From: Greg Kroah-Hartman Date: Tue, 15 Sep 2020 07:57:38 +0000 (+0200) Subject: 5.8-stable patches X-Git-Tag: v4.19.146~25 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4d80d8e450313c9a69b22fc15822541de405b8b1;p=thirdparty%2Fkernel%2Fstable-queue.git 5.8-stable patches added patches: drm-msm-disable-preemption-on-all-5xx-targets.patch drm-msm-disable-the-rptr-shadow.patch drm-msm-split-the-a5xx-preemption-record.patch drm-tve200-stabilize-enable-disable.patch mmc-sdhci-of-esdhc-don-t-walk-device-tree-on-every-interrupt.patch mmc-sdio-use-mmc_pre_req-mmc_post_req.patch nvme-revert-fix-controller-creation-races-with-teardown-flow.patch rbd-require-global-cap_sys_admin-for-mapping-and-unmapping.patch --- diff --git a/queue-5.8/drm-msm-disable-preemption-on-all-5xx-targets.patch b/queue-5.8/drm-msm-disable-preemption-on-all-5xx-targets.patch new file mode 100644 index 00000000000..962e80bd3b2 --- /dev/null +++ b/queue-5.8/drm-msm-disable-preemption-on-all-5xx-targets.patch @@ -0,0 +1,33 @@ +From 7b3f3948c8b7053d771acc9f79810cc410f5e2e0 Mon Sep 17 00:00:00 2001 +From: Jordan Crouse +Date: Thu, 3 Sep 2020 20:03:12 -0600 +Subject: drm/msm: Disable preemption on all 5xx targets + +From: Jordan Crouse + +commit 7b3f3948c8b7053d771acc9f79810cc410f5e2e0 upstream. + +Temporarily disable preemption on a5xx targets pending some improvements +to protect the RPTR shadow from being corrupted. + +Cc: stable@vger.kernel.org +Signed-off-by: Jordan Crouse +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +@@ -1510,7 +1510,8 @@ struct msm_gpu *a5xx_gpu_init(struct drm + + check_speed_bin(&pdev->dev); + +- ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 4); ++ /* Restricting nr_rings to 1 to temporarily disable preemption */ ++ ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1); + if (ret) { + a5xx_destroy(&(a5xx_gpu->base.base)); + return ERR_PTR(ret); diff --git a/queue-5.8/drm-msm-disable-the-rptr-shadow.patch b/queue-5.8/drm-msm-disable-the-rptr-shadow.patch new file mode 100644 index 00000000000..c34fe3a0550 --- /dev/null +++ b/queue-5.8/drm-msm-disable-the-rptr-shadow.patch @@ -0,0 +1,164 @@ +From f6828e0c4045f03f9cf2df6c2a768102641183f4 Mon Sep 17 00:00:00 2001 +From: Jordan Crouse +Date: Thu, 3 Sep 2020 20:03:13 -0600 +Subject: drm/msm: Disable the RPTR shadow + +From: Jordan Crouse + +commit f6828e0c4045f03f9cf2df6c2a768102641183f4 upstream. + +Disable the RPTR shadow across all targets. It will be selectively +re-enabled later for targets that need it. + +Cc: stable@vger.kernel.org +Signed-off-by: Jordan Crouse +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 5 +++++ + drivers/gpu/drm/msm/adreno/a3xx_gpu.c | 10 ++++++++++ + drivers/gpu/drm/msm/adreno/a4xx_gpu.c | 10 ++++++++++ + drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 11 +++++++++-- + drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 7 +++++++ + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 27 ++------------------------- + 6 files changed, 43 insertions(+), 27 deletions(-) + +--- a/drivers/gpu/drm/msm/adreno/a2xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a2xx_gpu.c +@@ -164,6 +164,11 @@ static int a2xx_hw_init(struct msm_gpu * + if (ret) + return ret; + ++ gpu_write(gpu, REG_AXXX_CP_RB_CNTL, ++ MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE); ++ ++ gpu_write(gpu, REG_AXXX_CP_RB_BASE, lower_32_bits(gpu->rb[0]->iova)); ++ + /* NOTE: PM4/micro-engine firmware registers look to be the same + * for a2xx and a3xx.. we could possibly push that part down to + * adreno_gpu base class. Or push both PM4 and PFP but +--- a/drivers/gpu/drm/msm/adreno/a3xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a3xx_gpu.c +@@ -211,6 +211,16 @@ static int a3xx_hw_init(struct msm_gpu * + if (ret) + return ret; + ++ /* ++ * Use the default ringbuffer size and block size but disable the RPTR ++ * shadow ++ */ ++ gpu_write(gpu, REG_AXXX_CP_RB_CNTL, ++ MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE); ++ ++ /* Set the ringbuffer address */ ++ gpu_write(gpu, REG_AXXX_CP_RB_BASE, lower_32_bits(gpu->rb[0]->iova)); ++ + /* setup access protection: */ + gpu_write(gpu, REG_A3XX_CP_PROTECT_CTRL, 0x00000007); + +--- a/drivers/gpu/drm/msm/adreno/a4xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a4xx_gpu.c +@@ -267,6 +267,16 @@ static int a4xx_hw_init(struct msm_gpu * + if (ret) + return ret; + ++ /* ++ * Use the default ringbuffer size and block size but disable the RPTR ++ * shadow ++ */ ++ gpu_write(gpu, REG_A4XX_CP_RB_CNTL, ++ MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE); ++ ++ /* Set the ringbuffer address */ ++ gpu_write(gpu, REG_A4XX_CP_RB_BASE, lower_32_bits(gpu->rb[0]->iova)); ++ + /* Load PM4: */ + ptr = (uint32_t *)(adreno_gpu->fw[ADRENO_FW_PM4]->data); + len = adreno_gpu->fw[ADRENO_FW_PM4]->size / 4; +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.c +@@ -702,8 +702,6 @@ static int a5xx_hw_init(struct msm_gpu * + if (ret) + return ret; + +- a5xx_preempt_hw_init(gpu); +- + if (!adreno_is_a510(adreno_gpu)) + a5xx_gpmu_ucode_init(gpu); + +@@ -711,6 +709,15 @@ static int a5xx_hw_init(struct msm_gpu * + if (ret) + return ret; + ++ /* Set the ringbuffer address */ ++ gpu_write64(gpu, REG_A5XX_CP_RB_BASE, REG_A5XX_CP_RB_BASE_HI, ++ gpu->rb[0]->iova); ++ ++ gpu_write(gpu, REG_A5XX_CP_RB_CNTL, ++ MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE); ++ ++ a5xx_preempt_hw_init(gpu); ++ + /* Disable the interrupts through the initial bringup stage */ + gpu_write(gpu, REG_A5XX_RBBM_INT_0_MASK, A5XX_INT_MASK); + +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +@@ -557,6 +557,13 @@ static int a6xx_hw_init(struct msm_gpu * + if (ret) + goto out; + ++ /* Set the ringbuffer address */ ++ gpu_write64(gpu, REG_A6XX_CP_RB_BASE, REG_A6XX_CP_RB_BASE_HI, ++ gpu->rb[0]->iova); ++ ++ gpu_write(gpu, REG_A6XX_CP_RB_CNTL, ++ MSM_GPU_RB_CNTL_DEFAULT | AXXX_CP_RB_CNTL_NO_UPDATE); ++ + /* Always come up on rb 0 */ + a6xx_gpu->cur_ring = gpu->rb[0]; + +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -400,26 +400,6 @@ int adreno_hw_init(struct msm_gpu *gpu) + ring->memptrs->rptr = 0; + } + +- /* +- * Setup REG_CP_RB_CNTL. The same value is used across targets (with +- * the excpetion of A430 that disables the RPTR shadow) - the cacluation +- * for the ringbuffer size and block size is moved to msm_gpu.h for the +- * pre-processor to deal with and the A430 variant is ORed in here +- */ +- adreno_gpu_write(adreno_gpu, REG_ADRENO_CP_RB_CNTL, +- MSM_GPU_RB_CNTL_DEFAULT | +- (adreno_is_a430(adreno_gpu) ? AXXX_CP_RB_CNTL_NO_UPDATE : 0)); +- +- /* Setup ringbuffer address - use ringbuffer[0] for GPU init */ +- adreno_gpu_write64(adreno_gpu, REG_ADRENO_CP_RB_BASE, +- REG_ADRENO_CP_RB_BASE_HI, gpu->rb[0]->iova); +- +- if (!adreno_is_a430(adreno_gpu)) { +- adreno_gpu_write64(adreno_gpu, REG_ADRENO_CP_RB_RPTR_ADDR, +- REG_ADRENO_CP_RB_RPTR_ADDR_HI, +- rbmemptr(gpu->rb[0], rptr)); +- } +- + return 0; + } + +@@ -427,11 +407,8 @@ int adreno_hw_init(struct msm_gpu *gpu) + static uint32_t get_rptr(struct adreno_gpu *adreno_gpu, + struct msm_ringbuffer *ring) + { +- if (adreno_is_a430(adreno_gpu)) +- return ring->memptrs->rptr = adreno_gpu_read( +- adreno_gpu, REG_ADRENO_CP_RB_RPTR); +- else +- return ring->memptrs->rptr; ++ return ring->memptrs->rptr = adreno_gpu_read( ++ adreno_gpu, REG_ADRENO_CP_RB_RPTR); + } + + struct msm_ringbuffer *adreno_active_ring(struct msm_gpu *gpu) diff --git a/queue-5.8/drm-msm-split-the-a5xx-preemption-record.patch b/queue-5.8/drm-msm-split-the-a5xx-preemption-record.patch new file mode 100644 index 00000000000..1ff794c7885 --- /dev/null +++ b/queue-5.8/drm-msm-split-the-a5xx-preemption-record.patch @@ -0,0 +1,93 @@ +From 34221545d2069dc947131f42392fd4cebabe1b39 Mon Sep 17 00:00:00 2001 +From: Jordan Crouse +Date: Thu, 3 Sep 2020 20:03:10 -0600 +Subject: drm/msm: Split the a5xx preemption record + +From: Jordan Crouse + +commit 34221545d2069dc947131f42392fd4cebabe1b39 upstream. + +The main a5xx preemption record can be marked as privileged to +protect it from user access but the counters storage needs to be +remain unprivileged. Split the buffers and mark the critical memory +as privileged. + +Cc: stable@vger.kernel.org +Signed-off-by: Jordan Crouse +Signed-off-by: Rob Clark +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/msm/adreno/a5xx_gpu.h | 1 + + drivers/gpu/drm/msm/adreno/a5xx_preempt.c | 25 ++++++++++++++++++++----- + 2 files changed, 21 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/msm/adreno/a5xx_gpu.h ++++ b/drivers/gpu/drm/msm/adreno/a5xx_gpu.h +@@ -31,6 +31,7 @@ struct a5xx_gpu { + struct msm_ringbuffer *next_ring; + + struct drm_gem_object *preempt_bo[MSM_GPU_MAX_RINGS]; ++ struct drm_gem_object *preempt_counters_bo[MSM_GPU_MAX_RINGS]; + struct a5xx_preempt_record *preempt[MSM_GPU_MAX_RINGS]; + uint64_t preempt_iova[MSM_GPU_MAX_RINGS]; + +--- a/drivers/gpu/drm/msm/adreno/a5xx_preempt.c ++++ b/drivers/gpu/drm/msm/adreno/a5xx_preempt.c +@@ -226,19 +226,31 @@ static int preempt_init_ring(struct a5xx + struct adreno_gpu *adreno_gpu = &a5xx_gpu->base; + struct msm_gpu *gpu = &adreno_gpu->base; + struct a5xx_preempt_record *ptr; +- struct drm_gem_object *bo = NULL; +- u64 iova = 0; ++ void *counters; ++ struct drm_gem_object *bo = NULL, *counters_bo = NULL; ++ u64 iova = 0, counters_iova = 0; + + ptr = msm_gem_kernel_new(gpu->dev, + A5XX_PREEMPT_RECORD_SIZE + A5XX_PREEMPT_COUNTER_SIZE, +- MSM_BO_UNCACHED, gpu->aspace, &bo, &iova); ++ MSM_BO_UNCACHED | MSM_BO_MAP_PRIV, gpu->aspace, &bo, &iova); + + if (IS_ERR(ptr)) + return PTR_ERR(ptr); + ++ /* The buffer to store counters needs to be unprivileged */ ++ counters = msm_gem_kernel_new(gpu->dev, ++ A5XX_PREEMPT_COUNTER_SIZE, ++ MSM_BO_UNCACHED, gpu->aspace, &counters_bo, &counters_iova); ++ if (IS_ERR(counters)) { ++ msm_gem_kernel_put(bo, gpu->aspace, true); ++ return PTR_ERR(counters); ++ } ++ + msm_gem_object_set_name(bo, "preempt"); ++ msm_gem_object_set_name(counters_bo, "preempt_counters"); + + a5xx_gpu->preempt_bo[ring->id] = bo; ++ a5xx_gpu->preempt_counters_bo[ring->id] = counters_bo; + a5xx_gpu->preempt_iova[ring->id] = iova; + a5xx_gpu->preempt[ring->id] = ptr; + +@@ -249,7 +261,7 @@ static int preempt_init_ring(struct a5xx + ptr->data = 0; + ptr->cntl = MSM_GPU_RB_CNTL_DEFAULT; + ptr->rptr_addr = rbmemptr(ring, rptr); +- ptr->counter = iova + A5XX_PREEMPT_RECORD_SIZE; ++ ptr->counter = counters_iova; + + return 0; + } +@@ -260,8 +272,11 @@ void a5xx_preempt_fini(struct msm_gpu *g + struct a5xx_gpu *a5xx_gpu = to_a5xx_gpu(adreno_gpu); + int i; + +- for (i = 0; i < gpu->nr_rings; i++) ++ for (i = 0; i < gpu->nr_rings; i++) { + msm_gem_kernel_put(a5xx_gpu->preempt_bo[i], gpu->aspace, true); ++ msm_gem_kernel_put(a5xx_gpu->preempt_counters_bo[i], ++ gpu->aspace, true); ++ } + } + + void a5xx_preempt_init(struct msm_gpu *gpu) diff --git a/queue-5.8/drm-tve200-stabilize-enable-disable.patch b/queue-5.8/drm-tve200-stabilize-enable-disable.patch new file mode 100644 index 00000000000..4f08e05d197 --- /dev/null +++ b/queue-5.8/drm-tve200-stabilize-enable-disable.patch @@ -0,0 +1,90 @@ +From f71800228dc74711c3df43854ce7089562a3bc2d Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Thu, 20 Aug 2020 22:31:44 +0200 +Subject: drm/tve200: Stabilize enable/disable + +From: Linus Walleij + +commit f71800228dc74711c3df43854ce7089562a3bc2d upstream. + +The TVE200 will occasionally print a bunch of lost interrupts +and similar dmesg messages, sometimes during boot and sometimes +after disabling and coming back to enablement. This is probably +because the hardware is left in an unknown state by the boot +loader that displays a logo. + +This can be fixed by bringing the controller into a known state +by resetting the controller while enabling it. We retry reset 5 +times like the vendor driver does. We also put the controller +into reset before de-clocking it and clear all interrupts before +enabling the vblank IRQ. + +This makes the video enable/disable/enable cycle rock solid +on the D-Link DIR-685. Tested extensively. + +Signed-off-by: Linus Walleij +Acked-by: Daniel Vetter +Cc: stable@vger.kernel.org +Link: https://patchwork.freedesktop.org/patch/msgid/20200820203144.271081-1-linus.walleij@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/tve200/tve200_display.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/tve200/tve200_display.c ++++ b/drivers/gpu/drm/tve200/tve200_display.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -130,9 +131,25 @@ static void tve200_display_enable(struct + struct drm_connector *connector = priv->connector; + u32 format = fb->format->format; + u32 ctrl1 = 0; ++ int retries; + + clk_prepare_enable(priv->clk); + ++ /* Reset the TVE200 and wait for it to come back online */ ++ writel(TVE200_CTRL_4_RESET, priv->regs + TVE200_CTRL_4); ++ for (retries = 0; retries < 5; retries++) { ++ usleep_range(30000, 50000); ++ if (readl(priv->regs + TVE200_CTRL_4) & TVE200_CTRL_4_RESET) ++ continue; ++ else ++ break; ++ } ++ if (retries == 5 && ++ readl(priv->regs + TVE200_CTRL_4) & TVE200_CTRL_4_RESET) { ++ dev_err(drm->dev, "can't get hardware out of reset\n"); ++ return; ++ } ++ + /* Function 1 */ + ctrl1 |= TVE200_CTRL_CSMODE; + /* Interlace mode for CCIR656: parameterize? */ +@@ -230,8 +247,9 @@ static void tve200_display_disable(struc + + drm_crtc_vblank_off(crtc); + +- /* Disable and Power Down */ ++ /* Disable put into reset and Power Down */ + writel(0, priv->regs + TVE200_CTRL); ++ writel(TVE200_CTRL_4_RESET, priv->regs + TVE200_CTRL_4); + + clk_disable_unprepare(priv->clk); + } +@@ -279,6 +297,8 @@ static int tve200_display_enable_vblank( + struct drm_device *drm = crtc->dev; + struct tve200_drm_dev_private *priv = drm->dev_private; + ++ /* Clear any IRQs and enable */ ++ writel(0xFF, priv->regs + TVE200_INT_CLR); + writel(TVE200_INT_V_STATUS, priv->regs + TVE200_INT_EN); + return 0; + } diff --git a/queue-5.8/mmc-sdhci-of-esdhc-don-t-walk-device-tree-on-every-interrupt.patch b/queue-5.8/mmc-sdhci-of-esdhc-don-t-walk-device-tree-on-every-interrupt.patch new file mode 100644 index 00000000000..7a5057e2449 --- /dev/null +++ b/queue-5.8/mmc-sdhci-of-esdhc-don-t-walk-device-tree-on-every-interrupt.patch @@ -0,0 +1,61 @@ +From 060522d89705f9d961ef1762dc1468645dd21fbd Mon Sep 17 00:00:00 2001 +From: Chris Packham +Date: Thu, 3 Sep 2020 13:20:29 +1200 +Subject: mmc: sdhci-of-esdhc: Don't walk device-tree on every interrupt + +From: Chris Packham + +commit 060522d89705f9d961ef1762dc1468645dd21fbd upstream. + +Commit b214fe592ab7 ("mmc: sdhci-of-esdhc: add erratum eSDHC7 support") +added code to check for a specific compatible string in the device-tree +on every esdhc interrupat. Instead of doing this record the quirk in +struct sdhci_esdhc and lookup the struct in esdhc_irq. + +Signed-off-by: Chris Packham +Link: https://lore.kernel.org/r/20200903012029.25673-1-chris.packham@alliedtelesis.co.nz +Fixes: b214fe592ab7 ("mmc: sdhci-of-esdhc: add erratum eSDHC7 support") +Cc: stable@vger.kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/host/sdhci-of-esdhc.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/mmc/host/sdhci-of-esdhc.c ++++ b/drivers/mmc/host/sdhci-of-esdhc.c +@@ -81,6 +81,7 @@ struct sdhci_esdhc { + bool quirk_tuning_erratum_type2; + bool quirk_ignore_data_inhibit; + bool quirk_delay_before_data_reset; ++ bool quirk_trans_complete_erratum; + bool in_sw_tuning; + unsigned int peripheral_clock; + const struct esdhc_clk_fixup *clk_fixup; +@@ -1177,10 +1178,11 @@ static void esdhc_set_uhs_signaling(stru + + static u32 esdhc_irq(struct sdhci_host *host, u32 intmask) + { ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_esdhc *esdhc = sdhci_pltfm_priv(pltfm_host); + u32 command; + +- if (of_find_compatible_node(NULL, NULL, +- "fsl,p2020-esdhc")) { ++ if (esdhc->quirk_trans_complete_erratum) { + command = SDHCI_GET_CMD(sdhci_readw(host, + SDHCI_COMMAND)); + if (command == MMC_WRITE_MULTIPLE_BLOCK && +@@ -1334,8 +1336,10 @@ static void esdhc_init(struct platform_d + esdhc->clk_fixup = match->data; + np = pdev->dev.of_node; + +- if (of_device_is_compatible(np, "fsl,p2020-esdhc")) ++ if (of_device_is_compatible(np, "fsl,p2020-esdhc")) { + esdhc->quirk_delay_before_data_reset = true; ++ esdhc->quirk_trans_complete_erratum = true; ++ } + + clk = of_clk_get(np, 0); + if (!IS_ERR(clk)) { diff --git a/queue-5.8/mmc-sdio-use-mmc_pre_req-mmc_post_req.patch b/queue-5.8/mmc-sdio-use-mmc_pre_req-mmc_post_req.patch new file mode 100644 index 00000000000..93cdefa5d62 --- /dev/null +++ b/queue-5.8/mmc-sdio-use-mmc_pre_req-mmc_post_req.patch @@ -0,0 +1,107 @@ +From