From c8838a914435f75f3703d686c9636f7a3ab637c2 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 26 Sep 2021 18:59:05 -0400 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...t-triggering-of-sillyrename-on-3rd-p.patch | 168 +++++++++++++++++ ...ng-of-i_blocks-on-file-dir-extension.patch | 118 ++++++++++++ ...ntic-fix-issue-in-the-pm-resume-flow.patch | 47 +++++ ...imeout-when-tx-ring-size-is-set-to-t.patch | 105 +++++++++++ ...al-access-when-reading-affinity_hint.patch | 54 ++++++ ...ialized-struct-dim_sample-field-usag.patch | 45 +++++ ...x-void-functions-to-remove-return-va.patch | 45 +++++ ...signal-add-sve-to-the-set-of-feature.patch | 63 +++++++ ...signal-skip-tests-if-required-featur.patch | 55 ++++++ ...locate-the-slave_mii_bus-using-devre.patch | 167 ++++++++++++++++ ...k-register-the-mdio-bus-under-devres.patch | 113 +++++++++++ ...s3-check-queue-id-range-before-using.patch | 47 +++++ ...x-change-rss-hfunc-ineffective-issue.patch | 178 ++++++++++++++++++ ...suse-vf-id-and-vport-id-in-some-logs.patch | 125 ++++++++++++ ...t-allow-arfs-for-encapsulated-packet.patch | 38 ++++ ...-mlx4_en-resolve-bad-operstate-value.patch | 127 +++++++++++++ ...sing-error-check-in-smc_clc_prfx_set.patch | 45 +++++ ...queue-leaked-lock-in-smc_conn_abort_.patch | 48 +++++ ...el-punit_ipc-drop-wrong-use-of-acpi_.patch | 50 +++++ ...ait-for-resources-under-hw-error-rec.patch | 65 +++++++ ...fix-deadlock-during-failing-recovery.patch | 107 +++++++++++ ...ll-deref-in-qeth_clear_working_pool_.patch | 60 ++++++ queue-5.10/series | 22 +++ 23 files changed, 1892 insertions(+) create mode 100644 queue-5.10/afs-fix-incorrect-triggering-of-sillyrename-on-3rd-p.patch create mode 100644 queue-5.10/afs-fix-updating-of-i_blocks-on-file-dir-extension.patch create mode 100644 queue-5.10/atlantic-fix-issue-in-the-pm-resume-flow.patch create mode 100644 queue-5.10/bnxt_en-fix-tx-timeout-when-tx-ring-size-is-set-to-t.patch create mode 100644 queue-5.10/enetc-fix-illegal-access-when-reading-affinity_hint.patch create mode 100644 queue-5.10/enetc-fix-uninitialized-struct-dim_sample-field-usag.patch create mode 100644 queue-5.10/gpio-uniphier-fix-void-functions-to-remove-return-va.patch create mode 100644 queue-5.10/kselftest-arm64-signal-add-sve-to-the-set-of-feature.patch create mode 100644 queue-5.10/kselftest-arm64-signal-skip-tests-if-required-featur.patch create mode 100644 queue-5.10/net-dsa-don-t-allocate-the-slave_mii_bus-using-devre.patch create mode 100644 queue-5.10/net-dsa-realtek-register-the-mdio-bus-under-devres.patch create mode 100644 queue-5.10/net-hns3-check-queue-id-range-before-using.patch create mode 100644 queue-5.10/net-hns3-fix-change-rss-hfunc-ineffective-issue.patch create mode 100644 queue-5.10/net-hns3-fix-misuse-vf-id-and-vport-id-in-some-logs.patch create mode 100644 queue-5.10/net-mlx4_en-don-t-allow-arfs-for-encapsulated-packet.patch create mode 100644 queue-5.10/net-mlx4_en-resolve-bad-operstate-value.patch create mode 100644 queue-5.10/net-smc-add-missing-error-check-in-smc_clc_prfx_set.patch create mode 100644 queue-5.10/net-smc-fix-workqueue-leaked-lock-in-smc_conn_abort_.patch create mode 100644 queue-5.10/platform-x86-intel-punit_ipc-drop-wrong-use-of-acpi_.patch create mode 100644 queue-5.10/qed-rdma-don-t-wait-for-resources-under-hw-error-rec.patch create mode 100644 queue-5.10/s390-qeth-fix-deadlock-during-failing-recovery.patch create mode 100644 queue-5.10/s390-qeth-fix-null-deref-in-qeth_clear_working_pool_.patch diff --git a/queue-5.10/afs-fix-incorrect-triggering-of-sillyrename-on-3rd-p.patch b/queue-5.10/afs-fix-incorrect-triggering-of-sillyrename-on-3rd-p.patch new file mode 100644 index 00000000000..19267953cec --- /dev/null +++ b/queue-5.10/afs-fix-incorrect-triggering-of-sillyrename-on-3rd-p.patch @@ -0,0 +1,168 @@ +From 782f7ca2f1b0d029efbdb8cf4a97166d64aa7e07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 18:11:33 +0100 +Subject: afs: Fix incorrect triggering of sillyrename on 3rd-party + invalidation + +From: David Howells + +[ Upstream commit 63d49d843ef5fffeea069e0ffdfbd2bf40ba01c6 ] + +The AFS filesystem is currently triggering the silly-rename cleanup from +afs_d_revalidate() when it sees that a dentry has been changed by a third +party[1]. It should not be doing this as the cleanup includes deleting the +silly-rename target file on iput. + +Fix this by removing the places in the d_revalidate handling that validate +anything other than the directory and the dirent. It probably should not +be looking to validate the target inode of the dentry also. + +This includes removing the point in afs_d_revalidate() where the inode that +a dentry used to point to was marked as being deleted (AFS_VNODE_DELETED). +We don't know it got deleted. It could have been renamed or it could have +hard links remaining. + +This was reproduced by cloning a git repo onto an afs volume on one +machine, switching to another machine and doing "git status", then +switching back to the first and doing "git status". The second status +would show weird output due to ".git/index" getting deleted by the above +mentioned mechanism. + +A simpler way to do it is to do: + + machine 1: touch a + machine 2: touch b; mv -f b a + machine 1: stat a + +on an afs volume. The bug shows up as the stat failing with ENOENT and the +file server log showing that machine 1 deleted "a". + +Fixes: 79ddbfa500b3 ("afs: Implement sillyrename for unlink and rename") +Reported-by: Markus Suvanto +Signed-off-by: David Howells +Tested-by: Markus Suvanto +cc: linux-afs@lists.infradead.org +Link: https://bugzilla.kernel.org/show_bug.cgi?id=214217#c4 [1] +Link: https://lore.kernel.org/r/163111668100.283156.3851669884664475428.stgit@warthog.procyon.org.uk/ +Signed-off-by: Sasha Levin +--- + fs/afs/dir.c | 46 +++++++--------------------------------------- + 1 file changed, 7 insertions(+), 39 deletions(-) + +diff --git a/fs/afs/dir.c b/fs/afs/dir.c +index 92d7fd7436cb..262c0ae505af 100644 +--- a/fs/afs/dir.c ++++ b/fs/afs/dir.c +@@ -997,9 +997,9 @@ static struct dentry *afs_lookup(struct inode *dir, struct dentry *dentry, + */ + static int afs_d_revalidate_rcu(struct dentry *dentry) + { +- struct afs_vnode *dvnode, *vnode; ++ struct afs_vnode *dvnode; + struct dentry *parent; +- struct inode *dir, *inode; ++ struct inode *dir; + long dir_version, de_version; + + _enter("%p", dentry); +@@ -1029,18 +1029,6 @@ static int afs_d_revalidate_rcu(struct dentry *dentry) + return -ECHILD; + } + +- /* Check to see if the vnode referred to by the dentry still +- * has a callback. +- */ +- if (d_really_is_positive(dentry)) { +- inode = d_inode_rcu(dentry); +- if (inode) { +- vnode = AFS_FS_I(inode); +- if (!afs_check_validity(vnode)) +- return -ECHILD; +- } +- } +- + return 1; /* Still valid */ + } + +@@ -1076,17 +1064,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags) + if (IS_ERR(key)) + key = NULL; + +- if (d_really_is_positive(dentry)) { +- inode = d_inode(dentry); +- if (inode) { +- vnode = AFS_FS_I(inode); +- afs_validate(vnode, key); +- if (test_bit(AFS_VNODE_DELETED, &vnode->flags)) +- goto out_bad; +- } +- } +- +- /* lock down the parent dentry so we can peer at it */ ++ /* Hold the parent dentry so we can peer at it */ + parent = dget_parent(dentry); + dir = AFS_FS_I(d_inode(parent)); + +@@ -1095,7 +1073,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags) + + if (test_bit(AFS_VNODE_DELETED, &dir->flags)) { + _debug("%pd: parent dir deleted", dentry); +- goto out_bad_parent; ++ goto not_found; + } + + /* We only need to invalidate a dentry if the server's copy changed +@@ -1121,12 +1099,12 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags) + case 0: + /* the filename maps to something */ + if (d_really_is_negative(dentry)) +- goto out_bad_parent; ++ goto not_found; + inode = d_inode(dentry); + if (is_bad_inode(inode)) { + printk("kAFS: afs_d_revalidate: %pd2 has bad inode\n", + dentry); +- goto out_bad_parent; ++ goto not_found; + } + + vnode = AFS_FS_I(inode); +@@ -1148,9 +1126,6 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags) + dentry, fid.unique, + vnode->fid.unique, + vnode->vfs_inode.i_generation); +- write_seqlock(&vnode->cb_lock); +- set_bit(AFS_VNODE_DELETED, &vnode->flags); +- write_sequnlock(&vnode->cb_lock); + goto not_found; + } + goto out_valid; +@@ -1165,7 +1140,7 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags) + default: + _debug("failed to iterate dir %pd: %d", + parent, ret); +- goto out_bad_parent; ++ goto not_found; + } + + out_valid: +@@ -1176,16 +1151,9 @@ static int afs_d_revalidate(struct dentry *dentry, unsigned int flags) + _leave(" = 1 [valid]"); + return 1; + +- /* the dirent, if it exists, now points to a different vnode */ + not_found: +- spin_lock(&dentry->d_lock); +- dentry->d_flags |= DCACHE_NFSFS_RENAMED; +- spin_unlock(&dentry->d_lock); +- +-out_bad_parent: + _debug("dropping dentry %pd2", dentry); + dput(parent); +-out_bad: + key_put(key); + + _leave(" = 0 [bad]"); +-- +2.33.0 + diff --git a/queue-5.10/afs-fix-updating-of-i_blocks-on-file-dir-extension.patch