method; ++ ++ method = &backlight_data->backlight_control[panel_type]; ++ i915->vbt.backlight.type = method->type; ++ i915->vbt.backlight.controller = method->controller; ++ } + } + + i915->vbt.backlight.pwm_freq_hz = entry->pwm_freq_hz; +diff --git a/drivers/gpu/drm/i915/display/intel_vbt_defs.h b/drivers/gpu/drm/i915/display/intel_vbt_defs.h +index dbe24d7e7375..cf1ffe4a0e46 100644 +--- a/drivers/gpu/drm/i915/display/intel_vbt_defs.h ++++ b/drivers/gpu/drm/i915/display/intel_vbt_defs.h +@@ -814,6 +814,11 @@ struct lfp_brightness_level { + u16 reserved; + } __packed; + ++#define EXP_BDB_LFP_BL_DATA_SIZE_REV_191 \ ++ offsetof(struct bdb_lfp_backlight_data, brightness_level) ++#define EXP_BDB_LFP_BL_DATA_SIZE_REV_234 \ ++ offsetof(struct bdb_lfp_backlight_data, brightness_precision_bits) ++ + struct bdb_lfp_backlight_data { + u8 entry_size; + struct lfp_backlight_data_entry data[16]; +-- +2.33.0 + diff --git a/queue-5.14/drm-i915-jsl-add-w-a-1409054076-for-jsl.patch b/queue-5.14/drm-i915-jsl-add-w-a-1409054076-for-jsl.patch new file mode 100644 index 00000000000..e82926d8c17 --- /dev/null +++ b/queue-5.14/drm-i915-jsl-add-w-a-1409054076-for-jsl.patch @@ -0,0 +1,146 @@ +From 2b581b5455a78af3efb21e1850e0e069cf4c3818 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 16:26:13 +0530 +Subject: drm/i915/jsl: Add W/A 1409054076 for JSL + +From: Tejas Upadhyay + +[ Upstream commit 544021e3f2aa3c4c6c5aabc58907e8bab69b3762 ] + +When pipe A is disabled and MIPI DSI is enabled on pipe B, +the AMT KVMR feature will incorrectly see pipe A as enabled. +Set 0x42080 bit 23=1 before enabling DSI on pipe B and leave +it set while DSI is enabled on pipe B. No impact to setting +it all the time. + +Changes since V5: + - Added reviewed-by + - Removed redundant braces and debug message format - Imre +Changes since V4: + - Modified function comment Wa_:icl,jsl,ehl - Lucas + - Modified debug message in sync state - Imre +Changes since V3: + - More meaningful name to workaround - Imre + - Remove boolean check clear flag + - Add WA_verify hook in dsi sync_state +Changes since V2: + - Used REG_BIT, ignored pipe A and used sw state check - Jani + - Made function wrapper - Jani +Changes since V1: + - ./dim checkpatch errors addressed + +Signed-off-by: Tejas Upadhyay +Reviewed-by: Imre Deak +Signed-off-by: Maarten Lankhorst +Link: https://patchwork.freedesktop.org/patch/msgid/20210615105613.851491-1-tejaskumarx.surendrakumar.upadhyay@intel.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/icl_dsi.c | 42 ++++++++++++++++++++++++++ + drivers/gpu/drm/i915/i915_reg.h | 1 + + 2 files changed, 43 insertions(+) + +diff --git a/drivers/gpu/drm/i915/display/icl_dsi.c b/drivers/gpu/drm/i915/display/icl_dsi.c +index 16812488c5dd..970ba9e7f84e 100644 +--- a/drivers/gpu/drm/i915/display/icl_dsi.c ++++ b/drivers/gpu/drm/i915/display/icl_dsi.c +@@ -1253,15 +1253,36 @@ static void gen11_dsi_pre_enable(struct intel_atomic_state *state, + gen11_dsi_set_transcoder_timings(encoder, pipe_config); + } + ++/* ++ * Wa_1409054076:icl,jsl,ehl ++ * When pipe A is disabled and MIPI DSI is enabled on pipe B, ++ * the AMT KVMR feature will incorrectly see pipe A as enabled. ++ * Set 0x42080 bit 23=1 before enabling DSI on pipe B and leave ++ * it set while DSI is enabled on pipe B ++ */ ++static void icl_apply_kvmr_pipe_a_wa(struct intel_encoder *encoder, ++ enum pipe pipe, bool enable) ++{ ++ struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); ++ ++ if (DISPLAY_VER(dev_priv) == 11 && pipe == PIPE_B) ++ intel_de_rmw(dev_priv, CHICKEN_PAR1_1, ++ IGNORE_KVMR_PIPE_A, ++ enable ? IGNORE_KVMR_PIPE_A : 0); ++} + static void gen11_dsi_enable(struct intel_atomic_state *state, + struct intel_encoder *encoder, + const struct intel_crtc_state *crtc_state, + const struct drm_connector_state *conn_state) + { + struct intel_dsi *intel_dsi = enc_to_intel_dsi(encoder); ++ struct intel_crtc *crtc = to_intel_crtc(conn_state->crtc); + + drm_WARN_ON(state->base.dev, crtc_state->has_pch_encoder); + ++ /* Wa_1409054076:icl,jsl,ehl */ ++ icl_apply_kvmr_pipe_a_wa(encoder, crtc->pipe, true); ++ + /* step6d: enable dsi transcoder */ + gen11_dsi_enable_transcoder(encoder); + +@@ -1415,6 +1436,7 @@ static void gen11_dsi_disable(struct intel_atomic_state *state, + const struct drm_connector_state *old_conn_state) + { + struct intel_dsi *intel_dsi = enc_to_intel_dsi(encoder); ++ struct intel_crtc *crtc = to_intel_crtc(old_conn_state->crtc); + + /* step1: turn off backlight */ + intel_dsi_vbt_exec_sequence(intel_dsi, MIPI_SEQ_BACKLIGHT_OFF); +@@ -1423,6 +1445,9 @@ static void gen11_dsi_disable(struct intel_atomic_state *state, + /* step2d,e: disable transcoder and wait */ + gen11_dsi_disable_transcoder(encoder); + ++ /* Wa_1409054076:icl,jsl,ehl */ ++ icl_apply_kvmr_pipe_a_wa(encoder, crtc->pipe, false); ++ + /* step2f,g: powerdown panel */ + gen11_dsi_powerdown_panel(encoder); + +@@ -1548,6 +1573,22 @@ static void gen11_dsi_get_config(struct intel_encoder *encoder, + pipe_config->mode_flags |= I915_MODE_FLAG_DSI_PERIODIC_CMD_MODE; + } + ++static void gen11_dsi_sync_state(struct intel_encoder *encoder, ++ const struct intel_crtc_state *crtc_state) ++{ ++ struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); ++ struct intel_crtc *intel_crtc = to_intel_crtc(crtc_state->uapi.crtc); ++ enum pipe pipe = intel_crtc->pipe; ++ ++ /* wa verify 1409054076:icl,jsl,ehl */ ++ if (DISPLAY_VER(dev_priv) == 11 && pipe == PIPE_B && ++ !(intel_de_read(dev_priv, CHICKEN_PAR1_1) & IGNORE_KVMR_PIPE_A)) ++ drm_dbg_kms(&dev_priv->drm, ++ "[ENCODER:%d:%s] BIOS left IGNORE_KVMR_PIPE_A cleared with pipe B enabled\n", ++ encoder->base.base.id, ++ encoder->base.name); ++} ++ + static int gen11_dsi_dsc_compute_config(struct intel_encoder *encoder, + struct intel_crtc_state *crtc_state) + { +@@ -1966,6 +2007,7 @@ void icl_dsi_init(struct drm_i915_private *dev_priv) + encoder->post_disable = gen11_dsi_post_disable; + encoder->port = port; + encoder->get_config = gen11_dsi_get_config; ++ encoder->sync_state = gen11_dsi_sync_state; + encoder->update_pipe = intel_panel_update_backlight; + encoder->compute_config = gen11_dsi_compute_config; + encoder->get_hw_state = gen11_dsi_get_hw_state; +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 7dc58ad08fbb..5aa5ddefd22d 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -8113,6 +8113,7 @@ enum { + # define CHICKEN3_DGMG_DONE_FIX_DISABLE (1 << 2) + + #define CHICKEN_PAR1_1 _MMIO(0x42080) ++#define IGNORE_KVMR_PIPE_A REG_BIT(23) + #define KBL_ARB_FILL_SPARE_22 REG_BIT(22) + #define DIS_RAM_BYPASS_PSR2_MAN_TRACK (1 << 16) + #define SKL_DE_COMPRESSED_HASH_MODE (1 << 15) +-- +2.33.0 + diff --git a/queue-5.14/drm-i915-tc-fix-typec-port-init-resume-time-sanitiza.patch b/queue-5.14/drm-i915-tc-fix-typec-port-init-resume-time-sanitiza.patch new file mode 100644 index 00000000000..6a7e8e7e5bf --- /dev/null +++ b/queue-5.14/drm-i915-tc-fix-typec-port-init-resume-time-sanitiza.patch @@ -0,0 +1,130 @@ +From eb46f0ccfefc15c055e25c2c510ed480638171f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 16:28:27 +0300 +Subject: drm/i915/tc: Fix TypeC port init/resume time sanitization +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Imre Deak + +[ Upstream commit a532cde31de3cae6ed60e60d6f9379771f652809 ] + +Atm during driver loading and system resume TypeC ports are accessed +before their HW/SW state is synced. Move the TypeC port sanitization to +the encoder's sync_state hook to fix this. + +v2: Handle the encoder disabled case in gen11_dsi_sync_state() as well + (Jose, Jani) + +Fixes: f9e76a6e68d3 ("drm/i915: Add an encoder hook to sanitize its state during init/resume") +Cc: José Roberto de Souza +Cc: Ville Syrjälä +Signed-off-by: Imre Deak +Reviewed-by: José Roberto de Souza +Link: https://patchwork.freedesktop.org/patch/msgid/20210929132833.2253961-1-imre.deak@intel.com +(cherry picked from commit 7194dc998dfffca096c30b3cd39625158608992d) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/display/icl_dsi.c | 10 ++++++++-- + drivers/gpu/drm/i915/display/intel_ddi.c | 8 +++++++- + drivers/gpu/drm/i915/display/intel_display.c | 20 +++++--------------- + 3 files changed, 20 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/i915/display/icl_dsi.c b/drivers/gpu/drm/i915/display/icl_dsi.c +index 970ba9e7f84e..13bafa9d49c0 100644 +--- a/drivers/gpu/drm/i915/display/icl_dsi.c ++++ b/drivers/gpu/drm/i915/display/icl_dsi.c +@@ -1577,8 +1577,14 @@ static void gen11_dsi_sync_state(struct intel_encoder *encoder, + const struct intel_crtc_state *crtc_state) + { + struct drm_i915_private *dev_priv = to_i915(encoder->base.dev); +- struct intel_crtc *intel_crtc = to_intel_crtc(crtc_state->uapi.crtc); +- enum pipe pipe = intel_crtc->pipe; ++ struct intel_crtc *intel_crtc; ++ enum pipe pipe; ++ ++ if (!crtc_state) ++ return; ++ ++ intel_crtc = to_intel_crtc(crtc_state->uapi.crtc); ++ pipe = intel_crtc->pipe; + + /* wa verify 1409054076:icl,jsl,ehl */ + if (DISPLAY_VER(dev_priv) == 11 && pipe == PIPE_B && +diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c +index 00dade49665b..89a109f65f38 100644 +--- a/drivers/gpu/drm/i915/display/intel_ddi.c ++++ b/drivers/gpu/drm/i915/display/intel_ddi.c +@@ -3899,7 +3899,13 @@ void hsw_ddi_get_config(struct intel_encoder *encoder, + static void intel_ddi_sync_state(struct intel_encoder *encoder, + const struct intel_crtc_state *crtc_state) + { +- if (intel_crtc_has_dp_encoder(crtc_state)) ++ struct drm_i915_private *i915 = to_i915(encoder->base.dev); ++ enum phy phy = intel_port_to_phy(i915, encoder->port); ++ ++ if (intel_phy_is_tc(i915, phy)) ++ intel_tc_port_sanitize(enc_to_dig_port(encoder)); ++ ++ if (crtc_state && intel_crtc_has_dp_encoder(crtc_state)) + intel_dp_sync_state(encoder, crtc_state); + } + +diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c +index 0a8a2395c8ac..bb1d2b19be15 100644 +--- a/drivers/gpu/drm/i915/display/intel_display.c ++++ b/drivers/gpu/drm/i915/display/intel_display.c +@@ -12933,18 +12933,16 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev) + readout_plane_state(dev_priv); + + for_each_intel_encoder(dev, encoder) { ++ struct intel_crtc_state *crtc_state = NULL; ++ + pipe = 0; + + if (encoder->get_hw_state(encoder, &pipe)) { +- struct intel_crtc_state *crtc_state; +- + crtc = intel_get_crtc_for_pipe(dev_priv, pipe); + crtc_state = to_intel_crtc_state(crtc->base.state); + + encoder->base.crtc = &crtc->base; + intel_encoder_get_config(encoder, crtc_state); +- if (encoder->sync_state) +- encoder->sync_state(encoder, crtc_state); + + /* read out to slave crtc as well for bigjoiner */ + if (crtc_state->bigjoiner) { +@@ -12959,6 +12957,9 @@ static void intel_modeset_readout_hw_state(struct drm_device *dev) + encoder->base.crtc = NULL; + } + ++ if (encoder->sync_state) ++ encoder->sync_state(encoder, crtc_state); ++ + drm_dbg_kms(&dev_priv->drm, + "[ENCODER:%d:%s] hw state readout: %s, pipe %c\n", + encoder->base.base.id, encoder->base.name, +@@ -13241,17 +13242,6 @@ intel_modeset_setup_hw_state(struct drm_device *dev, + intel_modeset_readout_hw_state(dev); + + /* HW state is read out, now we need to sanitize this mess. */ +- +- /* Sanitize the TypeC port mode upfront, encoders depend on this */ +- for_each_intel_encoder(dev, encoder) { +- enum phy phy = intel_port_to_phy(dev_priv, encoder->port); +- +- /* We need to sanitize only the MST primary port. */ +- if (encoder->type != INTEL_OUTPUT_DP_MST && +- intel_phy_is_tc(dev_priv, phy)) +- intel_tc_port_sanitize(enc_to_dig_port(encoder)); +- } +- + get_encoder_power_domains(dev_priv); + + if (HAS_PCH_IBX(dev_priv)) +-- +2.33.0 + diff --git a/queue-5.14/drm-nouveau-avoid-a-use-after-free-when-bo-init-fail.patch b/queue-5.14/drm-nouveau-avoid-a-use-after-free-when-bo-init-fail.patch new file mode 100644 index 00000000000..06168831258 --- /dev/null +++ b/queue-5.14/drm-nouveau-avoid-a-use-after-free-when-bo-init-fail.patch @@ -0,0 +1,48 @@ +From 4a99f68611bf5daa63ff1b7a551860c022185d37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 19:02:20 -0500 +Subject: drm/nouveau: avoid a use-after-free when BO init fails + +From: Jeremy Cline + +[ Upstream commit bcf34aa5082ee2343574bc3f4d1c126030913e54 ] + +nouveau_bo_init() is backed by ttm_bo_init() and ferries its return code +back to the caller. On failures, ttm_bo_init() invokes the provided +destructor which should de-initialize and free the memory. + +Thus, when nouveau_bo_init() returns an error the gem object has already +been released and the memory freed by nouveau_bo_del_ttm(). + +Fixes: 019cbd4a4feb ("drm/nouveau: Initialize GEM object before TTM object") +Cc: Thierry Reding +Signed-off-by: Jeremy Cline +Reviewed-by: Lyude Paul +Reviewed-by: Karol Herbst +Signed-off-by: Karol Herbst +Link: https://patchwork.freedesktop.org/patch/msgid/20201203000220.18238-1-jcline@redhat.com +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_gem.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c +index 5b27845075a1..8c2ecc282723 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_gem.c ++++ b/drivers/gpu/drm/nouveau/nouveau_gem.c +@@ -247,10 +247,8 @@ nouveau_gem_new(struct nouveau_cli *cli, u64 size, int align, uint32_t domain, + } + + ret = nouveau_bo_init(nvbo, size, align, domain, NULL, NULL); +- if (ret) { +- nouveau_bo_ref(NULL, &nvbo); ++ if (ret) + return ret; +- } + + /* we restrict allowed domains on nv50+ to only the types + * that were requested at creation time. not possibly on +-- +2.33.0 + diff --git a/queue-5.14/drm-nouveau-debugfs-fix-file-release-memory-leak.patch b/queue-5.14/drm-nouveau-debugfs-fix-file-release-memory-leak.patch new file mode 100644 index 00000000000..d15e42b303c --- /dev/null +++ b/queue-5.14/drm-nouveau-debugfs-fix-file-release-memory-leak.patch @@ -0,0 +1,39 @@ +From 76b2356e0fb5746460a97e7e9aec5306faebe7d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Sep 2021 15:50:23 +0800 +Subject: drm/nouveau/debugfs: fix file release memory leak + +From: Yang Yingliang + +[ Upstream commit f5a8703a9c418c6fc54eb772712dfe7641e3991c ] + +When using single_open() for opening, single_release() should be +called, otherwise the 'op' allocated in single_open() will be leaked. + +Fixes: 6e9fc177399f ("drm/nouveau/debugfs: add copy of sysfs pstate interface ported to debugfs") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Reviewed-by: Karol Herbst +Signed-off-by: Karol Herbst +Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-2-yangyingliang@huawei.com +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nouveau_debugfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +index c2bc05eb2e54..1cbe01048b93 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c ++++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c +@@ -207,6 +207,7 @@ static const struct file_operations nouveau_pstate_fops = { + .open = nouveau_debugfs_pstate_open, + .read = seq_read, + .write = nouveau_debugfs_pstate_set, ++ .release = single_release, + }; + + static struct drm_info_list nouveau_debugfs_list[] = { +-- +2.33.0 + diff --git a/queue-5.14/drm-nouveau-fifo-ga102-initialise-chid-on-return-fro.patch b/queue-5.14/drm-nouveau-fifo-ga102-initialise-chid-on-return-fro.patch new file mode 100644 index 00000000000..3c9f6345930 --- /dev/null +++ b/queue-5.14/drm-nouveau-fifo-ga102-initialise-chid-on-return-fro.patch @@ -0,0 +1,41 @@ +From 38a8a0c8d9ba29ed773a86dafaa2a37934d4bc5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 19:07:35 +1000 +Subject: drm/nouveau/fifo/ga102: initialise chid on return from channel + creation + +From: Ben Skeggs + +[ Upstream commit 0689ea432a85ad1a108f47c3d90b6feae322c7f9 ] + +Turns out caller isn't zero-initialised after-all. + +Fixes: 49b2dfc08182 ("drm/nouveau/ga102-: support ttm buffer moves via copy engine") +Reported-by: Karol Herbst +Signed-off-by: Ben Skeggs +Reviewed-by: Karol Herbst +Signed-off-by: Karol Herbst +Link: https://patchwork.freedesktop.org/patch/msgid/20210921090735.247236-1-skeggsb@gmail.com +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c +index f897bef13acf..c630dbd2911a 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/ga102.c +@@ -179,6 +179,9 @@ ga102_chan_new(struct nvkm_device *device, + return -ENODEV; + + chan->ctrl.chan = nvkm_rd32(device, chan->ctrl.runl + 0x004) & 0xfffffff0; ++ ++ args->chid = 0; ++ args->inst = 0; + args->token = nvkm_rd32(device, chan->ctrl.runl + 0x008) & 0xffff0000; + + ret = nvkm_memory_new(device, NVKM_MEM_TARGET_INST, 0x1000, 0x1000, true, &chan->mthd); +-- +2.33.0 + diff --git a/queue-5.14/drm-nouveau-kms-nv50-fix-file-release-memory-leak.patch b/queue-5.14/drm-nouveau-kms-nv50-fix-file-release-memory-leak.patch new file mode 100644 index 00000000000..1b70eda1e33 --- /dev/null +++ b/queue-5.14/drm-nouveau-kms-nv50-fix-file-release-memory-leak.patch @@ -0,0 +1,39 @@ +From a268ea5e96b77e65de4382a6b23a6f0257e4ac70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 11 Sep 2021 15:50:22 +0800 +Subject: drm/nouveau/kms/nv50-: fix file release memory leak + +From: Yang Yingliang + +[ Upstream commit 0b3d4945cc7e7ea1acd52cb06dfa83bfe265b6d5 ] + +When using single_open() for opening, single_release() should be +called, otherwise the 'op' allocated in single_open() will be leaked. + +Fixes: 12885ecbfe62 ("drm/nouveau/kms/nvd9-: Add CRC support") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Reviewed-by: Karol Herbst +Signed-off-by: Karol Herbst +Link: https://patchwork.freedesktop.org/patch/msgid/20210911075023.3969054-1-yangyingliang@huawei.com +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/dispnv50/crc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/nouveau/dispnv50/crc.c b/drivers/gpu/drm/nouveau/dispnv50/crc.c +index b8c31b697797..66f32d965c72 100644 +--- a/drivers/gpu/drm/nouveau/dispnv50/crc.c ++++ b/drivers/gpu/drm/nouveau/dispnv50/crc.c +@@ -704,6 +704,7 @@ static const struct file_operations nv50_crc_flip_threshold_fops = { + .open = nv50_crc_debugfs_flip_threshold_open, + .read = seq_read, + .write = nv50_crc_debugfs_flip_threshold_set, ++ .release = single_release, + }; + + int nv50_head_crc_late_register(struct nv50_head *head) +-- +2.33.0 + diff --git a/queue-5.14/drm-panel-abt-y030xx067a-yellow-tint-fix.patch b/queue-5.14/drm-panel-abt-y030xx067a-yellow-tint-fix.patch new file mode 100644 index 00000000000..22810a00a49 --- /dev/null +++ b/queue-5.14/drm-panel-abt-y030xx067a-yellow-tint-fix.patch @@ -0,0 +1,41 @@ +From 81016d6a6a3d57352e552978c216e7cdbb5963db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Sep 2021 11:27:16 +0200 +Subject: drm/panel: abt-y030xx067a: yellow tint fix + +From: Christophe Branchereau + +[ Upstream commit 413e8d06ad896dae9bbc6f97b0abea5eae5495f1 ] + +The previous parameters caused an unbalanced yellow tint. + +Fixes: 7467389bdafb ("drm/panel: Add ABT Y030XX067A 3.0" 320x480 panel") +Signed-off-by: Christophe Branchereau +Acked-by: Sam Ravnborg +[Paul: Add Fixes: tag, and fix case and punctuation in commit message] +Signed-off-by: Paul Cercueil +Link: https://patchwork.freedesktop.org/patch/msgid/20210914092716.2370039-1-cbranchereau@gmail.com +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-abt-y030xx067a.