From: Sasha Levin Date: Mon, 31 Aug 2020 01:27:34 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.4.235~54 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4d90ed7db5cdbd93a4f81b3e6e78250691f2492b;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/alsa-hda-realtek-add-model-alc298-samsung-headphone.patch b/queue-5.4/alsa-hda-realtek-add-model-alc298-samsung-headphone.patch new file mode 100644 index 00000000000..3dcd9c52997 --- /dev/null +++ b/queue-5.4/alsa-hda-realtek-add-model-alc298-samsung-headphone.patch @@ -0,0 +1,37 @@ +From 058c834ff817f8abb96d34b72573b19be7cc79f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Aug 2020 21:32:17 -0700 +Subject: ALSA: hda/realtek: Add model alc298-samsung-headphone + +From: Mike Pozulp + +[ Upstream commit 23dc958689449be85e39351a8c809c3d344b155b ] + +The very quiet and distorted headphone output bug that afflicted my +Samsung Notebook 9 is appearing in many other Samsung laptops. Expose +the quirk which fixed my laptop as a model so other users can try it. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=207423 +Signed-off-by: Mike Pozulp +Link: https://lore.kernel.org/r/20200817043219.458889-1-pozulp.kernel@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_realtek.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 3c7bc398c0cbc..d1b74c7cacd76 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -7939,6 +7939,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC299_FIXUP_PREDATOR_SPK, .name = "predator-spk"}, + {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"}, + {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"}, ++ {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, + {} + }; + #define ALC225_STANDARD_PINS \ +-- +2.25.1 + diff --git a/queue-5.4/arm64-allow-booting-of-late-cpus-affected-by-erratum.patch b/queue-5.4/arm64-allow-booting-of-late-cpus-affected-by-erratum.patch new file mode 100644 index 00000000000..512f5d45059 --- /dev/null +++ b/queue-5.4/arm64-allow-booting-of-late-cpus-affected-by-erratum.patch @@ -0,0 +1,41 @@ +From d455a2feb390936afe6db9dabd6a1e6eda2f3937 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 18:38:24 +0100 +Subject: arm64: Allow booting of late CPUs affected by erratum 1418040 + +From: Marc Zyngier + +[ Upstream commit bf87bb0881d0f59181fe3bbcf29c609f36483ff8 ] + +As we can now switch from a system that isn't affected by 1418040 +to a system that globally is affected, let's allow affected CPUs +to come in at a later time. + +Signed-off-by: Marc Zyngier +Tested-by: Sai Prakash Ranjan +Reviewed-by: Stephen Boyd +Reviewed-by: Suzuki K Poulose +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/20200731173824.107480-3-maz@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/cpu_errata.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 0b2830379fe03..51462c59ab5da 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -917,6 +917,8 @@ const struct arm64_cpu_capabilities arm64_errata[] = { + .desc = "ARM erratum 1418040", + .capability = ARM64_WORKAROUND_1418040, + ERRATA_MIDR_RANGE_LIST(erratum_1418040_list), ++ .type = (ARM64_CPUCAP_SCOPE_LOCAL_CPU | ++ ARM64_CPUCAP_PERMITTED_FOR_LATE_CPU), + }, + #endif + #ifdef CONFIG_ARM64_ERRATUM_1165522 +-- +2.25.1 + diff --git a/queue-5.4/arm64-move-handling-of-erratum-1418040-into-c-code.patch b/queue-5.4/arm64-move-handling-of-erratum-1418040-into-c-code.patch new file mode 100644 index 00000000000..91ba42ef33f --- /dev/null +++ b/queue-5.4/arm64-move-handling-of-erratum-1418040-into-c-code.patch @@ -0,0 +1,84 @@ +From dfcf92cbb8043d4b802b44e5430e112e93582b90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 18:38:23 +0100 +Subject: arm64: Move handling of erratum 1418040 into C code + +From: Marc Zyngier + +[ Upstream commit d49f7d7376d0c0daf8680984a37bd07581ac7d38 ] + +Instead of dealing with erratum 1418040 on each entry and exit, +let's move the handling to __switch_to() instead, which has +several advantages: + +- It can be applied when it matters (switching between 32 and 64 + bit tasks). +- It is written in C (yay!) +- It can rely on static keys rather than alternatives + +Signed-off-by: Marc Zyngier +Tested-by: Sai Prakash Ranjan +Reviewed-by: Stephen Boyd +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/20200731173824.107480-2-maz@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/process.c | 34 ++++++++++++++++++++++++++++++++++ + 1 file changed, 34 insertions(+) + +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index fab013c5ee8c9..10190c4b16dc4 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -498,6 +498,39 @@ static void entry_task_switch(struct task_struct *next) + __this_cpu_write(__entry_task, next); + } + ++/* ++ * ARM erratum 1418040 handling, affecting the 32bit view of CNTVCT. ++ * Assuming the virtual counter is enabled at the beginning of times: ++ * ++ * - disable access when switching from a 64bit task to a 32bit task ++ * - enable access when switching from a 32bit task to a 64bit task ++ */ ++static void erratum_1418040_thread_switch(struct task_struct *prev, ++ struct task_struct *next) ++{ ++ bool prev32, next32; ++ u64 val; ++ ++ if (!(IS_ENABLED(CONFIG_ARM64_ERRATUM_1418040) && ++ cpus_have_const_cap(ARM64_WORKAROUND_1418040))) ++ return; ++ ++ prev32 = is_compat_thread(task_thread_info(prev)); ++ next32 = is_compat_thread(task_thread_info(next)); ++ ++ if (prev32 == next32) ++ return; ++ ++ val = read_sysreg(cntkctl_el1); ++ ++ if (!next32) ++ val |= ARCH_TIMER_USR_VCT_ACCESS_EN; ++ else ++ val &= ~ARCH_TIMER_USR_VCT_ACCESS_EN; ++ ++ write_sysreg(val, cntkctl_el1); ++} ++ + /* + * Thread switching. + */ +@@ -514,6 +547,7 @@ __notrace_funcgraph struct task_struct *__switch_to(struct task_struct *prev, + uao_thread_switch(next); + ptrauth_thread_switch(next); + ssbs_thread_switch(next); ++ erratum_1418040_thread_switch(prev, next); + + /* + * Complete any pending TLB or cache maintenance on this CPU in case +-- +2.25.1 + diff --git a/queue-5.4/asoc-wm8994-avoid-attempts-to-read-unreadable-regist.patch b/queue-5.4/asoc-wm8994-avoid-attempts-to-read-unreadable-regist.patch new file mode 100644 index 00000000000..ced0a3cfa01 --- /dev/null +++ b/queue-5.4/asoc-wm8994-avoid-attempts-to-read-unreadable-regist.patch @@ -0,0 +1,52 @@ +From 95d0bbf5e592fb4e5fc1291f1e12c87b6e2b5dd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 19:38:34 +0200 +Subject: ASoC: wm8994: Avoid attempts to read unreadable registers + +From: Sylwester Nawrocki + +[ Upstream commit f082bb59b72039a2326ec1a44496899fb8aa6d0e ] + +The driver supports WM1811, WM8994, WM8958 devices but according to +documentation and the regmap definitions the WM8958_DSP2_* registers +are only available on WM8958. In current code these registers are +being accessed as if they were available on all the three chips. + +When starting playback on WM1811 CODEC multiple errors like: +"wm8994-codec wm8994-codec: ASoC: error at soc_component_read_no_lock on wm8994-codec: -5" +can be seen, which is caused by attempts to read an unavailable +WM8958_DSP2_PROGRAM register. The issue has been uncovered by recent +commit "e2329ee ASoC: soc-component: add soc_component_err()". + +This patch adds a check in wm8958_aif_ev() callback so the DSP2 handling +is only done for WM8958. + +Signed-off-by: Sylwester Nawrocki +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20200731173834.23832-1-s.nawrocki@samsung.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8958-dsp2.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/codecs/wm8958-dsp2.c b/sound/soc/codecs/wm8958-dsp2.c +index 18535b326680a..04f23477039a5 100644 +--- a/sound/soc/codecs/wm8958-dsp2.c ++++ b/sound/soc/codecs/wm8958-dsp2.c +@@ -416,8 +416,12 @@ int wm8958_aif_ev(struct snd_soc_dapm_widget *w, + struct snd_kcontrol *kcontrol, int event) + { + struct snd_soc_component *component = snd_soc_dapm_to_component(w->dapm); ++ struct wm8994 *control = dev_get_drvdata(component->dev->parent); + int i; + ++ if (control->type != WM8958) ++ return 0; ++ + switch (event) { + case SND_SOC_DAPM_POST_PMU: + case SND_SOC_DAPM_PRE_PMU: +-- +2.25.1 + diff --git a/queue-5.4/bfq-fix-blkio-cgroup-leakage-v4.patch b/queue-5.4/bfq-fix-blkio-cgroup-leakage-v4.patch new file mode 100644 index 00000000000..6ed8588c182 --- /dev/null +++ b/queue-5.4/bfq-fix-blkio-cgroup-leakage-v4.patch @@ -0,0 +1,155 @@ +From 6f8cecb73032984fa390f780237307acaf23c5a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 06:43:40 +0000 +Subject: bfq: fix blkio cgroup leakage v4 + +From: Dmitry Monakhov + +[ Upstream commit 2de791ab4918969d8108f15238a701968375f235 ] + +Changes from v1: + - update commit description with proper ref-accounting justification + +commit db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree") +introduce leak forbfq_group and blkcg_gq objects because of get/put +imbalance. +In fact whole idea of original commit is wrong because bfq_group entity +can not dissapear under us because it is referenced by child bfq_queue's +entities from here: + -> bfq_init_entity() + ->bfqg_and_blkg_get(bfqg); + ->entity->parent = bfqg->my_entity + + -> bfq_put_queue(bfqq) + FINAL_PUT + ->bfqg_and_blkg_put(bfqq_group(bfqq)) + ->kmem_cache_free(bfq_pool, bfqq); + +So parent entity can not disappear while child entity is in tree, +and child entities already has proper protection. +This patch revert commit db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree") + +bfq_group leak trace caused by bad commit: +-> blkg_alloc + -> bfq_pq_alloc + -> bfqg_get (+1) +->bfq_activate_bfqq + ->bfq_activate_requeue_entity + -> __bfq_activate_entity + ->bfq_get_entity + ->bfqg_and_blkg_get (+1) <==== : Note1 +->bfq_del_bfqq_busy + ->bfq_deactivate_entity+0x53/0xc0 [bfq] + ->__bfq_deactivate_entity+0x1b8/0x210 [bfq] + -> bfq_forget_entity(is_in_service = true) + entity->on_st_or_in_serv = false <=== :Note2 + if (is_in_service) + return; ==> do not touch reference +-> blkcg_css_offline + -> blkcg_destroy_blkgs + -> blkg_destroy + -> bfq_pd_offline + -> __bfq_deactivate_entity + if (!entity->on_st_or_in_serv) /* true, because (Note2) + return false; + -> bfq_pd_free + -> bfqg_put() (-1, byt bfqg->ref == 2) because of (Note2) +So bfq_group and blkcg_gq will leak forever, see test-case below. + +##TESTCASE_BEGIN: +#!/bin/bash + +max_iters=${1:-100} +#prep cgroup mounts +mount -t tmpfs cgroup_root /sys/fs/cgroup +mkdir /sys/fs/cgroup/blkio +mount -t cgroup -o blkio none /sys/fs/cgroup/blkio + +# Prepare blkdev +grep blkio /proc/cgroups +truncate -s 1M img +losetup /dev/loop0 img +echo bfq > /sys/block/loop0/queue/scheduler + +grep blkio /proc/cgroups +for ((i=0;i /sys/fs/cgroup/blkio/a/cgroup.procs + dd if=/dev/loop0 bs=4k count=1 of=/dev/null iflag=direct 2> /dev/null + echo 0 > /sys/fs/cgroup/blkio/cgroup.procs + rmdir /sys/fs/cgroup/blkio/a + grep blkio /proc/cgroups +done +##TESTCASE_END: + +Fixes: db37a34c563b ("block, bfq: get a ref to a group when adding it to a service tree") +Tested-by: Oleksandr Natalenko +Signed-off-by: Dmitry Monakhov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-cgroup.c | 2 +- + block/bfq-iosched.h | 1 - + block/bfq-wf2q.c | 12 ++---------- + 3 files changed, 3 insertions(+), 12 deletions(-) + +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index 12b707a4e52fd..342a1cfa48c57 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -332,7 +332,7 @@ static void bfqg_put(struct bfq_group *bfqg) + kfree(bfqg); + } + +-void bfqg_and_blkg_get(struct bfq_group *bfqg) ++static void bfqg_and_blkg_get(struct bfq_group *bfqg) + { + /* see comments in bfq_bic_update_cgroup for why refcounting bfqg */ + bfqg_get(bfqg); +diff --git a/block/bfq-iosched.h b/block/bfq-iosched.h +index c0232975075d0..de98fdfe9ea17 100644 +--- a/block/bfq-iosched.h ++++ b/block/bfq-iosched.h +@@ -980,7 +980,6 @@ struct bfq_group *bfq_find_set_group(struct bfq_data *bfqd, + struct blkcg_gq *bfqg_to_blkg(struct bfq_group *bfqg); + struct bfq_group *bfqq_group(struct bfq_queue *bfqq); + struct bfq_group *bfq_create_group_hierarchy(struct bfq_data *bfqd, int node); +-void bfqg_and_blkg_get(struct bfq_group *bfqg); + void bfqg_and_blkg_put(struct bfq_group *bfqg); + + #ifdef CONFIG_BFQ_GROUP_IOSCHED +diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c +index 44079147e396e..05f0bf4a1144d 100644 +--- a/block/bfq-wf2q.c ++++ b/block/bfq-wf2q.c +@@ -536,9 +536,7 @@ static void bfq_get_entity(struct bfq_entity *entity) + bfqq->ref++; + bfq_log_bfqq(bfqq->bfqd, bfqq, "get_entity: %p %d", + bfqq, bfqq->ref); +- } else +- bfqg_and_blkg_get(container_of(entity, struct bfq_group, +- entity)); ++ } + } + + /** +@@ -652,14 +650,8 @@ static void bfq_forget_entity(struct bfq_service_tree *st, + + entity->on_st = false; + st->wsum -= entity->weight; +- if (is_in_service) +- return; +- +- if (bfqq) ++ if (bfqq && !is_in_service) + bfq_put_queue(bfqq); +- else +- bfqg_and_blkg_put(container_of(entity, struct bfq_group, +- entity)); + } + + /** +-- +2.25.1 + diff --git a/queue-5.4/blk-mq-insert-request-not-through-queue_rq-into-sw-s.patch b/queue-5.4/blk-mq-insert-request-not-through-queue_rq-into-sw-s.patch new file mode 100644 index 00000000000..509dd7492cc --- /dev/null +++ b/queue-5.4/blk-mq-insert-request-not-through-queue_rq-into-sw-s.patch @@ -0,0 +1,51 @@ +From 57ebcb096a743788edbc4b4355e13d8df4a519c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 17:07:28 +0800 +Subject: blk-mq: insert request not through ->queue_rq into sw/scheduler queue + +From: Ming Lei + +[ Upstream commit db03f88fae8a2c8007caafa70287798817df2875 ] + +c616cbee97ae ("blk-mq: punt failed direct issue to dispatch list") supposed +to add request which has been through ->queue_rq() to the hw queue dispatch +list, however it adds request running out of budget or driver tag to hw queue +too. This way basically bypasses request merge, and causes too many request +dispatched to LLD, and system% is unnecessary increased. + +Fixes this issue by adding request not through ->queue_rq into sw/scheduler +queue, and this way is safe because no ->queue_rq is called on this request +yet. + +High %system can be observed on Azure storvsc device, and even soft lock +is observed. This patch reduces %system during heavy sequential IO, +meantime decreases soft lockup risk. + +Fixes: c616cbee97ae ("blk-mq: punt failed direct issue to dispatch list") +Signed-off-by: Ming Lei +Cc: Christoph Hellwig +Cc: Bart Van Assche +Cc: Mike Snitzer +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index ae7d31cb5a4e1..8f67f0f16ec2e 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1869,7 +1869,8 @@ insert: + if (bypass_insert) + return BLK_STS_RESOURCE; + +- blk_mq_request_bypass_insert(rq, false, run_queue); ++ blk_mq_sched_insert_request(rq, false, run_queue, false); ++ + return BLK_STS_OK; + } + +-- +2.25.1 + diff --git a/queue-5.4/blkcg-fix-memleak-for-iolatency.patch b/queue-5.4/blkcg-fix-memleak-for-iolatency.patch new file mode 100644 index 00000000000..da62ee12437 --- /dev/null +++ b/queue-5.4/blkcg-fix-memleak-for-iolatency.patch @@ -0,0 +1,48 @@ +From 68e7b6e9864befacb2feebcb93e81eda59e223af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 22:21:16 -0400 +Subject: blkcg: fix memleak for iolatency + +From: Yufen Yu + +[ Upstream commit 27029b4b18aa5d3b060f0bf2c26dae254132cfce ] + +Normally, blkcg_iolatency_exit() will free related memory in iolatency +when cleanup queue. But if blk_throtl_init() return error and queue init +fail, blkcg_iolatency_exit() will not do that for us. Then it cause +memory leak. + +Fixes: d70675121546 ("block: introduce blk-iolatency io controller") +Signed-off-by: Yufen Yu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-cgroup.