From: Sasha Levin Date: Fri, 11 Jun 2021 02:13:08 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.4.273~58 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=1d0f598030367827df65111cefd9aded97609537;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch b/queue-5.4/asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch new file mode 100644 index 00000000000..788c1e192bc --- /dev/null +++ b/queue-5.4/asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch @@ -0,0 +1,47 @@ +From 62e119ef20190630e9a66fcee92d973a0c3d77eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 17:01:45 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet + +From: Hans de Goede + +[ Upstream commit 28c268d3acdd4cbcd2ac320b85609e77f84e74a7 ] + +Add a quirk for the Glavey TM800A550L tablet, this BYTCR tablet has no CHAN +package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which +is the default for BYTCR devices. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210508150146.28403-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 46a81d4f0b2d..1e6c86f2306f 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -568,6 +568,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Glavey TM800A550L */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), ++ /* Above strings are too generic, also match on BIOS version */ ++ DMI_MATCH(DMI_BIOS_VERSION, "ZY-8-BI-PX4S70VTR400-X423B-005-D"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), +-- +2.30.2 + diff --git a/queue-5.4/asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch b/queue-5.4/asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch new file mode 100644 index 00000000000..5355b388c19 --- /dev/null +++ b/queue-5.4/asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch @@ -0,0 +1,49 @@ +From 49389b83b1fcce2b1bc5d9bd10d7f9f6bdd31c29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 17:01:46 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet + +From: Hans de Goede + +[ Upstream commit f0353e1f53f92f7b3da91e6669f5d58ee222ebe8 ] + +The Lenovo Miix 3-830 tablet has only 1 speaker, has an internal analog +mic on IN1 and uses JD2 for jack-detect, add a quirk to automatically +apply these settings on Lenovo Miix 3-830 tablets. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210508150146.28403-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 1e6c86f2306f..c67b86e2d0c0 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -646,6 +646,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_MONO_SPEAKER | + BYT_RT5640_MCLK_EN), + }, ++ { /* Lenovo Miix 3-830 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 3-830"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_IN1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_MONO_SPEAKER | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* Linx Linx7 tablet */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LINX"), +-- +2.30.2 + diff --git a/queue-5.4/asoc-max98088-fix-ni-clock-divider-calculation.patch b/queue-5.4/asoc-max98088-fix-ni-clock-divider-calculation.patch new file mode 100644 index 00000000000..0be450fa59c --- /dev/null +++ b/queue-5.4/asoc-max98088-fix-ni-clock-divider-calculation.patch @@ -0,0 +1,88 @@ +From e74991eea652877bbae3cf52880e52319ddae4af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 15:54:02 +0200 +Subject: ASoC: max98088: fix ni clock divider calculation + +From: Marco Felsch + +[ Upstream commit 6c9762a78c325107dc37d20ee21002b841679209 ] + +The ni1/ni2 ratio formula [1] uses the pclk which is the prescaled mclk. +The max98088 datasheet [2] has no such formula but table-12 equals so +we can assume that it is the same for both devices. + +While on it make use of DIV_ROUND_CLOSEST_ULL(). + +[1] https://datasheets.maximintegrated.com/en/ds/MAX98089.pdf; page 86 +[2] https://datasheets.maximintegrated.com/en/ds/MAX98088.pdf; page 82 + +Signed-off-by: Marco Felsch +Link: https://lore.kernel.org/r/20210423135402.32105-1-m.felsch@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98088.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c +index f031d2caa8b7..fa4cdbfd0b80 100644 +--- a/sound/soc/codecs/max98088.c ++++ b/sound/soc/codecs/max98088.c +@@ -41,6 +41,7 @@ struct max98088_priv { + enum max98088_type devtype; + struct max98088_pdata *pdata; + struct clk *mclk; ++ unsigned char mclk_prescaler; + unsigned int sysclk; + struct max98088_cdata dai[2]; + int eq_textcnt; +@@ -998,13 +999,16 @@ static int max98088_dai1_hw_params(struct snd_pcm_substream *substream, + /* Configure NI when operating as master */ + if (snd_soc_component_read32(component, M98088_REG_14_DAI1_FORMAT) + & M98088_DAI_MAS) { ++ unsigned long pclk; ++ + if (max98088->sysclk == 0) { + dev_err(component->dev, "Invalid system clock frequency\n"); + return -EINVAL; + } + ni = 65536ULL * (rate < 50000 ? 96ULL : 48ULL) + * (unsigned long long int)rate; +- do_div(ni, (unsigned long long int)max98088->sysclk); ++ pclk = DIV_ROUND_CLOSEST(max98088->sysclk, max98088->mclk_prescaler); ++ ni = DIV_ROUND_CLOSEST_ULL(ni, pclk); + snd_soc_component_write(component, M98088_REG_12_DAI1_CLKCFG_HI, + (ni >> 8) & 0x7F); + snd_soc_component_write(component, M98088_REG_13_DAI1_CLKCFG_LO, +@@ -1065,13 +1069,16 @@ static int max98088_dai2_hw_params(struct snd_pcm_substream *substream, + /* Configure NI when operating as master */ + if (snd_soc_component_read32(component, M98088_REG_1C_DAI2_FORMAT) + & M98088_DAI_MAS) { ++ unsigned long pclk; ++ + if (max98088->sysclk == 0) { + dev_err(component->dev, "Invalid system clock frequency\n"); + return -EINVAL; + } + ni = 65536ULL * (rate < 50000 ? 96ULL : 48ULL) + * (unsigned long long int)rate; +- do_div(ni, (unsigned long long int)max98088->sysclk); ++ pclk = DIV_ROUND_CLOSEST(max98088->sysclk, max98088->mclk_prescaler); ++ ni = DIV_ROUND_CLOSEST_ULL(ni, pclk); + snd_soc_component_write(component, M98088_REG_1A_DAI2_CLKCFG_HI, + (ni >> 8) & 0x7F); + snd_soc_component_write(component, M98088_REG_1B_DAI2_CLKCFG_LO, +@@ -1113,8 +1120,10 @@ static int max98088_dai_set_sysclk(struct snd_soc_dai *dai, + */ + if ((freq >= 10000000) && (freq < 20000000)) { + snd_soc_component_write(component, M98088_REG_10_SYS_CLK, 0x10); ++ max98088->mclk_prescaler = 1; + } else if ((freq >= 20000000) && (freq < 30000000)) { + snd_soc_component_write(component, M98088_REG_10_SYS_CLK, 0x20); ++ max98088->mclk_prescaler = 2; + } else { + dev_err(component->dev, "Invalid master clock frequency\n"); + return -EINVAL; +-- +2.30.2 + diff --git a/queue-5.4/asoc-sti-sas-add-missing-module_device_table.patch b/queue-5.4/asoc-sti-sas-add-missing-module_device_table.patch new file mode 100644 index 00000000000..7e31ff9aac6 --- /dev/null +++ b/queue-5.4/asoc-sti-sas-add-missing-module_device_table.patch @@ -0,0 +1,37 @@ +From 0f02662ae5fa2e97d6e778849480852b73109078 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 11:12:25 +0800 +Subject: ASoC: sti-sas: add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit e072b2671606c77538d6a4dd5dda80b508cb4816 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Link: https://lore.kernel.org/r/1620789145-14936-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sti-sas.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c +index ec9933b054ad..423daac9d5a9 100644 +--- a/sound/soc/codecs/sti-sas.c ++++ b/sound/soc/codecs/sti-sas.c +@@ -411,6 +411,7 @@ static const struct of_device_id sti_sas_dev_match[] = { + }, + {}, + }; ++MODULE_DEVICE_TABLE(of, sti_sas_dev_match); + + static int sti_sas_driver_probe(struct platform_device *pdev) + { +-- +2.30.2 + diff --git a/queue-5.4/bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch b/queue-5.4/bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch new file mode 100644 index 00000000000..b6871a389c3 --- /dev/null +++ b/queue-5.4/bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch @@ -0,0 +1,41 @@ +From 9890b188ab5e17bea3c10177a70f8dbd2ef51154 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 19:00:12 +0800 +Subject: bnx2x: Fix missing error code in bnx2x_iov_init_one() + +From: Jiapeng Chong + +[ Upstream commit 65161c35554f7135e6656b3df1ce2c500ca0bdcf ] + +Eliminate the follow smatch warning: + +drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1227 +bnx2x_iov_init_one() warn: missing error code 'err'. + +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +index 5097a44686b3..cf39623b828b 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +@@ -1245,8 +1245,10 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param, + goto failed; + + /* SR-IOV capability was enabled but there are no VFs*/ +- if (iov->total == 0) ++ if (iov->total == 0) { ++ err = -EINVAL; + goto failed; ++ } + + iov->nr_virtfn = min_t(u16, iov->total, num_vfs_param); + +-- +2.30.2 + diff --git a/queue-5.4/bonding-init-notify_work-earlier-to-avoid-uninitiali.patch b/queue-5.4/bonding-init-notify_work-earlier-to-avoid-uninitiali.patch new file mode 100644 index 00000000000..ab7c3d4ed65 --- /dev/null +++ b/queue-5.4/bonding-init-notify_work-earlier-to-avoid-uninitiali.patch @@ -0,0 +1,53 @@ +From e7a6e57d9522479c64059c527e2e1f42a86a44b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:13:35 +0200 +Subject: bonding: init notify_work earlier to avoid uninitialized use + +From: Johannes Berg + +[ Upstream commit 35d96e631860226d5dc4de0fad0a415362ec2457 ] + +If bond_kobj_init() or later kzalloc() in bond_alloc_slave() fail, +then we call kobject_put() on the slave->kobj. This in turn calls +the release function slave_kobj_release() which will always try to +cancel_delayed_work_sync(&slave->notify_work), which shouldn't be +done on an uninitialized work struct. + +Always initialize the work struct earlier to avoid problems here. + +Syzbot bisected this down to a completely pointless commit, some +fault injection may have been at work here that caused the alloc +failure in the first place, which may interact badly with bisect. + +Reported-by: syzbot+bfda097c12a00c8cae67@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Acked-by: Jay Vosburgh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 2bc4cb9e3095..e21643377162 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1335,6 +1335,7 @@ static struct slave *bond_alloc_slave(struct bonding *bond, + + slave->bond = bond; + slave->dev = slave_dev; ++ INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); + + if (bond_kobj_init(slave)) + return NULL; +@@ -1347,7 +1348,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond, + return NULL; + } + } +- INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); + + return slave; + } +-- +2.30.2 + diff --git a/queue-5.4/cgroup-disable-controllers-at-parse-time.patch b/queue-5.4/cgroup-disable-controllers-at-parse-time.patch new file mode 100644 index 00000000000..c722c714200 --- /dev/null +++ b/queue-5.4/cgroup-disable-controllers-at-parse-time.patch @@ -0,0 +1,75 @@ +From 249d07fbdaa0a5a73ef413d72e9999805f8bba4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 13:19:46 -0700 +Subject: cgroup: disable controllers at parse time +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shakeel Butt + +[ Upstream commit 45e1ba40837ac2f6f4d4716bddb8d44bd7e4a251 ] + +This patch effectively reverts the commit a3e72739b7a7 ("cgroup: fix +too early usage of static_branch_disable()"). The commit 6041186a3258 +("init: initialize jump labels before command line option parsing") has +moved the jump_label_init() before parse_args() which has made the +commit a3e72739b7a7 unnecessary. On the other hand there are +consequences of disabling the controllers later as there are subsystems +doing the controller checks for different decisions. One such incident +is reported [1] regarding the memory controller and its impact on memory +reclaim code. + +[1] https://lore.kernel.org/linux-mm/921e53f3-4b13-aab8-4a9e-e83ff15371e4@nec.com + +Signed-off-by: Shakeel Butt +Reported-by: NOMURA JUNICHI(野村　淳一) +Signed-off-by: Tejun Heo +Tested-by: Jun'ichi Nomura +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cgroup.