From 62d14d4b6158d42244c7ac6d4b773ec91f5ca2fc Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 8 Aug 2021 17:30:45 -0400 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...o-fix-incorrect-clock-source-setting.patch | 62 +++++ ...dts-am437x-l4-fix-typo-in-can-0-node.patch | 35 +++ ...ri-imx6ull-limit-sdio-clock-to-25mhz.patch | 39 +++ ...-m53menlo-pinctrl_power_button-pinct.patch | 50 ++++ ...sr-som-increase-the-phy-reset-durati.patch | 57 ++++ ...-stm32-disable-lan8710-edpd-on-dhcom.patch | 47 ++++ ...x-touchscreen-irq-line-assignment-on.patch | 103 ++++++++ ...mx-add-missing-clk_disable_unprepare.patch | 75 ++++++ queue-5.10/arm-imx-add-missing-iounmap.patch | 53 ++++ ...ing-3rd-argument-in-macro-imx_mmdc_p.patch | 38 +++ ...-3720-turris-mox-fixed-indices-for-t.patch | 43 +++ ...-3720-turris-mox-remove-mrvl-i2c-fas.patch | 44 ++++ ...28-sl28-fix-networking-for-variant-2.patch | 46 ++++ ...ls1028a-fix-node-name-for-the-sysclk.patch | 57 ++++ ...ror-out-if-blk_get_queue-failed-in-i.patch | 47 ++++ ...cleanup-of-resources-in-hci_unregist.patch | 244 ++++++++++++++++++ ...-fix-an-error-code-in-bnx2x_nic_load.patch | 37 +++ ...gpt12-system-timer-issue-with-reserv.patch | 87 +++++++ ...-post-divisor-setup-for-i2s-sai-plls.patch | 88 +++++++ ...ent-disable_unused-of-tegra_clk_sdmm.patch | 55 ++++ ...a-configure-the-generic-dma-type-to-.patch | 44 ++++ ...dma-fix-pm-usage-counter-imbalance-i.patch | 50 ++++ ...dmamux-fix-pm-usage-counter-unbalanc.patch | 59 +++++ ...er-xdmac-use-readl_poll_timeout_atom.patch | 42 +++ ...gpio-tqmx86-really-make-irq-optional.patch | 52 ++++ ...core-dequeue-if-start_streaming-fail.patch | 71 +++++ ...eturn-value-of-pgtable_pmd_page_ctor.patch | 60 +++++ queue-5.10/mips-fix-non-posix-regexp.patch | 57 ++++ ...a-ar9331-reorder-mdio-write-sequence.patch | 67 +++++ ...be-stateless-with-fdb-entries-on-sja.patch | 92 +++++++ ...invalidate-dynamic-fdb-entries-learn.patch | 141 ++++++++++ ...match-fdb-entries-regardless-of-inne.patch | 74 ++++++ ...overwrite-dynamic-fdb-entries-with-s.patch | 86 ++++++ ...fix-use-after-free-in-fec_drv_remove.patch | 50 ++++ ...r-transport-header-offset-in-tcp-udp.patch | 145 +++++++++++ ...urned-variable-type-in-ip6_skb_dst_m.patch | 40 +++ ...missing-pci_disable_device-in-probe-.patch | 65 +++++ ...uninit-value-in-get_interrupt_interv.patch | 96 +++++++ ...crel-fix-detection-of-ksz87xx-switch.patch | 84 ++++++ ...ckdep_set_class-typo-error-for-sch-s.patch | 41 +++ ...-after-free-in-vxge_device_unregiste.patch | 53 ++++ ...fix-memory-leak-in-xfrm_user_rcv_msg.patch | 50 ++++ ...tool-reporting-of-pauseframe-control.patch | 39 +++ ...on-remove-not-physically-existing-vd.patch | 80 ++++++ ...emptying-a-cache-entry-when-a-new-mr.patch | 44 ++++ ...orrect-event-when-media-event-code-i.patch | 46 ++++ ...tive_key-update-after-sh_keys-is-add.patch | 68 +++++ queue-5.10/series | 49 ++++ ...pi-fix-low-speed-configreg-delay-cal.patch | 74 ++++++ ...pi-reinstate-low-speed-configreg-del.patch | 107 ++++++++ 50 files changed, 3333 insertions(+) create mode 100644 queue-5.10/alsa-usb-audio-fix-incorrect-clock-source-setting.patch create mode 100644 queue-5.10/arm-dts-am437x-l4-fix-typo-in-can-0-node.patch create mode 100644 queue-5.10/arm-dts-colibri-imx6ull-limit-sdio-clock-to-25mhz.patch create mode 100644 queue-5.10/arm-dts-imx-swap-m53menlo-pinctrl_power_button-pinct.patch create mode 100644 queue-5.10/arm-dts-imx6qdl-sr-som-increase-the-phy-reset-durati.patch create mode 100644 queue-5.10/arm-dts-stm32-disable-lan8710-edpd-on-dhcom.patch create mode 100644 queue-5.10/arm-dts-stm32-fix-touchscreen-irq-line-assignment-on.patch create mode 100644 queue-5.10/arm-imx-add-missing-clk_disable_unprepare.patch create mode 100644 queue-5.10/arm-imx-add-missing-iounmap.patch create mode 100644 queue-5.10/arm-imx-fix-missing-3rd-argument-in-macro-imx_mmdc_p.patch create mode 100644 queue-5.10/arm64-dts-armada-3720-turris-mox-fixed-indices-for-t.patch create mode 100644 queue-5.10/arm64-dts-armada-3720-turris-mox-remove-mrvl-i2c-fas.patch create mode 100644 queue-5.10/arm64-dts-ls1028-sl28-fix-networking-for-variant-2.patch create mode 100644 queue-5.10/arm64-dts-ls1028a-fix-node-name-for-the-sysclk.patch create mode 100644 queue-5.10/blk-iolatency-error-out-if-blk_get_queue-failed-in-i.patch create mode 100644 queue-5.10/bluetooth-defer-cleanup-of-resources-in-hci_unregist.patch create mode 100644 queue-5.10/bnx2x-fix-an-error-code-in-bnx2x_nic_load.patch create mode 100644 queue-5.10/bus-ti-sysc-fix-gpt12-system-timer-issue-with-reserv.patch create mode 100644 queue-5.10/clk-stm32f4-fix-post-divisor-setup-for-i2s-sai-plls.patch create mode 100644 queue-5.10/clk-tegra-implement-disable_unused-of-tegra_clk_sdmm.patch create mode 100644 queue-5.10/dmaengine-imx-dma-configure-the-generic-dma-type-to-.patch create mode 100644 queue-5.10/dmaengine-stm32-dma-fix-pm-usage-counter-imbalance-i.patch create mode 100644 queue-5.10/dmaengine-stm32-dmamux-fix-pm-usage-counter-unbalanc.patch create mode 100644 queue-5.10/dmaengine-uniphier-xdmac-use-readl_poll_timeout_atom.patch create mode 100644 queue-5.10/gpio-tqmx86-really-make-irq-optional.patch create mode 100644 queue-5.10/media-videobuf2-core-dequeue-if-start_streaming-fail.patch create mode 100644 queue-5.10/mips-check-return-value-of-pgtable_pmd_page_ctor.patch create mode 100644 queue-5.10/mips-fix-non-posix-regexp.patch create mode 100644 queue-5.10/net-dsa-qca-ar9331-reorder-mdio-write-sequence.patch create mode 100644 queue-5.10/net-dsa-sja1105-be-stateless-with-fdb-entries-on-sja.patch create mode 100644 queue-5.10/net-dsa-sja1105-invalidate-dynamic-fdb-entries-learn.patch create mode 100644 queue-5.10/net-dsa-sja1105-match-fdb-entries-regardless-of-inne.patch create mode 100644 queue-5.10/net-dsa-sja1105-overwrite-dynamic-fdb-entries-with-s.patch create mode 100644 queue-5.10/net-fec-fix-use-after-free-in-fec_drv_remove.patch create mode 100644 queue-5.10/net-gro-set-inner-transport-header-offset-in-tcp-udp.patch create mode 100644 queue-5.10/net-ipv6-fix-returned-variable-type-in-ip6_skb_dst_m.patch create mode 100644 queue-5.10/net-natsemi-fix-missing-pci_disable_device-in-probe-.patch create mode 100644 queue-5.10/net-pegasus-fix-uninit-value-in-get_interrupt_interv.patch create mode 100644 queue-5.10/net-phy-micrel-fix-detection-of-ksz87xx-switch.patch create mode 100644 queue-5.10/net-sched-fix-lockdep_set_class-typo-error-for-sch-s.patch create mode 100644 queue-5.10/net-vxge-fix-use-after-free-in-vxge_device_unregiste.patch create mode 100644 queue-5.10/net-xfrm-fix-memory-leak-in-xfrm_user_rcv_msg.patch create mode 100644 queue-5.10/nfp-update-ethtool-reporting-of-pauseframe-control.patch create mode 100644 queue-5.10/omap5-board-common-remove-not-physically-existing-vd.patch create mode 100644 queue-5.10/rdma-mlx5-delay-emptying-a-cache-entry-when-a-new-mr.patch create mode 100644 queue-5.10/scsi-sr-return-correct-event-when-media-event-code-i.patch create mode 100644 queue-5.10/sctp-move-the-active_key-update-after-sh_keys-is-add.patch create mode 100644 queue-5.10/series create mode 100644 queue-5.10/spi-imx-mx51-ecspi-fix-low-speed-configreg-delay-cal.patch create mode 100644 queue-5.10/spi-imx-mx51-ecspi-reinstate-low-speed-configreg-del.patch diff --git a/queue-5.10/alsa-usb-audio-fix-incorrect-clock-source-setting.patch b/queue-5.10/alsa-usb-audio-fix-incorrect-clock-source-setting.patch new file mode 100644 index 00000000000..7a1a183fb17 --- /dev/null +++ b/queue-5.10/alsa-usb-audio-fix-incorrect-clock-source-setting.patch @@ -0,0 +1,62 @@ +From da0f647ebed923dc80540d2b720b5daac022583d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Jul 2021 12:23:41 +0800 +Subject: ALSA: usb-audio: fix incorrect clock source setting + +From: chihhao.chen + +[ Upstream commit 4511781f95da0a3b2bad34f3f5e3967e80cd2d18 ] + +The following scenario describes an echo test for +Samsung USBC Headset (AKG) with VID/PID (0x04e8/0xa051). + +We first start a capture stream(USB IN transfer) in 96Khz/24bit/1ch mode. +In clock find source function, we get value 0x2 for clock selector +and 0x1 for clock source. + +Kernel-4.14 behavior +Since clock source is valid so clock selector was not set again. +We pass through this function and start a playback stream(USB OUT transfer) +in 48Khz/32bit/2ch mode. This time we get value 0x1 for clock selector +and 0x1 for clock source. Finally clock id with this setting is 0x9. + +Kernel-5.10 behavior +Clock selector was always set one more time even it is valid. +When we start a playback stream, we will get 0x2 for clock selector +and 0x1 for clock source. In this case clock id becomes 0xA. +This is an incorrect clock source setting and results in severe noises. +We see wrong data rate in USB IN transfer. +(From 288 bytes/ms becomes 144 bytes/ms) It should keep in 288 bytes/ms. + +This earphone works fine on older kernel version load because +this is a newly-added behavior. + +Fixes: d2e8f641257d ("ALSA: usb-audio: Explicitly set up the clock selector") +Signed-off-by: chihhao.chen +Link: https://lore.kernel.org/r/1627100621-19225-1-git-send-email-chihhao.chen@mediatek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/clock.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/sound/usb/clock.c b/sound/usb/clock.c +index e3d97e5112fd..514d18a3e07a 100644 +--- a/sound/usb/clock.c ++++ b/sound/usb/clock.c +@@ -319,6 +319,12 @@ static int __uac_clock_find_source(struct snd_usb_audio *chip, + selector->baCSourceID[ret - 1], + visited, validate); + if (ret > 0) { ++ /* ++ * For Samsung USBC Headset (AKG), setting clock selector again ++ * will result in incorrect default clock setting problems ++ */ ++ if (chip->usb_id == USB_ID(0x04e8, 0xa051)) ++ return ret; + err = uac_clock_selector_set_val(chip, entity_id, cur); + if (err < 0) + return err; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-am437x-l4-fix-typo-in-can-0-node.patch b/queue-5.10/arm-dts-am437x-l4-fix-typo-in-can-0-node.patch new file mode 100644 index 00000000000..fc13aac9253 --- /dev/null +++ b/queue-5.10/arm-dts-am437x-l4-fix-typo-in-can-0-node.patch @@ -0,0 +1,35 @@ +From 74074cea0c57f688c6ff1e443a687781a485cec8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jul 2021 15:15:25 +0200 +Subject: ARM: dts: am437x-l4: fix typo in can@0 node + +From: Dario Binacchi + +[ Upstream commit 0162a9964365fd26e34575e121b17d021204c481 ] + +Replace clock-name with clock-names. + +Fixes: 2a4117df9b43 ("ARM: dts: Fix dcan driver probe failed on am437x platform") +Signed-off-by: Dario Binacchi +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am437x-l4.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/am437x-l4.dtsi b/arch/arm/boot/dts/am437x-l4.dtsi +index 370c4e64676f..86bf668f3848 100644 +--- a/arch/arm/boot/dts/am437x-l4.dtsi ++++ b/arch/arm/boot/dts/am437x-l4.dtsi +@@ -1576,7 +1576,7 @@ + compatible = "ti,am4372-d_can", "ti,am3352-d_can"; + reg = <0x0 0x2000>; + clocks = <&dcan1_fck>; +- clock-name = "fck"; ++ clock-names = "fck"; + syscon-raminit = <&scm_conf 0x644 1>; + interrupts = ; + status = "disabled"; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-colibri-imx6ull-limit-sdio-clock-to-25mhz.patch b/queue-5.10/arm-dts-colibri-imx6ull-limit-sdio-clock-to-25mhz.patch new file mode 100644 index 00000000000..58a96b851c8 --- /dev/null +++ b/queue-5.10/arm-dts-colibri-imx6ull-limit-sdio-clock-to-25mhz.patch @@ -0,0 +1,39 @@ +From 49192e7f90648c887c8cf6e838206ef5800b41b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jul 2021 23:21:07 +0300 +Subject: ARM: dts: colibri-imx6ull: limit SDIO clock to 25MHz + +From: Oleksandr Suvorov + +[ Upstream commit 828db68f4ff1ab6982a36a56522b585160dc8c8e ] + +NXP and AzureWave don't recommend using SDIO bus mode 3.3V@50MHz due +to noise affecting the wireless throughput. Colibri iMX6ULL uses only +3.3V signaling for Wi-Fi module AW-CM276NF. + +Limit the SDIO Clock on Colibri iMX6ULL to 25MHz. + +Fixes: c2e4987e0e02 ("ARM: dts: imx6ull: add Toradex Colibri iMX6ULL support") +Signed-off-by: Oleksandr Suvorov +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi +index a0545431b3dc..9f1e38282bee 100644 +--- a/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi ++++ b/arch/arm/boot/dts/imx6ull-colibri-wifi.dtsi +@@ -43,6 +43,7 @@ + assigned-clock-rates = <0>, <198000000>; + cap-power-off-card; + keep-power-in-suspend; ++ max-frequency = <25000000>; + mmc-pwrseq = <&wifi_pwrseq>; + no-1-8-v; + non-removable; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-imx-swap-m53menlo-pinctrl_power_button-pinct.patch b/queue-5.10/arm-dts-imx-swap-m53menlo-pinctrl_power_button-pinct.patch new file mode 100644 index 00000000000..ec4c1d3de2c --- /dev/null +++ b/queue-5.10/arm-dts-imx-swap-m53menlo-pinctrl_power_button-pinct.patch @@ -0,0 +1,50 @@ +From f8380809692b6ef2a50b1b9d5016d18dbe75e747 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Jul 2021 23:43:02 +0200 +Subject: ARM: dts: imx: Swap M53Menlo pinctrl_power_button/pinctrl_power_out + pins + +From: Marek Vasut + +[ Upstream commit 3d9e30a52047f2d464efdfd1d561ae1f707a0286 ] + +The pinctrl_power_button/pinctrl_power_out each define single GPIO +pinmux, except it is exactly the other one than the matching gpio-keys +and gpio-poweroff DT nodes use for that functionality. Swap the two +GPIOs to correct this error. + +Fixes: 50d29fdb765d ("ARM: dts: imx53: Add power GPIOs on M53Menlo") +Signed-off-by: Marek Vasut +Cc: Shawn Guo +Cc: Fabio Estevam +Cc: NXP Linux Team +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx53-m53menlo.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts +index f98691ae4415..d3082b9774e4 100644 +--- a/arch/arm/boot/dts/imx53-m53menlo.dts ++++ b/arch/arm/boot/dts/imx53-m53menlo.dts +@@ -388,13 +388,13 @@ + + pinctrl_power_button: powerbutgrp { + fsl,pins = < +- MX53_PAD_SD2_DATA2__GPIO1_13 0x1e4 ++ MX53_PAD_SD2_DATA0__GPIO1_15 0x1e4 + >; + }; + + pinctrl_power_out: poweroutgrp { + fsl,pins = < +- MX53_PAD_SD2_DATA0__GPIO1_15 0x1e4 ++ MX53_PAD_SD2_DATA2__GPIO1_13 0x1e4 + >; + }; + +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-imx6qdl-sr-som-increase-the-phy-reset-durati.patch b/queue-5.10/arm-dts-imx6qdl-sr-som-increase-the-phy-reset-durati.patch new file mode 100644 index 00000000000..5b002657b36 --- /dev/null +++ b/queue-5.10/arm-dts-imx6qdl-sr-som-increase-the-phy-reset-durati.patch @@ -0,0 +1,57 @@ +From 65204122c0e44dbf9f6d3e3a169b67875beec538 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 14:13:53 +0200 +Subject: ARM: dts: imx6qdl-sr-som: Increase the PHY reset duration to 10ms +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maxime Chevallier + +[ Upstream commit fd8e83884fdd7b5fc411f201a58d8d01890198a2 ] + +The AR803x PHY used on this modules seems to require the reset line to +be asserted for around 10ms in order to avoid rare cases where the PHY +gets stuck in an incoherent state that prevents it to function +correctly. + +The previous value of 2ms was found to be problematic on some setups, +causing intermittent issues where the PHY would be unresponsive +every once in a while on some sytems, with a low occurrence (it typically +took around 30 consecutive reboots to encounter the issue). + +Bumping the delay to the 10ms makes the issue dissapear, with more than +2500 consecutive reboots performed without the issue showing-up. + +Fixes: 208d7baf8085 ("ARM: imx: initial SolidRun HummingBoard support") +Signed-off-by: Maxime Chevallier +Tested-by: Hervé Codina +Reviewed-by: Russell King (Oracle) +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-sr-som.dtsi | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-sr-som.dtsi b/arch/arm/boot/dts/imx6qdl-sr-som.dtsi +index 7e4e5fd0143a..c56337b63c3b 100644 +--- a/arch/arm/boot/dts/imx6qdl-sr-som.