From: Sasha Levin Date: Sun, 11 Jul 2021 14:44:12 +0000 (-0400) Subject: Fixes for 5.12 X-Git-Tag: v5.4.132~30^2~6 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2d4f7e7102b844c8a8d3de97e115d59d46a5b2ff;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.12 Signed-off-by: Sasha Levin --- diff --git a/queue-5.12/acpi-apei-fix-synchronous-external-aborts-in-user-mo.patch b/queue-5.12/acpi-apei-fix-synchronous-external-aborts-in-user-mo.patch new file mode 100644 index 00000000000..47192655f32 --- /dev/null +++ b/queue-5.12/acpi-apei-fix-synchronous-external-aborts-in-user-mo.patch @@ -0,0 +1,160 @@ +From c8d133361aa0c4364974421540a2534f23fe2dc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jun 2021 20:37:07 +0800 +Subject: ACPI: APEI: fix synchronous external aborts in user-mode + +From: Xiaofei Tan + +[ Upstream commit ccb5ecdc2ddeaff744ee075b54cdff8a689e8fa7 ] + +Before commit 8fcc4ae6faf8 ("arm64: acpi: Make apei_claim_sea() +synchronise with APEI's irq work"), do_sea() would unconditionally +signal the affected task from the arch code. Since that change, +the GHES driver sends the signals. + +This exposes a problem as errors the GHES driver doesn't understand +or doesn't handle effectively are silently ignored. It will cause +the errors get taken again, and circulate endlessly. User-space task +get stuck in this loop. + +Existing firmware on Kunpeng9xx systems reports cache errors with the +'ARM Processor Error' CPER records. + +Do memory failure handling for ARM Processor Error Section just like +for Memory Error Section. + +Fixes: 8fcc4ae6faf8 ("arm64: acpi: Make apei_claim_sea() synchronise with APEI's irq work") +Signed-off-by: Xiaofei Tan +Reviewed-by: James Morse +[ rjw: Subject edit ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/ghes.c | 81 +++++++++++++++++++++++++++++++--------- + 1 file changed, 64 insertions(+), 17 deletions(-) + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index fce7ade2aba9..0c8330ed1ffd 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -441,28 +441,35 @@ static void ghes_kick_task_work(struct callback_head *head) + gen_pool_free(ghes_estatus_pool, (unsigned long)estatus_node, node_len); + } + +-static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, +- int sev) ++static bool ghes_do_memory_failure(u64 physical_addr, int flags) + { + unsigned long pfn; +- int flags = -1; +- int sec_sev = ghes_severity(gdata->error_severity); +- struct cper_sec_mem_err *mem_err = acpi_hest_get_payload(gdata); + + if (!IS_ENABLED(CONFIG_ACPI_APEI_MEMORY_FAILURE)) + return false; + +- if (!(mem_err->validation_bits & CPER_MEM_VALID_PA)) +- return false; +- +- pfn = mem_err->physical_addr >> PAGE_SHIFT; ++ pfn = PHYS_PFN(physical_addr); + if (!pfn_valid(pfn)) { + pr_warn_ratelimited(FW_WARN GHES_PFX + "Invalid address in generic error data: %#llx\n", +- mem_err->physical_addr); ++ physical_addr); + return false; + } + ++ memory_failure_queue(pfn, flags); ++ return true; ++} ++ ++static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, ++ int sev) ++{ ++ int flags = -1; ++ int sec_sev = ghes_severity(gdata->error_severity); ++ struct cper_sec_mem_err *mem_err = acpi_hest_get_payload(gdata); ++ ++ if (!(mem_err->validation_bits & CPER_MEM_VALID_PA)) ++ return false; ++ + /* iff following two events can be handled properly by now */ + if (sec_sev == GHES_SEV_CORRECTED && + (gdata->flags & CPER_SEC_ERROR_THRESHOLD_EXCEEDED)) +@@ -470,14 +477,56 @@ static bool ghes_handle_memory_failure(struct acpi_hest_generic_data *gdata, + if (sev == GHES_SEV_RECOVERABLE && sec_sev == GHES_SEV_RECOVERABLE) + flags = 0; + +- if (flags != -1) { +- memory_failure_queue(pfn, flags); +- return true; +- } ++ if (flags != -1) ++ return ghes_do_memory_failure(mem_err->physical_addr, flags); + + return false; + } + ++static bool ghes_handle_arm_hw_error(struct acpi_hest_generic_data *gdata, int sev) ++{ ++ struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); ++ bool queued = false; ++ int sec_sev, i; ++ char *p; ++ ++ log_arm_hw_error(err); ++ ++ sec_sev = ghes_severity(gdata->error_severity); ++ if (sev != GHES_SEV_RECOVERABLE || sec_sev != GHES_SEV_RECOVERABLE) ++ return false; ++ ++ p = (char *)(err + 1); ++ for (i = 0; i < err->err_info_num; i++) { ++ struct cper_arm_err_info *err_info = (struct cper_arm_err_info *)p; ++ bool is_cache = (err_info->type == CPER_ARM_CACHE_ERROR); ++ bool has_pa = (err_info->validation_bits & CPER_ARM_INFO_VALID_PHYSICAL_ADDR); ++ const char *error_type = "unknown error"; ++ ++ /* ++ * The field (err_info->error_info & BIT(26)) is fixed to set to ++ * 1 in some old firmware of HiSilicon Kunpeng920. We assume that ++ * firmware won't mix corrected errors in an uncorrected section, ++ * and don't filter out 'corrected' error here. ++ */ ++ if (is_cache && has_pa) { ++ queued = ghes_do_memory_failure(err_info->physical_fault_addr, 0); ++ p += err_info->length; ++ continue; ++ } ++ ++ if (err_info->type < ARRAY_SIZE(cper_proc_error_type_strs)) ++ error_type = cper_proc_error_type_strs[err_info->type]; ++ ++ pr_warn_ratelimited(FW_WARN GHES_PFX ++ "Unhandled processor error type: %s\n", ++ error_type); ++ p += err_info->length; ++ } ++ ++ return queued; ++} ++ + /* + * PCIe AER errors need to be sent to the AER driver for reporting and + * recovery. The GHES severities map to the following AER severities and +@@ -605,9 +654,7 @@ static bool ghes_do_proc(struct ghes *ghes, + ghes_handle_aer(gdata); + } + else if (guid_equal(sec_type, &CPER_SEC_PROC_ARM)) { +- struct cper_sec_proc_arm *err = acpi_hest_get_payload(gdata); +- +- log_arm_hw_error(err); ++ queued = ghes_handle_arm_hw_error(gdata, sev); + } else { + void *err = acpi_hest_get_payload(gdata); + +-- +2.30.2 + diff --git a/queue-5.12/acpi-bgrt-fix-cfi-violation.patch b/queue-5.12/acpi-bgrt-fix-cfi-violation.patch new file mode 100644 index 00000000000..f64674baaee --- /dev/null +++ b/queue-5.12/acpi-bgrt-fix-cfi-violation.patch @@ -0,0 +1,125 @@ +From eee82c94b7b560c38152f0f8893abc452809d07b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 18:38:01 -0700 +Subject: ACPI: bgrt: Fix CFI violation + +From: Nathan Chancellor + +[ Upstream commit f37ccf8fce155d08ae2a4fb3db677911ced0c21a ] + +clang's Control Flow Integrity requires that every indirect call has a +valid target, which is based on the type of the function pointer. The +*_show() functions in this file are written as if they will be called +from dev_attr_show(); however, they will be called from +sysfs_kf_seq_show() because the files were created by +sysfs_create_group() and the sysfs ops are based on kobj_sysfs_ops +because of kobject_add_and_create(). Because the *_show() functions do +not match the type of the show() member in struct kobj_attribute, there +is a CFI violation. + +$ cat /sys/firmware/acpi/bgrt/{status,type,version,{x,y}offset}} +1 +0 +1 +522 +307 + +$ dmesg | grep "CFI failure" +[ 267.761825] CFI failure (target: type_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): +[ 267.762246] CFI failure (target: xoffset_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): +[ 267.762584] CFI failure (target: status_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): +[ 267.762973] CFI failure (target: yoffset_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): +[ 267.763330] CFI failure (target: version_show.d5e1ad21498a5fd14edbc5c320906598.cfi_jt+0x0/0x8): + +Convert these functions to the type of the show() member in struct +kobj_attribute so that there is no more CFI violation. Because these +functions are all so similar, combine them into a macro. + +Fixes: d1ff4b1cdbab ("ACPI: Add support for exposing BGRT data") +Link: https://github.com/ClangBuiltLinux/linux/issues/1406 +Signed-off-by: Nathan Chancellor +Reviewed-by: Kees Cook +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/bgrt.c | 57 ++++++++++++++------------------------------- + 1 file changed, 18 insertions(+), 39 deletions(-) + +diff --git a/drivers/acpi/bgrt.c b/drivers/acpi/bgrt.c +index 19bb7f870204..e0d14017706e 100644 +--- a/drivers/acpi/bgrt.c ++++ b/drivers/acpi/bgrt.c +@@ -15,40 +15,19 @@ + static void *bgrt_image; + static struct kobject *bgrt_kobj; + +-static ssize_t version_show(struct device *dev, +- struct device_attribute *attr, char *buf) +-{ +- return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab.version); +-} +-static DEVICE_ATTR_RO(version); +- +-static ssize_t status_show(struct device *dev, +- struct device_attribute *attr, char *buf) +-{ +- return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab.status); +-} +-static DEVICE_ATTR_RO(status); +- +-static ssize_t type_show(struct device *dev, +- struct device_attribute *attr, char *buf) +-{ +- return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab.image_type); +-} +-static DEVICE_ATTR_RO(type); +- +-static ssize_t xoffset_show(struct device *dev, +- struct device_attribute *attr, char *buf) +-{ +- return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab.image_offset_x); +-} +-static DEVICE_ATTR_RO(xoffset); +- +-static ssize_t yoffset_show(struct device *dev, +- struct device_attribute *attr, char *buf) +-{ +- return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab.image_offset_y); +-} +-static DEVICE_ATTR_RO(yoffset); ++#define BGRT_SHOW(_name, _member) \ ++ static ssize_t _name##_show(struct kobject *kobj, \ ++ struct kobj_attribute *attr, char *buf) \ ++ { \ ++ return snprintf(buf, PAGE_SIZE, "%d\n", bgrt_tab._member); \ ++ } \ ++ struct kobj_attribute bgrt_attr_##_name = __ATTR_RO(_name) ++ ++BGRT_SHOW(version, version); ++BGRT_SHOW(status, status); ++BGRT_SHOW(type, image_type); ++BGRT_SHOW(xoffset, image_offset_x); ++BGRT_SHOW(yoffset, image_offset_y); + + static ssize_t image_read(struct file *file, struct kobject *kobj, + struct bin_attribute *attr, char *buf, loff_t off, size_t count) +@@ -60,11 +39,11 @@ static ssize_t image_read(struct file *file, struct kobject *kobj, + static BIN_ATTR_RO(image, 0); /* size gets filled in later */ + + static struct attribute *bgrt_attributes[] = { +- &dev_attr_version.attr, +- &dev_attr_status.attr, +- &dev_attr_type.attr, +- &dev_attr_xoffset.attr, +- &dev_attr_yoffset.attr, ++ &bgrt_attr_version.attr, ++ &bgrt_attr_status.attr, ++ &bgrt_attr_type.attr, ++ &bgrt_attr_xoffset.attr, ++ &bgrt_attr_yoffset.attr, + NULL, + }; + +-- +2.30.2 + diff --git a/queue-5.12/acpi-bus-call-kobject_put-in-acpi_init-error-path.patch b/queue-5.12/acpi-bus-call-kobject_put-in-acpi_init-error-path.patch new file mode 100644 index 00000000000..194e8a9b04a --- /dev/null +++ b/queue-5.12/acpi-bus-call-kobject_put-in-acpi_init-error-path.patch @@ -0,0 +1,36 @@ +From 70c67b1ecd11a3b5891b9e79b8fc61194295cabb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 17:36:50 +0800 +Subject: ACPI: bus: Call kobject_put() in acpi_init() error path + +From: Hanjun Guo + +[ Upstream commit 4ac7a817f1992103d4e68e9837304f860b5e7300 ] + +Although the system will not be in a good condition or it will not +boot if acpi_bus_init() fails, it is still necessary to put the +kobject in the error path before returning to avoid leaking memory. + +Signed-off-by: Hanjun Guo +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/bus.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index a4bd673934c0..44b4f02e2c6d 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -1321,6 +1321,7 @@ static int __init acpi_init(void) + + result = acpi_bus_init(); + if (result) { ++ kobject_put(acpi_kobj); + disable_acpi(); + return result; + } +-- +2.30.2 + diff --git a/queue-5.12/acpi-ec-make-more-asus-laptops-use-ecdt-_gpe.patch b/queue-5.12/acpi-ec-make-more-asus-laptops-use-ecdt-_gpe.patch new file mode 100644 index 00000000000..ea812ab8a08 --- /dev/null +++ b/queue-5.12/acpi-ec-make-more-asus-laptops-use-ecdt-_gpe.patch @@ -0,0 +1,54 @@ +From 3364c2955aa694ce4ce36f3b88b2dcc5d9919295 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 11:09:50 +0800 +Subject: ACPI: EC: Make more Asus laptops use ECDT _GPE + +From: Chris Chiu + +[ Upstream commit 6306f0431914beaf220634ad36c08234006571d5 ] + +More ASUS laptops have the _GPE define in the DSDT table with a +different value than the _GPE number in the ECDT. + +This is causing media keys not working on ASUS X505BA/BP, X542BA/BP + +Add model info to the quirks list. + +Signed-off-by: Chris Chiu +Signed-off-by: Jian-Hong Pan +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/ec.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 13565629ce0a..e8c5da2b964a 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1846,6 +1846,22 @@ static const struct dmi_system_id ec_dmi_table[] __initconst = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "GL702VMK"),}, NULL}, + { ++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X505BA", { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X505BA"),}, NULL}, ++ { ++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X505BP", { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X505BP"),}, NULL}, ++ { ++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X542BA", { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X542BA"),}, NULL}, ++ { ++ ec_honor_ecdt_gpe, "ASUSTeK COMPUTER INC. X542BP", { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "X542BP"),}, NULL}, ++ { + ec_honor_ecdt_gpe, "ASUS X550VXK", { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X550VXK"),}, NULL}, +-- +2.30.2 + diff --git a/queue-5.12/acpi-ec-trust-dsdt-gpe-for-certain-hp-laptop.patch b/queue-5.12/acpi-ec-trust-dsdt-gpe-for-certain-hp-laptop.patch new file mode 100644 index 00000000000..6ef7d9579f9 --- /dev/null +++ b/queue-5.12/acpi-ec-trust-dsdt-gpe-for-certain-hp-laptop.patch @@ -0,0 +1,84 @@ +From 45ce3f36cd3e936abe6ef358cb65b43ef59f280d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 09:37:27 +0800 +Subject: ACPI: EC: trust DSDT GPE for certain HP laptop + +From: Zhang Rui + +[ Upstream commit 4370cbf350dbaca984dbda9f9ce3fac45d6949d5 ] + +On HP Pavilion Gaming Laptop 15-cx0xxx, the ECDT EC and DSDT EC share +the same port addresses but different GPEs. And the DSDT GPE is the +right one to use. + +The current code duplicates DSDT EC with ECDT EC if the port addresses +are the same, and uses ECDT GPE as a result, which breaks this machine. + +Introduce a new quirk for the HP laptop to trust the DSDT GPE, +and avoid duplicating even if the port addresses are the same. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=209989 +Reported-and-tested-by: Shao Fu, Chen +Signed-off-by: Zhang Rui +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/ec.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index e8c5da2b964a..87c3b4a099b9 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -183,6 +183,7 @@ static struct workqueue_struct *ec_query_wq; + + static int EC_FLAGS_CORRECT_ECDT; /* Needs ECDT port address correction */ + static int EC_FLAGS_IGNORE_DSDT_GPE; /* Needs ECDT GPE as correction setting */ ++static int EC_FLAGS_TRUST_DSDT_GPE; /* Needs DSDT GPE as correction setting */ + static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */ + + /* -------------------------------------------------------------------------- +@@ -1593,7 +1594,8 @@ static int acpi_ec_add(struct acpi_device *device) + } + + if (boot_ec && ec->command_addr == boot_ec->command_addr && +- ec->data_addr == boot_ec->data_addr) { ++ ec->data_addr == boot_ec->data_addr && ++ !EC_FLAGS_TRUST_DSDT_GPE) { + /* + * Trust PNP0C09 namespace location rather than + * ECDT ID. But trust ECDT GPE rather than _GPE +@@ -1816,6 +1818,18 @@ static int ec_correct_ecdt(const struct dmi_system_id *id) + return 0; + } + ++/* ++ * Some ECDTs contain wrong GPE setting, but they share the same port addresses ++ * with DSDT EC, don't duplicate the DSDT EC with ECDT EC in this case. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=209989 ++ */ ++static int ec_honor_dsdt_gpe(const struct dmi_system_id *id) ++{ ++ pr_debug("Detected system needing DSDT GPE setting.\n"); ++ EC_FLAGS_TRUST_DSDT_GPE = 1; ++ return 0; ++} ++ + /* + * Some DSDTs contain wrong GPE setting. + * Asus FX502VD/VE, GL702VMK, X550VXK, X580VD +@@ -1870,6 +1884,11 @@ static const struct dmi_system_id ec_dmi_table[] __initconst = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "X580VD"),}, NULL}, + { ++ /* https://bugzilla.kernel.org/show_bug.cgi?id=209989 */ ++ ec_honor_dsdt_gpe, "HP Pavilion Gaming Laptop 15-cx0xxx", { ++ DMI_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion Gaming Laptop 15-cx0xxx"),}, NULL}, ++ { + ec_clear_on_resume, "Samsung hardware", { + DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL}, + {}, +-- +2.30.2 + diff --git a/queue-5.12/acpi-pm-fan-put-fan-device-ids-into-separate-header-.patch b/queue-5.12/acpi-pm-fan-put-fan-device-ids-into-separate-header-.patch new file mode 100644 index 00000000000..dd97930081a --- /dev/null +++ b/queue-5.12/acpi-pm-fan-put-fan-device-ids-into-separate-header-.patch @@ -0,0 +1,102 @@ +From a5d5eedfd4e94310ce02f4b4c1a1e655098d9411 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 21:08:51 +0200 +Subject: ACPI: PM / fan: Put fan device IDs into separate header file + +From: Rafael J. Wysocki + +[ Upstream commit b9370dceabb7841c5e65ce4ee4405b9db5231fc4 ] + +The ACPI fan device IDs are shared between the fan driver and the +device power management code. The former is modular, so it needs +to include the table of device IDs for module autoloading and the +latter needs that list to avoid attaching the generic ACPI PM domain +to fan devices (which doesn't make sense) possibly before the fan +driver module is loaded. + +Unfortunately, that requires the list of fan device IDs to be +updated in two places which is prone to mistakes, so put it into +a symbol definition in a separate header file so there is only one +copy of it in case it needs to be updated again in the future. + +Fixes: b9ea0bae260f ("ACPI: PM: Avoid attaching ACPI PM domain to certain devices") +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/device_pm.c | 6 ++---- + drivers/acpi/fan.c | 7 +++---- + drivers/acpi/fan.h | 13 +++++++++++++ + 3 files changed, 18 insertions(+), 8 deletions(-) + create mode 100644 drivers/acpi/fan.h + +diff --git a/drivers/acpi/device_pm.c b/drivers/acpi/device_pm.c +index 58876248b192..a63dd10d9aa9 100644 +--- a/drivers/acpi/device_pm.c ++++ b/drivers/acpi/device_pm.c +@@ -20,6 +20,7 @@ + #include + #include + ++#include "fan.h" + #include "internal.h" + + /** +@@ -1307,10 +1308,7 @@ int acpi_dev_pm_attach(struct device *dev, bool power_on) + * with the generic ACPI PM domain. + */ + static const struct acpi_device_id special_pm_ids[] = { +- {"PNP0C0B", }, /* Generic ACPI fan */ +- {"INT3404", }, /* Fan */ +- {"INTC1044", }, /* Fan for Tiger Lake generation */ +- {"INTC1048", }, /* Fan for Alder Lake generation */ ++ ACPI_FAN_DEVICE_IDS, + {} + }; + struct acpi_device *adev = ACPI_COMPANION(dev); +diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c +index 66c3983f0ccc..5cd0ceb50bc8 100644 +--- a/drivers/acpi/fan.c ++++ b/drivers/acpi/fan.c +@@ -16,6 +16,8 @@ + #include + #include + ++#include "fan.h" ++ + MODULE_AUTHOR("Paul Diefenbaugh"); + MODULE_DESCRIPTION("ACPI Fan Driver"); + MODULE_LICENSE("GPL"); +@@ -24,10 +26,7 @@ static int acpi_fan_probe(struct platform_device *pdev); + static int acpi_fan_remove(struct platform_device *pdev); + + static const struct acpi_device_id fan_device_ids[] = { +- {"PNP0C0B", 0}, +- {"INT3404", 0}, +- {"INTC1044", 0}, +- {"INTC1048", 0}, ++ ACPI_FAN_DEVICE_IDS, + {"", 0}, + }; + MODULE_DEVICE_TABLE(acpi, fan_device_ids); +diff --git a/drivers/acpi/fan.h b/drivers/acpi/fan.h +new file mode 100644 +index 000000000000..dc9a6efa514b +--- /dev/null ++++ b/drivers/acpi/fan.h +@@ -0,0 +1,13 @@ ++/* SPDX-License-Identifier: GPL-2.0-only */ ++ ++/* ++ * ACPI fan device IDs are shared between the fan driver and the device power ++ * management code. ++ * ++ * Add new device IDs before the generic ACPI fan one. ++ */ ++#define ACPI_FAN_DEVICE_IDS \ ++ {"INT3404", }, /* Fan */ \ ++ {"INTC1044", }, /* Fan for Tiger Lake generation */ \ ++ {"INTC1048", }, /* Fan for Alder Lake generation */ \ ++ {"PNP0C0B", } /* Generic ACPI fan */ +-- +2.30.2 + diff --git a/queue-5.12/acpi-pm-s2idle-add-missing-lps0-functions-for-amd.patch b/queue-5.12/acpi-pm-s2idle-add-missing-lps0-functions-for-amd.patch new file mode 100644 index 00000000000..0371491798b --- /dev/null +++ b/queue-5.12/acpi-pm-s2idle-add-missing-lps0-functions-for-amd.patch @@ -0,0 +1,56 @@ +From 047916524fb4bb121223287c6e16e4203753edb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 09:20:32 -0400 +Subject: ACPI: PM: s2idle: Add missing LPS0 functions for AMD + +From: Alex Deucher + +[ Upstream commit f59a905b962c34642e862b5edec35c0eda72d70d ] + +These are supposedly not required for AMD platforms, +but at least some HP laptops seem to require it to +properly turn off the keyboard backlight. + +Based on a patch from Marcin Bachry . + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1230 +Reviewed-by: Hans de Goede +Signed-off-by: Alex Deucher +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/x86/s2idle.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/acpi/x86/s2idle.c b/drivers/acpi/x86/s2idle.c +index 2b69536cdccb..2d7ddb8a8cb6 100644 +--- a/drivers/acpi/x86/s2idle.c ++++ b/drivers/acpi/x86/s2idle.c +@@ -42,6 +42,8 @@ static const struct acpi_device_id lps0_device_ids[] = { + + /* AMD */ + #define ACPI_LPS0_DSM_UUID_AMD "e3f32452-febc-43ce-9039-932122d37721" ++#define ACPI_LPS0_ENTRY_AMD 2 ++#define ACPI_LPS0_EXIT_AMD 3 + #define ACPI_LPS0_SCREEN_OFF_AMD 4 + #define ACPI_LPS0_SCREEN_ON_AMD 5 + +@@ -408,6 +410,7 @@ int acpi_s2idle_prepare_late(void) + + if (acpi_s2idle_vendor_amd()) { + acpi_sleep_run_lps0_dsm(ACPI_LPS0_SCREEN_OFF_AMD); ++ acpi_sleep_run_lps0_dsm(ACPI_LPS0_ENTRY_AMD); + } else { + acpi_sleep_run_lps0_dsm(ACPI_LPS0_SCREEN_OFF); + acpi_sleep_run_lps0_dsm(ACPI_LPS0_ENTRY); +@@ -422,6 +425,7 @@ void acpi_s2idle_restore_early(void) + return; + + if (acpi_s2idle_vendor_amd()) { ++ acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT_AMD); + acpi_sleep_run_lps0_dsm(ACPI_LPS0_SCREEN_ON_AMD); + } else { + acpi_sleep_run_lps0_dsm(ACPI_LPS0_EXIT); +-- +2.30.2 + diff --git a/queue-5.12/acpi-processor-idle-fix-up-c-state-latency-if-not-or.patch b/queue-5.12/acpi-processor-idle-fix-up-c-state-latency-if-not-or.patch new file mode 100644 index 00000000000..d6a40f2e7ac --- /dev/null +++ b/queue-5.12/acpi-processor-idle-fix-up-c-state-latency-if-not-or.patch @@ -0,0 +1,113 @@ +From ee9c50bf13cbd61d1a778747ea08ce33b8265a36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 17:15:14 -0500 +Subject: ACPI: processor idle: Fix up C-state latency if not ordered + +From: Mario Limonciello + +[ Upstream commit 65ea8f2c6e230bdf71fed0137cf9e9d1b307db32 ] + +Generally, the C-state latency is provided by the _CST method or +FADT, but some OEM platforms using AMD Picasso, Renoir, Van Gogh, +and Cezanne set the C2 latency greater than C3's which causes the +C2 state to be skipped. + +That will block the core entering PC6, which prevents S0ix working +properly on Linux systems. + +In other operating systems, the latency values are not validated and +this does not cause problems by skipping states. + +To avoid this issue on Linux, detect when latencies are not an +arithmetic progression and sort them. + +Link: https://gitlab.freedesktop.org/agd5f/linux/-/commit/026d186e4592c1ee9c1cb44295912d0294508725 +Link: https://gitlab.freedesktop.org/drm/amd/-/issues/1230#note_712174 +Suggested-by: Prike Liang +Suggested-by: Alex Deucher +Signed-off-by: Mario Limonciello +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/processor_idle.c | 40 +++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c +index 4e2d76b8b697..6790df5a2462 100644 +--- a/drivers/acpi/processor_idle.c ++++ b/drivers/acpi/processor_idle.c +@@ -16,6 +16,7 @@ + #include + #include + #include /* need_resched() */ ++#include + #include + #include + #include +@@ -388,10 +389,37 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr, + return; + } + ++static int acpi_cst_latency_cmp(const void *a, const void *b) ++{ ++ const struct acpi_processor_cx *x = a, *y = b; ++ ++ if (!(x->valid && y->valid)) ++ return 0; ++ if (x->latency > y->latency) ++ return 1; ++ if (x->latency < y->latency) ++ return -1; ++ return 0; ++} ++static void acpi_cst_latency_swap(void *a, void *b, int n) ++{ ++ struct acpi_processor_cx *x = a, *y = b; ++ u32 tmp; ++ ++ if (!(x->valid && y->valid)) ++ return; ++ tmp = x->latency; ++ x->latency = y->latency; ++ y->latency = tmp; ++} ++ + static int acpi_processor_power_verify(struct acpi_processor *pr) + { + unsigned int i; + unsigned int working = 0; ++ unsigned int last_latency = 0; ++ unsigned int last_type = 0; ++ bool buggy_latency = false; + + pr->power.timer_broadcast_on_state = INT_MAX; + +@@ -415,12 +443,24 @@ static int acpi_processor_power_verify(struct acpi_processor *pr) + } + if (!cx->valid) + continue; ++ if (cx->type >= last_type && cx->latency < last_latency) ++ buggy_latency = true; ++ last_latency = cx->latency; ++ last_type = cx->type; + + lapic_timer_check_state(i, pr, cx); + tsc_check_state(cx->type); + working++; + } + ++ if (buggy_latency) { ++ pr_notice("FW issue: working around C-state latencies out of order\n"); ++ sort(&pr->power.states[1], max_cstate, ++ sizeof(struct acpi_processor_cx), ++ acpi_cst_latency_cmp, ++ acpi_cst_latency_swap); ++ } ++ + lapic_timer_propagate_broadcast(pr); + + return (working); +-- +2.30.2 + diff --git a/queue-5.12/acpi-resources-add-checks-for-acpi-irq-override.patch b/queue-5.12/acpi-resources-add-checks-for-acpi-irq-override.patch new file mode 100644 index 00000000000..d0895e4cb8a --- /dev/null +++ b/queue-5.12/acpi-resources-add-checks-for-acpi-irq-override.patch @@ -0,0 +1,82 @@ +From 7cbe438ad5ea53e8f42459a1205da3c341910828 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jun 2021 10:14:42 +0800 +Subject: ACPI: resources: Add checks for ACPI IRQ override + +From: Hui Wang + +[ Upstream commit 0ec4e55e9f571f08970ed115ec0addc691eda613 ] + +The laptop keyboard doesn't work on many MEDION notebooks, but the +keyboard works well under Windows and Unix. + +Through debugging, we found this log in the dmesg: + + ACPI: IRQ 1 override to edge, high + pnp 00:03: Plug and Play ACPI device, IDs PNP0303 (active) + + And we checked the IRQ definition in the DSDT, it is: + + IRQ (Level, ActiveLow, Exclusive, ) + {1} + +So the BIOS defines the keyboard IRQ to Level_Low, but the Linux +kernel override it to Edge_High. If the Linux kernel is modified +to skip the IRQ override, the keyboard will work normally. + +From the existing comment in acpi_dev_get_irqresource(), the override +function only needs to be called when IRQ() or IRQNoFlags() is used +to populate the resource descriptor, and according to Section 6.4.2.1 +of ACPI 6.4 [1], if IRQ() is empty or IRQNoFlags() is used, the IRQ +is High true, edge sensitive and non-shareable. ACPICA also assumes +that to be the case (see acpi_rs_set_irq[] in rsirq.c). + +In accordance with the above, check 3 additional conditions +(EdgeSensitive, ActiveHigh and Exclusive) when deciding whether or +not to treat an ACPI_RESOURCE_TYPE_IRQ resource as "legacy", in which +case the IRQ override is applicable to it. + +Link: https://uefi.org/specs/ACPI/6.4/06_Device_Configuration/Device_Configuration.html#irq-descriptor # [1] +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213031 +BugLink: http://bugs.launchpad.net/bugs/1909814 +Suggested-by: Rafael J. Wysocki +Reported-by: Manuel Krause +Tested-by: Manuel Krause +Signed-off-by: Hui Wang +[ rjw: Subject rewrite, changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/resource.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 20a7892c6d3f..f0b2c3791253 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -423,6 +423,13 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi, + } + } + ++static bool irq_is_legacy(struct acpi_resource_irq *irq) ++{ ++ return irq->triggering == ACPI_EDGE_SENSITIVE && ++ irq->polarity == ACPI_ACTIVE_HIGH && ++ irq->shareable == ACPI_EXCLUSIVE; ++} ++ + /** + * acpi_dev_resource_interrupt - Extract ACPI interrupt resource information. + * @ares: Input ACPI resource object. +@@ -461,7 +468,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index, + } + acpi_dev_get_irqresource(res, irq->interrupts[index], + irq->triggering, irq->polarity, +- irq->shareable, true); ++ irq->shareable, irq_is_legacy(irq)); + break; + case ACPI_RESOURCE_TYPE_EXTENDED_IRQ: + ext_irq = &ares->data.extended_irq; +-- +2.30.2 + diff --git a/queue-5.12/acpi-sysfs-fix-a-buffer-overrun-problem-with-descrip.patch b/queue-5.12/acpi-sysfs-fix-a-buffer-overrun-problem-with-descrip.patch new file mode 100644 index 00000000000..32b7bfb32c6 --- /dev/null +++ b/queue-5.12/acpi-sysfs-fix-a-buffer-overrun-problem-with-descrip.patch @@ -0,0 +1,73 @@ +From cc18f45912fe63bcb6fb743743bbb8aa2dde8eee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 17:12:01 +0000 +Subject: ACPI: sysfs: Fix a buffer overrun problem with description_show() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Wilczyński + +[ Upstream commit 888be6067b97132c3992866bbcf647572253ab3f ] + +Currently, a device description can be obtained using ACPI, if the _STR +method exists for a particular device, and then exposed to the userspace +via a sysfs object as a string value. + +If the _STR method is available for a given device then the data +(usually a Unicode string) is read and stored in a buffer (of the +ACPI_TYPE_BUFFER type) with a pointer to said buffer cached in the +struct acpi_device_pnp for later access. + +The description_show() function is responsible for exposing the device +description to the userspace via a corresponding sysfs object and +internally calls the utf16s_to_utf8s() function with a pointer to the +buffer that contains the Unicode string so that it can be converted from +UTF16 encoding to UTF8 and thus allowing for the value to be safely +stored and later displayed. + +When invoking the utf16s_to_utf8s() function, the description_show() +function also sets a limit of the data that can be saved into a provided +buffer as a result of the character conversion to be a total of +PAGE_SIZE, and upon completion, the utf16s_to_utf8s() function returns +an integer value denoting the number of bytes that have been written +into the provided buffer. + +Following the execution of the utf16s_to_utf8s() a newline character +will be added at the end of the resulting buffer so that when the value +is read in the userspace through the sysfs object then it would include +newline making it more accessible when working with the sysfs file +system in the shell, etc. Normally, this wouldn't be a problem, but if +the function utf16s_to_utf8s() happens to return the number of bytes +written to be precisely PAGE_SIZE, then we would overrun the buffer and +write the newline character outside the allotted space which can have +undefined consequences or result in a failure. + +To fix this buffer overrun, ensure that there always is enough space +left for the newline character to be safely appended. + +Fixes: d1efe3c324ea ("ACPI: Add new sysfs interface to export device description") +Signed-off-by: Krzysztof Wilczyński +Reviewed-by: Bjorn Helgaas +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/device_sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c +index da4ff2a8b06a..fe8c7e79f472 100644 +--- a/drivers/acpi/device_sysfs.c ++++ b/drivers/acpi/device_sysfs.c +@@ -446,7 +446,7 @@ static ssize_t description_show(struct device *dev, + (wchar_t *)acpi_dev->pnp.str_obj->buffer.pointer, + acpi_dev->pnp.str_obj->buffer.length, + UTF16_LITTLE_ENDIAN, buf, +- PAGE_SIZE); ++ PAGE_SIZE - 1); + + buf[result++] = '\n'; + +-- +2.30.2 + diff --git a/queue-5.12/acpi-tables-add-custom-dsdt-file-as-makefile-prerequ.patch b/queue-5.12/acpi-tables-add-custom-dsdt-file-as-makefile-prerequ.patch new file mode 100644 index 00000000000..43806a6097c --- /dev/null +++ b/queue-5.12/acpi-tables-add-custom-dsdt-file-as-makefile-prerequ.patch @@ -0,0 +1,43 @@ +From 1ebb029ef53dc543f3bae064bfa9d0304ba91189 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 16:24:33 +0100 +Subject: ACPI: tables: Add custom DSDT file as makefile prerequisite + +From: Richard Fitzgerald + +[ Upstream commit d1059c1b1146870c52f3dac12cb7b6cbf39ed27f ] + +A custom DSDT file is mostly used during development or debugging, +and in that case it is quite likely to want to rebuild the kernel +after changing ONLY the content of the DSDT. + +This patch adds the custom DSDT as a prerequisite to tables.o +to ensure a rebuild if the DSDT file is updated. Make will merge +the prerequisites from multiple rules for the same target. + +Signed-off-by: Richard Fitzgerald +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/Makefile | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile +index 700b41adf2db..9aa82d527272 100644 +--- a/drivers/acpi/Makefile ++++ b/drivers/acpi/Makefile +@@ -8,6 +8,11 @@ ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT + # + # ACPI Boot-Time Table Parsing + # ++ifeq ($(CONFIG_ACPI_CUSTOM_DSDT),y) ++tables.o: $(src)/../../include/$(subst $\",,$(CONFIG_ACPI_CUSTOM_DSDT_FILE)) ; ++ ++endif ++ + obj-$(CONFIG_ACPI) += tables.o + obj-$(CONFIG_X86) += blacklist.o + +-- +2.30.2 + diff --git a/queue-5.12/acpi-tables-fpdt-add-missing-acpi_put_table-in-acpi_.patch b/queue-5.12/acpi-tables-fpdt-add-missing-acpi_put_table-in-acpi_.patch new file mode 100644 index 00000000000..a004494098f --- /dev/null +++ b/queue-5.12/acpi-tables-fpdt-add-missing-acpi_put_table-in-acpi_.patch @@ -0,0 +1,43 @@ +From f93daec0b20e5f152db594ddda1fa3476c0fd87a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 19:58:12 +0800 +Subject: ACPI: tables: FPDT: Add missing acpi_put_table() in acpi_init_fpdt() + +From: Jing Xiangfeng + +[ Upstream commit dd9eaa23e72572d4f1c03f2e5d2e14a5b5793e79 ] + +acpi_init_fpdt() forgets to call acpi_put_table() in an error path. + +Add the missing function call to fix it. + +Fixes: d1eb86e59be0 ("ACPI: tables: introduce support for FPDT table") +Signed-off-by: Jing Xiangfeng +Acked-by: Zhang Rui +Reviewed-by: Hanjun Guo +[ rjw: Subject and changelog edits ] +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_fpdt.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/acpi/acpi_fpdt.c b/drivers/acpi/acpi_fpdt.c +index a89a806a7a2a..4ee2ad234e3d 100644 +--- a/drivers/acpi/acpi_fpdt.c ++++ b/drivers/acpi/acpi_fpdt.c +@@ -240,8 +240,10 @@ static int __init acpi_init_fpdt(void) + return 0; + + fpdt_kobj = kobject_create_and_add("fpdt", acpi_kobj); +- if (!fpdt_kobj) ++ if (!fpdt_kobj) { ++ acpi_put_table(header); + return -ENOMEM; ++ } + + while (offset < header->length) { + subtable = (void *)header + offset; +-- +2.30.2 + diff --git a/queue-5.12/acpi-video-use-native-backlight-for-ga401-ga502-ga50.patch b/queue-5.12/acpi-video-use-native-backlight-for-ga401-ga502-ga50.patch new file mode 100644 index 00000000000..f3c94af3bd7 --- /dev/null +++ b/queue-5.12/acpi-video-use-native-backlight-for-ga401-ga502-ga50.patch @@ -0,0 +1,57 @@ +From da1eab10c48b7912d476aac4f37bbf1837f2b7f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 19:39:17 +1200 +Subject: ACPI: video: use native backlight for GA401/GA502/GA503 + +From: Luke D Jones + +[ Upstream commit 2dfbacc65d1d2eae587ccb6b93f6280542641858 ] + +Force backlight control in these models to use the native interface +at /sys/class/backlight/amdgpu_bl0. + +Signed-off-by: Luke D. Jones +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/video_detect.c | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 83cd4c95faf0..33474fd96991 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -385,6 +385,30 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "BA51_MV"), + }, + }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "ASUSTeK COMPUTER INC. GA401", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA401"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "ASUSTeK COMPUTER INC. GA502", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA502"), ++ }, ++ }, ++ { ++ .callback = video_detect_force_native, ++ .ident = "ASUSTeK COMPUTER INC. GA503", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "GA503"), ++ }, ++ }, + + /* + * Desktops which falsely report a backlight and which our heuristics +-- +2.30.2 + diff --git a/queue-5.12/acpica-fix-memory-leak-caused-by-_cid-repair-functio.patch b/queue-5.12/acpica-fix-memory-leak-caused-by-_cid-repair-functio.patch new file mode 100644 index 00000000000..efcb477a2cb --- /dev/null +++ b/queue-5.12/acpica-fix-memory-leak-caused-by-_cid-repair-functio.patch @@ -0,0 +1,55 @@ +From b90f941bf7858de690a15cdcd638f66f3c4af759 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 14:25:57 -0700 +Subject: ACPICA: Fix memory leak caused by _CID repair function + +From: Erik Kaneda + +[ Upstream commit c27bac0314131b11bccd735f7e8415ac6444b667 ] + +ACPICA commit 180cb53963aa876c782a6f52cc155d951b26051a + +According to the ACPI spec, _CID returns a package containing +hardware ID's. Each element of an ASL package contains a reference +count from the parent package as well as the element itself. + +Name (TEST, Package() { + "String object" // this package element has a reference count of 2 +}) + +A memory leak was caused in the _CID repair function because it did +not decrement the reference count created by the package. Fix the +memory leak by calling acpi_ut_remove_reference on _CID package elements +that represent a hardware ID (_HID). + +Link: https://github.com/acpica/acpica/commit/180cb539 +Tested-by: Shawn Guo +Signed-off-by: Erik Kaneda +Signed-off-by: Bob Moore +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/nsrepair2.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/acpi/acpica/nsrepair2.c b/drivers/acpi/acpica/nsrepair2.c +index 14b71b41e845..38e10ab976e6 100644 +--- a/drivers/acpi/acpica/nsrepair2.c ++++ b/drivers/acpi/acpica/nsrepair2.c +@@ -379,6 +379,13 @@ acpi_ns_repair_CID(struct acpi_evaluate_info *info, + + (*element_ptr)->common.reference_count = + original_ref_count; ++ ++ /* ++ * The original_element holds a reference from the package object ++ * that represents _HID. Since a new element was created by _HID, ++ * remove the reference from the _CID package. ++ */ ++ acpi_ut_remove_reference(original_element); + } + + element_ptr++; +-- +2.30.2 + diff --git a/queue-5.12/add-a-reference-to-ucounts-for-each-cred.patch b/queue-5.12/add-a-reference-to-ucounts-for-each-cred.patch new file mode 100644 index 00000000000..5cf090c5365 --- /dev/null +++ b/queue-5.12/add-a-reference-to-ucounts-for-each-cred.patch @@ -0,0 +1,341 @@ +From c64b1454a810ccb4f82a3ee9a1907aded9abb26c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Apr 2021 14:27:09 +0200 +Subject: Add a reference to ucounts for each cred + +From: Alexey Gladkov + +[ Upstream commit 905ae01c4ae2ae3df05bb141801b1db4b7d83c61 ] + +For RLIMIT_NPROC and some other rlimits the user_struct that holds the +global limit is kept alive for the lifetime of a process by keeping it +in struct cred. Adding a pointer to ucounts in the struct cred will +allow to track RLIMIT_NPROC not only for user in the system, but for +user in the user_namespace. + +Updating ucounts may require memory allocation which may fail. So, we +cannot change cred.ucounts in the commit_creds() because this function +cannot fail and it should always return 0. For this reason, we modify +cred.ucounts before calling the commit_creds(). + +Changelog + +v6: +* Fix null-ptr-deref in is_ucounts_overlimit() detected by trinity. This + error was caused by the fact that cred_alloc_blank() left the ucounts + pointer empty. + +Reported-by: kernel test robot +Signed-off-by: Alexey Gladkov +Link: https://lkml.kernel.org/r/b37aaef28d8b9b0d757e07ba6dd27281bbe39259.1619094428.git.legion@kernel.org +Signed-off-by: Eric W. Biederman +Signed-off-by: Sasha Levin +--- + fs/exec.c | 4 ++++ + include/linux/cred.h | 2 ++ + include/linux/user_namespace.h | 4 ++++ + kernel/cred.c | 40 ++++++++++++++++++++++++++++++++++ + kernel/fork.c | 6 +++++ + kernel/sys.c | 12 ++++++++++ + kernel/ucount.c | 40 +++++++++++++++++++++++++++++++--- + kernel/user_namespace.c | 3 +++ + 8 files changed, 108 insertions(+), 3 deletions(-) + +diff --git a/fs/exec.c b/fs/exec.c +index 18594f11c31f..d7c4187ca023 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1360,6 +1360,10 @@ int begin_new_exec(struct linux_binprm * bprm) + WRITE_ONCE(me->self_exec_id, me->self_exec_id + 1); + flush_signal_handlers(me, 0); + ++ retval = set_cred_ucounts(bprm->cred); ++ if (retval < 0) ++ goto out_unlock; ++ + /* + * install the new credentials for this executable + */ +diff --git a/include/linux/cred.h b/include/linux/cred.h +index 4c6350503697..66436e655032 100644 +--- a/include/linux/cred.h ++++ b/include/linux/cred.h +@@ -144,6 +144,7 @@ struct cred { + #endif + struct user_struct *user; /* real user ID subscription */ + struct user_namespace *user_ns; /* user_ns the caps and keyrings are relative to. */ ++ struct ucounts *ucounts; + struct group_info *group_info; /* supplementary groups for euid/fsgid */ + /* RCU deletion */ + union { +@@ -170,6 +171,7 @@ extern int set_security_override_from_ctx(struct cred *, const char *); + extern int set_create_files_as(struct cred *, struct inode *); + extern int cred_fscmp(const struct cred *, const struct cred *); + extern void __init cred_init(void); ++extern int set_cred_ucounts(struct cred *); + + /* + * check for validity of credentials +diff --git a/include/linux/user_namespace.h b/include/linux/user_namespace.h +index f6c5f784be5a..604cf6a5dc2d 100644 +--- a/include/linux/user_namespace.h ++++ b/include/linux/user_namespace.h +@@ -100,11 +100,15 @@ struct ucounts { + }; + + extern struct user_namespace init_user_ns; ++extern struct ucounts init_ucounts; + + bool setup_userns_sysctls(struct user_namespace *ns); + void retire_userns_sysctls(struct user_namespace *ns); + struct ucounts *inc_ucount(struct user_namespace *ns, kuid_t uid, enum ucount_type type); + void dec_ucount(struct ucounts *ucounts, enum ucount_type type); ++struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid); ++struct ucounts *get_ucounts(struct ucounts *ucounts); ++void put_ucounts(struct ucounts *ucounts); + + #ifdef CONFIG_USER_NS + +diff --git a/kernel/cred.c b/kernel/cred.c +index 421b1149c651..58a8a9e24347 100644 +--- a/kernel/cred.c ++++ b/kernel/cred.c +@@ -60,6 +60,7 @@ struct cred init_cred = { + .user = INIT_USER, + .user_ns = &init_user_ns, + .group_info = &init_groups, ++ .ucounts = &init_ucounts, + }; + + static inline void set_cred_subscribers(struct cred *cred, int n) +@@ -119,6 +120,8 @@ static void put_cred_rcu(struct rcu_head *rcu) + if (cred->group_info) + put_group_info(cred->group_info); + free_uid(cred->user); ++ if (cred->ucounts) ++ put_ucounts(cred->ucounts); + put_user_ns(cred->user_ns); + kmem_cache_free(cred_jar, cred); + } +@@ -222,6 +225,7 @@ struct cred *cred_alloc_blank(void) + #ifdef CONFIG_DEBUG_CREDENTIALS + new->magic = CRED_MAGIC; + #endif ++ new->ucounts = get_ucounts(&init_ucounts); + + if (security_cred_alloc_blank(new, GFP_KERNEL_ACCOUNT) < 0) + goto error; +@@ -284,6 +288,11 @@ struct cred *prepare_creds(void) + + if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) + goto error; ++ ++ new->ucounts = get_ucounts(new->ucounts); ++ if (!new->ucounts) ++ goto error; ++ + validate_creds(new); + return new; + +@@ -363,6 +372,8 @@ int copy_creds(struct task_struct *p, unsigned long clone_flags) + ret = create_user_ns(new); + if (ret < 0) + goto error_put; ++ if (set_cred_ucounts(new) < 0) ++ goto error_put; + } + + #ifdef CONFIG_KEYS +@@ -653,6 +664,31 @@ int cred_fscmp(const struct cred *a, const struct cred *b) + } + EXPORT_SYMBOL(cred_fscmp); + ++int set_cred_ucounts(struct cred *new) ++{ ++ struct task_struct *task = current; ++ const struct cred *old = task->real_cred; ++ struct ucounts *old_ucounts = new->ucounts; ++ ++ if (new->user == old->user && new->user_ns == old->user_ns) ++ return 0; ++ ++ /* ++ * This optimization is needed because alloc_ucounts() uses locks ++ * for table lookups. ++ */ ++ if (old_ucounts && old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->euid)) ++ return 0; ++ ++ if (!(new->ucounts = alloc_ucounts(new->user_ns, new->euid))) ++ return -EAGAIN; ++ ++ if (old_ucounts) ++ put_ucounts(old_ucounts); ++ ++ return 0; ++} ++ + /* + * initialise the credentials stuff + */ +@@ -719,6 +755,10 @@ struct cred *prepare_kernel_cred(struct task_struct *daemon) + if (security_prepare_creds(new, old, GFP_KERNEL_ACCOUNT) < 0) + goto error; + ++ new->ucounts = get_ucounts(new->ucounts); ++ if (!new->ucounts) ++ goto error; ++ + put_cred(old); + validate_creds(new); + return new; +diff --git a/kernel/fork.c b/kernel/fork.c +index 426cd0c51f9e..321a5e31d817 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2995,6 +2995,12 @@ int ksys_unshare(unsigned long unshare_flags) + if (err) + goto bad_unshare_cleanup_cred; + ++ if (new_cred) { ++ err = set_cred_ucounts(new_cred); ++ if (err) ++ goto bad_unshare_cleanup_cred; ++ } ++ + if (new_fs || new_fd || do_sysvsem || new_cred || new_nsproxy) { + if (do_sysvsem) { + /* +diff --git a/kernel/sys.c b/kernel/sys.c +index 2e2e3f378d97..cabfc5b86175 100644 +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -552,6 +552,10 @@ long __sys_setreuid(uid_t ruid, uid_t euid) + if (retval < 0) + goto error; + ++ retval = set_cred_ucounts(new); ++ if (retval < 0) ++ goto error; ++ + return commit_creds(new); + + error: +@@ -610,6 +614,10 @@ long __sys_setuid(uid_t uid) + if (retval < 0) + goto error; + ++ retval = set_cred_ucounts(new); ++ if (retval < 0) ++ goto error; ++ + return commit_creds(new); + + error: +@@ -685,6 +693,10 @@ long __sys_setresuid(uid_t ruid, uid_t euid, uid_t suid) + if (retval < 0) + goto error; + ++ retval = set_cred_ucounts(new); ++ if (retval < 0) ++ goto error; ++ + return commit_creds(new); + + error: +diff --git a/kernel/ucount.c b/kernel/ucount.c +index 11b1596e2542..9894795043c4 100644 +--- a/kernel/ucount.c ++++ b/kernel/ucount.c +@@ -8,6 +8,12 @@ + #include + #include + ++struct ucounts init_ucounts = { ++ .ns = &init_user_ns, ++ .uid = GLOBAL_ROOT_UID, ++ .count = 1, ++}; ++ + #define UCOUNTS_HASHTABLE_BITS 10 + static struct hlist_head ucounts_hashtable[(1 << UCOUNTS_HASHTABLE_BITS)]; + static DEFINE_SPINLOCK(ucounts_lock); +@@ -125,7 +131,15 @@ static struct ucounts *find_ucounts(struct user_namespace *ns, kuid_t uid, struc + return NULL; + } + +-static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid) ++static void hlist_add_ucounts(struct ucounts *ucounts) ++{ ++ struct hlist_head *hashent = ucounts_hashentry(ucounts->ns, ucounts->uid); ++ spin_lock_irq(&ucounts_lock); ++ hlist_add_head(&ucounts->node, hashent); ++ spin_unlock_irq(&ucounts_lock); ++} ++ ++struct ucounts *alloc_ucounts(struct user_namespace *ns, kuid_t uid) + { + struct hlist_head *hashent = ucounts_hashentry(ns, uid); + struct ucounts *ucounts, *new; +@@ -160,7 +174,26 @@ static struct ucounts *get_ucounts(struct user_namespace *ns, kuid_t uid) + return ucounts; + } + +-static void put_ucounts(struct ucounts *ucounts) ++struct ucounts *get_ucounts(struct ucounts *ucounts) ++{ ++ unsigned long flags; ++ ++ if (!ucounts) ++ return NULL; ++ ++ spin_lock_irqsave(&ucounts_lock, flags); ++ if (ucounts->count == INT_MAX) { ++ WARN_ONCE(1, "ucounts: counter has reached its maximum value"); ++ ucounts = NULL; ++ } else { ++ ucounts->count += 1; ++ } ++ spin_unlock_irqrestore(&ucounts_lock, flags); ++ ++ return ucounts; ++} ++ ++void put_ucounts(struct ucounts *ucounts) + { + unsigned long flags; + +@@ -194,7 +227,7 @@ struct ucounts *inc_ucount(struct user_namespace *ns, kuid_t uid, + { + struct ucounts *ucounts, *iter, *bad; + struct user_namespace *tns; +- ucounts = get_ucounts(ns, uid); ++ ucounts = alloc_ucounts(ns, uid); + for (iter = ucounts; iter; iter = tns->ucounts) { + int max; + tns = iter->ns; +@@ -237,6 +270,7 @@ static __init int user_namespace_sysctl_init(void) + BUG_ON(!user_header); + BUG_ON(!setup_userns_sysctls(&init_user_ns)); + #endif ++ hlist_add_ucounts(&init_ucounts); + return 0; + } + subsys_initcall(user_namespace_sysctl_init); +diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c +index 9a4b980d695b..f1b7b4b8ffa2 100644 +--- a/kernel/user_namespace.c ++++ b/kernel/user_namespace.c +@@ -1340,6 +1340,9 @@ static int userns_install(struct nsset *nsset, struct ns_common *ns) + put_user_ns(cred->user_ns); + set_cred_user_ns(cred, get_user_ns(user_ns)); + ++ if (set_cred_ucounts(cred) < 0) ++ return -EINVAL; ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.12/alsa-firewire-lib-fix-amdtp_domain_start-when-no-amd.patch b/queue-5.12/alsa-firewire-lib-fix-amdtp_domain_start-when-no-amd.patch new file mode 100644 index 00000000000..3c01b13d2de --- /dev/null +++ b/queue-5.12/alsa-firewire-lib-fix-amdtp_domain_start-when-no-amd.patch @@ -0,0 +1,53 @@ +From ad7ee70c76066fb425be999cb42ba3fb0a5c7106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 20:49:36 +0200 +Subject: ALSA: firewire-lib: Fix 'amdtp_domain_start()' when no + AMDTP_OUT_STREAM stream is found + +From: Christophe JAILLET + +[ Upstream commit 0cbbeaf370221fc469c95945dd3c1198865c5fe4 ] + +The intent here is to return an error code if we don't find what we are +looking for in the 'list_for_each_entry()' loop. + +'s' is not NULL if the list is empty or if we scan the complete list. +Introduce a new 'found' variable to handle such cases. + +Fixes: 60dd49298ec5 ("ALSA: firewire-lib: handle several AMDTP streams in callback handler of IRQ target") +Signed-off-by: Christophe JAILLET +Acked-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/9c9a53a4905984a570ba5672cbab84f2027dedc1.1624560484.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/amdtp-stream.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c +index 5805c5de39fb..7a282d8e7148 100644 +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -1404,14 +1404,17 @@ int amdtp_domain_start(struct amdtp_domain *d, unsigned int ir_delay_cycle) + unsigned int queue_size; + struct amdtp_stream *s; + int cycle; ++ bool found = false; + int err; + + // Select an IT context as IRQ target. + list_for_each_entry(s, &d->streams, list) { +- if (s->direction == AMDTP_OUT_STREAM) ++ if (s->direction == AMDTP_OUT_STREAM) { ++ found = true; + break; ++ } + } +- if (!s) ++ if (!found) + return -ENXIO; + d->irq_target = s; + +-- +2.30.2 + diff --git a/queue-5.12/arm64-dts-marvell-armada-37xx-fix-reg-for-standard-v.patch b/queue-5.12/arm64-dts-marvell-armada-37xx-fix-reg-for-standard-v.patch new file mode 100644 index 00000000000..7c7df01d0e5 --- /dev/null +++ b/queue-5.12/arm64-dts-marvell-armada-37xx-fix-reg-for-standard-v.patch @@ -0,0 +1,41 @@ +From 4eb035ae902e883c2e4c1cabf50c20811b09d0ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 00:49:04 +0200 +Subject: arm64: dts: marvell: armada-37xx: Fix reg for standard variant of + UART +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 2cbfdedef39fb5994b8f1e1df068eb8440165975 ] + +UART1 (standard variant with DT node name 'uart0') has register space +0x12000-0x12018 and not whole size 0x200. So fix also this in example. + +Signed-off-by: Pali Rohár +Fixes: c737abc193d1 ("arm64: dts: marvell: Fix A37xx UART0 register size") +Link: https://lore.kernel.org/r/20210624224909.6350-6-pali@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-37xx.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +index 456dcd4a7793..6ffbb099fcac 100644 +--- a/arch/arm64/boot/dts/marvell/armada-37xx.dtsi ++++ b/arch/arm64/boot/dts/marvell/armada-37xx.dtsi +@@ -134,7 +134,7 @@ + + uart0: serial@12000 { + compatible = "marvell,armada-3700-uart"; +- reg = <0x12000 0x200>; ++ reg = <0x12000 0x18>; + clocks = <&xtalclk>; + interrupts = + , +-- +2.30.2 + diff --git a/queue-5.12/arm64-mm-fix-ttbr0-values-stored-in-struct-thread_in.patch b/queue-5.12/arm64-mm-fix-ttbr0-values-stored-in-struct-thread_in.patch new file mode 100644 index 00000000000..db43bd8a828 --- /dev/null +++ b/queue-5.12/arm64-mm-fix-ttbr0-values-stored-in-struct-thread_in.patch @@ -0,0 +1,70 @@ +From 421ada905368dfd2d6ac9a3059335332e8699d7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 15:02:58 +0530 +Subject: arm64/mm: Fix ttbr0 values stored in struct thread_info for + software-pan + +From: Anshuman Khandual + +[ Upstream commit 9163f01130304fab1f74683d7d44632da7bda637 ] + +When using CONFIG_ARM64_SW_TTBR0_PAN, a task's thread_info::ttbr0 must be +the TTBR0_EL1 value used to run userspace. With 52-bit PAs, the PA must be +packed into the TTBR using phys_to_ttbr(), but we forget to do this in some +of the SW PAN code. Thus, if the value is installed into TTBR0_EL1 (as may +happen in the uaccess routines), this could result in UNPREDICTABLE +behaviour. + +Since hardware with 52-bit PA support almost certainly has HW PAN, which +will be used in preference, this shouldn't be a practical issue, but let's +fix this for consistency. + +Cc: Catalin Marinas +Cc: Will Deacon +Cc: Mark Rutland +Cc: James Morse +Cc: linux-arm-kernel@lists.infradead.org +Cc: linux-kernel@vger.kernel.org +Fixes: 529c4b05a3cb ("arm64: handle 52-bit addresses in TTBR") +Signed-off-by: Anshuman Khandual +Reviewed-by: Catalin Marinas +Link: https://lore.kernel.org/r/1623749578-11231-1-git-send-email-anshuman.khandual@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/mmu_context.h | 4 ++-- + arch/arm64/kernel/setup.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h +index bd02e99b1a4c..44dceac442fc 100644 +--- a/arch/arm64/include/asm/mmu_context.h ++++ b/arch/arm64/include/asm/mmu_context.h +@@ -177,9 +177,9 @@ static inline void update_saved_ttbr0(struct task_struct *tsk, + return; + + if (mm == &init_mm) +- ttbr = __pa_symbol(reserved_pg_dir); ++ ttbr = phys_to_ttbr(__pa_symbol(reserved_pg_dir)); + else +- ttbr = virt_to_phys(mm->pgd) | ASID(mm) << 48; ++ ttbr = phys_to_ttbr(virt_to_phys(mm->pgd)) | ASID(mm) << 48; + + WRITE_ONCE(task_thread_info(tsk)->ttbr0, ttbr); + } +diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c +index 61845c0821d9..68b30e8c22db 100644 +--- a/arch/arm64/kernel/setup.c ++++ b/arch/arm64/kernel/setup.c +@@ -381,7 +381,7 @@ void __init __no_sanitize_address setup_arch(char **cmdline_p) + * faults in case uaccess_enable() is inadvertently called by the init + * thread. + */ +- init_task.thread_info.ttbr0 = __pa_symbol(reserved_pg_dir); ++ init_task.thread_info.ttbr0 = phys_to_ttbr(__pa_symbol(reserved_pg_dir)); + #endif + + if (boot_args[1] || boot_args[2] || boot_args[3]) { +-- +2.30.2 + diff --git a/queue-5.12/arm64-perf-convert-snprintf-to-sysfs_emit.patch b/queue-5.12/arm64-perf-convert-snprintf-to-sysfs_emit.patch new file mode 100644 index 00000000000..f575b1f3872 --- /dev/null +++ b/queue-5.12/arm64-perf-convert-snprintf-to-sysfs_emit.patch @@ -0,0 +1,37 @@ +From da9adeb69edb732b195886cbe800468dddf0ca62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 15:59:45 +0800 +Subject: arm64: perf: Convert snprintf to sysfs_emit + +From: Tian Tao + +[ Upstream commit a5740e955540181f4ab8f076cc9795c6bbe4d730 ] + +Use sysfs_emit instead of snprintf to avoid buf overrun,because in +sysfs_emit it strictly checks whether buf is null or buf whether +pagesize aligned, otherwise it returns an error. + +Signed-off-by: Tian Tao +Link: https://lore.kernel.org/r/1621497585-30887-1-git-send-email-tiantao6@hisilicon.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/perf_event.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c +index 4658fcf88c2b..3baca49fcf6b 100644 +--- a/arch/arm64/kernel/perf_event.c ++++ b/arch/arm64/kernel/perf_event.c +@@ -312,7 +312,7 @@ static ssize_t slots_show(struct device *dev, struct device_attribute *attr, + struct arm_pmu *cpu_pmu = container_of(pmu, struct arm_pmu, pmu); + u32 slots = cpu_pmu->reg_pmmir & ARMV8_PMU_SLOTS_MASK; + +- return snprintf(page, PAGE_SIZE, "0x%08x\n", slots); ++ return sysfs_emit(page, "0x%08x\n", slots); + } + + static DEVICE_ATTR_RO(slots); +-- +2.30.2 + diff --git a/queue-5.12/asoc-atmel-i2s-fix-usage-of-capture-and-playback-at-.patch b/queue-5.12/asoc-atmel-i2s-fix-usage-of-capture-and-playback-at-.patch new file mode 100644 index 00000000000..13ca148486f --- /dev/null +++ b/queue-5.12/asoc-atmel-i2s-fix-usage-of-capture-and-playback-at-.patch @@ -0,0 +1,100 @@ +From 5e481aeb825fe717661e58ff02b3a3604b638a28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 18:07:41 +0300 +Subject: ASoC: atmel-i2s: Fix usage of capture and playback at the same time + +From: Codrin Ciubotariu + +[ Upstream commit 3b7961a326f8a7e03f54a19f02fedae8d488b80f ] + +For both capture and playback streams to work at the same time, only the +needed values from a register need to be updated. Also, clocks should be +enabled only when the first stream is started and stopped when there is no +running stream. + +Fixes: b543e467d1a9 ("ASoC: atmel-i2s: add driver for the new Atmel I2S controller") +Signed-off-by: Codrin Ciubotariu +Link: https://lore.kernel.org/r/20210618150741.401739-2-codrin.ciubotariu@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel-i2s.c | 34 ++++++++++++++++++++++++++-------- + 1 file changed, 26 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/atmel/atmel-i2s.c b/sound/soc/atmel/atmel-i2s.c +index e43acb54296b..a383c6bef8e0 100644 +--- a/sound/soc/atmel/atmel-i2s.c ++++ b/sound/soc/atmel/atmel-i2s.c +@@ -200,6 +200,7 @@ struct atmel_i2s_dev { + unsigned int fmt; + const struct atmel_i2s_gck_param *gck_param; + const struct atmel_i2s_caps *caps; ++ int clk_use_no; + }; + + static irqreturn_t atmel_i2s_interrupt(int irq, void *dev_id) +@@ -321,9 +322,16 @@ static int atmel_i2s_hw_params(struct snd_pcm_substream *substream, + { + struct atmel_i2s_dev *dev = snd_soc_dai_get_drvdata(dai); + bool is_playback = (substream->stream == SNDRV_PCM_STREAM_PLAYBACK); +- unsigned int mr = 0; ++ unsigned int mr = 0, mr_mask; + int ret; + ++ mr_mask = ATMEL_I2SC_MR_FORMAT_MASK | ATMEL_I2SC_MR_MODE_MASK | ++ ATMEL_I2SC_MR_DATALENGTH_MASK; ++ if (is_playback) ++ mr_mask |= ATMEL_I2SC_MR_TXMONO; ++ else ++ mr_mask |= ATMEL_I2SC_MR_RXMONO; ++ + switch (dev->fmt & SND_SOC_DAIFMT_FORMAT_MASK) { + case SND_SOC_DAIFMT_I2S: + mr |= ATMEL_I2SC_MR_FORMAT_I2S; +@@ -402,7 +410,7 @@ static int atmel_i2s_hw_params(struct snd_pcm_substream *substream, + return -EINVAL; + } + +- return regmap_write(dev->regmap, ATMEL_I2SC_MR, mr); ++ return regmap_update_bits(dev->regmap, ATMEL_I2SC_MR, mr_mask, mr); + } + + static int atmel_i2s_switch_mck_generator(struct atmel_i2s_dev *dev, +@@ -495,18 +503,28 @@ static int atmel_i2s_trigger(struct snd_pcm_substream *substream, int cmd, + is_master = (mr & ATMEL_I2SC_MR_MODE_MASK) == ATMEL_I2SC_MR_MODE_MASTER; + + /* If master starts, enable the audio clock. */ +- if (is_master && mck_enabled) +- err = atmel_i2s_switch_mck_generator(dev, true); +- if (err) +- return err; ++ if (is_master && mck_enabled) { ++ if (!dev->clk_use_no) { ++ err = atmel_i2s_switch_mck_generator(dev, true); ++ if (err) ++ return err; ++ } ++ dev->clk_use_no++; ++ } + + err = regmap_write(dev->regmap, ATMEL_I2SC_CR, cr); + if (err) + return err; + + /* If master stops, disable the audio clock. */ +- if (is_master && !mck_enabled) +- err = atmel_i2s_switch_mck_generator(dev, false); ++ if (is_master && !mck_enabled) { ++ if (dev->clk_use_no == 1) { ++ err = atmel_i2s_switch_mck_generator(dev, false); ++ if (err) ++ return err; ++ } ++ dev->clk_use_no--; ++ } + + return err; + } +-- +2.30.2 + diff --git a/queue-5.12/asoc-atmel-i2s-set-symmetric-sample-bits.patch b/queue-5.12/asoc-atmel-i2s-set-symmetric-sample-bits.patch new file mode 100644 index 00000000000..a96dc5462d2 --- /dev/null +++ b/queue-5.12/asoc-atmel-i2s-set-symmetric-sample-bits.patch @@ -0,0 +1,36 @@ +From 63e9e648d05be7062fecdae33f8f2f6eb285c8cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 18:07:40 +0300 +Subject: ASoC: atmel-i2s: Set symmetric sample bits + +From: Codrin Ciubotariu + +[ Upstream commit 489a830a25e1730aebf7ff53430c170db9a1771b ] + +The I2S needs to have the same sample bits for both capture and playback +streams. + +Fixes: b543e467d1a9 ("ASoC: atmel-i2s: add driver for the new Atmel I2S controller") +Signed-off-by: Codrin Ciubotariu +Link: https://lore.kernel.org/r/20210618150741.401739-1-codrin.ciubotariu@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel-i2s.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/atmel/atmel-i2s.c b/sound/soc/atmel/atmel-i2s.c +index 7c6187e41f2b..e43acb54296b 100644 +--- a/sound/soc/atmel/atmel-i2s.c ++++ b/sound/soc/atmel/atmel-i2s.c +@@ -542,6 +542,7 @@ static struct snd_soc_dai_driver atmel_i2s_dai = { + }, + .ops = &atmel_i2s_dai_ops, + .symmetric_rate = 1, ++ .symmetric_sample_bits = 1, + }; + + static const struct snd_soc_component_driver atmel_i2s_component = { +-- +2.30.2 + diff --git a/queue-5.12/asoc-cs42l42-correct-definition-of-cs42l42_adc_pdn_m.patch b/queue-5.12/asoc-cs42l42-correct-definition-of-cs42l42_adc_pdn_m.patch new file mode 100644 index 00000000000..d504c623fe5 --- /dev/null +++ b/queue-5.12/asoc-cs42l42-correct-definition-of-cs42l42_adc_pdn_m.patch @@ -0,0 +1,37 @@ +From 58c99e64939e72c78f909724cb14deb9f24f036d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 14:56:04 +0100 +Subject: ASoC: cs42l42: Correct definition of CS42L42_ADC_PDN_MASK + +From: Richard Fitzgerald + +[ Upstream commit fac165f22ac947b55407cd3a60a2a9824f905235 ] + +The definition of CS42L42_ADC_PDN_MASK was incorrectly defined +as the HP_PDN bit. + +Fixes: 2c394ca79604 ("ASoC: Add support for CS42L42 codec") +Signed-off-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20210616135604.19363-1-rf@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l42.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs42l42.h b/sound/soc/codecs/cs42l42.h +index 866d7c873e3c..ca2019732013 100644 +--- a/sound/soc/codecs/cs42l42.h ++++ b/sound/soc/codecs/cs42l42.h +@@ -77,7 +77,7 @@ + #define CS42L42_HP_PDN_SHIFT 3 + #define CS42L42_HP_PDN_MASK (1 << CS42L42_HP_PDN_SHIFT) + #define CS42L42_ADC_PDN_SHIFT 2 +-#define CS42L42_ADC_PDN_MASK (1 << CS42L42_HP_PDN_SHIFT) ++#define CS42L42_ADC_PDN_MASK (1 << CS42L42_ADC_PDN_SHIFT) + #define CS42L42_PDN_ALL_SHIFT 0 + #define CS42L42_PDN_ALL_MASK (1 << CS42L42_PDN_ALL_SHIFT) + +-- +2.30.2 + diff --git a/queue-5.12/asoc-fsl_spdif-fix-error-handler-with-pm_runtime_ena.patch b/queue-5.12/asoc-fsl_spdif-fix-error-handler-with-pm_runtime_ena.patch new file mode 100644 index 00000000000..2e3c6e7a98d --- /dev/null +++ b/queue-5.12/asoc-fsl_spdif-fix-error-handler-with-pm_runtime_ena.patch @@ -0,0 +1,73 @@ +From 13c10cb36b41013c957dd3500922e3b4319816be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jun 2021 14:18:38 +0800 +Subject: ASoC: fsl_spdif: Fix error handler with pm_runtime_enable + +From: Shengjiu Wang + +[ Upstream commit 28108d71ee11a7232e1102effab3361049dcd3b8 ] + +There is error message when defer probe happens: + +fsl-spdif-dai 2dab0000.spdif: Unbalanced pm_runtime_enable! + +Fix the error handler with pm_runtime_enable and add +fsl_spdif_remove() for pm_runtime_disable. + +Fixes: 9cb2b3796e08 ("ASoC: fsl_spdif: Add pm runtime function") +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1623392318-26304-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_spdif.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c +index 174e558224d8..e5d366b2a6a4 100644 +--- a/sound/soc/fsl/fsl_spdif.c ++++ b/sound/soc/fsl/fsl_spdif.c +@@ -1400,16 +1400,29 @@ static int fsl_spdif_probe(struct platform_device *pdev) + &spdif_priv->cpu_dai_drv, 1); + if (ret) { + dev_err(&pdev->dev, "failed to register DAI: %d\n", ret); +- return ret; ++ goto err_pm_disable; + } + + ret = imx_pcm_dma_init(pdev, IMX_SPDIF_DMABUF_SIZE); +- if (ret && ret != -EPROBE_DEFER) +- dev_err(&pdev->dev, "imx_pcm_dma_init failed: %d\n", ret); ++ if (ret) { ++ dev_err_probe(&pdev->dev, ret, "imx_pcm_dma_init failed\n"); ++ goto err_pm_disable; ++ } ++ ++ return ret; + ++err_pm_disable: ++ pm_runtime_disable(&pdev->dev); + return ret; + } + ++static int fsl_spdif_remove(struct platform_device *pdev) ++{ ++ pm_runtime_disable(&pdev->dev); ++ ++ return 0; ++} ++ + #ifdef CONFIG_PM + static int fsl_spdif_runtime_suspend(struct device *dev) + { +@@ -1512,6 +1525,7 @@ static struct platform_driver fsl_spdif_driver = { + .pm = &fsl_spdif_pm, + }, + .probe = fsl_spdif_probe, ++ .remove = fsl_spdif_remove, + }; + + module_platform_driver(fsl_spdif_driver); +-- +2.30.2 + diff --git a/queue-5.12/asoc-fsl_spdif-fix-unexpected-interrupt-after-suspen.patch b/queue-5.12/asoc-fsl_spdif-fix-unexpected-interrupt-after-suspen.patch new file mode 100644 index 00000000000..95f2343fe1d --- /dev/null +++ b/queue-5.12/asoc-fsl_spdif-fix-unexpected-interrupt-after-suspen.patch @@ -0,0 +1,49 @@ +From 441ad17cac54b651506bf4883c6b1185dbfd1d09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 20:31:24 +0800 +Subject: ASoC: fsl_spdif: Fix unexpected interrupt after suspend + +From: Shengjiu Wang + +[ Upstream commit a7a0a2feb957e446b2bcf732f245ba04fc8b6314 ] + +When system enter suspend, the machine driver suspend callback +function will be called, then the cpu driver trigger callback +(SNDRV_PCM_TRIGGER_SUSPEND) be called, it would disable the +interrupt. + +But the machine driver suspend and cpu dai driver suspend order +maybe changed, the cpu dai driver's suspend callback is called before +machine driver's suppend callback, then the interrupt is not cleared +successfully in trigger callback. + +So need to clear interrupts in cpu dai driver's suspend callback +to avoid such issue. + +Fixes: 9cb2b3796e08 ("ASoC: fsl_spdif: Add pm runtime function") +Signed-off-by: Shengjiu Wang +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/1624365084-7934-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_spdif.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c +index e5d366b2a6a4..6d5e9c0acdb4 100644 +--- a/sound/soc/fsl/fsl_spdif.c ++++ b/sound/soc/fsl/fsl_spdif.c +@@ -1429,6 +1429,9 @@ static int fsl_spdif_runtime_suspend(struct device *dev) + struct fsl_spdif_priv *spdif_priv = dev_get_drvdata(dev); + int i; + ++ /* Disable all the interrupts */ ++ regmap_update_bits(spdif_priv->regmap, REG_SPDIF_SIE, 0xffffff, 0); ++ + regmap_read(spdif_priv->regmap, REG_SPDIF_SRPC, + &spdif_priv->regcache_srpc); + regcache_cache_only(spdif_priv->regmap, true); +-- +2.30.2 + diff --git a/queue-5.12/asoc-fsl_xcvr-disable-all-interrupts-when-suspend-ha.patch b/queue-5.12/asoc-fsl_xcvr-disable-all-interrupts-when-suspend-ha.patch new file mode 100644 index 00000000000..9f77847bfd3 --- /dev/null +++ b/queue-5.12/asoc-fsl_xcvr-disable-all-interrupts-when-suspend-ha.patch @@ -0,0 +1,49 @@ +From e40564692b45be3ed011c122bf8161228e093d38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 20:38:33 +0800 +Subject: ASoC: fsl_xcvr: disable all interrupts when suspend happens + +From: Shengjiu Wang + +[ Upstream commit ea837090b388245744988083313f6e9c7c9b9699 ] + +There is an unhandled interrupt after suspend, which cause endless +interrupt when system resume, so system may hang. + +Disable all interrupts in runtime suspend callback to avoid above +issue. + +Fixes: 28564486866f ("ASoC: fsl_xcvr: Add XCVR ASoC CPU DAI driver") +Signed-off-by: Shengjiu Wang +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/1624019913-3380-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_xcvr.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/sound/soc/fsl/fsl_xcvr.c b/sound/soc/fsl/fsl_xcvr.c +index 6dd0a5fcd455..070e3f32859f 100644 +--- a/sound/soc/fsl/fsl_xcvr.c ++++ b/sound/soc/fsl/fsl_xcvr.c +@@ -1236,6 +1236,16 @@ static __maybe_unused int fsl_xcvr_runtime_suspend(struct device *dev) + struct fsl_xcvr *xcvr = dev_get_drvdata(dev); + int ret; + ++ /* ++ * Clear interrupts, when streams starts or resumes after ++ * suspend, interrupts are enabled in prepare(), so no need ++ * to enable interrupts in resume(). ++ */ ++ ret = regmap_update_bits(xcvr->regmap, FSL_XCVR_EXT_IER0, ++ FSL_XCVR_IRQ_EARC_ALL, 0); ++ if (ret < 0) ++ dev_err(dev, "Failed to clear IER0: %d\n", ret); ++ + /* Assert M0+ reset */ + ret = regmap_update_bits(xcvr->regmap, FSL_XCVR_EXT_CTRL, + FSL_XCVR_EXT_CTRL_CORE_RESET, +-- +2.30.2 + diff --git a/queue-5.12/asoc-hisilicon-fix-missing-clk_disable_unprepare-on-.patch b/queue-5.12/asoc-hisilicon-fix-missing-clk_disable_unprepare-on-.patch new file mode 100644 index 00000000000..12f049243eb --- /dev/null +++ b/queue-5.12/asoc-hisilicon-fix-missing-clk_disable_unprepare-on-.patch @@ -0,0 +1,64 @@ +From 5fd83873997d7043927fdee02cbda284c8ac3f67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 12:45:14 +0800 +Subject: ASoC: hisilicon: fix missing clk_disable_unprepare() on error in + hi6210_i2s_startup() + +From: Yang Yingliang + +[ Upstream commit 375904e3931955fcf0a847f029b2492a117efc43 ] + +After calling clk_prepare_enable(), clk_disable_unprepare() need +be called when calling clk_set_rate() failed. + +Fixes: 0bf750f4cbe1 ("ASoC: hisilicon: Add hi6210 i2s audio driver") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210518044514.607010-1-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/hisilicon/hi6210-i2s.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/hisilicon/hi6210-i2s.c b/sound/soc/hisilicon/hi6210-i2s.c +index 907f5f1f7b44..ff05b9779e4b 100644 +--- a/sound/soc/hisilicon/hi6210-i2s.c ++++ b/sound/soc/hisilicon/hi6210-i2s.c +@@ -102,18 +102,15 @@ static int hi6210_i2s_startup(struct snd_pcm_substream *substream, + + for (n = 0; n < i2s->clocks; n++) { + ret = clk_prepare_enable(i2s->clk[n]); +- if (ret) { +- while (n--) +- clk_disable_unprepare(i2s->clk[n]); +- return ret; +- } ++ if (ret) ++ goto err_unprepare_clk; + } + + ret = clk_set_rate(i2s->clk[CLK_I2S_BASE], 49152000); + if (ret) { + dev_err(i2s->dev, "%s: setting 49.152MHz base rate failed %d\n", + __func__, ret); +- return ret; ++ goto err_unprepare_clk; + } + + /* enable clock before frequency division */ +@@ -165,6 +162,11 @@ static int hi6210_i2s_startup(struct snd_pcm_substream *substream, + hi6210_write_reg(i2s, HII2S_SW_RST_N, val); + + return 0; ++ ++err_unprepare_clk: ++ while (n--) ++ clk_disable_unprepare(i2s->clk[n]); ++ return ret; + } + + static void hi6210_i2s_shutdown(struct snd_pcm_substream *substream, +-- +2.30.2 + diff --git a/queue-5.12/asoc-intel-sof_sdw-add-quirk-support-for-brya-and-bt.patch b/queue-5.12/asoc-intel-sof_sdw-add-quirk-support-for-brya-and-bt.patch new file mode 100644 index 00000000000..a31bbd02865 --- /dev/null +++ b/queue-5.12/asoc-intel-sof_sdw-add-quirk-support-for-brya-and-bt.patch @@ -0,0 +1,56 @@ +From 9a7c63c291a740868982cbe30d27723d9cc29d8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 18:56:32 +0300 +Subject: ASoC: Intel: sof_sdw: add quirk support for Brya and BT-offload + +From: Vamshi Krishna Gopal + +[ Upstream commit 03effde3a2ea1d82c4dd6b634fc6174545d2c34f ] + +Brya is another ADL-P product. + +AlderLake has support for Bluetooth audio offload capability. +Enable the BT-offload quirk for ADL-P Brya and the Intel RVP. + +Signed-off-by: Vamshi Krishna Gopal +Signed-off-by: Yong Zhi +Reviewed-by: Bard Liao +Reviewed-by: Ranjani Sridharan +Signed-off-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20210521155632.3736393-2-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index dfad2ad129ab..35ad448902c7 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -197,7 +197,21 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + .driver_data = (void *)(SOF_RT711_JD_SRC_JD1 | + SOF_SDW_TGL_HDMI | + SOF_RT715_DAI_ID_FIX | +- SOF_SDW_PCH_DMIC), ++ SOF_SDW_PCH_DMIC | ++ SOF_BT_OFFLOAD_SSP(2) | ++ SOF_SSP_BT_OFFLOAD_PRESENT), ++ }, ++ { ++ .callback = sof_sdw_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Google"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Brya"), ++ }, ++ .driver_data = (void *)(SOF_SDW_TGL_HDMI | ++ SOF_SDW_PCH_DMIC | ++ SOF_SDW_FOUR_SPK | ++ SOF_BT_OFFLOAD_SSP(2) | ++ SOF_SSP_BT_OFFLOAD_PRESENT), + }, + {} + }; +-- +2.30.2 + diff --git a/queue-5.12/asoc-intel-sof_sdw-add-sof_rt715_dai_id_fix-for-alde.patch b/queue-5.12/asoc-intel-sof_sdw-add-sof_rt715_dai_id_fix-for-alde.patch new file mode 100644 index 00000000000..6eca8f309db --- /dev/null +++ b/queue-5.12/asoc-intel-sof_sdw-add-sof_rt715_dai_id_fix-for-alde.patch @@ -0,0 +1,37 @@ +From 17bd4d6edf2a90cd369db6024a7a2f0cbd5fd247 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 11:37:02 -0500 +Subject: ASoC: Intel: sof_sdw: add SOF_RT715_DAI_ID_FIX for AlderLake + +From: Libin Yang + +[ Upstream commit 81cd42e5174ba7918edd3d006406ce21ebaa8507 ] + +AlderLake needs the flag SOF_RT715_DAI_ID_FIX if it is using the +rt715 DMIC. + +Reviewed-by: Bard Liao +Signed-off-by: Libin Yang +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210505163705.305616-11-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index ecd3f90f4bbe..dfad2ad129ab 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -196,6 +196,7 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + }, + .driver_data = (void *)(SOF_RT711_JD_SRC_JD1 | + SOF_SDW_TGL_HDMI | ++ SOF_RT715_DAI_ID_FIX | + SOF_SDW_PCH_DMIC), + }, + {} +-- +2.30.2 + diff --git a/queue-5.12/asoc-intel-sof_sdw-use-mach-data-for-adl-rvp-dmic-co.patch b/queue-5.12/asoc-intel-sof_sdw-use-mach-data-for-adl-rvp-dmic-co.patch new file mode 100644 index 00000000000..77f0bbb397b --- /dev/null +++ b/queue-5.12/asoc-intel-sof_sdw-use-mach-data-for-adl-rvp-dmic-co.patch @@ -0,0 +1,40 @@ +From 95e2f41bc8e9f9cb375586e7fb84aa944e83d53b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 14:40:48 -0500 +Subject: ASoC: Intel: sof_sdw: use mach data for ADL RVP DMIC count + +From: Kai Vehmanen + +[ Upstream commit 505351329d26e684588a6919c0407b8a0f5c3813 ] + +On the reference boards, number of PCH dmics may vary and the number +should be taken from driver machine data. Remove the SOF_SDW_PCH_DMIC +quirk to make DMIC number configurable. + +Fixes:d25bbe80485f8 ("ASoC: Intel: sof_sdw: add quirk for new ADL-P Rvp") + +BugLink: https://github.com/thesofproject/sof/issues/4185 +Signed-off-by: Kai Vehmanen +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210621194057.21711-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_sdw.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/sound/soc/intel/boards/sof_sdw.c b/sound/soc/intel/boards/sof_sdw.c +index 35ad448902c7..dd93f663803b 100644 +--- a/sound/soc/intel/boards/sof_sdw.c ++++ b/sound/soc/intel/boards/sof_sdw.c +@@ -197,7 +197,6 @@ static const struct dmi_system_id sof_sdw_quirk_table[] = { + .driver_data = (void *)(SOF_RT711_JD_SRC_JD1 | + SOF_SDW_TGL_HDMI | + SOF_RT715_DAI_ID_FIX | +- SOF_SDW_PCH_DMIC | + SOF_BT_OFFLOAD_SSP(2) | + SOF_SSP_BT_OFFLOAD_PRESENT), + }, +-- +2.30.2 + diff --git a/queue-5.12/asoc-max98373-sdw-add-missing-memory-allocation-chec.patch b/queue-5.12/asoc-max98373-sdw-add-missing-memory-allocation-chec.patch new file mode 100644 index 00000000000..e88fd02ae1b --- /dev/null +++ b/queue-5.12/asoc-max98373-sdw-add-missing-memory-allocation-chec.patch @@ -0,0 +1,38 @@ +From 502d9069f2e3efe017c027c4e740d2e2250b5da9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 17:22:25 -0500 +Subject: ASoC: max98373-sdw: add missing memory allocation check + +From: Pierre-Louis Bossart + +[ Upstream commit 468a272ca49cc4e2f58f3c360643c3f6d313c146 ] + +We forgot to test that devm_kcalloc doesn't return NULL. + +Fixes: 349dd23931d1 ('ASoC: max98373: don't access volatile registers in bias level off') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20210607222239.582139-2-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98373-sdw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/max98373-sdw.c b/sound/soc/codecs/max98373-sdw.c +index f3a12205cd48..c7a3506046db 100644 +--- a/sound/soc/codecs/max98373-sdw.c ++++ b/sound/soc/codecs/max98373-sdw.c +@@ -787,6 +787,8 @@ static int max98373_init(struct sdw_slave *slave, struct regmap *regmap) + max98373->cache = devm_kcalloc(dev, max98373->cache_num, + sizeof(*max98373->cache), + GFP_KERNEL); ++ if (!max98373->cache) ++ return -ENOMEM; + + for (i = 0; i < max98373->cache_num; i++) + max98373->cache[i].reg = max98373_sdw_cache_reg[i]; +-- +2.30.2 + diff --git a/queue-5.12/asoc-max98373-sdw-use-first_hw_init-flag-on-resume.patch b/queue-5.12/asoc-max98373-sdw-use-first_hw_init-flag-on-resume.patch new file mode 100644 index 00000000000..d1c2f41baba --- /dev/null +++ b/queue-5.12/asoc-max98373-sdw-use-first_hw_init-flag-on-resume.patch @@ -0,0 +1,106 @@ +From 2ef1b52513a7d76e0299e91fed2d2d21d1228d09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 17:22:26 -0500 +Subject: ASoC: max98373-sdw: use first_hw_init flag on resume + +From: Pierre-Louis Bossart + +[ Upstream commit bf881170311ea74ff30c3be0be8fb097132ce696 ] + +The intent of the status check on resume was to verify if a SoundWire +peripheral reported ATTACHED before waiting for the initialization to +complete. This is required to avoid timeouts that will happen with +'ghost' devices that are exposed in the platform firmware but are not +populated in hardware. + +Unfortunately we used 'hw_init' instead of 'first_hw_init'. Due to +another error, the resume operation never timed out, but the volume +settings were not properly restored. + +This patch renames the status flag to 'first_hw_init' for consistency +with other drivers. + +BugLink: https://github.com/thesofproject/linux/issues/2637 +Fixes: 56a5b7910e96 ('ASoC: codecs: max98373: add SoundWire support') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20210607222239.582139-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98373-sdw.c | 12 ++++++------ + sound/soc/codecs/max98373.h | 2 +- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/sound/soc/codecs/max98373-sdw.c b/sound/soc/codecs/max98373-sdw.c +index c7a3506046db..dc520effc61c 100644 +--- a/sound/soc/codecs/max98373-sdw.c ++++ b/sound/soc/codecs/max98373-sdw.c +@@ -271,7 +271,7 @@ static __maybe_unused int max98373_resume(struct device *dev) + struct max98373_priv *max98373 = dev_get_drvdata(dev); + unsigned long time; + +- if (!max98373->hw_init) ++ if (!max98373->first_hw_init) + return 0; + + if (!slave->unattach_request) +@@ -362,7 +362,7 @@ static int max98373_io_init(struct sdw_slave *slave) + struct device *dev = &slave->dev; + struct max98373_priv *max98373 = dev_get_drvdata(dev); + +- if (max98373->pm_init_once) { ++ if (max98373->first_hw_init) { + regcache_cache_only(max98373->regmap, false); + regcache_cache_bypass(max98373->regmap, true); + } +@@ -370,7 +370,7 @@ static int max98373_io_init(struct sdw_slave *slave) + /* + * PM runtime is only enabled when a Slave reports as Attached + */ +- if (!max98373->pm_init_once) { ++ if (!max98373->first_hw_init) { + /* set autosuspend parameters */ + pm_runtime_set_autosuspend_delay(dev, 3000); + pm_runtime_use_autosuspend(dev); +@@ -462,12 +462,12 @@ static int max98373_io_init(struct sdw_slave *slave) + regmap_write(max98373->regmap, MAX98373_R20B5_BDE_EN, 1); + regmap_write(max98373->regmap, MAX98373_R20E2_LIMITER_EN, 1); + +- if (max98373->pm_init_once) { ++ if (max98373->first_hw_init) { + regcache_cache_bypass(max98373->regmap, false); + regcache_mark_dirty(max98373->regmap); + } + +- max98373->pm_init_once = true; ++ max98373->first_hw_init = true; + max98373->hw_init = true; + + pm_runtime_mark_last_busy(dev); +@@ -797,7 +797,7 @@ static int max98373_init(struct sdw_slave *slave, struct regmap *regmap) + max98373_slot_config(dev, max98373); + + max98373->hw_init = false; +- max98373->pm_init_once = false; ++ max98373->first_hw_init = false; + + /* codec registration */ + ret = devm_snd_soc_register_component(dev, &soc_codec_dev_max98373_sdw, +diff --git a/sound/soc/codecs/max98373.h b/sound/soc/codecs/max98373.h +index 71f5a5228f34..c09c73678a9a 100644 +--- a/sound/soc/codecs/max98373.h ++++ b/sound/soc/codecs/max98373.h +@@ -223,7 +223,7 @@ struct max98373_priv { + /* variables to support soundwire */ + struct sdw_slave *slave; + bool hw_init; +- bool pm_init_once; ++ bool first_hw_init; + int slot; + unsigned int rx_mask; + }; +-- +2.30.2 + diff --git a/queue-5.12/asoc-mediatek-mtk-btcvsd-fix-an-error-handling-path-.patch b/queue-5.12/asoc-mediatek-mtk-btcvsd-fix-an-error-handling-path-.patch new file mode 100644 index 00000000000..c408c463968 --- /dev/null +++ b/queue-5.12/asoc-mediatek-mtk-btcvsd-fix-an-error-handling-path-.patch @@ -0,0 +1,92 @@ +From 9408f4574e915865a90cb2d73655ba75b8514d4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Jun 2021 16:31:09 +0200 +Subject: ASoC: mediatek: mtk-btcvsd: Fix an error handling path in + 'mtk_btcvsd_snd_probe()' + +From: Christophe JAILLET + +[ Upstream commit b6052c3c7a78f5e2b9756c92ef77c0b56435f107 ] + +If an error occurs after a successful 'of_iomap()' call, it must be undone +by a corresponding 'iounmap()' call, as already done in the remove +function. + +While at it, remove the useless initialization of 'ret' at the beginning of +the function. + +Fixes: 4bd8597dc36c ("ASoC: mediatek: add btcvsd driver") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/0c2ba562c3364e61bfbd5b3013a99dfa0d9045d7.1622989685.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mediatek/common/mtk-btcvsd.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/mediatek/common/mtk-btcvsd.c b/sound/soc/mediatek/common/mtk-btcvsd.c +index a554c57b6460..6299dee9a6de 100644 +--- a/sound/soc/mediatek/common/mtk-btcvsd.c ++++ b/sound/soc/mediatek/common/mtk-btcvsd.c +@@ -1281,7 +1281,7 @@ static const struct snd_soc_component_driver mtk_btcvsd_snd_platform = { + + static int mtk_btcvsd_snd_probe(struct platform_device *pdev) + { +- int ret = 0; ++ int ret; + int irq_id; + u32 offset[5] = {0, 0, 0, 0, 0}; + struct mtk_btcvsd_snd *btcvsd; +@@ -1337,7 +1337,8 @@ static int mtk_btcvsd_snd_probe(struct platform_device *pdev) + btcvsd->bt_sram_bank2_base = of_iomap(dev->of_node, 1); + if (!btcvsd->bt_sram_bank2_base) { + dev_err(dev, "iomap bt_sram_bank2_base fail\n"); +- return -EIO; ++ ret = -EIO; ++ goto unmap_pkv_err; + } + + btcvsd->infra = syscon_regmap_lookup_by_phandle(dev->of_node, +@@ -1345,7 +1346,8 @@ static int mtk_btcvsd_snd_probe(struct platform_device *pdev) + if (IS_ERR(btcvsd->infra)) { + dev_err(dev, "cannot find infra controller: %ld\n", + PTR_ERR(btcvsd->infra)); +- return PTR_ERR(btcvsd->infra); ++ ret = PTR_ERR(btcvsd->infra); ++ goto unmap_bank2_err; + } + + /* get offset */ +@@ -1354,7 +1356,7 @@ static int mtk_btcvsd_snd_probe(struct platform_device *pdev) + ARRAY_SIZE(offset)); + if (ret) { + dev_warn(dev, "%s(), get offset fail, ret %d\n", __func__, ret); +- return ret; ++ goto unmap_bank2_err; + } + btcvsd->infra_misc_offset = offset[0]; + btcvsd->conn_bt_cvsd_mask = offset[1]; +@@ -1373,8 +1375,18 @@ static int mtk_btcvsd_snd_probe(struct platform_device *pdev) + mtk_btcvsd_snd_set_state(btcvsd, btcvsd->tx, BT_SCO_STATE_IDLE); + mtk_btcvsd_snd_set_state(btcvsd, btcvsd->rx, BT_SCO_STATE_IDLE); + +- return devm_snd_soc_register_component(dev, &mtk_btcvsd_snd_platform, +- NULL, 0); ++ ret = devm_snd_soc_register_component(dev, &mtk_btcvsd_snd_platform, ++ NULL, 0); ++ if (ret) ++ goto unmap_bank2_err; ++ ++ return 0; ++ ++unmap_bank2_err: ++ iounmap(btcvsd->bt_sram_bank2_base); ++unmap_pkv_err: ++ iounmap(btcvsd->bt_pkv_base); ++ return ret; + } + + static int mtk_btcvsd_snd_remove(struct platform_device *pdev) +-- +2.30.2 + diff --git a/queue-5.12/asoc-rk3328-fix-missing-clk_disable_unprepare-on-err.patch b/queue-5.12/asoc-rk3328-fix-missing-clk_disable_unprepare-on-err.patch new file mode 100644 index 00000000000..1a17dd57be3 --- /dev/null +++ b/queue-5.12/asoc-rk3328-fix-missing-clk_disable_unprepare-on-err.patch @@ -0,0 +1,80 @@ +From b60f56f770e9a4de828ae9402abc0dfe2932b581 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 15:58:47 +0800 +Subject: ASoC: rk3328: fix missing clk_disable_unprepare() on error in + rk3328_platform_probe() + +From: Yang Yingliang + +[ Upstream commit d14eece945a8068a017995f7512ea2beac21e34b ] + +Fix the missing clk_disable_unprepare() before return +from rk3328_platform_probe() in the error handling case. + +Fixes: c32759035ad2 ("ASoC: rockchip: support ACODEC for rk3328") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210518075847.1116983-1-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rk3328_codec.c | 28 ++++++++++++++++++++++------ + 1 file changed, 22 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/rk3328_codec.c b/sound/soc/codecs/rk3328_codec.c +index bfefefcc76d8..758d439e8c7a 100644 +--- a/sound/soc/codecs/rk3328_codec.c ++++ b/sound/soc/codecs/rk3328_codec.c +@@ -474,7 +474,8 @@ static int rk3328_platform_probe(struct platform_device *pdev) + rk3328->pclk = devm_clk_get(&pdev->dev, "pclk"); + if (IS_ERR(rk3328->pclk)) { + dev_err(&pdev->dev, "can't get acodec pclk\n"); +- return PTR_ERR(rk3328->pclk); ++ ret = PTR_ERR(rk3328->pclk); ++ goto err_unprepare_mclk; + } + + ret = clk_prepare_enable(rk3328->pclk); +@@ -484,19 +485,34 @@ static int rk3328_platform_probe(struct platform_device *pdev) + } + + base = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(base)) +- return PTR_ERR(base); ++ if (IS_ERR(base)) { ++ ret = PTR_ERR(base); ++ goto err_unprepare_pclk; ++ } + + rk3328->regmap = devm_regmap_init_mmio(&pdev->dev, base, + &rk3328_codec_regmap_config); +- if (IS_ERR(rk3328->regmap)) +- return PTR_ERR(rk3328->regmap); ++ if (IS_ERR(rk3328->regmap)) { ++ ret = PTR_ERR(rk3328->regmap); ++ goto err_unprepare_pclk; ++ } + + platform_set_drvdata(pdev, rk3328); + +- return devm_snd_soc_register_component(&pdev->dev, &soc_codec_rk3328, ++ ret = devm_snd_soc_register_component(&pdev->dev, &soc_codec_rk3328, + rk3328_dai, + ARRAY_SIZE(rk3328_dai)); ++ if (ret) ++ goto err_unprepare_pclk; ++ ++ return 0; ++ ++err_unprepare_pclk: ++ clk_disable_unprepare(rk3328->pclk); ++ ++err_unprepare_mclk: ++ clk_disable_unprepare(rk3328->mclk); ++ return ret; + } + + static const struct of_device_id rk3328_codec_of_match[] __maybe_unused = { +-- +2.30.2 + diff --git a/queue-5.12/asoc-rsnd-tidyup-loop-on-rsnd_adg_clk_query.patch b/queue-5.12/asoc-rsnd-tidyup-loop-on-rsnd_adg_clk_query.patch new file mode 100644 index 00000000000..8f273499846 --- /dev/null +++ b/queue-5.12/asoc-rsnd-tidyup-loop-on-rsnd_adg_clk_query.patch @@ -0,0 +1,49 @@ +From e23ab900c447f708b568b87ee8e4fa975b756d00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 15:12:09 +0900 +Subject: ASoC: rsnd: tidyup loop on rsnd_adg_clk_query() + +From: Kuninori Morimoto + +[ Upstream commit cf9d5c6619fadfc41cf8f5154cb990cc38e3da85 ] + +commit 06e8f5c842f2d ("ASoC: rsnd: don't call clk_get_rate() under +atomic context") used saved clk_rate, thus for_each_rsnd_clk() +is no longer needed. This patch fixes it. + +Fixes: 06e8f5c842f2d ("ASoC: rsnd: don't call clk_get_rate() under atomic context") +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87v978oe2u.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/rcar/adg.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c +index abdfd9cf91e2..19c604b2e248 100644 +--- a/sound/soc/sh/rcar/adg.c ++++ b/sound/soc/sh/rcar/adg.c +@@ -289,7 +289,6 @@ static void rsnd_adg_set_ssi_clk(struct rsnd_mod *ssi_mod, u32 val) + int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate) + { + struct rsnd_adg *adg = rsnd_priv_to_adg(priv); +- struct clk *clk; + int i; + int sel_table[] = { + [CLKA] = 0x1, +@@ -302,10 +301,9 @@ int rsnd_adg_clk_query(struct rsnd_priv *priv, unsigned int rate) + * find suitable clock from + * AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC/AUDIO_CLKI. + */ +- for_each_rsnd_clk(clk, adg, i) { ++ for (i = 0; i < CLKMAX; i++) + if (rate == adg->clk_rate[i]) + return sel_table[i]; +- } + + /* + * find divided clock from BRGA/BRGB +-- +2.30.2 + diff --git a/queue-5.12/asoc-rt1308-sdw-use-first_hw_init-flag-on-resume.patch b/queue-5.12/asoc-rt1308-sdw-use-first_hw_init-flag-on-resume.patch new file mode 100644 index 00000000000..3f43aa0ff47 --- /dev/null +++ b/queue-5.12/asoc-rt1308-sdw-use-first_hw_init-flag-on-resume.patch @@ -0,0 +1,48 @@ +From 58cc70012417037ba8f1339be91cda4e03114991 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 17:22:27 -0500 +Subject: ASoC: rt1308-sdw: use first_hw_init flag on resume + +From: Pierre-Louis Bossart + +[ Upstream commit 30e102dab5fad1db71684f8ac5e1ac74e49da06d ] + +The intent of the status check on resume was to verify if a SoundWire +peripheral reported ATTACHED before waiting for the initialization to +complete. This is required to avoid timeouts that will happen with +'ghost' devices that are exposed in the platform firmware but are not +populated in hardware. + +Unfortunately we used 'hw_init' instead of 'first_hw_init'. Due to +another error, the resume operation never timed out, but the volume +settings were not properly restored. + +BugLink: https://github.com/thesofproject/linux/issues/2908 +BugLink: https://github.com/thesofproject/linux/issues/2637 +Fixes: a87a6653a28c0 ('ASoC: rt1308-sdw: add rt1308 SdW amplifier driver') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20210607222239.582139-4-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt1308-sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt1308-sdw.c b/sound/soc/codecs/rt1308-sdw.c +index afd2c3b687cc..0ec741cf70fc 100644 +--- a/sound/soc/codecs/rt1308-sdw.c ++++ b/sound/soc/codecs/rt1308-sdw.c +@@ -709,7 +709,7 @@ static int __maybe_unused rt1308_dev_resume(struct device *dev) + struct rt1308_sdw_priv *rt1308 = dev_get_drvdata(dev); + unsigned long time; + +- if (!rt1308->hw_init) ++ if (!rt1308->first_hw_init) + return 0; + + if (!slave->unattach_request) +-- +2.30.2 + diff --git a/queue-5.12/asoc-rt5682-disable-irq-on-shutdown.patch b/queue-5.12/asoc-rt5682-disable-irq-on-shutdown.patch new file mode 100644 index 00000000000..e24d2b1a3cf --- /dev/null +++ b/queue-5.12/asoc-rt5682-disable-irq-on-shutdown.patch @@ -0,0 +1,45 @@ +From 13362ca2991e7bfbb0d66101f97e9283345bc358 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 00:51:50 -0700 +Subject: ASoC: rt5682: Disable irq on shutdown + +From: Stephen Boyd + +[ Upstream commit 47bcb1c7108363418cd578283333d72e310dfeaa ] + +We cancel the work queues, and reset the device on shutdown, but the irq +isn't disabled so the work queues could be queued again. Let's disable +the irq during shutdown so that we don't have to worry about this device +trying to do anything anymore. This fixes a problem seen where the i2c +bus is shutdown at reboot but this device irq still comes in and tries +to make another i2c transaction when the bus doesn't work. + +Cc: Jairaj Arava +Cc: Sathyanarayana Nujella +Cc: Pierre-Louis Bossart +Cc: Shuming Fan +Cc: Ranjani Sridharan +Fixes: 45a2702ce109 ("ASoC: rt5682: Fix panic in rt5682_jack_detect_handler happening during system shutdown") +Signed-off-by: Stephen Boyd +Link: https://lore.kernel.org/r/20210508075151.1626903-1-swboyd@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682-i2c.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/rt5682-i2c.c b/sound/soc/codecs/rt5682-i2c.c +index 93c1603b42f1..8265b537ff4f 100644 +--- a/sound/soc/codecs/rt5682-i2c.c ++++ b/sound/soc/codecs/rt5682-i2c.c +@@ -273,6 +273,7 @@ static void rt5682_i2c_shutdown(struct i2c_client *client) + { + struct rt5682_priv *rt5682 = i2c_get_clientdata(client); + ++ disable_irq(client->irq); + cancel_delayed_work_sync(&rt5682->jack_detect_work); + cancel_delayed_work_sync(&rt5682->jd_check_work); + +-- +2.30.2 + diff --git a/queue-5.12/asoc-rt5682-fix-a-problem-with-error-handling-in-the.patch b/queue-5.12/asoc-rt5682-fix-a-problem-with-error-handling-in-the.patch new file mode 100644 index 00000000000..ced7922be5d --- /dev/null +++ b/queue-5.12/asoc-rt5682-fix-a-problem-with-error-handling-in-the.patch @@ -0,0 +1,57 @@ +From c8f93651be4d3603492419c51147cc000a86ecd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 17:22:36 -0500 +Subject: ASoC: rt5682: Fix a problem with error handling in the io init + function of the soundwire + +From: Oder Chiou + +[ Upstream commit 9266d95405ae0c078f188ec8bca3a004631be429 ] + +The device checking error should be a jump to pm_runtime_put_autosuspend() +as done before returning value. + +Fixes: 867f8d18df4f ('ASoC: rt5682: fix getting the wrong device id when the suspend_stress_test') +Reviewed-by: Bard Liao +Signed-off-by: Oder Chiou +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210607222239.582139-13-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682-sdw.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt5682-sdw.c b/sound/soc/codecs/rt5682-sdw.c +index 6bf1b4c31296..2b0f02e6c977 100644 +--- a/sound/soc/codecs/rt5682-sdw.c ++++ b/sound/soc/codecs/rt5682-sdw.c +@@ -408,9 +408,11 @@ static int rt5682_io_init(struct device *dev, struct sdw_slave *slave) + usleep_range(30000, 30005); + loop--; + } ++ + if (val != DEVICE_ID) { + dev_err(dev, "Device with ID register %x is not rt5682\n", val); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_nodev; + } + + if (rt5682->first_hw_init) { +@@ -486,10 +488,11 @@ reinit: + rt5682->hw_init = true; + rt5682->first_hw_init = true; + ++err_nodev: + pm_runtime_mark_last_busy(&slave->dev); + pm_runtime_put_autosuspend(&slave->dev); + +- dev_dbg(&slave->dev, "%s hw_init complete\n", __func__); ++ dev_dbg(&slave->dev, "%s hw_init complete: %d\n", __func__, ret); + + return ret; + } +-- +2.30.2 + diff --git a/queue-5.12/asoc-rt5682-sdw-set-regcache_cache_only-false-before.patch b/queue-5.12/asoc-rt5682-sdw-set-regcache_cache_only-false-before.patch new file mode 100644 index 00000000000..2590b3f6f59 --- /dev/null +++ b/queue-5.12/asoc-rt5682-sdw-set-regcache_cache_only-false-before.patch @@ -0,0 +1,54 @@ +From 25e3adbdfae3d692be902bea6ca35b67e41c15ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 17:22:37 -0500 +Subject: ASoC: rt5682-sdw: set regcache_cache_only false before reading + RT5682_DEVICE_ID + +From: Bard Liao + +[ Upstream commit c0372bc873dd29f325ee908351e0bd5b08d4d608 ] + +RT5682_DEVICE_ID is a volatile register, we can not read it in cache +only mode. + +Fixes: 03f6fc6de919 ("ASoC: rt5682: Add the soundwire support") +Signed-off-by: Bard Liao +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210607222239.582139-14-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682-sdw.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/codecs/rt5682-sdw.c b/sound/soc/codecs/rt5682-sdw.c +index 2b0f02e6c977..b4649b599eaa 100644 +--- a/sound/soc/codecs/rt5682-sdw.c ++++ b/sound/soc/codecs/rt5682-sdw.c +@@ -400,6 +400,11 @@ static int rt5682_io_init(struct device *dev, struct sdw_slave *slave) + + pm_runtime_get_noresume(&slave->dev); + ++ if (rt5682->first_hw_init) { ++ regcache_cache_only(rt5682->regmap, false); ++ regcache_cache_bypass(rt5682->regmap, true); ++ } ++ + while (loop > 0) { + regmap_read(rt5682->regmap, RT5682_DEVICE_ID, &val); + if (val == DEVICE_ID) +@@ -415,11 +420,6 @@ static int rt5682_io_init(struct device *dev, struct sdw_slave *slave) + goto err_nodev; + } + +- if (rt5682->first_hw_init) { +- regcache_cache_only(rt5682->regmap, false); +- regcache_cache_bypass(rt5682->regmap, true); +- } +- + rt5682_calibrate(rt5682); + + if (rt5682->first_hw_init) { +-- +2.30.2 + diff --git a/queue-5.12/asoc-rt5682-sdw-use-first_hw_init-flag-on-resume.patch b/queue-5.12/asoc-rt5682-sdw-use-first_hw_init-flag-on-resume.patch new file mode 100644 index 00000000000..55a01fd4ca2 --- /dev/null +++ b/queue-5.12/asoc-rt5682-sdw-use-first_hw_init-flag-on-resume.patch @@ -0,0 +1,48 @@ +From 6ddc4bc752f0e3034ef464500f56addfe88a43f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 17:22:29 -0500 +Subject: ASoC: rt5682-sdw: use first_hw_init flag on resume + +From: Pierre-Louis Bossart + +[ Upstream commit 5361a42114689f875a9748299cadb4b1adbee6f4 ] + +The intent of the status check on resume was to verify if a SoundWire +peripheral reported ATTACHED before waiting for the initialization to +complete. This is required to avoid timeouts that will happen with +'ghost' devices that are exposed in the platform firmware but are not +populated in hardware. + +Unfortunately we used 'hw_init' instead of 'first_hw_init'. Due to +another error, the resume operation never timed out, but the volume +settings were not properly restored. + +BugLink: https://github.com/thesofproject/linux/issues/2908 +BugLink: https://github.com/thesofproject/linux/issues/2637 +Fixes: 03f6fc6de9192 ('ASoC: rt5682: Add the soundwire support') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20210607222239.582139-6-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5682-sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt5682-sdw.c b/sound/soc/codecs/rt5682-sdw.c +index d1dd7f720ba4..6bf1b4c31296 100644 +--- a/sound/soc/codecs/rt5682-sdw.c ++++ b/sound/soc/codecs/rt5682-sdw.c +@@ -743,7 +743,7 @@ static int __maybe_unused rt5682_dev_resume(struct device *dev) + struct rt5682_priv *rt5682 = dev_get_drvdata(dev); + unsigned long time; + +- if (!rt5682->hw_init) ++ if (!rt5682->first_hw_init) + return 0; + + if (!slave->unattach_request) +-- +2.30.2 + diff --git a/queue-5.12/asoc-rt700-sdw-use-first_hw_init-flag-on-resume.patch b/queue-5.12/asoc-rt700-sdw-use-first_hw_init-flag-on-resume.patch new file mode 100644 index 00000000000..169e6b10d06 --- /dev/null +++ b/queue-5.12/asoc-rt700-sdw-use-first_hw_init-flag-on-resume.patch @@ -0,0 +1,48 @@ +From 694688d58aa4534ed1a4c2fba0c9941218776397 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 17:22:30 -0500 +Subject: ASoC: rt700-sdw: use first_hw_init flag on resume + +From: Pierre-Louis Bossart + +[ Upstream commit a9e54e5fbe396b546771cf77b43ce7c75e212278 ] + +The intent of the status check on resume was to verify if a SoundWire +peripheral reported ATTACHED before waiting for the initialization to +complete. This is required to avoid timeouts that will happen with +'ghost' devices that are exposed in the platform firmware but are not +populated in hardware. + +Unfortunately we used 'hw_init' instead of 'first_hw_init'. Due to +another error, the resume operation never timed out, but the volume +settings were not properly restored. + +BugLink: https://github.com/thesofproject/linux/issues/2908 +BugLink: https://github.com/thesofproject/linux/issues/2637 +Fixes: 7d2a5f9ae41e3 ('ASoC: rt700: add rt700 codec driver') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20210607222239.582139-7-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt700-sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt700-sdw.c b/sound/soc/codecs/rt700-sdw.c +index 4001612dfd73..fc6299a6022d 100644 +--- a/sound/soc/codecs/rt700-sdw.c ++++ b/sound/soc/codecs/rt700-sdw.c +@@ -498,7 +498,7 @@ static int __maybe_unused rt700_dev_resume(struct device *dev) + struct rt700_priv *rt700 = dev_get_drvdata(dev); + unsigned long time; + +- if (!rt700->hw_init) ++ if (!rt700->first_hw_init) + return 0; + + if (!slave->unattach_request) +-- +2.30.2 + diff --git a/queue-5.12/asoc-rt711-sdw-use-first_hw_init-flag-on-resume.patch b/queue-5.12/asoc-rt711-sdw-use-first_hw_init-flag-on-resume.patch new file mode 100644 index 00000000000..5d66cd30fc2 --- /dev/null +++ b/queue-5.12/asoc-rt711-sdw-use-first_hw_init-flag-on-resume.patch @@ -0,0 +1,48 @@ +From cc0222988d6dee8f614152a61739c97b7329a10e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 17:22:32 -0500 +Subject: ASoC: rt711-sdw: use first_hw_init flag on resume + +From: Pierre-Louis Bossart + +[ Upstream commit a0897ebca669f09a2e02206a9c48a738af655329 ] + +The intent of the status check on resume was to verify if a SoundWire +peripheral reported ATTACHED before waiting for the initialization to +complete. This is required to avoid timeouts that will happen with +'ghost' devices that are exposed in the platform firmware but are not +populated in hardware. + +Unfortunately we used 'hw_init' instead of 'first_hw_init'. Due to +another error, the resume operation never timed out, but the volume +settings were not properly restored. + +BugLink: https://github.com/thesofproject/linux/issues/2908 +BugLink: https://github.com/thesofproject/linux/issues/2637 +Fixes: 320b8b0d13b81 ('ASoC: rt711: add rt711 codec driver') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20210607222239.582139-9-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt711-sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt711-sdw.c b/sound/soc/codecs/rt711-sdw.c +index 2beb4286d997..bfa9fede7f90 100644 +--- a/sound/soc/codecs/rt711-sdw.c ++++ b/sound/soc/codecs/rt711-sdw.c +@@ -501,7 +501,7 @@ static int __maybe_unused rt711_dev_resume(struct device *dev) + struct rt711_priv *rt711 = dev_get_drvdata(dev); + unsigned long time; + +- if (!rt711->hw_init) ++ if (!rt711->first_hw_init) + return 0; + + if (!slave->unattach_request) +-- +2.30.2 + diff --git a/queue-5.12/asoc-rt715-sdw-use-first_hw_init-flag-on-resume.patch b/queue-5.12/asoc-rt715-sdw-use-first_hw_init-flag-on-resume.patch new file mode 100644 index 00000000000..cda4cc6e5dc --- /dev/null +++ b/queue-5.12/asoc-rt715-sdw-use-first_hw_init-flag-on-resume.patch @@ -0,0 +1,48 @@ +From 15ab490ec00504c08ebef2988b40aa7c6b63fd4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 17:22:34 -0500 +Subject: ASoC: rt715-sdw: use first_hw_init flag on resume + +From: Pierre-Louis Bossart + +[ Upstream commit dbc07517ab173688ef11234d1099bc1e24e4f14b ] + +The intent of the status check on resume was to verify if a SoundWire +peripheral reported ATTACHED before waiting for the initialization to +complete. This is required to avoid timeouts that will happen with +'ghost' devices that are exposed in the platform firmware but are not +populated in hardware. + +Unfortunately we used 'hw_init' instead of 'first_hw_init'. Due to +another error, the resume operation never timed out, but the volume +settings were not properly restored. + +BugLink: https://github.com/thesofproject/linux/issues/2908 +BugLink: https://github.com/thesofproject/linux/issues/2637 +Fixes: d1ede0641b05e ('ASoC: rt715: add RT715 codec driver') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20210607222239.582139-11-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt715-sdw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/rt715-sdw.c b/sound/soc/codecs/rt715-sdw.c +index 71dd3b97a459..157a97acc6c2 100644 +--- a/sound/soc/codecs/rt715-sdw.c ++++ b/sound/soc/codecs/rt715-sdw.c +@@ -541,7 +541,7 @@ static int __maybe_unused rt715_dev_resume(struct device *dev) + struct rt715_priv *rt715 = dev_get_drvdata(dev); + unsigned long time; + +- if (!rt715->hw_init) ++ if (!rt715->first_hw_init) + return 0; + + if (!slave->unattach_request) +-- +2.30.2 + diff --git a/queue-5.12/ath10k-add-missing-error-return-code-in-ath10k_pci_p.patch b/queue-5.12/ath10k-add-missing-error-return-code-in-ath10k_pci_p.patch new file mode 100644 index 00000000000..b9742a5db5e --- /dev/null +++ b/queue-5.12/ath10k-add-missing-error-return-code-in-ath10k_pci_p.patch @@ -0,0 +1,64 @@ +From fe71f4ce6a7d8af3bd33d8f97ecfa26bd83f2c84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 May 2021 17:41:28 +0300 +Subject: ath10k: add missing error return code in ath10k_pci_probe() + +From: Yang Yingliang + +[ Upstream commit e2783e2f39ba99178dedfc1646d5cc0979d1bab3 ] + +When chip_id is not supported, the resources will be freed +on path err_unsupported, these resources will also be freed +when calling ath10k_pci_remove(), it will cause double free, +so return -ENODEV when it doesn't support the device with wrong +chip_id. + +Fixes: c0c378f9907c ("ath10k: remove target soc ps code") +Fixes: 7505f7c3ec1d ("ath10k: create a chip revision whitelist") +Fixes: f8914a14623a ("ath10k: restore QCA9880-AR1A (v1) detection") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210522105822.1091848-3-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/pci.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index 463cf3f8f8a5..71878ab35b93 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -3685,8 +3685,10 @@ static int ath10k_pci_probe(struct pci_dev *pdev, + ath10k_pci_soc_read32(ar, SOC_CHIP_ID_ADDRESS); + if (bus_params.chip_id != 0xffffffff) { + if (!ath10k_pci_chip_is_supported(pdev->device, +- bus_params.chip_id)) ++ bus_params.chip_id)) { ++ ret = -ENODEV; + goto err_unsupported; ++ } + } + } + +@@ -3697,11 +3699,15 @@ static int ath10k_pci_probe(struct pci_dev *pdev, + } + + bus_params.chip_id = ath10k_pci_soc_read32(ar, SOC_CHIP_ID_ADDRESS); +- if (bus_params.chip_id == 0xffffffff) ++ if (bus_params.chip_id == 0xffffffff) { ++ ret = -ENODEV; + goto err_unsupported; ++ } + +- if (!ath10k_pci_chip_is_supported(pdev->device, bus_params.chip_id)) ++ if (!ath10k_pci_chip_is_supported(pdev->device, bus_params.chip_id)) { ++ ret = -ENODEV; + goto err_unsupported; ++ } + + ret = ath10k_core_register(ar, &bus_params); + if (ret) { +-- +2.30.2 + diff --git a/queue-5.12/ath10k-fix-an-error-code-in-ath10k_add_interface.patch b/queue-5.12/ath10k-fix-an-error-code-in-ath10k_add_interface.patch new file mode 100644 index 00000000000..5d63e1dfd10 --- /dev/null +++ b/queue-5.12/ath10k-fix-an-error-code-in-ath10k_add_interface.patch @@ -0,0 +1,43 @@ +From cf528c9e52e65de1dbe4349e5f4b4b70c32686d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 18:46:17 +0800 +Subject: ath10k: Fix an error code in ath10k_add_interface() + +From: Yang Li + +[ Upstream commit e9ca70c735ce66fc6a0e02c8b6958434f74ef8de ] + +When the code execute this if statement, the value of ret is 0. +However, we can see from the ath10k_warn() log that the value of +ret should be -EINVAL. + +Clean up smatch warning: + +drivers/net/wireless/ath/ath10k/mac.c:5596 ath10k_add_interface() warn: +missing error code 'ret' + +Reported-by: Abaci Robot +Fixes: ccec9038c721 ("ath10k: enable raw encap mode and software crypto engine") +Signed-off-by: Yang Li +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1621939577-62218-1-git-send-email-yang.lee@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index bb6c5ee43ac0..def52df829d4 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -5590,6 +5590,7 @@ static int ath10k_add_interface(struct ieee80211_hw *hw, + + if (arvif->nohwcrypt && + !test_bit(ATH10K_FLAG_RAW_MODE, &ar->dev_flags)) { ++ ret = -EINVAL; + ath10k_warn(ar, "cryptmode module param needed for sw crypto\n"); + goto err; + } +-- +2.30.2 + diff --git a/queue-5.12/ath10k-go-to-path-err_unsupported-when-chip-id-is-no.patch b/queue-5.12/ath10k-go-to-path-err_unsupported-when-chip-id-is-no.patch new file mode 100644 index 00000000000..980e070a4d9 --- /dev/null +++ b/queue-5.12/ath10k-go-to-path-err_unsupported-when-chip-id-is-no.patch @@ -0,0 +1,37 @@ +From 4b2b7181b21a34628d3ef5ce30f2d40e7ae58d17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 May 2021 17:41:28 +0300 +Subject: ath10k: go to path err_unsupported when chip id is not supported + +From: Yang Yingliang + +[ Upstream commit 9e88dd431d2345acdb7a549f3e88aaf4c2a307a1 ] + +When chip id is not supported, it go to path err_unsupported +to print the error message. + +Fixes: f8914a14623a ("ath10k: restore QCA9880-AR1A (v1) detection") +Signed-off-by: Yang Yingliang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210522105822.1091848-2-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c +index e7fde635e0ee..463cf3f8f8a5 100644 +--- a/drivers/net/wireless/ath/ath10k/pci.c ++++ b/drivers/net/wireless/ath/ath10k/pci.c +@@ -3701,7 +3701,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev, + goto err_unsupported; + + if (!ath10k_pci_chip_is_supported(pdev->device, bus_params.chip_id)) +- goto err_free_irq; ++ goto err_unsupported; + + ret = ath10k_core_register(ar, &bus_params); + if (ret) { +-- +2.30.2 + diff --git a/queue-5.12/ath11k-fix-an-error-handling-path-in-ath11k_core_fet.patch b/queue-5.12/ath11k-fix-an-error-handling-path-in-ath11k_core_fet.patch new file mode 100644 index 00000000000..916d985f59c --- /dev/null +++ b/queue-5.12/ath11k-fix-an-error-handling-path-in-ath11k_core_fet.patch @@ -0,0 +1,40 @@ +From 94ed8f4cf6b92a1c43582f7897feb5416a41bac9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 May 2021 11:50:54 +0200 +Subject: ath11k: Fix an error handling path in + ath11k_core_fetch_board_data_api_n() + +From: Christophe JAILLET + +[ Upstream commit 515bda1d1e51c64edf2a384a58801f85a80a3f2d ] + +All error paths but this one 'goto err' in order to release some +resources. +Fix this. + +Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") +Signed-off-by: Christophe JAILLET +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/e959eb544f3cb04258507d8e25a6f12eab126bde.1621676864.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath11k/core.c b/drivers/net/wireless/ath/ath11k/core.c +index 350b7913622c..b55b6289eeb1 100644 +--- a/drivers/net/wireless/ath/ath11k/core.c ++++ b/drivers/net/wireless/ath/ath11k/core.c +@@ -445,7 +445,8 @@ static int ath11k_core_fetch_board_data_api_n(struct ath11k_base *ab, + if (len < ALIGN(ie_len, 4)) { + ath11k_err(ab, "invalid length for board ie_id %d ie_len %zu len %zu\n", + ie_id, ie_len, len); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err; + } + + switch (ie_id) { +-- +2.30.2 + diff --git a/queue-5.12/ath11k-send-beacon-template-after-vdev_start-restart.patch b/queue-5.12/ath11k-send-beacon-template-after-vdev_start-restart.patch new file mode 100644 index 00000000000..3a6cae662ef --- /dev/null +++ b/queue-5.12/ath11k-send-beacon-template-after-vdev_start-restart.patch @@ -0,0 +1,63 @@ +From fa3e4b6160db3109b324610b8f9e38bb20f6b887 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 15:30:28 +0200 +Subject: ath11k: send beacon template after vdev_start/restart during csa + +From: Seevalamuthu Mariappan + +[ Upstream commit 979ebc54cf13bd1e3eb6e21766d208d5de984fb8 ] + +Firmware has added assert if beacon template is received after +vdev_down. Firmware expects beacon template after vdev_start +and before vdev_up. This change is needed to support MBSSID EMA +cases in firmware. + +Hence, Change the sequence in ath11k as expected from firmware. +This new change is not causing any issues with older +firmware. + +Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1.r3-00011-QCAHKSWPL_SILICONZ-1 +Tested-on: IPQ8074 hw2.0 AHB WLAN.HK.2.5.0.1.r4-00008-QCAHKSWPL_SILICONZ-1 + +Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") +Signed-off-by: Seevalamuthu Mariappan +[sven@narfation.org: added tested-on/fixes information] +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210525133028.2805615-1-sven@narfation.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mac.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index 7ad0383affcb..a0e7bc6dd8c7 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -5311,11 +5311,6 @@ ath11k_mac_update_vif_chan(struct ath11k *ar, + if (WARN_ON(!arvif->is_up)) + continue; + +- ret = ath11k_mac_setup_bcn_tmpl(arvif); +- if (ret) +- ath11k_warn(ab, "failed to update bcn tmpl during csa: %d\n", +- ret); +- + ret = ath11k_mac_vdev_restart(arvif, &vifs[i].new_ctx->def); + if (ret) { + ath11k_warn(ab, "failed to restart vdev %d: %d\n", +@@ -5323,6 +5318,11 @@ ath11k_mac_update_vif_chan(struct ath11k *ar, + continue; + } + ++ ret = ath11k_mac_setup_bcn_tmpl(arvif); ++ if (ret) ++ ath11k_warn(ab, "failed to update bcn tmpl during csa: %d\n", ++ ret); ++ + ret = ath11k_wmi_vdev_up(arvif->ar, arvif->vdev_id, arvif->aid, + arvif->bssid); + if (ret) { +-- +2.30.2 + diff --git a/queue-5.12/backlight-lm3630a_bl-put-fwnode-in-error-case-during.patch b/queue-5.12/backlight-lm3630a_bl-put-fwnode-in-error-case-during.patch new file mode 100644 index 00000000000..5eeb5d978b6 --- /dev/null +++ b/queue-5.12/backlight-lm3630a_bl-put-fwnode-in-error-case-during.patch @@ -0,0 +1,43 @@ +From 86ad4f33706c1f2f56b12d307d6f6ef0ec6d727d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 12:57:16 +0300 +Subject: backlight: lm3630a_bl: Put fwnode in error case during ->probe() + +From: Andy Shevchenko + +[ Upstream commit 6d1c32dbedd7d7e7372aa38033ec8782c39f6379 ] + +device_for_each_child_node() bumps a reference counting of a returned variable. +We have to balance it whenever we return to the caller. + +Cc: Brian Masney +Cc: Dan Murphy +Fixes: 8fbce8efe15cd ("backlight: lm3630a: Add firmware node support") +Signed-off-by: Andy Shevchenko +Reviewed-by: Brian Masney +Reviewed-by: Daniel Thompson +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/lm3630a_bl.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c +index e88a2b0e5904..662029d6a3dc 100644 +--- a/drivers/video/backlight/lm3630a_bl.c ++++ b/drivers/video/backlight/lm3630a_bl.c +@@ -482,8 +482,10 @@ static int lm3630a_parse_node(struct lm3630a_chip *pchip, + + device_for_each_child_node(pchip->dev, node) { + ret = lm3630a_parse_bank(pdata, node, &seen_led_sources); +- if (ret) ++ if (ret) { ++ fwnode_handle_put(node); + return ret; ++ } + } + + return ret; +-- +2.30.2 + diff --git a/queue-5.12/bfq-remove-merged-request-already-in-bfq_requests_me.patch b/queue-5.12/bfq-remove-merged-request-already-in-bfq_requests_me.patch new file mode 100644 index 00000000000..77c9d2d3d87 --- /dev/null +++ b/queue-5.12/bfq-remove-merged-request-already-in-bfq_requests_me.patch @@ -0,0 +1,111 @@ +From 1ccb42d3d65a81a95c1d2d730aea9eabc180210b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 11:36:33 +0200 +Subject: bfq: Remove merged request already in bfq_requests_merged() + +From: Jan Kara + +[ Upstream commit a921c655f2033dd1ce1379128efe881dda23ea37 ] + +Currently, bfq does very little in bfq_requests_merged() and handles all +the request cleanup in bfq_finish_requeue_request() called from +blk_mq_free_request(). That is currently safe only because +blk_mq_free_request() is called shortly after bfq_requests_merged() +while bfqd->lock is still held. However to fix a lock inversion between +bfqd->lock and ioc->lock, we need to call blk_mq_free_request() after +dropping bfqd->lock. That would mean that already merged request could +be seen by other processes inside bfq queues and possibly dispatched to +the device which is wrong. So move cleanup of the request from +bfq_finish_requeue_request() to bfq_requests_merged(). + +Acked-by: Paolo Valente +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20210623093634.27879-2-jack@suse.cz +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 41 +++++++++++++---------------------------- + 1 file changed, 13 insertions(+), 28 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index bc319931d2b3..9a180c4b9605 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2376,7 +2376,7 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, + *next_bfqq = bfq_init_rq(next); + + if (!bfqq) +- return; ++ goto remove; + + /* + * If next and rq belong to the same bfq_queue and next is older +@@ -2399,6 +2399,14 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, + bfqq->next_rq = rq; + + bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags); ++remove: ++ /* Merged request may be in the IO scheduler. Remove it. */ ++ if (!RB_EMPTY_NODE(&next->rb_node)) { ++ bfq_remove_request(next->q, next); ++ if (next_bfqq) ++ bfqg_stats_update_io_remove(bfqq_group(next_bfqq), ++ next->cmd_flags); ++ } + } + + /* Must be called with bfqq != NULL */ +@@ -6015,6 +6023,7 @@ static void bfq_finish_requeue_request(struct request *rq) + { + struct bfq_queue *bfqq = RQ_BFQQ(rq); + struct bfq_data *bfqd; ++ unsigned long flags; + + /* + * rq either is not associated with any icq, or is an already +@@ -6032,39 +6041,15 @@ static void bfq_finish_requeue_request(struct request *rq) + rq->io_start_time_ns, + rq->cmd_flags); + ++ spin_lock_irqsave(&bfqd->lock, flags); + if (likely(rq->rq_flags & RQF_STARTED)) { +- unsigned long flags; +- +- spin_lock_irqsave(&bfqd->lock, flags); +- + if (rq == bfqd->waited_rq) + bfq_update_inject_limit(bfqd, bfqq); + + bfq_completed_request(bfqq, bfqd); +- bfq_finish_requeue_request_body(bfqq); +- +- spin_unlock_irqrestore(&bfqd->lock, flags); +- } else { +- /* +- * Request rq may be still/already in the scheduler, +- * in which case we need to remove it (this should +- * never happen in case of requeue). And we cannot +- * defer such a check and removal, to avoid +- * inconsistencies in the time interval from the end +- * of this function to the start of the deferred work. +- * This situation seems to occur only in process +- * context, as a consequence of a merge. In the +- * current version of the code, this implies that the +- * lock is held. +- */ +- +- if (!RB_EMPTY_NODE(&rq->rb_node)) { +- bfq_remove_request(rq->q, rq); +- bfqg_stats_update_io_remove(bfqq_group(bfqq), +- rq->cmd_flags); +- } +- bfq_finish_requeue_request_body(bfqq); + } ++ bfq_finish_requeue_request_body(bfqq); ++ spin_unlock_irqrestore(&bfqd->lock, flags); + + /* + * Reset private fields. In case of a requeue, this allows +-- +2.30.2 + diff --git a/queue-5.12/blk-mq-clear-stale-request-in-tags-rq-before-freeing.patch b/queue-5.12/blk-mq-clear-stale-request-in-tags-rq-before-freeing.patch new file mode 100644 index 00000000000..62c153141f4 --- /dev/null +++ b/queue-5.12/blk-mq-clear-stale-request-in-tags-rq-before-freeing.patch @@ -0,0 +1,162 @@ +From 1c2a17e955b4b9fac8dbecb0fd2b7b235984bfed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 23:22:35 +0800 +Subject: blk-mq: clear stale request in tags->rq[] before freeing one request + pool + +From: Ming Lei + +[ Upstream commit bd63141d585bef14f4caf111f6d0e27fe2300ec6 ] + +refcount_inc_not_zero() in bt_tags_iter() still may read one freed +request. + +Fix the issue by the following approach: + +1) hold a per-tags spinlock when reading ->rqs[tag] and calling +refcount_inc_not_zero in bt_tags_iter() + +2) clearing stale request referred via ->rqs[tag] before freeing +request pool, the per-tags spinlock is held for clearing stale +->rq[tag] + +So after we cleared stale requests, bt_tags_iter() won't observe +freed request any more, also the clearing will wait for pending +request reference. + +The idea of clearing ->rqs[] is borrowed from John Garry's previous +patch and one recent David's patch. + +Tested-by: John Garry +Reviewed-by: David Jeffery +Reviewed-by: Bart Van Assche +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20210511152236.763464-4-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-tag.c | 9 +++++++-- + block/blk-mq-tag.h | 6 ++++++ + block/blk-mq.c | 46 +++++++++++++++++++++++++++++++++++++++++----- + 3 files changed, 54 insertions(+), 7 deletions(-) + +diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c +index 6772c3728865..c4f2f6c123ae 100644 +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -202,10 +202,14 @@ struct bt_iter_data { + static struct request *blk_mq_find_and_get_req(struct blk_mq_tags *tags, + unsigned int bitnr) + { +- struct request *rq = tags->rqs[bitnr]; ++ struct request *rq; ++ unsigned long flags; + ++ spin_lock_irqsave(&tags->lock, flags); ++ rq = tags->rqs[bitnr]; + if (!rq || !refcount_inc_not_zero(&rq->ref)) +- return NULL; ++ rq = NULL; ++ spin_unlock_irqrestore(&tags->lock, flags); + return rq; + } + +@@ -538,6 +542,7 @@ struct blk_mq_tags *blk_mq_init_tags(unsigned int total_tags, + + tags->nr_tags = total_tags; + tags->nr_reserved_tags = reserved_tags; ++ spin_lock_init(&tags->lock); + + if (flags & BLK_MQ_F_TAG_HCTX_SHARED) + return tags; +diff --git a/block/blk-mq-tag.h b/block/blk-mq-tag.h +index 7d3e6b333a4a..f887988e5ef6 100644 +--- a/block/blk-mq-tag.h ++++ b/block/blk-mq-tag.h +@@ -20,6 +20,12 @@ struct blk_mq_tags { + struct request **rqs; + struct request **static_rqs; + struct list_head page_list; ++ ++ /* ++ * used to clear request reference in rqs[] before freeing one ++ * request pool ++ */ ++ spinlock_t lock; + }; + + extern struct blk_mq_tags *blk_mq_init_tags(unsigned int nr_tags, +diff --git a/block/blk-mq.c b/block/blk-mq.c +index d5370ab2eb31..d06ff908f3d9 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -2291,6 +2291,45 @@ queue_exit: + return BLK_QC_T_NONE; + } + ++static size_t order_to_size(unsigned int order) ++{ ++ return (size_t)PAGE_SIZE << order; ++} ++ ++/* called before freeing request pool in @tags */ ++static void blk_mq_clear_rq_mapping(struct blk_mq_tag_set *set, ++ struct blk_mq_tags *tags, unsigned int hctx_idx) ++{ ++ struct blk_mq_tags *drv_tags = set->tags[hctx_idx]; ++ struct page *page; ++ unsigned long flags; ++ ++ list_for_each_entry(page, &tags->page_list, lru) { ++ unsigned long start = (unsigned long)page_address(page); ++ unsigned long end = start + order_to_size(page->private); ++ int i; ++ ++ for (i = 0; i < set->queue_depth; i++) { ++ struct request *rq = drv_tags->rqs[i]; ++ unsigned long rq_addr = (unsigned long)rq; ++ ++ if (rq_addr >= start && rq_addr < end) { ++ WARN_ON_ONCE(refcount_read(&rq->ref) != 0); ++ cmpxchg(&drv_tags->rqs[i], rq, NULL); ++ } ++ } ++ } ++ ++ /* ++ * Wait until all pending iteration is done. ++ * ++ * Request reference is cleared and it is guaranteed to be observed ++ * after the ->lock is released. ++ */ ++ spin_lock_irqsave(&drv_tags->lock, flags); ++ spin_unlock_irqrestore(&drv_tags->lock, flags); ++} ++ + void blk_mq_free_rqs(struct blk_mq_tag_set *set, struct blk_mq_tags *tags, + unsigned int hctx_idx) + { +@@ -2309,6 +2348,8 @@ void blk_mq_free_rqs(struct blk_mq_tag_set *set, struct blk_mq_tags *tags, + } + } + ++ blk_mq_clear_rq_mapping(set, tags, hctx_idx); ++ + while (!list_empty(&tags->page_list)) { + page = list_first_entry(&tags->page_list, struct page, lru); + list_del_init(&page->lru); +@@ -2368,11 +2409,6 @@ struct blk_mq_tags *blk_mq_alloc_rq_map(struct blk_mq_tag_set *set, + return tags; + } + +-static size_t order_to_size(unsigned int order) +-{ +- return (size_t)PAGE_SIZE << order; +-} +- + static int blk_mq_init_request(struct blk_mq_tag_set *set, struct request *rq, + unsigned int hctx_idx, int node) + { +-- +2.30.2 + diff --git a/queue-5.12/blk-mq-grab-rq-refcount-before-calling-fn-in-blk_mq_.patch b/queue-5.12/blk-mq-grab-rq-refcount-before-calling-fn-in-blk_mq_.patch new file mode 100644 index 00000000000..e89b1aced09 --- /dev/null +++ b/queue-5.12/blk-mq-grab-rq-refcount-before-calling-fn-in-blk_mq_.patch @@ -0,0 +1,180 @@ +From 26f8d3c6818cd73057be9f5b46c766ad691108ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 23:22:34 +0800 +Subject: blk-mq: grab rq->refcount before calling ->fn in + blk_mq_tagset_busy_iter + +From: Ming Lei + +[ Upstream commit 2e315dc07df009c3e29d6926871f62a30cfae394 ] + +Grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter(), and +this way will prevent the request from being re-used when ->fn is +running. The approach is same as what we do during handling timeout. + +Fix request use-after-free(UAF) related with completion race or queue +releasing: + +- If one rq is referred before rq->q is frozen, then queue won't be +frozen before the request is released during iteration. + +- If one rq is referred after rq->q is frozen, refcount_inc_not_zero() +will return false, and we won't iterate over this request. + +However, still one request UAF not covered: refcount_inc_not_zero() may +read one freed request, and it will be handled in next patch. + +Tested-by: John Garry +Reviewed-by: Christoph Hellwig +Reviewed-by: Bart Van Assche +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20210511152236.763464-3-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-tag.c | 44 +++++++++++++++++++++++++++++++++----------- + block/blk-mq.c | 14 +++++++++----- + block/blk-mq.h | 1 + + 3 files changed, 43 insertions(+), 16 deletions(-) + +diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c +index 9c92053e704d..6772c3728865 100644 +--- a/block/blk-mq-tag.c ++++ b/block/blk-mq-tag.c +@@ -199,6 +199,16 @@ struct bt_iter_data { + bool reserved; + }; + ++static struct request *blk_mq_find_and_get_req(struct blk_mq_tags *tags, ++ unsigned int bitnr) ++{ ++ struct request *rq = tags->rqs[bitnr]; ++ ++ if (!rq || !refcount_inc_not_zero(&rq->ref)) ++ return NULL; ++ return rq; ++} ++ + static bool bt_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data) + { + struct bt_iter_data *iter_data = data; +@@ -206,18 +216,22 @@ static bool bt_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data) + struct blk_mq_tags *tags = hctx->tags; + bool reserved = iter_data->reserved; + struct request *rq; ++ bool ret = true; + + if (!reserved) + bitnr += tags->nr_reserved_tags; +- rq = tags->rqs[bitnr]; +- + /* + * We can hit rq == NULL here, because the tagging functions + * test and set the bit before assigning ->rqs[]. + */ +- if (rq && rq->q == hctx->queue && rq->mq_hctx == hctx) +- return iter_data->fn(hctx, rq, iter_data->data, reserved); +- return true; ++ rq = blk_mq_find_and_get_req(tags, bitnr); ++ if (!rq) ++ return true; ++ ++ if (rq->q == hctx->queue && rq->mq_hctx == hctx) ++ ret = iter_data->fn(hctx, rq, iter_data->data, reserved); ++ blk_mq_put_rq_ref(rq); ++ return ret; + } + + /** +@@ -264,6 +278,8 @@ static bool bt_tags_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data) + struct blk_mq_tags *tags = iter_data->tags; + bool reserved = iter_data->flags & BT_TAG_ITER_RESERVED; + struct request *rq; ++ bool ret = true; ++ bool iter_static_rqs = !!(iter_data->flags & BT_TAG_ITER_STATIC_RQS); + + if (!reserved) + bitnr += tags->nr_reserved_tags; +@@ -272,16 +288,19 @@ static bool bt_tags_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data) + * We can hit rq == NULL here, because the tagging functions + * test and set the bit before assigning ->rqs[]. + */ +- if (iter_data->flags & BT_TAG_ITER_STATIC_RQS) ++ if (iter_static_rqs) + rq = tags->static_rqs[bitnr]; + else +- rq = tags->rqs[bitnr]; ++ rq = blk_mq_find_and_get_req(tags, bitnr); + if (!rq) + return true; +- if ((iter_data->flags & BT_TAG_ITER_STARTED) && +- !blk_mq_request_started(rq)) +- return true; +- return iter_data->fn(rq, iter_data->data, reserved); ++ ++ if (!(iter_data->flags & BT_TAG_ITER_STARTED) || ++ blk_mq_request_started(rq)) ++ ret = iter_data->fn(rq, iter_data->data, reserved); ++ if (!iter_static_rqs) ++ blk_mq_put_rq_ref(rq); ++ return ret; + } + + /** +@@ -348,6 +367,9 @@ void blk_mq_all_tag_iter(struct blk_mq_tags *tags, busy_tag_iter_fn *fn, + * indicates whether or not @rq is a reserved request. Return + * true to continue iterating tags, false to stop. + * @priv: Will be passed as second argument to @fn. ++ * ++ * We grab one request reference before calling @fn and release it after ++ * @fn returns. + */ + void blk_mq_tagset_busy_iter(struct blk_mq_tag_set *tagset, + busy_tag_iter_fn *fn, void *priv) +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 0e120547ccb7..d5370ab2eb31 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -908,6 +908,14 @@ static bool blk_mq_req_expired(struct request *rq, unsigned long *next) + return false; + } + ++void blk_mq_put_rq_ref(struct request *rq) ++{ ++ if (is_flush_rq(rq, rq->mq_hctx)) ++ rq->end_io(rq, 0); ++ else if (refcount_dec_and_test(&rq->ref)) ++ __blk_mq_free_request(rq); ++} ++ + static bool blk_mq_check_expired(struct blk_mq_hw_ctx *hctx, + struct request *rq, void *priv, bool reserved) + { +@@ -941,11 +949,7 @@ static bool blk_mq_check_expired(struct blk_mq_hw_ctx *hctx, + if (blk_mq_req_expired(rq, next)) + blk_mq_rq_timed_out(rq, reserved); + +- if (is_flush_rq(rq, hctx)) +- rq->end_io(rq, 0); +- else if (refcount_dec_and_test(&rq->ref)) +- __blk_mq_free_request(rq); +- ++ blk_mq_put_rq_ref(rq); + return true; + } + +diff --git a/block/blk-mq.h b/block/blk-mq.h +index 3616453ca28c..143afe42c63a 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -47,6 +47,7 @@ void blk_mq_add_to_requeue_list(struct request *rq, bool at_head, + void blk_mq_flush_busy_ctxs(struct blk_mq_hw_ctx *hctx, struct list_head *list); + struct request *blk_mq_dequeue_from_ctx(struct blk_mq_hw_ctx *hctx, + struct blk_mq_ctx *start); ++void blk_mq_put_rq_ref(struct request *rq); + + /* + * Internal helpers for allocating/freeing the request map +-- +2.30.2 + diff --git a/queue-5.12/blk-mq-update-hctx-dispatch_busy-in-case-of-real-sch.patch b/queue-5.12/blk-mq-update-hctx-dispatch_busy-in-case-of-real-sch.patch new file mode 100644 index 00000000000..7c0e9f08065 --- /dev/null +++ b/queue-5.12/blk-mq-update-hctx-dispatch_busy-in-case-of-real-sch.patch @@ -0,0 +1,44 @@ +From 07f3842c77b61af62f3c72823fb04bb39b2dd0ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 10:02:48 +0800 +Subject: blk-mq: update hctx->dispatch_busy in case of real scheduler + +From: Ming Lei + +[ Upstream commit cb9516be7708a2a18ec0a19fe3a225b5b3bc92c7 ] + +Commit 6e6fcbc27e77 ("blk-mq: support batching dispatch in case of io") +starts to support io batching submission by using hctx->dispatch_busy. + +However, blk_mq_update_dispatch_busy() isn't changed to update hctx->dispatch_busy +in that commit, so fix the issue by updating hctx->dispatch_busy in case +of real scheduler. + +Reported-by: Jan Kara +Reviewed-by: Jan Kara +Fixes: 6e6fcbc27e77 ("blk-mq: support batching dispatch in case of io") +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20210625020248.1630497-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index d06ff908f3d9..6a982a277176 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1223,9 +1223,6 @@ static void blk_mq_update_dispatch_busy(struct blk_mq_hw_ctx *hctx, bool busy) + { + unsigned int ewma; + +- if (hctx->queue->elevator) +- return; +- + ewma = hctx->dispatch_busy; + + if (!ewma && !busy) +-- +2.30.2 + diff --git a/queue-5.12/blk-wbt-introduce-a-new-disable-state-to-prevent-fal.patch b/queue-5.12/blk-wbt-introduce-a-new-disable-state-to-prevent-fal.patch new file mode 100644 index 00000000000..57df07d102f --- /dev/null +++ b/queue-5.12/blk-wbt-introduce-a-new-disable-state-to-prevent-fal.patch @@ -0,0 +1,66 @@ +From b4b83f93e5851f2abdda818b5de76a7a4fba244c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 17:36:59 +0800 +Subject: blk-wbt: introduce a new disable state to prevent false positive by + rwb_enabled() + +From: Zhang Yi + +[ Upstream commit 1d0903d61e9645c6330b94247b96dd873dfc11c8 ] + +Now that we disable wbt by simply zero out rwb->wb_normal in +wbt_disable_default() when switch elevator to bfq, but it's not safe +because it will become false positive if we change queue depth. If it +become false positive between wbt_wait() and wbt_track() when submit +write request, it will lead to drop rqw->inflight to -1 in wbt_done(), +which will end up trigger IO hung. Fix this issue by introduce a new +state which mean the wbt was disabled. + +Fixes: a79050434b45 ("blk-rq-qos: refactor out common elements of blk-wbt") +Signed-off-by: Zhang Yi +Link: https://lore.kernel.org/r/20210619093700.920393-2-yi.zhang@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-wbt.c | 5 +++-- + block/blk-wbt.h | 1 + + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/block/blk-wbt.c b/block/blk-wbt.c +index 42aed0160f86..b098ac6a84f0 100644 +--- a/block/blk-wbt.c ++++ b/block/blk-wbt.c +@@ -77,7 +77,8 @@ enum { + + static inline bool rwb_enabled(struct rq_wb *rwb) + { +- return rwb && rwb->wb_normal != 0; ++ return rwb && rwb->enable_state != WBT_STATE_OFF_DEFAULT && ++ rwb->wb_normal != 0; + } + + static void wb_timestamp(struct rq_wb *rwb, unsigned long *var) +@@ -702,7 +703,7 @@ void wbt_disable_default(struct request_queue *q) + rwb = RQWB(rqos); + if (rwb->enable_state == WBT_STATE_ON_DEFAULT) { + blk_stat_deactivate(rwb->cb); +- rwb->wb_normal = 0; ++ rwb->enable_state = WBT_STATE_OFF_DEFAULT; + } + } + EXPORT_SYMBOL_GPL(wbt_disable_default); +diff --git a/block/blk-wbt.h b/block/blk-wbt.h +index 16bdc85b8df9..2eb01becde8c 100644 +--- a/block/blk-wbt.h ++++ b/block/blk-wbt.h +@@ -34,6 +34,7 @@ enum { + enum { + WBT_STATE_ON_DEFAULT = 1, + WBT_STATE_ON_MANUAL = 2, ++ WBT_STATE_OFF_DEFAULT + }; + + struct rq_wb { +-- +2.30.2 + diff --git a/queue-5.12/blk-wbt-make-sure-throttle-is-enabled-properly.patch b/queue-5.12/blk-wbt-make-sure-throttle-is-enabled-properly.patch new file mode 100644 index 00000000000..bbf87c3e88c --- /dev/null +++ b/queue-5.12/blk-wbt-make-sure-throttle-is-enabled-properly.patch @@ -0,0 +1,45 @@ +From 48de6e99e736feb9aa1209a5188ff44ecf58f0b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 17:37:00 +0800 +Subject: blk-wbt: make sure throttle is enabled properly + +From: Zhang Yi + +[ Upstream commit 76a8040817b4b9c69b53f9b326987fa891b4082a ] + +After commit a79050434b45 ("blk-rq-qos: refactor out common elements of +blk-wbt"), if throttle was disabled by wbt_disable_default(), we could +not enable again, fix this by set enable_state back to +WBT_STATE_ON_DEFAULT. + +Fixes: a79050434b45 ("blk-rq-qos: refactor out common elements of blk-wbt") +Signed-off-by: Zhang Yi +Link: https://lore.kernel.org/r/20210619093700.920393-3-yi.zhang@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-wbt.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/block/blk-wbt.c b/block/blk-wbt.c +index b098ac6a84f0..f5e5ac915bf7 100644 +--- a/block/blk-wbt.c ++++ b/block/blk-wbt.c +@@ -637,9 +637,13 @@ void wbt_set_write_cache(struct request_queue *q, bool write_cache_on) + void wbt_enable_default(struct request_queue *q) + { + struct rq_qos *rqos = wbt_rq_qos(q); ++ + /* Throttling already enabled? */ +- if (rqos) ++ if (rqos) { ++ if (RQWB(rqos)->enable_state == WBT_STATE_OFF_DEFAULT) ++ RQWB(rqos)->enable_state = WBT_STATE_ON_DEFAULT; + return; ++ } + + /* Queue not registered? Maybe shutting down... */ + if (!blk_queue_registered(q)) +-- +2.30.2 + diff --git a/queue-5.12/block-avoid-double-io-accounting-for-flush-request.patch b/queue-5.12/block-avoid-double-io-accounting-for-flush-request.patch new file mode 100644 index 00000000000..e102f408414 --- /dev/null +++ b/queue-5.12/block-avoid-double-io-accounting-for-flush-request.patch @@ -0,0 +1,52 @@ +From 6fed392d354def34123b201097624ce30a744b2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 23:22:33 +0800 +Subject: block: avoid double io accounting for flush request + +From: Ming Lei + +[ Upstream commit 84da7acc3ba53af26f15c4b0ada446127b7a7836 ] + +For flush request, rq->end_io() may be called two times, one is from +timeout handling(blk_mq_check_expired()), another is from normal +completion(__blk_mq_end_request()). + +Move blk_account_io_flush() after flush_rq->ref drops to zero, so +io accounting can be done just once for flush request. + +Fixes: b68663186577 ("block: add iostat counters for flush requests") +Reviewed-by: Bart Van Assche +Reviewed-by: Christoph Hellwig +Tested-by: John Garry +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20210511152236.763464-2-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-flush.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/block/blk-flush.c b/block/blk-flush.c +index 7942ca6ed321..1002f6c58181 100644 +--- a/block/blk-flush.c ++++ b/block/blk-flush.c +@@ -219,8 +219,6 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error) + unsigned long flags = 0; + struct blk_flush_queue *fq = blk_get_flush_queue(q, flush_rq->mq_ctx); + +- blk_account_io_flush(flush_rq); +- + /* release the tag's ownership to the req cloned from */ + spin_lock_irqsave(&fq->mq_flush_lock, flags); + +@@ -230,6 +228,7 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error) + return; + } + ++ blk_account_io_flush(flush_rq); + /* + * Flush request has to be marked as IDLE when it is really ended + * because its .end_io() is called from timeout code path too for +-- +2.30.2 + diff --git a/queue-5.12/block-fix-discard-request-merge.patch b/queue-5.12/block-fix-discard-request-merge.patch new file mode 100644 index 00000000000..94a1919cc4c --- /dev/null +++ b/queue-5.12/block-fix-discard-request-merge.patch @@ -0,0 +1,58 @@ +From 177b0463209352160de251b4bc855e3206d410ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 10:33:12 +0800 +Subject: block: fix discard request merge + +From: Ming Lei + +[ Upstream commit 2705dfb2094777e405e065105e307074af8965c1 ] + +ll_new_hw_segment() is reached only in case of single range discard +merge, and we don't have max discard segment size limit actually, so +it is wrong to run the following check: + +if (req->nr_phys_segments + nr_phys_segs > blk_rq_get_max_segments(req)) + +it may be always false since req->nr_phys_segments is initialized as +one, and bio's segment count is still 1, blk_rq_get_max_segments(reg) +is 1 too. + +Fix the issue by not doing the check and bypassing the calculation of +discard request's nr_phys_segments. + +Based on analysis from Wang Shanker. + +Cc: Christoph Hellwig +Reported-by: Wang Shanker +Signed-off-by: Ming Lei +Link: https://lore.kernel.org/r/20210628023312.1903255-1-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-merge.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 4d97fb6dd226..bcdff1879c34 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -559,10 +559,14 @@ static inline unsigned int blk_rq_get_max_segments(struct request *rq) + static inline int ll_new_hw_segment(struct request *req, struct bio *bio, + unsigned int nr_phys_segs) + { +- if (req->nr_phys_segments + nr_phys_segs > blk_rq_get_max_segments(req)) ++ if (blk_integrity_merge_bio(req->q, req, bio) == false) + goto no_merge; + +- if (blk_integrity_merge_bio(req->q, req, bio) == false) ++ /* discard request merge won't add new segment */ ++ if (req_op(req) == REQ_OP_DISCARD) ++ return 1; ++ ++ if (req->nr_phys_segments + nr_phys_segs > blk_rq_get_max_segments(req)) + goto no_merge; + + /* +-- +2.30.2 + diff --git a/queue-5.12/block-fix-race-between-adding-removing-rq-qos-and-no.patch b/queue-5.12/block-fix-race-between-adding-removing-rq-qos-and-no.patch new file mode 100644 index 00000000000..333857e35f0 --- /dev/null +++ b/queue-5.12/block-fix-race-between-adding-removing-rq-qos-and-no.patch @@ -0,0 +1,113 @@ +From 9d5ee2abc35d49645ba5046c69e4804a5a3d144a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jun 2021 09:58:21 +0800 +Subject: block: fix race between adding/removing rq qos and normal IO + +From: Ming Lei + +[ Upstream commit 2cafe29a8d03f02a3d16193bdaae2f3e82a423f9 ] + +Yi reported several kernel panics on: + +[16687.001777] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 +... +[16687.163549] pc : __rq_qos_track+0x38/0x60 + +or + +[ 997.690455] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000020 +... +[ 997.850347] pc : __rq_qos_done+0x2c/0x50 + +Turns out it is caused by race between adding rq qos(wbt) and normal IO +because rq_qos_add can be run when IO is being submitted, fix this issue +by freezing queue before adding/deleting rq qos to queue. + +rq_qos_exit() needn't to freeze queue because it is called after queue +has been frozen. + +iolatency calls rq_qos_add() during allocating queue, so freezing won't +add delay because queue usage refcount works at atomic mode at that +time. + +iocost calls rq_qos_add() when writing cgroup attribute file, that is +fine to freeze queue at that time since we usually freeze queue when +storing to queue sysfs attribute, meantime iocost only exists on the +root cgroup. + +wbt_init calls it in blk_register_queue() and queue sysfs attribute +store(queue_wb_lat_store() when write it 1st time in case of !BLK_WBT_MQ), +the following patch will speedup the queue freezing in wbt_init. + +Reported-by: Yi Zhang +Cc: Bart Van Assche +Signed-off-by: Ming Lei +Reviewed-by: Bart Van Assche +Tested-by: Yi Zhang +Link: https://lore.kernel.org/r/20210609015822.103433-2-ming.lei@redhat.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-rq-qos.h | 24 ++++++++++++++++++++++++ + 1 file changed, 24 insertions(+) + +diff --git a/block/blk-rq-qos.h b/block/blk-rq-qos.h +index 2bc43e94f4c4..2bcb3495e376 100644 +--- a/block/blk-rq-qos.h ++++ b/block/blk-rq-qos.h +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + + #include "blk-mq-debugfs.h" + +@@ -99,8 +100,21 @@ static inline void rq_wait_init(struct rq_wait *rq_wait) + + static inline void rq_qos_add(struct request_queue *q, struct rq_qos *rqos) + { ++ /* ++ * No IO can be in-flight when adding rqos, so freeze queue, which ++ * is fine since we only support rq_qos for blk-mq queue. ++ * ++ * Reuse ->queue_lock for protecting against other concurrent ++ * rq_qos adding/deleting ++ */ ++ blk_mq_freeze_queue(q); ++ ++ spin_lock_irq(&q->queue_lock); + rqos->next = q->rq_qos; + q->rq_qos = rqos; ++ spin_unlock_irq(&q->queue_lock); ++ ++ blk_mq_unfreeze_queue(q); + + if (rqos->ops->debugfs_attrs) + blk_mq_debugfs_register_rqos(rqos); +@@ -110,12 +124,22 @@ static inline void rq_qos_del(struct request_queue *q, struct rq_qos *rqos) + { + struct rq_qos **cur; + ++ /* ++ * See comment in rq_qos_add() about freezing queue & using ++ * ->queue_lock. ++ */ ++ blk_mq_freeze_queue(q); ++ ++ spin_lock_irq(&q->queue_lock); + for (cur = &q->rq_qos; *cur; cur = &(*cur)->next) { + if (*cur == rqos) { + *cur = rqos->next; + break; + } + } ++ spin_unlock_irq(&q->queue_lock); ++ ++ blk_mq_unfreeze_queue(q); + + blk_mq_debugfs_unregister_rqos(rqos); + } +-- +2.30.2 + diff --git a/queue-5.12/block-fix-trace-completion-for-chained-bio.patch b/queue-5.12/block-fix-trace-completion-for-chained-bio.patch new file mode 100644 index 00000000000..838b89fa74a --- /dev/null +++ b/queue-5.12/block-fix-trace-completion-for-chained-bio.patch @@ -0,0 +1,76 @@ +From a235e80dc4a45b033f03b489d0da554555f88f88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 20:30:30 +0800 +Subject: block: fix trace completion for chained bio + +From: Edward Hsieh + +[ Upstream commit 60b6a7e6a0f4382cd689f9afdac816964fec2921 ] + +For chained bio, trace_block_bio_complete in bio_endio is currently called +only by the parent bio once upon all chained bio completed. +However, the sector and size for the parent bio are modified in bio_split. +Therefore, the size and sector of the complete events might not match the +queue events in blktrace. + +The original fix of bio completion trace ("block: trace +completion of all bios.") wants multiple complete events to correspond +to one queue event but missed this. + +The issue can be reproduced by md/raid5 read with bio cross chunks. + +To fix, move trace completion into the loop for every chained bio to call. + +Fixes: fbbaf700e7b1 ("block: trace completion of all bios.") +Reviewed-by: Wade Liang +Reviewed-by: BingJing Chang +Signed-off-by: Edward Hsieh +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20210624123030.27014-1-edwardh@synology.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/block/bio.c b/block/bio.c +index 50e579088aca..b00c5a88a743 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -1412,8 +1412,7 @@ static inline bool bio_remaining_done(struct bio *bio) + * + * bio_endio() can be called several times on a bio that has been chained + * using bio_chain(). The ->bi_end_io() function will only be called the +- * last time. At this point the BLK_TA_COMPLETE tracing event will be +- * generated if BIO_TRACE_COMPLETION is set. ++ * last time. + **/ + void bio_endio(struct bio *bio) + { +@@ -1426,6 +1425,11 @@ again: + if (bio->bi_bdev) + rq_qos_done_bio(bio->bi_bdev->bd_disk->queue, bio); + ++ if (bio->bi_bdev && bio_flagged(bio, BIO_TRACE_COMPLETION)) { ++ trace_block_bio_complete(bio->bi_bdev->bd_disk->queue, bio); ++ bio_clear_flag(bio, BIO_TRACE_COMPLETION); ++ } ++ + /* + * Need to have a real endio function for chained bios, otherwise + * various corner cases will break (like stacking block devices that +@@ -1439,11 +1443,6 @@ again: + goto again; + } + +- if (bio->bi_bdev && bio_flagged(bio, BIO_TRACE_COMPLETION)) { +- trace_block_bio_complete(bio->bi_bdev->bd_disk->queue, bio); +- bio_clear_flag(bio, BIO_TRACE_COMPLETION); +- } +- + blk_throtl_bio_endio(bio); + /* release cgroup info */ + bio_uninit(bio); +-- +2.30.2 + diff --git a/queue-5.12/block_dump-remove-block_dump-feature-in-mark_inode_d.patch b/queue-5.12/block_dump-remove-block_dump-feature-in-mark_inode_d.patch new file mode 100644 index 00000000000..2939073be68 --- /dev/null +++ b/queue-5.12/block_dump-remove-block_dump-feature-in-mark_inode_d.patch @@ -0,0 +1,84 @@ +From 1269c4ee68bd6523d1465eca98e68f1158849fa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Mar 2021 11:01:44 +0800 +Subject: block_dump: remove block_dump feature in mark_inode_dirty() + +From: zhangyi (F) + +[ Upstream commit 12e0613715e1cf305fffafaf0e89d810d9a85cc0 ] + +block_dump is an old debugging interface, one of it's functions is used +to print the information about who write which file on disk. If we +enable block_dump through /proc/sys/vm/block_dump and turn on debug log +level, we can gather information about write process name, target file +name and disk from kernel message. This feature is realized in +block_dump___mark_inode_dirty(), it print above information into kernel +message directly when marking inode dirty, so it is noisy and can easily +trigger log storm. At the same time, get the dentry refcount is also not +safe, we found it will lead to deadlock on ext4 file system with +data=journal mode. + +After tracepoints has been introduced into the kernel, we got a +tracepoint in __mark_inode_dirty(), which is a better replacement of +block_dump___mark_inode_dirty(). The only downside is that it only trace +the inode number and not a file name, but it probably doesn't matter +because the original printed file name in block_dump is not accurate in +some cases, and we can still find it through the inode number and device +id. So this patch delete the dirting inode part of block_dump feature. + +Signed-off-by: zhangyi (F) +Reviewed-by: Jan Kara +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20210313030146.2882027-2-yi.zhang@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/fs-writeback.c | 25 ------------------------- + 1 file changed, 25 deletions(-) + +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index e91980f49388..7c46d1588a19 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -2205,28 +2205,6 @@ int dirtytime_interval_handler(struct ctl_table *table, int write, + return ret; + } + +-static noinline void block_dump___mark_inode_dirty(struct inode *inode) +-{ +- if (inode->i_ino || strcmp(inode->i_sb->s_id, "bdev")) { +- struct dentry *dentry; +- const char *name = "?"; +- +- dentry = d_find_alias(inode); +- if (dentry) { +- spin_lock(&dentry->d_lock); +- name = (const char *) dentry->d_name.name; +- } +- printk(KERN_DEBUG +- "%s(%d): dirtied inode %lu (%s) on %s\n", +- current->comm, task_pid_nr(current), inode->i_ino, +- name, inode->i_sb->s_id); +- if (dentry) { +- spin_unlock(&dentry->d_lock); +- dput(dentry); +- } +- } +-} +- + /** + * __mark_inode_dirty - internal function to mark an inode dirty + * +@@ -2296,9 +2274,6 @@ void __mark_inode_dirty(struct inode *inode, int flags) + (dirtytime && (inode->i_state & I_DIRTY_INODE))) + return; + +- if (unlikely(block_dump)) +- block_dump___mark_inode_dirty(inode); +- + spin_lock(&inode->i_lock); + if (dirtytime && (inode->i_state & I_DIRTY_INODE)) + goto out_unlock_inode; +-- +2.30.2 + diff --git a/queue-5.12/bluetooth-fix-handling-of-hci_le_advertising_set_ter.patch b/queue-5.12/bluetooth-fix-handling-of-hci_le_advertising_set_ter.patch new file mode 100644 index 00000000000..84df9f39e08 --- /dev/null +++ b/queue-5.12/bluetooth-fix-handling-of-hci_le_advertising_set_ter.patch @@ -0,0 +1,56 @@ +From 4636e69bce552b9b15e253be49542ed8aae5f7cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 20:59:02 -0700 +Subject: Bluetooth: Fix handling of HCI_LE_Advertising_Set_Terminated event + +From: Luiz Augusto von Dentz + +[ Upstream commit 23837a6d7a1a61818ed94a6b8af552d6cf7d32d5 ] + +Error status of this event means that it has ended due reasons other +than a connection: + + 'If advertising has terminated as a result of the advertising duration + elapsing, the Status parameter shall be set to the error code + Advertising Timeout (0x3C).' + + 'If advertising has terminated because the + Max_Extended_Advertising_Events was reached, the Status parameter + shall be set to the error code Limit Reached (0x43).' + +Fixes: acf0aeae431a0 ("Bluetooth: Handle ADv set terminated event") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 03245ab74e67..c6f400b108d9 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -5271,8 +5271,19 @@ static void hci_le_ext_adv_term_evt(struct hci_dev *hdev, struct sk_buff *skb) + + BT_DBG("%s status 0x%2.2x", hdev->name, ev->status); + +- if (ev->status) ++ if (ev->status) { ++ struct adv_info *adv; ++ ++ adv = hci_find_adv_instance(hdev, ev->handle); ++ if (!adv) ++ return; ++ ++ /* Remove advertising as it has been terminated */ ++ hci_remove_adv_instance(hdev, ev->handle); ++ mgmt_advertising_removed(NULL, hdev, ev->handle); ++ + return; ++ } + + conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->conn_handle)); + if (conn) { +-- +2.30.2 + diff --git a/queue-5.12/bluetooth-fix-set-extended-scan-response-data.patch b/queue-5.12/bluetooth-fix-set-extended-scan-response-data.patch new file mode 100644 index 00000000000..ab50f02157d --- /dev/null +++ b/queue-5.12/bluetooth-fix-set-extended-scan-response-data.patch @@ -0,0 +1,176 @@ +From e38bf3d231610dcc98ff1ea3af1795d947d7e12d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jun 2021 11:09:27 -0700 +Subject: Bluetooth: Fix Set Extended (Scan Response) Data + +From: Luiz Augusto von Dentz + +[ Upstream commit c9ed0a7077306f9d41d74fb006ab5dbada8349c5 ] + +These command do have variable length and the length can go up to 251, +so this changes the struct to not use a fixed size and then when +creating the PDU only the actual length of the data send to the +controller. + +Fixes: a0fb3726ba551 ("Bluetooth: Use Set ext adv/scan rsp data if controller supports") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + include/net/bluetooth/hci.h | 6 ++-- + include/net/bluetooth/hci_core.h | 8 ++--- + net/bluetooth/hci_request.c | 51 ++++++++++++++++++-------------- + 3 files changed, 37 insertions(+), 28 deletions(-) + +diff --git a/include/net/bluetooth/hci.h b/include/net/bluetooth/hci.h +index ba2f439bc04d..46d99c2778c3 100644 +--- a/include/net/bluetooth/hci.h ++++ b/include/net/bluetooth/hci.h +@@ -1773,13 +1773,15 @@ struct hci_cp_ext_adv_set { + __u8 max_events; + } __packed; + ++#define HCI_MAX_EXT_AD_LENGTH 251 ++ + #define HCI_OP_LE_SET_EXT_ADV_DATA 0x2037 + struct hci_cp_le_set_ext_adv_data { + __u8 handle; + __u8 operation; + __u8 frag_pref; + __u8 length; +- __u8 data[HCI_MAX_AD_LENGTH]; ++ __u8 data[]; + } __packed; + + #define HCI_OP_LE_SET_EXT_SCAN_RSP_DATA 0x2038 +@@ -1788,7 +1790,7 @@ struct hci_cp_le_set_ext_scan_rsp_data { + __u8 operation; + __u8 frag_pref; + __u8 length; +- __u8 data[HCI_MAX_AD_LENGTH]; ++ __u8 data[]; + } __packed; + + #define LE_SET_ADV_DATA_OP_COMPLETE 0x03 +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index ca4ac6603b9a..8674141337b7 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -228,9 +228,9 @@ struct adv_info { + __u16 remaining_time; + __u16 duration; + __u16 adv_data_len; +- __u8 adv_data[HCI_MAX_AD_LENGTH]; ++ __u8 adv_data[HCI_MAX_EXT_AD_LENGTH]; + __u16 scan_rsp_len; +- __u8 scan_rsp_data[HCI_MAX_AD_LENGTH]; ++ __u8 scan_rsp_data[HCI_MAX_EXT_AD_LENGTH]; + __s8 tx_power; + __u32 min_interval; + __u32 max_interval; +@@ -550,9 +550,9 @@ struct hci_dev { + DECLARE_BITMAP(dev_flags, __HCI_NUM_FLAGS); + + __s8 adv_tx_power; +- __u8 adv_data[HCI_MAX_AD_LENGTH]; ++ __u8 adv_data[HCI_MAX_EXT_AD_LENGTH]; + __u8 adv_data_len; +- __u8 scan_rsp_data[HCI_MAX_AD_LENGTH]; ++ __u8 scan_rsp_data[HCI_MAX_EXT_AD_LENGTH]; + __u8 scan_rsp_data_len; + + struct list_head adv_instances; +diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c +index 805ce546b813..e5d6b1d12764 100644 +--- a/net/bluetooth/hci_request.c ++++ b/net/bluetooth/hci_request.c +@@ -1685,30 +1685,33 @@ void __hci_req_update_scan_rsp_data(struct hci_request *req, u8 instance) + return; + + if (ext_adv_capable(hdev)) { +- struct hci_cp_le_set_ext_scan_rsp_data cp; ++ struct { ++ struct hci_cp_le_set_ext_scan_rsp_data cp; ++ u8 data[HCI_MAX_EXT_AD_LENGTH]; ++ } pdu; + +- memset(&cp, 0, sizeof(cp)); ++ memset(&pdu, 0, sizeof(pdu)); + + if (instance) + len = create_instance_scan_rsp_data(hdev, instance, +- cp.data); ++ pdu.data); + else +- len = create_default_scan_rsp_data(hdev, cp.data); ++ len = create_default_scan_rsp_data(hdev, pdu.data); + + if (hdev->scan_rsp_data_len == len && +- !memcmp(cp.data, hdev->scan_rsp_data, len)) ++ !memcmp(pdu.data, hdev->scan_rsp_data, len)) + return; + +- memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data)); ++ memcpy(hdev->scan_rsp_data, pdu.data, len); + hdev->scan_rsp_data_len = len; + +- cp.handle = instance; +- cp.length = len; +- cp.operation = LE_SET_ADV_DATA_OP_COMPLETE; +- cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG; ++ pdu.cp.handle = instance; ++ pdu.cp.length = len; ++ pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE; ++ pdu.cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG; + +- hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_RSP_DATA, sizeof(cp), +- &cp); ++ hci_req_add(req, HCI_OP_LE_SET_EXT_SCAN_RSP_DATA, ++ sizeof(pdu.cp) + len, &pdu.cp); + } else { + struct hci_cp_le_set_scan_rsp_data cp; + +@@ -1831,26 +1834,30 @@ void __hci_req_update_adv_data(struct hci_request *req, u8 instance) + return; + + if (ext_adv_capable(hdev)) { +- struct hci_cp_le_set_ext_adv_data cp; ++ struct { ++ struct hci_cp_le_set_ext_adv_data cp; ++ u8 data[HCI_MAX_EXT_AD_LENGTH]; ++ } pdu; + +- memset(&cp, 0, sizeof(cp)); ++ memset(&pdu, 0, sizeof(pdu)); + +- len = create_instance_adv_data(hdev, instance, cp.data); ++ len = create_instance_adv_data(hdev, instance, pdu.data); + + /* There's nothing to do if the data hasn't changed */ + if (hdev->adv_data_len == len && +- memcmp(cp.data, hdev->adv_data, len) == 0) ++ memcmp(pdu.data, hdev->adv_data, len) == 0) + return; + +- memcpy(hdev->adv_data, cp.data, sizeof(cp.data)); ++ memcpy(hdev->adv_data, pdu.data, len); + hdev->adv_data_len = len; + +- cp.length = len; +- cp.handle = instance; +- cp.operation = LE_SET_ADV_DATA_OP_COMPLETE; +- cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG; ++ pdu.cp.length = len; ++ pdu.cp.handle = instance; ++ pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE; ++ pdu.cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG; + +- hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_DATA, sizeof(cp), &cp); ++ hci_req_add(req, HCI_OP_LE_SET_EXT_ADV_DATA, ++ sizeof(pdu.cp) + len, &pdu.cp); + } else { + struct hci_cp_le_set_adv_data cp; + +-- +2.30.2 + diff --git a/queue-5.12/bluetooth-mgmt-fix-slab-out-of-bounds-in-tlv_data_is.patch b/queue-5.12/bluetooth-mgmt-fix-slab-out-of-bounds-in-tlv_data_is.patch new file mode 100644 index 00000000000..7a84ac29539 --- /dev/null +++ b/queue-5.12/bluetooth-mgmt-fix-slab-out-of-bounds-in-tlv_data_is.patch @@ -0,0 +1,65 @@ +From 54c5b9c85255e54455a7c0d819268f9be5d67cd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 11:45:02 -0700 +Subject: Bluetooth: mgmt: Fix slab-out-of-bounds in tlv_data_is_valid + +From: Luiz Augusto von Dentz + +[ Upstream commit 799acb9347915bfe4eac0ff2345b468f0a1ca207 ] + +This fixes parsing of LTV entries when the length is 0. + +Found with: + +tools/mgmt-tester -s "Add Advertising - Success (ScRsp only)" + +Add Advertising - Success (ScRsp only) - run + Sending Add Advertising (0x003e) + Test condition added, total 1 +[ 11.004577] ================================================================== +[ 11.005292] BUG: KASAN: slab-out-of-bounds in tlv_data_is_valid+0x87/0xe0 +[ 11.005984] Read of size 1 at addr ffff888002c695b0 by task mgmt-tester/87 +[ 11.006711] +[ 11.007176] +[ 11.007429] Allocated by task 87: +[ 11.008151] +[ 11.008438] The buggy address belongs to the object at ffff888002c69580 +[ 11.008438] which belongs to the cache kmalloc-64 of size 64 +[ 11.010526] The buggy address is located 48 bytes inside of +[ 11.010526] 64-byte region [ffff888002c69580, ffff888002c695c0) +[ 11.012423] The buggy address belongs to the page: +[ 11.013291] +[ 11.013544] Memory state around the buggy address: +[ 11.014359] ffff888002c69480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +[ 11.015453] ffff888002c69500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +[ 11.016232] >ffff888002c69580: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc +[ 11.017010] ^ +[ 11.017547] ffff888002c69600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc +[ 11.018296] ffff888002c69680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +[ 11.019116] ================================================================== + +Fixes: 2bb36870e8cb2 ("Bluetooth: Unify advertising instance flags check") +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/mgmt.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c +index 939c6f77fecc..71de147f5558 100644 +--- a/net/bluetooth/mgmt.c ++++ b/net/bluetooth/mgmt.c +@@ -7579,6 +7579,9 @@ static bool tlv_data_is_valid(struct hci_dev *hdev, u32 adv_flags, u8 *data, + for (i = 0, cur_len = 0; i < len; i += (cur_len + 1)) { + cur_len = data[i]; + ++ if (!cur_len) ++ continue; ++ + if (data[i + 1] == EIR_FLAGS && + (!is_adv_data || flags_managed(adv_flags))) + return false; +-- +2.30.2 + diff --git a/queue-5.12/bpf-do-not-change-gso_size-during-bpf_skb_change_pro.patch b/queue-5.12/bpf-do-not-change-gso_size-during-bpf_skb_change_pro.patch new file mode 100644 index 00000000000..c36626a8743 --- /dev/null +++ b/queue-5.12/bpf-do-not-change-gso_size-during-bpf_skb_change_pro.patch @@ -0,0 +1,145 @@ +From 3a23ffe2f8502172e6a5a0c9f2d75f2bc917bf83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 17:09:51 -0700 +Subject: bpf: Do not change gso_size during bpf_skb_change_proto() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej Å»enczykowski + +[ Upstream commit 364745fbe981a4370f50274475da4675661104df ] + +This is technically a backwards incompatible change in behaviour, but I'm +going to argue that it is very unlikely to break things, and likely to fix +*far* more then it breaks. + +In no particular order, various reasons follow: + +(a) I've long had a bug assigned to myself to debug a super rare kernel crash +on Android Pixel phones which can (per stacktrace) be traced back to BPF clat +IPv6 to IPv4 protocol conversion causing some sort of ugly failure much later +on during transmit deep in the GSO engine, AFAICT precisely because of this +change to gso_size, though I've never been able to manually reproduce it. I +believe it may be related to the particular network offload support of attached +USB ethernet dongle being used for tethering off of an IPv6-only cellular +connection. The reason might be we end up with more segments than max permitted, +or with a GSO packet with only one segment... (either way we break some +assumption and hit a BUG_ON) + +(b) There is no check that the gso_size is > 20 when reducing it by 20, so we +might end up with a negative (or underflowing) gso_size or a gso_size of 0. +This can't possibly be good. Indeed this is probably somehow exploitable (or +at least can result in a kernel crash) by delivering crafted packets and perhaps +triggering an infinite loop or a divide by zero... As a reminder: gso_size (MSS) +is related to MTU, but not directly derived from it: gso_size/MSS may be +significantly smaller then one would get by deriving from local MTU. And on +some NICs (which do loose MTU checking on receive, it may even potentially be +larger, for example my work pc with 1500 MTU can receive 1520 byte frames [and +sometimes does due to bugs in a vendor plat46 implementation]). Indeed even just +going from 21 to 1 is potentially problematic because it increases the number +of segments by a factor of 21 (think DoS, or some other crash due to too many +segments). + +(c) It's always safe to not increase the gso_size, because it doesn't result in +the max packet size increasing. So the skb_increase_gso_size() call was always +unnecessary for correctness (and outright undesirable, see later). As such the +only part which is potentially dangerous (ie. could cause backwards compatibility +issues) is the removal of the skb_decrease_gso_size() call. + +(d) If the packets are ultimately destined to the local device, then there is +absolutely no benefit to playing around with gso_size. It only matters if the +packets will egress the device. ie. we're either forwarding, or transmitting +from the device. + +(e) This logic only triggers for packets which are GSO. It does not trigger for +skbs which are not GSO. It will not convert a non-GSO MTU sized packet into a +GSO packet (and you don't even know what the MTU is, so you can't even fix it). +As such your transmit path must *already* be able to handle an MTU 20 bytes +larger then your receive path (for IPv4 to IPv6 translation) - and indeed 28 +bytes larger due to IPv4 fragments. Thus removing the skb_decrease_gso_size() +call doesn't actually increase the size of the packets your transmit side must +be able to handle. ie. to handle non-GSO max-MTU packets, the IPv4/IPv6 device/ +route MTUs must already be set correctly. Since for example with an IPv4 egress +MTU of 1500, IPv4 to IPv6 translation will already build 1520 byte IPv6 frames, +so you need a 1520 byte device MTU. This means if your IPv6 device's egress +MTU is 1280, your IPv4 route must be 1260 (and actually 1252, because of the +need to handle fragments). This is to handle normal non-GSO packets. Thus the +reduction is simply not needed for GSO packets, because when they're correctly +built, they will already be the right size. + +(f) TSO/GSO should be able to exactly undo GRO: the number of packets (TCP +segments) should not be modified, so that TCP's MSS counting works correctly +(this matters for congestion control). If protocol conversion changes the +gso_size, then the number of TCP segments may increase or decrease. Packet loss +after protocol conversion can result in partial loss of MSS segments that the +sender sent. How's the sending TCP stack going to react to receiving ACKs/SACKs +in the middle of the segments it sent? + +(g) skb_{decrease,increase}_gso_size() are already no-ops for GSO_BY_FRAGS +case (besides triggering WARN_ON_ONCE). This means you already cannot guarantee +that gso_size (and thus resulting packet MTU) is changed. ie. you must assume +it won't be changed. + +(h) changing gso_size is outright buggy for UDP GSO packets, where framing +matters (I believe that's also the case for SCTP, but it's already excluded +by [g]). So the only remaining case is TCP, which also doesn't want it +(see [f]). + +(i) see also the reasoning on the previous attempt at fixing this +(commit fa7b83bf3b156c767f3e4a25bbf3817b08f3ff8e) which shows that the current +behaviour causes TCP packet loss: + + In the forwarding path GRO -> BPF 6 to 4 -> GSO for TCP traffic, the + coalesced packet payload can be > MSS, but < MSS + 20. + + bpf_skb_proto_6_to_4() will upgrade the MSS and it can be > the payload + length. After then tcp_gso_segment checks for the payload length if it + is <= MSS. The condition is causing the packet to be dropped. + + tcp_gso_segment(): + [...] + mss = skb_shinfo(skb)->gso_size; + if (unlikely(skb->len <= mss)) goto out; + [...] + +Thus changing the gso_size is simply a very bad idea. Increasing is unnecessary +and buggy, and decreasing can go negative. + +Fixes: 6578171a7ff0 ("bpf: add bpf_skb_change_proto helper") +Signed-off-by: Maciej Å»enczykowski +Signed-off-by: Daniel Borkmann +Cc: Dongseok Yi +Cc: Willem de Bruijn +Link: https://lore.kernel.org/bpf/CANP3RGfjLikQ6dg=YpBU0OeHvyv7JOki7CyOUS9modaXAi-9vQ@mail.gmail.com +Link: https://lore.kernel.org/bpf/20210617000953.2787453-2-zenczykowski@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/filter.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/net/core/filter.c b/net/core/filter.c +index 52f4359efbd2..0d1273d40fcf 100644 +--- a/net/core/filter.c ++++ b/net/core/filter.c +@@ -3266,8 +3266,6 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb) + shinfo->gso_type |= SKB_GSO_TCPV6; + } + +- /* Due to IPv6 header, MSS needs to be downgraded. */ +- skb_decrease_gso_size(shinfo, len_diff); + /* Header must be checked, and gso_segs recomputed. */ + shinfo->gso_type |= SKB_GSO_DODGY; + shinfo->gso_segs = 0; +@@ -3307,8 +3305,6 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb) + shinfo->gso_type |= SKB_GSO_TCPV4; + } + +- /* Due to IPv4 header, MSS can be upgraded. */ +- skb_increase_gso_size(shinfo, len_diff); + /* Header must be checked, and gso_segs recomputed. */ + shinfo->gso_type |= SKB_GSO_DODGY; + shinfo->gso_segs = 0; +-- +2.30.2 + diff --git a/queue-5.12/bpf-fix-integer-overflow-in-argument-calculation-for.patch b/queue-5.12/bpf-fix-integer-overflow-in-argument-calculation-for.patch new file mode 100644 index 00000000000..ee292ec4405 --- /dev/null +++ b/queue-5.12/bpf-fix-integer-overflow-in-argument-calculation-for.patch @@ -0,0 +1,67 @@ +From 2abcac01e3da93c07d3d245f9d3bcf5ff98eb7c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 21:34:39 +0700 +Subject: bpf: Fix integer overflow in argument calculation for + bpf_map_area_alloc + +From: Bui Quang Minh + +[ Upstream commit 7dd5d437c258bbf4cc15b35229e5208b87b8b4e0 ] + +In 32-bit architecture, the result of sizeof() is a 32-bit integer so +the expression becomes the multiplication between 2 32-bit integer which +can potentially leads to integer overflow. As a result, +bpf_map_area_alloc() allocates less memory than needed. + +Fix this by casting 1 operand to u64. + +Fixes: 0d2c4f964050 ("bpf: Eliminate rlimit-based memory accounting for sockmap and sockhash maps") +Fixes: 99c51064fb06 ("devmap: Use bpf_map_area_alloc() for allocating hash buckets") +Fixes: 546ac1ffb70d ("bpf: add devmap, a map for storing net device references") +Signed-off-by: Bui Quang Minh +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20210613143440.71975-1-minhquangbui99@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/devmap.c | 4 ++-- + net/core/sock_map.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c +index 85d9d1b72a33..b0ab5b915e6d 100644 +--- a/kernel/bpf/devmap.c ++++ b/kernel/bpf/devmap.c +@@ -92,7 +92,7 @@ static struct hlist_head *dev_map_create_hash(unsigned int entries, + int i; + struct hlist_head *hash; + +- hash = bpf_map_area_alloc(entries * sizeof(*hash), numa_node); ++ hash = bpf_map_area_alloc((u64) entries * sizeof(*hash), numa_node); + if (hash != NULL) + for (i = 0; i < entries; i++) + INIT_HLIST_HEAD(&hash[i]); +@@ -143,7 +143,7 @@ static int dev_map_init_map(struct bpf_dtab *dtab, union bpf_attr *attr) + + spin_lock_init(&dtab->index_lock); + } else { +- dtab->netdev_map = bpf_map_area_alloc(dtab->map.max_entries * ++ dtab->netdev_map = bpf_map_area_alloc((u64) dtab->map.max_entries * + sizeof(struct bpf_dtab_netdev *), + dtab->map.numa_node); + if (!dtab->netdev_map) +diff --git a/net/core/sock_map.c b/net/core/sock_map.c +index d758fb83c884..ae62e6f96a95 100644 +--- a/net/core/sock_map.c ++++ b/net/core/sock_map.c +@@ -44,7 +44,7 @@ static struct bpf_map *sock_map_alloc(union bpf_attr *attr) + bpf_map_init_from_attr(&stab->map, attr); + raw_spin_lock_init(&stab->lock); + +- stab->sks = bpf_map_area_alloc(stab->map.max_entries * ++ stab->sks = bpf_map_area_alloc((u64) stab->map.max_entries * + sizeof(struct sock *), + stab->map.numa_node); + if (!stab->sks) { +-- +2.30.2 + diff --git a/queue-5.12/bpf-fix-libelf-endian-handling-in-resolv_btfids.patch b/queue-5.12/bpf-fix-libelf-endian-handling-in-resolv_btfids.patch new file mode 100644 index 00000000000..fa48c57e522 --- /dev/null +++ b/queue-5.12/bpf-fix-libelf-endian-handling-in-resolv_btfids.patch @@ -0,0 +1,58 @@ +From d5d5fc9333eb68fd3a39f4f862c0a08f857a2305 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 23:14:04 -0700 +Subject: bpf: Fix libelf endian handling in resolv_btfids + +From: Tony Ambardar + +[ Upstream commit 61e8aeda9398925f8c6fc290585bdd9727d154c4 ] + +The vmlinux ".BTF_ids" ELF section is declared in btf_ids.h to hold a list +of zero-filled BTF IDs, which is then patched at link-time with correct +values by resolv_btfids. The section is flagged as "allocable" to preclude +compression, but notably the section contents (BTF IDs) are untyped. + +When patching the BTF IDs, resolve_btfids writes in host-native endianness +and relies on libelf for any required translation on reading and updating +vmlinux. However, since the type of the .BTF_ids section content defaults +to ELF_T_BYTE (i.e. unsigned char), no translation occurs. This results in +incorrect patched values when cross-compiling to non-native endianness, +and can manifest as kernel Oops and test failures which are difficult to +troubleshoot [1]. + +Explicitly set the type of patched data to ELF_T_WORD, the architecture- +neutral ELF type corresponding to the u32 BTF IDs. This enables libelf to +transparently perform any needed endian conversions. + +Fixes: fbbb68de80a4 ("bpf: Add resolve_btfids tool to resolve BTF IDs in ELF object") +Signed-off-by: Tony Ambardar +Signed-off-by: Daniel Borkmann +Acked-by: Jiri Olsa +Cc: Frank Eigler +Cc: Mark Wielaard +Cc: Jiri Olsa +Cc: Yonghong Song +Link: https://lore.kernel.org/bpf/CAPGftE_eY-Zdi3wBcgDfkz_iOr1KF10n=9mJHm1_a_PykcsoeA@mail.gmail.com [1] +Link: https://lore.kernel.org/bpf/20210618061404.818569-1-Tony.Ambardar@gmail.com +Signed-off-by: Sasha Levin +--- + tools/bpf/resolve_btfids/main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/bpf/resolve_btfids/main.c b/tools/bpf/resolve_btfids/main.c +index 80d966cfcaa1..7ce4558a932f 100644 +--- a/tools/bpf/resolve_btfids/main.c ++++ b/tools/bpf/resolve_btfids/main.c +@@ -656,6 +656,9 @@ static int symbols_patch(struct object *obj) + if (sets_patch(obj)) + return -1; + ++ /* Set type to ensure endian translation occurs. */ ++ obj->efile.idlist->d_type = ELF_T_WORD; ++ + elf_flagdata(obj->efile.idlist, ELF_C_SET, ELF_F_DIRTY); + + err = elf_update(obj->efile.elf, ELF_C_WRITE); +-- +2.30.2 + diff --git a/queue-5.12/bpf-fix-null-ptr-deref-with-mixed-tail-calls-and-sub.patch b/queue-5.12/bpf-fix-null-ptr-deref-with-mixed-tail-calls-and-sub.patch new file mode 100644 index 00000000000..0cd49325a2f --- /dev/null +++ b/queue-5.12/bpf-fix-null-ptr-deref-with-mixed-tail-calls-and-sub.patch @@ -0,0 +1,129 @@ +From ab011c46ca908b52082e876b9a0f274690e291ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 15:55:00 -0700 +Subject: bpf: Fix null ptr deref with mixed tail calls and subprogs + +From: John Fastabend + +[ Upstream commit 7506d211b932870155bcb39e3dd9e39fab45a7c7 ] + +The sub-programs prog->aux->poke_tab[] is populated in jit_subprogs() and +then used when emitting 'BPF_JMP|BPF_TAIL_CALL' insn->code from the +individual JITs. The poke_tab[] to use is stored in the insn->imm by +the code adding it to that array slot. The JIT then uses imm to find the +right entry for an individual instruction. In the x86 bpf_jit_comp.c +this is done by calling emit_bpf_tail_call_direct with the poke_tab[] +of the imm value. + +However, we observed the below null-ptr-deref when mixing tail call +programs with subprog programs. For this to happen we just need to +mix bpf-2-bpf calls and tailcalls with some extra calls or instructions +that would be patched later by one of the fixup routines. So whats +happening? + +Before the fixup_call_args() -- where the jit op is done -- various +code patching is done by do_misc_fixups(). This may increase the +insn count, for example when we patch map_lookup_up using map_gen_lookup +hook. This does two things. First, it means the instruction index, +insn_idx field, of a tail call instruction will move by a 'delta'. + +In verifier code, + + struct bpf_jit_poke_descriptor desc = { + .reason = BPF_POKE_REASON_TAIL_CALL, + .tail_call.map = BPF_MAP_PTR(aux->map_ptr_state), + .tail_call.key = bpf_map_key_immediate(aux), + .insn_idx = i + delta, + }; + +Then subprog start values subprog_info[i].start will be updated +with the delta and any poke descriptor index will also be updated +with the delta in adjust_poke_desc(). If we look at the adjust +subprog starts though we see its only adjusted when the delta +occurs before the new instructions, + + /* NOTE: fake 'exit' subprog should be updated as well. */ + for (i = 0; i <= env->subprog_cnt; i++) { + if (env->subprog_info[i].start <= off) + continue; + +Earlier subprograms are not changed because their start values +are not moved. But, adjust_poke_desc() does the offset + delta +indiscriminately. The result is poke descriptors are potentially +corrupted. + +Then in jit_subprogs() we only populate the poke_tab[] +when the above insn_idx is less than the next subprogram start. From +above we corrupted our insn_idx so we might incorrectly assume a +poke descriptor is not used in a subprogram omitting it from the +subprogram. And finally when the jit runs it does the deref of poke_tab +when emitting the instruction and crashes with below. Because earlier +step omitted the poke descriptor. + +The fix is straight forward with above context. Simply move same logic +from adjust_subprog_starts() into adjust_poke_descs() and only adjust +insn_idx when needed. + +[ 82.396354] bpf_testmod: version magic '5.12.0-rc2alu+ SMP preempt mod_unload ' should be '5.12.0+ SMP preempt mod_unload ' +[ 82.623001] loop10: detected capacity change from 0 to 8 +[ 88.487424] ================================================================== +[ 88.487438] BUG: KASAN: null-ptr-deref in do_jit+0x184a/0x3290 +[ 88.487455] Write of size 8 at addr 0000000000000008 by task test_progs/5295 +[ 88.487471] CPU: 7 PID: 5295 Comm: test_progs Tainted: G I 5.12.0+ #386 +[ 88.487483] Hardware name: Dell Inc. Precision 5820 Tower/002KVM, BIOS 1.9.2 01/24/2019 +[ 88.487490] Call Trace: +[ 88.487498] dump_stack+0x93/0xc2 +[ 88.487515] kasan_report.cold+0x5f/0xd8 +[ 88.487530] ? do_jit+0x184a/0x3290 +[ 88.487542] do_jit+0x184a/0x3290 + ... +[ 88.487709] bpf_int_jit_compile+0x248/0x810 + ... +[ 88.487765] bpf_check+0x3718/0x5140 + ... +[ 88.487920] bpf_prog_load+0xa22/0xf10 + +Fixes: a748c6975dea3 ("bpf: propagate poke descriptors to subprograms") +Reported-by: Jussi Maki +Signed-off-by: John Fastabend +Signed-off-by: Alexei Starovoitov +Reviewed-by: Daniel Borkmann +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 2423b4e918b9..87c4ea3b3cb7 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -10877,7 +10877,7 @@ static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len + } + } + +-static void adjust_poke_descs(struct bpf_prog *prog, u32 len) ++static void adjust_poke_descs(struct bpf_prog *prog, u32 off, u32 len) + { + struct bpf_jit_poke_descriptor *tab = prog->aux->poke_tab; + int i, sz = prog->aux->size_poke_tab; +@@ -10885,6 +10885,8 @@ static void adjust_poke_descs(struct bpf_prog *prog, u32 len) + + for (i = 0; i < sz; i++) { + desc = &tab[i]; ++ if (desc->insn_idx <= off) ++ continue; + desc->insn_idx += len - 1; + } + } +@@ -10905,7 +10907,7 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of + if (adjust_insn_aux_data(env, new_prog, off, len)) + return NULL; + adjust_subprog_starts(env, off, len); +- adjust_poke_descs(new_prog, len); ++ adjust_poke_descs(new_prog, off, len); + return new_prog; + } + +-- +2.30.2 + diff --git a/queue-5.12/bpf-fix-regression-on-bpf_obj_get-with-non-o_rdwr-fl.patch b/queue-5.12/bpf-fix-regression-on-bpf_obj_get-with-non-o_rdwr-fl.patch new file mode 100644 index 00000000000..c682cbee86a --- /dev/null +++ b/queue-5.12/bpf-fix-regression-on-bpf_obj_get-with-non-o_rdwr-fl.patch @@ -0,0 +1,56 @@ +From 77d7157b2a0246995fab66c46cf9ea56d71db76a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 03:55:26 -0700 +Subject: bpf: Fix regression on BPF_OBJ_GET with non-O_RDWR flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej Å»enczykowski + +[ Upstream commit 5dec6d96d12d33900ec315972c8e47a73bcc378d ] + +This reverts commit d37300ed1821 ("bpf: program: Refuse non-O_RDWR flags +in BPF_OBJ_GET"). It breaks Android userspace which expects to be able to +fetch programs with just read permissions. + +See: https://cs.android.com/android/platform/superproject/+/master:frameworks/libs/net/common/native/bpf_syscall_wrappers/include/BpfSyscallWrappers.h;drc=7005c764be23d31fa1d69e826b4a2f6689a8c81e;l=124 + +Side-note: another option to fix it would be to extend bpf_prog_new_fd() +and to pass in used file mode flags in the same way as we do for maps via +bpf_map_new_fd(). Meaning, they'd end up in anon_inode_getfd() and thus +would be retained for prog fd operations with bpf() syscall. Right now +these flags are not checked with progs since they are immutable for their +lifetime (as opposed to maps which can be updated from user space). In +future this could potentially change with new features, but at that point +it's still fine to do the bpf_prog_new_fd() extension when needed. For a +simple stable fix, a revert is less churn. + +Fixes: d37300ed1821 ("bpf: program: Refuse non-O_RDWR flags in BPF_OBJ_GET") +Signed-off-by: Maciej Å»enczykowski +[ Daniel: added side-note to commit message ] +Signed-off-by: Daniel Borkmann +Acked-by: Lorenz Bauer +Acked-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/bpf/20210618105526.265003-1-zenczykowski@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c +index d2de2abec35b..dc56237d6960 100644 +--- a/kernel/bpf/inode.c ++++ b/kernel/bpf/inode.c +@@ -543,7 +543,7 @@ int bpf_obj_get_user(const char __user *pathname, int flags) + return PTR_ERR(raw); + + if (type == BPF_TYPE_PROG) +- ret = (f_flags != O_RDWR) ? -EINVAL : bpf_prog_new_fd(raw); ++ ret = bpf_prog_new_fd(raw); + else if (type == BPF_TYPE_MAP) + ret = bpf_map_new_fd(raw, f_flags); + else if (type == BPF_TYPE_LINK) +-- +2.30.2 + diff --git a/queue-5.12/bpf-x86-fix-extable-offset-calculation.patch b/queue-5.12/bpf-x86-fix-extable-offset-calculation.patch new file mode 100644 index 00000000000..f5e1ab8cff7 --- /dev/null +++ b/queue-5.12/bpf-x86-fix-extable-offset-calculation.patch @@ -0,0 +1,39 @@ +From bd9106570c6c9e3c5de3b2a0ffa70a9f66f98619 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 16:30:26 +0530 +Subject: bpf, x86: Fix extable offset calculation + +From: Ravi Bangoria + +[ Upstream commit 328aac5ecd119ede3633f7d17969b1ff34ccc784 ] + +Commit 4c5de127598e1 ("bpf: Emit explicit NULL pointer checks for PROBE_LDX +instructions.") is emitting a couple of instructions before the actual load. +Consider those additional instructions while calculating extable offset. + +Fixes: 4c5de127598e1 ("bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.") +Signed-off-by: Ravi Bangoria +Signed-off-by: Alexei Starovoitov +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20210622110026.1157847-1-ravi.bangoria@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/x86/net/bpf_jit_comp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 7f1b3a862e14..1fb0c37e48cb 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -1297,7 +1297,7 @@ st: if (is_imm8(insn->off)) + emit_ldx(&prog, BPF_SIZE(insn->code), dst_reg, src_reg, insn->off); + if (BPF_MODE(insn->code) == BPF_PROBE_MEM) { + struct exception_table_entry *ex; +- u8 *_insn = image + proglen; ++ u8 *_insn = image + proglen + (start_of_ldx - temp); + s64 delta; + + /* populate jmp_offset for JMP above */ +-- +2.30.2 + diff --git a/queue-5.12/bpfilter-specify-the-log-level-for-the-kmsg-message.patch b/queue-5.12/bpfilter-specify-the-log-level-for-the-kmsg-message.patch new file mode 100644 index 00000000000..1e3218c5f88 --- /dev/null +++ b/queue-5.12/bpfilter-specify-the-log-level-for-the-kmsg-message.patch @@ -0,0 +1,45 @@ +From 4d1cd5768dad62c1eeb4df49566b309c118cc5fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 12:09:18 +0800 +Subject: bpfilter: Specify the log level for the kmsg message + +From: Gary Lin + +[ Upstream commit a196fa78a26571359740f701cf30d774eb8a72cb ] + +Per the kmsg document [0], if we don't specify the log level with a +prefix "" in the message string, the default log level will be +applied to the message. Since the default level could be warning(4), +this would make the log utility such as journalctl treat the message, +"Started bpfilter", as a warning. To avoid confusion, this commit +adds the prefix "<5>" to make the message always a notice. + + [0] https://www.kernel.org/doc/Documentation/ABI/testing/dev-kmsg + +Fixes: 36c4357c63f3 ("net: bpfilter: print umh messages to /dev/kmsg") +Reported-by: Martin Loviska +Signed-off-by: Gary Lin +Signed-off-by: Daniel Borkmann +Acked-by: Dmitrii Banshchikov +Link: https://lore.kernel.org/bpf/20210623040918.8683-1-glin@suse.com +Signed-off-by: Sasha Levin +--- + net/bpfilter/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bpfilter/main.c b/net/bpfilter/main.c +index 05e1cfc1e5cd..291a92546246 100644 +--- a/net/bpfilter/main.c ++++ b/net/bpfilter/main.c +@@ -57,7 +57,7 @@ int main(void) + { + debug_f = fopen("/dev/kmsg", "w"); + setvbuf(debug_f, 0, _IOLBF, 0); +- fprintf(debug_f, "Started bpfilter\n"); ++ fprintf(debug_f, "<5>Started bpfilter\n"); + loop(); + fclose(debug_f); + return 0; +-- +2.30.2 + diff --git a/queue-5.12/brcmfmac-correctly-report-average-rssi-in-station-in.patch b/queue-5.12/brcmfmac-correctly-report-average-rssi-in-station-in.patch new file mode 100644 index 00000000000..b50614c0112 --- /dev/null +++ b/queue-5.12/brcmfmac-correctly-report-average-rssi-in-station-in.patch @@ -0,0 +1,87 @@ +From 568c4dcc0ac36475d1b82a731e64c2ab0efb057c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 May 2021 13:20:12 +0000 +Subject: brcmfmac: correctly report average RSSI in station info +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alvin Å ipraga + +[ Upstream commit 9a1590934d9a02e570636432b93052c0c035f31f ] + +The rx_lastpkt_rssi field provided by the firmware is suitable for +NL80211_STA_INFO_{SIGNAL,CHAIN_SIGNAL}, while the rssi field is an +average. Fix up the assignments and set the correct STA_INFO bits. This +lets userspace know that the average RSSI is part of the station info. + +Fixes: cae355dc90db ("brcmfmac: Add RSSI information to get_station.") +Signed-off-by: Alvin Å ipraga +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210506132010.3964484-2-alsi@bang-olufsen.dk +Signed-off-by: Sasha Levin +--- + .../broadcom/brcm80211/brcmfmac/cfg80211.c | 36 ++++++++++--------- + 1 file changed, 20 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index afa75cb83221..d8822a01d277 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -2767,8 +2767,9 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev, + struct brcmf_sta_info_le sta_info_le; + u32 sta_flags; + u32 is_tdls_peer; +- s32 total_rssi; +- s32 count_rssi; ++ s32 total_rssi_avg = 0; ++ s32 total_rssi = 0; ++ s32 count_rssi = 0; + int rssi; + u32 i; + +@@ -2834,24 +2835,27 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev, + sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES); + sinfo->rx_bytes = le64_to_cpu(sta_info_le.rx_tot_bytes); + } +- total_rssi = 0; +- count_rssi = 0; + for (i = 0; i < BRCMF_ANT_MAX; i++) { +- if (sta_info_le.rssi[i]) { +- sinfo->chains |= BIT(count_rssi); +- sinfo->chain_signal_avg[count_rssi] = +- sta_info_le.rssi[i]; +- sinfo->chain_signal[count_rssi] = +- sta_info_le.rssi[i]; +- total_rssi += sta_info_le.rssi[i]; +- count_rssi++; +- } ++ if (sta_info_le.rssi[i] == 0 || ++ sta_info_le.rx_lastpkt_rssi[i] == 0) ++ continue; ++ sinfo->chains |= BIT(count_rssi); ++ sinfo->chain_signal[count_rssi] = ++ sta_info_le.rx_lastpkt_rssi[i]; ++ sinfo->chain_signal_avg[count_rssi] = ++ sta_info_le.rssi[i]; ++ total_rssi += sta_info_le.rx_lastpkt_rssi[i]; ++ total_rssi_avg += sta_info_le.rssi[i]; ++ count_rssi++; + } + if (count_rssi) { +- sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL); + sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL); +- total_rssi /= count_rssi; +- sinfo->signal = total_rssi; ++ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG); ++ sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL); ++ sinfo->filled |= ++ BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG); ++ sinfo->signal = total_rssi / count_rssi; ++ sinfo->signal_avg = total_rssi_avg / count_rssi; + } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED, + &ifp->vif->sme_state)) { + memset(&scb_val, 0, sizeof(scb_val)); +-- +2.30.2 + diff --git a/queue-5.12/brcmfmac-delete-second-brcm-folder-hierarchy.patch b/queue-5.12/brcmfmac-delete-second-brcm-folder-hierarchy.patch new file mode 100644 index 00000000000..42bbf88bde3 --- /dev/null +++ b/queue-5.12/brcmfmac-delete-second-brcm-folder-hierarchy.patch @@ -0,0 +1,40 @@ +From bce7f006e8b49f28850276e167d7f854287169a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 16:43:05 +0200 +Subject: brcmfmac: Delete second brcm folder hierarchy + +From: Matthias Brugger + +[ Upstream commit 4a26aafe4886a4ec9965171c280ce16df30dc362 ] + +BRCMF_FW_DEFAULT_PATH already defines the brcm folder, delete the second +folder to match with Linux firmware repository layout. + +Fixes: 75729e110e68 ("brcmfmac: expose firmware config files through modinfo") +Signed-off-by: Matthias Brugger +Reviewed-by: Hans de Goede +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210602144305.4481-1-matthias.bgg@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +index 3a1c98a046f0..faf5f8e5eee3 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -626,8 +626,8 @@ BRCMF_FW_DEF(4373, "brcmfmac4373-sdio"); + BRCMF_FW_DEF(43012, "brcmfmac43012-sdio"); + + /* firmware config files */ +-MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcm/brcmfmac*-sdio.