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 37db8eba149a..ede370ec245d 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -5721,8 +5721,6 @@ int __init cgroup_init_early(void) + return 0; + } + +-static u16 cgroup_disable_mask __initdata; +- + /** + * cgroup_init - cgroup initialization + * +@@ -5781,12 +5779,8 @@ int __init cgroup_init(void) + * disabled flag and cftype registration needs kmalloc, + * both of which aren't available during early_init. + */ +- if (cgroup_disable_mask & (1 << ssid)) { +- static_branch_disable(cgroup_subsys_enabled_key[ssid]); +- printk(KERN_INFO "Disabling %s control group subsystem\n", +- ss->name); ++ if (!cgroup_ssid_enabled(ssid)) + continue; +- } + + if (cgroup1_ssid_disabled(ssid)) + printk(KERN_INFO "Disabling %s control group subsystem in v1 mounts\n", +@@ -6173,7 +6167,10 @@ static int __init cgroup_disable(char *str) + if (strcmp(token, ss->name) && + strcmp(token, ss->legacy_name)) + continue; +- cgroup_disable_mask |= 1 << i; ++ ++ static_branch_disable(cgroup_subsys_enabled_key[i]); ++ pr_info("Disabling %s control group subsystem\n", ++ ss->name); + } + } + return 1; +-- +2.30.2 + diff --git a/queue-5.4/dm-verity-fix-require_signatures-module_param-permis.patch b/queue-5.4/dm-verity-fix-require_signatures-module_param-permis.patch new file mode 100644 index 00000000000..afd4f463a67 --- /dev/null +++ b/queue-5.4/dm-verity-fix-require_signatures-module_param-permis.patch @@ -0,0 +1,43 @@ +From 5eda642f654d85ed6920ff9817a47582764c8a97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 12:14:21 +0100 +Subject: dm verity: fix require_signatures module_param permissions + +From: John Keeping + +[ Upstream commit 0c1f3193b1cdd21e7182f97dc9bca7d284d18a15 ] + +The third parameter of module_param() is permissions for the sysfs node +but it looks like it is being used as the initial value of the parameter +here. In fact, false here equates to omitting the file from sysfs and +does not affect the value of require_signatures. + +Making the parameter writable is not simple because going from +false->true is fine but it should not be possible to remove the +requirement to verify a signature. But it can be useful to inspect the +value of this parameter from userspace, so change the permissions to +make a read-only file in sysfs. + +Signed-off-by: John Keeping +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-verity-verify-sig.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c +index 614e43db93aa..919154ae4cae 100644 +--- a/drivers/md/dm-verity-verify-sig.c ++++ b/drivers/md/dm-verity-verify-sig.c +@@ -15,7 +15,7 @@ + #define DM_VERITY_VERIFY_ERR(s) DM_VERITY_ROOT_HASH_VERIFICATION " " s + + static bool require_signatures; +-module_param(require_signatures, bool, false); ++module_param(require_signatures, bool, 0444); + MODULE_PARM_DESC(require_signatures, + "Verify the roothash of dm-verity hash tree"); + +-- +2.30.2 + diff --git a/queue-5.4/i2c-mpc-implement-erratum-a-004447-workaround.patch b/queue-5.4/i2c-mpc-implement-erratum-a-004447-workaround.patch new file mode 100644 index 00000000000..5a19958ee97 --- /dev/null +++ b/queue-5.4/i2c-mpc-implement-erratum-a-004447-workaround.patch @@ -0,0 +1,148 @@ +From 8a57139af56c9963ecd731dc3d8b3069b1c855be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 09:20:52 +1200 +Subject: i2c: mpc: implement erratum A-004447 workaround + +From: Chris Packham + +[ Upstream commit 8f0cdec8b5fd94135d643662506ee94ae9e98785 ] + +The P2040/P2041 has an erratum where the normal i2c recovery mechanism +does not work. Implement the alternative recovery mechanism documented +in the P2040 Chip Errata Rev Q. + +Signed-off-by: Chris Packham +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mpc.c | 79 +++++++++++++++++++++++++++++++++++- + 1 file changed, 78 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c +index 6a0d55e9e8e3..af349661fd76 100644 +--- a/drivers/i2c/busses/i2c-mpc.c ++++ b/drivers/i2c/busses/i2c-mpc.c +@@ -23,6 +23,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -49,6 +50,7 @@ + #define CCR_MTX 0x10 + #define CCR_TXAK 0x08 + #define CCR_RSTA 0x04 ++#define CCR_RSVD 0x02 + + #define CSR_MCF 0x80 + #define CSR_MAAS 0x40 +@@ -70,6 +72,7 @@ struct mpc_i2c { + u8 fdr, dfsrr; + #endif + struct clk *clk_per; ++ bool has_errata_A004447; + }; + + struct mpc_i2c_divider { +@@ -176,6 +179,75 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing) + return 0; + } + ++static int i2c_mpc_wait_sr(struct mpc_i2c *i2c, int mask) ++{ ++ void __iomem *addr = i2c->base + MPC_I2C_SR; ++ u8 val; ++ ++ return readb_poll_timeout(addr, val, val & mask, 0, 100); ++} ++ ++/* ++ * Workaround for Erratum A004447. From the P2040CE Rev Q ++ * ++ * 1. Set up the frequency divider and sampling rate. ++ * 2. I2CCR - a0h ++ * 3. Poll for I2CSR[MBB] to get set. ++ * 4. If I2CSR[MAL] is set (an indication that SDA is stuck low), then go to ++ * step 5. If MAL is not set, then go to step 13. ++ * 5. I2CCR - 00h ++ * 6. I2CCR - 22h ++ * 7. I2CCR - a2h ++ * 8. Poll for I2CSR[MBB] to get set. ++ * 9. Issue read to I2CDR. ++ * 10. Poll for I2CSR[MIF] to be set. ++ * 11. I2CCR - 82h ++ * 12. Workaround complete. Skip the next steps. ++ * 13. Issue read to I2CDR. ++ * 14. Poll for I2CSR[MIF] to be set. ++ * 15. I2CCR - 80h ++ */ ++static void mpc_i2c_fixup_A004447(struct mpc_i2c *i2c) ++{ ++ int ret; ++ u32 val; ++ ++ writeccr(i2c, CCR_MEN | CCR_MSTA); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MBB); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MBB\n"); ++ return; ++ } ++ ++ val = readb(i2c->base + MPC_I2C_SR); ++ ++ if (val & CSR_MAL) { ++ writeccr(i2c, 0x00); ++ writeccr(i2c, CCR_MSTA | CCR_RSVD); ++ writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSVD); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MBB); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MBB\n"); ++ return; ++ } ++ val = readb(i2c->base + MPC_I2C_DR); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MIF); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MIF\n"); ++ return; ++ } ++ writeccr(i2c, CCR_MEN | CCR_RSVD); ++ } else { ++ val = readb(i2c->base + MPC_I2C_DR); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MIF); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MIF\n"); ++ return; ++ } ++ writeccr(i2c, CCR_MEN); ++ } ++} ++ + #if defined(CONFIG_PPC_MPC52xx) || defined(CONFIG_PPC_MPC512x) + static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = { + {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23}, +@@ -641,7 +713,10 @@ static int fsl_i2c_bus_recovery(struct i2c_adapter *adap) + { + struct mpc_i2c *i2c = i2c_get_adapdata(adap); + +- mpc_i2c_fixup(i2c); ++ if (i2c->has_errata_A004447) ++ mpc_i2c_fixup_A004447(i2c); ++ else ++ mpc_i2c_fixup(i2c); + + return 0; + } +@@ -745,6 +820,8 @@ static int fsl_i2c_probe(struct platform_device *op) + dev_info(i2c->dev, "timeout %u us\n", mpc_ops.timeout * 1000000 / HZ); + + platform_set_drvdata(op, i2c); ++ if (of_property_read_bool(op->dev.of_node, "fsl,i2c-erratum-a004447")) ++ i2c->has_errata_A004447 = true; + + i2c->adap = mpc_ops; + of_address_to_resource(op->dev.of_node, 0, &res); +-- +2.30.2 + diff --git a/queue-5.4/i2c-mpc-make-use-of-i2c_recover_bus.patch b/queue-5.4/i2c-mpc-make-use-of-i2c_recover_bus.patch new file mode 100644 index 00000000000..5d9dc307a89 --- /dev/null +++ b/queue-5.4/i2c-mpc-make-use-of-i2c_recover_bus.patch @@ -0,0 +1,81 @@ +From a6b45ae23c9737045840e867e1ac4df394916a37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 14:52:03 +1300 +Subject: i2c: mpc: Make use of i2c_recover_bus() + +From: Chris Packham + +[ Upstream commit 65171b2df15eb7545431d75c2729b5062da89b43 ] + +Move the existing calls of mpc_i2c_fixup() to a recovery function +registered via bus_recovery_info. This makes it more obvious that +recovery is supported and allows for a future where recovery is +triggered by the i2c core. + +Signed-off-by: Chris Packham +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mpc.