From 17ccdaee81e5c5cbd3913a534b2e94705ebf9303 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 21 Dec 2020 16:02:44 -0500 Subject: [PATCH] Fixes for 5.4 Signed-off-by: Sasha Levin --- ...eak-when-mounting-with-multiple-sour.patch | 60 +++ ...dl-kontron-samx6i-fix-i2c_pm-scl-pin.patch | 38 ++ ...wandboard-revd1-remove-pad_gpio_6-fr.patch | 41 ++ ...nanapi-enable-rgmii-rx-tx-delay-on-e.patch | 42 ++ ...duino3-nano-enable-rgmii-rx-tx-delay.patch | 56 +++ ...0-bananapi-m2-berry-fix-dcdc1-regula.patch | 55 +++ ...-sun8i-v3s-fix-gic-node-memory-range.patch | 39 ++ ...0-bananapi-m2-berry-fix-ethernet-nod.patch | 37 ++ ...it-userspace-before-unmasking-except.patch | 53 +++ ..._dispatch_rq_list-no-budget-is-a-rea.patch | 72 ++++ ...-requeue-handling-from-dispatch-code.patch | 70 ++++ ...plify-req_op_zone_reset_all-handling.patch | 103 +++++ ...fting_netdev_open-fix-error-handling.patch | 47 +++ ...06g032-drop-__packed-for-portability.patch | 55 +++ .../dm-table-remove-bug_on-in_interrupt.patch | 45 ++ ...init-clock-value-by-current-vbios-cl.patch | 53 +++ ...ra-replace-idr_init-by-idr_init_base.patch | 39 ++ ...sable-clocks-on-error-in-tegra_sor_i.patch | 54 +++ ...eak-loop-when-getting-null-device-re.patch | 40 ++ ...x-potential-user-after-free-on-probe.patch | 69 +++ ...eference-leak-in-zynq_gpio-functions.patch | 53 +++ ...bs-put-devices-before-driver-removal.patch | 62 +++ ...i40e-avoid-premature-rx-buffer-reuse.patch | 187 +++++++++ ...i40e-optimise-prefetch-page-refcount.patch | 72 ++++ queue-5.4/i40e-refactor-rx_bi-accesses.patch | 170 ++++++++ ...pcie-add-one-missing-entry-for-ax210.patch | 35 ++ ...xgbe-avoid-premature-rx-buffer-reuse.patch | 114 +++++ ...uild-avoid-split-lines-in-.mod-files.patch | 77 ++++ ...rch-override-for-clear_tasks_mm_cpum.patch | 55 +++ ...pp2-add-mvpp2_phylink_to_port-helper.patch | 117 ++++++ ...mpat-make-sure-xtables-destructors-h.patch | 189 +++++++++ ...-remove-confirmation-check-for-nft_c.patch | 42 ++ ...nset-fix-timeouts-later-than-23-days.patch | 86 ++++ ...tables-switch-synchronization-to-rcu.patch | 394 ++++++++++++++++++ ...86-intel-check-pebs-status-correctly.patch | 41 ++ ...ix-gpio-requests-on-pass-through-ban.patch | 165 ++++++++ ...-avoid-clearing-debounce-value-when-.patch | 72 ++++ ...ld-set-default-bias-in-case-no-parti.patch | 58 +++ ...ttempt-to-use-non-valid-pointer-when.patch | 79 ++++ ...sprd-use-devm_platform_ioremap_resou.patch | 67 +++ queue-5.4/scsi-bnx2i-requires-mmu.patch | 52 +++ ...rease-iocinit-request-timeout-to-30s.patch | 38 ++ ...st_offload.py-reset-ethtool-features.patch | 43 ++ ...elftests-fix-poll-error-in-udpgro.sh.patch | 48 +++ queue-5.4/series | 48 +++ ...add-needed_headroom-for-lower-device.patch | 51 +++ ...n-copy-needed_tailroom-from-lowerdev.patch | 37 ++ .../xsk-fix-xsk_poll-s-return-type.patch | 59 +++ ...lace-datagram_poll-by-sock_poll_wait.patch | 46 ++ 49 files changed, 3625 insertions(+) create mode 100644 queue-5.4/afs-fix-memory-leak-when-mounting-with-multiple-sour.patch create mode 100644 queue-5.4/arm-dts-imx6qdl-kontron-samx6i-fix-i2c_pm-scl-pin.patch create mode 100644 queue-5.4/arm-dts-imx6qdl-wandboard-revd1-remove-pad_gpio_6-fr.patch create mode 100644 queue-5.4/arm-dts-sun7i-bananapi-enable-rgmii-rx-tx-delay-on-e.patch create mode 100644 queue-5.4/arm-dts-sun7i-pcduino3-nano-enable-rgmii-rx-tx-delay.patch create mode 100644 queue-5.4/arm-dts-sun8i-r40-bananapi-m2-berry-fix-dcdc1-regula.patch create mode 100644 queue-5.4/arm-dts-sun8i-v3s-fix-gic-node-memory-range.patch create mode 100644 queue-5.4/arm-dts-sun8i-v40-bananapi-m2-berry-fix-ethernet-nod.patch create mode 100644 queue-5.4/arm64-syscall-exit-userspace-before-unmasking-except.patch create mode 100644 queue-5.4/blk-mq-in-blk_mq_dispatch_rq_list-no-budget-is-a-rea.patch create mode 100644 queue-5.4/block-factor-out-requeue-handling-from-dispatch-code.patch create mode 100644 queue-5.4/block-simplify-req_op_zone_reset_all-handling.patch create mode 100644 queue-5.4/can-softing-softing_netdev_open-fix-error-handling.patch create mode 100644 queue-5.4/clk-renesas-r9a06g032-drop-__packed-for-portability.patch create mode 100644 queue-5.4/dm-table-remove-bug_on-in_interrupt.patch create mode 100644 queue-5.4/drm-amd-display-init-clock-value-by-current-vbios-cl.patch create mode 100644 queue-5.4/drm-tegra-replace-idr_init-by-idr_init_base.patch create mode 100644 queue-5.4/drm-tegra-sor-disable-clocks-on-error-in-tegra_sor_i.patch create mode 100644 queue-5.4/gpio-eic-sprd-break-loop-when-getting-null-device-re.patch create mode 100644 queue-5.4/gpio-mvebu-fix-potential-user-after-free-on-probe.patch create mode 100644 queue-5.4/gpio-zynq-fix-reference-leak-in-zynq_gpio-functions.patch create mode 100644 queue-5.4/habanalabs-put-devices-before-driver-removal.patch create mode 100644 queue-5.4/i40e-avoid-premature-rx-buffer-reuse.patch create mode 100644 queue-5.4/i40e-optimise-prefetch-page-refcount.patch create mode 100644 queue-5.4/i40e-refactor-rx_bi-accesses.patch create mode 100644 queue-5.4/iwlwifi-pcie-add-one-missing-entry-for-ax210.patch create mode 100644 queue-5.4/ixgbe-avoid-premature-rx-buffer-reuse.patch create mode 100644 queue-5.4/kbuild-avoid-split-lines-in-.mod-files.patch create mode 100644 queue-5.4/kernel-cpu-add-arch-override-for-clear_tasks_mm_cpum.patch create mode 100644 queue-5.4/net-mvpp2-add-mvpp2_phylink_to_port-helper.patch create mode 100644 queue-5.4/netfilter-nft_compat-make-sure-xtables-destructors-h.patch create mode 100644 queue-5.4/netfilter-nft_ct-remove-confirmation-check-for-nft_c.patch create mode 100644 queue-5.4/netfilter-nft_dynset-fix-timeouts-later-than-23-days.patch create mode 100644 queue-5.4/netfilter-x_tables-switch-synchronization-to-rcu.patch create mode 100644 queue-5.4/perf-x86-intel-check-pebs-status-correctly.patch create mode 100644 queue-5.4/pinctrl-aspeed-fix-gpio-requests-on-pass-through-ban.patch create mode 100644 queue-5.4/pinctrl-baytrail-avoid-clearing-debounce-value-when-.patch create mode 100644 queue-5.4/pinctrl-merrifield-set-default-bias-in-case-no-parti.patch create mode 100644 queue-5.4/rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch create mode 100644 queue-5.4/revert-gpio-eic-sprd-use-devm_platform_ioremap_resou.patch create mode 100644 queue-5.4/scsi-bnx2i-requires-mmu.patch create mode 100644 queue-5.4/scsi-mpt3sas-increase-iocinit-request-timeout-to-30s.patch create mode 100644 queue-5.4/selftests-bpf-test_offload.py-reset-ethtool-features.patch create mode 100644 queue-5.4/selftests-fix-poll-error-in-udpgro.sh.patch create mode 100644 queue-5.4/series create mode 100644 queue-5.4/vxlan-add-needed_headroom-for-lower-device.patch create mode 100644 queue-5.4/vxlan-copy-needed_tailroom-from-lowerdev.patch create mode 100644 queue-5.4/xsk-fix-xsk_poll-s-return-type.patch create mode 100644 queue-5.4/xsk-replace-datagram_poll-by-sock_poll_wait.patch diff --git a/queue-5.4/afs-fix-memory-leak-when-mounting-with-multiple-sour.patch b/queue-5.4/afs-fix-memory-leak-when-mounting-with-multiple-sour.patch new file mode 100644 index 00000000000..e5d583bc1c2 --- /dev/null +++ b/queue-5.4/afs-fix-memory-leak-when-mounting-with-multiple-sour.patch @@ -0,0 +1,60 @@ +From 2ed70139e0b002757566915b336ddc2b8d268e15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 23:52:03 +0000 +Subject: afs: Fix memory leak when mounting with multiple source parameters + +From: David Howells + +[ Upstream commit 4cb682964706deffb4861f0a91329ab3a705039f ] + +There's a memory leak in afs_parse_source() whereby multiple source= +parameters overwrite fc->source in the fs_context struct without freeing +the previously recorded source. + +Fix this by only permitting a single source parameter and rejecting with +an error all subsequent ones. + +This was caught by syzbot with the kernel memory leak detector, showing +something like the following trace: + + unreferenced object 0xffff888114375440 (size 32): + comm "repro", pid 5168, jiffies 4294923723 (age 569.948s) + backtrace: + slab_post_alloc_hook+0x42/0x79 + __kmalloc_track_caller+0x125/0x16a + kmemdup_nul+0x24/0x3c + vfs_parse_fs_string+0x5a/0xa1 + generic_parse_monolithic+0x9d/0xc5 + do_new_mount+0x10d/0x15a + do_mount+0x5f/0x8e + __do_sys_mount+0xff/0x127 + do_syscall_64+0x2d/0x3a + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: 13fcc6837049 ("afs: Add fs_context support") +Reported-by: syzbot+86dc6632faaca40133ab@syzkaller.appspotmail.com +Signed-off-by: David Howells +cc: Randy Dunlap +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/afs/super.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/afs/super.c b/fs/afs/super.c +index 7f8a9b3137bff..eb04dcc543289 100644 +--- a/fs/afs/super.c ++++ b/fs/afs/super.c +@@ -236,6 +236,9 @@ static int afs_parse_source(struct fs_context *fc, struct fs_parameter *param) + + _enter(",%s", name); + ++ if (fc->source) ++ return invalf(fc, "kAFS: Multiple sources not supported"); ++ + if (!name) { + printk(KERN_ERR "kAFS: no volume name specified\n"); + return -EINVAL; +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-imx6qdl-kontron-samx6i-fix-i2c_pm-scl-pin.patch b/queue-5.4/arm-dts-imx6qdl-kontron-samx6i-fix-i2c_pm-scl-pin.patch new file mode 100644 index 00000000000..daccada7648 --- /dev/null +++ b/queue-5.4/arm-dts-imx6qdl-kontron-samx6i-fix-i2c_pm-scl-pin.patch @@ -0,0 +1,38 @@ +From 8f078091e355d9627992e533ee148e82d24116cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 18:56:28 +0100 +Subject: ARM: dts: imx6qdl-kontron-samx6i: fix I2C_PM scl pin + +From: Bernd Bauer + +[ Upstream commit 19ba8fb810c60b46869acc9f455613de454e0fca ] + +Use the correct pin for the i2c scl signal else we can't access the +SoM eeprom. + +Fixes: 2a51f9dae13d ("ARM: dts: imx6qdl-kontron-samx6i: Add iMX6-based Kontron SMARC-sAMX6i module") +Signed-off-by: Bernd Bauer +[m.felsch@pengutronix.de: Adapt commit message] +Signed-off-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +index 81c7ebb4b3fbe..6acc8591219a7 100644 +--- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +@@ -551,7 +551,7 @@ + + pinctrl_i2c3: i2c3grp { + fsl,pins = < +- MX6QDL_PAD_GPIO_3__I2C3_SCL 0x4001b8b1 ++ MX6QDL_PAD_GPIO_5__I2C3_SCL 0x4001b8b1 + MX6QDL_PAD_GPIO_16__I2C3_SDA 0x4001b8b1 + >; + }; +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-imx6qdl-wandboard-revd1-remove-pad_gpio_6-fr.patch b/queue-5.4/arm-dts-imx6qdl-wandboard-revd1-remove-pad_gpio_6-fr.patch new file mode 100644 index 00000000000..15dea3b3727 --- /dev/null +++ b/queue-5.4/arm-dts-imx6qdl-wandboard-revd1-remove-pad_gpio_6-fr.patch @@ -0,0 +1,41 @@ +From b0db0dcf8b6c2d2c749a8414fa216e0e2da66f1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 17:54:47 -0300 +Subject: ARM: dts: imx6qdl-wandboard-revd1: Remove PAD_GPIO_6 from enetgrp + +From: Fabio Estevam + +[ Upstream commit 58d6bca5efc73235b0f84c0d53321737177c651e ] + +Since commit 8ad2d1dcce54 ("ARM: dts: imx6qdl-wandboard: Add OV5645 camera +support") the PAD_GPIO_6 is used for providing the camera sensor clock. + +Remove it from the enetgrp to fix the following IOMXU conflict: + +[ 9.972414] imx6q-pinctrl 20e0000.pinctrl: pin MX6Q_PAD_GPIO_6 already requested by 2188000.ethernet; cannot claim for 1-003c +[ 9.983857] imx6q-pinctrl 20e0000.pinctrl: pin-140 (1-003c) status -22 +[ 9.990514] imx6q-pinctrl 20e0000.pinctrl: could not request pin 140 (MX6Q_PAD_GPIO_6) from group ov5645grp on device 20e0000.pinctrl + +Fixes: 8ad2d1dcce54 ("ARM: dts: imx6qdl-wandboard: Add OV5645 camera support") +Signed-off-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi +index 93909796885a0..b9b698f72b261 100644 +--- a/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-wandboard-revd1.dtsi +@@ -166,7 +166,6 @@ + MX6QDL_PAD_RGMII_RD2__RGMII_RD2 0x1b030 + MX6QDL_PAD_RGMII_RD3__RGMII_RD3 0x1b030 + MX6QDL_PAD_RGMII_RX_CTL__RGMII_RX_CTL 0x1b030 +- MX6QDL_PAD_GPIO_6__ENET_IRQ 0x000b1 + >; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-sun7i-bananapi-enable-rgmii-rx-tx-delay-on-e.patch b/queue-5.4/arm-dts-sun7i-bananapi-enable-rgmii-rx-tx-delay-on-e.patch new file mode 100644 index 00000000000..7a38cc3aaa8 --- /dev/null +++ b/queue-5.4/arm-dts-sun7i-bananapi-enable-rgmii-rx-tx-delay-on-e.patch @@ -0,0 +1,42 @@ +From 150deac78c3fc77b4ff107f5fe6ef5741d0d0e3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 11:16:40 -0300 +Subject: ARM: dts: sun7i: bananapi: Enable RGMII RX/TX delay on Ethernet PHY + +From: Pablo Greco + +[ Upstream commit 8c9cb4094ccf242eddd140efba13872c55f68a87 ] + +The Ethernet PHY on the Bananapi M1 has the RX and TX delays enabled on +the PHY, using pull-ups on the RXDLY and TXDLY pins. + +Fix the phy-mode description to correct reflect this so that the +implementation doesn't reconfigure the delays incorrectly. This +happened with commit bbc4d71d6354 ("net: phy: realtek: fix rtl8211e +rx/tx delay config"). + +Fixes: 8a5b272fbf44 ("ARM: dts: sun7i: Add Banana Pi board") +Signed-off-by: Pablo Greco +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/1604326600-39544-1-git-send-email-pgreco@centosproject.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun7i-a20-bananapi.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun7i-a20-bananapi.dts b/arch/arm/boot/dts/sun7i-a20-bananapi.dts +index bb3987e101c29..0b3d9ae756503 100644 +--- a/arch/arm/boot/dts/sun7i-a20-bananapi.dts ++++ b/arch/arm/boot/dts/sun7i-a20-bananapi.dts +@@ -132,7 +132,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-supply = <®_gmac_3v3>; + status = "okay"; + }; +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-sun7i-pcduino3-nano-enable-rgmii-rx-tx-delay.patch b/queue-5.4/arm-dts-sun7i-pcduino3-nano-enable-rgmii-rx-tx-delay.patch new file mode 100644 index 00000000000..4c4616faccb --- /dev/null +++ b/queue-5.4/arm-dts-sun7i-pcduino3-nano-enable-rgmii-rx-tx-delay.patch @@ -0,0 +1,56 @@ +From 1ab197332b9a6fcca02f1296c6136853ffd13ad8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 17:47:39 +0000 +Subject: ARM: dts: sun7i: pcduino3-nano: enable RGMII RX/TX delay on PHY + +From: Adam Sampson + +[ Upstream commit a7361b9c4615951f52ffd2b1afa09a1384c7b4e4 ] + +The RX/TX delays for the Ethernet PHY on the Linksprite pcDuino 3 Nano +are configured in hardware, using resistors that are populated to pull +the RTL8211E's RXDLY/TXDLY pins low or high as needed. + +phy-mode should be set to rgmii-id to reflect this. Previously it was +set to rgmii, which used to work but now results in the delays being +disabled again as a result of the bugfix in commit bbc4d71d6354 ("net: +phy: realtek: fix rtl8211e rx/tx delay config"). + +Tested on two pcDuino 3 Nano boards purchased in 2015. Without this fix, +Ethernet works unreliably on one board and doesn't work at all on the +other. + +Fixes: 061035d456c9 ("ARM: dts: sun7i: Add dts file for pcDuino 3 Nano board") +Signed-off-by: Adam Sampson +Signed-off-by: Maxime Ripard +Reviewed-by: Andrew Lunn +Acked-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20201123174739.6809-1-ats@offog.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts b/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts +index fce2f7fcd084a..bf38c66c1815b 100644 +--- a/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts ++++ b/arch/arm/boot/dts/sun7i-a20-pcduino3-nano.dts +@@ -1,5 +1,5 @@ + /* +- * Copyright 2015 Adam Sampson ++ * Copyright 2015-2020 Adam Sampson + * + * This file is dual-licensed: you can use it either under the terms + * of the GPL or the X11 license, at your option. Note that this dual +@@ -115,7 +115,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-sun8i-r40-bananapi-m2-berry-fix-dcdc1-regula.patch b/queue-5.4/arm-dts-sun8i-r40-bananapi-m2-berry-fix-dcdc1-regula.patch new file mode 100644 index 00000000000..d9fdbe42d62 --- /dev/null +++ b/queue-5.4/arm-dts-sun8i-r40-bananapi-m2-berry-fix-dcdc1-regula.patch @@ -0,0 +1,55 @@ +From 495ff24f31f535f5f8fdf94ff09dbf7d26691806 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 11:19:14 -0300 +Subject: ARM: dts: sun8i: r40: bananapi-m2-berry: Fix dcdc1 regulator + +From: Pablo Greco + +[ Upstream commit bd5cdcdc66e1f7179ff6d172d1e5f55e43403aa8 ] + +DCDC1 regulator powers many different subsystems. While some of them can +work at 3.0 V, some of them can not. For example, VCC-HDMI can only work +between 3.24 V and 3.36 V. According to OS images provided by the board +manufacturer this regulator should be set to 3.3 V. + +Set DCDC1 and DCDC1SW to 3.3 V in order to fix this. + +Fixes: 23edc168bd98 ("ARM: dts: sun8i: Add board dts file for Banana Pi M2 Berry") +Fixes: 27e81e1970a8 ("ARM: dts: sun8i: v40: bananapi-m2-berry: Enable GMAC ethernet controller") +Signed-off-by: Pablo Greco +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/1604326755-39742-1-git-send-email-pgreco@centosproject.