From 9d1480fcadfbb26c7fc066df92b6de8edd3374f1 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 11 Apr 2021 23:51:15 -0400 Subject: [PATCH] Fixes for 5.11 Signed-off-by: Sasha Levin --- ...amd-xgbe-update-dma-coherency-values.patch | 42 +++ ...b01-set-vmmc-supply-for-both-sd-inte.patch | 45 +++ ...omnia-fix-hardware-buffer-management.patch | 43 +++ ...-fix-pmic-voltage-domains-for-bionic.patch | 39 +++ ...ate-rom-return-address-for-oswr-and-.patch | 124 +++++++++ ...mx8mm-q-fix-pad-control-of-sd1_data0.patch | 58 ++++ ...tel-hda-fix-core-status-verification.patch | 54 ++++ ...nxi-sun4i-codec-fill-asoc-card-owner.patch | 83 ++++++ ...wrong-bclk-and-lrclk-with-pll-enable.patch | 54 ++++ ...msg_namelen-values-depending-on-can_.patch | 134 +++++++++ ...g_namelen-values-depending-on-can_re.patch | 82 ++++++ ...support-for-half-duplex-spi-host-con.patch | 110 ++++++++ ...ark-union-inside-struct-can_frame-pa.patch | 78 ++++++ ...lid-usage-of-list-cursor-in-register.patch | 88 ++++++ ...d-usage-of-list-cursor-in-unregister.patch | 107 ++++++++ ...-update-the-clock-ops-for-the-sc7180.patch | 257 ++++++++++++++++++ ...ecting-sge_qbase-regs-during-traffic.patch | 83 ++++++ ...hdlc_fr-fix-a-double-free-in-pvc_xmi.patch | 51 ++++ ...-version-check-for-the-a650-sqe-micr.patch | 55 ++++ ...1-program-3d_merge-only-if-block-is-.patch | 40 +++ ...data-to-null-when-msm_drm_init-fails.patch | 54 ++++ ...rtc-reduce-pv-fifo-threshold-on-hvs4.patch | 64 +++++ ..._f_sctp_crc-bit-from-features-for-es.patch | 70 +++++ ...e-fix-a-use-after-free-in-myri10ge_s.patch | 40 +++ ...dify-the-shared-tunnel-info-when-pmt.patch | 81 ++++++ ...dle-error-code-at-mac-address-change.patch | 39 +++ ...s-fix-memory-handling-in-follow_link.patch | 55 ++++ ...djust-bus_freq_hz-when-refuse-high-s.patch | 38 +++ ...i2c-jz4780-fix-bug-for-ingenic-x1000.patch | 49 ++++ ...d-asym_pause-to-supported-link-modes.patch | 41 +++ ...0e-fix-display-statistics-for-veb_tc.patch | 115 ++++++++ ...l-oops-when-i40e-driver-removes-vf-s.patch | 84 ++++++ ...ix-parameters-in-aq_get_phy_register.patch | 39 +++ ...ng-of-single-packets-in-xsk-zero-cop.patch | 64 +++++ ...-disabled-bit-in-the-regulatory-capa.patch | 41 +++ ...ix-ecn-marking-in-tunnel-decapsulati.patch | 120 ++++++++ ...ast-related-sockopt-on-mptcp-sockets.patch | 102 +++++++ ...cp-provide-subflow-aware-release-fun.patch | 118 ++++++++ ...uninitialised-struct-field-bo-unlock.patch | 39 +++ ...ix-type-was-not-set-for-devlink-port.patch | 52 ++++ ...f-down-state-bit-before-request-link.patch | 51 ++++ ...restore-cmp-registers-on-resume-path.patch | 55 ++++ ...e-auxiliary-bus-driver-eth-rep-first.patch | 48 ++++ ...on-t-request-more-than-supported-eqs.patch | 57 ++++ ...hw-spec-violation-configuring-uplink.patch | 42 +++ .../net-mlx5-fix-pbmc-register-mapping.patch | 37 +++ ...ix-placement-of-log_max_flow_counter.patch | 44 +++ .../net-mlx5-fix-pplm-register-mapping.patch | 38 +++ ...ethtool-indication-of-connector-type.patch | 73 +++++ ...t-mlx5e-fix-mapping-of-ct_label-zero.patch | 130 +++++++++ ...tee-room-for-xsk-wakeup-nop-on-async.patch | 169 ++++++++++++ ...oid-channel_monitor-hrtimer-deadlock.patch | 76 ++++++ ...-only-advertise-eee-for-supported-mo.patch | 56 ++++ ...-memory-leak-on-qrtr_tx_wait-failure.patch | 43 +++ ...e-after-free-in-rds_message_map_page.patch | 45 +++ ...x-a-double-free-in-tipc_sk_mcast_rcv.patch | 44 +++ ...d-support-for-getsockopt-.-.-udp_gro.patch | 41 +++ ...e-sequence-counter-per-network-names.patch | 104 +++++++ ...ignore-duplicate-merge-hints-from-fw.patch | 219 +++++++++++++++ ...send-of-uninitialized-stack-memory-i.patch | 47 ++++ queue-5.11/perf-inject-fix-repipe-usage.patch | 54 ++++ ...f-report-fix-wrong-lbr-block-sorting.patch | 113 ++++++++ ...el-hid-fix-spurious-wakeups-caused-b.patch | 65 +++++ .../rdma-addr-be-strict-with-gid-size.patch | 41 +++ ...-for-ipv6-address-properly-while-des.patch | 39 +++ ...rnel-panic-when-trying-to-access-rec.patch | 79 ++++++ ...ose-rtrs-client-conn-before-destroyi.patch | 131 +++++++++ ...71mwv-fix-avs-and-dvfs-voltage-range.patch | 50 ++++ ...ix-firmware-loading-crashes-on-k3-so.patch | 44 +++ ...-qcom-pil_info-avoid-64-bit-division.patch | 43 +++ ...-marvell-armada-cp110-switch-to-per-.patch | 59 ++++ ...-inline-assembly-register-clobbering.patch | 46 ++++ ...ff-by-one-checks-in-red_check_params.patch | 73 +++++ ...x-task-management-request-completion.patch | 40 +++ ...x-wrong-task-tag-used-in-task-manage.patch | 107 ++++++++ queue-5.11/series | 87 ++++++ ...fix-conflicting-alignment-attributes.patch | 44 +++ ...he-tmp-aead-refcnt-before-attaching-.patch | 65 +++++ ...pa-mlx5-fix-wrong-use-of-bit-numbers.patch | 50 ++++ ...-exclude-header-length-and-fcs-from-.patch | 84 ++++++ ...irtchnl-fix-layout-of-rss-structures.patch | 45 +++ ...ify-the-shared-tunnel-info-when-pmtu.patch | 83 ++++++ ...he-position-of-debug_work_activate-i.patch | 46 ++++ ...rn_frame-kernel-bug-throw-for-page_p.patch | 51 ++++ ...pointer-dereference-on-policy-lookup.patch | 40 +++ ...ix-ipv4-pmtu-check-to-honor-ip-heade.patch | 48 ++++ ...vate-skb-extensions-for-segmented-an.patch | 90 ++++++ ...socket-sk-instead-of-skb-socket-for-.patch | 152 +++++++++++ 88 files changed, 6220 insertions(+) create mode 100644 queue-5.11/amd-xgbe-update-dma-coherency-values.patch create mode 100644 queue-5.11/arm-dts-imx6-pbab01-set-vmmc-supply-for-both-sd-inte.patch create mode 100644 queue-5.11/arm-dts-turris-omnia-fix-hardware-buffer-management.patch create mode 100644 queue-5.11/arm-omap4-fix-pmic-voltage-domains-for-bionic.patch create mode 100644 queue-5.11/arm-omap4-pm-update-rom-return-address-for-oswr-and-.patch create mode 100644 queue-5.11/arm64-dts-imx8mm-q-fix-pad-control-of-sd1_data0.patch create mode 100644 queue-5.11/asoc-sof-intel-hda-fix-core-status-verification.patch create mode 100644 queue-5.11/asoc-sunxi-sun4i-codec-fill-asoc-card-owner.patch create mode 100644 queue-5.11/asoc-wm8960-fix-wrong-bclk-and-lrclk-with-pll-enable.patch create mode 100644 queue-5.11/can-bcm-raw-fix-msg_namelen-values-depending-on-can_.patch create mode 100644 queue-5.11/can-isotp-fix-msg_namelen-values-depending-on-can_re.patch create mode 100644 queue-5.11/can-mcp251x-fix-support-for-half-duplex-spi-host-con.patch create mode 100644 queue-5.11/can-uapi-can.h-mark-union-inside-struct-can_frame-pa.patch create mode 100644 queue-5.11/clk-fix-invalid-usage-of-list-cursor-in-register.patch create mode 100644 queue-5.11/clk-fix-invalid-usage-of-list-cursor-in-unregister.patch create mode 100644 queue-5.11/clk-qcom-camcc-update-the-clock-ops-for-the-sc7180.patch create mode 100644 queue-5.11/cxgb4-avoid-collecting-sge_qbase-regs-during-traffic.patch create mode 100644 queue-5.11/drivers-net-wan-hdlc_fr-fix-a-double-free-in-pvc_xmi.patch create mode 100644 queue-5.11/drm-msm-a6xx-fix-version-check-for-the-a650-sqe-micr.patch create mode 100644 queue-5.11/drm-msm-disp-dpu1-program-3d_merge-only-if-block-is-.patch create mode 100644 queue-5.11/drm-msm-set-drvdata-to-null-when-msm_drm_init-fails.patch create mode 100644 queue-5.11/drm-vc4-crtc-reduce-pv-fifo-threshold-on-hvs4.patch create mode 100644 queue-5.11/esp-delete-netif_f_sctp_crc-bit-from-features-for-es.patch create mode 100644 queue-5.11/ethernet-myri10ge-fix-a-use-after-free-in-myri10ge_s.patch create mode 100644 queue-5.11/geneve-do-not-modify-the-shared-tunnel-info-when-pmt.patch create mode 100644 queue-5.11/gianfar-handle-error-code-at-mac-address-change.patch create mode 100644 queue-5.11/hostfs-fix-memory-handling-in-follow_link.patch create mode 100644 queue-5.11/i2c-designware-adjust-bus_freq_hz-when-refuse-high-s.patch create mode 100644 queue-5.11/i2c-jz4780-fix-bug-for-ingenic-x1000.patch create mode 100644 queue-5.11/i40e-added-asym_pause-to-supported-link-modes.patch create mode 100644 queue-5.11/i40e-fix-display-statistics-for-veb_tc.patch create mode 100644 queue-5.11/i40e-fix-kernel-oops-when-i40e-driver-removes-vf-s.patch create mode 100644 queue-5.11/i40e-fix-parameters-in-aq_get_phy_register.patch create mode 100644 queue-5.11/i40e-fix-receiving-of-single-packets-in-xsk-zero-cop.patch create mode 100644 queue-5.11/iwlwifi-fix-11ax-disabled-bit-in-the-regulatory-capa.patch create mode 100644 queue-5.11/mlxsw-spectrum-fix-ecn-marking-in-tunnel-decapsulati.patch create mode 100644 queue-5.11/mptcp-forbit-mcast-related-sockopt-on-mptcp-sockets.patch create mode 100644 queue-5.11/mptcp-revert-mptcp-provide-subflow-aware-release-fun.patch create mode 100644 queue-5.11/net-cls_api-fix-uninitialised-struct-field-bo-unlock.patch create mode 100644 queue-5.11/net-dsa-fix-type-was-not-set-for-devlink-port.patch create mode 100644 queue-5.11/net-hns3-clear-vf-down-state-bit-before-request-link.patch create mode 100644 queue-5.11/net-macb-restore-cmp-registers-on-resume-path.patch create mode 100644 queue-5.11/net-mlx5-delete-auxiliary-bus-driver-eth-rep-first.patch create mode 100644 queue-5.11/net-mlx5-don-t-request-more-than-supported-eqs.patch create mode 100644 queue-5.11/net-mlx5-fix-hw-spec-violation-configuring-uplink.patch create mode 100644 queue-5.11/net-mlx5-fix-pbmc-register-mapping.patch create mode 100644 queue-5.11/net-mlx5-fix-placement-of-log_max_flow_counter.patch create mode 100644 queue-5.11/net-mlx5-fix-pplm-register-mapping.patch create mode 100644 queue-5.11/net-mlx5e-fix-ethtool-indication-of-connector-type.patch create mode 100644 queue-5.11/net-mlx5e-fix-mapping-of-ct_label-zero.patch create mode 100644 queue-5.11/net-mlx5e-guarantee-room-for-xsk-wakeup-nop-on-async.patch create mode 100644 queue-5.11/net-ncsi-avoid-channel_monitor-hrtimer-deadlock.patch create mode 100644 queue-5.11/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch create mode 100644 queue-5.11/net-qrtr-fix-memory-leak-on-qrtr_tx_wait-failure.patch create mode 100644 queue-5.11/net-rds-fix-a-use-after-free-in-rds_message_map_page.patch create mode 100644 queue-5.11/net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch create mode 100644 queue-5.11/net-udp-add-support-for-getsockopt-.-.-udp_gro.patch create mode 100644 queue-5.11/net-xfrm-localize-sequence-counter-per-network-names.patch create mode 100644 queue-5.11/nfp-flower-ignore-duplicate-merge-hints-from-fw.patch create mode 100644 queue-5.11/openvswitch-fix-send-of-uninitialized-stack-memory-i.patch create mode 100644 queue-5.11/perf-inject-fix-repipe-usage.patch create mode 100644 queue-5.11/perf-report-fix-wrong-lbr-block-sorting.patch create mode 100644 queue-5.11/platform-x86-intel-hid-fix-spurious-wakeups-caused-b.patch create mode 100644 queue-5.11/rdma-addr-be-strict-with-gid-size.patch create mode 100644 queue-5.11/rdma-cxgb4-check-for-ipv6-address-properly-while-des.patch create mode 100644 queue-5.11/rdma-qedr-fix-kernel-panic-when-trying-to-access-rec.patch create mode 100644 queue-5.11/rdma-rtrs-clt-close-rtrs-client-conn-before-destroyi.patch create mode 100644 queue-5.11/regulator-bd9571mwv-fix-avs-and-dvfs-voltage-range.patch create mode 100644 queue-5.11/remoteproc-pru-fix-firmware-loading-crashes-on-k3-so.patch create mode 100644 queue-5.11/remoteproc-qcom-pil_info-avoid-64-bit-division.patch create mode 100644 queue-5.11/revert-arm64-dts-marvell-armada-cp110-switch-to-per-.patch create mode 100644 queue-5.11/s390-cpcmd-fix-inline-assembly-register-clobbering.patch create mode 100644 queue-5.11/sch_red-fix-off-by-one-checks-in-red_check_params.patch create mode 100644 queue-5.11/scsi-ufs-core-fix-task-management-request-completion.patch create mode 100644 queue-5.11/scsi-ufs-core-fix-wrong-task-tag-used-in-task-manage.patch create mode 100644 queue-5.11/soc-fsl-qbman-fix-conflicting-alignment-attributes.patch create mode 100644 queue-5.11/tipc-increment-the-tmp-aead-refcnt-before-attaching-.patch create mode 100644 queue-5.11/vdpa-mlx5-fix-wrong-use-of-bit-numbers.patch create mode 100644 queue-5.11/vdpa-mlx5-should-exclude-header-length-and-fcs-from-.patch create mode 100644 queue-5.11/virtchnl-fix-layout-of-rss-structures.patch create mode 100644 queue-5.11/vxlan-do-not-modify-the-shared-tunnel-info-when-pmtu.patch create mode 100644 queue-5.11/workqueue-move-the-position-of-debug_work_activate-i.patch create mode 100644 queue-5.11/xdp-fix-xdp_return_frame-kernel-bug-throw-for-page_p.patch create mode 100644 queue-5.11/xfrm-fix-null-pointer-dereference-on-policy-lookup.patch create mode 100644 queue-5.11/xfrm-interface-fix-ipv4-pmtu-check-to-honor-ip-heade.patch create mode 100644 queue-5.11/xfrm-provide-private-skb-extensions-for-segmented-an.patch create mode 100644 queue-5.11/xfrm-use-actual-socket-sk-instead-of-skb-socket-for-.patch diff --git a/queue-5.11/amd-xgbe-update-dma-coherency-values.patch b/queue-5.11/amd-xgbe-update-dma-coherency-values.patch new file mode 100644 index 00000000000..51fff86f213 --- /dev/null +++ b/queue-5.11/amd-xgbe-update-dma-coherency-values.patch @@ -0,0 +1,42 @@ +From b51f0275a2370225ee26ba9885d0a7d8826a8360 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 08:39:12 +0530 +Subject: amd-xgbe: Update DMA coherency values + +From: Shyam Sundar S K + +[ Upstream commit d75135082698140a26a56defe1bbc1b06f26a41f ] + +Based on the IOMMU configuration, the current cache control settings can +result in possible coherency issues. The hardware team has recommended +new settings for the PCI device path to eliminate the issue. + +Fixes: 6f595959c095 ("amd-xgbe: Adjust register settings to improve performance") +Signed-off-by: Shyam Sundar S K +Acked-by: Tom Lendacky +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/xgbe/xgbe.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h +index ba8321ec1ee7..3305979a9f7c 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h +@@ -180,9 +180,9 @@ + #define XGBE_DMA_SYS_AWCR 0x30303030 + + /* DMA cache settings - PCI device */ +-#define XGBE_DMA_PCI_ARCR 0x00000003 +-#define XGBE_DMA_PCI_AWCR 0x13131313 +-#define XGBE_DMA_PCI_AWARCR 0x00000313 ++#define XGBE_DMA_PCI_ARCR 0x000f0f0f ++#define XGBE_DMA_PCI_AWCR 0x0f0f0f0f ++#define XGBE_DMA_PCI_AWARCR 0x00000f0f + + /* DMA channel interrupt modes */ + #define XGBE_IRQ_MODE_EDGE 0 +-- +2.30.2 + diff --git a/queue-5.11/arm-dts-imx6-pbab01-set-vmmc-supply-for-both-sd-inte.patch b/queue-5.11/arm-dts-imx6-pbab01-set-vmmc-supply-for-both-sd-inte.patch new file mode 100644 index 00000000000..2569bdff144 --- /dev/null +++ b/queue-5.11/arm-dts-imx6-pbab01-set-vmmc-supply-for-both-sd-inte.patch @@ -0,0 +1,45 @@ +From a6f99423d4baa82d13969e20c9702097e7e2290b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 15:01:03 +0200 +Subject: ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces + +From: Stefan Riedmueller + +[ Upstream commit f57011e72f5fe0421ec7a812beb1b57bdf4bb47f ] + +Setting the vmmc supplies is crucial since otherwise the supplying +regulators get disabled and the SD interfaces are no longer powered +which leads to system failures if the system is booted from that SD +interface. + +Fixes: 1e44d3f880d5 ("ARM i.MX6Q: dts: Enable I2C1 with EEPROM and PMIC on Phytec phyFLEX-i.MX6 Ouad module") +Signed-off-by: Stefan Riedmueller +Reviewed-by: Fabio Estevam +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi +index 7a1e53195785..f28a96fcf23e 100644 +--- a/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-phytec-pfla02.dtsi +@@ -433,6 +433,7 @@ + pinctrl-0 = <&pinctrl_usdhc2>; + cd-gpios = <&gpio1 4 GPIO_ACTIVE_LOW>; + wp-gpios = <&gpio1 2 GPIO_ACTIVE_HIGH>; ++ vmmc-supply = <&vdd_sd1_reg>; + status = "disabled"; + }; + +@@ -442,5 +443,6 @@ + &pinctrl_usdhc3_cdwp>; + cd-gpios = <&gpio1 27 GPIO_ACTIVE_LOW>; + wp-gpios = <&gpio1 29 GPIO_ACTIVE_HIGH>; ++ vmmc-supply = <&vdd_sd0_reg>; + status = "disabled"; + }; +-- +2.30.2 + diff --git a/queue-5.11/arm-dts-turris-omnia-fix-hardware-buffer-management.patch b/queue-5.11/arm-dts-turris-omnia-fix-hardware-buffer-management.patch new file mode 100644 index 00000000000..8432975c20a --- /dev/null +++ b/queue-5.11/arm-dts-turris-omnia-fix-hardware-buffer-management.patch @@ -0,0 +1,43 @@ +From bcb5e7c19d9de32fe36621f7dcbd57086612daaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Feb 2021 15:30:38 +0000 +Subject: ARM: dts: turris-omnia: fix hardware buffer management +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rui Salvaterra + +[ Upstream commit 5b2c7e0ae762fff2b172caf16b2766cc3e1ad859 ] + +Hardware buffer management has never worked on the Turris Omnia, as the +required MBus window hadn't been reserved. Fix thusly. + +Fixes: 018b88eee1a2 ("ARM: dts: turris-omnia: enable HW buffer management") + +Signed-off-by: Rui Salvaterra +Reviewed-by: Marek Behún +Tested-by: Klaus Kudielka +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-385-turris-omnia.dts | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/armada-385-turris-omnia.dts b/arch/arm/boot/dts/armada-385-turris-omnia.dts +index b0f3fd8e1429..5bd6a66d2c2b 100644 +--- a/arch/arm/boot/dts/armada-385-turris-omnia.dts ++++ b/arch/arm/boot/dts/armada-385-turris-omnia.dts +@@ -32,7 +32,8 @@ + ranges = ; ++ MBUS_ID(0x09, 0x15) 0 0xf1110000 0x10000 ++ MBUS_ID(0x0c, 0x04) 0 0xf1200000 0x100000>; + + internal-regs { + +-- +2.30.2 + diff --git a/queue-5.11/arm-omap4-fix-pmic-voltage-domains-for-bionic.patch b/queue-5.11/arm-omap4-fix-pmic-voltage-domains-for-bionic.patch new file mode 100644 index 00000000000..84d7d1c6fbb --- /dev/null +++ b/queue-5.11/arm-omap4-fix-pmic-voltage-domains-for-bionic.patch @@ -0,0 +1,39 @@ +From ad332a08b2e711a490b60091185f06f83fea4011 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Mar 2021 18:41:01 +0200 +Subject: ARM: OMAP4: Fix PMIC voltage domains for bionic + +From: Tony Lindgren + +[ Upstream commit 30916faa1a6009122e10d0c42338b8db44a36fde ] + +We are now registering the mpu domain three times instead of registering +mpu, core and iva domains like we should. + +Fixes: d44fa156dcb2 ("ARM: OMAP2+: Configure voltage controller for cpcap") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/pmic-cpcap.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/mach-omap2/pmic-cpcap.c b/arch/arm/mach-omap2/pmic-cpcap.c +index 09076ad0576d..668dc84fd31e 100644 +--- a/arch/arm/mach-omap2/pmic-cpcap.c ++++ b/arch/arm/mach-omap2/pmic-cpcap.c +@@ -246,10 +246,10 @@ int __init omap4_cpcap_init(void) + omap_voltage_register_pmic(voltdm, &omap443x_max8952_mpu); + + if (of_machine_is_compatible("motorola,droid-bionic")) { +- voltdm = voltdm_lookup("mpu"); ++ voltdm = voltdm_lookup("core"); + omap_voltage_register_pmic(voltdm, &omap_cpcap_core); + +- voltdm = voltdm_lookup("mpu"); ++ voltdm = voltdm_lookup("iva"); + omap_voltage_register_pmic(voltdm, &omap_cpcap_iva); + } else { + voltdm = voltdm_lookup("core"); +-- +2.30.2 + diff --git a/queue-5.11/arm-omap4-pm-update-rom-return-address-for-oswr-and-.patch b/queue-5.11/arm-omap4-pm-update-rom-return-address-for-oswr-and-.patch new file mode 100644 index 00000000000..171a06903b6 --- /dev/null +++ b/queue-5.11/arm-omap4-pm-update-rom-return-address-for-oswr-and-.patch @@ -0,0 +1,124 @@ +From 1955ae13b7aae10e09750f2a5c68ceb6d2d20aab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Mar 2021 18:35:44 +0200 +Subject: ARM: OMAP4: PM: update ROM return address for OSWR and OFF + +From: Carlos Leija + +[ Upstream commit b3d09a06d89f474cb52664e016849315a97e09d9 ] + +We need to add a dummy smc call to the cpuidle wakeup path to force the +ROM code to save the return address after MMU is enabled again. This is +needed to prevent random hangs on secure devices like droid4. + +Otherwise the system will eventually hang when entering deeper SoC idle +states with the core and mpu domains in open-switch retention (OSWR). +The hang happens as the ROM code tries to use the earlier physical return +address set by omap-headsmp.S with MMU off while waking up CPU1 again. + +The hangs started happening in theory already with commit caf8c87d7ff2 +("ARM: OMAP2+: Allow core oswr for omap4"), but in practise the issue went +unnoticed as various drivers were often blocking any deeper idle states +with hardware autoidle features. + +This patch is based on an earlier TI Linux kernel tree commit 92f0b3028d9e +("OMAP4: PM: update ROM return address for OSWR and OFF") written by +Carlos Leija , Praneeth Bajjuri , and +Bryan Buckley . A later version of the patch was +updated to use CPU_PM notifiers by Tero Kristo . + +Signed-off-by: Carlos Leija +Signed-off-by: Praneeth Bajjuri +Signed-off-by: Bryan Buckley +Signed-off-by: Tero Kristo +Fixes: caf8c87d7ff2 ("ARM: OMAP2+: Allow core oswr for omap4") +Reported-by: Carl Philipp Klemm +Reported-by: Merlijn Wajer +Cc: Ivan Jelincic +Cc: Pavel Machek +Cc: Sebastian Reichel +Cc: Tero Kristo +[tony@atomide.com: updated to apply, updated description] +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap-secure.c | 39 +++++++++++++++++++++++++++++++ + arch/arm/mach-omap2/omap-secure.h | 1 + + 2 files changed, 40 insertions(+) + +diff --git a/arch/arm/mach-omap2/omap-secure.c b/arch/arm/mach-omap2/omap-secure.c +index f70d561f37f7..0659ab4cb0af 100644 +--- a/arch/arm/mach-omap2/omap-secure.c ++++ b/arch/arm/mach-omap2/omap-secure.c +@@ -9,6 +9,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -20,6 +21,7 @@ + + #include "common.h" + #include "omap-secure.h" ++#include "soc.h" + + static phys_addr_t omap_secure_memblock_base; + +@@ -213,3 +215,40 @@ void __init omap_secure_init(void) + { + omap_optee_init_check(); + } ++ ++/* ++ * Dummy dispatcher call after core OSWR and MPU off. Updates the ROM return ++ * address after MMU has been re-enabled after CPU1 has been woken up again. ++ * Otherwise the ROM code will attempt to use the earlier physical return ++ * address that got set with MMU off when waking up CPU1. Only used on secure ++ * devices. ++ */ ++static int cpu_notifier(struct notifier_block *nb, unsigned long cmd, void *v) ++{ ++ switch (cmd) { ++ case CPU_CLUSTER_PM_EXIT: ++ omap_secure_dispatcher(OMAP4_PPA_SERVICE_0, ++ FLAG_START_CRITICAL, ++ 0, 0, 0, 0, 0); ++ break; ++ default: ++ break; ++ } ++ ++ return NOTIFY_OK; ++} ++ ++static struct notifier_block secure_notifier_block = { ++ .notifier_call = cpu_notifier, ++}; ++ ++static int __init secure_pm_init(void) ++{ ++ if (omap_type() == OMAP2_DEVICE_TYPE_GP || !soc_is_omap44xx()) ++ return 0; ++ ++ cpu_pm_register_notifier(&secure_notifier_block); ++ ++ return 0; ++} ++omap_arch_initcall(secure_pm_init); +diff --git a/arch/arm/mach-omap2/omap-secure.h b/arch/arm/mach-omap2/omap-secure.h +index 4aaa95706d39..172069f31616 100644 +--- a/arch/arm/mach-omap2/omap-secure.h ++++ b/arch/arm/mach-omap2/omap-secure.h +@@ -50,6 +50,7 @@ + #define OMAP5_DRA7_MON_SET_ACR_INDEX 0x107 + + /* Secure PPA(Primary Protected Application) APIs */ ++#define OMAP4_PPA_SERVICE_0 0x21 + #define OMAP4_PPA_L2_POR_INDEX 0x23 + #define OMAP4_PPA_CPU_ACTRL_SMP_INDEX 0x25 + +-- +2.30.2 + diff --git a/queue-5.11/arm64-dts-imx8mm-q-fix-pad-control-of-sd1_data0.patch b/queue-5.11/arm64-dts-imx8mm-q-fix-pad-control-of-sd1_data0.patch new file mode 100644 index 00000000000..a37430e0be2 --- /dev/null +++ b/queue-5.11/arm64-dts-imx8mm-q-fix-pad-control-of-sd1_data0.patch @@ -0,0 +1,58 @@ +From c47b5516e121320189d072448d1ec8987ab27965 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 14:28:41 +0100 +Subject: arm64: dts: imx8mm/q: Fix pad control of SD1_DATA0 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Oliver Stäbler + +[ Upstream commit 5cfad4f45806f6f898b63b8c77cea7452c704cb3 ] + +Fix address of the pad control register +(IOMUXC_SW_PAD_CTL_PAD_SD1_DATA0) for SD1_DATA0_GPIO2_IO2. This seems +to be a typo but it leads to an exception when pinctrl is applied due to +wrong memory address access. + +Signed-off-by: Oliver Stäbler +Reviewed-by: Fabio Estevam +Acked-by: Rob Herring +Fixes: c1c9d41319c3 ("dt-bindings: imx: Add pinctrl binding doc for imx8mm") +Fixes: 748f908cc882 ("arm64: add basic DTS for i.MX8MQ") +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h | 2 +- + arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h +index 5ccc4cc91959..a003e6af3353 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h ++++ b/arch/arm64/boot/dts/freescale/imx8mm-pinfunc.h +@@ -124,7 +124,7 @@ + #define MX8MM_IOMUXC_SD1_CMD_USDHC1_CMD 0x0A4 0x30C 0x000 0x0 0x0 + #define MX8MM_IOMUXC_SD1_CMD_GPIO2_IO1 0x0A4 0x30C 0x000 0x5 0x0 + #define MX8MM_IOMUXC_SD1_DATA0_USDHC1_DATA0 0x0A8 0x310 0x000 0x0 0x0 +-#define MX8MM_IOMUXC_SD1_DATA0_GPIO2_IO2 0x0A8 0x31 0x000 0x5 0x0 ++#define MX8MM_IOMUXC_SD1_DATA0_GPIO2_IO2 0x0A8 0x310 0x000 0x5 0x0 + #define MX8MM_IOMUXC_SD1_DATA1_USDHC1_DATA1 0x0AC 0x314 0x000 0x0 0x0 + #define MX8MM_IOMUXC_SD1_DATA1_GPIO2_IO3 0x0AC 0x314 0x000 0x5 0x0 + #define MX8MM_IOMUXC_SD1_DATA2_USDHC1_DATA2 0x0B0 0x318 0x000 0x0 0x0 +diff --git a/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h b/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h +index b94b02080a34..68e8fa172974 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h ++++ b/arch/arm64/boot/dts/freescale/imx8mq-pinfunc.h +@@ -130,7 +130,7 @@ + #define MX8MQ_IOMUXC_SD1_CMD_USDHC1_CMD 0x0A4 0x30C 0x000 0x0 0x0 + #define MX8MQ_IOMUXC_SD1_CMD_GPIO2_IO1 0x0A4 0x30C 0x000 0x5 0x0 + #define MX8MQ_IOMUXC_SD1_DATA0_USDHC1_DATA0 0x0A8 0x310 0x000 0x0 0x0 +-#define MX8MQ_IOMUXC_SD1_DATA0_GPIO2_IO2 0x0A8 0x31 0x000 0x5 0x0 ++#define MX8MQ_IOMUXC_SD1_DATA0_GPIO2_IO2 0x0A8 0x310 0x000 0x5 0x0 + #define MX8MQ_IOMUXC_SD1_DATA1_USDHC1_DATA1 0x0AC 0x314 0x000 0x0 0x0 + #define MX8MQ_IOMUXC_SD1_DATA1_GPIO2_IO3 0x0AC 0x314 0x000 0x5 0x0 + #define MX8MQ_IOMUXC_SD1_DATA2_USDHC1_DATA2 0x0B0 0x318 0x000 0x0 0x0 +-- +2.30.2 + diff --git a/queue-5.11/asoc-sof-intel-hda-fix-core-status-verification.patch b/queue-5.11/asoc-sof-intel-hda-fix-core-status-verification.patch new file mode 100644 index 00000000000..e92acb8351b --- /dev/null +++ b/queue-5.11/asoc-sof-intel-hda-fix-core-status-verification.patch @@ -0,0 +1,54 @@ +From 444e0d07488e81db5d899814d0ed72ca7518301f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 11:37:21 -0500 +Subject: ASoC: SOF: Intel: HDA: fix core status verification + +From: Guennadi Liakhovetski + +[ Upstream commit 927280909fa7d8e61596800d82f18047c6cfbbe4 ] + +When checking for enabled cores it isn't enough to check that +some of the requested cores are running, we have to check that +all of them are. + +Fixes: 747503b1813a ("ASoC: SOF: Intel: Add Intel specific HDA DSP HW operations") +Reviewed-by: Kai Vehmanen +Reviewed-by: Ranjani Sridharan +Signed-off-by: Guennadi Liakhovetski +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210322163728.16616-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-dsp.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-dsp.c b/sound/soc/sof/intel/hda-dsp.c +index 012bac41fee0..ea8e7ad8684d 100644 +--- a/sound/soc/sof/intel/hda-dsp.c ++++ b/sound/soc/sof/intel/hda-dsp.c +@@ -226,10 +226,17 @@ bool hda_dsp_core_is_enabled(struct snd_sof_dev *sdev, + + val = snd_sof_dsp_read(sdev, HDA_DSP_BAR, HDA_DSP_REG_ADSPCS); + +- is_enable = (val & HDA_DSP_ADSPCS_CPA_MASK(core_mask)) && +- (val & HDA_DSP_ADSPCS_SPA_MASK(core_mask)) && +- !(val & HDA_DSP_ADSPCS_CRST_MASK(core_mask)) && +- !(val & HDA_DSP_ADSPCS_CSTALL_MASK(core_mask)); ++#define MASK_IS_EQUAL(v, m, field) ({ \ ++ u32 _m = field(m); \ ++ ((v) & _m) == _m; \ ++}) ++ ++ is_enable = MASK_IS_EQUAL(val, core_mask, HDA_DSP_ADSPCS_CPA_MASK) && ++ MASK_IS_EQUAL(val, core_mask, HDA_DSP_ADSPCS_SPA_MASK) && ++ !(val & HDA_DSP_ADSPCS_CRST_MASK(core_mask)) && ++ !(val & HDA_DSP_ADSPCS_CSTALL_MASK(core_mask)); ++ ++#undef MASK_IS_EQUAL + + dev_dbg(sdev->dev, "DSP core(s) enabled? %d : core_mask %x\n", + is_enable, core_mask); +-- +2.30.2 + diff --git a/queue-5.11/asoc-sunxi-sun4i-codec-fill-asoc-card-owner.patch b/queue-5.11/asoc-sunxi-sun4i-codec-fill-asoc-card-owner.patch new file mode 100644 index 00000000000..3b10202dca7 --- /dev/null +++ b/queue-5.11/asoc-sunxi-sun4i-codec-fill-asoc-card-owner.patch @@ -0,0 +1,83 @@ +From 09a467e0cfd5192d9814e21834c66c461785d2f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 17:18:43 +0200 +Subject: ASoC: sunxi: sun4i-codec: fill ASoC card owner + +From: Bastian Germann + +[ Upstream commit 7c0d6e482062eb5c06ecccfab340abc523bdca00 ] + +card->owner is a required property and since commit 81033c6b584b ("ALSA: +core: Warn on empty module") a warning is issued if it is empty. Add it. +This fixes following warning observed on Lamobo R1: + +WARNING: CPU: 1 PID: 190 at sound/core/init.c:207 snd_card_new+0x430/0x480 [snd] +Modules linked in: sun4i_codec(E+) sun4i_backend(E+) snd_soc_core(E) ... +CPU: 1 PID: 190 Comm: systemd-udevd Tainted: G C E 5.10.0-1-armmp #1 Debian 5.10.4-1 +Hardware name: Allwinner sun7i (A20) Family +Call trace: + (snd_card_new [snd]) + (snd_soc_bind_card [snd_soc_core]) + (snd_soc_register_card [snd_soc_core]) + (sun4i_codec_probe [sun4i_codec]) + +Fixes: 45fb6b6f2aa3 ("ASoC: sunxi: add support for the on-chip codec on early Allwinner SoCs") +Related: commit 3c27ea23ffb4 ("ASoC: qcom: Set card->owner to avoid warnings") +Related: commit ec653df2a0cb ("drm/vc4/vc4_hdmi: fill ASoC card owner") +Cc: linux-arm-kernel@lists.infradead.org +Cc: alsa-devel@alsa-project.org +Signed-off-by: Bastian Germann +Link: https://lore.kernel.org/r/20210331151843.30583-1-bage@linutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-codec.