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c +index d94f05c8b8b7..6a0d55e9e8e3 100644 +--- a/drivers/i2c/busses/i2c-mpc.c ++++ b/drivers/i2c/busses/i2c-mpc.c +@@ -586,7 +586,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) { + writeb(status & ~CSR_MAL, + i2c->base + MPC_I2C_SR); +- mpc_i2c_fixup(i2c); ++ i2c_recover_bus(&i2c->adap); + } + return -EIO; + } +@@ -622,7 +622,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) { + writeb(status & ~CSR_MAL, + i2c->base + MPC_I2C_SR); +- mpc_i2c_fixup(i2c); ++ i2c_recover_bus(&i2c->adap); + } + return -EIO; + } +@@ -637,6 +637,15 @@ static u32 mpc_functionality(struct i2c_adapter *adap) + | I2C_FUNC_SMBUS_READ_BLOCK_DATA | I2C_FUNC_SMBUS_BLOCK_PROC_CALL; + } + ++static int fsl_i2c_bus_recovery(struct i2c_adapter *adap) ++{ ++ struct mpc_i2c *i2c = i2c_get_adapdata(adap); ++ ++ mpc_i2c_fixup(i2c); ++ ++ return 0; ++} ++ + static const struct i2c_algorithm mpc_algo = { + .master_xfer = mpc_xfer, + .functionality = mpc_functionality, +@@ -648,6 +657,10 @@ static struct i2c_adapter mpc_ops = { + .timeout = HZ, + }; + ++static struct i2c_bus_recovery_info fsl_i2c_recovery_info = { ++ .recover_bus = fsl_i2c_bus_recovery, ++}; ++ + static const struct of_device_id mpc_i2c_of_match[]; + static int fsl_i2c_probe(struct platform_device *op) + { +@@ -740,6 +753,7 @@ static int fsl_i2c_probe(struct platform_device *op) + i2c_set_adapdata(&i2c->adap, i2c); + i2c->adap.dev.parent = &op->dev; + i2c->adap.dev.of_node = of_node_get(op->dev.of_node); ++ i2c->adap.bus_recovery_info = &fsl_i2c_recovery_info; + + result = i2c_add_adapter(&i2c->adap); + if (result < 0) +-- +2.30.2 + diff --git a/queue-5.4/isdn-misdn-netjet-fix-crash-in-nj_probe.patch b/queue-5.4/isdn-misdn-netjet-fix-crash-in-nj_probe.patch new file mode 100644 index 00000000000..bae7edaa0fd --- /dev/null +++ b/queue-5.4/isdn-misdn-netjet-fix-crash-in-nj_probe.patch @@ -0,0 +1,168 @@ +From 3bd0f69e1ab31d9dd3a14d7988f6856b7f2f9ff5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 May 2021 07:11:40 +0000 +Subject: isdn: mISDN: netjet: Fix crash in nj_probe: + +From: Zheyu Ma + +[ Upstream commit 9f6f852550d0e1b7735651228116ae9d300f69b3 ] + +'nj_setup' in netjet.c might fail with -EIO and in this case +'card->irq' is initialized and is bigger than zero. A subsequent call to +'nj_release' will free the irq that has not been requested. + +Fix this bug by deleting the previous assignment to 'card->irq' and just +keep the assignment before 'request_irq'. + +The KASAN's log reveals it: + +[ 3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826 +free_irq+0x100/0x480 +[ 3.355112 ] Modules linked in: +[ 3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted +5.13.0-rc1-00144-g25a1298726e #13 +[ 3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS +rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +[ 3.356552 ] RIP: 0010:free_irq+0x100/0x480 +[ 3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18 +4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 +ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80 +[ 3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082 +[ 3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX: +0000000000000000 +[ 3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI: +00000000ffffffff +[ 3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09: +0000000000000000 +[ 3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12: +0000000000000000 +[ 3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15: +ffff888104dc80a8 +[ 3.360652 ] FS: 0000000000000000(0000) GS:ffff88817bc00000(0000) +knlGS:0000000000000000 +[ 3.361170 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4: +00000000000006f0 +[ 3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: +0000000000000000 +[ 3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: +0000000000000400 +[ 3.362175 ] Call Trace: +[ 3.362175 ] nj_release+0x51/0x1e0 +[ 3.362175 ] nj_probe+0x450/0x950 +[ 3.362175 ] ? pci_device_remove+0x110/0x110 +[ 3.362175 ] local_pci_probe+0x45/0xa0 +[ 3.362175 ] pci_device_probe+0x12b/0x1d0 +[ 3.362175 ] really_probe+0x2a9/0x610 +[ 3.362175 ] driver_probe_device+0x90/0x1d0 +[ 3.362175 ] ? mutex_lock_nested+0x1b/0x20 +[ 3.362175 ] device_driver_attach+0x68/0x70 +[ 3.362175 ] __driver_attach+0x124/0x1b0 +[ 3.362175 ] ? device_driver_attach+0x70/0x70 +[ 3.362175 ] bus_for_each_dev+0xbb/0x110 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] driver_attach+0x27/0x30 +[ 3.362175 ] bus_add_driver+0x1eb/0x2a0 +[ 3.362175 ] driver_register+0xa9/0x180 +[ 3.362175 ] __pci_register_driver+0x82/0x90 +[ 3.362175 ] ? w6692_init+0x38/0x38 +[ 3.362175 ] nj_init+0x36/0x38 +[ 3.362175 ] do_one_initcall+0x7f/0x3d0 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 3.362175 ] kernel_init_freeable+0x2aa/0x301 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] kernel_init+0x18/0x190 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ret_from_fork+0x1f/0x30 +[ 3.362175 ] Kernel panic - not syncing: panic_on_warn set ... +[ 3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted +5.13.0-rc1-00144-g25a1298726e #13 +[ 3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS +rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +[ 3.362175 ] Call Trace: +[ 3.362175 ] dump_stack+0xba/0xf5 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] panic+0x15a/0x3f2 +[ 3.362175 ] ? __warn+0xf2/0x150 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] __warn+0x108/0x150 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] report_bug+0x119/0x1c0 +[ 3.362175 ] handle_bug+0x3b/0x80 +[ 3.362175 ] exc_invalid_op+0x18/0x70 +[ 3.362175 ] asm_exc_invalid_op+0x12/0x20 +[ 3.362175 ] RIP: 0010:free_irq+0x100/0x480 +[ 3.362175 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18 +4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 +ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80 +[ 3.362175 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082 +[ 3.362175 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX: +0000000000000000 +[ 3.362175 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI: +00000000ffffffff +[ 3.362175 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09: +0000000000000000 +[ 3.362175 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12: +0000000000000000 +[ 3.362175 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15: +ffff888104dc80a8 +[ 3.362175 ] ? vprintk+0x76/0x150 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] nj_release+0x51/0x1e0 +[ 3.362175 ] nj_probe+0x450/0x950 +[ 3.362175 ] ? pci_device_remove+0x110/0x110 +[ 3.362175 ] local_pci_probe+0x45/0xa0 +[ 3.362175 ] pci_device_probe+0x12b/0x1d0 +[ 3.362175 ] really_probe+0x2a9/0x610 +[ 3.362175 ] driver_probe_device+0x90/0x1d0 +[ 3.362175 ] ? mutex_lock_nested+0x1b/0x20 +[ 3.362175 ] device_driver_attach+0x68/0x70 +[ 3.362175 ] __driver_attach+0x124/0x1b0 +[ 3.362175 ] ? device_driver_attach+0x70/0x70 +[ 3.362175 ] bus_for_each_dev+0xbb/0x110 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] driver_attach+0x27/0x30 +[ 3.362175 ] bus_add_driver+0x1eb/0x2a0 +[ 3.362175 ] driver_register+0xa9/0x180 +[ 3.362175 ] __pci_register_driver+0x82/0x90 +[ 3.362175 ] ? w6692_init+0x38/0x38 +[ 3.362175 ] nj_init+0x36/0x38 +[ 3.362175 ] do_one_initcall+0x7f/0x3d0 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 3.362175 ] kernel_init_freeable+0x2aa/0x301 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] kernel_init+0x18/0x190 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ret_from_fork+0x1f/0x30 +[ 3.362175 ] Dumping ftrace buffer: +[ 3.362175 ] (ftrace buffer empty) +[ 3.362175 ] Kernel Offset: disabled +[ 3.362175 ] Rebooting in 1 seconds.. + +Reported-by: Zheyu Ma +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/netjet.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c +index 61caa7e50b9a..9e6aab04f9d6 100644 +--- a/drivers/isdn/hardware/mISDN/netjet.c ++++ b/drivers/isdn/hardware/mISDN/netjet.c +@@ -1100,7 +1100,6 @@ nj_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + card->typ = NETJET_S_TJ300; + + card->base = pci_resource_start(pdev, 0); +- card->irq = pdev->irq; + pci_set_drvdata(pdev, card); + err = setup_instance(card); + if (err) +-- +2.30.2 + diff --git a/queue-5.4/mips-fix-kernel-hang-under-function_graph_tracer-and.patch b/queue-5.4/mips-fix-kernel-hang-under-function_graph_tracer-and.patch new file mode 100644 index 00000000000..406b56d65cb --- /dev/null +++ b/queue-5.4/mips-fix-kernel-hang-under-function_graph_tracer-and.patch @@ -0,0 +1,105 @@ +From c33d47193520bccf70af88f39f4bcb21475ba63b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 19:02:01 +0800 +Subject: MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER + +From: Tiezhu Yang + +[ Upstream commit 78cf0eb926cb1abeff2106bae67752e032fe5f3e ] + +When update the latest mainline kernel with the following three configs, +the kernel hangs during startup: + +(1) CONFIG_FUNCTION_GRAPH_TRACER=y +(2) CONFIG_PREEMPT_TRACER=y +(3) CONFIG_FTRACE_STARTUP_TEST=y + +When update the latest mainline kernel with the above two configs (1) +and (2), the kernel starts normally, but it still hangs when execute +the following command: + +echo "function_graph" > /sys/kernel/debug/tracing/current_tracer + +Without CONFIG_PREEMPT_TRACER=y, the above two kinds of kernel hangs +disappeared, so it seems that CONFIG_PREEMPT_TRACER has some influences +with function_graph tracer at the first glance. + +I use ejtag to find out the epc address is related with preempt_enable() +in the file arch/mips/lib/mips-atomic.c, because function tracing can +trace the preempt_{enable,disable} calls that are traced, replace them +with preempt_{enable,disable}_notrace to prevent function tracing from +going into an infinite loop, and then it can fix the kernel hang issue. + +By the way, it seems that this commit is a complement and improvement of +commit f93a1a00f2bd ("MIPS: Fix crash that occurs when function tracing +is enabled"). + +Signed-off-by: Tiezhu Yang +Cc: Steven Rostedt +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/lib/mips-atomic.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c +index 5530070e0d05..57497a26e79c 100644 +--- a/arch/mips/lib/mips-atomic.c ++++ b/arch/mips/lib/mips-atomic.c +@@ -37,7 +37,7 @@ + */ + notrace void arch_local_irq_disable(void) + { +- preempt_disable(); ++ preempt_disable_notrace(); + + __asm__ __volatile__( + " .set push \n" +@@ -53,7 +53,7 @@ notrace void arch_local_irq_disable(void) + : /* no inputs */ + : "memory"); + +- preempt_enable(); ++ preempt_enable_notrace(); + } + EXPORT_SYMBOL(arch_local_irq_disable); + +@@ -61,7 +61,7 @@ notrace unsigned long arch_local_irq_save(void) + { + unsigned long flags; + +- preempt_disable(); ++ preempt_disable_notrace(); + + __asm__ __volatile__( + " .set push \n" +@@ -78,7 +78,7 @@ notrace unsigned long arch_local_irq_save(void) + : /* no inputs */ + : "memory"); + +- preempt_enable(); ++ preempt_enable_notrace(); + + return flags; + } +@@ -88,7 +88,7 @@ notrace void arch_local_irq_restore(unsigned long flags) + { + unsigned long __tmp1; + +- preempt_disable(); ++ preempt_disable_notrace(); + + __asm__ __volatile__( + " .set push \n" +@@ -106,7 +106,7 @@ notrace void arch_local_irq_restore(unsigned long flags) + : "0" (flags) + : "memory"); + +- preempt_enable(); ++ preempt_enable_notrace(); + } + EXPORT_SYMBOL(arch_local_irq_restore); + +-- +2.30.2 + diff --git a/queue-5.4/net-appletalk-cops-fix-data-race-in-cops_probe1.patch b/queue-5.4/net-appletalk-cops-fix-data-race-in-cops_probe1.patch new file mode 100644 index 00000000000..ce4125c3025 --- /dev/null +++ b/queue-5.4/net-appletalk-cops-fix-data-race-in-cops_probe1.patch @@ -0,0 +1,49 @@ +From 53a24d444494e05d1d91363f5974e754b673e37e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 19:07:12 +0530 +Subject: net: appletalk: cops: Fix data race in cops_probe1 + +From: Saubhik Mukherjee + +[ Upstream commit a4dd4fc6105e54393d637450a11d4cddb5fabc4f ] + +In cops_probe1(), there is a write to dev->base_addr after requesting an +interrupt line and registering the interrupt handler cops_interrupt(). +The handler might be called in parallel to handle an interrupt. +cops_interrupt() tries to read dev->base_addr leading to a potential +data race. So write to dev->base_addr before calling request_irq(). + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Saubhik Mukherjee +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/appletalk/cops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c +index b3c63d2f16aa..5c89c2eff891 100644 +--- a/drivers/net/appletalk/cops.c ++++ b/drivers/net/appletalk/cops.c +@@ -325,6 +325,8 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr) + break; + } + ++ dev->base_addr = ioaddr; ++ + /* Reserve any actual interrupt. */ + if (dev->irq) { + retval = request_irq(dev->irq, cops_interrupt, 0, dev->name, dev); +@@ -332,8 +334,6 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr) + goto err_out; + } + +- dev->base_addr = ioaddr; +- + lp = netdev_priv(dev); + spin_lock_init(&lp->lock); + +-- +2.30.2 + diff --git a/queue-5.4/net-dsa-microchip-enable-phy-errata-workaround-on-95.patch b/queue-5.4/net-dsa-microchip-enable-phy-errata-workaround-on-95.patch new file mode 100644 index 00000000000..e4583c87852 --- /dev/null +++ b/queue-5.4/net-dsa-microchip-enable-phy-errata-workaround-on-95.patch @@ -0,0 +1,35 @@ +From 189a0bd25cef615285d391b71f4b4355ff80fbac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 15:29:53 -0500 +Subject: net: dsa: microchip: enable phy errata workaround on 9567 + +From: George McCollister + +[ Upstream commit 8c42a49738f16af0061f9ae5c2f5a955f268d9e3 ] + +Also enable phy errata workaround on 9567 since has the same errata as +the 9477 according to the manufacture's documentation. + +Signed-off-by: George McCollister +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz9477.