*.txt"); +-MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcm/brcmfmac*-pcie.*.txt"); ++MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-sdio.*.txt"); ++MODULE_FIRMWARE(BRCMF_FW_DEFAULT_PATH "brcmfmac*-pcie.*.txt"); + + static const struct brcmf_firmware_mapping brcmf_sdio_fwnames[] = { + BRCMF_FW_ENTRY(BRCM_CC_43143_CHIP_ID, 0xFFFFFFFF, 43143), +-- +2.30.2 + diff --git a/queue-5.12/brcmfmac-fix-a-double-free-in-brcmf_sdio_bus_reset.patch b/queue-5.12/brcmfmac-fix-a-double-free-in-brcmf_sdio_bus_reset.patch new file mode 100644 index 00000000000..59873539bea --- /dev/null +++ b/queue-5.12/brcmfmac-fix-a-double-free-in-brcmf_sdio_bus_reset.patch @@ -0,0 +1,38 @@ +From 92f9bc7a5cad6315737bded99a78faeaa3707a91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 18:01:28 +0800 +Subject: brcmfmac: Fix a double-free in brcmf_sdio_bus_reset + +From: Tong Tiangen + +[ Upstream commit 7ea7a1e05c7ff5ffc9f9ec1f0849f6ceb7fcd57c ] + +brcmf_sdiod_remove has been called inside brcmf_sdiod_probe when fails, +so there's no need to call another one. Otherwise, sdiodev->freezer +would be double freed. + +Fixes: 7836102a750a ("brcmfmac: reset SDIO bus on a firmware crash") +Signed-off-by: Tong Tiangen +Reviewed-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210601100128.69561-1-tongtiangen@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +index 16ed325795a8..3a1c98a046f0 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -4162,7 +4162,6 @@ static int brcmf_sdio_bus_reset(struct device *dev) + if (ret) { + brcmf_err("Failed to probe after sdio device reset: ret %d\n", + ret); +- brcmf_sdiod_remove(sdiodev); + } + + return ret; +-- +2.30.2 + diff --git a/queue-5.12/brcmfmac-fix-setting-of-station-info-chains-bitmask.patch b/queue-5.12/brcmfmac-fix-setting-of-station-info-chains-bitmask.patch new file mode 100644 index 00000000000..baf7bf7636e --- /dev/null +++ b/queue-5.12/brcmfmac-fix-setting-of-station-info-chains-bitmask.patch @@ -0,0 +1,61 @@ +From ab666e465dc7fd799d15bdd8207ea6ab3c65e106 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 May 2021 13:20:12 +0000 +Subject: brcmfmac: fix setting of station info chains bitmask +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alvin Å ipraga + +[ Upstream commit feb45643762172110cb3a44f99dd54304f33b711 ] + +The sinfo->chains field is a bitmask for filled values in chain_signal +and chain_signal_avg, not a count. Treat it as such so that the driver +can properly report per-chain RSSI information. + +Before (MIMO mode): + + $ iw dev wlan0 station dump + ... + signal: -51 [-51] dBm + +After (MIMO mode): + + $ iw dev wlan0 station dump + ... + signal: -53 [-53, -54] dBm + +Fixes: cae355dc90db ("brcmfmac: Add RSSI information to get_station.") +Signed-off-by: Alvin Å ipraga +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210506132010.3964484-1-alsi@bang-olufsen.dk +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index f4405d7861b6..afa75cb83221 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -2838,6 +2838,7 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev, + count_rssi = 0; + for (i = 0; i < BRCMF_ANT_MAX; i++) { + if (sta_info_le.rssi[i]) { ++ sinfo->chains |= BIT(count_rssi); + sinfo->chain_signal_avg[count_rssi] = + sta_info_le.rssi[i]; + sinfo->chain_signal[count_rssi] = +@@ -2848,8 +2849,6 @@ brcmf_cfg80211_get_station(struct wiphy *wiphy, struct net_device *ndev, + } + if (count_rssi) { + sinfo->filled |= BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL); +- sinfo->chains = count_rssi; +- + sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL); + total_rssi /= count_rssi; + sinfo->signal = total_rssi; +-- +2.30.2 + diff --git a/queue-5.12/brcmsmac-mac80211_if-fix-a-resource-leak-in-an-error.patch b/queue-5.12/brcmsmac-mac80211_if-fix-a-resource-leak-in-an-error.patch new file mode 100644 index 00000000000..104a6e06a60 --- /dev/null +++ b/queue-5.12/brcmsmac-mac80211_if-fix-a-resource-leak-in-an-error.patch @@ -0,0 +1,55 @@ +From 3878db79747e6813236dff3462523f0ec1961f42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 22:58:30 +0200 +Subject: brcmsmac: mac80211_if: Fix a resource leak in an error handling path + +From: Christophe JAILLET + +[ Upstream commit 9a25344d5177c2b9285532236dc3d10a091f39a8 ] + +If 'brcms_attach()' fails, we must undo the previous 'ieee80211_alloc_hw()' +as already done in the remove function. + +Fixes: 5b435de0d786 ("net: wireless: add brcm80211 drivers") +Signed-off-by: Christophe JAILLET +Acked-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/8fbc171a1a493b38db5a6f0873c6021fca026a6c.1620852921.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + .../wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c +index 39f3af2d0439..eadac0f5590f 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/mac80211_if.c +@@ -1220,6 +1220,7 @@ static int brcms_bcma_probe(struct bcma_device *pdev) + { + struct brcms_info *wl; + struct ieee80211_hw *hw; ++ int ret; + + dev_info(&pdev->dev, "mfg %x core %x rev %d class %d irq %d\n", + pdev->id.manuf, pdev->id.id, pdev->id.rev, pdev->id.class, +@@ -1244,11 +1245,16 @@ static int brcms_bcma_probe(struct bcma_device *pdev) + wl = brcms_attach(pdev); + if (!wl) { + pr_err("%s: brcms_attach failed!\n", __func__); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_free_ieee80211; + } + brcms_led_register(wl); + + return 0; ++ ++err_free_ieee80211: ++ ieee80211_free_hw(hw); ++ return ret; + } + + static int brcms_suspend(struct bcma_device *pdev) +-- +2.30.2 + diff --git a/queue-5.12/btrfs-abort-transaction-if-we-fail-to-update-the-del.patch b/queue-5.12/btrfs-abort-transaction-if-we-fail-to-update-the-del.patch new file mode 100644 index 00000000000..fec8bef04a5 --- /dev/null +++ b/queue-5.12/btrfs-abort-transaction-if-we-fail-to-update-the-del.patch @@ -0,0 +1,43 @@ +From 17d9c7e5ab53f1ce74eed26b98ffb6ef0d7d4630 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 16:44:09 -0400 +Subject: btrfs: abort transaction if we fail to update the delayed inode + +From: Josef Bacik + +[ Upstream commit 04587ad9bef6ce9d510325b4ba9852b6129eebdb ] + +If we fail to update the delayed inode we need to abort the transaction, +because we could leave an inode with the improper counts or some other +such corruption behind. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/delayed-inode.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index 2f73846d712f..55dad12a5ce0 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1066,6 +1066,14 @@ err_out: + btrfs_delayed_inode_release_metadata(fs_info, node, (ret < 0)); + btrfs_release_delayed_inode(node); + ++ /* ++ * If we fail to update the delayed inode we need to abort the ++ * transaction, because we could leave the inode with the improper ++ * counts behind. ++ */ ++ if (ret && ret != -ENOENT) ++ btrfs_abort_transaction(trans, ret); ++ + return ret; + + search: +-- +2.30.2 + diff --git a/queue-5.12/btrfs-always-abort-the-transaction-if-we-abort-a-tra.patch b/queue-5.12/btrfs-always-abort-the-transaction-if-we-abort-a-tra.patch new file mode 100644 index 00000000000..92e1be16192 --- /dev/null +++ b/queue-5.12/btrfs-always-abort-the-transaction-if-we-abort-a-tra.patch @@ -0,0 +1,142 @@ +From 040092f1e6fc84e6ab373b6556190ff4beb803f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 11:21:31 -0400 +Subject: btrfs: always abort the transaction if we abort a trans handle + +From: Josef Bacik + +[ Upstream commit 5963ffcaf383134985a5a2d8a4baa582d3999e0a ] + +While stress testing our error handling I noticed that sometimes we +would still commit the transaction even though we had aborted the +transaction. + +Currently we track if a trans handle has dirtied any metadata, and if it +hasn't we mark the filesystem as having an error (so no new transactions +can be started), but we will allow the current transaction to complete +as we do not mark the transaction itself as having been aborted. + +This sounds good in theory, but we were not properly tracking IO errors +in btrfs_finish_ordered_io, and thus committing the transaction with +bogus free space data. This isn't necessarily a problem per-se with the +free space cache, as the other guards in place would have kept us from +accepting the free space cache as valid, but highlights a real world +case where we had a bug and could have corrupted the filesystem because +of it. + +This "skip abort on empty trans handle" is nice in theory, but assumes +we have perfect error handling everywhere, which we clearly do not. +Also we do not allow further transactions to be started, so all this +does is save the last transaction that was happening, which doesn't +necessarily gain us anything other than the potential for real +corruption. + +Remove this particular bit of code, if we decide we need to abort the +transaction then abort the current one and keep us from doing real harm +to the file system, regardless of whether this specific trans handle +dirtied anything or not. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/ctree.c | 5 +---- + fs/btrfs/extent-tree.c | 1 - + fs/btrfs/super.c | 11 ----------- + fs/btrfs/transaction.c | 8 -------- + fs/btrfs/transaction.h | 1 - + 5 files changed, 1 insertion(+), 25 deletions(-) + +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index f43ce82a6aed..8f48553d861e 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -1498,7 +1498,6 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans, + trans->transid, fs_info->generation); + + if (!should_cow_block(trans, root, buf)) { +- trans->dirty = true; + *cow_ret = buf; + return 0; + } +@@ -2670,10 +2669,8 @@ again: + * then we don't want to set the path blocking, + * so we test it here + */ +- if (!should_cow_block(trans, root, b)) { +- trans->dirty = true; ++ if (!should_cow_block(trans, root, b)) + goto cow_done; +- } + + /* + * must have write locks on this node and the +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 27c368007481..1cde6f84f145 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -4799,7 +4799,6 @@ btrfs_init_new_buffer(struct btrfs_trans_handle *trans, struct btrfs_root *root, + set_extent_dirty(&trans->transaction->dirty_pages, buf->start, + buf->start + buf->len - 1, GFP_NOFS); + } +- trans->dirty = true; + /* this returns a buffer locked for blocking */ + return buf; + } +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index f7a4ad86adee..b3b7f3066cfa 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -273,17 +273,6 @@ void __btrfs_abort_transaction(struct btrfs_trans_handle *trans, + struct btrfs_fs_info *fs_info = trans->fs_info; + + WRITE_ONCE(trans->aborted, errno); +- /* Nothing used. The other threads that have joined this +- * transaction may be able to continue. */ +- if (!trans->dirty && list_empty(&trans->new_bgs)) { +- const char *errstr; +- +- errstr = btrfs_decode_error(errno); +- btrfs_warn(fs_info, +- "%s:%d: Aborting unused transaction(%s).", +- function, line, errstr); +- return; +- } + WRITE_ONCE(trans->transaction->aborted, errno); + /* Wake up anybody who may be waiting on this transaction */ + wake_up(&fs_info->transaction_wait); +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index d678c24250a4..81c8567dffee 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -2056,14 +2056,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans) + + ASSERT(refcount_read(&trans->use_count) == 1); + +- /* +- * Some places just start a transaction to commit it. We need to make +- * sure that if this commit fails that the abort code actually marks the +- * transaction as failed, so set trans->dirty to make the abort code do +- * the right thing. +- */ +- trans->dirty = true; +- + /* Stop the commit early if ->aborted is set */ + if (TRANS_ABORTED(cur_trans)) { + ret = cur_trans->aborted; +diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h +index 364cfbb4c5c5..c49e2266b28b 100644 +--- a/fs/btrfs/transaction.h ++++ b/fs/btrfs/transaction.h +@@ -143,7 +143,6 @@ struct btrfs_trans_handle { + bool allocating_chunk; + bool can_flush_pending_bgs; + bool reloc_reserved; +- bool dirty; + bool in_fsync; + struct btrfs_root *root; + struct btrfs_fs_info *fs_info; +-- +2.30.2 + diff --git a/queue-5.12/btrfs-clear-log-tree-recovering-status-if-starting-t.patch b/queue-5.12/btrfs-clear-log-tree-recovering-status-if-starting-t.patch new file mode 100644 index 00000000000..1399652f9e3 --- /dev/null +++ b/queue-5.12/btrfs-clear-log-tree-recovering-status-if-starting-t.patch @@ -0,0 +1,44 @@ +From bcda996529bc84f44fd62ddedc979806f0de2376 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jul 2020 18:38:05 +0200 +Subject: btrfs: clear log tree recovering status if starting transaction fails + +From: David Sterba + +[ Upstream commit 1aeb6b563aea18cd55c73cf666d1d3245a00f08c ] + +When a log recovery is in progress, lots of operations have to take that +into account, so we keep this status per tree during the operation. Long +time ago error handling revamp patch 79787eaab461 ("btrfs: replace many +BUG_ONs with proper error handling") removed clearing of the status in +an error branch. Add it back as was intended in e02119d5a7b4 ("Btrfs: +Add a write ahead tree log to optimize synchronous operations"). + +There are probably no visible effects, log replay is done only during +mount and if it fails all structures are cleared so the stale status +won't be kept. + +Fixes: 79787eaab461 ("btrfs: replace many BUG_ONs with proper error handling") +Reviewed-by: Qu Wenruo +Reviewed-by: Anand Jain +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/tree-log.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 276b5511ff80..f4b0aecdaac7 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -6365,6 +6365,7 @@ next: + error: + if (wc.trans) + btrfs_end_transaction(wc.trans); ++ clear_bit(BTRFS_FS_LOG_RECOVERING, &fs_info->flags); + btrfs_free_path(path); + return ret; + } +-- +2.30.2 + diff --git a/queue-5.12/btrfs-disable-build-on-platforms-having-page-size-25.patch b/queue-5.12/btrfs-disable-build-on-platforms-having-page-size-25.patch new file mode 100644 index 00000000000..d5688673229 --- /dev/null +++ b/queue-5.12/btrfs-disable-build-on-platforms-having-page-size-25.patch @@ -0,0 +1,54 @@ +From bb533e45ae9f47d3c909d6de5113cd4e7ef78b37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 05:23:02 +0000 +Subject: btrfs: disable build on platforms having page size 256K + +From: Christophe Leroy + +[ Upstream commit b05fbcc36be1f8597a1febef4892053a0b2f3f60 ] + +With a config having PAGE_SIZE set to 256K, BTRFS build fails +with the following message + + include/linux/compiler_types.h:326:38: error: call to + '__compiletime_assert_791' declared with attribute error: + BUILD_BUG_ON failed: (BTRFS_MAX_COMPRESSED % PAGE_SIZE) != 0 + +BTRFS_MAX_COMPRESSED being 128K, BTRFS cannot support platforms with +256K pages at the time being. + +There are two platforms that can select 256K pages: + - hexagon + - powerpc + +Disable BTRFS when 256K page size is selected. Supporting this would +require changes to the subpage mode that's currently being developed. +Given that 256K is many times larger than page sizes commonly used and +for what the algorithms and structures have been tuned, it's out of +scope and disabling build is a reasonable option. + +Reported-by: kernel test robot +Signed-off-by: Christophe Leroy +[ update changelog ] +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/Kconfig | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig +index 68b95ad82126..520a0f6a7d9e 100644 +--- a/fs/btrfs/Kconfig ++++ b/fs/btrfs/Kconfig +@@ -18,6 +18,8 @@ config BTRFS_FS + select RAID6_PQ + select XOR_BLOCKS + select SRCU ++ depends on !PPC_256K_PAGES # powerpc ++ depends on !PAGE_SIZE_256KB # hexagon + + help + Btrfs is a general purpose copy-on-write filesystem with extents, +-- +2.30.2 + diff --git a/queue-5.12/btrfs-don-t-clear-page-extent-mapped-if-we-re-not-in.patch b/queue-5.12/btrfs-don-t-clear-page-extent-mapped-if-we-re-not-in.patch new file mode 100644 index 00000000000..1cb15d304fe --- /dev/null +++ b/queue-5.12/btrfs-don-t-clear-page-extent-mapped-if-we-re-not-in.patch @@ -0,0 +1,83 @@ +From 810e03e110396d49d9bcf633c688980fbdfea3a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 May 2021 16:50:55 +0800 +Subject: btrfs: don't clear page extent mapped if we're not invalidating the + full page + +From: Qu Wenruo + +[ Upstream commit bcd77455d590eaa0422a5e84ae852007cfce574a ] + +[BUG] +With current btrfs subpage rw support, the following script can lead to +fs hang: + + $ mkfs.btrfs -f -s 4k $dev + $ mount $dev -o nospace_cache $mnt + $ fsstress -w -n 100 -p 1 -s 1608140256 -v -d $mnt + +The fs will hang at btrfs_start_ordered_extent(). + +[CAUSE] +In above test case, btrfs_invalidate() will be called with the following +parameters: + + offset = 0 length = 53248 page dirty = 1 subpage dirty bitmap = 0x2000 + +Since @offset is 0, btrfs_invalidate() will try to invalidate the full +page, and finally call clear_page_extent_mapped() which will detach +subpage structure from the page. + +And since the page no longer has subpage structure, the subpage dirty +bitmap will be cleared, preventing the dirty range from being written +back, thus no way to wake up the ordered extent. + +[FIX] +Just follow other filesystems, only to invalidate the page if the range +covers the full page. + +There are cases like truncate_setsize() which can call +btrfs_invalidatepage() with offset == 0 and length != 0 for the last +page of an inode. + +Although the old code will still try to invalidate the full page, we are +still safe to just wait for ordered extent to finish. +So it shouldn't cause extra problems. + +Tested-by: Ritesh Harjani # [ppc64] +Tested-by: Anand Jain # [aarch64] +Signed-off-by: Qu Wenruo +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/inode.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 3e7173c7660d..1b22ded1a799 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -8386,7 +8386,19 @@ static void btrfs_invalidatepage(struct page *page, unsigned int offset, + */ + wait_on_page_writeback(page); + +- if (offset) { ++ /* ++ * For subpage case, we have call sites like ++ * btrfs_punch_hole_lock_range() which passes range not aligned to ++ * sectorsize. ++ * If the range doesn't cover the full page, we don't need to and ++ * shouldn't clear page extent mapped, as page->private can still ++ * record subpage dirty bits for other part of the range. ++ * ++ * For cases that can invalidate the full even the range doesn't ++ * cover the full page, like invalidating the last page, we're ++ * still safe to wait for ordered extent to finish. ++ */ ++ if (!(offset == 0 && length == PAGE_SIZE)) { + btrfs_releasepage(page, GFP_NOFS); + return; + } +-- +2.30.2 + diff --git a/queue-5.12/btrfs-fix-error-handling-in-__btrfs_update_delayed_i.patch b/queue-5.12/btrfs-fix-error-handling-in-__btrfs_update_delayed_i.patch new file mode 100644 index 00000000000..57e9c8306f4 --- /dev/null +++ b/queue-5.12/btrfs-fix-error-handling-in-__btrfs_update_delayed_i.patch @@ -0,0 +1,73 @@ +From 49609bc01f97ab373b264d09f214348ada644627 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 16:44:08 -0400 +Subject: btrfs: fix error handling in __btrfs_update_delayed_inode + +From: Josef Bacik + +[ Upstream commit bb385bedded3ccbd794559600de4a09448810f4a ] + +If we get an error while looking up the inode item we'll simply bail +without cleaning up the delayed node. This results in this style of +warning happening on commit: + + WARNING: CPU: 0 PID: 76403 at fs/btrfs/delayed-inode.c:1365 btrfs_assert_delayed_root_empty+0x5b/0x90 + CPU: 0 PID: 76403 Comm: fsstress Tainted: G W 5.13.0-rc1+ #373 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 + RIP: 0010:btrfs_assert_delayed_root_empty+0x5b/0x90 + RSP: 0018:ffffb8bb815a7e50 EFLAGS: 00010286 + RAX: 0000000000000000 RBX: ffff95d6d07e1888 RCX: ffff95d6c0fa3000 + RDX: 0000000000000002 RSI: 000000000029e91c RDI: ffff95d6c0fc8060 + RBP: ffff95d6c0fc8060 R08: 00008d6d701a2c1d R09: 0000000000000000 + R10: ffff95d6d1760ea0 R11: 0000000000000001 R12: ffff95d6c15a4d00 + R13: ffff95d6c0fa3000 R14: 0000000000000000 R15: ffffb8bb815a7e90 + FS: 00007f490e8dbb80(0000) GS:ffff95d73bc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007f6e75555cb0 CR3: 00000001101ce001 CR4: 0000000000370ef0 + Call Trace: + btrfs_commit_transaction+0x43c/0xb00 + ? finish_wait+0x80/0x80 + ? vfs_fsync_range+0x90/0x90 + iterate_supers+0x8c/0x100 + ksys_sync+0x50/0x90 + __do_sys_sync+0xa/0x10 + do_syscall_64+0x3d/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Because the iref isn't dropped and this leaves an elevated node->count, +so any release just re-queues it onto the delayed inodes list. Fix this +by going to the out label to handle the proper cleanup of the delayed +node. + +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/delayed-inode.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/fs/btrfs/delayed-inode.c b/fs/btrfs/delayed-inode.c +index c1d2b6786129..2f73846d712f 100644 +--- a/fs/btrfs/delayed-inode.c ++++ b/fs/btrfs/delayed-inode.c +@@ -1025,12 +1025,10 @@ static int __btrfs_update_delayed_inode(struct btrfs_trans_handle *trans, + nofs_flag = memalloc_nofs_save(); + ret = btrfs_lookup_inode(trans, root, path, &key, mod); + memalloc_nofs_restore(nofs_flag); +- if (ret > 0) { +- btrfs_release_path(path); +- return -ENOENT; +- } else if (ret < 0) { +- return ret; +- } ++ if (ret > 0) ++ ret = -ENOENT; ++ if (ret < 0) ++ goto out; + + leaf = path->nodes[0]; + inode_item = btrfs_item_ptr(leaf, path->slots[0], +-- +2.30.2 + diff --git a/queue-5.12/btrfs-fix-the-filemap_range_has_page-call-in-btrfs_p.patch b/queue-5.12/btrfs-fix-the-filemap_range_has_page-call-in-btrfs_p.patch new file mode 100644 index 00000000000..270a6041436 --- /dev/null +++ b/queue-5.12/btrfs-fix-the-filemap_range_has_page-call-in-btrfs_p.patch @@ -0,0 +1,104 @@ +From 57c6d5d75a485267c00abc94b0f5f7f0333b87b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 May 2021 16:50:54 +0800 +Subject: btrfs: fix the filemap_range_has_page() call in + btrfs_punch_hole_lock_range() + +From: Qu Wenruo + +[ Upstream commit 0528476b6ac7832f31e2ed740a57ae31316b124e ] + +[BUG] +With current subpage RW support, the following script can hang the fs +with 64K page size. + + # mkfs.btrfs -f -s 4k $dev + # mount $dev -o nospace_cache $mnt + # fsstress -w -n 50 -p 1 -s 1607749395 -d $mnt + +The kernel will do an infinite loop in btrfs_punch_hole_lock_range(). + +[CAUSE] +In btrfs_punch_hole_lock_range() we: + +- Truncate page cache range +- Lock extent io tree +- Wait any ordered extents in the range. + +We exit the loop until we meet all the following conditions: + +- No ordered extent in the lock range +- No page is in the lock range + +The latter condition has a pitfall, it only works for sector size == +PAGE_SIZE case. + +While can't handle the following subpage case: + + 0 32K 64K 96K 128K + | |///////||//////| || + +lockstart=32K +lockend=96K - 1 + +In this case, although the range crosses 2 pages, +truncate_pagecache_range() will invalidate no page at all, but only zero +the [32K, 96K) range of the two pages. + +Thus filemap_range_has_page(32K, 96K-1) will always return true, thus we +will never meet the loop exit condition. + +[FIX] +Fix the problem by doing page alignment for the lock range. + +Function filemap_range_has_page() has already handled lend < lstart +case, we only need to round up @lockstart, and round_down @lockend for +truncate_pagecache_range(). + +This modification should not change any thing for sector size == +PAGE_SIZE case, as in that case our range is already page aligned. + +Tested-by: Ritesh Harjani # [ppc64] +Tested-by: Anand Jain # [aarch64] +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/file.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index f21d98c73878..9c00cabcf0da 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -2483,6 +2483,17 @@ static int btrfs_punch_hole_lock_range(struct inode *inode, + const u64 lockend, + struct extent_state **cached_state) + { ++ /* ++ * For subpage case, if the range is not at page boundary, we could ++ * have pages at the leading/tailing part of the range. ++ * This could lead to dead loop since filemap_range_has_page() ++ * will always return true. ++ * So here we need to do extra page alignment for ++ * filemap_range_has_page(). ++ */ ++ const u64 page_lockstart = round_up(lockstart, PAGE_SIZE); ++ const u64 page_lockend = round_down(lockend + 1, PAGE_SIZE) - 1; ++ + while (1) { + struct btrfs_ordered_extent *ordered; + int ret; +@@ -2503,7 +2514,7 @@ static int btrfs_punch_hole_lock_range(struct inode *inode, + (ordered->file_offset + ordered->num_bytes <= lockstart || + ordered->file_offset > lockend)) && + !filemap_range_has_page(inode->i_mapping, +- lockstart, lockend)) { ++ page_lockstart, page_lockend)) { + if (ordered) + btrfs_put_ordered_extent(ordered); + break; +-- +2.30.2 + diff --git a/queue-5.12/btrfs-scrub-fix-subpage-repair-error-caused-by-hard-.patch b/queue-5.12/btrfs-scrub-fix-subpage-repair-error-caused-by-hard-.patch new file mode 100644 index 00000000000..c64e05665fb --- /dev/null +++ b/queue-5.12/btrfs-scrub-fix-subpage-repair-error-caused-by-hard-.patch @@ -0,0 +1,313 @@ +From 02bfe2a433757b5c38767e918b6ae7ba2e295bbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Apr 2021 19:02:46 +0800 +Subject: btrfs: scrub: fix subpage repair error caused by hard coded PAGE_SIZE + +From: Qu Wenruo + +[ Upstream commit 8df507cbb5952719353c912a021b66c27641e90c ] + +[BUG] +For the following file layout, scrub will not be able to repair all +these two repairable error, but in fact make one corruption even +unrepairable: + + inode offset 0 4k 8K +Mirror 1 |XXXXXX| | +Mirror 2 | |XXXXXX| + +[CAUSE] +The root cause is the hard coded PAGE_SIZE, which makes scrub repair to +go crazy for subpage. + +For above case, when reading the first sector, we use PAGE_SIZE other +than sectorsize to read, which makes us to read the full range [0, 64K). +In fact, after 8K there may be no data at all, we can just get some +garbage. + +Then when doing the repair, we also writeback a full page from mirror 2, +this means, we will also writeback the corrupted data in mirror 2 back +to mirror 1, leaving the range [4K, 8K) unrepairable. + +[FIX] +This patch will modify the following PAGE_SIZE use with sectorsize: + +- scrub_print_warning_inode() + Remove the min() and replace PAGE_SIZE with sectorsize. + The min() makes no sense, as csum is done for the full sector with + padding. + + This fixes a bug that subpage report extra length like: + checksum error at logical 298844160 on dev /dev/mapper/arm_nvme-test, + physical 575668224, root 5, inode 257, offset 0, length 12288, links 1 (path: file) + + Where the error is only 1 sector. + +- scrub_handle_errored_block() + Comments with PAGE|page involved, all changed to sector. + +- scrub_setup_recheck_block() +- scrub_repair_page_from_good_copy() +- scrub_add_page_to_wr_bio() +- scrub_wr_submit() +- scrub_add_page_to_rd_bio() +- scrub_block_complete() + Replace PAGE_SIZE with sectorsize. + This solves several problems where we read/write extra range for + subpage case. + +RAID56 code is excluded intentionally, as RAID56 has extra PAGE_SIZE +usage, and is not really safe enough. +Thus we will reject RAID56 for subpage in later commit. + +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/scrub.c | 82 +++++++++++++++++++++++++----------------------- + 1 file changed, 42 insertions(+), 40 deletions(-) + +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index b9202a1f1af1..37a9e1c2e2f5 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -634,7 +634,6 @@ nomem: + static int scrub_print_warning_inode(u64 inum, u64 offset, u64 root, + void *warn_ctx) + { +- u64 isize; + u32 nlink; + int ret; + int i; +@@ -670,7 +669,6 @@ static int scrub_print_warning_inode(u64 inum, u64 offset, u64 root, + eb = swarn->path->nodes[0]; + inode_item = btrfs_item_ptr(eb, swarn->path->slots[0], + struct btrfs_inode_item); +- isize = btrfs_inode_size(eb, inode_item); + nlink = btrfs_inode_nlink(eb, inode_item); + btrfs_release_path(swarn->path); + +@@ -699,12 +697,12 @@ static int scrub_print_warning_inode(u64 inum, u64 offset, u64 root, + */ + for (i = 0; i < ipath->fspath->elem_cnt; ++i) + btrfs_warn_in_rcu(fs_info, +-"%s at logical %llu on dev %s, physical %llu, root %llu, inode %llu, offset %llu, length %llu, links %u (path: %s)", ++"%s at logical %llu on dev %s, physical %llu, root %llu, inode %llu, offset %llu, length %u, links %u (path: %s)", + swarn->errstr, swarn->logical, + rcu_str_deref(swarn->dev->name), + swarn->physical, + root, inum, offset, +- min(isize - offset, (u64)PAGE_SIZE), nlink, ++ fs_info->sectorsize, nlink, + (char *)(unsigned long)ipath->fspath->val[i]); + + btrfs_put_root(local_root); +@@ -893,25 +891,25 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check) + * read all mirrors one after the other. This includes to + * re-read the extent or metadata block that failed (that was + * the cause that this fixup code is called) another time, +- * page by page this time in order to know which pages ++ * sector by sector this time in order to know which sectors + * caused I/O errors and which ones are good (for all mirrors). + * It is the goal to handle the situation when more than one + * mirror contains I/O errors, but the errors do not + * overlap, i.e. the data can be repaired by selecting the +- * pages from those mirrors without I/O error on the +- * particular pages. One example (with blocks >= 2 * PAGE_SIZE) +- * would be that mirror #1 has an I/O error on the first page, +- * the second page is good, and mirror #2 has an I/O error on +- * the second page, but the first page is good. +- * Then the first page of the first mirror can be repaired by +- * taking the first page of the second mirror, and the +- * second page of the second mirror can be repaired by +- * copying the contents of the 2nd page of the 1st mirror. +- * One more note: if the pages of one mirror contain I/O ++ * sectors from those mirrors without I/O error on the ++ * particular sectors. One example (with blocks >= 2 * sectorsize) ++ * would be that mirror #1 has an I/O error on the first sector, ++ * the second sector is good, and mirror #2 has an I/O error on ++ * the second sector, but the first sector is good. ++ * Then the first sector of the first mirror can be repaired by ++ * taking the first sector of the second mirror, and the ++ * second sector of the second mirror can be repaired by ++ * copying the contents of the 2nd sector of the 1st mirror. ++ * One more note: if the sectors of one mirror contain I/O + * errors, the checksum cannot be verified. In order to get + * the best data for repairing, the first attempt is to find + * a mirror without I/O errors and with a validated checksum. +- * Only if this is not possible, the pages are picked from ++ * Only if this is not possible, the sectors are picked from + * mirrors with I/O errors without considering the checksum. + * If the latter is the case, at the end, the checksum of the + * repaired area is verified in order to correctly maintain +@@ -1068,26 +1066,26 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check) + + /* + * In case of I/O errors in the area that is supposed to be +- * repaired, continue by picking good copies of those pages. +- * Select the good pages from mirrors to rewrite bad pages from ++ * repaired, continue by picking good copies of those sectors. ++ * Select the good sectors from mirrors to rewrite bad sectors from + * the area to fix. Afterwards verify the checksum of the block + * that is supposed to be repaired. This verification step is + * only done for the purpose of statistic counting and for the + * final scrub report, whether errors remain. + * A perfect algorithm could make use of the checksum and try +- * all possible combinations of pages from the different mirrors ++ * all possible combinations of sectors from the different mirrors + * until the checksum verification succeeds. For example, when +- * the 2nd page of mirror #1 faces I/O errors, and the 2nd page ++ * the 2nd sector of mirror #1 faces I/O errors, and the 2nd sector + * of mirror #2 is readable but the final checksum test fails, +- * then the 2nd page of mirror #3 could be tried, whether now ++ * then the 2nd sector of mirror #3 could be tried, whether now + * the final checksum succeeds. But this would be a rare + * exception and is therefore not implemented. At least it is + * avoided that the good copy is overwritten. + * A more useful improvement would be to pick the sectors + * without I/O error based on sector sizes (512 bytes on legacy +- * disks) instead of on PAGE_SIZE. Then maybe 512 byte of one ++ * disks) instead of on sectorsize. Then maybe 512 byte of one + * mirror could be repaired by taking 512 byte of a different +- * mirror, even if other 512 byte sectors in the same PAGE_SIZE ++ * mirror, even if other 512 byte sectors in the same sectorsize + * area are unreadable. + */ + success = 1; +@@ -1268,7 +1266,7 @@ static int scrub_setup_recheck_block(struct scrub_block *original_sblock, + { + struct scrub_ctx *sctx = original_sblock->sctx; + struct btrfs_fs_info *fs_info = sctx->fs_info; +- u64 length = original_sblock->page_count * PAGE_SIZE; ++ u64 length = original_sblock->page_count * fs_info->sectorsize; + u64 logical = original_sblock->pagev[0]->logical; + u64 generation = original_sblock->pagev[0]->generation; + u64 flags = original_sblock->pagev[0]->flags; +@@ -1291,13 +1289,13 @@ static int scrub_setup_recheck_block(struct scrub_block *original_sblock, + */ + + while (length > 0) { +- sublen = min_t(u64, length, PAGE_SIZE); ++ sublen = min_t(u64, length, fs_info->sectorsize); + mapped_length = sublen; + bbio = NULL; + + /* +- * with a length of PAGE_SIZE, each returned stripe +- * represents one mirror ++ * With a length of sectorsize, each returned stripe represents ++ * one mirror + */ + btrfs_bio_counter_inc_blocked(fs_info); + ret = btrfs_map_sblock(fs_info, BTRFS_MAP_GET_READ_MIRRORS, +@@ -1488,7 +1486,7 @@ static void scrub_recheck_block(struct btrfs_fs_info *fs_info, + bio = btrfs_io_bio_alloc(1); + bio_set_dev(bio, spage->dev->bdev); + +- bio_add_page(bio, spage->page, PAGE_SIZE, 0); ++ bio_add_page(bio, spage->page, fs_info->sectorsize, 0); + bio->bi_iter.bi_sector = spage->physical >> 9; + bio->bi_opf = REQ_OP_READ; + +@@ -1552,6 +1550,7 @@ static int scrub_repair_page_from_good_copy(struct scrub_block *sblock_bad, + struct scrub_page *spage_bad = sblock_bad->pagev[page_num]; + struct scrub_page *spage_good = sblock_good->pagev[page_num]; + struct btrfs_fs_info *fs_info = sblock_bad->sctx->fs_info; ++ const u32 sectorsize = fs_info->sectorsize; + + BUG_ON(spage_bad->page == NULL); + BUG_ON(spage_good->page == NULL); +@@ -1571,8 +1570,8 @@ static int scrub_repair_page_from_good_copy(struct scrub_block *sblock_bad, + bio->bi_iter.bi_sector = spage_bad->physical >> 9; + bio->bi_opf = REQ_OP_WRITE; + +- ret = bio_add_page(bio, spage_good->page, PAGE_SIZE, 0); +- if (PAGE_SIZE != ret) { ++ ret = bio_add_page(bio, spage_good->page, sectorsize, 0); ++ if (ret != sectorsize) { + bio_put(bio); + return -EIO; + } +@@ -1650,6 +1649,7 @@ static int scrub_add_page_to_wr_bio(struct scrub_ctx *sctx, + { + struct scrub_bio *sbio; + int ret; ++ const u32 sectorsize = sctx->fs_info->sectorsize; + + mutex_lock(&sctx->wr_lock); + again: +@@ -1689,16 +1689,16 @@ again: + bio->bi_iter.bi_sector = sbio->physical >> 9; + bio->bi_opf = REQ_OP_WRITE; + sbio->status = 0; +- } else if (sbio->physical + sbio->page_count * PAGE_SIZE != ++ } else if (sbio->physical + sbio->page_count * sectorsize != + spage->physical_for_dev_replace || +- sbio->logical + sbio->page_count * PAGE_SIZE != ++ sbio->logical + sbio->page_count * sectorsize != + spage->logical) { + scrub_wr_submit(sctx); + goto again; + } + +- ret = bio_add_page(sbio->bio, spage->page, PAGE_SIZE, 0); +- if (ret != PAGE_SIZE) { ++ ret = bio_add_page(sbio->bio, spage->page, sectorsize, 0); ++ if (ret != sectorsize) { + if (sbio->page_count < 1) { + bio_put(sbio->bio); + sbio->bio = NULL; +@@ -1737,7 +1737,8 @@ static void scrub_wr_submit(struct scrub_ctx *sctx) + btrfsic_submit_bio(sbio->bio); + + if (btrfs_is_zoned(sctx->fs_info)) +- sctx->write_pointer = sbio->physical + sbio->page_count * PAGE_SIZE; ++ sctx->write_pointer = sbio->physical + sbio->page_count * ++ sctx->fs_info->sectorsize; + } + + static void scrub_wr_bio_end_io(struct bio *bio) +@@ -2014,6 +2015,7 @@ static int scrub_add_page_to_rd_bio(struct scrub_ctx *sctx, + { + struct scrub_block *sblock = spage->sblock; + struct scrub_bio *sbio; ++ const u32 sectorsize = sctx->fs_info->sectorsize; + int ret; + + again: +@@ -2052,9 +2054,9 @@ again: + bio->bi_iter.bi_sector = sbio->physical >> 9; + bio->bi_opf = REQ_OP_READ; + sbio->status = 0; +- } else if (sbio->physical + sbio->page_count * PAGE_SIZE != ++ } else if (sbio->physical + sbio->page_count * sectorsize != + spage->physical || +- sbio->logical + sbio->page_count * PAGE_SIZE != ++ sbio->logical + sbio->page_count * sectorsize != + spage->logical || + sbio->dev != spage->dev) { + scrub_submit(sctx); +@@ -2062,8 +2064,8 @@ again: + } + + sbio->pagev[sbio->page_count] = spage; +- ret = bio_add_page(sbio->bio, spage->page, PAGE_SIZE, 0); +- if (ret != PAGE_SIZE) { ++ ret = bio_add_page(sbio->bio, spage->page, sectorsize, 0); ++ if (ret != sectorsize) { + if (sbio->page_count < 1) { + bio_put(sbio->bio); + sbio->bio = NULL; +@@ -2406,7 +2408,7 @@ static void scrub_block_complete(struct scrub_block *sblock) + if (sblock->sparity && corrupted && !sblock->data_corrected) { + u64 start = sblock->pagev[0]->logical; + u64 end = sblock->pagev[sblock->page_count - 1]->logical + +- PAGE_SIZE; ++ sblock->sctx->fs_info->sectorsize; + + ASSERT(end - start <= U32_MAX); + scrub_parity_mark_sectors_error(sblock->sparity, +-- +2.30.2 + diff --git a/queue-5.12/btrfs-sysfs-fix-format-string-for-some-discard-stats.patch b/queue-5.12/btrfs-sysfs-fix-format-string-for-some-discard-stats.patch new file mode 100644 index 00000000000..0c7c3260b35 --- /dev/null +++ b/queue-5.12/btrfs-sysfs-fix-format-string-for-some-discard-stats.patch @@ -0,0 +1,46 @@ +From eac31bfc2bea5d7446b3f412026f76b2722d884a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 May 2021 20:00:14 +0200 +Subject: btrfs: sysfs: fix format string for some discard stats + +From: David Sterba + +[ Upstream commit 8c5ec995616f1202ab92e195fd75d6f60d86f85c ] + +The type of discard_bitmap_bytes and discard_extent_bytes is u64 so the +format should be %llu, though the actual values would hardly ever +overflow to negative values. + +Reviewed-by: Qu Wenruo +Reviewed-by: Anand Jain +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/sysfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c +index 6eb1c50fa98c..bd95446869d0 100644 +--- a/fs/btrfs/sysfs.c ++++ b/fs/btrfs/sysfs.c +@@ -414,7 +414,7 @@ static ssize_t btrfs_discard_bitmap_bytes_show(struct kobject *kobj, + { + struct btrfs_fs_info *fs_info = discard_to_fs_info(kobj); + +- return scnprintf(buf, PAGE_SIZE, "%lld\n", ++ return scnprintf(buf, PAGE_SIZE, "%llu\n", + fs_info->discard_ctl.discard_bitmap_bytes); + } + BTRFS_ATTR(discard, discard_bitmap_bytes, btrfs_discard_bitmap_bytes_show); +@@ -436,7 +436,7 @@ static ssize_t btrfs_discard_extent_bytes_show(struct kobject *kobj, + { + struct btrfs_fs_info *fs_info = discard_to_fs_info(kobj); + +- return scnprintf(buf, PAGE_SIZE, "%lld\n", ++ return scnprintf(buf, PAGE_SIZE, "%llu\n", + fs_info->discard_ctl.discard_extent_bytes); + } + BTRFS_ATTR(discard, discard_extent_bytes, btrfs_discard_extent_bytes_show); +-- +2.30.2 + diff --git a/queue-5.12/can-j1939-j1939_sk_setsockopt-prevent-allocation-of-.patch b/queue-5.12/can-j1939-j1939_sk_setsockopt-prevent-allocation-of-.patch new file mode 100644 index 00000000000..26e570e2e7b --- /dev/null +++ b/queue-5.12/can-j1939-j1939_sk_setsockopt-prevent-allocation-of-.patch @@ -0,0 +1,42 @@ +From 0c91e39e78cb78533372f91bb8a3b5e84b95f3c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Jun 2021 14:38:42 +0200 +Subject: can: j1939: j1939_sk_setsockopt(): prevent allocation of j1939 filter + for optlen == 0 + +From: Norbert Slusarek + +[ Upstream commit aaf473d0100f64abc88560e2bea905805bcf2a8e ] + +If optval != NULL and optlen == 0 are specified for SO_J1939_FILTER in +j1939_sk_setsockopt(), memdup_sockptr() will return ZERO_PTR for 0 +size allocation. The new filter will be mistakenly assigned ZERO_PTR. +This patch checks for optlen != 0 and filter will be assigned NULL in +case of optlen == 0. + +Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") +Link: https://lore.kernel.org/r/20210620123842.117975-1-nslusarek@gmx.net +Signed-off-by: Norbert Slusarek +Acked-by: Oleksij Rempel +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/j1939/socket.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c +index fce8bc8afeb7..e1a399821238 100644 +--- a/net/can/j1939/socket.c ++++ b/net/can/j1939/socket.c +@@ -676,7 +676,7 @@ static int j1939_sk_setsockopt(struct socket *sock, int level, int optname, + + switch (optname) { + case SO_J1939_FILTER: +- if (!sockptr_is_null(optval)) { ++ if (!sockptr_is_null(optval) && optlen != 0) { + struct j1939_filter *f; + int c; + +-- +2.30.2 + diff --git a/queue-5.12/char-pcmcia-error-out-if-num_bytes_read-is-greater-t.patch b/queue-5.12/char-pcmcia-error-out-if-num_bytes_read-is-greater-t.patch new file mode 100644 index 00000000000..4558ea2f446 --- /dev/null +++ b/queue-5.12/char-pcmcia-error-out-if-num_bytes_read-is-greater-t.patch @@ -0,0 +1,41 @@ +From a7d38db516a5f5c80964bc151c05f5aeca89184c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 20:06:17 +0800 +Subject: char: pcmcia: error out if 'num_bytes_read' is greater than 4 in + set_protocol() + +From: Yu Kuai + +[ Upstream commit 37188559c610f1b7eec83c8e448936c361c578de ] + +Theoretically, it will cause index out of bounds error if +'num_bytes_read' is greater than 4. As we expect it(and was tested) +never to be greater than 4, error out if it happens. + +Fixes: c1986ee9bea3 ("[PATCH] New Omnikey Cardman 4000 driver") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20210521120617.138396-1-yukuai3@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/char/pcmcia/cm4000_cs.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c +index 89681f07bc78..9468e9520cee 100644 +--- a/drivers/char/pcmcia/cm4000_cs.c ++++ b/drivers/char/pcmcia/cm4000_cs.c +@@ -544,6 +544,10 @@ static int set_protocol(struct cm4000_dev *dev, struct ptsreq *ptsreq) + io_read_num_rec_bytes(iobase, &num_bytes_read); + if (num_bytes_read >= 4) { + DEBUGP(2, dev, "NumRecBytes = %i\n", num_bytes_read); ++ if (num_bytes_read > 4) { ++ rc = -EIO; ++ goto exit_setprotocol; ++ } + break; + } + usleep_range(10000, 11000); +-- +2.30.2 + diff --git a/queue-5.12/cifs-fix-check-of-dfs-interlinks.patch b/queue-5.12/cifs-fix-check-of-dfs-interlinks.patch new file mode 100644 index 00000000000..8e10f9fe79a --- /dev/null +++ b/queue-5.12/cifs-fix-check-of-dfs-interlinks.patch @@ -0,0 +1,58 @@ +From 381f3b98b7b4d08c7ff9d7b363fde7166227a7fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 12:58:20 -0300 +Subject: cifs: fix check of dfs interlinks + +From: Paulo Alcantara + +[ Upstream commit 889c2a700799f3b6f82210925e1faf4a9b833c4a ] + +Interlink is a special type of DFS link that resolves to a different +DFS domain-based namespace. To determine whether it is an interlink +or not, check if ReferralServers and StorageServers bits are set to 1 +and 0 respectively in ReferralHeaderFlags, as specified in MS-DFSC +3.1.5.4.5 Determining Whether a Referral Response is an Interlink. + +Signed-off-by: Paulo Alcantara (SUSE) +Reviewed-by: Aurelien Aptel +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/dfs_cache.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/fs/cifs/dfs_cache.c b/fs/cifs/dfs_cache.c +index 098b4bc8da59..d2d686ee10a3 100644 +--- a/fs/cifs/dfs_cache.c ++++ b/fs/cifs/dfs_cache.c +@@ -25,8 +25,7 @@ + #define CACHE_HTABLE_SIZE 32 + #define CACHE_MAX_ENTRIES 64 + +-#define IS_INTERLINK_SET(v) ((v) & (DFSREF_REFERRAL_SERVER | \ +- DFSREF_STORAGE_SERVER)) ++#define IS_DFS_INTERLINK(v) (((v) & DFSREF_REFERRAL_SERVER) && !((v) & DFSREF_STORAGE_SERVER)) + + struct cache_dfs_tgt { + char *name; +@@ -170,7 +169,7 @@ static int dfscache_proc_show(struct seq_file *m, void *v) + "cache entry: path=%s,type=%s,ttl=%d,etime=%ld,hdr_flags=0x%x,ref_flags=0x%x,interlink=%s,path_consumed=%d,expired=%s\n", + ce->path, ce->srvtype == DFS_TYPE_ROOT ? "root" : "link", + ce->ttl, ce->etime.tv_nsec, ce->ref_flags, ce->hdr_flags, +- IS_INTERLINK_SET(ce->hdr_flags) ? "yes" : "no", ++ IS_DFS_INTERLINK(ce->hdr_flags) ? "yes" : "no", + ce->path_consumed, cache_entry_expired(ce) ? "yes" : "no"); + + list_for_each_entry(t, &ce->tlist, list) { +@@ -239,7 +238,7 @@ static inline void dump_ce(const struct cache_entry *ce) + ce->srvtype == DFS_TYPE_ROOT ? "root" : "link", ce->ttl, + ce->etime.tv_nsec, + ce->hdr_flags, ce->ref_flags, +- IS_INTERLINK_SET(ce->hdr_flags) ? "yes" : "no", ++ IS_DFS_INTERLINK(ce->hdr_flags) ? "yes" : "no", + ce->path_consumed, + cache_entry_expired(ce) ? "yes" : "no"); + dump_tgts(ce); +-- +2.30.2 + diff --git a/queue-5.12/cifs-fix-missing-spinlock-around-update-to-ses-statu.patch b/queue-5.12/cifs-fix-missing-spinlock-around-update-to-ses-statu.patch new file mode 100644 index 00000000000..35d72a91be9 --- /dev/null +++ b/queue-5.12/cifs-fix-missing-spinlock-around-update-to-ses-statu.patch @@ -0,0 +1,63 @@ +From 15ccb219463955c7df6abaa2b58e23b191c91191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 15:28:04 -0500 +Subject: cifs: fix missing spinlock around update to ses->status + +From: Steve French + +[ Upstream commit 0060a4f28a9ef45ae8163c0805e944a2b1546762 ] + +In the other places where we update ses->status we protect the +updates via GlobalMid_Lock. So to be consistent add the same +locking around it in cifs_put_smb_ses where it was missing. + +Addresses-Coverity: 1268904 ("Data race condition") +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/cifsglob.h | 3 ++- + fs/cifs/connect.c | 5 ++++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index ec824ab8c5ca..723b97002d8d 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -896,7 +896,7 @@ struct cifs_ses { + struct mutex session_mutex; + struct TCP_Server_Info *server; /* pointer to server info */ + int ses_count; /* reference counter */ +- enum statusEnum status; ++ enum statusEnum status; /* updates protected by GlobalMid_Lock */ + unsigned overrideSecFlg; /* if non-zero override global sec flags */ + char *serverOS; /* name of operating system underlying server */ + char *serverNOS; /* name of network operating system of server */ +@@ -1783,6 +1783,7 @@ require use of the stronger protocol */ + * list operations on pending_mid_q and oplockQ + * updates to XID counters, multiplex id and SMB sequence numbers + * list operations on global DnotifyReqList ++ * updates to ses->status + * tcp_ses_lock protects: + * list operations on tcp and SMB session lists + * tcon->open_file_lock protects the list of open files hanging off the tcon +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 3d62d52d730b..09a3939f25bf 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -1639,9 +1639,12 @@ void cifs_put_smb_ses(struct cifs_ses *ses) + spin_unlock(&cifs_tcp_ses_lock); + return; + } ++ spin_unlock(&cifs_tcp_ses_lock); ++ ++ spin_lock(&GlobalMid_Lock); + if (ses->status == CifsGood) + ses->status = CifsExiting; +- spin_unlock(&cifs_tcp_ses_lock); ++ spin_unlock(&GlobalMid_Lock); + + cifs_free_ipc(ses); + +-- +2.30.2 + diff --git a/queue-5.12/cifs-improve-fallocate-emulation.patch b/queue-5.12/cifs-improve-fallocate-emulation.patch new file mode 100644 index 00000000000..9364cf9692c --- /dev/null +++ b/queue-5.12/cifs-improve-fallocate-emulation.patch @@ -0,0 +1,191 @@ +From 16ef42a640c875574ca20f119e882133b3cdd7be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 15:31:01 +1000 +Subject: cifs: improve fallocate emulation + +From: Ronnie Sahlberg + +[ Upstream commit 966a3cb7c7db786452a87afdc3b48858fc4d4d6b ] + +RHBZ: 1866684 + +We don't have a real fallocate in the SMB2 protocol so we used to emulate fallocate +by simply switching the file to become non-sparse. But as that could potantially consume +a lot more data than we intended to fallocate (large sparse file and fallocating a thin +slice in the middle) we would only do this IFF the fallocate request was for virtually +the entire file. + +This patch improves this and starts allowing us to fallocate smaller chunks of a file by +overwriting the region with 0, for the parts that are unallocated. + +The method used is to first query the server for FSCTL_QUERY_ALLOCATED_RANGES to find what +is unallocated in the fallocate range and then to only overwrite-with-zero the unallocated +ranges to fill in the holes. + +As overwriting-with-zero is different from just allocating blocks, and potentially much +more expensive, we limit this to only allow fallocate ranges up to 1Mb in size. + +Reported-by: kernel test robot +Signed-off-by: Ronnie Sahlberg +Acked-by: Aurelien Aptel +Acked-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2ops.c | 133 ++++++++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 133 insertions(+) + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index e9a530da4255..ea5e958fd6b0 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -3561,6 +3561,119 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon, + return rc; + } + ++static int smb3_simple_fallocate_write_range(unsigned int xid, ++ struct cifs_tcon *tcon, ++ struct cifsFileInfo *cfile, ++ loff_t off, loff_t len, ++ char *buf) ++{ ++ struct cifs_io_parms io_parms = {0}; ++ int nbytes; ++ struct kvec iov[2]; ++ ++ io_parms.netfid = cfile->fid.netfid; ++ io_parms.pid = current->tgid; ++ io_parms.tcon = tcon; ++ io_parms.persistent_fid = cfile->fid.persistent_fid; ++ io_parms.volatile_fid = cfile->fid.volatile_fid; ++ io_parms.offset = off; ++ io_parms.length = len; ++ ++ /* iov[0] is reserved for smb header */ ++ iov[1].iov_base = buf; ++ iov[1].iov_len = io_parms.length; ++ return SMB2_write(xid, &io_parms, &nbytes, iov, 1); ++} ++ ++static int smb3_simple_fallocate_range(unsigned int xid, ++ struct cifs_tcon *tcon, ++ struct cifsFileInfo *cfile, ++ loff_t off, loff_t len) ++{ ++ struct file_allocated_range_buffer in_data, *out_data = NULL, *tmp_data; ++ u32 out_data_len; ++ char *buf = NULL; ++ loff_t l; ++ int rc; ++ ++ in_data.file_offset = cpu_to_le64(off); ++ in_data.length = cpu_to_le64(len); ++ rc = SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid, ++ cfile->fid.volatile_fid, ++ FSCTL_QUERY_ALLOCATED_RANGES, true, ++ (char *)&in_data, sizeof(in_data), ++ 1024 * sizeof(struct file_allocated_range_buffer), ++ (char **)&out_data, &out_data_len); ++ if (rc) ++ goto out; ++ /* ++ * It is already all allocated ++ */ ++ if (out_data_len == 0) ++ goto out; ++ ++ buf = kzalloc(1024 * 1024, GFP_KERNEL); ++ if (buf == NULL) { ++ rc = -ENOMEM; ++ goto out; ++ } ++ ++ tmp_data = out_data; ++ while (len) { ++ /* ++ * The rest of the region is unmapped so write it all. ++ */ ++ if (out_data_len == 0) { ++ rc = smb3_simple_fallocate_write_range(xid, tcon, ++ cfile, off, len, buf); ++ goto out; ++ } ++ ++ if (out_data_len < sizeof(struct file_allocated_range_buffer)) { ++ rc = -EINVAL; ++ goto out; ++ } ++ ++ if (off < le64_to_cpu(tmp_data->file_offset)) { ++ /* ++ * We are at a hole. Write until the end of the region ++ * or until the next allocated data, ++ * whichever comes next. ++ */ ++ l = le64_to_cpu(tmp_data->file_offset) - off; ++ if (len < l) ++ l = len; ++ rc = smb3_simple_fallocate_write_range(xid, tcon, ++ cfile, off, l, buf); ++ if (rc) ++ goto out; ++ off = off + l; ++ len = len - l; ++ if (len == 0) ++ goto out; ++ } ++ /* ++ * We are at a section of allocated data, just skip forward ++ * until the end of the data or the end of the region ++ * we are supposed to fallocate, whichever comes first. ++ */ ++ l = le64_to_cpu(tmp_data->length); ++ if (len < l) ++ l = len; ++ off += l; ++ len -= l; ++ ++ tmp_data = &tmp_data[1]; ++ out_data_len -= sizeof(struct file_allocated_range_buffer); ++ } ++ ++ out: ++ kfree(out_data); ++ kfree(buf); ++ return rc; ++} ++ ++ + static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon, + loff_t off, loff_t len, bool keep_size) + { +@@ -3621,6 +3734,26 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon, + } + + if ((keep_size == true) || (i_size_read(inode) >= off + len)) { ++ /* ++ * At this point, we are trying to fallocate an internal ++ * regions of a sparse file. Since smb2 does not have a ++ * fallocate command we have two otions on how to emulate this. ++ * We can either turn the entire file to become non-sparse ++ * which we only do if the fallocate is for virtually ++ * the whole file, or we can overwrite the region with zeroes ++ * using SMB2_write, which could be prohibitevly expensive ++ * if len is large. ++ */ ++ /* ++ * We are only trying to fallocate a small region so ++ * just write it with zero. ++ */ ++ if (len <= 1024 * 1024) { ++ rc = smb3_simple_fallocate_range(xid, tcon, cfile, ++ off, len); ++ goto out; ++ } ++ + /* + * Check if falloc starts within first few pages of file + * and ends within a few pages of the end of file to +-- +2.30.2 + diff --git a/queue-5.12/clk-actions-fix-ahpprediv-h-ahb-clock-chain-on-owl-s.patch b/queue-5.12/clk-actions-fix-ahpprediv-h-ahb-clock-chain-on-owl-s.patch new file mode 100644 index 00000000000..bfbac597440 --- /dev/null +++ b/queue-5.12/clk-actions-fix-ahpprediv-h-ahb-clock-chain-on-owl-s.patch @@ -0,0 +1,91 @@ +From fd08fb4efbe95dce0603388ee89f65f7c82e3f4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 23:05:24 +0300 +Subject: clk: actions: Fix AHPPREDIV-H-AHB clock chain on Owl S500 SoC + +From: Cristian Ciocaltea + +[ Upstream commit fd90b5b9045274360b12cea0f2ce50f3bcfb25cc ] + +There are a few issues with the setup of the Actions Semi Owl S500 SoC's +clock chain involving AHPPREDIV, H and AHB clocks: + +* AHBPREDIV clock is defined as a muxer only, although it also acts as + a divider. +* H clock is using a wrong divider register offset +* AHB is defined as a multi-rate factor clock, but it is actually just + a fixed pass clock. + +Let's provide the following fixes: + +* Change AHBPREDIV clock to an ungated OWL_COMP_DIV definition. +* Use the correct register shift value in the OWL_DIVIDER definition + for H clock +* Drop the unneeded 'ahb_factor_table[]' and change AHB clock to an + ungated OWL_COMP_FIXED_FACTOR definition. + +Fixes: ed6b4795ece4 ("clk: actions: Add clock driver for S500 SoC") +Signed-off-by: Cristian Ciocaltea +Link: https://lore.kernel.org/r/21c1abd19a7089b65a34852ac6513961be88cbe1.1623354574.git.cristian.ciocaltea@gmail.com +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/actions/owl-s500.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/drivers/clk/actions/owl-s500.c b/drivers/clk/actions/owl-s500.c +index 42d6899755e6..cbeb51c804eb 100644 +--- a/drivers/clk/actions/owl-s500.c ++++ b/drivers/clk/actions/owl-s500.c +@@ -153,11 +153,6 @@ static struct clk_factor_table hde_factor_table[] = { + { 0, 0, 0 }, + }; + +-static struct clk_factor_table ahb_factor_table[] = { +- { 1, 1, 2 }, { 2, 1, 3 }, +- { 0, 0, 0 }, +-}; +- + static struct clk_div_table rmii_ref_div_table[] = { + { 0, 4 }, { 1, 10 }, + { 0, 0 }, +@@ -186,7 +181,6 @@ static struct clk_div_table nand_div_table[] = { + + /* mux clock */ + static OWL_MUX(dev_clk, "dev_clk", dev_clk_mux_p, CMU_DEVPLL, 12, 1, CLK_SET_RATE_PARENT); +-static OWL_MUX(ahbprediv_clk, "ahbprediv_clk", ahbprediv_clk_mux_p, CMU_BUSCLK1, 8, 3, CLK_SET_RATE_PARENT); + + /* gate clocks */ + static OWL_GATE(gpio_clk, "gpio_clk", "apb_clk", CMU_DEVCLKEN0, 18, 0, 0); +@@ -199,16 +193,25 @@ static OWL_GATE(timer_clk, "timer_clk", "hosc", CMU_DEVCLKEN1, 27, 0, 0); + static OWL_GATE(hdmi_clk, "hdmi_clk", "hosc", CMU_DEVCLKEN1, 3, 0, 0); + + /* divider clocks */ +-static OWL_DIVIDER(h_clk, "h_clk", "ahbprediv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0); ++static OWL_DIVIDER(h_clk, "h_clk", "ahbprediv_clk", CMU_BUSCLK1, 2, 2, NULL, 0, 0); + static OWL_DIVIDER(apb_clk, "apb_clk", "ahb_clk", CMU_BUSCLK1, 14, 2, NULL, 0, 0); + static OWL_DIVIDER(rmii_ref_clk, "rmii_ref_clk", "ethernet_pll_clk", CMU_ETHERNETPLL, 1, 1, rmii_ref_div_table, 0, 0); + + /* factor clocks */ +-static OWL_FACTOR(ahb_clk, "ahb_clk", "h_clk", CMU_BUSCLK1, 2, 2, ahb_factor_table, 0, 0); + static OWL_FACTOR(de1_clk, "de_clk1", "de_clk", CMU_DECLK, 0, 4, de_factor_table, 0, 0); + static OWL_FACTOR(de2_clk, "de_clk2", "de_clk", CMU_DECLK, 4, 4, de_factor_table, 0, 0); + + /* composite clocks */ ++static OWL_COMP_DIV(ahbprediv_clk, "ahbprediv_clk", ahbprediv_clk_mux_p, ++ OWL_MUX_HW(CMU_BUSCLK1, 8, 3), ++ { 0 }, ++ OWL_DIVIDER_HW(CMU_BUSCLK1, 12, 2, 0, NULL), ++ CLK_SET_RATE_PARENT); ++ ++static OWL_COMP_FIXED_FACTOR(ahb_clk, "ahb_clk", "h_clk", ++ { 0 }, ++ 1, 1, 0); ++ + static OWL_COMP_FACTOR(vce_clk, "vce_clk", hde_clk_mux_p, + OWL_MUX_HW(CMU_VCECLK, 4, 2), + OWL_GATE_HW(CMU_DEVCLKEN0, 26, 0), +-- +2.30.2 + diff --git a/queue-5.12/clk-actions-fix-bisp_factor_table-based-clocks-on-ow.patch b/queue-5.12/clk-actions-fix-bisp_factor_table-based-clocks-on-ow.patch new file mode 100644 index 00000000000..5aee3bac7d8 --- /dev/null +++ b/queue-5.12/clk-actions-fix-bisp_factor_table-based-clocks-on-ow.patch @@ -0,0 +1,143 @@ +From c6ee827a9c5b3de9f43c17c8c4da5c6b9ed4d279 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 23:05:23 +0300 +Subject: clk: actions: Fix bisp_factor_table based clocks on Owl S500 SoC + +From: Cristian Ciocaltea + +[ Upstream commit a8f1f03caa51aa7a69c671aa87c475034db7d368 ] + +The following clocks of the Actions Semi Owl S500 SoC have been defined +to use a shared clock factor table 'bisp_factor_table[]': DE[1-2], VCE, +VDE, BISP, SENSOR[0-1] + +There are several issues involved in this approach: + +* 'bisp_factor_table[]' describes the configuration of a regular 8-rates + divider, so its usage is redundant. Additionally, judging by the BISP + clock context, it is incomplete since it maps only 8 out of 12 + possible entries. + +* The clocks mentioned above are not identical in terms of the available + rates, therefore cannot rely on the same factor table. Specifically, + BISP and SENSOR* are standard 12-rate dividers so their configuration + should rely on a proper clock div table, while VCE and VDE require a + factor table that is a actually a subset of the one needed for DE[1-2] + clocks. + +Let's fix this by implementing the following: + +* Add new factor tables 'de_factor_table' and 'hde_factor_table' to + properly handle DE[1-2], VCE and VDE clocks. + +* Add a common div table 'std12rate_div_table' for BISP and SENSOR[0-1] + clocks converted to OWL_COMP_DIV. + +* Drop the now unused 'bisp_factor_table[]'. + +Additionally, drop the CLK_IGNORE_UNUSED flag for SENSOR[0-1] since +there is no reason to always keep ON those clocks. + +Fixes: ed6b4795ece4 ("clk: actions: Add clock driver for S500 SoC") +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/e675820a46cd9930d8d576c6cae61d41c1a8416f.1623354574.git.cristian.ciocaltea@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/actions/owl-s500.c | 44 ++++++++++++++++++++++------------ + 1 file changed, 29 insertions(+), 15 deletions(-) + +diff --git a/drivers/clk/actions/owl-s500.c b/drivers/clk/actions/owl-s500.c +index 42abdf964044..42d6899755e6 100644 +--- a/drivers/clk/actions/owl-s500.c ++++ b/drivers/clk/actions/owl-s500.c +@@ -140,9 +140,16 @@ static struct clk_factor_table sd_factor_table[] = { + { 0, 0, 0 }, + }; + +-static struct clk_factor_table bisp_factor_table[] = { +- { 0, 1, 1 }, { 1, 1, 2 }, { 2, 1, 3 }, { 3, 1, 4 }, +- { 4, 1, 5 }, { 5, 1, 6 }, { 6, 1, 7 }, { 7, 1, 8 }, ++static struct clk_factor_table de_factor_table[] = { ++ { 0, 1, 1 }, { 1, 2, 3 }, { 2, 1, 2 }, { 3, 2, 5 }, ++ { 4, 1, 3 }, { 5, 1, 4 }, { 6, 1, 6 }, { 7, 1, 8 }, ++ { 8, 1, 12 }, ++ { 0, 0, 0 }, ++}; ++ ++static struct clk_factor_table hde_factor_table[] = { ++ { 0, 1, 1 }, { 1, 2, 3 }, { 2, 1, 2 }, { 3, 2, 5 }, ++ { 4, 1, 3 }, { 5, 1, 4 }, { 6, 1, 6 }, { 7, 1, 8 }, + { 0, 0, 0 }, + }; + +@@ -156,6 +163,13 @@ static struct clk_div_table rmii_ref_div_table[] = { + { 0, 0 }, + }; + ++static struct clk_div_table std12rate_div_table[] = { ++ { 0, 1 }, { 1, 2 }, { 2, 3 }, { 3, 4 }, ++ { 4, 5 }, { 5, 6 }, { 6, 7 }, { 7, 8 }, ++ { 8, 9 }, { 9, 10 }, { 10, 11 }, { 11, 12 }, ++ { 0, 0 }, ++}; ++ + static struct clk_div_table i2s_div_table[] = { + { 0, 1 }, { 1, 2 }, { 2, 3 }, { 3, 4 }, + { 4, 6 }, { 5, 8 }, { 6, 12 }, { 7, 16 }, +@@ -191,39 +205,39 @@ static OWL_DIVIDER(rmii_ref_clk, "rmii_ref_clk", "ethernet_pll_clk", CMU_ETHERNE + + /* factor clocks */ + static OWL_FACTOR(ahb_clk, "ahb_clk", "h_clk", CMU_BUSCLK1, 2, 2, ahb_factor_table, 0, 0); +-static OWL_FACTOR(de1_clk, "de_clk1", "de_clk", CMU_DECLK, 0, 3, bisp_factor_table, 0, 0); +-static OWL_FACTOR(de2_clk, "de_clk2", "de_clk", CMU_DECLK, 4, 3, bisp_factor_table, 0, 0); ++static OWL_FACTOR(de1_clk, "de_clk1", "de_clk", CMU_DECLK, 0, 4, de_factor_table, 0, 0); ++static OWL_FACTOR(de2_clk, "de_clk2", "de_clk", CMU_DECLK, 4, 4, de_factor_table, 0, 0); + + /* composite clocks */ + static OWL_COMP_FACTOR(vce_clk, "vce_clk", hde_clk_mux_p, + OWL_MUX_HW(CMU_VCECLK, 4, 2), + OWL_GATE_HW(CMU_DEVCLKEN0, 26, 0), +- OWL_FACTOR_HW(CMU_VCECLK, 0, 3, 0, bisp_factor_table), ++ OWL_FACTOR_HW(CMU_VCECLK, 0, 3, 0, hde_factor_table), + 0); + + static OWL_COMP_FACTOR(vde_clk, "vde_clk", hde_clk_mux_p, + OWL_MUX_HW(CMU_VDECLK, 4, 2), + OWL_GATE_HW(CMU_DEVCLKEN0, 25, 0), +- OWL_FACTOR_HW(CMU_VDECLK, 0, 3, 0, bisp_factor_table), ++ OWL_FACTOR_HW(CMU_VDECLK, 0, 3, 0, hde_factor_table), + 0); + +-static OWL_COMP_FACTOR(bisp_clk, "bisp_clk", bisp_clk_mux_p, ++static OWL_COMP_DIV(bisp_clk, "bisp_clk", bisp_clk_mux_p, + OWL_MUX_HW(CMU_BISPCLK, 4, 1), + OWL_GATE_HW(CMU_DEVCLKEN0, 14, 0), +- OWL_FACTOR_HW(CMU_BISPCLK, 0, 3, 0, bisp_factor_table), ++ OWL_DIVIDER_HW(CMU_BISPCLK, 0, 4, 0, std12rate_div_table), + 0); + +-static OWL_COMP_FACTOR(sensor0_clk, "sensor0_clk", sensor_clk_mux_p, ++static OWL_COMP_DIV(sensor0_clk, "sensor0_clk", sensor_clk_mux_p, + OWL_MUX_HW(CMU_SENSORCLK, 4, 1), + OWL_GATE_HW(CMU_DEVCLKEN0, 14, 0), +- OWL_FACTOR_HW(CMU_SENSORCLK, 0, 3, 0, bisp_factor_table), +- CLK_IGNORE_UNUSED); ++ OWL_DIVIDER_HW(CMU_SENSORCLK, 0, 4, 0, std12rate_div_table), ++ 0); + +-static OWL_COMP_FACTOR(sensor1_clk, "sensor1_clk", sensor_clk_mux_p, ++static OWL_COMP_DIV(sensor1_clk, "sensor1_clk", sensor_clk_mux_p, + OWL_MUX_HW(CMU_SENSORCLK, 4, 1), + OWL_GATE_HW(CMU_DEVCLKEN0, 14, 0), +- OWL_FACTOR_HW(CMU_SENSORCLK, 8, 3, 0, bisp_factor_table), +- CLK_IGNORE_UNUSED); ++ OWL_DIVIDER_HW(CMU_SENSORCLK, 8, 4, 0, std12rate_div_table), ++ 0); + + static OWL_COMP_FACTOR(sd0_clk, "sd0_clk", sd_clk_mux_p, + OWL_MUX_HW(CMU_SD0CLK, 9, 1), +-- +2.30.2 + diff --git a/queue-5.12/clk-actions-fix-sd-clocks-factor-table-on-owl-s500-s.patch b/queue-5.12/clk-actions-fix-sd-clocks-factor-table-on-owl-s500-s.patch new file mode 100644 index 00000000000..dccde1d9065 --- /dev/null +++ b/queue-5.12/clk-actions-fix-sd-clocks-factor-table-on-owl-s500-s.patch @@ -0,0 +1,49 @@ +From 1fa3220bacb0b0c00ce76a1bdb95e66f12faca01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 23:05:22 +0300 +Subject: clk: actions: Fix SD clocks factor table on Owl S500 SoC + +From: Cristian Ciocaltea + +[ Upstream commit fe1f71e338d77814da3ef44e9f64d32981a6ccdf ] + +Drop the unsupported entries in the factor table used for the SD[0-2] +clocks definitions on the Actions Semi Owl S500 SoC. + +Fixes: ed6b4795ece4 ("clk: actions: Add clock driver for S500 SoC") +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/196c948d708a22b8198c95f064a0f6b6820f9980.1623354574.git.cristian.ciocaltea@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/actions/owl-s500.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/actions/owl-s500.c b/drivers/clk/actions/owl-s500.c +index 75b7186185b0..42abdf964044 100644 +--- a/drivers/clk/actions/owl-s500.c ++++ b/drivers/clk/actions/owl-s500.c +@@ -127,8 +127,7 @@ static struct clk_factor_table sd_factor_table[] = { + { 12, 1, 13 }, { 13, 1, 14 }, { 14, 1, 15 }, { 15, 1, 16 }, + { 16, 1, 17 }, { 17, 1, 18 }, { 18, 1, 19 }, { 19, 1, 20 }, + { 20, 1, 21 }, { 21, 1, 22 }, { 22, 1, 23 }, { 23, 1, 24 }, +- { 24, 1, 25 }, { 25, 1, 26 }, { 26, 1, 27 }, { 27, 1, 28 }, +- { 28, 1, 29 }, { 29, 1, 30 }, { 30, 1, 31 }, { 31, 1, 32 }, ++ { 24, 1, 25 }, + + /* bit8: /128 */ + { 256, 1, 1 * 128 }, { 257, 1, 2 * 128 }, { 258, 1, 3 * 128 }, { 259, 1, 4 * 128 }, +@@ -137,8 +136,7 @@ static struct clk_factor_table sd_factor_table[] = { + { 268, 1, 13 * 128 }, { 269, 1, 14 * 128 }, { 270, 1, 15 * 128 }, { 271, 1, 16 * 128 }, + { 272, 1, 17 * 128 }, { 273, 1, 18 * 128 }, { 274, 1, 19 * 128 }, { 275, 1, 20 * 128 }, + { 276, 1, 21 * 128 }, { 277, 1, 22 * 128 }, { 278, 1, 23 * 128 }, { 279, 1, 24 * 128 }, +- { 280, 1, 25 * 128 }, { 281, 1, 26 * 128 }, { 282, 1, 27 * 128 }, { 283, 1, 28 * 128 }, +- { 284, 1, 29 * 128 }, { 285, 1, 30 * 128 }, { 286, 1, 31 * 128 }, { 287, 1, 32 * 128 }, ++ { 280, 1, 25 * 128 }, + { 0, 0, 0 }, + }; + +-- +2.30.2 + diff --git a/queue-5.12/clk-actions-fix-uart-clock-dividers-on-owl-s500-soc.patch b/queue-5.12/clk-actions-fix-uart-clock-dividers-on-owl-s500-soc.patch new file mode 100644 index 00000000000..8d9315339c1 --- /dev/null +++ b/queue-5.12/clk-actions-fix-uart-clock-dividers-on-owl-s500-soc.patch @@ -0,0 +1,75 @@ +From 7b6ddddb98de859e9c3f37a2737fe69c929fe4e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 23:05:21 +0300 +Subject: clk: actions: Fix UART clock dividers on Owl S500 SoC + +From: Cristian Ciocaltea + +[ Upstream commit 2dca2a619a907579e3e65e7c1789230c2b912e88 ] + +Use correct divider registers for the Actions Semi Owl S500 SoC's UART +clocks. + +Fixes: ed6b4795ece4 ("clk: actions: Add clock driver for S500 SoC") +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/4714d05982b19ac5fec2ed74f54be42d8238e392.1623354574.git.cristian.ciocaltea@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/actions/owl-s500.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/clk/actions/owl-s500.c b/drivers/clk/actions/owl-s500.c +index 61bb224f6330..75b7186185b0 100644 +--- a/drivers/clk/actions/owl-s500.c ++++ b/drivers/clk/actions/owl-s500.c +@@ -305,7 +305,7 @@ static OWL_COMP_FIXED_FACTOR(i2c3_clk, "i2c3_clk", "ethernet_pll_clk", + static OWL_COMP_DIV(uart0_clk, "uart0_clk", uart_clk_mux_p, + OWL_MUX_HW(CMU_UART0CLK, 16, 1), + OWL_GATE_HW(CMU_DEVCLKEN1, 6, 0), +- OWL_DIVIDER_HW(CMU_UART1CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), ++ OWL_DIVIDER_HW(CMU_UART0CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), + CLK_IGNORE_UNUSED); + + static OWL_COMP_DIV(uart1_clk, "uart1_clk", uart_clk_mux_p, +@@ -317,31 +317,31 @@ static OWL_COMP_DIV(uart1_clk, "uart1_clk", uart_clk_mux_p, + static OWL_COMP_DIV(uart2_clk, "uart2_clk", uart_clk_mux_p, + OWL_MUX_HW(CMU_UART2CLK, 16, 1), + OWL_GATE_HW(CMU_DEVCLKEN1, 8, 0), +- OWL_DIVIDER_HW(CMU_UART1CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), ++ OWL_DIVIDER_HW(CMU_UART2CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), + CLK_IGNORE_UNUSED); + + static OWL_COMP_DIV(uart3_clk, "uart3_clk", uart_clk_mux_p, + OWL_MUX_HW(CMU_UART3CLK, 16, 1), + OWL_GATE_HW(CMU_DEVCLKEN1, 19, 0), +- OWL_DIVIDER_HW(CMU_UART1CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), ++ OWL_DIVIDER_HW(CMU_UART3CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), + CLK_IGNORE_UNUSED); + + static OWL_COMP_DIV(uart4_clk, "uart4_clk", uart_clk_mux_p, + OWL_MUX_HW(CMU_UART4CLK, 16, 1), + OWL_GATE_HW(CMU_DEVCLKEN1, 20, 0), +- OWL_DIVIDER_HW(CMU_UART1CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), ++ OWL_DIVIDER_HW(CMU_UART4CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), + CLK_IGNORE_UNUSED); + + static OWL_COMP_DIV(uart5_clk, "uart5_clk", uart_clk_mux_p, + OWL_MUX_HW(CMU_UART5CLK, 16, 1), + OWL_GATE_HW(CMU_DEVCLKEN1, 21, 0), +- OWL_DIVIDER_HW(CMU_UART1CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), ++ OWL_DIVIDER_HW(CMU_UART5CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), + CLK_IGNORE_UNUSED); + + static OWL_COMP_DIV(uart6_clk, "uart6_clk", uart_clk_mux_p, + OWL_MUX_HW(CMU_UART6CLK, 16, 1), + OWL_GATE_HW(CMU_DEVCLKEN1, 18, 0), +- OWL_DIVIDER_HW(CMU_UART1CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), ++ OWL_DIVIDER_HW(CMU_UART6CLK, 0, 8, CLK_DIVIDER_ROUND_CLOSEST, NULL), + CLK_IGNORE_UNUSED); + + static OWL_COMP_DIV(i2srx_clk, "i2srx_clk", i2s_clk_mux_p, +-- +2.30.2 + diff --git a/queue-5.12/clk-imx8mq-remove-sys-pll-1-2-clock-gates.patch b/queue-5.12/clk-imx8mq-remove-sys-pll-1-2-clock-gates.patch new file mode 100644 index 00000000000..b10f6a7fc5f --- /dev/null +++ b/queue-5.12/clk-imx8mq-remove-sys-pll-1-2-clock-gates.patch @@ -0,0 +1,127 @@ +From 23a0f41db1ca30cb487e39dce59732bd9a5be51d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 20:01:35 +0200 +Subject: clk: imx8mq: remove SYS PLL 1/2 clock gates + +From: Lucas Stach + +[ Upstream commit c586f53ae159c6c1390f093a1ec94baef2df9f3a ] + +Remove the PLL clock gates as the allowing to gate the sys1_pll_266m breaks +the uSDHC module which is sporadically unable to enumerate devices after +this change. Also it makes AMP clock management harder with no obvious +benefit to Linux, so just revert the change. + +Link: https://lore.kernel.org/r/20210528180135.1640876-1-l.stach@pengutronix.de +Fixes: b04383b6a558 ("clk: imx8mq: Define gates for pll1/2 fixed dividers") +Signed-off-by: Lucas Stach +Reviewed-by: Abel Vesa +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mq.c | 56 ++++++++---------------- + include/dt-bindings/clock/imx8mq-clock.h | 19 -------- + 2 files changed, 18 insertions(+), 57 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mq.c b/drivers/clk/imx/clk-imx8mq.c +index 3e1a10d3f55c..b9bad6d92671 100644 +--- a/drivers/clk/imx/clk-imx8mq.c ++++ b/drivers/clk/imx/clk-imx8mq.c +@@ -358,46 +358,26 @@ static int imx8mq_clocks_probe(struct platform_device *pdev) + hws[IMX8MQ_VIDEO2_PLL_OUT] = imx_clk_hw_sscg_pll("video2_pll_out", video2_pll_out_sels, ARRAY_SIZE(video2_pll_out_sels), 0, 0, 0, base + 0x54, 0); + + /* SYS PLL1 fixed output */ +- hws[IMX8MQ_SYS1_PLL_40M_CG] = imx_clk_hw_gate("sys1_pll_40m_cg", "sys1_pll_out", base + 0x30, 9); +- hws[IMX8MQ_SYS1_PLL_80M_CG] = imx_clk_hw_gate("sys1_pll_80m_cg", "sys1_pll_out", base + 0x30, 11); +- hws[IMX8MQ_SYS1_PLL_100M_CG] = imx_clk_hw_gate("sys1_pll_100m_cg", "sys1_pll_out", base + 0x30, 13); +- hws[IMX8MQ_SYS1_PLL_133M_CG] = imx_clk_hw_gate("sys1_pll_133m_cg", "sys1_pll_out", base + 0x30, 15); +- hws[IMX8MQ_SYS1_PLL_160M_CG] = imx_clk_hw_gate("sys1_pll_160m_cg", "sys1_pll_out", base + 0x30, 17); +- hws[IMX8MQ_SYS1_PLL_200M_CG] = imx_clk_hw_gate("sys1_pll_200m_cg", "sys1_pll_out", base + 0x30, 19); +- hws[IMX8MQ_SYS1_PLL_266M_CG] = imx_clk_hw_gate("sys1_pll_266m_cg", "sys1_pll_out", base + 0x30, 21); +- hws[IMX8MQ_SYS1_PLL_400M_CG] = imx_clk_hw_gate("sys1_pll_400m_cg", "sys1_pll_out", base + 0x30, 23); +- hws[IMX8MQ_SYS1_PLL_800M_CG] = imx_clk_hw_gate("sys1_pll_800m_cg", "sys1_pll_out", base + 0x30, 25); +- +- hws[IMX8MQ_SYS1_PLL_40M] = imx_clk_hw_fixed_factor("sys1_pll_40m", "sys1_pll_40m_cg", 1, 20); +- hws[IMX8MQ_SYS1_PLL_80M] = imx_clk_hw_fixed_factor("sys1_pll_80m", "sys1_pll_80m_cg", 1, 10); +- hws[IMX8MQ_SYS1_PLL_100M] = imx_clk_hw_fixed_factor("sys1_pll_100m", "sys1_pll_100m_cg", 1, 8); +- hws[IMX8MQ_SYS1_PLL_133M] = imx_clk_hw_fixed_factor("sys1_pll_133m", "sys1_pll_133m_cg", 1, 6); +- hws[IMX8MQ_SYS1_PLL_160M] = imx_clk_hw_fixed_factor("sys1_pll_160m", "sys1_pll_160m_cg", 1, 5); +- hws[IMX8MQ_SYS1_PLL_200M] = imx_clk_hw_fixed_factor("sys1_pll_200m", "sys1_pll_200m_cg", 1, 4); +- hws[IMX8MQ_SYS1_PLL_266M] = imx_clk_hw_fixed_factor("sys1_pll_266m", "sys1_pll_266m_cg", 1, 3); +- hws[IMX8MQ_SYS1_PLL_400M] = imx_clk_hw_fixed_factor("sys1_pll_400m", "sys1_pll_400m_cg", 1, 2); +- hws[IMX8MQ_SYS1_PLL_800M] = imx_clk_hw_fixed_factor("sys1_pll_800m", "sys1_pll_800m_cg", 1, 1); ++ hws[IMX8MQ_SYS1_PLL_40M] = imx_clk_hw_fixed_factor("sys1_pll_40m", "sys1_pll_out", 1, 20); ++ hws[IMX8MQ_SYS1_PLL_80M] = imx_clk_hw_fixed_factor("sys1_pll_80m", "sys1_pll_out", 1, 10); ++ hws[IMX8MQ_SYS1_PLL_100M] = imx_clk_hw_fixed_factor("sys1_pll_100m", "sys1_pll_out", 1, 8); ++ hws[IMX8MQ_SYS1_PLL_133M] = imx_clk_hw_fixed_factor("sys1_pll_133m", "sys1_pll_out", 1, 6); ++ hws[IMX8MQ_SYS1_PLL_160M] = imx_clk_hw_fixed_factor("sys1_pll_160m", "sys1_pll_out", 1, 5); ++ hws[IMX8MQ_SYS1_PLL_200M] = imx_clk_hw_fixed_factor("sys1_pll_200m", "sys1_pll_out", 1, 4); ++ hws[IMX8MQ_SYS1_PLL_266M] = imx_clk_hw_fixed_factor("sys1_pll_266m", "sys1_pll_out", 1, 3); ++ hws[IMX8MQ_SYS1_PLL_400M] = imx_clk_hw_fixed_factor("sys1_pll_400m", "sys1_pll_out", 1, 2); ++ hws[IMX8MQ_SYS1_PLL_800M] = imx_clk_hw_fixed_factor("sys1_pll_800m", "sys1_pll_out", 1, 1); + + /* SYS PLL2 fixed output */ +- hws[IMX8MQ_SYS2_PLL_50M_CG] = imx_clk_hw_gate("sys2_pll_50m_cg", "sys2_pll_out", base + 0x3c, 9); +- hws[IMX8MQ_SYS2_PLL_100M_CG] = imx_clk_hw_gate("sys2_pll_100m_cg", "sys2_pll_out", base + 0x3c, 11); +- hws[IMX8MQ_SYS2_PLL_125M_CG] = imx_clk_hw_gate("sys2_pll_125m_cg", "sys2_pll_out", base + 0x3c, 13); +- hws[IMX8MQ_SYS2_PLL_166M_CG] = imx_clk_hw_gate("sys2_pll_166m_cg", "sys2_pll_out", base + 0x3c, 15); +- hws[IMX8MQ_SYS2_PLL_200M_CG] = imx_clk_hw_gate("sys2_pll_200m_cg", "sys2_pll_out", base + 0x3c, 17); +- hws[IMX8MQ_SYS2_PLL_250M_CG] = imx_clk_hw_gate("sys2_pll_250m_cg", "sys2_pll_out", base + 0x3c, 19); +- hws[IMX8MQ_SYS2_PLL_333M_CG] = imx_clk_hw_gate("sys2_pll_333m_cg", "sys2_pll_out", base + 0x3c, 21); +- hws[IMX8MQ_SYS2_PLL_500M_CG] = imx_clk_hw_gate("sys2_pll_500m_cg", "sys2_pll_out", base + 0x3c, 23); +- hws[IMX8MQ_SYS2_PLL_1000M_CG] = imx_clk_hw_gate("sys2_pll_1000m_cg", "sys2_pll_out", base + 0x3c, 25); +- +- hws[IMX8MQ_SYS2_PLL_50M] = imx_clk_hw_fixed_factor("sys2_pll_50m", "sys2_pll_50m_cg", 1, 20); +- hws[IMX8MQ_SYS2_PLL_100M] = imx_clk_hw_fixed_factor("sys2_pll_100m", "sys2_pll_100m_cg", 1, 10); +- hws[IMX8MQ_SYS2_PLL_125M] = imx_clk_hw_fixed_factor("sys2_pll_125m", "sys2_pll_125m_cg", 1, 8); +- hws[IMX8MQ_SYS2_PLL_166M] = imx_clk_hw_fixed_factor("sys2_pll_166m", "sys2_pll_166m_cg", 1, 6); +- hws[IMX8MQ_SYS2_PLL_200M] = imx_clk_hw_fixed_factor("sys2_pll_200m", "sys2_pll_200m_cg", 1, 5); +- hws[IMX8MQ_SYS2_PLL_250M] = imx_clk_hw_fixed_factor("sys2_pll_250m", "sys2_pll_250m_cg", 1, 4); +- hws[IMX8MQ_SYS2_PLL_333M] = imx_clk_hw_fixed_factor("sys2_pll_333m", "sys2_pll_333m_cg", 1, 3); +- hws[IMX8MQ_SYS2_PLL_500M] = imx_clk_hw_fixed_factor("sys2_pll_500m", "sys2_pll_500m_cg", 1, 2); +- hws[IMX8MQ_SYS2_PLL_1000M] = imx_clk_hw_fixed_factor("sys2_pll_1000m", "sys2_pll_1000m_cg", 1, 1); ++ hws[IMX8MQ_SYS2_PLL_50M] = imx_clk_hw_fixed_factor("sys2_pll_50m", "sys2_pll_out", 1, 20); ++ hws[IMX8MQ_SYS2_PLL_100M] = imx_clk_hw_fixed_factor("sys2_pll_100m", "sys2_pll_out", 1, 10); ++ hws[IMX8MQ_SYS2_PLL_125M] = imx_clk_hw_fixed_factor("sys2_pll_125m", "sys2_pll_out", 1, 8); ++ hws[IMX8MQ_SYS2_PLL_166M] = imx_clk_hw_fixed_factor("sys2_pll_166m", "sys2_pll_out", 1, 6); ++ hws[IMX8MQ_SYS2_PLL_200M] = imx_clk_hw_fixed_factor("sys2_pll_200m", "sys2_pll_out", 1, 5); ++ hws[IMX8MQ_SYS2_PLL_250M] = imx_clk_hw_fixed_factor("sys2_pll_250m", "sys2_pll_out", 1, 4); ++ hws[IMX8MQ_SYS2_PLL_333M] = imx_clk_hw_fixed_factor("sys2_pll_333m", "sys2_pll_out", 1, 3); ++ hws[IMX8MQ_SYS2_PLL_500M] = imx_clk_hw_fixed_factor("sys2_pll_500m", "sys2_pll_out", 1, 2); ++ hws[IMX8MQ_SYS2_PLL_1000M] = imx_clk_hw_fixed_factor("sys2_pll_1000m", "sys2_pll_out", 1, 1); + + hws[IMX8MQ_CLK_MON_AUDIO_PLL1_DIV] = imx_clk_hw_divider("audio_pll1_out_monitor", "audio_pll1_bypass", base + 0x78, 0, 3); + hws[IMX8MQ_CLK_MON_AUDIO_PLL2_DIV] = imx_clk_hw_divider("audio_pll2_out_monitor", "audio_pll2_bypass", base + 0x78, 4, 3); +diff --git a/include/dt-bindings/clock/imx8mq-clock.h b/include/dt-bindings/clock/imx8mq-clock.h +index 82e907ce7bdd..afa74d7ba100 100644 +--- a/include/dt-bindings/clock/imx8mq-clock.h ++++ b/include/dt-bindings/clock/imx8mq-clock.h +@@ -405,25 +405,6 @@ + + #define IMX8MQ_VIDEO2_PLL1_REF_SEL 266 + +-#define IMX8MQ_SYS1_PLL_40M_CG 267 +-#define IMX8MQ_SYS1_PLL_80M_CG 268 +-#define IMX8MQ_SYS1_PLL_100M_CG 269 +-#define IMX8MQ_SYS1_PLL_133M_CG 270 +-#define IMX8MQ_SYS1_PLL_160M_CG 271 +-#define IMX8MQ_SYS1_PLL_200M_CG 272 +-#define IMX8MQ_SYS1_PLL_266M_CG 273 +-#define IMX8MQ_SYS1_PLL_400M_CG 274 +-#define IMX8MQ_SYS1_PLL_800M_CG 275 +-#define IMX8MQ_SYS2_PLL_50M_CG 276 +-#define IMX8MQ_SYS2_PLL_100M_CG 277 +-#define IMX8MQ_SYS2_PLL_125M_CG 278 +-#define IMX8MQ_SYS2_PLL_166M_CG 279 +-#define IMX8MQ_SYS2_PLL_200M_CG 280 +-#define IMX8MQ_SYS2_PLL_250M_CG 281 +-#define IMX8MQ_SYS2_PLL_333M_CG 282 +-#define IMX8MQ_SYS2_PLL_500M_CG 283 +-#define IMX8MQ_SYS2_PLL_1000M_CG 284 +- + #define IMX8MQ_CLK_GPU_CORE 285 + #define IMX8MQ_CLK_GPU_SHADER 286 + #define IMX8MQ_CLK_M4_CORE 287 +-- +2.30.2 + diff --git a/queue-5.12/clk-meson-g12a-fix-gp0-and-hifi-ranges.patch b/queue-5.12/clk-meson-g12a-fix-gp0-and-hifi-ranges.patch new file mode 100644 index 00000000000..ff71b49df0c --- /dev/null +++ b/queue-5.12/clk-meson-g12a-fix-gp0-and-hifi-ranges.patch @@ -0,0 +1,45 @@ +From ba40d10f38542d438b3938282dbc9affe7e4eb86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 11:03:25 +0200 +Subject: clk: meson: g12a: fix gp0 and hifi ranges + +From: Jerome Brunet + +[ Upstream commit bc794f8c56abddf709f1f84fcb2a3c9e7d9cc9b4 ] + +While some SoC samples are able to lock with a PLL factor of 55, others +samples can't. ATM, a minimum of 60 appears to work on all the samples +I have tried. + +Even with 60, it sometimes takes a long time for the PLL to eventually +lock. The documentation says that the minimum rate of these PLLs DCO +should be 3GHz, a factor of 125. Let's use that to be on the safe side. + +With factor range changed, the PLL seems to lock quickly (enough) so far. +It is still unclear if the range was the only reason for the delay. + +Fixes: 085a4ea93d54 ("clk: meson: g12a: add peripheral clock controller") +Signed-off-by: Jerome Brunet +Acked-by: Neil Armstrong +Link: https://lore.kernel.org/r/20210429090325.60970-1-jbrunet@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/g12a.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c +index b080359b4645..a805bac93c11 100644 +--- a/drivers/clk/meson/g12a.c ++++ b/drivers/clk/meson/g12a.c +@@ -1603,7 +1603,7 @@ static struct clk_regmap g12b_cpub_clk_trace = { + }; + + static const struct pll_mult_range g12a_gp0_pll_mult_range = { +- .min = 55, ++ .min = 125, + .max = 255, + }; + +-- +2.30.2 + diff --git a/queue-5.12/clk-qcom-clk-alpha-pll-fix-cal_l-write-in-alpha_pll_.patch b/queue-5.12/clk-qcom-clk-alpha-pll-fix-cal_l-write-in-alpha_pll_.patch new file mode 100644 index 00000000000..3a486efe256 --- /dev/null +++ b/queue-5.12/clk-qcom-clk-alpha-pll-fix-cal_l-write-in-alpha_pll_.patch @@ -0,0 +1,37 @@ +From 2f5e7c7e66aace0b676e7b4d5c99115cd0e6406e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 22:28:52 -0400 +Subject: clk: qcom: clk-alpha-pll: fix CAL_L write in alpha_pll_fabia_prepare + +From: Jonathan Marek + +[ Upstream commit 7f54bf2640e877c8a9b4cc7e2b29f82e3ca1a284 ] + +Caught this when looking at alpha-pll code. Untested but it is clear that +this was intended to write to PLL_CAL_L_VAL and not PLL_ALPHA_VAL. + +Fixes: 691865bad627 ("clk: qcom: clk-alpha-pll: Add support for Fabia PLL calibration") +Signed-off-by: Jonathan Marek +Link: https://lore.kernel.org/r/20210609022852.4151-1-jonathan@marek.ca +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-alpha-pll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c +index c6eb99169ddc..6f8f0bbc5ab5 100644 +--- a/drivers/clk/qcom/clk-alpha-pll.c ++++ b/drivers/clk/qcom/clk-alpha-pll.c +@@ -1234,7 +1234,7 @@ static int alpha_pll_fabia_prepare(struct clk_hw *hw) + return ret; + + /* Setup PLL for calibration frequency */ +- regmap_write(pll->clkr.regmap, PLL_ALPHA_VAL(pll), cal_l); ++ regmap_write(pll->clkr.regmap, PLL_CAL_L_VAL(pll), cal_l); + + /* Bringup the PLL at calibration frequency */ + ret = clk_alpha_pll_enable(hw); +-- +2.30.2 + diff --git a/queue-5.12/clk-qcom-gcc-add-support-for-a-new-frequency-for-sc7.patch b/queue-5.12/clk-qcom-gcc-add-support-for-a-new-frequency-for-sc7.patch new file mode 100644 index 00000000000..ca22416c82f --- /dev/null +++ b/queue-5.12/clk-qcom-gcc-add-support-for-a-new-frequency-for-sc7.patch @@ -0,0 +1,36 @@ +From 4c1e8b2d39fb9f50eb0a22579fb71b5650844a4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 17:27:51 +0530 +Subject: clk: qcom: gcc: Add support for a new frequency for SC7280 + +From: Taniya Das + +[ Upstream commit ca1c667f4be935825fffb232a106c9d3f1c09b0b ] + +There is a requirement to support 52MHz for qup clocks for bluetooth +usecase, thus update the frequency table to support the frequency. + +Fixes: a3cc092196ef ("clk: qcom: Add Global Clock controller (GCC) driver for SC7280") +Signed-off-by: Taniya Das +Link: https://lore.kernel.org/r/1624449471-9984-1-git-send-email-tdas@codeaurora.org +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sc7280.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-sc7280.c b/drivers/clk/qcom/gcc-sc7280.c +index 22736c16ed16..2db1b07c7044 100644 +--- a/drivers/clk/qcom/gcc-sc7280.c ++++ b/drivers/clk/qcom/gcc-sc7280.c +@@ -716,6 +716,7 @@ static const struct freq_tbl ftbl_gcc_qupv3_wrap0_s2_clk_src[] = { + F(29491200, P_GCC_GPLL0_OUT_EVEN, 1, 1536, 15625), + F(32000000, P_GCC_GPLL0_OUT_EVEN, 1, 8, 75), + F(48000000, P_GCC_GPLL0_OUT_EVEN, 1, 4, 25), ++ F(52174000, P_GCC_GPLL0_OUT_MAIN, 1, 2, 23), + F(64000000, P_GCC_GPLL0_OUT_EVEN, 1, 16, 75), + F(75000000, P_GCC_GPLL0_OUT_EVEN, 4, 0, 0), + F(80000000, P_GCC_GPLL0_OUT_EVEN, 1, 4, 15), +-- +2.30.2 + diff --git a/queue-5.12/clk-si5341-avoid-divide-errors-due-to-bogus-register.patch b/queue-5.12/clk-si5341-avoid-divide-errors-due-to-bogus-register.patch new file mode 100644 index 00000000000..bb114c18f36 --- /dev/null +++ b/queue-5.12/clk-si5341-avoid-divide-errors-due-to-bogus-register.patch @@ -0,0 +1,70 @@ +From 48bb8fcd346ee152e8cafb7d24f4931fce04326d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 13:26:37 -0600 +Subject: clk: si5341: Avoid divide errors due to bogus register contents + +From: Robert Hancock + +[ Upstream commit 78f6f406026d688868223d5dbeb197a4f7e9a9fd ] + +If the Si5341 is being initially programmed and has no stored NVM +configuration, some of the register contents may contain unexpected +values, such as zeros, which could cause divide by zero errors during +driver initialization. Trap errors caused by zero registers or zero clock +rates which could result in divide errors later in the code. + +Fixes: 3044a860fd ("clk: Add Si5341/Si5340 driver") +Signed-off-by: Robert Hancock +Link: https://lore.kernel.org/r/20210325192643.2190069-4-robert.hancock@calian.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index b8a960e927bc..ac1ccec2b681 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -624,6 +624,9 @@ static unsigned long si5341_synth_clk_recalc_rate(struct clk_hw *hw, + SI5341_SYNTH_N_NUM(synth->index), &n_num, &n_den); + if (err < 0) + return err; ++ /* Check for bogus/uninitialized settings */ ++ if (!n_num || !n_den) ++ return 0; + + /* + * n_num and n_den are shifted left as much as possible, so to prevent +@@ -807,6 +810,9 @@ static long si5341_output_clk_round_rate(struct clk_hw *hw, unsigned long rate, + { + unsigned long r; + ++ if (!rate) ++ return 0; ++ + r = *parent_rate >> 1; + + /* If rate is an even divisor, no changes to parent required */ +@@ -835,11 +841,16 @@ static int si5341_output_clk_set_rate(struct clk_hw *hw, unsigned long rate, + unsigned long parent_rate) + { + struct clk_si5341_output *output = to_clk_si5341_output(hw); +- /* Frequency divider is (r_div + 1) * 2 */ +- u32 r_div = (parent_rate / rate) >> 1; ++ u32 r_div; + int err; + u8 r[3]; + ++ if (!rate) ++ return -EINVAL; ++ ++ /* Frequency divider is (r_div + 1) * 2 */ ++ r_div = (parent_rate / rate) >> 1; ++ + if (r_div <= 1) + r_div = 0; + else if (r_div >= BIT(24)) +-- +2.30.2 + diff --git a/queue-5.12/clk-si5341-check-for-input-clock-presence-and-pll-lo.patch b/queue-5.12/clk-si5341-check-for-input-clock-presence-and-pll-lo.patch new file mode 100644 index 00000000000..24a52006068 --- /dev/null +++ b/queue-5.12/clk-si5341-check-for-input-clock-presence-and-pll-lo.patch @@ -0,0 +1,82 @@ +From 16dd75f6516848330c5b8f69417842ad5e709bc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 13:26:38 -0600 +Subject: clk: si5341: Check for input clock presence and PLL lock on startup + +From: Robert Hancock + +[ Upstream commit 71dcc4d1f7d2ad97ff7ab831281bc6893ff713a2 ] + +After initializing the device, wait for it to report that the input +clock is present and the PLL has locked before declaring success. + +Fixes: 3044a860fd ("clk: Add Si5341/Si5340 driver") +Signed-off-by: Robert Hancock +Link: https://lore.kernel.org/r/20210325192643.2190069-5-robert.hancock@calian.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 26 ++++++++++++++++++++++++++ + 1 file changed, 26 insertions(+) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index ac1ccec2b681..da40b90c2aa8 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -92,6 +92,9 @@ struct clk_si5341_output_config { + #define SI5341_PN_BASE 0x0002 + #define SI5341_DEVICE_REV 0x0005 + #define SI5341_STATUS 0x000C ++#define SI5341_LOS 0x000D ++#define SI5341_STATUS_STICKY 0x0011 ++#define SI5341_LOS_STICKY 0x0012 + #define SI5341_SOFT_RST 0x001C + #define SI5341_IN_SEL 0x0021 + #define SI5341_DEVICE_READY 0x00FE +@@ -99,6 +102,12 @@ struct clk_si5341_output_config { + #define SI5341_IN_EN 0x0949 + #define SI5341_INX_TO_PFD_EN 0x094A + ++/* Status bits */ ++#define SI5341_STATUS_SYSINCAL BIT(0) ++#define SI5341_STATUS_LOSXAXB BIT(1) ++#define SI5341_STATUS_LOSREF BIT(2) ++#define SI5341_STATUS_LOL BIT(3) ++ + /* Input selection */ + #define SI5341_IN_SEL_MASK 0x06 + #define SI5341_IN_SEL_SHIFT 1 +@@ -1416,6 +1425,7 @@ static int si5341_probe(struct i2c_client *client, + unsigned int i; + struct clk_si5341_output_config config[SI5341_MAX_NUM_OUTPUTS]; + bool initialization_required; ++ u32 status; + + data = devm_kzalloc(&client->dev, sizeof(*data), GFP_KERNEL); + if (!data) +@@ -1583,6 +1593,22 @@ static int si5341_probe(struct i2c_client *client, + return err; + } + ++ /* wait for device to report input clock present and PLL lock */ ++ err = regmap_read_poll_timeout(data->regmap, SI5341_STATUS, status, ++ !(status & (SI5341_STATUS_LOSREF | SI5341_STATUS_LOL)), ++ 10000, 250000); ++ if (err) { ++ dev_err(&client->dev, "Error waiting for input clock or PLL lock\n"); ++ return err; ++ } ++ ++ /* clear sticky alarm bits from initialization */ ++ err = regmap_write(data->regmap, SI5341_STATUS_STICKY, 0); ++ if (err) { ++ dev_err(&client->dev, "unable to clear sticky status\n"); ++ return err; ++ } ++ + /* Free the names, clk framework makes copies */ + for (i = 0; i < data->num_synth; ++i) + devm_kfree(&client->dev, (void *)synth_clock_names[i]); +-- +2.30.2 + diff --git a/queue-5.12/clk-si5341-update-initialization-magic.patch b/queue-5.12/clk-si5341-update-initialization-magic.patch new file mode 100644 index 00000000000..d9a01ee80a6 --- /dev/null +++ b/queue-5.12/clk-si5341-update-initialization-magic.patch @@ -0,0 +1,48 @@ +From 8f76fc304b6ba007e8ccf8c024ebb75362606d6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 13:26:39 -0600 +Subject: clk: si5341: Update initialization magic + +From: Robert Hancock + +[ Upstream commit 3c9b49b0031aefb81adfdba5ab0ddf3ca3a2cdc9 ] + +Update the default register settings to include the VCO_RESET_CALCODE +settings (set by the SiLabs ClockBuilder software but not described in +the datasheet). Also update part of the initialization sequence to match +ClockBuilder and the datasheet. + +Fixes: 3044a860fd ("clk: Add Si5341/Si5340 driver") +Signed-off-by: Robert Hancock +Link: https://lore.kernel.org/r/20210325192643.2190069-6-robert.hancock@calian.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index da40b90c2aa8..eb22f4fdbc6b 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -350,6 +350,8 @@ static const struct si5341_reg_default si5341_reg_defaults[] = { + { 0x094A, 0x00 }, /* INx_TO_PFD_EN (disabled) */ + { 0x0A02, 0x00 }, /* Not in datasheet */ + { 0x0B44, 0x0F }, /* PDIV_ENB (datasheet does not mention what it is) */ ++ { 0x0B57, 0x10 }, /* VCO_RESET_CALCODE (not described in datasheet) */ ++ { 0x0B58, 0x05 }, /* VCO_RESET_CALCODE (not described in datasheet) */ + }; + + /* Read and interpret a 44-bit followed by a 32-bit value in the regmap */ +@@ -1104,7 +1106,7 @@ static const struct si5341_reg_default si5341_preamble[] = { + { 0x0B25, 0x00 }, + { 0x0502, 0x01 }, + { 0x0505, 0x03 }, +- { 0x0957, 0x1F }, ++ { 0x0957, 0x17 }, + { 0x0B4E, 0x1A }, + }; + +-- +2.30.2 + diff --git a/queue-5.12/clk-si5341-wait-for-device_ready-on-startup.patch b/queue-5.12/clk-si5341-wait-for-device_ready-on-startup.patch new file mode 100644 index 00000000000..fe2a18311cc --- /dev/null +++ b/queue-5.12/clk-si5341-wait-for-device_ready-on-startup.patch @@ -0,0 +1,86 @@ +From af1fff3f92c17a2902d8ef56f554820b163b4b2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 13:26:36 -0600 +Subject: clk: si5341: Wait for DEVICE_READY on startup + +From: Robert Hancock + +[ Upstream commit 6e7d2de1e000d36990923ed80d2e78dfcb545cee ] + +The Si5341 datasheet warns that before accessing any other registers, +including the PAGE register, we need to wait for the DEVICE_READY register +to indicate the device is ready, or the process of the device loading its +state from NVM can be corrupted. Wait for DEVICE_READY on startup before +continuing initialization. This is done using a raw I2C register read +prior to setting up regmap to avoid any potential unwanted automatic PAGE +register accesses from regmap at this stage. + +Fixes: 3044a860fd ("clk: Add Si5341/Si5340 driver") +Signed-off-by: Robert Hancock +Link: https://lore.kernel.org/r/20210325192643.2190069-3-robert.hancock@calian.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-si5341.c | 32 ++++++++++++++++++++++++++++++++ + 1 file changed, 32 insertions(+) + +diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c +index e0446e66fa64..b8a960e927bc 100644 +--- a/drivers/clk/clk-si5341.c ++++ b/drivers/clk/clk-si5341.c +@@ -94,6 +94,7 @@ struct clk_si5341_output_config { + #define SI5341_STATUS 0x000C + #define SI5341_SOFT_RST 0x001C + #define SI5341_IN_SEL 0x0021 ++#define SI5341_DEVICE_READY 0x00FE + #define SI5341_XAXB_CFG 0x090E + #define SI5341_IN_EN 0x0949 + #define SI5341_INX_TO_PFD_EN 0x094A +@@ -1189,6 +1190,32 @@ static const struct regmap_range_cfg si5341_regmap_ranges[] = { + }, + }; + ++static int si5341_wait_device_ready(struct i2c_client *client) ++{ ++ int count; ++ ++ /* Datasheet warns: Any attempt to read or write any register other ++ * than DEVICE_READY before DEVICE_READY reads as 0x0F may corrupt the ++ * NVM programming and may corrupt the register contents, as they are ++ * read from NVM. Note that this includes accesses to the PAGE register. ++ * Also: DEVICE_READY is available on every register page, so no page ++ * change is needed to read it. ++ * Do this outside regmap to avoid automatic PAGE register access. ++ * May take up to 300ms to complete. ++ */ ++ for (count = 0; count < 15; ++count) { ++ s32 result = i2c_smbus_read_byte_data(client, ++ SI5341_DEVICE_READY); ++ if (result < 0) ++ return result; ++ if (result == 0x0F) ++ return 0; ++ msleep(20); ++ } ++ dev_err(&client->dev, "timeout waiting for DEVICE_READY\n"); ++ return -EIO; ++} ++ + static const struct regmap_config si5341_regmap_config = { + .reg_bits = 8, + .val_bits = 8, +@@ -1385,6 +1412,11 @@ static int si5341_probe(struct i2c_client *client, + + data->i2c_client = client; + ++ /* Must be done before otherwise touching hardware */ ++ err = si5341_wait_device_ready(client); ++ if (err) ++ return err; ++ + for (i = 0; i < SI5341_NUM_INPUTS; ++i) { + input = devm_clk_get(&client->dev, si5341_input_clock_names[i]); + if (IS_ERR(input)) { +-- +2.30.2 + diff --git a/queue-5.12/clk-tegra30-use-300mhz-for-video-decoder-by-default.patch b/queue-5.12/clk-tegra30-use-300mhz-for-video-decoder-by-default.patch new file mode 100644 index 00000000000..c7a534aebf3 --- /dev/null +++ b/queue-5.12/clk-tegra30-use-300mhz-for-video-decoder-by-default.patch @@ -0,0 +1,38 @@ +From d495803ba34856009a4fd177a7a31ffbc821bd86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 May 2021 19:30:33 +0300 +Subject: clk: tegra30: Use 300MHz for video decoder by default + +From: Dmitry Osipenko + +[ Upstream commit 56bb7c28ad00e7bcfc851c4e183c42d148d3ad4e ] + +The 600MHz is a too high clock rate for some SoC versions for the video +decoder hardware and this may cause stability issues. Use 300MHz for the +video decoder by default, which is supported by all hardware versions. + +Fixes: ed1a2459e20c ("clk: tegra: Add Tegra20/30 EMC clock implementation") +Acked-by: Thierry Reding +Signed-off-by: Dmitry Osipenko +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-tegra30.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c +index 16dbf83d2f62..a33688b2359e 100644 +--- a/drivers/clk/tegra/clk-tegra30.c ++++ b/drivers/clk/tegra/clk-tegra30.c +@@ -1245,7 +1245,7 @@ static struct tegra_clk_init_table init_table[] __initdata = { + { TEGRA30_CLK_GR3D, TEGRA30_CLK_PLL_C, 300000000, 0 }, + { TEGRA30_CLK_GR3D2, TEGRA30_CLK_PLL_C, 300000000, 0 }, + { TEGRA30_CLK_PLL_U, TEGRA30_CLK_CLK_MAX, 480000000, 0 }, +- { TEGRA30_CLK_VDE, TEGRA30_CLK_PLL_C, 600000000, 0 }, ++ { TEGRA30_CLK_VDE, TEGRA30_CLK_PLL_C, 300000000, 0 }, + { TEGRA30_CLK_SPDIF_IN_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 }, + { TEGRA30_CLK_I2S0_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 }, + { TEGRA30_CLK_I2S1_SYNC, TEGRA30_CLK_CLK_MAX, 24000000, 0 }, +-- +2.30.2 + diff --git a/queue-5.12/clk-vc5-fix-output-disabling-when-enabling-a-fod.patch b/queue-5.12/clk-vc5-fix-output-disabling-when-enabling-a-fod.patch new file mode 100644 index 00000000000..19f2f2889da --- /dev/null +++ b/queue-5.12/clk-vc5-fix-output-disabling-when-enabling-a-fod.patch @@ -0,0 +1,112 @@ +From e56ecf8f9ef24d3875dd0a11603f56d20fae925d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 23:16:47 +0200 +Subject: clk: vc5: fix output disabling when enabling a FOD +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Luca Ceresoli + +[ Upstream commit fc336ae622df0ec114dbe5551a4d2760c535ecd0 ] + +On 5P49V6965, when an output is enabled we enable the corresponding +FOD. When this happens for the first time, and specifically when writing +register VC5_OUT_DIV_CONTROL in vc5_clk_out_prepare(), all other outputs +are stopped for a short time and then restarted. + +According to Renesas support this is intended: "The reason for that is VC6E +has synced up all output function". + +This behaviour can be disabled at least on VersaClock 6E devices, of which +only the 5P49V6965 is currently implemented by this driver. This requires +writing bit 7 (bypass_sync{1..4}) in register 0x20..0x50. Those registers +are named "Unused Factory Reserved Register", and the bits are documented +as "Skip VDDO verification", which does not clearly explain the relation +to FOD sync. However according to Renesas support as well as my testing +setting this bit does prevent disabling of all clock outputs when enabling +a FOD. + +See "VersaClock ® 6E Family Register Descriptions and Programming Guide" +(August 30, 2018), Table 116 "Power Up VDD check", page 58: +https://www.renesas.com/us/en/document/mau/versaclock-6e-family-register-descriptions-and-programming-guide + +Signed-off-by: Luca Ceresoli +Reviewed-by: Adam Ford +Link: https://lore.kernel.org/r/20210527211647.1520720-1-luca@lucaceresoli.net +Fixes: 2bda748e6ad8 ("clk: vc5: Add support for IDT VersaClock 5P49V6965") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-versaclock5.c | 27 ++++++++++++++++++++++++--- + 1 file changed, 24 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/clk-versaclock5.c b/drivers/clk/clk-versaclock5.c +index 344cd6c61188..3c737742c2a9 100644 +--- a/drivers/clk/clk-versaclock5.c ++++ b/drivers/clk/clk-versaclock5.c +@@ -69,7 +69,10 @@ + #define VC5_FEEDBACK_FRAC_DIV(n) (0x19 + (n)) + #define VC5_RC_CONTROL0 0x1e + #define VC5_RC_CONTROL1 0x1f +-/* Register 0x20 is factory reserved */ ++ ++/* These registers are named "Unused Factory Reserved Registers" */ ++#define VC5_RESERVED_X0(idx) (0x20 + ((idx) * 0x10)) ++#define VC5_RESERVED_X0_BYPASS_SYNC BIT(7) /* bypass_sync bit */ + + /* Output divider control for divider 1,2,3,4 */ + #define VC5_OUT_DIV_CONTROL(idx) (0x21 + ((idx) * 0x10)) +@@ -87,7 +90,6 @@ + #define VC5_OUT_DIV_SKEW_INT(idx, n) (0x2b + ((idx) * 0x10) + (n)) + #define VC5_OUT_DIV_INT(idx, n) (0x2d + ((idx) * 0x10) + (n)) + #define VC5_OUT_DIV_SKEW_FRAC(idx) (0x2f + ((idx) * 0x10)) +-/* Registers 0x30, 0x40, 0x50 are factory reserved */ + + /* Clock control register for clock 1,2 */ + #define VC5_CLK_OUTPUT_CFG(idx, n) (0x60 + ((idx) * 0x2) + (n)) +@@ -140,6 +142,8 @@ + #define VC5_HAS_INTERNAL_XTAL BIT(0) + /* chip has PFD requency doubler */ + #define VC5_HAS_PFD_FREQ_DBL BIT(1) ++/* chip has bits to disable FOD sync */ ++#define VC5_HAS_BYPASS_SYNC_BIT BIT(2) + + /* Supported IDT VC5 models. */ + enum vc5_model { +@@ -581,6 +585,23 @@ static int vc5_clk_out_prepare(struct clk_hw *hw) + unsigned int src; + int ret; + ++ /* ++ * When enabling a FOD, all currently enabled FODs are briefly ++ * stopped in order to synchronize all of them. This causes a clock ++ * disruption to any unrelated chips that might be already using ++ * other clock outputs. Bypass the sync feature to avoid the issue, ++ * which is possible on the VersaClock 6E family via reserved ++ * registers. ++ */ ++ if (vc5->chip_info->flags & VC5_HAS_BYPASS_SYNC_BIT) { ++ ret = regmap_update_bits(vc5->regmap, ++ VC5_RESERVED_X0(hwdata->num), ++ VC5_RESERVED_X0_BYPASS_SYNC, ++ VC5_RESERVED_X0_BYPASS_SYNC); ++ if (ret) ++ return ret; ++ } ++ + /* + * If the input mux is disabled, enable it first and + * select source from matching FOD. +@@ -1166,7 +1187,7 @@ static const struct vc5_chip_info idt_5p49v6965_info = { + .model = IDT_VC6_5P49V6965, + .clk_fod_cnt = 4, + .clk_out_cnt = 5, +- .flags = 0, ++ .flags = VC5_HAS_BYPASS_SYNC_BIT, + }; + + static const struct i2c_device_id vc5_id[] = { +-- +2.30.2 + diff --git a/queue-5.12/clocksource-check-per-cpu-clock-synchronization-when.patch b/queue-5.12/clocksource-check-per-cpu-clock-synchronization-when.patch new file mode 100644 index 00000000000..cbb9052334d --- /dev/null +++ b/queue-5.12/clocksource-check-per-cpu-clock-synchronization-when.patch @@ -0,0 +1,142 @@ +From 7ec701c4c7dc89b740e2634426dd2a0a4467f54e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 12:01:20 -0700 +Subject: clocksource: Check per-CPU clock synchronization when marked unstable + +From: Paul E. McKenney + +[ Upstream commit 7560c02bdffb7c52d1457fa551b9e745d4b9e754 ] + +Some sorts of per-CPU clock sources have a history of going out of +synchronization with each other. However, this problem has purportedy been +solved in the past ten years. Except that it is all too possible that the +problem has instead simply been made less likely, which might mean that +some of the occasional "Marking clocksource 'tsc' as unstable" messages +might be due to desynchronization. How would anyone know? + +Therefore apply CPU-to-CPU synchronization checking to newly unstable +clocksource that are marked with the new CLOCK_SOURCE_VERIFY_PERCPU flag. +Lists of desynchronized CPUs are printed, with the caveat that if it +is the reporting CPU that is itself desynchronized, it will appear that +all the other clocks are wrong. Just like in real life. + +Reported-by: Chris Mason +Signed-off-by: Paul E. McKenney +Signed-off-by: Thomas Gleixner +Acked-by: Feng Tang +Link: https://lore.kernel.org/r/20210527190124.440372-2-paulmck@kernel.org +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/tsc.c | 3 +- + include/linux/clocksource.h | 2 +- + kernel/time/clocksource.c | 60 +++++++++++++++++++++++++++++++++++++ + 3 files changed, 63 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c +index f70dffc2771f..56289170753c 100644 +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -1151,7 +1151,8 @@ static struct clocksource clocksource_tsc = { + .mask = CLOCKSOURCE_MASK(64), + .flags = CLOCK_SOURCE_IS_CONTINUOUS | + CLOCK_SOURCE_VALID_FOR_HRES | +- CLOCK_SOURCE_MUST_VERIFY, ++ CLOCK_SOURCE_MUST_VERIFY | ++ CLOCK_SOURCE_VERIFY_PERCPU, + .vdso_clock_mode = VDSO_CLOCKMODE_TSC, + .enable = tsc_cs_enable, + .resume = tsc_resume, +diff --git a/include/linux/clocksource.h b/include/linux/clocksource.h +index 86d143db6523..83a3ebff7456 100644 +--- a/include/linux/clocksource.h ++++ b/include/linux/clocksource.h +@@ -131,7 +131,7 @@ struct clocksource { + #define CLOCK_SOURCE_UNSTABLE 0x40 + #define CLOCK_SOURCE_SUSPEND_NONSTOP 0x80 + #define CLOCK_SOURCE_RESELECT 0x100 +- ++#define CLOCK_SOURCE_VERIFY_PERCPU 0x200 + /* simplify initialization of mask field */ + #define CLOCKSOURCE_MASK(bits) GENMASK_ULL((bits) - 1, 0) + +diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c +index 49b25f1cc344..242997b71f2d 100644 +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -224,6 +224,60 @@ static bool cs_watchdog_read(struct clocksource *cs, u64 *csnow, u64 *wdnow) + return false; + } + ++static u64 csnow_mid; ++static cpumask_t cpus_ahead; ++static cpumask_t cpus_behind; ++ ++static void clocksource_verify_one_cpu(void *csin) ++{ ++ struct clocksource *cs = (struct clocksource *)csin; ++ ++ csnow_mid = cs->read(cs); ++} ++ ++static void clocksource_verify_percpu(struct clocksource *cs) ++{ ++ int64_t cs_nsec, cs_nsec_max = 0, cs_nsec_min = LLONG_MAX; ++ u64 csnow_begin, csnow_end; ++ int cpu, testcpu; ++ s64 delta; ++ ++ cpumask_clear(&cpus_ahead); ++ cpumask_clear(&cpus_behind); ++ preempt_disable(); ++ testcpu = smp_processor_id(); ++ pr_warn("Checking clocksource %s synchronization from CPU %d.\n", cs->name, testcpu); ++ for_each_online_cpu(cpu) { ++ if (cpu == testcpu) ++ continue; ++ csnow_begin = cs->read(cs); ++ smp_call_function_single(cpu, clocksource_verify_one_cpu, cs, 1); ++ csnow_end = cs->read(cs); ++ delta = (s64)((csnow_mid - csnow_begin) & cs->mask); ++ if (delta < 0) ++ cpumask_set_cpu(cpu, &cpus_behind); ++ delta = (csnow_end - csnow_mid) & cs->mask; ++ if (delta < 0) ++ cpumask_set_cpu(cpu, &cpus_ahead); ++ delta = clocksource_delta(csnow_end, csnow_begin, cs->mask); ++ cs_nsec = clocksource_cyc2ns(delta, cs->mult, cs->shift); ++ if (cs_nsec > cs_nsec_max) ++ cs_nsec_max = cs_nsec; ++ if (cs_nsec < cs_nsec_min) ++ cs_nsec_min = cs_nsec; ++ } ++ preempt_enable(); ++ if (!cpumask_empty(&cpus_ahead)) ++ pr_warn(" CPUs %*pbl ahead of CPU %d for clocksource %s.\n", ++ cpumask_pr_args(&cpus_ahead), testcpu, cs->name); ++ if (!cpumask_empty(&cpus_behind)) ++ pr_warn(" CPUs %*pbl behind CPU %d for clocksource %s.\n", ++ cpumask_pr_args(&cpus_behind), testcpu, cs->name); ++ if (!cpumask_empty(&cpus_ahead) || !cpumask_empty(&cpus_behind)) ++ pr_warn(" CPU %d check durations %lldns - %lldns for clocksource %s.\n", ++ testcpu, cs_nsec_min, cs_nsec_max, cs->name); ++} ++ + static void clocksource_watchdog(struct timer_list *unused) + { + u64 csnow, wdnow, cslast, wdlast, delta; +@@ -448,6 +502,12 @@ static int __clocksource_watchdog_kthread(void) + unsigned long flags; + int select = 0; + ++ /* Do any required per-CPU skew verification. */ ++ if (curr_clocksource && ++ curr_clocksource->flags & CLOCK_SOURCE_UNSTABLE && ++ curr_clocksource->flags & CLOCK_SOURCE_VERIFY_PERCPU) ++ clocksource_verify_percpu(curr_clocksource); ++ + spin_lock_irqsave(&watchdog_lock, flags); + list_for_each_entry_safe(cs, tmp, &watchdog_list, wd_list) { + if (cs->flags & CLOCK_SOURCE_UNSTABLE) { +-- +2.30.2 + diff --git a/queue-5.12/clocksource-drivers-timer-ti-dm-save-and-restore-tim.patch b/queue-5.12/clocksource-drivers-timer-ti-dm-save-and-restore-tim.patch new file mode 100644 index 00000000000..445bb0c0368 --- /dev/null +++ b/queue-5.12/clocksource-drivers-timer-ti-dm-save-and-restore-tim.patch @@ -0,0 +1,67 @@ +From 554c4c4c52d5ba18cf52b83e86e69a1b84864898 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 11:55:06 +0300 +Subject: clocksource/drivers/timer-ti-dm: Save and restore timer TIOCP_CFG + +From: Tony Lindgren + +[ Upstream commit 9517c577f9f722270584cfb1a7b4e1354e408658 ] + +As we are using cpu_pm to save and restore context, we must also save and +restore the timer sysconfig register TIOCP_CFG. This is needed because +we are not calling PM runtime functions at all with cpu_pm. + +Fixes: b34677b0999a ("clocksource/drivers/timer-ti-dm: Implement cpu_pm notifier for context save and restore") +Cc: Aaro Koskinen +Cc: Adam Ford +Cc: Andreas Kemnade +Cc: Lokesh Vutla +Cc: Peter Ujfalusi +Signed-off-by: Tony Lindgren +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20210415085506.56828-1-tony@atomide.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-ti-dm.c | 6 ++++++ + include/clocksource/timer-ti-dm.h | 1 + + 2 files changed, 7 insertions(+) + +diff --git a/drivers/clocksource/timer-ti-dm.c b/drivers/clocksource/timer-ti-dm.c +index 33eeabf9c3d1..e5c631f1b5cb 100644 +--- a/drivers/clocksource/timer-ti-dm.c ++++ b/drivers/clocksource/timer-ti-dm.c +@@ -78,6 +78,9 @@ static void omap_dm_timer_write_reg(struct omap_dm_timer *timer, u32 reg, + + static void omap_timer_restore_context(struct omap_dm_timer *timer) + { ++ __omap_dm_timer_write(timer, OMAP_TIMER_OCP_CFG_OFFSET, ++ timer->context.ocp_cfg, 0); ++ + omap_dm_timer_write_reg(timer, OMAP_TIMER_WAKEUP_EN_REG, + timer->context.twer); + omap_dm_timer_write_reg(timer, OMAP_TIMER_COUNTER_REG, +@@ -95,6 +98,9 @@ static void omap_timer_restore_context(struct omap_dm_timer *timer) + + static void omap_timer_save_context(struct omap_dm_timer *timer) + { ++ timer->context.ocp_cfg = ++ __omap_dm_timer_read(timer, OMAP_TIMER_OCP_CFG_OFFSET, 0); ++ + timer->context.tclr = + omap_dm_timer_read_reg(timer, OMAP_TIMER_CTRL_REG); + timer->context.twer = +diff --git a/include/clocksource/timer-ti-dm.h b/include/clocksource/timer-ti-dm.h +index 4c61dade8835..f6da8a132639 100644 +--- a/include/clocksource/timer-ti-dm.h ++++ b/include/clocksource/timer-ti-dm.h +@@ -74,6 +74,7 @@ + #define OMAP_TIMER_ERRATA_I103_I767 0x80000000 + + struct timer_regs { ++ u32 ocp_cfg; + u32 tidr; + u32 tier; + u32 twer; +-- +2.30.2 + diff --git a/queue-5.12/clocksource-retry-clock-read-if-long-delays-detected.patch b/queue-5.12/clocksource-retry-clock-read-if-long-delays-detected.patch new file mode 100644 index 00000000000..c2c42ce7ebd --- /dev/null +++ b/queue-5.12/clocksource-retry-clock-read-if-long-delays-detected.patch @@ -0,0 +1,144 @@ +From 017d03f21e8e1f2f8b787df2860d49b5eaa2c1e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 12:01:19 -0700 +Subject: clocksource: Retry clock read if long delays detected + +From: Paul E. McKenney + +[ Upstream commit db3a34e17433de2390eb80d436970edcebd0ca3e ] + +When the clocksource watchdog marks a clock as unstable, this might be due +to that clock being unstable or it might be due to delays that happen to +occur between the reads of the two clocks. Yes, interrupts are disabled +across those two reads, but there are no shortage of things that can delay +interrupts-disabled regions of code ranging from SMI handlers to vCPU +preemption. It would be good to have some indication as to why the clock +was marked unstable. + +Therefore, re-read the watchdog clock on either side of the read from the +clock under test. If the watchdog clock shows an excessive time delta +between its pair of reads, the reads are retried. + +The maximum number of retries is specified by a new kernel boot parameter +clocksource.max_cswd_read_retries, which defaults to three, that is, up to +four reads, one initial and up to three retries. If more than one retry +was required, a message is printed on the console (the occasional single +retry is expected behavior, especially in guest OSes). If the maximum +number of retries is exceeded, the clock under test will be marked +unstable. However, the probability of this happening due to various sorts +of delays is quite small. In addition, the reason (clock-read delays) for +the unstable marking will be apparent. + +Reported-by: Chris Mason +Signed-off-by: Paul E. McKenney +Signed-off-by: Thomas Gleixner +Acked-by: Feng Tang +Link: https://lore.kernel.org/r/20210527190124.440372-1-paulmck@kernel.org +Signed-off-by: Sasha Levin +--- + .../admin-guide/kernel-parameters.txt | 6 +++ + kernel/time/clocksource.c | 53 ++++++++++++++++--- + 2 files changed, 53 insertions(+), 6 deletions(-) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 835f810f2f26..c08e174e6ff4 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -583,6 +583,12 @@ + loops can be debugged more effectively on production + systems. + ++ clocksource.max_cswd_read_retries= [KNL] ++ Number of clocksource_watchdog() retries due to ++ external delays before the clock will be marked ++ unstable. Defaults to three retries, that is, ++ four attempts to read the clock under test. ++ + clearcpuid=BITNUM[,BITNUM...] [X86] + Disable CPUID feature X for the kernel. See + arch/x86/include/asm/cpufeatures.h for the valid bit +diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c +index cce484a2cc7c..49b25f1cc344 100644 +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -124,6 +124,13 @@ static void __clocksource_change_rating(struct clocksource *cs, int rating); + #define WATCHDOG_INTERVAL (HZ >> 1) + #define WATCHDOG_THRESHOLD (NSEC_PER_SEC >> 4) + ++/* ++ * Maximum permissible delay between two readouts of the watchdog ++ * clocksource surrounding a read of the clocksource being validated. ++ * This delay could be due to SMIs, NMIs, or to VCPU preemptions. ++ */ ++#define WATCHDOG_MAX_SKEW (100 * NSEC_PER_USEC) ++ + static void clocksource_watchdog_work(struct work_struct *work) + { + /* +@@ -184,12 +191,45 @@ void clocksource_mark_unstable(struct clocksource *cs) + spin_unlock_irqrestore(&watchdog_lock, flags); + } + ++static ulong max_cswd_read_retries = 3; ++module_param(max_cswd_read_retries, ulong, 0644); ++ ++static bool cs_watchdog_read(struct clocksource *cs, u64 *csnow, u64 *wdnow) ++{ ++ unsigned int nretries; ++ u64 wd_end, wd_delta; ++ int64_t wd_delay; ++ ++ for (nretries = 0; nretries <= max_cswd_read_retries; nretries++) { ++ local_irq_disable(); ++ *wdnow = watchdog->read(watchdog); ++ *csnow = cs->read(cs); ++ wd_end = watchdog->read(watchdog); ++ local_irq_enable(); ++ ++ wd_delta = clocksource_delta(wd_end, *wdnow, watchdog->mask); ++ wd_delay = clocksource_cyc2ns(wd_delta, watchdog->mult, ++ watchdog->shift); ++ if (wd_delay <= WATCHDOG_MAX_SKEW) { ++ if (nretries > 1 || nretries >= max_cswd_read_retries) { ++ pr_warn("timekeeping watchdog on CPU%d: %s retried %d times before success\n", ++ smp_processor_id(), watchdog->name, nretries); ++ } ++ return true; ++ } ++ } ++ ++ pr_warn("timekeeping watchdog on CPU%d: %s read-back delay of %lldns, attempt %d, marking unstable\n", ++ smp_processor_id(), watchdog->name, wd_delay, nretries); ++ return false; ++} ++ + static void clocksource_watchdog(struct timer_list *unused) + { +- struct clocksource *cs; + u64 csnow, wdnow, cslast, wdlast, delta; +- int64_t wd_nsec, cs_nsec; + int next_cpu, reset_pending; ++ int64_t wd_nsec, cs_nsec; ++ struct clocksource *cs; + + spin_lock(&watchdog_lock); + if (!watchdog_running) +@@ -206,10 +246,11 @@ static void clocksource_watchdog(struct timer_list *unused) + continue; + } + +- local_irq_disable(); +- csnow = cs->read(cs); +- wdnow = watchdog->read(watchdog); +- local_irq_enable(); ++ if (!cs_watchdog_read(cs, &csnow, &wdnow)) { ++ /* Clock readout unreliable, so give it up. */ ++ __clocksource_unstable(cs); ++ continue; ++ } + + /* Clocksource initialized ? */ + if (!(cs->flags & CLOCK_SOURCE_WATCHDOG) || +-- +2.30.2 + diff --git a/queue-5.12/configfs-fix-memleak-in-configfs_release_bin_file.patch b/queue-5.12/configfs-fix-memleak-in-configfs_release_bin_file.patch new file mode 100644 index 00000000000..eb374b1d323 --- /dev/null +++ b/queue-5.12/configfs-fix-memleak-in-configfs_release_bin_file.patch @@ -0,0 +1,47 @@ +From b8ae1b2dcc2ca07f930285a43727e084f89f925a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 15:59:25 +0800 +Subject: configfs: fix memleak in configfs_release_bin_file + +From: Chung-Chiang Cheng + +[ Upstream commit 3c252b087de08d3cb32468b54a158bd7ad0ae2f7 ] + +When reading binary attributes in progress, buffer->bin_buffer is setup in +configfs_read_bin_file() but never freed. + +Fixes: 03607ace807b4 ("configfs: implement binary attributes") +Signed-off-by: Chung-Chiang Cheng +[hch: move the vfree rather than duplicating it] +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/configfs/file.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/fs/configfs/file.c b/fs/configfs/file.c +index da8351d1e455..4d0825213116 100644 +--- a/fs/configfs/file.c ++++ b/fs/configfs/file.c +@@ -482,13 +482,13 @@ static int configfs_release_bin_file(struct inode *inode, struct file *file) + buffer->bin_buffer_size); + } + up_read(&frag->frag_sem); +- /* vfree on NULL is safe */ +- vfree(buffer->bin_buffer); +- buffer->bin_buffer = NULL; +- buffer->bin_buffer_size = 0; +- buffer->needs_read_fill = 1; + } + ++ vfree(buffer->bin_buffer); ++ buffer->bin_buffer = NULL; ++ buffer->bin_buffer_size = 0; ++ buffer->needs_read_fill = 1; ++ + configfs_release(inode, file); + return 0; + } +-- +2.30.2 + diff --git a/queue-5.12/coresight-core-fix-use-of-uninitialized-pointer.patch b/queue-5.12/coresight-core-fix-use-of-uninitialized-pointer.patch new file mode 100644 index 00000000000..fcfb4a57e23 --- /dev/null +++ b/queue-5.12/coresight-core-fix-use-of-uninitialized-pointer.patch @@ -0,0 +1,41 @@ +From 9297972c4121ccadec70e92b93a0cd5aebc39285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 11:58:57 -0600 +Subject: coresight: core: Fix use of uninitialized pointer + +From: Junhao He + +[ Upstream commit d777a8991847729ec4e2a13fcad58c2b00bb19dc ] + +Currently the pointer "sink" might be checked before initialized. Fix +this by initializing this pointer. + +Link: https://lore.kernel.org/r/1620912469-52222-2-git-send-email-liuqi115@huawei.com +Fixes: 6d578258b955 ("coresight: Make sysfs functional on topologies with per core sink") +Signed-off-by: Junhao He +Signed-off-by: Qi Liu +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20210614175901.532683-3-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c +index 0062c8935653..237a8c0d6c24 100644 +--- a/drivers/hwtracing/coresight/coresight-core.c ++++ b/drivers/hwtracing/coresight/coresight-core.c +@@ -595,7 +595,7 @@ static struct coresight_device * + coresight_find_enabled_sink(struct coresight_device *csdev) + { + int i; +- struct coresight_device *sink; ++ struct coresight_device *sink = NULL; + + if ((csdev->type == CORESIGHT_DEV_TYPE_SINK || + csdev->type == CORESIGHT_DEV_TYPE_LINKSINK) && +-- +2.30.2 + diff --git a/queue-5.12/cpufreq-make-cpufreq_online-call-driver-offline-on-e.patch b/queue-5.12/cpufreq-make-cpufreq_online-call-driver-offline-on-e.patch new file mode 100644 index 00000000000..0b524f0c254 --- /dev/null +++ b/queue-5.12/cpufreq-make-cpufreq_online-call-driver-offline-on-e.patch @@ -0,0 +1,62 @@ +From bc9a43bce9cbbe482a111897573dd2f45e73f1ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 21:11:39 +0200 +Subject: cpufreq: Make cpufreq_online() call driver->offline() on errors + +From: Rafael J. Wysocki + +[ Upstream commit 3b7180573c250eb6e2a7eec54ae91f27472332ea ] + +In the CPU removal path the ->offline() callback provided by the +driver is always invoked before ->exit(), but in the cpufreq_online() +error path it is not, so ->exit() is expected to somehow know the +context in which it has been called and act accordingly. + +That is less than straightforward, so make cpufreq_online() invoke +the driver's ->offline() callback, if present, on errors before +->exit() too. + +This only potentially affects intel_pstate. + +Fixes: 91a12e91dc39 ("cpufreq: Allow light-weight tear down and bring up of CPUs") +Signed-off-by: Rafael J. Wysocki +Acked-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/cpufreq.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 1d1b563cea4b..1bc1293deae9 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1370,9 +1370,14 @@ static int cpufreq_online(unsigned int cpu) + goto out_free_policy; + } + ++ /* ++ * The initialization has succeeded and the policy is online. ++ * If there is a problem with its frequency table, take it ++ * offline and drop it. ++ */ + ret = cpufreq_table_validate_and_sort(policy); + if (ret) +- goto out_exit_policy; ++ goto out_offline_policy; + + /* related_cpus should at least include policy->cpus. */ + cpumask_copy(policy->related_cpus, policy->cpus); +@@ -1518,6 +1523,10 @@ out_destroy_policy: + + up_write(&policy->rwsem); + ++out_offline_policy: ++ if (cpufreq_driver->offline) ++ cpufreq_driver->offline(policy); ++ + out_exit_policy: + if (cpufreq_driver->exit) + cpufreq_driver->exit(policy); +-- +2.30.2 + diff --git a/queue-5.12/crypto-ccp-fix-a-resource-leak-in-an-error-handling-.patch b/queue-5.12/crypto-ccp-fix-a-resource-leak-in-an-error-handling-.patch new file mode 100644 index 00000000000..547642c78fa --- /dev/null +++ b/queue-5.12/crypto-ccp-fix-a-resource-leak-in-an-error-handling-.patch @@ -0,0 +1,51 @@ +From a1ed1f0e9cbccc711525b593294362e49c2efa43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 May 2021 08:58:04 +0200 +Subject: crypto: ccp - Fix a resource leak in an error handling path + +From: Christophe JAILLET + +[ Upstream commit a6f8e68e238a15bb15f1726b35c695136c64eaba ] + +If an error occurs after calling 'sp_get_irqs()', 'sp_free_irqs()' must be +called as already done in the error handling path. + +Fixes: f4d18d656f88 ("crypto: ccp - Abstract interrupt registeration") +Signed-off-by: Christophe JAILLET +Acked-by: John Allen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/sp-pci.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/ccp/sp-pci.c b/drivers/crypto/ccp/sp-pci.c +index f471dbaef1fb..7d346d842a39 100644 +--- a/drivers/crypto/ccp/sp-pci.c ++++ b/drivers/crypto/ccp/sp-pci.c +@@ -222,7 +222,7 @@ static int sp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + if (ret) { + dev_err(dev, "dma_set_mask_and_coherent failed (%d)\n", + ret); +- goto e_err; ++ goto free_irqs; + } + } + +@@ -230,10 +230,12 @@ static int sp_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + ret = sp_init(sp); + if (ret) +- goto e_err; ++ goto free_irqs; + + return 0; + ++free_irqs: ++ sp_free_irqs(sp); + e_err: + dev_notice(dev, "initialization failed\n"); + return ret; +-- +2.30.2 + diff --git a/queue-5.12/crypto-hisilicon-sec-fixup-3des-minimum-key-size-dec.patch b/queue-5.12/crypto-hisilicon-sec-fixup-3des-minimum-key-size-dec.patch new file mode 100644 index 00000000000..084cf25dca5 --- /dev/null +++ b/queue-5.12/crypto-hisilicon-sec-fixup-3des-minimum-key-size-dec.patch @@ -0,0 +1,39 @@ +From 42112fb6db15d33130048ac343e3abdc12e45741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 19:42:06 +0800 +Subject: crypto: hisilicon/sec - fixup 3des minimum key size declaration + +From: Kai Ye + +[ Upstream commit 6161f40c630bd7ced5f236cd5fbabec06e47afae ] + +Fixup the 3des algorithm minimum key size declaration. + +Signed-off-by: Kai Ye +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec_crypto.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index 8adcbb327126..c86b01abd0a6 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -1513,11 +1513,11 @@ static struct skcipher_alg sec_skciphers[] = { + AES_BLOCK_SIZE, AES_BLOCK_SIZE) + + SEC_SKCIPHER_ALG("ecb(des3_ede)", sec_setkey_3des_ecb, +- SEC_DES3_2KEY_SIZE, SEC_DES3_3KEY_SIZE, ++ SEC_DES3_3KEY_SIZE, SEC_DES3_3KEY_SIZE, + DES3_EDE_BLOCK_SIZE, 0) + + SEC_SKCIPHER_ALG("cbc(des3_ede)", sec_setkey_3des_cbc, +- SEC_DES3_2KEY_SIZE, SEC_DES3_3KEY_SIZE, ++ SEC_DES3_3KEY_SIZE, SEC_DES3_3KEY_SIZE, + DES3_EDE_BLOCK_SIZE, DES3_EDE_BLOCK_SIZE) + + SEC_SKCIPHER_ALG("xts(sm4)", sec_setkey_sm4_xts, +-- +2.30.2 + diff --git a/queue-5.12/crypto-ixp4xx-dma_unmap-the-correct-address.patch b/queue-5.12/crypto-ixp4xx-dma_unmap-the-correct-address.patch new file mode 100644 index 00000000000..cabc8594ead --- /dev/null +++ b/queue-5.12/crypto-ixp4xx-dma_unmap-the-correct-address.patch @@ -0,0 +1,38 @@ +From 95ee20b66fac8ac0b37cef696691765c27fa4973 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 20:26:08 +0000 +Subject: crypto: ixp4xx - dma_unmap the correct address + +From: Corentin Labbe + +[ Upstream commit 9395c58fdddd79cdd3882132cdd04e8ac7ad525f ] + +Testing ixp4xx_crypto with CONFIG_DMA_API_DEBUG lead to the following error: +DMA-API: platform ixp4xx_crypto.0: device driver tries to free DMA memory it has not allocated [device address=0x0000000000000000] [size=24 bytes] + +This is due to dma_unmap using the wrong address. + +Fixes: 0d44dc59b2b4 ("crypto: ixp4xx - Fix handling of chained sg buffers") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ixp4xx_crypto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c +index 8b0f17fc09fb..9e330e93e340 100644 +--- a/drivers/crypto/ixp4xx_crypto.c ++++ b/drivers/crypto/ixp4xx_crypto.c +@@ -330,7 +330,7 @@ static void free_buf_chain(struct device *dev, struct buffer_desc *buf, + + buf1 = buf->next; + phys1 = buf->phys_next; +- dma_unmap_single(dev, buf->phys_next, buf->buf_len, buf->dir); ++ dma_unmap_single(dev, buf->phys_addr, buf->buf_len, buf->dir); + dma_pool_free(buffer_pool, buf, phys); + buf = buf1; + phys = phys1; +-- +2.30.2 + diff --git a/queue-5.12/crypto-ixp4xx-update-iv-after-requests.patch b/queue-5.12/crypto-ixp4xx-update-iv-after-requests.patch new file mode 100644 index 00000000000..ab3959064ee --- /dev/null +++ b/queue-5.12/crypto-ixp4xx-update-iv-after-requests.patch @@ -0,0 +1,84 @@ +From e576aa6d4ea24c3115a3bee0efe89d774e601d54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 20:26:09 +0000 +Subject: crypto: ixp4xx - update IV after requests + +From: Corentin Labbe + +[ Upstream commit e8acf011f2e7e21a7e2fae47cbaa06598e533d40 ] + +Crypto selftests fail on ixp4xx since it do not update IV after skcipher +requests. + +Fixes: 81bef0150074 ("crypto: ixp4xx - Hardware crypto support for IXP4xx CPUs") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ixp4xx_crypto.c | 22 ++++++++++++++++++++++ + 1 file changed, 22 insertions(+) + +diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c +index 9e330e93e340..7567456a21a0 100644 +--- a/drivers/crypto/ixp4xx_crypto.c ++++ b/drivers/crypto/ixp4xx_crypto.c +@@ -149,6 +149,8 @@ struct crypt_ctl { + struct ablk_ctx { + struct buffer_desc *src; + struct buffer_desc *dst; ++ u8 iv[MAX_IVLEN]; ++ bool encrypt; + }; + + struct aead_ctx { +@@ -381,6 +383,20 @@ static void one_packet(dma_addr_t phys) + case CTL_FLAG_PERFORM_ABLK: { + struct skcipher_request *req = crypt->data.ablk_req; + struct ablk_ctx *req_ctx = skcipher_request_ctx(req); ++ struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req); ++ unsigned int ivsize = crypto_skcipher_ivsize(tfm); ++ unsigned int offset; ++ ++ if (ivsize > 0) { ++ offset = req->cryptlen - ivsize; ++ if (req_ctx->encrypt) { ++ scatterwalk_map_and_copy(req->iv, req->dst, ++ offset, ivsize, 0); ++ } else { ++ memcpy(req->iv, req_ctx->iv, ivsize); ++ memzero_explicit(req_ctx->iv, ivsize); ++ } ++ } + + if (req_ctx->dst) { + free_buf_chain(dev, req_ctx->dst, crypt->dst_buf); +@@ -876,6 +892,7 @@ static int ablk_perform(struct skcipher_request *req, int encrypt) + struct ablk_ctx *req_ctx = skcipher_request_ctx(req); + struct buffer_desc src_hook; + struct device *dev = &pdev->dev; ++ unsigned int offset; + gfp_t flags = req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP ? + GFP_KERNEL : GFP_ATOMIC; + +@@ -885,6 +902,7 @@ static int ablk_perform(struct skcipher_request *req, int encrypt) + return -EAGAIN; + + dir = encrypt ? &ctx->encrypt : &ctx->decrypt; ++ req_ctx->encrypt = encrypt; + + crypt = get_crypt_desc(); + if (!crypt) +@@ -900,6 +918,10 @@ static int ablk_perform(struct skcipher_request *req, int encrypt) + + BUG_ON(ivsize && !req->iv); + memcpy(crypt->iv, req->iv, ivsize); ++ if (ivsize > 0 && !encrypt) { ++ offset = req->cryptlen - ivsize; ++ scatterwalk_map_and_copy(req_ctx->iv, req->src, offset, ivsize, 0); ++ } + if (req->src != req->dst) { + struct buffer_desc dst_hook; + crypt->mode |= NPE_OP_NOT_IN_PLACE; +-- +2.30.2 + diff --git a/queue-5.12/crypto-nitrox-fix-unchecked-variable-in-nitrox_regis.patch b/queue-5.12/crypto-nitrox-fix-unchecked-variable-in-nitrox_regis.patch new file mode 100644 index 00000000000..996245192f6 --- /dev/null +++ b/queue-5.12/crypto-nitrox-fix-unchecked-variable-in-nitrox_regis.patch @@ -0,0 +1,38 @@ +From 9295c546ebb352342a85a287d3c1dae9d2fcbda8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 18:01:55 +0800 +Subject: crypto: nitrox - fix unchecked variable in nitrox_register_interrupts + +From: Tong Tiangen + +[ Upstream commit 57c126661f50b884d3812e7db6e00f2e778eccfb ] + +Function nitrox_register_interrupts leaves variable 'nr_vecs' unchecked, which +would be use as kcalloc parameter later. + +Fixes: 5155e118dda9 ("crypto: cavium/nitrox - use pci_alloc_irq_vectors() while enabling MSI-X.") +Signed-off-by: Tong Tiangen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/cavium/nitrox/nitrox_isr.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/crypto/cavium/nitrox/nitrox_isr.c b/drivers/crypto/cavium/nitrox/nitrox_isr.c +index 99b053094f5a..b16689b48f5a 100644 +--- a/drivers/crypto/cavium/nitrox/nitrox_isr.c ++++ b/drivers/crypto/cavium/nitrox/nitrox_isr.c +@@ -307,6 +307,10 @@ int nitrox_register_interrupts(struct nitrox_device *ndev) + * Entry 192: NPS_CORE_INT_ACTIVE + */ + nr_vecs = pci_msix_vec_count(pdev); ++ if (nr_vecs < 0) { ++ dev_err(DEV(ndev), "Error in getting vec count %d\n", nr_vecs); ++ return nr_vecs; ++ } + + /* Enable MSI-X */ + ret = pci_alloc_irq_vectors(pdev, nr_vecs, nr_vecs, PCI_IRQ_MSIX); +-- +2.30.2 + diff --git a/queue-5.12/crypto-nx-add-missing-module_device_table.patch b/queue-5.12/crypto-nx-add-missing-module_device_table.patch new file mode 100644 index 00000000000..07c1f2924a2 --- /dev/null +++ b/queue-5.12/crypto-nx-add-missing-module_device_table.patch @@ -0,0 +1,36 @@ +From 5dd9d503ecff54358f6655511068044ee3569288 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:14:55 +0800 +Subject: crypto: nx - add missing MODULE_DEVICE_TABLE + +From: Bixuan Cui + +[ Upstream commit 06676aa1f455c74e3ad1624cea3acb9ed2ef71ae ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Bixuan Cui +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/nx/nx-842-pseries.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/nx/nx-842-pseries.c b/drivers/crypto/nx/nx-842-pseries.c +index cc8dd3072b8b..8ee547ee378e 100644 +--- a/drivers/crypto/nx/nx-842-pseries.c ++++ b/drivers/crypto/nx/nx-842-pseries.c +@@ -1069,6 +1069,7 @@ static const struct vio_device_id nx842_vio_driver_ids[] = { + {"ibm,compression-v1", "ibm,compression"}, + {"", ""}, + }; ++MODULE_DEVICE_TABLE(vio, nx842_vio_driver_ids); + + static struct vio_driver nx842_vio_driver = { + .name = KBUILD_MODNAME, +-- +2.30.2 + diff --git a/queue-5.12/crypto-nx-fix-rcu-warning-in-nx842_of_upd_status.patch b/queue-5.12/crypto-nx-fix-rcu-warning-in-nx842_of_upd_status.patch new file mode 100644 index 00000000000..20548fde7f6 --- /dev/null +++ b/queue-5.12/crypto-nx-fix-rcu-warning-in-nx842_of_upd_status.patch @@ -0,0 +1,61 @@ +From 5009f604e114c9622a51cc4ea3c7e3427412bcb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 15:57:12 +0800 +Subject: crypto: nx - Fix RCU warning in nx842_OF_upd_status + +From: Herbert Xu + +[ Upstream commit 2a96726bd0ccde4f12b9b9a9f61f7b1ac5af7e10 ] + +The function nx842_OF_upd_status triggers a sparse RCU warning when +it directly dereferences the RCU-protected devdata. This appears +to be an accident as there was another variable of the same name +that was passed in from the caller. + +After it was removed (because the main purpose of using it, to +update the status member was itself removed) the global variable +unintenionally stood in as its replacement. + +This patch restores the devdata parameter. + +Fixes: 90fd73f912f0 ("crypto: nx - remove pSeries NX 'status' field") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/nx/nx-842-pseries.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/nx/nx-842-pseries.c b/drivers/crypto/nx/nx-842-pseries.c +index 8ee547ee378e..9b2417ebc95a 100644 +--- a/drivers/crypto/nx/nx-842-pseries.c ++++ b/drivers/crypto/nx/nx-842-pseries.c +@@ -538,13 +538,15 @@ static int nx842_OF_set_defaults(struct nx842_devdata *devdata) + * The status field indicates if the device is enabled when the status + * is 'okay'. Otherwise the device driver will be disabled. + * +- * @prop - struct property point containing the maxsyncop for the update ++ * @devdata: struct nx842_devdata to use for dev_info ++ * @prop: struct property point containing the maxsyncop for the update + * + * Returns: + * 0 - Device is available + * -ENODEV - Device is not available + */ +-static int nx842_OF_upd_status(struct property *prop) ++static int nx842_OF_upd_status(struct nx842_devdata *devdata, ++ struct property *prop) + { + const char *status = (const char *)prop->value; + +@@ -758,7 +760,7 @@ static int nx842_OF_upd(struct property *new_prop) + goto out; + + /* Perform property updates */ +- ret = nx842_OF_upd_status(status); ++ ret = nx842_OF_upd_status(new_devdata, status); + if (ret) + goto error_out; + +-- +2.30.2 + diff --git a/queue-5.12/crypto-omap-sham-fix-pm-reference-leak-in-omap-sham-.patch b/queue-5.12/crypto-omap-sham-fix-pm-reference-leak-in-omap-sham-.patch new file mode 100644 index 00000000000..60d5ddbc255 --- /dev/null +++ b/queue-5.12/crypto-omap-sham-fix-pm-reference-leak-in-omap-sham-.patch @@ -0,0 +1,48 @@ +From da137a0f08d173335987e4e42d7de83755e293b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 22:51:18 +0800 +Subject: crypto: omap-sham - Fix PM reference leak in omap sham ops + +From: Zhang Qilong + +[ Upstream commit ca323b2c61ec321eb9f2179a405b9c34cdb4f553 ] + +pm_runtime_get_sync will increment pm usage counter +even it failed. Forgetting to putting operation will +result in reference leak here. We fix it by replacing +it with pm_runtime_resume_and_get to keep usage counter +balanced. + +Fixes: 604c31039dae4 ("crypto: omap-sham - Check for return value from pm_runtime_get_sync") +Signed-off-by: Zhang Qilong +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/omap-sham.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c +index ae0d320d3c60..dd53ad9987b0 100644 +--- a/drivers/crypto/omap-sham.c ++++ b/drivers/crypto/omap-sham.c +@@ -372,7 +372,7 @@ static int omap_sham_hw_init(struct omap_sham_dev *dd) + { + int err; + +- err = pm_runtime_get_sync(dd->dev); ++ err = pm_runtime_resume_and_get(dd->dev); + if (err < 0) { + dev_err(dd->dev, "failed to get sync: %d\n", err); + return err; +@@ -2244,7 +2244,7 @@ static int omap_sham_suspend(struct device *dev) + + static int omap_sham_resume(struct device *dev) + { +- int err = pm_runtime_get_sync(dev); ++ int err = pm_runtime_resume_and_get(dev); + if (err < 0) { + dev_err(dev, "failed to get sync: %d\n", err); + return err; +-- +2.30.2 + diff --git a/queue-5.12/crypto-qat-check-return-code-of-qat_hal_rd_rel_reg.patch b/queue-5.12/crypto-qat-check-return-code-of-qat_hal_rd_rel_reg.patch new file mode 100644 index 00000000000..df9990ebaad --- /dev/null +++ b/queue-5.12/crypto-qat-check-return-code-of-qat_hal_rd_rel_reg.patch @@ -0,0 +1,47 @@ +From ab867e1b339338d5a591a923c62af77d40d59eb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 05:13:15 -0400 +Subject: crypto: qat - check return code of qat_hal_rd_rel_reg() + +From: Jack Xu + +[ Upstream commit 96b57229209490c8bca4335b01a426a96173dc56 ] + +Check the return code of the function qat_hal_rd_rel_reg() and return it +to the caller. + +This is to fix the following warning when compiling the driver with +clang scan-build: + + drivers/crypto/qat/qat_common/qat_hal.c:1436:2: warning: 6th function call argument is an uninitialized value + +Signed-off-by: Jack Xu +Co-developed-by: Zhehui Xiang +Signed-off-by: Zhehui Xiang +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_hal.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c +index bd3028126cbe..069f51621f0e 100644 +--- a/drivers/crypto/qat/qat_common/qat_hal.c ++++ b/drivers/crypto/qat/qat_common/qat_hal.c +@@ -1417,7 +1417,11 @@ static int qat_hal_put_rel_wr_xfer(struct icp_qat_fw_loader_handle *handle, + pr_err("QAT: bad xfrAddr=0x%x\n", xfr_addr); + return -EINVAL; + } +- qat_hal_rd_rel_reg(handle, ae, ctx, ICP_GPB_REL, gprnum, &gprval); ++ status = qat_hal_rd_rel_reg(handle, ae, ctx, ICP_GPB_REL, gprnum, &gprval); ++ if (status) { ++ pr_err("QAT: failed to read register"); ++ return status; ++ } + gpr_addr = qat_hal_get_reg_addr(ICP_GPB_REL, gprnum); + data16low = 0xffff & data; + data16hi = 0xffff & (data >> 0x10); +-- +2.30.2 + diff --git a/queue-5.12/crypto-qat-remove-unused-macro-in-fw-loader.patch b/queue-5.12/crypto-qat-remove-unused-macro-in-fw-loader.patch new file mode 100644 index 00000000000..15d35dcbbd7 --- /dev/null +++ b/queue-5.12/crypto-qat-remove-unused-macro-in-fw-loader.patch @@ -0,0 +1,42 @@ +From 4b9883e7eeddf0d2022639b5c49bf2ab6b229dd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 05:13:16 -0400 +Subject: crypto: qat - remove unused macro in FW loader + +From: Jack Xu + +[ Upstream commit 9afe77cf25d9670e61b489fd52cc6f75fd7f6803 ] + +Remove the unused macro ICP_DH895XCC_PESRAM_BAR_SIZE in the firmware +loader. + +This is to fix the following warning when compiling the driver using the +clang compiler with CC=clang W=2: + + drivers/crypto/qat/qat_common/qat_uclo.c:345:9: warning: macro is not used [-Wunused-macros] + +Signed-off-by: Jack Xu +Co-developed-by: Zhehui Xiang +Signed-off-by: Zhehui Xiang +Reviewed-by: Giovanni Cabiddu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_uclo.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_uclo.c b/drivers/crypto/qat/qat_common/qat_uclo.c +index 1fb5fc852f6b..6d95160e451e 100644 +--- a/drivers/crypto/qat/qat_common/qat_uclo.c ++++ b/drivers/crypto/qat/qat_common/qat_uclo.c +@@ -342,7 +342,6 @@ static int qat_uclo_init_umem_seg(struct icp_qat_fw_loader_handle *handle, + return 0; + } + +-#define ICP_DH895XCC_PESRAM_BAR_SIZE 0x80000 + static int qat_uclo_init_ae_memory(struct icp_qat_fw_loader_handle *handle, + struct icp_qat_uof_initmem *init_mem) + { +-- +2.30.2 + diff --git a/queue-5.12/crypto-qce-skcipher-fix-incorrect-sg-count-for-dma-t.patch b/queue-5.12/crypto-qce-skcipher-fix-incorrect-sg-count-for-dma-t.patch new file mode 100644 index 00000000000..ec0fb41e31c --- /dev/null +++ b/queue-5.12/crypto-qce-skcipher-fix-incorrect-sg-count-for-dma-t.patch @@ -0,0 +1,70 @@ +From 1a28aa9626486c25f1adc4e2f40d1235a981fc28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 22:20:23 -0400 +Subject: crypto: qce: skcipher: Fix incorrect sg count for dma transfers + +From: Thara Gopinath + +[ Upstream commit 1339a7c3ba05137a2d2fe75f602311bbfc6fab33 ] + +Use the sg count returned by dma_map_sg to call into +dmaengine_prep_slave_sg rather than using the original sg count. dma_map_sg +can merge consecutive sglist entries, thus making the original sg count +wrong. This is a fix for memory coruption issues observed while testing +encryption/decryption of large messages using libkcapi framework. + +Patch has been tested further by running full suite of tcrypt.ko tests +including fuzz tests. + +Signed-off-by: Thara Gopinath +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qce/skcipher.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/crypto/qce/skcipher.c b/drivers/crypto/qce/skcipher.c +index a2d3da0ad95f..5a6559131eac 100644 +--- a/drivers/crypto/qce/skcipher.c ++++ b/drivers/crypto/qce/skcipher.c +@@ -71,7 +71,7 @@ qce_skcipher_async_req_handle(struct crypto_async_request *async_req) + struct scatterlist *sg; + bool diff_dst; + gfp_t gfp; +- int ret; ++ int dst_nents, src_nents, ret; + + rctx->iv = req->iv; + rctx->ivsize = crypto_skcipher_ivsize(skcipher); +@@ -122,21 +122,22 @@ qce_skcipher_async_req_handle(struct crypto_async_request *async_req) + sg_mark_end(sg); + rctx->dst_sg = rctx->dst_tbl.sgl; + +- ret = dma_map_sg(qce->dev, rctx->dst_sg, rctx->dst_nents, dir_dst); +- if (ret < 0) ++ dst_nents = dma_map_sg(qce->dev, rctx->dst_sg, rctx->dst_nents, dir_dst); ++ if (dst_nents < 0) + goto error_free; + + if (diff_dst) { +- ret = dma_map_sg(qce->dev, req->src, rctx->src_nents, dir_src); +- if (ret < 0) ++ src_nents = dma_map_sg(qce->dev, req->src, rctx->src_nents, dir_src); ++ if (src_nents < 0) + goto error_unmap_dst; + rctx->src_sg = req->src; + } else { + rctx->src_sg = rctx->dst_sg; ++ src_nents = dst_nents - 1; + } + +- ret = qce_dma_prep_sgs(&qce->dma, rctx->src_sg, rctx->src_nents, +- rctx->dst_sg, rctx->dst_nents, ++ ret = qce_dma_prep_sgs(&qce->dma, rctx->src_sg, src_nents, ++ rctx->dst_sg, dst_nents, + qce_skcipher_done, async_req); + if (ret) + goto error_unmap_src; +-- +2.30.2 + diff --git a/queue-5.12/crypto-sa2ul-fix-leaks-on-failure-paths-with-sa_dma_.patch b/queue-5.12/crypto-sa2ul-fix-leaks-on-failure-paths-with-sa_dma_.patch new file mode 100644 index 00000000000..1937ae84fde --- /dev/null +++ b/queue-5.12/crypto-sa2ul-fix-leaks-on-failure-paths-with-sa_dma_.patch @@ -0,0 +1,99 @@ +From de4a7f50f5774eb41016c592f36f735331302ed0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 11:12:42 -0500 +Subject: crypto: sa2ul - Fix leaks on failure paths with sa_dma_init() + +From: Suman Anna + +[ Upstream commit 4c0716ee1d973f6504d13f0e8d4d10350c85ad37 ] + +The sa_dma_init() function doesn't release the requested dma channels +on all failure paths. Any failure in this function also ends up +leaking the dma pool created in sa_init_mem() in the sa_ul_probe() +function. Fix all of these issues. + +Fixes: 7694b6ca649f ("crypto: sa2ul - Add crypto driver") +Signed-off-by: Suman Anna +Reviewed-by: Tero Kristo +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sa2ul.c | 21 ++++++++++++--------- + 1 file changed, 12 insertions(+), 9 deletions(-) + +diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c +index b0f0502a5bb0..efde3e96f62d 100644 +--- a/drivers/crypto/sa2ul.c ++++ b/drivers/crypto/sa2ul.c +@@ -2275,9 +2275,9 @@ static int sa_dma_init(struct sa_crypto_data *dd) + + dd->dma_rx2 = dma_request_chan(dd->dev, "rx2"); + if (IS_ERR(dd->dma_rx2)) { +- dma_release_channel(dd->dma_rx1); +- return dev_err_probe(dd->dev, PTR_ERR(dd->dma_rx2), +- "Unable to request rx2 DMA channel\n"); ++ ret = dev_err_probe(dd->dev, PTR_ERR(dd->dma_rx2), ++ "Unable to request rx2 DMA channel\n"); ++ goto err_dma_rx2; + } + + dd->dma_tx = dma_request_chan(dd->dev, "tx"); +@@ -2298,28 +2298,31 @@ static int sa_dma_init(struct sa_crypto_data *dd) + if (ret) { + dev_err(dd->dev, "can't configure IN dmaengine slave: %d\n", + ret); +- return ret; ++ goto err_dma_config; + } + + ret = dmaengine_slave_config(dd->dma_rx2, &cfg); + if (ret) { + dev_err(dd->dev, "can't configure IN dmaengine slave: %d\n", + ret); +- return ret; ++ goto err_dma_config; + } + + ret = dmaengine_slave_config(dd->dma_tx, &cfg); + if (ret) { + dev_err(dd->dev, "can't configure OUT dmaengine slave: %d\n", + ret); +- return ret; ++ goto err_dma_config; + } + + return 0; + ++err_dma_config: ++ dma_release_channel(dd->dma_tx); + err_dma_tx: +- dma_release_channel(dd->dma_rx1); + dma_release_channel(dd->dma_rx2); ++err_dma_rx2: ++ dma_release_channel(dd->dma_rx1); + + return ret; + } +@@ -2364,7 +2367,7 @@ static int sa_ul_probe(struct platform_device *pdev) + sa_init_mem(dev_data); + ret = sa_dma_init(dev_data); + if (ret) +- goto disable_pm_runtime; ++ goto destroy_dma_pool; + + spin_lock_init(&dev_data->scid_lock); + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +@@ -2394,9 +2397,9 @@ release_dma: + dma_release_channel(dev_data->dma_rx1); + dma_release_channel(dev_data->dma_tx); + ++destroy_dma_pool: + dma_pool_destroy(dev_data->sc_pool); + +-disable_pm_runtime: + pm_runtime_put_sync(&pdev->dev); + pm_runtime_disable(&pdev->dev); + +-- +2.30.2 + diff --git a/queue-5.12/crypto-sa2ul-fix-pm_runtime-enable-in-sa_ul_probe.patch b/queue-5.12/crypto-sa2ul-fix-pm_runtime-enable-in-sa_ul_probe.patch new file mode 100644 index 00000000000..9a8c7cf9347 --- /dev/null +++ b/queue-5.12/crypto-sa2ul-fix-pm_runtime-enable-in-sa_ul_probe.patch @@ -0,0 +1,39 @@ +From a0434d811312c52c9a1f144bc1f91b699d992e84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 11:12:43 -0500 +Subject: crypto: sa2ul - Fix pm_runtime enable in sa_ul_probe() + +From: Suman Anna + +[ Upstream commit 5c8552325e013cbdabc443cd1f1b4d03c4a2e64e ] + +The pm_runtime APIs added first in commit 7694b6ca649f ("crypto: sa2ul - +Add crypto driver") are not unwound properly and was fixed up partially +in commit 13343badae09 ("crypto: sa2ul - Fix PM reference leak in +sa_ul_probe()"). This fixed up the pm_runtime usage count but not the +state. Fix this properly. + +Fixes: 13343badae09 ("crypto: sa2ul - Fix PM reference leak in sa_ul_probe()") +Signed-off-by: Suman Anna +Reviewed-by: Tero Kristo +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/sa2ul.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c +index efde3e96f62d..ba116670ef8c 100644 +--- a/drivers/crypto/sa2ul.c ++++ b/drivers/crypto/sa2ul.c +@@ -2361,6 +2361,7 @@ static int sa_ul_probe(struct platform_device *pdev) + if (ret < 0) { + dev_err(&pdev->dev, "%s: failed to get sync: %d\n", __func__, + ret); ++ pm_runtime_disable(dev); + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.12/crypto-shash-avoid-comparing-pointers-to-exported-fu.patch b/queue-5.12/crypto-shash-avoid-comparing-pointers-to-exported-fu.patch new file mode 100644 index 00000000000..bb917b6b04f --- /dev/null +++ b/queue-5.12/crypto-shash-avoid-comparing-pointers-to-exported-fu.patch @@ -0,0 +1,88 @@ +From a4c63feaec7de8bd09347ebcc3ddc9ad5d0b6ec1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 08:21:50 +0200 +Subject: crypto: shash - avoid comparing pointers to exported functions under + CFI + +From: Ard Biesheuvel + +[ Upstream commit 22ca9f4aaf431a9413dcc115dd590123307f274f ] + +crypto_shash_alg_has_setkey() is implemented by testing whether the +.setkey() member of a struct shash_alg points to the default version, +called shash_no_setkey(). As crypto_shash_alg_has_setkey() is a static +inline, this requires shash_no_setkey() to be exported to modules. + +Unfortunately, when building with CFI, function pointers are routed +via CFI stubs which are private to each module (or to the kernel proper) +and so this function pointer comparison may fail spuriously. + +Let's fix this by turning crypto_shash_alg_has_setkey() into an out of +line function. + +Cc: Sami Tolvanen +Cc: Eric Biggers +Signed-off-by: Ard Biesheuvel +Reviewed-by: Eric Biggers +Reviewed-by: Sami Tolvanen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/shash.c | 18 +++++++++++++++--- + include/crypto/internal/hash.h | 8 +------- + 2 files changed, 16 insertions(+), 10 deletions(-) + +diff --git a/crypto/shash.c b/crypto/shash.c +index 2e3433ad9762..0a0a50cb694f 100644 +--- a/crypto/shash.c ++++ b/crypto/shash.c +@@ -20,12 +20,24 @@ + + static const struct crypto_type crypto_shash_type; + +-int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, +- unsigned int keylen) ++static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, ++ unsigned int keylen) + { + return -ENOSYS; + } +-EXPORT_SYMBOL_GPL(shash_no_setkey); ++ ++/* ++ * Check whether an shash algorithm has a setkey function. ++ * ++ * For CFI compatibility, this must not be an inline function. This is because ++ * when CFI is enabled, modules won't get the same address for shash_no_setkey ++ * (if it were exported, which inlining would require) as the core kernel will. ++ */ ++bool crypto_shash_alg_has_setkey(struct shash_alg *alg) ++{ ++ return alg->setkey != shash_no_setkey; ++} ++EXPORT_SYMBOL_GPL(crypto_shash_alg_has_setkey); + + static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key, + unsigned int keylen) +diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h +index 0a288dddcf5b..25806141db59 100644 +--- a/include/crypto/internal/hash.h ++++ b/include/crypto/internal/hash.h +@@ -75,13 +75,7 @@ void crypto_unregister_ahashes(struct ahash_alg *algs, int count); + int ahash_register_instance(struct crypto_template *tmpl, + struct ahash_instance *inst); + +-int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, +- unsigned int keylen); +- +-static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg) +-{ +- return alg->setkey != shash_no_setkey; +-} ++bool crypto_shash_alg_has_setkey(struct shash_alg *alg); + + static inline bool crypto_shash_alg_needs_key(struct shash_alg *alg) + { +-- +2.30.2 + diff --git a/queue-5.12/crypto-sm2-fix-a-memory-leak-in-sm2.patch b/queue-5.12/crypto-sm2-fix-a-memory-leak-in-sm2.patch new file mode 100644 index 00000000000..36e3a7399a8 --- /dev/null +++ b/queue-5.12/crypto-sm2-fix-a-memory-leak-in-sm2.patch @@ -0,0 +1,87 @@ +From cf5c83641c593ad2ee75aaf9da18492a4a23109f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 14:30:35 +0800 +Subject: crypto: sm2 - fix a memory leak in sm2 + +From: Hongbo Li + +[ Upstream commit 5cd259ca5d466f65ffd21e2e2fa00fb648a8c555 ] + +SM2 module alloc ec->Q in sm2_set_pub_key(), when doing alg test in +test_akcipher_one(), it will set public key for every test vector, +and don't free ec->Q. This will cause a memory leak. + +This patch alloc ec->Q in sm2_ec_ctx_init(). + +Fixes: ea7ecb66440b ("crypto: sm2 - introduce OSCCA SM2 asymmetric cipher algorithm") +Signed-off-by: Hongbo Li +Reviewed-by: Tianjia Zhang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/sm2.c | 24 ++++++++++-------------- + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/crypto/sm2.c b/crypto/sm2.c +index b21addc3ac06..db8a4a265669 100644 +--- a/crypto/sm2.c ++++ b/crypto/sm2.c +@@ -79,10 +79,17 @@ static int sm2_ec_ctx_init(struct mpi_ec_ctx *ec) + goto free; + + rc = -ENOMEM; ++ ++ ec->Q = mpi_point_new(0); ++ if (!ec->Q) ++ goto free; ++ + /* mpi_ec_setup_elliptic_curve */ + ec->G = mpi_point_new(0); +- if (!ec->G) ++ if (!ec->G) { ++ mpi_point_release(ec->Q); + goto free; ++ } + + mpi_set(ec->G->x, x); + mpi_set(ec->G->y, y); +@@ -91,6 +98,7 @@ static int sm2_ec_ctx_init(struct mpi_ec_ctx *ec) + rc = -EINVAL; + ec->n = mpi_scanval(ecp->n); + if (!ec->n) { ++ mpi_point_release(ec->Q); + mpi_point_release(ec->G); + goto free; + } +@@ -386,27 +394,15 @@ static int sm2_set_pub_key(struct crypto_akcipher *tfm, + MPI a; + int rc; + +- ec->Q = mpi_point_new(0); +- if (!ec->Q) +- return -ENOMEM; +- + /* include the uncompressed flag '0x04' */ +- rc = -ENOMEM; + a = mpi_read_raw_data(key, keylen); + if (!a) +- goto error; ++ return -ENOMEM; + + mpi_normalize(a); + rc = sm2_ecc_os2ec(ec->Q, a); + mpi_free(a); +- if (rc) +- goto error; +- +- return 0; + +-error: +- mpi_point_release(ec->Q); +- ec->Q = NULL; + return rc; + } + +-- +2.30.2 + diff --git a/queue-5.12/crypto-ux500-fix-error-return-code-in-hash_hw_final.patch b/queue-5.12/crypto-ux500-fix-error-return-code-in-hash_hw_final.patch new file mode 100644 index 00000000000..5316375094a --- /dev/null +++ b/queue-5.12/crypto-ux500-fix-error-return-code-in-hash_hw_final.patch @@ -0,0 +1,37 @@ +From 422c578cce3afea2400d5b1ae93d01a7256de942 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 15:00:49 +0800 +Subject: crypto: ux500 - Fix error return code in hash_hw_final() + +From: Zhen Lei + +[ Upstream commit b01360384009ab066940b45f34880991ea7ccbfb ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 8a63b1994c50 ("crypto: ux500 - Add driver for HASH hardware") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Reviewed-by: Linus Walleij +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ux500/hash/hash_core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c +index da284b0ea1b2..243515df609b 100644 +--- a/drivers/crypto/ux500/hash/hash_core.c ++++ b/drivers/crypto/ux500/hash/hash_core.c +@@ -1010,6 +1010,7 @@ static int hash_hw_final(struct ahash_request *req) + goto out; + } + } else if (req->nbytes == 0 && ctx->keylen > 0) { ++ ret = -EPERM; + dev_err(device_data->dev, "%s: Empty message with keylength > 0, NOT supported\n", + __func__); + goto out; +-- +2.30.2 + diff --git a/queue-5.12/crypto-x86-curve25519-fix-cpu-feature-checking-logic.patch b/queue-5.12/crypto-x86-curve25519-fix-cpu-feature-checking-logic.patch new file mode 100644 index 00000000000..151d0c498a5 --- /dev/null +++ b/queue-5.12/crypto-x86-curve25519-fix-cpu-feature-checking-logic.patch @@ -0,0 +1,41 @@ +From 3bd117c71f24e13e1e8514c860125080458505e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 01:53:40 -0400 +Subject: crypto: x86/curve25519 - fix cpu feature checking logic in mod_exit + +From: Hangbin Liu + +[ Upstream commit 1b82435d17774f3eaab35dce239d354548aa9da2 ] + +In curve25519_mod_init() the curve25519_alg will be registered only when +(X86_FEATURE_BMI2 && X86_FEATURE_ADX). But in curve25519_mod_exit() +it still checks (X86_FEATURE_BMI2 || X86_FEATURE_ADX) when do crypto +unregister. This will trigger a BUG_ON in crypto_unregister_alg() as +alg->cra_refcnt is 0 if the cpu only supports one of X86_FEATURE_BMI2 +and X86_FEATURE_ADX. + +Fixes: 07b586fe0662 ("crypto: x86/curve25519 - replace with formally verified implementation") +Signed-off-by: Hangbin Liu +Reviewed-by: Jason A. Donenfeld +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + arch/x86/crypto/curve25519-x86_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/crypto/curve25519-x86_64.c b/arch/x86/crypto/curve25519-x86_64.c +index 5af8021b98ce..11b4c83c715e 100644 +--- a/arch/x86/crypto/curve25519-x86_64.c ++++ b/arch/x86/crypto/curve25519-x86_64.c +@@ -1500,7 +1500,7 @@ static int __init curve25519_mod_init(void) + static void __exit curve25519_mod_exit(void) + { + if (IS_REACHABLE(CONFIG_CRYPTO_KPP) && +- (boot_cpu_has(X86_FEATURE_BMI2) || boot_cpu_has(X86_FEATURE_ADX))) ++ static_branch_likely(&curve25519_use_bmi2_adx)) + crypto_unregister_kpp(&curve25519_alg); + } + +-- +2.30.2 + diff --git a/queue-5.12/csky-fix-syscache.c-fallthrough-warning.patch b/queue-5.12/csky-fix-syscache.c-fallthrough-warning.patch new file mode 100644 index 00000000000..afc91ca4303 --- /dev/null +++ b/queue-5.12/csky-fix-syscache.c-fallthrough-warning.patch @@ -0,0 +1,49 @@ +From af6288bb4d4a63925c0e4d0290c00997c7f50283 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Apr 2021 09:41:04 -0700 +Subject: csky: fix syscache.c fallthrough warning + +From: Randy Dunlap + +[ Upstream commit 0679d29d3e2351a1c3049c26a63ce1959cad5447 ] + +This case of the switch statement falls through to the following case. +This appears to be on purpose, so declare it as OK. + +../arch/csky/mm/syscache.c: In function '__do_sys_cacheflush': +../arch/csky/mm/syscache.c:17:3: warning: this statement may fall through [-Wimplicit-fallthrough=] + 17 | flush_icache_mm_range(current->mm, + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + 18 | (unsigned long)addr, + | ~~~~~~~~~~~~~~~~~~~~ + 19 | (unsigned long)addr + bytes); + | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +../arch/csky/mm/syscache.c:20:2: note: here + 20 | case DCACHE: + | ^~~~ + +Fixes: 997153b9a75c ("csky: Add flush_icache_mm to defer flush icache all") +Signed-off-by: Randy Dunlap +Signed-off-by: Guo Ren +Cc: linux-csky@vger.kernel.org +Cc: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/csky/mm/syscache.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/csky/mm/syscache.c b/arch/csky/mm/syscache.c +index ffade2f9a4c8..4e51d63850c4 100644 +--- a/arch/csky/mm/syscache.c ++++ b/arch/csky/mm/syscache.c +@@ -17,6 +17,7 @@ SYSCALL_DEFINE3(cacheflush, + flush_icache_mm_range(current->mm, + (unsigned long)addr, + (unsigned long)addr + bytes); ++ fallthrough; + case DCACHE: + dcache_wb_range((unsigned long)addr, + (unsigned long)addr + bytes); +-- +2.30.2 + diff --git a/queue-5.12/csky-syscache-fixup-duplicate-cache-flush.patch b/queue-5.12/csky-syscache-fixup-duplicate-cache-flush.patch new file mode 100644 index 00000000000..0f2e6a798b0 --- /dev/null +++ b/queue-5.12/csky-syscache-fixup-duplicate-cache-flush.patch @@ -0,0 +1,54 @@ +From c52ef50d523c8fe7c834c4544fcd0537ceba08ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 14:08:44 +0800 +Subject: csky: syscache: Fixup duplicate cache flush + +From: Guo Ren + +[ Upstream commit 6ea42c84f33368eb3fe1ec1bff8d7cb1a5c7b07a ] + +The current csky logic of sys_cacheflush is wrong, it'll cause +icache flush call dcache flush again. Now fixup it with a +conditional "break & fallthrough". + +Fixes: 997153b9a75c ("csky: Add flush_icache_mm to defer flush icache all") +Fixes: 0679d29d3e23 ("csky: fix syscache.c fallthrough warning") +Acked-by: Randy Dunlap +Co-Developed-by: Randy Dunlap +Signed-off-by: Guo Ren +Cc: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/csky/mm/syscache.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/arch/csky/mm/syscache.c b/arch/csky/mm/syscache.c +index 4e51d63850c4..cd847ad62c7e 100644 +--- a/arch/csky/mm/syscache.c ++++ b/arch/csky/mm/syscache.c +@@ -12,15 +12,17 @@ SYSCALL_DEFINE3(cacheflush, + int, cache) + { + switch (cache) { +- case ICACHE: + case BCACHE: +- flush_icache_mm_range(current->mm, +- (unsigned long)addr, +- (unsigned long)addr + bytes); +- fallthrough; + case DCACHE: + dcache_wb_range((unsigned long)addr, + (unsigned long)addr + bytes); ++ if (cache != BCACHE) ++ break; ++ fallthrough; ++ case ICACHE: ++ flush_icache_mm_range(current->mm, ++ (unsigned long)addr, ++ (unsigned long)addr + bytes); + break; + default: + return -EINVAL; +-- +2.30.2 + diff --git a/queue-5.12/cw1200-revert-unnecessary-patches-that-fix-unreal-us.patch b/queue-5.12/cw1200-revert-unnecessary-patches-that-fix-unreal-us.patch new file mode 100644 index 00000000000..21373bc951f --- /dev/null +++ b/queue-5.12/cw1200-revert-unnecessary-patches-that-fix-unreal-us.patch @@ -0,0 +1,101 @@ +From 889f6e684f5dca5f1b6dc21dc4e2847485139177 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 15:32:38 -0700 +Subject: cw1200: Revert unnecessary patches that fix unreal use-after-free + bugs + +From: Hang Zhang + +[ Upstream commit 3f60f4685699aa6006e58e424637e8e413e0a94d ] + +A previous commit 4f68ef64cd7f ("cw1200: Fix concurrency +use-after-free bugs in cw1200_hw_scan()") tried to fix a seemingly +use-after-free bug between cw1200_bss_info_changed() and +cw1200_hw_scan(), where the former frees a sk_buff pointed +to by frame.skb, and the latter accesses the sk_buff +pointed to by frame.skb. However, this issue should be a +false alarm because: + +(1) "frame.skb" is not a shared variable between the above +two functions, because "frame" is a local function variable, +each of the two functions has its own local "frame" - they +just happen to have the same variable name. + +(2) the sk_buff(s) pointed to by these two "frame.skb" are +also two different object instances, they are individually +allocated by different dev_alloc_skb() within the two above +functions. To free one object instance will not invalidate +the access of another different one. + +Based on these facts, the previous commit should be unnecessary. +Moreover, it also introduced a missing unlock which was +addressed in a subsequent commit 51c8d24101c7 ("cw1200: fix missing +unlock on error in cw1200_hw_scan()"). Now that the +original use-after-free is unreal, these two commits should +be reverted. This patch performs the reversion. + +Fixes: 4f68ef64cd7f ("cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()") +Fixes: 51c8d24101c7 ("cw1200: fix missing unlock on error in cw1200_hw_scan()") +Signed-off-by: Hang Zhang +Acked-by: Jia-Ju Bai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210521223238.25020-1-zh.nvgt@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/st/cw1200/scan.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/st/cw1200/scan.c b/drivers/net/wireless/st/cw1200/scan.c +index 988581cc134b..1f856fbbc0ea 100644 +--- a/drivers/net/wireless/st/cw1200/scan.c ++++ b/drivers/net/wireless/st/cw1200/scan.c +@@ -75,30 +75,27 @@ int cw1200_hw_scan(struct ieee80211_hw *hw, + if (req->n_ssids > WSM_SCAN_MAX_NUM_OF_SSIDS) + return -EINVAL; + +- /* will be unlocked in cw1200_scan_work() */ +- down(&priv->scan.lock); +- mutex_lock(&priv->conf_mutex); +- + frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0, + req->ie_len); +- if (!frame.skb) { +- mutex_unlock(&priv->conf_mutex); +- up(&priv->scan.lock); ++ if (!frame.skb) + return -ENOMEM; +- } + + if (req->ie_len) + skb_put_data(frame.skb, req->ie, req->ie_len); + ++ /* will be unlocked in cw1200_scan_work() */ ++ down(&priv->scan.lock); ++ mutex_lock(&priv->conf_mutex); ++ + ret = wsm_set_template_frame(priv, &frame); + if (!ret) { + /* Host want to be the probe responder. */ + ret = wsm_set_probe_responder(priv, true); + } + if (ret) { +- dev_kfree_skb(frame.skb); + mutex_unlock(&priv->conf_mutex); + up(&priv->scan.lock); ++ dev_kfree_skb(frame.skb); + return ret; + } + +@@ -120,8 +117,8 @@ int cw1200_hw_scan(struct ieee80211_hw *hw, + ++priv->scan.n_ssids; + } + +- dev_kfree_skb(frame.skb); + mutex_unlock(&priv->conf_mutex); ++ dev_kfree_skb(frame.skb); + queue_work(priv->workqueue, &priv->scan.work); + return 0; + } +-- +2.30.2 + diff --git a/queue-5.12/dax-fix-enomem-handling-in-grab_mapping_entry.patch b/queue-5.12/dax-fix-enomem-handling-in-grab_mapping_entry.patch new file mode 100644 index 00000000000..d5d0aa6dd9f --- /dev/null +++ b/queue-5.12/dax-fix-enomem-handling-in-grab_mapping_entry.patch @@ -0,0 +1,63 @@ +From 14999b01272ccaf208eac4612065ee811a24bf2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 19:35:04 -0700 +Subject: dax: fix ENOMEM handling in grab_mapping_entry() + +From: Jan Kara + +[ Upstream commit 1a14e3779dd58c16b30e56558146e5cc850ba8b0 ] + +grab_mapping_entry() has a bug in handling of ENOMEM condition. Suppose +we have a PMD entry at index i which we are downgrading to a PTE entry. +grab_mapping_entry() will set pmd_downgrade to true, lock the entry, clear +the entry in xarray, and decrement mapping->nrpages. The it will call: + + entry = dax_make_entry(pfn_to_pfn_t(0), flags); + dax_lock_entry(xas, entry); + +which inserts new PTE entry into xarray. However this may fail allocating +the new node. We handle this by: + + if (xas_nomem(xas, mapping_gfp_mask(mapping) & ~__GFP_HIGHMEM)) + goto retry; + +however pmd_downgrade stays set to true even though 'entry' returned from +get_unlocked_entry() will be NULL now. And we will go again through the +downgrade branch. This is mostly harmless except that mapping->nrpages is +decremented again and we temporarily have an invalid entry stored in +xarray. Fix the problem by setting pmd_downgrade to false each time we +lookup the entry we work with so that it matches the entry we found. + +Link: https://lkml.kernel.org/r/20210622160015.18004-1-jack@suse.cz +Fixes: b15cd800682f ("dax: Convert page fault handlers to XArray") +Signed-off-by: Jan Kara +Reviewed-by: Dan Williams +Cc: Matthew Wilcox +Cc: "Aneesh Kumar K.V" +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/dax.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/dax.c b/fs/dax.c +index df5485b4bddf..d5d7b9393bca 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -488,10 +488,11 @@ static void *grab_mapping_entry(struct xa_state *xas, + struct address_space *mapping, unsigned int order) + { + unsigned long index = xas->xa_index; +- bool pmd_downgrade = false; /* splitting PMD entry into PTE entries? */ ++ bool pmd_downgrade; /* splitting PMD entry into PTE entries? */ + void *entry; + + retry: ++ pmd_downgrade = false; + xas_lock_irq(xas); + entry = get_unlocked_entry(xas, order); + +-- +2.30.2 + diff --git a/queue-5.12/drivers-hv-fix-missing-error-code-in-vmbus_connect.patch b/queue-5.12/drivers-hv-fix-missing-error-code-in-vmbus_connect.patch new file mode 100644 index 00000000000..b2fe6cf04e5 --- /dev/null +++ b/queue-5.12/drivers-hv-fix-missing-error-code-in-vmbus_connect.patch @@ -0,0 +1,43 @@ +From f30b58da586c17a688f3df85d4697ce7c8047d6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 18:58:41 +0800 +Subject: drivers: hv: Fix missing error code in vmbus_connect() + +From: Jiapeng Chong + +[ Upstream commit 9de6655cc5a6a1febc514465c87c24a0e96d8dba ] + +Eliminate the follow smatch warning: + +drivers/hv/connection.c:236 vmbus_connect() warn: missing error code +'ret'. + +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/1621940321-72353-1-git-send-email-jiapeng.chong@linux.alibaba.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/connection.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index c83612cddb99..425bf85ed1a0 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -229,8 +229,10 @@ int vmbus_connect(void) + */ + + for (i = 0; ; i++) { +- if (i == ARRAY_SIZE(vmbus_versions)) ++ if (i == ARRAY_SIZE(vmbus_versions)) { ++ ret = -EDOM; + goto cleanup; ++ } + + version = vmbus_versions[i]; + if (version > max_version) +-- +2.30.2 + diff --git a/queue-5.12/drivers-perf-fix-the-missed-ida_simple_remove-in-ddr.patch b/queue-5.12/drivers-perf-fix-the-missed-ida_simple_remove-in-ddr.patch new file mode 100644 index 00000000000..abab211f325 --- /dev/null +++ b/queue-5.12/drivers-perf-fix-the-missed-ida_simple_remove-in-ddr.patch @@ -0,0 +1,41 @@ +From a79978f7f433b05745b2a2141f6d314ae8f8ef67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 20:26:14 +0800 +Subject: drivers/perf: fix the missed ida_simple_remove() in ddr_perf_probe() + +From: Jing Xiangfeng + +[ Upstream commit d96b1b8c9f79b6bb234a31c80972a6f422079376 ] + +ddr_perf_probe() misses to call ida_simple_remove() in an error path. +Jump to cpuhp_state_err to fix it. + +Signed-off-by: Jing Xiangfeng +Reviewed-by: Dong Aisheng +Link: https://lore.kernel.org/r/20210617122614.166823-1-jingxiangfeng@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/fsl_imx8_ddr_perf.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c +index be1f26b62ddb..4a56849f0400 100644 +--- a/drivers/perf/fsl_imx8_ddr_perf.c ++++ b/drivers/perf/fsl_imx8_ddr_perf.c +@@ -706,8 +706,10 @@ static int ddr_perf_probe(struct platform_device *pdev) + + name = devm_kasprintf(&pdev->dev, GFP_KERNEL, DDR_PERF_DEV_NAME "%d", + num); +- if (!name) +- return -ENOMEM; ++ if (!name) { ++ ret = -ENOMEM; ++ goto cpuhp_state_err; ++ } + + pmu->devtype_data = of_device_get_match_data(&pdev->dev); + +-- +2.30.2 + diff --git a/queue-5.12/drm-amd-dc-fix-a-missing-check-bug-in-dm_dp_mst_dete.patch b/queue-5.12/drm-amd-dc-fix-a-missing-check-bug-in-dm_dp_mst_dete.patch new file mode 100644 index 00000000000..e827e5aa700 --- /dev/null +++ b/queue-5.12/drm-amd-dc-fix-a-missing-check-bug-in-dm_dp_mst_dete.patch @@ -0,0 +1,38 @@ +From 117cbb0e92c196de723d2382290f3cda6fb1b367 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Apr 2021 17:57:20 -0700 +Subject: drm/amd/dc: Fix a missing check bug in dm_dp_mst_detect() + +From: Yingjie Wang + +[ Upstream commit 655c0ed19772d92c9665ed08bdc5202acc096dda ] + +In dm_dp_mst_detect(), We should check whether or not @connector +has been unregistered from userspace. If the connector is unregistered, +we should return disconnected status. + +Fixes: 4562236b3bc0 ("drm/amd/dc: Add dc display driver (v2)") +Signed-off-by: Yingjie Wang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +index 41b09ab22233..b478129a7477 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c +@@ -270,6 +270,9 @@ dm_dp_mst_detect(struct drm_connector *connector, + struct amdgpu_dm_connector *aconnector = to_amdgpu_dm_connector(connector); + struct amdgpu_dm_connector *master = aconnector->mst_port; + ++ if (drm_connector_is_unregistered(connector)) ++ return connector_status_disconnected; ++ + return drm_dp_mst_detect_port(connector, ctx, &master->mst_mgr, + aconnector->port); + } +-- +2.30.2 + diff --git a/queue-5.12/drm-amd-display-avoid-hpd-irq-in-gpu-reset-state.patch b/queue-5.12/drm-amd-display-avoid-hpd-irq-in-gpu-reset-state.patch new file mode 100644 index 00000000000..0a6fbfde76b --- /dev/null +++ b/queue-5.12/drm-amd-display-avoid-hpd-irq-in-gpu-reset-state.patch @@ -0,0 +1,49 @@ +From 64def993389dc5fe72c472aedffaada44f22178b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 May 2021 19:30:36 -0400 +Subject: drm/amd/display: Avoid HPD IRQ in GPU reset state + +From: Zhan Liu + +[ Upstream commit 509b9a5b4865dee723296f143695a7774fc96c4a ] + +[Why] +If GPU is in reset state, force enabling link will cause +unexpected behaviour. + +[How] +Avoid handling HPD IRQ when GPU is in reset state. + +Signed-off-by: Zhan Liu +Reviewed-by: Nikola Cornij +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index d95569e0e53a..61337d4c0bb2 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2624,15 +2624,15 @@ static void handle_hpd_rx_irq(void *param) + } + } + +- if (!amdgpu_in_reset(adev)) ++ if (!amdgpu_in_reset(adev)) { + mutex_lock(&adev->dm.dc_lock); + #ifdef CONFIG_DRM_AMD_DC_HDCP + result = dc_link_handle_hpd_rx_irq(dc_link, &hpd_irq_data, NULL); + #else + result = dc_link_handle_hpd_rx_irq(dc_link, NULL, NULL); + #endif +- if (!amdgpu_in_reset(adev)) + mutex_unlock(&adev->dm.dc_lock); ++ } + + out: + if (result && !is_mst_root_connector) { +-- +2.30.2 + diff --git a/queue-5.12/drm-amd-display-fix-potential-gpu-reset-deadlock.patch b/queue-5.12/drm-amd-display-fix-potential-gpu-reset-deadlock.patch new file mode 100644 index 00000000000..9ee94717f36 --- /dev/null +++ b/queue-5.12/drm-amd-display-fix-potential-gpu-reset-deadlock.patch @@ -0,0 +1,54 @@ +From a9e58a37dd49f28ff3c58201fecb34e7d31061d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 11:47:00 -0400 +Subject: drm/amd/display: fix potential gpu reset deadlock + +From: Roman Li + +[ Upstream commit cf8b92a75646735136053ce51107bfa8cfc23191 ] + +[Why] +In gpu reset dc_lock acquired in dm_suspend(). +Asynchronously handle_hpd_rx_irq can also be called +through amdgpu_dm_irq_suspend->flush_work, which also +tries to acquire dc_lock. That causes a deadlock. + +[How] +Check if amdgpu executing reset before acquiring dc_lock. + +Signed-off-by: Lang Yu +Signed-off-by: Roman Li +Reviewed-by: Qingqing Zhuo +Acked-by: Wayne Lin +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index eed494630583..d95569e0e53a 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -2624,13 +2624,15 @@ static void handle_hpd_rx_irq(void *param) + } + } + +- mutex_lock(&adev->dm.dc_lock); ++ if (!amdgpu_in_reset(adev)) ++ mutex_lock(&adev->dm.dc_lock); + #ifdef CONFIG_DRM_AMD_DC_HDCP + result = dc_link_handle_hpd_rx_irq(dc_link, &hpd_irq_data, NULL); + #else + result = dc_link_handle_hpd_rx_irq(dc_link, NULL, NULL); + #endif +- mutex_unlock(&adev->dm.dc_lock); ++ if (!amdgpu_in_reset(adev)) ++ mutex_unlock(&adev->dm.dc_lock); + + out: + if (result && !is_mst_root_connector) { +-- +2.30.2 + diff --git a/queue-5.12/drm-amd-display-take-dc_lock-in-short-pulse-handler-.patch b/queue-5.12/drm-amd-display-take-dc_lock-in-short-pulse-handler-.patch new file mode 100644 index 00000000000..59d3eeba45e --- /dev/null +++ b/queue-5.12/drm-amd-display-take-dc_lock-in-short-pulse-handler-.patch @@ -0,0 +1,121 @@ +From 4d3e20c388a6aaed76964f4f51a26a86c90c19fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 16:51:01 -0400 +Subject: drm/amd/display: take dc_lock in short pulse handler only + +From: Aurabindo Pillai + +[ Upstream commit d2aa1356834d845ffdac0d8c01b58aa60d1bdc65 ] + +[Why] +Conditions that end up modifying the global dc state must be locked. +However, during mst allocate payload sequence, lock is already taken. +With StarTech 1.2 DP hub, we get an HPD RX interrupt for a reason other +than to indicate down reply availability right after sending payload +allocation. The handler again takes dc lock before calling the +dc's HPD RX handler. Due to this contention, the DRM thread which waits +for MST down reply never gets a chance to finish its waiting +successfully and ends up timing out. Once the lock is released, the hpd +rx handler fires and goes ahead to read from the MST HUB, but now its +too late and the HUB doesnt lightup all displays since DRM lacks error +handling when payload allocation fails. + +[How] +Take lock only if there is a change in link status or if automated test +pattern bit is set. The latter fixes the null pointer dereference when +running certain DP Link Layer Compliance test. + +Fixes: c8ea79a8a276 ("drm/amd/display: NULL pointer error during compliance test") + +Signed-off-by: Aurabindo Pillai +Reviewed-by: Nicholas Kazlauskas +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 19 +++++++++++++++++-- + .../gpu/drm/amd/display/dc/core/dc_link_dp.c | 2 +- + .../gpu/drm/amd/display/dc/inc/dc_link_dp.h | 4 ++++ + 3 files changed, 22 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 61337d4c0bb2..0858e0c7b7a1 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -28,6 +28,7 @@ + + #include "dm_services_types.h" + #include "dc.h" ++#include "dc_link_dp.h" + #include "dc/inc/core_types.h" + #include "dal_asic_id.h" + #include "dmub/dmub_srv.h" +@@ -2598,6 +2599,7 @@ static void handle_hpd_rx_irq(void *param) + enum dc_connection_type new_connection_type = dc_connection_none; + struct amdgpu_device *adev = drm_to_adev(dev); + union hpd_irq_data hpd_irq_data; ++ bool lock_flag = 0; + + memset(&hpd_irq_data, 0, sizeof(hpd_irq_data)); + +@@ -2624,15 +2626,28 @@ static void handle_hpd_rx_irq(void *param) + } + } + +- if (!amdgpu_in_reset(adev)) { ++ /* ++ * TODO: We need the lock to avoid touching DC state while it's being ++ * modified during automated compliance testing, or when link loss ++ * happens. While this should be split into subhandlers and proper ++ * interfaces to avoid having to conditionally lock like this in the ++ * outer layer, we need this workaround temporarily to allow MST ++ * lightup in some scenarios to avoid timeout. ++ */ ++ if (!amdgpu_in_reset(adev) && ++ (hpd_rx_irq_check_link_loss_status(dc_link, &hpd_irq_data) || ++ hpd_irq_data.bytes.device_service_irq.bits.AUTOMATED_TEST)) { + mutex_lock(&adev->dm.dc_lock); ++ lock_flag = 1; ++ } ++ + #ifdef CONFIG_DRM_AMD_DC_HDCP + result = dc_link_handle_hpd_rx_irq(dc_link, &hpd_irq_data, NULL); + #else + result = dc_link_handle_hpd_rx_irq(dc_link, NULL, NULL); + #endif ++ if (!amdgpu_in_reset(adev) && lock_flag) + mutex_unlock(&adev->dm.dc_lock); +- } + + out: + if (result && !is_mst_root_connector) { +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index c1391bfb7a9b..b85f67341a9a 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -1918,7 +1918,7 @@ enum dc_status read_hpd_rx_irq_data( + return retval; + } + +-static bool hpd_rx_irq_check_link_loss_status( ++bool hpd_rx_irq_check_link_loss_status( + struct dc_link *link, + union hpd_irq_data *hpd_irq_dpcd_data) + { +diff --git a/drivers/gpu/drm/amd/display/dc/inc/dc_link_dp.h b/drivers/gpu/drm/amd/display/dc/inc/dc_link_dp.h +index b970a32177af..28abd30e90a5 100644 +--- a/drivers/gpu/drm/amd/display/dc/inc/dc_link_dp.h ++++ b/drivers/gpu/drm/amd/display/dc/inc/dc_link_dp.h +@@ -63,6 +63,10 @@ bool perform_link_training_with_retries( + struct pipe_ctx *pipe_ctx, + enum signal_type signal); + ++bool hpd_rx_irq_check_link_loss_status( ++ struct dc_link *link, ++ union hpd_irq_data *hpd_irq_dpcd_data); ++ + bool is_mst_supported(struct dc_link *link); + + bool detect_dp_sink_caps(struct dc_link *link); +-- +2.30.2 + diff --git a/queue-5.12/drm-ast-fix-missing-conversions-to-managed-api.patch b/queue-5.12/drm-ast-fix-missing-conversions-to-managed-api.patch new file mode 100644 index 00000000000..73c62fdc25a --- /dev/null +++ b/queue-5.12/drm-ast-fix-missing-conversions-to-managed-api.patch @@ -0,0 +1,49 @@ +From 3f74860fc8cab163a257884deb730aeab6ba1168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 19:04:58 +0200 +Subject: drm/ast: Fix missing conversions to managed API + +From: Takashi Iwai + +[ Upstream commit 9ea172a9a3f4a7c5e876469509fc18ddefc7d49d ] + +The commit 7cbb93d89838 ("drm/ast: Use managed pci functions") +converted a few PCI accessors to the managed API and dropped the +manual pci_iounmap() calls, but it seems to have forgotten converting +pci_iomap() to the managed one. It resulted in the leftover resources +after the driver unbind. Let's fix them. + +Fixes: 7cbb93d89838 ("drm/ast: Use managed pci functions") +Signed-off-by: Takashi Iwai +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20210421170458.21178-1-tiwai@suse.