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/soc/sunxi/sun4i-codec.c b/sound/soc/sunxi/sun4i-codec.c +index 6c13cc84b3fb..2173991c13db 100644 +--- a/sound/soc/sunxi/sun4i-codec.c ++++ b/sound/soc/sunxi/sun4i-codec.c +@@ -1364,6 +1364,7 @@ static struct snd_soc_card *sun4i_codec_create_card(struct device *dev) + return ERR_PTR(-ENOMEM); + + card->dev = dev; ++ card->owner = THIS_MODULE; + card->name = "sun4i-codec"; + card->dapm_widgets = sun4i_codec_card_dapm_widgets; + card->num_dapm_widgets = ARRAY_SIZE(sun4i_codec_card_dapm_widgets); +@@ -1396,6 +1397,7 @@ static struct snd_soc_card *sun6i_codec_create_card(struct device *dev) + return ERR_PTR(-ENOMEM); + + card->dev = dev; ++ card->owner = THIS_MODULE; + card->name = "A31 Audio Codec"; + card->dapm_widgets = sun6i_codec_card_dapm_widgets; + card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets); +@@ -1449,6 +1451,7 @@ static struct snd_soc_card *sun8i_a23_codec_create_card(struct device *dev) + return ERR_PTR(-ENOMEM); + + card->dev = dev; ++ card->owner = THIS_MODULE; + card->name = "A23 Audio Codec"; + card->dapm_widgets = sun6i_codec_card_dapm_widgets; + card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets); +@@ -1487,6 +1490,7 @@ static struct snd_soc_card *sun8i_h3_codec_create_card(struct device *dev) + return ERR_PTR(-ENOMEM); + + card->dev = dev; ++ card->owner = THIS_MODULE; + card->name = "H3 Audio Codec"; + card->dapm_widgets = sun6i_codec_card_dapm_widgets; + card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets); +@@ -1525,6 +1529,7 @@ static struct snd_soc_card *sun8i_v3s_codec_create_card(struct device *dev) + return ERR_PTR(-ENOMEM); + + card->dev = dev; ++ card->owner = THIS_MODULE; + card->name = "V3s Audio Codec"; + card->dapm_widgets = sun6i_codec_card_dapm_widgets; + card->num_dapm_widgets = ARRAY_SIZE(sun6i_codec_card_dapm_widgets); +-- +2.30.2 + diff --git a/queue-5.11/asoc-wm8960-fix-wrong-bclk-and-lrclk-with-pll-enable.patch b/queue-5.11/asoc-wm8960-fix-wrong-bclk-and-lrclk-with-pll-enable.patch new file mode 100644 index 00000000000..a03ce8c9094 --- /dev/null +++ b/queue-5.11/asoc-wm8960-fix-wrong-bclk-and-lrclk-with-pll-enable.patch @@ -0,0 +1,54 @@ +From 199141a7dcf7552af76ef678d64ea144eec4e3b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 18:48:46 +0800 +Subject: ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some + chips + +From: Shengjiu Wang + +[ Upstream commit 16b82e75c15a7dbd564ea3654f3feb61df9e1e6f ] + +The input MCLK is 12.288MHz, the desired output sysclk is 11.2896MHz +and sample rate is 44100Hz, with the configuration pllprescale=2, +postscale=sysclkdiv=1, some chip may have wrong bclk +and lrclk output with pll enabled in master mode, but with the +configuration pllprescale=1, postscale=2, the output clock is correct. + +>From Datasheet, the PLL performs best when f2 is between +90MHz and 100MHz when the desired sysclk output is 11.2896MHz +or 12.288MHz, so sysclkdiv = 2 (f2/8) is the best choice. + +So search available sysclk_divs from 2 to 1 other than from 1 to 2. + +Fixes: 84fdc00d519f ("ASoC: codec: wm9860: Refactor PLL out freq search") +Signed-off-by: Shengjiu Wang +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/1616150926-22892-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8960.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c +index 660ec46eecf2..ceaf3bbb18e6 100644 +--- a/sound/soc/codecs/wm8960.c ++++ b/sound/soc/codecs/wm8960.c +@@ -707,7 +707,13 @@ int wm8960_configure_pll(struct snd_soc_component *component, int freq_in, + best_freq_out = -EINVAL; + *sysclk_idx = *dac_idx = *bclk_idx = -1; + +- for (i = 0; i < ARRAY_SIZE(sysclk_divs); ++i) { ++ /* ++ * From Datasheet, the PLL performs best when f2 is between ++ * 90MHz and 100MHz, the desired sysclk output is 11.2896MHz ++ * or 12.288MHz, then sysclkdiv = 2 is the best choice. ++ * So search sysclk_divs from 2 to 1 other than from 1 to 2. ++ */ ++ for (i = ARRAY_SIZE(sysclk_divs) - 1; i >= 0; --i) { + if (sysclk_divs[i] == -1) + continue; + for (j = 0; j < ARRAY_SIZE(dac_divs); ++j) { +-- +2.30.2 + diff --git a/queue-5.11/can-bcm-raw-fix-msg_namelen-values-depending-on-can_.patch b/queue-5.11/can-bcm-raw-fix-msg_namelen-values-depending-on-can_.patch new file mode 100644 index 00000000000..8ec9e3242c9 --- /dev/null +++ b/queue-5.11/can-bcm-raw-fix-msg_namelen-values-depending-on-can_.patch @@ -0,0 +1,134 @@ +From c2bf6d85c008c01b9fe82988aedfe67e21ee6fbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 13:58:48 +0100 +Subject: can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE + +From: Oliver Hartkopp + +[ Upstream commit 9e9714742fb70467464359693a73b911a630226f ] + +Since commit f5223e9eee65 ("can: extend sockaddr_can to include j1939 +members") the sockaddr_can has been extended in size and a new +CAN_REQUIRED_SIZE macro has been introduced to calculate the protocol +specific needed size. + +The ABI for the msg_name and msg_namelen has not been adapted to the +new CAN_REQUIRED_SIZE macro for the other CAN protocols which leads to +a problem when an existing binary reads the (increased) struct +sockaddr_can in msg_name. + +Fixes: f5223e9eee65 ("can: extend sockaddr_can to include j1939 members") +Reported-by: Richard Weinberger +Tested-by: Richard Weinberger +Acked-by: Kurt Van Dijck +Link: https://lore.kernel.org/linux-can/1135648123.112255.1616613706554.JavaMail.zimbra@nod.at/T/#t +Link: https://lore.kernel.org/r/20210325125850.1620-1-socketcan@hartkopp.net +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/bcm.c | 10 ++++++---- + net/can/raw.c | 14 ++++++++------ + 2 files changed, 14 insertions(+), 10 deletions(-) + +diff --git a/net/can/bcm.c b/net/can/bcm.c +index 0e5c37be4a2b..909b9e684e04 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -86,6 +86,8 @@ MODULE_LICENSE("Dual BSD/GPL"); + MODULE_AUTHOR("Oliver Hartkopp "); + MODULE_ALIAS("can-proto-2"); + ++#define BCM_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex) ++ + /* + * easy access to the first 64 bit of can(fd)_frame payload. cp->data is + * 64 bit aligned so the offset has to be multiples of 8 which is ensured +@@ -1292,7 +1294,7 @@ static int bcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + /* no bound device as default => check msg_name */ + DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name); + +- if (msg->msg_namelen < CAN_REQUIRED_SIZE(*addr, can_ifindex)) ++ if (msg->msg_namelen < BCM_MIN_NAMELEN) + return -EINVAL; + + if (addr->can_family != AF_CAN) +@@ -1534,7 +1536,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len, + struct net *net = sock_net(sk); + int ret = 0; + +- if (len < CAN_REQUIRED_SIZE(*addr, can_ifindex)) ++ if (len < BCM_MIN_NAMELEN) + return -EINVAL; + + lock_sock(sk); +@@ -1616,8 +1618,8 @@ static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + sock_recv_ts_and_drops(msg, sk, skb); + + if (msg->msg_name) { +- __sockaddr_check_size(sizeof(struct sockaddr_can)); +- msg->msg_namelen = sizeof(struct sockaddr_can); ++ __sockaddr_check_size(BCM_MIN_NAMELEN); ++ msg->msg_namelen = BCM_MIN_NAMELEN; + memcpy(msg->msg_name, skb->cb, msg->msg_namelen); + } + +diff --git a/net/can/raw.c b/net/can/raw.c +index 6ec8aa1d0da4..95113b0898b2 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -60,6 +60,8 @@ MODULE_LICENSE("Dual BSD/GPL"); + MODULE_AUTHOR("Urs Thuermann "); + MODULE_ALIAS("can-proto-1"); + ++#define RAW_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex) ++ + #define MASK_ALL 0 + + /* A raw socket has a list of can_filters attached to it, each receiving +@@ -394,7 +396,7 @@ static int raw_bind(struct socket *sock, struct sockaddr *uaddr, int len) + int err = 0; + int notify_enetdown = 0; + +- if (len < CAN_REQUIRED_SIZE(*addr, can_ifindex)) ++ if (len < RAW_MIN_NAMELEN) + return -EINVAL; + if (addr->can_family != AF_CAN) + return -EINVAL; +@@ -475,11 +477,11 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr, + if (peer) + return -EOPNOTSUPP; + +- memset(addr, 0, sizeof(*addr)); ++ memset(addr, 0, RAW_MIN_NAMELEN); + addr->can_family = AF_CAN; + addr->can_ifindex = ro->ifindex; + +- return sizeof(*addr); ++ return RAW_MIN_NAMELEN; + } + + static int raw_setsockopt(struct socket *sock, int level, int optname, +@@ -731,7 +733,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + if (msg->msg_name) { + DECLARE_SOCKADDR(struct sockaddr_can *, addr, msg->msg_name); + +- if (msg->msg_namelen < CAN_REQUIRED_SIZE(*addr, can_ifindex)) ++ if (msg->msg_namelen < RAW_MIN_NAMELEN) + return -EINVAL; + + if (addr->can_family != AF_CAN) +@@ -824,8 +826,8 @@ static int raw_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + sock_recv_ts_and_drops(msg, sk, skb); + + if (msg->msg_name) { +- __sockaddr_check_size(sizeof(struct sockaddr_can)); +- msg->msg_namelen = sizeof(struct sockaddr_can); ++ __sockaddr_check_size(RAW_MIN_NAMELEN); ++ msg->msg_namelen = RAW_MIN_NAMELEN; + memcpy(msg->msg_name, skb->cb, msg->msg_namelen); + } + +-- +2.30.2 + diff --git a/queue-5.11/can-isotp-fix-msg_namelen-values-depending-on-can_re.patch b/queue-5.11/can-isotp-fix-msg_namelen-values-depending-on-can_re.patch new file mode 100644 index 00000000000..cbc8e7021d1 --- /dev/null +++ b/queue-5.11/can-isotp-fix-msg_namelen-values-depending-on-can_re.patch @@ -0,0 +1,82 @@ +From d4e5e0a608f294d6290af25f88b34dddab69d4d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 13:58:49 +0100 +Subject: can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE + +From: Oliver Hartkopp + +[ Upstream commit f522d9559b07854c231cf8f0b8cb5a3578f8b44e ] + +Since commit f5223e9eee65 ("can: extend sockaddr_can to include j1939 +members") the sockaddr_can has been extended in size and a new +CAN_REQUIRED_SIZE macro has been introduced to calculate the protocol +specific needed size. + +The ABI for the msg_name and msg_namelen has not been adapted to the +new CAN_REQUIRED_SIZE macro for the other CAN protocols which leads to +a problem when an existing binary reads the (increased) struct +sockaddr_can in msg_name. + +Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") +Reported-by: Richard Weinberger +Acked-by: Kurt Van Dijck +Link: https://lore.kernel.org/linux-can/1135648123.112255.1616613706554.JavaMail.zimbra@nod.at/T/#t +Link: https://lore.kernel.org/r/20210325125850.1620-2-socketcan@hartkopp.net +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/isotp.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index 15ea1234d457..9f94ad3caee9 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -77,6 +77,8 @@ MODULE_LICENSE("Dual BSD/GPL"); + MODULE_AUTHOR("Oliver Hartkopp "); + MODULE_ALIAS("can-proto-6"); + ++#define ISOTP_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_addr.tp) ++ + #define SINGLE_MASK(id) (((id) & CAN_EFF_FLAG) ? \ + (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \ + (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG)) +@@ -986,7 +988,8 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + sock_recv_timestamp(msg, sk, skb); + + if (msg->msg_name) { +- msg->msg_namelen = sizeof(struct sockaddr_can); ++ __sockaddr_check_size(ISOTP_MIN_NAMELEN); ++ msg->msg_namelen = ISOTP_MIN_NAMELEN; + memcpy(msg->msg_name, skb->cb, msg->msg_namelen); + } + +@@ -1056,7 +1059,7 @@ static int isotp_bind(struct socket *sock, struct sockaddr *uaddr, int len) + int notify_enetdown = 0; + int do_rx_reg = 1; + +- if (len < CAN_REQUIRED_SIZE(struct sockaddr_can, can_addr.tp)) ++ if (len < ISOTP_MIN_NAMELEN) + return -EINVAL; + + /* do not register frame reception for functional addressing */ +@@ -1152,13 +1155,13 @@ static int isotp_getname(struct socket *sock, struct sockaddr *uaddr, int peer) + if (peer) + return -EOPNOTSUPP; + +- memset(addr, 0, sizeof(*addr)); ++ memset(addr, 0, ISOTP_MIN_NAMELEN); + addr->can_family = AF_CAN; + addr->can_ifindex = so->ifindex; + addr->can_addr.tp.rx_id = so->rxid; + addr->can_addr.tp.tx_id = so->txid; + +- return sizeof(*addr); ++ return ISOTP_MIN_NAMELEN; + } + + static int isotp_setsockopt(struct socket *sock, int level, int optname, +-- +2.30.2 + diff --git a/queue-5.11/can-mcp251x-fix-support-for-half-duplex-spi-host-con.patch b/queue-5.11/can-mcp251x-fix-support-for-half-duplex-spi-host-con.patch new file mode 100644 index 00000000000..797ea4f42f5 --- /dev/null +++ b/queue-5.11/can-mcp251x-fix-support-for-half-duplex-spi-host-con.patch @@ -0,0 +1,110 @@ +From 24f5188dc0178cd4c405855250707465c6c784ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 11:46:07 +0200 +Subject: can: mcp251x: fix support for half duplex SPI host controllers + +From: Marc Kleine-Budde + +[ Upstream commit 617085fca6375e2c1667d1fbfc6adc4034c85f04 ] + +Some SPI host controllers do not support full-duplex SPI transfers. + +The function mcp251x_spi_trans() does a full duplex transfer. It is +used in several places in the driver, where a TX half duplex transfer +is sufficient. + +To fix support for half duplex SPI host controllers, this patch +introduces a new function mcp251x_spi_write() and changes all callers +that do a TX half duplex transfer to use mcp251x_spi_write(). + +Fixes: e0e25001d088 ("can: mcp251x: add support for half duplex controllers") +Link: https://lore.kernel.org/r/20210330100246.1074375-1-mkl@pengutronix.de +Cc: Tim Harvey +Tested-By: Tim Harvey +Reported-by: Gerhard Bertelsmann +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/spi/mcp251x.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/can/spi/mcp251x.c b/drivers/net/can/spi/mcp251x.c +index 25859d16d06f..e7be36dc2159 100644 +--- a/drivers/net/can/spi/mcp251x.c ++++ b/drivers/net/can/spi/mcp251x.c +@@ -314,6 +314,18 @@ static int mcp251x_spi_trans(struct spi_device *spi, int len) + return ret; + } + ++static int mcp251x_spi_write(struct spi_device *spi, int len) ++{ ++ struct mcp251x_priv *priv = spi_get_drvdata(spi); ++ int ret; ++ ++ ret = spi_write(spi, priv->spi_tx_buf, len); ++ if (ret) ++ dev_err(&spi->dev, "spi write failed: ret = %d\n", ret); ++ ++ return ret; ++} ++ + static u8 mcp251x_read_reg(struct spi_device *spi, u8 reg) + { + struct mcp251x_priv *priv = spi_get_drvdata(spi); +@@ -361,7 +373,7 @@ static void mcp251x_write_reg(struct spi_device *spi, u8 reg, u8 val) + priv->spi_tx_buf[1] = reg; + priv->spi_tx_buf[2] = val; + +- mcp251x_spi_trans(spi, 3); ++ mcp251x_spi_write(spi, 3); + } + + static void mcp251x_write_2regs(struct spi_device *spi, u8 reg, u8 v1, u8 v2) +@@ -373,7 +385,7 @@ static void mcp251x_write_2regs(struct spi_device *spi, u8 reg, u8 v1, u8 v2) + priv->spi_tx_buf[2] = v1; + priv->spi_tx_buf[3] = v2; + +- mcp251x_spi_trans(spi, 4); ++ mcp251x_spi_write(spi, 4); + } + + static void mcp251x_write_bits(struct spi_device *spi, u8 reg, +@@ -386,7 +398,7 @@ static void mcp251x_write_bits(struct spi_device *spi, u8 reg, + priv->spi_tx_buf[2] = mask; + priv->spi_tx_buf[3] = val; + +- mcp251x_spi_trans(spi, 4); ++ mcp251x_spi_write(spi, 4); + } + + static u8 mcp251x_read_stat(struct spi_device *spi) +@@ -618,7 +630,7 @@ static void mcp251x_hw_tx_frame(struct spi_device *spi, u8 *buf, + buf[i]); + } else { + memcpy(priv->spi_tx_buf, buf, TXBDAT_OFF + len); +- mcp251x_spi_trans(spi, TXBDAT_OFF + len); ++ mcp251x_spi_write(spi, TXBDAT_OFF + len); + } + } + +@@ -650,7 +662,7 @@ static void mcp251x_hw_tx(struct spi_device *spi, struct can_frame *frame, + + /* use INSTRUCTION_RTS, to avoid "repeated frame problem" */ + priv->spi_tx_buf[0] = INSTRUCTION_RTS(1 << tx_buf_idx); +- mcp251x_spi_trans(priv->spi, 1); ++ mcp251x_spi_write(priv->spi, 1); + } + + static void mcp251x_hw_rx_frame(struct spi_device *spi, u8 *buf, +@@ -888,7 +900,7 @@ static int mcp251x_hw_reset(struct spi_device *spi) + mdelay(MCP251X_OST_DELAY_MS); + + priv->spi_tx_buf[0] = INSTRUCTION_RESET; +- ret = mcp251x_spi_trans(spi, 1); ++ ret = mcp251x_spi_write(spi, 1); + if (ret) + return ret; + +-- +2.30.2 + diff --git a/queue-5.11/can-uapi-can.h-mark-union-inside-struct-can_frame-pa.patch b/queue-5.11/can-uapi-can.h-mark-union-inside-struct-can_frame-pa.patch new file mode 100644 index 00000000000..4aef4fe5ad1 --- /dev/null +++ b/queue-5.11/can-uapi-can.h-mark-union-inside-struct-can_frame-pa.patch @@ -0,0 +1,78 @@ +From 0084115277906a63aa1a04266be996b4fcd78c91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 10:44:54 +0100 +Subject: can: uapi: can.h: mark union inside struct can_frame packed + +From: Marc Kleine-Budde + +[ Upstream commit f5076c6ba02e8e24c61c40bbf48078929bc0fc79 ] + +In commit ea7800565a12 ("can: add optional DLC element to Classical +CAN frame structure") the struct can_frame::can_dlc was put into an +anonymous union with another u8 variable. + +For various reasons some members in struct can_frame and canfd_frame +including the first 8 byes of data are expected to have the same +memory layout. This is enforced by a BUILD_BUG_ON check in af_can.c. + +Since the above mentioned commit this check fails on ARM kernels +compiled with the ARM OABI (which means CONFIG_AEABI not set). In this +case -mabi=apcs-gnu is passed to the compiler, which leads to a +structure size boundary of 32, instead of 8 compared to CONFIG_AEABI +enabled. This means the the union in struct can_frame takes 4 bytes +instead of the expected 1. + +Rong Chen illustrates the problem with pahole in the ARM OABI case: + +| struct can_frame { +| canid_t can_id; /* 0 4 */ +| union { +| __u8 len; /* 4 1 */ +| __u8 can_dlc; /* 4 1 */ +| }; /* 4 4 */ +| __u8 __pad; /* 8 1 */ +| __u8 __res0; /* 9 1 */ +| __u8 len8_dlc; /* 10 1 */ +| +| /* XXX 5 bytes hole, try to pack */ +| +| __u8 data[8] +| __attribute__((__aligned__(8))); /* 16 8 */ +| +| /* size: 24, cachelines: 1, members: 6 */ +| /* sum members: 19, holes: 1, sum holes: 5 */ +| /* forced alignments: 1, forced holes: 1, sum forced holes: 5 */ +| /* last cacheline: 24 bytes */ +| } __attribute__((__aligned__(8))); + +Marking the anonymous union as __attribute__((packed)) fixes the +BUILD_BUG_ON problem on these compilers. + +Fixes: ea7800565a12 ("can: add optional DLC element to Classical CAN frame structure") +Reported-by: kernel test robot +Suggested-by: Rong Chen +Link: https://lore.kernel.org/linux-can/2c82ec23-3551-61b5-1bd8-178c3407ee83@hartkopp.net/ +Link: https://lore.kernel.org/r/20210325125850.1620-3-socketcan@hartkopp.net +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + include/uapi/linux/can.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h +index f75238ac6dce..c7535352fef6 100644 +--- a/include/uapi/linux/can.h ++++ b/include/uapi/linux/can.h +@@ -113,7 +113,7 @@ struct can_frame { + */ + __u8 len; + __u8 can_dlc; /* deprecated */ +- }; ++ } __attribute__((packed)); /* disable padding added in some ABIs */ + __u8 __pad; /* padding */ + __u8 __res0; /* reserved / padding */ + __u8 len8_dlc; /* optional DLC for 8 byte payload length (9 .. 15) */ +-- +2.30.2 + diff --git a/queue-5.11/clk-fix-invalid-usage-of-list-cursor-in-register.patch b/queue-5.11/clk-fix-invalid-usage-of-list-cursor-in-register.patch new file mode 100644 index 00000000000..5c330f9aa62 --- /dev/null +++ b/queue-5.11/clk-fix-invalid-usage-of-list-cursor-in-register.patch @@ -0,0 +1,88 @@ +From e28d2b4ca3f7faf34486543590f068f57afbc097 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 00:51:48 +0200 +Subject: clk: fix invalid usage of list cursor in register + +From: Lukasz Bartosik + +[ Upstream commit 8d3c0c01cb2e36b2bf3c06a82b18b228d0c8f5d0 ] + +Fix invalid usage of a list_for_each_entry cursor in +clk_notifier_register(). When list is empty or if the list +is completely traversed (without breaking from the loop on one +of the entries) then the list cursor does not point to a valid +entry and therefore should not be used. + +The issue was dicovered when running 5.12-rc1 kernel on x86_64 +with KASAN enabled: +BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230 +Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1 + +CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1 +Hardware name: Google Caroline/Caroline, +BIOS Google_Caroline.7820.430.0 07/20/2018 +Call Trace: + dump_stack+0xee/0x15c + print_address_description+0x1e/0x2dc + kasan_report+0x188/0x1ce + ? clk_notifier_register+0xab/0x230 + ? clk_prepare_lock+0x15/0x7b + ? clk_notifier_register+0xab/0x230 + clk_notifier_register+0xab/0x230 + dw8250_probe+0xc01/0x10d4 +... +Memory state around the buggy address: + ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 + ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 +>ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 + ^ + ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 + ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00 + ================================================================== + +Fixes: b2476490ef11 ("clk: introduce the common clock framework") +Reported-by: Lukasz Majczak +Signed-off-by: Lukasz Bartosik +Link: https://lore.kernel.org/r/20210401225149.18826-1-lb@semihalf.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 8c1d04db990d..e08274020944 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -4336,20 +4336,19 @@ int clk_notifier_register(struct clk *clk, struct notifier_block *nb) + /* search the list of notifiers for this clk */ + list_for_each_entry(cn, &clk_notifier_list, node) + if (cn->clk == clk) +- break; ++ goto found; + + /* if clk wasn't in the notifier list, allocate new clk_notifier */ +- if (cn->clk != clk) { +- cn = kzalloc(sizeof(*cn), GFP_KERNEL); +- if (!cn) +- goto out; ++ cn = kzalloc(sizeof(*cn), GFP_KERNEL); ++ if (!cn) ++ goto out; + +- cn->clk = clk; +- srcu_init_notifier_head(&cn->notifier_head); ++ cn->clk = clk; ++ srcu_init_notifier_head(&cn->notifier_head); + +- list_add(&cn->node, &clk_notifier_list); +- } ++ list_add(&cn->node, &clk_notifier_list); + ++found: + ret = srcu_notifier_chain_register(&cn->notifier_head, nb); + + clk->core->notifier_count++; +-- +2.30.2 + diff --git a/queue-5.11/clk-fix-invalid-usage-of-list-cursor-in-unregister.patch b/queue-5.11/clk-fix-invalid-usage-of-list-cursor-in-unregister.patch new file mode 100644 index 00000000000..0adc9a38948 --- /dev/null +++ b/queue-5.11/clk-fix-invalid-usage-of-list-cursor-in-unregister.patch @@ -0,0 +1,107 @@ +From f304eee90304efad6579d7648d106d7b5b77e90c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 00:51:49 +0200 +Subject: clk: fix invalid usage of list cursor in unregister + +From: Lukasz Bartosik + +[ Upstream commit 7045465500e465b09f09d6e5bdc260a9f1aab97b ] + +Fix invalid usage of a list_for_each_entry cursor in +clk_notifier_unregister(). When list is empty or if the list +is completely traversed (without breaking from the loop on one +of the entries) then the list cursor does not point to a valid +entry and therefore should not be used. The patch fixes a logical +bug that hasn't been seen in pratice however it is analogus +to the bug fixed in clk_notifier_register(). + +The issue was dicovered when running 5.12-rc1 kernel on x86_64 +with KASAN enabled: +BUG: KASAN: global-out-of-bounds in clk_notifier_register+0xab/0x230 +Read of size 8 at addr ffffffffa0d10588 by task swapper/0/1 + +CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.12.0-rc1 #1 +Hardware name: Google Caroline/Caroline, +BIOS Google_Caroline.7820.430.0 07/20/2018 +Call Trace: + dump_stack+0xee/0x15c + print_address_description+0x1e/0x2dc + kasan_report+0x188/0x1ce + ? clk_notifier_register+0xab/0x230 + ? clk_prepare_lock+0x15/0x7b + ? clk_notifier_register+0xab/0x230 + clk_notifier_register+0xab/0x230 + dw8250_probe+0xc01/0x10d4 + ... + Memory state around the buggy address: + ffffffffa0d10480: 00 00 00 00 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 + ffffffffa0d10500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 + >ffffffffa0d10580: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00 + ^ + ffffffffa0d10600: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00 + ffffffffa0d10680: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00 + ================================================================== + +Fixes: b2476490ef11 ("clk: introduce the common clock framework") +Reported-by: Lukasz Majczak +Signed-off-by: Lukasz Bartosik +Link: https://lore.kernel.org/r/20210401225149.18826-2-lb@semihalf.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 30 +++++++++++++----------------- + 1 file changed, 13 insertions(+), 17 deletions(-) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index e08274020944..571ae066e548 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -4373,32 +4373,28 @@ EXPORT_SYMBOL_GPL(clk_notifier_register); + */ + int clk_notifier_unregister(struct clk *clk, struct notifier_block *nb) + { +- struct clk_notifier *cn = NULL; +- int ret = -EINVAL; ++ struct clk_notifier *cn; ++ int ret = -ENOENT; + + if (!clk || !nb) + return -EINVAL; + + clk_prepare_lock(); + +- list_for_each_entry(cn, &clk_notifier_list, node) +- if (cn->clk == clk) +- break; +- +- if (cn->clk == clk) { +- ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb); ++ list_for_each_entry(cn, &clk_notifier_list, node) { ++ if (cn->clk == clk) { ++ ret = srcu_notifier_chain_unregister(&cn->notifier_head, nb); + +- clk->core->notifier_count--; ++ clk->core->notifier_count--; + +- /* XXX the notifier code should handle this better */ +- if (!cn->notifier_head.head) { +- srcu_cleanup_notifier_head(&cn->notifier_head); +- list_del(&cn->node); +- kfree(cn); ++ /* XXX the notifier code should handle this better */ ++ if (!cn->notifier_head.head) { ++ srcu_cleanup_notifier_head(&cn->notifier_head); ++ list_del(&cn->node); ++ kfree(cn); ++ } ++ break; + } +- +- } else { +- ret = -ENOENT; + } + + clk_prepare_unlock(); +-- +2.30.2 + diff --git a/queue-5.11/clk-qcom-camcc-update-the-clock-ops-for-the-sc7180.patch b/queue-5.11/clk-qcom-camcc-update-the-clock-ops-for-the-sc7180.patch new file mode 100644 index 00000000000..f3823fb4c5a --- /dev/null +++ b/queue-5.11/clk-qcom-camcc-update-the-clock-ops-for-the-sc7180.patch @@ -0,0 +1,257 @@ +From af956ee3de38ad2898b0d35fe3f67b79264beb53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Mar 2021 07:11:05 +0530 +Subject: clk: qcom: camcc: Update the clock ops for the SC7180 + +From: Taniya Das + +[ Upstream commit e5c359f70e4b5e7b6c2bf4b0ca2d2686d543a37b ] + +Some of the RCGs could be always ON from the XO source and could be used +as the clock on signal for the GDSC to be operational. In the cases where +the GDSCs are parked at different source with the source clock disabled, +it could lead to the GDSC to be stuck at ON/OFF during gdsc disable/enable. +Thus park the RCGs at XO during clock disable and update the rcg_ops to +use the shared_ops. + +Fixes: 15d09e830bbc ("clk: qcom: camcc: Add camera clock controller driver for SC7180") +Signed-off-by: Taniya Das +Link: https://lore.kernel.org/r/1616809265-11912-1-git-send-email-tdas@codeaurora.org +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/camcc-sc7180.c | 50 ++++++++++++++++----------------- + 1 file changed, 25 insertions(+), 25 deletions(-) + +diff --git a/drivers/clk/qcom/camcc-sc7180.c b/drivers/clk/qcom/camcc-sc7180.c +index dbac5651ab85..9bcf2f8ed4de 100644 +--- a/drivers/clk/qcom/camcc-sc7180.c ++++ b/drivers/clk/qcom/camcc-sc7180.c +@@ -304,7 +304,7 @@ static struct clk_rcg2 cam_cc_bps_clk_src = { + .name = "cam_cc_bps_clk_src", + .parent_data = cam_cc_parent_data_2, + .num_parents = 5, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -325,7 +325,7 @@ static struct clk_rcg2 cam_cc_cci_0_clk_src = { + .name = "cam_cc_cci_0_clk_src", + .parent_data = cam_cc_parent_data_5, + .num_parents = 3, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -339,7 +339,7 @@ static struct clk_rcg2 cam_cc_cci_1_clk_src = { + .name = "cam_cc_cci_1_clk_src", + .parent_data = cam_cc_parent_data_5, + .num_parents = 3, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -360,7 +360,7 @@ static struct clk_rcg2 cam_cc_cphy_rx_clk_src = { + .name = "cam_cc_cphy_rx_clk_src", + .parent_data = cam_cc_parent_data_3, + .num_parents = 6, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -379,7 +379,7 @@ static struct clk_rcg2 cam_cc_csi0phytimer_clk_src = { + .name = "cam_cc_csi0phytimer_clk_src", + .parent_data = cam_cc_parent_data_0, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -393,7 +393,7 @@ static struct clk_rcg2 cam_cc_csi1phytimer_clk_src = { + .name = "cam_cc_csi1phytimer_clk_src", + .parent_data = cam_cc_parent_data_0, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -407,7 +407,7 @@ static struct clk_rcg2 cam_cc_csi2phytimer_clk_src = { + .name = "cam_cc_csi2phytimer_clk_src", + .parent_data = cam_cc_parent_data_0, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -421,7 +421,7 @@ static struct clk_rcg2 cam_cc_csi3phytimer_clk_src = { + .name = "cam_cc_csi3phytimer_clk_src", + .parent_data = cam_cc_parent_data_0, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -443,7 +443,7 @@ static struct clk_rcg2 cam_cc_fast_ahb_clk_src = { + .name = "cam_cc_fast_ahb_clk_src", + .parent_data = cam_cc_parent_data_0, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -466,7 +466,7 @@ static struct clk_rcg2 cam_cc_icp_clk_src = { + .name = "cam_cc_icp_clk_src", + .parent_data = cam_cc_parent_data_2, + .num_parents = 5, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -488,7 +488,7 @@ static struct clk_rcg2 cam_cc_ife_0_clk_src = { + .name = "cam_cc_ife_0_clk_src", + .parent_data = cam_cc_parent_data_4, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -510,7 +510,7 @@ static struct clk_rcg2 cam_cc_ife_0_csid_clk_src = { + .name = "cam_cc_ife_0_csid_clk_src", + .parent_data = cam_cc_parent_data_3, + .num_parents = 6, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -524,7 +524,7 @@ static struct clk_rcg2 cam_cc_ife_1_clk_src = { + .name = "cam_cc_ife_1_clk_src", + .parent_data = cam_cc_parent_data_4, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -538,7 +538,7 @@ static struct clk_rcg2 cam_cc_ife_1_csid_clk_src = { + .name = "cam_cc_ife_1_csid_clk_src", + .parent_data = cam_cc_parent_data_3, + .num_parents = 6, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -553,7 +553,7 @@ static struct clk_rcg2 cam_cc_ife_lite_clk_src = { + .parent_data = cam_cc_parent_data_4, + .num_parents = 4, + .flags = CLK_SET_RATE_PARENT, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -567,7 +567,7 @@ static struct clk_rcg2 cam_cc_ife_lite_csid_clk_src = { + .name = "cam_cc_ife_lite_csid_clk_src", + .parent_data = cam_cc_parent_data_3, + .num_parents = 6, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -590,7 +590,7 @@ static struct clk_rcg2 cam_cc_ipe_0_clk_src = { + .name = "cam_cc_ipe_0_clk_src", + .parent_data = cam_cc_parent_data_2, + .num_parents = 5, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -613,7 +613,7 @@ static struct clk_rcg2 