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 1eb8895be4c6b..0c7addcd19859 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -1219,13 +1219,15 @@ int blkcg_init_queue(struct request_queue *q) + if (preloaded) + radix_tree_preload_end(); + +- ret = blk_iolatency_init(q); ++ ret = blk_throtl_init(q); + if (ret) + goto err_destroy_all; + +- ret = blk_throtl_init(q); +- if (ret) ++ ret = blk_iolatency_init(q); ++ if (ret) { ++ blk_throtl_exit(q); + goto err_destroy_all; ++ } + return 0; + + err_destroy_all: +-- +2.25.1 + diff --git a/queue-5.4/block-fix-page_is_mergeable-for-compound-pages.patch b/queue-5.4/block-fix-page_is_mergeable-for-compound-pages.patch new file mode 100644 index 00000000000..05daffc93b3 --- /dev/null +++ b/queue-5.4/block-fix-page_is_mergeable-for-compound-pages.patch @@ -0,0 +1,54 @@ +From 00f2f5e8e468c376d35433ae8a330140e5b0230c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 20:52:06 +0100 +Subject: block: Fix page_is_mergeable() for compound pages + +From: Matthew Wilcox (Oracle) + +[ Upstream commit d81665198b83e55a28339d1f3e4890ed8a434556 ] + +If we pass in an offset which is larger than PAGE_SIZE, then +page_is_mergeable() thinks it's not mergeable with the previous bio_vec, +leading to a large number of bio_vecs being used. Use a slightly more +obvious test that the two pages are compatible with each other. + +Fixes: 52d52d1c98a9 ("block: only allow contiguous page structs in a bio_vec") +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/block/bio.c b/block/bio.c +index 94d697217887a..87505a93bcff6 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -683,8 +683,8 @@ static inline bool page_is_mergeable(const struct bio_vec *bv, + struct page *page, unsigned int len, unsigned int off, + bool *same_page) + { +- phys_addr_t vec_end_addr = page_to_phys(bv->bv_page) + +- bv->bv_offset + bv->bv_len - 1; ++ size_t bv_end = bv->bv_offset + bv->bv_len; ++ phys_addr_t vec_end_addr = page_to_phys(bv->bv_page) + bv_end - 1; + phys_addr_t page_addr = page_to_phys(page); + + if (vec_end_addr + 1 != page_addr + off) +@@ -693,9 +693,9 @@ static inline bool page_is_mergeable(const struct bio_vec *bv, + return false; + + *same_page = ((vec_end_addr & PAGE_MASK) == page_addr); +- if (!*same_page && pfn_to_page(PFN_DOWN(vec_end_addr)) + 1 != page) +- return false; +- return true; ++ if (*same_page) ++ return true; ++ return (bv->bv_page + bv_end / PAGE_SIZE) == (page + off / PAGE_SIZE); + } + + static bool bio_try_merge_pc_page(struct request_queue *q, struct bio *bio, +-- +2.25.1 + diff --git a/queue-5.4/block-respect-queue-limit-of-max-discard-segment.patch b/queue-5.4/block-respect-queue-limit-of-max-discard-segment.patch new file mode 100644 index 00000000000..24b6654a212 --- /dev/null +++ b/queue-5.4/block-respect-queue-limit-of-max-discard-segment.patch @@ -0,0 +1,64 @@ +From 8eaefc65ea2c89791d7f86effca2a62b97b4eb64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 17:52:39 +0800 +Subject: block: respect queue limit of max discard segment + +From: Ming Lei + +[ Upstream commit 943b40c832beb71115e38a1c4d99b640b5342738 ] + +When queue_max_discard_segments(q) is 1, blk_discard_mergable() will +return false for discard request, then normal request merge is applied. +However, only queue_max_segments() is checked, so max discard segment +limit isn't respected. + +Check max discard segment limit in the request merge code for fixing +the issue. + +Discard request failure of virtio_blk is fixed. + +Fixes: 69840466086d ("block: fix the DISCARD request merge") +Signed-off-by: Ming Lei +Reviewed-by: Christoph Hellwig +Cc: Stefano Garzarella +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-merge.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 93cff719b0661..c874931bae6b5 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -553,10 +553,17 @@ int blk_rq_map_sg(struct request_queue *q, struct request *rq, + } + EXPORT_SYMBOL(blk_rq_map_sg); + ++static inline unsigned int blk_rq_get_max_segments(struct request *rq) ++{ ++ if (req_op(rq) == REQ_OP_DISCARD) ++ return queue_max_discard_segments(rq->q); ++ return queue_max_segments(rq->q); ++} ++ + static inline int ll_new_hw_segment(struct request *req, struct bio *bio, + unsigned int nr_phys_segs) + { +- if (req->nr_phys_segments + nr_phys_segs > queue_max_segments(req->q)) ++ if (req->nr_phys_segments + nr_phys_segs > blk_rq_get_max_segments(req)) + goto no_merge; + + if (blk_integrity_merge_bio(req->q, req, bio) == false) +@@ -640,7 +647,7 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req, + return 0; + + total_phys_segments = req->nr_phys_segments + next->nr_phys_segments; +- if (total_phys_segments > queue_max_segments(q)) ++ if (total_phys_segments > blk_rq_get_max_segments(req)) + return 0; + + if (blk_integrity_merge_rq(q, req, next) == false) +-- +2.25.1 + diff --git a/queue-5.4/block-virtio_blk-fix-handling-single-range-discard-r.patch b/queue-5.4/block-virtio_blk-fix-handling-single-range-discard-r.patch new file mode 100644 index 00000000000..a7674672b52 --- /dev/null +++ b/queue-5.4/block-virtio_blk-fix-handling-single-range-discard-r.patch @@ -0,0 +1,82 @@ +From 5d7489d46ae308152473c7c961fae9bff3f30c77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 17:52:40 +0800 +Subject: block: virtio_blk: fix handling single range discard request + +From: Ming Lei + +[ Upstream commit af822aa68fbdf0a480a17462ed70232998127453 ] + +1f23816b8eb8 ("virtio_blk: add discard and write zeroes support") starts +to support multi-range discard for virtio-blk. However, the virtio-blk +disk may report max discard segment as 1, at least that is exactly what +qemu is doing. + +So far, block layer switches to normal request merge if max discard segment +limit is 1, and multiple bios can be merged to single segment. This way may +cause memory corruption in virtblk_setup_discard_write_zeroes(). + +Fix the issue by handling single max discard segment in straightforward +way. + +Fixes: 1f23816b8eb8 ("virtio_blk: add discard and write zeroes support") +Signed-off-by: Ming Lei +Reviewed-by: Christoph Hellwig +Cc: Changpeng Liu +Cc: Daniel Verkamp +Cc: Michael S. Tsirkin +Cc: Stefan Hajnoczi +Cc: Stefano Garzarella +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 31 +++++++++++++++++++++++-------- + 1 file changed, 23 insertions(+), 8 deletions(-) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index c1de270046bfe..2eeb2bcb488d4 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -205,16 +205,31 @@ static int virtblk_setup_discard_write_zeroes(struct request *req, bool unmap) + if (!range) + return -ENOMEM; + +- __rq_for_each_bio(bio, req) { +- u64 sector = bio->bi_iter.bi_sector; +- u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT; +- +- range[n].flags = cpu_to_le32(flags); +- range[n].num_sectors = cpu_to_le32(num_sectors); +- range[n].sector = cpu_to_le64(sector); +- n++; ++ /* ++ * Single max discard segment means multi-range discard isn't ++ * supported, and block layer only runs contiguity merge like ++ * normal RW request. So we can't reply on bio for retrieving ++ * each range info. ++ */ ++ if (queue_max_discard_segments(req->q) == 1) { ++ range[0].flags = cpu_to_le32(flags); ++ range[0].num_sectors = cpu_to_le32(blk_rq_sectors(req)); ++ range[0].sector = cpu_to_le64(blk_rq_pos(req)); ++ n = 1; ++ } else { ++ __rq_for_each_bio(bio, req) { ++ u64 sector = bio->bi_iter.bi_sector; ++ u32 num_sectors = bio->bi_iter.bi_size >> SECTOR_SHIFT; ++ ++ range[n].flags = cpu_to_le32(flags); ++ range[n].num_sectors = cpu_to_le32(num_sectors); ++ range[n].sector = cpu_to_le64(sector); ++ n++; ++ } + } + ++ WARN_ON_ONCE(n != segments); ++ + req->special_vec.bv_page = virt_to_page(range); + req->special_vec.bv_offset = offset_in_page(range); + req->special_vec.bv_len = sizeof(*range) * segments; +-- +2.25.1 + diff --git a/queue-5.4/can-j1939-transport-j1939_xtp_rx_dat_one-compare-own.patch b/queue-5.4/can-j1939-transport-j1939_xtp_rx_dat_one-compare-own.patch new file mode 100644 index 00000000000..88282536dc7 --- /dev/null +++ b/queue-5.4/can-j1939-transport-j1939_xtp_rx_dat_one-compare-own.patch @@ -0,0 +1,57 @@ +From 9ff9482ebca7333d7d99ce2cdc59fcff90761bf2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2020 12:52:00 +0200 +Subject: can: j1939: transport: j1939_xtp_rx_dat_one(): compare own packets to + detect corruptions + +From: Oleksij Rempel + +[ Upstream commit e052d0540298bfe0f6cbbecdc7e2ea9b859575b2 ] + +Since the stack relays on receiving own packets, it was overwriting own +transmit buffer from received packets. + +At least theoretically, the received echo buffer can be corrupt or +changed and the session partner can request to resend previous data. In +this case we will re-send bad data. + +With this patch we will stop to overwrite own TX buffer and use it for +sanity checking. + +Signed-off-by: Oleksij Rempel +Link: https://lore.kernel.org/r/20200807105200.26441-6-o.rempel@pengutronix.de +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/j1939/transport.c | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/net/can/j1939/transport.c b/net/can/j1939/transport.c +index dbd215cbc53d8..a8dd956b5e8e1 100644 +--- a/net/can/j1939/transport.c ++++ b/net/can/j1939/transport.c +@@ -1803,7 +1803,20 @@ static void j1939_xtp_rx_dat_one(struct j1939_session *session, + } + + tpdat = se_skb->data; +- memcpy(&tpdat[offset], &dat[1], nbytes); ++ if (!session->transmission) { ++ memcpy(&tpdat[offset], &dat[1], nbytes); ++ } else { ++ int err; ++ ++ err = memcmp(&tpdat[offset], &dat[1], nbytes); ++ if (err) ++ netdev_err_once(priv->ndev, ++ "%s: 0x%p: Data of RX-looped back packet (%*ph) doesn't match TX data (%*ph)!\n", ++ __func__, session, ++ nbytes, &dat[1], ++ nbytes, &tpdat[offset]); ++ } ++ + if (packet == session->pkt.rx) + session->pkt.rx++; + +-- +2.25.1 + diff --git a/queue-5.4/drm-amd-display-switch-to-immediate-mode-for-updatin.patch b/queue-5.4/drm-amd-display-switch-to-immediate-mode-for-updatin.patch new file mode 100644 index 00000000000..79f9a281d6a --- /dev/null +++ b/queue-5.4/drm-amd-display-switch-to-immediate-mode-for-updatin.patch @@ -0,0 +1,114 @@ +From b2a7313b9894458814ec8afb7af0d2fd3ceedb59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jul 2020 17:43:10 -0400 +Subject: drm/amd/display: Switch to immediate mode for updating infopackets + +From: Anthony Koo + +[ Upstream commit abba907c7a20032c2d504fd5afe3af7d440a09d0 ] + +[Why] +Using FRAME_UPDATE will result in infopacket to be potentially updated +one frame late. +In commit stream scenarios for previously active stream, some stale +infopacket data from previous config might be erroneously sent out on +initial frame after stream is re-enabled. + +[How] +Switch to using IMMEDIATE_UPDATE mode + +Signed-off-by: Anthony Koo +Reviewed-by: Ashley Thomas +Acked-by: Qingqing Zhuo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/dcn10/dcn10_stream_encoder.c | 16 ++++++++-------- + .../amd/display/dc/dcn10/dcn10_stream_encoder.h | 14 ++++++++++++++ + 2 files changed, 22 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c +index 9aa258f3550b6..ddf66046616d6 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.c +@@ -121,35 +121,35 @@ void enc1_update_generic_info_packet( + switch (packet_index) { + case 0: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC0_FRAME_UPDATE, 1); ++ AFMT_GENERIC0_IMMEDIATE_UPDATE, 1); + break; + case 1: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC1_FRAME_UPDATE, 1); ++ AFMT_GENERIC1_IMMEDIATE_UPDATE, 1); + break; + case 2: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC2_FRAME_UPDATE, 1); ++ AFMT_GENERIC2_IMMEDIATE_UPDATE, 1); + break; + case 3: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC3_FRAME_UPDATE, 1); ++ AFMT_GENERIC3_IMMEDIATE_UPDATE, 1); + break; + case 4: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC4_FRAME_UPDATE, 1); ++ AFMT_GENERIC4_IMMEDIATE_UPDATE, 1); + break; + case 5: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC5_FRAME_UPDATE, 1); ++ AFMT_GENERIC5_IMMEDIATE_UPDATE, 1); + break; + case 6: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC6_FRAME_UPDATE, 1); ++ AFMT_GENERIC6_IMMEDIATE_UPDATE, 1); + break; + case 7: + REG_UPDATE(AFMT_VBI_PACKET_CONTROL1, +- AFMT_GENERIC7_FRAME_UPDATE, 1); ++ AFMT_GENERIC7_IMMEDIATE_UPDATE, 1); + break; + default: + break; +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h +index a512cbea00d17..b9656614950e3 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_stream_encoder.h +@@ -275,7 +275,14 @@ struct dcn10_stream_enc_registers { + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC2_FRAME_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC3_FRAME_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC4_FRAME_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC0_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC1_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC2_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC3_IMMEDIATE_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC4_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC5_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC6_IMMEDIATE_UPDATE, mask_sh),\ ++ SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC7_IMMEDIATE_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC5_FRAME_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC6_FRAME_UPDATE, mask_sh),\ + SE_SF(DIG0_AFMT_VBI_PACKET_CONTROL1, AFMT_GENERIC7_FRAME_UPDATE, mask_sh),\ +@@ -339,7 +346,14 @@ struct dcn10_stream_enc_registers { + type AFMT_GENERIC2_FRAME_UPDATE;\ + type AFMT_GENERIC3_FRAME_UPDATE;\ + type AFMT_GENERIC4_FRAME_UPDATE;\ ++ type AFMT_GENERIC0_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC1_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC2_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC3_IMMEDIATE_UPDATE;\ + type AFMT_GENERIC4_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC5_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC6_IMMEDIATE_UPDATE;\ ++ type AFMT_GENERIC7_IMMEDIATE_UPDATE;\ + type AFMT_GENERIC5_FRAME_UPDATE;\ + type AFMT_GENERIC6_FRAME_UPDATE;\ + type AFMT_GENERIC7_FRAME_UPDATE;\ +-- +2.25.1 + diff --git a/queue-5.4/drm-amd-powerplay-correct-uvd-vce-pg-state-on-custom.patch b/queue-5.4/drm-amd-powerplay-correct-uvd-vce-pg-state-on-custom.patch new file mode 100644 index 00000000000..1d8b1a85912 --- /dev/null +++ b/queue-5.4/drm-amd-powerplay-correct-uvd-vce-pg-state-on-custom.patch @@ -0,0 +1,41 @@ +From 439a3a638fe02318095b9a07adc84a8bfddb3e1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2020 17:01:47 +0800 +Subject: drm/amd/powerplay: correct UVD/VCE PG state on custom pptable + uploading + +From: Evan Quan + +[ Upstream commit 2c5b8080d810d98e3e59617680218499b17c84a1 ] + +The UVD/VCE PG state is managed by UVD and VCE IP. It's error-prone to +assume the bootup state in SMU based on the dpm status. + +Signed-off-by: Evan Quan +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +index 08b91c31532ba..947e4fa3c5e68 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +@@ -1640,12 +1640,6 @@ static void vega20_init_powergate_state(struct pp_hwmgr *hwmgr) + + data->uvd_power_gated = true; + data->vce_power_gated = true; +- +- if (data->smu_features[GNLD_DPM_UVD].enabled) +- data->uvd_power_gated = false; +- +- if (data->smu_features[GNLD_DPM_VCE].enabled) +- data->vce_power_gated = false; + } + + static int vega20_enable_dpm_tasks(struct pp_hwmgr *hwmgr) +-- +2.25.1 + diff --git a/queue-5.4/drm-amd-powerplay-correct-vega20-cached-smu-feature-.patch b/queue-5.4/drm-amd-powerplay-correct-vega20-cached-smu-feature-.patch new file mode 100644 index 00000000000..8cde69850d1 --- /dev/null +++ b/queue-5.4/drm-amd-powerplay-correct-vega20-cached-smu-feature-.patch @@ -0,0 +1,92 @@ +From abfb0a79764cc92dea20c005eaeb7522f9172184 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2020 15:03:40 +0800 +Subject: drm/amd/powerplay: correct Vega20 cached smu feature state + +From: Evan Quan + +[ Upstream commit 266d81d9eed30f4994d76a2b237c63ece062eefe ] + +Correct the cached smu feature state on pp_features sysfs +setting. + +Signed-off-by: Evan Quan +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../drm/amd/powerplay/hwmgr/vega20_hwmgr.c | 38 +++++++++---------- + 1 file changed, 19 insertions(+), 19 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +index f5915308e643a..08b91c31532ba 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega20_hwmgr.c +@@ -981,27 +981,15 @@ static int vega20_disable_all_smu_features(struct pp_hwmgr *hwmgr) + { + struct vega20_hwmgr *data = + (struct vega20_hwmgr *)(hwmgr->backend); +- uint64_t features_enabled; +- int i; +- bool enabled; +- int ret = 