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +index 15c22b06fc4b6..84eb082957183 100644 +--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts ++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +@@ -198,16 +198,16 @@ + }; + + ®_dc1sw { +- regulator-min-microvolt = <3000000>; +- regulator-max-microvolt = <3000000>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; + regulator-name = "vcc-gmac-phy"; + }; + + ®_dcdc1 { + regulator-always-on; +- regulator-min-microvolt = <3000000>; +- regulator-max-microvolt = <3000000>; +- regulator-name = "vcc-3v0"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-name = "vcc-3v3"; + }; + + ®_dcdc2 { +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-sun8i-v3s-fix-gic-node-memory-range.patch b/queue-5.4/arm-dts-sun8i-v3s-fix-gic-node-memory-range.patch new file mode 100644 index 00000000000..80ba540e3e2 --- /dev/null +++ b/queue-5.4/arm-dts-sun8i-v3s-fix-gic-node-memory-range.patch @@ -0,0 +1,39 @@ +From 9634142600b5a91a0d50b84ab8696336c98b6f2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 13:08:51 +0800 +Subject: ARM: dts: sun8i: v3s: fix GIC node memory range + +From: Icenowy Zheng + +[ Upstream commit a98fd117a2553ab1a6d2fe3c7acae88c1eca4372 ] + +Currently the GIC node in V3s DTSI follows some old DT examples, and +being broken. This leads a warning at boot. + +Fix this. + +Fixes: f989086ccbc6 ("ARM: dts: sunxi: add dtsi file for V3s SoC") +Signed-off-by: Icenowy Zheng +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201120050851.4123759-1-icenowy@aosc.io +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-v3s.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi +index 2abcba35d27e6..50c32cf72c65c 100644 +--- a/arch/arm/boot/dts/sun8i-v3s.dtsi ++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi +@@ -423,7 +423,7 @@ + gic: interrupt-controller@1c81000 { + compatible = "arm,gic-400"; + reg = <0x01c81000 0x1000>, +- <0x01c82000 0x1000>, ++ <0x01c82000 0x2000>, + <0x01c84000 0x2000>, + <0x01c86000 0x2000>; + interrupt-controller; +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-sun8i-v40-bananapi-m2-berry-fix-ethernet-nod.patch b/queue-5.4/arm-dts-sun8i-v40-bananapi-m2-berry-fix-ethernet-nod.patch new file mode 100644 index 00000000000..81f614c3d1e --- /dev/null +++ b/queue-5.4/arm-dts-sun8i-v40-bananapi-m2-berry-fix-ethernet-nod.patch @@ -0,0 +1,37 @@ +From 014424c301ff8753dc52cfcad4ebf4be2d76ba6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 11:19:29 -0300 +Subject: ARM: dts: sun8i: v40: bananapi-m2-berry: Fix ethernet node + +From: Pablo Greco + +[ Upstream commit 8a82d91fa275aaea49be06d7f5b1407ce1c0dd4b ] + +Ethernet PHY on BananaPi M2 Berry provides RX and TX delays. Fix ethernet +node to reflect that fact. + +Fixes: 27e81e1970a8 ("ARM: dts: sun8i: v40: bananapi-m2-berry: Enable GMAC ethernet controller") +Signed-off-by: Pablo Greco +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/1604326769-39802-1-git-send-email-pgreco@centosproject.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +index 84eb082957183..47954551f5735 100644 +--- a/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts ++++ b/arch/arm/boot/dts/sun8i-v40-bananapi-m2-berry.dts +@@ -120,7 +120,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&gmac_rgmii_pins>; + phy-handle = <&phy1>; +- phy-mode = "rgmii"; ++ phy-mode = "rgmii-id"; + phy-supply = <®_dc1sw>; + status = "okay"; + }; +-- +2.27.0 + diff --git a/queue-5.4/arm64-syscall-exit-userspace-before-unmasking-except.patch b/queue-5.4/arm64-syscall-exit-userspace-before-unmasking-except.patch new file mode 100644 index 00000000000..7724c62f988 --- /dev/null +++ b/queue-5.4/arm64-syscall-exit-userspace-before-unmasking-except.patch @@ -0,0 +1,53 @@ +From 6aeaa2c54c5ca27cec268fafbaced1e026f19ac0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 11:59:40 +0000 +Subject: arm64: syscall: exit userspace before unmasking exceptions + +From: Mark Rutland + +[ Upstream commit ca1314d73eed493c49bb1932c60a8605530db2e4 ] + +In el0_svc_common() we unmask exceptions before we call user_exit(), and +so there's a window where an IRQ or debug exception can be taken while +RCU is not watching. In do_debug_exception() we account for this in via +debug_exception_{enter,exit}(), but in the el1_irq asm we do not and we +call trace functions which rely on RCU before we have a guarantee that +RCU is watching. + +Let's avoid this by having el0_svc_common() exit userspace before +unmasking exceptions, matching what we do for all other EL0 entry paths. +We can use user_exit_irqoff() to avoid the pointless save/restore of IRQ +flags while we're sure exceptions are masked in DAIF. + +The workaround for Cortex-A76 erratum 1463225 may trigger a debug +exception before this point, but the debug code invoked in this case is +safe even when RCU is not watching. + +Signed-off-by: Mark Rutland +Cc: Catalin Marinas +Cc: James Morse +Cc: Will Deacon +Link: https://lore.kernel.org/r/20201130115950.22492-2-mark.rutland@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/syscall.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/syscall.c b/arch/arm64/kernel/syscall.c +index 1457a0ba83dbc..f2d2dbbbfca20 100644 +--- a/arch/arm64/kernel/syscall.c ++++ b/arch/arm64/kernel/syscall.c +@@ -102,8 +102,8 @@ static void el0_svc_common(struct pt_regs *regs, int scno, int sc_nr, + regs->syscallno = scno; + + cortex_a76_erratum_1463225_svc_handler(); ++ user_exit_irqoff(); + local_daif_restore(DAIF_PROCCTX); +- user_exit(); + + if (has_syscall_work(flags)) { + /* set default errno for user-issued syscall(-1) */ +-- +2.27.0 + diff --git a/queue-5.4/blk-mq-in-blk_mq_dispatch_rq_list-no-budget-is-a-rea.patch b/queue-5.4/blk-mq-in-blk_mq_dispatch_rq_list-no-budget-is-a-rea.patch new file mode 100644 index 00000000000..c1b86dd0e6a --- /dev/null +++ b/queue-5.4/blk-mq-in-blk_mq_dispatch_rq_list-no-budget-is-a-rea.patch @@ -0,0 +1,72 @@ +From b5e6ef0a5491378cf44d3a48dd7572e542580a26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Apr 2020 09:24:51 -0700 +Subject: blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick + +From: Douglas Anderson + +[ Upstream commit ab3cee3762e5e69f27c302c43691289fdfc12316 ] + +In blk_mq_dispatch_rq_list(), if blk_mq_sched_needs_restart() returns +true and the driver returns BLK_STS_RESOURCE then we'll kick the +queue. However, there's another case where we might need to kick it. +If we were unable to get budget we can be in much the same state as +when the driver returns BLK_STS_RESOURCE, so we should treat it the +same. + +It should be noted that even if we add a whole bunch of extra kicking +to the queue in other patches this patch is still important. +Specifically any kicking that happened before we re-spliced leftover +requests into 'hctx->dispatch' wouldn't have found any work, so we +really need to make sure we kick ourselves after we've done the +splicing. + +Signed-off-by: Douglas Anderson +Reviewed-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index c0efd3e278da6..057a634396a90 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1233,6 +1233,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, + bool no_tag = false; + int errors, queued; + blk_status_t ret = BLK_STS_OK; ++ bool no_budget_avail = false; + + if (list_empty(list)) + return false; +@@ -1251,6 +1252,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, + hctx = rq->mq_hctx; + if (!got_budget && !blk_mq_get_dispatch_budget(hctx)) { + blk_mq_put_driver_tag(rq); ++ no_budget_avail = true; + break; + } + +@@ -1356,13 +1358,15 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, + * + * If driver returns BLK_STS_RESOURCE and SCHED_RESTART + * bit is set, run queue after a delay to avoid IO stalls +- * that could otherwise occur if the queue is idle. ++ * that could otherwise occur if the queue is idle. We'll do ++ * similar if we couldn't get budget and SCHED_RESTART is set. + */ + needs_restart = blk_mq_sched_needs_restart(hctx); + if (!needs_restart || + (no_tag && list_empty_careful(&hctx->dispatch_wait.entry))) + blk_mq_run_hw_queue(hctx, true); +- else if (needs_restart && (ret == BLK_STS_RESOURCE)) ++ else if (needs_restart && (ret == BLK_STS_RESOURCE || ++ no_budget_avail)) + blk_mq_delay_run_hw_queue(hctx, BLK_MQ_RESOURCE_DELAY); + + blk_mq_update_dispatch_busy(hctx, true); +-- +2.27.0 + diff --git a/queue-5.4/block-factor-out-requeue-handling-from-dispatch-code.patch b/queue-5.4/block-factor-out-requeue-handling-from-dispatch-code.patch new file mode 100644 index 00000000000..e88785ba809 --- /dev/null +++ b/queue-5.4/block-factor-out-requeue-handling-from-dispatch-code.patch @@ -0,0 +1,70 @@ +From fc5a9f0402167e00c92335cd3a449ec143d28c31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Mar 2020 00:24:44 +0900 +Subject: block: factor out requeue handling from dispatch code + +From: Johannes Thumshirn + +[ Upstream commit c92a41031a6d57395889b5c87cea359220a24d2a ] + +Factor out the requeue handling from the dispatch code, this will make +subsequent addition of different requeueing schemes easier. + +Signed-off-by: Johannes Thumshirn +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index b748d1e63f9c8..c0efd3e278da6 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1205,6 +1205,23 @@ static void blk_mq_update_dispatch_busy(struct blk_mq_hw_ctx *hctx, bool busy) + + #define BLK_MQ_RESOURCE_DELAY 3 /* ms units */ + ++static void blk_mq_handle_dev_resource(struct request *rq, ++ struct list_head *list) ++{ ++ struct request *next = ++ list_first_entry_or_null(list, struct request, queuelist); ++ ++ /* ++ * If an I/O scheduler has been configured and we got a driver tag for ++ * the next request already, free it. ++ */ ++ if (next) ++ blk_mq_put_driver_tag(next); ++ ++ list_add(&rq->queuelist, list); ++ __blk_mq_requeue_request(rq); ++} ++ + /* + * Returns true if we did some work AND can potentially do more. + */ +@@ -1274,17 +1291,7 @@ bool blk_mq_dispatch_rq_list(struct request_queue *q, struct list_head *list, + + ret = q->mq_ops->queue_rq(hctx, &bd); + if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) { +- /* +- * If an I/O scheduler has been configured and we got a +- * driver tag for the next request already, free it +- * again. +- */ +- if (!list_empty(list)) { +- nxt = list_first_entry(list, struct request, queuelist); +- blk_mq_put_driver_tag(nxt); +- } +- list_add(&rq->queuelist, list); +- __blk_mq_requeue_request(rq); ++ blk_mq_handle_dev_resource(rq, list); + break; + } + +-- +2.27.0 + diff --git a/queue-5.4/block-simplify-req_op_zone_reset_all-handling.patch b/queue-5.4/block-simplify-req_op_zone_reset_all-handling.patch new file mode 100644 index 00000000000..8b92bb43123 --- /dev/null +++ b/queue-5.4/block-simplify-req_op_zone_reset_all-handling.patch @@ -0,0 +1,103 @@ +From 53352fcb346ff1f3327adc7ca695b2105b20bada Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Oct 2019 23:05:43 +0900 +Subject: block: Simplify REQ_OP_ZONE_RESET_ALL handling + +From: Damien Le Moal + +[ Upstream commit c7a1d926dc4076aadad187614500afcd8de78818 ] + +There is no need for the function __blkdev_reset_all_zones() as +REQ_OP_ZONE_RESET_ALL can be handled directly in blkdev_reset_zones() +bio loop with an early break from the loop. This patch removes this +function and modifies blkdev_reset_zones(), simplifying the code. + +Reviewed-by: Christoph Hellwig +Signed-off-by: Damien Le Moal +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-zoned.c | 40 +++++++++++++--------------------------- + 1 file changed, 13 insertions(+), 27 deletions(-) + +diff --git a/block/blk-zoned.c b/block/blk-zoned.c +index 4bc5f260248a6..b17c094cb977c 100644 +--- a/block/blk-zoned.c ++++ b/block/blk-zoned.c +@@ -202,32 +202,14 @@ int blkdev_report_zones(struct block_device *bdev, sector_t sector, + } + EXPORT_SYMBOL_GPL(blkdev_report_zones); + +-/* +- * Special case of zone reset operation to reset all zones in one command, +- * useful for applications like mkfs. +- */ +-static int __blkdev_reset_all_zones(struct block_device *bdev, gfp_t gfp_mask) +-{ +- struct bio *bio = bio_alloc(gfp_mask, 0); +- int ret; +- +- /* across the zones operations, don't need any sectors */ +- bio_set_dev(bio, bdev); +- bio_set_op_attrs(bio, REQ_OP_ZONE_RESET_ALL, 0); +- +- ret = submit_bio_wait(bio); +- bio_put(bio); +- +- return ret; +-} +- + static inline bool blkdev_allow_reset_all_zones(struct block_device *bdev, ++ sector_t sector, + sector_t nr_sectors) + { + if (!blk_queue_zone_resetall(bdev_get_queue(bdev))) + return false; + +- if (nr_sectors != part_nr_sects_read(bdev->bd_part)) ++ if (sector || nr_sectors != part_nr_sects_read(bdev->bd_part)) + return false; + /* + * REQ_OP_ZONE_RESET_ALL can be executed only if the block device is +@@ -271,9 +253,6 @@ int blkdev_reset_zones(struct block_device *bdev, + /* Out of range */ + return -EINVAL; + +- if (blkdev_allow_reset_all_zones(bdev, nr_sectors)) +- return __blkdev_reset_all_zones(bdev, gfp_mask); +- + /* Check alignment (handle eventual smaller last zone) */ + zone_sectors = blk_queue_zone_sectors(q); + if (sector & (zone_sectors - 1)) +@@ -285,17 +264,24 @@ int blkdev_reset_zones(struct block_device *bdev, + + blk_start_plug(&plug); + while (sector < end_sector) { +- + bio = blk_next_bio(bio, 0, gfp_mask); +- bio->bi_iter.bi_sector = sector; + bio_set_dev(bio, bdev); +- bio_set_op_attrs(bio, REQ_OP_ZONE_RESET, 0); + ++ /* ++ * Special case for the zone reset operation that reset all ++ * zones, this is useful for applications like mkfs. ++ */ ++ if (blkdev_allow_reset_all_zones(bdev, sector, nr_sectors)) { ++ bio->bi_opf = REQ_OP_ZONE_RESET_ALL; ++ break; ++ } ++ ++ bio->bi_opf = REQ_OP_ZONE_RESET; ++ bio->bi_iter.bi_sector = sector; + sector += zone_sectors; + + /* This may take a while, so be nice to others */ + cond_resched(); +- + } + + ret = submit_bio_wait(bio); +-- +2.27.0 + diff --git a/queue-5.4/can-softing-softing_netdev_open-fix-error-handling.patch b/queue-5.4/can-softing-softing_netdev_open-fix-error-handling.patch new file mode 100644 index 00000000000..bc3519e0dc8 --- /dev/null +++ b/queue-5.4/can-softing-softing_netdev_open-fix-error-handling.patch @@ -0,0 +1,47 @@ +From 5ca41e30b4e70a7ea7427e30080e74de73c619dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 14:35:06 +0100 +Subject: can: softing: softing_netdev_open(): fix error handling + +From: Zhang Qilong + +[ Upstream commit 4d1be581ec6b92a338bb7ed23e1381f45ddf336f ] + +If softing_netdev_open() fails, we should call close_candev() to avoid +reference leak. + +Fixes: 03fd3cf5a179d ("can: add driver for Softing card") +Signed-off-by: Zhang Qilong +Acked-by: Kurt Van Dijck +Link: https://lore.kernel.org/r/20201202151632.1343786-1-zhangqilong3@huawei.com +Signed-off-by: Marc Kleine-Budde +Link: https://lore.kernel.org/r/20201204133508.742120-2-mkl@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/can/softing/softing_main.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c +index 8242fb287cbbe..16e3f55efa311 100644 +--- a/drivers/net/can/softing/softing_main.c ++++ b/drivers/net/can/softing/softing_main.c +@@ -382,8 +382,13 @@ static int softing_netdev_open(struct net_device *ndev) + + /* check or determine and set bittime */ + ret = open_candev(ndev); +- if (!ret) +- ret = softing_startstop(ndev, 1); ++ if (ret) ++ return ret; ++ ++ ret = softing_startstop(ndev, 1); ++ if (ret < 0) ++ close_candev(ndev); ++ + return ret; + } + +-- +2.27.0 + diff --git a/queue-5.4/clk-renesas-r9a06g032-drop-__packed-for-portability.patch b/queue-5.4/clk-renesas-r9a06g032-drop-__packed-for-portability.patch new file mode 100644 index 00000000000..cbaed2e288a --- /dev/null +++ b/queue-5.4/clk-renesas-r9a06g032-drop-__packed-for-portability.patch @@ -0,0 +1,55 @@ +From 08e4efac890ed579e6db876c944e4382b0a67789 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 09:57:43 +0100 +Subject: clk: renesas: r9a06g032: Drop __packed for portability + +From: Geert Uytterhoeven + +[ Upstream commit ceabbf94c317c6175dee6e91805fca4a6353745a ] + +The R9A06G032 clock driver uses an array of packed structures to reduce +kernel size. However, this array contains pointers, which are no longer +aligned naturally, and cannot be relocated on PPC64. Hence when +compile-testing this driver on PPC64 with CONFIG_RELOCATABLE=y (e.g. +PowerPC allyesconfig), the following warnings are produced: + + WARNING: 136 bad relocations + c000000000616be3 R_PPC64_UADDR64 .rodata+0x00000000000cf338 + c000000000616bfe R_PPC64_UADDR64 .rodata+0x00000000000cf370 + ... + +Fix this by dropping the __packed attribute from the r9a06g032_clkdesc +definition, trading a small size increase for portability. + +This increases the 156-entry clock table by 1 byte per entry, but due to +the compiler generating more efficient code for unpacked accesses, the +net size increase is only 76 bytes (gcc 9.3.0 on arm32). + +Reported-by: Stephen Rothwell +Fixes: 4c3d88526eba2143 ("clk: renesas: Renesas R9A06G032 clock driver") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20201130085743.1656317-1-geert+renesas@glider.be +Tested-by: Stephen Rothwell # PowerPC allyesconfig build +Acked-by: Stephen Boyd +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/renesas/r9a06g032-clocks.