b/queue-5.10/afs-fix-updating-of-i_blocks-on-file-dir-extension.patch new file mode 100644 index 00000000000..786ae085a72 --- /dev/null +++ b/queue-5.10/afs-fix-updating-of-i_blocks-on-file-dir-extension.patch @@ -0,0 +1,118 @@ +From 75e715874482d9aeeab1d18630f853c5d6e9e87f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Sep 2021 21:55:19 +0100 +Subject: afs: Fix updating of i_blocks on file/dir extension + +From: David Howells + +[ Upstream commit 9d37e1cab2a9d2cee2737973fa455e6f89eee46a ] + +When an afs file or directory is modified locally such that the total file +size is extended, i_blocks needs to be recalculated too. + +Fix this by making afs_write_end() and afs_edit_dir_add() call +afs_set_i_size() rather than setting inode->i_size directly as that also +recalculates inode->i_blocks. + +This can be tested by creating and writing into directories and files and +then examining them with du. Without this change, directories show a 4 +blocks (they start out at 2048 bytes) and files show 0 blocks; with this +change, they should show a number of blocks proportional to the file size +rounded up to 1024. + +Fixes: 31143d5d515e ("AFS: implement basic file write support") +Fixes: 63a4681ff39c ("afs: Locally edit directory data for mkdir/create/unlink/...") +Reported-by: Markus Suvanto +Signed-off-by: David Howells +Reviewed-by: Marc Dionne +Tested-by: Markus Suvanto +cc: linux-afs@lists.infradead.org +Link: https://lore.kernel.org/r/163113612442.352844.11162345591911691150.stgit@warthog.procyon.org.uk/ +Signed-off-by: Sasha Levin +--- + fs/afs/dir_edit.c | 4 ++-- + fs/afs/inode.c | 10 ---------- + fs/afs/internal.h | 10 ++++++++++ + fs/afs/write.c | 2 +- + 4 files changed, 13 insertions(+), 13 deletions(-) + +diff --git a/fs/afs/dir_edit.c b/fs/afs/dir_edit.c +index 2ffe09abae7f..3a9cffc081b9 100644 +--- a/fs/afs/dir_edit.c ++++ b/fs/afs/dir_edit.c +@@ -264,7 +264,7 @@ void afs_edit_dir_add(struct afs_vnode *vnode, + if (b == nr_blocks) { + _debug("init %u", b); + afs_edit_init_block(meta, block, b); +- i_size_write(&vnode->vfs_inode, (b + 1) * AFS_DIR_BLOCK_SIZE); ++ afs_set_i_size(vnode, (b + 1) * AFS_DIR_BLOCK_SIZE); + } + + /* Only lower dir pages have a counter in the header. */ +@@ -297,7 +297,7 @@ void afs_edit_dir_add(struct afs_vnode *vnode, + new_directory: + afs_edit_init_block(meta, meta, 0); + i_size = AFS_DIR_BLOCK_SIZE; +- i_size_write(&vnode->vfs_inode, i_size); ++ afs_set_i_size(vnode, i_size); + slot = AFS_DIR_RESV_BLOCKS0; + page = page0; + block = meta; +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index ae3016a9fb23..f81a972bdd29 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -53,16 +53,6 @@ static noinline void dump_vnode(struct afs_vnode *vnode, struct afs_vnode *paren + dump_stack(); + } + +-/* +- * Set the file size and block count. Estimate the number of 512 bytes blocks +- * used, rounded up to nearest 1K for consistency with other AFS clients. +- */ +-static void afs_set_i_size(struct afs_vnode *vnode, u64 size) +-{ +- i_size_write(&vnode->vfs_inode, size); +- vnode->vfs_inode.i_blocks = ((size + 1023) >> 10) << 1; +-} +- + /* + * Initialise an inode from the vnode status. + */ +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index ffe318ad2e02..dc08a3d9b3a8 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -1573,6 +1573,16 @@ static inline void afs_update_dentry_version(struct afs_operation *op, + (void *)(unsigned long)dir_vp->scb.status.data_version; + } + ++/* ++ * Set the file size and block count. Estimate the number of 512 bytes blocks ++ * used, rounded up to nearest 1K for consistency with other AFS clients. ++ */ ++static inline void afs_set_i_size(struct afs_vnode *vnode, u64 size) ++{ ++ i_size_write(&vnode->vfs_inode, size); ++ vnode->vfs_inode.i_blocks = ((size + 1023) >> 10) << 1; ++} ++ + /* + * Check for a conflicting operation on a directory that we just unlinked from. + * If someone managed to sneak a link or an unlink in on the file we just +diff --git a/fs/afs/write.c b/fs/afs/write.c +index d37b5cfcf28f..be60cf110382 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -184,7 +184,7 @@ int afs_write_end(struct file *file, struct address_space *mapping, + write_seqlock(&vnode->cb_lock); + i_size = i_size_read(&vnode->vfs_inode); + if (maybe_i_size > i_size) +- i_size_write(&vnode->vfs_inode, maybe_i_size); ++ afs_set_i_size(vnode, maybe_i_size); + write_sequnlock(&vnode->cb_lock); + } + +-- +2.33.0 + diff --git a/queue-5.10/atlantic-fix-issue-in-the-pm-resume-flow.patch b/queue-5.10/atlantic-fix-issue-in-the-pm-resume-flow.patch new file mode 100644 index 00000000000..0ba247d0960 --- /dev/null +++ b/queue-5.10/atlantic-fix-issue-in-the-pm-resume-flow.patch @@ -0,0 +1,47 @@ +From 8fda30d07b2c73f65cbe27e10aa01ea34de26d02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 03:16:05 -0700 +Subject: atlantic: Fix issue in the pm resume flow. + +From: Sudarsana Reddy Kalluru + +[ Upstream commit 4d88c339c423eefe2fd48215016cb0c75fcb4c4d ] + +After fixing hibernation resume flow, another usecase was found which +should be explicitly handled - resume when device is in "down" state. +Invoke aq_nic_init jointly with aq_nic_start only if ndev was already +up during suspend/hibernate. We still need to perform nic_deinit() if +caller requests for it, to handle the freeze/resume scenarios. + +Fixes: 57f780f1c433 ("atlantic: Fix driver resume flow.") +Signed-off-by: Sudarsana Reddy Kalluru +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +index f26d03735619..5b996330f228 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -419,13 +419,13 @@ static int atl_resume_common(struct device *dev, bool deep) + if (deep) { + /* Reinitialize Nic/Vecs objects */ + aq_nic_deinit(nic, !nic->aq_hw->aq_nic_cfg->wol); ++ } + ++ if (netif_running(nic->ndev)) { + ret = aq_nic_init(nic); + if (ret) + goto err_exit; +- } + +- if (netif_running(nic->ndev)) { + ret = aq_nic_start(nic); + if (ret) + goto err_exit; +-- +2.33.0 + diff --git a/queue-5.10/bnxt_en-fix-tx-timeout-when-tx-ring-size-is-set-to-t.patch b/queue-5.10/bnxt_en-fix-tx-timeout-when-tx-ring-size-is-set-to-t.patch new file mode 100644 index 00000000000..127e45f8dfe --- /dev/null +++ b/queue-5.10/bnxt_en-fix-tx-timeout-when-tx-ring-size-is-set-to-t.patch @@ -0,0 +1,105 @@ +From 460f9511d6cdd11063201562caf95bb16ef0e903 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Sep 2021 02:51:52 -0400 +Subject: bnxt_en: Fix TX timeout when TX ring size is set to the smallest + +From: Michael Chan + +[ Upstream commit 5bed8b0704c9ecccc8f4a2c377d7c8e21090a82e ] + +The smallest TX ring size we support must fit a TX SKB with MAX_SKB_FRAGS ++ 1. Because the first TX BD for a packet is always a long TX BD, we +need an extra TX BD to fit this packet. Define BNXT_MIN_TX_DESC_CNT with +this value to make this more clear. The current code uses a minimum +that is off by 1. Fix it using this constant. + +The tx_wake_thresh to determine when to wake up the TX queue is half the +ring size but we must have at least BNXT_MIN_TX_DESC_CNT for the next +packet which may have maximum fragments. So the comparison of the +available TX BDs with tx_wake_thresh should be >= instead of > in the +current code. Otherwise, at the smallest ring size, we will never wake +up the TX queue and will cause TX timeout. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reviewed-by: Pavan Chebbi +Signed-off-by: Michael Chan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 8 ++++---- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 5 +++++ + drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 2 +- + 3 files changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 26179e437bbf..cb0c270418a4 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -381,7 +381,7 @@ static bool bnxt_txr_netif_try_stop_queue(struct bnxt *bp, + * netif_tx_queue_stopped(). + */ + smp_mb(); +- if (bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh) { ++ if (bnxt_tx_avail(bp, txr) >= bp->tx_wake_thresh) { + netif_tx_wake_queue(txq); + return false; + } +@@ -717,7 +717,7 @@ static void bnxt_tx_int(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts) + smp_mb(); + + if (unlikely(netif_tx_queue_stopped(txq)) && +- bnxt_tx_avail(bp, txr) > bp->tx_wake_thresh && ++ bnxt_tx_avail(bp, txr) >= bp->tx_wake_thresh && + READ_ONCE(txr->dev_state) != BNXT_DEV_STATE_CLOSING) + netif_tx_wake_queue(txq); + } +@@ -2300,7 +2300,7 @@ static int __bnxt_poll_work(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + if (TX_CMP_TYPE(txcmp) == CMP_TYPE_TX_L2_CMP) { + tx_pkts++; + /* return full budget so NAPI will complete. */ +- if (unlikely(tx_pkts > bp->tx_wake_thresh)) { ++ if (unlikely(tx_pkts >= bp->tx_wake_thresh)) { + rx_pkts = budget; + raw_cons = NEXT_RAW_CMP(raw_cons); + if (budget) +@@ -3431,7 +3431,7 @@ static int bnxt_init_tx_rings(struct bnxt *bp) + u16 i; + + bp->tx_wake_thresh = max_t(int, bp->tx_ring_size / 2, +- MAX_SKB_FRAGS + 1); ++ BNXT_MIN_TX_DESC_CNT); + + for (i = 0; i < bp->tx_nr_rings; i++) { + struct bnxt_tx_ring_info *txr = &bp->tx_ring[i]; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 95d10e7bbb04..92f9f7f5240b 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -611,6 +611,11 @@ struct nqe_cn { + #define BNXT_MAX_RX_JUM_DESC_CNT (RX_DESC_CNT * MAX_RX_AGG_PAGES - 1) + #define BNXT_MAX_TX_DESC_CNT (TX_DESC_CNT * MAX_TX_PAGES - 1) + ++/* Minimum TX BDs for a TX packet with MAX_SKB_FRAGS + 1. We need one extra ++ * BD because the first TX BD is always a long BD. ++ */ ++#define BNXT_MIN_TX_DESC_CNT (MAX_SKB_FRAGS + 2) ++ + #define RX_RING(x) (((x) & ~(RX_DESC_CNT - 1)) >> (BNXT_PAGE_SHIFT - 4)) + #define RX_IDX(x) ((x) & (RX_DESC_CNT - 1)) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 1471c9a36238..6f9196ff2ac4 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -780,7 +780,7 @@ static int bnxt_set_ringparam(struct net_device *dev, + + if ((ering->rx_pending > BNXT_MAX_RX_DESC_CNT) || + (ering->tx_pending > BNXT_MAX_TX_DESC_CNT) || +- (ering->tx_pending <= MAX_SKB_FRAGS)) ++ (ering->tx_pending < BNXT_MIN_TX_DESC_CNT)) + return -EINVAL; + + if (netif_running(dev)) +-- +2.33.0 + diff --git a/queue-5.10/enetc-fix-illegal-access-when-reading-affinity_hint.patch b/queue-5.10/enetc-fix-illegal-access-when-reading-affinity_hint.patch new file mode 100644 index 00000000000..50326b8ea61 --- /dev/null +++ b/queue-5.10/enetc-fix-illegal-access-when-reading-affinity_hint.patch @@ -0,0 +1,54 @@ +From b674524a98254def5d511f8e3c08f87298d4d660 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Sep 2021 13:22:05 +0300 +Subject: enetc: Fix illegal access when reading affinity_hint + +From: Claudiu Manoil + +[ Upstream commit 7237a494decfa17d0b9d0076e6cee3235719de90 ] + +irq_set_affinity_hit() stores a reference to the cpumask_t +parameter in the irq descriptor, and that reference can be +accessed later from irq_affinity_hint_proc_show(). Since +the cpu_mask parameter passed to irq_set_affinity_hit() has +only temporary storage (it's on the stack memory), later +accesses to it are illegal. Thus reads from the corresponding +procfs affinity_hint file can result in paging request oops. + +The issue is fixed by the get_cpu_mask() helper, which provides +a permanent storage for the cpumask_t parameter. + +Fixes: d4fd0404c1c9 ("enetc: Introduce basic PF and VF ENETC ethernet drivers") +Signed-off-by: Claudiu Manoil +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c +index df4a858c8001..6877f8e2047b 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc.c +@@ -1320,7 +1320,6 @@ static void enetc_clear_bdrs(struct enetc_ndev_priv *priv) + static int enetc_setup_irqs(struct enetc_ndev_priv *priv) + { + struct pci_dev *pdev = priv->si->pdev; +- cpumask_t cpu_mask; + int i, j, err; + + for (i = 0; i < priv->bdr_int_num; i++) { +@@ -1349,9 +1348,7 @@ static int enetc_setup_irqs(struct enetc_ndev_priv *priv) + + enetc_wr(hw, ENETC_SIMSITRV(idx), entry); + } +- cpumask_clear(&cpu_mask); +- cpumask_set_cpu(i % num_online_cpus(), &cpu_mask); +- irq_set_affinity_hint(irq, &cpu_mask); ++ irq_set_affinity_hint(irq, get_cpu_mask(i % num_online_cpus())); + } + + return 0; +-- +2.33.0 + diff --git a/queue-5.10/enetc-fix-uninitialized-struct-dim_sample-field-usag.patch b/queue-5.10/enetc-fix-uninitialized-struct-dim_sample-field-usag.patch new file mode 100644 index 00000000000..67a5c3ef420 --- /dev/null +++ b/queue-5.10/enetc-fix-uninitialized-struct-dim_sample-field-usag.patch @@ -0,0 +1,45 @@ +From e511a8ad49d21c933689909aecd9a3599e49d9f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Sep 2021 13:22:06 +0300 +Subject: enetc: Fix uninitialized struct dim_sample field usage + +From: Claudiu Manoil + +[ Upstream commit 9f7afa05c9522b086327929ae622facab0f0f72b ] + +The only struct dim_sample member that does not get +initialized by dim_update_sample() is comp_ctr. (There +is special API to initialize comp_ctr: +dim_update_sample_with_comps(), and it is currently used +only for RDMA.) comp_ctr is used to compute curr_stats->cmps +and curr_stats->cpe_ratio (see dim_calc_stats()) which in +turn are consumed by the rdma_dim_*() API. Therefore, +functionally, the net_dim*() API consumers are not affected. +Nevertheless, fix the computation of statistics based +on an uninitialized variable, even if the mentioned statistics +are not used at the moment. + +Fixes: ae0e6a5d1627 ("enetc: Add adaptive interrupt coalescing") +Signed-off-by: Claudiu Manoil +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc.c b/drivers/net/ethernet/freescale/enetc/enetc.c +index 6877f8e2047b..15aa3b3c0089 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc.c +@@ -299,7 +299,7 @@ static void enetc_rx_dim_work(struct work_struct *w) + + static void enetc_rx_net_dim(struct enetc_int_vector *v) + { +- struct dim_sample dim_sample; ++ struct dim_sample dim_sample = {}; + + v->comp_cnt++; + +-- +2.33.0 + diff --git a/queue-5.10/gpio-uniphier-fix-void-functions-to-remove-return-va.patch b/queue-5.10/gpio-uniphier-fix-void-functions-to-remove-return-va.patch new file mode 100644 index 00000000000..eb1255f9f03 --- /dev/null +++ b/queue-5.10/gpio-uniphier-fix-void-functions-to-remove-return-va.patch @@ -0,0 +1,45 @@ +From 1d54a09ecda30e7118fae1e4e2459e71227a10cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Sep 2021 20:19:35 +0900 +Subject: gpio: uniphier: Fix void functions to remove return value + +From: Kunihiko Hayashi + +[ Upstream commit 2dd824cca3407bc9a2bd11b00f6e117b66fcfcf1 ] + +The return type of irq_chip.irq_mask() and irq_chip.irq_unmask() should +be void. + +Fixes: dbe776c2ca54 ("gpio: uniphier: add UniPhier GPIO controller driver") +Signed-off-by: Kunihiko Hayashi +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-uniphier.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpio/gpio-uniphier.c b/drivers/gpio/gpio-uniphier.c +index f99f3c10bed0..39dca147d587 100644 +--- a/drivers/gpio/gpio-uniphier.c ++++ b/drivers/gpio/gpio-uniphier.c +@@ -184,7 +184,7 @@ static void uniphier_gpio_irq_mask(struct irq_data *data) + + uniphier_gpio_reg_update(priv, UNIPHIER_GPIO_IRQ_EN, mask, 0); + +- return irq_chip_mask_parent(data); ++ irq_chip_mask_parent(data); + } + + static void uniphier_gpio_irq_unmask(struct irq_data *data) +@@ -194,7 +194,7 @@ static void uniphier_gpio_irq_unmask(struct irq_data *data) + + uniphier_gpio_reg_update(priv, UNIPHIER_GPIO_IRQ_EN, mask, mask); + +- return irq_chip_unmask_parent(data); ++ irq_chip_unmask_parent(data); + } + + static int uniphier_gpio_irq_set_type(struct irq_data *data, unsigned int type) +-- +2.33.0 + diff --git a/queue-5.10/kselftest-arm64-signal-add-sve-to-the-set-of-feature.patch b/queue-5.10/kselftest-arm64-signal-add-sve-to-the-set-of-feature.patch new file mode 100644 index 00000000000..56bbd6267f7 --- /dev/null +++ b/queue-5.10/kselftest-arm64-signal-add-sve-to-the-set-of-feature.patch @@ -0,0 +1,63 @@ +From 16b631896bd210aff1ee934bc28076dfcefbf406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Aug 2021 14:42:40 +0100 +Subject: kselftest/arm64: signal: Add SVE to the set of features we can check + for + +From: Mark Brown + +[ Upstream commit d4e4dc4fab686c5f3f185272a19b83930664bef5 ] + +Allow testcases for SVE signal handling to flag the dependency and be +skipped on systems without SVE support. + +Signed-off-by: Mark Brown +Link: https://lore.kernel.org/r/20210819134245.13935-2-broonie@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/signal/test_signals.h | 2 ++ + tools/testing/selftests/arm64/signal/test_signals_utils.c | 3 +++ + 2 files changed, 5 insertions(+) + +diff --git a/tools/testing/selftests/arm64/signal/test_signals.h b/tools/testing/selftests/arm64/signal/test_signals.h +index f96baf1cef1a..ebe8694dbef0 100644 +--- a/tools/testing/selftests/arm64/signal/test_signals.h ++++ b/tools/testing/selftests/arm64/signal/test_signals.h +@@ -33,10 +33,12 @@ + */ + enum { + FSSBS_BIT, ++ FSVE_BIT, + FMAX_END + }; + + #define FEAT_SSBS (1UL << FSSBS_BIT) ++#define FEAT_SVE (1UL << FSVE_BIT) + + /* + * A descriptor used to describe and configure a test case. +diff --git a/tools/testing/selftests/arm64/signal/test_signals_utils.c b/tools/testing/selftests/arm64/signal/test_signals_utils.c +index 2de6e5ed5e25..6836510a522f 100644 +--- a/tools/testing/selftests/arm64/signal/test_signals_utils.c ++++ b/tools/testing/selftests/arm64/signal/test_signals_utils.c +@@ -26,6 +26,7 @@ static int sig_copyctx = SIGTRAP; + + static char const *const feats_names[FMAX_END] = { + " SSBS ", ++ " SVE ", + }; + + #define MAX_FEATS_SZ 128 +@@ -263,6 +264,8 @@ int test_init(struct tdescr *td) + */ + if (getauxval(AT_HWCAP) & HWCAP_SSBS) + td->feats_supported |= FEAT_SSBS; ++ if (getauxval(AT_HWCAP) & HWCAP_SVE) ++ td->feats_supported |= FEAT_SVE; + if (feats_ok(td)) + fprintf(stderr, + "Required Features: [%s] supported\n", +-- +2.33.0 + diff --git a/queue-5.10/kselftest-arm64-signal-skip-tests-if-required-featur.patch b/queue-5.10/kselftest-arm64-signal-skip-tests-if-required-featur.patch new file mode 100644 index 00000000000..c6b2ea5457e --- /dev/null +++ b/queue-5.10/kselftest-arm64-signal-skip-tests-if-required-featur.patch @@ -0,0 +1,55 @@ +From f21150d4bfe629e0c234a019d857866da793326e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Sep 2021 13:12:28 +0100 +Subject: kselftest/arm64: signal: Skip tests if required features are missing + +From: Cristian Marussi + +[ Upstream commit 0e3dbf765fe22060acbcb8eb8c4d256e655a1247 ] + +During initialization of a signal testcase, features declared as required +are properly checked against the running system but no action is then taken +to effectively skip such a testcase. + +Fix core signals test logic to abort initialization and report such a +testcase as skipped to the KSelfTest framework. + +Fixes: f96bf4340316 ("kselftest: arm64: mangle_pstate_invalid_compat_toggle and common utils") +Signed-off-by: Cristian Marussi +Reviewed-by: Mark Brown +Link: https://lore.kernel.org/r/20210920121228.35368-1-cristian.marussi@arm.com +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/arm64/signal/test_signals_utils.