From: Greg Kroah-Hartman Date: Tue, 10 Mar 2020 10:55:06 +0000 (+0100) Subject: 5.5-stable patches X-Git-Tag: v4.4.216~23 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=7d18d1c83e9466a8e7fb883dde3f1d11d7781126;p=thirdparty%2Fkernel%2Fstable-queue.git 5.5-stable patches added patches: arm-dts-imx6-phycore-som-fix-emmc-supply.patch arm64-dts-imx8qxp-mek-remove-unexisting-ethernet-phy.patch asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch asoc-intel-skylake-fix-available-clock-counter-incrementation.patch asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch asoc-soc-component-tidyup-snd_soc_pcm_component_sync_stop.patch drm-i915-perf-reintroduce-wait-on-oa-configuration-completion.patch drm-i915-program-mbus-with-rmw-during-initialization.patch drm-i915-selftests-fix-return-in-assert_mmap_offset.patch drm-kirin-revert-fix-for-hikey620-display-offset-problem.patch drm-mediatek-handle-component-type-mtk_disp_ovl_2l-correctly.patch drm-panfrost-don-t-try-to-map-on-error-faults.patch drm-sun4i-add-separate-de3-vi-layer-formats.patch drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch drm-sun4i-fix-de2-vi-layer-format-support.patch drm-ttm-fix-leaking-fences-via-ttm_buffer_object_transfer.patch firmware-imx-align-imx_sc_msg_req_cpu_start-to-4.patch firmware-imx-misc-align-imx-sc-msg-structs-to-4.patch firmware-imx-scu-pd-align-imx-sc-msg-structs-to-4.patch ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch ib-mlx5-fix-implicit-odp-race.patch phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch rdma-core-fix-protection-fault-in-ib_mr_pool_destroy.patch rdma-iwcm-fix-iwcm-work-deallocation.patch rdma-nldev-fix-crash-when-set-a-qp-to-a-new-counter-but-qpn-is-missing.patch rdma-odp-ensure-the-mm-is-still-alive-before-creating-an-implicit-child.patch rdma-rw-fix-error-flow-during-rdma-context-initialization.patch rdma-siw-fix-failure-handling-during-device-creation.patch regulator-qcom_spmi-fix-docs-for-pm8004.patch regulator-stm32-vrefbuf-fix-a-possible-overshoot-when-re-enabling.patch revert-rdma-cma-simplify-rdma_resolve_addr-error-flow.patch rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch soc-imx-scu-align-imx-sc-msg-structs-to-4.patch spi-atmel-quadspi-fix-possible-mmio-window-size-overrun.patch --- diff --git a/queue-5.5/arm-dts-imx6-phycore-som-fix-emmc-supply.patch b/queue-5.5/arm-dts-imx6-phycore-som-fix-emmc-supply.patch new file mode 100644 index 00000000000..1df68282532 --- /dev/null +++ b/queue-5.5/arm-dts-imx6-phycore-som-fix-emmc-supply.patch @@ -0,0 +1,33 @@ +From eb0bbba7636b9fc81939d6087a5fe575e150c95a Mon Sep 17 00:00:00 2001 +From: Marco Felsch +Date: Thu, 16 Jan 2020 15:01:08 +0100 +Subject: ARM: dts: imx6: phycore-som: fix emmc supply + +From: Marco Felsch + +commit eb0bbba7636b9fc81939d6087a5fe575e150c95a upstream. + +Currently the vmmc is supplied by the 1.8V pmic rail but this is wrong. +The default module behaviour is to power VCCQ and VCC by the 3.3V power +rail. Optional the user can connect the VCCQ to the pmic 1.8V emmc +power rail using a solder jumper. + +Fixes: ddec5d1c0047 ("ARM: dts: imx6: Add initial support for phyCORE-i.MX 6 SOM") +Signed-off-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi | 1 - + 1 file changed, 1 deletion(-) + +--- a/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-phytec-phycore-som.dtsi +@@ -183,7 +183,6 @@ + pinctrl-0 = <&pinctrl_usdhc4>; + bus-width = <8>; + non-removable; +- vmmc-supply = <&vdd_emmc_1p8>; + status = "disabled"; + }; + diff --git a/queue-5.5/arm64-dts-imx8qxp-mek-remove-unexisting-ethernet-phy.patch b/queue-5.5/arm64-dts-imx8qxp-mek-remove-unexisting-ethernet-phy.patch new file mode 100644 index 00000000000..fe8463f3250 --- /dev/null +++ b/queue-5.5/arm64-dts-imx8qxp-mek-remove-unexisting-ethernet-phy.patch @@ -0,0 +1,41 @@ +From 26c4b4758fce8f0ae744335e1762213be29db441 Mon Sep 17 00:00:00 2001 +From: Fabio Estevam +Date: Mon, 17 Feb 2020 16:15:03 -0300 +Subject: arm64: dts: imx8qxp-mek: Remove unexisting Ethernet PHY + +From: Fabio Estevam + +commit 26c4b4758fce8f0ae744335e1762213be29db441 upstream. + +There is only on Ethernet port and one Ethernet PHY on imx8qxp-mek. + +Remove the unexisting ethphy1 port. + +This fixes a run-time warning: + +mdio_bus 5b040000.ethernet-1: MDIO device at address 1 is missing. + +Fixes: fdea904e85e1 ("arm64: dts: imx: add imx8qxp mek support") +Signed-off-by: Fabio Estevam +Reviewed-by: Leonard Crestez +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm64/boot/dts/freescale/imx8qxp-mek.dts | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/arch/arm64/boot/dts/freescale/imx8qxp-mek.dts ++++ b/arch/arm64/boot/dts/freescale/imx8qxp-mek.dts +@@ -52,11 +52,6 @@ + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <0>; + }; +- +- ethphy1: ethernet-phy@1 { +- compatible = "ethernet-phy-ieee802.3-c22"; +- reg = <1>; +- }; + }; + }; + diff --git a/queue-5.5/asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch b/queue-5.5/asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch new file mode 100644 index 00000000000..07e8a5f2509 --- /dev/null +++ b/queue-5.5/asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch @@ -0,0 +1,43 @@ +From 9b3193089e77d3b59b045146ff1c770dd899acb1 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Fri, 28 Feb 2020 15:31:45 +0000 +Subject: ASoC: dapm: Correct DAPM handling of active widgets during shutdown + +From: Charles Keepax + +commit 9b3193089e77d3b59b045146ff1c770dd899acb1 upstream. + +commit c2caa4da46a4 ("ASoC: Fix widget powerdown on shutdown") added a +set of the power state during snd_soc_dapm_shutdown to ensure the +widgets powered off. However, when commit 39eb5fd13dff +("ASoC: dapm: Delay w->power update until the changes are written") +added the new_power member of the widget structure, to differentiate +between the current power state and the target power state, it did not +update the shutdown to use the new_power member. + +As new_power has not updated it will be left in the state set by the +last DAPM sequence, ie. 1 for active widgets. So as the DAPM sequence +for the shutdown proceeds it will turn the widgets on (despite them +already being on) rather than turning them off. + +Fixes: 39eb5fd13dff ("ASoC: dapm: Delay w->power update until the changes are written") +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20200228153145.21013-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-dapm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -4749,7 +4749,7 @@ static void soc_dapm_shutdown_dapm(struc + continue; + if (w->power) { + dapm_seq_insert(w, &down_list, false); +- w->power = 0; ++ w->new_power = 0; + powerdown = 1; + } + } diff --git a/queue-5.5/asoc-intel-skylake-fix-available-clock-counter-incrementation.patch b/queue-5.5/asoc-intel-skylake-fix-available-clock-counter-incrementation.patch new file mode 100644 index 00000000000..b5b4d64fef5 --- /dev/null +++ b/queue-5.5/asoc-intel-skylake-fix-available-clock-counter-incrementation.patch @@ -0,0 +1,43 @@ +From 8308a09e87d2cb51adb186dc7d5a5c1913fb0758 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Amadeusz=20S=C5=82awi=C5=84ski?= + +Date: Mon, 24 Feb 2020 07:52:02 -0500 +Subject: ASoC: Intel: Skylake: Fix available clock counter incrementation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Amadeusz Sławiński + +commit 8308a09e87d2cb51adb186dc7d5a5c1913fb0758 upstream. + +Incrementation of avail_clk_cnt was incorrectly moved to error path. Put +it back to success path. + +Fixes: 6ee927f2f01466 ('ASoC: Intel: Skylake: Fix NULL ptr dereference when unloading clk dev') +Signed-off-by: Amadeusz Sławiński +Reviewed-by: Cezary Rojewski +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200224125202.13784-1-amadeuszx.slawinski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/intel/skylake/skl-ssp-clk.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/sound/soc/intel/skylake/skl-ssp-clk.c ++++ b/sound/soc/intel/skylake/skl-ssp-clk.c +@@ -384,9 +384,11 @@ static int skl_clk_dev_probe(struct plat + &clks[i], clk_pdata, i); + + if (IS_ERR(data->clk[data->avail_clk_cnt])) { +- ret = PTR_ERR(data->clk[data->avail_clk_cnt++]); ++ ret = PTR_ERR(data->clk[data->avail_clk_cnt]); + goto err_unreg_skl_clk; + } ++ ++ data->avail_clk_cnt++; + } + + platform_set_drvdata(pdev, data); diff --git a/queue-5.5/asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch b/queue-5.5/asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch new file mode 100644 index 00000000000..d6c03b4b389 --- /dev/null +++ b/queue-5.5/asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch @@ -0,0 +1,84 @@ +From 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 18 Feb 2020 12:17:37 +0100 +Subject: ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output + +From: Takashi Iwai + +commit 6c89ffea60aa3b2a33ae7987de1e84bfb89e4c9e upstream. + +dpcm_show_state() invokes multiple snprintf() calls to concatenate +formatted strings on the fixed size buffer. The usage of snprintf() +is supposed for avoiding the buffer overflow, but it doesn't work as +expected because snprintf() doesn't return the actual output size but +the size to be written. + +Fix this bug by replacing all snprintf() calls with scnprintf() +calls. + +Fixes: f86dcef87b77 ("ASoC: dpcm: Add debugFS support for DPCM") +Signed-off-by: Takashi Iwai +Acked-by: Cezary Rojewski +Link: https://lore.kernel.org/r/20200218111737.14193-4-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-pcm.c | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -3192,16 +3192,16 @@ static ssize_t dpcm_show_state(struct sn + unsigned long flags; + + /* FE state */ +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + "[%s - %s]\n", fe->dai_link->name, + stream ? "Capture" : "Playback"); + +- offset += snprintf(buf + offset, size - offset, "State: %s\n", ++ offset += scnprintf(buf + offset, size - offset, "State: %s\n", + dpcm_state_string(fe->dpcm[stream].state)); + + if ((fe->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) && + (fe->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP)) +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + "Hardware Params: " + "Format = %s, Channels = %d, Rate = %d\n", + snd_pcm_format_name(params_format(params)), +@@ -3209,10 +3209,10 @@ static ssize_t dpcm_show_state(struct sn + params_rate(params)); + + /* BEs state */ +- offset += snprintf(buf + offset, size - offset, "Backends:\n"); ++ offset += scnprintf(buf + offset, size - offset, "Backends:\n"); + + if (list_empty(&fe->dpcm[stream].be_clients)) { +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + " No active DSP links\n"); + goto out; + } +@@ -3222,16 +3222,16 @@ static ssize_t dpcm_show_state(struct sn + struct snd_soc_pcm_runtime *be = dpcm->be; + params = &dpcm->hw_params; + +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + "- %s\n", be->dai_link->name); + +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + " State: %s\n", + dpcm_state_string(be->dpcm[stream].state)); + + if ((be->dpcm[stream].state >= SND_SOC_DPCM_STATE_HW_PARAMS) && + (be->dpcm[stream].state <= SND_SOC_DPCM_STATE_STOP)) +- offset += snprintf(buf + offset, size - offset, ++ offset += scnprintf(buf + offset, size - offset, + " Hardware Params: " + "Format = %s, Channels = %d, Rate = %d\n", + snd_pcm_format_name(params_format(params)), diff --git a/queue-5.5/asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch b/queue-5.5/asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch new file mode 100644 index 00000000000..2860c17bae9 --- /dev/null +++ b/queue-5.5/asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch @@ -0,0 +1,47 @@ +From ac0a68997935c4acb92eaae5ad8982e0bb432d56 Mon Sep 17 00:00:00 2001 +From: Matthias Reichl +Date: Thu, 20 Feb 2020 21:29:56 +0100 +Subject: ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path + +From: Matthias Reichl + +commit ac0a68997935c4acb92eaae5ad8982e0bb432d56 upstream. + +When we get a clock error during probe we have to call +regulator_bulk_disable before bailing out, otherwise we trigger +a warning in regulator_put. + +Fix this by using "goto err" like in the error cases above. + +Fixes: 5a3af1293194d ("ASoC: pcm512x: Add PCM512x driver") +Signed-off-by: Matthias Reichl +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200220202956.29233-1-hias@horus.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/codecs/pcm512x.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +--- a/sound/soc/codecs/pcm512x.c ++++ b/sound/soc/codecs/pcm512x.c +@@ -1564,13 +1564,15 @@ int pcm512x_probe(struct device *dev, st + } + + pcm512x->sclk = devm_clk_get(dev, NULL); +- if (PTR_ERR(pcm512x->sclk) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(pcm512x->sclk) == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto err; ++ } + if (!IS_ERR(pcm512x->sclk)) { + ret = clk_prepare_enable(pcm512x->sclk); + if (ret != 0) { + dev_err(dev, "Failed to enable SCLK: %d\n", ret); +- return ret; ++ goto err; + } + } + diff --git a/queue-5.5/asoc-soc-component-tidyup-snd_soc_pcm_component_sync_stop.patch b/queue-5.5/asoc-soc-component-tidyup-snd_soc_pcm_component_sync_stop.patch new file mode 100644 index 00000000000..a9727d95187 --- /dev/null +++ b/queue-5.5/asoc-soc-component-tidyup-snd_soc_pcm_component_sync_stop.patch @@ -0,0 +1,36 @@ +From f1861a7c58ba1ba43c7adff6909d9a920338e4a8 Mon Sep 17 00:00:00 2001 +From: Kuninori Morimoto +Date: Fri, 28 Feb 2020 10:48:35 +0900 +Subject: ASoC: soc-component: tidyup snd_soc_pcm_component_sync_stop() + +From: Kuninori Morimoto + +commit f1861a7c58ba1ba43c7adff6909d9a920338e4a8 upstream. + +commit 1e5ddb6ba73894 ("ASoC: component: Add sync_stop PCM ops") +added snd_soc_pcm_component_sync_stop(), but it is checking +ioctrl instead of sync_stop. This is bug. +This patch fixup it. + +Fixes: commit 1e5ddb6ba73894 ("ASoC: component: Add sync_stop PCM ops") +Signed-off-by: Kuninori Morimoto +Cc: Takashi Iwai +Link: https://lore.kernel.org/r/8736av7a8c.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + sound/soc/soc-component.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/soc/soc-component.c ++++ b/sound/soc/soc-component.c +@@ -452,7 +452,7 @@ int snd_soc_pcm_component_sync_stop(stru + int ret; + + for_each_rtd_components(rtd, rtdcom, component) { +- if (component->driver->ioctl) { ++ if (component->driver->sync_stop) { + ret = component->driver->sync_stop(component, + substream); + if (ret < 0) diff --git a/queue-5.5/drm-i915-perf-reintroduce-wait-on-oa-configuration-completion.patch b/queue-5.5/drm-i915-perf-reintroduce-wait-on-oa-configuration-completion.patch new file mode 100644 index 00000000000..e34f4ab073f --- /dev/null +++ b/queue-5.5/drm-i915-perf-reintroduce-wait-on-oa-configuration-completion.patch @@ -0,0 +1,196 @@ +From 08f56f8f3799b2ed1c5ac7eed6d86a4926289655 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 2 Mar 2020 08:57:57 +0000 +Subject: drm/i915/perf: Reintroduce wait on OA configuration completion + +From: Chris Wilson + +commit 08f56f8f3799b2ed1c5ac7eed6d86a4926289655 upstream. + +We still need to wait for the initial OA configuration to happen +before we enable OA report writes to the OA buffer. + +Reported-by: Lionel Landwerlin +Fixes: 15d0ace1f876 ("drm/i915/perf: execute OA configuration from command stream") +Closes: https://gitlab.freedesktop.org/drm/intel/issues/1356 +Testcase: igt/perf/stream-open-close +Signed-off-by: Chris Wilson +Cc: Lionel Landwerlin +Reviewed-by: Lionel Landwerlin +Link: https://patchwork.freedesktop.org/patch/msgid/20200302085812.4172450-7-chris@chris-wilson.co.uk +(cherry picked from commit 4b4e973d5eb89244b67d3223b60f752d0479f253) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/i915_perf.c | 58 +++++++++++++++++++++++---------- + drivers/gpu/drm/i915/i915_perf_types.h | 3 + + 2 files changed, 43 insertions(+), 18 deletions(-) + +--- a/drivers/gpu/drm/i915/i915_perf.c ++++ b/drivers/gpu/drm/i915/i915_perf.c +@@ -1950,9 +1950,10 @@ out: + return i915_vma_get(oa_bo->vma); + } + +-static int emit_oa_config(struct i915_perf_stream *stream, +- struct i915_oa_config *oa_config, +- struct intel_context *ce) ++static struct i915_request * ++emit_oa_config(struct i915_perf_stream *stream, ++ struct i915_oa_config *oa_config, ++ struct intel_context *ce) + { + struct i915_request *rq; + struct i915_vma *vma; +@@ -1960,7 +1961,7 @@ static int emit_oa_config(struct i915_pe + + vma = get_oa_vma(stream, oa_config); + if (IS_ERR(vma)) +- return PTR_ERR(vma); ++ return ERR_CAST(vma); + + err = i915_vma_pin(vma, 0, 0, PIN_GLOBAL | PIN_HIGH); + if (err) +@@ -1983,13 +1984,17 @@ static int emit_oa_config(struct i915_pe + err = rq->engine->emit_bb_start(rq, + vma->node.start, 0, + I915_DISPATCH_SECURE); ++ if (err) ++ goto err_add_request; ++ ++ i915_request_get(rq); + err_add_request: + i915_request_add(rq); + err_vma_unpin: + i915_vma_unpin(vma); + err_vma_put: + i915_vma_put(vma); +- return err; ++ return err ? ERR_PTR(err) : rq; + } + + static struct intel_context *oa_context(struct i915_perf_stream *stream) +@@ -1997,7 +2002,8 @@ static struct intel_context *oa_context( + return stream->pinned_ctx ?: stream->engine->kernel_context; + } + +-static int hsw_enable_metric_set(struct i915_perf_stream *stream) ++static struct i915_request * ++hsw_enable_metric_set(struct i915_perf_stream *stream) + { + struct intel_uncore *uncore = stream->uncore; + +@@ -2408,7 +2414,8 @@ static int lrc_configure_all_contexts(st + return oa_configure_all_contexts(stream, regs, ARRAY_SIZE(regs)); + } + +-static int gen8_enable_metric_set(struct i915_perf_stream *stream) ++static struct i915_request * ++gen8_enable_metric_set(struct i915_perf_stream *stream) + { + struct intel_uncore *uncore = stream->uncore; + struct i915_oa_config *oa_config = stream->oa_config; +@@ -2450,12 +2457,13 @@ static int gen8_enable_metric_set(struct + */ + ret = lrc_configure_all_contexts(stream, oa_config); + if (ret) +- return ret; ++ return ERR_PTR(ret); + + return emit_oa_config(stream, oa_config, oa_context(stream)); + } + +-static int gen12_enable_metric_set(struct i915_perf_stream *stream) ++static struct i915_request * ++gen12_enable_metric_set(struct i915_perf_stream *stream) + { + struct intel_uncore *uncore = stream->uncore; + struct i915_oa_config *oa_config = stream->oa_config; +@@ -2488,7 +2496,7 @@ static int gen12_enable_metric_set(struc + */ + ret = gen12_configure_all_contexts(stream, oa_config); + if (ret) +- return ret; ++ return ERR_PTR(ret); + + /* + * For Gen12, performance counters are context +@@ -2498,7 +2506,7 @@ static int gen12_enable_metric_set(struc + if (stream->ctx) { + ret = gen12_configure_oar_context(stream, true); + if (ret) +- return ret; ++ return ERR_PTR(ret); + } + + return emit_oa_config(stream, oa_config, oa_context(stream)); +@@ -2693,6 +2701,20 @@ static const struct i915_perf_stream_ops + .read = i915_oa_read, + }; + ++static int i915_perf_stream_enable_sync(struct i915_perf_stream *stream) ++{ ++ struct i915_request *rq; ++ ++ rq = stream->perf->ops.enable_metric_set(stream); ++ if (IS_ERR(rq)) ++ return PTR_ERR(rq); ++ ++ i915_request_wait(rq, 0, MAX_SCHEDULE_TIMEOUT); ++ i915_request_put(rq); ++ ++ return 0; ++} ++ + /** + * i915_oa_stream_init - validate combined props for OA stream and init + * @stream: An i915 perf stream +@@ -2826,7 +2848,7 @@ static int i915_oa_stream_init(struct i9 + stream->ops = &i915_oa_stream_ops; + perf->exclusive_stream = stream; + +- ret = perf->ops.enable_metric_set(stream); ++ ret = i915_perf_stream_enable_sync(stream); + if (ret) { + DRM_DEBUG("Unable to enable metric set\n"); + goto err_enable; +@@ -3144,7 +3166,7 @@ static long i915_perf_config_locked(stru + return -EINVAL; + + if (config != stream->oa_config) { +- int err; ++ struct i915_request *rq; + + /* + * If OA is bound to a specific context, emit the +@@ -3155,11 +3177,13 @@ static long i915_perf_config_locked(stru + * When set globally, we use a low priority kernel context, + * so it will effectively take effect when idle. + */ +- err = emit_oa_config(stream, config, oa_context(stream)); +- if (err == 0) ++ rq = emit_oa_config(stream, config, oa_context(stream)); ++ if (!IS_ERR(rq)) { + config = xchg(&stream->oa_config, config); +- else +- ret = err; ++ i915_request_put(rq); ++ } else { ++ ret = PTR_ERR(rq); ++ } + } + + i915_oa_config_put(config); +--- a/drivers/gpu/drm/i915/i915_perf_types.h ++++ b/drivers/gpu/drm/i915/i915_perf_types.h +@@ -339,7 +339,8 @@ struct i915_oa_ops { + * counter reports being sampled. May apply system constraints such as + * disabling EU clock gating as required. + */ +- int (*enable_metric_set)(struct i915_perf_stream *stream); ++ struct i915_request * ++ (*enable_metric_set)(struct i915_perf_stream *stream); + + /** + * @disable_metric_set: Remove system constraints associated with using diff --git a/queue-5.5/drm-i915-program-mbus-with-rmw-during-initialization.patch b/queue-5.5/drm-i915-program-mbus-with-rmw-during-initialization.patch new file mode 100644 index 00000000000..78a43ddcbb3 --- /dev/null +++ b/queue-5.5/drm-i915-program-mbus-with-rmw-during-initialization.patch @@ -0,0 +1,57 @@ +From c725161924f9a5872a3e53b73345a6026a5c170e Mon Sep 17 00:00:00 2001 +From: Matt Roper +Date: Thu, 27 Feb 2020 16:43:19 -0800 +Subject: drm/i915: Program MBUS with rmw during initialization + +From: Matt Roper + +commit c725161924f9a5872a3e53b73345a6026a5c170e upstream. + +It wasn't terribly clear from the bspec's wording, but after discussion +with the hardware folks, it turns out that we need to preserve the +pre-existing contents of the MBUS ABOX control register when +initializing a few specific bits. + +Bspec: 49213 +Bspec: 50096 +Fixes: 4cb4585e5a7f ("drm/i915/icl: initialize MBus during display init") +Cc: Stanislav Lisovskiy +Signed-off-by: Matt Roper +Link: https://patchwork.freedesktop.org/patch/msgid/20200204011032.582737-1-matthew.d.roper@intel.com +Reviewed-by: Matt Atwood +(cherry picked from commit 837b63e6087838d0f1e612d448405419199d8033) +Signed-off-by: Jani Nikula +Link: https://patchwork.freedesktop.org/patch/msgid/20200228004320.127142-1-matthew.d.roper@intel.com +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/display/intel_display_power.c | 16 +++++++++++----- + 1 file changed, 11 insertions(+), 5 deletions(-) + +--- a/drivers/gpu/drm/i915/display/intel_display_power.c ++++ b/drivers/gpu/drm/i915/display/intel_display_power.c +@@ -4471,13 +4471,19 @@ static void icl_dbuf_disable(struct drm_ + + static void icl_mbus_init(struct drm_i915_private *dev_priv) + { +- u32 val; ++ u32 mask, val; + +- val = MBUS_ABOX_BT_CREDIT_POOL1(16) | +- MBUS_ABOX_BT_CREDIT_POOL2(16) | +- MBUS_ABOX_B_CREDIT(1) | +- MBUS_ABOX_BW_CREDIT(1); ++ mask = MBUS_ABOX_BT_CREDIT_POOL1_MASK | ++ MBUS_ABOX_BT_CREDIT_POOL2_MASK | ++ MBUS_ABOX_B_CREDIT_MASK | ++ MBUS_ABOX_BW_CREDIT_MASK; + ++ val = I915_READ(MBUS_ABOX_CTL); ++ val &= ~mask; ++ val |= MBUS_ABOX_BT_CREDIT_POOL1(16) | ++ MBUS_ABOX_BT_CREDIT_POOL2(16) | ++ MBUS_ABOX_B_CREDIT(1) | ++ MBUS_ABOX_BW_CREDIT(1); + I915_WRITE(MBUS_ABOX_CTL, val); + } + diff --git a/queue-5.5/drm-i915-selftests-fix-return-in-assert_mmap_offset.patch b/queue-5.5/drm-i915-selftests-fix-return-in-assert_mmap_offset.patch new file mode 100644 index 00000000000..748c356121f --- /dev/null +++ b/queue-5.5/drm-i915-selftests-fix-return-in-assert_mmap_offset.patch @@ -0,0 +1,37 @@ +From f4aaa44e8b20f7e0d4ea68d3bca4968b6ae5aaff Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Fri, 28 Feb 2020 17:14:13 +0300 +Subject: drm/i915/selftests: Fix return in assert_mmap_offset() + +From: Dan Carpenter + +commit f4aaa44e8b20f7e0d4ea68d3bca4968b6ae5aaff upstream. + +The assert_mmap_offset() returns type bool so if we return an error +pointer that is "return true;" or success. If we have an error, then +we should return false. + +Fixes: 3d81d589d6e3 ("drm/i915: Test exhaustion of the mmap space") +Signed-off-by: Dan Carpenter +Reviewed-by: Chris Wilson +Signed-off-by: Chris Wilson +Link: https://patchwork.freedesktop.org/patch/msgid/20200228141413.qfjf4abr323drlo4@kili.mountain +(cherry picked from commit efbf928824820f2738f41271934f6ec2c6ebd587) +Signed-off-by: Jani Nikula +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c ++++ b/drivers/gpu/drm/i915/gem/selftests/i915_gem_mman.c +@@ -567,7 +567,7 @@ static bool assert_mmap_offset(struct dr + + obj = i915_gem_object_create_internal(i915, size); + if (IS_ERR(obj)) +- return PTR_ERR(obj); ++ return false; + + err = create_mmap_offset(obj); + i915_gem_object_put(obj); diff --git a/queue-5.5/drm-kirin-revert-fix-for-hikey620-display-offset-problem.patch b/queue-5.5/drm-kirin-revert-fix-for-hikey620-display-offset-problem.patch new file mode 100644 index 00000000000..28fdd3734b1 --- /dev/null +++ b/queue-5.5/drm-kirin-revert-fix-for-hikey620-display-offset-problem.patch @@ -0,0 +1,112 @@ +From 1b79cfd99ff5127e6a143767b51694a527b3ea38 Mon Sep 17 00:00:00 2001 +From: John Stultz +Date: Tue, 3 Mar 2020 16:32:28 +0000 +Subject: drm: kirin: Revert "Fix for hikey620 display offset problem" + +From: John Stultz + +commit 1b79cfd99ff5127e6a143767b51694a527b3ea38 upstream. + +This reverts commit ff57c6513820efe945b61863cf4a51b79f18b592. + +With the commit ff57c6513820 ("drm: kirin: Fix for hikey620 +display offset problem") we added support for handling LDI +overflows by resetting the hardware. + +However, its been observed that when we do hit the LDI overflow +condition, the irq seems to be screaming, and we do nothing but +stream: + [drm:ade_irq_handler [kirin_drm]] *ERROR* LDI underflow! +over and over to the screen + +I've tried a few appraoches to avoid this, but none has yet +been successful and the cure here is worse then the original +disease, so revert this for now. + +Cc: Xinliang Liu +Cc: Rongrong Zou +Cc: Xinwei Kong +Cc: Chen Feng +Cc: Sam Ravnborg +Cc: David Airlie +Cc: Daniel Vetter +Cc: dri-devel +Fixes: ff57c6513820 ("drm: kirin: Fix for hikey620 display offset problem") +Signed-off-by: John Stultz +Acked-by: Xinliang Liu +Signed-off-by: Xinliang Liu +Link: https://patchwork.freedesktop.org/patch/msgid/20200303163228.52741-1-john.stultz@linaro.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/hisilicon/kirin/kirin_ade_reg.h | 1 - + drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c | 20 -------------------- + 2 files changed, 21 deletions(-) + +--- a/drivers/gpu/drm/hisilicon/kirin/kirin_ade_reg.h ++++ b/drivers/gpu/drm/hisilicon/kirin/kirin_ade_reg.h +@@ -83,7 +83,6 @@ + #define VSIZE_OFST 20 + #define LDI_INT_EN 0x741C + #define FRAME_END_INT_EN_OFST 1 +-#define UNDERFLOW_INT_EN_OFST 2 + #define LDI_CTRL 0x7420 + #define BPP_OFST 3 + #define DATA_GATE_EN BIT(2) +--- a/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c ++++ b/drivers/gpu/drm/hisilicon/kirin/kirin_drm_ade.c +@@ -46,7 +46,6 @@ struct ade_hw_ctx { + struct clk *media_noc_clk; + struct clk *ade_pix_clk; + struct reset_control *reset; +- struct work_struct display_reset_wq; + bool power_on; + int irq; + +@@ -136,7 +135,6 @@ static void ade_init(struct ade_hw_ctx * + */ + ade_update_bits(base + ADE_CTRL, FRM_END_START_OFST, + FRM_END_START_MASK, REG_EFFECTIVE_IN_ADEEN_FRMEND); +- ade_update_bits(base + LDI_INT_EN, UNDERFLOW_INT_EN_OFST, MASK(1), 1); + } + + static bool ade_crtc_mode_fixup(struct drm_crtc *crtc, +@@ -304,17 +302,6 @@ static void ade_crtc_disable_vblank(stru + MASK(1), 0); + } + +-static void drm_underflow_wq(struct work_struct *work) +-{ +- struct ade_hw_ctx *ctx = container_of(work, struct ade_hw_ctx, +- display_reset_wq); +- struct drm_device *drm_dev = ctx->crtc->dev; +- struct drm_atomic_state *state; +- +- state = drm_atomic_helper_suspend(drm_dev); +- drm_atomic_helper_resume(drm_dev, state); +-} +- + static irqreturn_t ade_irq_handler(int irq, void *data) + { + struct ade_hw_ctx *ctx = data; +@@ -331,12 +318,6 @@ static irqreturn_t ade_irq_handler(int i + MASK(1), 1); + drm_crtc_handle_vblank(crtc); + } +- if (status & BIT(UNDERFLOW_INT_EN_OFST)) { +- ade_update_bits(base + LDI_INT_CLR, UNDERFLOW_INT_EN_OFST, +- MASK(1), 1); +- DRM_ERROR("LDI underflow!"); +- schedule_work(&ctx->display_reset_wq); +- } + + return IRQ_HANDLED; + } +@@ -919,7 +900,6 @@ static void *ade_hw_ctx_alloc(struct pla + if (ret) + return ERR_PTR(-EIO); + +- INIT_WORK(&ctx->display_reset_wq, drm_underflow_wq); + ctx->crtc = crtc; + + return ctx; diff --git a/queue-5.5/drm-mediatek-handle-component-type-mtk_disp_ovl_2l-correctly.patch b/queue-5.5/drm-mediatek-handle-component-type-mtk_disp_ovl_2l-correctly.patch new file mode 100644 index 00000000000..a068ec2d84a --- /dev/null +++ b/queue-5.5/drm-mediatek-handle-component-type-mtk_disp_ovl_2l-correctly.patch @@ -0,0 +1,33 @@ +From 3d2ed431b8f39483477bc3c3a2aefbc9778ffe12 Mon Sep 17 00:00:00 2001 +From: Phong LE +Date: Wed, 19 Feb 2020 15:13:24 +0100 +Subject: drm/mediatek: Handle component type MTK_DISP_OVL_2L correctly + +From: Phong LE + +commit 3d2ed431b8f39483477bc3c3a2aefbc9778ffe12 upstream. + +The larb device remains NULL if the type is MTK_DISP_OVL_2L. +A kernel panic is raised when a crtc uses mtk_smi_larb_get or +mtk_smi_larb_put. + +Fixes: b17bdd0d7a73 ("drm/mediatek: add component OVL_2L0") + +Signed-off-by: Phong LE +Signed-off-by: CK Hu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +@@ -358,6 +358,7 @@ int mtk_ddp_comp_init(struct device *dev + /* Only DMA capable components need the LARB property */ + comp->larb_dev = NULL; + if (type != MTK_DISP_OVL && ++ type != MTK_DISP_OVL_2L && + type != MTK_DISP_RDMA && + type != MTK_DISP_WDMA) + return 0; diff --git a/queue-5.5/drm-panfrost-don-t-try-to-map-on-error-faults.patch b/queue-5.5/drm-panfrost-don-t-try-to-map-on-error-faults.patch new file mode 100644 index 00000000000..6dffd0cf1ee --- /dev/null +++ b/queue-5.5/drm-panfrost-don-t-try-to-map-on-error-faults.patch @@ -0,0 +1,82 @@ +From eb9d8ddbc107d02e489681f9dcbf93949e1a99a4 Mon Sep 17 00:00:00 2001 +From: Tomeu Vizoso +Date: Wed, 12 Feb 2020 14:22:36 -0600 +Subject: drm/panfrost: Don't try to map on error faults + +From: Tomeu Vizoso + +commit eb9d8ddbc107d02e489681f9dcbf93949e1a99a4 upstream. + +If the exception type isn't a translation fault, don't try to map and +instead go straight to a terminal fault. + +Otherwise, we can get flooded by kernel warnings and further faults. + +Fixes: 187d2929206e ("drm/panfrost: Add support for GPU heap allocations") +Signed-off-by: Rob Herring +Signed-off-by: Tomeu Vizoso +Reviewed-by: Steven Price +Reviewed-by: Tomeu Vizoso +Acked-by: Alyssa Rosenzweig +Link: https://patchwork.freedesktop.org/patch/msgid/20200212202236.13095-1-robh@kernel.org +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/panfrost/panfrost_mmu.c | 44 +++++++++++++------------------- + 1 file changed, 19 insertions(+), 25 deletions(-) + +--- a/drivers/gpu/drm/panfrost/panfrost_mmu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_mmu.c +@@ -601,33 +601,27 @@ static irqreturn_t panfrost_mmu_irq_hand + source_id = (fault_status >> 16); + + /* Page fault only */ +- if ((status & mask) == BIT(i)) { +- WARN_ON(exception_type < 0xC1 || exception_type > 0xC4); +- ++ ret = -1; ++ if ((status & mask) == BIT(i) && (exception_type & 0xF8) == 0xC0) + ret = panfrost_mmu_map_fault_addr(pfdev, i, addr); +- if (!ret) { +- mmu_write(pfdev, MMU_INT_CLEAR, BIT(i)); +- status &= ~mask; +- continue; +- } +- } + +- /* terminal fault, print info about the fault */ +- dev_err(pfdev->dev, +- "Unhandled Page fault in AS%d at VA 0x%016llX\n" +- "Reason: %s\n" +- "raw fault status: 0x%X\n" +- "decoded fault status: %s\n" +- "exception type 0x%X: %s\n" +- "access type 0x%X: %s\n" +- "source id 0x%X\n", +- i, addr, +- "TODO", +- fault_status, +- (fault_status & (1 << 10) ? "DECODER FAULT" : "SLAVE FAULT"), +- exception_type, panfrost_exception_name(pfdev, exception_type), +- access_type, access_type_name(pfdev, fault_status), +- source_id); ++ if (ret) ++ /* terminal fault, print info about the fault */ ++ dev_err(pfdev->dev, ++ "Unhandled Page fault in AS%d at VA 0x%016llX\n" ++ "Reason: %s\n" ++ "raw fault status: 0x%X\n" ++ "decoded fault status: %s\n" ++ "exception type 0x%X: %s\n" ++ "access type 0x%X: %s\n" ++ "source id 0x%X\n", ++ i, addr, ++ "TODO", ++ fault_status, ++ (fault_status & (1 << 10) ? "DECODER FAULT" : "SLAVE FAULT"), ++ exception_type, panfrost_exception_name(pfdev, exception_type), ++ access_type, access_type_name(pfdev, fault_status), ++ source_id); + + mmu_write(pfdev, MMU_INT_CLEAR, mask); + diff --git a/queue-5.5/drm-sun4i-add-separate-de3-vi-layer-formats.patch b/queue-5.5/drm-sun4i-add-separate-de3-vi-layer-formats.patch new file mode 100644 index 00000000000..df17e3a8c69 --- /dev/null +++ b/queue-5.5/drm-sun4i-add-separate-de3-vi-layer-formats.patch @@ -0,0 +1,187 @@ +From 169ca4b38932112e8b2ee8baef9cea44678625b3 Mon Sep 17 00:00:00 2001 +From: Jernej Skrabec +Date: Mon, 24 Feb 2020 18:38:56 +0100 +Subject: drm/sun4i: Add separate DE3 VI layer formats + +From: Jernej Skrabec + +commit 169ca4b38932112e8b2ee8baef9cea44678625b3 upstream. + +DE3 VI layers support alpha blending, but DE2 VI layers do not. +Additionally, DE3 VI layers support 10-bit RGB and YUV formats. + +Make a separate list for DE3. + +Fixes: c50519e6db4d ("drm/sun4i: Add basic support for DE3") +Acked-by: Maxime Ripard +Signed-off-by: Jernej Skrabec +Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-3-jernej.skrabec@siol.net +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/sun4i/sun8i_mixer.c | 36 ++++++++++++++++++++ + drivers/gpu/drm/sun4i/sun8i_mixer.h | 11 ++++++ + drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 58 +++++++++++++++++++++++++++++++-- + 3 files changed, 102 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c +@@ -149,6 +149,30 @@ static const struct de2_fmt_info de2_for + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ .drm_fmt = DRM_FORMAT_ARGB2101010, ++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB2101010, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { ++ .drm_fmt = DRM_FORMAT_ABGR2101010, ++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR2101010, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { ++ .drm_fmt = DRM_FORMAT_RGBA1010102, ++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA1010102, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { ++ .drm_fmt = DRM_FORMAT_BGRA1010102, ++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA1010102, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_UYVY, + .de2_fmt = SUN8I_MIXER_FBFMT_UYVY, + .rgb = false, +@@ -244,6 +268,18 @@ static const struct de2_fmt_info de2_for + .rgb = false, + .csc = SUN8I_CSC_MODE_YVU2RGB, + }, ++ { ++ .drm_fmt = DRM_FORMAT_P010, ++ .de2_fmt = SUN8I_MIXER_FBFMT_P010_YUV, ++ .rgb = false, ++ .csc = SUN8I_CSC_MODE_YUV2RGB, ++ }, ++ { ++ .drm_fmt = DRM_FORMAT_P210, ++ .de2_fmt = SUN8I_MIXER_FBFMT_P210_YUV, ++ .rgb = false, ++ .csc = SUN8I_CSC_MODE_YUV2RGB, ++ }, + }; + + const struct de2_fmt_info *sun8i_mixer_format_info(u32 format) +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.h ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.h +@@ -93,6 +93,10 @@ + #define SUN8I_MIXER_FBFMT_ABGR1555 17 + #define SUN8I_MIXER_FBFMT_RGBA5551 18 + #define SUN8I_MIXER_FBFMT_BGRA5551 19 ++#define SUN8I_MIXER_FBFMT_ARGB2101010 20 ++#define SUN8I_MIXER_FBFMT_ABGR2101010 21 ++#define SUN8I_MIXER_FBFMT_RGBA1010102 22 ++#define SUN8I_MIXER_FBFMT_BGRA1010102 23 + + #define SUN8I_MIXER_FBFMT_YUYV 0 + #define SUN8I_MIXER_FBFMT_UYVY 1 +@@ -109,6 +113,13 @@ + /* format 12 is semi-planar YUV411 UVUV */ + /* format 13 is semi-planar YUV411 VUVU */ + #define SUN8I_MIXER_FBFMT_YUV411 14 ++/* format 15 doesn't exist */ ++/* format 16 is P010 YVU */ ++#define SUN8I_MIXER_FBFMT_P010_YUV 17 ++/* format 18 is P210 YVU */ ++#define SUN8I_MIXER_FBFMT_P210_YUV 19 ++/* format 20 is packed YVU444 10-bit */ ++/* format 21 is packed YUV444 10-bit */ + + /* + * Sub-engines listed bellow are unused for now. The EN registers are here only +--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c +@@ -438,24 +438,76 @@ static const u32 sun8i_vi_layer_formats[ + DRM_FORMAT_YVU444, + }; + ++static const u32 sun8i_vi_layer_de3_formats[] = { ++ DRM_FORMAT_ABGR1555, ++ DRM_FORMAT_ABGR2101010, ++ DRM_FORMAT_ABGR4444, ++ DRM_FORMAT_ABGR8888, ++ DRM_FORMAT_ARGB1555, ++ DRM_FORMAT_ARGB2101010, ++ DRM_FORMAT_ARGB4444, ++ DRM_FORMAT_ARGB8888, ++ DRM_FORMAT_BGR565, ++ DRM_FORMAT_BGR888, ++ DRM_FORMAT_BGRA1010102, ++ DRM_FORMAT_BGRA5551, ++ DRM_FORMAT_BGRA4444, ++ DRM_FORMAT_BGRA8888, ++ DRM_FORMAT_BGRX8888, ++ DRM_FORMAT_RGB565, ++ DRM_FORMAT_RGB888, ++ DRM_FORMAT_RGBA1010102, ++ DRM_FORMAT_RGBA4444, ++ DRM_FORMAT_RGBA5551, ++ DRM_FORMAT_RGBA8888, ++ DRM_FORMAT_RGBX8888, ++ DRM_FORMAT_XBGR8888, ++ DRM_FORMAT_XRGB8888, ++ ++ DRM_FORMAT_NV16, ++ DRM_FORMAT_NV12, ++ DRM_FORMAT_NV21, ++ DRM_FORMAT_NV61, ++ DRM_FORMAT_P010, ++ DRM_FORMAT_P210, ++ DRM_FORMAT_UYVY, ++ DRM_FORMAT_VYUY, ++ DRM_FORMAT_YUYV, ++ DRM_FORMAT_YVYU, ++ DRM_FORMAT_YUV411, ++ DRM_FORMAT_YUV420, ++ DRM_FORMAT_YUV422, ++ DRM_FORMAT_YVU411, ++ DRM_FORMAT_YVU420, ++ DRM_FORMAT_YVU422, ++}; ++ + struct sun8i_vi_layer *sun8i_vi_layer_init_one(struct drm_device *drm, + struct sun8i_mixer *mixer, + int index) + { + u32 supported_encodings, supported_ranges; ++ unsigned int plane_cnt, format_count; + struct sun8i_vi_layer *layer; +- unsigned int plane_cnt; ++ const u32 *formats; + int ret; + + layer = devm_kzalloc(drm->dev, sizeof(*layer), GFP_KERNEL); + if (!layer) + return ERR_PTR(-ENOMEM); + ++ if (mixer->cfg->is_de3) { ++ formats = sun8i_vi_layer_de3_formats; ++ format_count = ARRAY_SIZE(sun8i_vi_layer_de3_formats); ++ } else { ++ formats = sun8i_vi_layer_formats; ++ format_count = ARRAY_SIZE(sun8i_vi_layer_formats); ++ } ++ + /* possible crtcs are set later */ + ret = drm_universal_plane_init(drm, &layer->plane, 0, + &sun8i_vi_layer_funcs, +- sun8i_vi_layer_formats, +- ARRAY_SIZE(sun8i_vi_layer_formats), ++ formats, format_count, + NULL, DRM_PLANE_TYPE_OVERLAY, NULL); + if (ret) { + dev_err(drm->dev, "Couldn't initialize layer\n"); diff --git a/queue-5.5/drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch b/queue-5.5/drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch new file mode 100644 index 00000000000..701db32c5e7 --- /dev/null +++ b/queue-5.5/drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch @@ -0,0 +1,65 @@ +From a4769905f0ae32cae4f096f646ab03b8b4794c74 Mon Sep 17 00:00:00 2001 +From: Jernej Skrabec +Date: Mon, 24 Feb 2020 18:38:55 +0100 +Subject: drm/sun4i: de2/de3: Remove unsupported VI layer formats + +From: Jernej Skrabec + +commit a4769905f0ae32cae4f096f646ab03b8b4794c74 upstream. + +YUV444 and YVU444 are planar formats, but HW format RGB888 is packed. +This means that those two mappings were never correct. Remove them. + +Fixes: 60a3dcf96aa8 ("drm/sun4i: Add DE2 definitions for YUV formats") +Acked-by: Maxime Ripard +Signed-off-by: Jernej Skrabec +Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-2-jernej.skrabec@siol.net +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/sun4i/sun8i_mixer.c | 12 ------------ + drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 2 -- + 2 files changed, 14 deletions(-) + +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c +@@ -277,12 +277,6 @@ static const struct de2_fmt_info de2_for + .csc = SUN8I_CSC_MODE_YUV2RGB, + }, + { +- .drm_fmt = DRM_FORMAT_YUV444, +- .de2_fmt = SUN8I_MIXER_FBFMT_RGB888, +- .rgb = true, +- .csc = SUN8I_CSC_MODE_YUV2RGB, +- }, +- { + .drm_fmt = DRM_FORMAT_YUV422, + .de2_fmt = SUN8I_MIXER_FBFMT_YUV422, + .rgb = false, +@@ -301,12 +295,6 @@ static const struct de2_fmt_info de2_for + .csc = SUN8I_CSC_MODE_YUV2RGB, + }, + { +- .drm_fmt = DRM_FORMAT_YVU444, +- .de2_fmt = SUN8I_MIXER_FBFMT_RGB888, +- .rgb = true, +- .csc = SUN8I_CSC_MODE_YVU2RGB, +- }, +- { + .drm_fmt = DRM_FORMAT_YVU422, + .de2_fmt = SUN8I_MIXER_FBFMT_YUV422, + .rgb = false, +--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c +@@ -431,11 +431,9 @@ static const u32 sun8i_vi_layer_formats[ + DRM_FORMAT_YUV411, + DRM_FORMAT_YUV420, + DRM_FORMAT_YUV422, +- DRM_FORMAT_YUV444, + DRM_FORMAT_YVU411, + DRM_FORMAT_YVU420, + DRM_FORMAT_YVU422, +- DRM_FORMAT_YVU444, + }; + + static const u32 sun8i_vi_layer_de3_formats[] = { diff --git a/queue-5.5/drm-sun4i-fix-de2-vi-layer-format-support.patch b/queue-5.5/drm-sun4i-fix-de2-vi-layer-format-support.patch new file mode 100644 index 00000000000..fd7a7e57969 --- /dev/null +++ b/queue-5.5/drm-sun4i-fix-de2-vi-layer-format-support.patch @@ -0,0 +1,168 @@ +From 20896ef137340e9426cf322606f764452f5eb960 Mon Sep 17 00:00:00 2001 +From: Jernej Skrabec +Date: Mon, 24 Feb 2020 18:38:57 +0100 +Subject: drm/sun4i: Fix DE2 VI layer format support + +From: Jernej Skrabec + +commit 20896ef137340e9426cf322606f764452f5eb960 upstream. + +DE2 VI layer doesn't support blending which means alpha channel is +ignored. Replace all formats with alpha with "don't care" (X) channel. + +Fixes: 7480ba4d7571 ("drm/sun4i: Add support for DE2 VI planes") +Acked-by: Maxime Ripard +Signed-off-by: Jernej Skrabec +Link: https://patchwork.freedesktop.org/patch/msgid/20200224173901.174016-4-jernej.skrabec@siol.net +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/sun4i/sun8i_mixer.c | 56 +++++++++++++++++++++++++++++++++ + drivers/gpu/drm/sun4i/sun8i_vi_layer.c | 22 ++++++------ + 2 files changed, 67 insertions(+), 11 deletions(-) + +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c +@@ -107,46 +107,102 @@ static const struct de2_fmt_info de2_for + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_XRGB4444, ++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB4444, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_ABGR4444, + .de2_fmt = SUN8I_MIXER_FBFMT_ABGR4444, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_XBGR4444, ++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR4444, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_RGBA4444, + .de2_fmt = SUN8I_MIXER_FBFMT_RGBA4444, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_RGBX4444, ++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA4444, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_BGRA4444, + .de2_fmt = SUN8I_MIXER_FBFMT_BGRA4444, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_BGRX4444, ++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA4444, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_ARGB1555, + .de2_fmt = SUN8I_MIXER_FBFMT_ARGB1555, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_XRGB1555, ++ .de2_fmt = SUN8I_MIXER_FBFMT_ARGB1555, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_ABGR1555, + .de2_fmt = SUN8I_MIXER_FBFMT_ABGR1555, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_XBGR1555, ++ .de2_fmt = SUN8I_MIXER_FBFMT_ABGR1555, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_RGBA5551, + .de2_fmt = SUN8I_MIXER_FBFMT_RGBA5551, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, + }, + { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_RGBX5551, ++ .de2_fmt = SUN8I_MIXER_FBFMT_RGBA5551, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { + .drm_fmt = DRM_FORMAT_BGRA5551, + .de2_fmt = SUN8I_MIXER_FBFMT_BGRA5551, + .rgb = true, + .csc = SUN8I_CSC_MODE_OFF, ++ }, ++ { ++ /* for DE2 VI layer which ignores alpha */ ++ .drm_fmt = DRM_FORMAT_BGRX5551, ++ .de2_fmt = SUN8I_MIXER_FBFMT_BGRA5551, ++ .rgb = true, ++ .csc = SUN8I_CSC_MODE_OFF, + }, + { + .drm_fmt = DRM_FORMAT_ARGB2101010, +--- a/drivers/gpu/drm/sun4i/sun8i_vi_layer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_vi_layer.c +@@ -398,26 +398,26 @@ static const struct drm_plane_funcs sun8 + }; + + /* +- * While all RGB formats are supported, VI planes don't support +- * alpha blending, so there is no point having formats with alpha +- * channel if their opaque analog exist. ++ * While DE2 VI layer supports same RGB formats as UI layer, alpha ++ * channel is ignored. This structure lists all unique variants ++ * where alpha channel is replaced with "don't care" (X) channel. + */ + static const u32 sun8i_vi_layer_formats[] = { +- DRM_FORMAT_ABGR1555, +- DRM_FORMAT_ABGR4444, +- DRM_FORMAT_ARGB1555, +- DRM_FORMAT_ARGB4444, + DRM_FORMAT_BGR565, + DRM_FORMAT_BGR888, +- DRM_FORMAT_BGRA5551, +- DRM_FORMAT_BGRA4444, ++ DRM_FORMAT_BGRX4444, ++ DRM_FORMAT_BGRX5551, + DRM_FORMAT_BGRX8888, + DRM_FORMAT_RGB565, + DRM_FORMAT_RGB888, +- DRM_FORMAT_RGBA4444, +- DRM_FORMAT_RGBA5551, ++ DRM_FORMAT_RGBX4444, ++ DRM_FORMAT_RGBX5551, + DRM_FORMAT_RGBX8888, ++ DRM_FORMAT_XBGR1555, ++ DRM_FORMAT_XBGR4444, + DRM_FORMAT_XBGR8888, ++ DRM_FORMAT_XRGB1555, ++ DRM_FORMAT_XRGB4444, + DRM_FORMAT_XRGB8888, + + DRM_FORMAT_NV16, diff --git a/queue-5.5/drm-ttm-fix-leaking-fences-via-ttm_buffer_object_transfer.patch b/queue-5.5/drm-ttm-fix-leaking-fences-via-ttm_buffer_object_transfer.patch new file mode 100644 index 00000000000..b342faad91c --- /dev/null +++ b/queue-5.5/drm-ttm-fix-leaking-fences-via-ttm_buffer_object_transfer.patch @@ -0,0 +1,45 @@ +From 8c8c06207bcfc5a7e5918fc0a0f7f7b9a2e196d6 Mon Sep 17 00:00:00 2001 +From: Ahzo +Date: Tue, 25 Feb 2020 13:56:14 -0500 +Subject: drm/ttm: fix leaking fences via ttm_buffer_object_transfer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ahzo + +commit 8c8c06207bcfc5a7e5918fc0a0f7f7b9a2e196d6 upstream. + +Set the drm_device to NULL, so that the newly created buffer object +doesn't appear to use the embedded gem object. + +This is necessary, because otherwise no corresponding dma_resv_fini for +the dma_resv_init is called, resulting in a memory leak. + +The dma_resv_fini in ttm_bo_release_list is only called if the embedded +gem object is not used, which is determined by checking if the +drm_device is NULL. + +Bug: https://gitlab.freedesktop.org/drm/amd/issues/958 +Fixes: 1e053b10ba60 ("drm/ttm: use gem reservation object") +Reviewed-by: Christian König +Signed-off-by: Ahzo +Signed-off-by: Alex Deucher +Signed-off-by: Christian König +Link: https://patchwork.freedesktop.org/patch/355089/ +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/ttm/ttm_bo_util.