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/renesas/r9a06g032-clocks.c b/drivers/clk/renesas/r9a06g032-clocks.c +index 1907ee195a08c..f2dc625b745da 100644 +--- a/drivers/clk/renesas/r9a06g032-clocks.c ++++ b/drivers/clk/renesas/r9a06g032-clocks.c +@@ -55,7 +55,7 @@ struct r9a06g032_clkdesc { + u16 sel, g1, r1, g2, r2; + } dual; + }; +-} __packed; ++}; + + #define I_GATE(_clk, _rst, _rdy, _midle, _scon, _mirack, _mistat) \ + { .gate = _clk, .reset = _rst, \ +-- +2.27.0 + diff --git a/queue-5.4/dm-table-remove-bug_on-in_interrupt.patch b/queue-5.4/dm-table-remove-bug_on-in_interrupt.patch new file mode 100644 index 00000000000..aa6d5bbb223 --- /dev/null +++ b/queue-5.4/dm-table-remove-bug_on-in_interrupt.patch @@ -0,0 +1,45 @@ +From ebbedab683460cfd78c3cd447a5a0072ba444cf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 15:19:10 +0100 +Subject: dm table: Remove BUG_ON(in_interrupt()) + +From: Thomas Gleixner + +[ Upstream commit e7b624183d921b49ef0a96329f21647d38865ee9 ] + +The BUG_ON(in_interrupt()) in dm_table_event() is a historic leftover from +a rework of the dm table code which changed the calling context. + +Issuing a BUG for a wrong calling context is frowned upon and +in_interrupt() is deprecated and only covering parts of the wrong +contexts. The sanity check for the context is covered by +CONFIG_DEBUG_ATOMIC_SLEEP and other debug facilities already. + +Signed-off-by: Thomas Gleixner +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-table.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 13ad791126618..6dd56afa048c2 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -1320,12 +1320,6 @@ void dm_table_event_callback(struct dm_table *t, + + void dm_table_event(struct dm_table *t) + { +- /* +- * You can no longer call dm_table_event() from interrupt +- * context, use a bottom half instead. +- */ +- BUG_ON(in_interrupt()); +- + mutex_lock(&_event_lock); + if (t->event_fn) + t->event_fn(t->event_context); +-- +2.27.0 + diff --git a/queue-5.4/drm-amd-display-init-clock-value-by-current-vbios-cl.patch b/queue-5.4/drm-amd-display-init-clock-value-by-current-vbios-cl.patch new file mode 100644 index 00000000000..3d660e6ab79 --- /dev/null +++ b/queue-5.4/drm-amd-display-init-clock-value-by-current-vbios-cl.patch @@ -0,0 +1,53 @@ +From f3758db7a74e25f7f582a3a236b32bd9816187fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 15:35:52 +0800 +Subject: drm/amd/display: Init clock value by current vbios CLKs + +From: Brandon Syu + +[ Upstream commit 7e0b367db85ef7b91399006253759a024eab7653 ] + +[Why] +While booting into OS, driver updates DPP/DISP CLKs. +But init clock value is zero which is invalid. + +[How] +Get current clocks value to update init clocks. +To avoid underflow. + +Signed-off-by: Brandon Syu +Reviewed-by: Tony Cheng +Acked-by: Aurabindo Pillai +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +index dd92f9c295b45..9f301f8575a54 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +@@ -97,8 +97,17 @@ void rn_update_clocks(struct clk_mgr *clk_mgr_base, + new_clocks->dppclk_khz = 100000; + } + +- if (should_set_clock(safe_to_lower, new_clocks->dppclk_khz, clk_mgr->base.clks.dppclk_khz)) { +- if (clk_mgr->base.clks.dppclk_khz > new_clocks->dppclk_khz) ++ /* ++ * Temporally ignore thew 0 cases for disp and dpp clks. ++ * We may have a new feature that requires 0 clks in the future. ++ */ ++ if (new_clocks->dppclk_khz == 0 || new_clocks->dispclk_khz == 0) { ++ new_clocks->dppclk_khz = clk_mgr_base->clks.dppclk_khz; ++ new_clocks->dispclk_khz = clk_mgr_base->clks.dispclk_khz; ++ } ++ ++ if (should_set_clock(safe_to_lower, new_clocks->dppclk_khz, clk_mgr_base->clks.dppclk_khz)) { ++ if (clk_mgr_base->clks.dppclk_khz > new_clocks->dppclk_khz) + dpp_clock_lowered = true; + clk_mgr_base->clks.dppclk_khz = new_clocks->dppclk_khz; + update_dppclk = true; +-- +2.27.0 + diff --git a/queue-5.4/drm-tegra-replace-idr_init-by-idr_init_base.patch b/queue-5.4/drm-tegra-replace-idr_init-by-idr_init_base.patch new file mode 100644 index 00000000000..0deed515109 --- /dev/null +++ b/queue-5.4/drm-tegra-replace-idr_init-by-idr_init_base.patch @@ -0,0 +1,39 @@ +From abdcffdae2a1cd443a507187798131c95e1fc0e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 23:29:28 +0530 +Subject: drm/tegra: replace idr_init() by idr_init_base() + +From: Deepak R Varma + +[ Upstream commit 41f71629b4c432f8dd47d70ace813be5f79d4d75 ] + +idr_init() uses base 0 which is an invalid identifier for this driver. +The new function idr_init_base allows IDR to set the ID lookup from +base 1. This avoids all lookups that otherwise starts from 0 since +0 is always unused. + +References: commit 6ce711f27500 ("idr: Make 1-based IDRs more efficient") + +Signed-off-by: Deepak R Varma +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/drm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c +index bc7cc32140f81..6833dfad7241b 100644 +--- a/drivers/gpu/drm/tegra/drm.c ++++ b/drivers/gpu/drm/tegra/drm.c +@@ -256,7 +256,7 @@ static int tegra_drm_open(struct drm_device *drm, struct drm_file *filp) + if (!fpriv) + return -ENOMEM; + +- idr_init(&fpriv->contexts); ++ idr_init_base(&fpriv->contexts, 1); + mutex_init(&fpriv->lock); + filp->driver_priv = fpriv; + +-- +2.27.0 + diff --git a/queue-5.4/drm-tegra-sor-disable-clocks-on-error-in-tegra_sor_i.patch b/queue-5.4/drm-tegra-sor-disable-clocks-on-error-in-tegra_sor_i.patch new file mode 100644 index 00000000000..4d2afc67134 --- /dev/null +++ b/queue-5.4/drm-tegra-sor-disable-clocks-on-error-in-tegra_sor_i.patch @@ -0,0 +1,54 @@ +From 105a9483b0ff87bcca4ff322554999673acd3829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 09:34:24 +0800 +Subject: drm/tegra: sor: Disable clocks on error in tegra_sor_init() + +From: Qinglang Miao + +[ Upstream commit bf3a3cdcad40e5928a22ea0fd200d17fd6d6308d ] + +Fix the missing clk_disable_unprepare() before return from +tegra_sor_init() in the error handling case. + +Signed-off-by: Qinglang Miao +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/sor.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/sor.c b/drivers/gpu/drm/tegra/sor.c +index 75e65d9536d54..6c3d221652393 100644 +--- a/drivers/gpu/drm/tegra/sor.c ++++ b/drivers/gpu/drm/tegra/sor.c +@@ -2899,6 +2899,7 @@ static int tegra_sor_init(struct host1x_client *client) + if (err < 0) { + dev_err(sor->dev, "failed to deassert SOR reset: %d\n", + err); ++ clk_disable_unprepare(sor->clk); + return err; + } + +@@ -2906,12 +2907,17 @@ static int tegra_sor_init(struct host1x_client *client) + } + + err = clk_prepare_enable(sor->clk_safe); +- if (err < 0) ++ if (err < 0) { ++ clk_disable_unprepare(sor->clk); + return err; ++ } + + err = clk_prepare_enable(sor->clk_dp); +- if (err < 0) ++ if (err < 0) { ++ clk_disable_unprepare(sor->clk_safe); ++ clk_disable_unprepare(sor->clk); + return err; ++ } + + /* + * Enable and unmask the HDA codec SCRATCH0 register interrupt. This +-- +2.27.0 + diff --git a/queue-5.4/gpio-eic-sprd-break-loop-when-getting-null-device-re.patch b/queue-5.4/gpio-eic-sprd-break-loop-when-getting-null-device-re.patch new file mode 100644 index 00000000000..742aa0aff5d --- /dev/null +++ b/queue-5.4/gpio-eic-sprd-break-loop-when-getting-null-device-re.patch @@ -0,0 +1,40 @@ +From f9c84771c8384660b92add15120aeef0f46188df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 13:51:06 +0800 +Subject: gpio: eic-sprd: break loop when getting NULL device resource + +From: Chunyan Zhang + +[ Upstream commit 263ade7166a2e589c5b605272690c155c0637dcb ] + +EIC controller have unfixed numbers of banks on different Spreadtrum SoCs, +and each bank has its own base address, the loop of getting there base +address in driver should break if the resource gotten via +platform_get_resource() is NULL already. The later ones would be all NULL +even if the loop continues. + +Fixes: 25518e024e3a ("gpio: Add Spreadtrum EIC driver support") +Signed-off-by: Chunyan Zhang +Link: https://lore.kernel.org/r/20201209055106.840100-1-zhang.lyra@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-eic-sprd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c +index 8c97577740100..a69b3faf51ef0 100644 +--- a/drivers/gpio/gpio-eic-sprd.c ++++ b/drivers/gpio/gpio-eic-sprd.c +@@ -598,7 +598,7 @@ static int sprd_eic_probe(struct platform_device *pdev) + */ + res = platform_get_resource(pdev, IORESOURCE_MEM, i); + if (!res) +- continue; ++ break; + + sprd_eic->base[i] = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(sprd_eic->base[i])) +-- +2.27.0 + diff --git a/queue-5.4/gpio-mvebu-fix-potential-user-after-free-on-probe.patch b/queue-5.4/gpio-mvebu-fix-potential-user-after-free-on-probe.patch new file mode 100644 index 00000000000..94510fa50c7 --- /dev/null +++ b/queue-5.4/gpio-mvebu-fix-potential-user-after-free-on-probe.patch @@ -0,0 +1,69 @@ +From fa0327e328f3ca0a5a23e7f9acc8855f3263844d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 09:15:32 +0200 +Subject: gpio: mvebu: fix potential user-after-free on probe + +From: Baruch Siach + +[ Upstream commit 7ee1a01e47403f72b9f38839a737692f6991263e ] + +When mvebu_pwm_probe() fails IRQ domain is not released. Move pwm probe +before IRQ domain allocation. Add pwm cleanup code to the failure path. + +Fixes: 757642f9a584 ("gpio: mvebu: Add limited PWM support") +Reported-by: Andrew Lunn +Signed-off-by: Baruch Siach +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-mvebu.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c +index 6c06876943412..3985d6e1c17dc 100644 +--- a/drivers/gpio/gpio-mvebu.c ++++ b/drivers/gpio/gpio-mvebu.c +@@ -1196,6 +1196,13 @@ static int mvebu_gpio_probe(struct platform_device *pdev) + + devm_gpiochip_add_data(&pdev->dev, &mvchip->chip, mvchip); + ++ /* Some MVEBU SoCs have simple PWM support for GPIO lines */ ++ if (IS_ENABLED(CONFIG_PWM)) { ++ err = mvebu_pwm_probe(pdev, mvchip, id); ++ if (err) ++ return err; ++ } ++ + /* Some gpio controllers do not provide irq support */ + if (!have_irqs) + return 0; +@@ -1205,7 +1212,8 @@ static int mvebu_gpio_probe(struct platform_device *pdev) + if (!mvchip->domain) { + dev_err(&pdev->dev, "couldn't allocate irq domain %s (DT).\n", + mvchip->chip.label); +- return -ENODEV; ++ err = -ENODEV; ++ goto err_pwm; + } + + err = irq_alloc_domain_generic_chips( +@@ -1253,14 +1261,12 @@ static int mvebu_gpio_probe(struct platform_device *pdev) + mvchip); + } + +- /* Some MVEBU SoCs have simple PWM support for GPIO lines */ +- if (IS_ENABLED(CONFIG_PWM)) +- return mvebu_pwm_probe(pdev, mvchip, id); +- + return 0; + + err_domain: + irq_domain_remove(mvchip->domain); ++err_pwm: ++ pwmchip_remove(&mvchip->mvpwm->chip); + + return err; + } +-- +2.27.0 + diff --git a/queue-5.4/gpio-zynq-fix-reference-leak-in-zynq_gpio-functions.patch b/queue-5.4/gpio-zynq-fix-reference-leak-in-zynq_gpio-functions.patch new file mode 100644 index 00000000000..40e776fb97e --- /dev/null +++ b/queue-5.4/gpio-zynq-fix-reference-leak-in-zynq_gpio-functions.patch @@ -0,0 +1,53 @@ +From 504d08b8e6fe32f6f7d8e9d2261105803f4baa58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 17:44:45 +0800 +Subject: gpio: zynq: fix reference leak in zynq_gpio functions + +From: Qinglang Miao + +[ Upstream commit 7f57b295f990c0fa07f96d51ca1c82c52dbf79cc ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to putting operation will result in a +reference leak here. + +A new function pm_runtime_resume_and_get is introduced in +[0] to keep usage counter balanced. So We fix the reference +leak by replacing it with new funtion. + +[0] dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") + +Fixes: c2df3de0d07e ("gpio: zynq: properly support runtime PM for GPIO used as interrupts") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-zynq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c +index 7835aad6d1628..88b04d8a7fa7d 100644 +--- a/drivers/gpio/gpio-zynq.c ++++ b/drivers/gpio/gpio-zynq.c +@@ -556,7 +556,7 @@ static int zynq_gpio_irq_reqres(struct irq_data *d) + struct gpio_chip *chip = irq_data_get_irq_chip_data(d); + int ret; + +- ret = pm_runtime_get_sync(chip->parent); ++ ret = pm_runtime_resume_and_get(chip->parent); + if (ret < 0) + return ret; + +@@ -884,7 +884,7 @@ static int zynq_gpio_probe(struct platform_device *pdev) + + pm_runtime_set_active(&pdev->dev); + pm_runtime_enable(&pdev->dev); +- ret = pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) + goto err_pm_dis; + +-- +2.27.0 + diff --git a/queue-5.4/habanalabs-put-devices-before-driver-removal.patch b/queue-5.4/habanalabs-put-devices-before-driver-removal.patch new file mode 100644 index 00000000000..f6445918b7c --- /dev/null +++ b/queue-5.4/habanalabs-put-devices-before-driver-removal.patch @@ -0,0 +1,62 @@ +From 82af2b66d1622c3c9b46ad47d01945c3512051dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Nov 2020 09:34:12 +0200 +Subject: habanalabs: put devices before driver removal + +From: Ofir Bitton + +[ Upstream commit 5555b7c56bdec7a29c789fec27f84d40f52fbdfa ] + +Driver never puts its device and control_device objects, hence +a memory leak is introduced every driver removal. + +Signed-off-by: Ofir Bitton +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/device.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/misc/habanalabs/device.c b/drivers/misc/habanalabs/device.c +index a7a4fed4d8995..3eeb1920ddb43 100644 +--- a/drivers/misc/habanalabs/device.c ++++ b/drivers/misc/habanalabs/device.c +@@ -229,16 +229,16 @@ static int device_cdev_sysfs_add(struct hl_device *hdev) + + static void device_cdev_sysfs_del(struct hl_device *hdev) + { +- /* device_release() won't be called so must free devices explicitly */ +- if (!hdev->cdev_sysfs_created) { +- kfree(hdev->dev_ctrl); +- kfree(hdev->dev); +- return; +- } ++ if (!hdev->cdev_sysfs_created) ++ goto put_devices; + + hl_sysfs_fini(hdev); + cdev_device_del(&hdev->cdev_ctrl, hdev->dev_ctrl); + cdev_device_del(&hdev->cdev, hdev->dev); ++ ++put_devices: ++ put_device(hdev->dev); ++ put_device(hdev->dev_ctrl); + } + + /* +@@ -1285,9 +1285,9 @@ int hl_device_init(struct hl_device *hdev, struct class *hclass) + early_fini: + device_early_fini(hdev); + free_dev_ctrl: +- kfree(hdev->dev_ctrl); ++ put_device(hdev->dev_ctrl); + free_dev: +- kfree(hdev->dev); ++ put_device(hdev->dev); + out_disabled: + hdev->disabled = true; + if (add_cdev_sysfs_on_err) +-- +2.27.0 + diff --git a/queue-5.4/i40e-avoid-premature-rx-buffer-reuse.patch b/queue-5.4/i40e-avoid-premature-rx-buffer-reuse.patch new file mode 100644 index 00000000000..c7db1a52949 --- /dev/null +++ b/queue-5.4/i40e-avoid-premature-rx-buffer-reuse.patch @@ -0,0 +1,187 @@ +From f33f0607fe948a2ba47633119b6a89785b5663f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 19:27:34 +0200 +Subject: i40e: avoid premature Rx buffer reuse +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit 75aab4e10ae6a4593a60f66d13de755d4e91f400 ] + +The page recycle code, incorrectly, relied on that a page fragment +could not be freed inside xdp_do_redirect(). This assumption leads to +that page fragments that are used by the stack/XDP redirect can be +reused and overwritten. + +To avoid this, store the page count prior invoking xdp_do_redirect(). + +Longer explanation: + +Intel NICs have a recycle mechanism. The main idea is that a page is +split into two parts. One part is owned by the driver, one part might +be owned by someone else, such as the stack. + +t0: Page is allocated, and put on the Rx ring + +--------------- +used by NIC ->| upper buffer +(rx_buffer) +--------------- + | lower buffer + +--------------- + page count == USHRT_MAX + rx_buffer->pagecnt_bias == USHRT_MAX + +t1: Buffer is received, and passed to the stack (e.g.) + +--------------- + | upper buff (skb) + +--------------- +used by NIC ->| lower buffer +(rx_buffer) +--------------- + page count == USHRT_MAX + rx_buffer->pagecnt_bias == USHRT_MAX - 1 + +t2: Buffer is received, and redirected + +--------------- + | upper buff (skb) + +--------------- +used by NIC ->| lower buffer +(rx_buffer) +--------------- + +Now, prior calling xdp_do_redirect(): + page count == USHRT_MAX + rx_buffer->pagecnt_bias == USHRT_MAX - 2 + +This means that buffer *cannot* be flipped/reused, because the skb is +still using it. + +The problem arises when xdp_do_redirect() actually frees the +segment. Then we get: + page count == USHRT_MAX - 1 + rx_buffer->pagecnt_bias == USHRT_MAX - 2 + +From a recycle perspective, the buffer can be flipped and reused, +which means that the skb data area is passed to the Rx HW ring! + +To work around this, the page count is stored prior calling +xdp_do_redirect(). + +Note that this is not optimal, since the NIC could actually reuse the +"lower buffer" again. However, then we need to track whether +XDP_REDIRECT consumed the buffer or not. + +Fixes: d9314c474d4f ("i40e: add support for XDP_REDIRECT") +Reported-and-analyzed-by: Li RongQing +Signed-off-by: Björn Töpel +Tested-by: George Kuruvinakunnel +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 27 +++++++++++++++------ + 1 file changed, 20 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 89a3be41d6d83..f47841f3a69d5 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -1869,6 +1869,7 @@ static inline bool i40e_page_is_reusable(struct page *page) + * the adapter for another receive + * + * @rx_buffer: buffer containing the page ++ * @rx_buffer_pgcnt: buffer page refcount pre xdp_do_redirect() call + * + * If page is reusable, rx_buffer->page_offset is adjusted to point to + * an unused region in the page. +@@ -1891,7 +1892,8 @@ static inline bool i40e_page_is_reusable(struct page *page) + * + * In either case, if the page is reusable its refcount is increased. + **/ +-static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer) ++static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer, ++ int rx_buffer_pgcnt) + { + unsigned