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ast/ast_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c +index 0ac3c2039c4b..c29cc7f19863 100644 +--- a/drivers/gpu/drm/ast/ast_main.c ++++ b/drivers/gpu/drm/ast/ast_main.c +@@ -413,7 +413,7 @@ struct ast_private *ast_device_create(const struct drm_driver *drv, + + pci_set_drvdata(pdev, dev); + +- ast->regs = pci_iomap(pdev, 1, 0); ++ ast->regs = pcim_iomap(pdev, 1, 0); + if (!ast->regs) + return ERR_PTR(-EIO); + +@@ -429,7 +429,7 @@ struct ast_private *ast_device_create(const struct drm_driver *drv, + + /* "map" IO regs if the above hasn't done so already */ + if (!ast->ioregs) { +- ast->ioregs = pci_iomap(pdev, 2, 0); ++ ast->ioregs = pcim_iomap(pdev, 2, 0); + if (!ast->ioregs) + return ERR_PTR(-EIO); + } +-- +2.30.2 + diff --git a/queue-5.12/drm-bridge-fix-the-stop-condition-of-drm_bridge_chai.patch b/queue-5.12/drm-bridge-fix-the-stop-condition-of-drm_bridge_chai.patch new file mode 100644 index 00000000000..7549def2463 --- /dev/null +++ b/queue-5.12/drm-bridge-fix-the-stop-condition-of-drm_bridge_chai.patch @@ -0,0 +1,40 @@ +From e1fa5f58e4dbe9cada52254ac3580a67ccc562a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 15:39:24 -0700 +Subject: drm/bridge: Fix the stop condition of drm_bridge_chain_pre_enable() + +From: Douglas Anderson + +[ Upstream commit bab5cca7e609952b069a550e39fe4893149fb658 ] + +The drm_bridge_chain_pre_enable() is not the proper opposite of +drm_bridge_chain_post_disable(). It continues along the chain to +_before_ the starting bridge. Let's fix that. + +Fixes: 05193dc38197 ("drm/bridge: Make the bridge chain a double-linked list") +Signed-off-by: Douglas Anderson +Reviewed-by: Andrzej Hajda +Reviewed-by: Laurent Pinchart +Link: https://patchwork.freedesktop.org/patch/msgid/20210416153909.v4.1.If62a003f76a2bc4ccc6c53565becc05d2aad4430@changeid +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_bridge.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/drm_bridge.c b/drivers/gpu/drm/drm_bridge.c +index 64f0effb52ac..044acd07c153 100644 +--- a/drivers/gpu/drm/drm_bridge.c ++++ b/drivers/gpu/drm/drm_bridge.c +@@ -522,6 +522,9 @@ void drm_bridge_chain_pre_enable(struct drm_bridge *bridge) + list_for_each_entry_reverse(iter, &encoder->bridge_chain, chain_node) { + if (iter->funcs->pre_enable) + iter->funcs->pre_enable(iter); ++ ++ if (iter == bridge) ++ break; + } + } + EXPORT_SYMBOL(drm_bridge_chain_pre_enable); +-- +2.30.2 + diff --git a/queue-5.12/drm-bridge-sii8620-fix-dependency-on-extcon.patch b/queue-5.12/drm-bridge-sii8620-fix-dependency-on-extcon.patch new file mode 100644 index 00000000000..a81995c5664 --- /dev/null +++ b/queue-5.12/drm-bridge-sii8620-fix-dependency-on-extcon.patch @@ -0,0 +1,43 @@ +From 917c76b69a2b97f4bb2a9482eb79d2cc23d9758f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 11:01:24 +0200 +Subject: drm/bridge/sii8620: fix dependency on extcon + +From: Robert Foss + +[ Upstream commit 08319adbdde15ef7cee1970336f63461254baa2a ] + +The DRM_SIL_SII8620 kconfig has a weak `imply` dependency +on EXTCON, which causes issues when sii8620 is built +as a builtin and EXTCON is built as a module. + +The symptoms are 'undefined reference' errors caused +by the symbols in EXTCON not being available +to the sii8620 driver. + +Fixes: 688838442147 ("drm/bridge/sii8620: use micro-USB cable detection logic to detect MHL") +Reported-by: kernel test robot +Signed-off-by: Robert Foss +Reviewed-by: Randy Dunlap +Link: https://patchwork.freedesktop.org/patch/msgid/20210419090124.153560-1-robert.foss@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/Kconfig b/drivers/gpu/drm/bridge/Kconfig +index bc60fc4728d7..8d5bae9e745b 100644 +--- a/drivers/gpu/drm/bridge/Kconfig ++++ b/drivers/gpu/drm/bridge/Kconfig +@@ -143,7 +143,7 @@ config DRM_SIL_SII8620 + tristate "Silicon Image SII8620 HDMI/MHL bridge" + depends on OF + select DRM_KMS_HELPER +- imply EXTCON ++ select EXTCON + depends on RC_CORE || !RC_CORE + help + Silicon Image SII8620 HDMI/MHL bridge chip driver. +-- +2.30.2 + diff --git a/queue-5.12/drm-imx-ipuv3-plane-do-not-advertise-yuv-formats-on-.patch b/queue-5.12/drm-imx-ipuv3-plane-do-not-advertise-yuv-formats-on-.patch new file mode 100644 index 00000000000..3511be7004b --- /dev/null +++ b/queue-5.12/drm-imx-ipuv3-plane-do-not-advertise-yuv-formats-on-.patch @@ -0,0 +1,97 @@ +From d7a9edf2221ef4007a3651ad0a9e7d7637642d19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 Jan 2021 14:51:08 +0100 +Subject: drm/imx: ipuv3-plane: do not advertise YUV formats on planes without + CSC + +From: Philipp Zabel + +[ Upstream commit 06841148c570832d4d247b0f6befc1922a84120b ] + +Only planes that are displayed via the Display Processor (DP) path +support color space conversion. Limit formats on planes that are +shown via the direct Display Controller (DC) path to RGB. + +Reported-by: Fabio Estevam +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/ipuv3-plane.c | 41 ++++++++++++++++++++++++++++--- + 1 file changed, 37 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c +index 075508051b5f..c5ff966e2ceb 100644 +--- a/drivers/gpu/drm/imx/ipuv3-plane.c ++++ b/drivers/gpu/drm/imx/ipuv3-plane.c +@@ -35,7 +35,7 @@ static inline struct ipu_plane *to_ipu_plane(struct drm_plane *p) + return container_of(p, struct ipu_plane, base); + } + +-static const uint32_t ipu_plane_formats[] = { ++static const uint32_t ipu_plane_all_formats[] = { + DRM_FORMAT_ARGB1555, + DRM_FORMAT_XRGB1555, + DRM_FORMAT_ABGR1555, +@@ -72,6 +72,31 @@ static const uint32_t ipu_plane_formats[] = { + DRM_FORMAT_BGRX8888_A8, + }; + ++static const uint32_t ipu_plane_rgb_formats[] = { ++ DRM_FORMAT_ARGB1555, ++ DRM_FORMAT_XRGB1555, ++ DRM_FORMAT_ABGR1555, ++ DRM_FORMAT_XBGR1555, ++ DRM_FORMAT_RGBA5551, ++ DRM_FORMAT_BGRA5551, ++ DRM_FORMAT_ARGB4444, ++ DRM_FORMAT_ARGB8888, ++ DRM_FORMAT_XRGB8888, ++ DRM_FORMAT_ABGR8888, ++ DRM_FORMAT_XBGR8888, ++ DRM_FORMAT_RGBA8888, ++ DRM_FORMAT_RGBX8888, ++ DRM_FORMAT_BGRA8888, ++ DRM_FORMAT_BGRX8888, ++ DRM_FORMAT_RGB565, ++ DRM_FORMAT_RGB565_A8, ++ DRM_FORMAT_BGR565_A8, ++ DRM_FORMAT_RGB888_A8, ++ DRM_FORMAT_BGR888_A8, ++ DRM_FORMAT_RGBX8888_A8, ++ DRM_FORMAT_BGRX8888_A8, ++}; ++ + static const uint64_t ipu_format_modifiers[] = { + DRM_FORMAT_MOD_LINEAR, + DRM_FORMAT_MOD_INVALID +@@ -822,16 +847,24 @@ struct ipu_plane *ipu_plane_init(struct drm_device *dev, struct ipu_soc *ipu, + struct ipu_plane *ipu_plane; + const uint64_t *modifiers = ipu_format_modifiers; + unsigned int zpos = (type == DRM_PLANE_TYPE_PRIMARY) ? 0 : 1; ++ unsigned int format_count; ++ const uint32_t *formats; + int ret; + + DRM_DEBUG_KMS("channel %d, dp flow %d, possible_crtcs=0x%x\n", + dma, dp, possible_crtcs); + ++ if (dp == IPU_DP_FLOW_SYNC_BG || dp == IPU_DP_FLOW_SYNC_FG) { ++ formats = ipu_plane_all_formats; ++ format_count = ARRAY_SIZE(ipu_plane_all_formats); ++ } else { ++ formats = ipu_plane_rgb_formats; ++ format_count = ARRAY_SIZE(ipu_plane_rgb_formats); ++ } + ipu_plane = drmm_universal_plane_alloc(dev, struct ipu_plane, base, + possible_crtcs, &ipu_plane_funcs, +- ipu_plane_formats, +- ARRAY_SIZE(ipu_plane_formats), +- modifiers, type, NULL); ++ formats, format_count, modifiers, ++ type, NULL); + if (IS_ERR(ipu_plane)) { + DRM_ERROR("failed to allocate and initialize %s plane\n", + zpos ? "overlay" : "primary"); +-- +2.30.2 + diff --git a/queue-5.12/drm-imx-ipuv3-plane-fix-prg-modifiers-after-drm-mana.patch b/queue-5.12/drm-imx-ipuv3-plane-fix-prg-modifiers-after-drm-mana.patch new file mode 100644 index 00000000000..96365e67ce3 --- /dev/null +++ b/queue-5.12/drm-imx-ipuv3-plane-fix-prg-modifiers-after-drm-mana.patch @@ -0,0 +1,73 @@ +From 46e9db390a0a97976bdb35d30b8401be2d67ada2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 16:59:27 +0200 +Subject: drm/imx: ipuv3-plane: fix PRG modifiers after drm managed resource + conversion + +From: Lucas Stach + +[ Upstream commit 17b9a94656fe19aef3647c4f93d93be51697ceb1 ] + +The conversion to drm managed resources introduced two bugs: the plane is now +always initialized with the linear-only list, while the list with the Vivante +GPU modifiers should have been used when the PRG/PRE engines are present. This +masked another issue, as ipu_plane_format_mod_supported() is now called before +the private plane data is set up, so if a non-linear modifier is supplied in +the plane modifier list, we run into a NULL pointer dereference checking for +the PRG presence. To fix this just remove the check from this function, as we +know that it will only be called with a non-linear modifier, if the plane init +code has already determined that the PRG/PRE is present. + +Fixes: 699e7e543f1a ("drm/imx: ipuv3-plane: use drm managed resources") +Signed-off-by: Lucas Stach +Link: https://lore.kernel.org/r/20210510145927.988661-1-l.stach@pengutronix.de +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/imx/ipuv3-plane.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/imx/ipuv3-plane.c b/drivers/gpu/drm/imx/ipuv3-plane.c +index c5ff966e2ceb..8c08c8b36074 100644 +--- a/drivers/gpu/drm/imx/ipuv3-plane.c ++++ b/drivers/gpu/drm/imx/ipuv3-plane.c +@@ -345,10 +345,11 @@ static bool ipu_plane_format_mod_supported(struct drm_plane *plane, + if (modifier == DRM_FORMAT_MOD_LINEAR) + return true; + +- /* without a PRG there are no supported modifiers */ +- if (!ipu_prg_present(ipu)) +- return false; +- ++ /* ++ * Without a PRG the possible modifiers list only includes the linear ++ * modifier, so we always take the early return from this function and ++ * only end up here if the PRG is present. ++ */ + return ipu_prg_format_supported(ipu, format, modifier); + } + +@@ -861,6 +862,10 @@ struct ipu_plane *ipu_plane_init(struct drm_device *dev, struct ipu_soc *ipu, + formats = ipu_plane_rgb_formats; + format_count = ARRAY_SIZE(ipu_plane_rgb_formats); + } ++ ++ if (ipu_prg_present(ipu)) ++ modifiers = pre_format_modifiers; ++ + ipu_plane = drmm_universal_plane_alloc(dev, struct ipu_plane, base, + possible_crtcs, &ipu_plane_funcs, + formats, format_count, modifiers, +@@ -875,9 +880,6 @@ struct ipu_plane *ipu_plane_init(struct drm_device *dev, struct ipu_soc *ipu, + ipu_plane->dma = dma; + ipu_plane->dp_flow = dp; + +- if (ipu_prg_present(ipu)) +- modifiers = pre_format_modifiers; +- + drm_plane_helper_add(&ipu_plane->base, &ipu_plane_helper_funcs); + + if (dp == IPU_DP_FLOW_SYNC_BG || dp == IPU_DP_FLOW_SYNC_FG) +-- +2.30.2 + diff --git a/queue-5.12/drm-msm-dp-handle-irq_hpd-with-sink_count-0-correctl.patch b/queue-5.12/drm-msm-dp-handle-irq_hpd-with-sink_count-0-correctl.patch new file mode 100644 index 00000000000..ad1d192174b --- /dev/null +++ b/queue-5.12/drm-msm-dp-handle-irq_hpd-with-sink_count-0-correctl.patch @@ -0,0 +1,266 @@ +From 1af2adb20613174b843c5fc5baf43c2d5b167ba8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 15:25:30 -0700 +Subject: drm/msm/dp: handle irq_hpd with sink_count = 0 correctly + +From: Kuogee Hsieh + +[ Upstream commit f21c8a276c2daddddf58d483b49b01d0603f0316 ] + +irq_hpd interrupt should be handled after dongle plugged in and +before dongle unplugged. Hence irq_hpd interrupt is enabled at +the end of the plugin handle and disabled at the beginning of +unplugged handle. Current irq_hpd with sink_count = 0 is wrongly +handled same as the dongle unplugged which tears down the mainlink +and disables the phy. This patch fixes this problem by only tearing +down the mainlink but keeping phy enabled at irq_hpd with +sink_count = 0 handle so that next irq_hpd with sink_count =1 can be +handled by setup mainlink only. This patch also set dongle into D3 +(power off) state at end of handling irq_hpd with sink_count = 0. + +Changes in v2: +-- add ctrl->phy_Power_count + +Changes in v3: +-- del ctrl->phy_Power_count +-- add phy_power_off to dp_ctrl_off_link_stream() + +Changes in v4: +-- return immediately if clock disable failed at dp_ctrl_off_link_stream() + +Changes in v5: +-- set dongle to D3 (power off) state at dp_ctrl_off_link_stream() + +Changes in v6: +-- add Fixes tag + +Fixes: ea9f337ce81e ("drm/msm/dp: reset dp controller only at boot up and pm_resume") +Signed-off-by: Kuogee Hsieh +Tested-by: Stephen Boyd +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/1621635930-30161-1-git-send-email-khsieh@codeaurora.org +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_catalog.c | 5 +-- + drivers/gpu/drm/msm/dp/dp_ctrl.c | 55 ++++++++++++++++++++++++++++ + drivers/gpu/drm/msm/dp/dp_ctrl.h | 2 + + drivers/gpu/drm/msm/dp/dp_display.c | 57 +++++++++++++++++++++-------- + 4 files changed, 101 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/msm/dp/dp_catalog.c b/drivers/gpu/drm/msm/dp/dp_catalog.c +index b1a9b1b98f5f..f4f53f23e331 100644 +--- a/drivers/gpu/drm/msm/dp/dp_catalog.c ++++ b/drivers/gpu/drm/msm/dp/dp_catalog.c +@@ -582,10 +582,9 @@ void dp_catalog_ctrl_hpd_config(struct dp_catalog *dp_catalog) + + u32 reftimer = dp_read_aux(catalog, REG_DP_DP_HPD_REFTIMER); + +- /* enable HPD interrupts */ ++ /* enable HPD plug and unplug interrupts */ + dp_catalog_hpd_config_intr(dp_catalog, +- DP_DP_HPD_PLUG_INT_MASK | DP_DP_IRQ_HPD_INT_MASK +- | DP_DP_HPD_UNPLUG_INT_MASK | DP_DP_HPD_REPLUG_INT_MASK, true); ++ DP_DP_HPD_PLUG_INT_MASK | DP_DP_HPD_UNPLUG_INT_MASK, true); + + /* Configure REFTIMER and enable it */ + reftimer |= DP_DP_HPD_REFTIMER_ENABLE; +diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c +index 1390f3547fde..2a8955ca70d1 100644 +--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c ++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c +@@ -1809,6 +1809,61 @@ end: + return ret; + } + ++int dp_ctrl_off_link_stream(struct dp_ctrl *dp_ctrl) ++{ ++ struct dp_ctrl_private *ctrl; ++ struct dp_io *dp_io; ++ struct phy *phy; ++ int ret; ++ ++ ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl); ++ dp_io = &ctrl->parser->io; ++ phy = dp_io->phy; ++ ++ /* set dongle to D3 (power off) mode */ ++ dp_link_psm_config(ctrl->link, &ctrl->panel->link_info, true); ++ ++ dp_catalog_ctrl_mainlink_ctrl(ctrl->catalog, false); ++ ++ ret = dp_power_clk_enable(ctrl->power, DP_STREAM_PM, false); ++ if (ret) { ++ DRM_ERROR("Failed to disable pixel clocks. ret=%d\n", ret); ++ return ret; ++ } ++ ++ ret = dp_power_clk_enable(ctrl->power, DP_CTRL_PM, false); ++ if (ret) { ++ DRM_ERROR("Failed to disable link clocks. ret=%d\n", ret); ++ return ret; ++ } ++ ++ phy_power_off(phy); ++ ++ /* aux channel down, reinit phy */ ++ phy_exit(phy); ++ phy_init(phy); ++ ++ DRM_DEBUG_DP("DP off link/stream done\n"); ++ return ret; ++} ++ ++void dp_ctrl_off_phy(struct dp_ctrl *dp_ctrl) ++{ ++ struct dp_ctrl_private *ctrl; ++ struct dp_io *dp_io; ++ struct phy *phy; ++ ++ ctrl = container_of(dp_ctrl, struct dp_ctrl_private, dp_ctrl); ++ dp_io = &ctrl->parser->io; ++ phy = dp_io->phy; ++ ++ dp_catalog_ctrl_reset(ctrl->catalog); ++ ++ phy_exit(phy); ++ ++ DRM_DEBUG_DP("DP off phy done\n"); ++} ++ + int dp_ctrl_off(struct dp_ctrl *dp_ctrl) + { + struct dp_ctrl_private *ctrl; +diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.h b/drivers/gpu/drm/msm/dp/dp_ctrl.h +index a836bd358447..25e4f7512252 100644 +--- a/drivers/gpu/drm/msm/dp/dp_ctrl.h ++++ b/drivers/gpu/drm/msm/dp/dp_ctrl.h +@@ -23,6 +23,8 @@ int dp_ctrl_host_init(struct dp_ctrl *dp_ctrl, bool flip, bool reset); + void dp_ctrl_host_deinit(struct dp_ctrl *dp_ctrl); + int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl); + int dp_ctrl_on_stream(struct dp_ctrl *dp_ctrl); ++int dp_ctrl_off_link_stream(struct dp_ctrl *dp_ctrl); ++void dp_ctrl_off_phy(struct dp_ctrl *dp_ctrl); + int dp_ctrl_off(struct dp_ctrl *dp_ctrl); + void dp_ctrl_push_idle(struct dp_ctrl *dp_ctrl); + void dp_ctrl_isr(struct dp_ctrl *dp_ctrl); +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index 1784e119269b..cdec0a367a2c 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -346,6 +346,12 @@ static int dp_display_process_hpd_high(struct dp_display_private *dp) + dp->dp_display.max_pclk_khz = DP_MAX_PIXEL_CLK_KHZ; + dp->dp_display.max_dp_lanes = dp->parser->max_dp_lanes; + ++ /* ++ * set sink to normal operation mode -- D0 ++ * before dpcd read ++ */ ++ dp_link_psm_config(dp->link, &dp->panel->link_info, false); ++ + dp_link_reset_phy_params_vx_px(dp->link); + rc = dp_ctrl_on_link(dp->ctrl); + if (rc) { +@@ -414,11 +420,6 @@ static int dp_display_usbpd_configure_cb(struct device *dev) + + dp_display_host_init(dp, false); + +- /* +- * set sink to normal operation mode -- D0 +- * before dpcd read +- */ +- dp_link_psm_config(dp->link, &dp->panel->link_info, false); + rc = dp_display_process_hpd_high(dp); + end: + return rc; +@@ -579,6 +580,10 @@ static int dp_hpd_plug_handle(struct dp_display_private *dp, u32 data) + dp_add_event(dp, EV_CONNECT_PENDING_TIMEOUT, 0, tout); + } + ++ /* enable HDP irq_hpd/replug interrupt */ ++ dp_catalog_hpd_config_intr(dp->catalog, ++ DP_DP_IRQ_HPD_INT_MASK | DP_DP_HPD_REPLUG_INT_MASK, true); ++ + mutex_unlock(&dp->event_mutex); + + /* uevent will complete connection part */ +@@ -628,7 +633,26 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data) + mutex_lock(&dp->event_mutex); + + state = dp->hpd_state; +- if (state == ST_DISCONNECT_PENDING || state == ST_DISCONNECTED) { ++ ++ /* disable irq_hpd/replug interrupts */ ++ dp_catalog_hpd_config_intr(dp->catalog, ++ DP_DP_IRQ_HPD_INT_MASK | DP_DP_HPD_REPLUG_INT_MASK, false); ++ ++ /* unplugged, no more irq_hpd handle */ ++ dp_del_event(dp, EV_IRQ_HPD_INT); ++ ++ if (state == ST_DISCONNECTED) { ++ /* triggered by irq_hdp with sink_count = 0 */ ++ if (dp->link->sink_count == 0) { ++ dp_ctrl_off_phy(dp->ctrl); ++ hpd->hpd_high = 0; ++ dp->core_initialized = false; ++ } ++ mutex_unlock(&dp->event_mutex); ++ return 0; ++ } ++ ++ if (state == ST_DISCONNECT_PENDING) { + mutex_unlock(&dp->event_mutex); + return 0; + } +@@ -642,9 +666,8 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data) + + dp->hpd_state = ST_DISCONNECT_PENDING; + +- /* disable HPD plug interrupt until disconnect is done */ +- dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_PLUG_INT_MASK +- | DP_DP_IRQ_HPD_INT_MASK, false); ++ /* disable HPD plug interrupts */ ++ dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_PLUG_INT_MASK, false); + + hpd->hpd_high = 0; + +@@ -660,8 +683,8 @@ static int dp_hpd_unplug_handle(struct dp_display_private *dp, u32 data) + /* signal the disconnect event early to ensure proper teardown */ + dp_display_handle_plugged_change(g_dp_display, false); + +- dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_PLUG_INT_MASK | +- DP_DP_IRQ_HPD_INT_MASK, true); ++ /* enable HDP plug interrupt to prepare for next plugin */ ++ dp_catalog_hpd_config_intr(dp->catalog, DP_DP_HPD_PLUG_INT_MASK, true); + + /* uevent will complete disconnection part */ + mutex_unlock(&dp->event_mutex); +@@ -692,7 +715,7 @@ static int dp_irq_hpd_handle(struct dp_display_private *dp, u32 data) + + /* irq_hpd can happen at either connected or disconnected state */ + state = dp->hpd_state; +- if (state == ST_DISPLAY_OFF) { ++ if (state == ST_DISPLAY_OFF || state == ST_SUSPENDED) { + mutex_unlock(&dp->event_mutex); + return 0; + } +@@ -910,9 +933,13 @@ static int dp_display_disable(struct dp_display_private *dp, u32 data) + + dp_display->audio_enabled = false; + +- dp_ctrl_off(dp->ctrl); +- +- dp->core_initialized = false; ++ /* triggered by irq_hpd with sink_count = 0 */ ++ if (dp->link->sink_count == 0) { ++ dp_ctrl_off_link_stream(dp->ctrl); ++ } else { ++ dp_ctrl_off(dp->ctrl); ++ dp->core_initialized = false; ++ } + + dp_display->power_on = false; + +-- +2.30.2 + diff --git a/queue-5.12/drm-msm-dpu-fix-error-return-code-in-dpu_mdss_init.patch b/queue-5.12/drm-msm-dpu-fix-error-return-code-in-dpu_mdss_init.patch new file mode 100644 index 00000000000..558e0ab38ae --- /dev/null +++ b/queue-5.12/drm-msm-dpu-fix-error-return-code-in-dpu_mdss_init.patch @@ -0,0 +1,70 @@ +From d50795537f2cca493f184616a84ff1956a7fbcc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 14:38:05 +0800 +Subject: drm/msm/dpu: Fix error return code in dpu_mdss_init() + +From: Zhen Lei + +[ Upstream commit e020ac961ce5d038de66dc7f6ffca98899e9a3f3 ] + +The error code returned by platform_get_irq() is stored in 'irq', it's +forgotten to be copied to 'ret' before being returned. As a result, the +value 0 of 'ret' is returned incorrectly. + +After the above fix is completed, initializing the local variable 'ret' +to 0 is no longer needed, remove it. + +In addition, when dpu_mdss_init() is successfully returned, the value of +'ret' is always 0. Therefore, replace "return ret" with "return 0" to make +the code clearer. + +Fixes: 070e64dc1bbc ("drm/msm/dpu: Convert to a chained irq chip") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210510063805.3262-2-thunder.leizhen@huawei.com +Reviewed-by: Stephen Boyd +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c +index 3416e9617ee9..96f3908e4c5b 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_mdss.c +@@ -222,7 +222,7 @@ int dpu_mdss_init(struct drm_device *dev) + struct msm_drm_private *priv = dev->dev_private; + struct dpu_mdss *dpu_mdss; + struct dss_module_power *mp; +- int ret = 0; ++ int ret; + int irq; + + dpu_mdss = devm_kzalloc(dev->dev, sizeof(*dpu_mdss), GFP_KERNEL); +@@ -250,8 +250,10 @@ int dpu_mdss_init(struct drm_device *dev) + goto irq_domain_error; + + irq = platform_get_irq(pdev, 0); +- if (irq < 0) ++ if (irq < 0) { ++ ret = irq; + goto irq_error; ++ } + + irq_set_chained_handler_and_data(irq, dpu_mdss_irq, + dpu_mdss); +@@ -260,7 +262,7 @@ int dpu_mdss_init(struct drm_device *dev) + + pm_runtime_enable(dev->dev); + +- return ret; ++ return 0; + + irq_error: + _dpu_mdss_irq_domain_fini(dpu_mdss); +-- +2.30.2 + diff --git a/queue-5.12/drm-msm-fix-error-return-code-in-msm_drm_init.patch b/queue-5.12/drm-msm-fix-error-return-code-in-msm_drm_init.patch new file mode 100644 index 00000000000..527e33ade12 --- /dev/null +++ b/queue-5.12/drm-msm-fix-error-return-code-in-msm_drm_init.patch @@ -0,0 +1,39 @@ +From 974af13f27d4fbb31412a04a7361ef2e6bcef9e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 10:28:36 +0800 +Subject: drm/msm: Fix error return code in msm_drm_init() + +From: Zhen Lei + +[ Upstream commit a1c9b1e3bdd6d8dc43c18699772fb6cf4497d45a ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 7f9743abaa79 ("drm/msm: validate display and event threads") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210508022836.1777-1-thunder.leizhen@huawei.com +Reviewed-by: Dmitry Baryshkov +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/msm_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c +index 18ea1c66de71..f206c53c27e0 100644 +--- a/drivers/gpu/drm/msm/msm_drv.c ++++ b/drivers/gpu/drm/msm/msm_drv.c +@@ -521,6 +521,7 @@ static int msm_drm_init(struct device *dev, const struct drm_driver *drv) + priv->event_thread[i].worker = kthread_create_worker(0, + "crtc_event:%d", priv->event_thread[i].crtc_id); + if (IS_ERR(priv->event_thread[i].worker)) { ++ ret = PTR_ERR(priv->event_thread[i].worker); + DRM_DEV_ERROR(dev, "failed to create crtc_event kthread\n"); + goto err_msm_uninit; + } +-- +2.30.2 + diff --git a/queue-5.12/drm-pl111-actually-fix-config_vexpress_config-depend.patch b/queue-5.12/drm-pl111-actually-fix-config_vexpress_config-depend.patch new file mode 100644 index 00000000000..6e91a13af7f --- /dev/null +++ b/queue-5.12/drm-pl111-actually-fix-config_vexpress_config-depend.patch @@ -0,0 +1,40 @@ +From c626772e47817e921810f3d27b27801f87680d96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 18:40:55 -0700 +Subject: drm/pl111: Actually fix CONFIG_VEXPRESS_CONFIG depends + +From: Kees Cook + +[ Upstream commit 4e566003571244f508408f59ce78f6ac2ccdba8e ] + +VEXPRESS_CONFIG needs to either be missing, built-in, or modular when +pl111 is modular. Update the Kconfig to reflect the need. + +Fixes: 4dc7c97d04dc ("drm/pl111: depend on CONFIG_VEXPRESS_CONFIG") +Signed-off-by: Kees Cook +Reviewed-by: Linus Walleij +Acked-by: Rob Herring +Signed-off-by: Linus Walleij +Link: https://patchwork.freedesktop.org/patch/msgid/20210604014055.4060521-1-keescook@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/pl111/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/pl111/Kconfig b/drivers/gpu/drm/pl111/Kconfig +index c5210a5bef1b..3aae387a96af 100644 +--- a/drivers/gpu/drm/pl111/Kconfig ++++ b/drivers/gpu/drm/pl111/Kconfig +@@ -2,7 +2,8 @@ + config DRM_PL111 + tristate "DRM Support for PL111 CLCD Controller" + depends on DRM +- depends on VEXPRESS_CONFIG ++ depends on ARM || ARM64 || COMPILE_TEST ++ depends on VEXPRESS_CONFIG || VEXPRESS_CONFIG=n + depends on COMMON_CLK + select DRM_KMS_HELPER + select DRM_KMS_CMA_HELPER +-- +2.30.2 + diff --git a/queue-5.12/drm-pl111-depend-on-config_vexpress_config.patch b/queue-5.12/drm-pl111-depend-on-config_vexpress_config.patch new file mode 100644 index 00000000000..df629846f89 --- /dev/null +++ b/queue-5.12/drm-pl111-depend-on-config_vexpress_config.patch @@ -0,0 +1,39 @@ +From 4d1f578752bef684333bacc2ca593f5b6ae282d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 14:52:52 -0700 +Subject: drm/pl111: depend on CONFIG_VEXPRESS_CONFIG + +From: Kees Cook + +[ Upstream commit 4dc7c97d04dcaa9f19482f70dcfdbeb52cc7193f ] + +Avoid randconfig build failures by requiring VEXPRESS_CONFIG: + +aarch64-linux-gnu-ld: drivers/gpu/drm/pl111/pl111_versatile.o: in function `pl111_vexpress_clcd_init': +pl111_versatile.c:(.text+0x220): undefined reference to `devm_regmap_init_vexpress_config' + +Fixes: 826fc86b5903 ("drm: pl111: Move VExpress setup into versatile init") +Signed-off-by: Kees Cook +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20210602215252.695994-4-keescook@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/pl111/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/pl111/Kconfig b/drivers/gpu/drm/pl111/Kconfig +index 80f6748055e3..c5210a5bef1b 100644 +--- a/drivers/gpu/drm/pl111/Kconfig ++++ b/drivers/gpu/drm/pl111/Kconfig +@@ -2,7 +2,7 @@ + config DRM_PL111 + tristate "DRM Support for PL111 CLCD Controller" + depends on DRM +- depends on ARM || ARM64 || COMPILE_TEST ++ depends on VEXPRESS_CONFIG + depends on COMMON_CLK + select DRM_KMS_HELPER + select DRM_KMS_CMA_HELPER +-- +2.30.2 + diff --git a/queue-5.12/drm-qxl-ensure-surf.data-is-ininitialized.patch b/queue-5.12/drm-qxl-ensure-surf.data-is-ininitialized.patch new file mode 100644 index 00000000000..4e86392d857 --- /dev/null +++ b/queue-5.12/drm-qxl-ensure-surf.data-is-ininitialized.patch @@ -0,0 +1,40 @@ +From b49cf0c1d92583e4a7b68dd0fe43c74b87d3e852 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 17:13:13 +0100 +Subject: drm: qxl: ensure surf.data is ininitialized + +From: Colin Ian King + +[ Upstream commit fbbf23ddb2a1cc0c12c9f78237d1561c24006f50 ] + +The object surf is not fully initialized and the uninitialized +field surf.data is being copied by the call to qxl_bo_create +via the call to qxl_gem_object_create. Set surf.data to zero +to ensure garbage data from the stack is not being copied. + +Addresses-Coverity: ("Uninitialized scalar variable") +Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)") +Signed-off-by: Colin Ian King +Link: http://patchwork.freedesktop.org/patch/msgid/20210608161313.161922-1-colin.king@canonical.com +Signed-off-by: Gerd Hoffmann +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/qxl/qxl_dumb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/qxl/qxl_dumb.c b/drivers/gpu/drm/qxl/qxl_dumb.c +index c04cd5a2553c..e377bdbff90d 100644 +--- a/drivers/gpu/drm/qxl/qxl_dumb.c ++++ b/drivers/gpu/drm/qxl/qxl_dumb.c +@@ -58,6 +58,8 @@ int qxl_mode_dumb_create(struct drm_file *file_priv, + surf.height = args->height; + surf.stride = pitch; + surf.format = format; ++ surf.data = 0; ++ + r = qxl_gem_object_create_with_handle(qdev, file_priv, + QXL_GEM_DOMAIN_SURFACE, + args->size, &surf, &qobj, +-- +2.30.2 + diff --git a/queue-5.12/drm-rockchip-cdn-dp-core-add-missing-clk_disable_unp.patch b/queue-5.12/drm-rockchip-cdn-dp-core-add-missing-clk_disable_unp.patch new file mode 100644 index 00000000000..baa18736bd6 --- /dev/null +++ b/queue-5.12/drm-rockchip-cdn-dp-core-add-missing-clk_disable_unp.patch @@ -0,0 +1,38 @@ +From 05bd64614a0625594975e3cdb3fb3de9f7e92f74 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 21:49:28 +0800 +Subject: drm/rockchip: cdn-dp-core: add missing clk_disable_unprepare() on + error in cdn_dp_grf_write() + +From: Yang Yingliang + +[ Upstream commit ae41d925c75b53798f289c69ee8d9f7d36432f6d ] + +After calling clk_prepare_enable(), clk_disable_unprepare() need +be called when calling regmap_write() failed. + +Fixes: 1a0f7ed3abe2 ("drm/rockchip: cdn-dp: add cdn DP support for rk3399") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20210519134928.2696617-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/cdn-dp-core.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/rockchip/cdn-dp-core.c b/drivers/gpu/drm/rockchip/cdn-dp-core.c +index a4a45daf93f2..6802d9b65f82 100644 +--- a/drivers/gpu/drm/rockchip/cdn-dp-core.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-core.c +@@ -73,6 +73,7 @@ static int cdn_dp_grf_write(struct cdn_dp_device *dp, + ret = regmap_write(dp->grf, reg, val); + if (ret) { + DRM_DEV_ERROR(dp->dev, "Could not write to GRF: %d\n", ret); ++ clk_disable_unprepare(dp->grf_clk); + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.12/drm-rockchip-cdn-dp-fix-sign-extension-on-an-int-mul.patch b/queue-5.12/drm-rockchip-cdn-dp-fix-sign-extension-on-an-int-mul.patch new file mode 100644 index 00000000000..34c8b9a6787 --- /dev/null +++ b/queue-5.12/drm-rockchip-cdn-dp-fix-sign-extension-on-an-int-mul.patch @@ -0,0 +1,42 @@ +From 2513b18e3f47e27b61dcbfeccb02b7962f96e672 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 17:20:49 +0100 +Subject: drm/rockchip: cdn-dp: fix sign extension on an int multiply for a u64 + result + +From: Colin Ian King + +[ Upstream commit ce0cb93a5adb283f577cd4661f511047b5e39028 ] + +The variable bit_per_pix is a u8 and is promoted in the multiplication +to an int type and then sign extended to a u64. If the result of the +int multiplication is greater than 0x7fffffff then the upper 32 bits will +be set to 1 as a result of the sign extension. Avoid this by casting +tu_size_reg to u64 to avoid sign extension and also a potential overflow. + +Fixes: 1a0f7ed3abe2 ("drm/rockchip: cdn-dp: add cdn DP support for rk3399") +Signed-off-by: Colin Ian King +Reviewed-by: Guenter Roeck +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20200915162049.36434-1-colin.king@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/cdn-dp-reg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/rockchip/cdn-dp-reg.c b/drivers/gpu/drm/rockchip/cdn-dp-reg.c +index 9d2163ef4d6e..33fb4d05c506 100644 +--- a/drivers/gpu/drm/rockchip/cdn-dp-reg.c ++++ b/drivers/gpu/drm/rockchip/cdn-dp-reg.c +@@ -658,7 +658,7 @@ int cdn_dp_config_video(struct cdn_dp_device *dp) + */ + do { + tu_size_reg += 2; +- symbol = tu_size_reg * mode->clock * bit_per_pix; ++ symbol = (u64)tu_size_reg * mode->clock * bit_per_pix; + do_div(symbol, dp->max_lanes * link_rate * 8); + rem = do_div(symbol, 1000); + if (tu_size_reg > 64) { +-- +2.30.2 + diff --git a/queue-5.12/drm-rockchip-dsi-move-all-lane-config-except-lcdc-mu.patch b/queue-5.12/drm-rockchip-dsi-move-all-lane-config-except-lcdc-mu.patch new file mode 100644 index 00000000000..9b180c88edf --- /dev/null +++ b/queue-5.12/drm-rockchip-dsi-move-all-lane-config-except-lcdc-mu.patch @@ -0,0 +1,120 @@ +From ba41f3fdbb146af0943d0f6db9466fb288e29533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Apr 2021 19:04:10 -0700 +Subject: drm/rockchip: dsi: move all lane config except LCDC mux to bind() + +From: Thomas Hebb + +[ Upstream commit 43c2de1002d2b70fb5941fa14e97a34e3dc214d4 ] + +When we first enable the DSI encoder, we currently program some per-chip +configuration that we look up in rk3399_chip_data based on the device +tree compatible we match. This data configures various parameters of the +MIPI lanes, including on RK3399 whether DSI1 is slaved to DSI0 in a +dual-mode configuration. It also selects which LCDC (i.e. VOP) to scan +out from. + +This causes a problem in RK3399 dual-mode configurations, though: panel +prepare() callbacks run before the encoder gets enabled and expect to be +able to write commands to the DSI bus, but the bus isn't fully +functional until the lane and master/slave configuration have been +programmed. As a result, dual-mode panels (and possibly others too) fail +to turn on when the rockchipdrm driver is initially loaded. + +Because the LCDC mux is the only thing we don't know until enable time +(and is the only thing that can ever change), we can actually move most +of the initialization to bind() and get it out of the way early. That's +what this change does. (Rockchip's 4.4 BSP kernel does it in mode_set(), +which also avoids the issue, but bind() seems like the more correct +place to me.) + +Tested on a Google Scarlet board (Acer Chromebook Tab 10), which has a +Kingdisplay KD097D04 dual-mode panel. Prior to this change, the panel's +backlight would turn on but no image would appear when initially loading +rockchipdrm. If I kept rockchipdrm loaded and reloaded the panel driver, +it would come on. With this change, the panel successfully turns on +during initial rockchipdrm load as expected. + +Fixes: 2d4f7bdafd70 ("drm/rockchip: dsi: migrate to use dw-mipi-dsi bridge driver") +Signed-off-by: Thomas Hebb +Tested-by: Jonathan Liu +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/55fe7f3454d8c91dc3837ba5aa741d4a0e67378f.1618797813.git.tommyhebb@gmail.com +Signed-off-by: Sasha Levin +--- + .../gpu/drm/rockchip/dw-mipi-dsi-rockchip.c | 36 ++++++++++++++----- + 1 file changed, 28 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c +index 24a71091759c..d8c47ee3cad3 100644 +--- a/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c ++++ b/drivers/gpu/drm/rockchip/dw-mipi-dsi-rockchip.c +@@ -692,13 +692,8 @@ static const struct dw_mipi_dsi_phy_ops dw_mipi_dsi_rockchip_phy_ops = { + .get_timing = dw_mipi_dsi_phy_get_timing, + }; + +-static void dw_mipi_dsi_rockchip_config(struct dw_mipi_dsi_rockchip *dsi, +- int mux) ++static void dw_mipi_dsi_rockchip_config(struct dw_mipi_dsi_rockchip *dsi) + { +- if (dsi->cdata->lcdsel_grf_reg) +- regmap_write(dsi->grf_regmap, dsi->cdata->lcdsel_grf_reg, +- mux ? dsi->cdata->lcdsel_lit : dsi->cdata->lcdsel_big); +- + if (dsi->cdata->lanecfg1_grf_reg) + regmap_write(dsi->grf_regmap, dsi->cdata->lanecfg1_grf_reg, + dsi->cdata->lanecfg1); +@@ -712,6 +707,13 @@ static void dw_mipi_dsi_rockchip_config(struct dw_mipi_dsi_rockchip *dsi, + dsi->cdata->enable); + } + ++static void dw_mipi_dsi_rockchip_set_lcdsel(struct dw_mipi_dsi_rockchip *dsi, ++ int mux) ++{ ++ regmap_write(dsi->grf_regmap, dsi->cdata->lcdsel_grf_reg, ++ mux ? dsi->cdata->lcdsel_lit : dsi->cdata->lcdsel_big); ++} ++ + static int + dw_mipi_dsi_encoder_atomic_check(struct drm_encoder *encoder, + struct drm_crtc_state *crtc_state, +@@ -767,9 +769,9 @@ static void dw_mipi_dsi_encoder_enable(struct drm_encoder *encoder) + return; + } + +- dw_mipi_dsi_rockchip_config(dsi, mux); ++ dw_mipi_dsi_rockchip_set_lcdsel(dsi, mux); + if (dsi->slave) +- dw_mipi_dsi_rockchip_config(dsi->slave, mux); ++ dw_mipi_dsi_rockchip_set_lcdsel(dsi->slave, mux); + + clk_disable_unprepare(dsi->grf_clk); + } +@@ -923,6 +925,24 @@ static int dw_mipi_dsi_rockchip_bind(struct device *dev, + return ret; + } + ++ /* ++ * With the GRF clock running, write lane and dual-mode configurations ++ * that won't change immediately. If we waited until enable() to do ++ * this, things like panel preparation would not be able to send ++ * commands over DSI. ++ */ ++ ret = clk_prepare_enable(dsi->grf_clk); ++ if (ret) { ++ DRM_DEV_ERROR(dsi->dev, "Failed to enable grf_clk: %d\n", ret); ++ return ret; ++ } ++ ++ dw_mipi_dsi_rockchip_config(dsi); ++ if (dsi->slave) ++ dw_mipi_dsi_rockchip_config(dsi->slave); ++ ++ clk_disable_unprepare(dsi->grf_clk); ++ + ret = rockchip_dsi_drm_create_encoder(dsi, drm_dev); + if (ret) { + DRM_DEV_ERROR(dev, "Failed to create drm encoder\n"); +-- +2.30.2 + diff --git a/queue-5.12/drm-rockchip-lvds-fix-an-error-handling-path.patch b/queue-5.12/drm-rockchip-lvds-fix-an-error-handling-path.patch new file mode 100644 index 00000000000..102bdc7213c --- /dev/null +++ b/queue-5.12/drm-rockchip-lvds-fix-an-error-handling-path.patch @@ -0,0 +1,44 @@ +From b607f3513f994144acc36d24060f10df3884272b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 17:13:16 +0200 +Subject: drm/rockchip: lvds: Fix an error handling path + +From: Christophe JAILLET + +[ Upstream commit 3dfa159f6b0c054eb63673fbf643a5f2cc862e63 ] + +'ret' is know to be 0 a this point. Checking the return value of +'phy_init()' and 'phy_set_mode()' was intended instead. + +So add the missing assignments. + +Fixes: cca1705c3d89 ("drm/rockchip: lvds: Add PX30 support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/248220d4815dc8c8088cebfab7d6df5f70518438.1619881852.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_lvds.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_lvds.c b/drivers/gpu/drm/rockchip/rockchip_lvds.c +index 654bc52d9ff3..1a7f24c1ce49 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_lvds.c ++++ b/drivers/gpu/drm/rockchip/rockchip_lvds.c +@@ -499,11 +499,11 @@ static int px30_lvds_probe(struct platform_device *pdev, + if (IS_ERR(lvds->dphy)) + return PTR_ERR(lvds->dphy); + +- phy_init(lvds->dphy); ++ ret = phy_init(lvds->dphy); + if (ret) + return ret; + +- phy_set_mode(lvds->dphy, PHY_MODE_LVDS); ++ ret = phy_set_mode(lvds->dphy, PHY_MODE_LVDS); + if (ret) + return ret; + +-- +2.30.2 + diff --git a/queue-5.12/drm-rockchip-set-alpha_en-to-0-if-it-is-not-used.patch b/queue-5.12/drm-rockchip-set-alpha_en-to-0-if-it-is-not-used.patch new file mode 100644 index 00000000000..ee9b83495ea --- /dev/null +++ b/queue-5.12/drm-rockchip-set-alpha_en-to-0-if-it-is-not-used.patch @@ -0,0 +1,36 @@ +From a138173fadc55ed235292c5bf471135bac4607f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 15:05:54 +0200 +Subject: drm: rockchip: set alpha_en to 0 if it is not used + +From: Alex Bee + +[ Upstream commit 046e0db975695540c9d9898cdbf0b60533d28afb ] + +alpha_en should be set to 0 if it is not used, i.e. to disable alpha +blending if it was enabled before and should be disabled now. + +Fixes: 2aae8ed1f390 ("drm/rockchip: Add per-pixel alpha support for the PX30 VOP") +Signed-off-by: Alex Bee +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20210528130554.72191-6-knaerzche@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +index 8d15cabdcb02..2d10198044c2 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -1013,6 +1013,7 @@ static void vop_plane_atomic_update(struct drm_plane *plane, + VOP_WIN_SET(vop, win, alpha_en, 1); + } else { + VOP_WIN_SET(vop, win, src_alpha_ctl, SRC_ALPHA_EN(0)); ++ VOP_WIN_SET(vop, win, alpha_en, 0); + } + + VOP_WIN_SET(vop, win, enable, 1); +-- +2.30.2 + diff --git a/queue-5.12/drm-vc4-crtc-fix-vc4_get_crtc_encoder-logic.patch b/queue-5.12/drm-vc4-crtc-fix-vc4_get_crtc_encoder-logic.patch new file mode 100644 index 00000000000..6836471d409 --- /dev/null +++ b/queue-5.12/drm-vc4-crtc-fix-vc4_get_crtc_encoder-logic.patch @@ -0,0 +1,95 @@ +From 9cbd6f1cf78dd8a227c79d5367e1d92890197f73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 May 2021 17:05:07 +0200 +Subject: drm/vc4: crtc: Fix vc4_get_crtc_encoder logic + +From: Maxime Ripard + +[ Upstream commit 5a184d959d5a5a66b377cb5cd4c95a80388e0c88 ] + +The vc4_get_crtc_encoder function currently only works when the +connector->state->crtc pointer is set, which is only true when the +connector is currently enabled. + +However, we use it as part of the disable path as well, and our lookup +will fail in that case, resulting in it returning a null pointer we +can't act on. + +We can access the connector that used to be connected to that crtc +though using the old connector state in the disable path. + +Since we want to support both the enable and disable path, we can +support it by passing the state accessor variant as a function pointer, +together with the atomic state. + +Fixes: 792c3132bc1b ("drm/vc4: encoder: Add finer-grained encoder callbacks") +Signed-off-by: Maxime Ripard +Reviewed-by: Dave Stevenson +Link: https://patchwork.freedesktop.org/patch/msgid/20210507150515.257424-5-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_crtc.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c +index d079303cc426..1733add20498 100644 +--- a/drivers/gpu/drm/vc4/vc4_crtc.c ++++ b/drivers/gpu/drm/vc4/vc4_crtc.c +@@ -279,14 +279,22 @@ static u32 vc4_crtc_get_fifo_full_level_bits(struct vc4_crtc *vc4_crtc, + * allows drivers to push pixels to more than one encoder from the + * same CRTC. + */ +-static struct drm_encoder *vc4_get_crtc_encoder(struct drm_crtc *crtc) ++static struct drm_encoder *vc4_get_crtc_encoder(struct drm_crtc *crtc, ++ struct drm_atomic_state *state, ++ struct drm_connector_state *(*get_state)(struct drm_atomic_state *state, ++ struct drm_connector *connector)) + { + struct drm_connector *connector; + struct drm_connector_list_iter conn_iter; + + drm_connector_list_iter_begin(crtc->dev, &conn_iter); + drm_for_each_connector_iter(connector, &conn_iter) { +- if (connector->state->crtc == crtc) { ++ struct drm_connector_state *conn_state = get_state(state, connector); ++ ++ if (!conn_state) ++ continue; ++ ++ if (conn_state->crtc == crtc) { + drm_connector_list_iter_end(&conn_iter); + return connector->encoder; + } +@@ -309,7 +317,8 @@ static void vc4_crtc_config_pv(struct drm_crtc *crtc, struct drm_atomic_state *s + { + struct drm_device *dev = crtc->dev; + struct vc4_dev *vc4 = to_vc4_dev(dev); +- struct drm_encoder *encoder = vc4_get_crtc_encoder(crtc); ++ struct drm_encoder *encoder = vc4_get_crtc_encoder(crtc, state, ++ drm_atomic_get_new_connector_state); + struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder); + struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); + const struct vc4_pv_data *pv_data = vc4_crtc_to_vc4_pv_data(vc4_crtc); +@@ -424,7 +433,8 @@ static int vc4_crtc_disable(struct drm_crtc *crtc, + struct drm_atomic_state *state, + unsigned int channel) + { +- struct drm_encoder *encoder = vc4_get_crtc_encoder(crtc); ++ struct drm_encoder *encoder = vc4_get_crtc_encoder(crtc, state, ++ drm_atomic_get_old_connector_state); + struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder); + struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); + struct drm_device *dev = crtc->dev; +@@ -524,7 +534,8 @@ static void vc4_crtc_atomic_enable(struct drm_crtc *crtc, + { + struct drm_device *dev = crtc->dev; + struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); +- struct drm_encoder *encoder = vc4_get_crtc_encoder(crtc); ++ struct drm_encoder *encoder = vc4_get_crtc_encoder(crtc, state, ++ drm_atomic_get_new_connector_state); + struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder); + + require_hvs_enabled(dev); +-- +2.30.2 + diff --git a/queue-5.12/drm-vc4-crtc-lookup-the-encoder-from-the-register-at.patch b/queue-5.12/drm-vc4-crtc-lookup-the-encoder-from-the-register-at.patch new file mode 100644 index 00000000000..1c198e0dcf6 --- /dev/null +++ b/queue-5.12/drm-vc4-crtc-lookup-the-encoder-from-the-register-at.patch @@ -0,0 +1,115 @@ +From 9d101e443c9f76c0f495d38f2063063230aa8da9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 May 2021 17:05:08 +0200 +Subject: drm/vc4: crtc: Lookup the encoder from the register at boot + +From: Maxime Ripard + +[ Upstream commit b601c16b7ba8f3bb7a7e773b238da6b63657fa1d ] + +At boot, we can't rely on the vc4_get_crtc_encoder since we don't have a +state yet and thus will not be able to figure out which connector is +attached to our CRTC. + +However, we have a muxing bit in the CRTC register we can use to get the +encoder currently connected to the pixelvalve. We can thus read that +register, lookup the associated register through the vc4_pv_data +structure, and then pass it to vc4_crtc_disable so that we can perform +the proper operations. + +Fixes: 875a4d536842 ("drm/vc4: drv: Disable the CRTC at boot time") +Signed-off-by: Maxime Ripard +Reviewed-by: Dave Stevenson +Link: https://patchwork.freedesktop.org/patch/msgid/20210507150515.257424-6-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_crtc.c | 38 ++++++++++++++++++++++++++++++---- + 1 file changed, 34 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c +index 1733add20498..1f36b67cd6ce 100644 +--- a/drivers/gpu/drm/vc4/vc4_crtc.c ++++ b/drivers/gpu/drm/vc4/vc4_crtc.c +@@ -430,11 +430,10 @@ static void require_hvs_enabled(struct drm_device *dev) + } + + static int vc4_crtc_disable(struct drm_crtc *crtc, ++ struct drm_encoder *encoder, + struct drm_atomic_state *state, + unsigned int channel) + { +- struct drm_encoder *encoder = vc4_get_crtc_encoder(crtc, state, +- drm_atomic_get_old_connector_state); + struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder); + struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); + struct drm_device *dev = crtc->dev; +@@ -475,10 +474,29 @@ static int vc4_crtc_disable(struct drm_crtc *crtc, + return 0; + } + ++static struct drm_encoder *vc4_crtc_get_encoder_by_type(struct drm_crtc *crtc, ++ enum vc4_encoder_type type) ++{ ++ struct drm_encoder *encoder; ++ ++ drm_for_each_encoder(encoder, crtc->dev) { ++ struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder); ++ ++ if (vc4_encoder->type == type) ++ return encoder; ++ } ++ ++ return NULL; ++} ++ + int vc4_crtc_disable_at_boot(struct drm_crtc *crtc) + { + struct drm_device *drm = crtc->dev; + struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); ++ enum vc4_encoder_type encoder_type; ++ const struct vc4_pv_data *pv_data; ++ struct drm_encoder *encoder; ++ unsigned encoder_sel; + int channel; + + if (!(of_device_is_compatible(vc4_crtc->pdev->dev.of_node, +@@ -497,7 +515,17 @@ int vc4_crtc_disable_at_boot(struct drm_crtc *crtc) + if (channel < 0) + return 0; + +- return vc4_crtc_disable(crtc, NULL, channel); ++ encoder_sel = VC4_GET_FIELD(CRTC_READ(PV_CONTROL), PV_CONTROL_CLK_SELECT); ++ if (WARN_ON(encoder_sel != 0)) ++ return 0; ++ ++ pv_data = vc4_crtc_to_vc4_pv_data(vc4_crtc); ++ encoder_type = pv_data->encoder_types[encoder_sel]; ++ encoder = vc4_crtc_get_encoder_by_type(crtc, encoder_type); ++ if (WARN_ON(!encoder)) ++ return 0; ++ ++ return vc4_crtc_disable(crtc, encoder, NULL, channel); + } + + static void vc4_crtc_atomic_disable(struct drm_crtc *crtc, +@@ -506,6 +534,8 @@ static void vc4_crtc_atomic_disable(struct drm_crtc *crtc, + struct drm_crtc_state *old_state = drm_atomic_get_old_crtc_state(state, + crtc); + struct vc4_crtc_state *old_vc4_state = to_vc4_crtc_state(old_state); ++ struct drm_encoder *encoder = vc4_get_crtc_encoder(crtc, state, ++ drm_atomic_get_old_connector_state); + struct drm_device *dev = crtc->dev; + + require_hvs_enabled(dev); +@@ -513,7 +543,7 @@ static void vc4_crtc_atomic_disable(struct drm_crtc *crtc, + /* Disable vblank irq handling before crtc is disabled. */ + drm_crtc_vblank_off(crtc); + +- vc4_crtc_disable(crtc, state, old_vc4_state->assigned_channel); ++ vc4_crtc_disable(crtc, encoder, state, old_vc4_state->assigned_channel); + + /* + * Make sure we issue a vblank event after disabling the CRTC if +-- +2.30.2 + diff --git a/queue-5.12/drm-vc4-crtc-pass-the-drm_atomic_state-to-config_pv.patch b/queue-5.12/drm-vc4-crtc-pass-the-drm_atomic_state-to-config_pv.patch new file mode 100644 index 00000000000..4af47f030d5 --- /dev/null +++ b/queue-5.12/drm-vc4-crtc-pass-the-drm_atomic_state-to-config_pv.patch @@ -0,0 +1,58 @@ +From 3dc0ebef439d12578de6089bbba66814c700deee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 May 2021 17:05:06 +0200 +Subject: drm/vc4: crtc: Pass the drm_atomic_state to config_pv + +From: Maxime Ripard + +[ Upstream commit c6883985d46319e0d4f159de8932b09ff93e877d ] + +The vc4_crtc_config_pv will need to access the drm_atomic_state +structure and its only parent function, vc4_crtc_atomic_enable already +has access to it. Let's pass it as a parameter. + +Fixes: 792c3132bc1b ("drm/vc4: encoder: Add finer-grained encoder callbacks") +Signed-off-by: Maxime Ripard +Reviewed-by: Dave Stevenson +Link: https://patchwork.freedesktop.org/patch/msgid/20210507150515.257424-4-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_crtc.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_crtc.c b/drivers/gpu/drm/vc4/vc4_crtc.c +index 76657dcdf9b0..d079303cc426 100644 +--- a/drivers/gpu/drm/vc4/vc4_crtc.c ++++ b/drivers/gpu/drm/vc4/vc4_crtc.c +@@ -305,7 +305,7 @@ static void vc4_crtc_pixelvalve_reset(struct drm_crtc *crtc) + CRTC_WRITE(PV_CONTROL, CRTC_READ(PV_CONTROL) | PV_CONTROL_FIFO_CLR); + } + +-static void vc4_crtc_config_pv(struct drm_crtc *crtc) ++static void vc4_crtc_config_pv(struct drm_crtc *crtc, struct drm_atomic_state *state) + { + struct drm_device *dev = crtc->dev; + struct vc4_dev *vc4 = to_vc4_dev(dev); +@@ -313,8 +313,8 @@ static void vc4_crtc_config_pv(struct drm_crtc *crtc) + struct vc4_encoder *vc4_encoder = to_vc4_encoder(encoder); + struct vc4_crtc *vc4_crtc = to_vc4_crtc(crtc); + const struct vc4_pv_data *pv_data = vc4_crtc_to_vc4_pv_data(vc4_crtc); +- struct drm_crtc_state *state = crtc->state; +- struct drm_display_mode *mode = &state->adjusted_mode; ++ struct drm_crtc_state *crtc_state = crtc->state; ++ struct drm_display_mode *mode = &crtc_state->adjusted_mode; + bool interlace = mode->flags & DRM_MODE_FLAG_INTERLACE; + u32 pixel_rep = (mode->flags & DRM_MODE_FLAG_DBLCLK) ? 2 : 1; + bool is_dsi = (vc4_encoder->type == VC4_ENCODER_TYPE_DSI0 || +@@ -539,7 +539,7 @@ static void vc4_crtc_atomic_enable(struct drm_crtc *crtc, + if (vc4_encoder->pre_crtc_configure) + vc4_encoder->pre_crtc_configure(encoder, state); + +- vc4_crtc_config_pv(crtc); ++ vc4_crtc_config_pv(crtc, state); + + CRTC_WRITE(PV_CONTROL, CRTC_READ(PV_CONTROL) | PV_CONTROL_EN); + +-- +2.30.2 + diff --git a/queue-5.12/drm-vc4-hdmi-fix-error-path-of-hpd-gpios.patch b/queue-5.12/drm-vc4-hdmi-fix-error-path-of-hpd-gpios.patch new file mode 100644 index 00000000000..dd6a3d9eaf1 --- /dev/null +++ b/queue-5.12/drm-vc4-hdmi-fix-error-path-of-hpd-gpios.patch @@ -0,0 +1,52 @@ +From 25912b4cec2804b1a3dceac4e096ce762590acce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 15:18:51 +0200 +Subject: drm/vc4: hdmi: Fix error path of hpd-gpios + +From: Maxime Ripard + +[ Upstream commit e075a7811977ff51c917a65ed1896e08231d2615 ] + +If the of_get_named_gpio_flags call fails in vc4_hdmi_bind, we jump to +the err_unprepare_hsm label. That label will then call +pm_runtime_disable and put_device on the DDC device. + +We just retrieved the DDC device, so the latter is definitely justified. +However at that point we still haven't called pm_runtime_enable, so the +call to pm_runtime_disable is not supposed to be there. + +Fixes: 10ee275cb12f ("drm/vc4: prepare for CEC support") +Signed-off-by: Maxime Ripard +Reviewed-by: Linus Walleij +Link: https://patchwork.freedesktop.org/patch/msgid/20210524131852.263883-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 8106b5634fe1..e94730beb15b 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -2000,7 +2000,7 @@ static int vc4_hdmi_bind(struct device *dev, struct device *master, void *data) + &hpd_gpio_flags); + if (vc4_hdmi->hpd_gpio < 0) { + ret = vc4_hdmi->hpd_gpio; +- goto err_unprepare_hsm; ++ goto err_put_ddc; + } + + vc4_hdmi->hpd_active_low = hpd_gpio_flags & OF_GPIO_ACTIVE_LOW; +@@ -2041,8 +2041,8 @@ err_destroy_conn: + vc4_hdmi_connector_destroy(&vc4_hdmi->connector); + err_destroy_encoder: + drm_encoder_cleanup(encoder); +-err_unprepare_hsm: + pm_runtime_disable(dev); ++err_put_ddc: + put_device(&vc4_hdmi->ddc->dev); + + return ret; +-- +2.30.2 + diff --git a/queue-5.12/drm-vmwgfx-fix-cpu-updates-of-coherent-multisample-s.patch b/queue-5.12/drm-vmwgfx-fix-cpu-updates-of-coherent-multisample-s.patch new file mode 100644 index 00000000000..a7382108a3f --- /dev/null +++ b/queue-5.12/drm-vmwgfx-fix-cpu-updates-of-coherent-multisample-s.patch @@ -0,0 +1,109 @@ +From c95ff3367d1a8fff7cf8d40df21e3ba7bc72832d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 23:57:37 -0400 +Subject: drm/vmwgfx: Fix cpu updates of coherent multisample surfaces + +From: Thomas Hellstrom + +[ Upstream commit 88509f698c4e38e287e016e86a0445547824135c ] + +In cases where the dirty linear memory range spans multiple sample sheets +in a surface, the dirty surface region is incorrectly computed. +To do this correctly and in an optimized fashion we would have to compute +the dirty region of each sample sheet and compute the union of those +regions. + +But assuming that cpu writing to a multisample surface is rather a corner +case than a common case, just set the dirty region to the full surface. + +This fixes OpenGL piglit errors with SVGA_FORCE_COHERENT=1 +and the piglit test: + +fbo-depthstencil blit default_fb -samples=2 -auto + +Fixes: 9ca7d19ff8ba ("drm/vmwgfx: Add surface dirty-tracking callbacks") +Signed-off-by: Thomas Hellstrom +Reviewed-by: Charmaine Lee +Reviewed-by: Roland Scheidegger +Signed-off-by: Zack Rusin +Link: https://patchwork.freedesktop.org/patch/msgid/20210505035740.286923-4-zackr@vmware.com +Signed-off-by: Sasha Levin +--- + .../drm/vmwgfx/device_include/svga3d_surfacedefs.h | 8 ++++++-- + drivers/gpu/drm/vmwgfx/vmwgfx_surface.c | 13 +++++++++++++ + 2 files changed, 19 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/device_include/svga3d_surfacedefs.h b/drivers/gpu/drm/vmwgfx/device_include/svga3d_surfacedefs.h +index 4db25bd9fa22..127eaf0a0a58 100644 +--- a/drivers/gpu/drm/vmwgfx/device_include/svga3d_surfacedefs.h ++++ b/drivers/gpu/drm/vmwgfx/device_include/svga3d_surfacedefs.h +@@ -1467,6 +1467,7 @@ struct svga3dsurface_cache { + + /** + * struct svga3dsurface_loc - Surface location ++ * @sheet: The multisample sheet. + * @sub_resource: Surface subresource. Defined as layer * num_mip_levels + + * mip_level. + * @x: X coordinate. +@@ -1474,6 +1475,7 @@ struct svga3dsurface_cache { + * @z: Z coordinate. + */ + struct svga3dsurface_loc { ++ u32 sheet; + u32 sub_resource; + u32 x, y, z; + }; +@@ -1566,8 +1568,8 @@ svga3dsurface_get_loc(const struct svga3dsurface_cache *cache, + u32 layer; + int i; + +- if (offset >= cache->sheet_bytes) +- offset %= cache->sheet_bytes; ++ loc->sheet = offset / cache->sheet_bytes; ++ offset -= loc->sheet * cache->sheet_bytes; + + layer = offset / cache->mip_chain_bytes; + offset -= layer * cache->mip_chain_bytes; +@@ -1631,6 +1633,7 @@ svga3dsurface_min_loc(const struct svga3dsurface_cache *cache, + u32 sub_resource, + struct svga3dsurface_loc *loc) + { ++ loc->sheet = 0; + loc->sub_resource = sub_resource; + loc->x = loc->y = loc->z = 0; + } +@@ -1652,6 +1655,7 @@ svga3dsurface_max_loc(const struct svga3dsurface_cache *cache, + const struct drm_vmw_size *size; + u32 mip; + ++ loc->sheet = 0; + loc->sub_resource = sub_resource + 1; + mip = sub_resource % cache->num_mip_levels; + size = &cache->mip[mip].size; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +index f6cab77075a0..990523217278 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c +@@ -1801,6 +1801,19 @@ static void vmw_surface_tex_dirty_range_add(struct vmw_resource *res, + svga3dsurface_get_loc(cache, &loc2, end - 1); + svga3dsurface_inc_loc(cache, &loc2); + ++ if (loc1.sheet != loc2.sheet) { ++ u32 sub_res; ++ ++ /* ++ * Multiple multisample sheets. To do this in an optimized ++ * fashion, compute the dirty region for each sheet and the ++ * resulting union. Since this is not a common case, just dirty ++ * the whole surface. ++ */ ++ for (sub_res = 0; sub_res < dirty->num_subres; ++sub_res) ++ vmw_subres_dirty_full(dirty, sub_res); ++ return; ++ } + if (loc1.sub_resource + 1 == loc2.sub_resource) { + /* Dirty range covers a single sub-resource */ + vmw_subres_dirty_add(dirty, &loc1, &loc2); +-- +2.30.2 + diff --git a/queue-5.12/drm-vmwgfx-mark-a-surface-gpu-dirty-after-the-svga3d.patch b/queue-5.12/drm-vmwgfx-mark-a-surface-gpu-dirty-after-the-svga3d.patch new file mode 100644 index 00000000000..3f7a962f027 --- /dev/null +++ b/queue-5.12/drm-vmwgfx-mark-a-surface-gpu-dirty-after-the-svga3d.patch @@ -0,0 +1,67 @@ +From 7102071d8fe035889296dcba72d7a0193091c968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 23:57:36 -0400 +Subject: drm/vmwgfx: Mark a surface gpu-dirty after the SVGA3dCmdDXGenMips + command + +From: Thomas Hellstrom + +[ Upstream commit 75156a887b6cea6e09d83ec19f4ebfd7c86265f0 ] + +The SVGA3dCmdDXGenMips command uses a shader-resource view to access +the underlying surface. Normally accesses using that view-type are not +dirtying the underlying surface, but that particular command is an +exception. +Mark the surface gpu-dirty after a SVGA3dCmdDXGenMips command has been +submitted. + +This fixes the piglit getteximage-formats test run with +SVGA_FORCE_COHERENT=1 + +Fixes: a9f58c456e9d ("drm/vmwgfx: Be more restrictive when dirtying resources") +Signed-off-by: Thomas Hellstrom +Reviewed-by: Charmaine Lee +Reviewed-by: Roland Scheidegger +Signed-off-by: Zack Rusin +Link: https://patchwork.freedesktop.org/patch/msgid/20210505035740.286923-3-zackr@vmware.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 20 ++++++++++++++++---- + 1 file changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +index 462f17320708..0996c3282ebd 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c +@@ -2759,12 +2759,24 @@ static int vmw_cmd_dx_genmips(struct vmw_private *dev_priv, + { + VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdDXGenMips) = + container_of(header, typeof(*cmd), header); +- struct vmw_resource *ret; ++ struct vmw_resource *view; ++ struct vmw_res_cache_entry *rcache; + +- ret = vmw_view_id_val_add(sw_context, vmw_view_sr, +- cmd->body.shaderResourceViewId); ++ view = vmw_view_id_val_add(sw_context, vmw_view_sr, ++ cmd->body.shaderResourceViewId); ++ if (IS_ERR(view)) ++ return PTR_ERR(view); + +- return PTR_ERR_OR_ZERO(ret); ++ /* ++ * Normally the shader-resource view is not gpu-dirtying, but for ++ * this particular command it is... ++ * So mark the last looked-up surface, which is the surface ++ * the view points to, gpu-dirty. ++ */ ++ rcache = &sw_context->res_cache[vmw_res_surface]; ++ vmw_validation_res_set_dirty(sw_context->ctx, rcache->private, ++ VMW_RES_DIRTY_SET); ++ return 0; + } + + /** +-- +2.30.2 + diff --git a/queue-5.12/e1000e-check-the-pcim-state.patch b/queue-5.12/e1000e-check-the-pcim-state.patch new file mode 100644 index 00000000000..e4bd9ac6101 --- /dev/null +++ b/queue-5.12/e1000e-check-the-pcim-state.patch @@ -0,0 +1,64 @@ +From 7002a470f8611a9b7f2c3dbe696f3bd86c41db49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 12:02:48 -0700 +Subject: e1000e: Check the PCIm state + +From: Sasha Neftin + +[ Upstream commit 2e7256f12cdb16eaa2515b6231d665044a07c51a ] + +Complete to commit def4ec6dce393e ("e1000e: PCIm function state support") +Check the PCIm state only on CSME systems. There is no point to do this +check on non CSME systems. +This patch fixes a generation a false-positive warning: +"Error in exiting dmoff" + +Fixes: def4ec6dce39 ("e1000e: PCIm function state support") +Signed-off-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/netdev.c | 24 ++++++++++++---------- + 1 file changed, 13 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index a0948002ddf8..b3ad95ac3d85 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -5222,18 +5222,20 @@ static void e1000_watchdog_task(struct work_struct *work) + pm_runtime_resume(netdev->dev.parent); + + /* Checking if MAC is in DMoff state*/ +- pcim_state = er32(STATUS); +- while (pcim_state & E1000_STATUS_PCIM_STATE) { +- if (tries++ == dmoff_exit_timeout) { +- e_dbg("Error in exiting dmoff\n"); +- break; +- } +- usleep_range(10000, 20000); ++ if (er32(FWSM) & E1000_ICH_FWSM_FW_VALID) { + pcim_state = er32(STATUS); +- +- /* Checking if MAC exited DMoff state */ +- if (!(pcim_state & E1000_STATUS_PCIM_STATE)) +- e1000_phy_hw_reset(&adapter->hw); ++ while (pcim_state & E1000_STATUS_PCIM_STATE) { ++ if (tries++ == dmoff_exit_timeout) { ++ e_dbg("Error in exiting dmoff\n"); ++ break; ++ } ++ usleep_range(10000, 20000); ++ pcim_state = er32(STATUS); ++ ++ /* Checking if MAC exited DMoff state */ ++ if (!(pcim_state & E1000_STATUS_PCIM_STATE)) ++ e1000_phy_hw_reset(&adapter->hw); ++ } + } + + /* update snapshot of PHY registers on LSC */ +-- +2.30.2 + diff --git a/queue-5.12/edac-aspeed-use-proper-format-string-for-printing-re.patch b/queue-5.12/edac-aspeed-use-proper-format-string-for-printing-re.patch new file mode 100644 index 00000000000..79b9b4ac7b0 --- /dev/null +++ b/queue-5.12/edac-aspeed-use-proper-format-string-for-printing-re.patch @@ -0,0 +1,50 @@ +From 8f74a3da4c15423752233cdf76a003bf3217e182 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 15:54:53 +0200 +Subject: EDAC/aspeed: Use proper format string for printing resource + +From: Arnd Bergmann + +[ Upstream commit 2e2f16d5cdb33e5f6fc53b7ad66c9f456d5f2950 ] + +On ARMv7, resource_size_t can be 64-bit, which breaks printing +it as %x: + + drivers/edac/aspeed_edac.c: In function 'init_csrows': + drivers/edac/aspeed_edac.c:257:28: error: format '%x' expects argument of \ + type 'unsigned int', but argument 4 has type 'resource_size_t' {aka 'long \ + long unsigned int'} [-Werror=format=] + 257 | dev_dbg(mci->pdev, "dt: /memory node resources: first page \ + r.start=0x%x, resource_size=0x%x, PAGE_SHIFT macro=0x%x\n", + +Use the special %pR format string to pretty-print the entire resource +instead. + +Fixes: edfc2d73ca45 ("EDAC/aspeed: Add support for AST2400 and AST2600") +Signed-off-by: Arnd Bergmann +Signed-off-by: Borislav Petkov +Reviewed-by: Andrew Jeffery +Link: https://lkml.kernel.org/r/20210421135500.3518661-1-arnd@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/edac/aspeed_edac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/aspeed_edac.c b/drivers/edac/aspeed_edac.c +index a46da56d6d54..6bd5f8815919 100644 +--- a/drivers/edac/aspeed_edac.c ++++ b/drivers/edac/aspeed_edac.c +@@ -254,8 +254,8 @@ static int init_csrows(struct mem_ctl_info *mci) + return rc; + } + +- dev_dbg(mci->pdev, "dt: /memory node resources: first page r.start=0x%x, resource_size=0x%x, PAGE_SHIFT macro=0x%x\n", +- r.start, resource_size(&r), PAGE_SHIFT); ++ dev_dbg(mci->pdev, "dt: /memory node resources: first page %pR, PAGE_SHIFT macro=0x%x\n", ++ &r, PAGE_SHIFT); + + csrow->first_page = r.start >> PAGE_SHIFT; + nr_pages = resource_size(&r) >> PAGE_SHIFT; +-- +2.30.2 + diff --git a/queue-5.12/edac-igen6-fix-core-dependency.patch b/queue-5.12/edac-igen6-fix-core-dependency.patch new file mode 100644 index 00000000000..a3fe55999c7 --- /dev/null +++ b/queue-5.12/edac-igen6-fix-core-dependency.patch @@ -0,0 +1,46 @@ +From 57b3032ca57a66137a08303ab193c5f799fa41af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 09:02:03 -0700 +Subject: EDAC/igen6: fix core dependency + +From: Randy Dunlap + +[ Upstream commit 0a9ece9ba154dd6205709108180952c55e630833 ] + +igen6_edac needs mce_register()/unregister() functions, +so it should depend on X86_MCE (or X86_MCE_INTEL). + +That change prevents these build errors: + +ld: drivers/edac/igen6_edac.o: in function `igen6_remove': +igen6_edac.c:(.text+0x494): undefined reference to `mce_unregister_decode_chain' +ld: drivers/edac/igen6_edac.o: in function `igen6_probe': +igen6_edac.c:(.text+0xf5b): undefined reference to `mce_register_decode_chain' + +Fixes: 10590a9d4f23e ("EDAC/igen6: Add EDAC driver for Intel client SoCs using IBECC") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/r/20210619160203.2026-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + drivers/edac/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig +index 27d0c4cdc58d..9b21e45debc2 100644 +--- a/drivers/edac/Kconfig ++++ b/drivers/edac/Kconfig +@@ -270,7 +270,8 @@ config EDAC_PND2 + + config EDAC_IGEN6 + tristate "Intel client SoC Integrated MC" +- depends on PCI && X86_64 && PCI_MMCONFIG && ARCH_HAVE_NMI_SAFE_CMPXCHG ++ depends on PCI && PCI_MMCONFIG && ARCH_HAVE_NMI_SAFE_CMPXCHG ++ depends on X64_64 && X86_MCE_INTEL + help + Support for error detection and correction on the Intel + client SoC Integrated Memory Controller using In-Band ECC IP. +-- +2.30.2 + diff --git a/queue-5.12/edac-intel-do-not-load-edac-driver-when-running-as-a.patch b/queue-5.12/edac-intel-do-not-load-edac-driver-when-running-as-a.patch new file mode 100644 index 00000000000..3e3f41f5b23 --- /dev/null +++ b/queue-5.12/edac-intel-do-not-load-edac-driver-when-running-as-a.patch @@ -0,0 +1,87 @@ +From 3c60d5ace07dfec75a571576378029c826bfc782 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 10:44:19 -0700 +Subject: EDAC/Intel: Do not load EDAC driver when running as a guest + +From: Luck, Tony + +[ Upstream commit f0a029fff4a50eb01648810a77ba1873e829fdd4 ] + +There's little to no point in loading an EDAC driver running in a guest: +1) The CPU model reported by CPUID may not represent actual h/w +2) The hypervisor likely does not pass in access to memory controller devices +3) Hypervisors generally do not pass corrected error details to guests + +Add a check in each of the Intel EDAC drivers for X86_FEATURE_HYPERVISOR +and simply return -ENODEV in the init routine. + +Acked-by: Borislav Petkov +Signed-off-by: Tony Luck +Link: https://lore.kernel.org/r/20210615174419.GA1087688@agluck-desk2.amr.corp.intel.com +Signed-off-by: Sasha Levin +--- + drivers/edac/i10nm_base.c | 3 +++ + drivers/edac/pnd2_edac.c | 3 +++ + drivers/edac/sb_edac.c | 3 +++ + drivers/edac/skx_base.c | 3 +++ + 4 files changed, 12 insertions(+) + +diff --git a/drivers/edac/i10nm_base.c b/drivers/edac/i10nm_base.c +index 238a4ad1e526..37b4e875420e 100644 +--- a/drivers/edac/i10nm_base.c ++++ b/drivers/edac/i10nm_base.c +@@ -278,6 +278,9 @@ static int __init i10nm_init(void) + if (owner && strncmp(owner, EDAC_MOD_STR, sizeof(EDAC_MOD_STR))) + return -EBUSY; + ++ if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) ++ return -ENODEV; ++ + id = x86_match_cpu(i10nm_cpuids); + if (!id) + return -ENODEV; +diff --git a/drivers/edac/pnd2_edac.c b/drivers/edac/pnd2_edac.c +index 928f63a374c7..c94ca1f790c4 100644 +--- a/drivers/edac/pnd2_edac.c ++++ b/drivers/edac/pnd2_edac.c +@@ -1554,6 +1554,9 @@ static int __init pnd2_init(void) + if (owner && strncmp(owner, EDAC_MOD_STR, sizeof(EDAC_MOD_STR))) + return -EBUSY; + ++ if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) ++ return -ENODEV; ++ + id = x86_match_cpu(pnd2_cpuids); + if (!id) + return -ENODEV; +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index 93daa4297f2e..4c626fcd4dcb 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -3510,6 +3510,9 @@ static int __init sbridge_init(void) + if (owner && strncmp(owner, EDAC_MOD_STR, sizeof(EDAC_MOD_STR))) + return -EBUSY; + ++ if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) ++ return -ENODEV; ++ + id = x86_match_cpu(sbridge_cpuids); + if (!id) + return -ENODEV; +diff --git a/drivers/edac/skx_base.c b/drivers/edac/skx_base.c +index 6a4f0b27c654..4dbd46575bfb 100644 +--- a/drivers/edac/skx_base.c ++++ b/drivers/edac/skx_base.c +@@ -656,6 +656,9 @@ static int __init skx_init(void) + if (owner && strncmp(owner, EDAC_MOD_STR, sizeof(EDAC_MOD_STR))) + return -EBUSY; + ++ if (cpu_feature_enabled(X86_FEATURE_HYPERVISOR)) ++ return -ENODEV; ++ + id = x86_match_cpu(skx_cpuids); + if (!id) + return -ENODEV; +-- +2.30.2 + diff --git a/queue-5.12/edac-ti-add-missing-module_device_table.patch b/queue-5.12/edac-ti-add-missing-module_device_table.patch new file mode 100644 index 00000000000..aa1043b3f23 --- /dev/null +++ b/queue-5.12/edac-ti-add-missing-module_device_table.patch @@ -0,0 +1,39 @@ +From fe4b46a31275f9a44d310868ecff6c2b9c65f170 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 11:37:27 +0800 +Subject: EDAC/ti: Add missing MODULE_DEVICE_TABLE + +From: Bixuan Cui + +[ Upstream commit 0a37f32ba5272b2d4ec8c8d0f6b212b81b578f7e ] + +The module misses MODULE_DEVICE_TABLE() for of_device_id tables and thus +never autoloads on ID matches. + +Add the missing declaration. + +Reported-by: Hulk Robot +Signed-off-by: Bixuan Cui +Signed-off-by: Borislav Petkov +Cc: Tero Kristo +Link: https://lkml.kernel.org/r/20210512033727.26701-1-cuibixuan@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/edac/ti_edac.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/edac/ti_edac.c b/drivers/edac/ti_edac.c +index e7eae20f83d1..169f96e51c29 100644 +--- a/drivers/edac/ti_edac.c ++++ b/drivers/edac/ti_edac.c +@@ -197,6 +197,7 @@ static const struct of_device_id ti_edac_of_match[] = { + { .compatible = "ti,emif-dra7xx", .data = (void *)EMIF_TYPE_DRA7 }, + {}, + }; ++MODULE_DEVICE_TABLE(of, ti_edac_of_match); + + static int _emif_get_id(struct device_node *node) + { +-- +2.30.2 + diff --git a/queue-5.12/eeprom-idt_89hpesx-put-fwnode-in-matching-case-durin.patch b/queue-5.12/eeprom-idt_89hpesx-put-fwnode-in-matching-case-durin.patch new file mode 100644 index 00000000000..554ae4d11ac --- /dev/null +++ b/queue-5.12/eeprom-idt_89hpesx-put-fwnode-in-matching-case-durin.patch @@ -0,0 +1,37 @@ +From d2881390ffee32b17b8dc06115b299e2848812d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 01:17:55 +0300 +Subject: eeprom: idt_89hpesx: Put fwnode in matching case during ->probe() + +From: Andy Shevchenko + +[ Upstream commit 3f6ee1c095156a74ab2df605af13020f1ce3e600 ] + +device_get_next_child_node() bumps a reference counting of a returned variable. +We have to balance it whenever we return to the caller. + +Fixes: db15d73e5f0e ("eeprom: idt_89hpesx: Support both ACPI and OF probing") +Cc: Huy Duong +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210607221757.81465-1-andy.shevchenko@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/idt_89hpesx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c +index 81c70e5bc168..45a61a1f9e98 100644 +--- a/drivers/misc/eeprom/idt_89hpesx.c ++++ b/drivers/misc/eeprom/idt_89hpesx.c +@@ -1161,6 +1161,7 @@ static void idt_get_fw_data(struct idt_89hpesx_dev *pdev) + else /* if (!fwnode_property_read_bool(node, "read-only")) */ + pdev->eero = false; + ++ fwnode_handle_put(fwnode); + dev_info(dev, "EEPROM of %d bytes found by 0x%x", + pdev->eesize, pdev->eeaddr); + } +-- +2.30.2 + diff --git a/queue-5.12/eeprom-idt_89hpesx-restore-printing-the-unsupported-.patch b/queue-5.12/eeprom-idt_89hpesx-restore-printing-the-unsupported-.patch new file mode 100644 index 00000000000..d11113e0b59 --- /dev/null +++ b/queue-5.12/eeprom-idt_89hpesx-restore-printing-the-unsupported-.patch @@ -0,0 +1,46 @@ +From 5b6d5f7462328428564a581011a230cd539d08a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 01:17:56 +0300 +Subject: eeprom: idt_89hpesx: Restore printing the unsupported fwnode name + +From: Andy Shevchenko + +[ Upstream commit e0db3deea73ba418bf5dc21f5a4e32ca87d16dde ] + +When iterating over child firmware nodes restore printing the name of ones +that are not supported. + +While at it, refactor loop body to clearly show that we stop at the first match. + +Fixes: db15d73e5f0e ("eeprom: idt_89hpesx: Support both ACPI and OF probing") +Cc: Huy Duong +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210607221757.81465-2-andy.shevchenko@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/eeprom/idt_89hpesx.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/eeprom/idt_89hpesx.c b/drivers/misc/eeprom/idt_89hpesx.c +index 45a61a1f9e98..3e4a594c110b 100644 +--- a/drivers/misc/eeprom/idt_89hpesx.c ++++ b/drivers/misc/eeprom/idt_89hpesx.c +@@ -1126,11 +1126,10 @@ static void idt_get_fw_data(struct idt_89hpesx_dev *pdev) + + device_for_each_child_node(dev, fwnode) { + ee_id = idt_ee_match_id(fwnode); +- if (!ee_id) { +- dev_warn(dev, "Skip unsupported EEPROM device"); +- continue; +- } else ++ if (ee_id) + break; ++ ++ dev_warn(dev, "Skip unsupported EEPROM device %pfw\n", fwnode); + } + + /* If there is no fwnode EEPROM device, then set zero size */ +-- +2.30.2 + diff --git a/queue-5.12/ehea-fix-error-return-code-in-ehea_restart_qps.patch b/queue-5.12/ehea-fix-error-return-code-in-ehea_restart_qps.patch new file mode 100644 index 00000000000..cb00e4ea813 --- /dev/null +++ b/queue-5.12/ehea-fix-error-return-code-in-ehea_restart_qps.patch @@ -0,0 +1,69 @@ +From 19cc91dce216e99936a3157c0c5ba710cfda9f64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 16:55:55 +0800 +Subject: ehea: fix error return code in ehea_restart_qps() + +From: Zhen Lei + +[ Upstream commit 015dbf5662fd689d581c0bc980711b073ca09a1a ] + +Fix to return -EFAULT from the error handling case instead of 0, as done +elsewhere in this function. + +By the way, when get_zeroed_page() fails, directly return -ENOMEM to +simplify code. + +Fixes: 2c69448bbced ("ehea: DLPAR memory add fix") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210528085555.9390-1-thunder.leizhen@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ehea/ehea_main.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ehea/ehea_main.c b/drivers/net/ethernet/ibm/ehea/ehea_main.c +index c2e740475786..f63066736425 100644 +--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c ++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c +@@ -2617,10 +2617,8 @@ static int ehea_restart_qps(struct net_device *dev) + u16 dummy16 = 0; + + cb0 = (void *)get_zeroed_page(GFP_KERNEL); +- if (!cb0) { +- ret = -ENOMEM; +- goto out; +- } ++ if (!cb0) ++ return -ENOMEM; + + for (i = 0; i < (port->num_def_qps); i++) { + struct ehea_port_res *pr = &port->port_res[i]; +@@ -2640,6 +2638,7 @@ static int ehea_restart_qps(struct net_device *dev) + cb0); + if (hret != H_SUCCESS) { + netdev_err(dev, "query_ehea_qp failed (1)\n"); ++ ret = -EFAULT; + goto out; + } + +@@ -2652,6 +2651,7 @@ static int ehea_restart_qps(struct net_device *dev) + &dummy64, &dummy16, &dummy16); + if (hret != H_SUCCESS) { + netdev_err(dev, "modify_ehea_qp failed (1)\n"); ++ ret = -EFAULT; + goto out; + } + +@@ -2660,6 +2660,7 @@ static int ehea_restart_qps(struct net_device *dev) + cb0); + if (hret != H_SUCCESS) { + netdev_err(dev, "query_ehea_qp failed (2)\n"); ++ ret = -EFAULT; + goto out; + } + +-- +2.30.2 + diff --git a/queue-5.12/evm-fix-writing-securityfs-evm-overflow.patch b/queue-5.12/evm-fix-writing-securityfs-evm-overflow.patch new file mode 100644 index 00000000000..d71d76f675f --- /dev/null +++ b/queue-5.12/evm-fix-writing-securityfs-evm-overflow.patch @@ -0,0 +1,44 @@ +From ed810db094152711b81047c0414591ba5126307e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 18:13:45 -0400 +Subject: evm: fix writing /evm overflow + +From: Mimi Zohar + +[ Upstream commit 49219d9b8785ba712575c40e48ce0f7461254626 ] + +EVM_SETUP_COMPLETE is defined as 0x80000000, which is larger than INT_MAX. +The "-fno-strict-overflow" compiler option properly prevents signaling +EVM that the EVM policy setup is complete. Define and read an unsigned +int. + +Fixes: f00d79750712 ("EVM: Allow userspace to signal an RSA key has been loaded") +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/evm/evm_secfs.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/security/integrity/evm/evm_secfs.c b/security/integrity/evm/evm_secfs.c +index c175e2b659e4..5f0da41bccd0 100644 +--- a/security/integrity/evm/evm_secfs.c ++++ b/security/integrity/evm/evm_secfs.c +@@ -66,12 +66,13 @@ static ssize_t evm_read_key(struct file *filp, char __user *buf, + static ssize_t evm_write_key(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) + { +- int i, ret; ++ unsigned int i; ++ int ret; + + if (!capable(CAP_SYS_ADMIN) || (evm_initialized & EVM_SETUP_COMPLETE)) + return -EPERM; + +- ret = kstrtoint_from_user(buf, count, 0, &i); ++ ret = kstrtouint_from_user(buf, count, 0, &i); + + if (ret) + return ret; +-- +2.30.2 + diff --git a/queue-5.12/extcon-extcon-max8997-fix-irq-freeing-at-error-path.patch b/queue-5.12/extcon-extcon-max8997-fix-irq-freeing-at-error-path.patch new file mode 100644 index 00000000000..e0f6e9ad8b6 --- /dev/null +++ b/queue-5.12/extcon-extcon-max8997-fix-irq-freeing-at-error-path.patch @@ -0,0 +1,41 @@ +From c57691bf40ac39fa7469ced4ee8f05aad84799d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 13:10:31 +0300 +Subject: extcon: extcon-max8997: Fix IRQ freeing at error path + +From: Matti Vaittinen + +[ Upstream commit 610bdc04830a864115e6928fc944f1171dfff6f3 ] + +If reading MAX8997_MUIC_REG_STATUS1 fails at probe the driver exits +without freeing the requested IRQs. + +Free the IRQs prior returning if reading the status fails. + +Fixes: 3e34c8198960 ("extcon: max8997: Avoid forcing UART path on drive probe") +Signed-off-by: Matti Vaittinen +Reviewed-by: Hans de Goede +Acked-by: Chanwoo Choi +Link: https://lore.kernel.org/r/27ee4a48ee775c3f8c9d90459c18b6f2b15edc76.1623146580.git.matti.vaittinen@fi.rohmeurope.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-max8997.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c +index 337b0eea4e62..5c4f7746cbee 100644 +--- a/drivers/extcon/extcon-max8997.c ++++ b/drivers/extcon/extcon-max8997.c +@@ -729,7 +729,7 @@ static int max8997_muic_probe(struct platform_device *pdev) + 2, info->status); + if (ret) { + dev_err(info->dev, "failed to read MUIC register\n"); +- return ret; ++ goto err_irq; + } + cable_type = max8997_muic_get_cable_type(info, + MAX8997_CABLE_GROUP_ADC, &attached); +-- +2.30.2 + diff --git a/queue-5.12/extcon-max8997-add-missing-modalias-string.patch b/queue-5.12/extcon-max8997-add-missing-modalias-string.patch new file mode 100644 index 00000000000..16423bd4de9 --- /dev/null +++ b/queue-5.12/extcon-max8997-add-missing-modalias-string.patch @@ -0,0 +1,33 @@ +From ab720b580320a4d7dbaf42e1c1d550870b5771b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 22:46:24 +0200 +Subject: extcon: max8997: Add missing modalias string + +From: Marek Szyprowski + +[ Upstream commit dc11fc2991e9efbceef93912b83e333d2835fb19 ] + +The platform device driver name is "max8997-muic", so advertise it +properly in the modalias string. This fixes automated module loading when +this driver is compiled as a module. + +Fixes: b76668ba8a77 ("Extcon: add MAX8997 extcon driver") +Signed-off-by: Marek Szyprowski +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-max8997.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/extcon/extcon-max8997.c b/drivers/extcon/extcon-max8997.c +index 5c4f7746cbee..64008808675e 100644 +--- a/drivers/extcon/extcon-max8997.c ++++ b/drivers/extcon/extcon-max8997.c +@@ -784,3 +784,4 @@ module_platform_driver(max8997_muic_driver); + MODULE_DESCRIPTION("Maxim MAX8997 Extcon driver"); + MODULE_AUTHOR("Donggeun Kim "); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS("platform:max8997-muic"); +-- +2.30.2 + diff --git a/queue-5.12/extcon-sm5502-drop-invalid-register-write-in-sm5502_.patch b/queue-5.12/extcon-sm5502-drop-invalid-register-write-in-sm5502_.patch new file mode 100644 index 00000000000..ffb2392b1e9 --- /dev/null +++ b/queue-5.12/extcon-sm5502-drop-invalid-register-write-in-sm5502_.patch @@ -0,0 +1,40 @@ +From d9e576cc3a57a09a917745a1d7689816a3c8bc42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 May 2021 15:34:35 +0200 +Subject: extcon: sm5502: Drop invalid register write in sm5502_reg_data + +From: Stephan Gerhold + +[ Upstream commit d25b224f8e5507879b36a769a6d1324cf163466c ] + +When sm5502_init_dev_type() iterates over sm5502_reg_data to +initialize the registers it is limited by ARRAY_SIZE(sm5502_reg_data). +There is no need to add another empty element to sm5502_reg_data. + +Having the additional empty element in sm5502_reg_data will just +result in writing 0xff to register 0x00, which does not really +make sense. + +Fixes: 914b881f9452 ("extcon: sm5502: Add support new SM5502 extcon device driver") +Signed-off-by: Stephan Gerhold +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-sm5502.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/extcon/extcon-sm5502.c b/drivers/extcon/extcon-sm5502.c +index 106d4da647bd..5e0718dee03b 100644 +--- a/drivers/extcon/extcon-sm5502.c ++++ b/drivers/extcon/extcon-sm5502.c +@@ -88,7 +88,6 @@ static struct reg_data sm5502_reg_data[] = { + | SM5502_REG_INTM2_MHL_MASK, + .invert = true, + }, +- { } + }; + + /* List of detectable cables */ +-- +2.30.2 + diff --git a/queue-5.12/firmware-stratix10-svc-fix-a-resource-leak-in-an-err.patch b/queue-5.12/firmware-stratix10-svc-fix-a-resource-leak-in-an-err.patch new file mode 100644 index 00000000000..2234f1256fa --- /dev/null +++ b/queue-5.12/firmware-stratix10-svc-fix-a-resource-leak-in-an-err.patch @@ -0,0 +1,73 @@ +From 027a565377c74f66b83b9696bd02a1dba666476f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 20:22:15 +0200 +Subject: firmware: stratix10-svc: Fix a resource leak in an error handling + path + +From: Christophe JAILLET + +[ Upstream commit d99247f9b542533ddbf87a3481a05473b8e48194 ] + +If an error occurs after a successful 'kfifo_alloc()' call, it must be +undone by a corresponding 'kfifo_free()' call, as already done in the +remove function. + +While at it, move the 'platform_device_put()' call to this new error +handling path and explicitly return 0 in the success path. + +Fixes: b5dc75c915cd ("firmware: stratix10-svc: extend svc to support new RSU features") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/0ca3f3ab139c53e846804455a1e7599ee8ae896a.1621621271.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/stratix10-svc.c | 22 +++++++++++++++------- + 1 file changed, 15 insertions(+), 7 deletions(-) + +diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c +index 3aa489dba30a..2a7687911c09 100644 +--- a/drivers/firmware/stratix10-svc.c ++++ b/drivers/firmware/stratix10-svc.c +@@ -1034,24 +1034,32 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) + + /* add svc client device(s) */ + svc = devm_kzalloc(dev, sizeof(*svc), GFP_KERNEL); +- if (!svc) +- return -ENOMEM; ++ if (!svc) { ++ ret = -ENOMEM; ++ goto err_free_kfifo; ++ } + + svc->stratix10_svc_rsu = platform_device_alloc(STRATIX10_RSU, 0); + if (!svc->stratix10_svc_rsu) { + dev_err(dev, "failed to allocate %s device\n", STRATIX10_RSU); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_free_kfifo; + } + + ret = platform_device_add(svc->stratix10_svc_rsu); +- if (ret) { +- platform_device_put(svc->stratix10_svc_rsu); +- return ret; +- } ++ if (ret) ++ goto err_put_device; ++ + dev_set_drvdata(dev, svc); + + pr_info("Intel Service Layer Driver Initialized\n"); + ++ return 0; ++ ++err_put_device: ++ platform_device_put(svc->stratix10_svc_rsu); ++err_free_kfifo: ++ kfifo_free(&controller->svc_fifo); + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.12/fs-dlm-cancel-work-sync-othercon.patch b/queue-5.12/fs-dlm-cancel-work-sync-othercon.patch new file mode 100644 index 00000000000..3e4df5f2122 --- /dev/null +++ b/queue-5.12/fs-dlm-cancel-work-sync-othercon.patch @@ -0,0 +1,38 @@ +From 2378d29295af8a4325d24b73f504252b6ccd4977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 15:08:38 -0400 +Subject: fs: dlm: cancel work sync othercon + +From: Alexander Aring + +[ Upstream commit c6aa00e3d20c2767ba3f57b64eb862572b9744b3 ] + +These rx tx flags arguments are for signaling close_connection() from +which worker they are called. Obviously the receive worker cannot cancel +itself and vice versa for swork. For the othercon the receive worker +should only be used, however to avoid deadlocks we should pass the same +flags as the original close_connection() was called. + +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lowcomms.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c +index 01b672cee783..7e6736c70e11 100644 +--- a/fs/dlm/lowcomms.c ++++ b/fs/dlm/lowcomms.c +@@ -714,7 +714,7 @@ static void close_connection(struct connection *con, bool and_other, + + if (con->othercon && and_other) { + /* Will only re-enter once. */ +- close_connection(con->othercon, false, true, true); ++ close_connection(con->othercon, false, tx, rx); + } + + con->rx_leftover = 0; +-- +2.30.2 + diff --git a/queue-5.12/fs-dlm-fix-lowcomms_start-error-case.patch b/queue-5.12/fs-dlm-fix-lowcomms_start-error-case.patch new file mode 100644 index 00000000000..60c8892c448 --- /dev/null +++ b/queue-5.12/fs-dlm-fix-lowcomms_start-error-case.patch @@ -0,0 +1,72 @@ +From 6b149ce486dee1fac31516893357324ad986a18a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 09:45:15 -0400 +Subject: fs: dlm: fix lowcomms_start error case + +From: Alexander Aring + +[ Upstream commit fcef0e6c27ce109d2c617aa12f0bfd9f7ff47d38 ] + +This patch fixes the error path handling in lowcomms_start(). We need to +cleanup some static allocated data structure and cleanup possible +workqueue if these have started. + +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lowcomms.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c +index 7e6736c70e11..d2a0ea0acca3 100644 +--- a/fs/dlm/lowcomms.c ++++ b/fs/dlm/lowcomms.c +@@ -1600,10 +1600,15 @@ static void process_send_sockets(struct work_struct *work) + + static void work_stop(void) + { +- if (recv_workqueue) ++ if (recv_workqueue) { + destroy_workqueue(recv_workqueue); +- if (send_workqueue) ++ recv_workqueue = NULL; ++ } ++ ++ if (send_workqueue) { + destroy_workqueue(send_workqueue); ++ send_workqueue = NULL; ++ } + } + + static int work_start(void) +@@ -1620,6 +1625,7 @@ static int work_start(void) + if (!send_workqueue) { + log_print("can't start dlm_send"); + destroy_workqueue(recv_workqueue); ++ recv_workqueue = NULL; + return -ENOMEM; + } + +@@ -1751,7 +1757,7 @@ int dlm_lowcomms_start(void) + + error = work_start(); + if (error) +- goto fail; ++ goto fail_local; + + dlm_allow_conn = 1; + +@@ -1768,6 +1774,9 @@ int dlm_lowcomms_start(void) + fail_unlisten: + dlm_allow_conn = 0; + dlm_close_sock(&listen_con.sock); ++ work_stop(); ++fail_local: ++ deinit_local(); + fail: + return error; + } +-- +2.30.2 + diff --git a/queue-5.12/fs-dlm-fix-memory-leak-when-fenced.patch b/queue-5.12/fs-dlm-fix-memory-leak-when-fenced.patch new file mode 100644 index 00000000000..bcbc46e0c42 --- /dev/null +++ b/queue-5.12/fs-dlm-fix-memory-leak-when-fenced.patch @@ -0,0 +1,85 @@ +From 95fbe2338c524f39f8ceb14263a9ed7b6dae3f73 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 09:45:16 -0400 +Subject: fs: dlm: fix memory leak when fenced + +From: Alexander Aring + +[ Upstream commit 700ab1c363c7b54c9ea3222379b33fc00ab02f7b ] + +I got some kmemleak report when a node was fenced. The user space tool +dlm_controld will therefore run some rmdir() in dlm configfs which was +triggering some memleaks. This patch stores the sps and cms attributes +which stores some handling for subdirectories of the configfs cluster +entry and free them if they get released as the parent directory gets +freed. + +unreferenced object 0xffff88810d9e3e00 (size 192): + comm "dlm_controld", pid 342, jiffies 4294698126 (age 55438.801s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 73 70 61 63 65 73 00 00 ........spaces.. + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000db8b640b>] make_cluster+0x5d/0x360 + [<000000006a571db4>] configfs_mkdir+0x274/0x730 + [<00000000b094501c>] vfs_mkdir+0x27e/0x340 + [<0000000058b0adaf>] do_mkdirat+0xff/0x1b0 + [<00000000d1ffd156>] do_syscall_64+0x40/0x80 + [<00000000ab1408c8>] entry_SYSCALL_64_after_hwframe+0x44/0xae +unreferenced object 0xffff88810d9e3a00 (size 192): + comm "dlm_controld", pid 342, jiffies 4294698126 (age 55438.801s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 63 6f 6d 6d 73 00 00 00 ........comms... + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000a7ef6ad2>] make_cluster+0x82/0x360 + [<000000006a571db4>] configfs_mkdir+0x274/0x730 + [<00000000b094501c>] vfs_mkdir+0x27e/0x340 + [<0000000058b0adaf>] do_mkdirat+0xff/0x1b0 + [<00000000d1ffd156>] do_syscall_64+0x40/0x80 + [<00000000ab1408c8>] entry_SYSCALL_64_after_hwframe+0x44/0xae + +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/config.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/dlm/config.c b/fs/dlm/config.c +index 88d95d96e36c..52bcda64172a 100644 +--- a/fs/dlm/config.c ++++ b/fs/dlm/config.c +@@ -79,6 +79,9 @@ struct dlm_cluster { + unsigned int cl_new_rsb_count; + unsigned int cl_recover_callbacks; + char cl_cluster_name[DLM_LOCKSPACE_LEN]; ++ ++ struct dlm_spaces *sps; ++ struct dlm_comms *cms; + }; + + static struct dlm_cluster *config_item_to_cluster(struct config_item *i) +@@ -409,6 +412,9 @@ static struct config_group *make_cluster(struct config_group *g, + if (!cl || !sps || !cms) + goto fail; + ++ cl->sps = sps; ++ cl->cms = cms; ++ + config_group_init_type_name(&cl->group, name, &cluster_type); + config_group_init_type_name(&sps->ss_group, "spaces", &spaces_type); + config_group_init_type_name(&cms->cs_group, "comms", &comms_type); +@@ -458,6 +464,9 @@ static void drop_cluster(struct config_group *g, struct config_item *i) + static void release_cluster(struct config_item *i) + { + struct dlm_cluster *cl = config_item_to_cluster(i); ++ ++ kfree(cl->sps); ++ kfree(cl->cms); + kfree(cl); + } + +-- +2.30.2 + diff --git a/queue-5.12/fs-dlm-reconnect-if-socket-error-report-occurs.patch b/queue-5.12/fs-dlm-reconnect-if-socket-error-report-occurs.patch new file mode 100644 index 00000000000..d768584cfb7 --- /dev/null +++ b/queue-5.12/fs-dlm-reconnect-if-socket-error-report-occurs.patch @@ -0,0 +1,153 @@ +From 9ba9ae5671af126823e71740ea53b369c6a84072 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 15:08:37 -0400 +Subject: fs: dlm: reconnect if socket error report occurs + +From: Alexander Aring + +[ Upstream commit ba868d9deaab2bb1c09e50650127823925154802 ] + +This patch will change the reconnect handling that if an error occurs +if a socket error callback is occurred. This will also handle reconnects +in a non blocking connecting case which is currently missing. If error +ECONNREFUSED is reported we delay the reconnect by one second. + +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/lowcomms.c | 60 ++++++++++++++++++++++++++++++----------------- + 1 file changed, 39 insertions(+), 21 deletions(-) + +diff --git a/fs/dlm/lowcomms.c b/fs/dlm/lowcomms.c +index 45c2fdaf34c4..01b672cee783 100644 +--- a/fs/dlm/lowcomms.c ++++ b/fs/dlm/lowcomms.c +@@ -79,6 +79,8 @@ struct connection { + #define CF_CLOSING 8 + #define CF_SHUTDOWN 9 + #define CF_CONNECTED 10 ++#define CF_RECONNECT 11 ++#define CF_DELAY_CONNECT 12 + struct list_head writequeue; /* List of outgoing writequeue_entries */ + spinlock_t writequeue_lock; + void (*connect_action) (struct connection *); /* What to do to connect */ +@@ -87,6 +89,7 @@ struct connection { + #define MAX_CONNECT_RETRIES 3 + struct hlist_node list; + struct connection *othercon; ++ struct connection *sendcon; + struct work_struct rwork; /* Receive workqueue */ + struct work_struct swork; /* Send workqueue */ + wait_queue_head_t shutdown_wait; /* wait for graceful shutdown */ +@@ -584,6 +587,22 @@ static void lowcomms_error_report(struct sock *sk) + dlm_config.ci_tcp_port, sk->sk_err, + sk->sk_err_soft); + } ++ ++ /* below sendcon only handling */ ++ if (test_bit(CF_IS_OTHERCON, &con->flags)) ++ con = con->sendcon; ++ ++ switch (sk->sk_err) { ++ case ECONNREFUSED: ++ set_bit(CF_DELAY_CONNECT, &con->flags); ++ break; ++ default: ++ break; ++ } ++ ++ if (!test_and_set_bit(CF_RECONNECT, &con->flags)) ++ queue_work(send_workqueue, &con->swork); ++ + out: + read_unlock_bh(&sk->sk_callback_lock); + if (orig_report) +@@ -701,6 +720,8 @@ static void close_connection(struct connection *con, bool and_other, + con->rx_leftover = 0; + con->retries = 0; + clear_bit(CF_CONNECTED, &con->flags); ++ clear_bit(CF_DELAY_CONNECT, &con->flags); ++ clear_bit(CF_RECONNECT, &con->flags); + mutex_unlock(&con->sock_mutex); + clear_bit(CF_CLOSING, &con->flags); + } +@@ -839,18 +860,15 @@ out_resched: + + out_close: + mutex_unlock(&con->sock_mutex); +- if (ret != -EAGAIN) { +- /* Reconnect when there is something to send */ ++ if (ret == 0) { + close_connection(con, false, true, false); +- if (ret == 0) { +- log_print("connection %p got EOF from %d", +- con, con->nodeid); +- /* handling for tcp shutdown */ +- clear_bit(CF_SHUTDOWN, &con->flags); +- wake_up(&con->shutdown_wait); +- /* signal to breaking receive worker */ +- ret = -1; +- } ++ log_print("connection %p got EOF from %d", ++ con, con->nodeid); ++ /* handling for tcp shutdown */ ++ clear_bit(CF_SHUTDOWN, &con->flags); ++ wake_up(&con->shutdown_wait); ++ /* signal to breaking receive worker */ ++ ret = -1; + } + return ret; + } +@@ -933,6 +951,7 @@ static int accept_from_sock(struct listen_connection *con) + } + + newcon->othercon = othercon; ++ othercon->sendcon = newcon; + } else { + /* close other sock con if we have something new */ + close_connection(othercon, false, true, false); +@@ -1478,7 +1497,7 @@ static void send_to_sock(struct connection *con) + cond_resched(); + goto out; + } else if (ret < 0) +- goto send_error; ++ goto out; + } + + /* Don't starve people filling buffers */ +@@ -1495,14 +1514,6 @@ out: + mutex_unlock(&con->sock_mutex); + return; + +-send_error: +- mutex_unlock(&con->sock_mutex); +- close_connection(con, false, false, true); +- /* Requeue the send work. When the work daemon runs again, it will try +- a new connection, then call this function again. */ +- queue_work(send_workqueue, &con->swork); +- return; +- + out_connect: + mutex_unlock(&con->sock_mutex); + queue_work(send_workqueue, &con->swork); +@@ -1574,8 +1585,15 @@ static void process_send_sockets(struct work_struct *work) + struct connection *con = container_of(work, struct connection, swork); + + clear_bit(CF_WRITE_PENDING, &con->flags); +- if (con->sock == NULL) /* not mutex protected so check it inside too */ ++ ++ if (test_and_clear_bit(CF_RECONNECT, &con->flags)) ++ close_connection(con, false, false, true); ++ ++ if (con->sock == NULL) { /* not mutex protected so check it inside too */ ++ if (test_and_clear_bit(CF_DELAY_CONNECT, &con->flags)) ++ msleep(1000); + con->connect_action(con); ++ } + if (!list_empty(&con->writequeue)) + send_to_sock(con); + } +-- +2.30.2 + diff --git a/queue-5.12/fsi-core-fix-return-of-error-values-on-failures.patch b/queue-5.12/fsi-core-fix-return-of-error-values-on-failures.patch new file mode 100644 index 00000000000..d8f2aa5bf6c --- /dev/null +++ b/queue-5.12/fsi-core-fix-return-of-error-values-on-failures.patch @@ -0,0 +1,50 @@ +From 20a062e80c6d8fe12f7e2a641b9b58ffee4024f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 13:28:12 +0100 +Subject: fsi: core: Fix return of error values on failures + +From: Colin Ian King + +[ Upstream commit 910810945707fe9877ca86a0dca4e585fd05e37b ] + +Currently the cfam_read and cfam_write functions return the provided +number of bytes given in the count parameter and not the error return +code in variable rc, hence all failures of read/writes are being +silently ignored. Fix this by returning the error code in rc. + +Addresses-Coverity: ("Unused value") +Fixes: d1dcd6782576 ("fsi: Add cfam char devices") +Signed-off-by: Colin Ian King +Reviewed-by: Jeremy Kerr +Link: https://lore.kernel.org/r/20210603122812.83587-1-colin.king@canonical.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + drivers/fsi/fsi-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/fsi/fsi-core.c b/drivers/fsi/fsi-core.c +index 4e60e84cd17a..59ddc9fd5bca 100644 +--- a/drivers/fsi/fsi-core.c ++++ b/drivers/fsi/fsi-core.c +@@ -724,7 +724,7 @@ static ssize_t cfam_read(struct file *filep, char __user *buf, size_t count, + rc = count; + fail: + *offset = off; +- return count; ++ return rc; + } + + static ssize_t cfam_write(struct file *filep, const char __user *buf, +@@ -761,7 +761,7 @@ static ssize_t cfam_write(struct file *filep, const char __user *buf, + rc = count; + fail: + *offset = off; +- return count; ++ return rc; + } + + static loff_t cfam_llseek(struct file *file, loff_t offset, int whence) +-- +2.30.2 + diff --git a/queue-5.12/fsi-occ-don-t-accept-response-from-un-initialized-oc.patch b/queue-5.12/fsi-occ-don-t-accept-response-from-un-initialized-oc.patch new file mode 100644 index 00000000000..9d65ca84c1e --- /dev/null +++ b/queue-5.12/fsi-occ-don-t-accept-response-from-un-initialized-oc.patch @@ -0,0 +1,38 @@ +From 4cb62302108df1cde996a661d35aaa70b2557a9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Feb 2021 11:12:32 -0600 +Subject: fsi: occ: Don't accept response from un-initialized OCC + +From: Eddie James + +[ Upstream commit 8a4659be08576141f47d47d94130eb148cb5f0df ] + +If the OCC is not initialized and responds as such, the driver +should continue waiting for a valid response until the timeout +expires. + +Signed-off-by: Eddie James +Reviewed-by: Joel Stanley +Fixes: 7ed98dddb764 ("fsi: Add On-Chip Controller (OCC) driver") +Link: https://lore.kernel.org/r/20210209171235.20624-2-eajames@linux.ibm.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + drivers/fsi/fsi-occ.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/fsi/fsi-occ.c b/drivers/fsi/fsi-occ.c +index 10ca2e290655..cb05b6dacc9d 100644 +--- a/drivers/fsi/fsi-occ.c ++++ b/drivers/fsi/fsi-occ.c +@@ -495,6 +495,7 @@ int fsi_occ_submit(struct device *dev, const void *request, size_t req_len, + goto done; + + if (resp->return_status == OCC_RESP_CMD_IN_PRG || ++ resp->return_status == OCC_RESP_CRIT_INIT || + resp->seq_no != seq_no) { + rc = -ETIMEDOUT; + +-- +2.30.2 + diff --git a/queue-5.12/fsi-sbefifo-clean-up-correct-fifo-when-receiving-res.patch b/queue-5.12/fsi-sbefifo-clean-up-correct-fifo-when-receiving-res.patch new file mode 100644 index 00000000000..9036c5fe404 --- /dev/null +++ b/queue-5.12/fsi-sbefifo-clean-up-correct-fifo-when-receiving-res.patch @@ -0,0 +1,39 @@ +From 46937f3dcefec3f9d1eaba105448c3a2fdbdd489 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jul 2020 16:45:17 +0930 +Subject: fsi/sbefifo: Clean up correct FIFO when receiving reset request from + SBE + +From: Joachim Fenkes + +[ Upstream commit 95152433e46fdb36652ebdbea442356a16ae1fa6 ] + +When the SBE requests a reset via the down FIFO, that is also the +FIFO we should go and reset ;) + +Fixes: 9f4a8a2d7f9d ("fsi/sbefifo: Add driver for the SBE FIFO") +Signed-off-by: Joachim Fenkes +Signed-off-by: Joel Stanley +Link: https://lore.kernel.org/r/20200724071518.430515-2-joel@jms.id.au +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + drivers/fsi/fsi-sbefifo.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c +index bfd5e5da8020..de27c435d706 100644 +--- a/drivers/fsi/fsi-sbefifo.c ++++ b/drivers/fsi/fsi-sbefifo.c +@@ -400,7 +400,7 @@ static int sbefifo_cleanup_hw(struct sbefifo *sbefifo) + /* The FIFO already contains a reset request from the SBE ? */ + if (down_status & SBEFIFO_STS_RESET_REQ) { + dev_info(dev, "Cleanup: FIFO reset request set, resetting\n"); +- rc = sbefifo_regw(sbefifo, SBEFIFO_UP, SBEFIFO_PERFORM_RESET); ++ rc = sbefifo_regw(sbefifo, SBEFIFO_DOWN, SBEFIFO_PERFORM_RESET); + if (rc) { + sbefifo->broken = true; + dev_err(dev, "Cleanup: Reset reg write failed, rc=%d\n", rc); +-- +2.30.2 + diff --git a/queue-5.12/fsi-sbefifo-fix-reset-timeout.patch b/queue-5.12/fsi-sbefifo-fix-reset-timeout.patch new file mode 100644 index 00000000000..711c0bba353 --- /dev/null +++ b/queue-5.12/fsi-sbefifo-fix-reset-timeout.patch @@ -0,0 +1,60 @@ +From 8d44b1b4973db5744b9629e824b19f42dbb73a3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jul 2020 16:45:18 +0930 +Subject: fsi/sbefifo: Fix reset timeout + +From: Joachim Fenkes + +[ Upstream commit 9ab1428dfe2c66b51e0b41337cd0164da0ab6080 ] + +On BMCs with lower timer resolution than 1ms, msleep(1) will take +way longer than 1ms, so looping 10k times won't wait for 10s but +significantly longer. + +Fix this by using jiffies like the rest of the code. + +Fixes: 9f4a8a2d7f9d ("fsi/sbefifo: Add driver for the SBE FIFO") +Signed-off-by: Joachim Fenkes +Link: https://lore.kernel.org/r/20200724071518.430515-3-joel@jms.id.au +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + drivers/fsi/fsi-sbefifo.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/fsi/fsi-sbefifo.c b/drivers/fsi/fsi-sbefifo.c +index de27c435d706..84cb965bfed5 100644 +--- a/drivers/fsi/fsi-sbefifo.c ++++ b/drivers/fsi/fsi-sbefifo.c +@@ -325,7 +325,8 @@ static int sbefifo_up_write(struct sbefifo *sbefifo, __be32 word) + static int sbefifo_request_reset(struct sbefifo *sbefifo) + { + struct device *dev = &sbefifo->fsi_dev->dev; +- u32 status, timeout; ++ unsigned long end_time; ++ u32 status; + int rc; + + dev_dbg(dev, "Requesting FIFO reset\n"); +@@ -341,7 +342,8 @@ static int sbefifo_request_reset(struct sbefifo *sbefifo) + } + + /* Wait for it to complete */ +- for (timeout = 0; timeout < SBEFIFO_RESET_TIMEOUT; timeout++) { ++ end_time = jiffies + msecs_to_jiffies(SBEFIFO_RESET_TIMEOUT); ++ while (!time_after(jiffies, end_time)) { + rc = sbefifo_regr(sbefifo, SBEFIFO_UP | SBEFIFO_STS, &status); + if (rc) { + dev_err(dev, "Failed to read UP fifo status during reset" +@@ -355,7 +357,7 @@ static int sbefifo_request_reset(struct sbefifo *sbefifo) + return 0; + } + +- msleep(1); ++ cond_resched(); + } + dev_err(dev, "FIFO reset timed out\n"); + +-- +2.30.2 + diff --git a/queue-5.12/fsi-scom-reset-the-fsi2pib-engine-for-any-error.patch b/queue-5.12/fsi-scom-reset-the-fsi2pib-engine-for-any-error.patch new file mode 100644 index 00000000000..9b279afe55f --- /dev/null +++ b/queue-5.12/fsi-scom-reset-the-fsi2pib-engine-for-any-error.patch @@ -0,0 +1,63 @@ +From 02767ae682e58919fccedb721a0d742758438d20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 10:13:44 -0500 +Subject: fsi: scom: Reset the FSI2PIB engine for any error + +From: Eddie James + +[ Upstream commit a5c317dac5567206ca7b6bc9d008dd6890c8bced ] + +The error bits in the FSI2PIB status are only cleared by a reset. So +the driver needs to perform a reset after seeing any of the FSI2PIB +errors, otherwise subsequent operations will also look like failures. + +Fixes: 6b293258cded ("fsi: scom: Major overhaul") +Signed-off-by: Eddie James +Reviewed-by: Joel Stanley +Link: https://lore.kernel.org/r/20210329151344.14246-1-eajames@linux.ibm.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + drivers/fsi/fsi-scom.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/fsi/fsi-scom.c b/drivers/fsi/fsi-scom.c +index b45bfab7b7f5..75d1389e2626 100644 +--- a/drivers/fsi/fsi-scom.c ++++ b/drivers/fsi/fsi-scom.c +@@ -38,9 +38,10 @@ + #define SCOM_STATUS_PIB_RESP_MASK 0x00007000 + #define SCOM_STATUS_PIB_RESP_SHIFT 12 + +-#define SCOM_STATUS_ANY_ERR (SCOM_STATUS_PROTECTION | \ +- SCOM_STATUS_PARITY | \ +- SCOM_STATUS_PIB_ABORT | \ ++#define SCOM_STATUS_FSI2PIB_ERROR (SCOM_STATUS_PROTECTION | \ ++ SCOM_STATUS_PARITY | \ ++ SCOM_STATUS_PIB_ABORT) ++#define SCOM_STATUS_ANY_ERR (SCOM_STATUS_FSI2PIB_ERROR | \ + SCOM_STATUS_PIB_RESP_MASK) + /* SCOM address encodings */ + #define XSCOM_ADDR_IND_FLAG BIT_ULL(63) +@@ -240,13 +241,14 @@ static int handle_fsi2pib_status(struct scom_device *scom, uint32_t status) + { + uint32_t dummy = -1; + +- if (status & SCOM_STATUS_PROTECTION) +- return -EPERM; +- if (status & SCOM_STATUS_PARITY) { ++ if (status & SCOM_STATUS_FSI2PIB_ERROR) + fsi_device_write(scom->fsi_dev, SCOM_FSI2PIB_RESET_REG, &dummy, + sizeof(uint32_t)); ++ ++ if (status & SCOM_STATUS_PROTECTION) ++ return -EPERM; ++ if (status & SCOM_STATUS_PARITY) + return -EIO; +- } + /* Return -EBUSY on PIB abort to force a retry */ + if (status & SCOM_STATUS_PIB_ABORT) + return -EBUSY; +-- +2.30.2 + diff --git a/queue-5.12/gve-fix-swapped-vars-when-fetching-max-queues.patch b/queue-5.12/gve-fix-swapped-vars-when-fetching-max-queues.patch new file mode 100644 index 00000000000..b9dd72b9e56 --- /dev/null +++ b/queue-5.12/gve-fix-swapped-vars-when-fetching-max-queues.patch @@ -0,0 +1,35 @@ +From 9dd31e163d230d57c5aa576d2bbc13dad2b5a00d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 19:55:41 -0700 +Subject: gve: Fix swapped vars when fetching max queues + +From: Bailey Forrest + +[ Upstream commit 1db1a862a08f85edc36aad091236ac9b818e949e ] + +Fixes: 893ce44df565 ("gve: Add basic driver framework for Compute Engine Virtual NIC") +Signed-off-by: Bailey Forrest +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/google/gve/gve_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/google/gve/gve_main.c b/drivers/net/ethernet/google/gve/gve_main.c +index bbc423e93122..79cefe85a799 100644 +--- a/drivers/net/ethernet/google/gve/gve_main.c ++++ b/drivers/net/ethernet/google/gve/gve_main.c +@@ -1295,8 +1295,8 @@ static int gve_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + gve_write_version(®_bar->driver_version); + /* Get max queues to alloc etherdev */ +- max_rx_queues = ioread32be(®_bar->max_tx_queues); +- max_tx_queues = ioread32be(®_bar->max_rx_queues); ++ max_tx_queues = ioread32be(®_bar->max_tx_queues); ++ max_rx_queues = ioread32be(®_bar->max_rx_queues); + /* Alloc and setup the netdev and priv */ + dev = alloc_etherdev_mqs(sizeof(*priv), max_tx_queues, max_rx_queues); + if (!dev) { +-- +2.30.2 + diff --git a/queue-5.12/habanalabs-fix-an-error-handling-path-in-hl_pci_prob.patch b/queue-5.12/habanalabs-fix-an-error-handling-path-in-hl_pci_prob.patch new file mode 100644 index 00000000000..1dd3b1f5360 --- /dev/null +++ b/queue-5.12/habanalabs-fix-an-error-handling-path-in-hl_pci_prob.patch @@ -0,0 +1,37 @@ +From de038c1d443defd375a59994952cd45df0a1cf7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Jun 2021 07:39:51 +0200 +Subject: habanalabs: Fix an error handling path in 'hl_pci_probe()' + +From: Christophe JAILLET + +[ Upstream commit 3002f467a0b0a70aec01d9f446da4ac8c6fda10b ] + +If an error occurs after a 'pci_enable_pcie_error_reporting()' call, it +must be undone by a corresponding 'pci_disable_pcie_error_reporting()' +call, as already done in the remove function. + +Fixes: 2e5eda4681f9 ("habanalabs: PCIe Advanced Error Reporting support") +Signed-off-by: Christophe JAILLET +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/common/habanalabs_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/misc/habanalabs/common/habanalabs_drv.c b/drivers/misc/habanalabs/common/habanalabs_drv.c +index 032d114f01ea..827140626244 100644 +--- a/drivers/misc/habanalabs/common/habanalabs_drv.c ++++ b/drivers/misc/habanalabs/common/habanalabs_drv.c +@@ -437,6 +437,7 @@ static int hl_pci_probe(struct pci_dev *pdev, + return 0; + + disable_device: ++ pci_disable_pcie_error_reporting(pdev); + pci_set_drvdata(pdev, NULL); + destroy_hdev(hdev); + +-- +2.30.2 + diff --git a/queue-5.12/hid-do-not-use-down_interruptible-when-unbinding-dev.patch b/queue-5.12/hid-do-not-use-down_interruptible-when-unbinding-dev.patch new file mode 100644 index 00000000000..1ce9c549021 --- /dev/null +++ b/queue-5.12/hid-do-not-use-down_interruptible-when-unbinding-dev.patch @@ -0,0 +1,53 @@ +From e6cfba125bf2c6e364ef51c8b2ad374eec50fdf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Mar 2021 17:27:16 -0700 +Subject: HID: do not use down_interruptible() when unbinding devices + +From: Dmitry Torokhov + +[ Upstream commit f2145f8dc566c4f3b5a8deb58dcd12bed4e20194 ] + +Action of unbinding driver from a device is not cancellable and should not +fail, and driver core does not pay attention to the result of "remove" +method, therefore using down_interruptible() in hid_device_remove() does +not make sense. + +Signed-off-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-core.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 0f69f35f2957..5550c943f985 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -2306,12 +2306,8 @@ static int hid_device_remove(struct device *dev) + { + struct hid_device *hdev = to_hid_device(dev); + struct hid_driver *hdrv; +- int ret = 0; + +- if (down_interruptible(&hdev->driver_input_lock)) { +- ret = -EINTR; +- goto end; +- } ++ down(&hdev->driver_input_lock); + hdev->io_started = false; + + hdrv = hdev->driver; +@@ -2326,8 +2322,8 @@ static int hid_device_remove(struct device *dev) + + if (!hdev->io_started) + up(&hdev->driver_input_lock); +-end: +- return ret; ++ ++ return 0; + } + + static ssize_t modalias_show(struct device *dev, struct device_attribute *a, +-- +2.30.2 + diff --git a/queue-5.12/hid-hid-input-add-surface-go-battery-quirk.patch b/queue-5.12/hid-hid-input-add-surface-go-battery-quirk.patch new file mode 100644 index 00000000000..05300d7471b --- /dev/null +++ b/queue-5.12/hid-hid-input-add-surface-go-battery-quirk.patch @@ -0,0 +1,52 @@ +From e33ac7d60cebc3aa91a41031257238e7362e5b04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 20:58:14 +0200 +Subject: HID: hid-input: add Surface Go battery quirk + +From: Zoltan Tamas Vajda + +[ Upstream commit b5539722eb832441f309642fe5102cc3536f92b8 ] + +The Elantech touchscreen/digitizer in the Surface Go mistakenly reports +having a battery. This results in a low battery message every time you +try to use the pen. + +This patch adds a quirk to ignore the non-existent battery and +gets rid of the false low battery messages. + +Signed-off-by: Zoltan Tamas Vajda +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-input.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 03978111d944..06168f485722 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -397,6 +397,7 @@ + #define USB_DEVICE_ID_HP_X2_10_COVER 0x0755 + #define I2C_DEVICE_ID_HP_SPECTRE_X360_15 0x2817 + #define USB_DEVICE_ID_ASUS_UX550_TOUCHSCREEN 0x2706 ++#define I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN 0x261A + + #define USB_VENDOR_ID_ELECOM 0x056e + #define USB_DEVICE_ID_ELECOM_BM084 0x0061 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index e982d8173c9c..bf5e728258c1 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -326,6 +326,8 @@ static const struct hid_device_id hid_battery_quirks[] = { + HID_BATTERY_QUIRK_IGNORE }, + { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_HP_SPECTRE_X360_15), + HID_BATTERY_QUIRK_IGNORE }, ++ { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, I2C_DEVICE_ID_SURFACE_GO_TOUCHSCREEN), ++ HID_BATTERY_QUIRK_IGNORE }, + {} + }; + +-- +2.30.2 + diff --git a/queue-5.12/hid-sony-fix-freeze-when-inserting-ghlive-ps3-wii-do.patch b/queue-5.12/hid-sony-fix-freeze-when-inserting-ghlive-ps3-wii-do.patch new file mode 100644 index 00000000000..d0564f86fdb --- /dev/null +++ b/queue-5.12/hid-sony-fix-freeze-when-inserting-ghlive-ps3-wii-do.patch @@ -0,0 +1,196 @@ +From aeab33a5dce0dc57e4442767d19067113b9209ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 12:10:23 -0400 +Subject: HID: sony: fix freeze when inserting ghlive ps3/wii dongles + +From: Pascal Giard + +[ Upstream commit fb1a79a6b6e1223ddb18f12aa35e36f832da2290 ] + +This commit fixes a freeze on insertion of a Guitar Hero Live PS3/WiiU +USB dongle. Indeed, with the current implementation, inserting one of +those USB dongles will lead to a hard freeze. I apologize for not +catching this earlier, it didn't occur on my old laptop. + +While the issue was isolated to memory alloc/free, I could not figure +out why it causes a freeze. So this patch fixes this issue by +simplifying memory allocation and usage. + +We remind that for the dongle to work properly, a control URB needs to +be sent periodically. We used to alloc/free the URB each time this URB +needed to be sent. + +With this patch, the memory for the URB is allocated on the probe, reused +for as long as the dongle is plugged in, and freed once the dongle is +unplugged. + +Signed-off-by: Pascal Giard +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-sony.c | 98 +++++++++++++++++++++--------------------- + 1 file changed, 49 insertions(+), 49 deletions(-) + +diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c +index 8319b0ce385a..b3722c51ec78 100644 +--- a/drivers/hid/hid-sony.c ++++ b/drivers/hid/hid-sony.c +@@ -597,9 +597,8 @@ struct sony_sc { + /* DS4 calibration data */ + struct ds4_calibration_data ds4_calib_data[6]; + /* GH Live */ ++ struct urb *ghl_urb; + struct timer_list ghl_poke_timer; +- struct usb_ctrlrequest *ghl_cr; +- u8 *ghl_databuf; + }; + + static void sony_set_leds(struct sony_sc *sc); +@@ -625,66 +624,54 @@ static inline void sony_schedule_work(struct sony_sc *sc, + + static void ghl_magic_poke_cb(struct urb *urb) + { +- if (urb) { +- /* Free sc->ghl_cr and sc->ghl_databuf allocated in +- * ghl_magic_poke() +- */ +- kfree(urb->setup_packet); +- kfree(urb->transfer_buffer); +- } ++ struct sony_sc *sc = urb->context; ++ ++ if (urb->status < 0) ++ hid_err(sc->hdev, "URB transfer failed : %d", urb->status); ++ ++ mod_timer(&sc->ghl_poke_timer, jiffies + GHL_GUITAR_POKE_INTERVAL*HZ); + } + + static void ghl_magic_poke(struct timer_list *t) + { ++ int ret; + struct sony_sc *sc = from_timer(sc, t, ghl_poke_timer); + +- int ret; ++ ret = usb_submit_urb(sc->ghl_urb, GFP_ATOMIC); ++ if (ret < 0) ++ hid_err(sc->hdev, "usb_submit_urb failed: %d", ret); ++} ++ ++static int ghl_init_urb(struct sony_sc *sc, struct usb_device *usbdev) ++{ ++ struct usb_ctrlrequest *cr; ++ u16 poke_size; ++ u8 *databuf; + unsigned int pipe; +- struct urb *urb; +- struct usb_device *usbdev = to_usb_device(sc->hdev->dev.parent->parent); +- const u16 poke_size = +- ARRAY_SIZE(ghl_ps3wiiu_magic_data); + ++ poke_size = ARRAY_SIZE(ghl_ps3wiiu_magic_data); + pipe = usb_sndctrlpipe(usbdev, 0); + +- if (!sc->ghl_cr) { +- sc->ghl_cr = kzalloc(sizeof(*sc->ghl_cr), GFP_ATOMIC); +- if (!sc->ghl_cr) +- goto resched; +- } +- +- if (!sc->ghl_databuf) { +- sc->ghl_databuf = kzalloc(poke_size, GFP_ATOMIC); +- if (!sc->ghl_databuf) +- goto resched; +- } ++ cr = devm_kzalloc(&sc->hdev->dev, sizeof(*cr), GFP_ATOMIC); ++ if (cr == NULL) ++ return -ENOMEM; + +- urb = usb_alloc_urb(0, GFP_ATOMIC); +- if (!urb) +- goto resched; ++ databuf = devm_kzalloc(&sc->hdev->dev, poke_size, GFP_ATOMIC); ++ if (databuf == NULL) ++ return -ENOMEM; + +- sc->ghl_cr->bRequestType = ++ cr->bRequestType = + USB_RECIP_INTERFACE | USB_TYPE_CLASS | USB_DIR_OUT; +- sc->ghl_cr->bRequest = USB_REQ_SET_CONFIGURATION; +- sc->ghl_cr->wValue = cpu_to_le16(ghl_ps3wiiu_magic_value); +- sc->ghl_cr->wIndex = 0; +- sc->ghl_cr->wLength = cpu_to_le16(poke_size); +- memcpy(sc->ghl_databuf, ghl_ps3wiiu_magic_data, poke_size); +- ++ cr->bRequest = USB_REQ_SET_CONFIGURATION; ++ cr->wValue = cpu_to_le16(ghl_ps3wiiu_magic_value); ++ cr->wIndex = 0; ++ cr->wLength = cpu_to_le16(poke_size); ++ memcpy(databuf, ghl_ps3wiiu_magic_data, poke_size); + usb_fill_control_urb( +- urb, usbdev, pipe, +- (unsigned char *) sc->ghl_cr, sc->ghl_databuf, +- poke_size, ghl_magic_poke_cb, NULL); +- ret = usb_submit_urb(urb, GFP_ATOMIC); +- if (ret < 0) { +- kfree(sc->ghl_databuf); +- kfree(sc->ghl_cr); +- } +- usb_free_urb(urb); +- +-resched: +- /* Reschedule for next time */ +- mod_timer(&sc->ghl_poke_timer, jiffies + GHL_GUITAR_POKE_INTERVAL*HZ); ++ sc->ghl_urb, usbdev, pipe, ++ (unsigned char *) cr, databuf, poke_size, ++ ghl_magic_poke_cb, sc); ++ return 0; + } + + static int guitar_mapping(struct hid_device *hdev, struct hid_input *hi, +@@ -2981,6 +2968,7 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id) + int ret; + unsigned long quirks = id->driver_data; + struct sony_sc *sc; ++ struct usb_device *usbdev; + unsigned int connect_mask = HID_CONNECT_DEFAULT; + + if (!strcmp(hdev->name, "FutureMax Dance Mat")) +@@ -3000,6 +2988,7 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id) + sc->quirks = quirks; + hid_set_drvdata(hdev, sc); + sc->hdev = hdev; ++ usbdev = to_usb_device(sc->hdev->dev.parent->parent); + + ret = hid_parse(hdev); + if (ret) { +@@ -3042,6 +3031,15 @@ static int sony_probe(struct hid_device *hdev, const struct hid_device_id *id) + } + + if (sc->quirks & GHL_GUITAR_PS3WIIU) { ++ sc->ghl_urb = usb_alloc_urb(0, GFP_ATOMIC); ++ if (!sc->ghl_urb) ++ return -ENOMEM; ++ ret = ghl_init_urb(sc, usbdev); ++ if (ret) { ++ hid_err(hdev, "error preparing URB\n"); ++ return ret; ++ } ++ + timer_setup(&sc->ghl_poke_timer, ghl_magic_poke, 0); + mod_timer(&sc->ghl_poke_timer, + jiffies + GHL_GUITAR_POKE_INTERVAL*HZ); +@@ -3054,8 +3052,10 @@ static void sony_remove(struct hid_device *hdev) + { + struct sony_sc *sc = hid_get_drvdata(hdev); + +- if (sc->quirks & GHL_GUITAR_PS3WIIU) ++ if (sc->quirks & GHL_GUITAR_PS3WIIU) { + del_timer_sync(&sc->ghl_poke_timer); ++ usb_free_urb(sc->ghl_urb); ++ } + + hid_hw_close(hdev); + +-- +2.30.2 + diff --git a/queue-5.12/hid-wacom-correct-base-usage-for-capacitive-expressk.patch b/queue-5.12/hid-wacom-correct-base-usage-for-capacitive-expressk.patch new file mode 100644 index 00000000000..6563316030e --- /dev/null +++ b/queue-5.12/hid-wacom-correct-base-usage-for-capacitive-expressk.patch @@ -0,0 +1,35 @@ +From d2643b9811783f19667b3b2c52b672dd9a9c87dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 09:58:09 -0700 +Subject: HID: wacom: Correct base usage for capacitive ExpressKey status bits + +From: Jason Gerecke + +[ Upstream commit 424d8237945c6c448c8b3f23885d464fb5685c97 ] + +The capacitive status of ExpressKeys is reported with usages beginning +at 0x940, not 0x950. Bring our driver into alignment with reality. + +Signed-off-by: Jason Gerecke +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/wacom_wac.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h +index 195910dd2154..e3835407e8d2 100644 +--- a/drivers/hid/wacom_wac.h ++++ b/drivers/hid/wacom_wac.h +@@ -122,7 +122,7 @@ + #define WACOM_HID_WD_TOUCHONOFF (WACOM_HID_UP_WACOMDIGITIZER | 0x0454) + #define WACOM_HID_WD_BATTERY_LEVEL (WACOM_HID_UP_WACOMDIGITIZER | 0x043b) + #define WACOM_HID_WD_EXPRESSKEY00 (WACOM_HID_UP_WACOMDIGITIZER | 0x0910) +-#define WACOM_HID_WD_EXPRESSKEYCAP00 (WACOM_HID_UP_WACOMDIGITIZER | 0x0950) ++#define WACOM_HID_WD_EXPRESSKEYCAP00 (WACOM_HID_UP_WACOMDIGITIZER | 0x0940) + #define WACOM_HID_WD_MODE_CHANGE (WACOM_HID_UP_WACOMDIGITIZER | 0x0980) + #define WACOM_HID_WD_MUTE_DEVICE (WACOM_HID_UP_WACOMDIGITIZER | 0x0981) + #define WACOM_HID_WD_CONTROLPANEL (WACOM_HID_UP_WACOMDIGITIZER | 0x0982) +-- +2.30.2 + diff --git a/queue-5.12/hugetlb-address-ref-count-racing-in-prep_compound_gi.patch b/queue-5.12/hugetlb-address-ref-count-racing-in-prep_compound_gi.patch new file mode 100644 index 00000000000..f30818e7101 --- /dev/null +++ b/queue-5.12/hugetlb-address-ref-count-racing-in-prep_compound_gi.patch @@ -0,0 +1,212 @@ +From 7bfa9b138c4c73be8f0f39fe00abe29f60e53998 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:48:34 -0700 +Subject: hugetlb: address ref count racing in prep_compound_gigantic_page + +From: Mike Kravetz + +[ Upstream commit 7118fc2906e2925d7edb5ed9c8a57f2a5f23b849 ] + +In [1], Jann Horn points out a possible race between +prep_compound_gigantic_page and __page_cache_add_speculative. The root +cause of the possible race is prep_compound_gigantic_page uncondittionally +setting the ref count of pages to zero. It does this because +prep_compound_gigantic_page is handed a 'group' of pages from an allocator +and needs to convert that group of pages to a compound page. The ref +count of each page in this 'group' is one as set by the allocator. +However, the ref count of compound page tail pages must be zero. + +The potential race comes about when ref counted pages are returned from +the allocator. When this happens, other mm code could also take a +reference on the page. __page_cache_add_speculative is one such example. +Therefore, prep_compound_gigantic_page can not just set the ref count of +pages to zero as it does today. Doing so would lose the reference taken +by any other code. This would lead to BUGs in code checking ref counts +and could possibly even lead to memory corruption. + +There are two possible ways to address this issue. + +1) Make all allocators of gigantic groups of pages be able to return a + properly constructed compound page. + +2) Make prep_compound_gigantic_page be more careful when constructing a + compound page. + +This patch takes approach 2. + +In prep_compound_gigantic_page, use cmpxchg to only set ref count to zero +if it is one. If the cmpxchg fails, call synchronize_rcu() in the hope +that the extra ref count will be driopped during a rcu grace period. This +is not a performance critical code path and the wait should be +accceptable. If the ref count is still inflated after the grace period, +then undo any modifications made and return an error. + +Currently prep_compound_gigantic_page is type void and does not return +errors. Modify the two callers to check for and handle error returns. On +error, the caller must free the 'group' of pages as they can not be used +to form a gigantic page. After freeing pages, the runtime caller +(alloc_fresh_huge_page) will retry the allocation once. Boot time +allocations can not be retried. + +The routine prep_compound_page also unconditionally sets the ref count of +compound page tail pages to zero. However, in this case the buddy +allocator is constructing a compound page from freshly allocated pages. +The ref count on those freshly allocated pages is already zero, so the +set_page_count(p, 0) is unnecessary and could lead to confusion. Just +remove it. + +[1] https://lore.kernel.org/linux-mm/CAG48ez23q0Jy9cuVnwAe7t_fdhMk2S7N5Hdi-GLcCeq5bsfLxw@mail.gmail.com/ + +Link: https://lkml.kernel.org/r/20210622021423.154662-3-mike.kravetz@oracle.com +Fixes: 58a84aa92723 ("thp: set compound tail page _count to zero") +Signed-off-by: Mike Kravetz +Reported-by: Jann Horn +Cc: Youquan Song +Cc: Andrea Arcangeli +Cc: Jan Kara +Cc: John Hubbard +Cc: "Kirill A . Shutemov" +Cc: Matthew Wilcox +Cc: Michal Hocko +Cc: Muchun Song +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/hugetlb.c | 72 +++++++++++++++++++++++++++++++++++++++++++------ + mm/page_alloc.c | 1 - + 2 files changed, 64 insertions(+), 9 deletions(-) + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index dbf44b92651b..9fdcad652c34 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1504,9 +1504,9 @@ static void prep_new_huge_page(struct hstate *h, struct page *page, int nid) + spin_unlock(&hugetlb_lock); + } + +-static void prep_compound_gigantic_page(struct page *page, unsigned int order) ++static bool prep_compound_gigantic_page(struct page *page, unsigned int order) + { +- int i; ++ int i, j; + int nr_pages = 1 << order; + struct page *p = page + 1; + +@@ -1528,11 +1528,48 @@ static void prep_compound_gigantic_page(struct page *page, unsigned int order) + * after get_user_pages(). + */ + __ClearPageReserved(p); ++ /* ++ * Subtle and very unlikely ++ * ++ * Gigantic 'page allocators' such as memblock or cma will ++ * return a set of pages with each page ref counted. We need ++ * to turn this set of pages into a compound page with tail ++ * page ref counts set to zero. Code such as speculative page ++ * cache adding could take a ref on a 'to be' tail page. ++ * We need to respect any increased ref count, and only set ++ * the ref count to zero if count is currently 1. If count ++ * is not 1, we call synchronize_rcu in the hope that a rcu ++ * grace period will cause ref count to drop and then retry. ++ * If count is still inflated on retry we return an error and ++ * must discard the pages. ++ */ ++ if (!page_ref_freeze(p, 1)) { ++ pr_info("HugeTLB unexpected inflated ref count on freshly allocated page\n"); ++ synchronize_rcu(); ++ if (!page_ref_freeze(p, 1)) ++ goto out_error; ++ } + set_page_count(p, 0); + set_compound_head(p, page); + } + atomic_set(compound_mapcount_ptr(page), -1); + atomic_set(compound_pincount_ptr(page), 0); ++ return true; ++ ++out_error: ++ /* undo tail page modifications made above */ ++ p = page + 1; ++ for (j = 1; j < i; j++, p = mem_map_next(p, page, j)) { ++ clear_compound_head(p); ++ set_page_refcounted(p); ++ } ++ /* need to clear PG_reserved on remaining tail pages */ ++ for (; j < nr_pages; j++, p = mem_map_next(p, page, j)) ++ __ClearPageReserved(p); ++ set_compound_order(page, 0); ++ page[1].compound_nr = 0; ++ __ClearPageHead(page); ++ return false; + } + + /* +@@ -1652,7 +1689,9 @@ static struct page *alloc_fresh_huge_page(struct hstate *h, + nodemask_t *node_alloc_noretry) + { + struct page *page; ++ bool retry = false; + ++retry: + if (hstate_is_gigantic(h)) + page = alloc_gigantic_page(h, gfp_mask, nid, nmask); + else +@@ -1661,8 +1700,21 @@ static struct page *alloc_fresh_huge_page(struct hstate *h, + if (!page) + return NULL; + +- if (hstate_is_gigantic(h)) +- prep_compound_gigantic_page(page, huge_page_order(h)); ++ if (hstate_is_gigantic(h)) { ++ if (!prep_compound_gigantic_page(page, huge_page_order(h))) { ++ /* ++ * Rare failure to convert pages to compound page. ++ * Free pages and try again - ONCE! ++ */ ++ free_gigantic_page(page, huge_page_order(h)); ++ if (!retry) { ++ retry = true; ++ goto retry; ++ } ++ pr_warn("HugeTLB page can not be used due to unexpected inflated ref count\n"); ++ return NULL; ++ } ++ } + prep_new_huge_page(h, page, page_to_nid(page)); + + return page; +@@ -2516,10 +2568,14 @@ static void __init gather_bootmem_prealloc(void) + + VM_BUG_ON(!hstate_is_gigantic(h)); + WARN_ON(page_count(page) != 1); +- prep_compound_gigantic_page(page, huge_page_order(h)); +- WARN_ON(PageReserved(page)); +- prep_new_huge_page(h, page, page_to_nid(page)); +- put_page(page); /* free it into the hugepage allocator */ ++ if (prep_compound_gigantic_page(page, huge_page_order(h))) { ++ WARN_ON(PageReserved(page)); ++ prep_new_huge_page(h, page, page_to_nid(page)); ++ put_page(page); /* add to the hugepage allocator */ ++ } else { ++ free_gigantic_page(page, huge_page_order(h)); ++ pr_warn("HugeTLB page can not be used due to unexpected inflated ref count\n"); ++ } + + /* + * We need to restore the 'stolen' pages to totalram_pages +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 382af5377274..fe9b8975e69d 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -676,7 +676,6 @@ void prep_compound_page(struct page *page, unsigned int order) + __SetPageHead(page); + for (i = 1; i < nr_pages; i++) { + struct page *p = page + i; +- set_page_count(p, 0); + p->mapping = TAIL_MAPPING; + set_compound_head(p, page); + } +-- +2.30.2 + diff --git a/queue-5.12/hugetlb-remove-prep_compound_huge_page-cleanup.patch b/queue-5.12/hugetlb-remove-prep_compound_huge_page-cleanup.patch new file mode 100644 index 00000000000..9a5ec662e75 --- /dev/null +++ b/queue-5.12/hugetlb-remove-prep_compound_huge_page-cleanup.patch @@ -0,0 +1,121 @@ +From 9d470a63b31fb4ff0b7c90e6761466ff9f735772 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:48:31 -0700 +Subject: hugetlb: remove prep_compound_huge_page cleanup + +From: Mike Kravetz + +[ Upstream commit 48b8d744ea841b8adf8d07bfe7a2d55f22e4d179 ] + +Patch series "Fix prep_compound_gigantic_page ref count adjustment". + +These patches address the possible race between +prep_compound_gigantic_page and __page_cache_add_speculative as described +by Jann Horn in [1]. + +The first patch simply removes the unnecessary/obsolete helper routine +prep_compound_huge_page to make the actual fix a little simpler. + +The second patch is the actual fix and has a detailed explanation in the +commit message. + +This potential issue has existed for almost 10 years and I am unaware of +anyone actually hitting the race. I did not cc stable, but would be happy +to squash the patches and send to stable if anyone thinks that is a good +idea. + +[1] https://lore.kernel.org/linux-mm/CAG48ez23q0Jy9cuVnwAe7t_fdhMk2S7N5Hdi-GLcCeq5bsfLxw@mail.gmail.com/ + +This patch (of 2): + +I could not think of a reliable way to recreate the issue for testing. +Rather, I 'simulated errors' to exercise all the error paths. + +The routine prep_compound_huge_page is a simple wrapper to call either +prep_compound_gigantic_page or prep_compound_page. However, it is only +called from gather_bootmem_prealloc which only processes gigantic pages. +Eliminate the routine and call prep_compound_gigantic_page directly. + +Link: https://lkml.kernel.org/r/20210622021423.154662-1-mike.kravetz@oracle.com +Link: https://lkml.kernel.org/r/20210622021423.154662-2-mike.kravetz@oracle.com +Signed-off-by: Mike Kravetz +Cc: Andrea Arcangeli +Cc: Jan Kara +Cc: Jann Horn +Cc: John Hubbard +Cc: "Kirill A . Shutemov" +Cc: Matthew Wilcox +Cc: Michal Hocko +Cc: Youquan Song +Cc: Muchun Song +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/hugetlb.c | 29 ++++++++++------------------- + 1 file changed, 10 insertions(+), 19 deletions(-) + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 7ba7d9b20494..dbf44b92651b 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1313,8 +1313,6 @@ static struct page *alloc_gigantic_page(struct hstate *h, gfp_t gfp_mask, + return alloc_contig_pages(nr_pages, gfp_mask, nid, nodemask); + } + +-static void prep_new_huge_page(struct hstate *h, struct page *page, int nid); +-static void prep_compound_gigantic_page(struct page *page, unsigned int order); + #else /* !CONFIG_CONTIG_ALLOC */ + static struct page *alloc_gigantic_page(struct hstate *h, gfp_t gfp_mask, + int nid, nodemask_t *nodemask) +@@ -2504,16 +2502,10 @@ found: + return 1; + } + +-static void __init prep_compound_huge_page(struct page *page, +- unsigned int order) +-{ +- if (unlikely(order > (MAX_ORDER - 1))) +- prep_compound_gigantic_page(page, order); +- else +- prep_compound_page(page, order); +-} +- +-/* Put bootmem huge pages into the standard lists after mem_map is up */ ++/* ++ * Put bootmem huge pages into the standard lists after mem_map is up. ++ * Note: This only applies to gigantic (order > MAX_ORDER) pages. ++ */ + static void __init gather_bootmem_prealloc(void) + { + struct huge_bootmem_page *m; +@@ -2522,20 +2514,19 @@ static void __init gather_bootmem_prealloc(void) + struct page *page = virt_to_page(m); + struct hstate *h = m->hstate; + ++ VM_BUG_ON(!hstate_is_gigantic(h)); + WARN_ON(page_count(page) != 1); +- prep_compound_huge_page(page, huge_page_order(h)); ++ prep_compound_gigantic_page(page, huge_page_order(h)); + WARN_ON(PageReserved(page)); + prep_new_huge_page(h, page, page_to_nid(page)); + put_page(page); /* free it into the hugepage allocator */ + + /* +- * If we had gigantic hugepages allocated at boot time, we need +- * to restore the 'stolen' pages to totalram_pages in order to +- * fix confusing memory reports from free(1) and another +- * side-effects, like CommitLimit going negative. ++ * We need to restore the 'stolen' pages to totalram_pages ++ * in order to fix confusing memory reports from free(1) and ++ * other side-effects, like CommitLimit going negative. + */ +- if (hstate_is_gigantic(h)) +- adjust_managed_page_count(page, pages_per_huge_page(h)); ++ adjust_managed_page_count(page, pages_per_huge_page(h)); + cond_resched(); + } + } +-- +2.30.2 + diff --git a/queue-5.12/hv_utils-fix-passing-zero-to-ptr_err-warning.patch b/queue-5.12/hv_utils-fix-passing-zero-to-ptr_err-warning.patch new file mode 100644 index 00000000000..3ed33045e7d --- /dev/null +++ b/queue-5.12/hv_utils-fix-passing-zero-to-ptr_err-warning.patch @@ -0,0 +1,43 @@ +From 450452bf97b7677ae947f57fa0cc793c9077b7f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 15:01:16 +0800 +Subject: hv_utils: Fix passing zero to 'PTR_ERR' warning + +From: YueHaibing + +[ Upstream commit c6a8625fa4c6b0a97860d053271660ccedc3d1b3 ] + +Sparse warn this: + +drivers/hv/hv_util.c:753 hv_timesync_init() warn: + passing zero to 'PTR_ERR' + +Use PTR_ERR_OR_ZERO instead of PTR_ERR to fix this. + +Signed-off-by: YueHaibing +Link: https://lore.kernel.org/r/20210514070116.16800-1-yuehaibing@huawei.com +[ wei: change %ld to %d ] +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/hv_util.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c +index e4aefeb330da..136576cba26f 100644 +--- a/drivers/hv/hv_util.c ++++ b/drivers/hv/hv_util.c +@@ -750,8 +750,8 @@ static int hv_timesync_init(struct hv_util_service *srv) + */ + hv_ptp_clock = ptp_clock_register(&ptp_hyperv_info, NULL); + if (IS_ERR_OR_NULL(hv_ptp_clock)) { +- pr_err("cannot register PTP clock: %ld\n", +- PTR_ERR(hv_ptp_clock)); ++ pr_err("cannot register PTP clock: %d\n", ++ PTR_ERR_OR_ZERO(hv_ptp_clock)); + hv_ptp_clock = NULL; + } + +-- +2.30.2 + diff --git a/queue-5.12/hwmon-lm70-revert-hwmon-lm70-add-support-for-acpi.patch b/queue-5.12/hwmon-lm70-revert-hwmon-lm70-add-support-for-acpi.patch new file mode 100644 index 00000000000..570e2a70879 --- /dev/null +++ b/queue-5.12/hwmon-lm70-revert-hwmon-lm70-add-support-for-acpi.patch @@ -0,0 +1,80 @@ +From 7992925916ac741b851d1a31f2186805b43d2065 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 09:44:50 -0700 +Subject: hwmon: (lm70) Revert "hwmon: (lm70) Add support for ACPI" + +From: Guenter Roeck + +[ Upstream commit ac61c8aae446b9c0fe18981fe721d4a43e283ad6 ] + +This reverts commit b58bd4c6dfe709646ed9efcbba2a70643f9bc873. + +None of the ACPI IDs introduced with the reverted patch is a valid ACPI +device ID. Any ACPI users of this driver are advised to use PRP0001 and +a devicetree-compatible device identification. + +Fixes: b58bd4c6dfe7 ("hwmon: (lm70) Add support for ACPI") +Cc: Andrej Picej +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm70.c | 26 +------------------------- + 1 file changed, 1 insertion(+), 25 deletions(-) + +diff --git a/drivers/hwmon/lm70.c b/drivers/hwmon/lm70.c +index 40eab3349904..6b884ea00987 100644 +--- a/drivers/hwmon/lm70.c ++++ b/drivers/hwmon/lm70.c +@@ -22,10 +22,10 @@ + #include + #include + #include ++#include + #include + #include + #include +-#include + + #define DRVNAME "lm70" + +@@ -148,29 +148,6 @@ static const struct of_device_id lm70_of_ids[] = { + MODULE_DEVICE_TABLE(of, lm70_of_ids); + #endif + +-#ifdef CONFIG_ACPI +-static const struct acpi_device_id lm70_acpi_ids[] = { +- { +- .id = "LM000070", +- .driver_data = LM70_CHIP_LM70, +- }, +- { +- .id = "TMP00121", +- .driver_data = LM70_CHIP_TMP121, +- }, +- { +- .id = "LM000071", +- .driver_data = LM70_CHIP_LM71, +- }, +- { +- .id = "LM000074", +- .driver_data = LM70_CHIP_LM74, +- }, +- {}, +-}; +-MODULE_DEVICE_TABLE(acpi, lm70_acpi_ids); +-#endif +- + static int lm70_probe(struct spi_device *spi) + { + struct device *hwmon_dev; +@@ -217,7 +194,6 @@ static struct spi_driver lm70_driver = { + .driver = { + .name = "lm70", + .of_match_table = of_match_ptr(lm70_of_ids), +- .acpi_match_table = ACPI_PTR(lm70_acpi_ids), + }, + .id_table = lm70_ids, + .probe = lm70_probe, +-- +2.30.2 + diff --git a/queue-5.12/hwmon-max31722-remove-non-standard-acpi-device-ids.patch b/queue-5.12/hwmon-max31722-remove-non-standard-acpi-device-ids.patch new file mode 100644 index 00000000000..82b683a94b1 --- /dev/null +++ b/queue-5.12/hwmon-max31722-remove-non-standard-acpi-device-ids.patch @@ -0,0 +1,58 @@ +From 46fd422cdbba17179782a6b8626c5dc93637e838 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 09:50:25 -0700 +Subject: hwmon: (max31722) Remove non-standard ACPI device IDs + +From: Guenter Roeck + +[ Upstream commit 97387c2f06bcfd79d04a848d35517b32ee6dca7c ] + +Valid Maxim Integrated ACPI device IDs would start with MXIM, +not with MAX1. On top of that, ACPI device IDs reflecting chip names +are almost always invalid. + +Remove the invalid ACPI IDs. + +Fixes: 04e1e70afec6 ("hwmon: (max31722) Add support for MAX31722/MAX31723 temperature sensors") +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/max31722.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/hwmon/max31722.c b/drivers/hwmon/max31722.c +index 062eceb7be0d..613338cbcb17 100644 +--- a/drivers/hwmon/max31722.c ++++ b/drivers/hwmon/max31722.c +@@ -6,7 +6,6 @@ + * Copyright (c) 2016, Intel Corporation. + */ + +-#include + #include + #include + #include +@@ -133,20 +132,12 @@ static const struct spi_device_id max31722_spi_id[] = { + {"max31723", 0}, + {} + }; +- +-static const struct acpi_device_id __maybe_unused max31722_acpi_id[] = { +- {"MAX31722", 0}, +- {"MAX31723", 0}, +- {} +-}; +- + MODULE_DEVICE_TABLE(spi, max31722_spi_id); + + static struct spi_driver max31722_driver = { + .driver = { + .name = "max31722", + .pm = &max31722_pm_ops, +- .acpi_match_table = ACPI_PTR(max31722_acpi_id), + }, + .probe = max31722_probe, + .remove = max31722_remove, +-- +2.30.2 + diff --git a/queue-5.12/hwmon-max31790-fix-fan-speed-reporting-for-fan7.12.patch b/queue-5.12/hwmon-max31790-fix-fan-speed-reporting-for-fan7.12.patch new file mode 100644 index 00000000000..f049d343bfe --- /dev/null +++ b/queue-5.12/hwmon-max31790-fix-fan-speed-reporting-for-fan7.12.patch @@ -0,0 +1,50 @@ +From cdc70c1f4b98b576d653d0312a435da9d61b42fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 08:40:16 -0700 +Subject: hwmon: (max31790) Fix fan speed reporting for fan7..12 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guenter Roeck + +[ Upstream commit cbbf244f0515af3472084f22b6213121b4a63835 ] + +Fans 7..12 do not have their own set of configuration registers. +So far the code ignored that and read beyond the end of the configuration +register range to get the tachometer period. This resulted in more or less +random fan speed values for those fans. + +The datasheet is quite vague when it comes to defining the tachometer +period for fans 7..12. Experiments confirm that the period is the same +for both fans associated with a given set of configuration registers. + +Fixes: 54187ff9d766 ("hwmon: (max31790) Convert to use new hwmon registration API") +Fixes: 195a4b4298a7 ("hwmon: Driver for Maxim MAX31790") +Cc: Jan Kundrát +Reviewed-by: Jan Kundrát +Cc: Václav Kubernát +Reviewed-by: Jan Kundrát +Signed-off-by: Guenter Roeck +Link: https://lore.kernel.org/r/20210526154022.3223012-2-linux@roeck-us.net +Signed-off-by: Sasha Levin +--- + drivers/hwmon/max31790.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/max31790.c b/drivers/hwmon/max31790.c +index 76aa96f5b984..67677c437768 100644 +--- a/drivers/hwmon/max31790.c ++++ b/drivers/hwmon/max31790.c +@@ -171,7 +171,7 @@ static int max31790_read_fan(struct device *dev, u32 attr, int channel, + + switch (attr) { + case hwmon_fan_input: +- sr = get_tach_period(data->fan_dynamics[channel]); ++ sr = get_tach_period(data->fan_dynamics[channel % NR_CHANNEL]); + rpm = RPM_FROM_REG(data->tach[channel], sr); + *val = rpm; + return 0; +-- +2.30.2 + diff --git a/queue-5.12/hwmon-max31790-fix-pwmx_enable-attributes.patch b/queue-5.12/hwmon-max31790-fix-pwmx_enable-attributes.patch new file mode 100644 index 00000000000..2e82e1e4b44 --- /dev/null +++ b/queue-5.12/hwmon-max31790-fix-pwmx_enable-attributes.patch @@ -0,0 +1,140 @@ +From 8754ff3c70b7bf088bcdc3c0474c230f46711aee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 08:40:18 -0700 +Subject: hwmon: (max31790) Fix pwmX_enable attributes +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guenter Roeck + +[ Upstream commit 148c847c9e5a54b99850617bf9c143af9a344f92 ] + +pwmX_enable supports three possible values: + +0: Fan control disabled. Duty cycle is fixed to 0% +1: Fan control enabled, pwm mode. Duty cycle is determined by + values written into Target Duty Cycle registers. +2: Fan control enabled, rpm mode + Duty cycle is adjusted such that fan speed matches + the values in Target Count registers + +The current code does not do this; instead, it mixes pwm control +configuration with fan speed monitoring configuration. Worse, it +reports that pwm control would be disabled (pwmX_enable==0) when +it is in fact enabled in pwm mode. Part of the problem may be that +the chip sets the "TACH input enable" bit on its own whenever the +mode bit is set to RPM mode, but that doesn't mean that "TACH input +enable" accurately reflects the pwm mode. + +Fix it up and only handle pwm control with the pwmX_enable attributes. +In the documentation, clarify that disabling pwm control (pwmX_enable=0) +sets the pwm duty cycle to 0%. In the code, explain why TACH_INPUT_EN +is set together with RPM_MODE. + +While at it, only update the configuration register if the configuration +has changed, and only update the cached configuration if updating the +chip configuration was successful. + +Cc: Jan Kundrát +Cc: Václav Kubernát +Signed-off-by: Guenter Roeck +Tested-by: Václav Kubernát +Reviewed-by: Jan Kundrát +Link: https://lore.kernel.org/r/20210526154022.3223012-4-linux@roeck-us.net +Signed-off-by: Sasha Levin +--- + Documentation/hwmon/max31790.rst | 2 +- + drivers/hwmon/max31790.c | 41 ++++++++++++++++++++------------ + 2 files changed, 27 insertions(+), 16 deletions(-) + +diff --git a/Documentation/hwmon/max31790.rst b/Documentation/hwmon/max31790.rst +index 54ff0f49e28f..7b097c3b9b90 100644 +--- a/Documentation/hwmon/max31790.rst ++++ b/Documentation/hwmon/max31790.rst +@@ -38,7 +38,7 @@ Sysfs entries + fan[1-12]_input RO fan tachometer speed in RPM + fan[1-12]_fault RO fan experienced fault + fan[1-6]_target RW desired fan speed in RPM +-pwm[1-6]_enable RW regulator mode, 0=disabled, 1=manual mode, 2=rpm mode ++pwm[1-6]_enable RW regulator mode, 0=disabled (duty cycle=0%), 1=manual mode, 2=rpm mode + pwm[1-6] RW read: current pwm duty cycle, + write: target pwm duty cycle (0-255) + ================== === ======================================================= +diff --git a/drivers/hwmon/max31790.c b/drivers/hwmon/max31790.c +index 8ad7a45bfe68..76aa96f5b984 100644 +--- a/drivers/hwmon/max31790.c ++++ b/drivers/hwmon/max31790.c +@@ -27,6 +27,7 @@ + + /* Fan Config register bits */ + #define MAX31790_FAN_CFG_RPM_MODE 0x80 ++#define MAX31790_FAN_CFG_CTRL_MON 0x10 + #define MAX31790_FAN_CFG_TACH_INPUT_EN 0x08 + #define MAX31790_FAN_CFG_TACH_INPUT 0x01 + +@@ -271,12 +272,12 @@ static int max31790_read_pwm(struct device *dev, u32 attr, int channel, + *val = data->pwm[channel] >> 8; + return 0; + case hwmon_pwm_enable: +- if (fan_config & MAX31790_FAN_CFG_RPM_MODE) ++ if (fan_config & MAX31790_FAN_CFG_CTRL_MON) ++ *val = 0; ++ else if (fan_config & MAX31790_FAN_CFG_RPM_MODE) + *val = 2; +- else if (fan_config & MAX31790_FAN_CFG_TACH_INPUT_EN) +- *val = 1; + else +- *val = 0; ++ *val = 1; + return 0; + default: + return -EOPNOTSUPP; +@@ -307,23 +308,33 @@ static int max31790_write_pwm(struct device *dev, u32 attr, int channel, + case hwmon_pwm_enable: + fan_config = data->fan_config[channel]; + if (val == 0) { +- fan_config &= ~(MAX31790_FAN_CFG_TACH_INPUT_EN | +- MAX31790_FAN_CFG_RPM_MODE); ++ fan_config |= MAX31790_FAN_CFG_CTRL_MON; ++ /* ++ * Disable RPM mode; otherwise disabling fan speed ++ * monitoring is not possible. ++ */ ++ fan_config &= ~MAX31790_FAN_CFG_RPM_MODE; + } else if (val == 1) { +- fan_config = (fan_config | +- MAX31790_FAN_CFG_TACH_INPUT_EN) & +- ~MAX31790_FAN_CFG_RPM_MODE; ++ fan_config &= ~(MAX31790_FAN_CFG_CTRL_MON | MAX31790_FAN_CFG_RPM_MODE); + } else if (val == 2) { +- fan_config |= MAX31790_FAN_CFG_TACH_INPUT_EN | +- MAX31790_FAN_CFG_RPM_MODE; ++ fan_config &= ~MAX31790_FAN_CFG_CTRL_MON; ++ /* ++ * The chip sets MAX31790_FAN_CFG_TACH_INPUT_EN on its ++ * own if MAX31790_FAN_CFG_RPM_MODE is set. ++ * Do it here as well to reflect the actual register ++ * value in the cache. ++ */ ++ fan_config |= (MAX31790_FAN_CFG_RPM_MODE | MAX31790_FAN_CFG_TACH_INPUT_EN); + } else { + err = -EINVAL; + break; + } +- data->fan_config[channel] = fan_config; +- err = i2c_smbus_write_byte_data(client, +- MAX31790_REG_FAN_CONFIG(channel), +- fan_config); ++ if (fan_config != data->fan_config[channel]) { ++ err = i2c_smbus_write_byte_data(client, MAX31790_REG_FAN_CONFIG(channel), ++ fan_config); ++ if (!err) ++ data->fan_config[channel] = fan_config; ++ } + break; + default: + err = -EOPNOTSUPP; +-- +2.30.2 + diff --git a/queue-5.12/hwmon-max31790-report-correct-current-pwm-duty-cycle.patch b/queue-5.12/hwmon-max31790-report-correct-current-pwm-duty-cycle.patch new file mode 100644 index 00000000000..1669648da2d --- /dev/null +++ b/queue-5.12/hwmon-max31790-report-correct-current-pwm-duty-cycle.patch @@ -0,0 +1,76 @@ +From ba47fdae05bec71b1f401c91907b1dd762221c35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 08:40:17 -0700 +Subject: hwmon: (max31790) Report correct current pwm duty cycles +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guenter Roeck + +[ Upstream commit 897f6339893b741a5d68ae8e2475df65946041c2 ] + +The MAX31790 has two sets of registers for pwm duty cycles, one to request +a duty cycle and one to read the actual current duty cycle. Both do not +have to be the same. + +When reporting the pwm duty cycle to the user, the actual pwm duty cycle +from pwm duty cycle registers needs to be reported. When setting it, the +pwm target duty cycle needs to be written. Since we don't know the actual +pwm duty cycle after a target pwm duty cycle has been written, set the +valid flag to false to indicate that actual pwm duty cycle should be read +from the chip instead of using cached values. + +Cc: Jan Kundrát +Cc: Václav Kubernát +Signed-off-by: Guenter Roeck +Tested-by: Václav Kubernát +Reviewed-by: Jan Kundrát +Link: https://lore.kernel.org/r/20210526154022.3223012-3-linux@roeck-us.net +Signed-off-by: Sasha Levin +--- + Documentation/hwmon/max31790.rst | 3 ++- + drivers/hwmon/max31790.c | 6 +++--- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/Documentation/hwmon/max31790.rst b/Documentation/hwmon/max31790.rst +index f301385d8cef..54ff0f49e28f 100644 +--- a/Documentation/hwmon/max31790.rst ++++ b/Documentation/hwmon/max31790.rst +@@ -39,5 +39,6 @@ fan[1-12]_input RO fan tachometer speed in RPM + fan[1-12]_fault RO fan experienced fault + fan[1-6]_target RW desired fan speed in RPM + pwm[1-6]_enable RW regulator mode, 0=disabled, 1=manual mode, 2=rpm mode +-pwm[1-6] RW fan target duty cycle (0-255) ++pwm[1-6] RW read: current pwm duty cycle, ++ write: target pwm duty cycle (0-255) + ================== === ======================================================= +diff --git a/drivers/hwmon/max31790.c b/drivers/hwmon/max31790.c +index 86e6c71db685..8ad7a45bfe68 100644 +--- a/drivers/hwmon/max31790.c ++++ b/drivers/hwmon/max31790.c +@@ -104,7 +104,7 @@ static struct max31790_data *max31790_update_device(struct device *dev) + data->tach[NR_CHANNEL + i] = rv; + } else { + rv = i2c_smbus_read_word_swapped(client, +- MAX31790_REG_PWMOUT(i)); ++ MAX31790_REG_PWM_DUTY_CYCLE(i)); + if (rv < 0) + goto abort; + data->pwm[i] = rv; +@@ -299,10 +299,10 @@ static int max31790_write_pwm(struct device *dev, u32 attr, int channel, + err = -EINVAL; + break; + } +- data->pwm[channel] = val << 8; ++ data->valid = false; + err = i2c_smbus_write_word_swapped(client, + MAX31790_REG_PWMOUT(channel), +- data->pwm[channel]); ++ val << 8); + break; + case hwmon_pwm_enable: + fan_config = data->fan_config[channel]; +-- +2.30.2 + diff --git a/queue-5.12/hwrng-exynos-fix-runtime-pm-imbalance-on-error.patch b/queue-5.12/hwrng-exynos-fix-runtime-pm-imbalance-on-error.patch new file mode 100644 index 00000000000..be42120648d --- /dev/null +++ b/queue-5.12/hwrng-exynos-fix-runtime-pm-imbalance-on-error.patch @@ -0,0 +1,49 @@ +From 37add58b83d3f31a96c40f32cbb4bb523387eb09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 20:29:14 +0200 +Subject: hwrng: exynos - Fix runtime PM imbalance on error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Łukasz Stelmach + +[ Upstream commit 0cdbabf8bb7a6147f5adf37dbc251e92a1bbc2c7 ] + +pm_runtime_resume_and_get() wraps around pm_runtime_get_sync() and +decrements the runtime PM usage counter in case the latter function +fails and keeps the counter balanced. + +Signed-off-by: Łukasz Stelmach +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/exynos-trng.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/hw_random/exynos-trng.c b/drivers/char/hw_random/exynos-trng.c +index 8e1fe3f8dd2d..c8db62bc5ff7 100644 +--- a/drivers/char/hw_random/exynos-trng.c ++++ b/drivers/char/hw_random/exynos-trng.c +@@ -132,7 +132,7 @@ static int exynos_trng_probe(struct platform_device *pdev) + return PTR_ERR(trng->mem); + + pm_runtime_enable(&pdev->dev); +- ret = pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) { + dev_err(&pdev->dev, "Could not get runtime PM.\n"); + goto err_pm_get; +@@ -165,7 +165,7 @@ err_register: + clk_disable_unprepare(trng->clk); + + err_clock: +- pm_runtime_put_sync(&pdev->dev); ++ pm_runtime_put_noidle(&pdev->dev); + + err_pm_get: + pm_runtime_disable(&pdev->dev); +-- +2.30.2 + diff --git a/queue-5.12/i40e-fix-autoneg-disabling-for-non-10gbaset-links.patch b/queue-5.12/i40e-fix-autoneg-disabling-for-non-10gbaset-links.patch new file mode 100644 index 00000000000..c83beb78d89 --- /dev/null +++ b/queue-5.12/i40e-fix-autoneg-disabling-for-non-10gbaset-links.patch @@ -0,0 +1,41 @@ +From 19b02a720bc92576dbd754fc3de4b7579fa1dfa9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 11:12:54 +0000 +Subject: i40e: Fix autoneg disabling for non-10GBaseT links + +From: Mateusz Palczewski + +[ Upstream commit 9262793e59f0423437166a879a73d056b1fe6f9a ] + +Disabling autonegotiation was allowed only for 10GBaseT PHY. +The condition was changed to check if link media type is BaseT. + +Fixes: 3ce12ee9d8f9 ("i40e: Fix order of checks when enabling/disabling autoneg in ethtool") +Reviewed-by: Aleksandr Loktionov +Reviewed-by: Karen Sornek +Signed-off-by: Dawid Lukwinski +Signed-off-by: Mateusz Palczewski +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_ethtool.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 93dd58fda272..d558364e3a9f 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -1262,8 +1262,7 @@ static int i40e_set_link_ksettings(struct net_device *netdev, + if (ethtool_link_ksettings_test_link_mode(&safe_ks, + supported, + Autoneg) && +- hw->phy.link_info.phy_type != +- I40E_PHY_TYPE_10GBASE_T) { ++ hw->phy.media_type != I40E_MEDIA_TYPE_BASET) { + netdev_info(netdev, "Autoneg cannot be disabled on this phy\n"); + err = -EINVAL; + goto done; +-- +2.30.2 + diff --git a/queue-5.12/i40e-fix-error-handling-in-i40e_vsi_open.patch b/queue-5.12/i40e-fix-error-handling-in-i40e_vsi_open.patch new file mode 100644 index 00000000000..fe3eb0ee41f --- /dev/null +++ b/queue-5.12/i40e-fix-error-handling-in-i40e_vsi_open.patch @@ -0,0 +1,38 @@ +From f957986beea220cb03e95afe08802b2a3d66b89b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 19:50:58 +0800 +Subject: i40e: Fix error handling in i40e_vsi_open + +From: Dinghao Liu + +[ Upstream commit 9c04cfcd4aad232e36306cdc5c74cd9fc9148a7e ] + +When vsi->type == I40E_VSI_FDIR, we have caught the return value of +i40e_vsi_request_irq() but without further handling. Check and execute +memory clean on failure just like the other i40e_vsi_request_irq(). + +Fixes: 8a9eb7d3cbcab ("i40e: rework fdir setup and teardown") +Signed-off-by: Dinghao Liu +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index ac4b44fc19f1..2dbc03cd1769 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -8702,6 +8702,8 @@ int i40e_vsi_open(struct i40e_vsi *vsi) + dev_driver_string(&pf->pdev->dev), + dev_name(&pf->pdev->dev)); + err = i40e_vsi_request_irq(vsi, int_name); ++ if (err) ++ goto err_setup_rx; + + } else { + err = -EINVAL; +-- +2.30.2 + diff --git a/queue-5.12/i40e-fix-missing-rtnl-locking-when-setting-up-pf-swi.patch b/queue-5.12/i40e-fix-missing-rtnl-locking-when-setting-up-pf-swi.patch new file mode 100644 index 00000000000..e928f61167b --- /dev/null +++ b/queue-5.12/i40e-fix-missing-rtnl-locking-when-setting-up-pf-swi.patch @@ -0,0 +1,90 @@ +From 94a8fa57bc58aa99461cbba7b3aad94b4e50dbe3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jun 2021 12:01:41 +0200 +Subject: i40e: Fix missing rtnl locking when setting up pf switch + +From: Jan Sokolowski + +[ Upstream commit 956e759d5f8e0859e86b951a8779c60af633aafd ] + +A recent change that made i40e use new udp_tunnel infrastructure +uses a method that expects to be called under rtnl lock. + +However, not all codepaths do the lock prior to calling +i40e_setup_pf_switch. + +Fix that by adding additional rtnl locking and unlocking. + +Fixes: 40a98cb6f01f ("i40e: convert to new udp_tunnel infrastructure") +Signed-off-by: Jan Sokolowski +Signed-off-by: Mateusz Palczewski +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 2dbc03cd1769..d5106a6afb45 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -31,7 +31,7 @@ static void i40e_vsi_reinit_locked(struct i40e_vsi *vsi); + static void i40e_handle_reset_warning(struct i40e_pf *pf, bool lock_acquired); + static int i40e_add_vsi(struct i40e_vsi *vsi); + static int i40e_add_veb(struct i40e_veb *veb, struct i40e_vsi *vsi); +-static int i40e_setup_pf_switch(struct i40e_pf *pf, bool reinit); ++static int i40e_setup_pf_switch(struct i40e_pf *pf, bool reinit, bool lock_acquired); + static int i40e_setup_misc_vector(struct i40e_pf *pf); + static void i40e_determine_queue_usage(struct i40e_pf *pf); + static int i40e_setup_pf_filter_control(struct i40e_pf *pf); +@@ -10570,7 +10570,7 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) + #endif /* CONFIG_I40E_DCB */ + if (!lock_acquired) + rtnl_lock(); +- ret = i40e_setup_pf_switch(pf, reinit); ++ ret = i40e_setup_pf_switch(pf, reinit, true); + if (ret) + goto end_unlock; + +@@ -14623,10 +14623,11 @@ int i40e_fetch_switch_configuration(struct i40e_pf *pf, bool printconfig) + * i40e_setup_pf_switch - Setup the HW switch on startup or after reset + * @pf: board private structure + * @reinit: if the Main VSI needs to re-initialized. ++ * @lock_acquired: indicates whether or not the lock has been acquired + * + * Returns 0 on success, negative value on failure + **/ +-static int i40e_setup_pf_switch(struct i40e_pf *pf, bool reinit) ++static int i40e_setup_pf_switch(struct i40e_pf *pf, bool reinit, bool lock_acquired) + { + u16 flags = 0; + int ret; +@@ -14728,9 +14729,15 @@ static int i40e_setup_pf_switch(struct i40e_pf *pf, bool reinit) + + i40e_ptp_init(pf); + ++ if (!lock_acquired) ++ rtnl_lock(); ++ + /* repopulate tunnel port filters */ + udp_tunnel_nic_reset_ntf(pf->vsi[pf->lan_vsi]->netdev); + ++ if (!lock_acquired) ++ rtnl_unlock(); ++ + return ret; + } + +@@ -15511,7 +15518,7 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + pf->flags |= I40E_FLAG_VEB_MODE_ENABLED; + } + #endif +- err = i40e_setup_pf_switch(pf, false); ++ err = i40e_setup_pf_switch(pf, false, false); + if (err) { + dev_info(&pdev->dev, "setup_pf_switch failed: %d\n", err); + goto err_vsis; +-- +2.30.2 + diff --git a/queue-5.12/ia64-mca_drv-fix-incorrect-array-size-calculation.patch b/queue-5.12/ia64-mca_drv-fix-incorrect-array-size-calculation.patch new file mode 100644 index 00000000000..e935a2e6fbb --- /dev/null +++ b/queue-5.12/ia64-mca_drv-fix-incorrect-array-size-calculation.patch @@ -0,0 +1,48 @@ +From a146ed8f3faaf1869b3f52ed448744d56ea27cb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 19:33:41 -0700 +Subject: ia64: mca_drv: fix incorrect array size calculation + +From: Arnd Bergmann + +[ Upstream commit c5f320ff8a79501bb59338278336ec43acb9d7e2 ] + +gcc points out a mistake in the mca driver that goes back to before the +git history: + +arch/ia64/kernel/mca_drv.c: In function 'init_record_index_pools': +arch/ia64/kernel/mca_drv.c:346:54: error: expression does not compute the number of elements in this array; element typ +e is 'int', not 'size_t' {aka 'long unsigned int'} [-Werror=sizeof-array-div] + 346 | for (i = 1; i < sizeof sal_log_sect_min_sizes/sizeof(size_t); i++) + | ^ + +This is the same as sizeof(size_t), which is two shorter than the actual +array. Use the ARRAY_SIZE() macro to get the correct calculation instead. + +Link: https://lkml.kernel.org/r/20210514214123.875971-1-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Cc: Masahiro Yamada +Cc: Randy Dunlap +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/ia64/kernel/mca_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/ia64/kernel/mca_drv.c b/arch/ia64/kernel/mca_drv.c +index 36a69b4e6169..5bfc79be4cef 100644 +--- a/arch/ia64/kernel/mca_drv.c ++++ b/arch/ia64/kernel/mca_drv.c +@@ -343,7 +343,7 @@ init_record_index_pools(void) + + /* - 2 - */ + sect_min_size = sal_log_sect_min_sizes[0]; +- for (i = 1; i < sizeof sal_log_sect_min_sizes/sizeof(size_t); i++) ++ for (i = 1; i < ARRAY_SIZE(sal_log_sect_min_sizes); i++) + if (sect_min_size > sal_log_sect_min_sizes[i]) + sect_min_size = sal_log_sect_min_sizes[i]; + +-- +2.30.2 + diff --git a/queue-5.12/ibmvnic-account-for-bufs-already-saved-in-indir_buf.patch b/queue-5.12/ibmvnic-account-for-bufs-already-saved-in-indir_buf.patch new file mode 100644 index 00000000000..d6259b81857 --- /dev/null +++ b/queue-5.12/ibmvnic-account-for-bufs-already-saved-in-indir_buf.patch @@ -0,0 +1,46 @@ +From 432621cd06529f0e9c3d37f0861fad1ad467d4ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 21:13:13 -0700 +Subject: ibmvnic: account for bufs already saved in indir_buf + +From: Sukadev Bhattiprolu + +[ Upstream commit 72368f8b2b9e4106072a2728bed3367d54641c22 ] + +This fixes a crash in replenish_rx_pool() when called from ibmvnic_poll() +after a previous call to replenish_rx_pool() encountered an error when +allocating a socket buffer. + +Thanks to Rick Lindsley and Dany Madden for helping debug the crash. + +Fixes: 4f0b6812e9b9 ("ibmvnic: Introduce batched RX buffer descriptor transmission") +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index e8f4bdb1079c..f1a6f454fe97 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -328,7 +328,14 @@ static void replenish_rx_pool(struct ibmvnic_adapter *adapter, + + rx_scrq = adapter->rx_scrq[pool->index]; + ind_bufp = &rx_scrq->ind_buf; +- for (i = 0; i < count; ++i) { ++ ++ /* netdev_skb_alloc() could have failed after we saved a few skbs ++ * in the indir_buf and we would not have sent them to VIOS yet. ++ * To account for them, start the loop at ind_bufp->index rather ++ * than 0. If we pushed all the skbs to VIOS, ind_bufp->index will ++ * be 0. ++ */ ++ for (i = ind_bufp->index; i < count; ++i) { + skb = netdev_alloc_skb(adapter->netdev, pool->buff_size); + if (!skb) { + dev_err(dev, "Couldn't replenish rx buff\n"); +-- +2.30.2 + diff --git a/queue-5.12/ibmvnic-clean-pending-indirect-buffs-during-reset.patch b/queue-5.12/ibmvnic-clean-pending-indirect-buffs-during-reset.patch new file mode 100644 index 00000000000..033fcbac5dc --- /dev/null +++ b/queue-5.12/ibmvnic-clean-pending-indirect-buffs-during-reset.patch @@ -0,0 +1,83 @@ +From dbf8bb07d577758d4dadc80757fe206119f90ad2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 21:13:12 -0700 +Subject: ibmvnic: clean pending indirect buffs during reset + +From: Sukadev Bhattiprolu + +[ Upstream commit 65d6470d139a6c1655fccb5cbacbeaba8e8ad2f8 ] + +We batch subordinate command response queue (scrq) descriptors that we +need to send to the VIOS using an "indirect" buffer. If after we queue +one or more scrqs in the indirect buffer encounter an error (say fail +to allocate an skb), we leave the queued scrq descriptors in the +indirect buffer until the next call to ibmvnic_xmit(). + +On the next call to ibmvnic_xmit(), it is possible that the adapter is +going through a reset and it is possible that the long term buffers +have been unmapped on the VIOS side. If we proceed to flush (send) the +packets that are in the indirect buffer, we will end up using the old +map ids and this can cause the VIOS to trigger an unnecessary FATAL +error reset. + +Instead of flushing packets remaining on the indirect_buff, discard +(clean) them instead. + +Fixes: 0d973388185d4 ("ibmvnic: Introduce xmit_more support using batched subCRQ hcalls") +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index b2f5250f77a9..e8f4bdb1079c 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -106,6 +106,8 @@ static void release_crq_queue(struct ibmvnic_adapter *); + static int __ibmvnic_set_mac(struct net_device *, u8 *); + static int init_crq_queue(struct ibmvnic_adapter *adapter); + static int send_query_phys_parms(struct ibmvnic_adapter *adapter); ++static void ibmvnic_tx_scrq_clean_buffer(struct ibmvnic_adapter *adapter, ++ struct ibmvnic_sub_crq_queue *tx_scrq); + + struct ibmvnic_stat { + char name[ETH_GSTRING_LEN]; +@@ -668,6 +670,7 @@ static int reset_tx_pools(struct ibmvnic_adapter *adapter) + + tx_scrqs = adapter->num_active_tx_pools; + for (i = 0; i < tx_scrqs; i++) { ++ ibmvnic_tx_scrq_clean_buffer(adapter, adapter->tx_scrq[i]); + rc = reset_one_tx_pool(adapter, &adapter->tso_pool[i]); + if (rc) + return rc; +@@ -1592,7 +1595,8 @@ static void ibmvnic_tx_scrq_clean_buffer(struct ibmvnic_adapter *adapter, + ind_bufp->index = 0; + if (atomic_sub_return(entries, &tx_scrq->used) <= + (adapter->req_tx_entries_per_subcrq / 2) && +- __netif_subqueue_stopped(adapter->netdev, queue_num)) { ++ __netif_subqueue_stopped(adapter->netdev, queue_num) && ++ !test_bit(0, &adapter->resetting)) { + netif_wake_subqueue(adapter->netdev, queue_num); + netdev_dbg(adapter->netdev, "Started queue %d\n", + queue_num); +@@ -1685,7 +1689,6 @@ static netdev_tx_t ibmvnic_xmit(struct sk_buff *skb, struct net_device *netdev) + tx_send_failed++; + tx_dropped++; + ret = NETDEV_TX_OK; +- ibmvnic_tx_scrq_flush(adapter, tx_scrq); + goto out; + } + +@@ -3123,6 +3126,7 @@ static void release_sub_crqs(struct ibmvnic_adapter *adapter, bool do_h_free) + + netdev_dbg(adapter->netdev, "Releasing tx_scrq[%d]\n", + i); ++ ibmvnic_tx_scrq_clean_buffer(adapter, adapter->tx_scrq[i]); + if (adapter->tx_scrq[i]->irq) { + free_irq(adapter->tx_scrq[i]->irq, + adapter->tx_scrq[i]); +-- +2.30.2 + diff --git a/queue-5.12/ibmvnic-free-tx_pool-if-tso_pool-alloc-fails.patch b/queue-5.12/ibmvnic-free-tx_pool-if-tso_pool-alloc-fails.patch new file mode 100644 index 00000000000..1c7e1f07742 --- /dev/null +++ b/queue-5.12/ibmvnic-free-tx_pool-if-tso_pool-alloc-fails.patch @@ -0,0 +1,44 @@ +From c43c1f84b9e227780f7db5f173ece3001eae4026 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 21:13:15 -0700 +Subject: ibmvnic: free tx_pool if tso_pool alloc fails + +From: Sukadev Bhattiprolu + +[ Upstream commit f6ebca8efa52e4ae770f0325d618e7bcf08ada0c ] + +Free tx_pool and clear it, if allocation of tso_pool fails. + +release_tx_pools() assumes we have both tx and tso_pools if ->tx_pool is +non-NULL. If allocation of tso_pool fails in init_tx_pools(), the assumption +will not be true and we would end up dereferencing ->tx_buff, ->free_map +fields from a NULL pointer. + +Fixes: 3205306c6b8d ("ibmvnic: Update TX pool initialization routine") +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index accf362193f8..3c77897b3f31 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -778,8 +778,11 @@ static int init_tx_pools(struct net_device *netdev) + + adapter->tso_pool = kcalloc(tx_subcrqs, + sizeof(struct ibmvnic_tx_pool), GFP_KERNEL); +- if (!adapter->tso_pool) ++ if (!adapter->tso_pool) { ++ kfree(adapter->tx_pool); ++ adapter->tx_pool = NULL; + return -1; ++ } + + adapter->num_active_tx_pools = tx_subcrqs; + +-- +2.30.2 + diff --git a/queue-5.12/ibmvnic-set-ltb-buff-to-null-after-freeing.patch b/queue-5.12/ibmvnic-set-ltb-buff-to-null-after-freeing.patch new file mode 100644 index 00000000000..bd9fa08fc86 --- /dev/null +++ b/queue-5.12/ibmvnic-set-ltb-buff-to-null-after-freeing.patch @@ -0,0 +1,84 @@ +From dbbc5973422abd5fa05e0f224d6a839aa7d290bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 21:13:14 -0700 +Subject: ibmvnic: set ltb->buff to NULL after freeing + +From: Sukadev Bhattiprolu + +[ Upstream commit 552a33729f1a7cc5115d0752064fe9abd6e3e336 ] + +free_long_term_buff() checks ltb->buff to decide whether we have a long +term buffer to free. So set ltb->buff to NULL afer freeing. While here, +also clear ->map_id, fix up some coding style and log an error. + +Fixes: 9c4eaabd1bb39 ("Check CRQ command return codes") +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 26 +++++++++++++++----------- + 1 file changed, 15 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index f1a6f454fe97..accf362193f8 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -211,12 +211,11 @@ static int alloc_long_term_buff(struct ibmvnic_adapter *adapter, + mutex_lock(&adapter->fw_lock); + adapter->fw_done_rc = 0; + reinit_completion(&adapter->fw_done); +- rc = send_request_map(adapter, ltb->addr, +- ltb->size, ltb->map_id); ++ ++ rc = send_request_map(adapter, ltb->addr, ltb->size, ltb->map_id); + if (rc) { +- dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr); +- mutex_unlock(&adapter->fw_lock); +- return rc; ++ dev_err(dev, "send_request_map failed, rc = %d\n", rc); ++ goto out; + } + + rc = ibmvnic_wait_for_completion(adapter, &adapter->fw_done, 10000); +@@ -224,20 +223,23 @@ static int alloc_long_term_buff(struct ibmvnic_adapter *adapter, + dev_err(dev, + "Long term map request aborted or timed out,rc = %d\n", + rc); +- dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr); +- mutex_unlock(&adapter->fw_lock); +- return rc; ++ goto out; + } + + if (adapter->fw_done_rc) { + dev_err(dev, "Couldn't map long term buffer,rc = %d\n", + adapter->fw_done_rc); ++ rc = -1; ++ goto out; ++ } ++ rc = 0; ++out: ++ if (rc) { + dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr); +- mutex_unlock(&adapter->fw_lock); +- return -1; ++ ltb->buff = NULL; + } + mutex_unlock(&adapter->fw_lock); +- return 0; ++ return rc; + } + + static void free_long_term_buff(struct ibmvnic_adapter *adapter, +@@ -257,6 +259,8 @@ static void free_long_term_buff(struct ibmvnic_adapter *adapter, + adapter->reset_reason != VNIC_RESET_TIMEOUT) + send_request_unmap(adapter, ltb->map_id); + dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr); ++ ltb->buff = NULL; ++ ltb->map_id = 0; + } + + static int reset_long_term_buff(struct ibmvnic_adapter *adapter, +-- +2.30.2 + diff --git a/queue-5.12/ieee802154-hwsim-avoid-possible-crash-in-hwsim_del_e.patch b/queue-5.12/ieee802154-hwsim-avoid-possible-crash-in-hwsim_del_e.patch new file mode 100644 index 00000000000..c0f6f735def --- /dev/null +++ b/queue-5.12/ieee802154-hwsim-avoid-possible-crash-in-hwsim_del_e.patch @@ -0,0 +1,41 @@ +From 3a50c332c46bc1d2ad9e46d44a3ecd6218c1efa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 11:02:44 -0700 +Subject: ieee802154: hwsim: avoid possible crash in hwsim_del_edge_nl() + +From: Eric Dumazet + +[ Upstream commit 0303b30375dff5351a79cc2c3c87dfa4fda29bed ] + +Both MAC802154_HWSIM_ATTR_RADIO_ID and MAC802154_HWSIM_ATTR_RADIO_EDGE +must be present to avoid a crash. + +Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") +Signed-off-by: Eric Dumazet +Cc: Alexander Aring +Cc: Stefan Schmidt +Reported-by: syzbot +Acked-by: Alexander Aring +Link: https://lore.kernel.org/r/20210621180244.882076-1-eric.dumazet@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/mac802154_hwsim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c +index 6d479df2d9e5..626e1ce817fc 100644 +--- a/drivers/net/ieee802154/mac802154_hwsim.c ++++ b/drivers/net/ieee802154/mac802154_hwsim.c +@@ -480,7 +480,7 @@ static int hwsim_del_edge_nl(struct sk_buff *msg, struct genl_info *info) + struct hwsim_edge *e; + u32 v0, v1; + +- if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] && ++ if (!info->attrs[MAC802154_HWSIM_ATTR_RADIO_ID] || + !info->attrs[MAC802154_HWSIM_ATTR_RADIO_EDGE]) + return -EINVAL; + +-- +2.30.2 + diff --git a/queue-5.12/ieee802154-hwsim-fix-memory-leak-in-hwsim_add_one.patch b/queue-5.12/ieee802154-hwsim-fix-memory-leak-in-hwsim_add_one.patch new file mode 100644 index 00000000000..caa1ad6d867 --- /dev/null +++ b/queue-5.12/ieee802154-hwsim-fix-memory-leak-in-hwsim_add_one.patch @@ -0,0 +1,60 @@ +From 0a5e882584623e1648fabbdb9e8f74a6ca54a404 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 10:09:01 +0800 +Subject: ieee802154: hwsim: Fix memory leak in hwsim_add_one + +From: Dongliang Mu + +[ Upstream commit 28a5501c3383f0e6643012c187b7c2027ef42aea ] + +No matter from hwsim_remove or hwsim_del_radio_nl, hwsim_del fails to +remove the entry in the edges list. Take the example below, phy0, phy1 +and e0 will be deleted, resulting in e1 not freed and accessed in the +future. + + hwsim_phys + | + ------------------------------ + | | +phy0 (edges) phy1 (edges) + ----> e1 (idx = 1) ----> e0 (idx = 0) + +Fix this by deleting and freeing all the entries in the edges list +between hwsim_edge_unsubscribe_me and list_del(&phy->list). + +Reported-by: syzbot+b80c9959009a9325cdff@syzkaller.appspotmail.com +Fixes: 1c9f4a3fce77 ("ieee802154: hwsim: fix rcu handling") +Signed-off-by: Dongliang Mu +Acked-by: Alexander Aring +Link: https://lore.kernel.org/r/20210616020901.2759466-1-mudongliangabcd@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/mac802154_hwsim.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c +index 7a168170224a..6d479df2d9e5 100644 +--- a/drivers/net/ieee802154/mac802154_hwsim.c ++++ b/drivers/net/ieee802154/mac802154_hwsim.c +@@ -824,12 +824,17 @@ err_pib: + static void hwsim_del(struct hwsim_phy *phy) + { + struct hwsim_pib *pib; ++ struct hwsim_edge *e; + + hwsim_edge_unsubscribe_me(phy); + + list_del(&phy->list); + + rcu_read_lock(); ++ list_for_each_entry_rcu(e, &phy->edges, list) { ++ list_del_rcu(&e->list); ++ hwsim_free_edge(e); ++ } + pib = rcu_dereference(phy->pib); + rcu_read_unlock(); + +-- +2.30.2 + diff --git a/queue-5.12/ieee802154-hwsim-fix-possible-memory-leak-in-hwsim_s.patch b/queue-5.12/ieee802154-hwsim-fix-possible-memory-leak-in-hwsim_s.patch new file mode 100644 index 00000000000..772ddbb6197 --- /dev/null +++ b/queue-5.12/ieee802154-hwsim-fix-possible-memory-leak-in-hwsim_s.patch @@ -0,0 +1,49 @@ +From 9617b84f7abe648267b53dcb920603186746711c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jun 2021 09:58:12 +0800 +Subject: ieee802154: hwsim: Fix possible memory leak in + hwsim_subscribe_all_others + +From: Dongliang Mu + +[ Upstream commit ab372c2293f5d0b279f31c8d768566ea37602dc9 ] + +In hwsim_subscribe_all_others, the error handling code performs +incorrectly if the second hwsim_alloc_edge fails. When this issue occurs, +it goes to sub_fail, without cleaning the edges allocated before. + +Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb") +Signed-off-by: Dongliang Mu +Acked-by: Alexander Aring +Link: https://lore.kernel.org/r/20210611015812.1626999-1-mudongliangabcd@gmail.com +Signed-off-by: Stefan Schmidt +Signed-off-by: Sasha Levin +--- + drivers/net/ieee802154/mac802154_hwsim.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c +index c0bf7d78276e..7a168170224a 100644 +--- a/drivers/net/ieee802154/mac802154_hwsim.c ++++ b/drivers/net/ieee802154/mac802154_hwsim.c +@@ -715,6 +715,8 @@ static int hwsim_subscribe_all_others(struct hwsim_phy *phy) + + return 0; + ++sub_fail: ++ hwsim_edge_unsubscribe_me(phy); + me_fail: + rcu_read_lock(); + list_for_each_entry_rcu(e, &phy->edges, list) { +@@ -722,8 +724,6 @@ me_fail: + hwsim_free_edge(e); + } + rcu_read_unlock(); +-sub_fail: +- hwsim_edge_unsubscribe_me(phy); + return -ENOMEM; + } + +-- +2.30.2 + diff --git a/queue-5.12/iio-accel-bma180-fix-buffer-alignment-in-iio_push_to.patch b/queue-5.12/iio-accel-bma180-fix-buffer-alignment-in-iio_push_to.patch new file mode 100644 index 00000000000..17b90ace69b --- /dev/null +++ b/queue-5.12/iio-accel-bma180-fix-buffer-alignment-in-iio_push_to.patch @@ -0,0 +1,60 @@ +From f220b93a932c4838e51898438fe11dafd60ad97b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:03 +0100 +Subject: iio: accel: bma180: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit fc36da3131a747a9367a05caf06de19be1bcc972 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of this function. + +Fixes: b9a6a237ffc9 ("iio:bma180: Drop _update_scan_mode()") +Signed-off-by: Jonathan Cameron +Cc: Peter Meerwald +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-2-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/bma180.