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-sr-som.dtsi +@@ -54,7 +54,13 @@ + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_microsom_enet_ar8035>; + phy-mode = "rgmii-id"; +- phy-reset-duration = <2>; ++ ++ /* ++ * The PHY seems to require a long-enough reset duration to avoid ++ * some rare issues where the PHY gets stuck in an inconsistent and ++ * non-functional state at boot-up. 10ms proved to be fine . ++ */ ++ phy-reset-duration = <10>; + phy-reset-gpios = <&gpio4 15 GPIO_ACTIVE_LOW>; + status = "okay"; + +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-stm32-disable-lan8710-edpd-on-dhcom.patch b/queue-5.10/arm-dts-stm32-disable-lan8710-edpd-on-dhcom.patch new file mode 100644 index 00000000000..9b3aa123e67 --- /dev/null +++ b/queue-5.10/arm-dts-stm32-disable-lan8710-edpd-on-dhcom.patch @@ -0,0 +1,47 @@ +From 1719963e9658bd7bb56f102cf764172af7765870 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 20:12:53 +0200 +Subject: ARM: dts: stm32: Disable LAN8710 EDPD on DHCOM + +From: Marek Vasut + +[ Upstream commit 36862c1ebc92a7e6fcc55002965c44b8ad17d4ca ] + +The LAN8710 Energy Detect Power Down (EDPD) functionality might cause +unreliable cable detection. There are multiple accounts of this in the +SMSC PHY driver patches which attempted to make EDPD reliable, however +it seems there is always some sort of corner case left. Unfortunatelly, +there is no errata documented which would confirm this to be a silicon +bug on the LAN87xx series of PHYs (LAN8700, LAN8710, LAN8720 at least). + +Disable EDPD on the DHCOM SoM, just like multiple other boards already +do as well, to make the cable detection reliable. + +Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +index 8221bf69fefe..000af7177701 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +@@ -133,6 +133,7 @@ + reset-gpios = <&gpioh 3 GPIO_ACTIVE_LOW>; + reset-assert-us = <500>; + reset-deassert-us = <500>; ++ smsc,disable-energy-detect; + interrupt-parent = <&gpioi>; + interrupts = <11 IRQ_TYPE_LEVEL_LOW>; + }; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-stm32-fix-touchscreen-irq-line-assignment-on.patch b/queue-5.10/arm-dts-stm32-fix-touchscreen-irq-line-assignment-on.patch new file mode 100644 index 00000000000..3480bea8592 --- /dev/null +++ b/queue-5.10/arm-dts-stm32-fix-touchscreen-irq-line-assignment-on.patch @@ -0,0 +1,103 @@ +From a0c939919555fdd0a23a9d2a3783e6b01688d027 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 20:10:40 +0200 +Subject: ARM: dts: stm32: Fix touchscreen IRQ line assignment on DHCOM + +From: Marek Vasut + +[ Upstream commit 15f68f027ebd961b99a1c420f96ff3838c5e4450 ] + +While 7e5f3155dcbb4 ("ARM: dts: stm32: Fix LED5 on STM32MP1 DHCOM PDK2") +fixed the LED0 assignment on the PDK2 board, the same commit did not +update the touchscreen IRQ line assignment, which is the same GPIO line, +shared between the LED0 output and touchscreen IRQ input. To make this +more convoluted, the same EXTI input (not the same GPIO line) is shared +between Button B which is Active-Low IRQ, and touchscreen IRQ which is +Edge-Falling IRQ, which cannot be used at the same time. In case the LCD +board with touchscreen is in use, which is the case here, LED0 must be +disabled, Button B must be polled, so the touchscreen interrupt works as +it should. + +Update the touchscreen IRQ line assignment, disable LED0 and use polled +GPIO button driver for Button B, since the DT here describes baseboard +with LCD board. + +Fixes: 7e5f3155dcbb4 ("ARM: dts: stm32: Fix LED5 on STM32MP1 DHCOM PDK2") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 24 +++++++++++-------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +index 59b3239bcd76..633079245601 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +@@ -37,7 +37,7 @@ + poll-interval = <20>; + + /* +- * The EXTi IRQ line 3 is shared with touchscreen and ethernet, ++ * The EXTi IRQ line 3 is shared with ethernet, + * so mark this as polled GPIO key. + */ + button-0 { +@@ -46,6 +46,16 @@ + gpios = <&gpiof 3 GPIO_ACTIVE_LOW>; + }; + ++ /* ++ * The EXTi IRQ line 6 is shared with touchscreen, ++ * so mark this as polled GPIO key. ++ */ ++ button-1 { ++ label = "TA2-GPIO-B"; ++ linux,code = ; ++ gpios = <&gpiod 6 GPIO_ACTIVE_LOW>; ++ }; ++ + /* + * The EXTi IRQ line 0 is shared with PMIC, + * so mark this as polled GPIO key. +@@ -60,13 +70,6 @@ + gpio-keys { + compatible = "gpio-keys"; + +- button-1 { +- label = "TA2-GPIO-B"; +- linux,code = ; +- gpios = <&gpiod 6 GPIO_ACTIVE_LOW>; +- wakeup-source; +- }; +- + button-3 { + label = "TA4-GPIO-D"; + linux,code = ; +@@ -82,6 +85,7 @@ + label = "green:led5"; + gpios = <&gpioc 6 GPIO_ACTIVE_HIGH>; + default-state = "off"; ++ status = "disabled"; + }; + + led-1 { +@@ -185,8 +189,8 @@ + touchscreen@38 { + compatible = "edt,edt-ft5406"; + reg = <0x38>; +- interrupt-parent = <&gpiog>; +- interrupts = <2 IRQ_TYPE_EDGE_FALLING>; /* GPIO E */ ++ interrupt-parent = <&gpioc>; ++ interrupts = <6 IRQ_TYPE_EDGE_FALLING>; /* GPIO E */ + }; + }; + +-- +2.30.2 + diff --git a/queue-5.10/arm-imx-add-missing-clk_disable_unprepare.patch b/queue-5.10/arm-imx-add-missing-clk_disable_unprepare.patch new file mode 100644 index 00000000000..cd849faf2e5 --- /dev/null +++ b/queue-5.10/arm-imx-add-missing-clk_disable_unprepare.patch @@ -0,0 +1,75 @@ +From 3e53997b94776d67fecdda52866aac637225fe9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 20:52:39 +0800 +Subject: ARM: imx: add missing clk_disable_unprepare() + +From: Yang Yingliang + +[ Upstream commit f07ec85365807b3939f32d0094a6dd5ce065d1b9 ] + +clock source is prepared and enabled by clk_prepare_enable() +in probe function, but no disable or unprepare in remove and +error path. + +Fixes: 9454a0caff6a ("ARM: imx: add mmdc ipg clock operation for mmdc") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Reviewed-by: Dong Aisheng +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/mmdc.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c +index 8e57691aafe2..4a6f1359e1e9 100644 +--- a/arch/arm/mach-imx/mmdc.c ++++ b/arch/arm/mach-imx/mmdc.c +@@ -103,6 +103,7 @@ struct mmdc_pmu { + struct perf_event *mmdc_events[MMDC_NUM_COUNTERS]; + struct hlist_node node; + struct fsl_mmdc_devtype_data *devtype_data; ++ struct clk *mmdc_ipg_clk; + }; + + /* +@@ -463,11 +464,13 @@ static int imx_mmdc_remove(struct platform_device *pdev) + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + perf_pmu_unregister(&pmu_mmdc->pmu); + iounmap(pmu_mmdc->mmdc_base); ++ clk_disable_unprepare(pmu_mmdc->mmdc_ipg_clk); + kfree(pmu_mmdc); + return 0; + } + +-static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base) ++static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_base, ++ struct clk *mmdc_ipg_clk) + { + struct mmdc_pmu *pmu_mmdc; + char *name; +@@ -495,6 +498,7 @@ static int imx_mmdc_perf_init(struct platform_device *pdev, void __iomem *mmdc_b + } + + mmdc_num = mmdc_pmu_init(pmu_mmdc, mmdc_base, &pdev->dev); ++ pmu_mmdc->mmdc_ipg_clk = mmdc_ipg_clk; + if (mmdc_num == 0) + name = "mmdc"; + else +@@ -568,9 +572,11 @@ static int imx_mmdc_probe(struct platform_device *pdev) + val &= ~(1 << BP_MMDC_MAPSR_PSD); + writel_relaxed(val, reg); + +- err = imx_mmdc_perf_init(pdev, mmdc_base); +- if (err) ++ err = imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk); ++ if (err) { + iounmap(mmdc_base); ++ clk_disable_unprepare(mmdc_ipg_clk); ++ } + + return err; + } +-- +2.30.2 + diff --git a/queue-5.10/arm-imx-add-missing-iounmap.patch b/queue-5.10/arm-imx-add-missing-iounmap.patch new file mode 100644 index 00000000000..52067adcb1a --- /dev/null +++ b/queue-5.10/arm-imx-add-missing-iounmap.patch @@ -0,0 +1,53 @@ +From d60e8ef30792ea78c7ad85eddc5064c2fb1be52d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 20:52:38 +0800 +Subject: ARM: imx: add missing iounmap() + +From: Yang Yingliang + +[ Upstream commit f9613aa07f16d6042e74208d1b40a6104d72964a ] + +Commit e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver") +introduced imx_mmdc_remove(), the mmdc_base need be unmapped in it if +config PERF_EVENTS is enabled. + +If imx_mmdc_perf_init() fails, the mmdc_base also need be unmapped. + +Fixes: e76bdfd7403a ("ARM: imx: Added perf functionality to mmdc driver") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Reviewed-by: Dong Aisheng +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/mmdc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c +index 0dfd0ae7a63d..8e57691aafe2 100644 +--- a/arch/arm/mach-imx/mmdc.c ++++ b/arch/arm/mach-imx/mmdc.c +@@ -462,6 +462,7 @@ static int imx_mmdc_remove(struct platform_device *pdev) + + cpuhp_state_remove_instance_nocalls(cpuhp_mmdc_state, &pmu_mmdc->node); + perf_pmu_unregister(&pmu_mmdc->pmu); ++ iounmap(pmu_mmdc->mmdc_base); + kfree(pmu_mmdc); + return 0; + } +@@ -567,7 +568,11 @@ static int imx_mmdc_probe(struct platform_device *pdev) + val &= ~(1 << BP_MMDC_MAPSR_PSD); + writel_relaxed(val, reg); + +- return imx_mmdc_perf_init(pdev, mmdc_base); ++ err = imx_mmdc_perf_init(pdev, mmdc_base); ++ if (err) ++ iounmap(mmdc_base); ++ ++ return err; + } + + int imx_mmdc_get_ddr_type(void) +-- +2.30.2 + diff --git a/queue-5.10/arm-imx-fix-missing-3rd-argument-in-macro-imx_mmdc_p.patch b/queue-5.10/arm-imx-fix-missing-3rd-argument-in-macro-imx_mmdc_p.patch new file mode 100644 index 00000000000..26c8c55fa79 --- /dev/null +++ b/queue-5.10/arm-imx-fix-missing-3rd-argument-in-macro-imx_mmdc_p.patch @@ -0,0 +1,38 @@ +From d1ec213358f846dfe049530469c8d3ba40b002d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Jul 2021 14:23:21 +0100 +Subject: ARM: imx: fix missing 3rd argument in macro imx_mmdc_perf_init + +From: Colin Ian King + +[ Upstream commit 20fb73911fec01f06592de1cdbca00b66602ebd7 ] + +The function imx_mmdc_perf_init recently had a 3rd argument added to +it but the equivalent macro was not updated and is still the older +2 argument version. Fix this by adding in the missing 3rd argumement +mmdc_ipg_clk. + +Fixes: f07ec8536580 ("ARM: imx: add missing clk_disable_unprepare()") +Signed-off-by: Colin Ian King +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/mmdc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/mach-imx/mmdc.c b/arch/arm/mach-imx/mmdc.c +index 4a6f1359e1e9..af12668d0bf5 100644 +--- a/arch/arm/mach-imx/mmdc.c ++++ b/arch/arm/mach-imx/mmdc.c +@@ -534,7 +534,7 @@ pmu_free: + + #else + #define imx_mmdc_remove NULL +-#define imx_mmdc_perf_init(pdev, mmdc_base) 0 ++#define imx_mmdc_perf_init(pdev, mmdc_base, mmdc_ipg_clk) 0 + #endif + + static int imx_mmdc_probe(struct platform_device *pdev) +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-armada-3720-turris-mox-fixed-indices-for-t.patch b/queue-5.10/arm64-dts-armada-3720-turris-mox-fixed-indices-for-t.patch new file mode 100644 index 00000000000..05b46414448 --- /dev/null +++ b/queue-5.10/arm64-dts-armada-3720-turris-mox-fixed-indices-for-t.patch @@ -0,0 +1,43 @@ +From 2b09ef9a4c5632e0e637cf08010378a43674e4b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jul 2021 13:11:34 +0300 +Subject: arm64: dts: armada-3720-turris-mox: fixed indices for the SDHC + controllers + +From: Vladimir Oltean + +[ Upstream commit 923f98929182dfd04e9149be839160b63a3db145 ] + +Since drivers/mmc/host/sdhci-xenon.c declares the PROBE_PREFER_ASYNCHRONOUS +probe type, it is not guaranteed whether /dev/mmcblk0 will belong to +sdhci0 or sdhci1. In turn, this will break booting by: + +root=/dev/mmcblk0p1 + +Fix the issue by adding aliases so that the old MMC controller indices +are preserved. + +Fixes: 7320915c8861 ("mmc: Set PROBE_PREFER_ASYNCHRONOUS for drivers that existed in v4.14") +Signed-off-by: Vladimir Oltean +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +index 389aebdb35f1..2d51c6f3915d 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +@@ -19,6 +19,8 @@ + aliases { + spi0 = &spi0; + ethernet1 = ð1; ++ mmc0 = &sdhci0; ++ mmc1 = &sdhci1; + }; + + chosen { +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-armada-3720-turris-mox-remove-mrvl-i2c-fas.patch b/queue-5.10/arm64-dts-armada-3720-turris-mox-remove-mrvl-i2c-fas.patch new file mode 100644 index 00000000000..45a49957e34 --- /dev/null +++ b/queue-5.10/arm64-dts-armada-3720-turris-mox-remove-mrvl-i2c-fas.patch @@ -0,0 +1,44 @@ +From 50fc4edcd01400ef919fac8880ce6e02061feefe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 17:12:29 +0200 +Subject: arm64: dts: armada-3720-turris-mox: remove mrvl,i2c-fast-mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit ee7ab3f263f8131722cff3871b9618b1e7478f07 ] + +Some SFP modules are not detected when i2c-fast-mode is enabled even when +clock-frequency is already set to 100000. The I2C bus violates the timing +specifications when run in fast mode. So disable fast mode on Turris Mox. + +Same change was already applied for uDPU (also Armada 3720 board with SFP) +in commit fe3ec631a77d ("arm64: dts: uDPU: remove i2c-fast-mode"). + +Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox") +Signed-off-by: Pali Rohár +Reviewed-by: Marek Behún +Acked-by: Russell King (Oracle) +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +index 2d51c6f3915d..bbd34ae12a53 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +@@ -120,6 +120,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&i2c1_pins>; + clock-frequency = <100000>; ++ /delete-property/ mrvl,i2c-fast-mode; + status = "okay"; + + rtc@6f { +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-ls1028-sl28-fix-networking-for-variant-2.patch b/queue-5.10/arm64-dts-ls1028-sl28-fix-networking-for-variant-2.patch new file mode 100644 index 00000000000..09bb8258e9c --- /dev/null +++ b/queue-5.10/arm64-dts-ls1028-sl28-fix-networking-for-variant-2.patch @@ -0,0 +1,46 @@ +From 2f65aefed1dfa542de86fc2546333e78b576942c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jul 2021 21:49:14 +0200 +Subject: arm64: dts: ls1028: sl28: fix networking for variant 2 + +From: Michael Walle + +[ Upstream commit 29f6a20c21b5bdc7eb623a712bbf7b99612ee746 ] + +The PHY configuration for the variant 2 is still missing the flag for +in-band signalling between PHY and MAC. Both sides - MAC and PHY - have +to match the setting. For now, Linux only supports setting the MAC side +and thus it has to match the setting the bootloader is configuring. +Enable in-band signalling to make ethernet work. + +Fixes: ab43f0307449 ("arm64: dts: ls1028a: sl28: add support for variant 2") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts b/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts +index dd764b720fb0..f6a79c8080d1 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a-kontron-sl28-var2.dts +@@ -54,6 +54,7 @@ + + &mscc_felix_port0 { + label = "swp0"; ++ managed = "in-band-status"; + phy-handle = <&phy0>; + phy-mode = "sgmii"; + status = "okay"; +@@ -61,6 +62,7 @@ + + &mscc_felix_port1 { + label = "swp1"; ++ managed = "in-band-status"; + phy-handle = <&phy1>; + phy-mode = "sgmii"; + status = "okay"; +-- +2.30.2 + diff --git a/queue-5.10/arm64-dts-ls1028a-fix-node-name-for-the-sysclk.patch b/queue-5.10/arm64-dts-ls1028a-fix-node-name-for-the-sysclk.patch new file mode 100644 index 00000000000..3d61d74a6ff --- /dev/null +++ b/queue-5.10/arm64-dts-ls1028a-fix-node-name-for-the-sysclk.patch @@ -0,0 +1,57 @@ +From aa0d3b0b8af0c84689ac5d6ced5b7b463b887783 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 14:26:58 +0300 +Subject: arm64: dts: ls1028a: fix node name for the sysclk + +From: Vladimir Oltean + +[ Upstream commit 7e71b85473f863a29eb1c69265ef025389b4091d ] + +U-Boot attempts to fix up the "clock-frequency" property of the "/sysclk" node: +https://elixir.bootlin.com/u-boot/v2021.04/source/arch/arm/cpu/armv8/fsl-layerscape/fdt.c#L512 + +but fails to do so: + + ## Booting kernel from Legacy Image at a1000000 ... + Image Name: + Created: 2021-06-08 10:31:38 UTC + Image Type: AArch64 Linux Kernel Image (gzip compressed) + Data Size: 15431370 Bytes = 14.7 MiB + Load Address: 80080000 + Entry Point: 80080000 + Verifying Checksum ... OK + ## Flattened Device Tree blob at a0000000 + Booting using the fdt blob at 0xa0000000 + Uncompressing Kernel Image + Loading Device Tree to 00000000fbb19000, end 00000000fbb22717 ... OK + Unable to update property /sysclk:clock-frequency, err=FDT_ERR_NOTFOUND + + Starting kernel ... + +All Layerscape SoCs except LS1028A use "sysclk" as the node name, and +not "clock-sysclk". So change the node name of LS1028A accordingly. + +Fixes: 8897f3255c9c ("arm64: dts: Add support for NXP LS1028A SoC") +Signed-off-by: Vladimir Oltean +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index f3b58bb9b840..5f42904d53ab 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -69,7 +69,7 @@ + }; + }; + +- sysclk: clock-sysclk { ++ sysclk: sysclk { + compatible = "fixed-clock"; + #clock-cells = <0>; + clock-frequency = <100000000>; +-- +2.30.2 + diff --git a/queue-5.10/blk-iolatency-error-out-if-blk_get_queue-failed-in-i.patch b/queue-5.10/blk-iolatency-error-out-if-blk_get_queue-failed-in-i.patch new file mode 100644 index 00000000000..54eec8788b8 --- /dev/null +++ b/queue-5.10/blk-iolatency-error-out-if-blk_get_queue-failed-in-i.patch @@ -0,0 +1,47 @@ +From 0a7ecd3aa811d3b27401adf47ec60b18ad1d7ebf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 20:46:45 +0800 +Subject: blk-iolatency: error out if blk_get_queue() failed in + iolatency_set_limit() + +From: Yu Kuai + +[ Upstream commit 8d75d0eff6887bcac7225e12b9c75595e523d92d ] + +If queue is dying while iolatency_set_limit() is in progress, +blk_get_queue() won't increment the refcount of the queue. However, +blk_put_queue() will still decrement the refcount later, which will +cause the refcout to be unbalanced. + +Thus error out in such case to fix the problem. + +Fixes: 8c772a9bfc7c ("blk-iolatency: fix IO hang due to negative inflight counter") +Signed-off-by: Yu Kuai +Acked-by: Tejun Heo +Link: https://lore.kernel.org/r/20210805124645.543797-1-yukuai3@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-iolatency.