cam_cc_jpeg_clk_src = { + .name = "cam_cc_jpeg_clk_src", + .parent_data = cam_cc_parent_data_2, + .num_parents = 5, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -635,7 +635,7 @@ static struct clk_rcg2 cam_cc_lrme_clk_src = { + .name = "cam_cc_lrme_clk_src", + .parent_data = cam_cc_parent_data_6, + .num_parents = 5, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -656,7 +656,7 @@ static struct clk_rcg2 cam_cc_mclk0_clk_src = { + .name = "cam_cc_mclk0_clk_src", + .parent_data = cam_cc_parent_data_1, + .num_parents = 3, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -670,7 +670,7 @@ static struct clk_rcg2 cam_cc_mclk1_clk_src = { + .name = "cam_cc_mclk1_clk_src", + .parent_data = cam_cc_parent_data_1, + .num_parents = 3, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -684,7 +684,7 @@ static struct clk_rcg2 cam_cc_mclk2_clk_src = { + .name = "cam_cc_mclk2_clk_src", + .parent_data = cam_cc_parent_data_1, + .num_parents = 3, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -698,7 +698,7 @@ static struct clk_rcg2 cam_cc_mclk3_clk_src = { + .name = "cam_cc_mclk3_clk_src", + .parent_data = cam_cc_parent_data_1, + .num_parents = 3, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -712,7 +712,7 @@ static struct clk_rcg2 cam_cc_mclk4_clk_src = { + .name = "cam_cc_mclk4_clk_src", + .parent_data = cam_cc_parent_data_1, + .num_parents = 3, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +@@ -732,7 +732,7 @@ static struct clk_rcg2 cam_cc_slow_ahb_clk_src = { + .parent_data = cam_cc_parent_data_0, + .num_parents = 4, + .flags = CLK_SET_RATE_PARENT | CLK_OPS_PARENT_ENABLE, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_shared_ops, + }, + }; + +-- +2.30.2 + diff --git a/queue-5.11/cxgb4-avoid-collecting-sge_qbase-regs-during-traffic.patch b/queue-5.11/cxgb4-avoid-collecting-sge_qbase-regs-during-traffic.patch new file mode 100644 index 00000000000..5f6c79c230e --- /dev/null +++ b/queue-5.11/cxgb4-avoid-collecting-sge_qbase-regs-during-traffic.patch @@ -0,0 +1,83 @@ +From d26622ee8b34b63649de9d2059b7c68b610b29b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 27 Mar 2021 23:49:08 +0530 +Subject: cxgb4: avoid collecting SGE_QBASE regs during traffic + +From: Rahul Lakkireddy + +[ Upstream commit 1bfb3dea965ff9f6226fd1709338f227363b6061 ] + +Accessing SGE_QBASE_MAP[0-3] and SGE_QBASE_INDEX registers can lead +to SGE missing doorbells under heavy traffic. So, only collect them +when adapter is idle. Also update the regdump range to skip collecting +these registers. + +Fixes: 80a95a80d358 ("cxgb4: collect SGE PF/VF queue map") +Signed-off-by: Rahul Lakkireddy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/chelsio/cxgb4/cudbg_lib.c | 23 +++++++++++++++---- + drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 3 ++- + 2 files changed, 21 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c +index 75474f810249..c5b0e725b238 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cudbg_lib.c +@@ -1794,11 +1794,25 @@ int cudbg_collect_sge_indirect(struct cudbg_init *pdbg_init, + struct cudbg_buffer temp_buff = { 0 }; + struct sge_qbase_reg_field *sge_qbase; + struct ireg_buf *ch_sge_dbg; ++ u8 padap_running = 0; + int i, rc; ++ u32 size; + +- rc = cudbg_get_buff(pdbg_init, dbg_buff, +- sizeof(*ch_sge_dbg) * 2 + sizeof(*sge_qbase), +- &temp_buff); ++ /* Accessing SGE_QBASE_MAP[0-3] and SGE_QBASE_INDEX regs can ++ * lead to SGE missing doorbells under heavy traffic. So, only ++ * collect them when adapter is idle. ++ */ ++ for_each_port(padap, i) { ++ padap_running = netif_running(padap->port[i]); ++ if (padap_running) ++ break; ++ } ++ ++ size = sizeof(*ch_sge_dbg) * 2; ++ if (!padap_running) ++ size += sizeof(*sge_qbase); ++ ++ rc = cudbg_get_buff(pdbg_init, dbg_buff, size, &temp_buff); + if (rc) + return rc; + +@@ -1820,7 +1834,8 @@ int cudbg_collect_sge_indirect(struct cudbg_init *pdbg_init, + ch_sge_dbg++; + } + +- if (CHELSIO_CHIP_VERSION(padap->params.chip) > CHELSIO_T5) { ++ if (CHELSIO_CHIP_VERSION(padap->params.chip) > CHELSIO_T5 && ++ !padap_running) { + sge_qbase = (struct sge_qbase_reg_field *)ch_sge_dbg; + /* 1 addr reg SGE_QBASE_INDEX and 4 data reg + * SGE_QBASE_MAP[0-3] +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index 98d01a7497ec..581670dced6e 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -2090,7 +2090,8 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t buf_size) + 0x1190, 0x1194, + 0x11a0, 0x11a4, + 0x11b0, 0x11b4, +- 0x11fc, 0x1274, ++ 0x11fc, 0x123c, ++ 0x1254, 0x1274, + 0x1280, 0x133c, + 0x1800, 0x18fc, + 0x3000, 0x302c, +-- +2.30.2 + diff --git a/queue-5.11/drivers-net-wan-hdlc_fr-fix-a-double-free-in-pvc_xmi.patch b/queue-5.11/drivers-net-wan-hdlc_fr-fix-a-double-free-in-pvc_xmi.patch new file mode 100644 index 00000000000..f6a0671d563 --- /dev/null +++ b/queue-5.11/drivers-net-wan-hdlc_fr-fix-a-double-free-in-pvc_xmi.patch @@ -0,0 +1,51 @@ +From 9c07417b0cebd5d049805d6bb86b5624ffff82b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Mar 2021 00:50:08 -0700 +Subject: drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit + +From: Lv Yunlong + +[ Upstream commit 1b479fb801602b22512f53c19b1f93a4fc5d5d9d ] + +In pvc_xmit, if __skb_pad(skb, pad, false) failed, it will free +the skb in the first time and goto drop. But the same skb is freed +by kfree_skb(skb) in the second time in drop. + +Maintaining the original function unchanged, my patch adds a new +label out to avoid the double free if __skb_pad() failed. + +Fixes: f5083d0cee08a ("drivers/net/wan/hdlc_fr: Improvements to the code of pvc_xmit") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/wan/hdlc_fr.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c +index 0720f5f92caa..4d9dc7d15908 100644 +--- a/drivers/net/wan/hdlc_fr.c ++++ b/drivers/net/wan/hdlc_fr.c +@@ -415,7 +415,7 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev) + + if (pad > 0) { /* Pad the frame with zeros */ + if (__skb_pad(skb, pad, false)) +- goto drop; ++ goto out; + skb_put(skb, pad); + } + } +@@ -448,8 +448,9 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev) + return NETDEV_TX_OK; + + drop: +- dev->stats.tx_dropped++; + kfree_skb(skb); ++out: ++ dev->stats.tx_dropped++; + return NETDEV_TX_OK; + } + +-- +2.30.2 + diff --git a/queue-5.11/drm-msm-a6xx-fix-version-check-for-the-a650-sqe-micr.patch b/queue-5.11/drm-msm-a6xx-fix-version-check-for-the-a650-sqe-micr.patch new file mode 100644 index 00000000000..68f81a2887b --- /dev/null +++ b/queue-5.11/drm-msm-a6xx-fix-version-check-for-the-a650-sqe-micr.patch @@ -0,0 +1,55 @@ +From 8c2f6b0d1cc24ee9cc732a1672a3f063dca7ba5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 17:02:23 +0300 +Subject: drm/msm: a6xx: fix version check for the A650 SQE microcode + +From: Dmitry Baryshkov + +[ Upstream commit 6ddbfa1f5adbd5dea14ff66778ca58257f09f17d ] + +I suppose the microcode version check for a650 is incorrect. It checks +for the version 1.95, while the firmware released have major version of 0: +0.91 (vulnerable), 0.99 (fixing the issue). + +Lower version requirements to accept firmware 0.99. + +Fixes: 8490f02a3ca4 ("drm/msm: a6xx: Make sure the SQE microcode is safe") +Cc: Akhil P Oommen +Cc: Jordan Crouse +Signed-off-by: Dmitry Baryshkov +Acked-by: Jordan Crouse +Message-Id: <20210331140223.3771449-1-dmitry.baryshkov@linaro.org> +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +index e7a8442b59af..a676811ef69d 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +@@ -566,17 +566,17 @@ static bool a6xx_ucode_check_version(struct a6xx_gpu *a6xx_gpu, + } else { + /* + * a650 tier targets don't need whereami but still need to be +- * equal to or newer than 1.95 for other security fixes ++ * equal to or newer than 0.95 for other security fixes + */ + if (adreno_is_a650(adreno_gpu)) { +- if ((buf[0] & 0xfff) >= 0x195) { ++ if ((buf[0] & 0xfff) >= 0x095) { + ret = true; + goto out; + } + + DRM_DEV_ERROR(&gpu->pdev->dev, + "a650 SQE ucode is too old. Have version %x need at least %x\n", +- buf[0] & 0xfff, 0x195); ++ buf[0] & 0xfff, 0x095); + } + + /* +-- +2.30.2 + diff --git a/queue-5.11/drm-msm-disp-dpu1-program-3d_merge-only-if-block-is-.patch b/queue-5.11/drm-msm-disp-dpu1-program-3d_merge-only-if-block-is-.patch new file mode 100644 index 00000000000..479128ac2ea --- /dev/null +++ b/queue-5.11/drm-msm-disp-dpu1-program-3d_merge-only-if-block-is-.patch @@ -0,0 +1,40 @@ +From efcf3fcacda2f511aad30ad1c80df1a40e22e464 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 04:54:53 -0700 +Subject: drm/msm/disp/dpu1: program 3d_merge only if block is attached + +From: Kalyan Thota + +[ Upstream commit 12aca1ce9ee33af3751aec5e55a5900747cbdd4b ] + +Update the 3d merge as active in the data path only if +the hw block is selected in the configuration. + +Reported-by: Stephen Boyd +Fixes: 73bfb790ac78 ("msm:disp:dpu1: setup display datapath for SC7180 target") +Signed-off-by: Kalyan Thota +Message-Id: <1617364493-13518-1-git-send-email-kalyan_t@codeaurora.org> +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c +index 8981cfa9dbc3..92e6f1b94738 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_hw_ctl.c +@@ -496,7 +496,9 @@ static void dpu_hw_ctl_intf_cfg_v1(struct dpu_hw_ctl *ctx, + + DPU_REG_WRITE(c, CTL_TOP, mode_sel); + DPU_REG_WRITE(c, CTL_INTF_ACTIVE, intf_active); +- DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE, BIT(cfg->merge_3d - MERGE_3D_0)); ++ if (cfg->merge_3d) ++ DPU_REG_WRITE(c, CTL_MERGE_3D_ACTIVE, ++ BIT(cfg->merge_3d - MERGE_3D_0)); + } + + static void dpu_hw_ctl_intf_cfg(struct dpu_hw_ctl *ctx, +-- +2.30.2 + diff --git a/queue-5.11/drm-msm-set-drvdata-to-null-when-msm_drm_init-fails.patch b/queue-5.11/drm-msm-set-drvdata-to-null-when-msm_drm_init-fails.patch new file mode 100644 index 00000000000..7addc877ece --- /dev/null +++ b/queue-5.11/drm-msm-set-drvdata-to-null-when-msm_drm_init-fails.patch @@ -0,0 +1,54 @@ +From 81378ed8a4f6a7bc66be5e193587cc52a38b09b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 14:28:22 -0700 +Subject: drm/msm: Set drvdata to NULL when msm_drm_init() fails + +From: Stephen Boyd + +[ Upstream commit 5620b135aea49a8f41c86aaecfcb1598a7774121 ] + +We should set the platform device's driver data to NULL here so that +code doesn't assume the struct drm_device pointer is valid when it could +have been destroyed. The lifetime of this pointer is managed by a kref +but when msm_drm_init() fails we call drm_dev_put() on the pointer which +will free the pointer's memory. This driver uses the component model, so +there's sort of two "probes" in this file, one for the platform device +i.e. msm_pdev_probe() and one for the component i.e. msm_drm_bind(). The +msm_drm_bind() code is using the platform device's driver data to store +struct drm_device so the two functions are intertwined. + +This relationship becomes a problem for msm_pdev_shutdown() when it +tests the NULL-ness of the pointer to see if it should call +drm_atomic_helper_shutdown(). The NULL test is a proxy check for if the +pointer has been freed by kref_put(). If the drm_device has been +destroyed, then we shouldn't call the shutdown helper, and we know that +is the case if msm_drm_init() failed, therefore set the driver data to +NULL so that this pointer liveness is tracked properly. + +Fixes: 9d5cbf5fe46e ("drm/msm: add shutdown support for display platform_driver") +Cc: Dmitry Baryshkov +Cc: Fabio Estevam +Cc: Krishna Manikandan +Signed-off-by: Stephen Boyd +Message-Id: <20210325212822.3663144-1-swboyd@chromium.org> +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index a5c6b8c23336..196907689c82 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -570,6 +570,7 @@ err_free_priv: + kfree(priv); + err_put_drm_dev: + drm_dev_put(ddev); ++ platform_set_drvdata(pdev, NULL); + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.11/drm-vc4-crtc-reduce-pv-fifo-threshold-on-hvs4.patch b/queue-5.11/drm-vc4-crtc-reduce-pv-fifo-threshold-on-hvs4.patch new file mode 100644 index 00000000000..225cdb6bfec --- /dev/null +++ b/queue-5.11/drm-vc4-crtc-reduce-pv-fifo-threshold-on-hvs4.patch @@ -0,0 +1,64 @@ +From e195c7478a7900c576e922ce5475215649f89177 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Mar 2021 17:13:28 +0100 +Subject: drm/vc4: crtc: Reduce PV fifo threshold on hvs4 + +From: Dom Cobley + +[ Upstream commit eb9dfdd1ed40357b99a4201c8534c58c562e48c9 ] + +Experimentally have found PV on hvs4 reports fifo full +error with expected settings and does not with one less + +This appears as: +[drm:drm_atomic_helper_wait_for_flip_done] *ERROR* [CRTC:82:crtc-3] flip_done timed out + +with bit 10 of PV_STAT set "HVS driving pixels when the PV FIFO is full" + +Fixes: c8b75bca92cb ("drm/vc4: Add KMS support for Raspberry Pi.") +Signed-off-by: Dom Cobley +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20210318161328.1471556-3-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_crtc.c | 17 +++++++++++++++++ + 1 file changed, 17 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c +index ea710beb8e00..351c601f0ddb 100644 +--- a/drivers/gpu/drm/vc4/vc4_crtc.c ++++ b/drivers/gpu/drm/vc4/vc4_crtc.c +@@ -210,6 +210,7 @@ static u32 vc4_get_fifo_full_level(struct vc4_crtc *vc4_crtc, u32 format) + { + const struct vc4_crtc_data *crtc_data = vc4_crtc_to_vc4_crtc_data(vc4_crtc); + const struct vc4_pv_data *pv_data = vc4_crtc_to_vc4_pv_data(vc4_crtc); ++ struct vc4_dev *vc4 = to_vc4_dev(vc4_crtc->base.dev); + u32 fifo_len_bytes = pv_data->fifo_depth; + + /* +@@ -238,6 +239,22 @@ static u32 vc4_get_fifo_full_level(struct vc4_crtc *vc4_crtc, u32 format) + if (crtc_data->hvs_output == 5) + return 32; + ++ /* ++ * It looks like in some situations, we will overflow ++ * the PixelValve FIFO (with the bit 10 of PV stat being ++ * set) and stall the HVS / PV, eventually resulting in ++ * a page flip timeout. ++ * ++ * Displaying the video overlay during a playback with ++ * Kodi on an RPi3 seems to be a great solution with a ++ * failure rate around 50%. ++ * ++ * Removing 1 from the FIFO full level however ++ * seems to completely remove that issue. ++ */ ++ if (!vc4->hvs->hvs5) ++ return fifo_len_bytes - 3 * HVS_FIFO_LATENCY_PIX - 1; ++ + return fifo_len_bytes - 3 * HVS_FIFO_LATENCY_PIX; + } + } +-- +2.30.2 + diff --git a/queue-5.11/esp-delete-netif_f_sctp_crc-bit-from-features-for-es.patch b/queue-5.11/esp-delete-netif_f_sctp_crc-bit-from-features-for-es.patch new file mode 100644 index 00000000000..d3d882652f4 --- /dev/null +++ b/queue-5.11/esp-delete-netif_f_sctp_crc-bit-from-features-for-es.patch @@ -0,0 +1,70 @@ +From 163b87199abd07b5cfcd8f47fe4669f4e47f5b44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 15:35:07 +0800 +Subject: esp: delete NETIF_F_SCTP_CRC bit from features for esp offload + +From: Xin Long + +[ Upstream commit 154deab6a3ba47792936edf77f2f13a1cbc4351d ] + +Now in esp4/6_gso_segment(), before calling inner proto .gso_segment, +NETIF_F_CSUM_MASK bits are deleted, as HW won't be able to do the +csum for inner proto due to the packet encrypted already. + +So the UDP/TCP packet has to do the checksum on its own .gso_segment. +But SCTP is using CRC checksum, and for that NETIF_F_SCTP_CRC should +be deleted to make SCTP do the csum in own .gso_segment as well. + +In Xiumei's testing with SCTP over IPsec/veth, the packets are kept +dropping due to the wrong CRC checksum. + +Reported-by: Xiumei Mu +Fixes: 7862b4058b9f ("esp: Add gso handlers for esp4 and esp6") +Signed-off-by: Xin Long +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/ipv4/esp4_offload.c | 6 ++++-- + net/ipv6/esp6_offload.c | 6 ++++-- + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c +index 5bda5aeda579..d5c0f5a2a551 100644 +--- a/net/ipv4/esp4_offload.c ++++ b/net/ipv4/esp4_offload.c +@@ -217,10 +217,12 @@ static struct sk_buff *esp4_gso_segment(struct sk_buff *skb, + + if ((!(skb->dev->gso_partial_features & NETIF_F_HW_ESP) && + !(features & NETIF_F_HW_ESP)) || x->xso.dev != skb->dev) +- esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK); ++ esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK | ++ NETIF_F_SCTP_CRC); + else if (!(features & NETIF_F_HW_ESP_TX_CSUM) && + !(skb->dev->gso_partial_features & NETIF_F_HW_ESP_TX_CSUM)) +- esp_features = features & ~NETIF_F_CSUM_MASK; ++ esp_features = features & ~(NETIF_F_CSUM_MASK | ++ NETIF_F_SCTP_CRC); + + xo->flags |= XFRM_GSO_SEGMENT; + +diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c +index 1ca516fb30e1..f35203ab39f5 100644 +--- a/net/ipv6/esp6_offload.c ++++ b/net/ipv6/esp6_offload.c +@@ -254,9 +254,11 @@ static struct sk_buff *esp6_gso_segment(struct sk_buff *skb, + skb->encap_hdr_csum = 1; + + if (!(features & NETIF_F_HW_ESP) || x->xso.dev != skb->dev) +- esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK); ++ esp_features = features & ~(NETIF_F_SG | NETIF_F_CSUM_MASK | ++ NETIF_F_SCTP_CRC); + else if (!(features & NETIF_F_HW_ESP_TX_CSUM)) +- esp_features = features & ~NETIF_F_CSUM_MASK; ++ esp_features = features & ~(NETIF_F_CSUM_MASK | ++ NETIF_F_SCTP_CRC); + + xo->flags |= XFRM_GSO_SEGMENT; + +-- +2.30.2 + diff --git a/queue-5.11/ethernet-myri10ge-fix-a-use-after-free-in-myri10ge_s.patch b/queue-5.11/ethernet-myri10ge-fix-a-use-after-free-in-myri10ge_s.patch new file mode 100644 index 00000000000..9ffa2b6c2ff --- /dev/null +++ b/queue-5.11/ethernet-myri10ge-fix-a-use-after-free-in-myri10ge_s.patch @@ -0,0 +1,40 @@ +From 03862dd9073032c294b922587baad8c9ad555efe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 05:36:48 -0700 +Subject: ethernet: myri10ge: Fix a use after free in myri10ge_sw_tso + +From: Lv Yunlong + +[ Upstream commit 63415767a2446136372e777cde5bb351f21ec21d ] + +In myri10ge_sw_tso, the skb_list_walk_safe macro will set +(curr) = (segs) and (next) = (curr)->next. If status!=0 is true, +the memory pointed by curr and segs will be free by dev_kfree_skb_any(curr). +But later, the segs is used by segs = segs->next and causes a uaf. + +As (next) = (curr)->next, my patch replaces seg->next to next. + +Fixes: 536577f36ff7a ("net: myri10ge: use skb_list_walk_safe helper for gso segments") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +index 1634ca6d4a8f..c84c8bf2bc20 100644 +--- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c ++++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +@@ -2897,7 +2897,7 @@ static netdev_tx_t myri10ge_sw_tso(struct sk_buff *skb, + dev_kfree_skb_any(curr); + if (segs != NULL) { + curr = segs; +- segs = segs->next; ++ segs = next; + curr->next = NULL; + dev_kfree_skb_any(segs); + } +-- +2.30.2 + diff --git a/queue-5.11/geneve-do-not-modify-the-shared-tunnel-info-when-pmt.patch b/queue-5.11/geneve-do-not-modify-the-shared-tunnel-info-when-pmt.patch new file mode 100644 index 00000000000..977cf81cba5 --- /dev/null +++ b/queue-5.11/geneve-do-not-modify-the-shared-tunnel-info-when-pmt.patch @@ -0,0 +1,81 @@ +From 2ee370f382190bc45efadbce93fbf1358ab38264 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 16:35:33 +0100 +Subject: geneve: do not modify the shared tunnel info when PMTU triggers an + ICMP reply + +From: Antoine Tenart + +[ Upstream commit 68c1a943ef37bafde5ea2383e8ca224c7169ee31 ] + +When the interface is part of a bridge or an Open vSwitch port and a +packet exceed a PMTU estimate, an ICMP reply is sent to the sender. When +using the external mode (collect metadata) the source and destination +addresses are reversed, so that Open vSwitch can match the packet +against an existing (reverse) flow. + +But inverting the source and destination addresses in the shared +ip_tunnel_info will make following packets of the flow to use a wrong +destination address (packets will be tunnelled to itself), if the flow +isn't updated. Which happens with Open vSwitch, until the flow times +out. + +Fixes this by uncloning the skb's ip_tunnel_info before inverting its +source and destination addresses, so that the modification will only be +made for the PTMU packet, not the following ones. + +Fixes: c1a800e88dbf ("geneve: Support for PMTU discovery on directly bridged links") +Tested-by: Eelco Chaudron +Reviewed-by: Eelco Chaudron +Signed-off-by: Antoine Tenart +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/geneve.c | 24 ++++++++++++++++++++---- + 1 file changed, 20 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 5523f069b9a5..f35b0b83fe85 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -908,8 +908,16 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, + + info = skb_tunnel_info(skb); + if (info) { +- info->key.u.ipv4.dst = fl4.saddr; +- info->key.u.ipv4.src = fl4.daddr; ++ struct ip_tunnel_info *unclone; ++ ++ unclone = skb_tunnel_info_unclone(skb); ++ if (unlikely(!unclone)) { ++ dst_release(&rt->dst); ++ return -ENOMEM; ++ } ++ ++ unclone->key.u.ipv4.dst = fl4.saddr; ++ unclone->key.u.ipv4.src = fl4.daddr; + } + + if (!pskb_may_pull(skb, ETH_HLEN)) { +@@ -993,8 +1001,16 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, + struct ip_tunnel_info *info = skb_tunnel_info(skb); + + if (info) { +- info->key.u.ipv6.dst = fl6.saddr; +- info->key.u.ipv6.src = fl6.daddr; ++ struct ip_tunnel_info *unclone; ++ ++ unclone = skb_tunnel_info_unclone(skb); ++ if (unlikely(!unclone)) { ++ dst_release(dst); ++ return -ENOMEM; ++ } ++ ++ unclone->key.u.ipv6.dst = fl6.saddr; ++ unclone->key.u.ipv6.src = fl6.daddr; + } + + if (!pskb_may_pull(skb, ETH_HLEN)) { +-- +2.30.2 + diff --git a/queue-5.11/gianfar-handle-error-code-at-mac-address-change.patch b/queue-5.11/gianfar-handle-error-code-at-mac-address-change.patch new file mode 100644 index 00000000000..bf06d2448c1 --- /dev/null +++ b/queue-5.11/gianfar-handle-error-code-at-mac-address-change.patch @@ -0,0 +1,39 @@ +From a2cacc29a26552d6a06cb16a40c9f611fadf3011 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 17:08:47 +0300 +Subject: gianfar: Handle error code at MAC address change + +From: Claudiu Manoil + +[ Upstream commit bff5b62585123823842833ab20b1c0a7fa437f8c ] + +Handle return error code of eth_mac_addr(); + +Fixes: 3d23a05c75c7 ("gianfar: Enable changing mac addr when if up") +Signed-off-by: Claudiu Manoil +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/gianfar.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index 4fab2ee5bbf5..e4d9c4c640e5 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -364,7 +364,11 @@ static void gfar_set_mac_for_addr(struct net_device *dev, int num, + + static int gfar_set_mac_addr(struct net_device *dev, void *p) + { +- eth_mac_addr(dev, p); ++ int ret; ++ ++ ret = eth_mac_addr(dev, p); ++ if (ret) ++ return ret; + + gfar_set_mac_for_addr(dev, 0, dev->dev_addr); + +-- +2.30.2 + diff --git a/queue-5.11/hostfs-fix-memory-handling-in-follow_link.patch b/queue-5.11/hostfs-fix-memory-handling-in-follow_link.patch new file mode 100644 index 00000000000..7499f92c0b3 --- /dev/null +++ b/queue-5.11/hostfs-fix-memory-handling-in-follow_link.patch @@ -0,0 +1,55 @@ +From 65a846cd40983bf72d5b93fe43ce3010a0fd53d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 14:12:34 -0400 +Subject: hostfs: fix memory handling in follow_link() + +From: Al Viro + +[ Upstream commit 7f6c411c9b50cfab41cc798e003eff27608c7016 ] + +1) argument should not be freed in any case - the caller already has +it as ->s_fs_info (and uses it a lot afterwards) +2) allocate readlink buffer with kmalloc() - the caller has no way +to tell if it's got that (on absolute symlink) or a result of +kasprintf(). Sure, for SLAB and SLUB kfree() works on results of +kmem_cache_alloc(), but that's not documented anywhere, might change +in the future *and* is already not true for SLOB. + +Fixes: 52b209f7b848 ("get rid of hostfs_read_inode()") +Signed-off-by: Al Viro +Signed-off-by: Sasha Levin +--- + fs/hostfs/hostfs_kern.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c +index aea35459d390..07467ca0f71d 100644 +--- a/fs/hostfs/hostfs_kern.c ++++ b/fs/hostfs/hostfs_kern.c +@@ -142,7 +142,7 @@ static char *follow_link(char *link) + char *name, *resolved, *end; + int n; + +- name = __getname(); ++ name = kmalloc(PATH_MAX, GFP_KERNEL); + if (!name) { + n = -ENOMEM; + goto out_free; +@@ -171,12 +171,11 @@ static char *follow_link(char *link) + goto out_free; + } + +- __putname(name); +- kfree(link); ++ kfree(name); + return resolved; + + out_free: +- __putname(name); ++ kfree(name); + return ERR_PTR(n); + } + +-- +2.30.2 + diff --git a/queue-5.11/i2c-designware-adjust-bus_freq_hz-when-refuse-high-s.patch b/queue-5.11/i2c-designware-adjust-bus_freq_hz-when-refuse-high-s.patch new file mode 100644 index 00000000000..c4ee548f5c4 --- /dev/null +++ b/queue-5.11/i2c-designware-adjust-bus_freq_hz-when-refuse-high-s.patch @@ -0,0 +1,38 @@ +From a4766970073004ce215c0bd484c18a4483717c5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 14:05:10 +0300 +Subject: i2c: designware: Adjust bus_freq_hz when refuse high speed mode set + +From: Andy Shevchenko + +[ Upstream commit 5e729bc54bda705f64941008b018b4e41a4322bf ] + +When hardware doesn't support High Speed Mode, we forget bus_freq_hz +timing adjustment. This makes the timings and real registers being +unsynchronized. Adjust bus_freq_hz when refuse high speed mode set. + +Fixes: b6e67145f149 ("i2c: designware: Enable high speed mode") +Reported-by: "Song Bao Hua (Barry Song)" +Signed-off-by: Andy Shevchenko +Reviewed-by: Barry Song +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-master.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index d6425ad6e6a3..2871cf2ee8b4 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -129,6 +129,7 @@ static int i2c_dw_set_timings_master(struct dw_i2c_dev *dev) + if ((comp_param1 & DW_IC_COMP_PARAM_1_SPEED_MODE_MASK) + != DW_IC_COMP_PARAM_1_SPEED_MODE_HIGH) { + dev_err(dev->dev, "High Speed not supported!\n"); ++ t->bus_freq_hz = I2C_MAX_FAST_MODE_FREQ; + dev->master_cfg &= ~DW_IC_CON_SPEED_MASK; + dev->master_cfg |= DW_IC_CON_SPEED_FAST; + dev->hs_hcnt = 0; +-- +2.30.2 + diff --git a/queue-5.11/i2c-jz4780-fix-bug-for-ingenic-x1000.patch b/queue-5.11/i2c-jz4780-fix-bug-for-ingenic-x1000.patch new file mode 100644 index 00000000000..5abb4ff1155 --- /dev/null +++ b/queue-5.11/i2c-jz4780-fix-bug-for-ingenic-x1000.patch @@ -0,0 +1,49 @@ +From 401bcb376bf25258a7445fd4eeb1c4396054138a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 18:12:13 +0800 +Subject: I2C: JZ4780: Fix bug for Ingenic X1000. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: 周琰杰 (Zhou Yanjie) + +[ Upstream commit 942bfbecc0281c75db84f744b9b77b0f2396f484 ] + +Only send "X1000_I2C_DC_STOP" when last byte, or it will cause +error when I2C write operation which should look like this: + +device_addr + w, reg_addr, data; + +But without this patch, it looks like this: + +device_addr + w, reg_addr, device_addr + w, data; + +Fixes: 21575a7a8d4c ("I2C: JZ4780: Add support for the X1000.") +Reported-by: 杨文龙 (Yang Wenlong) +Tested-by: 杨文龙 (Yang Wenlong) +Signed-off-by: 周琰杰 (Zhou Yanjie) +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-jz4780.