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/accel/bma180.c b/drivers/iio/accel/bma180.c +index 2a6d73cc7333..9b0018874eec 100644 +--- a/drivers/iio/accel/bma180.c ++++ b/drivers/iio/accel/bma180.c +@@ -164,7 +164,11 @@ struct bma180_data { + int scale; + int bw; + bool pmode; +- u8 buff[16]; /* 3x 16-bit + 8-bit + padding + timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s16 chan[4]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + enum bma180_chan { +@@ -943,12 +947,12 @@ static irqreturn_t bma180_trigger_handler(int irq, void *p) + mutex_unlock(&data->mutex); + goto err; + } +- ((s16 *)data->buff)[i++] = ret; ++ data->scan.chan[i++] = ret; + } + + mutex_unlock(&data->mutex); + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buff, time_ns); ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, time_ns); + err: + iio_trigger_notify_done(indio_dev->trig); + +-- +2.30.2 + diff --git a/queue-5.12/iio-accel-bma220-fix-buffer-alignment-in-iio_push_to.patch b/queue-5.12/iio-accel-bma220-fix-buffer-alignment-in-iio_push_to.patch new file mode 100644 index 00000000000..cccbdcaf93f --- /dev/null +++ b/queue-5.12/iio-accel-bma220-fix-buffer-alignment-in-iio_push_to.patch @@ -0,0 +1,59 @@ +From 191916977dd543e5d3cc1c2d3047763c9fc91a01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:04 +0100 +Subject: iio: accel: bma220: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 151dbf0078da98206817ee0b87d499035479ef11 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of this function. + +Fixes: 194dc4c71413 ("iio: accel: Add triggered buffer support for BMA220") +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-3-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/bma220_spi.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/accel/bma220_spi.c b/drivers/iio/accel/bma220_spi.c +index 3c9b0c6954e6..e8a9db1a82ad 100644 +--- a/drivers/iio/accel/bma220_spi.c ++++ b/drivers/iio/accel/bma220_spi.c +@@ -63,7 +63,11 @@ static const int bma220_scale_table[][2] = { + struct bma220_data { + struct spi_device *spi_device; + struct mutex lock; +- s8 buffer[16]; /* 3x8-bit channels + 5x8 padding + 8x8 timestamp */ ++ struct { ++ s8 chans[3]; ++ /* Ensure timestamp is naturally aligned. */ ++ s64 timestamp __aligned(8); ++ } scan; + u8 tx_buf[2] ____cacheline_aligned; + }; + +@@ -94,12 +98,12 @@ static irqreturn_t bma220_trigger_handler(int irq, void *p) + + mutex_lock(&data->lock); + data->tx_buf[0] = BMA220_REG_ACCEL_X | BMA220_READ_MASK; +- ret = spi_write_then_read(spi, data->tx_buf, 1, data->buffer, ++ ret = spi_write_then_read(spi, data->tx_buf, 1, &data->scan.chans, + ARRAY_SIZE(bma220_channels) - 1); + if (ret < 0) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + err: + mutex_unlock(&data->lock); +-- +2.30.2 + diff --git a/queue-5.12/iio-accel-hid-fix-buffer-alignment-in-iio_push_to_bu.patch b/queue-5.12/iio-accel-hid-fix-buffer-alignment-in-iio_push_to_bu.patch new file mode 100644 index 00000000000..821c497c403 --- /dev/null +++ b/queue-5.12/iio-accel-hid-fix-buffer-alignment-in-iio_push_to_bu.patch @@ -0,0 +1,68 @@ +From 8cd50f8a2f3fd3e12fef475c395a1f1886376a0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:05 +0100 +Subject: iio: accel: hid: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit c6559bf796ccdb3a0c79db846af96c8f7046880b ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. +Note this matches what was done in all the other hid sensor drivers. +This one was missed previously due to an extra level of indirection. + +Found during an audit of all calls of this function. + +Fixes: a96cd0f901ee ("iio: accel: hid-sensor-accel-3d: Add timestamp") +Signed-off-by: Jonathan Cameron +Cc: Srinivas Pandruvada +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-4-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/hid-sensor-accel-3d.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/drivers/iio/accel/hid-sensor-accel-3d.c b/drivers/iio/accel/hid-sensor-accel-3d.c +index 5d63ed19e6e2..d35d039c79cb 100644 +--- a/drivers/iio/accel/hid-sensor-accel-3d.c ++++ b/drivers/iio/accel/hid-sensor-accel-3d.c +@@ -28,8 +28,11 @@ struct accel_3d_state { + struct hid_sensor_hub_callbacks callbacks; + struct hid_sensor_common common_attributes; + struct hid_sensor_hub_attribute_info accel[ACCEL_3D_CHANNEL_MAX]; +- /* Reserve for 3 channels + padding + timestamp */ +- u32 accel_val[ACCEL_3D_CHANNEL_MAX + 3]; ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u32 accel_val[3]; ++ s64 timestamp __aligned(8); ++ } scan; + int scale_pre_decml; + int scale_post_decml; + int scale_precision; +@@ -241,8 +244,8 @@ static int accel_3d_proc_event(struct hid_sensor_hub_device *hsdev, + accel_state->timestamp = iio_get_time_ns(indio_dev); + + hid_sensor_push_data(indio_dev, +- accel_state->accel_val, +- sizeof(accel_state->accel_val), ++ &accel_state->scan, ++ sizeof(accel_state->scan), + accel_state->timestamp); + + accel_state->timestamp = 0; +@@ -267,7 +270,7 @@ static int accel_3d_capture_sample(struct hid_sensor_hub_device *hsdev, + case HID_USAGE_SENSOR_ACCEL_Y_AXIS: + case HID_USAGE_SENSOR_ACCEL_Z_AXIS: + offset = usage_id - HID_USAGE_SENSOR_ACCEL_X_AXIS; +- accel_state->accel_val[CHANNEL_SCAN_INDEX_X + offset] = ++ accel_state->scan.accel_val[CHANNEL_SCAN_INDEX_X + offset] = + *(u32 *)raw_data; + ret = 0; + break; +-- +2.30.2 + diff --git a/queue-5.12/iio-accel-kxcjk-1013-fix-buffer-alignment-in-iio_pus.patch b/queue-5.12/iio-accel-kxcjk-1013-fix-buffer-alignment-in-iio_pus.patch new file mode 100644 index 00000000000..1dca53c8b9b --- /dev/null +++ b/queue-5.12/iio-accel-kxcjk-1013-fix-buffer-alignment-in-iio_pus.patch @@ -0,0 +1,88 @@ +From 700ff48edb1eb3de916297c04843985e2b3e2786 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:06 +0100 +Subject: iio: accel: kxcjk-1013: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 3ab3aa2e7bd57497f9a7c6275c00dce237d2c9ba ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of this function. + +Fixes: 1a4fbf6a9286 ("iio: accel: kxcjk1013 3-axis accelerometer driver") +Signed-off-by: Jonathan Cameron +Cc: Srinivas Pandruvada +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-5-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/kxcjk-1013.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c +index 2fadafc860fd..5a19b5041e28 100644 +--- a/drivers/iio/accel/kxcjk-1013.c ++++ b/drivers/iio/accel/kxcjk-1013.c +@@ -133,6 +133,13 @@ enum kx_acpi_type { + ACPI_KIOX010A, + }; + ++enum kxcjk1013_axis { ++ AXIS_X, ++ AXIS_Y, ++ AXIS_Z, ++ AXIS_MAX ++}; ++ + struct kxcjk1013_data { + struct regulator_bulk_data regulators[2]; + struct i2c_client *client; +@@ -140,7 +147,11 @@ struct kxcjk1013_data { + struct iio_trigger *motion_trig; + struct iio_mount_matrix orientation; + struct mutex mutex; +- s16 buffer[8]; ++ /* Ensure timestamp naturally aligned */ ++ struct { ++ s16 chans[AXIS_MAX]; ++ s64 timestamp __aligned(8); ++ } scan; + u8 odr_bits; + u8 range; + int wake_thres; +@@ -154,13 +165,6 @@ struct kxcjk1013_data { + enum kx_acpi_type acpi_type; + }; + +-enum kxcjk1013_axis { +- AXIS_X, +- AXIS_Y, +- AXIS_Z, +- AXIS_MAX, +-}; +- + enum kxcjk1013_mode { + STANDBY, + OPERATION, +@@ -1094,12 +1098,12 @@ static irqreturn_t kxcjk1013_trigger_handler(int irq, void *p) + ret = i2c_smbus_read_i2c_block_data_or_emulated(data->client, + KXCJK1013_REG_XOUT_L, + AXIS_MAX * 2, +- (u8 *)data->buffer); ++ (u8 *)data->scan.chans); + mutex_unlock(&data->mutex); + if (ret < 0) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + data->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); +-- +2.30.2 + diff --git a/queue-5.12/iio-accel-mxc4005-fix-overread-of-data-and-alignment.patch b/queue-5.12/iio-accel-mxc4005-fix-overread-of-data-and-alignment.patch new file mode 100644 index 00000000000..b4c03bf40c6 --- /dev/null +++ b/queue-5.12/iio-accel-mxc4005-fix-overread-of-data-and-alignment.patch @@ -0,0 +1,63 @@ +From e0981309721da6ab8e9071176a173d0383c7c292 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:07 +0100 +Subject: iio: accel: mxc4005: Fix overread of data and alignment issue. + +From: Jonathan Cameron + +[ Upstream commit f65802284a3a337510d7f8f916c97d66c74f2e71 ] + +The bulk read size is based on the size of an array that also has +space for the timestamp alongside the channels. +Fix that and also fix alignment of the buffer passed +to iio_push_to_buffers_with_timestamp. + +Found during an audit of all calls to this function. + +Fixes: 1ce0eda0f757 ("iio: mxc4005: add triggered buffer mode for mxc4005") +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-6-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/mxc4005.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/accel/mxc4005.c b/drivers/iio/accel/mxc4005.c +index 0f8fd687866d..381c6b1be5f5 100644 +--- a/drivers/iio/accel/mxc4005.c ++++ b/drivers/iio/accel/mxc4005.c +@@ -56,7 +56,11 @@ struct mxc4005_data { + struct mutex mutex; + struct regmap *regmap; + struct iio_trigger *dready_trig; +- __be16 buffer[8]; ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ __be16 chans[3]; ++ s64 timestamp __aligned(8); ++ } scan; + bool trigger_enabled; + }; + +@@ -135,7 +139,7 @@ static int mxc4005_read_xyz(struct mxc4005_data *data) + int ret; + + ret = regmap_bulk_read(data->regmap, MXC4005_REG_XOUT_UPPER, +- data->buffer, sizeof(data->buffer)); ++ data->scan.chans, sizeof(data->scan.chans)); + if (ret < 0) { + dev_err(data->dev, "failed to read axes\n"); + return ret; +@@ -301,7 +305,7 @@ static irqreturn_t mxc4005_trigger_handler(int irq, void *private) + if (ret < 0) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + + err: +-- +2.30.2 + diff --git a/queue-5.12/iio-accel-stk8312-fix-buffer-alignment-in-iio_push_t.patch b/queue-5.12/iio-accel-stk8312-fix-buffer-alignment-in-iio_push_t.patch new file mode 100644 index 00000000000..fbe5bc18f3d --- /dev/null +++ b/queue-5.12/iio-accel-stk8312-fix-buffer-alignment-in-iio_push_t.patch @@ -0,0 +1,68 @@ +From 6cd8c48a0aa9a0fb45f9972bc0396872af160c1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:08 +0100 +Subject: iio: accel: stk8312: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit f40a71ffec808e7e51848f63f0c0d3c32d65081b ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of this function. + +Fixes: 95c12bba51c3 ("iio: accel: Add buffer mode for Sensortek STK8312") +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-7-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/stk8312.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/accel/stk8312.c b/drivers/iio/accel/stk8312.c +index 3b59887a8581..7d24801e8aa7 100644 +--- a/drivers/iio/accel/stk8312.c ++++ b/drivers/iio/accel/stk8312.c +@@ -103,7 +103,11 @@ struct stk8312_data { + u8 mode; + struct iio_trigger *dready_trig; + bool dready_trigger_on; +- s8 buffer[16]; /* 3x8-bit channels + 5x8 padding + 64-bit timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s8 chans[3]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + static IIO_CONST_ATTR(in_accel_scale_available, STK8312_SCALE_AVAIL); +@@ -438,7 +442,7 @@ static irqreturn_t stk8312_trigger_handler(int irq, void *p) + ret = i2c_smbus_read_i2c_block_data(data->client, + STK8312_REG_XOUT, + STK8312_ALL_CHANNEL_SIZE, +- data->buffer); ++ data->scan.chans); + if (ret < STK8312_ALL_CHANNEL_SIZE) { + dev_err(&data->client->dev, "register read failed\n"); + mutex_unlock(&data->lock); +@@ -452,12 +456,12 @@ static irqreturn_t stk8312_trigger_handler(int irq, void *p) + mutex_unlock(&data->lock); + goto err; + } +- data->buffer[i++] = ret; ++ data->scan.chans[i++] = ret; + } + } + mutex_unlock(&data->lock); + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); +-- +2.30.2 + diff --git a/queue-5.12/iio-accel-stk8ba50-fix-buffer-alignment-in-iio_push_.patch b/queue-5.12/iio-accel-stk8ba50-fix-buffer-alignment-in-iio_push_.patch new file mode 100644 index 00000000000..95342e66e42 --- /dev/null +++ b/queue-5.12/iio-accel-stk8ba50-fix-buffer-alignment-in-iio_push_.patch @@ -0,0 +1,71 @@ +From a992a8281a5ab534c532b5c93dbf2e911bf2183b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:09 +0100 +Subject: iio: accel: stk8ba50: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 334883894bc1e145a1e0f5de1b0d1b6a1133f0e6 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of this function. + +Fixes: db6a19b8251f ("iio: accel: Add trigger support for STK8BA50") +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-8-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/stk8ba50.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/iio/accel/stk8ba50.c b/drivers/iio/accel/stk8ba50.c +index 3ead378b02c9..e8087d7ee49f 100644 +--- a/drivers/iio/accel/stk8ba50.c ++++ b/drivers/iio/accel/stk8ba50.c +@@ -91,12 +91,11 @@ struct stk8ba50_data { + u8 sample_rate_idx; + struct iio_trigger *dready_trig; + bool dready_trigger_on; +- /* +- * 3 x 16-bit channels (10-bit data, 6-bit padding) + +- * 1 x 16 padding + +- * 4 x 16 64-bit timestamp +- */ +- s16 buffer[8]; ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s16 chans[3]; ++ s64 timetamp __aligned(8); ++ } scan; + }; + + #define STK8BA50_ACCEL_CHANNEL(index, reg, axis) { \ +@@ -324,7 +323,7 @@ static irqreturn_t stk8ba50_trigger_handler(int irq, void *p) + ret = i2c_smbus_read_i2c_block_data(data->client, + STK8BA50_REG_XOUT, + STK8BA50_ALL_CHANNEL_SIZE, +- (u8 *)data->buffer); ++ (u8 *)data->scan.chans); + if (ret < STK8BA50_ALL_CHANNEL_SIZE) { + dev_err(&data->client->dev, "register read failed\n"); + goto err; +@@ -337,10 +336,10 @@ static irqreturn_t stk8ba50_trigger_handler(int irq, void *p) + if (ret < 0) + goto err; + +- data->buffer[i++] = ret; ++ data->scan.chans[i++] = ret; + } + } +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + err: + mutex_unlock(&data->lock); +-- +2.30.2 + diff --git a/queue-5.12/iio-adc-at91-sama5d2-fix-buffer-alignment-in-iio_pus.patch b/queue-5.12/iio-adc-at91-sama5d2-fix-buffer-alignment-in-iio_pus.patch new file mode 100644 index 00000000000..1607583be01 --- /dev/null +++ b/queue-5.12/iio-adc-at91-sama5d2-fix-buffer-alignment-in-iio_pus.patch @@ -0,0 +1,45 @@ +From 139cfadbd0026cb4510e6e3b8b7b1c518fd59803 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 16:22:54 +0100 +Subject: iio: adc: at91-sama5d2: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cameron + +[ Upstream commit 8f884758966259fa8c50c137ac6d4ce9bb7859db ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of this function. + +Fixes: 5e1a1da0f8c9 ("iio: adc: at91-sama5d2_adc: add hw trigger and buffer support") +Signed-off-by: Jonathan Cameron +Cc: Eugen Hristev +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20210613152301.571002-2-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/at91-sama5d2_adc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/at91-sama5d2_adc.c b/drivers/iio/adc/at91-sama5d2_adc.c +index a7826f097b95..d356b515df09 100644 +--- a/drivers/iio/adc/at91-sama5d2_adc.c ++++ b/drivers/iio/adc/at91-sama5d2_adc.c +@@ -403,7 +403,8 @@ struct at91_adc_state { + struct at91_adc_dma dma_st; + struct at91_adc_touch touch_st; + struct iio_dev *indio_dev; +- u16 buffer[AT91_BUFFER_MAX_HWORDS]; ++ /* Ensure naturally aligned timestamp */ ++ u16 buffer[AT91_BUFFER_MAX_HWORDS] __aligned(8); + /* + * lock to prevent concurrent 'single conversion' requests through + * sysfs. +-- +2.30.2 + diff --git a/queue-5.12/iio-adc-hx711-fix-buffer-alignment-in-iio_push_to_bu.patch b/queue-5.12/iio-adc-hx711-fix-buffer-alignment-in-iio_push_to_bu.patch new file mode 100644 index 00000000000..29ce6d8de20 --- /dev/null +++ b/queue-5.12/iio-adc-hx711-fix-buffer-alignment-in-iio_push_to_bu.patch @@ -0,0 +1,47 @@ +From 70f19d052d908ff2ba9c9d27974b6d271df2a4f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 16:22:55 +0100 +Subject: iio: adc: hx711: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cameron + +[ Upstream commit afe2a789fbf7acd1a05407fc7839cc08d23825e3 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of this function. + +Fixes: d3bf60450d47 ("iio: hx711: add triggered buffer support") +Signed-off-by: Jonathan Cameron +Cc: Andreas Klinger +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20210613152301.571002-3-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/hx711.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/adc/hx711.c b/drivers/iio/adc/hx711.c +index 6a173531d355..f7ee856a6b8b 100644 +--- a/drivers/iio/adc/hx711.c ++++ b/drivers/iio/adc/hx711.c +@@ -86,9 +86,9 @@ struct hx711_data { + struct mutex lock; + /* + * triggered buffer +- * 2x32-bit channel + 64-bit timestamp ++ * 2x32-bit channel + 64-bit naturally aligned timestamp + */ +- u32 buffer[4]; ++ u32 buffer[4] __aligned(8); + /* + * delay after a rising edge on SCK until the data is ready DOUT + * this is dependent on the hx711 where the datasheet tells a +-- +2.30.2 + diff --git a/queue-5.12/iio-adc-mxs-lradc-fix-buffer-alignment-in-iio_push_t.patch b/queue-5.12/iio-adc-mxs-lradc-fix-buffer-alignment-in-iio_push_t.patch new file mode 100644 index 00000000000..ca624f5b644 --- /dev/null +++ b/queue-5.12/iio-adc-mxs-lradc-fix-buffer-alignment-in-iio_push_t.patch @@ -0,0 +1,47 @@ +From 56ee77c5679166b262ce4da941bc7b24636b70e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 16:22:56 +0100 +Subject: iio: adc: mxs-lradc: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cameron + +[ Upstream commit 6a6be221b8bd561b053f0701ec752a5ed9007f69 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. +Add a comment on why the buffer is the size it is as not immediately +obvious. + +Found during an audit of all calls of this function. + +Fixes: 6dd112b9f85e ("iio: adc: mxs-lradc: Add support for ADC driver") +Signed-off-by: Jonathan Cameron +Cc: Andreas Klinger +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20210613152301.571002-4-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/mxs-lradc-adc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/mxs-lradc-adc.c b/drivers/iio/adc/mxs-lradc-adc.c +index 30e29f44ebd2..c480cb489c1a 100644 +--- a/drivers/iio/adc/mxs-lradc-adc.c ++++ b/drivers/iio/adc/mxs-lradc-adc.c +@@ -115,7 +115,8 @@ struct mxs_lradc_adc { + struct device *dev; + + void __iomem *base; +- u32 buffer[10]; ++ /* Maximum of 8 channels + 8 byte ts */ ++ u32 buffer[10] __aligned(8); + struct iio_trigger *trig; + struct completion completion; + spinlock_t lock; +-- +2.30.2 + diff --git a/queue-5.12/iio-adc-ti-ads1015-fix-buffer-alignment-in-iio_push_.patch b/queue-5.12/iio-adc-ti-ads1015-fix-buffer-alignment-in-iio_push_.patch new file mode 100644 index 00000000000..cfc6039aab5 --- /dev/null +++ b/queue-5.12/iio-adc-ti-ads1015-fix-buffer-alignment-in-iio_push_.patch @@ -0,0 +1,63 @@ +From d0aae141e33eb989e0f9cec45383dd4018d89168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:10 +0100 +Subject: iio: adc: ti-ads1015: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit d85d71dd1ab67eaa7351f69fec512d8f09d164e1 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of this function. + +Fixes: ecc24e72f437 ("iio: adc: Add TI ADS1015 ADC driver support") +Signed-off-by: Jonathan Cameron +Cc: Daniel Baluta +Cc: Andy Shevchenko +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-9-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ti-ads1015.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/adc/ti-ads1015.c b/drivers/iio/adc/ti-ads1015.c +index 9fef39bcf997..5b828428be77 100644 +--- a/drivers/iio/adc/ti-ads1015.c ++++ b/drivers/iio/adc/ti-ads1015.c +@@ -395,10 +395,14 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p) + struct iio_poll_func *pf = p; + struct iio_dev *indio_dev = pf->indio_dev; + struct ads1015_data *data = iio_priv(indio_dev); +- s16 buf[8]; /* 1x s16 ADC val + 3x s16 padding + 4x s16 timestamp */ ++ /* Ensure natural alignment of timestamp */ ++ struct { ++ s16 chan; ++ s64 timestamp __aligned(8); ++ } scan; + int chan, ret, res; + +- memset(buf, 0, sizeof(buf)); ++ memset(&scan, 0, sizeof(scan)); + + mutex_lock(&data->lock); + chan = find_first_bit(indio_dev->active_scan_mask, +@@ -409,10 +413,10 @@ static irqreturn_t ads1015_trigger_handler(int irq, void *p) + goto err; + } + +- buf[0] = res; ++ scan.chan = res; + mutex_unlock(&data->lock); + +- iio_push_to_buffers_with_timestamp(indio_dev, buf, ++ iio_push_to_buffers_with_timestamp(indio_dev, &scan, + iio_get_time_ns(indio_dev)); + + err: +-- +2.30.2 + diff --git a/queue-5.12/iio-adc-ti-ads8688-fix-alignment-of-buffer-in-iio_pu.patch b/queue-5.12/iio-adc-ti-ads8688-fix-alignment-of-buffer-in-iio_pu.patch new file mode 100644 index 00000000000..74cd3b7d7fb --- /dev/null +++ b/queue-5.12/iio-adc-ti-ads8688-fix-alignment-of-buffer-in-iio_pu.patch @@ -0,0 +1,43 @@ +From 794b3dbb1186077be79aa1bd367f9af09cb753bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 16:22:57 +0100 +Subject: iio: adc: ti-ads8688: Fix alignment of buffer in + iio_push_to_buffers_with_timestamp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cameron + +[ Upstream commit 61fa5dfa5f52806f5ce37a0ba5712c271eb22f98 ] + +Add __aligned(8) to ensure the buffer passed to +iio_push_to_buffers_with_timestamp() is suitable for the naturally +aligned timestamp that will be inserted. + +Fixes: f214ff521fb1 ("iio: ti-ads8688: Update buffer allocation for timestamps") +Signed-off-by: Jonathan Cameron +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20210613152301.571002-5-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/ti-ads8688.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/ti-ads8688.c b/drivers/iio/adc/ti-ads8688.c +index 16bcb37eebb7..79c803537dc4 100644 +--- a/drivers/iio/adc/ti-ads8688.c ++++ b/drivers/iio/adc/ti-ads8688.c +@@ -383,7 +383,8 @@ static irqreturn_t ads8688_trigger_handler(int irq, void *p) + { + struct iio_poll_func *pf = p; + struct iio_dev *indio_dev = pf->indio_dev; +- u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)]; ++ /* Ensure naturally aligned timestamp */ ++ u16 buffer[ADS8688_MAX_CHANNELS + sizeof(s64)/sizeof(u16)] __aligned(8); + int i, j = 0; + + for (i = 0; i < indio_dev->masklength; i++) { +-- +2.30.2 + diff --git a/queue-5.12/iio-adc-vf610-fix-buffer-alignment-in-iio_push_to_bu.patch b/queue-5.12/iio-adc-vf610-fix-buffer-alignment-in-iio_push_to_bu.patch new file mode 100644 index 00000000000..6039dbcaeeb --- /dev/null +++ b/queue-5.12/iio-adc-vf610-fix-buffer-alignment-in-iio_push_to_bu.patch @@ -0,0 +1,59 @@ +From 7b1c11be7130c677f1af5f411526f38f990a8e99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:11 +0100 +Subject: iio: adc: vf610: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 7765dfaa22ea08abf0c175e7553826ba2a939632 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes: 0010d6b44406 ("iio: adc: vf610: Add IIO buffer support for Vybrid ADC") +Signed-off-by: Jonathan Cameron +Cc: Stefan-Gabriel Mirea +Cc: Sanchayan Maity +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-10-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/vf610_adc.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c +index 1d794cf3e3f1..fd57fc43e8e5 100644 +--- a/drivers/iio/adc/vf610_adc.c ++++ b/drivers/iio/adc/vf610_adc.c +@@ -167,7 +167,11 @@ struct vf610_adc { + u32 sample_freq_avail[5]; + + struct completion completion; +- u16 buffer[8]; ++ /* Ensure the timestamp is naturally aligned */ ++ struct { ++ u16 chan; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + static const u32 vf610_hw_avgs[] = { 1, 4, 8, 16, 32 }; +@@ -579,9 +583,9 @@ static irqreturn_t vf610_adc_isr(int irq, void *dev_id) + if (coco & VF610_ADC_HS_COCO0) { + info->value = vf610_adc_read_data(info); + if (iio_buffer_enabled(indio_dev)) { +- info->buffer[0] = info->value; ++ info->scan.chan = info->value; + iio_push_to_buffers_with_timestamp(indio_dev, +- info->buffer, ++ &info->scan, + iio_get_time_ns(indio_dev)); + iio_trigger_notify_done(indio_dev->trig); + } else +-- +2.30.2 + diff --git a/queue-5.12/iio-adis16400-do-not-return-ints-in-irq-handlers.patch b/queue-5.12/iio-adis16400-do-not-return-ints-in-irq-handlers.patch new file mode 100644 index 00000000000..72ca6edbb00 --- /dev/null +++ b/queue-5.12/iio-adis16400-do-not-return-ints-in-irq-handlers.patch @@ -0,0 +1,42 @@ +From 85e22299f59bcb7cd10d2edf40de7f4d5d4aa334 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Apr 2021 12:19:04 +0200 +Subject: iio: adis16400: do not return ints in irq handlers + +From: Nuno Sa + +[ Upstream commit ab3df79782e7d8a27a58576c9b4e8c6c4879ad79 ] + +On an IRQ handler we should not return normal error codes as 'irqreturn_t' +is expected. + +Not necessary to apply to stable as the original check cannot fail and +as such the bug cannot actually occur. + +Fixes: 5eda3550a3cc1 ("staging:iio:adis16400: Preallocate transfer message") +Reviewed-by: Alexandru Ardelean +Signed-off-by: Nuno Sa +Link: https://lore.kernel.org/r/20210422101911.135630-3-nuno.sa@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/adis16400.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/iio/imu/adis16400.c b/drivers/iio/imu/adis16400.c +index 785a4ce606d8..4aff16466da0 100644 +--- a/drivers/iio/imu/adis16400.c ++++ b/drivers/iio/imu/adis16400.c +@@ -647,9 +647,6 @@ static irqreturn_t adis16400_trigger_handler(int irq, void *p) + void *buffer; + int ret; + +- if (!adis->buffer) +- return -ENOMEM; +- + if (!(st->variant->flags & ADIS16400_NO_BURST) && + st->adis.spi->max_speed_hz > ADIS16400_SPI_BURST) { + st->adis.spi->max_speed_hz = ADIS16400_SPI_BURST; +-- +2.30.2 + diff --git a/queue-5.12/iio-adis16475-do-not-return-ints-in-irq-handlers.patch b/queue-5.12/iio-adis16475-do-not-return-ints-in-irq-handlers.patch new file mode 100644 index 00000000000..7ab87788db5 --- /dev/null +++ b/queue-5.12/iio-adis16475-do-not-return-ints-in-irq-handlers.patch @@ -0,0 +1,43 @@ +From 34bc70ad20a2d1f66754b3b8ee1df8a0bf33a3ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 10:54:49 +0200 +Subject: iio: adis16475: do not return ints in irq handlers + +From: Nuno Sa + +[ Upstream commit 00a72db718fa198da3946286dcad222399ccd4fb ] + +On an IRQ handler we should not return normal error codes as 'irqreturn_t' +is expected. + +This is done by jumping to the 'check_burst32' label where we return +'IRQ_HANDLED'. Note that it is fine to do the burst32 check in this +error path. If we have proper settings to apply burst32, we might just +do the setup now so that the next sample already uses it. + +Fixes: fff7352bf7a3c ("iio: imu: Add support for adis16475") +Reviewed-by: Alexandru Ardelean +Signed-off-by: Nuno Sa +Link: https://lore.kernel.org/r/20210427085454.30616-2-nuno.sa@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/adis16475.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/imu/adis16475.c b/drivers/iio/imu/adis16475.c +index 197d48240991..3c4e4deb8760 100644 +--- a/drivers/iio/imu/adis16475.c ++++ b/drivers/iio/imu/adis16475.c +@@ -990,7 +990,7 @@ static irqreturn_t adis16475_trigger_handler(int irq, void *p) + + ret = spi_sync(adis->spi, &adis->msg); + if (ret) +- return ret; ++ goto check_burst32; + + adis->spi->max_speed_hz = cached_spi_speed_hz; + buffer = adis->buffer; +-- +2.30.2 + diff --git a/queue-5.12/iio-adis_buffer-do-not-return-ints-in-irq-handlers.patch b/queue-5.12/iio-adis_buffer-do-not-return-ints-in-irq-handlers.patch new file mode 100644 index 00000000000..283f422322b --- /dev/null +++ b/queue-5.12/iio-adis_buffer-do-not-return-ints-in-irq-handlers.patch @@ -0,0 +1,42 @@ +From 93238001fdd178d6effd9da01f3e9af52b74a298 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Apr 2021 12:19:03 +0200 +Subject: iio: adis_buffer: do not return ints in irq handlers + +From: Nuno Sa + +[ Upstream commit d877539ad8e8fdde9af69887055fec6402be1a13 ] + +On an IRQ handler we should not return normal error codes as 'irqreturn_t' +is expected. + +Not necessarily stable material as the old check cannot fail, so it's a bug +we can not hit. + +Fixes: ccd2b52f4ac69 ("staging:iio: Add common ADIS library") +Reviewed-by: Alexandru Ardelean +Signed-off-by: Nuno Sa +Link: https://lore.kernel.org/r/20210422101911.135630-2-nuno.sa@analog.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/adis_buffer.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c +index ac354321f63a..175af154e443 100644 +--- a/drivers/iio/imu/adis_buffer.c ++++ b/drivers/iio/imu/adis_buffer.c +@@ -129,9 +129,6 @@ static irqreturn_t adis_trigger_handler(int irq, void *p) + struct adis *adis = iio_device_get_drvdata(indio_dev); + int ret; + +- if (!adis->buffer) +- return -ENOMEM; +- + if (adis->data->has_paging) { + mutex_lock(&adis->state_lock); + if (adis->current_page != 0) { +-- +2.30.2 + diff --git a/queue-5.12/iio-chemical-atlas-fix-buffer-alignment-in-iio_push_.patch b/queue-5.12/iio-chemical-atlas-fix-buffer-alignment-in-iio_push_.patch new file mode 100644 index 00000000000..20a3e0c7629 --- /dev/null +++ b/queue-5.12/iio-chemical-atlas-fix-buffer-alignment-in-iio_push_.patch @@ -0,0 +1,47 @@ +From 2e499de05cb7ae4dc0933719d3b578269d0a0cd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:13:46 +0100 +Subject: iio: chemical: atlas: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit b0f5d8db7348a6ce5cdd79fba46ebc91eebc8fd9 ] + +Variable location for the timestamp, so just use __aligned(8) +to ensure it is always possible to naturally align it. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes tag is not accurate, but it will need manual backporting beyond +that point if anyone cares. + +Fixes: 0d15190f53b4 ("iio: chemical: atlas-ph-sensor: rename atlas-ph-sensor to atlas-sensor") +Signed-off-by: Jonathan Cameron +Cc: Matt Ranostay +Acked-by: Matt Ranostay +Link: https://lore.kernel.org/r/20210501171352.512953-6-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/chemical/atlas-sensor.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/chemical/atlas-sensor.c b/drivers/iio/chemical/atlas-sensor.c +index cdab9d04dedd..0c8a50de8940 100644 +--- a/drivers/iio/chemical/atlas-sensor.c ++++ b/drivers/iio/chemical/atlas-sensor.c +@@ -91,8 +91,8 @@ struct atlas_data { + struct regmap *regmap; + struct irq_work work; + unsigned int interrupt_enabled; +- +- __be32 buffer[6]; /* 96-bit data + 32-bit pad + 64-bit timestamp */ ++ /* 96-bit data + 32-bit pad + 64-bit timestamp */ ++ __be32 buffer[6] __aligned(8); + }; + + static const struct regmap_config atlas_regmap_config = { +-- +2.30.2 + diff --git a/queue-5.12/iio-cros_ec_sensors-fix-alignment-of-buffer-in-iio_p.patch b/queue-5.12/iio-cros_ec_sensors-fix-alignment-of-buffer-in-iio_p.patch new file mode 100644 index 00000000000..3f0fe7e99db --- /dev/null +++ b/queue-5.12/iio-cros_ec_sensors-fix-alignment-of-buffer-in-iio_p.patch @@ -0,0 +1,46 @@ +From b1c325ac67b9ea7fc2f5b95c02c21f1ccf128513 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:13:47 +0100 +Subject: iio: cros_ec_sensors: Fix alignment of buffer in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 8dea228b174ac9637b567e5ef54f4c40db4b3c41 ] + +The samples buffer is passed to iio_push_to_buffers_with_timestamp() +which requires a buffer aligned to 8 bytes as it is assumed that +the timestamp will be naturally aligned if present. + +Fixes tag is inaccurate but prior to that likely manual backporting needed +(for anything before 4.18) Earlier than that the include file to fix is +drivers/iio/common/cros_ec_sensors/cros_ec_sensors_core.h: +commit 974e6f02e27 ("iio: cros_ec_sensors_core: Add common functions +for the ChromeOS EC Sensor Hub.") present since kernel stable 4.10. +(Thanks to Gwendal for tracking this down) + +Fixes: 5a0b8cb46624c ("iio: cros_ec: Move cros_ec_sensors_core.h in /include") +Signed-off-by: Jonathan Cameron +Reviewed-by: Gwendal Grignou +--- + include/linux/iio/common/cros_ec_sensors_core.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/iio/common/cros_ec_sensors_core.h b/include/linux/iio/common/cros_ec_sensors_core.h +index c9b80be82440..f82857bd693f 100644 +--- a/include/linux/iio/common/cros_ec_sensors_core.h ++++ b/include/linux/iio/common/cros_ec_sensors_core.h +@@ -77,7 +77,7 @@ struct cros_ec_sensors_core_state { + u16 scale; + } calib[CROS_EC_SENSOR_MAX_AXIS]; + s8 sign[CROS_EC_SENSOR_MAX_AXIS]; +- u8 samples[CROS_EC_SAMPLE_SIZE]; ++ u8 samples[CROS_EC_SAMPLE_SIZE] __aligned(8); + + int (*read_ec_sensors_data)(struct iio_dev *indio_dev, + unsigned long scan_mask, s16 *data); +-- +2.30.2 + diff --git a/queue-5.12/iio-gyro-bmg160-fix-buffer-alignment-in-iio_push_to_.patch b/queue-5.12/iio-gyro-bmg160-fix-buffer-alignment-in-iio_push_to_.patch new file mode 100644 index 00000000000..4f83ba787e1 --- /dev/null +++ b/queue-5.12/iio-gyro-bmg160-fix-buffer-alignment-in-iio_push_to_.patch @@ -0,0 +1,61 @@ +From b7232b25293ca61ed6b63d056290ac30cdd4b118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:12 +0100 +Subject: iio: gyro: bmg160: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 06778d881f3798ce93ffbbbf801234292250b598 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes: 13426454b649 ("iio: bmg160: Separate i2c and core driver") +Signed-off-by: Jonathan Cameron +Cc: Stephan Gerhold +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-11-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/gyro/bmg160_core.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c +index 029ef4c34604..457fa8702d19 100644 +--- a/drivers/iio/gyro/bmg160_core.c ++++ b/drivers/iio/gyro/bmg160_core.c +@@ -98,7 +98,11 @@ struct bmg160_data { + struct iio_trigger *motion_trig; + struct iio_mount_matrix orientation; + struct mutex mutex; +- s16 buffer[8]; ++ /* Ensure naturally aligned timestamp */ ++ struct { ++ s16 chans[3]; ++ s64 timestamp __aligned(8); ++ } scan; + u32 dps_range; + int ev_enable_state; + int slope_thres; +@@ -882,12 +886,12 @@ static irqreturn_t bmg160_trigger_handler(int irq, void *p) + + mutex_lock(&data->mutex); + ret = regmap_bulk_read(data->regmap, BMG160_REG_XOUT_L, +- data->buffer, AXIS_MAX * 2); ++ data->scan.chans, AXIS_MAX * 2); + mutex_unlock(&data->mutex); + if (ret < 0) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); +-- +2.30.2 + diff --git a/queue-5.12/iio-humidity-am2315-fix-buffer-alignment-in-iio_push.patch b/queue-5.12/iio-humidity-am2315-fix-buffer-alignment-in-iio_push.patch new file mode 100644 index 00000000000..6aa4441cbbe --- /dev/null +++ b/queue-5.12/iio-humidity-am2315-fix-buffer-alignment-in-iio_push.patch @@ -0,0 +1,71 @@ +From 037a5915413a112f25751c7828500079b0eaccde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:13 +0100 +Subject: iio: humidity: am2315: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit f4ca2e2595d9fee65d5ce0d218b22ce00e5b2915 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes: 0d96d5ead3f7 ("iio: humidity: Add triggered buffer support for AM2315") +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-12-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/humidity/am2315.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/iio/humidity/am2315.c b/drivers/iio/humidity/am2315.c +index 02ad1767c845..3398fa413ec5 100644 +--- a/drivers/iio/humidity/am2315.c ++++ b/drivers/iio/humidity/am2315.c +@@ -33,7 +33,11 @@ + struct am2315_data { + struct i2c_client *client; + struct mutex lock; +- s16 buffer[8]; /* 2x16-bit channels + 2x16 padding + 4x16 timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s16 chans[2]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + struct am2315_sensor_data { +@@ -167,20 +171,20 @@ static irqreturn_t am2315_trigger_handler(int irq, void *p) + + mutex_lock(&data->lock); + if (*(indio_dev->active_scan_mask) == AM2315_ALL_CHANNEL_MASK) { +- data->buffer[0] = sensor_data.hum_data; +- data->buffer[1] = sensor_data.temp_data; ++ data->scan.chans[0] = sensor_data.hum_data; ++ data->scan.chans[1] = sensor_data.temp_data; + } else { + i = 0; + for_each_set_bit(bit, indio_dev->active_scan_mask, + indio_dev->masklength) { +- data->buffer[i] = (bit ? sensor_data.temp_data : +- sensor_data.hum_data); ++ data->scan.chans[i] = (bit ? sensor_data.temp_data : ++ sensor_data.hum_data); + i++; + } + } + mutex_unlock(&data->lock); + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + err: + iio_trigger_notify_done(indio_dev->trig); +-- +2.30.2 + diff --git a/queue-5.12/iio-light-isl29125-fix-buffer-alignment-in-iio_push_.patch b/queue-5.12/iio-light-isl29125-fix-buffer-alignment-in-iio_push_.patch new file mode 100644 index 00000000000..5d744ae9499 --- /dev/null +++ b/queue-5.12/iio-light-isl29125-fix-buffer-alignment-in-iio_push_.patch @@ -0,0 +1,58 @@ +From 129df66b60bb7739f34af2794a8c6527d72cf843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:19 +0100 +Subject: iio: light: isl29125: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 3d4725194de6935dba2ad7c9cc075c885008f747 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes: 6c25539cbc46 ("iio: Add Intersil isl29125 digital color light sensor driver") +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-18-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/light/isl29125.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/light/isl29125.c b/drivers/iio/light/isl29125.c +index b93b85dbc3a6..ba53b50d711a 100644 +--- a/drivers/iio/light/isl29125.c ++++ b/drivers/iio/light/isl29125.c +@@ -51,7 +51,11 @@ + struct isl29125_data { + struct i2c_client *client; + u8 conf1; +- u16 buffer[8]; /* 3x 16-bit, padding, 8 bytes timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u16 chans[3]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + #define ISL29125_CHANNEL(_color, _si) { \ +@@ -184,10 +188,10 @@ static irqreturn_t isl29125_trigger_handler(int irq, void *p) + if (ret < 0) + goto done; + +- data->buffer[j++] = ret; ++ data->scan.chans[j++] = ret; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + iio_get_time_ns(indio_dev)); + + done: +-- +2.30.2 + diff --git a/queue-5.12/iio-light-tcs3414-fix-buffer-alignment-in-iio_push_t.patch b/queue-5.12/iio-light-tcs3414-fix-buffer-alignment-in-iio_push_t.patch new file mode 100644 index 00000000000..1146aa0265f --- /dev/null +++ b/queue-5.12/iio-light-tcs3414-fix-buffer-alignment-in-iio_push_t.patch @@ -0,0 +1,58 @@ +From 1c38102ab1eac29a72ec9c9b7f8b1cd0fefedc05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:20 +0100 +Subject: iio: light: tcs3414: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit ff08fbc22ab32ccc6690c21b0e5e1d402dcc076f ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes: a244e7b57f0f ("iio: Add driver for AMS/TAOS tcs3414 digital color sensor") +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-19-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/light/tcs3414.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/light/tcs3414.c b/drivers/iio/light/tcs3414.c +index 6fe5d46f80d4..0593abd600ec 100644 +--- a/drivers/iio/light/tcs3414.c ++++ b/drivers/iio/light/tcs3414.c +@@ -53,7 +53,11 @@ struct tcs3414_data { + u8 control; + u8 gain; + u8 timing; +- u16 buffer[8]; /* 4x 16-bit + 8 bytes timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u16 chans[4]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + #define TCS3414_CHANNEL(_color, _si, _addr) { \ +@@ -209,10 +213,10 @@ static irqreturn_t tcs3414_trigger_handler(int irq, void *p) + if (ret < 0) + goto done; + +- data->buffer[j++] = ret; ++ data->scan.chans[j++] = ret; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + iio_get_time_ns(indio_dev)); + + done: +-- +2.30.2 + diff --git a/queue-5.12/iio-light-tcs3472-fix-buffer-alignment-in-iio_push_t.patch b/queue-5.12/iio-light-tcs3472-fix-buffer-alignment-in-iio_push_t.patch new file mode 100644 index 00000000000..a245c508a4f --- /dev/null +++ b/queue-5.12/iio-light-tcs3472-fix-buffer-alignment-in-iio_push_t.patch @@ -0,0 +1,62 @@ +From 2e4668fdd1238377d376cd01ab04a36bc462d6e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:21 +0100 +Subject: iio: light: tcs3472: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit df2f37cffd6ed486d613e7ee22aadc8e49ae2dd3 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp(). + +Fixes tag is not strictly accurate as prior to that patch there was +potentially an unaligned write. However, any backport past there will +need to be done manually. + +Fixes: 0624bf847dd0 ("iio:tcs3472: Use iio_push_to_buffers_with_timestamp()") +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-20-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/light/tcs3472.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/light/tcs3472.c b/drivers/iio/light/tcs3472.c +index b41068492338..371c6a39a165 100644 +--- a/drivers/iio/light/tcs3472.c ++++ b/drivers/iio/light/tcs3472.c +@@ -64,7 +64,11 @@ struct tcs3472_data { + u8 control; + u8 atime; + u8 apers; +- u16 buffer[8]; /* 4 16-bit channels + 64-bit timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u16 chans[4]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + static const struct iio_event_spec tcs3472_events[] = { +@@ -386,10 +390,10 @@ static irqreturn_t tcs3472_trigger_handler(int irq, void *p) + if (ret < 0) + goto done; + +- data->buffer[j++] = ret; ++ data->scan.chans[j++] = ret; + } + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + iio_get_time_ns(indio_dev)); + + done: +-- +2.30.2 + diff --git a/queue-5.12/iio-light-vcnl4000-fix-buffer-alignment-in-iio_push_.patch b/queue-5.12/iio-light-vcnl4000-fix-buffer-alignment-in-iio_push_.patch new file mode 100644 index 00000000000..04c5d1f61a5 --- /dev/null +++ b/queue-5.12/iio-light-vcnl4000-fix-buffer-alignment-in-iio_push_.patch @@ -0,0 +1,49 @@ +From 533ab3fe9c5b3a41ef7b1aab4704cb68d306a8b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 16:22:59 +0100 +Subject: iio: light: vcnl4000: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cameron + +[ Upstream commit dce793c0ab00c35039028fdcd5ce123805a01361 ] + +Add __aligned(8) to ensure the buffer passed to +iio_push_to_buffers_with_timestamp() is suitable for the naturally +aligned timestamp that will be inserted. + +Here an explicit structure is not used, because the holes would +necessitate the addition of an explict memset(), to avoid a kernel +data leak, making for a less minimal fix. + +Found during an audit of all callers of iio_push_to_buffers_with_timestamp() + +Fixes: 8fe78d5261e7 ("iio: vcnl4000: Add buffer support for VCNL4010/20.") +Signed-off-by: Jonathan Cameron +Cc: Mathieu Othacehe +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20210613152301.571002-7-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/light/vcnl4000.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/light/vcnl4000.c b/drivers/iio/light/vcnl4000.c +index fff4b36b8b58..f4feb44903b3 100644 +--- a/drivers/iio/light/vcnl4000.c ++++ b/drivers/iio/light/vcnl4000.c +@@ -910,7 +910,7 @@ static irqreturn_t vcnl4010_trigger_handler(int irq, void *p) + struct iio_dev *indio_dev = pf->indio_dev; + struct vcnl4000_data *data = iio_priv(indio_dev); + const unsigned long *active_scan_mask = indio_dev->active_scan_mask; +- u16 buffer[8] = {0}; /* 1x16-bit + ts */ ++ u16 buffer[8] __aligned(8) = {0}; /* 1x16-bit + naturally aligned ts */ + bool data_read = false; + unsigned long isr; + int val = 0; +-- +2.30.2 + diff --git a/queue-5.12/iio-light-vcnl4035-fix-buffer-alignment-in-iio_push_.patch b/queue-5.12/iio-light-vcnl4035-fix-buffer-alignment-in-iio_push_.patch new file mode 100644 index 00000000000..297aa6e1fb5 --- /dev/null +++ b/queue-5.12/iio-light-vcnl4035-fix-buffer-alignment-in-iio_push_.patch @@ -0,0 +1,48 @@ +From cc79408a67b8cf74e7988e64ade2c1fb9175ff39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 16:23:00 +0100 +Subject: iio: light: vcnl4035: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cameron + +[ Upstream commit ec90b52c07c0403a6db60d752484ec08d605ead0 ] + +Add __aligned(8) to ensure the buffer passed to +iio_push_to_buffers_with_timestamp() is suitable for the naturally +aligned timestamp that will be inserted. + +Here an explicit structure is not used, because the holes would +necessitate the addition of an explict memset(), to avoid a potential +kernel data leak, making for a less minimal fix. + +Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035") +Signed-off-by: Jonathan Cameron +Cc: Parthiban Nallathambi +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20210613152301.571002-8-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/light/vcnl4035.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/light/vcnl4035.c b/drivers/iio/light/vcnl4035.c +index 73a28e30dddc..1342bbe111ed 100644 +--- a/drivers/iio/light/vcnl4035.c ++++ b/drivers/iio/light/vcnl4035.c +@@ -102,7 +102,8 @@ static irqreturn_t vcnl4035_trigger_consumer_handler(int irq, void *p) + struct iio_poll_func *pf = p; + struct iio_dev *indio_dev = pf->indio_dev; + struct vcnl4035_data *data = iio_priv(indio_dev); +- u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)]; ++ /* Ensure naturally aligned timestamp */ ++ u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8); + int ret; + + ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer); +-- +2.30.2 + diff --git a/queue-5.12/iio-magn-bmc150-fix-buffer-alignment-in-iio_push_to_.patch b/queue-5.12/iio-magn-bmc150-fix-buffer-alignment-in-iio_push_to_.patch new file mode 100644 index 00000000000..56083449749 --- /dev/null +++ b/queue-5.12/iio-magn-bmc150-fix-buffer-alignment-in-iio_push_to_.patch @@ -0,0 +1,63 @@ +From 9aa6f37a2b7a2fb7b3b79eca438a725b1d2f0395 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:18 +0100 +Subject: iio: magn: bmc150: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 7692088f72865c41b6b531fd09486ee99a5da930 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes: c91746a2361d ("iio: magn: Add support for BMC150 magnetometer") +Signed-off-by: Jonathan Cameron +Cc: Stephan Gerhold +Cc: Linus Walleij +Reviewed-by: Linus Walleij +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-17-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/bmc150_magn.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/magnetometer/bmc150_magn.c b/drivers/iio/magnetometer/bmc150_magn.c +index b2f3129e1b4f..20a0842f0e3a 100644 +--- a/drivers/iio/magnetometer/bmc150_magn.c ++++ b/drivers/iio/magnetometer/bmc150_magn.c +@@ -138,8 +138,11 @@ struct bmc150_magn_data { + struct regmap *regmap; + struct regulator_bulk_data regulators[2]; + struct iio_mount_matrix orientation; +- /* 4 x 32 bits for x, y z, 4 bytes align, 64 bits timestamp */ +- s32 buffer[6]; ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s32 chans[3]; ++ s64 timestamp __aligned(8); ++ } scan; + struct iio_trigger *dready_trig; + bool dready_trigger_on; + int max_odr; +@@ -675,11 +678,11 @@ static irqreturn_t bmc150_magn_trigger_handler(int irq, void *p) + int ret; + + mutex_lock(&data->mutex); +- ret = bmc150_magn_read_xyz(data, data->buffer); ++ ret = bmc150_magn_read_xyz(data, data->scan.chans); + if (ret < 0) + goto err; + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + pf->timestamp); + + err: +-- +2.30.2 + diff --git a/queue-5.12/iio-magn-hmc5843-fix-buffer-alignment-in-iio_push_to.patch b/queue-5.12/iio-magn-hmc5843-fix-buffer-alignment-in-iio_push_to.patch new file mode 100644 index 00000000000..019713548bd --- /dev/null +++ b/queue-5.12/iio-magn-hmc5843-fix-buffer-alignment-in-iio_push_to.patch @@ -0,0 +1,75 @@ +From fba87757bc86df4b0ec308c81df21d8c41301377 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:17 +0100 +Subject: iio: magn: hmc5843: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 1ef2f51e9fe424ccecca5bb0373d71b900c2cd41 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes: 7247645f6865 ("iio: hmc5843: Move hmc5843 out of staging") +Signed-off-by: Jonathan Cameron +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-16-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/hmc5843.h | 8 ++++++-- + drivers/iio/magnetometer/hmc5843_core.c | 4 ++-- + 2 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/iio/magnetometer/hmc5843.h b/drivers/iio/magnetometer/hmc5843.h +index 3f6c0b662941..242f742f2643 100644 +--- a/drivers/iio/magnetometer/hmc5843.h ++++ b/drivers/iio/magnetometer/hmc5843.h +@@ -33,7 +33,8 @@ enum hmc5843_ids { + * @lock: update and read regmap data + * @regmap: hardware access register maps + * @variant: describe chip variants +- * @buffer: 3x 16-bit channels + padding + 64-bit timestamp ++ * @scan: buffer to pack data for passing to ++ * iio_push_to_buffers_with_timestamp() + */ + struct hmc5843_data { + struct device *dev; +@@ -41,7 +42,10 @@ struct hmc5843_data { + struct regmap *regmap; + const struct hmc5843_chip_info *variant; + struct iio_mount_matrix orientation; +- __be16 buffer[8]; ++ struct { ++ __be16 chans[3]; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + int hmc5843_common_probe(struct device *dev, struct regmap *regmap, +diff --git a/drivers/iio/magnetometer/hmc5843_core.c b/drivers/iio/magnetometer/hmc5843_core.c +index 780faea61d82..221563e0c18f 100644 +--- a/drivers/iio/magnetometer/hmc5843_core.c ++++ b/drivers/iio/magnetometer/hmc5843_core.c +@@ -446,13 +446,13 @@ static irqreturn_t hmc5843_trigger_handler(int irq, void *p) + } + + ret = regmap_bulk_read(data->regmap, HMC5843_DATA_OUT_MSB_REGS, +- data->buffer, 3 * sizeof(__be16)); ++ data->scan.chans, sizeof(data->scan.chans)); + + mutex_unlock(&data->lock); + if (ret < 0) + goto done; + +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + iio_get_time_ns(indio_dev)); + + done: +-- +2.30.2 + diff --git a/queue-5.12/iio-magn-rm3100-fix-alignment-of-buffer-in-iio_push_.patch b/queue-5.12/iio-magn-rm3100-fix-alignment-of-buffer-in-iio_push_.patch new file mode 100644 index 00000000000..1a0792e5331 --- /dev/null +++ b/queue-5.12/iio-magn-rm3100-fix-alignment-of-buffer-in-iio_push_.patch @@ -0,0 +1,47 @@ +From 70d834e4b1e033aa0a1c8d599fff4bfcdf5c8754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 16:22:58 +0100 +Subject: iio: magn: rm3100: Fix alignment of buffer in + iio_push_to_buffers_with_timestamp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cameron + +[ Upstream commit b8f939fd20690623cb24845a563e7bc1e4a21482 ] + +Add __aligned(8) to ensure the buffer passed to +iio_push_to_buffers_with_timestamp() is suitable for the naturally +aligned timestamp that will be inserted. + +Here an explicit structure is not used, because this buffer is used in +a non-trivial way for data repacking. + +Fixes: 121354b2eceb ("iio: magnetometer: Add driver support for PNI RM3100") +Signed-off-by: Jonathan Cameron +Cc: Song Qiang +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20210613152301.571002-6-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/rm3100-core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/magnetometer/rm3100-core.c b/drivers/iio/magnetometer/rm3100-core.c +index 7242897a05e9..720234a91db1 100644 +--- a/drivers/iio/magnetometer/rm3100-core.c ++++ b/drivers/iio/magnetometer/rm3100-core.c +@@ -78,7 +78,8 @@ struct rm3100_data { + bool use_interrupt; + int conversion_time; + int scale; +- u8 buffer[RM3100_SCAN_BYTES]; ++ /* Ensure naturally aligned timestamp */ ++ u8 buffer[RM3100_SCAN_BYTES] __aligned(8); + struct iio_trigger *drdy_trig; + + /* +-- +2.30.2 + diff --git a/queue-5.12/iio-potentiostat-lmp91000-fix-alignment-of-buffer-in.patch b/queue-5.12/iio-potentiostat-lmp91000-fix-alignment-of-buffer-in.patch new file mode 100644 index 00000000000..22ea96d9de9 --- /dev/null +++ b/queue-5.12/iio-potentiostat-lmp91000-fix-alignment-of-buffer-in.patch @@ -0,0 +1,45 @@ +From e42120e4ce0c02a50d8df0b4846060158428f3d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:13:48 +0100 +Subject: iio: potentiostat: lmp91000: Fix alignment of buffer in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 8979b67ec61abc232636400ee8c758a16a73c95f ] + +Add __aligned(8) to ensure the buffer passed to +iio_push_to_buffers_with_timestamp() is suitable for the naturally +aligned timestamp that will be inserted. + +Here structure is not used, because this buffer is also used +elsewhere in the driver. + +Fixes: 67e17300dc1d ("iio: potentiostat: add LMP91000 support") +Signed-off-by: Jonathan Cameron +Cc: Matt Ranostay +Acked-by: Matt Ranostay +Link: https://lore.kernel.org/r/20210501171352.512953-8-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/potentiostat/lmp91000.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/potentiostat/lmp91000.c b/drivers/iio/potentiostat/lmp91000.c +index f34ca769dc20..d7ff74a798ba 100644 +--- a/drivers/iio/potentiostat/lmp91000.c ++++ b/drivers/iio/potentiostat/lmp91000.c +@@ -71,8 +71,8 @@ struct lmp91000_data { + + struct completion completion; + u8 chan_select; +- +- u32 buffer[4]; /* 64-bit data + 64-bit timestamp */ ++ /* 64-bit data + 64-bit naturally aligned timestamp */ ++ u32 buffer[4] __aligned(8); + }; + + static const struct iio_chan_spec lmp91000_channels[] = { +-- +2.30.2 + diff --git a/queue-5.12/iio-prox-as3935-fix-buffer-alignment-in-iio_push_to_.patch b/queue-5.12/iio-prox-as3935-fix-buffer-alignment-in-iio_push_to_.patch new file mode 100644 index 00000000000..5fc07169dcc --- /dev/null +++ b/queue-5.12/iio-prox-as3935-fix-buffer-alignment-in-iio_push_to_.patch @@ -0,0 +1,58 @@ +From f24c801d17ab9c27906905ec2576f4634d24c630 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:16 +0100 +Subject: iio: prox: as3935: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 37eb8d8c64f2ecb3a5521ba1cc1fad973adfae41 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes: 37b1ba2c68cf ("iio: proximity: as3935: fix buffer stack trashing") +Signed-off-by: Jonathan Cameron +Cc: Matt Ranostay +Acked-by: Matt Ranostay +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-15-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/proximity/as3935.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c +index b79ada839e01..98330e26ac3b 100644 +--- a/drivers/iio/proximity/as3935.c ++++ b/drivers/iio/proximity/as3935.c +@@ -59,7 +59,11 @@ struct as3935_state { + unsigned long noise_tripped; + u32 tune_cap; + u32 nflwdth_reg; +- u8 buffer[16]; /* 8-bit data + 56-bit padding + 64-bit timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u8 chan; ++ s64 timestamp __aligned(8); ++ } scan; + u8 buf[2] ____cacheline_aligned; + }; + +@@ -225,8 +229,8 @@ static irqreturn_t as3935_trigger_handler(int irq, void *private) + if (ret) + goto err_read; + +- st->buffer[0] = val & AS3935_DATA_MASK; +- iio_push_to_buffers_with_timestamp(indio_dev, &st->buffer, ++ st->scan.chan = val & AS3935_DATA_MASK; ++ iio_push_to_buffers_with_timestamp(indio_dev, &st->scan, + iio_get_time_ns(indio_dev)); + err_read: + iio_trigger_notify_done(indio_dev->trig); +-- +2.30.2 + diff --git a/queue-5.12/iio-prox-isl29501-fix-buffer-alignment-in-iio_push_t.patch b/queue-5.12/iio-prox-isl29501-fix-buffer-alignment-in-iio_push_t.patch new file mode 100644 index 00000000000..ad8bce1cb83 --- /dev/null +++ b/queue-5.12/iio-prox-isl29501-fix-buffer-alignment-in-iio_push_t.patch @@ -0,0 +1,47 @@ +From 8e5b094ff83527b6634b66c20c32898fb1cf2482 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 16:23:01 +0100 +Subject: iio: prox: isl29501: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cameron + +[ Upstream commit 92babc9938ebbf4050f2fba774836f7edc16a570 ] + +Add __aligned(8) to ensure the buffer passed to +iio_push_to_buffers_with_timestamp() is suitable for the naturally +aligned timestamp that will be inserted. + +Here an explicit structure is not used, because the holes would +necessitate the addition of an explict memset(), to avoid a kernel +data leak, making for a less minimal fix. + +Fixes: 1c28799257bc ("iio: light: isl29501: Add support for the ISL29501 ToF sensor.") +Signed-off-by: Jonathan Cameron +Cc: Mathieu Othacehe +Reviewed-by: Nuno Sá +Link: https://lore.kernel.org/r/20210613152301.571002-9-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/proximity/isl29501.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iio/proximity/isl29501.c b/drivers/iio/proximity/isl29501.c +index 90e76451c972..5b6ea783795d 100644 +--- a/drivers/iio/proximity/isl29501.c ++++ b/drivers/iio/proximity/isl29501.c +@@ -938,7 +938,7 @@ static irqreturn_t isl29501_trigger_handler(int irq, void *p) + struct iio_dev *indio_dev = pf->indio_dev; + struct isl29501_private *isl29501 = iio_priv(indio_dev); + const unsigned long *active_mask = indio_dev->active_scan_mask; +- u32 buffer[4] = {}; /* 1x16-bit + ts */ ++ u32 buffer[4] __aligned(8) = {}; /* 1x16-bit + naturally aligned ts */ + + if (test_bit(ISL29501_DISTANCE_SCAN_INDEX, active_mask)) + isl29501_register_read(isl29501, REG_DISTANCE, buffer); +-- +2.30.2 + diff --git a/queue-5.12/iio-prox-pulsed-light-fix-buffer-alignment-in-iio_pu.patch b/queue-5.12/iio-prox-pulsed-light-fix-buffer-alignment-in-iio_pu.patch new file mode 100644 index 00000000000..87366aa2013 --- /dev/null +++ b/queue-5.12/iio-prox-pulsed-light-fix-buffer-alignment-in-iio_pu.patch @@ -0,0 +1,59 @@ +From 38000a987a841414c4878b2947385ffbc8f46cb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:15 +0100 +Subject: iio: prox: pulsed-light: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 679cc377a03ff1944491eafc7355c1eb1fad4109 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes: cb119d535083 ("iio: proximity: add support for PulsedLight LIDAR") +Signed-off-by: Jonathan Cameron +Cc: Matt Ranostay +Acked-by: Matt Ranostay +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-14-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/proximity/pulsedlight-lidar-lite-v2.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +index cc206bfa09c7..d854b8d5fbba 100644 +--- a/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c ++++ b/drivers/iio/proximity/pulsedlight-lidar-lite-v2.c +@@ -44,7 +44,11 @@ struct lidar_data { + int (*xfer)(struct lidar_data *data, u8 reg, u8 *val, int len); + int i2c_enabled; + +- u16 buffer[8]; /* 2 byte distance + 8 byte timestamp */ ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ u16 chan; ++ s64 timestamp __aligned(8); ++ } scan; + }; + + static const struct iio_chan_spec lidar_channels[] = { +@@ -230,9 +234,9 @@ static irqreturn_t lidar_trigger_handler(int irq, void *private) + struct lidar_data *data = iio_priv(indio_dev); + int ret; + +- ret = lidar_get_measurement(data, data->buffer); ++ ret = lidar_get_measurement(data, &data->scan.chan); + if (!ret) { +- iio_push_to_buffers_with_timestamp(indio_dev, data->buffer, ++ iio_push_to_buffers_with_timestamp(indio_dev, &data->scan, + iio_get_time_ns(indio_dev)); + } else if (ret != -EINVAL) { + dev_err(&data->client->dev, "cannot read LIDAR measurement"); +-- +2.30.2 + diff --git a/queue-5.12/iio-prox-srf08-fix-buffer-alignment-in-iio_push_to_b.patch b/queue-5.12/iio-prox-srf08-fix-buffer-alignment-in-iio_push_to_b.patch new file mode 100644 index 00000000000..43e2e77b903 --- /dev/null +++ b/queue-5.12/iio-prox-srf08-fix-buffer-alignment-in-iio_push_to_b.patch @@ -0,0 +1,62 @@ +From 59b038b99d6e9dc9a26775fcdc3e96cf39712213 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 May 2021 18:01:14 +0100 +Subject: iio: prox: srf08: Fix buffer alignment in + iio_push_to_buffers_with_timestamp() + +From: Jonathan Cameron + +[ Upstream commit 19f1a254fe4949fff1e67db386409f48cf438bd7 ] + +To make code more readable, use a structure to express the channel +layout and ensure the timestamp is 8 byte aligned. + +Found during an audit of all calls of uses of +iio_push_to_buffers_with_timestamp() + +Fixes: 78f839029e1d ("iio: distance: srf08: add IIO driver for us ranger") +Signed-off-by: Jonathan Cameron +Cc: Andreas Klinger +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210501170121.512209-13-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/proximity/srf08.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/iio/proximity/srf08.c b/drivers/iio/proximity/srf08.c +index 70beac5c9c1d..9b0886760f76 100644 +--- a/drivers/iio/proximity/srf08.c ++++ b/drivers/iio/proximity/srf08.c +@@ -63,11 +63,11 @@ struct srf08_data { + int range_mm; + struct mutex lock; + +- /* +- * triggered buffer +- * 1x16-bit channel + 3x16 padding + 4x16 timestamp +- */ +- s16 buffer[8]; ++ /* Ensure timestamp is naturally aligned */ ++ struct { ++ s16 chan; ++ s64 timestamp __aligned(8); ++ } scan; + + /* Sensor-Type */ + enum srf08_sensor_type sensor_type; +@@ -190,9 +190,9 @@ static irqreturn_t srf08_trigger_handler(int irq, void *p) + + mutex_lock(&data->lock); + +- data->buffer[0] = sensor_data; ++ data->scan.chan = sensor_data; + iio_push_to_buffers_with_timestamp(indio_dev, +- data->buffer, pf->timestamp); ++ &data->scan, pf->timestamp); + + mutex_unlock(&data->lock); + err: +-- +2.30.2 + diff --git a/queue-5.12/ima-don-t-remove-security.ima-if-file-must-not-be-ap.patch b/queue-5.12/ima-don-t-remove-security.ima-if-file-must-not-be-ap.patch new file mode 100644 index 00000000000..53f005b3b69 --- /dev/null +++ b/queue-5.12/ima-don-t-remove-security.ima-if-file-must-not-be-ap.patch @@ -0,0 +1,37 @@ +From 0ca2b20c8fdbc927ad33bb6acc0f650081e3497b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 17:27:53 +0200 +Subject: ima: Don't remove security.ima if file must not be appraised + +From: Roberto Sassu + +[ Upstream commit ed1b472fc15aeaa20ddeeb93fd25190014e50d17 ] + +Files might come from a remote source and might have xattrs, including +security.ima. It should not be IMA task to decide whether security.ima +should be kept or not. This patch removes the removexattr() system +call in ima_inode_post_setattr(). + +Signed-off-by: Roberto Sassu +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_appraise.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c +index 565e33ff19d0..d7cc6f897746 100644 +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -522,8 +522,6 @@ void ima_inode_post_setattr(struct user_namespace *mnt_userns, + return; + + action = ima_must_appraise(mnt_userns, inode, MAY_ACCESS, POST_SETATTR); +- if (!action) +- __vfs_removexattr(&init_user_ns, dentry, XATTR_NAME_IMA); + iint = integrity_iint_find(inode); + if (iint) { + set_bit(IMA_CHANGE_ATTR, &iint->atomic_flags); +-- +2.30.2 + diff --git a/queue-5.12/input-goodix-platform-x86-touchscreen_dmi-move-upsid.patch b/queue-5.12/input-goodix-platform-x86-touchscreen_dmi-move-upsid.patch new file mode 100644 index 00000000000..55191268d1e --- /dev/null +++ b/queue-5.12/input-goodix-platform-x86-touchscreen_dmi-move-upsid.patch @@ -0,0 +1,192 @@ +From 2cc28b6c05c7db2a712b52e887891bd2f35c5a50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 20:57:42 +0200 +Subject: Input: goodix - platform/x86: touchscreen_dmi - Move upside down + quirks to touchscreen_dmi.c + +From: Hans de Goede + +[ Upstream commit 5a6f0dbe621a5c20dc912ac474debf9f11129e03 ] + +Move the DMI quirks for upside-down mounted Goodix touchscreens from +drivers/input/touchscreen/goodix.c to +drivers/platform/x86/touchscreen_dmi.c, +where all the other x86 touchscreen quirks live. + +Note the touchscreen_dmi.c code attaches standard touchscreen +device-properties to an i2c-client device based on a combination of a +DMI match + a device-name match. I've verified that the: Teclast X98 Pro, +WinBook TW100 and WinBook TW700 uses an ACPI devicename of "GDIX1001:00" +based on acpidumps and/or dmesg output available on the web. + +This patch was tested on a Teclast X89 tablet. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210504185746.175461-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/goodix.c | 52 ------------------------ + drivers/platform/x86/touchscreen_dmi.c | 56 ++++++++++++++++++++++++++ + 2 files changed, 56 insertions(+), 52 deletions(-) + +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index c682b028f0a2..4f53d3c57e69 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -178,51 +178,6 @@ static const unsigned long goodix_irq_flags[] = { + IRQ_TYPE_LEVEL_HIGH, + }; + +-/* +- * Those tablets have their coordinates origin at the bottom right +- * of the tablet, as if rotated 180 degrees +- */ +-static const struct dmi_system_id rotated_screen[] = { +-#if defined(CONFIG_DMI) && defined(CONFIG_X86) +- { +- .ident = "Teclast X89", +- .matches = { +- /* tPAD is too generic, also match on bios date */ +- DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), +- DMI_MATCH(DMI_BOARD_NAME, "tPAD"), +- DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"), +- }, +- }, +- { +- .ident = "Teclast X98 Pro", +- .matches = { +- /* +- * Only match BIOS date, because the manufacturers +- * BIOS does not report the board name at all +- * (sometimes)... +- */ +- DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), +- DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"), +- }, +- }, +- { +- .ident = "WinBook TW100", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "WinBook"), +- DMI_MATCH(DMI_PRODUCT_NAME, "TW100") +- } +- }, +- { +- .ident = "WinBook TW700", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "WinBook"), +- DMI_MATCH(DMI_PRODUCT_NAME, "TW700") +- }, +- }, +-#endif +- {} +-}; +- + static const struct dmi_system_id nine_bytes_report[] = { + #if defined(CONFIG_DMI) && defined(CONFIG_X86) + { +@@ -1123,13 +1078,6 @@ static int goodix_configure_dev(struct goodix_ts_data *ts) + ABS_MT_POSITION_Y, ts->prop.max_y); + } + +- if (dmi_check_system(rotated_screen)) { +- ts->prop.invert_x = true; +- ts->prop.invert_y = true; +- dev_dbg(&ts->client->dev, +- "Applying '180 degrees rotated screen' quirk\n"); +- } +- + if (dmi_check_system(nine_bytes_report)) { + ts->contact_size = 9; + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index 8618c44106c2..222f6c9f0b45 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -299,6 +299,23 @@ static const struct ts_dmi_data estar_beauty_hd_data = { + .properties = estar_beauty_hd_props, + }; + ++/* Generic props + data for upside-down mounted GDIX1001 touchscreens */ ++static const struct property_entry gdix1001_upside_down_props[] = { ++ PROPERTY_ENTRY_BOOL("touchscreen-inverted-x"), ++ PROPERTY_ENTRY_BOOL("touchscreen-inverted-y"), ++ { } ++}; ++ ++static const struct ts_dmi_data gdix1001_00_upside_down_data = { ++ .acpi_name = "GDIX1001:00", ++ .properties = gdix1001_upside_down_props, ++}; ++ ++static const struct ts_dmi_data gdix1001_01_upside_down_data = { ++ .acpi_name = "GDIX1001:01", ++ .properties = gdix1001_upside_down_props, ++}; ++ + static const struct property_entry gp_electronic_t701_props[] = { + PROPERTY_ENTRY_U32("touchscreen-size-x", 960), + PROPERTY_ENTRY_U32("touchscreen-size-y", 640), +@@ -1295,6 +1312,16 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "X3 Plus"), + }, + }, ++ { ++ /* Teclast X89 (Windows version / BIOS) */ ++ .driver_data = (void *)&gdix1001_01_upside_down_data, ++ .matches = { ++ /* tPAD is too generic, also match on bios date */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), ++ DMI_MATCH(DMI_BOARD_NAME, "tPAD"), ++ DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"), ++ }, ++ }, + { + /* Teclast X98 Plus II */ + .driver_data = (void *)&teclast_x98plus2_data, +@@ -1303,6 +1330,19 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "X98 Plus II"), + }, + }, ++ { ++ /* Teclast X98 Pro */ ++ .driver_data = (void *)&gdix1001_00_upside_down_data, ++ .matches = { ++ /* ++ * Only match BIOS date, because the manufacturers ++ * BIOS does not report the board name at all ++ * (sometimes)... ++ */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), ++ DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"), ++ }, ++ }, + { + /* Trekstor Primebook C11 */ + .driver_data = (void *)&trekstor_primebook_c11_data, +@@ -1378,6 +1418,22 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "VINGA Twizzle J116"), + }, + }, ++ { ++ /* "WinBook TW100" */ ++ .driver_data = (void *)&gdix1001_00_upside_down_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "WinBook"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "TW100") ++ } ++ }, ++ { ++ /* WinBook TW700 */ ++ .driver_data = (void *)&gdix1001_00_upside_down_data, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "WinBook"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "TW700") ++ }, ++ }, + { + /* Yours Y8W81, same case and touchscreen as Chuwi Vi8 */ + .driver_data = (void *)&chuwi_vi8_data, +-- +2.30.2 + diff --git a/queue-5.12/input-hil_kbd-fix-error-return-code-in-hil_dev_conne.patch b/queue-5.12/input-hil_kbd-fix-error-return-code-in-hil_dev_conne.patch new file mode 100644 index 00000000000..6e92d738d0c --- /dev/null +++ b/queue-5.12/input-hil_kbd-fix-error-return-code-in-hil_dev_conne.patch @@ -0,0 +1,37 @@ +From a6f60bda7321806088005a1b99a7658375674b66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 11:52:42 -0700 +Subject: Input: hil_kbd - fix error return code in hil_dev_connect() + +From: Zhen Lei + +[ Upstream commit d9b576917a1d0efa293801a264150a1b37691617 ] + +Return error code -EINVAL rather than '0' when the combo devices are not +supported. + +Fixes: fa71c605c2bb ("Input: combine hil_kbd and hil_ptr drivers") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210515030053.6824-1-thunder.leizhen@huawei.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/hil_kbd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/keyboard/hil_kbd.c b/drivers/input/keyboard/hil_kbd.c +index bb29a7c9a1c0..54afb38601b9 100644 +--- a/drivers/input/keyboard/hil_kbd.c ++++ b/drivers/input/keyboard/hil_kbd.c +@@ -512,6 +512,7 @@ static int hil_dev_connect(struct serio *serio, struct serio_driver *drv) + HIL_IDD_NUM_AXES_PER_SET(*idd)) { + printk(KERN_INFO PREFIX + "combo devices are not supported.\n"); ++ error = -EINVAL; + goto bail1; + } + +-- +2.30.2 + diff --git a/queue-5.12/iommu-amd-fix-extended-features-logging.patch b/queue-5.12/iommu-amd-fix-extended-features-logging.patch new file mode 100644 index 00000000000..280520fb8c3 --- /dev/null +++ b/queue-5.12/iommu-amd-fix-extended-features-logging.patch @@ -0,0 +1,63 @@ +From 47422cf1b718a907760687a224bf94ea774aa4a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 13:22:20 +0300 +Subject: iommu/amd: Fix extended features logging + +From: Alexander Monakov + +[ Upstream commit 4b21a503adf597773e4b37db05db0e9b16a81d53 ] + +print_iommu_info prints the EFR register and then the decoded list of +features on a separate line: + +pci 0000:00:00.2: AMD-Vi: Extended features (0x206d73ef22254ade): + PPR X2APIC NX GT IA GA PC GA_vAPIC + +The second line is emitted via 'pr_cont', which causes it to have a +different ('warn') loglevel compared to the previous line ('info'). + +Commit 9a295ff0ffc9 attempted to rectify this by removing the newline +from the pci_info format string, but this doesn't work, as pci_info +calls implicitly append a newline anyway. + +Printing the decoded features on the same line would make it quite long. +Instead, change pci_info() to pr_info() to omit PCI bus location info, +which is also shown in the preceding message. This results in: + +pci 0000:00:00.2: AMD-Vi: Found IOMMU cap 0x40 +AMD-Vi: Extended features (0x206d73ef22254ade): PPR X2APIC NX GT IA GA PC GA_vAPIC +AMD-Vi: Interrupt remapping enabled + +Fixes: 9a295ff0ffc9 ("iommu/amd: Print extended features in one line to fix divergent log levels") +Link: https://lore.kernel.org/lkml/alpine.LNX.2.20.13.2104112326460.11104@monopod.intra.ispras.ru +Signed-off-by: Alexander Monakov +Cc: Paul Menzel +Cc: Joerg Roedel +Cc: Suravee Suthikulpanit +Cc: iommu@lists.linux-foundation.org +Reviewed-by: Paul Menzel +Link: https://lore.kernel.org/r/20210504102220.1793-1-amonakov@ispras.ru +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/init.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c +index df7b19ff0a9e..ecc7308130ba 100644 +--- a/drivers/iommu/amd/init.c ++++ b/drivers/iommu/amd/init.c +@@ -1911,8 +1911,8 @@ static void print_iommu_info(void) + pci_info(pdev, "Found IOMMU cap 0x%x\n", iommu->cap_ptr); + + if (iommu->cap & (1 << IOMMU_CAP_EFR)) { +- pci_info(pdev, "Extended features (%#llx):", +- iommu->features); ++ pr_info("Extended features (%#llx):", iommu->features); ++ + for (i = 0; i < ARRAY_SIZE(feat_str); ++i) { + if (iommu_feature(iommu, (1ULL << i))) + pr_cont(" %s", feat_str[i]); +-- +2.30.2 + diff --git a/queue-5.12/iommu-dma-fix-iova-reserve-dma-ranges.patch b/queue-5.12/iommu-dma-fix-iova-reserve-dma-ranges.patch new file mode 100644 index 00000000000..b3dcb0ddb21 --- /dev/null +++ b/queue-5.12/iommu-dma-fix-iova-reserve-dma-ranges.patch @@ -0,0 +1,44 @@ +From d91746f6d1ce3d9f564fc310828568a1ff46846a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 12:53:19 +0530 +Subject: iommu/dma: Fix IOVA reserve dma ranges + +From: Srinath Mannam + +[ Upstream commit 571f316074a203e979ea90211d9acf423dfe5f46 ] + +Fix IOVA reserve failure in the case when address of first memory region +listed in dma-ranges is equal to 0x0. + +Fixes: aadad097cd46f ("iommu/dma: Reserve IOVA for PCIe inaccessible DMA address") +Signed-off-by: Srinath Mannam +Reviewed-by: Robin Murphy +Tested-by: Sven Peter +Link: https://lore.kernel.org/r/20200914072319.6091-1-srinath.mannam@broadcom.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/dma-iommu.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index fdd095e1fa52..5f75ab0dfc73 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -252,9 +252,11 @@ resv_iova: + lo = iova_pfn(iovad, start); + hi = iova_pfn(iovad, end); + reserve_iova(iovad, lo, hi); +- } else { ++ } else if (end < start) { + /* dma_ranges list should be sorted */ +- dev_err(&dev->dev, "Failed to reserve IOVA\n"); ++ dev_err(&dev->dev, ++ "Failed to reserve IOVA [%#010llx-%#010llx]\n", ++ start, end); + return -EINVAL; + } + +-- +2.30.2 + diff --git a/queue-5.12/ip6_tunnel-fix-gre6-segmentation.patch b/queue-5.12/ip6_tunnel-fix-gre6-segmentation.patch new file mode 100644 index 00000000000..71b2a255d1b --- /dev/null +++ b/queue-5.12/ip6_tunnel-fix-gre6-segmentation.patch @@ -0,0 +1,60 @@ +From acf07a0a7cd3893a8d866142e78a7fa36f0edd72 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 18:52:54 -0700 +Subject: ip6_tunnel: fix GRE6 segmentation + +From: Jakub Kicinski + +[ Upstream commit a6e3f2985a80ef6a45a17d2d9d9151f17ea3ce07 ] + +Commit 6c11fbf97e69 ("ip6_tunnel: add MPLS transmit support") +moved assiging inner_ipproto down from ipxip6_tnl_xmit() to +its callee ip6_tnl_xmit(). The latter is also used by GRE. + +Since commit 38720352412a ("gre: Use inner_proto to obtain inner +header protocol") GRE had been depending on skb->inner_protocol +during segmentation. It sets it in gre_build_header() and reads +it in gre_gso_segment(). Changes to ip6_tnl_xmit() overwrite +the protocol, resulting in GSO skbs getting dropped. + +Note that inner_protocol is a union with inner_ipproto, +GRE uses the former while the change switched it to the latter +(always setting it to just IPPROTO_GRE). + +Restore the original location of skb_set_inner_ipproto(), +it is unclear why it was moved in the first place. + +Fixes: 6c11fbf97e69 ("ip6_tunnel: add MPLS transmit support") +Signed-off-by: Jakub Kicinski +Tested-by: Vadim Fedorenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/ip6_tunnel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index d42f471b0d65..adbc9bf65d30 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1239,8 +1239,6 @@ route_lookup: + if (max_headroom > dev->needed_headroom) + dev->needed_headroom = max_headroom; + +- skb_set_inner_ipproto(skb, proto); +- + err = ip6_tnl_encap(skb, t, &proto, fl6); + if (err) + return err; +@@ -1377,6 +1375,8 @@ ipxip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, + if (iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6)) + return -1; + ++ skb_set_inner_ipproto(skb, protocol); ++ + err = ip6_tnl_xmit(skb, dev, dsfield, &fl6, encap_limit, &mtu, + protocol); + if (err != 0) { +-- +2.30.2 + diff --git a/queue-5.12/ipv6-exthdrs-do-not-blindly-use-init_net.patch b/queue-5.12/ipv6-exthdrs-do-not-blindly-use-init_net.patch new file mode 100644 index 00000000000..3cc25da5c4f --- /dev/null +++ b/queue-5.12/ipv6-exthdrs-do-not-blindly-use-init_net.patch @@ -0,0 +1,61 @@ +From ce836e2b90866213976f25db251c07c0067486f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 08:27:00 -0700 +Subject: ipv6: exthdrs: do not blindly use init_net + +From: Eric Dumazet + +[ Upstream commit bcc3f2a829b9edbe3da5fb117ee5a63686d31834 ] + +I see no reason why max_dst_opts_cnt and max_hbh_opts_cnt +are fetched from the initial net namespace. + +The other sysctls (max_dst_opts_len & max_hbh_opts_len) +are in fact already using the current ns. + +Note: it is not clear why ipv6_destopt_rcv() use two ways to +get to the netns : + + 1) dev_net(dst->dev) + Originally used to increment IPSTATS_MIB_INHDRERRORS + + 2) dev_net(skb->dev) + Tom used this variant in his patch. + +Maybe this calls to use ipv6_skb_net() instead ? + +Fixes: 47d3d7ac656a ("ipv6: Implement limits on Hop-by-Hop and Destination options") +Signed-off-by: Eric Dumazet +Cc: Tom Herbert +Cc: Coco Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/exthdrs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index 6126f8bf94b3..a9e1d7918d14 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -306,7 +306,7 @@ fail_and_free: + #endif + + if (ip6_parse_tlv(tlvprocdestopt_lst, skb, +- init_net.ipv6.sysctl.max_dst_opts_cnt)) { ++ net->ipv6.sysctl.max_dst_opts_cnt)) { + skb->transport_header += extlen; + opt = IP6CB(skb); + #if IS_ENABLED(CONFIG_IPV6_MIP6) +@@ -1036,7 +1036,7 @@ fail_and_free: + + opt->flags |= IP6SKB_HOPBYHOP; + if (ip6_parse_tlv(tlvprochopopt_lst, skb, +- init_net.ipv6.sysctl.max_hbh_opts_cnt)) { ++ net->ipv6.sysctl.max_hbh_opts_cnt)) { + skb->transport_header += extlen; + opt = IP6CB(skb); + opt->nhoff = sizeof(struct ipv6hdr); +-- +2.30.2 + diff --git a/queue-5.12/ipv6-fix-out-of-bound-access-in-ip6_parse_tlv.patch b/queue-5.12/ipv6-fix-out-of-bound-access-in-ip6_parse_tlv.patch new file mode 100644 index 00000000000..a2236267834 --- /dev/null +++ b/queue-5.12/ipv6-fix-out-of-bound-access-in-ip6_parse_tlv.patch @@ -0,0 +1,89 @@ +From bc17c512db45cb95231f1052d113e08f609a9af4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 03:07:20 -0700 +Subject: ipv6: fix out-of-bound access in ip6_parse_tlv() + +From: Eric Dumazet + +[ Upstream commit 624085a31c1ad6a80b1e53f686bf6ee92abbf6e8 ] + +First problem is that optlen is fetched without checking +there is more than one byte to parse. + +Fix this by taking care of IPV6_TLV_PAD1 before +fetching optlen (under appropriate sanity checks against len) + +Second problem is that IPV6_TLV_PADN checks of zero +padding are performed before the check of remaining length. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Fixes: c1412fce7ecc ("net/ipv6/exthdrs.c: Strict PadN option checking") +Signed-off-by: Eric Dumazet +Cc: Paolo Abeni +Cc: Tom Herbert +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/exthdrs.c | 27 +++++++++++++-------------- + 1 file changed, 13 insertions(+), 14 deletions(-) + +diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c +index a9e1d7918d14..6ffa05298cc0 100644 +--- a/net/ipv6/exthdrs.c ++++ b/net/ipv6/exthdrs.c +@@ -135,18 +135,23 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, + len -= 2; + + while (len > 0) { +- int optlen = nh[off + 1] + 2; +- int i; ++ int optlen, i; + +- switch (nh[off]) { +- case IPV6_TLV_PAD1: +- optlen = 1; ++ if (nh[off] == IPV6_TLV_PAD1) { + padlen++; + if (padlen > 7) + goto bad; +- break; ++ off++; ++ len--; ++ continue; ++ } ++ if (len < 2) ++ goto bad; ++ optlen = nh[off + 1] + 2; ++ if (optlen > len) ++ goto bad; + +- case IPV6_TLV_PADN: ++ if (nh[off] == IPV6_TLV_PADN) { + /* RFC 2460 states that the purpose of PadN is + * to align the containing header to multiples + * of 8. 7 is therefore the highest valid value. +@@ -163,12 +168,7 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, + if (nh[off + i] != 0) + goto bad; + } +- break; +- +- default: /* Other TLV code so scan list */ +- if (optlen > len) +- goto bad; +- ++ } else { + tlv_count++; + if (tlv_count > max_count) + goto bad; +@@ -188,7 +188,6 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, + return false; + + padlen = 0; +- break; + } + off += optlen; + len -= optlen; +-- +2.30.2 + diff --git a/queue-5.12/iwlwifi-increase-pnvm-load-timeout.patch b/queue-5.12/iwlwifi-increase-pnvm-load-timeout.patch new file mode 100644 index 00000000000..c96886a3997 --- /dev/null +++ b/queue-5.12/iwlwifi-increase-pnvm-load-timeout.patch @@ -0,0 +1,48 @@ +From dc74ee82ae805caac33547eeb472d2af3fd2f473 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Jun 2021 14:32:40 +0300 +Subject: iwlwifi: increase PNVM load timeout + +From: Luca Coelho + +[ Upstream commit 5cc816ef9db1fe03f73e56e9d8f118add9c6efe4 ] + +The FW has a watchdog of 200ms in the PNVM load flow, so the driver +should have a slightly higher timeout. Change the timeout from 100ms +to 250ms. + +Signed-off-by: Luca Coelho +Fixes: 70d3ca86b025 ("iwlwifi: mvm: ring the doorbell and wait for PNVM load completion") +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20210612142637.ba22aec1e2be.I36bfadc28c480f4fc57266c075a79e8ea4a6934f@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/fw/pnvm.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.h b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.h +index e4f91bce222d..61d3d4e0b7d9 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/pnvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/pnvm.h +@@ -1,7 +1,7 @@ + /* SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause */ + /****************************************************************************** + * +- * Copyright(c) 2020 Intel Corporation ++ * Copyright(c) 2020-2021 Intel Corporation + * + *****************************************************************************/ + +@@ -10,7 +10,7 @@ + + #include "fw/notif-wait.h" + +-#define MVM_UCODE_PNVM_TIMEOUT (HZ / 10) ++#define MVM_UCODE_PNVM_TIMEOUT (HZ / 4) + + int iwl_pnvm_load(struct iwl_trans *trans, + struct iwl_notif_wait_data *notif_wait); +-- +2.30.2 + diff --git a/queue-5.12/kbuild-fix-objtool-dependency-for-object_files_non_s.patch b/queue-5.12/kbuild-fix-objtool-dependency-for-object_files_non_s.patch new file mode 100644 index 00000000000..301587f9958 --- /dev/null +++ b/queue-5.12/kbuild-fix-objtool-dependency-for-object_files_non_s.patch @@ -0,0 +1,61 @@ +From a05af1c424fe346deeaa010b3d238466fc2e5381 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 18:59:15 -0500 +Subject: kbuild: Fix objtool dependency for 'OBJECT_FILES_NON_STANDARD_ + := n' + +From: Josh Poimboeuf + +[ Upstream commit 8852c552402979508fdc395ae07aa8761aa46045 ] + +"OBJECT_FILES_NON_STANDARD_vma.o := n" has a dependency bug. When +objtool source is updated, the affected object doesn't get re-analyzed +by objtool. + +Peter's new variable-sized jump label feature relies on objtool +rewriting the object file. Otherwise the system can fail to boot. That +effectively upgrades this minor dependency issue to a major bug. + +The problem is that variables in prerequisites are expanded early, +during the read-in phase. The '$(objtool_dep)' variable indirectly uses +'$@', which isn't yet available when the target prerequisites are +evaluated. + +Use '.SECONDEXPANSION:' which causes '$(objtool_dep)' to be expanded in +a later phase, after the target-specific '$@' variable has been defined. + +Fixes: b9ab5ebb14ec ("objtool: Add CONFIG_STACK_VALIDATION option") +Fixes: ab3257042c26 ("jump_label, x86: Allow short NOPs") +Reported-by: Matthew Wilcox +Signed-off-by: Josh Poimboeuf +Signed-off-by: Sasha Levin +--- + scripts/Makefile.build | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/scripts/Makefile.build b/scripts/Makefile.build +index 1b6094a13034..73701d637ed5 100644 +--- a/scripts/Makefile.build ++++ b/scripts/Makefile.build +@@ -267,7 +267,8 @@ define rule_as_o_S + endef + + # Built-in and composite module parts +-$(obj)/%.o: $(src)/%.c $(recordmcount_source) $(objtool_dep) FORCE ++.SECONDEXPANSION: ++$(obj)/%.o: $(src)/%.c $(recordmcount_source) $$(objtool_dep) FORCE + $(call if_changed_rule,cc_o_c) + $(call cmd,force_checksrc) + +@@ -348,7 +349,7 @@ cmd_modversions_S = \ + fi + endif + +-$(obj)/%.o: $(src)/%.S $(objtool_dep) FORCE ++$(obj)/%.o: $(src)/%.S $$(objtool_dep) FORCE + $(call if_changed_rule,as_o_S) + + targets += $(filter-out $(subdir-builtin), $(real-obj-y)) +-- +2.30.2 + diff --git a/queue-5.12/kthread_worker-fix-return-value-when-kthread_mod_del.patch b/queue-5.12/kthread_worker-fix-return-value-when-kthread_mod_del.patch new file mode 100644 index 00000000000..ed8ef27ad87 --- /dev/null +++ b/queue-5.12/kthread_worker-fix-return-value-when-kthread_mod_del.patch @@ -0,0 +1,99 @@ +From 7f759ffad13f910358b2c353bad1c4a0e38e535b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 19:33:35 -0700 +Subject: kthread_worker: fix return value when kthread_mod_delayed_work() + races with kthread_cancel_delayed_work_sync() + +From: Petr Mladek + +[ Upstream commit d71ba1649fa3c464c51ec7163e4b817345bff2c7 ] + +kthread_mod_delayed_work() might race with +kthread_cancel_delayed_work_sync() or another kthread_mod_delayed_work() +call. The function lets the other operation win when it sees +work->canceling counter set. And it returns @false. + +But it should return @true as it is done by the related workqueue API, see +mod_delayed_work_on(). + +The reason is that the return value might be used for reference counting. +It has to distinguish the case when the number of queued works has changed +or stayed the same. + +The change is safe. kthread_mod_delayed_work() return value is not +checked anywhere at the moment. + +Link: https://lore.kernel.org/r/20210521163526.GA17916@redhat.com +Link: https://lkml.kernel.org/r/20210610133051.15337-4-pmladek@suse.com +Signed-off-by: Petr Mladek +Reported-by: Oleg Nesterov +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Tejun Heo +Cc: Minchan Kim +Cc: +Cc: Martin Liu +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + kernel/kthread.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/kernel/kthread.c b/kernel/kthread.c +index e8da89c714f5..44f89a602b00 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -1161,14 +1161,14 @@ static bool __kthread_cancel_work(struct kthread_work *work) + * modify @dwork's timer so that it expires after @delay. If @delay is zero, + * @work is guaranteed to be queued immediately. + * +- * Return: %true if @dwork was pending and its timer was modified, +- * %false otherwise. ++ * Return: %false if @dwork was idle and queued, %true otherwise. + * + * A special case is when the work is being canceled in parallel. + * It might be caused either by the real kthread_cancel_delayed_work_sync() + * or yet another kthread_mod_delayed_work() call. We let the other command +- * win and return %false here. The caller is supposed to synchronize these +- * operations a reasonable way. ++ * win and return %true here. The return value can be used for reference ++ * counting and the number of queued works stays the same. Anyway, the caller ++ * is supposed to synchronize these operations a reasonable way. + * + * This function is safe to call from any context including IRQ handler. + * See __kthread_cancel_work() and kthread_delayed_work_timer_fn() +@@ -1180,13 +1180,15 @@ bool kthread_mod_delayed_work(struct kthread_worker *worker, + { + struct kthread_work *work = &dwork->work; + unsigned long flags; +- int ret = false; ++ int ret; + + raw_spin_lock_irqsave(&worker->lock, flags); + + /* Do not bother with canceling when never queued. */ +- if (!work->worker) ++ if (!work->worker) { ++ ret = false; + goto fast_queue; ++ } + + /* Work must not be used with >1 worker, see kthread_queue_work() */ + WARN_ON_ONCE(work->worker != worker); +@@ -1204,8 +1206,11 @@ bool kthread_mod_delayed_work(struct kthread_worker *worker, + * be used for reference counting. + */ + kthread_cancel_delayed_work_timer(work, &flags); +- if (work->canceling) ++ if (work->canceling) { ++ /* The number of works in the queue does not change. */ ++ ret = true; + goto out; ++ } + ret = __kthread_cancel_work(work); + + fast_queue: +-- +2.30.2 + diff --git a/queue-5.12/kunit-fix-result-propagation-for-parameterised-tests.patch b/queue-5.12/kunit-fix-result-propagation-for-parameterised-tests.patch new file mode 100644 index 00000000000..cd506c05bc6 --- /dev/null +++ b/queue-5.12/kunit-fix-result-propagation-for-parameterised-tests.patch @@ -0,0 +1,73 @@ +From d33b77601dc6cae3add6ba0d4a370734def7c374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 20:57:25 -0700 +Subject: kunit: Fix result propagation for parameterised tests + +From: David Gow + +[ Upstream commit 384426bd101cb3cd580b18de19d4891ec5ca5bf9 ] + +When one parameter of a parameterised test failed, its failure would be +propagated to the overall test, but not to the suite result (unless it +was the last parameter). + +This is because test_case->success was being reset to the test->success +result after each parameter was used, so a failing test's result would +be overwritten by a non-failing result. The overall test result was +handled in a third variable, test_result, but this was discarded after +the status line was printed. + +Instead, just propagate the result after each parameter run. + +Signed-off-by: David Gow +Fixes: fadb08e7c750 ("kunit: Support for Parameterized Testing") +Reviewed-by: Marco Elver +Reviewed-by: Brendan Higgins +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + lib/kunit/test.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/lib/kunit/test.c b/lib/kunit/test.c +index ec9494e914ef..c2b7248ebc9e 100644 +--- a/lib/kunit/test.c ++++ b/lib/kunit/test.c +@@ -343,7 +343,7 @@ static void kunit_run_case_catch_errors(struct kunit_suite *suite, + context.test_case = test_case; + kunit_try_catch_run(try_catch, &context); + +- test_case->success = test->success; ++ test_case->success &= test->success; + } + + int kunit_run_tests(struct kunit_suite *suite) +@@ -355,7 +355,7 @@ int kunit_run_tests(struct kunit_suite *suite) + + kunit_suite_for_each_test_case(suite, test_case) { + struct kunit test = { .param_value = NULL, .param_index = 0 }; +- bool test_success = true; ++ test_case->success = true; + + if (test_case->generate_params) { + /* Get initial param. */ +@@ -365,7 +365,6 @@ int kunit_run_tests(struct kunit_suite *suite) + + do { + kunit_run_case_catch_errors(suite, test_case, &test); +- test_success &= test_case->success; + + if (test_case->generate_params) { + if (param_desc[0] == '\0') { +@@ -387,7 +386,7 @@ int kunit_run_tests(struct kunit_suite *suite) + } + } while (test.param_value); + +- kunit_print_ok_not_ok(&test, true, test_success, ++ kunit_print_ok_not_ok(&test, true, test_case->success, + kunit_test_case_num(suite, test_case), + test_case->name); + } +-- +2.30.2 + diff --git a/queue-5.12/kvm-arm64-don-t-zero-the-cycle-count-register-when-p.patch b/queue-5.12/kvm-arm64-don-t-zero-the-cycle-count-register-when-p.patch new file mode 100644 index 00000000000..ccf37ec79aa --- /dev/null +++ b/queue-5.12/kvm-arm64-don-t-zero-the-cycle-count-register-when-p.patch @@ -0,0 +1,42 @@ +From 12c06267dc3b8b749043f8639beafe9db16028eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 11:51:39 +0100 +Subject: KVM: arm64: Don't zero the cycle count register when PMCR_EL0.P is + set + +From: Alexandru Elisei + +[ Upstream commit 2a71fabf6a1bc9162a84e18d6ab991230ca4d588 ] + +According to ARM DDI 0487G.a, page D13-3895, setting the PMCR_EL0.P bit to +1 has the following effect: + +"Reset all event counters accessible in the current Exception level, not +including PMCCNTR_EL0, to zero." + +Similar behaviour is described for AArch32 on page G8-7022. Make it so. + +Fixes: c01d6a18023b ("KVM: arm64: pmu: Only handle supported event counters") +Signed-off-by: Alexandru Elisei +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20210618105139.83795-1-alexandru.elisei@arm.com +Signed-off-by: Sasha Levin +--- + arch/arm64/kvm/pmu-emul.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c +index e9699d10d2bd..14957f7c7303 100644 +--- a/arch/arm64/kvm/pmu-emul.c ++++ b/arch/arm64/kvm/pmu-emul.c +@@ -578,6 +578,7 @@ void kvm_pmu_handle_pmcr(struct kvm_vcpu *vcpu, u64 val) + kvm_pmu_set_counter_value(vcpu, ARMV8_PMU_CYCLE_IDX, 0); + + if (val & ARMV8_PMU_PMCR_P) { ++ mask &= ~BIT(ARMV8_PMU_CYCLE_IDX); + for_each_set_bit(i, &mask, 32) + kvm_pmu_set_counter_value(vcpu, i, 0); + } +-- +2.30.2 + diff --git a/queue-5.12/kvm-arm64-restore-pmu-configuration-on-first-run.patch b/queue-5.12/kvm-arm64-restore-pmu-configuration-on-first-run.patch new file mode 100644 index 00000000000..bba507238d9 --- /dev/null +++ b/queue-5.12/kvm-arm64-restore-pmu-configuration-on-first-run.patch @@ -0,0 +1,74 @@ +From 692f8c52104fb74db18b28f03bbe55ee3181ca5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 16:50:02 +0100 +Subject: KVM: arm64: Restore PMU configuration on first run + +From: Marc Zyngier + +[ Upstream commit d0c94c49792cf780cbfefe29f81bb8c3b73bc76b ] + +Restoring a guest with an active virtual PMU results in no perf +counters being instanciated on the host side. Not quite what +you'd expect from a restore. + +In order to fix this, force a writeback of PMCR_EL0 on the first +run of a vcpu (using a new request so that it happens once the +vcpu has been loaded). This will in turn create all the host-side +counters that were missing. + +Reported-by: Jinank Jain +Tested-by: Jinank Jain +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/87wnrbylxv.wl-maz@kernel.org +Link: https://lore.kernel.org/r/b53dfcf9bbc4db7f96154b1cd5188d72b9766358.camel@amazon.de +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/kvm_host.h | 1 + + arch/arm64/kvm/arm.c | 4 ++++ + arch/arm64/kvm/pmu-emul.c | 3 +++ + 3 files changed, 8 insertions(+) + +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index 858c2fcfc043..4e4356add46e 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -46,6 +46,7 @@ + #define KVM_REQ_VCPU_RESET KVM_ARCH_REQ(2) + #define KVM_REQ_RECORD_STEAL KVM_ARCH_REQ(3) + #define KVM_REQ_RELOAD_GICv4 KVM_ARCH_REQ(4) ++#define KVM_REQ_RELOAD_PMU KVM_ARCH_REQ(5) + + #define KVM_DIRTY_LOG_MANUAL_CAPS (KVM_DIRTY_LOG_MANUAL_PROTECT_ENABLE | \ + KVM_DIRTY_LOG_INITIALLY_SET) +diff --git a/arch/arm64/kvm/arm.c b/arch/arm64/kvm/arm.c +index 7730b81aad6d..8455c5c30116 100644 +--- a/arch/arm64/kvm/arm.c ++++ b/arch/arm64/kvm/arm.c +@@ -684,6 +684,10 @@ static void check_vcpu_requests(struct kvm_vcpu *vcpu) + vgic_v4_load(vcpu); + preempt_enable(); + } ++ ++ if (kvm_check_request(KVM_REQ_RELOAD_PMU, vcpu)) ++ kvm_pmu_handle_pmcr(vcpu, ++ __vcpu_sys_reg(vcpu, PMCR_EL0)); + } + } + +diff --git a/arch/arm64/kvm/pmu-emul.c b/arch/arm64/kvm/pmu-emul.c +index e32c6e139a09..e9699d10d2bd 100644 +--- a/arch/arm64/kvm/pmu-emul.c ++++ b/arch/arm64/kvm/pmu-emul.c +@@ -850,6 +850,9 @@ int kvm_arm_pmu_v3_enable(struct kvm_vcpu *vcpu) + return -EINVAL; + } + ++ /* One-off reload of the PMU on first run */ ++ kvm_make_request(KVM_REQ_RELOAD_PMU, vcpu); ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.12/kvm-nvmx-don-t-clobber-nested-mmu-s-a-d-status-on-ep.patch b/queue-5.12/kvm-nvmx-don-t-clobber-nested-mmu-s-a-d-status-on-ep.patch new file mode 100644 index 00000000000..485d3a5f3ce --- /dev/null +++ b/queue-5.12/kvm-nvmx-don-t-clobber-nested-mmu-s-a-d-status-on-ep.patch @@ -0,0 +1,70 @@ +From 80457053ea735b830b11d5535c1860f3679e0cc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jun 2021 16:42:23 -0700 +Subject: KVM: nVMX: Don't clobber nested MMU's A/D status on EPTP switch + +From: Sean Christopherson + +[ Upstream commit 272b0a998d084e7667284bdd2d0c675c6a2d11de ] + +Drop bogus logic that incorrectly clobbers the accessed/dirty enabling +status of the nested MMU on an EPTP switch. When nested EPT is enabled, +walk_mmu points at L2's _legacy_ page tables, not L1's EPT for L2. + +This is likely a benign bug, as mmu->ept_ad is never consumed (since the +MMU is not a nested EPT MMU), and stuffing mmu_role.base.ad_disabled will +never propagate into future shadow pages since the nested MMU isn't used +to map anything, just to walk L2's page tables. + +Note, KVM also does a full MMU reload, i.e. the guest_mmu will be +recreated using the new EPTP, and thus any change in A/D enabling will be +properly recognized in the relevant MMU. + +Fixes: 41ab93727467 ("KVM: nVMX: Emulate EPTP switching for the L1 hypervisor") +Signed-off-by: Sean Christopherson +Message-Id: <20210609234235.1244004-4-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/vmx/nested.c | 7 ------- + 1 file changed, 7 deletions(-) + +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index d3774d79916d..618dcf11d688 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -5472,8 +5472,6 @@ static int nested_vmx_eptp_switching(struct kvm_vcpu *vcpu, + { + u32 index = kvm_rcx_read(vcpu); + u64 new_eptp; +- bool accessed_dirty; +- struct kvm_mmu *mmu = vcpu->arch.walk_mmu; + + if (!nested_cpu_has_eptp_switching(vmcs12) || + !nested_cpu_has_ept(vmcs12)) +@@ -5482,13 +5480,10 @@ static int nested_vmx_eptp_switching(struct kvm_vcpu *vcpu, + if (index >= VMFUNC_EPTP_ENTRIES) + return 1; + +- + if (kvm_vcpu_read_guest_page(vcpu, vmcs12->eptp_list_address >> PAGE_SHIFT, + &new_eptp, index * 8, 8)) + return 1; + +- accessed_dirty = !!(new_eptp & VMX_EPTP_AD_ENABLE_BIT); +- + /* + * If the (L2) guest does a vmfunc to the currently + * active ept pointer, we don't have to do anything else +@@ -5497,8 +5492,6 @@ static int nested_vmx_eptp_switching(struct kvm_vcpu *vcpu, + if (!nested_vmx_check_eptp(vcpu, new_eptp)) + return 1; + +- mmu->ept_ad = accessed_dirty; +- mmu->mmu_role.base.ad_disabled = !accessed_dirty; + vmcs12->ept_pointer = new_eptp; + + kvm_make_request(KVM_REQ_MMU_RELOAD, vcpu); +-- +2.30.2 + diff --git a/queue-5.12/kvm-nvmx-ensure-64-bit-shift-when-checking-vmfunc-bi.patch b/queue-5.12/kvm-nvmx-ensure-64-bit-shift-when-checking-vmfunc-bi.patch new file mode 100644 index 00000000000..39f53f5c38a --- /dev/null +++ b/queue-5.12/kvm-nvmx-ensure-64-bit-shift-when-checking-vmfunc-bi.patch @@ -0,0 +1,54 @@ +From b42b9a68b841e0502f8ab4323150fb89b47a3a58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jun 2021 16:42:22 -0700 +Subject: KVM: nVMX: Ensure 64-bit shift when checking VMFUNC bitmap + +From: Sean Christopherson + +[ Upstream commit 0e75225dfa4c5d5d51291f54a3d2d5895bad38da ] + +Use BIT_ULL() instead of an open-coded shift to check whether or not a +function is enabled in L1's VMFUNC bitmap. This is a benign bug as KVM +supports only bit 0, and will fail VM-Enter if any other bits are set, +i.e. bits 63:32 are guaranteed to be zero. + +Note, "function" is bounded by hardware as VMFUNC will #UD before taking +a VM-Exit if the function is greater than 63. + +Before: + if ((vmcs12->vm_function_control & (1 << function)) == 0) + 0x000000000001a916 <+118>: mov $0x1,%eax + 0x000000000001a91b <+123>: shl %cl,%eax + 0x000000000001a91d <+125>: cltq + 0x000000000001a91f <+127>: and 0x128(%rbx),%rax + +After: + if (!(vmcs12->vm_function_control & BIT_ULL(function & 63))) + 0x000000000001a955 <+117>: mov 0x128(%rbx),%rdx + 0x000000000001a95c <+124>: bt %rax,%rdx + +Fixes: 27c42a1bb867 ("KVM: nVMX: Enable VMFUNC for the L1 hypervisor") +Signed-off-by: Sean Christopherson +Message-Id: <20210609234235.1244004-3-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/vmx/nested.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index eca3db08d183..d3774d79916d 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -5524,7 +5524,7 @@ static int handle_vmfunc(struct kvm_vcpu *vcpu) + } + + vmcs12 = get_vmcs12(vcpu); +- if ((vmcs12->vm_function_control & (1 << function)) == 0) ++ if (!(vmcs12->vm_function_control & BIT_ULL(function))) + goto fail; + + switch (function) { +-- +2.30.2 + diff --git a/queue-5.12/kvm-nvmx-sync-all-pgds-on-nested-transition-with-sha.patch b/queue-5.12/kvm-nvmx-sync-all-pgds-on-nested-transition-with-sha.patch new file mode 100644 index 00000000000..a4ae843ab24 --- /dev/null +++ b/queue-5.12/kvm-nvmx-sync-all-pgds-on-nested-transition-with-sha.patch @@ -0,0 +1,113 @@ +From 2770f49060077745fd6dc0fccec1cc74be3e6cee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jun 2021 16:42:21 -0700 +Subject: KVM: nVMX: Sync all PGDs on nested transition with shadow paging + +From: Sean Christopherson + +[ Upstream commit 07ffaf343e34b555c9e7ea39a9c81c439a706f13 ] + +Trigger a full TLB flush on behalf of the guest on nested VM-Enter and +VM-Exit when VPID is disabled for L2. kvm_mmu_new_pgd() syncs only the +current PGD, which can theoretically leave stale, unsync'd entries in a +previous guest PGD, which could be consumed if L2 is allowed to load CR3 +with PCID_NOFLUSH=1. + +Rename KVM_REQ_HV_TLB_FLUSH to KVM_REQ_TLB_FLUSH_GUEST so that it can +be utilized for its obvious purpose of emulating a guest TLB flush. + +Note, there is no change the actual TLB flush executed by KVM, even +though the fast PGD switch uses KVM_REQ_TLB_FLUSH_CURRENT. When VPID is +disabled for L2, vpid02 is guaranteed to be '0', and thus +nested_get_vpid02() will return the VPID that is shared by L1 and L2. + +Generate the request outside of kvm_mmu_new_pgd(), as getting the common +helper to correctly identify which requested is needed is quite painful. +E.g. using KVM_REQ_TLB_FLUSH_GUEST when nested EPT is in play is wrong as +a TLB flush from the L1 kernel's perspective does not invalidate EPT +mappings. And, by using KVM_REQ_TLB_FLUSH_GUEST, nVMX can do future +simplification by moving the logic into nested_vmx_transition_tlb_flush(). + +Fixes: 41fab65e7c44 ("KVM: nVMX: Skip MMU sync on nested VMX transition when possible") +Signed-off-by: Sean Christopherson +Message-Id: <20210609234235.1244004-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/kvm_host.h | 2 +- + arch/x86/kvm/hyperv.c | 2 +- + arch/x86/kvm/vmx/nested.c | 17 ++++++++++++----- + arch/x86/kvm/x86.c | 2 +- + 4 files changed, 15 insertions(+), 8 deletions(-) + +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 0702adf2460b..0758ff3008c6 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -85,7 +85,7 @@ + #define KVM_REQ_APICV_UPDATE \ + KVM_ARCH_REQ_FLAGS(25, KVM_REQUEST_WAIT | KVM_REQUEST_NO_WAKEUP) + #define KVM_REQ_TLB_FLUSH_CURRENT KVM_ARCH_REQ(26) +-#define KVM_REQ_HV_TLB_FLUSH \ ++#define KVM_REQ_TLB_FLUSH_GUEST \ + KVM_ARCH_REQ_FLAGS(27, KVM_REQUEST_NO_WAKEUP) + #define KVM_REQ_APF_READY KVM_ARCH_REQ(28) + #define KVM_REQ_MSR_FILTER_CHANGED KVM_ARCH_REQ(29) +diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c +index f00830e5202f..fdd1eca717fd 100644 +--- a/arch/x86/kvm/hyperv.c ++++ b/arch/x86/kvm/hyperv.c +@@ -1704,7 +1704,7 @@ static u64 kvm_hv_flush_tlb(struct kvm_vcpu *vcpu, u64 ingpa, u16 rep_cnt, bool + * vcpu->arch.cr3 may not be up-to-date for running vCPUs so we can't + * analyze it here, flush TLB regardless of the specified address space. + */ +- kvm_make_vcpus_request_mask(kvm, KVM_REQ_HV_TLB_FLUSH, ++ kvm_make_vcpus_request_mask(kvm, KVM_REQ_TLB_FLUSH_GUEST, + NULL, vcpu_mask, &hv_vcpu->tlb_flush); + + ret_success: +diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c +index 8cb5a95e0c54..eca3db08d183 100644 +--- a/arch/x86/kvm/vmx/nested.c ++++ b/arch/x86/kvm/vmx/nested.c +@@ -1132,12 +1132,19 @@ static int nested_vmx_load_cr3(struct kvm_vcpu *vcpu, unsigned long cr3, bool ne + + /* + * Unconditionally skip the TLB flush on fast CR3 switch, all TLB +- * flushes are handled by nested_vmx_transition_tlb_flush(). See +- * nested_vmx_transition_mmu_sync for details on skipping the MMU sync. ++ * flushes are handled by nested_vmx_transition_tlb_flush(). + */ +- if (!nested_ept) +- kvm_mmu_new_pgd(vcpu, cr3, true, +- !nested_vmx_transition_mmu_sync(vcpu)); ++ if (!nested_ept) { ++ kvm_mmu_new_pgd(vcpu, cr3, true, true); ++ ++ /* ++ * A TLB flush on VM-Enter/VM-Exit flushes all linear mappings ++ * across all PCIDs, i.e. all PGDs need to be synchronized. ++ * See nested_vmx_transition_mmu_sync() for more details. ++ */ ++ if (nested_vmx_transition_mmu_sync(vcpu)) ++ kvm_make_request(KVM_REQ_TLB_FLUSH_GUEST, vcpu); ++ } + + vcpu->arch.cr3 = cr3; + kvm_register_mark_available(vcpu, VCPU_EXREG_CR3); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index d46a6182d0e9..615dd236e842 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -9022,7 +9022,7 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu) + } + if (kvm_check_request(KVM_REQ_TLB_FLUSH_CURRENT, vcpu)) + kvm_vcpu_flush_tlb_current(vcpu); +- if (kvm_check_request(KVM_REQ_HV_TLB_FLUSH, vcpu)) ++ if (kvm_check_request(KVM_REQ_TLB_FLUSH_GUEST, vcpu)) + kvm_vcpu_flush_tlb_guest(vcpu); + + if (kvm_check_request(KVM_REQ_REPORT_TPR_ACCESS, vcpu)) { +-- +2.30.2 + diff --git a/queue-5.12/kvm-ppc-book3s-hv-fix-tlb-management-on-smt8-power9-.patch b/queue-5.12/kvm-ppc-book3s-hv-fix-tlb-management-on-smt8-power9-.patch new file mode 100644 index 00000000000..89205f1bbe4 --- /dev/null +++ b/queue-5.12/kvm-ppc-book3s-hv-fix-tlb-management-on-smt8-power9-.patch @@ -0,0 +1,142 @@ +From ba139973580f30fcd6320ad33ff11610bf9fe85f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 14:04:41 +1000 +Subject: KVM: PPC: Book3S HV: Fix TLB management on SMT8 POWER9 and POWER10 + processors + +From: Suraj Jitindar Singh + +[ Upstream commit 77bbbc0cf84834ed130838f7ac1988567f4d0288 ] + +The POWER9 vCPU TLB management code assumes all threads in a core share +a TLB, and that TLBIEL execued by one thread will invalidate TLBs for +all threads. This is not the case for SMT8 capable POWER9 and POWER10 +(big core) processors, where the TLB is split between groups of threads. +This results in TLB multi-hits, random data corruption, etc. + +Fix this by introducing cpu_first_tlb_thread_sibling etc., to determine +which siblings share TLBs, and use that in the guest TLB flushing code. + +[npiggin@gmail.com: add changelog and comment] + +Signed-off-by: Paul Mackerras +Signed-off-by: Nicholas Piggin +Reviewed-by: Fabiano Rosas +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210602040441.3984352-1-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/cputhreads.h | 30 +++++++++++++++++++++++++++ + arch/powerpc/kvm/book3s_hv.c | 13 ++++++------ + arch/powerpc/kvm/book3s_hv_builtin.c | 2 +- + arch/powerpc/kvm/book3s_hv_rm_mmu.c | 2 +- + 4 files changed, 39 insertions(+), 8 deletions(-) + +diff --git a/arch/powerpc/include/asm/cputhreads.h b/arch/powerpc/include/asm/cputhreads.h +index 98c8bd155bf9..b167186aaee4 100644 +--- a/arch/powerpc/include/asm/cputhreads.h ++++ b/arch/powerpc/include/asm/cputhreads.h +@@ -98,6 +98,36 @@ static inline int cpu_last_thread_sibling(int cpu) + return cpu | (threads_per_core - 1); + } + ++/* ++ * tlb_thread_siblings are siblings which share a TLB. This is not ++ * architected, is not something a hypervisor could emulate and a future ++ * CPU may change behaviour even in compat mode, so this should only be ++ * used on PowerNV, and only with care. ++ */ ++static inline int cpu_first_tlb_thread_sibling(int cpu) ++{ ++ if (cpu_has_feature(CPU_FTR_ARCH_300) && (threads_per_core == 8)) ++ return cpu & ~0x6; /* Big Core */ ++ else ++ return cpu_first_thread_sibling(cpu); ++} ++ ++static inline int cpu_last_tlb_thread_sibling(int cpu) ++{ ++ if (cpu_has_feature(CPU_FTR_ARCH_300) && (threads_per_core == 8)) ++ return cpu | 0x6; /* Big Core */ ++ else ++ return cpu_last_thread_sibling(cpu); ++} ++ ++static inline int cpu_tlb_thread_sibling_step(void) ++{ ++ if (cpu_has_feature(CPU_FTR_ARCH_300) && (threads_per_core == 8)) ++ return 2; /* Big Core */ ++ else ++ return 1; ++} ++ + static inline u32 get_tensr(void) + { + #ifdef CONFIG_BOOKE +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index 60c5bc0c130c..1c6e0a52fb53 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -2619,7 +2619,7 @@ static void radix_flush_cpu(struct kvm *kvm, int cpu, struct kvm_vcpu *vcpu) + cpumask_t *cpu_in_guest; + int i; + +- cpu = cpu_first_thread_sibling(cpu); ++ cpu = cpu_first_tlb_thread_sibling(cpu); + if (nested) { + cpumask_set_cpu(cpu, &nested->need_tlb_flush); + cpu_in_guest = &nested->cpu_in_guest; +@@ -2633,9 +2633,10 @@ static void radix_flush_cpu(struct kvm *kvm, int cpu, struct kvm_vcpu *vcpu) + * the other side is the first smp_mb() in kvmppc_run_core(). + */ + smp_mb(); +- for (i = 0; i < threads_per_core; ++i) +- if (cpumask_test_cpu(cpu + i, cpu_in_guest)) +- smp_call_function_single(cpu + i, do_nothing, NULL, 1); ++ for (i = cpu; i <= cpu_last_tlb_thread_sibling(cpu); ++ i += cpu_tlb_thread_sibling_step()) ++ if (cpumask_test_cpu(i, cpu_in_guest)) ++ smp_call_function_single(i, do_nothing, NULL, 1); + } + + static void kvmppc_prepare_radix_vcpu(struct kvm_vcpu *vcpu, int pcpu) +@@ -2666,8 +2667,8 @@ static void kvmppc_prepare_radix_vcpu(struct kvm_vcpu *vcpu, int pcpu) + */ + if (prev_cpu != pcpu) { + if (prev_cpu >= 0 && +- cpu_first_thread_sibling(prev_cpu) != +- cpu_first_thread_sibling(pcpu)) ++ cpu_first_tlb_thread_sibling(prev_cpu) != ++ cpu_first_tlb_thread_sibling(pcpu)) + radix_flush_cpu(kvm, prev_cpu, vcpu); + if (nested) + nested->prev_cpu[vcpu->arch.nested_vcpu_id] = pcpu; +diff --git a/arch/powerpc/kvm/book3s_hv_builtin.c b/arch/powerpc/kvm/book3s_hv_builtin.c +index 158d309b42a3..b5e5d07cb40f 100644 +--- a/arch/powerpc/kvm/book3s_hv_builtin.c ++++ b/arch/powerpc/kvm/book3s_hv_builtin.c +@@ -797,7 +797,7 @@ void kvmppc_check_need_tlb_flush(struct kvm *kvm, int pcpu, + * Thus we make all 4 threads use the same bit. + */ + if (cpu_has_feature(CPU_FTR_ARCH_300)) +- pcpu = cpu_first_thread_sibling(pcpu); ++ pcpu = cpu_first_tlb_thread_sibling(pcpu); + + if (nested) + need_tlb_flush = &nested->need_tlb_flush; +diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c +index 88da2764c1bb..3ddc83d2e849 100644 +--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c ++++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c +@@ -67,7 +67,7 @@ static int global_invalidates(struct kvm *kvm) + * so use the bit for the first thread to represent the core. + */ + if (cpu_has_feature(CPU_FTR_ARCH_300)) +- cpu = cpu_first_thread_sibling(cpu); ++ cpu = cpu_first_tlb_thread_sibling(cpu); + cpumask_clear_cpu(cpu, &kvm->arch.need_tlb_flush); + } + +-- +2.30.2 + diff --git a/queue-5.12/kvm-s390-get-rid-of-register-asm-usage.patch b/queue-5.12/kvm-s390-get-rid-of-register-asm-usage.patch new file mode 100644 index 00000000000..6cd583978b6 --- /dev/null +++ b/queue-5.12/kvm-s390-get-rid-of-register-asm-usage.patch @@ -0,0 +1,78 @@ +From 9059bf311d34e1ede6642dca94fa813c3cb6f9c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 16:03:56 +0200 +Subject: KVM: s390: get rid of register asm usage + +From: Heiko Carstens + +[ Upstream commit 4fa3b91bdee1b08348c82660668ca0ca34e271ad ] + +Using register asm statements has been proven to be very error prone, +especially when using code instrumentation where gcc may add function +calls, which clobbers register contents in an unexpected way. + +Therefore get rid of register asm statements in kvm code, even though +there is currently nothing wrong with them. This way we know for sure +that this bug class won't be introduced here. + +Signed-off-by: Heiko Carstens +Reviewed-by: Christian Borntraeger +Reviewed-by: Thomas Huth +Reviewed-by: Cornelia Huck +Reviewed-by: Claudio Imbrenda +Link: https://lore.kernel.org/r/20210621140356.1210771-1-hca@linux.ibm.com +[borntraeger@de.ibm.com: checkpatch strict fix] +Signed-off-by: Christian Borntraeger +Signed-off-by: Sasha Levin +--- + arch/s390/kvm/kvm-s390.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 24ad447e648c..dd7136b3ed9a 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -323,31 +323,31 @@ static void allow_cpu_feat(unsigned long nr) + + static inline int plo_test_bit(unsigned char nr) + { +- register unsigned long r0 asm("0") = (unsigned long) nr | 0x100; ++ unsigned long function = (unsigned long)nr | 0x100; + int cc; + + asm volatile( ++ " lgr 0,%[function]\n" + /* Parameter registers are ignored for "test bit" */ + " plo 0,0,0,0(0)\n" + " ipm %0\n" + " srl %0,28\n" + : "=d" (cc) +- : "d" (r0) +- : "cc"); ++ : [function] "d" (function) ++ : "cc", "0"); + return cc == 0; + } + + static __always_inline void __insn32_query(unsigned int opcode, u8 *query) + { +- register unsigned long r0 asm("0") = 0; /* query function */ +- register unsigned long r1 asm("1") = (unsigned long) query; +- + asm volatile( +- /* Parameter regs are ignored */ ++ " lghi 0,0\n" ++ " lgr 1,%[query]\n" ++ /* Parameter registers are ignored */ + " .insn rrf,%[opc] << 16,2,4,6,0\n" + : +- : "d" (r0), "a" (r1), [opc] "i" (opcode) +- : "cc", "memory"); ++ : [query] "d" ((unsigned long)query), [opc] "i" (opcode) ++ : "cc", "memory", "0", "1"); + } + + #define INSN_SORTL 0xb938 +-- +2.30.2 + diff --git a/queue-5.12/kvm-selftests-fix-triple-fault-if-ept-0-in-dirty_log.patch b/queue-5.12/kvm-selftests-fix-triple-fault-if-ept-0-in-dirty_log.patch new file mode 100644 index 00000000000..25b2d46fb60 --- /dev/null +++ b/queue-5.12/kvm-selftests-fix-triple-fault-if-ept-0-in-dirty_log.patch @@ -0,0 +1,94 @@ +From abae7d8062a955b0d0dd793b6bae320b6003917c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 21:55:32 +0800 +Subject: KVM: selftests: fix triple fault if ept=0 in dirty_log_test + +From: Hou Wenlong + +[ Upstream commit e5830fb13b8cad5e3bdf84f0f7a3dcb4f4d9bcbb ] + +Commit 22f232d134e1 ("KVM: selftests: x86: Set supported CPUIDs on +default VM") moved vcpu_set_cpuid into vm_create_with_vcpus, but +dirty_log_test doesn't use it to create vm. So vcpu's CPUIDs is +not set, the guest's pa_bits in kvm would be smaller than the +value queried by userspace. + +However, the dirty track memory slot is in the highest GPA, the +reserved bits in gpte would be set with wrong pa_bits. +For shadow paging, page fault would fail in permission_fault and +be injected into guest. Since guest doesn't have idt, it finally +leads to vm_exit for triple fault. + +Move vcpu_set_cpuid into vm_vcpu_add_default to set supported +CPUIDs on default vcpu, since almost all tests need it. + +Fixes: 22f232d134e1 ("KVM: selftests: x86: Set supported CPUIDs on default VM") +Signed-off-by: Hou Wenlong +Message-Id: <411ea2173f89abce56fc1fca5af913ed9c5a89c9.1624351343.git.houwenlong93@linux.alibaba.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/lib/kvm_util.c | 4 ---- + tools/testing/selftests/kvm/lib/x86_64/processor.c | 3 +++ + tools/testing/selftests/kvm/steal_time.c | 2 -- + tools/testing/selftests/kvm/x86_64/set_boot_cpu_id.c | 2 -- + 4 files changed, 3 insertions(+), 8 deletions(-) + +diff --git a/tools/testing/selftests/kvm/lib/kvm_util.c b/tools/testing/selftests/kvm/lib/kvm_util.c +index 8b90256bca96..03e13938fd07 100644 +--- a/tools/testing/selftests/kvm/lib/kvm_util.c ++++ b/tools/testing/selftests/kvm/lib/kvm_util.c +@@ -310,10 +310,6 @@ struct kvm_vm *vm_create_with_vcpus(enum vm_guest_mode mode, uint32_t nr_vcpus, + uint32_t vcpuid = vcpuids ? vcpuids[i] : i; + + vm_vcpu_add_default(vm, vcpuid, guest_code); +- +-#ifdef __x86_64__ +- vcpu_set_cpuid(vm, vcpuid, kvm_get_supported_cpuid()); +-#endif + } + + return vm; +diff --git a/tools/testing/selftests/kvm/lib/x86_64/processor.c b/tools/testing/selftests/kvm/lib/x86_64/processor.c +index a8906e60a108..09cc685599a2 100644 +--- a/tools/testing/selftests/kvm/lib/x86_64/processor.c ++++ b/tools/testing/selftests/kvm/lib/x86_64/processor.c +@@ -600,6 +600,9 @@ void vm_vcpu_add_default(struct kvm_vm *vm, uint32_t vcpuid, void *guest_code) + /* Setup the MP state */ + mp_state.mp_state = 0; + vcpu_set_mp_state(vm, vcpuid, &mp_state); ++ ++ /* Setup supported CPUIDs */ ++ vcpu_set_cpuid(vm, vcpuid, kvm_get_supported_cpuid()); + } + + /* +diff --git a/tools/testing/selftests/kvm/steal_time.c b/tools/testing/selftests/kvm/steal_time.c +index fcc840088c91..a6fe75cb9a6e 100644 +--- a/tools/testing/selftests/kvm/steal_time.c ++++ b/tools/testing/selftests/kvm/steal_time.c +@@ -73,8 +73,6 @@ static void steal_time_init(struct kvm_vm *vm) + for (i = 0; i < NR_VCPUS; ++i) { + int ret; + +- vcpu_set_cpuid(vm, i, kvm_get_supported_cpuid()); +- + /* ST_GPA_BASE is identity mapped */ + st_gva[i] = (void *)(ST_GPA_BASE + i * STEAL_TIME_SIZE); + sync_global_to_guest(vm, st_gva[i]); +diff --git a/tools/testing/selftests/kvm/x86_64/set_boot_cpu_id.c b/tools/testing/selftests/kvm/x86_64/set_boot_cpu_id.c +index 12c558fc8074..c8d2bbe202d0 100644 +--- a/tools/testing/selftests/kvm/x86_64/set_boot_cpu_id.c ++++ b/tools/testing/selftests/kvm/x86_64/set_boot_cpu_id.c +@@ -106,8 +106,6 @@ static void add_x86_vcpu(struct kvm_vm *vm, uint32_t vcpuid, bool bsp_code) + vm_vcpu_add_default(vm, vcpuid, guest_bsp_vcpu); + else + vm_vcpu_add_default(vm, vcpuid, guest_not_bsp_vcpu); +- +- vcpu_set_cpuid(vm, vcpuid, kvm_get_supported_cpuid()); + } + + static void run_vm_bsp(uint32_t bsp_vcpu) +-- +2.30.2 + diff --git a/queue-5.12/kvm-selftests-remove-errant-asm-barrier.h-include-to.patch b/queue-5.12/kvm-selftests-remove-errant-asm-barrier.h-include-to.patch new file mode 100644 index 00000000000..f964e8892a9 --- /dev/null +++ b/queue-5.12/kvm-selftests-remove-errant-asm-barrier.h-include-to.patch @@ -0,0 +1,49 @@ +From 5ef3b830b0a40ccfd667a14e1ea87e65c96f51a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 13:05:11 -0700 +Subject: KVM: selftests: Remove errant asm/barrier.h include to fix arm64 + build + +From: Sean Christopherson + +[ Upstream commit ecc3a92c6f4953c134a9590c762755e6593f507c ] + +Drop an unnecessary include of asm/barrier.h from dirty_log_test.c to +allow the test to build on arm64. arm64, s390, and x86 all build cleanly +without the include (PPC and MIPS aren't supported in KVM's selftests). + +arm64's barrier.h includes linux/kasan-checks.h, which is not copied +into tools/. + + In file included from ../../../../tools/include/asm/barrier.h:8, + from dirty_log_test.c:19: + .../arm64/include/asm/barrier.h:12:10: fatal error: linux/kasan-checks.h: No such file or directory + 12 | #include + | ^~~~~~~~~~~~~~~~~~~~~~ + compilation terminated. + +Fixes: 84292e565951 ("KVM: selftests: Add dirty ring buffer test") +Cc: Peter Xu +Signed-off-by: Sean Christopherson +Message-Id: <20210622200529.3650424-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/kvm/dirty_log_test.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/tools/testing/selftests/kvm/dirty_log_test.c b/tools/testing/selftests/kvm/dirty_log_test.c +index 81edbd23d371..b4d24f50aca6 100644 +--- a/tools/testing/selftests/kvm/dirty_log_test.c ++++ b/tools/testing/selftests/kvm/dirty_log_test.c +@@ -16,7 +16,6 @@ + #include + #include + #include +-#include + #include + + #include "kvm_util.h" +-- +2.30.2 + diff --git a/queue-5.12/kvm-x86-mmu-drop-redundant-trace_kvm_mmu_set_spte-in.patch b/queue-5.12/kvm-x86-mmu-drop-redundant-trace_kvm_mmu_set_spte-in.patch new file mode 100644 index 00000000000..ba68063eca9 --- /dev/null +++ b/queue-5.12/kvm-x86-mmu-drop-redundant-trace_kvm_mmu_set_spte-in.patch @@ -0,0 +1,46 @@ +From f81ff4cc5fd98c9d7727231bf15fa483a999eec1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Feb 2021 12:47:33 -0800 +Subject: KVM: x86/mmu: Drop redundant trace_kvm_mmu_set_spte() in the TDP MMU + +From: Sean Christopherson + +[ Upstream commit 3849e0924ef14a245aa292ecaa9accdc4792012c ] + +Remove TDP MMU's call to trace_kvm_mmu_set_spte() that is done for both +shadow-present SPTEs and MMIO SPTEs. It's fully redundant for the +former, and unnecessary for the latter. This aligns TDP MMU tracing +behavior with that of the legacy MMU. + +Fixes: 33dd3574f5fe ("kvm: x86/mmu: Add existing trace points to TDP MMU") +Cc: Ben Gardon +Signed-off-by: Sean Christopherson +Message-Id: <20210225204749.1512652-9-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/mmu/tdp_mmu.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c +index 0aca7dcbcbf9..7cfb55788df5 100644 +--- a/arch/x86/kvm/mmu/tdp_mmu.c ++++ b/arch/x86/kvm/mmu/tdp_mmu.c +@@ -777,12 +777,11 @@ static int tdp_mmu_map_handle_target_level(struct kvm_vcpu *vcpu, int write, + trace_mark_mmio_spte(rcu_dereference(iter->sptep), iter->gfn, + new_spte); + ret = RET_PF_EMULATE; +- } else ++ } else { + trace_kvm_mmu_set_spte(iter->level, iter->gfn, + rcu_dereference(iter->sptep)); ++ } + +- trace_kvm_mmu_set_spte(iter->level, iter->gfn, +- rcu_dereference(iter->sptep)); + if (!prefault) + vcpu->stat.pf_fixed++; + +-- +2.30.2 + diff --git a/queue-5.12/kvm-x86-mmu-fix-pf_fixed-count-in-tdp_mmu_map_handle.patch b/queue-5.12/kvm-x86-mmu-fix-pf_fixed-count-in-tdp_mmu_map_handle.patch new file mode 100644 index 00000000000..4239564bea0 --- /dev/null +++ b/queue-5.12/kvm-x86-mmu-fix-pf_fixed-count-in-tdp_mmu_map_handle.patch @@ -0,0 +1,56 @@ +From e664e0ded76650b9c408d5731c7ea345ab4c076c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 12:57:10 +1200 +Subject: KVM: x86/mmu: Fix pf_fixed count in tdp_mmu_map_handle_target_level() + +From: Kai Huang + +[ Upstream commit 857f84743e4b78500afae010d866675642e18e90 ] + +Currently pf_fixed is not increased when prefault is true. This is not +correct, since prefault here really means "async page fault completed". +In that case, the original page fault from the guest was morphed into as +async page fault and pf_fixed was not increased. So when prefault +indicates async page fault is completed, pf_fixed should be increased. + +Additionally, currently pf_fixed is also increased even when page fault +is spurious, while legacy MMU increases pf_fixed when page fault returns +RET_PF_EMULATE or RET_PF_FIXED. + +To fix above two issues, change to increase pf_fixed when return value +is not RET_PF_SPURIOUS (RET_PF_RETRY has already been ruled out by +reaching here). + +More information: +https://lore.kernel.org/kvm/cover.1620200410.git.kai.huang@intel.com/T/#mbb5f8083e58a2cd262231512b9211cbe70fc3bd5 + +Fixes: bb18842e2111 ("kvm: x86/mmu: Add TDP MMU PF handler") +Reviewed-by: Sean Christopherson +Signed-off-by: Kai Huang +Message-Id: <2ea8b7f5d4f03c99b32bc56fc982e1e4e3d3fc6b.1623717884.git.kai.huang@intel.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/mmu/tdp_mmu.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c +index 7cfb55788df5..5c83b912becc 100644 +--- a/arch/x86/kvm/mmu/tdp_mmu.c ++++ b/arch/x86/kvm/mmu/tdp_mmu.c +@@ -782,7 +782,11 @@ static int tdp_mmu_map_handle_target_level(struct kvm_vcpu *vcpu, int write, + rcu_dereference(iter->sptep)); + } + +- if (!prefault) ++ /* ++ * Increase pf_fixed in both RET_PF_EMULATE and RET_PF_FIXED to be ++ * consistent with legacy MMU behavior. ++ */ ++ if (ret != RET_PF_SPURIOUS) + vcpu->stat.pf_fixed++; + + return ret; +-- +2.30.2 + diff --git a/queue-5.12/kvm-x86-mmu-fix-return-value-in-tdp_mmu_map_handle_t.patch b/queue-5.12/kvm-x86-mmu-fix-return-value-in-tdp_mmu_map_handle_t.patch new file mode 100644 index 00000000000..941907b5117 --- /dev/null +++ b/queue-5.12/kvm-x86-mmu-fix-return-value-in-tdp_mmu_map_handle_t.patch @@ -0,0 +1,45 @@ +From 5712792ef5b72bbf9a10fee17dd88f72145753e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 12:57:09 +1200 +Subject: KVM: x86/mmu: Fix return value in tdp_mmu_map_handle_target_level() + +From: Kai Huang + +[ Upstream commit 57a3e96d6d17ae5ac9861ef34af024a627f1c3bb ] + +Currently tdp_mmu_map_handle_target_level() returns 0, which is +RET_PF_RETRY, when page fault is actually fixed. This makes +kvm_tdp_mmu_map() also return RET_PF_RETRY in this case, instead of +RET_PF_FIXED. Fix by initializing ret to RET_PF_FIXED. + +Note that kvm_mmu_page_fault() resumes guest on both RET_PF_RETRY and +RET_PF_FIXED, which means in practice returning the two won't make +difference, so this fix alone won't be necessary for stable tree. + +Fixes: bb18842e2111 ("kvm: x86/mmu: Add TDP MMU PF handler") +Reviewed-by: Sean Christopherson +Reviewed-by: Ben Gardon +Signed-off-by: Kai Huang +Message-Id: +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/mmu/tdp_mmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/mmu/tdp_mmu.c b/arch/x86/kvm/mmu/tdp_mmu.c +index 018d82e73e31..0aca7dcbcbf9 100644 +--- a/arch/x86/kvm/mmu/tdp_mmu.c ++++ b/arch/x86/kvm/mmu/tdp_mmu.c +@@ -745,7 +745,7 @@ static int tdp_mmu_map_handle_target_level(struct kvm_vcpu *vcpu, int write, + kvm_pfn_t pfn, bool prefault) + { + u64 new_spte; +- int ret = 0; ++ int ret = RET_PF_FIXED; + int make_spte_ret = 0; + + if (unlikely(is_noslot_pfn(pfn))) +-- +2.30.2 + diff --git a/queue-5.12/leds-as3645a-fix-error-return-code-in-as3645a_parse_.patch b/queue-5.12/leds-as3645a-fix-error-return-code-in-as3645a_parse_.patch new file mode 100644 index 00000000000..83d6a3869e5 --- /dev/null +++ b/queue-5.12/leds-as3645a-fix-error-return-code-in-as3645a_parse_.patch @@ -0,0 +1,37 @@ +From 2be1425caa78c2784fb735a755bdbd657456bd41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 11:06:46 +0800 +Subject: leds: as3645a: Fix error return code in as3645a_parse_node() + +From: Zhen Lei + +[ Upstream commit 96a30960a2c5246c8ffebe8a3c9031f9df094d97 ] + +Return error code -ENODEV rather than '0' when the indicator node can not +be found. + +Fixes: a56ba8fbcb55 ("media: leds: as3645a: Add LED flash class driver") +Reported-by: Hulk Robot +Acked-by: Sakari Ailus +Signed-off-by: Zhen Lei +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-as3645a.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/leds/leds-as3645a.c b/drivers/leds/leds-as3645a.c +index e8922fa03379..80411d41e802 100644 +--- a/drivers/leds/leds-as3645a.c ++++ b/drivers/leds/leds-as3645a.c +@@ -545,6 +545,7 @@ static int as3645a_parse_node(struct as3645a *flash, + if (!flash->indicator_node) { + dev_warn(&flash->client->dev, + "can't find indicator node\n"); ++ rval = -ENODEV; + goto out_err; + } + +-- +2.30.2 + diff --git a/queue-5.12/leds-class-the-enotsupp-should-never-be-seen-by-user.patch b/queue-5.12/leds-class-the-enotsupp-should-never-be-seen-by-user.patch new file mode 100644 index 00000000000..01269c8e2ba --- /dev/null +++ b/queue-5.12/leds-class-the-enotsupp-should-never-be-seen-by-user.patch @@ -0,0 +1,39 @@ +From 9b3662f7d5a6cfb583d9f255e164ecf50e60b846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 12:50:18 +0300 +Subject: leds: class: The -ENOTSUPP should never be seen by user space + +From: Andy Shevchenko + +[ Upstream commit 0ac40af86077982a5346dbc9655172d2775d6b08 ] + +Drop the bogus error code and let of_led_get() to take care about absent +of_node. + +Fixes: e389240ad992 ("leds: Add managed API to get a LED from a device driver") +Cc: Jean-Jacques Hiblot +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/led-class.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index 2e495ff67856..fa3f5f504ff7 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -285,10 +285,6 @@ struct led_classdev *__must_check devm_of_led_get(struct device *dev, + if (!dev) + return ERR_PTR(-EINVAL); + +- /* Not using device tree? */ +- if (!IS_ENABLED(CONFIG_OF) || !dev->of_node) +- return ERR_PTR(-ENOTSUPP); +- + led = of_led_get(dev->of_node, index); + if (IS_ERR(led)) + return led; +-- +2.30.2 + diff --git a/queue-5.12/leds-ktd2692-fix-an-error-handling-path.patch b/queue-5.12/leds-ktd2692-fix-an-error-handling-path.patch new file mode 100644 index 00000000000..d42cdb4c5fa --- /dev/null +++ b/queue-5.12/leds-ktd2692-fix-an-error-handling-path.patch @@ -0,0 +1,85 @@ +From f4b8073dca77429f200fe51a98f9cf479f4524fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 13:21:01 +0200 +Subject: leds: ktd2692: Fix an error handling path + +From: Christophe JAILLET + +[ Upstream commit ee78b9360e14c276f5ceaa4a0d06f790f04ccdad ] + +In 'ktd2692_parse_dt()', if an error occurs after a successful +'regulator_enable()' call, we should call 'regulator_enable()'. + +This is the same in 'ktd2692_probe()', if an error occurs after a +successful 'ktd2692_parse_dt()' call. + +Instead of adding 'regulator_enable()' in several places, implement a +resource managed solution and simplify the remove function accordingly. + +Fixes: b7da8c5c725c ("leds: Add ktd2692 flash LED driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-ktd2692.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/drivers/leds/leds-ktd2692.c b/drivers/leds/leds-ktd2692.c +index 632f10db4b3f..f341da1503a4 100644 +--- a/drivers/leds/leds-ktd2692.c ++++ b/drivers/leds/leds-ktd2692.c +@@ -256,6 +256,17 @@ static void ktd2692_setup(struct ktd2692_context *led) + | KTD2692_REG_FLASH_CURRENT_BASE); + } + ++static void regulator_disable_action(void *_data) ++{ ++ struct device *dev = _data; ++ struct ktd2692_context *led = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = regulator_disable(led->regulator); ++ if (ret) ++ dev_err(dev, "Failed to disable supply: %d\n", ret); ++} ++ + static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev, + struct ktd2692_led_config_data *cfg) + { +@@ -286,8 +297,14 @@ static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev, + + if (led->regulator) { + ret = regulator_enable(led->regulator); +- if (ret) ++ if (ret) { + dev_err(dev, "Failed to enable supply: %d\n", ret); ++ } else { ++ ret = devm_add_action_or_reset(dev, ++ regulator_disable_action, dev); ++ if (ret) ++ return ret; ++ } + } + + child_node = of_get_next_available_child(np, NULL); +@@ -377,17 +394,9 @@ static int ktd2692_probe(struct platform_device *pdev) + static int ktd2692_remove(struct platform_device *pdev) + { + struct ktd2692_context *led = platform_get_drvdata(pdev); +- int ret; + + led_classdev_flash_unregister(&led->fled_cdev); + +- if (led->regulator) { +- ret = regulator_disable(led->regulator); +- if (ret) +- dev_err(&pdev->dev, +- "Failed to disable supply: %d\n", ret); +- } +- + mutex_destroy(&led->lock); + + return 0; +-- +2.30.2 + diff --git a/queue-5.12/leds-lgm-fix-spelling-mistake-prepate-prepare.patch b/queue-5.12/leds-lgm-fix-spelling-mistake-prepate-prepare.patch new file mode 100644 index 00000000000..d2c0416b39e --- /dev/null +++ b/queue-5.12/leds-lgm-fix-spelling-mistake-prepate-prepare.patch @@ -0,0 +1,34 @@ +From 40e53d8fe65996fc2c7dd68920c7799ca88aad6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Feb 2021 13:49:39 +0000 +Subject: leds: lgm: Fix spelling mistake "prepate" -> "prepare" + +From: Colin Ian King + +[ Upstream commit ec50536b7840dde085185d9570fa19d0baf5042c ] + +There is a spelling mistake in a dev_err error message. Fix it. + +Signed-off-by: Colin Ian King +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/blink/leds-lgm-sso.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c +index 7d5c9ca007d6..6a63846d10b5 100644 +--- a/drivers/leds/blink/leds-lgm-sso.c ++++ b/drivers/leds/blink/leds-lgm-sso.c +@@ -793,7 +793,7 @@ static int intel_sso_led_probe(struct platform_device *pdev) + + ret = clk_prepare_enable(priv->gclk); + if (ret) { +- dev_err(dev, "Failed to prepate/enable sso gate clock!\n"); ++ dev_err(dev, "Failed to prepare/enable sso gate clock!\n"); + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.12/leds-lgm-sso-fix-clock-handling.patch b/queue-5.12/leds-lgm-sso-fix-clock-handling.patch new file mode 100644 index 00000000000..472aff148b6 --- /dev/null +++ b/queue-5.12/leds-lgm-sso-fix-clock-handling.patch @@ -0,0 +1,117 @@ +From 75e46064a5a3ae2fc26ae2aeef8e5e2df4a5763a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 12:50:24 +0300 +Subject: leds: lgm-sso: Fix clock handling + +From: Andy Shevchenko + +[ Upstream commit fba8a6f2263bc54683cf3fd75df4dbd5d041c195 ] + +The clock handling has a few issues: + - when getting second clock fails, the first one left prepared and enabled + - on ->remove() clocks are unprepared and disabled twice + +Fix all these by converting to use bulk clock operations since both clocks +are mandatory. + +Fixes: c3987cd2bca3 ("leds: lgm: Add LED controller driver for LGM SoC") +Cc: Amireddy Mallikarjuna reddy +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/blink/leds-lgm-sso.c | 44 ++++++++++++------------------- + 1 file changed, 17 insertions(+), 27 deletions(-) + +diff --git a/drivers/leds/blink/leds-lgm-sso.c b/drivers/leds/blink/leds-lgm-sso.c +index 6a63846d10b5..7d5f0bf2817a 100644 +--- a/drivers/leds/blink/leds-lgm-sso.c ++++ b/drivers/leds/blink/leds-lgm-sso.c +@@ -132,8 +132,7 @@ struct sso_led_priv { + struct regmap *mmap; + struct device *dev; + struct platform_device *pdev; +- struct clk *gclk; +- struct clk *fpid_clk; ++ struct clk_bulk_data clocks[2]; + u32 fpid_clkrate; + u32 gptc_clkrate; + u32 freq[MAX_FREQ_RANK]; +@@ -763,12 +762,11 @@ static int sso_probe_gpios(struct sso_led_priv *priv) + return sso_gpio_gc_init(dev, priv); + } + +-static void sso_clk_disable(void *data) ++static void sso_clock_disable_unprepare(void *data) + { + struct sso_led_priv *priv = data; + +- clk_disable_unprepare(priv->fpid_clk); +- clk_disable_unprepare(priv->gclk); ++ clk_bulk_disable_unprepare(ARRAY_SIZE(priv->clocks), priv->clocks); + } + + static int intel_sso_led_probe(struct platform_device *pdev) +@@ -785,36 +783,30 @@ static int intel_sso_led_probe(struct platform_device *pdev) + priv->dev = dev; + + /* gate clock */ +- priv->gclk = devm_clk_get(dev, "sso"); +- if (IS_ERR(priv->gclk)) { +- dev_err(dev, "get sso gate clock failed!\n"); +- return PTR_ERR(priv->gclk); +- } ++ priv->clocks[0].id = "sso"; ++ ++ /* fpid clock */ ++ priv->clocks[1].id = "fpid"; + +- ret = clk_prepare_enable(priv->gclk); ++ ret = devm_clk_bulk_get(dev, ARRAY_SIZE(priv->clocks), priv->clocks); + if (ret) { +- dev_err(dev, "Failed to prepare/enable sso gate clock!\n"); ++ dev_err(dev, "Getting clocks failed!\n"); + return ret; + } + +- priv->fpid_clk = devm_clk_get(dev, "fpid"); +- if (IS_ERR(priv->fpid_clk)) { +- dev_err(dev, "Failed to get fpid clock!\n"); +- return PTR_ERR(priv->fpid_clk); +- } +- +- ret = clk_prepare_enable(priv->fpid_clk); ++ ret = clk_bulk_prepare_enable(ARRAY_SIZE(priv->clocks), priv->clocks); + if (ret) { +- dev_err(dev, "Failed to prepare/enable fpid clock!\n"); ++ dev_err(dev, "Failed to prepare and enable clocks!\n"); + return ret; + } +- priv->fpid_clkrate = clk_get_rate(priv->fpid_clk); + +- ret = devm_add_action_or_reset(dev, sso_clk_disable, priv); +- if (ret) { +- dev_err(dev, "Failed to devm_add_action_or_reset, %d\n", ret); ++ ret = devm_add_action_or_reset(dev, sso_clock_disable_unprepare, priv); ++ if (ret) + return ret; +- } ++ ++ priv->fpid_clkrate = clk_get_rate(priv->clocks[1].clk); ++ ++ priv->mmap = syscon_node_to_regmap(dev->of_node); + + priv->mmap = syscon_node_to_regmap(dev->of_node); + if (IS_ERR(priv->mmap)) { +@@ -859,8 +851,6 @@ static int intel_sso_led_remove(struct platform_device *pdev) + sso_led_shutdown(led); + } + +- clk_disable_unprepare(priv->fpid_clk); +- clk_disable_unprepare(priv->gclk); + regmap_exit(priv->mmap); + + return 0; +-- +2.30.2 + diff --git a/queue-5.12/leds-lm3532-select-regmap-i2c-api.patch b/queue-5.12/leds-lm3532-select-regmap-i2c-api.patch new file mode 100644 index 00000000000..dbb1e9c2bab --- /dev/null +++ b/queue-5.12/leds-lm3532-select-regmap-i2c-api.patch @@ -0,0 +1,37 @@ +From 447f6d6c48b17cc25f1999afc409e9a5247e66e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 12:50:31 +0300 +Subject: leds: lm3532: select regmap I2C API + +From: Andy Shevchenko + +[ Upstream commit 99be74f61cb0292b518f5e6d7e5c6611555c2ec7 ] + +Regmap APIs should be selected, otherwise link can fail + +ERROR: modpost: "__devm_regmap_init_i2c" [drivers/leds/leds-lm3532.ko] undefined! + +Fixes: bc1b8492c764 ("leds: lm3532: Introduce the lm3532 LED driver") +Cc: Dan Murphy +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig +index b6742b4231bf..258247dd5e3d 100644 +--- a/drivers/leds/Kconfig ++++ b/drivers/leds/Kconfig +@@ -199,6 +199,7 @@ config LEDS_LM3530 + + config LEDS_LM3532 + tristate "LCD Backlight driver for LM3532" ++ select REGMAP_I2C + depends on LEDS_CLASS + depends on I2C + help +-- +2.30.2 + diff --git a/queue-5.12/leds-lm36274-put-fwnode-in-error-case-during-probe.patch b/queue-5.12/leds-lm36274-put-fwnode-in-error-case-during-probe.patch new file mode 100644 index 00000000000..38414108c60 --- /dev/null +++ b/queue-5.12/leds-lm36274-put-fwnode-in-error-case-during-probe.patch @@ -0,0 +1,43 @@ +From 8f85333080223478c39c15551c19885358599171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 12:50:33 +0300 +Subject: leds: lm36274: Put fwnode in error case during ->probe() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit 3c5f655c44bb65cb7e3c219d08c130ce5fa45d7f ] + +device_get_next_child_node() bumps a reference counting of a returned variable. +We have to balance it whenever we return to the caller. + +In the older code the same is implied with device_for_each_child_node(). + +Fixes: 11e1bbc116a7 ("leds: lm36274: Introduce the TI LM36274 LED driver") +Fixes: a448fcf19c9c ("leds: lm36274: don't iterate through children since there is only one") +Cc: Dan Murphy +Cc: Marek Behún +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lm36274.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/leds/leds-lm36274.c b/drivers/leds/leds-lm36274.c +index aadb03468a40..a23a9424c2f3 100644 +--- a/drivers/leds/leds-lm36274.c ++++ b/drivers/leds/leds-lm36274.c +@@ -127,6 +127,7 @@ static int lm36274_probe(struct platform_device *pdev) + + ret = lm36274_init(chip); + if (ret) { ++ fwnode_handle_put(init_data.fwnode); + dev_err(chip->dev, "Failed to init the device\n"); + return ret; + } +-- +2.30.2 + diff --git a/queue-5.12/leds-lm3692x-put-fwnode-in-any-case-during-probe.patch b/queue-5.12/leds-lm3692x-put-fwnode-in-any-case-during-probe.patch new file mode 100644 index 00000000000..6751bc7e837 --- /dev/null +++ b/queue-5.12/leds-lm3692x-put-fwnode-in-any-case-during-probe.patch @@ -0,0 +1,52 @@ +From 0a1e24bfac845b089413ad831c830d8d2cb213ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 12:50:35 +0300 +Subject: leds: lm3692x: Put fwnode in any case during ->probe() + +From: Andy Shevchenko + +[ Upstream commit f55db1c7fadc2a29c9fa4ff3aec98dbb111f2206 ] + +device_get_next_child_node() bumps a reference counting of a returned variable. +We have to balance it whenever we return to the caller. + +Fixes: 9a5c1c64ac0a ("leds: lm3692x: Change DT calls to fwnode calls") +Cc: Dan Murphy +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lm3692x.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/leds/leds-lm3692x.c b/drivers/leds/leds-lm3692x.c +index e945de45388c..55e6443997ec 100644 +--- a/drivers/leds/leds-lm3692x.c ++++ b/drivers/leds/leds-lm3692x.c +@@ -435,6 +435,7 @@ static int lm3692x_probe_dt(struct lm3692x_led *led) + + ret = fwnode_property_read_u32(child, "reg", &led->led_enable); + if (ret) { ++ fwnode_handle_put(child); + dev_err(&led->client->dev, "reg DT property missing\n"); + return ret; + } +@@ -449,12 +450,11 @@ static int lm3692x_probe_dt(struct lm3692x_led *led) + + ret = devm_led_classdev_register_ext(&led->client->dev, &led->led_dev, + &init_data); +- if (ret) { ++ if (ret) + dev_err(&led->client->dev, "led register err: %d\n", ret); +- return ret; +- } + +- return 0; ++ fwnode_handle_put(init_data.fwnode); ++ return ret; + } + + static int lm3692x_probe(struct i2c_client *client, +-- +2.30.2 + diff --git a/queue-5.12/leds-lm3697-don-t-spam-logs-when-probe-is-deferred.patch b/queue-5.12/leds-lm3697-don-t-spam-logs-when-probe-is-deferred.patch new file mode 100644 index 00000000000..66ccc604f90 --- /dev/null +++ b/queue-5.12/leds-lm3697-don-t-spam-logs-when-probe-is-deferred.patch @@ -0,0 +1,44 @@ +From 32fccc524e74ecb770aac1ebf756c77661e67a8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 12:50:39 +0300 +Subject: leds: lm3697: Don't spam logs when probe is deferred + +From: Andy Shevchenko + +[ Upstream commit 807553f8bf4afa673750e52905e0f9488179112f ] + +When requesting GPIO line the probe can be deferred. +In such case don't spam logs with an error message. +This can be achieved by switching to dev_err_probe(). + +Fixes: 5c1d824cda9f ("leds: lm3697: Introduce the lm3697 driver") +Cc: Dan Murphy +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lm3697.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/leds/leds-lm3697.c b/drivers/leds/leds-lm3697.c +index 7d216cdb91a8..912e8bb22a99 100644 +--- a/drivers/leds/leds-lm3697.c ++++ b/drivers/leds/leds-lm3697.c +@@ -203,11 +203,9 @@ static int lm3697_probe_dt(struct lm3697 *priv) + + priv->enable_gpio = devm_gpiod_get_optional(dev, "enable", + GPIOD_OUT_LOW); +- if (IS_ERR(priv->enable_gpio)) { +- ret = PTR_ERR(priv->enable_gpio); +- dev_err(dev, "Failed to get enable gpio: %d\n", ret); +- return ret; +- } ++ if (IS_ERR(priv->enable_gpio)) ++ return dev_err_probe(dev, PTR_ERR(priv->enable_gpio), ++ "Failed to get enable GPIO\n"); + + priv->regulator = devm_regulator_get(dev, "vled"); + if (IS_ERR(priv->regulator)) +-- +2.30.2 + diff --git a/queue-5.12/leds-lp50xx-put-fwnode-in-error-case-during-probe.patch b/queue-5.12/leds-lp50xx-put-fwnode-in-error-case-during-probe.patch new file mode 100644 index 00000000000..4f9c5bae0de --- /dev/null +++ b/queue-5.12/leds-lp50xx-put-fwnode-in-error-case-during-probe.patch @@ -0,0 +1,47 @@ +From 06774cfeb0b919f303d0fbaef203a2609a37f987 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 12:50:40 +0300 +Subject: leds: lp50xx: Put fwnode in error case during ->probe() + +From: Andy Shevchenko + +[ Upstream commit f1e1d532da7e6ef355528a22fb97d9a8fbf76c4e ] + +fwnode_for_each_child_node() bumps a reference counting of a returned variable. +We have to balance it whenever we return to the caller. + +OTOH, the successful iteration will drop reference count under the hood, no need +to do it twice. + +Fixes: 242b81170fb8 ("leds: lp50xx: Add the LP50XX family of the RGB LED driver") +Cc: Dan Murphy +Signed-off-by: Andy Shevchenko +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lp50xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-lp50xx.c b/drivers/leds/leds-lp50xx.c +index 06230614fdc5..401df1e2e05d 100644 +--- a/drivers/leds/leds-lp50xx.c ++++ b/drivers/leds/leds-lp50xx.c +@@ -490,6 +490,7 @@ static int lp50xx_probe_dt(struct lp50xx *priv) + ret = fwnode_property_read_u32(led_node, "color", + &color_id); + if (ret) { ++ fwnode_handle_put(led_node); + dev_err(priv->dev, "Cannot read color\n"); + goto child_out; + } +@@ -512,7 +513,6 @@ static int lp50xx_probe_dt(struct lp50xx *priv) + goto child_out; + } + i++; +- fwnode_handle_put(child); + } + + return 0; +-- +2.30.2 + diff --git a/queue-5.12/lib-math-rational.c-fix-divide-by-zero.patch b/queue-5.12/lib-math-rational.c-fix-divide-by-zero.patch new file mode 100644 index 00000000000..1314ee64781 --- /dev/null +++ b/queue-5.12/lib-math-rational.c-fix-divide-by-zero.patch @@ -0,0 +1,78 @@ +From a6ea172838a92138f6c97285759298a1f0a2531d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:55:49 -0700 +Subject: lib/math/rational.c: fix divide by zero + +From: Trent Piepho + +[ Upstream commit 65a0d3c14685663ba111038a35db70f559e39336 ] + +If the input is out of the range of the allowed values, either larger than +the largest value or closer to zero than the smallest non-zero allowed +value, then a division by zero would occur. + +In the case of input too large, the division by zero will occur on the +first iteration. The best result (largest allowed value) will be found by +always choosing the semi-convergent and excluding the denominator based +limit when finding it. + +In the case of the input too small, the division by zero will occur on the +second iteration. The numerator based semi-convergent should not be +calculated to avoid the division by zero. But the semi-convergent vs +previous convergent test is still needed, which effectively chooses +between 0 (the previous convergent) vs the smallest allowed fraction (best +semi-convergent) as the result. + +Link: https://lkml.kernel.org/r/20210525144250.214670-1-tpiepho@gmail.com +Fixes: 323dd2c3ed0 ("lib/math/rational.c: fix possible incorrect result from rational fractions helper") +Signed-off-by: Trent Piepho +Reported-by: Yiyuan Guo +Reviewed-by: Andy Shevchenko +Cc: Oskar Schirmer +Cc: Daniel Latypov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/math/rational.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +diff --git a/lib/math/rational.c b/lib/math/rational.c +index 9781d521963d..c0ab51d8fbb9 100644 +--- a/lib/math/rational.c ++++ b/lib/math/rational.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + /* + * calculate best rational approximation for a given fraction +@@ -78,13 +79,18 @@ void rational_best_approximation( + * found below as 't'. + */ + if ((n2 > max_numerator) || (d2 > max_denominator)) { +- unsigned long t = min((max_numerator - n0) / n1, +- (max_denominator - d0) / d1); ++ unsigned long t = ULONG_MAX; + +- /* This tests if the semi-convergent is closer +- * than the previous convergent. ++ if (d1) ++ t = (max_denominator - d0) / d1; ++ if (n1) ++ t = min(t, (max_numerator - n0) / n1); ++ ++ /* This tests if the semi-convergent is closer than the previous ++ * convergent. If d1 is zero there is no previous convergent as this ++ * is the 1st iteration, so always choose the semi-convergent. + */ +- if (2u * t > a || (2u * t == a && d0 * dp > d1 * d)) { ++ if (!d1 || 2u * t > a || (2u * t == a && d0 * dp > d1 * d)) { + n1 = n0 + t * n1; + d1 = d0 + t * d1; + } +-- +2.30.2 + diff --git a/queue-5.12/lib-vsprintf-fix-handling-of-number-field-widths-in-.patch b/queue-5.12/lib-vsprintf-fix-handling-of-number-field-widths-in-.patch new file mode 100644 index 00000000000..f0ac9f5c827 --- /dev/null +++ b/queue-5.12/lib-vsprintf-fix-handling-of-number-field-widths-in-.patch @@ -0,0 +1,233 @@ +From 946070b1949f17415497b97b643f8271ec97b041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 17:12:04 +0100 +Subject: lib: vsprintf: Fix handling of number field widths in vsscanf + +From: Richard Fitzgerald + +[ Upstream commit 900fdc4573766dd43b847b4f54bd4a1ee2bc7360 ] + +The existing code attempted to handle numbers by doing a strto[u]l(), +ignoring the field width, and then repeatedly dividing to extract the +field out of the full converted value. If the string contains a run of +valid digits longer than will fit in a long or long long, this would +overflow and no amount of dividing can recover the correct value. + +This patch fixes vsscanf() to obey number field widths when parsing +the number. + +A new _parse_integer_limit() is added that takes a limit for the number +of characters to parse. The number field conversion in vsscanf is changed +to use this new function. + +If a number starts with a radix prefix, the field width must be long +enough for at last one digit after the prefix. If not, it will be handled +like this: + + sscanf("0x4", "%1i", &i): i=0, scanning continues with the 'x' + sscanf("0x4", "%2i", &i): i=0, scanning continues with the '4' + +This is consistent with the observed behaviour of userland sscanf. + +Note that this patch does NOT fix the problem of a single field value +overflowing the target type. So for example: + + sscanf("123456789abcdef", "%x", &i); + +Will not produce the correct result because the value obviously overflows +INT_MAX. But sscanf will report a successful conversion. + +Note that where a very large number is used to mean "unlimited", the value +INT_MAX is used for consistency with the behaviour of vsnprintf(). + +Signed-off-by: Richard Fitzgerald +Reviewed-by: Petr Mladek +Signed-off-by: Petr Mladek +Link: https://lore.kernel.org/r/20210514161206.30821-2-rf@opensource.cirrus.com +Signed-off-by: Sasha Levin +--- + lib/kstrtox.c | 13 ++++++-- + lib/kstrtox.h | 2 ++ + lib/vsprintf.c | 82 +++++++++++++++++++++++++++++--------------------- + 3 files changed, 60 insertions(+), 37 deletions(-) + +diff --git a/lib/kstrtox.c b/lib/kstrtox.c +index a118b0b1e9b2..0b5fe8b41173 100644 +--- a/lib/kstrtox.c ++++ b/lib/kstrtox.c +@@ -39,20 +39,22 @@ const char *_parse_integer_fixup_radix(const char *s, unsigned int *base) + + /* + * Convert non-negative integer string representation in explicitly given radix +- * to an integer. ++ * to an integer. A maximum of max_chars characters will be converted. ++ * + * Return number of characters consumed maybe or-ed with overflow bit. + * If overflow occurs, result integer (incorrect) is still returned. + * + * Don't you dare use this function. + */ +-unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long *p) ++unsigned int _parse_integer_limit(const char *s, unsigned int base, unsigned long long *p, ++ size_t max_chars) + { + unsigned long long res; + unsigned int rv; + + res = 0; + rv = 0; +- while (1) { ++ while (max_chars--) { + unsigned int c = *s; + unsigned int lc = c | 0x20; /* don't tolower() this line */ + unsigned int val; +@@ -82,6 +84,11 @@ unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long + return rv; + } + ++unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long *p) ++{ ++ return _parse_integer_limit(s, base, p, INT_MAX); ++} ++ + static int _kstrtoull(const char *s, unsigned int base, unsigned long long *res) + { + unsigned long long _res; +diff --git a/lib/kstrtox.h b/lib/kstrtox.h +index 3b4637bcd254..158c400ca865 100644 +--- a/lib/kstrtox.h ++++ b/lib/kstrtox.h +@@ -4,6 +4,8 @@ + + #define KSTRTOX_OVERFLOW (1U << 31) + const char *_parse_integer_fixup_radix(const char *s, unsigned int *base); ++unsigned int _parse_integer_limit(const char *s, unsigned int base, unsigned long long *res, ++ size_t max_chars); + unsigned int _parse_integer(const char *s, unsigned int base, unsigned long long *res); + + #endif +diff --git a/lib/vsprintf.c b/lib/vsprintf.c +index 39ef2e314da5..9d6722199390 100644 +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -53,6 +53,31 @@ + #include + #include "kstrtox.h" + ++static unsigned long long simple_strntoull(const char *startp, size_t max_chars, ++ char **endp, unsigned int base) ++{ ++ const char *cp; ++ unsigned long long result = 0ULL; ++ size_t prefix_chars; ++ unsigned int rv; ++ ++ cp = _parse_integer_fixup_radix(startp, &base); ++ prefix_chars = cp - startp; ++ if (prefix_chars < max_chars) { ++ rv = _parse_integer_limit(cp, base, &result, max_chars - prefix_chars); ++ /* FIXME */ ++ cp += (rv & ~KSTRTOX_OVERFLOW); ++ } else { ++ /* Field too short for prefix + digit, skip over without converting */ ++ cp = startp + max_chars; ++ } ++ ++ if (endp) ++ *endp = (char *)cp; ++ ++ return result; ++} ++ + /** + * simple_strtoull - convert a string to an unsigned long long + * @cp: The start of the string +@@ -63,18 +88,7 @@ + */ + unsigned long long simple_strtoull(const char *cp, char **endp, unsigned int base) + { +- unsigned long long result; +- unsigned int rv; +- +- cp = _parse_integer_fixup_radix(cp, &base); +- rv = _parse_integer(cp, base, &result); +- /* FIXME */ +- cp += (rv & ~KSTRTOX_OVERFLOW); +- +- if (endp) +- *endp = (char *)cp; +- +- return result; ++ return simple_strntoull(cp, INT_MAX, endp, base); + } + EXPORT_SYMBOL(simple_strtoull); + +@@ -109,6 +123,21 @@ long simple_strtol(const char *cp, char **endp, unsigned int base) + } + EXPORT_SYMBOL(simple_strtol); + ++static long long simple_strntoll(const char *cp, size_t max_chars, char **endp, ++ unsigned int base) ++{ ++ /* ++ * simple_strntoull() safely handles receiving max_chars==0 in the ++ * case cp[0] == '-' && max_chars == 1. ++ * If max_chars == 0 we can drop through and pass it to simple_strntoull() ++ * and the content of *cp is irrelevant. ++ */ ++ if (*cp == '-' && max_chars > 0) ++ return -simple_strntoull(cp + 1, max_chars - 1, endp, base); ++ ++ return simple_strntoull(cp, max_chars, endp, base); ++} ++ + /** + * simple_strtoll - convert a string to a signed long long + * @cp: The start of the string +@@ -119,10 +148,7 @@ EXPORT_SYMBOL(simple_strtol); + */ + long long simple_strtoll(const char *cp, char **endp, unsigned int base) + { +- if (*cp == '-') +- return -simple_strtoull(cp + 1, endp, base); +- +- return simple_strtoull(cp, endp, base); ++ return simple_strntoll(cp, INT_MAX, endp, base); + } + EXPORT_SYMBOL(simple_strtoll); + +@@ -3475,25 +3501,13 @@ int vsscanf(const char *buf, const char *fmt, va_list args) + break; + + if (is_sign) +- val.s = qualifier != 'L' ? +- simple_strtol(str, &next, base) : +- simple_strtoll(str, &next, base); ++ val.s = simple_strntoll(str, ++ field_width >= 0 ? field_width : INT_MAX, ++ &next, base); + else +- val.u = qualifier != 'L' ? +- simple_strtoul(str, &next, base) : +- simple_strtoull(str, &next, base); +- +- if (field_width > 0 && next - str > field_width) { +- if (base == 0) +- _parse_integer_fixup_radix(str, &base); +- while (next - str > field_width) { +- if (is_sign) +- val.s = div_s64(val.s, base); +- else +- val.u = div_u64(val.u, base); +- --next; +- } +- } ++ val.u = simple_strntoull(str, ++ field_width >= 0 ? field_width : INT_MAX, ++ &next, base); + + switch (qualifier) { + case 'H': /* that's 'hh' in format */ +-- +2.30.2 + diff --git a/queue-5.12/lockdep-fix-wait-type-for-empty-stack.patch b/queue-5.12/lockdep-fix-wait-type-for-empty-stack.patch new file mode 100644 index 00000000000..157e1fb54fa --- /dev/null +++ b/queue-5.12/lockdep-fix-wait-type-for-empty-stack.patch @@ -0,0 +1,37 @@ +From 3efe5b527ee4df3e34a372298ca41279d4d5fefe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 20:57:18 +0200 +Subject: lockdep: Fix wait-type for empty stack + +From: Peter Zijlstra + +[ Upstream commit f8b298cc39f0619544c607eaef09fd0b2afd10f3 ] + +Even the very first lock can violate the wait-context check, consider +the various IRQ contexts. + +Fixes: de8f5e4f2dc1 ("lockdep: Introduce wait-type checks") +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Joerg Roedel +Link: https://lore.kernel.org/r/20210617190313.256987481@infradead.org +Signed-off-by: Sasha Levin +--- + kernel/locking/lockdep.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index b56c3855756e..8f8cd43ec2a0 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -4692,7 +4692,7 @@ static int check_wait_context(struct task_struct *curr, struct held_lock *next) + u8 curr_inner; + int depth; + +- if (!curr->lockdep_depth || !next_inner || next->trylock) ++ if (!next_inner || next->trylock) + return 0; + + if (!next_outer) +-- +2.30.2 + diff --git a/queue-5.12/lockdep-selftests-fix-selftests-vs-prove_raw_lock_ne.patch b/queue-5.12/lockdep-selftests-fix-selftests-vs-prove_raw_lock_ne.patch new file mode 100644 index 00000000000..9914ea862b0 --- /dev/null +++ b/queue-5.12/lockdep-selftests-fix-selftests-vs-prove_raw_lock_ne.patch @@ -0,0 +1,41 @@ +From e10beb0f090b3ddade73501020d95bc77731a2a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 20:57:19 +0200 +Subject: lockdep/selftests: Fix selftests vs PROVE_RAW_LOCK_NESTING + +From: Peter Zijlstra + +[ Upstream commit c0c2c0dad6a06e0c05e9a52d65f932bd54364c97 ] + +When PROVE_RAW_LOCK_NESTING=y many of the selftests FAILED because +HARDIRQ context is out-of-bounds for spinlocks. Instead make the +default hardware context the threaded hardirq context, which preserves +the old locking rules. + +The wait-type specific locking selftests will have a non-threaded +HARDIRQ variant. + +Fixes: de8f5e4f2dc1 ("lockdep: Introduce wait-type checks") +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Joerg Roedel +Link: https://lore.kernel.org/r/20210617190313.322096283@infradead.org +Signed-off-by: Sasha Levin +--- + lib/locking-selftest.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/locking-selftest.c b/lib/locking-selftest.c +index 2d85abac1744..0f6b262e0964 100644 +--- a/lib/locking-selftest.c ++++ b/lib/locking-selftest.c +@@ -194,6 +194,7 @@ static void init_shared_classes(void) + #define HARDIRQ_ENTER() \ + local_irq_disable(); \ + __irq_enter(); \ ++ lockdep_hardirq_threaded(); \ + WARN_ON(!in_irq()); + + #define HARDIRQ_EXIT() \ +-- +2.30.2 + diff --git a/queue-5.12/lockding-lockdep-avoid-to-find-wrong-lock-dep-path-i.patch b/queue-5.12/lockding-lockdep-avoid-to-find-wrong-lock-dep-path-i.patch new file mode 100644 index 00000000000..f4589ef460b --- /dev/null +++ b/queue-5.12/lockding-lockdep-avoid-to-find-wrong-lock-dep-path-i.patch @@ -0,0 +1,59 @@ +From ca317d684a05cee79ecfec224047ac437ac5eb8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 01:01:09 +0800 +Subject: lockding/lockdep: Avoid to find wrong lock dep path in + check_irq_usage() + +From: Boqun Feng + +[ Upstream commit 7b1f8c6179769af6ffa055e1169610b51d71edd5 ] + +In the step #3 of check_irq_usage(), we seach backwards to find a lock +whose usage conflicts the usage of @target_entry1 on safe/unsafe. +However, we should only keep the irq-unsafe usage of @target_entry1 into +consideration, because it could be a case where a lock is hardirq-unsafe +but soft-safe, and in check_irq_usage() we find it because its +hardirq-unsafe could result into a hardirq-safe-unsafe deadlock, but +currently since we don't filter out the other usage bits, so we may find +a lock dependency path softirq-unsafe -> softirq-safe, which in fact +doesn't cause a deadlock. And this may cause misleading lockdep splats. + +Fix this by only keeping LOCKF_ENABLED_IRQ_ALL bits when we try the +backwards search. + +Reported-by: Johannes Berg +Signed-off-by: Boqun Feng +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20210618170110.3699115-4-boqun.feng@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/locking/lockdep.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 03a9d9b96045..b56c3855756e 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -2772,8 +2772,18 @@ static int check_irq_usage(struct task_struct *curr, struct held_lock *prev, + * Step 3: we found a bad match! Now retrieve a lock from the backward + * list whose usage mask matches the exclusive usage mask from the + * lock found on the forward list. ++ * ++ * Note, we should only keep the LOCKF_ENABLED_IRQ_ALL bits, considering ++ * the follow case: ++ * ++ * When trying to add A -> B to the graph, we find that there is a ++ * hardirq-safe L, that L -> ... -> A, and another hardirq-unsafe M, ++ * that B -> ... -> M. However M is **softirq-safe**, if we use exact ++ * invert bits of M's usage_mask, we will find another lock N that is ++ * **softirq-unsafe** and N -> ... -> A, however N -> .. -> M will not ++ * cause a inversion deadlock. + */ +- backward_mask = original_mask(target_entry1->class->usage_mask); ++ backward_mask = original_mask(target_entry1->class->usage_mask & LOCKF_ENABLED_IRQ_ALL); + + ret = find_usage_backwards(&this, backward_mask, &target_entry); + if (bfs_error(ret)) { +-- +2.30.2 + diff --git a/queue-5.12/locking-lockdep-fix-the-dep-path-printing-for-backwa.patch b/queue-5.12/locking-lockdep-fix-the-dep-path-printing-for-backwa.patch new file mode 100644 index 00000000000..ac21e594a36 --- /dev/null +++ b/queue-5.12/locking-lockdep-fix-the-dep-path-printing-for-backwa.patch @@ -0,0 +1,163 @@ +From 816e75d791245b94ba1f1cac6d607935b86b960b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 01:01:07 +0800 +Subject: locking/lockdep: Fix the dep path printing for backwards BFS + +From: Boqun Feng + +[ Upstream commit 69c7a5fb2482636f525f016c8333fdb9111ecb9d ] + +We use the same code to print backwards lock dependency path as the +forwards lock dependency path, and this could result into incorrect +printing because for a backwards lock_list ->trace is not the call trace +where the lock of ->class is acquired. + +Fix this by introducing a separate function on printing the backwards +dependency path. Also add a few comments about the printing while we are +at it. + +Reported-by: Johannes Berg +Signed-off-by: Boqun Feng +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20210618170110.3699115-2-boqun.feng@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/locking/lockdep.c | 108 ++++++++++++++++++++++++++++++++++++++- + 1 file changed, 106 insertions(+), 2 deletions(-) + +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 5bf6b1659215..03a9d9b96045 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -2305,7 +2305,56 @@ static void print_lock_class_header(struct lock_class *class, int depth) + } + + /* +- * printk the shortest lock dependencies from @start to @end in reverse order: ++ * Dependency path printing: ++ * ++ * After BFS we get a lock dependency path (linked via ->parent of lock_list), ++ * printing out each lock in the dependency path will help on understanding how ++ * the deadlock could happen. Here are some details about dependency path ++ * printing: ++ * ++ * 1) A lock_list can be either forwards or backwards for a lock dependency, ++ * for a lock dependency A -> B, there are two lock_lists: ++ * ++ * a) lock_list in the ->locks_after list of A, whose ->class is B and ++ * ->links_to is A. In this case, we can say the lock_list is ++ * "A -> B" (forwards case). ++ * ++ * b) lock_list in the ->locks_before list of B, whose ->class is A ++ * and ->links_to is B. In this case, we can say the lock_list is ++ * "B <- A" (bacwards case). ++ * ++ * The ->trace of both a) and b) point to the call trace where B was ++ * acquired with A held. ++ * ++ * 2) A "helper" lock_list is introduced during BFS, this lock_list doesn't ++ * represent a certain lock dependency, it only provides an initial entry ++ * for BFS. For example, BFS may introduce a "helper" lock_list whose ++ * ->class is A, as a result BFS will search all dependencies starting with ++ * A, e.g. A -> B or A -> C. ++ * ++ * The notation of a forwards helper lock_list is like "-> A", which means ++ * we should search the forwards dependencies starting with "A", e.g A -> B ++ * or A -> C. ++ * ++ * The notation of a bacwards helper lock_list is like "<- B", which means ++ * we should search the backwards dependencies ending with "B", e.g. ++ * B <- A or B <- C. ++ */ ++ ++/* ++ * printk the shortest lock dependencies from @root to @leaf in reverse order. ++ * ++ * We have a lock dependency path as follow: ++ * ++ * @root @leaf ++ * | | ++ * V V ++ * ->parent ->parent ++ * | lock_list | <--------- | lock_list | ... | lock_list | <--------- | lock_list | ++ * | -> L1 | | L1 -> L2 | ... |Ln-2 -> Ln-1| | Ln-1 -> Ln| ++ * ++ * , so it's natural that we start from @leaf and print every ->class and ++ * ->trace until we reach the @root. + */ + static void __used + print_shortest_lock_dependencies(struct lock_list *leaf, +@@ -2333,6 +2382,61 @@ print_shortest_lock_dependencies(struct lock_list *leaf, + } while (entry && (depth >= 0)); + } + ++/* ++ * printk the shortest lock dependencies from @leaf to @root. ++ * ++ * We have a lock dependency path (from a backwards search) as follow: ++ * ++ * @leaf @root ++ * | | ++ * V V ++ * ->parent ->parent ++ * | lock_list | ---------> | lock_list | ... | lock_list | ---------> | lock_list | ++ * | L2 <- L1 | | L3 <- L2 | ... | Ln <- Ln-1 | | <- Ln | ++ * ++ * , so when we iterate from @leaf to @root, we actually print the lock ++ * dependency path L1 -> L2 -> .. -> Ln in the non-reverse order. ++ * ++ * Another thing to notice here is that ->class of L2 <- L1 is L1, while the ++ * ->trace of L2 <- L1 is the call trace of L2, in fact we don't have the call ++ * trace of L1 in the dependency path, which is alright, because most of the ++ * time we can figure out where L1 is held from the call trace of L2. ++ */ ++static void __used ++print_shortest_lock_dependencies_backwards(struct lock_list *leaf, ++ struct lock_list *root) ++{ ++ struct lock_list *entry = leaf; ++ const struct lock_trace *trace = NULL; ++ int depth; ++ ++ /*compute depth from generated tree by BFS*/ ++ depth = get_lock_depth(leaf); ++ ++ do { ++ print_lock_class_header(entry->class, depth); ++ if (trace) { ++ printk("%*s ... acquired at:\n", depth, ""); ++ print_lock_trace(trace, 2); ++ printk("\n"); ++ } ++ ++ /* ++ * Record the pointer to the trace for the next lock_list ++ * entry, see the comments for the function. ++ */ ++ trace = entry->trace; ++ ++ if (depth == 0 && (entry != root)) { ++ printk("lockdep:%s bad path found in chain graph\n", __func__); ++ break; ++ } ++ ++ entry = get_lock_parent(entry); ++ depth--; ++ } while (entry && (depth >= 0)); ++} ++ + static void + print_irq_lock_scenario(struct lock_list *safe_entry, + struct lock_list *unsafe_entry, +@@ -2450,7 +2554,7 @@ print_bad_irq_dependency(struct task_struct *curr, + prev_root->trace = save_trace(); + if (!prev_root->trace) + return; +- print_shortest_lock_dependencies(backwards_entry, prev_root); ++ print_shortest_lock_dependencies_backwards(backwards_entry, prev_root); + + pr_warn("\nthe dependencies between the lock to be acquired"); + pr_warn(" and %s-irq-unsafe lock:\n", irqclass); +-- +2.30.2 + diff --git a/queue-5.12/locking-lockdep-reduce-lockdep-dependency-list.patch b/queue-5.12/locking-lockdep-reduce-lockdep-dependency-list.patch new file mode 100644 index 00000000000..85ef88f982c --- /dev/null +++ b/queue-5.12/locking-lockdep-reduce-lockdep-dependency-list.patch @@ -0,0 +1,62 @@ +From 7212ffe618c4c0605e1dafea75c3575a8eee4e98 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 15:41:50 -0700 +Subject: locking/lockdep: Reduce LOCKDEP dependency list + +From: Randy Dunlap + +[ Upstream commit b8e00abe7d9fe21dd13609e2e3a707e38902b105 ] + +Some arches (um, sparc64, riscv, xtensa) cause a Kconfig warning for +LOCKDEP. +These arch-es select LOCKDEP_SUPPORT but they are not listed as one +of the arch-es that LOCKDEP depends on. + +Since (16) arch-es define the Kconfig symbol LOCKDEP_SUPPORT if they +intend to have LOCKDEP support, replace the awkward list of +arch-es that LOCKDEP depends on with the LOCKDEP_SUPPORT symbol. + +But wait. LOCKDEP_SUPPORT is included in LOCK_DEBUGGING_SUPPORT, +which is already a dependency here, so LOCKDEP_SUPPORT is redundant +and not needed. +That leaves the FRAME_POINTER dependency, but it is part of an +expression like this: + depends on (A && B) && (FRAME_POINTER || B') +where B' is a dependency of B so if B is true then B' is true +and the value of FRAME_POINTER does not matter. +Thus we can also delete the FRAME_POINTER dependency. + +Fixes this kconfig warning: (for um, sparc64, riscv, xtensa) + +WARNING: unmet direct dependencies detected for LOCKDEP + Depends on [n]: DEBUG_KERNEL [=y] && LOCK_DEBUGGING_SUPPORT [=y] && (FRAME_POINTER [=n] || MIPS || PPC || S390 || MICROBLAZE || ARM || ARC || X86) + Selected by [y]: + - PROVE_LOCKING [=y] && DEBUG_KERNEL [=y] && LOCK_DEBUGGING_SUPPORT [=y] + - LOCK_STAT [=y] && DEBUG_KERNEL [=y] && LOCK_DEBUGGING_SUPPORT [=y] + - DEBUG_LOCK_ALLOC [=y] && DEBUG_KERNEL [=y] && LOCK_DEBUGGING_SUPPORT [=y] + +Fixes: 7d37cb2c912d ("lib: fix kconfig dependency on ARCH_WANT_FRAME_POINTERS") +Signed-off-by: Randy Dunlap +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Waiman Long +Link: https://lkml.kernel.org/r/20210524224150.8009-1-rdunlap@infradead.org +Signed-off-by: Sasha Levin +--- + lib/Kconfig.debug | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug +index 417c3d3e521b..5c9f528dd46d 100644 +--- a/lib/Kconfig.debug ++++ b/lib/Kconfig.debug +@@ -1363,7 +1363,6 @@ config LOCKDEP + bool + depends on DEBUG_KERNEL && LOCK_DEBUGGING_SUPPORT + select STACKTRACE +- depends on FRAME_POINTER || MIPS || PPC || S390 || MICROBLAZE || ARM || ARC || X86 + select KALLSYMS + select KALLSYMS_ALL + +-- +2.30.2 + diff --git a/queue-5.12/m68k-atari-fix-atari_kbd_core-kconfig-unmet-dependen.patch b/queue-5.12/m68k-atari-fix-atari_kbd_core-kconfig-unmet-dependen.patch new file mode 100644 index 00000000000..74ba5237269 --- /dev/null +++ b/queue-5.12/m68k-atari-fix-atari_kbd_core-kconfig-unmet-dependen.patch @@ -0,0 +1,64 @@ +From 0a075f73d41c3eaf17ffa01304d96687b3dfc079 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 17:12:51 -0700 +Subject: m68k: atari: Fix ATARI_KBD_CORE kconfig unmet dependency warning + +From: Randy Dunlap + +[ Upstream commit c1367ee016e3550745315fb9a2dd1e4ce02cdcf6 ] + +Since the code for ATARI_KBD_CORE does not use drivers/input/keyboard/ +code, just move ATARI_KBD_CORE to arch/m68k/Kconfig.machine to remove +the dependency on INPUT_KEYBOARD. + +Removes this kconfig warning: + + WARNING: unmet direct dependencies detected for ATARI_KBD_CORE + Depends on [n]: !UML && INPUT [=y] && INPUT_KEYBOARD [=n] + Selected by [y]: + - MOUSE_ATARI [=y] && !UML && INPUT [=y] && INPUT_MOUSE [=y] && ATARI [=y] + +Fixes: c04cb856e20a ("m68k: Atari keyboard and mouse support.") +Signed-off-by: Randy Dunlap +Suggested-by: Geert Uytterhoeven +Suggested-by: Michael Schmitz +Acked-by: Dmitry Torokhov +Link: https://lore.kernel.org/r/20210527001251.8529-1-rdunlap@infradead.org +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/m68k/Kconfig.machine | 3 +++ + drivers/input/keyboard/Kconfig | 3 --- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/m68k/Kconfig.machine b/arch/m68k/Kconfig.machine +index 4d59ec2f5b8d..d964c1f27399 100644 +--- a/arch/m68k/Kconfig.machine ++++ b/arch/m68k/Kconfig.machine +@@ -25,6 +25,9 @@ config ATARI + this kernel on an Atari, say Y here and browse the material + available in ; otherwise say N. + ++config ATARI_KBD_CORE ++ bool ++ + config MAC + bool "Macintosh support" + depends on MMU +diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig +index 32d15809ae58..40a070a2e7f5 100644 +--- a/drivers/input/keyboard/Kconfig ++++ b/drivers/input/keyboard/Kconfig +@@ -67,9 +67,6 @@ config KEYBOARD_AMIGA + To compile this driver as a module, choose M here: the + module will be called amikbd. + +-config ATARI_KBD_CORE +- bool +- + config KEYBOARD_APPLESPI + tristate "Apple SPI keyboard and trackpad" + depends on ACPI && EFI +-- +2.30.2 + diff --git a/queue-5.12/mac80211-remove-iwlwifi-specific-workaround-ndps-of-.patch b/queue-5.12/mac80211-remove-iwlwifi-specific-workaround-ndps-of-.patch new file mode 100644 index 00000000000..34c423cdf1d --- /dev/null +++ b/queue-5.12/mac80211-remove-iwlwifi-specific-workaround-ndps-of-.patch @@ -0,0 +1,41 @@ +From 608b5ae3a88246a766e1d99934624112e595bed8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 21:48:25 +0800 +Subject: mac80211: remove iwlwifi specific workaround NDPs of null_response + +From: Ping-Ke Shih + +[ Upstream commit 744757e46bf13ec3a7b3507d17ab3faab9516d43 ] + +Remove the remaining workaround that is not removed by the +commit e41eb3e408de ("mac80211: remove iwlwifi specific workaround +that broke sta NDP tx") + +Fixes: 41cbb0f5a295 ("mac80211: add support for HE") +Signed-off-by: Ping-Ke Shih +Link: https://lore.kernel.org/r/20210623134826.10318-1-pkshih@realtek.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index f2fb69da9b6e..13250cadb420 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -1398,11 +1398,6 @@ static void ieee80211_send_null_response(struct sta_info *sta, int tid, + struct ieee80211_tx_info *info; + struct ieee80211_chanctx_conf *chanctx_conf; + +- /* Don't send NDPs when STA is connected HE */ +- if (sdata->vif.type == NL80211_IFTYPE_STATION && +- !(sdata->u.mgd.flags & IEEE80211_STA_DISABLE_HE)) +- return; +- + if (qos) { + fc = cpu_to_le16(IEEE80211_FTYPE_DATA | + IEEE80211_STYPE_QOS_NULLFUNC | +-- +2.30.2 + diff --git a/queue-5.12/mailbox-qcom-use-platform_devid_auto-to-register-pla.patch b/queue-5.12/mailbox-qcom-use-platform_devid_auto-to-register-pla.patch new file mode 100644 index 00000000000..3dbc8c8e141 --- /dev/null +++ b/queue-5.12/mailbox-qcom-use-platform_devid_auto-to-register-pla.patch @@ -0,0 +1,48 @@ +From c8807be7846bc6bc405b3da2430c9c119f2ff16a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 08:39:18 +0800 +Subject: mailbox: qcom: Use PLATFORM_DEVID_AUTO to register platform device + +From: Shawn Guo + +[ Upstream commit 96e39e95c01283ff5695dafe659df88ada802159 ] + +In adding APCS clock support for MSM8939, the second clock registration +fails due to duplicate device name like below. + +[ 0.519657] sysfs: cannot create duplicate filename '/bus/platform/devices/qcom-apcs-msm8916-clk' +... +[ 0.661158] qcom_apcs_ipc b111000.mailbox: failed to register APCS clk + +This is because MSM8939 has 3 APCS instances for Cluster0 (little cores), +Cluster1 (big cores) and CCI (Cache Coherent Interconnect). Although +only APCS of Cluster0 and Cluster1 have IPC bits, each of 3 APCS has +A53PLL clock control bits. That said, 3 'qcom-apcs-msm8916-clk' devices +need to be registered to instantiate all 3 clocks. Use PLATFORM_DEVID_AUTO +rather than PLATFORM_DEVID_NONE for platform_device_register_data() call +to fix the issue above. + +Signed-off-by: Shawn Guo +Reviewed-by: Bjorn Andersson +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/qcom-apcs-ipc-mailbox.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mailbox/qcom-apcs-ipc-mailbox.c b/drivers/mailbox/qcom-apcs-ipc-mailbox.c +index f25324d03842..15236d729625 100644 +--- a/drivers/mailbox/qcom-apcs-ipc-mailbox.c ++++ b/drivers/mailbox/qcom-apcs-ipc-mailbox.c +@@ -132,7 +132,7 @@ static int qcom_apcs_ipc_probe(struct platform_device *pdev) + if (apcs_data->clk_name) { + apcs->clk = platform_device_register_data(&pdev->dev, + apcs_data->clk_name, +- PLATFORM_DEVID_NONE, ++ PLATFORM_DEVID_AUTO, + NULL, 0); + if (IS_ERR(apcs->clk)) + dev_err(&pdev->dev, "failed to register APCS clk\n"); +-- +2.30.2 + diff --git a/queue-5.12/makefile-fix-gdb-warning-with-config_relr.patch b/queue-5.12/makefile-fix-gdb-warning-with-config_relr.patch new file mode 100644 index 00000000000..73daf16f7ad --- /dev/null +++ b/queue-5.12/makefile-fix-gdb-warning-with-config_relr.patch @@ -0,0 +1,65 @@ +From 1d688ed0cd58c8e2365029245b07d0f05acfd376 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 18:26:24 -0700 +Subject: Makefile: fix GDB warning with CONFIG_RELR + +From: Nick Desaulniers + +[ Upstream commit 27f2a4db76e8d8a8b601fc1c6a7a17f88bd907ab ] + +GDB produces the following warning when debugging kernels built with +CONFIG_RELR: + +BFD: /android0/linux-next/vmlinux: unknown type [0x13] section `.relr.dyn' + +when loading a kernel built with CONFIG_RELR into GDB. It can also +prevent debugging symbols using such relocations. + +Peter sugguests: + [That flag] means that lld will use dynamic tags and section type + numbers in the OS-specific range rather than the generic range. The + kernel itself doesn't care about these numbers; it determines the + location of the RELR section using symbols defined by a linker script. + +Link: https://github.com/ClangBuiltLinux/linux/issues/1057 +Suggested-by: Peter Collingbourne +Reviewed-by: Nathan Chancellor +Signed-off-by: Nick Desaulniers +Link: https://lore.kernel.org/r/20210522012626.2811297-1-ndesaulniers@google.