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/block/blk-iolatency.c b/block/blk-iolatency.c +index 81be0096411d..d8b0d8bd132b 100644 +--- a/block/blk-iolatency.c ++++ b/block/blk-iolatency.c +@@ -833,7 +833,11 @@ static ssize_t iolatency_set_limit(struct kernfs_open_file *of, char *buf, + + enable = iolatency_set_min_lat_nsec(blkg, lat_val); + if (enable) { +- WARN_ON_ONCE(!blk_get_queue(blkg->q)); ++ if (!blk_get_queue(blkg->q)) { ++ ret = -ENODEV; ++ goto out; ++ } ++ + blkg_get(blkg); + } + +-- +2.30.2 + diff --git a/queue-5.10/bluetooth-defer-cleanup-of-resources-in-hci_unregist.patch b/queue-5.10/bluetooth-defer-cleanup-of-resources-in-hci_unregist.patch new file mode 100644 index 00000000000..4dce35d3343 --- /dev/null +++ b/queue-5.10/bluetooth-defer-cleanup-of-resources-in-hci_unregist.patch @@ -0,0 +1,244 @@ +From 61f6df0be991e7357dafc0f22a162d7116977db4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 19:26:56 +0900 +Subject: Bluetooth: defer cleanup of resources in hci_unregister_dev() + +From: Tetsuo Handa + +[ Upstream commit e04480920d1eec9c061841399aa6f35b6f987d8b ] + +syzbot is hitting might_sleep() warning at hci_sock_dev_event() due to +calling lock_sock() with rw spinlock held [1]. + +It seems that history of this locking problem is a trial and error. + +Commit b40df5743ee8 ("[PATCH] bluetooth: fix socket locking in +hci_sock_dev_event()") in 2.6.21-rc4 changed bh_lock_sock() to +lock_sock() as an attempt to fix lockdep warning. + +Then, commit 4ce61d1c7a8e ("[BLUETOOTH]: Fix locking in +hci_sock_dev_event().") in 2.6.22-rc2 changed lock_sock() to +local_bh_disable() + bh_lock_sock_nested() as an attempt to fix the +sleep in atomic context warning. + +Then, commit 4b5dd696f81b ("Bluetooth: Remove local_bh_disable() from +hci_sock.c") in 3.3-rc1 removed local_bh_disable(). + +Then, commit e305509e678b ("Bluetooth: use correct lock to prevent UAF +of hdev object") in 5.13-rc5 again changed bh_lock_sock_nested() to +lock_sock() as an attempt to fix CVE-2021-3573. + +This difficulty comes from current implementation that +hci_sock_dev_event(HCI_DEV_UNREG) is responsible for dropping all +references from sockets because hci_unregister_dev() immediately +reclaims resources as soon as returning from +hci_sock_dev_event(HCI_DEV_UNREG). + +But the history suggests that hci_sock_dev_event(HCI_DEV_UNREG) was not +doing what it should do. + +Therefore, instead of trying to detach sockets from device, let's accept +not detaching sockets from device at hci_sock_dev_event(HCI_DEV_UNREG), +by moving actual cleanup of resources from hci_unregister_dev() to +hci_cleanup_dev() which is called by bt_host_release() when all +references to this unregistered device (which is a kobject) are gone. + +Since hci_sock_dev_event(HCI_DEV_UNREG) no longer resets +hci_pi(sk)->hdev, we need to check whether this device was unregistered +and return an error based on HCI_UNREGISTER flag. There might be subtle +behavioral difference in "monitor the hdev" functionality; please report +if you found something went wrong due to this patch. + +Link: https://syzkaller.appspot.com/bug?extid=a5df189917e79d5e59c9 [1] +Reported-by: syzbot +Suggested-by: Linus Torvalds +Signed-off-by: Tetsuo Handa +Fixes: e305509e678b ("Bluetooth: use correct lock to prevent UAF of hdev object") +Acked-by: Luiz Augusto von Dentz +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci_core.h | 1 + + net/bluetooth/hci_core.c | 16 +++++------ + net/bluetooth/hci_sock.c | 49 +++++++++++++++++++++----------- + net/bluetooth/hci_sysfs.c | 3 ++ + 4 files changed, 45 insertions(+), 24 deletions(-) + +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index e534dff2874e..a592a826e2fb 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -1189,6 +1189,7 @@ struct hci_dev *hci_alloc_dev(void); + void hci_free_dev(struct hci_dev *hdev); + int hci_register_dev(struct hci_dev *hdev); + void hci_unregister_dev(struct hci_dev *hdev); ++void hci_cleanup_dev(struct hci_dev *hdev); + int hci_suspend_dev(struct hci_dev *hdev); + int hci_resume_dev(struct hci_dev *hdev); + int hci_reset_dev(struct hci_dev *hdev); +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 86ebfc6ae698..65d3f5409963 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3816,14 +3816,10 @@ EXPORT_SYMBOL(hci_register_dev); + /* Unregister HCI device */ + void hci_unregister_dev(struct hci_dev *hdev) + { +- int id; +- + BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); + + hci_dev_set_flag(hdev, HCI_UNREGISTER); + +- id = hdev->id; +- + write_lock(&hci_dev_list_lock); + list_del(&hdev->list); + write_unlock(&hci_dev_list_lock); +@@ -3858,7 +3854,14 @@ void hci_unregister_dev(struct hci_dev *hdev) + } + + device_del(&hdev->dev); ++ /* Actual cleanup is deferred until hci_cleanup_dev(). */ ++ hci_dev_put(hdev); ++} ++EXPORT_SYMBOL(hci_unregister_dev); + ++/* Cleanup HCI device */ ++void hci_cleanup_dev(struct hci_dev *hdev) ++{ + debugfs_remove_recursive(hdev->debugfs); + kfree_const(hdev->hw_info); + kfree_const(hdev->fw_info); +@@ -3883,11 +3886,8 @@ void hci_unregister_dev(struct hci_dev *hdev) + hci_blocked_keys_clear(hdev); + hci_dev_unlock(hdev); + +- hci_dev_put(hdev); +- +- ida_simple_remove(&hci_index_ida, id); ++ ida_simple_remove(&hci_index_ida, hdev->id); + } +-EXPORT_SYMBOL(hci_unregister_dev); + + /* Suspend HCI device */ + int hci_suspend_dev(struct hci_dev *hdev) +diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c +index eed0dd066e12..53f85d7c5f9e 100644 +--- a/net/bluetooth/hci_sock.c ++++ b/net/bluetooth/hci_sock.c +@@ -59,6 +59,17 @@ struct hci_pinfo { + char comm[TASK_COMM_LEN]; + }; + ++static struct hci_dev *hci_hdev_from_sock(struct sock *sk) ++{ ++ struct hci_dev *hdev = hci_pi(sk)->hdev; ++ ++ if (!hdev) ++ return ERR_PTR(-EBADFD); ++ if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) ++ return ERR_PTR(-EPIPE); ++ return hdev; ++} ++ + void hci_sock_set_flag(struct sock *sk, int nr) + { + set_bit(nr, &hci_pi(sk)->flags); +@@ -759,19 +770,13 @@ void hci_sock_dev_event(struct hci_dev *hdev, int event) + if (event == HCI_DEV_UNREG) { + struct sock *sk; + +- /* Detach sockets from device */ ++ /* Wake up sockets using this dead device */ + read_lock(&hci_sk_list.lock); + sk_for_each(sk, &hci_sk_list.head) { +- lock_sock(sk); + if (hci_pi(sk)->hdev == hdev) { +- hci_pi(sk)->hdev = NULL; + sk->sk_err = EPIPE; +- sk->sk_state = BT_OPEN; + sk->sk_state_change(sk); +- +- hci_dev_put(hdev); + } +- release_sock(sk); + } + read_unlock(&hci_sk_list.lock); + } +@@ -930,10 +935,10 @@ static int hci_sock_blacklist_del(struct hci_dev *hdev, void __user *arg) + static int hci_sock_bound_ioctl(struct sock *sk, unsigned int cmd, + unsigned long arg) + { +- struct hci_dev *hdev = hci_pi(sk)->hdev; ++ struct hci_dev *hdev = hci_hdev_from_sock(sk); + +- if (!hdev) +- return -EBADFD; ++ if (IS_ERR(hdev)) ++ return PTR_ERR(hdev); + + if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) + return -EBUSY; +@@ -1103,6 +1108,18 @@ static int hci_sock_bind(struct socket *sock, struct sockaddr *addr, + + lock_sock(sk); + ++ /* Allow detaching from dead device and attaching to alive device, if ++ * the caller wants to re-bind (instead of close) this socket in ++ * response to hci_sock_dev_event(HCI_DEV_UNREG) notification. ++ */ ++ hdev = hci_pi(sk)->hdev; ++ if (hdev && hci_dev_test_flag(hdev, HCI_UNREGISTER)) { ++ hci_pi(sk)->hdev = NULL; ++ sk->sk_state = BT_OPEN; ++ hci_dev_put(hdev); ++ } ++ hdev = NULL; ++ + if (sk->sk_state == BT_BOUND) { + err = -EALREADY; + goto done; +@@ -1379,9 +1396,9 @@ static int hci_sock_getname(struct socket *sock, struct sockaddr *addr, + + lock_sock(sk); + +- hdev = hci_pi(sk)->hdev; +- if (!hdev) { +- err = -EBADFD; ++ hdev = hci_hdev_from_sock(sk); ++ if (IS_ERR(hdev)) { ++ err = PTR_ERR(hdev); + goto done; + } + +@@ -1743,9 +1760,9 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, + goto done; + } + +- hdev = hci_pi(sk)->hdev; +- if (!hdev) { +- err = -EBADFD; ++ hdev = hci_hdev_from_sock(sk); ++ if (IS_ERR(hdev)) { ++ err = PTR_ERR(hdev); + goto done; + } + +diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c +index 9874844a95a9..b69d88b88d2e 100644 +--- a/net/bluetooth/hci_sysfs.c ++++ b/net/bluetooth/hci_sysfs.c +@@ -83,6 +83,9 @@ void hci_conn_del_sysfs(struct hci_conn *conn) + static void bt_host_release(struct device *dev) + { + struct hci_dev *hdev = to_hci_dev(dev); ++ ++ if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) ++ hci_cleanup_dev(hdev); + kfree(hdev); + module_put(THIS_MODULE); + } +-- +2.30.2 + diff --git a/queue-5.10/bnx2x-fix-an-error-code-in-bnx2x_nic_load.patch b/queue-5.10/bnx2x-fix-an-error-code-in-bnx2x_nic_load.patch new file mode 100644 index 00000000000..af026f1c891 --- /dev/null +++ b/queue-5.10/bnx2x-fix-an-error-code-in-bnx2x_nic_load.patch @@ -0,0 +1,37 @@ +From 4f6196bf2f81db4935768e08b8010693d0d13003 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Aug 2021 13:38:26 +0300 +Subject: bnx2x: fix an error code in bnx2x_nic_load() + +From: Dan Carpenter + +[ Upstream commit fb653827c758725b149b5c924a5eb50ab4812750 ] + +Set the error code if bnx2x_alloc_fw_stats_mem() fails. The current +code returns success. + +Fixes: ad5afc89365e ("bnx2x: Separate VF and PF logic") +Signed-off-by: Dan Carpenter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 1a6ec1a12d53..b5d954cb409a 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -2669,7 +2669,8 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode) + } + + /* Allocated memory for FW statistics */ +- if (bnx2x_alloc_fw_stats_mem(bp)) ++ rc = bnx2x_alloc_fw_stats_mem(bp); ++ if (rc) + LOAD_ERROR_EXIT(bp, load_error0); + + /* request pf to initialize status blocks */ +-- +2.30.2 + diff --git a/queue-5.10/bus-ti-sysc-fix-gpt12-system-timer-issue-with-reserv.patch b/queue-5.10/bus-ti-sysc-fix-gpt12-system-timer-issue-with-reserv.patch new file mode 100644 index 00000000000..364a6aae0e1 --- /dev/null +++ b/queue-5.10/bus-ti-sysc-fix-gpt12-system-timer-issue-with-reserv.patch @@ -0,0 +1,87 @@ +From 6a8880e515f341a49bfa95cfd94a7503eb223147 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jun 2021 08:42:50 +0300 +Subject: bus: ti-sysc: Fix gpt12 system timer issue with reserved status + +From: Tony Lindgren + +[ Upstream commit 3ff340e24c9dd5cff9fc07d67914c5adf67f80d6 ] + +Jarkko Nikula reported that Beagleboard +revision c2 stopped booting. Jarkko bisected the issue down to +commit 6cfcd5563b4f ("clocksource/drivers/timer-ti-dm: Fix suspend +and resume for am3 and am4"). + +Let's fix the issue by tagging system timers as reserved rather than +ignoring them. And let's not probe any interconnect target module child +devices for reserved modules. + +This allows PM runtime to keep track of clocks and clockdomains for +the interconnect target module, and prevent the system timer from idling +as we already have SYSC_QUIRK_NO_IDLE and SYSC_QUIRK_NO_IDLE_ON_INIT +flags set for system timers. + +Fixes: 6cfcd5563b4f ("clocksource/drivers/timer-ti-dm: Fix suspend and resume for am3 and am4") +Reported-by: Jarkko Nikula +Tested-by: Jarkko Nikula +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + drivers/bus/ti-sysc.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c +index 818dc7f54f03..d3d31123a0a4 100644 +--- a/drivers/bus/ti-sysc.c ++++ b/drivers/bus/ti-sysc.c +@@ -100,6 +100,7 @@ static const char * const clock_names[SYSC_MAX_CLOCKS] = { + * @cookie: data used by legacy platform callbacks + * @name: name if available + * @revision: interconnect target module revision ++ * @reserved: target module is reserved and already in use + * @enabled: sysc runtime enabled status + * @needs_resume: runtime resume needed on resume from suspend + * @child_needs_resume: runtime resume needed for child on resume from suspend +@@ -130,6 +131,7 @@ struct sysc { + struct ti_sysc_cookie cookie; + const char *name; + u32 revision; ++ unsigned int reserved:1; + unsigned int enabled:1; + unsigned int needs_resume:1; + unsigned int child_needs_resume:1; +@@ -3057,8 +3059,8 @@ static int sysc_probe(struct platform_device *pdev) + return error; + + error = sysc_check_active_timer(ddata); +- if (error) +- return error; ++ if (error == -EBUSY) ++ ddata->reserved = true; + + error = sysc_get_clocks(ddata); + if (error) +@@ -3094,11 +3096,15 @@ static int sysc_probe(struct platform_device *pdev) + sysc_show_registers(ddata); + + ddata->dev->type = &sysc_device_type; +- error = of_platform_populate(ddata->dev->of_node, sysc_match_table, +- pdata ? pdata->auxdata : NULL, +- ddata->dev); +- if (error) +- goto err; ++ ++ if (!ddata->reserved) { ++ error = of_platform_populate(ddata->dev->of_node, ++ sysc_match_table, ++ pdata ? pdata->auxdata : NULL, ++ ddata->dev); ++ if (error) ++ goto err; ++ } + + INIT_DELAYED_WORK(&ddata->idle_work, ti_sysc_idle); + +-- +2.30.2 + diff --git a/queue-5.10/clk-stm32f4-fix-post-divisor-setup-for-i2s-sai-plls.patch b/queue-5.10/clk-stm32f4-fix-post-divisor-setup-for-i2s-sai-plls.patch new file mode 100644 index 00000000000..5b6b1d2090b --- /dev/null +++ b/queue-5.10/clk-stm32f4-fix-post-divisor-setup-for-i2s-sai-plls.patch @@ -0,0 +1,88 @@ +From ab245358d9db5b16c4202bf1805696173a8b3cb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jul 2021 18:07:25 +0200 +Subject: clk: stm32f4: fix post divisor setup for I2S/SAI PLLs + +From: Dario Binacchi + +[ Upstream commit 24b5b1978cd5a80db58e2a19db2f9c36fe8d4f7a ] + +Enabling the framebuffer leads to a system hang. Running, as a debug +hack, the store_pan() function in drivers/video/fbdev/core/fbsysfs.c +without taking the console_lock, allows to see the crash backtrace on +the serial line. + +~ # echo 0 0 > /sys/class/graphics/fb0/pan + +[ 9.719414] Unhandled exception: IPSR = 00000005 LR = fffffff1 +[ 9.726937] CPU: 0 PID: 49 Comm: sh Not tainted 5.13.0-rc5 #9 +[ 9.733008] Hardware name: STM32 (Device Tree Support) +[ 9.738296] PC is at clk_gate_is_enabled+0x0/0x28 +[ 9.743426] LR is at stm32f4_pll_div_set_rate+0xf/0x38 +[ 9.748857] pc : [<0011e4be>] lr : [<0011f9e3>] psr: 0100000b +[ 9.755373] sp : 00bc7be0 ip : 00000000 fp : 001f3ac4 +[ 9.760812] r10: 002610d0 r9 : 01efe920 r8 : 00540560 +[ 9.766269] r7 : 02e7ddb0 r6 : 0173eed8 r5 : 00000000 r4 : 004027c0 +[ 9.773081] r3 : 0011e4bf r2 : 02e7ddb0 r1 : 0173eed8 r0 : 1d3267b8 +[ 9.779911] xPSR: 0100000b +[ 9.782719] CPU: 0 PID: 49 Comm: sh Not tainted 5.13.0-rc5 #9 +[ 9.788791] Hardware name: STM32 (Device Tree Support) +[ 9.794120] [<0000afa1>] (unwind_backtrace) from [<0000a33f>] (show_stack+0xb/0xc) +[ 9.802421] [<0000a33f>] (show_stack) from [<0000a8df>] (__invalid_entry+0x4b/0x4c) + +The `pll_num' field in the post_div_data configuration contained a wrong +value which also referenced an uninitialized hardware clock when +clk_register_pll_div() was called. + +Fixes: 517633ef630e ("clk: stm32f4: Add post divisor for I2S & SAI PLLs") +Signed-off-by: Dario Binacchi +Reviewed-by: Gabriel Fernandez +Link: https://lore.kernel.org/r/20210725160725.10788-1-dariobin@libero.it +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-stm32f4.