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c +index cb4a25ebb890..2a946c207928 100644 +--- a/drivers/i2c/busses/i2c-jz4780.c ++++ b/drivers/i2c/busses/i2c-jz4780.c +@@ -526,8 +526,8 @@ static irqreturn_t jz4780_i2c_irq(int irqno, void *dev_id) + i2c_sta = jz4780_i2c_readw(i2c, JZ4780_I2C_STA); + data = *i2c->wbuf; + data &= ~JZ4780_I2C_DC_READ; +- if ((!i2c->stop_hold) && (i2c->cdata->version >= +- ID_X1000)) ++ if ((i2c->wt_len == 1) && (!i2c->stop_hold) && ++ (i2c->cdata->version >= ID_X1000)) + data |= X1000_I2C_DC_STOP; + jz4780_i2c_writew(i2c, JZ4780_I2C_DC, data); + i2c->wbuf++; +-- +2.30.2 + diff --git a/queue-5.11/i40e-added-asym_pause-to-supported-link-modes.patch b/queue-5.11/i40e-added-asym_pause-to-supported-link-modes.patch new file mode 100644 index 00000000000..1004c700143 --- /dev/null +++ b/queue-5.11/i40e-added-asym_pause-to-supported-link-modes.patch @@ -0,0 +1,41 @@ +From 4cd70cd0cfac15e814718729683886bc9f4cf99a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Jan 2021 15:00:02 +0000 +Subject: i40e: Added Asym_Pause to supported link modes + +From: Mateusz Palczewski + +[ Upstream commit 90449e98c265296329446c7abcd2aae3b20c0bc9 ] + +Add Asym_Pause to supported link modes (it is supported by HW). +Lack of Asym_Pause in supported modes can cause several problems, +i.e. it won't be possible to turn the autonegotiation on +with asymmetric pause settings (i.e. Tx on, Rx off). + +Fixes: 4e91bcd5d47a ("i40e: Finish implementation of ethtool get settings") +Signed-off-by: Dawid Lukwinski +Signed-off-by: Mateusz Palczewski +Reviewed-by: Aleksandr Loktionov +Reviewed-by: Przemyslaw Patynowski +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 9e81f85ee2d8..a92fac6f1389 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -1101,6 +1101,7 @@ static int i40e_get_link_ksettings(struct net_device *netdev, + + /* Set flow control settings */ + ethtool_link_ksettings_add_link_mode(ks, supported, Pause); ++ ethtool_link_ksettings_add_link_mode(ks, supported, Asym_Pause); + + switch (hw->fc.requested_mode) { + case I40E_FC_FULL: +-- +2.30.2 + diff --git a/queue-5.11/i40e-fix-display-statistics-for-veb_tc.patch b/queue-5.11/i40e-fix-display-statistics-for-veb_tc.patch new file mode 100644 index 00000000000..283f24486c8 --- /dev/null +++ b/queue-5.11/i40e-fix-display-statistics-for-veb_tc.patch @@ -0,0 +1,115 @@ +From 053fed77e39f6bc217de46b990ce497b4b6a6a2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 08:46:27 +0100 +Subject: i40e: Fix display statistics for veb_tc + +From: Eryk Rybak + +[ Upstream commit c3214de929dbf1b7374add8bbed30ce82b197bbb ] + +If veb-stats was enabled, the ethtool stats triggered a warning +due to invalid size: 'unexpected stat size for veb.tc_%u_tx_packets'. +This was due to an incorrect structure definition for the statistics. +Structures and functions have been improved in line with requirements +for the presentation of statistics, in particular for the functions: +'i40e_add_ethtool_stats' and 'i40e_add_stat_strings'. + +Fixes: 1510ae0be2a4 ("i40e: convert VEB TC stats to use an i40e_stats array") +Signed-off-by: Eryk Rybak +Signed-off-by: Grzegorz Szczurek +Reviewed-by: Aleksandr Loktionov +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/i40e/i40e_ethtool.c | 52 ++++++++++++++++--- + 1 file changed, 46 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index a92fac6f1389..849e38be69ff 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -232,6 +232,8 @@ static void __i40e_add_stat_strings(u8 **p, const struct i40e_stats stats[], + I40E_STAT(struct i40e_vsi, _name, _stat) + #define I40E_VEB_STAT(_name, _stat) \ + I40E_STAT(struct i40e_veb, _name, _stat) ++#define I40E_VEB_TC_STAT(_name, _stat) \ ++ I40E_STAT(struct i40e_cp_veb_tc_stats, _name, _stat) + #define I40E_PFC_STAT(_name, _stat) \ + I40E_STAT(struct i40e_pfc_stats, _name, _stat) + #define I40E_QUEUE_STAT(_name, _stat) \ +@@ -266,11 +268,18 @@ static const struct i40e_stats i40e_gstrings_veb_stats[] = { + I40E_VEB_STAT("veb.rx_unknown_protocol", stats.rx_unknown_protocol), + }; + ++struct i40e_cp_veb_tc_stats { ++ u64 tc_rx_packets; ++ u64 tc_rx_bytes; ++ u64 tc_tx_packets; ++ u64 tc_tx_bytes; ++}; ++ + static const struct i40e_stats i40e_gstrings_veb_tc_stats[] = { +- I40E_VEB_STAT("veb.tc_%u_tx_packets", tc_stats.tc_tx_packets), +- I40E_VEB_STAT("veb.tc_%u_tx_bytes", tc_stats.tc_tx_bytes), +- I40E_VEB_STAT("veb.tc_%u_rx_packets", tc_stats.tc_rx_packets), +- I40E_VEB_STAT("veb.tc_%u_rx_bytes", tc_stats.tc_rx_bytes), ++ I40E_VEB_TC_STAT("veb.tc_%u_tx_packets", tc_tx_packets), ++ I40E_VEB_TC_STAT("veb.tc_%u_tx_bytes", tc_tx_bytes), ++ I40E_VEB_TC_STAT("veb.tc_%u_rx_packets", tc_rx_packets), ++ I40E_VEB_TC_STAT("veb.tc_%u_rx_bytes", tc_rx_bytes), + }; + + static const struct i40e_stats i40e_gstrings_misc_stats[] = { +@@ -2217,6 +2226,29 @@ static int i40e_get_sset_count(struct net_device *netdev, int sset) + } + } + ++/** ++ * i40e_get_veb_tc_stats - copy VEB TC statistics to formatted structure ++ * @tc: the TC statistics in VEB structure (veb->tc_stats) ++ * @i: the index of traffic class in (veb->tc_stats) structure to copy ++ * ++ * Copy VEB TC statistics from structure of arrays (veb->tc_stats) to ++ * one dimensional structure i40e_cp_veb_tc_stats. ++ * Produce formatted i40e_cp_veb_tc_stats structure of the VEB TC ++ * statistics for the given TC. ++ **/ ++static struct i40e_cp_veb_tc_stats ++i40e_get_veb_tc_stats(struct i40e_veb_tc_stats *tc, unsigned int i) ++{ ++ struct i40e_cp_veb_tc_stats veb_tc = { ++ .tc_rx_packets = tc->tc_rx_packets[i], ++ .tc_rx_bytes = tc->tc_rx_bytes[i], ++ .tc_tx_packets = tc->tc_tx_packets[i], ++ .tc_tx_bytes = tc->tc_tx_bytes[i], ++ }; ++ ++ return veb_tc; ++} ++ + /** + * i40e_get_pfc_stats - copy HW PFC statistics to formatted structure + * @pf: the PF device structure +@@ -2301,8 +2333,16 @@ static void i40e_get_ethtool_stats(struct net_device *netdev, + i40e_gstrings_veb_stats); + + for (i = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) +- i40e_add_ethtool_stats(&data, veb_stats ? veb : NULL, +- i40e_gstrings_veb_tc_stats); ++ if (veb_stats) { ++ struct i40e_cp_veb_tc_stats veb_tc = ++ i40e_get_veb_tc_stats(&veb->tc_stats, i); ++ ++ i40e_add_ethtool_stats(&data, &veb_tc, ++ i40e_gstrings_veb_tc_stats); ++ } else { ++ i40e_add_ethtool_stats(&data, NULL, ++ i40e_gstrings_veb_tc_stats); ++ } + + i40e_add_ethtool_stats(&data, pf, i40e_gstrings_stats); + +-- +2.30.2 + diff --git a/queue-5.11/i40e-fix-kernel-oops-when-i40e-driver-removes-vf-s.patch b/queue-5.11/i40e-fix-kernel-oops-when-i40e-driver-removes-vf-s.patch new file mode 100644 index 00000000000..c4b4df56d22 --- /dev/null +++ b/queue-5.11/i40e-fix-kernel-oops-when-i40e-driver-removes-vf-s.patch @@ -0,0 +1,84 @@ +From 4746c86df55808bcabb53a5231a9181ac0941dd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Feb 2021 11:15:26 +0000 +Subject: i40e: Fix kernel oops when i40e driver removes VF's + +From: Eryk Rybak + +[ Upstream commit 347b5650cd158d1d953487cc2bec567af5c5bf96 ] + +Fix the reason of kernel oops when i40e driver removed VFs. +Added new __I40E_VFS_RELEASING state to signalize releasing +process by PF, that it makes possible to exit of reset VF procedure. +Without this patch, it is possible to suspend the VFs reset by +releasing VFs resources procedure. Retrying the reset after the +timeout works on the freed VF memory causing a kernel oops. + +Fixes: d43d60e5eb95 ("i40e: ensure reset occurs when disabling VF") +Signed-off-by: Eryk Rybak +Signed-off-by: Grzegorz Szczurek +Reviewed-by: Aleksandr Loktionov +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c | 9 +++++++++ + 2 files changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 118473dfdcbd..fe1258778cbc 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -142,6 +142,7 @@ enum i40e_state_t { + __I40E_VIRTCHNL_OP_PENDING, + __I40E_RECOVERY_MODE, + __I40E_VF_RESETS_DISABLED, /* disable resets during i40e_remove */ ++ __I40E_VFS_RELEASING, + /* This must be last as it determines the size of the BITMAP */ + __I40E_STATE_SIZE__, + }; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 1b6ec9be155a..5d301a466f5c 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -137,6 +137,7 @@ void i40e_vc_notify_vf_reset(struct i40e_vf *vf) + **/ + static inline void i40e_vc_disable_vf(struct i40e_vf *vf) + { ++ struct i40e_pf *pf = vf->pf; + int i; + + i40e_vc_notify_vf_reset(vf); +@@ -147,6 +148,11 @@ static inline void i40e_vc_disable_vf(struct i40e_vf *vf) + * ensure a reset. + */ + for (i = 0; i < 20; i++) { ++ /* If PF is in VFs releasing state reset VF is impossible, ++ * so leave it. ++ */ ++ if (test_bit(__I40E_VFS_RELEASING, pf->state)) ++ return; + if (i40e_reset_vf(vf, false)) + return; + usleep_range(10000, 20000); +@@ -1574,6 +1580,8 @@ void i40e_free_vfs(struct i40e_pf *pf) + + if (!pf->vf) + return; ++ ++ set_bit(__I40E_VFS_RELEASING, pf->state); + while (test_and_set_bit(__I40E_VF_DISABLE, pf->state)) + usleep_range(1000, 2000); + +@@ -1631,6 +1639,7 @@ void i40e_free_vfs(struct i40e_pf *pf) + } + } + clear_bit(__I40E_VF_DISABLE, pf->state); ++ clear_bit(__I40E_VFS_RELEASING, pf->state); + } + + #ifdef CONFIG_PCI_IOV +-- +2.30.2 + diff --git a/queue-5.11/i40e-fix-parameters-in-aq_get_phy_register.patch b/queue-5.11/i40e-fix-parameters-in-aq_get_phy_register.patch new file mode 100644 index 00000000000..b4a5dcf925f --- /dev/null +++ b/queue-5.11/i40e-fix-parameters-in-aq_get_phy_register.patch @@ -0,0 +1,39 @@ +From cada40dcc3167fd465aa9b1b4ced15046a8d2df0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 09:58:27 +0100 +Subject: i40e: Fix parameters in aq_get_phy_register() + +From: Grzegorz Siwik + +[ Upstream commit b2d0efc4be7ed320e33eaa9b6dd6f3f6011ffb8e ] + +Change parameters order in aq_get_phy_register() due to wrong +statistics in PHY reported by ethtool. Previously all PHY statistics were +exactly the same for all interfaces +Now statistics are reported correctly - different for different interfaces + +Fixes: 0514db37dd78 ("i40e: Extend PHY access with page change flag") +Signed-off-by: Grzegorz Siwik +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 849e38be69ff..31d48a85cfaf 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -5285,7 +5285,7 @@ static int i40e_get_module_eeprom(struct net_device *netdev, + + status = i40e_aq_get_phy_register(hw, + I40E_AQ_PHY_REG_ACCESS_EXTERNAL_MODULE, +- true, addr, offset, &value, NULL); ++ addr, true, offset, &value, NULL); + if (status) + return -EIO; + data[i] = value; +-- +2.30.2 + diff --git a/queue-5.11/i40e-fix-receiving-of-single-packets-in-xsk-zero-cop.patch b/queue-5.11/i40e-fix-receiving-of-single-packets-in-xsk-zero-cop.patch new file mode 100644 index 00000000000..7278398d78f --- /dev/null +++ b/queue-5.11/i40e-fix-receiving-of-single-packets-in-xsk-zero-cop.patch @@ -0,0 +1,64 @@ +From 3566e37f5fa092c4e26aa25bdcf6e5bd9080e86b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 10:44:10 +0100 +Subject: i40e: fix receiving of single packets in xsk zero-copy mode + +From: Magnus Karlsson + +[ Upstream commit 528060ef3e1105c5c3eba66ffbfc80e0825e2cce ] + +Fix so that single packets are received immediately instead of in +batches of 8. If you sent 1 pps to a system, you received 8 packets +every 8 seconds instead of 1 packet every second. The problem behind +this was that the work_done reporting from the Tx part of the driver +was broken. The work_done reporting in i40e controls not only the +reporting back to the napi logic but also the setting of the interrupt +throttling logic. When Tx or Rx reports that it has more to do, +interrupts are throttled or coalesced and when they both report that +they are done, interrupts are armed right away. If the wrong work_done +value is returned, the logic will start to throttle interrupts in a +situation where it should have just enabled them. This leads to the +undesired batching behavior seen in user-space. + +Fix this by returning the correct boolean value from the Tx xsk +zero-copy path. Return true if there is nothing to do or if we got +fewer packets to process than we asked for. Return false if we got as +many packets as the budget since there might be more packets we can +process. + +Fixes: 3106c580fb7c ("i40e: Use batched xsk Tx interfaces to increase performance") +Reported-by: Sreedevi Joshi +Signed-off-by: Magnus Karlsson +Acked-by: Maciej Fijalkowski +Tested-by: Kiran Bhandare +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_xsk.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +index 37a21fb99922..7949f6b79f92 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +@@ -462,7 +462,7 @@ static bool i40e_xmit_zc(struct i40e_ring *xdp_ring, unsigned int budget) + + nb_pkts = xsk_tx_peek_release_desc_batch(xdp_ring->xsk_pool, descs, budget); + if (!nb_pkts) +- return false; ++ return true; + + if (xdp_ring->next_to_use + nb_pkts >= xdp_ring->count) { + nb_processed = xdp_ring->count - xdp_ring->next_to_use; +@@ -479,7 +479,7 @@ static bool i40e_xmit_zc(struct i40e_ring *xdp_ring, unsigned int budget) + + i40e_update_tx_stats(xdp_ring, nb_pkts, total_bytes); + +- return true; ++ return nb_pkts < budget; + } + + /** +-- +2.30.2 + diff --git a/queue-5.11/iwlwifi-fix-11ax-disabled-bit-in-the-regulatory-capa.patch b/queue-5.11/iwlwifi-fix-11ax-disabled-bit-in-the-regulatory-capa.patch new file mode 100644 index 00000000000..90d9c9f0d7f --- /dev/null +++ b/queue-5.11/iwlwifi-fix-11ax-disabled-bit-in-the-regulatory-capa.patch @@ -0,0 +1,41 @@ +From 495821d58556697012250846b1f48b8b1d1ff07d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 12:57:17 +0200 +Subject: iwlwifi: fix 11ax disabled bit in the regulatory capability flags + +From: Luca Coelho + +[ Upstream commit 07cc40fec9a85e669ea12e161a438d2cbd76f1ed ] + +When version 2 of the regulatory capability flags API was implemented, +the flag to disable 11ax was defined as bit 13, but this was later +changed and the bit remained as bit 10, like in version 1. This was +never changed in the driver, so we were checking for the wrong bit in +newer devices. Fix it. + +Signed-off-by: Luca Coelho +Fixes: e27c506a985c ("iwlwifi: regulatory: regulatory capabilities api change") +Signed-off-by: Luca Coelho +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/iwlwifi.20210326125611.6d28516b59cd.Id0248d5e4662695254f49ce37b0268834ed52918@changeid +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +index 720193d16539..7da193a12871 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-nvm-parse.c +@@ -232,7 +232,7 @@ enum iwl_reg_capa_flags_v2 { + REG_CAPA_V2_MCS_9_ALLOWED = BIT(6), + REG_CAPA_V2_WEATHER_DISABLED = BIT(7), + REG_CAPA_V2_40MHZ_ALLOWED = BIT(8), +- REG_CAPA_V2_11AX_DISABLED = BIT(13), ++ REG_CAPA_V2_11AX_DISABLED = BIT(10), + }; + + /* +-- +2.30.2 + diff --git a/queue-5.11/mlxsw-spectrum-fix-ecn-marking-in-tunnel-decapsulati.patch b/queue-5.11/mlxsw-spectrum-fix-ecn-marking-in-tunnel-decapsulati.patch new file mode 100644 index 00000000000..346f766273d --- /dev/null +++ b/queue-5.11/mlxsw-spectrum-fix-ecn-marking-in-tunnel-decapsulati.patch @@ -0,0 +1,120 @@ +From 3a1416ae2e1e3ab17505e1fc898a9bd439a2b733 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 11:29:23 +0300 +Subject: mlxsw: spectrum: Fix ECN marking in tunnel decapsulation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ido Schimmel + +[ Upstream commit 66167c310deb4ac1725f81004fb4b504676ad0bf ] + +Cited commit changed the behavior of the software data path with regards +to the ECN marking of decapsulated packets. However, the commit did not +change other callers of __INET_ECN_decapsulate(), namely mlxsw. The +driver is using the function in order to ensure that the hardware and +software data paths act the same with regards to the ECN marking of +decapsulated packets. + +The discrepancy was uncovered by commit 5aa3c334a449 ("selftests: +forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value") that +aligned the selftest to the new behavior. Without this patch the +selftest passes when used with veth pairs, but fails when used with +mlxsw netdevs. + +Fix this by instructing the device to propagate the ECT(1) mark from the +outer header to the inner header when the inner header is ECT(0), for +both NVE and IP-in-IP tunnels. + +A helper is added in order not to duplicate the code between both tunnel +types. + +Fixes: b723748750ec ("tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040") +Signed-off-by: Ido Schimmel +Reviewed-by: Petr Machata +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.h | 15 +++++++++++++++ + .../net/ethernet/mellanox/mlxsw/spectrum_ipip.c | 7 +++---- + .../net/ethernet/mellanox/mlxsw/spectrum_nve.c | 7 +++---- + 3 files changed, 21 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +index a6956cfc9cb1..4399c9a4999d 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #include "port.h" + #include "core.h" +@@ -346,6 +347,20 @@ struct mlxsw_sp_port_type_speed_ops { + u32 (*ptys_proto_cap_masked_get)(u32 eth_proto_cap); + }; + ++static inline u8 mlxsw_sp_tunnel_ecn_decap(u8 outer_ecn, u8 inner_ecn, ++ bool *trap_en) ++{ ++ bool set_ce = false; ++ ++ *trap_en = !!__INET_ECN_decapsulate(outer_ecn, inner_ecn, &set_ce); ++ if (set_ce) ++ return INET_ECN_CE; ++ else if (outer_ecn == INET_ECN_ECT_1 && inner_ecn == INET_ECN_ECT_0) ++ return INET_ECN_ECT_1; ++ else ++ return inner_ecn; ++} ++ + static inline struct net_device * + mlxsw_sp_bridge_vxlan_dev_find(struct net_device *br_dev) + { +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c +index 6ccca39bae84..64a8f838eb53 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_ipip.c +@@ -335,12 +335,11 @@ static int mlxsw_sp_ipip_ecn_decap_init_one(struct mlxsw_sp *mlxsw_sp, + u8 inner_ecn, u8 outer_ecn) + { + char tidem_pl[MLXSW_REG_TIDEM_LEN]; +- bool trap_en, set_ce = false; + u8 new_inner_ecn; ++ bool trap_en; + +- trap_en = __INET_ECN_decapsulate(outer_ecn, inner_ecn, &set_ce); +- new_inner_ecn = set_ce ? INET_ECN_CE : inner_ecn; +- ++ new_inner_ecn = mlxsw_sp_tunnel_ecn_decap(outer_ecn, inner_ecn, ++ &trap_en); + mlxsw_reg_tidem_pack(tidem_pl, outer_ecn, inner_ecn, new_inner_ecn, + trap_en, trap_en ? MLXSW_TRAP_ID_DECAP_ECN0 : 0); + return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(tidem), tidem_pl); +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c +index e5ec595593f4..9eba8fa684ae 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve.c +@@ -909,12 +909,11 @@ static int __mlxsw_sp_nve_ecn_decap_init(struct mlxsw_sp *mlxsw_sp, + u8 inner_ecn, u8 outer_ecn) + { + char tndem_pl[MLXSW_REG_TNDEM_LEN]; +- bool trap_en, set_ce = false; + u8 new_inner_ecn; ++ bool trap_en; + +- trap_en = !!__INET_ECN_decapsulate(outer_ecn, inner_ecn, &set_ce); +- new_inner_ecn = set_ce ? INET_ECN_CE : inner_ecn; +- ++ new_inner_ecn = mlxsw_sp_tunnel_ecn_decap(outer_ecn, inner_ecn, ++ &trap_en); + mlxsw_reg_tndem_pack(tndem_pl, outer_ecn, inner_ecn, new_inner_ecn, + trap_en, trap_en ? MLXSW_TRAP_ID_DECAP_ECN0 : 0); + return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(tndem), tndem_pl); +-- +2.30.2 + diff --git a/queue-5.11/mptcp-forbit-mcast-related-sockopt-on-mptcp-sockets.patch b/queue-5.11/mptcp-forbit-mcast-related-sockopt-on-mptcp-sockets.patch new file mode 100644 index 00000000000..c23202991fb --- /dev/null +++ b/queue-5.11/mptcp-forbit-mcast-related-sockopt-on-mptcp-sockets.patch @@ -0,0 +1,102 @@ +From 12b4493ab6ac94f4e1a10d683352cbc7cb2baa38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 18:57:44 +0200 +Subject: mptcp: forbit mcast-related sockopt on MPTCP sockets + +From: Paolo Abeni + +[ Upstream commit 86581852d7710990d8af9dadfe9a661f0abf2114 ] + +Unrolling mcast state at msk dismantel time is bug prone, as +syzkaller reported: + +====================================================== +WARNING: possible circular locking dependency detected +5.11.0-syzkaller #0 Not tainted +------------------------------------------------------ +syz-executor905/8822 is trying to acquire lock: +ffffffff8d678fe8 (rtnl_mutex){+.+.}-{3:3}, at: ipv6_sock_mc_close+0xd7/0x110 net/ipv6/mcast.c:323 + +but task is already holding lock: +ffff888024390120 (sk_lock-AF_INET6){+.+.}-{0:0}, at: lock_sock include/net/sock.h:1600 [inline] +ffff888024390120 (sk_lock-AF_INET6){+.+.}-{0:0}, at: mptcp6_release+0x57/0x130 net/mptcp/protocol.c:3507 + +which lock already depends on the new lock. + +Instead we can simply forbit any mcast-related setsockopt + +Fixes: 717e79c867ca5 ("mptcp: Add setsockopt()/getsockopt() socket operations") +Signed-off-by: Paolo Abeni +Reviewed-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/protocol.c | 45 ++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 45 insertions(+) + +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index 5932b0ebecc3..de9f2509acbe 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -2863,6 +2863,48 @@ static int mptcp_setsockopt_v6(struct mptcp_sock *msk, int optname, + return ret; + } + ++static bool mptcp_unsupported(int level, int optname) ++{ ++ if (level == SOL_IP) { ++ switch (optname) { ++ case IP_ADD_MEMBERSHIP: ++ case IP_ADD_SOURCE_MEMBERSHIP: ++ case IP_DROP_MEMBERSHIP: ++ case IP_DROP_SOURCE_MEMBERSHIP: ++ case IP_BLOCK_SOURCE: ++ case IP_UNBLOCK_SOURCE: ++ case MCAST_JOIN_GROUP: ++ case MCAST_LEAVE_GROUP: ++ case MCAST_JOIN_SOURCE_GROUP: ++ case MCAST_LEAVE_SOURCE_GROUP: ++ case MCAST_BLOCK_SOURCE: ++ case MCAST_UNBLOCK_SOURCE: ++ case MCAST_MSFILTER: ++ return true; ++ } ++ return false; ++ } ++ if (level == SOL_IPV6) { ++ switch (optname) { ++ case IPV6_ADDRFORM: ++ case IPV6_ADD_MEMBERSHIP: ++ case IPV6_DROP_MEMBERSHIP: ++ case IPV6_JOIN_ANYCAST: ++ case IPV6_LEAVE_ANYCAST: ++ case MCAST_JOIN_GROUP: ++ case MCAST_LEAVE_GROUP: ++ case MCAST_JOIN_SOURCE_GROUP: ++ case MCAST_LEAVE_SOURCE_GROUP: ++ case MCAST_BLOCK_SOURCE: ++ case MCAST_UNBLOCK_SOURCE: ++ case MCAST_MSFILTER: ++ return true; ++ } ++ return false; ++ } ++ return false; ++} ++ + static int mptcp_setsockopt(struct sock *sk, int level, int optname, + sockptr_t optval, unsigned int optlen) + { +@@ -2871,6 +2913,9 @@ static int mptcp_setsockopt(struct sock *sk, int level, int optname, + + pr_debug("msk=%p", msk); + ++ if (mptcp_unsupported(level, optname)) ++ return -ENOPROTOOPT; ++ + if (level == SOL_SOCKET) + return mptcp_setsockopt_sol_socket(msk, optname, optval, optlen); + +-- +2.30.2 + diff --git a/queue-5.11/mptcp-revert-mptcp-provide-subflow-aware-release-fun.patch b/queue-5.11/mptcp-revert-mptcp-provide-subflow-aware-release-fun.patch new file mode 100644 index 00000000000..f17be14366d --- /dev/null +++ b/queue-5.11/mptcp-revert-mptcp-provide-subflow-aware-release-fun.patch @@ -0,0 +1,118 @@ +From 76956661dc8e9bff9b82a10094c1ba2c2b8f5629 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 18:57:45 +0200 +Subject: mptcp: revert "mptcp: provide subflow aware release function" + +From: Paolo Abeni + +[ Upstream commit 0a3cc57978d1d1448312f8973bd84dca4a71433a ] + +This change reverts commit ad98dd37051e ("mptcp: provide subflow aware +release function"). The latter introduced a deadlock spotted by +syzkaller and is not needed anymore after the previous commit. + +Fixes: ad98dd37051e ("mptcp: provide subflow aware release function") +Signed-off-by: Paolo Abeni +Reviewed-by: Mat Martineau +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/mptcp/protocol.c | 55 ++------------------------------------------ + 1 file changed, 2 insertions(+), 53 deletions(-) + +diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c +index de9f2509acbe..e337b35a368f 100644 +--- a/net/mptcp/protocol.c ++++ b/net/mptcp/protocol.c +@@ -11,7 +11,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -20,7 +19,6 @@ + #include + #if IS_ENABLED(CONFIG_MPTCP_IPV6) + #include +-#include + #endif + #include + #include +@@ -3424,34 +3422,10 @@ static __poll_t mptcp_poll(struct file *file, struct socket *sock, + return mask; + } + +-static int mptcp_release(struct socket *sock) +-{ +- struct mptcp_subflow_context *subflow; +- struct sock *sk = sock->sk; +- struct mptcp_sock *msk; +- +- if (!sk) +- return 0; +- +- lock_sock(sk); +- +- msk = mptcp_sk(sk); +- +- mptcp_for_each_subflow(msk, subflow) { +- struct sock *ssk = mptcp_subflow_tcp_sock(subflow); +- +- ip_mc_drop_socket(ssk); +- } +- +- release_sock(sk); +- +- return inet_release(sock); +-} +- + static const struct proto_ops mptcp_stream_ops = { + .family = PF_INET, + .owner = THIS_MODULE, +- .release = mptcp_release, ++ .release = inet_release, + .bind = mptcp_bind, + .connect = mptcp_stream_connect, + .socketpair = sock_no_socketpair, +@@ -3498,35 +3472,10 @@ void __init mptcp_proto_init(void) + } + + #if IS_ENABLED(CONFIG_MPTCP_IPV6) +-static int mptcp6_release(struct socket *sock) +-{ +- struct mptcp_subflow_context *subflow; +- struct mptcp_sock *msk; +- struct sock *sk = sock->sk; +- +- if (!sk) +- return 0; +- +- lock_sock(sk); +- +- msk = mptcp_sk(sk); +- +- mptcp_for_each_subflow(msk, subflow) { +- struct sock *ssk = mptcp_subflow_tcp_sock(subflow); +- +- ip_mc_drop_socket(ssk); +- ipv6_sock_mc_close(ssk); +- ipv6_sock_ac_close(ssk); +- } +- +- release_sock(sk); +- return inet6_release(sock); +-} +- + static const struct proto_ops mptcp_v6_stream_ops = { + .family = PF_INET6, + .owner = THIS_MODULE, +- .release = mptcp6_release, ++ .release = inet6_release, + .bind = mptcp_bind, + .connect = mptcp_stream_connect, + .socketpair = sock_no_socketpair, +-- +2.30.2 + diff --git a/queue-5.11/net-cls_api-fix-uninitialised-struct-field-bo-unlock.patch b/queue-5.11/net-cls_api-fix-uninitialised-struct-field-bo-unlock.patch new file mode 100644 index 00000000000..ebcf17f6176 --- /dev/null +++ b/queue-5.11/net-cls_api-fix-uninitialised-struct-field-bo-unlock.patch @@ -0,0 +1,39 @@ +From 6905f0e6d46c5df0b2358d01f6ac79d85a32dc0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 12:52:48 +0800 +Subject: net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb + +From: Yunjian Wang + +[ Upstream commit 990b03b05b2fba79de2a1ee9dc359fc552d95ba6 ] + +The 'unlocked_driver_cb' struct field in 'bo' is not being initialized +in tcf_block_offload_init(). The uninitialized 'unlocked_driver_cb' +will be used when calling unlocked_driver_cb(). So initialize 'bo' to +zero to avoid the issue. + +Addresses-Coverity: ("Uninitialized scalar variable") +Fixes: 0fdcf78d5973 ("net: use flow_indr_dev_setup_offload()") +Signed-off-by: Yunjian Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/cls_api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 87cac07da7c3..b3a2cba130a1 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -646,7 +646,7 @@ static void tc_block_indr_cleanup(struct flow_block_cb *block_cb) + struct net_device *dev = block_cb->indr.dev; + struct Qdisc *sch = block_cb->indr.sch; + struct netlink_ext_ack extack = {}; +- struct flow_block_offload bo; ++ struct flow_block_offload bo = {}; + + tcf_block_offload_init(&bo, dev, sch, FLOW_BLOCK_UNBIND, + block_cb->indr.binder_type, +-- +2.30.2 + diff --git a/queue-5.11/net-dsa-fix-type-was-not-set-for-devlink-port.patch b/queue-5.11/net-dsa-fix-type-was-not-set-for-devlink-port.patch new file mode 100644 index 00000000000..55a88a7a6e0 --- /dev/null +++ b/queue-5.11/net-dsa-fix-type-was-not-set-for-devlink-port.patch @@ -0,0 +1,52 @@ +From 86d5b8dbb8364ea9da48fcba27dcf671d129c191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 18:30:16 +0300 +Subject: net: dsa: Fix type was not set for devlink port + +From: Maxim Kochetkov + +[ Upstream commit fb6ec87f7229b92baa81b35cbc76f2626d5bfadb ] + +If PHY is not available on DSA port (described at devicetree but absent or +failed to detect) then kernel prints warning after 3700 secs: + +[ 3707.948771] ------------[ cut here ]------------ +[ 3707.948784] Type was not set for devlink port. +[ 3707.948894] WARNING: CPU: 1 PID: 17 at net/core/devlink.c:8097 0xc083f9d8 + +We should unregister the devlink port as a user port and +re-register it as an unused port before executing "continue" in case of +dsa_port_setup error. + +Fixes: 86f8b1c01a0a ("net: dsa: Do not make user port errors fatal") +Signed-off-by: Maxim Kochetkov +Reviewed-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/dsa/dsa2.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c +index a04fd637b4cd..3ada338d7e08 100644 +--- a/net/dsa/dsa2.c ++++ b/net/dsa/dsa2.c +@@ -533,8 +533,14 @@ static int dsa_tree_setup_switches(struct dsa_switch_tree *dst) + + list_for_each_entry(dp, &dst->ports, list) { + err = dsa_port_setup(dp); +- if (err) ++ if (err) { ++ dsa_port_devlink_teardown(dp); ++ dp->type = DSA_PORT_TYPE_UNUSED; ++ err = dsa_port_devlink_setup(dp); ++ if (err) ++ goto teardown; + continue; ++ } + } + + return 0; +-- +2.30.2 + diff --git a/queue-5.11/net-hns3-clear-vf-down-state-bit-before-request-link.patch b/queue-5.11/net-hns3-clear-vf-down-state-bit-before-request-link.patch new file mode 100644 index 00000000000..ba08ec20bfc --- /dev/null +++ b/queue-5.11/net-hns3-clear-vf-down-state-bit-before-request-link.patch @@ -0,0 +1,51 @@ +From a7eb33d7553ff58671bb65debb22fe78758932e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 21:10:43 +0800 +Subject: net: hns3: clear VF down state bit before request link status + +From: Guangbin Huang + +[ Upstream commit ed7bedd2c3ca040f1e8ea02c6590a93116b1ec78 ] + +Currently, the VF down state bit is cleared after VF sending +link status request command. There is problem that when VF gets +link status replied from PF, the down state bit may still set +as 1. In this case, the link status replied from PF will be +ignored and always set VF link status to down. + +To fix this problem, clear VF down state bit before VF requests +link status. + +Fixes: e2cb1dec9779 ("net: hns3: Add HNS3 VF HCL(Hardware Compatibility Layer) Support") +Signed-off-by: Guangbin Huang +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +index 674b3a22e91f..3bd7bc794677 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c +@@ -2575,14 +2575,14 @@ static int hclgevf_ae_start(struct hnae3_handle *handle) + { + struct hclgevf_dev *hdev = hclgevf_ae_get_hdev(handle); + ++ clear_bit(HCLGEVF_STATE_DOWN, &hdev->state); ++ + hclgevf_reset_tqp_stats(handle); + + hclgevf_request_link_info(hdev); + + hclgevf_update_link_mode(hdev); + +- clear_bit(HCLGEVF_STATE_DOWN, &hdev->state); +- + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.11/net-macb-restore-cmp-registers-on-resume-path.patch b/queue-5.11/net-macb-restore-cmp-registers-on-resume-path.patch new file mode 100644 index 00000000000..dcb46721e47 --- /dev/null +++ b/queue-5.11/net-macb-restore-cmp-registers-on-resume-path.patch @@ -0,0 +1,55 @@ +From 77f9be407c53f49637f469898ff643f4e5bd487d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 15:42:53 +0300 +Subject: net: macb: restore cmp registers on resume path + +From: Claudiu Beznea + +[ Upstream commit a14d273ba15968495896a38b7b3399dba66d0270 ] + +Restore CMP screener registers on resume path. + +Fixes: c1e85c6ce57ef ("net: macb: save/restore the remaining registers and features") +Signed-off-by: Claudiu Beznea +Acked-by: Nicolas Ferre +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 07cdb38e7d11..fbedbceef2d1 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -3235,6 +3235,9 @@ static void gem_prog_cmp_regs(struct macb *bp, struct ethtool_rx_flow_spec *fs) + bool cmp_b = false; + bool cmp_c = false; + ++ if (!macb_is_gem(bp)) ++ return; ++ + tp4sp_v = &(fs->h_u.tcp_ip4_spec); + tp4sp_m = &(fs->m_u.tcp_ip4_spec); + +@@ -3603,6 +3606,7 @@ static void macb_restore_features(struct macb *bp) + { + struct net_device *netdev = bp->dev; + netdev_features_t features = netdev->features; ++ struct ethtool_rx_fs_item *item; + + /* TX checksum offload */ + macb_set_txcsum_feature(bp, features); +@@ -3611,6 +3615,9 @@ static void macb_restore_features(struct macb *bp) + macb_set_rxcsum_feature(bp, features); + + /* RX Flow Filters */ ++ list_for_each_entry(item, &bp->rx_fs_list.list, list) ++ gem_prog_cmp_regs(bp, &item->fs); ++ + macb_set_rxflow_feature(bp, features); + } + +-- +2.30.2 + diff --git a/queue-5.11/net-mlx5-delete-auxiliary-bus-driver-eth-rep-first.patch b/queue-5.11/net-mlx5-delete-auxiliary-bus-driver-eth-rep-first.patch new file mode 100644 index 00000000000..58cbcef16e8 --- /dev/null +++ b/queue-5.11/net-mlx5-delete-auxiliary-bus-driver-eth-rep-first.patch @@ -0,0 +1,48 @@ +From 4be9c151e751fb6070b09cf9df0197fc794a050c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 17:22:03 +0200 +Subject: net/mlx5: Delete auxiliary bus driver eth-rep first + +From: Maor Dickman + +[ Upstream commit 1f90aedfb496ccccf862c7b7c0889af20c2fc61a ] + +Delete auxiliary bus drivers flow deletes the eth driver +first and then the eth-reps driver but eth-reps devices resources +are depend on eth device. + +Fixed by changing the delete order of auxiliary bus drivers to delete +the eth-rep driver first and after it the eth driver. + +Fixes: 601c10c89cbb ("net/mlx5: Delete custom device management logic") +Signed-off-by: Maor Dickman +Reviewed-by: Leon Romanovsky +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/dev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +index b051417ede67..9153c9bda96f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c +@@ -191,12 +191,12 @@ static bool is_ib_supported(struct mlx5_core_dev *dev) + } + + enum { +- MLX5_INTERFACE_PROTOCOL_ETH_REP, + MLX5_INTERFACE_PROTOCOL_ETH, ++ MLX5_INTERFACE_PROTOCOL_ETH_REP, + ++ MLX5_INTERFACE_PROTOCOL_IB, + MLX5_INTERFACE_PROTOCOL_IB_REP, + MLX5_INTERFACE_PROTOCOL_MPIB, +- MLX5_INTERFACE_PROTOCOL_IB, + + MLX5_INTERFACE_PROTOCOL_VNET, + }; +-- +2.30.2 + diff --git a/queue-5.11/net-mlx5-don-t-request-more-than-supported-eqs.patch b/queue-5.11/net-mlx5-don-t-request-more-than-supported-eqs.patch new file mode 100644 index 00000000000..c52eb6af1ca --- /dev/null +++ b/queue-5.11/net-mlx5-don-t-request-more-than-supported-eqs.patch @@ -0,0 +1,57 @@ +From d26a2cd0463c4cc170e28cfffb8958d4815db436 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Dec 2019 16:58:10 -0600 +Subject: net/mlx5: Don't request more than supported EQs + +From: Daniel Jurgens + +[ Upstream commit a7b76002ae78cd230ee652ccdfedf21aa94fcecc ] + +Calculating the number of compeltion EQs based on the number of +available IRQ vectors doesn't work now that all async EQs share one IRQ. +Thus the max number of EQs can be exceeded on systems with more than +approximately 256 CPUs. Take this into account when calculating the +number of available completion EQs. + +Fixes: 81bfa206032a ("net/mlx5: Use a single IRQ for all async EQs") +Signed-off-by: Daniel Jurgens +Reviewed-by: Parav Pandit +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/eq.