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + Makefile | 2 +- + scripts/tools-support-relr.sh | 3 ++- + 2 files changed, 3 insertions(+), 2 deletions(-) + +diff --git a/Makefile b/Makefile +index bf6accb2328c..6682790891df 100644 +--- a/Makefile ++++ b/Makefile +@@ -1006,7 +1006,7 @@ LDFLAGS_vmlinux += $(call ld-option, -X,) + endif + + ifeq ($(CONFIG_RELR),y) +-LDFLAGS_vmlinux += --pack-dyn-relocs=relr ++LDFLAGS_vmlinux += --pack-dyn-relocs=relr --use-android-relr-tags + endif + + # We never want expected sections to be placed heuristically by the +diff --git a/scripts/tools-support-relr.sh b/scripts/tools-support-relr.sh +index 45e8aa360b45..cb55878bd5b8 100755 +--- a/scripts/tools-support-relr.sh ++++ b/scripts/tools-support-relr.sh +@@ -7,7 +7,8 @@ trap "rm -f $tmp_file.o $tmp_file $tmp_file.bin" EXIT + cat << "END" | $CC -c -x c - -o $tmp_file.o >/dev/null 2>&1 + void *p = &p; + END +-$LD $tmp_file.o -shared -Bsymbolic --pack-dyn-relocs=relr -o $tmp_file ++$LD $tmp_file.o -shared -Bsymbolic --pack-dyn-relocs=relr \ ++ --use-android-relr-tags -o $tmp_file + + # Despite printing an error message, GNU nm still exits with exit code 0 if it + # sees a relr section. So we need to check that nothing is printed to stderr. +-- +2.30.2 + diff --git a/queue-5.12/mark-pstore-blk-as-broken.patch b/queue-5.12/mark-pstore-blk-as-broken.patch new file mode 100644 index 00000000000..d161afd3ad2 --- /dev/null +++ b/queue-5.12/mark-pstore-blk-as-broken.patch @@ -0,0 +1,41 @@ +From c3dfd29e880af5f15af86b579660db9f4aa3d9a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 18:13:27 +0200 +Subject: mark pstore-blk as broken + +From: Christoph Hellwig + +[ Upstream commit d07f3b081ee632268786601f55e1334d1f68b997 ] + +pstore-blk just pokes directly into the pagecache for the block +device without going through the file operations for that by faking +up it's own file operations that do not match the block device ones. + +As this breaks the control of the block layer of it's page cache, +and even now just works by accident only the best thing is to just +disable this driver. + +Fixes: 17639f67c1d6 ("pstore/blk: Introduce backend for block devices") +Signed-off-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20210608161327.1537919-1-hch@lst.de +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/pstore/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/pstore/Kconfig b/fs/pstore/Kconfig +index 8adabde685f1..328da35da390 100644 +--- a/fs/pstore/Kconfig ++++ b/fs/pstore/Kconfig +@@ -173,6 +173,7 @@ config PSTORE_BLK + tristate "Log panic/oops to a block device" + depends on PSTORE + depends on BLOCK ++ depends on BROKEN + select PSTORE_ZONE + default n + help +-- +2.30.2 + diff --git a/queue-5.12/md-revert-io-stats-accounting.patch b/queue-5.12/md-revert-io-stats-accounting.patch new file mode 100644 index 00000000000..e7d4b545f53 --- /dev/null +++ b/queue-5.12/md-revert-io-stats-accounting.patch @@ -0,0 +1,118 @@ +From 708892b4aa3319a75d764c846d1acaa1a4e30d6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 17:46:16 +0800 +Subject: md: revert io stats accounting + +From: Guoqing Jiang + +[ Upstream commit ad3fc798800fb7ca04c1dfc439dba946818048d8 ] + +The commit 41d2d848e5c0 ("md: improve io stats accounting") could cause +double fault problem per the report [1], and also it is not correct to +change ->bi_end_io if md don't own it, so let's revert it. + +And io stats accounting will be replemented in later commits. + +[1]. https://lore.kernel.org/linux-raid/3bf04253-3fad-434a-63a7-20214e38cf26@gmail.com/T/#t + +Fixes: 41d2d848e5c0 ("md: improve io stats accounting") +Signed-off-by: Guoqing Jiang +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md.c | 45 --------------------------------------------- + drivers/md/md.h | 1 - + 2 files changed, 46 deletions(-) + +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 2a9553efc2d1..c21ce8070d3c 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -441,30 +441,6 @@ check_suspended: + } + EXPORT_SYMBOL(md_handle_request); + +-struct md_io { +- struct mddev *mddev; +- bio_end_io_t *orig_bi_end_io; +- void *orig_bi_private; +- struct block_device *orig_bi_bdev; +- unsigned long start_time; +-}; +- +-static void md_end_io(struct bio *bio) +-{ +- struct md_io *md_io = bio->bi_private; +- struct mddev *mddev = md_io->mddev; +- +- bio_end_io_acct_remapped(bio, md_io->start_time, md_io->orig_bi_bdev); +- +- bio->bi_end_io = md_io->orig_bi_end_io; +- bio->bi_private = md_io->orig_bi_private; +- +- mempool_free(md_io, &mddev->md_io_pool); +- +- if (bio->bi_end_io) +- bio->bi_end_io(bio); +-} +- + static blk_qc_t md_submit_bio(struct bio *bio) + { + const int rw = bio_data_dir(bio); +@@ -489,21 +465,6 @@ static blk_qc_t md_submit_bio(struct bio *bio) + return BLK_QC_T_NONE; + } + +- if (bio->bi_end_io != md_end_io) { +- struct md_io *md_io; +- +- md_io = mempool_alloc(&mddev->md_io_pool, GFP_NOIO); +- md_io->mddev = mddev; +- md_io->orig_bi_end_io = bio->bi_end_io; +- md_io->orig_bi_private = bio->bi_private; +- md_io->orig_bi_bdev = bio->bi_bdev; +- +- bio->bi_end_io = md_end_io; +- bio->bi_private = md_io; +- +- md_io->start_time = bio_start_io_acct(bio); +- } +- + /* bio could be mergeable after passing to underlayer */ + bio->bi_opf &= ~REQ_NOMERGE; + +@@ -5614,7 +5575,6 @@ static void md_free(struct kobject *ko) + + bioset_exit(&mddev->bio_set); + bioset_exit(&mddev->sync_set); +- mempool_exit(&mddev->md_io_pool); + kfree(mddev); + } + +@@ -5710,11 +5670,6 @@ static int md_alloc(dev_t dev, char *name) + */ + mddev->hold_active = UNTIL_STOP; + +- error = mempool_init_kmalloc_pool(&mddev->md_io_pool, BIO_POOL_SIZE, +- sizeof(struct md_io)); +- if (error) +- goto abort; +- + error = -ENOMEM; + mddev->queue = blk_alloc_queue(NUMA_NO_NODE); + if (!mddev->queue) +diff --git a/drivers/md/md.h b/drivers/md/md.h +index bcbba1b5ec4a..5b2da02e2e75 100644 +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -487,7 +487,6 @@ struct mddev { + struct bio_set sync_set; /* for sync operations like + * metadata and bitmap writes + */ +- mempool_t md_io_pool; + + /* Generic flush handling. + * The last to finish preflush schedules a worker to submit +-- +2.30.2 + diff --git a/queue-5.12/media-am437x-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.12/media-am437x-fix-pm_runtime_get_sync-usage-count.patch new file mode 100644 index 00000000000..37a0e88aa96 --- /dev/null +++ b/queue-5.12/media-am437x-fix-pm_runtime_get_sync-usage-count.patch @@ -0,0 +1,69 @@ +From 550f53cb455a319612b09308e8891ad6a9dd47c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 17:05:27 +0200 +Subject: media: am437x: fix pm_runtime_get_sync() usage count + +From: Mauro Carvalho Chehab + +[ Upstream commit c41e02493334985cca1a22efd5ca962ce3abb061 ] + +The pm_runtime_get_sync() internally increments the +dev->power.usage_count without decrementing it, even on errors. +Replace it by the new pm_runtime_resume_and_get(), introduced by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +in order to properly decrement the usage counter, avoiding +a potential PM usage counter leak. + +While here, ensure that the driver will check if PM runtime +resumed at vpfe_initialize_device(). + +Reviewed-by: Jonathan Cameron +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/am437x/am437x-vpfe.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c +index 6cdc77dda0e4..1c9cb9e05fdf 100644 +--- a/drivers/media/platform/am437x/am437x-vpfe.c ++++ b/drivers/media/platform/am437x/am437x-vpfe.c +@@ -1021,7 +1021,9 @@ static int vpfe_initialize_device(struct vpfe_device *vpfe) + if (ret) + return ret; + +- pm_runtime_get_sync(vpfe->pdev); ++ ret = pm_runtime_resume_and_get(vpfe->pdev); ++ if (ret < 0) ++ return ret; + + vpfe_config_enable(&vpfe->ccdc, 1); + +@@ -2443,7 +2445,11 @@ static int vpfe_probe(struct platform_device *pdev) + pm_runtime_enable(&pdev->dev); + + /* for now just enable it here instead of waiting for the open */ +- pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); ++ if (ret < 0) { ++ vpfe_err(vpfe, "Unable to resume device.\n"); ++ goto probe_out_v4l2_unregister; ++ } + + vpfe_ccdc_config_defaults(ccdc); + +@@ -2530,6 +2536,11 @@ static int vpfe_suspend(struct device *dev) + + /* only do full suspend if streaming has started */ + if (vb2_start_streaming_called(&vpfe->buffer_queue)) { ++ /* ++ * ignore RPM resume errors here, as it is already too late. ++ * A check like that should happen earlier, either at ++ * open() or just before start streaming. ++ */ + pm_runtime_get_sync(dev); + vpfe_config_enable(ccdc, 1); + +-- +2.30.2 + diff --git a/queue-5.12/media-au0828-fix-a-null-vs-is_err-check.patch b/queue-5.12/media-au0828-fix-a-null-vs-is_err-check.patch new file mode 100644 index 00000000000..11a94dd7bb0 --- /dev/null +++ b/queue-5.12/media-au0828-fix-a-null-vs-is_err-check.patch @@ -0,0 +1,40 @@ +From 6650eb44a07a56c741320de452bda5382ab832f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 16:20:38 +0200 +Subject: media: au0828: fix a NULL vs IS_ERR() check + +From: Dan Carpenter + +[ Upstream commit 8f2e452730d2bcd59fe05246f0e19a4c52e0012d ] + +The media_device_usb_allocate() function returns error pointers when +it's enabled and something goes wrong. It can return NULL as well, but +only if CONFIG_MEDIA_CONTROLLER is disabled so that doesn't apply here. + +Fixes: 812658d88d26 ("media: change au0828 to use Media Device Allocator API") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/au0828/au0828-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c +index a8a72d5fbd12..caefac07af92 100644 +--- a/drivers/media/usb/au0828/au0828-core.c ++++ b/drivers/media/usb/au0828/au0828-core.c +@@ -199,8 +199,8 @@ static int au0828_media_device_init(struct au0828_dev *dev, + struct media_device *mdev; + + mdev = media_device_usb_allocate(udev, KBUILD_MODNAME, THIS_MODULE); +- if (!mdev) +- return -ENOMEM; ++ if (IS_ERR(mdev)) ++ return PTR_ERR(mdev); + + dev->media_dev = mdev; + #endif +-- +2.30.2 + diff --git a/queue-5.12/media-bt878-do-not-schedule-tasklet-when-it-is-not-s.patch b/queue-5.12/media-bt878-do-not-schedule-tasklet-when-it-is-not-s.patch new file mode 100644 index 00000000000..ba00bcae21a --- /dev/null +++ b/queue-5.12/media-bt878-do-not-schedule-tasklet-when-it-is-not-s.patch @@ -0,0 +1,52 @@ +From 5dcd4b2c0b7303854e84b894c2c745bc3d39a355 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 00:12:26 +0200 +Subject: media: bt878: do not schedule tasklet when it is not setup + +From: Tong Zhang + +[ Upstream commit a3a54bf4bddaecda8b5767209cfc703f0be2841d ] + +There is a problem with the tasklet in bt878. bt->tasklet is set by +dvb-bt8xx.ko, and bt878.ko can be loaded independently. +In this case if interrupt comes it may cause null-ptr-dereference. +To solve this issue, we check if the tasklet is actually set before +calling tasklet_schedule. + +[ 1.750438] bt878(0): irq FDSR FBUS risc_pc= +[ 1.750728] BUG: kernel NULL pointer dereference, address: 0000000000000000 +[ 1.752969] RIP: 0010:0x0 +[ 1.757526] Call Trace: +[ 1.757659] +[ 1.757770] tasklet_action_common.isra.0+0x107/0x110 +[ 1.758041] tasklet_action+0x22/0x30 +[ 1.758237] __do_softirq+0xe0/0x29b +[ 1.758430] irq_exit_rcu+0xa4/0xb0 +[ 1.758618] common_interrupt+0x8d/0xa0 +[ 1.758824] + +Signed-off-by: Tong Zhang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/bt8xx/bt878.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/bt8xx/bt878.c b/drivers/media/pci/bt8xx/bt878.c +index 78dd35c9b65d..7ca309121fb5 100644 +--- a/drivers/media/pci/bt8xx/bt878.c ++++ b/drivers/media/pci/bt8xx/bt878.c +@@ -300,7 +300,8 @@ static irqreturn_t bt878_irq(int irq, void *dev_id) + } + if (astat & BT878_ARISCI) { + bt->finished_block = (stat & BT878_ARISCS) >> 28; +- tasklet_schedule(&bt->tasklet); ++ if (bt->tasklet.callback) ++ tasklet_schedule(&bt->tasklet); + break; + } + count++; +-- +2.30.2 + diff --git a/queue-5.12/media-bt8xx-fix-a-missing-check-bug-in-bt878_probe.patch b/queue-5.12/media-bt8xx-fix-a-missing-check-bug-in-bt878_probe.patch new file mode 100644 index 00000000000..2d482fd227b --- /dev/null +++ b/queue-5.12/media-bt8xx-fix-a-missing-check-bug-in-bt878_probe.patch @@ -0,0 +1,122 @@ +From 99388cabd7cb785fdf43f0abbff721e134a0791f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 17:18:36 +0200 +Subject: media: bt8xx: Fix a missing check bug in bt878_probe + +From: Zheyu Ma + +[ Upstream commit 1a4520090681853e6b850cbe54b27247a013e0e5 ] + +In 'bt878_irq', the driver calls 'tasklet_schedule', but this tasklet is +set in 'dvb_bt8xx_load_card' of another driver 'dvb-bt8xx'. +However, this two drivers are separate. The user may not load the +'dvb-bt8xx' driver when loading the 'bt8xx' driver, that is, the tasklet +has not been initialized when 'tasklet_schedule' is called, so it is +necessary to check whether the tasklet is initialized in 'bt878_probe'. + +Fix this by adding a check at the end of bt878_probe. + +The KASAN's report reveals it: + +BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 +PGD 800000006aab2067 P4D 800000006aab2067 PUD 6b2ea067 PMD 0 +Oops: 0010 [#1] PREEMPT SMP KASAN PTI +CPU: 2 PID: 8724 Comm: syz-executor.0 Not tainted 4.19.177- +gdba4159c14ef-dirty #40 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59- +gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +RIP: 0010: (null) +Code: Bad RIP value. +RSP: 0018:ffff88806c287ea0 EFLAGS: 00010246 +RAX: fffffbfff1b01774 RBX: dffffc0000000000 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: 1ffffffff1b01775 RDI: 0000000000000000 +RBP: ffff88806c287f00 R08: fffffbfff1b01774 R09: fffffbfff1b01774 +R10: 0000000000000001 R11: fffffbfff1b01773 R12: 0000000000000000 +R13: ffff88806c29f530 R14: ffffffff8d80bb88 R15: ffffffff8d80bb90 +FS: 00007f6b550e6700(0000) GS:ffff88806c280000(0000) knlGS: +0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: ffffffffffffffd6 CR3: 000000005ec98000 CR4: 00000000000006e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + + tasklet_action_common.isra.17+0x141/0x420 kernel/softirq.c:522 + tasklet_action+0x50/0x70 kernel/softirq.c:540 + __do_softirq+0x224/0x92c kernel/softirq.c:292 + invoke_softirq kernel/softirq.c:372 [inline] + irq_exit+0x15a/0x180 kernel/softirq.c:412 + exiting_irq arch/x86/include/asm/apic.h:535 [inline] + do_IRQ+0x123/0x1e0 arch/x86/kernel/irq.c:260 + common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 + +RIP: 0010:__do_sys_interrupt kernel/sys.c:2593 [inline] +RIP: 0010:__se_sys_interrupt kernel/sys.c:2584 [inline] +RIP: 0010:__x64_sys_interrupt+0x5b/0x80 kernel/sys.c:2584 +Code: ba 00 04 00 00 48 c7 c7 c0 99 31 8c e8 ae 76 5e 01 48 85 c0 75 21 e8 +14 ae 24 00 48 c7 c3 c0 99 31 8c b8 0c 00 00 00 0f 01 c1 <31> db e8 fe ad +24 00 48 89 d8 5b 5d c3 48 c7 c3 ea ff ff ff eb ec +RSP: 0018:ffff888054167f10 EFLAGS: 00000212 ORIG_RAX: ffffffffffffffde +RAX: 000000000000000c RBX: ffffffff8c3199c0 RCX: ffffc90001ca6000 +RDX: 000000000000001a RSI: ffffffff813478fc RDI: ffffffff8c319dc0 +RBP: ffff888054167f18 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000080 R11: fffffbfff18633b7 R12: ffff888054167f58 +R13: ffff88805f638000 R14: 0000000000000000 R15: 0000000000000000 + do_syscall_64+0xb0/0x4e0 arch/x86/entry/common.c:293 + entry_SYSCALL_64_after_hwframe+0x49/0xbe +RIP: 0033:0x4692a9 +Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 f7 +48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff +ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f6b550e5c48 EFLAGS: 00000246 ORIG_RAX: 000000000000014f +RAX: ffffffffffffffda RBX: 000000000077bf60 RCX: 00000000004692a9 +RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020000140 +RBP: 00000000004cf7eb R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 000000000077bf60 +R13: 0000000000000000 R14: 000000000077bf60 R15: 00007fff55a1dca0 +Modules linked in: +Dumping ftrace buffer: + (ftrace buffer empty) +CR2: 0000000000000000 +---[ end trace 68e5849c3f77cbb6 ]--- +RIP: 0010: (null) +Code: Bad RIP value. +RSP: 0018:ffff88806c287ea0 EFLAGS: 00010246 +RAX: fffffbfff1b01774 RBX: dffffc0000000000 RCX: 0000000000000000 +RDX: 0000000000000000 RSI: 1ffffffff1b01775 RDI: 0000000000000000 +RBP: ffff88806c287f00 R08: fffffbfff1b01774 R09: fffffbfff1b01774 +R10: 0000000000000001 R11: fffffbfff1b01773 R12: 0000000000000000 +R13: ffff88806c29f530 R14: ffffffff8d80bb88 R15: ffffffff8d80bb90 +FS: 00007f6b550e6700(0000) GS:ffff88806c280000(0000) knlGS: +0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: ffffffffffffffd6 CR3: 000000005ec98000 CR4: 00000000000006e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + +Reported-by: Zheyu Ma +Signed-off-by: Zheyu Ma +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/bt8xx/bt878.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/pci/bt8xx/bt878.c b/drivers/media/pci/bt8xx/bt878.c +index 7ca309121fb5..90972d6952f1 100644 +--- a/drivers/media/pci/bt8xx/bt878.c ++++ b/drivers/media/pci/bt8xx/bt878.c +@@ -478,6 +478,9 @@ static int bt878_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) + btwrite(0, BT878_AINT_MASK); + bt878_num++; + ++ if (!bt->tasklet.func) ++ tasklet_disable(&bt->tasklet); ++ + return 0; + + fail2: +-- +2.30.2 + diff --git a/queue-5.12/media-cedrus-fix-.buf_prepare.patch b/queue-5.12/media-cedrus-fix-.buf_prepare.patch new file mode 100644 index 00000000000..de1be91f15d --- /dev/null +++ b/queue-5.12/media-cedrus-fix-.buf_prepare.patch @@ -0,0 +1,47 @@ +From db8f592d46520d1c83383bcf3afae9eb3818f82b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 14:23:47 +0200 +Subject: media: cedrus: Fix .buf_prepare + +From: Andrzej Pietrasiewicz + +[ Upstream commit d84b9202d712309840f8b5abee0ed272506563bd ] + +The driver should only set the payload on .buf_prepare if the +buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused +set by userspace then v4l2-core will set it to buffer length. + +If we overwrite bytesused for OUTPUT buffers, too, then +vb2_get_plane_payload() will return incorrect value which might be then +written to hw registers by the driver in cedrus_h264.c or cedrus_vp8.c. + +Signed-off-by: Andrzej Pietrasiewicz +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/sunxi/cedrus/cedrus_video.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_video.c b/drivers/staging/media/sunxi/cedrus/cedrus_video.c +index b62eb8e84057..bf731caf2ed5 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus_video.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_video.c +@@ -457,7 +457,13 @@ static int cedrus_buf_prepare(struct vb2_buffer *vb) + if (vb2_plane_size(vb, 0) < pix_fmt->sizeimage) + return -EINVAL; + +- vb2_set_plane_payload(vb, 0, pix_fmt->sizeimage); ++ /* ++ * Buffer's bytesused must be written by driver for CAPTURE buffers. ++ * (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets ++ * it to buffer length). ++ */ ++ if (V4L2_TYPE_IS_CAPTURE(vq->type)) ++ vb2_set_plane_payload(vb, 0, pix_fmt->sizeimage); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.12/media-cobalt-fix-race-condition-in-setting-hpd.patch b/queue-5.12/media-cobalt-fix-race-condition-in-setting-hpd.patch new file mode 100644 index 00000000000..c556f85c013 --- /dev/null +++ b/queue-5.12/media-cobalt-fix-race-condition-in-setting-hpd.patch @@ -0,0 +1,70 @@ +From 45105385d04a2184c5a05f8a5b59e4f50e270f9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 10:00:49 +0200 +Subject: media: cobalt: fix race condition in setting HPD + +From: Hans Verkuil + +[ Upstream commit 3d37ef41bed0854805ab9af22c422267510e1344 ] + +The cobalt_s_bit_sysctrl reads the old register value over PCI, +then changes a bit and sets writes the new value to the register. + +This is used among other things for setting the HPD output pin. + +But if the HPD is changed for multiple inputs at the same time, +then this causes a race condition where a stale value is read. + +Serialize this function with a mutex. + +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cobalt/cobalt-driver.c | 1 + + drivers/media/pci/cobalt/cobalt-driver.h | 7 ++++++- + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/cobalt/cobalt-driver.c b/drivers/media/pci/cobalt/cobalt-driver.c +index 0695078ef812..1bd8bbe57a30 100644 +--- a/drivers/media/pci/cobalt/cobalt-driver.c ++++ b/drivers/media/pci/cobalt/cobalt-driver.c +@@ -667,6 +667,7 @@ static int cobalt_probe(struct pci_dev *pci_dev, + return -ENOMEM; + cobalt->pci_dev = pci_dev; + cobalt->instance = i; ++ mutex_init(&cobalt->pci_lock); + + retval = v4l2_device_register(&pci_dev->dev, &cobalt->v4l2_dev); + if (retval) { +diff --git a/drivers/media/pci/cobalt/cobalt-driver.h b/drivers/media/pci/cobalt/cobalt-driver.h +index bca68572b324..12c33e035904 100644 +--- a/drivers/media/pci/cobalt/cobalt-driver.h ++++ b/drivers/media/pci/cobalt/cobalt-driver.h +@@ -251,6 +251,8 @@ struct cobalt { + int instance; + struct pci_dev *pci_dev; + struct v4l2_device v4l2_dev; ++ /* serialize PCI access in cobalt_s_bit_sysctrl() */ ++ struct mutex pci_lock; + + void __iomem *bar0, *bar1; + +@@ -320,10 +322,13 @@ static inline u32 cobalt_g_sysctrl(struct cobalt *cobalt) + static inline void cobalt_s_bit_sysctrl(struct cobalt *cobalt, + int bit, int val) + { +- u32 ctrl = cobalt_read_bar1(cobalt, COBALT_SYS_CTRL_BASE); ++ u32 ctrl; + ++ mutex_lock(&cobalt->pci_lock); ++ ctrl = cobalt_read_bar1(cobalt, COBALT_SYS_CTRL_BASE); + cobalt_write_bar1(cobalt, COBALT_SYS_CTRL_BASE, + (ctrl & ~(1UL << bit)) | (val << bit)); ++ mutex_unlock(&cobalt->pci_lock); + } + + static inline u32 cobalt_g_sysstat(struct cobalt *cobalt) +-- +2.30.2 + diff --git a/queue-5.12/media-cpia2-fix-memory-leak-in-cpia2_usb_probe.patch b/queue-5.12/media-cpia2-fix-memory-leak-in-cpia2_usb_probe.patch new file mode 100644 index 00000000000..c5867f95aa4 --- /dev/null +++ b/queue-5.12/media-cpia2-fix-memory-leak-in-cpia2_usb_probe.patch @@ -0,0 +1,104 @@ +From 35c1eb25096c6475dff3e03948beda7f2d18bcd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 21:43:45 +0200 +Subject: media: cpia2: fix memory leak in cpia2_usb_probe + +From: Pavel Skripkin + +[ Upstream commit be8656e62e9e791837b606a027802b504a945c97 ] + +syzbot reported leak in cpia2 usb driver. The problem was +in invalid error handling. + +v4l2_device_register() is called in cpia2_init_camera_struct(), but +all error cases after cpia2_init_camera_struct() did not call the +v4l2_device_unregister() + +Reported-by: syzbot+d1e69c888f0d3866ead4@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/cpia2/cpia2.h | 1 + + drivers/media/usb/cpia2/cpia2_core.c | 12 ++++++++++++ + drivers/media/usb/cpia2/cpia2_usb.c | 13 +++++++------ + 3 files changed, 20 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/usb/cpia2/cpia2.h b/drivers/media/usb/cpia2/cpia2.h +index 50835f5f7512..57b7f1ea68da 100644 +--- a/drivers/media/usb/cpia2/cpia2.h ++++ b/drivers/media/usb/cpia2/cpia2.h +@@ -429,6 +429,7 @@ int cpia2_send_command(struct camera_data *cam, struct cpia2_command *cmd); + int cpia2_do_command(struct camera_data *cam, + unsigned int command, + unsigned char direction, unsigned char param); ++void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf); + struct camera_data *cpia2_init_camera_struct(struct usb_interface *intf); + int cpia2_init_camera(struct camera_data *cam); + int cpia2_allocate_buffers(struct camera_data *cam); +diff --git a/drivers/media/usb/cpia2/cpia2_core.c b/drivers/media/usb/cpia2/cpia2_core.c +index e747548ab286..b5a2d06fb356 100644 +--- a/drivers/media/usb/cpia2/cpia2_core.c ++++ b/drivers/media/usb/cpia2/cpia2_core.c +@@ -2163,6 +2163,18 @@ static void reset_camera_struct(struct camera_data *cam) + cam->height = cam->params.roi.height; + } + ++/****************************************************************************** ++ * ++ * cpia2_init_camera_struct ++ * ++ * Deinitialize camera struct ++ *****************************************************************************/ ++void cpia2_deinit_camera_struct(struct camera_data *cam, struct usb_interface *intf) ++{ ++ v4l2_device_unregister(&cam->v4l2_dev); ++ kfree(cam); ++} ++ + /****************************************************************************** + * + * cpia2_init_camera_struct +diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c +index 3ab80a7b4498..76aac06f9fb8 100644 +--- a/drivers/media/usb/cpia2/cpia2_usb.c ++++ b/drivers/media/usb/cpia2/cpia2_usb.c +@@ -844,15 +844,13 @@ static int cpia2_usb_probe(struct usb_interface *intf, + ret = set_alternate(cam, USBIF_CMDONLY); + if (ret < 0) { + ERR("%s: usb_set_interface error (ret = %d)\n", __func__, ret); +- kfree(cam); +- return ret; ++ goto alt_err; + } + + + if((ret = cpia2_init_camera(cam)) < 0) { + ERR("%s: failed to initialize cpia2 camera (ret = %d)\n", __func__, ret); +- kfree(cam); +- return ret; ++ goto alt_err; + } + LOG(" CPiA Version: %d.%02d (%d.%d)\n", + cam->params.version.firmware_revision_hi, +@@ -872,11 +870,14 @@ static int cpia2_usb_probe(struct usb_interface *intf, + ret = cpia2_register_camera(cam); + if (ret < 0) { + ERR("%s: Failed to register cpia2 camera (ret = %d)\n", __func__, ret); +- kfree(cam); +- return ret; ++ goto alt_err; + } + + return 0; ++ ++alt_err: ++ cpia2_deinit_camera_struct(cam, intf); ++ return ret; + } + + /****************************************************************************** +-- +2.30.2 + diff --git a/queue-5.12/media-dvb_net-avoid-speculation-from-net-slot.patch b/queue-5.12/media-dvb_net-avoid-speculation-from-net-slot.patch new file mode 100644 index 00000000000..8e22163c8ba --- /dev/null +++ b/queue-5.12/media-dvb_net-avoid-speculation-from-net-slot.patch @@ -0,0 +1,89 @@ +From a5245727f0b5f7b6aff2638510afb4c137ba693f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 13:13:54 +0200 +Subject: media: dvb_net: avoid speculation from net slot + +From: Mauro Carvalho Chehab + +[ Upstream commit abc0226df64dc137b48b911c1fe4319aec5891bb ] + +The risk of especulation is actually almost-non-existing here, +as there are very few users of TCP/IP using the DVB stack, +as, this is mainly used with DVB-S/S2 cards, and only by people +that receives TCP/IP from satellite connections, which limits +a lot the number of users of such feature(*). + +(*) In thesis, DVB-C cards could also benefit from it, but I'm +yet to see a hardware that supports it. + +Yet, fixing it is trivial. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dvb_net.c | 25 +++++++++++++++++++------ + 1 file changed, 19 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c +index 89620da983ba..dddebea644bb 100644 +--- a/drivers/media/dvb-core/dvb_net.c ++++ b/drivers/media/dvb-core/dvb_net.c +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1462,14 +1463,20 @@ static int dvb_net_do_ioctl(struct file *file, + struct net_device *netdev; + struct dvb_net_priv *priv_data; + struct dvb_net_if *dvbnetif = parg; ++ int if_num = dvbnetif->if_num; + +- if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX || +- !dvbnet->state[dvbnetif->if_num]) { ++ if (if_num >= DVB_NET_DEVICES_MAX) { + ret = -EINVAL; + goto ioctl_error; + } ++ if_num = array_index_nospec(if_num, DVB_NET_DEVICES_MAX); + +- netdev = dvbnet->device[dvbnetif->if_num]; ++ if (!dvbnet->state[if_num]) { ++ ret = -EINVAL; ++ goto ioctl_error; ++ } ++ ++ netdev = dvbnet->device[if_num]; + + priv_data = netdev_priv(netdev); + dvbnetif->pid=priv_data->pid; +@@ -1522,14 +1529,20 @@ static int dvb_net_do_ioctl(struct file *file, + struct net_device *netdev; + struct dvb_net_priv *priv_data; + struct __dvb_net_if_old *dvbnetif = parg; ++ int if_num = dvbnetif->if_num; ++ ++ if (if_num >= DVB_NET_DEVICES_MAX) { ++ ret = -EINVAL; ++ goto ioctl_error; ++ } ++ if_num = array_index_nospec(if_num, DVB_NET_DEVICES_MAX); + +- if (dvbnetif->if_num >= DVB_NET_DEVICES_MAX || +- !dvbnet->state[dvbnetif->if_num]) { ++ if (!dvbnet->state[if_num]) { + ret = -EINVAL; + goto ioctl_error; + } + +- netdev = dvbnet->device[dvbnetif->if_num]; ++ netdev = dvbnet->device[if_num]; + + priv_data = netdev_priv(netdev); + dvbnetif->pid=priv_data->pid; +-- +2.30.2 + diff --git a/queue-5.12/media-dvbdev-fix-error-logic-at-dvb_register_device.patch b/queue-5.12/media-dvbdev-fix-error-logic-at-dvb_register_device.patch new file mode 100644 index 00000000000..adae51f3ada --- /dev/null +++ b/queue-5.12/media-dvbdev-fix-error-logic-at-dvb_register_device.patch @@ -0,0 +1,55 @@ +From c8c57a1bb002178088fca960fed45acd7c9e0028 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jun 2021 14:32:29 +0200 +Subject: media: dvbdev: fix error logic at dvb_register_device() + +From: Mauro Carvalho Chehab + +[ Upstream commit 1fec2ecc252301110e4149e6183fa70460d29674 ] + +As reported by smatch: + + drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:510 dvb_register_device() warn: '&dvbdev->list_head' not removed from list + drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:530 dvb_register_device() warn: '&dvbdev->list_head' not removed from list + drivers/media/dvb-core/dvbdev.c: drivers/media/dvb-core/dvbdev.c:545 dvb_register_device() warn: '&dvbdev->list_head' not removed from list + +The error logic inside dvb_register_device() doesn't remove +devices from the dvb_adapter_list in case of errors. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/dvb-core/dvbdev.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c +index 3862ddc86ec4..795d9bfaba5c 100644 +--- a/drivers/media/dvb-core/dvbdev.c ++++ b/drivers/media/dvb-core/dvbdev.c +@@ -506,6 +506,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + break; + + if (minor == MAX_DVB_MINORS) { ++ list_del (&dvbdev->list_head); + kfree(dvbdevfops); + kfree(dvbdev); + up_write(&minor_rwsem); +@@ -526,6 +527,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + __func__); + + dvb_media_device_free(dvbdev); ++ list_del (&dvbdev->list_head); + kfree(dvbdevfops); + kfree(dvbdev); + mutex_unlock(&dvbdev_register_lock); +@@ -541,6 +543,7 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev, + pr_err("%s: failed to create device dvb%d.%s%d (%ld)\n", + __func__, adap->num, dnames[type], id, PTR_ERR(clsdev)); + dvb_media_device_free(dvbdev); ++ list_del (&dvbdev->list_head); + kfree(dvbdevfops); + kfree(dvbdev); + return PTR_ERR(clsdev); +-- +2.30.2 + diff --git a/queue-5.12/media-dvd_usb-memory-leak-in-cinergyt2_fe_attach.patch b/queue-5.12/media-dvd_usb-memory-leak-in-cinergyt2_fe_attach.patch new file mode 100644 index 00000000000..546908f6c6a --- /dev/null +++ b/queue-5.12/media-dvd_usb-memory-leak-in-cinergyt2_fe_attach.patch @@ -0,0 +1,52 @@ +From 325742683d50b56a59c5c16e037a494604493a69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 15:06:52 +0200 +Subject: media: dvd_usb: memory leak in cinergyt2_fe_attach + +From: Dongliang Mu + +[ Upstream commit 9ad1efee086e0e913914fa2b2173efb830bad68c ] + +When the driver fails to talk with the hardware with dvb_usb_generic_rw, +it will return an error to dvb_usb_adapter_frontend_init. However, the +driver forgets to free the resource (e.g., struct cinergyt2_fe_state), +which leads to a memory leak. + +Fix this by freeing struct cinergyt2_fe_state when dvb_usb_generic_rw +fails in cinergyt2_frontend_attach. + +backtrace: + [<0000000056e17b1a>] kmalloc include/linux/slab.h:552 [inline] + [<0000000056e17b1a>] kzalloc include/linux/slab.h:682 [inline] + [<0000000056e17b1a>] cinergyt2_fe_attach+0x21/0x80 drivers/media/usb/dvb-usb/cinergyT2-fe.c:271 + [<00000000ae0b1711>] cinergyt2_frontend_attach+0x21/0x70 drivers/media/usb/dvb-usb/cinergyT2-core.c:74 + [<00000000d0254861>] dvb_usb_adapter_frontend_init+0x11b/0x1b0 drivers/media/usb/dvb-usb/dvb-usb-dvb.c:290 + [<0000000002e08ac6>] dvb_usb_adapter_init drivers/media/usb/dvb-usb/dvb-usb-init.c:84 [inline] + [<0000000002e08ac6>] dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:173 [inline] + [<0000000002e08ac6>] dvb_usb_device_init.cold+0x4d0/0x6ae drivers/media/usb/dvb-usb/dvb-usb-init.c:287 + +Reported-by: syzbot+e1de8986786b3722050e@syzkaller.appspotmail.com +Signed-off-by: Dongliang Mu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/dvb-usb/cinergyT2-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/usb/dvb-usb/cinergyT2-core.c b/drivers/media/usb/dvb-usb/cinergyT2-core.c +index 969a7ec71dff..4116ba5c45fc 100644 +--- a/drivers/media/usb/dvb-usb/cinergyT2-core.c ++++ b/drivers/media/usb/dvb-usb/cinergyT2-core.c +@@ -78,6 +78,8 @@ static int cinergyt2_frontend_attach(struct dvb_usb_adapter *adap) + + ret = dvb_usb_generic_rw(d, st->data, 1, st->data, 3, 0); + if (ret < 0) { ++ if (adap->fe_adap[0].fe) ++ adap->fe_adap[0].fe->ops.release(adap->fe_adap[0].fe); + deb_rc("cinergyt2_power_ctrl() Failed to retrieve sleep state info\n"); + } + mutex_unlock(&d->data_mutex); +-- +2.30.2 + diff --git a/queue-5.12/media-em28xx-fix-possible-memory-leak-of-em28xx-stru.patch b/queue-5.12/media-em28xx-fix-possible-memory-leak-of-em28xx-stru.patch new file mode 100644 index 00000000000..dcdc327b905 --- /dev/null +++ b/queue-5.12/media-em28xx-fix-possible-memory-leak-of-em28xx-stru.patch @@ -0,0 +1,58 @@ +From 2ad9dc75ed25dca54849f659eadfe92ec08f95ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 20:32:49 +0200 +Subject: media: em28xx: Fix possible memory leak of em28xx struct + +From: Igor Matheus Andrade Torrente + +[ Upstream commit ac5688637144644f06ed1f3c6d4dd8bb7db96020 ] + +The em28xx struct kref isn't being decreased after an error in the +em28xx_ir_init, leading to a possible memory leak. + +A kref_put and em28xx_shutdown_buttons is added to the error handler code. + +Signed-off-by: Igor Matheus Andrade Torrente +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/em28xx/em28xx-input.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/em28xx/em28xx-input.c b/drivers/media/usb/em28xx/em28xx-input.c +index 5aa15a7a49de..59529cbf9cd0 100644 +--- a/drivers/media/usb/em28xx/em28xx-input.c ++++ b/drivers/media/usb/em28xx/em28xx-input.c +@@ -720,7 +720,8 @@ static int em28xx_ir_init(struct em28xx *dev) + dev->board.has_ir_i2c = 0; + dev_warn(&dev->intf->dev, + "No i2c IR remote control device found.\n"); +- return -ENODEV; ++ err = -ENODEV; ++ goto ref_put; + } + } + +@@ -735,7 +736,7 @@ static int em28xx_ir_init(struct em28xx *dev) + + ir = kzalloc(sizeof(*ir), GFP_KERNEL); + if (!ir) +- return -ENOMEM; ++ goto ref_put; + rc = rc_allocate_device(RC_DRIVER_SCANCODE); + if (!rc) + goto error; +@@ -839,6 +840,9 @@ error: + dev->ir = NULL; + rc_free_device(rc); + kfree(ir); ++ref_put: ++ em28xx_shutdown_buttons(dev); ++ kref_put(&dev->ref, em28xx_free_device); + return err; + } + +-- +2.30.2 + diff --git a/queue-5.12/media-exynos-gsc-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.12/media-exynos-gsc-fix-pm_runtime_get_sync-usage-count.patch new file mode 100644 index 00000000000..bb74f3ba978 --- /dev/null +++ b/queue-5.12/media-exynos-gsc-fix-pm_runtime_get_sync-usage-count.patch @@ -0,0 +1,46 @@ +From 90a95497749cf95ad2c00efa43c4d54195e928cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 17:19:18 +0200 +Subject: media: exynos-gsc: fix pm_runtime_get_sync() usage count + +From: Mauro Carvalho Chehab + +[ Upstream commit 59087b66ea6730c130c57d23bd9fd139b78c1ba5 ] + +The pm_runtime_get_sync() internally increments the +dev->power.usage_count without decrementing it, even on errors. +Replace it by the new pm_runtime_resume_and_get(), introduced by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +in order to properly decrement the usage counter, avoiding +a potential PM usage counter leak. + +As a bonus, as pm_runtime_get_sync() always return 0 on +success, the logic can be simplified. + +Reviewed-by: Jonathan Cameron +Reviewed-by: Sylwester Nawrocki +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos-gsc/gsc-m2m.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/media/platform/exynos-gsc/gsc-m2m.c b/drivers/media/platform/exynos-gsc/gsc-m2m.c +index 27a3c92c73bc..f1cf847d1cc2 100644 +--- a/drivers/media/platform/exynos-gsc/gsc-m2m.c ++++ b/drivers/media/platform/exynos-gsc/gsc-m2m.c +@@ -56,10 +56,8 @@ static void __gsc_m2m_job_abort(struct gsc_ctx *ctx) + static int gsc_m2m_start_streaming(struct vb2_queue *q, unsigned int count) + { + struct gsc_ctx *ctx = q->drv_priv; +- int ret; + +- ret = pm_runtime_get_sync(&ctx->gsc_dev->pdev->dev); +- return ret > 0 ? 0 : ret; ++ return pm_runtime_resume_and_get(&ctx->gsc_dev->pdev->dev); + } + + static void __gsc_m2m_cleanup_queue(struct gsc_ctx *ctx) +-- +2.30.2 + diff --git a/queue-5.12/media-exynos4-is-fix-a-use-after-free-in-isp_video_r.patch b/queue-5.12/media-exynos4-is-fix-a-use-after-free-in-isp_video_r.patch new file mode 100644 index 00000000000..2a29c462b05 --- /dev/null +++ b/queue-5.12/media-exynos4-is-fix-a-use-after-free-in-isp_video_r.patch @@ -0,0 +1,57 @@ +From de7f197fa94279eb469d62eb512a82a323ca66ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 May 2021 10:12:31 +0200 +Subject: media: exynos4-is: Fix a use after free in isp_video_release + +From: Lv Yunlong + +[ Upstream commit 01fe904c9afd26e79c1f73aa0ca2e3d785e5e319 ] + +In isp_video_release, file->private_data is freed via +_vb2_fop_release()->v4l2_fh_release(). But the freed +file->private_data is still used in v4l2_fh_is_singular_file() +->v4l2_fh_is_singular(file->private_data), which is a use +after free bug. + +My patch uses a variable 'is_singular_file' to avoid the uaf. +v3: https://lore.kernel.org/patchwork/patch/1419058/ + +Fixes: 34947b8aebe3f ("[media] exynos4-is: Add the FIMC-IS ISP capture DMA driver") +Signed-off-by: Lv Yunlong +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/fimc-isp-video.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c +index 8d9dc597deaa..83688a7982f7 100644 +--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c ++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c +@@ -305,17 +305,20 @@ static int isp_video_release(struct file *file) + struct fimc_is_video *ivc = &isp->video_capture; + struct media_entity *entity = &ivc->ve.vdev.entity; + struct media_device *mdev = entity->graph_obj.mdev; ++ bool is_singular_file; + + mutex_lock(&isp->video_lock); + +- if (v4l2_fh_is_singular_file(file) && ivc->streaming) { ++ is_singular_file = v4l2_fh_is_singular_file(file); ++ ++ if (is_singular_file && ivc->streaming) { + media_pipeline_stop(entity); + ivc->streaming = 0; + } + + _vb2_fop_release(file, NULL); + +- if (v4l2_fh_is_singular_file(file)) { ++ if (is_singular_file) { + fimc_pipeline_call(&ivc->ve, close); + + mutex_lock(&mdev->graph_mutex); +-- +2.30.2 + diff --git a/queue-5.12/media-exynos4-is-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.12/media-exynos4-is-fix-pm_runtime_get_sync-usage-count.patch new file mode 100644 index 00000000000..6963d33fdeb --- /dev/null +++ b/queue-5.12/media-exynos4-is-fix-pm_runtime_get_sync-usage-count.patch @@ -0,0 +1,225 @@ +From 9373ded512416e5cad82068c09ed9a2d3dc0e978 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 17:19:17 +0200 +Subject: media: exynos4-is: fix pm_runtime_get_sync() usage count + +From: Mauro Carvalho Chehab + +[ Upstream commit 59f96244af9403ddf4810ec5c0fbe8920857634e ] + +The pm_runtime_get_sync() internally increments the +dev->power.usage_count without decrementing it, even on errors. + +On some places, this is ok, but on others the usage count +ended being unbalanced on failures. + +Replace it by the new pm_runtime_resume_and_get(), introduced by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +in order to properly decrement the usage counter, avoiding +a potential PM usage counter leak. + +As a bonus, such function always return zero on success. So, +some code can be simplified. + +Reviewed-by: Sylwester Nawrocki +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/fimc-capture.c | 6 ++---- + drivers/media/platform/exynos4-is/fimc-is.c | 4 ++-- + drivers/media/platform/exynos4-is/fimc-isp-video.c | 3 +-- + drivers/media/platform/exynos4-is/fimc-isp.c | 7 +++---- + drivers/media/platform/exynos4-is/fimc-lite.c | 5 +++-- + drivers/media/platform/exynos4-is/fimc-m2m.c | 5 +---- + drivers/media/platform/exynos4-is/media-dev.c | 9 +++------ + drivers/media/platform/exynos4-is/mipi-csis.c | 10 ++++------ + 8 files changed, 19 insertions(+), 30 deletions(-) + +diff --git a/drivers/media/platform/exynos4-is/fimc-capture.c b/drivers/media/platform/exynos4-is/fimc-capture.c +index 13c838d3f947..0da36443173c 100644 +--- a/drivers/media/platform/exynos4-is/fimc-capture.c ++++ b/drivers/media/platform/exynos4-is/fimc-capture.c +@@ -478,11 +478,9 @@ static int fimc_capture_open(struct file *file) + goto unlock; + + set_bit(ST_CAPT_BUSY, &fimc->state); +- ret = pm_runtime_get_sync(&fimc->pdev->dev); +- if (ret < 0) { +- pm_runtime_put_sync(&fimc->pdev->dev); ++ ret = pm_runtime_resume_and_get(&fimc->pdev->dev); ++ if (ret < 0) + goto unlock; +- } + + ret = v4l2_fh_open(file); + if (ret) { +diff --git a/drivers/media/platform/exynos4-is/fimc-is.c b/drivers/media/platform/exynos4-is/fimc-is.c +index 972d9601d236..1b24f5bfc4af 100644 +--- a/drivers/media/platform/exynos4-is/fimc-is.c ++++ b/drivers/media/platform/exynos4-is/fimc-is.c +@@ -828,9 +828,9 @@ static int fimc_is_probe(struct platform_device *pdev) + goto err_irq; + } + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) +- goto err_pm; ++ goto err_irq; + + vb2_dma_contig_set_max_seg_size(dev, DMA_BIT_MASK(32)); + +diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c +index 612b9872afc8..8d9dc597deaa 100644 +--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c ++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c +@@ -275,7 +275,7 @@ static int isp_video_open(struct file *file) + if (ret < 0) + goto unlock; + +- ret = pm_runtime_get_sync(&isp->pdev->dev); ++ ret = pm_runtime_resume_and_get(&isp->pdev->dev); + if (ret < 0) + goto rel_fh; + +@@ -293,7 +293,6 @@ static int isp_video_open(struct file *file) + if (!ret) + goto unlock; + rel_fh: +- pm_runtime_put_noidle(&isp->pdev->dev); + v4l2_fh_release(file); + unlock: + mutex_unlock(&isp->video_lock); +diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c +index a77c49b18511..74b49d30901e 100644 +--- a/drivers/media/platform/exynos4-is/fimc-isp.c ++++ b/drivers/media/platform/exynos4-is/fimc-isp.c +@@ -304,11 +304,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, int on) + pr_debug("on: %d\n", on); + + if (on) { +- ret = pm_runtime_get_sync(&is->pdev->dev); +- if (ret < 0) { +- pm_runtime_put(&is->pdev->dev); ++ ret = pm_runtime_resume_and_get(&is->pdev->dev); ++ if (ret < 0) + return ret; +- } ++ + set_bit(IS_ST_PWR_ON, &is->state); + + ret = fimc_is_start_firmware(is); +diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c +index fe20af3a7178..4d8b18078ff3 100644 +--- a/drivers/media/platform/exynos4-is/fimc-lite.c ++++ b/drivers/media/platform/exynos4-is/fimc-lite.c +@@ -469,9 +469,9 @@ static int fimc_lite_open(struct file *file) + } + + set_bit(ST_FLITE_IN_USE, &fimc->state); +- ret = pm_runtime_get_sync(&fimc->pdev->dev); ++ ret = pm_runtime_resume_and_get(&fimc->pdev->dev); + if (ret < 0) +- goto err_pm; ++ goto err_in_use; + + ret = v4l2_fh_open(file); + if (ret < 0) +@@ -499,6 +499,7 @@ static int fimc_lite_open(struct file *file) + v4l2_fh_release(file); + err_pm: + pm_runtime_put_sync(&fimc->pdev->dev); ++err_in_use: + clear_bit(ST_FLITE_IN_USE, &fimc->state); + unlock: + mutex_unlock(&fimc->lock); +diff --git a/drivers/media/platform/exynos4-is/fimc-m2m.c b/drivers/media/platform/exynos4-is/fimc-m2m.c +index c9704a147e5c..df8e2aa454d8 100644 +--- a/drivers/media/platform/exynos4-is/fimc-m2m.c ++++ b/drivers/media/platform/exynos4-is/fimc-m2m.c +@@ -73,17 +73,14 @@ static void fimc_m2m_shutdown(struct fimc_ctx *ctx) + static int start_streaming(struct vb2_queue *q, unsigned int count) + { + struct fimc_ctx *ctx = q->drv_priv; +- int ret; + +- ret = pm_runtime_get_sync(&ctx->fimc_dev->pdev->dev); +- return ret > 0 ? 0 : ret; ++ return pm_runtime_resume_and_get(&ctx->fimc_dev->pdev->dev); + } + + static void stop_streaming(struct vb2_queue *q) + { + struct fimc_ctx *ctx = q->drv_priv; + +- + fimc_m2m_shutdown(ctx); + fimc_m2m_job_finish(ctx, VB2_BUF_STATE_ERROR); + pm_runtime_put(&ctx->fimc_dev->pdev->dev); +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c +index 8e1e892085ec..4424050a22e4 100644 +--- a/drivers/media/platform/exynos4-is/media-dev.c ++++ b/drivers/media/platform/exynos4-is/media-dev.c +@@ -510,11 +510,9 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd) + if (!fmd->pmf) + return -ENXIO; + +- ret = pm_runtime_get_sync(fmd->pmf); +- if (ret < 0) { +- pm_runtime_put(fmd->pmf); ++ ret = pm_runtime_resume_and_get(fmd->pmf); ++ if (ret < 0) + return ret; +- } + + fmd->num_sensors = 0; + +@@ -1289,8 +1287,7 @@ static int cam_clk_prepare(struct clk_hw *hw) + if (camclk->fmd->pmf == NULL) + return -ENODEV; + +- ret = pm_runtime_get_sync(camclk->fmd->pmf); +- return ret < 0 ? ret : 0; ++ return pm_runtime_resume_and_get(camclk->fmd->pmf); + } + + static void cam_clk_unprepare(struct clk_hw *hw) +diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c +index 1aac167abb17..ebf39c856894 100644 +--- a/drivers/media/platform/exynos4-is/mipi-csis.c ++++ b/drivers/media/platform/exynos4-is/mipi-csis.c +@@ -494,7 +494,7 @@ static int s5pcsis_s_power(struct v4l2_subdev *sd, int on) + struct device *dev = &state->pdev->dev; + + if (on) +- return pm_runtime_get_sync(dev); ++ return pm_runtime_resume_and_get(dev); + + return pm_runtime_put_sync(dev); + } +@@ -509,11 +509,9 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int enable) + + if (enable) { + s5pcsis_clear_counters(state); +- ret = pm_runtime_get_sync(&state->pdev->dev); +- if (ret && ret != 1) { +- pm_runtime_put_noidle(&state->pdev->dev); ++ ret = pm_runtime_resume_and_get(&state->pdev->dev); ++ if (ret < 0) + return ret; +- } + } + + mutex_lock(&state->lock); +@@ -535,7 +533,7 @@ unlock: + if (!enable) + pm_runtime_put(&state->pdev->dev); + +- return ret == 1 ? 0 : ret; ++ return ret; + } + + static int s5pcsis_enum_mbus_code(struct v4l2_subdev *sd, +-- +2.30.2 + diff --git a/queue-5.12/media-fix-media-controller-api-config-checks.patch b/queue-5.12/media-fix-media-controller-api-config-checks.patch new file mode 100644 index 00000000000..56249627f50 --- /dev/null +++ b/queue-5.12/media-fix-media-controller-api-config-checks.patch @@ -0,0 +1,88 @@ +From 535b8d026253f6ef2cf5026229808a5c68a8f12d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 17:19:06 +0200 +Subject: media: Fix Media Controller API config checks + +From: Shuah Khan + +[ Upstream commit 50e7a31d30e8221632675abed3be306382324ca2 ] + +Smatch static checker warns that "mdev" can be null: + +sound/usb/media.c:287 snd_media_device_create() + warn: 'mdev' can also be NULL + +If CONFIG_MEDIA_CONTROLLER is disabled, this file should not be included +in the build. + +The below conditions in the sound/usb/Makefile are in place to ensure that +media.c isn't included in the build. + +sound/usb/Makefile: +snd-usb-audio-$(CONFIG_SND_USB_AUDIO_USE_MEDIA_CONTROLLER) += media.o + +select SND_USB_AUDIO_USE_MEDIA_CONTROLLER if MEDIA_CONTROLLER && + (MEDIA_SUPPORT=y || MEDIA_SUPPORT=SND_USB_AUDIO) + +The following config check in include/media/media-dev-allocator.h is +in place to enable the API only when CONFIG_MEDIA_CONTROLLER and +CONFIG_USB are enabled. + + #if defined(CONFIG_MEDIA_CONTROLLER) && defined(CONFIG_USB) + +This check doesn't work as intended when CONFIG_USB=m. When CONFIG_USB=m, +CONFIG_USB_MODULE is defined and CONFIG_USB is not. The above config check +doesn't catch that CONFIG_USB is defined as a module and disables the API. +This results in sound/usb enabling Media Controller specific ALSA driver +code, while Media disables the Media Controller API. + +Fix the problem requires two changes: + +1. Change the check to use IS_ENABLED to detect when CONFIG_USB is enabled + as a module or static. Since CONFIG_MEDIA_CONTROLLER is a bool, leave + the check unchanged to be consistent with drivers/media/Makefile. + +2. Change the drivers/media/mc/Makefile to include mc-dev-allocator.o + in mc-objs when CONFIG_USB is enabled. + +Link: https://lore.kernel.org/alsa-devel/YLeAvT+R22FQ%2FEyw@mwanda/ + +Reported-by: Dan Carpenter +Signed-off-by: Shuah Khan +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/mc/Makefile | 2 +- + include/media/media-dev-allocator.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/mc/Makefile b/drivers/media/mc/Makefile +index 119037f0e686..2b7af42ba59c 100644 +--- a/drivers/media/mc/Makefile ++++ b/drivers/media/mc/Makefile +@@ -3,7 +3,7 @@ + mc-objs := mc-device.o mc-devnode.o mc-entity.o \ + mc-request.o + +-ifeq ($(CONFIG_USB),y) ++ifneq ($(CONFIG_USB),) + mc-objs += mc-dev-allocator.o + endif + +diff --git a/include/media/media-dev-allocator.h b/include/media/media-dev-allocator.h +index b35ea6062596..2ab54d426c64 100644 +--- a/include/media/media-dev-allocator.h ++++ b/include/media/media-dev-allocator.h +@@ -19,7 +19,7 @@ + + struct usb_device; + +-#if defined(CONFIG_MEDIA_CONTROLLER) && defined(CONFIG_USB) ++#if defined(CONFIG_MEDIA_CONTROLLER) && IS_ENABLED(CONFIG_USB) + /** + * media_device_usb_allocate() - Allocate and return struct &media device + * +-- +2.30.2 + diff --git a/queue-5.12/media-gspca-gl860-fix-zero-length-control-requests.patch b/queue-5.12/media-gspca-gl860-fix-zero-length-control-requests.patch new file mode 100644 index 00000000000..37eed788d0a --- /dev/null +++ b/queue-5.12/media-gspca-gl860-fix-zero-length-control-requests.patch @@ -0,0 +1,48 @@ +From 121c0648575a6fe34c056d4751bd3f22e0989a1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 13:09:18 +0200 +Subject: media: gspca/gl860: fix zero-length control requests + +From: Johan Hovold + +[ Upstream commit 8ed339f23d41e21660a389adf2e7b2966d457ff6 ] + +The direction of the pipe argument must match the request-type direction +bit or control requests may fail depending on the host-controller-driver +implementation. + +Control transfers without a data stage are treated as OUT requests by +the USB stack and should be using usb_sndctrlpipe(). Failing to do so +will now trigger a warning. + +Fix the gl860_RTx() helper so that zero-length control reads fail with +an error message instead. Note that there are no current callers that +would trigger this. + +Fixes: 4f7cb8837cec ("V4L/DVB (12954): gspca - gl860: Addition of GL860 based webcams") +Signed-off-by: Johan Hovold +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/gspca/gl860/gl860.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/gspca/gl860/gl860.c b/drivers/media/usb/gspca/gl860/gl860.c +index 2c05ea2598e7..ce4ee8bc75c8 100644 +--- a/drivers/media/usb/gspca/gl860/gl860.c ++++ b/drivers/media/usb/gspca/gl860/gl860.c +@@ -561,8 +561,8 @@ int gl860_RTx(struct gspca_dev *gspca_dev, + len, 400 + 200 * (len > 1)); + memcpy(pdata, gspca_dev->usb_buf, len); + } else { +- r = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), +- req, pref, val, index, NULL, len, 400); ++ gspca_err(gspca_dev, "zero-length read request\n"); ++ r = -EINVAL; + } + } + +-- +2.30.2 + diff --git a/queue-5.12/media-hantro-do-a-pm-resume-earlier.patch b/queue-5.12/media-hantro-do-a-pm-resume-earlier.patch new file mode 100644 index 00000000000..62d35362db4 --- /dev/null +++ b/queue-5.12/media-hantro-do-a-pm-resume-earlier.patch @@ -0,0 +1,99 @@ +From 218d502ffce95478a799b0979d0c39d68a1281e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 08:27:55 +0200 +Subject: media: hantro: do a PM resume earlier + +From: Mauro Carvalho Chehab + +[ Upstream commit 892bb6ecead9b834ba7ad1d07513e9eba1baa3a4 ] + +The device_run() first enables the clock and then +tries to resume PM runtime, checking for errors. + +Well, if for some reason the pm_runtime can not resume, +it would be better to detect it beforehand. + +So, change the order inside device_run(). + +Reviewed-by: Ezequiel Garcia +Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/hantro/hantro_drv.c | 33 +++++++++++++++-------- + 1 file changed, 22 insertions(+), 11 deletions(-) + +diff --git a/drivers/staging/media/hantro/hantro_drv.c b/drivers/staging/media/hantro/hantro_drv.c +index e5f200e64993..2d6e0056be62 100644 +--- a/drivers/staging/media/hantro/hantro_drv.c ++++ b/drivers/staging/media/hantro/hantro_drv.c +@@ -56,16 +56,12 @@ dma_addr_t hantro_get_ref(struct hantro_ctx *ctx, u64 ts) + return hantro_get_dec_buf_addr(ctx, buf); + } + +-static void hantro_job_finish(struct hantro_dev *vpu, +- struct hantro_ctx *ctx, +- enum vb2_buffer_state result) ++static void hantro_job_finish_no_pm(struct hantro_dev *vpu, ++ struct hantro_ctx *ctx, ++ enum vb2_buffer_state result) + { + struct vb2_v4l2_buffer *src, *dst; + +- pm_runtime_mark_last_busy(vpu->dev); +- pm_runtime_put_autosuspend(vpu->dev); +- clk_bulk_disable(vpu->variant->num_clocks, vpu->clocks); +- + src = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx); + dst = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx); + +@@ -81,6 +77,18 @@ static void hantro_job_finish(struct hantro_dev *vpu, + result); + } + ++static void hantro_job_finish(struct hantro_dev *vpu, ++ struct hantro_ctx *ctx, ++ enum vb2_buffer_state result) ++{ ++ pm_runtime_mark_last_busy(vpu->dev); ++ pm_runtime_put_autosuspend(vpu->dev); ++ ++ clk_bulk_disable(vpu->variant->num_clocks, vpu->clocks); ++ ++ hantro_job_finish_no_pm(vpu, ctx, result); ++} ++ + void hantro_irq_done(struct hantro_dev *vpu, + enum vb2_buffer_state result) + { +@@ -152,12 +160,15 @@ static void device_run(void *priv) + src = hantro_get_src_buf(ctx); + dst = hantro_get_dst_buf(ctx); + ++ ret = pm_runtime_get_sync(ctx->dev->dev); ++ if (ret < 0) { ++ pm_runtime_put_noidle(ctx->dev->dev); ++ goto err_cancel_job; ++ } ++ + ret = clk_bulk_enable(ctx->dev->variant->num_clocks, ctx->dev->clocks); + if (ret) + goto err_cancel_job; +- ret = pm_runtime_get_sync(ctx->dev->dev); +- if (ret < 0) +- goto err_cancel_job; + + v4l2_m2m_buf_copy_metadata(src, dst, true); + +@@ -165,7 +176,7 @@ static void device_run(void *priv) + return; + + err_cancel_job: +- hantro_job_finish(ctx->dev, ctx, VB2_BUF_STATE_ERROR); ++ hantro_job_finish_no_pm(ctx->dev, ctx, VB2_BUF_STATE_ERROR); + } + + static struct v4l2_m2m_ops vpu_m2m_ops = { +-- +2.30.2 + diff --git a/queue-5.12/media-hantro-fix-.buf_prepare.patch b/queue-5.12/media-hantro-fix-.buf_prepare.patch new file mode 100644 index 00000000000..e335abd9324 --- /dev/null +++ b/queue-5.12/media-hantro-fix-.buf_prepare.patch @@ -0,0 +1,48 @@ +From c30d46871e1ca712b31499015bb8724d1546c2f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 14:23:46 +0200 +Subject: media: hantro: Fix .buf_prepare + +From: Andrzej Pietrasiewicz + +[ Upstream commit 082aaecff35fbe1937531057911b1dd1fc6b496e ] + +The driver should only set the payload on .buf_prepare if the +buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused +set by userspace then v4l2-core will set it to buffer length. + +If we overwrite bytesused for OUTPUT buffers, too, then +vb2_get_plane_payload() will return incorrect value which might be then +written to hw registers by the driver in hantro_g1_h264_dec.c. + +Signed-off-by: Andrzej Pietrasiewicz +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/hantro/hantro_v4l2.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/hantro/hantro_v4l2.c b/drivers/staging/media/hantro/hantro_v4l2.c +index 1bc118e375a1..7ccc6405036a 100644 +--- a/drivers/staging/media/hantro/hantro_v4l2.c ++++ b/drivers/staging/media/hantro/hantro_v4l2.c +@@ -639,7 +639,14 @@ static int hantro_buf_prepare(struct vb2_buffer *vb) + ret = hantro_buf_plane_check(vb, pix_fmt); + if (ret) + return ret; +- vb2_set_plane_payload(vb, 0, pix_fmt->plane_fmt[0].sizeimage); ++ /* ++ * Buffer's bytesused must be written by driver for CAPTURE buffers. ++ * (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets ++ * it to buffer length). ++ */ ++ if (V4L2_TYPE_IS_CAPTURE(vq->type)) ++ vb2_set_plane_payload(vb, 0, pix_fmt->plane_fmt[0].sizeimage); ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.12/media-hevc-fix-dependent-slice-segment-flags.patch b/queue-5.12/media-hevc-fix-dependent-slice-segment-flags.patch new file mode 100644 index 00000000000..8f4f8258444 --- /dev/null +++ b/queue-5.12/media-hevc-fix-dependent-slice-segment-flags.patch @@ -0,0 +1,88 @@ +From 4f3b24a6ce0a5dd4cd616831cf9feaf1207ffcd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 09:15:54 +0200 +Subject: media: hevc: Fix dependent slice segment flags + +From: Jernej Skrabec + +[ Upstream commit 67a7e53d5b21f3a84efc03a4e62db7caf97841ef ] + +Dependent slice segment flag for PPS control is misnamed. It should have +"enabled" at the end. It only tells if this flag is present in slice +header or not and not the actual value. + +Fix this by renaming the PPS flag and introduce another flag for slice +control which tells actual value. + +Signed-off-by: Jernej Skrabec +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + Documentation/userspace-api/media/v4l/ext-ctrls-codec.rst | 5 ++++- + drivers/staging/media/sunxi/cedrus/cedrus_h265.c | 4 ++-- + include/media/hevc-ctrls.h | 3 ++- + 3 files changed, 8 insertions(+), 4 deletions(-) + +diff --git a/Documentation/userspace-api/media/v4l/ext-ctrls-codec.rst b/Documentation/userspace-api/media/v4l/ext-ctrls-codec.rst +index 00944e97d638..09f28ba60e6f 100644 +--- a/Documentation/userspace-api/media/v4l/ext-ctrls-codec.rst ++++ b/Documentation/userspace-api/media/v4l/ext-ctrls-codec.rst +@@ -3285,7 +3285,7 @@ enum v4l2_mpeg_video_hevc_size_of_length_field - + :stub-columns: 0 + :widths: 1 1 2 + +- * - ``V4L2_HEVC_PPS_FLAG_DEPENDENT_SLICE_SEGMENT`` ++ * - ``V4L2_HEVC_PPS_FLAG_DEPENDENT_SLICE_SEGMENT_ENABLED`` + - 0x00000001 + - + * - ``V4L2_HEVC_PPS_FLAG_OUTPUT_FLAG_PRESENT`` +@@ -3493,6 +3493,9 @@ enum v4l2_mpeg_video_hevc_size_of_length_field - + * - ``V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_LOOP_FILTER_ACROSS_SLICES_ENABLED`` + - 0x00000100 + - ++ * - ``V4L2_HEVC_SLICE_PARAMS_FLAG_DEPENDENT_SLICE_SEGMENT`` ++ - 0x00000200 ++ - + + .. c:type:: v4l2_hevc_dpb_entry + +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c +index ce497d0197df..10744fab7cea 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c +@@ -477,8 +477,8 @@ static void cedrus_h265_setup(struct cedrus_ctx *ctx, + slice_params->flags); + + reg |= VE_DEC_H265_FLAG(VE_DEC_H265_DEC_SLICE_HDR_INFO0_FLAG_DEPENDENT_SLICE_SEGMENT, +- V4L2_HEVC_PPS_FLAG_DEPENDENT_SLICE_SEGMENT, +- pps->flags); ++ V4L2_HEVC_SLICE_PARAMS_FLAG_DEPENDENT_SLICE_SEGMENT, ++ slice_params->flags); + + /* FIXME: For multi-slice support. */ + reg |= VE_DEC_H265_DEC_SLICE_HDR_INFO0_FLAG_FIRST_SLICE_SEGMENT_IN_PIC; +diff --git a/include/media/hevc-ctrls.h b/include/media/hevc-ctrls.h +index b4cb2ef02f17..226fcfa0e026 100644 +--- a/include/media/hevc-ctrls.h ++++ b/include/media/hevc-ctrls.h +@@ -81,7 +81,7 @@ struct v4l2_ctrl_hevc_sps { + __u64 flags; + }; + +-#define V4L2_HEVC_PPS_FLAG_DEPENDENT_SLICE_SEGMENT (1ULL << 0) ++#define V4L2_HEVC_PPS_FLAG_DEPENDENT_SLICE_SEGMENT_ENABLED (1ULL << 0) + #define V4L2_HEVC_PPS_FLAG_OUTPUT_FLAG_PRESENT (1ULL << 1) + #define V4L2_HEVC_PPS_FLAG_SIGN_DATA_HIDING_ENABLED (1ULL << 2) + #define V4L2_HEVC_PPS_FLAG_CABAC_INIT_PRESENT (1ULL << 3) +@@ -160,6 +160,7 @@ struct v4l2_hevc_pred_weight_table { + #define V4L2_HEVC_SLICE_PARAMS_FLAG_USE_INTEGER_MV (1ULL << 6) + #define V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_DEBLOCKING_FILTER_DISABLED (1ULL << 7) + #define V4L2_HEVC_SLICE_PARAMS_FLAG_SLICE_LOOP_FILTER_ACROSS_SLICES_ENABLED (1ULL << 8) ++#define V4L2_HEVC_SLICE_PARAMS_FLAG_DEPENDENT_SLICE_SEGMENT (1ULL << 9) + + struct v4l2_ctrl_hevc_slice_params { + __u32 bit_size; +-- +2.30.2 + diff --git a/queue-5.12/media-i2c-ccs-core-return-the-right-error-code-at-su.patch b/queue-5.12/media-i2c-ccs-core-return-the-right-error-code-at-su.patch new file mode 100644 index 00000000000..d3db8983a98 --- /dev/null +++ b/queue-5.12/media-i2c-ccs-core-return-the-right-error-code-at-su.patch @@ -0,0 +1,39 @@ +From 8918e97c87eb86a53733edd3089bea7856a9ad50 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 08:36:00 +0200 +Subject: media: i2c: ccs-core: return the right error code at suspend + +From: Mauro Carvalho Chehab + +[ Upstream commit 6005a8e955e4e451e4bf6000affaab566d4cab5e ] + +If pm_runtime resume logic fails, return the error code +provided by it, instead of -EAGAIN, as, depending on what +caused it to fail, it may not be something that would be +recovered. + +Fixes: cbba45d43631 ("[media] smiapp: Use runtime PM") +Reviewed-by: Jonathan Cameron +Acked-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ccs/ccs-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ccs/ccs-core.c b/drivers/media/i2c/ccs/ccs-core.c +index 4505594996bd..fde0c51f0406 100644 +--- a/drivers/media/i2c/ccs/ccs-core.c ++++ b/drivers/media/i2c/ccs/ccs-core.c +@@ -3093,7 +3093,7 @@ static int __maybe_unused ccs_suspend(struct device *dev) + if (rval < 0) { + pm_runtime_put_noidle(dev); + +- return -EAGAIN; ++ return rval; + } + + if (sensor->streaming) +-- +2.30.2 + diff --git a/queue-5.12/media-i2c-change-rst-to-rset-to-fix-multiple-build-e.patch b/queue-5.12/media-i2c-change-rst-to-rset-to-fix-multiple-build-e.patch new file mode 100644 index 00000000000..d2681bf63d5 --- /dev/null +++ b/queue-5.12/media-i2c-change-rst-to-rset-to-fix-multiple-build-e.patch @@ -0,0 +1,244 @@ +From ee1da84e699e807d65cb0d0dde83477353b69a79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Apr 2021 22:19:55 +0200 +Subject: media: I2C: change 'RST' to "RSET" to fix multiple build errors + +From: Randy Dunlap + +[ Upstream commit 8edcb5049ac29aa3c8acc5ef15dd4036543d747e ] + +The use of an enum named 'RST' conflicts with a #define macro +named 'RST' in arch/mips/include/asm/mach-rc32434/rb.h. + +The MIPS use of RST was there first (AFAICT), so change the +media/i2c/ uses of RST to be named 'RSET'. +'git grep -w RSET' does not report any naming conflicts with the +new name. + +This fixes multiple build errors: + +arch/mips/include/asm/mach-rc32434/rb.h:15:14: error: expected identifier before '(' token + 15 | #define RST (1 << 15) + | ^ +drivers/media/i2c/s5c73m3/s5c73m3.h:356:2: note: in expansion of macro 'RST' + 356 | RST, + | ^~~ + +../arch/mips/include/asm/mach-rc32434/rb.h:15:14: error: expected identifier before '(' token + 15 | #define RST (1 << 15) + | ^ +../drivers/media/i2c/s5k6aa.c:180:2: note: in expansion of macro 'RST' + 180 | RST, + | ^~~ + +../arch/mips/include/asm/mach-rc32434/rb.h:15:14: error: expected identifier before '(' token + 15 | #define RST (1 << 15) + | ^ +../drivers/media/i2c/s5k5baf.c:238:2: note: in expansion of macro 'RST' + 238 | RST, + | ^~~ + +and some others that I have trimmed. + +Fixes: cac47f1822fc ("[media] V4L: Add S5C73M3 camera driver") +Fixes: 8b99312b7214 ("[media] Add v4l2 subdev driver for S5K4ECGX sensor") +Fixes: 7d459937dc09 ("[media] Add driver for Samsung S5K5BAF camera sensor") +Fixes: bfa8dd3a0524 ("[media] v4l: Add v4l2 subdev driver for S5K6AAFX sensor") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Shawn Guo +Cc: Sascha Hauer +Cc: Pengutronix Kernel Team +Cc: Fabio Estevam +Cc: NXP Linux Team +Cc: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers) +Cc: Andrzej Hajda +Cc: Sylwester Nawrocki +Cc: Sangwook Lee +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/s5c73m3/s5c73m3-core.c | 6 +++--- + drivers/media/i2c/s5c73m3/s5c73m3.h | 2 +- + drivers/media/i2c/s5k4ecgx.c | 10 +++++----- + drivers/media/i2c/s5k5baf.c | 6 +++--- + drivers/media/i2c/s5k6aa.c | 10 +++++----- + 5 files changed, 17 insertions(+), 17 deletions(-) + +diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-core.c b/drivers/media/i2c/s5c73m3/s5c73m3-core.c +index 5b4c4a3547c9..71804a70bc6d 100644 +--- a/drivers/media/i2c/s5c73m3/s5c73m3-core.c ++++ b/drivers/media/i2c/s5c73m3/s5c73m3-core.c +@@ -1386,7 +1386,7 @@ static int __s5c73m3_power_on(struct s5c73m3 *state) + s5c73m3_gpio_deassert(state, STBY); + usleep_range(100, 200); + +- s5c73m3_gpio_deassert(state, RST); ++ s5c73m3_gpio_deassert(state, RSET); + usleep_range(50, 100); + + return 0; +@@ -1401,7 +1401,7 @@ static int __s5c73m3_power_off(struct s5c73m3 *state) + { + int i, ret; + +- if (s5c73m3_gpio_assert(state, RST)) ++ if (s5c73m3_gpio_assert(state, RSET)) + usleep_range(10, 50); + + if (s5c73m3_gpio_assert(state, STBY)) +@@ -1606,7 +1606,7 @@ static int s5c73m3_get_platform_data(struct s5c73m3 *state) + + state->mclk_frequency = pdata->mclk_frequency; + state->gpio[STBY] = pdata->gpio_stby; +- state->gpio[RST] = pdata->gpio_reset; ++ state->gpio[RSET] = pdata->gpio_reset; + return 0; + } + +diff --git a/drivers/media/i2c/s5c73m3/s5c73m3.h b/drivers/media/i2c/s5c73m3/s5c73m3.h +index ef7e85b34263..c3fcfdd3ea66 100644 +--- a/drivers/media/i2c/s5c73m3/s5c73m3.h ++++ b/drivers/media/i2c/s5c73m3/s5c73m3.h +@@ -353,7 +353,7 @@ struct s5c73m3_ctrls { + + enum s5c73m3_gpio_id { + STBY, +- RST, ++ RSET, + GPIO_NUM, + }; + +diff --git a/drivers/media/i2c/s5k4ecgx.c b/drivers/media/i2c/s5k4ecgx.c +index b2d53417badf..4e97309a67f4 100644 +--- a/drivers/media/i2c/s5k4ecgx.c ++++ b/drivers/media/i2c/s5k4ecgx.c +@@ -173,7 +173,7 @@ static const char * const s5k4ecgx_supply_names[] = { + + enum s5k4ecgx_gpio_id { + STBY, +- RST, ++ RSET, + GPIO_NUM, + }; + +@@ -476,7 +476,7 @@ static int __s5k4ecgx_power_on(struct s5k4ecgx *priv) + if (s5k4ecgx_gpio_set_value(priv, STBY, priv->gpio[STBY].level)) + usleep_range(30, 50); + +- if (s5k4ecgx_gpio_set_value(priv, RST, priv->gpio[RST].level)) ++ if (s5k4ecgx_gpio_set_value(priv, RSET, priv->gpio[RSET].level)) + usleep_range(30, 50); + + return 0; +@@ -484,7 +484,7 @@ static int __s5k4ecgx_power_on(struct s5k4ecgx *priv) + + static int __s5k4ecgx_power_off(struct s5k4ecgx *priv) + { +- if (s5k4ecgx_gpio_set_value(priv, RST, !priv->gpio[RST].level)) ++ if (s5k4ecgx_gpio_set_value(priv, RSET, !priv->gpio[RSET].level)) + usleep_range(30, 50); + + if (s5k4ecgx_gpio_set_value(priv, STBY, !priv->gpio[STBY].level)) +@@ -872,7 +872,7 @@ static int s5k4ecgx_config_gpios(struct s5k4ecgx *priv, + int ret; + + priv->gpio[STBY].gpio = -EINVAL; +- priv->gpio[RST].gpio = -EINVAL; ++ priv->gpio[RSET].gpio = -EINVAL; + + ret = s5k4ecgx_config_gpio(gpio->gpio, gpio->level, "S5K4ECGX_STBY"); + +@@ -891,7 +891,7 @@ static int s5k4ecgx_config_gpios(struct s5k4ecgx *priv, + s5k4ecgx_free_gpios(priv); + return ret; + } +- priv->gpio[RST] = *gpio; ++ priv->gpio[RSET] = *gpio; + if (gpio_is_valid(gpio->gpio)) + gpio_set_value(gpio->gpio, 0); + +diff --git a/drivers/media/i2c/s5k5baf.c b/drivers/media/i2c/s5k5baf.c +index ec6f22efe19a..ec65a8e084c6 100644 +--- a/drivers/media/i2c/s5k5baf.c ++++ b/drivers/media/i2c/s5k5baf.c +@@ -235,7 +235,7 @@ struct s5k5baf_gpio { + + enum s5k5baf_gpio_id { + STBY, +- RST, ++ RSET, + NUM_GPIOS, + }; + +@@ -969,7 +969,7 @@ static int s5k5baf_power_on(struct s5k5baf *state) + + s5k5baf_gpio_deassert(state, STBY); + usleep_range(50, 100); +- s5k5baf_gpio_deassert(state, RST); ++ s5k5baf_gpio_deassert(state, RSET); + return 0; + + err_reg_dis: +@@ -987,7 +987,7 @@ static int s5k5baf_power_off(struct s5k5baf *state) + state->apply_cfg = 0; + state->apply_crop = 0; + +- s5k5baf_gpio_assert(state, RST); ++ s5k5baf_gpio_assert(state, RSET); + s5k5baf_gpio_assert(state, STBY); + + if (!IS_ERR(state->clock)) +diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c +index 72439fae7968..6516e205e9a3 100644 +--- a/drivers/media/i2c/s5k6aa.c ++++ b/drivers/media/i2c/s5k6aa.c +@@ -177,7 +177,7 @@ static const char * const s5k6aa_supply_names[] = { + + enum s5k6aa_gpio_id { + STBY, +- RST, ++ RSET, + GPIO_NUM, + }; + +@@ -841,7 +841,7 @@ static int __s5k6aa_power_on(struct s5k6aa *s5k6aa) + ret = s5k6aa->s_power(1); + usleep_range(4000, 5000); + +- if (s5k6aa_gpio_deassert(s5k6aa, RST)) ++ if (s5k6aa_gpio_deassert(s5k6aa, RSET)) + msleep(20); + + return ret; +@@ -851,7 +851,7 @@ static int __s5k6aa_power_off(struct s5k6aa *s5k6aa) + { + int ret; + +- if (s5k6aa_gpio_assert(s5k6aa, RST)) ++ if (s5k6aa_gpio_assert(s5k6aa, RSET)) + usleep_range(100, 150); + + if (s5k6aa->s_power) { +@@ -1510,7 +1510,7 @@ static int s5k6aa_configure_gpios(struct s5k6aa *s5k6aa, + int ret; + + s5k6aa->gpio[STBY].gpio = -EINVAL; +- s5k6aa->gpio[RST].gpio = -EINVAL; ++ s5k6aa->gpio[RSET].gpio = -EINVAL; + + gpio = &pdata->gpio_stby; + if (gpio_is_valid(gpio->gpio)) { +@@ -1533,7 +1533,7 @@ static int s5k6aa_configure_gpios(struct s5k6aa *s5k6aa, + if (ret < 0) + return ret; + +- s5k6aa->gpio[RST] = *gpio; ++ s5k6aa->gpio[RSET] = *gpio; + } + + return 0; +-- +2.30.2 + diff --git a/queue-5.12/media-i2c-imx334-fix-the-pm-runtime-get-logic.patch b/queue-5.12/media-i2c-imx334-fix-the-pm-runtime-get-logic.patch new file mode 100644 index 00000000000..55750e21acf --- /dev/null +++ b/queue-5.12/media-i2c-imx334-fix-the-pm-runtime-get-logic.patch @@ -0,0 +1,60 @@ +From 7380a1326ffd1885d0364d565f57c505b72b49f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 17:19:13 +0200 +Subject: media: i2c: imx334: fix the pm runtime get logic + +From: Mauro Carvalho Chehab + +[ Upstream commit 62c90446868b439929cb04395f04a709a64ae04b ] + +The PM runtime get logic is currently broken, as it checks if +ret is zero instead of checking if it is an error code, +as reported by Dan Carpenter. + +While here, use the pm_runtime_resume_and_get() as added by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +added pm_runtime_resume_and_get() in order to automatically handle +dev->power.usage_count decrement on errors. As a bonus, such function +always return zero on success. + +It should also be noticed that a fail of pm_runtime_get_sync() would +potentially result in a spurious runtime_suspend(), instead of +using pm_runtime_put_noidle(). + +Reported-by: Dan Carpenter +Reviewed-by: Daniele Alessandrelli +Reviewed-by: Jonathan Cameron +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx334.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c +index ad530f0d338a..02d22907c75c 100644 +--- a/drivers/media/i2c/imx334.c ++++ b/drivers/media/i2c/imx334.c +@@ -717,9 +717,9 @@ static int imx334_set_stream(struct v4l2_subdev *sd, int enable) + } + + if (enable) { +- ret = pm_runtime_get_sync(imx334->dev); +- if (ret) +- goto error_power_off; ++ ret = pm_runtime_resume_and_get(imx334->dev); ++ if (ret < 0) ++ goto error_unlock; + + ret = imx334_start_streaming(imx334); + if (ret) +@@ -737,6 +737,7 @@ static int imx334_set_stream(struct v4l2_subdev *sd, int enable) + + error_power_off: + pm_runtime_put(imx334->dev); ++error_unlock: + mutex_unlock(&imx334->mutex); + + return ret; +-- +2.30.2 + diff --git a/queue-5.12/media-i2c-ov2659-use-clk_-prepare_enable-disable_unp.patch b/queue-5.12/media-i2c-ov2659-use-clk_-prepare_enable-disable_unp.patch new file mode 100644 index 00000000000..4d5ed7a94b5 --- /dev/null +++ b/queue-5.12/media-i2c-ov2659-use-clk_-prepare_enable-disable_unp.patch @@ -0,0 +1,106 @@ +From 247e5c7c16df860b516d3254b86235cc6a6e910b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 07:09:53 +0200 +Subject: media: i2c: ov2659: Use clk_{prepare_enable,disable_unprepare}() to + set xvclk on/off + +From: Dillon Min + +[ Upstream commit 24786ccd9c80fdb05494aa4d90fcb8f34295c193 ] + +On some platform(imx6q), xvclk might not switch on in advance, +also for power save purpose, xvclk should not be always on. +so, add clk_prepare_enable(), clk_disable_unprepare() in driver +side to set xvclk on/off at proper stage. + +Add following changes: +- add 'struct clk *clk;' in 'struct ov2659 {}' +- enable xvclk in ov2659_power_on() +- disable xvclk in ov2659_power_off() + +Signed-off-by: Dillon Min +Acked-by: Lad Prabhakar +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov2659.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/i2c/ov2659.c b/drivers/media/i2c/ov2659.c +index 42f64175a6df..fb78a1cedc03 100644 +--- a/drivers/media/i2c/ov2659.c ++++ b/drivers/media/i2c/ov2659.c +@@ -204,6 +204,7 @@ struct ov2659 { + struct i2c_client *client; + struct v4l2_ctrl_handler ctrls; + struct v4l2_ctrl *link_frequency; ++ struct clk *clk; + const struct ov2659_framesize *frame_size; + struct sensor_register *format_ctrl_regs; + struct ov2659_pll_ctrl pll; +@@ -1270,6 +1271,8 @@ static int ov2659_power_off(struct device *dev) + + gpiod_set_value(ov2659->pwdn_gpio, 1); + ++ clk_disable_unprepare(ov2659->clk); ++ + return 0; + } + +@@ -1278,9 +1281,17 @@ static int ov2659_power_on(struct device *dev) + struct i2c_client *client = to_i2c_client(dev); + struct v4l2_subdev *sd = i2c_get_clientdata(client); + struct ov2659 *ov2659 = to_ov2659(sd); ++ int ret; + + dev_dbg(&client->dev, "%s:\n", __func__); + ++ ret = clk_prepare_enable(ov2659->clk); ++ if (ret) { ++ dev_err(&client->dev, "%s: failed to enable clock\n", ++ __func__); ++ return ret; ++ } ++ + gpiod_set_value(ov2659->pwdn_gpio, 0); + + if (ov2659->resetb_gpio) { +@@ -1425,7 +1436,6 @@ static int ov2659_probe(struct i2c_client *client) + const struct ov2659_platform_data *pdata = ov2659_get_pdata(client); + struct v4l2_subdev *sd; + struct ov2659 *ov2659; +- struct clk *clk; + int ret; + + if (!pdata) { +@@ -1440,11 +1450,11 @@ static int ov2659_probe(struct i2c_client *client) + ov2659->pdata = pdata; + ov2659->client = client; + +- clk = devm_clk_get(&client->dev, "xvclk"); +- if (IS_ERR(clk)) +- return PTR_ERR(clk); ++ ov2659->clk = devm_clk_get(&client->dev, "xvclk"); ++ if (IS_ERR(ov2659->clk)) ++ return PTR_ERR(ov2659->clk); + +- ov2659->xvclk_frequency = clk_get_rate(clk); ++ ov2659->xvclk_frequency = clk_get_rate(ov2659->clk); + if (ov2659->xvclk_frequency < 6000000 || + ov2659->xvclk_frequency > 27000000) + return -EINVAL; +@@ -1506,7 +1516,9 @@ static int ov2659_probe(struct i2c_client *client) + ov2659->frame_size = &ov2659_framesizes[2]; + ov2659->format_ctrl_regs = ov2659_formats[0].format_ctrl_regs; + +- ov2659_power_on(&client->dev); ++ ret = ov2659_power_on(&client->dev); ++ if (ret < 0) ++ goto error; + + ret = ov2659_detect(sd); + if (ret < 0) +-- +2.30.2 + diff --git a/queue-5.12/media-i2c-rdacm21-fix-ov10640-powerup.patch b/queue-5.12/media-i2c-rdacm21-fix-ov10640-powerup.patch new file mode 100644 index 00000000000..9323a8d21d9 --- /dev/null +++ b/queue-5.12/media-i2c-rdacm21-fix-ov10640-powerup.patch @@ -0,0 +1,69 @@ +From 0b1cbe2eec7b33cf52b58761ba6f3f55add3e868 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 14:46:10 +0200 +Subject: media: i2c: rdacm21: Fix OV10640 powerup + +From: Jacopo Mondi + +[ Upstream commit ff75332b260cd33cc19000fdb5d256d9db4470d1 ] + +The OV10640 image sensor powerdown signal is controlled by the first +line of the OV490 GPIO pad #1, but the pad #0 identifier +OV490_GPIO_OUTPUT_VALUE0 was erroneously used. As a result the image +sensor powerdown signal was never asserted but was left floating and +kept high by an internal pull-up resistor, causing sporadic failures +during the image sensor startup phase. + +Fix this by using the correct GPIO pad identifier and wait the mandatory +1.5 millisecond delay after the powerup lane is asserted. The reset +delay is not characterized in the chip manual if not as "255 XVCLK + +initialization". Wait for at least 3 milliseconds to guarantee the SCCB +bus is available. + +While at it also fix the reset sequence, as the reset line was released +before the powerdown one, and the line was not cycled. + +This commit fixes a sporadic start-up error triggered by a failure to +read the OV10640 chip ID: +rdacm21 8-0054: OV10640 ID mismatch: (0x01) + +Fixes: a59f853b3b4b ("media: i2c: Add driver for RDACM21 camera module") +Signed-off-by: Jacopo Mondi +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rdacm21.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/rdacm21.c b/drivers/media/i2c/rdacm21.c +index 179d107f494c..4b0dfd0a75e1 100644 +--- a/drivers/media/i2c/rdacm21.c ++++ b/drivers/media/i2c/rdacm21.c +@@ -333,13 +333,19 @@ static int ov10640_initialize(struct rdacm21_device *dev) + { + u8 val; + +- /* Power-up OV10640 by setting RESETB and PWDNB pins high. */ ++ /* Enable GPIO0#0 (reset) and GPIO1#0 (pwdn) as output lines. */ + ov490_write_reg(dev, OV490_GPIO_SEL0, OV490_GPIO0); + ov490_write_reg(dev, OV490_GPIO_SEL1, OV490_SPWDN0); + ov490_write_reg(dev, OV490_GPIO_DIRECTION0, OV490_GPIO0); + ov490_write_reg(dev, OV490_GPIO_DIRECTION1, OV490_SPWDN0); ++ ++ /* Power up OV10640 and then reset it. */ ++ ov490_write_reg(dev, OV490_GPIO_OUTPUT_VALUE1, OV490_SPWDN0); ++ usleep_range(1500, 3000); ++ ++ ov490_write_reg(dev, OV490_GPIO_OUTPUT_VALUE0, 0x00); ++ usleep_range(1500, 3000); + ov490_write_reg(dev, OV490_GPIO_OUTPUT_VALUE0, OV490_GPIO0); +- ov490_write_reg(dev, OV490_GPIO_OUTPUT_VALUE0, OV490_SPWDN0); + usleep_range(3000, 5000); + + /* Read OV10640 ID to test communications. */ +-- +2.30.2 + diff --git a/queue-5.12/media-i2c-rdacm21-power-up-ov10640-before-ov490.patch b/queue-5.12/media-i2c-rdacm21-power-up-ov10640-before-ov490.patch new file mode 100644 index 00000000000..94a55d5e305 --- /dev/null +++ b/queue-5.12/media-i2c-rdacm21-power-up-ov10640-before-ov490.patch @@ -0,0 +1,137 @@ +From 321483748722bfc486a86366fae787ccec994b39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 14:46:11 +0200 +Subject: media: i2c: rdacm21: Power up OV10640 before OV490 + +From: Jacopo Mondi + +[ Upstream commit 2b821698dc73c00719e3dc367db712f727bbda85 ] + +The current RDACM21 initialization routine powers up the OV10640 image +sensor after the OV490 ISP. The ISP is programmed with a firmware loaded +from an embedded serial flash that (most probably) tries to interact and +program also the image sensor connected to the ISP. + +As described in commit "media: i2c: rdacm21: Fix OV10640 powerup" the +image sensor powerdown signal is kept high by an internal pull up +resistor and occasionally fails to startup correctly if the powerdown +line is not asserted explicitly. Failures in the OV10640 startup causes +the OV490 firmware to fail to boot correctly resulting in the camera +module initialization to fail consequentially. + +Fix this by powering up the OV10640 image sensor before testing the +OV490 firmware boot completion, by splitting the ov10640_initialize() +function in an ov10640_power_up() one and an ov10640_check_id() one. + +Also make sure the OV10640 identification procedure gives enough time to +the image sensor to resume after the programming phase performed by the +OV490 firmware by repeating the ID read procedure. + +This commit fixes a sporadic start-up error triggered by a failure to +detect the OV490 firmware boot completion: +rdacm21 8-0054: Timeout waiting for firmware boot + +[hverkuil: fixed two typos in commit log] + +Fixes: a59f853b3b4b ("media: i2c: Add driver for RDACM21 camera module") +Signed-off-by: Jacopo Mondi +Reviewed-by: Laurent Pinchart +Reviewed-by: Kieran Bingham +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/rdacm21.c | 46 ++++++++++++++++++++++++++----------- + 1 file changed, 32 insertions(+), 14 deletions(-) + +diff --git a/drivers/media/i2c/rdacm21.c b/drivers/media/i2c/rdacm21.c +index 4b0dfd0a75e1..50e2af522760 100644 +--- a/drivers/media/i2c/rdacm21.c ++++ b/drivers/media/i2c/rdacm21.c +@@ -69,6 +69,7 @@ + #define OV490_ISP_VSIZE_LOW 0x80820062 + #define OV490_ISP_VSIZE_HIGH 0x80820063 + ++#define OV10640_PID_TIMEOUT 20 + #define OV10640_ID_HIGH 0xa6 + #define OV10640_CHIP_ID 0x300a + #define OV10640_PIXEL_RATE 55000000 +@@ -329,10 +330,8 @@ static const struct v4l2_subdev_ops rdacm21_subdev_ops = { + .pad = &rdacm21_subdev_pad_ops, + }; + +-static int ov10640_initialize(struct rdacm21_device *dev) ++static void ov10640_power_up(struct rdacm21_device *dev) + { +- u8 val; +- + /* Enable GPIO0#0 (reset) and GPIO1#0 (pwdn) as output lines. */ + ov490_write_reg(dev, OV490_GPIO_SEL0, OV490_GPIO0); + ov490_write_reg(dev, OV490_GPIO_SEL1, OV490_SPWDN0); +@@ -347,18 +346,35 @@ static int ov10640_initialize(struct rdacm21_device *dev) + usleep_range(1500, 3000); + ov490_write_reg(dev, OV490_GPIO_OUTPUT_VALUE0, OV490_GPIO0); + usleep_range(3000, 5000); ++} + +- /* Read OV10640 ID to test communications. */ +- ov490_write_reg(dev, OV490_SCCB_SLAVE0_DIR, OV490_SCCB_SLAVE_READ); +- ov490_write_reg(dev, OV490_SCCB_SLAVE0_ADDR_HIGH, OV10640_CHIP_ID >> 8); +- ov490_write_reg(dev, OV490_SCCB_SLAVE0_ADDR_LOW, OV10640_CHIP_ID & 0xff); +- +- /* Trigger SCCB slave transaction and give it some time to complete. */ +- ov490_write_reg(dev, OV490_HOST_CMD, OV490_HOST_CMD_TRIGGER); +- usleep_range(1000, 1500); ++static int ov10640_check_id(struct rdacm21_device *dev) ++{ ++ unsigned int i; ++ u8 val; + +- ov490_read_reg(dev, OV490_SCCB_SLAVE0_DIR, &val); +- if (val != OV10640_ID_HIGH) { ++ /* Read OV10640 ID to test communications. */ ++ for (i = 0; i < OV10640_PID_TIMEOUT; ++i) { ++ ov490_write_reg(dev, OV490_SCCB_SLAVE0_DIR, ++ OV490_SCCB_SLAVE_READ); ++ ov490_write_reg(dev, OV490_SCCB_SLAVE0_ADDR_HIGH, ++ OV10640_CHIP_ID >> 8); ++ ov490_write_reg(dev, OV490_SCCB_SLAVE0_ADDR_LOW, ++ OV10640_CHIP_ID & 0xff); ++ ++ /* ++ * Trigger SCCB slave transaction and give it some time ++ * to complete. ++ */ ++ ov490_write_reg(dev, OV490_HOST_CMD, OV490_HOST_CMD_TRIGGER); ++ usleep_range(1000, 1500); ++ ++ ov490_read_reg(dev, OV490_SCCB_SLAVE0_DIR, &val); ++ if (val == OV10640_ID_HIGH) ++ break; ++ usleep_range(1000, 1500); ++ } ++ if (i == OV10640_PID_TIMEOUT) { + dev_err(dev->dev, "OV10640 ID mismatch: (0x%02x)\n", val); + return -ENODEV; + } +@@ -374,6 +390,8 @@ static int ov490_initialize(struct rdacm21_device *dev) + unsigned int i; + int ret; + ++ ov10640_power_up(dev); ++ + /* + * Read OV490 Id to test communications. Give it up to 40msec to + * exit from reset. +@@ -411,7 +429,7 @@ static int ov490_initialize(struct rdacm21_device *dev) + return -ENODEV; + } + +- ret = ov10640_initialize(dev); ++ ret = ov10640_check_id(dev); + if (ret) + return ret; + +-- +2.30.2 + diff --git a/queue-5.12/media-imx-csi-skip-first-few-frames-from-a-bt.656-so.patch b/queue-5.12/media-imx-csi-skip-first-few-frames-from-a-bt.656-so.patch new file mode 100644 index 00000000000..0f4e580d26e --- /dev/null +++ b/queue-5.12/media-imx-csi-skip-first-few-frames-from-a-bt.656-so.patch @@ -0,0 +1,63 @@ +From 15de2c15ab284b5eaab2e830e060001e0db37835 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:29:23 +0200 +Subject: media: imx-csi: Skip first few frames from a BT.656 source + +From: Steve Longerbeam + +[ Upstream commit e198be37e52551bb863d07d2edc535d0932a3c4f ] + +Some BT.656 sensors (e.g. ADV718x) transmit frames with unstable BT.656 +sync codes after initial power on. This confuses the imx CSI,resulting +in vertical and/or horizontal sync issues. Skip the first 20 frames +to avoid the unstable sync codes. + +[fabio: fixed checkpatch warning and increased the frame skipping to 20] + +Signed-off-by: Steve Longerbeam +Signed-off-by: Fabio Estevam +Reviewed-by: Tim Harvey +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/imx/imx-media-csi.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/imx/imx-media-csi.c b/drivers/staging/media/imx/imx-media-csi.c +index ef5add079774..7f4b967646d9 100644 +--- a/drivers/staging/media/imx/imx-media-csi.c ++++ b/drivers/staging/media/imx/imx-media-csi.c +@@ -753,9 +753,10 @@ static int csi_setup(struct csi_priv *priv) + + static int csi_start(struct csi_priv *priv) + { +- struct v4l2_fract *output_fi; ++ struct v4l2_fract *input_fi, *output_fi; + int ret; + ++ input_fi = &priv->frame_interval[CSI_SINK_PAD]; + output_fi = &priv->frame_interval[priv->active_output_pad]; + + /* start upstream */ +@@ -764,6 +765,17 @@ static int csi_start(struct csi_priv *priv) + if (ret) + return ret; + ++ /* Skip first few frames from a BT.656 source */ ++ if (priv->upstream_ep.bus_type == V4L2_MBUS_BT656) { ++ u32 delay_usec, bad_frames = 20; ++ ++ delay_usec = DIV_ROUND_UP_ULL((u64)USEC_PER_SEC * ++ input_fi->numerator * bad_frames, ++ input_fi->denominator); ++ ++ usleep_range(delay_usec, delay_usec + 1000); ++ } ++ + if (priv->dest == IPU_CSI_DEST_IDMAC) { + ret = csi_idmac_start(priv); + if (ret) +-- +2.30.2 + diff --git a/queue-5.12/media-imx-imx7_mipi_csis-fix-logging-of-only-error-e.patch b/queue-5.12/media-imx-imx7_mipi_csis-fix-logging-of-only-error-e.patch new file mode 100644 index 00000000000..33c68b73c30 --- /dev/null +++ b/queue-5.12/media-imx-imx7_mipi_csis-fix-logging-of-only-error-e.patch @@ -0,0 +1,48 @@ +From d537953c1971186de6ee5c37965e613b8134f8cb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Apr 2021 04:29:52 +0200 +Subject: media: imx: imx7_mipi_csis: Fix logging of only error event counters + +From: Laurent Pinchart + +[ Upstream commit d2fcc9c2de1191ea80366e3658711753738dd10a ] + +The mipi_csis_events array ends with 6 non-error events, not 4. Update +mipi_csis_log_counters() accordingly. While at it, log event counters in +forward order, as there's no reason to log them backward. + +Signed-off-by: Laurent Pinchart +Acked-by: Rui Miguel Silva +Reviewed-by: Frieder Schrempf +Tested-by: Frieder Schrempf +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/imx/imx7-mipi-csis.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/imx/imx7-mipi-csis.c b/drivers/staging/media/imx/imx7-mipi-csis.c +index a01a7364b4b9..b365790256e4 100644 +--- a/drivers/staging/media/imx/imx7-mipi-csis.c ++++ b/drivers/staging/media/imx/imx7-mipi-csis.c +@@ -597,13 +597,15 @@ static void mipi_csis_clear_counters(struct csi_state *state) + + static void mipi_csis_log_counters(struct csi_state *state, bool non_errors) + { +- int i = non_errors ? MIPI_CSIS_NUM_EVENTS : MIPI_CSIS_NUM_EVENTS - 4; ++ unsigned int num_events = non_errors ? MIPI_CSIS_NUM_EVENTS ++ : MIPI_CSIS_NUM_EVENTS - 6; + struct device *dev = &state->pdev->dev; + unsigned long flags; ++ unsigned int i; + + spin_lock_irqsave(&state->slock, flags); + +- for (i--; i >= 0; i--) { ++ for (i = 0; i < num_events; ++i) { + if (state->events[i].counter > 0 || state->debug) + dev_info(dev, "%s events: %d\n", state->events[i].name, + state->events[i].counter); +-- +2.30.2 + diff --git a/queue-5.12/media-ipu3-cio2-fix-reference-counting-when-looping-.patch b/queue-5.12/media-ipu3-cio2-fix-reference-counting-when-looping-.patch new file mode 100644 index 00000000000..2eae9ea271d --- /dev/null +++ b/queue-5.12/media-ipu3-cio2-fix-reference-counting-when-looping-.patch @@ -0,0 +1,60 @@ +From ab7502c8e79aa6557aeab693cf477edf17639e64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Apr 2021 20:14:09 +0200 +Subject: media: ipu3-cio2: Fix reference counting when looping over ACPI + devices + +From: Andy Shevchenko + +[ Upstream commit 2cb2705cf7ffe41dc5bd81290e4241bfb7f031cc ] + +When we continue, due to device is disabled, loop we have to drop +reference count. When we have an array full of devices we have to also +drop the reference count. Note, in this case the +cio2_bridge_unregister_sensors() is called by the caller. + +Fixes: 803abec64ef9 ("media: ipu3-cio2: Add cio2-bridge to ipu3-cio2 driver") +Signed-off-by: Andy Shevchenko +Reviewed-by: Daniel Scally +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/intel/ipu3/cio2-bridge.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/pci/intel/ipu3/cio2-bridge.c b/drivers/media/pci/intel/ipu3/cio2-bridge.c +index c2199042d3db..85f8b587405e 100644 +--- a/drivers/media/pci/intel/ipu3/cio2-bridge.c ++++ b/drivers/media/pci/intel/ipu3/cio2-bridge.c +@@ -173,14 +173,15 @@ static int cio2_bridge_connect_sensor(const struct cio2_sensor_config *cfg, + int ret; + + for_each_acpi_dev_match(adev, cfg->hid, NULL, -1) { +- if (!adev->status.enabled) ++ if (!adev->status.enabled) { ++ acpi_dev_put(adev); + continue; ++ } + + if (bridge->n_sensors >= CIO2_NUM_PORTS) { ++ acpi_dev_put(adev); + dev_err(&cio2->dev, "Exceeded available CIO2 ports\n"); +- cio2_bridge_unregister_sensors(bridge); +- ret = -EINVAL; +- goto err_out; ++ return -EINVAL; + } + + sensor = &bridge->sensors[bridge->n_sensors]; +@@ -228,7 +229,6 @@ err_free_swnodes: + software_node_unregister_nodes(sensor->swnodes); + err_put_adev: + acpi_dev_put(sensor->adev); +-err_out: + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.12/media-marvel-ccic-fix-some-issues-when-getting-pm_ru.patch b/queue-5.12/media-marvel-ccic-fix-some-issues-when-getting-pm_ru.patch new file mode 100644 index 00000000000..c7efa91832b --- /dev/null +++ b/queue-5.12/media-marvel-ccic-fix-some-issues-when-getting-pm_ru.patch @@ -0,0 +1,60 @@ +From 0b6cf51636305342baf4d2a66291cf1af9d3e80a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 16:54:25 +0200 +Subject: media: marvel-ccic: fix some issues when getting pm_runtime + +From: Mauro Carvalho Chehab + +[ Upstream commit e7c617cab7a522fba5b20f9033ee98565b6f3546 ] + +Calling pm_runtime_get_sync() is bad, since even when it +returns an error, pm_runtime_put*() should be called. +So, use instead pm_runtime_resume_and_get(). + +While here, ensure that the error condition will be checked +during clock enable an media open() calls. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/marvell-ccic/mcam-core.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/marvell-ccic/mcam-core.c b/drivers/media/platform/marvell-ccic/mcam-core.c +index 141bf5d97a04..ea87110d9073 100644 +--- a/drivers/media/platform/marvell-ccic/mcam-core.c ++++ b/drivers/media/platform/marvell-ccic/mcam-core.c +@@ -918,6 +918,7 @@ static int mclk_enable(struct clk_hw *hw) + struct mcam_camera *cam = container_of(hw, struct mcam_camera, mclk_hw); + int mclk_src; + int mclk_div; ++ int ret; + + /* + * Clock the sensor appropriately. Controller clock should +@@ -931,7 +932,9 @@ static int mclk_enable(struct clk_hw *hw) + mclk_div = 2; + } + +- pm_runtime_get_sync(cam->dev); ++ ret = pm_runtime_resume_and_get(cam->dev); ++ if (ret < 0) ++ return ret; + clk_enable(cam->clk[0]); + mcam_reg_write(cam, REG_CLKCTRL, (mclk_src << 29) | mclk_div); + mcam_ctlr_power_up(cam); +@@ -1611,7 +1614,9 @@ static int mcam_v4l_open(struct file *filp) + ret = sensor_call(cam, core, s_power, 1); + if (ret) + goto out; +- pm_runtime_get_sync(cam->dev); ++ ret = pm_runtime_resume_and_get(cam->dev); ++ if (ret < 0) ++ goto out; + __mcam_cam_reset(cam); + mcam_set_config_needed(cam, 1); + } +-- +2.30.2 + diff --git a/queue-5.12/media-mdk-mdp-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.12/media-mdk-mdp-fix-pm_runtime_get_sync-usage-count.patch new file mode 100644 index 00000000000..33beddc03e3 --- /dev/null +++ b/queue-5.12/media-mdk-mdp-fix-pm_runtime_get_sync-usage-count.patch @@ -0,0 +1,50 @@ +From 602fdd9655b5db92430723319ae9f843dde64756 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 16:57:16 +0200 +Subject: media: mdk-mdp: fix pm_runtime_get_sync() usage count + +From: Mauro Carvalho Chehab + +[ Upstream commit d07bb9702cf5f5ccf3fb661e6cab54bbc33cd23f ] + +The pm_runtime_get_sync() internally increments the +dev->power.usage_count without decrementing it, even on errors. +Replace it by the new pm_runtime_resume_and_get(), introduced by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +in order to properly decrement the usage counter, avoiding +a potential PM usage counter leak. + +While here, fix the return contition of mtk_mdp_m2m_start_streaming(), +as it doesn't make any sense to return 0 if the PM runtime failed +to resume. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-mdp/mtk_mdp_m2m.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/mtk-mdp/mtk_mdp_m2m.c b/drivers/media/platform/mtk-mdp/mtk_mdp_m2m.c +index ace4528cdc5e..f14779e7596e 100644 +--- a/drivers/media/platform/mtk-mdp/mtk_mdp_m2m.c ++++ b/drivers/media/platform/mtk-mdp/mtk_mdp_m2m.c +@@ -391,12 +391,12 @@ static int mtk_mdp_m2m_start_streaming(struct vb2_queue *q, unsigned int count) + struct mtk_mdp_ctx *ctx = q->drv_priv; + int ret; + +- ret = pm_runtime_get_sync(&ctx->mdp_dev->pdev->dev); ++ ret = pm_runtime_resume_and_get(&ctx->mdp_dev->pdev->dev); + if (ret < 0) +- mtk_mdp_dbg(1, "[%d] pm_runtime_get_sync failed:%d", ++ mtk_mdp_dbg(1, "[%d] pm_runtime_resume_and_get failed:%d", + ctx->id, ret); + +- return 0; ++ return ret; + } + + static void *mtk_mdp_m2m_buf_remove(struct mtk_mdp_ctx *ctx, +-- +2.30.2 + diff --git a/queue-5.12/media-mtk-vcodec-fix-pm-runtime-get-logic.patch b/queue-5.12/media-mtk-vcodec-fix-pm-runtime-get-logic.patch new file mode 100644 index 00000000000..5226d309325 --- /dev/null +++ b/queue-5.12/media-mtk-vcodec-fix-pm-runtime-get-logic.patch @@ -0,0 +1,86 @@ +From d7b711ed360c2a581b679667dc23cc5a45057ec8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 17:19:09 +0200 +Subject: media: mtk-vcodec: fix PM runtime get logic + +From: Mauro Carvalho Chehab + +[ Upstream commit 908711f542c17fe61e5d653da1beb8e5ab5c7b50 ] + +Currently, the driver just assumes that PM runtime logic +succeded resuming the device. + +That may not be the case, as pm_runtime_get_sync() +can fail (but keeping the usage count incremented). + +Replace the code to use pm_runtime_resume_and_get(), +and letting it return the error code. + +This way, if mtk_vcodec_dec_pw_on() fails, the logic +under fops_vcodec_open() will do the right thing and +return an error, instead of just assuming that the +device is ready to be used. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_drv.c | 4 +++- + drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 8 +++++--- + drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.h | 2 +- + 3 files changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_drv.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_drv.c +index 147dfef1638d..f87dc47d9e63 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_drv.c ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_drv.c +@@ -126,7 +126,9 @@ static int fops_vcodec_open(struct file *file) + mtk_vcodec_dec_set_default_params(ctx); + + if (v4l2_fh_is_singular(&ctx->fh)) { +- mtk_vcodec_dec_pw_on(&dev->pm); ++ ret = mtk_vcodec_dec_pw_on(&dev->pm); ++ if (ret < 0) ++ goto err_load_fw; + /* + * Does nothing if firmware was already loaded. + */ +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c +index ddee7046ce42..6038db96f71c 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c +@@ -88,13 +88,15 @@ void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev) + put_device(dev->pm.larbvdec); + } + +-void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm) ++int mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm) + { + int ret; + +- ret = pm_runtime_get_sync(pm->dev); ++ ret = pm_runtime_resume_and_get(pm->dev); + if (ret) +- mtk_v4l2_err("pm_runtime_get_sync fail %d", ret); ++ mtk_v4l2_err("pm_runtime_resume_and_get fail %d", ret); ++ ++ return ret; + } + + void mtk_vcodec_dec_pw_off(struct mtk_vcodec_pm *pm) +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.h b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.h +index 872d8bf8cfaf..280aeaefdb65 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.h ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.h +@@ -12,7 +12,7 @@ + int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *dev); + void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev); + +-void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm); ++int mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm); + void mtk_vcodec_dec_pw_off(struct mtk_vcodec_pm *pm); + void mtk_vcodec_dec_clock_on(struct mtk_vcodec_pm *pm); + void mtk_vcodec_dec_clock_off(struct mtk_vcodec_pm *pm); +-- +2.30.2 + diff --git a/queue-5.12/media-mtk-vpu-on-suspend-read-write-regs-only-if-vpu.patch b/queue-5.12/media-mtk-vpu-on-suspend-read-write-regs-only-if-vpu.patch new file mode 100644 index 00000000000..fcd0b3b401c --- /dev/null +++ b/queue-5.12/media-mtk-vpu-on-suspend-read-write-regs-only-if-vpu.patch @@ -0,0 +1,58 @@ +From 52a81538edd2cf68bdaf37b914ed726407850412 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 19:27:45 +0200 +Subject: media: mtk-vpu: on suspend, read/write regs only if vpu is running + +From: Dafna Hirschfeld + +[ Upstream commit 11420749c6b4b237361750de3d5b5579175f8622 ] + +If the vpu is not running, we should not rely on VPU_IDLE_REG +value. In this case, the suspend cb should only unprepare the +clock. This fixes a system-wide suspend to ram failure: + +[ 273.073363] PM: suspend entry (deep) +[ 273.410502] mtk-msdc 11230000.mmc: phase: [map:ffffffff] [maxlen:32] [final:10] +[ 273.455926] Filesystems sync: 0.378 seconds +[ 273.589707] Freezing user space processes ... (elapsed 0.003 seconds) done. +[ 273.600104] OOM killer disabled. +[ 273.603409] Freezing remaining freezable tasks ... (elapsed 0.001 seconds) done. +[ 273.613361] mwifiex_sdio mmc2:0001:1: None of the WOWLAN triggers enabled +[ 274.784952] mtk_vpu 10020000.vpu: vpu idle timeout +[ 274.789764] PM: dpm_run_callback(): platform_pm_suspend+0x0/0x70 returns -5 +[ 274.796740] mtk_vpu 10020000.vpu: PM: failed to suspend: error -5 +[ 274.802842] PM: Some devices failed to suspend, or early wake event detected +[ 275.426489] OOM killer enabled. +[ 275.429718] Restarting tasks ... +[ 275.435765] done. +[ 275.447510] PM: suspend exit + +Fixes: 1f565e263c3e ("media: mtk-vpu: VPU should be in idle state before system is suspended") +Signed-off-by: Dafna Hirschfeld +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-vpu/mtk_vpu.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/media/platform/mtk-vpu/mtk_vpu.c b/drivers/media/platform/mtk-vpu/mtk_vpu.c +index 043894f7188c..f49f6d53a941 100644 +--- a/drivers/media/platform/mtk-vpu/mtk_vpu.c ++++ b/drivers/media/platform/mtk-vpu/mtk_vpu.c +@@ -987,6 +987,12 @@ static int mtk_vpu_suspend(struct device *dev) + return ret; + } + ++ if (!vpu_running(vpu)) { ++ vpu_clock_disable(vpu); ++ clk_unprepare(vpu->clk); ++ return 0; ++ } ++ + mutex_lock(&vpu->vpu_mutex); + /* disable vpu timer interrupt */ + vpu_cfg_writel(vpu, vpu_cfg_readl(vpu, VPU_INT_STATUS) | VPU_IDLE_STATE, +-- +2.30.2 + diff --git a/queue-5.12/media-pvrusb2-fix-warning-in-pvr2_i2c_core_done.patch b/queue-5.12/media-pvrusb2-fix-warning-in-pvr2_i2c_core_done.patch new file mode 100644 index 00000000000..29a144996fc --- /dev/null +++ b/queue-5.12/media-pvrusb2-fix-warning-in-pvr2_i2c_core_done.patch @@ -0,0 +1,60 @@ +From 3bcbf762f5dbf4166302cab354aa489722f89558 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 19:08:58 +0200 +Subject: media: pvrusb2: fix warning in pvr2_i2c_core_done + +From: Anirudh Rayabharam + +[ Upstream commit f8194e5e63fdcb349e8da9eef9e574d5b1d687cb ] + +syzbot has reported the following warning in pvr2_i2c_done: + + sysfs group 'power' not found for kobject '1-0043' + +When the device is disconnected (pvr_hdw_disconnect), the i2c adapter is +not unregistered along with the USB and v4l2 teardown. As part of the USB +device disconnect, the sysfs files of the subdevices are also deleted. +So, by the time pvr_i2c_core_done is called by pvr_context_destroy, the +sysfs files have been deleted. + +To fix this, unregister the i2c adapter too in pvr_hdw_disconnect. Make +the device deregistration code shared by calling pvr_hdw_disconnect from +pvr2_hdw_destroy. + +Reported-by: syzbot+e74a998ca8f1df9cc332@syzkaller.appspotmail.com +Tested-by: syzbot+e74a998ca8f1df9cc332@syzkaller.appspotmail.com +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Anirudh Rayabharam +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +index f4a727918e35..d38dee1792e4 100644 +--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c ++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c +@@ -2676,9 +2676,8 @@ void pvr2_hdw_destroy(struct pvr2_hdw *hdw) + pvr2_stream_destroy(hdw->vid_stream); + hdw->vid_stream = NULL; + } +- pvr2_i2c_core_done(hdw); + v4l2_device_unregister(&hdw->v4l2_dev); +- pvr2_hdw_remove_usb_stuff(hdw); ++ pvr2_hdw_disconnect(hdw); + mutex_lock(&pvr2_unit_mtx); + do { + if ((hdw->unit_number >= 0) && +@@ -2705,6 +2704,7 @@ void pvr2_hdw_disconnect(struct pvr2_hdw *hdw) + { + pvr2_trace(PVR2_TRACE_INIT,"pvr2_hdw_disconnect(hdw=%p)",hdw); + LOCK_TAKE(hdw->big_lock); ++ pvr2_i2c_core_done(hdw); + LOCK_TAKE(hdw->ctl_lock); + pvr2_hdw_remove_usb_stuff(hdw); + LOCK_GIVE(hdw->ctl_lock); +-- +2.30.2 + diff --git a/queue-5.12/media-rc-i2c-fix-an-error-message.patch b/queue-5.12/media-rc-i2c-fix-an-error-message.patch new file mode 100644 index 00000000000..33bfaf1b568 --- /dev/null +++ b/queue-5.12/media-rc-i2c-fix-an-error-message.patch @@ -0,0 +1,40 @@ +From 64f73401c64f30079a818c2fc7be65ecc93cc1c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 May 2021 07:38:56 +0200 +Subject: media: rc: i2c: Fix an error message + +From: Christophe JAILLET + +[ Upstream commit 9c87ae1a0dbeb5794957421157fd266d38a869b4 ] + +'ret' is known to be 1 here. In fact 'i' is expected instead. +Store the return value of 'i2c_master_recv()' in 'ret' so that the error +message print the correct error code. + +Fixes: acaa34bf06e9 ("media: rc: implement zilog transmitter") +Signed-off-by: Christophe JAILLET +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ir-kbd-i2c.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c +index e8119ad0bc71..92376592455e 100644 +--- a/drivers/media/i2c/ir-kbd-i2c.c ++++ b/drivers/media/i2c/ir-kbd-i2c.c +@@ -678,8 +678,8 @@ static int zilog_tx(struct rc_dev *rcdev, unsigned int *txbuf, + goto out_unlock; + } + +- i = i2c_master_recv(ir->tx_c, buf, 1); +- if (i != 1) { ++ ret = i2c_master_recv(ir->tx_c, buf, 1); ++ if (ret != 1) { + dev_err(&ir->rc->dev, "i2c_master_recv failed with %d\n", ret); + ret = -EIO; + goto out_unlock; +-- +2.30.2 + diff --git a/queue-5.12/media-rkvdec-fix-.buf_prepare.patch b/queue-5.12/media-rkvdec-fix-.buf_prepare.patch new file mode 100644 index 00000000000..6444024e731 --- /dev/null +++ b/queue-5.12/media-rkvdec-fix-.buf_prepare.patch @@ -0,0 +1,54 @@ +From 163eab1425b285a207fcf21a75514faedd7677a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 14:23:45 +0200 +Subject: media: rkvdec: Fix .buf_prepare + +From: Ezequiel Garcia + +[ Upstream commit ba1ed4ae760a81caf39f54232e089d95157a0dba ] + +The driver should only set the payload on .buf_prepare if the +buffer is CAPTURE type. If an OUTPUT buffer has a zero bytesused +set by userspace then v4l2-core will set it to buffer length. + +If we overwrite bytesused for OUTPUT buffers, too, then +vb2_get_plane_payload() will return incorrect value which might be then +written to hw registers by the driver in rkvdec-h264.c. + +[Changed the comment and used V4L2_TYPE_IS_CAPTURE macro] + +Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver") +Signed-off-by: Ezequiel Garcia +Signed-off-by: Adrian Ratiu +Signed-off-by: Andrzej Pietrasiewicz +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/rkvdec/rkvdec.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c +index 8c17615f3a7a..7131156c1f2c 100644 +--- a/drivers/staging/media/rkvdec/rkvdec.c ++++ b/drivers/staging/media/rkvdec/rkvdec.c +@@ -481,7 +481,15 @@ static int rkvdec_buf_prepare(struct vb2_buffer *vb) + if (vb2_plane_size(vb, i) < sizeimage) + return -EINVAL; + } +- vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); ++ ++ /* ++ * Buffer's bytesused must be written by driver for CAPTURE buffers. ++ * (for OUTPUT buffers, if userspace passes 0 bytesused, v4l2-core sets ++ * it to buffer length). ++ */ ++ if (V4L2_TYPE_IS_CAPTURE(vq->type)) ++ vb2_set_plane_payload(vb, 0, f->fmt.pix_mp.plane_fmt[0].sizeimage); ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.12/media-s5p-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.12/media-s5p-fix-pm_runtime_get_sync-usage-count.patch new file mode 100644 index 00000000000..a328ad2076f --- /dev/null +++ b/queue-5.12/media-s5p-fix-pm_runtime_get_sync-usage-count.patch @@ -0,0 +1,50 @@ +From b30bb4c7b855b618c1607b1d20ead4383908820f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 17:04:23 +0200 +Subject: media: s5p: fix pm_runtime_get_sync() usage count + +From: Mauro Carvalho Chehab + +[ Upstream commit fdc34e82c0f968ac4c157bd3d8c299ebc24c9c63 ] + +The pm_runtime_get_sync() internally increments the +dev->power.usage_count without decrementing it, even on errors. +Replace it by the new pm_runtime_resume_and_get(), introduced by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +in order to properly decrement the usage counter, avoiding +a potential PM usage counter leak. + +While here, check if the PM runtime error was caught at +s5p_cec_adap_enable(). + +Reviewed-by: Jonathan Cameron +Reviewed-by: Sylwester Nawrocki +Acked-by: Marek Szyprowski +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/platform/s5p/s5p_cec.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/cec/platform/s5p/s5p_cec.c b/drivers/media/cec/platform/s5p/s5p_cec.c +index 2a3e7ffefe0a..2250c1cbc64e 100644 +--- a/drivers/media/cec/platform/s5p/s5p_cec.c ++++ b/drivers/media/cec/platform/s5p/s5p_cec.c +@@ -35,10 +35,13 @@ MODULE_PARM_DESC(debug, "debug level (0-2)"); + + static int s5p_cec_adap_enable(struct cec_adapter *adap, bool enable) + { ++ int ret; + struct s5p_cec_dev *cec = cec_get_drvdata(adap); + + if (enable) { +- pm_runtime_get_sync(cec->dev); ++ ret = pm_runtime_resume_and_get(cec->dev); ++ if (ret < 0) ++ return ret; + + s5p_cec_reset(cec); + +-- +2.30.2 + diff --git a/queue-5.12/media-s5p-g2d-fix-a-memory-leak-on-ctx-fh.m2m_ctx.patch b/queue-5.12/media-s5p-g2d-fix-a-memory-leak-on-ctx-fh.m2m_ctx.patch new file mode 100644 index 00000000000..06c07627443 --- /dev/null +++ b/queue-5.12/media-s5p-g2d-fix-a-memory-leak-on-ctx-fh.m2m_ctx.patch @@ -0,0 +1,40 @@ +From 0812c1c4377c5209b291f0ac28098ba6fbcce7a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 17:18:32 +0200 +Subject: media: s5p-g2d: Fix a memory leak on ctx->fh.m2m_ctx + +From: Dillon Min + +[ Upstream commit 5d11e6aad1811ea293ee2996cec9124f7fccb661 ] + +The m2m_ctx resources was allocated by v4l2_m2m_ctx_init() in g2d_open() +should be freed from g2d_release() when it's not used. + +Fix it + +Fixes: 918847341af0 ("[media] v4l: add G2D driver for s5p device family") +Signed-off-by: Dillon Min +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s5p-g2d/g2d.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/platform/s5p-g2d/g2d.c b/drivers/media/platform/s5p-g2d/g2d.c +index 15bcb7f6e113..1cb5eaabf340 100644 +--- a/drivers/media/platform/s5p-g2d/g2d.c ++++ b/drivers/media/platform/s5p-g2d/g2d.c +@@ -276,6 +276,9 @@ static int g2d_release(struct file *file) + struct g2d_dev *dev = video_drvdata(file); + struct g2d_ctx *ctx = fh2ctx(file->private_data); + ++ mutex_lock(&dev->mutex); ++ v4l2_m2m_ctx_release(ctx->fh.m2m_ctx); ++ mutex_unlock(&dev->mutex); + v4l2_ctrl_handler_free(&ctx->ctrl_handler); + v4l2_fh_del(&ctx->fh); + v4l2_fh_exit(&ctx->fh); +-- +2.30.2 + diff --git a/queue-5.12/media-s5p-jpeg-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.12/media-s5p-jpeg-fix-pm_runtime_get_sync-usage-count.patch new file mode 100644 index 00000000000..3bf2cc38ba2 --- /dev/null +++ b/queue-5.12/media-s5p-jpeg-fix-pm_runtime_get_sync-usage-count.patch @@ -0,0 +1,49 @@ +From 6a03dcbd71c02c0a614eb95a8474337a098f8107 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 17:19:10 +0200 +Subject: media: s5p-jpeg: fix pm_runtime_get_sync() usage count + +From: Mauro Carvalho Chehab + +[ Upstream commit 10343de268d10cf07b092b8b525e12ad558ead77 ] + +The pm_runtime_get_sync() internally increments the +dev->power.usage_count without decrementing it, even on errors. +Replace it by the new pm_runtime_resume_and_get(), introduced by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +in order to properly decrement the usage counter, avoiding +a potential PM usage counter leak. + +As a plus, pm_runtime_resume_and_get() doesn't return +positive numbers, so the return code validation can +be removed. + +Reviewed-by: Jonathan Cameron +Reviewed-by: Sylwester Nawrocki +Acked-by: Andrzej Pietrasiewicz +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s5p-jpeg/jpeg-core.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c +index 026111505f5a..d402e456f27d 100644 +--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c ++++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c +@@ -2566,11 +2566,8 @@ static void s5p_jpeg_buf_queue(struct vb2_buffer *vb) + static int s5p_jpeg_start_streaming(struct vb2_queue *q, unsigned int count) + { + struct s5p_jpeg_ctx *ctx = vb2_get_drv_priv(q); +- int ret; +- +- ret = pm_runtime_get_sync(ctx->jpeg->dev); + +- return ret > 0 ? 0 : ret; ++ return pm_runtime_resume_and_get(ctx->jpeg->dev); + } + + static void s5p_jpeg_stop_streaming(struct vb2_queue *q) +-- +2.30.2 + diff --git a/queue-5.12/media-s5p_cec-decrement-usage-count-if-disabled.patch b/queue-5.12/media-s5p_cec-decrement-usage-count-if-disabled.patch new file mode 100644 index 00000000000..134277b735c --- /dev/null +++ b/queue-5.12/media-s5p_cec-decrement-usage-count-if-disabled.patch @@ -0,0 +1,39 @@ +From df8e2e6d69c0fd019c39001551f17c972ca1b123 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 09:38:56 +0200 +Subject: media: s5p_cec: decrement usage count if disabled + +From: Mauro Carvalho Chehab + +[ Upstream commit 747bad54a677d8633ec14b39dfbeb859c821d7f2 ] + +There's a bug at s5p_cec_adap_enable(): if called to +disable the device, it should call pm_runtime_put() +instead of pm_runtime_disable(), as the goal here is to +decrement the usage_count and not to disable PM runtime. + +Reported-by: Sylwester Nawrocki +Reviewed-by: Jonathan Cameron +Fixes: 1bcbf6f4b6b0 ("[media] cec: s5p-cec: Add s5p-cec driver") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/cec/platform/s5p/s5p_cec.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/cec/platform/s5p/s5p_cec.c b/drivers/media/cec/platform/s5p/s5p_cec.c +index 2250c1cbc64e..028a09a7531e 100644 +--- a/drivers/media/cec/platform/s5p/s5p_cec.c ++++ b/drivers/media/cec/platform/s5p/s5p_cec.c +@@ -54,7 +54,7 @@ static int s5p_cec_adap_enable(struct cec_adapter *adap, bool enable) + } else { + s5p_cec_mask_tx_interrupts(cec); + s5p_cec_mask_rx_interrupts(cec); +- pm_runtime_disable(cec->dev); ++ pm_runtime_put(cec->dev); + } + + return 0; +-- +2.30.2 + diff --git a/queue-5.12/media-sh_vou-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.12/media-sh_vou-fix-pm_runtime_get_sync-usage-count.patch new file mode 100644 index 00000000000..7c4c8852c8d --- /dev/null +++ b/queue-5.12/media-sh_vou-fix-pm_runtime_get_sync-usage-count.patch @@ -0,0 +1,45 @@ +From 7144f43cccd01b3faf6d41812580e359e66cdbb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 17:07:41 +0200 +Subject: media: sh_vou: fix pm_runtime_get_sync() usage count + +From: Mauro Carvalho Chehab + +[ Upstream commit 6e8b1526db164c9d4b9dacfb9bc48e365d7c4860 ] + +The pm_runtime_get_sync() internally increments the +dev->power.usage_count without decrementing it, even on errors. +Replace it by the new pm_runtime_resume_and_get(), introduced by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +in order to properly decrement the usage counter, avoiding +a potential PM usage counter leak. + +While here, check if the PM runtime error was caught at open time. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sh_vou.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sh_vou.c b/drivers/media/platform/sh_vou.c +index 4ac48441f22c..ca4310e26c49 100644 +--- a/drivers/media/platform/sh_vou.c ++++ b/drivers/media/platform/sh_vou.c +@@ -1133,7 +1133,11 @@ static int sh_vou_open(struct file *file) + if (v4l2_fh_is_singular_file(file) && + vou_dev->status == SH_VOU_INITIALISING) { + /* First open */ +- pm_runtime_get_sync(vou_dev->v4l2_dev.dev); ++ err = pm_runtime_resume_and_get(vou_dev->v4l2_dev.dev); ++ if (err < 0) { ++ v4l2_fh_release(file); ++ goto done_open; ++ } + err = sh_vou_hw_init(vou_dev); + if (err < 0) { + pm_runtime_put(vou_dev->v4l2_dev.dev); +-- +2.30.2 + diff --git a/queue-5.12/media-siano-fix-device-register-error-path.patch b/queue-5.12/media-siano-fix-device-register-error-path.patch new file mode 100644 index 00000000000..768051130b2 --- /dev/null +++ b/queue-5.12/media-siano-fix-device-register-error-path.patch @@ -0,0 +1,39 @@ +From cde4d35432eeef20a86f55908bbc8cec071a8fbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 08:57:02 +0200 +Subject: media: siano: fix device register error path + +From: Mauro Carvalho Chehab + +[ Upstream commit 5368b1ee2939961a16e74972b69088433fc52195 ] + +As reported by smatch: + drivers/media/common/siano/smsdvb-main.c:1231 smsdvb_hotplug() warn: '&client->entry' not removed from list + +If an error occur at the end of the registration logic, it won't +drop the device from the list. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/common/siano/smsdvb-main.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c +index ae17407e477a..7cc654bc52d3 100644 +--- a/drivers/media/common/siano/smsdvb-main.c ++++ b/drivers/media/common/siano/smsdvb-main.c +@@ -1176,6 +1176,10 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev, + return 0; + + media_graph_error: ++ mutex_lock(&g_smsdvb_clientslock); ++ list_del(&client->entry); ++ mutex_unlock(&g_smsdvb_clientslock); ++ + smsdvb_debugfs_release(client); + + client_error: +-- +2.30.2 + diff --git a/queue-5.12/media-siano-fix-out-of-bounds-warnings-in-smscore_lo.patch b/queue-5.12/media-siano-fix-out-of-bounds-warnings-in-smscore_lo.patch new file mode 100644 index 00000000000..e5c9ffd69c2 --- /dev/null +++ b/queue-5.12/media-siano-fix-out-of-bounds-warnings-in-smscore_lo.patch @@ -0,0 +1,167 @@ +From 5c9a79a387f8df8feead661f635fcd274218156b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Mar 2021 19:40:43 -0600 +Subject: media: siano: Fix out-of-bounds warnings in + smscore_load_firmware_family2() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Gustavo A. R. Silva + +[ Upstream commit 13dfead49db07225335d4f587a560a2210391a1a ] + +Rename struct sms_msg_data4 to sms_msg_data5 and increase the size of +its msg_data array from 4 to 5 elements. Notice that at some point +the 5th element of msg_data is being accessed in function +smscore_load_firmware_family2(): + +1006 trigger_msg->msg_data[4] = 4; /* Task ID */ + +Also, there is no need for the object _trigger_msg_ of type struct +sms_msg_data *, when _msg_ can be used, directly. Notice that msg_data +in struct sms_msg_data is a one-element array, which causes multiple +out-of-bounds warnings when accessing beyond its first element +in function smscore_load_firmware_family2(): + + 992 struct sms_msg_data *trigger_msg = + 993 (struct sms_msg_data *) msg; + 994 + 995 pr_debug("sending MSG_SMS_SWDOWNLOAD_TRIGGER_REQ\n"); + 996 SMS_INIT_MSG(&msg->x_msg_header, + 997 MSG_SMS_SWDOWNLOAD_TRIGGER_REQ, + 998 sizeof(struct sms_msg_hdr) + + 999 sizeof(u32) * 5); +1000 +1001 trigger_msg->msg_data[0] = firmware->start_address; +1002 /* Entry point */ +1003 trigger_msg->msg_data[1] = 6; /* Priority */ +1004 trigger_msg->msg_data[2] = 0x200; /* Stack size */ +1005 trigger_msg->msg_data[3] = 0; /* Parameter */ +1006 trigger_msg->msg_data[4] = 4; /* Task ID */ + +even when enough dynamic memory is allocated for _msg_: + + 929 /* PAGE_SIZE buffer shall be enough and dma aligned */ + 930 msg = kmalloc(PAGE_SIZE, GFP_KERNEL | coredev->gfp_buf_flags); + +but as _msg_ is casted to (struct sms_msg_data *): + + 992 struct sms_msg_data *trigger_msg = + 993 (struct sms_msg_data *) msg; + +the out-of-bounds warnings are actually valid and should be addressed. + +Fix this by declaring object _msg_ of type struct sms_msg_data5 *, +which contains a 5-elements array, instead of just 4. And use +_msg_ directly, instead of creating object trigger_msg. + +This helps with the ongoing efforts to enable -Warray-bounds by fixing +the following warnings: + + CC [M] drivers/media/common/siano/smscoreapi.o +drivers/media/common/siano/smscoreapi.c: In function ‘smscore_load_firmware_family2’: +drivers/media/common/siano/smscoreapi.c:1003:24: warning: array subscript 1 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds] + 1003 | trigger_msg->msg_data[1] = 6; /* Priority */ + | ~~~~~~~~~~~~~~~~~~~~~^~~ +In file included from drivers/media/common/siano/smscoreapi.c:12: +drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’ + 619 | u32 msg_data[1]; + | ^~~~~~~~ +drivers/media/common/siano/smscoreapi.c:1004:24: warning: array subscript 2 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds] + 1004 | trigger_msg->msg_data[2] = 0x200; /* Stack size */ + | ~~~~~~~~~~~~~~~~~~~~~^~~ +In file included from drivers/media/common/siano/smscoreapi.c:12: +drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’ + 619 | u32 msg_data[1]; + | ^~~~~~~~ +drivers/media/common/siano/smscoreapi.c:1005:24: warning: array subscript 3 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds] + 1005 | trigger_msg->msg_data[3] = 0; /* Parameter */ + | ~~~~~~~~~~~~~~~~~~~~~^~~ +In file included from drivers/media/common/siano/smscoreapi.c:12: +drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’ + 619 | u32 msg_data[1]; + | ^~~~~~~~ +drivers/media/common/siano/smscoreapi.c:1006:24: warning: array subscript 4 is above array bounds of ‘u32[1]’ {aka ‘unsigned int[1]’} [-Warray-bounds] + 1006 | trigger_msg->msg_data[4] = 4; /* Task ID */ + | ~~~~~~~~~~~~~~~~~~~~~^~~ +In file included from drivers/media/common/siano/smscoreapi.c:12: +drivers/media/common/siano/smscoreapi.h:619:6: note: while referencing ‘msg_data’ + 619 | u32 msg_data[1]; + | ^~~~~~~~ + +Fixes: 018b0c6f8acb ("[media] siano: make load firmware logic to work with newer firmwares") +Co-developed-by: Kees Cook +Signed-off-by: Kees Cook +Signed-off-by: Gustavo A. R. Silva +Signed-off-by: Sasha Levin +--- + drivers/media/common/siano/smscoreapi.c | 22 +++++++++------------- + drivers/media/common/siano/smscoreapi.h | 4 ++-- + 2 files changed, 11 insertions(+), 15 deletions(-) + +diff --git a/drivers/media/common/siano/smscoreapi.c b/drivers/media/common/siano/smscoreapi.c +index c1511094fdc7..b735e2370137 100644 +--- a/drivers/media/common/siano/smscoreapi.c ++++ b/drivers/media/common/siano/smscoreapi.c +@@ -908,7 +908,7 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev, + void *buffer, size_t size) + { + struct sms_firmware *firmware = (struct sms_firmware *) buffer; +- struct sms_msg_data4 *msg; ++ struct sms_msg_data5 *msg; + u32 mem_address, calc_checksum = 0; + u32 i, *ptr; + u8 *payload = firmware->payload; +@@ -989,24 +989,20 @@ static int smscore_load_firmware_family2(struct smscore_device_t *coredev, + goto exit_fw_download; + + if (coredev->mode == DEVICE_MODE_NONE) { +- struct sms_msg_data *trigger_msg = +- (struct sms_msg_data *) msg; +- + pr_debug("sending MSG_SMS_SWDOWNLOAD_TRIGGER_REQ\n"); + SMS_INIT_MSG(&msg->x_msg_header, + MSG_SMS_SWDOWNLOAD_TRIGGER_REQ, +- sizeof(struct sms_msg_hdr) + +- sizeof(u32) * 5); ++ sizeof(*msg)); + +- trigger_msg->msg_data[0] = firmware->start_address; ++ msg->msg_data[0] = firmware->start_address; + /* Entry point */ +- trigger_msg->msg_data[1] = 6; /* Priority */ +- trigger_msg->msg_data[2] = 0x200; /* Stack size */ +- trigger_msg->msg_data[3] = 0; /* Parameter */ +- trigger_msg->msg_data[4] = 4; /* Task ID */ ++ msg->msg_data[1] = 6; /* Priority */ ++ msg->msg_data[2] = 0x200; /* Stack size */ ++ msg->msg_data[3] = 0; /* Parameter */ ++ msg->msg_data[4] = 4; /* Task ID */ + +- rc = smscore_sendrequest_and_wait(coredev, trigger_msg, +- trigger_msg->x_msg_header.msg_length, ++ rc = smscore_sendrequest_and_wait(coredev, msg, ++ msg->x_msg_header.msg_length, + &coredev->trigger_done); + } else { + SMS_INIT_MSG(&msg->x_msg_header, MSG_SW_RELOAD_EXEC_REQ, +diff --git a/drivers/media/common/siano/smscoreapi.h b/drivers/media/common/siano/smscoreapi.h +index b3b793b5caf3..16c45afabc53 100644 +--- a/drivers/media/common/siano/smscoreapi.h ++++ b/drivers/media/common/siano/smscoreapi.h +@@ -629,9 +629,9 @@ struct sms_msg_data2 { + u32 msg_data[2]; + }; + +-struct sms_msg_data4 { ++struct sms_msg_data5 { + struct sms_msg_hdr x_msg_header; +- u32 msg_data[4]; ++ u32 msg_data[5]; + }; + + struct sms_data_download { +-- +2.30.2 + diff --git a/queue-5.12/media-st-hva-fix-potential-null-pointer-dereferences.patch b/queue-5.12/media-st-hva-fix-potential-null-pointer-dereferences.patch new file mode 100644 index 00000000000..d4741386248 --- /dev/null +++ b/queue-5.12/media-st-hva-fix-potential-null-pointer-dereferences.patch @@ -0,0 +1,40 @@ +From 0afac2ab5907387963c08b19d291c7157322775c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 14:04:49 +0200 +Subject: media: st-hva: Fix potential NULL pointer dereferences + +From: Evgeny Novikov + +[ Upstream commit b7fdd208687ba59ebfb09b2199596471c63b69e3 ] + +When ctx_id >= HVA_MAX_INSTANCES in hva_hw_its_irq_thread() it tries to +access fields of ctx that is NULL at that point. The patch gets rid of +these accesses. + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Evgeny Novikov +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/hva/hva-hw.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c +index f59811e27f51..6eeee5017fac 100644 +--- a/drivers/media/platform/sti/hva/hva-hw.c ++++ b/drivers/media/platform/sti/hva/hva-hw.c +@@ -130,8 +130,7 @@ static irqreturn_t hva_hw_its_irq_thread(int irq, void *arg) + ctx_id = (hva->sts_reg & 0xFF00) >> 8; + if (ctx_id >= HVA_MAX_INSTANCES) { + dev_err(dev, "%s %s: bad context identifier: %d\n", +- ctx->name, __func__, ctx_id); +- ctx->hw_err = true; ++ HVA_PREFIX, __func__, ctx_id); + goto out; + } + +-- +2.30.2 + diff --git a/queue-5.12/media-sti-bdisp-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.12/media-sti-bdisp-fix-pm_runtime_get_sync-usage-count.patch new file mode 100644 index 00000000000..279c0c7ab8a --- /dev/null +++ b/queue-5.12/media-sti-bdisp-fix-pm_runtime_get_sync-usage-count.patch @@ -0,0 +1,67 @@ +From a2414f4fc175a1a465d5fa13b3b987c536acac02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 17:19:21 +0200 +Subject: media: sti/bdisp: fix pm_runtime_get_sync() usage count + +From: Mauro Carvalho Chehab + +[ Upstream commit c44eac5b72e23c31eefc0e10a71d9650036b8341 ] + +The pm_runtime_get_sync() internally increments the +dev->power.usage_count without decrementing it, even on errors. + +The bdisp_start_streaming() doesn't take it into account, which +would unbalance PM usage counter at bdisp_stop_streaming(). + +The logic at bdisp_probe() is correct, but the best is to use +the same call along the driver. + +So, replace it by the new pm_runtime_resume_and_get(), introduced by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +in order to properly decrement the usage counter, avoiding +a potential PM usage counter leak. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +index 060ca85f64d5..85288da9d2ae 100644 +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +@@ -499,7 +499,7 @@ static int bdisp_start_streaming(struct vb2_queue *q, unsigned int count) + { + struct bdisp_ctx *ctx = q->drv_priv; + struct vb2_v4l2_buffer *buf; +- int ret = pm_runtime_get_sync(ctx->bdisp_dev->dev); ++ int ret = pm_runtime_resume_and_get(ctx->bdisp_dev->dev); + + if (ret < 0) { + dev_err(ctx->bdisp_dev->dev, "failed to set runtime PM\n"); +@@ -1364,10 +1364,10 @@ static int bdisp_probe(struct platform_device *pdev) + + /* Power management */ + pm_runtime_enable(dev); +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { + dev_err(dev, "failed to set PM\n"); +- goto err_pm; ++ goto err_remove; + } + + /* Filters */ +@@ -1395,6 +1395,7 @@ err_filter: + bdisp_hw_free_filters(bdisp->dev); + err_pm: + pm_runtime_put(dev); ++err_remove: + bdisp_debugfs_remove(bdisp); + v4l2_device_unregister(&bdisp->v4l2_dev); + err_clk: +-- +2.30.2 + diff --git a/queue-5.12/media-sti-fix-obj-config-targets.patch b/queue-5.12/media-sti-fix-obj-config-targets.patch new file mode 100644 index 00000000000..74beced0818 --- /dev/null +++ b/queue-5.12/media-sti-fix-obj-config-targets.patch @@ -0,0 +1,58 @@ +From 044fa7acb1cf3d348280e36f10af278afe350454 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 11:26:31 +0200 +Subject: media: sti: fix obj-$(config) targets + +From: Mauro Carvalho Chehab + +[ Upstream commit 56c1f0876293888f686e31278d183d4af2cac3c3 ] + +The right thing to do is to add a new object to the building +system when a certain config option is selected, and *not* +override them. + +So, fix obj-$(config) logic at sti makefiles, using "+=", +instead of ":=". + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/bdisp/Makefile | 2 +- + drivers/media/platform/sti/delta/Makefile | 2 +- + drivers/media/platform/sti/hva/Makefile | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/sti/bdisp/Makefile b/drivers/media/platform/sti/bdisp/Makefile +index caf7ccd193ea..39ade0a34723 100644 +--- a/drivers/media/platform/sti/bdisp/Makefile ++++ b/drivers/media/platform/sti/bdisp/Makefile +@@ -1,4 +1,4 @@ + # SPDX-License-Identifier: GPL-2.0-only +-obj-$(CONFIG_VIDEO_STI_BDISP) := bdisp.o ++obj-$(CONFIG_VIDEO_STI_BDISP) += bdisp.o + + bdisp-objs := bdisp-v4l2.o bdisp-hw.o bdisp-debug.o +diff --git a/drivers/media/platform/sti/delta/Makefile b/drivers/media/platform/sti/delta/Makefile +index 92b37e216f00..32412fa4c632 100644 +--- a/drivers/media/platform/sti/delta/Makefile ++++ b/drivers/media/platform/sti/delta/Makefile +@@ -1,5 +1,5 @@ + # SPDX-License-Identifier: GPL-2.0-only +-obj-$(CONFIG_VIDEO_STI_DELTA_DRIVER) := st-delta.o ++obj-$(CONFIG_VIDEO_STI_DELTA_DRIVER) += st-delta.o + st-delta-y := delta-v4l2.o delta-mem.o delta-ipc.o delta-debug.o + + # MJPEG support +diff --git a/drivers/media/platform/sti/hva/Makefile b/drivers/media/platform/sti/hva/Makefile +index 74b41ec52f97..b5a5478bdd01 100644 +--- a/drivers/media/platform/sti/hva/Makefile ++++ b/drivers/media/platform/sti/hva/Makefile +@@ -1,4 +1,4 @@ + # SPDX-License-Identifier: GPL-2.0-only +-obj-$(CONFIG_VIDEO_STI_HVA) := st-hva.o ++obj-$(CONFIG_VIDEO_STI_HVA) += st-hva.o + st-hva-y := hva-v4l2.o hva-hw.o hva-mem.o hva-h264.o + st-hva-$(CONFIG_VIDEO_STI_HVA_DEBUGFS) += hva-debugfs.o +-- +2.30.2 + diff --git a/queue-5.12/media-subdev-remove-vidioc_dqevent_time32-handling.patch b/queue-5.12/media-subdev-remove-vidioc_dqevent_time32-handling.patch new file mode 100644 index 00000000000..68abc490bbd --- /dev/null +++ b/queue-5.12/media-subdev-remove-vidioc_dqevent_time32-handling.patch @@ -0,0 +1,72 @@ +From db10844c99b7f10c1c2acba178e429a5ce4aa9dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 12:34:05 +0200 +Subject: media: subdev: remove VIDIOC_DQEVENT_TIME32 handling + +From: Arnd Bergmann + +[ Upstream commit 765ba251d2522e2a0daa2f0793fd0f0ce34816ec ] + +Converting the VIDIOC_DQEVENT_TIME32/VIDIOC_DQEVENT32/ +VIDIOC_DQEVENT32_TIME32 arguments to the canonical form is done in common +code, but for some reason I ended up adding another conversion helper to +subdev_do_ioctl() as well. I must have concluded that this does not go +through the common conversion, but it has done that since the ioctl +handler was first added. + +I assume this one is harmless as there should be no way to arrive here +from user space if CONFIG_COMPAT_32BIT_TIME is set, but since it is dead +code, it should just get removed. + +On a 64-bit architecture, as well as a 32-bit architecture without +CONFIG_COMPAT_32BIT_TIME, handling this command is a mistake, +and the kernel should return an error. + +Fixes: 1a6c0b36dd19 ("media: v4l2-core: fix VIDIOC_DQEVENT for time64 ABI") +Signed-off-by: Arnd Bergmann +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-subdev.c | 24 ------------------------ + 1 file changed, 24 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-subdev.c b/drivers/media/v4l2-core/v4l2-subdev.c +index 956dafab43d4..bf3aa9252458 100644 +--- a/drivers/media/v4l2-core/v4l2-subdev.c ++++ b/drivers/media/v4l2-core/v4l2-subdev.c +@@ -428,30 +428,6 @@ static long subdev_do_ioctl(struct file *file, unsigned int cmd, void *arg) + + return v4l2_event_dequeue(vfh, arg, file->f_flags & O_NONBLOCK); + +- case VIDIOC_DQEVENT_TIME32: { +- struct v4l2_event_time32 *ev32 = arg; +- struct v4l2_event ev = { }; +- +- if (!(sd->flags & V4L2_SUBDEV_FL_HAS_EVENTS)) +- return -ENOIOCTLCMD; +- +- rval = v4l2_event_dequeue(vfh, &ev, file->f_flags & O_NONBLOCK); +- +- *ev32 = (struct v4l2_event_time32) { +- .type = ev.type, +- .pending = ev.pending, +- .sequence = ev.sequence, +- .timestamp.tv_sec = ev.timestamp.tv_sec, +- .timestamp.tv_nsec = ev.timestamp.tv_nsec, +- .id = ev.id, +- }; +- +- memcpy(&ev32->u, &ev.u, sizeof(ev.u)); +- memcpy(&ev32->reserved, &ev.reserved, sizeof(ev.reserved)); +- +- return rval; +- } +- + case VIDIOC_SUBSCRIBE_EVENT: + return v4l2_subdev_call(sd, core, subscribe_event, vfh, arg); + +-- +2.30.2 + diff --git a/queue-5.12/media-sunxi-fix-pm_runtime_get_sync-usage-count.patch b/queue-5.12/media-sunxi-fix-pm_runtime_get_sync-usage-count.patch new file mode 100644 index 00000000000..837927fbd9f --- /dev/null +++ b/queue-5.12/media-sunxi-fix-pm_runtime_get_sync-usage-count.patch @@ -0,0 +1,39 @@ +From 7a9a43600358a6702cfbfba4532c059782f1fdc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 17:19:10 +0200 +Subject: media: sunxi: fix pm_runtime_get_sync() usage count + +From: Mauro Carvalho Chehab + +[ Upstream commit 9c298f82d8392f799a0595f50076afa1d91e9092 ] + +The pm_runtime_get_sync() internally increments the +dev->power.usage_count without decrementing it, even on errors. +Replace it by the new pm_runtime_resume_and_get(), introduced by: +commit dd8088d5a896 ("PM: runtime: Add pm_runtime_resume_and_get to deal with usage counter") +in order to properly decrement the usage counter, avoiding +a potential PM usage counter leak. + +Reviewed-by: Jonathan Cameron +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sunxi/sun8i-rotate/sun8i_rotate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sunxi/sun8i-rotate/sun8i_rotate.c b/drivers/media/platform/sunxi/sun8i-rotate/sun8i_rotate.c +index 3f81dd17755c..fbcca59a0517 100644 +--- a/drivers/media/platform/sunxi/sun8i-rotate/sun8i_rotate.c ++++ b/drivers/media/platform/sunxi/sun8i-rotate/sun8i_rotate.c +@@ -494,7 +494,7 @@ static int rotate_start_streaming(struct vb2_queue *vq, unsigned int count) + struct device *dev = ctx->dev->dev; + int ret; + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) { + dev_err(dev, "Failed to enable module\n"); + +-- +2.30.2 + diff --git a/queue-5.12/media-tc358743-fix-error-return-code-in-tc358743_pro.patch b/queue-5.12/media-tc358743-fix-error-return-code-in-tc358743_pro.patch new file mode 100644 index 00000000000..8a7c8873ef8 --- /dev/null +++ b/queue-5.12/media-tc358743-fix-error-return-code-in-tc358743_pro.patch @@ -0,0 +1,38 @@ +From fd178dfed3f00065bf6aa96b549ea6251e2acbd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 08:58:30 +0200 +Subject: media: tc358743: Fix error return code in tc358743_probe_of() + +From: Zhen Lei + +[ Upstream commit a6b1e7093f0a099571fc8836ab4a589633f956a8 ] + +When the CSI bps per lane is not in the valid range, an appropriate error +code -EINVAL should be returned. However, we currently do not explicitly +assign this error code to 'ret'. As a result, 0 was incorrectly returned. + +Fixes: 256148246852 ("[media] tc358743: support probe from device tree") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/tc358743.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 1b309bb743c7..f21da11caf22 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -1974,6 +1974,7 @@ static int tc358743_probe_of(struct tc358743_state *state) + bps_pr_lane = 2 * endpoint.link_frequencies[0]; + if (bps_pr_lane < 62500000U || bps_pr_lane > 1000000000U) { + dev_err(dev, "unsupported bps per lane: %u bps\n", bps_pr_lane); ++ ret = -EINVAL; + goto disable_clk; + } + +-- +2.30.2 + diff --git a/queue-5.12/media-v4l2-core-avoid-the-dangling-pointer-in-v4l2_f.patch b/queue-5.12/media-v4l2-core-avoid-the-dangling-pointer-in-v4l2_f.patch new file mode 100644 index 00000000000..4d8ae02d25b --- /dev/null +++ b/queue-5.12/media-v4l2-core-avoid-the-dangling-pointer-in-v4l2_f.patch @@ -0,0 +1,39 @@ +From ba7fd88cc8cfaceb6b75c03c33da4e6b72afc76d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 May 2021 10:24:02 +0200 +Subject: media: v4l2-core: Avoid the dangling pointer in v4l2_fh_release + +From: Lv Yunlong + +[ Upstream commit 7dd0c9e547b6924e18712b6b51aa3cba1896ee2c ] + +A use after free bug caused by the dangling pointer +filp->privitate_data in v4l2_fh_release. +See https://lore.kernel.org/patchwork/patch/1419058/. + +My patch sets the dangling pointer to NULL to provide +robust. + +Signed-off-by: Lv Yunlong +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-fh.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c +index 684574f58e82..90eec79ee995 100644 +--- a/drivers/media/v4l2-core/v4l2-fh.c ++++ b/drivers/media/v4l2-core/v4l2-fh.c +@@ -96,6 +96,7 @@ int v4l2_fh_release(struct file *filp) + v4l2_fh_del(fh); + v4l2_fh_exit(fh); + kfree(fh); ++ filp->private_data = NULL; + } + return 0; + } +-- +2.30.2 + diff --git a/queue-5.12/media-v4l2-core-ignore-native-time32-ioctls-on-64-bi.patch b/queue-5.12/media-v4l2-core-ignore-native-time32-ioctls-on-64-bi.patch new file mode 100644 index 00000000000..d6cec53a800 --- /dev/null +++ b/queue-5.12/media-v4l2-core-ignore-native-time32-ioctls-on-64-bi.patch @@ -0,0 +1,128 @@ +From 1ad16b0177167ada05a8a4e94392fbe12d285909 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 12:34:02 +0200 +Subject: media: v4l2-core: ignore native time32 ioctls on 64-bit + +From: Arnd Bergmann + +[ Upstream commit c344f07aa1b4ba38ca8fabe407a2afe2f436323c ] + +Syzbot found that passing ioctl command 0xc0505609 into a 64-bit +kernel from a 32-bit process causes uninitialized kernel memory to +get passed to drivers instead of the user space data: + +BUG: KMSAN: uninit-value in check_array_args drivers/media/v4l2-core/v4l2-ioctl.c:3041 [inline] +BUG: KMSAN: uninit-value in video_usercopy+0x1631/0x3d30 drivers/media/v4l2-core/v4l2-ioctl.c:3315 +CPU: 0 PID: 19595 Comm: syz-executor.4 Not tainted 5.11.0-rc7-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x21c/0x280 lib/dump_stack.c:120 + kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 + __msan_warning+0x5f/0xa0 mm/kmsan/kmsan_instr.c:197 + check_array_args drivers/media/v4l2-core/v4l2-ioctl.c:3041 [inline] + video_usercopy+0x1631/0x3d30 drivers/media/v4l2-core/v4l2-ioctl.c:3315 + video_ioctl2+0x9f/0xb0 drivers/media/v4l2-core/v4l2-ioctl.c:3391 + v4l2_ioctl+0x255/0x290 drivers/media/v4l2-core/v4l2-dev.c:360 + v4l2_compat_ioctl32+0x2c6/0x370 drivers/media/v4l2-core/v4l2-compat-ioctl32.c:1248 + __do_compat_sys_ioctl fs/ioctl.c:842 [inline] + __se_compat_sys_ioctl+0x53d/0x1100 fs/ioctl.c:793 + __ia32_compat_sys_ioctl+0x4a/0x70 fs/ioctl.c:793 + do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] + __do_fast_syscall_32+0x102/0x160 arch/x86/entry/common.c:141 + do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:166 + do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:209 + entry_SYSENTER_compat_after_hwframe+0x4d/0x5c + +The time32 commands are defined but were never meant to be called on +64-bit machines, as those have always used time64 interfaces. I missed +this in my patch that introduced the time64 handling on 32-bit platforms. + +The problem in this case is the mismatch of one function checking for +the numeric value of the command and another function checking for the +type of process (native vs compat) instead, with the result being that +for this combination, nothing gets copied into the buffer at all. + +Avoid this by only trying to convert the time32 commands when running +on a 32-bit kernel where these are defined in a meaningful way. + +[hverkuil: fix 3 warnings: switch with no cases] + +Fixes: 577c89b0ce72 ("media: v4l2-core: fix v4l2_buffer handling for time64 ABI") +Reported-by: syzbot+142888ffec98ab194028@syzkaller.appspotmail.com +Signed-off-by: Arnd Bergmann +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-ioctl.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c +index 31d1342e61e8..7e8bf4b1ab2e 100644 +--- a/drivers/media/v4l2-core/v4l2-ioctl.c ++++ b/drivers/media/v4l2-core/v4l2-ioctl.c +@@ -3114,8 +3114,8 @@ static int check_array_args(unsigned int cmd, void *parg, size_t *array_size, + + static unsigned int video_translate_cmd(unsigned int cmd) + { ++#if !defined(CONFIG_64BIT) && defined(CONFIG_COMPAT_32BIT_TIME) + switch (cmd) { +-#ifdef CONFIG_COMPAT_32BIT_TIME + case VIDIOC_DQEVENT_TIME32: + return VIDIOC_DQEVENT; + case VIDIOC_QUERYBUF_TIME32: +@@ -3126,8 +3126,8 @@ static unsigned int video_translate_cmd(unsigned int cmd) + return VIDIOC_DQBUF; + case VIDIOC_PREPARE_BUF_TIME32: + return VIDIOC_PREPARE_BUF; +-#endif + } ++#endif + if (in_compat_syscall()) + return v4l2_compat_translate_cmd(cmd); + +@@ -3168,8 +3168,8 @@ static int video_get_user(void __user *arg, void *parg, + } else if (in_compat_syscall()) { + err = v4l2_compat_get_user(arg, parg, cmd); + } else { ++#if !defined(CONFIG_64BIT) && defined(CONFIG_COMPAT_32BIT_TIME) + switch (cmd) { +-#ifdef CONFIG_COMPAT_32BIT_TIME + case VIDIOC_QUERYBUF_TIME32: + case VIDIOC_QBUF_TIME32: + case VIDIOC_DQBUF_TIME32: +@@ -3197,8 +3197,8 @@ static int video_get_user(void __user *arg, void *parg, + }; + break; + } +-#endif + } ++#endif + } + + /* zero out anything we don't copy from userspace */ +@@ -3223,8 +3223,8 @@ static int video_put_user(void __user *arg, void *parg, + if (in_compat_syscall()) + return v4l2_compat_put_user(arg, parg, cmd); + ++#if !defined(CONFIG_64BIT) && defined(CONFIG_COMPAT_32BIT_TIME) + switch (cmd) { +-#ifdef CONFIG_COMPAT_32BIT_TIME + case VIDIOC_DQEVENT_TIME32: { + struct v4l2_event *ev = parg; + struct v4l2_event_time32 ev32; +@@ -3272,8 +3272,8 @@ static int video_put_user(void __user *arg, void *parg, + return -EFAULT; + break; + } +-#endif + } ++#endif + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.12/media-venus-rework-error-fail-recover-logic.patch b/queue-5.12/media-venus-rework-error-fail-recover-logic.patch new file mode 100644 index 00000000000..631d17591f3 --- /dev/null +++ b/queue-5.12/media-venus-rework-error-fail-recover-logic.patch @@ -0,0 +1,158 @@ +From 92d96b2ff741c937b67121d67298d65c71459e0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 10:39:47 +0200 +Subject: media: venus: Rework error fail recover logic + +From: Mauro Carvalho Chehab + +[ Upstream commit 4cba5473c5ce0f1389d316c5dc6f83a0259df5eb ] + +The Venus code has a sort of watchdog that attempts to recover +from IP errors, implemented as a delayed work job, which +calls venus_sys_error_handler(). + +Right now, it has several issues: + +1. It assumes that PM runtime resume never fails + +2. It internally runs two while() loops that also assume that + PM runtime will never fail to go idle: + + while (pm_runtime_active(core->dev_dec) || pm_runtime_active(core->dev_enc)) + msleep(10); + +... + + while (core->pmdomains[0] && pm_runtime_active(core->pmdomains[0])) + usleep_range(1000, 1500); + +3. It uses an OR to merge all return codes and then report to the user + +4. If the hardware never recovers, it keeps running on every 10ms, + flooding the syslog with 2 messages (so, up to 200 messages + per second). + +Rework the code, in order to prevent that, by: + +1. check the return code from PM runtime resume; +2. don't let the while() loops run forever; +3. store the failed event; +4. use warn ratelimited when it fails to recover. + +Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") +Reviewed-by: Jonathan Cameron +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/core.c | 60 +++++++++++++++++++----- + 1 file changed, 47 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c +index ae374bb2a48f..28443547ae8f 100644 +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -76,22 +76,32 @@ static const struct hfi_core_ops venus_core_ops = { + .event_notify = venus_event_notify, + }; + ++#define RPM_WAIT_FOR_IDLE_MAX_ATTEMPTS 10 ++ + static void venus_sys_error_handler(struct work_struct *work) + { + struct venus_core *core = + container_of(work, struct venus_core, work.work); +- int ret = 0; +- +- pm_runtime_get_sync(core->dev); ++ int ret, i, max_attempts = RPM_WAIT_FOR_IDLE_MAX_ATTEMPTS; ++ const char *err_msg = ""; ++ bool failed = false; ++ ++ ret = pm_runtime_get_sync(core->dev); ++ if (ret < 0) { ++ err_msg = "resume runtime PM"; ++ max_attempts = 0; ++ failed = true; ++ } + + hfi_core_deinit(core, true); + +- dev_warn(core->dev, "system error has occurred, starting recovery!\n"); +- + mutex_lock(&core->lock); + +- while (pm_runtime_active(core->dev_dec) || pm_runtime_active(core->dev_enc)) ++ for (i = 0; i < max_attempts; i++) { ++ if (!pm_runtime_active(core->dev_dec) && !pm_runtime_active(core->dev_enc)) ++ break; + msleep(10); ++ } + + venus_shutdown(core); + +@@ -99,31 +109,55 @@ static void venus_sys_error_handler(struct work_struct *work) + + pm_runtime_put_sync(core->dev); + +- while (core->pmdomains[0] && pm_runtime_active(core->pmdomains[0])) ++ for (i = 0; i < max_attempts; i++) { ++ if (!core->pmdomains[0] || !pm_runtime_active(core->pmdomains[0])) ++ break; + usleep_range(1000, 1500); ++ } + + hfi_reinit(core); + +- pm_runtime_get_sync(core->dev); ++ ret = pm_runtime_get_sync(core->dev); ++ if (ret < 0) { ++ err_msg = "resume runtime PM"; ++ failed = true; ++ } + +- ret |= venus_boot(core); +- ret |= hfi_core_resume(core, true); ++ ret = venus_boot(core); ++ if (ret && !failed) { ++ err_msg = "boot Venus"; ++ failed = true; ++ } ++ ++ ret = hfi_core_resume(core, true); ++ if (ret && !failed) { ++ err_msg = "resume HFI"; ++ failed = true; ++ } + + enable_irq(core->irq); + + mutex_unlock(&core->lock); + +- ret |= hfi_core_init(core); ++ ret = hfi_core_init(core); ++ if (ret && !failed) { ++ err_msg = "init HFI"; ++ failed = true; ++ } + + pm_runtime_put_sync(core->dev); + +- if (ret) { ++ if (failed) { + disable_irq_nosync(core->irq); +- dev_warn(core->dev, "recovery failed (%d)\n", ret); ++ dev_warn_ratelimited(core->dev, ++ "System error has occurred, recovery failed to %s\n", ++ err_msg); + schedule_delayed_work(&core->work, msecs_to_jiffies(10)); + return; + } + ++ dev_warn(core->dev, "system error has occurred (recovered)\n"); ++ + mutex_lock(&core->lock); + core->sys_error = false; + mutex_unlock(&core->lock); +-- +2.30.2 + diff --git a/queue-5.12/media-vicodec-use-_bitul-macro-in-uapi-headers.patch b/queue-5.12/media-vicodec-use-_bitul-macro-in-uapi-headers.patch new file mode 100644 index 00000000000..5630871d1b1 --- /dev/null +++ b/queue-5.12/media-vicodec-use-_bitul-macro-in-uapi-headers.patch @@ -0,0 +1,78 @@ +From d7fe16f879742a2ecea9be13d6abc2ef07809412 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 10:58:46 +0200 +Subject: media: vicodec: Use _BITUL() macro in UAPI headers + +From: Joe Richey + +[ Upstream commit ce67eaca95f8ab5c6aae41a10adfe9a6e8efa58c ] + +Replace BIT() in v4l2's UPAI header with _BITUL(). BIT() is not defined +in the UAPI headers and its usage may cause userspace build errors. + +Fixes: 206bc0f6fb94 ("media: vicodec: mark the stateless FWHT API as stable") +Signed-off-by: Joe Richey +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + include/uapi/linux/v4l2-controls.h | 23 ++++++++++++----------- + 1 file changed, 12 insertions(+), 11 deletions(-) + +diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h +index 039c0d7add1b..c7fe032df185 100644 +--- a/include/uapi/linux/v4l2-controls.h ++++ b/include/uapi/linux/v4l2-controls.h +@@ -50,6 +50,7 @@ + #ifndef __LINUX_V4L2_CONTROLS_H + #define __LINUX_V4L2_CONTROLS_H + ++#include + #include + + /* Control classes */ +@@ -1593,30 +1594,30 @@ struct v4l2_ctrl_h264_decode_params { + #define V4L2_FWHT_VERSION 3 + + /* Set if this is an interlaced format */ +-#define V4L2_FWHT_FL_IS_INTERLACED BIT(0) ++#define V4L2_FWHT_FL_IS_INTERLACED _BITUL(0) + /* Set if this is a bottom-first (NTSC) interlaced format */ +-#define V4L2_FWHT_FL_IS_BOTTOM_FIRST BIT(1) ++#define V4L2_FWHT_FL_IS_BOTTOM_FIRST _BITUL(1) + /* Set if each 'frame' contains just one field */ +-#define V4L2_FWHT_FL_IS_ALTERNATE BIT(2) ++#define V4L2_FWHT_FL_IS_ALTERNATE _BITUL(2) + /* + * If V4L2_FWHT_FL_IS_ALTERNATE was set, then this is set if this + * 'frame' is the bottom field, else it is the top field. + */ +-#define V4L2_FWHT_FL_IS_BOTTOM_FIELD BIT(3) ++#define V4L2_FWHT_FL_IS_BOTTOM_FIELD _BITUL(3) + /* Set if the Y' plane is uncompressed */ +-#define V4L2_FWHT_FL_LUMA_IS_UNCOMPRESSED BIT(4) ++#define V4L2_FWHT_FL_LUMA_IS_UNCOMPRESSED _BITUL(4) + /* Set if the Cb plane is uncompressed */ +-#define V4L2_FWHT_FL_CB_IS_UNCOMPRESSED BIT(5) ++#define V4L2_FWHT_FL_CB_IS_UNCOMPRESSED _BITUL(5) + /* Set if the Cr plane is uncompressed */ +-#define V4L2_FWHT_FL_CR_IS_UNCOMPRESSED BIT(6) ++#define V4L2_FWHT_FL_CR_IS_UNCOMPRESSED _BITUL(6) + /* Set if the chroma plane is full height, if cleared it is half height */ +-#define V4L2_FWHT_FL_CHROMA_FULL_HEIGHT BIT(7) ++#define V4L2_FWHT_FL_CHROMA_FULL_HEIGHT _BITUL(7) + /* Set if the chroma plane is full width, if cleared it is half width */ +-#define V4L2_FWHT_FL_CHROMA_FULL_WIDTH BIT(8) ++#define V4L2_FWHT_FL_CHROMA_FULL_WIDTH _BITUL(8) + /* Set if the alpha plane is uncompressed */ +-#define V4L2_FWHT_FL_ALPHA_IS_UNCOMPRESSED BIT(9) ++#define V4L2_FWHT_FL_ALPHA_IS_UNCOMPRESSED _BITUL(9) + /* Set if this is an I Frame */ +-#define V4L2_FWHT_FL_I_FRAME BIT(10) ++#define V4L2_FWHT_FL_I_FRAME _BITUL(10) + + /* A 4-values flag - the number of components - 1 */ + #define V4L2_FWHT_FL_COMPONENTS_NUM_MSK GENMASK(18, 16) +-- +2.30.2 + diff --git a/queue-5.12/media-video-mux-skip-dangling-endpoints.patch b/queue-5.12/media-video-mux-skip-dangling-endpoints.patch new file mode 100644 index 00000000000..7493cabc23f --- /dev/null +++ b/queue-5.12/media-video-mux-skip-dangling-endpoints.patch @@ -0,0 +1,54 @@ +From 2e1e71ce798356001678e43fdec97b7211d7a240 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Mar 2021 15:44:08 +0100 +Subject: media: video-mux: Skip dangling endpoints + +From: Philipp Zabel + +[ Upstream commit 95778c2d0979618e3349b1d2324ec282a5a6adbf ] + +i.MX6 device tree include files contain dangling endpoints for the +board device tree writers' convenience. These are still included in +many existing device trees. +Treat dangling endpoints as non-existent to support them. + +Signed-off-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Fixes: 612b385efb1e ("media: video-mux: Create media links in bound notifier") +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/video-mux.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/video-mux.c b/drivers/media/platform/video-mux.c +index 133122e38515..9bc0b4d8de09 100644 +--- a/drivers/media/platform/video-mux.c ++++ b/drivers/media/platform/video-mux.c +@@ -362,7 +362,7 @@ static int video_mux_async_register(struct video_mux *vmux, + + for (i = 0; i < num_input_pads; i++) { + struct v4l2_async_subdev *asd; +- struct fwnode_handle *ep; ++ struct fwnode_handle *ep, *remote_ep; + + ep = fwnode_graph_get_endpoint_by_id( + dev_fwnode(vmux->subdev.dev), i, 0, +@@ -370,6 +370,14 @@ static int video_mux_async_register(struct video_mux *vmux, + if (!ep) + continue; + ++ /* Skip dangling endpoints for backwards compatibility */ ++ remote_ep = fwnode_graph_get_remote_endpoint(ep); ++ if (!remote_ep) { ++ fwnode_handle_put(ep); ++ continue; ++ } ++ fwnode_handle_put(remote_ep); ++ + asd = v4l2_async_notifier_add_fwnode_remote_subdev( + &vmux->notifier, ep, struct v4l2_async_subdev); + +-- +2.30.2 + diff --git a/queue-5.12/memstick-rtsx_usb_ms-fix-uaf.patch b/queue-5.12/memstick-rtsx_usb_ms-fix-uaf.patch new file mode 100644 index 00000000000..d95aa7e6239 --- /dev/null +++ b/queue-5.12/memstick-rtsx_usb_ms-fix-uaf.patch @@ -0,0 +1,89 @@ +From 034930170818b6756b3ab24b0fa905fdbaca7327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 12:39:45 -0400 +Subject: memstick: rtsx_usb_ms: fix UAF + +From: Tong Zhang + +[ Upstream commit 42933c8aa14be1caa9eda41f65cde8a3a95d3e39 ] + +This patch fixes the following issues: +1. memstick_free_host() will free the host, so the use of ms_dev(host) after +it will be a problem. To fix this, move memstick_free_host() after when we +are done with ms_dev(host). +2. In rtsx_usb_ms_drv_remove(), pm need to be disabled before we remove +and free host otherwise memstick_check will be called and UAF will +happen. + +[ 11.351173] BUG: KASAN: use-after-free in rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms] +[ 11.357077] rtsx_usb_ms_drv_remove+0x94/0x140 [rtsx_usb_ms] +[ 11.357376] platform_remove+0x2a/0x50 +[ 11.367531] Freed by task 298: +[ 11.368537] kfree+0xa4/0x2a0 +[ 11.368711] device_release+0x51/0xe0 +[ 11.368905] kobject_put+0xa2/0x120 +[ 11.369090] rtsx_usb_ms_drv_remove+0x8c/0x140 [rtsx_usb_ms] +[ 11.369386] platform_remove+0x2a/0x50 + +[ 12.038408] BUG: KASAN: use-after-free in __mutex_lock.isra.0+0x3ec/0x7c0 +[ 12.045432] mutex_lock+0xc9/0xd0 +[ 12.046080] memstick_check+0x6a/0x578 [memstick] +[ 12.046509] process_one_work+0x46d/0x750 +[ 12.052107] Freed by task 297: +[ 12.053115] kfree+0xa4/0x2a0 +[ 12.053272] device_release+0x51/0xe0 +[ 12.053463] kobject_put+0xa2/0x120 +[ 12.053647] rtsx_usb_ms_drv_remove+0xc4/0x140 [rtsx_usb_ms] +[ 12.053939] platform_remove+0x2a/0x50 + +Signed-off-by: Tong Zhang +Co-developed-by: Ulf Hansson +Link: https://lore.kernel.org/r/20210511163944.1233295-1-ztong0001@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/memstick/host/rtsx_usb_ms.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/memstick/host/rtsx_usb_ms.c b/drivers/memstick/host/rtsx_usb_ms.c +index 102dbb8080da..29271ad4728a 100644 +--- a/drivers/memstick/host/rtsx_usb_ms.c ++++ b/drivers/memstick/host/rtsx_usb_ms.c +@@ -799,9 +799,9 @@ static int rtsx_usb_ms_drv_probe(struct platform_device *pdev) + + return 0; + err_out: +- memstick_free_host(msh); + pm_runtime_disable(ms_dev(host)); + pm_runtime_put_noidle(ms_dev(host)); ++ memstick_free_host(msh); + return err; + } + +@@ -828,9 +828,6 @@ static int rtsx_usb_ms_drv_remove(struct platform_device *pdev) + } + mutex_unlock(&host->host_mutex); + +- memstick_remove_host(msh); +- memstick_free_host(msh); +- + /* Balance possible unbalanced usage count + * e.g. unconditional module removal + */ +@@ -838,10 +835,11 @@ static int rtsx_usb_ms_drv_remove(struct platform_device *pdev) + pm_runtime_put(ms_dev(host)); + + pm_runtime_disable(ms_dev(host)); +- platform_set_drvdata(pdev, NULL); +- ++ memstick_remove_host(msh); + dev_dbg(ms_dev(host), + ": Realtek USB Memstick controller has been removed\n"); ++ memstick_free_host(msh); ++ platform_set_drvdata(pdev, NULL); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.12/mfd-mp2629-select-mfd_core-to-fix-build-error.patch b/queue-5.12/mfd-mp2629-select-mfd_core-to-fix-build-error.patch new file mode 100644 index 00000000000..f31d503b4df --- /dev/null +++ b/queue-5.12/mfd-mp2629-select-mfd_core-to-fix-build-error.patch @@ -0,0 +1,36 @@ +From 1b91d33388d313dad6a4a6941d9df9bb19a73ca2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 19:32:18 -0700 +Subject: mfd: mp2629: Select MFD_CORE to fix build error + +From: Randy Dunlap + +[ Upstream commit a933272041d852a1ef1c85f0c18b93e9999a41fa ] + +MFD_MP2629 should select MFD_CORE to a prevent build error: + +ERROR: modpost: "devm_mfd_add_devices" [drivers/mfd/mp2629.ko] undefined! + +Fixes: 06081646450e ("mfd: mp2629: Add support for mps battery charger") +Signed-off-by: Randy Dunlap +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig +index b74efa469e90..8b421b21a232 100644 +--- a/drivers/mfd/Kconfig ++++ b/drivers/mfd/Kconfig +@@ -465,6 +465,7 @@ config MFD_MP2629 + tristate "Monolithic Power Systems MP2629 ADC and Battery charger" + depends on I2C + select REGMAP_I2C ++ select MFD_CORE + help + Select this option to enable support for Monolithic Power Systems + battery charger. This provides ADC, thermal and battery charger power +-- +2.30.2 + diff --git a/queue-5.12/mfd-rn5t618-fix-irq-trigger-by-changing-it-to-level-.patch b/queue-5.12/mfd-rn5t618-fix-irq-trigger-by-changing-it-to-level-.patch new file mode 100644 index 00000000000..9c508c73f1e --- /dev/null +++ b/queue-5.12/mfd-rn5t618-fix-irq-trigger-by-changing-it-to-level-.patch @@ -0,0 +1,38 @@ +From 93e666adbb8822a630ebcb02cb8c61e9bb6f3a0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 22:55:18 +0200 +Subject: mfd: rn5t618: Fix IRQ trigger by changing it to level mode + +From: Andreas Kemnade + +[ Upstream commit a1649a5260631979c68e5b2012f60f90300e646f ] + +During more massive generation of interrupts, the IRQ got stuck, +and the subdevices did not see any new interrupts. That happens +especially at wonky USB supply in combination with ADC reads. +To fix that trigger the IRQ at level low instead of falling edge. + +Fixes: 0c81604516af ("mfd: rn5t618: Add IRQ support") +Signed-off-by: Andreas Kemnade +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/rn5t618.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/rn5t618.c b/drivers/mfd/rn5t618.c +index dc452df1f1bf..652a5e60067f 100644 +--- a/drivers/mfd/rn5t618.c ++++ b/drivers/mfd/rn5t618.c +@@ -104,7 +104,7 @@ static int rn5t618_irq_init(struct rn5t618 *rn5t618) + + ret = devm_regmap_add_irq_chip(rn5t618->dev, rn5t618->regmap, + rn5t618->irq, +- IRQF_TRIGGER_FALLING | IRQF_ONESHOT, ++ IRQF_TRIGGER_LOW | IRQF_ONESHOT, + 0, irq_chip, &rn5t618->irq_data); + if (ret) + dev_err(rn5t618->dev, "Failed to register IRQ chip\n"); +-- +2.30.2 + diff --git a/queue-5.12/mips-fix-pkmap-with-32-bit-mips-huge-page-support.patch b/queue-5.12/mips-fix-pkmap-with-32-bit-mips-huge-page-support.patch new file mode 100644 index 00000000000..f546616faa2 --- /dev/null +++ b/queue-5.12/mips-fix-pkmap-with-32-bit-mips-huge-page-support.patch @@ -0,0 +1,38 @@ +From 6102871d484d2d32405be59f4096841d3fa913cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 22:14:20 +0800 +Subject: MIPS: Fix PKMAP with 32-bit MIPS huge page support + +From: Wei Li + +[ Upstream commit cf02ce742f09188272bcc8b0e62d789eb671fc4c ] + +When 32-bit MIPS huge page support is enabled, we halve the number of +pointers a PTE page holds, making its last half go to waste. +Correspondingly, we should halve the number of kmap entries, as we just +initialized only a single pte table for that in pagetable_init(). + +Fixes: 35476311e529 ("MIPS: Add partial 32-bit huge page support") +Signed-off-by: Wei Li +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/highmem.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/highmem.h b/arch/mips/include/asm/highmem.h +index 292d0425717f..92a380210017 100644 +--- a/arch/mips/include/asm/highmem.h ++++ b/arch/mips/include/asm/highmem.h +@@ -36,7 +36,7 @@ extern pte_t *pkmap_page_table; + * easily, subsequent pte tables have to be allocated in one physical + * chunk of RAM. + */ +-#ifdef CONFIG_PHYS_ADDR_T_64BIT ++#if defined(CONFIG_PHYS_ADDR_T_64BIT) || defined(CONFIG_MIPS_HUGE_TLB_SUPPORT) + #define LAST_PKMAP 512 + #else + #define LAST_PKMAP 1024 +-- +2.30.2 + diff --git a/queue-5.12/mm-debug_vm_pgtable-ensure-thp-availability-via-has_.patch b/queue-5.12/mm-debug_vm_pgtable-ensure-thp-availability-via-has_.patch new file mode 100644 index 00000000000..744d299ac79 --- /dev/null +++ b/queue-5.12/mm-debug_vm_pgtable-ensure-thp-availability-via-has_.patch @@ -0,0 +1,239 @@ +From 234980536cbff3574bdcb8b3767f5ca3175f56ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 19:35:10 -0700 +Subject: mm/debug_vm_pgtable: ensure THP availability via + has_transparent_hugepage() + +From: Anshuman Khandual + +[ Upstream commit 65ac1a60a57e2c55f2ac37f27095f6b012295e81 ] + +On certain platforms, THP support could not just be validated via the +build option CONFIG_TRANSPARENT_HUGEPAGE. Instead +has_transparent_hugepage() also needs to be called upon to verify THP +runtime support. Otherwise the debug test will just run into unusable THP +helpers like in the case of a 4K hash config on powerpc platform [1]. +This just moves all pfn_pmd() and pfn_pud() after THP runtime validation +with has_transparent_hugepage() which prevents the mentioned problem. + +[1] https://bugzilla.kernel.org/show_bug.cgi?id=213069 + +Link: https://lkml.kernel.org/r/1621397588-19211-1-git-send-email-anshuman.khandual@arm.com +Fixes: 787d563b8642 ("mm/debug_vm_pgtable: fix kernel crash by checking for THP support") +Signed-off-by: Anshuman Khandual +Cc: Aneesh Kumar K.V +Cc: Christophe Leroy +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/debug_vm_pgtable.c | 63 ++++++++++++++++++++++++++++++++++--------- + 1 file changed, 51 insertions(+), 12 deletions(-) + +diff --git a/mm/debug_vm_pgtable.c b/mm/debug_vm_pgtable.c +index 726fd2030f64..12ebc97e8b43 100644 +--- a/mm/debug_vm_pgtable.c ++++ b/mm/debug_vm_pgtable.c +@@ -146,13 +146,14 @@ static void __init pte_savedwrite_tests(unsigned long pfn, pgprot_t prot) + static void __init pmd_basic_tests(unsigned long pfn, int idx) + { + pgprot_t prot = protection_map[idx]; +- pmd_t pmd = pfn_pmd(pfn, prot); + unsigned long val = idx, *ptr = &val; ++ pmd_t pmd; + + if (!has_transparent_hugepage()) + return; + + pr_debug("Validating PMD basic (%pGv)\n", ptr); ++ pmd = pfn_pmd(pfn, prot); + + /* + * This test needs to be executed after the given page table entry +@@ -185,7 +186,7 @@ static void __init pmd_advanced_tests(struct mm_struct *mm, + unsigned long pfn, unsigned long vaddr, + pgprot_t prot, pgtable_t pgtable) + { +- pmd_t pmd = pfn_pmd(pfn, prot); ++ pmd_t pmd; + + if (!has_transparent_hugepage()) + return; +@@ -232,9 +233,14 @@ static void __init pmd_advanced_tests(struct mm_struct *mm, + + static void __init pmd_leaf_tests(unsigned long pfn, pgprot_t prot) + { +- pmd_t pmd = pfn_pmd(pfn, prot); ++ pmd_t pmd; ++ ++ if (!has_transparent_hugepage()) ++ return; + + pr_debug("Validating PMD leaf\n"); ++ pmd = pfn_pmd(pfn, prot); ++ + /* + * PMD based THP is a leaf entry. + */ +@@ -267,12 +273,16 @@ static void __init pmd_huge_tests(pmd_t *pmdp, unsigned long pfn, pgprot_t prot) + + static void __init pmd_savedwrite_tests(unsigned long pfn, pgprot_t prot) + { +- pmd_t pmd = pfn_pmd(pfn, prot); ++ pmd_t pmd; + + if (!IS_ENABLED(CONFIG_NUMA_BALANCING)) + return; + ++ if (!has_transparent_hugepage()) ++ return; ++ + pr_debug("Validating PMD saved write\n"); ++ pmd = pfn_pmd(pfn, prot); + WARN_ON(!pmd_savedwrite(pmd_mk_savedwrite(pmd_clear_savedwrite(pmd)))); + WARN_ON(pmd_savedwrite(pmd_clear_savedwrite(pmd_mk_savedwrite(pmd)))); + } +@@ -281,13 +291,14 @@ static void __init pmd_savedwrite_tests(unsigned long pfn, pgprot_t prot) + static void __init pud_basic_tests(struct mm_struct *mm, unsigned long pfn, int idx) + { + pgprot_t prot = protection_map[idx]; +- pud_t pud = pfn_pud(pfn, prot); + unsigned long val = idx, *ptr = &val; ++ pud_t pud; + + if (!has_transparent_hugepage()) + return; + + pr_debug("Validating PUD basic (%pGv)\n", ptr); ++ pud = pfn_pud(pfn, prot); + + /* + * This test needs to be executed after the given page table entry +@@ -323,7 +334,7 @@ static void __init pud_advanced_tests(struct mm_struct *mm, + unsigned long pfn, unsigned long vaddr, + pgprot_t prot) + { +- pud_t pud = pfn_pud(pfn, prot); ++ pud_t pud; + + if (!has_transparent_hugepage()) + return; +@@ -332,6 +343,7 @@ static void __init pud_advanced_tests(struct mm_struct *mm, + /* Align the address wrt HPAGE_PUD_SIZE */ + vaddr &= HPAGE_PUD_MASK; + ++ pud = pfn_pud(pfn, prot); + set_pud_at(mm, vaddr, pudp, pud); + pudp_set_wrprotect(mm, vaddr, pudp); + pud = READ_ONCE(*pudp); +@@ -370,9 +382,13 @@ static void __init pud_advanced_tests(struct mm_struct *mm, + + static void __init pud_leaf_tests(unsigned long pfn, pgprot_t prot) + { +- pud_t pud = pfn_pud(pfn, prot); ++ pud_t pud; ++ ++ if (!has_transparent_hugepage()) ++ return; + + pr_debug("Validating PUD leaf\n"); ++ pud = pfn_pud(pfn, prot); + /* + * PUD based THP is a leaf entry. + */ +@@ -654,12 +670,16 @@ static void __init pte_protnone_tests(unsigned long pfn, pgprot_t prot) + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + static void __init pmd_protnone_tests(unsigned long pfn, pgprot_t prot) + { +- pmd_t pmd = pmd_mkhuge(pfn_pmd(pfn, prot)); ++ pmd_t pmd; + + if (!IS_ENABLED(CONFIG_NUMA_BALANCING)) + return; + ++ if (!has_transparent_hugepage()) ++ return; ++ + pr_debug("Validating PMD protnone\n"); ++ pmd = pmd_mkhuge(pfn_pmd(pfn, prot)); + WARN_ON(!pmd_protnone(pmd)); + WARN_ON(!pmd_present(pmd)); + } +@@ -679,18 +699,26 @@ static void __init pte_devmap_tests(unsigned long pfn, pgprot_t prot) + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + static void __init pmd_devmap_tests(unsigned long pfn, pgprot_t prot) + { +- pmd_t pmd = pfn_pmd(pfn, prot); ++ pmd_t pmd; ++ ++ if (!has_transparent_hugepage()) ++ return; + + pr_debug("Validating PMD devmap\n"); ++ pmd = pfn_pmd(pfn, prot); + WARN_ON(!pmd_devmap(pmd_mkdevmap(pmd))); + } + + #ifdef CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD + static void __init pud_devmap_tests(unsigned long pfn, pgprot_t prot) + { +- pud_t pud = pfn_pud(pfn, prot); ++ pud_t pud; ++ ++ if (!has_transparent_hugepage()) ++ return; + + pr_debug("Validating PUD devmap\n"); ++ pud = pfn_pud(pfn, prot); + WARN_ON(!pud_devmap(pud_mkdevmap(pud))); + } + #else /* !CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD */ +@@ -733,25 +761,33 @@ static void __init pte_swap_soft_dirty_tests(unsigned long pfn, pgprot_t prot) + #ifdef CONFIG_TRANSPARENT_HUGEPAGE + static void __init pmd_soft_dirty_tests(unsigned long pfn, pgprot_t prot) + { +- pmd_t pmd = pfn_pmd(pfn, prot); ++ pmd_t pmd; + + if (!IS_ENABLED(CONFIG_MEM_SOFT_DIRTY)) + return; + ++ if (!has_transparent_hugepage()) ++ return; ++ + pr_debug("Validating PMD soft dirty\n"); ++ pmd = pfn_pmd(pfn, prot); + WARN_ON(!pmd_soft_dirty(pmd_mksoft_dirty(pmd))); + WARN_ON(pmd_soft_dirty(pmd_clear_soft_dirty(pmd))); + } + + static void __init pmd_swap_soft_dirty_tests(unsigned long pfn, pgprot_t prot) + { +- pmd_t pmd = pfn_pmd(pfn, prot); ++ pmd_t pmd; + + if (!IS_ENABLED(CONFIG_MEM_SOFT_DIRTY) || + !IS_ENABLED(CONFIG_ARCH_ENABLE_THP_MIGRATION)) + return; + ++ if (!has_transparent_hugepage()) ++ return; ++ + pr_debug("Validating PMD swap soft dirty\n"); ++ pmd = pfn_pmd(pfn, prot); + WARN_ON(!pmd_swp_soft_dirty(pmd_swp_mksoft_dirty(pmd))); + WARN_ON(pmd_swp_soft_dirty(pmd_swp_clear_soft_dirty(pmd))); + } +@@ -780,6 +816,9 @@ static void __init pmd_swap_tests(unsigned long pfn, pgprot_t prot) + swp_entry_t swp; + pmd_t pmd; + ++ if (!has_transparent_hugepage()) ++ return; ++ + pr_debug("Validating PMD swap\n"); + pmd = pfn_pmd(pfn, prot); + swp = __pmd_to_swp_entry(pmd); +-- +2.30.2 + diff --git a/queue-5.12/mm-define-default-max_ptrs_per_-in-include-pgtable.h.patch b/queue-5.12/mm-define-default-max_ptrs_per_-in-include-pgtable.h.patch new file mode 100644 index 00000000000..74e5d5e7325 --- /dev/null +++ b/queue-5.12/mm-define-default-max_ptrs_per_-in-include-pgtable.h.patch @@ -0,0 +1,102 @@ +From 7e7421e0156618207a6c1b2a25980c1f4ed8a0df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 19:40:46 -0700 +Subject: mm: define default MAX_PTRS_PER_* in include/pgtable.h + +From: Daniel Axtens + +[ Upstream commit c0f8aa4fa815daacb6eca52cae04820d6aecb7c2 ] + +Commit c65e774fb3f6 ("x86/mm: Make PGDIR_SHIFT and PTRS_PER_P4D variable") +made PTRS_PER_P4D variable on x86 and introduced MAX_PTRS_PER_P4D as a +constant for cases which need a compile-time constant (e.g. fixed-size +arrays). + +powerpc likewise has boot-time selectable MMU features which can cause +other mm "constants" to vary. For KASAN, we have some static +PTE/PMD/PUD/P4D arrays so we need compile-time maximums for all these +constants. Extend the MAX_PTRS_PER_ idiom, and place default definitions +in include/pgtable.h. These define MAX_PTRS_PER_x to be PTRS_PER_x unless +an architecture has defined MAX_PTRS_PER_x in its arch headers. + +Clean up pgtable-nop4d.h and s390's MAX_PTRS_PER_P4D definitions while +we're at it: both can just pick up the default now. + +Link: https://lkml.kernel.org/r/20210624034050.511391-4-dja@axtens.net +Signed-off-by: Daniel Axtens +Acked-by: Andrey Konovalov +Reviewed-by: Christophe Leroy +Reviewed-by: Marco Elver +Cc: Aneesh Kumar K.V +Cc: Balbir Singh +Cc: Alexander Potapenko +Cc: Andrey Ryabinin +Cc: Dmitry Vyukov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/pgtable.h | 2 -- + include/asm-generic/pgtable-nop4d.h | 1 - + include/linux/pgtable.h | 22 ++++++++++++++++++++++ + 3 files changed, 22 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h +index 29c7ecd5ad1d..b38f7b781564 100644 +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -344,8 +344,6 @@ static inline int is_module_addr(void *addr) + #define PTRS_PER_P4D _CRST_ENTRIES + #define PTRS_PER_PGD _CRST_ENTRIES + +-#define MAX_PTRS_PER_P4D PTRS_PER_P4D +- + /* + * Segment table and region3 table entry encoding + * (R = read-only, I = invalid, y = young bit): +diff --git a/include/asm-generic/pgtable-nop4d.h b/include/asm-generic/pgtable-nop4d.h +index ce2cbb3c380f..2f6b1befb129 100644 +--- a/include/asm-generic/pgtable-nop4d.h ++++ b/include/asm-generic/pgtable-nop4d.h +@@ -9,7 +9,6 @@ + typedef struct { pgd_t pgd; } p4d_t; + + #define P4D_SHIFT PGDIR_SHIFT +-#define MAX_PTRS_PER_P4D 1 + #define PTRS_PER_P4D 1 + #define P4D_SIZE (1UL << P4D_SHIFT) + #define P4D_MASK (~(P4D_SIZE-1)) +diff --git a/include/linux/pgtable.h b/include/linux/pgtable.h +index 136b1d996075..6fbbd620f6db 100644 +--- a/include/linux/pgtable.h ++++ b/include/linux/pgtable.h +@@ -1580,4 +1580,26 @@ typedef unsigned int pgtbl_mod_mask; + #define pte_leaf_size(x) PAGE_SIZE + #endif + ++/* ++ * Some architectures have MMUs that are configurable or selectable at boot ++ * time. These lead to variable PTRS_PER_x. For statically allocated arrays it ++ * helps to have a static maximum value. ++ */ ++ ++#ifndef MAX_PTRS_PER_PTE ++#define MAX_PTRS_PER_PTE PTRS_PER_PTE ++#endif ++ ++#ifndef MAX_PTRS_PER_PMD ++#define MAX_PTRS_PER_PMD PTRS_PER_PMD ++#endif ++ ++#ifndef MAX_PTRS_PER_PUD ++#define MAX_PTRS_PER_PUD PTRS_PER_PUD ++#endif ++ ++#ifndef MAX_PTRS_PER_P4D ++#define MAX_PTRS_PER_P4D PTRS_PER_P4D ++#endif ++ + #endif /* _LINUX_PGTABLE_H */ +-- +2.30.2 + diff --git a/queue-5.12/mm-huge_memory.c-add-missing-read-only-thp-checking-.patch b/queue-5.12/mm-huge_memory.c-add-missing-read-only-thp-checking-.patch new file mode 100644 index 00000000000..1fcb8931f80 --- /dev/null +++ b/queue-5.12/mm-huge_memory.c-add-missing-read-only-thp-checking-.patch @@ -0,0 +1,229 @@ +From cb4825c3676057d25786d2fb3d8afcf8b0ed4e6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:47:50 -0700 +Subject: mm/huge_memory.c: add missing read-only THP checking in + transparent_hugepage_enabled() + +From: Miaohe Lin + +[ Upstream commit e6be37b2e7bddfe0c76585ee7c7eee5acc8efeab ] + +Since commit 99cb0dbd47a1 ("mm,thp: add read-only THP support for +(non-shmem) FS"), read-only THP file mapping is supported. But it forgot +to add checking for it in transparent_hugepage_enabled(). To fix it, we +add checking for read-only THP file mapping and also introduce helper +transhuge_vma_enabled() to check whether thp is enabled for specified vma +to reduce duplicated code. We rename transparent_hugepage_enabled to +transparent_hugepage_active to make the code easier to follow as suggested +by David Hildenbrand. + +[linmiaohe@huawei.com: define transhuge_vma_enabled next to transhuge_vma_suitable] + Link: https://lkml.kernel.org/r/20210514093007.4117906-1-linmiaohe@huawei.com + +Link: https://lkml.kernel.org/r/20210511134857.1581273-4-linmiaohe@huawei.com +Fixes: 99cb0dbd47a1 ("mm,thp: add read-only THP support for (non-shmem) FS") +Signed-off-by: Miaohe Lin +Reviewed-by: Yang Shi +Cc: Alexey Dobriyan +Cc: "Aneesh Kumar K . V" +Cc: Anshuman Khandual +Cc: David Hildenbrand +Cc: Hugh Dickins +Cc: Johannes Weiner +Cc: Kirill A. Shutemov +Cc: Matthew Wilcox +Cc: Minchan Kim +Cc: Ralph Campbell +Cc: Rik van Riel +Cc: Song Liu +Cc: William Kucharski +Cc: Zi Yan +Cc: Mike Kravetz +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/proc/task_mmu.c | 2 +- + include/linux/huge_mm.h | 57 +++++++++++++++++++++++++---------------- + mm/huge_memory.c | 11 +++++++- + mm/khugepaged.c | 4 +-- + mm/shmem.c | 3 +-- + 5 files changed, 48 insertions(+), 29 deletions(-) + +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index e862cab69583..a3f27ccec742 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -829,7 +829,7 @@ static int show_smap(struct seq_file *m, void *v) + __show_smap(m, &mss, false); + + seq_printf(m, "THPeligible: %d\n", +- transparent_hugepage_enabled(vma)); ++ transparent_hugepage_active(vma)); + + if (arch_pkeys_enabled()) + seq_printf(m, "ProtectionKey: %8u\n", vma_pkey(vma)); +diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h +index 2a7c58ea5ca9..e72787731a5b 100644 +--- a/include/linux/huge_mm.h ++++ b/include/linux/huge_mm.h +@@ -118,9 +118,34 @@ extern struct kobj_attribute shmem_enabled_attr; + + extern unsigned long transparent_hugepage_flags; + ++static inline bool transhuge_vma_suitable(struct vm_area_struct *vma, ++ unsigned long haddr) ++{ ++ /* Don't have to check pgoff for anonymous vma */ ++ if (!vma_is_anonymous(vma)) { ++ if (!IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff, ++ HPAGE_PMD_NR)) ++ return false; ++ } ++ ++ if (haddr < vma->vm_start || haddr + HPAGE_PMD_SIZE > vma->vm_end) ++ return false; ++ return true; ++} ++ ++static inline bool transhuge_vma_enabled(struct vm_area_struct *vma, ++ unsigned long vm_flags) ++{ ++ /* Explicitly disabled through madvise. */ ++ if ((vm_flags & VM_NOHUGEPAGE) || ++ test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags)) ++ return false; ++ return true; ++} ++ + /* + * to be used on vmas which are known to support THP. +- * Use transparent_hugepage_enabled otherwise ++ * Use transparent_hugepage_active otherwise + */ + static inline bool __transparent_hugepage_enabled(struct vm_area_struct *vma) + { +@@ -131,15 +156,12 @@ static inline bool __transparent_hugepage_enabled(struct vm_area_struct *vma) + if (transparent_hugepage_flags & (1 << TRANSPARENT_HUGEPAGE_NEVER_DAX)) + return false; + +- if (vma->vm_flags & VM_NOHUGEPAGE) ++ if (!transhuge_vma_enabled(vma, vma->vm_flags)) + return false; + + if (vma_is_temporary_stack(vma)) + return false; + +- if (test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags)) +- return false; +- + if (transparent_hugepage_flags & (1 << TRANSPARENT_HUGEPAGE_FLAG)) + return true; + +@@ -153,22 +175,7 @@ static inline bool __transparent_hugepage_enabled(struct vm_area_struct *vma) + return false; + } + +-bool transparent_hugepage_enabled(struct vm_area_struct *vma); +- +-static inline bool transhuge_vma_suitable(struct vm_area_struct *vma, +- unsigned long haddr) +-{ +- /* Don't have to check pgoff for anonymous vma */ +- if (!vma_is_anonymous(vma)) { +- if (!IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff, +- HPAGE_PMD_NR)) +- return false; +- } +- +- if (haddr < vma->vm_start || haddr + HPAGE_PMD_SIZE > vma->vm_end) +- return false; +- return true; +-} ++bool transparent_hugepage_active(struct vm_area_struct *vma); + + #define transparent_hugepage_use_zero_page() \ + (transparent_hugepage_flags & \ +@@ -355,7 +362,7 @@ static inline bool __transparent_hugepage_enabled(struct vm_area_struct *vma) + return false; + } + +-static inline bool transparent_hugepage_enabled(struct vm_area_struct *vma) ++static inline bool transparent_hugepage_active(struct vm_area_struct *vma) + { + return false; + } +@@ -366,6 +373,12 @@ static inline bool transhuge_vma_suitable(struct vm_area_struct *vma, + return false; + } + ++static inline bool transhuge_vma_enabled(struct vm_area_struct *vma, ++ unsigned long vm_flags) ++{ ++ return false; ++} ++ + static inline void prep_transhuge_page(struct page *page) {} + + static inline bool is_transparent_hugepage(struct page *page) +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 44c455dbbd63..3120b6952f0d 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -63,7 +63,14 @@ static atomic_t huge_zero_refcount; + struct page *huge_zero_page __read_mostly; + unsigned long huge_zero_pfn __read_mostly = ~0UL; + +-bool transparent_hugepage_enabled(struct vm_area_struct *vma) ++static inline bool file_thp_enabled(struct vm_area_struct *vma) ++{ ++ return transhuge_vma_enabled(vma, vma->vm_flags) && vma->vm_file && ++ !inode_is_open_for_write(vma->vm_file->f_inode) && ++ (vma->vm_flags & VM_EXEC); ++} ++ ++bool transparent_hugepage_active(struct vm_area_struct *vma) + { + /* The addr is used to check if the vma size fits */ + unsigned long addr = (vma->vm_end & HPAGE_PMD_MASK) - HPAGE_PMD_SIZE; +@@ -74,6 +81,8 @@ bool transparent_hugepage_enabled(struct vm_area_struct *vma) + return __transparent_hugepage_enabled(vma); + if (vma_is_shmem(vma)) + return shmem_huge_enabled(vma); ++ if (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS)) ++ return file_thp_enabled(vma); + + return false; + } +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 2680d5ffee7f..1259efcd94ca 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -442,9 +442,7 @@ static inline int khugepaged_test_exit(struct mm_struct *mm) + static bool hugepage_vma_check(struct vm_area_struct *vma, + unsigned long vm_flags) + { +- /* Explicitly disabled through madvise. */ +- if ((vm_flags & VM_NOHUGEPAGE) || +- test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags)) ++ if (!transhuge_vma_enabled(vma, vm_flags)) + return false; + + /* Enabled via shmem mount options or sysfs settings. */ +diff --git a/mm/shmem.c b/mm/shmem.c +index 1a03744240e7..3c39116fd071 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -4037,8 +4037,7 @@ bool shmem_huge_enabled(struct vm_area_struct *vma) + loff_t i_size; + pgoff_t off; + +- if ((vma->vm_flags & VM_NOHUGEPAGE) || +- test_bit(MMF_DISABLE_THP, &vma->vm_mm->flags)) ++ if (!transhuge_vma_enabled(vma, vma->vm_flags)) + return false; + if (shmem_huge == SHMEM_HUGE_FORCE) + return true; +-- +2.30.2 + diff --git a/queue-5.12/mm-huge_memory.c-don-t-discard-hugepage-if-other-pro.patch b/queue-5.12/mm-huge_memory.c-don-t-discard-hugepage-if-other-pro.patch new file mode 100644 index 00000000000..627e99b7932 --- /dev/null +++ b/queue-5.12/mm-huge_memory.c-don-t-discard-hugepage-if-other-pro.patch @@ -0,0 +1,58 @@ +From 80dd2f62afce2f06097dc1e01a7936476eb8b18a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:47:57 -0700 +Subject: mm/huge_memory.c: don't discard hugepage if other processes are + mapping it + +From: Miaohe Lin + +[ Upstream commit babbbdd08af98a59089334eb3effbed5a7a0cf7f ] + +If other processes are mapping any other subpages of the hugepage, i.e. +in pte-mapped thp case, page_mapcount() will return 1 incorrectly. Then +we would discard the page while other processes are still mapping it. Fix +it by using total_mapcount() which can tell whether other processes are +still mapping it. + +Link: https://lkml.kernel.org/r/20210511134857.1581273-6-linmiaohe@huawei.com +Fixes: b8d3c4c3009d ("mm/huge_memory.c: don't split THP page when MADV_FREE syscall is called") +Reviewed-by: Yang Shi +Signed-off-by: Miaohe Lin +Cc: Alexey Dobriyan +Cc: "Aneesh Kumar K . V" +Cc: Anshuman Khandual +Cc: David Hildenbrand +Cc: Hugh Dickins +Cc: Johannes Weiner +Cc: Kirill A. Shutemov +Cc: Matthew Wilcox +Cc: Minchan Kim +Cc: Ralph Campbell +Cc: Rik van Riel +Cc: Song Liu +Cc: William Kucharski +Cc: Zi Yan +Cc: Mike Kravetz +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/huge_memory.