int pagecnt_bias = rx_buffer->pagecnt_bias; + struct page *page = rx_buffer->page; +@@ -1902,7 +1904,7 @@ static bool i40e_can_reuse_rx_page(struct i40e_rx_buffer *rx_buffer) + + #if (PAGE_SIZE < 8192) + /* if we are only owner of page we can reuse it */ +- if (unlikely((page_count(page) - pagecnt_bias) > 1)) ++ if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1)) + return false; + #else + #define I40E_LAST_OFFSET \ +@@ -1961,16 +1963,24 @@ static void i40e_add_rx_frag(struct i40e_ring *rx_ring, + * i40e_get_rx_buffer - Fetch Rx buffer and synchronize data for use + * @rx_ring: rx descriptor ring to transact packets on + * @size: size of buffer to add to skb ++ * @rx_buffer_pgcnt: buffer page refcount + * + * This function will pull an Rx buffer from the ring and synchronize it + * for use by the CPU. + */ + static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring, +- const unsigned int size) ++ const unsigned int size, ++ int *rx_buffer_pgcnt) + { + struct i40e_rx_buffer *rx_buffer; + + rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean); ++ *rx_buffer_pgcnt = ++#if (PAGE_SIZE < 8192) ++ page_count(rx_buffer->page); ++#else ++ 0; ++#endif + prefetch_page_address(rx_buffer->page); + + /* we are reusing so sync this buffer for CPU use */ +@@ -2125,14 +2135,16 @@ static struct sk_buff *i40e_build_skb(struct i40e_ring *rx_ring, + * i40e_put_rx_buffer - Clean up used buffer and either recycle or free + * @rx_ring: rx descriptor ring to transact packets on + * @rx_buffer: rx buffer to pull data from ++ * @rx_buffer_pgcnt: rx buffer page refcount pre xdp_do_redirect() call + * + * This function will clean up the contents of the rx_buffer. It will + * either recycle the buffer or unmap it and free the associated resources. + */ + static void i40e_put_rx_buffer(struct i40e_ring *rx_ring, +- struct i40e_rx_buffer *rx_buffer) ++ struct i40e_rx_buffer *rx_buffer, ++ int rx_buffer_pgcnt) + { +- if (i40e_can_reuse_rx_page(rx_buffer)) { ++ if (i40e_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) { + /* hand second half of page back to the ring */ + i40e_reuse_rx_page(rx_ring, rx_buffer); + } else { +@@ -2345,6 +2357,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget) + while (likely(total_rx_packets < (unsigned int)budget)) { + struct i40e_rx_buffer *rx_buffer; + union i40e_rx_desc *rx_desc; ++ int rx_buffer_pgcnt; + unsigned int size; + u64 qword; + +@@ -2384,7 +2397,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget) + break; + + i40e_trace(clean_rx_irq, rx_ring, rx_desc, skb); +- rx_buffer = i40e_get_rx_buffer(rx_ring, size); ++ rx_buffer = i40e_get_rx_buffer(rx_ring, size, &rx_buffer_pgcnt); + + /* retrieve a buffer from the ring */ + if (!skb) { +@@ -2424,7 +2437,7 @@ static int i40e_clean_rx_irq(struct i40e_ring *rx_ring, int budget) + break; + } + +- i40e_put_rx_buffer(rx_ring, rx_buffer); ++ i40e_put_rx_buffer(rx_ring, rx_buffer, rx_buffer_pgcnt); + cleaned_count++; + + if (i40e_is_non_eop(rx_ring, rx_desc, skb)) +-- +2.27.0 + diff --git a/queue-5.4/i40e-optimise-prefetch-page-refcount.patch b/queue-5.4/i40e-optimise-prefetch-page-refcount.patch new file mode 100644 index 00000000000..ecbf6c51210 --- /dev/null +++ b/queue-5.4/i40e-optimise-prefetch-page-refcount.patch @@ -0,0 +1,72 @@ +From 18dc097224f3129d6498c16cfa8c8a5e82940c62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 15:07:57 +0800 +Subject: i40e: optimise prefetch page refcount + +From: Li RongQing + +[ Upstream commit 1fa5cef283420b3dad93cd6ab04d7125bc1562de ] + +refcount of rx_buffer page will be added here originally, so prefetchw +is needed, but after commit 1793668c3b8c ("i40e/i40evf: Update code to +better handle incrementing page count"), and refcount is not added +every time, so change prefetchw as prefetch. + +Now it mainly services page_address(), but which accesses struct page +only when WANT_PAGE_VIRTUAL or HASHED_PAGE_VIRTUAL is defined otherwise +it returns address based on offset, so we prefetch it conditionally. + +Jakub suggested to define prefetch_page_address in a common header. + +Reported-by: kernel test robot +Suggested-by: Jakub Kicinski +Signed-off-by: Li RongQing +Reviewed-by: Jesse Brandeburg +Tested-by: Aaron Brown +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +- + include/linux/prefetch.h | 8 ++++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 7f7f02bc2b794..89a3be41d6d83 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -1971,7 +1971,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring, + struct i40e_rx_buffer *rx_buffer; + + rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean); +- prefetchw(rx_buffer->page); ++ prefetch_page_address(rx_buffer->page); + + /* we are reusing so sync this buffer for CPU use */ + dma_sync_single_range_for_cpu(rx_ring->dev, +diff --git a/include/linux/prefetch.h b/include/linux/prefetch.h +index 13eafebf3549a..b83a3f944f287 100644 +--- a/include/linux/prefetch.h ++++ b/include/linux/prefetch.h +@@ -15,6 +15,7 @@ + #include + #include + ++struct page; + /* + prefetch(x) attempts to pre-emptively get the memory pointed to + by address "x" into the CPU L1 cache. +@@ -62,4 +63,11 @@ static inline void prefetch_range(void *addr, size_t len) + #endif + } + ++static inline void prefetch_page_address(struct page *page) ++{ ++#if defined(WANT_PAGE_VIRTUAL) || defined(HASHED_PAGE_VIRTUAL) ++ prefetch(page); ++#endif ++} ++ + #endif +-- +2.27.0 + diff --git a/queue-5.4/i40e-refactor-rx_bi-accesses.patch b/queue-5.4/i40e-refactor-rx_bi-accesses.patch new file mode 100644 index 00000000000..bf5fae39cd1 --- /dev/null +++ b/queue-5.4/i40e-refactor-rx_bi-accesses.patch @@ -0,0 +1,170 @@ +From 3f26aa271907b88ed2656ec294be2711e6bcd753 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 May 2020 21:20:54 +0200 +Subject: i40e: Refactor rx_bi accesses +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit e1675f97367bed74d4dcfe08de9ce9b5d6b288c1 ] + +As a first step to migrate i40e to the new MEM_TYPE_XSK_BUFF_POOL +APIs, code that accesses the rx_bi (SW/shadow ring) is refactored to +use an accessor function. + +Signed-off-by: Björn Töpel +Signed-off-by: Alexei Starovoitov +Cc: intel-wired-lan@lists.osuosl.org +Link: https://lore.kernel.org/bpf/20200520192103.355233-7-bjorn.topel@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 17 +++++++++++------ + drivers/net/ethernet/intel/i40e/i40e_xsk.c | 18 ++++++++++++------ + 2 files changed, 23 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index e3f29dc8b290a..7f7f02bc2b794 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -1195,6 +1195,11 @@ static void i40e_update_itr(struct i40e_q_vector *q_vector, + rc->total_packets = 0; + } + ++static struct i40e_rx_buffer *i40e_rx_bi(struct i40e_ring *rx_ring, u32 idx) ++{ ++ return &rx_ring->rx_bi[idx]; ++} ++ + /** + * i40e_reuse_rx_page - page flip buffer and store it back on the ring + * @rx_ring: rx descriptor ring to store buffers on +@@ -1208,7 +1213,7 @@ static void i40e_reuse_rx_page(struct i40e_ring *rx_ring, + struct i40e_rx_buffer *new_buff; + u16 nta = rx_ring->next_to_alloc; + +- new_buff = &rx_ring->rx_bi[nta]; ++ new_buff = i40e_rx_bi(rx_ring, nta); + + /* update, and store next to alloc */ + nta++; +@@ -1272,7 +1277,7 @@ struct i40e_rx_buffer *i40e_clean_programming_status( + ntc = rx_ring->next_to_clean; + + /* fetch, update, and store next to clean */ +- rx_buffer = &rx_ring->rx_bi[ntc++]; ++ rx_buffer = i40e_rx_bi(rx_ring, ntc++); + ntc = (ntc < rx_ring->count) ? ntc : 0; + rx_ring->next_to_clean = ntc; + +@@ -1361,7 +1366,7 @@ void i40e_clean_rx_ring(struct i40e_ring *rx_ring) + + /* Free all the Rx ring sk_buffs */ + for (i = 0; i < rx_ring->count; i++) { +- struct i40e_rx_buffer *rx_bi = &rx_ring->rx_bi[i]; ++ struct i40e_rx_buffer *rx_bi = i40e_rx_bi(rx_ring, i); + + if (!rx_bi->page) + continue; +@@ -1576,7 +1581,7 @@ bool i40e_alloc_rx_buffers(struct i40e_ring *rx_ring, u16 cleaned_count) + return false; + + rx_desc = I40E_RX_DESC(rx_ring, ntu); +- bi = &rx_ring->rx_bi[ntu]; ++ bi = i40e_rx_bi(rx_ring, ntu); + + do { + if (!i40e_alloc_mapped_page(rx_ring, bi)) +@@ -1598,7 +1603,7 @@ bool i40e_alloc_rx_buffers(struct i40e_ring *rx_ring, u16 cleaned_count) + ntu++; + if (unlikely(ntu == rx_ring->count)) { + rx_desc = I40E_RX_DESC(rx_ring, 0); +- bi = rx_ring->rx_bi; ++ bi = i40e_rx_bi(rx_ring, 0); + ntu = 0; + } + +@@ -1965,7 +1970,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer(struct i40e_ring *rx_ring, + { + struct i40e_rx_buffer *rx_buffer; + +- rx_buffer = &rx_ring->rx_bi[rx_ring->next_to_clean]; ++ rx_buffer = i40e_rx_bi(rx_ring, rx_ring->next_to_clean); + prefetchw(rx_buffer->page); + + /* we are reusing so sync this buffer for CPU use */ +diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +index 3156de786d955..c9d4534fbdf02 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +@@ -9,6 +9,11 @@ + #include "i40e_txrx_common.h" + #include "i40e_xsk.h" + ++static struct i40e_rx_buffer *i40e_rx_bi(struct i40e_ring *rx_ring, u32 idx) ++{ ++ return &rx_ring->rx_bi[idx]; ++} ++ + /** + * i40e_xsk_umem_dma_map - DMA maps all UMEM memory for the netdev + * @vsi: Current VSI +@@ -321,7 +326,7 @@ __i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count, + bool ok = true; + + rx_desc = I40E_RX_DESC(rx_ring, ntu); +- bi = &rx_ring->rx_bi[ntu]; ++ bi = i40e_rx_bi(rx_ring, ntu); + do { + if (!alloc(rx_ring, bi)) { + ok = false; +@@ -340,7 +345,7 @@ __i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count, + + if (unlikely(ntu == rx_ring->count)) { + rx_desc = I40E_RX_DESC(rx_ring, 0); +- bi = rx_ring->rx_bi; ++ bi = i40e_rx_bi(rx_ring, 0); + ntu = 0; + } + +@@ -402,7 +407,7 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer_zc(struct i40e_ring *rx_ring, + { + struct i40e_rx_buffer *bi; + +- bi = &rx_ring->rx_bi[rx_ring->next_to_clean]; ++ bi = i40e_rx_bi(rx_ring, rx_ring->next_to_clean); + + /* we are reusing so sync this buffer for CPU use */ + dma_sync_single_range_for_cpu(rx_ring->dev, +@@ -424,7 +429,8 @@ static struct i40e_rx_buffer *i40e_get_rx_buffer_zc(struct i40e_ring *rx_ring, + static void i40e_reuse_rx_buffer_zc(struct i40e_ring *rx_ring, + struct i40e_rx_buffer *old_bi) + { +- struct i40e_rx_buffer *new_bi = &rx_ring->rx_bi[rx_ring->next_to_alloc]; ++ struct i40e_rx_buffer *new_bi = i40e_rx_bi(rx_ring, ++ rx_ring->next_to_alloc); + u16 nta = rx_ring->next_to_alloc; + + /* update, and store next to alloc */ +@@ -456,7 +462,7 @@ void i40e_zca_free(struct zero_copy_allocator *alloc, unsigned long handle) + mask = rx_ring->xsk_umem->chunk_mask; + + nta = rx_ring->next_to_alloc; +- bi = &rx_ring->rx_bi[nta]; ++ bi = i40e_rx_bi(rx_ring, nta); + + nta++; + rx_ring->next_to_alloc = (nta < rx_ring->count) ? nta : 0; +@@ -824,7 +830,7 @@ void i40e_xsk_clean_rx_ring(struct i40e_ring *rx_ring) + u16 i; + + for (i = 0; i < rx_ring->count; i++) { +- struct i40e_rx_buffer *rx_bi = &rx_ring->rx_bi[i]; ++ struct i40e_rx_buffer *rx_bi = i40e_rx_bi(rx_ring, i); + + if (!rx_bi->addr) + continue; +-- +2.27.0 + diff --git a/queue-5.4/iwlwifi-pcie-add-one-missing-entry-for-ax210.patch b/queue-5.4/iwlwifi-pcie-add-one-missing-entry-for-ax210.patch new file mode 100644 index 00000000000..a03fa04f673 --- /dev/null +++ b/queue-5.4/iwlwifi-pcie-add-one-missing-entry-for-ax210.patch @@ -0,0 +1,35 @@ +From 37c39be49d908edf9305953a35b5860e0914d758 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 14:41:49 +0200 +Subject: iwlwifi: pcie: add one missing entry for AX210 + +From: Luca Coelho + +[ Upstream commit 5febcdef30902fa870128b9789b873199f13aff1 ] + +The 0x0024 subsytem device ID was missing from the list, so some AX210 +devices were not recognized. Add it. + +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20201202143859.308eab4db42c.I3763196cd3f7bb36f3dcabf02ec4e7c4fe859c0f@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/pcie/drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index b0b7eca1754ed..f34297fd453c0 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -968,6 +968,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + + {IWL_PCI_DEVICE(0x2725, 0x0090, iwlax211_2ax_cfg_so_gf_a0)}, + {IWL_PCI_DEVICE(0x2725, 0x0020, iwlax210_2ax_cfg_ty_gf_a0)}, ++ {IWL_PCI_DEVICE(0x2725, 0x0024, iwlax210_2ax_cfg_ty_gf_a0)}, + {IWL_PCI_DEVICE(0x2725, 0x0310, iwlax210_2ax_cfg_ty_gf_a0)}, + {IWL_PCI_DEVICE(0x2725, 0x0510, iwlax210_2ax_cfg_ty_gf_a0)}, + {IWL_PCI_DEVICE(0x2725, 0x0A10, iwlax210_2ax_cfg_ty_gf_a0)}, +-- +2.27.0 + diff --git a/queue-5.4/ixgbe-avoid-premature-rx-buffer-reuse.patch b/queue-5.4/ixgbe-avoid-premature-rx-buffer-reuse.patch new file mode 100644 index 00000000000..f86cb5611e3 --- /dev/null +++ b/queue-5.4/ixgbe-avoid-premature-rx-buffer-reuse.patch @@ -0,0 +1,114 @@ +From 4c5acbb2547058f0d1074094e498c7e49b790c2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 19:27:35 +0200 +Subject: ixgbe: avoid premature Rx buffer reuse +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit a06316dc87bdc000f7f39a315476957af2ba0f05 ] + +The page recycle code, incorrectly, relied on that a page fragment +could not be freed inside xdp_do_redirect(). This assumption leads to +that page fragments that are used by the stack/XDP redirect can be +reused and overwritten. + +To avoid this, store the page count prior invoking xdp_do_redirect(). + +Fixes: 6453073987ba ("ixgbe: add initial support for xdp redirect") +Reported-and-analyzed-by: Li RongQing +Signed-off-by: Björn Töpel +Tested-by: Sandeep Penigalapati +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 24 +++++++++++++------ + 1 file changed, 17 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 5336bfcd2d701..f605540644035 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -1947,7 +1947,8 @@ static inline bool ixgbe_page_is_reserved(struct page *page) + return (page_to_nid(page) != numa_mem_id()) || page_is_pfmemalloc(page); + } + +-static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer) ++static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer, ++ int rx_buffer_pgcnt) + { + unsigned int pagecnt_bias = rx_buffer->pagecnt_bias; + struct page *page = rx_buffer->page; +@@ -1958,7 +1959,7 @@ static bool ixgbe_can_reuse_rx_page(struct ixgbe_rx_buffer *rx_buffer) + + #if (PAGE_SIZE < 8192) + /* if we are only owner of page we can reuse it */ +- if (unlikely((page_ref_count(page) - pagecnt_bias) > 1)) ++ if (unlikely((rx_buffer_pgcnt - pagecnt_bias) > 1)) + return false; + #else + /* The last offset is a bit aggressive in that we assume the +@@ -2023,11 +2024,18 @@ static void ixgbe_add_rx_frag(struct ixgbe_ring *rx_ring, + static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring, + union ixgbe_adv_rx_desc *rx_desc, + struct sk_buff **skb, +- const unsigned int size) ++ const unsigned int size, ++ int *rx_buffer_pgcnt) + { + struct ixgbe_rx_buffer *rx_buffer; + + rx_buffer = &rx_ring->rx_buffer_info[rx_ring->next_to_clean]; ++ *rx_buffer_pgcnt = ++#if (PAGE_SIZE < 8192) ++ page_count(rx_buffer->page); ++#else ++ 0; ++#endif + prefetchw(rx_buffer->page); + *skb = rx_buffer->skb; + +@@ -2057,9 +2065,10 @@ static struct ixgbe_rx_buffer *ixgbe_get_rx_buffer(struct ixgbe_ring *rx_ring, + + static void ixgbe_put_rx_buffer(struct ixgbe_ring *rx_ring, + struct ixgbe_rx_buffer *rx_buffer, +- struct sk_buff *skb) ++ struct sk_buff *skb, ++ int rx_buffer_pgcnt) + { +- if (ixgbe_can_reuse_rx_page(rx_buffer)) { ++ if (ixgbe_can_reuse_rx_page(rx_buffer, rx_buffer_pgcnt)) { + /* hand second half of page back to the ring */ + ixgbe_reuse_rx_page(rx_ring, rx_buffer); + } else { +@@ -2295,6 +2304,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, + union ixgbe_adv_rx_desc *rx_desc; + struct ixgbe_rx_buffer *rx_buffer; + struct sk_buff *skb; ++ int rx_buffer_pgcnt; + unsigned int size; + + /* return some buffers to hardware, one at a time is too slow */ +@@ -2314,7 +2324,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, + */ + dma_rmb(); + +- rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size); ++ rx_buffer = ixgbe_get_rx_buffer(rx_ring, rx_desc, &skb, size, &rx_buffer_pgcnt); + + /* retrieve a buffer from the ring */ + if (!skb) { +@@ -2356,7 +2366,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, + break; + } + +- ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb); ++ ixgbe_put_rx_buffer(rx_ring, rx_buffer, skb, rx_buffer_pgcnt); + cleaned_count++; + + /* place incomplete frames back on ring for completion */ +-- +2.27.0 + diff --git a/queue-5.4/kbuild-avoid-split-lines-in-.mod-files.patch b/queue-5.4/kbuild-avoid-split-lines-in-.mod-files.patch new file mode 100644 index 00000000000..1e1f6dacc09 --- /dev/null +++ b/queue-5.4/kbuild-avoid-split-lines-in-.mod-files.patch @@ -0,0 +1,77 @@ +From c1633e35fd563809fe1534cc24e35015708b28ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 02:55:51 +0900 +Subject: kbuild: avoid split lines in .mod files + +From: Masahiro Yamada + +[ Upstream commit 7d32358be8acb119dcfe39b6cf67ec6d94bf1fe7 ] + +"xargs echo" is not a safe way to remove line breaks because the input +may exceed the command line limit and xargs may break it up into +multiple invocations of echo. This should never happen because +scripts/gen_autoksyms.sh expects all undefined symbols are placed in +the second line of .mod files. + +One