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c +index 49ab1346dc3f..0370e71ed6e0 100644 +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -1520,6 +1520,7 @@ static const struct ksz_chip_data ksz9477_switch_chips[] = { + .num_statics = 16, + .cpu_ports = 0x7F, /* can be configured as cpu port */ + .port_cnt = 7, /* total physical port count */ ++ .phy_errata_9477 = true, + }, + }; + +-- +2.30.2 + diff --git a/queue-5.4/net-macb-ensure-the-device-is-available-before-acces.patch b/queue-5.4/net-macb-ensure-the-device-is-available-before-acces.patch new file mode 100644 index 00000000000..076f46c0917 --- /dev/null +++ b/queue-5.4/net-macb-ensure-the-device-is-available-before-acces.patch @@ -0,0 +1,46 @@ +From 2ce0354ff84fac6d4a68da855e9264854e4ed2dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 May 2021 17:16:11 +0800 +Subject: net: macb: ensure the device is available before accessing GEMGXL + control registers + +From: Zong Li + +[ Upstream commit 5eff1461a6dec84f04fafa9128548bad51d96147 ] + +If runtime power menagement is enabled, the gigabit ethernet PLL would +be disabled after macb_probe(). During this period of time, the system +would hang up if we try to access GEMGXL control registers. + +We can't put runtime_pm_get/runtime_pm_put/ there due to the issue of +sleep inside atomic section (7fa2955ff70ce453 ("sh_eth: Fix sleeping +function called from invalid context"). Add netif_running checking to +ensure the device is available before accessing GEMGXL device. + +Changed in v2: + - Use netif_running instead of its own flag + +Signed-off-by: Zong Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 377668465535..ebd0853a6f31 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -2536,6 +2536,9 @@ static struct net_device_stats *gem_get_stats(struct macb *bp) + struct gem_stats *hwstat = &bp->hw_stats.gem; + struct net_device_stats *nstat = &bp->dev->stats; + ++ if (!netif_running(bp->dev)) ++ return nstat; ++ + gem_update_stats(bp); + + nstat->rx_errors = (hwstat->rx_frame_check_sequence_errors + +-- +2.30.2 + diff --git a/queue-5.4/net-mdiobus-get-rid-of-a-bug_on.patch b/queue-5.4/net-mdiobus-get-rid-of-a-bug_on.patch new file mode 100644 index 00000000000..e741414711e --- /dev/null +++ b/queue-5.4/net-mdiobus-get-rid-of-a-bug_on.patch @@ -0,0 +1,41 @@ +From 6a61cf1d6b87095db3b6663be94e8f3734e29e96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 12:04:13 +0300 +Subject: net: mdiobus: get rid of a BUG_ON() + +From: Dan Carpenter + +[ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] + +We spotted a bug recently during a review where a driver was +unregistering a bus that wasn't registered, which would trigger this +BUG_ON(). Let's handle that situation more gracefully, and just print +a warning and return. + +Reported-by: Russell King (Oracle) +Signed-off-by: Dan Carpenter +Reviewed-by: Russell King (Oracle) +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio_bus.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c +index 229e480179ff..5bf06eac04ba 100644 +--- a/drivers/net/phy/mdio_bus.c ++++ b/drivers/net/phy/mdio_bus.c +@@ -453,7 +453,8 @@ void mdiobus_unregister(struct mii_bus *bus) + struct mdio_device *mdiodev; + int i; + +- BUG_ON(bus->state != MDIOBUS_REGISTERED); ++ if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) ++ return; + bus->state = MDIOBUS_UNREGISTERED; + + for (i = 0; i < PHY_MAX_ADDR; i++) { +-- +2.30.2 + diff --git a/queue-5.4/net-nfc-rawsock.c-fix-a-permission-check-bug.patch b/queue-5.4/net-nfc-rawsock.c-fix-a-permission-check-bug.patch new file mode 100644 index 00000000000..5e896a7cac7 --- /dev/null +++ b/queue-5.4/net-nfc-rawsock.c-fix-a-permission-check-bug.patch @@ -0,0 +1,34 @@ +From a3ebf05c154559fda75e99661ac7d8312c0aeadf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:52:30 +0800 +Subject: net/nfc/rawsock.c: fix a permission check bug + +From: Jeimon + +[ Upstream commit 8ab78863e9eff11910e1ac8bcf478060c29b379e ] + +The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable(). + +Signed-off-by: Jeimon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/rawsock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c +index 23d5e56306a4..8d649f4aee79 100644 +--- a/net/nfc/rawsock.c ++++ b/net/nfc/rawsock.c +@@ -333,7 +333,7 @@ static int rawsock_create(struct net *net, struct socket *sock, + return -ESOCKTNOSUPPORT; + + if (sock->type == SOCK_RAW) { +- if (!capable(CAP_NET_RAW)) ++ if (!ns_capable(net->user_ns, CAP_NET_RAW)) + return -EPERM; + sock->ops = &rawsock_raw_ops; + } else { +-- +2.30.2 + diff --git a/queue-5.4/net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch b/queue-5.4/net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch new file mode 100644 index 00000000000..54bc2998921 --- /dev/null +++ b/queue-5.4/net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch @@ -0,0 +1,108 @@ +From 03d68fa21fa771c67c6bda511064cd50c2d2eff2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 12:32:36 +0000 +Subject: net/qla3xxx: fix schedule while atomic in ql_sem_spinlock + +From: Zheyu Ma + +[ Upstream commit 13a6f3153922391e90036ba2267d34eed63196fc ] + +When calling the 'ql_sem_spinlock', the driver has already acquired the +spin lock, so the driver should not call 'ssleep' in atomic context. + +This bug can be fixed by using 'mdelay' instead of 'ssleep'. + +The KASAN's log reveals it: + +[ 3.238124 ] BUG: scheduling while atomic: swapper/0/1/0x00000002 +[ 3.238748 ] 2 locks held by swapper/0/1: +[ 3.239151 ] #0: ffff88810177b240 (&dev->mutex){....}-{3:3}, at: +__device_driver_lock+0x41/0x60 +[ 3.240026 ] #1: ffff888107c60e28 (&qdev->hw_lock){....}-{2:2}, at: +ql3xxx_probe+0x2aa/0xea0 +[ 3.240873 ] Modules linked in: +[ 3.241187 ] irq event stamp: 460854 +[ 3.241541 ] hardirqs last enabled at (460853): [] +_raw_spin_unlock_irqrestore+0x4f/0x70 +[ 3.242245 ] hardirqs last disabled at (460854): [] +_raw_spin_lock_irqsave+0x2a/0x70 +[ 3.242245 ] softirqs last enabled at (446076): [] +__do_softirq+0x2e4/0x4b1 +[ 3.242245 ] softirqs last disabled at (446069): [] +irq_exit_rcu+0x100/0x110 +[ 3.242245 ] Preemption disabled at: +[ 3.242245 ] [] ql3xxx_probe+0x2aa/0xea0 +[ 3.242245 ] Kernel panic - not syncing: scheduling while atomic +[ 3.242245 ] CPU: 2 PID: 1 Comm: swapper/0 Not tainted +5.13.0-rc1-00145 +-gee7dc339169-dirty #16 +[ 3.242245 ] Call Trace: +[ 3.242245 ] dump_stack+0xba/0xf5 +[ 3.242245 ] ? ql3xxx_probe+0x1f0/0xea0 +[ 3.242245 ] panic+0x15a/0x3f2 +[ 3.242245 ] ? vprintk+0x76/0x150 +[ 3.242245 ] ? ql3xxx_probe+0x2aa/0xea0 +[ 3.242245 ] __schedule_bug+0xae/0xe0 +[ 3.242245 ] __schedule+0x72e/0xa00 +[ 3.242245 ] schedule+0x43/0xf0 +[ 3.242245 ] schedule_timeout+0x28b/0x500 +[ 3.242245 ] ? del_timer_sync+0xf0/0xf0 +[ 3.242245 ] ? msleep+0x2f/0x70 +[ 3.242245 ] msleep+0x59/0x70 +[ 3.242245 ] ql3xxx_probe+0x307/0xea0 +[ 3.242245 ] ? _raw_spin_unlock_irqrestore+0x3a/0x70 +[ 3.242245 ] ? pci_device_remove+0x110/0x110 +[ 3.242245 ] local_pci_probe+0x45/0xa0 +[ 3.242245 ] pci_device_probe+0x12b/0x1d0 +[ 3.242245 ] really_probe+0x2a9/0x610 +[ 3.242245 ] driver_probe_device+0x90/0x1d0 +[ 3.242245 ] ? mutex_lock_nested+0x1b/0x20 +[ 3.242245 ] device_driver_attach+0x68/0x70 +[ 3.242245 ] __driver_attach+0x124/0x1b0 +[ 3.242245 ] ? device_driver_attach+0x70/0x70 +[ 3.242245 ] bus_for_each_dev+0xbb/0x110 +[ 3.242245 ] ? rdinit_setup+0x45/0x45 +[ 3.242245 ] driver_attach+0x27/0x30 +[ 3.242245 ] bus_add_driver+0x1eb/0x2a0 +[ 3.242245 ] driver_register+0xa9/0x180 +[ 3.242245 ] __pci_register_driver+0x82/0x90 +[ 3.242245 ] ? yellowfin_init+0x25/0x25 +[ 3.242245 ] ql3xxx_driver_init+0x23/0x25 +[ 3.242245 ] do_one_initcall+0x7f/0x3d0 +[ 3.242245 ] ? rdinit_setup+0x45/0x45 +[ 3.242245 ] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 3.242245 ] kernel_init_freeable+0x2aa/0x301 +[ 3.242245 ] ? rest_init+0x2c0/0x2c0 +[ 3.242245 ] kernel_init+0x18/0x190 +[ 3.242245 ] ? rest_init+0x2c0/0x2c0 +[ 3.242245 ] ? rest_init+0x2c0/0x2c0 +[ 3.242245 ] ret_from_fork+0x1f/0x30 +[ 3.242245 ] Dumping ftrace buffer: +[ 3.242245 ] (ftrace buffer empty) +[ 3.242245 ] Kernel Offset: disabled +[ 3.242245 ] Rebooting in 1 seconds. + +Reported-by: Zheyu Ma +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qla3xxx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index 986f26578d34..5dc36c51636c 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -115,7 +115,7 @@ static int ql_sem_spinlock(struct ql3_adapter *qdev, + value = readl(&port_regs->CommonRegs.semaphoreReg); + if ((value & (sem_mask >> 16)) == sem_bits) + return 0; +- ssleep(1); ++ mdelay(1000); + } while (--seconds); + return -1; + } +-- +2.30.2 + diff --git a/queue-5.4/netlink-disable-irqs-for-netlink_lock_table.patch b/queue-5.4/netlink-disable-irqs-for-netlink_lock_table.patch new file mode 100644 index 00000000000..2d21961e22c --- /dev/null +++ b/queue-5.4/netlink-disable-irqs-for-netlink_lock_table.patch @@ -0,0 +1,75 @@ +From 85a6630852596386b71a6bdf74f1dc1d3ae2b5ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:38:09 +0200 +Subject: netlink: disable IRQs for netlink_lock_table() + +From: Johannes Berg + +[ Upstream commit 1d482e666b8e74c7555dbdfbfb77205eeed3ff2d ] + +Syzbot reports that in mac80211 we have a potential deadlock +between our "local->stop_queue_reasons_lock" (spinlock) and +netlink's nl_table_lock (rwlock). This is because there's at +least one situation in which we might try to send a netlink +message with this spinlock held while it is also possible to +take the spinlock from a hardirq context, resulting in the +following deadlock scenario reported by lockdep: + + CPU0 CPU1 + ---- ---- + lock(nl_table_lock); + local_irq_disable(); + lock(&local->queue_stop_reason_lock); + lock(nl_table_lock); + + lock(&local->queue_stop_reason_lock); + +This seems valid, we can take the queue_stop_reason_lock in +any kind of context ("CPU0"), and call ieee80211_report_ack_skb() +with the spinlock held and IRQs disabled ("CPU1") in some +code path (ieee80211_do_stop() via ieee80211_free_txskb()). + +Short of disallowing netlink use in scenarios like these +(which would be rather complex in mac80211's case due to +the deep callchain), it seems the only fix for this is to +disable IRQs while nl_table_lock is held to avoid hitting +this scenario, this disallows the "CPU0" portion of the +reported deadlock. + +Note that the writer side (netlink_table_grab()) already +disables IRQs for this lock. + +Unfortunately though, this seems like a huge hammer, and +maybe the whole netlink table locking should be reworked. + +Reported-by: syzbot+69ff9dff50dcfe14ddd4@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index c2a5174387ff..9d993b4cf1af 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -452,11 +452,13 @@ void netlink_table_ungrab(void) + static inline void + netlink_lock_table(void) + { ++ unsigned long flags; ++ + /* read_lock() synchronizes us to netlink_table_grab */ + +- read_lock(&nl_table_lock); ++ read_lock_irqsave(&nl_table_lock, flags); + atomic_inc(&nl_table_users); +- read_unlock(&nl_table_lock); ++ read_unlock_irqrestore(&nl_table_lock, flags); + } + + static inline void +-- +2.30.2 + diff --git a/queue-5.4/nvme-fabrics-decode-host-pathing-error-for-connect.patch b/queue-5.4/nvme-fabrics-decode-host-pathing-error-for-connect.patch new file mode 100644 index 00000000000..2f26b229eb1 --- /dev/null +++ b/queue-5.4/nvme-fabrics-decode-host-pathing-error-for-connect.patch @@ -0,0 +1,40 @@ +From 26265f346a1ed1c1228d3e115e9bbfd57d799f65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 10:23:46 +0200 +Subject: nvme-fabrics: decode host pathing error for connect + +From: Hannes Reinecke + +[ Upstream commit 4d9442bf263ac45d495bb7ecf75009e59c0622b2 ] + +Add an additional decoding for 'host pathing error' during connect. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Himanshu Madhani +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fabrics.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 3bb71f177dfd..d884187d7706 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -336,6 +336,11 @@ static void nvmf_log_connect_error(struct nvme_ctrl *ctrl, + cmd->connect.recfmt); + break; + ++ case NVME_SC_HOST_PATH_ERROR: ++ dev_err(ctrl->device, ++ "Connect command failed: host path error\n"); ++ break; ++ + default: + dev_err(ctrl->device, + "Connect command failed, error wo/DNR bit: %d\n", +-- +2.30.2 + diff --git a/queue-5.4/nvme-tcp-remove-incorrect-kconfig-dep-in-blk_dev_nvm.patch b/queue-5.4/nvme-tcp-remove-incorrect-kconfig-dep-in-blk_dev_nvm.patch new file mode 100644 index 00000000000..4a3ad3e949e --- /dev/null +++ b/queue-5.4/nvme-tcp-remove-incorrect-kconfig-dep-in-blk_dev_nvm.patch @@ -0,0 +1,37 @@ +From 70d1a57dc12cabe99ce83d1493a7c6e13330ba64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 14:51:15 -0700 +Subject: nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME + +From: Sagi Grimberg + +[ Upstream commit 042a3eaad6daeabcfaf163aa44da8ea3cf8b5496 ] + +We need to select NVME_CORE. + +Signed-off-by: Sagi Grimberg +Reviewed-by: Max Gurtovoy +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig +index 7b3f6555e67b..cf0ae71c489e 100644 +--- a/drivers/nvme/host/Kconfig ++++ b/drivers/nvme/host/Kconfig +@@ -62,7 +62,8 @@ config NVME_FC + config NVME_TCP + tristate "NVM Express over Fabrics TCP host driver" + depends on INET +- depends on BLK_DEV_NVME ++ depends on BLOCK ++ select NVME_CORE + select NVME_FABRICS + select CRYPTO + select CRYPTO_CRC32C +-- +2.30.2 + diff --git a/queue-5.4/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch b/queue-5.4/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch new file mode 100644 index 00000000000..8d524c0b7e1 --- /dev/null +++ b/queue-5.4/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch @@ -0,0 +1,45 @@ +From e9e030fabc5ac0d13c758e08b494e8fdc67a3330 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 09:20:51 +1200 +Subject: powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c + controllers + +From: Chris Packham + +[ Upstream commit 19ae697a1e4edf1d755b413e3aa38da65e2db23b ] + +The i2c controllers on the P1010 have an erratum where the documented +scheme for i2c bus recovery will not work (A-004447). A different +mechanism is needed which is documented in the P1010 Chip Errata Rev L. + +Signed-off-by: Chris Packham +Acked-by: Michael Ellerman +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi +index 1b4aafc1f6a2..9716a0484ecf 100644 +--- a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi ++++ b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi +@@ -122,7 +122,15 @@ + }; + + /include/ "pq3-i2c-0.dtsi" ++ i2c@3000 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "pq3-i2c-1.dtsi" ++ i2c@3100 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "pq3-duart-0.dtsi" + /include/ "pq3-espi-0.dtsi" + spi0: spi@7000 { +-- +2.30.2 + diff --git a/queue-5.4/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch b/queue-5.4/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch new file mode 100644 index 00000000000..f4c8a4514fc --- /dev/null +++ b/queue-5.4/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch @@ -0,0 +1,54 @@ +From 0da5e2a2d57ce662b2e52cb31a3a43023d3b4750 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 09:20:50 +1200 +Subject: powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c + controllers + +From: Chris Packham + +[ Upstream commit 7adc7b225cddcfd0f346d10144fd7a3d3d9f9ea7 ] + +The i2c controllers on the P2040/P2041 have an erratum where the +documented scheme for i2c bus recovery will not work (A-004447). A +different mechanism is needed which is documented in the P2040 Chip +Errata Rev Q (latest available at the time of writing). + +Signed-off-by: Chris Packham +Acked-by: Michael Ellerman +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi +index 872e4485dc3f..ddc018d42252 100644 +--- a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi ++++ b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi +@@ -371,7 +371,23 @@ + }; + + /include/ "qoriq-i2c-0.dtsi" ++ i2c@118000 { ++ fsl,i2c-erratum-a004447; ++ }; ++ ++ i2c@118100 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "qoriq-i2c-1.dtsi" ++ i2c@119000 { ++ fsl,i2c-erratum-a004447; ++ }; ++ ++ i2c@119100 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "qoriq-duart-0.dtsi" + /include/ "qoriq-duart-1.dtsi" + /include/ "qoriq-gpio-0.dtsi" +-- +2.30.2 + diff --git a/queue-5.4/rds-tcp-loopback-connection-can-hang.patch b/queue-5.4/rds-tcp-loopback-connection-can-hang.patch new file mode 100644 index 00000000000..73a89f1552d --- /dev/null +++ b/queue-5.4/rds-tcp-loopback-connection-can-hang.patch @@ -0,0 +1,121 @@ +From 699595088a80cf9db10e260ad11aa7b7322e44df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 11:08:06 -0700 +Subject: RDS tcp loopback connection can hang + +From: Rao Shoaib + +[ Upstream commit aced3ce57cd37b5ca332bcacd370d01f5a8c5371 ] + +When TCP is used as transport and a program on the +system connects to RDS port 16385, connection is +accepted but denied per the rules of RDS. However, +RDS connections object is left in the list. Next +loopback connection will select that connection +object as it is at the head of list. The connection +attempt will hang as the connection object is set +to connect over TCP which is not allowed + +The issue can be reproduced easily, use rds-ping +to ping a local IP address. After that use any +program like ncat to connect to the same IP +address and port 16385. This will hang so ctrl-c out. +Now try rds-ping, it will hang. + +To fix the issue this patch adds checks to disallow +the connection object creation and destroys the +connection object. + +Signed-off-by: Rao Shoaib +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 23 +++++++++++++++++------ + net/rds/tcp.c | 4 ++-- + net/rds/tcp.h | 3 ++- + net/rds/tcp_listen.c | 6 ++++++ + 4 files changed, 27 insertions(+), 9 deletions(-) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index ed7f2133acc2..c85bd6340eaa 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -240,12 +240,23 @@ static struct rds_connection *__rds_conn_create(struct net *net, + if (loop_trans) { + rds_trans_put(loop_trans); + conn->c_loopback = 1; +- if (is_outgoing && trans->t_prefer_loopback) { +- /* "outgoing" connection - and the transport +- * says it wants the connection handled by the +- * loopback transport. This is what TCP does. +- */ +- trans = &rds_loop_transport; ++ if (trans->t_prefer_loopback) { ++ if (likely(is_outgoing)) { ++ /* "outgoing" connection to local address. ++ * Protocol says it wants the connection ++ * handled by the loopback transport. ++ * This is what TCP does. ++ */ ++ trans = &rds_loop_transport; ++ } else { ++ /* No transport currently in use ++ * should end up here, but if it ++ * does, reset/destroy the connection. ++ */ ++ kmem_cache_free(rds_conn_slab, conn); ++ conn = ERR_PTR(-EOPNOTSUPP); ++ goto out; ++ } + } + } + +diff --git a/net/rds/tcp.c b/net/rds/tcp.c +index 66121bc6f34e..1402e9166a7e 100644 +--- a/net/rds/tcp.c ++++ b/net/rds/tcp.c +@@ -323,8 +323,8 @@ out: + } + #endif + +-static int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr, +- __u32 scope_id) ++int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr, ++ __u32 scope_id) + { + struct net_device *dev = NULL; + #if IS_ENABLED(CONFIG_IPV6) +diff --git a/net/rds/tcp.h b/net/rds/tcp.h +index 3c69361d21c7..4620549ecbeb 100644 +--- a/net/rds/tcp.h ++++ b/net/rds/tcp.h +@@ -60,7 +60,8 @@ u32 rds_tcp_snd_una(struct rds_tcp_connection *tc); + u64 rds_tcp_map_seq(struct rds_tcp_connection *tc, u32 seq); + extern struct rds_transport rds_tcp_transport; + void rds_tcp_accept_work(struct sock *sk); +- ++int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr, ++ __u32 scope_id); + /* tcp_connect.c */ + int rds_tcp_conn_path_connect(struct rds_conn_path *cp); + void rds_tcp_conn_path_shutdown(struct rds_conn_path *conn); +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index 810a3a49e947..26a3e18e460d 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -198,6 +198,12 @@ int rds_tcp_accept_one(struct socket *sock) + } + #endif + ++ if (!rds_tcp_laddr_check(sock_net(sock->sk), peer_addr, dev_if)) { ++ /* local address connection is only allowed via loopback */ ++ ret = -EOPNOTSUPP; ++ goto out; ++ } ++ + conn = rds_conn_create(sock_net(sock->sk), + my_addr, peer_addr, + &rds_tcp_transport, 0, GFP_KERNEL, dev_if); +-- +2.30.2 + diff --git a/queue-5.4/scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch b/queue-5.4/scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch new file mode 100644 index 00000000000..952937fe21d --- /dev/null +++ b/queue-5.4/scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch @@ -0,0 +1,36 @@ +From 1da2835dee73430c1056df360a1964f7b253512b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 23:14:16 -0700 +Subject: scsi: bnx2fc: Return failure if io_req is already in ABTS processing + +From: Javed Hasan + +[ Upstream commit 122c81c563b0c1c6b15ff76a9159af5ee1f21563 ] + +Return failure from bnx2fc_eh_abort() if io_req is already in ABTS +processing. + +Link: https://lore.kernel.org/r/20210519061416.19321-1-jhasan@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Javed Hasan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2fc/bnx2fc_io.