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/panel/panel-abt-y030xx067a.c b/drivers/gpu/drm/panel/panel-abt-y030xx067a.c +index 2d8794d495d0..3d8a9ab47cae 100644 +--- a/drivers/gpu/drm/panel/panel-abt-y030xx067a.c ++++ b/drivers/gpu/drm/panel/panel-abt-y030xx067a.c +@@ -146,8 +146,8 @@ static const struct reg_sequence y030xx067a_init_sequence[] = { + { 0x09, REG09_SUB_BRIGHT_R(0x20) }, + { 0x0a, REG0A_SUB_BRIGHT_B(0x20) }, + { 0x0b, REG0B_HD_FREERUN | REG0B_VD_FREERUN }, +- { 0x0c, REG0C_CONTRAST_R(0x10) }, +- { 0x0d, REG0D_CONTRAST_G(0x10) }, ++ { 0x0c, REG0C_CONTRAST_R(0x00) }, ++ { 0x0d, REG0D_CONTRAST_G(0x00) }, + { 0x0e, REG0E_CONTRAST_B(0x10) }, + { 0x0f, 0 }, + { 0x10, REG10_BRIGHT(0x7f) }, +-- +2.33.0 + diff --git a/queue-5.14/drm-sun4i-dw-hdmi-fix-hdmi-phy-clock-setup.patch b/queue-5.14/drm-sun4i-dw-hdmi-fix-hdmi-phy-clock-setup.patch new file mode 100644 index 00000000000..4544ff1df3f --- /dev/null +++ b/queue-5.14/drm-sun4i-dw-hdmi-fix-hdmi-phy-clock-setup.patch @@ -0,0 +1,223 @@ +From 995253cf3d4766d050fe3f974517f75b483065d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 19:58:36 +0200 +Subject: drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup + +From: Jernej Skrabec + +[ Upstream commit c64c8e04a12ed3e2238761e26cda78e72550dc98 ] + +Recent rework, which made HDMI PHY driver a platform device, inadvertely +reversed clock setup order. HW is very touchy about it. Proper way is to +handle controllers resets and clocks first and HDMI PHYs second. + +Currently, without this fix, first mode set completely fails (nothing on +HDMI monitor) on H3 era PHYs. On H6, it still somehow work. + +Move HDMI PHY reset & clocks handling to sun8i_hdmi_phy_init() which +will assure that code is executed after controllers reset & clocks are +handled. Additionally, add sun8i_hdmi_phy_deinit() which will deinit +them at controllers driver unload. + +Tested on A64, H3, H6 and R40. + +Fixes: 9bf3797796f5 ("drm/sun4i: dw-hdmi: Make HDMI PHY into a platform device") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210915175836.3158839-1-jernej.skrabec@gmail.com +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c | 7 +- + drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h | 4 +- + drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c | 97 ++++++++++++++------------ + 3 files changed, 61 insertions(+), 47 deletions(-) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +index f75fb157f2ff..016b877051da 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c ++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.c +@@ -216,11 +216,13 @@ static int sun8i_dw_hdmi_bind(struct device *dev, struct device *master, + goto err_disable_clk_tmds; + } + ++ ret = sun8i_hdmi_phy_init(hdmi->phy); ++ if (ret) ++ goto err_disable_clk_tmds; ++ + drm_encoder_helper_add(encoder, &sun8i_dw_hdmi_encoder_helper_funcs); + drm_simple_encoder_init(drm, encoder, DRM_MODE_ENCODER_TMDS); + +- sun8i_hdmi_phy_init(hdmi->phy); +- + plat_data->mode_valid = hdmi->quirks->mode_valid; + plat_data->use_drm_infoframe = hdmi->quirks->use_drm_infoframe; + sun8i_hdmi_phy_set_ops(hdmi->phy, plat_data); +@@ -262,6 +264,7 @@ static void sun8i_dw_hdmi_unbind(struct device *dev, struct device *master, + struct sun8i_dw_hdmi *hdmi = dev_get_drvdata(dev); + + dw_hdmi_unbind(hdmi->hdmi); ++ sun8i_hdmi_phy_deinit(hdmi->phy); + clk_disable_unprepare(hdmi->clk_tmds); + reset_control_assert(hdmi->rst_ctrl); + gpiod_set_value(hdmi->ddc_en, 0); +diff --git a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h +index 74f6ed0e2570..bffe1b9cd3dc 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h ++++ b/drivers/gpu/drm/sun4i/sun8i_dw_hdmi.h +@@ -169,6 +169,7 @@ struct sun8i_hdmi_phy { + struct clk *clk_phy; + struct clk *clk_pll0; + struct clk *clk_pll1; ++ struct device *dev; + unsigned int rcal; + struct regmap *regs; + struct reset_control *rst_phy; +@@ -205,7 +206,8 @@ encoder_to_sun8i_dw_hdmi(struct drm_encoder *encoder) + + int sun8i_hdmi_phy_get(struct sun8i_dw_hdmi *hdmi, struct device_node *node); + +-void sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy); ++int sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy); ++void sun8i_hdmi_phy_deinit(struct sun8i_hdmi_phy *phy); + void sun8i_hdmi_phy_set_ops(struct sun8i_hdmi_phy *phy, + struct dw_hdmi_plat_data *plat_data); + +diff --git a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c +index c9239708d398..b64d93da651d 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c ++++ b/drivers/gpu/drm/sun4i/sun8i_hdmi_phy.c +@@ -506,9 +506,60 @@ static void sun8i_hdmi_phy_init_h3(struct sun8i_hdmi_phy *phy) + phy->rcal = (val & SUN8I_HDMI_PHY_ANA_STS_RCAL_MASK) >> 2; + } + +-void sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy) ++int sun8i_hdmi_phy_init(struct sun8i_hdmi_phy *phy) + { ++ int ret; ++ ++ ret = reset_control_deassert(phy->rst_phy); ++ if (ret) { ++ dev_err(phy->dev, "Cannot deassert phy reset control: %d\n", ret); ++ return ret; ++ } ++ ++ ret = clk_prepare_enable(phy->clk_bus); ++ if (ret) { ++ dev_err(phy->dev, "Cannot enable bus clock: %d\n", ret); ++ goto err_assert_rst_phy; ++ } ++ ++ ret = clk_prepare_enable(phy->clk_mod); ++ if (ret) { ++ dev_err(phy->dev, "Cannot enable mod clock: %d\n", ret); ++ goto err_disable_clk_bus; ++ } ++ ++ if (phy->variant->has_phy_clk) { ++ ret = sun8i_phy_clk_create(phy, phy->dev, ++ phy->variant->has_second_pll); ++ if (ret) { ++ dev_err(phy->dev, "Couldn't create the PHY clock\n"); ++ goto err_disable_clk_mod; ++ } ++ ++ clk_prepare_enable(phy->clk_phy); ++ } ++ + phy->variant->phy_init(phy); ++ ++ return 0; ++ ++err_disable_clk_mod: ++ clk_disable_unprepare(phy->clk_mod); ++err_disable_clk_bus: ++ clk_disable_unprepare(phy->clk_bus); ++err_assert_rst_phy: ++ reset_control_assert(phy->rst_phy); ++ ++ return ret; ++} ++ ++void sun8i_hdmi_phy_deinit(struct sun8i_hdmi_phy *phy) ++{ ++ clk_disable_unprepare(phy->clk_mod); ++ clk_disable_unprepare(phy->clk_bus); ++ clk_disable_unprepare(phy->clk_phy); ++ ++ reset_control_assert(phy->rst_phy); + } + + void sun8i_hdmi_phy_set_ops(struct sun8i_hdmi_phy *phy, +@@ -638,6 +689,7 @@ static int sun8i_hdmi_phy_probe(struct platform_device *pdev) + return -ENOMEM; + + phy->variant = (struct sun8i_hdmi_phy_variant *)match->data; ++ phy->dev = dev; + + ret = of_address_to_resource(node, 0, &res); + if (ret) { +@@ -696,47 +748,10 @@ static int sun8i_hdmi_phy_probe(struct platform_device *pdev) + goto err_put_clk_pll1; + } + +- ret = reset_control_deassert(phy->rst_phy); +- if (ret) { +- dev_err(dev, "Cannot deassert phy reset control: %d\n", ret); +- goto err_put_rst_phy; +- } +- +- ret = clk_prepare_enable(phy->clk_bus); +- if (ret) { +- dev_err(dev, "Cannot enable bus clock: %d\n", ret); +- goto err_deassert_rst_phy; +- } +- +- ret = clk_prepare_enable(phy->clk_mod); +- if (ret) { +- dev_err(dev, "Cannot enable mod clock: %d\n", ret); +- goto err_disable_clk_bus; +- } +- +- if (phy->variant->has_phy_clk) { +- ret = sun8i_phy_clk_create(phy, dev, +- phy->variant->has_second_pll); +- if (ret) { +- dev_err(dev, "Couldn't create the PHY clock\n"); +- goto err_disable_clk_mod; +- } +- +- clk_prepare_enable(phy->clk_phy); +- } +- + platform_set_drvdata(pdev, phy); + + return 0; + +-err_disable_clk_mod: +- clk_disable_unprepare(phy->clk_mod); +-err_disable_clk_bus: +- clk_disable_unprepare(phy->clk_bus); +-err_deassert_rst_phy: +- reset_control_assert(phy->rst_phy); +-err_put_rst_phy: +- reset_control_put(phy->rst_phy); + err_put_clk_pll1: + clk_put(phy->clk_pll1); + err_put_clk_pll0: +@@ -753,12 +768,6 @@ static int sun8i_hdmi_phy_remove(struct platform_device *pdev) + { + struct sun8i_hdmi_phy *phy = platform_get_drvdata(pdev); + +- clk_disable_unprepare(phy->clk_mod); +- clk_disable_unprepare(phy->clk_bus); +- clk_disable_unprepare(phy->clk_phy); +- +- reset_control_assert(phy->rst_phy); +- + reset_control_put(phy->rst_phy); + + clk_put(phy->clk_pll0); +-- +2.33.0 + diff --git a/queue-5.14/dt-bindings-drm-bridge-ti-sn65dsi86-fix-reg-value.patch b/queue-5.14/dt-bindings-drm-bridge-ti-sn65dsi86-fix-reg-value.patch new file mode 100644 index 00000000000..317bddb7a49 --- /dev/null +++ b/queue-5.14/dt-bindings-drm-bridge-ti-sn65dsi86-fix-reg-value.patch @@ -0,0 +1,42 @@ +From 85f6a56e2bb1587590aa5d94bbf165b2ecdb5be1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 14:35:12 +0200 +Subject: dt-bindings: drm/bridge: ti-sn65dsi86: Fix reg value + +From: Geert Uytterhoeven + +[ Upstream commit b2d70c0dbf2731a37d1c7bcc86ab2387954d5f56 ] + +make dtbs_check: + + arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dt.yaml: bridge@2c: reg:0:0: 45 was expected + +According to the datasheet, the I2C address can be either 0x2c or 0x2d, +depending on the ADDR control input. + +Fixes: e3896e6dddf0b821 ("dt-bindings: drm/bridge: Document sn65dsi86 bridge bindings") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Kieran Bingham +Link: https://lore.kernel.org/r/08f73c2aa0d4e580303357dfae107d084d962835.1632486753.git.geert+renesas@glider.be +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + .../devicetree/bindings/display/bridge/ti,sn65dsi86.yaml | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml b/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml +index 26932d2e86ab..8608b9dd8e9d 100644 +--- a/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml ++++ b/Documentation/devicetree/bindings/display/bridge/ti,sn65dsi86.yaml +@@ -18,7 +18,7 @@ properties: + const: ti,sn65dsi86 + + reg: +- const: 0x2d ++ enum: [ 0x2c, 0x2d ] + + enable-gpios: + maxItems: 1 +-- +2.33.0 + diff --git a/queue-5.14/gve-avoid-freeing-null-pointer.patch b/queue-5.14/gve-avoid-freeing-null-pointer.patch new file mode 100644 index 00000000000..4ce713807b9 --- /dev/null +++ b/queue-5.14/gve-avoid-freeing-null-pointer.patch @@ -0,0 +1,78 @@ +From 6e10eadf739d30a06e03c04d0231b711d1e665a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 19:42:20 -0700 +Subject: gve: Avoid freeing NULL pointer + +From: Tao Liu + +[ Upstream commit 922aa9bcac92b3ab6a423526a8e785b35a60b441 ] + +Prevent possible crashes when cleaning up after unsuccessful +initializations. + +Fixes: 893ce44df5658 ("gve: Add basic driver framework for Compute Engine Virtual NIC") +Signed-off-by: Tao Liu +Signed-off-by: Catherine Sully +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_main.c | 27 ++++++++++++++-------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c +index 099a2bc5ae67..29c5f994f92e 100644 +--- a/drivers/net/ethernet/google/gve/gve_main.c ++++ b/drivers/net/ethernet/google/gve/gve_main.c +@@ -82,6 +82,9 @@ static int gve_alloc_counter_array(struct gve_priv *priv) + + static void gve_free_counter_array(struct gve_priv *priv) + { ++ if (!priv->counter_array) ++ return; ++ + dma_free_coherent(&priv->pdev->dev, + priv->num_event_counters * + sizeof(*priv->counter_array), +@@ -142,6 +145,9 @@ static int gve_alloc_stats_report(struct gve_priv *priv) + + static void gve_free_stats_report(struct gve_priv *priv) + { ++ if (!priv->stats_report) ++ return; ++ + del_timer_sync(&priv->stats_report_timer); + dma_free_coherent(&priv->pdev->dev, priv->stats_report_len, + priv->stats_report, priv->stats_report_bus); +@@ -370,18 +376,19 @@ static void gve_free_notify_blocks(struct gve_priv *priv) + { + int i; + +- if (priv->msix_vectors) { +- /* Free the irqs */ +- for (i = 0; i < priv->num_ntfy_blks; i++) { +- struct gve_notify_block *block = &priv->ntfy_blocks[i]; +- int msix_idx = i; ++ if (!priv->msix_vectors) ++ return; + +- irq_set_affinity_hint(priv->msix_vectors[msix_idx].vector, +- NULL); +- free_irq(priv->msix_vectors[msix_idx].vector, block); +- } +- free_irq(priv->msix_vectors[priv->mgmt_msix_idx].vector, priv); ++ /* Free the irqs */ ++ for (i = 0; i < priv->num_ntfy_blks; i++) { ++ struct gve_notify_block *block = &priv->ntfy_blocks[i]; ++ int msix_idx = i; ++ ++ irq_set_affinity_hint(priv->msix_vectors[msix_idx].vector, ++ NULL); ++ free_irq(priv->msix_vectors[msix_idx].vector, block); + } ++ free_irq(priv->msix_vectors[priv->mgmt_msix_idx].vector, priv); + dma_free_coherent(&priv->pdev->dev, + priv->num_ntfy_blks * sizeof(*priv->ntfy_blocks), + priv->ntfy_blocks, priv->ntfy_block_bus); +-- +2.33.0 + diff --git a/queue-5.14/gve-correct-available-tx-qpl-check.patch b/queue-5.14/gve-correct-available-tx-qpl-check.patch new file mode 100644 index 00000000000..77c1918c9c5 --- /dev/null +++ b/queue-5.14/gve-correct-available-tx-qpl-check.patch @@ -0,0 +1,37 @@ +From c157cb264027b7b4484c9e4e6c0122b1ff984ac5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 19:42:19 -0700 +Subject: gve: Correct available tx qpl check + +From: Catherine Sullivan + +[ Upstream commit d03477ee10f4bc35d3573cf1823814378ef2dca2 ] + +The qpl_map_size is rounded up to a multiple of sizeof(long), but the +number of qpls doesn't have to be. + +Fixes: f5cedc84a30d2 ("gve: Add transmit and receive support") +Signed-off-by: Catherine Sullivan +Signed-off-by: Jeroen de Borst +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/google/gve/gve.h b/drivers/net/ethernet/google/gve/gve.h +index 1d3188e8e3b3..92dc18a4bcc4 100644 +--- a/drivers/net/ethernet/google/gve/gve.h ++++ b/drivers/net/ethernet/google/gve/gve.h +@@ -780,7 +780,7 @@ struct gve_queue_page_list *gve_assign_rx_qpl(struct gve_priv *priv) + gve_num_tx_qpls(priv)); + + /* we are out of rx qpls */ +- if (id == priv->qpl_cfg.qpl_map_size) ++ if (id == gve_num_tx_qpls(priv) + gve_num_rx_qpls(priv)) + return NULL; + + set_bit(id, priv->qpl_cfg.qpl_id_map); +-- +2.33.0 + diff --git a/queue-5.14/gve-fix-gve_get_stats.patch b/queue-5.14/gve-fix-gve_get_stats.patch new file mode 100644 index 00000000000..2312c83b20f --- /dev/null +++ b/queue-5.14/gve-fix-gve_get_stats.patch @@ -0,0 +1,75 @@ +From c1876e8edbfe006e675fb49fd3ab93759e07941f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 17:30:30 -0700 +Subject: gve: fix gve_get_stats() + +From: Eric Dumazet + +[ Upstream commit 2f57d4975fa027eabd35fdf23a49f8222ef3abf2 ] + +gve_get_stats() can report wrong numbers if/when u64_stats_fetch_retry() +returns true. + +What is needed here is to sample values in temporary variables, +and only use them after each loop is ended. + +Fixes: f5cedc84a30d ("gve: Add transmit and receive support") +Signed-off-by: Eric Dumazet +Cc: Catherine Sullivan +Cc: Sagi Shahar +Cc: Jon Olson +Cc: Willem de Bruijn +Cc: Luigi Rizzo +Cc: Jeroen de Borst +Cc: Tao Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_main.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c +index 29c5f994f92e..1b49e9feacac 100644 +--- a/drivers/net/ethernet/google/gve/gve_main.c ++++ b/drivers/net/ethernet/google/gve/gve_main.c +@@ -41,6 +41,7 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) + { + struct gve_priv *priv = netdev_priv(dev); + unsigned int start; ++ u64 packets, bytes; + int ring; + + if (priv->rx) { +@@ -48,10 +49,12 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) + do { + start = + u64_stats_fetch_begin(&priv->rx[ring].statss); +- s->rx_packets += priv->rx[ring].rpackets; +- s->rx_bytes += priv->rx[ring].rbytes; ++ packets = priv->rx[ring].rpackets; ++ bytes = priv->rx[ring].rbytes; + } while (u64_stats_fetch_retry(&priv->rx[ring].statss, + start)); ++ s->rx_packets += packets; ++ s->rx_bytes += bytes; + } + } + if (priv->tx) { +@@ -59,10 +62,12 @@ static void gve_get_stats(struct net_device *dev, struct rtnl_link_stats64 *s) + do { + start = + u64_stats_fetch_begin(&priv->tx[ring].statss); +- s->tx_packets += priv->tx[ring].pkt_done; +- s->tx_bytes += priv->tx[ring].bytes_done; ++ packets = priv->tx[ring].pkt_done; ++ bytes = priv->tx[ring].bytes_done; + } while (u64_stats_fetch_retry(&priv->tx[ring].statss, + start)); ++ s->tx_packets += packets; ++ s->tx_bytes += bytes; + } + } + } +-- +2.33.0 + diff --git a/queue-5.14/gve-properly-handle-errors-in-gve_assign_qpl.patch b/queue-5.14/gve-properly-handle-errors-in-gve_assign_qpl.patch new file mode 100644 index 00000000000..5f142a775b6 --- /dev/null +++ b/queue-5.14/gve-properly-handle-errors-in-gve_assign_qpl.patch @@ -0,0 +1,43 @@ +From 493b2b9c3c3400ae08dc1e431fe1ca7f0589252e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 19:42:21 -0700 +Subject: gve: Properly handle errors in gve_assign_qpl + +From: Catherine Sullivan + +[ Upstream commit d4b111fda69a01e0a7439d05993f5dad567c93aa ] + +Ignored errors would result in crash. + +Fixes: ede3fcf5ec67f ("gve: Add support for raw addressing to the rx path") +Signed-off-by: Catherine Sullivan +Signed-off-by: Jeroen de Borst +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_rx.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_rx.c b/drivers/net/ethernet/google/gve/gve_rx.c +index bb8261368250..94941d4e4744 100644 +--- a/drivers/net/ethernet/google/gve/gve_rx.c ++++ b/drivers/net/ethernet/google/gve/gve_rx.c +@@ -104,8 +104,14 @@ static int gve_prefill_rx_pages(struct gve_rx_ring *rx) + if (!rx->data.page_info) + return -ENOMEM; + +- if (!rx->data.raw_addressing) ++ if (!rx->data.raw_addressing) { + rx->data.qpl = gve_assign_rx_qpl(priv); ++ if (!rx->data.qpl) { ++ kvfree(rx->data.page_info); ++ rx->data.page_info = NULL; ++ return -ENOMEM; ++ } ++ } + for (i = 0; i < slots; i++) { + if (!rx->data.raw_addressing) { + struct page *page = rx->data.qpl->pages[i]; +-- +2.33.0 + diff --git a/queue-5.14/gve-report-64bit-tx_bytes-counter-from-gve_handle_re.patch b/queue-5.14/gve-report-64bit-tx_bytes-counter-from-gve_handle_re.patch new file mode 100644 index 00000000000..67f0ad2c76b --- /dev/null +++ b/queue-5.14/gve-report-64bit-tx_bytes-counter-from-gve_handle_re.patch @@ -0,0 +1,44 @@ +From 14d1d542b94df3df095e57aa7621c63b7b2f25b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 18:01:38 -0700 +Subject: gve: report 64bit tx_bytes counter from gve_handle_report_stats() + +From: Eric Dumazet + +[ Upstream commit 17c37d748f2b122a95b6d0524d410302ff89a2b1 ] + +Each tx queue maintains a 64bit counter for bytes, there is +no reason to truncate this to 32bit (or this has not been +documented) + +Fixes: 24aeb56f2d38 ("gve: Add Gvnic stats AQ command and ethtool show/set-priv-flags.") +Signed-off-by: Eric Dumazet +Cc: Yangchun Fu +Cc: Kuo Zhao +Cc: David Awogbemila +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_main.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c +index 1b49e9feacac..bf8a4a7c43f7 100644 +--- a/drivers/net/ethernet/google/gve/gve_main.c ++++ b/drivers/net/ethernet/google/gve/gve_main.c +@@ -1197,9 +1197,10 @@ static void gve_handle_reset(struct gve_priv *priv) + + void gve_handle_report_stats(struct gve_priv *priv) + { +- int idx, stats_idx = 0, tx_bytes; +- unsigned int start = 0; + struct stats *stats = priv->stats_report->stats; ++ int idx, stats_idx = 0; ++ unsigned int start = 0; ++ u64 tx_bytes; + + if (!gve_get_report_stats(priv)) + return; +-- +2.33.0 + diff --git a/queue-5.14/i40e-fix-endless-loop-under-rtnl.patch b/queue-5.14/i40e-fix-endless-loop-under-rtnl.patch new file mode 100644 index 00000000000..2c7d20ac753 --- /dev/null +++ b/queue-5.14/i40e-fix-endless-loop-under-rtnl.patch @@ -0,0 +1,58 @@ +From 53078f4cee1af271b6dd51fb52e4b5b776ada65f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Sep 2021 10:54:42 +0200 +Subject: i40e: fix endless loop under rtnl + +From: Jiri Benc + +[ Upstream commit 857b6c6f665cca9828396d9743faf37fd09e9ac3 ] + +The loop in i40e_get_capabilities can never end. The problem is that +although i40e_aq_discover_capabilities returns with an error if there's +a firmware problem, the returned error is not checked. There is a check for +pf->hw.aq.asq_last_status but that value is set to I40E_AQ_RC_OK on most +firmware problems. + +When i40e_aq_discover_capabilities encounters a firmware problem, it will +encounter the same problem on its next invocation. As the result, the loop +becomes endless. We hit this with I40E_ERR_ADMIN_QUEUE_TIMEOUT but looking +at the code, it can happen with a range of other firmware errors. + +I don't know what the correct behavior should be: whether the firmware +should be retried a few times, or whether pf->hw.aq.asq_last_status should +be always set to the encountered firmware error (but then it would be +pointless and can be just replaced by the i40e_aq_discover_capabilities +return value). However, the current behavior with an endless loop under the +rtnl mutex(!) is unacceptable and Intel has not submitted a fix, although we +explained the bug to them 7 months ago. + +This may not be the best possible fix but it's better than hanging the whole +system on a firmware bug. + +Fixes: 56a62fc86895 ("i40e: init code and hardware support") +Tested-by: Stefan Assmann +Signed-off-by: Jiri Benc +Reviewed-by: Jesse Brandeburg +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 1d1f52756a93..772dd05a0ae8 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -10110,7 +10110,7 @@ static int i40e_get_capabilities(struct i40e_pf *pf, + if (pf->hw.aq.asq_last_status == I40E_AQ_RC_ENOMEM) { + /* retry with a larger buffer */ + buf_len = data_size; +- } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK) { ++ } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK || err) { + dev_info(&pf->pdev->dev, + "capability discovery failed, err %s aq_err %s\n", + i40e_stat_str(&pf->hw, err), +-- +2.33.0 + diff --git a/queue-5.14/i40e-fix-freeing-of-uninitialized-misc-irq-vector.patch b/queue-5.14/i40e-fix-freeing-of-uninitialized-misc-irq-vector.patch new file mode 100644 index 00000000000..ca75683904d --- /dev/null +++ b/queue-5.14/i40e-fix-freeing-of-uninitialized-misc-irq-vector.patch @@ -0,0 +1,79 @@ +From 01651b08730ddcd33a2c5d9e4d7f2e5420162415 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 11:40:41 +0200 +Subject: i40e: Fix freeing of uninitialized misc IRQ vector + +From: Sylwester Dziedziuch + +[ Upstream commit 2e5a20573a926302b233b0c2e1077f5debc7ab2e ] + +When VSI set up failed in i40e_probe() as part of PF switch set up +driver was trying to free misc IRQ vectors in +i40e_clear_interrupt_scheme and produced a kernel Oops: + + Trying to free already-free IRQ 266 + WARNING: CPU: 0 PID: 5 at kernel/irq/manage.c:1731 __free_irq+0x9a/0x300 + Workqueue: events work_for_cpu_fn + RIP: 0010:__free_irq+0x9a/0x300 + Call Trace: + ? synchronize_irq+0x3a/0xa0 + free_irq+0x2e/0x60 + i40e_clear_interrupt_scheme+0x53/0x190 [i40e] + i40e_probe.part.108+0x134b/0x1a40 [i40e] + ? kmem_cache_alloc+0x158/0x1c0 + ? acpi_ut_update_ref_count.part.1+0x8e/0x345 + ? acpi_ut_update_object_reference+0x15e/0x1e2 + ? strstr+0x21/0x70 + ? irq_get_irq_data+0xa/0x20 + ? mp_check_pin_attr+0x13/0xc0 + ? irq_get_irq_data+0xa/0x20 + ? mp_map_pin_to_irq+0xd3/0x2f0 + ? acpi_register_gsi_ioapic+0x93/0x170 + ? pci_conf1_read+0xa4/0x100 + ? pci_bus_read_config_word+0x49/0x70 + ? do_pci_enable_device+0xcc/0x100 + local_pci_probe+0x41/0x90 + work_for_cpu_fn+0x16/0x20 + process_one_work+0x1a7/0x360 + worker_thread+0x1cf/0x390 + ? create_worker+0x1a0/0x1a0 + kthread+0x112/0x130 + ? kthread_flush_work_fn+0x10/0x10 + ret_from_fork+0x1f/0x40 + +The problem is that at that point misc IRQ vectors +were not allocated yet and we get a call trace +that driver is trying to free already free IRQ vectors. + +Add a check in i40e_clear_interrupt_scheme for __I40E_MISC_IRQ_REQUESTED +PF state before calling i40e_free_misc_vector. This state is set only if +misc IRQ vectors were properly initialized. + +Fixes: c17401a1dd21 ("i40e: use separate state bit for miscellaneous IRQ setup") +Reported-by: PJ Waskiewicz +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Mateusz Palczewski +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 772dd05a0ae8..5d3d6b1dae7b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -4868,7 +4868,8 @@ static void i40e_clear_interrupt_scheme(struct i40e_pf *pf) + { + int i; + +- i40e_free_misc_vector(pf); ++ if (test_bit(__I40E_MISC_IRQ_REQUESTED, pf->state)) ++ i40e_free_misc_vector(pf); + + i40e_put_lump(pf->irq_pile, pf->iwarp_base_vector, + I40E_IWARP_IRQ_PILE_ID); +-- +2.33.0 + diff --git a/queue-5.14/iavf-fix-double-unlock-of-crit_lock.patch b/queue-5.14/iavf-fix-double-unlock-of-crit_lock.patch new file mode 100644 index 00000000000..b042cb5a6b2 --- /dev/null +++ b/queue-5.14/iavf-fix-double-unlock-of-crit_lock.patch @@ -0,0 +1,41 @@ +From 5c400f06c87d0220cab009df651253617de6fe42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Aug 2021 12:06:39 +0200 +Subject: iavf: fix double unlock of crit_lock + +From: Stefan Assmann + +[ Upstream commit 54ee39439acd9f8b161703c6ad4f4e1835585277 ] + +The crit_lock mutex could be unlocked twice as reported here +https://lists.osuosl.org/pipermail/intel-wired-lan/Week-of-Mon-20210823/025525.html + +Remove the superfluous unlock. Technically the problem was already +present before 5ac49f3c2702 as that commit only replaced the locking +primitive, but no functional change. + +Reported-by: Dan Carpenter +Fixes: 5ac49f3c2702 ("iavf: use mutexes for locking of critical sections") +Fixes: bac8486116b0 ("iavf: Refactor the watchdog state machine") +Signed-off-by: Stefan Assmann +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 23762a7ef740..cada4e0e40b4 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1965,7 +1965,6 @@ static void iavf_watchdog_task(struct work_struct *work) + } + adapter->aq_required = 0; + adapter->current_op = VIRTCHNL_OP_UNKNOWN; +- mutex_unlock(&adapter->crit_lock); + queue_delayed_work(iavf_wq, + &adapter->watchdog_task, + msecs_to_jiffies(10)); +-- +2.33.0 + diff --git a/queue-5.14/iwlwifi-mvm-fix-possible-null-dereference.patch b/queue-5.14/iwlwifi-mvm-fix-possible-null-dereference.patch new file mode 100644 index 00000000000..4540806ba54 --- /dev/null +++ b/queue-5.14/iwlwifi-mvm-fix-possible-null-dereference.patch @@ -0,0 +1,45 @@ +From f2f6c16a852ca52141275d615be4a6b994f1d9e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Sep 2021 14:32:14 +0300 +Subject: iwlwifi: mvm: Fix possible NULL dereference + +From: Ilan Peer + +[ Upstream commit 24d5f16e407b75bc59d5419b957a9cab423b2681 ] + +In __iwl_mvm_remove_time_event() check that 'te_data->vif' is NULL +before dereferencing it. + +Fixes: 7b3954a1d69a ("iwlwifi: mvm: Explicitly stop session protection before unbinding") +Reported-by: Dan Carpenter +Signed-off-by: Ilan Peer +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20210907143156.e80e52167d93.Ie2247f43f8acb2cee6dff5b07a3947c79a772835@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/time-event.