possible way is to replace "xargs echo" with +"sed ':x;N;$!bx;s/\n/ /g'" or something, but I rewrote the code by +using awk because it is more readable. + +This issue was reported by Sami Tolvanen; in his Clang LTO patch set, +$(multi-used-m) is no longer an ELF object, but a thin archive that +contains LLVM bitcode files. llvm-nm prints out symbols for each +archive member separately, which results a lot of dupications, in some +places, beyond the system-defined limit. + +This problem must be fixed irrespective of LTO, and we must ensure +zero possibility of having this issue. + +Link: https://lkml.org/lkml/2020/12/1/1658 +Reported-by: Sami Tolvanen +Signed-off-by: Masahiro Yamada +Reviewed-by: Sami Tolvanen +Signed-off-by: Sasha Levin +--- + scripts/Makefile.build | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/scripts/Makefile.build b/scripts/Makefile.build +index 24a33c01bbf7c..9c689d011bced 100644 +--- a/scripts/Makefile.build ++++ b/scripts/Makefile.build +@@ -234,6 +234,9 @@ objtool_dep = $(objtool_obj) \ + ifdef CONFIG_TRIM_UNUSED_KSYMS + cmd_gen_ksymdeps = \ + $(CONFIG_SHELL) $(srctree)/scripts/gen_ksymdeps.sh $@ >> $(dot-target).cmd ++ ++# List module undefined symbols ++undefined_syms = $(NM) $< | $(AWK) '$$1 == "U" { printf("%s%s", x++ ? " " : "", $$2) }'; + endif + + define rule_cc_o_c +@@ -253,13 +256,6 @@ define rule_as_o_S + $(call cmd,modversions_S) + endef + +-# List module undefined symbols (or empty line if not enabled) +-ifdef CONFIG_TRIM_UNUSED_KSYMS +-cmd_undef_syms = $(NM) $< | sed -n 's/^ *U //p' | xargs echo +-else +-cmd_undef_syms = echo +-endif +- + # Built-in and composite module parts + $(obj)/%.o: $(src)/%.c $(recordmcount_source) $(objtool_dep) FORCE + $(call cmd,force_checksrc) +@@ -267,7 +263,7 @@ $(obj)/%.o: $(src)/%.c $(recordmcount_source) $(objtool_dep) FORCE + + cmd_mod = { \ + echo $(if $($*-objs)$($*-y)$($*-m), $(addprefix $(obj)/, $($*-objs) $($*-y) $($*-m)), $(@:.mod=.o)); \ +- $(cmd_undef_syms); \ ++ $(undefined_syms) echo; \ + } > $@ + + $(obj)/%.mod: $(obj)/%.o FORCE +-- +2.27.0 + diff --git a/queue-5.4/kernel-cpu-add-arch-override-for-clear_tasks_mm_cpum.patch b/queue-5.4/kernel-cpu-add-arch-override-for-clear_tasks_mm_cpum.patch new file mode 100644 index 00000000000..2cf2516ec97 --- /dev/null +++ b/queue-5.4/kernel-cpu-add-arch-override-for-clear_tasks_mm_cpum.patch @@ -0,0 +1,55 @@ +From 8e174684a300bcae21bc0c50775d7b2ff5c38096 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 20:25:29 +1000 +Subject: kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm + handling + +From: Nicholas Piggin + +[ Upstream commit 8ff00399b153440c1c83e20c43020385b416415b ] + +powerpc/64s keeps a counter in the mm which counts bits set in +mm_cpumask as well as other things. This means it can't use generic code +to clear bits out of the mask and doesn't adjust the arch specific +counter. + +Add an arch override that allows powerpc/64s to use +clear_tasks_mm_cpumask(). + +Signed-off-by: Nicholas Piggin +Reviewed-by: Aneesh Kumar K.V +Acked-by: Peter Zijlstra (Intel) +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201126102530.691335-4-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/cpu.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/kernel/cpu.c b/kernel/cpu.c +index 7527825ac7daa..fa0e5727b4d9c 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -815,6 +815,10 @@ void __init cpuhp_threads_init(void) + } + + #ifdef CONFIG_HOTPLUG_CPU ++#ifndef arch_clear_mm_cpumask_cpu ++#define arch_clear_mm_cpumask_cpu(cpu, mm) cpumask_clear_cpu(cpu, mm_cpumask(mm)) ++#endif ++ + /** + * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU + * @cpu: a CPU id +@@ -850,7 +854,7 @@ void clear_tasks_mm_cpumask(int cpu) + t = find_lock_task_mm(p); + if (!t) + continue; +- cpumask_clear_cpu(cpu, mm_cpumask(t->mm)); ++ arch_clear_mm_cpumask_cpu(cpu, t->mm); + task_unlock(t); + } + rcu_read_unlock(); +-- +2.27.0 + diff --git a/queue-5.4/net-mvpp2-add-mvpp2_phylink_to_port-helper.patch b/queue-5.4/net-mvpp2-add-mvpp2_phylink_to_port-helper.patch new file mode 100644 index 00000000000..5b34a1c773e --- /dev/null +++ b/queue-5.4/net-mvpp2-add-mvpp2_phylink_to_port-helper.patch @@ -0,0 +1,117 @@ +From 520dc7f501956b55d60f9353ac4acc57bee85906 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jun 2020 10:21:32 +0100 +Subject: net: mvpp2: add mvpp2_phylink_to_port() helper + +From: Russell King + +[ Upstream commit 6c2b49eb96716e91f202756bfbd3f5fea3b2b172 ] + +Add a helper to convert the struct phylink_config pointer passed in +from phylink to the drivers internal struct mvpp2_port. + +Signed-off-by: Russell King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/marvell/mvpp2/mvpp2_main.c | 29 +++++++++---------- + 1 file changed, 14 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 63c0334430134..931d1a56b79ca 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -4745,12 +4745,16 @@ static void mvpp2_port_copy_mac_addr(struct net_device *dev, struct mvpp2 *priv, + eth_hw_addr_random(dev); + } + ++static struct mvpp2_port *mvpp2_phylink_to_port(struct phylink_config *config) ++{ ++ return container_of(config, struct mvpp2_port, phylink_config); ++} ++ + static void mvpp2_phylink_validate(struct phylink_config *config, + unsigned long *supported, + struct phylink_link_state *state) + { +- struct mvpp2_port *port = container_of(config, struct mvpp2_port, +- phylink_config); ++ struct mvpp2_port *port = mvpp2_phylink_to_port(config); + __ETHTOOL_DECLARE_LINK_MODE_MASK(mask) = { 0, }; + + /* Invalid combinations */ +@@ -4877,8 +4881,7 @@ static void mvpp2_gmac_link_state(struct mvpp2_port *port, + static int mvpp2_phylink_mac_link_state(struct phylink_config *config, + struct phylink_link_state *state) + { +- struct mvpp2_port *port = container_of(config, struct mvpp2_port, +- phylink_config); ++ struct mvpp2_port *port = mvpp2_phylink_to_port(config); + + if (port->priv->hw_version == MVPP22 && port->gop_id == 0) { + u32 mode = readl(port->base + MVPP22_XLG_CTRL3_REG); +@@ -4896,8 +4899,7 @@ static int mvpp2_phylink_mac_link_state(struct phylink_config *config, + + static void mvpp2_mac_an_restart(struct phylink_config *config) + { +- struct mvpp2_port *port = container_of(config, struct mvpp2_port, +- phylink_config); ++ struct mvpp2_port *port = mvpp2_phylink_to_port(config); + u32 val = readl(port->base + MVPP2_GMAC_AUTONEG_CONFIG); + + writel(val | MVPP2_GMAC_IN_BAND_RESTART_AN, +@@ -5085,13 +5087,12 @@ static void mvpp2_gmac_config(struct mvpp2_port *port, unsigned int mode, + static void mvpp2_mac_config(struct phylink_config *config, unsigned int mode, + const struct phylink_link_state *state) + { +- struct net_device *dev = to_net_dev(config->dev); +- struct mvpp2_port *port = netdev_priv(dev); ++ struct mvpp2_port *port = mvpp2_phylink_to_port(config); + bool change_interface = port->phy_interface != state->interface; + + /* Check for invalid configuration */ + if (mvpp2_is_xlg(state->interface) && port->gop_id != 0) { +- netdev_err(dev, "Invalid mode on %s\n", dev->name); ++ netdev_err(port->dev, "Invalid mode on %s\n", port->dev->name); + return; + } + +@@ -5128,8 +5129,7 @@ static void mvpp2_mac_config(struct phylink_config *config, unsigned int mode, + static void mvpp2_mac_link_up(struct phylink_config *config, unsigned int mode, + phy_interface_t interface, struct phy_device *phy) + { +- struct net_device *dev = to_net_dev(config->dev); +- struct mvpp2_port *port = netdev_priv(dev); ++ struct mvpp2_port *port = mvpp2_phylink_to_port(config); + u32 val; + + if (!phylink_autoneg_inband(mode)) { +@@ -5150,14 +5150,13 @@ static void mvpp2_mac_link_up(struct phylink_config *config, unsigned int mode, + + mvpp2_egress_enable(port); + mvpp2_ingress_enable(port); +- netif_tx_wake_all_queues(dev); ++ netif_tx_wake_all_queues(port->dev); + } + + static void mvpp2_mac_link_down(struct phylink_config *config, + unsigned int mode, phy_interface_t interface) + { +- struct net_device *dev = to_net_dev(config->dev); +- struct mvpp2_port *port = netdev_priv(dev); ++ struct mvpp2_port *port = mvpp2_phylink_to_port(config); + u32 val; + + if (!phylink_autoneg_inband(mode)) { +@@ -5174,7 +5173,7 @@ static void mvpp2_mac_link_down(struct phylink_config *config, + } + } + +- netif_tx_stop_all_queues(dev); ++ netif_tx_stop_all_queues(port->dev); + mvpp2_egress_disable(port); + mvpp2_ingress_disable(port); + +-- +2.27.0 + diff --git a/queue-5.4/netfilter-nft_compat-make-sure-xtables-destructors-h.patch b/queue-5.4/netfilter-nft_compat-make-sure-xtables-destructors-h.patch new file mode 100644 index 00000000000..9693da796e7 --- /dev/null +++ b/queue-5.4/netfilter-nft_compat-make-sure-xtables-destructors-h.patch @@ -0,0 +1,189 @@ +From cbbef329fb48624186823e410a505fbe0be9d9d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jul 2020 13:34:46 +0200 +Subject: netfilter: nft_compat: make sure xtables destructors have run + +From: Florian Westphal + +[ Upstream commit ffe8923f109b7ea92c0842c89e61300eefa11c94 ] + +Pablo Neira found that after recent update of xt_IDLETIMER the +iptables-nft tests sometimes show an error. + +He tracked this down to the delayed cleanup used by nf_tables core: +del rule (transaction A) +add rule (transaction B) + +Its possible that by time transaction B (both in same netns) runs, +the xt target destructor has not been invoked yet. + +For native nft expressions this is no problem because all expressions +that have such side effects make sure these are handled from the commit +phase, rather than async cleanup. + +For nft_compat however this isn't true. + +Instead of forcing synchronous behaviour for nft_compat, keep track +of the number of outstanding destructor calls. + +When we attempt to create a new expression, flush the cleanup worker +to make sure destructors have completed. + +With lots of help from Pablo Neira. + +Reported-by: Pablo Neira Ayso +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 2 ++ + net/netfilter/nf_tables_api.c | 10 +++++++-- + net/netfilter/nft_compat.c | 36 +++++++++++++++++++++++++++---- + 3 files changed, 42 insertions(+), 6 deletions(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index a576bcbba2fcc..6a6fcd10d3185 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -1462,4 +1462,6 @@ void nft_chain_filter_fini(void); + + void __init nft_chain_route_init(void); + void nft_chain_route_fini(void); ++ ++void nf_tables_trans_destroy_flush_work(void); + #endif /* _NET_NF_TABLES_H */ +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 459b7c0547115..7753d6f1467c9 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -6605,6 +6605,12 @@ static void nf_tables_trans_destroy_work(struct work_struct *w) + } + } + ++void nf_tables_trans_destroy_flush_work(void) ++{ ++ flush_work(&trans_destroy_work); ++} ++EXPORT_SYMBOL_GPL(nf_tables_trans_destroy_flush_work); ++ + static int nf_tables_commit_chain_prepare(struct net *net, struct nft_chain *chain) + { + struct nft_rule *rule; +@@ -6776,9 +6782,9 @@ static void nf_tables_commit_release(struct net *net) + spin_unlock(&nf_tables_destroy_list_lock); + + nf_tables_module_autoload_cleanup(net); +- mutex_unlock(&net->nft.commit_mutex); +- + schedule_work(&trans_destroy_work); ++ ++ mutex_unlock(&net->nft.commit_mutex); + } + + static int nf_tables_commit(struct net *net, struct sk_buff *skb) +diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c +index f9adca62ccb3d..0e3e0ff805812 100644 +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -27,6 +27,8 @@ struct nft_xt_match_priv { + void *info; + }; + ++static refcount_t nft_compat_pending_destroy = REFCOUNT_INIT(1); ++ + static int nft_compat_chain_validate_dependency(const struct nft_ctx *ctx, + const char *tablename) + { +@@ -236,6 +238,15 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + + nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv); + ++ /* xtables matches or targets can have side effects, e.g. ++ * creation/destruction of /proc files. ++ * The xt ->destroy functions are run asynchronously from ++ * work queue. If we have pending invocations we thus ++ * need to wait for those to finish. ++ */ ++ if (refcount_read(&nft_compat_pending_destroy) > 1) ++ nf_tables_trans_destroy_flush_work(); ++ + ret = xt_check_target(&par, size, proto, inv); + if (ret < 0) + return ret; +@@ -247,6 +258,13 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + return 0; + } + ++static void __nft_mt_tg_destroy(struct module *me, const struct nft_expr *expr) ++{ ++ refcount_dec(&nft_compat_pending_destroy); ++ module_put(me); ++ kfree(expr->ops); ++} ++ + static void + nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) + { +@@ -262,8 +280,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) + if (par.target->destroy != NULL) + par.target->destroy(&par); + +- module_put(me); +- kfree(expr->ops); ++ __nft_mt_tg_destroy(me, expr); + } + + static int nft_extension_dump_info(struct sk_buff *skb, int attr, +@@ -494,8 +511,7 @@ __nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, + if (par.match->destroy != NULL) + par.match->destroy(&par); + +- module_put(me); +- kfree(expr->ops); ++ __nft_mt_tg_destroy(me, expr); + } + + static void +@@ -700,6 +716,14 @@ static const struct nfnetlink_subsystem nfnl_compat_subsys = { + + static struct nft_expr_type nft_match_type; + ++static void nft_mt_tg_deactivate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr, ++ enum nft_trans_phase phase) ++{ ++ if (phase == NFT_TRANS_COMMIT) ++ refcount_inc(&nft_compat_pending_destroy); ++} ++ + static const struct nft_expr_ops * + nft_match_select_ops(const struct nft_ctx *ctx, + const struct nlattr * const tb[]) +@@ -738,6 +762,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, + ops->type = &nft_match_type; + ops->eval = nft_match_eval; + ops->init = nft_match_init; ++ ops->deactivate = nft_mt_tg_deactivate, + ops->destroy = nft_match_destroy; + ops->dump = nft_match_dump; + ops->validate = nft_match_validate; +@@ -828,6 +853,7 @@ nft_target_select_ops(const struct nft_ctx *ctx, + ops->size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); + ops->init = nft_target_init; + ops->destroy = nft_target_destroy; ++ ops->deactivate = nft_mt_tg_deactivate, + ops->dump = nft_target_dump; + ops->validate = nft_target_validate; + ops->data = target; +@@ -891,6 +917,8 @@ static void __exit nft_compat_module_exit(void) + nfnetlink_subsys_unregister(&nfnl_compat_subsys); + nft_unregister_expr(&nft_target_type); + nft_unregister_expr(&nft_match_type); ++ ++ WARN_ON_ONCE(refcount_read(&nft_compat_pending_destroy) != 1); + } + + MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_NFT_COMPAT); +-- +2.27.0 + diff --git a/queue-5.4/netfilter-nft_ct-remove-confirmation-check-for-nft_c.patch b/queue-5.4/netfilter-nft_ct-remove-confirmation-check-for-nft_c.patch new file mode 100644 index 00000000000..d5b5e349133 --- /dev/null +++ b/queue-5.4/netfilter-nft_ct-remove-confirmation-check-for-nft_c.patch @@ -0,0 +1,42 @@ +From faf24d131e62ad936fc4e34b43cbdcc850743d1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 16:39:24 -0500 +Subject: netfilter: nft_ct: Remove confirmation check for NFT_CT_ID + +From: Brett Mastbergen + +[ Upstream commit 2d94b20b95b009eec1a267dcf026b01af627c0cd ] + +Since commit 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id +hash calculation") the ct id will not change from initialization to +confirmation. Removing the confirmation check allows for things like +adding an element to a 'typeof ct id' set in prerouting upon reception +of the first packet of a new connection, and then being able to +reference that set consistently both before and after the connection +is confirmed. + +Fixes: 656c8e9cc1ba ("netfilter: conntrack: Use consistent ct id hash calculation") +Signed-off-by: Brett Mastbergen +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_ct.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c +index 46ca8bcca1bd5..2042c6f4629cc 100644 +--- a/net/netfilter/nft_ct.c ++++ b/net/netfilter/nft_ct.c +@@ -177,8 +177,6 @@ static void nft_ct_get_eval(const struct nft_expr *expr, + } + #endif + case NFT_CT_ID: +- if (!nf_ct_is_confirmed(ct)) +- goto err; + *dest = nf_ct_get_id(ct); + return; + default: +-- +2.27.0 + diff --git a/queue-5.4/netfilter-nft_dynset-fix-timeouts-later-than-23-days.patch b/queue-5.4/netfilter-nft_dynset-fix-timeouts-later-than-23-days.patch new file mode 100644 index 00000000000..32b8f220a19 --- /dev/null +++ b/queue-5.4/netfilter-nft_dynset-fix-timeouts-later-than-23-days.patch @@ -0,0 +1,86 @@ +From 337e1a3853cbe0718689ddb1d9275db7d8f616ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 18:25:53 +0100 +Subject: netfilter: nft_dynset: fix timeouts later than 23 days + +From: Pablo Neira Ayuso + +[ Upstream commit 917d80d376ffbaa9725fde9e3c0282f63643f278 ] + +Use nf_msecs_to_jiffies64 and nf_jiffies64_to_msecs as provided by +8e1102d5a159 ("netfilter: nf_tables: support timeouts larger than 23 +days"), otherwise ruleset listing breaks. + +Fixes: a8b1e36d0d1d ("netfilter: nft_dynset: fix element timeout for HZ != 1000") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_tables.h | 4 ++++ + net/netfilter/nf_tables_api.c | 4 ++-- + net/netfilter/nft_dynset.c | 8 +++++--- + 3 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 6a6fcd10d3185..f694f08ad635b 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -1464,4 +1464,8 @@ void __init nft_chain_route_init(void); + void nft_chain_route_fini(void); + + void nf_tables_trans_destroy_flush_work(void); ++ ++int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result); ++__be64 nf_jiffies64_to_msecs(u64 input); ++ + #endif /* _NET_NF_TABLES_H */ +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 7753d6f1467c9..40216c2a7dd72 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3277,7 +3277,7 @@ static int nf_tables_set_alloc_name(struct nft_ctx *ctx, struct nft_set *set, + return 0; + } + +-static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result) ++int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result) + { + u64 ms = be64_to_cpu(nla_get_be64(nla)); + u64 max = (u64)(~((u64)0)); +@@ -3291,7 +3291,7 @@ static int nf_msecs_to_jiffies64(const struct nlattr *nla, u64 *result) + return 0; + } + +-static __be64 nf_jiffies64_to_msecs(u64 input) ++__be64 nf_jiffies64_to_msecs(u64 input) + { + return cpu_to_be64(jiffies64_to_msecs(input)); + } +diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c +index 8887295414dcb..217fd1bdc55e7 100644 +--- a/net/netfilter/nft_dynset.c ++++ b/net/netfilter/nft_dynset.c +@@ -180,8 +180,10 @@ static int nft_dynset_init(const struct nft_ctx *ctx, + if (tb[NFTA_DYNSET_TIMEOUT] != NULL) { + if (!