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/ttm/ttm_bo_util.c ++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c +@@ -516,6 +516,7 @@ static int ttm_buffer_object_transfer(st + fbo->base.base.resv = &fbo->base.base._resv; + + dma_resv_init(&fbo->base.base._resv); ++ fbo->base.base.dev = NULL; + ret = dma_resv_trylock(&fbo->base.base._resv); + WARN_ON(!ret); + diff --git a/queue-5.5/firmware-imx-align-imx_sc_msg_req_cpu_start-to-4.patch b/queue-5.5/firmware-imx-align-imx_sc_msg_req_cpu_start-to-4.patch new file mode 100644 index 00000000000..53be35f9c01 --- /dev/null +++ b/queue-5.5/firmware-imx-align-imx_sc_msg_req_cpu_start-to-4.patch @@ -0,0 +1,36 @@ +From f5bfeff44612d304deb100065a9f712309dc2783 Mon Sep 17 00:00:00 2001 +From: Leonard Crestez +Date: Thu, 20 Feb 2020 18:29:36 +0200 +Subject: firmware: imx: Align imx_sc_msg_req_cpu_start to 4 + +From: Leonard Crestez + +commit f5bfeff44612d304deb100065a9f712309dc2783 upstream. + +The imx SC api strongly assumes that messages are composed out of +4-bytes words but some of our message structs have odd sizeofs. + +This produces many oopses with CONFIG_KASAN=y. + +Fix by marking with __aligned(4). + +Fixes: d90bf296ae18 ("firmware: imx: Add support to start/stop a CPU") +Signed-off-by: Leonard Crestez +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/imx/misc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/firmware/imx/misc.c ++++ b/drivers/firmware/imx/misc.c +@@ -24,7 +24,7 @@ struct imx_sc_msg_req_cpu_start { + u32 address_lo; + u16 resource; + u8 enable; +-} __packed; ++} __packed __aligned(4); + + struct imx_sc_msg_req_misc_get_ctrl { + struct imx_sc_rpc_msg hdr; diff --git a/queue-5.5/firmware-imx-misc-align-imx-sc-msg-structs-to-4.patch b/queue-5.5/firmware-imx-misc-align-imx-sc-msg-structs-to-4.patch new file mode 100644 index 00000000000..bba483a5f49 --- /dev/null +++ b/queue-5.5/firmware-imx-misc-align-imx-sc-msg-structs-to-4.patch @@ -0,0 +1,54 @@ +From 1e6a4eba693ac72e6f91b4252458c933110e5f4c Mon Sep 17 00:00:00 2001 +From: Leonard Crestez +Date: Thu, 20 Feb 2020 18:29:34 +0200 +Subject: firmware: imx: misc: Align imx sc msg structs to 4 + +From: Leonard Crestez + +commit 1e6a4eba693ac72e6f91b4252458c933110e5f4c upstream. + +The imx SC api strongly assumes that messages are composed out of +4-bytes words but some of our message structs have odd sizeofs. + +This produces many oopses with CONFIG_KASAN=y: + + BUG: KASAN: stack-out-of-bounds in imx_mu_send_data+0x108/0x1f0 + +It shouldn't cause an issues in normal use because these structs are +always allocated on the stack. + +Fixes: 15e1f2bc8b3b ("firmware: imx: add misc svc support") +Signed-off-by: Leonard Crestez +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/imx/misc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/firmware/imx/misc.c ++++ b/drivers/firmware/imx/misc.c +@@ -16,7 +16,7 @@ struct imx_sc_msg_req_misc_set_ctrl { + u32 ctrl; + u32 val; + u16 resource; +-} __packed; ++} __packed __aligned(4); + + struct imx_sc_msg_req_cpu_start { + struct imx_sc_rpc_msg hdr; +@@ -30,12 +30,12 @@ struct imx_sc_msg_req_misc_get_ctrl { + struct imx_sc_rpc_msg hdr; + u32 ctrl; + u16 resource; +-} __packed; ++} __packed __aligned(4); + + struct imx_sc_msg_resp_misc_get_ctrl { + struct imx_sc_rpc_msg hdr; + u32 val; +-} __packed; ++} __packed __aligned(4); + + /* + * This function sets a miscellaneous control value. diff --git a/queue-5.5/firmware-imx-scu-pd-align-imx-sc-msg-structs-to-4.patch b/queue-5.5/firmware-imx-scu-pd-align-imx-sc-msg-structs-to-4.patch new file mode 100644 index 00000000000..01dfebbdc35 --- /dev/null +++ b/queue-5.5/firmware-imx-scu-pd-align-imx-sc-msg-structs-to-4.patch @@ -0,0 +1,36 @@ +From 7c1a1c814ccc858633c761951c2546041202b24e Mon Sep 17 00:00:00 2001 +From: Leonard Crestez +Date: Thu, 20 Feb 2020 18:29:35 +0200 +Subject: firmware: imx: scu-pd: Align imx sc msg structs to 4 + +From: Leonard Crestez + +commit 7c1a1c814ccc858633c761951c2546041202b24e upstream. + +The imx SC api strongly assumes that messages are composed out of +4-bytes words but some of our message structs have odd sizeofs. + +This produces many oopses with CONFIG_KASAN=y. + +Fix by marking with __aligned(4). + +Fixes: c800cd7824bd ("firmware: imx: add SCU power domain driver") +Signed-off-by: Leonard Crestez +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/firmware/imx/scu-pd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/firmware/imx/scu-pd.c ++++ b/drivers/firmware/imx/scu-pd.c +@@ -61,7 +61,7 @@ struct imx_sc_msg_req_set_resource_power + struct imx_sc_rpc_msg hdr; + u16 resource; + u8 mode; +-} __packed; ++} __packed __aligned(4); + + #define IMX_SCU_PD_NAME_SIZE 20 + struct imx_sc_pm_domain { diff --git a/queue-5.5/ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch b/queue-5.5/ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch new file mode 100644 index 00000000000..1fc243edce5 --- /dev/null +++ b/queue-5.5/ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch @@ -0,0 +1,66 @@ +From 817a68a6584aa08e323c64283fec5ded7be84759 Mon Sep 17 00:00:00 2001 +From: Dennis Dalessandro +Date: Tue, 25 Feb 2020 14:54:45 -0500 +Subject: IB/hfi1, qib: Ensure RCU is locked when accessing list + +From: Dennis Dalessandro + +commit 817a68a6584aa08e323c64283fec5ded7be84759 upstream. + +The packet handling function, specifically the iteration of the qp list +for mad packet processing misses locking RCU before running through the +list. Not only is this incorrect, but the list_for_each_entry_rcu() call +can not be called with a conditional check for lock dependency. Remedy +this by invoking the rcu lock and unlock around the critical section. + +This brings MAD packet processing in line with what is done for non-MAD +packets. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Link: https://lore.kernel.org/r/20200225195445.140896.41873.stgit@awfm-01.aw.intel.com +Reviewed-by: Mike Marciniszyn +Signed-off-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/hfi1/verbs.c | 4 +++- + drivers/infiniband/hw/qib/qib_verbs.c | 2 ++ + 2 files changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -515,10 +515,11 @@ static inline void hfi1_handle_packet(st + opa_get_lid(packet->dlid, 9B)); + if (!mcast) + goto drop; ++ rcu_read_lock(); + list_for_each_entry_rcu(p, &mcast->qp_list, list) { + packet->qp = p->qp; + if (hfi1_do_pkey_check(packet)) +- goto drop; ++ goto unlock_drop; + spin_lock_irqsave(&packet->qp->r_lock, flags); + packet_handler = qp_ok(packet); + if (likely(packet_handler)) +@@ -527,6 +528,7 @@ static inline void hfi1_handle_packet(st + ibp->rvp.n_pkt_drops++; + spin_unlock_irqrestore(&packet->qp->r_lock, flags); + } ++ rcu_read_unlock(); + /* + * Notify rvt_multicast_detach() if it is waiting for us + * to finish. +--- a/drivers/infiniband/hw/qib/qib_verbs.c ++++ b/drivers/infiniband/hw/qib/qib_verbs.c +@@ -329,8 +329,10 @@ void qib_ib_rcv(struct qib_ctxtdata *rcd + if (mcast == NULL) + goto drop; + this_cpu_inc(ibp->pmastats->n_multicast_rcv); ++ rcu_read_lock(); + list_for_each_entry_rcu(p, &mcast->qp_list, list) + qib_qp_rcv(rcd, hdr, 1, data, tlen, p->qp); ++ rcu_read_unlock(); + /* + * Notify rvt_multicast_detach() if it is waiting for us + * to finish. diff --git a/queue-5.5/ib-mlx5-fix-implicit-odp-race.patch b/queue-5.5/ib-mlx5-fix-implicit-odp-race.patch new file mode 100644 index 00000000000..8418ff2d4ab --- /dev/null +++ b/queue-5.5/ib-mlx5-fix-implicit-odp-race.patch @@ -0,0 +1,122 @@ +From de5ed007a03d71daaa505f5daa4d3666530c7090 Mon Sep 17 00:00:00 2001 +From: Artemy Kovalyov +Date: Thu, 27 Feb 2020 13:39:18 +0200 +Subject: IB/mlx5: Fix implicit ODP race + +From: Artemy Kovalyov + +commit de5ed007a03d71daaa505f5daa4d3666530c7090 upstream. + +Following race may occur because of the call_srcu and the placement of +the synchronize_srcu vs the xa_erase. + +CPU0 CPU1 + +mlx5_ib_free_implicit_mr: destroy_unused_implicit_child_mr: + xa_erase(odp_mkeys) + synchronize_srcu() + xa_lock(implicit_children) + if (still in xarray) + atomic_inc() + call_srcu() + xa_unlock(implicit_children) + xa_erase(implicit_children): + xa_lock(implicit_children) + __xa_erase() + xa_unlock(implicit_children) + + flush_workqueue() + [..] + free_implicit_child_mr_rcu: + (via call_srcu) + queue_work() + + WARN_ON(atomic_read()) + [..] + free_implicit_child_mr_work: + (via wq) + free_implicit_child_mr() + mlx5_mr_cache_invalidate() + mlx5_ib_update_xlt() <-- UMR QP fail + atomic_dec() + +The wait_event() solves the race because it blocks until +free_implicit_child_mr_work() completes. + +Fixes: 5256edcb98a1 ("RDMA/mlx5: Rework implicit ODP destroy") +Link: https://lore.kernel.org/r/20200227113918.94432-1-leon@kernel.org +Signed-off-by: Artemy Kovalyov +Reviewed-by: Jason Gunthorpe +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/mlx5_ib.h | 1 + + drivers/infiniband/hw/mlx5/odp.c | 17 +++++++---------- + 2 files changed, 8 insertions(+), 10 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -629,6 +629,7 @@ struct mlx5_ib_mr { + + /* For ODP and implicit */ + atomic_t num_deferred_work; ++ wait_queue_head_t q_deferred_work; + struct xarray implicit_children; + union { + struct rcu_head rcu; +--- a/drivers/infiniband/hw/mlx5/odp.c ++++ b/drivers/infiniband/hw/mlx5/odp.c +@@ -197,7 +197,8 @@ static void free_implicit_child_mr(struc + mr->parent = NULL; + mlx5_mr_cache_free(mr->dev, mr); + ib_umem_odp_release(odp); +- atomic_dec(&imr->num_deferred_work); ++ if (atomic_dec_and_test(&imr->num_deferred_work)) ++ wake_up(&imr->q_deferred_work); + } + + static void free_implicit_child_mr_work(struct work_struct *work) +@@ -516,6 +517,7 @@ struct mlx5_ib_mr *mlx5_ib_alloc_implici + imr->umem = &umem_odp->umem; + imr->is_odp_implicit = true; + atomic_set(&imr->num_deferred_work, 0); ++ init_waitqueue_head(&imr->q_deferred_work); + xa_init(&imr->implicit_children); + + err = mlx5_ib_update_xlt(imr, 0, +@@ -573,10 +575,7 @@ void mlx5_ib_free_implicit_mr(struct mlx + * under xa_lock while the child is in the xarray. Thus at this point + * it is only decreasing, and all work holding it is now on the wq. + */ +- if (atomic_read(&imr->num_deferred_work)) { +- flush_workqueue(system_unbound_wq); +- WARN_ON(atomic_read(&imr->num_deferred_work)); +- } ++ wait_event(imr->q_deferred_work, !atomic_read(&imr->num_deferred_work)); + + /* + * Fence