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +index 24b658a3098a..3ae727bc4e94 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +@@ -652,12 +652,13 @@ static bool __iwl_mvm_remove_time_event(struct iwl_mvm *mvm, + u32 *uid) + { + u32 id; +- struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif); ++ struct iwl_mvm_vif *mvmvif; + enum nl80211_iftype iftype; + + if (!te_data->vif) + return false; + ++ mvmvif = iwl_mvm_vif_from_mac80211(te_data->vif); + iftype = te_data->vif->type; + + /* +-- +2.33.0 + diff --git a/queue-5.14/iwlwifi-pcie-add-configuration-of-a-wi-fi-adapter-on.patch b/queue-5.14/iwlwifi-pcie-add-configuration-of-a-wi-fi-adapter-on.patch new file mode 100644 index 00000000000..737324c21d4 --- /dev/null +++ b/queue-5.14/iwlwifi-pcie-add-configuration-of-a-wi-fi-adapter-on.patch @@ -0,0 +1,49 @@ +From a29e933947514ba95d28994f9ca3cfd4361e1969 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 15:21:54 +0300 +Subject: iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15 + +From: Vladimir Zapolskiy + +[ Upstream commit fe5c735d0d47b495be6753d6aea4f8f78c909a0a ] + +There is a Killer AX1650 2x2 Wi-Fi 6 and Bluetooth 5.1 wireless adapter +found on Dell XPS 15 (9510) laptop, its configuration was present on +Linux v5.7, however accidentally it has been removed from the list of +supported devices, let's add it back. + +The problem is manifested on driver initialization: + + Intel(R) Wireless WiFi driver for Linux + iwlwifi 0000:00:14.3: enabling device (0000 -> 0002) + iwlwifi: No config found for PCI dev 43f0/1651, rev=0x354, rfid=0x10a100 + iwlwifi: probe of 0000:00:14.3 failed with error -22 + +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=213939 +Fixes: 3f910a25839b ("iwlwifi: pcie: convert all AX101 devices to the device tables") +Cc: Julien Wajsberg +Signed-off-by: Vladimir Zapolskiy +Acked-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210924122154.2376577-1-vladimir.zapolskiy@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 6f49950a5f6d..be3ad4281353 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -547,6 +547,8 @@ static const struct iwl_dev_info iwl_dev_info_table[] = { + IWL_DEV_INFO(0x43F0, 0x0074, iwl_ax201_cfg_qu_hr, NULL), + IWL_DEV_INFO(0x43F0, 0x0078, iwl_ax201_cfg_qu_hr, NULL), + IWL_DEV_INFO(0x43F0, 0x007C, iwl_ax201_cfg_qu_hr, NULL), ++ IWL_DEV_INFO(0x43F0, 0x1651, killer1650s_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650s_name), ++ IWL_DEV_INFO(0x43F0, 0x1652, killer1650i_2ax_cfg_qu_b0_hr_b0, iwl_ax201_killer_1650i_name), + IWL_DEV_INFO(0x43F0, 0x2074, iwl_ax201_cfg_qu_hr, NULL), + IWL_DEV_INFO(0x43F0, 0x4070, iwl_ax201_cfg_qu_hr, NULL), + IWL_DEV_INFO(0xA0F0, 0x0070, iwl_ax201_cfg_qu_hr, NULL), +-- +2.33.0 + diff --git a/queue-5.14/libbpf-fix-memory-leak-in-strset.patch b/queue-5.14/libbpf-fix-memory-leak-in-strset.patch new file mode 100644 index 00000000000..8511e5fe6d4 --- /dev/null +++ b/queue-5.14/libbpf-fix-memory-leak-in-strset.patch @@ -0,0 +1,36 @@ +From 7b718b9199f86c4baf6c4676dd7bd82708c9b73b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Oct 2021 11:59:10 -0700 +Subject: libbpf: Fix memory leak in strset + +From: Andrii Nakryiko + +[ Upstream commit b0e875bac0fab3e7a7431c2eee36a8ccc0c712ac ] + +Free struct strset itself, not just its internal parts. + +Fixes: 90d76d3ececc ("libbpf: Extract internal set-of-strings datastructure APIs") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Daniel Borkmann +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20211001185910.86492-1-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/strset.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/lib/bpf/strset.c b/tools/lib/bpf/strset.c +index 1fb8b49de1d6..ea655318153f 100644 +--- a/tools/lib/bpf/strset.c ++++ b/tools/lib/bpf/strset.c +@@ -88,6 +88,7 @@ void strset__free(struct strset *set) + + hashmap__free(set->strs_hash); + free(set->strs_data); ++ free(set); + } + + size_t strset__data_size(const struct strset *set) +-- +2.33.0 + diff --git a/queue-5.14/libbpf-fix-segfault-in-light-skeleton-for-objects-wi.patch b/queue-5.14/libbpf-fix-segfault-in-light-skeleton-for-objects-wi.patch new file mode 100644 index 00000000000..4d5a13bd203 --- /dev/null +++ b/queue-5.14/libbpf-fix-segfault-in-light-skeleton-for-objects-wi.patch @@ -0,0 +1,54 @@ +From d4093b728d63313cd173eb47a5a712b635b873e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 11:46:34 +0530 +Subject: libbpf: Fix segfault in light skeleton for objects without BTF + +From: Kumar Kartikeya Dwivedi + +[ Upstream commit 4729445b47efebf089da4ccbcd1b116ffa2ad4af ] + +When fed an empty BPF object, bpftool gen skeleton -L crashes at +btf__set_fd() since it assumes presence of obj->btf, however for +the sequence below clang adds no .BTF section (hence no BTF). + +Reproducer: + + $ touch a.bpf.c + $ clang -O2 -g -target bpf -c a.bpf.c + $ bpftool gen skeleton -L a.bpf.o + /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */ + /* THIS FILE IS AUTOGENERATED! */ + + struct a_bpf { + struct bpf_loader_ctx ctx; + Segmentation fault (core dumped) + +The same occurs for files compiled without BTF info, i.e. without +clang's -g flag. + +Fixes: 67234743736a (libbpf: Generate loader program out of BPF ELF file.) +Signed-off-by: Kumar Kartikeya Dwivedi +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210930061634.1840768-1-memxor@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index d27e017ebfbe..f1bc09e606cd 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -8115,7 +8115,8 @@ int bpf_object__load_xattr(struct bpf_object_load_attr *attr) + + if (obj->gen_loader) { + /* reset FDs */ +- btf__set_fd(obj->btf, -1); ++ if (obj->btf) ++ btf__set_fd(obj->btf, -1); + for (i = 0; i < obj->nr_maps; i++) + obj->maps[i].fd = -1; + if (!err) +-- +2.33.0 + diff --git a/queue-5.14/mips-revert-add-support-for-buggy-mt7621s-core-detec.patch b/queue-5.14/mips-revert-add-support-for-buggy-mt7621s-core-detec.patch new file mode 100644 index 00000000000..d9f41f854e5 --- /dev/null +++ b/queue-5.14/mips-revert-add-support-for-buggy-mt7621s-core-detec.patch @@ -0,0 +1,75 @@ +From 5f92347491d82918e30bee9f23aa3313008379d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 09:57:41 -0700 +Subject: MIPS: Revert "add support for buggy MT7621S core detection" + +From: Ilya Lipnitskiy + +[ Upstream commit 740da9d7ca4e25f5d87db9f80d75432681b61305 ] + +This reverts commit 6decd1aad15f56b169217789630a0098b496de0e. CPULAUNCH +register is not set properly by some bootloaders, causing a regression +until a bootloader change is made, which is hard if not impossible on +some embedded devices. Revert the change until a more robust core +detection mechanism that works on MT7621S routers such as Netgear R6220 +as well as platforms like Digi EX15 can be made. + +Link: https://lore.kernel.org/lkml/4d9e3b39-7caa-d372-5d7b-42dcec36fec7@kernel.org +Fixes: 6decd1aad15f ("MIPS: add support for buggy MT7621S core detection") +Signed-off-by: Ilya Lipnitskiy +Acked-by: Sergio Paracuellos +Acked-by: Greg Ungerer +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/mips-cps.h | 23 +---------------------- + 1 file changed, 1 insertion(+), 22 deletions(-) + +diff --git a/arch/mips/include/asm/mips-cps.h b/arch/mips/include/asm/mips-cps.h +index 35fb8ee6dd33..fd43d876892e 100644 +--- a/arch/mips/include/asm/mips-cps.h ++++ b/arch/mips/include/asm/mips-cps.h +@@ -10,8 +10,6 @@ + #include + #include + +-#include +- + extern unsigned long __cps_access_bad_size(void) + __compiletime_error("Bad size for CPS accessor"); + +@@ -167,30 +165,11 @@ static inline uint64_t mips_cps_cluster_config(unsigned int cluster) + */ + static inline unsigned int mips_cps_numcores(unsigned int cluster) + { +- unsigned int ncores; +- + if (!mips_cm_present()) + return 0; + + /* Add one before masking to handle 0xff indicating no cores */ +- ncores = (mips_cps_cluster_config(cluster) + 1) & CM_GCR_CONFIG_PCORES; +- +- if (IS_ENABLED(CONFIG_SOC_MT7621)) { +- struct cpulaunch *launch; +- +- /* +- * Ralink MT7621S SoC is single core, but the GCR_CONFIG method +- * always reports 2 cores. Check the second core's LAUNCH_FREADY +- * flag to detect if the second core is missing. This method +- * only works before the core has been started. +- */ +- launch = (struct cpulaunch *)CKSEG0ADDR(CPULAUNCH); +- launch += 2; /* MT7621 has 2 VPEs per core */ +- if (!(launch->flags & LAUNCH_FREADY)) +- ncores = 1; +- } +- +- return ncores; ++ return (mips_cps_cluster_config(cluster) + 1) & CM_GCR_CONFIG_PCORES; + } + + /** +-- +2.33.0 + diff --git a/queue-5.14/net-bridge-fix-under-estimation-in-br_get_linkxstats.patch b/queue-5.14/net-bridge-fix-under-estimation-in-br_get_linkxstats.patch new file mode 100644 index 00000000000..f300b1f5dbf --- /dev/null +++ b/queue-5.14/net-bridge-fix-under-estimation-in-br_get_linkxstats.patch @@ -0,0 +1,43 @@ +From 00762820ecff1b7826afc7a521c3eabe5fdc0af9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 18:05:08 -0700 +Subject: net: bridge: fix under estimation in br_get_linkxstats_size() + +From: Eric Dumazet + +[ Upstream commit 0854a0513321cf70bea5fa483ebcaa983cc7c62e ] + +Commit de1799667b00 ("net: bridge: add STP xstats") +added an additional nla_reserve_64bit() in br_fill_linkxstats(), +but forgot to update br_get_linkxstats_size() accordingly. + +This can trigger the following in rtnl_stats_get() + + WARN_ON(err == -EMSGSIZE); + +Fixes: de1799667b00 ("net: bridge: add STP xstats") +Signed-off-by: Eric Dumazet +Cc: Vivien Didelot +Cc: Nikolay Aleksandrov +Acked-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_netlink.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index 69c0002f413f..2abfbd4b8a15 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -1658,6 +1658,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr) + + return numvls * nla_total_size(sizeof(struct bridge_vlan_xstats)) + + nla_total_size_64bit(sizeof(struct br_mcast_stats)) + ++ (p ? nla_total_size_64bit(sizeof(p->stp_xstats)) : 0) + + nla_total_size(0); + } + +-- +2.33.0 + diff --git a/queue-5.14/net-bridge-use-nla_total_size_64bit-in-br_get_linkxs.patch b/queue-5.14/net-bridge-use-nla_total_size_64bit-in-br_get_linkxs.patch new file mode 100644 index 00000000000..fc2fc5b5284 --- /dev/null +++ b/queue-5.14/net-bridge-use-nla_total_size_64bit-in-br_get_linkxs.patch @@ -0,0 +1,41 @@ +From 14ea675cc2d7e19acc1f2e0ffeb81593e1751da4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 18:05:07 -0700 +Subject: net: bridge: use nla_total_size_64bit() in br_get_linkxstats_size() + +From: Eric Dumazet + +[ Upstream commit dbe0b88064494b7bb6a9b2aa7e085b14a3112d44 ] + +bridge_fill_linkxstats() is using nla_reserve_64bit(). + +We must use nla_total_size_64bit() instead of nla_total_size() +for corresponding data structure. + +Fixes: 1080ab95e3c7 ("net: bridge: add support for IGMP/MLD stats and export them via netlink") +Signed-off-by: Eric Dumazet +Cc: Nikolay Aleksandrov +Cc: Vivien Didelot +Acked-by: Nikolay Aleksandrov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/bridge/br_netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index 8642e56059fb..69c0002f413f 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -1657,7 +1657,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr) + } + + return numvls * nla_total_size(sizeof(struct bridge_vlan_xstats)) + +- nla_total_size(sizeof(struct br_mcast_stats)) + ++ nla_total_size_64bit(sizeof(struct br_mcast_stats)) + + nla_total_size(0); + } + +-- +2.33.0 + diff --git a/queue-5.14/net-mlx5-avoid-generating-event-after-pps-out-in-rea.patch b/queue-5.14/net-mlx5-avoid-generating-event-after-pps-out-in-rea.patch new file mode 100644 index 00000000000..98cfa5139ae --- /dev/null +++ b/queue-5.14/net-mlx5-avoid-generating-event-after-pps-out-in-rea.patch @@ -0,0 +1,72 @@ +From e94a861bb5989b8aeb54d6dd875a5b91be02ebcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 15:30:01 +0300 +Subject: net/mlx5: Avoid generating event after PPS out in Real time mode + +From: Aya Levin + +[ Upstream commit 99b9a678b2e474756770900595cb09c94498bfca ] + +When in Real-time mode, HW clock is synced with the PTP daemon. Hence +driver should not re-calibrate the next pulse (via MTPPSE repetitive +events mechanism). + +This patch arms repetitive events only in free-running mode. + +Fixes: 432119de33d9 ("net/mlx5: Add cyc2time HW translation mode support") +Signed-off-by: Aya Levin +Reviewed-by: Eran Ben Elisha +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx5/core/lib/clock.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +index a8c6450637da..c009ccc88df4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +@@ -472,6 +472,7 @@ static int mlx5_perout_configure(struct ptp_clock_info *ptp, + container_of(ptp, struct mlx5_clock, ptp_info); + struct mlx5_core_dev *mdev = + container_of(clock, struct mlx5_core_dev, clock); ++ bool rt_mode = mlx5_real_time_mode(mdev); + u32 in[MLX5_ST_SZ_DW(mtpps_reg)] = {0}; + struct timespec64 ts; + u32 field_select = 0; +@@ -535,6 +536,9 @@ static int mlx5_perout_configure(struct ptp_clock_info *ptp, + if (err) + return err; + ++ if (rt_mode) ++ return 0; ++ + return mlx5_set_mtppse(mdev, pin, 0, + MLX5_EVENT_MODE_REPETETIVE & on); + } +@@ -702,20 +706,14 @@ static void ts_next_sec(struct timespec64 *ts) + static u64 perout_conf_next_event_timer(struct mlx5_core_dev *mdev, + struct mlx5_clock *clock) + { +- bool rt_mode = mlx5_real_time_mode(mdev); + struct timespec64 ts; + s64 target_ns; + +- if (rt_mode) +- ts = mlx5_ptp_gettimex_real_time(mdev, NULL); +- else +- mlx5_ptp_gettimex(&clock->ptp_info, &ts, NULL); +- ++ mlx5_ptp_gettimex(&clock->ptp_info, &ts, NULL); + ts_next_sec(&ts); + target_ns = timespec64_to_ns(&ts); + +- return rt_mode ? perout_conf_real_time(ts.tv_sec) : +- find_target_cycles(mdev, target_ns); ++ return find_target_cycles(mdev, target_ns); + } + + static int mlx5_pps_event(struct notifier_block *nb, +-- +2.33.0 + diff --git a/queue-5.14/net-mlx5-e-switch-fix-double-allocation-of-acl-flow-.patch b/queue-5.14/net-mlx5-e-switch-fix-double-allocation-of-acl-flow-.patch new file mode 100644 index 00000000000..18778787590 --- /dev/null +++ b/queue-5.14/net-mlx5-e-switch-fix-double-allocation-of-acl-flow-.patch @@ -0,0 +1,83 @@ +From 810e4e08b09c0a303c0121e74d8538dd819573da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 17:57:47 +0300 +Subject: net/mlx5: E-Switch, Fix double allocation of acl flow counter + +From: Moshe Shemesh + +[ Upstream commit a586775f83bd729ad60b56352dbe067f4bb0beee ] + +Flow counter is allocated in eswitch legacy acl setting functions +without checking if already allocated by previous setting. Add a check +to avoid such double allocation. + +Fixes: 07bab9502641 ("net/mlx5: E-Switch, Refactor eswitch ingress acl codes") +Fixes: ea651a86d468 ("net/mlx5: E-Switch, Refactor eswitch egress acl codes") +Signed-off-by: Moshe Shemesh +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../mellanox/mlx5/core/esw/acl/egress_lgcy.c | 12 ++++++++---- + .../mellanox/mlx5/core/esw/acl/ingress_lgcy.c | 4 +++- + 2 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c +index 0399a396d166..60a73990017c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c +@@ -79,12 +79,16 @@ int esw_acl_egress_lgcy_setup(struct mlx5_eswitch *esw, + int dest_num = 0; + int err = 0; + +- if (MLX5_CAP_ESW_EGRESS_ACL(esw->dev, flow_counter)) { ++ if (vport->egress.legacy.drop_counter) { ++ drop_counter = vport->egress.legacy.drop_counter; ++ } else if (MLX5_CAP_ESW_EGRESS_ACL(esw->dev, flow_counter)) { + drop_counter = mlx5_fc_create(esw->dev, false); +- if (IS_ERR(drop_counter)) ++ if (IS_ERR(drop_counter)) { + esw_warn(esw->dev, + "vport[%d] configure egress drop rule counter err(%ld)\n", + vport->vport, PTR_ERR(drop_counter)); ++ drop_counter = NULL; ++ } + vport->egress.legacy.drop_counter = drop_counter; + } + +@@ -123,7 +127,7 @@ int esw_acl_egress_lgcy_setup(struct mlx5_eswitch *esw, + flow_act.action = MLX5_FLOW_CONTEXT_ACTION_DROP; + + /* Attach egress drop flow counter */ +- if (!IS_ERR_OR_NULL(drop_counter)) { ++ if (drop_counter) { + flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_COUNT; + drop_ctr_dst.type = MLX5_FLOW_DESTINATION_TYPE_COUNTER; + drop_ctr_dst.counter_id = mlx5_fc_id(drop_counter); +@@ -162,7 +166,7 @@ void esw_acl_egress_lgcy_cleanup(struct mlx5_eswitch *esw, + esw_acl_egress_table_destroy(vport); + + clean_drop_counter: +- if (!IS_ERR_OR_NULL(vport->egress.legacy.drop_counter)) { ++ if (vport->egress.legacy.drop_counter) { + mlx5_fc_destroy(esw->dev, vport->egress.legacy.drop_counter); + vport->egress.legacy.drop_counter = NULL; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c +index f75b86abaf1c..b1a5199260f6 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c +@@ -160,7 +160,9 @@ int esw_acl_ingress_lgcy_setup(struct mlx5_eswitch *esw, + + esw_acl_ingress_lgcy_rules_destroy(vport); + +- if (MLX5_CAP_ESW_INGRESS_ACL(esw->dev, flow_counter)) { ++ if (vport->ingress.legacy.drop_counter) { ++ counter = vport->ingress.legacy.drop_counter; ++ } else if (MLX5_CAP_ESW_INGRESS_ACL(esw->dev, flow_counter)) { + counter = mlx5_fc_create(esw->dev, false); + if (IS_ERR(counter)) { + esw_warn(esw->dev, +-- +2.33.0 + diff --git a/queue-5.14/net-mlx5-fix-length-of-irq_index-in-chars.patch b/queue-5.14/net-mlx5-fix-length-of-irq_index-in-chars.patch new file mode 100644 index 00000000000..7571100040c --- /dev/null +++ b/queue-5.14/net-mlx5-fix-length-of-irq_index-in-chars.patch @@ -0,0 +1,39 @@ +From a589302ec15846a34e163328457b48895c1a5b4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 16:01:28 +0300 +Subject: net/mlx5: Fix length of irq_index in chars + +From: Shay Drory + +[ Upstream commit ac8b7d50ae4c3f5325c599f3d6e939ecef6a585a ] + +The maximum irq_index can be 2047, This means irq_name should have 4 +characters reserve for the irq_index. Hence, increase it to 4. + +Fixes: 3af26495a247 ("net/mlx5: Enlarge interrupt field in CREATE_EQ") +Signed-off-by: Shay Drory +Reviewed-by: Parav Pandit +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c +index 3465b363fc2f..49e6f5003991 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c +@@ -13,8 +13,8 @@ + #endif + + #define MLX5_MAX_IRQ_NAME (32) +-/* max irq_index is 255. three chars */ +-#define MLX5_MAX_IRQ_IDX_CHARS (3) ++/* max irq_index is 2047, so four chars */ ++#define MLX5_MAX_IRQ_IDX_CHARS (4) + + #define MLX5_SFS_PER_CTRL_IRQ 64 + #define MLX5_IRQ_CTRL_SF_MAX 8 +-- +2.33.0 + diff --git a/queue-5.14/net-mlx5-fix-setting-number-of-eqs-of-sfs.patch b/queue-5.14/net-mlx5-fix-setting-number-of-eqs-of-sfs.patch new file mode 100644 index 00000000000..cffd756ad64 --- /dev/null +++ b/queue-5.14/net-mlx5-fix-setting-number-of-eqs-of-sfs.patch @@ -0,0 +1,42 @@ +From 097321027358b2d39ff4b7de011b99ba7261f6fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Sep 2021 10:13:02 +0300 +Subject: net/mlx5: Fix setting number of EQs of SFs + +From: Shay Drory + +[ Upstream commit f88c4876347400a577598e06f1b230a7b19ee0e9 ] + +When setting number of completion EQs of the SF, consider number of +online CPUs. +Without this consideration, when number of online cpus are less than 8, +unnecessary 8 completion EQs are allocated. + +Fixes: c36326d38d93 ("net/mlx5: Round-Robin EQs over IRQs") +Signed-off-by: Shay Drory +Reviewed-by: Parav Pandit +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c +index 49e6f5003991..d9345c9ebbff 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c +@@ -610,8 +610,9 @@ void mlx5_irq_table_destroy(struct mlx5_core_dev *dev) + int mlx5_irq_table_get_sfs_vec(struct mlx5_irq_table *table) + { + if (table->sf_comp_pool) +- return table->sf_comp_pool->xa_num_irqs.max - +- table->sf_comp_pool->xa_num_irqs.min + 1; ++ return min_t(int, num_online_cpus(), ++ table->sf_comp_pool->xa_num_irqs.max - ++ table->sf_comp_pool->xa_num_irqs.min + 1); + else + return mlx5_irq_table_get_num_comp(table); + } +-- +2.33.0 + diff --git