(set->flags & NFT_SET_TIMEOUT)) + return -EINVAL; +- timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64( +- tb[NFTA_DYNSET_TIMEOUT]))); ++ ++ err = nf_msecs_to_jiffies64(tb[NFTA_DYNSET_TIMEOUT], &timeout); ++ if (err) ++ return err; + } + + priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]); +@@ -296,7 +298,7 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr) + if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name)) + goto nla_put_failure; + if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, +- cpu_to_be64(jiffies_to_msecs(priv->timeout)), ++ nf_jiffies64_to_msecs(priv->timeout), + NFTA_DYNSET_PAD)) + goto nla_put_failure; + if (priv->expr && nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr)) +-- +2.27.0 + diff --git a/queue-5.4/netfilter-x_tables-switch-synchronization-to-rcu.patch b/queue-5.4/netfilter-x_tables-switch-synchronization-to-rcu.patch new file mode 100644 index 00000000000..7460f16c6df --- /dev/null +++ b/queue-5.4/netfilter-x_tables-switch-synchronization-to-rcu.patch @@ -0,0 +1,394 @@ +From 12d075a522a2cdbfa03eed1a5c4b758c781f1e7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 11:27:22 -0700 +Subject: netfilter: x_tables: Switch synchronization to RCU + +From: Subash Abhinov Kasiviswanathan + +[ Upstream commit cc00bcaa589914096edef7fb87ca5cee4a166b5c ] + +When running concurrent iptables rules replacement with data, the per CPU +sequence count is checked after the assignment of the new information. +The sequence count is used to synchronize with the packet path without the +use of any explicit locking. If there are any packets in the packet path using +the table information, the sequence count is incremented to an odd value and +is incremented to an even after the packet process completion. + +The new table value assignment is followed by a write memory barrier so every +CPU should see the latest value. If the packet path has started with the old +table information, the sequence counter will be odd and the iptables +replacement will wait till the sequence count is even prior to freeing the +old table info. + +However, this assumes that the new table information assignment and the memory +barrier is actually executed prior to the counter check in the replacement +thread. If CPU decides to execute the assignment later as there is no user of +the table information prior to the sequence check, the packet path in another +CPU may use the old table information. The replacement thread would then free +the table information under it leading to a use after free in the packet +processing context- + +Unable to handle kernel NULL pointer dereference at virtual +address 000000000000008e +pc : ip6t_do_table+0x5d0/0x89c +lr : ip6t_do_table+0x5b8/0x89c +ip6t_do_table+0x5d0/0x89c +ip6table_filter_hook+0x24/0x30 +nf_hook_slow+0x84/0x120 +ip6_input+0x74/0xe0 +ip6_rcv_finish+0x7c/0x128 +ipv6_rcv+0xac/0xe4 +__netif_receive_skb+0x84/0x17c +process_backlog+0x15c/0x1b8 +napi_poll+0x88/0x284 +net_rx_action+0xbc/0x23c +__do_softirq+0x20c/0x48c + +This could be fixed by forcing instruction order after the new table +information assignment or by switching to RCU for the synchronization. + +Fixes: 80055dab5de0 ("netfilter: x_tables: make xt_replace_table wait until old rules are not used anymore") +Reported-by: Sean Tranchetti +Reported-by: kernel test robot +Suggested-by: Florian Westphal +Signed-off-by: Subash Abhinov Kasiviswanathan +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter/x_tables.h | 5 ++- + net/ipv4/netfilter/arp_tables.c | 14 ++++----- + net/ipv4/netfilter/ip_tables.c | 14 ++++----- + net/ipv6/netfilter/ip6_tables.c | 14 ++++----- + net/netfilter/x_tables.c | 49 +++++++++--------------------- + 5 files changed, 40 insertions(+), 56 deletions(-) + +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 1b261c51b3a3a..f5c21b7d29748 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -227,7 +227,7 @@ struct xt_table { + unsigned int valid_hooks; + + /* Man behind the curtain... */ +- struct xt_table_info *private; ++ struct xt_table_info __rcu *private; + + /* Set this to THIS_MODULE if you are a module, otherwise NULL */ + struct module *me; +@@ -448,6 +448,9 @@ xt_get_per_cpu_counter(struct xt_counters *cnt, unsigned int cpu) + + struct nf_hook_ops *xt_hook_ops_alloc(const struct xt_table *, nf_hookfn *); + ++struct xt_table_info ++*xt_table_get_private_protected(const struct xt_table *table); ++ + #ifdef CONFIG_COMPAT + #include + +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index f1f78a742b36a..8a6a4384e7916 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -203,7 +203,7 @@ unsigned int arpt_do_table(struct sk_buff *skb, + + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = READ_ONCE(table->private); /* Address dependency. */ ++ private = rcu_access_pointer(table->private); + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct arpt_entry **)private->jumpstack[cpu]; +@@ -649,7 +649,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = table->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(table); + + /* We need atomic snapshot of counters: rest doesn't change + * (other than comefrom, which userspace doesn't care +@@ -673,7 +673,7 @@ static int copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct arpt_entry *e; + struct xt_counters *counters; +- struct xt_table_info *private = table->private; ++ struct xt_table_info *private = xt_table_get_private_protected(table); + int ret = 0; + void *loc_cpu_entry; + +@@ -808,7 +808,7 @@ static int get_info(struct net *net, void __user *user, + t = xt_request_find_table_lock(net, NFPROTO_ARP, name); + if (!IS_ERR(t)) { + struct arpt_getinfo info; +- const struct xt_table_info *private = t->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(t); + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -861,7 +861,7 @@ static int get_entries(struct net *net, struct arpt_get_entries __user *uptr, + + t = xt_find_table_lock(net, NFPROTO_ARP, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = t->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(t); + + if (get.size == private->size) + ret = copy_entries_to_user(private->size, +@@ -1020,7 +1020,7 @@ static int do_add_counters(struct net *net, const void __user *user, + } + + local_bh_disable(); +- private = t->private; ++ private = xt_table_get_private_protected(t); + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1357,7 +1357,7 @@ static int compat_copy_entries_to_user(unsigned int total_size, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = table->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(table); + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index 10b91ebdf2131..4852769995440 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -258,7 +258,7 @@ ipt_do_table(struct sk_buff *skb, + WARN_ON(!(table->valid_hooks & (1 << hook))); + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = READ_ONCE(table->private); /* Address dependency. */ ++ private = rcu_access_pointer(table->private); + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct ipt_entry **)private->jumpstack[cpu]; +@@ -791,7 +791,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = table->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(table); + + /* We need atomic snapshot of counters: rest doesn't change + (other than comefrom, which userspace doesn't care +@@ -815,7 +815,7 @@ copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct ipt_entry *e; + struct xt_counters *counters; +- const struct xt_table_info *private = table->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(table); + int ret = 0; + const void *loc_cpu_entry; + +@@ -965,7 +965,7 @@ static int get_info(struct net *net, void __user *user, + t = xt_request_find_table_lock(net, AF_INET, name); + if (!IS_ERR(t)) { + struct ipt_getinfo info; +- const struct xt_table_info *private = t->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(t); + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -1019,7 +1019,7 @@ get_entries(struct net *net, struct ipt_get_entries __user *uptr, + + t = xt_find_table_lock(net, AF_INET, get.name); + if (!IS_ERR(t)) { +- const struct xt_table_info *private = t->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(t); + if (get.size == private->size) + ret = copy_entries_to_user(private->size, + t, uptr->entrytable); +@@ -1175,7 +1175,7 @@ do_add_counters(struct net *net, const void __user *user, + } + + local_bh_disable(); +- private = t->private; ++ private = xt_table_get_private_protected(t); + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1570,7 +1570,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = table->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(table); + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index c973ace208c51..12735ee7713a7 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -280,7 +280,7 @@ ip6t_do_table(struct sk_buff *skb, + + local_bh_disable(); + addend = xt_write_recseq_begin(); +- private = READ_ONCE(table->private); /* Address dependency. */ ++ private = rcu_access_pointer(table->private); + cpu = smp_processor_id(); + table_base = private->entries; + jumpstack = (struct ip6t_entry **)private->jumpstack[cpu]; +@@ -807,7 +807,7 @@ static struct xt_counters *alloc_counters(const struct xt_table *table) + { + unsigned int countersize; + struct xt_counters *counters; +- const struct xt_table_info *private = table->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(table); + + /* We need atomic snapshot of counters: rest doesn't change + (other than comefrom, which userspace doesn't care +@@ -831,7 +831,7 @@ copy_entries_to_user(unsigned int total_size, + unsigned int off, num; + const struct ip6t_entry *e; + struct xt_counters *counters; +- const struct xt_table_info *private = table->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(table); + int ret = 0; + const void *loc_cpu_entry; + +@@ -981,7 +981,7 @@ static int get_info(struct net *net, void __user *user, + t = xt_request_find_table_lock(net, AF_INET6, name); + if (!IS_ERR(t)) { + struct ip6t_getinfo info; +- const struct xt_table_info *private = t->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(t); + #ifdef CONFIG_COMPAT + struct xt_table_info tmp; + +@@ -1036,7 +1036,7 @@ get_entries(struct net *net, struct ip6t_get_entries __user *uptr, + + t = xt_find_table_lock(net, AF_INET6, get.name); + if (!IS_ERR(t)) { +- struct xt_table_info *private = t->private; ++ struct xt_table_info *private = xt_table_get_private_protected(t); + if (get.size == private->size) + ret = copy_entries_to_user(private->size, + t, uptr->entrytable); +@@ -1191,7 +1191,7 @@ do_add_counters(struct net *net, const void __user *user, unsigned int len, + } + + local_bh_disable(); +- private = t->private; ++ private = xt_table_get_private_protected(t); + if (private->number != tmp.num_counters) { + ret = -EINVAL; + goto unlock_up_free; +@@ -1579,7 +1579,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table, + void __user *userptr) + { + struct xt_counters *counters; +- const struct xt_table_info *private = table->private; ++ const struct xt_table_info *private = xt_table_get_private_protected(table); + void __user *pos; + unsigned int size; + int ret = 0; +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 44f971f319920..d1ef2d7930739 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1349,6 +1349,14 @@ struct xt_counters *xt_counters_alloc(unsigned int counters) + } + EXPORT_SYMBOL(xt_counters_alloc); + ++struct xt_table_info ++*xt_table_get_private_protected(const struct xt_table *table) ++{ ++ return rcu_dereference_protected(table->private, ++ mutex_is_locked(&xt[table->af].mutex)); ++} ++EXPORT_SYMBOL(xt_table_get_private_protected); ++ + struct xt_table_info * + xt_replace_table(struct xt_table *table, + unsigned int num_counters, +@@ -1356,7 +1364,6 @@ xt_replace_table(struct xt_table *table, + int *error) + { + struct xt_table_info *private; +- unsigned int cpu; + int ret; + + ret = xt_jumpstack_alloc(newinfo); +@@ -1366,47 +1373,20 @@ xt_replace_table(struct xt_table *table, + } + + /* Do the substitution. */ +- local_bh_disable(); +- private = table->private; ++ private = xt_table_get_private_protected(table); + + /* Check inside lock: is the old number correct? */ + if (num_counters != private->number) { + pr_debug("num_counters != table->private->number (%u/%u)\n", + num_counters, private->number); +- local_bh_enable(); + *error = -EAGAIN; + return NULL; + } + + newinfo->initial_entries = private->initial_entries; +- /* +- * Ensure contents of newinfo are visible before assigning to +- * private. +- */ +- smp_wmb(); +- table->private = newinfo; +- +- /* make sure all cpus see new ->private value */ +- smp_wmb(); + +- /* +- * Even though table entries have now been swapped, other CPU's +- * may still be using the old entries... +- */ +- local_bh_enable(); +- +- /* ... so wait for even xt_recseq on all cpus */ +- for_each_possible_cpu(cpu) { +- seqcount_t *s = &per_cpu(xt_recseq, cpu); +- u32 seq = raw_read_seqcount(s); +- +- if (seq & 1) { +- do { +- cond_resched(); +- cpu_relax(); +- } while (seq == raw_read_seqcount(s)); +- } +- } ++ rcu_assign_pointer(table->private, newinfo); ++ synchronize_rcu(); + + #ifdef CONFIG_AUDIT + if (audit_enabled) { +@@ -1447,12 +1427,12 @@ struct xt_table *xt_register_table(struct net *net, + } + + /* Simplifies replace_table code. */ +- table->private = bootstrap; ++ rcu_assign_pointer(table->private, bootstrap); + + if (!xt_replace_table(table, 0, newinfo, &ret)) + goto unlock; + +- private = table->private; ++ private = xt_table_get_private_protected(table); + pr_debug("table->private->number = %u\n", private->number); + + /* save number of initial entries */ +@@ -1475,7 +1455,8 @@ void *xt_unregister_table(struct xt_table *table) + struct xt_table_info *private; + + mutex_lock(&xt[table->af].mutex); +- private = table->private; ++ private = xt_table_get_private_protected(table); ++ RCU_INIT_POINTER(table->private, NULL); + list_del(&table->list); + mutex_unlock(&xt[table->af].mutex); + kfree(table); +-- +2.27.0 + diff --git a/queue-5.4/perf-x86-intel-check-pebs-status-correctly.patch b/queue-5.4/perf-x86-intel-check-pebs-status-correctly.patch new file mode 100644 index 00000000000..a85064ac7ef --- /dev/null +++ b/queue-5.4/perf-x86-intel-check-pebs-status-correctly.patch @@ -0,0 +1,41 @@ +From bbfeb6719975695b0873bfe29e8dd21a84a4d9b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 20:09:22 +0900 +Subject: perf/x86/intel: Check PEBS status correctly + +From: Stephane Eranian + +[ Upstream commit fc17db8aa4c53cbd2d5469bb0521ea0f0a6dbb27 ] + +The kernel cannot disambiguate when 2+ PEBS counters overflow at the +same time. This is what the comment for this code suggests. However, +I see the comparison is done with the unfiltered p->status which is a +copy of IA32_PERF_GLOBAL_STATUS at the time of the sample. This +register contains more than the PEBS counter overflow bits. It also +includes many other bits which could also be set. + +Signed-off-by: Namhyung Kim +Signed-off-by: Stephane Eranian +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20201126110922.317681-2-namhyung@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/ds.