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/arm64/signal/test_signals_utils.c b/tools/testing/selftests/arm64/signal/test_signals_utils.c +index 6836510a522f..22722abc9dfa 100644 +--- a/tools/testing/selftests/arm64/signal/test_signals_utils.c ++++ b/tools/testing/selftests/arm64/signal/test_signals_utils.c +@@ -266,16 +266,19 @@ int test_init(struct tdescr *td) + td->feats_supported |= FEAT_SSBS; + if (getauxval(AT_HWCAP) & HWCAP_SVE) + td->feats_supported |= FEAT_SVE; +- if (feats_ok(td)) ++ if (feats_ok(td)) { + fprintf(stderr, + "Required Features: [%s] supported\n", + feats_to_string(td->feats_required & + td->feats_supported)); +- else ++ } else { + fprintf(stderr, + "Required Features: [%s] NOT supported\n", + feats_to_string(td->feats_required & + ~td->feats_supported)); ++ td->result = KSFT_SKIP; ++ return 0; ++ } + } + + /* Perform test specific additional initialization */ +-- +2.33.0 + diff --git a/queue-5.10/net-dsa-don-t-allocate-the-slave_mii_bus-using-devre.patch b/queue-5.10/net-dsa-don-t-allocate-the-slave_mii_bus-using-devre.patch new file mode 100644 index 00000000000..7bbe49d1f60 --- /dev/null +++ b/queue-5.10/net-dsa-don-t-allocate-the-slave_mii_bus-using-devre.patch @@ -0,0 +1,167 @@ +From 397b2e7e1aa711f521b1e5ebf7070fe6e54729ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 00:42:08 +0300 +Subject: net: dsa: don't allocate the slave_mii_bus using devres + +From: Vladimir Oltean + +[ Upstream commit 5135e96a3dd2f4555ae6981c3155a62bcf3227f6 ] + +The Linux device model permits both the ->shutdown and ->remove driver +methods to get called during a shutdown procedure. Example: a DSA switch +which sits on an SPI bus, and the SPI bus driver calls this on its +->shutdown method: + +spi_unregister_controller +-> device_for_each_child(&ctlr->dev, NULL, __unregister); + -> spi_unregister_device(to_spi_device(dev)); + -> device_del(&spi->dev); + +So this is a simple pattern which can theoretically appear on any bus, +although the only other buses on which I've been able to find it are +I2C: + +i2c_del_adapter +-> device_for_each_child(&adap->dev, NULL, __unregister_client); + -> i2c_unregister_device(client); + -> device_unregister(&client->dev); + +The implication of this pattern is that devices on these buses can be +unregistered after having been shut down. The drivers for these devices +might choose to return early either from ->remove or ->shutdown if the +other callback has already run once, and they might choose that the +->shutdown method should only perform a subset of the teardown done by +->remove (to avoid unnecessary delays when rebooting). + +So in other words, the device driver may choose on ->remove to not +do anything (therefore to not unregister an MDIO bus it has registered +on ->probe), because this ->remove is actually triggered by the +device_shutdown path, and its ->shutdown method has already run and done +the minimally required cleanup. + +This used to be fine until the blamed commit, but now, the following +BUG_ON triggers: + +void mdiobus_free(struct mii_bus *bus) +{ + /* For compatibility with error handling in drivers. */ + if (bus->state == MDIOBUS_ALLOCATED) { + kfree(bus); + return; + } + + BUG_ON(bus->state != MDIOBUS_UNREGISTERED); + bus->state = MDIOBUS_RELEASED; + + put_device(&bus->dev); +} + +In other words, there is an attempt to free an MDIO bus which was not +unregistered. The attempt to free it comes from the devres release +callbacks of the SPI device, which are executed after the device is +unregistered. + +I'm not saying that the fact that MDIO buses allocated using devres +would automatically get unregistered wasn't strange. I'm just saying +that the commit didn't care about auditing existing call paths in the +kernel, and now, the following code sequences are potentially buggy: + +(a) devm_mdiobus_alloc followed by plain mdiobus_register, for a device + located on a bus that unregisters its children on shutdown. After + the blamed patch, either both the alloc and the register should use + devres, or none should. + +(b) devm_mdiobus_alloc followed by plain mdiobus_register, and then no + mdiobus_unregister at all in the remove path. After the blamed + patch, nobody unregisters the MDIO bus anymore, so this is even more + buggy than the previous case which needs a specific bus + configuration to be seen, this one is an unconditional bug. + +In this case, DSA falls into category (a), it tries to be helpful and +registers an MDIO bus on behalf of the switch, which might be on such a +bus. I've no idea why it does it under devres. + +It does this on probe: + + if (!ds->slave_mii_bus && ds->ops->phy_read) + alloc and register mdio bus + +and this on remove: + + if (ds->slave_mii_bus && ds->ops->phy_read) + unregister mdio bus + +I _could_ imagine using devres because the condition used on remove is +different than the condition used on probe. So strictly speaking, DSA +cannot determine whether the ds->slave_mii_bus it sees on remove is the +ds->slave_mii_bus that _it_ has allocated on probe. Using devres would +have solved that problem. But nonetheless, the existing code already +proceeds to unregister the MDIO bus, even though it might be +unregistering an MDIO bus it has never registered. So I can only guess +that no driver that implements ds->ops->phy_read also allocates and +registers ds->slave_mii_bus itself. + +So in that case, if unregistering is fine, freeing must be fine too. + +Stop using devres and free the MDIO bus manually. This will make devres +stop attempting to free a still registered MDIO bus on ->shutdown. + +Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") +Reported-by: Lino Sanfilippo +Signed-off-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Tested-by: Lino Sanfilippo +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/dsa2.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c +index 3ada338d7e08..71c8ef7d4087 100644 +--- a/net/dsa/dsa2.c ++++ b/net/dsa/dsa2.c +@@ -459,7 +459,7 @@ static int dsa_switch_setup(struct dsa_switch *ds) + devlink_params_publish(ds->devlink); + + if (!ds->slave_mii_bus && ds->ops->phy_read) { +- ds->slave_mii_bus = devm_mdiobus_alloc(ds->dev); ++ ds->slave_mii_bus = mdiobus_alloc(); + if (!ds->slave_mii_bus) { + err = -ENOMEM; + goto teardown; +@@ -469,13 +469,16 @@ static int dsa_switch_setup(struct dsa_switch *ds) + + err = mdiobus_register(ds->slave_mii_bus); + if (err < 0) +- goto teardown; ++ goto free_slave_mii_bus; + } + + ds->setup = true; + + return 0; + ++free_slave_mii_bus: ++ if (ds->slave_mii_bus && ds->ops->phy_read) ++ mdiobus_free(ds->slave_mii_bus); + teardown: + if (ds->ops->teardown) + ds->ops->teardown(ds); +@@ -500,8 +503,11 @@ static void dsa_switch_teardown(struct dsa_switch *ds) + if (!ds->setup) + return; + +- if (ds->slave_mii_bus && ds->ops->phy_read) ++ if (ds->slave_mii_bus && ds->ops->phy_read) { + mdiobus_unregister(ds->slave_mii_bus); ++ mdiobus_free(ds->slave_mii_bus); ++ ds->slave_mii_bus = NULL; ++ } + + dsa_switch_unregister_notifier(ds); + +-- +2.33.0 + diff --git a/queue-5.10/net-dsa-realtek-register-the-mdio-bus-under-devres.patch b/queue-5.10/net-dsa-realtek-register-the-mdio-bus-under-devres.patch new file mode 100644 index 00000000000..07971cf779e --- /dev/null +++ b/queue-5.10/net-dsa-realtek-register-the-mdio-bus-under-devres.patch @@ -0,0 +1,113 @@ +From ff6dea7ac63ab341a35b4f6083de89e6110b1b18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 00:42:09 +0300 +Subject: net: dsa: realtek: register the MDIO bus under devres +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vladimir Oltean + +[ Upstream commit 74b6d7d13307b016f4b5bba8198297824c0ee6df ] + +The Linux device model permits both the ->shutdown and ->remove driver +methods to get called during a shutdown procedure. Example: a DSA switch +which sits on an SPI bus, and the SPI bus driver calls this on its +->shutdown method: + +spi_unregister_controller +-> device_for_each_child(&ctlr->dev, NULL, __unregister); + -> spi_unregister_device(to_spi_device(dev)); + -> device_del(&spi->dev); + +So this is a simple pattern which can theoretically appear on any bus, +although the only other buses on which I've been able to find it are +I2C: + +i2c_del_adapter +-> device_for_each_child(&adap->dev, NULL, __unregister_client); + -> i2c_unregister_device(client); + -> device_unregister(&client->dev); + +The implication of this pattern is that devices on these buses can be +unregistered after having been shut down. The drivers for these devices +might choose to return early either from ->remove or ->shutdown if the +other callback has already run once, and they might choose that the +->shutdown method should only perform a subset of the teardown done by +->remove (to avoid unnecessary delays when rebooting). + +So in other words, the device driver may choose on ->remove to not +do anything (therefore to not unregister an MDIO bus it has registered +on ->probe), because this ->remove is actually triggered by the +device_shutdown path, and its ->shutdown method has already run and done +the minimally required cleanup. + +This used to be fine until the blamed commit, but now, the following +BUG_ON triggers: + +void mdiobus_free(struct mii_bus *bus) +{ + /* For compatibility with error handling in drivers. */ + if (bus->state == MDIOBUS_ALLOCATED) { + kfree(bus); + return; + } + + BUG_ON(bus->state != MDIOBUS_UNREGISTERED); + bus->state = MDIOBUS_RELEASED; + + put_device(&bus->dev); +} + +In other words, there is an attempt to free an MDIO bus which was not +unregistered. The attempt to free it comes from the devres release +callbacks of the SPI device, which are executed after the device is +unregistered. + +I'm not saying that the fact that MDIO buses allocated using devres +would automatically get unregistered wasn't strange. I'm just saying +that the commit didn't care about auditing existing call paths in the +kernel, and now, the following code sequences are potentially buggy: + +(a) devm_mdiobus_alloc followed by plain mdiobus_register, for a device + located on a bus that unregisters its children on shutdown. After + the blamed patch, either both the alloc and the register should use + devres, or none should. + +(b) devm_mdiobus_alloc followed by plain mdiobus_register, and then no + mdiobus_unregister at all in the remove path. After the blamed + patch, nobody unregisters the MDIO bus anymore, so this is even more + buggy than the previous case which needs a specific bus + configuration to be seen, this one is an unconditional bug. + +In this case, the Realtek drivers fall under category (b). To solve it, +we can register the MDIO bus under devres too, which restores the +previous behavior. + +Fixes: ac3a68d56651 ("net: phy: don't abuse devres in devm_mdiobus_register()") +Reported-by: Lino Sanfilippo +Reported-by: Alvin Å ipraga +Signed-off-by: Vladimir Oltean +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/realtek-smi-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/realtek-smi-core.c b/drivers/net/dsa/realtek-smi-core.c +index 8e49d4f85d48..6bf46d76c028 100644 +--- a/drivers/net/dsa/realtek-smi-core.c ++++ b/drivers/net/dsa/realtek-smi-core.c +@@ -368,7 +368,7 @@ int realtek_smi_setup_mdio(struct realtek_smi *smi) + smi->slave_mii_bus->parent = smi->dev; + smi->ds->slave_mii_bus = smi->slave_mii_bus; + +- ret = of_mdiobus_register(smi->slave_mii_bus, mdio_np); ++ ret = devm_of_mdiobus_register(smi->dev, smi->slave_mii_bus, mdio_np); + if (ret) { + dev_err(smi->dev, "unable to register MDIO bus %s\n", + smi->slave_mii_bus->id); +-- +2.33.0 + diff --git a/queue-5.10/net-hns3-check-queue-id-range-before-using.patch b/queue-5.10/net-hns3-check-queue-id-range-before-using.patch new file mode 100644 index 00000000000..8aae4c439fc --- /dev/null +++ b/queue-5.10/net-hns3-check-queue-id-range-before-using.patch @@ -0,0 +1,47 @@ +From d48657ed6ac9813b6299f5ecf1a7c6bec33422a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 21:52:09 +0800 +Subject: net: hns3: check queue id range before using + +From: Yufeng Mo + +[ Upstream commit 63b1279d9905100a14da9e043de7b28e99dba3f8 ] + +The input parameters may not be reliable. Before using the +queue id, we should check this parameter. Otherwise, memory +overwriting may occur. + +Fixes: d34100184685 ("net: hns3: refactor the mailbox message between PF and VF") +Signed-off-by: Yufeng Mo +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +index 8c528ea33406..8932af32e89d 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +@@ -581,9 +581,17 @@ static void hclge_get_queue_id_in_pf(struct hclge_vport *vport, + struct hclge_mbx_vf_to_pf_cmd *mbx_req, + struct hclge_respond_to_vf_msg *resp_msg) + { ++ struct hnae3_handle *handle = &vport->nic; ++ struct hclge_dev *hdev = vport->back; + u16 queue_id, qid_in_pf; + + memcpy(&queue_id, mbx_req->msg.data, sizeof(queue_id)); ++ if (queue_id >= handle->kinfo.num_tqps) { ++ dev_err(&hdev->pdev->dev, "Invalid queue id(%u) from VF %u\n", ++ queue_id, mbx_req->mbx_src_vfid); ++ return; ++ } ++ + qid_in_pf = hclge_covert_handle_qid_global(&vport->nic, queue_id); + memcpy(resp_msg->data, &qid_in_pf, sizeof(qid_in_pf)); + resp_msg->len = sizeof(qid_in_pf); +-- +2.33.0 + diff --git a/queue-5.10/net-hns3-fix-change-rss-hfunc-ineffective-issue.patch b/queue-5.10/net-hns3-fix-change-rss-hfunc-ineffective-issue.patch new file mode 100644 index 00000000000..ff2c34a714e --- /dev/null +++ b/queue-5.10/net-hns3-fix-change-rss-hfunc-ineffective-issue.patch @@ -0,0 +1,178 @@ +From ee49b171b9770dc620bcc50daf33d065c3bd429b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 21:52:06 +0800 +Subject: net: hns3: fix change RSS 'hfunc' ineffective issue + +From: Jian Shen + +[ Upstream commit e184cec5e29d8eb3c3435b12a9074b75e2d69e4a ] + +When user change rss 'hfunc' without set rss 'hkey' by ethtool +-X command, the driver will ignore the 'hfunc' for the hkey is +NULL. It's unreasonable. So fix it. + +Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") +Fixes: 374ad291762a ("net: hns3: Add RSS general configuration support for VF") +Signed-off-by: Jian Shen +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../hisilicon/hns3/hns3pf/hclge_main.c | 45 ++++++++++------ + .../hisilicon/hns3/hns3vf/hclgevf_main.c | 52 ++++++++++++------- + 2 files changed, 64 insertions(+), 33 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 59ec538eba1f..24357e907155 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -4377,6 +4377,24 @@ static int hclge_get_rss(struct hnae3_handle *handle, u32 *indir, + return 0; + } + ++static int hclge_parse_rss_hfunc(struct hclge_vport *vport, const u8 hfunc, ++ u8 *hash_algo) ++{ ++ switch (hfunc) { ++ case ETH_RSS_HASH_TOP: ++ *hash_algo = HCLGE_RSS_HASH_ALGO_TOEPLITZ; ++ return 0; ++ case ETH_RSS_HASH_XOR: ++ *hash_algo = HCLGE_RSS_HASH_ALGO_SIMPLE; ++ return 0; ++ case ETH_RSS_HASH_NO_CHANGE: ++ *hash_algo = vport->rss_algo; ++ return 0; ++ default: ++ return -EINVAL; ++ } ++} ++ + static int hclge_set_rss(struct hnae3_handle *handle, const u32 *indir, + const u8 *key, const u8 hfunc) + { +@@ -4385,30 +4403,27 @@ static int hclge_set_rss(struct hnae3_handle *handle, const u32 *indir, + u8 hash_algo; + int ret, i; + ++ ret = hclge_parse_rss_hfunc(vport, hfunc, &hash_algo); ++ if (ret) { ++ dev_err(&hdev->pdev->dev, "invalid hfunc type %u\n", hfunc); ++ return ret; ++ } ++ + /* Set the RSS Hash Key if specififed by the user */ + if (key) { +- switch (hfunc) { +- case ETH_RSS_HASH_TOP: +- hash_algo = HCLGE_RSS_HASH_ALGO_TOEPLITZ; +- break; +- case ETH_RSS_HASH_XOR: +- hash_algo = HCLGE_RSS_HASH_ALGO_SIMPLE; +- break; +- case ETH_RSS_HASH_NO_CHANGE: +- hash_algo = vport->rss_algo; +- break; +- default: +- return -EINVAL; +- } +- + ret = hclge_set_rss_algo_key(hdev, hash_algo, key); + if (ret) + return ret; + + /* Update the shadow RSS key with user specified qids */ + memcpy(vport->rss_hash_key, key, HCLGE_RSS_KEY_SIZE); +- vport->rss_algo = hash_algo; ++ } else { ++ ret = hclge_set_rss_algo_key(hdev, hash_algo, ++ vport->rss_hash_key); ++ if (ret) ++ return ret; + } ++ vport->rss_algo = hash_algo; + + /* Update the shadow RSS table with user specified qids */ + for (i = 0; i < HCLGE_RSS_IND_TBL_SIZE; i++) +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index 447457cacf97..3641d7c31451 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -785,40 +785,56 @@ static int hclgevf_get_rss(struct hnae3_handle *handle, u32 *indir, u8 *key, + return 0; + } + ++static int hclgevf_parse_rss_hfunc(struct hclgevf_dev *hdev, const u8 hfunc, ++ u8 *hash_algo) ++{ ++ switch (hfunc) { ++ case ETH_RSS_HASH_TOP: ++ *hash_algo = HCLGEVF_RSS_HASH_ALGO_TOEPLITZ; ++ return 0; ++ case ETH_RSS_HASH_XOR: ++ *hash_algo = HCLGEVF_RSS_HASH_ALGO_SIMPLE; ++ return 0; ++ case ETH_RSS_HASH_NO_CHANGE: ++ *hash_algo = hdev->rss_cfg.hash_algo; ++ return 0; ++ default: ++ return -EINVAL; ++ } ++} ++ + static int hclgevf_set_rss(struct hnae3_handle *handle, const u32 *indir, + const u8 *key, const u8 