a/queue-5.14/net-mlx5-force-round-second-at-1pps-out-start-time.patch b/queue-5.14/net-mlx5-force-round-second-at-1pps-out-start-time.patch new file mode 100644 index 00000000000..085146fc155 --- /dev/null +++ b/queue-5.14/net-mlx5-force-round-second-at-1pps-out-start-time.patch @@ -0,0 +1,96 @@ +From a376691320b7fbbeead053d5ce0a46c56fe9f966 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 16:56:09 +0300 +Subject: net/mlx5: Force round second at 1PPS out start time + +From: Aya Levin + +[ Upstream commit 64728294703e77827cc31a1b164ca867400067f5 ] + +Allow configuration of 1PPS start time only with time-stamp representing +a round second. Prior to this patch driver allowed setting of a +non-round-second which is not supported by the device. Avoid unexpected +behavior by restricting start-time configuration to a round-second. + +Fixes: 4272f9b88db9 ("net/mlx5e: Change 1PPS out scheme") +Signed-off-by: Aya Levin +Reviewed-by: Eran Ben Elisha +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/lib/clock.c | 25 ++++++++----------- + 1 file changed, 11 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +index ce696d523493..a8c6450637da 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +@@ -448,22 +448,20 @@ static u64 find_target_cycles(struct mlx5_core_dev *mdev, s64 target_ns) + return cycles_now + cycles_delta; + } + +-static u64 perout_conf_internal_timer(struct mlx5_core_dev *mdev, +- s64 sec, u32 nsec) ++static u64 perout_conf_internal_timer(struct mlx5_core_dev *mdev, s64 sec) + { +- struct timespec64 ts; ++ struct timespec64 ts = {}; + s64 target_ns; + + ts.tv_sec = sec; +- ts.tv_nsec = nsec; + target_ns = timespec64_to_ns(&ts); + + return find_target_cycles(mdev, target_ns); + } + +-static u64 perout_conf_real_time(s64 sec, u32 nsec) ++static u64 perout_conf_real_time(s64 sec) + { +- return (u64)nsec | (u64)sec << 32; ++ return (u64)sec << 32; + } + + static int mlx5_perout_configure(struct ptp_clock_info *ptp, +@@ -501,8 +499,10 @@ static int mlx5_perout_configure(struct ptp_clock_info *ptp, + + if (on) { + bool rt_mode = mlx5_real_time_mode(mdev); +- u32 nsec; +- s64 sec; ++ s64 sec = rq->perout.start.sec; ++ ++ if (rq->perout.start.nsec) ++ return -EINVAL; + + pin_mode = MLX5_PIN_MODE_OUT; + pattern = MLX5_OUT_PATTERN_PERIODIC; +@@ -513,14 +513,11 @@ static int mlx5_perout_configure(struct ptp_clock_info *ptp, + if ((ns >> 1) != 500000000LL) + return -EINVAL; + +- nsec = rq->perout.start.nsec; +- sec = rq->perout.start.sec; +- + if (rt_mode && sec > U32_MAX) + return -EINVAL; + +- time_stamp = rt_mode ? perout_conf_real_time(sec, nsec) : +- perout_conf_internal_timer(mdev, sec, nsec); ++ time_stamp = rt_mode ? perout_conf_real_time(sec) : ++ perout_conf_internal_timer(mdev, sec); + + field_select |= MLX5_MTPPS_FS_PIN_MODE | + MLX5_MTPPS_FS_PATTERN | +@@ -717,7 +714,7 @@ static u64 perout_conf_next_event_timer(struct mlx5_core_dev *mdev, + ts_next_sec(&ts); + target_ns = timespec64_to_ns(&ts); + +- return rt_mode ? perout_conf_real_time(ts.tv_sec, ts.tv_nsec) : ++ return rt_mode ? perout_conf_real_time(ts.tv_sec) : + find_target_cycles(mdev, target_ns); + } + +-- +2.33.0 + diff --git a/queue-5.14/net-mlx5e-fix-the-presented-rq-index-in-ptp-stats.patch b/queue-5.14/net-mlx5e-fix-the-presented-rq-index-in-ptp-stats.patch new file mode 100644 index 00000000000..6e16696d2d9 --- /dev/null +++ b/queue-5.14/net-mlx5e-fix-the-presented-rq-index-in-ptp-stats.patch @@ -0,0 +1,147 @@ +From 38830ba2fe31e81862ecc4b593e52ac415ceb080 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Aug 2021 11:26:03 +0300 +Subject: net/mlx5e: Fix the presented RQ index in PTP stats + +From: Lama Kayal + +[ Upstream commit dd1979cf3c710398a9eeba4853b908fe16426814 ] + +PTP-RQ counters title format contains PTP-RQ identifier, which is +mistakenly not passed to sprinft(). +This leads to unexpected garbage values instead. +This patch fixes it. + +Before applying the patch: +ethtool -S eth3 | grep ptp_rq + ptp_rq15_packets: 0 + ptp_rq8_bytes: 0 + ptp_rq6_csum_complete: 0 + ptp_rq14_csum_complete_tail: 0 + ptp_rq3_csum_complete_tail_slow : 0 + ptp_rq9_csum_unnecessary: 0 + ptp_rq1_csum_unnecessary_inner: 0 + ptp_rq7_csum_none: 0 + ptp_rq10_xdp_drop: 0 + ptp_rq9_xdp_redirect: 0 + ptp_rq13_lro_packets: 0 + ptp_rq12_lro_bytes: 0 + ptp_rq10_ecn_mark: 0 + ptp_rq9_removed_vlan_packets: 0 + ptp_rq5_wqe_err: 0 + ptp_rq8_mpwqe_filler_cqes: 0 + ptp_rq2_mpwqe_filler_strides: 0 + ptp_rq5_oversize_pkts_sw_drop: 0 + ptp_rq6_buff_alloc_err: 0 + ptp_rq15_cqe_compress_blks: 0 + ptp_rq2_cqe_compress_pkts: 0 + ptp_rq2_cache_reuse: 0 + ptp_rq12_cache_full: 0 + ptp_rq11_cache_empty: 256 + ptp_rq12_cache_busy: 0 + ptp_rq11_cache_waive: 0 + ptp_rq12_congst_umr: 0 + ptp_rq11_arfs_err: 0 + ptp_rq9_recover: 0 + +After applying the patch: +ethtool -S eth3 | grep ptp_rq + ptp_rq0_packets: 0 + ptp_rq0_bytes: 0 + ptp_rq0_csum_complete: 0 + ptp_rq0_csum_complete_tail: 0 + ptp_rq0_csum_complete_tail_slow : 0 + ptp_rq0_csum_unnecessary: 0 + ptp_rq0_csum_unnecessary_inner: 0 + ptp_rq0_csum_none: 0 + ptp_rq0_xdp_drop: 0 + ptp_rq0_xdp_redirect: 0 + ptp_rq0_lro_packets: 0 + ptp_rq0_lro_bytes: 0 + ptp_rq0_ecn_mark: 0 + ptp_rq0_removed_vlan_packets: 0 + ptp_rq0_wqe_err: 0 + ptp_rq0_mpwqe_filler_cqes: 0 + ptp_rq0_mpwqe_filler_strides: 0 + ptp_rq0_oversize_pkts_sw_drop: 0 + ptp_rq0_buff_alloc_err: 0 + ptp_rq0_cqe_compress_blks: 0 + ptp_rq0_cqe_compress_pkts: 0 + ptp_rq0_cache_reuse: 0 + ptp_rq0_cache_full: 0 + ptp_rq0_cache_empty: 256 + ptp_rq0_cache_busy: 0 + ptp_rq0_cache_waive: 0 + ptp_rq0_congst_umr: 0 + ptp_rq0_arfs_err: 0 + ptp_rq0_recover: 0 + +Fixes: a28359e922c6 ("net/mlx5e: Add PTP-RX statistics") +Signed-off-by: Lama Kayal +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c | 3 +-- + drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h | 2 ++ + drivers/net/ethernet/mellanox/mlx5/core/en_stats.c | 3 ++- + 3 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +index efef4adce086..93a8fa31255d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c +@@ -13,8 +13,6 @@ struct mlx5e_ptp_fs { + bool valid; + }; + +-#define MLX5E_PTP_CHANNEL_IX 0 +- + struct mlx5e_ptp_params { + struct mlx5e_params params; + struct mlx5e_sq_param txq_sq_param; +@@ -505,6 +503,7 @@ static int mlx5e_init_ptp_rq(struct mlx5e_ptp *c, struct mlx5e_params *params, + rq->mdev = mdev; + rq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu); + rq->stats = &c->priv->ptp_stats.rq; ++ rq->ix = MLX5E_PTP_CHANNEL_IX; + rq->ptp_cyc2time = mlx5_rq_ts_translator(mdev); + err = mlx5e_rq_set_handlers(rq, params, false); + if (err) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h +index c96668bd701c..a71a32e00ebb 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h +@@ -8,6 +8,8 @@ + #include "en_stats.h" + #include + ++#define MLX5E_PTP_CHANNEL_IX 0 ++ + struct mlx5e_ptpsq { + struct mlx5e_txqsq txqsq; + struct mlx5e_cq ts_cq; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +index 46bf78169f63..e1dd17019030 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +@@ -34,6 +34,7 @@ + #include "en.h" + #include "en_accel/tls.h" + #include "en_accel/en_accel.h" ++#include "en/ptp.h" + + static unsigned int stats_grps_num(struct mlx5e_priv *priv) + { +@@ -2076,7 +2077,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS(ptp) + if (priv->rx_ptp_opened) { + for (i = 0; i < NUM_PTP_RQ_STATS; i++) + sprintf(data + (idx++) * ETH_GSTRING_LEN, +- ptp_rq_stats_desc[i].format); ++ ptp_rq_stats_desc[i].format, MLX5E_PTP_CHANNEL_IX); + } + return idx; + } +-- +2.33.0 + diff --git a/queue-5.14/net-mlx5e-ipsec-rx-enable-checksum-complete.patch b/queue-5.14/net-mlx5e-ipsec-rx-enable-checksum-complete.patch new file mode 100644 index 00000000000..95511837db3 --- /dev/null +++ b/queue-5.14/net-mlx5e-ipsec-rx-enable-checksum-complete.patch @@ -0,0 +1,53 @@ +From beb624fb87d0840892229c1db62062af796ba5cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 17:07:17 +0300 +Subject: net/mlx5e: IPSEC RX, enable checksum complete + +From: Raed Salem + +[ Upstream commit f9a10440f0b1f33faa792af26f4e9823a9b8b6a4 ] + +Currently in Rx data path IPsec crypto offloaded packets uses +csum_none flag, so checksum is handled by the stack, this naturally +have some performance/cpu utilization impact on such flows. As Nvidia +NIC starting from ConnectX6DX provides checksum complete value out of +the box also for such flows there is no sense in taking csum_none path, +furthermore the stack (xfrm) have the method to handle checksum complete +corrections for such flows i.e. IPsec trailer removal and consequently +checksum value adjustment. + +Because of the above and in addition the ConnectX6DX is the first HW +which supports IPsec crypto offload then it is safe to report csum +complete for IPsec offloaded traffic. + +Fixes: b2ac7541e377 ("net/mlx5e: IPsec: Add Connect-X IPsec Rx data path offload") +Signed-off-by: Raed Salem +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +index 3c65fd0bcf31..29a6586ef28d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -1001,14 +1001,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev, + goto csum_unnecessary; + + if (likely(is_last_ethertype_ip(skb, &network_depth, &proto))) { +- u8 ipproto = get_ip_proto(skb, network_depth, proto); +- +- if (unlikely(ipproto == IPPROTO_SCTP)) ++ if (unlikely(get_ip_proto(skb, network_depth, proto) == IPPROTO_SCTP)) + goto csum_unnecessary; + +- if (unlikely(mlx5_ipsec_is_rx_flow(cqe))) +- goto csum_none; +- + stats->csum_complete++; + skb->ip_summed = CHECKSUM_COMPLETE; + skb->csum = csum_unfold((__force __sum16)cqe->check_sum); +-- +2.33.0 + diff --git a/queue-5.14/net-mlx5e-keep-the-value-for-maximum-number-of-chann.patch b/queue-5.14/net-mlx5e-keep-the-value-for-maximum-number-of-chann.patch new file mode 100644 index 00000000000..72402d422f3 --- /dev/null +++ b/queue-5.14/net-mlx5e-keep-the-value-for-maximum-number-of-chann.patch @@ -0,0 +1,358 @@ +From cf85479d857d5f8f3455a08b6e655f8893b5798b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Sep 2021 10:33:32 +0300 +Subject: net/mlx5e: Keep the value for maximum number of channels in-sync + +From: Tariq Toukan + +[ Upstream commit 9d758d4a3a039b9d7086d4759ed255b748713eee ] + +The value for maximum number of channels is first calculated based +on the netdev's profile and current function resources (specifically, +number of MSIX vectors, which depends among other things on the number +of online cores in the system). +This value is then used to calculate the netdev's number of rxqs/txqs. +Once created (by alloc_etherdev_mqs), the number of netdev's rxqs/txqs +is constant and we must not exceed it. + +To achieve this, keep the maximum number of channels in sync upon any +netdevice re-attach. + +Use mlx5e_get_max_num_channels() for calculating the number of netdev's +rxqs/txqs. After netdev is created, use mlx5e_calc_max_nch() (which +coinsiders core device resources, profile, and netdev) to init or +update priv->max_nch. + +Before this patch, the value of priv->max_nch might get out of sync, +mistakenly allowing accesses to out-of-bounds objects, which would +crash the system. + +Track the number of channels stats structures used in a separate +field, as they are persistent to suspend/resume operations. All the +collected stats of every channel index that ever existed should be +preserved. They are reset only when struct mlx5e_priv is, +in mlx5e_priv_cleanup(), which is part of the profile changing flow. + +There is no point anymore in blocking a profile change due to max_nch +mismatch in mlx5e_netdev_change_profile(). Remove the limitation. + +Fixes: a1f240f18017 ("net/mlx5e: Adjust to max number of channles when re-attaching") +Signed-off-by: Tariq Toukan +Reviewed-by: Aya Levin +Reviewed-by: Maxim Mikityanskiy +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en.h | 11 ++-- + .../mellanox/mlx5/core/en/hv_vhca_stats.c | 6 +- + .../net/ethernet/mellanox/mlx5/core/en_main.c | 59 ++++++++++++++----- + .../net/ethernet/mellanox/mlx5/core/en_rep.c | 3 +- + .../ethernet/mellanox/mlx5/core/en_stats.c | 8 +-- + .../ethernet/mellanox/mlx5/core/ipoib/ipoib.c | 4 +- + 6 files changed, 57 insertions(+), 34 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index 3f67efbe12fc..dcbdf746be35 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -863,6 +863,7 @@ struct mlx5e_priv { + struct mlx5e_channel_stats channel_stats[MLX5E_MAX_NUM_CHANNELS]; + struct mlx5e_channel_stats trap_stats; + struct mlx5e_ptp_stats ptp_stats; ++ u16 stats_nch; + u16 max_nch; + u8 max_opened_tc; + bool tx_ptp_opened; +@@ -1156,12 +1157,6 @@ int mlx5e_ethtool_set_pauseparam(struct mlx5e_priv *priv, + struct ethtool_pauseparam *pauseparam); + + /* mlx5e generic netdev management API */ +-static inline unsigned int +-mlx5e_calc_max_nch(struct mlx5e_priv *priv, const struct mlx5e_profile *profile) +-{ +- return priv->netdev->num_rx_queues / max_t(u8, profile->rq_groups, 1); +-} +- + static inline bool + mlx5e_tx_mpwqe_supported(struct mlx5_core_dev *mdev) + { +@@ -1170,11 +1165,13 @@ mlx5e_tx_mpwqe_supported(struct mlx5_core_dev *mdev) + } + + int mlx5e_priv_init(struct mlx5e_priv *priv, ++ const struct mlx5e_profile *profile, + struct net_device *netdev, + struct mlx5_core_dev *mdev); + void mlx5e_priv_cleanup(struct mlx5e_priv *priv); + struct net_device * +-mlx5e_create_netdev(struct mlx5_core_dev *mdev, unsigned int txqs, unsigned int rxqs); ++mlx5e_create_netdev(struct mlx5_core_dev *mdev, const struct mlx5e_profile *profile, ++ unsigned int txqs, unsigned int rxqs); + int mlx5e_attach_netdev(struct mlx5e_priv *priv); + void mlx5e_detach_netdev(struct mlx5e_priv *priv); + void mlx5e_destroy_netdev(struct mlx5e_priv *priv); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c +index ac44bbe95c5c..d290d7276b8d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c +@@ -35,7 +35,7 @@ static void mlx5e_hv_vhca_fill_stats(struct mlx5e_priv *priv, void *data, + { + int ch, i = 0; + +- for (ch = 0; ch < priv->max_nch; ch++) { ++ for (ch = 0; ch < priv->stats_nch; ch++) { + void *buf = data + i; + + if (WARN_ON_ONCE(buf + +@@ -51,7 +51,7 @@ static void mlx5e_hv_vhca_fill_stats(struct mlx5e_priv *priv, void *data, + static int mlx5e_hv_vhca_stats_buf_size(struct mlx5e_priv *priv) + { + return (sizeof(struct mlx5e_hv_vhca_per_ring_stats) * +- priv->max_nch); ++ priv->stats_nch); + } + + static void mlx5e_hv_vhca_stats_work(struct work_struct *work) +@@ -100,7 +100,7 @@ static void mlx5e_hv_vhca_stats_control(struct mlx5_hv_vhca_agent *agent, + sagent = &priv->stats_agent; + + block->version = MLX5_HV_VHCA_STATS_VERSION; +- block->rings = priv->max_nch; ++ block->rings = priv->stats_nch; + + if (!block->command) { + cancel_delayed_work_sync(&priv->stats_agent.work); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index fa718e71db2d..548e8e7fc956 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -3515,7 +3515,7 @@ void mlx5e_fold_sw_stats64(struct mlx5e_priv *priv, struct rtnl_link_stats64 *s) + { + int i; + +- for (i = 0; i < priv->max_nch; i++) { ++ for (i = 0; i < priv->stats_nch; i++) { + struct mlx5e_channel_stats *channel_stats = &priv->channel_stats[i]; + struct mlx5e_rq_stats *xskrq_stats = &channel_stats->xskrq; + struct mlx5e_rq_stats *rq_stats = &channel_stats->rq; +@@ -4661,8 +4661,6 @@ void mlx5e_build_nic_params(struct mlx5e_priv *priv, struct mlx5e_xsk *xsk, u16 + struct mlx5_core_dev *mdev = priv->mdev; + u8 rx_cq_period_mode; + +- priv->max_nch = mlx5e_calc_max_nch(priv, priv->profile); +- + params->sw_mtu = mtu; + params->hard_mtu = MLX5E_ETH_HARD_MTU; + params->num_channels = min_t(unsigned int, MLX5E_MAX_NUM_CHANNELS / 2, +@@ -5203,8 +5201,35 @@ static const struct mlx5e_profile mlx5e_nic_profile = { + .rx_ptp_support = true, + }; + ++static unsigned int ++mlx5e_calc_max_nch(struct mlx5_core_dev *mdev, struct net_device *netdev, ++ const struct mlx5e_profile *profile) ++ ++{ ++ unsigned int max_nch, tmp; ++ ++ /* core resources */ ++ max_nch = mlx5e_get_max_num_channels(mdev); ++ ++ /* netdev rx queues */ ++ tmp = netdev->num_rx_queues / max_t(u8, profile->rq_groups, 1); ++ max_nch = min_t(unsigned int, max_nch, tmp); ++ ++ /* netdev tx queues */ ++ tmp = netdev->num_tx_queues; ++ if (mlx5_qos_is_supported(mdev)) ++ tmp -= mlx5e_qos_max_leaf_nodes(mdev); ++ if (MLX5_CAP_GEN(mdev, ts_cqe_to_dest_cqn)) ++ tmp -= profile->max_tc; ++ tmp = tmp / profile->max_tc; ++ max_nch = min_t(unsigned int, max_nch, tmp); ++ ++ return max_nch; ++} ++ + /* mlx5e generic netdev management API (move to en_common.c) */ + int mlx5e_priv_init(struct mlx5e_priv *priv, ++ const struct mlx5e_profile *profile, + struct net_device *netdev, + struct mlx5_core_dev *mdev) + { +@@ -5212,6 +5237,8 @@ int mlx5e_priv_init(struct mlx5e_priv *priv, + priv->mdev = mdev; + priv->netdev = netdev; + priv->msglevel = MLX5E_MSG_LEVEL; ++ priv->max_nch = mlx5e_calc_max_nch(mdev, netdev, profile); ++ priv->stats_nch = priv->max_nch; + priv->max_opened_tc = 1; + + if (!alloc_cpumask_var(&priv->scratchpad.cpumask, GFP_KERNEL)) +@@ -5255,7 +5282,8 @@ void mlx5e_priv_cleanup(struct mlx5e_priv *priv) + } + + struct net_device * +-mlx5e_create_netdev(struct mlx5_core_dev *mdev, unsigned int txqs, unsigned int rxqs) ++mlx5e_create_netdev(struct mlx5_core_dev *mdev, const struct mlx5e_profile *profile, ++ unsigned int txqs, unsigned int rxqs) + { + struct net_device *netdev; + int err; +@@ -5266,7 +5294,7 @@ mlx5e_create_netdev(struct mlx5_core_dev *mdev, unsigned int txqs, unsigned int + return NULL; + } + +- err = mlx5e_priv_init(netdev_priv(netdev), netdev, mdev); ++ err = mlx5e_priv_init(netdev_priv(netdev), profile, netdev, mdev); + if (err) { + mlx5_core_err(mdev, "mlx5e_priv_init failed, err=%d\n", err); + goto err_free_netdev; +@@ -5308,7 +5336,7 @@ int mlx5e_attach_netdev(struct mlx5e_priv *priv) + clear_bit(MLX5E_STATE_DESTROYING, &priv->state); + + /* max number of channels may have changed */ +- max_nch = mlx5e_get_max_num_channels(priv->mdev); ++ max_nch = mlx5e_calc_max_nch(priv->mdev, priv->netdev, profile); + if (priv->channels.params.num_channels > max_nch) { + mlx5_core_warn(priv->mdev, "MLX5E: Reducing number of channels to %d\n", max_nch); + /* Reducing the number of channels - RXFH has to be reset, and +@@ -5317,6 +5345,13 @@ int mlx5e_attach_netdev(struct mlx5e_priv *priv) + priv->netdev->priv_flags &= ~IFF_RXFH_CONFIGURED; + priv->channels.params.num_channels = max_nch; + } ++ if (max_nch != priv->max_nch) { ++ mlx5_core_warn(priv->mdev, ++ "MLX5E: Updating max number of channels from %u to %u\n", ++ priv->max_nch, max_nch); ++ priv->max_nch = max_nch; ++ } ++ + /* 1. Set the real number of queues in the kernel the first time. + * 2. Set our default XPS cpumask. + * 3. Build the RQT. +@@ -5381,7 +5416,7 @@ mlx5e_netdev_attach_profile(struct net_device *netdev, struct mlx5_core_dev *mde + struct mlx5e_priv *priv = netdev_priv(netdev); + int err; + +- err = mlx5e_priv_init(priv, netdev, mdev); ++ err = mlx5e_priv_init(priv, new_profile, netdev, mdev); + if (err) { + mlx5_core_err(mdev, "mlx5e_priv_init failed, err=%d\n", err); + return err; +@@ -5407,20 +5442,12 @@ priv_cleanup: + int mlx5e_netdev_change_profile(struct mlx5e_priv *priv, + const struct mlx5e_profile *new_profile, void *new_ppriv) + { +- unsigned int new_max_nch = mlx5e_calc_max_nch(priv, new_profile); + const struct mlx5e_profile *orig_profile = priv->profile; + struct net_device *netdev = priv->netdev; + struct mlx5_core_dev *mdev = priv->mdev; + void *orig_ppriv = priv->ppriv; + int err, rollback_err; + +- /* sanity */ +- if (new_max_nch != priv->max_nch) { +- netdev_warn(netdev, "%s: Replacing profile with different max channels\n", +- __func__); +- return -EINVAL; +- } +- + /* cleanup old profile */ + mlx5e_detach_netdev(priv); + priv->profile->cleanup(priv); +@@ -5516,7 +5543,7 @@ static int mlx5e_probe(struct auxiliary_device *adev, + nch = mlx5e_get_max_num_channels(mdev); + txqs = nch * profile->max_tc + ptp_txqs + qos_sqs; + rxqs = nch * profile->rq_groups; +- netdev = mlx5e_create_netdev(mdev, txqs, rxqs); ++ netdev = mlx5e_create_netdev(mdev, profile, txqs, rxqs); + if (!netdev) { + mlx5_core_err(mdev, "mlx5e_create_netdev failed\n"); + return -ENOMEM; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index bf94bcb6fa5d..bec1d344481c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -561,7 +561,6 @@ static void mlx5e_build_rep_params(struct net_device *netdev) + MLX5_CQ_PERIOD_MODE_START_FROM_CQE : + MLX5_CQ_PERIOD_MODE_START_FROM_EQE; + +- priv->max_nch = mlx5e_calc_max_nch(priv, priv->profile); + params = &priv->channels.params; + + params->num_channels = MLX5E_REP_PARAMS_DEF_NUM_CHANNELS; +@@ -1151,7 +1150,7 @@ mlx5e_vport_vf_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) + nch = mlx5e_get_max_num_channels(dev); + txqs = nch * profile->max_tc; + rxqs = nch * profile->rq_groups; +- netdev = mlx5e_create_netdev(dev, txqs, rxqs); ++ netdev = mlx5e_create_netdev(dev, profile, txqs, rxqs); + if (!netdev) { + mlx5_core_warn(dev, + "Failed to create representor netdev for vport %d\n", +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +index e4f5b6395148..46bf78169f63 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c +@@ -450,7 +450,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(sw) + + memset(s, 0, sizeof(*s)); + +- for (i = 0; i < priv->max_nch; i++) { ++ for (i = 0; i < priv->stats_nch; i++) { + struct mlx5e_channel_stats *channel_stats = + &priv->channel_stats[i]; + int j; +@@ -2119,7 +2119,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(ptp) { return; } + + static MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS(channels) + { +- int max_nch = priv->max_nch; ++ int max_nch = priv->stats_nch; + + return (NUM_RQ_STATS * max_nch) + + (NUM_CH_STATS * max_nch) + +@@ -2133,7 +2133,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS(channels) + static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS(channels) + { + bool