f0c393e2104e48c8a881719a8bd37996f71b0aee Mon Sep 17 00:00:00 2001 +From: Adrian Hunter +Date: Thu, 3 Sep 2020 11:20:07 +0300 +Subject: mmc: sdio: Use mmc_pre_req() / mmc_post_req() + +From: Adrian Hunter + +commit f0c393e2104e48c8a881719a8bd37996f71b0aee upstream. + +SDHCI changed from using a tasklet to finish requests, to using an IRQ +thread i.e. commit c07a48c2651965 ("mmc: sdhci: Remove finish_tasklet"). +Because this increased the latency to complete requests, a preparatory +change was made to complete the request from the IRQ handler if +possible i.e. commit 19d2f695f4e827 ("mmc: sdhci: Call mmc_request_done() +from IRQ handler if possible"). That alleviated the situation for MMC +block devices because the MMC block driver makes use of mmc_pre_req() +and mmc_post_req() so that successful requests are completed in the IRQ +handler and any DMA unmapping is handled separately in mmc_post_req(). +However SDIO was still affected, and an example has been reported with +up to 20% degradation in performance. + +Looking at SDIO I/O helper functions, sdio_io_rw_ext_helper() appeared +to be a possible candidate for making use of asynchronous requests +within its I/O loops, but analysis revealed that these loops almost +never iterate more than once, so the complexity of the change would not +be warrented. + +Instead, mmc_pre_req() and mmc_post_req() are added before and after I/O +submission (mmc_wait_for_req) in mmc_io_rw_extended(). This still has +the potential benefit of reducing the duration of interrupt handlers, as +well as addressing the latency issue for SDHCI. It also seems a more +reasonable solution than forcing drivers to do everything in the IRQ +handler. + +Reported-by: Dmitry Osipenko +Fixes: c07a48c2651965 ("mmc: sdhci: Remove finish_tasklet") +Signed-off-by: Adrian Hunter +Tested-by: Dmitry Osipenko +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20200903082007.18715-1-adrian.hunter@intel.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mmc/core/sdio_ops.c | 39 ++++++++++++++++++++++----------------- + 1 file changed, 22 insertions(+), 17 deletions(-) + +--- a/drivers/mmc/core/sdio_ops.c ++++ b/drivers/mmc/core/sdio_ops.c +@@ -121,6 +121,7 @@ int mmc_io_rw_extended(struct mmc_card * + struct sg_table sgtable; + unsigned int nents, left_size, i; + unsigned int seg_size = card->host->max_seg_size; ++ int err; + + WARN_ON(blksz == 0); + +@@ -170,28 +171,32 @@ int mmc_io_rw_extended(struct mmc_card * + + mmc_set_data_timeout(&data, card); + +- mmc_wait_for_req(card->host, &mrq); ++ mmc_pre_req(card->host, &mrq); + +- if (nents > 1) +- sg_free_table(&sgtable); ++ mmc_wait_for_req(card->host, &mrq); + + if (cmd.error) +- return cmd.error; +- if (data.error) +- return data.error; +- +- if (mmc_host_is_spi(card->host)) { ++ err = cmd.error; ++ else if (data.error) ++ err = data.error; ++ else if (mmc_host_is_spi(card->host)) + /* host driver already reported errors */ +- } else { +- if (cmd.resp[0] & R5_ERROR) +- return -EIO; +- if (cmd.resp[0] & R5_FUNCTION_NUMBER) +- return -EINVAL; +- if (cmd.resp[0] & R5_OUT_OF_RANGE) +- return -ERANGE; +- } ++ err = 0; ++ else if (cmd.resp[0] & R5_ERROR) ++ err = -EIO; ++ else if (cmd.resp[0] & R5_FUNCTION_NUMBER) ++ err = -EINVAL; ++ else if (cmd.resp[0] & R5_OUT_OF_RANGE) ++ err = -ERANGE; ++ else ++ err = 0; ++ ++ mmc_post_req(card->host, &mrq, err); ++ ++ if (nents > 1) ++ sg_free_table(&sgtable); + +- return 0; ++ return err; + } + + int sdio_reset(struct mmc_host *host) diff --git a/queue-5.8/nvme-revert-fix-controller-creation-races-with-teardown-flow.patch b/queue-5.8/nvme-revert-fix-controller-creation-races-with-teardown-flow.patch new file mode 100644 index 00000000000..dd9f1751c83 --- /dev/null +++ b/queue-5.8/nvme-revert-fix-controller-creation-races-with-teardown-flow.patch @@ -0,0 +1,77 @@ +From b63de8400a6e1001b5732286cf6f5ec27799b7b4 Mon Sep 17 00:00:00 2001 +From: James Smart +Date: Fri, 28 Aug 2020 12:01:50 -0700 +Subject: nvme: Revert: Fix controller creation races with teardown flow + +From: James Smart + +commit b63de8400a6e1001b5732286cf6f5ec27799b7b4 upstream. + +The indicated patch introduced a barrier in the sysfs_delete attribute +for the controller that rejects the request if the controller isn't +created. "Created" is defined as at least 1 call to nvme_start_ctrl(). + +This is problematic in error-injection testing. If an error occurs on +the initial attempt to create an association and the controller enters +reconnect(s) attempts, the admin cannot delete the controller until +either there is a successful association created or ctrl_loss_tmo +times out. + +Where this issue is particularly hurtful is when the "admin" is the +nvme-cli, it is performing a connection to a discovery controller, and +it is initiated via auto-connect scripts. With the FC transport, if the +first connection attempt fails, the controller enters a normal reconnect +state but returns control to the cli thread that created the controller. +In this scenario, the cli attempts to read the discovery log via ioctl, +which fails, causing the cli to see it as an empty log and then proceeds +to delete the discovery controller. The delete is rejected and the +controller is left live. If the discovery controller reconnect then +succeeds, there is no action to delete it, and it sits live doing nothing. + +Cc: # v5.7+ +Fixes: ce1518139e69 ("nvme: Fix controller creation races with teardown flow") +Signed-off-by: James Smart +CC: Israel Rukshin +CC: Max Gurtovoy +CC: Christoph Hellwig +CC: Keith Busch +CC: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/nvme/host/core.c | 5 ----- + drivers/nvme/host/nvme.h | 1 - + 2 files changed, 6 deletions(-) + +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3324,10 +3324,6 @@ static ssize_t nvme_sysfs_delete(struct + { + struct nvme_ctrl *ctrl = dev_get_drvdata(dev); + +- /* Can't delete non-created controllers */ +- if (!ctrl->created) +- return -EBUSY; +- + if (device_remove_file_self(dev, attr)) + nvme_delete_ctrl_sync(ctrl); + return count; +@@ -4129,7 +4125,6 @@ void nvme_start_ctrl(struct nvme_ctrl *c + nvme_queue_scan(ctrl); + nvme_start_queues(ctrl); + } +- ctrl->created = true; + } + EXPORT_SYMBOL_GPL(nvme_start_ctrl); + +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -271,7 +271,6 @@ struct nvme_ctrl { + struct nvme_command ka_cmd; + struct work_struct fw_act_work; + unsigned long events; +- bool created; + + #ifdef CONFIG_NVME_MULTIPATH + /* asymmetric namespace access: */ diff --git a/queue-5.8/rbd-require-global-cap_sys_admin-for-mapping-and-unmapping.patch b/queue-5.8/rbd-require-global-cap_sys_admin-for-mapping-and-unmapping.patch