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 3120b6952f0d..bc642923e0c9 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -1615,7 +1615,7 @@ bool madvise_free_huge_pmd(struct mmu_gather *tlb, struct vm_area_struct *vma, + * If other processes are mapping this page, we couldn't discard + * the page unless they all do MADV_FREE so let's skip the page. + */ +- if (page_mapcount(page) != 1) ++ if (total_mapcount(page) != 1) + goto out; + + if (!trylock_page(page)) +-- +2.30.2 + diff --git a/queue-5.12/mm-huge_memory.c-remove-dedicated-macro-hpage_cache_.patch b/queue-5.12/mm-huge_memory.c-remove-dedicated-macro-hpage_cache_.patch new file mode 100644 index 00000000000..ff6a572ccff --- /dev/null +++ b/queue-5.12/mm-huge_memory.c-remove-dedicated-macro-hpage_cache_.patch @@ -0,0 +1,73 @@ +From cbc7f30b05373405e7ecf38ae4ccddc319fed7f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:47:43 -0700 +Subject: mm/huge_memory.c: remove dedicated macro HPAGE_CACHE_INDEX_MASK + +From: Miaohe Lin + +[ Upstream commit b2bd53f18bb7f7cfc91b3bb527d7809376700a8e ] + +Patch series "Cleanup and fixup for huge_memory:, v3. + +This series contains cleanups to remove dedicated macro and remove +unnecessary tlb_remove_page_size() for huge zero pmd. Also this adds +missing read-only THP checking for transparent_hugepage_enabled() and +avoids discarding hugepage if other processes are mapping it. More +details can be found in the respective changelogs. + +Thi patch (of 5): + +Rewrite the pgoff checking logic to remove macro HPAGE_CACHE_INDEX_MASK +which is only used here to simplify the code. + +Link: https://lkml.kernel.org/r/20210511134857.1581273-1-linmiaohe@huawei.com +Link: https://lkml.kernel.org/r/20210511134857.1581273-2-linmiaohe@huawei.com +Signed-off-by: Miaohe Lin +Reviewed-by: Yang Shi +Reviewed-by: Anshuman Khandual +Reviewed-by: David Hildenbrand +Cc: Zi Yan +Cc: William Kucharski +Cc: Matthew Wilcox +Cc: "Aneesh Kumar K . V" +Cc: Ralph Campbell +Cc: Song Liu +Cc: Kirill A. Shutemov +Cc: Rik van Riel +Cc: Johannes Weiner +Cc: Minchan Kim +Cc: Hugh Dickins +Cc: Alexey Dobriyan +Cc: Mike Kravetz +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/huge_mm.h | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/include/linux/huge_mm.h b/include/linux/huge_mm.h +index 6686a0baa91d..2a7c58ea5ca9 100644 +--- a/include/linux/huge_mm.h ++++ b/include/linux/huge_mm.h +@@ -155,15 +155,13 @@ static inline bool __transparent_hugepage_enabled(struct vm_area_struct *vma) + + bool transparent_hugepage_enabled(struct vm_area_struct *vma); + +-#define HPAGE_CACHE_INDEX_MASK (HPAGE_PMD_NR - 1) +- + static inline bool transhuge_vma_suitable(struct vm_area_struct *vma, + unsigned long haddr) + { + /* Don't have to check pgoff for anonymous vma */ + if (!vma_is_anonymous(vma)) { +- if (((vma->vm_start >> PAGE_SHIFT) & HPAGE_CACHE_INDEX_MASK) != +- (vma->vm_pgoff & HPAGE_CACHE_INDEX_MASK)) ++ if (!IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff, ++ HPAGE_PMD_NR)) + return false; + } + +-- +2.30.2 + diff --git a/queue-5.12/mm-memcg-slab-properly-set-up-gfp-flags-for-objcg-po.patch b/queue-5.12/mm-memcg-slab-properly-set-up-gfp-flags-for-objcg-po.patch new file mode 100644 index 00000000000..9abf3283b1a --- /dev/null +++ b/queue-5.12/mm-memcg-slab-properly-set-up-gfp-flags-for-objcg-po.patch @@ -0,0 +1,117 @@ +From 18529b99c46707c7acd84806f78a08d9d0e2b029 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 19:37:34 -0700 +Subject: mm: memcg/slab: properly set up gfp flags for objcg pointer array + +From: Waiman Long + +[ Upstream commit 41eb5df1cbc9b302fc263ad7c9f38cfc38b4df61 ] + +Patch series "mm: memcg/slab: Fix objcg pointer array handling problem", v4. + +Since the merging of the new slab memory controller in v5.9, the page +structure stores a pointer to objcg pointer array for slab pages. When +the slab has no used objects, it can be freed in free_slab() which will +call kfree() to free the objcg pointer array in +memcg_alloc_page_obj_cgroups(). If it happens that the objcg pointer +array is the last used object in its slab, that slab may then be freed +which may caused kfree() to be called again. + +With the right workload, the slab cache may be set up in a way that allows +the recursive kfree() calling loop to nest deep enough to cause a kernel +stack overflow and panic the system. In fact, we have a reproducer that +can cause kernel stack overflow on a s390 system involving kmalloc-rcl-256 +and kmalloc-rcl-128 slabs with the following kfree() loop recursively +called 74 times: + + [ 285.520739] [<000000000ec432fc>] kfree+0x4bc/0x560 [ 285.520740] +[<000000000ec43466>] __free_slab+0xc6/0x228 [ 285.520741] +[<000000000ec41fc2>] __slab_free+0x3c2/0x3e0 [ 285.520742] +[<000000000ec432fc>] kfree+0x4bc/0x560 : While investigating this issue, I +also found an issue on the allocation side. If the objcg pointer array +happen to come from the same slab or a circular dependency linkage is +formed with multiple slabs, those affected slabs can never be freed again. + +This patch series addresses these two issues by introducing a new set of +kmalloc-cg- caches split from kmalloc- caches. The new set will +only contain non-reclaimable and non-dma objects that are accounted in +memory cgroups whereas the old set are now for unaccounted objects only. +By making this split, all the objcg pointer arrays will come from the +kmalloc- caches, but those caches will never hold any objcg pointer +array. As a result, deeply nested kfree() call and the unfreeable slab +problems are now gone. + +This patch (of 4): + +Since the merging of the new slab memory controller in v5.9, the page +structure may store a pointer to obj_cgroup pointer array for slab pages. +Currently, only the __GFP_ACCOUNT bit is masked off. However, the array +is not readily reclaimable and doesn't need to come from the DMA buffer. +So those GFP bits should be masked off as well. + +Do the flag bit clearing at memcg_alloc_page_obj_cgroups() to make sure +that it is consistently applied no matter where it is called. + +Link: https://lkml.kernel.org/r/20210505200610.13943-1-longman@redhat.com +Link: https://lkml.kernel.org/r/20210505200610.13943-2-longman@redhat.com +Fixes: 286e04b8ed7a ("mm: memcg/slab: allocate obj_cgroups for non-root slab pages") +Signed-off-by: Waiman Long +Reviewed-by: Shakeel Butt +Acked-by: Roman Gushchin +Reviewed-by: Vlastimil Babka +Cc: Johannes Weiner +Cc: Michal Hocko +Cc: Vladimir Davydov +Cc: Christoph Lameter +Cc: Pekka Enberg +Cc: David Rientjes +Cc: Joonsoo Kim +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/memcontrol.c | 8 ++++++++ + mm/slab.h | 1 - + 2 files changed, 8 insertions(+), 1 deletion(-) + +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index e876ba693998..769b73151f05 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -2906,6 +2906,13 @@ static void commit_charge(struct page *page, struct mem_cgroup *memcg) + } + + #ifdef CONFIG_MEMCG_KMEM ++/* ++ * The allocated objcg pointers array is not accounted directly. ++ * Moreover, it should not come from DMA buffer and is not readily ++ * reclaimable. So those GFP bits should be masked off. ++ */ ++#define OBJCGS_CLEAR_MASK (__GFP_DMA | __GFP_RECLAIMABLE | __GFP_ACCOUNT) ++ + int memcg_alloc_page_obj_cgroups(struct page *page, struct kmem_cache *s, + gfp_t gfp, bool new_page) + { +@@ -2913,6 +2920,7 @@ int memcg_alloc_page_obj_cgroups(struct page *page, struct kmem_cache *s, + unsigned long memcg_data; + void *vec; + ++ gfp &= ~OBJCGS_CLEAR_MASK; + vec = kcalloc_node(objects, sizeof(struct obj_cgroup *), gfp, + page_to_nid(page)); + if (!vec) +diff --git a/mm/slab.h b/mm/slab.h +index 076582f58f68..440133f93a53 100644 +--- a/mm/slab.h ++++ b/mm/slab.h +@@ -309,7 +309,6 @@ static inline void memcg_slab_post_alloc_hook(struct kmem_cache *s, + if (!memcg_kmem_enabled() || !objcg) + return; + +- flags &= ~__GFP_ACCOUNT; + for (i = 0; i < size; i++) { + if (likely(p[i])) { + page = virt_to_head_page(p[i]); +-- +2.30.2 + diff --git a/queue-5.12/mm-migrate-fix-missing-update-page_private-to-hugetl.patch b/queue-5.12/mm-migrate-fix-missing-update-page_private-to-hugetl.patch new file mode 100644 index 00000000000..5b279adee8e --- /dev/null +++ b/queue-5.12/mm-migrate-fix-missing-update-page_private-to-hugetl.patch @@ -0,0 +1,82 @@ +From 36a697222a1b024e677a63cf45e29fba395fabcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:51:29 -0700 +Subject: mm: migrate: fix missing update page_private to hugetlb_page_subpool + +From: Muchun Song + +[ Upstream commit 6acfb5ba150cf75005ce85e0e25d79ef2fec287c ] + +Since commit d6995da31122 ("hugetlb: use page.private for hugetlb specific +page flags") converts page.private for hugetlb specific page flags. We +should use hugetlb_page_subpool() to get the subpool pointer instead of +page_private(). + +This 'could' prevent the migration of hugetlb pages. page_private(hpage) +is now used for hugetlb page specific flags. At migration time, the only +flag which could be set is HPageVmemmapOptimized. This flag will only be +set if the new vmemmap reduction feature is enabled. In addition, +!page_mapping() implies an anonymous mapping. So, this will prevent +migration of hugetb pages in anonymous mappings if the vmemmap reduction +feature is enabled. + +In addition, that if statement checked for the rare race condition of a +page being migrated while in the process of being freed. Since that check +is now wrong, we could leak hugetlb subpool usage counts. + +The commit forgot to update it in the page migration routine. So fix it. + +[songmuchun@bytedance.com: fix compiler error when !CONFIG_HUGETLB_PAGE reported by Randy] + Link: https://lkml.kernel.org/r/20210521022747.35736-1-songmuchun@bytedance.com + +Link: https://lkml.kernel.org/r/20210520025949.1866-1-songmuchun@bytedance.com +Fixes: d6995da31122 ("hugetlb: use page.private for hugetlb specific page flags") +Signed-off-by: Muchun Song +Reported-by: Anshuman Khandual +Reviewed-by: Mike Kravetz +Acked-by: Michal Hocko +Tested-by: Anshuman Khandual [arm64] +Cc: Oscar Salvador +Cc: David Hildenbrand +Cc: Matthew Wilcox +Cc: Xiongchun Duan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/hugetlb.h | 5 +++++ + mm/migrate.c | 2 +- + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h +index 28fa3f9bbbfd..7bbef3f195ae 100644 +--- a/include/linux/hugetlb.h ++++ b/include/linux/hugetlb.h +@@ -862,6 +862,11 @@ static inline void huge_ptep_modify_prot_commit(struct vm_area_struct *vma, + #else /* CONFIG_HUGETLB_PAGE */ + struct hstate {}; + ++static inline struct hugepage_subpool *hugetlb_page_subpool(struct page *hpage) ++{ ++ return NULL; ++} ++ + static inline struct page *alloc_huge_page(struct vm_area_struct *vma, + unsigned long addr, + int avoid_reserve) +diff --git a/mm/migrate.c b/mm/migrate.c +index 40455e753c5b..3138600cf435 100644 +--- a/mm/migrate.c ++++ b/mm/migrate.c +@@ -1315,7 +1315,7 @@ static int unmap_and_move_huge_page(new_page_t get_new_page, + * page_mapping() set, hugetlbfs specific move page routine will not + * be called and we could leak usage counts for subpools. + */ +- if (page_private(hpage) && !page_mapping(hpage)) { ++ if (hugetlb_page_subpool(hpage) && !page_mapping(hpage)) { + rc = -EBUSY; + goto out_unlock; + } +-- +2.30.2 + diff --git a/queue-5.12/mm-mmap_lock-use-local-locks-instead-of-disabling-pr.patch b/queue-5.12/mm-mmap_lock-use-local-locks-instead-of-disabling-pr.patch new file mode 100644 index 00000000000..d3785aa4ea6 --- /dev/null +++ b/queue-5.12/mm-mmap_lock-use-local-locks-instead-of-disabling-pr.patch @@ -0,0 +1,146 @@ +From b002037bb76369cafcabef53932ecb79eb6b3be8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 19:35:13 -0700 +Subject: mm: mmap_lock: use local locks instead of disabling preemption + +From: Nicolas Saenz Julienne + +[ Upstream commit 832b50725373e8c46781b7d4db104ec9cf564a6b ] + +mmap_lock will explicitly disable/enable preemption upon manipulating its +local CPU variables. This is to be expected, but in this case, it doesn't +play well with PREEMPT_RT. The preemption disabled code section also +takes a spin-lock. Spin-locks in RT systems will try to schedule, which +is exactly what we're trying to avoid. + +To mitigate this, convert the explicit preemption handling to local_locks. +Which are RT aware, and will disable migration instead of preemption when +PREEMPT_RT=y. + +The faulty call trace looks like the following: + __mmap_lock_do_trace_*() + preempt_disable() + get_mm_memcg_path() + cgroup_path() + kernfs_path_from_node() + spin_lock_irqsave() /* Scheduling while atomic! */ + +Link: https://lkml.kernel.org/r/20210604163506.2103900-1-nsaenzju@redhat.com +Fixes: 2b5067a8143e3 ("mm: mmap_lock: add tracepoints around lock acquisition ") +Signed-off-by: Nicolas Saenz Julienne +Tested-by: Axel Rasmussen +Reviewed-by: Axel Rasmussen +Cc: Vlastimil Babka +Cc: Steven Rostedt +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/mmap_lock.c | 33 ++++++++++++++++++++++----------- + 1 file changed, 22 insertions(+), 11 deletions(-) + +diff --git a/mm/mmap_lock.c b/mm/mmap_lock.c +index dcdde4f722a4..2ae3f33b85b1 100644 +--- a/mm/mmap_lock.c ++++ b/mm/mmap_lock.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + + EXPORT_TRACEPOINT_SYMBOL(mmap_lock_start_locking); + EXPORT_TRACEPOINT_SYMBOL(mmap_lock_acquire_returned); +@@ -39,21 +40,30 @@ static int reg_refcount; /* Protected by reg_lock. */ + */ + #define CONTEXT_COUNT 4 + +-static DEFINE_PER_CPU(char __rcu *, memcg_path_buf); ++struct memcg_path { ++ local_lock_t lock; ++ char __rcu *buf; ++ local_t buf_idx; ++}; ++static DEFINE_PER_CPU(struct memcg_path, memcg_paths) = { ++ .lock = INIT_LOCAL_LOCK(lock), ++ .buf_idx = LOCAL_INIT(0), ++}; ++ + static char **tmp_bufs; +-static DEFINE_PER_CPU(int, memcg_path_buf_idx); + + /* Called with reg_lock held. */ + static void free_memcg_path_bufs(void) + { ++ struct memcg_path *memcg_path; + int cpu; + char **old = tmp_bufs; + + for_each_possible_cpu(cpu) { +- *(old++) = rcu_dereference_protected( +- per_cpu(memcg_path_buf, cpu), ++ memcg_path = per_cpu_ptr(&memcg_paths, cpu); ++ *(old++) = rcu_dereference_protected(memcg_path->buf, + lockdep_is_held(®_lock)); +- rcu_assign_pointer(per_cpu(memcg_path_buf, cpu), NULL); ++ rcu_assign_pointer(memcg_path->buf, NULL); + } + + /* Wait for inflight memcg_path_buf users to finish. */ +@@ -88,7 +98,7 @@ int trace_mmap_lock_reg(void) + new = kmalloc(MEMCG_PATH_BUF_SIZE * CONTEXT_COUNT, GFP_KERNEL); + if (new == NULL) + goto out_fail_free; +- rcu_assign_pointer(per_cpu(memcg_path_buf, cpu), new); ++ rcu_assign_pointer(per_cpu_ptr(&memcg_paths, cpu)->buf, new); + /* Don't need to wait for inflights, they'd have gotten NULL. */ + } + +@@ -122,23 +132,24 @@ out: + + static inline char *get_memcg_path_buf(void) + { ++ struct memcg_path *memcg_path = this_cpu_ptr(&memcg_paths); + char *buf; + int idx; + + rcu_read_lock(); +- buf = rcu_dereference(*this_cpu_ptr(&memcg_path_buf)); ++ buf = rcu_dereference(memcg_path->buf); + if (buf == NULL) { + rcu_read_unlock(); + return NULL; + } +- idx = this_cpu_add_return(memcg_path_buf_idx, MEMCG_PATH_BUF_SIZE) - ++ idx = local_add_return(MEMCG_PATH_BUF_SIZE, &memcg_path->buf_idx) - + MEMCG_PATH_BUF_SIZE; + return &buf[idx]; + } + + static inline void put_memcg_path_buf(void) + { +- this_cpu_sub(memcg_path_buf_idx, MEMCG_PATH_BUF_SIZE); ++ local_sub(MEMCG_PATH_BUF_SIZE, &this_cpu_ptr(&memcg_paths)->buf_idx); + rcu_read_unlock(); + } + +@@ -179,14 +190,14 @@ out: + #define TRACE_MMAP_LOCK_EVENT(type, mm, ...) \ + do { \ + const char *memcg_path; \ +- preempt_disable(); \ ++ local_lock(&memcg_paths.lock); \ + memcg_path = get_mm_memcg_path(mm); \ + trace_mmap_lock_##type(mm, \ + memcg_path != NULL ? memcg_path : "", \ + ##__VA_ARGS__); \ + if (likely(memcg_path != NULL)) \ + put_memcg_path_buf(); \ +- preempt_enable(); \ ++ local_unlock(&memcg_paths.lock); \ + } while (0) + + #else /* !CONFIG_MEMCG */ +-- +2.30.2 + diff --git a/queue-5.12/mm-page_alloc-fix-counting-of-managed_pages.patch b/queue-5.12/mm-page_alloc-fix-counting-of-managed_pages.patch new file mode 100644 index 00000000000..e96c70ecf4d --- /dev/null +++ b/queue-5.12/mm-page_alloc-fix-counting-of-managed_pages.patch @@ -0,0 +1,56 @@ +From 16b4af5ecafefd5b8f03768d778ead205657b766 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 19:42:33 -0700 +Subject: mm/page_alloc: fix counting of managed_pages + +From: Liu Shixin + +[ Upstream commit f7ec104458e00d27a190348ac3a513f3df3699a4 ] + +commit f63661566fad ("mm/page_alloc.c: clear out zone->lowmem_reserve[] if +the zone is empty") clears out zone->lowmem_reserve[] if zone is empty. +But when zone is not empty and sysctl_lowmem_reserve_ratio[i] is set to +zero, zone_managed_pages(zone) is not counted in the managed_pages either. +This is inconsistent with the description of lowmem_reserve, so fix it. + +Link: https://lkml.kernel.org/r/20210527125707.3760259-1-liushixin2@huawei.com +Fixes: f63661566fad ("mm/page_alloc.c: clear out zone->lowmem_reserve[] if the zone is empty") +Signed-off-by: Liu Shixin +Reported-by: yangerkun +Reviewed-by: Baoquan He +Acked-by: David Hildenbrand +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/page_alloc.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 25c83640d47a..382af5377274 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -7894,14 +7894,14 @@ static void setup_per_zone_lowmem_reserve(void) + unsigned long managed_pages = 0; + + for (j = i + 1; j < MAX_NR_ZONES; j++) { +- if (clear) { +- zone->lowmem_reserve[j] = 0; +- } else { +- struct zone *upper_zone = &pgdat->node_zones[j]; ++ struct zone *upper_zone = &pgdat->node_zones[j]; ++ ++ managed_pages += zone_managed_pages(upper_zone); + +- managed_pages += zone_managed_pages(upper_zone); ++ if (clear) ++ zone->lowmem_reserve[j] = 0; ++ else + zone->lowmem_reserve[j] = managed_pages / ratio; +- } + } + } + } +-- +2.30.2 + diff --git a/queue-5.12/mm-shmem-fix-shmem_swapin-race-with-swapoff.patch b/queue-5.12/mm-shmem-fix-shmem_swapin-race-with-swapoff.patch new file mode 100644 index 00000000000..dd98518269c --- /dev/null +++ b/queue-5.12/mm-shmem-fix-shmem_swapin-race-with-swapoff.patch @@ -0,0 +1,99 @@ +From 81af72933f8c78608235bdebfc5f7726d6087a6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 19:36:57 -0700 +Subject: mm/shmem: fix shmem_swapin() race with swapoff + +From: Miaohe Lin + +[ Upstream commit 2efa33fc7f6ec94a3a538c1a264273c889be2b36 ] + +When I was investigating the swap code, I found the below possible race +window: + +CPU 1 CPU 2 +----- ----- +shmem_swapin + swap_cluster_readahead + if (likely(si->flags & (SWP_BLKDEV | SWP_FS_OPS))) { + swapoff + .. + si->swap_file = NULL; + .. + struct inode *inode = si->swap_file->f_mapping->host;[oops!] + +Close this race window by using get/put_swap_device() to guard against +concurrent swapoff. + +Link: https://lkml.kernel.org/r/20210426123316.806267-5-linmiaohe@huawei.com +Fixes: 8fd2e0b505d1 ("mm: swap: check if swap backing device is congested or not") +Signed-off-by: Miaohe Lin +Reviewed-by: "Huang, Ying" +Cc: Dennis Zhou +Cc: Tim Chen +Cc: Hugh Dickins +Cc: Johannes Weiner +Cc: Michal Hocko +Cc: Joonsoo Kim +Cc: Alex Shi +Cc: Matthew Wilcox +Cc: Minchan Kim +Cc: Wei Yang +Cc: Yang Shi +Cc: David Hildenbrand +Cc: Yu Zhao +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/shmem.c | 14 +++++++++++++- + 1 file changed, 13 insertions(+), 1 deletion(-) + +diff --git a/mm/shmem.c b/mm/shmem.c +index 6e99a4ad6e1f..1a03744240e7 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -1696,7 +1696,8 @@ static int shmem_swapin_page(struct inode *inode, pgoff_t index, + struct address_space *mapping = inode->i_mapping; + struct shmem_inode_info *info = SHMEM_I(inode); + struct mm_struct *charge_mm = vma ? vma->vm_mm : current->mm; +- struct page *page; ++ struct swap_info_struct *si; ++ struct page *page = NULL; + swp_entry_t swap; + int error; + +@@ -1704,6 +1705,12 @@ static int shmem_swapin_page(struct inode *inode, pgoff_t index, + swap = radix_to_swp_entry(*pagep); + *pagep = NULL; + ++ /* Prevent swapoff from happening to us. */ ++ si = get_swap_device(swap); ++ if (!si) { ++ error = EINVAL; ++ goto failed; ++ } + /* Look it up and read it in.. */ + page = lookup_swap_cache(swap, NULL, 0); + if (!page) { +@@ -1765,6 +1772,8 @@ static int shmem_swapin_page(struct inode *inode, pgoff_t index, + swap_free(swap); + + *pagep = page; ++ if (si) ++ put_swap_device(si); + return 0; + failed: + if (!shmem_confirm_swap(mapping, index, swap)) +@@ -1775,6 +1784,9 @@ unlock: + put_page(page); + } + ++ if (si) ++ put_swap_device(si); ++ + return error; + } + +-- +2.30.2 + diff --git a/queue-5.12/mm-z3fold-fix-potential-memory-leak-in-z3fold_destro.patch b/queue-5.12/mm-z3fold-fix-potential-memory-leak-in-z3fold_destro.patch new file mode 100644 index 00000000000..285dae8ec9a --- /dev/null +++ b/queue-5.12/mm-z3fold-fix-potential-memory-leak-in-z3fold_destro.patch @@ -0,0 +1,40 @@ +From 2e4f67efb57519e79e86963ef47d3c724c6927bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:50:36 -0700 +Subject: mm/z3fold: fix potential memory leak in z3fold_destroy_pool() + +From: Miaohe Lin + +[ Upstream commit dac0d1cfda56472378d330b1b76b9973557a7b1d ] + +There is a memory leak in z3fold_destroy_pool() as it forgets to +free_percpu pool->unbuddied. Call free_percpu for pool->unbuddied to fix +this issue. + +Link: https://lkml.kernel.org/r/20210619093151.1492174-6-linmiaohe@huawei.com +Fixes: d30561c56f41 ("z3fold: use per-cpu unbuddied lists") +Signed-off-by: Miaohe Lin +Reviewed-by: Vitaly Wool +Cc: Hillf Danton +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/z3fold.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/mm/z3fold.c b/mm/z3fold.c +index 9d889ad2bb86..56a5551f2ba8 100644 +--- a/mm/z3fold.c ++++ b/mm/z3fold.c +@@ -1059,6 +1059,7 @@ static void z3fold_destroy_pool(struct z3fold_pool *pool) + destroy_workqueue(pool->compact_wq); + destroy_workqueue(pool->release_wq); + z3fold_unregister_migration(pool); ++ free_percpu(pool->unbuddied); + kfree(pool); + } + +-- +2.30.2 + diff --git a/queue-5.12/mm-z3fold-use-release_z3fold_page_locked-to-release-.patch b/queue-5.12/mm-z3fold-use-release_z3fold_page_locked-to-release-.patch new file mode 100644 index 00000000000..ae7fb15d273 --- /dev/null +++ b/queue-5.12/mm-z3fold-use-release_z3fold_page_locked-to-release-.patch @@ -0,0 +1,41 @@ +From ee743b257033140f98d9d51e350a8701c21cf0b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:50:39 -0700 +Subject: mm/z3fold: use release_z3fold_page_locked() to release locked z3fold + page + +From: Miaohe Lin + +[ Upstream commit 28473d91ff7f686d58047ff55f2fa98ab59114a4 ] + +We should use release_z3fold_page_locked() to release z3fold page when +it's locked, although it looks harmless to use release_z3fold_page() now. + +Link: https://lkml.kernel.org/r/20210619093151.1492174-7-linmiaohe@huawei.com +Fixes: dcf5aedb24f8 ("z3fold: stricter locking and more careful reclaim") +Signed-off-by: Miaohe Lin +Reviewed-by: Vitaly Wool +Cc: Hillf Danton +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/z3fold.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/z3fold.c b/mm/z3fold.c +index 56a5551f2ba8..7c417fb8404a 100644 +--- a/mm/z3fold.c ++++ b/mm/z3fold.c +@@ -1383,7 +1383,7 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries) + if (zhdr->foreign_handles || + test_and_set_bit(PAGE_CLAIMED, &page->private)) { + if (kref_put(&zhdr->refcount, +- release_z3fold_page)) ++ release_z3fold_page_locked)) + atomic64_dec(&pool->pages_nr); + else + z3fold_page_unlock(zhdr); +-- +2.30.2 + diff --git a/queue-5.12/mm-zswap.c-fix-two-bugs-in-zswap_writeback_entry.patch b/queue-5.12/mm-zswap.c-fix-two-bugs-in-zswap_writeback_entry.patch new file mode 100644 index 00000000000..de186a2b892 --- /dev/null +++ b/queue-5.12/mm-zswap.c-fix-two-bugs-in-zswap_writeback_entry.patch @@ -0,0 +1,71 @@ +From 5749b22a62f190f03d0f2c9a0b8bf1702c79c58e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:52:55 -0700 +Subject: mm/zswap.c: fix two bugs in zswap_writeback_entry() + +From: Miaohe Lin + +[ Upstream commit 46b76f2e09dc35f70aca2f4349eb0d158f53fe93 ] + +In the ZSWAP_SWAPCACHE_FAIL and ZSWAP_SWAPCACHE_EXIST case, we forgot to +call zpool_unmap_handle() when zpool can't sleep. And we might sleep in +zswap_get_swap_cache_page() while zpool can't sleep. To fix all of these, +zpool_unmap_handle() should be done before zswap_get_swap_cache_page() +when zpool can't sleep. + +Link: https://lkml.kernel.org/r/20210522092242.3233191-4-linmiaohe@huawei.com +Fixes: fc6697a89f56 ("mm/zswap: add the flag can_sleep_mapped") +Signed-off-by: Miaohe Lin +Cc: Colin Ian King +Cc: Dan Streetman +Cc: Nathan Chancellor +Cc: Sebastian Andrzej Siewior +Cc: Seth Jennings +Cc: Tian Tao +Cc: Vitaly Wool +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/zswap.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +diff --git a/mm/zswap.c b/mm/zswap.c +index 578d9f256920..91f7439fde7f 100644 +--- a/mm/zswap.c ++++ b/mm/zswap.c +@@ -967,6 +967,13 @@ static int zswap_writeback_entry(struct zpool *pool, unsigned long handle) + spin_unlock(&tree->lock); + BUG_ON(offset != entry->offset); + ++ src = (u8 *)zhdr + sizeof(struct zswap_header); ++ if (!zpool_can_sleep_mapped(pool)) { ++ memcpy(tmp, src, entry->length); ++ src = tmp; ++ zpool_unmap_handle(pool, handle); ++ } ++ + /* try to allocate swap cache page */ + switch (zswap_get_swap_cache_page(swpentry, &page)) { + case ZSWAP_SWAPCACHE_FAIL: /* no memory or invalidate happened */ +@@ -982,17 +989,7 @@ static int zswap_writeback_entry(struct zpool *pool, unsigned long handle) + case ZSWAP_SWAPCACHE_NEW: /* page is locked */ + /* decompress */ + acomp_ctx = raw_cpu_ptr(entry->pool->acomp_ctx); +- + dlen = PAGE_SIZE; +- src = (u8 *)zhdr + sizeof(struct zswap_header); +- +- if (!zpool_can_sleep_mapped(pool)) { +- +- memcpy(tmp, src, entry->length); +- src = tmp; +- +- zpool_unmap_handle(pool, handle); +- } + + mutex_lock(acomp_ctx->mutex); + sg_init_one(&input, src, entry->length); +-- +2.30.2 + diff --git a/queue-5.12/mmc-sdhci-of-aspeed-turn-down-a-phase-correction-war.patch b/queue-5.12/mmc-sdhci-of-aspeed-turn-down-a-phase-correction-war.patch new file mode 100644 index 00000000000..783f00ef1b2 --- /dev/null +++ b/queue-5.12/mmc-sdhci-of-aspeed-turn-down-a-phase-correction-war.patch @@ -0,0 +1,45 @@ +From 3bd6e5c42a7c5549822231d41da771f1ae5120df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 11:00:20 +0930 +Subject: mmc: sdhci-of-aspeed: Turn down a phase correction warning + +From: Andrew Jeffery + +[ Upstream commit a7ab186f60785850b5af1be183867000485ad491 ] + +The card timing and the bus frequency are not changed atomically with +respect to calls to the set_clock() callback in the driver. The result +is the driver sees a transient state where there's a mismatch between +the two and thus the inputs to the phase correction calculation +formula are garbage. + +Switch from dev_warn() to dev_dbg() to avoid noise in the normal case, +though the change does make bad configurations less likely to be +noticed. + +Reported-by: Joel Stanley +Signed-off-by: Andrew Jeffery +Reviewed-by: Joel Stanley +Link: https://lore.kernel.org/r/20210607013020.85885-1-andrew@aj.id.au +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-of-aspeed.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/sdhci-of-aspeed.c b/drivers/mmc/host/sdhci-of-aspeed.c +index 7d8692e90996..b6ac2af199b8 100644 +--- a/drivers/mmc/host/sdhci-of-aspeed.c ++++ b/drivers/mmc/host/sdhci-of-aspeed.c +@@ -150,7 +150,7 @@ static int aspeed_sdhci_phase_to_tap(struct device *dev, unsigned long rate_hz, + + tap = div_u64(phase_period_ps, prop_delay_ps); + if (tap > ASPEED_SDHCI_NR_TAPS) { +- dev_warn(dev, ++ dev_dbg(dev, + "Requested out of range phase tap %d for %d degrees of phase compensation at %luHz, clamping to tap %d\n", + tap, phase_deg, rate_hz, ASPEED_SDHCI_NR_TAPS); + tap = ASPEED_SDHCI_NR_TAPS; +-- +2.30.2 + diff --git a/queue-5.12/mmc-sdhci-sprd-use-sdhci_sprd_writew.patch b/queue-5.12/mmc-sdhci-sprd-use-sdhci_sprd_writew.patch new file mode 100644 index 00000000000..5f6f2425647 --- /dev/null +++ b/queue-5.12/mmc-sdhci-sprd-use-sdhci_sprd_writew.patch @@ -0,0 +1,37 @@ +From 2e5bcfd94fcb12e2125312fdb4630de3a074dd34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 11:54:03 +0200 +Subject: mmc: sdhci-sprd: use sdhci_sprd_writew + +From: Krzysztof Kozlowski + +[ Upstream commit 961470820021e6f9d74db4837bd6831a1a30341b ] + +The sdhci_sprd_writew() was defined by never used in sdhci_ops: + + drivers/mmc/host/sdhci-sprd.c:134:20: warning: unused function 'sdhci_sprd_writew' + +Reported-by: kernel test robot +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210601095403.236007-2-krzysztof.kozlowski@canonical.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/sdhci-sprd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/sdhci-sprd.c b/drivers/mmc/host/sdhci-sprd.c +index 5dc36efff47f..11e375579cfb 100644 +--- a/drivers/mmc/host/sdhci-sprd.c ++++ b/drivers/mmc/host/sdhci-sprd.c +@@ -393,6 +393,7 @@ static void sdhci_sprd_request_done(struct sdhci_host *host, + static struct sdhci_ops sdhci_sprd_ops = { + .read_l = sdhci_sprd_readl, + .write_l = sdhci_sprd_writel, ++ .write_w = sdhci_sprd_writew, + .write_b = sdhci_sprd_writeb, + .set_clock = sdhci_sprd_set_clock, + .get_max_clock = sdhci_sprd_get_max_clock, +-- +2.30.2 + diff --git a/queue-5.12/mmc-usdhi6rol0-fix-error-return-code-in-usdhi6_probe.patch b/queue-5.12/mmc-usdhi6rol0-fix-error-return-code-in-usdhi6_probe.patch new file mode 100644 index 00000000000..5aa7981fbb9 --- /dev/null +++ b/queue-5.12/mmc-usdhi6rol0-fix-error-return-code-in-usdhi6_probe.patch @@ -0,0 +1,37 @@ +From c38c9c9d88ef4a5ea359f52fb6d3904386261222 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 10:03:21 +0800 +Subject: mmc: usdhi6rol0: fix error return code in usdhi6_probe() + +From: Zhen Lei + +[ Upstream commit 2f9ae69e5267f53e89e296fccee291975a85f0eb ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 75fa9ea6e3c0 ("mmc: add a driver for the Renesas usdhi6rol0 SD/SDIO host controller") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210508020321.1677-1-thunder.leizhen@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/usdhi6rol0.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/usdhi6rol0.c b/drivers/mmc/host/usdhi6rol0.c +index 615f3d008af1..b9b79b1089a0 100644 +--- a/drivers/mmc/host/usdhi6rol0.c ++++ b/drivers/mmc/host/usdhi6rol0.c +@@ -1801,6 +1801,7 @@ static int usdhi6_probe(struct platform_device *pdev) + + version = usdhi6_read(host, USDHI6_VERSION); + if ((version & 0xfff) != 0xa0d) { ++ ret = -EPERM; + dev_err(dev, "Version not recognized %x\n", version); + goto e_clk_off; + } +-- +2.30.2 + diff --git a/queue-5.12/mmc-via-sdmmc-add-a-check-against-null-pointer-deref.patch b/queue-5.12/mmc-via-sdmmc-add-a-check-against-null-pointer-deref.patch new file mode 100644 index 00000000000..8033fb3de44 --- /dev/null +++ b/queue-5.12/mmc-via-sdmmc-add-a-check-against-null-pointer-deref.patch @@ -0,0 +1,140 @@ +From db625e0a900c919eb48939182b8946a3da2686a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 13:33:20 +0000 +Subject: mmc: via-sdmmc: add a check against NULL pointer dereference + +From: Zheyu Ma + +[ Upstream commit 45c8ddd06c4b729c56a6083ab311bfbd9643f4a6 ] + +Before referencing 'host->data', the driver needs to check whether it is +null pointer, otherwise it will cause a null pointer reference. + +This log reveals it: + +[ 29.355199] BUG: kernel NULL pointer dereference, address: +0000000000000014 +[ 29.357323] #PF: supervisor write access in kernel mode +[ 29.357706] #PF: error_code(0x0002) - not-present page +[ 29.358088] PGD 0 P4D 0 +[ 29.358280] Oops: 0002 [#1] PREEMPT SMP PTI +[ 29.358595] CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.12.4- +g70e7f0549188-dirty #102 +[ 29.359164] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), +BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +[ 29.359978] RIP: 0010:via_sdc_isr+0x21f/0x410 +[ 29.360314] Code: ff ff e8 84 aa d0 fd 66 45 89 7e 28 66 41 f7 c4 00 +10 75 56 e8 72 aa d0 fd 66 41 f7 c4 00 c0 74 10 e8 65 aa d0 fd 48 8b 43 +18 40 14 ac ff ff ff e8 55 aa d0 fd 48 89 df e8 ad fb ff ff e9 77 +[ 29.361661] RSP: 0018:ffffc90000118e98 EFLAGS: 00010046 +[ 29.362042] RAX: 0000000000000000 RBX: ffff888107d77880 +RCX: 0000000000000000 +[ 29.362564] RDX: 0000000000000000 RSI: ffffffff835d20bb +RDI: 00000000ffffffff +[ 29.363085] RBP: ffffc90000118ed8 R08: 0000000000000001 +R09: 0000000000000001 +[ 29.363604] R10: 0000000000000000 R11: 0000000000000001 +R12: 0000000000008600 +[ 29.364128] R13: ffff888107d779c8 R14: ffffc90009c00200 +R15: 0000000000008000 +[ 29.364651] FS: 0000000000000000(0000) GS:ffff88817bc80000(0000) +knlGS:0000000000000000 +[ 29.365235] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 29.365655] CR2: 0000000000000014 CR3: 0000000005a2e000 +CR4: 00000000000006e0 +[ 29.366170] DR0: 0000000000000000 DR1: 0000000000000000 +DR2: 0000000000000000 +[ 29.366683] DR3: 0000000000000000 DR6: 00000000fffe0ff0 +DR7: 0000000000000400 +[ 29.367197] Call Trace: +[ 29.367381] +[ 29.367537] __handle_irq_event_percpu+0x53/0x3e0 +[ 29.367916] handle_irq_event_percpu+0x35/0x90 +[ 29.368247] handle_irq_event+0x39/0x60 +[ 29.368632] handle_fasteoi_irq+0xc2/0x1d0 +[ 29.368950] __common_interrupt+0x7f/0x150 +[ 29.369254] common_interrupt+0xb4/0xd0 +[ 29.369547] +[ 29.369708] asm_common_interrupt+0x1e/0x40 +[ 29.370016] RIP: 0010:native_safe_halt+0x17/0x20 +[ 29.370360] Code: 07 0f 00 2d db 80 43 00 f4 5d c3 0f 1f 84 00 00 00 +00 00 8b 05 c2 37 e5 01 55 48 89 e5 85 c0 7e 07 0f 00 2d bb 80 43 00 fb +f4 <5d> c3 cc cc cc cc cc cc cc 55 48 89 e5 e8 67 53 ff ff 8b 0d f9 91 +[ 29.371696] RSP: 0018:ffffc9000008fe90 EFLAGS: 00000246 +[ 29.372079] RAX: 0000000000000000 RBX: 0000000000000002 +RCX: 0000000000000000 +[ 29.372595] RDX: 0000000000000000 RSI: ffffffff854f67a4 +RDI: ffffffff85403406 +[ 29.373122] RBP: ffffc9000008fe90 R08: 0000000000000001 +R09: 0000000000000001 +[ 29.373646] R10: 0000000000000000 R11: 0000000000000001 +R12: ffffffff86009188 +[ 29.374160] R13: 0000000000000000 R14: 0000000000000000 +R15: ffff888100258000 +[ 29.374690] default_idle+0x9/0x10 +[ 29.374944] arch_cpu_idle+0xa/0x10 +[ 29.375198] default_idle_call+0x6e/0x250 +[ 29.375491] do_idle+0x1f0/0x2d0 +[ 29.375740] cpu_startup_entry+0x18/0x20 +[ 29.376034] start_secondary+0x11f/0x160 +[ 29.376328] secondary_startup_64_no_verify+0xb0/0xbb +[ 29.376705] Modules linked in: +[ 29.376939] Dumping ftrace buffer: +[ 29.377187] (ftrace buffer empty) +[ 29.377460] CR2: 0000000000000014 +[ 29.377712] ---[ end trace 51a473dffb618c47 ]--- +[ 29.378056] RIP: 0010:via_sdc_isr+0x21f/0x410 +[ 29.378380] Code: ff ff e8 84 aa d0 fd 66 45 89 7e 28 66 41 f7 c4 00 +10 75 56 e8 72 aa d0 fd 66 41 f7 c4 00 c0 74 10 e8 65 aa d0 fd 48 8b 43 +18 40 14 ac ff ff ff e8 55 aa d0 fd 48 89 df e8 ad fb ff ff e9 77 +[ 29.379714] RSP: 0018:ffffc90000118e98 EFLAGS: 00010046 +[ 29.380098] RAX: 0000000000000000 RBX: ffff888107d77880 +RCX: 0000000000000000 +[ 29.380614] RDX: 0000000000000000 RSI: ffffffff835d20bb +RDI: 00000000ffffffff +[ 29.381134] RBP: ffffc90000118ed8 R08: 0000000000000001 +R09: 0000000000000001 +[ 29.381653] R10: 0000000000000000 R11: 0000000000000001 +R12: 0000000000008600 +[ 29.382176] R13: ffff888107d779c8 R14: ffffc90009c00200 +R15: 0000000000008000 +[ 29.382697] FS: 0000000000000000(0000) GS:ffff88817bc80000(0000) +knlGS:0000000000000000 +[ 29.383277] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 29.383697] CR2: 0000000000000014 CR3: 0000000005a2e000 +CR4: 00000000000006e0 +[ 29.384223] DR0: 0000000000000000 DR1: 0000000000000000 +DR2: 0000000000000000 +[ 29.384736] DR3: 0000000000000000 DR6: 00000000fffe0ff0 +DR7: 0000000000000400 +[ 29.385260] Kernel panic - not syncing: Fatal exception in interrupt +[ 29.385882] Dumping ftrace buffer: +[ 29.386135] (ftrace buffer empty) +[ 29.386401] Kernel Offset: disabled +[ 29.386656] Rebooting in 1 seconds.. + +Signed-off-by: Zheyu Ma +Link: https://lore.kernel.org/r/1622727200-15808-1-git-send-email-zheyuma97@gmail.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/via-sdmmc.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mmc/host/via-sdmmc.c b/drivers/mmc/host/via-sdmmc.c +index 4f4c0813f9fd..350e67056fa6 100644 +--- a/drivers/mmc/host/via-sdmmc.c ++++ b/drivers/mmc/host/via-sdmmc.c +@@ -857,6 +857,9 @@ static void via_sdc_data_isr(struct via_crdr_mmc_host *host, u16 intmask) + { + BUG_ON(intmask == 0); + ++ if (!host->data) ++ return; ++ + if (intmask & VIA_CRDR_SDSTS_DT) + host->data->error = -ETIMEDOUT; + else if (intmask & (VIA_CRDR_SDSTS_RC | VIA_CRDR_SDSTS_WC)) +-- +2.30.2 + diff --git a/queue-5.12/mptcp-fix-pr_debug-in-mptcp_token_new_connect.patch b/queue-5.12/mptcp-fix-pr_debug-in-mptcp_token_new_connect.patch new file mode 100644 index 00000000000..1fe91b49569 --- /dev/null +++ b/queue-5.12/mptcp-fix-pr_debug-in-mptcp_token_new_connect.patch @@ -0,0 +1,55 @@ +From bbf95712184c1e7e0e7b7d8e97c3fba1b794310c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 16:54:24 -0700 +Subject: mptcp: fix pr_debug in mptcp_token_new_connect + +From: Jianguo Wu + +[ Upstream commit 2f1af441fd5dd5caf0807bb19ce9bbf9325ce534 ] + +After commit 2c5ebd001d4f ("mptcp: refactor token container"), +pr_debug() is called before mptcp_crypto_key_gen_sha() in +mptcp_token_new_connect(), so the output local_key, token and +idsn are 0, like: + + MPTCP: ssk=00000000f6b3c4a2, local_key=0, token=0, idsn=0 + +Move pr_debug() after mptcp_crypto_key_gen_sha(). + +Fixes: 2c5ebd001d4f ("mptcp: refactor token container") +Acked-by: Paolo Abeni +Signed-off-by: Jianguo Wu +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/token.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/mptcp/token.c b/net/mptcp/token.c +index feb4b9ffd462..0691a4883f3a 100644 +--- a/net/mptcp/token.c ++++ b/net/mptcp/token.c +@@ -156,9 +156,6 @@ int mptcp_token_new_connect(struct sock *sk) + int retries = TOKEN_MAX_RETRIES; + struct token_bucket *bucket; + +- pr_debug("ssk=%p, local_key=%llu, token=%u, idsn=%llu\n", +- sk, subflow->local_key, subflow->token, subflow->idsn); +- + again: + mptcp_crypto_key_gen_sha(&subflow->local_key, &subflow->token, + &subflow->idsn); +@@ -172,6 +169,9 @@ again: + goto again; + } + ++ pr_debug("ssk=%p, local_key=%llu, token=%u, idsn=%llu\n", ++ sk, subflow->local_key, subflow->token, subflow->idsn); ++ + WRITE_ONCE(msk->token, subflow->token); + __sk_nulls_add_node_rcu((struct sock *)msk, &bucket->msk_chain); + bucket->chain_len++; +-- +2.30.2 + diff --git a/queue-5.12/mptcp-generate-subflow-hmac-after-mptcp_finish_join.patch b/queue-5.12/mptcp-generate-subflow-hmac-after-mptcp_finish_join.patch new file mode 100644 index 00000000000..c34f77623fb --- /dev/null +++ b/queue-5.12/mptcp-generate-subflow-hmac-after-mptcp_finish_join.patch @@ -0,0 +1,49 @@ +From 53c4b51fff0ae51408c50c392348a6497d1f3539 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 16:54:26 -0700 +Subject: mptcp: generate subflow hmac after mptcp_finish_join() + +From: Jianguo Wu + +[ Upstream commit 0a4d8e96e4fd687af92b961d5cdcea0fdbde05fe ] + +For outgoing subflow join, when recv SYNACK, in subflow_finish_connect(), +the mptcp_finish_join() may return false in some cases, and send a RESET +to remote, and no local hmac is required. +So generate subflow hmac after mptcp_finish_join(). + +Fixes: ec3edaa7ca6c ("mptcp: Add handling of outgoing MP_JOIN requests") +Signed-off-by: Jianguo Wu +Signed-off-by: Mat Martineau +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/mptcp/subflow.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index d6d8ad4f918e..189139b8d401 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -409,15 +409,15 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb) + goto do_reset; + } + ++ if (!mptcp_finish_join(sk)) ++ goto do_reset; ++ + subflow_generate_hmac(subflow->local_key, subflow->remote_key, + subflow->local_nonce, + subflow->remote_nonce, + hmac); + memcpy(subflow->hmac, hmac, MPTCPOPT_HMAC_LEN); + +- if (!mptcp_finish_join(sk)) +- goto do_reset; +- + subflow->mp_join = 1; + MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINSYNACKRX); + +-- +2.30.2 + diff --git a/queue-5.12/mt76-connac-alaways-wake-the-device-before-scanning.patch b/queue-5.12/mt76-connac-alaways-wake-the-device-before-scanning.patch new file mode 100644 index 00000000000..a0b79b46acb --- /dev/null +++ b/queue-5.12/mt76-connac-alaways-wake-the-device-before-scanning.patch @@ -0,0 +1,80 @@ +From 75f975f0c2cee9f83df702f25f431bee4b7f11a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Apr 2021 18:45:39 +0200 +Subject: mt76: connac: alaways wake the device before scanning + +From: Lorenzo Bianconi + +[ Upstream commit a61826203ba8806b4cdffd36bafdce3e9ad35c24 ] + +move scanning check from mt76_connac_power_save_sched routine +to mt7921_pm_power_save_work/mt7615_pm_power_save_work ones + +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/mac.c | 4 ++++ + drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c | 8 -------- + drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 4 ++++ + 3 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +index 8dccb589b756..d06e61cadc41 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/mac.c +@@ -1890,6 +1890,10 @@ void mt7615_pm_power_save_work(struct work_struct *work) + pm.ps_work.work); + + delta = dev->pm.idle_timeout; ++ if (test_bit(MT76_HW_SCANNING, &dev->mphy.state) || ++ test_bit(MT76_HW_SCHED_SCANNING, &dev->mphy.state)) ++ goto out; ++ + if (time_is_after_jiffies(dev->pm.last_activity + delta)) { + delta = dev->pm.last_activity + delta - jiffies; + goto out; +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +index c5f5037f5757..cff60b699e31 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mac.c +@@ -16,10 +16,6 @@ int mt76_connac_pm_wake(struct mt76_phy *phy, struct mt76_connac_pm *pm) + if (!test_bit(MT76_STATE_PM, &phy->state)) + return 0; + +- if (test_bit(MT76_HW_SCANNING, &phy->state) || +- test_bit(MT76_HW_SCHED_SCANNING, &phy->state)) +- return 0; +- + if (queue_work(dev->wq, &pm->wake_work)) + reinit_completion(&pm->wake_cmpl); + +@@ -45,10 +41,6 @@ void mt76_connac_power_save_sched(struct mt76_phy *phy, + + pm->last_activity = jiffies; + +- if (test_bit(MT76_HW_SCANNING, &phy->state) || +- test_bit(MT76_HW_SCHED_SCANNING, &phy->state)) +- return; +- + if (!test_bit(MT76_STATE_PM, &phy->state)) + queue_delayed_work(dev->wq, &pm->ps_work, pm->idle_timeout); + } +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +index 39be2e396269..c4b144391a8e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +@@ -1524,6 +1524,10 @@ void mt7921_pm_power_save_work(struct work_struct *work) + pm.ps_work.work); + + delta = dev->pm.idle_timeout; ++ if (test_bit(MT76_HW_SCANNING, &dev->mphy.state) || ++ test_bit(MT76_HW_SCHED_SCANNING, &dev->mphy.state)) ++ goto out; ++ + if (time_is_after_jiffies(dev->pm.last_activity + delta)) { + delta = dev->pm.last_activity + delta - jiffies; + goto out; +-- +2.30.2 + diff --git a/queue-5.12/mt76-connac-fix-wow-with-disconnetion-and-bitmap-pat.patch b/queue-5.12/mt76-connac-fix-wow-with-disconnetion-and-bitmap-pat.patch new file mode 100644 index 00000000000..894db5e88a8 --- /dev/null +++ b/queue-5.12/mt76-connac-fix-wow-with-disconnetion-and-bitmap-pat.patch @@ -0,0 +1,79 @@ +From 4e0b88024d9625b2a2ca1f1fc4ceecdeffbfd52c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 23:14:54 +0800 +Subject: mt76: connac: fix WoW with disconnetion and bitmap pattern + +From: YN Chen + +[ Upstream commit 193e5f22eeb2a9661bff8bc0d8519e6ded48c807 ] + +Update MCU command usage to fix WoW configuration with disconnection +and bitmap pattern and to avoid magic number. + +Fixes: ffa1bf97425b ("mt76: mt7921: introduce PM support") +Reviewed-by: Lorenzo Bianconi +Signed-off-by: YN Chen +Signed-off-by: Sean Wang +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 11 +++++++---- + drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h | 8 ++++++++ + 2 files changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +index cefd33b74a87..280aee1aa299 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c +@@ -1732,7 +1732,7 @@ mt76_connac_mcu_set_wow_pattern(struct mt76_dev *dev, + ptlv->index = index; + + memcpy(ptlv->pattern, pattern->pattern, pattern->pattern_len); +- memcpy(ptlv->mask, pattern->mask, pattern->pattern_len / 8); ++ memcpy(ptlv->mask, pattern->mask, DIV_ROUND_UP(pattern->pattern_len, 8)); + + return mt76_mcu_skb_send_msg(dev, skb, MCU_UNI_CMD_SUSPEND, true); + } +@@ -1767,14 +1767,17 @@ mt76_connac_mcu_set_wow_ctrl(struct mt76_phy *phy, struct ieee80211_vif *vif, + }; + + if (wowlan->magic_pkt) +- req.wow_ctrl_tlv.trigger |= BIT(0); ++ req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_MAGIC; + if (wowlan->disconnect) +- req.wow_ctrl_tlv.trigger |= BIT(2); ++ req.wow_ctrl_tlv.trigger |= (UNI_WOW_DETECT_TYPE_DISCONNECT | ++ UNI_WOW_DETECT_TYPE_BCN_LOST); + if (wowlan->nd_config) { + mt76_connac_mcu_sched_scan_req(phy, vif, wowlan->nd_config); +- req.wow_ctrl_tlv.trigger |= BIT(5); ++ req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT; + mt76_connac_mcu_sched_scan_enable(phy, vif, suspend); + } ++ if (wowlan->n_patterns) ++ req.wow_ctrl_tlv.trigger |= UNI_WOW_DETECT_TYPE_BITMAP; + + if (mt76_is_mmio(dev)) + req.wow_ctrl_tlv.wakeup_hif = WOW_PCIE; +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +index c1e1df5f7cd7..eea121101b5e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.h +@@ -589,6 +589,14 @@ enum { + UNI_OFFLOAD_OFFLOAD_BMC_RPY_DETECT, + }; + ++#define UNI_WOW_DETECT_TYPE_MAGIC BIT(0) ++#define UNI_WOW_DETECT_TYPE_ANY BIT(1) ++#define UNI_WOW_DETECT_TYPE_DISCONNECT BIT(2) ++#define UNI_WOW_DETECT_TYPE_GTK_REKEY_FAIL BIT(3) ++#define UNI_WOW_DETECT_TYPE_BCN_LOST BIT(4) ++#define UNI_WOW_DETECT_TYPE_SCH_SCAN_HIT BIT(5) ++#define UNI_WOW_DETECT_TYPE_BITMAP BIT(6) ++ + enum { + UNI_SUSPEND_MODE_SETTING, + UNI_SUSPEND_WOW_CTRL, +-- +2.30.2 + diff --git a/queue-5.12/mt76-fix-possible-null-pointer-dereference-in-mt76_t.patch b/queue-5.12/mt76-fix-possible-null-pointer-dereference-in-mt76_t.patch new file mode 100644 index 00000000000..ee04b55a032 --- /dev/null +++ b/queue-5.12/mt76-fix-possible-null-pointer-dereference-in-mt76_t.patch @@ -0,0 +1,36 @@ +From 686a3162a4a46fe9959a05477fef00983567b1bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 12:05:00 +0200 +Subject: mt76: fix possible NULL pointer dereference in mt76_tx + +From: Lorenzo Bianconi + +[ Upstream commit d7400a2f3e295b8cee692c7a66e10f60015a3c37 ] + +Even if this is not a real issue since mt76_tx is never run with wcid set +to NULL, fix a theoretical NULL pointer dereference in mt76_tx routine + +Fixes: db9f11d3433f7 ("mt76: store wcid tx rate info in one u32 reduce locking") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/tx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/tx.c b/drivers/net/wireless/mediatek/mt76/tx.c +index 451ed60c6296..802e3d733959 100644 +--- a/drivers/net/wireless/mediatek/mt76/tx.c ++++ b/drivers/net/wireless/mediatek/mt76/tx.c +@@ -285,7 +285,7 @@ mt76_tx(struct mt76_phy *phy, struct ieee80211_sta *sta, + skb_set_queue_mapping(skb, qid); + } + +- if (!(wcid->tx_info & MT_WCID_TX_INFO_SET)) ++ if (wcid && !(wcid->tx_info & MT_WCID_TX_INFO_SET)) + ieee80211_get_tx_rates(info->control.vif, sta, skb, + info->control.rates, 1); + +-- +2.30.2 + diff --git a/queue-5.12/mt76-mt7615-fix-null-pointer-dereference-in-tx_prepa.patch b/queue-5.12/mt76-mt7615-fix-null-pointer-dereference-in-tx_prepa.patch new file mode 100644 index 00000000000..a4adab992c3 --- /dev/null +++ b/queue-5.12/mt76-mt7615-fix-null-pointer-dereference-in-tx_prepa.patch @@ -0,0 +1,76 @@ +From 78056d15c543aca1ce34b207b8d6ddd4002e98ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 12:07:14 +0200 +Subject: mt76: mt7615: fix NULL pointer dereference in tx_prepare_skb() + +From: Lorenzo Bianconi + +[ Upstream commit 8d3cdc1bbb1d355f0ebef973175ae5fd74286feb ] + +Fix theoretical NULL pointer dereference in mt7615_tx_prepare_skb and +mt7663_usb_sdio_tx_prepare_skb routines. This issue has been identified +by code analysis. + +Fixes: 6aa4ed7927f11 ("mt76: mt7615: implement DMA support for MT7622") +Fixes: 4bb586bc33b98 ("mt76: mt7663u: sync probe sampling with rate configuration") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c | 5 +++-- + drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c | 5 +++-- + 2 files changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c +index 1b4cb145f38e..f2fbf11e0321 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c +@@ -133,20 +133,21 @@ int mt7615_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + struct mt76_tx_info *tx_info) + { + struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76); +- struct mt7615_sta *msta = container_of(wcid, struct mt7615_sta, wcid); + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb); + struct ieee80211_key_conf *key = info->control.hw_key; + int pid, id; + u8 *txwi = (u8 *)txwi_ptr; + struct mt76_txwi_cache *t; ++ struct mt7615_sta *msta; + void *txp; + ++ msta = wcid ? container_of(wcid, struct mt7615_sta, wcid) : NULL; + if (!wcid) + wcid = &dev->mt76.global_wcid; + + pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb); + +- if (info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) { ++ if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && msta) { + struct mt7615_phy *phy = &dev->phy; + + if ((info->hw_queue & MT_TX_HW_QUEUE_EXT_PHY) && mdev->phy2) +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c +index f8d3673c2cae..7010101f6b14 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c +@@ -191,14 +191,15 @@ int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, + struct ieee80211_sta *sta, + struct mt76_tx_info *tx_info) + { +- struct mt7615_sta *msta = container_of(wcid, struct mt7615_sta, wcid); + struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76); + struct sk_buff *skb = tx_info->skb; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); ++ struct mt7615_sta *msta; + int pad; + ++ msta = wcid ? container_of(wcid, struct mt7615_sta, wcid) : NULL; + if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && +- !msta->rate_probe) { ++ msta && !msta->rate_probe) { + /* request to configure sampling rate */ + spin_lock_bh(&dev->mt76.lock); + mt7615_mac_set_rates(&dev->phy, msta, &info->control.rates[0], +-- +2.30.2 + diff --git a/queue-5.12/mt76-mt7915-fix-rx-fcs-error-count-in-testmode.patch b/queue-5.12/mt76-mt7915-fix-rx-fcs-error-count-in-testmode.patch new file mode 100644 index 00000000000..9874b248e92 --- /dev/null +++ b/queue-5.12/mt76-mt7915-fix-rx-fcs-error-count-in-testmode.patch @@ -0,0 +1,76 @@ +From 005fc359a742d23fdc0a3969fc53e60bfc334c3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 14:55:58 +0800 +Subject: mt76: mt7915: fix rx fcs error count in testmode + +From: Shayne Chen + +[ Upstream commit 89043529c8b833d87391f1844e9d1cc1643393eb ] + +FCS error packets are filtered by default and won't be reported to +driver, so that RX fcs error and PER in testmode always show zero. +Fix this issue by reading fcs error count from hw counter. + +We did't fix this issue by disabling fcs error rx filter since it may +let HW suffer some SER errors. + +Fixes: 5d8a83f09941 ("mt76: mt7915: implement testmode rx support") +Signed-off-by: Shayne Chen +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../wireless/mediatek/mt76/mt7915/testmode.c | 21 +++++++++++++++++-- + 1 file changed, 19 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/testmode.c b/drivers/net/wireless/mediatek/mt76/mt7915/testmode.c +index bd798df748ba..8eb90722c532 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/testmode.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/testmode.c +@@ -476,10 +476,17 @@ mt7915_tm_set_tx_frames(struct mt7915_phy *phy, bool en) + static void + mt7915_tm_set_rx_frames(struct mt7915_phy *phy, bool en) + { +- if (en) ++ mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, false); ++ ++ if (en) { ++ struct mt7915_dev *dev = phy->dev; ++ + mt7915_tm_update_channel(phy); + +- mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en); ++ /* read-clear */ ++ mt76_rr(dev, MT_MIB_SDR3(phy != &dev->phy)); ++ mt7915_tm_set_trx(phy, TM_MAC_RX_RXV, en); ++ } + } + + static int +@@ -702,7 +709,11 @@ static int + mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg) + { + struct mt7915_phy *phy = mphy->priv; ++ struct mt7915_dev *dev = phy->dev; ++ bool ext_phy = phy != &dev->phy; ++ enum mt76_rxq_id q; + void *rx, *rssi; ++ u16 fcs_err; + int i; + + rx = nla_nest_start(msg, MT76_TM_STATS_ATTR_LAST_RX); +@@ -747,6 +758,12 @@ mt7915_tm_dump_stats(struct mt76_phy *mphy, struct sk_buff *msg) + + nla_nest_end(msg, rx); + ++ fcs_err = mt76_get_field(dev, MT_MIB_SDR3(ext_phy), ++ MT_MIB_SDR3_FCS_ERR_MASK); ++ q = ext_phy ? MT_RXQ_EXT : MT_RXQ_MAIN; ++ mphy->test.rx_stats.packets[q] += fcs_err; ++ mphy->test.rx_stats.fcs_error[q] += fcs_err; ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.12/mt76-mt7921-consider-the-invalid-value-for-to_rssi.patch b/queue-5.12/mt76-mt7921-consider-the-invalid-value-for-to_rssi.patch new file mode 100644 index 00000000000..0105536f4d4 --- /dev/null +++ b/queue-5.12/mt76-mt7921-consider-the-invalid-value-for-to_rssi.patch @@ -0,0 +1,54 @@ +From 7c4dde2ca7311a2d5d506b32afb4f1018c9a425c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 23:14:55 +0800 +Subject: mt76: mt7921: consider the invalid value for to_rssi + +From: Sean Wang + +[ Upstream commit edb5aebc1c3db312e74e1dcf75b8626ee5300596 ] + +It is possible the RCPI from the certain antenna is an invalid value, +especially packets are receiving while the system is frequently entering +deep sleep mode, so consider calculating RSSI with the reasonable upper +bound to avoid report the wrong value to the mac80211 layer. + +Fixes: 163f4d22c118 ("mt76: mt7921: add MAC support") +Reviewed-by: Lorenzo Bianconi +Signed-off-by: Sean Wang +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/mac.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +index ce4eae7f1e44..39be2e396269 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/mac.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/mac.c +@@ -420,16 +420,19 @@ int mt7921_mac_fill_rx(struct mt7921_dev *dev, struct sk_buff *skb) + status->chain_signal[1] = to_rssi(MT_PRXV_RCPI1, v1); + status->chain_signal[2] = to_rssi(MT_PRXV_RCPI2, v1); + status->chain_signal[3] = to_rssi(MT_PRXV_RCPI3, v1); +- status->signal = status->chain_signal[0]; +- +- for (i = 1; i < hweight8(mphy->antenna_mask); i++) { +- if (!(status->chains & BIT(i))) ++ status->signal = -128; ++ for (i = 0; i < hweight8(mphy->antenna_mask); i++) { ++ if (!(status->chains & BIT(i)) || ++ status->chain_signal[i] >= 0) + continue; + + status->signal = max(status->signal, + status->chain_signal[i]); + } + ++ if (status->signal == -128) ++ status->flag |= RX_FLAG_NO_SIGNAL_VAL; ++ + stbc = FIELD_GET(MT_PRXV_STBC, v0); + gi = FIELD_GET(MT_PRXV_SGI, v0); + cck = false; +-- +2.30.2 + diff --git a/queue-5.12/mt76-mt7921-don-t-alter-rx-path-classifier.patch b/queue-5.12/mt76-mt7921-don-t-alter-rx-path-classifier.patch new file mode 100644 index 00000000000..e5e6388d8ac --- /dev/null +++ b/queue-5.12/mt76-mt7921-don-t-alter-rx-path-classifier.patch @@ -0,0 +1,59 @@ +From 696ea95fbca189dbe486ba47443dc62a7c0b4981 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 23:14:50 +0800 +Subject: mt76: mt7921: Don't alter Rx path classifier + +From: Sean Wang + +[ Upstream commit 2c80c02a682aefc073df2cfbb48c77c74579cb4a ] + +Keep Rx path classifier the mt7921 firmware prefers to allow frames pass +through MCU. + +Fixes: 5c14a5f944b9 ("mt76: mt7921: introduce mt7921e support") +Reviewed-by: Lorenzo Bianconi +Signed-off-by: Sean Wang +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7921/init.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/init.c b/drivers/net/wireless/mediatek/mt76/mt7921/init.c +index a0797cec136e..f9bd907b90fa 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/init.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/init.c +@@ -110,30 +110,12 @@ mt7921_init_wiphy(struct ieee80211_hw *hw) + static void + mt7921_mac_init_band(struct mt7921_dev *dev, u8 band) + { +- u32 mask, set; +- + mt76_rmw_field(dev, MT_TMAC_CTCR0(band), + MT_TMAC_CTCR0_INS_DDLMT_REFTIME, 0x3f); + mt76_set(dev, MT_TMAC_CTCR0(band), + MT_TMAC_CTCR0_INS_DDLMT_VHT_SMPDU_EN | + MT_TMAC_CTCR0_INS_DDLMT_EN); + +- mask = MT_MDP_RCFR0_MCU_RX_MGMT | +- MT_MDP_RCFR0_MCU_RX_CTL_NON_BAR | +- MT_MDP_RCFR0_MCU_RX_CTL_BAR; +- set = FIELD_PREP(MT_MDP_RCFR0_MCU_RX_MGMT, MT_MDP_TO_HIF) | +- FIELD_PREP(MT_MDP_RCFR0_MCU_RX_CTL_NON_BAR, MT_MDP_TO_HIF) | +- FIELD_PREP(MT_MDP_RCFR0_MCU_RX_CTL_BAR, MT_MDP_TO_HIF); +- mt76_rmw(dev, MT_MDP_BNRCFR0(band), mask, set); +- +- mask = MT_MDP_RCFR1_MCU_RX_BYPASS | +- MT_MDP_RCFR1_RX_DROPPED_UCAST | +- MT_MDP_RCFR1_RX_DROPPED_MCAST; +- set = FIELD_PREP(MT_MDP_RCFR1_MCU_RX_BYPASS, MT_MDP_TO_HIF) | +- FIELD_PREP(MT_MDP_RCFR1_RX_DROPPED_UCAST, MT_MDP_TO_HIF) | +- FIELD_PREP(MT_MDP_RCFR1_RX_DROPPED_MCAST, MT_MDP_TO_HIF); +- mt76_rmw(dev, MT_MDP_BNRCFR1(band), mask, set); +- + mt76_set(dev, MT_WF_RMAC_MIB_TIME0(band), MT_WF_RMAC_MIB_RXTIME_EN); + mt76_set(dev, MT_WF_RMAC_MIB_AIRTIME0(band), MT_WF_RMAC_MIB_RXTIME_EN); + +-- +2.30.2 + diff --git a/queue-5.12/mt76-mt7921-fix-omac-idx-usage.patch b/queue-5.12/mt76-mt7921-fix-omac-idx-usage.patch new file mode 100644 index 00000000000..a2ae91e9f73 --- /dev/null +++ b/queue-5.12/mt76-mt7921-fix-omac-idx-usage.patch @@ -0,0 +1,98 @@ +From 40169d11a6b39bdde50daefeff4f97e62c8e6f89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 11:46:40 +0800 +Subject: mt76: mt7921: fix OMAC idx usage + +From: Sean Wang + +[ Upstream commit 213f87289ea01514acdbfeed9f65bcb5f12aef70 ] + +OMAC idx have to be same with BSS idx according to firmware usage. + +Fixes: e0f9fdda81bd ("mt76: mt7921: add ieee80211_ops") +Reviewed-by: Lorenzo Bianconi +Signed-off-by: Deren Wu +Signed-off-by: YN Chen +Signed-off-by: Sean Wang +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7921/main.c | 55 +------------------ + 1 file changed, 1 insertion(+), 54 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index 05ba9cdffb1a..1894ca6324d5 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -223,54 +223,6 @@ static void mt7921_stop(struct ieee80211_hw *hw) + mt7921_mutex_release(dev); + } + +-static inline int get_free_idx(u32 mask, u8 start, u8 end) +-{ +- return ffs(~mask & GENMASK(end, start)); +-} +- +-static int get_omac_idx(enum nl80211_iftype type, u64 mask) +-{ +- int i; +- +- switch (type) { +- case NL80211_IFTYPE_STATION: +- /* prefer hw bssid slot 1-3 */ +- i = get_free_idx(mask, HW_BSSID_1, HW_BSSID_3); +- if (i) +- return i - 1; +- +- /* next, try to find a free repeater entry for the sta */ +- i = get_free_idx(mask >> REPEATER_BSSID_START, 0, +- REPEATER_BSSID_MAX - REPEATER_BSSID_START); +- if (i) +- return i + 32 - 1; +- +- i = get_free_idx(mask, EXT_BSSID_1, EXT_BSSID_MAX); +- if (i) +- return i - 1; +- +- if (~mask & BIT(HW_BSSID_0)) +- return HW_BSSID_0; +- +- break; +- case NL80211_IFTYPE_MONITOR: +- /* ap uses hw bssid 0 and ext bssid */ +- if (~mask & BIT(HW_BSSID_0)) +- return HW_BSSID_0; +- +- i = get_free_idx(mask, EXT_BSSID_1, EXT_BSSID_MAX); +- if (i) +- return i - 1; +- +- break; +- default: +- WARN_ON(1); +- break; +- } +- +- return -1; +-} +- + static int mt7921_add_interface(struct ieee80211_hw *hw, + struct ieee80211_vif *vif) + { +@@ -292,12 +244,7 @@ static int mt7921_add_interface(struct ieee80211_hw *hw, + goto out; + } + +- idx = get_omac_idx(vif->type, phy->omac_mask); +- if (idx < 0) { +- ret = -ENOSPC; +- goto out; +- } +- mvif->mt76.omac_idx = idx; ++ mvif->mt76.omac_idx = mvif->mt76.idx; + mvif->phy = phy; + mvif->mt76.band_idx = 0; + mvif->mt76.wmm_idx = mvif->mt76.idx % MT7921_MAX_WMM_SETS; +-- +2.30.2 + diff --git a/queue-5.12/mt76-mt7921-remove-redundant-check-on-type.patch b/queue-5.12/mt76-mt7921-remove-redundant-check-on-type.patch new file mode 100644 index 00000000000..6d4fcf653d2 --- /dev/null +++ b/queue-5.12/mt76-mt7921-remove-redundant-check-on-type.patch @@ -0,0 +1,40 @@ +From e741466f09d4b556fee3a62ad6cc43f9db0cf960 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Mar 2021 17:29:49 +0000 +Subject: mt76: mt7921: remove redundant check on type + +From: Colin Ian King + +[ Upstream commit 1921b8925c6f2a171af6294bba6af733da2409b9 ] + +Currently in the switch statement case where type is +NL80211_IFTYPE_STATION there is a check to see if type +is not NL80211_IFTYPE_STATION. This check is always false +and is redundant dead code that can be removed. + +Addresses-Coverity: ("Logically dead code") +Fixes: e0f9fdda81bd ("mt76: mt7921: add ieee80211_ops") +Signed-off-by: Colin Ian King +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/main.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/main.c b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +index c6e8857067a3..05ba9cdffb1a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/main.c +@@ -239,9 +239,6 @@ static int get_omac_idx(enum nl80211_iftype type, u64 mask) + if (i) + return i - 1; + +- if (type != NL80211_IFTYPE_STATION) +- break; +- + /* next, try to find a free repeater entry for the sta */ + i = get_free_idx(mask >> REPEATER_BSSID_START, 0, + REPEATER_BSSID_MAX - REPEATER_BSSID_START); +-- +2.30.2 + diff --git a/queue-5.12/mtd-parsers-qcom-fix-leaking-of-partition-name.patch b/queue-5.12/mtd-parsers-qcom-fix-leaking-of-partition-name.patch new file mode 100644 index 00000000000..c6fd47a9b9f --- /dev/null +++ b/queue-5.12/mtd-parsers-qcom-fix-leaking-of-partition-name.patch @@ -0,0 +1,57 @@ +From 199295f42a8bc4e26334a4634ecc57e1f96f9108 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 01:09:31 +0200 +Subject: mtd: parsers: qcom: Fix leaking of partition name + +From: Ansuel Smith + +[ Upstream commit 10f3b4d79958d6f9f71588c6fa862159c83fa80f ] + +Add cleanup function as the name variable for the partition name was +allocaed but never freed after the use as the add mtd function +duplicate the name and free the pparts struct as the partition name is +assumed to be static. +The leak was found using kmemleak. + +Fixes: 803eb124e1a6 ("mtd: parsers: Add Qcom SMEM parser") +Signed-off-by: Ansuel Smith +Reviewed-by: Bjorn Andersson +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210525230931.30013-1-ansuelsmth@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/parsers/qcomsmempart.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/mtd/parsers/qcomsmempart.c b/drivers/mtd/parsers/qcomsmempart.c +index d9083308f6ba..06a818cd2433 100644 +--- a/drivers/mtd/parsers/qcomsmempart.c ++++ b/drivers/mtd/parsers/qcomsmempart.c +@@ -159,6 +159,15 @@ out_free_parts: + return ret; + } + ++static void parse_qcomsmem_cleanup(const struct mtd_partition *pparts, ++ int nr_parts) ++{ ++ int i; ++ ++ for (i = 0; i < nr_parts; i++) ++ kfree(pparts[i].name); ++} ++ + static const struct of_device_id qcomsmem_of_match_table[] = { + { .compatible = "qcom,smem-part" }, + {}, +@@ -167,6 +176,7 @@ MODULE_DEVICE_TABLE(of, qcomsmem_of_match_table); + + static struct mtd_part_parser mtd_parser_qcomsmem = { + .parse_fn = parse_qcomsmem_part, ++ .cleanup = parse_qcomsmem_cleanup, + .name = "qcomsmem", + .of_match_table = qcomsmem_of_match_table, + }; +-- +2.30.2 + diff --git a/queue-5.12/mtd-partitions-redboot-seek-fis-index-block-in-the-r.patch b/queue-5.12/mtd-partitions-redboot-seek-fis-index-block-in-the-r.patch new file mode 100644 index 00000000000..01b7ab29b17 --- /dev/null +++ b/queue-5.12/mtd-partitions-redboot-seek-fis-index-block-in-the-r.patch @@ -0,0 +1,51 @@ +From cfaa68e67966eab4dba11bd378e0df930d76edb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 11:48:50 +0000 +Subject: mtd: partitions: redboot: seek fis-index-block in the right node + +From: Corentin Labbe + +[ Upstream commit 237960880960863fb41888763d635b384cffb104 ] + +fis-index-block is seeked in the master node and not in the partitions node. +For following binding and current usage, the driver need to check the +partitions subnode. + +Fixes: c0e118c8a1a3 ("mtd: partitions: Add OF support to RedBoot partitions") +Signed-off-by: Corentin Labbe +Reviewed-by: Linus Walleij +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210520114851.1274609-1-clabbe@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/parsers/redboot.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/parsers/redboot.c b/drivers/mtd/parsers/redboot.c +index 91146bdc4713..3ccd6363ee8c 100644 +--- a/drivers/mtd/parsers/redboot.c ++++ b/drivers/mtd/parsers/redboot.c +@@ -45,6 +45,7 @@ static inline int redboot_checksum(struct fis_image_desc *img) + static void parse_redboot_of(struct mtd_info *master) + { + struct device_node *np; ++ struct device_node *npart; + u32 dirblock; + int ret; + +@@ -52,7 +53,11 @@ static void parse_redboot_of(struct mtd_info *master) + if (!np) + return; + +- ret = of_property_read_u32(np, "fis-index-block", &dirblock); ++ npart = of_get_child_by_name(np, "partitions"); ++ if (!npart) ++ return; ++ ++ ret = of_property_read_u32(npart, "fis-index-block", &dirblock); + if (ret) + return; + +-- +2.30.2 + diff --git a/queue-5.12/mtd-rawnand-arasan-ensure-proper-configuration-for-t.patch b/queue-5.12/mtd-rawnand-arasan-ensure-proper-configuration-for-t.patch new file mode 100644 index 00000000000..91f5d2c03d9 --- /dev/null +++ b/queue-5.12/mtd-rawnand-arasan-ensure-proper-configuration-for-t.patch @@ -0,0 +1,160 @@ +From ea8b6bb4b8d2531f9c1418209a83b0e1d12257e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 11:32:41 +0200 +Subject: mtd: rawnand: arasan: Ensure proper configuration for the asserted + target + +From: Miquel Raynal + +[ Upstream commit b5437c7b682c9a505065b4ab4716cdc951dc3c7c ] + +The controller being always asserting one CS or the other, there is no +need to actually select the right target before doing a page read/write. +However, the anfc_select_target() helper actually also changes the +timing configuration and clock in the case were two different NAND chips +with different timing requirements would be used. In this situation, we +must ensure proper configuration of the controller by calling it. + +As a consequence of this change, the anfc_select_target() helper is +being moved earlier in the driver. + +Fixes: 88ffef1b65cf ("mtd: rawnand: arasan: Support the hardware BCH ECC engine") +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210526093242.183847-4-miquel.raynal@bootlin.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/arasan-nand-controller.c | 90 ++++++++++++------- + 1 file changed, 57 insertions(+), 33 deletions(-) + +diff --git a/drivers/mtd/nand/raw/arasan-nand-controller.c b/drivers/mtd/nand/raw/arasan-nand-controller.c +index 549aac00228e..390f8d719c25 100644 +--- a/drivers/mtd/nand/raw/arasan-nand-controller.c ++++ b/drivers/mtd/nand/raw/arasan-nand-controller.c +@@ -273,6 +273,37 @@ static int anfc_pkt_len_config(unsigned int len, unsigned int *steps, + return 0; + } + ++static int anfc_select_target(struct nand_chip *chip, int target) ++{ ++ struct anand *anand = to_anand(chip); ++ struct arasan_nfc *nfc = to_anfc(chip->controller); ++ int ret; ++ ++ /* Update the controller timings and the potential ECC configuration */ ++ writel_relaxed(anand->timings, nfc->base + DATA_INTERFACE_REG); ++ ++ /* Update clock frequency */ ++ if (nfc->cur_clk != anand->clk) { ++ clk_disable_unprepare(nfc->controller_clk); ++ ret = clk_set_rate(nfc->controller_clk, anand->clk); ++ if (ret) { ++ dev_err(nfc->dev, "Failed to change clock rate\n"); ++ return ret; ++ } ++ ++ ret = clk_prepare_enable(nfc->controller_clk); ++ if (ret) { ++ dev_err(nfc->dev, ++ "Failed to re-enable the controller clock\n"); ++ return ret; ++ } ++ ++ nfc->cur_clk = anand->clk; ++ } ++ ++ return 0; ++} ++ + /* + * When using the embedded hardware ECC engine, the controller is in charge of + * feeding the engine with, first, the ECC residue present in the data array. +@@ -401,6 +432,18 @@ static int anfc_read_page_hw_ecc(struct nand_chip *chip, u8 *buf, + return 0; + } + ++static int anfc_sel_read_page_hw_ecc(struct nand_chip *chip, u8 *buf, ++ int oob_required, int page) ++{ ++ int ret; ++ ++ ret = anfc_select_target(chip, chip->cur_cs); ++ if (ret) ++ return ret; ++ ++ return anfc_read_page_hw_ecc(chip, buf, oob_required, page); ++}; ++ + static int anfc_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf, + int oob_required, int page) + { +@@ -461,6 +504,18 @@ static int anfc_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf, + return ret; + } + ++static int anfc_sel_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf, ++ int oob_required, int page) ++{ ++ int ret; ++ ++ ret = anfc_select_target(chip, chip->cur_cs); ++ if (ret) ++ return ret; ++ ++ return anfc_write_page_hw_ecc(chip, buf, oob_required, page); ++}; ++ + /* NAND framework ->exec_op() hooks and related helpers */ + static int anfc_parse_instructions(struct nand_chip *chip, + const struct nand_subop *subop, +@@ -753,37 +808,6 @@ static const struct nand_op_parser anfc_op_parser = NAND_OP_PARSER( + NAND_OP_PARSER_PAT_WAITRDY_ELEM(false)), + ); + +-static int anfc_select_target(struct nand_chip *chip, int target) +-{ +- struct anand *anand = to_anand(chip); +- struct arasan_nfc *nfc = to_anfc(chip->controller); +- int ret; +- +- /* Update the controller timings and the potential ECC configuration */ +- writel_relaxed(anand->timings, nfc->base + DATA_INTERFACE_REG); +- +- /* Update clock frequency */ +- if (nfc->cur_clk != anand->clk) { +- clk_disable_unprepare(nfc->controller_clk); +- ret = clk_set_rate(nfc->controller_clk, anand->clk); +- if (ret) { +- dev_err(nfc->dev, "Failed to change clock rate\n"); +- return ret; +- } +- +- ret = clk_prepare_enable(nfc->controller_clk); +- if (ret) { +- dev_err(nfc->dev, +- "Failed to re-enable the controller clock\n"); +- return ret; +- } +- +- nfc->cur_clk = anand->clk; +- } +- +- return 0; +-} +- + static int anfc_check_op(struct nand_chip *chip, + const struct nand_operation *op) + { +@@ -1007,8 +1031,8 @@ static int anfc_init_hw_ecc_controller(struct arasan_nfc *nfc, + if (!anand->bch) + return -EINVAL; + +- ecc->read_page = anfc_read_page_hw_ecc; +- ecc->write_page = anfc_write_page_hw_ecc; ++ ecc->read_page = anfc_sel_read_page_hw_ecc; ++ ecc->write_page = anfc_sel_write_page_hw_ecc; + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.12/mtd-rawnand-marvell-add-missing-clk_disable_unprepar.patch b/queue-5.12/mtd-rawnand-marvell-add-missing-clk_disable_unprepar.patch new file mode 100644 index 00000000000..60853acbb29 --- /dev/null +++ b/queue-5.12/mtd-rawnand-marvell-add-missing-clk_disable_unprepar.patch @@ -0,0 +1,41 @@ +From 45b0482e3239634272908bb37c21ca1c3cea1e19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 20:58:14 +0800 +Subject: mtd: rawnand: marvell: add missing clk_disable_unprepare() on error + in marvell_nfc_resume() + +From: Yang Yingliang + +[ Upstream commit ae94c49527aa9bd3b563349adc4b5617747ca6bd ] + +Add clk_disable_unprepare() on error path in marvell_nfc_resume(). + +Fixes: bd9c3f9b3c00 ("mtd: rawnand: marvell: add suspend and resume hooks") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210601125814.3260364-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/marvell_nand.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c +index 79da6b02e209..f83525a1ab0e 100644 +--- a/drivers/mtd/nand/raw/marvell_nand.c ++++ b/drivers/mtd/nand/raw/marvell_nand.c +@@ -3030,8 +3030,10 @@ static int __maybe_unused marvell_nfc_resume(struct device *dev) + return ret; + + ret = clk_prepare_enable(nfc->reg_clk); +- if (ret < 0) ++ if (ret < 0) { ++ clk_disable_unprepare(nfc->core_clk); + return ret; ++ } + + /* + * Reset nfc->selected_chip so the next command will cause the timing +-- +2.30.2 + diff --git a/queue-5.12/mtd-spinand-fix-double-counting-of-ecc-stats.patch b/queue-5.12/mtd-spinand-fix-double-counting-of-ecc-stats.patch new file mode 100644 index 00000000000..b2c7ee09a7a --- /dev/null +++ b/queue-5.12/mtd-spinand-fix-double-counting-of-ecc-stats.patch @@ -0,0 +1,88 @@ +From 27699d46e4c0c4b41b674481905644f0af497456 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 10:43:45 +0200 +Subject: mtd: spinand: Fix double counting of ECC stats + +From: Miquel Raynal + +[ Upstream commit c93081b265735db2417f0964718516044d06b1a2 ] + +In the raw NAND world, ECC engines increment ecc_stats and the final +caller is responsible for returning -EBADMSG if the verification +failed. + +In the SPI-NAND world it was a bit different until now because there was +only one possible ECC engine: the on-die one. Indeed, the +spinand_mtd_read() call was incrementing the ecc_stats counters +depending on the outcome of spinand_check_ecc_status() directly. + +So now let's split the logic like this: +- spinand_check_ecc_status() is specific to the SPI-NAND on-die engine + and is kept very simple: it just returns the ECC status (bonus point: + the content of this helper can be overloaded). +- spinand_ondie_ecc_finish_io_req() is the caller of + spinand_check_ecc_status() and will increment the counters and + eventually return -EBADMSG. +- spinand_mtd_read() is not tied to the on-die ECC implementation and + should be able to handle results coming from other ECC engines: it has + the responsibility of returning the maximum number of bitflips which + happened during the entire operation as this is the only helper that + is aware that several pages may be read in a row. + +Fixes: 945845b54c9c ("mtd: spinand: Instantiate a SPI-NAND on-die ECC engine") +Reported-by: YouChing Lin +Signed-off-by: Miquel Raynal +Tested-by: YouChing Lin +Link: https://lore.kernel.org/linux-mtd/20210527084345.208215-1-miquel.raynal@bootlin.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/spi/core.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c +index 17f63f95f4a2..54ae540bc66b 100644 +--- a/drivers/mtd/nand/spi/core.c ++++ b/drivers/mtd/nand/spi/core.c +@@ -290,6 +290,8 @@ static int spinand_ondie_ecc_finish_io_req(struct nand_device *nand, + { + struct spinand_ondie_ecc_conf *engine_conf = nand->ecc.ctx.priv; + struct spinand_device *spinand = nand_to_spinand(nand); ++ struct mtd_info *mtd = spinand_to_mtd(spinand); ++ int ret; + + if (req->mode == MTD_OPS_RAW) + return 0; +@@ -299,7 +301,13 @@ static int spinand_ondie_ecc_finish_io_req(struct nand_device *nand, + return 0; + + /* Finish a page write: check the status, report errors/bitflips */ +- return spinand_check_ecc_status(spinand, engine_conf->status); ++ ret = spinand_check_ecc_status(spinand, engine_conf->status); ++ if (ret == -EBADMSG) ++ mtd->ecc_stats.failed++; ++ else if (ret > 0) ++ mtd->ecc_stats.corrected += ret; ++ ++ return ret; + } + + static struct nand_ecc_engine_ops spinand_ondie_ecc_engine_ops = { +@@ -620,13 +628,10 @@ static int spinand_mtd_read(struct mtd_info *mtd, loff_t from, + if (ret < 0 && ret != -EBADMSG) + break; + +- if (ret == -EBADMSG) { ++ if (ret == -EBADMSG) + ecc_failed = true; +- mtd->ecc_stats.failed++; +- } else { +- mtd->ecc_stats.corrected += ret; ++ else + max_bitflips = max_t(unsigned int, max_bitflips, ret); +- } + + ret = 0; + ops->retlen += iter.req.datalen; +-- +2.30.2 + diff --git a/queue-5.12/mwifiex-re-fix-for-unaligned-accesses.patch b/queue-5.12/mwifiex-re-fix-for-unaligned-accesses.patch new file mode 100644 index 00000000000..bf9da48532c --- /dev/null +++ b/queue-5.12/mwifiex-re-fix-for-unaligned-accesses.patch @@ -0,0 +1,62 @@ +From 542db71d78fa0575a3ffad3917e7ed01a6cb0172 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 00:07:55 +0200 +Subject: mwifiex: re-fix for unaligned accesses + +From: Arnd Bergmann + +[ Upstream commit 8f4e3d48bb50765ab27ae5bebed2595b20de80a1 ] + +A patch from 2017 changed some accesses to DMA memory to use +get_unaligned_le32() and similar interfaces, to avoid problems +with doing unaligned accesson uncached memory. + +However, the change in the mwifiex_pcie_alloc_sleep_cookie_buf() +function ended up changing the size of the access instead, +as it operates on a pointer to u8. + +Change this function back to actually access the entire 32 bits. +Note that the pointer is aligned by definition because it came +from dma_alloc_coherent(). + +Fixes: 92c70a958b0b ("mwifiex: fix for unaligned reads") +Acked-by: Kalle Valo +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/pcie.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c +index 94228b316df1..46517515ba72 100644 +--- a/drivers/net/wireless/marvell/mwifiex/pcie.c ++++ b/drivers/net/wireless/marvell/mwifiex/pcie.c +@@ -1231,7 +1231,7 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter) + static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter) + { + struct pcie_service_card *card = adapter->card; +- u32 tmp; ++ u32 *cookie; + + card->sleep_cookie_vbase = dma_alloc_coherent(&card->dev->dev, + sizeof(u32), +@@ -1242,13 +1242,11 @@ static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter) + "dma_alloc_coherent failed!\n"); + return -ENOMEM; + } ++ cookie = (u32 *)card->sleep_cookie_vbase; + /* Init val of Sleep Cookie */ +- tmp = FW_AWAKE_COOKIE; +- put_unaligned(tmp, card->sleep_cookie_vbase); ++ *cookie = FW_AWAKE_COOKIE; + +- mwifiex_dbg(adapter, INFO, +- "alloc_scook: sleep cookie=0x%x\n", +- get_unaligned(card->sleep_cookie_vbase)); ++ mwifiex_dbg(adapter, INFO, "alloc_scook: sleep cookie=0x%x\n", *cookie); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.12/net-atlantic-fix-the-macsec-key-length.patch b/queue-5.12/net-atlantic-fix-the-macsec-key-length.patch new file mode 100644 index 00000000000..5277f59f6df --- /dev/null +++ b/queue-5.12/net-atlantic-fix-the-macsec-key-length.patch @@ -0,0 +1,52 @@ +From 441ad1f1b986220019b3fdf282e9f05323db1d7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 11:38:30 +0200 +Subject: net: atlantic: fix the macsec key length + +From: Antoine Tenart + +[ Upstream commit d67fb4772d9a6cfd10f1109f0e7b1e6eb58c8e16 ] + +The key length used to store the macsec key was set to MACSEC_KEYID_LEN +(16), which is an issue as: +- This was never meant to be the key length. +- The key length can be > 16. + +Fix this by using MACSEC_MAX_KEY_LEN instead (the max length accepted in +uAPI). + +Fixes: 27736563ce32 ("net: atlantic: MACSec egress offload implementation") +Fixes: 9ff40a751a6f ("net: atlantic: MACSec ingress offload implementation") +Reported-by: Lior Nahmanson +Signed-off-by: Antoine Tenart +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_macsec.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_macsec.h b/drivers/net/ethernet/aquantia/atlantic/aq_macsec.h +index f5fba8b8cdea..a47e2710487e 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_macsec.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_macsec.h +@@ -91,7 +91,7 @@ struct aq_macsec_txsc { + u32 hw_sc_idx; + unsigned long tx_sa_idx_busy; + const struct macsec_secy *sw_secy; +- u8 tx_sa_key[MACSEC_NUM_AN][MACSEC_KEYID_LEN]; ++ u8 tx_sa_key[MACSEC_NUM_AN][MACSEC_MAX_KEY_LEN]; + struct aq_macsec_tx_sc_stats stats; + struct aq_macsec_tx_sa_stats tx_sa_stats[MACSEC_NUM_AN]; + }; +@@ -101,7 +101,7 @@ struct aq_macsec_rxsc { + unsigned long rx_sa_idx_busy; + const struct macsec_secy *sw_secy; + const struct macsec_rx_sc *sw_rxsc; +- u8 rx_sa_key[MACSEC_NUM_AN][MACSEC_KEYID_LEN]; ++ u8 rx_sa_key[MACSEC_NUM_AN][MACSEC_MAX_KEY_LEN]; + struct aq_macsec_rx_sa_stats rx_sa_stats[MACSEC_NUM_AN]; + }; + +-- +2.30.2 + diff --git a/queue-5.12/net-bcmgenet-fix-attaching-to-pyh-failed-on-rpi-4b.patch b/queue-5.12/net-bcmgenet-fix-attaching-to-pyh-failed-on-rpi-4b.patch new file mode 100644 index 00000000000..fcc01d3fed6 --- /dev/null +++ b/queue-5.12/net-bcmgenet-fix-attaching-to-pyh-failed-on-rpi-4b.patch @@ -0,0 +1,47 @@ +From 62129833bbd1945887c27d45956a998cac576d70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 11:28:03 +0800 +Subject: net: bcmgenet: Fix attaching to PYH failed on RPi 4B + +From: Jian-Hong Pan + +[ Upstream commit b2ac9800cfe0f8da16abc4e74e003440361c112e ] + +The Broadcom UniMAC MDIO bus from mdio-bcm-unimac module comes too late. +So, GENET cannot find the ethernet PHY on UniMAC MDIO bus. This leads +GENET fail to attach the PHY as following log: + +bcmgenet fd580000.ethernet: GENET 5.0 EPHY: 0x0000 +... +could not attach to PHY +bcmgenet fd580000.ethernet eth0: failed to connect to PHY +uart-pl011 fe201000.serial: no DMA platform data +libphy: bcmgenet MII bus: probed +... +unimac-mdio unimac-mdio.-19: Broadcom UniMAC MDIO bus + +This patch adds the soft dependency to load mdio-bcm-unimac module +before genet module to avoid the issue. + +Fixes: 9a4e79697009 ("net: bcmgenet: utilize generic Broadcom UniMAC MDIO controller driver") +Buglink: https://bugzilla.kernel.org/show_bug.cgi?id=213485 +Signed-off-by: Jian-Hong Pan +Signed-off-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index fcca023f22e5..41f7f078cd27 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -4296,3 +4296,4 @@ MODULE_AUTHOR("Broadcom Corporation"); + MODULE_DESCRIPTION("Broadcom GENET Ethernet controller driver"); + MODULE_ALIAS("platform:bcmgenet"); + MODULE_LICENSE("GPL"); ++MODULE_SOFTDEP("pre: mdio-bcm-unimac"); +-- +2.30.2 + diff --git a/queue-5.12/net-broadcom-bcm4908_enet-reset-dma-rings-sw-indexes.patch b/queue-5.12/net-broadcom-bcm4908_enet-reset-dma-rings-sw-indexes.patch new file mode 100644 index 00000000000..374595a1a8c --- /dev/null +++ b/queue-5.12/net-broadcom-bcm4908_enet-reset-dma-rings-sw-indexes.patch @@ -0,0 +1,54 @@ +From 3a6ab2304beec834eff481c660fad64a7658c15c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 07:24:15 +0200 +Subject: net: broadcom: bcm4908_enet: reset DMA rings sw indexes properly +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit ddeacc4f6494e07cbb6f033627926623f3e7a9d0 ] + +Resetting software indexes in bcm4908_dma_alloc_buf_descs() is not +enough as it's called during device probe only. Driver resets DMA on +every .ndo_open callback and it's required to reset indexes then. + +This fixes inconsistent rings state and stalled traffic after interface +down & up sequence. + +Fixes: 4feffeadbcb2 ("net: broadcom: bcm4908enet: add BCM4908 controller driver") +Signed-off-by: Rafał Miłecki +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bcm4908_enet.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bcm4908_enet.c b/drivers/net/ethernet/broadcom/bcm4908_enet.c +index 65981931a798..a31984cd0fb7 100644 +--- a/drivers/net/ethernet/broadcom/bcm4908_enet.c ++++ b/drivers/net/ethernet/broadcom/bcm4908_enet.c +@@ -165,9 +165,6 @@ static int bcm4908_dma_alloc_buf_descs(struct bcm4908_enet *enet, + if (!ring->slots) + goto err_free_buf_descs; + +- ring->read_idx = 0; +- ring->write_idx = 0; +- + return 0; + + err_free_buf_descs: +@@ -295,6 +292,9 @@ static void bcm4908_enet_dma_ring_init(struct bcm4908_enet *enet, + + enet_write(enet, ring->st_ram_block + ENET_DMA_CH_STATE_RAM_BASE_DESC_PTR, + (uint32_t)ring->dma_addr); ++ ++ ring->read_idx = 0; ++ ring->write_idx = 0; + } + + static void bcm4908_enet_dma_uninit(struct bcm4908_enet *enet) +-- +2.30.2 + diff --git a/queue-5.12/net-dsa-mv88e6xxx-fix-adding-vlan-0.patch b/queue-5.12/net-dsa-mv88e6xxx-fix-adding-vlan-0.patch new file mode 100644 index 00000000000..f3bf03fe281 --- /dev/null +++ b/queue-5.12/net-dsa-mv88e6xxx-fix-adding-vlan-0.patch @@ -0,0 +1,58 @@ +From feafebef18be5a2e6c6b547b8a5baf1557fcfe91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 11:54:38 +0300 +Subject: net: dsa: mv88e6xxx: Fix adding vlan 0 + +From: Eldar Gasanov + +[ Upstream commit b8b79c414eca4e9bcab645e02cb92c48db974ce9 ] + +8021q module adds vlan 0 to all interfaces when it starts. +When 8021q module is loaded it isn't possible to create bond +with mv88e6xxx interfaces, bonding module dipslay error +"Couldn't add bond vlan ids", because it tries to add vlan 0 +to slave interfaces. + +There is unexpected behavior in the switch. When a PVID +is assigned to a port the switch changes VID to PVID +in ingress frames with VID 0 on the port. Expected +that the switch doesn't assign PVID to tagged frames +with VID 0. But there isn't a way to change this behavior +in the switch. + +Fixes: 57e661aae6a8 ("net: dsa: mv88e6xxx: Link aggregation support") +Signed-off-by: Eldar Gasanov +Reviewed-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index e08bf9377140..25363fceb45e 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -1552,9 +1552,6 @@ static int mv88e6xxx_port_check_hw_vlan(struct dsa_switch *ds, int port, + struct mv88e6xxx_vtu_entry vlan; + int i, err; + +- if (!vid) +- return -EOPNOTSUPP; +- + /* DSA and CPU ports have to be members of multiple vlans */ + if (dsa_is_dsa_port(ds, port) || dsa_is_cpu_port(ds, port)) + return 0; +@@ -1993,6 +1990,9 @@ static int mv88e6xxx_port_vlan_add(struct dsa_switch *ds, int port, + u8 member; + int err; + ++ if (!vlan->vid) ++ return 0; ++ + err = mv88e6xxx_port_vlan_prepare(ds, port, vlan); + if (err) + return err; +-- +2.30.2 + diff --git a/queue-5.12/net-dsa-sja1105-fix-null-pointer-dereference-in-sja1.patch b/queue-5.12/net-dsa-sja1105-fix-null-pointer-dereference-in-sja1.patch new file mode 100644 index 00000000000..fcd0c5008fa --- /dev/null +++ b/queue-5.12/net-dsa-sja1105-fix-null-pointer-dereference-in-sja1.patch @@ -0,0 +1,55 @@ +From fc0481b90c4cdc5dff7d67c4fa3045205743cbac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 18:52:07 +0300 +Subject: net: dsa: sja1105: fix NULL pointer dereference in + sja1105_reload_cbs() + +From: Vladimir Oltean + +[ Upstream commit be7f62eebaff2f86c1467a2d33930a0a7a87675b ] + +priv->cbs is an array of priv->info->num_cbs_shapers elements of type +struct sja1105_cbs_entry which only get allocated if CONFIG_NET_SCH_CBS +is enabled. + +However, sja1105_reload_cbs() is called from sja1105_static_config_reload() +which in turn is called for any of the items in sja1105_reset_reasons, +therefore during the normal runtime of the driver and not just from a +code path which can be triggered by the tc-cbs offload. + +The sja1105_reload_cbs() function does not contain a check whether the +priv->cbs array is NULL or not, it just assumes it isn't and proceeds to +iterate through the credit-based shaper elements. This leads to a NULL +pointer dereference. + +The solution is to return success if the priv->cbs array has not been +allocated, since sja1105_reload_cbs() has nothing to do. + +Fixes: 4d7525085a9b ("net: dsa: sja1105: offload the Credit-Based Shaper qdisc") +Signed-off-by: Vladimir Oltean +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/sja1105/sja1105_main.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c +index 926544440f02..42a0fb588f64 100644 +--- a/drivers/net/dsa/sja1105/sja1105_main.c ++++ b/drivers/net/dsa/sja1105/sja1105_main.c +@@ -1798,6 +1798,12 @@ static int sja1105_reload_cbs(struct sja1105_private *priv) + { + int rc = 0, i; + ++ /* The credit based shapers are only allocated if ++ * CONFIG_NET_SCH_CBS is enabled. ++ */ ++ if (!priv->cbs) ++ return 0; ++ + for (i = 0; i < priv->info->num_cbs_shapers; i++) { + struct sja1105_cbs_entry *cbs = &priv->cbs[i]; + +-- +2.30.2 + diff --git a/queue-5.12/net-ethernet-aeroflex-fix-uaf-in-greth_of_remove.patch b/queue-5.12/net-ethernet-aeroflex-fix-uaf-in-greth_of_remove.patch new file mode 100644 index 00000000000..ac8ad6a0aac --- /dev/null +++ b/queue-5.12/net-ethernet-aeroflex-fix-uaf-in-greth_of_remove.patch @@ -0,0 +1,54 @@ +From 4ca4728c38d75a94c87a0e5dcb8608d554af6011 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 17:57:31 +0300 +Subject: net: ethernet: aeroflex: fix UAF in greth_of_remove + +From: Pavel Skripkin + +[ Upstream commit e3a5de6d81d8b2199935c7eb3f7d17a50a7075b7 ] + +static int greth_of_remove(struct platform_device *of_dev) +{ +... + struct greth_private *greth = netdev_priv(ndev); +... + unregister_netdev(ndev); + free_netdev(ndev); + + of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0])); +... +} + +greth is netdev private data, but it is used +after free_netdev(). It can cause use-after-free when accessing greth +pointer. So, fix it by moving free_netdev() after of_iounmap() +call. + +Fixes: d4c41139df6e ("net: Add Aeroflex Gaisler 10/100/1G Ethernet MAC driver") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aeroflex/greth.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aeroflex/greth.c b/drivers/net/ethernet/aeroflex/greth.c +index 9c5891bbfe61..f4f50b3a472e 100644 +--- a/drivers/net/ethernet/aeroflex/greth.c ++++ b/drivers/net/ethernet/aeroflex/greth.c +@@ -1539,10 +1539,11 @@ static int greth_of_remove(struct platform_device *of_dev) + mdiobus_unregister(greth->mdio); + + unregister_netdev(ndev); +- free_netdev(ndev); + + of_iounmap(&of_dev->resource[0], greth->regs, resource_size(&of_dev->resource[0])); + ++ free_netdev(ndev); ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.12/net-ethernet-ezchip-fix-error-handling.patch b/queue-5.12/net-ethernet-ezchip-fix-error-handling.patch new file mode 100644 index 00000000000..17a3f58fa52 --- /dev/null +++ b/queue-5.12/net-ethernet-ezchip-fix-error-handling.patch @@ -0,0 +1,44 @@ +From 6310b74f590ecde4a06baaa72f2cfb60b2c5b5db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 19:14:47 +0300 +Subject: net: ethernet: ezchip: fix error handling + +From: Pavel Skripkin + +[ Upstream commit 0de449d599594f5472e00267d651615c7f2c6c1d ] + +As documented at drivers/base/platform.c for platform_get_irq: + + * Gets an IRQ for a platform device and prints an error message if finding the + * IRQ fails. Device drivers should check the return value for errors so as to + * not pass a negative integer value to the request_irq() APIs. + +So, the driver should check that platform_get_irq() return value +is _negative_, not that it's equal to zero, because -ENXIO (return +value from request_irq() if irq was not found) will +pass this check and it leads to passing negative irq to request_irq() + +Fixes: 0dd077093636 ("NET: Add ezchip ethernet driver") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ezchip/nps_enet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c +index 026a3ec19b6e..3d74401b4f10 100644 +--- a/drivers/net/ethernet/ezchip/nps_enet.c ++++ b/drivers/net/ethernet/ezchip/nps_enet.c +@@ -610,7 +610,7 @@ static s32 nps_enet_probe(struct platform_device *pdev) + + /* Get IRQ number */ + priv->irq = platform_get_irq(pdev, 0); +- if (!priv->irq) { ++ if (priv->irq < 0) { + dev_err(dev, "failed to retrieve value from device tree\n"); + err = -ENODEV; + goto out_netdev; +-- +2.30.2 + diff --git a/queue-5.12/net-ethernet-ezchip-fix-uaf-in-nps_enet_remove.patch b/queue-5.12/net-ethernet-ezchip-fix-uaf-in-nps_enet_remove.patch new file mode 100644 index 00000000000..01a8a7a7aaa --- /dev/null +++ b/queue-5.12/net-ethernet-ezchip-fix-uaf-in-nps_enet_remove.patch @@ -0,0 +1,39 @@ +From a5aba0f9cfd2a5a8115f76de80e5d7661a653cb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 19:14:31 +0300 +Subject: net: ethernet: ezchip: fix UAF in nps_enet_remove + +From: Pavel Skripkin + +[ Upstream commit e4b8700e07a86e8eab6916aa5c5ba99042c34089 ] + +priv is netdev private data, but it is used +after free_netdev(). It can cause use-after-free when accessing priv +pointer. So, fix it by moving free_netdev() after netif_napi_del() +call. + +Fixes: 0dd077093636 ("NET: Add ezchip ethernet driver") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ezchip/nps_enet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/ezchip/nps_enet.c b/drivers/net/ethernet/ezchip/nps_enet.c +index 815fb62c4b02..026a3ec19b6e 100644 +--- a/drivers/net/ethernet/ezchip/nps_enet.c ++++ b/drivers/net/ethernet/ezchip/nps_enet.c +@@ -645,8 +645,8 @@ static s32 nps_enet_remove(struct platform_device *pdev) + struct nps_enet_priv *priv = netdev_priv(ndev); + + unregister_netdev(ndev); +- free_netdev(ndev); + netif_napi_del(&priv->napi); ++ free_netdev(ndev); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.12/net-ftgmac100-add-missing-error-return-code-in-ftgma.patch b/queue-5.12/net-ftgmac100-add-missing-error-return-code-in-ftgma.patch new file mode 100644 index 00000000000..914fab23dc8 --- /dev/null +++ b/queue-5.12/net-ftgmac100-add-missing-error-return-code-in-ftgma.patch @@ -0,0 +1,57 @@ +From 8ece7bbe8e4f08a306d0ffb04e9618bd7014623d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 May 2021 20:02:46 +0800 +Subject: net: ftgmac100: add missing error return code in ftgmac100_probe() + +From: Yang Yingliang + +[ Upstream commit 52af13a41489d7bbc1932d17583eff6e5fffc820 ] + +The variables will be free on path err_phy_connect, it should +return error code, or it will cause double free when calling +ftgmac100_remove(). + +Fixes: bd466c3fb5a4 ("net/faraday: Support NCSI mode") +Fixes: 39bfab8844a0 ("net: ftgmac100: Add support for DT phy-handle property") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftgmac100.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/faraday/ftgmac100.c b/drivers/net/ethernet/faraday/ftgmac100.c +index 04421aec2dfd..11dbbfd38770 100644 +--- a/drivers/net/ethernet/faraday/ftgmac100.c ++++ b/drivers/net/ethernet/faraday/ftgmac100.c +@@ -1830,14 +1830,17 @@ static int ftgmac100_probe(struct platform_device *pdev) + if (np && of_get_property(np, "use-ncsi", NULL)) { + if (!IS_ENABLED(CONFIG_NET_NCSI)) { + dev_err(&pdev->dev, "NCSI stack not enabled\n"); ++ err = -EINVAL; + goto err_phy_connect; + } + + dev_info(&pdev->dev, "Using NCSI interface\n"); + priv->use_ncsi = true; + priv->ndev = ncsi_register_dev(netdev, ftgmac100_ncsi_handler); +- if (!priv->ndev) ++ if (!priv->ndev) { ++ err = -EINVAL; + goto err_phy_connect; ++ } + } else if (np && of_get_property(np, "phy-handle", NULL)) { + struct phy_device *phy; + +@@ -1856,6 +1859,7 @@ static int ftgmac100_probe(struct platform_device *pdev) + &ftgmac100_adjust_link); + if (!phy) { + dev_err(&pdev->dev, "Failed to connect to phy\n"); ++ err = -EINVAL; + goto err_phy_connect; + } + +-- +2.30.2 + diff --git a/queue-5.12/net-ipv4-swap-flow-ports-when-validating-source.patch b/queue-5.12/net-ipv4-swap-flow-ports-when-validating-source.patch new file mode 100644 index 00000000000..67f937241b9 --- /dev/null +++ b/queue-5.12/net-ipv4-swap-flow-ports-when-validating-source.patch @@ -0,0 +1,39 @@ +From 839f4aa20a892bca939003c97314561a8763a17b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 12:24:50 +0800 +Subject: net/ipv4: swap flow ports when validating source + +From: Miao Wang + +[ Upstream commit c69f114d09891adfa3e301a35d9e872b8b7b5a50 ] + +When doing source address validation, the flowi4 struct used for +fib_lookup should be in the reverse direction to the given skb. +fl4_dport and fl4_sport returned by fib4_rules_early_flow_dissect +should thus be swapped. + +Fixes: 5a847a6e1477 ("net/ipv4: Initialize proto and ports in flow struct") +Signed-off-by: Miao Wang +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/fib_frontend.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 84bb707bd88d..647bceab56c2 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -371,6 +371,8 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst, + fl4.flowi4_proto = 0; + fl4.fl4_sport = 0; + fl4.fl4_dport = 0; ++ } else { ++ swap(fl4.fl4_sport, fl4.fl4_dport); + } + + if (fib_lookup(net, &fl4, &res, 0)) +-- +2.30.2 + diff --git a/queue-5.12/net-lwtunnel-handle-mtu-calculation-in-forwading.patch b/queue-5.12/net-lwtunnel-handle-mtu-calculation-in-forwading.patch new file mode 100644 index 00000000000..ea35cfb6d6a --- /dev/null +++ b/queue-5.12/net-lwtunnel-handle-mtu-calculation-in-forwading.patch @@ -0,0 +1,142 @@ +From 2d763a6e165d660c954a2c0208924e376bbc0f5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 19:21:39 +0300 +Subject: net: lwtunnel: handle MTU calculation in forwading + +From: Vadim Fedorenko + +[ Upstream commit fade56410c22cacafb1be9f911a0afd3701d8366 ] + +Commit 14972cbd34ff ("net: lwtunnel: Handle fragmentation") moved +fragmentation logic away from lwtunnel by carry encap headroom and +use it in output MTU calculation. But the forwarding part was not +covered and created difference in MTU for output and forwarding and +further to silent drops on ipv4 forwarding path. Fix it by taking +into account lwtunnel encap headroom. + +The same commit also introduced difference in how to treat RTAX_MTU +in IPv4 and IPv6 where latter explicitly removes lwtunnel encap +headroom from route MTU. Make IPv4 version do the same. + +Fixes: 14972cbd34ff ("net: lwtunnel: Handle fragmentation") +Suggested-by: David Ahern +Signed-off-by: Vadim Fedorenko +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/ip.h | 12 ++++++++---- + include/net/ip6_route.h | 16 ++++++++++++---- + net/ipv4/route.c | 3 ++- + 3 files changed, 22 insertions(+), 9 deletions(-) + +diff --git a/include/net/ip.h b/include/net/ip.h +index e20874059f82..d9683bef8684 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + + #define IPV4_MAX_PMTU 65535U /* RFC 2675, Section 5.1 */ + #define IPV4_MIN_MTU 68 /* RFC 791 */ +@@ -445,22 +446,25 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, + + /* 'forwarding = true' case should always honour route mtu */ + mtu = dst_metric_raw(dst, RTAX_MTU); +- if (mtu) +- return mtu; ++ if (!mtu) ++ mtu = min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); + +- return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); ++ return mtu - lwtunnel_headroom(dst->lwtstate, mtu); + } + + static inline unsigned int ip_skb_dst_mtu(struct sock *sk, + const struct sk_buff *skb) + { ++ unsigned int mtu; ++ + if (!sk || !sk_fullsock(sk) || ip_sk_use_pmtu(sk)) { + bool forwarding = IPCB(skb)->flags & IPSKB_FORWARDED; + + return ip_dst_mtu_maybe_forward(skb_dst(skb), forwarding); + } + +- return min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU); ++ mtu = min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU); ++ return mtu - lwtunnel_headroom(skb_dst(skb)->lwtstate, mtu); + } + + struct dst_metrics *ip_fib_metrics_init(struct net *net, struct nlattr *fc_mx, +diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h +index f51a118bfce8..f14149df5a65 100644 +--- a/include/net/ip6_route.h ++++ b/include/net/ip6_route.h +@@ -265,11 +265,18 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + + static inline int ip6_skb_dst_mtu(struct sk_buff *skb) + { ++ int mtu; ++ + struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ? + inet6_sk(skb->sk) : NULL; + +- return (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) ? +- skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb)); ++ if (np && np->pmtudisc >= IPV6_PMTUDISC_PROBE) { ++ mtu = READ_ONCE(skb_dst(skb)->dev->mtu); ++ mtu -= lwtunnel_headroom(skb_dst(skb)->lwtstate, mtu); ++ } else ++ mtu = dst_mtu(skb_dst(skb)); ++ ++ return mtu; + } + + static inline bool ip6_sk_accept_pmtu(const struct sock *sk) +@@ -317,7 +324,7 @@ static inline unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) + if (dst_metric_locked(dst, RTAX_MTU)) { + mtu = dst_metric_raw(dst, RTAX_MTU); + if (mtu) +- return mtu; ++ goto out; + } + + mtu = IPV6_MIN_MTU; +@@ -327,7 +334,8 @@ static inline unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst) + mtu = idev->cnf.mtu6; + rcu_read_unlock(); + +- return mtu; ++out: ++ return mtu - lwtunnel_headroom(dst->lwtstate, mtu); + } + + u32 ip6_mtu_from_fib6(const struct fib6_result *res, +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 09506203156d..484064daa95a 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1331,7 +1331,7 @@ INDIRECT_CALLABLE_SCOPE unsigned int ipv4_mtu(const struct dst_entry *dst) + mtu = dst_metric_raw(dst, RTAX_MTU); + + if (mtu) +- return mtu; ++ goto out; + + mtu = READ_ONCE(dst->dev->mtu); + +@@ -1340,6 +1340,7 @@ INDIRECT_CALLABLE_SCOPE unsigned int ipv4_mtu(const struct dst_entry *dst) + mtu = 576; + } + ++out: + mtu = min_t(unsigned int, mtu, IP_MAX_MTU); + + return mtu - lwtunnel_headroom(dst->lwtstate, mtu); +-- +2.30.2 + diff --git a/queue-5.12/net-macsec-fix-the-length-used-to-copy-the-key-for-o.patch b/queue-5.12/net-macsec-fix-the-length-used-to-copy-the-key-for-o.patch new file mode 100644 index 00000000000..8e0fcc536d3 --- /dev/null +++ b/queue-5.12/net-macsec-fix-the-length-used-to-copy-the-key-for-o.patch @@ -0,0 +1,65 @@ +From c40eca91e88e0ce78250007510c65dad3052bad9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 11:38:28 +0200 +Subject: net: macsec: fix the length used to copy the key for offloading + +From: Antoine Tenart + +[ Upstream commit 1f7fe5121127e037b86592ba42ce36515ea0e3f7 ] + +The key length used when offloading macsec to Ethernet or PHY drivers +was set to MACSEC_KEYID_LEN (16), which is an issue as: +- This was never meant to be the key length. +- The key length can be > 16. + +Fix this by using MACSEC_MAX_KEY_LEN to store the key (the max length +accepted in uAPI) and secy->key_len to copy it. + +Fixes: 3cf3227a21d1 ("net: macsec: hardware offloading infrastructure") +Reported-by: Lior Nahmanson +Signed-off-by: Antoine Tenart +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/macsec.c | 4 ++-- + include/net/macsec.h | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 92425e1fd70c..93dc48b9b4f2 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -1819,7 +1819,7 @@ static int macsec_add_rxsa(struct sk_buff *skb, struct genl_info *info) + ctx.sa.rx_sa = rx_sa; + ctx.secy = secy; + memcpy(ctx.sa.key, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]), +- MACSEC_KEYID_LEN); ++ secy->key_len); + + err = macsec_offload(ops->mdo_add_rxsa, &ctx); + if (err) +@@ -2061,7 +2061,7 @@ static int macsec_add_txsa(struct sk_buff *skb, struct genl_info *info) + ctx.sa.tx_sa = tx_sa; + ctx.secy = secy; + memcpy(ctx.sa.key, nla_data(tb_sa[MACSEC_SA_ATTR_KEY]), +- MACSEC_KEYID_LEN); ++ secy->key_len); + + err = macsec_offload(ops->mdo_add_txsa, &ctx); + if (err) +diff --git a/include/net/macsec.h b/include/net/macsec.h +index 52874cdfe226..d6fa6b97f6ef 100644 +--- a/include/net/macsec.h ++++ b/include/net/macsec.h +@@ -241,7 +241,7 @@ struct macsec_context { + struct macsec_rx_sc *rx_sc; + struct { + unsigned char assoc_num; +- u8 key[MACSEC_KEYID_LEN]; ++ u8 key[MACSEC_MAX_KEY_LEN]; + union { + struct macsec_rx_sa *rx_sa; + struct macsec_tx_sa *tx_sa; +-- +2.30.2 + diff --git a/queue-5.12/net-mvpp2-put-fwnode-in-error-case-during-probe.patch b/queue-5.12/net-mvpp2-put-fwnode-in-error-case-during-probe.patch new file mode 100644 index 00000000000..1c54a32aa7b --- /dev/null +++ b/queue-5.12/net-mvpp2-put-fwnode-in-error-case-during-probe.patch @@ -0,0 +1,40 @@ +From 3516cd578f38980356a34815ca186f33b2351dcd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 12:58:05 +0300 +Subject: net: mvpp2: Put fwnode in error case during ->probe() + +From: Andy Shevchenko + +[ Upstream commit 71f0891c84dfdc448736082ab0a00acd29853896 ] + +In each iteration fwnode_for_each_available_child_node() bumps a reference +counting of a loop variable followed by dropping in on a next iteration, + +Since in error case the loop is broken, we have to drop a reference count +by ourselves. Do it for port_fwnode in error case during ->probe(). + +Fixes: 248122212f68 ("net: mvpp2: use device_*/fwnode_* APIs instead of of_*") +Cc: Marcin Wojtas +Signed-off-by: Andy Shevchenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 6c81e4f175ac..bf06f2d785db 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -7589,6 +7589,8 @@ static int mvpp2_probe(struct platform_device *pdev) + return 0; + + err_port_probe: ++ fwnode_handle_put(port_fwnode); ++ + i = 0; + fwnode_for_each_available_child_node(fwnode, port_fwnode) { + if (priv->port_list[i]) +-- +2.30.2 + diff --git a/queue-5.12/net-pch_gbe-propagate-error-from-devm_gpio_request_o.patch b/queue-5.12/net-pch_gbe-propagate-error-from-devm_gpio_request_o.patch new file mode 100644 index 00000000000..fe64f5c3a57 --- /dev/null +++ b/queue-5.12/net-pch_gbe-propagate-error-from-devm_gpio_request_o.patch @@ -0,0 +1,56 @@ +From 9beb409a45a533570dbe27be09658b549f928c4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 19:39:27 +0300 +Subject: net: pch_gbe: Propagate error from devm_gpio_request_one() + +From: Andy Shevchenko + +[ Upstream commit 9e3617a7b84512bf96c04f9cf82d1a7257d33794 ] + +If GPIO controller is not available yet we need to defer +the probe of GBE until provider will become available. + +While here, drop GPIOF_EXPORT because it's deprecated and +may not be available. + +Fixes: f1a26fdf5944 ("pch_gbe: Add MinnowBoard support") +Signed-off-by: Andy Shevchenko +Tested-by: Flavio Suligoi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +index 140cee7c459d..1b32a43f7024 100644 +--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c ++++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c +@@ -2531,9 +2531,13 @@ static int pch_gbe_probe(struct pci_dev *pdev, + adapter->pdev = pdev; + adapter->hw.back = adapter; + adapter->hw.reg = pcim_iomap_table(pdev)[PCH_GBE_PCI_BAR]; ++ + adapter->pdata = (struct pch_gbe_privdata *)pci_id->driver_data; +- if (adapter->pdata && adapter->pdata->platform_init) +- adapter->pdata->platform_init(pdev); ++ if (adapter->pdata && adapter->pdata->platform_init) { ++ ret = adapter->pdata->platform_init(pdev); ++ if (ret) ++ goto err_free_netdev; ++ } + + adapter->ptp_pdev = + pci_get_domain_bus_and_slot(pci_domain_nr(adapter->pdev->bus), +@@ -2628,7 +2632,7 @@ err_free_netdev: + */ + static int pch_gbe_minnow_platform_init(struct pci_dev *pdev) + { +- unsigned long flags = GPIOF_DIR_OUT | GPIOF_INIT_HIGH | GPIOF_EXPORT; ++ unsigned long flags = GPIOF_OUT_INIT_HIGH; + unsigned gpio = MINNOW_PHY_RESET_GPIO; + int ret; + +-- +2.30.2 + diff --git a/queue-5.12/net-phy-mscc-fix-macsec-key-length.patch b/queue-5.12/net-phy-mscc-fix-macsec-key-length.patch new file mode 100644 index 00000000000..bdc346a7a3d --- /dev/null +++ b/queue-5.12/net-phy-mscc-fix-macsec-key-length.patch @@ -0,0 +1,56 @@ +From cd9cdf99f98f86ee65ce341b71765683a0b0a7fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Jun 2021 11:38:29 +0200 +Subject: net: phy: mscc: fix macsec key length + +From: Antoine Tenart + +[ Upstream commit c309217f91f2d2097c2a0a832d9bff50b88c81dc ] + +The key length used to store the macsec key was set to MACSEC_KEYID_LEN +(16), which is an issue as: +- This was never meant to be the key length. +- The key length can be > 16. + +Fix this by using MACSEC_MAX_KEY_LEN instead (the max length accepted in +uAPI). + +Fixes: 28c5107aa904 ("net: phy: mscc: macsec support") +Reported-by: Lior Nahmanson +Signed-off-by: Antoine Tenart +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mscc/mscc_macsec.c | 2 +- + drivers/net/phy/mscc/mscc_macsec.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/phy/mscc/mscc_macsec.c b/drivers/net/phy/mscc/mscc_macsec.c +index 10be266e48e8..b7b2521c73fb 100644 +--- a/drivers/net/phy/mscc/mscc_macsec.c ++++ b/drivers/net/phy/mscc/mscc_macsec.c +@@ -501,7 +501,7 @@ static u32 vsc8584_macsec_flow_context_id(struct macsec_flow *flow) + } + + /* Derive the AES key to get a key for the hash autentication */ +-static int vsc8584_macsec_derive_key(const u8 key[MACSEC_KEYID_LEN], ++static int vsc8584_macsec_derive_key(const u8 key[MACSEC_MAX_KEY_LEN], + u16 key_len, u8 hkey[16]) + { + const u8 input[AES_BLOCK_SIZE] = {0}; +diff --git a/drivers/net/phy/mscc/mscc_macsec.h b/drivers/net/phy/mscc/mscc_macsec.h +index 9c6d25e36de2..453304bae778 100644 +--- a/drivers/net/phy/mscc/mscc_macsec.h ++++ b/drivers/net/phy/mscc/mscc_macsec.h +@@ -81,7 +81,7 @@ struct macsec_flow { + /* Highest takes precedence [0..15] */ + u8 priority; + +- u8 key[MACSEC_KEYID_LEN]; ++ u8 key[MACSEC_MAX_KEY_LEN]; + + union { + struct macsec_rx_sa *rx_sa; +-- +2.30.2 + diff --git a/queue-5.12/net-pxa168_eth-fix-a-potential-data-race-in-pxa168_e.patch b/queue-5.12/net-pxa168_eth-fix-a-potential-data-race-in-pxa168_e.patch new file mode 100644 index 00000000000..68895766b37 --- /dev/null +++ b/queue-5.12/net-pxa168_eth-fix-a-potential-data-race-in-pxa168_e.patch @@ -0,0 +1,43 @@ +From 4ebd8d895f2df04c5a7c1dd91f42934d2e98b8ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 11:35:26 +0200 +Subject: net: pxa168_eth: Fix a potential data race in pxa168_eth_remove + +From: Pavel Machek + +[ Upstream commit bd70957438f0cc4879cbdff8bbc8614bc1cddf49 ] + +Commit 0571a753cb07 cancelled delayed work too late, keeping small +race. Cancel work sooner to close it completely. + +Signed-off-by: Pavel Machek (CIP) +Fixes: 0571a753cb07 ("net: pxa168_eth: Fix a potential data race in pxa168_eth_remove") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/pxa168_eth.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/pxa168_eth.c b/drivers/net/ethernet/marvell/pxa168_eth.c +index 3712e1786091..406fdfe968bf 100644 +--- a/drivers/net/ethernet/marvell/pxa168_eth.c ++++ b/drivers/net/ethernet/marvell/pxa168_eth.c +@@ -1533,6 +1533,7 @@ static int pxa168_eth_remove(struct platform_device *pdev) + struct net_device *dev = platform_get_drvdata(pdev); + struct pxa168_eth_private *pep = netdev_priv(dev); + ++ cancel_work_sync(&pep->tx_timeout_task); + if (pep->htpr) { + dma_free_coherent(pep->dev->dev.parent, HASH_ADDR_TABLE_SIZE, + pep->htpr, pep->htpr_dma); +@@ -1544,7 +1545,6 @@ static int pxa168_eth_remove(struct platform_device *pdev) + clk_disable_unprepare(pep->clk); + mdiobus_unregister(pep->smi_bus); + mdiobus_free(pep->smi_bus); +- cancel_work_sync(&pep->tx_timeout_task); + unregister_netdev(dev); + free_netdev(dev); + return 0; +-- +2.30.2 + diff --git a/queue-5.12/net-qrtr-ns-fix-error-return-code-in-qrtr_ns_init.patch b/queue-5.12/net-qrtr-ns-fix-error-return-code-in-qrtr_ns_init.patch new file mode 100644 index 00000000000..4e9f76780b0 --- /dev/null +++ b/queue-5.12/net-qrtr-ns-fix-error-return-code-in-qrtr_ns_init.patch @@ -0,0 +1,41 @@ +From cea8740eb38281cede2cc7f24b9138d69f768d15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 15:58:52 +0000 +Subject: net: qrtr: ns: Fix error return code in qrtr_ns_init() + +From: Wei Yongjun + +[ Upstream commit a49e72b3bda73d36664a084e47da9727a31b8095 ] + +Fix to return a negative error code -ENOMEM from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: c6e08d6251f3 ("net: qrtr: Allocate workqueue before kernel_bind") +Reported-by: Hulk Robot +Signed-off-by: Wei Yongjun +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/qrtr/ns.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c +index 8d00dfe8139e..1990d496fcfc 100644 +--- a/net/qrtr/ns.c ++++ b/net/qrtr/ns.c +@@ -775,8 +775,10 @@ int qrtr_ns_init(void) + } + + qrtr_ns.workqueue = alloc_workqueue("qrtr_ns_handler", WQ_UNBOUND, 1); +- if (!qrtr_ns.workqueue) ++ if (!qrtr_ns.workqueue) { ++ ret = -ENOMEM; + goto err_sock; ++ } + + qrtr_ns.sock->sk->sk_data_ready = qrtr_ns_data_ready; + +-- +2.30.2 + diff --git a/queue-5.12/net-sched-act_vlan-fix-modify-to-allow-0.patch b/queue-5.12/net-sched-act_vlan-fix-modify-to-allow-0.patch new file mode 100644 index 00000000000..ca4eb421b0d --- /dev/null +++ b/queue-5.12/net-sched-act_vlan-fix-modify-to-allow-0.patch @@ -0,0 +1,95 @@ +From b40e2054038c275d98c4711f833c194dd15609c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 15:30:50 +0300 +Subject: net/sched: act_vlan: Fix modify to allow 0 + +From: Boris Sukholitko + +[ Upstream commit 9c5eee0afca09cbde6bd00f77876754aaa552970 ] + +Currently vlan modification action checks existence of vlan priority by +comparing it to 0. Therefore it is impossible to modify existing vlan +tag to have priority 0. + +For example, the following tc command will change the vlan id but will +not affect vlan priority: + +tc filter add dev eth1 ingress matchall action vlan modify id 300 \ + priority 0 pipe mirred egress redirect dev eth2 + +The incoming packet on eth1: + +ethertype 802.1Q (0x8100), vlan 200, p 4, ethertype IPv4 + +will be changed to: + +ethertype 802.1Q (0x8100), vlan 300, p 4, ethertype IPv4 + +although the user has intended to have p == 0. + +The fix is to add tcfv_push_prio_exists flag to struct tcf_vlan_params +and rely on it when deciding to set the priority. + +Fixes: 45a497f2d149a4a8061c (net/sched: act_vlan: Introduce TCA_VLAN_ACT_MODIFY vlan action) +Signed-off-by: Boris Sukholitko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tc_act/tc_vlan.h | 1 + + net/sched/act_vlan.c | 7 +++++-- + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/include/net/tc_act/tc_vlan.h b/include/net/tc_act/tc_vlan.h +index f051046ba034..f94b8bc26f9e 100644 +--- a/include/net/tc_act/tc_vlan.h ++++ b/include/net/tc_act/tc_vlan.h +@@ -16,6 +16,7 @@ struct tcf_vlan_params { + u16 tcfv_push_vid; + __be16 tcfv_push_proto; + u8 tcfv_push_prio; ++ bool tcfv_push_prio_exists; + struct rcu_head rcu; + }; + +diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c +index 1cac3c6fbb49..a108469c664f 100644 +--- a/net/sched/act_vlan.c ++++ b/net/sched/act_vlan.c +@@ -70,7 +70,7 @@ static int tcf_vlan_act(struct sk_buff *skb, const struct tc_action *a, + /* replace the vid */ + tci = (tci & ~VLAN_VID_MASK) | p->tcfv_push_vid; + /* replace prio bits, if tcfv_push_prio specified */ +- if (p->tcfv_push_prio) { ++ if (p->tcfv_push_prio_exists) { + tci &= ~VLAN_PRIO_MASK; + tci |= p->tcfv_push_prio << VLAN_PRIO_SHIFT; + } +@@ -121,6 +121,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla, + struct tc_action_net *tn = net_generic(net, vlan_net_id); + struct nlattr *tb[TCA_VLAN_MAX + 1]; + struct tcf_chain *goto_ch = NULL; ++ bool push_prio_exists = false; + struct tcf_vlan_params *p; + struct tc_vlan *parm; + struct tcf_vlan *v; +@@ -189,7 +190,8 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla, + push_proto = htons(ETH_P_8021Q); + } + +- if (tb[TCA_VLAN_PUSH_VLAN_PRIORITY]) ++ push_prio_exists = !!tb[TCA_VLAN_PUSH_VLAN_PRIORITY]; ++ if (push_prio_exists) + push_prio = nla_get_u8(tb[TCA_VLAN_PUSH_VLAN_PRIORITY]); + break; + case TCA_VLAN_ACT_POP_ETH: +@@ -241,6 +243,7 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla, + p->tcfv_action = action; + p->tcfv_push_vid = push_vid; + p->tcfv_push_prio = push_prio; ++ p->tcfv_push_prio_exists = push_prio_exists || action == TCA_VLAN_ACT_PUSH; + p->tcfv_push_proto = push_proto; + + if (action == TCA_VLAN_ACT_PUSH_ETH) { +-- +2.30.2 + diff --git a/queue-5.12/net-sched-add-barrier-to-ensure-correct-ordering-for.patch b/queue-5.12/net-sched-add-barrier-to-ensure-correct-ordering-for.patch new file mode 100644 index 00000000000..4d6386eeaf3 --- /dev/null +++ b/queue-5.12/net-sched-add-barrier-to-ensure-correct-ordering-for.patch @@ -0,0 +1,68 @@ +From 81150e23e8925c7dc816cb945a163706acb0f4f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 09:04:14 +0800 +Subject: net: sched: add barrier to ensure correct ordering for lockless qdisc + +From: Yunsheng Lin + +[ Upstream commit 89837eb4b2463c556a123437f242d6c2bc62ce81 ] + +The spin_trylock() was assumed to contain the implicit +barrier needed to ensure the correct ordering between +STATE_MISSED setting/clearing and STATE_MISSED checking +in commit a90c57f2cedd ("net: sched: fix packet stuck +problem for lockless qdisc"). + +But it turns out that spin_trylock() only has load-acquire +semantic, for strongly-ordered system(like x86), the compiler +barrier implicitly contained in spin_trylock() seems enough +to ensure the correct ordering. But for weakly-orderly system +(like arm64), the store-release semantic is needed to ensure +the correct ordering as clear_bit() and test_bit() is store +operation, see queued_spin_lock(). + +So add the explicit barrier to ensure the correct ordering +for the above case. + +Fixes: a90c57f2cedd ("net: sched: fix packet stuck problem for lockless qdisc") +Signed-off-by: Yunsheng Lin +Acked-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/sch_generic.h | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index 2c4f3527cc09..b070e99c412d 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -163,6 +163,12 @@ static inline bool qdisc_run_begin(struct Qdisc *qdisc) + if (spin_trylock(&qdisc->seqlock)) + goto nolock_empty; + ++ /* Paired with smp_mb__after_atomic() to make sure ++ * STATE_MISSED checking is synchronized with clearing ++ * in pfifo_fast_dequeue(). ++ */ ++ smp_mb__before_atomic(); ++ + /* If the MISSED flag is set, it means other thread has + * set the MISSED flag before second spin_trylock(), so + * we can return false here to avoid multi cpus doing +@@ -180,6 +186,12 @@ static inline bool qdisc_run_begin(struct Qdisc *qdisc) + */ + set_bit(__QDISC_STATE_MISSED, &qdisc->state); + ++ /* spin_trylock() only has load-acquire semantic, so use ++ * smp_mb__after_atomic() to ensure STATE_MISSED is set ++ * before doing the second spin_trylock(). ++ */ ++ smp_mb__after_atomic(); ++ + /* Retry again in case other CPU may not see the new flag + * after it releases the lock at the end of qdisc_run_end(). + */ +-- +2.30.2 + diff --git a/queue-5.12/net-sched-fix-warning-in-tcindex_alloc_perfect_hash.patch b/queue-5.12/net-sched-fix-warning-in-tcindex_alloc_perfect_hash.patch new file mode 100644 index 00000000000..811181872b8 --- /dev/null +++ b/queue-5.12/net-sched-fix-warning-in-tcindex_alloc_perfect_hash.patch @@ -0,0 +1,40 @@ +From ca669d9ee5293b3e424e0a624fd6e43dc65dfbff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 23:23:48 +0300 +Subject: net: sched: fix warning in tcindex_alloc_perfect_hash + +From: Pavel Skripkin + +[ Upstream commit 3f2db250099f46988088800052cdf2332c7aba61 ] + +Syzbot reported warning in tcindex_alloc_perfect_hash. The problem +was in too big cp->hash, which triggers warning in kmalloc. Since +cp->hash comes from userspace, there is no need to warn if value +is not correct + +Fixes: b9a24bb76bf6 ("net_sched: properly handle failure case of tcf_exts_init()") +Reported-and-tested-by: syzbot+1071ad60cd7df39fdadb@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Acked-by: Cong Wang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/cls_tcindex.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c +index c4007b9cd16d..5b274534264c 100644 +--- a/net/sched/cls_tcindex.c ++++ b/net/sched/cls_tcindex.c +@@ -304,7 +304,7 @@ static int tcindex_alloc_perfect_hash(struct net *net, struct tcindex_data *cp) + int i, err = 0; + + cp->perfect = kcalloc(cp->hash, sizeof(struct tcindex_filter_result), +- GFP_KERNEL); ++ GFP_KERNEL | __GFP_NOWARN); + if (!cp->perfect) + return -ENOMEM; + +-- +2.30.2 + diff --git a/queue-5.12/net-ti-am65-cpsw-nuss-fix-crash-when-changing-number.patch b/queue-5.12/net-ti-am65-cpsw-nuss-fix-crash-when-changing-number.patch new file mode 100644 index 00000000000..2faf99c7d00 --- /dev/null +++ b/queue-5.12/net-ti-am65-cpsw-nuss-fix-crash-when-changing-number.patch @@ -0,0 +1,93 @@ +From 150abb2c7afc5f233d739e5e3821d2cd802142a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 20:08:57 +0530 +Subject: net: ti: am65-cpsw-nuss: Fix crash when changing number of TX queues + +From: Vignesh Raghavendra + +[ Upstream commit ce8eb4c728ef40b554b4f3d8963f11ed44502e00 ] + +When changing number of TX queues using ethtool: + + # ethtool -L eth0 tx 1 + [ 135.301047] Unable to handle kernel paging request at virtual address 00000000af5d0000 + [...] + [ 135.525128] Call trace: + [ 135.525142] dma_release_from_dev_coherent+0x2c/0xb0 + [ 135.525148] dma_free_attrs+0x54/0xe0 + [ 135.525156] k3_cppi_desc_pool_destroy+0x50/0xa0 + [ 135.525164] am65_cpsw_nuss_remove_tx_chns+0x88/0xdc + [ 135.525171] am65_cpsw_set_channels+0x3c/0x70 + [...] + +This is because k3_cppi_desc_pool_destroy() which is called after +k3_udma_glue_release_tx_chn() in am65_cpsw_nuss_remove_tx_chns() +references struct device that is unregistered at the end of +k3_udma_glue_release_tx_chn() + +Therefore the right order is to call k3_cppi_desc_pool_destroy() and +destroy desc pool before calling k3_udma_glue_release_tx_chn(). +Fix this throughout the driver. + +Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver") +Signed-off-by: Vignesh Raghavendra +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ti/am65-cpsw-nuss.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +index 638d7b03be4b..a98182b2d19b 100644 +--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c ++++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c +@@ -1506,12 +1506,12 @@ static void am65_cpsw_nuss_free_tx_chns(void *data) + for (i = 0; i < common->tx_ch_num; i++) { + struct am65_cpsw_tx_chn *tx_chn = &common->tx_chns[i]; + +- if (!IS_ERR_OR_NULL(tx_chn->tx_chn)) +- k3_udma_glue_release_tx_chn(tx_chn->tx_chn); +- + if (!IS_ERR_OR_NULL(tx_chn->desc_pool)) + k3_cppi_desc_pool_destroy(tx_chn->desc_pool); + ++ if (!IS_ERR_OR_NULL(tx_chn->tx_chn)) ++ k3_udma_glue_release_tx_chn(tx_chn->tx_chn); ++ + memset(tx_chn, 0, sizeof(*tx_chn)); + } + } +@@ -1531,12 +1531,12 @@ void am65_cpsw_nuss_remove_tx_chns(struct am65_cpsw_common *common) + + netif_napi_del(&tx_chn->napi_tx); + +- if (!IS_ERR_OR_NULL(tx_chn->tx_chn)) +- k3_udma_glue_release_tx_chn(tx_chn->tx_chn); +- + if (!IS_ERR_OR_NULL(tx_chn->desc_pool)) + k3_cppi_desc_pool_destroy(tx_chn->desc_pool); + ++ if (!IS_ERR_OR_NULL(tx_chn->tx_chn)) ++ k3_udma_glue_release_tx_chn(tx_chn->tx_chn); ++ + memset(tx_chn, 0, sizeof(*tx_chn)); + } + } +@@ -1624,11 +1624,11 @@ static void am65_cpsw_nuss_free_rx_chns(void *data) + + rx_chn = &common->rx_chns; + +- if (!IS_ERR_OR_NULL(rx_chn->rx_chn)) +- k3_udma_glue_release_rx_chn(rx_chn->rx_chn); +- + if (!IS_ERR_OR_NULL(rx_chn->desc_pool)) + k3_cppi_desc_pool_destroy(rx_chn->desc_pool); ++ ++ if (!IS_ERR_OR_NULL(rx_chn->rx_chn)) ++ k3_udma_glue_release_rx_chn(rx_chn->rx_chn); + } + + static int am65_cpsw_nuss_init_rx_chns(struct am65_cpsw_common *common) +-- +2.30.2 + diff --git a/queue-5.12/net-tipc-fix-fb_mtu-eat-two-pages.patch b/queue-5.12/net-tipc-fix-fb_mtu-eat-two-pages.patch new file mode 100644 index 00000000000..b56525e5e1d --- /dev/null +++ b/queue-5.12/net-tipc-fix-fb_mtu-eat-two-pages.patch @@ -0,0 +1,118 @@ +From 39f98ce68f042e468842867843f4e0fc6d800b8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Jun 2021 23:37:44 -0700 +Subject: net: tipc: fix FB_MTU eat two pages + +From: Menglong Dong + +[ Upstream commit 0c6de0c943dbb42831bf7502eb5c007f71e752d2 ] + +FB_MTU is used in 'tipc_msg_build()' to alloc smaller skb when memory +allocation fails, which can avoid unnecessary sending failures. + +The value of FB_MTU now is 3744, and the data size will be: + + (3744 + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)) + \ + SKB_DATA_ALIGN(BUF_HEADROOM + BUF_TAILROOM + 3)) + +which is larger than one page(4096), and two pages will be allocated. + +To avoid it, replace '3744' with a calculation: + + (PAGE_SIZE - SKB_DATA_ALIGN(BUF_OVERHEAD) - \ + SKB_DATA_ALIGN(sizeof(struct skb_shared_info))) + +What's more, alloc_skb_fclone() will call SKB_DATA_ALIGN for data size, +and it's not necessary to make alignment for buf_size in +tipc_buf_acquire(). So, just remove it. + +Fixes: 4c94cc2d3d57 ("tipc: fall back to smaller MTU if allocation of local send skb fails") +Signed-off-by: Menglong Dong +Acked-by: Jon Maloy +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/bcast.c | 2 +- + net/tipc/msg.c | 17 ++++++++--------- + net/tipc/msg.h | 3 ++- + 3 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c +index d4beca895992..593846d25214 100644 +--- a/net/tipc/bcast.c ++++ b/net/tipc/bcast.c +@@ -699,7 +699,7 @@ int tipc_bcast_init(struct net *net) + spin_lock_init(&tipc_net(net)->bclock); + + if (!tipc_link_bc_create(net, 0, 0, NULL, +- FB_MTU, ++ one_page_mtu, + BCLINK_WIN_DEFAULT, + BCLINK_WIN_DEFAULT, + 0, +diff --git a/net/tipc/msg.c b/net/tipc/msg.c +index d0fc5fadbc68..b7943da9d095 100644 +--- a/net/tipc/msg.c ++++ b/net/tipc/msg.c +@@ -44,12 +44,15 @@ + #define MAX_FORWARD_SIZE 1024 + #ifdef CONFIG_TIPC_CRYPTO + #define BUF_HEADROOM ALIGN(((LL_MAX_HEADER + 48) + EHDR_MAX_SIZE), 16) +-#define BUF_TAILROOM (TIPC_AES_GCM_TAG_SIZE) ++#define BUF_OVERHEAD (BUF_HEADROOM + TIPC_AES_GCM_TAG_SIZE) + #else + #define BUF_HEADROOM (LL_MAX_HEADER + 48) +-#define BUF_TAILROOM 16 ++#define BUF_OVERHEAD BUF_HEADROOM + #endif + ++const int one_page_mtu = PAGE_SIZE - SKB_DATA_ALIGN(BUF_OVERHEAD) - ++ SKB_DATA_ALIGN(sizeof(struct skb_shared_info)); ++ + static unsigned int align(unsigned int i) + { + return (i + 3) & ~3u; +@@ -69,13 +72,8 @@ static unsigned int align(unsigned int i) + struct sk_buff *tipc_buf_acquire(u32 size, gfp_t gfp) + { + struct sk_buff *skb; +-#ifdef CONFIG_TIPC_CRYPTO +- unsigned int buf_size = (BUF_HEADROOM + size + BUF_TAILROOM + 3) & ~3u; +-#else +- unsigned int buf_size = (BUF_HEADROOM + size + 3) & ~3u; +-#endif + +- skb = alloc_skb_fclone(buf_size, gfp); ++ skb = alloc_skb_fclone(BUF_OVERHEAD + size, gfp); + if (skb) { + skb_reserve(skb, BUF_HEADROOM); + skb_put(skb, size); +@@ -395,7 +393,8 @@ int tipc_msg_build(struct tipc_msg *mhdr, struct msghdr *m, int offset, + if (unlikely(!skb)) { + if (pktmax != MAX_MSG_SIZE) + return -ENOMEM; +- rc = tipc_msg_build(mhdr, m, offset, dsz, FB_MTU, list); ++ rc = tipc_msg_build(mhdr, m, offset, dsz, ++ one_page_mtu, list); + if (rc != dsz) + return rc; + if (tipc_msg_assemble(list)) +diff --git a/net/tipc/msg.h b/net/tipc/msg.h +index 5d64596ba987..64ae4c4c44f8 100644 +--- a/net/tipc/msg.h ++++ b/net/tipc/msg.h +@@ -99,9 +99,10 @@ struct plist; + #define MAX_H_SIZE 60 /* Largest possible TIPC header size */ + + #define MAX_MSG_SIZE (MAX_H_SIZE + TIPC_MAX_USER_MSG_SIZE) +-#define FB_MTU 3744 + #define TIPC_MEDIA_INFO_OFFSET 5 + ++extern const int one_page_mtu; ++ + struct tipc_skb_cb { + union { + struct { +-- +2.30.2 + diff --git a/queue-5.12/netfilter-nf_tables-do-not-allow-to-delete-table-wit.patch b/queue-5.12/netfilter-nf_tables-do-not-allow-to-delete-table-wit.patch new file mode 100644 index 00000000000..2c1cabe63e1 --- /dev/null +++ b/queue-5.12/netfilter-nf_tables-do-not-allow-to-delete-table-wit.patch @@ -0,0 +1,59 @@ +From 1d43bde65926d72b2a0ed061278a586ac4042837 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 12:10:49 +0200 +Subject: netfilter: nf_tables: do not allow to delete table with owner by + handle + +From: Pablo Neira Ayuso + +[ Upstream commit e31f072ffab0397a328b31a9589dcf9733dc9c72 ] + +nft_table_lookup_byhandle() also needs to validate the netlink PortID +owner when deleting a table by handle. + +Fixes: 6001a930ce03 ("netfilter: nftables: introduce table ownership") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 3705086d43f5..6b79fa357bfe 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -533,14 +533,19 @@ static struct nft_table *nft_table_lookup(const struct net *net, + + static struct nft_table *nft_table_lookup_byhandle(const struct net *net, + const struct nlattr *nla, +- u8 genmask) ++ u8 genmask, u32 nlpid) + { + struct nft_table *table; + + list_for_each_entry(table, &net->nft.tables, list) { + if (be64_to_cpu(nla_get_be64(nla)) == table->handle && +- nft_active_genmask(table, genmask)) ++ nft_active_genmask(table, genmask)) { ++ if (nft_table_has_owner(table) && ++ nlpid && table->nlpid != nlpid) ++ return ERR_PTR(-EPERM); ++ + return table; ++ } + } + + return ERR_PTR(-ENOENT); +@@ -1213,7 +1218,8 @@ static int nf_tables_deltable(struct net *net, struct sock *nlsk, + + if (nla[NFTA_TABLE_HANDLE]) { + attr = nla[NFTA_TABLE_HANDLE]; +- table = nft_table_lookup_byhandle(net, attr, genmask); ++ table = nft_table_lookup_byhandle(net, attr, genmask, ++ NETLINK_CB(skb).portid); + } else { + attr = nla[NFTA_TABLE_NAME]; + table = nft_table_lookup(net, attr, family, genmask, +-- +2.30.2 + diff --git a/queue-5.12/netfilter-nf_tables-skip-netlink-portid-validation-i.patch b/queue-5.12/netfilter-nf_tables-skip-netlink-portid-validation-i.patch new file mode 100644 index 00000000000..070445598bf --- /dev/null +++ b/queue-5.12/netfilter-nf_tables-skip-netlink-portid-validation-i.patch @@ -0,0 +1,38 @@ +From bfacc2626402db4a9ccccae216a7757a6a4fd7c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 11:45:11 +0200 +Subject: netfilter: nf_tables: skip netlink portID validation if zero + +From: Pablo Neira Ayuso + +[ Upstream commit 534799097a777e82910f77a4f9d289c815a9a64e ] + +nft_table_lookup() allows us to obtain the table object by the name and +the family. The netlink portID validation needs to be skipped for the +dump path, since the ownership only applies to commands to update the +given table. Skip validation if the specified netlink PortID is zero +when calling nft_table_lookup(). + +Fixes: 6001a930ce03 ("netfilter: nftables: introduce table ownership") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 9d5ea2352965..3705086d43f5 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -521,7 +521,7 @@ static struct nft_table *nft_table_lookup(const struct net *net, + table->family == family && + nft_active_genmask(table, genmask)) { + if (nft_table_has_owner(table) && +- table->nlpid != nlpid) ++ nlpid && table->nlpid != nlpid) + return ERR_PTR(-EPERM); + + return table; +-- +2.30.2 + diff --git a/queue-5.12/netfilter-nf_tables_offload-check-flow_dissector_key.patch b/queue-5.12/netfilter-nf_tables_offload-check-flow_dissector_key.patch new file mode 100644 index 00000000000..21b81f902b6 --- /dev/null +++ b/queue-5.12/netfilter-nf_tables_offload-check-flow_dissector_key.patch @@ -0,0 +1,60 @@ +From a3bfeafe772c285b6fa3bccf0b67fdfeab006704 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 01:25:14 +0200 +Subject: netfilter: nf_tables_offload: check FLOW_DISSECTOR_KEY_BASIC in VLAN + transfer logic + +From: Pablo Neira Ayuso + +[ Upstream commit ea45fdf82cc90430bb7c280e5e53821e833782c5 ] + +The VLAN transfer logic should actually check for +FLOW_DISSECTOR_KEY_BASIC, not FLOW_DISSECTOR_KEY_CONTROL. Moreover, do +not fallback to case 2) .n_proto is set to 802.1q or 802.1ad, if +FLOW_DISSECTOR_KEY_BASIC is unset. + +Fixes: 783003f3bb8a ("netfilter: nftables_offload: special ethertype handling for VLAN") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_offload.c | 17 +++++++---------- + 1 file changed, 7 insertions(+), 10 deletions(-) + +diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c +index 2b00f7f47693..9ce776175214 100644 +--- a/net/netfilter/nf_tables_offload.c ++++ b/net/netfilter/nf_tables_offload.c +@@ -54,15 +54,10 @@ static void nft_flow_rule_transfer_vlan(struct nft_offload_ctx *ctx, + struct nft_flow_rule *flow) + { + struct nft_flow_match *match = &flow->match; +- struct nft_offload_ethertype ethertype; +- +- if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_CONTROL) && +- match->key.basic.n_proto != htons(ETH_P_8021Q) && +- match->key.basic.n_proto != htons(ETH_P_8021AD)) +- return; +- +- ethertype.value = match->key.basic.n_proto; +- ethertype.mask = match->mask.basic.n_proto; ++ struct nft_offload_ethertype ethertype = { ++ .value = match->key.basic.n_proto, ++ .mask = match->mask.basic.n_proto, ++ }; + + if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_VLAN) && + (match->key.vlan.vlan_tpid == htons(ETH_P_8021Q) || +@@ -76,7 +71,9 @@ static void nft_flow_rule_transfer_vlan(struct nft_offload_ctx *ctx, + match->dissector.offset[FLOW_DISSECTOR_KEY_CVLAN] = + offsetof(struct nft_flow_key, cvlan); + match->dissector.used_keys |= BIT(FLOW_DISSECTOR_KEY_CVLAN); +- } else { ++ } else if (match->dissector.used_keys & BIT(FLOW_DISSECTOR_KEY_BASIC) && ++ (match->key.basic.n_proto == htons(ETH_P_8021Q) || ++ match->key.basic.n_proto == htons(ETH_P_8021AD))) { + match->key.basic.n_proto = match->key.vlan.vlan_tpid; + match->mask.basic.n_proto = match->mask.vlan.vlan_tpid; + match->key.vlan.vlan_tpid = ethertype.value; +-- +2.30.2 + diff --git a/queue-5.12/netfilter-nft_exthdr-check-for-ipv6-packet-before-fu.patch b/queue-5.12/netfilter-nft_exthdr-check-for-ipv6-packet-before-fu.patch new file mode 100644 index 00000000000..98fab427d71 --- /dev/null +++ b/queue-5.12/netfilter-nft_exthdr-check-for-ipv6-packet-before-fu.patch @@ -0,0 +1,38 @@ +From 0e775088a4751fe623c40e4266787b7ac4f1b9c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 20:20:30 +0200 +Subject: netfilter: nft_exthdr: check for IPv6 packet before further + processing + +From: Pablo Neira Ayuso + +[ Upstream commit cdd73cc545c0fb9b1a1f7b209f4f536e7990cff4 ] + +ipv6_find_hdr() does not validate that this is an IPv6 packet. Add a +sanity check for calling ipv6_find_hdr() to make sure an IPv6 packet +is passed for parsing. + +Fixes: 96518518cc41 ("netfilter: add nftables") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_exthdr.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c +index f64f0017e9a5..670dd146fb2b 100644 +--- a/net/netfilter/nft_exthdr.c ++++ b/net/netfilter/nft_exthdr.c +@@ -42,6 +42,9 @@ static void nft_exthdr_ipv6_eval(const struct nft_expr *expr, + unsigned int offset = 0; + int err; + ++ if (pkt->skb->protocol != htons(ETH_P_IPV6)) ++ goto err; ++ + err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL); + if (priv->flags & NFT_EXTHDR_F_PRESENT) { + nft_reg_store8(dest, err >= 0); +-- +2.30.2 + diff --git a/queue-5.12/netfilter-nft_osf-check-for-tcp-packet-before-furthe.patch b/queue-5.12/netfilter-nft_osf-check-for-tcp-packet-before-furthe.patch new file mode 100644 index 00000000000..87e9f4f103d --- /dev/null +++ b/queue-5.12/netfilter-nft_osf-check-for-tcp-packet-before-furthe.patch @@ -0,0 +1,40 @@ +From 4aa4fbef4c07ca3f7816177b62938aebf76a6d00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 20:20:31 +0200 +Subject: netfilter: nft_osf: check for TCP packet before further processing + +From: Pablo Neira Ayuso + +[ Upstream commit 8f518d43f89ae00b9cf5460e10b91694944ca1a8 ] + +The osf expression only supports for TCP packets, add a upfront sanity +check to skip packet parsing if this is not a TCP packet. + +Fixes: b96af92d6eaf ("netfilter: nf_tables: implement Passive OS fingerprint module in nft_osf") +Signed-off-by: Pablo Neira Ayuso +Reported-by: kernel test robot +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_osf.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/netfilter/nft_osf.c b/net/netfilter/nft_osf.c +index ac61f708b82d..d82677e83400 100644 +--- a/net/netfilter/nft_osf.c ++++ b/net/netfilter/nft_osf.c +@@ -28,6 +28,11 @@ static void nft_osf_eval(const struct nft_expr *expr, struct nft_regs *regs, + struct nf_osf_data data; + struct tcphdr _tcph; + ++ if (pkt->tprot != IPPROTO_TCP) { ++ regs->verdict.code = NFT_BREAK; ++ return; ++ } ++ + tcp = skb_header_pointer(skb, ip_hdrlen(skb), + sizeof(struct tcphdr), &_tcph); + if (!tcp) { +-- +2.30.2 + diff --git a/queue-5.12/netfilter-nft_tproxy-restrict-support-to-tcp-and-udp.patch b/queue-5.12/netfilter-nft_tproxy-restrict-support-to-tcp-and-udp.patch new file mode 100644 index 00000000000..35b5d9b5c4e --- /dev/null +++ b/queue-5.12/netfilter-nft_tproxy-restrict-support-to-tcp-and-udp.patch @@ -0,0 +1,50 @@ +From f206597a02bcc7a4c3c08fc781a5db87569b7fdf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jun 2021 19:26:56 +0200 +Subject: netfilter: nft_tproxy: restrict support to TCP and UDP transport + protocols + +From: Pablo Neira Ayuso + +[ Upstream commit 52f0f4e178c757b3d356087376aad8bd77271828 ] + +Add unfront check for TCP and UDP packets before performing further +processing. + +Fixes: 4ed8eb6570a4 ("netfilter: nf_tables: Add native tproxy support") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_tproxy.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_tproxy.c b/net/netfilter/nft_tproxy.c +index 43a5a780a6d3..37c728bdad41 100644 +--- a/net/netfilter/nft_tproxy.c ++++ b/net/netfilter/nft_tproxy.c +@@ -30,6 +30,12 @@ static void nft_tproxy_eval_v4(const struct nft_expr *expr, + __be16 tport = 0; + struct sock *sk; + ++ if (pkt->tprot != IPPROTO_TCP && ++ pkt->tprot != IPPROTO_UDP) { ++ regs->verdict.code = NFT_BREAK; ++ return; ++ } ++ + hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr); + if (!hp) { + regs->verdict.code = NFT_BREAK; +@@ -91,7 +97,8 @@ static void nft_tproxy_eval_v6(const struct nft_expr *expr, + + memset(&taddr, 0, sizeof(taddr)); + +- if (!pkt->tprot_set) { ++ if (pkt->tprot != IPPROTO_TCP && ++ pkt->tprot != IPPROTO_UDP) { + regs->verdict.code = NFT_BREAK; + return; + } +-- +2.30.2 + diff --git a/queue-5.12/netlabel-fix-memory-leak-in-netlbl_mgmt_add_common.patch b/queue-5.12/netlabel-fix-memory-leak-in-netlbl_mgmt_add_common.patch new file mode 100644 index 00000000000..eecb6116976 --- /dev/null +++ b/queue-5.12/netlabel-fix-memory-leak-in-netlbl_mgmt_add_common.patch @@ -0,0 +1,114 @@ +From dc8c16c60a2c1045f93bdcd66762e9865c2fb6f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 10:14:44 +0800 +Subject: netlabel: Fix memory leak in netlbl_mgmt_add_common + +From: Liu Shixin + +[ Upstream commit b8f6b0522c298ae9267bd6584e19b942a0636910 ] + +Hulk Robot reported memory leak in netlbl_mgmt_add_common. +The problem is non-freed map in case of netlbl_domhsh_add() failed. + +BUG: memory leak +unreferenced object 0xffff888100ab7080 (size 96): + comm "syz-executor537", pid 360, jiffies 4294862456 (age 22.678s) + hex dump (first 32 bytes): + 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + fe 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ................ + backtrace: + [<0000000008b40026>] netlbl_mgmt_add_common.isra.0+0xb2a/0x1b40 + [<000000003be10950>] netlbl_mgmt_add+0x271/0x3c0 + [<00000000c70487ed>] genl_family_rcv_msg_doit.isra.0+0x20e/0x320 + [<000000001f2ff614>] genl_rcv_msg+0x2bf/0x4f0 + [<0000000089045792>] netlink_rcv_skb+0x134/0x3d0 + [<0000000020e96fdd>] genl_rcv+0x24/0x40 + [<0000000042810c66>] netlink_unicast+0x4a0/0x6a0 + [<000000002e1659f0>] netlink_sendmsg+0x789/0xc70 + [<000000006e43415f>] sock_sendmsg+0x139/0x170 + [<00000000680a73d7>] ____sys_sendmsg+0x658/0x7d0 + [<0000000065cbb8af>] ___sys_sendmsg+0xf8/0x170 + [<0000000019932b6c>] __sys_sendmsg+0xd3/0x190 + [<00000000643ac172>] do_syscall_64+0x37/0x90 + [<000000009b79d6dc>] entry_SYSCALL_64_after_hwframe+0x44/0xae + +Fixes: 63c416887437 ("netlabel: Add network address selectors to the NetLabel/LSM domain mapping") +Reported-by: Hulk Robot +Signed-off-by: Liu Shixin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netlabel/netlabel_mgmt.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c +index df1b41ed73fd..19e4fffccf78 100644 +--- a/net/netlabel/netlabel_mgmt.c ++++ b/net/netlabel/netlabel_mgmt.c +@@ -76,6 +76,7 @@ static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = { + static int netlbl_mgmt_add_common(struct genl_info *info, + struct netlbl_audit *audit_info) + { ++ void *pmap = NULL; + int ret_val = -EINVAL; + struct netlbl_domaddr_map *addrmap = NULL; + struct cipso_v4_doi *cipsov4 = NULL; +@@ -175,6 +176,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info, + ret_val = -ENOMEM; + goto add_free_addrmap; + } ++ pmap = map; + map->list.addr = addr->s_addr & mask->s_addr; + map->list.mask = mask->s_addr; + map->list.valid = 1; +@@ -183,10 +185,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info, + map->def.cipso = cipsov4; + + ret_val = netlbl_af4list_add(&map->list, &addrmap->list4); +- if (ret_val != 0) { +- kfree(map); +- goto add_free_addrmap; +- } ++ if (ret_val != 0) ++ goto add_free_map; + + entry->family = AF_INET; + entry->def.type = NETLBL_NLTYPE_ADDRSELECT; +@@ -223,6 +223,7 @@ static int netlbl_mgmt_add_common(struct genl_info *info, + ret_val = -ENOMEM; + goto add_free_addrmap; + } ++ pmap = map; + map->list.addr = *addr; + map->list.addr.s6_addr32[0] &= mask->s6_addr32[0]; + map->list.addr.s6_addr32[1] &= mask->s6_addr32[1]; +@@ -235,10 +236,8 @@ static int netlbl_mgmt_add_common(struct genl_info *info, + map->def.calipso = calipso; + + ret_val = netlbl_af6list_add(&map->list, &addrmap->list6); +- if (ret_val != 0) { +- kfree(map); +- goto add_free_addrmap; +- } ++ if (ret_val != 0) ++ goto add_free_map; + + entry->family = AF_INET6; + entry->def.type = NETLBL_NLTYPE_ADDRSELECT; +@@ -248,10 +247,12 @@ static int netlbl_mgmt_add_common(struct genl_info *info, + + ret_val = netlbl_domhsh_add(entry, audit_info); + if (ret_val != 0) +- goto add_free_addrmap; ++ goto add_free_map; + + return 0; + ++add_free_map: ++ kfree(pmap); + add_free_addrmap: + kfree(addrmap); + add_doi_put_def: +-- +2.30.2 + diff --git a/queue-5.12/nvme-pci-fix-var.-type-for-increasing-cq_head.patch b/queue-5.12/nvme-pci-fix-var.-type-for-increasing-cq_head.patch new file mode 100644 index 00000000000..f90dacc4387 --- /dev/null +++ b/queue-5.12/nvme-pci-fix-var.-type-for-increasing-cq_head.patch @@ -0,0 +1,44 @@ +From 5dc281fca03b38c2a5ff61ab190c98786c396341 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 15:02:17 +0900 +Subject: nvme-pci: fix var. type for increasing cq_head + +From: JK Kim + +[ Upstream commit a0aac973a26d1ac814b9e131e209eb39472a67ce ] + +nvmeq->cq_head is compared with nvmeq->q_depth and changed the value +and cq_phase for handling the next cq db. + +but, nvmeq->q_depth's type is u32 and max. value is 0x10000 when +CQP.MSQE is 0xffff and io_queue_depth is 0x10000. + +current temp. variable for comparing with nvmeq->q_depth is overflowed +when previous nvmeq->cq_head is 0xffff. + +in this case, nvmeq->cq_phase is not updated. +so, fix data type for temp. variable to u32. + +Signed-off-by: JK Kim +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index c92a15c3fbc5..4555e9202851 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1027,7 +1027,7 @@ static inline void nvme_handle_cqe(struct nvme_queue *nvmeq, u16 idx) + + static inline void nvme_update_cq_head(struct nvme_queue *nvmeq) + { +- u16 tmp = nvmeq->cq_head + 1; ++ u32 tmp = nvmeq->cq_head + 1; + + if (tmp == nvmeq->q_depth) { + nvmeq->cq_head = 0; +-- +2.30.2 + diff --git a/queue-5.12/nvme-pci-look-for-storaged3enable-on-companion-acpi-.patch b/queue-5.12/nvme-pci-look-for-storaged3enable-on-companion-acpi-.patch new file mode 100644 index 00000000000..edef28314ab --- /dev/null +++ b/queue-5.12/nvme-pci-look-for-storaged3enable-on-companion-acpi-.patch @@ -0,0 +1,78 @@ +From cad3fe0c3bb517b94ca09fb1519a0011a7e4542c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 11:02:34 -0500 +Subject: nvme-pci: look for StorageD3Enable on companion ACPI device instead + +From: Mario Limonciello + +[ Upstream commit e21e0243e7b0f1c2a21d21f4d115f7b37175772a ] + +The documentation around the StorageD3Enable property hints that it +should be made on the PCI device. This is where newer AMD systems set +the property and it's required for S0i3 support. + +So rather than look for nodes of the root port only present on Intel +systems, switch to the companion ACPI device for all systems. +David Box from Intel indicated this should work on Intel as well. + +Link: https://lore.kernel.org/linux-nvme/YK6gmAWqaRmvpJXb@google.com/T/#m900552229fa455867ee29c33b854845fce80ba70 +Link: https://docs.microsoft.com/en-us/windows-hardware/design/component-guidelines/power-management-for-storage-hardware-devices-intro +Fixes: df4f9bc4fb9c ("nvme-pci: add support for ACPI StorageD3Enable property") +Suggested-by: Liang Prike +Acked-by: Raul E Rangel +Signed-off-by: Mario Limonciello +Reviewed-by: David E. Box +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 24 +----------------------- + 1 file changed, 1 insertion(+), 23 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 4555e9202851..2a3ef79f96f9 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2834,10 +2834,7 @@ static unsigned long check_vendor_combination_bug(struct pci_dev *pdev) + #ifdef CONFIG_ACPI + static bool nvme_acpi_storage_d3(struct pci_dev *dev) + { +- struct acpi_device *adev; +- struct pci_dev *root; +- acpi_handle handle; +- acpi_status status; ++ struct acpi_device *adev = ACPI_COMPANION(&dev->dev); + u8 val; + + /* +@@ -2845,28 +2842,9 @@ static bool nvme_acpi_storage_d3(struct pci_dev *dev) + * must use D3 to support deep platform power savings during + * suspend-to-idle. + */ +- root = pcie_find_root_port(dev); +- if (!root) +- return false; + +- adev = ACPI_COMPANION(&root->dev); + if (!adev) + return false; +- +- /* +- * The property is defined in the PXSX device for South complex ports +- * and in the PEGP device for North complex ports. +- */ +- status = acpi_get_handle(adev->handle, "PXSX", &handle); +- if (ACPI_FAILURE(status)) { +- status = acpi_get_handle(adev->handle, "PEGP", &handle); +- if (ACPI_FAILURE(status)) +- return false; +- } +- +- if (acpi_bus_get_device(handle, &adev)) +- return false; +- + if (fwnode_property_read_u8(acpi_fwnode_handle(adev), "StorageD3Enable", + &val)) + return false; +-- +2.30.2 + diff --git a/queue-5.12/nvmet-fc-do-not-check-for-invalid-target-port-in-nvm.patch b/queue-5.12/nvmet-fc-do-not-check-for-invalid-target-port-in-nvm.patch new file mode 100644 index 00000000000..afeabd4c80e --- /dev/null +++ b/queue-5.12/nvmet-fc-do-not-check-for-invalid-target-port-in-nvm.patch @@ -0,0 +1,55 @@ +From 76fb62b569e2871394c05b7c95d49b05dc7d719a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 14:54:14 +0200 +Subject: nvmet-fc: do not check for invalid target port in + nvmet_fc_handle_fcp_rqst() + +From: Hannes Reinecke + +[ Upstream commit 2a4a910aa4f0acc428dc8d10227c42e14ed21d10 ] + +When parsing a request in nvmet_fc_handle_fcp_rqst() we should not +check for invalid target ports; if we do the command is aborted +from the fcp layer, causing the host to assume a transport error. +Rather we should still forward this request to the nvmet layer, which +will then correctly fail the command with an appropriate error status. + +Signed-off-by: Hannes Reinecke +Reviewed-by: James Smart +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/fc.c | 10 ++-------- + 1 file changed, 2 insertions(+), 8 deletions(-) + +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index d375745fc4ed..b81db5270018 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -2494,13 +2494,6 @@ nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, + u32 xfrlen = be32_to_cpu(cmdiu->data_len); + int ret; + +- /* +- * if there is no nvmet mapping to the targetport there +- * shouldn't be requests. just terminate them. +- */ +- if (!tgtport->pe) +- goto transport_error; +- + /* + * Fused commands are currently not supported in the linux + * implementation. +@@ -2528,7 +2521,8 @@ nvmet_fc_handle_fcp_rqst(struct nvmet_fc_tgtport *tgtport, + + fod->req.cmd = &fod->cmdiubuf.sqe; + fod->req.cqe = &fod->rspiubuf.cqe; +- fod->req.port = tgtport->pe->port; ++ if (tgtport->pe) ++ fod->req.port = tgtport->pe->port; + + /* clear any response payload */ + memset(&fod->rspiubuf, 0, sizeof(fod->rspiubuf)); +-- +2.30.2 + diff --git a/queue-5.12/ocfs2-fix-snprintf-checking.patch b/queue-5.12/ocfs2-fix-snprintf-checking.patch new file mode 100644 index 00000000000..c2919c3c7b0 --- /dev/null +++ b/queue-5.12/ocfs2-fix-snprintf-checking.patch @@ -0,0 +1,85 @@ +From 1bd816790a9dfd62f47580e8ebbbd6b8765ef9fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Jun 2021 19:34:01 -0700 +Subject: ocfs2: fix snprintf() checking + +From: Dan Carpenter + +[ Upstream commit 54e948c60cc843b6e84dc44496edc91f51d2a28e ] + +The snprintf() function returns the number of bytes which would have been +printed if the buffer was large enough. In other words it can return ">= +remain" but this code assumes it returns "== remain". + +The run time impact of this bug is not very severe. The next iteration +through the loop would trigger a WARN() when we pass a negative limit to +snprintf(). We would then return success instead of -E2BIG. + +The kernel implementation of snprintf() will never return negatives so +there is no need to check and I have deleted that dead code. + +Link: https://lkml.kernel.org/r/20210511135350.GV1955@kadam +Fixes: a860f6eb4c6a ("ocfs2: sysfile interfaces for online file check") +Fixes: 74ae4e104dfc ("ocfs2: Create stack glue sysfs files.") +Signed-off-by: Dan Carpenter +Reviewed-by: Joseph Qi +Cc: Mark Fasheh +Cc: Joel Becker +Cc: Junxiao Bi +Cc: Changwei Ge +Cc: Gang He +Cc: Jun Piao +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ocfs2/filecheck.c | 6 +----- + fs/ocfs2/stackglue.c | 8 ++------ + 2 files changed, 3 insertions(+), 11 deletions(-) + +diff --git a/fs/ocfs2/filecheck.c b/fs/ocfs2/filecheck.c +index 50f11bfdc8c2..82a3edc4aea4 100644 +--- a/fs/ocfs2/filecheck.c ++++ b/fs/ocfs2/filecheck.c +@@ -328,11 +328,7 @@ static ssize_t ocfs2_filecheck_attr_show(struct kobject *kobj, + ret = snprintf(buf + total, remain, "%lu\t\t%u\t%s\n", + p->fe_ino, p->fe_done, + ocfs2_filecheck_error(p->fe_status)); +- if (ret < 0) { +- total = ret; +- break; +- } +- if (ret == remain) { ++ if (ret >= remain) { + /* snprintf() didn't fit */ + total = -E2BIG; + break; +diff --git a/fs/ocfs2/stackglue.c b/fs/ocfs2/stackglue.c +index a191094694c6..03eacb249f37 100644 +--- a/fs/ocfs2/stackglue.c ++++ b/fs/ocfs2/stackglue.c +@@ -502,11 +502,7 @@ static ssize_t ocfs2_loaded_cluster_plugins_show(struct kobject *kobj, + list_for_each_entry(p, &ocfs2_stack_list, sp_list) { + ret = snprintf(buf, remain, "%s\n", + p->sp_name); +- if (ret < 0) { +- total = ret; +- break; +- } +- if (ret == remain) { ++ if (ret >= remain) { + /* snprintf() didn't fit */ + total = -E2BIG; + break; +@@ -533,7 +529,7 @@ static ssize_t ocfs2_active_cluster_plugin_show(struct kobject *kobj, + if (active_stack) { + ret = snprintf(buf, PAGE_SIZE, "%s\n", + active_stack->sp_name); +- if (ret == PAGE_SIZE) ++ if (ret >= PAGE_SIZE) + ret = -E2BIG; + } + spin_unlock(&ocfs2_stack_lock); +-- +2.30.2 + diff --git a/queue-5.12/of-fix-truncation-of-memory-sizes-on-32-bit-platform.patch b/queue-5.12/of-fix-truncation-of-memory-sizes-on-32-bit-platform.patch new file mode 100644 index 00000000000..8fb6962d146 --- /dev/null +++ b/queue-5.12/of-fix-truncation-of-memory-sizes-on-32-bit-platform.patch @@ -0,0 +1,87 @@ +From c07469cc8101a354f7881d7f43c2f43a019591e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 11:27:44 +0200 +Subject: of: Fix truncation of memory sizes on 32-bit platforms + +From: Geert Uytterhoeven + +[ Upstream commit 2892d8a00d23d511a0591ac4b2ff3f050ae1f004 ] + +Variable "size" has type "phys_addr_t", which can be either 32-bit or +64-bit on 32-bit systems, while "unsigned long" is always 32-bit on +32-bit systems. Hence the cast in + + (unsigned long)size / SZ_1M + +may truncate a 64-bit size to 32-bit, as casts have a higher operator +precedence than divisions. + +Fix this by inverting the order of the cast and division, which should +be safe for memory blocks smaller than 4 PiB. Note that the division is +actually a shift, as SZ_1M is a power-of-two constant, hence there is no +need to use div_u64(). + +While at it, use "%lu" to format "unsigned long". + +Fixes: e8d9d1f5485b52ec ("drivers: of: add initialization code for static reserved memory") +Fixes: 3f0c8206644836e4 ("drivers: of: add initialization code for dynamic reserved memory") +Signed-off-by: Geert Uytterhoeven +Acked-by: Marek Szyprowski +Link: https://lore.kernel.org/r/4a1117e72d13d26126f57be034c20dac02f1e915.1623835273.git.geert+renesas@glider.be +Signed-off-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/of/fdt.c | 8 ++++---- + drivers/of/of_reserved_mem.c | 8 ++++---- + 2 files changed, 8 insertions(+), 8 deletions(-) + +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index adb26aff481d..c485b2c7720d 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -511,11 +511,11 @@ static int __init __reserved_mem_reserve_reg(unsigned long node, + + if (size && + early_init_dt_reserve_memory_arch(base, size, nomap) == 0) +- pr_debug("Reserved memory: reserved region for node '%s': base %pa, size %ld MiB\n", +- uname, &base, (unsigned long)size / SZ_1M); ++ pr_debug("Reserved memory: reserved region for node '%s': base %pa, size %lu MiB\n", ++ uname, &base, (unsigned long)(size / SZ_1M)); + else +- pr_info("Reserved memory: failed to reserve memory for node '%s': base %pa, size %ld MiB\n", +- uname, &base, (unsigned long)size / SZ_1M); ++ pr_info("Reserved memory: failed to reserve memory for node '%s': base %pa, size %lu MiB\n", ++ uname, &base, (unsigned long)(size / SZ_1M)); + + len -= t_len; + if (first) { +diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c +index a7fbc5e37e19..6c95bbdf9265 100644 +--- a/drivers/of/of_reserved_mem.c ++++ b/drivers/of/of_reserved_mem.c +@@ -134,9 +134,9 @@ static int __init __reserved_mem_alloc_size(unsigned long node, + ret = early_init_dt_alloc_reserved_memory_arch(size, + align, start, end, nomap, &base); + if (ret == 0) { +- pr_debug("allocated memory for '%s' node: base %pa, size %ld MiB\n", ++ pr_debug("allocated memory for '%s' node: base %pa, size %lu MiB\n", + uname, &base, +- (unsigned long)size / SZ_1M); ++ (unsigned long)(size / SZ_1M)); + break; + } + len -= t_len; +@@ -146,8 +146,8 @@ static int __init __reserved_mem_alloc_size(unsigned long node, + ret = early_init_dt_alloc_reserved_memory_arch(size, align, + 0, 0, nomap, &base); + if (ret == 0) +- pr_debug("allocated memory for '%s' node: base %pa, size %ld MiB\n", +- uname, &base, (unsigned long)size / SZ_1M); ++ pr_debug("allocated memory for '%s' node: base %pa, size %lu MiB\n", ++ uname, &base, (unsigned long)(size / SZ_1M)); + } + + if (base == 0) { +-- +2.30.2 + diff --git a/queue-5.12/open-don-t-silently-ignore-unknown-o-flags-in-openat.patch b/queue-5.12/open-don-t-silently-ignore-unknown-o-flags-in-openat.patch new file mode 100644 index 00000000000..c7d65507096 --- /dev/null +++ b/queue-5.12/open-don-t-silently-ignore-unknown-o-flags-in-openat.patch @@ -0,0 +1,108 @@ +From 9c849a71de99da9ae728de988d3043acd956c33d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 11:24:16 +0200 +Subject: open: don't silently ignore unknown O-flags in openat2() + +From: Christian Brauner + +[ Upstream commit cfe80306a0dd6d363934913e47c3f30d71b721e5 ] + +The new openat2() syscall verifies that no unknown O-flag values are +set and returns an error to userspace if they are while the older open +syscalls like open() and openat() simply ignore unknown flag values: + + #define O_FLAG_CURRENTLY_INVALID (1 << 31) + struct open_how how = { + .flags = O_RDONLY | O_FLAG_CURRENTLY_INVALID, + .resolve = 0, + }; + + /* fails */ + fd = openat2(-EBADF, "/dev/null", &how, sizeof(how)); + + /* succeeds */ + fd = openat(-EBADF, "/dev/null", O_RDONLY | O_FLAG_CURRENTLY_INVALID); + +However, openat2() silently truncates the upper 32 bits meaning: + + #define O_FLAG_CURRENTLY_INVALID_LOWER32 (1 << 31) + #define O_FLAG_CURRENTLY_INVALID_UPPER32 (1 << 40) + + struct open_how how_lowe32 = { + .flags = O_RDONLY | O_FLAG_CURRENTLY_INVALID_LOWER32, + }; + + struct open_how how_upper32 = { + .flags = O_RDONLY | O_FLAG_CURRENTLY_INVALID_UPPER32, + }; + + /* fails */ + fd = openat2(-EBADF, "/dev/null", &how_lower32, sizeof(how_lower32)); + + /* succeeds */ + fd = openat2(-EBADF, "/dev/null", &how_upper32, sizeof(how_upper32)); + +Fix this by preventing the immediate truncation in build_open_flags(). + +There's a snafu here though stripping FMODE_* directly from flags would +cause the upper 32 bits to be truncated as well due to integer promotion +rules since FMODE_* is unsigned int, O_* are signed ints (yuck). + +In addition, struct open_flags currently defines flags to be 32 bit +which is reasonable. If we simply were to bump it to 64 bit we would +need to change a lot of code preemptively which doesn't seem worth it. +So simply add a compile-time check verifying that all currently known +O_* flags are within the 32 bit range and fail to build if they aren't +anymore. + +This change shouldn't regress old open syscalls since they silently +truncate any unknown values anyway. It is a tiny semantic change for +openat2() but it is very unlikely people pass ing > 32 bit unknown flags +and the syscall is relatively new too. + +Link: https://lore.kernel.org/r/20210528092417.3942079-3-brauner@kernel.org +Cc: Christoph Hellwig +Cc: Aleksa Sarai +Cc: Al Viro +Cc: linux-fsdevel@vger.kernel.org +Reported-by: Richard Guy Briggs +Reviewed-by: Christoph Hellwig +Reviewed-by: Aleksa Sarai +Reviewed-by: Richard Guy Briggs +Signed-off-by: Christian Brauner +Signed-off-by: Sasha Levin +--- + fs/open.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/fs/open.c b/fs/open.c +index e53af13b5835..53bc0573c0ec 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -1002,12 +1002,20 @@ inline struct open_how build_open_how(int flags, umode_t mode) + + inline int build_open_flags(const struct open_how *how, struct open_flags *op) + { +- int flags = how->flags; ++ u64 flags = how->flags; ++ u64 strip = FMODE_NONOTIFY | O_CLOEXEC; + int lookup_flags = 0; + int acc_mode = ACC_MODE(flags); + +- /* Must never be set by userspace */ +- flags &= ~(FMODE_NONOTIFY | O_CLOEXEC); ++ BUILD_BUG_ON_MSG(upper_32_bits(VALID_OPEN_FLAGS), ++ "struct open_flags doesn't yet handle flags > 32 bits"); ++ ++ /* ++ * Strip flags that either shouldn't be set by userspace like ++ * FMODE_NONOTIFY or that aren't relevant in determining struct ++ * open_flags like O_CLOEXEC. ++ */ ++ flags &= ~strip; + + /* + * Older syscalls implicitly clear all of the invalid flags or argument +-- +2.30.2 + diff --git a/queue-5.12/pata_ep93xx-fix-deferred-probing.patch b/queue-5.12/pata_ep93xx-fix-deferred-probing.patch new file mode 100644 index 00000000000..57195fff113 --- /dev/null +++ b/queue-5.12/pata_ep93xx-fix-deferred-probing.patch @@ -0,0 +1,39 @@ +From 8e16fcca09e9ccd557f3fda8e11074474dc38372 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Mar 2021 23:32:38 +0300 +Subject: pata_ep93xx: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit 5c8121262484d99bffb598f39a0df445cecd8efb ] + +The driver overrides the error codes returned by platform_get_irq() to +-ENXIO, so if it returns -EPROBE_DEFER, the driver would fail the probe +permanently instead of the deferred probing. Propagate the error code +upstream, as it should have been done from the start... + +Fixes: 2fff27512600 ("PATA host controller driver for ep93xx") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/509fda88-2e0d-2cc7-f411-695d7e94b136@omprussia.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_ep93xx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ata/pata_ep93xx.c b/drivers/ata/pata_ep93xx.c +index badab6708893..46208ececbb6 100644 +--- a/drivers/ata/pata_ep93xx.c ++++ b/drivers/ata/pata_ep93xx.c +@@ -928,7 +928,7 @@ static int ep93xx_pata_probe(struct platform_device *pdev) + /* INT[3] (IRQ_EP93XX_EXT3) line connected as pull down */ + irq = platform_get_irq(pdev, 0); + if (irq < 0) { +- err = -ENXIO; ++ err = irq; + goto err_rel_gpio; + } + +-- +2.30.2 + diff --git a/queue-5.12/pata_octeon_cf-avoid-warn_on-in-ata_host_activate.patch b/queue-5.12/pata_octeon_cf-avoid-warn_on-in-ata_host_activate.patch new file mode 100644 index 00000000000..999b8e97f59 --- /dev/null +++ b/queue-5.12/pata_octeon_cf-avoid-warn_on-in-ata_host_activate.patch @@ -0,0 +1,45 @@ +From cd7db5db3255ebfc7d2ae22b118e406c91bbc743 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 23:38:54 +0300 +Subject: pata_octeon_cf: avoid WARN_ON() in ata_host_activate() + +From: Sergey Shtylyov + +[ Upstream commit bfc1f378c8953e68ccdbfe0a8c20748427488b80 ] + +Iff platform_get_irq() fails (or returns IRQ0) and thus the polling mode +has to be used, ata_host_activate() hits the WARN_ON() due to 'irq_handler' +parameter being non-NULL if the polling mode is selected. Let's only set +the pointer to the driver's IRQ handler if platform_get_irq() returns a +valid IRQ # -- this should avoid the unnecessary WARN_ON()... + +Fixes: 43f01da0f279 ("MIPS/OCTEON/ata: Convert pata_octeon_cf.c to use device tree.") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/3a241167-f84d-1d25-5b9b-be910afbe666@omp.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_octeon_cf.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/ata/pata_octeon_cf.c b/drivers/ata/pata_octeon_cf.c +index bd87476ab481..b5a3f710d76d 100644 +--- a/drivers/ata/pata_octeon_cf.c ++++ b/drivers/ata/pata_octeon_cf.c +@@ -898,10 +898,11 @@ static int octeon_cf_probe(struct platform_device *pdev) + return -EINVAL; + } + +- irq_handler = octeon_cf_interrupt; + i = platform_get_irq(dma_dev, 0); +- if (i > 0) ++ if (i > 0) { + irq = i; ++ irq_handler = octeon_cf_interrupt; ++ } + } + of_node_put(dma_node); + } +-- +2.30.2 + diff --git a/queue-5.12/pata_rb532_cf-fix-deferred-probing.patch b/queue-5.12/pata_rb532_cf-fix-deferred-probing.patch new file mode 100644 index 00000000000..08397830a71 --- /dev/null +++ b/queue-5.12/pata_rb532_cf-fix-deferred-probing.patch @@ -0,0 +1,46 @@ +From b20e2c38af2e836ae18e580f84f9c58a494cf308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Mar 2021 14:46:53 +0300 +Subject: pata_rb532_cf: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit 2d3a62fbae8e5badc2342388f65ab2191c209cc0 ] + +The driver overrides the error codes returned by platform_get_irq() to +-ENOENT, so if it returns -EPROBE_DEFER, the driver would fail the probe +permanently instead of the deferred probing. Switch to propagating the +error code upstream, still checking/overriding IRQ0 as libata regards it +as "no IRQ" (thus polling) anyway... + +Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/771ced55-3efb-21f5-f21c-b99920aae611@omprussia.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/pata_rb532_cf.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/ata/pata_rb532_cf.c b/drivers/ata/pata_rb532_cf.c +index 479c4b29b856..303f8c375b3a 100644 +--- a/drivers/ata/pata_rb532_cf.c ++++ b/drivers/ata/pata_rb532_cf.c +@@ -115,10 +115,12 @@ static int rb532_pata_driver_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) { ++ if (irq < 0) { + dev_err(&pdev->dev, "no IRQ resource found\n"); +- return -ENOENT; ++ return irq; + } ++ if (!irq) ++ return -EINVAL; + + gpiod = devm_gpiod_get(&pdev->dev, NULL, GPIOD_IN); + if (IS_ERR(gpiod)) { +-- +2.30.2 + diff --git a/queue-5.12/pci-hv-add-check-for-hyperv_initialized-in-init_hv_p.patch b/queue-5.12/pci-hv-add-check-for-hyperv_initialized-in-init_hv_p.patch new file mode 100644 index 00000000000..6a21773251c --- /dev/null +++ b/queue-5.12/pci-hv-add-check-for-hyperv_initialized-in-init_hv_p.patch @@ -0,0 +1,41 @@ +From 64ed61f15bb5baa067900793e3b6d933382bbb7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 16:17:33 -0700 +Subject: PCI: hv: Add check for hyperv_initialized in init_hv_pci_drv() + +From: Haiyang Zhang + +[ Upstream commit 7d815f4afa87f2032b650ae1bba7534b550a6b8b ] + +Add check for hv_is_hyperv_initialized() at the top of +init_hv_pci_drv(), so if the pci-hyperv driver is force-loaded on non +Hyper-V platforms, the init_hv_pci_drv() will exit immediately, without +any side effects, like assignments to hvpci_block_ops, etc. + +Signed-off-by: Haiyang Zhang +Reported-and-tested-by: Mohammad Alqayeem +Reviewed-by: Wei Liu +Link: https://lore.kernel.org/r/1621984653-1210-1-git-send-email-haiyangz@microsoft.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-hyperv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c +index 27a17a1e4a7c..7479edf3676c 100644 +--- a/drivers/pci/controller/pci-hyperv.c ++++ b/drivers/pci/controller/pci-hyperv.c +@@ -3480,6 +3480,9 @@ static void __exit exit_hv_pci_drv(void) + + static int __init init_hv_pci_drv(void) + { ++ if (!hv_is_hyperv_initialized()) ++ return -ENODEV; ++ + /* Set the invalid domain number's bit, so it will not be used */ + set_bit(HVPCI_DOM_INVALID, hvpci_dom_map); + +-- +2.30.2 + diff --git a/queue-5.12/perf-arm-cmn-fix-invalid-pointer-when-access-dtc-obj.patch b/queue-5.12/perf-arm-cmn-fix-invalid-pointer-when-access-dtc-obj.patch new file mode 100644 index 00000000000..6104ece933c --- /dev/null +++ b/queue-5.12/perf-arm-cmn-fix-invalid-pointer-when-access-dtc-obj.patch @@ -0,0 +1,41 @@ +From a751241a2ec52b5c9221ea837ebbaccc21db345f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 09:08:49 -0700 +Subject: perf/arm-cmn: Fix invalid pointer when access dtc object sharing the + same IRQ number + +From: Tuan Phan + +[ Upstream commit 4e16f283edc289820e9b2d6f617ed8e514ee8396 ] + +When multiple dtcs share the same IRQ number, the irq_friend which +used to refer to dtc object gets calculated incorrect which leads +to invalid pointer. + +Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver") + +Signed-off-by: Tuan Phan +Reviewed-by: Robin Murphy +Link: https://lore.kernel.org/r/1623946129-3290-1-git-send-email-tuanphan@os.amperecomputing.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/arm-cmn.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c +index 1328159fe564..a4339426664e 100644 +--- a/drivers/perf/arm-cmn.c ++++ b/drivers/perf/arm-cmn.c +@@ -1212,7 +1212,7 @@ static int arm_cmn_init_irqs(struct arm_cmn *cmn) + irq = cmn->dtc[i].irq; + for (j = i; j--; ) { + if (cmn->dtc[j].irq == irq) { +- cmn->dtc[j].irq_friend = j - i; ++ cmn->dtc[j].irq_friend = i - j; + goto next; + } + } +-- +2.30.2 + diff --git a/queue-5.12/perf-llvm-return-enomem-when-asprintf-fails.patch b/queue-5.12/perf-llvm-return-enomem-when-asprintf-fails.patch new file mode 100644 index 00000000000..7fe94c4817c --- /dev/null +++ b/queue-5.12/perf-llvm-return-enomem-when-asprintf-fails.patch @@ -0,0 +1,57 @@ +From 48c2078122db0ebc2a0f0fe76ecdec0af8f2fc59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Jul 2021 14:20:58 -0300 +Subject: perf llvm: Return -ENOMEM when asprintf() fails + +From: Arnaldo Carvalho de Melo + +[ Upstream commit c435c166dcf526ac827bc964d82cc0d5e7a1fd0b ] + +Zhihao sent a patch but it made llvm__compile_bpf() return what +asprintf() returns on error, which is just -1, but since this function +returns -errno, fix it by returning -ENOMEM for this case instead. + +Fixes: cb76371441d098 ("perf llvm: Allow passing options to llc ...") +Fixes: 5eab5a7ee032ac ("perf llvm: Display eBPF compiling command ...") +Reported-by: Hulk Robot +Reported-by: Zhihao Cheng +Cc: Alexei Starovoitov +Cc: Andrii Nakryiko +Cc: Daniel Borkmann +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Peter Zijlstra +Cc: Yu Kuai +Cc: clang-built-linux@googlegroups.com +Link: http://lore.kernel.org/lkml/20210609115945.2193194-1-chengzhihao1@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/llvm-utils.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/perf/util/llvm-utils.c b/tools/perf/util/llvm-utils.c +index dbdffb6673fe..0bf6b4d4c90a 100644 +--- a/tools/perf/util/llvm-utils.c ++++ b/tools/perf/util/llvm-utils.c +@@ -504,6 +504,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf, + goto errout; + } + ++ err = -ENOMEM; + if (asprintf(&pipe_template, "%s -emit-llvm | %s -march=bpf %s -filetype=obj -o -", + template, llc_path, opts) < 0) { + pr_err("ERROR:\tnot enough memory to setup command line\n"); +@@ -524,6 +525,7 @@ int llvm__compile_bpf(const char *path, void **p_obj_buf, + + pr_debug("llvm compiling command template: %s\n", template); + ++ err = -ENOMEM; + if (asprintf(&command_echo, "echo -n \"%s\"", template) < 0) + goto errout; + +-- +2.30.2 + diff --git a/queue-5.12/perf-scripting-python-fix-tuple_set_u64.patch b/queue-5.12/perf-scripting-python-fix-tuple_set_u64.patch new file mode 100644 index 00000000000..a4d8fc3459e --- /dev/null +++ b/queue-5.12/perf-scripting-python-fix-tuple_set_u64.patch @@ -0,0 +1,281 @@ +From 6359a6025e29300dc6314861de9e41dc55c5dbda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 12:51:03 +0300 +Subject: perf scripting python: Fix tuple_set_u64() + +From: Adrian Hunter + +[ Upstream commit d04c1ff0b3ddd5c0fbbe640996c8eaad279ed1c5 ] + +tuple_set_u64() produces a signed value instead of an unsigned value. +That works for database export but not other cases. Rename to +tuple_set_d64() for database export and fix tuple_set_u64(). + +Fixes: df919b400ad3f ("perf scripting python: Extend interface to export data in a database-friendly way") +Signed-off-by: Adrian Hunter +Cc: Andi Kleen +Cc: Jiri Olsa +Signed-off-by: Arnaldo Carvalho de Melo +Link: https://lore.kernel.org/r/20210525095112.1399-2-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + .../scripting-engines/trace-event-python.c | 146 ++++++++++-------- + 1 file changed, 81 insertions(+), 65 deletions(-) + +diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c +index c83c2c6564e0..23dc5014e711 100644 +--- a/tools/perf/util/scripting-engines/trace-event-python.c ++++ b/tools/perf/util/scripting-engines/trace-event-python.c +@@ -934,7 +934,7 @@ static PyObject *tuple_new(unsigned int sz) + return t; + } + +-static int tuple_set_u64(PyObject *t, unsigned int pos, u64 val) ++static int tuple_set_s64(PyObject *t, unsigned int pos, s64 val) + { + #if BITS_PER_LONG == 64 + return PyTuple_SetItem(t, pos, _PyLong_FromLong(val)); +@@ -944,6 +944,22 @@ static int tuple_set_u64(PyObject *t, unsigned int pos, u64 val) + #endif + } + ++/* ++ * Databases support only signed 64-bit numbers, so even though we are ++ * exporting a u64, it must be as s64. ++ */ ++#define tuple_set_d64 tuple_set_s64 ++ ++static int tuple_set_u64(PyObject *t, unsigned int pos, u64 val) ++{ ++#if BITS_PER_LONG == 64 ++ return PyTuple_SetItem(t, pos, PyLong_FromUnsignedLong(val)); ++#endif ++#if BITS_PER_LONG == 32 ++ return PyTuple_SetItem(t, pos, PyLong_FromUnsignedLongLong(val)); ++#endif ++} ++ + static int tuple_set_s32(PyObject *t, unsigned int pos, s32 val) + { + return PyTuple_SetItem(t, pos, _PyLong_FromLong(val)); +@@ -967,7 +983,7 @@ static int python_export_evsel(struct db_export *dbe, struct evsel *evsel) + + t = tuple_new(2); + +- tuple_set_u64(t, 0, evsel->db_id); ++ tuple_set_d64(t, 0, evsel->db_id); + tuple_set_string(t, 1, evsel__name(evsel)); + + call_object(tables->evsel_handler, t, "evsel_table"); +@@ -985,7 +1001,7 @@ static int python_export_machine(struct db_export *dbe, + + t = tuple_new(3); + +- tuple_set_u64(t, 0, machine->db_id); ++ tuple_set_d64(t, 0, machine->db_id); + tuple_set_s32(t, 1, machine->pid); + tuple_set_string(t, 2, machine->root_dir ? machine->root_dir : ""); + +@@ -1004,9 +1020,9 @@ static int python_export_thread(struct db_export *dbe, struct thread *thread, + + t = tuple_new(5); + +- tuple_set_u64(t, 0, thread->db_id); +- tuple_set_u64(t, 1, machine->db_id); +- tuple_set_u64(t, 2, main_thread_db_id); ++ tuple_set_d64(t, 0, thread->db_id); ++ tuple_set_d64(t, 1, machine->db_id); ++ tuple_set_d64(t, 2, main_thread_db_id); + tuple_set_s32(t, 3, thread->pid_); + tuple_set_s32(t, 4, thread->tid); + +@@ -1025,10 +1041,10 @@ static int python_export_comm(struct db_export *dbe, struct comm *comm, + + t = tuple_new(5); + +- tuple_set_u64(t, 0, comm->db_id); ++ tuple_set_d64(t, 0, comm->db_id); + tuple_set_string(t, 1, comm__str(comm)); +- tuple_set_u64(t, 2, thread->db_id); +- tuple_set_u64(t, 3, comm->start); ++ tuple_set_d64(t, 2, thread->db_id); ++ tuple_set_d64(t, 3, comm->start); + tuple_set_s32(t, 4, comm->exec); + + call_object(tables->comm_handler, t, "comm_table"); +@@ -1046,9 +1062,9 @@ static int python_export_comm_thread(struct db_export *dbe, u64 db_id, + + t = tuple_new(3); + +- tuple_set_u64(t, 0, db_id); +- tuple_set_u64(t, 1, comm->db_id); +- tuple_set_u64(t, 2, thread->db_id); ++ tuple_set_d64(t, 0, db_id); ++ tuple_set_d64(t, 1, comm->db_id); ++ tuple_set_d64(t, 2, thread->db_id); + + call_object(tables->comm_thread_handler, t, "comm_thread_table"); + +@@ -1068,8 +1084,8 @@ static int python_export_dso(struct db_export *dbe, struct dso *dso, + + t = tuple_new(5); + +- tuple_set_u64(t, 0, dso->db_id); +- tuple_set_u64(t, 1, machine->db_id); ++ tuple_set_d64(t, 0, dso->db_id); ++ tuple_set_d64(t, 1, machine->db_id); + tuple_set_string(t, 2, dso->short_name); + tuple_set_string(t, 3, dso->long_name); + tuple_set_string(t, 4, sbuild_id); +@@ -1090,10 +1106,10 @@ static int python_export_symbol(struct db_export *dbe, struct symbol *sym, + + t = tuple_new(6); + +- tuple_set_u64(t, 0, *sym_db_id); +- tuple_set_u64(t, 1, dso->db_id); +- tuple_set_u64(t, 2, sym->start); +- tuple_set_u64(t, 3, sym->end); ++ tuple_set_d64(t, 0, *sym_db_id); ++ tuple_set_d64(t, 1, dso->db_id); ++ tuple_set_d64(t, 2, sym->start); ++ tuple_set_d64(t, 3, sym->end); + tuple_set_s32(t, 4, sym->binding); + tuple_set_string(t, 5, sym->name); + +@@ -1130,30 +1146,30 @@ static void python_export_sample_table(struct db_export *dbe, + + t = tuple_new(24); + +- tuple_set_u64(t, 0, es->db_id); +- tuple_set_u64(t, 1, es->evsel->db_id); +- tuple_set_u64(t, 2, es->al->maps->machine->db_id); +- tuple_set_u64(t, 3, es->al->thread->db_id); +- tuple_set_u64(t, 4, es->comm_db_id); +- tuple_set_u64(t, 5, es->dso_db_id); +- tuple_set_u64(t, 6, es->sym_db_id); +- tuple_set_u64(t, 7, es->offset); +- tuple_set_u64(t, 8, es->sample->ip); +- tuple_set_u64(t, 9, es->sample->time); ++ tuple_set_d64(t, 0, es->db_id); ++ tuple_set_d64(t, 1, es->evsel->db_id); ++ tuple_set_d64(t, 2, es->al->maps->machine->db_id); ++ tuple_set_d64(t, 3, es->al->thread->db_id); ++ tuple_set_d64(t, 4, es->comm_db_id); ++ tuple_set_d64(t, 5, es->dso_db_id); ++ tuple_set_d64(t, 6, es->sym_db_id); ++ tuple_set_d64(t, 7, es->offset); ++ tuple_set_d64(t, 8, es->sample->ip); ++ tuple_set_d64(t, 9, es->sample->time); + tuple_set_s32(t, 10, es->sample->cpu); +- tuple_set_u64(t, 11, es->addr_dso_db_id); +- tuple_set_u64(t, 12, es->addr_sym_db_id); +- tuple_set_u64(t, 13, es->addr_offset); +- tuple_set_u64(t, 14, es->sample->addr); +- tuple_set_u64(t, 15, es->sample->period); +- tuple_set_u64(t, 16, es->sample->weight); +- tuple_set_u64(t, 17, es->sample->transaction); +- tuple_set_u64(t, 18, es->sample->data_src); ++ tuple_set_d64(t, 11, es->addr_dso_db_id); ++ tuple_set_d64(t, 12, es->addr_sym_db_id); ++ tuple_set_d64(t, 13, es->addr_offset); ++ tuple_set_d64(t, 14, es->sample->addr); ++ tuple_set_d64(t, 15, es->sample->period); ++ tuple_set_d64(t, 16, es->sample->weight); ++ tuple_set_d64(t, 17, es->sample->transaction); ++ tuple_set_d64(t, 18, es->sample->data_src); + tuple_set_s32(t, 19, es->sample->flags & PERF_BRANCH_MASK); + tuple_set_s32(t, 20, !!(es->sample->flags & PERF_IP_FLAG_IN_TX)); +- tuple_set_u64(t, 21, es->call_path_id); +- tuple_set_u64(t, 22, es->sample->insn_cnt); +- tuple_set_u64(t, 23, es->sample->cyc_cnt); ++ tuple_set_d64(t, 21, es->call_path_id); ++ tuple_set_d64(t, 22, es->sample->insn_cnt); ++ tuple_set_d64(t, 23, es->sample->cyc_cnt); + + call_object(tables->sample_handler, t, "sample_table"); + +@@ -1167,8 +1183,8 @@ static void python_export_synth(struct db_export *dbe, struct export_sample *es) + + t = tuple_new(3); + +- tuple_set_u64(t, 0, es->db_id); +- tuple_set_u64(t, 1, es->evsel->core.attr.config); ++ tuple_set_d64(t, 0, es->db_id); ++ tuple_set_d64(t, 1, es->evsel->core.attr.config); + tuple_set_bytes(t, 2, es->sample->raw_data, es->sample->raw_size); + + call_object(tables->synth_handler, t, "synth_data"); +@@ -1200,10 +1216,10 @@ static int python_export_call_path(struct db_export *dbe, struct call_path *cp) + + t = tuple_new(4); + +- tuple_set_u64(t, 0, cp->db_id); +- tuple_set_u64(t, 1, parent_db_id); +- tuple_set_u64(t, 2, sym_db_id); +- tuple_set_u64(t, 3, cp->ip); ++ tuple_set_d64(t, 0, cp->db_id); ++ tuple_set_d64(t, 1, parent_db_id); ++ tuple_set_d64(t, 2, sym_db_id); ++ tuple_set_d64(t, 3, cp->ip); + + call_object(tables->call_path_handler, t, "call_path_table"); + +@@ -1221,20 +1237,20 @@ static int python_export_call_return(struct db_export *dbe, + + t = tuple_new(14); + +- tuple_set_u64(t, 0, cr->db_id); +- tuple_set_u64(t, 1, cr->thread->db_id); +- tuple_set_u64(t, 2, comm_db_id); +- tuple_set_u64(t, 3, cr->cp->db_id); +- tuple_set_u64(t, 4, cr->call_time); +- tuple_set_u64(t, 5, cr->return_time); +- tuple_set_u64(t, 6, cr->branch_count); +- tuple_set_u64(t, 7, cr->call_ref); +- tuple_set_u64(t, 8, cr->return_ref); +- tuple_set_u64(t, 9, cr->cp->parent->db_id); ++ tuple_set_d64(t, 0, cr->db_id); ++ tuple_set_d64(t, 1, cr->thread->db_id); ++ tuple_set_d64(t, 2, comm_db_id); ++ tuple_set_d64(t, 3, cr->cp->db_id); ++ tuple_set_d64(t, 4, cr->call_time); ++ tuple_set_d64(t, 5, cr->return_time); ++ tuple_set_d64(t, 6, cr->branch_count); ++ tuple_set_d64(t, 7, cr->call_ref); ++ tuple_set_d64(t, 8, cr->return_ref); ++ tuple_set_d64(t, 9, cr->cp->parent->db_id); + tuple_set_s32(t, 10, cr->flags); +- tuple_set_u64(t, 11, cr->parent_db_id); +- tuple_set_u64(t, 12, cr->insn_count); +- tuple_set_u64(t, 13, cr->cyc_count); ++ tuple_set_d64(t, 11, cr->parent_db_id); ++ tuple_set_d64(t, 12, cr->insn_count); ++ tuple_set_d64(t, 13, cr->cyc_count); + + call_object(tables->call_return_handler, t, "call_return_table"); + +@@ -1254,14 +1270,14 @@ static int python_export_context_switch(struct db_export *dbe, u64 db_id, + + t = tuple_new(9); + +- tuple_set_u64(t, 0, db_id); +- tuple_set_u64(t, 1, machine->db_id); +- tuple_set_u64(t, 2, sample->time); ++ tuple_set_d64(t, 0, db_id); ++ tuple_set_d64(t, 1, machine->db_id); ++ tuple_set_d64(t, 2, sample->time); + tuple_set_s32(t, 3, sample->cpu); +- tuple_set_u64(t, 4, th_out_id); +- tuple_set_u64(t, 5, comm_out_id); +- tuple_set_u64(t, 6, th_in_id); +- tuple_set_u64(t, 7, comm_in_id); ++ tuple_set_d64(t, 4, th_out_id); ++ tuple_set_d64(t, 5, comm_out_id); ++ tuple_set_d64(t, 6, th_in_id); ++ tuple_set_d64(t, 7, comm_in_id); + tuple_set_s32(t, 8, flags); + + call_object(tables->context_switch_handler, t, "context_switch"); +-- +2.30.2 + diff --git a/queue-5.12/phy-ralink-phy-mt7621-pci-properly-print-pointer-add.patch b/queue-5.12/phy-ralink-phy-mt7621-pci-properly-print-pointer-add.patch new file mode 100644 index 00000000000..298dac94263 --- /dev/null +++ b/queue-5.12/phy-ralink-phy-mt7621-pci-properly-print-pointer-add.patch @@ -0,0 +1,44 @@ +From d9a282a6953e93242b51c83cbbf42dd47309f7bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 09:09:30 +0200 +Subject: phy: ralink: phy-mt7621-pci: properly print pointer address + +From: Sergio Paracuellos + +[ Upstream commit 652a6a2e3824ce2ebf79a2d5326940d05c4db036 ] + +The way of printing the pointer address for the 'port_base' +address got into compile warnings on some architectures +[-Wpointer-to-int-cast]. Instead of use '%08x' and cast +to an 'unsigned int' just make use of '%px' and avoid the +cast. To avoid not really needed driver verbosity on normal +behaviour change also from 'dev_info' to 'dev_dbg'. + +Fixes: d87da32372a0 ("phy: ralink: Add PHY driver for MT7621 PCIe PHY") +Reported-by: kernel test robot +Signed-off-by: Sergio Paracuellos +Link: https://lore.kernel.org/r/20210508070930.5290-7-sergio.paracuellos@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ralink/phy-mt7621-pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/ralink/phy-mt7621-pci.c b/drivers/phy/ralink/phy-mt7621-pci.c +index 753cb5bab930..88e82ab81b61 100644 +--- a/drivers/phy/ralink/phy-mt7621-pci.c ++++ b/drivers/phy/ralink/phy-mt7621-pci.c +@@ -272,8 +272,8 @@ static struct phy *mt7621_pcie_phy_of_xlate(struct device *dev, + + mt7621_phy->has_dual_port = args->args[0]; + +- dev_info(dev, "PHY for 0x%08x (dual port = %d)\n", +- (unsigned int)mt7621_phy->port_base, mt7621_phy->has_dual_port); ++ dev_dbg(dev, "PHY for 0x%px (dual port = %d)\n", ++ mt7621_phy->port_base, mt7621_phy->has_dual_port); + + return mt7621_phy->phy; + } +-- +2.30.2 + diff --git a/queue-5.12/phy-ti-dm816x-fix-the-error-handling-path-in-dm816x_.patch b/queue-5.12/phy-ti-dm816x-fix-the-error-handling-path-in-dm816x_.patch new file mode 100644 index 00000000000..47b8e136411 --- /dev/null +++ b/queue-5.12/phy-ti-dm816x-fix-the-error-handling-path-in-dm816x_.patch @@ -0,0 +1,62 @@ +From b115d0ba012ff3ad4483ad540531ab971a340097 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Jun 2021 15:17:43 +0200 +Subject: phy: ti: dm816x: Fix the error handling path in + 'dm816x_usb_phy_probe() + +From: Christophe JAILLET + +[ Upstream commit f7eedcb8539ddcbb6fe7791f1b4ccf43f905c72f ] + +Add an error handling path in the probe to release some resources, as +already done in the remove function. + +Fixes: 609adde838f4 ("phy: Add a driver for dm816x USB PHY") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/ac5136881f6bdec50be19b3bf73b3bc1b15ef1f1.1622898974.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-dm816x-usb.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/phy/ti/phy-dm816x-usb.c b/drivers/phy/ti/phy-dm816x-usb.c +index 57adc08a89b2..9fe6ea6fdae5 100644 +--- a/drivers/phy/ti/phy-dm816x-usb.c ++++ b/drivers/phy/ti/phy-dm816x-usb.c +@@ -242,19 +242,28 @@ static int dm816x_usb_phy_probe(struct platform_device *pdev) + + pm_runtime_enable(phy->dev); + generic_phy = devm_phy_create(phy->dev, NULL, &ops); +- if (IS_ERR(generic_phy)) +- return PTR_ERR(generic_phy); ++ if (IS_ERR(generic_phy)) { ++ error = PTR_ERR(generic_phy); ++ goto clk_unprepare; ++ } + + phy_set_drvdata(generic_phy, phy); + + phy_provider = devm_of_phy_provider_register(phy->dev, + of_phy_simple_xlate); +- if (IS_ERR(phy_provider)) +- return PTR_ERR(phy_provider); ++ if (IS_ERR(phy_provider)) { ++ error = PTR_ERR(phy_provider); ++ goto clk_unprepare; ++ } + + usb_add_phy_dev(&phy->phy); + + return 0; ++ ++clk_unprepare: ++ pm_runtime_disable(phy->dev); ++ clk_unprepare(phy->refclk); ++ return error; + } + + static int dm816x_usb_phy_remove(struct platform_device *pdev) +-- +2.30.2 + diff --git a/queue-5.12/phy-uniphier-pcie-fix-updating-phy-parameters.patch b/queue-5.12/phy-uniphier-pcie-fix-updating-phy-parameters.patch new file mode 100644 index 00000000000..b34defc72ca --- /dev/null +++ b/queue-5.12/phy-uniphier-pcie-fix-updating-phy-parameters.patch @@ -0,0 +1,63 @@ +From 1789816a7717fe539a00837ae87465798b14d5ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 12:50:42 +0900 +Subject: phy: uniphier-pcie: Fix updating phy parameters + +From: Kunihiko Hayashi + +[ Upstream commit 4a90bbb478dbf18ecdec9dcf8eb708e319d24264 ] + +The current driver uses a value from register TEST_O as the original +value for register TEST_I, though, the value is overwritten by "param", +so there is a bug that the original value isn't no longer used. + +The value of TEST_O[7:0] should be masked with "mask", replaced with +"param", and placed in the bitfield TESTI_DAT_MASK as new TEST_I value. + +Fixes: c6d9b1324159 ("phy: socionext: add PCIe PHY driver support") +Signed-off-by: Kunihiko Hayashi +Link: https://lore.kernel.org/r/1623037842-19363-1-git-send-email-hayashi.kunihiko@socionext.