is_xsk = priv->xsk.ever_used; +- int max_nch = priv->max_nch; ++ int max_nch = priv->stats_nch; + int i, j, tc; + + for (i = 0; i < max_nch; i++) +@@ -2175,7 +2175,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS(channels) + static MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS(channels) + { + bool is_xsk = priv->xsk.ever_used; +- int max_nch = priv->max_nch; ++ int max_nch = priv->stats_nch; + int i, j, tc; + + for (i = 0; i < max_nch; i++) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c +index 620d638e1e8f..1c9de6eddef8 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c +@@ -113,7 +113,7 @@ static void mlx5i_grp_sw_update_stats(struct mlx5e_priv *priv) + struct mlx5e_sw_stats s = { 0 }; + int i, j; + +- for (i = 0; i < priv->max_nch; i++) { ++ for (i = 0; i < priv->stats_nch; i++) { + struct mlx5e_channel_stats *channel_stats; + struct mlx5e_rq_stats *rq_stats; + +@@ -729,7 +729,7 @@ static int mlx5_rdma_setup_rn(struct ib_device *ibdev, u32 port_num, + goto destroy_ht; + } + +- err = mlx5e_priv_init(epriv, netdev, mdev); ++ err = mlx5e_priv_init(epriv, prof, netdev, mdev); + if (err) + goto destroy_mdev_resources; + +-- +2.33.0 + diff --git a/queue-5.14/net-mscc-ocelot-fix-vcap-filters-remaining-active-af.patch b/queue-5.14/net-mscc-ocelot-fix-vcap-filters-remaining-active-af.patch new file mode 100644 index 00000000000..99e4c5d199f --- /dev/null +++ b/queue-5.14/net-mscc-ocelot-fix-vcap-filters-remaining-active-af.patch @@ -0,0 +1,63 @@ +From e95c0159afd9e6a301fd1df51ad703c884cc32e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 15:53:30 +0300 +Subject: net: mscc: ocelot: fix VCAP filters remaining active after being + deleted + +From: Vladimir Oltean + +[ Upstream commit 019d9329e7481cfaccbd8ed17b1e04ca76970f13 ] + +When ocelot_flower.c calls ocelot_vcap_filter_add(), the filter has a +given filter->id.cookie. This filter is added to the block->rules list. + +However, when ocelot_flower.c calls ocelot_vcap_block_find_filter_by_id() +which passes the cookie as argument, the filter is never found by +filter->id.cookie when searching through the block->rules list. + +This is unsurprising, since the filter->id.cookie is an unsigned long, +but the cookie argument provided to ocelot_vcap_block_find_filter_by_id() +is a signed int, and the comparison fails. + +Fixes: 50c6cc5b9283 ("net: mscc: ocelot: store a namespaced VCAP filter ID") +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20210930125330.2078625-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mscc/ocelot_vcap.c | 4 ++-- + include/soc/mscc/ocelot_vcap.h | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/mscc/ocelot_vcap.c b/drivers/net/ethernet/mscc/ocelot_vcap.c +index 7945393a0655..99d7376a70a7 100644 +--- a/drivers/net/ethernet/mscc/ocelot_vcap.c ++++ b/drivers/net/ethernet/mscc/ocelot_vcap.c +@@ -998,8 +998,8 @@ ocelot_vcap_block_find_filter_by_index(struct ocelot_vcap_block *block, + } + + struct ocelot_vcap_filter * +-ocelot_vcap_block_find_filter_by_id(struct ocelot_vcap_block *block, int cookie, +- bool tc_offload) ++ocelot_vcap_block_find_filter_by_id(struct ocelot_vcap_block *block, ++ unsigned long cookie, bool tc_offload) + { + struct ocelot_vcap_filter *filter; + +diff --git a/include/soc/mscc/ocelot_vcap.h b/include/soc/mscc/ocelot_vcap.h +index 25fd525aaf92..4869ebbd438d 100644 +--- a/include/soc/mscc/ocelot_vcap.h ++++ b/include/soc/mscc/ocelot_vcap.h +@@ -694,7 +694,7 @@ int ocelot_vcap_filter_add(struct ocelot *ocelot, + int ocelot_vcap_filter_del(struct ocelot *ocelot, + struct ocelot_vcap_filter *rule); + struct ocelot_vcap_filter * +-ocelot_vcap_block_find_filter_by_id(struct ocelot_vcap_block *block, int id, +- bool tc_offload); ++ocelot_vcap_block_find_filter_by_id(struct ocelot_vcap_block *block, ++ unsigned long cookie, bool tc_offload); + + #endif /* _OCELOT_VCAP_H_ */ +-- +2.33.0 + diff --git a/queue-5.14/net-pcs-xpcs-fix-incorrect-cl37-an-sequence.patch b/queue-5.14/net-pcs-xpcs-fix-incorrect-cl37-an-sequence.patch new file mode 100644 index 00000000000..50ab0c7f2ad --- /dev/null +++ b/queue-5.14/net-pcs-xpcs-fix-incorrect-cl37-an-sequence.patch @@ -0,0 +1,92 @@ +From f6e04ff3b4b299ca637b7c2d0ee4f3b584a410d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 11:45:21 +0800 +Subject: net: pcs: xpcs: fix incorrect CL37 AN sequence + +From: Wong Vee Khee + +[ Upstream commit e3cf002d5a4452f8adc5543df341cf96fd702fcf ] + +According to Synopsys DesignWare Cores Ethernet PCS databook, it is +required to disable Clause 37 auto-negotiation by programming bit-12 +(AN_ENABLE) to 0 if it is already enabled, before programming various +fields of VR_MII_AN_CTRL registers. + +After all these programming are done, it is then required to enable +Clause 37 auto-negotiation by programming bit-12 (AN_ENABLE) to 1. + +Fixes: b97b5331b8ab ("net: pcs: add C37 SGMII AN support for intel mGbE controller") +Cc: Vladimir Oltean +Signed-off-by: Wong Vee Khee +Reviewed-by: Vladimir Oltean +Tested-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/pcs/pcs-xpcs.c | 32 +++++++++++++++++++++++++++----- + 1 file changed, 27 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c +index 4bd61339823c..4a169545797b 100644 +--- a/drivers/net/pcs/pcs-xpcs.c ++++ b/drivers/net/pcs/pcs-xpcs.c +@@ -693,14 +693,17 @@ EXPORT_SYMBOL_GPL(xpcs_config_eee); + + static int xpcs_config_aneg_c37_sgmii(struct dw_xpcs *xpcs, unsigned int mode) + { +- int ret; ++ int ret, mdio_ctrl; + + /* For AN for C37 SGMII mode, the settings are :- +- * 1) VR_MII_AN_CTRL Bit(2:1)[PCS_MODE] = 10b (SGMII AN) +- * 2) VR_MII_AN_CTRL Bit(3) [TX_CONFIG] = 0b (MAC side SGMII) ++ * 1) VR_MII_MMD_CTRL Bit(12) [AN_ENABLE] = 0b (Disable SGMII AN in case ++ it is already enabled) ++ * 2) VR_MII_AN_CTRL Bit(2:1)[PCS_MODE] = 10b (SGMII AN) ++ * 3) VR_MII_AN_CTRL Bit(3) [TX_CONFIG] = 0b (MAC side SGMII) + * DW xPCS used with DW EQoS MAC is always MAC side SGMII. +- * 3) VR_MII_DIG_CTRL1 Bit(9) [MAC_AUTO_SW] = 1b (Automatic ++ * 4) VR_MII_DIG_CTRL1 Bit(9) [MAC_AUTO_SW] = 1b (Automatic + * speed/duplex mode change by HW after SGMII AN complete) ++ * 5) VR_MII_MMD_CTRL Bit(12) [AN_ENABLE] = 1b (Enable SGMII AN) + * + * Note: Since it is MAC side SGMII, there is no need to set + * SR_MII_AN_ADV. MAC side SGMII receives AN Tx Config from +@@ -708,6 +711,17 @@ static int xpcs_config_aneg_c37_sgmii(struct dw_xpcs *xpcs, unsigned int mode) + * between PHY and Link Partner. There is also no need to + * trigger AN restart for MAC-side SGMII. + */ ++ mdio_ctrl = xpcs_read(xpcs, MDIO_MMD_VEND2, DW_VR_MII_MMD_CTRL); ++ if (mdio_ctrl < 0) ++ return mdio_ctrl; ++ ++ if (mdio_ctrl & AN_CL37_EN) { ++ ret = xpcs_write(xpcs, MDIO_MMD_VEND2, DW_VR_MII_MMD_CTRL, ++ mdio_ctrl & ~AN_CL37_EN); ++ if (ret < 0) ++ return ret; ++ } ++ + ret = xpcs_read(xpcs, MDIO_MMD_VEND2, DW_VR_MII_AN_CTRL); + if (ret < 0) + return ret; +@@ -732,7 +746,15 @@ static int xpcs_config_aneg_c37_sgmii(struct dw_xpcs *xpcs, unsigned int mode) + else + ret &= ~DW_VR_MII_DIG_CTRL1_MAC_AUTO_SW; + +- return xpcs_write(xpcs, MDIO_MMD_VEND2, DW_VR_MII_DIG_CTRL1, ret); ++ ret = xpcs_write(xpcs, MDIO_MMD_VEND2, DW_VR_MII_DIG_CTRL1, ret); ++ if (ret < 0) ++ return ret; ++ ++ if (phylink_autoneg_inband(mode)) ++ ret = xpcs_write(xpcs, MDIO_MMD_VEND2, DW_VR_MII_MMD_CTRL, ++ mdio_ctrl | AN_CL37_EN); ++ ++ return ret; + } + + static int xpcs_config_2500basex(struct dw_xpcs *xpcs) +-- +2.33.0 + diff --git a/queue-5.14/net-pcs-xpcs-fix-incorrect-steps-on-disable-eee.patch b/queue-5.14/net-pcs-xpcs-fix-incorrect-steps-on-disable-eee.patch new file mode 100644 index 00000000000..310214abf49 --- /dev/null +++ b/queue-5.14/net-pcs-xpcs-fix-incorrect-steps-on-disable-eee.patch @@ -0,0 +1,63 @@ +From b9a1e7058227872156fe2049a35b1b04ce44a0f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 19:50:59 +0800 +Subject: net: pcs: xpcs: fix incorrect steps on disable EEE + +From: Wong Vee Khee + +[ Upstream commit 590df78bc7d1d0425196a8e11ce6676d7023fb26 ] + +When Energy-Efficient Ethernet(EEE) is disable from the MAC side, +we need to clear the DW_VR_MII_EEE_TRN_LPI bit of DW_VR_MII_EEE_MCTRL1 +register. + +Fixes: 7617af3d1a5e ("net: pcs: Introducing support for DWC xpcs Energy Efficient Ethernet") +Cc: Michael Sit Wei Hong +Signed-off-by: Wong Vee Khee +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/pcs/pcs-xpcs.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/pcs/pcs-xpcs.c b/drivers/net/pcs/pcs-xpcs.c +index 4a169545797b..d4ab03a92fb5 100644 +--- a/drivers/net/pcs/pcs-xpcs.c ++++ b/drivers/net/pcs/pcs-xpcs.c +@@ -662,6 +662,10 @@ int xpcs_config_eee(struct dw_xpcs *xpcs, int mult_fact_100ns, int enable) + { + int ret; + ++ ret = xpcs_read(xpcs, MDIO_MMD_VEND2, DW_VR_MII_EEE_MCTRL0); ++ if (ret < 0) ++ return ret; ++ + if (enable) { + /* Enable EEE */ + ret = DW_VR_MII_EEE_LTX_EN | DW_VR_MII_EEE_LRX_EN | +@@ -669,9 +673,6 @@ int xpcs_config_eee(struct dw_xpcs *xpcs, int mult_fact_100ns, int enable) + DW_VR_MII_EEE_TX_EN_CTRL | DW_VR_MII_EEE_RX_EN_CTRL | + mult_fact_100ns << DW_VR_MII_EEE_MULT_FACT_100NS_SHIFT; + } else { +- ret = xpcs_read(xpcs, MDIO_MMD_VEND2, DW_VR_MII_EEE_MCTRL0); +- if (ret < 0) +- return ret; + ret &= ~(DW_VR_MII_EEE_LTX_EN | DW_VR_MII_EEE_LRX_EN | + DW_VR_MII_EEE_TX_QUIET_EN | DW_VR_MII_EEE_RX_QUIET_EN | + DW_VR_MII_EEE_TX_EN_CTRL | DW_VR_MII_EEE_RX_EN_CTRL | +@@ -686,7 +687,11 @@ int xpcs_config_eee(struct dw_xpcs *xpcs, int mult_fact_100ns, int enable) + if (ret < 0) + return ret; + +- ret |= DW_VR_MII_EEE_TRN_LPI; ++ if (enable) ++ ret |= DW_VR_MII_EEE_TRN_LPI; ++ else ++ ret &= ~DW_VR_MII_EEE_TRN_LPI; ++ + return xpcs_write(xpcs, MDIO_MMD_VEND2, DW_VR_MII_EEE_MCTRL1, ret); + } + EXPORT_SYMBOL_GPL(xpcs_config_eee); +-- +2.33.0 + diff --git a/queue-5.14/net-prefer-socket-bound-to-interface-when-not-in-vrf.patch b/queue-5.14/net-prefer-socket-bound-to-interface-when-not-in-vrf.patch new file mode 100644 index 00000000000..49e6a0d8d03 --- /dev/null +++ b/queue-5.14/net-prefer-socket-bound-to-interface-when-not-in-vrf.patch @@ -0,0 +1,98 @@ +From 2f36c01034ebfca5c86dca9a2c049499338cbb24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 14:03:42 +0100 +Subject: net: prefer socket bound to interface when not in VRF + +From: Mike Manning + +[ Upstream commit 8d6c414cd2fb74aa6812e9bfec6178f8246c4f3a ] + +The commit 6da5b0f027a8 ("net: ensure unbound datagram socket to be +chosen when not in a VRF") modified compute_score() so that a device +match is always made, not just in the case of an l3mdev skb, then +increments the score also for unbound sockets. This ensures that +sockets bound to an l3mdev are never selected when not in a VRF. +But as unbound and bound sockets are now scored equally, this results +in the last opened socket being selected if there are matches in the +default VRF for an unbound socket and a socket bound to a dev that is +not an l3mdev. However, handling prior to this commit was to always +select the bound socket in this case. Reinstate this handling by +incrementing the score only for bound sockets. The required isolation +due to choosing between an unbound socket and a socket bound to an +l3mdev remains in place due to the device match always being made. +The same approach is taken for compute_score() for stream sockets. + +Fixes: 6da5b0f027a8 ("net: ensure unbound datagram socket to be chosen when not in a VRF") +Fixes: e78190581aff ("net: ensure unbound stream socket to be chosen when not in a VRF") +Signed-off-by: Mike Manning +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/cf0a8523-b362-1edf-ee78-eef63cbbb428@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/inet_hashtables.c | 4 +++- + net/ipv4/udp.c | 3 ++- + net/ipv6/inet6_hashtables.c | 2 +- + net/ipv6/udp.c | 3 ++- + 4 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index 80aeaf9e6e16..bfb522e51346 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -242,8 +242,10 @@ static inline int compute_score(struct sock *sk, struct net *net, + + if (!inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif)) + return -1; ++ score = sk->sk_bound_dev_if ? 2 : 1; + +- score = sk->sk_family == PF_INET ? 2 : 1; ++ if (sk->sk_family == PF_INET) ++ score++; + if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id()) + score++; + } +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 915ea635b2d5..cbc7907f79b8 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -390,7 +390,8 @@ static int compute_score(struct sock *sk, struct net *net, + dif, sdif); + if (!dev_match) + return -1; +- score += 4; ++ if (sk->sk_bound_dev_if) ++ score += 4; + + if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id()) + score++; +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c +index 55c290d55605..67c9114835c8 100644 +--- a/net/ipv6/inet6_hashtables.c ++++ b/net/ipv6/inet6_hashtables.c +@@ -106,7 +106,7 @@ static inline int compute_score(struct sock *sk, struct net *net, + if (!inet_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif)) + return -1; + +- score = 1; ++ score = sk->sk_bound_dev_if ? 2 : 1; + if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id()) + score++; + } +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 80ae024d13c8..ba77955d75fb 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -133,7 +133,8 @@ static int compute_score(struct sock *sk, struct net *net, + dev_match = udp_sk_bound_dev_eq(net, sk->sk_bound_dev_if, dif, sdif); + if (!dev_match) + return -1; +- score++; ++ if (sk->sk_bound_dev_if) ++ score++; + + if (READ_ONCE(sk->sk_incoming_cpu) == raw_smp_processor_id()) + score++; +-- +2.33.0 + diff --git a/queue-5.14/net-sched-sch_taprio-properly-cancel-timer-from-tapr.patch b/queue-5.14/net-sched-sch_taprio-properly-cancel-timer-from-tapr.patch new file mode 100644 index 00000000000..e07b24f39da --- /dev/null +++ b/queue-5.14/net-sched-sch_taprio-properly-cancel-timer-from-tapr.patch @@ -0,0 +1,94 @@ +From 3d267f98c9fd8fb5596dae6feb3b5a798d338538 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 12:55:22 -0700 +Subject: net/sched: sch_taprio: properly cancel timer from taprio_destroy() + +From: Eric Dumazet + +[ Upstream commit a56d447f196fa9973c568f54c0d76d5391c3b0c0 ] + +There is a comment in qdisc_create() about us not calling ops->reset() +in some cases. + +err_out4: + /* + * Any broken qdiscs that would require a ops->reset() here? + * The qdisc was never in action so it shouldn't be necessary. + */ + +As taprio sets a timer before actually receiving a packet, we need +to cancel it from ops->destroy, just in case ops->reset has not +been called. + +syzbot reported: + +ODEBUG: free active (active state 0) object type: hrtimer hint: advance_sched+0x0/0x9a0 arch/x86/include/asm/atomic64_64.h:22 +WARNING: CPU: 0 PID: 8441 at lib/debugobjects.c:505 debug_print_object+0x16e/0x250 lib/debugobjects.c:505 +Modules linked in: +CPU: 0 PID: 8441 Comm: syz-executor813 Not tainted 5.14.0-rc6-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +RIP: 0010:debug_print_object+0x16e/0x250 lib/debugobjects.c:505 +Code: ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 af 00 00 00 48 8b 14 dd e0 d3 e3 89 4c 89 ee 48 c7 c7 e0 c7 e3 89 e8 5b 86 11 05 <0f> 0b 83 05 85 03 92 09 01 48 83 c4 18 5b 5d 41 5c 41 5d 41 5e c3 +RSP: 0018:ffffc9000130f330 EFLAGS: 00010282 +RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 +RDX: ffff88802baeb880 RSI: ffffffff815d87b5 RDI: fffff52000261e58 +RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 +R10: ffffffff815d25ee R11: 0000000000000000 R12: ffffffff898dd020 +R13: ffffffff89e3ce20 R14: ffffffff81653630 R15: dffffc0000000000 +FS: 0000000000f0d300(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007ffb64b3e000 CR3: 0000000036557000 CR4: 00000000001506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + __debug_check_no_obj_freed lib/debugobjects.c:987 [inline] + debug_check_no_obj_freed+0x301/0x420 lib/debugobjects.c:1018 + slab_free_hook mm/slub.c:1603 [inline] + slab_free_freelist_hook+0x171/0x240 mm/slub.c:1653 + slab_free mm/slub.c:3213 [inline] + kfree+0xe4/0x540 mm/slub.c:4267 + qdisc_create+0xbcf/0x1320 net/sched/sch_api.c:1299 + tc_modify_qdisc+0x4c8/0x1a60 net/sched/sch_api.c:1663 + rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5571 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 + netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 + netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:724 + ____sys_sendmsg+0x6e8/0x810 net/socket.c:2403 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2457 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2486 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + +Fixes: 44d4775ca518 ("net/sched: sch_taprio: reset child qdiscs before freeing them") +Signed-off-by: Eric Dumazet +Cc: Davide Caratti +Reported-by: syzbot +Acked-by: Vinicius Costa Gomes +Acked-by: Davide Caratti +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_taprio.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index 1ab2fc933a21..b9fd18d98646 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1641,6 +1641,10 @@ static void taprio_destroy(struct Qdisc *sch) + list_del(&q->taprio_list); + spin_unlock(&taprio_list_lock); + ++ /* Note that taprio_reset() might not be called if an error ++ * happens in qdisc_create(), after taprio_init() has been called. ++ */ ++ hrtimer_cancel(&q->advance_timer); + + taprio_disable_offload(dev, q, NULL); + +-- +2.33.0 + diff --git a/queue-5.14/net-sfp-fix-typo-in-state-machine-debug-string.patch b/queue-5.14/net-sfp-fix-typo-in-state-machine-debug-string.patch new file mode 100644 index 00000000000..f0300c6e0e9 --- /dev/null +++ b/queue-5.14/net-sfp-fix-typo-in-state-machine-debug-string.patch @@ -0,0 +1,36 @@ +From f8a11c3a4e79ec0324493fc05de2a1b6181e825a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 17:50:02 -0400 +Subject: net: sfp: Fix typo in state machine debug string + +From: Sean Anderson + +[ Upstream commit 25a9da6641f1f66006e93ddbefee13a437efa8c0 ] + +The string should be "tx_disable" to match the state enum. + +Fixes: 4005a7cb4f55 ("net: phy: sftp: print debug message with text, not numbers") +Signed-off-by: Sean Anderson +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/sfp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index 34e90216bd2c..ab77a9f439ef 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -134,7 +134,7 @@ static const char * const sm_state_strings[] = { + [SFP_S_LINK_UP] = "link_up", + [SFP_S_TX_FAULT] = "tx_fault", + [SFP_S_REINIT] = "reinit", +- [SFP_S_TX_DISABLE] = "rx_disable", ++ [SFP_S_TX_DISABLE] = "tx_disable", + }; + + static const char *sm_state_to_str(unsigned short sm_state) +-- +2.33.0 + diff --git a/queue-5.14/net-stmmac-dwmac-rk-fix-ethernet-on-rk3399-based-dev.patch b/queue-5.14/net-stmmac-dwmac-rk-fix-ethernet-on-rk3399-based-dev.patch new file mode 100644 index 00000000000..c992ce802e9 --- /dev/null +++ b/queue-5.14/net-stmmac-dwmac-rk-fix-ethernet-on-rk3399-based-dev.patch @@ -0,0 +1,63 @@ +From 57082bd1a0f34b73301cf78d0de92cd802ba1289 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 22:50:49 +0900 +Subject: net: stmmac: dwmac-rk: Fix ethernet on rk3399 based devices + +From: Punit Agrawal + +[ Upstream commit aec3f415f7244b7747a7952596971adb0df2f568 ] + +Commit 2d26f6e39afb ("net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable warnings") +while getting rid of a runtime PM warning ended up breaking ethernet +on rk3399 based devices. By dropping an extra reference to the device, +the commit ends up enabling suspend / resume of the ethernet device - +which appears to be broken. + +While the issue with runtime pm is being investigated, partially +revert commit 2d26f6e39afb to restore the network on rk3399. + +Fixes: 2d26f6e39afb ("net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable warnings") +Suggested-by: Heiko Stuebner +Signed-off-by: Punit Agrawal +Cc: Michael Riesch +Tested-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20210929135049.3426058-1-punitagrawal@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +index ed817011a94a..6924a6aacbd5 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #include "stmmac_platform.h" + +@@ -1528,6 +1529,8 @@ static int rk_gmac_powerup(struct rk_priv_data *bsp_priv) + return ret; + } + ++ pm_runtime_get_sync(dev); ++ + if (bsp_priv->integrated_phy) + rk_gmac_integrated_phy_powerup(bsp_priv); + +@@ -1539,6 +1542,8 @@ static void rk_gmac_powerdown(struct rk_priv_data *gmac) + if (gmac->integrated_phy) + rk_gmac_integrated_phy_powerdown(gmac); + ++ pm_runtime_put_sync(&gmac->pdev->dev); ++ + phy_power_on(gmac, false); + gmac_clk_enable(gmac, false); + } +-- +2.33.0 + diff --git a/queue-5.14/net-stmmac-trigger-pcs-eee-to-turn-off-on-link-down.patch b/queue-5.14/net-stmmac-trigger-pcs-eee-to-turn-off-on-link-down.patch new file mode 100644 index 00000000000..efdb38af995 --- /dev/null +++ b/queue-5.14/net-stmmac-trigger-pcs-eee-to-turn-off-on-link-down.patch @@ -0,0 +1,49 @@ +From 2cb5389b763b6edfc1be97701dd3226db0af39b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 19:51:00 +0800 +Subject: net: stmmac: trigger PCS EEE to turn off on link down + +From: Wong Vee Khee + +[ Upstream commit d4aeaed80b0ebb020fadf2073b23462928dbdc17 ] + +The current implementation enable PCS EEE feature in the event of link +up, but PCS EEE feature is not disabled on link down. + +This patch makes sure PCE EEE feature is disabled on link down. + +Fixes: 656ed8b015f1 ("net: stmmac: fix EEE init issue when paired with EEE capable PHYs") +Signed-off-by: Wong Vee Khee +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 86151a817b79..6b2a5e5769e8 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -477,6 +477,10 @@ bool stmmac_eee_init(struct stmmac_priv *priv) + stmmac_lpi_entry_timer_config(priv, 