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c +index fc0afa03d407..b5f48efebd71 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c +@@ -928,13 +928,24 @@ void mlx5_core_eq_free_irqs(struct mlx5_core_dev *dev) + mutex_unlock(&table->lock); + } + ++#ifdef CONFIG_INFINIBAND_ON_DEMAND_PAGING ++#define MLX5_MAX_ASYNC_EQS 4 ++#else ++#define MLX5_MAX_ASYNC_EQS 3 ++#endif ++ + int mlx5_eq_table_create(struct mlx5_core_dev *dev) + { + struct mlx5_eq_table *eq_table = dev->priv.eq_table; ++ int num_eqs = MLX5_CAP_GEN(dev, max_num_eqs) ? ++ MLX5_CAP_GEN(dev, max_num_eqs) : ++ 1 << MLX5_CAP_GEN(dev, log_max_eq); + int err; + + eq_table->num_comp_eqs = +- mlx5_irq_get_num_comp(eq_table->irq_table); ++ min_t(int, ++ mlx5_irq_get_num_comp(eq_table->irq_table), ++ num_eqs - MLX5_MAX_ASYNC_EQS); + + err = create_async_eqs(dev); + if (err) { +-- +2.30.2 + diff --git a/queue-5.11/net-mlx5-fix-hw-spec-violation-configuring-uplink.patch b/queue-5.11/net-mlx5-fix-hw-spec-violation-configuring-uplink.patch new file mode 100644 index 00000000000..c77f0a5d2d8 --- /dev/null +++ b/queue-5.11/net-mlx5-fix-hw-spec-violation-configuring-uplink.patch @@ -0,0 +1,42 @@ +From 9a30d5cbd84951be40869d2f6ad49521a0e6ef63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 09:46:09 +0200 +Subject: net/mlx5: Fix HW spec violation configuring uplink + +From: Eli Cohen + +[ Upstream commit 1a73704c82ed4ee95532ac04645d02075bd1ce3d ] + +Make sure to modify uplink port to follow only if the uplink_follow +capability is set as required by the HW spec. Failure to do so causes +traffic to the uplink representor net device to cease after switching to +switchdev mode. + +Fixes: 7d0314b11cdd ("net/mlx5e: Modify uplink state on interface up/down") +Signed-off-by: Eli Cohen +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index f0ceae65f6cf..8afbb485197e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -1103,8 +1103,9 @@ static void mlx5e_uplink_rep_enable(struct mlx5e_priv *priv) + + mlx5e_rep_tc_enable(priv); + +- mlx5_modify_vport_admin_state(mdev, MLX5_VPORT_STATE_OP_MOD_UPLINK, +- 0, 0, MLX5_VPORT_ADMIN_STATE_AUTO); ++ if (MLX5_CAP_GEN(mdev, uplink_follow)) ++ mlx5_modify_vport_admin_state(mdev, MLX5_VPORT_STATE_OP_MOD_UPLINK, ++ 0, 0, MLX5_VPORT_ADMIN_STATE_AUTO); + mlx5_lag_add(mdev, netdev); + priv->events_nb.notifier_call = uplink_rep_async_event; + mlx5_notifier_register(mdev, &priv->events_nb); +-- +2.30.2 + diff --git a/queue-5.11/net-mlx5-fix-pbmc-register-mapping.patch b/queue-5.11/net-mlx5-fix-pbmc-register-mapping.patch new file mode 100644 index 00000000000..9e127602b70 --- /dev/null +++ b/queue-5.11/net-mlx5-fix-pbmc-register-mapping.patch @@ -0,0 +1,37 @@ +From c30e55f0357af897f6027cd1aeca0b4338db2ec8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 12:55:00 +0300 +Subject: net/mlx5: Fix PBMC register mapping + +From: Aya Levin + +[ Upstream commit 534b1204ca4694db1093b15cf3e79a99fcb6a6da ] + +Add reserved mapping to cover all the register in order to avoid setting +arbitrary values to newer FW which implements the reserved fields. + +Fixes: 50b4a3c23646 ("net/mlx5: PPTB and PBMC register firmware command support") +Signed-off-by: Aya Levin +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + include/linux/mlx5/mlx5_ifc.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index 443dda54d851..6370ba10f1fd 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -10108,7 +10108,7 @@ struct mlx5_ifc_pbmc_reg_bits { + + struct mlx5_ifc_bufferx_reg_bits buffer[10]; + +- u8 reserved_at_2e0[0x40]; ++ u8 reserved_at_2e0[0x80]; + }; + + struct mlx5_ifc_qtct_reg_bits { +-- +2.30.2 + diff --git a/queue-5.11/net-mlx5-fix-placement-of-log_max_flow_counter.patch b/queue-5.11/net-mlx5-fix-placement-of-log_max_flow_counter.patch new file mode 100644 index 00000000000..3ad4856703e --- /dev/null +++ b/queue-5.11/net-mlx5-fix-placement-of-log_max_flow_counter.patch @@ -0,0 +1,44 @@ +From 9ab5f8d759fb938e645d27ca6d5c468d773b1ea5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 16:01:37 +0200 +Subject: net/mlx5: Fix placement of log_max_flow_counter + +From: Raed Salem + +[ Upstream commit a14587dfc5ad2312dabdd42a610d80ecd0dc8bea ] + +The cited commit wrongly placed log_max_flow_counter field of +mlx5_ifc_flow_table_prop_layout_bits, align it to the HW spec intended +placement. + +Fixes: 16f1c5bb3ed7 ("net/mlx5: Check device capability for maximum flow counters") +Signed-off-by: Raed Salem +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + include/linux/mlx5/mlx5_ifc.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index 442c0160caab..def58d333357 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -437,11 +437,11 @@ struct mlx5_ifc_flow_table_prop_layout_bits { + u8 reserved_at_60[0x18]; + u8 log_max_ft_num[0x8]; + +- u8 reserved_at_80[0x18]; ++ u8 reserved_at_80[0x10]; ++ u8 log_max_flow_counter[0x8]; + u8 log_max_destination[0x8]; + +- u8 log_max_flow_counter[0x8]; +- u8 reserved_at_a8[0x10]; ++ u8 reserved_at_a0[0x18]; + u8 log_max_flow[0x8]; + + u8 reserved_at_c0[0x40]; +-- +2.30.2 + diff --git a/queue-5.11/net-mlx5-fix-pplm-register-mapping.patch b/queue-5.11/net-mlx5-fix-pplm-register-mapping.patch new file mode 100644 index 00000000000..fdcb37f2dd2 --- /dev/null +++ b/queue-5.11/net-mlx5-fix-pplm-register-mapping.patch @@ -0,0 +1,38 @@ +From 1fc9b71b9fd902e2c060b03c917bb6a6eca35934 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 10:50:50 +0300 +Subject: net/mlx5: Fix PPLM register mapping + +From: Aya Levin + +[ Upstream commit ce28f0fd670ddffcd564ce7119bdefbaf08f02d3 ] + +Add reserved mapping to cover all the register in order to avoid +setting arbitrary values to newer FW which implements the reserved +fields. + +Fixes: a58837f52d43 ("net/mlx5e: Expose FEC feilds and related capability bit") +Signed-off-by: Aya Levin +Reviewed-by: Moshe Shemesh +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + include/linux/mlx5/mlx5_ifc.h | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index def58d333357..443dda54d851 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -8769,6 +8769,8 @@ struct mlx5_ifc_pplm_reg_bits { + + u8 fec_override_admin_100g_2x[0x10]; + u8 fec_override_admin_50g_1x[0x10]; ++ ++ u8 reserved_at_140[0x140]; + }; + + struct mlx5_ifc_ppcnt_reg_bits { +-- +2.30.2 + diff --git a/queue-5.11/net-mlx5e-fix-ethtool-indication-of-connector-type.patch b/queue-5.11/net-mlx5e-fix-ethtool-indication-of-connector-type.patch new file mode 100644 index 00000000000..16c7b6a3f71 --- /dev/null +++ b/queue-5.11/net-mlx5e-fix-ethtool-indication-of-connector-type.patch @@ -0,0 +1,73 @@ +From 95fa49afaddc6a700aeda18fc37eadf71208539e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Mar 2021 12:25:06 +0200 +Subject: net/mlx5e: Fix ethtool indication of connector type + +From: Aya Levin + +[ Upstream commit 3211434dfe7a66fcf55e43961ea524b78336c04c ] + +Use connector_type read from PTYS register when it's valid, based on +corresponding capability bit. + +Fixes: 5b4793f81745 ("net/mlx5e: Add support for reading connector type from PTYS") +Signed-off-by: Aya Levin +Reviewed-by: Eran Ben Elisha +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/en_ethtool.c | 22 +++++++++---------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +index c9d01e705ab2..d3d532fdf04e 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +@@ -747,11 +747,11 @@ static int get_fec_supported_advertised(struct mlx5_core_dev *dev, + return 0; + } + +-static void ptys2ethtool_supported_advertised_port(struct ethtool_link_ksettings *link_ksettings, +- u32 eth_proto_cap, +- u8 connector_type, bool ext) ++static void ptys2ethtool_supported_advertised_port(struct mlx5_core_dev *mdev, ++ struct ethtool_link_ksettings *link_ksettings, ++ u32 eth_proto_cap, u8 connector_type) + { +- if ((!connector_type && !ext) || connector_type >= MLX5E_CONNECTOR_TYPE_NUMBER) { ++ if (!MLX5_CAP_PCAM_FEATURE(mdev, ptys_connector_type)) { + if (eth_proto_cap & (MLX5E_PROT_MASK(MLX5E_10GBASE_CR) + | MLX5E_PROT_MASK(MLX5E_10GBASE_SR) + | MLX5E_PROT_MASK(MLX5E_40GBASE_CR4) +@@ -887,9 +887,9 @@ static int ptys2connector_type[MLX5E_CONNECTOR_TYPE_NUMBER] = { + [MLX5E_PORT_OTHER] = PORT_OTHER, + }; + +-static u8 get_connector_port(u32 eth_proto, u8 connector_type, bool ext) ++static u8 get_connector_port(struct mlx5_core_dev *mdev, u32 eth_proto, u8 connector_type) + { +- if ((connector_type || ext) && connector_type < MLX5E_CONNECTOR_TYPE_NUMBER) ++ if (MLX5_CAP_PCAM_FEATURE(mdev, ptys_connector_type)) + return ptys2connector_type[connector_type]; + + if (eth_proto & +@@ -990,11 +990,11 @@ int mlx5e_ethtool_get_link_ksettings(struct mlx5e_priv *priv, + data_rate_oper, link_ksettings); + + eth_proto_oper = eth_proto_oper ? eth_proto_oper : eth_proto_cap; +- +- link_ksettings->base.port = get_connector_port(eth_proto_oper, +- connector_type, ext); +- ptys2ethtool_supported_advertised_port(link_ksettings, eth_proto_admin, +- connector_type, ext); ++ connector_type = connector_type < MLX5E_CONNECTOR_TYPE_NUMBER ? ++ connector_type : MLX5E_PORT_UNKNOWN; ++ link_ksettings->base.port = get_connector_port(mdev, eth_proto_oper, connector_type); ++ ptys2ethtool_supported_advertised_port(mdev, link_ksettings, eth_proto_admin, ++ connector_type); + get_lp_advertising(mdev, eth_proto_lp, link_ksettings); + + if (an_status == MLX5_AN_COMPLETE) +-- +2.30.2 + diff --git a/queue-5.11/net-mlx5e-fix-mapping-of-ct_label-zero.patch b/queue-5.11/net-mlx5e-fix-mapping-of-ct_label-zero.patch new file mode 100644 index 00000000000..15083ce8b53 --- /dev/null +++ b/queue-5.11/net-mlx5e-fix-mapping-of-ct_label-zero.patch @@ -0,0 +1,130 @@ +From f9fb82f19c848d6e14dc42058ebffca5ad64ec81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Mar 2021 01:29:01 +0200 +Subject: net/mlx5e: Fix mapping of ct_label zero + +From: Ariel Levkovich + +[ Upstream commit d24f847e54214049814b9515771622eaab3f42ab ] + +ct_label 0 is a default label each flow has and therefore +there can be rules that match on ct_label=0 without a prior +rule that set the ct_label to this value. + +The ct_label value is not used directly in the HW rules and +instead it is mapped to some id within a defined range and this +id is used to set and match the metadata register which carries +the ct_label. + +If we have a rule that matches on ct_label=0, the hw rule will +perform matching on a value that is != 0 because of the mapping +from label to id. Since the metadata register default value is +0 and it was never set before to anything else by an action that +sets the ct_label, there will always be a mismatch between that +register and the value in the rule. + +To support such rule, a forced mapping of ct_label 0 to id=0 +is done so that it will match the metadata register default +value of 0. + +Fixes: 54b154ecfb8c ("net/mlx5e: CT: Map 128 bits labels to 32 bit map ID") +Signed-off-by: Ariel Levkovich +Reviewed-by: Roi Dayan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + .../ethernet/mellanox/mlx5/core/en/tc_ct.c | 36 +++++++++++++++---- + 1 file changed, 29 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +index b42396df3111..0469f53dfb99 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c +@@ -184,6 +184,28 @@ mlx5_tc_ct_entry_has_nat(struct mlx5_ct_entry *entry) + return !!(entry->tuple_nat_node.next); + } + ++static int ++mlx5_get_label_mapping(struct mlx5_tc_ct_priv *ct_priv, ++ u32 *labels, u32 *id) ++{ ++ if (!memchr_inv(labels, 0, sizeof(u32) * 4)) { ++ *id = 0; ++ return 0; ++ } ++ ++ if (mapping_add(ct_priv->labels_mapping, labels, id)) ++ return -EOPNOTSUPP; ++ ++ return 0; ++} ++ ++static void ++mlx5_put_label_mapping(struct mlx5_tc_ct_priv *ct_priv, u32 id) ++{ ++ if (id) ++ mapping_remove(ct_priv->labels_mapping, id); ++} ++ + static int + mlx5_tc_ct_rule_to_tuple(struct mlx5_ct_tuple *tuple, struct flow_rule *rule) + { +@@ -435,7 +457,7 @@ mlx5_tc_ct_entry_del_rule(struct mlx5_tc_ct_priv *ct_priv, + mlx5_tc_rule_delete(netdev_priv(ct_priv->netdev), zone_rule->rule, attr); + mlx5e_mod_hdr_detach(ct_priv->dev, + ct_priv->mod_hdr_tbl, zone_rule->mh); +- mapping_remove(ct_priv->labels_mapping, attr->ct_attr.ct_labels_id); ++ mlx5_put_label_mapping(ct_priv, attr->ct_attr.ct_labels_id); + kfree(attr); + } + +@@ -638,8 +660,8 @@ mlx5_tc_ct_entry_create_mod_hdr(struct mlx5_tc_ct_priv *ct_priv, + if (!meta) + return -EOPNOTSUPP; + +- err = mapping_add(ct_priv->labels_mapping, meta->ct_metadata.labels, +- &attr->ct_attr.ct_labels_id); ++ err = mlx5_get_label_mapping(ct_priv, meta->ct_metadata.labels, ++ &attr->ct_attr.ct_labels_id); + if (err) + return -EOPNOTSUPP; + if (nat) { +@@ -675,7 +697,7 @@ mlx5_tc_ct_entry_create_mod_hdr(struct mlx5_tc_ct_priv *ct_priv, + + err_mapping: + dealloc_mod_hdr_actions(&mod_acts); +- mapping_remove(ct_priv->labels_mapping, attr->ct_attr.ct_labels_id); ++ mlx5_put_label_mapping(ct_priv, attr->ct_attr.ct_labels_id); + return err; + } + +@@ -743,7 +765,7 @@ mlx5_tc_ct_entry_add_rule(struct mlx5_tc_ct_priv *ct_priv, + err_rule: + mlx5e_mod_hdr_detach(ct_priv->dev, + ct_priv->mod_hdr_tbl, zone_rule->mh); +- mapping_remove(ct_priv->labels_mapping, attr->ct_attr.ct_labels_id); ++ mlx5_put_label_mapping(ct_priv, attr->ct_attr.ct_labels_id); + err_mod_hdr: + kfree(attr); + err_attr: +@@ -1198,7 +1220,7 @@ void mlx5_tc_ct_match_del(struct mlx5_tc_ct_priv *priv, struct mlx5_ct_attr *ct_ + if (!priv || !ct_attr->ct_labels_id) + return; + +- mapping_remove(priv->labels_mapping, ct_attr->ct_labels_id); ++ mlx5_put_label_mapping(priv, ct_attr->ct_labels_id); + } + + int +@@ -1276,7 +1298,7 @@ mlx5_tc_ct_match_add(struct mlx5_tc_ct_priv *priv, + ct_labels[1] = key->ct_labels[1] & mask->ct_labels[1]; + ct_labels[2] = key->ct_labels[2] & mask->ct_labels[2]; + ct_labels[3] = key->ct_labels[3] & mask->ct_labels[3]; +- if (mapping_add(priv->labels_mapping, ct_labels, &ct_attr->ct_labels_id)) ++ if (mlx5_get_label_mapping(priv, ct_labels, &ct_attr->ct_labels_id)) + return -EOPNOTSUPP; + mlx5e_tc_match_to_reg_match(spec, LABELS_TO_REG, ct_attr->ct_labels_id, + MLX5_CT_LABELS_MASK); +-- +2.30.2 + diff --git a/queue-5.11/net-mlx5e-guarantee-room-for-xsk-wakeup-nop-on-async.patch b/queue-5.11/net-mlx5e-guarantee-room-for-xsk-wakeup-nop-on-async.patch new file mode 100644 index 00000000000..b3480c33cea --- /dev/null +++ b/queue-5.11/net-mlx5e-guarantee-room-for-xsk-wakeup-nop-on-async.patch @@ -0,0 +1,169 @@ +From a62c5ce9c13cc524930a7c7adf32556ac95a3f38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Feb 2021 14:58:01 +0200 +Subject: net/mlx5e: Guarantee room for XSK wakeup NOP on async ICOSQ + +From: Tariq Toukan + +[ Upstream commit 3ff3874fa0b261ef74f2bfb008a82ab1601c11eb ] + +XSK wakeup flow triggers an IRQ by posting a NOP WQE and hitting +the doorbell on the async ICOSQ. +It maintains its state so that it doesn't issue another NOP WQE +if it has an outstanding one already. + +For this flow to work properly, the NOP post must not fail. +Make sure to reserve room for the NOP WQE in all WQE posts to the +async ICOSQ. + +Fixes: 8d94b590f1e4 ("net/mlx5e: Turn XSK ICOSQ into a general asynchronous one") +Fixes: 1182f3659357 ("net/mlx5e: kTLS, Add kTLS RX HW offload support") +Fixes: 0419d8c9d8f8 ("net/mlx5e: kTLS, Add kTLS RX resync support") +Signed-off-by: Tariq Toukan +Reviewed-by: Maxim Mikityanskiy +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + + .../net/ethernet/mellanox/mlx5/core/en/txrx.h | 6 ++++++ + .../mellanox/mlx5/core/en_accel/ktls_rx.c | 18 +++++++--------- + .../net/ethernet/mellanox/mlx5/core/en_main.c | 21 ++++++++++++++++++- + 4 files changed, 34 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index f258f2f9b8cf..9061a30a93bc 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -510,6 +510,7 @@ struct mlx5e_icosq { + struct mlx5_wq_cyc wq; + void __iomem *uar_map; + u32 sqn; ++ u16 reserved_room; + unsigned long state; + + /* control path */ +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +index 4880f2179273..05d673e5289d 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h +@@ -434,4 +434,10 @@ static inline u16 mlx5e_stop_room_for_wqe(u16 wqe_size) + return wqe_size * 2 - 1; + } + ++static inline bool mlx5e_icosq_can_post_wqe(struct mlx5e_icosq *sq, u16 wqe_size) ++{ ++ u16 room = sq->reserved_room + mlx5e_stop_room_for_wqe(wqe_size); ++ ++ return mlx5e_wqc_has_room_for(&sq->wq, sq->cc, sq->pc, room); ++} + #endif +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +index d06532d0baa4..c0bd4e55ed8c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ktls_rx.c +@@ -137,11 +137,10 @@ post_static_params(struct mlx5e_icosq *sq, + { + struct mlx5e_set_tls_static_params_wqe *wqe; + struct mlx5e_icosq_wqe_info wi; +- u16 pi, num_wqebbs, room; ++ u16 pi, num_wqebbs; + + num_wqebbs = MLX5E_TLS_SET_STATIC_PARAMS_WQEBBS; +- room = mlx5e_stop_room_for_wqe(num_wqebbs); +- if (unlikely(!mlx5e_wqc_has_room_for(&sq->wq, sq->cc, sq->pc, room))) ++ if (unlikely(!mlx5e_icosq_can_post_wqe(sq, num_wqebbs))) + return ERR_PTR(-ENOSPC); + + pi = mlx5e_icosq_get_next_pi(sq, num_wqebbs); +@@ -168,11 +167,10 @@ post_progress_params(struct mlx5e_icosq *sq, + { + struct mlx5e_set_tls_progress_params_wqe *wqe; + struct mlx5e_icosq_wqe_info wi; +- u16 pi, num_wqebbs, room; ++ u16 pi, num_wqebbs; + + num_wqebbs = MLX5E_TLS_SET_PROGRESS_PARAMS_WQEBBS; +- room = mlx5e_stop_room_for_wqe(num_wqebbs); +- if (unlikely(!mlx5e_wqc_has_room_for(&sq->wq, sq->cc, sq->pc, room))) ++ if (unlikely(!mlx5e_icosq_can_post_wqe(sq, num_wqebbs))) + return ERR_PTR(-ENOSPC); + + pi = mlx5e_icosq_get_next_pi(sq, num_wqebbs); +@@ -277,17 +275,15 @@ resync_post_get_progress_params(struct mlx5e_icosq *sq, + + buf->priv_rx = priv_rx; + +- BUILD_BUG_ON(MLX5E_KTLS_GET_PROGRESS_WQEBBS != 1); +- + spin_lock_bh(&sq->channel->async_icosq_lock); + +- if (unlikely(!mlx5e_wqc_has_room_for(&sq->wq, sq->cc, sq->pc, 1))) { ++ if (unlikely(!mlx5e_icosq_can_post_wqe(sq, MLX5E_KTLS_GET_PROGRESS_WQEBBS))) { + spin_unlock_bh(&sq->channel->async_icosq_lock); + err = -ENOSPC; + goto err_dma_unmap; + } + +- pi = mlx5e_icosq_get_next_pi(sq, 1); ++ pi = mlx5e_icosq_get_next_pi(sq, MLX5E_KTLS_GET_PROGRESS_WQEBBS); + wqe = MLX5E_TLS_FETCH_GET_PROGRESS_PARAMS_WQE(sq, pi); + + #define GET_PSV_DS_CNT (DIV_ROUND_UP(sizeof(*wqe), MLX5_SEND_WQE_DS)) +@@ -307,7 +303,7 @@ resync_post_get_progress_params(struct mlx5e_icosq *sq, + + wi = (struct mlx5e_icosq_wqe_info) { + .wqe_type = MLX5E_ICOSQ_WQE_GET_PSV_TLS, +- .num_wqebbs = 1, ++ .num_wqebbs = MLX5E_KTLS_GET_PROGRESS_WQEBBS, + .tls_get_params.buf = buf, + }; + icosq_fill_wi(sq, pi, &wi); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index b6324d11a008..7bb189e65628 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -1058,6 +1058,7 @@ static int mlx5e_alloc_icosq(struct mlx5e_channel *c, + + sq->channel = c; + sq->uar_map = mdev->mlx5e_res.bfreg.map; ++ sq->reserved_room = param->stop_room; + + param->wq.db_numa_node = cpu_to_node(c->cpu); + err = mlx5_wq_cyc_create(mdev, ¶m->wq, sqc_wq, wq, &sq->wq_ctrl); +@@ -2299,6 +2300,24 @@ void mlx5e_build_icosq_param(struct mlx5e_priv *priv, + mlx5e_build_ico_cq_param(priv, log_wq_size, ¶m->cqp); + } + ++static void mlx5e_build_async_icosq_param(struct mlx5e_priv *priv, ++ struct mlx5e_params *params, ++ u8 log_wq_size, ++ struct mlx5e_sq_param *param) ++{ ++ void *sqc = param->sqc; ++ void *wq = MLX5_ADDR_OF(sqc, sqc, wq); ++ ++ mlx5e_build_sq_param_common(priv, param); ++ ++ /* async_icosq is used by XSK only if xdp_prog is active */ ++ if (params->xdp_prog) ++ param->stop_room = mlx5e_stop_room_for_wqe(1); /* for XSK NOP */ ++ MLX5_SET(sqc, sqc, reg_umr, MLX5_CAP_ETH(priv->mdev, reg_umr_sq)); ++ MLX5_SET(wq, wq, log_wq_sz, log_wq_size); ++ mlx5e_build_ico_cq_param(priv, log_wq_size, ¶m->cqp); ++} ++ + void mlx5e_build_xdpsq_param(struct mlx5e_priv *priv, + struct mlx5e_params *params, + struct mlx5e_sq_param *param) +@@ -2347,7 +2366,7 @@ static void mlx5e_build_channel_param(struct mlx5e_priv *priv, + mlx5e_build_sq_param(priv, params, &cparam->txq_sq); + mlx5e_build_xdpsq_param(priv, params, &cparam->xdp_sq); + mlx5e_build_icosq_param(priv, icosq_log_wq_sz, &cparam->icosq); +- mlx5e_build_icosq_param(priv, async_icosq_log_wq_sz, &cparam->async_icosq); ++ mlx5e_build_async_icosq_param(priv, params, async_icosq_log_wq_sz, &cparam->async_icosq); + } + + int mlx5e_open_channels(struct mlx5e_priv *priv, +-- +2.30.2 + diff --git a/queue-5.11/net-ncsi-avoid-channel_monitor-hrtimer-deadlock.patch b/queue-5.11/net-ncsi-avoid-channel_monitor-hrtimer-deadlock.patch new file mode 100644 index 00000000000..217f95ea123 --- /dev/null +++ b/queue-5.11/net-ncsi-avoid-channel_monitor-hrtimer-deadlock.patch @@ -0,0 +1,76 @@ +From 275003f70ce53886d51130abd58f6b6bae0b9d4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 10:20:39 -0500 +Subject: net/ncsi: Avoid channel_monitor hrtimer deadlock + +From: Milton Miller + +[ Upstream commit 03cb4d05b4ea9a3491674ca40952adb708d549fa ] + +Calling ncsi_stop_channel_monitor from channel_monitor is a guaranteed +deadlock on SMP because stop calls del_timer_sync on the timer that +invoked channel_monitor as its timer function. + +Recognise the inherent race of marking the monitor disabled before +deleting the timer by just returning if enable was cleared. After +a timeout (the default case -- reset to START when response received) +just mark the monitor.enabled false. + +If the channel has an entry on the channel_queue list, or if the +state is not ACTIVE or INACTIVE, then warn and mark the timer stopped +and don't restart, as the locking is broken somehow. + +Fixes: 0795fb2021f0 ("net/ncsi: Stop monitor if channel times out or is inactive") +Signed-off-by: Milton Miller +Signed-off-by: Eddie James +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ncsi/ncsi-manage.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/net/ncsi/ncsi-manage.c b/net/ncsi/ncsi-manage.c +index a9cb355324d1..ffff8da707b8 100644 +--- a/net/ncsi/ncsi-manage.c ++++ b/net/ncsi/ncsi-manage.c +@@ -105,13 +105,20 @@ static void ncsi_channel_monitor(struct timer_list *t) + monitor_state = nc->monitor.state; + spin_unlock_irqrestore(&nc->lock, flags); + +- if (!enabled || chained) { +- ncsi_stop_channel_monitor(nc); +- return; +- } ++ if (!enabled) ++ return; /* expected race disabling timer */ ++ if (WARN_ON_ONCE(chained)) ++ goto bad_state; ++ + if (state != NCSI_CHANNEL_INACTIVE && + state != NCSI_CHANNEL_ACTIVE) { +- ncsi_stop_channel_monitor(nc); ++bad_state: ++ netdev_warn(ndp->ndev.dev, ++ "Bad NCSI monitor state channel %d 0x%x %s queue\n", ++ nc->id, state, chained ? "on" : "off"); ++ spin_lock_irqsave(&nc->lock, flags); ++ nc->monitor.enabled = false; ++ spin_unlock_irqrestore(&nc->lock, flags); + return; + } + +@@ -136,10 +143,9 @@ static void ncsi_channel_monitor(struct timer_list *t) + ncsi_report_link(ndp, true); + ndp->flags |= NCSI_DEV_RESHUFFLE; + +- ncsi_stop_channel_monitor(nc); +- + ncm = &nc->modes[NCSI_MODE_LINK]; + spin_lock_irqsave(&nc->lock, flags); ++ nc->monitor.enabled = false; + nc->state = NCSI_CHANNEL_INVISIBLE; + ncm->data[2] &= ~0x1; + spin_unlock_irqrestore(&nc->lock, flags); +-- +2.30.2 + diff --git a/queue-5.11/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch b/queue-5.11/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch new file mode 100644 index 00000000000..4a8ceaf4af1 --- /dev/null +++ b/queue-5.11/net-phy-broadcom-only-advertise-eee-for-supported-mo.patch @@ -0,0 +1,56 @@ +From 8cfc9198d2c5f7ac5158235f86a1cc88cc94857d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 15:00:24 -0700 +Subject: net: phy: broadcom: Only advertise EEE for supported modes + +From: Florian Fainelli + +[ Upstream commit c056d480b40a68f2520ccc156c7fae672d69d57d ] + +We should not be advertising EEE for modes that we do not support, +correct that oversight by looking at the PHY device supported linkmodes. + +Fixes: 99cec8a4dda2 ("net: phy: broadcom: Allow enabling or disabling of EEE") +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/bcm-phy-lib.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c +index 53282a6d5928..287cccf8f7f4 100644 +--- a/drivers/net/phy/bcm-phy-lib.c ++++ b/drivers/net/phy/bcm-phy-lib.c +@@ -369,7 +369,7 @@ EXPORT_SYMBOL_GPL(bcm_phy_enable_apd); + + int bcm_phy_set_eee(struct phy_device *phydev, bool enable) + { +- int val; ++ int val, mask = 0; + + /* Enable EEE at PHY level */ + val = phy_read_mmd(phydev, MDIO_MMD_AN, BRCM_CL45VEN_EEE_CONTROL); +@@ -388,10 +388,17 @@ int bcm_phy_set_eee(struct phy_device *phydev, bool enable) + if (val < 0) + return val; + ++ if (linkmode_test_bit(ETHTOOL_LINK_MODE_1000baseT_Full_BIT, ++ phydev->supported)) ++ mask |= MDIO_EEE_1000T; ++ if (linkmode_test_bit(ETHTOOL_LINK_MODE_100baseT_Full_BIT, ++ phydev->supported)) ++ mask |= MDIO_EEE_100TX; ++ + if (enable) +- val |= (MDIO_EEE_100TX | MDIO_EEE_1000T); ++ val |= mask; + else +- val &= ~(MDIO_EEE_100TX | MDIO_EEE_1000T); ++ val &= ~mask; + + phy_write_mmd(phydev, MDIO_MMD_AN, BCM_CL45VEN_EEE_ADV, (u32)val); + +-- +2.30.2 + diff --git a/queue-5.11/net-qrtr-fix-memory-leak-on-qrtr_tx_wait-failure.patch b/queue-5.11/net-qrtr-fix-memory-leak-on-qrtr_tx_wait-failure.patch new file mode 100644 index 00000000000..93839dd2a61 --- /dev/null +++ b/queue-5.11/net-qrtr-fix-memory-leak-on-qrtr_tx_wait-failure.patch @@ -0,0 +1,43 @@ +From 4464105121fcde000d7a8b5bfe9c9361f4dd8ccf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 16:11:08 +0200 +Subject: net: qrtr: Fix memory leak on qrtr_tx_wait failure + +From: Loic Poulain + +[ Upstream commit 8a03dd925786bdc3834d56ccc980bb70668efa35 ] + +qrtr_tx_wait does not check for radix_tree_insert failure, causing +the 'flow' object to be unreferenced after qrtr_tx_wait return. Fix +that by releasing flow on radix_tree_insert failure. + +Fixes: 5fdeb0d372ab ("net: qrtr: Implement outgoing flow control") +Reported-by: syzbot+739016799a89c530b32a@syzkaller.appspotmail.com +Signed-off-by: Loic Poulain +Reviewed-by: Bjorn Andersson +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/qrtr.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c +index dfc820ee553a..1e4fb568fa84 100644 +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -271,7 +271,10 @@ static int qrtr_tx_wait(struct qrtr_node *node, int dest_node, int dest_port, + flow = kzalloc(sizeof(*flow), GFP_KERNEL); + if (flow) { + init_waitqueue_head(&flow->resume_tx); +- radix_tree_insert(&node->qrtr_tx_flow, key, flow); ++ if (radix_tree_insert(&node->qrtr_tx_flow, key, flow)) { ++ kfree(flow); ++ flow = NULL; ++ } + } + } + mutex_unlock(&node->qrtr_tx_lock); +-- +2.30.2 + diff --git a/queue-5.11/net-rds-fix-a-use-after-free-in-rds_message_map_page.patch b/queue-5.11/net-rds-fix-a-use-after-free-in-rds_message_map_page.patch new file mode 100644 index 00000000000..87f30eac653 --- /dev/null +++ b/queue-5.11/net-rds-fix-a-use-after-free-in-rds_message_map_page.patch @@ -0,0 +1,45 @@ +From 0cb794ff289213197c98fdb2edf916be9d8f92f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 18:59:59 -0700 +Subject: net/rds: Fix a use after free in rds_message_map_pages +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lv Yunlong + +[ Upstream commit bdc2ab5c61a5c07388f4820ff21e787b4dfd1ced ] + +In rds_message_map_pages, the rm is freed by rds_message_put(rm). +But rm is still used by rm->data.op_sg in return value. + +My patch assigns ERR_CAST(rm->data.op_sg) to err before the rm is +freed to avoid the uaf. + +Fixes: 7dba92037baf3 ("net/rds: Use ERR_PTR for rds_message_alloc_sgs()") +Signed-off-by: Lv Yunlong +Reviewed-by: HÃ¥kon Bugge +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rds/message.