0; ++ int i, ret = 0; + + PP_ASSERT_WITH_CODE((ret = smum_send_msg_to_smc(hwmgr, + PPSMC_MSG_DisableAllSmuFeatures)) == 0, + "[DisableAllSMUFeatures] Failed to disable all smu features!", + return ret); + +- ret = vega20_get_enabled_smc_features(hwmgr, &features_enabled); +- PP_ASSERT_WITH_CODE(!ret, +- "[DisableAllSMUFeatures] Failed to get enabled smc features!", +- return ret); +- +- for (i = 0; i < GNLD_FEATURES_MAX; i++) { +- enabled = (features_enabled & data->smu_features[i].smu_feature_bitmap) ? +- true : false; +- data->smu_features[i].enabled = enabled; +- data->smu_features[i].supported = enabled; +- } ++ for (i = 0; i < GNLD_FEATURES_MAX; i++) ++ data->smu_features[i].enabled = 0; + + return 0; + } +@@ -3211,10 +3199,11 @@ static int vega20_get_ppfeature_status(struct pp_hwmgr *hwmgr, char *buf) + + static int vega20_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfeature_masks) + { +- uint64_t features_enabled; +- uint64_t features_to_enable; +- uint64_t features_to_disable; +- int ret = 0; ++ struct vega20_hwmgr *data = ++ (struct vega20_hwmgr *)(hwmgr->backend); ++ uint64_t features_enabled, features_to_enable, features_to_disable; ++ int i, ret = 0; ++ bool enabled; + + if (new_ppfeature_masks >= (1ULL << GNLD_FEATURES_MAX)) + return -EINVAL; +@@ -3243,6 +3232,17 @@ static int vega20_set_ppfeature_status(struct pp_hwmgr *hwmgr, uint64_t new_ppfe + return ret; + } + ++ /* Update the cached feature enablement state */ ++ ret = vega20_get_enabled_smc_features(hwmgr, &features_enabled); ++ if (ret) ++ return ret; ++ ++ for (i = 0; i < GNLD_FEATURES_MAX; i++) { ++ enabled = (features_enabled & data->smu_features[i].smu_feature_bitmap) ? ++ true : false; ++ data->smu_features[i].enabled = enabled; ++ } ++ + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.4/drm-msm-adreno-fix-updating-ring-fence.patch b/queue-5.4/drm-msm-adreno-fix-updating-ring-fence.patch new file mode 100644 index 00000000000..6ab3efb22d5 --- /dev/null +++ b/queue-5.4/drm-msm-adreno-fix-updating-ring-fence.patch @@ -0,0 +1,42 @@ +From a93a74933c2b2dcfc766032a216f91d111c15f0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Aug 2020 17:03:09 -0700 +Subject: drm/msm/adreno: fix updating ring fence + +From: Rob Clark + +[ Upstream commit f228af11dfa1d1616bc67f3a4119ab77c36181f1 ] + +We need to set it to the most recent completed fence, not the most +recent submitted. Otherwise we have races where we think we can retire +submits that the GPU is not finished with, if the GPU doesn't manage to +overwrite the seqno before we look at it. + +This can show up with hang recovery if one of the submits after the +crashing submit also hangs after it is replayed. + +Fixes: f97decac5f4c ("drm/msm: Support multiple ringbuffers") +Signed-off-by: Rob Clark +Reviewed-by: Jordan Crouse +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index 048c8be426f32..053da39da1cc0 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -350,7 +350,7 @@ int adreno_hw_init(struct msm_gpu *gpu) + ring->next = ring->start; + + /* reset completed fence seqno: */ +- ring->memptrs->fence = ring->seqno; ++ ring->memptrs->fence = ring->fctx->completed_fence; + ring->memptrs->rptr = 0; + } + +-- +2.25.1 + diff --git a/queue-5.4/ext4-correctly-restore-system-zone-info-when-remount.patch b/queue-5.4/ext4-correctly-restore-system-zone-info-when-remount.patch new file mode 100644 index 00000000000..6b15f70c371 --- /dev/null +++ b/queue-5.4/ext4-correctly-restore-system-zone-info-when-remount.patch @@ -0,0 +1,110 @@ +From 9ce01e30a5549672318c6dc01ce0cedd864f535a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jul 2020 15:04:37 +0200 +Subject: ext4: correctly restore system zone info when remount fails + +From: Jan Kara + +[ Upstream commit 0f5bde1db174f6c471f0bd27198575719dabe3e5 ] + +When remounting filesystem fails late during remount handling and +block_validity mount option is also changed during the remount, we fail +to restore system zone information to a state matching the mount option. +This is mostly harmless, just the block validity checking will not match +the situation described by the mount option. Make sure these two are always +consistent. + +Reported-by: Lukas Czerner +Reviewed-by: Lukas Czerner +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20200728130437.7804-7-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/block_validity.c | 8 -------- + fs/ext4/super.c | 29 +++++++++++++++++++++-------- + 2 files changed, 21 insertions(+), 16 deletions(-) + +diff --git a/fs/ext4/block_validity.c b/fs/ext4/block_validity.c +index ceb54ccc937e9..97c56d061e615 100644 +--- a/fs/ext4/block_validity.c ++++ b/fs/ext4/block_validity.c +@@ -250,14 +250,6 @@ int ext4_setup_system_zone(struct super_block *sb) + int flex_size = ext4_flex_bg_size(sbi); + int ret; + +- if (!test_opt(sb, BLOCK_VALIDITY)) { +- if (sbi->system_blks) +- ext4_release_system_zone(sb); +- return 0; +- } +- if (sbi->system_blks) +- return 0; +- + system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL); + if (!system_blks) + return -ENOMEM; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index e8923013accc0..184f2d737efc9 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4563,11 +4563,13 @@ no_journal: + + ext4_set_resv_clusters(sb); + +- err = ext4_setup_system_zone(sb); +- if (err) { +- ext4_msg(sb, KERN_ERR, "failed to initialize system " +- "zone (%d)", err); +- goto failed_mount4a; ++ if (test_opt(sb, BLOCK_VALIDITY)) { ++ err = ext4_setup_system_zone(sb); ++ if (err) { ++ ext4_msg(sb, KERN_ERR, "failed to initialize system " ++ "zone (%d)", err); ++ goto failed_mount4a; ++ } + } + + ext4_ext_init(sb); +@@ -5563,9 +5565,16 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + ext4_register_li_request(sb, first_not_zeroed); + } + +- err = ext4_setup_system_zone(sb); +- if (err) +- goto restore_opts; ++ /* ++ * Handle creation of system zone data early because it can fail. ++ * Releasing of existing data is done when we are sure remount will ++ * succeed. ++ */ ++ if (test_opt(sb, BLOCK_VALIDITY) && !sbi->system_blks) { ++ err = ext4_setup_system_zone(sb); ++ if (err) ++ goto restore_opts; ++ } + + if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) { + err = ext4_commit_super(sb, 1); +@@ -5587,6 +5596,8 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + } + } + #endif ++ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks) ++ ext4_release_system_zone(sb); + + /* + * Some options can be enabled by ext4 and/or by VFS mount flag +@@ -5608,6 +5619,8 @@ restore_opts: + sbi->s_commit_interval = old_opts.s_commit_interval; + sbi->s_min_batch_time = old_opts.s_min_batch_time; + sbi->s_max_batch_time = old_opts.s_max_batch_time; ++ if (!test_opt(sb, BLOCK_VALIDITY) && sbi->system_blks) ++ ext4_release_system_zone(sb); + #ifdef CONFIG_QUOTA + sbi->s_jquota_fmt = old_opts.s_jquota_fmt; + for (i = 0; i < EXT4_MAXQUOTAS; i++) { +-- +2.25.1 + diff --git a/queue-5.4/ext4-don-t-bug-on-inconsistent-journal-feature.patch b/queue-5.4/ext4-don-t-bug-on-inconsistent-journal-feature.patch new file mode 100644 index 00000000000..cb9473b57ca --- /dev/null +++ b/queue-5.4/ext4-don-t-bug-on-inconsistent-journal-feature.patch @@ -0,0 +1,212 @@ +From 62489b6ecbbc90a7e656382c06a2b2e064448d18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Jul 2020 16:07:59 +0200 +Subject: ext4: don't BUG on inconsistent journal feature + +From: Jan Kara + +[ Upstream commit 11215630aada28307ba555a43138db6ac54fa825 ] + +A customer has reported a BUG_ON in ext4_clear_journal_err() hitting +during an LTP testing. Either this has been caused by a test setup +issue where the filesystem was being overwritten while LTP was mounting +it or the journal replay has overwritten the superblock with invalid +data. In either case it is preferable we don't take the machine down +with a BUG_ON. So handle the situation of unexpectedly missing +has_journal feature more gracefully. We issue warning and fail the mount +in the cases where the race window is narrow and the failed check is +most likely a programming error. In cases where fs corruption is more +likely, we do full ext4_error() handling before failing mount / remount. + +Reviewed-by: Lukas Czerner +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20200710140759.18031-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 68 ++++++++++++++++++++++++++++++++++--------------- + 1 file changed, 47 insertions(+), 21 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index f7c20bb20da37..bd4feafcff294 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -66,10 +66,10 @@ static int ext4_load_journal(struct super_block *, struct ext4_super_block *, + unsigned long journal_devnum); + static int ext4_show_options(struct seq_file *seq, struct dentry *root); + static int ext4_commit_super(struct super_block *sb, int sync); +-static void ext4_mark_recovery_complete(struct super_block *sb, ++static int ext4_mark_recovery_complete(struct super_block *sb, + struct ext4_super_block *es); +-static void ext4_clear_journal_err(struct super_block *sb, +- struct ext4_super_block *es); ++static int ext4_clear_journal_err(struct super_block *sb, ++ struct ext4_super_block *es); + static int ext4_sync_fs(struct super_block *sb, int wait); + static int ext4_remount(struct super_block *sb, int *flags, char *data); + static int ext4_statfs(struct dentry *dentry, struct kstatfs *buf); +@@ -4635,7 +4635,9 @@ no_journal: + EXT4_SB(sb)->s_mount_state &= ~EXT4_ORPHAN_FS; + if (needs_recovery) { + ext4_msg(sb, KERN_INFO, "recovery complete"); +- ext4_mark_recovery_complete(sb, es); ++ err = ext4_mark_recovery_complete(sb, es); ++ if (err) ++ goto failed_mount8; + } + if (EXT4_SB(sb)->s_journal) { + if (test_opt(sb, DATA_FLAGS) == EXT4_MOUNT_JOURNAL_DATA) +@@ -4678,10 +4680,8 @@ cantfind_ext4: + ext4_msg(sb, KERN_ERR, "VFS: Can't find ext4 filesystem"); + goto failed_mount; + +-#ifdef CONFIG_QUOTA + failed_mount8: + ext4_unregister_sysfs(sb); +-#endif + failed_mount7: + ext4_unregister_li_request(sb); + failed_mount6: +@@ -4820,7 +4820,8 @@ static journal_t *ext4_get_journal(struct super_block *sb, + struct inode *journal_inode; + journal_t *journal; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return NULL; + + journal_inode = ext4_get_journal_inode(sb, journal_inum); + if (!journal_inode) +@@ -4850,7 +4851,8 @@ static journal_t *ext4_get_dev_journal(struct super_block *sb, + struct ext4_super_block *es; + struct block_device *bdev; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return NULL; + + bdev = ext4_blkdev_get(j_dev, sb); + if (bdev == NULL) +@@ -4942,7 +4944,8 @@ static int ext4_load_journal(struct super_block *sb, + int err = 0; + int really_read_only; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) ++ return -EFSCORRUPTED; + + if (journal_devnum && + journal_devnum != le32_to_cpu(es->s_journal_dev)) { +@@ -5012,7 +5015,12 @@ static int ext4_load_journal(struct super_block *sb, + } + + EXT4_SB(sb)->s_journal = journal; +- ext4_clear_journal_err(sb, es); ++ err = ext4_clear_journal_err(sb, es); ++ if (err) { ++ EXT4_SB(sb)->s_journal = NULL; ++ jbd2_journal_destroy(journal); ++ return err; ++ } + + if (!really_read_only && journal_devnum && + journal_devnum != le32_to_cpu(es->s_journal_dev)) { +@@ -5108,26 +5116,32 @@ static int ext4_commit_super(struct super_block *sb, int sync) + * remounting) the filesystem readonly, then we will end up with a + * consistent fs on disk. Record that fact. + */ +-static void ext4_mark_recovery_complete(struct super_block *sb, +- struct ext4_super_block *es) ++static int ext4_mark_recovery_complete(struct super_block *sb, ++ struct ext4_super_block *es) + { ++ int err; + journal_t *journal = EXT4_SB(sb)->s_journal; + + if (!ext4_has_feature_journal(sb)) { +- BUG_ON(journal != NULL); +- return; ++ if (journal != NULL) { ++ ext4_error(sb, "Journal got removed while the fs was " ++ "mounted!"); ++ return -EFSCORRUPTED; ++ } ++ return 0; + } + jbd2_journal_lock_updates(journal); +- if (jbd2_journal_flush(journal) < 0) ++ err = jbd2_journal_flush(journal); ++ if (err < 0) + goto out; + + if (ext4_has_feature_journal_needs_recovery(sb) && sb_rdonly(sb)) { + ext4_clear_feature_journal_needs_recovery(sb); + ext4_commit_super(sb, 1); + } +- + out: + jbd2_journal_unlock_updates(journal); ++ return err; + } + + /* +@@ -5135,14 +5149,17 @@ out: + * has recorded an error from a previous lifetime, move that error to the + * main filesystem now. + */ +-static void ext4_clear_journal_err(struct super_block *sb, ++static int ext4_clear_journal_err(struct super_block *sb, + struct ext4_super_block *es) + { + journal_t *journal; + int j_errno; + const char *errstr; + +- BUG_ON(!ext4_has_feature_journal(sb)); ++ if (!ext4_has_feature_journal(sb)) { ++ ext4_error(sb, "Journal got removed while the fs was mounted!"); ++ return -EFSCORRUPTED; ++ } + + journal = EXT4_SB(sb)->s_journal; + +@@ -5167,6 +5184,7 @@ static void ext4_clear_journal_err(struct super_block *sb, + jbd2_journal_clear_err(journal); + jbd2_journal_update_sb_errno(journal); + } ++ return 0; + } + + /* +@@ -5437,8 +5455,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + (sbi->s_mount_state & EXT4_VALID_FS)) + es->s_state = cpu_to_le16(sbi->s_mount_state); + +- if (sbi->s_journal) ++ if (sbi->s_journal) { ++ /* ++ * We let remount-ro finish even if marking fs ++ * as clean failed... ++ */ + ext4_mark_recovery_complete(sb, es); ++ } + if (sbi->s_mmp_tsk) + kthread_stop(sbi->s_mmp_tsk); + } else { +@@ -5486,8 +5509,11 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + * been changed by e2fsck since we originally mounted + * the partition.) + */ +- if (sbi->s_journal) +- ext4_clear_journal_err(sb, es); ++ if (sbi->s_journal) { ++ err = ext4_clear_journal_err(sb, es); ++ if (err) ++ goto restore_opts; ++ } + sbi->s_mount_state = le16_to_cpu(es->s_state); + + err = ext4_setup_super(sb, es, 0); +-- +2.25.1 + diff --git a/queue-5.4/ext4-handle-error-of-ext4_setup_system_zone-on-remou.patch b/queue-5.4/ext4-handle-error-of-ext4_setup_system_zone-on-remou.patch new file mode 100644 index 00000000000..3d886f1c89a --- /dev/null +++ b/queue-5.4/ext4-handle-error-of-ext4_setup_system_zone-on-remou.patch @@ -0,0 +1,39 @@ +From e41f31783b40746bf14687c1398ad650c039fbe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 28 Jul 2020 15:04:32 +0200 +Subject: ext4: handle error of ext4_setup_system_zone() on remount + +From: Jan Kara + +[ Upstream commit d176b1f62f242ab259ff665a26fbac69db1aecba ] + +ext4_setup_system_zone() can fail. Handle the failure in ext4_remount(). + +Reviewed-by: Lukas Czerner +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20200728130437.7804-2-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 92a6741c4bdd9..e8923013accc0 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5563,7 +5563,10 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + ext4_register_li_request(sb, first_not_zeroed); + } + +- ext4_setup_system_zone(sb); ++ err = ext4_setup_system_zone(sb); ++ if (err) ++ goto restore_opts; ++ + if (sbi->s_journal == NULL && !(old_sb_flags & SB_RDONLY)) { + err = ext4_commit_super(sb, 1); + if (err) +-- +2.25.1 + diff --git a/queue-5.4/ext4-handle-option-set-by-mount-flags-correctly.patch b/queue-5.4/ext4-handle-option-set-by-mount-flags-correctly.patch new file mode 100644 index 00000000000..e3029d9cf30 --- /dev/null +++ b/queue-5.4/ext4-handle-option-set-by-mount-flags-correctly.patch @@ -0,0 +1,98 @@ +From f2b4d4507008ee8ba1ee0441031e3f06960b052d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 17:05:26 +0200 +Subject: ext4: handle option set by mount flags correctly + +From: Lukas Czerner + +[ Upstream commit f25391ebb475d3ffb3aa61bb90e3594c841749ef ] + +Currently there is a problem with mount options that can be both set by +vfs using mount flags or by a string parsing in ext4. + +i_version/iversion options gets lost after remount, for example + +$ mount -o i_version /dev/pmem0 /mnt +$ grep pmem0 /proc/self/mountinfo | grep i_version +310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,seclabel,i_version +$ mount -o remount,ro /mnt +$ grep pmem0 /proc/self/mountinfo | grep i_version + +nolazytime gets ignored by ext4 on remount, for example + +$ mount -o lazytime /dev/pmem0 /mnt +$ grep pmem0 /proc/self/mountinfo | grep lazytime +310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,lazytime,seclabel +$ mount -o remount,nolazytime /mnt +$ grep pmem0 /proc/self/mountinfo | grep lazytime +310 95 259:0 / /mnt rw,relatime shared:163 - ext4 /dev/pmem0 rw,lazytime,seclabel + +Fix it by applying the SB_LAZYTIME and SB_I_VERSION flags from *flags to +s_flags before we parse the option and use the resulting state of the +same flags in *flags at the end of successful remount. + +Signed-off-by: Lukas Czerner +Reviewed-by: Ritesh Harjani +Link: https://lore.kernel.org/r/20200723150526.19931-1-lczerner@redhat.