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c +index 401743e2b429..a0e776414889 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_io.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_io.c +@@ -1219,6 +1219,7 @@ int bnx2fc_eh_abort(struct scsi_cmnd *sc_cmd) + was a result from the ABTS request rather than the CLEANUP + request */ + set_bit(BNX2FC_FLAG_IO_CLEANUP, &io_req->req_flags); ++ rc = FAILED; + goto done; + } + +-- +2.30.2 + diff --git a/queue-5.4/scsi-hisi_sas-drop-free_irq-of-devm_request_irq-allo.patch b/queue-5.4/scsi-hisi_sas-drop-free_irq-of-devm_request_irq-allo.patch new file mode 100644 index 00000000000..632d8605e10 --- /dev/null +++ b/queue-5.4/scsi-hisi_sas-drop-free_irq-of-devm_request_irq-allo.patch @@ -0,0 +1,49 @@ +From b01c199bdab4a16d813be7782306ace72733705f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 21:05:19 +0800 +Subject: scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq + +From: Yang Yingliang + +[ Upstream commit 7907a021e4bbfa29cccacd2ba2dade894d9a7d4c ] + +irqs allocated with devm_request_irq() should not be freed using +free_irq(). Doing so causes a dangling pointer and a subsequent double +free. + +Link: https://lore.kernel.org/r/20210519130519.2661938-1-yangyingliang@huawei.com +Reported-by: Hulk Robot +Acked-by: John Garry +Signed-off-by: Yang Yingliang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 723f51c822af..916447f3c607 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -3274,14 +3274,14 @@ hisi_sas_v3_destroy_irqs(struct pci_dev *pdev, struct hisi_hba *hisi_hba) + { + int i; + +- free_irq(pci_irq_vector(pdev, 1), hisi_hba); +- free_irq(pci_irq_vector(pdev, 2), hisi_hba); +- free_irq(pci_irq_vector(pdev, 11), hisi_hba); ++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 1), hisi_hba); ++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 2), hisi_hba); ++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 11), hisi_hba); + for (i = 0; i < hisi_hba->cq_nvecs; i++) { + struct hisi_sas_cq *cq = &hisi_hba->cq[i]; + int nr = hisi_sas_intr_conv ? 16 : 16 + i; + +- free_irq(pci_irq_vector(pdev, nr), cq); ++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, nr), cq); + } + pci_free_irq_vectors(pdev); + } +-- +2.30.2 + diff --git a/queue-5.4/scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch b/queue-5.4/scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch new file mode 100644 index 00000000000..ae61fa679ce --- /dev/null +++ b/queue-5.4/scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch @@ -0,0 +1,82 @@ +From f0fa1f1137bad46aceb7fc4042289b8a387ce231 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 23:35:54 +0300 +Subject: scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal + +From: Dmitry Bogdanov + +[ Upstream commit 2ef7665dfd88830f15415ba007c7c9a46be7acd8 ] + +Target de-configuration panics at high CPU load because TPGT and WWPN can +be removed on separate threads. + +TPGT removal requests a reset HBA on a separate thread and waits for reset +complete (phase1). Due to high CPU load that HBA reset can be delayed for +some time. + +WWPN removal does qlt_stop_phase2(). There it is believed that phase1 has +already completed and thus tgt.tgt_ops is subsequently cleared. However, +tgt.tgt_ops is needed to process incoming traffic and therefore this will +cause one of the following panics: + +NIP qlt_reset+0x7c/0x220 [qla2xxx] +LR qlt_reset+0x68/0x220 [qla2xxx] +Call Trace: +0xc000003ffff63a78 (unreliable) +qlt_handle_imm_notify+0x800/0x10c0 [qla2xxx] +qlt_24xx_atio_pkt+0x208/0x590 [qla2xxx] +qlt_24xx_process_atio_queue+0x33c/0x7a0 [qla2xxx] +qla83xx_msix_atio_q+0x54/0x90 [qla2xxx] + +or + +NIP qlt_24xx_handle_abts+0xd0/0x2a0 [qla2xxx] +LR qlt_24xx_handle_abts+0xb4/0x2a0 [qla2xxx] +Call Trace: +qlt_24xx_handle_abts+0x90/0x2a0 [qla2xxx] (unreliable) +qlt_24xx_process_atio_queue+0x500/0x7a0 [qla2xxx] +qla83xx_msix_atio_q+0x54/0x90 [qla2xxx] + +or + +NIP qlt_create_sess+0x90/0x4e0 [qla2xxx] +LR qla24xx_do_nack_work+0xa8/0x180 [qla2xxx] +Call Trace: +0xc0000000348fba30 (unreliable) +qla24xx_do_nack_work+0xa8/0x180 [qla2xxx] +qla2x00_do_work+0x674/0xbf0 [qla2xxx] +qla2x00_iocb_work_fn + +The patch fixes the issue by serializing qlt_stop_phase1() and +qlt_stop_phase2() functions to make WWPN removal wait for phase1 +completion. + +Link: https://lore.kernel.org/r/20210415203554.27890-1-d.bogdanov@yadro.com +Reviewed-by: Roman Bolshakov +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 509539ec58e9..57068e2faef5 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1559,10 +1559,12 @@ void qlt_stop_phase2(struct qla_tgt *tgt) + return; + } + ++ mutex_lock(&tgt->ha->optrom_mutex); + mutex_lock(&vha->vha_tgt.tgt_mutex); + tgt->tgt_stop = 0; + tgt->tgt_stopped = 1; + mutex_unlock(&vha->vha_tgt.tgt_mutex); ++ mutex_unlock(&tgt->ha->optrom_mutex); + + ql_dbg(ql_dbg_tgt_mgt, vha, 0xf00c, "Stop of tgt %p finished\n", + tgt); +-- +2.30.2 + diff --git a/queue-5.4/scsi-vmw_pvscsi-set-correct-residual-data-length.patch b/queue-5.4/scsi-vmw_pvscsi-set-correct-residual-data-length.patch new file mode 100644 index 00000000000..1bb2c75cd05 --- /dev/null +++ b/queue-5.4/scsi-vmw_pvscsi-set-correct-residual-data-length.patch @@ -0,0 +1,71 @@ +From 7f405f0371040f622a0075635075917c9ae0ec6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 09:49:32 +0000 +Subject: scsi: vmw_pvscsi: Set correct residual data length + +From: Matt Wang + +[ Upstream commit e662502b3a782d479e67736a5a1c169a703d853a ] + +Some commands (such as INQUIRY) may return less data than the initiator +requested. To avoid conducting useless information, set the right residual +count to make upper layer aware of this. + +Before (INQUIRY PAGE 0xB0 with 128B buffer): + +$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00 +SCSI Status: Good + +Received 128 bytes of data: + 00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............ + 10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@.... + 20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... ..... + 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + +After: + +$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00 +SCSI Status: Good + +Received 64 bytes of data: +00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............ +10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@.... +20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... ..... +30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + +[mkp: clarified description] + +Link: https://lore.kernel.org/r/03C41093-B62E-43A2-913E-CFC92F1C70C3@vmware.com +Signed-off-by: Matt Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/vmw_pvscsi.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index 70008816c91f..0ac342b1deb9 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -574,7 +574,13 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter, + case BTSTAT_SUCCESS: + case BTSTAT_LINKED_COMMAND_COMPLETED: + case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG: +- /* If everything went fine, let's move on.. */ ++ /* ++ * Commands like INQUIRY may transfer less data than ++ * requested by the initiator via bufflen. Set residual ++ * count to make upper layer aware of the actual amount ++ * of data returned. ++ */ ++ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen); + cmd->result = (DID_OK << 16); + break; + +-- +2.30.2 + diff --git a/queue-5.4/series b/queue-5.4/series index 54cd2a3f714..d3be8c8ee86 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -1 +1,36 @@ proc-track-proc-pid-attr-opener-mm_struct.patch +asoc-max98088-fix-ni-clock-divider-calculation.patch +spi-fix-spi-device-unregister-flow.patch +net-nfc-rawsock.c-fix-a-permission-check-bug.patch +usb-cdns3-fix-runtime-pm-imbalance-on-error.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch +vfio-ccw-serialize-fsm-idle-state-with-i-o-completio.patch +asoc-sti-sas-add-missing-module_device_table.patch +spi-sprd-add-missing-module_device_table.patch +isdn-misdn-netjet-fix-crash-in-nj_probe.patch +bonding-init-notify_work-earlier-to-avoid-uninitiali.patch +netlink-disable-irqs-for-netlink_lock_table.patch +net-mdiobus-get-rid-of-a-bug_on.patch +cgroup-disable-controllers-at-parse-time.patch +wq-handle-vm-suspension-in-stall-detection.patch +net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch +rds-tcp-loopback-connection-can-hang.patch +scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch +scsi-vmw_pvscsi-set-correct-residual-data-length.patch +scsi-hisi_sas-drop-free_irq-of-devm_request_irq-allo.patch +scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch +net-macb-ensure-the-device-is-available-before-acces.patch +net-appletalk-cops-fix-data-race-in-cops_probe1.patch +net-dsa-microchip-enable-phy-errata-workaround-on-95.patch +nvme-fabrics-decode-host-pathing-error-for-connect.patch +mips-fix-kernel-hang-under-function_graph_tracer-and.patch +dm-verity-fix-require_signatures-module_param-permis.patch +bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch +nvme-tcp-remove-incorrect-kconfig-dep-in-blk_dev_nvm.patch +powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch +powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch +spi-don-t-have-controller-clean-up-spi-device-before.patch +spi-cleanup-on-failure-of-initial-setup.patch +i2c-mpc-make-use-of-i2c_recover_bus.patch +i2c-mpc-implement-erratum-a-004447-workaround.patch diff --git a/queue-5.4/spi-cleanup-on-failure-of-initial-setup.patch b/queue-5.4/spi-cleanup-on-failure-of-initial-setup.patch new file mode 100644 index 00000000000..d43cf244c99 --- /dev/null +++ b/queue-5.4/spi-cleanup-on-failure-of-initial-setup.patch @@ -0,0 +1,275 @@ +From 1f4fb02454008cb0460779860a3aeef58386b96d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 23:10:56 +0200 +Subject: spi: Cleanup on failure of initial setup + +From: Lukas Wunner + +[ Upstream commit 2ec6f20b33eb4f62ab90bdcd620436c883ec3af6 ] + +Commit c7299fea6769 ("spi: Fix spi device unregister flow") changed the +SPI core's behavior if the ->setup() hook returns an error upon adding +an spi_device: Before, the ->cleanup() hook was invoked to free any +allocations that were made by ->setup(). With the commit, that's no +longer the case, so the ->setup() hook is expected to free the +allocations itself. + +I've identified 5 drivers which depend on the old behavior and am fixing +them up hereinafter: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c +spi-omap2-mcspi.c spi-pxa2xx.c + +Importantly, ->setup() is not only invoked on spi_device *addition*: +It may subsequently be called to *change* SPI parameters. If changing +these SPI parameters fails, freeing memory allocations would be wrong. +That should only be done if the spi_device is finally destroyed. +I am therefore using a bool "initial_setup" in 4 of the affected drivers +to differentiate between the invocation on *adding* the spi_device and +any subsequent invocations: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c +spi-omap2-mcspi.c + +In spi-pxa2xx.c, it seems the ->setup() hook can only fail on spi_device +addition, not any subsequent calls. It therefore doesn't need the bool. + +It's worth noting that 5 other drivers already perform a cleanup if the +->setup() hook fails. Before c7299fea6769, they caused a double-free +if ->setup() failed on spi_device addition. Since the commit, they're +fine. These drivers are: spi-mpc512x-psc.c spi-pl022.c spi-s3c64xx.c +spi-st-ssc4.c spi-tegra114.c + +(spi-pxa2xx.c also already performs a cleanup, but only in one of +several error paths.) + +Fixes: c7299fea6769 ("spi: Fix spi device unregister flow") +Signed-off-by: Lukas Wunner +Cc: Saravana Kannan +Acked-by: Andy Shevchenko # pxa2xx +Link: https://lore.kernel.org/r/f76a0599469f265b69c371538794101fa37b5536.1622149321.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bitbang.c | 18 ++++++++++++---- + drivers/spi/spi-fsl-spi.c | 4 ++++ + drivers/spi/spi-omap-uwire.c | 9 +++++++- + drivers/spi/spi-omap2-mcspi.c | 39 +++++++++++++++++++++-------------- + drivers/spi/spi-pxa2xx.c | 9 +++++++- + 5 files changed, 57 insertions(+), 22 deletions(-) + +diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c +index d84e22dd6f9f..7d61a3b71ee5 100644 +--- a/drivers/spi/spi-bitbang.c ++++ b/drivers/spi/spi-bitbang.c +@@ -181,6 +181,8 @@ int spi_bitbang_setup(struct spi_device *spi) + { + struct spi_bitbang_cs *cs = spi->controller_state; + struct spi_bitbang *bitbang; ++ bool initial_setup = false; ++ int retval; + + bitbang = spi_master_get_devdata(spi->master); + +@@ -189,22 +191,30 @@ int spi_bitbang_setup(struct spi_device *spi) + if (!cs) + return -ENOMEM; + spi->controller_state = cs; ++ initial_setup = true; + } + + /* per-word shift register access, in hardware or bitbanging */ + cs->txrx_word = bitbang->txrx_word[spi->mode & (SPI_CPOL|SPI_CPHA)]; +- if (!cs->txrx_word) +- return -EINVAL; ++ if (!cs->txrx_word) { ++ retval = -EINVAL; ++ goto err_free; ++ } + + if (bitbang->setup_transfer) { +- int retval = bitbang->setup_transfer(spi, NULL); ++ retval = bitbang->setup_transfer(spi, NULL); + if (retval < 0) +- return retval; ++ goto err_free; + } + + dev_dbg(&spi->dev, "%s, %u nsec/bit\n", __func__, 2 * cs->nsecs); + + return 0; ++ ++err_free: ++ if (initial_setup) ++ kfree(cs); ++ return retval; + } + EXPORT_SYMBOL_GPL(spi_bitbang_setup); + +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index 18a93a2854d8..02b999d48ca1 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -442,6 +442,7 @@ static int fsl_spi_setup(struct spi_device *spi) + { + struct mpc8xxx_spi *mpc8xxx_spi; + struct fsl_spi_reg *reg_base; ++ bool initial_setup = false; + int retval; + u32 hw_mode; + struct spi_mpc8xxx_cs *cs = spi_get_ctldata(spi); +@@ -454,6 +455,7 @@ static int fsl_spi_setup(struct spi_device *spi) + if (!cs) + return -ENOMEM; + spi_set_ctldata(spi, cs); ++ initial_setup = true; + } + mpc8xxx_spi = spi_master_get_devdata(spi->master); + +@@ -477,6 +479,8 @@ static int fsl_spi_setup(struct spi_device *spi) + retval = fsl_spi_setup_transfer(spi, NULL); + if (retval < 0) { + cs->hw_mode = hw_mode; /* Restore settings */ ++ if (initial_setup) ++ kfree(cs); + return retval; + } + +diff --git a/drivers/spi/spi-omap-uwire.c b/drivers/spi/spi-omap-uwire.c +index ce8dbdbce312..85ee907e28f9 100644 +--- a/drivers/spi/spi-omap-uwire.c ++++ b/drivers/spi/spi-omap-uwire.c +@@ -424,15 +424,22 @@ done: + static int uwire_setup(struct spi_device *spi) + { + struct uwire_state *ust = spi->controller_state; ++ bool initial_setup = false; ++ int status; + + if (ust == NULL) { + ust = kzalloc(sizeof(*ust), GFP_KERNEL); + if (ust == NULL) + return -ENOMEM; + spi->controller_state = ust; ++ initial_setup = true; + } + +- return uwire_setup_transfer(spi, NULL); ++ status = uwire_setup_transfer(spi, NULL); ++ if (status && initial_setup) ++ kfree(ust); ++ ++ return status; + } + + static void uwire_cleanup(struct spi_device *spi) +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index 7646b4b56bed..38f4be209234 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -1043,8 +1043,25 @@ static void omap2_mcspi_release_dma(struct spi_master *master) + } + } + ++static void omap2_mcspi_cleanup(struct spi_device *spi) ++{ ++ struct omap2_mcspi_cs *cs; ++ ++ if (spi->controller_state) { ++ /* Unlink controller state from context save list */ ++ cs = spi->controller_state; ++ list_del(&cs->node); ++ ++ kfree(cs); ++ } ++ ++ if (gpio_is_valid(spi->cs_gpio)) ++ gpio_free(spi->cs_gpio); ++} ++ + static int omap2_mcspi_setup(struct spi_device *spi) + { ++ bool initial_setup = false; + int ret; + struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master); + struct omap2_mcspi_regs *ctx = &mcspi->ctx; +@@ -1062,6 +1079,7 @@ static int omap2_mcspi_setup(struct spi_device *spi) + spi->controller_state = cs; + /* Link this to context save list */ + list_add_tail(&cs->node, &ctx->cs); ++ initial_setup = true; + + if (gpio_is_valid(spi->cs_gpio)) { + ret = gpio_request(spi->cs_gpio, dev_name(&spi->dev)); +@@ -1077,33 +1095,22 @@ static int omap2_mcspi_setup(struct spi_device *spi) + ret = pm_runtime_get_sync(mcspi->dev); + if (ret < 0) { + pm_runtime_put_noidle(mcspi->dev); ++ if (initial_setup) ++ omap2_mcspi_cleanup(spi); + + return ret; + } + + ret = omap2_mcspi_setup_transfer(spi, NULL); ++ if (ret && initial_setup) ++ omap2_mcspi_cleanup(spi); ++ + pm_runtime_mark_last_busy(mcspi->dev); + pm_runtime_put_autosuspend(mcspi->dev); + + return ret; + } + +-static void omap2_mcspi_cleanup(struct spi_device *spi) +-{ +- struct omap2_mcspi_cs *cs; +- +- if (spi->controller_state) { +- /* Unlink controller state from context save list */ +- cs = spi->controller_state; +- list_del(&cs->node); +- +- kfree(cs); +- } +- +- if (gpio_is_valid(spi->cs_gpio)) +- gpio_free(spi->cs_gpio); +-} +- + static irqreturn_t omap2_mcspi_irq_handler(int irq, void *data) + { + struct omap2_mcspi *mcspi = data; +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index f5a10a94f156..e32d51f27944 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1241,6 +1241,8 @@ static int setup_cs(struct spi_device *spi, struct chip_data *chip, + chip->gpio_cs_inverted = spi->mode & SPI_CS_HIGH; + + err = gpiod_direction_output(gpiod, !chip->gpio_cs_inverted); ++ if (err) ++ gpiod_put(chip->gpiod_cs); + } + + return err; +@@ -1254,6 +1256,7 @@ static int setup(struct spi_device *spi) + struct driver_data *drv_data = + spi_controller_get_devdata(spi->controller); + uint tx_thres, tx_hi_thres, rx_thres; ++ int err; + + switch (drv_data->ssp_type) { + case QUARK_X1000_SSP: +@@ -1400,7 +1403,11 @@ static int setup(struct spi_device *spi) + if (drv_data->ssp_type == CE4100_SSP) + return 0; + +- return setup_cs(spi, chip, chip_info); ++ err = setup_cs(spi, chip, chip_info); ++ if (err) ++ kfree(chip); ++ ++ return err; + } + + static void cleanup(struct spi_device *spi) +-- +2.30.2 + diff --git a/queue-5.4/spi-don-t-have-controller-clean-up-spi-device-before.patch b/queue-5.4/spi-don-t-have-controller-clean-up-spi-device-before.patch new file mode 100644 index 00000000000..b01c6fdde04 --- /dev/null +++ b/queue-5.4/spi-don-t-have-controller-clean-up-spi-device-before.patch @@ -0,0 +1,51 @@ +From e8cb6d589e049712be8d32de3a94e03d2c1da4a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 09:47:34 -0700 +Subject: spi: Don't have controller clean up spi device before driver unbind + +From: Saravana Kannan + +[ Upstream commit 27e7db56cf3dffd302bd7ddfacb1d405cf671a2a ] + +When a spi device is unregistered and triggers a driver unbind, the +driver might need to access the spi device. So, don't have the +controller clean up the spi device before the driver is unbound. Clean +up the spi device after the driver is unbound. + +Fixes: c7299fea6769 ("spi: Fix spi device unregister flow") +Reported-by: Lukas Wunner +Signed-off-by: Saravana Kannan +Tested-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210505164734.175546-1-saravanak@google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index c4b80cf825b8..f8f3434d5ab1 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -708,15 +708,15 @@ void spi_unregister_device(struct spi_device *spi) + if (!spi) + return; + +- spi_cleanup(spi); +- + if (spi->dev.of_node) { + of_node_clear_flag(spi->dev.of_node, OF_POPULATED); + of_node_put(spi->dev.of_node); + } + if (ACPI_COMPANION(&spi->dev)) + acpi_device_clear_enumerated(ACPI_COMPANION(&spi->dev)); +- device_unregister(&spi->dev); ++ device_del(&spi->dev); ++ spi_cleanup(spi); ++ put_device(&spi->dev); + } + EXPORT_SYMBOL_GPL(spi_unregister_device); + +-- +2.30.2 + diff --git a/queue-5.4/spi-fix-spi-device-unregister-flow.patch b/queue-5.4/spi-fix-spi-device-unregister-flow.patch new file mode 100644 index 00000000000..984ba6c27ad --- /dev/null +++ b/queue-5.4/spi-fix-spi-device-unregister-flow.patch @@ -0,0 +1,92 @@ +From 59655296c837c77b77c73243141b9ccb033b95f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 16:56:38 -0700 +Subject: spi: Fix spi device unregister flow + +From: Saravana Kannan + +[ Upstream commit c7299fea67696db5bd09d924d1f1080d894f92ef ] + +When an SPI device is unregistered, the spi->controller->cleanup() is +called in the device's release callback. That's wrong for a couple of +reasons: + +1. spi_dev_put() can be called before spi_add_device() is called. And + it's spi_add_device() that calls spi_setup(). This will cause clean() + to get called without the spi device ever