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/rds/message.c b/net/rds/message.c +index 071a261fdaab..799034e0f513 100644 +--- a/net/rds/message.c ++++ b/net/rds/message.c +@@ -347,8 +347,9 @@ struct rds_message *rds_message_map_pages(unsigned long *page_addrs, unsigned in + rm->data.op_nents = DIV_ROUND_UP(total_len, PAGE_SIZE); + rm->data.op_sg = rds_message_alloc_sgs(rm, num_sgs); + if (IS_ERR(rm->data.op_sg)) { ++ void *err = ERR_CAST(rm->data.op_sg); + rds_message_put(rm); +- return ERR_CAST(rm->data.op_sg); ++ return err; + } + + for (i = 0; i < rm->data.op_nents; ++i) { +-- +2.30.2 + diff --git a/queue-5.11/net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch b/queue-5.11/net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch new file mode 100644 index 00000000000..f0791453f22 --- /dev/null +++ b/queue-5.11/net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch @@ -0,0 +1,44 @@ +From ad0b57b16f883dfebf8679446581a61020f58799 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Mar 2021 00:30:29 -0700 +Subject: net:tipc: Fix a double free in tipc_sk_mcast_rcv + +From: Lv Yunlong + +[ Upstream commit 6bf24dc0cc0cc43b29ba344b66d78590e687e046 ] + +In the if(skb_peek(arrvq) == skb) branch, it calls __skb_dequeue(arrvq) to get +the skb by skb = skb_peek(arrvq). Then __skb_dequeue() unlinks the skb from arrvq +and returns the skb which equals to skb_peek(arrvq). After __skb_dequeue(arrvq) +finished, the skb is freed by kfree_skb(__skb_dequeue(arrvq)) in the first time. + +Unfortunately, the same skb is freed in the second time by kfree_skb(skb) after +the branch completed. + +My patch removes kfree_skb() in the if(skb_peek(arrvq) == skb) branch, because +this skb will be freed by kfree_skb(skb) finally. + +Fixes: cb1b728096f54 ("tipc: eliminate race condition at multicast reception") +Signed-off-by: Lv Yunlong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/socket.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index cebcc104dc70..022999e0202d 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -1265,7 +1265,7 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq, + spin_lock_bh(&inputq->lock); + if (skb_peek(arrvq) == skb) { + skb_queue_splice_tail_init(&tmpq, inputq); +- kfree_skb(__skb_dequeue(arrvq)); ++ __skb_dequeue(arrvq); + } + spin_unlock_bh(&inputq->lock); + __skb_queue_purge(&tmpq); +-- +2.30.2 + diff --git a/queue-5.11/net-udp-add-support-for-getsockopt-.-.-udp_gro.patch b/queue-5.11/net-udp-add-support-for-getsockopt-.-.-udp_gro.patch new file mode 100644 index 00000000000..12ab4eadb34 --- /dev/null +++ b/queue-5.11/net-udp-add-support-for-getsockopt-.-.-udp_gro.patch @@ -0,0 +1,41 @@ +From 45306bcd4a749ff4aaae9356db943f513c9b2829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 08:59:17 +0200 +Subject: net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...); + +From: Norman Maurer + +[ Upstream commit 98184612aca0a9ee42b8eb0262a49900ee9eef0d ] + +Support for UDP_GRO was added in the past but the implementation for +getsockopt was missed which did lead to an error when we tried to +retrieve the setting for UDP_GRO. This patch adds the missing switch +case for UDP_GRO + +Fixes: e20cf8d3f1f7 ("udp: implement GRO for plain UDP sockets.") +Signed-off-by: Norman Maurer +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/udp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 69ea76578abb..9d2a1a247cec 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -2749,6 +2749,10 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname, + val = up->gso_size; + break; + ++ case UDP_GRO: ++ val = up->gro_enabled; ++ break; ++ + /* The following two cannot be changed on UDP sockets, the return is + * always 0 (which corresponds to the full checksum coverage of UDP). */ + case UDPLITE_SEND_CSCOV: +-- +2.30.2 + diff --git a/queue-5.11/net-xfrm-localize-sequence-counter-per-network-names.patch b/queue-5.11/net-xfrm-localize-sequence-counter-per-network-names.patch new file mode 100644 index 00000000000..765f874ee7a --- /dev/null +++ b/queue-5.11/net-xfrm-localize-sequence-counter-per-network-names.patch @@ -0,0 +1,104 @@ +From 1bf81d8ffbf66eab45171820194adb69c0e1bcb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Mar 2021 11:56:29 +0100 +Subject: net: xfrm: Localize sequence counter per network namespace + +From: Ahmed S. Darwish + +[ Upstream commit e88add19f68191448427a6e4eb059664650a837f ] + +A sequence counter write section must be serialized or its internal +state can get corrupted. The "xfrm_state_hash_generation" seqcount is +global, but its write serialization lock (net->xfrm.xfrm_state_lock) is +instantiated per network namespace. The write protection is thus +insufficient. + +To provide full protection, localize the sequence counter per network +namespace instead. This should be safe as both the seqcount read and +write sections access data exclusively within the network namespace. It +also lays the foundation for transforming "xfrm_state_hash_generation" +data type from seqcount_t to seqcount_LOCKNAME_t in further commits. + +Fixes: b65e3d7be06f ("xfrm: state: add sequence count to detect hash resizes") +Signed-off-by: Ahmed S. Darwish +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + include/net/netns/xfrm.h | 4 +++- + net/xfrm/xfrm_state.c | 10 +++++----- + 2 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/include/net/netns/xfrm.h b/include/net/netns/xfrm.h +index 59f45b1e9dac..b59d73d529ba 100644 +--- a/include/net/netns/xfrm.h ++++ b/include/net/netns/xfrm.h +@@ -72,7 +72,9 @@ struct netns_xfrm { + #if IS_ENABLED(CONFIG_IPV6) + struct dst_ops xfrm6_dst_ops; + #endif +- spinlock_t xfrm_state_lock; ++ spinlock_t xfrm_state_lock; ++ seqcount_t xfrm_state_hash_generation; ++ + spinlock_t xfrm_policy_lock; + struct mutex xfrm_cfg_mutex; + }; +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index d01ca1a18418..ffd315cff984 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -44,7 +44,6 @@ static void xfrm_state_gc_task(struct work_struct *work); + */ + + static unsigned int xfrm_state_hashmax __read_mostly = 1 * 1024 * 1024; +-static __read_mostly seqcount_t xfrm_state_hash_generation = SEQCNT_ZERO(xfrm_state_hash_generation); + static struct kmem_cache *xfrm_state_cache __ro_after_init; + + static DECLARE_WORK(xfrm_state_gc_work, xfrm_state_gc_task); +@@ -140,7 +139,7 @@ static void xfrm_hash_resize(struct work_struct *work) + } + + spin_lock_bh(&net->xfrm.xfrm_state_lock); +- write_seqcount_begin(&xfrm_state_hash_generation); ++ write_seqcount_begin(&net->xfrm.xfrm_state_hash_generation); + + nhashmask = (nsize / sizeof(struct hlist_head)) - 1U; + odst = xfrm_state_deref_prot(net->xfrm.state_bydst, net); +@@ -156,7 +155,7 @@ static void xfrm_hash_resize(struct work_struct *work) + rcu_assign_pointer(net->xfrm.state_byspi, nspi); + net->xfrm.state_hmask = nhashmask; + +- write_seqcount_end(&xfrm_state_hash_generation); ++ write_seqcount_end(&net->xfrm.xfrm_state_hash_generation); + spin_unlock_bh(&net->xfrm.xfrm_state_lock); + + osize = (ohashmask + 1) * sizeof(struct hlist_head); +@@ -1063,7 +1062,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr, + + to_put = NULL; + +- sequence = read_seqcount_begin(&xfrm_state_hash_generation); ++ sequence = read_seqcount_begin(&net->xfrm.xfrm_state_hash_generation); + + rcu_read_lock(); + h = xfrm_dst_hash(net, daddr, saddr, tmpl->reqid, encap_family); +@@ -1176,7 +1175,7 @@ out: + if (to_put) + xfrm_state_put(to_put); + +- if (read_seqcount_retry(&xfrm_state_hash_generation, sequence)) { ++ if (read_seqcount_retry(&net->xfrm.xfrm_state_hash_generation, sequence)) { + *err = -EAGAIN; + if (x) { + xfrm_state_put(x); +@@ -2666,6 +2665,7 @@ int __net_init xfrm_state_init(struct net *net) + net->xfrm.state_num = 0; + INIT_WORK(&net->xfrm.state_hash_work, xfrm_hash_resize); + spin_lock_init(&net->xfrm.xfrm_state_lock); ++ seqcount_init(&net->xfrm.xfrm_state_hash_generation); + return 0; + + out_byspi: +-- +2.30.2 + diff --git a/queue-5.11/nfp-flower-ignore-duplicate-merge-hints-from-fw.patch b/queue-5.11/nfp-flower-ignore-duplicate-merge-hints-from-fw.patch new file mode 100644 index 00000000000..eb57593f107 --- /dev/null +++ b/queue-5.11/nfp-flower-ignore-duplicate-merge-hints-from-fw.patch @@ -0,0 +1,219 @@ +From 3a3146baeb9cff3f0de72b2926a94fcdf6d15faa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Mar 2021 10:30:23 +0200 +Subject: nfp: flower: ignore duplicate merge hints from FW + +From: Yinjun Zhang + +[ Upstream commit 2ea538dbee1c79f6f6c24a6f2f82986e4b7ccb78 ] + +A merge hint message needs some time to process before the merged +flow actually reaches the firmware, during which we may get duplicate +merge hints if there're more than one packet that hit the pre-merged +flow. And processing duplicate merge hints will cost extra host_ctx's +which are a limited resource. + +Avoid the duplicate merge by using hash table to store the sub_flows +to be merged. + +Fixes: 8af56f40e53b ("nfp: flower: offload merge flows") +Signed-off-by: Yinjun Zhang +Signed-off-by: Louis Peens +Signed-off-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/netronome/nfp/flower/main.h | 8 ++++ + .../ethernet/netronome/nfp/flower/metadata.c | 16 ++++++- + .../ethernet/netronome/nfp/flower/offload.c | 48 ++++++++++++++++++- + 3 files changed, 69 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/netronome/nfp/flower/main.h b/drivers/net/ethernet/netronome/nfp/flower/main.h +index caf12eec9945..56833a41f3d2 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/main.h ++++ b/drivers/net/ethernet/netronome/nfp/flower/main.h +@@ -190,6 +190,7 @@ struct nfp_fl_internal_ports { + * @qos_rate_limiters: Current active qos rate limiters + * @qos_stats_lock: Lock on qos stats updates + * @pre_tun_rule_cnt: Number of pre-tunnel rules offloaded ++ * @merge_table: Hash table to store merged flows + */ + struct nfp_flower_priv { + struct nfp_app *app; +@@ -223,6 +224,7 @@ struct nfp_flower_priv { + unsigned int qos_rate_limiters; + spinlock_t qos_stats_lock; /* Protect the qos stats */ + int pre_tun_rule_cnt; ++ struct rhashtable merge_table; + }; + + /** +@@ -350,6 +352,12 @@ struct nfp_fl_payload_link { + }; + + extern const struct rhashtable_params nfp_flower_table_params; ++extern const struct rhashtable_params merge_table_params; ++ ++struct nfp_merge_info { ++ u64 parent_ctx; ++ struct rhash_head ht_node; ++}; + + struct nfp_fl_stats_frame { + __be32 stats_con_id; +diff --git a/drivers/net/ethernet/netronome/nfp/flower/metadata.c b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +index aa06fcb38f8b..327bb56b3ef5 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/metadata.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/metadata.c +@@ -490,6 +490,12 @@ const struct rhashtable_params nfp_flower_table_params = { + .automatic_shrinking = true, + }; + ++const struct rhashtable_params merge_table_params = { ++ .key_offset = offsetof(struct nfp_merge_info, parent_ctx), ++ .head_offset = offsetof(struct nfp_merge_info, ht_node), ++ .key_len = sizeof(u64), ++}; ++ + int nfp_flower_metadata_init(struct nfp_app *app, u64 host_ctx_count, + unsigned int host_num_mems) + { +@@ -506,6 +512,10 @@ int nfp_flower_metadata_init(struct nfp_app *app, u64 host_ctx_count, + if (err) + goto err_free_flow_table; + ++ err = rhashtable_init(&priv->merge_table, &merge_table_params); ++ if (err) ++ goto err_free_stats_ctx_table; ++ + get_random_bytes(&priv->mask_id_seed, sizeof(priv->mask_id_seed)); + + /* Init ring buffer and unallocated mask_ids. */ +@@ -513,7 +523,7 @@ int nfp_flower_metadata_init(struct nfp_app *app, u64 host_ctx_count, + kmalloc_array(NFP_FLOWER_MASK_ENTRY_RS, + NFP_FLOWER_MASK_ELEMENT_RS, GFP_KERNEL); + if (!priv->mask_ids.mask_id_free_list.buf) +- goto err_free_stats_ctx_table; ++ goto err_free_merge_table; + + priv->mask_ids.init_unallocated = NFP_FLOWER_MASK_ENTRY_RS - 1; + +@@ -550,6 +560,8 @@ err_free_last_used: + kfree(priv->mask_ids.last_used); + err_free_mask_id: + kfree(priv->mask_ids.mask_id_free_list.buf); ++err_free_merge_table: ++ rhashtable_destroy(&priv->merge_table); + err_free_stats_ctx_table: + rhashtable_destroy(&priv->stats_ctx_table); + err_free_flow_table: +@@ -568,6 +580,8 @@ void nfp_flower_metadata_cleanup(struct nfp_app *app) + nfp_check_rhashtable_empty, NULL); + rhashtable_free_and_destroy(&priv->stats_ctx_table, + nfp_check_rhashtable_empty, NULL); ++ rhashtable_free_and_destroy(&priv->merge_table, ++ nfp_check_rhashtable_empty, NULL); + kvfree(priv->stats); + kfree(priv->mask_ids.mask_id_free_list.buf); + kfree(priv->mask_ids.last_used); +diff --git a/drivers/net/ethernet/netronome/nfp/flower/offload.c b/drivers/net/ethernet/netronome/nfp/flower/offload.c +index d72225d64a75..e95969c462e4 100644 +--- a/drivers/net/ethernet/netronome/nfp/flower/offload.c ++++ b/drivers/net/ethernet/netronome/nfp/flower/offload.c +@@ -1009,6 +1009,8 @@ int nfp_flower_merge_offloaded_flows(struct nfp_app *app, + struct netlink_ext_ack *extack = NULL; + struct nfp_fl_payload *merge_flow; + struct nfp_fl_key_ls merge_key_ls; ++ struct nfp_merge_info *merge_info; ++ u64 parent_ctx = 0; + int err; + + ASSERT_RTNL(); +@@ -1019,6 +1021,15 @@ int nfp_flower_merge_offloaded_flows(struct nfp_app *app, + nfp_flower_is_merge_flow(sub_flow2)) + return -EINVAL; + ++ /* check if the two flows are already merged */ ++ parent_ctx = (u64)(be32_to_cpu(sub_flow1->meta.host_ctx_id)) << 32; ++ parent_ctx |= (u64)(be32_to_cpu(sub_flow2->meta.host_ctx_id)); ++ if (rhashtable_lookup_fast(&priv->merge_table, ++ &parent_ctx, merge_table_params)) { ++ nfp_flower_cmsg_warn(app, "The two flows are already merged.\n"); ++ return 0; ++ } ++ + err = nfp_flower_can_merge(sub_flow1, sub_flow2); + if (err) + return err; +@@ -1060,16 +1071,33 @@ int nfp_flower_merge_offloaded_flows(struct nfp_app *app, + if (err) + goto err_release_metadata; + ++ merge_info = kmalloc(sizeof(*merge_info), GFP_KERNEL); ++ if (!merge_info) { ++ err = -ENOMEM; ++ goto err_remove_rhash; ++ } ++ merge_info->parent_ctx = parent_ctx; ++ err = rhashtable_insert_fast(&priv->merge_table, &merge_info->ht_node, ++ merge_table_params); ++ if (err) ++ goto err_destroy_merge_info; ++ + err = nfp_flower_xmit_flow(app, merge_flow, + NFP_FLOWER_CMSG_TYPE_FLOW_MOD); + if (err) +- goto err_remove_rhash; ++ goto err_remove_merge_info; + + merge_flow->in_hw = true; + sub_flow1->in_hw = false; + + return 0; + ++err_remove_merge_info: ++ WARN_ON_ONCE(rhashtable_remove_fast(&priv->merge_table, ++ &merge_info->ht_node, ++ merge_table_params)); ++err_destroy_merge_info: ++ kfree(merge_info); + err_remove_rhash: + WARN_ON_ONCE(rhashtable_remove_fast(&priv->flow_table, + &merge_flow->fl_node, +@@ -1359,7 +1387,9 @@ nfp_flower_remove_merge_flow(struct nfp_app *app, + { + struct nfp_flower_priv *priv = app->priv; + struct nfp_fl_payload_link *link, *temp; ++ struct nfp_merge_info *merge_info; + struct nfp_fl_payload *origin; ++ u64 parent_ctx = 0; + bool mod = false; + int err; + +@@ -1396,8 +1426,22 @@ nfp_flower_remove_merge_flow(struct nfp_app *app, + err_free_links: + /* Clean any links connected with the merged flow. */ + list_for_each_entry_safe(link, temp, &merge_flow->linked_flows, +- merge_flow.list) ++ merge_flow.list) { ++ u32 ctx_id = be32_to_cpu(link->sub_flow.flow->meta.host_ctx_id); ++ ++ parent_ctx = (parent_ctx << 32) | (u64)(ctx_id); + nfp_flower_unlink_flow(link); ++ } ++ ++ merge_info = rhashtable_lookup_fast(&priv->merge_table, ++ &parent_ctx, ++ merge_table_params); ++ if (merge_info) { ++ WARN_ON_ONCE(rhashtable_remove_fast(&priv->merge_table, ++ &merge_info->ht_node, ++ merge_table_params)); ++ kfree(merge_info); ++ } + + kfree(merge_flow->action_data); + kfree(merge_flow->mask_data); +-- +2.30.2 + diff --git a/queue-5.11/openvswitch-fix-send-of-uninitialized-stack-memory-i.patch b/queue-5.11/openvswitch-fix-send-of-uninitialized-stack-memory-i.patch new file mode 100644 index 00000000000..a17a8e96473 --- /dev/null +++ b/queue-5.11/openvswitch-fix-send-of-uninitialized-stack-memory-i.patch @@ -0,0 +1,47 @@ +From 10d59f4857ab8abdab867d981efa254952b6fa50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 19:50:31 +0200 +Subject: openvswitch: fix send of uninitialized stack memory in ct limit reply + +From: Ilya Maximets + +[ Upstream commit 4d51419d49930be2701c2633ae271b350397c3ca ] + +'struct ovs_zone_limit' has more members than initialized in +ovs_ct_limit_get_default_limit(). The rest of the memory is a random +kernel stack content that ends up being sent to userspace. + +Fix that by using designated initializer that will clear all +non-specified fields. + +Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") +Signed-off-by: Ilya Maximets +Acked-by: Tonghao Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/openvswitch/conntrack.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index 5eddfe7bd391..2316efd6ace8 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -2032,10 +2032,10 @@ static int ovs_ct_limit_del_zone_limit(struct nlattr *nla_zone_limit, + static int ovs_ct_limit_get_default_limit(struct ovs_ct_limit_info *info, + struct sk_buff *reply) + { +- struct ovs_zone_limit zone_limit; +- +- zone_limit.zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE; +- zone_limit.limit = info->default_limit; ++ struct ovs_zone_limit zone_limit = { ++ .zone_id = OVS_ZONE_LIMIT_DEFAULT_ZONE, ++ .limit = info->default_limit, ++ }; + + return nla_put_nohdr(reply, sizeof(zone_limit), &zone_limit); + } +-- +2.30.2 + diff --git a/queue-5.11/perf-inject-fix-repipe-usage.patch b/queue-5.11/perf-inject-fix-repipe-usage.patch new file mode 100644 index 00000000000..0e895537c21 --- /dev/null +++ b/queue-5.11/perf-inject-fix-repipe-usage.patch @@ -0,0 +1,54 @@ +From 79b27a75150715169a057e6ff8c4adf3fe77e0e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 13:36:05 +0300 +Subject: perf inject: Fix repipe usage + +From: Adrian Hunter + +[ Upstream commit 026334a3bb6a3919b42aba9fc11843db2b77fd41 ] + +Since commit 14d3d54052539a1e ("perf session: Try to read pipe data from +file") 'perf inject' has started printing "PERFILE2h" when not processing +pipes. + +The commit exposed perf to the possiblity that the input is not a pipe +but the 'repipe' parameter gets used. That causes the printing because +perf inject sets 'repipe' to true always. + +The 'repipe' parameter of perf_session__new() is used by 2 functions: + + - perf_file_header__read_pipe() + - trace_report() + +In both cases, the functions copy data to STDOUT_FILENO when 'repipe' is +true. + +Fix by setting 'repipe' to true only if the output is a pipe. + +Fixes: e558a5bd8b74aff4 ("perf inject: Work with files") +Signed-off-by: Adrian Hunter +Acked-by: Jiri Olsa +Cc: Andrew Vagin +Link: http://lore.kernel.org/lkml/20210401103605.9000-1-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-inject.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c +index 43937f4b399a..c0be51b95713 100644 +--- a/tools/perf/builtin-inject.c ++++ b/tools/perf/builtin-inject.c +@@ -906,7 +906,7 @@ int cmd_inject(int argc, const char **argv) + } + + data.path = inject.input_name; +- inject.session = perf_session__new(&data, true, &inject.tool); ++ inject.session = perf_session__new(&data, inject.output.is_pipe, &inject.tool); + if (IS_ERR(inject.session)) + return PTR_ERR(inject.session); + +-- +2.30.2 + diff --git a/queue-5.11/perf-report-fix-wrong-lbr-block-sorting.patch b/queue-5.11/perf-report-fix-wrong-lbr-block-sorting.patch new file mode 100644 index 00000000000..287486110ee --- /dev/null +++ b/queue-5.11/perf-report-fix-wrong-lbr-block-sorting.patch @@ -0,0 +1,113 @@ +From 0a67444ae40c5c2fac347304c69b49a56b60f6de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Apr 2021 10:44:52 +0800 +Subject: perf report: Fix wrong LBR block sorting + +From: Jin Yao + +[ Upstream commit f2013278ae40b89cc27916366c407ce5261815ef ] + +When '--total-cycles' is specified, it supports sorting for all blocks +by 'Sampled Cycles%'. This is useful to concentrate on the globally +hottest blocks. + +'Sampled Cycles%' - block sampled cycles aggregation / total sampled cycles + +But in current code, it doesn't use the cycles aggregation. Part of +'cycles' counting is possibly dropped for some overlap jumps. But for +identifying the hot block, we always need the full cycles. + + # perf record -b ./triad_loop + # perf report --total-cycles --stdio + +Before: + + # + # Sampled Cycles% Sampled Cycles Avg Cycles% Avg Cycles [Program Block Range] Shared Object + # ............... .............. ........... .......... ............................................................. ................. + # + 0.81% 793 4.32% 793 [setup-vdso.h:34 -> setup-vdso.h:40] ld-2.27.so + 0.49% 480 0.87% 160 [native_write_msr+0 -> native_write_msr+16] [kernel.kallsyms] + 0.48% 476 0.52% 95 [native_read_msr+0 -> native_read_msr+29] [kernel.kallsyms] + 0.31% 303 1.65% 303 [nmi_restore+0 -> nmi_restore+37] [kernel.kallsyms] + 0.26% 255 1.39% 255 [nohz_balance_exit_idle+75 -> nohz_balance_exit_idle+162] [kernel.kallsyms] + 0.24% 234 1.28% 234 [end_repeat_nmi+67 -> end_repeat_nmi+83] [kernel.kallsyms] + 0.23% 227 1.24% 227 [__irqentry_text_end+96 -> __irqentry_text_end+126] [kernel.kallsyms] + 0.20% 194 1.06% 194 [native_set_debugreg+52 -> native_set_debugreg+56] [kernel.kallsyms] + 0.11% 106 0.14% 26 [native_sched_clock+0 -> native_sched_clock+98] [kernel.kallsyms] + 0.10% 97 0.53% 97 [trigger_load_balance+0 -> trigger_load_balance+67] [kernel.kallsyms] + 0.09% 85 0.46% 85 [get-dynamic-info.h:102 -> get-dynamic-info.h:111] ld-2.27.so + ... + 0.00% 92.7K 0.02% 4 [triad_loop.c:64 -> triad_loop.c:65] triad_loop + +The hottest block '[triad_loop.c:64 -> triad_loop.c:65]' is not at +the top of output. + +After: + + # Sampled Cycles% Sampled Cycles Avg Cycles% Avg Cycles [Program Block Range] Shared Object + # ............... .............. ........... .......... .............................................................. ................. + # + 94.35% 92.7K 0.02% 4 [triad_loop.c:64 -> triad_loop.c:65] triad_loop + 0.81% 793 4.32% 793 [setup-vdso.h:34 -> setup-vdso.h:40] ld-2.27.so + 0.49% 480 0.87% 160 [native_write_msr+0 -> native_write_msr+16] [kernel.kallsyms] + 0.48% 476 0.52% 95 [native_read_msr+0 -> native_read_msr+29] [kernel.kallsyms] + 0.31% 303 1.65% 303 [nmi_restore+0 -> nmi_restore+37] [kernel.kallsyms] + 0.26% 255 1.39% 255 [nohz_balance_exit_idle+75 -> nohz_balance_exit_idle+162] [kernel.kallsyms] + 0.24% 234 1.28% 234 [end_repeat_nmi+67 -> end_repeat_nmi+83] [kernel.kallsyms] + 0.23% 227 1.24% 227 [__irqentry_text_end+96 -> __irqentry_text_end+126] [kernel.kallsyms] + 0.20% 194 1.06% 194 [native_set_debugreg+52 -> native_set_debugreg+56] [kernel.kallsyms] + 0.11% 106 0.14% 26 [native_sched_clock+0 -> native_sched_clock+98] [kernel.kallsyms] + 0.10% 97 0.53% 97 [trigger_load_balance+0 -> trigger_load_balance+67] [kernel.kallsyms] + 0.09% 85 0.46% 85 [get-dynamic-info.h:102 -> get-dynamic-info.h:111] ld-2.27.so + 0.08% 82 0.06% 11 [intel_pmu_drain_pebs_nhm+580 -> intel_pmu_drain_pebs_nhm+627] [kernel.kallsyms] + 0.08% 77 0.42% 77 [lru_add_drain_cpu+0 -> lru_add_drain_cpu+133] [kernel.kallsyms] + 0.08% 74 0.10% 18 [handle_pmi_common+271 -> handle_pmi_common+310] [kernel.kallsyms] + 0.08% 74 0.40% 74 [get-dynamic-info.h:131 -> get-dynamic-info.h:157] ld-2.27.so + 0.07% 69 0.09% 17 [intel_pmu_drain_pebs_nhm+432 -> intel_pmu_drain_pebs_nhm+468] [kernel.kallsyms] + +Now the hottest block is reported at the top of output. + +Fixes: b65a7d372b1a55db ("perf hist: Support block formats with compare/sort/display") +Signed-off-by: Jin Yao +Reviewed-by: Andi Kleen +Cc: Alexander Shishkin +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20210407024452.29988-1-yao.jin@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/block-info.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/util/block-info.c b/tools/perf/util/block-info.c +index 423ec69bda6c..5ecd4f401f32 100644 +--- a/tools/perf/util/block-info.c ++++ b/tools/perf/util/block-info.c +@@ -201,7 +201,7 @@ static int block_total_cycles_pct_entry(struct perf_hpp_fmt *fmt, + double ratio = 0.0; + + if (block_fmt->total_cycles) +- ratio = (double)bi->cycles / (double)block_fmt->total_cycles; ++ ratio = (double)bi->cycles_aggr / (double)block_fmt->total_cycles; + + return color_pct(hpp, block_fmt->width, 100.0 * ratio); + } +@@ -216,9 +216,9 @@ static int64_t block_total_cycles_pct_sort(struct perf_hpp_fmt *fmt, + double l, r; + + if (block_fmt->total_cycles) { +- l = ((double)bi_l->cycles / ++ l = ((double)bi_l->cycles_aggr / + (double)block_fmt->total_cycles) * 100000.0; +- r = ((double)bi_r->cycles / ++ r = ((double)bi_r->cycles_aggr / + (double)block_fmt->total_cycles) * 100000.0; + return (int64_t)l - (int64_t)r; + } +-- +2.30.2 + diff --git a/queue-5.11/platform-x86-intel-hid-fix-spurious-wakeups-caused-b.patch b/queue-5.11/platform-x86-intel-hid-fix-spurious-wakeups-caused-b.patch new file mode 100644 index 00000000000..b923a94bd9c --- /dev/null +++ b/queue-5.11/platform-x86-intel-hid-fix-spurious-wakeups-caused-b.patch @@ -0,0 +1,65 @@ +From a9822131a707ae064994dab7e3fc4b450440fc5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 16:38:31 +0200 +Subject: platform/x86: intel-hid: Fix spurious wakeups caused by tablet-mode + events during suspend + +From: Hans de Goede + +[ Upstream commit a3790a8a94fc0234c5d38013b48e74ef221ec84c ] + +Some devices send (duplicate) tablet-mode events when moved around even +though the mode has not changed; and they do this even when suspended. + +Change the tablet-mode event handling when priv->wakeup_mode is set to +update the switch state in case it changed and then return immediately +(without calling pm_wakeup_hard_event()) to avoid spurious wakeups. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=212537 +Fixes: 537b0dd4729e ("platform/x86: intel-hid: Add support for SW_TABLET_MODE") +Signed-off-by: Hans de Goede +Reviewed-by: Elia Devito +Link: https://lore.kernel.org/r/20210404143831.25173-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/intel-hid.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c +index 57cc92891a57..078648a9201b 100644 +--- a/drivers/platform/x86/intel-hid.c ++++ b/drivers/platform/x86/intel-hid.c +@@ -483,11 +483,16 @@ static void notify_handler(acpi_handle handle, u32 event, void *context) + goto wakeup; + + /* +- * Switch events will wake the device and report the new switch +- * position to the input subsystem. ++ * Some devices send (duplicate) tablet-mode events when moved ++ * around even though the mode has not changed; and they do this ++ * even when suspended. ++ * Update the switch state in case it changed and then return ++ * without waking up to avoid spurious wakeups. + */ +- if (priv->switches && (event == 0xcc || event == 0xcd)) +- goto wakeup; ++ if (event == 0xcc || event == 0xcd) { ++ report_tablet_mode_event(priv->switches, event); ++ return; ++ } + + /* Wake up on 5-button array events only. */ + if (event == 0xc0 || !priv->array) +@@ -501,9 +506,6 @@ static void notify_handler(acpi_handle handle, u32 event, void *context) + wakeup: + pm_wakeup_hard_event(&device->dev); + +- if (report_tablet_mode_event(priv->switches, event)) +- return; +- + return; + } + +-- +2.30.2 + diff --git a/queue-5.11/rdma-addr-be-strict-with-gid-size.patch b/queue-5.11/rdma-addr-be-strict-with-gid-size.patch new file mode 100644 index 00000000000..89504d2fe04 --- /dev/null +++ b/queue-5.11/rdma-addr-be-strict-with-gid-size.patch @@ -0,0 +1,41 @@ +From 7fdba956709b479186be4a479fe5e06e1c45da74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Apr 2021 10:44:34 +0300 +Subject: RDMA/addr: Be strict with gid size + +From: Leon Romanovsky + +[ Upstream commit d1c803a9ccd7bd3aff5e989ccfb39ed3b799b975 ] + +The nla_len() is less than or equal to 16. If it's less than 16 then end +of the "gid" buffer is uninitialized. + +Fixes: ae43f8286730 ("IB/core: Add IP to GID netlink offload") +Link: https://lore.kernel.org/r/20210405074434.264221-1-leon@kernel.org +Reported-by: Dan Carpenter +Signed-off-by: Mark Bloch +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/addr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index 0abce004a959..65e3e7df8a4b 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -76,7 +76,9 @@ static struct workqueue_struct *addr_wq; + + static const struct nla_policy ib_nl_addr_policy[LS_NLA_TYPE_MAX] = { + [LS_NLA_TYPE_DGID] = {.type = NLA_BINARY, +- .len = sizeof(struct rdma_nla_ls_gid)}, ++ .len = sizeof(struct rdma_nla_ls_gid), ++ .validation_type = NLA_VALIDATE_MIN, ++ .min = sizeof(struct rdma_nla_ls_gid)}, + }; + + static inline bool ib_nl_is_good_ip_resp(const struct nlmsghdr *nlh) +-- +2.30.2 + diff --git a/queue-5.11/rdma-cxgb4-check-for-ipv6-address-properly-while-des.patch b/queue-5.11/rdma-cxgb4-check-for-ipv6-address-properly-while-des.patch new file mode 100644 index 00000000000..d572cd008d6 --- /dev/null +++ b/queue-5.11/rdma-cxgb4-check-for-ipv6-address-properly-while-des.patch @@ -0,0 +1,39 @@ +From 2e95f8e1c043dcd468b7d04721a8644602e64293 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 19:27:15 +0530 +Subject: RDMA/cxgb4: check for ipv6 address properly while destroying listener + +From: Potnuri Bharat Teja + +[ Upstream commit 603c4690b01aaffe3a6c3605a429f6dac39852ae ] + +ipv6 bit is wrongly set by the below which causes fatal adapter lookup +engine errors for ipv4 connections while destroying a listener. Fix it to +properly check the local address for ipv6. + +Fixes: 3408be145a5d ("RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server") +Link: https://lore.kernel.org/r/20210331135715.30072-1-bharat@chelsio.com +Signed-off-by: Potnuri Bharat Teja +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cm.