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 21 ++++++++++++++++----- + 1 file changed, 16 insertions(+), 5 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 76c5529394395..92a6741c4bdd9 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5342,7 +5342,7 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + { + struct ext4_super_block *es; + struct ext4_sb_info *sbi = EXT4_SB(sb); +- unsigned long old_sb_flags; ++ unsigned long old_sb_flags, vfs_flags; + struct ext4_mount_options old_opts; + int enable_quota = 0; + ext4_group_t g; +@@ -5385,6 +5385,14 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + if (sbi->s_journal && sbi->s_journal->j_task->io_context) + journal_ioprio = sbi->s_journal->j_task->io_context->ioprio; + ++ /* ++ * Some options can be enabled by ext4 and/or by VFS mount flag ++ * either way we need to make sure it matches in both *flags and ++ * s_flags. Copy those selected flags from *flags to s_flags ++ */ ++ vfs_flags = SB_LAZYTIME | SB_I_VERSION; ++ sb->s_flags = (sb->s_flags & ~vfs_flags) | (*flags & vfs_flags); ++ + if (!parse_options(data, sb, NULL, &journal_ioprio, 1)) { + err = -EINVAL; + goto restore_opts; +@@ -5438,9 +5446,6 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + set_task_ioprio(sbi->s_journal->j_task, journal_ioprio); + } + +- if (*flags & SB_LAZYTIME) +- sb->s_flags |= SB_LAZYTIME; +- + if ((bool)(*flags & SB_RDONLY) != sb_rdonly(sb)) { + if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED) { + err = -EROFS; +@@ -5580,7 +5585,13 @@ static int ext4_remount(struct super_block *sb, int *flags, char *data) + } + #endif + +- *flags = (*flags & ~SB_LAZYTIME) | (sb->s_flags & SB_LAZYTIME); ++ /* ++ * Some options can be enabled by ext4 and/or by VFS mount flag ++ * either way we need to make sure it matches in both *flags and ++ * s_flags. Copy those selected flags from s_flags to *flags ++ */ ++ *flags = (*flags & ~vfs_flags) | (sb->s_flags & vfs_flags); ++ + ext4_msg(sb, KERN_INFO, "re-mounted. Opts: %s", orig_data); + kfree(orig_data); + return 0; +-- +2.25.1 + diff --git a/queue-5.4/ext4-handle-read-only-external-journal-device.patch b/queue-5.4/ext4-handle-read-only-external-journal-device.patch new file mode 100644 index 00000000000..19d4dece63f --- /dev/null +++ b/queue-5.4/ext4-handle-read-only-external-journal-device.patch @@ -0,0 +1,183 @@ +From 45562d8f7a7870ef813d81ea5854908b781b0290 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 11:06:05 +0200 +Subject: ext4: handle read only external journal device + +From: Lukas Czerner + +[ Upstream commit 273108fa5015eeffc4bacfa5ce272af3434b96e4 ] + +Ext4 uses blkdev_get_by_dev() to get the block_device for journal device +which does check to see if the read-only block device was opened +read-only. + +As a result ext4 will hapily proceed mounting the file system with +external journal on read-only device. This is bad as we would not be +able to use the journal leading to errors later on. + +Instead of simply failing to mount file system in this case, treat it in +a similar way we treat internal journal on read-only device. Allow to +mount with -o noload in read-only mode. + +This can be reproduced easily like this: + +mke2fs -F -O journal_dev $JOURNAL_DEV 100M +mkfs.$FSTYPE -F -J device=$JOURNAL_DEV $FS_DEV +blockdev --setro $JOURNAL_DEV +mount $FS_DEV $MNT +touch $MNT/file +umount $MNT + +leading to error like this + +[ 1307.318713] ------------[ cut here ]------------ +[ 1307.323362] generic_make_request: Trying to write to read-only block-device dm-2 (partno 0) +[ 1307.331741] WARNING: CPU: 36 PID: 3224 at block/blk-core.c:855 generic_make_request_checks+0x2c3/0x580 +[ 1307.341041] Modules linked in: ext4 mbcache jbd2 rfkill intel_rapl_msr intel_rapl_common isst_if_commd +[ 1307.419445] CPU: 36 PID: 3224 Comm: jbd2/dm-2 Tainted: G W I 5.8.0-rc5 #2 +[ 1307.427359] Hardware name: Dell Inc. PowerEdge R740/01KPX8, BIOS 2.3.10 08/15/2019 +[ 1307.434932] RIP: 0010:generic_make_request_checks+0x2c3/0x580 +[ 1307.440676] Code: 94 03 00 00 48 89 df 48 8d 74 24 08 c6 05 cf 2b 18 01 01 e8 7f a4 ff ff 48 c7 c7 50e +[ 1307.459420] RSP: 0018:ffffc0d70eb5fb48 EFLAGS: 00010286 +[ 1307.464646] RAX: 0000000000000000 RBX: ffff9b33b2978300 RCX: 0000000000000000 +[ 1307.471780] RDX: ffff9b33e12a81e0 RSI: ffff9b33e1298000 RDI: ffff9b33e1298000 +[ 1307.478913] RBP: ffff9b7b9679e0c0 R08: 0000000000000837 R09: 0000000000000024 +[ 1307.486044] R10: 0000000000000000 R11: ffffc0d70eb5f9f0 R12: 0000000000000400 +[ 1307.493177] R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000000 +[ 1307.500308] FS: 0000000000000000(0000) GS:ffff9b33e1280000(0000) knlGS:0000000000000000 +[ 1307.508396] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 1307.514142] CR2: 000055eaf4109000 CR3: 0000003dee40a006 CR4: 00000000007606e0 +[ 1307.521273] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 1307.528407] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 1307.535538] PKRU: 55555554 +[ 1307.538250] Call Trace: +[ 1307.540708] generic_make_request+0x30/0x340 +[ 1307.544985] submit_bio+0x43/0x190 +[ 1307.548393] ? bio_add_page+0x62/0x90 +[ 1307.552068] submit_bh_wbc+0x16a/0x190 +[ 1307.555833] jbd2_write_superblock+0xec/0x200 [jbd2] +[ 1307.560803] jbd2_journal_update_sb_log_tail+0x65/0xc0 [jbd2] +[ 1307.566557] jbd2_journal_commit_transaction+0x2ae/0x1860 [jbd2] +[ 1307.572566] ? check_preempt_curr+0x7a/0x90 +[ 1307.576756] ? update_curr+0xe1/0x1d0 +[ 1307.580421] ? account_entity_dequeue+0x7b/0xb0 +[ 1307.584955] ? newidle_balance+0x231/0x3d0 +[ 1307.589056] ? __switch_to_asm+0x42/0x70 +[ 1307.592986] ? __switch_to_asm+0x36/0x70 +[ 1307.596918] ? lock_timer_base+0x67/0x80 +[ 1307.600851] kjournald2+0xbd/0x270 [jbd2] +[ 1307.604873] ? finish_wait+0x80/0x80 +[ 1307.608460] ? commit_timeout+0x10/0x10 [jbd2] +[ 1307.612915] kthread+0x114/0x130 +[ 1307.616152] ? kthread_park+0x80/0x80 +[ 1307.619816] ret_from_fork+0x22/0x30 +[ 1307.623400] ---[ end trace 27490236265b1630 ]--- + +Signed-off-by: Lukas Czerner +Reviewed-by: Andreas Dilger +Link: https://lore.kernel.org/r/20200717090605.2612-1-lczerner@redhat.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/super.c | 51 ++++++++++++++++++++++++++++++++----------------- + 1 file changed, 33 insertions(+), 18 deletions(-) + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index bd4feafcff294..76c5529394395 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4943,6 +4943,7 @@ static int ext4_load_journal(struct super_block *sb, + dev_t journal_dev; + int err = 0; + int really_read_only; ++ int journal_dev_ro; + + if (WARN_ON_ONCE(!ext4_has_feature_journal(sb))) + return -EFSCORRUPTED; +@@ -4955,7 +4956,31 @@ static int ext4_load_journal(struct super_block *sb, + } else + journal_dev = new_decode_dev(le32_to_cpu(es->s_journal_dev)); + +- really_read_only = bdev_read_only(sb->s_bdev); ++ if (journal_inum && journal_dev) { ++ ext4_msg(sb, KERN_ERR, ++ "filesystem has both journal inode and journal device!"); ++ return -EINVAL; ++ } ++ ++ if (journal_inum) { ++ journal = ext4_get_journal(sb, journal_inum); ++ if (!journal) ++ return -EINVAL; ++ } else { ++ journal = ext4_get_dev_journal(sb, journal_dev); ++ if (!journal) ++ return -EINVAL; ++ } ++ ++ journal_dev_ro = bdev_read_only(journal->j_dev); ++ really_read_only = bdev_read_only(sb->s_bdev) | journal_dev_ro; ++ ++ if (journal_dev_ro && !sb_rdonly(sb)) { ++ ext4_msg(sb, KERN_ERR, ++ "journal device read-only, try mounting with '-o ro'"); ++ err = -EROFS; ++ goto err_out; ++ } + + /* + * Are we loading a blank journal or performing recovery after a +@@ -4970,27 +4995,14 @@ static int ext4_load_journal(struct super_block *sb, + ext4_msg(sb, KERN_ERR, "write access " + "unavailable, cannot proceed " + "(try mounting with noload)"); +- return -EROFS; ++ err = -EROFS; ++ goto err_out; + } + ext4_msg(sb, KERN_INFO, "write access will " + "be enabled during recovery"); + } + } + +- if (journal_inum && journal_dev) { +- ext4_msg(sb, KERN_ERR, "filesystem has both journal " +- "and inode journals!"); +- return -EINVAL; +- } +- +- if (journal_inum) { +- if (!(journal = ext4_get_journal(sb, journal_inum))) +- return -EINVAL; +- } else { +- if (!(journal = ext4_get_dev_journal(sb, journal_dev))) +- return -EINVAL; +- } +- + if (!(journal->j_flags & JBD2_BARRIER)) + ext4_msg(sb, KERN_INFO, "barriers disabled"); + +@@ -5010,8 +5022,7 @@ static int ext4_load_journal(struct super_block *sb, + + if (err) { + ext4_msg(sb, KERN_ERR, "error loading journal"); +- jbd2_journal_destroy(journal); +- return err; ++ goto err_out; + } + + EXT4_SB(sb)->s_journal = journal; +@@ -5031,6 +5042,10 @@ static int ext4_load_journal(struct super_block *sb, + } + + return 0; ++ ++err_out: ++ jbd2_journal_destroy(journal); ++ return err; + } + + static int ext4_commit_super(struct super_block *sb, int sync) +-- +2.25.1 + diff --git a/queue-5.4/fs-prevent-bug_on-in-submit_bh_wbc.patch b/queue-5.4/fs-prevent-bug_on-in-submit_bh_wbc.patch new file mode 100644 index 00000000000..eb1f1d64c86 --- /dev/null +++ b/queue-5.4/fs-prevent-bug_on-in-submit_bh_wbc.patch @@ -0,0 +1,131 @@ +From 7f8aa158c0084d07ae26df41ec8be1327582ca1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 12:10:25 -0400 +Subject: fs: prevent BUG_ON in submit_bh_wbc() + +From: Xianting Tian + +[ Upstream commit 377254b2cd2252c7c3151b113cbdf93a7736c2e9 ] + +If a device is hot-removed --- for example, when a physical device is +unplugged from pcie slot or a nbd device's network is shutdown --- +this can result in a BUG_ON() crash in submit_bh_wbc(). This is +because the when the block device dies, the buffer heads will have +their Buffer_Mapped flag get cleared, leading to the crash in +submit_bh_wbc. + +We had attempted to work around this problem in commit a17712c8 +("ext4: check superblock mapped prior to committing"). Unfortunately, +it's still possible to hit the BUG_ON(!buffer_mapped(bh)) if the +device dies between when the work-around check in ext4_commit_super() +and when submit_bh_wbh() is finally called: + +Code path: +ext4_commit_super + judge if 'buffer_mapped(sbh)' is false, return <== commit a17712c8 + lock_buffer(sbh) + ... + unlock_buffer(sbh) + __sync_dirty_buffer(sbh,... + lock_buffer(sbh) + judge if 'buffer_mapped(sbh))' is false, return <== added by this patch + submit_bh(...,sbh) + submit_bh_wbc(...,sbh,...) + +[100722.966497] kernel BUG at fs/buffer.c:3095! <== BUG_ON(!buffer_mapped(bh))' in submit_bh_wbc() +[100722.966503] invalid opcode: 0000 [#1] SMP +[100722.966566] task: ffff8817e15a9e40 task.stack: ffffc90024744000 +[100722.966574] RIP: 0010:submit_bh_wbc+0x180/0x190 +[100722.966575] RSP: 0018:ffffc90024747a90 EFLAGS: 00010246 +[100722.966576] RAX: 0000000000620005 RBX: ffff8818a80603a8 RCX: 0000000000000000 +[100722.966576] RDX: ffff8818a80603a8 RSI: 0000000000020800 RDI: 0000000000000001 +[100722.966577] RBP: ffffc90024747ac0 R08: 0000000000000000 R09: ffff88207f94170d +[100722.966578] R10: 00000000000437c8 R11: 0000000000000001 R12: 0000000000020800 +[100722.966578] R13: 0000000000000001 R14: 000000000bf9a438 R15: ffff88195f333000 +[100722.966580] FS: 00007fa2eee27700(0000) GS:ffff88203d840000(0000) knlGS:0000000000000000 +[100722.966580] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[100722.966581] CR2: 0000000000f0b008 CR3: 000000201a622003 CR4: 00000000007606e0 +[100722.966582] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[100722.966583] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[100722.966583] PKRU: 55555554 +[100722.966583] Call Trace: +[100722.966588] __sync_dirty_buffer+0x6e/0xd0 +[100722.966614] ext4_commit_super+0x1d8/0x290 [ext4] +[100722.966626] __ext4_std_error+0x78/0x100 [ext4] +[100722.966635] ? __ext4_journal_get_write_access+0xca/0x120 [ext4] +[100722.966646] ext4_reserve_inode_write+0x58/0xb0 [ext4] +[100722.966655] ? ext4_dirty_inode+0x48/0x70 [ext4] +[100722.966663] ext4_mark_inode_dirty+0x53/0x1e0 [ext4] +[100722.966671] ? __ext4_journal_start_sb+0x6d/0xf0 [ext4] +[100722.966679] ext4_dirty_inode+0x48/0x70 [ext4] +[100722.966682] __mark_inode_dirty+0x17f/0x350 +[100722.966686] generic_update_time+0x87/0xd0 +[100722.966687] touch_atime+0xa9/0xd0 +[100722.966690] generic_file_read_iter+0xa09/0xcd0 +[100722.966694] ? page_cache_tree_insert+0xb0/0xb0 +[100722.966704] ext4_file_read_iter+0x4a/0x100 [ext4] +[100722.966707] ? __inode_security_revalidate+0x4f/0x60 +[100722.966709] __vfs_read+0xec/0x160 +[100722.966711] vfs_read+0x8c/0x130 +[100722.966712] SyS_pread64+0x87/0xb0 +[100722.966716] do_syscall_64+0x67/0x1b0 +[100722.966719] entry_SYSCALL64_slow_path+0x25/0x25 + +To address this, add the check of 'buffer_mapped(bh)' to +__sync_dirty_buffer(). This also has the benefit of fixing this for +other file systems. + +With this addition, we can drop the workaround in ext4_commit_supper(). + +[ Commit description rewritten by tytso. ] + +Signed-off-by: Xianting Tian +Link: https://lore.kernel.org/r/1596211825-8750-1-git-send-email-xianting_tian@126.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/buffer.c | 9 +++++++++ + fs/ext4/super.c | 7 ------- + 2 files changed, 9 insertions(+), 7 deletions(-) + +diff --git a/fs/buffer.c b/fs/buffer.c +index 79c9562434a8d..22d8ac4a8c40a 100644 +--- a/fs/buffer.c ++++ b/fs/buffer.c +@@ -3170,6 +3170,15 @@ int __sync_dirty_buffer(struct buffer_head *bh, int op_flags) + WARN_ON(atomic_read(&bh->b_count) < 1); + lock_buffer(bh); + if (test_clear_buffer_dirty(bh)) { ++ /* ++ * The bh should be mapped, but it might not be if the ++ * device was hot-removed. Not much we can do but fail the I/O. ++ */ ++ if (!buffer_mapped(bh)) { ++ unlock_buffer(bh); ++ return -EIO; ++ } ++ + get_bh(bh); + bh->b_end_io = end_buffer_write_sync; + ret = submit_bh(REQ_OP_WRITE, op_flags, bh); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 184f2d737efc9..4aae7e3e89a12 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5059,13 +5059,6 @@ static int ext4_commit_super(struct super_block *sb, int sync) + if (!sbh || block_device_ejected(sb)) + return error; + +- /* +- * The superblock bh should be mapped, but it might not be if the +- * device was hot-removed. Not much we can do but fail the I/O. +- */ +- if (!buffer_mapped(sbh)) +- return error; +- + /* + * If the file system is mounted read-only, don't update the + * superblock write time. This avoids updating the superblock +-- +2.25.1 + diff --git a/queue-5.4/hwmon-nct7904-correct-divide-by-0.patch b/queue-5.4/hwmon-nct7904-correct-divide-by-0.patch new file mode 100644 index 00000000000..2c3a9c8ca0a --- /dev/null +++ b/queue-5.4/hwmon-nct7904-correct-divide-by-0.patch @@ -0,0 +1,63 @@ +From 77b53c9126679d6e597bfcae2fca571b674190a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 12:20:14 -0400 +Subject: hwmon: (nct7904) Correct divide by 0 + +From: Jason Baron + +[ Upstream commit 8aebbbb2d573d0b4afc08b90ac7d73dba2d9da97 ] + +We hit a kernel panic due to a divide by 0 in nct7904_read_fan() for +the hwmon_fan_min case. Extend the check to hwmon_fan_input case as well +for safety. + +[ 1656.545650] divide error: 0000 [#1] SMP PTI +[ 1656.545779] CPU: 12 PID: 18010 Comm: sensors Not tainted 5.4.47 #1 +[ 1656.546065] RIP: 0010:nct7904_read+0x1e9/0x510 [nct7904] +... +[ 1656.546549] RAX: 0000000000149970 RBX: ffffbd6b86bcbe08 RCX: 0000000000000000 +... +[ 1656.547548] Call Trace: +[ 1656.547665] hwmon_attr_show+0x32/0xd0 [hwmon] +[ 1656.547783] dev_attr_show+0x18/0x50 +[ 1656.547898] sysfs_kf_seq_show+0x99/0x120 +[ 1656.548013] seq_read+0xd8/0x3e0 +[ 1656.548127] vfs_read+0x89/0x130 +[ 1656.548234] ksys_read+0x7d/0xb0 +[ 1656.548342] do_syscall_64+0x48/0x110 +[ 1656.548451] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: d65a5102a99f5 ("hwmon: (nct7904) Convert to use new hwmon registration API") +Signed-off-by: Jason Baron +Link: https://lore.kernel.org/r/1598026814-2604-1-git-send-email-jbaron@akamai.