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/clk-stm32f4.c b/drivers/clk/clk-stm32f4.c +index 18117ce5ff85..5c75e3d906c2 100644 +--- a/drivers/clk/clk-stm32f4.c ++++ b/drivers/clk/clk-stm32f4.c +@@ -526,7 +526,7 @@ struct stm32f4_pll { + + struct stm32f4_pll_post_div_data { + int idx; +- u8 pll_num; ++ int pll_idx; + const char *name; + const char *parent; + u8 flag; +@@ -557,13 +557,13 @@ static const struct clk_div_table post_divr_table[] = { + + #define MAX_POST_DIV 3 + static const struct stm32f4_pll_post_div_data post_div_data[MAX_POST_DIV] = { +- { CLK_I2SQ_PDIV, PLL_I2S, "plli2s-q-div", "plli2s-q", ++ { CLK_I2SQ_PDIV, PLL_VCO_I2S, "plli2s-q-div", "plli2s-q", + CLK_SET_RATE_PARENT, STM32F4_RCC_DCKCFGR, 0, 5, 0, NULL}, + +- { CLK_SAIQ_PDIV, PLL_SAI, "pllsai-q-div", "pllsai-q", ++ { CLK_SAIQ_PDIV, PLL_VCO_SAI, "pllsai-q-div", "pllsai-q", + CLK_SET_RATE_PARENT, STM32F4_RCC_DCKCFGR, 8, 5, 0, NULL }, + +- { NO_IDX, PLL_SAI, "pllsai-r-div", "pllsai-r", CLK_SET_RATE_PARENT, ++ { NO_IDX, PLL_VCO_SAI, "pllsai-r-div", "pllsai-r", CLK_SET_RATE_PARENT, + STM32F4_RCC_DCKCFGR, 16, 2, 0, post_divr_table }, + }; + +@@ -1774,7 +1774,7 @@ static void __init stm32f4_rcc_init(struct device_node *np) + post_div->width, + post_div->flag_div, + post_div->div_table, +- clks[post_div->pll_num], ++ clks[post_div->pll_idx], + &stm32f4_clk_lock); + + if (post_div->idx != NO_IDX) +-- +2.30.2 + diff --git a/queue-5.10/clk-tegra-implement-disable_unused-of-tegra_clk_sdmm.patch b/queue-5.10/clk-tegra-implement-disable_unused-of-tegra_clk_sdmm.patch new file mode 100644 index 00000000000..53b988eefbe --- /dev/null +++ b/queue-5.10/clk-tegra-implement-disable_unused-of-tegra_clk_sdmm.patch @@ -0,0 +1,55 @@ +From 02ca7d6d9ec89355df5b2c6f8c1bef161fdc2821 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jul 2021 14:27:42 +0300 +Subject: clk: tegra: Implement disable_unused() of tegra_clk_sdmmc_mux_ops + +From: Dmitry Osipenko + +[ Upstream commit 2bcc025ab9bbd029b1730cde71cb4e4f0ed35d0f ] + +Implement disable_unused() callback of tegra_clk_sdmmc_mux_ops to fix +imbalanced disabling of the unused MMC clock on Tegra210 Jetson Nano. + +Fixes: c592c8a28f58 ("clk: tegra: Fix refcounting of gate clocks") +Reported-by: Jon Hunter # T210 Nano +Tested-by: Jon Hunter # T210 Nano +Acked-by: Jon Hunter +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20210717112742.7196-1-digetx@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-sdmmc-mux.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/clk/tegra/clk-sdmmc-mux.c b/drivers/clk/tegra/clk-sdmmc-mux.c +index 316912d3b1a4..4f2c3309eea4 100644 +--- a/drivers/clk/tegra/clk-sdmmc-mux.c ++++ b/drivers/clk/tegra/clk-sdmmc-mux.c +@@ -194,6 +194,15 @@ static void clk_sdmmc_mux_disable(struct clk_hw *hw) + gate_ops->disable(gate_hw); + } + ++static void clk_sdmmc_mux_disable_unused(struct clk_hw *hw) ++{ ++ struct tegra_sdmmc_mux *sdmmc_mux = to_clk_sdmmc_mux(hw); ++ const struct clk_ops *gate_ops = sdmmc_mux->gate_ops; ++ struct clk_hw *gate_hw = &sdmmc_mux->gate.hw; ++ ++ gate_ops->disable_unused(gate_hw); ++} ++ + static void clk_sdmmc_mux_restore_context(struct clk_hw *hw) + { + struct clk_hw *parent = clk_hw_get_parent(hw); +@@ -218,6 +227,7 @@ static const struct clk_ops tegra_clk_sdmmc_mux_ops = { + .is_enabled = clk_sdmmc_mux_is_enabled, + .enable = clk_sdmmc_mux_enable, + .disable = clk_sdmmc_mux_disable, ++ .disable_unused = clk_sdmmc_mux_disable_unused, + .restore_context = clk_sdmmc_mux_restore_context, + }; + +-- +2.30.2 + diff --git a/queue-5.10/dmaengine-imx-dma-configure-the-generic-dma-type-to-.patch b/queue-5.10/dmaengine-imx-dma-configure-the-generic-dma-type-to-.patch new file mode 100644 index 00000000000..452a1773ea9 --- /dev/null +++ b/queue-5.10/dmaengine-imx-dma-configure-the-generic-dma-type-to-.patch @@ -0,0 +1,44 @@ +From 5a4d1da7c229c1a87fab43b9ac01f429284a3767 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 09:18:21 +0200 +Subject: dmaengine: imx-dma: configure the generic DMA type to make it work + +From: Juergen Borleis + +[ Upstream commit 7199ddede9f0f2f68d41e6928e1c6c4bca9c39c0 ] + +Commit dea7a9fbb009 ("dmaengine: imx-dma: remove dma_slave_config +direction usage") changes the method from a "configuration when called" +to an "configuration when used". Due to this, only the cyclic DMA type +gets configured correctly, while the generic DMA type is left +non-configured. + +Without this additional call, the struct imxdma_channel::word_size member +is stuck at DMA_SLAVE_BUSWIDTH_UNDEFINED and imxdma_prep_slave_sg() always +returns NULL. + +Signed-off-by: Juergen Borleis +Fixes: dea7a9fbb009 ("dmaengine: imx-dma: remove dma_slave_config direction usage") +Link: https://lore.kernel.org/r/20210729071821.9857-1-jbe@pengutronix.de +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/imx-dma.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c +index 670db04b0757..52e361ed43e3 100644 +--- a/drivers/dma/imx-dma.c ++++ b/drivers/dma/imx-dma.c +@@ -831,6 +831,8 @@ static struct dma_async_tx_descriptor *imxdma_prep_slave_sg( + dma_length += sg_dma_len(sg); + } + ++ imxdma_config_write(chan, &imxdmac->config, direction); ++ + switch (imxdmac->word_size) { + case DMA_SLAVE_BUSWIDTH_4_BYTES: + if (sg_dma_len(sgl) & 3 || sgl->dma_address & 3) +-- +2.30.2 + diff --git a/queue-5.10/dmaengine-stm32-dma-fix-pm-usage-counter-imbalance-i.patch b/queue-5.10/dmaengine-stm32-dma-fix-pm-usage-counter-imbalance-i.patch new file mode 100644 index 00000000000..59a2bb3cb49 --- /dev/null +++ b/queue-5.10/dmaengine-stm32-dma-fix-pm-usage-counter-imbalance-i.patch @@ -0,0 +1,50 @@ +From 86ca0d9d39d21d86c74278b3d65ff9b65f6faf07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 14:46:38 +0800 +Subject: dmaengine: stm32-dma: Fix PM usage counter imbalance in stm32 dma ops + +From: Zhang Qilong + +[ Upstream commit d54db74ad6e0dea8c253fb68c689b836657ab914 ] + +pm_runtime_get_sync will increment pm usage counter +even it failed. Forgetting to putting operation will +result in reference leak here. We fix it by replacing +it with pm_runtime_resume_and_get to keep usage counter +balanced. + +Fixes: 48bc73ba14bcd ("dmaengine: stm32-dma: Add PM Runtime support") +Fixes: 05f8740a0e6fc ("dmaengine: stm32-dma: add suspend/resume power management support") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20210607064640.121394-2-zhangqilong3@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-dma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/stm32-dma.c b/drivers/dma/stm32-dma.c +index d0055d2f0b9a..1150aa90eab6 100644 +--- a/drivers/dma/stm32-dma.c ++++ b/drivers/dma/stm32-dma.c +@@ -1187,7 +1187,7 @@ static int stm32_dma_alloc_chan_resources(struct dma_chan *c) + + chan->config_init = false; + +- ret = pm_runtime_get_sync(dmadev->ddev.dev); ++ ret = pm_runtime_resume_and_get(dmadev->ddev.dev); + if (ret < 0) + return ret; + +@@ -1455,7 +1455,7 @@ static int stm32_dma_suspend(struct device *dev) + struct stm32_dma_device *dmadev = dev_get_drvdata(dev); + int id, ret, scr; + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/dmaengine-stm32-dmamux-fix-pm-usage-counter-unbalanc.patch b/queue-5.10/dmaengine-stm32-dmamux-fix-pm-usage-counter-unbalanc.patch new file mode 100644 index 00000000000..9d3297061c2 --- /dev/null +++ b/queue-5.10/dmaengine-stm32-dmamux-fix-pm-usage-counter-unbalanc.patch @@ -0,0 +1,59 @@ +From b021e82dca8746337fa9fa2f44c8a9042a9a5b3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 14:46:39 +0800 +Subject: dmaengine: stm32-dmamux: Fix PM usage counter unbalance in stm32 + dmamux ops + +From: Zhang Qilong + +[ Upstream commit baa16371c9525f24d508508e4d296c031e1de29c ] + +pm_runtime_get_sync will increment pm usage counter +even it failed. Forgetting to putting operation will +result in reference leak here. We fix it by replacing +it with pm_runtime_resume_and_get to keep usage counter +balanced. + +Fixes: 4f3ceca254e0f ("dmaengine: stm32-dmamux: Add PM Runtime support") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20210607064640.121394-3-zhangqilong3@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/stm32-dmamux.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/stm32-dmamux.c b/drivers/dma/stm32-dmamux.c +index a10ccd964376..bddd3b23f33f 100644 +--- a/drivers/dma/stm32-dmamux.c ++++ b/drivers/dma/stm32-dmamux.c +@@ -137,7 +137,7 @@ static void *stm32_dmamux_route_allocate(struct of_phandle_args *dma_spec, + + /* Set dma request */ + spin_lock_irqsave(&dmamux->lock, flags); +- ret = pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) { + spin_unlock_irqrestore(&dmamux->lock, flags); + goto error; +@@ -336,7 +336,7 @@ static int stm32_dmamux_suspend(struct device *dev) + struct stm32_dmamux_data *stm32_dmamux = platform_get_drvdata(pdev); + int i, ret; + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) + return ret; + +@@ -361,7 +361,7 @@ static int stm32_dmamux_resume(struct device *dev) + if (ret < 0) + return ret; + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.10/dmaengine-uniphier-xdmac-use-readl_poll_timeout_atom.patch b/queue-5.10/dmaengine-uniphier-xdmac-use-readl_poll_timeout_atom.patch new file mode 100644 index 00000000000..b3c83abe49a --- /dev/null +++ b/queue-5.10/dmaengine-uniphier-xdmac-use-readl_poll_timeout_atom.patch @@ -0,0 +1,42 @@ +From b95180c07df47c7e9656b5247a82a26938cdcb57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 14:47:32 +0900 +Subject: dmaengine: uniphier-xdmac: Use readl_poll_timeout_atomic() in atomic + state + +From: Kunihiko Hayashi + +[ Upstream commit 55f24c27b6c1a840b62fe297616f1f9ea3576cb7 ] + +The function uniphier_xdmac_chan_stop() is only called in atomic state. +Should use readl_poll_timeout_atomic() there instead of +readl_poll_timeout(). + +Reported-by: Dan Carpenter +Fixes: 667b9251440b ("dmaengine: uniphier-xdmac: Add UniPhier external DMA controller driver") +Signed-off-by: Kunihiko Hayashi +Link: https://lore.kernel.org/r/1627364852-28432-1-git-send-email-hayashi.kunihiko@socionext.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/uniphier-xdmac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/uniphier-xdmac.c b/drivers/dma/uniphier-xdmac.c +index 16b19654873d..d6b8a202474f 100644 +--- a/drivers/dma/uniphier-xdmac.c ++++ b/drivers/dma/uniphier-xdmac.c +@@ -209,8 +209,8 @@ static int uniphier_xdmac_chan_stop(struct uniphier_xdmac_chan *xc) + writel(0, xc->reg_ch_base + XDMAC_TSS); + + /* wait until transfer is stopped */ +- return readl_poll_timeout(xc->reg_ch_base + XDMAC_STAT, val, +- !(val & XDMAC_STAT_TENF), 100, 1000); ++ return readl_poll_timeout_atomic(xc->reg_ch_base + XDMAC_STAT, val, ++ !(val & XDMAC_STAT_TENF), 100, 1000); + } + + /* xc->vc.lock must be held by caller */ +-- +2.30.2 + diff --git a/queue-5.10/gpio-tqmx86-really-make-irq-optional.patch b/queue-5.10/gpio-tqmx86-really-make-irq-optional.patch new file mode 100644 index 00000000000..9a24fd586a8 --- /dev/null +++ b/queue-5.10/gpio-tqmx86-really-make-irq-optional.patch @@ -0,0 +1,52 @@ +From 3ae0dc9f6d56d7be053460806db61a29b3cc5ef0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jul 2021 12:00:47 +0200 +Subject: gpio: tqmx86: really make IRQ optional + +From: Matthias Schiffer + +[ Upstream commit 9b87f43537acfa24b95c236beba0f45901356eb2 ] + +The tqmx86 MFD driver was passing IRQ 0 for "no IRQ" in the past. This +causes warnings with newer kernels. + +Prepare the gpio-tqmx86 driver for the fixed MFD driver by handling a +missing IRQ properly. + +Fixes: b868db94a6a7 ("gpio: tqmx86: Add GPIO from for this IO controller") +Signed-off-by: Matthias Schiffer +Reviewed-by: Andrew Lunn +Acked-by: Linus Walleij +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-tqmx86.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpio/gpio-tqmx86.c b/drivers/gpio/gpio-tqmx86.c +index 5022e0ad0fae..0f5d17f343f1 100644 +--- a/drivers/gpio/gpio-tqmx86.c ++++ b/drivers/gpio/gpio-tqmx86.c +@@ -238,8 +238,8 @@ static int tqmx86_gpio_probe(struct platform_device *pdev) + struct resource *res; + int ret, irq; + +- irq = platform_get_irq(pdev, 0); +- if (irq < 0) ++ irq = platform_get_irq_optional(pdev, 0); ++ if (irq < 0 && irq != -ENXIO) + return irq; + + res = platform_get_resource(pdev, IORESOURCE_IO, 0); +@@ -278,7 +278,7 @@ static int tqmx86_gpio_probe(struct platform_device *pdev) + + pm_runtime_enable(&pdev->dev); + +- if (irq) { ++ if (irq > 0) { + struct irq_chip *irq_chip = &gpio->irq_chip; + u8 irq_status; + +-- +2.30.2 + diff --git a/queue-5.10/media-videobuf2-core-dequeue-if-start_streaming-fail.patch b/queue-5.10/media-videobuf2-core-dequeue-if-start_streaming-fail.patch new file mode 100644 index 00000000000..956d4edca54 --- /dev/null +++ b/queue-5.10/media-videobuf2-core-dequeue-if-start_streaming-fail.patch @@ -0,0 +1,71 @@ +From 8e479aaa06429667068475bef2c4baeb16c943b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 09:58:23 +0200 +Subject: media: videobuf2-core: dequeue if start_streaming fails + +From: Hans Verkuil + +[ Upstream commit c592b46907adbeb81243f7eb7a468c36692658b8 ] + +If a vb2_queue sets q->min_buffers_needed then when the number of +queued buffers reaches q->min_buffers_needed, vb2_core_qbuf() will call +the start_streaming() callback. If start_streaming() returns an error, +then that error was just returned by vb2_core_qbuf(), but the buffer +was still queued. However, userspace expects that if VIDIOC_QBUF fails, +the buffer is returned dequeued. + +So if start_streaming() fails, then remove the buffer from the queue, +thus avoiding this unwanted side-effect. + +Signed-off-by: Hans Verkuil +Reviewed-by: Laurent Pinchart +Tested-by: Kieran Bingham +Fixes: b3379c6201bb ("[media] vb2: only call start_streaming if sufficient buffers are queued") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/common/videobuf2/videobuf2-core.