0); + del_timer_sync(&priv->eee_ctrl_timer); + stmmac_set_eee_timer(priv, priv->hw, 0, eee_tw_timer); ++ if (priv->hw->xpcs) ++ xpcs_config_eee(priv->hw->xpcs, ++ priv->plat->mult_fact_100ns, ++ false); + } + mutex_unlock(&priv->lock); + return false; +@@ -1038,7 +1042,7 @@ static void stmmac_mac_link_down(struct phylink_config *config, + stmmac_mac_set(priv, priv->ioaddr, false); + priv->eee_active = false; + priv->tx_lpi_enabled = false; +- stmmac_eee_init(priv); ++ priv->eee_enabled = stmmac_eee_init(priv); + stmmac_set_eee_pls(priv, priv->hw, false); + + if (priv->dma_cap.fpesel) +-- +2.33.0 + diff --git a/queue-5.14/net_sched-fix-null-deref-in-fifo_set_limit.patch b/queue-5.14/net_sched-fix-null-deref-in-fifo_set_limit.patch new file mode 100644 index 00000000000..02a4b69e9b5 --- /dev/null +++ b/queue-5.14/net_sched-fix-null-deref-in-fifo_set_limit.patch @@ -0,0 +1,87 @@ +From fac3dbba0f794eed14f8178590144311fe6e892e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 14:22:39 -0700 +Subject: net_sched: fix NULL deref in fifo_set_limit() + +From: Eric Dumazet + +[ Upstream commit 560ee196fe9e5037e5015e2cdb14b3aecb1cd7dc ] + +syzbot reported another NULL deref in fifo_set_limit() [1] + +I could repro the issue with : + +unshare -n +tc qd add dev lo root handle 1:0 tbf limit 200000 burst 70000 rate 100Mbit +tc qd replace dev lo parent 1:0 pfifo_fast +tc qd change dev lo root handle 1:0 tbf limit 300000 burst 70000 rate 100Mbit + +pfifo_fast does not have a change() operation. +Make fifo_set_limit() more robust about this. + +[1] +BUG: kernel NULL pointer dereference, address: 0000000000000000 +PGD 1cf99067 P4D 1cf99067 PUD 7ca49067 PMD 0 +Oops: 0010 [#1] PREEMPT SMP KASAN +CPU: 1 PID: 14443 Comm: syz-executor959 Not tainted 5.15.0-rc3-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +RIP: 0010:0x0 +Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. +RSP: 0018:ffffc9000e2f7310 EFLAGS: 00010246 +RAX: dffffc0000000000 RBX: ffffffff8d6ecc00 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: ffff888024c27910 RDI: ffff888071e34000 +RBP: ffff888071e34000 R08: 0000000000000001 R09: ffffffff8fcfb947 +R10: 0000000000000001 R11: 0000000000000000 R12: ffff888024c27910 +R13: ffff888071e34018 R14: 0000000000000000 R15: ffff88801ef74800 +FS: 00007f321d897700(0000) GS:ffff8880b9d00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: ffffffffffffffd6 CR3: 00000000722c3000 CR4: 00000000003506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + fifo_set_limit net/sched/sch_fifo.c:242 [inline] + fifo_set_limit+0x198/0x210 net/sched/sch_fifo.c:227 + tbf_change+0x6ec/0x16d0 net/sched/sch_tbf.c:418 + qdisc_change net/sched/sch_api.c:1332 [inline] + tc_modify_qdisc+0xd9a/0x1a60 net/sched/sch_api.c:1634 + rtnetlink_rcv_msg+0x413/0xb80 net/core/rtnetlink.c:5572 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 + netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 + netlink_sendmsg+0x86d/0xdb0 net/netlink/af_netlink.c:1929 + sock_sendmsg_nosec net/socket.c:704 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:724 + ____sys_sendmsg+0x6e8/0x810 net/socket.c:2409 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2463 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2492 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: fb0305ce1b03 ("net-sched: consolidate default fifo qdisc setup") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Link: https://lore.kernel.org/r/20210930212239.3430364-1-eric.dumazet@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_fifo.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c +index a579a4131d22..e1040421b797 100644 +--- a/net/sched/sch_fifo.c ++++ b/net/sched/sch_fifo.c +@@ -233,6 +233,9 @@ int fifo_set_limit(struct Qdisc *q, unsigned int limit) + if (strncmp(q->ops->id + 1, "fifo", 4) != 0) + return 0; + ++ if (!q->ops->change) ++ return 0; ++ + nla = kmalloc(nla_attr_size(sizeof(struct tc_fifo_qopt)), GFP_KERNEL); + if (nla) { + nla->nla_type = RTM_NEWQDISC; +-- +2.33.0 + diff --git a/queue-5.14/netfilter-conntrack-fix-boot-failure-with-nf_conntra.patch b/queue-5.14/netfilter-conntrack-fix-boot-failure-with-nf_conntra.patch new file mode 100644 index 00000000000..b9ab36d0def --- /dev/null +++ b/queue-5.14/netfilter-conntrack-fix-boot-failure-with-nf_conntra.patch @@ -0,0 +1,240 @@ +From 98834709e5f508224db96bf081062d3b76b59851 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 16:44:34 +0200 +Subject: netfilter: conntrack: fix boot failure with + nf_conntrack.enable_hooks=1 + +From: Florian Westphal + +[ Upstream commit 339031bafe6b281cf2dcb8364217288b9fdab555 ] + +This is a revert of +7b1957b049 ("netfilter: nf_defrag_ipv4: use net_generic infra") +and a partial revert of +8b0adbe3e3 ("netfilter: nf_defrag_ipv6: use net_generic infra"). + +If conntrack is builtin and kernel is booted with: +nf_conntrack.enable_hooks=1 + +.... kernel will fail to boot due to a NULL deref in +nf_defrag_ipv4_enable(): Its called before the ipv4 defrag initcall is +made, so net_generic() returns NULL. + +To resolve this, move the user refcount back to struct net so calls +to those functions are possible even before their initcalls have run. + +Fixes: 7b1957b04956 ("netfilter: nf_defrag_ipv4: use net_generic infra") +Fixes: 8b0adbe3e38d ("netfilter: nf_defrag_ipv6: use net_generic infra"). +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/ipv6/nf_defrag_ipv6.h | 1 - + include/net/netns/netfilter.h | 6 +++++ + net/ipv4/netfilter/nf_defrag_ipv4.c | 30 +++++++-------------- + net/ipv6/netfilter/nf_conntrack_reasm.c | 2 +- + net/ipv6/netfilter/nf_defrag_ipv6_hooks.c | 25 +++++++---------- + 5 files changed, 25 insertions(+), 39 deletions(-) + +diff --git a/include/net/netfilter/ipv6/nf_defrag_ipv6.h b/include/net/netfilter/ipv6/nf_defrag_ipv6.h +index 0fd8a4159662..ceadf8ba25a4 100644 +--- a/include/net/netfilter/ipv6/nf_defrag_ipv6.h ++++ b/include/net/netfilter/ipv6/nf_defrag_ipv6.h +@@ -17,7 +17,6 @@ struct inet_frags_ctl; + struct nft_ct_frag6_pernet { + struct ctl_table_header *nf_frag_frags_hdr; + struct fqdir *fqdir; +- unsigned int users; + }; + + #endif /* _NF_DEFRAG_IPV6_H */ +diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h +index 15e2b13fb0c0..71343b969cd3 100644 +--- a/include/net/netns/netfilter.h ++++ b/include/net/netns/netfilter.h +@@ -28,5 +28,11 @@ struct netns_nf { + #if IS_ENABLED(CONFIG_DECNET) + struct nf_hook_entries __rcu *hooks_decnet[NF_DN_NUMHOOKS]; + #endif ++#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4) ++ unsigned int defrag_ipv4_users; ++#endif ++#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) ++ unsigned int defrag_ipv6_users; ++#endif + }; + #endif +diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c +index 613432a36f0a..e61ea428ea18 100644 +--- a/net/ipv4/netfilter/nf_defrag_ipv4.c ++++ b/net/ipv4/netfilter/nf_defrag_ipv4.c +@@ -20,13 +20,8 @@ + #endif + #include + +-static unsigned int defrag4_pernet_id __read_mostly; + static DEFINE_MUTEX(defrag4_mutex); + +-struct defrag4_pernet { +- unsigned int users; +-}; +- + static int nf_ct_ipv4_gather_frags(struct net *net, struct sk_buff *skb, + u_int32_t user) + { +@@ -111,19 +106,15 @@ static const struct nf_hook_ops ipv4_defrag_ops[] = { + + static void __net_exit defrag4_net_exit(struct net *net) + { +- struct defrag4_pernet *nf_defrag = net_generic(net, defrag4_pernet_id); +- +- if (nf_defrag->users) { ++ if (net->nf.defrag_ipv4_users) { + nf_unregister_net_hooks(net, ipv4_defrag_ops, + ARRAY_SIZE(ipv4_defrag_ops)); +- nf_defrag->users = 0; ++ net->nf.defrag_ipv4_users = 0; + } + } + + static struct pernet_operations defrag4_net_ops = { + .exit = defrag4_net_exit, +- .id = &defrag4_pernet_id, +- .size = sizeof(struct defrag4_pernet), + }; + + static int __init nf_defrag_init(void) +@@ -138,24 +129,23 @@ static void __exit nf_defrag_fini(void) + + int nf_defrag_ipv4_enable(struct net *net) + { +- struct defrag4_pernet *nf_defrag = net_generic(net, defrag4_pernet_id); + int err = 0; + + mutex_lock(&defrag4_mutex); +- if (nf_defrag->users == UINT_MAX) { ++ if (net->nf.defrag_ipv4_users == UINT_MAX) { + err = -EOVERFLOW; + goto out_unlock; + } + +- if (nf_defrag->users) { +- nf_defrag->users++; ++ if (net->nf.defrag_ipv4_users) { ++ net->nf.defrag_ipv4_users++; + goto out_unlock; + } + + err = nf_register_net_hooks(net, ipv4_defrag_ops, + ARRAY_SIZE(ipv4_defrag_ops)); + if (err == 0) +- nf_defrag->users = 1; ++ net->nf.defrag_ipv4_users = 1; + + out_unlock: + mutex_unlock(&defrag4_mutex); +@@ -165,12 +155,10 @@ EXPORT_SYMBOL_GPL(nf_defrag_ipv4_enable); + + void nf_defrag_ipv4_disable(struct net *net) + { +- struct defrag4_pernet *nf_defrag = net_generic(net, defrag4_pernet_id); +- + mutex_lock(&defrag4_mutex); +- if (nf_defrag->users) { +- nf_defrag->users--; +- if (nf_defrag->users == 0) ++ if (net->nf.defrag_ipv4_users) { ++ net->nf.defrag_ipv4_users--; ++ if (net->nf.defrag_ipv4_users == 0) + nf_unregister_net_hooks(net, ipv4_defrag_ops, + ARRAY_SIZE(ipv4_defrag_ops)); + } +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index a0108415275f..5c47be29b9ee 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -33,7 +33,7 @@ + + static const char nf_frags_cache_name[] = "nf-frags"; + +-unsigned int nf_frag_pernet_id __read_mostly; ++static unsigned int nf_frag_pernet_id __read_mostly; + static struct inet_frags nf_frags; + + static struct nft_ct_frag6_pernet *nf_frag_pernet(struct net *net) +diff --git a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +index e8a59d8bf2ad..cb4eb1d2c620 100644 +--- a/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c ++++ b/net/ipv6/netfilter/nf_defrag_ipv6_hooks.c +@@ -25,8 +25,6 @@ + #include + #include + +-extern unsigned int nf_frag_pernet_id; +- + static DEFINE_MUTEX(defrag6_mutex); + + static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum, +@@ -91,12 +89,10 @@ static const struct nf_hook_ops ipv6_defrag_ops[] = { + + static void __net_exit defrag6_net_exit(struct net *net) + { +- struct nft_ct_frag6_pernet *nf_frag = net_generic(net, nf_frag_pernet_id); +- +- if (nf_frag->users) { ++ if (net->nf.defrag_ipv6_users) { + nf_unregister_net_hooks(net, ipv6_defrag_ops, + ARRAY_SIZE(ipv6_defrag_ops)); +- nf_frag->users = 0; ++ net->nf.defrag_ipv6_users = 0; + } + } + +@@ -134,24 +130,23 @@ static void __exit nf_defrag_fini(void) + + int nf_defrag_ipv6_enable(struct net *net) + { +- struct nft_ct_frag6_pernet *nf_frag = net_generic(net, nf_frag_pernet_id); + int err = 0; + + mutex_lock(&defrag6_mutex); +- if (nf_frag->users == UINT_MAX) { ++ if (net->nf.defrag_ipv6_users == UINT_MAX) { + err = -EOVERFLOW; + goto out_unlock; + } + +- if (nf_frag->users) { +- nf_frag->users++; ++ if (net->nf.defrag_ipv6_users) { ++ net->nf.defrag_ipv6_users++; + goto out_unlock; + } + + err = nf_register_net_hooks(net, ipv6_defrag_ops, + ARRAY_SIZE(ipv6_defrag_ops)); + if (err == 0) +- nf_frag->users = 1; ++ net->nf.defrag_ipv6_users = 1; + + out_unlock: + mutex_unlock(&defrag6_mutex); +@@ -161,12 +156,10 @@ EXPORT_SYMBOL_GPL(nf_defrag_ipv6_enable); + + void nf_defrag_ipv6_disable(struct net *net) + { +- struct nft_ct_frag6_pernet *nf_frag = net_generic(net, nf_frag_pernet_id); +- + mutex_lock(&defrag6_mutex); +- if (nf_frag->users) { +- nf_frag->users--; +- if (nf_frag->users == 0) ++ if (net->nf.defrag_ipv6_users) { ++ net->nf.defrag_ipv6_users--; ++ if (net->nf.defrag_ipv6_users == 0) + nf_unregister_net_hooks(net, ipv6_defrag_ops, + ARRAY_SIZE(ipv6_defrag_ops)); + } +-- +2.33.0 + diff --git a/queue-5.14/netfilter-nf_tables-add-position-handle-in-event-not.patch b/queue-5.14/netfilter-nf_tables-add-position-handle-in-event-not.patch new file mode 100644 index 00000000000..4e6b68af35f --- /dev/null +++ b/queue-5.14/netfilter-nf_tables-add-position-handle-in-event-not.patch @@ -0,0 +1,124 @@ +From a83feac921d2411996b939ee569717d268747ed0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 00:37:03 +0200 +Subject: netfilter: nf_tables: add position handle in event notification + +From: Pablo Neira Ayuso + +[ Upstream commit e189ae161dd784aa5d454b0832f818cacc0e131b ] + +Add position handle to allow to identify the rule location from netlink +events. Otherwise, userspace cannot incrementally update a userspace +cache through monitoring events. + +Skip handle dump if the rule has been either inserted (at the beginning +of the ruleset) or appended (at the end of the ruleset), the +NLM_F_APPEND netlink flag is sufficient in these two cases. + +Handle NLM_F_REPLACE as NLM_F_APPEND since the rule replacement +expansion appends it after the specified rule handle. + +Fixes: 96518518cc41 ("netfilter: add nftables") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 34 +++++++++++++++++++++++++--------- + 1 file changed, 25 insertions(+), 9 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index b9546defdc28..085783b14075 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2866,8 +2866,7 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, + u32 flags, int family, + const struct nft_table *table, + const struct nft_chain *chain, +- const struct nft_rule *rule, +- const struct nft_rule *prule) ++ const struct nft_rule *rule, u64 handle) + { + struct nlmsghdr *nlh; + const struct nft_expr *expr, *next; +@@ -2887,9 +2886,8 @@ static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, + NFTA_RULE_PAD)) + goto nla_put_failure; + +- if (event != NFT_MSG_DELRULE && prule) { +- if (nla_put_be64(skb, NFTA_RULE_POSITION, +- cpu_to_be64(prule->handle), ++ if (event != NFT_MSG_DELRULE && handle) { ++ if (nla_put_be64(skb, NFTA_RULE_POSITION, cpu_to_be64(handle), + NFTA_RULE_PAD)) + goto nla_put_failure; + } +@@ -2925,7 +2923,10 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx, + const struct nft_rule *rule, int event) + { + struct nftables_pernet *nft_net = nft_pernet(ctx->net); ++ const struct nft_rule *prule; + struct sk_buff *skb; ++ u64 handle = 0; ++ u16 flags = 0; + int err; + + if (!ctx->report && +@@ -2936,9 +2937,18 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx, + if (skb == NULL) + goto err; + ++ if (event == NFT_MSG_NEWRULE && ++ !list_is_first(&rule->list, &ctx->chain->rules) && ++ !list_is_last(&rule->list, &ctx->chain->rules)) { ++ prule = list_prev_entry(rule, list); ++ handle = prule->handle; ++ } ++ if (ctx->flags & (NLM_F_APPEND | NLM_F_REPLACE)) ++ flags |= NLM_F_APPEND; ++ + err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, +- event, 0, ctx->family, ctx->table, +- ctx->chain, rule, NULL); ++ event, flags, ctx->family, ctx->table, ++ ctx->chain, rule, handle); + if (err < 0) { + kfree_skb(skb); + goto err; +@@ -2964,6 +2974,7 @@ static int __nf_tables_dump_rules(struct sk_buff *skb, + struct net *net = sock_net(skb->sk); + const struct nft_rule *rule, *prule; + unsigned int s_idx = cb->args[0]; ++ u64 handle; + + prule = NULL; + list_for_each_entry_rcu(rule, &chain->rules, list) { +@@ -2975,12 +2986,17 @@ static int __nf_tables_dump_rules(struct sk_buff *skb, + memset(&cb->args[1], 0, + sizeof(cb->args) - sizeof(cb->args[0])); + } ++ if (prule) ++ handle = prule->handle; ++ else ++ handle = 0; ++ + if (nf_tables_fill_rule_info(skb, net, NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, + NFT_MSG_NEWRULE, + NLM_F_MULTI | NLM_F_APPEND, + table->family, +- table, chain, rule, prule) < 0) ++ table, chain, rule, handle) < 0) + return 1; + + nl_dump_check_consistent(cb, nlmsg_hdr(skb)); +@@ -3143,7 +3159,7 @@ static int nf_tables_getrule(struct sk_buff *skb, const struct nfnl_info *info, + + err = nf_tables_fill_rule_info(skb2, net, NETLINK_CB(skb).portid, + info->nlh->nlmsg_seq, NFT_MSG_NEWRULE, 0, +- family, table, chain, rule, NULL); ++ family, table, chain, rule, 0); + if (err < 0) + goto err_fill_rule_info; + +-- +2.33.0 + diff --git a/queue-5.14/netfilter-nf_tables-honor-nlm_f_create-and-nlm_f_exc.patch b/queue-5.14/netfilter-nf_tables-honor-nlm_f_create-and-nlm_f_exc.patch new file mode 100644 index 00000000000..0457917214b --- /dev/null +++ b/queue-5.14/netfilter-nf_tables-honor-nlm_f_create-and-nlm_f_exc.patch @@ -0,0 +1,224 @@ +From 2780df8b6363cca77a5b02dc549cb892ae4a4b69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Sep 2021 09:59:35 +0200 +Subject: netfilter: nf_tables: honor NLM_F_CREATE and NLM_F_EXCL in event + notification + +From: Pablo Neira Ayuso + +[ Upstream commit 6fb721cf781808ee2ca5e737fb0592cc68de3381 ] + +Include the NLM_F_CREATE and NLM_F_EXCL flags in netlink event +notifications, otherwise userspace cannot distiguish between create and +add commands. + +Fixes: 96518518cc41 ("netfilter: add nftables") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 2 +- + net/netfilter/nf_tables_api.c | 47 +++++++++++++++++++++++-------- + net/netfilter/nft_quota.c | 2 +- + 3 files changed, 37 insertions(+), 14 deletions(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 148f5d8ee5ab..a16171c5fd9e 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -1202,7 +1202,7 @@ struct nft_object *nft_obj_lookup(const struct net *net, + + void nft_obj_notify(struct net *net, const struct nft_table *table, + struct nft_object *obj, u32 portid, u32 seq, +- int event, int family, int report, gfp_t gfp); ++ int event, u16 flags, int family, int report, gfp_t gfp); + + /** + * struct nft_object_type - stateful object type +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index c8acd26c7201..c0851fec11d4 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -780,6 +780,7 @@ static void nf_tables_table_notify(const struct nft_ctx *ctx, int event) + { + struct nftables_pernet *nft_net; + struct sk_buff *skb; ++ u16 flags = 0; + int err; + + if (!ctx->report && +@@ -790,8 +791,11 @@ static void nf_tables_table_notify(const struct nft_ctx *ctx, int event) + if (skb == NULL) + goto err; + ++ if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) ++ flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); ++ + err = nf_tables_fill_table_info(skb, ctx->net, ctx->portid, ctx->seq, +- event, 0, ctx->family, ctx->table); ++ event, flags, ctx->family, ctx->table); + if (err < 0) { + kfree_skb(skb); + goto err; +@@ -1563,6 +1567,7 @@ static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event) + { + struct nftables_pernet *nft_net; + struct sk_buff *skb; ++ u16 flags = 0; + int err; + + if (!ctx->report && +@@ -1573,8 +1578,11 @@ static void nf_tables_chain_notify(const struct nft_ctx *ctx, int event) + if (skb == NULL) + goto err; + ++ if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) ++ flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); ++ + err = nf_tables_fill_chain_info(skb, ctx->net, ctx->portid, ctx->seq, +- event, 0, ctx->family, ctx->table, ++ event, flags, ctx->family, ctx->table, + ctx->chain); + if (err < 0) { + kfree_skb(skb); +@@ -2945,6 +2953,8 @@ static void nf_tables_rule_notify(const struct nft_ctx *ctx, + } + if (ctx->flags & (NLM_F_APPEND | NLM_F_REPLACE)) + flags |= NLM_F_APPEND; ++ if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) ++ flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); + + err = nf_tables_fill_rule_info(skb, ctx->net, ctx->portid, ctx->seq, + event, flags, ctx->family, ctx->table, +@@ -3957,8 +3967,9 @@ static void nf_tables_set_notify(const struct nft_ctx *ctx, + gfp_t gfp_flags) + { + struct nftables_pernet *nft_net = nft_pernet(ctx->net); +- struct sk_buff *skb; + u32 portid = ctx->portid; ++ struct sk_buff *skb; ++ u16 flags = 0; + int err; + + if (!ctx->report && +@@ -3969,7 +3980,10 @@ static void nf_tables_set_notify(const struct nft_ctx *ctx, + if (skb == NULL) + goto err; + +- err = nf_tables_fill_set(skb, ctx, set, event, 0); ++ if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) ++ flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); ++ ++ err = nf_tables_fill_set(skb, ctx, set, event, flags); + if (err < 0) { + kfree_skb(skb); + goto err; +@@ -5245,12 +5259,13 @@ static int nf_tables_getsetelem(struct sk_buff *skb, + static void nf_tables_setelem_notify(const struct nft_ctx *ctx, + const struct nft_set *set, + const struct nft_set_elem *elem, +- int event, u16 flags) ++ int event) + { + struct nftables_pernet *nft_net; + struct net *net = ctx->net; + u32 portid = ctx->portid; + struct sk_buff *skb; ++ u16 flags = 0; + int err; + + if (!ctx->report && !nfnetlink_has_listeners(net, NFNLGRP_NFTABLES)) +@@ -5260,6 +5275,9 @@ static void nf_tables_setelem_notify(const struct nft_ctx *ctx, + if (skb == NULL) + goto err; + ++ if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) ++ flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); ++ + err = nf_tables_fill_setelem_info(skb, ctx, 0, portid, event, flags, + set, elem); + if (err < 0) { +@@ -6935,7 +6953,7 @@ static int nf_tables_delobj(struct sk_buff *skb, const struct nfnl_info *info, + + void nft_obj_notify(struct net *net, const struct nft_table *table, + struct nft_object *obj, u32 portid, u32 seq, int event, +- int family, int report, gfp_t gfp) ++ u16 flags, int family, int report, gfp_t gfp) + { + struct nftables_pernet *nft_net = nft_pernet(net); + struct sk_buff *skb; +@@ -6960,8 +6978,9 @@ void nft_obj_notify(struct net *net, const struct nft_table *table, + if (skb == NULL) + goto err; + +- err = nf_tables_fill_obj_info(skb, net, portid, seq, event, 0, family, +- table, obj, false); ++ err = nf_tables_fill_obj_info(skb, net, portid, seq, event, ++ flags & (NLM_F_CREATE | NLM_F_EXCL), ++ family, table, obj, false); + if (err < 0) { + kfree_skb(skb); + goto err; +@@ -6978,7 +6997,7 @@ static void nf_tables_obj_notify(const struct nft_ctx *ctx, + struct nft_object *obj, int event) + { + nft_obj_notify(ctx->net, ctx->table, obj, ctx->portid, ctx->seq, event, +- ctx->family, ctx->report, GFP_KERNEL); ++ ctx->flags, ctx->family, ctx->report, GFP_KERNEL); + } + + /* +@@ -7759,6 +7778,7 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx, + { + struct nftables_pernet *nft_net = nft_pernet(ctx->net); + struct sk_buff *skb; ++ u16 flags = 0; + int err; + + if (!ctx->report && +@@ -7769,8 +7789,11 @@ static void nf_tables_flowtable_notify(struct nft_ctx *ctx, + if (skb == NULL) + goto err; + ++ if (ctx->flags & (NLM_F_CREATE | NLM_F_EXCL)) ++ flags |= ctx->flags & (NLM_F_CREATE | NLM_F_EXCL); ++ + err = nf_tables_fill_flowtable_info(skb, ctx->net, ctx->portid, +- ctx->seq, event, 0, ++ ctx->seq, event, flags, + ctx->family, flowtable, hook_list); + if (err < 0) { + kfree_skb(skb); +@@ -8648,7 +8671,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + nft_setelem_activate(net, te->set, &te->elem); + nf_tables_setelem_notify(&trans->ctx, te->set, + &te->elem, +- NFT_MSG_NEWSETELEM, 0); ++ NFT_MSG_NEWSETELEM); + nft_trans_destroy(trans); + break; + case NFT_MSG_DELSETELEM: +@@ -8656,7 +8679,7 @@ static int nf_tables_commit(struct net *net, struct sk_buff *skb) + + nf_tables_setelem_notify(&trans->ctx, te->set, + &te->elem, +- NFT_MSG_DELSETELEM, 0); ++ NFT_MSG_DELSETELEM); + nft_setelem_remove(net, te->set, &te->elem); + if (!nft_setelem_is_catchall(te->set, &te->elem)) { + atomic_dec(&te->set->nelems); +diff --git a/net/netfilter/nft_quota.c b/net/netfilter/nft_quota.c +index 0363f533a42b..c4d1389f7185 100644 +--- a/net/netfilter/nft_quota.c ++++ b/net/netfilter/nft_quota.c +@@ -60,7 +60,7 @@ static void nft_quota_obj_eval(struct nft_object *obj, + if (overquota && + !test_and_set_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags)) + nft_obj_notify(nft_net(pkt), obj->key.table, obj, 0, 0, +- NFT_MSG_NEWOBJ, nft_pf(pkt), 0, GFP_ATOMIC); ++ NFT_MSG_NEWOBJ, 0, nft_pf(pkt), 0, GFP_ATOMIC); + } + + static int nft_quota_do_init(const struct nlattr * const tb[], +-- +2.33.0 + diff --git a/queue-5.14/netfilter-nf_tables-reverse-order-in-rule-replacemen.patch b/queue-5.14/netfilter-nf_tables-reverse-order-in-rule-replacemen.patch new file mode 100644 index 00000000000..e84acb38352 --- /dev/null +++ b/queue-5.14/netfilter-nf_tables-reverse-order-in-rule-replacemen.patch @@ -0,0 +1,53 @@ +From ea9c16565f655132859bd0b65ccdba60f757ad13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Sep 2021 00:27:38 +0200 +Subject: netfilter: nf_tables: reverse order in rule replacement expansion + +From: Pablo Neira Ayuso + +[ Upstream commit 2c964c558641a3bddaee5719c9e6d8805f777812 ] + +Deactivate old rule first, then append the new rule, so rule replacement +notification via netlink first reports the deletion of the old rule with +handle X in first place, then it adds the new rule (reusing the handle X +of the replaced old rule). + +Note that the abort path releases the transaction that has been created +by nft_delrule() on error. + +Fixes: ca08987885a1 ("netfilter: nf_tables: deactivate expressions in rule replecement routine") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 085783b14075..c8acd26c7201 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3419,17 +3419,15 @@ static int nf_tables_newrule(struct sk_buff *skb, const struct nfnl_info *info, + } + + if (info->nlh->nlmsg_flags & NLM_F_REPLACE) { ++ err = nft_delrule(&ctx, old_rule); ++ if (err < 0) ++ goto err_destroy_flow_rule; ++ + trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); + if (trans == NULL) { + err = -ENOMEM; + goto err_destroy_flow_rule; + } +- err = nft_delrule(&ctx, old_rule); +- if (err < 0) { +- nft_trans_destroy(trans); +- goto err_destroy_flow_rule; +- } +- + list_add_tail_rcu(&rule->list, &old_rule->list); + } else { + trans = nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule); +-- +2.33.0 + diff --git a/queue-5.14/netfs-fix-read-write-confusion-when-calling-iov_iter.patch b/queue-5.14/netfs-fix-read-write-confusion-when-calling-iov_iter.patch new file mode 100644 index 00000000000..8233e7dbdd7 --- /dev/null +++ b/queue-5.14/netfs-fix-read-write-confusion-when-calling-iov_iter.patch @@ -0,0 +1,48 @@ +From 09b692c02af9616653e5fd55db3233bc06f82db8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jul 2021 10:37:57 +0100 +Subject: netfs: Fix READ/WRITE confusion when calling iov_iter_xarray() + +From: David Howells + +[ Upstream commit 330de47d14af0c3995db81cc03cf5ca683d94d81 ] + +Fix netfs_clear_unread() to pass READ to iov_iter_xarray() instead of WRITE +(the flag is about the operation accessing the buffer, not what sort of +access it is doing to the buffer). + +Fixes: 3d3c95046742 ("netfs: Provide readahead and readpage netfs helpers") +Signed-off-by: David Howells +Reviewed-by: Jeff Layton +cc: linux-cachefs@redhat.com +cc: linux-afs@lists.infradead.org +cc: ceph-devel@vger.kernel.org +cc: linux-cifs@vger.kernel.org +cc: linux-nfs@vger.kernel.org +cc: v9fs-developer@lists.sourceforge.net +cc: linux-fsdevel@vger.kernel.org +cc: linux-mm@kvack.org +Link: https://lore.kernel.org/r/162729351325.813557.9242842205308443901.stgit@warthog.procyon.org.uk/ +Link: https://lore.kernel.org/r/162886603464.3940407.3790841170414793899.stgit@warthog.procyon.org.uk +Link: https://lore.kernel.org/r/163239074602.1243337.14154704004485867017.stgit@warthog.procyon.org.uk +Signed-off-by: Sasha Levin +--- + fs/netfs/read_helper.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/netfs/read_helper.c b/fs/netfs/read_helper.c +index 0b6cd3b8734c..994ec22d4040 100644 +--- a/fs/netfs/read_helper.c ++++ b/fs/netfs/read_helper.c +@@ -150,7 +150,7 @@ static void netfs_clear_unread(struct netfs_read_subrequest *subreq) + { + struct iov_iter iter; + +- iov_iter_xarray(&iter, WRITE, &subreq->rreq->mapping->i_pages, ++ iov_iter_xarray(&iter, READ, &subreq->rreq->mapping->i_pages, + subreq->start + subreq->transferred, + subreq->len - subreq->transferred); + iov_iter_zero(iov_iter_count(&iter), &iter); +-- +2.33.0 + diff --git a/queue-5.14/netlink-annotate-data-races-around-nlk-bound.patch b/queue-5.14/netlink-annotate-data-races-around-nlk-bound.patch new file mode 100644 index 00000000000..60256c7db63 --- /dev/null +++ b/queue-5.14/netlink-annotate-data-races-around-nlk-bound.patch @@ -0,0 +1,111 @@ +From 6f2cefb1a59e2c28495bfdf58acdf4b9c1597ae7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 14:24:15 -0700 +Subject: netlink: annotate data races around nlk->bound + +From: Eric Dumazet + +[ Upstream commit 7707a4d01a648e4c655101a469c956cb11273655 ] + +While existing code is correct, KCSAN is reporting +a data-race in netlink_insert / netlink_sendmsg [1] + +It is correct to read nlk->bound without a lock, as netlink_autobind() +will acquire all needed locks. + +[1] +BUG: KCSAN: data-race in netlink_insert / netlink_sendmsg + +write to 0xffff8881031c8b30 of 1 bytes by task 18752 on cpu 0: + netlink_insert+0x5cc/0x7f0 net/netlink/af_netlink.c:597 + netlink_autobind+0xa9/0x150 net/netlink/af_netlink.c:842 + netlink_sendmsg+0x479/0x7c0 net/netlink/af_netlink.c:1892 + sock_sendmsg_nosec net/socket.c:703 [inline] + sock_sendmsg net/socket.c:723 [inline] + ____sys_sendmsg+0x360/0x4d0 net/socket.c:2392 + ___sys_sendmsg net/socket.c:2446 [inline] + __sys_sendmsg+0x1ed/0x270 net/socket.c:2475 + __do_sys_sendmsg net/socket.c:2484 [inline] + __se_sys_sendmsg net/socket.c:2482 [inline] + __x64_sys_sendmsg+0x42/0x50 net/socket.c:2482 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +read to 0xffff8881031c8b30 of 1 bytes by task 18751 on cpu 1: + netlink_sendmsg+0x270/0x7c0 net/netlink/af_netlink.c:1891 + sock_sendmsg_nosec net/socket.c:703 [inline] + sock_sendmsg net/socket.c:723 [inline] + __sys_sendto+0x2a8/0x370 net/socket.c:2019 + __do_sys_sendto net/socket.c:2031 [inline] + __se_sys_sendto net/socket.c:2027 [inline] + __x64_sys_sendto+0x74/0x90 net/socket.c:2027 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x3d/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +value changed: 0x00 -> 0x01 + +Reported by Kernel Concurrency Sanitizer on: +CPU: 1 PID: 18751 Comm: syz-executor.0 Not tainted 5.14.0-rc1-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + +Fixes: da314c9923fe ("netlink: Replace rhash_portid with bound") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 24b7cf447bc5..ada47e59647a 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -594,7 +594,10 @@ static int netlink_insert(struct sock *sk, u32 portid) + + /* We need to ensure that the socket is hashed and visible. */ + smp_wmb(); +- nlk_sk(sk)->bound = portid; ++ /* Paired with lockless reads from netlink_bind(), ++ * netlink_connect() and netlink_sendmsg(). ++ */ ++ WRITE_ONCE(nlk_sk(sk)->bound, portid); + + err: + release_sock(sk); +@@ -1012,7 +1015,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, + if (nlk->ngroups < BITS_PER_LONG) + groups &= (1UL << nlk->ngroups) - 1; + +- bound = nlk->bound; ++ /* Paired with WRITE_ONCE() in netlink_insert() */ ++ bound = READ_ONCE(nlk->bound); + if (bound) { + /* Ensure nlk->portid is up-to-date. */ + smp_rmb(); +@@ -1098,8 +1102,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, + + /* No need for barriers here as we return to user-space without + * using any of the bound attributes. ++ * Paired with WRITE_ONCE() in netlink_insert(). + */ +- if (!nlk->bound) ++ if (!READ_ONCE(nlk->bound)) + err = netlink_autobind(sock); + + if (err == 0) { +@@ -1888,7 +1893,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + dst_group = nlk->dst_group; + } + +- if (!nlk->bound) { ++ /* Paired with WRITE_ONCE() in netlink_insert() */ ++ if (!READ_ONCE(nlk->bound)) { + err = netlink_autobind(sock); + if (err) + goto out; +-- +2.33.0 + diff --git a/queue-5.14/pci-hv-fix-sleep-while-in-non-sleep-context-when-rem.patch b/queue-5.14/pci-hv-fix-sleep-while-in-non-sleep-context-when-rem.patch new file mode 100644 index 00000000000..4f6a6514835 --- /dev/null +++ b/queue-5.14/pci-hv-fix-sleep-while-in-non-sleep-context-when-rem.patch @@ -0,0 +1,78 @@ +From 2940f89d66989f89da1534b41ad1b6d7712d1a44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 16:13:27 -0700 +Subject: PCI: hv: Fix sleep while in non-sleep context when removing child + devices from the bus +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Long Li + +[ Upstream commit 41608b64b10b80fe00dd253cd8326ec8ad85930f ] + +In hv_pci_bus_exit, the code is holding a spinlock while calling +pci_destroy_slot(), which takes a mutex. + +This is not safe for spinlock. Fix this by moving the children to be +deleted to a list on the stack, and removing them after spinlock is +released. + +Fixes: 94d22763207a ("PCI: hv: Fix a race condition when removing the device") + +Cc: "K. Y. Srinivasan" +Cc: Haiyang Zhang +Cc: Stephen Hemminger +Cc: Wei Liu +Cc: Dexuan Cui +Cc: Lorenzo Pieralisi +Cc: Rob Herring +Cc: "Krzysztof Wilczyński" +Cc: Bjorn Helgaas +Cc: Michael Kelley +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/linux-hyperv/20210823152130.GA21501@kili/ +Signed-off-by: Long Li +Reviewed-by: Wei Liu +Link: https://lore.kernel.org/r/1630365207-20616-1-git-send-email-longli@linuxonhyperv.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-hyperv.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c +index a53bd8728d0d..fc1a29acadbb 100644 +--- a/drivers/pci/controller/pci-hyperv.c ++++ b/drivers/pci/controller/pci-hyperv.c +@@ -3229,9 +3229,17 @@ static int hv_pci_bus_exit(struct hv_device *hdev, bool keep_devs) + return 0; + + if (!keep_devs) { +- /* Delete any children which might still exist. */ ++ struct list_head removed; ++ ++ /* Move all present children to the list on stack */ ++ INIT_LIST_HEAD(&removed); + spin_lock_irqsave(&hbus->device_list_lock, flags); +- list_for_each_entry_safe(hpdev, tmp, &hbus->children, list_entry) { ++ list_for_each_entry_safe(hpdev, tmp, &hbus->children, list_entry) ++ list_move_tail(&hpdev->list_entry, &removed); ++ spin_unlock_irqrestore(&hbus->device_list_lock, flags); ++ ++ /* Remove all children in the list */ ++ list_for_each_entry_safe(hpdev, tmp, &removed, list_entry) { + list_del(&hpdev->list_entry); + if (hpdev->pci_slot) + pci_destroy_slot(hpdev->pci_slot); +@@ -3239,7 +3247,6 @@ static int hv_pci_bus_exit(struct hv_device *hdev, bool keep_devs) + put_pcichild(hpdev); + put_pcichild(hpdev); + } +- spin_unlock_irqrestore(&hbus->device_list_lock, flags); + } + + ret = hv_send_resources_released(hdev); +-- +2.33.0 + diff --git a/queue-5.14/perf-jevents-free-the-sys_event_tables-list-after-pr.patch b/queue-5.14/perf-jevents-free-the-sys_event_tables-list-after-pr.patch new file mode 100644 index 00000000000..893e8743500 --- /dev/null +++ b/queue-5.14/perf-jevents-free-the-sys_event_tables-list-after-pr.patch @@ -0,0 +1,52 @@ +From 46be32399c1e497bdfffaaaea3194ad0b77aa3d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Sep 2021 18:29:38 +0800 +Subject: perf jevents: Free the sys_event_tables list after processing entries + +From: Like Xu + +[ Upstream commit b94729919db2c6737501c36ea6526a36d5d63fa2 ] + +The compiler reports that free_sys_event_tables() is dead code. + +But according to the semantics, the "LIST_HEAD(sys_event_tables)" should +also be released, just like we do with 'arch_std_events' in main(). + +Fixes: e9d32c1bf0cd7a98 ("perf vendor events: Add support for arch standard events") +Signed-off-by: Like Xu +Reviewed-by: John Garry +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20210928102938.69681-1-likexu@tencent.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/pmu-events/jevents.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/pmu-events/jevents.c b/tools/perf/pmu-events/jevents.c +index 9604446f8360..8b536117e154 100644 +--- a/tools/perf/pmu-events/jevents.c ++++ b/tools/perf/pmu-events/jevents.c +@@ -1284,6 +1284,7 @@ int main(int argc, char *argv[]) + } + + free_arch_std_events(); ++ free_sys_event_tables(); + free(mapfile); + return 0; + +@@ -1305,6 +1306,7 @@ err_close_eventsfp: + create_empty_mapping(output_file); + err_out: + free_arch_std_events(); ++ free_sys_event_tables(); + free(mapfile); + return ret; + } +-- +2.33.0 + diff --git a/queue-5.14/phy-mdio-fix-memory-leak.patch b/queue-5.14/phy-mdio-fix-memory-leak.patch new file mode 100644 index 00000000000..7fbe90f4554 --- /dev/null +++ b/queue-5.14/phy-mdio-fix-memory-leak.patch @@ -0,0 +1,58 @@ +From 3f86a4cb7b0da2c6b6da063ad82ef4d2f02c0f01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 20:50:28 +0300 +Subject: phy: mdio: fix memory leak + +From: Pavel Skripkin + +[ Upstream commit ca6e11c337daf7925ff8a2aac8e84490a8691905 ] + +Syzbot reported memory leak in MDIO bus interface, the problem was in +wrong state logic. + +MDIOBUS_ALLOCATED indicates 2 states: + 1. Bus is only allocated + 2. Bus allocated and __mdiobus_register() fails, but + device_register() was called + +In case of device_register() has been called we should call put_device() +to correctly free the memory allocated for this device, but mdiobus_free() +calls just kfree(dev) in case of MDIOBUS_ALLOCATED state + +To avoid this behaviour we need to set bus->state to MDIOBUS_UNREGISTERED +_before_ calling device_register(), because put_device() should be +called even in case of device_register() failure. + +Link: https://lore.kernel.org/netdev/YVMRWNDZDUOvQjHL@shell.armlinux.org.uk/ +Fixes: 46abc02175b3 ("phylib: give mdio buses a device tree presence") +Reported-and-tested-by: syzbot+398e7dc692ddbbb4cfec@syzkaller.appspotmail.com +Reviewed-by: Dan Carpenter +Signed-off-by: Pavel Skripkin +Link: https://lore.kernel.org/r/eceae1429fbf8fa5c73dd2a0d39d525aa905074d.1633024062.git.paskripkin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio_bus.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c +index ee8313a4ac71..6865d9319197 100644 +--- a/drivers/net/phy/mdio_bus.c ++++ b/drivers/net/phy/mdio_bus.c +@@ -538,6 +538,13 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner) + bus->dev.groups = NULL; + dev_set_name(&bus->dev, "%s", bus->id); + ++ /* We need to set state to MDIOBUS_UNREGISTERED to correctly release ++ * the device in mdiobus_free() ++ * ++ * State will be updated later in this function in case of success ++ */ ++ bus->state = MDIOBUS_UNREGISTERED; ++ + err = device_register(&bus->dev); + if (err) { + pr_err("mii_bus %s failed to register\n", bus->id); +-- +2.33.0 + diff --git a/queue-5.14/powerpc-fsl-dts-fix-phy-connection-type-for-fm1mac3.patch b/queue-5.14/powerpc-fsl-dts-fix-phy-connection-type-for-fm1mac3.patch new file mode 100644 index 00000000000..8c33b730540 --- /dev/null +++ b/queue-5.14/powerpc-fsl-dts-fix-phy-connection-type-for-fm1mac3.patch @@ -0,0 +1,42 @@ +From 7148b2fed8ae6adb5510c250425f2c820edbb214 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Oct 2021 11:04:09 +0200 +Subject: powerpc/fsl/dts: Fix phy-connection-type for fm1mac3 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit eed183abc0d3b8adb64fd1363b7cea7986cd58d6 ] + +Property phy-connection-type contains invalid value "sgmii-2500" per scheme +defined in file ethernet-controller.yaml. + +Correct phy-connection-type value should be "2500base-x". + +Signed-off-by: Pali Rohár +Fixes: 84e0f1c13806 ("powerpc/mpc85xx: Add MDIO bus muxing support to the board device tree(s)") +Acked-by: Scott Wood +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/fsl/t1023rdb.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/boot/dts/fsl/t1023rdb.dts b/arch/powerpc/boot/dts/fsl/t1023rdb.dts +index 5ba6fbfca274..f82f85c65964 100644 +--- a/arch/powerpc/boot/dts/fsl/t1023rdb.dts ++++ b/arch/powerpc/boot/dts/fsl/t1023rdb.dts +@@ -154,7 +154,7 @@ + + fm1mac3: ethernet@e4000 { + phy-handle = <&sgmii_aqr_phy3>; +- phy-connection-type = "sgmii-2500"; ++ phy-connection-type = "2500base-x"; + sleep = <&rcpm 0x20000000>; + }; + +-- +2.33.0 + diff --git a/queue-5.14/ptp_pch-load-module-automatically-if-id-matches.patch b/queue-5.14/ptp_pch-load-module-automatically-if-id-matches.patch new file mode 100644 index 00000000000..34126c61594 --- /dev/null +++ b/queue-5.14/ptp_pch-load-module-automatically-if-id-matches.patch @@ -0,0 +1,36 @@ +From c192d65ae1ee736c9af8a4aaebab86eb77c31285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Oct 2021 19:20:33 +0300 +Subject: ptp_pch: Load module automatically if ID matches + +From: Andy Shevchenko + +[ Upstream commit 7cd8b1542a7ba0720c5a0a85ed414a122015228b ] + +The driver can't be loaded automatically because it misses +module alias to be provided. Add corresponding MODULE_DEVICE_TABLE() +call to the driver. + +Fixes: 863d08ece9bf ("supports eg20t ptp clock") +Signed-off-by: Andy Shevchenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/ptp/ptp_pch.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ptp/ptp_pch.c b/drivers/ptp/ptp_pch.c +index a17e8cc642c5..8070f3fd98f0 100644 +--- a/drivers/ptp/ptp_pch.c ++++ b/drivers/ptp/ptp_pch.c +@@ -644,6 +644,7 @@ static const struct pci_device_id pch_ieee1588_pcidev_id[] = { + }, + {0} + }; ++MODULE_DEVICE_TABLE(pci, pch_ieee1588_pcidev_id); + + static SIMPLE_DEV_PM_OPS(pch_pm_ops, pch_suspend, pch_resume); + +-- +2.33.0 + diff --git a/queue-5.14/revert-arm64-dts-qcom-sc7280-fixup-the-cpufreq-node.patch b/queue-5.14/revert-arm64-dts-qcom-sc7280-fixup-the-cpufreq-node.patch new file mode 100644 index 00000000000..486c9b40ec6 --- /dev/null +++ b/queue-5.14/revert-arm64-dts-qcom-sc7280-fixup-the-cpufreq-node.patch @@ -0,0 +1,49 @@ +From 482b78e61420481db715529786ab3b42bfe844f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Sep 2021 12:12:25 -0700 +Subject: Revert "arm64: dts: qcom: sc7280: Fixup the cpufreq node" + +From: Douglas Anderson + +[ Upstream commit a48c730a4e0bf480bcde12d795a9cd6f9ef14d1e ] + +This reverts commit 11e03d692101e484df9322f892a8b6e111a82bfd. + +As per discussion [1] the patch shouldn't have landed. Let's revert. + +[1] https://lore.kernel.org/r/fde7bac239f796b039b9be58b391fb77@codeaurora.org/ + +Fixes: 11e03d692101 ("arm64: dts: qcom: sc7280: Fixup the cpufreq node") +Reported-by: Matthias Kaehlcke +Cc: Sibi Sankar +Cc: Matthias Kaehlcke +Cc: Stephen Boyd +Signed-off-by: Douglas Anderson +Reviewed-by: Matthias Kaehlcke +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210907121220.1.I08460f490473b70de0d768db45f030a4d5c17828@changeid +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7280.