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/nct7904.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwmon/nct7904.c b/drivers/hwmon/nct7904.c +index dfb122b5e1b76..b812b199e5e5b 100644 +--- a/drivers/hwmon/nct7904.c ++++ b/drivers/hwmon/nct7904.c +@@ -197,7 +197,7 @@ static int nct7904_read_fan(struct device *dev, u32 attr, int channel, + if (ret < 0) + return ret; + cnt = ((ret & 0xff00) >> 3) | (ret & 0x1f); +- if (cnt == 0x1fff) ++ if (cnt == 0 || cnt == 0x1fff) + rpm = 0; + else + rpm = 1350000 / cnt; +@@ -209,7 +209,7 @@ static int nct7904_read_fan(struct device *dev, u32 attr, int channel, + if (ret < 0) + return ret; + cnt = ((ret & 0xff00) >> 3) | (ret & 0x1f); +- if (cnt == 0x1fff) ++ if (cnt == 0 || cnt == 0x1fff) + rpm = 0; + else + rpm = 1350000 / cnt; +-- +2.25.1 + diff --git a/queue-5.4/i2c-core-don-t-fail-prp0001-enumeration-when-no-id-t.patch b/queue-5.4/i2c-core-don-t-fail-prp0001-enumeration-when-no-id-t.patch new file mode 100644 index 00000000000..f8a4f19e2ef --- /dev/null +++ b/queue-5.4/i2c-core-don-t-fail-prp0001-enumeration-when-no-id-t.patch @@ -0,0 +1,47 @@ +From 113fa83c1d7aff50613babbd78c8cd9c24114b08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 20:03:33 +0300 +Subject: i2c: core: Don't fail PRP0001 enumeration when no ID table exist +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andy Shevchenko + +[ Upstream commit e3cb82c6d6f6c27ab754e13ae29bdd6b949982e2 ] + +When commit c64ffff7a9d1 ("i2c: core: Allow empty id_table in ACPI case +as well") fixed the enumeration of I²C devices on ACPI enabled platforms +when driver has no ID table, it missed the PRP0001 support. + +i2c_device_match() and i2c_acpi_match_device() differently match +driver against given device. Use acpi_driver_match_device(), that is used +in the former, in i2c_device_probe() and don't fail PRP0001 enumeration +when no ID table exist. + +Fixes: c64ffff7a9d1 ("i2c: core: Allow empty id_table in ACPI case as well") +BugLink: https://stackoverflow.com/q/63519678/2511795 +Signed-off-by: Andy Shevchenko +Reviewed-by: Mika Westerberg +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index cc193f2ba5d37..def62d5b42ca7 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -354,7 +354,7 @@ static int i2c_device_probe(struct device *dev) + * or ACPI ID table is supplied for the probing device. + */ + if (!driver->id_table && +- !i2c_acpi_match_device(dev->driver->acpi_match_table, client) && ++ !acpi_driver_match_device(dev, dev->driver) && + !i2c_of_match_device(dev->driver->of_match_table, client)) { + status = -ENODEV; + goto put_sync_adapter; +-- +2.25.1 + diff --git a/queue-5.4/i2c-rcar-in-slave-mode-clear-nack-earlier.patch b/queue-5.4/i2c-rcar-in-slave-mode-clear-nack-earlier.patch new file mode 100644 index 00000000000..66e6937a973 --- /dev/null +++ b/queue-5.4/i2c-rcar-in-slave-mode-clear-nack-earlier.patch @@ -0,0 +1,38 @@ +From a4fb1dd4197fe5d6efbddd340849fe310dd8e37f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 14:19:30 +0200 +Subject: i2c: rcar: in slave mode, clear NACK earlier + +From: Wolfram Sang + +[ Upstream commit 914a7b3563b8fb92f976619bbd0fa3a4a708baae ] + +Currently, a NACK in slave mode is set/cleared when SCL is held low by +the IP core right before the bit is about to be pushed out. This is too +late for clearing and then a NACK from the previous byte is still used +for the current one. Now, let's clear the NACK right after we detected +the STOP condition following the NACK. + +Fixes: de20d1857dd6 ("i2c: rcar: add slave support") +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 0b90aa0318df3..9c162a01a5849 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -587,6 +587,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + /* master sent stop */ + if (ssr_filtered & SSR) { + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); ++ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */ + rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); + } +-- +2.25.1 + diff --git a/queue-5.4/jbd2-abort-journal-if-free-a-async-write-error-metad.patch b/queue-5.4/jbd2-abort-journal-if-free-a-async-write-error-metad.patch new file mode 100644 index 00000000000..5ede76d692f --- /dev/null +++ b/queue-5.4/jbd2-abort-journal-if-free-a-async-write-error-metad.patch @@ -0,0 +1,66 @@ +From ab4acf9e0886f638ef16fcc9df41fddc237c3e16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 20 Jun 2020 10:54:26 +0800 +Subject: jbd2: abort journal if free a async write error metadata buffer + +From: zhangyi (F) + +[ Upstream commit c044f3d8360d2ecf831ba2cc9f08cf9fb2c699fb ] + +If we free a metadata buffer which has been failed to async write out +in the background, the jbd2 checkpoint procedure will not detect this +failure in jbd2_log_do_checkpoint(), so it may lead to filesystem +inconsistency after cleanup journal tail. This patch abort the journal +if free a buffer has write_io_error flag to prevent potential further +inconsistency. + +Signed-off-by: zhangyi (F) +Link: https://lore.kernel.org/r/20200620025427.1756360-5-yi.zhang@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/transaction.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index 0b663269771d4..90453309345d5 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -2077,6 +2077,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, + { + struct buffer_head *head; + struct buffer_head *bh; ++ bool has_write_io_error = false; + int ret = 0; + + J_ASSERT(PageLocked(page)); +@@ -2101,11 +2102,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal, + jbd_unlock_bh_state(bh); + if (buffer_jbd(bh)) + goto busy; ++ ++ /* ++ * If we free a metadata buffer which has been failed to ++ * write out, the jbd2 checkpoint procedure will not detect ++ * this failure and may lead to filesystem inconsistency ++ * after cleanup journal tail. ++ */ ++ if (buffer_write_io_error(bh)) { ++ pr_err("JBD2: Error while async write back metadata bh %llu.", ++ (unsigned long long)bh->b_blocknr); ++ has_write_io_error = true; ++ } + } while ((bh = bh->b_this_page) != head); + + ret = try_to_free_buffers(page); + + busy: ++ if (has_write_io_error) ++ jbd2_journal_abort(journal, -EIO); ++ + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.4/jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch b/queue-5.4/jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch new file mode 100644 index 00000000000..32b7aaba77b --- /dev/null +++ b/queue-5.4/jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch @@ -0,0 +1,62 @@ +From 559aee5e4f85f643342be8de2d696e76c0732a36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 11:25:49 +0200 +Subject: jbd2: make sure jh have b_transaction set in refile/unfile_buffer + +From: Lukas Czerner + +[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ] + +Callers of __jbd2_journal_unfile_buffer() and +__jbd2_journal_refile_buffer() assume that the b_transaction is set. In +fact if it's not, we can end up with journal_head refcounting errors +leading to crash much later that might be very hard to track down. Add +asserts to make sure that is the case. + +We also make sure that b_next_transaction is NULL in +__jbd2_journal_unfile_buffer() since the callers expect that as well and +we should not get into that stage in this state anyway, leading to +problems later on if we do. + +Tested with fstests. + +Signed-off-by: Lukas Czerner +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/jbd2/transaction.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index de992a70ddfef..0b663269771d4 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1983,6 +1983,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh) + */ + static void __jbd2_journal_unfile_buffer(struct journal_head *jh) + { ++ J_ASSERT_JH(jh, jh->b_transaction != NULL); ++ J_ASSERT_JH(jh, jh->b_next_transaction == NULL); ++ + __jbd2_journal_temp_unlink_buffer(jh); + jh->b_transaction = NULL; + jbd2_journal_put_journal_head(jh); +@@ -2530,6 +2533,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh) + + was_dirty = test_clear_buffer_jbddirty(bh); + __jbd2_journal_temp_unlink_buffer(jh); ++ ++ /* ++ * b_transaction must be set, otherwise the new b_transaction won't ++ * be holding jh reference ++ */ ++ J_ASSERT_JH(jh, jh->b_transaction != NULL); ++ + /* + * We set b_transaction here because b_next_transaction will inherit + * our jh reference and thus __jbd2_journal_file_buffer() must not +-- +2.25.1 + diff --git a/queue-5.4/libbpf-handle-gcc-built-in-types-for-arm-neon.patch b/queue-5.4/libbpf-handle-gcc-built-in-types-for-arm-neon.patch new file mode 100644 index 00000000000..8673a4ddc2d --- /dev/null +++ b/queue-5.4/libbpf-handle-gcc-built-in-types-for-arm-neon.patch @@ -0,0 +1,115 @@ +From f0b0bdbf7045ed59d5ec03fbbbfb64a7be5dab1c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Aug 2020 16:39:10 +0200 +Subject: libbpf: Handle GCC built-in types for Arm NEON + +From: Jean-Philippe Brucker + +[ Upstream commit 702eddc77a905782083b14ccd05b23840675fd18 ] + +When building Arm NEON (SIMD) code from lib/raid6/neon.uc, GCC emits +DWARF information using a base type "__Poly8_t", which is internal to +GCC and not recognized by Clang. This causes build failures when +building with Clang a vmlinux.h generated from an arm64 kernel that was +built with GCC. + + vmlinux.h:47284:9: error: unknown type name '__Poly8_t' + typedef __Poly8_t poly8x16_t[16]; + ^~~~~~~~~ + +The polyX_t types are defined as unsigned integers in the "Arm C +Language Extension" document (101028_Q220_00_en). Emit typedefs based on +standard integer types for the GCC internal types, similar to those +emitted by Clang. + +Including linux/kernel.h to use ARRAY_SIZE() incidentally redefined +max(), causing a build bug due to different types, hence the seemingly +unrelated change. + +Reported-by: Jakov Petrina +Signed-off-by: Jean-Philippe Brucker +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20200812143909.3293280-1-jean-philippe@linaro.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf_dump.c | 35 ++++++++++++++++++++++++++++++++++- + 1 file changed, 34 insertions(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index d9e386b8f47ed..07fcc8e79662d 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include "btf.h" + #include "hashmap.h" + #include "libbpf.h" +@@ -543,6 +544,9 @@ static int btf_dump_order_type(struct btf_dump *d, __u32 id, bool through_ptr) + } + } + ++static void btf_dump_emit_missing_aliases(struct btf_dump *d, __u32 id, ++ const struct btf_type *t); ++ + static void btf_dump_emit_struct_fwd(struct btf_dump *d, __u32 id, + const struct btf_type *t); + static void btf_dump_emit_struct_def(struct btf_dump *d, __u32 id, +@@ -665,6 +669,9 @@ static void btf_dump_emit_type(struct btf_dump *d, __u32 id, __u32 cont_id) + + switch (kind) { + case BTF_KIND_INT: ++ /* Emit type alias definitions if necessary */ ++ btf_dump_emit_missing_aliases(d, id, t); ++ + tstate->emit_state = EMITTED; + break; + case BTF_KIND_ENUM: +@@ -899,7 +906,7 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + btf_dump_printf(d, ": %d", m_sz); + off = m_off + m_sz; + } else { +- m_sz = max(0, btf__resolve_size(d->btf, m->type)); ++ m_sz = max(0LL, btf__resolve_size(d->btf, m->type)); + off = m_off + m_sz * 8; + } + btf_dump_printf(d, ";"); +@@ -919,6 +926,32 @@ static void btf_dump_emit_struct_def(struct btf_dump *d, + btf_dump_printf(d, " __attribute__((packed))"); + } + ++static const char *missing_base_types[][2] = { ++ /* ++ * GCC emits typedefs to its internal __PolyX_t types when compiling Arm ++ * SIMD intrinsics. Alias them to standard base types. ++ */ ++ { "__Poly8_t", "unsigned char" }, ++ { "__Poly16_t", "unsigned short" }, ++ { "__Poly64_t", "unsigned long long" }, ++ { "__Poly128_t", "unsigned __int128" }, ++}; ++ ++static void btf_dump_emit_missing_aliases(struct btf_dump *d, __u32 id, ++ const struct btf_type *t) ++{ ++ const char *name = btf_dump_type_name(d, id); ++ int i; ++ ++ for (i = 0; i < ARRAY_SIZE(missing_base_types); i++) { ++ if (strcmp(name, missing_base_types[i][0]) == 0) { ++ btf_dump_printf(d, "typedef %s %s;\n\n", ++ missing_base_types[i][1], name); ++ break; ++ } ++ } ++} ++ + static void btf_dump_emit_enum_fwd(struct btf_dump *d, __u32 id, + const struct btf_type *t) + { +-- +2.25.1 + diff --git a/queue-5.4/macvlan-validate-setting-of-multiple-remote-source-m.patch b/queue-5.4/macvlan-validate-setting-of-multiple-remote-source-m.patch new file mode 100644 index 00000000000..6dc9d4746f9 --- /dev/null +++ b/queue-5.4/macvlan-validate-setting-of-multiple-remote-source-m.patch @@ -0,0 +1,91 @@ +From bfac317199c67e19c487f932b65dfbfb176516bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 10:51:34 +0200 +Subject: macvlan: validate setting of multiple remote source MAC addresses +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alvin Šipraga + +[ Upstream commit 8b61fba503904acae24aeb2bd5569b4d6544d48f ] + +Remote source MAC addresses can be set on a 'source mode' macvlan +interface via the IFLA_MACVLAN_MACADDR_DATA attribute. This commit +tightens the validation of these MAC addresses to match the validation +already performed when setting or adding a single MAC address via the +IFLA_MACVLAN_MACADDR attribute. + +iproute2 uses IFLA_MACVLAN_MACADDR_DATA for its 'macvlan macaddr set' +command, and IFLA_MACVLAN_MACADDR for its 'macvlan macaddr add' command, +which demonstrates the inconsistent behaviour that this commit +addresses: + + # ip link add link eth0 name macvlan0 type macvlan mode source + # ip link set link dev macvlan0 type macvlan macaddr add 01:00:00:00:00:00 + RTNETLINK answers: Cannot assign requested address + # ip link set link dev macvlan0 type macvlan macaddr set 01:00:00:00:00:00 + # ip -d link show macvlan0 + 5: macvlan0@eth0: mtu 1500 ... + link/ether 2e:ac:fd:2d:69:f8 brd ff:ff:ff:ff:ff:ff promiscuity 0 + macvlan mode source remotes (1) 01:00:00:00:00:00 numtxqueues 1 ... + +With this change, the 'set' command will (rightly) fail in the same way +as the 'add' command. + +Signed-off-by: Alvin Šipraga +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/macvlan.c | 21 +++++++++++++++++---- + 1 file changed, 17 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 9d3209ae41cfb..07622cf8765ae 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1259,6 +1259,9 @@ static void macvlan_port_destroy(struct net_device *dev) + static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[], + struct netlink_ext_ack *extack) + { ++ struct nlattr *nla, *head; ++ int rem, len; ++ + if (tb[IFLA_ADDRESS]) { + if (nla_len(tb[IFLA_ADDRESS]) != ETH_ALEN) + return -EINVAL; +@@ -1306,6 +1309,20 @@ static int macvlan_validate(struct nlattr *tb[], struct nlattr *data[], + return -EADDRNOTAVAIL; + } + ++ if (data[IFLA_MACVLAN_MACADDR_DATA]) { ++ head = nla_data(data[IFLA_MACVLAN_MACADDR_DATA]); ++ len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]); ++ ++ nla_for_each_attr(nla, head, len, rem) { ++ if (nla_type(nla) != IFLA_MACVLAN_MACADDR || ++ nla_len(nla) != ETH_ALEN) ++ return -EINVAL; ++ ++ if (!is_valid_ether_addr(nla_data(nla))) ++ return -EADDRNOTAVAIL; ++ } ++ } ++ + if (data[IFLA_MACVLAN_MACADDR_COUNT]) + return -EINVAL; + +@@ -1362,10 +1379,6 @@ static int macvlan_changelink_sources(struct macvlan_dev *vlan, u32 mode, + len = nla_len(data[IFLA_MACVLAN_MACADDR_DATA]); + + nla_for_each_attr(nla, head, len, rem) { +- if (nla_type(nla) != IFLA_MACVLAN_MACADDR || +- nla_len(nla) != ETH_ALEN) +- continue; +- + addr = nla_data(nla); + ret = macvlan_hash_add_source(vlan, addr); + if (ret) +-- +2.25.1 + diff --git a/queue-5.4/media-gpio-ir-tx-improve-precision-of-transmitted-si.patch b/queue-5.4/media-gpio-ir-tx-improve-precision-of-transmitted-si.patch new file mode 100644 index 00000000000..a2836e5580f --- /dev/null +++ b/queue-5.4/media-gpio-ir-tx-improve-precision-of-transmitted-si.patch @@ -0,0 +1,43 @@ +From aa5a656341bd223b8a31c7006e694e62f15f1677 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 May 2020 14:50:52 +0200 +Subject: media: gpio-ir-tx: improve precision of transmitted signal due to + scheduling + +From: Sean Young + +[ Upstream commit ea8912b788f8144e7d32ee61e5ccba45424bef83 ] + +usleep_range() may take longer than the max argument due to scheduling, +especially under load. This is causing random errors in the transmitted +IR. Remove the usleep_range() in favour of busy-looping with udelay(). + +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/gpio-ir-tx.