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c +index 1aaba2c8a9ba6..eb8bd0eeace7d 100644 +--- a/arch/x86/events/intel/ds.c ++++ b/arch/x86/events/intel/ds.c +@@ -1912,7 +1912,7 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs) + * that caused the PEBS record. It's called collision. + * If collision happened, the record will be dropped. + */ +- if (p->status != (1ULL << bit)) { ++ if (pebs_status != (1ULL << bit)) { + for_each_set_bit(i, (unsigned long *)&pebs_status, size) + error[i]++; + continue; +-- +2.27.0 + diff --git a/queue-5.4/pinctrl-aspeed-fix-gpio-requests-on-pass-through-ban.patch b/queue-5.4/pinctrl-aspeed-fix-gpio-requests-on-pass-through-ban.patch new file mode 100644 index 00000000000..03906a9e386 --- /dev/null +++ b/queue-5.4/pinctrl-aspeed-fix-gpio-requests-on-pass-through-ban.patch @@ -0,0 +1,165 @@ +From 188d2d0dbb077744de63bf0c5b6d70dc69536985 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 17:03:37 +1030 +Subject: pinctrl: aspeed: Fix GPIO requests on pass-through banks + +From: Andrew Jeffery + +[ Upstream commit 7aeb353802611a8e655e019f09a370ff682af1a6 ] + +Commit 6726fbff19bf ("pinctrl: aspeed: Fix GPI only function problem.") +fixes access to GPIO banks T and U on the AST2600. Both banks contain +input-only pins and the GPIO pin function is named GPITx and GPIUx +respectively. Unfortunately the fix had a negative impact on GPIO banks +D and E for the AST2400 and AST2500 where the GPIO pass-through +functions take similar "GPI"-style names. The net effect on the older +SoCs was that when the GPIO subsystem requested a pin in banks D or E be +muxed for GPIO, they were instead muxed for pass-through mode. +Mistakenly muxing pass-through mode e.g. breaks booting the host on +IBM's Witherspoon (AC922) platform where GPIOE0 is used for FSI. + +Further exploit the names in the provided expression structure to +differentiate pass-through from pin-specific GPIO modes. + +This follow-up fix gives the expected behaviour for the following tests: + +Witherspoon BMC (AST2500): + +1. Power-on the Witherspoon host +2. Request GPIOD1 be muxed via /sys/class/gpio/export +3. Request GPIOE1 be muxed via /sys/class/gpio/export +4. Request the balls for GPIOs E2 and E3 be muxed as GPIO pass-through + ("GPIE2" mode) via a pinctrl hog in the devicetree + +Rainier BMC (AST2600): + +5. Request GPIT0 be muxed via /sys/class/gpio/export +6. Request GPIU0 be muxed via /sys/class/gpio/export + +Together the tests demonstrate that all three pieces of functionality +(general GPIOs via 1, 2 and 3, input-only GPIOs via 5 and 6, pass-through +mode via 4) operate as desired across old and new SoCs. + +Fixes: 9b92f5c51e9a ("pinctrl: aspeed: Fix GPI only function problem.") +Signed-off-by: Andrew Jeffery +Tested-by: Joel Stanley +Reviewed-by: Joel Stanley +Cc: Billy Tsai +Cc: Joel Stanley +Link: https://lore.kernel.org/r/20201126063337.489927-1-andrew@aj.id.au +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/aspeed/pinctrl-aspeed.c | 74 +++++++++++++++++++++++-- + drivers/pinctrl/aspeed/pinmux-aspeed.h | 7 ++- + 2 files changed, 72 insertions(+), 9 deletions(-) + +diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed.c b/drivers/pinctrl/aspeed/pinctrl-aspeed.c +index 93b5654ff2828..22aca6d182c0c 100644 +--- a/drivers/pinctrl/aspeed/pinctrl-aspeed.c ++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed.c +@@ -277,14 +277,76 @@ int aspeed_pinmux_set_mux(struct pinctrl_dev *pctldev, unsigned int function, + static bool aspeed_expr_is_gpio(const struct aspeed_sig_expr *expr) + { + /* +- * The signal type is GPIO if the signal name has "GPI" as a prefix. +- * strncmp (rather than strcmp) is used to implement the prefix +- * requirement. ++ * We need to differentiate between GPIO and non-GPIO signals to ++ * implement the gpio_request_enable() interface. For better or worse ++ * the ASPEED pinctrl driver uses the expression names to determine ++ * whether an expression will mux a pin for GPIO. + * +- * expr->signal might look like "GPIOB1" in the GPIO case. +- * expr->signal might look like "GPIT0" in the GPI case. ++ * Generally we have the following - A GPIO such as B1 has: ++ * ++ * - expr->signal set to "GPIOB1" ++ * - expr->function set to "GPIOB1" ++ * ++ * Using this fact we can determine whether the provided expression is ++ * a GPIO expression by testing the signal name for the string prefix ++ * "GPIO". ++ * ++ * However, some GPIOs are input-only, and the ASPEED datasheets name ++ * them differently. An input-only GPIO such as T0 has: ++ * ++ * - expr->signal set to "GPIT0" ++ * - expr->function set to "GPIT0" ++ * ++ * It's tempting to generalise the prefix test from "GPIO" to "GPI" to ++ * account for both GPIOs and GPIs, but in doing so we run aground on ++ * another feature: ++ * ++ * Some pins in the ASPEED BMC SoCs have a "pass-through" GPIO ++ * function where the input state of one pin is replicated as the ++ * output state of another (as if they were shorted together - a mux ++ * configuration that is typically enabled by hardware strapping). ++ * This feature allows the BMC to pass e.g. power button state through ++ * to the host while the BMC is yet to boot, but take control of the ++ * button state once the BMC has booted by muxing each pin as a ++ * separate, pin-specific GPIO. ++ * ++ * Conceptually this pass-through mode is a form of GPIO and is named ++ * as such in the datasheets, e.g. "GPID0". This naming similarity ++ * trips us up with the simple GPI-prefixed-signal-name scheme ++ * discussed above, as the pass-through configuration is not what we ++ * want when muxing a pin as GPIO for the GPIO subsystem. ++ * ++ * On e.g. the AST2400, a pass-through function "GPID0" is grouped on ++ * balls A18 and D16, where we have: ++ * ++ * For ball A18: ++ * - expr->signal set to "GPID0IN" ++ * - expr->function set to "GPID0" ++ * ++ * For ball D16: ++ * - expr->signal set to "GPID0OUT" ++ * - expr->function set to "GPID0" ++ * ++ * By contrast, the pin-specific GPIO expressions for the same pins are ++ * as follows: ++ * ++ * For ball A18: ++ * - expr->signal looks like "GPIOD0" ++ * - expr->function looks like "GPIOD0" ++ * ++ * For ball D16: ++ * - expr->signal looks like "GPIOD1" ++ * - expr->function looks like "GPIOD1" ++ * ++ * Testing both the signal _and_ function names gives us the means ++ * differentiate the pass-through GPIO pinmux configuration from the ++ * pin-specific configuration that the GPIO subsystem is after: An ++ * expression is a pin-specific (non-pass-through) GPIO configuration ++ * if the signal prefix is "GPI" and the signal name matches the ++ * function name. + */ +- return strncmp(expr->signal, "GPI", 3) == 0; ++ return !strncmp(expr->signal, "GPI", 3) && ++ !strcmp(expr->signal, expr->function); + } + + static bool aspeed_gpio_in_exprs(const struct aspeed_sig_expr **exprs) +diff --git a/drivers/pinctrl/aspeed/pinmux-aspeed.h b/drivers/pinctrl/aspeed/pinmux-aspeed.h +index 140c5ce9fbc11..0aaa20653536f 100644 +--- a/drivers/pinctrl/aspeed/pinmux-aspeed.h ++++ b/drivers/pinctrl/aspeed/pinmux-aspeed.h +@@ -452,10 +452,11 @@ struct aspeed_sig_desc { + * evaluation of the descriptors. + * + * @signal: The signal name for the priority level on the pin. If the signal +- * type is GPIO, then the signal name must begin with the string +- * "GPIO", e.g. GPIOA0, GPIOT4 etc. ++ * type is GPIO, then the signal name must begin with the ++ * prefix "GPI", e.g. GPIOA0, GPIT0 etc. + * @function: The name of the function the signal participates in for the +- * associated expression ++ * associated expression. For pin-specific GPIO, the function ++ * name must match the signal name. + * @ndescs: The number of signal descriptors in the expression + * @descs: Pointer to an array of signal descriptors that comprise the + * function expression +-- +2.27.0 + diff --git a/queue-5.4/pinctrl-baytrail-avoid-clearing-debounce-value-when-.patch b/queue-5.4/pinctrl-baytrail-avoid-clearing-debounce-value-when-.patch new file mode 100644 index 00000000000..d3df5451971 --- /dev/null +++ b/queue-5.4/pinctrl-baytrail-avoid-clearing-debounce-value-when-.patch @@ -0,0 +1,72 @@ +From 6def410b848de9479c5648f44cf6e059125f2966 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 21:03:01 +0200 +Subject: pinctrl: baytrail: Avoid clearing debounce value when turning it off + +From: Andy Shevchenko + +[ Upstream commit 0b74e40a4e41f3cbad76dff4c50850d47b525b26 ] + +Baytrail pin control has a common register to set up debounce timeout. +When a pin configuration requested debounce to be disabled, the rest +of the pins may still want to have debounce enabled and thus rely on +the common timeout value. Avoid clearing debounce value when turning +it off for one pin while others may still use it. + +Fixes: 658b476c742f ("pinctrl: baytrail: Add debounce configuration") +Depends-on: 04ff5a095d66 ("pinctrl: baytrail: Rectify debounce support") +Depends-on: 827e1579e1d5 ("pinctrl: baytrail: Rectify debounce support (part 2)") +Signed-off-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-baytrail.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c +index 5a1174a8e2bac..d05f20ca90d7e 100644 +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -1060,7 +1060,6 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, + break; + case PIN_CONFIG_INPUT_DEBOUNCE: + debounce = readl(db_reg); +- debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + + if (arg) + conf |= BYT_DEBOUNCE_EN; +@@ -1069,24 +1068,31 @@ static int byt_pin_config_set(struct pinctrl_dev *pctl_dev, + + switch (arg) { + case 375: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_375US; + break; + case 750: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_750US; + break; + case 1500: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_1500US; + break; + case 3000: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_3MS; + break; + case 6000: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_6MS; + break; + case 12000: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_12MS; + break; + case 24000: ++ debounce &= ~BYT_DEBOUNCE_PULSE_MASK; + debounce |= BYT_DEBOUNCE_PULSE_24MS; + break; + default: +-- +2.27.0 + diff --git a/queue-5.4/pinctrl-merrifield-set-default-bias-in-case-no-parti.patch b/queue-5.4/pinctrl-merrifield-set-default-bias-in-case-no-parti.patch new file mode 100644 index 00000000000..cd87be46dec --- /dev/null +++ b/queue-5.4/pinctrl-merrifield-set-default-bias-in-case-no-parti.patch @@ -0,0 +1,58 @@ +From ab8ba9d81099f0f695506cd40d599a2515f9ce3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 14:06:05 +0200 +Subject: pinctrl: merrifield: Set default bias in case no particular value + given + +From: Andy Shevchenko + +[ Upstream commit 0fa86fc2e28227f1e64f13867e73cf864c6d25ad ] + +When GPIO library asks pin control to set the bias, it doesn't pass +any value of it and argument is considered boolean (and this is true +for ACPI GpioIo() / GpioInt() resources, by the way). Thus, individual +drivers must behave well, when they got the resistance value of 1 Ohm, +i.e. transforming it to sane default. + +In case of Intel Merrifield pin control hardware the 20 kOhm sounds plausible +because it gives a good trade off between weakness and minimization of leakage +current (will be only 50 uA with the above choice). + +Fixes: 4e80c8f50574 ("pinctrl: intel: Add Intel Merrifield pin controller support") +Depends-on: 2956b5d94a76 ("pinctrl / gpio: Introduce .set_config() callback for GPIO chips") +Signed-off-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/intel/pinctrl-merrifield.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/pinctrl/intel/pinctrl-merrifield.c b/drivers/pinctrl/intel/pinctrl-merrifield.c +index 04ca8ae95df83..9e91d83b01388 100644 +--- a/drivers/pinctrl/intel/pinctrl-merrifield.c ++++ b/drivers/pinctrl/intel/pinctrl-merrifield.c +@@ -741,6 +741,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin, + mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK; + bits |= BUFCFG_PU_EN; + ++ /* Set default strength value in case none is given */ ++ if (arg == 1) ++ arg = 20000; ++ + switch (arg) { + case 50000: + bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT; +@@ -761,6 +765,10 @@ static int mrfld_config_set_pin(struct mrfld_pinctrl *mp, unsigned int pin, + mask |= BUFCFG_Px_EN_MASK | BUFCFG_PUPD_VAL_MASK; + bits |= BUFCFG_PD_EN; + ++ /* Set default strength value in case none is given */ ++ if (arg == 1) ++ arg = 20000; ++ + switch (arg) { + case 50000: + bits |= BUFCFG_PUPD_VAL_50K << BUFCFG_PUPD_VAL_SHIFT; +-- +2.27.0 + diff --git a/queue-5.4/rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch b/queue-5.4/rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch new file mode 100644 index 00000000000..2a695820076 --- /dev/null +++ b/queue-5.4/rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch @@ -0,0 +1,79 @@ +From 824d52c5233279095be798f23cfd0ffa99b5d3c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 08:42:05 +0200 +Subject: RDMA/cm: Fix an attempt to use non-valid pointer when cleaning + timewait +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Leon Romanovsky + +[ Upstream commit 340b940ea0ed12d9adbb8f72dea17d516b2019e8 ] + +If cm_create_timewait_info() fails, the timewait_info pointer will contain +an error value and will be used in cm_remove_remote() later. + + general protection fault, probably for non-canonical address 0xdffffc0000000024: 0000 [#1] SMP KASAN PTI + KASAN: null-ptr-deref in range [0×0000000000000120-0×0000000000000127] + CPU: 2 PID: 12446 Comm: syz-executor.3 Not tainted 5.10.0-rc5-5d4c0742a60e #27 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + RIP: 0010:cm_remove_remote.isra.0+0x24/0×170 drivers/infiniband/core/cm.c:978 + Code: 84 00 00 00 00 00 41 54 55 53 48 89 fb 48 8d ab 2d 01 00 00 e8 7d bf 4b fe 48 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 48 89 ea 83 e2 07 38 d0 7f 08 84 c0 0f 85 fc 00 00 00 + RSP: 0018:ffff888013127918 EFLAGS: 00010006 + RAX: dffffc0000000000 RBX: fffffffffffffff4 RCX: ffffc9000a18b000 + RDX: 0000000000000024 RSI: ffffffff82edc573 RDI: fffffffffffffff4 + RBP: 0000000000000121 R08: 0000000000000001 R09: ffffed1002624f1d + R10: 0000000000000003 R11: ffffed1002624f1c R12: ffff888107760c70 + R13: ffff888107760c40 R14: fffffffffffffff4 R15: ffff888107760c9c + FS: 00007fe1ffcc1700(0000) GS:ffff88811a600000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000001b2ff21000 CR3: 000000010f504001 CR4: 0000000000370ee0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + cm_destroy_id+0x189/0×15b0 drivers/infiniband/core/cm.c:1155 + cma_connect_ib drivers/infiniband/core/cma.c:4029 [inline] + rdma_connect_locked+0x1100/0×17c0 drivers/infiniband/core/cma.c:4107 + rdma_connect+0x2a/0×40 drivers/infiniband/core/cma.c:4140 + ucma_connect+0x277/0×340 drivers/infiniband/core/ucma.c:1069 + ucma_write+0x236/0×2f0 drivers/infiniband/core/ucma.c:1724 + vfs_write+0x220/0×830 fs/read_write.c:603 + ksys_write+0x1df/0×240 fs/read_write.c:658 + do_syscall_64+0x33/0×40 arch/x86/entry/common.c:46 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation") +Link: https://lore.kernel.org/r/20201204064205.145795-1-leon@kernel.org +Reviewed-by: Maor Gottlieb +Reported-by: Amit Matityahu +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c +index c1d6a068f50fe..fd7c84721b0de 100644 +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1435,6 +1435,7 @@ int ib_send_cm_req(struct ib_cm_id *cm_id, + id.local_id); + if (IS_ERR(cm_id_priv->timewait_info)) { + ret = PTR_ERR(cm_id_priv->timewait_info); ++ cm_id_priv->timewait_info = NULL; + goto out; + } + +@@ -1961,6 +1962,7 @@ static int cm_req_handler(struct cm_work *work) + id.local_id); + if (IS_ERR(cm_id_priv->timewait_info)) { + ret = PTR_ERR(cm_id_priv->timewait_info); ++ cm_id_priv->timewait_info = NULL; + goto destroy; + } + cm_id_priv->timewait_info->work.remote_id = req_msg->local_comm_id; +-- +2.27.0 + diff --git a/queue-5.4/revert-gpio-eic-sprd-use-devm_platform_ioremap_resou.patch b/queue-5.4/revert-gpio-eic-sprd-use-devm_platform_ioremap_resou.patch new file mode 100644 index 00000000000..e3ea67b5eb9 --- /dev/null +++ b/queue-5.4/revert-gpio-eic-sprd-use-devm_platform_ioremap_resou.patch @@ -0,0 +1,67 @@ +From 789a6229744d9a1cb742b2c773e608782cf1c238 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Apr 2020 17:59:25 +0800 +Subject: Revert "gpio: eic-sprd: Use devm_platform_ioremap_resource()" + +From: Baolin Wang + +[ Upstream commit 4ed7d7dd4890bb8120a3e77c16191a695fdfcc5a ] + +This reverts commit 0f5cb8cc27a266c81e6523b436479802e9aafc9e. + +This commit will cause below warnings, since our EIC controller can support +differnt banks on different Spreadtrum SoCs, and each bank has its own base +address, we will get invalid resource warning if the bank number is less than +SPRD_EIC_MAX_BANK on some Spreadtrum SoCs. + +So we should not use devm_platform_ioremap_resource() here to remove the +warnings. + +[ 1.118508] sprd-eic 40210000.gpio: invalid resource +[ 1.118535] sprd-eic 40210000.gpio: invalid resource +[ 1.119034] sprd-eic 40210080.gpio: invalid resource +[ 1.119055] sprd-eic 40210080.gpio: invalid resource +[ 1.119462] sprd-eic 402100a0.gpio: invalid resource +[ 1.119482] sprd-eic 402100a0.gpio: invalid resource +[ 1.119893] sprd-eic 402100c0.gpio: invalid resource +[ 1.119913] sprd-eic 402100c0.gpio: invalid resource + +Signed-off-by: Baolin Wang +Link: https://lore.kernel.org/r/8d3579f4b49bb675dc805035960f24852898be28.1585734060.git.baolin.wang7@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-eic-sprd.