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c +index 81903749d241..e42c812e74c3 100644 +--- a/drivers/infiniband/hw/cxgb4/cm.c ++++ b/drivers/infiniband/hw/cxgb4/cm.c +@@ -3616,7 +3616,8 @@ int c4iw_destroy_listen(struct iw_cm_id *cm_id) + c4iw_init_wr_wait(ep->com.wr_waitp); + err = cxgb4_remove_server( + ep->com.dev->rdev.lldi.ports[0], ep->stid, +- ep->com.dev->rdev.lldi.rxq_ids[0], true); ++ ep->com.dev->rdev.lldi.rxq_ids[0], ++ ep->com.local_addr.ss_family == AF_INET6); + if (err) + goto done; + err = c4iw_wait_for_reply(&ep->com.dev->rdev, ep->com.wr_waitp, +-- +2.30.2 + diff --git a/queue-5.11/rdma-qedr-fix-kernel-panic-when-trying-to-access-rec.patch b/queue-5.11/rdma-qedr-fix-kernel-panic-when-trying-to-access-rec.patch new file mode 100644 index 00000000000..bbc1c48123a --- /dev/null +++ b/queue-5.11/rdma-qedr-fix-kernel-panic-when-trying-to-access-rec.patch @@ -0,0 +1,79 @@ +From 07b8361a3c3adedf5ad87639f8928036f61adf13 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 15:55:01 +0300 +Subject: RDMA/qedr: Fix kernel panic when trying to access recv_cq + +From: Kamal Heib + +[ Upstream commit e1ad897b9c738d5550be6762bf3a6ef1672259a4 ] + +As INI QP does not require a recv_cq, avoid the following null pointer +dereference by checking if the qp_type is not INI before trying to extract +the recv_cq. + +BUG: kernel NULL pointer dereference, address: 00000000000000e0 + #PF: supervisor read access in kernel mode + #PF: error_code(0x0000) - not-present page + PGD 0 P4D 0 + Oops: 0000 [#1] SMP PTI + CPU: 0 PID: 54250 Comm: mpitests-IMB-MP Not tainted 5.12.0-rc5 #1 + Hardware name: Dell Inc. PowerEdge R320/0KM5PX, BIOS 2.7.0 08/19/2019 + RIP: 0010:qedr_create_qp+0x378/0x820 [qedr] + Code: 02 00 00 50 e8 29 d4 a9 d1 48 83 c4 18 e9 65 fe ff ff 48 8b 53 10 48 8b 43 18 44 8b 82 e0 00 00 00 45 85 c0 0f 84 10 74 00 00 <8b> b8 e0 00 00 00 85 ff 0f 85 50 fd ff ff e9 fd 73 00 00 48 8d bd + RSP: 0018:ffff9c8f056f7a70 EFLAGS: 00010202 + RAX: 0000000000000000 RBX: ffff9c8f056f7b58 RCX: 0000000000000009 + RDX: ffff8c41a9744c00 RSI: ffff9c8f056f7b58 RDI: ffff8c41c0dfa280 + RBP: ffff8c41c0dfa280 R08: 0000000000000002 R09: 0000000000000001 + R10: 0000000000000000 R11: ffff8c41e06fc608 R12: ffff8c4194052000 + R13: 0000000000000000 R14: ffff8c4191546070 R15: ffff8c41c0dfa280 + FS: 00007f78b2787b80(0000) GS:ffff8c43a3200000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000000000e0 CR3: 00000001011d6002 CR4: 00000000001706f0 + Call Trace: + ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x4e4/0xb90 [ib_uverbs] + ? ib_uverbs_cq_event_handler+0x30/0x30 [ib_uverbs] + ib_uverbs_run_method+0x6f6/0x7a0 [ib_uverbs] + ? ib_uverbs_handler_UVERBS_METHOD_QP_DESTROY+0x70/0x70 [ib_uverbs] + ? __cond_resched+0x15/0x30 + ? __kmalloc+0x5a/0x440 + ib_uverbs_cmd_verbs+0x195/0x360 [ib_uverbs] + ? xa_load+0x6e/0x90 + ? cred_has_capability+0x7c/0x130 + ? avc_has_extended_perms+0x17f/0x440 + ? vma_link+0xae/0xb0 + ? vma_set_page_prot+0x2a/0x60 + ? mmap_region+0x298/0x6c0 + ? do_mmap+0x373/0x520 + ? selinux_file_ioctl+0x17f/0x220 + ib_uverbs_ioctl+0xa7/0x110 [ib_uverbs] + __x64_sys_ioctl+0x84/0xc0 + do_syscall_64+0x33/0x40 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f78b120262b + +Fixes: 06e8d1df46ed ("RDMA/qedr: Add support for user mode XRC-SRQ's") +Link: https://lore.kernel.org/r/20210404125501.154789-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/verbs.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 0eb6a7a618e0..9ea542270ed4 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1244,7 +1244,8 @@ static int qedr_check_qp_attrs(struct ib_pd *ibpd, struct qedr_dev *dev, + * TGT QP isn't associated with RQ/SQ + */ + if ((attrs->qp_type != IB_QPT_GSI) && (dev->gsi_qp_created) && +- (attrs->qp_type != IB_QPT_XRC_TGT)) { ++ (attrs->qp_type != IB_QPT_XRC_TGT) && ++ (attrs->qp_type != IB_QPT_XRC_INI)) { + struct qedr_cq *send_cq = get_qedr_cq(attrs->send_cq); + struct qedr_cq *recv_cq = get_qedr_cq(attrs->recv_cq); + +-- +2.30.2 + diff --git a/queue-5.11/rdma-rtrs-clt-close-rtrs-client-conn-before-destroyi.patch b/queue-5.11/rdma-rtrs-clt-close-rtrs-client-conn-before-destroyi.patch new file mode 100644 index 00000000000..9819d49d7c8 --- /dev/null +++ b/queue-5.11/rdma-rtrs-clt-close-rtrs-client-conn-before-destroyi.patch @@ -0,0 +1,131 @@ +From 3f3db609d9379740761cbea35af58ade80b6e373 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 16:32:57 +0100 +Subject: RDMA/rtrs-clt: Close rtrs client conn before destroying rtrs clt + session files + +From: Md Haris Iqbal + +[ Upstream commit 7582207b1059129e59eb92026fca2cfc088a74fc ] + +KASAN detected the following BUG: + + BUG: KASAN: use-after-free in rtrs_clt_update_wc_stats+0x41/0x100 [rtrs_client] + Read of size 8 at addr ffff88bf2fb4adc0 by task swapper/0/0 + + CPU: 0 PID: 0 Comm: swapper/0 Tainted: G O 5.4.84-pserver #5.4.84-1+feature+linux+5.4.y+dbg+20201216.1319+b6b887b~deb10 + Hardware name: Supermicro H8QG6/H8QG6, BIOS 3.00 09/04/2012 + Call Trace: + + dump_stack+0x96/0xe0 + print_address_description.constprop.4+0x1f/0x300 + ? irq_work_claim+0x2e/0x50 + __kasan_report.cold.8+0x78/0x92 + ? rtrs_clt_update_wc_stats+0x41/0x100 [rtrs_client] + kasan_report+0x10/0x20 + rtrs_clt_update_wc_stats+0x41/0x100 [rtrs_client] + rtrs_clt_rdma_done+0xb1/0x760 [rtrs_client] + ? lockdep_hardirqs_on+0x1a8/0x290 + ? process_io_rsp+0xb0/0xb0 [rtrs_client] + ? mlx4_ib_destroy_cq+0x100/0x100 [mlx4_ib] + ? add_interrupt_randomness+0x1a2/0x340 + __ib_process_cq+0x97/0x100 [ib_core] + ib_poll_handler+0x41/0xb0 [ib_core] + irq_poll_softirq+0xe0/0x260 + __do_softirq+0x127/0x672 + irq_exit+0xd1/0xe0 + do_IRQ+0xa3/0x1d0 + common_interrupt+0xf/0xf + + RIP: 0010:cpuidle_enter_state+0xea/0x780 + Code: 31 ff e8 99 48 47 ff 80 7c 24 08 00 74 12 9c 58 f6 c4 02 0f 85 53 05 00 00 31 ff e8 b0 6f 53 ff e8 ab 4f 5e ff fb 8b 44 24 04 <85> c0 0f 89 f3 01 00 00 48 8d 7b 14 e8 65 1e 77 ff c7 43 14 00 00 + RSP: 0018:ffffffffab007d58 EFLAGS: 00000246 ORIG_RAX: ffffffffffffffca + RAX: 0000000000000002 RBX: ffff88b803d69800 RCX: ffffffffa91a8298 + RDX: 0000000000000007 RSI: dffffc0000000000 RDI: ffffffffab021414 + RBP: ffffffffab6329e0 R08: 0000000000000002 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000002 + R13: 000000bf39d82466 R14: ffffffffab632aa0 R15: ffffffffab632ae0 + ? lockdep_hardirqs_on+0x1a8/0x290 + ? cpuidle_enter_state+0xe5/0x780 + cpuidle_enter+0x3c/0x60 + do_idle+0x2fb/0x390 + ? arch_cpu_idle_exit+0x40/0x40 + ? schedule+0x94/0x120 + cpu_startup_entry+0x19/0x1b + start_kernel+0x5da/0x61b + ? thread_stack_cache_init+0x6/0x6 + ? load_ucode_amd_bsp+0x6f/0xc4 + ? init_amd_microcode+0xa6/0xa6 + ? x86_family+0x5/0x20 + ? load_ucode_bsp+0x182/0x1fd + secondary_startup_64+0xa4/0xb0 + + Allocated by task 5730: + save_stack+0x19/0x80 + __kasan_kmalloc.constprop.9+0xc1/0xd0 + kmem_cache_alloc_trace+0x15b/0x350 + alloc_sess+0xf4/0x570 [rtrs_client] + rtrs_clt_open+0x3b4/0x780 [rtrs_client] + find_and_get_or_create_sess+0x649/0x9d0 [rnbd_client] + rnbd_clt_map_device+0xd7/0xf50 [rnbd_client] + rnbd_clt_map_device_store+0x4ee/0x970 [rnbd_client] + kernfs_fop_write+0x141/0x240 + vfs_write+0xf3/0x280 + ksys_write+0xba/0x150 + do_syscall_64+0x68/0x270 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + + Freed by task 5822: + save_stack+0x19/0x80 + __kasan_slab_free+0x125/0x170 + kfree+0xe7/0x3f0 + kobject_put+0xd3/0x240 + rtrs_clt_destroy_sess_files+0x3f/0x60 [rtrs_client] + rtrs_clt_close+0x3c/0x80 [rtrs_client] + close_rtrs+0x45/0x80 [rnbd_client] + rnbd_client_exit+0x10f/0x2bd [rnbd_client] + __x64_sys_delete_module+0x27b/0x340 + do_syscall_64+0x68/0x270 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +When rtrs_clt_close is triggered, it iterates over all the present +rtrs_clt_sess and triggers close on them. However, the call to +rtrs_clt_destroy_sess_files is done before the rtrs_clt_close_conns. This +is incorrect since during the initialization phase we allocate +rtrs_clt_sess first, and then we go ahead and create rtrs_clt_con for it. + +If we free the rtrs_clt_sess structure before closing the rtrs_clt_con, it +may so happen that an inflight IO completion would trigger the function +rtrs_clt_rdma_done, which would lead to the above UAF case. + +Hence close the rtrs_clt_con connections first, and then trigger the +destruction of session files. + +Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") +Link: https://lore.kernel.org/r/20210325153308.1214057-12-gi-oh.kim@ionos.com +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Gioh Kim +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 394c1f6822b9..ee37c5af3a8c 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -2735,8 +2735,8 @@ void rtrs_clt_close(struct rtrs_clt *clt) + + /* Now it is safe to iterate over all paths without locks */ + list_for_each_entry_safe(sess, tmp, &clt->paths_list, s.entry) { +- rtrs_clt_destroy_sess_files(sess, NULL); + rtrs_clt_close_conns(sess, true); ++ rtrs_clt_destroy_sess_files(sess, NULL); + kobject_put(&sess->kobj); + } + free_clt(clt); +-- +2.30.2 + diff --git a/queue-5.11/regulator-bd9571mwv-fix-avs-and-dvfs-voltage-range.patch b/queue-5.11/regulator-bd9571mwv-fix-avs-and-dvfs-voltage-range.patch new file mode 100644 index 00000000000..5a9cf24d30f --- /dev/null +++ b/queue-5.11/regulator-bd9571mwv-fix-avs-and-dvfs-voltage-range.patch @@ -0,0 +1,50 @@ +From e4b6672e1ed1223fe5f7517645f944a7249dcf5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 14:02:40 +0100 +Subject: regulator: bd9571mwv: Fix AVS and DVFS voltage range + +From: Geert Uytterhoeven + +[ Upstream commit 3b6e7088afc919f5b52e4d2de8501ad34d35b09b ] + +According to Table 30 ("DVFS_MoniVDAC [6:0] Setting Table") in the +BD9571MWV-M Datasheet Rev. 002, the valid voltage range is 600..1100 mV +(settings 0x3c..0x6e). While the lower limit is taken into account (by +setting regulator_desc.linear_min_sel to 0x3c), the upper limit is not. + +Fix this by reducing regulator_desc.n_voltages from 0x80 to 0x6f. + +Fixes: e85c5a153fe237f2 ("regulator: Add ROHM BD9571MWV-M PMIC regulator driver") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20210312130242.3390038-2-geert+renesas@glider.be +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/bd9571mwv-regulator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/bd9571mwv-regulator.c b/drivers/regulator/bd9571mwv-regulator.c +index e690c2ce5b3c..25e33028871c 100644 +--- a/drivers/regulator/bd9571mwv-regulator.c ++++ b/drivers/regulator/bd9571mwv-regulator.c +@@ -124,7 +124,7 @@ static const struct regulator_ops vid_ops = { + + static const struct regulator_desc regulators[] = { + BD9571MWV_REG("VD09", "vd09", VD09, avs_ops, 0, 0x7f, +- 0x80, 600000, 10000, 0x3c), ++ 0x6f, 600000, 10000, 0x3c), + BD9571MWV_REG("VD18", "vd18", VD18, vid_ops, BD9571MWV_VD18_VID, 0xf, + 16, 1625000, 25000, 0), + BD9571MWV_REG("VD25", "vd25", VD25, vid_ops, BD9571MWV_VD25_VID, 0xf, +@@ -133,7 +133,7 @@ static const struct regulator_desc regulators[] = { + 11, 2800000, 100000, 0), + BD9571MWV_REG("DVFS", "dvfs", DVFS, reg_ops, + BD9571MWV_DVFS_MONIVDAC, 0x7f, +- 0x80, 600000, 10000, 0x3c), ++ 0x6f, 600000, 10000, 0x3c), + }; + + #ifdef CONFIG_PM_SLEEP +-- +2.30.2 + diff --git a/queue-5.11/remoteproc-pru-fix-firmware-loading-crashes-on-k3-so.patch b/queue-5.11/remoteproc-pru-fix-firmware-loading-crashes-on-k3-so.patch new file mode 100644 index 00000000000..1ccb5768970 --- /dev/null +++ b/queue-5.11/remoteproc-pru-fix-firmware-loading-crashes-on-k3-so.patch @@ -0,0 +1,44 @@ +From e58c8bfe860d027f66b78e3b0f2848c929187bb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 15:58:59 -0500 +Subject: remoteproc: pru: Fix firmware loading crashes on K3 SoCs + +From: Suman Anna + +[ Upstream commit 9afeefcf06fc7b4bdab06a6e2cb06745bded34dd ] + +The K3 PRUs are 32-bit processors and in general have some limitations +in using the standard ARMv8 memcpy function for loading firmware segments, +so the driver already uses a custom memcpy implementation. This added +logic however is limited to only IRAMs at the moment, but the loading +into Data RAMs is not completely ok either and does generate a kernel +crash for unaligned accesses. + +Fix these crashes by removing the existing IRAM logic limitation and +extending the custom memcpy usage to Data RAMs as well for all K3 SoCs. + +Fixes: 1d39f4d19921 ("remoteproc: pru: Add support for various PRU cores on K3 AM65x SoCs") +Signed-off-by: Suman Anna +Link: https://lore.kernel.org/r/20210315205859.19590-1-s-anna@ti.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/pru_rproc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/remoteproc/pru_rproc.c b/drivers/remoteproc/pru_rproc.c +index 2667919d76b3..16979c1cd2f4 100644 +--- a/drivers/remoteproc/pru_rproc.c ++++ b/drivers/remoteproc/pru_rproc.c +@@ -585,7 +585,7 @@ pru_rproc_load_elf_segments(struct rproc *rproc, const struct firmware *fw) + break; + } + +- if (pru->data->is_k3 && is_iram) { ++ if (pru->data->is_k3) { + ret = pru_rproc_memcpy(ptr, elf_data + phdr->p_offset, + filesz); + if (ret) { +-- +2.30.2 + diff --git a/queue-5.11/remoteproc-qcom-pil_info-avoid-64-bit-division.patch b/queue-5.11/remoteproc-qcom-pil_info-avoid-64-bit-division.patch new file mode 100644 index 00000000000..6ac87691228 --- /dev/null +++ b/queue-5.11/remoteproc-qcom-pil_info-avoid-64-bit-division.patch @@ -0,0 +1,43 @@ +From 6f718d2c95d9719f88469e1215256dec7c953582 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 3 Jan 2021 14:56:12 +0100 +Subject: remoteproc: qcom: pil_info: avoid 64-bit division + +From: Arnd Bergmann + +[ Upstream commit 7029e783027706b427bbfbdf8558252c1dac6fa0 ] + +On 32-bit machines with 64-bit resource_size_t, the driver causes +a link failure because of the 64-bit division: + +arm-linux-gnueabi-ld: drivers/remoteproc/qcom_pil_info.o: in function `qcom_pil_info_store': +qcom_pil_info.c:(.text+0x1ec): undefined reference to `__aeabi_uldivmod' + +Add a cast to an u32 to avoid this. If the resource exceeds 4GB, +there are bigger problems. + +Fixes: 549b67da660d ("remoteproc: qcom: Introduce helper to store pil info in IMEM") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20210103135628.3702427-1-arnd@kernel.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_pil_info.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/remoteproc/qcom_pil_info.c b/drivers/remoteproc/qcom_pil_info.c +index 5521c4437ffa..7c007dd7b200 100644 +--- a/drivers/remoteproc/qcom_pil_info.c ++++ b/drivers/remoteproc/qcom_pil_info.c +@@ -56,7 +56,7 @@ static int qcom_pil_info_init(void) + memset_io(base, 0, resource_size(&imem)); + + _reloc.base = base; +- _reloc.num_entries = resource_size(&imem) / PIL_RELOC_ENTRY_SIZE; ++ _reloc.num_entries = (u32)resource_size(&imem) / PIL_RELOC_ENTRY_SIZE; + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.11/revert-arm64-dts-marvell-armada-cp110-switch-to-per-.patch b/queue-5.11/revert-arm64-dts-marvell-armada-cp110-switch-to-per-.patch new file mode 100644 index 00000000000..880700e12f5 --- /dev/null +++ b/queue-5.11/revert-arm64-dts-marvell-armada-cp110-switch-to-per-.patch @@ -0,0 +1,59 @@ +From 09f46653d3e9e688dd73ce1c106642e33a36cc88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 21:58:26 +0200 +Subject: Revert "arm64: dts: marvell: armada-cp110: Switch to per-port SATA + interrupts" + +From: Gregory CLEMENT + +[ Upstream commit 967ff33eb0efcd48e4df11ab9aee51c41e0f44d0 ] + +The driver part of this support was not merged which leads to break +AHCI on all Marvell Armada 7k8k / CN913x platforms as it was reported +by Marcin Wojtas. + +So for now let's remove it in order to fix the issue waiting for the +driver part really be merged. + +This reverts commit 53e950d597e3578da84238b86424bfcc9e101d87. +Fixes: 53e950d597e3 ("arm64: dts: marvell: armada-cp110: Switch to per-port SATA interrupts") + +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-cp11x.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi b/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi +index 994a2fce449a..1e37ae181acf 100644 +--- a/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-cp11x.dtsi +@@ -300,9 +300,11 @@ + }; + + CP11X_LABEL(sata0): sata@540000 { +- compatible = "marvell,armada-8k-ahci"; ++ compatible = "marvell,armada-8k-ahci", ++ "generic-ahci"; + reg = <0x540000 0x30000>; + dma-coherent; ++ interrupts = <107 IRQ_TYPE_LEVEL_HIGH>; + clocks = <&CP11X_LABEL(clk) 1 15>, + <&CP11X_LABEL(clk) 1 16>; + #address-cells = <1>; +@@ -310,12 +312,10 @@ + status = "disabled"; + + sata-port@0 { +- interrupts = <109 IRQ_TYPE_LEVEL_HIGH>; + reg = <0>; + }; + + sata-port@1 { +- interrupts = <107 IRQ_TYPE_LEVEL_HIGH>; + reg = <1>; + }; + }; +-- +2.30.2 + diff --git a/queue-5.11/s390-cpcmd-fix-inline-assembly-register-clobbering.patch b/queue-5.11/s390-cpcmd-fix-inline-assembly-register-clobbering.patch new file mode 100644 index 00000000000..f06e852aa6b --- /dev/null +++ b/queue-5.11/s390-cpcmd-fix-inline-assembly-register-clobbering.patch @@ -0,0 +1,46 @@ +From cffb1b99ddcd35477d7d805837e99428db56e8ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 18:35:07 +0200 +Subject: s390/cpcmd: fix inline assembly register clobbering + +From: Alexander Gordeev + +[ Upstream commit 7a2f91441b2c1d81b77c1cd816a4659f4abc9cbe ] + +Register variables initialized using arithmetic. That leads to +kasan instrumentaton code corrupting the registers contents. +Follow GCC guidlines and use temporary variables for assigning +init values to register variables. + +Fixes: 94c12cc7d196 ("[S390] Inline assembly cleanup.") +Signed-off-by: Alexander Gordeev +Acked-by: Ilya Leoshkevich +Link: https://gcc.gnu.org/onlinedocs/gcc-10.2.0/gcc/Local-Register-Variables.html +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/cpcmd.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/kernel/cpcmd.c b/arch/s390/kernel/cpcmd.c +index af013b4244d3..2da027359798 100644 +--- a/arch/s390/kernel/cpcmd.c ++++ b/arch/s390/kernel/cpcmd.c +@@ -37,10 +37,12 @@ static int diag8_noresponse(int cmdlen) + + static int diag8_response(int cmdlen, char *response, int *rlen) + { ++ unsigned long _cmdlen = cmdlen | 0x40000000L; ++ unsigned long _rlen = *rlen; + register unsigned long reg2 asm ("2") = (addr_t) cpcmd_buf; + register unsigned long reg3 asm ("3") = (addr_t) response; +- register unsigned long reg4 asm ("4") = cmdlen | 0x40000000L; +- register unsigned long reg5 asm ("5") = *rlen; ++ register unsigned long reg4 asm ("4") = _cmdlen; ++ register unsigned long reg5 asm ("5") = _rlen; + + asm volatile( + " diag %2,%0,0x8\n" +-- +2.30.2 + diff --git a/queue-5.11/sch_red-fix-off-by-one-checks-in-red_check_params.patch b/queue-5.11/sch_red-fix-off-by-one-checks-in-red_check_params.patch new file mode 100644 index 00000000000..2eea4bef3b6 --- /dev/null +++ b/queue-5.11/sch_red-fix-off-by-one-checks-in-red_check_params.patch @@ -0,0 +1,73 @@ +From 168b83f197e3e97e58b60781fd6fa371cabc4bf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 11:14:53 -0700 +Subject: sch_red: fix off-by-one checks in red_check_params() + +From: Eric Dumazet + +[ Upstream commit 3a87571f0ffc51ba3bf3ecdb6032861d0154b164 ] + +This fixes following syzbot report: + +UBSAN: shift-out-of-bounds in ./include/net/red.h:237:23 +shift exponent 32 is too large for 32-bit type 'unsigned int' +CPU: 1 PID: 8418 Comm: syz-executor170 Not tainted 5.12.0-rc4-next-20210324-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x141/0x1d7 lib/dump_stack.c:120 + ubsan_epilogue+0xb/0x5a lib/ubsan.c:148 + __ubsan_handle_shift_out_of_bounds.cold+0xb1/0x181 lib/ubsan.c:327 + red_set_parms include/net/red.h:237 [inline] + choke_change.cold+0x3c/0xc8 net/sched/sch_choke.c:414 + qdisc_create+0x475/0x12f0 net/sched/sch_api.c:1247 + tc_modify_qdisc+0x4c8/0x1a50 net/sched/sch_api.c:1663 + rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5553 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2502 + netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1338 + netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1927 + sock_sendmsg_nosec net/socket.c:654 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:674 + ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 + do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 + entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x43f039 +Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007ffdfa725168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 0000000000400488 RCX: 000000000043f039 +RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000004 +RBP: 0000000000403020 R08: 0000000000400488 R09: 0000000000400488 +R10: 0000000000400488 R11: 0000000000000246 R12: 00000000004030b0 +R13: 0000000000000000 R14: 00000000004ac018 R15: 0000000000400488 + +Fixes: 8afa10cbe281 ("net_sched: red: Avoid illegal values") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/red.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/net/red.h b/include/net/red.h +index 9e6647c4ccd1..cc9f6b0d7f1e 100644 +--- a/include/net/red.h ++++ b/include/net/red.h +@@ -171,9 +171,9 @@ static inline void red_set_vars(struct red_vars *v) + static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog, + u8 Scell_log, u8 *stab) + { +- if (fls(qth_min) + Wlog > 32) ++ if (fls(qth_min) + Wlog >= 32) + return false; +- if (fls(qth_max) + Wlog > 32) ++ if (fls(qth_max) + Wlog >= 32) + return false; + if (Scell_log >= 32) + return false; +-- +2.30.2 + diff --git a/queue-5.11/scsi-ufs-core-fix-task-management-request-completion.patch b/queue-5.11/scsi-ufs-core-fix-task-management-request-completion.patch new file mode 100644 index 00000000000..dba106caea4 --- /dev/null +++ b/queue-5.11/scsi-ufs-core-fix-task-management-request-completion.patch @@ -0,0 +1,40 @@ +From 2060e8483b806e73302c35dbcf4b5b62598fc8bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 00:39:08 -0700 +Subject: scsi: ufs: core: Fix task management request completion timeout + +From: Can Guo + +[ Upstream commit 1235fc569e0bf541ddda0a1224d4c6fa6d914890 ] + +ufshcd_tmc_handler() calls blk_mq_tagset_busy_iter(fn = ufshcd_compl_tm()), +but since blk_mq_tagset_busy_iter() only iterates over all reserved tags +and requests which are not in IDLE state, ufshcd_compl_tm() never gets a +chance to run. Thus, TMR always ends up with completion timeout. Fix it by +calling blk_mq_start_request() in __ufshcd_issue_tm_cmd(). + +Link: https://lore.kernel.org/r/1617262750-4864-2-git-send-email-cang@codeaurora.org +Fixes: 69a6c269c097 ("scsi: ufs: Use blk_{get,put}_request() to allocate and free TMFs") +Reviewed-by: Bart Van Assche +Signed-off-by: Can Guo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 16e1bd1aa49d..c801f88007dd 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -6381,6 +6381,7 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba, + + spin_lock_irqsave(host->host_lock, flags); + task_tag = hba->nutrs + free_slot; ++ blk_mq_start_request(req); + + treq->req_header.dword_0 |= cpu_to_be32(task_tag); + +-- +2.30.2 + diff --git a/queue-5.11/scsi-ufs-core-fix-wrong-task-tag-used-in-task-manage.patch b/queue-5.11/scsi-ufs-core-fix-wrong-task-tag-used-in-task-manage.patch new file mode 100644 index 00000000000..73032cc3baa --- /dev/null +++ b/queue-5.11/scsi-ufs-core-fix-wrong-task-tag-used-in-task-manage.patch @@ -0,0 +1,107 @@ +From d60cde62948e50ba792e4171acf5bdd35dda64ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 00:39:09 -0700 +Subject: scsi: ufs: core: Fix wrong Task Tag used in task management request + UPIUs + +From: Can Guo + +[ Upstream commit 4b42d557a8add52b9a9924fb31e40a218aab7801 ] + +In __ufshcd_issue_tm_cmd(), it is not correct to use hba->nutrs + req->tag +as the Task Tag in a TMR UPIU. Directly use req->tag as the Task Tag. + +Fixes: e293313262d3 ("scsi: ufs: Fix broken task management command implementation") +Link: https://lore.kernel.org/r/1617262750-4864-3-git-send-email-cang@codeaurora.org +Reviewed-by: Bart Van Assche +Signed-off-by: Can Guo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 30 +++++++++++++----------------- + 1 file changed, 13 insertions(+), 17 deletions(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index c801f88007dd..e53a3f89e863 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -6363,38 +6363,34 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba, + DECLARE_COMPLETION_ONSTACK(wait); + struct request *req; + unsigned long flags; +- int free_slot, task_tag, err; ++ int task_tag, err; + + /* +- * Get free slot, sleep if slots are unavailable. +- * Even though we use wait_event() which sleeps indefinitely, +- * the maximum wait time is bounded by %TM_CMD_TIMEOUT. ++ * blk_get_request() is used here only to get a free tag. + */ + req = blk_get_request(q, REQ_OP_DRV_OUT, 0); + if (IS_ERR(req)) + return PTR_ERR(req); + + req->end_io_data = &wait; +- free_slot = req->tag; +- WARN_ON_ONCE(free_slot < 0 || free_slot >= hba->nutmrs); + ufshcd_hold(hba, false); + + spin_lock_irqsave(host->host_lock, flags); +- task_tag = hba->nutrs + free_slot; + blk_mq_start_request(req); + ++ task_tag = req->tag; + treq->req_header.dword_0 |= cpu_to_be32(task_tag); + +- memcpy(hba->utmrdl_base_addr + free_slot, treq, sizeof(*treq)); +- ufshcd_vops_setup_task_mgmt(hba, free_slot, tm_function); ++ memcpy(hba->utmrdl_base_addr + task_tag, treq, sizeof(*treq)); ++ ufshcd_vops_setup_task_mgmt(hba, task_tag, tm_function); + + /* send command to the controller */ +- __set_bit(free_slot, &hba->outstanding_tasks); ++ __set_bit(task_tag, &hba->outstanding_tasks); + + /* Make sure descriptors are ready before ringing the task doorbell */ + wmb(); + +- ufshcd_writel(hba, 1 << free_slot, REG_UTP_TASK_REQ_DOOR_BELL); ++ ufshcd_writel(hba, 1 << task_tag, REG_UTP_TASK_REQ_DOOR_BELL); + /* Make sure that doorbell is committed immediately */ + wmb(); + +@@ -6414,24 +6410,24 @@ static int __ufshcd_issue_tm_cmd(struct ufs_hba *hba, + ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete_err"); + dev_err(hba->dev, "%s: task management cmd 0x%.2x timed-out\n", + __func__, tm_function); +- if (ufshcd_clear_tm_cmd(hba, free_slot)) +- dev_WARN(hba->dev, "%s: unable clear tm cmd (slot %d) after timeout\n", +- __func__, free_slot); ++ if (ufshcd_clear_tm_cmd(hba, task_tag)) ++ dev_WARN(hba->dev, "%s: unable to clear tm cmd (slot %d) after timeout\n", ++ __func__, task_tag); + err = -ETIMEDOUT; + } else { + err = 0; +- memcpy(treq, hba->utmrdl_base_addr + free_slot, sizeof(*treq)); ++ memcpy(treq, hba->utmrdl_base_addr + task_tag, sizeof(*treq)); + + ufshcd_add_tm_upiu_trace(hba, task_tag, "tm_complete"); + } + + spin_lock_irqsave(hba->host->host_lock, flags); +- __clear_bit(free_slot, &hba->outstanding_tasks); ++ __clear_bit(task_tag, &hba->outstanding_tasks); + spin_unlock_irqrestore(hba->host->host_lock, flags); + ++ ufshcd_release(hba); + blk_put_request(req); + +- ufshcd_release(hba); + return err; + } + +-- +2.30.2 + diff --git a/queue-5.11/series b/queue-5.11/series index 6d3e29fffd0..a808b6a62f3 100644 --- a/queue-5.11/series +++ b/queue-5.11/series @@ -100,3 +100,90 @@ kvm-x86-mmu-preserve-pending-tlb-flush-across-calls-.patch net-sched-fix-err-handler-in-tcf_action_init.patch ice-refactor-dcb-related-variables-out-of-the-ice_po.patch ice-recognize-860-as-iscsi-port-in-cee-mode.patch +xfrm-interface-fix-ipv4-pmtu-check-to-honor-ip-heade.patch +xfrm-use-actual-socket-sk-instead-of-skb-socket-for-.patch +remoteproc-qcom-pil_info-avoid-64-bit-division.patch +regulator-bd9571mwv-fix-avs-and-dvfs-voltage-range.patch +arm-omap4-fix-pmic-voltage-domains-for-bionic.patch +arm-omap4-pm-update-rom-return-address-for-oswr-and-.patch +remoteproc-pru-fix-firmware-loading-crashes-on-k3-so.patch +net-xfrm-localize-sequence-counter-per-network-names.patch +esp-delete-netif_f_sctp_crc-bit-from-features-for-es.patch +asoc-sof-intel-hda-fix-core-status-verification.patch +asoc-wm8960-fix-wrong-bclk-and-lrclk-with-pll-enable.patch +xfrm-fix-null-pointer-dereference-on-policy-lookup.patch +virtchnl-fix-layout-of-rss-structures.patch +i40e-added-asym_pause-to-supported-link-modes.patch +i40e-fix-kernel-oops-when-i40e-driver-removes-vf-s.patch +hostfs-fix-memory-handling-in-follow_link.patch +amd-xgbe-update-dma-coherency-values.patch +vxlan-do-not-modify-the-shared-tunnel-info-when-pmtu.patch +geneve-do-not-modify-the-shared-tunnel-info-when-pmt.patch +sch_red-fix-off-by-one-checks-in-red_check_params.patch +drivers-net-wan-hdlc_fr-fix-a-double-free-in-pvc_xmi.patch +arm64-dts-imx8mm-q-fix-pad-control-of-sd1_data0.patch +xfrm-provide-private-skb-extensions-for-segmented-an.patch +can-bcm-raw-fix-msg_namelen-values-depending-on-can_.patch +can-isotp-fix-msg_namelen-values-depending-on-can_re.patch +can-uapi-can.h-mark-union-inside-struct-can_frame-pa.patch +mlxsw-spectrum-fix-ecn-marking-in-tunnel-decapsulati.patch +ethernet-myri10ge-fix-a-use-after-free-in-myri10ge_s.patch +gianfar-handle-error-code-at-mac-address-change.patch +net-dsa-fix-type-was-not-set-for-devlink-port.patch +clk-qcom-camcc-update-the-clock-ops-for-the-sc7180.patch +cxgb4-avoid-collecting-sge_qbase-regs-during-traffic.patch +net-tipc-fix-a-double-free-in-tipc_sk_mcast_rcv.patch +arm-dts-imx6-pbab01-set-vmmc-supply-for-both-sd-inte.patch +net-ncsi-avoid-channel_monitor-hrtimer-deadlock.patch +net-qrtr-fix-memory-leak-on-qrtr_tx_wait-failure.patch +nfp-flower-ignore-duplicate-merge-hints-from-fw.patch +net-phy-broadcom-only-advertise-eee-for-supported-mo.patch +i2c-jz4780-fix-bug-for-ingenic-x1000.patch +asoc-sunxi-sun4i-codec-fill-asoc-card-owner.patch +net-mlx5e-fix-mapping-of-ct_label-zero.patch +net-mlx5-delete-auxiliary-bus-driver-eth-rep-first.patch +net-mlx5e-fix-ethtool-indication-of-connector-type.patch +net-mlx5-don-t-request-more-than-supported-eqs.patch +net-mlx5e-guarantee-room-for-xsk-wakeup-nop-on-async.patch +net-rds-fix-a-use-after-free-in-rds_message_map_page.patch +xdp-fix-xdp_return_frame-kernel-bug-throw-for-page_p.patch +soc-fsl-qbman-fix-conflicting-alignment-attributes.patch +i40e-fix-receiving-of-single-packets-in-xsk-zero-cop.patch +i40e-fix-display-statistics-for-veb_tc.patch +rdma-rtrs-clt-close-rtrs-client-conn-before-destroyi.patch +drm-msm-set-drvdata-to-null-when-msm_drm_init-fails.patch +net-udp-add-support-for-getsockopt-.-.