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/media/rc/gpio-ir-tx.c b/drivers/media/rc/gpio-ir-tx.c +index 18ca12d78314c..66703989ae185 100644 +--- a/drivers/media/rc/gpio-ir-tx.c ++++ b/drivers/media/rc/gpio-ir-tx.c +@@ -79,13 +79,8 @@ static int gpio_ir_tx(struct rc_dev *dev, unsigned int *txbuf, + // space + edge = ktime_add_us(edge, txbuf[i]); + delta = ktime_us_delta(edge, ktime_get()); +- if (delta > 10) { +- spin_unlock_irqrestore(&gpio_ir->lock, flags); +- usleep_range(delta, delta + 10); +- spin_lock_irqsave(&gpio_ir->lock, flags); +- } else if (delta > 0) { ++ if (delta > 0) + udelay(delta); +- } + } else { + // pulse + ktime_t last = ktime_add_us(edge, txbuf[i]); +-- +2.25.1 + diff --git a/queue-5.4/net-gianfar-add-of_node_put-before-goto-statement.patch b/queue-5.4/net-gianfar-add-of_node_put-before-goto-statement.patch new file mode 100644 index 00000000000..73a04b458ed --- /dev/null +++ b/queue-5.4/net-gianfar-add-of_node_put-before-goto-statement.patch @@ -0,0 +1,46 @@ +From b5e99040178a30393cd0a4117b300f1f69d5f01b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 00:22:41 +0530 +Subject: net: gianfar: Add of_node_put() before goto statement + +From: Sumera Priyadarsini + +[ Upstream commit 989e4da042ca4a56bbaca9223d1a93639ad11e17 ] + +Every iteration of for_each_available_child_of_node() decrements +reference count of the previous node, however when control +is transferred from the middle of the loop, as in the case of +a return or break or goto, there is no decrement thus ultimately +resulting in a memory leak. + +Fix a potential memory leak in gianfar.c by inserting of_node_put() +before the goto statement. + +Issue found with Coccinelle. + +Signed-off-by: Sumera Priyadarsini +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/gianfar.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index 2580bcd850253..3978d82c95989 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -751,8 +751,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev) + continue; + + err = gfar_parse_group(child, priv, model); +- if (err) ++ if (err) { ++ of_node_put(child); + goto err_grp_init; ++ } + } + } else { /* SQ_SG_MODE */ + err = gfar_parse_group(np, priv, model); +-- +2.25.1 + diff --git a/queue-5.4/netfilter-avoid-ipv6-nf_defrag_ipv6-module-dependenc.patch b/queue-5.4/netfilter-avoid-ipv6-nf_defrag_ipv6-module-dependenc.patch new file mode 100644 index 00000000000..5ad761acdcb --- /dev/null +++ b/queue-5.4/netfilter-avoid-ipv6-nf_defrag_ipv6-module-dependenc.patch @@ -0,0 +1,119 @@ +From e63ed6db099beb05cbf4657097dc7b0177933b89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 13:52:15 +0200 +Subject: netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency + +From: Florian Westphal + +[ Upstream commit 2404b73c3f1a5f15726c6ecd226b56f6f992767f ] + +nf_ct_frag6_gather is part of nf_defrag_ipv6.ko, not ipv6 core. + +The current use of the netfilter ipv6 stub indirections causes a module +dependency between ipv6 and nf_defrag_ipv6. + +This prevents nf_defrag_ipv6 module from being removed because ipv6 can't +be unloaded. + +Remove the indirection and always use a direct call. This creates a +depency from nf_conntrack_bridge to nf_defrag_ipv6 instead: + +modinfo nf_conntrack +depends: nf_conntrack,nf_defrag_ipv6,bridge + +.. and nf_conntrack already depends on nf_defrag_ipv6 anyway. + +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/linux/netfilter_ipv6.h | 18 ------------------ + net/bridge/netfilter/nf_conntrack_bridge.c | 8 ++++++-- + net/ipv6/netfilter.c | 3 --- + 3 files changed, 6 insertions(+), 23 deletions(-) + +diff --git a/include/linux/netfilter_ipv6.h b/include/linux/netfilter_ipv6.h +index aac42c28fe62d..9b67394471e1c 100644 +--- a/include/linux/netfilter_ipv6.h ++++ b/include/linux/netfilter_ipv6.h +@@ -58,7 +58,6 @@ struct nf_ipv6_ops { + int (*output)(struct net *, struct sock *, struct sk_buff *)); + int (*reroute)(struct sk_buff *skb, const struct nf_queue_entry *entry); + #if IS_MODULE(CONFIG_IPV6) +- int (*br_defrag)(struct net *net, struct sk_buff *skb, u32 user); + int (*br_fragment)(struct net *net, struct sock *sk, + struct sk_buff *skb, + struct nf_bridge_frag_data *data, +@@ -117,23 +116,6 @@ static inline int nf_ip6_route(struct net *net, struct dst_entry **dst, + + #include + +-static inline int nf_ipv6_br_defrag(struct net *net, struct sk_buff *skb, +- u32 user) +-{ +-#if IS_MODULE(CONFIG_IPV6) +- const struct nf_ipv6_ops *v6_ops = nf_get_ipv6_ops(); +- +- if (!v6_ops) +- return 1; +- +- return v6_ops->br_defrag(net, skb, user); +-#elif IS_BUILTIN(CONFIG_IPV6) +- return nf_ct_frag6_gather(net, skb, user); +-#else +- return 1; +-#endif +-} +- + int br_ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, + struct nf_bridge_frag_data *data, + int (*output)(struct net *, struct sock *sk, +diff --git a/net/bridge/netfilter/nf_conntrack_bridge.c b/net/bridge/netfilter/nf_conntrack_bridge.c +index 8096732223828..8d033a75a766e 100644 +--- a/net/bridge/netfilter/nf_conntrack_bridge.c ++++ b/net/bridge/netfilter/nf_conntrack_bridge.c +@@ -168,6 +168,7 @@ static unsigned int nf_ct_br_defrag4(struct sk_buff *skb, + static unsigned int nf_ct_br_defrag6(struct sk_buff *skb, + const struct nf_hook_state *state) + { ++#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) + u16 zone_id = NF_CT_DEFAULT_ZONE_ID; + enum ip_conntrack_info ctinfo; + struct br_input_skb_cb cb; +@@ -180,14 +181,17 @@ static unsigned int nf_ct_br_defrag6(struct sk_buff *skb, + + br_skb_cb_save(skb, &cb, sizeof(struct inet6_skb_parm)); + +- err = nf_ipv6_br_defrag(state->net, skb, +- IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id); ++ err = nf_ct_frag6_gather(state->net, skb, ++ IP_DEFRAG_CONNTRACK_BRIDGE_IN + zone_id); + /* queued */ + if (err == -EINPROGRESS) + return NF_STOLEN; + + br_skb_cb_restore(skb, &cb, IP6CB(skb)->frag_max_size); + return err == 0 ? NF_ACCEPT : NF_DROP; ++#else ++ return NF_ACCEPT; ++#endif + } + + static int nf_ct_br_ip_check(const struct sk_buff *skb) +diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c +index 409e79b84a830..6d0e942d082d4 100644 +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -245,9 +245,6 @@ static const struct nf_ipv6_ops ipv6ops = { + .route_input = ip6_route_input, + .fragment = ip6_fragment, + .reroute = nf_ip6_reroute, +-#if IS_MODULE(CONFIG_IPV6) && IS_ENABLED(CONFIG_NF_DEFRAG_IPV6) +- .br_defrag = nf_ct_frag6_gather, +-#endif + #if IS_MODULE(CONFIG_IPV6) + .br_fragment = br_ip6_fragment, + #endif +-- +2.25.1 + diff --git a/queue-5.4/null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch b/queue-5.4/null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch new file mode 100644 index 00000000000..e2d053f2903 --- /dev/null +++ b/queue-5.4/null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch @@ -0,0 +1,35 @@ +From 27f8337369e4d96a71822758554e435510740c2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 04:34:42 -0400 +Subject: null_blk: fix passing of REQ_FUA flag in null_handle_rq + +From: Hou Pu + +[ Upstream commit 2d62e6b038e729c3e4bfbfcfbd44800ef0883680 ] + +REQ_FUA should be checked using rq->cmd_flags instead of req_op(). + +Fixes: deb78b419dfda ("nullb: emulate cache") +Signed-off-by: Hou Pu +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/null_blk_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/block/null_blk_main.c b/drivers/block/null_blk_main.c +index c4454cfc6d530..13eae973eaea4 100644 +--- a/drivers/block/null_blk_main.c ++++ b/drivers/block/null_blk_main.c +@@ -1072,7 +1072,7 @@ static int null_handle_rq(struct nullb_cmd *cmd) + len = bvec.bv_len; + err = null_transfer(nullb, bvec.bv_page, len, bvec.bv_offset, + op_is_write(req_op(rq)), sector, +- req_op(rq) & REQ_FUA); ++ rq->cmd_flags & REQ_FUA); + if (err) { + spin_unlock_irq(&nullb->lock); + return err; +-- +2.25.1 + diff --git a/queue-5.4/nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch b/queue-5.4/nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch new file mode 100644 index 00000000000..a980d8cc568 --- /dev/null +++ b/queue-5.4/nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch @@ -0,0 +1,49 @@ +From 4d6213db109a60825dcd712626f391cdf7db5e0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 19:15:45 +0800 +Subject: nvme-fc: Fix wrong return value in __nvme_fc_init_request() + +From: Tianjia Zhang + +[ Upstream commit f34448cd0dc697723fb5f4118f8431d9233b370d ] + +On an error exit path, a negative error code should be returned +instead of a positive return value. + +Fixes: e399441de9115 ("nvme-fabrics: Add host support for FC transport") +Cc: James Smart +Signed-off-by: Tianjia Zhang +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Christoph Hellwig +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 83ac88924f253..dce4d6782ceb1 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -1740,7 +1740,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, + if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.cmddma)) { + dev_err(ctrl->dev, + "FCP Op failed - cmdiu dma mapping failed.\n"); +- ret = EFAULT; ++ ret = -EFAULT; + goto out_on_error; + } + +@@ -1750,7 +1750,7 @@ __nvme_fc_init_request(struct nvme_fc_ctrl *ctrl, + if (fc_dma_mapping_error(ctrl->lport->dev, op->fcp_req.rspdma)) { + dev_err(ctrl->dev, + "FCP Op failed - rspiu dma mapping failed.\n"); +- ret = EFAULT; ++ ret = -EFAULT; + } + + atomic_set(&op->state, FCPOP_STATE_IDLE); +-- +2.25.1 + diff --git a/queue-5.4/nvme-multipath-round-robin-fix-single-non-optimized-.patch b/queue-5.4/nvme-multipath-round-robin-fix-single-non-optimized-.patch new file mode 100644 index 00000000000..75d858a313a --- /dev/null +++ b/queue-5.4/nvme-multipath-round-robin-fix-single-non-optimized-.patch @@ -0,0 +1,55 @@ +From f1b0114504b2ad8e5261a7ddbee1f0a61caf2a91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 15:19:31 +0200 +Subject: nvme: multipath: round-robin: fix single non-optimized path case + +From: Martin Wilck + +[ Upstream commit 93eb0381e13d249a18ed4aae203291ff977e7ffb ] + +If there's only one usable, non-optimized path, nvme_round_robin_path() +returns NULL, which is wrong. Fix it by falling back to "old", like in +the single optimized path case. Also, if the active path isn't changed, +there's no need to re-assign the pointer. + +Fixes: 3f6e3246db0e ("nvme-multipath: fix logic for non-optimized paths") +Signed-off-by: Martin Wilck +Signed-off-by: Martin George +Reviewed-by: Keith Busch +Signed-off-by: Sagi Grimberg +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/multipath.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c +index 484aad0d0c9c6..0a458f7880887 100644 +--- a/drivers/nvme/host/multipath.c ++++ b/drivers/nvme/host/multipath.c +@@ -249,12 +249,17 @@ static struct nvme_ns *nvme_round_robin_path(struct nvme_ns_head *head, + fallback = ns; + } + +- /* No optimized path found, re-check the current path */ ++ /* ++ * The loop above skips the current path for round-robin semantics. ++ * Fall back to the current path if either: ++ * - no other optimized path found and current is optimized, ++ * - no other usable path found and current is usable. ++ */ + if (!nvme_path_is_disabled(old) && +- old->ana_state == NVME_ANA_OPTIMIZED) { +- found = old; +- goto out; +- } ++ (old->ana_state == NVME_ANA_OPTIMIZED || ++ (!fallback && old->ana_state == NVME_ANA_NONOPTIMIZED))) ++ return old; ++ + if (!fallback) + return NULL; + found = fallback; +-- +2.25.1 + diff --git a/queue-5.4/powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch b/queue-5.4/powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch new file mode 100644 index 00000000000..104a2efcdcd --- /dev/null +++ b/queue-5.4/powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch @@ -0,0 +1,56 @@ +From a308ee733ff55238c850eb4877af2781b53f0d21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 08:46:32 -0400 +Subject: powerpc/perf: Fix soft lockups due to missed interrupt accounting + +From: Athira Rajeev + +[ Upstream commit 17899eaf88d689529b866371344c8f269ba79b5f ] + +Performance monitor interrupt handler checks if any counter has +overflown and calls record_and_restart() in core-book3s which invokes +perf_event_overflow() to record the sample information. Apart from +creating sample, perf_event_overflow() also does the interrupt and +period checks via perf_event_account_interrupt(). + +Currently we record information only if the SIAR (Sampled Instruction +Address Register) valid bit is set (using siar_valid() check) and +hence the interrupt check. + +But it is possible that we do sampling for some events that are not +generating valid SIAR, and hence there is no chance to disable the +event if interrupts are more than max_samples_per_tick. This leads to +soft lockup. + +Fix this by adding perf_event_account_interrupt() in the invalid SIAR +code path for a sampling event. ie if SIAR is invalid, just do +interrupt check and don't record the sample information. + +Reported-by: Alexey Kardashevskiy +Signed-off-by: Athira Rajeev +Tested-by: Alexey Kardashevskiy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1596717992-7321-1-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/core-book3s.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index ca92e01d0bd1b..e32f7700303bc 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -2106,6 +2106,10 @@ static void record_and_restart(struct perf_event *event, unsigned long val, + + if (perf_event_overflow(event, &data, regs)) + power_pmu_stop(event, 0); ++ } else if (period) { ++ /* Account for interrupt in case of invalid SIAR */ ++ if (perf_event_account_interrupt(event)) ++ power_pmu_stop(event, 0); + } + } + +-- +2.25.1 + diff --git a/queue-5.4/revert-scsi-qla2xxx-fix-crash-on-qla2x00_mailbox_com.patch b/queue-5.4/revert-scsi-qla2xxx-fix-crash-on-qla2x00_mailbox_com.patch new file mode 100644 index 00000000000..79aca7e1500 --- /dev/null +++ b/queue-5.4/revert-scsi-qla2xxx-fix-crash-on-qla2x00_mailbox_com.patch @@ -0,0 +1,47 @@ +From 636affdbbdc2db2c636c0d30da276d81f191bd2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:13 -0700 +Subject: Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" + +From: Saurav Kashyap + +[ Upstream commit de7e6194301ad31c4ce95395eb678e51a1b907e5 ] + +FCoE adapter initialization failed for ISP8021 with the following patch +applied. In addition, reproduction of the issue the patch originally tried +to address has been unsuccessful. + +This reverts commit 3cb182b3fa8b7a61f05c671525494697cba39c6a. + +Link: https://lore.kernel.org/r/20200806111014.28434-11-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Saurav Kashyap +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 62a16463f0254..c1631e42d35d1 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -335,14 +335,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp) + if (time_after(jiffies, wait_time)) + break; + +- /* +- * Check if it's UNLOADING, cause we cannot poll in +- * this case, or else a NULL pointer dereference +- * is triggered. +- */ +- if (unlikely(test_bit(UNLOADING, &base_vha->dpc_flags))) +- return QLA_FUNCTION_TIMEOUT; +- + /* Check for pending interrupts. */ + qla2x00_poll(ha->rsp_q_map[0]); + +-- +2.25.1 + diff --git a/queue-5.4/s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch b/queue-5.4/s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch new file mode 100644 index 00000000000..aa826a78cf1 --- /dev/null +++ b/queue-5.4/s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch @@ -0,0 +1,43 @@ +From 79fd64050b6c52be12e3b948e0452c91e894b159 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 16:42:45 +0200 +Subject: s390/cio: add cond_resched() in the slow_eval_known_fn() loop + +From: Vineeth Vijayan + +[ Upstream commit 0b8eb2ee9da1e8c9b8082f404f3948aa82a057b2 ] + +The scanning through subchannels during the time of an event could +take significant amount of time in case of platforms with lots of +known subchannels. This might result in higher scheduling latencies +for other tasks especially on systems with a single CPU. Add +cond_resched() call, as the loop in slow_eval_known_fn() can be +executed for a longer duration. + +Reviewed-by: Peter Oberparleiter +Signed-off-by: Vineeth Vijayan +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/css.