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/common/videobuf2/videobuf2-core.c b/drivers/media/common/videobuf2/videobuf2-core.c +index 89e38392509c..72350343a56a 100644 +--- a/drivers/media/common/videobuf2/videobuf2-core.c ++++ b/drivers/media/common/videobuf2/videobuf2-core.c +@@ -1573,6 +1573,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb, + struct media_request *req) + { + struct vb2_buffer *vb; ++ enum vb2_buffer_state orig_state; + int ret; + + if (q->error) { +@@ -1673,6 +1674,7 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb, + * Add to the queued buffers list, a buffer will stay on it until + * dequeued in dqbuf. + */ ++ orig_state = vb->state; + list_add_tail(&vb->queued_entry, &q->queued_list); + q->queued_count++; + q->waiting_for_buffers = false; +@@ -1703,8 +1705,17 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb, + if (q->streaming && !q->start_streaming_called && + q->queued_count >= q->min_buffers_needed) { + ret = vb2_start_streaming(q); +- if (ret) ++ if (ret) { ++ /* ++ * Since vb2_core_qbuf will return with an error, ++ * we should return it to state DEQUEUED since ++ * the error indicates that the buffer wasn't queued. ++ */ ++ list_del(&vb->queued_entry); ++ q->queued_count--; ++ vb->state = orig_state; + return ret; ++ } + } + + dprintk(q, 2, "qbuf of buffer %d succeeded\n", vb->index); +-- +2.30.2 + diff --git a/queue-5.10/mips-check-return-value-of-pgtable_pmd_page_ctor.patch b/queue-5.10/mips-check-return-value-of-pgtable_pmd_page_ctor.patch new file mode 100644 index 00000000000..fa32ebec963 --- /dev/null +++ b/queue-5.10/mips-check-return-value-of-pgtable_pmd_page_ctor.patch @@ -0,0 +1,60 @@ +From c0a6b1fe85d8a03dada24f83a1dc69c54bc376fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 17:30:45 +0800 +Subject: MIPS: check return value of pgtable_pmd_page_ctor + +From: Huang Pei + +[ Upstream commit 6aa32467299e9e12280a6aec9dbc21bf2db830b0 ] + ++. According to Documentation/vm/split_page_table_lock, handle failure +of pgtable_pmd_page_ctor + ++. Use GFP_KERNEL_ACCOUNT instead of GFP_KERNEL|__GFP_ACCOUNT + ++. Adjust coding style + +Fixes: ed914d48b6a1 ("MIPS: add PMD table accounting into MIPS') +Reported-by: Joshua Kinard +Signed-off-by: Huang Pei +Reviewed-by: Joshua Kinard +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/pgalloc.h | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h +index d0cf997b4ba8..139b4050259f 100644 +--- a/arch/mips/include/asm/pgalloc.h ++++ b/arch/mips/include/asm/pgalloc.h +@@ -59,15 +59,20 @@ do { \ + + static inline pmd_t *pmd_alloc_one(struct mm_struct *mm, unsigned long address) + { +- pmd_t *pmd = NULL; ++ pmd_t *pmd; + struct page *pg; + +- pg = alloc_pages(GFP_KERNEL | __GFP_ACCOUNT, PMD_ORDER); +- if (pg) { +- pgtable_pmd_page_ctor(pg); +- pmd = (pmd_t *)page_address(pg); +- pmd_init((unsigned long)pmd, (unsigned long)invalid_pte_table); ++ pg = alloc_pages(GFP_KERNEL_ACCOUNT, PMD_ORDER); ++ if (!pg) ++ return NULL; ++ ++ if (!pgtable_pmd_page_ctor(pg)) { ++ __free_pages(pg, PMD_ORDER); ++ return NULL; + } ++ ++ pmd = (pmd_t *)page_address(pg); ++ pmd_init((unsigned long)pmd, (unsigned long)invalid_pte_table); + return pmd; + } + +-- +2.30.2 + diff --git a/queue-5.10/mips-fix-non-posix-regexp.patch b/queue-5.10/mips-fix-non-posix-regexp.patch new file mode 100644 index 00000000000..ef31d132765 --- /dev/null +++ b/queue-5.10/mips-fix-non-posix-regexp.patch @@ -0,0 +1,57 @@ +From f3adddafb9ddf85a442a78b41b50023d83d8c5bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jul 2021 10:57:10 +0200 +Subject: mips: Fix non-POSIX regexp + +From: H. Nikolaus Schaller + +[ Upstream commit 28bbbb9875a35975904e46f9b06fa689d051b290 ] + +When cross compiling a MIPS kernel on a BSD based HOSTCC leads +to errors like + + SYNC include/config/auto.conf.cmd - due to: .config +egrep: empty (sub)expression + UPD include/config/kernel.release + HOSTCC scripts/dtc/dtc.o - due to target missing + +It turns out that egrep uses this egrep pattern: + + (|MINOR_|PATCHLEVEL_) + +This is not valid syntax or gives undefined results according +to POSIX 9.5.3 ERE Grammar + + https://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap09.html + +It seems to be silently accepted by the Linux egrep implementation +while a BSD host complains. + +Such patterns can be replaced by a transformation like + + "(|p1|p2)" -> "(p1|p2)?" + +Fixes: 48c35b2d245f ("[MIPS] There is no __GNUC_MAJOR__") +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + arch/mips/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/Makefile b/arch/mips/Makefile +index 686990fcc5f0..acab8018ab44 100644 +--- a/arch/mips/Makefile ++++ b/arch/mips/Makefile +@@ -320,7 +320,7 @@ KBUILD_LDFLAGS += -m $(ld-emul) + + ifdef CONFIG_MIPS + CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \ +- egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \ ++ egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \ + sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g') + endif + +-- +2.30.2 + diff --git a/queue-5.10/net-dsa-qca-ar9331-reorder-mdio-write-sequence.patch b/queue-5.10/net-dsa-qca-ar9331-reorder-mdio-write-sequence.patch new file mode 100644 index 00000000000..a853cdca1f7 --- /dev/null +++ b/queue-5.10/net-dsa-qca-ar9331-reorder-mdio-write-sequence.patch @@ -0,0 +1,67 @@ +From ab6116f944ac13d15e6307910ae3a46cdaa82c84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 08:37:46 +0200 +Subject: net: dsa: qca: ar9331: reorder MDIO write sequence + +From: Oleksij Rempel + +[ Upstream commit d1a58c013a5837451e3213e7a426d350fa524ead ] + +In case of this switch we work with 32bit registers on top of 16bit +bus. Some registers (for example access to forwarding database) have +trigger bit on the first 16bit half of request and the result + +configuration of request in the second half. Without this patch, we would +trigger database operation and overwrite result in one run. + +To make it work properly, we should do the second part of transfer +before the first one is done. + +So far, this rule seems to work for all registers on this switch. + +Fixes: ec6698c272de ("net: dsa: add support for Atheros AR9331 built-in switch") +Signed-off-by: Oleksij Rempel +Reviewed-by: Andrew Lunn +Reviewed-by: Florian Fainelli +Reviewed-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20210803063746.3600-1-o.rempel@pengutronix.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/qca/ar9331.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/qca/ar9331.c b/drivers/net/dsa/qca/ar9331.c +index 4d49c5f2b790..661745932a53 100644 +--- a/drivers/net/dsa/qca/ar9331.c ++++ b/drivers/net/dsa/qca/ar9331.c +@@ -689,16 +689,24 @@ static int ar9331_mdio_write(void *ctx, u32 reg, u32 val) + return 0; + } + +- ret = __ar9331_mdio_write(sbus, AR9331_SW_MDIO_PHY_MODE_REG, reg, val); ++ /* In case of this switch we work with 32bit registers on top of 16bit ++ * bus. Some registers (for example access to forwarding database) have ++ * trigger bit on the first 16bit half of request, the result and ++ * configuration of request in the second half. ++ * To make it work properly, we should do the second part of transfer ++ * before the first one is done. ++ */ ++ ret = __ar9331_mdio_write(sbus, AR9331_SW_MDIO_PHY_MODE_REG, reg + 2, ++ val >> 16); + if (ret < 0) + goto error; + +- ret = __ar9331_mdio_write(sbus, AR9331_SW_MDIO_PHY_MODE_REG, reg + 2, +- val >> 16); ++ ret = __ar9331_mdio_write(sbus, AR9331_SW_MDIO_PHY_MODE_REG, reg, val); + if (ret < 0) + goto error; + + return 0; ++ + error: + dev_err_ratelimited(&sbus->dev, "Bus error. Failed to write register.\n"); + return ret; +-- +2.30.2 + diff --git a/queue-5.10/net-dsa-sja1105-be-stateless-with-fdb-entries-on-sja.patch b/queue-5.10/net-dsa-sja1105-be-stateless-with-fdb-entries-on-sja.patch new file mode 100644 index 00000000000..70533871c4f --- /dev/null +++ b/queue-5.10/net-dsa-sja1105-be-stateless-with-fdb-entries-on-sja.patch @@ -0,0 +1,92 @@ +From 09994f231be6d2c6a85d7bf9cd2df18681de1836 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jul 2021 20:18:14 +0300 +Subject: net: dsa: sja1105: be stateless with FDB entries on + SJA1105P/Q/R/S/SJA1110 too + +From: Vladimir Oltean + +[ Upstream commit 589918df93226a1e5f104306c185b6dcf2bd8051 ] + +Similar but not quite the same with what was done in commit b11f0a4c0c81 +("net: dsa: sja1105: be stateless when installing FDB entries") for +SJA1105E/T, it is desirable to drop the priv->vlan_aware check and +simply go ahead and install FDB entries in the VLAN that was given by +the bridge. + +As opposed to SJA1105E/T, in SJA1105P/Q/R/S and SJA1110, the FDB is a +maskable TCAM, and we are installing VLAN-unaware FDB entries with the +VLAN ID masked off. However, such FDB entries might completely obscure +VLAN-aware entries where the VLAN ID is included in the search mask, +because the switch looks up the FDB from left to right and picks the +first entry which results in a masked match. So it depends on whether +the bridge installs first the VLAN-unaware or the VLAN-aware FDB entries. + +Anyway, if we had a VLAN-unaware FDB entry towards one set of DESTPORTS +and a VLAN-aware one towards other set of DESTPORTS, the result is that +the packets in VLAN-aware mode will be forwarded towards the DESTPORTS +specified by the VLAN-unaware entry. + +To solve this, simply do not use the masked matching ability of the FDB +for VLAN ID, and always match precisely on it. In VLAN-unaware mode, we +configure the switch for shared VLAN learning, so the VLAN ID will be +ignored anyway during lookup, so it is redundant to mask it off in the +TCAM. + +This patch conflicts with net-next commit 0fac6aa098ed ("net: dsa: sja1105: +delete the best_effort_vlan_filtering mode") which changed this line: + if (priv->vlan_state != SJA1105_VLAN_UNAWARE) { +into: + if (priv->vlan_aware) { + +When merging with net-next, the lines added by this patch should take +precedence in the conflict resolution (i.e. the "if" condition should be +deleted in both cases). + +Fixes: 1da73821343c ("net: dsa: sja1105: Add FDB operations for P/Q/R/S series") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105_main.c | 18 ++++-------------- + 1 file changed, 4 insertions(+), 14 deletions(-) + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index 52d8cc1a95fa..e65be1380803 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -1389,13 +1389,8 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port, + l2_lookup.vlanid = vid; + l2_lookup.iotag = SJA1105_S_TAG; + l2_lookup.mask_macaddr = GENMASK_ULL(ETH_ALEN * 8 - 1, 0); +- if (priv->vlan_state != SJA1105_VLAN_UNAWARE) { +- l2_lookup.mask_vlanid = VLAN_VID_MASK; +- l2_lookup.mask_iotag = BIT(0); +- } else { +- l2_lookup.mask_vlanid = 0; +- l2_lookup.mask_iotag = 0; +- } ++ l2_lookup.mask_vlanid = VLAN_VID_MASK; ++ l2_lookup.mask_iotag = BIT(0); + l2_lookup.destports = BIT(port); + + rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP, +@@ -1482,13 +1477,8 @@ int sja1105pqrs_fdb_del(struct dsa_switch *ds, int port, + l2_lookup.vlanid = vid; + l2_lookup.iotag = SJA1105_S_TAG; + l2_lookup.mask_macaddr = GENMASK_ULL(ETH_ALEN * 8 - 1, 0); +- if (priv->vlan_state != SJA1105_VLAN_UNAWARE) { +- l2_lookup.mask_vlanid = VLAN_VID_MASK; +- l2_lookup.mask_iotag = BIT(0); +- } else { +- l2_lookup.mask_vlanid = 0; +- l2_lookup.mask_iotag = 0; +- } ++ l2_lookup.mask_vlanid = VLAN_VID_MASK; ++ l2_lookup.mask_iotag = BIT(0); + l2_lookup.destports = BIT(port); + + rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP, +-- +2.30.2 + diff --git a/queue-5.10/net-dsa-sja1105-invalidate-dynamic-fdb-entries-learn.patch b/queue-5.10/net-dsa-sja1105-invalidate-dynamic-fdb-entries-learn.patch new file mode 100644 index 00000000000..7a35343ce8d --- /dev/null +++ b/queue-5.10/net-dsa-sja1105-invalidate-dynamic-fdb-entries-learn.patch @@ -0,0 +1,141 @@ +From f316314564043bfbb6476ed3d64eac3fcc4a7571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jul 2021 20:18:12 +0300 +Subject: net: dsa: sja1105: invalidate dynamic FDB entries learned + concurrently with statically added ones + +From: Vladimir Oltean + +[ Upstream commit 6c5fc159e0927531707895709eee1f8bfa04289f ] + +The procedure to add a static FDB entry in sja1105 is concurrent with +dynamic learning performed on all bridge ports and the CPU port. + +The switch looks up the FDB from left to right, and also learns +dynamically from left to right, so it is possible that between the +moment when we pick up a free slot to install an FDB entry, another slot +to the left of that one becomes free due to an address ageing out, and +that other slot is then immediately used by the switch to learn +dynamically the same address as we're trying to add statically. + +The result is that we succeeded to add our static FDB entry, but it is +being shadowed by a dynamic FDB entry to its left, and the switch will +behave as if our static FDB entry did not exist. + +We cannot really prevent this from happening unless we make the entire +process to add a static FDB entry a huge critical section where address +learning is temporarily disabled on _all_ ports, and then re-enabled +according to the configuration done by sja1105_port_set_learning. +However, that is kind of disruptive for the operation of the network. + +What we can do alternatively is to simply read back the FDB for dynamic +entries located before our newly added static one, and delete them. +This will guarantee that our static FDB entry is now operational. It +will still not guarantee that there aren't dynamic FDB entries to the +_right_ of that static FDB entry, but at least those entries will age +out by themselves since they aren't hit, and won't bother anyone. + +Fixes: 291d1e72b756 ("net: dsa: sja1105: Add support for FDB and MDB management") +Fixes: 1da73821343c ("net: dsa: sja1105: Add FDB operations for P/Q/R/S series") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105_main.c | 57 +++++++++++++++++++++++++- + 1 file changed, 55 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index 469d123772a6..52d8cc1a95fa 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -1260,10 +1260,11 @@ static int sja1105et_is_fdb_entry_in_bin(struct sja1105_private *priv, int bin, + int sja1105et_fdb_add(struct dsa_switch *ds, int port, + const unsigned char *addr, u16 vid) + { +- struct sja1105_l2_lookup_entry l2_lookup = {0}; ++ struct sja1105_l2_lookup_entry l2_lookup = {0}, tmp; + struct sja1105_private *priv = ds->priv; + struct device *dev = ds->dev; + int last_unused = -1; ++ int start, end, i; + int bin, way, rc; + + bin = sja1105et_fdb_hash(priv, addr, vid); +@@ -1315,6 +1316,29 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port, + if (rc < 0) + return rc; + ++ /* Invalidate a dynamically learned entry if that exists */ ++ start = sja1105et_fdb_index(bin, 0); ++ end = sja1105et_fdb_index(bin, way); ++ ++ for (i = start; i < end; i++) { ++ rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP, ++ i, &tmp); ++ if (rc == -ENOENT) ++ continue; ++ if (rc) ++ return rc; ++ ++ if (tmp.macaddr != ether_addr_to_u64(addr) || tmp.vlanid != vid) ++ continue; ++ ++ rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP, ++ i, NULL, false); ++ if (rc) ++ return rc; ++ ++ break; ++ } ++ + return sja1105_static_fdb_change(priv, port, &l2_lookup, true); + } + +@@ -1356,7 +1380,7 @@ int sja1105et_fdb_del(struct dsa_switch *ds, int port, + int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port, + const unsigned char *addr, u16 vid) + { +- struct sja1105_l2_lookup_entry l2_lookup = {0}; ++ struct sja1105_l2_lookup_entry l2_lookup = {0}, tmp; + struct sja1105_private *priv = ds->priv; + int rc, i; + +@@ -1414,6 +1438,35 @@ skip_finding_an_index: + if (rc < 0) + return rc; + ++ /* The switch learns dynamic entries and looks up the FDB left to ++ * right. It is possible that our addition was concurrent with the ++ * dynamic learning of the same address, so now that the static entry ++ * has been installed, we are certain that address learning for this ++ * particular address has been turned off, so the dynamic entry either ++ * is in the FDB at an index smaller than the static one, or isn't (it ++ * can also be at a larger index, but in that case it is inactive ++ * because the static FDB entry will match first, and the dynamic one ++ * will eventually age out). Search for a dynamically learned address ++ * prior to our static one and invalidate it. ++ */ ++ tmp = l2_lookup; ++ ++ rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP, ++ SJA1105_SEARCH, &tmp); ++ if (rc < 0) { ++ dev_err(ds->dev, ++ "port %d failed to read back entry for %pM vid %d: %pe\n", ++ port, addr, vid, ERR_PTR(rc)); ++ return rc; ++ } ++ ++ if (tmp.index < l2_lookup.index) { ++ rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP, ++ tmp.index, NULL, false); ++ if (rc < 0) ++ return rc; ++ } ++ + return sja1105_static_fdb_change(priv, port, &l2_lookup, true); + } + +-- +2.30.2 + diff --git a/queue-5.10/net-dsa-sja1105-match-fdb-entries-regardless-of-inne.patch b/queue-5.10/net-dsa-sja1105-match-fdb-entries-regardless-of-inne.patch new file mode 100644 index 00000000000..b480b75b396 --- /dev/null +++ b/queue-5.10/net-dsa-sja1105-match-fdb-entries-regardless-of-inne.patch @@ -0,0 +1,74 @@ +From 2d5b74d973f5158dd4b849a44ff00cfdad5f5550 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jul 2021 20:18:15 +0300 +Subject: net: dsa: sja1105: match FDB entries regardless of inner/outer VLAN + tag + +From: Vladimir Oltean + +[ Upstream commit 47c2c0c2312118a478f738503781de1d1a6020d2 ] + +On SJA1105P/Q/R/S and SJA1110, the L2 Lookup Table entries contain a +maskable "inner/outer tag" bit which means: +- when set to 1: match single-outer and double tagged frames +- when set to 0: match untagged and single-inner tagged frames +- when masked off: match all frames regardless of the type of tag + +This driver does not make any meaningful distinction between inner tags +(matches on TPID) and outer tags (matches on TPID2). In fact, all VLAN +table entries are installed as SJA1110_VLAN_D_TAG, which means that they +match on both inner and outer tags. + +So it does not make sense that we install FDB entries with the IOTAG bit +set to 1. + +In VLAN-unaware mode, we set both TPID and TPID2 to 0xdadb, so the +switch will see frames as outer-tagged or double-tagged (never inner). +So the FDB entries will match if IOTAG is set to 1. + +In VLAN-aware mode, we set TPID to 0x8100 and TPID2 to 0x88a8. So the +switch will see untagged and 802.1Q-tagged packets as inner-tagged, and +802.1ad-tagged packets as outer-tagged. So untagged and 802.1Q-tagged +packets will not match FDB entries if IOTAG is set to 1, but 802.1ad +tagged packets will. Strange. + +To fix this, simply mask off the IOTAG bit from FDB entries, and make +them match regardless of whether the VLAN tag is inner or outer. + +Fixes: 1da73821343c ("net: dsa: sja1105: Add FDB operations for P/Q/R/S series") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105_main.