being setup. + +2. There's no guarantee that the controller's driver would be present by + the time the spi device's release function gets called. + +3. It also causes "sleeping in atomic context" stack dump[1] when device + link deletion code does a put_device() on the spi device. + +Fix these issues by simply moving the cleanup from the device release +callback to the actual spi_unregister_device() function. + +[1] - https://lore.kernel.org/lkml/CAHp75Vc=FCGcUyS0v6fnxme2YJ+qD+Y-hQDQLa2JhWNON9VmsQ@mail.gmail.com/ + +Signed-off-by: Saravana Kannan +Link: https://lore.kernel.org/r/20210426235638.1285530-1-saravanak@google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 7592d4de20c9..c4b80cf825b8 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -47,10 +47,6 @@ static void spidev_release(struct device *dev) + { + struct spi_device *spi = to_spi_device(dev); + +- /* spi controllers may cleanup for released devices */ +- if (spi->controller->cleanup) +- spi->controller->cleanup(spi); +- + spi_controller_put(spi->controller); + kfree(spi->driver_override); + kfree(spi); +@@ -549,6 +545,12 @@ static int spi_dev_check(struct device *dev, void *data) + return 0; + } + ++static void spi_cleanup(struct spi_device *spi) ++{ ++ if (spi->controller->cleanup) ++ spi->controller->cleanup(spi); ++} ++ + /** + * spi_add_device - Add spi_device allocated with spi_alloc_device + * @spi: spi_device to register +@@ -613,11 +615,13 @@ int spi_add_device(struct spi_device *spi) + + /* Device may be bound to an active driver when this returns */ + status = device_add(&spi->dev); +- if (status < 0) ++ if (status < 0) { + dev_err(dev, "can't add %s, status %d\n", + dev_name(&spi->dev), status); +- else ++ spi_cleanup(spi); ++ } else { + dev_dbg(dev, "registered child %s\n", dev_name(&spi->dev)); ++ } + + done: + mutex_unlock(&spi_add_lock); +@@ -704,6 +708,8 @@ void spi_unregister_device(struct spi_device *spi) + if (!spi) + return; + ++ spi_cleanup(spi); ++ + if (spi->dev.of_node) { + of_node_clear_flag(spi->dev.of_node, OF_POPULATED); + of_node_put(spi->dev.of_node); +-- +2.30.2 + diff --git a/queue-5.4/spi-sprd-add-missing-module_device_table.patch b/queue-5.4/spi-sprd-add-missing-module_device_table.patch new file mode 100644 index 00000000000..4b6bfdb7b63 --- /dev/null +++ b/queue-5.4/spi-sprd-add-missing-module_device_table.patch @@ -0,0 +1,37 @@ +From 5191e668dba2116e818bf5f3604a58e86ca4fe01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 17:35:34 +0800 +Subject: spi: sprd: Add missing MODULE_DEVICE_TABLE + +From: Chunyan Zhang + +[ Upstream commit 7907cad7d07e0055789ec0c534452f19dfe1fc80 ] + +MODULE_DEVICE_TABLE is used to extract the device information out of the +driver and builds a table when being compiled. If using this macro, +kernel can find the driver if available when the device is plugged in, +and then loads that driver and initializes the device. + +Signed-off-by: Chunyan Zhang +Link: https://lore.kernel.org/r/20210512093534.243040-1-zhang.lyra@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sprd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-sprd.c b/drivers/spi/spi-sprd.c +index c2bdf19ccdd2..44dc7b5b45ad 100644 +--- a/drivers/spi/spi-sprd.c ++++ b/drivers/spi/spi-sprd.c +@@ -1066,6 +1066,7 @@ static const struct of_device_id sprd_spi_of_match[] = { + { .compatible = "sprd,sc9860-spi", }, + { /* sentinel */ } + }; ++MODULE_DEVICE_TABLE(of, sprd_spi_of_match); + + static struct platform_driver sprd_spi_driver = { + .driver = { +-- +2.30.2 + diff --git a/queue-5.4/usb-cdns3-fix-runtime-pm-imbalance-on-error.patch b/queue-5.4/usb-cdns3-fix-runtime-pm-imbalance-on-error.patch new file mode 100644 index 00000000000..09797d2c8b2 --- /dev/null +++ b/queue-5.4/usb-cdns3-fix-runtime-pm-imbalance-on-error.patch @@ -0,0 +1,40 @@ +From a0e37b5a8bdc5dbc7e999e98feee972ff2e0bea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 13:49:07 +0800 +Subject: usb: cdns3: Fix runtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit e5b913496099527abe46e175e5e2c844367bded0 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus a pairing decrement is needed on +the error handling path to keep the counter balanced. + +Reviewed-by: Peter Chen +Signed-off-by: Dinghao Liu +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/gadget.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/cdns3/gadget.c b/drivers/usb/cdns3/gadget.c +index c0c39cf30387..f32f00c49571 100644 +--- a/drivers/usb/cdns3/gadget.c ++++ b/drivers/usb/cdns3/gadget.c +@@ -2706,8 +2706,10 @@ static int __cdns3_gadget_init(struct cdns3 *cdns) + pm_runtime_get_sync(cdns->dev); + + ret = cdns3_gadget_start(cdns); +- if (ret) ++ if (ret) { ++ pm_runtime_put_sync(cdns->dev); + return ret; ++ } + + /* + * Because interrupt line can be shared with other components in +-- +2.30.2 + diff --git a/queue-5.4/vfio-ccw-serialize-fsm-idle-state-with-i-o-completio.patch b/queue-5.4/vfio-ccw-serialize-fsm-idle-state-with-i-o-completio.patch new file mode 100644 index 00000000000..7ad22aedab0 --- /dev/null +++ b/queue-5.4/vfio-ccw-serialize-fsm-idle-state-with-i-o-completio.patch @@ -0,0 +1,85 @@ +From 42c8d6377b4e84ebcce3a1793ed5886631ba8c57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 21:56:31 +0200 +Subject: vfio-ccw: Serialize FSM IDLE state with I/O completion + +From: Eric Farman + +[ Upstream commit 2af7a834a435460d546f0cf0a8b8e4d259f1d910 ] + +Today, the stacked call to vfio_ccw_sch_io_todo() does three things: + + 1) Update a solicited IRB with CP information, and release the CP + if the interrupt was the end of a START operation. + 2) Copy the IRB data into the io_region, under the protection of + the io_mutex + 3) Reset the vfio-ccw FSM state to IDLE to acknowledge that + vfio-ccw can accept more work. + +The trouble is that step 3 is (A) invoked for both solicited and +unsolicited interrupts, and (B) sitting after the mutex for step 2. +This second piece becomes a problem if it processes an interrupt +for a CLEAR SUBCHANNEL while another thread initiates a START, +thus allowing the CP and FSM states to get out of sync. That is: + + CPU 1 CPU 2 + fsm_do_clear() + fsm_irq() + fsm_io_request() + vfio_ccw_sch_io_todo() + fsm_io_helper() + +Since the FSM state and CP should be kept in sync, let's make a +note when the CP is released, and rely on that as an indication +that the FSM should also be reset at the end of this routine and +open up the device for more work. + +Signed-off-by: Eric Farman +Acked-by: Matthew Rosato +Reviewed-by: Cornelia Huck +Message-Id: <20210511195631.3995081-4-farman@linux.ibm.com> +Signed-off-by: Cornelia Huck +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/vfio_ccw_drv.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c +index 339a6bc0339b..fd590d1cffc1 100644 +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -83,6 +83,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) + struct vfio_ccw_private *private; + struct irb *irb; + bool is_final; ++ bool cp_is_finished = false; + + private = container_of(work, struct vfio_ccw_private, io_work); + irb = &private->irb; +@@ -91,14 +92,21 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) + (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); + if (scsw_is_solicited(&irb->scsw)) { + cp_update_scsw(&private->cp, &irb->scsw); +- if (is_final && private->state == VFIO_CCW_STATE_CP_PENDING) ++ if (is_final && private->state == VFIO_CCW_STATE_CP_PENDING) { + cp_free(&private->cp); ++ cp_is_finished = true; ++ } + } + mutex_lock(&private->io_mutex); + memcpy(private->io_region->irb_area, irb, sizeof(*irb)); + mutex_unlock(&private->io_mutex); + +- if (private->mdev && is_final) ++ /* ++ * Reset to IDLE only if processing of a channel program ++ * has finished. Do not overwrite a possible processing ++ * state if the final interrupt was for HSCH or CSCH. ++ */ ++ if (private->mdev && cp_is_finished) + private->state = VFIO_CCW_STATE_IDLE; + + if (private->io_trigger) +-- +2.30.2 + diff --git a/queue-5.4/wq-handle-vm-suspension-in-stall-detection.patch b/queue-5.4/wq-handle-vm-suspension-in-stall-detection.patch new file mode 100644 index 00000000000..a7d76d6f765 --- /dev/null +++ b/queue-5.4/wq-handle-vm-suspension-in-stall-detection.patch @@ -0,0 +1,89 @@ +From d7d5e3f959198acb379c66d7c0c93a17bfb8349f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 19:14:22 +0900 +Subject: wq: handle VM suspension in stall detection + +From: Sergey Senozhatsky + +[ Upstream commit 940d71c6462e8151c78f28e4919aa8882ff2054e ] + +If VCPU is suspended (VM suspend) in wq_watchdog_timer_fn() then +once this VCPU resumes it will see the new jiffies value, while it +may take a while before IRQ detects PVCLOCK_GUEST_STOPPED on this +VCPU and updates all the watchdogs via pvclock_touch_watchdogs(). +There is a small chance of misreported WQ stalls in the meantime, +because new jiffies is time_after() old 'ts + thresh'. + +wq_watchdog_timer_fn() +{ + for_each_pool(pool, pi) { + if (time_after(jiffies, ts + thresh)) { + pr_emerg("BUG: workqueue lockup - pool"); + } + } +} + +Save jiffies at the beginning of this function and use that value +for stall detection. If VM gets suspended then we continue using +"old" jiffies value and old WQ touch timestamps. If IRQ at some +point restarts the stall detection cycle (pvclock_touch_watchdogs()) +then old jiffies will always be before new 'ts + thresh'. + +Signed-off-by: Sergey Senozhatsky +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/workqueue.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 5d7092e32912..8f41499d8257 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -50,6 +50,7 @@ + #include + #include + #include ++#include + + #include "workqueue_internal.h" + +@@ -5734,6 +5735,7 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) + { + unsigned long thresh = READ_ONCE(wq_watchdog_thresh) * HZ; + bool lockup_detected = false; ++ unsigned long now = jiffies; + struct worker_pool *pool; + int pi; + +@@ -5748,6 +5750,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) + if (list_empty(&pool->worklist)) + continue; + ++ /* ++ * If a virtual machine is stopped by the host it can look to ++ * the watchdog like a stall. ++ */ ++ kvm_check_and_clear_guest_paused(); ++ + /* get the latest of pool and touched timestamps */ + pool_ts = READ_ONCE(pool->watchdog_ts); + touched = READ_ONCE(wq_watchdog_touched); +@@ -5766,12 +5774,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) + } + + /* did we stall? */ +- if (time_after(jiffies, ts + thresh)) { ++ if (time_after(now, ts + thresh)) { + lockup_detected = true; + pr_emerg("BUG: workqueue lockup - pool"); + pr_cont_pool_info(pool); + pr_cont(" stuck for %us!\n", +- jiffies_to_msecs(jiffies - pool_ts) / 1000); ++ jiffies_to_msecs(now - pool_ts) / 1000); + } + } + +-- +2.30.2 +