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c +index 831850435c23b..5734a78dbb8e6 100644 +--- a/drivers/s390/cio/css.c ++++ b/drivers/s390/cio/css.c +@@ -677,6 +677,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data) + rc = css_evaluate_known_subchannel(sch, 1); + if (rc == -EAGAIN) + css_schedule_eval(sch->schid); ++ /* ++ * The loop might take long time for platforms with lots of ++ * known devices. Allow scheduling here. ++ */ ++ cond_resched(); + } + return 0; + } +-- +2.25.1 + diff --git a/queue-5.4/scsi-fcoe-fix-i-o-path-allocation.patch b/queue-5.4/scsi-fcoe-fix-i-o-path-allocation.patch new file mode 100644 index 00000000000..1756361c220 --- /dev/null +++ b/queue-5.4/scsi-fcoe-fix-i-o-path-allocation.patch @@ -0,0 +1,39 @@ +From be885e70b13adf94386ff67a99a654ae64605899 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2020 15:23:33 -0500 +Subject: scsi: fcoe: Fix I/O path allocation + +From: Mike Christie + +[ Upstream commit fa39ab5184d64563cd36f2fb5f0d3fbad83a432c ] + +ixgbe_fcoe_ddp_setup() can be called from the main I/O path and is called +with a spin_lock held, so we have to use GFP_ATOMIC allocation instead of +GFP_KERNEL. + +Link: https://lore.kernel.org/r/1596831813-9839-1-git-send-email-michael.christie@oracle.com +cc: Hannes Reinecke +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c +index ccd852ad62a4b..d50c5b55da180 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_fcoe.c +@@ -192,7 +192,7 @@ static int ixgbe_fcoe_ddp_setup(struct net_device *netdev, u16 xid, + } + + /* alloc the udl from per cpu ddp pool */ +- ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_KERNEL, &ddp->udp); ++ ddp->udl = dma_pool_alloc(ddp_pool->pool, GFP_ATOMIC, &ddp->udp); + if (!ddp->udl) { + e_err(drv, "failed allocated ddp context\n"); + goto out_noddp_unmap; +-- +2.25.1 + diff --git a/queue-5.4/scsi-qla2xxx-check-if-fw-supports-mq-before-enabling.patch b/queue-5.4/scsi-qla2xxx-check-if-fw-supports-mq-before-enabling.patch new file mode 100644 index 00000000000..efd77e68e72 --- /dev/null +++ b/queue-5.4/scsi-qla2xxx-check-if-fw-supports-mq-before-enabling.patch @@ -0,0 +1,42 @@ +From 2ac17c1845f0b39b9bbfcad084e07484698b5939 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:11 -0700 +Subject: scsi: qla2xxx: Check if FW supports MQ before enabling + +From: Saurav Kashyap + +[ Upstream commit dffa11453313a115157b19021cc2e27ea98e624c ] + +OS boot during Boot from SAN was stuck at dracut emergency shell after +enabling NVMe driver parameter. For non-MQ support the driver was enabling +MQ. Add a check to confirm if FW supports MQ. + +Link: https://lore.kernel.org/r/20200806111014.28434-9-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Saurav Kashyap +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_os.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index d91c95d9981ac..67b1e74fcd1e6 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -1993,6 +1993,11 @@ skip_pio: + /* Determine queue resources */ + ha->max_req_queues = ha->max_rsp_queues = 1; + ha->msix_count = QLA_BASE_VECTORS; ++ ++ /* Check if FW supports MQ or not */ ++ if (!(ha->fw_attributes & BIT_6)) ++ goto mqiobase_exit; ++ + if (!ql2xmqsupport || !ql2xnvmeenable || + (!IS_QLA25XX(ha) && !IS_QLA81XX(ha))) + goto mqiobase_exit; +-- +2.25.1 + diff --git a/queue-5.4/scsi-qla2xxx-fix-login-timeout.patch b/queue-5.4/scsi-qla2xxx-fix-login-timeout.patch new file mode 100644 index 00000000000..c4f3b4fea05 --- /dev/null +++ b/queue-5.4/scsi-qla2xxx-fix-login-timeout.patch @@ -0,0 +1,73 @@ +From 5373f3b232ae7c6bad9443562a0cd2d61515c172 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:07 -0700 +Subject: scsi: qla2xxx: Fix login timeout + +From: Quinn Tran + +[ Upstream commit abb31aeaa9b20680b0620b23fea5475ea4591e31 ] + +Multipath errors were seen during failback due to login timeout. The +remote device sent LOGO, the local host tore down the session and did +relogin. The RSCN arrived indicates remote device is going through failover +after which the relogin is in a 20s timeout phase. At this point the +driver is stuck in the relogin process. Add a fix to delete the session as +part of abort/flush the login. + +Link: https://lore.kernel.org/r/20200806111014.28434-5-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_gs.c | 18 +++++++++++++++--- + drivers/scsi/qla2xxx/qla_target.c | 2 +- + 2 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index a44de4c5dcf6c..fc6e12fb7d77b 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3673,10 +3673,22 @@ void qla24xx_async_gnnft_done(scsi_qla_host_t *vha, srb_t *sp) + } + + if (fcport->scan_state != QLA_FCPORT_FOUND) { ++ bool do_delete = false; ++ ++ if (fcport->scan_needed && ++ fcport->disc_state == DSC_LOGIN_PEND) { ++ /* Cable got disconnected after we sent ++ * a login. Do delete to prevent timeout. ++ */ ++ fcport->logout_on_delete = 1; ++ do_delete = true; ++ } ++ + fcport->scan_needed = 0; +- if ((qla_dual_mode_enabled(vha) || +- qla_ini_mode_enabled(vha)) && +- atomic_read(&fcport->state) == FCS_ONLINE) { ++ if (((qla_dual_mode_enabled(vha) || ++ qla_ini_mode_enabled(vha)) && ++ atomic_read(&fcport->state) == FCS_ONLINE) || ++ do_delete) { + if (fcport->loop_id != FC_NO_LOOP_ID) { + if (fcport->flags & FCF_FCP2_DEVICE) + fcport->logout_on_delete = 0; +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index cb8a892e2d393..b75e6e4d58c06 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1262,7 +1262,7 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess) + + qla24xx_chk_fcp_state(sess); + +- ql_dbg(ql_dbg_tgt, sess->vha, 0xe001, ++ ql_dbg(ql_dbg_disc, sess->vha, 0xe001, + "Scheduling sess %p for deletion %8phC\n", + sess, sess->port_name); + +-- +2.25.1 + diff --git a/queue-5.4/scsi-qla2xxx-fix-null-pointer-access-during-disconne.patch b/queue-5.4/scsi-qla2xxx-fix-null-pointer-access-during-disconne.patch new file mode 100644 index 00000000000..2f030336d37 --- /dev/null +++ b/queue-5.4/scsi-qla2xxx-fix-null-pointer-access-during-disconne.patch @@ -0,0 +1,76 @@ +From 52031a76edc629e18822420428f4bd50f68dcd2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 04:10:12 -0700 +Subject: scsi: qla2xxx: Fix null pointer access during disconnect from + subsystem + +From: Quinn Tran + +[ Upstream commit 83949613fac61e8e37eadf8275bf072342302f4e ] + +NVMEAsync command is being submitted to QLA while the same NVMe controller +is in the middle of reset. The reset path has deleted the association and +freed aen_op->fcp_req.private. Add a check for this private pointer before +issuing the command. + +... + 6 [ffffb656ca11fce0] page_fault at ffffffff8c00114e + [exception RIP: qla_nvme_post_cmd+394] + RIP: ffffffffc0d012ba RSP: ffffb656ca11fd98 RFLAGS: 00010206 + RAX: ffff8fb039eda228 RBX: ffff8fb039eda200 RCX: 00000000000da161 + RDX: ffffffffc0d4d0f0 RSI: ffffffffc0d26c9b RDI: ffff8fb039eda220 + RBP: 0000000000000013 R8: ffff8fb47ff6aa80 R9: 0000000000000002 + R10: 0000000000000000 R11: ffffb656ca11fdc8 R12: ffff8fb27d04a3b0 + R13: ffff8fc46dd98a58 R14: 0000000000000000 R15: ffff8fc4540f0000 + ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 + 7 [ffffb656ca11fe08] nvme_fc_start_fcp_op at ffffffffc0241568 [nvme_fc] + 8 [ffffb656ca11fe50] nvme_fc_submit_async_event at ffffffffc0241901 [nvme_fc] + 9 [ffffb656ca11fe68] nvme_async_event_work at ffffffffc014543d [nvme_core] +10 [ffffb656ca11fe98] process_one_work at ffffffff8b6cd437 +11 [ffffb656ca11fed8] worker_thread at ffffffff8b6cdcef +12 [ffffb656ca11ff10] kthread at ffffffff8b6d3402 +13 [ffffb656ca11ff50] ret_from_fork at ffffffff8c000255 + +-- +PID: 37824 TASK: ffff8fb033063d80 CPU: 20 COMMAND: "kworker/u97:451" + 0 [ffffb656ce1abc28] __schedule at ffffffff8be629e3 + 1 [ffffb656ce1abcc8] schedule at ffffffff8be62fe8 + 2 [ffffb656ce1abcd0] schedule_timeout at ffffffff8be671ed + 3 [ffffb656ce1abd70] wait_for_completion at ffffffff8be639cf + 4 [ffffb656ce1abdd0] flush_work at ffffffff8b6ce2d5 + 5 [ffffb656ce1abe70] nvme_stop_ctrl at ffffffffc0144900 [nvme_core] + 6 [ffffb656ce1abe80] nvme_fc_reset_ctrl_work at ffffffffc0243445 [nvme_fc] + 7 [ffffb656ce1abe98] process_one_work at ffffffff8b6cd437 + 8 [ffffb656ce1abed8] worker_thread at ffffffff8b6cdb50 + 9 [ffffb656ce1abf10] kthread at ffffffff8b6d3402 +10 [ffffb656ce1abf50] ret_from_fork at ffffffff8c000255 + +Link: https://lore.kernel.org/r/20200806111014.28434-10-njavali@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Quinn Tran +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_nvme.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 941aa53363f56..f4815a4084d8c 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -535,6 +535,11 @@ static int qla_nvme_post_cmd(struct nvme_fc_local_port *lport, + struct nvme_private *priv = fd->private; + struct qla_nvme_rport *qla_rport = rport->private; + ++ if (!priv) { ++ /* nvme association has been torn down */ ++ return rval; ++ } ++ + fcport = qla_rport->fcport; + + if (!qpair || !fcport || (qpair && !qpair->fw_started) || +-- +2.25.1 + diff --git a/queue-5.4/scsi-ufs-clean-up-completed-request-without-interrup.patch b/queue-5.4/scsi-ufs-clean-up-completed-request-without-interrup.patch new file mode 100644 index 00000000000..05d9a17659d --- /dev/null +++ b/queue-5.4/scsi-ufs-clean-up-completed-request-without-interrup.patch @@ -0,0 +1,56 @@ +From 0532aa3e39261efa809b6e2380359d90d2cf14b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 16:18:58 +0200 +Subject: scsi: ufs: Clean up completed request without interrupt notification + +From: Stanley Chu + +[ Upstream commit b10178ee7fa88b68a9e8adc06534d2605cb0ec23 ] + +If somehow no interrupt notification is raised for a completed request and +its doorbell bit is cleared by host, UFS driver needs to cleanup its +outstanding bit in ufshcd_abort(). Otherwise, system may behave abnormally +in the following scenario: + +After ufshcd_abort() returns, this request will be requeued by SCSI layer +with its outstanding bit set. Any future completed request will trigger +ufshcd_transfer_req_compl() to handle all "completed outstanding bits". At +this time the "abnormal outstanding bit" will be detected and the "requeued +request" will be chosen to execute request post-processing flow. This is +wrong because this request is still "alive". + +Link: https://lore.kernel.org/r/20200811141859.27399-2-huobean@gmail.com +Reviewed-by: Can Guo +Acked-by: Avri Altman +Signed-off-by: Stanley Chu +Signed-off-by: Bean Huo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index b51ccbf6cc59c..5e502e1605549 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -6140,7 +6140,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) + /* command completed already */ + dev_err(hba->dev, "%s: cmd at tag %d successfully cleared from DB.\n", + __func__, tag); +- goto out; ++ goto cleanup; + } else { + dev_err(hba->dev, + "%s: no response from device. tag = %d, err %d\n", +@@ -6174,6 +6174,7 @@ static int ufshcd_abort(struct scsi_cmnd *cmd) + goto out; + } + ++cleanup: + scsi_dma_unmap(cmd); + + spin_lock_irqsave(host->host_lock, flags); +-- +2.25.1 + diff --git a/queue-5.4/scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch b/queue-5.4/scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch new file mode 100644 index 00000000000..e3aae62bcfa --- /dev/null +++ b/queue-5.4/scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch @@ -0,0 +1,57 @@ +From 9978fc355540f636911686d50540025dc3fc3f19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Aug 2020 13:07:34 +0800 +Subject: scsi: ufs: Fix possible infinite loop in ufshcd_hold + +From: Stanley Chu + +[ Upstream commit 93b6c5db06028a3b55122bbb74d0715dd8ca4ae0 ] + +In ufshcd_suspend(), after clk-gating is suspended and link is set +as Hibern8 state, ufshcd_hold() is still possibly invoked before +ufshcd_suspend() returns. For example, MediaTek's suspend vops may +issue UIC commands which would call ufshcd_hold() during the command +issuing flow. + +Now if UFSHCD_CAP_HIBERN8_WITH_CLK_GATING capability is enabled, +then ufshcd_hold() may enter infinite loops because there is no +clk-ungating work scheduled or pending. In this case, ufshcd_hold() +shall just bypass, and keep the link as Hibern8 state. + +Link: https://lore.kernel.org/r/20200809050734.18740-1-stanley.chu@mediatek.com +Reviewed-by: Avri Altman +Co-developed-by: Andy Teng +Signed-off-by: Andy Teng +Signed-off-by: Stanley Chu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index b41b88bcab3d9..336cf72397e50 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -1516,6 +1516,7 @@ unblock_reqs: + int ufshcd_hold(struct ufs_hba *hba, bool async) + { + int rc = 0; ++ bool flush_result; + unsigned long flags; + + if (!ufshcd_is_clkgating_allowed(hba)) +@@ -1547,7 +1548,9 @@ start: + break; + } + spin_unlock_irqrestore(hba->host->host_lock, flags); +- flush_work(&hba->clk_gating.ungate_work); ++ flush_result = flush_work(&hba->clk_gating.ungate_work); ++ if (hba->clk_gating.is_suspended && !flush_result) ++ goto out; + spin_lock_irqsave(hba->host->host_lock, flags); + goto start; + } +-- +2.25.1 + diff --git a/queue-5.4/scsi-ufs-improve-interrupt-handling-for-shared-inter.patch b/queue-5.4/scsi-ufs-improve-interrupt-handling-for-shared-inter.patch new file mode 100644 index 00000000000..ccb349806a7 --- /dev/null +++ b/queue-5.4/scsi-ufs-improve-interrupt-handling-for-shared-inter.patch @@ -0,0 +1,55 @@ +From 1d8d095418e34a6f526e3adb5d86c1c11f0b7ae5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 16:39:36 +0300 +Subject: scsi: ufs: Improve interrupt handling for shared interrupts + +From: Adrian Hunter + +[ Upstream commit 127d5f7c4b653b8be5eb3b2c7bbe13728f9003ff ] + +For shared interrupts, the interrupt status might be zero, so check that +first. + +Link: https://lore.kernel.org/r/20200811133936.19171-2-adrian.hunter@intel.com +Reviewed-by: Avri Altman +Signed-off-by: Adrian Hunter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 336cf72397e50..b51ccbf6cc59c 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -5612,7 +5612,7 @@ static void ufshcd_sl_intr(struct ufs_hba *hba, u32 intr_status) + */ + static irqreturn_t ufshcd_intr(int irq, void *__hba) + { +- u32 intr_status, enabled_intr_status; ++ u32 intr_status, enabled_intr_status = 0; + irqreturn_t retval = IRQ_NONE; + struct ufs_hba *hba = __hba; + int retries = hba->nutrs; +@@ -5626,7 +5626,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) + * read, make sure we handle them by checking the interrupt status + * again in a loop until we process all of the reqs before returning. + */ +- do { ++ while (intr_status && retries--) { + enabled_intr_status = + intr_status & ufshcd_readl(hba, REG_INTERRUPT_ENABLE); + if (intr_status) +@@ -5637,7 +5637,7 @@ static irqreturn_t ufshcd_intr(int irq, void *__hba) + } + + intr_status = ufshcd_readl(hba, REG_INTERRUPT_STATUS); +- } while (intr_status && --retries); ++ } + + spin_unlock(hba->host->host_lock); + return retval; +-- +2.25.1 + diff --git a/queue-5.4/selftests-disable-rp_filter-for-icmp_redirect.sh.patch b/queue-5.4/selftests-disable-rp_filter-for-icmp_redirect.sh.patch new file mode 100644 index 00000000000..d2924361353 --- /dev/null +++ b/queue-5.4/selftests-disable-rp_filter-for-icmp_redirect.sh.patch @@ -0,0 +1,38 @@ +From e03ef519fa277c5551ad5508ef078177ab93e5b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 09:43:33 -0600 +Subject: selftests: disable rp_filter for icmp_redirect.sh + +From: David Ahern + +[ Upstream commit bcf7ddb0186d366f761f86196b480ea6dd2dc18c ] + +h1 is initially configured to reach h2 via r1 rather than the +more direct path through r2. If rp_filter is set and inherited +for r2, forwarding fails since the source address of h1 is +reachable from eth0 vs the packet coming to it via r1 and eth1. +Since rp_filter setting affects the test, explicitly reset it. + +Signed-off-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/icmp_redirect.sh | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/tools/testing/selftests/net/icmp_redirect.sh b/tools/testing/selftests/net/icmp_redirect.sh +index 18c5de53558af..bf361f30d6ef9 100755 +--- a/tools/testing/selftests/net/icmp_redirect.sh ++++ b/tools/testing/selftests/net/icmp_redirect.sh +@@ -180,6 +180,8 @@ setup() + ;; + r[12]) ip netns exec $ns sysctl -q -w net.ipv4.ip_forward=1 + ip netns exec $ns sysctl -q -w net.ipv4.conf.all.send_redirects=1 ++ ip netns exec $ns sysctl -q -w net.ipv4.conf.default.rp_filter=0 ++ ip netns exec $ns sysctl -q -w net.ipv4.conf.all.rp_filter=0 + + ip netns exec $ns sysctl -q -w net.ipv6.conf.all.forwarding=1 + ip netns exec $ns sysctl -q -w net.ipv6.route.mtu_expires=10 +-- +2.25.1 + diff --git a/queue-5.4/series b/queue-5.4/series index 8953159a8f1..9cf9e7ca3ae 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -95,3 +95,54 @@ pci-qcom-change-duplicate-pci-reset-to-phy-reset.patch pci-qcom-add-missing-reset-for-ipq806x.patch cpufreq-intel_pstate-fix-epp-setting-via-sysfs-in-ac.patch alsa-usb-audio-add-capture-support-for-saffire-6-usb.patch +media-gpio-ir-tx-improve-precision-of-transmitted-si.patch +block-respect-queue-limit-of-max-discard-segment.patch +block-virtio_blk-fix-handling-single-range-discard-r.patch +drm-msm-adreno-fix-updating-ring-fence.patch +block-fix-page_is_mergeable-for-compound-pages.patch +bfq-fix-blkio-cgroup-leakage-v4.patch +hwmon-nct7904-correct-divide-by-0.patch +blk-mq-insert-request-not-through-queue_rq-into-sw-s.patch +blkcg-fix-memleak-for-iolatency.patch +nvme-fc-fix-wrong-return-value-in-__nvme_fc_init_req.patch +nvme-multipath-round-robin-fix-single-non-optimized-.patch +null_blk-fix-passing-of-req_fua-flag-in-null_handle_.patch +i2c-core-don-t-fail-prp0001-enumeration-when-no-id-t.patch +i2c-rcar-in-slave-mode-clear-nack-earlier.patch +usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch +spi-stm32-clear-only-asserted-irq-flags-on-interrupt.patch +jbd2-make-sure-jh-have-b_transaction-set-in-refile-u.patch +ext4-don-t-bug-on-inconsistent-journal-feature.patch +ext4-handle-read-only-external-journal-device.patch +jbd2-abort-journal-if-free-a-async-write-error-metad.patch +ext4-handle-option-set-by-mount-flags-correctly.patch +ext4-handle-error-of-ext4_setup_system_zone-on-remou.patch +ext4-correctly-restore-system-zone-info-when-remount.patch +fs-prevent-bug_on-in-submit_bh_wbc.patch +spi-stm32h7-fix-race-condition-at-end-of-transfer.patch +spi-stm32-fix-fifo-threshold-level-in-case-of-short-.patch +spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch +spi-stm32-always-perform-registers-configuration-pri.patch +drm-amd-powerplay-correct-vega20-cached-smu-feature-.patch +drm-amd-powerplay-correct-uvd-vce-pg-state-on-custom.patch +drm-amd-display-switch-to-immediate-mode-for-updatin.patch +libbpf-handle-gcc-built-in-types-for-arm-neon.patch +netfilter-avoid-ipv6-nf_defrag_ipv6-module-dependenc.patch +can-j1939-transport-j1939_xtp_rx_dat_one-compare-own.patch +alsa-hda-realtek-add-model-alc298-samsung-headphone.patch +s390-cio-add-cond_resched-in-the-slow_eval_known_fn-.patch +asoc-wm8994-avoid-attempts-to-read-unreadable-regist.patch +selftests-disable-rp_filter-for-icmp_redirect.sh.patch +scsi-fcoe-fix-i-o-path-allocation.patch +scsi-ufs-fix-possible-infinite-loop-in-ufshcd_hold.patch +scsi-ufs-improve-interrupt-handling-for-shared-inter.patch +scsi-ufs-clean-up-completed-request-without-interrup.patch +scsi-qla2xxx-fix-login-timeout.patch +scsi-qla2xxx-check-if-fw-supports-mq-before-enabling.patch +scsi-qla2xxx-fix-null-pointer-access-during-disconne.patch +revert-scsi-qla2xxx-fix-crash-on-qla2x00_mailbox_com.patch +macvlan-validate-setting-of-multiple-remote-source-m.patch +net-gianfar-add-of_node_put-before-goto-statement.patch +powerpc-perf-fix-soft-lockups-due-to-missed-interrup.patch +arm64-move-handling-of-erratum-1418040-into-c-code.patch +arm64-allow-booting-of-late-cpus-affected-by-erratum.patch diff --git a/queue-5.4/spi-stm32-always-perform-registers-configuration-pri.patch b/queue-5.4/spi-stm32-always-perform-registers-configuration-pri.patch new file mode 100644 index 00000000000..f4f45e32281 --- /dev/null +++ b/queue-5.4/spi-stm32-always-perform-registers-configuration-pri.patch @@ -0,0 +1,87 @@ +From 8eac8487e921acd2ffd89697921b2d2ba1720b46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 09:12:38 +0200 +Subject: spi: stm32: always perform registers configuration prior to transfer + +From: Alain Volmat + +[ Upstream commit 60ccb3515fc61a0124c70aa37317f75b67560024 ] + +SPI registers content may have been lost upon suspend/resume sequence. +So, always compute and apply the necessary configuration in +stm32_spi_transfer_one_setup routine. + +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1597043558-29668-6-git-send-email-alain.volmat@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 42 +++++++++++++++++------------------------ + 1 file changed, 17 insertions(+), 25 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 50ef03a8252d7..8146c2d91d307 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -1590,41 +1590,33 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi, + unsigned long flags; + unsigned int comm_type; + int nb_words, ret = 0; ++ int mbr; + + spin_lock_irqsave(&spi->lock, flags); + + spi->cur_xferlen = transfer->len; + +- if (spi->cur_bpw != transfer->bits_per_word) { +- spi->cur_bpw = transfer->bits_per_word; +- spi->cfg->set_bpw(spi); +- } +- +- if (spi->cur_speed != transfer->speed_hz) { +- int mbr; +- +- /* Update spi->cur_speed with real clock speed */ +- mbr = stm32_spi_prepare_mbr(spi, transfer->speed_hz, +- spi->cfg->baud_rate_div_min, +- spi->cfg->baud_rate_div_max); +- if (mbr < 0) { +- ret = mbr; +- goto out; +- } ++ spi->cur_bpw = transfer->bits_per_word; ++ spi->cfg->set_bpw(spi); + +- transfer->speed_hz = spi->cur_speed; +- stm32_spi_set_mbr(spi, mbr); ++ /* Update spi->cur_speed with real clock speed */ ++ mbr = stm32_spi_prepare_mbr(spi, transfer->speed_hz, ++ spi->cfg->baud_rate_div_min, ++ spi->cfg->baud_rate_div_max); ++ if (mbr < 0) { ++ ret = mbr; ++ goto out; + } + +- comm_type = stm32_spi_communication_type(spi_dev, transfer); +- if (spi->cur_comm != comm_type) { +- ret = spi->cfg->set_mode(spi, comm_type); ++ transfer->speed_hz = spi->cur_speed; ++ stm32_spi_set_mbr(spi, mbr); + +- if (ret < 0) +- goto out; ++ comm_type = stm32_spi_communication_type(spi_dev, transfer); ++ ret = spi->cfg->set_mode(spi, comm_type); ++ if (ret < 0) ++ goto out; + +- spi->cur_comm = comm_type; +- } ++ spi->cur_comm = comm_type; + + if (spi->cfg->set_data_idleness) + spi->cfg->set_data_idleness(spi, transfer->len); +-- +2.25.1 + diff --git a/queue-5.4/spi-stm32-clear-only-asserted-irq-flags-on-interrupt.patch b/queue-5.4/spi-stm32-clear-only-asserted-irq-flags-on-interrupt.patch new file mode 100644 index 00000000000..09ce374fd2f --- /dev/null +++ b/queue-5.4/spi-stm32-clear-only-asserted-irq-flags-on-interrupt.patch @@ -0,0 +1,39 @@ +From ca82cd450990aa1d08573d66ee211dd1ce7f9bc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Aug 2020 21:51:36 +0200 +Subject: spi: stm32: clear only asserted irq flags on interrupt + +From: Tobias Schramm + +[ Upstream commit ae1ba50f1e706dfd7ce402ac52c1f1f10becad68 ] + +Previously the stm32h7 interrupt thread cleared all non-masked interrupts. +If an interrupt was to occur during the handling of another interrupt its +flag would be unset, resulting in a lost interrupt. +This patches fixes the issue by clearing only the currently set interrupt +flags. + +Signed-off-by: Tobias Schramm +Link: https://lore.kernel.org/r/20200804195136.1485392-1-t.schramm@manjaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 7e92ab0cc9920..dc6334f67e6ae 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -962,7 +962,7 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + if (!spi->cur_usedma && (spi->rx_buf && (spi->rx_len > 0))) + stm32h7_spi_read_rxfifo(spi, false); + +- writel_relaxed(mask, spi->base + STM32H7_SPI_IFCR); ++ writel_relaxed(sr & mask, spi->base + STM32H7_SPI_IFCR); + + spin_unlock_irqrestore(&spi->lock, flags); + +-- +2.25.1 + diff --git a/queue-5.4/spi-stm32-fix-fifo-threshold-level-in-case-of-short-.patch b/queue-5.4/spi-stm32-fix-fifo-threshold-level-in-case-of-short-.patch new file mode 100644 index 00000000000..488ddf46e78 --- /dev/null +++ b/queue-5.4/spi-stm32-fix-fifo-threshold-level-in-case-of-short-.patch @@ -0,0 +1,99 @@ +From 494bb35e1a91d0f1032e9ba649107a419592ffa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 09:12:35 +0200 +Subject: spi: stm32: fix fifo threshold level in case of short transfer + +From: Amelie Delaunay + +[ Upstream commit 3373e9004acc0603242622b4378c64bc01d21b5f ] + +When transfer is shorter than half of the fifo, set the data packet size +up to transfer size instead of up to half of the fifo. +Check also that threshold is set at least to 1 data frame. + +Signed-off-by: Amelie Delaunay +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1597043558-29668-3-git-send-email-alain.volmat@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 25b1348aaa549..f092bc8e00819 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -469,20 +469,27 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz, + /** + * stm32h7_spi_prepare_fthlv - Determine FIFO threshold level + * @spi: pointer to the spi controller data structure ++ * @xfer_len: length of the message to be transferred + */ +-static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi) ++static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi, u32 xfer_len) + { +- u32 fthlv, half_fifo; ++ u32 fthlv, half_fifo, packet; + + /* data packet should not exceed 1/2 of fifo space */ + half_fifo = (spi->fifo_size / 2); + ++ /* data_packet should not exceed transfer length */ ++ if (half_fifo > xfer_len) ++ packet = xfer_len; ++ else ++ packet = half_fifo; ++ + if (spi->cur_bpw <= 8) +- fthlv = half_fifo; ++ fthlv = packet; + else if (spi->cur_bpw <= 16) +- fthlv = half_fifo / 2; ++ fthlv = packet / 2; + else +- fthlv = half_fifo / 4; ++ fthlv = packet / 4; + + /* align packet size with data registers access */ + if (spi->cur_bpw > 8) +@@ -490,6 +497,9 @@ static u32 stm32h7_spi_prepare_fthlv(struct stm32_spi *spi) + else + fthlv -= (fthlv % 4); /* multiple of 4 */ + ++ if (!fthlv) ++ fthlv = 1; ++ + return fthlv; + } + +@@ -1396,7 +1406,7 @@ static void stm32h7_spi_set_bpw(struct stm32_spi *spi) + cfg1_setb |= (bpw << STM32H7_SPI_CFG1_DSIZE_SHIFT) & + STM32H7_SPI_CFG1_DSIZE; + +- spi->cur_fthlv = stm32h7_spi_prepare_fthlv(spi); ++ spi->cur_fthlv = stm32h7_spi_prepare_fthlv(spi, spi->cur_xferlen); + fthlv = spi->cur_fthlv - 1; + + cfg1_clrb |= STM32H7_SPI_CFG1_FTHLV; +@@ -1582,6 +1592,8 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi, + + spin_lock_irqsave(&spi->lock, flags); + ++ spi->cur_xferlen = transfer->len; ++ + if (spi->cur_bpw != transfer->bits_per_word) { + spi->cur_bpw = transfer->bits_per_word; + spi->cfg->set_bpw(spi); +@@ -1629,8 +1641,6 @@ static int stm32_spi_transfer_one_setup(struct stm32_spi *spi, + goto out; + } + +- spi->cur_xferlen = transfer->len; +- + dev_dbg(spi->dev, "transfer communication mode set to %d\n", + spi->cur_comm); + dev_dbg(spi->dev, +-- +2.25.1 + diff --git a/queue-5.4/spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch b/queue-5.4/spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch new file mode 100644 index 00000000000..c85a4c7b289 --- /dev/null +++ b/queue-5.4/spi-stm32-fix-stm32_spi_prepare_mbr-in-case-of-odd-c.patch @@ -0,0 +1,38 @@ +From 6d85acd00024f8cc063e781236ea5b1fa51aa6fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 09:12:36 +0200 +Subject: spi: stm32: fix stm32_spi_prepare_mbr in case of odd clk_rate + +From: Amelie Delaunay + +[ Upstream commit 9cc61973bf9385b19ff5dda4a2a7e265fcba85e4 ] + +Fix spi->clk_rate when it is odd to the nearest lowest even value because +minimum SPI divider is 2. + +Signed-off-by: Amelie Delaunay +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1597043558-29668-4-git-send-email-alain.volmat@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index f092bc8e00819..50ef03a8252d7 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -443,7 +443,8 @@ static int stm32_spi_prepare_mbr(struct stm32_spi *spi, u32 speed_hz, + { + u32 div, mbrdiv; + +- div = DIV_ROUND_UP(spi->clk_rate, speed_hz); ++ /* Ensure spi->clk_rate is even */ ++ div = DIV_ROUND_UP(spi->clk_rate & ~0x1, speed_hz); + + /* + * SPI framework set xfer->speed_hz to master->max_speed_hz if +-- +2.25.1 + diff --git a/queue-5.4/spi-stm32h7-fix-race-condition-at-end-of-transfer.patch b/queue-5.4/spi-stm32h7-fix-race-condition-at-end-of-transfer.patch new file mode 100644 index 00000000000..f0fcde80c74 --- /dev/null +++ b/queue-5.4/spi-stm32h7-fix-race-condition-at-end-of-transfer.patch @@ -0,0 +1,44 @@ +From 573c677837692430152cf10f5c02a73313c01c3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 09:12:34 +0200 +Subject: spi: stm32h7: fix race condition at end of transfer + +From: Antonio Borneo + +[ Upstream commit 135dd873d3c76d812ae64c668adef3f2c59ed27f ] + +The caller of stm32_spi_transfer_one(), spi_transfer_one_message(), +is waiting for us to call spi_finalize_current_transfer() and will +eventually schedule a new transfer, if available. +We should guarantee that the spi controller is really available +before calling spi_finalize_current_transfer(). + +Move the call to spi_finalize_current_transfer() _after_ the call +to stm32_spi_disable(). + +Signed-off-by: Antonio Borneo +Signed-off-by: Alain Volmat +Link: https://lore.kernel.org/r/1597043558-29668-2-git-send-email-alain.volmat@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index dc6334f67e6ae..25b1348aaa549 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -967,8 +967,8 @@ static irqreturn_t stm32h7_spi_irq_thread(int irq, void *dev_id) + spin_unlock_irqrestore(&spi->lock, flags); + + if (end) { +- spi_finalize_current_transfer(master); + stm32h7_spi_disable(spi); ++ spi_finalize_current_transfer(master); + } + + return IRQ_HANDLED; +-- +2.25.1 + diff --git a/queue-5.4/usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch b/queue-5.4/usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch new file mode 100644 index 00000000000..0b14492d434 --- /dev/null +++ b/queue-5.4/usb-gadget-f_tcm-fix-some-resource-leaks-in-some-err.patch @@ -0,0 +1,46 @@ +From 53bfd328d0c19122b58dfdb43d72b1c6dfba2496 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Aug 2020 07:55:01 +0200 +Subject: usb: gadget: f_tcm: Fix some resource leaks in some error paths + +From: Christophe JAILLET + +[ Upstream commit 07c8434150f4eb0b65cae288721c8af1080fde17 ] + +If a memory allocation fails within a 'usb_ep_alloc_request()' call, the +already allocated memory must be released. + +Fix a mix-up in the code and free the correct requests. + +Fixes: c52661d60f63 ("usb-gadget: Initial merge of target module for UASP + BOT") +Signed-off-by: Christophe JAILLET +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_tcm.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/function/f_tcm.c +index 7f01f78b1d238..f6d203fec4955 100644 +--- a/drivers/usb/gadget/function/f_tcm.c ++++ b/drivers/usb/gadget/function/f_tcm.c +@@ -751,12 +751,13 @@ static int uasp_alloc_stream_res(struct f_uas *fu, struct uas_stream *stream) + goto err_sts; + + return 0; ++ + err_sts: +- usb_ep_free_request(fu->ep_status, stream->req_status); +- stream->req_status = NULL; +-err_out: + usb_ep_free_request(fu->ep_out, stream->req_out); + stream->req_out = NULL; ++err_out: ++ usb_ep_free_request(fu->ep_in, stream->req_in); ++ stream->req_in = NULL; + out: + return -ENOMEM; + } +-- +2.25.1 +