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index e65be1380803..855371fcbf85 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -1387,10 +1387,8 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port, + /* Search for an existing entry in the FDB table */ + l2_lookup.macaddr = ether_addr_to_u64(addr); + l2_lookup.vlanid = vid; +- l2_lookup.iotag = SJA1105_S_TAG; + l2_lookup.mask_macaddr = GENMASK_ULL(ETH_ALEN * 8 - 1, 0); + l2_lookup.mask_vlanid = VLAN_VID_MASK; +- l2_lookup.mask_iotag = BIT(0); + l2_lookup.destports = BIT(port); + + rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP, +@@ -1475,10 +1473,8 @@ int sja1105pqrs_fdb_del(struct dsa_switch *ds, int port, + + l2_lookup.macaddr = ether_addr_to_u64(addr); + l2_lookup.vlanid = vid; +- l2_lookup.iotag = SJA1105_S_TAG; + l2_lookup.mask_macaddr = GENMASK_ULL(ETH_ALEN * 8 - 1, 0); + l2_lookup.mask_vlanid = VLAN_VID_MASK; +- l2_lookup.mask_iotag = BIT(0); + l2_lookup.destports = BIT(port); + + rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP, +-- +2.30.2 + diff --git a/queue-5.10/net-dsa-sja1105-overwrite-dynamic-fdb-entries-with-s.patch b/queue-5.10/net-dsa-sja1105-overwrite-dynamic-fdb-entries-with-s.patch new file mode 100644 index 00000000000..2fe48ef6755 --- /dev/null +++ b/queue-5.10/net-dsa-sja1105-overwrite-dynamic-fdb-entries-with-s.patch @@ -0,0 +1,86 @@ +From 19eb0a78ffe39df4ce73b16755eef4abf7864188 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jul 2021 20:18:11 +0300 +Subject: net: dsa: sja1105: overwrite dynamic FDB entries with static ones in + .port_fdb_add + +From: Vladimir Oltean + +[ Upstream commit e11e865bf84e3c6ea91563ff3e858cfe0e184bd2 ] + +The SJA1105 switch family leaves it up to software to decide where +within the FDB to install a static entry, and to concatenate destination +ports for already existing entries (the FDB is also used for multicast +entries), it is not as simple as just saying "please add this entry". + +This means we first need to search for an existing FDB entry before +adding a new one. The driver currently manages to fool itself into +thinking that if an FDB entry already exists, there is nothing to be +done. But that FDB entry might be dynamically learned, case in which it +should be replaced with a static entry, but instead it is left alone. + +This patch checks the LOCKEDS ("locked/static") bit from found FDB +entries, and lets the code "goto skip_finding_an_index;" if the FDB +entry was not static. So we also need to move the place where we set +LOCKEDS = true, to cover the new case where a dynamic FDB entry existed +but was dynamic. + +Fixes: 291d1e72b756 ("net: dsa: sja1105: Add support for FDB and MDB management") +Fixes: 1da73821343c ("net: dsa: sja1105: Add FDB operations for P/Q/R/S series") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105_main.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index 82b918d36117..469d123772a6 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -1275,7 +1275,7 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port, + * mask? If yes, we need to do nothing. If not, we need + * to rewrite the entry by adding this port to it. + */ +- if (l2_lookup.destports & BIT(port)) ++ if ((l2_lookup.destports & BIT(port)) && l2_lookup.lockeds) + return 0; + l2_lookup.destports |= BIT(port); + } else { +@@ -1306,6 +1306,7 @@ int sja1105et_fdb_add(struct dsa_switch *ds, int port, + index, NULL, false); + } + } ++ l2_lookup.lockeds = true; + l2_lookup.index = sja1105et_fdb_index(bin, way); + + rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP, +@@ -1376,10 +1377,10 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port, + rc = sja1105_dynamic_config_read(priv, BLK_IDX_L2_LOOKUP, + SJA1105_SEARCH, &l2_lookup); + if (rc == 0) { +- /* Found and this port is already in the entry's ++ /* Found a static entry and this port is already in the entry's + * port mask => job done + */ +- if (l2_lookup.destports & BIT(port)) ++ if ((l2_lookup.destports & BIT(port)) && l2_lookup.lockeds) + return 0; + /* l2_lookup.index is populated by the switch in case it + * found something. +@@ -1402,10 +1403,11 @@ int sja1105pqrs_fdb_add(struct dsa_switch *ds, int port, + dev_err(ds->dev, "FDB is full, cannot add entry.\n"); + return -EINVAL; + } +- l2_lookup.lockeds = true; + l2_lookup.index = i; + + skip_finding_an_index: ++ l2_lookup.lockeds = true; ++ + rc = sja1105_dynamic_config_write(priv, BLK_IDX_L2_LOOKUP, + l2_lookup.index, &l2_lookup, + true); +-- +2.30.2 + diff --git a/queue-5.10/net-fec-fix-use-after-free-in-fec_drv_remove.patch b/queue-5.10/net-fec-fix-use-after-free-in-fec_drv_remove.patch new file mode 100644 index 00000000000..0a25bb99120 --- /dev/null +++ b/queue-5.10/net-fec-fix-use-after-free-in-fec_drv_remove.patch @@ -0,0 +1,50 @@ +From be2350b08ed479808769ab00d61e011cbef648c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 18:51:51 +0300 +Subject: net: fec: fix use-after-free in fec_drv_remove + +From: Pavel Skripkin + +[ Upstream commit 44712965bf12ae1758cec4de53816ed4b914ca1a ] + +Smatch says: + drivers/net/ethernet/freescale/fec_main.c:3994 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev); + drivers/net/ethernet/freescale/fec_main.c:3995 fec_drv_remove() error: Using fep after free_{netdev,candev}(ndev); + +Since fep pointer is netdev private data, accessing it after free_netdev() +call can cause use-after-free bug. Fix it by moving free_netdev() call at +the end of the function + +Reported-by: Dan Carpenter +Fixes: a31eda65ba21 ("net: fec: fix clock count mis-match") +Signed-off-by: Pavel Skripkin +Reviewed-by: Joakim Zhang +Reviewed-by: Jesse Brandeburg +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 2cb73e850a32..94eb838a0176 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3822,13 +3822,13 @@ fec_drv_remove(struct platform_device *pdev) + if (of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + of_node_put(fep->phy_node); +- free_netdev(ndev); + + clk_disable_unprepare(fep->clk_ahb); + clk_disable_unprepare(fep->clk_ipg); + pm_runtime_put_noidle(&pdev->dev); + pm_runtime_disable(&pdev->dev); + ++ free_netdev(ndev); + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.10/net-gro-set-inner-transport-header-offset-in-tcp-udp.patch b/queue-5.10/net-gro-set-inner-transport-header-offset-in-tcp-udp.patch new file mode 100644 index 00000000000..afa1df27c62 --- /dev/null +++ b/queue-5.10/net-gro-set-inner-transport-header-offset-in-tcp-udp.patch @@ -0,0 +1,145 @@ +From 95e8cf63ec11c347883e73e898e02fb49bdcc50d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 15:48:20 +0200 +Subject: net, gro: Set inner transport header offset in tcp/udp GRO hook + +From: Jakub Sitnicki + +[ Upstream commit d51c5907e9809a803b276883d203f45849abd4d6 ] + +GSO expects inner transport header offset to be valid when +skb->encapsulation flag is set. GSO uses this value to calculate the length +of an individual segment of a GSO packet in skb_gso_transport_seglen(). + +However, tcp/udp gro_complete callbacks don't update the +skb->inner_transport_header when processing an encapsulated TCP/UDP +segment. As a result a GRO skb has ->inner_transport_header set to a value +carried over from earlier skb processing. + +This can have mild to tragic consequences. From miscalculating the GSO +segment length to triggering a page fault [1], when trying to read TCP/UDP +header at an address past the skb->data page. + +The latter scenario leads to an oops report like so: + + BUG: unable to handle page fault for address: ffff9fa7ec00d008 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 123f201067 P4D 123f201067 PUD 123f209067 PMD 0 + Oops: 0000 [#1] SMP NOPTI + CPU: 44 PID: 0 Comm: swapper/44 Not tainted 5.4.53-cloudflare-2020.7.21 #1 + Hardware name: HYVE EDGE-METAL-GEN10/HS-1811DLite1, BIOS V2.15 02/21/2020 + RIP: 0010:skb_gso_transport_seglen+0x44/0xa0 + Code: c0 41 83 e0 11 f6 87 81 00 00 00 20 74 30 0f b7 87 aa 00 00 00 0f [...] + RSP: 0018:ffffad8640bacbb8 EFLAGS: 00010202 + RAX: 000000000000feda RBX: ffff9fcc8d31bc00 RCX: ffff9fa7ec00cffc + RDX: ffff9fa7ebffdec0 RSI: 000000000000feda RDI: 0000000000000122 + RBP: 00000000000005c4 R08: 0000000000000001 R09: 0000000000000000 + R10: ffff9fe588ae3800 R11: ffff9fe011fc92f0 R12: ffff9fcc8d31bc00 + R13: ffff9fe0119d4300 R14: 00000000000005c4 R15: ffff9fba57d70900 + FS: 0000000000000000(0000) GS:ffff9fe68df00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffff9fa7ec00d008 CR3: 0000003e99b1c000 CR4: 0000000000340ee0 + Call Trace: + + skb_gso_validate_network_len+0x11/0x70 + __ip_finish_output+0x109/0x1c0 + ip_sublist_rcv_finish+0x57/0x70 + ip_sublist_rcv+0x2aa/0x2d0 + ? ip_rcv_finish_core.constprop.0+0x390/0x390 + ip_list_rcv+0x12b/0x14f + __netif_receive_skb_list_core+0x2a9/0x2d0 + netif_receive_skb_list_internal+0x1b5/0x2e0 + napi_complete_done+0x93/0x140 + veth_poll+0xc0/0x19f [veth] + ? mlx5e_napi_poll+0x221/0x610 [mlx5_core] + net_rx_action+0x1f8/0x790 + __do_softirq+0xe1/0x2bf + irq_exit+0x8e/0xc0 + do_IRQ+0x58/0xe0 + common_interrupt+0xf/0xf + + +The bug can be observed in a simple setup where we send IP/GRE/IP/TCP +packets into a netns over a veth pair. Inside the netns, packets are +forwarded to dummy device: + + trafgen -> [veth A]--[veth B] -forward-> [dummy] + +For veth B to GRO aggregate packets on receive, it needs to have an XDP +program attached (for example, a trivial XDP_PASS). Additionally, for UDP, +we need to enable GSO_UDP_L4 feature on the device: + + ip netns exec A ethtool -K AB rx-udp-gro-forwarding on + +The last component is an artificial delay to increase the chances of GRO +batching happening: + + ip netns exec A tc qdisc add dev AB root \ + netem delay 200us slot 5ms 10ms packets 2 bytes 64k + +With such a setup in place, the bug can be observed by tracing the skb +outer and inner offsets when GSO skb is transmitted from the dummy device: + +tcp: + +FUNC DEV SKB_LEN NH TH ENC INH ITH GSO_SIZE GSO_TYPE +ip_finish_output dumB 2830 270 290 1 294 254 1383 (tcpv4,gre,) + ^^^ +udp: + +FUNC DEV SKB_LEN NH TH ENC INH ITH GSO_SIZE GSO_TYPE +ip_finish_output dumB 2818 270 290 1 294 254 1383 (gre,udp_l4,) + ^^^ + +Fix it by updating the inner transport header offset in tcp/udp +gro_complete callbacks, similar to how {inet,ipv6}_gro_complete callbacks +update the inner network header offset, when skb->encapsulation flag is +set. + +[1] https://lore.kernel.org/netdev/CAKxSbF01cLpZem2GFaUaifh0S-5WYViZemTicAg7FCHOnh6kug@mail.gmail.com/ + +Fixes: bf296b125b21 ("tcp: Add GRO support") +Fixes: f993bc25e519 ("net: core: handle encapsulation offloads when computing segment lengths") +Fixes: e20cf8d3f1f7 ("udp: implement GRO for plain UDP sockets.") +Reported-by: Alex Forster +Signed-off-by: Jakub Sitnicki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_offload.c | 3 +++ + net/ipv4/udp_offload.c | 4 ++++ + 2 files changed, 7 insertions(+) + +diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c +index e09147ac9a99..fc61cd3fea65 100644 +--- a/net/ipv4/tcp_offload.c ++++ b/net/ipv4/tcp_offload.c +@@ -298,6 +298,9 @@ int tcp_gro_complete(struct sk_buff *skb) + if (th->cwr) + skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN; + ++ if (skb->encapsulation) ++ skb->inner_transport_header = skb->transport_header; ++ + return 0; + } + EXPORT_SYMBOL(tcp_gro_complete); +diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c +index 6e2b02cf7841..f4b8e56068e0 100644 +--- a/net/ipv4/udp_offload.c ++++ b/net/ipv4/udp_offload.c +@@ -615,6 +615,10 @@ static int udp_gro_complete_segment(struct sk_buff *skb) + + skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count; + skb_shinfo(skb)->gso_type |= SKB_GSO_UDP_L4; ++ ++ if (skb->encapsulation) ++ skb->inner_transport_header = skb->transport_header; ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.10/net-ipv6-fix-returned-variable-type-in-ip6_skb_dst_m.patch b/queue-5.10/net-ipv6-fix-returned-variable-type-in-ip6_skb_dst_m.patch new file mode 100644 index 00000000000..92aa1a647d8 --- /dev/null +++ b/queue-5.10/net-ipv6-fix-returned-variable-type-in-ip6_skb_dst_m.patch @@ -0,0 +1,40 @@ +From 4b4877f357047aad522e37f12c3995231a6712bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 12:00:16 +0200 +Subject: net: ipv6: fix returned variable type in ip6_skb_dst_mtu + +From: Antoine Tenart + +[ Upstream commit 4039146777a91e1576da2bf38e0d8a1061a1ae47 ] + +The patch fixing the returned value of ip6_skb_dst_mtu (int -> unsigned +int) was rebased between its initial review and the version applied. In +the meantime fade56410c22 was applied, which added a new variable (int) +used as the returned value. This lead to a mismatch between the function +prototype and the variable used as the return value. + +Fixes: 40fc3054b458 ("net: ipv6: fix return value of ip6_skb_dst_mtu") +Cc: Vadim Fedorenko +Signed-off-by: Antoine Tenart +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/ip6_route.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h +index 42fe4e1b6a8c..44969d03debf 100644 +--- a/include/net/ip6_route.h ++++ b/include/net/ip6_route.h +@@ -264,7 +264,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + + static inline unsigned int ip6_skb_dst_mtu(struct sk_buff *skb) + { +- int mtu; ++ unsigned int mtu; + + struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? + inet6_sk(skb->sk) : NULL; +-- +2.30.2 + diff --git a/queue-5.10/net-natsemi-fix-missing-pci_disable_device-in-probe-.patch b/queue-5.10/net-natsemi-fix-missing-pci_disable_device-in-probe-.patch new file mode 100644 index 00000000000..41a4233db01 --- /dev/null +++ b/queue-5.10/net-natsemi-fix-missing-pci_disable_device-in-probe-.patch @@ -0,0 +1,65 @@ +From 91c68adf939bbfcab903d900616e163cd2759c1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jul 2021 14:38:01 +0800 +Subject: net: natsemi: Fix missing pci_disable_device() in probe and remove + +From: Wang Hai + +[ Upstream commit 7fe74dfd41c428afb24e2e615470832fa997ff14 ] + +Replace pci_enable_device() with pcim_enable_device(), +pci_disable_device() and pci_release_regions() will be +called in release automatically. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/natsemi/natsemi.c | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/natsemi/natsemi.c b/drivers/net/ethernet/natsemi/natsemi.c +index b81e1487945c..14a17ad730f0 100644 +--- a/drivers/net/ethernet/natsemi/natsemi.c ++++ b/drivers/net/ethernet/natsemi/natsemi.c +@@ -819,7 +819,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + printk(version); + #endif + +- i = pci_enable_device(pdev); ++ i = pcim_enable_device(pdev); + if (i) return i; + + /* natsemi has a non-standard PM control register +@@ -852,7 +852,7 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + ioaddr = ioremap(iostart, iosize); + if (!ioaddr) { + i = -ENOMEM; +- goto err_ioremap; ++ goto err_pci_request_regions; + } + + /* Work around the dropped serial bit. */ +@@ -974,9 +974,6 @@ static int natsemi_probe1(struct pci_dev *pdev, const struct pci_device_id *ent) + err_register_netdev: + iounmap(ioaddr); + +- err_ioremap: +- pci_release_regions(pdev); +- + err_pci_request_regions: + free_netdev(dev); + return i; +@@ -3241,7 +3238,6 @@ static void natsemi_remove1(struct pci_dev *pdev) + + NATSEMI_REMOVE_FILE(pdev, dspcfg_workaround); + unregister_netdev (dev); +- pci_release_regions (pdev); + iounmap(ioaddr); + free_netdev (dev); + } +-- +2.30.2 + diff --git a/queue-5.10/net-pegasus-fix-uninit-value-in-get_interrupt_interv.patch b/queue-5.10/net-pegasus-fix-uninit-value-in-get_interrupt_interv.patch new file mode 100644 index 00000000000..05609f9e8dd --- /dev/null +++ b/queue-5.10/net-pegasus-fix-uninit-value-in-get_interrupt_interv.patch @@ -0,0 +1,96 @@ +From 690d0d0aa69bf65134a380778d6ee6a3833aa1a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 17:30:05 +0300 +Subject: net: pegasus: fix uninit-value in get_interrupt_interval + +From: Pavel Skripkin + +[ Upstream commit af35fc37354cda3c9c8cc4961b1d24bdc9d27903 ] + +Syzbot reported uninit value pegasus_probe(). The problem was in missing +error handling. + +get_interrupt_interval() internally calls read_eprom_word() which can +fail in some cases. For example: failed to receive usb control message. +These cases should be handled to prevent uninit value bug, since +read_eprom_word() will not initialize passed stack variable in case of +internal failure. + +Fail log: + +BUG: KMSAN: uninit-value in get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline] +BUG: KMSAN: uninit-value in pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152 +CPU: 1 PID: 825 Comm: kworker/1:1 Not tainted 5.12.0-rc6-syzkaller #0 +... +Workqueue: usb_hub_wq hub_event +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 + kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 + __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 + get_interrupt_interval drivers/net/usb/pegasus.c:746 [inline] + pegasus_probe+0x10e7/0x4080 drivers/net/usb/pegasus.c:1152 +.... + +Local variable ----data.i@pegasus_probe created at: + get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline] + pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152 + get_interrupt_interval drivers/net/usb/pegasus.c:1151 [inline] + pegasus_probe+0xe57/0x4080 drivers/net/usb/pegasus.c:1152 + +Reported-and-tested-by: syzbot+02c9f70f3afae308464a@syzkaller.appspotmail.com +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Pavel Skripkin +Link: https://lore.kernel.org/r/20210804143005.439-1-paskripkin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/usb/pegasus.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c +index 32e1335c94ad..0d7935924e58 100644 +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -736,12 +736,16 @@ static inline void disable_net_traffic(pegasus_t *pegasus) + set_registers(pegasus, EthCtrl0, sizeof(tmp), &tmp); + } + +-static inline void get_interrupt_interval(pegasus_t *pegasus) ++static inline int get_interrupt_interval(pegasus_t *pegasus) + { + u16 data; + u8 interval; ++ int ret; ++ ++ ret = read_eprom_word(pegasus, 4, &data); ++ if (ret < 0) ++ return ret; + +- read_eprom_word(pegasus, 4, &data); + interval = data >> 8; + if (pegasus->usb->speed != USB_SPEED_HIGH) { + if (interval < 0x80) { +@@ -756,6 +760,8 @@ static inline void get_interrupt_interval(pegasus_t *pegasus) + } + } + pegasus->intr_interval = interval; ++ ++ return 0; + } + + static void set_carrier(struct net_device *net) +@@ -1150,7 +1156,9 @@ static int pegasus_probe(struct usb_interface *intf, + | NETIF_MSG_PROBE | NETIF_MSG_LINK); + + pegasus->features = usb_dev_id[dev_index].private; +- get_interrupt_interval(pegasus); ++ res = get_interrupt_interval(pegasus); ++ if (res) ++ goto out2; + if (reset_mac(pegasus)) { + dev_err(&intf->dev, "can't reset MAC\n"); + res = -EIO; +-- +2.30.2 + diff --git a/queue-5.10/net-phy-micrel-fix-detection-of-ksz87xx-switch.patch b/queue-5.10/net-phy-micrel-fix-detection-of-ksz87xx-switch.patch new file mode 100644 index 00000000000..24c9734c656 --- /dev/null +++ b/queue-5.10/net-phy-micrel-fix-detection-of-ksz87xx-switch.patch @@ -0,0 +1,84 @@ +From b79cf552ee6d0f48c962ae1396e50118b2a3842d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Jul 2021 08:57:50 +1000 +Subject: net: phy: micrel: Fix detection of ksz87xx switch + +From: Steve Bennett + +[ Upstream commit a5e63c7d38d548b8dab6c6205e0b6af76899dbf5 ] + +The logic for discerning between KSZ8051 and KSZ87XX PHYs is incorrect +such that the that KSZ87XX switch is not identified correctly. + +ksz8051_ksz8795_match_phy_device() uses the parameter ksz_phy_id +to discriminate whether it was called from ksz8051_match_phy_device() +or from ksz8795_match_phy_device() but since PHY_ID_KSZ87XX is the +same value as PHY_ID_KSZ8051, this doesn't work. + +Instead use a bool to discriminate the caller. + +Without this patch, the KSZ8795 switch port identifies as: + +ksz8795-switch spi3.1 ade1 (uninitialized): PHY [dsa-0.1:03] driver [Generic PHY] + +With the patch, it identifies correctly: + +ksz8795-switch spi3.1 ade1 (uninitialized): PHY [dsa-0.1:03] driver [Micrel KSZ87XX Switch] + +Fixes: 8b95599c55ed24b36cf4 ("net: phy: micrel: Discern KSZ8051 and KSZ8795 PHYs") +Signed-off-by: Steve Bennett +Reviewed-by: Marek Vasut +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/micrel.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c +index 9b0bc8b74bc0..9a566c5b36a6 100644 +--- a/drivers/net/phy/micrel.c ++++ b/drivers/net/phy/micrel.c +@@ -349,11 +349,11 @@ static int ksz8041_config_aneg(struct phy_device *phydev) + } + + static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev, +- const u32 ksz_phy_id) ++ const bool ksz_8051) + { + int ret; + +- if ((phydev->phy_id & MICREL_PHY_ID_MASK) != ksz_phy_id) ++ if ((phydev->phy_id & MICREL_PHY_ID_MASK) != PHY_ID_KSZ8051) + return 0; + + ret = phy_read(phydev, MII_BMSR); +@@ -366,7 +366,7 @@ static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev, + * the switch does not. + */ + ret &= BMSR_ERCAP; +- if (ksz_phy_id == PHY_ID_KSZ8051) ++ if (ksz_8051) + return ret; + else + return !ret; +@@ -374,7 +374,7 @@ static int ksz8051_ksz8795_match_phy_device(struct phy_device *phydev, + + static int ksz8051_match_phy_device(struct phy_device *phydev) + { +- return ksz8051_ksz8795_match_phy_device(phydev, PHY_ID_KSZ8051); ++ return ksz8051_ksz8795_match_phy_device(phydev, true); + } + + static int ksz8081_config_init(struct phy_device *phydev) +@@ -402,7 +402,7 @@ static int ksz8061_config_init(struct phy_device *phydev) + + static int ksz8795_match_phy_device(struct phy_device *phydev) + { +- return ksz8051_ksz8795_match_phy_device(phydev, PHY_ID_KSZ87XX); ++ return ksz8051_ksz8795_match_phy_device(phydev, false); + } + + static int ksz9021_load_values_from_of(struct phy_device *phydev, +-- +2.30.2 + diff --git a/queue-5.10/net-sched-fix-lockdep_set_class-typo-error-for-sch-s.patch b/queue-5.10/net-sched-fix-lockdep_set_class-typo-error-for-sch-s.patch new file mode 100644 index 00000000000..0a00ed3a800 --- /dev/null +++ b/queue-5.10/net-sched-fix-lockdep_set_class-typo-error-for-sch-s.patch @@ -0,0 +1,41 @@ +From f116ebea25c52339ae62a761e2e0ba03fcd5f341 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 18:58:21 +0800 +Subject: net: sched: fix lockdep_set_class() typo error for sch->seqlock + +From: Yunsheng Lin + +[ Upstream commit 06f5553e0f0c2182268179b93856187d9cb86dd5 ] + +According to comment in qdisc_alloc(), sch->seqlock's lockdep +class key should be set to qdisc_tx_busylock, due to possible +type error, sch->busylock's lockdep class key is set to +qdisc_tx_busylock, which is duplicated because sch->busylock's +lockdep class key is already set in qdisc_alloc(). + +So fix it by replacing sch->busylock with sch->seqlock. + +Fixes: 96009c7d500e ("sched: replace __QDISC_STATE_RUNNING bit with a spin lock") +Signed-off-by: Yunsheng Lin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_generic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index 854d2b38db85..05aa2571a409 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -886,7 +886,7 @@ struct Qdisc *qdisc_alloc(struct netdev_queue *dev_queue, + + /* seqlock has the same scope of busylock, for NOLOCK qdisc */ + spin_lock_init(&sch->seqlock); +- lockdep_set_class(&sch->busylock, ++ lockdep_set_class(&sch->seqlock, + dev->qdisc_tx_busylock ?: &qdisc_tx_busylock); + + seqcount_init(&sch->running); +-- +2.30.2 + diff --git a/queue-5.10/net-vxge-fix-use-after-free-in-vxge_device_unregiste.patch b/queue-5.10/net-vxge-fix-use-after-free-in-vxge_device_unregiste.patch new file mode 100644 index 00000000000..f9216120982 --- /dev/null +++ b/queue-5.10/net-vxge-fix-use-after-free-in-vxge_device_unregiste.patch @@ -0,0 +1,53 @@ +From 224fb55b61f69b3073a007b1b6801737c4fd2340 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 18:52:20 +0300 +Subject: net: vxge: fix use-after-free in vxge_device_unregister + +From: Pavel Skripkin + +[ Upstream commit 942e560a3d3862dd5dee1411dbdd7097d29b8416 ] + +Smatch says: +drivers/net/ethernet/neterion/vxge/vxge-main.c:3518 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev); +drivers/net/ethernet/neterion/vxge/vxge-main.c:3518 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev); +drivers/net/ethernet/neterion/vxge/vxge-main.c:3520 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev); +drivers/net/ethernet/neterion/vxge/vxge-main.c:3520 vxge_device_unregister() error: Using vdev after free_{netdev,candev}(dev); + +Since vdev pointer is netdev private data accessing it after free_netdev() +call can cause use-after-free bug. Fix it by moving free_netdev() call at +the end of the function + +Fixes: 6cca200362b4 ("vxge: cleanup probe error paths") +Reported-by: Dan Carpenter +Signed-off-by: Pavel Skripkin +Reviewed-by: Jesse Brandeburg +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/neterion/vxge/vxge-main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/neterion/vxge/vxge-main.c b/drivers/net/ethernet/neterion/vxge/vxge-main.c +index 87892bd992b1..56556373548c 100644 +--- a/drivers/net/ethernet/neterion/vxge/vxge-main.c ++++ b/drivers/net/ethernet/neterion/vxge/vxge-main.c +@@ -3527,13 +3527,13 @@ static void vxge_device_unregister(struct __vxge_hw_device *hldev) + + kfree(vdev->vpaths); + +- /* we are safe to free it now */ +- free_netdev(dev); +- + vxge_debug_init(vdev->level_trace, "%s: ethernet device unregistered", + buf); + vxge_debug_entryexit(vdev->level_trace, "%s: %s:%d Exiting...", buf, + __func__, __LINE__); ++ ++ /* we are safe to free it now */ ++ free_netdev(dev); + } + + /* +-- +2.30.2 + diff --git a/queue-5.10/net-xfrm-fix-memory-leak-in-xfrm_user_rcv_msg.patch b/queue-5.10/net-xfrm-fix-memory-leak-in-xfrm_user_rcv_msg.patch new file mode 100644 index 00000000000..b1d1a59c958 --- /dev/null +++ b/queue-5.10/net-xfrm-fix-memory-leak-in-xfrm_user_rcv_msg.patch @@ -0,0 +1,50 @@ +From bb3f2dc540be72686859ff2f2e11f26bdc5e30f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 13:23:54 +0300 +Subject: net: xfrm: fix memory leak in xfrm_user_rcv_msg + +From: Pavel Skripkin + +[ Upstream commit 7c1a80e80cde008f271bae630d28cf684351e807 ] + +Syzbot reported memory leak in xfrm_user_rcv_msg(). The +problem was is non-freed skb's frag_list. + +In skb_release_all() skb_release_data() will be called only +in case of skb->head != NULL, but netlink_skb_destructor() +sets head to NULL. So, allocated frag_list skb should be +freed manualy, since consume_skb() won't take care of it + +Fixes: 5106f4a8acff ("xfrm/compat: Add 32=>64-bit messages translator") +Reported-and-tested-by: syzbot+fb347cf82c73a90efcca@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_user.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 45f86a97eaf2..6f97665b632e 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -2751,6 +2751,16 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, + + err = link->doit(skb, nlh, attrs); + ++ /* We need to free skb allocated in xfrm_alloc_compat() before ++ * returning from this function, because consume_skb() won't take ++ * care of frag_list since netlink destructor sets ++ * sbk->head to NULL. (see netlink_skb_destructor()) ++ */ ++ if (skb_has_frag_list(skb)) { ++ kfree_skb(skb_shinfo(skb)->frag_list); ++ skb_shinfo(skb)->frag_list = NULL; ++ } ++ + err: + kvfree(nlh64); + return err; +-- +2.30.2 + diff --git a/queue-5.10/nfp-update-ethtool-reporting-of-pauseframe-control.patch b/queue-5.10/nfp-update-ethtool-reporting-of-pauseframe-control.patch new file mode 100644 index 00000000000..e8f651d48f1 --- /dev/null +++ b/queue-5.10/nfp-update-ethtool-reporting-of-pauseframe-control.patch @@ -0,0 +1,39 @@ +From 4e74e191db250a92c3286da5fa9e42e29ec9550a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 12:39:11 +0200 +Subject: nfp: update ethtool reporting of pauseframe control + +From: Fei Qin + +[ Upstream commit 9fdc5d85a8fe684cdf24dc31c6bc4a727decfe87 ] + +Pauseframe control is set to symmetric mode by default on the NFP. +Pause frames can not be configured through ethtool now, but ethtool can +report the supported mode. + +Fixes: 265aeb511bd5 ("nfp: add support for .get_link_ksettings()") +Signed-off-by: Fei Qin +Signed-off-by: Louis Peens +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index 9c9ae33d84ce..c036a1d0f8de 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -286,6 +286,8 @@ nfp_net_get_link_ksettings(struct net_device *netdev, + + /* Init to unknowns */ + ethtool_link_ksettings_add_link_mode(cmd, supported, FIBRE); ++ ethtool_link_ksettings_add_link_mode(cmd, supported, Pause); ++ ethtool_link_ksettings_add_link_mode(cmd, advertising, Pause); + cmd->base.port = PORT_OTHER; + cmd->base.speed = SPEED_UNKNOWN; + cmd->base.duplex = DUPLEX_UNKNOWN; +-- +2.30.2 + diff --git a/queue-5.10/omap5-board-common-remove-not-physically-existing-vd.patch b/queue-5.10/omap5-board-common-remove-not-physically-existing-vd.patch new file mode 100644 index 00000000000..79aa4fb160e --- /dev/null +++ b/queue-5.10/omap5-board-common-remove-not-physically-existing-vd.patch @@ -0,0 +1,80 @@ +From b6012389b7089e98334032e1df254601460b7837 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jul 2021 16:00:22 +0200 +Subject: omap5-board-common: remove not physically existing vdds_1v8_main + fixed-regulator + +From: H. Nikolaus Schaller + +[ Upstream commit c68ef4ad180e09805fa46965d15e1dfadf09ffa5 ] + +This device tree include file describes a fixed-regulator +connecting smps7_reg output (1.8V) to some 1.8V rail and +consumers (vdds_1v8_main). + +This regulator does not physically exist. + +I assume it was introduced as a wrapper around smps7_reg +to provide a speaking signal name "vdds_1v8_main" as label. + +This fixed-regulator without real function was not an issue +in driver code until + + Commit 98e48cd9283d ("regulator: core: resolve supply for boot-on/always-on regulators") + +introduced a new check for regulator initialization which +makes Palmas regulator registration fail: + +[ 5.407712] ldo1: supplied by vsys_cobra +[ 5.412748] ldo2: supplied by vsys_cobra +[ 5.417603] palmas-pmic 48070000.i2c:palmas@48:palmas_pmic: failed to register 48070000.i2c:palmas@48:palmas_pmic regulator + +The reason is that the supply-chain of regulators is too +long and goes from ldo3 through the virtual vdds_1v8_main +regulator and then back to smps7. This adds a cross-dependency +of probing Palmas regulators and the fixed-regulator which +leads to probe deferral by the new check and is no longer +resolved. + +Since we do not control what device tree files including this +one reference (either &vdds_1v8_main or &smps7_reg or both) +we keep both labels for smps7 for compatibility. + +Fixes: 98e48cd9283d ("regulator: core: resolve supply for boot-on/always-on regulators") +Signed-off-by: H. Nikolaus Schaller +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap5-board-common.dtsi | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/arch/arm/boot/dts/omap5-board-common.dtsi b/arch/arm/boot/dts/omap5-board-common.dtsi +index d8f13626cfd1..3a8f10231475 100644 +--- a/arch/arm/boot/dts/omap5-board-common.dtsi ++++ b/arch/arm/boot/dts/omap5-board-common.dtsi +@@ -30,14 +30,6 @@ + regulator-max-microvolt = <5000000>; + }; + +- vdds_1v8_main: fixedregulator-vdds_1v8_main { +- compatible = "regulator-fixed"; +- regulator-name = "vdds_1v8_main"; +- vin-supply = <&smps7_reg>; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- }; +- + vmmcsd_fixed: fixedregulator-mmcsd { + compatible = "regulator-fixed"; + regulator-name = "vmmcsd_fixed"; +@@ -487,6 +479,7 @@ + regulator-boot-on; + }; + ++ vdds_1v8_main: + smps7_reg: smps7 { + /* VDDS_1v8_OMAP over VDDS_1v8_MAIN */ + regulator-name = "smps7"; +-- +2.30.2 + diff --git a/queue-5.10/rdma-mlx5-delay-emptying-a-cache-entry-when-a-new-mr.patch b/queue-5.10/rdma-mlx5-delay-emptying-a-cache-entry-when-a-new-mr.patch new file mode 100644 index 00000000000..7e954aa1757 --- /dev/null +++ b/queue-5.10/rdma-mlx5-delay-emptying-a-cache-entry-when-a-new-mr.patch @@ -0,0 +1,44 @@ +From 3c1e708d4ff7118ddf3792320572760926ccf108 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 10:16:06 +0300 +Subject: RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it + recently + +From: Aharon Landau + +[ Upstream commit d6793ca97b76642b77629dd0783ec64782a50bdb ] + +Fixing a typo that causes a cache entry to shrink immediately after adding +to it new MRs if the entry size exceeds the high limit. In doing so, the +cache misses its purpose to prevent the creation of new mkeys on the +runtime by using the cached ones. + +Fixes: b9358bdbc713 ("RDMA/mlx5: Fix locking in MR cache work queue") +Link: https://lore.kernel.org/r/fcb546986be346684a016f5ca23a0567399145fa.1627370131.git.leonro@nvidia.com +Signed-off-by: Aharon Landau +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mr.