new file mode 100644 index 00000000000..2728b7224e2 --- /dev/null +++ b/queue-5.8/rbd-require-global-cap_sys_admin-for-mapping-and-unmapping.patch @@ -0,0 +1,79 @@ +From f44d04e696feaf13d192d942c4f14ad2e117065a Mon Sep 17 00:00:00 2001 +From: Ilya Dryomov +Date: Thu, 3 Sep 2020 13:24:11 +0200 +Subject: rbd: require global CAP_SYS_ADMIN for mapping and unmapping + +From: Ilya Dryomov + +commit f44d04e696feaf13d192d942c4f14ad2e117065a upstream. + +It turns out that currently we rely only on sysfs attribute +permissions: + + $ ll /sys/bus/rbd/{add*,remove*} + --w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/add + --w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/add_single_major + --w------- 1 root root 4096 Sep 3 20:37 /sys/bus/rbd/remove + --w------- 1 root root 4096 Sep 3 20:38 /sys/bus/rbd/remove_single_major + +This means that images can be mapped and unmapped (i.e. block devices +can be created and deleted) by a UID 0 process even after it drops all +privileges or by any process with CAP_DAC_OVERRIDE in its user namespace +as long as UID 0 is mapped into that user namespace. + +Be consistent with other virtual block devices (loop, nbd, dm, md, etc) +and require CAP_SYS_ADMIN in the initial user namespace for mapping and +unmapping, and also for dumping the configuration string and refreshing +the image header. + +Cc: stable@vger.kernel.org +Signed-off-by: Ilya Dryomov +Reviewed-by: Jeff Layton +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/rbd.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -5120,6 +5120,9 @@ static ssize_t rbd_config_info_show(stru + { + struct rbd_device *rbd_dev = dev_to_rbd_dev(dev); + ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ + return sprintf(buf, "%s\n", rbd_dev->config_info); + } + +@@ -5231,6 +5234,9 @@ static ssize_t rbd_image_refresh(struct + struct rbd_device *rbd_dev = dev_to_rbd_dev(dev); + int ret; + ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ + ret = rbd_dev_refresh(rbd_dev); + if (ret) + return ret; +@@ -7059,6 +7065,9 @@ static ssize_t do_rbd_add(struct bus_typ + struct rbd_client *rbdc; + int rc; + ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ + if (!try_module_get(THIS_MODULE)) + return -ENODEV; + +@@ -7209,6 +7218,9 @@ static ssize_t do_rbd_remove(struct bus_ + bool force = false; + int ret; + ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ + dev_id = -1; + opt_buf[0] = '\0'; + sscanf(buf, "%d %5s", &dev_id, opt_buf); diff --git a/queue-5.8/series b/queue-5.8/series index 2d7e8ddcd6e..14603de7096 100644 --- a/queue-5.8/series +++ b/queue-5.8/series @@ -139,3 +139,11 @@ misc-eeprom-at24-register-nvmem-only-after-eeprom-is-ready-to-use.patch scsi-target-iscsi-fix-data-digest-calculation.patch scsi-lpfc-fix-setting-irq-affinity-with-an-empty-cpu-mask.patch scsi-target-iscsi-fix-hang-in-iscsit_access_np-when-getting-tpg-np_login_sem.patch +drm-tve200-stabilize-enable-disable.patch +drm-msm-split-the-a5xx-preemption-record.patch +drm-msm-disable-preemption-on-all-5xx-targets.patch +drm-msm-disable-the-rptr-shadow.patch +mmc-sdio-use-mmc_pre_req-mmc_post_req.patch +mmc-sdhci-of-esdhc-don-t-walk-device-tree-on-every-interrupt.patch +nvme-revert-fix-controller-creation-races-with-teardown-flow.patch +rbd-require-global-cap_sys_admin-for-mapping-and-unmapping.patch