hfunc) + { + struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle); + struct hclgevf_rss_cfg *rss_cfg = &hdev->rss_cfg; ++ u8 hash_algo; + int ret, i; + + if (hdev->ae_dev->dev_version >= HNAE3_DEVICE_VERSION_V2) { ++ ret = hclgevf_parse_rss_hfunc(hdev, hfunc, &hash_algo); ++ if (ret) ++ return ret; ++ + /* Set the RSS Hash Key if specififed by the user */ + if (key) { +- switch (hfunc) { +- case ETH_RSS_HASH_TOP: +- rss_cfg->hash_algo = +- HCLGEVF_RSS_HASH_ALGO_TOEPLITZ; +- break; +- case ETH_RSS_HASH_XOR: +- rss_cfg->hash_algo = +- HCLGEVF_RSS_HASH_ALGO_SIMPLE; +- break; +- case ETH_RSS_HASH_NO_CHANGE: +- break; +- default: +- return -EINVAL; +- } +- +- ret = hclgevf_set_rss_algo_key(hdev, rss_cfg->hash_algo, +- key); +- if (ret) ++ ret = hclgevf_set_rss_algo_key(hdev, hash_algo, key); ++ if (ret) { ++ dev_err(&hdev->pdev->dev, ++ "invalid hfunc type %u\n", hfunc); + return ret; ++ } + + /* Update the shadow RSS key with user specified qids */ + memcpy(rss_cfg->rss_hash_key, key, + HCLGEVF_RSS_KEY_SIZE); ++ } else { ++ ret = hclgevf_set_rss_algo_key(hdev, hash_algo, ++ rss_cfg->rss_hash_key); ++ if (ret) ++ return ret; + } ++ rss_cfg->hash_algo = hash_algo; + } + + /* update the shadow RSS table with user specified qids */ +-- +2.33.0 + diff --git a/queue-5.10/net-hns3-fix-misuse-vf-id-and-vport-id-in-some-logs.patch b/queue-5.10/net-hns3-fix-misuse-vf-id-and-vport-id-in-some-logs.patch new file mode 100644 index 00000000000..33bcdc9ce6a --- /dev/null +++ b/queue-5.10/net-hns3-fix-misuse-vf-id-and-vport-id-in-some-logs.patch @@ -0,0 +1,125 @@ +From 843ecf796fbf62361c849df9c7a55bab98dd490e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 21:52:08 +0800 +Subject: net: hns3: fix misuse vf id and vport id in some logs + +From: Jiaran Zhang + +[ Upstream commit 311c0aaa9b4bb8dc65f22634e15963316b17c921 ] + +vport_id include PF and VFs, vport_id = 0 means PF, other values mean VFs. +So the actual vf id is equal to vport_id minus 1. + +Some VF print logs are actually vport, and logs of vf id actually use +vport id, so this patch fixes them. + +Fixes: ac887be5b0fe ("net: hns3: change print level of RAS error log from warning to error") +Fixes: adcf738b804b ("net: hns3: cleanup some print format warning") +Signed-off-by: Jiaran Zhang +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 8 ++++---- + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 10 ++++++---- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 2 +- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 +- + 4 files changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c +index 3226ca176155..b7fb4f49bc3f 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c +@@ -1742,12 +1742,12 @@ static void hclge_handle_over_8bd_err(struct hclge_dev *hdev, + return; + } + +- dev_err(dev, "PPU_PF_ABNORMAL_INT_ST over_8bd_no_fe found, vf_id(%u), queue_id(%u)\n", ++ dev_err(dev, "PPU_PF_ABNORMAL_INT_ST over_8bd_no_fe found, vport(%u), queue_id(%u)\n", + vf_id, q_id); + + if (vf_id) { + if (vf_id >= hdev->num_alloc_vport) { +- dev_err(dev, "invalid vf id(%u)\n", vf_id); ++ dev_err(dev, "invalid vport(%u)\n", vf_id); + return; + } + +@@ -1760,8 +1760,8 @@ static void hclge_handle_over_8bd_err(struct hclge_dev *hdev, + + ret = hclge_inform_reset_assert_to_vf(&hdev->vport[vf_id]); + if (ret) +- dev_err(dev, "inform reset to vf(%u) failed %d!\n", +- hdev->vport->vport_id, ret); ++ dev_err(dev, "inform reset to vport(%u) failed %d!\n", ++ vf_id, ret); + } else { + set_bit(HNAE3_FUNC_RESET, reset_requests); + } +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 24357e907155..a00d71ad82b1 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -3418,7 +3418,8 @@ static int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset) + if (ret) { + dev_err(&hdev->pdev->dev, + "set vf(%u) rst failed %d!\n", +- vport->vport_id, ret); ++ vport->vport_id - HCLGE_VF_VPORT_START_NUM, ++ ret); + return ret; + } + +@@ -3433,7 +3434,8 @@ static int hclge_set_all_vf_rst(struct hclge_dev *hdev, bool reset) + if (ret) + dev_warn(&hdev->pdev->dev, + "inform reset to vf(%u) failed %d!\n", +- vport->vport_id, ret); ++ vport->vport_id - HCLGE_VF_VPORT_START_NUM, ++ ret); + } + + return 0; +@@ -10043,11 +10045,11 @@ static void hclge_clear_resetting_state(struct hclge_dev *hdev) + struct hclge_vport *vport = &hdev->vport[i]; + int ret; + +- /* Send cmd to clear VF's FUNC_RST_ING */ ++ /* Send cmd to clear vport's FUNC_RST_ING */ + ret = hclge_set_vf_rst(hdev, vport->vport_id, false); + if (ret) + dev_warn(&hdev->pdev->dev, +- "clear vf(%u) rst failed %d!\n", ++ "clear vport(%u) rst failed %d!\n", + vport->vport_id, ret); + } + } +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +index ff9d84a7147f..8c528ea33406 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +@@ -557,7 +557,7 @@ static int hclge_reset_vf(struct hclge_vport *vport) + struct hclge_dev *hdev = vport->back; + + dev_warn(&hdev->pdev->dev, "PF received VF reset request from VF %u!", +- vport->vport_id); ++ vport->vport_id - HCLGE_VF_VPORT_START_NUM); + + return hclge_func_reset_cmd(hdev, vport->vport_id); + } +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index e8495f58a1a8..801ba349498f 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -546,7 +546,7 @@ int hclge_tm_qs_shaper_cfg(struct hclge_vport *vport, int max_tx_rate) + ret = hclge_cmd_send(&hdev->hw, &desc, 1); + if (ret) { + dev_err(&hdev->pdev->dev, +- "vf%u, qs%u failed to set tx_rate:%d, ret=%d\n", ++ "vport%u, qs%u failed to set tx_rate:%d, ret=%d\n", + vport->vport_id, shap_cfg_cmd->qs_id, + max_tx_rate, ret); + return ret; +-- +2.33.0 + diff --git a/queue-5.10/net-mlx4_en-don-t-allow-arfs-for-encapsulated-packet.patch b/queue-5.10/net-mlx4_en-don-t-allow-arfs-for-encapsulated-packet.patch new file mode 100644 index 00000000000..615fb57e513 --- /dev/null +++ b/queue-5.10/net-mlx4_en-don-t-allow-arfs-for-encapsulated-packet.patch @@ -0,0 +1,38 @@ +From 4a4aba8169ef3cd2c8a62f68d5f34865730a08da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 09:51:45 +0300 +Subject: net/mlx4_en: Don't allow aRFS for encapsulated packets + +From: Aya Levin + +[ Upstream commit fdbccea419dc782079ce5881d2705cc9e3881480 ] + +Driver doesn't support aRFS for encapsulated packets, return early error +in such a case. + +Fixes: 1eb8c695bda9 ("net/mlx4_en: Add accelerated RFS support") +Signed-off-by: Aya Levin +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/en_netdev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 49a11406b6ab..00fe2e2893cd 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -372,6 +372,9 @@ mlx4_en_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb, + int nhoff = skb_network_offset(skb); + int ret = 0; + ++ if (skb->encapsulation) ++ return -EPROTONOSUPPORT; ++ + if (skb->protocol != htons(ETH_P_IP)) + return -EPROTONOSUPPORT; + +-- +2.33.0 + diff --git a/queue-5.10/net-mlx4_en-resolve-bad-operstate-value.patch b/queue-5.10/net-mlx4_en-resolve-bad-operstate-value.patch new file mode 100644 index 00000000000..69f7176e067 --- /dev/null +++ b/queue-5.10/net-mlx4_en-resolve-bad-operstate-value.patch @@ -0,0 +1,127 @@ +From d161613ee7b68dba877408f5edc8fe9d0fa2646a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Sep 2021 14:55:45 +0300 +Subject: net/mlx4_en: Resolve bad operstate value + +From: Lama Kayal + +[ Upstream commit 72a3c58d18fd780eecd80178bb2132ce741a0a74 ] + +Any link state change that's done prior to net device registration +isn't reflected on the state, thus the operational state is left +obsolete, with 'UNKNOWN' status. + +To resolve the issue, query link state from FW upon open operations +to ensure operational state is updated. + +Fixes: c27a02cd94d6 ("mlx4_en: Add driver for Mellanox ConnectX 10GbE NIC") +Signed-off-by: Lama Kayal +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlx4/en_netdev.c | 47 ++++++++++++------- + drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 1 - + 2 files changed, 29 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index d8a20e83d904..49a11406b6ab 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -1269,7 +1269,6 @@ static void mlx4_en_do_set_rx_mode(struct work_struct *work) + if (!netif_carrier_ok(dev)) { + if (!mlx4_en_QUERY_PORT(mdev, priv->port)) { + if (priv->port_state.link_state) { +- priv->last_link_state = MLX4_DEV_EVENT_PORT_UP; + netif_carrier_on(dev); + en_dbg(LINK, priv, "Link Up\n"); + } +@@ -1557,26 +1556,36 @@ static void mlx4_en_service_task(struct work_struct *work) + mutex_unlock(&mdev->state_lock); + } + +-static void mlx4_en_linkstate(struct work_struct *work) ++static void mlx4_en_linkstate(struct mlx4_en_priv *priv) ++{ ++ struct mlx4_en_port_state *port_state = &priv->port_state; ++ struct mlx4_en_dev *mdev = priv->mdev; ++ struct net_device *dev = priv->dev; ++ bool up; ++ ++ if (mlx4_en_QUERY_PORT(mdev, priv->port)) ++ port_state->link_state = MLX4_PORT_STATE_DEV_EVENT_PORT_DOWN; ++ ++ up = port_state->link_state == MLX4_PORT_STATE_DEV_EVENT_PORT_UP; ++ if (up == netif_carrier_ok(dev)) ++ netif_carrier_event(dev); ++ if (!up) { ++ en_info(priv, "Link Down\n"); ++ netif_carrier_off(dev); ++ } else { ++ en_info(priv, "Link Up\n"); ++ netif_carrier_on(dev); ++ } ++} ++ ++static void mlx4_en_linkstate_work(struct work_struct *work) + { + struct mlx4_en_priv *priv = container_of(work, struct mlx4_en_priv, + linkstate_task); + struct mlx4_en_dev *mdev = priv->mdev; +- int linkstate = priv->link_state; + + mutex_lock(&mdev->state_lock); +- /* If observable port state changed set carrier state and +- * report to system log */ +- if (priv->last_link_state != linkstate) { +- if (linkstate == MLX4_DEV_EVENT_PORT_DOWN) { +- en_info(priv, "Link Down\n"); +- netif_carrier_off(priv->dev); +- } else { +- en_info(priv, "Link Up\n"); +- netif_carrier_on(priv->dev); +- } +- } +- priv->last_link_state = linkstate; ++ mlx4_en_linkstate(priv); + mutex_unlock(&mdev->state_lock); + } + +@@ -2080,9 +2089,11 @@ static int mlx4_en_open(struct net_device *dev) + mlx4_en_clear_stats(dev); + + err = mlx4_en_start_port(dev); +- if (err) ++ if (err) { + en_err(priv, "Failed starting port:%d\n", priv->port); +- ++ goto out; ++ } ++ mlx4_en_linkstate(priv); + out: + mutex_unlock(&mdev->state_lock); + return err; +@@ -3173,7 +3184,7 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, + spin_lock_init(&priv->stats_lock); + INIT_WORK(&priv->rx_mode_task, mlx4_en_do_set_rx_mode); + INIT_WORK(&priv->restart_task, mlx4_en_restart); +- INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate); ++ INIT_WORK(&priv->linkstate_task, mlx4_en_linkstate_work); + INIT_DELAYED_WORK(&priv->stats_task, mlx4_en_do_get_stats); + INIT_DELAYED_WORK(&priv->service_task, mlx4_en_service_task); + #ifdef CONFIG_RFS_ACCEL +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +index 0aa4a23ad3de..c1f23dc3b0e6 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +@@ -571,7 +571,6 @@ struct mlx4_en_priv { + + struct mlx4_hwq_resources res; + int link_state; +- int last_link_state; + bool port_up; + int port; + int registered; +-- +2.33.0 + diff --git a/queue-5.10/net-smc-add-missing-error-check-in-smc_clc_prfx_set.patch b/queue-5.10/net-smc-add-missing-error-check-in-smc_clc_prfx_set.patch new file mode 100644 index 00000000000..b6fea59020a --- /dev/null +++ b/queue-5.10/net-smc-add-missing-error-check-in-smc_clc_prfx_set.patch @@ -0,0 +1,45 @@ +From a9e859ff4327d2fb76b787590acfe1b6fe86f75c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Sep 2021 21:18:14 +0200 +Subject: net/smc: add missing error check in smc_clc_prfx_set() + +From: Karsten Graul + +[ Upstream commit 6c90731980655280ea07ce4b21eb97457bf86286 ] + +Coverity stumbled over a missing error check in smc_clc_prfx_set(): + +*** CID 1475954: Error handling issues (CHECKED_RETURN) +/net/smc/smc_clc.c: 233 in smc_clc_prfx_set() +>>> CID 1475954: Error handling issues (CHECKED_RETURN) +>>> Calling "kernel_getsockname" without checking return value (as is done elsewhere 8 out of 10 times). +233 kernel_getsockname(clcsock, (struct sockaddr *)&addrs); + +Add the return code check in smc_clc_prfx_set(). + +Fixes: c246d942eabc ("net/smc: restructure netinfo for CLC proposal msgs") +Reported-by: Julian Wiedmann +Signed-off-by: Karsten Graul +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_clc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c +index 696d89c2dce4..5ee5b2ce29a6 100644 +--- a/net/smc/smc_clc.c ++++ b/net/smc/smc_clc.c +@@ -230,7 +230,8 @@ static int smc_clc_prfx_set(struct socket *clcsock, + goto out_rel; + } + /* get address to which the internal TCP socket is bound */ +- kernel_getsockname(clcsock, (struct sockaddr *)&addrs); ++ if (kernel_getsockname(clcsock, (struct sockaddr *)&addrs) < 0) ++ goto out_rel; + /* analyze IP specific data of net_device belonging to TCP socket */ + addr6 = (struct sockaddr_in6 *)&addrs; + rcu_read_lock(); +-- +2.33.0 + diff --git a/queue-5.10/net-smc-fix-workqueue-leaked-lock-in-smc_conn_abort_.patch b/queue-5.10/net-smc-fix-workqueue-leaked-lock-in-smc_conn_abort_.patch new file mode 100644 index 00000000000..552578aa12c --- /dev/null +++ b/queue-5.10/net-smc-fix-workqueue-leaked-lock-in-smc_conn_abort_.patch @@ -0,0 +1,48 @@ +From 5a54a9e366090820f69a29e53914d47bead538fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Sep 2021 21:18:15 +0200 +Subject: net/smc: fix 'workqueue leaked lock' in smc_conn_abort_work + +From: Karsten Graul + +[ Upstream commit a18cee4791b1123d0a6579a7c89f4b87e48abe03 ] + +The abort_work is scheduled when a connection was detected to be +out-of-sync after a link failure. The work calls smc_conn_kill(), +which calls smc_close_active_abort() and that might end up calling +smc_close_cancel_work(). +smc_close_cancel_work() cancels any pending close_work and tx_work but +needs to release the sock_lock before and acquires the sock_lock again +afterwards. So when the sock_lock was NOT acquired before then it may +be held after the abort_work completes. Thats why the sock_lock is +acquired before the call to smc_conn_kill() in __smc_lgr_terminate(), +but this is missing in smc_conn_abort_work(). + +Fix that by acquiring the sock_lock first and release it after the +call to smc_conn_kill(). + +Fixes: b286a0651e44 ("net/smc: handle incoming CDC validation message") +Signed-off-by: Karsten Graul +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index af96f813c075..c491dd8e67cd 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -1089,7 +1089,9 @@ static void smc_conn_abort_work(struct work_struct *work) + abort_work); + struct smc_sock *smc = container_of(conn, struct smc_sock, conn); + ++ lock_sock(&smc->sk); + smc_conn_kill(conn, true); ++ release_sock(&smc->sk); + sock_put(&smc->sk); /* sock_hold done by schedulers of abort_work */ + } + +-- +2.33.0 + diff --git a/queue-5.10/platform-x86-intel-punit_ipc-drop-wrong-use-of-acpi_.patch b/queue-5.10/platform-x86-intel-punit_ipc-drop-wrong-use-of-acpi_.patch new file mode 100644 index 00000000000..e71ab98b109 --- /dev/null +++ b/queue-5.10/platform-x86-intel-punit_ipc-drop-wrong-use-of-acpi_.patch @@ -0,0 +1,50 @@ +From d5780e3e6bbe86a1054c26258719e3e91e40ca90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Aug 2021 17:53:10 +0300 +Subject: platform/x86/intel: punit_ipc: Drop wrong use of ACPI_PTR() + +From: Andy Shevchenko + +[ Upstream commit 349bff48ae0f5f8aa2075d0bdc2091a30bd634f6 ] + +ACPI_PTR() is more harmful than helpful. For example, in this case +if CONFIG_ACPI=n, the ID table left unused which is not what we want. + +Instead of adding ifdeffery here and there, drop ACPI_PTR() +and unused acpi.h. + +Fixes: fdca4f16f57d ("platform:x86: add Intel P-Unit mailbox IPC driver") +Reported-by: kernel test robot +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210827145310.76239-1-andriy.shevchenko@linux.intel.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel_punit_ipc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c +index f58b8543f6ac..66bb39fd0ef9 100644 +--- a/drivers/platform/x86/intel_punit_ipc.c ++++ b/drivers/platform/x86/intel_punit_ipc.c +@@ -8,7 +8,6 @@ + * which provide mailbox interface for power management usage. + */ + +-#include + #include + #include + #include +@@ -319,7 +318,7 @@ static struct platform_driver intel_punit_ipc_driver = { + .remove = intel_punit_ipc_remove, + .driver = { + .name = "intel_punit_ipc", +- .acpi_match_table = ACPI_PTR(punit_ipc_acpi_ids), ++ .acpi_match_table = punit_ipc_acpi_ids, + }, + }; + +-- +2.33.0 + diff --git a/queue-5.10/qed-rdma-don-t-wait-for-resources-under-hw-error-rec.patch b/queue-5.10/qed-rdma-don-t-wait-for-resources-under-hw-error-rec.patch new file mode 100644 index 00000000000..fe8ca2f7836 --- /dev/null +++ b/queue-5.10/qed-rdma-don-t-wait-for-resources-under-hw-error-rec.patch @@ -0,0 +1,65 @@ +From f91d5896e68a142a2edd8243120caae2936ce9cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Sep 2021 13:53:26 +0300 +Subject: qed: rdma - don't wait for resources under hw error recovery flow + +From: Shai Malin + +[ Upstream commit 1ea7812326004afd2803cc968a4776ae5120a597 ] + +If the HW device is during recovery, the HW resources will never return, +hence we shouldn't wait for the CID (HW context ID) bitmaps to clear. +This fix speeds up the error recovery flow. + +Fixes: 64515dc899df ("qed: Add infrastructure for error detection and recovery") +Signed-off-by: Michal Kalderon +Signed-off-by: Ariel Elior +Signed-off-by: Shai Malin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_iwarp.c | 8 ++++++++ + drivers/net/ethernet/qlogic/qed/qed_roce.c | 8 ++++++++ + 2 files changed, 16 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c +index a99861124630..68fbe536a1f3 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c +@@ -1297,6 +1297,14 @@ qed_iwarp_wait_cid_map_cleared(struct qed_hwfn *p_hwfn, struct qed_bmap *bmap) + prev_weight = weight; + + while (weight) { ++ /* If the HW device is during recovery, all resources are ++ * immediately reset without receiving a per-cid indication ++ * from HW. In this case we don't expect the cid_map to be ++ * cleared. ++ */ ++ if (p_hwfn->cdev->recov_in_prog) ++ return 0; ++ + msleep(QED_IWARP_MAX_CID_CLEAN_TIME); + + weight = bitmap_weight(bmap->bitmap, bmap->max_count); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_roce.c b/drivers/net/ethernet/qlogic/qed/qed_roce.c +index f16a157bb95a..cf5baa5e59bc 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_roce.