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 971694e781b6..19346693c1da 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -526,8 +526,8 @@ static void __cache_work_func(struct mlx5_cache_ent *ent) + */ + spin_unlock_irq(&ent->lock); + need_delay = need_resched() || someone_adding(cache) || +- time_after(jiffies, +- READ_ONCE(cache->last_add) + 300 * HZ); ++ !time_after(jiffies, ++ READ_ONCE(cache->last_add) + 300 * HZ); + spin_lock_irq(&ent->lock); + if (ent->disabled) + goto out; +-- +2.30.2 + diff --git a/queue-5.10/scsi-sr-return-correct-event-when-media-event-code-i.patch b/queue-5.10/scsi-sr-return-correct-event-when-media-event-code-i.patch new file mode 100644 index 00000000000..552455483b3 --- /dev/null +++ b/queue-5.10/scsi-sr-return-correct-event-when-media-event-code-i.patch @@ -0,0 +1,46 @@ +From 87dfb09c5b0310952f40788c52bf685d7cbfd91f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jul 2021 19:49:13 +0800 +Subject: scsi: sr: Return correct event when media event code is 3 + +From: Li Manyi + +[ Upstream commit 5c04243a56a7977185b00400e59ca7e108004faf ] + +Media event code 3 is defined in the MMC-6 spec as follows: + + "MediaRemoval: The media has been removed from the specified slot, and + the Drive is unable to access the media without user intervention. This + applies to media changers only." + +This indicated that treating the condition as an EJECT_REQUEST was +appropriate. However, doing so had the unfortunate side-effect of causing +the drive tray to be physically ejected on resume. Instead treat the event +as a MEDIA_CHANGE request. + +Fixes: 7dd753ca59d6 ("scsi: sr: Return appropriate error code when disk is ejected") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=213759 +Link: https://lore.kernel.org/r/20210726114913.6760-1-limanyi@uniontech.com +Signed-off-by: Li Manyi +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/sr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c +index 726b7048a767..4cb4ab9c6137 100644 +--- a/drivers/scsi/sr.c ++++ b/drivers/scsi/sr.c +@@ -221,7 +221,7 @@ static unsigned int sr_get_events(struct scsi_device *sdev) + else if (med->media_event_code == 2) + return DISK_EVENT_MEDIA_CHANGE; + else if (med->media_event_code == 3) +- return DISK_EVENT_EJECT_REQUEST; ++ return DISK_EVENT_MEDIA_CHANGE; + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.10/sctp-move-the-active_key-update-after-sh_keys-is-add.patch b/queue-5.10/sctp-move-the-active_key-update-after-sh_keys-is-add.patch new file mode 100644 index 00000000000..9bd53ae1f9c --- /dev/null +++ b/queue-5.10/sctp-move-the-active_key-update-after-sh_keys-is-add.patch @@ -0,0 +1,68 @@ +From a98aa4745164d1538304043bbbcbd496e7c0bedf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 1 Aug 2021 02:25:31 -0400 +Subject: sctp: move the active_key update after sh_keys is added + +From: Xin Long + +[ Upstream commit ae954bbc451d267f7d60d7b49db811d5a68ebd7b ] + +In commit 58acd1009226 ("sctp: update active_key for asoc when old key is +being replaced"), sctp_auth_asoc_init_active_key() is called to update +the active_key right after the old key is deleted and before the new key +is added, and it caused that the active_key could be found with the key_id. + +In Ying Xu's testing, the BUG_ON in sctp_auth_asoc_init_active_key() was +triggered: + + [ ] kernel BUG at net/sctp/auth.c:416! + [ ] RIP: 0010:sctp_auth_asoc_init_active_key.part.8+0xe7/0xf0 [sctp] + [ ] Call Trace: + [ ] sctp_auth_set_key+0x16d/0x1b0 [sctp] + [ ] sctp_setsockopt.part.33+0x1ba9/0x2bd0 [sctp] + [ ] __sys_setsockopt+0xd6/0x1d0 + [ ] __x64_sys_setsockopt+0x20/0x30 + [ ] do_syscall_64+0x5b/0x1a0 + +So fix it by moving the active_key update after sh_keys is added. + +Fixes: 58acd1009226 ("sctp: update active_key for asoc when old key is being replaced") +Reported-by: Ying Xu +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sctp/auth.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/net/sctp/auth.c b/net/sctp/auth.c +index fe74c5f95630..db6b7373d16c 100644 +--- a/net/sctp/auth.c ++++ b/net/sctp/auth.c +@@ -857,14 +857,18 @@ int sctp_auth_set_key(struct sctp_endpoint *ep, + memcpy(key->data, &auth_key->sca_key[0], auth_key->sca_keylength); + cur_key->key = key; + +- if (replace) { +- list_del_init(&shkey->key_list); +- sctp_auth_shkey_release(shkey); +- if (asoc && asoc->active_key_id == auth_key->sca_keynumber) +- sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL); ++ if (!replace) { ++ list_add(&cur_key->key_list, sh_keys); ++ return 0; + } ++ ++ list_del_init(&shkey->key_list); ++ sctp_auth_shkey_release(shkey); + list_add(&cur_key->key_list, sh_keys); + ++ if (asoc && asoc->active_key_id == auth_key->sca_keynumber) ++ sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL); ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.10/series b/queue-5.10/series new file mode 100644 index 00000000000..1d281e55fd4 --- /dev/null +++ b/queue-5.10/series @@ -0,0 +1,49 @@ +bus-ti-sysc-fix-gpt12-system-timer-issue-with-reserv.patch +net-xfrm-fix-memory-leak-in-xfrm_user_rcv_msg.patch +arm64-dts-ls1028a-fix-node-name-for-the-sysclk.patch +arm-imx-add-missing-iounmap.patch +arm-imx-add-missing-clk_disable_unprepare.patch +arm-dts-imx6qdl-sr-som-increase-the-phy-reset-durati.patch +arm64-dts-ls1028-sl28-fix-networking-for-variant-2.patch +arm-dts-colibri-imx6ull-limit-sdio-clock-to-25mhz.patch +arm-imx-fix-missing-3rd-argument-in-macro-imx_mmdc_p.patch +arm-dts-imx-swap-m53menlo-pinctrl_power_button-pinct.patch +arm64-dts-armada-3720-turris-mox-fixed-indices-for-t.patch +arm64-dts-armada-3720-turris-mox-remove-mrvl-i2c-fas.patch +alsa-usb-audio-fix-incorrect-clock-source-setting.patch +clk-stm32f4-fix-post-divisor-setup-for-i2s-sai-plls.patch +arm-dts-am437x-l4-fix-typo-in-can-0-node.patch +omap5-board-common-remove-not-physically-existing-vd.patch +dmaengine-uniphier-xdmac-use-readl_poll_timeout_atom.patch +clk-tegra-implement-disable_unused-of-tegra_clk_sdmm.patch +dmaengine-stm32-dma-fix-pm-usage-counter-imbalance-i.patch +dmaengine-stm32-dmamux-fix-pm-usage-counter-unbalanc.patch +spi-imx-mx51-ecspi-reinstate-low-speed-configreg-del.patch +spi-imx-mx51-ecspi-fix-low-speed-configreg-delay-cal.patch +scsi-sr-return-correct-event-when-media-event-code-i.patch +media-videobuf2-core-dequeue-if-start_streaming-fail.patch +arm-dts-stm32-disable-lan8710-edpd-on-dhcom.patch +arm-dts-stm32-fix-touchscreen-irq-line-assignment-on.patch +dmaengine-imx-dma-configure-the-generic-dma-type-to-.patch +net-gro-set-inner-transport-header-offset-in-tcp-udp.patch +net-dsa-sja1105-overwrite-dynamic-fdb-entries-with-s.patch +net-dsa-sja1105-invalidate-dynamic-fdb-entries-learn.patch +net-dsa-sja1105-be-stateless-with-fdb-entries-on-sja.patch +net-dsa-sja1105-match-fdb-entries-regardless-of-inne.patch +net-phy-micrel-fix-detection-of-ksz87xx-switch.patch +net-natsemi-fix-missing-pci_disable_device-in-probe-.patch +gpio-tqmx86-really-make-irq-optional.patch +rdma-mlx5-delay-emptying-a-cache-entry-when-a-new-mr.patch +sctp-move-the-active_key-update-after-sh_keys-is-add.patch +nfp-update-ethtool-reporting-of-pauseframe-control.patch +net-ipv6-fix-returned-variable-type-in-ip6_skb_dst_m.patch +net-dsa-qca-ar9331-reorder-mdio-write-sequence.patch +net-sched-fix-lockdep_set_class-typo-error-for-sch-s.patch +mips-check-return-value-of-pgtable_pmd_page_ctor.patch +mips-fix-non-posix-regexp.patch +bnx2x-fix-an-error-code-in-bnx2x_nic_load.patch +net-pegasus-fix-uninit-value-in-get_interrupt_interv.patch +net-fec-fix-use-after-free-in-fec_drv_remove.patch +net-vxge-fix-use-after-free-in-vxge_device_unregiste.patch +blk-iolatency-error-out-if-blk_get_queue-failed-in-i.patch +bluetooth-defer-cleanup-of-resources-in-hci_unregist.patch diff --git a/queue-5.10/spi-imx-mx51-ecspi-fix-low-speed-configreg-delay-cal.patch b/queue-5.10/spi-imx-mx51-ecspi-fix-low-speed-configreg-delay-cal.patch new file mode 100644 index 00000000000..7291559d6f7 --- /dev/null +++ b/queue-5.10/spi-imx-mx51-ecspi-fix-low-speed-configreg-delay-cal.patch @@ -0,0 +1,74 @@ +From fd5f8235a9767bf8d589ff305724849c3a00c71f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jul 2021 12:01:02 +0200 +Subject: spi: imx: mx51-ecspi: Fix low-speed CONFIGREG delay calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit 53ca18acbe645656132fb5a329833db711067e54 ] + +The spi_imx->spi_bus_clk may be uninitialized and thus also zero in +mx51_ecspi_prepare_message(), which would lead to division by zero +in kernel. Since bitbang .setup_transfer callback which initializes +the spi_imx->spi_bus_clk is called after bitbang prepare_message +callback, iterate over all the transfers in spi_message, find the +one with lowest bus frequency, and use that bus frequency for the +delay calculation. + +Note that it is not possible to move this CONFIGREG delay back into +the .setup_transfer callback, because that is invoked too late, after +the GPIO chipselects were already configured. + +Fixes: 135cbd378eab ("spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay") +Signed-off-by: Marek Vasut +Cc: Uwe Kleine-König +Cc: Mark Brown +Link: https://lore.kernel.org/r/20210726100102.5188-1-marex@denx.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index 8c0a6ea941ad..0e3bc0b0a526 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -505,7 +505,9 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx, + struct spi_message *msg) + { + struct spi_device *spi = msg->spi; ++ struct spi_transfer *xfer; + u32 ctrl = MX51_ECSPI_CTRL_ENABLE; ++ u32 min_speed_hz = ~0U; + u32 testreg, delay; + u32 cfg = readl(spi_imx->base + MX51_ECSPI_CONFIG); + +@@ -577,8 +579,20 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx, + * be asserted before the SCLK polarity changes, which would disrupt + * the SPI communication as the device on the other end would consider + * the change of SCLK polarity as a clock tick already. ++ * ++ * Because spi_imx->spi_bus_clk is only set in bitbang prepare_message ++ * callback, iterate over all the transfers in spi_message, find the ++ * one with lowest bus frequency, and use that bus frequency for the ++ * delay calculation. In case all transfers have speed_hz == 0, then ++ * min_speed_hz is ~0 and the resulting delay is zero. + */ +- delay = (2 * 1000000) / spi_imx->spi_bus_clk; ++ list_for_each_entry(xfer, &msg->transfers, transfer_list) { ++ if (!xfer->speed_hz) ++ continue; ++ min_speed_hz = min(xfer->speed_hz, min_speed_hz); ++ } ++ ++ delay = (2 * 1000000) / min_speed_hz; + if (likely(delay < 10)) /* SCLK is faster than 100 kHz */ + udelay(delay); + else /* SCLK is _very_ slow */ +-- +2.30.2 + diff --git a/queue-5.10/spi-imx-mx51-ecspi-reinstate-low-speed-configreg-del.patch b/queue-5.10/spi-imx-mx51-ecspi-reinstate-low-speed-configreg-del.patch new file mode 100644 index 00000000000..089ecc2ab4b --- /dev/null +++ b/queue-5.10/spi-imx-mx51-ecspi-reinstate-low-speed-configreg-del.patch @@ -0,0 +1,107 @@ +From ea7fd834362d88992780bd8514742064e994897f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jul 2021 04:23:00 +0200 +Subject: spi: imx: mx51-ecspi: Reinstate low-speed CONFIGREG delay +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Vasut + +[ Upstream commit 135cbd378eab336da15de9c84bbb22bf743b38a5 ] + +Since 00b80ac935539 ("spi: imx: mx51-ecspi: Move some initialisation to +prepare_message hook."), the MX51_ECSPI_CONFIG write no longer happens +in prepare_transfer hook, but rather in prepare_message hook, however +the MX51_ECSPI_CONFIG delay is still left in prepare_transfer hook and +thus has no effect. This leads to low bus frequency operation problems +described in 6fd8b8503a0dc ("spi: spi-imx: Fix out-of-order CS/SCLK +operation at low speeds") again. + +Move the MX51_ECSPI_CONFIG write delay into the prepare_message hook +as well, thus reinstating the low bus frequency fix. + +Fixes: 00b80ac935539 ("spi: imx: mx51-ecspi: Move some initialisation to prepare_message hook.") +Signed-off-by: Marek Vasut +Cc: Uwe Kleine-König +Cc: Mark Brown +Link: https://lore.kernel.org/r/20210703022300.296114-1-marex@denx.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-imx.c | 38 +++++++++++++++++++------------------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c +index c8b750d8ac35..8c0a6ea941ad 100644 +--- a/drivers/spi/spi-imx.c ++++ b/drivers/spi/spi-imx.c +@@ -506,7 +506,7 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx, + { + struct spi_device *spi = msg->spi; + u32 ctrl = MX51_ECSPI_CTRL_ENABLE; +- u32 testreg; ++ u32 testreg, delay; + u32 cfg = readl(spi_imx->base + MX51_ECSPI_CONFIG); + + /* set Master or Slave mode */ +@@ -567,6 +567,23 @@ static int mx51_ecspi_prepare_message(struct spi_imx_data *spi_imx, + + writel(cfg, spi_imx->base + MX51_ECSPI_CONFIG); + ++ /* ++ * Wait until the changes in the configuration register CONFIGREG ++ * propagate into the hardware. It takes exactly one tick of the ++ * SCLK clock, but we will wait two SCLK clock just to be sure. The ++ * effect of the delay it takes for the hardware to apply changes ++ * is noticable if the SCLK clock run very slow. In such a case, if ++ * the polarity of SCLK should be inverted, the GPIO ChipSelect might ++ * be asserted before the SCLK polarity changes, which would disrupt ++ * the SPI communication as the device on the other end would consider ++ * the change of SCLK polarity as a clock tick already. ++ */ ++ delay = (2 * 1000000) / spi_imx->spi_bus_clk; ++ if (likely(delay < 10)) /* SCLK is faster than 100 kHz */ ++ udelay(delay); ++ else /* SCLK is _very_ slow */ ++ usleep_range(delay, delay + 10); ++ + return 0; + } + +@@ -574,7 +591,7 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx, + struct spi_device *spi) + { + u32 ctrl = readl(spi_imx->base + MX51_ECSPI_CTRL); +- u32 clk, delay; ++ u32 clk; + + /* Clear BL field and set the right value */ + ctrl &= ~MX51_ECSPI_CTRL_BL_MASK; +@@ -596,23 +613,6 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx, + + writel(ctrl, spi_imx->base + MX51_ECSPI_CTRL); + +- /* +- * Wait until the changes in the configuration register CONFIGREG +- * propagate into the hardware. It takes exactly one tick of the +- * SCLK clock, but we will wait two SCLK clock just to be sure. The +- * effect of the delay it takes for the hardware to apply changes +- * is noticable if the SCLK clock run very slow. In such a case, if +- * the polarity of SCLK should be inverted, the GPIO ChipSelect might +- * be asserted before the SCLK polarity changes, which would disrupt +- * the SPI communication as the device on the other end would consider +- * the change of SCLK polarity as a clock tick already. +- */ +- delay = (2 * 1000000) / clk; +- if (likely(delay < 10)) /* SCLK is faster than 100 kHz */ +- udelay(delay); +- else /* SCLK is _very_ slow */ +- usleep_range(delay, delay + 10); +- + return 0; + } + +-- +2.30.2 + -- 2.47.3