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-eic-sprd.c b/drivers/gpio/gpio-eic-sprd.c +index bb287f35cf408..8c97577740100 100644 +--- a/drivers/gpio/gpio-eic-sprd.c ++++ b/drivers/gpio/gpio-eic-sprd.c +@@ -569,6 +569,7 @@ static int sprd_eic_probe(struct platform_device *pdev) + const struct sprd_eic_variant_data *pdata; + struct gpio_irq_chip *irq; + struct sprd_eic *sprd_eic; ++ struct resource *res; + int ret, i; + + pdata = of_device_get_match_data(&pdev->dev); +@@ -595,9 +596,13 @@ static int sprd_eic_probe(struct platform_device *pdev) + * have one bank EIC, thus base[1] and base[2] can be + * optional. + */ +- sprd_eic->base[i] = devm_platform_ioremap_resource(pdev, i); +- if (IS_ERR(sprd_eic->base[i])) ++ res = platform_get_resource(pdev, IORESOURCE_MEM, i); ++ if (!res) + continue; ++ ++ sprd_eic->base[i] = devm_ioremap_resource(&pdev->dev, res); ++ if (IS_ERR(sprd_eic->base[i])) ++ return PTR_ERR(sprd_eic->base[i]); + } + + sprd_eic->chip.label = sprd_eic_label_name[sprd_eic->type]; +-- +2.27.0 + diff --git a/queue-5.4/scsi-bnx2i-requires-mmu.patch b/queue-5.4/scsi-bnx2i-requires-mmu.patch new file mode 100644 index 00000000000..ffccc0eb069 --- /dev/null +++ b/queue-5.4/scsi-bnx2i-requires-mmu.patch @@ -0,0 +1,52 @@ +From 19ec576cdb41cf911f58b0d5d8c4a67ea7ec5002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Nov 2020 23:09:16 -0800 +Subject: scsi: bnx2i: Requires MMU + +From: Randy Dunlap + +[ Upstream commit 2d586494c4a001312650f0b919d534e429dd1e09 ] + +The SCSI_BNX2_ISCSI kconfig symbol selects CNIC and CNIC selects UIO, which +depends on MMU. + +Since 'select' does not follow dependency chains, add the same MMU +dependency to SCSI_BNX2_ISCSI. + +Quietens this kconfig warning: + +WARNING: unmet direct dependencies detected for CNIC + Depends on [n]: NETDEVICES [=y] && ETHERNET [=y] && NET_VENDOR_BROADCOM [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n) && MMU [=n] + Selected by [m]: + - SCSI_BNX2_ISCSI [=m] && SCSI_LOWLEVEL [=y] && SCSI [=y] && NET [=y] && PCI [=y] && (IPV6 [=m] || IPV6 [=m]=n) + +Link: https://lore.kernel.org/r/20201129070916.3919-1-rdunlap@infradead.org +Fixes: cf4e6363859d ("[SCSI] bnx2i: Add bnx2i iSCSI driver.") +Cc: linux-scsi@vger.kernel.org +Cc: Nilesh Javali +Cc: Manish Rangankar +Cc: GR-QLogic-Storage-Upstream@marvell.com +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Signed-off-by: Randy Dunlap +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2i/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/bnx2i/Kconfig b/drivers/scsi/bnx2i/Kconfig +index 702dc82c9501d..a0c0791abee69 100644 +--- a/drivers/scsi/bnx2i/Kconfig ++++ b/drivers/scsi/bnx2i/Kconfig +@@ -4,6 +4,7 @@ config SCSI_BNX2_ISCSI + depends on NET + depends on PCI + depends on (IPV6 || IPV6=n) ++ depends on MMU + select SCSI_ISCSI_ATTRS + select NETDEVICES + select ETHERNET +-- +2.27.0 + diff --git a/queue-5.4/scsi-mpt3sas-increase-iocinit-request-timeout-to-30s.patch b/queue-5.4/scsi-mpt3sas-increase-iocinit-request-timeout-to-30s.patch new file mode 100644 index 00000000000..5d67fec02f7 --- /dev/null +++ b/queue-5.4/scsi-mpt3sas-increase-iocinit-request-timeout-to-30s.patch @@ -0,0 +1,38 @@ +From 147d0d4b9025d684392ffbb5046667600a0ad4eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 13:57:33 +0530 +Subject: scsi: mpt3sas: Increase IOCInit request timeout to 30s + +From: Sreekanth Reddy + +[ Upstream commit 85dad327d9b58b4c9ce08189a2707167de392d23 ] + +Currently the IOCInit request message timeout is set to 10s. This is not +sufficient in some scenarios such as during HBA FW downgrade operations. + +Increase the IOCInit request timeout to 30s. + +Link: https://lore.kernel.org/r/20201130082733.26120-1-sreekanth.reddy@broadcom.com +Signed-off-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 8be8c510fdf79..7532603aafb15 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -6227,7 +6227,7 @@ _base_send_ioc_init(struct MPT3SAS_ADAPTER *ioc) + + r = _base_handshake_req_reply_wait(ioc, + sizeof(Mpi2IOCInitRequest_t), (u32 *)&mpi_request, +- sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 10); ++ sizeof(Mpi2IOCInitReply_t), (u16 *)&mpi_reply, 30); + + if (r != 0) { + ioc_err(ioc, "%s: handshake failed (r=%d)\n", __func__, r); +-- +2.27.0 + diff --git a/queue-5.4/selftests-bpf-test_offload.py-reset-ethtool-features.patch b/queue-5.4/selftests-bpf-test_offload.py-reset-ethtool-features.patch new file mode 100644 index 00000000000..41bae156a39 --- /dev/null +++ b/queue-5.4/selftests-bpf-test_offload.py-reset-ethtool-features.patch @@ -0,0 +1,43 @@ +From 3acbd15bc077f3e86241a22a09355667b8703218 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 14:57:42 +0100 +Subject: selftests/bpf/test_offload.py: Reset ethtool features after failed + setting +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 766e62b7fcd2cf1d43e6594ba37c659dc48f7ddb ] + +When setting the ethtool feature flag fails (as expected for the test), the +kernel now tracks that the feature was requested to be 'off' and refuses to +subsequently disable it again. So reset it back to 'on' so a subsequent +disable (that's not supposed to fail) can succeed. + +Fixes: 417ec26477a5 ("selftests/bpf: add offload test based on netdevsim") +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: Daniel Borkmann +Acked-by: Jakub Kicinski +Link: https://lore.kernel.org/bpf/160752226280.110217.10696241563705667871.stgit@toke.dk +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_offload.py | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/test_offload.py b/tools/testing/selftests/bpf/test_offload.py +index 1afa22c88e42a..8f918847ddf89 100755 +--- a/tools/testing/selftests/bpf/test_offload.py ++++ b/tools/testing/selftests/bpf/test_offload.py +@@ -930,6 +930,7 @@ try: + start_test("Test disabling TC offloads is rejected while filters installed...") + ret, _ = sim.set_ethtool_tc_offloads(False, fail=False) + fail(ret == 0, "Driver should refuse to disable TC offloads with filters installed...") ++ sim.set_ethtool_tc_offloads(True) + + start_test("Test qdisc removal frees things...") + sim.tc_flush_filters() +-- +2.27.0 + diff --git a/queue-5.4/selftests-fix-poll-error-in-udpgro.sh.patch b/queue-5.4/selftests-fix-poll-error-in-udpgro.sh.patch new file mode 100644 index 00000000000..dbd15ac1d16 --- /dev/null +++ b/queue-5.4/selftests-fix-poll-error-in-udpgro.sh.patch @@ -0,0 +1,48 @@ +From eba0cc0ece4a74a72e5394d9e2edfdd1e5f9b859 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 12:21:13 +0100 +Subject: selftests: fix poll error in udpgro.sh + +From: Paolo Abeni + +[ Upstream commit 38bf8cd821be292e7d8e6f6283d67c5d9708f887 ] + +The test program udpgso_bench_rx always invokes the poll() +syscall with a timeout of 10ms. If a larger timeout is specified +via the command line, udpgso_bench_rx is supposed to do multiple +poll() calls till the timeout is expired or an event is received. + +Currently the poll() loop errors out after the first invocation with +no events, and may causes self-tests failure alike: + +failed + GRO with custom segment size ./udpgso_bench_rx: poll: 0x0 expected 0x1 + +This change addresses the issue allowing the poll() loop to consume +all the configured timeout. + +Fixes: ada641ff6ed3 ("selftests: fixes for UDP GRO") +Signed-off-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/udpgso_bench_rx.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/selftests/net/udpgso_bench_rx.c b/tools/testing/selftests/net/udpgso_bench_rx.c +index db3d4a8b5a4c4..76a24052f4b47 100644 +--- a/tools/testing/selftests/net/udpgso_bench_rx.c ++++ b/tools/testing/selftests/net/udpgso_bench_rx.c +@@ -113,6 +113,9 @@ static void do_poll(int fd, int timeout_ms) + interrupted = true; + break; + } ++ ++ /* no events and more time to wait, do poll again */ ++ continue; + } + if (pfd.revents != POLLIN) + error(1, errno, "poll: 0x%x expected 0x%x\n", +-- +2.27.0 + diff --git a/queue-5.4/series b/queue-5.4/series new file mode 100644 index 00000000000..f8833d070a4 --- /dev/null +++ b/queue-5.4/series @@ -0,0 +1,48 @@ +arm-dts-sun7i-bananapi-enable-rgmii-rx-tx-delay-on-e.patch +arm-dts-sun8i-r40-bananapi-m2-berry-fix-dcdc1-regula.patch +arm-dts-sun8i-v40-bananapi-m2-berry-fix-ethernet-nod.patch +pinctrl-merrifield-set-default-bias-in-case-no-parti.patch +pinctrl-baytrail-avoid-clearing-debounce-value-when-.patch +arm-dts-sun8i-v3s-fix-gic-node-memory-range.patch +arm-dts-sun7i-pcduino3-nano-enable-rgmii-rx-tx-delay.patch +arm-dts-imx6qdl-wandboard-revd1-remove-pad_gpio_6-fr.patch +arm-dts-imx6qdl-kontron-samx6i-fix-i2c_pm-scl-pin.patch +gpio-zynq-fix-reference-leak-in-zynq_gpio-functions.patch +gpio-mvebu-fix-potential-user-after-free-on-probe.patch +scsi-bnx2i-requires-mmu.patch +xsk-fix-xsk_poll-s-return-type.patch +xsk-replace-datagram_poll-by-sock_poll_wait.patch +can-softing-softing_netdev_open-fix-error-handling.patch +clk-renesas-r9a06g032-drop-__packed-for-portability.patch +block-simplify-req_op_zone_reset_all-handling.patch +block-factor-out-requeue-handling-from-dispatch-code.patch +blk-mq-in-blk_mq_dispatch_rq_list-no-budget-is-a-rea.patch +pinctrl-aspeed-fix-gpio-requests-on-pass-through-ban.patch +netfilter-x_tables-switch-synchronization-to-rcu.patch +netfilter-nft_compat-make-sure-xtables-destructors-h.patch +netfilter-nft_dynset-fix-timeouts-later-than-23-days.patch +afs-fix-memory-leak-when-mounting-with-multiple-sour.patch +revert-gpio-eic-sprd-use-devm_platform_ioremap_resou.patch +gpio-eic-sprd-break-loop-when-getting-null-device-re.patch +netfilter-nft_ct-remove-confirmation-check-for-nft_c.patch +selftests-bpf-test_offload.py-reset-ethtool-features.patch +rdma-cm-fix-an-attempt-to-use-non-valid-pointer-when.patch +i40e-refactor-rx_bi-accesses.patch +i40e-optimise-prefetch-page-refcount.patch +i40e-avoid-premature-rx-buffer-reuse.patch +ixgbe-avoid-premature-rx-buffer-reuse.patch +selftests-fix-poll-error-in-udpgro.sh.patch +net-mvpp2-add-mvpp2_phylink_to_port-helper.patch +drm-tegra-replace-idr_init-by-idr_init_base.patch +kernel-cpu-add-arch-override-for-clear_tasks_mm_cpum.patch +drm-tegra-sor-disable-clocks-on-error-in-tegra_sor_i.patch +habanalabs-put-devices-before-driver-removal.patch +arm64-syscall-exit-userspace-before-unmasking-except.patch +vxlan-add-needed_headroom-for-lower-device.patch +vxlan-copy-needed_tailroom-from-lowerdev.patch +scsi-mpt3sas-increase-iocinit-request-timeout-to-30s.patch +dm-table-remove-bug_on-in_interrupt.patch +iwlwifi-pcie-add-one-missing-entry-for-ax210.patch +drm-amd-display-init-clock-value-by-current-vbios-cl.patch +perf-x86-intel-check-pebs-status-correctly.patch +kbuild-avoid-split-lines-in-.mod-files.patch diff --git a/queue-5.4/vxlan-add-needed_headroom-for-lower-device.patch b/queue-5.4/vxlan-add-needed_headroom-for-lower-device.patch new file mode 100644 index 00000000000..ea3838a9471 --- /dev/null +++ b/queue-5.4/vxlan-add-needed_headroom-for-lower-device.patch @@ -0,0 +1,51 @@ +From 9bd1aa2e3379ad318a0bb79cafdbad033c4a6bf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 13:52:46 +0100 +Subject: vxlan: Add needed_headroom for lower device + +From: Sven Eckelmann + +[ Upstream commit 0a35dc41fea67ac4495ce7584406bf9557a6e7d0 ] + +It was observed that sending data via batadv over vxlan (on top of +wireguard) reduced the performance massively compared to raw ethernet or +batadv on raw ethernet. A check of perf data showed that the +vxlan_build_skb was calling all the time pskb_expand_head to allocate +enough headroom for: + + min_headroom = LL_RESERVED_SPACE(dst->dev) + dst->header_len + + VXLAN_HLEN + iphdr_len; + +But the vxlan_config_apply only requested needed headroom for: + + lowerdev->hard_header_len + VXLAN6_HEADROOM or VXLAN_HEADROOM + +So it completely ignored the needed_headroom of the lower device. The first +caller of net_dev_xmit could therefore never make sure that enough headroom +was allocated for the rest of the transmit path. + +Cc: Annika Wickert +Signed-off-by: Sven Eckelmann +Tested-by: Annika Wickert +Link: https://lore.kernel.org/r/20201126125247.1047977-1-sven@narfation.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 630ac00a34ede..3753cf0942865 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -3538,6 +3538,7 @@ static void vxlan_config_apply(struct net_device *dev, + dev->gso_max_segs = lowerdev->gso_max_segs; + + needed_headroom = lowerdev->hard_header_len; ++ needed_headroom += lowerdev->needed_headroom; + + max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : + VXLAN_HEADROOM); +-- +2.27.0 + diff --git a/queue-5.4/vxlan-copy-needed_tailroom-from-lowerdev.patch b/queue-5.4/vxlan-copy-needed_tailroom-from-lowerdev.patch new file mode 100644 index 00000000000..375f2a86922 --- /dev/null +++ b/queue-5.4/vxlan-copy-needed_tailroom-from-lowerdev.patch @@ -0,0 +1,37 @@ +From 58f6fbfd98643a5f480cc8538d3affd6b23450d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 13:52:47 +0100 +Subject: vxlan: Copy needed_tailroom from lowerdev + +From: Sven Eckelmann + +[ Upstream commit a5e74021e84bb5eadf760aaf2c583304f02269be ] + +While vxlan doesn't need any extra tailroom, the lowerdev might need it. In +that case, copy it over to reduce the chance for additional (re)allocations +in the transmit path. + +Signed-off-by: Sven Eckelmann +Link: https://lore.kernel.org/r/20201126125247.1047977-2-sven@narfation.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 3753cf0942865..5502e145aa17b 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -3540,6 +3540,8 @@ static void vxlan_config_apply(struct net_device *dev, + needed_headroom = lowerdev->hard_header_len; + needed_headroom += lowerdev->needed_headroom; + ++ dev->needed_tailroom = lowerdev->needed_tailroom; ++ + max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : + VXLAN_HEADROOM); + if (max_mtu < ETH_MIN_MTU) +-- +2.27.0 + diff --git a/queue-5.4/xsk-fix-xsk_poll-s-return-type.patch b/queue-5.4/xsk-fix-xsk_poll-s-return-type.patch new file mode 100644 index 00000000000..c8f95f841e5 --- /dev/null +++ b/queue-5.4/xsk-fix-xsk_poll-s-return-type.patch @@ -0,0 +1,59 @@ +From 56755e17cd7ad8e78b73b1853c406043ce796e17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 20 Nov 2019 01:10:42 +0100 +Subject: xsk: Fix xsk_poll()'s return type +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luc Van Oostenryck + +[ Upstream commit 5d946c5abbaf68083fa6a41824dd79e1f06286d8 ] + +xsk_poll() is defined as returning 'unsigned int' but the +.poll method is declared as returning '__poll_t', a bitwise type. + +Fix this by using the proper return type and using the EPOLL +constants instead of the POLL ones, as required for __poll_t. + +Signed-off-by: Luc Van Oostenryck +Signed-off-by: Daniel Borkmann +Acked-by: Björn Töpel +Link: https://lore.kernel.org/bpf/20191120001042.30830-1-luc.vanoostenryck@gmail.com +Signed-off-by: Sasha Levin +--- + net/xdp/xsk.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index f9eb5efb237c7..04652797cd374 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -426,10 +426,10 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) + return __xsk_sendmsg(sk); + } + +-static unsigned int xsk_poll(struct file *file, struct socket *sock, ++static __poll_t xsk_poll(struct file *file, struct socket *sock, + struct poll_table_struct *wait) + { +- unsigned int mask = datagram_poll(file, sock, wait); ++ __poll_t mask = datagram_poll(file, sock, wait); + struct sock *sk = sock->sk; + struct xdp_sock *xs = xdp_sk(sk); + struct xdp_umem *umem; +@@ -448,9 +448,9 @@ static unsigned int xsk_poll(struct file *file, struct socket *sock, + } + + if (xs->rx && !xskq_empty_desc(xs->rx)) +- mask |= POLLIN | POLLRDNORM; ++ mask |= EPOLLIN | EPOLLRDNORM; + if (xs->tx && !xskq_full_desc(xs->tx)) +- mask |= POLLOUT | POLLWRNORM; ++ mask |= EPOLLOUT | EPOLLWRNORM; + + return mask; + } +-- +2.27.0 + diff --git a/queue-5.4/xsk-replace-datagram_poll-by-sock_poll_wait.patch b/queue-5.4/xsk-replace-datagram_poll-by-sock_poll_wait.patch new file mode 100644 index 00000000000..7819045a56a --- /dev/null +++ b/queue-5.4/xsk-replace-datagram_poll-by-sock_poll_wait.patch @@ -0,0 +1,46 @@ +From 3c62262f24d92e513d8e38b385d53dbfd006cb0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 21:56:57 +0800 +Subject: xsk: Replace datagram_poll by sock_poll_wait + +From: Xuan Zhuo + +[ Upstream commit f5da54187e33dce9bea63170667dbb0ca8d98194 ] + +datagram_poll will judge the current socket status (EPOLLIN, EPOLLOUT) +based on the traditional socket information (eg: sk_wmem_alloc), but +this does not apply to xsk. So this patch uses sock_poll_wait instead of +datagram_poll, and the mask is calculated by xsk_poll. + +Fixes: c497176cb2e4 ("xsk: add Rx receive functions and poll support") +Signed-off-by: Xuan Zhuo +Signed-off-by: Daniel Borkmann +Acked-by: Magnus Karlsson +Link: https://lore.kernel.org/bpf/e82f4697438cd63edbf271ebe1918db8261b7c09.1606555939.git.xuanzhuo@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + net/xdp/xsk.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c +index 04652797cd374..2bc0d6e3e124c 100644 +--- a/net/xdp/xsk.c ++++ b/net/xdp/xsk.c +@@ -429,11 +429,13 @@ static int xsk_sendmsg(struct socket *sock, struct msghdr *m, size_t total_len) + static __poll_t xsk_poll(struct file *file, struct socket *sock, + struct poll_table_struct *wait) + { +- __poll_t mask = datagram_poll(file, sock, wait); ++ __poll_t mask = 0; + struct sock *sk = sock->sk; + struct xdp_sock *xs = xdp_sk(sk); + struct xdp_umem *umem; + ++ sock_poll_wait(file, sock, wait); ++ + if (unlikely(!xsk_is_bound(xs))) + return mask; + +-- +2.27.0 + -- 2.47.3