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_roce.c +@@ -77,6 +77,14 @@ void qed_roce_stop(struct qed_hwfn *p_hwfn) + * Beyond the added delay we clear the bitmap anyway. + */ + while (bitmap_weight(rcid_map->bitmap, rcid_map->max_count)) { ++ /* If the HW device is during recovery, all resources are ++ * immediately reset without receiving a per-cid indication ++ * from HW. In this case we don't expect the cid bitmap to be ++ * cleared. ++ */ ++ if (p_hwfn->cdev->recov_in_prog) ++ return; ++ + msleep(100); + if (wait_count++ > 20) { + DP_NOTICE(p_hwfn, "cid bitmap wait timed out\n"); +-- +2.33.0 + diff --git a/queue-5.10/s390-qeth-fix-deadlock-during-failing-recovery.patch b/queue-5.10/s390-qeth-fix-deadlock-during-failing-recovery.patch new file mode 100644 index 00000000000..5c80f0a8b66 --- /dev/null +++ b/queue-5.10/s390-qeth-fix-deadlock-during-failing-recovery.patch @@ -0,0 +1,107 @@ +From 840557f46ba3f39a0989d53ab62ad226dec63e7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 16:52:17 +0200 +Subject: s390/qeth: fix deadlock during failing recovery + +From: Alexandra Winter + +[ Upstream commit d2b59bd4b06d84a4eadb520b0f71c62fe8ec0a62 ] + +Commit 0b9902c1fcc5 ("s390/qeth: fix deadlock during recovery") removed +taking discipline_mutex inside qeth_do_reset(), fixing potential +deadlocks. An error path was missed though, that still takes +discipline_mutex and thus has the original deadlock potential. + +Intermittent deadlocks were seen when a qeth channel path is configured +offline, causing a race between qeth_do_reset and ccwgroup_remove. +Call qeth_set_offline() directly in the qeth_do_reset() error case and +then a new variant of ccwgroup_set_offline(), without taking +discipline_mutex. + +Fixes: b41b554c1ee7 ("s390/qeth: fix locking for discipline setup / removal") +Signed-off-by: Alexandra Winter +Reviewed-by: Julian Wiedmann +Signed-off-by: Julian Wiedmann +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/ccwgroup.h | 2 +- + drivers/s390/cio/ccwgroup.c | 10 ++++++++-- + drivers/s390/net/qeth_core_main.c | 3 ++- + 3 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/arch/s390/include/asm/ccwgroup.h b/arch/s390/include/asm/ccwgroup.h +index ad3acb1e882b..8a22da9a735a 100644 +--- a/arch/s390/include/asm/ccwgroup.h ++++ b/arch/s390/include/asm/ccwgroup.h +@@ -58,7 +58,7 @@ struct ccwgroup_device *get_ccwgroupdev_by_busid(struct ccwgroup_driver *gdrv, + char *bus_id); + + extern int ccwgroup_set_online(struct ccwgroup_device *gdev); +-extern int ccwgroup_set_offline(struct ccwgroup_device *gdev); ++int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv); + + extern int ccwgroup_probe_ccwdev(struct ccw_device *cdev); + extern void ccwgroup_remove_ccwdev(struct ccw_device *cdev); +diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c +index 483a9ecfcbb1..cfdc1c7825d0 100644 +--- a/drivers/s390/cio/ccwgroup.c ++++ b/drivers/s390/cio/ccwgroup.c +@@ -98,12 +98,13 @@ EXPORT_SYMBOL(ccwgroup_set_online); + /** + * ccwgroup_set_offline() - disable a ccwgroup device + * @gdev: target ccwgroup device ++ * @call_gdrv: Call the registered gdrv set_offline function + * + * This function attempts to put the ccwgroup device into the offline state. + * Returns: + * %0 on success and a negative error value on failure. + */ +-int ccwgroup_set_offline(struct ccwgroup_device *gdev) ++int ccwgroup_set_offline(struct ccwgroup_device *gdev, bool call_gdrv) + { + struct ccwgroup_driver *gdrv = to_ccwgroupdrv(gdev->dev.driver); + int ret = -EINVAL; +@@ -112,11 +113,16 @@ int ccwgroup_set_offline(struct ccwgroup_device *gdev) + return -EAGAIN; + if (gdev->state == CCWGROUP_OFFLINE) + goto out; ++ if (!call_gdrv) { ++ ret = 0; ++ goto offline; ++ } + if (gdrv->set_offline) + ret = gdrv->set_offline(gdev); + if (ret) + goto out; + ++offline: + gdev->state = CCWGROUP_OFFLINE; + out: + atomic_set(&gdev->onoff, 0); +@@ -145,7 +151,7 @@ static ssize_t ccwgroup_online_store(struct device *dev, + if (value == 1) + ret = ccwgroup_set_online(gdev); + else if (value == 0) +- ret = ccwgroup_set_offline(gdev); ++ ret = ccwgroup_set_offline(gdev, true); + else + ret = -EINVAL; + out: +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 7b0155b0e99e..15477bfb5bd8 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -5406,7 +5406,8 @@ static int qeth_do_reset(void *data) + dev_info(&card->gdev->dev, + "Device successfully recovered!\n"); + } else { +- ccwgroup_set_offline(card->gdev); ++ qeth_set_offline(card, disc, true); ++ ccwgroup_set_offline(card->gdev, false); + dev_warn(&card->gdev->dev, + "The qeth device driver failed to recover an error on the device\n"); + } +-- +2.33.0 + diff --git a/queue-5.10/s390-qeth-fix-null-deref-in-qeth_clear_working_pool_.patch b/queue-5.10/s390-qeth-fix-null-deref-in-qeth_clear_working_pool_.patch new file mode 100644 index 00000000000..69703cd686b --- /dev/null +++ b/queue-5.10/s390-qeth-fix-null-deref-in-qeth_clear_working_pool_.patch @@ -0,0 +1,60 @@ +From 44afeea40901165b55c38292448b6fa19e1a84a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 16:52:15 +0200 +Subject: s390/qeth: fix NULL deref in qeth_clear_working_pool_list() + +From: Julian Wiedmann + +[ Upstream commit 248f064af222a1f97ee02c84a98013dfbccad386 ] + +When qeth_set_online() calls qeth_clear_working_pool_list() to roll +back after an error exit from qeth_hardsetup_card(), we are at risk of +accessing card->qdio.in_q before it was allocated by +qeth_alloc_qdio_queues() via qeth_mpc_initialize(). + +qeth_clear_working_pool_list() then dereferences NULL, and by writing to +queue->bufs[i].pool_entry scribbles all over the CPU's lowcore. +Resulting in a crash when those lowcore areas are used next (eg. on +the next machine-check interrupt). + +Such a scenario would typically happen when the device is first set +online and its queues aren't allocated yet. An early IO error or certain +misconfigs (eg. mismatched transport mode, bad portno) then cause us to +error out from qeth_hardsetup_card() with card->qdio.in_q still being +NULL. + +Fix it by checking the pointer for NULL before accessing it. + +Note that we also have (rare) paths inside qeth_mpc_initialize() where +a configuration change can cause us to free the existing queues, +expecting that subsequent code will allocate them again. If we then +error out before that re-allocation happens, the same bug occurs. + +Fixes: eff73e16ee11 ("s390/qeth: tolerate pre-filled RX buffer") +Reported-by: Stefan Raspl +Root-caused-by: Heiko Carstens +Signed-off-by: Julian Wiedmann +Reviewed-by: Alexandra Winter +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_core_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 4d51c4ace8ea..7b0155b0e99e 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -210,6 +210,9 @@ static void qeth_clear_working_pool_list(struct qeth_card *card) + &card->qdio.in_buf_pool.entry_list, list) + list_del(&pool_entry->list); + ++ if (!queue) ++ return; ++ + for (i = 0; i < ARRAY_SIZE(queue->bufs); i++) + queue->bufs[i].pool_entry = NULL; + } +-- +2.33.0 + diff --git a/queue-5.10/series b/queue-5.10/series index d625a675fde..7c6dd0a96d3 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -30,3 +30,25 @@ scsi-sd_zbc-ensure-buffer-size-is-aligned-to-sector_size.patch drm-amd-pm-update-intermediate-power-state-for-si.patch net-hso-fix-muxed-tty-registration.patch comedi-fix-memory-leak-in-compat_insnlist.patch +afs-fix-incorrect-triggering-of-sillyrename-on-3rd-p.patch +afs-fix-updating-of-i_blocks-on-file-dir-extension.patch +platform-x86-intel-punit_ipc-drop-wrong-use-of-acpi_.patch +enetc-fix-illegal-access-when-reading-affinity_hint.patch +enetc-fix-uninitialized-struct-dim_sample-field-usag.patch +net-mlx4_en-resolve-bad-operstate-value.patch +bnxt_en-fix-tx-timeout-when-tx-ring-size-is-set-to-t.patch +net-hns3-fix-change-rss-hfunc-ineffective-issue.patch +net-hns3-fix-misuse-vf-id-and-vport-id-in-some-logs.patch +net-hns3-check-queue-id-range-before-using.patch +net-smc-add-missing-error-check-in-smc_clc_prfx_set.patch +net-smc-fix-workqueue-leaked-lock-in-smc_conn_abort_.patch +net-dsa-don-t-allocate-the-slave_mii_bus-using-devre.patch +net-dsa-realtek-register-the-mdio-bus-under-devres.patch +kselftest-arm64-signal-add-sve-to-the-set-of-feature.patch +kselftest-arm64-signal-skip-tests-if-required-featur.patch +s390-qeth-fix-null-deref-in-qeth_clear_working_pool_.patch +s390-qeth-fix-deadlock-during-failing-recovery.patch +gpio-uniphier-fix-void-functions-to-remove-return-va.patch +qed-rdma-don-t-wait-for-resources-under-hw-error-rec.patch +net-mlx4_en-don-t-allow-arfs-for-encapsulated-packet.patch +atlantic-fix-issue-in-the-pm-resume-flow.patch -- 2.47.3