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi +index c08f07410699..188c5768a55a 100644 +--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi +@@ -1437,9 +1437,9 @@ + + cpufreq_hw: cpufreq@18591000 { + compatible = "qcom,cpufreq-epss"; +- reg = <0 0x18591100 0 0x900>, +- <0 0x18592100 0 0x900>, +- <0 0x18593100 0 0x900>; ++ reg = <0 0x18591000 0 0x1000>, ++ <0 0x18592000 0 0x1000>, ++ <0 0x18593000 0 0x1000>; + clocks = <&rpmhcc RPMH_CXO_CLK>, <&gcc GCC_GPLL0>; + clock-names = "xo", "alternate"; + #freq-domain-cells = <1>; +-- +2.33.0 + diff --git a/queue-5.14/rtnetlink-fix-if_nlmsg_stats_size-under-estimation.patch b/queue-5.14/rtnetlink-fix-if_nlmsg_stats_size-under-estimation.patch new file mode 100644 index 00000000000..f93cb00bcda --- /dev/null +++ b/queue-5.14/rtnetlink-fix-if_nlmsg_stats_size-under-estimation.patch @@ -0,0 +1,45 @@ +From d2f8da35c2d3405a8b7c1f47e895adcac665a168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Oct 2021 14:04:17 -0700 +Subject: rtnetlink: fix if_nlmsg_stats_size() under estimation + +From: Eric Dumazet + +[ Upstream commit d34367991933d28bd7331f67a759be9a8c474014 ] + +rtnl_fill_statsinfo() is filling skb with one mandatory if_stats_msg structure. + +nlmsg_put(skb, pid, seq, type, sizeof(struct if_stats_msg), flags); + +But if_nlmsg_stats_size() never considered the needed storage. + +This bug did not show up because alloc_skb(X) allocates skb with +extra tailroom, because of added alignments. This could very well +be changed in the future to have deterministic behavior. + +Fixes: 10c9ead9f3c6 ("rtnetlink: add new RTM_GETSTATS message to dump link stats") +Signed-off-by: Eric Dumazet +Cc: Roopa Prabhu +Acked-by: Roopa Prabhu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 662eb1c37f47..10e2a0e4804b 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -5265,7 +5265,7 @@ nla_put_failure: + static size_t if_nlmsg_stats_size(const struct net_device *dev, + u32 filter_mask) + { +- size_t size = 0; ++ size_t size = NLMSG_ALIGN(sizeof(struct if_stats_msg)); + + if (stats_attr_valid(filter_mask, IFLA_STATS_LINK_64, 0)) + size += nla_total_size_64bit(sizeof(struct rtnl_link_stats64)); +-- +2.33.0 + diff --git a/queue-5.14/series b/queue-5.14/series index e6f79e27aa9..04c31ca1fee 100644 --- a/queue-5.14/series +++ b/queue-5.14/series @@ -33,3 +33,85 @@ arm-dts-imx6dl-yapp4-fix-lp5562-led-driver-probe.patch arm-dts-qcom-apq8064-use-compatible-which-contains-chipid.patch scsi-ufs-core-fix-task-management-completion.patch riscv-flush-current-cpu-icache-before-other-cpus.patch +bus-ti-sysc-add-break-in-switch-statement-in-sysc_in.patch +soc-qcom-socinfo-fixed-argument-passed-to-platform_s.patch +arm-dts-qcom-apq8064-use-27mhz-pxo-clock-as-dsi-pll-.patch +revert-arm64-dts-qcom-sc7280-fixup-the-cpufreq-node.patch +arm-at91-pm-do-not-panic-if-ram-controllers-are-not-.patch +iwlwifi-mvm-fix-possible-null-dereference.patch +soc-qcom-mdt_loader-drop-pt_load-check-on-hash-segme.patch +arm-dts-imx-add-missing-pinctrl-names-for-panel-on-m.patch +arm-dts-imx-fix-usb-host-power-regulator-polarity-on.patch +arm-dts-imx6qdl-pico-fix-ethernet-support.patch +pci-hv-fix-sleep-while-in-non-sleep-context-when-rem.patch +ath5k-fix-building-with-leds-m.patch +arm64-dts-qcom-pm8150-use-qcom-pm8998-pon-binding.patch +xtensa-use-config_use_of-instead-of-config_of.patch +xtensa-call-irqchip_init-only-when-config_use_of-is-.patch +iwlwifi-pcie-add-configuration-of-a-wi-fi-adapter-on.patch +netfilter-conntrack-fix-boot-failure-with-nf_conntra.patch +netfilter-nf_tables-add-position-handle-in-event-not.patch +netfilter-nf_tables-reverse-order-in-rule-replacemen.patch +bpf-arm-fix-register-clobbering-in-div-mod-implement.patch +soc-ti-omap-prm-fix-external-abort-for-am335x-pruss.patch +bpf-fix-integer-overflow-in-prealloc_elems_and_freel.patch +net-mlx5e-ipsec-rx-enable-checksum-complete.patch +net-mlx5e-keep-the-value-for-maximum-number-of-chann.patch +net-mlx5-e-switch-fix-double-allocation-of-acl-flow-.patch +net-mlx5-force-round-second-at-1pps-out-start-time.patch +net-mlx5-avoid-generating-event-after-pps-out-in-rea.patch +net-mlx5-fix-length-of-irq_index-in-chars.patch +net-mlx5-fix-setting-number-of-eqs-of-sfs.patch +net-mlx5e-fix-the-presented-rq-index-in-ptp-stats.patch +libbpf-fix-segfault-in-light-skeleton-for-objects-wi.patch +phy-mdio-fix-memory-leak.patch +libbpf-fix-memory-leak-in-strset.patch +net_sched-fix-null-deref-in-fifo_set_limit.patch +net-mscc-ocelot-fix-vcap-filters-remaining-active-af.patch +net-stmmac-dwmac-rk-fix-ethernet-on-rk3399-based-dev.patch +mips-revert-add-support-for-buggy-mt7621s-core-detec.patch +netfilter-nf_tables-honor-nlm_f_create-and-nlm_f_exc.patch +powerpc-fsl-dts-fix-phy-connection-type-for-fm1mac3.patch +ptp_pch-load-module-automatically-if-id-matches.patch +arm-dts-imx-change-the-spi-nor-tx.patch +arm64-dts-imx8-change-the-spi-nor-tx.patch +arm64-dts-imx8mm-kontron-n801x-som-do-not-allow-to-s.patch +arm64-dts-ls1028a-fix-esdhc2-node.patch +dt-bindings-drm-bridge-ti-sn65dsi86-fix-reg-value.patch +arm-imx6-disable-the-gic-cpu-interface-before-callin.patch +drm-i915-audio-use-bios-provided-value-for-rkl-hda-l.patch +drm-i915-jsl-add-w-a-1409054076-for-jsl.patch +drm-i915-tc-fix-typec-port-init-resume-time-sanitiza.patch +drm-i915-bdb-fix-version-check.patch +netfs-fix-read-write-confusion-when-calling-iov_iter.patch +afs-fix-afs_launder_page-to-set-correct-start-file-p.patch +net-bridge-use-nla_total_size_64bit-in-br_get_linkxs.patch +net-bridge-fix-under-estimation-in-br_get_linkxstats.patch +net-sched-sch_taprio-properly-cancel-timer-from-tapr.patch +net-sfp-fix-typo-in-state-machine-debug-string.patch +net-pcs-xpcs-fix-incorrect-cl37-an-sequence.patch +netlink-annotate-data-races-around-nlk-bound.patch +arm-defconfig-gemini-restore-framebuffer.patch +drm-amdkfd-fix-a-potential-ttm-sg-memory-leak.patch +drm-amdgpu-handle-the-case-of-pci_channel_io_frozen-.patch +perf-jevents-free-the-sys_event_tables-list-after-pr.patch +bus-ti-sysc-use-clkdm_noauto-for-dra7-dcan1-for-erra.patch +drm-sun4i-dw-hdmi-fix-hdmi-phy-clock-setup.patch +drm-nouveau-fifo-ga102-initialise-chid-on-return-fro.patch +drm-panel-abt-y030xx067a-yellow-tint-fix.patch +video-fbdev-gbefb-only-instantiate-device-when-built.patch +drm-nouveau-avoid-a-use-after-free-when-bo-init-fail.patch +drm-nouveau-kms-nv50-fix-file-release-memory-leak.patch +drm-nouveau-debugfs-fix-file-release-memory-leak.patch +net-pcs-xpcs-fix-incorrect-steps-on-disable-eee.patch +net-stmmac-trigger-pcs-eee-to-turn-off-on-link-down.patch +gve-correct-available-tx-qpl-check.patch +gve-avoid-freeing-null-pointer.patch +gve-properly-handle-errors-in-gve_assign_qpl.patch +rtnetlink-fix-if_nlmsg_stats_size-under-estimation.patch +gve-fix-gve_get_stats.patch +gve-report-64bit-tx_bytes-counter-from-gve_handle_re.patch +i40e-fix-endless-loop-under-rtnl.patch +i40e-fix-freeing-of-uninitialized-misc-irq-vector.patch +iavf-fix-double-unlock-of-crit_lock.patch +net-prefer-socket-bound-to-interface-when-not-in-vrf.patch diff --git a/queue-5.14/soc-qcom-mdt_loader-drop-pt_load-check-on-hash-segme.patch b/queue-5.14/soc-qcom-mdt_loader-drop-pt_load-check-on-hash-segme.patch new file mode 100644 index 00000000000..c9d73437a30 --- /dev/null +++ b/queue-5.14/soc-qcom-mdt_loader-drop-pt_load-check-on-hash-segme.patch @@ -0,0 +1,51 @@ +From b4e68df98528b099ea6c6b9dfe401112b3493f79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Aug 2021 15:02:02 +0800 +Subject: soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment + +From: Shawn Guo + +[ Upstream commit 833d51d7c66d6708abbc02398892b96b950167b9 ] + +PT_LOAD type denotes that the segment should be loaded into the final +firmware memory region. Hash segment is not one such, because it's only +needed for PAS init and shouldn't be in the final firmware memory region. +That's why mdt_phdr_valid() explicitly reject non PT_LOAD segment and +hash segment. This actually makes the hash segment type check in +qcom_mdt_read_metadata() unnecessary and redundant. For a hash segment, +it won't be loaded into firmware memory region anyway, due to the +QCOM_MDT_TYPE_HASH check in mdt_phdr_valid(), even if it has a PT_LOAD +type for some reason (misusing or abusing?). + +Some firmware files on Sony phones are such examples, e.g WCNSS firmware +of Sony Xperia M4 Aqua phone. The type of hash segment is just PT_LOAD. +Drop the unnecessary hash segment type check in qcom_mdt_read_metadata() +to fix firmware loading failure on these phones, while hash segment is +still kept away from the final firmware memory region. + +Fixes: 498b98e93900 ("soc: qcom: mdt_loader: Support loading non-split images") +Signed-off-by: Shawn Guo +Reviewed-by: Marijn Suijten +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210828070202.7033-1-shawn.guo@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/mdt_loader.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c +index eba7f76f9d61..6034cd8992b0 100644 +--- a/drivers/soc/qcom/mdt_loader.c ++++ b/drivers/soc/qcom/mdt_loader.c +@@ -98,7 +98,7 @@ void *qcom_mdt_read_metadata(const struct firmware *fw, size_t *data_len) + if (ehdr->e_phnum < 2) + return ERR_PTR(-EINVAL); + +- if (phdrs[0].p_type == PT_LOAD || phdrs[1].p_type == PT_LOAD) ++ if (phdrs[0].p_type == PT_LOAD) + return ERR_PTR(-EINVAL); + + if ((phdrs[1].p_flags & QCOM_MDT_TYPE_MASK) != QCOM_MDT_TYPE_HASH) +-- +2.33.0 + diff --git a/queue-5.14/soc-qcom-socinfo-fixed-argument-passed-to-platform_s.patch b/queue-5.14/soc-qcom-socinfo-fixed-argument-passed-to-platform_s.patch new file mode 100644 index 00000000000..e376b24401b --- /dev/null +++ b/queue-5.14/soc-qcom-socinfo-fixed-argument-passed-to-platform_s.patch @@ -0,0 +1,39 @@ +From 62cea4e3c0b41daf2ccefc0b6480d09793be6509 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 17:24:39 -0700 +Subject: soc: qcom: socinfo: Fixed argument passed to platform_set_data() + +From: Antonio Martorana + +[ Upstream commit 9c5a4ec69bbf5951f84ada9e0db9c6c50de61808 ] + +Set qcom_socinfo pointer as data being stored instead of pointer +to soc_device structure. Aligns with future calls to platform_get_data() +which expects qcom_socinfo pointer. + +Fixes: efb448d0a3fc ("soc: qcom: Add socinfo driver") +Signed-off-by: Antonio Martorana +Reviewed-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1629159879-95777-1-git-send-email-amartora@codeaurora.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/socinfo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/socinfo.c b/drivers/soc/qcom/socinfo.c +index b2f049faa3df..a6cffd57d3c7 100644 +--- a/drivers/soc/qcom/socinfo.c ++++ b/drivers/soc/qcom/socinfo.c +@@ -628,7 +628,7 @@ static int qcom_socinfo_probe(struct platform_device *pdev) + /* Feed the soc specific unique data into entropy pool */ + add_device_randomness(info, item_size); + +- platform_set_drvdata(pdev, qs->soc_dev); ++ platform_set_drvdata(pdev, qs); + + return 0; + } +-- +2.33.0 + diff --git a/queue-5.14/soc-ti-omap-prm-fix-external-abort-for-am335x-pruss.patch b/queue-5.14/soc-ti-omap-prm-fix-external-abort-for-am335x-pruss.patch new file mode 100644 index 00000000000..3924fd67e2e --- /dev/null +++ b/queue-5.14/soc-ti-omap-prm-fix-external-abort-for-am335x-pruss.patch @@ -0,0 +1,87 @@ +From 55da294c4860d0370388b4597a0a78568b4287d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Sep 2021 11:30:03 +0300 +Subject: soc: ti: omap-prm: Fix external abort for am335x pruss + +From: Tony Lindgren + +[ Upstream commit b232537074fcaf0c2837abbb217429c097bb7598 ] + +Starting with v5.15-rc1, we may now see some am335x beaglebone black +device produce the following error on pruss probe: + +Unhandled fault: external abort on non-linefetch (0x1008) at 0xe0326000 + +This has started with the enabling of pruss for am335x in the dts files. + +Turns out the is caused by the PRM reset handling not waiting for the +reset bit to clear. To fix the issue, let's always wait for the reset +bit to clear, even if there is a separate reset status register. + +We attempted to fix a similar issue for dra7 iva with a udelay() in +commit effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset +deassert for dra7 iva"). There is no longer a need for the udelay() +for dra7 iva reset either with the check added for reset bit clearing. + +Cc: Drew Fustini +Cc: Grygorii Strashko +Cc: "H. Nikolaus Schaller" +Cc: Robert Nelson +Cc: Yongqin Liu +Fixes: effe89e40037 ("soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva") +Reported-by: Matti Vaittinen +Tested-by: Matti Vaittinen +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/omap_prm.c | 27 +++++++++++++++------------ + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/drivers/soc/ti/omap_prm.c b/drivers/soc/ti/omap_prm.c +index ea64e187854e..f32e1cbbe8c5 100644 +--- a/drivers/soc/ti/omap_prm.c ++++ b/drivers/soc/ti/omap_prm.c +@@ -825,25 +825,28 @@ static int omap_reset_deassert(struct reset_controller_dev *rcdev, + writel_relaxed(v, reset->prm->base + reset->prm->data->rstctrl); + spin_unlock_irqrestore(&reset->lock, flags); + +- if (!has_rstst) +- goto exit; ++ /* wait for the reset bit to clear */ ++ ret = readl_relaxed_poll_timeout_atomic(reset->prm->base + ++ reset->prm->data->rstctrl, ++ v, !(v & BIT(id)), 1, ++ OMAP_RESET_MAX_WAIT); ++ if (ret) ++ pr_err("%s: timedout waiting for %s:%lu\n", __func__, ++ reset->prm->data->name, id); + + /* wait for the status to be set */ +- ret = readl_relaxed_poll_timeout_atomic(reset->prm->base + ++ if (has_rstst) { ++ ret = readl_relaxed_poll_timeout_atomic(reset->prm->base + + reset->prm->data->rstst, + v, v & BIT(st_bit), 1, + OMAP_RESET_MAX_WAIT); +- if (ret) +- pr_err("%s: timedout waiting for %s:%lu\n", __func__, +- reset->prm->data->name, id); ++ if (ret) ++ pr_err("%s: timedout waiting for %s:%lu\n", __func__, ++ reset->prm->data->name, id); ++ } + +-exit: +- if (reset->clkdm) { +- /* At least dra7 iva needs a delay before clkdm idle */ +- if (has_rstst) +- udelay(1); ++ if (reset->clkdm) + pdata->clkdm_allow_idle(reset->clkdm); +- } + + return ret; + } +-- +2.33.0 + diff --git a/queue-5.14/video-fbdev-gbefb-only-instantiate-device-when-built.patch b/queue-5.14/video-fbdev-gbefb-only-instantiate-device-when-built.patch new file mode 100644 index 00000000000..0c0bffd1b59 --- /dev/null +++ b/queue-5.14/video-fbdev-gbefb-only-instantiate-device-when-built.patch @@ -0,0 +1,44 @@ +From ccc1e73fa963c06a533d222420a3302bcdd82bc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 22:21:02 +0100 +Subject: video: fbdev: gbefb: Only instantiate device when built for IP32 + +From: Mark Brown + +[ Upstream commit 11b8e2bb986d23157e82e267fb8cc6b281dfdee9 ] + +The gbefb driver not only registers a driver but also the device for that +driver. This is all well and good when run on the IP32 machines that are +supported by the driver but since the driver supports building with +COMPILE_TEST we might also be building on other platforms which do not have +this hardware and will crash instantiating the driver. Add an IS_ENABLED() +check so we compile out the device registration if we don't have the Kconfig +option for the machine enabled. + +Fixes: 552ccf6b259d290c0c ("video: fbdev: gbefb: add COMPILE_TEST support") +Signed-off-by: Mark Brown +Cc: Bartlomiej Zolnierkiewicz +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20210921212102.30803-1-broonie@kernel.org +Signed-off-by: Maarten Lankhorst +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/gbefb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/gbefb.c b/drivers/video/fbdev/gbefb.c +index c5b99a4861e8..6b4d5a7f3e15 100644 +--- a/drivers/video/fbdev/gbefb.c ++++ b/drivers/video/fbdev/gbefb.c +@@ -1267,7 +1267,7 @@ static struct platform_device *gbefb_device; + static int __init gbefb_init(void) + { + int ret = platform_driver_register(&gbefb_driver); +- if (!ret) { ++ if (IS_ENABLED(CONFIG_SGI_IP32) && !ret) { + gbefb_device = platform_device_alloc("gbefb", 0); + if (gbefb_device) { + ret = platform_device_add(gbefb_device); +-- +2.33.0 + diff --git a/queue-5.14/xtensa-call-irqchip_init-only-when-config_use_of-is-.patch b/queue-5.14/xtensa-call-irqchip_init-only-when-config_use_of-is-.patch new file mode 100644 index 00000000000..f8cdbcb6dcb --- /dev/null +++ b/queue-5.14/xtensa-call-irqchip_init-only-when-config_use_of-is-.patch @@ -0,0 +1,65 @@ +From ad18400482e43f77256233a2f25eb900a74783d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Sep 2021 09:46:33 -0700 +Subject: xtensa: call irqchip_init only when CONFIG_USE_OF is selected + +From: Max Filippov + +[ Upstream commit 6489f8d0e1d93a3603d8dad8125797559e4cf2a2 ] + +During boot time kernel configured with OF=y but USE_OF=n displays the +following warnings and hangs shortly after starting userspace: + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 0 at kernel/irq/irqdomain.c:695 irq_create_mapping_affinity+0x29/0xc0 +irq_create_mapping_affinity(, 6) called with NULL domain +CPU: 0 PID: 0 Comm: swapper Not tainted 5.15.0-rc3-00001-gd67ed2510d28 #30 +Call Trace: + __warn+0x69/0xc4 + warn_slowpath_fmt+0x6c/0x94 + irq_create_mapping_affinity+0x29/0xc0 + local_timer_setup+0x40/0x88 + time_init+0xb1/0xe8 + start_kernel+0x31d/0x3f4 + _startup+0x13b/0x13b +---[ end trace 1e6630e1c5eda35b ]--- +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 0 at arch/xtensa/kernel/time.c:141 local_timer_setup+0x58/0x88 +error: can't map timer irq +CPU: 0 PID: 0 Comm: swapper Tainted: G W 5.15.0-rc3-00001-gd67ed2510d28 #30 +Call Trace: + __warn+0x69/0xc4 + warn_slowpath_fmt+0x6c/0x94 + local_timer_setup+0x58/0x88 + time_init+0xb1/0xe8 + start_kernel+0x31d/0x3f4 + _startup+0x13b/0x13b +---[ end trace 1e6630e1c5eda35c ]--- +Failed to request irq 0 (timer) + +Fix that by calling irqchip_init only when CONFIG_USE_OF is selected and +calling legacy interrupt controller init otherwise. + +Fixes: da844a81779e ("xtensa: add device trees support") +Signed-off-by: Max Filippov +Signed-off-by: Sasha Levin +--- + arch/xtensa/kernel/irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c +index a48bf2d10ac2..80cc9770a8d2 100644 +--- a/arch/xtensa/kernel/irq.c ++++ b/arch/xtensa/kernel/irq.c +@@ -145,7 +145,7 @@ unsigned xtensa_get_ext_irq_no(unsigned irq) + + void __init init_IRQ(void) + { +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + irqchip_init(); + #else + #ifdef CONFIG_HAVE_SMP +-- +2.33.0 + diff --git a/queue-5.14/xtensa-use-config_use_of-instead-of-config_of.patch b/queue-5.14/xtensa-use-config_use_of-instead-of-config_of.patch new file mode 100644 index 00000000000..f01242f2c2c --- /dev/null +++ b/queue-5.14/xtensa-use-config_use_of-instead-of-config_of.patch @@ -0,0 +1,136 @@ +From e2c8ea64e6dbf1ea2a0a1c69fe061b42cb44c22a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 20:29:51 -0700 +Subject: xtensa: use CONFIG_USE_OF instead of CONFIG_OF +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Randy Dunlap + +[ Upstream commit d67ed2510d28a1eb33171010d35cf52178cfcbdd ] + +CONFIG_OF can be set by a randconfig or by a user -- without setting the +early flattree option (OF_EARLY_FLATTREE). This causes build errors. +However, if randconfig or a user sets USE_OF in the Xtensa config, +the right kconfig symbols are set to fix the build. + +Fixes these build errors: + +../arch/xtensa/kernel/setup.c:67:19: error: ‘__dtb_start’ undeclared here (not in a function); did you mean ‘dtb_start’? + 67 | void *dtb_start = __dtb_start; + | ^~~~~~~~~~~ +../arch/xtensa/kernel/setup.c: In function 'xtensa_dt_io_area': +../arch/xtensa/kernel/setup.c:201:14: error: implicit declaration of function 'of_flat_dt_is_compatible'; did you mean 'of_machine_is_compatible'? [-Werror=implicit-function-declaration] + 201 | if (!of_flat_dt_is_compatible(node, "simple-bus")) +../arch/xtensa/kernel/setup.c:204:18: error: implicit declaration of function 'of_get_flat_dt_prop' [-Werror=implicit-function-declaration] + 204 | ranges = of_get_flat_dt_prop(node, "ranges", &len); +../arch/xtensa/kernel/setup.c:204:16: error: assignment to 'const __be32 *' {aka 'const unsigned int *'} from 'int' makes pointer from integer without a cast [-Werror=int-conversion] + 204 | ranges = of_get_flat_dt_prop(node, "ranges", &len); + | ^ +../arch/xtensa/kernel/setup.c: In function 'early_init_devtree': +../arch/xtensa/kernel/setup.c:228:9: error: implicit declaration of function 'early_init_dt_scan'; did you mean 'early_init_devtree'? [-Werror=implicit-function-declaration] + 228 | early_init_dt_scan(params); +../arch/xtensa/kernel/setup.c:229:9: error: implicit declaration of function 'of_scan_flat_dt' [-Werror=implicit-function-declaration] + 229 | of_scan_flat_dt(xtensa_dt_io_area, NULL); + +xtensa-elf-ld: arch/xtensa/mm/mmu.o:(.text+0x0): undefined reference to `xtensa_kio_paddr' + +Fixes: da844a81779e ("xtensa: add device trees support") +Fixes: 6cb971114f63 ("xtensa: remap io area defined in device tree") +Signed-off-by: Randy Dunlap +Signed-off-by: Max Filippov +Signed-off-by: Sasha Levin +--- + arch/xtensa/include/asm/kmem_layout.h | 2 +- + arch/xtensa/kernel/setup.c | 12 ++++++------ + arch/xtensa/mm/mmu.c | 2 +- + 3 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/xtensa/include/asm/kmem_layout.h b/arch/xtensa/include/asm/kmem_layout.h +index 7cbf68ca7106..6fc05cba61a2 100644 +--- a/arch/xtensa/include/asm/kmem_layout.h ++++ b/arch/xtensa/include/asm/kmem_layout.h +@@ -78,7 +78,7 @@ + #endif + #define XCHAL_KIO_SIZE 0x10000000 + +-#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_OF) ++#if (!XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY) && defined(CONFIG_USE_OF) + #define XCHAL_KIO_PADDR xtensa_get_kio_paddr() + #ifndef __ASSEMBLY__ + extern unsigned long xtensa_kio_paddr; +diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c +index ed184106e4cf..ee9082a142fe 100644 +--- a/arch/xtensa/kernel/setup.c ++++ b/arch/xtensa/kernel/setup.c +@@ -63,7 +63,7 @@ extern unsigned long initrd_end; + extern int initrd_below_start_ok; + #endif + +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + void *dtb_start = __dtb_start; + #endif + +@@ -125,7 +125,7 @@ __tagtable(BP_TAG_INITRD, parse_tag_initrd); + + #endif /* CONFIG_BLK_DEV_INITRD */ + +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + + static int __init parse_tag_fdt(const bp_tag_t *tag) + { +@@ -135,7 +135,7 @@ static int __init parse_tag_fdt(const bp_tag_t *tag) + + __tagtable(BP_TAG_FDT, parse_tag_fdt); + +-#endif /* CONFIG_OF */ ++#endif /* CONFIG_USE_OF */ + + static int __init parse_tag_cmdline(const bp_tag_t* tag) + { +@@ -183,7 +183,7 @@ static int __init parse_bootparam(const bp_tag_t *tag) + } + #endif + +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + + #if !XCHAL_HAVE_PTP_MMU || XCHAL_HAVE_SPANNING_WAY + unsigned long xtensa_kio_paddr = XCHAL_KIO_DEFAULT_PADDR; +@@ -232,7 +232,7 @@ void __init early_init_devtree(void *params) + strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE); + } + +-#endif /* CONFIG_OF */ ++#endif /* CONFIG_USE_OF */ + + /* + * Initialize architecture. (Early stage) +@@ -253,7 +253,7 @@ void __init init_arch(bp_tag_t *bp_start) + if (bp_start) + parse_bootparam(bp_start); + +-#ifdef CONFIG_OF ++#ifdef CONFIG_USE_OF + early_init_devtree(dtb_start); + #endif + +diff --git a/arch/xtensa/mm/mmu.c b/arch/xtensa/mm/mmu.c +index 7e4d97dc8bd8..38acda4f04e8 100644 +--- a/arch/xtensa/mm/mmu.c ++++ b/arch/xtensa/mm/mmu.c +@@ -101,7 +101,7 @@ void init_mmu(void) + + void init_kio(void) + { +-#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_OF) ++#if XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY && defined(CONFIG_USE_OF) + /* + * Update the IO area mapping in case xtensa_kio_paddr has changed + */ +-- +2.33.0 +