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/socionext/phy-uniphier-pcie.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/phy/socionext/phy-uniphier-pcie.c b/drivers/phy/socionext/phy-uniphier-pcie.c +index e4adab375c73..6bdbd1f214dd 100644 +--- a/drivers/phy/socionext/phy-uniphier-pcie.c ++++ b/drivers/phy/socionext/phy-uniphier-pcie.c +@@ -24,11 +24,13 @@ + #define PORT_SEL_1 FIELD_PREP(PORT_SEL_MASK, 1) + + #define PCL_PHY_TEST_I 0x2000 +-#define PCL_PHY_TEST_O 0x2004 + #define TESTI_DAT_MASK GENMASK(13, 6) + #define TESTI_ADR_MASK GENMASK(5, 1) + #define TESTI_WR_EN BIT(0) + ++#define PCL_PHY_TEST_O 0x2004 ++#define TESTO_DAT_MASK GENMASK(7, 0) ++ + #define PCL_PHY_RESET 0x200c + #define PCL_PHY_RESET_N_MNMODE BIT(8) /* =1:manual */ + #define PCL_PHY_RESET_N BIT(0) /* =1:deasssert */ +@@ -77,11 +79,12 @@ static void uniphier_pciephy_set_param(struct uniphier_pciephy_priv *priv, + val = FIELD_PREP(TESTI_DAT_MASK, 1); + val |= FIELD_PREP(TESTI_ADR_MASK, reg); + uniphier_pciephy_testio_write(priv, val); +- val = readl(priv->base + PCL_PHY_TEST_O); ++ val = readl(priv->base + PCL_PHY_TEST_O) & TESTO_DAT_MASK; + + /* update value */ +- val &= ~FIELD_PREP(TESTI_DAT_MASK, mask); +- val = FIELD_PREP(TESTI_DAT_MASK, mask & param); ++ val &= ~mask; ++ val |= mask & param; ++ val = FIELD_PREP(TESTI_DAT_MASK, val); + val |= FIELD_PREP(TESTI_ADR_MASK, reg); + uniphier_pciephy_testio_write(priv, val); + uniphier_pciephy_testio_write(priv, val | TESTI_WR_EN); +-- +2.30.2 + diff --git a/queue-5.12/pinctrl-renesas-r8a7796-add-missing-bias-for-preset-.patch b/queue-5.12/pinctrl-renesas-r8a7796-add-missing-bias-for-preset-.patch new file mode 100644 index 00000000000..718939cbcca --- /dev/null +++ b/queue-5.12/pinctrl-renesas-r8a7796-add-missing-bias-for-preset-.patch @@ -0,0 +1,49 @@ +From fa1da92c999dcf3c1d0179c4e88a84c1c088d1c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Apr 2021 14:31:00 +0200 +Subject: pinctrl: renesas: r8a7796: Add missing bias for PRESET# pin +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 2cee31cd49733e89dfedf4f68a56839fc2e42040 ] + +R-Car Gen3 Hardware Manual Errata for Rev. 0.52 of Nov 30, 2016, added +the configuration bit for bias pull-down control for the PRESET# pin on +R-Car M3-W. Add driver support for controlling pull-down on this pin. + +Fixes: 2d40bd24274d2577 ("pinctrl: sh-pfc: r8a7796: Add bias pinconf support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Niklas Söderlund +Link: https://lore.kernel.org/r/c479de5b3f235c2f7d5faea9e7e08e6fccb135df.1619785375.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a7796.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a7796.c b/drivers/pinctrl/renesas/pfc-r8a7796.c +index 96b5b1509bb7..c4f1f5607601 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a7796.c ++++ b/drivers/pinctrl/renesas/pfc-r8a7796.c +@@ -68,6 +68,7 @@ + PIN_NOGP_CFG(QSPI1_MOSI_IO0, "QSPI1_MOSI_IO0", fn, CFG_FLAGS), \ + PIN_NOGP_CFG(QSPI1_SPCLK, "QSPI1_SPCLK", fn, CFG_FLAGS), \ + PIN_NOGP_CFG(QSPI1_SSL, "QSPI1_SSL", fn, CFG_FLAGS), \ ++ PIN_NOGP_CFG(PRESET_N, "PRESET#", fn, SH_PFC_PIN_CFG_PULL_DOWN),\ + PIN_NOGP_CFG(RPC_INT_N, "RPC_INT#", fn, CFG_FLAGS), \ + PIN_NOGP_CFG(RPC_RESET_N, "RPC_RESET#", fn, CFG_FLAGS), \ + PIN_NOGP_CFG(RPC_WP_N, "RPC_WP#", fn, CFG_FLAGS), \ +@@ -6191,7 +6192,7 @@ static const struct pinmux_bias_reg pinmux_bias_regs[] = { + [ 4] = RCAR_GP_PIN(6, 29), /* USB30_OVC */ + [ 5] = RCAR_GP_PIN(6, 30), /* GP6_30 */ + [ 6] = RCAR_GP_PIN(6, 31), /* GP6_31 */ +- [ 7] = SH_PFC_PIN_NONE, ++ [ 7] = PIN_PRESET_N, /* PRESET# */ + [ 8] = SH_PFC_PIN_NONE, + [ 9] = SH_PFC_PIN_NONE, + [10] = SH_PFC_PIN_NONE, +-- +2.30.2 + diff --git a/queue-5.12/pinctrl-renesas-r8a77990-jtag-pins-do-not-have-pull-.patch b/queue-5.12/pinctrl-renesas-r8a77990-jtag-pins-do-not-have-pull-.patch new file mode 100644 index 00000000000..fb1b4661385 --- /dev/null +++ b/queue-5.12/pinctrl-renesas-r8a77990-jtag-pins-do-not-have-pull-.patch @@ -0,0 +1,47 @@ +From 60c0951a76ba32a2429211e15e8f67382fdbb5bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Apr 2021 14:31:01 +0200 +Subject: pinctrl: renesas: r8a77990: JTAG pins do not have pull-down + capabilities +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Geert Uytterhoeven + +[ Upstream commit 702a5fa2fe4d7e7f28fed92a170b540acfff9d34 ] + +Hence remove the SH_PFC_PIN_CFG_PULL_DOWN flags from their pin +descriptions. + +Fixes: 83f6941a42a5e773 ("pinctrl: sh-pfc: r8a77990: Add bias pinconf support") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Niklas Söderlund +Link: https://lore.kernel.org/r/da4b2d69955840a506412f1e8099607a0da97ecc.1619785375.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a77990.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a77990.c b/drivers/pinctrl/renesas/pfc-r8a77990.c +index 0a32e3c317c1..95bcacf1275d 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a77990.c ++++ b/drivers/pinctrl/renesas/pfc-r8a77990.c +@@ -54,10 +54,10 @@ + PIN_NOGP_CFG(FSCLKST_N, "FSCLKST_N", fn, CFG_FLAGS), \ + PIN_NOGP_CFG(MLB_REF, "MLB_REF", fn, CFG_FLAGS), \ + PIN_NOGP_CFG(PRESETOUT_N, "PRESETOUT_N", fn, CFG_FLAGS), \ +- PIN_NOGP_CFG(TCK, "TCK", fn, CFG_FLAGS), \ +- PIN_NOGP_CFG(TDI, "TDI", fn, CFG_FLAGS), \ +- PIN_NOGP_CFG(TMS, "TMS", fn, CFG_FLAGS), \ +- PIN_NOGP_CFG(TRST_N, "TRST_N", fn, CFG_FLAGS) ++ PIN_NOGP_CFG(TCK, "TCK", fn, SH_PFC_PIN_CFG_PULL_UP), \ ++ PIN_NOGP_CFG(TDI, "TDI", fn, SH_PFC_PIN_CFG_PULL_UP), \ ++ PIN_NOGP_CFG(TMS, "TMS", fn, SH_PFC_PIN_CFG_PULL_UP), \ ++ PIN_NOGP_CFG(TRST_N, "TRST_N", fn, SH_PFC_PIN_CFG_PULL_UP) + + /* + * F_() : just information +-- +2.30.2 + diff --git a/queue-5.12/pkt_sched-sch_qfq-fix-qfq_change_class-error-path.patch b/queue-5.12/pkt_sched-sch_qfq-fix-qfq_change_class-error-path.patch new file mode 100644 index 00000000000..f5730763743 --- /dev/null +++ b/queue-5.12/pkt_sched-sch_qfq-fix-qfq_change_class-error-path.patch @@ -0,0 +1,203 @@ +From d87b473ee7017c52d3360690f09b39412602cd2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 10:54:49 -0700 +Subject: pkt_sched: sch_qfq: fix qfq_change_class() error path + +From: Eric Dumazet + +[ Upstream commit 0cd58e5c53babb9237b741dbef711f0a9eb6d3fd ] + +If qfq_change_class() is unable to allocate memory for qfq_aggregate, +it frees the class that has been inserted in the class hash table, +but does not unhash it. + +Defer the insertion after the problematic allocation. + +BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:884 [inline] +BUG: KASAN: use-after-free in qdisc_class_hash_insert+0x200/0x210 net/sched/sch_api.c:731 +Write of size 8 at addr ffff88814a534f10 by task syz-executor.4/31478 + +CPU: 0 PID: 31478 Comm: syz-executor.4 Not tainted 5.13.0-rc6-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:79 [inline] + dump_stack+0x141/0x1d7 lib/dump_stack.c:120 + print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:233 + __kasan_report mm/kasan/report.c:419 [inline] + kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:436 + hlist_add_head include/linux/list.h:884 [inline] + qdisc_class_hash_insert+0x200/0x210 net/sched/sch_api.c:731 + qfq_change_class+0x96c/0x1990 net/sched/sch_qfq.c:489 + tc_ctl_tclass+0x514/0xe50 net/sched/sch_api.c:2113 + rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5564 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 + netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 + netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1929 + sock_sendmsg_nosec net/socket.c:654 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:674 + ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 + do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 + entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x4665d9 +Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007fdc7b5f0188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9 +RDX: 0000000000000000 RSI: 00000000200001c0 RDI: 0000000000000003 +RBP: 00007fdc7b5f01d0 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 +R13: 00007ffcf7310b3f R14: 00007fdc7b5f0300 R15: 0000000000022000 + +Allocated by task 31445: + kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 + kasan_set_track mm/kasan/common.c:46 [inline] + set_alloc_info mm/kasan/common.c:428 [inline] + ____kasan_kmalloc mm/kasan/common.c:507 [inline] + ____kasan_kmalloc mm/kasan/common.c:466 [inline] + __kasan_kmalloc+0x9b/0xd0 mm/kasan/common.c:516 + kmalloc include/linux/slab.h:556 [inline] + kzalloc include/linux/slab.h:686 [inline] + qfq_change_class+0x705/0x1990 net/sched/sch_qfq.c:464 + tc_ctl_tclass+0x514/0xe50 net/sched/sch_api.c:2113 + rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5564 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 + netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 + netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1929 + sock_sendmsg_nosec net/socket.c:654 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:674 + ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 + do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Freed by task 31445: + kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 + kasan_set_track+0x1c/0x30 mm/kasan/common.c:46 + kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:357 + ____kasan_slab_free mm/kasan/common.c:360 [inline] + ____kasan_slab_free mm/kasan/common.c:325 [inline] + __kasan_slab_free+0xfb/0x130 mm/kasan/common.c:368 + kasan_slab_free include/linux/kasan.h:212 [inline] + slab_free_hook mm/slub.c:1583 [inline] + slab_free_freelist_hook+0xdf/0x240 mm/slub.c:1608 + slab_free mm/slub.c:3168 [inline] + kfree+0xe5/0x7f0 mm/slub.c:4212 + qfq_change_class+0x10fb/0x1990 net/sched/sch_qfq.c:518 + tc_ctl_tclass+0x514/0xe50 net/sched/sch_api.c:2113 + rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5564 + netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2504 + netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline] + netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1340 + netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1929 + sock_sendmsg_nosec net/socket.c:654 [inline] + sock_sendmsg+0xcf/0x120 net/socket.c:674 + ____sys_sendmsg+0x6e8/0x810 net/socket.c:2350 + ___sys_sendmsg+0xf3/0x170 net/socket.c:2404 + __sys_sendmsg+0xe5/0x1b0 net/socket.c:2433 + do_syscall_64+0x3a/0xb0 arch/x86/entry/common.c:47 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +The buggy address belongs to the object at ffff88814a534f00 + which belongs to the cache kmalloc-128 of size 128 +The buggy address is located 16 bytes inside of + 128-byte region [ffff88814a534f00, ffff88814a534f80) +The buggy address belongs to the page: +page:ffffea0005294d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14a534 +flags: 0x57ff00000000200(slab|node=1|zone=2|lastcpupid=0x7ff) +raw: 057ff00000000200 ffffea00004fee00 0000000600000006 ffff8880110418c0 +raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected +page_owner tracks the page as allocated +page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 29797, ts 604817765317, free_ts 604810151744 + prep_new_page mm/page_alloc.c:2358 [inline] + get_page_from_freelist+0x1033/0x2b60 mm/page_alloc.c:3994 + __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5200 + alloc_pages+0x18c/0x2a0 mm/mempolicy.c:2272 + alloc_slab_page mm/slub.c:1646 [inline] + allocate_slab+0x2c5/0x4c0 mm/slub.c:1786 + new_slab mm/slub.c:1849 [inline] + new_slab_objects mm/slub.c:2595 [inline] + ___slab_alloc+0x4a1/0x810 mm/slub.c:2758 + __slab_alloc.constprop.0+0xa7/0xf0 mm/slub.c:2798 + slab_alloc_node mm/slub.c:2880 [inline] + slab_alloc mm/slub.c:2922 [inline] + __kmalloc+0x315/0x330 mm/slub.c:4050 + kmalloc include/linux/slab.h:561 [inline] + kzalloc include/linux/slab.h:686 [inline] + __register_sysctl_table+0x112/0x1090 fs/proc/proc_sysctl.c:1318 + mpls_dev_sysctl_register+0x1b7/0x2d0 net/mpls/af_mpls.c:1421 + mpls_add_dev net/mpls/af_mpls.c:1472 [inline] + mpls_dev_notify+0x214/0x8b0 net/mpls/af_mpls.c:1588 + notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 + call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2121 + call_netdevice_notifiers_extack net/core/dev.c:2133 [inline] + call_netdevice_notifiers net/core/dev.c:2147 [inline] + register_netdevice+0x106b/0x1500 net/core/dev.c:10312 + veth_newlink+0x585/0xac0 drivers/net/veth.c:1547 + __rtnl_newlink+0x1062/0x1710 net/core/rtnetlink.c:3452 + rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3500 +page last free stack trace: + reset_page_owner include/linux/page_owner.h:24 [inline] + free_pages_prepare mm/page_alloc.c:1298 [inline] + free_pcp_prepare+0x223/0x300 mm/page_alloc.c:1342 + free_unref_page_prepare mm/page_alloc.c:3250 [inline] + free_unref_page+0x12/0x1d0 mm/page_alloc.c:3298 + __vunmap+0x783/0xb60 mm/vmalloc.c:2566 + free_work+0x58/0x70 mm/vmalloc.c:80 + process_one_work+0x98d/0x1600 kernel/workqueue.c:2276 + worker_thread+0x64c/0x1120 kernel/workqueue.c:2422 + kthread+0x3b1/0x4a0 kernel/kthread.c:313 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 + +Memory state around the buggy address: + ffff88814a534e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff88814a534e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +>ffff88814a534f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff88814a534f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff88814a535000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 + +Fixes: 462dbc9101acd ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") +Signed-off-by: Eric Dumazet +Reported-by: syzbot +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_qfq.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c +index 1db9d4a2ef5e..b692a0de1ad5 100644 +--- a/net/sched/sch_qfq.c ++++ b/net/sched/sch_qfq.c +@@ -485,11 +485,6 @@ static int qfq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, + + if (cl->qdisc != &noop_qdisc) + qdisc_hash_add(cl->qdisc, true); +- sch_tree_lock(sch); +- qdisc_class_hash_insert(&q->clhash, &cl->common); +- sch_tree_unlock(sch); +- +- qdisc_class_hash_grow(sch, &q->clhash); + + set_change_agg: + sch_tree_lock(sch); +@@ -507,8 +502,11 @@ set_change_agg: + } + if (existing) + qfq_deact_rm_from_agg(q, cl); ++ else ++ qdisc_class_hash_insert(&q->clhash, &cl->common); + qfq_add_to_agg(q, new_agg, cl); + sch_tree_unlock(sch); ++ qdisc_class_hash_grow(sch, &q->clhash); + + *arg = (unsigned long)cl; + return 0; +-- +2.30.2 + diff --git a/queue-5.12/platform-x86-asus-nb-wmi-revert-add-support-for-asus.patch b/queue-5.12/platform-x86-asus-nb-wmi-revert-add-support-for-asus.patch new file mode 100644 index 00000000000..b142737d539 --- /dev/null +++ b/queue-5.12/platform-x86-asus-nb-wmi-revert-add-support-for-asus.patch @@ -0,0 +1,134 @@ +From 3d3bf614694aeb363f6a660f220e81f611d699c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 19:49:15 +1200 +Subject: platform/x86: asus-nb-wmi: Revert "add support for ASUS ROG Zephyrus + G14 and G15" + +From: Luke D. Jones + +[ Upstream commit 28117f3a5c3c8375a3304af76357d5bf9cf30f0b ] + +The quirks added to asus-nb-wmi for the ASUS ROG Zephyrus G14 and G15 are +wrong, they tell the asus-wmi code to use the vendor specific WMI backlight +interface. But there is no such interface on these laptops. + +As a side effect, these quirks stop the acpi_video driver to register since +they make acpi_video_get_backlight_type() return acpi_backlight_vendor, +leaving only the native AMD backlight driver in place, which is the one we +want. This happy coincidence is being replaced with a new quirk in +drivers/acpi/video_detect.c which actually sets the backlight_type to +acpi_backlight_native fixinf this properly. This reverts +commit 13bceda68fb9 ("platform/x86: asus-nb-wmi: add support for ASUS ROG +Zephyrus G14 and G15"). + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20210419074915.393433-3-luke@ljones.dev +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 82 ------------------------------ + 1 file changed, 82 deletions(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index b07b1288346e..0cb927f0f301 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -110,16 +110,6 @@ static struct quirk_entry quirk_asus_forceals = { + .wmi_force_als_set = true, + }; + +-static struct quirk_entry quirk_asus_ga401i = { +- .wmi_backlight_power = true, +- .wmi_backlight_set_devstate = true, +-}; +- +-static struct quirk_entry quirk_asus_ga502i = { +- .wmi_backlight_power = true, +- .wmi_backlight_set_devstate = true, +-}; +- + static struct quirk_entry quirk_asus_use_kbd_dock_devid = { + .use_kbd_dock_devid = true, + }; +@@ -430,78 +420,6 @@ static const struct dmi_system_id asus_quirks[] = { + }, + .driver_data = &quirk_asus_forceals, + }, +- { +- .callback = dmi_matched, +- .ident = "ASUSTeK COMPUTER INC. GA401IH", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_MATCH(DMI_PRODUCT_NAME, "GA401IH"), +- }, +- .driver_data = &quirk_asus_ga401i, +- }, +- { +- .callback = dmi_matched, +- .ident = "ASUSTeK COMPUTER INC. GA401II", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_MATCH(DMI_PRODUCT_NAME, "GA401II"), +- }, +- .driver_data = &quirk_asus_ga401i, +- }, +- { +- .callback = dmi_matched, +- .ident = "ASUSTeK COMPUTER INC. GA401IU", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_MATCH(DMI_PRODUCT_NAME, "GA401IU"), +- }, +- .driver_data = &quirk_asus_ga401i, +- }, +- { +- .callback = dmi_matched, +- .ident = "ASUSTeK COMPUTER INC. GA401IV", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_MATCH(DMI_PRODUCT_NAME, "GA401IV"), +- }, +- .driver_data = &quirk_asus_ga401i, +- }, +- { +- .callback = dmi_matched, +- .ident = "ASUSTeK COMPUTER INC. GA401IVC", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_MATCH(DMI_PRODUCT_NAME, "GA401IVC"), +- }, +- .driver_data = &quirk_asus_ga401i, +- }, +- { +- .callback = dmi_matched, +- .ident = "ASUSTeK COMPUTER INC. GA502II", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_MATCH(DMI_PRODUCT_NAME, "GA502II"), +- }, +- .driver_data = &quirk_asus_ga502i, +- }, +- { +- .callback = dmi_matched, +- .ident = "ASUSTeK COMPUTER INC. GA502IU", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_MATCH(DMI_PRODUCT_NAME, "GA502IU"), +- }, +- .driver_data = &quirk_asus_ga502i, +- }, +- { +- .callback = dmi_matched, +- .ident = "ASUSTeK COMPUTER INC. GA502IV", +- .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +- DMI_MATCH(DMI_PRODUCT_NAME, "GA502IV"), +- }, +- .driver_data = &quirk_asus_ga502i, +- }, + { + .callback = dmi_matched, + .ident = "Asus Transformer T100TA / T100HA / T100CHI", +-- +2.30.2 + diff --git a/queue-5.12/platform-x86-asus-nb-wmi-revert-drop-duplicate-dmi-q.patch b/queue-5.12/platform-x86-asus-nb-wmi-revert-drop-duplicate-dmi-q.patch new file mode 100644 index 00000000000..edb1f438e56 --- /dev/null +++ b/queue-5.12/platform-x86-asus-nb-wmi-revert-drop-duplicate-dmi-q.patch @@ -0,0 +1,116 @@ +From a730cc34229c03f20bda974adef2eaf8af312077 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Apr 2021 19:49:14 +1200 +Subject: platform/x86: asus-nb-wmi: Revert "Drop duplicate DMI quirk + structures" + +From: Luke D. Jones + +[ Upstream commit 98c0c85b1040db24f0d04d3e1d315c6c7b05cc07 ] + +This is a preparation revert for reverting the "add support for ASUS ROG +Zephyrus G14 and G15" change. This reverts +commit 67186653c903 ("platform/x86: asus-nb-wmi: Drop duplicate DMI quirk +structures") + +Signed-off-by: Luke D. Jones +Link: https://lore.kernel.org/r/20210419074915.393433-2-luke@ljones.dev +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/asus-nb-wmi.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index d41d7ad14be0..b07b1288346e 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -110,7 +110,12 @@ static struct quirk_entry quirk_asus_forceals = { + .wmi_force_als_set = true, + }; + +-static struct quirk_entry quirk_asus_vendor_backlight = { ++static struct quirk_entry quirk_asus_ga401i = { ++ .wmi_backlight_power = true, ++ .wmi_backlight_set_devstate = true, ++}; ++ ++static struct quirk_entry quirk_asus_ga502i = { + .wmi_backlight_power = true, + .wmi_backlight_set_devstate = true, + }; +@@ -432,7 +437,7 @@ static const struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "GA401IH"), + }, +- .driver_data = &quirk_asus_vendor_backlight, ++ .driver_data = &quirk_asus_ga401i, + }, + { + .callback = dmi_matched, +@@ -441,7 +446,7 @@ static const struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "GA401II"), + }, +- .driver_data = &quirk_asus_vendor_backlight, ++ .driver_data = &quirk_asus_ga401i, + }, + { + .callback = dmi_matched, +@@ -450,7 +455,7 @@ static const struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "GA401IU"), + }, +- .driver_data = &quirk_asus_vendor_backlight, ++ .driver_data = &quirk_asus_ga401i, + }, + { + .callback = dmi_matched, +@@ -459,7 +464,7 @@ static const struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "GA401IV"), + }, +- .driver_data = &quirk_asus_vendor_backlight, ++ .driver_data = &quirk_asus_ga401i, + }, + { + .callback = dmi_matched, +@@ -468,7 +473,7 @@ static const struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "GA401IVC"), + }, +- .driver_data = &quirk_asus_vendor_backlight, ++ .driver_data = &quirk_asus_ga401i, + }, + { + .callback = dmi_matched, +@@ -477,7 +482,7 @@ static const struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "GA502II"), + }, +- .driver_data = &quirk_asus_vendor_backlight, ++ .driver_data = &quirk_asus_ga502i, + }, + { + .callback = dmi_matched, +@@ -486,7 +491,7 @@ static const struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "GA502IU"), + }, +- .driver_data = &quirk_asus_vendor_backlight, ++ .driver_data = &quirk_asus_ga502i, + }, + { + .callback = dmi_matched, +@@ -495,7 +500,7 @@ static const struct dmi_system_id asus_quirks[] = { + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_PRODUCT_NAME, "GA502IV"), + }, +- .driver_data = &quirk_asus_vendor_backlight, ++ .driver_data = &quirk_asus_ga502i, + }, + { + .callback = dmi_matched, +-- +2.30.2 + diff --git a/queue-5.12/platform-x86-toshiba_acpi-fix-missing-error-code-in-.patch b/queue-5.12/platform-x86-toshiba_acpi-fix-missing-error-code-in-.patch new file mode 100644 index 00000000000..1d61b675546 --- /dev/null +++ b/queue-5.12/platform-x86-toshiba_acpi-fix-missing-error-code-in-.patch @@ -0,0 +1,42 @@ +From 4322a1db71ed08379860ea7d11462cd44497e002 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 18:05:48 +0800 +Subject: platform/x86: toshiba_acpi: Fix missing error code in + toshiba_acpi_setup_keyboard() + +From: Jiapeng Chong + +[ Upstream commit 28e367127718a9cb85d615a71e152f7acee41bfc ] + +The error code is missing in this code scenario, add the error code +'-EINVAL' to the return value 'error'. + +Eliminate the follow smatch warning: + +drivers/platform/x86/toshiba_acpi.c:2834 toshiba_acpi_setup_keyboard() +warn: missing error code 'error'. + +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Link: https://lore.kernel.org/r/1622628348-87035-1-git-send-email-jiapeng.chong@linux.alibaba.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/toshiba_acpi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index fa7232ad8c39..352508d30467 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -2831,6 +2831,7 @@ static int toshiba_acpi_setup_keyboard(struct toshiba_acpi_dev *dev) + + if (!dev->info_supported && !dev->system_event_supported) { + pr_warn("No hotkey query interface found\n"); ++ error = -EINVAL; + goto err_remove_filter; + } + +-- +2.30.2 + diff --git a/queue-5.12/platform-x86-touchscreen_dmi-add-an-extra-entry-for-.patch b/queue-5.12/platform-x86-touchscreen_dmi-add-an-extra-entry-for-.patch new file mode 100644 index 00000000000..c8fe9405ee3 --- /dev/null +++ b/queue-5.12/platform-x86-touchscreen_dmi-add-an-extra-entry-for-.patch @@ -0,0 +1,48 @@ +From 869f3a954b171092c79a8bf0cf1cd01cb848c11c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 20:57:44 +0200 +Subject: platform/x86: touchscreen_dmi: Add an extra entry for the upside down + Goodix touchscreen on Teclast X89 tablets + +From: Hans de Goede + +[ Upstream commit a22e3803f2a4d947ff0083a9448a169269ea0f62 ] + +Teclast X89 tablets come in 2 versions, with Windows pre-installed and with +Android pre-installed. These 2 versions have different DMI strings. + +Add a match for the DMI strings used by the Android version BIOS. + +Note the Android version BIOS has a bug in the DSDT where no IRQ is +provided, so for the touchscreen to work a DSDT override fixing this +is necessary as well. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210504185746.175461-4-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index 222f6c9f0b45..bbd8d80230cd 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -1312,6 +1312,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_BOARD_NAME, "X3 Plus"), + }, + }, ++ { ++ /* Teclast X89 (Android version / BIOS) */ ++ .driver_data = (void *)&gdix1001_00_upside_down_data, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "WISKY"), ++ DMI_MATCH(DMI_BOARD_NAME, "3G062i"), ++ }, ++ }, + { + /* Teclast X89 (Windows version / BIOS) */ + .driver_data = (void *)&gdix1001_01_upside_down_data, +-- +2.30.2 + diff --git a/queue-5.12/platform-x86-touchscreen_dmi-add-info-for-the-goodix.patch b/queue-5.12/platform-x86-touchscreen_dmi-add-info-for-the-goodix.patch new file mode 100644 index 00000000000..bd85bfbfa0f --- /dev/null +++ b/queue-5.12/platform-x86-touchscreen_dmi-add-info-for-the-goodix.patch @@ -0,0 +1,76 @@ +From d6f4d04fede1807d6a06574e99d166247a47719d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 20:57:45 +0200 +Subject: platform/x86: touchscreen_dmi: Add info for the Goodix GT912 panel of + TM800A550L tablets + +From: Hans de Goede + +[ Upstream commit fcd8cf0e3e48f4c66af82c8e799c37cb0cccffe0 ] + +The Bay Trail Glavey TM800A550L tablet, which ships with Android installed +from the factory, uses a GT912 touchscreen controller which needs to have +its firmware uploaded by the OS to work (this is a first for a x86 based +device with a Goodix touchscreen controller). + +Add a touchscreen_dmi entry for this which specifies the filenames +to use for the firmware and config files needed for this. + +Note this matches on a GDIX1001 ACPI HID, while the original DSDT uses +a HID of GODX0911. For the touchscreen to work on these devices a DSDT +override is necessary to fix a missing IRQ and broken GPIO settings in +the ACPI-resources for the touchscreen. This override also changes the +HID to the standard GDIX1001 id typically used for Goodix touchscreens. +The DSDT override is available here: +https://fedorapeople.org/~jwrdegoede/glavey-tm800a550l-dsdt-override/ + +Reviewed-by: Bastien Nocera +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210504185746.175461-5-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/touchscreen_dmi.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c +index bbd8d80230cd..b47f6821615e 100644 +--- a/drivers/platform/x86/touchscreen_dmi.c ++++ b/drivers/platform/x86/touchscreen_dmi.c +@@ -316,6 +316,18 @@ static const struct ts_dmi_data gdix1001_01_upside_down_data = { + .properties = gdix1001_upside_down_props, + }; + ++static const struct property_entry glavey_tm800a550l_props[] = { ++ PROPERTY_ENTRY_STRING("firmware-name", "gt912-glavey-tm800a550l.fw"), ++ PROPERTY_ENTRY_STRING("goodix,config-name", "gt912-glavey-tm800a550l.cfg"), ++ PROPERTY_ENTRY_U32("goodix,main-clk", 54), ++ { } ++}; ++ ++static const struct ts_dmi_data glavey_tm800a550l_data = { ++ .acpi_name = "GDIX1001:00", ++ .properties = glavey_tm800a550l_props, ++}; ++ + static const struct property_entry gp_electronic_t701_props[] = { + PROPERTY_ENTRY_U32("touchscreen-size-x", 960), + PROPERTY_ENTRY_U32("touchscreen-size-y", 640), +@@ -1029,6 +1041,15 @@ const struct dmi_system_id touchscreen_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "eSTAR BEAUTY HD Intel Quad core"), + }, + }, ++ { /* Glavey TM800A550L */ ++ .driver_data = (void *)&glavey_tm800a550l_data, ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), ++ /* Above strings are too generic, also match on BIOS version */ ++ DMI_MATCH(DMI_BIOS_VERSION, "ZY-8-BI-PX4S70VTR400-X423B-005-D"), ++ }, ++ }, + { + /* GP-electronic T701 */ + .driver_data = (void *)&gp_electronic_t701_data, +-- +2.30.2 + diff --git a/queue-5.12/pm-devfreq-add-missing-error-code-in-devfreq_add_dev.patch b/queue-5.12/pm-devfreq-add-missing-error-code-in-devfreq_add_dev.patch new file mode 100644 index 00000000000..5c2ea989104 --- /dev/null +++ b/queue-5.12/pm-devfreq-add-missing-error-code-in-devfreq_add_dev.patch @@ -0,0 +1,34 @@ +From 5343b2b051904154645e30ab7f249a1c1237d65e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 14:48:43 +0800 +Subject: PM / devfreq: Add missing error code in devfreq_add_device() + +From: YueHaibing + +[ Upstream commit 18b380ed61f892ed06838d1f1a5124d966292ed3 ] + +Set err code in the error path before jumping to the end of the function. + +Fixes: 4dc3bab8687f ("PM / devfreq: Add support delayed timer for polling mode") +Signed-off-by: YueHaibing +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/devfreq/devfreq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 59ba59bea0f5..db1bc8cf9276 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -822,6 +822,7 @@ struct devfreq *devfreq_add_device(struct device *dev, + if (devfreq->profile->timer < 0 + || devfreq->profile->timer >= DEVFREQ_TIMER_NUM) { + mutex_unlock(&devfreq->lock); ++ err = -EINVAL; + goto err_dev; + } + +-- +2.30.2 + diff --git a/queue-5.12/pm-devfreq-passive-fix-get_target_freq-when-not-usin.patch b/queue-5.12/pm-devfreq-passive-fix-get_target_freq-when-not-usin.patch new file mode 100644 index 00000000000..2e74f622077 --- /dev/null +++ b/queue-5.12/pm-devfreq-passive-fix-get_target_freq-when-not-usin.patch @@ -0,0 +1,48 @@ +From c96fe4b983d17dad810aed02a3bc32cc8e6e284d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 15:05:43 +0900 +Subject: PM / devfreq: passive: Fix get_target_freq when not using + required-opp + +From: Chanwoo Choi + +[ Upstream commit 8c37d01e1a86073d15ea7084390fba58d9a1665f ] + +The 86ad9a24f21e ("PM / devfreq: Add required OPPs support to passive governor") +supported the required-opp property for using devfreq passive governor. +But, 86ad9a24f21e has caused the problem on use-case when required-opp +is not used such as exynos-bus.c devfreq driver. So that fix the +get_target_freq of passive governor for supporting the case of when +required-opp is not used. + +Fixes: 86ad9a24f21e ("PM / devfreq: Add required OPPs support to passive governor") +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/devfreq/governor_passive.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/devfreq/governor_passive.c b/drivers/devfreq/governor_passive.c +index b094132bd20b..fc09324a03e0 100644 +--- a/drivers/devfreq/governor_passive.c ++++ b/drivers/devfreq/governor_passive.c +@@ -65,7 +65,7 @@ static int devfreq_passive_get_target_freq(struct devfreq *devfreq, + dev_pm_opp_put(p_opp); + + if (IS_ERR(opp)) +- return PTR_ERR(opp); ++ goto no_required_opp; + + *freq = dev_pm_opp_get_freq(opp); + dev_pm_opp_put(opp); +@@ -73,6 +73,7 @@ static int devfreq_passive_get_target_freq(struct devfreq *devfreq, + return 0; + } + ++no_required_opp: + /* + * Get the OPP table's index of decided frequency by governor + * of parent device. +-- +2.30.2 + diff --git a/queue-5.12/powerpc-64s-fix-copy-paste-data-exposure-into-newly-.patch b/queue-5.12/powerpc-64s-fix-copy-paste-data-exposure-into-newly-.patch new file mode 100644 index 00000000000..02d646280a1 --- /dev/null +++ b/queue-5.12/powerpc-64s-fix-copy-paste-data-exposure-into-newly-.patch @@ -0,0 +1,108 @@ +From 63da2ec1ccf0a9ea1bcd041797aaa9b9bcf4bd3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 15:30:36 +1000 +Subject: powerpc/64s: Fix copy-paste data exposure into newly created tasks + +From: Nicholas Piggin + +[ Upstream commit f35d2f249ef05b9671e7898f09ad89aa78f99122 ] + +copy-paste contains implicit "copy buffer" state that can contain +arbitrary user data (if the user process executes a copy instruction). +This could be snooped by another process if a context switch hits while +the state is live. So cp_abort is executed on context switch to clear +out possible sensitive data and prevent the leak. + +cp_abort is done after the low level _switch(), which means it is never +reached by newly created tasks, so they could snoop on this buffer +between their first and second context switch. + +Fix this by doing the cp_abort before calling _switch. Add some +comments which should make the issue harder to miss. + +Fixes: 07d2a628bc000 ("powerpc/64s: Avoid cpabort in context switch when possible") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210622053036.474678-1-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/process.c | 48 +++++++++++++++++++++++------------ + 1 file changed, 32 insertions(+), 16 deletions(-) + +diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c +index 3231c2df9e26..03d7261e1492 100644 +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -1212,6 +1212,19 @@ struct task_struct *__switch_to(struct task_struct *prev, + __flush_tlb_pending(batch); + batch->active = 0; + } ++ ++ /* ++ * On POWER9 the copy-paste buffer can only paste into ++ * foreign real addresses, so unprivileged processes can not ++ * see the data or use it in any way unless they have ++ * foreign real mappings. If the new process has the foreign ++ * real address mappings, we must issue a cp_abort to clear ++ * any state and prevent snooping, corruption or a covert ++ * channel. ISA v3.1 supports paste into local memory. ++ */ ++ if (new->mm && (cpu_has_feature(CPU_FTR_ARCH_31) || ++ atomic_read(&new->mm->context.vas_windows))) ++ asm volatile(PPC_CP_ABORT); + #endif /* CONFIG_PPC_BOOK3S_64 */ + + #ifdef CONFIG_PPC_ADV_DEBUG_REGS +@@ -1257,30 +1270,33 @@ struct task_struct *__switch_to(struct task_struct *prev, + + last = _switch(old_thread, new_thread); + ++ /* ++ * Nothing after _switch will be run for newly created tasks, ++ * because they switch directly to ret_from_fork/ret_from_kernel_thread ++ * etc. Code added here should have a comment explaining why that is ++ * okay. ++ */ ++ + #ifdef CONFIG_PPC_BOOK3S_64 ++ /* ++ * This applies to a process that was context switched while inside ++ * arch_enter_lazy_mmu_mode(), to re-activate the batch that was ++ * deactivated above, before _switch(). This will never be the case ++ * for new tasks. ++ */ + if (current_thread_info()->local_flags & _TLF_LAZY_MMU) { + current_thread_info()->local_flags &= ~_TLF_LAZY_MMU; + batch = this_cpu_ptr(&ppc64_tlb_batch); + batch->active = 1; + } + +- if (current->thread.regs) { ++ /* ++ * Math facilities are masked out of the child MSR in copy_thread. ++ * A new task does not need to restore_math because it will ++ * demand fault them. ++ */ ++ if (current->thread.regs) + restore_math(current->thread.regs); +- +- /* +- * On POWER9 the copy-paste buffer can only paste into +- * foreign real addresses, so unprivileged processes can not +- * see the data or use it in any way unless they have +- * foreign real mappings. If the new process has the foreign +- * real address mappings, we must issue a cp_abort to clear +- * any state and prevent snooping, corruption or a covert +- * channel. ISA v3.1 supports paste into local memory. +- */ +- if (current->mm && +- (cpu_has_feature(CPU_FTR_ARCH_31) || +- atomic_read(¤t->mm->context.vas_windows))) +- asm volatile(PPC_CP_ABORT); +- } + #endif /* CONFIG_PPC_BOOK3S_64 */ + + return last; +-- +2.30.2 + diff --git a/queue-5.12/powerpc-64s-interrupt-preserve-regs-softe-for-nmi-in.patch b/queue-5.12/powerpc-64s-interrupt-preserve-regs-softe-for-nmi-in.patch new file mode 100644 index 00000000000..d3078b90d6a --- /dev/null +++ b/queue-5.12/powerpc-64s-interrupt-preserve-regs-softe-for-nmi-in.patch @@ -0,0 +1,56 @@ +From 871863aed5e42bbf1cafb217f24438c9f69b9462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 17:46:17 +1000 +Subject: powerpc/64s/interrupt: preserve regs->softe for NMI interrupts + +From: Nicholas Piggin + +[ Upstream commit 1b0482229c302a3c6afd00d6b3bf0169cf279b44 ] + +If an NMI interrupt hits in an implicit soft-masked region, regs->softe +is modified to reflect that. This may not be necessary for correctness +at the moment, but it is less surprising and it's unhelpful when +debugging or adding checks. + +Make sure this is changed back to how it was found before returning. + +Fixes: 4ec5feec1ad0 ("powerpc/64s: Make NMI record implicitly soft-masked code as irqs disabled") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210630074621.2109197-6-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/interrupt.h | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/powerpc/include/asm/interrupt.h b/arch/powerpc/include/asm/interrupt.h +index 31ed5356590a..6d15728f0680 100644 +--- a/arch/powerpc/include/asm/interrupt.h ++++ b/arch/powerpc/include/asm/interrupt.h +@@ -120,6 +120,7 @@ struct interrupt_nmi_state { + u8 irq_happened; + #endif + u8 ftrace_enabled; ++ u64 softe; + #endif + }; + +@@ -129,6 +130,7 @@ static inline void interrupt_nmi_enter_prepare(struct pt_regs *regs, struct inte + #ifdef CONFIG_PPC_BOOK3S_64 + state->irq_soft_mask = local_paca->irq_soft_mask; + state->irq_happened = local_paca->irq_happened; ++ state->softe = regs->softe; + + /* + * Set IRQS_ALL_DISABLED unconditionally so irqs_disabled() does +@@ -178,6 +180,7 @@ static inline void interrupt_nmi_exit_prepare(struct pt_regs *regs, struct inter + #ifdef CONFIG_PPC_BOOK3S_64 + /* Check we didn't change the pending interrupt mask. */ + WARN_ON_ONCE((state->irq_happened | PACA_IRQ_HARD_DIS) != local_paca->irq_happened); ++ regs->softe = state->softe; + local_paca->irq_happened = state->irq_happened; + local_paca->irq_soft_mask = state->irq_soft_mask; + #endif +-- +2.30.2 + diff --git a/queue-5.12/powerpc-fix-is_kvm_guest-kvm_para_available.patch b/queue-5.12/powerpc-fix-is_kvm_guest-kvm_para_available.patch new file mode 100644 index 00000000000..df1ccaa9e6d --- /dev/null +++ b/queue-5.12/powerpc-fix-is_kvm_guest-kvm_para_available.patch @@ -0,0 +1,108 @@ +From b6e5630cbee60a3cef13913ac00ea7a8e5d4bb5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 23:05:14 +1000 +Subject: powerpc: Fix is_kvm_guest() / kvm_para_available() + +From: Michael Ellerman + +[ Upstream commit 95839225639ba7c3d8d7231b542728dcf222bf2d ] + +Commit a21d1becaa3f ("powerpc: Reintroduce is_kvm_guest() as a fast-path +check") added is_kvm_guest() and changed kvm_para_available() to use it. + +is_kvm_guest() checks a static key, kvm_guest, and that static key is +set in check_kvm_guest(). + +The problem is check_kvm_guest() is only called on pseries, and even +then only in some configurations. That means is_kvm_guest() always +returns false on all non-pseries and some pseries depending on +configuration. That's a bug. + +For PR KVM guests this is noticable because they no longer do live +patching of themselves, which can be detected by the omission of a +message in dmesg such as: + + KVM: Live patching for a fast VM worked + +To fix it make check_kvm_guest() an initcall, to ensure it's always +called at boot. It needs to be core so that it runs before +kvm_guest_init() which is postcore. To be an initcall it needs to return +int, where 0 means success, so update that. + +We still call it manually in pSeries_smp_probe(), because that runs +before init calls are run. + +Fixes: a21d1becaa3f ("powerpc: Reintroduce is_kvm_guest() as a fast-path check") +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210623130514.2543232-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/kvm_guest.h | 4 ++-- + arch/powerpc/kernel/firmware.c | 10 ++++++---- + arch/powerpc/platforms/pseries/smp.c | 4 +++- + 3 files changed, 11 insertions(+), 7 deletions(-) + +diff --git a/arch/powerpc/include/asm/kvm_guest.h b/arch/powerpc/include/asm/kvm_guest.h +index 2fca299f7e19..c63105d2c9e7 100644 +--- a/arch/powerpc/include/asm/kvm_guest.h ++++ b/arch/powerpc/include/asm/kvm_guest.h +@@ -16,10 +16,10 @@ static inline bool is_kvm_guest(void) + return static_branch_unlikely(&kvm_guest); + } + +-bool check_kvm_guest(void); ++int check_kvm_guest(void); + #else + static inline bool is_kvm_guest(void) { return false; } +-static inline bool check_kvm_guest(void) { return false; } ++static inline int check_kvm_guest(void) { return 0; } + #endif + + #endif /* _ASM_POWERPC_KVM_GUEST_H_ */ +diff --git a/arch/powerpc/kernel/firmware.c b/arch/powerpc/kernel/firmware.c +index c9e2819b095a..c7022c41cc31 100644 +--- a/arch/powerpc/kernel/firmware.c ++++ b/arch/powerpc/kernel/firmware.c +@@ -23,18 +23,20 @@ EXPORT_SYMBOL_GPL(powerpc_firmware_features); + + #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_KVM_GUEST) + DEFINE_STATIC_KEY_FALSE(kvm_guest); +-bool check_kvm_guest(void) ++int __init check_kvm_guest(void) + { + struct device_node *hyper_node; + + hyper_node = of_find_node_by_path("/hypervisor"); + if (!hyper_node) +- return false; ++ return 0; + + if (!of_device_is_compatible(hyper_node, "linux,kvm")) +- return false; ++ return 0; + + static_branch_enable(&kvm_guest); +- return true; ++ ++ return 0; + } ++core_initcall(check_kvm_guest); // before kvm_guest_init() + #endif +diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c +index c70b4be9f0a5..096629f54576 100644 +--- a/arch/powerpc/platforms/pseries/smp.c ++++ b/arch/powerpc/platforms/pseries/smp.c +@@ -211,7 +211,9 @@ static __init void pSeries_smp_probe(void) + if (!cpu_has_feature(CPU_FTR_SMT)) + return; + +- if (check_kvm_guest()) { ++ check_kvm_guest(); ++ ++ if (is_kvm_guest()) { + /* + * KVM emulates doorbells by disabling FSCR[MSGP] so msgsndp + * faults to the hypervisor which then reads the instruction +-- +2.30.2 + diff --git a/queue-5.12/powerpc-offline-cpu-in-stop_this_cpu.patch b/queue-5.12/powerpc-offline-cpu-in-stop_this_cpu.patch new file mode 100644 index 00000000000..86e2ec9a9e4 --- /dev/null +++ b/queue-5.12/powerpc-offline-cpu-in-stop_this_cpu.patch @@ -0,0 +1,61 @@ +From 0a96b5a76545b6d42798d8499b722d10f92515a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 14:12:45 +1000 +Subject: powerpc: Offline CPU in stop_this_cpu() + +From: Nicholas Piggin + +[ Upstream commit bab26238bbd44d5a4687c0a64fd2c7f2755ea937 ] + +printk_safe_flush_on_panic() has special lock breaking code for the case +where we panic()ed with the console lock held. It relies on panic IPI +causing other CPUs to mark themselves offline. + +Do as most other architectures do. + +This effectively reverts commit de6e5d38417e ("powerpc: smp_send_stop do +not offline stopped CPUs"), unfortunately it may result in some false +positive warnings, but the alternative is more situations where we can +crash without getting messages out. + +Fixes: de6e5d38417e ("powerpc: smp_send_stop do not offline stopped CPUs") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210623041245.865134-1-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/smp.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c +index 1d7daef1c3b6..216919de87d7 100644 +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -619,6 +619,8 @@ static void nmi_stop_this_cpu(struct pt_regs *regs) + /* + * IRQs are already hard disabled by the smp_handle_nmi_ipi. + */ ++ set_cpu_online(smp_processor_id(), false); ++ + spin_begin(); + while (1) + spin_cpu_relax(); +@@ -634,6 +636,15 @@ void smp_send_stop(void) + static void stop_this_cpu(void *dummy) + { + hard_irq_disable(); ++ ++ /* ++ * Offlining CPUs in stop_this_cpu can result in scheduler warnings, ++ * (see commit de6e5d38417e), but printk_safe_flush_on_panic() wants ++ * to know other CPUs are offline before it breaks locks to flush ++ * printk buffers, in case we panic()ed while holding the lock. ++ */ ++ set_cpu_online(smp_processor_id(), false); ++ + spin_begin(); + while (1) + spin_cpu_relax(); +-- +2.30.2 + diff --git a/queue-5.12/powerpc-papr_scm-make-perf_stats-invisible-if-perf-s.patch b/queue-5.12/powerpc-papr_scm-make-perf_stats-invisible-if-perf-s.patch new file mode 100644 index 00000000000..7e4f693bf09 --- /dev/null +++ b/queue-5.12/powerpc-papr_scm-make-perf_stats-invisible-if-perf-s.patch @@ -0,0 +1,144 @@ +From fd99c19e9cb89830bfb4bffb207ee9cc55cfba24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 May 2021 14:53:49 +0530 +Subject: powerpc/papr_scm: Make 'perf_stats' invisible if perf-stats + unavailable + +From: Vaibhav Jain + +[ Upstream commit ed78f56e1271f108e8af61baeba383dcd77adbec ] + +In case performance stats for an nvdimm are not available, reading the +'perf_stats' sysfs file returns an -ENOENT error. A better approach is +to make the 'perf_stats' file entirely invisible to indicate that +performance stats for an nvdimm are unavailable. + +So this patch updates 'papr_nd_attribute_group' to add a 'is_visible' +callback implemented as newly introduced 'papr_nd_attribute_visible()' +that returns an appropriate mode in case performance stats aren't +supported in a given nvdimm. + +Also the initialization of 'papr_scm_priv.stat_buffer_len' is moved +from papr_scm_nvdimm_init() to papr_scm_probe() so that it value is +available when 'papr_nd_attribute_visible()' is called during nvdimm +initialization. + +Even though 'perf_stats' attribute is available since v5.9, there are +no known user-space tools/scripts that are dependent on presence of its +sysfs file. Hence I dont expect any user-space breakage with this +patch. + +Fixes: 2d02bf835e57 ("powerpc/papr_scm: Fetch nvdimm performance stats from PHYP") +Signed-off-by: Vaibhav Jain +Reviewed-by: Dan Williams +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210513092349.285021-1-vaibhav@linux.ibm.com +Signed-off-by: Sasha Levin +--- + Documentation/ABI/testing/sysfs-bus-papr-pmem | 8 +++-- + arch/powerpc/platforms/pseries/papr_scm.c | 35 +++++++++++++------ + 2 files changed, 29 insertions(+), 14 deletions(-) + +diff --git a/Documentation/ABI/testing/sysfs-bus-papr-pmem b/Documentation/ABI/testing/sysfs-bus-papr-pmem +index 8316c33862a0..0aa02bf2bde5 100644 +--- a/Documentation/ABI/testing/sysfs-bus-papr-pmem ++++ b/Documentation/ABI/testing/sysfs-bus-papr-pmem +@@ -39,9 +39,11 @@ KernelVersion: v5.9 + Contact: linuxppc-dev , linux-nvdimm@lists.01.org, + Description: + (RO) Report various performance stats related to papr-scm NVDIMM +- device. Each stat is reported on a new line with each line +- composed of a stat-identifier followed by it value. Below are +- currently known dimm performance stats which are reported: ++ device. This attribute is only available for NVDIMM devices ++ that support reporting NVDIMM performance stats. Each stat is ++ reported on a new line with each line composed of a ++ stat-identifier followed by it value. Below are currently known ++ dimm performance stats which are reported: + + * "CtlResCt" : Controller Reset Count + * "CtlResTm" : Controller Reset Elapsed Time +diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c +index 0693bc8d70ac..057acbb9116d 100644 +--- a/arch/powerpc/platforms/pseries/papr_scm.c ++++ b/arch/powerpc/platforms/pseries/papr_scm.c +@@ -868,6 +868,20 @@ static ssize_t flags_show(struct device *dev, + } + DEVICE_ATTR_RO(flags); + ++static umode_t papr_nd_attribute_visible(struct kobject *kobj, ++ struct attribute *attr, int n) ++{ ++ struct device *dev = kobj_to_dev(kobj); ++ struct nvdimm *nvdimm = to_nvdimm(dev); ++ struct papr_scm_priv *p = nvdimm_provider_data(nvdimm); ++ ++ /* For if perf-stats not available remove perf_stats sysfs */ ++ if (attr == &dev_attr_perf_stats.attr && p->stat_buffer_len == 0) ++ return 0; ++ ++ return attr->mode; ++} ++ + /* papr_scm specific dimm attributes */ + static struct attribute *papr_nd_attributes[] = { + &dev_attr_flags.attr, +@@ -877,6 +891,7 @@ static struct attribute *papr_nd_attributes[] = { + + static struct attribute_group papr_nd_attribute_group = { + .name = "papr", ++ .is_visible = papr_nd_attribute_visible, + .attrs = papr_nd_attributes, + }; + +@@ -892,7 +907,6 @@ static int papr_scm_nvdimm_init(struct papr_scm_priv *p) + struct nd_region_desc ndr_desc; + unsigned long dimm_flags; + int target_nid, online_nid; +- ssize_t stat_size; + + p->bus_desc.ndctl = papr_scm_ndctl; + p->bus_desc.module = THIS_MODULE; +@@ -963,16 +977,6 @@ static int papr_scm_nvdimm_init(struct papr_scm_priv *p) + list_add_tail(&p->region_list, &papr_nd_regions); + mutex_unlock(&papr_ndr_lock); + +- /* Try retriving the stat buffer and see if its supported */ +- stat_size = drc_pmem_query_stats(p, NULL, 0); +- if (stat_size > 0) { +- p->stat_buffer_len = stat_size; +- dev_dbg(&p->pdev->dev, "Max perf-stat size %lu-bytes\n", +- p->stat_buffer_len); +- } else { +- dev_info(&p->pdev->dev, "Dimm performance stats unavailable\n"); +- } +- + return 0; + + err: nvdimm_bus_unregister(p->bus); +@@ -1050,6 +1054,7 @@ static int papr_scm_probe(struct platform_device *pdev) + struct papr_scm_priv *p; + u8 uuid_raw[UUID_SIZE]; + const char *uuid_str; ++ ssize_t stat_size; + uuid_t uuid; + int rc; + +@@ -1133,6 +1138,14 @@ static int papr_scm_probe(struct platform_device *pdev) + p->res.name = pdev->name; + p->res.flags = IORESOURCE_MEM; + ++ /* Try retrieving the stat buffer and see if its supported */ ++ stat_size = drc_pmem_query_stats(p, NULL, 0); ++ if (stat_size > 0) { ++ p->stat_buffer_len = stat_size; ++ dev_dbg(&p->pdev->dev, "Max perf-stat size %lu-bytes\n", ++ p->stat_buffer_len); ++ } ++ + rc = papr_scm_nvdimm_init(p); + if (rc) + goto err2; +-- +2.30.2 + diff --git a/queue-5.12/powerpc-papr_scm-properly-handle-uuid-types-and-api.patch b/queue-5.12/powerpc-papr_scm-properly-handle-uuid-types-and-api.patch new file mode 100644 index 00000000000..5ed06bee4ea --- /dev/null +++ b/queue-5.12/powerpc-papr_scm-properly-handle-uuid-types-and-api.patch @@ -0,0 +1,82 @@ +From 06f16af015ed15c7a035d31f0ac71c9ef7bb42cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 16:43:03 +0300 +Subject: powerpc/papr_scm: Properly handle UUID types and API + +From: Andy Shevchenko + +[ Upstream commit 0e8554b5d7801b0aebc6c348a0a9f7706aa17b3b ] + +Parse to and export from UUID own type, before dereferencing. +This also fixes wrong comment (Little Endian UUID is something else) +and should eliminate the direct strict types assignments. + +Fixes: 43001c52b603 ("powerpc/papr_scm: Use ibm,unit-guid as the iset cookie") +Fixes: 259a948c4ba1 ("powerpc/pseries/scm: Use a specific endian format for storing uuid from the device tree") +Signed-off-by: Andy Shevchenko +Reviewed-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210616134303.58185-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/papr_scm.c | 27 +++++++++++++++-------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c +index 835163f54244..0693bc8d70ac 100644 +--- a/arch/powerpc/platforms/pseries/papr_scm.c ++++ b/arch/powerpc/platforms/pseries/papr_scm.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + #define BIND_ANY_ADDR (~0ul) + +@@ -1047,8 +1048,9 @@ static int papr_scm_probe(struct platform_device *pdev) + u32 drc_index, metadata_size; + u64 blocks, block_size; + struct papr_scm_priv *p; ++ u8 uuid_raw[UUID_SIZE]; + const char *uuid_str; +- u64 uuid[2]; ++ uuid_t uuid; + int rc; + + /* check we have all the required DT properties */ +@@ -1090,16 +1092,23 @@ static int papr_scm_probe(struct platform_device *pdev) + p->is_volatile = !of_property_read_bool(dn, "ibm,cache-flush-required"); + + /* We just need to ensure that set cookies are unique across */ +- uuid_parse(uuid_str, (uuid_t *) uuid); ++ uuid_parse(uuid_str, &uuid); ++ + /* +- * cookie1 and cookie2 are not really little endian +- * we store a little endian representation of the +- * uuid str so that we can compare this with the label +- * area cookie irrespective of the endian config with which +- * the kernel is built. ++ * The cookie1 and cookie2 are not really little endian. ++ * We store a raw buffer representation of the ++ * uuid string so that we can compare this with the label ++ * area cookie irrespective of the endian configuration ++ * with which the kernel is built. ++ * ++ * Historically we stored the cookie in the below format. ++ * for a uuid string 72511b67-0b3b-42fd-8d1d-5be3cae8bcaa ++ * cookie1 was 0xfd423b0b671b5172 ++ * cookie2 was 0xaabce8cae35b1d8d + */ +- p->nd_set.cookie1 = cpu_to_le64(uuid[0]); +- p->nd_set.cookie2 = cpu_to_le64(uuid[1]); ++ export_uuid(uuid_raw, &uuid); ++ p->nd_set.cookie1 = get_unaligned_le64(&uuid_raw[0]); ++ p->nd_set.cookie2 = get_unaligned_le64(&uuid_raw[8]); + + /* might be zero */ + p->metadata_size = metadata_size; +-- +2.30.2 + diff --git a/queue-5.12/powerpc-powernv-fix-machine-check-reporting-of-async.patch b/queue-5.12/powerpc-powernv-fix-machine-check-reporting-of-async.patch new file mode 100644 index 00000000000..ec0d2306216 --- /dev/null +++ b/queue-5.12/powerpc-powernv-fix-machine-check-reporting-of-async.patch @@ -0,0 +1,134 @@ +From 368c38137a7097a8cfe00c168ce68190df437fce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 00:03:55 +1000 +Subject: powerpc/powernv: Fix machine check reporting of async store errors + +From: Nicholas Piggin + +[ Upstream commit 3729e0ec59a20825bd4c8c70996b2df63915e1dd ] + +POWER9 and POWER10 asynchronous machine checks due to stores have their +cause reported in SRR1 but SRR1[42] is set, which in other cases +indicates DSISR cause. + +Check for these cases and clear SRR1[42], so the cause matching uses +the i-side (SRR1) table. + +Fixes: 7b9f71f974a1 ("powerpc/64s: POWER9 machine check handler") +Fixes: 201220bb0e8c ("powerpc/powernv: Machine check handler for POWER10") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20210517140355.2325406-1-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/mce_power.c | 48 +++++++++++++++++++++++++++------ + 1 file changed, 40 insertions(+), 8 deletions(-) + +diff --git a/arch/powerpc/kernel/mce_power.c b/arch/powerpc/kernel/mce_power.c +index 667104d4c455..2fff886c549d 100644 +--- a/arch/powerpc/kernel/mce_power.c ++++ b/arch/powerpc/kernel/mce_power.c +@@ -481,12 +481,11 @@ static int mce_find_instr_ea_and_phys(struct pt_regs *regs, uint64_t *addr, + return -1; + } + +-static int mce_handle_ierror(struct pt_regs *regs, ++static int mce_handle_ierror(struct pt_regs *regs, unsigned long srr1, + const struct mce_ierror_table table[], + struct mce_error_info *mce_err, uint64_t *addr, + uint64_t *phys_addr) + { +- uint64_t srr1 = regs->msr; + int handled = 0; + int i; + +@@ -695,19 +694,19 @@ static long mce_handle_ue_error(struct pt_regs *regs, + } + + static long mce_handle_error(struct pt_regs *regs, ++ unsigned long srr1, + const struct mce_derror_table dtable[], + const struct mce_ierror_table itable[]) + { + struct mce_error_info mce_err = { 0 }; + uint64_t addr, phys_addr = ULONG_MAX; +- uint64_t srr1 = regs->msr; + long handled; + + if (SRR1_MC_LOADSTORE(srr1)) + handled = mce_handle_derror(regs, dtable, &mce_err, &addr, + &phys_addr); + else +- handled = mce_handle_ierror(regs, itable, &mce_err, &addr, ++ handled = mce_handle_ierror(regs, srr1, itable, &mce_err, &addr, + &phys_addr); + + if (!handled && mce_err.error_type == MCE_ERROR_TYPE_UE) +@@ -723,16 +722,20 @@ long __machine_check_early_realmode_p7(struct pt_regs *regs) + /* P7 DD1 leaves top bits of DSISR undefined */ + regs->dsisr &= 0x0000ffff; + +- return mce_handle_error(regs, mce_p7_derror_table, mce_p7_ierror_table); ++ return mce_handle_error(regs, regs->msr, ++ mce_p7_derror_table, mce_p7_ierror_table); + } + + long __machine_check_early_realmode_p8(struct pt_regs *regs) + { +- return mce_handle_error(regs, mce_p8_derror_table, mce_p8_ierror_table); ++ return mce_handle_error(regs, regs->msr, ++ mce_p8_derror_table, mce_p8_ierror_table); + } + + long __machine_check_early_realmode_p9(struct pt_regs *regs) + { ++ unsigned long srr1 = regs->msr; ++ + /* + * On POWER9 DD2.1 and below, it's possible to get a machine check + * caused by a paste instruction where only DSISR bit 25 is set. This +@@ -746,10 +749,39 @@ long __machine_check_early_realmode_p9(struct pt_regs *regs) + if (SRR1_MC_LOADSTORE(regs->msr) && regs->dsisr == 0x02000000) + return 1; + +- return mce_handle_error(regs, mce_p9_derror_table, mce_p9_ierror_table); ++ /* ++ * Async machine check due to bad real address from store or foreign ++ * link time out comes with the load/store bit (PPC bit 42) set in ++ * SRR1, but the cause comes in SRR1 not DSISR. Clear bit 42 so we're ++ * directed to the ierror table so it will find the cause (which ++ * describes it correctly as a store error). ++ */ ++ if (SRR1_MC_LOADSTORE(srr1) && ++ ((srr1 & 0x081c0000) == 0x08140000 || ++ (srr1 & 0x081c0000) == 0x08180000)) { ++ srr1 &= ~PPC_BIT(42); ++ } ++ ++ return mce_handle_error(regs, srr1, ++ mce_p9_derror_table, mce_p9_ierror_table); + } + + long __machine_check_early_realmode_p10(struct pt_regs *regs) + { +- return mce_handle_error(regs, mce_p10_derror_table, mce_p10_ierror_table); ++ unsigned long srr1 = regs->msr; ++ ++ /* ++ * Async machine check due to bad real address from store comes with ++ * the load/store bit (PPC bit 42) set in SRR1, but the cause comes in ++ * SRR1 not DSISR. Clear bit 42 so we're directed to the ierror table ++ * so it will find the cause (which describes it correctly as a store ++ * error). ++ */ ++ if (SRR1_MC_LOADSTORE(srr1) && ++ (srr1 & 0x081c0000) == 0x08140000) { ++ srr1 &= ~PPC_BIT(42); ++ } ++ ++ return mce_handle_error(regs, srr1, ++ mce_p10_derror_table, mce_p10_ierror_table); + } +-- +2.30.2 + diff --git a/queue-5.12/psi-fix-race-between-psi_trigger_create-destroy.patch b/queue-5.12/psi-fix-race-between-psi_trigger_create-destroy.patch new file mode 100644 index 00000000000..96d9e08afd4 --- /dev/null +++ b/queue-5.12/psi-fix-race-between-psi_trigger_create-destroy.patch @@ -0,0 +1,112 @@ +From c49e6a58d42b318de6b72fc8dd06ef66e06450ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Jun 2021 08:29:34 +0800 +Subject: psi: Fix race between psi_trigger_create/destroy + +From: Zhaoyang Huang + +[ Upstream commit 8f91efd870ea5d8bc10b0fcc9740db51cd4c0c83 ] + +Race detected between psi_trigger_destroy/create as shown below, which +cause panic by accessing invalid psi_system->poll_wait->wait_queue_entry +and psi_system->poll_timer->entry->next. Under this modification, the +race window is removed by initialising poll_wait and poll_timer in +group_init which are executed only once at beginning. + + psi_trigger_destroy() psi_trigger_create() + + mutex_lock(trigger_lock); + rcu_assign_pointer(poll_task, NULL); + mutex_unlock(trigger_lock); + mutex_lock(trigger_lock); + if (!rcu_access_pointer(group->poll_task)) { + timer_setup(poll_timer, poll_timer_fn, 0); + rcu_assign_pointer(poll_task, task); + } + mutex_unlock(trigger_lock); + + synchronize_rcu(); + del_timer_sync(poll_timer); <-- poll_timer has been reinitialized by + psi_trigger_create() + +So, trigger_lock/RCU correctly protects destruction of +group->poll_task but misses this race affecting poll_timer and +poll_wait. + +Fixes: 461daba06bdc ("psi: eliminate kthread_worker from psi trigger scheduling mechanism") +Co-developed-by: ziwei.dai +Signed-off-by: ziwei.dai +Co-developed-by: ke.wang +Signed-off-by: ke.wang +Signed-off-by: Zhaoyang Huang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Suren Baghdasaryan +Acked-by: Johannes Weiner +Link: https://lkml.kernel.org/r/1623371374-15664-1-git-send-email-huangzhaoyang@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/sched/psi.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c +index ef37acd28e4a..37f02fdbb35a 100644 +--- a/kernel/sched/psi.c ++++ b/kernel/sched/psi.c +@@ -179,6 +179,8 @@ struct psi_group psi_system = { + + static void psi_avgs_work(struct work_struct *work); + ++static void poll_timer_fn(struct timer_list *t); ++ + static void group_init(struct psi_group *group) + { + int cpu; +@@ -198,6 +200,8 @@ static void group_init(struct psi_group *group) + memset(group->polling_total, 0, sizeof(group->polling_total)); + group->polling_next_update = ULLONG_MAX; + group->polling_until = 0; ++ init_waitqueue_head(&group->poll_wait); ++ timer_setup(&group->poll_timer, poll_timer_fn, 0); + rcu_assign_pointer(group->poll_task, NULL); + } + +@@ -1142,9 +1146,7 @@ struct psi_trigger *psi_trigger_create(struct psi_group *group, + return ERR_CAST(task); + } + atomic_set(&group->poll_wakeup, 0); +- init_waitqueue_head(&group->poll_wait); + wake_up_process(task); +- timer_setup(&group->poll_timer, poll_timer_fn, 0); + rcu_assign_pointer(group->poll_task, task); + } + +@@ -1196,6 +1198,7 @@ static void psi_trigger_destroy(struct kref *ref) + group->poll_task, + lockdep_is_held(&group->trigger_lock)); + rcu_assign_pointer(group->poll_task, NULL); ++ del_timer(&group->poll_timer); + } + } + +@@ -1208,17 +1211,14 @@ static void psi_trigger_destroy(struct kref *ref) + */ + synchronize_rcu(); + /* +- * Destroy the kworker after releasing trigger_lock to prevent a ++ * Stop kthread 'psimon' after releasing trigger_lock to prevent a + * deadlock while waiting for psi_poll_work to acquire trigger_lock + */ + if (task_to_destroy) { + /* + * After the RCU grace period has expired, the worker + * can no longer be found through group->poll_task. +- * But it might have been already scheduled before +- * that - deschedule it cleanly before destroying it. + */ +- del_timer_sync(&group->poll_timer); + kthread_stop(task_to_destroy); + } + kfree(t); +-- +2.30.2 + diff --git a/queue-5.12/random32-fix-implicit-truncation-warning-in-prandom_.patch b/queue-5.12/random32-fix-implicit-truncation-warning-in-prandom_.patch new file mode 100644 index 00000000000..18eb9596da8 --- /dev/null +++ b/queue-5.12/random32-fix-implicit-truncation-warning-in-prandom_.patch @@ -0,0 +1,48 @@ +From 4afef175ca5b85cc1651c89c975abac897b737d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:20:12 +0100 +Subject: random32: Fix implicit truncation warning in prandom_seed_state() + +From: Richard Fitzgerald + +[ Upstream commit d327ea15a305024ef0085252fa3657bbb1ce25f5 ] + +sparse generates the following warning: + + include/linux/prandom.h:114:45: sparse: sparse: cast truncates bits from + constant value + +This is because the 64-bit seed value is manipulated and then placed in a +u32, causing an implicit cast and truncation. A forced cast to u32 doesn't +prevent this warning, which is reasonable because a typecast doesn't prove +that truncation was expected. + +Logical-AND the value with 0xffffffff to make explicit that truncation to +32-bit is intended. + +Reported-by: kernel test robot +Signed-off-by: Richard Fitzgerald +Reviewed-by: Petr Mladek +Signed-off-by: Petr Mladek +Link: https://lore.kernel.org/r/20210525122012.6336-3-rf@opensource.cirrus.com +Signed-off-by: Sasha Levin +--- + include/linux/prandom.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/prandom.h b/include/linux/prandom.h +index bbf4b4ad61df..056d31317e49 100644 +--- a/include/linux/prandom.h ++++ b/include/linux/prandom.h +@@ -111,7 +111,7 @@ static inline u32 __seed(u32 x, u32 m) + */ + static inline void prandom_seed_state(struct rnd_state *state, u64 seed) + { +- u32 i = (seed >> 32) ^ (seed << 10) ^ seed; ++ u32 i = ((seed >> 32) ^ (seed << 10) ^ seed) & 0xffffffffUL; + + state->s1 = __seed(i, 2U); + state->s2 = __seed(i, 8U); +-- +2.30.2 + diff --git a/queue-5.12/rcu-invoke-rcu_spawn_core_kthreads-from-rcu_spawn_gp.patch b/queue-5.12/rcu-invoke-rcu_spawn_core_kthreads-from-rcu_spawn_gp.patch new file mode 100644 index 00000000000..5dd2e315518 --- /dev/null +++ b/queue-5.12/rcu-invoke-rcu_spawn_core_kthreads-from-rcu_spawn_gp.patch @@ -0,0 +1,57 @@ +From 85a381cc4471cc2c1edbb70d0d4b39f0df1dc9f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 31 Mar 2021 10:59:05 -0700 +Subject: rcu: Invoke rcu_spawn_core_kthreads() from rcu_spawn_gp_kthread() + +From: Paul E. McKenney + +[ Upstream commit 8e4b1d2bc198e34b48fc7cc3a3c5a2fcb269e271 ] + +Currently, rcu_spawn_core_kthreads() is invoked via an early_initcall(), +which works, except that rcu_spawn_gp_kthread() is also invoked via an +early_initcall() and rcu_spawn_core_kthreads() relies on adjustments to +kthread_prio that are carried out by rcu_spawn_gp_kthread(). There is +no guaranttee of ordering among early_initcall() handlers, and thus no +guarantee that kthread_prio will be properly checked and range-limited +at the time that rcu_spawn_core_kthreads() needs it. + +In most cases, this bug is harmless. After all, the only reason that +rcu_spawn_gp_kthread() adjusts the value of kthread_prio is if the user +specified a nonsensical value for this boot parameter, which experience +indicates is rare. + +Nevertheless, a bug is a bug. This commit therefore causes the +rcu_spawn_core_kthreads() function to be invoked directly from +rcu_spawn_gp_kthread() after any needed adjustments to kthread_prio have +been carried out. + +Fixes: 48d07c04b4cc ("rcu: Enable elimination of Tree-RCU softirq processing") +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index 7356764e49a0..a274622ed6fa 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -2911,7 +2911,6 @@ static int __init rcu_spawn_core_kthreads(void) + "%s: Could not start rcuc kthread, OOM is now expected behavior\n", __func__); + return 0; + } +-early_initcall(rcu_spawn_core_kthreads); + + /* + * Handle any core-RCU processing required by a call_rcu() invocation. +@@ -4392,6 +4391,7 @@ static int __init rcu_spawn_gp_kthread(void) + wake_up_process(t); + rcu_spawn_nocb_kthreads(); + rcu_spawn_boost_kthreads(); ++ rcu_spawn_core_kthreads(); + return 0; + } + early_initcall(rcu_spawn_gp_kthread); +-- +2.30.2 + diff --git a/queue-5.12/rdma-cma-fix-incorrect-packet-lifetime-calculation.patch b/queue-5.12/rdma-cma-fix-incorrect-packet-lifetime-calculation.patch new file mode 100644 index 00000000000..8222fd11c79 --- /dev/null +++ b/queue-5.12/rdma-cma-fix-incorrect-packet-lifetime-calculation.patch @@ -0,0 +1,54 @@ +From 5a53c8169508e0213a51864d3427f6ad8f67e2e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 16:13:27 +0200 +Subject: RDMA/cma: Fix incorrect Packet Lifetime calculation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit e84045eab69c625bc0b0bf24d8e05bc65da1eed1 ] + +An approximation for the PacketLifeTime is half the local ACK timeout. +The encoding for both timers are logarithmic. + +If the local ACK timeout is set, but zero, it means the timer is +disabled. In this case, we choose the CMA_IBOE_PACKET_LIFETIME value, +since 50% of infinite makes no sense. + +Before this commit, the PacketLifeTime became 255 if local ACK +timeout was zero (not running). + +Fixed by explicitly testing for timeout being zero. + +Fixes: e1ee1e62bec4 ("RDMA/cma: Use ACK timeout for RoCE packetLifeTime") +Link: https://lore.kernel.org/r/1624371207-26710-1-git-send-email-haakon.bugge@oracle.com +Signed-off-by: HÃ¥kon Bugge +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 2f5f384987a2..68bbcecb0a6a 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -3060,8 +3060,10 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv) + * as a reasonable approximation for RoCE networks. + */ + mutex_lock(&id_priv->qp_mutex); +- route->path_rec->packet_life_time = id_priv->timeout_set ? +- id_priv->timeout - 1 : CMA_IBOE_PACKET_LIFETIME; ++ if (id_priv->timeout_set && id_priv->timeout) ++ route->path_rec->packet_life_time = id_priv->timeout - 1; ++ else ++ route->path_rec->packet_life_time = CMA_IBOE_PACKET_LIFETIME; + mutex_unlock(&id_priv->qp_mutex); + + if (!route->path_rec->mtu) { +-- +2.30.2 + diff --git a/queue-5.12/rdma-cma-protect-rmw-with-qp_mutex.patch b/queue-5.12/rdma-cma-protect-rmw-with-qp_mutex.patch new file mode 100644 index 00000000000..a109ebef353 --- /dev/null +++ b/queue-5.12/rdma-cma-protect-rmw-with-qp_mutex.patch @@ -0,0 +1,126 @@ +From 3cd34cd99ba31dc4684a2e6e806872fa2595d6c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 15:39:57 +0200 +Subject: RDMA/cma: Protect RMW with qp_mutex +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit ca0c448d2b9f43e3175835d536853854ef544e22 ] + +The struct rdma_id_private contains three bit-fields, tos_set, +timeout_set, and min_rnr_timer_set. These are set by accessor functions +without any synchronization. If two or all accessor functions are invoked +in close proximity in time, there will be Read-Modify-Write from several +contexts to the same variable, and the result will be intermittent. + +Fixed by protecting the bit-fields by the qp_mutex in the accessor +functions. + +The consumer of timeout_set and min_rnr_timer_set is in +rdma_init_qp_attr(), which is called with qp_mutex held for connected +QPs. Explicit locking is added for the consumers of tos and tos_set. + +This commit depends on ("RDMA/cma: Remove unnecessary INIT->INIT +transition"), since the call to rdma_init_qp_attr() from +cma_init_conn_qp() does not hold the qp_mutex. + +Fixes: 2c1619edef61 ("IB/cma: Define option to set ack timeout and pack tos_set") +Fixes: 3aeffc46afde ("IB/cma: Introduce rdma_set_min_rnr_timer()") +Link: https://lore.kernel.org/r/1624369197-24578-3-git-send-email-haakon.bugge@oracle.com +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 5b9022a8c9ec..2f5f384987a2 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -2476,8 +2476,10 @@ static int cma_iw_listen(struct rdma_id_private *id_priv, int backlog) + if (IS_ERR(id)) + return PTR_ERR(id); + ++ mutex_lock(&id_priv->qp_mutex); + id->tos = id_priv->tos; + id->tos_set = id_priv->tos_set; ++ mutex_unlock(&id_priv->qp_mutex); + id_priv->cm_id.iw = id; + + memcpy(&id_priv->cm_id.iw->local_addr, cma_src_addr(id_priv), +@@ -2537,8 +2539,10 @@ static int cma_listen_on_dev(struct rdma_id_private *id_priv, + cma_id_get(id_priv); + dev_id_priv->internal_id = 1; + dev_id_priv->afonly = id_priv->afonly; ++ mutex_lock(&id_priv->qp_mutex); + dev_id_priv->tos_set = id_priv->tos_set; + dev_id_priv->tos = id_priv->tos; ++ mutex_unlock(&id_priv->qp_mutex); + + ret = rdma_listen(&dev_id_priv->id, id_priv->backlog); + if (ret) +@@ -2585,8 +2589,10 @@ void rdma_set_service_type(struct rdma_cm_id *id, int tos) + struct rdma_id_private *id_priv; + + id_priv = container_of(id, struct rdma_id_private, id); ++ mutex_lock(&id_priv->qp_mutex); + id_priv->tos = (u8) tos; + id_priv->tos_set = true; ++ mutex_unlock(&id_priv->qp_mutex); + } + EXPORT_SYMBOL(rdma_set_service_type); + +@@ -2613,8 +2619,10 @@ int rdma_set_ack_timeout(struct rdma_cm_id *id, u8 timeout) + return -EINVAL; + + id_priv = container_of(id, struct rdma_id_private, id); ++ mutex_lock(&id_priv->qp_mutex); + id_priv->timeout = timeout; + id_priv->timeout_set = true; ++ mutex_unlock(&id_priv->qp_mutex); + + return 0; + } +@@ -3000,8 +3008,11 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv) + + u8 default_roce_tos = id_priv->cma_dev->default_roce_tos[id_priv->id.port_num - + rdma_start_port(id_priv->cma_dev->device)]; +- u8 tos = id_priv->tos_set ? id_priv->tos : default_roce_tos; ++ u8 tos; + ++ mutex_lock(&id_priv->qp_mutex); ++ tos = id_priv->tos_set ? id_priv->tos : default_roce_tos; ++ mutex_unlock(&id_priv->qp_mutex); + + work = kzalloc(sizeof *work, GFP_KERNEL); + if (!work) +@@ -3048,8 +3059,10 @@ static int cma_resolve_iboe_route(struct rdma_id_private *id_priv) + * PacketLifeTime = local ACK timeout/2 + * as a reasonable approximation for RoCE networks. + */ ++ mutex_lock(&id_priv->qp_mutex); + route->path_rec->packet_life_time = id_priv->timeout_set ? + id_priv->timeout - 1 : CMA_IBOE_PACKET_LIFETIME; ++ mutex_unlock(&id_priv->qp_mutex); + + if (!route->path_rec->mtu) { + ret = -EINVAL; +@@ -4073,8 +4086,11 @@ static int cma_connect_iw(struct rdma_id_private *id_priv, + if (IS_ERR(cm_id)) + return PTR_ERR(cm_id); + ++ mutex_lock(&id_priv->qp_mutex); + cm_id->tos = id_priv->tos; + cm_id->tos_set = id_priv->tos_set; ++ mutex_unlock(&id_priv->qp_mutex); ++ + id_priv->cm_id.iw = cm_id; + + memcpy(&cm_id->local_addr, cma_src_addr(id_priv), +-- +2.30.2 + diff --git a/queue-5.12/rdma-core-always-release-restrack-object.patch b/queue-5.12/rdma-core-always-release-restrack-object.patch new file mode 100644 index 00000000000..6bbab492d52 --- /dev/null +++ b/queue-5.12/rdma-core-always-release-restrack-object.patch @@ -0,0 +1,61 @@ +From 8091f15ced9cca63d384d69cda2b7c3a57aa167b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 09:49:33 +0300 +Subject: RDMA/core: Always release restrack object + +From: Leon Romanovsky + +[ Upstream commit 3d8287544223a3d2f37981c1f9ffd94d0b5e9ffc ] + +Change location of rdma_restrack_del() to fix the bug where +task_struct was acquired but not released, causing to resource leak. + + ucma_create_id() { + ucma_alloc_ctx(); + rdma_create_user_id() { + rdma_restrack_new(); + rdma_restrack_set_name() { + rdma_restrack_attach_task.part.0(); <--- task_struct was gotten + } + } + ucma_destroy_private_ctx() { + ucma_put_ctx(); + rdma_destroy_id() { + _destroy_id() <--- id_priv was freed + } + } + } + +Fixes: 889d916b6f8a ("RDMA/core: Don't access cm_id after its destruction") +Link: https://lore.kernel.org/r/073ec27acb943ca8b6961663c47c5abe78a5c8cc.1624948948.git.leonro@nvidia.com +Reported-by: Pavel Skripkin +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 68bbcecb0a6a..bb46f794f324 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1856,6 +1856,7 @@ static void _destroy_id(struct rdma_id_private *id_priv, + { + cma_cancel_operation(id_priv, state); + ++ rdma_restrack_del(&id_priv->res); + if (id_priv->cma_dev) { + if (rdma_cap_ib_cm(id_priv->id.device, 1)) { + if (id_priv->cm_id.ib) +@@ -1865,7 +1866,6 @@ static void _destroy_id(struct rdma_id_private *id_priv, + iw_destroy_cm_id(id_priv->cm_id.iw); + } + cma_leave_mc_groups(id_priv); +- rdma_restrack_del(&id_priv->res); + cma_release_dev(id_priv); + } + +-- +2.30.2 + diff --git a/queue-5.12/rdma-core-sanitize-wq-state-received-from-the-usersp.patch b/queue-5.12/rdma-core-sanitize-wq-state-received-from-the-usersp.patch new file mode 100644 index 00000000000..743dbc1c498 --- /dev/null +++ b/queue-5.12/rdma-core-sanitize-wq-state-received-from-the-usersp.patch @@ -0,0 +1,104 @@ +From 8b4bc64a549f156cbd53d1b6bb772654ad440f99 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 11:37:31 +0300 +Subject: RDMA/core: Sanitize WQ state received from the userspace + +From: Leon Romanovsky + +[ Upstream commit f97442887275d11c88c2899e720fe945c1f61488 ] + +The mlx4 and mlx5 implemented differently the WQ input checks. Instead of +duplicating mlx4 logic in the mlx5, let's prepare the input in the central +place. + +The mlx5 implementation didn't check for validity of state input. It is +not real bug because our FW checked that, but still worth to fix. + +Fixes: f213c0527210 ("IB/uverbs: Add WQ support") +Link: https://lore.kernel.org/r/ac41ad6a81b095b1a8ad453dcf62cf8d3c5da779.1621413310.git.leonro@nvidia.com +Reported-by: Jiapeng Chong +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/uverbs_cmd.c | 21 +++++++++++++++++++-- + drivers/infiniband/hw/mlx4/qp.c | 9 ++------- + drivers/infiniband/hw/mlx5/qp.c | 6 ++---- + 3 files changed, 23 insertions(+), 13 deletions(-) + +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index ab55f8b3190e..92ae454d500a 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -3033,12 +3033,29 @@ static int ib_uverbs_ex_modify_wq(struct uverbs_attr_bundle *attrs) + if (!wq) + return -EINVAL; + +- wq_attr.curr_wq_state = cmd.curr_wq_state; +- wq_attr.wq_state = cmd.wq_state; + if (cmd.attr_mask & IB_WQ_FLAGS) { + wq_attr.flags = cmd.flags; + wq_attr.flags_mask = cmd.flags_mask; + } ++ ++ if (cmd.attr_mask & IB_WQ_CUR_STATE) { ++ if (cmd.curr_wq_state > IB_WQS_ERR) ++ return -EINVAL; ++ ++ wq_attr.curr_wq_state = cmd.curr_wq_state; ++ } else { ++ wq_attr.curr_wq_state = wq->state; ++ } ++ ++ if (cmd.attr_mask & IB_WQ_STATE) { ++ if (cmd.wq_state > IB_WQS_ERR) ++ return -EINVAL; ++ ++ wq_attr.wq_state = cmd.wq_state; ++ } else { ++ wq_attr.wq_state = wq_attr.curr_wq_state; ++ } ++ + ret = wq->device->ops.modify_wq(wq, &wq_attr, cmd.attr_mask, + &attrs->driver_udata); + rdma_lookup_put_uobject(&wq->uobject->uevent.uobject, +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 651785bd57f2..18a47248e444 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -4254,13 +4254,8 @@ int mlx4_ib_modify_wq(struct ib_wq *ibwq, struct ib_wq_attr *wq_attr, + if (wq_attr_mask & IB_WQ_FLAGS) + return -EOPNOTSUPP; + +- cur_state = wq_attr_mask & IB_WQ_CUR_STATE ? wq_attr->curr_wq_state : +- ibwq->state; +- new_state = wq_attr_mask & IB_WQ_STATE ? wq_attr->wq_state : cur_state; +- +- if (cur_state < IB_WQS_RESET || cur_state > IB_WQS_ERR || +- new_state < IB_WQS_RESET || new_state > IB_WQS_ERR) +- return -EINVAL; ++ cur_state = wq_attr->curr_wq_state; ++ new_state = wq_attr->wq_state; + + if ((new_state == IB_WQS_RDY) && (cur_state == IB_WQS_ERR)) + return -EINVAL; +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 843f9e7fe96f..bcaaf238b364 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -5309,10 +5309,8 @@ int mlx5_ib_modify_wq(struct ib_wq *wq, struct ib_wq_attr *wq_attr, + + rqc = MLX5_ADDR_OF(modify_rq_in, in, ctx); + +- curr_wq_state = (wq_attr_mask & IB_WQ_CUR_STATE) ? +- wq_attr->curr_wq_state : wq->state; +- wq_state = (wq_attr_mask & IB_WQ_STATE) ? +- wq_attr->wq_state : curr_wq_state; ++ curr_wq_state = wq_attr->curr_wq_state; ++ wq_state = wq_attr->wq_state; + if (curr_wq_state == IB_WQS_ERR) + curr_wq_state = MLX5_RQC_STATE_ERR; + if (wq_state == IB_WQS_ERR) +-- +2.30.2 + diff --git a/queue-5.12/rdma-hns-fix-uninitialized-variable.patch b/queue-5.12/rdma-hns-fix-uninitialized-variable.patch new file mode 100644 index 00000000000..5a7161acb74 --- /dev/null +++ b/queue-5.12/rdma-hns-fix-uninitialized-variable.patch @@ -0,0 +1,38 @@ +From 31dcc36dae8dd6c2893ca9c4c97ccfbc1ba815af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 18:10:12 +0800 +Subject: RDMA/hns: Fix uninitialized variable + +From: Yixing Liu + +[ Upstream commit 2a38c0f10e6d7d28e06ff1eb1f350804c4850275 ] + +A random value will be returned if the condition below is not met, so it +needs to be initialized. + +Fixes: 9ea9a53ea93b ("RDMA/hns: Add mapped page count checking for MTR") +Link: https://lore.kernel.org/r/1624011020-16992-3-git-send-email-liweihang@huawei.com +Signed-off-by: Yixing Liu +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_mr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c +index 79b3c3023fe7..b8454dcb0318 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_mr.c ++++ b/drivers/infiniband/hw/hns/hns_roce_mr.c +@@ -776,7 +776,7 @@ int hns_roce_mtr_map(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr, + struct ib_device *ibdev = &hr_dev->ib_dev; + struct hns_roce_buf_region *r; + unsigned int i, mapped_cnt; +- int ret; ++ int ret = 0; + + /* + * Only use the first page address as root ba when hopnum is 0, this +-- +2.30.2 + diff --git a/queue-5.12/rdma-hns-force-rewrite-inline-flag-of-wqe.patch b/queue-5.12/rdma-hns-force-rewrite-inline-flag-of-wqe.patch new file mode 100644 index 00000000000..33550b787b6 --- /dev/null +++ b/queue-5.12/rdma-hns-force-rewrite-inline-flag-of-wqe.patch @@ -0,0 +1,47 @@ +From f0dd1796ee57f2a4a592d4e915c2c8b1e03fb526 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 18:10:11 +0800 +Subject: RDMA/hns: Force rewrite inline flag of WQE + +From: Lang Cheng + +[ Upstream commit e13026578b727becf2614f34a4f35e7f0ed21be1 ] + +When a non-inline WR reuses a WQE that was used for inline last time, the +remaining inline flag should be cleared. + +Fixes: 62490fd5a865 ("RDMA/hns: Avoid unnecessary memset on WQEs in post_send") +Link: https://lore.kernel.org/r/1624011020-16992-2-git-send-email-liweihang@huawei.com +Signed-off-by: Lang Cheng +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 3344b80ecf04..851acc9d050f 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -268,8 +268,6 @@ static int set_rc_inl(struct hns_roce_qp *qp, const struct ib_send_wr *wr, + + dseg += sizeof(struct hns_roce_v2_rc_send_wqe); + +- roce_set_bit(rc_sq_wqe->byte_4, V2_RC_SEND_WQE_BYTE_4_INLINE_S, 1); +- + if (msg_len <= HNS_ROCE_V2_MAX_RC_INL_INN_SZ) { + roce_set_bit(rc_sq_wqe->byte_20, + V2_RC_SEND_WQE_BYTE_20_INL_TYPE_S, 0); +@@ -314,6 +312,8 @@ static int set_rwqe_data_seg(struct ib_qp *ibqp, const struct ib_send_wr *wr, + V2_RC_SEND_WQE_BYTE_20_MSG_START_SGE_IDX_S, + (*sge_ind) & (qp->sge.sge_cnt - 1)); + ++ roce_set_bit(rc_sq_wqe->byte_4, V2_RC_SEND_WQE_BYTE_4_INLINE_S, ++ !!(wr->send_flags & IB_SEND_INLINE)); + if (wr->send_flags & IB_SEND_INLINE) + return set_rc_inl(qp, wr, rc_sq_wqe, sge_ind); + +-- +2.30.2 + diff --git a/queue-5.12/rdma-hns-remove-the-condition-of-light-load-for-post.patch b/queue-5.12/rdma-hns-remove-the-condition-of-light-load-for-post.patch new file mode 100644 index 00000000000..28ac41a4e81 --- /dev/null +++ b/queue-5.12/rdma-hns-remove-the-condition-of-light-load-for-post.patch @@ -0,0 +1,40 @@ +From b5cba4135afe36871664f57176a174560100065a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 15:12:30 +0800 +Subject: RDMA/hns: Remove the condition of light load for posting DWQE + +From: Yixian Liu + +[ Upstream commit 591f762b2750c628df9412d1c795b56e83a34b3e ] + +Even in the case of heavy load, direct WQE can still be posted. The +hardware will decide whether to drop the DWQE or not. Thus, the limit +needs to be removed. + +Fixes: 01584a5edcc4 ("RDMA/hns: Add support of direct wqe") +Link: https://lore.kernel.org/r/1619593950-29414-1-git-send-email-liweihang@huawei.com +Signed-off-by: Yixian Liu +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index ad3cee54140e..3344b80ecf04 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -750,8 +750,7 @@ out: + qp->sq.head += nreq; + qp->next_sge = sge_idx; + +- if (nreq == 1 && qp->sq.head == qp->sq.tail + 1 && +- (qp->en_flags & HNS_ROCE_QP_CAP_DIRECT_WQE)) ++ if (nreq == 1 && (qp->en_flags & HNS_ROCE_QP_CAP_DIRECT_WQE)) + write_dwqe(hr_dev, qp, wqe); + else + update_sq_db(hr_dev, qp); +-- +2.30.2 + diff --git a/queue-5.12/rdma-mlx5-don-t-access-null-cleared-mpi-pointer.patch b/queue-5.12/rdma-mlx5-don-t-access-null-cleared-mpi-pointer.patch new file mode 100644 index 00000000000..82f08744f30 --- /dev/null +++ b/queue-5.12/rdma-mlx5-don-t-access-null-cleared-mpi-pointer.patch @@ -0,0 +1,93 @@ +From 18e51280f8cfd0f18358ec62bdc462cac81d3f45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 11:51:38 +0300 +Subject: RDMA/mlx5: Don't access NULL-cleared mpi pointer + +From: Leon Romanovsky + +[ Upstream commit 4a754d7637026b42b0c9ba5787ad5ee3bc2ff77f ] + +The "dev->port[i].mp.mpi" is set to NULL during mlx5_ib_unbind_slave_port() +execution, however that field is needed to add device to unaffiliated list. + +Such flow causes to the following kernel panic while unloading mlx5_ib +module in multi-port mode, hence the device should be added to the list +prior to unbind call. + + RPC: Unregistered rdma transport module. + RPC: Unregistered rdma backchannel transport module. + BUG: kernel NULL pointer dereference, address: 0000000000000000 + #PF: supervisor write access in kernel mode + #PF: error_code(0x0002) - not-present page + PGD 0 P4D 0 + Oops: 0002 [#1] SMP NOPTI + CPU: 4 PID: 1904 Comm: modprobe Not tainted 5.13.0-rc7_for_upstream_min_debug_2021_06_24_12_08 #1 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + RIP: 0010:mlx5_ib_cleanup_multiport_master+0x18b/0x2d0 [mlx5_ib] + Code: 00 04 0f 85 c4 00 00 00 48 89 df e8 ef fa ff ff 48 8b 83 40 0d 00 00 48 8b 15 b9 e8 05 00 4a 8b 44 28 20 48 89 05 ad e8 05 00 <48> c7 00 d0 57 c5 a0 48 89 50 08 48 89 02 39 ab 88 0a 00 00 0f 86 + RSP: 0018:ffff888116ee3df8 EFLAGS: 00010296 + RAX: 0000000000000000 RBX: ffff8881154f6000 RCX: 0000000000000080 + RDX: ffffffffa0c557d0 RSI: ffff88810b69d200 RDI: 000000000002d8a0 + RBP: 0000000000000002 R08: ffff888110780408 R09: 0000000000000000 + R10: ffff88812452e1c0 R11: fffffffffff7e028 R12: 0000000000000000 + R13: 0000000000000080 R14: ffff888102c58000 R15: 0000000000000000 + FS: 00007f884393a740(0000) GS:ffff8882f5a00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 00000001249f6004 CR4: 0000000000370ea0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + mlx5_ib_stage_init_cleanup+0x16/0xd0 [mlx5_ib] + __mlx5_ib_remove+0x33/0x90 [mlx5_ib] + mlx5r_remove+0x22/0x30 [mlx5_ib] + auxiliary_bus_remove+0x18/0x30 + __device_release_driver+0x177/0x220 + driver_detach+0xc4/0x100 + bus_remove_driver+0x58/0xd0 + auxiliary_driver_unregister+0x12/0x20 + mlx5_ib_cleanup+0x13/0x897 [mlx5_ib] + __x64_sys_delete_module+0x154/0x230 + ? exit_to_user_mode_prepare+0x104/0x140 + do_syscall_64+0x3f/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + RIP: 0033:0x7f8842e095c7 + Code: 73 01 c3 48 8b 0d d9 48 2c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d a9 48 2c 00 f7 d8 64 89 01 48 + RSP: 002b:00007ffc68f6e758 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 + RAX: ffffffffffffffda RBX: 00005638207929c0 RCX: 00007f8842e095c7 + RDX: 0000000000000000 RSI: 0000000000000800 RDI: 0000563820792a28 + RBP: 00005638207929c0 R08: 00007ffc68f6d701 R09: 0000000000000000 + R10: 00007f8842e82880 R11: 0000000000000206 R12: 0000563820792a28 + R13: 0000000000000001 R14: 0000563820792a28 R15: 00007ffc68f6fb40 + Modules linked in: xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 br_netfilter overlay rdma_ucm ib_iser libiscsi scsi_transport_iscsi rdma_cm iw_cm ib_ipoib ib_cm ib_umad mlx5_ib(-) mlx4_ib ib_uverbs ib_core mlx4_en mlx4_core mlx5_core ptp pps_core [last unloaded: rpcrdma] + CR2: 0000000000000000 + ---[ end trace a0bb7e20804e9e9b ]--- + +Fixes: 7ce6095e3bff ("RDMA/mlx5: Don't add slave port to unaffiliated list") +Link: https://lore.kernel.org/r/899ac1b33a995be5ec0e16a4765c4e43c2b1ba5b.1624956444.git.leonro@nvidia.com +Reviewed-by: Itay Aveksis +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 21b230096cc1..fc531a506912 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -3539,9 +3539,9 @@ static void mlx5_ib_cleanup_multiport_master(struct mlx5_ib_dev *dev) + dev->port[i].mp.mpi = NULL; + } else { + mlx5_ib_dbg(dev, "unbinding port_num: %d\n", i + 1); +- mlx5_ib_unbind_slave_port(dev, dev->port[i].mp.mpi); + list_add_tail(&dev->port[i].mp.mpi->list, + &mlx5_ib_unaffiliated_port_list); ++ mlx5_ib_unbind_slave_port(dev, dev->port[i].mp.mpi); + } + } + } +-- +2.30.2 + diff --git a/queue-5.12/rdma-mlx5-don-t-add-slave-port-to-unaffiliated-list.patch b/queue-5.12/rdma-mlx5-don-t-add-slave-port-to-unaffiliated-list.patch new file mode 100644 index 00000000000..452163808ea --- /dev/null +++ b/queue-5.12/rdma-mlx5-don-t-add-slave-port-to-unaffiliated-list.patch @@ -0,0 +1,49 @@ +From cce7410a4b2b41bbeeb474da60b7769e7ef73035 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 May 2021 19:04:44 +0300 +Subject: RDMA/mlx5: Don't add slave port to unaffiliated list + +From: Leon Romanovsky + +[ Upstream commit 7ce6095e3bff8e20ce018b050960b527e298f7df ] + +The mlx5_ib_bind_slave_port() doesn't remove multiport device from the +unaffiliated list, but mlx5_ib_unbind_slave_port() did it. This unbalanced +flow caused to the situation where mlx5_ib_unaffiliated_port_list was +changed during iteration. + +Fixes: 32f69e4be269 ("{net, IB}/mlx5: Manage port association for multiport RoCE") +Link: https://lore.kernel.org/r/2726e6603b1e6ecfe76aa5a12a063af72173bcf7.1622477058.git.leonro@nvidia.com +Reported-by: Dan Carpenter +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 59ffbbdda317..21b230096cc1 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -3393,8 +3393,6 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, + + port->mp.mpi = NULL; + +- list_add_tail(&mpi->list, &mlx5_ib_unaffiliated_port_list); +- + spin_unlock(&port->mp.mpi_lock); + + err = mlx5_nic_vport_unaffiliate_multiport(mpi->mdev); +@@ -3542,6 +3540,8 @@ static void mlx5_ib_cleanup_multiport_master(struct mlx5_ib_dev *dev) + } else { + mlx5_ib_dbg(dev, "unbinding port_num: %d\n", i + 1); + mlx5_ib_unbind_slave_port(dev, dev->port[i].mp.mpi); ++ list_add_tail(&dev->port[i].mp.mpi->list, ++ &mlx5_ib_unaffiliated_port_list); + } + } + } +-- +2.30.2 + diff --git a/queue-5.12/rdma-rtrs-clt-check-if-the-queue_depth-has-changed-d.patch b/queue-5.12/rdma-rtrs-clt-check-if-the-queue_depth-has-changed-d.patch new file mode 100644 index 00000000000..613a50acb81 --- /dev/null +++ b/queue-5.12/rdma-rtrs-clt-check-if-the-queue_depth-has-changed-d.patch @@ -0,0 +1,78 @@ +From b423f887489bf3add8f09983ba32ed46b610a22c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 13:30:17 +0200 +Subject: RDMA/rtrs-clt: Check if the queue_depth has changed during a + reconnection + +From: Md Haris Iqbal + +[ Upstream commit 5b73b799c25c68a4703cd6c5ac4518006d9865b8 ] + +The queue_depth is a module parameter for rtrs_server. It is used on the +client side to determing the queue_depth of the request queue for the RNBD +virtual block device. + +During a reconnection event for an already mapped device, in case the +rtrs_server module queue_depth has changed, fail the reconnect attempt. + +Also stop further auto reconnection attempts. A manual reconnect via +sysfs has to be triggerred. + +Fixes: 6a98d71daea18 ("RDMA/rtrs: client: main functionality") +Link: https://lore.kernel.org/r/20210528113018.52290-20-jinpu.wang@ionos.com +Signed-off-by: Md Haris Iqbal +Signed-off-by: Gioh Kim +Signed-off-by: Jack Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index cb6f5c7610a0..1c581c4faacd 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -1716,7 +1716,19 @@ static int rtrs_rdma_conn_established(struct rtrs_clt_con *con, + queue_depth); + return -ECONNRESET; + } +- if (!sess->rbufs || sess->queue_depth < queue_depth) { ++ if (sess->queue_depth > 0 && queue_depth != sess->queue_depth) { ++ rtrs_err(clt, "Error: queue depth changed\n"); ++ ++ /* ++ * Stop any more reconnection attempts ++ */ ++ sess->reconnect_attempts = -1; ++ rtrs_err(clt, ++ "Disabling auto-reconnect. Trigger a manual reconnect after issue is resolved\n"); ++ return -ECONNRESET; ++ } ++ ++ if (!sess->rbufs) { + kfree(sess->rbufs); + sess->rbufs = kcalloc(queue_depth, sizeof(*sess->rbufs), + GFP_KERNEL); +@@ -1730,7 +1742,7 @@ static int rtrs_rdma_conn_established(struct rtrs_clt_con *con, + sess->chunk_size = sess->max_io_size + sess->max_hdr_size; + + /* +- * Global queue depth and IO size is always a minimum. ++ * Global IO size is always a minimum. + * If while a reconnection server sends us a value a bit + * higher - client does not care and uses cached minimum. + * +@@ -1738,8 +1750,7 @@ static int rtrs_rdma_conn_established(struct rtrs_clt_con *con, + * connections in parallel, use lock. + */ + mutex_lock(&clt->paths_mutex); +- clt->queue_depth = min_not_zero(sess->queue_depth, +- clt->queue_depth); ++ clt->queue_depth = sess->queue_depth; + clt->max_io_size = min_not_zero(sess->max_io_size, + clt->max_io_size); + mutex_unlock(&clt->paths_mutex); +-- +2.30.2 + diff --git a/queue-5.12/rdma-rtrs-clt-check-state-of-the-rtrs_clt_sess-befor.patch b/queue-5.12/rdma-rtrs-clt-check-state-of-the-rtrs_clt_sess-befor.patch new file mode 100644 index 00000000000..2d5825b5f84 --- /dev/null +++ b/queue-5.12/rdma-rtrs-clt-check-state-of-the-rtrs_clt_sess-befor.patch @@ -0,0 +1,59 @@ +From 8ca2ca4cb8ced7e381e45eb945e110bb8b493250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 13:30:10 +0200 +Subject: RDMA/rtrs-clt: Check state of the rtrs_clt_sess before reading its + stats + +From: Md Haris Iqbal + +[ Upstream commit 41db63a7efe1c8c2dd282c1849a6ebfbbedbaf67 ] + +When get_next_path_min_inflight is called to select the next path, it +iterates over the list of available rtrs_clt_sess (paths). It then reads +the number of inflight IOs for that path to select one which has the least +inflight IO. + +But it may so happen that rtrs_clt_sess (path) is no longer in the +connected state because closing or error recovery paths can change the status +of the rtrs_clt_Sess. + +For example, the client sent the heart-beat and did not get the +response, it would change the session status and stop IO processing. +The added checking of this patch can prevent accessing the broken path +and generating duplicated error messages. + +It is ok if the status is changed after checking the status because +the error recovery path does not free memory and only tries to +reconnection. And also it is ok if the session is closed after checking +the status because closing the session changes the session status and +flush all IO beforing free memory. If the session is being accessed for +IO processing, the closing session will wait. + +Fixes: 6a98d71daea18 ("RDMA/rtrs: client: main functionality") +Link: https://lore.kernel.org/r/20210528113018.52290-13-jinpu.wang@ionos.com +Signed-off-by: Md Haris Iqbal +Reviewed-by: Gioh Kim +Signed-off-by: Gioh Kim +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 959ba0462ef0..cb6f5c7610a0 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -805,6 +805,9 @@ static struct rtrs_clt_sess *get_next_path_min_inflight(struct path_it *it) + int inflight; + + list_for_each_entry_rcu(sess, &clt->paths_list, s.entry) { ++ if (unlikely(READ_ONCE(sess->state) != RTRS_CLT_CONNECTED)) ++ continue; ++ + if (unlikely(!list_empty(raw_cpu_ptr(sess->mp_skip_entry)))) + continue; + +-- +2.30.2 + diff --git a/queue-5.12/rdma-rtrs-clt-fix-memory-leak-of-not-freed-sess-stat.patch b/queue-5.12/rdma-rtrs-clt-fix-memory-leak-of-not-freed-sess-stat.patch new file mode 100644 index 00000000000..586b4090a49 --- /dev/null +++ b/queue-5.12/rdma-rtrs-clt-fix-memory-leak-of-not-freed-sess-stat.patch @@ -0,0 +1,64 @@ +From 66c3c7656cd8136b0310182f53b441f9afa7fda8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 13:30:18 +0200 +Subject: RDMA/rtrs-clt: Fix memory leak of not-freed sess->stats and + stats->pcpu_stats + +From: Gioh Kim + +[ Upstream commit 7ecd7e290bee0ab9cf75b79a367a4cc113cf8292 ] + +sess->stats and sess->stats->pcpu_stats objects are freed +when sysfs entry is removed. If something wrong happens and +session is closed before sysfs entry is created, +sess->stats and sess->stats->pcpu_stats objects are not freed. + +This patch adds freeing of them at three places: +1. When client uses wrong address and session creation fails. +2. When client fails to create a sysfs entry. +3. When client adds wrong address via sysfs add_path. + +Fixes: 215378b838df0 ("RDMA/rtrs: client: sysfs interface functions") +Link: https://lore.kernel.org/r/20210528113018.52290-21-jinpu.wang@ionos.com +Signed-off-by: Gioh Kim +Signed-off-by: Jack Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-clt.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +index 1c581c4faacd..49d12dd4a503 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c +@@ -2689,6 +2689,8 @@ struct rtrs_clt *rtrs_clt_open(struct rtrs_clt_ops *ops, + if (err) { + list_del_rcu(&sess->s.entry); + rtrs_clt_close_conns(sess, true); ++ free_percpu(sess->stats->pcpu_stats); ++ kfree(sess->stats); + free_sess(sess); + goto close_all_sess; + } +@@ -2697,6 +2699,8 @@ struct rtrs_clt *rtrs_clt_open(struct rtrs_clt_ops *ops, + if (err) { + list_del_rcu(&sess->s.entry); + rtrs_clt_close_conns(sess, true); ++ free_percpu(sess->stats->pcpu_stats); ++ kfree(sess->stats); + free_sess(sess); + goto close_all_sess; + } +@@ -2954,6 +2958,8 @@ int rtrs_clt_create_path_from_sysfs(struct rtrs_clt *clt, + close_sess: + rtrs_clt_remove_path_from_arr(sess); + rtrs_clt_close_conns(sess, true); ++ free_percpu(sess->stats->pcpu_stats); ++ kfree(sess->stats); + free_sess(sess); + + return err; +-- +2.30.2 + diff --git a/queue-5.12/rdma-rtrs-do-not-reset-hb_missed_max-after-re-connec.patch b/queue-5.12/rdma-rtrs-do-not-reset-hb_missed_max-after-re-connec.patch new file mode 100644 index 00000000000..5dc0776e0fe --- /dev/null +++ b/queue-5.12/rdma-rtrs-do-not-reset-hb_missed_max-after-re-connec.patch @@ -0,0 +1,43 @@ +From 9d0e6b2cdc6406f87b60c6a5d3d3a56fdef93d08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 13:30:13 +0200 +Subject: RDMA/rtrs: Do not reset hb_missed_max after re-connection + +From: Gioh Kim + +[ Upstream commit 64bce1ee978491a779eb31098b21c57d4e431d6a ] + +When re-connecting, it resets hb_missed_max to 0. +Before the first re-connecting, client will trigger re-connection +when it gets hb-ack more than 5 times. But after the first +re-connecting, clients will do re-connection whenever it does +not get hb-ack because hb_missed_max is 0. + +There is no need to reset hb_missed_max when re-connecting. +hb_missed_max should be kept until closing the session. + +Fixes: c0894b3ea69d3 ("RDMA/rtrs: core: lib functions shared between client and server modules") +Link: https://lore.kernel.org/r/20210528113018.52290-16-jinpu.wang@ionos.com +Signed-off-by: Gioh Kim +Signed-off-by: Jack Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs.c b/drivers/infiniband/ulp/rtrs/rtrs.c +index d13aff0aa816..4629bb758126 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs.c +@@ -373,7 +373,6 @@ void rtrs_stop_hb(struct rtrs_sess *sess) + { + cancel_delayed_work_sync(&sess->hb_dwork); + sess->hb_missed_cnt = 0; +- sess->hb_missed_max = 0; + } + EXPORT_SYMBOL_GPL(rtrs_stop_hb); + +-- +2.30.2 + diff --git a/queue-5.12/rdma-rtrs-srv-fix-memory-leak-of-unfreed-rtrs_srv_st.patch b/queue-5.12/rdma-rtrs-srv-fix-memory-leak-of-unfreed-rtrs_srv_st.patch new file mode 100644 index 00000000000..04cc81e1530 --- /dev/null +++ b/queue-5.12/rdma-rtrs-srv-fix-memory-leak-of-unfreed-rtrs_srv_st.patch @@ -0,0 +1,69 @@ +From 1f5f0b06587f4cbbf1aed8712abf38e3fef967ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 13:30:15 +0200 +Subject: RDMA/rtrs-srv: Fix memory leak of unfreed rtrs_srv_stats object + +From: Gioh Kim + +[ Upstream commit 2371c40354509746e4a4dad09a752e027a30f148 ] + +When closing a session, currently the rtrs_srv_stats object in the +closing session is freed by kobject release. But if it failed +to create a session by various reasons, it must free the rtrs_srv_stats +object directly because kobject is not created yet. + +This problem is found by kmemleak as below: + +1. One client machine maps /dev/nullb0 with session name 'bla': +root@test1:~# echo "sessname=bla path=ip:192.168.122.190 \ +device_path=/dev/nullb0" > /sys/devices/virtual/rnbd-client/ctl/map_device + +2. Another machine failed to create a session with the same name 'bla': +root@test2:~# echo "sessname=bla path=ip:192.168.122.190 \ +device_path=/dev/nullb1" > /sys/devices/virtual/rnbd-client/ctl/map_device +-bash: echo: write error: Connection reset by peer + +3. The kmemleak on server machine reported an error: +unreferenced object 0xffff888033cdc800 (size 128): + comm "kworker/2:1", pid 83, jiffies 4295086585 (age 2508.680s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000a72903b2>] __alloc_sess+0x1d4/0x1250 [rtrs_server] + [<00000000d1e5321e>] rtrs_srv_rdma_cm_handler+0xc31/0xde0 [rtrs_server] + [<00000000bb2f6e7e>] cma_ib_req_handler+0xdc5/0x2b50 [rdma_cm] + [<00000000e896235d>] cm_process_work+0x2d/0x100 [ib_cm] + [<00000000b6866c5f>] cm_req_handler+0x11bc/0x1c40 [ib_cm] + [<000000005f5dd9aa>] cm_work_handler+0xe65/0x3cf2 [ib_cm] + [<00000000610151e7>] process_one_work+0x4bc/0x980 + [<00000000541e0f77>] worker_thread+0x78/0x5c0 + [<00000000423898ca>] kthread+0x191/0x1e0 + [<000000005a24b239>] ret_from_fork+0x3a/0x50 + +Fixes: 39c2d639ca183 ("RDMA/rtrs-srv: Set .release function for rtrs srv device during device init") +Link: https://lore.kernel.org/r/20210528113018.52290-18-jinpu.wang@ionos.com +Signed-off-by: Gioh Kim +Signed-off-by: Md Haris Iqbal +Signed-off-by: Jack Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +index d071809e3ed2..8c0acfc48392 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +@@ -1477,6 +1477,7 @@ static void free_sess(struct rtrs_srv_sess *sess) + kobject_del(&sess->kobj); + kobject_put(&sess->kobj); + } else { ++ kfree(sess->stats); + kfree(sess); + } + } +-- +2.30.2 + diff --git a/queue-5.12/rdma-rtrs-srv-fix-memory-leak-when-having-multiple-s.patch b/queue-5.12/rdma-rtrs-srv-fix-memory-leak-when-having-multiple-s.patch new file mode 100644 index 00000000000..9e3f4faf0ff --- /dev/null +++ b/queue-5.12/rdma-rtrs-srv-fix-memory-leak-when-having-multiple-s.patch @@ -0,0 +1,88 @@ +From 001b6f1868cfb35c2c92e97de299f3df71f399a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 13:30:16 +0200 +Subject: RDMA/rtrs-srv: Fix memory leak when having multiple sessions + +From: Jack Wang + +[ Upstream commit 6bb97a2c1aa5278a30d49abb6186d50c34c207e2 ] + +Gioh notice memory leak below +unreferenced object 0xffff8880acda2000 (size 2048): + comm "kworker/4:1", pid 77, jiffies 4295062871 (age 1270.730s) + hex dump (first 32 bytes): + 00 20 da ac 80 88 ff ff 00 20 da ac 80 88 ff ff . ....... ...... + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000e85d85b5>] rtrs_srv_rdma_cm_handler+0x8e5/0xa90 [rtrs_server] + [<00000000e31a988a>] cma_ib_req_handler+0xdc5/0x2b50 [rdma_cm] + [<000000000eb02c5b>] cm_process_work+0x2d/0x100 [ib_cm] + [<00000000e1650ca9>] cm_req_handler+0x11bc/0x1c40 [ib_cm] + [<000000009c28818b>] cm_work_handler+0xe65/0x3cf2 [ib_cm] + [<000000002b53eaa1>] process_one_work+0x4bc/0x980 + [<00000000da3499fb>] worker_thread+0x78/0x5c0 + [<00000000167127a4>] kthread+0x191/0x1e0 + [<0000000060802104>] ret_from_fork+0x3a/0x50 +unreferenced object 0xffff88806d595d90 (size 8): + comm "kworker/4:1H", pid 131, jiffies 4295062972 (age 1269.720s) + hex dump (first 8 bytes): + 62 6c 61 00 6b 6b 6b a5 bla.kkk. + backtrace: + [<000000004447d253>] kstrdup+0x2e/0x60 + [<0000000047259793>] kobject_set_name_vargs+0x2f/0xb0 + [<00000000c2ee3bc8>] dev_set_name+0xab/0xe0 + [<000000002b6bdfb1>] rtrs_srv_create_sess_files+0x260/0x290 [rtrs_server] + [<0000000075d87bd7>] rtrs_srv_info_req_done+0x71b/0x960 [rtrs_server] + [<00000000ccdf1bb5>] __ib_process_cq+0x94/0x100 [ib_core] + [<00000000cbcb60cb>] ib_cq_poll_work+0x32/0xc0 [ib_core] + [<000000002b53eaa1>] process_one_work+0x4bc/0x980 + [<00000000da3499fb>] worker_thread+0x78/0x5c0 + [<00000000167127a4>] kthread+0x191/0x1e0 + [<0000000060802104>] ret_from_fork+0x3a/0x50 +unreferenced object 0xffff88806d6bb100 (size 256): + comm "kworker/4:1H", pid 131, jiffies 4295062972 (age 1269.720s) + hex dump (first 32 bytes): + 00 00 00 00 ad 4e ad de ff ff ff ff 00 00 00 00 .....N.......... + ff ff ff ff ff ff ff ff 00 59 4d 86 ff ff ff ff .........YM..... + backtrace: + [<00000000a18a11e4>] device_add+0x74d/0xa00 + [<00000000a915b95f>] rtrs_srv_create_sess_files.cold+0x49/0x1fe [rtrs_server] + [<0000000075d87bd7>] rtrs_srv_info_req_done+0x71b/0x960 [rtrs_server] + [<00000000ccdf1bb5>] __ib_process_cq+0x94/0x100 [ib_core] + [<00000000cbcb60cb>] ib_cq_poll_work+0x32/0xc0 [ib_core] + [<000000002b53eaa1>] process_one_work+0x4bc/0x980 + [<00000000da3499fb>] worker_thread+0x78/0x5c0 + [<00000000167127a4>] kthread+0x191/0x1e0 + [<0000000060802104>] ret_from_fork+0x3a/0x50 + +The problem is we increase device refcount by get_device in process_info_req +for each path, but only does put_deice for last path, which lead to +memory leak. + +To fix it, it also calls put_device when dev_ref is not 0. + +Fixes: e2853c49477d1 ("RDMA/rtrs-srv-sysfs: fix missing put_device") +Link: https://lore.kernel.org/r/20210528113018.52290-19-jinpu.wang@ionos.com +Signed-off-by: Gioh Kim +Signed-off-by: Jack Wang +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c +index 126a96e75c62..e499f64ae608 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv-sysfs.c +@@ -211,6 +211,7 @@ rtrs_srv_destroy_once_sysfs_root_folders(struct rtrs_srv_sess *sess) + device_del(&srv->dev); + put_device(&srv->dev); + } else { ++ put_device(&srv->dev); + mutex_unlock(&srv->paths_mutex); + } + } +-- +2.30.2 + diff --git a/queue-5.12/rdma-rtrs-srv-set-minimal-max_send_wr-and-max_recv_w.patch b/queue-5.12/rdma-rtrs-srv-set-minimal-max_send_wr-and-max_recv_w.patch new file mode 100644 index 00000000000..7be4675d550 --- /dev/null +++ b/queue-5.12/rdma-rtrs-srv-set-minimal-max_send_wr-and-max_recv_w.patch @@ -0,0 +1,107 @@ +From 8493ca16b3a9d8576c22b454ea9cba81dd659b76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 11:03:33 +0200 +Subject: RDMA/rtrs-srv: Set minimal max_send_wr and max_recv_wr + +From: Jack Wang + +[ Upstream commit 5e91eabf66c854f16ca2e954e5c68939bc81601e ] + +Currently rtrs when create_qp use a coarse numbers (bigger in general), +which leads to hardware create more resources which only waste memory with +no benefits. + +For max_send_wr, we don't really need alway max_qp_wr size when creating +qp, reduce it to cq_size. + +For max_recv_wr, cq_size is enough. + +With the patch when sess_queue_depth=128, per session (2 paths) memory +consumption reduced from 188 MB to 65MB + +When always_invalidate is enabled, we need send more wr, so treat it +special. + +Fixes: 9cb837480424e ("RDMA/rtrs: server: main functionality") +Link: https://lore.kernel.org/r/20210614090337.29557-2-jinpu.wang@ionos.com +Signed-off-by: Jack Wang +Reviewed-by: Md Haris Iqbal +Signed-off-by: Gioh Kim +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 38 +++++++++++++++++--------- + 1 file changed, 25 insertions(+), 13 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +index 8c0acfc48392..57a9d396ab75 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +@@ -1601,7 +1601,7 @@ static int create_con(struct rtrs_srv_sess *sess, + struct rtrs_sess *s = &sess->s; + struct rtrs_srv_con *con; + +- u32 cq_size, wr_queue_size; ++ u32 cq_size, max_send_wr, max_recv_wr, wr_limit; + int err, cq_vector; + + con = kzalloc(sizeof(*con), GFP_KERNEL); +@@ -1622,30 +1622,42 @@ static int create_con(struct rtrs_srv_sess *sess, + * All receive and all send (each requiring invalidate) + * + 2 for drain and heartbeat + */ +- wr_queue_size = SERVICE_CON_QUEUE_DEPTH * 3 + 2; +- cq_size = wr_queue_size; ++ max_send_wr = SERVICE_CON_QUEUE_DEPTH * 2 + 2; ++ max_recv_wr = SERVICE_CON_QUEUE_DEPTH + 2; ++ cq_size = max_send_wr + max_recv_wr; + } else { +- /* +- * If we have all receive requests posted and +- * all write requests posted and each read request +- * requires an invalidate request + drain +- * and qp gets into error state. +- */ +- cq_size = srv->queue_depth * 3 + 1; + /* + * In theory we might have queue_depth * 32 + * outstanding requests if an unsafe global key is used + * and we have queue_depth read requests each consisting + * of 32 different addresses. div 3 for mlx5. + */ +- wr_queue_size = sess->s.dev->ib_dev->attrs.max_qp_wr / 3; ++ wr_limit = sess->s.dev->ib_dev->attrs.max_qp_wr / 3; ++ /* when always_invlaidate enalbed, we need linv+rinv+mr+imm */ ++ if (always_invalidate) ++ max_send_wr = ++ min_t(int, wr_limit, ++ srv->queue_depth * (1 + 4) + 1); ++ else ++ max_send_wr = ++ min_t(int, wr_limit, ++ srv->queue_depth * (1 + 2) + 1); ++ ++ max_recv_wr = srv->queue_depth + 1; ++ /* ++ * If we have all receive requests posted and ++ * all write requests posted and each read request ++ * requires an invalidate request + drain ++ * and qp gets into error state. ++ */ ++ cq_size = max_send_wr + max_recv_wr; + } +- atomic_set(&con->sq_wr_avail, wr_queue_size); ++ atomic_set(&con->sq_wr_avail, max_send_wr); + cq_vector = rtrs_srv_get_next_cq_vector(sess); + + /* TODO: SOFTIRQ can be faster, but be careful with softirq context */ + err = rtrs_cq_qp_create(&sess->s, &con->c, 1, cq_vector, cq_size, +- wr_queue_size, wr_queue_size, ++ max_send_wr, max_recv_wr, + IB_POLL_WORKQUEUE); + if (err) { + rtrs_err(s, "rtrs_cq_qp_create(), err: %d\n", err); +-- +2.30.2 + diff --git a/queue-5.12/rdma-rxe-fix-failure-during-driver-load.patch b/queue-5.12/rdma-rxe-fix-failure-during-driver-load.patch new file mode 100644 index 00000000000..00dd47453f4 --- /dev/null +++ b/queue-5.12/rdma-rxe-fix-failure-during-driver-load.patch @@ -0,0 +1,58 @@ +From 6e8f4b5cecc6d0ed8d25c6471c62913389fb7af3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 12:01:12 +0300 +Subject: RDMA/rxe: Fix failure during driver load + +From: Kamal Heib + +[ Upstream commit 32a25f2ea690dfaace19f7a3a916f5d7e1ddafe8 ] + +To avoid the following failure when trying to load the rdma_rxe module +while IPv6 is disabled, add a check for EAFNOSUPPORT and ignore the +failure, also delete the needless debug print from rxe_setup_udp_tunnel(). + +$ modprobe rdma_rxe +modprobe: ERROR: could not insert 'rdma_rxe': Operation not permitted + +Fixes: dfdd6158ca2c ("IB/rxe: Fix kernel panic in udp_setup_tunnel") +Link: https://lore.kernel.org/r/20210603090112.36341-1-kamalheib1@gmail.com +Reported-by: Yi Zhang +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_net.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c +index 01662727dca0..fc1ba4904279 100644 +--- a/drivers/infiniband/sw/rxe/rxe_net.c ++++ b/drivers/infiniband/sw/rxe/rxe_net.c +@@ -207,10 +207,8 @@ static struct socket *rxe_setup_udp_tunnel(struct net *net, __be16 port, + + /* Create UDP socket */ + err = udp_sock_create(net, &udp_cfg, &sock); +- if (err < 0) { +- pr_err("failed to create udp socket. err = %d\n", err); ++ if (err < 0) + return ERR_PTR(err); +- } + + tnl_cfg.encap_type = 1; + tnl_cfg.encap_rcv = rxe_udp_encap_recv; +@@ -619,6 +617,12 @@ static int rxe_net_ipv6_init(void) + + recv_sockets.sk6 = rxe_setup_udp_tunnel(&init_net, + htons(ROCE_V2_UDP_DPORT), true); ++ if (PTR_ERR(recv_sockets.sk6) == -EAFNOSUPPORT) { ++ recv_sockets.sk6 = NULL; ++ pr_warn("IPv6 is not supported, can not create a UDPv6 socket\n"); ++ return 0; ++ } ++ + if (IS_ERR(recv_sockets.sk6)) { + recv_sockets.sk6 = NULL; + pr_err("Failed to create IPv6 UDP tunnel\n"); +-- +2.30.2 + diff --git a/queue-5.12/rdma-rxe-fix-qp-reference-counting-for-atomic-ops.patch b/queue-5.12/rdma-rxe-fix-qp-reference-counting-for-atomic-ops.patch new file mode 100644 index 00000000000..1fdd5cb4474 --- /dev/null +++ b/queue-5.12/rdma-rxe-fix-qp-reference-counting-for-atomic-ops.patch @@ -0,0 +1,60 @@ +From e7f76dc6b01b0d07abfaa926070925aaa6f05446 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 18:05:59 -0500 +Subject: RDMA/rxe: Fix qp reference counting for atomic ops + +From: Bob Pearson + +[ Upstream commit 15ae1375ea91ae2dee6f12d71a79d8c0a10a30bf ] + +Currently the rdma_rxe driver attempts to protect atomic responder +resources by taking a reference to the qp which is only freed when the +resource is recycled for a new read or atomic operation. This means that +in normal circumstances there is almost always an extra qp reference once +an atomic operation has been executed which prevents cleaning up the qp +and associated pd and cqs when the qp is destroyed. + +This patch removes the call to rxe_add_ref() in send_atomic_ack() and the +call to rxe_drop_ref() in free_rd_atomic_resource(). If the qp is +destroyed while a peer is retrying an atomic op it will cause the +operation to fail which is acceptable. + +Link: https://lore.kernel.org/r/20210604230558.4812-1-rpearsonhpe@gmail.com +Reported-by: Zhu Yanjun +Fixes: 86af61764151 ("IB/rxe: remove unnecessary skb_clone") +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_qp.c | 1 - + drivers/infiniband/sw/rxe/rxe_resp.c | 2 -- + 2 files changed, 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c +index b0f350d674fd..93a41ebda1a8 100644 +--- a/drivers/infiniband/sw/rxe/rxe_qp.c ++++ b/drivers/infiniband/sw/rxe/rxe_qp.c +@@ -136,7 +136,6 @@ static void free_rd_atomic_resources(struct rxe_qp *qp) + void free_rd_atomic_resource(struct rxe_qp *qp, struct resp_res *res) + { + if (res->type == RXE_ATOMIC_MASK) { +- rxe_drop_ref(qp); + kfree_skb(res->atomic.skb); + } else if (res->type == RXE_READ_MASK) { + if (res->read.mr) +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index 8e237b623b31..ae97bebc0f34 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -966,8 +966,6 @@ static int send_atomic_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt, + goto out; + } + +- rxe_add_ref(qp); +- + res = &qp->resp.resources[qp->resp.res_head]; + free_rd_atomic_resource(qp, res); + rxe_advance_resp_resource(qp); +-- +2.30.2 + diff --git a/queue-5.12/rdma-srp-fix-a-recently-introduced-memory-leak.patch b/queue-5.12/rdma-srp-fix-a-recently-introduced-memory-leak.patch new file mode 100644 index 00000000000..87827118298 --- /dev/null +++ b/queue-5.12/rdma-srp-fix-a-recently-introduced-memory-leak.patch @@ -0,0 +1,56 @@ +From 21f5718771f0d7f16474b93358bdf4d558c53025 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 May 2021 21:12:10 -0700 +Subject: RDMA/srp: Fix a recently introduced memory leak + +From: Bart Van Assche + +[ Upstream commit 7ec2e27a3afff64c96bfe7a77685c33619db84be ] + +Only allocate a memory registration list if it will be used and if it will +be freed. + +Link: https://lore.kernel.org/r/20210524041211.9480-5-bvanassche@acm.org +Reviewed-by: Max Gurtovoy +Fixes: f273ad4f8d90 ("RDMA/srp: Remove support for FMR memory registration") +Signed-off-by: Bart Van Assche +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/srp/ib_srp.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 31f8aa2c40ed..168705c88e2f 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -998,7 +998,6 @@ static int srp_alloc_req_data(struct srp_rdma_ch *ch) + struct srp_device *srp_dev = target->srp_host->srp_dev; + struct ib_device *ibdev = srp_dev->dev; + struct srp_request *req; +- void *mr_list; + dma_addr_t dma_addr; + int i, ret = -ENOMEM; + +@@ -1009,12 +1008,12 @@ static int srp_alloc_req_data(struct srp_rdma_ch *ch) + + for (i = 0; i < target->req_ring_size; ++i) { + req = &ch->req_ring[i]; +- mr_list = kmalloc_array(target->mr_per_cmd, sizeof(void *), +- GFP_KERNEL); +- if (!mr_list) +- goto out; +- if (srp_dev->use_fast_reg) +- req->fr_list = mr_list; ++ if (srp_dev->use_fast_reg) { ++ req->fr_list = kmalloc_array(target->mr_per_cmd, ++ sizeof(void *), GFP_KERNEL); ++ if (!req->fr_list) ++ goto out; ++ } + req->indirect_desc = kmalloc(target->indirect_size, GFP_KERNEL); + if (!req->indirect_desc) + goto out; +-- +2.30.2 + diff --git a/queue-5.12/regulator-da9052-ensure-enough-delay-time-for-.set_v.patch b/queue-5.12/regulator-da9052-ensure-enough-delay-time-for-.set_v.patch new file mode 100644 index 00000000000..dd25cac6667 --- /dev/null +++ b/queue-5.12/regulator-da9052-ensure-enough-delay-time-for-.set_v.patch @@ -0,0 +1,39 @@ +From 5e146eb7838ed96660d3c06807b67d9ac1596229 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 22:14:11 +0800 +Subject: regulator: da9052: Ensure enough delay time for .set_voltage_time_sel + +From: Axel Lin + +[ Upstream commit a336dc8f683e5be794186b5643cd34cb28dd2c53 ] + +Use DIV_ROUND_UP to prevent truncation by integer division issue. +This ensures we return enough delay time. + +Also fix returning negative value when new_sel < old_sel. + +Signed-off-by: Axel Lin +Link: https://lore.kernel.org/r/20210618141412.4014912-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/da9052-regulator.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c +index e18d291c7f21..23fa429ebe76 100644 +--- a/drivers/regulator/da9052-regulator.c ++++ b/drivers/regulator/da9052-regulator.c +@@ -250,7 +250,8 @@ static int da9052_regulator_set_voltage_time_sel(struct regulator_dev *rdev, + case DA9052_ID_BUCK3: + case DA9052_ID_LDO2: + case DA9052_ID_LDO3: +- ret = (new_sel - old_sel) * info->step_uV / 6250; ++ ret = DIV_ROUND_UP(abs(new_sel - old_sel) * info->step_uV, ++ 6250); + break; + } + +-- +2.30.2 + diff --git a/queue-5.12/regulator-fan53880-fix-vsel_mask-setting-for-fan5388.patch b/queue-5.12/regulator-fan53880-fix-vsel_mask-setting-for-fan5388.patch new file mode 100644 index 00000000000..11d60b44bd0 --- /dev/null +++ b/queue-5.12/regulator-fan53880-fix-vsel_mask-setting-for-fan5388.patch @@ -0,0 +1,42 @@ +From d09e45e6bd3f50e62d46c5e4634da139418f6fe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 22:29:07 +0800 +Subject: regulator: fan53880: Fix vsel_mask setting for FAN53880_BUCK +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Axel Lin + +[ Upstream commit 2e11737a772b95c6587df73f216eec1762431432 ] + +According to the datasheet: +REGISTER DETAILS − 0x02 BUCK, BUCK_OUT is BIT0 ~ BIT7. + +So vsel_mask for FAN53880_BUCK should be 0xFF. + +Fixes: e6dea51e2d41 ("regulator: fan53880: Add initial support") +Signed-off-by: Axel Lin +Link: https://lore.kernel.org/r/20210607142907.1599905-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/fan53880.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/fan53880.c b/drivers/regulator/fan53880.c +index 1684faf82ed2..94f02f3099dd 100644 +--- a/drivers/regulator/fan53880.c ++++ b/drivers/regulator/fan53880.c +@@ -79,7 +79,7 @@ static const struct regulator_desc fan53880_regulators[] = { + .n_linear_ranges = 2, + .n_voltages = 0xf8, + .vsel_reg = FAN53880_BUCKVOUT, +- .vsel_mask = 0x7f, ++ .vsel_mask = 0xff, + .enable_reg = FAN53880_ENABLE, + .enable_mask = 0x10, + .enable_time = 480, +-- +2.30.2 + diff --git a/queue-5.12/regulator-hi6421v600-fix-setting-idle-mode.patch b/queue-5.12/regulator-hi6421v600-fix-setting-idle-mode.patch new file mode 100644 index 00000000000..2d7ae1ed70a --- /dev/null +++ b/queue-5.12/regulator-hi6421v600-fix-setting-idle-mode.patch @@ -0,0 +1,64 @@ +From d33e877cd147e04e5cb64d47bbc08305bb0fe543 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 20:34:23 +0800 +Subject: regulator: hi6421v600: Fix setting idle mode + +From: Axel Lin + +[ Upstream commit 57c045bc727001c43b6a65adb0418aa7b3e6dbd0 ] + +commit db27f8294cd7 changed eco_mode << (ffs(sreg->eco_mode_mask) - 1) +to sreg->eco_mode_mask << (ffs(sreg->eco_mode_mask) - 1) which is wrong. +Fix it by simply set val = sreg->eco_mode_mask. + +In additional, sreg->eco_mode_mask can be 0 (LDO3, LDO33, LDO34). +Return -EINVAL if idle mode is not supported when sreg->eco_mode_mask is 0. + +While at it, also use unsigned int for reg_val/val which is the expected +type for regmap_read and regmap_update_bits. + +Fixes: db27f8294cd7 ("staging: regulator: hi6421v600-regulator: use shorter names for OF properties") +Signed-off-by: Axel Lin +Link: https://lore.kernel.org/r/20210619123423.4091429-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/staging/hikey9xx/hi6421v600-regulator.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/hikey9xx/hi6421v600-regulator.c b/drivers/staging/hikey9xx/hi6421v600-regulator.c +index e10fe3058176..91136db3961e 100644 +--- a/drivers/staging/hikey9xx/hi6421v600-regulator.c ++++ b/drivers/staging/hikey9xx/hi6421v600-regulator.c +@@ -129,7 +129,7 @@ static unsigned int hi6421_spmi_regulator_get_mode(struct regulator_dev *rdev) + { + struct hi6421_spmi_reg_info *sreg = rdev_get_drvdata(rdev); + struct hi6421_spmi_pmic *pmic = sreg->pmic; +- u32 reg_val; ++ unsigned int reg_val; + + regmap_read(pmic->regmap, rdev->desc->enable_reg, ®_val); + +@@ -144,14 +144,17 @@ static int hi6421_spmi_regulator_set_mode(struct regulator_dev *rdev, + { + struct hi6421_spmi_reg_info *sreg = rdev_get_drvdata(rdev); + struct hi6421_spmi_pmic *pmic = sreg->pmic; +- u32 val; ++ unsigned int val; + + switch (mode) { + case REGULATOR_MODE_NORMAL: + val = 0; + break; + case REGULATOR_MODE_IDLE: +- val = sreg->eco_mode_mask << (ffs(sreg->eco_mode_mask) - 1); ++ if (!sreg->eco_mode_mask) ++ return -EINVAL; ++ ++ val = sreg->eco_mode_mask; + break; + default: + return -EINVAL; +-- +2.30.2 + diff --git a/queue-5.12/regulator-hi655x-fix-pass-wrong-pointer-to-config.dr.patch b/queue-5.12/regulator-hi655x-fix-pass-wrong-pointer-to-config.dr.patch new file mode 100644 index 00000000000..afe19a632db --- /dev/null +++ b/queue-5.12/regulator-hi655x-fix-pass-wrong-pointer-to-config.dr.patch @@ -0,0 +1,80 @@ +From 7692153c9ee5def7e480b7d9d02433560dcca226 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Jun 2021 21:27:15 +0800 +Subject: regulator: hi655x: Fix pass wrong pointer to config.driver_data + +From: Axel Lin + +[ Upstream commit 61eb1b24f9e4f4e0725aa5f8164a932c933f3339 ] + +Current code sets config.driver_data to a zero initialized regulator +which is obviously wrong. Fix it. + +Fixes: 4618119b9be5 ("regulator: hi655x: enable regulator for hi655x PMIC") +Signed-off-by: Axel Lin +Link: https://lore.kernel.org/r/20210620132715.60215-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/hi655x-regulator.c | 16 +++++----------- + 1 file changed, 5 insertions(+), 11 deletions(-) + +diff --git a/drivers/regulator/hi655x-regulator.c b/drivers/regulator/hi655x-regulator.c +index ac2ee2030211..b44f492a2b83 100644 +--- a/drivers/regulator/hi655x-regulator.c ++++ b/drivers/regulator/hi655x-regulator.c +@@ -72,7 +72,7 @@ enum hi655x_regulator_id { + static int hi655x_is_enabled(struct regulator_dev *rdev) + { + unsigned int value = 0; +- struct hi655x_regulator *regulator = rdev_get_drvdata(rdev); ++ const struct hi655x_regulator *regulator = rdev_get_drvdata(rdev); + + regmap_read(rdev->regmap, regulator->status_reg, &value); + return (value & rdev->desc->enable_mask); +@@ -80,7 +80,7 @@ static int hi655x_is_enabled(struct regulator_dev *rdev) + + static int hi655x_disable(struct regulator_dev *rdev) + { +- struct hi655x_regulator *regulator = rdev_get_drvdata(rdev); ++ const struct hi655x_regulator *regulator = rdev_get_drvdata(rdev); + + return regmap_write(rdev->regmap, regulator->disable_reg, + rdev->desc->enable_mask); +@@ -169,7 +169,6 @@ static const struct hi655x_regulator regulators[] = { + static int hi655x_regulator_probe(struct platform_device *pdev) + { + unsigned int i; +- struct hi655x_regulator *regulator; + struct hi655x_pmic *pmic; + struct regulator_config config = { }; + struct regulator_dev *rdev; +@@ -180,22 +179,17 @@ static int hi655x_regulator_probe(struct platform_device *pdev) + return -ENODEV; + } + +- regulator = devm_kzalloc(&pdev->dev, sizeof(*regulator), GFP_KERNEL); +- if (!regulator) +- return -ENOMEM; +- +- platform_set_drvdata(pdev, regulator); +- + config.dev = pdev->dev.parent; + config.regmap = pmic->regmap; +- config.driver_data = regulator; + for (i = 0; i < ARRAY_SIZE(regulators); i++) { ++ config.driver_data = (void *) ®ulators[i]; ++ + rdev = devm_regulator_register(&pdev->dev, + ®ulators[i].rdesc, + &config); + if (IS_ERR(rdev)) { + dev_err(&pdev->dev, "failed to register regulator %s\n", +- regulator->rdesc.name); ++ regulators[i].rdesc.name); + return PTR_ERR(rdev); + } + } +-- +2.30.2 + diff --git a/queue-5.12/regulator-mt6315-fix-checking-return-value-of-devm_r.patch b/queue-5.12/regulator-mt6315-fix-checking-return-value-of-devm_r.patch new file mode 100644 index 00000000000..cfd8ff74393 --- /dev/null +++ b/queue-5.12/regulator-mt6315-fix-checking-return-value-of-devm_r.patch @@ -0,0 +1,38 @@ +From da996748f3686762ade0b374e4d91eeff9755adf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 21:29:34 +0800 +Subject: regulator: mt6315: Fix checking return value of + devm_regmap_init_spmi_ext + +From: Axel Lin + +[ Upstream commit 70d654ea3de937d7754c107bb8eeb20e30262c89 ] + +devm_regmap_init_spmi_ext() returns ERR_PTR() on error. + +Signed-off-by: Axel Lin +Link: https://lore.kernel.org/r/20210615132934.3453965-1-axel.lin@ingics.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/mt6315-regulator.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/regulator/mt6315-regulator.c b/drivers/regulator/mt6315-regulator.c +index 6b8be52c3772..7514702f78cf 100644 +--- a/drivers/regulator/mt6315-regulator.c ++++ b/drivers/regulator/mt6315-regulator.c +@@ -223,8 +223,8 @@ static int mt6315_regulator_probe(struct spmi_device *pdev) + int i; + + regmap = devm_regmap_init_spmi_ext(pdev, &mt6315_regmap_config); +- if (!regmap) +- return -ENODEV; ++ if (IS_ERR(regmap)) ++ return PTR_ERR(regmap); + + chip = devm_kzalloc(dev, sizeof(struct mt6315_chip), GFP_KERNEL); + if (!chip) +-- +2.30.2 + diff --git a/queue-5.12/regulator-mt6358-fix-vdram2-.vsel_mask.patch b/queue-5.12/regulator-mt6358-fix-vdram2-.vsel_mask.patch new file mode 100644 index 00000000000..65f62f08da0 --- /dev/null +++ b/queue-5.12/regulator-mt6358-fix-vdram2-.vsel_mask.patch @@ -0,0 +1,36 @@ +From 43062f7cd5aa53ddfb925d8f96b5ad8b540dd322 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 12:56:09 +0800 +Subject: regulator: mt6358: Fix vdram2 .vsel_mask + +From: Hsin-Hsiung Wang + +[ Upstream commit 50c9462edcbf900f3d5097ca3ad60171346124de ] + +The valid vsel value are 0 and 12, so the .vsel_mask should be 0xf. + +Signed-off-by: Hsin-Hsiung Wang +Reviewed-by: Axel Lin +Link: https://lore.kernel.org/r/1624424169-510-1-git-send-email-hsin-hsiung.wang@mediatek.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/mt6358-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/mt6358-regulator.c b/drivers/regulator/mt6358-regulator.c +index 13cb6ac9a892..1d4eb5dc4fac 100644 +--- a/drivers/regulator/mt6358-regulator.c ++++ b/drivers/regulator/mt6358-regulator.c +@@ -457,7 +457,7 @@ static struct mt6358_regulator_info mt6358_regulators[] = { + MT6358_REG_FIXED("ldo_vaud28", VAUD28, + MT6358_LDO_VAUD28_CON0, 0, 2800000), + MT6358_LDO("ldo_vdram2", VDRAM2, vdram2_voltages, vdram2_idx, +- MT6358_LDO_VDRAM2_CON0, 0, MT6358_LDO_VDRAM2_ELR0, 0x10, 0), ++ MT6358_LDO_VDRAM2_CON0, 0, MT6358_LDO_VDRAM2_ELR0, 0xf, 0), + MT6358_LDO("ldo_vsim1", VSIM1, vsim_voltages, vsim_idx, + MT6358_LDO_VSIM1_CON0, 0, MT6358_VSIM1_ANA_CON0, 0xf00, 8), + MT6358_LDO("ldo_vibr", VIBR, vibr_voltages, vibr_idx, +-- +2.30.2 + diff --git a/queue-5.12/regulator-uniphier-add-missing-module_device_table.patch b/queue-5.12/regulator-uniphier-add-missing-module_device_table.patch new file mode 100644 index 00000000000..ccabaef8e48 --- /dev/null +++ b/queue-5.12/regulator-uniphier-add-missing-module_device_table.patch @@ -0,0 +1,37 @@ +From 843eb00b391786e19790276c16a61f3a4c052e6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 11:53:18 +0800 +Subject: regulator: uniphier: Add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit d019f38a1af3c6015cde6a47951a3ec43beeed80 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Link: https://lore.kernel.org/r/1620705198-104566-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/uniphier-regulator.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/regulator/uniphier-regulator.c b/drivers/regulator/uniphier-regulator.c +index 2e02e26b516c..e75b0973e325 100644 +--- a/drivers/regulator/uniphier-regulator.c ++++ b/drivers/regulator/uniphier-regulator.c +@@ -201,6 +201,7 @@ static const struct of_device_id uniphier_regulator_match[] = { + }, + { /* Sentinel */ }, + }; ++MODULE_DEVICE_TABLE(of, uniphier_regulator_match); + + static struct platform_driver uniphier_regulator_driver = { + .probe = uniphier_regulator_probe, +-- +2.30.2 + diff --git a/queue-5.12/revert-be2net-disable-bh-with-spin_lock-in-be_proces.patch b/queue-5.12/revert-be2net-disable-bh-with-spin_lock-in-be_proces.patch new file mode 100644 index 00000000000..482745413de --- /dev/null +++ b/queue-5.12/revert-be2net-disable-bh-with-spin_lock-in-be_proces.patch @@ -0,0 +1,118 @@ +From 80e9873b635d30ceef5c4ffaf698d076364b3c40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 10:27:45 +0200 +Subject: Revert "be2net: disable bh with spin_lock in be_process_mcc" + +From: Petr Oros + +[ Upstream commit d6765985a42a660f078896d5c5b27f97c580a490 ] + +Patch was based on wrong presumption that be_poll can be called only +from bh context. It reintroducing old regression (also reverted) and +causing deadlock when we use netconsole with benet in bonding. + +Old revert: commit 072a9c486004 ("netpoll: revert 6bdb7fe3104 and fix +be_poll() instead") + +[ 331.269715] bond0: (slave enp0s7f0): Releasing backup interface +[ 331.270121] CPU: 4 PID: 1479 Comm: ifenslave Not tainted 5.13.0-rc7+ #2 +[ 331.270122] Call Trace: +[ 331.270122] [c00000001789f200] [c0000000008c505c] dump_stack+0x100/0x174 (unreliable) +[ 331.270124] [c00000001789f240] [c008000001238b9c] be_poll+0x64/0xe90 [be2net] +[ 331.270125] [c00000001789f330] [c000000000d1e6e4] netpoll_poll_dev+0x174/0x3d0 +[ 331.270127] [c00000001789f400] [c008000001bc167c] bond_poll_controller+0xb4/0x130 [bonding] +[ 331.270128] [c00000001789f450] [c000000000d1e624] netpoll_poll_dev+0xb4/0x3d0 +[ 331.270129] [c00000001789f520] [c000000000d1ed88] netpoll_send_skb+0x448/0x470 +[ 331.270130] [c00000001789f5d0] [c0080000011f14f8] write_msg+0x180/0x1b0 [netconsole] +[ 331.270131] [c00000001789f640] [c000000000230c0c] console_unlock+0x54c/0x790 +[ 331.270132] [c00000001789f7b0] [c000000000233098] vprintk_emit+0x2d8/0x450 +[ 331.270133] [c00000001789f810] [c000000000234758] vprintk+0xc8/0x270 +[ 331.270134] [c00000001789f850] [c000000000233c28] printk+0x40/0x54 +[ 331.270135] [c00000001789f870] [c000000000ccf908] __netdev_printk+0x150/0x198 +[ 331.270136] [c00000001789f910] [c000000000ccfdb4] netdev_info+0x68/0x94 +[ 331.270137] [c00000001789f950] [c008000001bcbd70] __bond_release_one+0x188/0x6b0 [bonding] +[ 331.270138] [c00000001789faa0] [c008000001bcc6f4] bond_do_ioctl+0x42c/0x490 [bonding] +[ 331.270139] [c00000001789fb60] [c000000000d0d17c] dev_ifsioc+0x17c/0x400 +[ 331.270140] [c00000001789fbc0] [c000000000d0db70] dev_ioctl+0x390/0x890 +[ 331.270141] [c00000001789fc10] [c000000000c7c76c] sock_do_ioctl+0xac/0x1b0 +[ 331.270142] [c00000001789fc90] [c000000000c7ffac] sock_ioctl+0x31c/0x6e0 +[ 331.270143] [c00000001789fd60] [c0000000005b9728] sys_ioctl+0xf8/0x150 +[ 331.270145] [c00000001789fdb0] [c0000000000336c0] system_call_exception+0x160/0x2f0 +[ 331.270146] [c00000001789fe10] [c00000000000d35c] system_call_common+0xec/0x278 +[ 331.270147] --- interrupt: c00 at 0x7fffa6c6ec00 +[ 331.270147] NIP: 00007fffa6c6ec00 LR: 0000000105c4185c CTR: 0000000000000000 +[ 331.270148] REGS: c00000001789fe80 TRAP: 0c00 Not tainted (5.13.0-rc7+) +[ 331.270148] MSR: 800000000280f033 CR: 28000428 XER: 00000000 +[ 331.270155] IRQMASK: 0 +[ 331.270156] GPR00: 0000000000000036 00007fffd494d5b0 00007fffa6d57100 0000000000000003 +[ 331.270158] GPR04: 0000000000008991 00007fffd494d6d0 0000000000000008 00007fffd494f28c +[ 331.270161] GPR08: 0000000000000003 0000000000000000 0000000000000000 0000000000000000 +[ 331.270164] GPR12: 0000000000000000 00007fffa6dfa220 0000000000000000 0000000000000000 +[ 331.270167] GPR16: 0000000105c44880 0000000000000000 0000000105c60088 0000000105c60318 +[ 331.270170] GPR20: 0000000105c602c0 0000000105c44560 0000000000000000 0000000000000000 +[ 331.270172] GPR24: 00007fffd494dc50 00007fffd494d6a8 0000000105c60008 00007fffd494d6d0 +[ 331.270175] GPR28: 00007fffd494f27e 0000000105c6026c 00007fffd494f284 0000000000000000 +[ 331.270178] NIP [00007fffa6c6ec00] 0x7fffa6c6ec00 +[ 331.270178] LR [0000000105c4185c] 0x105c4185c +[ 331.270179] --- interrupt: c00 + +This reverts commit d0d006a43e9a7a796f6f178839c92fcc222c564d. + +Fixes: d0d006a43e9a7a ("be2net: disable bh with spin_lock in be_process_mcc") +Signed-off-by: Petr Oros +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/emulex/benet/be_cmds.c | 6 ++++-- + drivers/net/ethernet/emulex/benet/be_main.c | 2 ++ + 2 files changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c +index 701c12c9e033..649c5c429bd7 100644 +--- a/drivers/net/ethernet/emulex/benet/be_cmds.c ++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c +@@ -550,7 +550,7 @@ int be_process_mcc(struct be_adapter *adapter) + int num = 0, status = 0; + struct be_mcc_obj *mcc_obj = &adapter->mcc_obj; + +- spin_lock_bh(&adapter->mcc_cq_lock); ++ spin_lock(&adapter->mcc_cq_lock); + + while ((compl = be_mcc_compl_get(adapter))) { + if (compl->flags & CQE_FLAGS_ASYNC_MASK) { +@@ -566,7 +566,7 @@ int be_process_mcc(struct be_adapter *adapter) + if (num) + be_cq_notify(adapter, mcc_obj->cq.id, mcc_obj->rearm_cq, num); + +- spin_unlock_bh(&adapter->mcc_cq_lock); ++ spin_unlock(&adapter->mcc_cq_lock); + return status; + } + +@@ -581,7 +581,9 @@ static int be_mcc_wait_compl(struct be_adapter *adapter) + if (be_check_error(adapter, BE_ERROR_ANY)) + return -EIO; + ++ local_bh_disable(); + status = be_process_mcc(adapter); ++ local_bh_enable(); + + if (atomic_read(&mcc_obj->q.used) == 0) + break; +diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c +index 7968568bbe21..361c1c87c183 100644 +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -5501,7 +5501,9 @@ static void be_worker(struct work_struct *work) + * mcc completions + */ + if (!netif_running(adapter->netdev)) { ++ local_bh_disable(); + be_process_mcc(adapter); ++ local_bh_enable(); + goto reschedule; + } + +-- +2.30.2 + diff --git a/queue-5.12/revert-ibmvnic-remove-duplicate-napi_schedule-call-i.patch b/queue-5.12/revert-ibmvnic-remove-duplicate-napi_schedule-call-i.patch new file mode 100644 index 00000000000..fa44d34d147 --- /dev/null +++ b/queue-5.12/revert-ibmvnic-remove-duplicate-napi_schedule-call-i.patch @@ -0,0 +1,46 @@ +From 034882d47e1e9d5a5ab9538401e4a220a5ae81b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 21:13:11 -0700 +Subject: Revert "ibmvnic: remove duplicate napi_schedule call in open + function" + +From: Dany Madden + +[ Upstream commit 2ca220f92878470c6ba03f9946e412323093cc94 ] + +This reverts commit 7c451f3ef676c805a4b77a743a01a5c21a250a73. + +When a vnic interface is taken down and then up, connectivity is not +restored. We bisected it to this commit. Reverting this commit until +we can fully investigate the issue/benefit of the change. + +Fixes: 7c451f3ef676 ("ibmvnic: remove duplicate napi_schedule call in open function") +Reported-by: Cristobal Forno +Reported-by: Abdul Haleem +Signed-off-by: Dany Madden +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index b920132d4940..b2f5250f77a9 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1186,6 +1186,11 @@ static int __ibmvnic_open(struct net_device *netdev) + + netif_tx_start_all_queues(netdev); + ++ if (prev_state == VNIC_CLOSED) { ++ for (i = 0; i < adapter->req_rx_queues; i++) ++ napi_schedule(&adapter->napi[i]); ++ } ++ + adapter->state = VNIC_OPEN; + return rc; + } +-- +2.30.2 + diff --git a/queue-5.12/revert-ibmvnic-simplify-reset_long_term_buff-functio.patch b/queue-5.12/revert-ibmvnic-simplify-reset_long_term_buff-functio.patch new file mode 100644 index 00000000000..c8a3512e9b3 --- /dev/null +++ b/queue-5.12/revert-ibmvnic-simplify-reset_long_term_buff-functio.patch @@ -0,0 +1,120 @@ +From 5c928a32c3eb7cdab6cbbb31db1e14a04f79278b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 21:13:10 -0700 +Subject: Revert "ibmvnic: simplify reset_long_term_buff function" + +From: Sukadev Bhattiprolu + +[ Upstream commit 0ec13aff058a82426c8d44b688c804cc4a5a0a3d ] + +This reverts commit 1c7d45e7b2c29080bf6c8cd0e213cc3cbb62a054. + +We tried to optimize the number of hcalls we send and skipped sending +the REQUEST_MAP calls for some maps. However during resets, we need to +resend all the maps to the VIOS since the VIOS does not remember the +old values. In fact we may have failed over to a new VIOS which will +not have any of the mappings. + +When we send packets with map ids the VIOS does not know about, it +triggers a FATAL reset. While the client does recover from the FATAL +error reset, we are seeing a large number of such resets. Handling +FATAL resets is lot more unnecessary work than issuing a few more +hcalls so revert the commit and resend the maps to the VIOS. + +Fixes: 1c7d45e7b2c ("ibmvnic: simplify reset_long_term_buff function") +Signed-off-by: Sukadev Bhattiprolu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 46 ++++++++++++++++++++++++------ + 1 file changed, 38 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index ffb2a91750c7..b920132d4940 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -257,12 +257,40 @@ static void free_long_term_buff(struct ibmvnic_adapter *adapter, + dma_free_coherent(dev, ltb->size, ltb->buff, ltb->addr); + } + +-static int reset_long_term_buff(struct ibmvnic_long_term_buff *ltb) ++static int reset_long_term_buff(struct ibmvnic_adapter *adapter, ++ struct ibmvnic_long_term_buff *ltb) + { +- if (!ltb->buff) +- return -EINVAL; ++ struct device *dev = &adapter->vdev->dev; ++ int rc; + + memset(ltb->buff, 0, ltb->size); ++ ++ mutex_lock(&adapter->fw_lock); ++ adapter->fw_done_rc = 0; ++ ++ reinit_completion(&adapter->fw_done); ++ rc = send_request_map(adapter, ltb->addr, ltb->size, ltb->map_id); ++ if (rc) { ++ mutex_unlock(&adapter->fw_lock); ++ return rc; ++ } ++ ++ rc = ibmvnic_wait_for_completion(adapter, &adapter->fw_done, 10000); ++ if (rc) { ++ dev_info(dev, ++ "Reset failed, long term map request timed out or aborted\n"); ++ mutex_unlock(&adapter->fw_lock); ++ return rc; ++ } ++ ++ if (adapter->fw_done_rc) { ++ dev_info(dev, ++ "Reset failed, attempting to free and reallocate buffer\n"); ++ free_long_term_buff(adapter, ltb); ++ mutex_unlock(&adapter->fw_lock); ++ return alloc_long_term_buff(adapter, ltb, ltb->size); ++ } ++ mutex_unlock(&adapter->fw_lock); + return 0; + } + +@@ -484,7 +512,8 @@ static int reset_rx_pools(struct ibmvnic_adapter *adapter) + rx_pool->size * + rx_pool->buff_size); + } else { +- rc = reset_long_term_buff(&rx_pool->long_term_buff); ++ rc = reset_long_term_buff(adapter, ++ &rx_pool->long_term_buff); + } + + if (rc) +@@ -607,11 +636,12 @@ static int init_rx_pools(struct net_device *netdev) + return 0; + } + +-static int reset_one_tx_pool(struct ibmvnic_tx_pool *tx_pool) ++static int reset_one_tx_pool(struct ibmvnic_adapter *adapter, ++ struct ibmvnic_tx_pool *tx_pool) + { + int rc, i; + +- rc = reset_long_term_buff(&tx_pool->long_term_buff); ++ rc = reset_long_term_buff(adapter, &tx_pool->long_term_buff); + if (rc) + return rc; + +@@ -638,10 +668,10 @@ static int reset_tx_pools(struct ibmvnic_adapter *adapter) + + tx_scrqs = adapter->num_active_tx_pools; + for (i = 0; i < tx_scrqs; i++) { +- rc = reset_one_tx_pool(&adapter->tso_pool[i]); ++ rc = reset_one_tx_pool(adapter, &adapter->tso_pool[i]); + if (rc) + return rc; +- rc = reset_one_tx_pool(&adapter->tx_pool[i]); ++ rc = reset_one_tx_pool(adapter, &adapter->tx_pool[i]); + if (rc) + return rc; + } +-- +2.30.2 + diff --git a/queue-5.12/rtw88-8822c-fix-lc-calibration-timing.patch b/queue-5.12/rtw88-8822c-fix-lc-calibration-timing.patch new file mode 100644 index 00000000000..f69a45b7c64 --- /dev/null +++ b/queue-5.12/rtw88-8822c-fix-lc-calibration-timing.patch @@ -0,0 +1,82 @@ +From 8a73b08e69295d2fe212e54d811a584632f9f02a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 09:32:52 +0800 +Subject: rtw88: 8822c: fix lc calibration timing + +From: Po-Hao Huang + +[ Upstream commit 05684fd583e1acc34dddea283838fbfbed4904a0 ] + +Before this patch, we use value from 2 seconds ago to decide +whether we should do lc calibration. +Although this don't happen frequently, fix flow to the way it should be. + +Fixes: 7ae7784ec2a8 ("rtw88: 8822c: add LC calibration for RTL8822C") +Signed-off-by: Po-Hao Huang +Signed-off-by: Ping-Ke Shih +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210426013252.5665-3-pkshih@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/rtw8822c.c | 22 ++++++++++--------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/rtw8822c.c b/drivers/net/wireless/realtek/rtw88/rtw8822c.c +index 448922cb2e63..10bb3b5a8c22 100644 +--- a/drivers/net/wireless/realtek/rtw88/rtw8822c.c ++++ b/drivers/net/wireless/realtek/rtw88/rtw8822c.c +@@ -3529,26 +3529,28 @@ static void rtw8822c_pwrtrack_set(struct rtw_dev *rtwdev, u8 rf_path) + } + } + +-static void rtw8822c_pwr_track_path(struct rtw_dev *rtwdev, +- struct rtw_swing_table *swing_table, +- u8 path) ++static void rtw8822c_pwr_track_stats(struct rtw_dev *rtwdev, u8 path) + { +- struct rtw_dm_info *dm_info = &rtwdev->dm_info; +- u8 thermal_value, delta; ++ u8 thermal_value; + + if (rtwdev->efuse.thermal_meter[path] == 0xff) + return; + + thermal_value = rtw_read_rf(rtwdev, path, RF_T_METER, 0x7e); +- + rtw_phy_pwrtrack_avg(rtwdev, thermal_value, path); ++} + +- delta = rtw_phy_pwrtrack_get_delta(rtwdev, path); ++static void rtw8822c_pwr_track_path(struct rtw_dev *rtwdev, ++ struct rtw_swing_table *swing_table, ++ u8 path) ++{ ++ struct rtw_dm_info *dm_info = &rtwdev->dm_info; ++ u8 delta; + ++ delta = rtw_phy_pwrtrack_get_delta(rtwdev, path); + dm_info->delta_power_index[path] = + rtw_phy_pwrtrack_get_pwridx(rtwdev, swing_table, path, path, + delta); +- + rtw8822c_pwrtrack_set(rtwdev, path); + } + +@@ -3559,12 +3561,12 @@ static void __rtw8822c_pwr_track(struct rtw_dev *rtwdev) + + rtw_phy_config_swing_table(rtwdev, &swing_table); + ++ for (i = 0; i < rtwdev->hal.rf_path_num; i++) ++ rtw8822c_pwr_track_stats(rtwdev, i); + if (rtw_phy_pwrtrack_need_lck(rtwdev)) + rtw8822c_do_lck(rtwdev); +- + for (i = 0; i < rtwdev->hal.rf_path_num; i++) + rtw8822c_pwr_track_path(rtwdev, &swing_table, i); +- + } + + static void rtw8822c_pwr_track(struct rtw_dev *rtwdev) +-- +2.30.2 + diff --git a/queue-5.12/s390-appldata-depends-on-proc_sysctl.patch b/queue-5.12/s390-appldata-depends-on-proc_sysctl.patch new file mode 100644 index 00000000000..91f4672e6fe --- /dev/null +++ b/queue-5.12/s390-appldata-depends-on-proc_sysctl.patch @@ -0,0 +1,46 @@ +From 35b4f1a3157ac316be7cb75ea0e1b1dcddd38da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 17:24:20 -0700 +Subject: s390: appldata depends on PROC_SYSCTL + +From: Randy Dunlap + +[ Upstream commit 5d3516b3647621d5a1180672ea9e0817fb718ada ] + +APPLDATA_BASE should depend on PROC_SYSCTL instead of PROC_FS. +Building with PROC_FS but not PROC_SYSCTL causes a build error, +since appldata_base.c uses data and APIs from fs/proc/proc_sysctl.c. + +arch/s390/appldata/appldata_base.o: in function `appldata_generic_handler': +appldata_base.c:(.text+0x192): undefined reference to `sysctl_vals' + +Fixes: c185b783b099 ("[S390] Remove config options.") +Signed-off-by: Randy Dunlap +Cc: Heiko Carstens +Cc: Vasily Gorbik +Cc: Christian Borntraeger +Cc: linux-s390@vger.kernel.org +Signed-off-by: Vasily Gorbik +Link: https://lore.kernel.org/r/20210528002420.17634-1-rdunlap@infradead.org +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index d6676197276c..4fcd460f496e 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -859,7 +859,7 @@ config CMM_IUCV + config APPLDATA_BASE + def_bool n + prompt "Linux - VM Monitor Stream, base infrastructure" +- depends on PROC_FS ++ depends on PROC_SYSCTL + help + This provides a kernel interface for creating and updating z/VM APPLDATA + monitor records. The monitor records are updated at certain time +-- +2.30.2 + diff --git a/queue-5.12/s390-enable-have_ioremap_prot.patch b/queue-5.12/s390-enable-have_ioremap_prot.patch new file mode 100644 index 00000000000..83e234e58cb --- /dev/null +++ b/queue-5.12/s390-enable-have_ioremap_prot.patch @@ -0,0 +1,79 @@ +From 6b51d0f41b285b11633c7088ec7e31e0be399181 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Feb 2021 12:00:52 +0100 +Subject: s390: enable HAVE_IOREMAP_PROT + +From: Niklas Schnelle + +[ Upstream commit d460bb6c6417588dd8b0907d34f69b237918812a ] + +In commit b02002cc4c0f ("s390/pci: Implement ioremap_wc/prot() with +MIO") we implemented both ioremap_wc() and ioremap_prot() however until +now we had not set HAVE_IOREMAP_PROT in Kconfig, do so now. + +This also requires implementing pte_pgprot() as this is used in the +generic_access_phys() code enabled by CONFIG_HAVE_IOREMAP_PROT. As with +ioremap_wc() we need to take the MMIO Write Back bit index into account. + +Moreover since the pgprot value returned from pte_pgprot() is to be used +for mappings into kernel address space we must make sure that it uses +appropriate kernel page table protection bits. In particular a pgprot +value originally coming from userspace could have the _PAGE_PROTECT +bit set to enable fault based dirty bit accounting which would then make +the mapping inaccessible when used in kernel address space. + +Fixes: b02002cc4c0f ("s390/pci: Implement ioremap_wc/prot() with MIO") +Reviewed-by: Gerald Schaefer +Signed-off-by: Niklas Schnelle +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/Kconfig | 1 + + arch/s390/include/asm/pgtable.h | 19 +++++++++++++++++++ + 2 files changed, 20 insertions(+) + +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index c1ff874e6c2e..d6676197276c 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -160,6 +160,7 @@ config S390 + select HAVE_FUTEX_CMPXCHG if FUTEX + select HAVE_GCC_PLUGINS + select HAVE_GENERIC_VDSO ++ select HAVE_IOREMAP_PROT if PCI + select HAVE_IRQ_EXIT_ON_IRQ_STACK + select HAVE_KERNEL_BZIP2 + select HAVE_KERNEL_GZIP +diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h +index b38f7b781564..adea53f69bfd 100644 +--- a/arch/s390/include/asm/pgtable.h ++++ b/arch/s390/include/asm/pgtable.h +@@ -863,6 +863,25 @@ static inline int pte_unused(pte_t pte) + return pte_val(pte) & _PAGE_UNUSED; + } + ++/* ++ * Extract the pgprot value from the given pte while at the same time making it ++ * usable for kernel address space mappings where fault driven dirty and ++ * young/old accounting is not supported, i.e _PAGE_PROTECT and _PAGE_INVALID ++ * must not be set. ++ */ ++static inline pgprot_t pte_pgprot(pte_t pte) ++{ ++ unsigned long pte_flags = pte_val(pte) & _PAGE_CHG_MASK; ++ ++ if (pte_write(pte)) ++ pte_flags |= pgprot_val(PAGE_KERNEL); ++ else ++ pte_flags |= pgprot_val(PAGE_KERNEL_RO); ++ pte_flags |= pte_val(pte) & mio_wb_bit_mask; ++ ++ return __pgprot(pte_flags); ++} ++ + /* + * pgd/pmd/pte modification functions + */ +-- +2.30.2 + diff --git a/queue-5.12/samples-bpf-fix-segmentation-fault-for-xdp_redirect-.patch b/queue-5.12/samples-bpf-fix-segmentation-fault-for-xdp_redirect-.patch new file mode 100644 index 00000000000..2459fec2502 --- /dev/null +++ b/queue-5.12/samples-bpf-fix-segmentation-fault-for-xdp_redirect-.patch @@ -0,0 +1,46 @@ +From 04ffc01b1b2533d6213466213e65bec3842247bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 12:23:24 +0800 +Subject: samples/bpf: Fix Segmentation fault for xdp_redirect command + +From: Wang Hai + +[ Upstream commit 85102ba58b4125ebad941d7555c3c248b23efd16 ] + +A Segmentation fault error is caused when the following command +is executed. + +$ sudo ./samples/bpf/xdp_redirect lo +Segmentation fault + +This command is missing a device as an argument, resulting +in out-of-bounds access from argv. + +If the number of devices for the xdp_redirect parameter is not 2, +we should report an error and exit. + +Fixes: 24251c264798 ("samples/bpf: add option for native and skb mode for redirect apps") +Signed-off-by: Wang Hai +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210616042324.314832-1-wanghai38@huawei.com +Signed-off-by: Sasha Levin +--- + samples/bpf/xdp_redirect_user.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/samples/bpf/xdp_redirect_user.c b/samples/bpf/xdp_redirect_user.c +index 41d705c3a1f7..eb876629109a 100644 +--- a/samples/bpf/xdp_redirect_user.c ++++ b/samples/bpf/xdp_redirect_user.c +@@ -130,7 +130,7 @@ int main(int argc, char **argv) + if (!(xdp_flags & XDP_FLAGS_SKB_MODE)) + xdp_flags |= XDP_FLAGS_DRV_MODE; + +- if (optind == argc) { ++ if (optind + 2 != argc) { + printf("usage: %s _IN _OUT\n", argv[0]); + return 1; + } +-- +2.30.2 + diff --git a/queue-5.12/samples-bpf-fix-the-error-return-code-of-xdp_redirec.patch b/queue-5.12/samples-bpf-fix-the-error-return-code-of-xdp_redirec.patch new file mode 100644 index 00000000000..5ea50cbf6fc --- /dev/null +++ b/queue-5.12/samples-bpf-fix-the-error-return-code-of-xdp_redirec.patch @@ -0,0 +1,37 @@ +From 6e790d715d9235091197edb0081c18e51c6588fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 12:25:34 +0800 +Subject: samples/bpf: Fix the error return code of xdp_redirect's main() + +From: Wang Hai + +[ Upstream commit 7c6090ee2a7b3315410cfc83a94c3eb057407b25 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +If bpf_map_update_elem() failed, main() should return a negative error. + +Fixes: 832622e6bd18 ("xdp: sample program for new bpf_redirect helper") +Signed-off-by: Wang Hai +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210616042534.315097-1-wanghai38@huawei.com +Signed-off-by: Sasha Levin +--- + samples/bpf/xdp_redirect_user.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/samples/bpf/xdp_redirect_user.c b/samples/bpf/xdp_redirect_user.c +index eb876629109a..93854e135134 100644 +--- a/samples/bpf/xdp_redirect_user.c ++++ b/samples/bpf/xdp_redirect_user.c +@@ -213,5 +213,5 @@ int main(int argc, char **argv) + poll_stats(2, ifindex_out); + + out: +- return 0; ++ return ret; + } +-- +2.30.2 + diff --git a/queue-5.12/sata_highbank-fix-deferred-probing.patch b/queue-5.12/sata_highbank-fix-deferred-probing.patch new file mode 100644 index 00000000000..d70408d0fa7 --- /dev/null +++ b/queue-5.12/sata_highbank-fix-deferred-probing.patch @@ -0,0 +1,46 @@ +From a2d0296dd40ecadc491024a0ba1a86519840d755 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Mar 2021 23:34:27 +0300 +Subject: sata_highbank: fix deferred probing + +From: Sergey Shtylyov + +[ Upstream commit 4a24efa16e7db02306fb5db84518bb0a7ada5a46 ] + +The driver overrides the error codes returned by platform_get_irq() to +-EINVAL, so if it returns -EPROBE_DEFER, the driver would fail the probe +permanently instead of the deferred probing. Switch to propagating the +error code upstream, still checking/overriding IRQ0 as libata regards it +as "no IRQ" (thus polling) anyway... + +Fixes: 9ec36cafe43b ("of/irq: do irq resolution in platform_get_irq") +Signed-off-by: Sergey Shtylyov +Link: https://lore.kernel.org/r/105b456d-1199-f6e9-ceb7-ffc5ba551d1a@omprussia.ru +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/ata/sata_highbank.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c +index 64b2ef15ec19..8440203e835e 100644 +--- a/drivers/ata/sata_highbank.c ++++ b/drivers/ata/sata_highbank.c +@@ -469,10 +469,12 @@ static int ahci_highbank_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (irq <= 0) { ++ if (irq < 0) { + dev_err(dev, "no irq\n"); +- return -EINVAL; ++ return irq; + } ++ if (!irq) ++ return -EINVAL; + + hpriv = devm_kzalloc(dev, sizeof(*hpriv), GFP_KERNEL); + if (!hpriv) { +-- +2.30.2 + diff --git a/queue-5.12/sched-core-initialize-the-idle-task-with-preemption-.patch b/queue-5.12/sched-core-initialize-the-idle-task-with-preemption-.patch new file mode 100644 index 00000000000..f517f8053ff --- /dev/null +++ b/queue-5.12/sched-core-initialize-the-idle-task-with-preemption-.patch @@ -0,0 +1,405 @@ +From cc3fdcae0e80b3f5b39efb5754cdce3fbece71ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 10:46:36 +0100 +Subject: sched/core: Initialize the idle task with preemption disabled + +From: Valentin Schneider + +[ Upstream commit f1a0a376ca0c4ef1fc3d24e3e502acbb5b795674 ] + +As pointed out by commit + + de9b8f5dcbd9 ("sched: Fix crash trying to dequeue/enqueue the idle thread") + +init_idle() can and will be invoked more than once on the same idle +task. At boot time, it is invoked for the boot CPU thread by +sched_init(). Then smp_init() creates the threads for all the secondary +CPUs and invokes init_idle() on them. + +As the hotplug machinery brings the secondaries to life, it will issue +calls to idle_thread_get(), which itself invokes init_idle() yet again. +In this case it's invoked twice more per secondary: at _cpu_up(), and at +bringup_cpu(). + +Given smp_init() already initializes the idle tasks for all *possible* +CPUs, no further initialization should be required. Now, removing +init_idle() from idle_thread_get() exposes some interesting expectations +with regards to the idle task's preempt_count: the secondary startup always +issues a preempt_disable(), requiring some reset of the preempt count to 0 +between hot-unplug and hotplug, which is currently served by +idle_thread_get() -> idle_init(). + +Given the idle task is supposed to have preemption disabled once and never +see it re-enabled, it seems that what we actually want is to initialize its +preempt_count to PREEMPT_DISABLED and leave it there. Do that, and remove +init_idle() from idle_thread_get(). + +Secondary startups were patched via coccinelle: + + @begone@ + @@ + + -preempt_disable(); + ... + cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); + +Signed-off-by: Valentin Schneider +Signed-off-by: Ingo Molnar +Acked-by: Peter Zijlstra +Link: https://lore.kernel.org/r/20210512094636.2958515-1-valentin.schneider@arm.com +Signed-off-by: Sasha Levin +--- + arch/alpha/kernel/smp.c | 1 - + arch/arc/kernel/smp.c | 1 - + arch/arm/kernel/smp.c | 1 - + arch/arm64/include/asm/preempt.h | 2 +- + arch/arm64/kernel/smp.c | 1 - + arch/csky/kernel/smp.c | 1 - + arch/ia64/kernel/smpboot.c | 1 - + arch/mips/kernel/smp.c | 1 - + arch/openrisc/kernel/smp.c | 2 -- + arch/parisc/kernel/smp.c | 1 - + arch/powerpc/kernel/smp.c | 1 - + arch/riscv/kernel/smpboot.c | 1 - + arch/s390/include/asm/preempt.h | 4 ++-- + arch/s390/kernel/smp.c | 1 - + arch/sh/kernel/smp.c | 2 -- + arch/sparc/kernel/smp_32.c | 1 - + arch/sparc/kernel/smp_64.c | 3 --- + arch/x86/include/asm/preempt.h | 2 +- + arch/x86/kernel/smpboot.c | 1 - + arch/xtensa/kernel/smp.c | 1 - + include/asm-generic/preempt.h | 2 +- + init/main.c | 6 +----- + kernel/fork.c | 2 +- + kernel/sched/core.c | 2 +- + kernel/smpboot.c | 1 - + 25 files changed, 8 insertions(+), 34 deletions(-) + +diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c +index f4dd9f3f3001..4b2575f936d4 100644 +--- a/arch/alpha/kernel/smp.c ++++ b/arch/alpha/kernel/smp.c +@@ -166,7 +166,6 @@ smp_callin(void) + DBGS(("smp_callin: commencing CPU %d current %p active_mm %p\n", + cpuid, current, current->active_mm)); + +- preempt_disable(); + cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); + } + +diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c +index 52906d314537..db0e104d6835 100644 +--- a/arch/arc/kernel/smp.c ++++ b/arch/arc/kernel/smp.c +@@ -189,7 +189,6 @@ void start_kernel_secondary(void) + pr_info("## CPU%u LIVE ##: Executing Code...\n", cpu); + + local_irq_enable(); +- preempt_disable(); + cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); + } + +diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c +index 74679240a9d8..c7bb168b0d97 100644 +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -432,7 +432,6 @@ asmlinkage void secondary_start_kernel(void) + #endif + pr_debug("CPU%u: Booted secondary processor\n", cpu); + +- preempt_disable(); + trace_hardirqs_off(); + + /* +diff --git a/arch/arm64/include/asm/preempt.h b/arch/arm64/include/asm/preempt.h +index 80e946b2abee..e83f0982b99c 100644 +--- a/arch/arm64/include/asm/preempt.h ++++ b/arch/arm64/include/asm/preempt.h +@@ -23,7 +23,7 @@ static inline void preempt_count_set(u64 pc) + } while (0) + + #define init_idle_preempt_count(p, cpu) do { \ +- task_thread_info(p)->preempt_count = PREEMPT_ENABLED; \ ++ task_thread_info(p)->preempt_count = PREEMPT_DISABLED; \ + } while (0) + + static inline void set_preempt_need_resched(void) +diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c +index 357590beaabb..48fd89256739 100644 +--- a/arch/arm64/kernel/smp.c ++++ b/arch/arm64/kernel/smp.c +@@ -223,7 +223,6 @@ asmlinkage notrace void secondary_start_kernel(void) + init_gic_priority_masking(); + + rcu_cpu_starting(cpu); +- preempt_disable(); + trace_hardirqs_off(); + + /* +diff --git a/arch/csky/kernel/smp.c b/arch/csky/kernel/smp.c +index 0f9f5eef9338..e2993539af8e 100644 +--- a/arch/csky/kernel/smp.c ++++ b/arch/csky/kernel/smp.c +@@ -281,7 +281,6 @@ void csky_start_secondary(void) + pr_info("CPU%u Online: %s...\n", cpu, __func__); + + local_irq_enable(); +- preempt_disable(); + cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); + } + +diff --git a/arch/ia64/kernel/smpboot.c b/arch/ia64/kernel/smpboot.c +index 49b488580939..d10f780c13b9 100644 +--- a/arch/ia64/kernel/smpboot.c ++++ b/arch/ia64/kernel/smpboot.c +@@ -441,7 +441,6 @@ start_secondary (void *unused) + #endif + efi_map_pal_code(); + cpu_init(); +- preempt_disable(); + smp_callin(); + + cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); +diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c +index ef86fbad8546..d542fb7af3ba 100644 +--- a/arch/mips/kernel/smp.c ++++ b/arch/mips/kernel/smp.c +@@ -348,7 +348,6 @@ asmlinkage void start_secondary(void) + */ + + calibrate_delay(); +- preempt_disable(); + cpu = smp_processor_id(); + cpu_data[cpu].udelay_val = loops_per_jiffy; + +diff --git a/arch/openrisc/kernel/smp.c b/arch/openrisc/kernel/smp.c +index 48e1092a64de..415e209732a3 100644 +--- a/arch/openrisc/kernel/smp.c ++++ b/arch/openrisc/kernel/smp.c +@@ -145,8 +145,6 @@ asmlinkage __init void secondary_start_kernel(void) + set_cpu_online(cpu, true); + + local_irq_enable(); +- +- preempt_disable(); + /* + * OK, it's off to the idle thread for us + */ +diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c +index 10227f667c8a..1405b603b91b 100644 +--- a/arch/parisc/kernel/smp.c ++++ b/arch/parisc/kernel/smp.c +@@ -302,7 +302,6 @@ void __init smp_callin(unsigned long pdce_proc) + #endif + + smp_cpu_init(slave_id); +- preempt_disable(); + + flush_cache_all_local(); /* start with known state */ + flush_tlb_all_local(NULL); +diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c +index c2473e20f5f5..1d7daef1c3b6 100644 +--- a/arch/powerpc/kernel/smp.c ++++ b/arch/powerpc/kernel/smp.c +@@ -1530,7 +1530,6 @@ void start_secondary(void *unused) + smp_store_cpu_info(cpu); + set_dec(tb_ticks_per_jiffy); + rcu_cpu_starting(cpu); +- preempt_disable(); + cpu_callin_map[cpu] = 1; + + if (smp_ops->setup_cpu) +diff --git a/arch/riscv/kernel/smpboot.c b/arch/riscv/kernel/smpboot.c +index 5e276c25646f..1941a6ce86a1 100644 +--- a/arch/riscv/kernel/smpboot.c ++++ b/arch/riscv/kernel/smpboot.c +@@ -176,7 +176,6 @@ asmlinkage __visible void smp_callin(void) + * Disable preemption before enabling interrupts, so we don't try to + * schedule a CPU that hasn't actually started yet. + */ +- preempt_disable(); + local_irq_enable(); + cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); + } +diff --git a/arch/s390/include/asm/preempt.h b/arch/s390/include/asm/preempt.h +index b49e0492842c..23ff51be7e29 100644 +--- a/arch/s390/include/asm/preempt.h ++++ b/arch/s390/include/asm/preempt.h +@@ -32,7 +32,7 @@ static inline void preempt_count_set(int pc) + #define init_task_preempt_count(p) do { } while (0) + + #define init_idle_preempt_count(p, cpu) do { \ +- S390_lowcore.preempt_count = PREEMPT_ENABLED; \ ++ S390_lowcore.preempt_count = PREEMPT_DISABLED; \ + } while (0) + + static inline void set_preempt_need_resched(void) +@@ -91,7 +91,7 @@ static inline void preempt_count_set(int pc) + #define init_task_preempt_count(p) do { } while (0) + + #define init_idle_preempt_count(p, cpu) do { \ +- S390_lowcore.preempt_count = PREEMPT_ENABLED; \ ++ S390_lowcore.preempt_count = PREEMPT_DISABLED; \ + } while (0) + + static inline void set_preempt_need_resched(void) +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 58c8afa3da65..d60c7374d807 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -877,7 +877,6 @@ static void smp_init_secondary(void) + restore_access_regs(S390_lowcore.access_regs_save_area); + cpu_init(); + rcu_cpu_starting(cpu); +- preempt_disable(); + init_cpu_timer(); + vtime_init(); + vdso_getcpu_init(); +diff --git a/arch/sh/kernel/smp.c b/arch/sh/kernel/smp.c +index 372acdc9033e..65924d9ec245 100644 +--- a/arch/sh/kernel/smp.c ++++ b/arch/sh/kernel/smp.c +@@ -186,8 +186,6 @@ asmlinkage void start_secondary(void) + + per_cpu_trap_init(); + +- preempt_disable(); +- + notify_cpu_starting(cpu); + + local_irq_enable(); +diff --git a/arch/sparc/kernel/smp_32.c b/arch/sparc/kernel/smp_32.c +index 50c127ab46d5..22b148e5a5f8 100644 +--- a/arch/sparc/kernel/smp_32.c ++++ b/arch/sparc/kernel/smp_32.c +@@ -348,7 +348,6 @@ static void sparc_start_secondary(void *arg) + */ + arch_cpu_pre_starting(arg); + +- preempt_disable(); + cpu = smp_processor_id(); + + notify_cpu_starting(cpu); +diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c +index e38d8bf454e8..ae5faa1d989d 100644 +--- a/arch/sparc/kernel/smp_64.c ++++ b/arch/sparc/kernel/smp_64.c +@@ -138,9 +138,6 @@ void smp_callin(void) + + set_cpu_online(cpuid, true); + +- /* idle thread is expected to have preempt disabled */ +- preempt_disable(); +- + local_irq_enable(); + + cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); +diff --git a/arch/x86/include/asm/preempt.h b/arch/x86/include/asm/preempt.h +index f8cb8af4de5c..fe5efbcba824 100644 +--- a/arch/x86/include/asm/preempt.h ++++ b/arch/x86/include/asm/preempt.h +@@ -44,7 +44,7 @@ static __always_inline void preempt_count_set(int pc) + #define init_task_preempt_count(p) do { } while (0) + + #define init_idle_preempt_count(p, cpu) do { \ +- per_cpu(__preempt_count, (cpu)) = PREEMPT_ENABLED; \ ++ per_cpu(__preempt_count, (cpu)) = PREEMPT_DISABLED; \ + } while (0) + + /* +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 363b36bbd791..ebc4b13b74a4 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -236,7 +236,6 @@ static void notrace start_secondary(void *unused) + cpu_init(); + rcu_cpu_starting(raw_smp_processor_id()); + x86_cpuinit.early_percpu_clock_init(); +- preempt_disable(); + smp_callin(); + + enable_start_cpu0 = 0; +diff --git a/arch/xtensa/kernel/smp.c b/arch/xtensa/kernel/smp.c +index cd85a7a2722b..1254da07ead1 100644 +--- a/arch/xtensa/kernel/smp.c ++++ b/arch/xtensa/kernel/smp.c +@@ -145,7 +145,6 @@ void secondary_start_kernel(void) + cpumask_set_cpu(cpu, mm_cpumask(mm)); + enter_lazy_tlb(mm, current); + +- preempt_disable(); + trace_hardirqs_off(); + + calibrate_delay(); +diff --git a/include/asm-generic/preempt.h b/include/asm-generic/preempt.h +index d683f5e6d791..b4d43a4af5f7 100644 +--- a/include/asm-generic/preempt.h ++++ b/include/asm-generic/preempt.h +@@ -29,7 +29,7 @@ static __always_inline void preempt_count_set(int pc) + } while (0) + + #define init_idle_preempt_count(p, cpu) do { \ +- task_thread_info(p)->preempt_count = PREEMPT_ENABLED; \ ++ task_thread_info(p)->preempt_count = PREEMPT_DISABLED; \ + } while (0) + + static __always_inline void set_preempt_need_resched(void) +diff --git a/init/main.c b/init/main.c +index 5bd1a25f1d6f..c97d3c0247a1 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -918,11 +918,7 @@ asmlinkage __visible void __init __no_sanitize_address start_kernel(void) + * time - but meanwhile we still have a functioning scheduler. + */ + sched_init(); +- /* +- * Disable preemption - early bootup scheduling is extremely +- * fragile until we cpu_idle() for the first time. +- */ +- preempt_disable(); ++ + if (WARN(!irqs_disabled(), + "Interrupts were enabled *very* early, fixing it\n")) + local_irq_disable(); +diff --git a/kernel/fork.c b/kernel/fork.c +index 321a5e31d817..2654a5a9e5df 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -2405,7 +2405,7 @@ static inline void init_idle_pids(struct task_struct *idle) + } + } + +-struct task_struct *fork_idle(int cpu) ++struct task_struct * __init fork_idle(int cpu) + { + struct task_struct *task; + struct kernel_clone_args args = { +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 814200541f8f..e25b2d8ec18d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -7428,7 +7428,7 @@ void show_state_filter(unsigned long state_filter) + * NOTE: this function does not set the idle thread's NEED_RESCHED + * flag, to make booting more robust. + */ +-void init_idle(struct task_struct *idle, int cpu) ++void __init init_idle(struct task_struct *idle, int cpu) + { + struct rq *rq = cpu_rq(cpu); + unsigned long flags; +diff --git a/kernel/smpboot.c b/kernel/smpboot.c +index f25208e8df83..e4163042c4d6 100644 +--- a/kernel/smpboot.c ++++ b/kernel/smpboot.c +@@ -33,7 +33,6 @@ struct task_struct *idle_thread_get(unsigned int cpu) + + if (!tsk) + return ERR_PTR(-ENOMEM); +- init_idle(tsk, cpu); + return tsk; + } + +-- +2.30.2 + diff --git a/queue-5.12/sched-don-t-defer-cpu-pick-to-migration_cpu_stop.patch b/queue-5.12/sched-don-t-defer-cpu-pick-to-migration_cpu_stop.patch new file mode 100644 index 00000000000..7dc38ce32df --- /dev/null +++ b/queue-5.12/sched-don-t-defer-cpu-pick-to-migration_cpu_stop.patch @@ -0,0 +1,100 @@ +From 35e646bc0b85ba5431b7d6fe2499e8ae2fa0565d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 21:57:50 +0100 +Subject: sched: Don't defer CPU pick to migration_cpu_stop() + +From: Valentin Schneider + +[ Upstream commit 475ea6c60279e9f2ddf7e4cf2648cd8ae0608361 ] + +Will reported that the 'XXX __migrate_task() can fail' in migration_cpu_stop() +can happen, and it *is* sort of a big deal. Looking at it some more, one +will note there is a glaring hole in the deferred CPU selection: + + (w/ CONFIG_CPUSET=n, so that the affinity mask passed via taskset doesn't + get AND'd with cpu_online_mask) + + $ taskset -pc 0-2 $PID + # offline CPUs 3-4 + $ taskset -pc 3-5 $PID + `\ + $PID may stay on 0-2 due to the cpumask_any_distribute() picking an + offline CPU and __migrate_task() refusing to do anything due to + cpu_is_allowed(). + +set_cpus_allowed_ptr() goes to some length to pick a dest_cpu that matches +the right constraints vs affinity and the online/active state of the +CPUs. Reuse that instead of discarding it in the affine_move_task() case. + +Fixes: 6d337eab041d ("sched: Fix migrate_disable() vs set_cpus_allowed_ptr()") +Reported-by: Will Deacon +Signed-off-by: Valentin Schneider +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210526205751.842360-2-valentin.schneider@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index f59166fe499a..fe5da692dd7a 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1919,7 +1919,6 @@ static int migration_cpu_stop(void *data) + struct migration_arg *arg = data; + struct set_affinity_pending *pending = arg->pending; + struct task_struct *p = arg->task; +- int dest_cpu = arg->dest_cpu; + struct rq *rq = this_rq(); + bool complete = false; + struct rq_flags rf; +@@ -1952,19 +1951,15 @@ static int migration_cpu_stop(void *data) + if (p->migration_pending == pending) + p->migration_pending = NULL; + complete = true; +- } + +- if (dest_cpu < 0) { + if (cpumask_test_cpu(task_cpu(p), &p->cpus_mask)) + goto out; +- +- dest_cpu = cpumask_any_distribute(&p->cpus_mask); + } + + if (task_on_rq_queued(p)) +- rq = __migrate_task(rq, &rf, p, dest_cpu); ++ rq = __migrate_task(rq, &rf, p, arg->dest_cpu); + else +- p->wake_cpu = dest_cpu; ++ p->wake_cpu = arg->dest_cpu; + + /* + * XXX __migrate_task() can fail, at which point we might end +@@ -2243,7 +2238,7 @@ static int affine_move_task(struct rq *rq, struct task_struct *p, struct rq_flag + init_completion(&my_pending.done); + my_pending.arg = (struct migration_arg) { + .task = p, +- .dest_cpu = -1, /* any */ ++ .dest_cpu = dest_cpu, + .pending = &my_pending, + }; + +@@ -2251,6 +2246,15 @@ static int affine_move_task(struct rq *rq, struct task_struct *p, struct rq_flag + } else { + pending = p->migration_pending; + refcount_inc(&pending->refs); ++ /* ++ * Affinity has changed, but we've already installed a ++ * pending. migration_cpu_stop() *must* see this, else ++ * we risk a completion of the pending despite having a ++ * task on a disallowed CPU. ++ * ++ * Serialized by p->pi_lock, so this is safe. ++ */ ++ pending->arg.dest_cpu = dest_cpu; + } + } + pending = p->migration_pending; +-- +2.30.2 + diff --git a/queue-5.12/sched-fair-fix-ascii-art-by-relpacing-tabs.patch b/queue-5.12/sched-fair-fix-ascii-art-by-relpacing-tabs.patch new file mode 100644 index 00000000000..4ed05ffc9a8 --- /dev/null +++ b/queue-5.12/sched-fair-fix-ascii-art-by-relpacing-tabs.patch @@ -0,0 +1,65 @@ +From 5ed0b04995d0c218b2d0374dd37cc53bd0f76275 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 14:52:02 +0200 +Subject: sched/fair: Fix ascii art by relpacing tabs + +From: Odin Ugedal + +[ Upstream commit 08f7c2f4d0e9f4283f5796b8168044c034a1bfcb ] + +When using something other than 8 spaces per tab, this ascii art +makes not sense, and the reader might end up wondering what this +advanced equation "is". + +Signed-off-by: Odin Ugedal +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Vincent Guittot +Link: https://lkml.kernel.org/r/20210518125202.78658-4-odin@uged.al +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 47fcc3fe9dc5..272c583fc167 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -3134,7 +3134,7 @@ void reweight_task(struct task_struct *p, int prio) + * + * tg->weight * grq->load.weight + * ge->load.weight = ----------------------------- (1) +- * \Sum grq->load.weight ++ * \Sum grq->load.weight + * + * Now, because computing that sum is prohibitively expensive to compute (been + * there, done that) we approximate it with this average stuff. The average +@@ -3148,7 +3148,7 @@ void reweight_task(struct task_struct *p, int prio) + * + * tg->weight * grq->avg.load_avg + * ge->load.weight = ------------------------------ (3) +- * tg->load_avg ++ * tg->load_avg + * + * Where: tg->load_avg ~= \Sum grq->avg.load_avg + * +@@ -3164,7 +3164,7 @@ void reweight_task(struct task_struct *p, int prio) + * + * tg->weight * grq->load.weight + * ge->load.weight = ----------------------------- = tg->weight (4) +- * grp->load.weight ++ * grp->load.weight + * + * That is, the sum collapses because all other CPUs are idle; the UP scenario. + * +@@ -3183,7 +3183,7 @@ void reweight_task(struct task_struct *p, int prio) + * + * tg->weight * grq->load.weight + * ge->load.weight = ----------------------------- (6) +- * tg_load_avg' ++ * tg_load_avg' + * + * Where: + * +-- +2.30.2 + diff --git a/queue-5.12/sched-fair-take-thermal-pressure-into-account-while-.patch b/queue-5.12/sched-fair-take-thermal-pressure-into-account-while-.patch new file mode 100644 index 00000000000..5527a233fa6 --- /dev/null +++ b/queue-5.12/sched-fair-take-thermal-pressure-into-account-while-.patch @@ -0,0 +1,93 @@ +From cb0d0673d27d372030b94d8fdeba572fa321083f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 20:11:28 +0100 +Subject: sched/fair: Take thermal pressure into account while estimating + energy + +From: Lukasz Luba + +[ Upstream commit 489f16459e0008c7a5c4c5af34bd80898aa82c2d ] + +Energy Aware Scheduling (EAS) needs to be able to predict the frequency +requests made by the SchedUtil governor to properly estimate energy used +in the future. It has to take into account CPUs utilization and forecast +Performance Domain (PD) frequency. There is a corner case when the max +allowed frequency might be reduced due to thermal. SchedUtil is aware of +that reduced frequency, so it should be taken into account also in EAS +estimations. + +SchedUtil, as a CPUFreq governor, knows the maximum allowed frequency of +a CPU, thanks to cpufreq_driver_resolve_freq() and internal clamping +to 'policy::max'. SchedUtil is responsible to respect that upper limit +while setting the frequency through CPUFreq drivers. This effective +frequency is stored internally in 'sugov_policy::next_freq' and EAS has +to predict that value. + +In the existing code the raw value of arch_scale_cpu_capacity() is used +for clamping the returned CPU utilization from effective_cpu_util(). +This patch fixes issue with too big single CPU utilization, by introducing +clamping to the allowed CPU capacity. The allowed CPU capacity is a CPU +capacity reduced by thermal pressure raw value. + +Thanks to knowledge about allowed CPU capacity, we don't get too big value +for a single CPU utilization, which is then added to the util sum. The +util sum is used as a source of information for estimating whole PD energy. +To avoid wrong energy estimation in EAS (due to capped frequency), make +sure that the calculation of util sum is aware of allowed CPU capacity. + +This thermal pressure might be visible in scenarios where the CPUs are not +heavily loaded, but some other component (like GPU) drastically reduced +available power budget and increased the SoC temperature. Thus, we still +use EAS for task placement and CPUs are not over-utilized. + +Signed-off-by: Lukasz Luba +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Vincent Guittot +Reviewed-by: Dietmar Eggemann +Link: https://lore.kernel.org/r/20210614191128.22735-1-lukasz.luba@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 272c583fc167..20ac5dff9a0c 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -6564,8 +6564,11 @@ compute_energy(struct task_struct *p, int dst_cpu, struct perf_domain *pd) + struct cpumask *pd_mask = perf_domain_span(pd); + unsigned long cpu_cap = arch_scale_cpu_capacity(cpumask_first(pd_mask)); + unsigned long max_util = 0, sum_util = 0; ++ unsigned long _cpu_cap = cpu_cap; + int cpu; + ++ _cpu_cap -= arch_scale_thermal_pressure(cpumask_first(pd_mask)); ++ + /* + * The capacity state of CPUs of the current rd can be driven by CPUs + * of another rd if they belong to the same pd. So, account for the +@@ -6601,8 +6604,10 @@ compute_energy(struct task_struct *p, int dst_cpu, struct perf_domain *pd) + * is already enough to scale the EM reported power + * consumption at the (eventually clamped) cpu_capacity. + */ +- sum_util += effective_cpu_util(cpu, util_running, cpu_cap, +- ENERGY_UTIL, NULL); ++ cpu_util = effective_cpu_util(cpu, util_running, cpu_cap, ++ ENERGY_UTIL, NULL); ++ ++ sum_util += min(cpu_util, _cpu_cap); + + /* + * Performance domain frequency: utilization clamping +@@ -6613,7 +6618,7 @@ compute_energy(struct task_struct *p, int dst_cpu, struct perf_domain *pd) + */ + cpu_util = effective_cpu_util(cpu, util_freq, cpu_cap, + FREQUENCY_UTIL, tsk); +- max_util = max(max_util, cpu_util); ++ max_util = max(max_util, min(cpu_util, _cpu_cap)); + } + + return em_cpu_energy(pd->em_pd, max_util, sum_util); +-- +2.30.2 + diff --git a/queue-5.12/sched-make-the-idle-task-quack-like-a-per-cpu-kthrea.patch b/queue-5.12/sched-make-the-idle-task-quack-like-a-per-cpu-kthrea.patch new file mode 100644 index 00000000000..28267ee4e7a --- /dev/null +++ b/queue-5.12/sched-make-the-idle-task-quack-like-a-per-cpu-kthrea.patch @@ -0,0 +1,144 @@ +From 17a17f9dd58e6a4b84e5c12bd85e9e0d24d1bd5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 16:10:23 +0100 +Subject: sched: Make the idle task quack like a per-CPU kthread + +From: Valentin Schneider + +[ Upstream commit 00b89fe0197f0c55a045775c11553c0cdb7082fe ] + +For all intents and purposes, the idle task is a per-CPU kthread. It isn't +created via the same route as other pcpu kthreads however, and as a result +it is missing a few bells and whistles: it fails kthread_is_per_cpu() and +it doesn't have PF_NO_SETAFFINITY set. + +Fix the former by giving the idle task a kthread struct along with the +KTHREAD_IS_PER_CPU flag. This requires some extra iffery as init_idle() +call be called more than once on the same idle task. + +Signed-off-by: Valentin Schneider +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210510151024.2448573-2-valentin.schneider@arm.com +Signed-off-by: Sasha Levin +--- + include/linux/kthread.h | 2 ++ + kernel/kthread.c | 30 ++++++++++++++++++------------ + kernel/sched/core.c | 21 +++++++++++++++------ + 3 files changed, 35 insertions(+), 18 deletions(-) + +diff --git a/include/linux/kthread.h b/include/linux/kthread.h +index 2484ed97e72f..d9133d6db308 100644 +--- a/include/linux/kthread.h ++++ b/include/linux/kthread.h +@@ -33,6 +33,8 @@ struct task_struct *kthread_create_on_cpu(int (*threadfn)(void *data), + unsigned int cpu, + const char *namefmt); + ++void set_kthread_struct(struct task_struct *p); ++ + void kthread_set_per_cpu(struct task_struct *k, int cpu); + bool kthread_is_per_cpu(struct task_struct *k); + +diff --git a/kernel/kthread.c b/kernel/kthread.c +index 4fdf2bd9b558..e8da89c714f5 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -68,16 +68,6 @@ enum KTHREAD_BITS { + KTHREAD_SHOULD_PARK, + }; + +-static inline void set_kthread_struct(void *kthread) +-{ +- /* +- * We abuse ->set_child_tid to avoid the new member and because it +- * can't be wrongly copied by copy_process(). We also rely on fact +- * that the caller can't exec, so PF_KTHREAD can't be cleared. +- */ +- current->set_child_tid = (__force void __user *)kthread; +-} +- + static inline struct kthread *to_kthread(struct task_struct *k) + { + WARN_ON(!