-udp_gro.patch +mptcp-forbit-mcast-related-sockopt-on-mptcp-sockets.patch +mptcp-revert-mptcp-provide-subflow-aware-release-fun.patch +scsi-ufs-core-fix-task-management-request-completion.patch +scsi-ufs-core-fix-wrong-task-tag-used-in-task-manage.patch +drm-msm-a6xx-fix-version-check-for-the-a650-sqe-micr.patch +drm-msm-disp-dpu1-program-3d_merge-only-if-block-is-.patch +revert-arm64-dts-marvell-armada-cp110-switch-to-per-.patch +arm-dts-turris-omnia-fix-hardware-buffer-management.patch +net-cls_api-fix-uninitialised-struct-field-bo-unlock.patch +net-macb-restore-cmp-registers-on-resume-path.patch +clk-fix-invalid-usage-of-list-cursor-in-register.patch +clk-fix-invalid-usage-of-list-cursor-in-unregister.patch +workqueue-move-the-position-of-debug_work_activate-i.patch +s390-cpcmd-fix-inline-assembly-register-clobbering.patch +perf-inject-fix-repipe-usage.patch +openvswitch-fix-send-of-uninitialized-stack-memory-i.patch +i2c-designware-adjust-bus_freq_hz-when-refuse-high-s.patch +iwlwifi-fix-11ax-disabled-bit-in-the-regulatory-capa.patch +can-mcp251x-fix-support-for-half-duplex-spi-host-con.patch +platform-x86-intel-hid-fix-spurious-wakeups-caused-b.patch +tipc-increment-the-tmp-aead-refcnt-before-attaching-.patch +net-hns3-clear-vf-down-state-bit-before-request-link.patch +net-mlx5-fix-hw-spec-violation-configuring-uplink.patch +net-mlx5-fix-placement-of-log_max_flow_counter.patch +net-mlx5-fix-pplm-register-mapping.patch +net-mlx5-fix-pbmc-register-mapping.patch +rdma-cxgb4-check-for-ipv6-address-properly-while-des.patch +perf-report-fix-wrong-lbr-block-sorting.patch +rdma-qedr-fix-kernel-panic-when-trying-to-access-rec.patch +drm-vc4-crtc-reduce-pv-fifo-threshold-on-hvs4.patch +i40e-fix-parameters-in-aq_get_phy_register.patch +rdma-addr-be-strict-with-gid-size.patch +vdpa-mlx5-should-exclude-header-length-and-fcs-from-.patch +vdpa-mlx5-fix-wrong-use-of-bit-numbers.patch diff --git a/queue-5.11/soc-fsl-qbman-fix-conflicting-alignment-attributes.patch b/queue-5.11/soc-fsl-qbman-fix-conflicting-alignment-attributes.patch new file mode 100644 index 00000000000..b47e77d8d1d --- /dev/null +++ b/queue-5.11/soc-fsl-qbman-fix-conflicting-alignment-attributes.patch @@ -0,0 +1,44 @@ +From b63231d3dee7ed9b6940cb53d4a0fbf039723411 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 14:15:23 +0100 +Subject: soc/fsl: qbman: fix conflicting alignment attributes + +From: Arnd Bergmann + +[ Upstream commit 040f31196e8b2609613f399793b9225271b79471 ] + +When building with W=1, gcc points out that the __packed attribute +on struct qm_eqcr_entry conflicts with the 8-byte alignment +attribute on struct qm_fd inside it: + +drivers/soc/fsl/qbman/qman.c:189:1: error: alignment 1 of 'struct qm_eqcr_entry' is less than 8 [-Werror=packed-not-aligned] + +I assume that the alignment attribute is the correct one, and +that qm_eqcr_entry cannot actually be unaligned in memory, +so add the same alignment on the outer struct. + +Fixes: c535e923bb97 ("soc/fsl: Introduce DPAA 1.x QMan device driver") +Signed-off-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20210323131530.2619900-1-arnd@kernel.org' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qbman/qman.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c +index a1b9be1d105a..fde4edd83c14 100644 +--- a/drivers/soc/fsl/qbman/qman.c ++++ b/drivers/soc/fsl/qbman/qman.c +@@ -186,7 +186,7 @@ struct qm_eqcr_entry { + __be32 tag; + struct qm_fd fd; + u8 __reserved3[32]; +-} __packed; ++} __packed __aligned(8); + #define QM_EQCR_VERB_VBIT 0x80 + #define QM_EQCR_VERB_CMD_MASK 0x61 /* but only one value; */ + #define QM_EQCR_VERB_CMD_ENQUEUE 0x01 +-- +2.30.2 + diff --git a/queue-5.11/tipc-increment-the-tmp-aead-refcnt-before-attaching-.patch b/queue-5.11/tipc-increment-the-tmp-aead-refcnt-before-attaching-.patch new file mode 100644 index 00000000000..7cefef215af --- /dev/null +++ b/queue-5.11/tipc-increment-the-tmp-aead-refcnt-before-attaching-.patch @@ -0,0 +1,65 @@ +From 549c289fb413b4fa538903dd53d0b329b2b6f480 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 10:45:23 +0800 +Subject: tipc: increment the tmp aead refcnt before attaching it + +From: Xin Long + +[ Upstream commit 2a2403ca3add03f542f6b34bef9f74649969b06d ] + +Li Shuang found a NULL pointer dereference crash in her testing: + + [] BUG: unable to handle kernel NULL pointer dereference at 0000000000000020 + [] RIP: 0010:tipc_crypto_rcv_complete+0xc8/0x7e0 [tipc] + [] Call Trace: + [] + [] tipc_crypto_rcv+0x2d9/0x8f0 [tipc] + [] tipc_rcv+0x2fc/0x1120 [tipc] + [] tipc_udp_recv+0xc6/0x1e0 [tipc] + [] udpv6_queue_rcv_one_skb+0x16a/0x460 + [] udp6_unicast_rcv_skb.isra.35+0x41/0xa0 + [] ip6_protocol_deliver_rcu+0x23b/0x4c0 + [] ip6_input+0x3d/0xb0 + [] ipv6_rcv+0x395/0x510 + [] __netif_receive_skb_core+0x5fc/0xc40 + +This is caused by NULL returned by tipc_aead_get(), and then crashed when +dereferencing it later in tipc_crypto_rcv_complete(). This might happen +when tipc_crypto_rcv_complete() is called by two threads at the same time: +the tmp attached by tipc_crypto_key_attach() in one thread may be released +by the one attached by that in the other thread. + +This patch is to fix it by incrementing the tmp's refcnt before attaching +it instead of calling tipc_aead_get() after attaching it. + +Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") +Reported-by: Li Shuang +Signed-off-by: Xin Long +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/crypto.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c +index f4fca8f7f63f..97710ce36047 100644 +--- a/net/tipc/crypto.c ++++ b/net/tipc/crypto.c +@@ -1941,12 +1941,13 @@ static void tipc_crypto_rcv_complete(struct net *net, struct tipc_aead *aead, + goto rcv; + if (tipc_aead_clone(&tmp, aead) < 0) + goto rcv; ++ WARN_ON(!refcount_inc_not_zero(&tmp->refcnt)); + if (tipc_crypto_key_attach(rx, tmp, ehdr->tx_key, false) < 0) { + tipc_aead_free(&tmp->rcu); + goto rcv; + } + tipc_aead_put(aead); +- aead = tipc_aead_get(tmp); ++ aead = tmp; + } + + if (unlikely(err)) { +-- +2.30.2 + diff --git a/queue-5.11/vdpa-mlx5-fix-wrong-use-of-bit-numbers.patch b/queue-5.11/vdpa-mlx5-fix-wrong-use-of-bit-numbers.patch new file mode 100644 index 00000000000..185b52ff967 --- /dev/null +++ b/queue-5.11/vdpa-mlx5-fix-wrong-use-of-bit-numbers.patch @@ -0,0 +1,50 @@ +From d70b6f9d420c2176912b8615bc7a070cb1d56766 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 12:10:46 +0300 +Subject: vdpa/mlx5: Fix wrong use of bit numbers + +From: Eli Cohen + +[ Upstream commit 4b454a82418dd76d8c0590bb3f7a99a63ea57dc5 ] + +VIRTIO_F_VERSION_1 is a bit number. Use BIT_ULL() with mask +conditionals. + +Also, in mlx5_vdpa_is_little_endian() use BIT_ULL for consistency with +the rest of the code. + +Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices") +Signed-off-by: Eli Cohen +Link: https://lore.kernel.org/r/20210408091047.4269-5-elic@nvidia.com +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/net/mlx5_vnet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index 067c3977ea8e..ac6be2d722bb 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -820,7 +820,7 @@ static int create_virtqueue(struct mlx5_vdpa_net *ndev, struct mlx5_vdpa_virtque + MLX5_SET(virtio_q, vq_ctx, event_qpn_or_msix, mvq->fwqp.mqp.qpn); + MLX5_SET(virtio_q, vq_ctx, queue_size, mvq->num_ent); + MLX5_SET(virtio_q, vq_ctx, virtio_version_1_0, +- !!(ndev->mvdev.actual_features & VIRTIO_F_VERSION_1)); ++ !!(ndev->mvdev.actual_features & BIT_ULL(VIRTIO_F_VERSION_1))); + MLX5_SET64(virtio_q, vq_ctx, desc_addr, mvq->desc_addr); + MLX5_SET64(virtio_q, vq_ctx, used_addr, mvq->device_addr); + MLX5_SET64(virtio_q, vq_ctx, available_addr, mvq->driver_addr); +@@ -1550,7 +1550,7 @@ static void teardown_virtqueues(struct mlx5_vdpa_net *ndev) + static inline bool mlx5_vdpa_is_little_endian(struct mlx5_vdpa_dev *mvdev) + { + return virtio_legacy_is_little_endian() || +- (mvdev->actual_features & (1ULL << VIRTIO_F_VERSION_1)); ++ (mvdev->actual_features & BIT_ULL(VIRTIO_F_VERSION_1)); + } + + static __virtio16 cpu_to_mlx5vdpa16(struct mlx5_vdpa_dev *mvdev, u16 val) +-- +2.30.2 + diff --git a/queue-5.11/vdpa-mlx5-should-exclude-header-length-and-fcs-from-.patch b/queue-5.11/vdpa-mlx5-should-exclude-header-length-and-fcs-from-.patch new file mode 100644 index 00000000000..e55d7635d42 --- /dev/null +++ b/queue-5.11/vdpa-mlx5-should-exclude-header-length-and-fcs-from-.patch @@ -0,0 +1,84 @@ +From 7ba4e24f69c1798c93f522ffaad73387a9cb8621 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 12:10:43 +0300 +Subject: vdpa/mlx5: should exclude header length and fcs from mtu + +From: Si-Wei Liu + +[ Upstream commit d084d996aaf53c0cc583dc75a4fc2a67fe485846 ] + +When feature VIRTIO_NET_F_MTU is negotiated on mlx5_vdpa, +22 extra bytes worth of MTU length is shown in guest. +This is because the mlx5_query_port_max_mtu API returns +the "hardware" MTU value, which does not just contain the + Ethernet payload, but includes extra lengths starting +from the Ethernet header up to the FCS altogether. + +Fix the MTU so packets won't get dropped silently. + +Fixes: 1a86b377aa21 ("vdpa/mlx5: Add VDPA driver for supported mlx5 devices") +Signed-off-by: Si-Wei Liu +Acked-by: Jason Wang +Acked-by: Eli Cohen +Link: https://lore.kernel.org/r/20210408091047.4269-2-elic@nvidia.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/vdpa/mlx5/core/mlx5_vdpa.h | 4 ++++ + drivers/vdpa/mlx5/net/mlx5_vnet.c | 15 ++++++++++++++- + 2 files changed, 18 insertions(+), 1 deletion(-) + +diff --git a/drivers/vdpa/mlx5/core/mlx5_vdpa.h b/drivers/vdpa/mlx5/core/mlx5_vdpa.h +index 08f742fd2409..b6cc53ba980c 100644 +--- a/drivers/vdpa/mlx5/core/mlx5_vdpa.h ++++ b/drivers/vdpa/mlx5/core/mlx5_vdpa.h +@@ -4,9 +4,13 @@ + #ifndef __MLX5_VDPA_H__ + #define __MLX5_VDPA_H__ + ++#include ++#include + #include + #include + ++#define MLX5V_ETH_HARD_MTU (ETH_HLEN + VLAN_HLEN + ETH_FCS_LEN) ++ + struct mlx5_vdpa_direct_mr { + u64 start; + u64 end; +diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c +index 09158f04fd6e..067c3977ea8e 100644 +--- a/drivers/vdpa/mlx5/net/mlx5_vnet.c ++++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c +@@ -1902,6 +1902,19 @@ static const struct vdpa_config_ops mlx5_vdpa_ops = { + .free = mlx5_vdpa_free, + }; + ++static int query_mtu(struct mlx5_core_dev *mdev, u16 *mtu) ++{ ++ u16 hw_mtu; ++ int err; ++ ++ err = mlx5_query_nic_vport_mtu(mdev, &hw_mtu); ++ if (err) ++ return err; ++ ++ *mtu = hw_mtu - MLX5V_ETH_HARD_MTU; ++ return 0; ++} ++ + static int alloc_resources(struct mlx5_vdpa_net *ndev) + { + struct mlx5_vdpa_net_resources *res = &ndev->res; +@@ -1987,7 +2000,7 @@ static int mlx5v_probe(struct auxiliary_device *adev, + init_mvqs(ndev); + mutex_init(&ndev->reslock); + config = &ndev->config; +- err = mlx5_query_nic_vport_mtu(mdev, &ndev->mtu); ++ err = query_mtu(mdev, &ndev->mtu); + if (err) + goto err_mtu; + +-- +2.30.2 + diff --git a/queue-5.11/virtchnl-fix-layout-of-rss-structures.patch b/queue-5.11/virtchnl-fix-layout-of-rss-structures.patch new file mode 100644 index 00000000000..7997e55c09a --- /dev/null +++ b/queue-5.11/virtchnl-fix-layout-of-rss-structures.patch @@ -0,0 +1,45 @@ +From f458e2611839010345646af1741a1c66beb22ca2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Jan 2021 10:17:02 -0800 +Subject: virtchnl: Fix layout of RSS structures + +From: Norbert Ciosek + +[ Upstream commit 22f8b5df881e9f1302514bbbbbb8649c2051de55 ] + +Remove padding from RSS structures. Previous layout +could lead to unwanted compiler optimizations +in loops when iterating over key and lut arrays. + +Fixes: 65ece6de0114 ("virtchnl: Add missing explicit padding to structures") +Signed-off-by: Norbert Ciosek +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + include/linux/avf/virtchnl.h | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/include/linux/avf/virtchnl.h b/include/linux/avf/virtchnl.h +index 40bad71865ea..532bcbfc4716 100644 +--- a/include/linux/avf/virtchnl.h ++++ b/include/linux/avf/virtchnl.h +@@ -476,7 +476,6 @@ struct virtchnl_rss_key { + u16 vsi_id; + u16 key_len; + u8 key[1]; /* RSS hash key, packed bytes */ +- u8 pad[1]; + }; + + VIRTCHNL_CHECK_STRUCT_LEN(6, virtchnl_rss_key); +@@ -485,7 +484,6 @@ struct virtchnl_rss_lut { + u16 vsi_id; + u16 lut_entries; + u8 lut[1]; /* RSS lookup table */ +- u8 pad[1]; + }; + + VIRTCHNL_CHECK_STRUCT_LEN(6, virtchnl_rss_lut); +-- +2.30.2 + diff --git a/queue-5.11/vxlan-do-not-modify-the-shared-tunnel-info-when-pmtu.patch b/queue-5.11/vxlan-do-not-modify-the-shared-tunnel-info-when-pmtu.patch new file mode 100644 index 00000000000..9c571d44c3f --- /dev/null +++ b/queue-5.11/vxlan-do-not-modify-the-shared-tunnel-info-when-pmtu.patch @@ -0,0 +1,83 @@ +From f90c5aafbcc6145350160c1ed5ba7f83339660cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 16:35:32 +0100 +Subject: vxlan: do not modify the shared tunnel info when PMTU triggers an + ICMP reply + +From: Antoine Tenart + +[ Upstream commit 30a93d2b7d5a7cbb53ac19c9364a256d1aa6c08a ] + +When the interface is part of a bridge or an Open vSwitch port and a +packet exceed a PMTU estimate, an ICMP reply is sent to the sender. When +using the external mode (collect metadata) the source and destination +addresses are reversed, so that Open vSwitch can match the packet +against an existing (reverse) flow. + +But inverting the source and destination addresses in the shared +ip_tunnel_info will make following packets of the flow to use a wrong +destination address (packets will be tunnelled to itself), if the flow +isn't updated. Which happens with Open vSwitch, until the flow times +out. + +Fixes this by uncloning the skb's ip_tunnel_info before inverting its +source and destination addresses, so that the modification will only be +made for the PTMU packet, not the following ones. + +Fixes: fc68c99577cc ("vxlan: Support for PMTU discovery on directly bridged links") +Tested-by: Eelco Chaudron +Reviewed-by: Eelco Chaudron +Signed-off-by: Antoine Tenart +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/vxlan.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 0842371eca3d..4adfa6a01198 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2725,12 +2725,17 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + goto tx_error; + } else if (err) { + if (info) { ++ struct ip_tunnel_info *unclone; + struct in_addr src, dst; + ++ unclone = skb_tunnel_info_unclone(skb); ++ if (unlikely(!unclone)) ++ goto tx_error; ++ + src = remote_ip.sin.sin_addr; + dst = local_ip.sin.sin_addr; +- info->key.u.ipv4.src = src.s_addr; +- info->key.u.ipv4.dst = dst.s_addr; ++ unclone->key.u.ipv4.src = src.s_addr; ++ unclone->key.u.ipv4.dst = dst.s_addr; + } + vxlan_encap_bypass(skb, vxlan, vxlan, vni, false); + dst_release(ndst); +@@ -2781,12 +2786,17 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + goto tx_error; + } else if (err) { + if (info) { ++ struct ip_tunnel_info *unclone; + struct in6_addr src, dst; + ++ unclone = skb_tunnel_info_unclone(skb); ++ if (unlikely(!unclone)) ++ goto tx_error; ++ + src = remote_ip.sin6.sin6_addr; + dst = local_ip.sin6.sin6_addr; +- info->key.u.ipv6.src = src; +- info->key.u.ipv6.dst = dst; ++ unclone->key.u.ipv6.src = src; ++ unclone->key.u.ipv6.dst = dst; + } + + vxlan_encap_bypass(skb, vxlan, vxlan, vni, false); +-- +2.30.2 + diff --git a/queue-5.11/workqueue-move-the-position-of-debug_work_activate-i.patch b/queue-5.11/workqueue-move-the-position-of-debug_work_activate-i.patch new file mode 100644 index 00000000000..f1659a7c6d8 --- /dev/null +++ b/queue-5.11/workqueue-move-the-position-of-debug_work_activate-i.patch @@ -0,0 +1,46 @@ +From 4c3462c3458e16244fa4353ef7871878f95f1b44 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Feb 2021 11:16:49 +0800 +Subject: workqueue: Move the position of debug_work_activate() in + __queue_work() + +From: Zqiang + +[ Upstream commit 0687c66b5f666b5ad433f4e94251590d9bc9d10e ] + +The debug_work_activate() is called on the premise that +the work can be inserted, because if wq be in WQ_DRAINING +status, insert work may be failed. + +Fixes: e41e704bc4f4 ("workqueue: improve destroy_workqueue() debuggability") +Signed-off-by: Zqiang +Reviewed-by: Lai Jiangshan +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/workqueue.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 894bb885b40b..6326a872510b 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1412,7 +1412,6 @@ static void __queue_work(int cpu, struct workqueue_struct *wq, + */ + lockdep_assert_irqs_disabled(); + +- debug_work_activate(work); + + /* if draining, only works from the same workqueue are allowed */ + if (unlikely(wq->flags & __WQ_DRAINING) && +@@ -1494,6 +1493,7 @@ retry: + worklist = &pwq->delayed_works; + } + ++ debug_work_activate(work); + insert_work(pwq, work, worklist, work_flags); + + out: +-- +2.30.2 + diff --git a/queue-5.11/xdp-fix-xdp_return_frame-kernel-bug-throw-for-page_p.patch b/queue-5.11/xdp-fix-xdp_return_frame-kernel-bug-throw-for-page_p.patch new file mode 100644 index 00000000000..c32d66a200e --- /dev/null +++ b/queue-5.11/xdp-fix-xdp_return_frame-kernel-bug-throw-for-page_p.patch @@ -0,0 +1,51 @@ +From 3285b223c5f18c2f733945102b5b8bd0158c471a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 21:25:03 +0800 +Subject: xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory + model + +From: Ong Boon Leong + +[ Upstream commit 622d13694b5f048c01caa7ba548498d9880d4cb0 ] + +xdp_return_frame() may be called outside of NAPI context to return +xdpf back to page_pool. xdp_return_frame() calls __xdp_return() with +napi_direct = false. For page_pool memory model, __xdp_return() calls +xdp_return_frame_no_direct() unconditionally and below false negative +kernel BUG throw happened under preempt-rt build: + +[ 430.450355] BUG: using smp_processor_id() in preemptible [00000000] code: modprobe/3884 +[ 430.451678] caller is __xdp_return+0x1ff/0x2e0 +[ 430.452111] CPU: 0 PID: 3884 Comm: modprobe Tainted: G U E 5.12.0-rc2+ #45 + +Changes in v2: + - This patch fixes the issue by making xdp_return_frame_no_direct() is + only called if napi_direct = true, as recommended for better by + Jesper Dangaard Brouer. Thanks! + +Fixes: 2539650fadbf ("xdp: Helpers for disabling napi_direct of xdp_return_frame") +Signed-off-by: Ong Boon Leong +Acked-by: Jesper Dangaard Brouer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/xdp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/core/xdp.c b/net/core/xdp.c +index 3a8c9ab4ecbe..a86bc3660729 100644 +--- a/net/core/xdp.c ++++ b/net/core/xdp.c +@@ -350,7 +350,8 @@ static void __xdp_return(void *data, struct xdp_mem_info *mem, bool napi_direct, + /* mem->id is valid, checked in xdp_rxq_info_reg_mem_model() */ + xa = rhashtable_lookup(mem_id_ht, &mem->id, mem_id_rht_params); + page = virt_to_head_page(data); +- napi_direct &= !xdp_return_frame_no_direct(); ++ if (napi_direct && xdp_return_frame_no_direct()) ++ napi_direct = false; + page_pool_put_full_page(xa->page_pool, page, napi_direct); + rcu_read_unlock(); + break; +-- +2.30.2 + diff --git a/queue-5.11/xfrm-fix-null-pointer-dereference-on-policy-lookup.patch b/queue-5.11/xfrm-fix-null-pointer-dereference-on-policy-lookup.patch new file mode 100644 index 00000000000..693c626f36d --- /dev/null +++ b/queue-5.11/xfrm-fix-null-pointer-dereference-on-policy-lookup.patch @@ -0,0 +1,40 @@ +From 0d732a45102674ee73a65754cc0a339f33264763 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Mar 2021 09:26:44 +0100 +Subject: xfrm: Fix NULL pointer dereference on policy lookup + +From: Steffen Klassert + +[ Upstream commit b1e3a5607034aa0a481c6f69a6893049406665fb ] + +When xfrm interfaces are used in combination with namespaces +and ESP offload, we get a dst_entry NULL pointer dereference. +This is because we don't have a dst_entry attached in the ESP +offloading case and we need to do a policy lookup before the +namespace transition. + +Fix this by expicit checking of skb_dst(skb) before accessing it. + +Fixes: f203b76d78092 ("xfrm: Add virtual xfrm interfaces") +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + include/net/xfrm.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index bfbc7810df94..c58a6d4eb610 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1097,7 +1097,7 @@ static inline int __xfrm_policy_check2(struct sock *sk, int dir, + return __xfrm_policy_check(sk, ndir, skb, family); + + return (!net->xfrm.policy_count[dir] && !secpath_exists(skb)) || +- (skb_dst(skb)->flags & DST_NOPOLICY) || ++ (skb_dst(skb) && (skb_dst(skb)->flags & DST_NOPOLICY)) || + __xfrm_policy_check(sk, ndir, skb, family); + } + +-- +2.30.2 + diff --git a/queue-5.11/xfrm-interface-fix-ipv4-pmtu-check-to-honor-ip-heade.patch b/queue-5.11/xfrm-interface-fix-ipv4-pmtu-check-to-honor-ip-heade.patch new file mode 100644 index 00000000000..3f52b1f38e6 --- /dev/null +++ b/queue-5.11/xfrm-interface-fix-ipv4-pmtu-check-to-honor-ip-heade.patch @@ -0,0 +1,48 @@ +From a8e26bf654d5310e9ae39416d59e9aa9c5723635 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Feb 2021 15:01:15 +0200 +Subject: xfrm: interface: fix ipv4 pmtu check to honor ip header df + +From: Eyal Birger + +[ Upstream commit 8fc0e3b6a8666d656923d214e4dc791e9a17164a ] + +Frag needed should only be sent if the header enables DF. + +This fix allows packets larger than MTU to pass the xfrm interface +and be fragmented after encapsulation, aligning behavior with +non-interface xfrm. + +Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces") +Signed-off-by: Eyal Birger +Reviewed-by: Sabrina Dubroca +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_interface.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c +index 697cdcfbb5e1..3f42c2f15ba4 100644 +--- a/net/xfrm/xfrm_interface.c ++++ b/net/xfrm/xfrm_interface.c +@@ -305,6 +305,8 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + + icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); + } else { ++ if (!(ip_hdr(skb)->frag_off & htons(IP_DF))) ++ goto xmit; + icmp_ndo_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(mtu)); + } +@@ -313,6 +315,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + return -EMSGSIZE; + } + ++xmit: + xfrmi_scrub_packet(skb, !net_eq(xi->net, dev_net(dev))); + skb_dst_set(skb, dst); + skb->dev = tdev; +-- +2.30.2 + diff --git a/queue-5.11/xfrm-provide-private-skb-extensions-for-segmented-an.patch b/queue-5.11/xfrm-provide-private-skb-extensions-for-segmented-an.patch new file mode 100644 index 00000000000..1f30a540859 --- /dev/null +++ b/queue-5.11/xfrm-provide-private-skb-extensions-for-segmented-an.patch @@ -0,0 +1,90 @@ +From ac5a9a34dd93e9ec7a65d27688ceaa81a64890d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 09:44:48 +0100 +Subject: xfrm: Provide private skb extensions for segmented and hw offloaded + ESP packets + +From: Steffen Klassert + +[ Upstream commit c7dbf4c08868d9db89b8bfe8f8245ca61b01ed2f ] + +Commit 94579ac3f6d0 ("xfrm: Fix double ESP trailer insertion in IPsec +crypto offload.") added a XFRM_XMIT flag to avoid duplicate ESP trailer +insertion on HW offload. This flag is set on the secpath that is shared +amongst segments. This lead to a situation where some segments are +not transformed correctly when segmentation happens at layer 3. + +Fix this by using private skb extensions for segmented and hw offloaded +ESP packets. + +Fixes: 94579ac3f6d0 ("xfrm: Fix double ESP trailer insertion in IPsec crypto offload.") +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/ipv4/esp4_offload.c | 11 ++++++++++- + net/ipv6/esp6_offload.c | 11 ++++++++++- + net/xfrm/xfrm_device.c | 2 -- + 3 files changed, 20 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c +index d5c0f5a2a551..5aa7344dbec7 100644 +--- a/net/ipv4/esp4_offload.c ++++ b/net/ipv4/esp4_offload.c +@@ -314,8 +314,17 @@ static int esp_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features_ + ip_hdr(skb)->tot_len = htons(skb->len); + ip_send_check(ip_hdr(skb)); + +- if (hw_offload) ++ if (hw_offload) { ++ if (!skb_ext_add(skb, SKB_EXT_SEC_PATH)) ++ return -ENOMEM; ++ ++ xo = xfrm_offload(skb); ++ if (!xo) ++ return -EINVAL; ++ ++ xo->flags |= XFRM_XMIT; + return 0; ++ } + + err = esp_output_tail(x, skb, &esp); + if (err) +diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c +index f35203ab39f5..4af56affaafd 100644 +--- a/net/ipv6/esp6_offload.c ++++ b/net/ipv6/esp6_offload.c +@@ -348,8 +348,17 @@ static int esp6_xmit(struct xfrm_state *x, struct sk_buff *skb, netdev_features + + ipv6_hdr(skb)->payload_len = htons(len); + +- if (hw_offload) ++ if (hw_offload) { ++ if (!skb_ext_add(skb, SKB_EXT_SEC_PATH)) ++ return -ENOMEM; ++ ++ xo = xfrm_offload(skb); ++ if (!xo) ++ return -EINVAL; ++ ++ xo->flags |= XFRM_XMIT; + return 0; ++ } + + err = esp6_output_tail(x, skb, &esp); + if (err) +diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c +index edf11893dbe8..6d6917b68856 100644 +--- a/net/xfrm/xfrm_device.c ++++ b/net/xfrm/xfrm_device.c +@@ -134,8 +134,6 @@ struct sk_buff *validate_xmit_xfrm(struct sk_buff *skb, netdev_features_t featur + return skb; + } + +- xo->flags |= XFRM_XMIT; +- + if (skb_is_gso(skb) && unlikely(x->xso.dev != dev)) { + struct sk_buff *segs; + +-- +2.30.2 + diff --git a/queue-5.11/xfrm-use-actual-socket-sk-instead-of-skb-socket-for-.patch b/queue-5.11/xfrm-use-actual-socket-sk-instead-of-skb-socket-for-.patch new file mode 100644 index 00000000000..74ace24264b --- /dev/null +++ b/queue-5.11/xfrm-use-actual-socket-sk-instead-of-skb-socket-for-.patch @@ -0,0 +1,152 @@ +From dc0d68728802a936f8758465addd2a0f7a3048b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 2 Mar 2021 08:00:04 +1300 +Subject: xfrm: Use actual socket sk instead of skb socket for + xfrm_output_resume + +From: Evan Nimmo + +[ Upstream commit 9ab1265d52314fce1b51e8665ea6dbc9ac1a027c ] + +A situation can occur where the interface bound to the sk is different +to the interface bound to the sk attached to the skb. The interface +bound to the sk is the correct one however this information is lost inside +xfrm_output2 and instead the sk on the skb is used in xfrm_output_resume +instead. This assumes that the sk bound interface and the bound interface +attached to the sk within the skb are the same which can lead to lookup +failures inside ip_route_me_harder resulting in the packet being dropped. + +We have an l2tp v3 tunnel with ipsec protection. The tunnel is in the +global VRF however we have an encapsulated dot1q tunnel interface that +is within a different VRF. We also have a mangle rule that marks the +packets causing them to be processed inside ip_route_me_harder. + +Prior to commit 31c70d5956fc ("l2tp: keep original skb ownership") this +worked fine as the sk attached to the skb was changed from the dot1q +encapsulated interface to the sk for the tunnel which meant the interface +bound to the sk and the interface bound to the skb were identical. +Commit 46d6c5ae953c ("netfilter: use actual socket sk rather than skb sk +when routing harder") fixed some of these issues however a similar +problem existed in the xfrm code. + +Fixes: 31c70d5956fc ("l2tp: keep original skb ownership") +Signed-off-by: Evan Nimmo +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + include/net/xfrm.h | 2 +- + net/ipv4/ah4.c | 2 +- + net/ipv4/esp4.c | 2 +- + net/ipv6/ah6.c | 2 +- + net/ipv6/esp6.c | 2 +- + net/xfrm/xfrm_output.c | 10 +++++----- + 6 files changed, 10 insertions(+), 10 deletions(-) + +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index b2a06f10b62c..bfbc7810df94 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1557,7 +1557,7 @@ int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, + int xfrm_trans_queue(struct sk_buff *skb, + int (*finish)(struct net *, struct sock *, + struct sk_buff *)); +-int xfrm_output_resume(struct sk_buff *skb, int err); ++int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err); + int xfrm_output(struct sock *sk, struct sk_buff *skb); + + #if IS_ENABLED(CONFIG_NET_PKTGEN) +diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c +index d99e1be94019..36ed85bf2ad5 100644 +--- a/net/ipv4/ah4.c ++++ b/net/ipv4/ah4.c +@@ -141,7 +141,7 @@ static void ah_output_done(struct crypto_async_request *base, int err) + } + + kfree(AH_SKB_CB(skb)->tmp); +- xfrm_output_resume(skb, err); ++ xfrm_output_resume(skb->sk, skb, err); + } + + static int ah_output(struct xfrm_state *x, struct sk_buff *skb) +diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c +index a3271ec3e162..4b834bbf95e0 100644 +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -279,7 +279,7 @@ static void esp_output_done(struct crypto_async_request *base, int err) + x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) + esp_output_tail_tcp(x, skb); + else +- xfrm_output_resume(skb, err); ++ xfrm_output_resume(skb->sk, skb, err); + } + } + +diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c +index 440080da805b..080ee7f44c64 100644 +--- a/net/ipv6/ah6.c ++++ b/net/ipv6/ah6.c +@@ -316,7 +316,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err) + } + + kfree(AH_SKB_CB(skb)->tmp); +- xfrm_output_resume(skb, err); ++ xfrm_output_resume(skb->sk, skb, err); + } + + static int ah6_output(struct xfrm_state *x, struct sk_buff *skb) +diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c +index 2b804fcebcc6..4071cb7c7a15 100644 +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -314,7 +314,7 @@ static void esp_output_done(struct crypto_async_request *base, int err) + x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) + esp_output_tail_tcp(x, skb); + else +- xfrm_output_resume(skb, err); ++ xfrm_output_resume(skb->sk, skb, err); + } + } + +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index a7ab19353313..b81ca117dac7 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -503,22 +503,22 @@ out: + return err; + } + +-int xfrm_output_resume(struct sk_buff *skb, int err) ++int xfrm_output_resume(struct sock *sk, struct sk_buff *skb, int err) + { + struct net *net = xs_net(skb_dst(skb)->xfrm); + + while (likely((err = xfrm_output_one(skb, err)) == 0)) { + nf_reset_ct(skb); + +- err = skb_dst(skb)->ops->local_out(net, skb->sk, skb); ++ err = skb_dst(skb)->ops->local_out(net, sk, skb); + if (unlikely(err != 1)) + goto out; + + if (!skb_dst(skb)->xfrm) +- return dst_output(net, skb->sk, skb); ++ return dst_output(net, sk, skb); + + err = nf_hook(skb_dst(skb)->ops->family, +- NF_INET_POST_ROUTING, net, skb->sk, skb, ++ NF_INET_POST_ROUTING, net, sk, skb, + NULL, skb_dst(skb)->dev, xfrm_output2); + if (unlikely(err != 1)) + goto out; +@@ -534,7 +534,7 @@ EXPORT_SYMBOL_GPL(xfrm_output_resume); + + static int xfrm_output2(struct net *net, struct sock *sk, struct sk_buff *skb) + { +- return xfrm_output_resume(skb, 1); ++ return xfrm_output_resume(sk, skb, 1); + } + + static int xfrm_output_gso(struct net *net, struct sock *sk, struct sk_buff *skb) +-- +2.30.2 + -- 2.47.3