(k->flags & PF_KTHREAD)); +@@ -103,6 +93,22 @@ static inline struct kthread *__to_kthread(struct task_struct *p) + return kthread; + } + ++void set_kthread_struct(struct task_struct *p) ++{ ++ struct kthread *kthread; ++ ++ if (__to_kthread(p)) ++ return; ++ ++ kthread = kzalloc(sizeof(*kthread), GFP_KERNEL); ++ /* ++ * We abuse ->set_child_tid to avoid the new member and because it ++ * can't be wrongly copied by copy_process(). We also rely on fact ++ * that the caller can't exec, so PF_KTHREAD can't be cleared. ++ */ ++ p->set_child_tid = (__force void __user *)kthread; ++} ++ + void free_kthread_struct(struct task_struct *k) + { + struct kthread *kthread; +@@ -272,8 +278,8 @@ static int kthread(void *_create) + struct kthread *self; + int ret; + +- self = kzalloc(sizeof(*self), GFP_KERNEL); +- set_kthread_struct(self); ++ set_kthread_struct(current); ++ self = to_kthread(current); + + /* If user was SIGKILLed, I release the structure. */ + done = xchg(&create->done, NULL); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index e25b2d8ec18d..17f612045271 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -7435,12 +7435,25 @@ void __init init_idle(struct task_struct *idle, int cpu) + + __sched_fork(0, idle); + ++ /* ++ * The idle task doesn't need the kthread struct to function, but it ++ * is dressed up as a per-CPU kthread and thus needs to play the part ++ * if we want to avoid special-casing it in code that deals with per-CPU ++ * kthreads. ++ */ ++ set_kthread_struct(idle); ++ + raw_spin_lock_irqsave(&idle->pi_lock, flags); + raw_spin_lock(&rq->lock); + + idle->state = TASK_RUNNING; + idle->se.exec_start = sched_clock(); +- idle->flags |= PF_IDLE; ++ /* ++ * PF_KTHREAD should already be set at this point; regardless, make it ++ * look like a proper per-CPU kthread. ++ */ ++ idle->flags |= PF_IDLE | PF_KTHREAD | PF_NO_SETAFFINITY; ++ kthread_set_per_cpu(idle, cpu); + + scs_task_reset(idle); + kasan_unpoison_task_stack(idle); +@@ -7647,12 +7660,8 @@ static void balance_push(struct rq *rq) + /* + * Both the cpu-hotplug and stop task are in this case and are + * required to complete the hotplug process. +- * +- * XXX: the idle task does not match kthread_is_per_cpu() due to +- * histerical raisins. + */ +- if (rq->idle == push_task || +- kthread_is_per_cpu(push_task) || ++ if (kthread_is_per_cpu(push_task) || + is_migration_disabled(push_task)) { + + /* +-- +2.30.2 + diff --git a/queue-5.12/sched-rt-fix-deadline-utilization-tracking-during-po.patch b/queue-5.12/sched-rt-fix-deadline-utilization-tracking-during-po.patch new file mode 100644 index 00000000000..caead032672 --- /dev/null +++ b/queue-5.12/sched-rt-fix-deadline-utilization-tracking-during-po.patch @@ -0,0 +1,53 @@ +From eed3e92cfed24adf6b2cac0adcc398dd38dd43af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 11:37:52 +0100 +Subject: sched/rt: Fix Deadline utilization tracking during policy change + +From: Vincent Donnefort + +[ Upstream commit d7d607096ae6d378b4e92d49946d22739c047d4c ] + +DL keeps track of the utilization on a per-rq basis with the structure +avg_dl. This utilization is updated during task_tick_dl(), +put_prev_task_dl() and set_next_task_dl(). However, when the current +running task changes its policy, set_next_task_dl() which would usually +take care of updating the utilization when the rq starts running DL +tasks, will not see a such change, leaving the avg_dl structure outdated. +When that very same task will be dequeued later, put_prev_task_dl() will +then update the utilization, based on a wrong last_update_time, leading to +a huge spike in the DL utilization signal. + +The signal would eventually recover from this issue after few ms. Even +if no DL tasks are run, avg_dl is also updated in +__update_blocked_others(). But as the CPU capacity depends partly on the +avg_dl, this issue has nonetheless a significant impact on the scheduler. + +Fix this issue by ensuring a load update when a running task changes +its policy to DL. + +Fixes: 3727e0e ("sched/dl: Add dl_rq utilization tracking") +Signed-off-by: Vincent Donnefort +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Vincent Guittot +Link: https://lore.kernel.org/r/1624271872-211872-3-git-send-email-vincent.donnefort@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/deadline.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index aac3539aa0fe..78b3bdcb84c1 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -2486,6 +2486,8 @@ static void switched_to_dl(struct rq *rq, struct task_struct *p) + check_preempt_curr_dl(rq, p, 0); + else + resched_curr(rq); ++ } else { ++ update_dl_rq_load_avg(rq_clock_pelt(rq), rq, 0); + } + } + +-- +2.30.2 + diff --git a/queue-5.12/sched-rt-fix-rt-utilization-tracking-during-policy-c.patch b/queue-5.12/sched-rt-fix-rt-utilization-tracking-during-policy-c.patch new file mode 100644 index 00000000000..22d2a6ea027 --- /dev/null +++ b/queue-5.12/sched-rt-fix-rt-utilization-tracking-during-policy-c.patch @@ -0,0 +1,70 @@ +From 83e3b34d8205d44e050ca93ab086a0c8c90093b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 11:37:51 +0100 +Subject: sched/rt: Fix RT utilization tracking during policy change + +From: Vincent Donnefort + +[ Upstream commit fecfcbc288e9f4923f40fd23ca78a6acdc7fdf6c ] + +RT keeps track of the utilization on a per-rq basis with the structure +avg_rt. This utilization is updated during task_tick_rt(), +put_prev_task_rt() and set_next_task_rt(). However, when the current +running task changes its policy, set_next_task_rt() which would usually +take care of updating the utilization when the rq starts running RT tasks, +will not see a such change, leaving the avg_rt structure outdated. When +that very same task will be dequeued later, put_prev_task_rt() will then +update the utilization, based on a wrong last_update_time, leading to a +huge spike in the RT utilization signal. + +The signal would eventually recover from this issue after few ms. Even if +no RT tasks are run, avg_rt is also updated in __update_blocked_others(). +But as the CPU capacity depends partly on the avg_rt, this issue has +nonetheless a significant impact on the scheduler. + +Fix this issue by ensuring a load update when a running task changes +its policy to RT. + +Fixes: 371bf427 ("sched/rt: Add rt_rq utilization tracking") +Signed-off-by: Vincent Donnefort +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Vincent Guittot +Link: https://lore.kernel.org/r/1624271872-211872-2-git-send-email-vincent.donnefort@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/rt.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 8f720b71d13d..e617287052d5 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -2331,13 +2331,20 @@ void __init init_sched_rt_class(void) + static void switched_to_rt(struct rq *rq, struct task_struct *p) + { + /* +- * If we are already running, then there's nothing +- * that needs to be done. But if we are not running +- * we may need to preempt the current running task. +- * If that current running task is also an RT task ++ * If we are running, update the avg_rt tracking, as the running time ++ * will now on be accounted into the latter. ++ */ ++ if (task_current(rq, p)) { ++ update_rt_rq_load_avg(rq_clock_pelt(rq), rq, 0); ++ return; ++ } ++ ++ /* ++ * If we are not running we may need to preempt the current ++ * running task. If that current running task is also an RT task + * then see if we can move to another run queue. + */ +- if (task_on_rq_queued(p) && rq->curr != p) { ++ if (task_on_rq_queued(p)) { + #ifdef CONFIG_SMP + if (p->nr_cpus_allowed > 1 && rq->rt.overloaded) + rt_queue_push_tasks(rq); +-- +2.30.2 + diff --git a/queue-5.12/sched-uclamp-fix-locking-around-cpu_util_update_eff.patch b/queue-5.12/sched-uclamp-fix-locking-around-cpu_util_update_eff.patch new file mode 100644 index 00000000000..912a8f16931 --- /dev/null +++ b/queue-5.12/sched-uclamp-fix-locking-around-cpu_util_update_eff.patch @@ -0,0 +1,61 @@ +From e860e85bf8de5ecb1b191c96055a1ccb48f09b10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 15:50:32 +0100 +Subject: sched/uclamp: Fix locking around cpu_util_update_eff() + +From: Qais Yousef + +[ Upstream commit 93b73858701fd01de26a4a874eb95f9b7156fd4b ] + +cpu_cgroup_css_online() calls cpu_util_update_eff() without holding the +uclamp_mutex or rcu_read_lock() like other call sites, which is +a mistake. + +The uclamp_mutex is required to protect against concurrent reads and +writes that could update the cgroup hierarchy. + +The rcu_read_lock() is required to traverse the cgroup data structures +in cpu_util_update_eff(). + +Surround the caller with the required locks and add some asserts to +better document the dependency in cpu_util_update_eff(). + +Fixes: 7226017ad37a ("sched/uclamp: Fix a bug in propagating uclamp value in new cgroups") +Reported-by: Quentin Perret +Signed-off-by: Qais Yousef +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210510145032.1934078-3-qais.yousef@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 3fe7daf9d31d..f59166fe499a 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -8693,7 +8693,11 @@ static int cpu_cgroup_css_online(struct cgroup_subsys_state *css) + + #ifdef CONFIG_UCLAMP_TASK_GROUP + /* Propagate the effective uclamp value for the new group */ ++ mutex_lock(&uclamp_mutex); ++ rcu_read_lock(); + cpu_util_update_eff(css); ++ rcu_read_unlock(); ++ mutex_unlock(&uclamp_mutex); + #endif + + return 0; +@@ -8783,6 +8787,9 @@ static void cpu_util_update_eff(struct cgroup_subsys_state *css) + enum uclamp_id clamp_id; + unsigned int clamps; + ++ lockdep_assert_held(&uclamp_mutex); ++ SCHED_WARN_ON(!rcu_read_lock_held()); ++ + css_for_each_descendant_pre(css, top_css) { + uc_parent = css_tg(css)->parent + ? css_tg(css)->parent->uclamp : NULL; +-- +2.30.2 + diff --git a/queue-5.12/sched-uclamp-fix-uclamp_tg_restrict.patch b/queue-5.12/sched-uclamp-fix-uclamp_tg_restrict.patch new file mode 100644 index 00000000000..fac7529a115 --- /dev/null +++ b/queue-5.12/sched-uclamp-fix-uclamp_tg_restrict.patch @@ -0,0 +1,188 @@ +From 2cb6539a843bdab38f6515f9550412c7e72143c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 17:51:55 +0100 +Subject: sched/uclamp: Fix uclamp_tg_restrict() + +From: Qais Yousef + +[ Upstream commit 0213b7083e81f4acd69db32cb72eb4e5f220329a ] + +Now cpu.uclamp.min acts as a protection, we need to make sure that the +uclamp request of the task is within the allowed range of the cgroup, +that is it is clamp()'ed correctly by tg->uclamp[UCLAMP_MIN] and +tg->uclamp[UCLAMP_MAX]. + +As reported by Xuewen [1] we can have some corner cases where there's +inversion between uclamp requested by task (p) and the uclamp values of +the taskgroup it's attached to (tg). Following table demonstrates +2 corner cases: + + | p | tg | effective + -----------+-----+------+----------- + CASE 1 + -----------+-----+------+----------- + uclamp_min | 60% | 0% | 60% + -----------+-----+------+----------- + uclamp_max | 80% | 50% | 50% + -----------+-----+------+----------- + CASE 2 + -----------+-----+------+----------- + uclamp_min | 0% | 30% | 30% + -----------+-----+------+----------- + uclamp_max | 20% | 50% | 20% + -----------+-----+------+----------- + +With this fix we get: + + | p | tg | effective + -----------+-----+------+----------- + CASE 1 + -----------+-----+------+----------- + uclamp_min | 60% | 0% | 50% + -----------+-----+------+----------- + uclamp_max | 80% | 50% | 50% + -----------+-----+------+----------- + CASE 2 + -----------+-----+------+----------- + uclamp_min | 0% | 30% | 30% + -----------+-----+------+----------- + uclamp_max | 20% | 50% | 30% + -----------+-----+------+----------- + +Additionally uclamp_update_active_tasks() must now unconditionally +update both UCLAMP_MIN/MAX because changing the tg's UCLAMP_MAX for +instance could have an impact on the effective UCLAMP_MIN of the tasks. + + | p | tg | effective + -----------+-----+------+----------- + old + -----------+-----+------+----------- + uclamp_min | 60% | 0% | 50% + -----------+-----+------+----------- + uclamp_max | 80% | 50% | 50% + -----------+-----+------+----------- + *new* + -----------+-----+------+----------- + uclamp_min | 60% | 0% | *60%* + -----------+-----+------+----------- + uclamp_max | 80% |*70%* | *70%* + -----------+-----+------+----------- + +[1] https://lore.kernel.org/lkml/CAB8ipk_a6VFNjiEnHRHkUMBKbA+qzPQvhtNjJ_YNzQhqV_o8Zw@mail.gmail.com/ + +Fixes: 0c18f2ecfcc2 ("sched/uclamp: Fix wrong implementation of cpu.uclamp.min") +Reported-by: Xuewen Yan +Signed-off-by: Qais Yousef +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210617165155.3774110-1-qais.yousef@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 49 +++++++++++++++++---------------------------- + 1 file changed, 18 insertions(+), 31 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index fe5da692dd7a..2b66c9a16cbe 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1055,8 +1055,10 @@ static void uclamp_sync_util_min_rt_default(void) + static inline struct uclamp_se + uclamp_tg_restrict(struct task_struct *p, enum uclamp_id clamp_id) + { ++ /* Copy by value as we could modify it */ + struct uclamp_se uc_req = p->uclamp_req[clamp_id]; + #ifdef CONFIG_UCLAMP_TASK_GROUP ++ unsigned int tg_min, tg_max, value; + + /* + * Tasks in autogroups or root task group will be +@@ -1067,23 +1069,11 @@ uclamp_tg_restrict(struct task_struct *p, enum uclamp_id clamp_id) + if (task_group(p) == &root_task_group) + return uc_req; + +- switch (clamp_id) { +- case UCLAMP_MIN: { +- struct uclamp_se uc_min = task_group(p)->uclamp[clamp_id]; +- if (uc_req.value < uc_min.value) +- return uc_min; +- break; +- } +- case UCLAMP_MAX: { +- struct uclamp_se uc_max = task_group(p)->uclamp[clamp_id]; +- if (uc_req.value > uc_max.value) +- return uc_max; +- break; +- } +- default: +- WARN_ON_ONCE(1); +- break; +- } ++ tg_min = task_group(p)->uclamp[UCLAMP_MIN].value; ++ tg_max = task_group(p)->uclamp[UCLAMP_MAX].value; ++ value = uc_req.value; ++ value = clamp(value, tg_min, tg_max); ++ uclamp_se_set(&uc_req, value, false); + #endif + + return uc_req; +@@ -1282,8 +1272,9 @@ static inline void uclamp_rq_dec(struct rq *rq, struct task_struct *p) + } + + static inline void +-uclamp_update_active(struct task_struct *p, enum uclamp_id clamp_id) ++uclamp_update_active(struct task_struct *p) + { ++ enum uclamp_id clamp_id; + struct rq_flags rf; + struct rq *rq; + +@@ -1303,9 +1294,11 @@ uclamp_update_active(struct task_struct *p, enum uclamp_id clamp_id) + * affecting a valid clamp bucket, the next time it's enqueued, + * it will already see the updated clamp bucket value. + */ +- if (p->uclamp[clamp_id].active) { +- uclamp_rq_dec_id(rq, p, clamp_id); +- uclamp_rq_inc_id(rq, p, clamp_id); ++ for_each_clamp_id(clamp_id) { ++ if (p->uclamp[clamp_id].active) { ++ uclamp_rq_dec_id(rq, p, clamp_id); ++ uclamp_rq_inc_id(rq, p, clamp_id); ++ } + } + + task_rq_unlock(rq, p, &rf); +@@ -1313,20 +1306,14 @@ uclamp_update_active(struct task_struct *p, enum uclamp_id clamp_id) + + #ifdef CONFIG_UCLAMP_TASK_GROUP + static inline void +-uclamp_update_active_tasks(struct cgroup_subsys_state *css, +- unsigned int clamps) ++uclamp_update_active_tasks(struct cgroup_subsys_state *css) + { +- enum uclamp_id clamp_id; + struct css_task_iter it; + struct task_struct *p; + + css_task_iter_start(css, 0, &it); +- while ((p = css_task_iter_next(&it))) { +- for_each_clamp_id(clamp_id) { +- if ((0x1 << clamp_id) & clamps) +- uclamp_update_active(p, clamp_id); +- } +- } ++ while ((p = css_task_iter_next(&it))) ++ uclamp_update_active(p); + css_task_iter_end(&it); + } + +@@ -8826,7 +8813,7 @@ static void cpu_util_update_eff(struct cgroup_subsys_state *css) + } + + /* Immediately update descendants RUNNABLE tasks */ +- uclamp_update_active_tasks(css, clamps); ++ uclamp_update_active_tasks(css); + } + } + +-- +2.30.2 + diff --git a/queue-5.12/sched-uclamp-fix-wrong-implementation-of-cpu.uclamp..patch b/queue-5.12/sched-uclamp-fix-wrong-implementation-of-cpu.uclamp..patch new file mode 100644 index 00000000000..26b325e46a8 --- /dev/null +++ b/queue-5.12/sched-uclamp-fix-wrong-implementation-of-cpu.uclamp..patch @@ -0,0 +1,116 @@ +From 19a02d613e21be1a5a57a5a827ee1101d7711ac5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 15:50:31 +0100 +Subject: sched/uclamp: Fix wrong implementation of cpu.uclamp.min + +From: Qais Yousef + +[ Upstream commit 0c18f2ecfcc274a4bcc1d122f79ebd4001c3b445 ] + +cpu.uclamp.min is a protection as described in cgroup-v2 Resource +Distribution Model + + Documentation/admin-guide/cgroup-v2.rst + +which means we try our best to preserve the minimum performance point of +tasks in this group. See full description of cpu.uclamp.min in the +cgroup-v2.rst. + +But the current implementation makes it a limit, which is not what was +intended. + +For example: + + tg->cpu.uclamp.min = 20% + + p0->uclamp[UCLAMP_MIN] = 0 + p1->uclamp[UCLAMP_MIN] = 50% + + Previous Behavior (limit): + + p0->effective_uclamp = 0 + p1->effective_uclamp = 20% + + New Behavior (Protection): + + p0->effective_uclamp = 20% + p1->effective_uclamp = 50% + +Which is inline with how protections should work. + +With this change the cgroup and per-task behaviors are the same, as +expected. + +Additionally, we remove the confusing relationship between cgroup and +!user_defined flag. + +We don't want for example RT tasks that are boosted by default to max to +change their boost value when they attach to a cgroup. If a cgroup wants +to limit the max performance point of tasks attached to it, then +cpu.uclamp.max must be set accordingly. + +Or if they want to set different boost value based on cgroup, then +sysctl_sched_util_clamp_min_rt_default must be used to NOT boost to max +and set the right cpu.uclamp.min for each group to let the RT tasks +obtain the desired boost value when attached to that group. + +As it stands the dependency on !user_defined flag adds an extra layer of +complexity that is not required now cpu.uclamp.min behaves properly as +a protection. + +The propagation model of effective cpu.uclamp.min in child cgroups as +implemented by cpu_util_update_eff() is still correct. The parent +protection sets an upper limit of what the child cgroups will +effectively get. + +Fixes: 3eac870a3247 (sched/uclamp: Use TG's clamps to restrict TASK's clamps) +Signed-off-by: Qais Yousef +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20210510145032.1934078-2-qais.yousef@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 17f612045271..3fe7daf9d31d 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1057,7 +1057,6 @@ uclamp_tg_restrict(struct task_struct *p, enum uclamp_id clamp_id) + { + struct uclamp_se uc_req = p->uclamp_req[clamp_id]; + #ifdef CONFIG_UCLAMP_TASK_GROUP +- struct uclamp_se uc_max; + + /* + * Tasks in autogroups or root task group will be +@@ -1068,9 +1067,23 @@ uclamp_tg_restrict(struct task_struct *p, enum uclamp_id clamp_id) + if (task_group(p) == &root_task_group) + return uc_req; + +- uc_max = task_group(p)->uclamp[clamp_id]; +- if (uc_req.value > uc_max.value || !uc_req.user_defined) +- return uc_max; ++ switch (clamp_id) { ++ case UCLAMP_MIN: { ++ struct uclamp_se uc_min = task_group(p)->uclamp[clamp_id]; ++ if (uc_req.value < uc_min.value) ++ return uc_min; ++ break; ++ } ++ case UCLAMP_MAX: { ++ struct uclamp_se uc_max = task_group(p)->uclamp[clamp_id]; ++ if (uc_req.value > uc_max.value) ++ return uc_max; ++ break; ++ } ++ default: ++ WARN_ON_ONCE(1); ++ break; ++ } + #endif + + return uc_req; +-- +2.30.2 + diff --git a/queue-5.12/scsi-flashpoint-rename-si_flags-field.patch b/queue-5.12/scsi-flashpoint-rename-si_flags-field.patch new file mode 100644 index 00000000000..6ab15a1bbf7 --- /dev/null +++ b/queue-5.12/scsi-flashpoint-rename-si_flags-field.patch @@ -0,0 +1,163 @@ +From 3b218cd1be3cdc6e3d111d7f5684fa4d0bb8ee15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 May 2021 16:48:57 -0700 +Subject: scsi: FlashPoint: Rename si_flags field + +From: Randy Dunlap + +[ Upstream commit 4d431153e751caa93f3b7e6f6313446974e92253 ] + +The BusLogic driver has build errors on ia64 due to a name collision (in +the #included FlashPoint.c file). Rename the struct field in struct +sccb_mgr_info from si_flags to si_mflags (manager flags) to mend the build. + +This is the first problem. There are 50+ others after this one: + +In file included from ../include/uapi/linux/signal.h:6, + from ../include/linux/signal_types.h:10, + from ../include/linux/sched.h:29, + from ../include/linux/hardirq.h:9, + from ../include/linux/interrupt.h:11, + from ../drivers/scsi/BusLogic.c:27: +../arch/ia64/include/uapi/asm/siginfo.h:15:27: error: expected ':', ',', ';', '}' or '__attribute__' before '.' token + 15 | #define si_flags _sifields._sigfault._flags + | ^ +../drivers/scsi/FlashPoint.c:43:6: note: in expansion of macro 'si_flags' + 43 | u16 si_flags; + | ^~~~~~~~ +In file included from ../drivers/scsi/BusLogic.c:51: +../drivers/scsi/FlashPoint.c: In function 'FlashPoint_ProbeHostAdapter': +../drivers/scsi/FlashPoint.c:1076:11: error: 'struct sccb_mgr_info' has no member named '_sifields' + 1076 | pCardInfo->si_flags = 0x0000; + | ^~ +../drivers/scsi/FlashPoint.c:1079:12: error: 'struct sccb_mgr_info' has no member named '_sifields' + +Link: https://lore.kernel.org/r/20210529234857.6870-1-rdunlap@infradead.org +Fixes: 391e2f25601e ("[SCSI] BusLogic: Port driver to 64-bit.") +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: Christoph Hellwig +Cc: Jens Axboe +Cc: Hannes Reinecke +Cc: Khalid Aziz +Cc: Khalid Aziz +Reported-by: kernel test robot +Reviewed-by: Hannes Reinecke +Signed-off-by: Randy Dunlap +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/FlashPoint.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/scsi/FlashPoint.c b/drivers/scsi/FlashPoint.c +index 24ace1824048..ec8a621d232d 100644 +--- a/drivers/scsi/FlashPoint.c ++++ b/drivers/scsi/FlashPoint.c +@@ -40,7 +40,7 @@ struct sccb_mgr_info { + u16 si_per_targ_ultra_nego; + u16 si_per_targ_no_disc; + u16 si_per_targ_wide_nego; +- u16 si_flags; ++ u16 si_mflags; + unsigned char si_card_family; + unsigned char si_bustype; + unsigned char si_card_model[3]; +@@ -1073,22 +1073,22 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo) + ScamFlg = + (unsigned char)FPT_utilEERead(ioport, SCAM_CONFIG / 2); + +- pCardInfo->si_flags = 0x0000; ++ pCardInfo->si_mflags = 0x0000; + + if (i & 0x01) +- pCardInfo->si_flags |= SCSI_PARITY_ENA; ++ pCardInfo->si_mflags |= SCSI_PARITY_ENA; + + if (!(i & 0x02)) +- pCardInfo->si_flags |= SOFT_RESET; ++ pCardInfo->si_mflags |= SOFT_RESET; + + if (i & 0x10) +- pCardInfo->si_flags |= EXTENDED_TRANSLATION; ++ pCardInfo->si_mflags |= EXTENDED_TRANSLATION; + + if (ScamFlg & SCAM_ENABLED) +- pCardInfo->si_flags |= FLAG_SCAM_ENABLED; ++ pCardInfo->si_mflags |= FLAG_SCAM_ENABLED; + + if (ScamFlg & SCAM_LEVEL2) +- pCardInfo->si_flags |= FLAG_SCAM_LEVEL2; ++ pCardInfo->si_mflags |= FLAG_SCAM_LEVEL2; + + j = (RD_HARPOON(ioport + hp_bm_ctrl) & ~SCSI_TERM_ENA_L); + if (i & 0x04) { +@@ -1104,7 +1104,7 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo) + + if (!(RD_HARPOON(ioport + hp_page_ctrl) & NARROW_SCSI_CARD)) + +- pCardInfo->si_flags |= SUPPORT_16TAR_32LUN; ++ pCardInfo->si_mflags |= SUPPORT_16TAR_32LUN; + + pCardInfo->si_card_family = HARPOON_FAMILY; + pCardInfo->si_bustype = BUSTYPE_PCI; +@@ -1140,15 +1140,15 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo) + + if (pCardInfo->si_card_model[1] == '3') { + if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7)) +- pCardInfo->si_flags |= LOW_BYTE_TERM; ++ pCardInfo->si_mflags |= LOW_BYTE_TERM; + } else if (pCardInfo->si_card_model[2] == '0') { + temp = RD_HARPOON(ioport + hp_xfer_pad); + WR_HARPOON(ioport + hp_xfer_pad, (temp & ~BIT(4))); + if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7)) +- pCardInfo->si_flags |= LOW_BYTE_TERM; ++ pCardInfo->si_mflags |= LOW_BYTE_TERM; + WR_HARPOON(ioport + hp_xfer_pad, (temp | BIT(4))); + if (RD_HARPOON(ioport + hp_ee_ctrl) & BIT(7)) +- pCardInfo->si_flags |= HIGH_BYTE_TERM; ++ pCardInfo->si_mflags |= HIGH_BYTE_TERM; + WR_HARPOON(ioport + hp_xfer_pad, temp); + } else { + temp = RD_HARPOON(ioport + hp_ee_ctrl); +@@ -1166,9 +1166,9 @@ static int FlashPoint_ProbeHostAdapter(struct sccb_mgr_info *pCardInfo) + WR_HARPOON(ioport + hp_ee_ctrl, temp); + WR_HARPOON(ioport + hp_xfer_pad, temp2); + if (!(temp3 & BIT(7))) +- pCardInfo->si_flags |= LOW_BYTE_TERM; ++ pCardInfo->si_mflags |= LOW_BYTE_TERM; + if (!(temp3 & BIT(6))) +- pCardInfo->si_flags |= HIGH_BYTE_TERM; ++ pCardInfo->si_mflags |= HIGH_BYTE_TERM; + } + + ARAM_ACCESS(ioport); +@@ -1275,7 +1275,7 @@ static void *FlashPoint_HardwareResetHostAdapter(struct sccb_mgr_info + WR_HARPOON(ioport + hp_arb_id, pCardInfo->si_id); + CurrCard->ourId = pCardInfo->si_id; + +- i = (unsigned char)pCardInfo->si_flags; ++ i = (unsigned char)pCardInfo->si_mflags; + if (i & SCSI_PARITY_ENA) + WR_HARPOON(ioport + hp_portctrl_1, (HOST_MODE8 | CHK_SCSI_P)); + +@@ -1289,14 +1289,14 @@ static void *FlashPoint_HardwareResetHostAdapter(struct sccb_mgr_info + j |= SCSI_TERM_ENA_H; + WR_HARPOON(ioport + hp_ee_ctrl, j); + +- if (!(pCardInfo->si_flags & SOFT_RESET)) { ++ if (!(pCardInfo->si_mflags & SOFT_RESET)) { + + FPT_sresb(ioport, thisCard); + + FPT_scini(thisCard, pCardInfo->si_id, 0); + } + +- if (pCardInfo->si_flags & POST_ALL_UNDERRRUNS) ++ if (pCardInfo->si_mflags & POST_ALL_UNDERRRUNS) + CurrCard->globalFlags |= F_NO_FILTER; + + if (pCurrNvRam) { +-- +2.30.2 + diff --git a/queue-5.12/scsi-iscsi-fix-in-kernel-conn-failure-handling.patch b/queue-5.12/scsi-iscsi-fix-in-kernel-conn-failure-handling.patch new file mode 100644 index 00000000000..f05d3a72d0f --- /dev/null +++ b/queue-5.12/scsi-iscsi-fix-in-kernel-conn-failure-handling.patch @@ -0,0 +1,700 @@ +From 287e53b504f75da074d4a34210e625aded548e21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:18:00 -0500 +Subject: scsi: iscsi: Fix in-kernel conn failure handling + +From: Mike Christie + +[ Upstream commit 23d6fefbb3f6b1cc29794427588b470ed06ff64e ] + +Commit 0ab710458da1 ("scsi: iscsi: Perform connection failure entirely in +kernel space") has the following regressions/bugs that this patch fixes: + +1. It can return cmds to upper layers like dm-multipath where that can +retry them. After they are successful the fs/app can send new I/O to the +same sectors, but we've left the cmds running in FW or in the net layer. +We need to be calling ep_disconnect if userspace is not up. + +This patch only fixes the issue for offload drivers. iscsi_tcp will be +fixed in separate commit because it doesn't have a ep_disconnect call. + +2. The drivers that implement ep_disconnect expect that it's called before +conn_stop. Besides crashes, if the cleanup_task callout is called before +ep_disconnect it might free up driver/card resources for session1 then they +could be allocated for session2. But because the driver's ep_disconnect is +not called it has not cleaned up the firmware so the card is still using +the resources for the original cmd. + +3. The stop_conn_work_fn can run after userspace has done its recovery and +we are happily using the session. We will then end up with various bugs +depending on what is going on at the time. + +We may also run stop_conn_work_fn late after userspace has called stop_conn +and ep_disconnect and is now going to call start/bind conn. If +stop_conn_work_fn runs after bind but before start, we would leave the conn +in a unbound but sort of started state where IO might be allowed even +though the drivers have been set in a state where they no longer expect +I/O. + +4. Returning -EAGAIN in iscsi_if_destroy_conn if we haven't yet run the in +kernel stop_conn function is breaking userspace. We should have been doing +this for the caller. + +Link: https://lore.kernel.org/r/20210525181821.7617-8-michael.christie@oracle.com +Fixes: 0ab710458da1 ("scsi: iscsi: Perform connection failure entirely in kernel space") +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 471 ++++++++++++++++------------ + include/scsi/scsi_transport_iscsi.h | 10 +- + 2 files changed, 283 insertions(+), 198 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index bab6654d8ee9..b8a93e607891 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -86,15 +86,11 @@ struct iscsi_internal { + struct transport_container session_cont; + }; + +-/* Worker to perform connection failure on unresponsive connections +- * completely in kernel space. +- */ +-static void stop_conn_work_fn(struct work_struct *work); +-static DECLARE_WORK(stop_conn_work, stop_conn_work_fn); +- + static atomic_t iscsi_session_nr; /* sysfs session id for next new session */ + static struct workqueue_struct *iscsi_eh_timer_workq; + ++static struct workqueue_struct *iscsi_conn_cleanup_workq; ++ + static DEFINE_IDA(iscsi_sess_ida); + /* + * list of registered transports and lock that must +@@ -1623,12 +1619,6 @@ static DECLARE_TRANSPORT_CLASS(iscsi_connection_class, + static struct sock *nls; + static DEFINE_MUTEX(rx_queue_mutex); + +-/* +- * conn_mutex protects the {start,bind,stop,destroy}_conn from racing +- * against the kernel stop_connection recovery mechanism +- */ +-static DEFINE_MUTEX(conn_mutex); +- + static LIST_HEAD(sesslist); + static DEFINE_SPINLOCK(sesslock); + static LIST_HEAD(connlist); +@@ -2245,6 +2235,123 @@ void iscsi_remove_session(struct iscsi_cls_session *session) + } + EXPORT_SYMBOL_GPL(iscsi_remove_session); + ++static void iscsi_stop_conn(struct iscsi_cls_conn *conn, int flag) ++{ ++ ISCSI_DBG_TRANS_CONN(conn, "Stopping conn.\n"); ++ ++ switch (flag) { ++ case STOP_CONN_RECOVER: ++ conn->state = ISCSI_CONN_FAILED; ++ break; ++ case STOP_CONN_TERM: ++ conn->state = ISCSI_CONN_DOWN; ++ break; ++ default: ++ iscsi_cls_conn_printk(KERN_ERR, conn, "invalid stop flag %d\n", ++ flag); ++ return; ++ } ++ ++ conn->transport->stop_conn(conn, flag); ++ ISCSI_DBG_TRANS_CONN(conn, "Stopping conn done.\n"); ++} ++ ++static int iscsi_if_stop_conn(struct iscsi_transport *transport, ++ struct iscsi_uevent *ev) ++{ ++ int flag = ev->u.stop_conn.flag; ++ struct iscsi_cls_conn *conn; ++ ++ conn = iscsi_conn_lookup(ev->u.stop_conn.sid, ev->u.stop_conn.cid); ++ if (!conn) ++ return -EINVAL; ++ ++ ISCSI_DBG_TRANS_CONN(conn, "iscsi if conn stop.\n"); ++ /* ++ * If this is a termination we have to call stop_conn with that flag ++ * so the correct states get set. If we haven't run the work yet try to ++ * avoid the extra run. ++ */ ++ if (flag == STOP_CONN_TERM) { ++ cancel_work_sync(&conn->cleanup_work); ++ iscsi_stop_conn(conn, flag); ++ } else { ++ /* ++ * Figure out if it was the kernel or userspace initiating this. ++ */ ++ if (!test_and_set_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { ++ iscsi_stop_conn(conn, flag); ++ } else { ++ ISCSI_DBG_TRANS_CONN(conn, ++ "flush kernel conn cleanup.\n"); ++ flush_work(&conn->cleanup_work); ++ } ++ /* ++ * Only clear for recovery to avoid extra cleanup runs during ++ * termination. ++ */ ++ clear_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags); ++ } ++ ISCSI_DBG_TRANS_CONN(conn, "iscsi if conn stop done.\n"); ++ return 0; ++} ++ ++static void iscsi_ep_disconnect(struct iscsi_cls_conn *conn, bool is_active) ++{ ++ struct iscsi_cls_session *session = iscsi_conn_to_session(conn); ++ struct iscsi_endpoint *ep; ++ ++ ISCSI_DBG_TRANS_CONN(conn, "disconnect ep.\n"); ++ conn->state = ISCSI_CONN_FAILED; ++ ++ if (!conn->ep || !session->transport->ep_disconnect) ++ return; ++ ++ ep = conn->ep; ++ conn->ep = NULL; ++ ++ session->transport->unbind_conn(conn, is_active); ++ session->transport->ep_disconnect(ep); ++ ISCSI_DBG_TRANS_CONN(conn, "disconnect ep done.\n"); ++} ++ ++static void iscsi_cleanup_conn_work_fn(struct work_struct *work) ++{ ++ struct iscsi_cls_conn *conn = container_of(work, struct iscsi_cls_conn, ++ cleanup_work); ++ struct iscsi_cls_session *session = iscsi_conn_to_session(conn); ++ ++ mutex_lock(&conn->ep_mutex); ++ /* ++ * If we are not at least bound there is nothing for us to do. Userspace ++ * will do a ep_disconnect call if offload is used, but will not be ++ * doing a stop since there is nothing to clean up, so we have to clear ++ * the cleanup bit here. ++ */ ++ if (conn->state != ISCSI_CONN_BOUND && conn->state != ISCSI_CONN_UP) { ++ ISCSI_DBG_TRANS_CONN(conn, "Got error while conn is already failed. Ignoring.\n"); ++ clear_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags); ++ mutex_unlock(&conn->ep_mutex); ++ return; ++ } ++ ++ iscsi_ep_disconnect(conn, false); ++ ++ if (system_state != SYSTEM_RUNNING) { ++ /* ++ * If the user has set up for the session to never timeout ++ * then hang like they wanted. For all other cases fail right ++ * away since userspace is not going to relogin. ++ */ ++ if (session->recovery_tmo > 0) ++ session->recovery_tmo = 0; ++ } ++ ++ iscsi_stop_conn(conn, STOP_CONN_RECOVER); ++ mutex_unlock(&conn->ep_mutex); ++ ISCSI_DBG_TRANS_CONN(conn, "cleanup done.\n"); ++} ++ + void iscsi_free_session(struct iscsi_cls_session *session) + { + ISCSI_DBG_TRANS_SESSION(session, "Freeing session\n"); +@@ -2284,7 +2391,7 @@ iscsi_create_conn(struct iscsi_cls_session *session, int dd_size, uint32_t cid) + + mutex_init(&conn->ep_mutex); + INIT_LIST_HEAD(&conn->conn_list); +- INIT_LIST_HEAD(&conn->conn_list_err); ++ INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn); + conn->transport = transport; + conn->cid = cid; + conn->state = ISCSI_CONN_DOWN; +@@ -2341,7 +2448,6 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn) + + spin_lock_irqsave(&connlock, flags); + list_del(&conn->conn_list); +- list_del(&conn->conn_list_err); + spin_unlock_irqrestore(&connlock, flags); + + transport_unregister_device(&conn->dev); +@@ -2456,83 +2562,6 @@ int iscsi_offload_mesg(struct Scsi_Host *shost, + } + EXPORT_SYMBOL_GPL(iscsi_offload_mesg); + +-/* +- * This can be called without the rx_queue_mutex, if invoked by the kernel +- * stop work. But, in that case, it is guaranteed not to race with +- * iscsi_destroy by conn_mutex. +- */ +-static void iscsi_if_stop_conn(struct iscsi_cls_conn *conn, int flag) +-{ +- /* +- * It is important that this path doesn't rely on +- * rx_queue_mutex, otherwise, a thread doing allocation on a +- * start_session/start_connection could sleep waiting on a +- * writeback to a failed iscsi device, that cannot be recovered +- * because the lock is held. If we don't hold it here, the +- * kernel stop_conn_work_fn has a chance to stop the broken +- * session and resolve the allocation. +- * +- * Still, the user invoked .stop_conn() needs to be serialized +- * with stop_conn_work_fn by a private mutex. Not pretty, but +- * it works. +- */ +- mutex_lock(&conn_mutex); +- switch (flag) { +- case STOP_CONN_RECOVER: +- conn->state = ISCSI_CONN_FAILED; +- break; +- case STOP_CONN_TERM: +- conn->state = ISCSI_CONN_DOWN; +- break; +- default: +- iscsi_cls_conn_printk(KERN_ERR, conn, +- "invalid stop flag %d\n", flag); +- goto unlock; +- } +- +- conn->transport->stop_conn(conn, flag); +-unlock: +- mutex_unlock(&conn_mutex); +-} +- +-static void stop_conn_work_fn(struct work_struct *work) +-{ +- struct iscsi_cls_conn *conn, *tmp; +- unsigned long flags; +- LIST_HEAD(recovery_list); +- +- spin_lock_irqsave(&connlock, flags); +- if (list_empty(&connlist_err)) { +- spin_unlock_irqrestore(&connlock, flags); +- return; +- } +- list_splice_init(&connlist_err, &recovery_list); +- spin_unlock_irqrestore(&connlock, flags); +- +- list_for_each_entry_safe(conn, tmp, &recovery_list, conn_list_err) { +- uint32_t sid = iscsi_conn_get_sid(conn); +- struct iscsi_cls_session *session; +- +- session = iscsi_session_lookup(sid); +- if (session) { +- if (system_state != SYSTEM_RUNNING) { +- /* +- * If the user has set up for the session to +- * never timeout then hang like they wanted. +- * For all other cases fail right away since +- * userspace is not going to relogin. +- */ +- if (session->recovery_tmo > 0) +- session->recovery_tmo = 0; +- } +- +- iscsi_if_stop_conn(conn, STOP_CONN_RECOVER); +- } +- +- list_del_init(&conn->conn_list_err); +- } +-} +- + void iscsi_conn_error_event(struct iscsi_cls_conn *conn, enum iscsi_err error) + { + struct nlmsghdr *nlh; +@@ -2540,12 +2569,9 @@ void iscsi_conn_error_event(struct iscsi_cls_conn *conn, enum iscsi_err error) + struct iscsi_uevent *ev; + struct iscsi_internal *priv; + int len = nlmsg_total_size(sizeof(*ev)); +- unsigned long flags; + +- spin_lock_irqsave(&connlock, flags); +- list_add(&conn->conn_list_err, &connlist_err); +- spin_unlock_irqrestore(&connlock, flags); +- queue_work(system_unbound_wq, &stop_conn_work); ++ if (!test_and_set_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) ++ queue_work(iscsi_conn_cleanup_workq, &conn->cleanup_work); + + priv = iscsi_if_transport_lookup(conn->transport); + if (!priv) +@@ -2875,26 +2901,17 @@ static int + iscsi_if_destroy_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev) + { + struct iscsi_cls_conn *conn; +- unsigned long flags; + + conn = iscsi_conn_lookup(ev->u.d_conn.sid, ev->u.d_conn.cid); + if (!conn) + return -EINVAL; + +- spin_lock_irqsave(&connlock, flags); +- if (!list_empty(&conn->conn_list_err)) { +- spin_unlock_irqrestore(&connlock, flags); +- return -EAGAIN; +- } +- spin_unlock_irqrestore(&connlock, flags); +- ++ ISCSI_DBG_TRANS_CONN(conn, "Flushing cleanup during destruction\n"); ++ flush_work(&conn->cleanup_work); + ISCSI_DBG_TRANS_CONN(conn, "Destroying transport conn\n"); + +- mutex_lock(&conn_mutex); + if (transport->destroy_conn) + transport->destroy_conn(conn); +- mutex_unlock(&conn_mutex); +- + return 0; + } + +@@ -2973,7 +2990,7 @@ release_host: + } + + static int iscsi_if_ep_disconnect(struct iscsi_transport *transport, +- u64 ep_handle, bool is_active) ++ u64 ep_handle) + { + struct iscsi_cls_conn *conn; + struct iscsi_endpoint *ep; +@@ -2984,17 +3001,30 @@ static int iscsi_if_ep_disconnect(struct iscsi_transport *transport, + ep = iscsi_lookup_endpoint(ep_handle); + if (!ep) + return -EINVAL; ++ + conn = ep->conn; +- if (conn) { +- mutex_lock(&conn->ep_mutex); +- conn->ep = NULL; ++ if (!conn) { ++ /* ++ * conn was not even bound yet, so we can't get iscsi conn ++ * failures yet. ++ */ ++ transport->ep_disconnect(ep); ++ goto put_ep; ++ } ++ ++ mutex_lock(&conn->ep_mutex); ++ /* Check if this was a conn error and the kernel took ownership */ ++ if (test_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { ++ ISCSI_DBG_TRANS_CONN(conn, "flush kernel conn cleanup.\n"); + mutex_unlock(&conn->ep_mutex); +- conn->state = ISCSI_CONN_FAILED; + +- transport->unbind_conn(conn, is_active); ++ flush_work(&conn->cleanup_work); ++ goto put_ep; + } + +- transport->ep_disconnect(ep); ++ iscsi_ep_disconnect(conn, false); ++ mutex_unlock(&conn->ep_mutex); ++put_ep: + iscsi_put_endpoint(ep); + return 0; + } +@@ -3025,8 +3055,7 @@ iscsi_if_transport_ep(struct iscsi_transport *transport, + break; + case ISCSI_UEVENT_TRANSPORT_EP_DISCONNECT: + rc = iscsi_if_ep_disconnect(transport, +- ev->u.ep_disconnect.ep_handle, +- false); ++ ev->u.ep_disconnect.ep_handle); + break; + } + return rc; +@@ -3653,18 +3682,129 @@ exit_host_stats: + return err; + } + ++static int iscsi_if_transport_conn(struct iscsi_transport *transport, ++ struct nlmsghdr *nlh) ++{ ++ struct iscsi_uevent *ev = nlmsg_data(nlh); ++ struct iscsi_cls_session *session; ++ struct iscsi_cls_conn *conn = NULL; ++ struct iscsi_endpoint *ep; ++ uint32_t pdu_len; ++ int err = 0; ++ ++ switch (nlh->nlmsg_type) { ++ case ISCSI_UEVENT_CREATE_CONN: ++ return iscsi_if_create_conn(transport, ev); ++ case ISCSI_UEVENT_DESTROY_CONN: ++ return iscsi_if_destroy_conn(transport, ev); ++ case ISCSI_UEVENT_STOP_CONN: ++ return iscsi_if_stop_conn(transport, ev); ++ } ++ ++ /* ++ * The following cmds need to be run under the ep_mutex so in kernel ++ * conn cleanup (ep_disconnect + unbind and conn) is not done while ++ * these are running. They also must not run if we have just run a conn ++ * cleanup because they would set the state in a way that might allow ++ * IO or send IO themselves. ++ */ ++ switch (nlh->nlmsg_type) { ++ case ISCSI_UEVENT_START_CONN: ++ conn = iscsi_conn_lookup(ev->u.start_conn.sid, ++ ev->u.start_conn.cid); ++ break; ++ case ISCSI_UEVENT_BIND_CONN: ++ conn = iscsi_conn_lookup(ev->u.b_conn.sid, ev->u.b_conn.cid); ++ break; ++ case ISCSI_UEVENT_SEND_PDU: ++ conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid); ++ break; ++ } ++ ++ if (!conn) ++ return -EINVAL; ++ ++ mutex_lock(&conn->ep_mutex); ++ if (test_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { ++ mutex_unlock(&conn->ep_mutex); ++ ev->r.retcode = -ENOTCONN; ++ return 0; ++ } ++ ++ switch (nlh->nlmsg_type) { ++ case ISCSI_UEVENT_BIND_CONN: ++ if (conn->ep) { ++ /* ++ * For offload boot support where iscsid is restarted ++ * during the pivot root stage, the ep will be intact ++ * here when the new iscsid instance starts up and ++ * reconnects. ++ */ ++ iscsi_ep_disconnect(conn, true); ++ } ++ ++ session = iscsi_session_lookup(ev->u.b_conn.sid); ++ if (!session) { ++ err = -EINVAL; ++ break; ++ } ++ ++ ev->r.retcode = transport->bind_conn(session, conn, ++ ev->u.b_conn.transport_eph, ++ ev->u.b_conn.is_leading); ++ if (!ev->r.retcode) ++ conn->state = ISCSI_CONN_BOUND; ++ ++ if (ev->r.retcode || !transport->ep_connect) ++ break; ++ ++ ep = iscsi_lookup_endpoint(ev->u.b_conn.transport_eph); ++ if (ep) { ++ ep->conn = conn; ++ conn->ep = ep; ++ iscsi_put_endpoint(ep); ++ } else { ++ err = -ENOTCONN; ++ iscsi_cls_conn_printk(KERN_ERR, conn, ++ "Could not set ep conn binding\n"); ++ } ++ break; ++ case ISCSI_UEVENT_START_CONN: ++ ev->r.retcode = transport->start_conn(conn); ++ if (!ev->r.retcode) ++ conn->state = ISCSI_CONN_UP; ++ break; ++ case ISCSI_UEVENT_SEND_PDU: ++ pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev); ++ ++ if ((ev->u.send_pdu.hdr_size > pdu_len) || ++ (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) { ++ err = -EINVAL; ++ break; ++ } ++ ++ ev->r.retcode = transport->send_pdu(conn, ++ (struct iscsi_hdr *)((char *)ev + sizeof(*ev)), ++ (char *)ev + sizeof(*ev) + ev->u.send_pdu.hdr_size, ++ ev->u.send_pdu.data_size); ++ break; ++ default: ++ err = -ENOSYS; ++ } ++ ++ mutex_unlock(&conn->ep_mutex); ++ return err; ++} + + static int + iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + { + int err = 0; + u32 portid; +- u32 pdu_len; + struct iscsi_uevent *ev = nlmsg_data(nlh); + struct iscsi_transport *transport = NULL; + struct iscsi_internal *priv; + struct iscsi_cls_session *session; +- struct iscsi_cls_conn *conn; + struct iscsi_endpoint *ep = NULL; + + if (!netlink_capable(skb, CAP_SYS_ADMIN)) +@@ -3741,90 +3881,16 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + else + err = -EINVAL; + break; +- case ISCSI_UEVENT_CREATE_CONN: +- err = iscsi_if_create_conn(transport, ev); +- break; +- case ISCSI_UEVENT_DESTROY_CONN: +- err = iscsi_if_destroy_conn(transport, ev); +- break; +- case ISCSI_UEVENT_BIND_CONN: +- session = iscsi_session_lookup(ev->u.b_conn.sid); +- conn = iscsi_conn_lookup(ev->u.b_conn.sid, ev->u.b_conn.cid); +- +- if (conn && conn->ep) +- iscsi_if_ep_disconnect(transport, conn->ep->id, true); +- +- if (!session || !conn) { +- err = -EINVAL; +- break; +- } +- +- mutex_lock(&conn_mutex); +- ev->r.retcode = transport->bind_conn(session, conn, +- ev->u.b_conn.transport_eph, +- ev->u.b_conn.is_leading); +- if (!ev->r.retcode) +- conn->state = ISCSI_CONN_BOUND; +- mutex_unlock(&conn_mutex); +- +- if (ev->r.retcode || !transport->ep_connect) +- break; +- +- ep = iscsi_lookup_endpoint(ev->u.b_conn.transport_eph); +- if (ep) { +- ep->conn = conn; +- +- mutex_lock(&conn->ep_mutex); +- conn->ep = ep; +- mutex_unlock(&conn->ep_mutex); +- iscsi_put_endpoint(ep); +- } else +- iscsi_cls_conn_printk(KERN_ERR, conn, +- "Could not set ep conn " +- "binding\n"); +- break; + case ISCSI_UEVENT_SET_PARAM: + err = iscsi_set_param(transport, ev); + break; +- case ISCSI_UEVENT_START_CONN: +- conn = iscsi_conn_lookup(ev->u.start_conn.sid, ev->u.start_conn.cid); +- if (conn) { +- mutex_lock(&conn_mutex); +- ev->r.retcode = transport->start_conn(conn); +- if (!ev->r.retcode) +- conn->state = ISCSI_CONN_UP; +- mutex_unlock(&conn_mutex); +- } +- else +- err = -EINVAL; +- break; ++ case ISCSI_UEVENT_CREATE_CONN: ++ case ISCSI_UEVENT_DESTROY_CONN: + case ISCSI_UEVENT_STOP_CONN: +- conn = iscsi_conn_lookup(ev->u.stop_conn.sid, ev->u.stop_conn.cid); +- if (conn) +- iscsi_if_stop_conn(conn, ev->u.stop_conn.flag); +- else +- err = -EINVAL; +- break; ++ case ISCSI_UEVENT_START_CONN: ++ case ISCSI_UEVENT_BIND_CONN: + case ISCSI_UEVENT_SEND_PDU: +- pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev); +- +- if ((ev->u.send_pdu.hdr_size > pdu_len) || +- (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) { +- err = -EINVAL; +- break; +- } +- +- conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid); +- if (conn) { +- mutex_lock(&conn_mutex); +- ev->r.retcode = transport->send_pdu(conn, +- (struct iscsi_hdr*)((char*)ev + sizeof(*ev)), +- (char*)ev + sizeof(*ev) + ev->u.send_pdu.hdr_size, +- ev->u.send_pdu.data_size); +- mutex_unlock(&conn_mutex); +- } +- else +- err = -EINVAL; ++ err = iscsi_if_transport_conn(transport, nlh); + break; + case ISCSI_UEVENT_GET_STATS: + err = iscsi_if_get_stats(transport, nlh); +@@ -4827,8 +4893,18 @@ static __init int iscsi_transport_init(void) + goto release_nls; + } + ++ iscsi_conn_cleanup_workq = alloc_workqueue("%s", ++ WQ_SYSFS | WQ_MEM_RECLAIM | WQ_UNBOUND, 0, ++ "iscsi_conn_cleanup"); ++ if (!iscsi_conn_cleanup_workq) { ++ err = -ENOMEM; ++ goto destroy_wq; ++ } ++ + return 0; + ++destroy_wq: ++ destroy_workqueue(iscsi_eh_timer_workq); + release_nls: + netlink_kernel_release(nls); + unregister_flashnode_bus: +@@ -4850,6 +4926,7 @@ unregister_transport_class: + + static void __exit iscsi_transport_exit(void) + { ++ destroy_workqueue(iscsi_conn_cleanup_workq); + destroy_workqueue(iscsi_eh_timer_workq); + netlink_kernel_release(nls); + bus_unregister(&iscsi_flashnode_bus); +diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h +index d36a72cf049f..3974329d4d02 100644 +--- a/include/scsi/scsi_transport_iscsi.h ++++ b/include/scsi/scsi_transport_iscsi.h +@@ -197,15 +197,23 @@ enum iscsi_connection_state { + ISCSI_CONN_BOUND, + }; + ++#define ISCSI_CLS_CONN_BIT_CLEANUP 1 ++ + struct iscsi_cls_conn { + struct list_head conn_list; /* item in connlist */ +- struct list_head conn_list_err; /* item in connlist_err */ + void *dd_data; /* LLD private data */ + struct iscsi_transport *transport; + uint32_t cid; /* connection id */ ++ /* ++ * This protects the conn startup and binding/unbinding of the ep to ++ * the conn. Unbinding includes ep_disconnect and stop_conn. ++ */ + struct mutex ep_mutex; + struct iscsi_endpoint *ep; + ++ unsigned long flags; ++ struct work_struct cleanup_work; ++ + struct device dev; /* sysfs transport/container device */ + enum iscsi_connection_state state; + }; +-- +2.30.2 + diff --git a/queue-5.12/scsi-iscsi-flush-block-work-before-unblock.patch b/queue-5.12/scsi-iscsi-flush-block-work-before-unblock.patch new file mode 100644 index 00000000000..38b8283c6b3 --- /dev/null +++ b/queue-5.12/scsi-iscsi-flush-block-work-before-unblock.patch @@ -0,0 +1,43 @@ +From ce968aea210666e27a4e4640e800707b1d71fd8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:18:09 -0500 +Subject: scsi: iscsi: Flush block work before unblock + +From: Mike Christie + +[ Upstream commit 7ce9fc5ecde0d8bd64c29baee6c5e3ce7074ec9a ] + +We set the max_active iSCSI EH works to 1, so all work is going to execute +in order by default. However, userspace can now override this in sysfs. If +max_active > 1, we can end up with the block_work on CPU1 and +iscsi_unblock_session running the unblock_work on CPU2 and the session and +target/device state will end up out of sync with each other. + +This adds a flush of the block_work in iscsi_unblock_session. + +Link: https://lore.kernel.org/r/20210525181821.7617-17-michael.christie@oracle.com +Fixes: 1d726aa6ef57 ("scsi: iscsi: Optimize work queue flush use") +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index b8a93e607891..6ce1cc992d1d 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -1969,6 +1969,8 @@ static void __iscsi_unblock_session(struct work_struct *work) + */ + void iscsi_unblock_session(struct iscsi_cls_session *session) + { ++ flush_work(&session->block_work); ++ + queue_work(iscsi_eh_timer_workq, &session->unblock_work); + /* + * Blocking the session can be done from any context so we only +-- +2.30.2 + diff --git a/queue-5.12/scsi-iscsi-force-immediate-failure-during-shutdown.patch b/queue-5.12/scsi-iscsi-force-immediate-failure-during-shutdown.patch new file mode 100644 index 00000000000..5d17927e10e --- /dev/null +++ b/queue-5.12/scsi-iscsi-force-immediate-failure-during-shutdown.patch @@ -0,0 +1,59 @@ +From f28f96efb8d788d3ced58e279c78449d51f560ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:17:57 -0500 +Subject: scsi: iscsi: Force immediate failure during shutdown + +From: Mike Christie + +[ Upstream commit 06c203a5566beecebb1f8838d026de8a61c8df71 ] + +If the system is not up, we can just fail immediately since iscsid is not +going to ever answer our netlink events. We are already setting the +recovery_tmo to 0, but by passing stop_conn STOP_CONN_TERM we never will +block the session and start the recovery timer, because for that flag +userspace will do the unbind and destroy events which would remove the +devices and wake up and kill the eh. + +Since the conn is dead and the system is going dowm this just has us use +STOP_CONN_RECOVER with recovery_tmo=0 so we fail immediately. However, if +the user has set the recovery_tmo=-1 we let the system hang like they +requested since they might have used that setting for specific reasons +(one known reason is for buggy cluster software). + +Link: https://lore.kernel.org/r/20210525181821.7617-5-michael.christie@oracle.com +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 82491343e94a..d134156d67f0 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2513,11 +2513,17 @@ static void stop_conn_work_fn(struct work_struct *work) + session = iscsi_session_lookup(sid); + if (session) { + if (system_state != SYSTEM_RUNNING) { +- session->recovery_tmo = 0; +- iscsi_if_stop_conn(conn, STOP_CONN_TERM); +- } else { +- iscsi_if_stop_conn(conn, STOP_CONN_RECOVER); ++ /* ++ * If the user has set up for the session to ++ * never timeout then hang like they wanted. ++ * For all other cases fail right away since ++ * userspace is not going to relogin. ++ */ ++ if (session->recovery_tmo > 0) ++ session->recovery_tmo = 0; + } ++ ++ iscsi_if_stop_conn(conn, STOP_CONN_RECOVER); + } + + list_del_init(&conn->conn_list_err); +-- +2.30.2 + diff --git a/queue-5.12/scsi-iscsi-rel-ref-after-iscsi_lookup_endpoint.patch b/queue-5.12/scsi-iscsi-rel-ref-after-iscsi_lookup_endpoint.patch new file mode 100644 index 00000000000..be2823fed4d --- /dev/null +++ b/queue-5.12/scsi-iscsi-rel-ref-after-iscsi_lookup_endpoint.patch @@ -0,0 +1,337 @@ +From c9e4a9d0c757316e882ae0722896fa406b985590 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:17:59 -0500 +Subject: scsi: iscsi: Rel ref after iscsi_lookup_endpoint() + +From: Mike Christie + +[ Upstream commit 9e5fe1700896c85040943fdc0d3fee0dd3e0d36f ] + +Subsequent commits allow the kernel to do ep_disconnect. In that case we +will have to get a proper refcount on the ep so one thread does not delete +it from under another. + +Link: https://lore.kernel.org/r/20210525181821.7617-7-michael.christie@oracle.com +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/iser/iscsi_iser.c | 1 + + drivers/scsi/be2iscsi/be_iscsi.c | 19 ++++++++++++------ + drivers/scsi/bnx2i/bnx2i_iscsi.c | 23 +++++++++++++++------- + drivers/scsi/cxgbi/libcxgbi.c | 12 ++++++++---- + drivers/scsi/qedi/qedi_iscsi.c | 25 +++++++++++++++++------- + drivers/scsi/qla4xxx/ql4_os.c | 1 + + drivers/scsi/scsi_transport_iscsi.c | 25 ++++++++++++++++-------- + include/scsi/scsi_transport_iscsi.h | 1 + + 8 files changed, 75 insertions(+), 32 deletions(-) + +diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c +index 6baebcb6d14d..776e46ee95da 100644 +--- a/drivers/infiniband/ulp/iser/iscsi_iser.c ++++ b/drivers/infiniband/ulp/iser/iscsi_iser.c +@@ -506,6 +506,7 @@ iscsi_iser_conn_bind(struct iscsi_cls_session *cls_session, + iser_conn->iscsi_conn = conn; + + out: ++ iscsi_put_endpoint(ep); + mutex_unlock(&iser_conn->state_mutex); + return error; + } +diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c +index a13c203ef7a9..c4881657a807 100644 +--- a/drivers/scsi/be2iscsi/be_iscsi.c ++++ b/drivers/scsi/be2iscsi/be_iscsi.c +@@ -182,6 +182,7 @@ int beiscsi_conn_bind(struct iscsi_cls_session *cls_session, + struct beiscsi_endpoint *beiscsi_ep; + struct iscsi_endpoint *ep; + uint16_t cri_index; ++ int rc = 0; + + ep = iscsi_lookup_endpoint(transport_fd); + if (!ep) +@@ -189,15 +190,17 @@ int beiscsi_conn_bind(struct iscsi_cls_session *cls_session, + + beiscsi_ep = ep->dd_data; + +- if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) +- return -EINVAL; ++ if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) { ++ rc = -EINVAL; ++ goto put_ep; ++ } + + if (beiscsi_ep->phba != phba) { + beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_CONFIG, + "BS_%d : beiscsi_ep->hba=%p not equal to phba=%p\n", + beiscsi_ep->phba, phba); +- +- return -EEXIST; ++ rc = -EEXIST; ++ goto put_ep; + } + cri_index = BE_GET_CRI_FROM_CID(beiscsi_ep->ep_cid); + if (phba->conn_table[cri_index]) { +@@ -209,7 +212,8 @@ int beiscsi_conn_bind(struct iscsi_cls_session *cls_session, + beiscsi_ep->ep_cid, + beiscsi_conn, + phba->conn_table[cri_index]); +- return -EINVAL; ++ rc = -EINVAL; ++ goto put_ep; + } + } + +@@ -226,7 +230,10 @@ int beiscsi_conn_bind(struct iscsi_cls_session *cls_session, + "BS_%d : cid %d phba->conn_table[%u]=%p\n", + beiscsi_ep->ep_cid, cri_index, beiscsi_conn); + phba->conn_table[cri_index] = beiscsi_conn; +- return 0; ++ ++put_ep: ++ iscsi_put_endpoint(ep); ++ return rc; + } + + static int beiscsi_iface_create_ipv4(struct beiscsi_hba *phba) +diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c +index b6c1da46d582..2ad85c6b99fd 100644 +--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c ++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c +@@ -1420,17 +1420,23 @@ static int bnx2i_conn_bind(struct iscsi_cls_session *cls_session, + * Forcefully terminate all in progress connection recovery at the + * earliest, either in bind(), send_pdu(LOGIN), or conn_start() + */ +- if (bnx2i_adapter_ready(hba)) +- return -EIO; ++ if (bnx2i_adapter_ready(hba)) { ++ ret_code = -EIO; ++ goto put_ep; ++ } + + bnx2i_ep = ep->dd_data; + if ((bnx2i_ep->state == EP_STATE_TCP_FIN_RCVD) || +- (bnx2i_ep->state == EP_STATE_TCP_RST_RCVD)) ++ (bnx2i_ep->state == EP_STATE_TCP_RST_RCVD)) { + /* Peer disconnect via' FIN or RST */ +- return -EINVAL; ++ ret_code = -EINVAL; ++ goto put_ep; ++ } + +- if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) +- return -EINVAL; ++ if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) { ++ ret_code = -EINVAL; ++ goto put_ep; ++ } + + if (bnx2i_ep->hba != hba) { + /* Error - TCP connection does not belong to this device +@@ -1441,7 +1447,8 @@ static int bnx2i_conn_bind(struct iscsi_cls_session *cls_session, + iscsi_conn_printk(KERN_ALERT, cls_conn->dd_data, + "belong to hba (%s)\n", + hba->netdev->name); +- return -EEXIST; ++ ret_code = -EEXIST; ++ goto put_ep; + } + bnx2i_ep->conn = bnx2i_conn; + bnx2i_conn->ep = bnx2i_ep; +@@ -1458,6 +1465,8 @@ static int bnx2i_conn_bind(struct iscsi_cls_session *cls_session, + bnx2i_put_rq_buf(bnx2i_conn, 0); + + bnx2i_arm_cq_event_coalescing(bnx2i_conn->ep, CNIC_ARM_CQE); ++put_ep: ++ iscsi_put_endpoint(ep); + return ret_code; + } + +diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c +index f078b3c4e083..f6bcae829c29 100644 +--- a/drivers/scsi/cxgbi/libcxgbi.c ++++ b/drivers/scsi/cxgbi/libcxgbi.c +@@ -2690,11 +2690,13 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_session, + err = csk->cdev->csk_ddp_setup_pgidx(csk, csk->tid, + ppm->tformat.pgsz_idx_dflt); + if (err < 0) +- return err; ++ goto put_ep; + + err = iscsi_conn_bind(cls_session, cls_conn, is_leading); +- if (err) +- return -EINVAL; ++ if (err) { ++ err = -EINVAL; ++ goto put_ep; ++ } + + /* calculate the tag idx bits needed for this conn based on cmds_max */ + cconn->task_idx_bits = (__ilog2_u32(conn->session->cmds_max - 1)) + 1; +@@ -2715,7 +2717,9 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_session, + /* init recv engine */ + iscsi_tcp_hdr_recv_prep(tcp_conn); + +- return 0; ++put_ep: ++ iscsi_put_endpoint(ep); ++ return err; + } + EXPORT_SYMBOL_GPL(cxgbi_bind_conn); + +diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c +index ef16537c523c..087c7ff28cd5 100644 +--- a/drivers/scsi/qedi/qedi_iscsi.c ++++ b/drivers/scsi/qedi/qedi_iscsi.c +@@ -377,6 +377,7 @@ static int qedi_conn_bind(struct iscsi_cls_session *cls_session, + struct qedi_ctx *qedi = iscsi_host_priv(shost); + struct qedi_endpoint *qedi_ep; + struct iscsi_endpoint *ep; ++ int rc = 0; + + ep = iscsi_lookup_endpoint(transport_fd); + if (!ep) +@@ -384,11 +385,16 @@ static int qedi_conn_bind(struct iscsi_cls_session *cls_session, + + qedi_ep = ep->dd_data; + if ((qedi_ep->state == EP_STATE_TCP_FIN_RCVD) || +- (qedi_ep->state == EP_STATE_TCP_RST_RCVD)) +- return -EINVAL; ++ (qedi_ep->state == EP_STATE_TCP_RST_RCVD)) { ++ rc = -EINVAL; ++ goto put_ep; ++ } ++ ++ if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) { ++ rc = -EINVAL; ++ goto put_ep; ++ } + +- if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) +- return -EINVAL; + + qedi_ep->conn = qedi_conn; + qedi_conn->ep = qedi_ep; +@@ -398,13 +404,18 @@ static int qedi_conn_bind(struct iscsi_cls_session *cls_session, + qedi_conn->cmd_cleanup_req = 0; + qedi_conn->cmd_cleanup_cmpl = 0; + +- if (qedi_bind_conn_to_iscsi_cid(qedi, qedi_conn)) +- return -EINVAL; ++ if (qedi_bind_conn_to_iscsi_cid(qedi, qedi_conn)) { ++ rc = -EINVAL; ++ goto put_ep; ++ } ++ + + spin_lock_init(&qedi_conn->tmf_work_lock); + INIT_LIST_HEAD(&qedi_conn->tmf_work_list); + init_waitqueue_head(&qedi_conn->wait_queue); +- return 0; ++put_ep: ++ iscsi_put_endpoint(ep); ++ return rc; + } + + static int qedi_iscsi_update_conn(struct qedi_ctx *qedi, +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index ff663cb330c2..ea128da08537 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -3235,6 +3235,7 @@ static int qla4xxx_conn_bind(struct iscsi_cls_session *cls_session, + conn = cls_conn->dd_data; + qla_conn = conn->dd_data; + qla_conn->qla_ep = ep->dd_data; ++ iscsi_put_endpoint(ep); + return 0; + } + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 2eb77f69fe0c..bab6654d8ee9 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -266,9 +266,20 @@ void iscsi_destroy_endpoint(struct iscsi_endpoint *ep) + } + EXPORT_SYMBOL_GPL(iscsi_destroy_endpoint); + ++void iscsi_put_endpoint(struct iscsi_endpoint *ep) ++{ ++ put_device(&ep->dev); ++} ++EXPORT_SYMBOL_GPL(iscsi_put_endpoint); ++ ++/** ++ * iscsi_lookup_endpoint - get ep from handle ++ * @handle: endpoint handle ++ * ++ * Caller must do a iscsi_put_endpoint. ++ */ + struct iscsi_endpoint *iscsi_lookup_endpoint(u64 handle) + { +- struct iscsi_endpoint *ep; + struct device *dev; + + dev = class_find_device(&iscsi_endpoint_class, NULL, &handle, +@@ -276,13 +287,7 @@ struct iscsi_endpoint *iscsi_lookup_endpoint(u64 handle) + if (!dev) + return NULL; + +- ep = iscsi_dev_to_endpoint(dev); +- /* +- * we can drop this now because the interface will prevent +- * removals and lookups from racing. +- */ +- put_device(dev); +- return ep; ++ return iscsi_dev_to_endpoint(dev); + } + EXPORT_SYMBOL_GPL(iscsi_lookup_endpoint); + +@@ -2990,6 +2995,7 @@ static int iscsi_if_ep_disconnect(struct iscsi_transport *transport, + } + + transport->ep_disconnect(ep); ++ iscsi_put_endpoint(ep); + return 0; + } + +@@ -3015,6 +3021,7 @@ iscsi_if_transport_ep(struct iscsi_transport *transport, + + ev->r.retcode = transport->ep_poll(ep, + ev->u.ep_poll.timeout_ms); ++ iscsi_put_endpoint(ep); + break; + case ISCSI_UEVENT_TRANSPORT_EP_DISCONNECT: + rc = iscsi_if_ep_disconnect(transport, +@@ -3698,6 +3705,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + ev->u.c_bound_session.initial_cmdsn, + ev->u.c_bound_session.cmds_max, + ev->u.c_bound_session.queue_depth); ++ iscsi_put_endpoint(ep); + break; + case ISCSI_UEVENT_DESTROY_SESSION: + session = iscsi_session_lookup(ev->u.d_session.sid); +@@ -3769,6 +3777,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + mutex_lock(&conn->ep_mutex); + conn->ep = ep; + mutex_unlock(&conn->ep_mutex); ++ iscsi_put_endpoint(ep); + } else + iscsi_cls_conn_printk(KERN_ERR, conn, + "Could not set ep conn " +diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h +index 8874016b3c9a..d36a72cf049f 100644 +--- a/include/scsi/scsi_transport_iscsi.h ++++ b/include/scsi/scsi_transport_iscsi.h +@@ -442,6 +442,7 @@ extern int iscsi_scan_finished(struct Scsi_Host *shost, unsigned long time); + extern struct iscsi_endpoint *iscsi_create_endpoint(int dd_size); + extern void iscsi_destroy_endpoint(struct iscsi_endpoint *ep); + extern struct iscsi_endpoint *iscsi_lookup_endpoint(u64 handle); ++extern void iscsi_put_endpoint(struct iscsi_endpoint *ep); + extern int iscsi_block_scsi_eh(struct scsi_cmnd *cmd); + extern struct iscsi_iface *iscsi_create_iface(struct Scsi_Host *shost, + struct iscsi_transport *t, +-- +2.30.2 + diff --git a/queue-5.12/scsi-iscsi-stop-queueing-during-ep_disconnect.patch b/queue-5.12/scsi-iscsi-stop-queueing-during-ep_disconnect.patch new file mode 100644 index 00000000000..53fe4b2c8e3 --- /dev/null +++ b/queue-5.12/scsi-iscsi-stop-queueing-during-ep_disconnect.patch @@ -0,0 +1,295 @@ +From 50dff8a537400059055b48bfde08f90459126735 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:17:55 -0500 +Subject: scsi: iscsi: Stop queueing during ep_disconnect + +From: Mike Christie + +[ Upstream commit 891e2639deae721dc43764a44fa255890dc34313 ] + +During ep_disconnect we have been doing iscsi_suspend_tx/queue to block new +I/O but every driver except cxgbi and iscsi_tcp can still get I/O from +__iscsi_conn_send_pdu() if we haven't called iscsi_conn_failure() before +ep_disconnect. This could happen if we were terminating the session, and +the logout timed out before it was even sent to libiscsi. + +Fix the issue by adding a helper which reverses the bind_conn call that +allows new I/O to be queued. Drivers implementing ep_disconnect can use this +to make sure new I/O is not queued to them when handling the disconnect. + +Link: https://lore.kernel.org/r/20210525181821.7617-3-michael.christie@oracle.com +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/iser/iscsi_iser.c | 1 + + drivers/scsi/be2iscsi/be_main.c | 1 + + drivers/scsi/bnx2i/bnx2i_iscsi.c | 1 + + drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 1 + + drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 1 + + drivers/scsi/libiscsi.c | 70 +++++++++++++++++++++--- + drivers/scsi/qedi/qedi_iscsi.c | 1 + + drivers/scsi/qla4xxx/ql4_os.c | 1 + + drivers/scsi/scsi_transport_iscsi.c | 10 +++- + include/scsi/libiscsi.h | 1 + + include/scsi/scsi_transport_iscsi.h | 1 + + 11 files changed, 78 insertions(+), 11 deletions(-) + +diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/ulp/iser/iscsi_iser.c +index 8fcaa1136f2c..6baebcb6d14d 100644 +--- a/drivers/infiniband/ulp/iser/iscsi_iser.c ++++ b/drivers/infiniband/ulp/iser/iscsi_iser.c +@@ -1002,6 +1002,7 @@ static struct iscsi_transport iscsi_iser_transport = { + /* connection management */ + .create_conn = iscsi_iser_conn_create, + .bind_conn = iscsi_iser_conn_bind, ++ .unbind_conn = iscsi_conn_unbind, + .destroy_conn = iscsi_conn_teardown, + .attr_is_visible = iser_attr_is_visible, + .set_param = iscsi_iser_set_param, +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index 90fcddb76f46..e9658a67d9da 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -5809,6 +5809,7 @@ struct iscsi_transport beiscsi_iscsi_transport = { + .destroy_session = beiscsi_session_destroy, + .create_conn = beiscsi_conn_create, + .bind_conn = beiscsi_conn_bind, ++ .unbind_conn = iscsi_conn_unbind, + .destroy_conn = iscsi_conn_teardown, + .attr_is_visible = beiscsi_attr_is_visible, + .set_iface_param = beiscsi_iface_set_param, +diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c +index 1e6d8f62ea3c..b6c1da46d582 100644 +--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c ++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c +@@ -2276,6 +2276,7 @@ struct iscsi_transport bnx2i_iscsi_transport = { + .destroy_session = bnx2i_session_destroy, + .create_conn = bnx2i_conn_create, + .bind_conn = bnx2i_conn_bind, ++ .unbind_conn = iscsi_conn_unbind, + .destroy_conn = bnx2i_conn_destroy, + .attr_is_visible = bnx2i_attr_is_visible, + .set_param = iscsi_set_param, +diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c +index 37d99357120f..edcd3fab6973 100644 +--- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c ++++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c +@@ -117,6 +117,7 @@ static struct iscsi_transport cxgb3i_iscsi_transport = { + /* connection management */ + .create_conn = cxgbi_create_conn, + .bind_conn = cxgbi_bind_conn, ++ .unbind_conn = iscsi_conn_unbind, + .destroy_conn = iscsi_tcp_conn_teardown, + .start_conn = iscsi_conn_start, + .stop_conn = iscsi_conn_stop, +diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c +index 2c3491528d42..efb3e2b3398e 100644 +--- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c ++++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c +@@ -134,6 +134,7 @@ static struct iscsi_transport cxgb4i_iscsi_transport = { + /* connection management */ + .create_conn = cxgbi_create_conn, + .bind_conn = cxgbi_bind_conn, ++ .unbind_conn = iscsi_conn_unbind, + .destroy_conn = iscsi_tcp_conn_teardown, + .start_conn = iscsi_conn_start, + .stop_conn = iscsi_conn_stop, +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 4834219497ee..2aaf83678654 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1387,23 +1387,32 @@ void iscsi_session_failure(struct iscsi_session *session, + } + EXPORT_SYMBOL_GPL(iscsi_session_failure); + +-void iscsi_conn_failure(struct iscsi_conn *conn, enum iscsi_err err) ++static bool iscsi_set_conn_failed(struct iscsi_conn *conn) + { + struct iscsi_session *session = conn->session; + +- spin_lock_bh(&session->frwd_lock); +- if (session->state == ISCSI_STATE_FAILED) { +- spin_unlock_bh(&session->frwd_lock); +- return; +- } ++ if (session->state == ISCSI_STATE_FAILED) ++ return false; + + if (conn->stop_stage == 0) + session->state = ISCSI_STATE_FAILED; +- spin_unlock_bh(&session->frwd_lock); + + set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx); + set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx); +- iscsi_conn_error_event(conn->cls_conn, err); ++ return true; ++} ++ ++void iscsi_conn_failure(struct iscsi_conn *conn, enum iscsi_err err) ++{ ++ struct iscsi_session *session = conn->session; ++ bool needs_evt; ++ ++ spin_lock_bh(&session->frwd_lock); ++ needs_evt = iscsi_set_conn_failed(conn); ++ spin_unlock_bh(&session->frwd_lock); ++ ++ if (needs_evt) ++ iscsi_conn_error_event(conn->cls_conn, err); + } + EXPORT_SYMBOL_GPL(iscsi_conn_failure); + +@@ -2180,6 +2189,51 @@ done: + spin_unlock(&session->frwd_lock); + } + ++/** ++ * iscsi_conn_unbind - prevent queueing to conn. ++ * @cls_conn: iscsi conn ep is bound to. ++ * @is_active: is the conn in use for boot or is this for EH/termination ++ * ++ * This must be called by drivers implementing the ep_disconnect callout. ++ * It disables queueing to the connection from libiscsi in preparation for ++ * an ep_disconnect call. ++ */ ++void iscsi_conn_unbind(struct iscsi_cls_conn *cls_conn, bool is_active) ++{ ++ struct iscsi_session *session; ++ struct iscsi_conn *conn; ++ ++ if (!cls_conn) ++ return; ++ ++ conn = cls_conn->dd_data; ++ session = conn->session; ++ /* ++ * Wait for iscsi_eh calls to exit. We don't wait for the tmf to ++ * complete or timeout. The caller just wants to know what's running ++ * is everything that needs to be cleaned up, and no cmds will be ++ * queued. ++ */ ++ mutex_lock(&session->eh_mutex); ++ ++ iscsi_suspend_queue(conn); ++ iscsi_suspend_tx(conn); ++ ++ spin_lock_bh(&session->frwd_lock); ++ if (!is_active) { ++ /* ++ * if logout timed out before userspace could even send a PDU ++ * the state might still be in ISCSI_STATE_LOGGED_IN and ++ * allowing new cmds and TMFs. ++ */ ++ if (session->state == ISCSI_STATE_LOGGED_IN) ++ iscsi_set_conn_failed(conn); ++ } ++ spin_unlock_bh(&session->frwd_lock); ++ mutex_unlock(&session->eh_mutex); ++} ++EXPORT_SYMBOL_GPL(iscsi_conn_unbind); ++ + static void iscsi_prep_abort_task_pdu(struct iscsi_task *task, + struct iscsi_tm *hdr) + { +diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c +index 08c05403cd72..ef16537c523c 100644 +--- a/drivers/scsi/qedi/qedi_iscsi.c ++++ b/drivers/scsi/qedi/qedi_iscsi.c +@@ -1401,6 +1401,7 @@ struct iscsi_transport qedi_iscsi_transport = { + .destroy_session = qedi_session_destroy, + .create_conn = qedi_conn_create, + .bind_conn = qedi_conn_bind, ++ .unbind_conn = iscsi_conn_unbind, + .start_conn = qedi_conn_start, + .stop_conn = iscsi_conn_stop, + .destroy_conn = qedi_conn_destroy, +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index 7bd9a4a04ad5..ff663cb330c2 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -259,6 +259,7 @@ static struct iscsi_transport qla4xxx_iscsi_transport = { + .start_conn = qla4xxx_conn_start, + .create_conn = qla4xxx_conn_create, + .bind_conn = qla4xxx_conn_bind, ++ .unbind_conn = iscsi_conn_unbind, + .stop_conn = iscsi_conn_stop, + .destroy_conn = qla4xxx_conn_destroy, + .set_param = iscsi_set_param, +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 441f0152193f..82491343e94a 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2964,7 +2964,7 @@ release_host: + } + + static int iscsi_if_ep_disconnect(struct iscsi_transport *transport, +- u64 ep_handle) ++ u64 ep_handle, bool is_active) + { + struct iscsi_cls_conn *conn; + struct iscsi_endpoint *ep; +@@ -2981,6 +2981,8 @@ static int iscsi_if_ep_disconnect(struct iscsi_transport *transport, + conn->ep = NULL; + mutex_unlock(&conn->ep_mutex); + conn->state = ISCSI_CONN_FAILED; ++ ++ transport->unbind_conn(conn, is_active); + } + + transport->ep_disconnect(ep); +@@ -3012,7 +3014,8 @@ iscsi_if_transport_ep(struct iscsi_transport *transport, + break; + case ISCSI_UEVENT_TRANSPORT_EP_DISCONNECT: + rc = iscsi_if_ep_disconnect(transport, +- ev->u.ep_disconnect.ep_handle); ++ ev->u.ep_disconnect.ep_handle, ++ false); + break; + } + return rc; +@@ -3737,7 +3740,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + conn = iscsi_conn_lookup(ev->u.b_conn.sid, ev->u.b_conn.cid); + + if (conn && conn->ep) +- iscsi_if_ep_disconnect(transport, conn->ep->id); ++ iscsi_if_ep_disconnect(transport, conn->ep->id, true); + + if (!session || !conn) { + err = -EINVAL; +@@ -4656,6 +4659,7 @@ iscsi_register_transport(struct iscsi_transport *tt) + int err; + + BUG_ON(!tt); ++ WARN_ON(tt->ep_disconnect && !tt->unbind_conn); + + priv = iscsi_if_transport_lookup(tt); + if (priv) +diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h +index 02f966e9358f..091f284bd6e9 100644 +--- a/include/scsi/libiscsi.h ++++ b/include/scsi/libiscsi.h +@@ -424,6 +424,7 @@ extern int iscsi_conn_start(struct iscsi_cls_conn *); + extern void iscsi_conn_stop(struct iscsi_cls_conn *, int); + extern int iscsi_conn_bind(struct iscsi_cls_session *, struct iscsi_cls_conn *, + int); ++extern void iscsi_conn_unbind(struct iscsi_cls_conn *cls_conn, bool is_active); + extern void iscsi_conn_failure(struct iscsi_conn *conn, enum iscsi_err err); + extern void iscsi_session_failure(struct iscsi_session *session, + enum iscsi_err err); +diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h +index fc5a39839b4b..8874016b3c9a 100644 +--- a/include/scsi/scsi_transport_iscsi.h ++++ b/include/scsi/scsi_transport_iscsi.h +@@ -82,6 +82,7 @@ struct iscsi_transport { + void (*destroy_session) (struct iscsi_cls_session *session); + struct iscsi_cls_conn *(*create_conn) (struct iscsi_cls_session *sess, + uint32_t cid); ++ void (*unbind_conn) (struct iscsi_cls_conn *conn, bool is_active); + int (*bind_conn) (struct iscsi_cls_session *session, + struct iscsi_cls_conn *cls_conn, + uint64_t transport_eph, int is_leading); +-- +2.30.2 + diff --git a/queue-5.12/scsi-iscsi-use-system_unbound_wq-for-destroy_work.patch b/queue-5.12/scsi-iscsi-use-system_unbound_wq-for-destroy_work.patch new file mode 100644 index 00000000000..58b51270c3a --- /dev/null +++ b/queue-5.12/scsi-iscsi-use-system_unbound_wq-for-destroy_work.patch @@ -0,0 +1,78 @@ +From 59c116594a6608f05a2904fa3c22bad57556b77a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:17:58 -0500 +Subject: scsi: iscsi: Use system_unbound_wq for destroy_work + +From: Mike Christie + +[ Upstream commit b25b957d2db1585602c2c70fdf4261a5641fe6b7 ] + +Use the system_unbound_wq for async session destruction. We don't need a +dedicated workqueue for async session destruction because: + + 1. perf does not seem to be an issue since we only allow 1 active work. + + 2. it does not have deps with other system works and we can run them in + parallel with each other. + +Link: https://lore.kernel.org/r/20210525181821.7617-6-michael.christie@oracle.com +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_transport_iscsi.c | 15 +-------------- + 1 file changed, 1 insertion(+), 14 deletions(-) + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index d134156d67f0..2eb77f69fe0c 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -95,8 +95,6 @@ static DECLARE_WORK(stop_conn_work, stop_conn_work_fn); + static atomic_t iscsi_session_nr; /* sysfs session id for next new session */ + static struct workqueue_struct *iscsi_eh_timer_workq; + +-static struct workqueue_struct *iscsi_destroy_workq; +- + static DEFINE_IDA(iscsi_sess_ida); + /* + * list of registered transports and lock that must +@@ -3724,7 +3722,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + list_del_init(&session->sess_list); + spin_unlock_irqrestore(&sesslock, flags); + +- queue_work(iscsi_destroy_workq, &session->destroy_work); ++ queue_work(system_unbound_wq, &session->destroy_work); + } + break; + case ISCSI_UEVENT_UNBIND_SESSION: +@@ -4820,18 +4818,8 @@ static __init int iscsi_transport_init(void) + goto release_nls; + } + +- iscsi_destroy_workq = alloc_workqueue("%s", +- WQ_SYSFS | __WQ_LEGACY | WQ_MEM_RECLAIM | WQ_UNBOUND, +- 1, "iscsi_destroy"); +- if (!iscsi_destroy_workq) { +- err = -ENOMEM; +- goto destroy_wq; +- } +- + return 0; + +-destroy_wq: +- destroy_workqueue(iscsi_eh_timer_workq); + release_nls: + netlink_kernel_release(nls); + unregister_flashnode_bus: +@@ -4853,7 +4841,6 @@ unregister_transport_class: + + static void __exit iscsi_transport_exit(void) + { +- destroy_workqueue(iscsi_destroy_workq); + destroy_workqueue(iscsi_eh_timer_workq); + netlink_kernel_release(nls); + bus_unregister(&iscsi_flashnode_bus); +-- +2.30.2 + diff --git a/queue-5.12/scsi-mpt3sas-fix-error-return-value-in-_scsih_expand.patch b/queue-5.12/scsi-mpt3sas-fix-error-return-value-in-_scsih_expand.patch new file mode 100644 index 00000000000..553a4f91cbd --- /dev/null +++ b/queue-5.12/scsi-mpt3sas-fix-error-return-value-in-_scsih_expand.patch @@ -0,0 +1,43 @@ +From 48175eccdb3ada57e5e19e55cb32d20f3747995d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 16:13:00 +0800 +Subject: scsi: mpt3sas: Fix error return value in _scsih_expander_add() + +From: Zhen Lei + +[ Upstream commit d6c2ce435ffe23ef7f395ae76ec747414589db46 ] + +When an expander does not contain any 'phys', an appropriate error code -1 +should be returned, as done elsewhere in this function. However, we +currently do not explicitly assign this error code to 'rc'. As a result, 0 +was incorrectly returned. + +Link: https://lore.kernel.org/r/20210514081300.6650-1-thunder.leizhen@huawei.com +Fixes: f92363d12359 ("[SCSI] mpt3sas: add new driver supporting 12GB SAS") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index ae1973878cc7..7824e77bc6e2 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -6883,8 +6883,10 @@ _scsih_expander_add(struct MPT3SAS_ADAPTER *ioc, u16 handle) + handle, parent_handle, + (u64)sas_expander->sas_address, sas_expander->num_phys); + +- if (!sas_expander->num_phys) ++ if (!sas_expander->num_phys) { ++ rc = -1; + goto out_fail; ++ } + sas_expander->phy = kcalloc(sas_expander->num_phys, + sizeof(struct _sas_phy), GFP_KERNEL); + if (!sas_expander->phy) { +-- +2.30.2 + diff --git a/queue-5.12/selftests-bpf-whitelist-test_progs.h-from-.gitignore.patch b/queue-5.12/selftests-bpf-whitelist-test_progs.h-from-.gitignore.patch new file mode 100644 index 00000000000..8e81c3e7964 --- /dev/null +++ b/queue-5.12/selftests-bpf-whitelist-test_progs.h-from-.gitignore.patch @@ -0,0 +1,45 @@ +From 3a9201bd99fbfa2fbb315395b44402f955483373 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 14:52:11 -0700 +Subject: selftests/bpf: Whitelist test_progs.h from .gitignore + +From: Daniel Xu + +[ Upstream commit 809ed84de8b3f2fd7b1d06efb94bf98fd318a7d7 ] + +Somehow test_progs.h was being included by the existing rule: + + /test_progs* + +This is bad because: + + 1) test_progs.h is a checked in file + 2) grep-like tools like ripgrep[0] respect gitignore and + test_progs.h was being hidden from searches + +[0]: https://github.com/BurntSushi/ripgrep + +Fixes: 74b5a5968fe8 ("selftests/bpf: Replace test_progs and test_maps w/ general rule") +Signed-off-by: Daniel Xu +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/a46f64944bf678bc652410ca6028d3450f4f7f4b.1623880296.git.dxu@dxuuu.xyz +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/.gitignore | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/bpf/.gitignore b/tools/testing/selftests/bpf/.gitignore +index c0c48fdb9ac1..76d495fe3a17 100644 +--- a/tools/testing/selftests/bpf/.gitignore ++++ b/tools/testing/selftests/bpf/.gitignore +@@ -8,6 +8,7 @@ FEATURE-DUMP.libbpf + fixdep + test_dev_cgroup + /test_progs* ++!test_progs.h + test_verifier_log + feature + test_sock +-- +2.30.2 + diff --git a/queue-5.12/selftests-ftrace-fix-event-no-pid-on-1-core-machine.patch b/queue-5.12/selftests-ftrace-fix-event-no-pid-on-1-core-machine.patch new file mode 100644 index 00000000000..9c7102075fb --- /dev/null +++ b/queue-5.12/selftests-ftrace-fix-event-no-pid-on-1-core-machine.patch @@ -0,0 +1,58 @@ +From d330699eee951eace39b8f7ec14f9c9eaa5a9027 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 15:43:15 +0200 +Subject: selftests/ftrace: fix event-no-pid on 1-core machine + +From: Krzysztof Kozlowski + +[ Upstream commit 07b60713b57a8f952d029a2b6849d003d9c16108 ] + +When running event-no-pid test on small machines (e.g. cloud 1-core +instance), other events might not happen: + + + cat trace + + cnt=0 + + [ 0 -eq 0 ] + + fail No other events were recorded + [15] event tracing - restricts events based on pid notrace filtering [FAIL] + +Schedule a simple sleep task to be sure that some other process events +get recorded. + +Fixes: ebed9628f5c2 ("selftests/ftrace: Add test to test new set_event_notrace_pid file") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Steven Rostedt (VMware) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../testing/selftests/ftrace/test.d/event/event-no-pid.tc | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/testing/selftests/ftrace/test.d/event/event-no-pid.tc b/tools/testing/selftests/ftrace/test.d/event/event-no-pid.tc +index e6eb78f0b954..9933ed24f901 100644 +--- a/tools/testing/selftests/ftrace/test.d/event/event-no-pid.tc ++++ b/tools/testing/selftests/ftrace/test.d/event/event-no-pid.tc +@@ -57,6 +57,10 @@ enable_events() { + echo 1 > tracing_on + } + ++other_task() { ++ sleep .001 || usleep 1 || sleep 1 ++} ++ + echo 0 > options/event-fork + + do_reset +@@ -94,6 +98,9 @@ child=$! + echo "child = $child" + wait $child + ++# Be sure some other events will happen for small systems (e.g. 1 core) ++other_task ++ + echo 0 > tracing_on + + cnt=`count_pid $mypid` +-- +2.30.2 + diff --git a/queue-5.12/selftests-splice-adjust-for-handler-fallback-removal.patch b/queue-5.12/selftests-splice-adjust-for-handler-fallback-removal.patch new file mode 100644 index 00000000000..36e99732a41 --- /dev/null +++ b/queue-5.12/selftests-splice-adjust-for-handler-fallback-removal.patch @@ -0,0 +1,188 @@ +From ce8d12865f5583464f7f34cf714f592443a2648a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 20:25:37 -0700 +Subject: selftests: splice: Adjust for handler fallback removal + +From: Kees Cook + +[ Upstream commit 6daf076b717d189f4d02a303d45edd5732341ec1 ] + +Some pseudo-filesystems do not have an explicit splice fops since adding +commit 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops"), +and now will reject attempts to use splice() in those filesystem paths. + +Reported-by: kernel test robot +Link: https://lore.kernel.org/lkml/202009181443.C2179FB@keescook/ +Fixes: 36e2c7421f02 ("fs: don't allow splice read/write without explicit ops") +Cc: Christoph Hellwig +Cc: Shuah Khan +Cc: linux-kselftest@vger.kernel.org +Signed-off-by: Kees Cook +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../selftests/splice/short_splice_read.sh | 119 ++++++++++++++---- + 1 file changed, 98 insertions(+), 21 deletions(-) + +diff --git a/tools/testing/selftests/splice/short_splice_read.sh b/tools/testing/selftests/splice/short_splice_read.sh +index 7810d3589d9a..22b6c8910b18 100755 +--- a/tools/testing/selftests/splice/short_splice_read.sh ++++ b/tools/testing/selftests/splice/short_splice_read.sh +@@ -1,21 +1,87 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0 ++# ++# Test for mishandling of splice() on pseudofilesystems, which should catch ++# bugs like 11990a5bd7e5 ("module: Correctly truncate sysfs sections output") ++# ++# Since splice fallback was removed as part of the set_fs() rework, many of these ++# tests expect to fail now. See https://lore.kernel.org/lkml/202009181443.C2179FB@keescook/ + set -e + ++DIR=$(dirname "$0") ++ + ret=0 + ++expect_success() ++{ ++ title="$1" ++ shift ++ ++ echo "" >&2 ++ echo "$title ..." >&2 ++ ++ set +e ++ "$@" ++ rc=$? ++ set -e ++ ++ case "$rc" in ++ 0) ++ echo "ok: $title succeeded" >&2 ++ ;; ++ 1) ++ echo "FAIL: $title should work" >&2 ++ ret=$(( ret + 1 )) ++ ;; ++ *) ++ echo "FAIL: something else went wrong" >&2 ++ ret=$(( ret + 1 )) ++ ;; ++ esac ++} ++ ++expect_failure() ++{ ++ title="$1" ++ shift ++ ++ echo "" >&2 ++ echo "$title ..." >&2 ++ ++ set +e ++ "$@" ++ rc=$? ++ set -e ++ ++ case "$rc" in ++ 0) ++ echo "FAIL: $title unexpectedly worked" >&2 ++ ret=$(( ret + 1 )) ++ ;; ++ 1) ++ echo "ok: $title correctly failed" >&2 ++ ;; ++ *) ++ echo "FAIL: something else went wrong" >&2 ++ ret=$(( ret + 1 )) ++ ;; ++ esac ++} ++ + do_splice() + { + filename="$1" + bytes="$2" + expected="$3" ++ report="$4" + +- out=$(./splice_read "$filename" "$bytes" | cat) ++ out=$("$DIR"/splice_read "$filename" "$bytes" | cat) + if [ "$out" = "$expected" ] ; then +- echo "ok: $filename $bytes" ++ echo " matched $report" >&2 ++ return 0 + else +- echo "FAIL: $filename $bytes" +- ret=1 ++ echo " no match: '$out' vs $report" >&2 ++ return 1 + fi + } + +@@ -23,34 +89,45 @@ test_splice() + { + filename="$1" + ++ echo " checking $filename ..." >&2 ++ + full=$(cat "$filename") ++ rc=$? ++ if [ $rc -ne 0 ] ; then ++ return 2 ++ fi ++ + two=$(echo "$full" | grep -m1 . | cut -c-2) + + # Make sure full splice has the same contents as a standard read. +- do_splice "$filename" 4096 "$full" ++ echo " splicing 4096 bytes ..." >&2 ++ if ! do_splice "$filename" 4096 "$full" "full read" ; then ++ return 1 ++ fi + + # Make sure a partial splice see the first two characters. +- do_splice "$filename" 2 "$two" ++ echo " splicing 2 bytes ..." >&2 ++ if ! do_splice "$filename" 2 "$two" "'$two'" ; then ++ return 1 ++ fi ++ ++ return 0 + } + +-# proc_single_open(), seq_read() +-test_splice /proc/$$/limits +-# special open, seq_read() +-test_splice /proc/$$/comm ++### /proc/$pid/ has no splice interface; these should all fail. ++expect_failure "proc_single_open(), seq_read() splice" test_splice /proc/$$/limits ++expect_failure "special open(), seq_read() splice" test_splice /proc/$$/comm + +-# proc_handler, proc_dointvec_minmax +-test_splice /proc/sys/fs/nr_open +-# proc_handler, proc_dostring +-test_splice /proc/sys/kernel/modprobe +-# proc_handler, special read +-test_splice /proc/sys/kernel/version ++### /proc/sys/ has a splice interface; these should all succeed. ++expect_success "proc_handler: proc_dointvec_minmax() splice" test_splice /proc/sys/fs/nr_open ++expect_success "proc_handler: proc_dostring() splice" test_splice /proc/sys/kernel/modprobe ++expect_success "proc_handler: special read splice" test_splice /proc/sys/kernel/version + ++### /sys/ has no splice interface; these should all fail. + if ! [ -d /sys/module/test_module/sections ] ; then +- modprobe test_module ++ expect_success "test_module kernel module load" modprobe test_module + fi +-# kernfs, attr +-test_splice /sys/module/test_module/coresize +-# kernfs, binattr +-test_splice /sys/module/test_module/sections/.init.text ++expect_failure "kernfs attr splice" test_splice /sys/module/test_module/coresize ++expect_failure "kernfs binattr splice" test_splice /sys/module/test_module/sections/.init.text + + exit $ret +-- +2.30.2 + diff --git a/queue-5.12/selftests-tls-clean-up-uninitialized-warnings.patch b/queue-5.12/selftests-tls-clean-up-uninitialized-warnings.patch new file mode 100644 index 00000000000..02e119835c3 --- /dev/null +++ b/queue-5.12/selftests-tls-clean-up-uninitialized-warnings.patch @@ -0,0 +1,83 @@ +From 22861c08519676778e0d9ab76a3914afb50523b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 13:25:03 -0700 +Subject: selftests: tls: clean up uninitialized warnings + +From: Jakub Kicinski + +[ Upstream commit baa00119d69e3318da8d99867fc1170ebddf09ce ] + +A bunch of tests uses uninitialized stack memory as random +data to send. This is harmless but generates compiler warnings. +Explicitly init the buffers with random data. + +Signed-off-by: Jakub Kicinski +Acked-by: Vadim Fedorenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/tls.c | 20 ++++++++++++++++++++ + 1 file changed, 20 insertions(+) + +diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c +index 426d07875a48..58fea6eb588d 100644 +--- a/tools/testing/selftests/net/tls.c ++++ b/tools/testing/selftests/net/tls.c +@@ -25,6 +25,18 @@ + #define TLS_PAYLOAD_MAX_LEN 16384 + #define SOL_TLS 282 + ++static void memrnd(void *s, size_t n) ++{ ++ int *dword = s; ++ char *byte; ++ ++ for (; n >= 4; n -= 4) ++ *dword++ = rand(); ++ byte = (void *)dword; ++ while (n--) ++ *byte++ = rand(); ++} ++ + FIXTURE(tls_basic) + { + int fd, cfd; +@@ -308,6 +320,8 @@ TEST_F(tls, recv_max) + char recv_mem[TLS_PAYLOAD_MAX_LEN]; + char buf[TLS_PAYLOAD_MAX_LEN]; + ++ memrnd(buf, sizeof(buf)); ++ + EXPECT_GE(send(self->fd, buf, send_len, 0), 0); + EXPECT_NE(recv(self->cfd, recv_mem, send_len, 0), -1); + EXPECT_EQ(memcmp(buf, recv_mem, send_len), 0); +@@ -588,6 +602,8 @@ TEST_F(tls, recvmsg_single_max) + struct iovec vec; + struct msghdr hdr; + ++ memrnd(send_mem, sizeof(send_mem)); ++ + EXPECT_EQ(send(self->fd, send_mem, send_len, 0), send_len); + vec.iov_base = (char *)recv_mem; + vec.iov_len = TLS_PAYLOAD_MAX_LEN; +@@ -610,6 +626,8 @@ TEST_F(tls, recvmsg_multiple) + struct msghdr hdr; + int i; + ++ memrnd(buf, sizeof(buf)); ++ + EXPECT_EQ(send(self->fd, buf, send_len, 0), send_len); + for (i = 0; i < msg_iovlen; i++) { + iov_base[i] = (char *)malloc(iov_len); +@@ -634,6 +652,8 @@ TEST_F(tls, single_send_multiple_recv) + char send_mem[TLS_PAYLOAD_MAX_LEN * 2]; + char recv_mem[TLS_PAYLOAD_MAX_LEN * 2]; + ++ memrnd(send_mem, sizeof(send_mem)); ++ + EXPECT_GE(send(self->fd, send_mem, total_len, 0), 0); + memset(recv_mem, 0, total_len); + +-- +2.30.2 + diff --git a/queue-5.12/selftests-tls-fix-chacha-bidir-tests.patch b/queue-5.12/selftests-tls-fix-chacha-bidir-tests.patch new file mode 100644 index 00000000000..1626144b7a3 --- /dev/null +++ b/queue-5.12/selftests-tls-fix-chacha-bidir-tests.patch @@ -0,0 +1,147 @@ +From 6f24d488c109f72eecd4a18b0c7edcada75842fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 13:25:04 -0700 +Subject: selftests: tls: fix chacha+bidir tests + +From: Jakub Kicinski + +[ Upstream commit 291c53e4dacd3a2cc3152d8af37f07f8496c594a ] + +ChaCha support did not adjust the bidirectional test. +We need to set up KTLS in reverse direction correctly, +otherwise these two cases will fail: + + tls.12_chacha.bidir + tls.13_chacha.bidir + +Fixes: 4f336e88a870 ("selftests/tls: add CHACHA20-POLY1305 to tls selftests") +Signed-off-by: Jakub Kicinski +Acked-by: Vadim Fedorenko +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/tls.c | 67 ++++++++++++++++++------------- + 1 file changed, 39 insertions(+), 28 deletions(-) + +diff --git a/tools/testing/selftests/net/tls.c b/tools/testing/selftests/net/tls.c +index 58fea6eb588d..112d41d01b12 100644 +--- a/tools/testing/selftests/net/tls.c ++++ b/tools/testing/selftests/net/tls.c +@@ -25,6 +25,35 @@ + #define TLS_PAYLOAD_MAX_LEN 16384 + #define SOL_TLS 282 + ++struct tls_crypto_info_keys { ++ union { ++ struct tls12_crypto_info_aes_gcm_128 aes128; ++ struct tls12_crypto_info_chacha20_poly1305 chacha20; ++ }; ++ size_t len; ++}; ++ ++static void tls_crypto_info_init(uint16_t tls_version, uint16_t cipher_type, ++ struct tls_crypto_info_keys *tls12) ++{ ++ memset(tls12, 0, sizeof(*tls12)); ++ ++ switch (cipher_type) { ++ case TLS_CIPHER_CHACHA20_POLY1305: ++ tls12->len = sizeof(struct tls12_crypto_info_chacha20_poly1305); ++ tls12->chacha20.info.version = tls_version; ++ tls12->chacha20.info.cipher_type = cipher_type; ++ break; ++ case TLS_CIPHER_AES_GCM_128: ++ tls12->len = sizeof(struct tls12_crypto_info_aes_gcm_128); ++ tls12->aes128.info.version = tls_version; ++ tls12->aes128.info.cipher_type = cipher_type; ++ break; ++ default: ++ break; ++ } ++} ++ + static void memrnd(void *s, size_t n) + { + int *dword = s; +@@ -145,33 +174,16 @@ FIXTURE_VARIANT_ADD(tls, 13_chacha) + + FIXTURE_SETUP(tls) + { +- union { +- struct tls12_crypto_info_aes_gcm_128 aes128; +- struct tls12_crypto_info_chacha20_poly1305 chacha20; +- } tls12; ++ struct tls_crypto_info_keys tls12; + struct sockaddr_in addr; + socklen_t len; + int sfd, ret; +- size_t tls12_sz; + + self->notls = false; + len = sizeof(addr); + +- memset(&tls12, 0, sizeof(tls12)); +- switch (variant->cipher_type) { +- case TLS_CIPHER_CHACHA20_POLY1305: +- tls12_sz = sizeof(struct tls12_crypto_info_chacha20_poly1305); +- tls12.chacha20.info.version = variant->tls_version; +- tls12.chacha20.info.cipher_type = variant->cipher_type; +- break; +- case TLS_CIPHER_AES_GCM_128: +- tls12_sz = sizeof(struct tls12_crypto_info_aes_gcm_128); +- tls12.aes128.info.version = variant->tls_version; +- tls12.aes128.info.cipher_type = variant->cipher_type; +- break; +- default: +- tls12_sz = 0; +- } ++ tls_crypto_info_init(variant->tls_version, variant->cipher_type, ++ &tls12); + + addr.sin_family = AF_INET; + addr.sin_addr.s_addr = htonl(INADDR_ANY); +@@ -199,7 +211,7 @@ FIXTURE_SETUP(tls) + + if (!self->notls) { + ret = setsockopt(self->fd, SOL_TLS, TLS_TX, &tls12, +- tls12_sz); ++ tls12.len); + ASSERT_EQ(ret, 0); + } + +@@ -212,7 +224,7 @@ FIXTURE_SETUP(tls) + ASSERT_EQ(ret, 0); + + ret = setsockopt(self->cfd, SOL_TLS, TLS_RX, &tls12, +- tls12_sz); ++ tls12.len); + ASSERT_EQ(ret, 0); + } + +@@ -854,18 +866,17 @@ TEST_F(tls, bidir) + int ret; + + if (!self->notls) { +- struct tls12_crypto_info_aes_gcm_128 tls12; ++ struct tls_crypto_info_keys tls12; + +- memset(&tls12, 0, sizeof(tls12)); +- tls12.info.version = variant->tls_version; +- tls12.info.cipher_type = TLS_CIPHER_AES_GCM_128; ++ tls_crypto_info_init(variant->tls_version, variant->cipher_type, ++ &tls12); + + ret = setsockopt(self->fd, SOL_TLS, TLS_RX, &tls12, +- sizeof(tls12)); ++ tls12.len); + ASSERT_EQ(ret, 0); + + ret = setsockopt(self->cfd, SOL_TLS, TLS_TX, &tls12, +- sizeof(tls12)); ++ tls12.len); + ASSERT_EQ(ret, 0); + } + +-- +2.30.2 + diff --git a/queue-5.12/selftests-vm-pkeys-fix-alloc_random_pkey-to-make-it-.patch b/queue-5.12/selftests-vm-pkeys-fix-alloc_random_pkey-to-make-it-.patch new file mode 100644 index 00000000000..d553e4e03d5 --- /dev/null +++ b/queue-5.12/selftests-vm-pkeys-fix-alloc_random_pkey-to-make-it-.patch @@ -0,0 +1,102 @@ +From bad00d75a33c5db744b2c4a4021dc896b2940684 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:56:53 -0700 +Subject: selftests/vm/pkeys: fix alloc_random_pkey() to make it really, really + random + +From: Dave Hansen + +[ Upstream commit f36ef407628835a7d7fb3d235b1f1aac7022d9a3 ] + +Patch series "selftests/vm/pkeys: Bug fixes and a new test". + +There has been a lot of activity on the x86 front around the XSAVE +architecture which is used to context-switch processor state (among other +things). In addition, AMD has recently joined the protection keys club by +adding processor support for PKU. + +The AMD implementation helped uncover a kernel bug around the PKRU "init +state", which actually applied to Intel's implementation but was just +harder to hit. This series adds a test which is expected to help find +this class of bug both on AMD and Intel. All the work around pkeys on x86 +also uncovered a few bugs in the selftest. + +This patch (of 4): + +The "random" pkey allocation code currently does the good old: + + srand((unsigned int)time(NULL)); + +*But*, it unfortunately does this on every random pkey allocation. + +There may be thousands of these a second. time() has a one second +resolution. So, each time alloc_random_pkey() is called, the PRNG is +*RESET* to time(). This is nasty. Normally, if you do: + + srand(); + foo = rand(); + bar = rand(); + +You'll be quite guaranteed that 'foo' and 'bar' are different. But, if +you do: + + srand(1); + foo = rand(); + srand(1); + bar = rand(); + +You are quite guaranteed that 'foo' and 'bar' are the *SAME*. The recent +"fix" effectively forced the test case to use the same "random" pkey for +the whole test, unless the test run crossed a second boundary. + +Only run srand() once at program startup. + +This explains some very odd and persistent test failures I've been seeing. + +Link: https://lkml.kernel.org/r/20210611164153.91B76FB8@viggo.jf.intel.com +Link: https://lkml.kernel.org/r/20210611164155.192D00FF@viggo.jf.intel.com +Fixes: 6e373263ce07 ("selftests/vm/pkeys: fix alloc_random_pkey() to make it really random") +Signed-off-by: Dave Hansen +Signed-off-by: Thomas Gleixner +Tested-by: Aneesh Kumar K.V +Cc: Ram Pai +Cc: Sandipan Das +Cc: Florian Weimer +Cc: "Desnes A. Nunes do Rosario" +Cc: Ingo Molnar +Cc: Thiago Jung Bauermann +Cc: Michael Ellerman +Cc: Michal Hocko +Cc: Michal Suchanek +Cc: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/protection_keys.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/vm/protection_keys.c b/tools/testing/selftests/vm/protection_keys.c +index fdbb602ecf32..9ee0ae5d3e06 100644 +--- a/tools/testing/selftests/vm/protection_keys.c ++++ b/tools/testing/selftests/vm/protection_keys.c +@@ -561,7 +561,6 @@ int alloc_random_pkey(void) + int nr_alloced = 0; + int random_index; + memset(alloced_pkeys, 0, sizeof(alloced_pkeys)); +- srand((unsigned int)time(NULL)); + + /* allocate every possible key and make a note of which ones we got */ + max_nr_pkey_allocs = NR_PKEYS; +@@ -1552,6 +1551,8 @@ int main(void) + int nr_iterations = 22; + int pkeys_supported = is_pkeys_supported(); + ++ srand((unsigned int)time(NULL)); ++ + setup_handlers(); + + printf("has pkeys: %d\n", pkeys_supported); +-- +2.30.2 + diff --git a/queue-5.12/selftests-vm-pkeys-handle-negative-sys_pkey_alloc-re.patch b/queue-5.12/selftests-vm-pkeys-handle-negative-sys_pkey_alloc-re.patch new file mode 100644 index 00000000000..ec2bde9ddcb --- /dev/null +++ b/queue-5.12/selftests-vm-pkeys-handle-negative-sys_pkey_alloc-re.patch @@ -0,0 +1,57 @@ +From 1371c26a4b532fd450c6498644c84f5a7ce1bea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:56:56 -0700 +Subject: selftests/vm/pkeys: handle negative sys_pkey_alloc() return code + +From: Dave Hansen + +[ Upstream commit bf68294a2ec39ed7fec6a5b45d52034e6983157a ] + +The alloc_pkey() sefltest function wraps the sys_pkey_alloc() system call. +On success, it updates its "shadow" register value because +sys_pkey_alloc() updates the real register. + +But, the success check is wrong. pkey_alloc() considers any non-zero +return code to indicate success where the pkey register will be modified. +This fails to take negative return codes into account. + +Consider only a positive return value as a successful call. + +Link: https://lkml.kernel.org/r/20210611164157.87AB4246@viggo.jf.intel.com +Fixes: 5f23f6d082a9 ("x86/pkeys: Add self-tests") +Reported-by: Thomas Gleixner +Signed-off-by: Dave Hansen +Tested-by: Aneesh Kumar K.V +Cc: Ram Pai +Cc: Sandipan Das +Cc: Florian Weimer +Cc: "Desnes A. Nunes do Rosario" +Cc: Ingo Molnar +Cc: Thiago Jung Bauermann +Cc: Michael Ellerman +Cc: Michal Hocko +Cc: Michal Suchanek +Cc: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/protection_keys.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/vm/protection_keys.c b/tools/testing/selftests/vm/protection_keys.c +index 9ee0ae5d3e06..356d62fca27f 100644 +--- a/tools/testing/selftests/vm/protection_keys.c ++++ b/tools/testing/selftests/vm/protection_keys.c +@@ -510,7 +510,7 @@ int alloc_pkey(void) + " shadow: 0x%016llx\n", + __func__, __LINE__, ret, __read_pkey_reg(), + shadow_pkey_reg); +- if (ret) { ++ if (ret > 0) { + /* clear both the bits: */ + shadow_pkey_reg = set_pkey_bits(shadow_pkey_reg, ret, + ~PKEY_MASK); +-- +2.30.2 + diff --git a/queue-5.12/selftests-vm-pkeys-refill-shadow-register-after-impl.patch b/queue-5.12/selftests-vm-pkeys-refill-shadow-register-after-impl.patch new file mode 100644 index 00000000000..b5a3f0801df --- /dev/null +++ b/queue-5.12/selftests-vm-pkeys-refill-shadow-register-after-impl.patch @@ -0,0 +1,75 @@ +From ea92c3b658ef0509caae5f33557bb326295ccd89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:56:59 -0700 +Subject: selftests/vm/pkeys: refill shadow register after implicit kernel + write + +From: Dave Hansen + +[ Upstream commit 6039ca254979694c5362dfebadd105e286c397bb ] + +The pkey test code keeps a "shadow" of the pkey register around. This +ensures that any bugs which might write to the register can be caught more +quickly. + +Generally, userspace has a good idea when the kernel is going to write to +the register. For instance, alloc_pkey() is passed a permission mask. +The caller of alloc_pkey() can update the shadow based on the return value +and the mask. + +But, the kernel can also modify the pkey register in a more sneaky way. +For mprotect(PROT_EXEC) mappings, the kernel will allocate a pkey and +write the pkey register to create an execute-only mapping. The kernel +never tells userspace what key it uses for this. + +This can cause the test to fail with messages like: + + protection_keys_64.2: pkey-helpers.h:132: _read_pkey_reg: Assertion `pkey_reg == shadow_pkey_reg' failed. + +because the shadow was not updated with the new kernel-set value. + +Forcibly update the shadow value immediately after an mprotect(). + +Link: https://lkml.kernel.org/r/20210611164200.EF76AB73@viggo.jf.intel.com +Fixes: 6af17cf89e99 ("x86/pkeys/selftests: Add PROT_EXEC test") +Signed-off-by: Dave Hansen +Signed-off-by: Thomas Gleixner +Tested-by: Aneesh Kumar K.V +Cc: Ram Pai +Cc: Sandipan Das +Cc: Florian Weimer +Cc: "Desnes A. Nunes do Rosario" +Cc: Ingo Molnar +Cc: Thiago Jung Bauermann +Cc: Michael Ellerman +Cc: Michal Hocko +Cc: Michal Suchanek +Cc: Shuah Khan +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/protection_keys.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/tools/testing/selftests/vm/protection_keys.c b/tools/testing/selftests/vm/protection_keys.c +index 356d62fca27f..87eecd5ba577 100644 +--- a/tools/testing/selftests/vm/protection_keys.c ++++ b/tools/testing/selftests/vm/protection_keys.c +@@ -1448,6 +1448,13 @@ void test_implicit_mprotect_exec_only_memory(int *ptr, u16 pkey) + ret = mprotect(p1, PAGE_SIZE, PROT_EXEC); + pkey_assert(!ret); + ++ /* ++ * Reset the shadow, assuming that the above mprotect() ++ * correctly changed PKRU, but to an unknown value since ++ * the actual alllocated pkey is unknown. ++ */ ++ shadow_pkey_reg = __read_pkey_reg(); ++ + dprintf2("pkey_reg: %016llx\n", read_pkey_reg()); + + /* Make sure this is an *instruction* fault */ +-- +2.30.2 + diff --git a/queue-5.12/serial-8250-8250_omap-fix-possible-interrupt-storm-o.patch b/queue-5.12/serial-8250-8250_omap-fix-possible-interrupt-storm-o.patch new file mode 100644 index 00000000000..7252e63db37 --- /dev/null +++ b/queue-5.12/serial-8250-8250_omap-fix-possible-interrupt-storm-o.patch @@ -0,0 +1,90 @@ +From 1355b15f3f0487501accc14eb2aa68620622c7d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 20:27:04 +0530 +Subject: serial: 8250: 8250_omap: Fix possible interrupt storm on K3 SoCs + +From: Vignesh Raghavendra + +[ Upstream commit b67e830d38fa9335d927fe67e812e3ed81b4689c ] + +On K3 family of SoCs (which includes AM654 SoC), it is observed that RX +TIMEOUT is signalled after RX FIFO has been drained, in which case a +dummy read of RX FIFO is required to clear RX TIMEOUT condition. +Otherwise, this would lead to an interrupt storm. + +Fix this by introducing UART_RX_TIMEOUT_QUIRK flag and doing a dummy +read in IRQ handler when RX TIMEOUT is reported with no data in RX FIFO. + +Fixes: be70874498f3 ("serial: 8250_omap: Add support for AM654 UART controller") +Reported-by: Jan Kiszka +Tested-by: Jan Kiszka +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20210622145704.11168-1-vigneshr@ti.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 3161d3655670..c37468887fd2 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -43,6 +43,7 @@ + #define UART_ERRATA_CLOCK_DISABLE (1 << 3) + #define UART_HAS_EFR2 BIT(4) + #define UART_HAS_RHR_IT_DIS BIT(5) ++#define UART_RX_TIMEOUT_QUIRK BIT(6) + + #define OMAP_UART_FCR_RX_TRIG 6 + #define OMAP_UART_FCR_TX_TRIG 4 +@@ -104,6 +105,9 @@ + #define UART_OMAP_EFR2 0x23 + #define UART_OMAP_EFR2_TIMEOUT_BEHAVE BIT(6) + ++/* RX FIFO occupancy indicator */ ++#define UART_OMAP_RX_LVL 0x64 ++ + struct omap8250_priv { + int line; + u8 habit; +@@ -611,6 +615,7 @@ static int omap_8250_dma_handle_irq(struct uart_port *port); + static irqreturn_t omap8250_irq(int irq, void *dev_id) + { + struct uart_port *port = dev_id; ++ struct omap8250_priv *priv = port->private_data; + struct uart_8250_port *up = up_to_u8250p(port); + unsigned int iir; + int ret; +@@ -625,6 +630,18 @@ static irqreturn_t omap8250_irq(int irq, void *dev_id) + serial8250_rpm_get(up); + iir = serial_port_in(port, UART_IIR); + ret = serial8250_handle_irq(port, iir); ++ ++ /* ++ * On K3 SoCs, it is observed that RX TIMEOUT is signalled after ++ * FIFO has been drained, in which case a dummy read of RX FIFO ++ * is required to clear RX TIMEOUT condition. ++ */ ++ if (priv->habit & UART_RX_TIMEOUT_QUIRK && ++ (iir & UART_IIR_RX_TIMEOUT) == UART_IIR_RX_TIMEOUT && ++ serial_port_in(port, UART_OMAP_RX_LVL) == 0) { ++ serial_port_in(port, UART_RX); ++ } ++ + serial8250_rpm_put(up); + + return IRQ_RETVAL(ret); +@@ -1218,7 +1235,8 @@ static struct omap8250_dma_params am33xx_dma = { + + static struct omap8250_platdata am654_platdata = { + .dma_params = &am654_dma, +- .habit = UART_HAS_EFR2 | UART_HAS_RHR_IT_DIS, ++ .habit = UART_HAS_EFR2 | UART_HAS_RHR_IT_DIS | ++ UART_RX_TIMEOUT_QUIRK, + }; + + static struct omap8250_platdata am33xx_platdata = { +-- +2.30.2 + diff --git a/queue-5.12/serial-8250-actually-allow-upf_magic_multiplier-baud.patch b/queue-5.12/serial-8250-actually-allow-upf_magic_multiplier-baud.patch new file mode 100644 index 00000000000..ce82e4549ad --- /dev/null +++ b/queue-5.12/serial-8250-actually-allow-upf_magic_multiplier-baud.patch @@ -0,0 +1,84 @@ +From cc1d07f283e47091c90b7e68b364a3e10195806f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 20:38:34 +0200 +Subject: serial: 8250: Actually allow UPF_MAGIC_MULTIPLIER baud rates + +From: Maciej W. Rozycki + +[ Upstream commit 78bcae8616ac277d6cb7f38e211493948ed73e30 ] + +Support for magic baud rate divisors of 32770 and 32769 used with SMSC +Super I/O chips for extra baud rates of 230400 and 460800 respectively +where base rate is 115200[1] has been added around Linux 2.5.64, which +predates our repo history, but the origin could be identified as commit +2a717aad772f ("Merge with Linux 2.5.64.") with the old MIPS/Linux repo +also at: . + +Code that is now in `serial8250_do_get_divisor' was added back then to +`serial8250_get_divisor', but that code would only ever trigger if one +of the higher baud rates was actually requested, and that cannot ever +happen, because the earlier call to `serial8250_get_baud_rate' never +returns them. This is because it calls `uart_get_baud_rate' with the +maximum requested being the base rate, that is clk/16 or 115200 for SMSC +chips at their nominal clock rate. + +Fix it then and allow UPF_MAGIC_MULTIPLIER baud rates to be selected, by +requesting the maximum baud rate of clk/4 rather than clk/16 if the flag +has been set. Also correct the minimum baud rate, observing that these +ports only support actual (non-magic) divisors of up to 32767 only. + +References: + +[1] "FDC37M81x, PC98/99 Compliant Enhanced Super I/O Controller with + Keyboard/Mouse Wake-Up", Standard Microsystems Corporation, Rev. + 03/27/2000, Table 31 - "Baud Rates", p. 77 + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Maciej W. Rozycki +Link: https://lore.kernel.org/r/alpine.DEB.2.21.2105190412280.29169@angie.orcam.me.uk +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_port.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 6e141429c980..6d9c494bed7d 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -2635,6 +2635,21 @@ static unsigned int serial8250_get_baud_rate(struct uart_port *port, + struct ktermios *old) + { + unsigned int tolerance = port->uartclk / 100; ++ unsigned int min; ++ unsigned int max; ++ ++ /* ++ * Handle magic divisors for baud rates above baud_base on SMSC ++ * Super I/O chips. Enable custom rates of clk/4 and clk/8, but ++ * disable divisor values beyond 32767, which are unavailable. ++ */ ++ if (port->flags & UPF_MAGIC_MULTIPLIER) { ++ min = port->uartclk / 16 / UART_DIV_MAX >> 1; ++ max = (port->uartclk + tolerance) / 4; ++ } else { ++ min = port->uartclk / 16 / UART_DIV_MAX; ++ max = (port->uartclk + tolerance) / 16; ++ } + + /* + * Ask the core to calculate the divisor for us. +@@ -2642,9 +2657,7 @@ static unsigned int serial8250_get_baud_rate(struct uart_port *port, + * slower than nominal still match standard baud rates without + * causing transmission errors. + */ +- return uart_get_baud_rate(port, termios, old, +- port->uartclk / 16 / UART_DIV_MAX, +- (port->uartclk + tolerance) / 16); ++ return uart_get_baud_rate(port, termios, old, min, max); + } + + /* +-- +2.30.2 + diff --git a/queue-5.12/serial-8250_omap-fix-a-timeout-loop-condition.patch b/queue-5.12/serial-8250_omap-fix-a-timeout-loop-condition.patch new file mode 100644 index 00000000000..9c03ef22128 --- /dev/null +++ b/queue-5.12/serial-8250_omap-fix-a-timeout-loop-condition.patch @@ -0,0 +1,37 @@ +From 848a49e95d8684aeb770560954eaea23846142b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 10:19:22 +0300 +Subject: serial: 8250_omap: fix a timeout loop condition + +From: Dan Carpenter + +[ Upstream commit d7e325aaa8c3593b5a572b583ecad79e95f32e7f ] + +This loop ends on -1 so the error message will never be printed. + +Fixes: 4bcf59a5dea0 ("serial: 8250: 8250_omap: Account for data in flight during DMA teardown") +Reviewed-by: Alexander Sverdlin +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YIpd+kOpXKMpEXPf@mwanda +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/8250_omap.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 23e0decde33e..3161d3655670 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -813,7 +813,7 @@ static void __dma_rx_do_complete(struct uart_8250_port *p) + poll_count--) + cpu_relax(); + +- if (!poll_count) ++ if (poll_count == -1) + dev_err(p->port.dev, "teardown incomplete\n"); + } + } +-- +2.30.2 + diff --git a/queue-5.12/serial-fsl_lpuart-don-t-modify-arbitrary-data-on-lpu.patch b/queue-5.12/serial-fsl_lpuart-don-t-modify-arbitrary-data-on-lpu.patch new file mode 100644 index 00000000000..102d8958d11 --- /dev/null +++ b/queue-5.12/serial-fsl_lpuart-don-t-modify-arbitrary-data-on-lpu.patch @@ -0,0 +1,37 @@ +From 63e39f1f2e7c3c9b2f37a629f9f9e7b0bf7c1a12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 16:12:47 +0200 +Subject: serial: fsl_lpuart: don't modify arbitrary data on lpuart32 + +From: Michael Walle + +[ Upstream commit ccf08fd1204bcb5311cc10aea037c71c6e74720a ] + +lpuart_rx_dma_startup() is used for both the 8 bit and the 32 bit +version of the LPUART. Modify the UARTCR only for the 8 bit version. + +Fixes: f4eef224a09f ("serial: fsl_lpuart: add sysrq support when using dma") +Signed-off-by: Michael Walle +Link: https://lore.kernel.org/r/20210512141255.18277-2-michael@walle.cc +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 794035041744..fbf2e4d2d22b 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1625,7 +1625,7 @@ static void lpuart_rx_dma_startup(struct lpuart_port *sport) + sport->lpuart_dma_rx_use = true; + rx_dma_timer_init(sport); + +- if (sport->port.has_sysrq) { ++ if (sport->port.has_sysrq && !lpuart_is_32(sport)) { + cr3 = readb(sport->port.membase + UARTCR3); + cr3 |= UARTCR3_FEIE; + writeb(cr3, sport->port.membase + UARTCR3); +-- +2.30.2 + diff --git a/queue-5.12/serial-fsl_lpuart-remove-rtscts-handling-from-get_mc.patch b/queue-5.12/serial-fsl_lpuart-remove-rtscts-handling-from-get_mc.patch new file mode 100644 index 00000000000..f3f820cd4c3 --- /dev/null +++ b/queue-5.12/serial-fsl_lpuart-remove-rtscts-handling-from-get_mc.patch @@ -0,0 +1,50 @@ +From 024577857a3c5dce1d78ecc7c417d03aa8993bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 16:12:52 +0200 +Subject: serial: fsl_lpuart: remove RTSCTS handling from get_mctrl() + +From: Michael Walle + +[ Upstream commit e60c2991f18bf221fa9908ff10cb24eaedaa9bae ] + +The wrong code in set_mctrl() was already removed in commit 2b30efe2e88a +("tty: serial: lpuart: Remove unnecessary code from set_mctrl"), but the +code in get_mctrl() wasn't removed. It will not return the state of the +RTS or CTS line but whether automatic flow control is enabled, which is +wrong for the get_mctrl(). Thus remove it. + +Fixes: 2b30efe2e88a ("tty: serial: lpuart: Remove unnecessary code from set_mctrl") +Signed-off-by: Michael Walle +Link: https://lore.kernel.org/r/20210512141255.18277-7-michael@walle.cc +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 12 +----------- + 1 file changed, 1 insertion(+), 11 deletions(-) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index fbf2e4d2d22b..9c78e43e669d 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -1408,17 +1408,7 @@ static unsigned int lpuart_get_mctrl(struct uart_port *port) + + static unsigned int lpuart32_get_mctrl(struct uart_port *port) + { +- unsigned int temp = 0; +- unsigned long reg; +- +- reg = lpuart32_read(port, UARTMODIR); +- if (reg & UARTMODIR_TXCTSE) +- temp |= TIOCM_CTS; +- +- if (reg & UARTMODIR_RXRTSE) +- temp |= TIOCM_RTS; +- +- return temp; ++ return 0; + } + + static void lpuart_set_mctrl(struct uart_port *port, unsigned int mctrl) +-- +2.30.2 + diff --git a/queue-5.12/serial-mvebu-uart-correctly-calculate-minimal-possib.patch b/queue-5.12/serial-mvebu-uart-correctly-calculate-minimal-possib.patch new file mode 100644 index 00000000000..269370150a8 --- /dev/null +++ b/queue-5.12/serial-mvebu-uart-correctly-calculate-minimal-possib.patch @@ -0,0 +1,66 @@ +From a18e6f25df0752205f77f5df0ab2c4bd6eb32ecb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 00:49:02 +0200 +Subject: serial: mvebu-uart: correctly calculate minimal possible baudrate +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit deeaf963569a0d9d1b08babb771f61bb501a5704 ] + +For default (x16) scheme which is currently used by mvebu-uart.c driver, +maximal divisor of UART base clock is 1023*16. Therefore there is limit for +minimal supported baudrate. This change calculate it correctly and prevents +setting invalid divisor 0 into hardware registers. + +Signed-off-by: Pali Rohár +Fixes: 68a0db1d7da2 ("serial: mvebu-uart: add function to change baudrate") +Link: https://lore.kernel.org/r/20210624224909.6350-4-pali@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/mvebu-uart.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index 9638ae6aae79..1e26220c7852 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -481,7 +481,7 @@ static void mvebu_uart_set_termios(struct uart_port *port, + struct ktermios *old) + { + unsigned long flags; +- unsigned int baud; ++ unsigned int baud, min_baud, max_baud; + + spin_lock_irqsave(&port->lock, flags); + +@@ -500,16 +500,21 @@ static void mvebu_uart_set_termios(struct uart_port *port, + port->ignore_status_mask |= STAT_RX_RDY(port) | STAT_BRK_ERR; + + /* ++ * Maximal divisor is 1023 * 16 when using default (x16) scheme. + * Maximum achievable frequency with simple baudrate divisor is 230400. + * Since the error per bit frame would be of more than 15%, achieving + * higher frequencies would require to implement the fractional divisor + * feature. + */ +- baud = uart_get_baud_rate(port, termios, old, 0, 230400); ++ min_baud = DIV_ROUND_UP(port->uartclk, 1023 * 16); ++ max_baud = 230400; ++ ++ baud = uart_get_baud_rate(port, termios, old, min_baud, max_baud); + if (mvebu_uart_baud_rate_set(port, baud)) { + /* No clock available, baudrate cannot be changed */ + if (old) +- baud = uart_get_baud_rate(port, old, NULL, 0, 230400); ++ baud = uart_get_baud_rate(port, old, NULL, ++ min_baud, max_baud); + } else { + tty_termios_encode_baud_rate(termios, baud, baud); + uart_update_timeout(port, termios->c_cflag, baud); +-- +2.30.2 + diff --git a/queue-5.12/serial-mvebu-uart-do-not-allow-changing-baudrate-whe.patch b/queue-5.12/serial-mvebu-uart-do-not-allow-changing-baudrate-whe.patch new file mode 100644 index 00000000000..5c38473b3d2 --- /dev/null +++ b/queue-5.12/serial-mvebu-uart-do-not-allow-changing-baudrate-whe.patch @@ -0,0 +1,55 @@ +From d3e2b3010b59a0a68a63d5e31f097e982ed4e8af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Jun 2021 00:49:01 +0200 +Subject: serial: mvebu-uart: do not allow changing baudrate when uartclk is + not available +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit ecd6b010d81f97b06b2f64d2d4f50ebf5acddaa9 ] + +Testing mvuart->clk for non-error is not enough as mvuart->clk may contain +valid clk pointer but when clk_prepare_enable(mvuart->clk) failed then +port->uartclk is zero. + +When mvuart->clk is not available then port->uartclk is zero too. + +Parent clock rate port->uartclk is needed to calculate UART clock divisor +and without it is not possible to change baudrate. + +So fix test condition when it is possible to change baudrate. + +Signed-off-by: Pali Rohár +Fixes: 68a0db1d7da2 ("serial: mvebu-uart: add function to change baudrate") +Link: https://lore.kernel.org/r/20210624224909.6350-3-pali@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/mvebu-uart.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/mvebu-uart.c b/drivers/tty/serial/mvebu-uart.c +index 908a4ac6b5a7..9638ae6aae79 100644 +--- a/drivers/tty/serial/mvebu-uart.c ++++ b/drivers/tty/serial/mvebu-uart.c +@@ -445,12 +445,11 @@ static void mvebu_uart_shutdown(struct uart_port *port) + + static int mvebu_uart_baud_rate_set(struct uart_port *port, unsigned int baud) + { +- struct mvebu_uart *mvuart = to_mvuart(port); + unsigned int d_divisor, m_divisor; + u32 brdv, osamp; + +- if (IS_ERR(mvuart->clk)) +- return -PTR_ERR(mvuart->clk); ++ if (!port->uartclk) ++ return -EOPNOTSUPP; + + /* + * The baudrate is derived from the UART clock thanks to two divisors: +-- +2.30.2 + diff --git a/queue-5.12/series b/queue-5.12/series index a95f3ad2f0b..25cd8036f77 100644 --- a/queue-5.12/series +++ b/queue-5.12/series @@ -116,3 +116,568 @@ fuse-fix-infinite-loop-in-sget_fc.patch fuse-ignore-pg_workingset-after-stealing.patch fuse-check-connected-before-queueing-on-fpq-io.patch fuse-reject-internal-errno.patch +thermal-cpufreq_cooling-update-offline-cpus-per-cpu-.patch +spi-make-of_register_spi_device-also-set-the-fwnode.patch +add-a-reference-to-ucounts-for-each-cred.patch +staging-media-rkvdec-fix-pm_runtime_get_sync-usage-c.patch +media-i2c-imx334-fix-the-pm-runtime-get-logic.patch +media-marvel-ccic-fix-some-issues-when-getting-pm_ru.patch +media-mdk-mdp-fix-pm_runtime_get_sync-usage-count.patch +media-s5p-fix-pm_runtime_get_sync-usage-count.patch +media-am437x-fix-pm_runtime_get_sync-usage-count.patch +media-sh_vou-fix-pm_runtime_get_sync-usage-count.patch +media-mtk-vcodec-fix-pm-runtime-get-logic.patch +media-s5p-jpeg-fix-pm_runtime_get_sync-usage-count.patch +media-sunxi-fix-pm_runtime_get_sync-usage-count.patch +media-sti-bdisp-fix-pm_runtime_get_sync-usage-count.patch +media-exynos4-is-fix-pm_runtime_get_sync-usage-count.patch +media-exynos-gsc-fix-pm_runtime_get_sync-usage-count.patch +spi-spi-loopback-test-fix-tx_buf-might-be-rx_buf.patch +spi-spi-topcliff-pch-fix-potential-double-free-in-pc.patch +spi-omap-100k-fix-the-length-judgment-problem.patch +regulator-uniphier-add-missing-module_device_table.patch +sched-core-initialize-the-idle-task-with-preemption-.patch +hwrng-exynos-fix-runtime-pm-imbalance-on-error.patch +crypto-nx-add-missing-module_device_table.patch +media-sti-fix-obj-config-targets.patch +sched-make-the-idle-task-quack-like-a-per-cpu-kthrea.patch +media-cpia2-fix-memory-leak-in-cpia2_usb_probe.patch +media-cobalt-fix-race-condition-in-setting-hpd.patch +media-hevc-fix-dependent-slice-segment-flags.patch +media-pvrusb2-fix-warning-in-pvr2_i2c_core_done.patch +media-imx-imx7_mipi_csis-fix-logging-of-only-error-e.patch +crypto-qat-check-return-code-of-qat_hal_rd_rel_reg.patch +crypto-qat-remove-unused-macro-in-fw-loader.patch +crypto-qce-skcipher-fix-incorrect-sg-count-for-dma-t.patch +arm64-perf-convert-snprintf-to-sysfs_emit.patch +sched-fair-fix-ascii-art-by-relpacing-tabs.patch +ima-don-t-remove-security.ima-if-file-must-not-be-ap.patch +media-i2c-ov2659-use-clk_-prepare_enable-disable_unp.patch +media-bt878-do-not-schedule-tasklet-when-it-is-not-s.patch +media-em28xx-fix-possible-memory-leak-of-em28xx-stru.patch +media-hantro-fix-.buf_prepare.patch +media-cedrus-fix-.buf_prepare.patch +media-v4l2-core-avoid-the-dangling-pointer-in-v4l2_f.patch +media-bt8xx-fix-a-missing-check-bug-in-bt878_probe.patch +media-st-hva-fix-potential-null-pointer-dereferences.patch +crypto-hisilicon-sec-fixup-3des-minimum-key-size-dec.patch +makefile-fix-gdb-warning-with-config_relr.patch +media-dvd_usb-memory-leak-in-cinergyt2_fe_attach.patch +memstick-rtsx_usb_ms-fix-uaf.patch +mmc-sdhci-sprd-use-sdhci_sprd_writew.patch +mmc-via-sdmmc-add-a-check-against-null-pointer-deref.patch +mmc-sdhci-of-aspeed-turn-down-a-phase-correction-war.patch +spi-meson-spicc-fix-a-wrong-goto-jump-for-avoiding-m.patch +spi-meson-spicc-fix-memory-leak-in-meson_spicc_probe.patch +regulator-mt6315-fix-checking-return-value-of-devm_r.patch +crypto-shash-avoid-comparing-pointers-to-exported-fu.patch +media-dvb_net-avoid-speculation-from-net-slot.patch +media-dvbdev-fix-error-logic-at-dvb_register_device.patch +media-siano-fix-device-register-error-path.patch +media-imx-csi-skip-first-few-frames-from-a-bt.656-so.patch +hwmon-max31790-report-correct-current-pwm-duty-cycle.patch +hwmon-max31790-fix-pwmx_enable-attributes.patch +sched-fair-take-thermal-pressure-into-account-while-.patch +drivers-perf-fix-the-missed-ida_simple_remove-in-ddr.patch +kvm-arm64-restore-pmu-configuration-on-first-run.patch +kvm-ppc-book3s-hv-fix-tlb-management-on-smt8-power9-.patch +btrfs-fix-error-handling-in-__btrfs_update_delayed_i.patch +btrfs-abort-transaction-if-we-fail-to-update-the-del.patch +btrfs-always-abort-the-transaction-if-we-abort-a-tra.patch +btrfs-sysfs-fix-format-string-for-some-discard-stats.patch +btrfs-scrub-fix-subpage-repair-error-caused-by-hard-.patch +btrfs-fix-the-filemap_range_has_page-call-in-btrfs_p.patch +btrfs-don-t-clear-page-extent-mapped-if-we-re-not-in.patch +btrfs-disable-build-on-platforms-having-page-size-25.patch +locking-lockdep-fix-the-dep-path-printing-for-backwa.patch +lockding-lockdep-avoid-to-find-wrong-lock-dep-path-i.patch +kvm-s390-get-rid-of-register-asm-usage.patch +regulator-mt6358-fix-vdram2-.vsel_mask.patch +regulator-da9052-ensure-enough-delay-time-for-.set_v.patch +media-fix-media-controller-api-config-checks.patch +acpi-video-use-native-backlight-for-ga401-ga502-ga50.patch +hid-do-not-use-down_interruptible-when-unbinding-dev.patch +edac-ti-add-missing-module_device_table.patch +acpi-pm-s2idle-add-missing-lps0-functions-for-amd.patch +acpi-processor-idle-fix-up-c-state-latency-if-not-or.patch +hv_utils-fix-passing-zero-to-ptr_err-warning.patch +lib-vsprintf-fix-handling-of-number-field-widths-in-.patch +input-goodix-platform-x86-touchscreen_dmi-move-upsid.patch +platform-x86-touchscreen_dmi-add-an-extra-entry-for-.patch +platform-x86-touchscreen_dmi-add-info-for-the-goodix.patch +acpi-ec-make-more-asus-laptops-use-ecdt-_gpe.patch +block_dump-remove-block_dump-feature-in-mark_inode_d.patch +blk-mq-grab-rq-refcount-before-calling-fn-in-blk_mq_.patch +blk-mq-clear-stale-request-in-tags-rq-before-freeing.patch +fs-dlm-reconnect-if-socket-error-report-occurs.patch +fs-dlm-cancel-work-sync-othercon.patch +random32-fix-implicit-truncation-warning-in-prandom_.patch +open-don-t-silently-ignore-unknown-o-flags-in-openat.patch +drivers-hv-fix-missing-error-code-in-vmbus_connect.patch +fs-dlm-fix-lowcomms_start-error-case.patch +fs-dlm-fix-memory-leak-when-fenced.patch +acpica-fix-memory-leak-caused-by-_cid-repair-functio.patch +acpi-bus-call-kobject_put-in-acpi_init-error-path.patch +acpi-resources-add-checks-for-acpi-irq-override.patch +hid-hid-input-add-surface-go-battery-quirk.patch +hid-sony-fix-freeze-when-inserting-ghlive-ps3-wii-do.patch +block-fix-race-between-adding-removing-rq-qos-and-no.patch +platform-x86-asus-nb-wmi-revert-drop-duplicate-dmi-q.patch +platform-x86-asus-nb-wmi-revert-add-support-for-asus.patch +platform-x86-toshiba_acpi-fix-missing-error-code-in-.patch +nvme-pci-fix-var.-type-for-increasing-cq_head.patch +nvmet-fc-do-not-check-for-invalid-target-port-in-nvm.patch +edac-intel-do-not-load-edac-driver-when-running-as-a.patch +tools-power-x86-intel-speed-select-fix-uncore-memory.patch +pci-hv-add-check-for-hyperv_initialized-in-init_hv_p.patch +cifs-improve-fallocate-emulation.patch +cifs-fix-check-of-dfs-interlinks.patch +smb3-fix-uninitialized-value-for-port-in-witness-pro.patch +acpi-ec-trust-dsdt-gpe-for-certain-hp-laptop.patch +clocksource-retry-clock-read-if-long-delays-detected.patch +clocksource-check-per-cpu-clock-synchronization-when.patch +tpm_tis_spi-add-missing-spi-device-id-entries.patch +acpi-tables-add-custom-dsdt-file-as-makefile-prerequ.patch +smb3-fix-possible-access-to-uninitialized-pointer-to.patch +hid-wacom-correct-base-usage-for-capacitive-expressk.patch +cifs-fix-missing-spinlock-around-update-to-ses-statu.patch +bfq-remove-merged-request-already-in-bfq_requests_me.patch +mailbox-qcom-use-platform_devid_auto-to-register-pla.patch +block-fix-discard-request-merge.patch +kthread_worker-fix-return-value-when-kthread_mod_del.patch +ia64-mca_drv-fix-incorrect-array-size-calculation.patch +writeback-cgroup-increment-isw_nr_in_flight-before-g.patch +mm-define-default-max_ptrs_per_-in-include-pgtable.h.patch +spi-allow-to-have-all-native-css-in-use-along-with-g.patch +spi-avoid-undefined-behaviour-when-counting-unused-n.patch +media-venus-rework-error-fail-recover-logic.patch +media-s5p_cec-decrement-usage-count-if-disabled.patch +media-i2c-ccs-core-return-the-right-error-code-at-su.patch +media-hantro-do-a-pm-resume-earlier.patch +crypto-ixp4xx-dma_unmap-the-correct-address.patch +crypto-ixp4xx-update-iv-after-requests.patch +crypto-ux500-fix-error-return-code-in-hash_hw_final.patch +sata_highbank-fix-deferred-probing.patch +pata_rb532_cf-fix-deferred-probing.patch +media-i2c-change-rst-to-rset-to-fix-multiple-build-e.patch +sched-uclamp-fix-wrong-implementation-of-cpu.uclamp..patch +sched-uclamp-fix-locking-around-cpu_util_update_eff.patch +kbuild-fix-objtool-dependency-for-object_files_non_s.patch +pata_octeon_cf-avoid-warn_on-in-ata_host_activate.patch +evm-fix-writing-securityfs-evm-overflow.patch +x86-elf-use-_bitul-macro-in-uapi-headers.patch +crypto-sa2ul-fix-leaks-on-failure-paths-with-sa_dma_.patch +crypto-sa2ul-fix-pm_runtime-enable-in-sa_ul_probe.patch +crypto-ccp-fix-a-resource-leak-in-an-error-handling-.patch +media-rc-i2c-fix-an-error-message.patch +pata_ep93xx-fix-deferred-probing.patch +locking-lockdep-reduce-lockdep-dependency-list.patch +sched-don-t-defer-cpu-pick-to-migration_cpu_stop.patch +media-ipu3-cio2-fix-reference-counting-when-looping-.patch +media-rkvdec-fix-.buf_prepare.patch +media-exynos4-is-fix-a-use-after-free-in-isp_video_r.patch +media-au0828-fix-a-null-vs-is_err-check.patch +media-tc358743-fix-error-return-code-in-tc358743_pro.patch +media-vicodec-use-_bitul-macro-in-uapi-headers.patch +media-gspca-gl860-fix-zero-length-control-requests.patch +m68k-atari-fix-atari_kbd_core-kconfig-unmet-dependen.patch +media-siano-fix-out-of-bounds-warnings-in-smscore_lo.patch +regulator-fan53880-fix-vsel_mask-setting-for-fan5388.patch +crypto-nitrox-fix-unchecked-variable-in-nitrox_regis.patch +crypto-omap-sham-fix-pm-reference-leak-in-omap-sham-.patch +crypto-x86-curve25519-fix-cpu-feature-checking-logic.patch +crypto-sm2-fix-a-memory-leak-in-sm2.patch +mmc-usdhi6rol0-fix-error-return-code-in-usdhi6_probe.patch +arm64-mm-fix-ttbr0-values-stored-in-struct-thread_in.patch +media-v4l2-core-ignore-native-time32-ioctls-on-64-bi.patch +media-subdev-remove-vidioc_dqevent_time32-handling.patch +media-s5p-g2d-fix-a-memory-leak-on-ctx-fh.m2m_ctx.patch +media-i2c-rdacm21-fix-ov10640-powerup.patch +media-i2c-rdacm21-power-up-ov10640-before-ov490.patch +hwmon-lm70-revert-hwmon-lm70-add-support-for-acpi.patch +hwmon-max31722-remove-non-standard-acpi-device-ids.patch +hwmon-max31790-fix-fan-speed-reporting-for-fan7.12.patch +kvm-nvmx-sync-all-pgds-on-nested-transition-with-sha.patch +kvm-nvmx-ensure-64-bit-shift-when-checking-vmfunc-bi.patch +kvm-nvmx-don-t-clobber-nested-mmu-s-a-d-status-on-ep.patch +kvm-x86-mmu-fix-return-value-in-tdp_mmu_map_handle_t.patch +kvm-x86-mmu-drop-redundant-trace_kvm_mmu_set_spte-in.patch +kvm-x86-mmu-fix-pf_fixed-count-in-tdp_mmu_map_handle.patch +perf-arm-cmn-fix-invalid-pointer-when-access-dtc-obj.patch +kvm-arm64-don-t-zero-the-cycle-count-register-when-p.patch +regulator-hi655x-fix-pass-wrong-pointer-to-config.dr.patch +regulator-hi6421v600-fix-setting-idle-mode.patch +btrfs-clear-log-tree-recovering-status-if-starting-t.patch +x86-sev-make-sure-irqs-are-disabled-while-ghcb-is-ac.patch +x86-sev-split-up-runtime-vc-handler-for-correct-stat.patch +sched-rt-fix-rt-utilization-tracking-during-policy-c.patch +sched-rt-fix-deadline-utilization-tracking-during-po.patch +sched-uclamp-fix-uclamp_tg_restrict.patch +lockdep-fix-wait-type-for-empty-stack.patch +lockdep-selftests-fix-selftests-vs-prove_raw_lock_ne.patch +spi-spi-sun6i-fix-chipselect-clock-bug.patch +crypto-nx-fix-rcu-warning-in-nx842_of_upd_status.patch +psi-fix-race-between-psi_trigger_create-destroy.patch +kvm-selftests-fix-triple-fault-if-ept-0-in-dirty_log.patch +kvm-selftests-remove-errant-asm-barrier.h-include-to.patch +media-video-mux-skip-dangling-endpoints.patch +media-mtk-vpu-on-suspend-read-write-regs-only-if-vpu.patch +edac-aspeed-use-proper-format-string-for-printing-re.patch +pm-devfreq-add-missing-error-code-in-devfreq_add_dev.patch +acpi-pm-fan-put-fan-device-ids-into-separate-header-.patch +block-avoid-double-io-accounting-for-flush-request.patch +x86-hyperv-fix-logical-processor-creation.patch +nvme-pci-look-for-storaged3enable-on-companion-acpi-.patch +acpi-tables-fpdt-add-missing-acpi_put_table-in-acpi_.patch +acpi-sysfs-fix-a-buffer-overrun-problem-with-descrip.patch +mark-pstore-blk-as-broken.patch +md-revert-io-stats-accounting.patch +clocksource-drivers-timer-ti-dm-save-and-restore-tim.patch +extcon-extcon-max8997-fix-irq-freeing-at-error-path.patch +acpi-apei-fix-synchronous-external-aborts-in-user-mo.patch +edac-igen6-fix-core-dependency.patch +blk-wbt-introduce-a-new-disable-state-to-prevent-fal.patch +blk-wbt-make-sure-throttle-is-enabled-properly.patch +acpi-bgrt-fix-cfi-violation.patch +cpufreq-make-cpufreq_online-call-driver-offline-on-e.patch +pm-devfreq-passive-fix-get_target_freq-when-not-usin.patch +block-fix-trace-completion-for-chained-bio.patch +blk-mq-update-hctx-dispatch_busy-in-case-of-real-sch.patch +ocfs2-fix-snprintf-checking.patch +dax-fix-enomem-handling-in-grab_mapping_entry.patch +mm-debug_vm_pgtable-ensure-thp-availability-via-has_.patch +mm-mmap_lock-use-local-locks-instead-of-disabling-pr.patch +swap-fix-do_swap_page-race-with-swapoff.patch +mm-shmem-fix-shmem_swapin-race-with-swapoff.patch +mm-memcg-slab-properly-set-up-gfp-flags-for-objcg-po.patch +mm-page_alloc-fix-counting-of-managed_pages.patch +xfrm-xfrm_state_mtu-should-return-at-least-1280-for-.patch +drm-bridge-sii8620-fix-dependency-on-extcon.patch +drm-bridge-fix-the-stop-condition-of-drm_bridge_chai.patch +drm-amd-dc-fix-a-missing-check-bug-in-dm_dp_mst_dete.patch +drm-ast-fix-missing-conversions-to-managed-api.patch +video-fbdev-imxfb-fix-an-error-message.patch +drm-imx-ipuv3-plane-do-not-advertise-yuv-formats-on-.patch +drm-imx-ipuv3-plane-fix-prg-modifiers-after-drm-mana.patch +net-mvpp2-put-fwnode-in-error-case-during-probe.patch +net-pch_gbe-propagate-error-from-devm_gpio_request_o.patch +pinctrl-renesas-r8a7796-add-missing-bias-for-preset-.patch +pinctrl-renesas-r8a77990-jtag-pins-do-not-have-pull-.patch +rdma-hns-remove-the-condition-of-light-load-for-post.patch +drm-vmwgfx-mark-a-surface-gpu-dirty-after-the-svga3d.patch +drm-vmwgfx-fix-cpu-updates-of-coherent-multisample-s.patch +net-qrtr-ns-fix-error-return-code-in-qrtr_ns_init.patch +clk-meson-g12a-fix-gp0-and-hifi-ranges.patch +drm-amd-display-fix-potential-gpu-reset-deadlock.patch +drm-amd-display-avoid-hpd-irq-in-gpu-reset-state.patch +drm-amd-display-take-dc_lock-in-short-pulse-handler-.patch +net-ftgmac100-add-missing-error-return-code-in-ftgma.patch +drm-vc4-crtc-pass-the-drm_atomic_state-to-config_pv.patch +drm-vc4-crtc-fix-vc4_get_crtc_encoder-logic.patch +drm-vc4-crtc-lookup-the-encoder-from-the-register-at.patch +drm-rockchip-set-alpha_en-to-0-if-it-is-not-used.patch +drm-rockchip-cdn-dp-core-add-missing-clk_disable_unp.patch +drm-rockchip-dsi-move-all-lane-config-except-lcdc-mu.patch +drm-rockchip-lvds-fix-an-error-handling-path.patch +drm-rockchip-cdn-dp-fix-sign-extension-on-an-int-mul.patch +mptcp-fix-pr_debug-in-mptcp_token_new_connect.patch +mptcp-generate-subflow-hmac-after-mptcp_finish_join.patch +rdma-srp-fix-a-recently-introduced-memory-leak.patch +rdma-rtrs-clt-check-state-of-the-rtrs_clt_sess-befor.patch +rdma-rtrs-do-not-reset-hb_missed_max-after-re-connec.patch +rdma-rtrs-srv-fix-memory-leak-of-unfreed-rtrs_srv_st.patch +rdma-rtrs-srv-fix-memory-leak-when-having-multiple-s.patch +rdma-rtrs-clt-check-if-the-queue_depth-has-changed-d.patch +rdma-rtrs-clt-fix-memory-leak-of-not-freed-sess-stat.patch +ehea-fix-error-return-code-in-ehea_restart_qps.patch +clk-tegra30-use-300mhz-for-video-decoder-by-default.patch +xfrm-remove-the-fragment-check-for-ipv6-beet-mode.patch +net-sched-act_vlan-fix-modify-to-allow-0.patch +rdma-core-sanitize-wq-state-received-from-the-usersp.patch +drm-pl111-depend-on-config_vexpress_config.patch +rdma-rxe-fix-failure-during-driver-load.patch +drm-pl111-actually-fix-config_vexpress_config-depend.patch +drm-vc4-hdmi-fix-error-path-of-hpd-gpios.patch +clk-vc5-fix-output-disabling-when-enabling-a-fod.patch +drm-qxl-ensure-surf.data-is-ininitialized.patch +tools-bpftool-fix-error-return-code-in-do_batch.patch +ath10k-go-to-path-err_unsupported-when-chip-id-is-no.patch +ath10k-add-missing-error-return-code-in-ath10k_pci_p.patch +wireless-carl9170-fix-leds-build-errors-warnings.patch +ieee802154-hwsim-fix-possible-memory-leak-in-hwsim_s.patch +clk-imx8mq-remove-sys-pll-1-2-clock-gates.patch +wcn36xx-move-hal_buf-allocation-to-devm_kmalloc-in-p.patch +ssb-fix-error-return-code-in-ssb_bus_scan.patch +brcmfmac-fix-setting-of-station-info-chains-bitmask.patch +brcmfmac-correctly-report-average-rssi-in-station-in.patch +brcmfmac-fix-a-double-free-in-brcmf_sdio_bus_reset.patch +brcmfmac-delete-second-brcm-folder-hierarchy.patch +brcmsmac-mac80211_if-fix-a-resource-leak-in-an-error.patch +cw1200-revert-unnecessary-patches-that-fix-unreal-us.patch +ath11k-fix-an-error-handling-path-in-ath11k_core_fet.patch +ath10k-fix-an-error-code-in-ath10k_add_interface.patch +ath11k-send-beacon-template-after-vdev_start-restart.patch +wil6210-remove-erroneous-wiphy-locking.patch +netlabel-fix-memory-leak-in-netlbl_mgmt_add_common.patch +rdma-mlx5-don-t-add-slave-port-to-unaffiliated-list.patch +netfilter-nft_exthdr-check-for-ipv6-packet-before-fu.patch +netfilter-nft_osf-check-for-tcp-packet-before-furthe.patch +netfilter-nft_tproxy-restrict-support-to-tcp-and-udp.patch +rdma-rxe-fix-qp-reference-counting-for-atomic-ops.patch +selftests-bpf-whitelist-test_progs.h-from-.gitignore.patch +xsk-fix-missing-validation-for-skb-and-unaligned-mod.patch +xsk-fix-broken-tx-ring-validation.patch +bpf-fix-libelf-endian-handling-in-resolv_btfids.patch +rdma-rtrs-srv-set-minimal-max_send_wr-and-max_recv_w.patch +samples-bpf-fix-segmentation-fault-for-xdp_redirect-.patch +samples-bpf-fix-the-error-return-code-of-xdp_redirec.patch +net-pxa168_eth-fix-a-potential-data-race-in-pxa168_e.patch +mt76-fix-possible-null-pointer-dereference-in-mt76_t.patch +mt76-mt7615-fix-null-pointer-dereference-in-tx_prepa.patch +mt76-mt7921-don-t-alter-rx-path-classifier.patch +mt76-connac-fix-wow-with-disconnetion-and-bitmap-pat.patch +mt76-mt7921-consider-the-invalid-value-for-to_rssi.patch +mt76-connac-alaways-wake-the-device-before-scanning.patch +mt76-mt7921-remove-redundant-check-on-type.patch +mt76-mt7921-fix-omac-idx-usage.patch +mt76-mt7915-fix-rx-fcs-error-count-in-testmode.patch +net-ethernet-aeroflex-fix-uaf-in-greth_of_remove.patch +net-ethernet-ezchip-fix-uaf-in-nps_enet_remove.patch +net-ethernet-ezchip-fix-error-handling.patch +vrf-do-not-push-non-nd-strict-packets-with-a-source-.patch +net-sched-add-barrier-to-ensure-correct-ordering-for.patch +selftests-tls-clean-up-uninitialized-warnings.patch +selftests-tls-fix-chacha-bidir-tests.patch +tls-prevent-oversized-sendfile-hangs-by-ignoring-msg.patch +netfilter-nf_tables_offload-check-flow_dissector_key.patch +net-dsa-mv88e6xxx-fix-adding-vlan-0.patch +pkt_sched-sch_qfq-fix-qfq_change_class-error-path.patch +xfrm-fix-xfrm-offload-fallback-fail-case.patch +netfilter-nf_tables-skip-netlink-portid-validation-i.patch +netfilter-nf_tables-do-not-allow-to-delete-table-wit.patch +iwlwifi-increase-pnvm-load-timeout.patch +bpf-fix-regression-on-bpf_obj_get-with-non-o_rdwr-fl.patch +rtw88-8822c-fix-lc-calibration-timing.patch +vxlan-add-missing-rcu_read_lock-in-neigh_reduce.patch +bpf-fix-integer-overflow-in-argument-calculation-for.patch +ip6_tunnel-fix-gre6-segmentation.patch +net-ipv4-swap-flow-ports-when-validating-source.patch +net-broadcom-bcm4908_enet-reset-dma-rings-sw-indexes.patch +net-ti-am65-cpsw-nuss-fix-crash-when-changing-number.patch +tc-testing-fix-list-handling.patch +rdma-hns-force-rewrite-inline-flag-of-wqe.patch +rdma-hns-fix-uninitialized-variable.patch +ieee802154-hwsim-fix-memory-leak-in-hwsim_add_one.patch +ieee802154-hwsim-avoid-possible-crash-in-hwsim_del_e.patch +bpf-fix-null-ptr-deref-with-mixed-tail-calls-and-sub.patch +drm-msm-dp-handle-irq_hpd-with-sink_count-0-correctl.patch +drm-msm-fix-error-return-code-in-msm_drm_init.patch +drm-msm-dpu-fix-error-return-code-in-dpu_mdss_init.patch +mac80211-remove-iwlwifi-specific-workaround-ndps-of-.patch +net-bcmgenet-fix-attaching-to-pyh-failed-on-rpi-4b.patch +ipv6-exthdrs-do-not-blindly-use-init_net.patch +can-j1939-j1939_sk_setsockopt-prevent-allocation-of-.patch +bpf-do-not-change-gso_size-during-bpf_skb_change_pro.patch +i40e-fix-error-handling-in-i40e_vsi_open.patch +i40e-fix-autoneg-disabling-for-non-10gbaset-links.patch +i40e-fix-missing-rtnl-locking-when-setting-up-pf-swi.patch +revert-ibmvnic-simplify-reset_long_term_buff-functio.patch +revert-ibmvnic-remove-duplicate-napi_schedule-call-i.patch +ibmvnic-clean-pending-indirect-buffs-during-reset.patch +ibmvnic-account-for-bufs-already-saved-in-indir_buf.patch +ibmvnic-set-ltb-buff-to-null-after-freeing.patch +ibmvnic-free-tx_pool-if-tso_pool-alloc-fails.patch +rdma-cma-protect-rmw-with-qp_mutex.patch +net-macsec-fix-the-length-used-to-copy-the-key-for-o.patch +net-phy-mscc-fix-macsec-key-length.patch +net-atlantic-fix-the-macsec-key-length.patch +ipv6-fix-out-of-bound-access-in-ip6_parse_tlv.patch +e1000e-check-the-pcim-state.patch +net-dsa-sja1105-fix-null-pointer-dereference-in-sja1.patch +bpfilter-specify-the-log-level-for-the-kmsg-message.patch +rdma-cma-fix-incorrect-packet-lifetime-calculation.patch +gve-fix-swapped-vars-when-fetching-max-queues.patch +revert-be2net-disable-bh-with-spin_lock-in-be_proces.patch +bluetooth-mgmt-fix-slab-out-of-bounds-in-tlv_data_is.patch +bluetooth-fix-set-extended-scan-response-data.patch +bluetooth-fix-handling-of-hci_le_advertising_set_ter.patch +clk-qcom-gcc-add-support-for-a-new-frequency-for-sc7.patch +clk-actions-fix-uart-clock-dividers-on-owl-s500-soc.patch +clk-actions-fix-sd-clocks-factor-table-on-owl-s500-s.patch +clk-actions-fix-bisp_factor_table-based-clocks-on-ow.patch +clk-actions-fix-ahpprediv-h-ahb-clock-chain-on-owl-s.patch +clk-qcom-clk-alpha-pll-fix-cal_l-write-in-alpha_pll_.patch +clk-si5341-wait-for-device_ready-on-startup.patch +clk-si5341-avoid-divide-errors-due-to-bogus-register.patch +clk-si5341-check-for-input-clock-presence-and-pll-lo.patch +clk-si5341-update-initialization-magic.patch +bpf-x86-fix-extable-offset-calculation.patch +writeback-fix-obtain-a-reference-to-a-freeing-memcg-.patch +net-lwtunnel-handle-mtu-calculation-in-forwading.patch +net-sched-fix-warning-in-tcindex_alloc_perfect_hash.patch +net-tipc-fix-fb_mtu-eat-two-pages.patch +rdma-mlx5-don-t-access-null-cleared-mpi-pointer.patch +rdma-core-always-release-restrack-object.patch +mips-fix-pkmap-with-32-bit-mips-huge-page-support.patch +staging-fbtft-rectify-gpio-handling.patch +staging-fbtft-don-t-spam-logs-when-probe-is-deferred.patch +asoc-rt5682-disable-irq-on-shutdown.patch +rcu-invoke-rcu_spawn_core_kthreads-from-rcu_spawn_gp.patch +serial-fsl_lpuart-don-t-modify-arbitrary-data-on-lpu.patch +serial-fsl_lpuart-remove-rtscts-handling-from-get_mc.patch +serial-8250_omap-fix-a-timeout-loop-condition.patch +tty-nozomi-fix-a-resource-leak-in-an-error-handling-.patch +phy-ralink-phy-mt7621-pci-properly-print-pointer-add.patch +mwifiex-re-fix-for-unaligned-accesses.patch +iio-adis_buffer-do-not-return-ints-in-irq-handlers.patch +iio-adis16400-do-not-return-ints-in-irq-handlers.patch +iio-adis16475-do-not-return-ints-in-irq-handlers.patch +iio-accel-bma180-fix-buffer-alignment-in-iio_push_to.patch +iio-accel-bma220-fix-buffer-alignment-in-iio_push_to.patch +iio-accel-hid-fix-buffer-alignment-in-iio_push_to_bu.patch +iio-accel-kxcjk-1013-fix-buffer-alignment-in-iio_pus.patch +iio-accel-mxc4005-fix-overread-of-data-and-alignment.patch +iio-accel-stk8312-fix-buffer-alignment-in-iio_push_t.patch +iio-accel-stk8ba50-fix-buffer-alignment-in-iio_push_.patch +iio-adc-ti-ads1015-fix-buffer-alignment-in-iio_push_.patch +iio-adc-vf610-fix-buffer-alignment-in-iio_push_to_bu.patch +iio-gyro-bmg160-fix-buffer-alignment-in-iio_push_to_.patch +iio-humidity-am2315-fix-buffer-alignment-in-iio_push.patch +iio-prox-srf08-fix-buffer-alignment-in-iio_push_to_b.patch +iio-prox-pulsed-light-fix-buffer-alignment-in-iio_pu.patch +iio-prox-as3935-fix-buffer-alignment-in-iio_push_to_.patch +iio-magn-hmc5843-fix-buffer-alignment-in-iio_push_to.patch +iio-magn-bmc150-fix-buffer-alignment-in-iio_push_to_.patch +iio-light-isl29125-fix-buffer-alignment-in-iio_push_.patch +iio-light-tcs3414-fix-buffer-alignment-in-iio_push_t.patch +iio-light-tcs3472-fix-buffer-alignment-in-iio_push_t.patch +iio-chemical-atlas-fix-buffer-alignment-in-iio_push_.patch +iio-cros_ec_sensors-fix-alignment-of-buffer-in-iio_p.patch +iio-potentiostat-lmp91000-fix-alignment-of-buffer-in.patch +asoc-rk3328-fix-missing-clk_disable_unprepare-on-err.patch +asoc-hisilicon-fix-missing-clk_disable_unprepare-on-.patch +backlight-lm3630a_bl-put-fwnode-in-error-case-during.patch +usb-typec-tcpm-fix-up-pr_swap-when-vsafe0v-is-signal.patch +asoc-rsnd-tidyup-loop-on-rsnd_adg_clk_query.patch +input-hil_kbd-fix-error-return-code-in-hil_dev_conne.patch +perf-scripting-python-fix-tuple_set_u64.patch +mtd-partitions-redboot-seek-fis-index-block-in-the-r.patch +mtd-parsers-qcom-fix-leaking-of-partition-name.patch +mtd-rawnand-arasan-ensure-proper-configuration-for-t.patch +staging-mmal-vchiq-fix-incorrect-static-vchiq_instan.patch +char-pcmcia-error-out-if-num_bytes_read-is-greater-t.patch +firmware-stratix10-svc-fix-a-resource-leak-in-an-err.patch +tty-nozomi-fix-the-error-handling-path-of-nozomi_car.patch +leds-class-the-enotsupp-should-never-be-seen-by-user.patch +leds-lgm-fix-spelling-mistake-prepate-prepare.patch +leds-lgm-sso-fix-clock-handling.patch +leds-lm3532-select-regmap-i2c-api.patch +leds-lm36274-put-fwnode-in-error-case-during-probe.patch +leds-lm3692x-put-fwnode-in-any-case-during-probe.patch +leds-lm3697-don-t-spam-logs-when-probe-is-deferred.patch +leds-lp50xx-put-fwnode-in-error-case-during-probe.patch +scsi-flashpoint-rename-si_flags-field.patch +scsi-iscsi-stop-queueing-during-ep_disconnect.patch +scsi-iscsi-force-immediate-failure-during-shutdown.patch +scsi-iscsi-use-system_unbound_wq-for-destroy_work.patch +scsi-iscsi-rel-ref-after-iscsi_lookup_endpoint.patch +scsi-iscsi-fix-in-kernel-conn-failure-handling.patch +scsi-iscsi-flush-block-work-before-unblock.patch +mfd-mp2629-select-mfd_core-to-fix-build-error.patch +mfd-rn5t618-fix-irq-trigger-by-changing-it-to-level-.patch +fsi-core-fix-return-of-error-values-on-failures.patch +fsi-scom-reset-the-fsi2pib-engine-for-any-error.patch +fsi-occ-don-t-accept-response-from-un-initialized-oc.patch +fsi-sbefifo-clean-up-correct-fifo-when-receiving-res.patch +fsi-sbefifo-fix-reset-timeout.patch +visorbus-fix-error-return-code-in-visorchipset_init.patch +iommu-amd-fix-extended-features-logging.patch +s390-enable-have_ioremap_prot.patch +s390-appldata-depends-on-proc_sysctl.patch +selftests-splice-adjust-for-handler-fallback-removal.patch +iommu-dma-fix-iova-reserve-dma-ranges.patch +asoc-max98373-sdw-add-missing-memory-allocation-chec.patch +asoc-max98373-sdw-use-first_hw_init-flag-on-resume.patch +asoc-rt1308-sdw-use-first_hw_init-flag-on-resume.patch +asoc-rt5682-sdw-use-first_hw_init-flag-on-resume.patch +asoc-rt700-sdw-use-first_hw_init-flag-on-resume.patch +asoc-rt711-sdw-use-first_hw_init-flag-on-resume.patch +asoc-rt715-sdw-use-first_hw_init-flag-on-resume.patch +asoc-rt5682-fix-a-problem-with-error-handling-in-the.patch +asoc-rt5682-sdw-set-regcache_cache_only-false-before.patch +asoc-mediatek-mtk-btcvsd-fix-an-error-handling-path-.patch +usb-gadget-f_fs-fix-setting-of-device-and-driver-dat.patch +usb-dwc2-don-t-reset-the-core-after-setting-turnarou.patch +eeprom-idt_89hpesx-put-fwnode-in-matching-case-durin.patch +eeprom-idt_89hpesx-restore-printing-the-unsupported-.patch +thunderbolt-bond-lanes-only-when-dual_link_port-null.patch +mtd-spinand-fix-double-counting-of-ecc-stats.patch +kunit-fix-result-propagation-for-parameterised-tests.patch +iio-adc-at91-sama5d2-fix-buffer-alignment-in-iio_pus.patch +iio-adc-hx711-fix-buffer-alignment-in-iio_push_to_bu.patch +iio-adc-mxs-lradc-fix-buffer-alignment-in-iio_push_t.patch +iio-adc-ti-ads8688-fix-alignment-of-buffer-in-iio_pu.patch +iio-magn-rm3100-fix-alignment-of-buffer-in-iio_push_.patch +iio-light-vcnl4000-fix-buffer-alignment-in-iio_push_.patch +asoc-fsl_spdif-fix-error-handler-with-pm_runtime_ena.patch +staging-gdm724x-check-for-buffer-overflow-in-gdm_lte.patch +staging-gdm724x-check-for-overflow-in-gdm_lte_netif_.patch +staging-rtl8712-fix-error-handling-in-r871xu_drv_ini.patch +staging-rtl8712-fix-memory-leak-in-rtl871x_load_fw_c.patch +coresight-core-fix-use-of-uninitialized-pointer.patch +staging-mt7621-dts-fix-pci-address-for-pci-memory-ra.patch +usb-phy-tegra-wait-for-vbus-wakeup-status-deassertio.patch +usb-phy-tegra-correct-definition-of-b_sess_vld_wakeu.patch +serial-8250-actually-allow-upf_magic_multiplier-baud.patch +iio-light-vcnl4035-fix-buffer-alignment-in-iio_push_.patch +iio-prox-isl29501-fix-buffer-alignment-in-iio_push_t.patch +asoc-cs42l42-correct-definition-of-cs42l42_adc_pdn_m.patch +of-fix-truncation-of-memory-sizes-on-32-bit-platform.patch +mtd-rawnand-marvell-add-missing-clk_disable_unprepar.patch +habanalabs-fix-an-error-handling-path-in-hl_pci_prob.patch +scsi-mpt3sas-fix-error-return-value-in-_scsih_expand.patch +soundwire-stream-fix-test-for-dp-prepare-complete.patch +phy-uniphier-pcie-fix-updating-phy-parameters.patch +phy-ti-dm816x-fix-the-error-handling-path-in-dm816x_.patch +extcon-sm5502-drop-invalid-register-write-in-sm5502_.patch +extcon-max8997-add-missing-modalias-string.patch +powerpc-powernv-fix-machine-check-reporting-of-async.patch +asoc-atmel-i2s-set-symmetric-sample-bits.patch +asoc-atmel-i2s-fix-usage-of-capture-and-playback-at-.patch +asoc-fsl_xcvr-disable-all-interrupts-when-suspend-ha.patch +configfs-fix-memleak-in-configfs_release_bin_file.patch +asoc-intel-sof_sdw-add-sof_rt715_dai_id_fix-for-alde.patch +asoc-intel-sof_sdw-add-quirk-support-for-brya-and-bt.patch +asoc-intel-sof_sdw-use-mach-data-for-adl-rvp-dmic-co.patch +asoc-fsl_spdif-fix-unexpected-interrupt-after-suspen.patch +leds-as3645a-fix-error-return-code-in-as3645a_parse_.patch +leds-ktd2692-fix-an-error-handling-path.patch +selftests-ftrace-fix-event-no-pid-on-1-core-machine.patch +serial-8250-8250_omap-fix-possible-interrupt-storm-o.patch +powerpc-offline-cpu-in-stop_this_cpu.patch +powerpc-papr_scm-properly-handle-uuid-types-and-api.patch +powerpc-64s-fix-copy-paste-data-exposure-into-newly-.patch +powerpc-papr_scm-make-perf_stats-invisible-if-perf-s.patch +powerpc-fix-is_kvm_guest-kvm_para_available.patch +alsa-firewire-lib-fix-amdtp_domain_start-when-no-amd.patch +serial-mvebu-uart-do-not-allow-changing-baudrate-whe.patch +serial-mvebu-uart-correctly-calculate-minimal-possib.patch +arm64-dts-marvell-armada-37xx-fix-reg-for-standard-v.patch +powerpc-64s-interrupt-preserve-regs-softe-for-nmi-in.patch +vfio-pci-handle-concurrent-vma-faults.patch +mm-huge_memory.c-remove-dedicated-macro-hpage_cache_.patch +mm-huge_memory.c-add-missing-read-only-thp-checking-.patch +mm-huge_memory.c-don-t-discard-hugepage-if-other-pro.patch +hugetlb-remove-prep_compound_huge_page-cleanup.patch +hugetlb-address-ref-count-racing-in-prep_compound_gi.patch +mm-z3fold-fix-potential-memory-leak-in-z3fold_destro.patch +mm-z3fold-use-release_z3fold_page_locked-to-release-.patch +mm-migrate-fix-missing-update-page_private-to-hugetl.patch +mm-zswap.c-fix-two-bugs-in-zswap_writeback_entry.patch +lib-math-rational.c-fix-divide-by-zero.patch +selftests-vm-pkeys-fix-alloc_random_pkey-to-make-it-.patch +selftests-vm-pkeys-handle-negative-sys_pkey_alloc-re.patch +selftests-vm-pkeys-refill-shadow-register-after-impl.patch +perf-llvm-return-enomem-when-asprintf-fails.patch +csky-fix-syscache.c-fallthrough-warning.patch +csky-syscache-fixup-duplicate-cache-flush.patch diff --git a/queue-5.12/smb3-fix-possible-access-to-uninitialized-pointer-to.patch b/queue-5.12/smb3-fix-possible-access-to-uninitialized-pointer-to.patch new file mode 100644 index 00000000000..7de6f8b50c7 --- /dev/null +++ b/queue-5.12/smb3-fix-possible-access-to-uninitialized-pointer-to.patch @@ -0,0 +1,35 @@ +From 5d62d795984257182c6fa5d9b51ea11e74bb66b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 17:54:50 -0500 +Subject: smb3: fix possible access to uninitialized pointer to DACL + +From: Steve French + +[ Upstream commit a5628263a9f8d47d9a1548fe9d5d75ba4423a735 ] + +dacl_ptr can be null so we must check for it everywhere it is +used in build_sec_desc. + +Addresses-Coverity: 1475598 ("Explicit null dereference") +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/cifsacl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c +index d178cf85e926..b80b6ba232aa 100644 +--- a/fs/cifs/cifsacl.c ++++ b/fs/cifs/cifsacl.c +@@ -1310,7 +1310,7 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd, + ndacl_ptr = (struct cifs_acl *)((char *)pnntsd + ndacloffset); + ndacl_ptr->revision = + dacloffset ? dacl_ptr->revision : cpu_to_le16(ACL_REVISION); +- ndacl_ptr->num_aces = dacl_ptr->num_aces; ++ ndacl_ptr->num_aces = dacl_ptr ? dacl_ptr->num_aces : 0; + + if (uid_valid(uid)) { /* chown */ + uid_t id; +-- +2.30.2 + diff --git a/queue-5.12/smb3-fix-uninitialized-value-for-port-in-witness-pro.patch b/queue-5.12/smb3-fix-uninitialized-value-for-port-in-witness-pro.patch new file mode 100644 index 00000000000..68fbc197a93 --- /dev/null +++ b/queue-5.12/smb3-fix-uninitialized-value-for-port-in-witness-pro.patch @@ -0,0 +1,61 @@ +From 98058c28c8b1bf31b2d1cfcea8d45d35c2d1bbe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 12:22:20 -0500 +Subject: smb3: fix uninitialized value for port in witness protocol move + +From: Steve French + +[ Upstream commit ff93b71a3eff25fe9d4364ef13b6e01d935600c6 ] + +Although in practice this can not occur (since IPv4 and IPv6 are the +only two cases currently supported), it is cleaner to avoid uninitialized +variable warnings. + +Addresses smatch warning: + fs/cifs/cifs_swn.c:468 cifs_swn_store_swn_addr() error: uninitialized symbol 'port'. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +CC: Samuel Cabrero +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/cifs_swn.c | 10 +++------- + 1 file changed, 3 insertions(+), 7 deletions(-) + +diff --git a/fs/cifs/cifs_swn.c b/fs/cifs/cifs_swn.c +index d829b8bf833e..93b47818c6c2 100644 +--- a/fs/cifs/cifs_swn.c ++++ b/fs/cifs/cifs_swn.c +@@ -447,15 +447,13 @@ static int cifs_swn_store_swn_addr(const struct sockaddr_storage *new, + const struct sockaddr_storage *old, + struct sockaddr_storage *dst) + { +- __be16 port; ++ __be16 port = cpu_to_be16(CIFS_PORT); + + if (old->ss_family == AF_INET) { + struct sockaddr_in *ipv4 = (struct sockaddr_in *)old; + + port = ipv4->sin_port; +- } +- +- if (old->ss_family == AF_INET6) { ++ } else if (old->ss_family == AF_INET6) { + struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)old; + + port = ipv6->sin6_port; +@@ -465,9 +463,7 @@ static int cifs_swn_store_swn_addr(const struct sockaddr_storage *new, + struct sockaddr_in *ipv4 = (struct sockaddr_in *)new; + + ipv4->sin_port = port; +- } +- +- if (new->ss_family == AF_INET6) { ++ } else if (new->ss_family == AF_INET6) { + struct sockaddr_in6 *ipv6 = (struct sockaddr_in6 *)new; + + ipv6->sin6_port = port; +-- +2.30.2 + diff --git a/queue-5.12/soundwire-stream-fix-test-for-dp-prepare-complete.patch b/queue-5.12/soundwire-stream-fix-test-for-dp-prepare-complete.patch new file mode 100644 index 00000000000..5910de77b66 --- /dev/null +++ b/queue-5.12/soundwire-stream-fix-test-for-dp-prepare-complete.patch @@ -0,0 +1,70 @@ +From 258075caffb76576c7dd09b41ebde65f199443ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 15:47:45 +0100 +Subject: soundwire: stream: Fix test for DP prepare complete + +From: Richard Fitzgerald + +[ Upstream commit 3d3e88e336338834086278236d42039f3cde50e1 ] + +In sdw_prep_deprep_slave_ports(), after the wait_for_completion() +the DP prepare status register is read. If this indicates that the +port is now prepared, the code should continue with the port setup. +It is irrelevant whether the wait_for_completion() timed out if the +port is now ready. + +The previous implementation would always fail if the +wait_for_completion() timed out, even if the port was reporting +successful prepare. + +This patch also fixes a minor bug where the return from sdw_read() +was not checked for error - any error code with LSBits clear could +be misinterpreted as a successful port prepare. + +Fixes: 79df15b7d37c ("soundwire: Add helpers for ports operations") +Signed-off-by: Richard Fitzgerald +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210618144745.30629-1-rf@opensource.cirrus.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/soundwire/stream.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/soundwire/stream.c b/drivers/soundwire/stream.c +index a418c3c7001c..304ff2ee7d75 100644 +--- a/drivers/soundwire/stream.c ++++ b/drivers/soundwire/stream.c +@@ -422,7 +422,6 @@ static int sdw_prep_deprep_slave_ports(struct sdw_bus *bus, + struct completion *port_ready; + struct sdw_dpn_prop *dpn_prop; + struct sdw_prepare_ch prep_ch; +- unsigned int time_left; + bool intr = false; + int ret = 0, val; + u32 addr; +@@ -479,15 +478,15 @@ static int sdw_prep_deprep_slave_ports(struct sdw_bus *bus, + + /* Wait for completion on port ready */ + port_ready = &s_rt->slave->port_ready[prep_ch.num]; +- time_left = wait_for_completion_timeout(port_ready, +- msecs_to_jiffies(dpn_prop->ch_prep_timeout)); ++ wait_for_completion_timeout(port_ready, ++ msecs_to_jiffies(dpn_prop->ch_prep_timeout)); + + val = sdw_read(s_rt->slave, SDW_DPN_PREPARESTATUS(p_rt->num)); +- val &= p_rt->ch_mask; +- if (!time_left || val) { ++ if ((val < 0) || (val & p_rt->ch_mask)) { ++ ret = (val < 0) ? val : -ETIMEDOUT; + dev_err(&s_rt->slave->dev, +- "Chn prep failed for port:%d\n", prep_ch.num); +- return -ETIMEDOUT; ++ "Chn prep failed for port %d: %d\n", prep_ch.num, ret); ++ return ret; + } + } + +-- +2.30.2 + diff --git a/queue-5.12/spi-allow-to-have-all-native-css-in-use-along-with-g.patch b/queue-5.12/spi-allow-to-have-all-native-css-in-use-along-with-g.patch new file mode 100644 index 00000000000..714fb9760db --- /dev/null +++ b/queue-5.12/spi-allow-to-have-all-native-css-in-use-along-with-g.patch @@ -0,0 +1,53 @@ +From e47e671a602e72dd09c83f690d66ce512fa97da8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 19:44:24 +0300 +Subject: spi: Allow to have all native CSs in use along with GPIOs + +From: Andy Shevchenko + +[ Upstream commit dbaca8e56ea3f23fa215f48c2d46dd03ede06e02 ] + +The commit 7d93aecdb58d ("spi: Add generic support for unused native cs +with cs-gpios") excludes the valid case for the controllers that doesn't +need to switch native CS in order to perform the transfer, i.e. when + + 0 native + ... ... + - 1 native + GPIO + + 1 GPIO + ... ... + +where defines maximum of native CSs supported by the controller. + +To allow this, bail out from spi_get_gpio_descs() conditionally for +the controllers which explicitly marked with SPI_MASTER_GPIO_SS. + +Fixes: 7d93aecdb58d ("spi: Add generic support for unused native cs with cs-gpios") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210420164425.40287-1-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 789354ee6a11..af126053213f 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2631,8 +2631,9 @@ static int spi_get_gpio_descs(struct spi_controller *ctlr) + } + + ctlr->unused_native_cs = ffz(native_cs_mask); +- if (num_cs_gpios && ctlr->max_native_cs && +- ctlr->unused_native_cs >= ctlr->max_native_cs) { ++ ++ if ((ctlr->flags & SPI_MASTER_GPIO_SS) && num_cs_gpios && ++ ctlr->max_native_cs && ctlr->unused_native_cs >= ctlr->max_native_cs) { + dev_err(dev, "No unused native chip select available\n"); + return -EINVAL; + } +-- +2.30.2 + diff --git a/queue-5.12/spi-avoid-undefined-behaviour-when-counting-unused-n.patch b/queue-5.12/spi-avoid-undefined-behaviour-when-counting-unused-n.patch new file mode 100644 index 00000000000..79c5a60e3c8 --- /dev/null +++ b/queue-5.12/spi-avoid-undefined-behaviour-when-counting-unused-n.patch @@ -0,0 +1,38 @@ +From c56da34bb74fb00d3e6e02a0c85cd51b1f0e5866 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Apr 2021 19:44:25 +0300 +Subject: spi: Avoid undefined behaviour when counting unused native CSs + +From: Andy Shevchenko + +[ Upstream commit f60d7270c8a3d2beb1c23ae0da42497afa3584c2 ] + +ffz(), that has been used to count unused native CSs, +might cause undefined behaviour when called against ~0U. +To fix that, open code it with ffs(~value) - 1. + +Fixes: 7d93aecdb58d ("spi: Add generic support for unused native cs with cs-gpios") +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210420164425.40287-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index af126053213f..2350463bfb8f 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2630,7 +2630,7 @@ static int spi_get_gpio_descs(struct spi_controller *ctlr) + native_cs_mask |= BIT(i); + } + +- ctlr->unused_native_cs = ffz(native_cs_mask); ++ ctlr->unused_native_cs = ffs(~native_cs_mask) - 1; + + if ((ctlr->flags & SPI_MASTER_GPIO_SS) && num_cs_gpios && + ctlr->max_native_cs && ctlr->unused_native_cs >= ctlr->max_native_cs) { +-- +2.30.2 + diff --git a/queue-5.12/spi-make-of_register_spi_device-also-set-the-fwnode.patch b/queue-5.12/spi-make-of_register_spi_device-also-set-the-fwnode.patch new file mode 100644 index 00000000000..66adc53f83d --- /dev/null +++ b/queue-5.12/spi-make-of_register_spi_device-also-set-the-fwnode.patch @@ -0,0 +1,62 @@ +From 40c86be4c85a1b802ee3981832511365e134a8ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Apr 2021 11:14:02 +0100 +Subject: spi: Make of_register_spi_device also set the fwnode + +From: Charles Keepax + +[ Upstream commit 0e793ba77c18382f08e440260fe72bc6fce2a3cb ] + +Currently, the SPI core doesn't set the struct device fwnode pointer +when it creates a new SPI device. This means when the device is +registered the fwnode is NULL and the check in device_add which sets +the fwnode->dev pointer is skipped. This wasn't previously an issue, +however these two patches: + +commit 4731210c09f5 ("gpiolib: Bind gpio_device to a driver to enable +fw_devlink=on by default") +commit ced2af419528 ("gpiolib: Don't probe gpio_device if it's not the +primary device") + +Added some code to the GPIO core which relies on using that +fwnode->dev pointer to determine if a driver is bound to the fwnode +and if not bind a stub GPIO driver. This means the GPIO providers +behind SPI will get both the expected driver and this stub driver +causing the stub driver to fail if it attempts to request any pin +configuration. For example on my system: + +madera-pinctrl madera-pinctrl: pin gpio5 already requested by madera-pinctrl; cannot claim for gpiochip3 +madera-pinctrl madera-pinctrl: pin-4 (gpiochip3) status -22 +madera-pinctrl madera-pinctrl: could not request pin 4 (gpio5) from group aif1 on device madera-pinctrl +gpio_stub_drv gpiochip3: Error applying setting, reverse things back +gpio_stub_drv: probe of gpiochip3 failed with error -22 + +The firmware node on the device created by the GPIO framework is set +through the of_node pointer hence things generally actually work, +however that fwnode->dev is never set, as the check was skipped at +device_add time. This fix appears to match how the I2C subsystem +handles the same situation. + +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20210421101402.8468-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index e067c54e87dd..789354ee6a11 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2066,6 +2066,7 @@ of_register_spi_device(struct spi_controller *ctlr, struct device_node *nc) + /* Store a pointer to the node in the device structure */ + of_node_get(nc); + spi->dev.of_node = nc; ++ spi->dev.fwnode = of_fwnode_handle(nc); + + /* Register the new device */ + rc = spi_add_device(spi); +-- +2.30.2 + diff --git a/queue-5.12/spi-meson-spicc-fix-a-wrong-goto-jump-for-avoiding-m.patch b/queue-5.12/spi-meson-spicc-fix-a-wrong-goto-jump-for-avoiding-m.patch new file mode 100644 index 00000000000..2ea023e5a32 --- /dev/null +++ b/queue-5.12/spi-meson-spicc-fix-a-wrong-goto-jump-for-avoiding-m.patch @@ -0,0 +1,50 @@ +From f22b1e6f0491519e275973b3e3c1b0403ea47dda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 13:29:32 +0800 +Subject: spi: meson-spicc: fix a wrong goto jump for avoiding memory leak. + +From: zpershuai + +[ Upstream commit 95730d5eb73170a6d225a9998c478be273598634 ] + +In meson_spifc_probe function, when enable the device pclk clock is +error, it should use clk_disable_unprepare to release the core clock. + +Signed-off-by: zpershuai +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/1623562172-22056-1-git-send-email-zpershuai@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-meson-spicc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-meson-spicc.c b/drivers/spi/spi-meson-spicc.c +index ecba6b4a5d85..51aef2c6e966 100644 +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -725,7 +725,7 @@ static int meson_spicc_probe(struct platform_device *pdev) + ret = clk_prepare_enable(spicc->pclk); + if (ret) { + dev_err(&pdev->dev, "pclk clock enable failed\n"); +- goto out_master; ++ goto out_core_clk; + } + + device_reset_optional(&pdev->dev); +@@ -764,9 +764,11 @@ static int meson_spicc_probe(struct platform_device *pdev) + return 0; + + out_clk: +- clk_disable_unprepare(spicc->core); + clk_disable_unprepare(spicc->pclk); + ++out_core_clk: ++ clk_disable_unprepare(spicc->core); ++ + out_master: + spi_master_put(master); + +-- +2.30.2 + diff --git a/queue-5.12/spi-meson-spicc-fix-memory-leak-in-meson_spicc_probe.patch b/queue-5.12/spi-meson-spicc-fix-memory-leak-in-meson_spicc_probe.patch new file mode 100644 index 00000000000..d57bf27716e --- /dev/null +++ b/queue-5.12/spi-meson-spicc-fix-memory-leak-in-meson_spicc_probe.patch @@ -0,0 +1,37 @@ +From 0f92a074c429108379c4b20bbda1c40c3069d3a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 13:29:16 +0800 +Subject: spi: meson-spicc: fix memory leak in meson_spicc_probe + +From: zpershuai + +[ Upstream commit b2d501c13470409ee7613855b17e5e5ec4111e1c ] + +when meson_spicc_clk_init returns failed, it should goto the +out_clk label. + +Signed-off-by: zpershuai +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/1623562156-21995-1-git-send-email-zpershuai@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-meson-spicc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-meson-spicc.c b/drivers/spi/spi-meson-spicc.c +index 51aef2c6e966..b2c4621db34d 100644 +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -752,7 +752,7 @@ static int meson_spicc_probe(struct platform_device *pdev) + ret = meson_spicc_clk_init(spicc); + if (ret) { + dev_err(&pdev->dev, "clock registration failed\n"); +- goto out_master; ++ goto out_clk; + } + + ret = devm_spi_register_master(&pdev->dev, master); +-- +2.30.2 + diff --git a/queue-5.12/spi-omap-100k-fix-the-length-judgment-problem.patch b/queue-5.12/spi-omap-100k-fix-the-length-judgment-problem.patch new file mode 100644 index 00000000000..46c6d00468b --- /dev/null +++ b/queue-5.12/spi-omap-100k-fix-the-length-judgment-problem.patch @@ -0,0 +1,36 @@ +From 7817d239735ca92f910f8a8ca78edafd255ae5ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 19:20:48 +0800 +Subject: spi: omap-100k: Fix the length judgment problem + +From: Tian Tao + +[ Upstream commit e7a1a3abea373e41ba7dfe0fbc93cb79b6a3a529 ] + +word_len should be checked in the omap1_spi100k_setup_transfer +function to see if it exceeds 32. + +Signed-off-by: Tian Tao +Link: https://lore.kernel.org/r/1619695248-39045-1-git-send-email-tiantao6@hisilicon.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-omap-100k.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-omap-100k.c b/drivers/spi/spi-omap-100k.c +index ccd817ee4917..0d0cd061d356 100644 +--- a/drivers/spi/spi-omap-100k.c ++++ b/drivers/spi/spi-omap-100k.c +@@ -241,7 +241,7 @@ static int omap1_spi100k_setup_transfer(struct spi_device *spi, + else + word_len = spi->bits_per_word; + +- if (spi->bits_per_word > 32) ++ if (word_len > 32) + return -EINVAL; + cs->word_len = word_len; + +-- +2.30.2 + diff --git a/queue-5.12/spi-spi-loopback-test-fix-tx_buf-might-be-rx_buf.patch b/queue-5.12/spi-spi-loopback-test-fix-tx_buf-might-be-rx_buf.patch new file mode 100644 index 00000000000..b24bf52837f --- /dev/null +++ b/queue-5.12/spi-spi-loopback-test-fix-tx_buf-might-be-rx_buf.patch @@ -0,0 +1,35 @@ +From 03cab8c8d71674d9d2ffa7eefaf2da3775d38ebe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 14:58:23 +0800 +Subject: spi: spi-loopback-test: Fix 'tx_buf' might be 'rx_buf' + +From: Jay Fang + +[ Upstream commit 9e37a3ab0627011fb63875e9a93094b6fc8ddf48 ] + +In function 'spi_test_run_iter': Value 'tx_buf' might be 'rx_buf'. + +Signed-off-by: Jay Fang +Link: https://lore.kernel.org/r/1620629903-15493-5-git-send-email-f.fangjian@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-loopback-test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c +index df981e55c24c..89b91cdfb2a5 100644 +--- a/drivers/spi/spi-loopback-test.c ++++ b/drivers/spi/spi-loopback-test.c +@@ -874,7 +874,7 @@ static int spi_test_run_iter(struct spi_device *spi, + test.transfers[i].len = len; + if (test.transfers[i].tx_buf) + test.transfers[i].tx_buf += tx_off; +- if (test.transfers[i].tx_buf) ++ if (test.transfers[i].rx_buf) + test.transfers[i].rx_buf += rx_off; + } + +-- +2.30.2 + diff --git a/queue-5.12/spi-spi-sun6i-fix-chipselect-clock-bug.patch b/queue-5.12/spi-spi-sun6i-fix-chipselect-clock-bug.patch new file mode 100644 index 00000000000..1913a721323 --- /dev/null +++ b/queue-5.12/spi-spi-sun6i-fix-chipselect-clock-bug.patch @@ -0,0 +1,56 @@ +From 6eab57b6921de73cc1f642f5b3cccbb36cfc0ba0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 16:45:07 +0200 +Subject: spi: spi-sun6i: Fix chipselect/clock bug + +From: Mirko Vogt + +[ Upstream commit 0d7993b234c9fad8cb6bec6adfaa74694ba85ecb ] + +The current sun6i SPI implementation initializes the transfer too early, +resulting in SCK going high before the transfer. When using an additional +(gpio) chipselect with sun6i, the chipselect is asserted at a time when +clock is high, making the SPI transfer fail. + +This is due to SUN6I_GBL_CTL_BUS_ENABLE being written into +SUN6I_GBL_CTL_REG at an early stage. Moving that to the transfer +function, hence, right before the transfer starts, mitigates that +problem. + +Fixes: 3558fe900e8af (spi: sunxi: Add Allwinner A31 SPI controller driver) +Signed-off-by: Mirko Vogt +Signed-off-by: Ralf Schlatterbeck +Link: https://lore.kernel.org/r/20210614144507.y3udezjfbko7eavv@runtux.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sun6i.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c +index cc8401980125..23ad052528db 100644 +--- a/drivers/spi/spi-sun6i.c ++++ b/drivers/spi/spi-sun6i.c +@@ -379,6 +379,10 @@ static int sun6i_spi_transfer_one(struct spi_master *master, + } + + sun6i_spi_write(sspi, SUN6I_CLK_CTL_REG, reg); ++ /* Finally enable the bus - doing so before might raise SCK to HIGH */ ++ reg = sun6i_spi_read(sspi, SUN6I_GBL_CTL_REG); ++ reg |= SUN6I_GBL_CTL_BUS_ENABLE; ++ sun6i_spi_write(sspi, SUN6I_GBL_CTL_REG, reg); + + /* Setup the transfer now... */ + if (sspi->tx_buf) +@@ -504,7 +508,7 @@ static int sun6i_spi_runtime_resume(struct device *dev) + } + + sun6i_spi_write(sspi, SUN6I_GBL_CTL_REG, +- SUN6I_GBL_CTL_BUS_ENABLE | SUN6I_GBL_CTL_MASTER | SUN6I_GBL_CTL_TP); ++ SUN6I_GBL_CTL_MASTER | SUN6I_GBL_CTL_TP); + + return 0; + +-- +2.30.2 + diff --git a/queue-5.12/spi-spi-topcliff-pch-fix-potential-double-free-in-pc.patch b/queue-5.12/spi-spi-topcliff-pch-fix-potential-double-free-in-pc.patch new file mode 100644 index 00000000000..bb26226c99c --- /dev/null +++ b/queue-5.12/spi-spi-topcliff-pch-fix-potential-double-free-in-pc.patch @@ -0,0 +1,42 @@ +From 5b3b4db452325676be5a1124901d21e6fa60992e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 May 2021 15:08:08 +0800 +Subject: spi: spi-topcliff-pch: Fix potential double free in + pch_spi_process_messages() + +From: Jay Fang + +[ Upstream commit 026a1dc1af52742c5897e64a3431445371a71871 ] + +pch_spi_set_tx() frees data->pkt_tx_buff on failure of kzalloc() for +data->pkt_rx_buff, but its caller, pch_spi_process_messages(), will +free data->pkt_tx_buff again. Set data->pkt_tx_buff to NULL after +kfree() to avoid double free. + +Signed-off-by: Jay Fang +Link: https://lore.kernel.org/r/1620284888-65215-1-git-send-email-f.fangjian@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-topcliff-pch.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c +index b459e369079f..7fb020a1d66a 100644 +--- a/drivers/spi/spi-topcliff-pch.c ++++ b/drivers/spi/spi-topcliff-pch.c +@@ -580,8 +580,10 @@ static void pch_spi_set_tx(struct pch_spi_data *data, int *bpw) + data->pkt_tx_buff = kzalloc(size, GFP_KERNEL); + if (data->pkt_tx_buff != NULL) { + data->pkt_rx_buff = kzalloc(size, GFP_KERNEL); +- if (!data->pkt_rx_buff) ++ if (!data->pkt_rx_buff) { + kfree(data->pkt_tx_buff); ++ data->pkt_tx_buff = NULL; ++ } + } + + if (!data->pkt_rx_buff) { +-- +2.30.2 + diff --git a/queue-5.12/ssb-fix-error-return-code-in-ssb_bus_scan.patch b/queue-5.12/ssb-fix-error-return-code-in-ssb_bus_scan.patch new file mode 100644 index 00000000000..d6dc26c5304 --- /dev/null +++ b/queue-5.12/ssb-fix-error-return-code-in-ssb_bus_scan.patch @@ -0,0 +1,41 @@ +From b02ee33ae190f4826286bd21d4ef6ef734d80c2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 15:29:49 +0800 +Subject: ssb: Fix error return code in ssb_bus_scan() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhen Lei + +[ Upstream commit 77a0989baa427dbd242c5784d05a53ca3d197d43 ] + +Fix to return -EINVAL from the error handling case instead of 0, as done +elsewhere in this function. + +Fixes: 61e115a56d1a ("[SSB]: add Sonics Silicon Backplane bus support") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Acked-by: Michael Büsch +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20210515072949.7151-1-thunder.leizhen@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/ssb/scan.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ssb/scan.c b/drivers/ssb/scan.c +index f49ab1aa2149..4161e5d1f276 100644 +--- a/drivers/ssb/scan.c ++++ b/drivers/ssb/scan.c +@@ -325,6 +325,7 @@ int ssb_bus_scan(struct ssb_bus *bus, + if (bus->nr_devices > ARRAY_SIZE(bus->devices)) { + pr_err("More than %d ssb cores found (%d)\n", + SSB_MAX_NR_CORES, bus->nr_devices); ++ err = -EINVAL; + goto err_unmap; + } + if (bus->bustype == SSB_BUSTYPE_SSB) { +-- +2.30.2 + diff --git a/queue-5.12/staging-fbtft-don-t-spam-logs-when-probe-is-deferred.patch b/queue-5.12/staging-fbtft-don-t-spam-logs-when-probe-is-deferred.patch new file mode 100644 index 00000000000..c32de2f36e0 --- /dev/null +++ b/queue-5.12/staging-fbtft-don-t-spam-logs-when-probe-is-deferred.patch @@ -0,0 +1,55 @@ +From 6443428760b4cb8ff8ecd2ac81e3ff90127c2b63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 20:21:11 +0300 +Subject: staging: fbtft: Don't spam logs when probe is deferred + +From: Andy Shevchenko + +[ Upstream commit 37667f6e57712cef5652fa67f1cbd1299e204d94 ] + +When requesting GPIO line the probe can be deferred. +In such case don't spam logs with an error message. +This can be achieved by switching to dev_err_probe(). + +Fixes: c440eee1a7a1 ("Staging: fbtft: Switch to the gpio descriptor interface") +Cc: Nishad Kamdar +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210503172114.27891-3-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fbtft/fbtft-core.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/staging/fbtft/fbtft-core.c b/drivers/staging/fbtft/fbtft-core.c +index 67c3b1975a4d..3723269890d5 100644 +--- a/drivers/staging/fbtft/fbtft-core.c ++++ b/drivers/staging/fbtft/fbtft-core.c +@@ -75,20 +75,16 @@ static int fbtft_request_one_gpio(struct fbtft_par *par, + struct gpio_desc **gpiop) + { + struct device *dev = par->info->device; +- int ret = 0; + + *gpiop = devm_gpiod_get_index_optional(dev, name, index, + GPIOD_OUT_LOW); +- if (IS_ERR(*gpiop)) { +- ret = PTR_ERR(*gpiop); +- dev_err(dev, +- "Failed to request %s GPIO: %d\n", name, ret); +- return ret; +- } ++ if (IS_ERR(*gpiop)) ++ return dev_err_probe(dev, PTR_ERR(*gpiop), "Failed to request %s GPIO\n", name); ++ + fbtft_par_dbg(DEBUG_REQUEST_GPIOS, par, "%s: '%s' GPIO\n", + __func__, name); + +- return ret; ++ return 0; + } + + static int fbtft_request_gpios(struct fbtft_par *par) +-- +2.30.2 + diff --git a/queue-5.12/staging-fbtft-rectify-gpio-handling.patch b/queue-5.12/staging-fbtft-rectify-gpio-handling.patch new file mode 100644 index 00000000000..41f3d85999b --- /dev/null +++ b/queue-5.12/staging-fbtft-rectify-gpio-handling.patch @@ -0,0 +1,485 @@ +From aaee4dc4ffa720632ad22d8a9de82d16fae446a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 May 2021 20:21:10 +0300 +Subject: staging: fbtft: Rectify GPIO handling +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit ec03c2104365ead0a33627c05e685093eed3eaef ] + +The infamous commit c440eee1a7a1 ("Staging: staging: fbtft: Switch to +the GPIO descriptor interface") broke GPIO handling completely. +It has already four commits to rectify and it seems not enough. +In order to fix the mess here we: + + 1) Set default to "inactive" for all requested pins + + 2) Fix CS#, RD#, and WR# pins polarity since it's active low + and GPIO descriptor interface takes it into consideration + from the Device Tree or ACPI + + 3) Consolidate chip activation (CS# assertion) under default + ->reset() callback + +To summarize the expectations about polarity for GPIOs: + + RD# Low + WR# Low + CS# Low + RESET# Low + DC or RS High + RW High + Data 0 .. 15 High + +See also Adafruit learning course [1] for the example of the schematics. + +While at it, drop unneeded NULL checks, since GPIO API is tolerant to that. + +[1]: https://learn.adafruit.com/adafruit-2-8-and-3-2-color-tft-touchscreen-breakout-v2/downloads + +Fixes: 92e3e884887c ("Staging: fbtft: Fix GPIO handling") +Fixes: b918d1c27066 ("Staging: fbtft: Fix reset assertion when using gpio descriptor") +Fixes: dbc4f989c878 ("Staging: fbtft: Fix probing of gpio descriptor") +Fixes: c440eee1a7a1 ("Staging: fbtft: Switch to the gpio descriptor interface") +Cc: Jan Sebastian Götte +Cc: Nishad Kamdar +Reviewed-by: Phil Reid +Signed-off-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210503172114.27891-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/fbtft/fb_agm1264k-fl.c | 20 ++++++++++---------- + drivers/staging/fbtft/fb_bd663474.c | 4 ---- + drivers/staging/fbtft/fb_ili9163.c | 4 ---- + drivers/staging/fbtft/fb_ili9320.c | 1 - + drivers/staging/fbtft/fb_ili9325.c | 4 ---- + drivers/staging/fbtft/fb_ili9340.c | 1 - + drivers/staging/fbtft/fb_s6d1121.c | 4 ---- + drivers/staging/fbtft/fb_sh1106.c | 1 - + drivers/staging/fbtft/fb_ssd1289.c | 4 ---- + drivers/staging/fbtft/fb_ssd1325.c | 2 -- + drivers/staging/fbtft/fb_ssd1331.c | 6 ++---- + drivers/staging/fbtft/fb_ssd1351.c | 1 - + drivers/staging/fbtft/fb_upd161704.c | 4 ---- + drivers/staging/fbtft/fb_watterott.c | 1 - + drivers/staging/fbtft/fbtft-bus.c | 3 +-- + drivers/staging/fbtft/fbtft-core.c | 13 ++++++------- + drivers/staging/fbtft/fbtft-io.c | 12 ++++++------ + 17 files changed, 25 insertions(+), 60 deletions(-) + +diff --git a/drivers/staging/fbtft/fb_agm1264k-fl.c b/drivers/staging/fbtft/fb_agm1264k-fl.c +index eeeeec97ad27..b545c2ca80a4 100644 +--- a/drivers/staging/fbtft/fb_agm1264k-fl.c ++++ b/drivers/staging/fbtft/fb_agm1264k-fl.c +@@ -84,9 +84,9 @@ static void reset(struct fbtft_par *par) + + dev_dbg(par->info->device, "%s()\n", __func__); + +- gpiod_set_value(par->gpio.reset, 0); +- udelay(20); + gpiod_set_value(par->gpio.reset, 1); ++ udelay(20); ++ gpiod_set_value(par->gpio.reset, 0); + mdelay(120); + } + +@@ -194,12 +194,12 @@ static void write_reg8_bus8(struct fbtft_par *par, int len, ...) + /* select chip */ + if (*buf) { + /* cs1 */ +- gpiod_set_value(par->CS0, 1); +- gpiod_set_value(par->CS1, 0); +- } else { +- /* cs0 */ + gpiod_set_value(par->CS0, 0); + gpiod_set_value(par->CS1, 1); ++ } else { ++ /* cs0 */ ++ gpiod_set_value(par->CS0, 1); ++ gpiod_set_value(par->CS1, 0); + } + + gpiod_set_value(par->RS, 0); /* RS->0 (command mode) */ +@@ -397,8 +397,8 @@ static int write_vmem(struct fbtft_par *par, size_t offset, size_t len) + } + kfree(convert_buf); + +- gpiod_set_value(par->CS0, 1); +- gpiod_set_value(par->CS1, 1); ++ gpiod_set_value(par->CS0, 0); ++ gpiod_set_value(par->CS1, 0); + + return ret; + } +@@ -419,10 +419,10 @@ static int write(struct fbtft_par *par, void *buf, size_t len) + for (i = 0; i < 8; ++i) + gpiod_set_value(par->gpio.db[i], data & (1 << i)); + /* set E */ +- gpiod_set_value(par->EPIN, 1); ++ gpiod_set_value(par->EPIN, 0); + udelay(5); + /* unset E - write */ +- gpiod_set_value(par->EPIN, 0); ++ gpiod_set_value(par->EPIN, 1); + udelay(1); + } + +diff --git a/drivers/staging/fbtft/fb_bd663474.c b/drivers/staging/fbtft/fb_bd663474.c +index e2c7646588f8..1629c2c440a9 100644 +--- a/drivers/staging/fbtft/fb_bd663474.c ++++ b/drivers/staging/fbtft/fb_bd663474.c +@@ -12,7 +12,6 @@ + #include + #include + #include +-#include + #include + + #include "fbtft.h" +@@ -24,9 +23,6 @@ + + static int init_display(struct fbtft_par *par) + { +- if (par->gpio.cs) +- gpiod_set_value(par->gpio.cs, 0); /* Activate chip */ +- + par->fbtftops.reset(par); + + /* Initialization sequence from Lib_UTFT */ +diff --git a/drivers/staging/fbtft/fb_ili9163.c b/drivers/staging/fbtft/fb_ili9163.c +index 05648c3ffe47..6582a2c90aaf 100644 +--- a/drivers/staging/fbtft/fb_ili9163.c ++++ b/drivers/staging/fbtft/fb_ili9163.c +@@ -11,7 +11,6 @@ + #include + #include + #include +-#include + #include + #include