the imr before we destroy the children. This allows us to +@@ -607,10 +606,7 @@ void mlx5_ib_fence_odp_mr(struct mlx5_ib + /* Wait for all running page-fault handlers to finish. */ + synchronize_srcu(&mr->dev->odp_srcu); + +- if (atomic_read(&mr->num_deferred_work)) { +- flush_workqueue(system_unbound_wq); +- WARN_ON(atomic_read(&mr->num_deferred_work)); +- } ++ wait_event(mr->q_deferred_work, !atomic_read(&mr->num_deferred_work)); + + dma_fence_odp_mr(mr); + } +@@ -1682,7 +1678,8 @@ static void destroy_prefetch_work(struct + u32 i; + + for (i = 0; i < work->num_sge; ++i) +- atomic_dec(&work->frags[i].mr->num_deferred_work); ++ if (atomic_dec_and_test(&work->frags[i].mr->num_deferred_work)) ++ wake_up(&work->frags[i].mr->q_deferred_work); + kvfree(work); + } + diff --git a/queue-5.5/phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch b/queue-5.5/phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch new file mode 100644 index 00000000000..5dbcc97d6d4 --- /dev/null +++ b/queue-5.5/phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch @@ -0,0 +1,60 @@ +From be4e3c737eebd75815633f4b8fd766defaf0f1fc Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Sun, 15 Sep 2019 13:15:52 -0700 +Subject: phy: mapphone-mdm6600: Fix timeouts by adding wake-up handling + +From: Tony Lindgren + +commit be4e3c737eebd75815633f4b8fd766defaf0f1fc upstream. + +We have an interrupt handler for the wake-up GPIO pin, but we're missing +the code to wake-up the system. This can cause timeouts receiving data +for the UART that shares the wake-up GPIO pin with the USB PHY. + +All we need to do is just wake the system and kick the autosuspend +timeout to fix the issue. + +Fixes: 5d1ebbda0318 ("phy: mapphone-mdm6600: Add USB PHY driver for MDM6600 on Droid 4") +Cc: Marcel Partap +Cc: Merlijn Wajer +Cc: Michael Scott +Cc: NeKit +Cc: Pavel Machek +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/motorola/phy-mapphone-mdm6600.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c ++++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c +@@ -243,10 +243,24 @@ static irqreturn_t phy_mdm6600_wakeirq_t + { + struct phy_mdm6600 *ddata = data; + struct gpio_desc *mode_gpio1; ++ int error, wakeup; + + mode_gpio1 = ddata->mode_gpios->desc[PHY_MDM6600_MODE1]; +- dev_dbg(ddata->dev, "OOB wake on mode_gpio1: %i\n", +- gpiod_get_value(mode_gpio1)); ++ wakeup = gpiod_get_value(mode_gpio1); ++ if (!wakeup) ++ return IRQ_NONE; ++ ++ dev_dbg(ddata->dev, "OOB wake on mode_gpio1: %i\n", wakeup); ++ error = pm_runtime_get_sync(ddata->dev); ++ if (error < 0) { ++ pm_runtime_put_noidle(ddata->dev); ++ ++ return IRQ_NONE; ++ } ++ ++ /* Just wake-up and kick the autosuspend timer */ ++ pm_runtime_mark_last_busy(ddata->dev); ++ pm_runtime_put_autosuspend(ddata->dev); + + return IRQ_HANDLED; + } diff --git a/queue-5.5/phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch b/queue-5.5/phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch new file mode 100644 index 00000000000..0b1599658ae --- /dev/null +++ b/queue-5.5/phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch @@ -0,0 +1,57 @@ +From 46b7edf1c7b7c91004c4db2c355cbd033f2385f9 Mon Sep 17 00:00:00 2001 +From: Tony Lindgren +Date: Tue, 4 Feb 2020 07:36:02 -0800 +Subject: phy: mapphone-mdm6600: Fix write timeouts with shorter GPIO toggle interval + +From: Tony Lindgren + +commit 46b7edf1c7b7c91004c4db2c355cbd033f2385f9 upstream. + +I've noticed that when writing data to the modem the writes can time out +at some point eventually. Looks like kicking the modem idle GPIO every +600 ms instead of once a second fixes the issue. Note that this rate is +different from our runtime PM autosuspend rate MDM6600_MODEM_IDLE_DELAY_MS +that we still want to keep at 1 second, so let's add a separate define for +PHY_MDM6600_IDLE_KICK_MS. + +Fixes: f7f50b2a7b05 ("phy: mapphone-mdm6600: Add runtime PM support for n_gsm on USB suspend") +Cc: Marcel Partap +Cc: Merlijn Wajer +Cc: Michael Scott +Cc: NeKit +Cc: Pavel Machek +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Kishon Vijay Abraham I +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/phy/motorola/phy-mapphone-mdm6600.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c ++++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c +@@ -20,6 +20,7 @@ + + #define PHY_MDM6600_PHY_DELAY_MS 4000 /* PHY enable 2.2s to 3.5s */ + #define PHY_MDM6600_ENABLED_DELAY_MS 8000 /* 8s more total for MDM6600 */ ++#define PHY_MDM6600_WAKE_KICK_MS 600 /* time on after GPIO toggle */ + #define MDM6600_MODEM_IDLE_DELAY_MS 1000 /* modem after USB suspend */ + #define MDM6600_MODEM_WAKE_DELAY_MS 200 /* modem response after idle */ + +@@ -510,8 +511,14 @@ static void phy_mdm6600_modem_wake(struc + + ddata = container_of(work, struct phy_mdm6600, modem_wake_work.work); + phy_mdm6600_wake_modem(ddata); ++ ++ /* ++ * The modem does not always stay awake 1.2 seconds after toggling ++ * the wake GPIO, and sometimes it idles after about some 600 ms ++ * making writes time out. ++ */ + schedule_delayed_work(&ddata->modem_wake_work, +- msecs_to_jiffies(MDM6600_MODEM_IDLE_DELAY_MS)); ++ msecs_to_jiffies(PHY_MDM6600_WAKE_KICK_MS)); + } + + static int __maybe_unused phy_mdm6600_runtime_suspend(struct device *dev) diff --git a/queue-5.5/rdma-core-fix-protection-fault-in-ib_mr_pool_destroy.patch b/queue-5.5/rdma-core-fix-protection-fault-in-ib_mr_pool_destroy.patch new file mode 100644 index 00000000000..cc205d42dac --- /dev/null +++ b/queue-5.5/rdma-core-fix-protection-fault-in-ib_mr_pool_destroy.patch @@ -0,0 +1,134 @@ +From e38b55ea0443da35a50a3eb2079ad3612cf763b9 Mon Sep 17 00:00:00 2001 +From: Maor Gottlieb +Date: Thu, 27 Feb 2020 13:27:08 +0200 +Subject: RDMA/core: Fix protection fault in ib_mr_pool_destroy + +From: Maor Gottlieb + +commit e38b55ea0443da35a50a3eb2079ad3612cf763b9 upstream. + +Fix NULL pointer dereference in the error flow of ib_create_qp_user +when accessing to uninitialized list pointers - rdma_mrs and sig_mrs. +The following crash from syzkaller revealed it. + + kasan: GPF could be caused by NULL-ptr deref or user memory access + general protection fault: 0000 [#1] SMP KASAN PTI + CPU: 1 PID: 23167 Comm: syz-executor.1 Not tainted 5.5.0-rc5 #2 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS + rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 + RIP: 0010:ib_mr_pool_destroy+0x81/0x1f0 + Code: 00 00 fc ff df 49 c1 ec 03 4d 01 fc e8 a8 ea 72 fe 41 80 3c 24 00 + 0f 85 62 01 00 00 48 8b 13 48 89 d6 4c 8d 6a c8 48 c1 ee 03 <42> 80 3c + 3e 00 0f 85 34 01 00 00 48 8d 7a 08 4c 8b 02 48 89 fe 48 + RSP: 0018:ffffc9000951f8b0 EFLAGS: 00010046 + RAX: 0000000000040000 RBX: ffff88810f268038 RCX: ffffffff82c41628 + RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc9000951f850 + RBP: ffff88810f268020 R08: 0000000000000004 R09: fffff520012a3f0a + R10: 0000000000000001 R11: fffff520012a3f0a R12: ffffed1021e4d007 + R13: ffffffffffffffc8 R14: 0000000000000246 R15: dffffc0000000000 + FS: 00007f54bc788700(0000) GS:ffff88811b100000(0000) + knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 0000000116920002 CR4: 0000000000360ee0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + rdma_rw_cleanup_mrs+0x15/0x30 + ib_destroy_qp_user+0x674/0x7d0 + ib_create_qp_user+0xb01/0x11c0 + create_qp+0x1517/0x2130 + ib_uverbs_create_qp+0x13e/0x190 + ib_uverbs_write+0xaa5/0xdf0 + __vfs_write+0x7c/0x100 + vfs_write+0x168/0x4a0 + ksys_write+0xc8/0x200 + do_syscall_64+0x9c/0x390 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x465b49 + Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89 + f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 + f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 + RSP: 002b:00007f54bc787c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 + RAX: ffffffffffffffda RBX: 000000000073bf00 RCX: 0000000000465b49 + RDX: 0000000000000040 RSI: 0000000020000540 RDI: 0000000000000003 + RBP: 00007f54bc787c70 R08: 0000000000000000 R09: 0000000000000000 + R10: 0000000000000000 R11: 0000000000000246 R12: 00007f54bc7886bc + R13: 00000000004ca2ec R14: 000000000070ded0 R15: 0000000000000005 + +Fixes: a060b5629ab0 ("IB/core: generic RDMA READ/WRITE API") +Link: https://lore.kernel.org/r/20200227112708.93023-1-leon@kernel.org +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Reviewed-by: Jason Gunthorpe +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/core_priv.h | 15 +++++++++++++++ + drivers/infiniband/core/uverbs_cmd.c | 10 ---------- + drivers/infiniband/core/verbs.c | 10 ---------- + 3 files changed, 15 insertions(+), 20 deletions(-) + +--- a/drivers/infiniband/core/core_priv.h ++++ b/drivers/infiniband/core/core_priv.h +@@ -338,6 +338,21 @@ static inline struct ib_qp *_ib_create_q + qp->pd = pd; + qp->uobject = uobj; + qp->real_qp = qp; ++ ++ qp->qp_type = attr->qp_type; ++ qp->qp_context = attr->qp_context; ++ qp->rwq_ind_tbl = attr->rwq_ind_tbl; ++ qp->send_cq = attr->send_cq; ++ qp->recv_cq = attr->recv_cq; ++ qp->srq = attr->srq; ++ qp->rwq_ind_tbl = attr->rwq_ind_tbl; ++ qp->event_handler = attr->event_handler; ++ ++ atomic_set(&qp->usecnt, 0); ++ spin_lock_init(&qp->mr_lock); ++ INIT_LIST_HEAD(&qp->rdma_mrs); ++ INIT_LIST_HEAD(&qp->sig_mrs); ++ + /* + * We don't track XRC QPs for now, because they don't have PD + * and more importantly they are created internaly by driver, +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -1433,17 +1433,7 @@ static int create_qp(struct uverbs_attr_ + if (ret) + goto err_cb; + +- qp->pd = pd; +- qp->send_cq = attr.send_cq; +- qp->recv_cq = attr.recv_cq; +- qp->srq = attr.srq; +- qp->rwq_ind_tbl = ind_tbl; +- qp->event_handler = attr.event_handler; +- qp->qp_context = attr.qp_context; +- qp->qp_type = attr.qp_type; +- atomic_set(&qp->usecnt, 0); + atomic_inc(&pd->usecnt); +- qp->port = 0; + if (attr.send_cq) + atomic_inc(&attr.send_cq->usecnt); + if (attr.recv_cq) +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -1182,16 +1182,6 @@ struct ib_qp *ib_create_qp_user(struct i + if (ret) + goto err; + +- qp->qp_type = qp_init_attr->qp_type; +- qp->rwq_ind_tbl = qp_init_attr->rwq_ind_tbl; +- +- atomic_set(&qp->usecnt, 0); +- qp->mrs_used = 0; +- spin_lock_init(&qp->mr_lock); +- INIT_LIST_HEAD(&qp->rdma_mrs); +- INIT_LIST_HEAD(&qp->sig_mrs); +- qp->port = 0; +- + if (qp_init_attr->qp_type == IB_QPT_XRC_TGT) { + struct ib_qp *xrc_qp = + create_xrc_qp_user(qp, qp_init_attr, udata); diff --git a/queue-5.5/rdma-iwcm-fix-iwcm-work-deallocation.patch b/queue-5.5/rdma-iwcm-fix-iwcm-work-deallocation.patch new file mode 100644 index 00000000000..a2060f09d58 --- /dev/null +++ b/queue-5.5/rdma-iwcm-fix-iwcm-work-deallocation.patch @@ -0,0 +1,41 @@ +From 810dbc69087b08fd53e1cdd6c709f385bc2921ad Mon Sep 17 00:00:00 2001 +From: Bernard Metzler +Date: Mon, 2 Mar 2020 19:16:14 +0100 +Subject: RDMA/iwcm: Fix iwcm work deallocation + +From: Bernard Metzler + +commit 810dbc69087b08fd53e1cdd6c709f385bc2921ad upstream. + +The dealloc_work_entries() function must update the work_free_list pointer +while freeing its entries, since potentially called again on same list. A +second iteration of the work list caused system crash. This happens, if +work allocation fails during cma_iw_listen() and free_cm_id() tries to +free the list again during cleanup. + +Fixes: 922a8e9fb2e0 ("RDMA: iWARP Connection Manager.") +Link: https://lore.kernel.org/r/20200302181614.17042-1-bmt@zurich.ibm.com +Reported-by: syzbot+cb0c054eabfba4342146@syzkaller.appspotmail.com +Signed-off-by: Bernard Metzler +Reviewed-by: Jason Gunthorpe +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/iwcm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/core/iwcm.c ++++ b/drivers/infiniband/core/iwcm.c +@@ -159,8 +159,10 @@ static void dealloc_work_entries(struct + { + struct list_head *e, *tmp; + +- list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) ++ list_for_each_safe(e, tmp, &cm_id_priv->work_free_list) { ++ list_del(e); + kfree(list_entry(e, struct iwcm_work, free_list)); ++ } + } + + static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count) diff --git a/queue-5.5/rdma-nldev-fix-crash-when-set-a-qp-to-a-new-counter-but-qpn-is-missing.patch b/queue-5.5/rdma-nldev-fix-crash-when-set-a-qp-to-a-new-counter-but-qpn-is-missing.patch new file mode 100644 index 00000000000..e1491c02cc5 --- /dev/null +++ b/queue-5.5/rdma-nldev-fix-crash-when-set-a-qp-to-a-new-counter-but-qpn-is-missing.patch @@ -0,0 +1,81 @@ +From 78f34a16c28654cb47791257006f90d0948f2f0c Mon Sep 17 00:00:00 2001 +From: Mark Zhang +Date: Thu, 27 Feb 2020 14:51:11 +0200 +Subject: RDMA/nldev: Fix crash when set a QP to a new counter but QPN is missing + +From: Mark Zhang + +commit 78f34a16c28654cb47791257006f90d0948f2f0c upstream. + +This fixes the kernel crash when a RDMA_NLDEV_CMD_STAT_SET command is +received, but the QP number parameter is not available. + + iwpm_register_pid: Unable to send a nlmsg (client = 2) + infiniband syz1: RDMA CMA: cma_listen_on_dev, error -98 + general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN + KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] + CPU: 0 PID: 9754 Comm: syz-executor069 Not tainted 5.6.0-rc2-syzkaller #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + RIP: 0010:nla_get_u32 include/net/netlink.h:1474 [inline] + RIP: 0010:nldev_stat_set_doit+0x63c/0xb70 drivers/infiniband/core/nldev.c:1760 + Code: fc 01 0f 84 58 03 00 00 e8 41 83 bf fb 4c 8b a3 58 fd ff ff 48 b8 00 00 00 00 00 fc ff df 49 8d 7c 24 04 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 6d + RSP: 0018:ffffc900068bf350 EFLAGS: 00010247 + RAX: dffffc0000000000 RBX: ffffc900068bf728 RCX: ffffffff85b60470 + RDX: 0000000000000000 RSI: ffffffff85b6047f RDI: 0000000000000004 + RBP: ffffc900068bf750 R08: ffff88808c3ee140 R09: ffff8880a25e6010 + R10: ffffed10144bcddc R11: ffff8880a25e6ee3 R12: 0000000000000000 + R13: ffff88809acb0000 R14: ffff888092a42c80 R15: 000000009ef2e29a + FS: 0000000001ff0880(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007f4733e34000 CR3: 00000000a9b27000 CR4: 00000000001406f0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + rdma_nl_rcv_msg drivers/infiniband/core/netlink.c:195 [inline] + rdma_nl_rcv_skb drivers/infiniband/core/netlink.c:239 [inline] + rdma_nl_rcv+0x5d9/0x980 drivers/infiniband/core/netlink.c:259 + netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] + netlink_unicast+0x59e/0x7e0 net/netlink/af_netlink.c:1329 + netlink_sendmsg+0x91c/0xea0 net/netlink/af_netlink.c:1918 + sock_sendmsg_nosec net/socket.c:652 [inline] + sock_sendmsg+0xd7/0x130 net/socket.c:672 + ____sys_sendmsg+0x753/0x880 net/socket.c:2343 + ___sys_sendmsg+0x100/0x170 net/socket.c:2397 + __sys_sendmsg+0x105/0x1d0 net/socket.c:2430 + __do_sys_sendmsg net/socket.c:2439 [inline] + __se_sys_sendmsg net/socket.c:2437 [inline] + __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2437 + do_syscall_64+0xfa/0x790 arch/x86/entry/common.c:294 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + RIP: 0033:0x4403d9 + Code: 18 89 d0 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 13 fc ff c3 66 2e 0f 1f 84 00 00 00 00 + RSP: 002b:00007ffc0efbc5c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e + RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 00000000004403d9 + RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000004 + RBP: 00000000006ca018 R08: 0000000000000008 R09: 00000000004002c8 + R10: 000000000000004a R11: 0000000000000246 R12: 0000000000401c60 + R13: 0000000000401cf0 R14: 0000000000000000 R15: 0000000000000000 + +Fixes: b389327df905 ("RDMA/nldev: Allow counter manual mode configration through RDMA netlink") +Link: https://lore.kernel.org/r/20200227125111.99142-1-leon@kernel.org +Reported-by: syzbot+bd4af81bc51ee0283445@syzkaller.appspotmail.com +Signed-off-by: Mark Zhang +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/nldev.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/infiniband/core/nldev.c ++++ b/drivers/infiniband/core/nldev.c +@@ -1756,6 +1756,8 @@ static int nldev_stat_set_doit(struct sk + if (ret) + goto err_msg; + } else { ++ if (!tb[RDMA_NLDEV_ATTR_RES_LQPN]) ++ goto err_msg; + qpn = nla_get_u32(tb[RDMA_NLDEV_ATTR_RES_LQPN]); + if (tb[RDMA_NLDEV_ATTR_STAT_COUNTER_ID]) { + cntn = nla_get_u32(tb[RDMA_NLDEV_ATTR_STAT_COUNTER_ID]); diff --git a/queue-5.5/rdma-odp-ensure-the-mm-is-still-alive-before-creating-an-implicit-child.patch b/queue-5.5/rdma-odp-ensure-the-mm-is-still-alive-before-creating-an-implicit-child.patch new file mode 100644 index 00000000000..feb1d14a5ed --- /dev/null +++ b/queue-5.5/rdma-odp-ensure-the-mm-is-still-alive-before-creating-an-implicit-child.patch @@ -0,0 +1,70 @@ +From a4e63bce1414df7ab6eb82ca9feb8494ce13e554 Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Thu, 27 Feb 2020 13:41:18 +0200 +Subject: RDMA/odp: Ensure the mm is still alive before creating an implicit child + +From: Jason Gunthorpe + +commit a4e63bce1414df7ab6eb82ca9feb8494ce13e554 upstream. + +Registration of a mmu_notifier requires the caller to hold a mmget() on +the mm as registration is not permitted to race with exit_mmap(). There is +a BUG_ON inside the mmu_notifier to guard against this. + +Normally creating a umem is done against current which implicitly holds +the mmget(), however an implicit ODP child is created from a pagefault +work queue and is not guaranteed to have a mmget(). + +Call mmget() around this registration and abort faulting if the MM has +gone to exit_mmap(). + +Before the patch below the notifier was registered when the implicit ODP +parent was created, so there was no chance to register a notifier outside +of current. + +Fixes: c571feca2dc9 ("RDMA/odp: use mmu_notifier_get/put for 'struct ib_ucontext_per_mm'") +Link: https://lore.kernel.org/r/20200227114118.94736-1-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/umem_odp.c | 24 +++++++++++++++++++----- + 1 file changed, 19 insertions(+), 5 deletions(-) + +--- a/drivers/infiniband/core/umem_odp.c ++++ b/drivers/infiniband/core/umem_odp.c +@@ -187,14 +187,28 @@ ib_umem_odp_alloc_child(struct ib_umem_o + odp_data->page_shift = PAGE_SHIFT; + odp_data->notifier.ops = ops; + ++ /* ++ * A mmget must be held when registering a notifier, the owming_mm only ++ * has a mm_grab at this point. ++ */ ++ if (!mmget_not_zero(umem->owning_mm)) { ++ ret = -EFAULT; ++ goto out_free; ++ } ++ + odp_data->tgid = get_pid(root->tgid); + ret = ib_init_umem_odp(odp_data, ops); +- if (ret) { +- put_pid(odp_data->tgid); +- kfree(odp_data); +- return ERR_PTR(ret); +- } ++ if (ret) ++ goto out_tgid; ++ mmput(umem->owning_mm); + return odp_data; ++ ++out_tgid: ++ put_pid(odp_data->tgid); ++ mmput(umem->owning_mm); ++out_free: ++ kfree(odp_data); ++ return ERR_PTR(ret); + } + EXPORT_SYMBOL(ib_umem_odp_alloc_child); + diff --git a/queue-5.5/rdma-rw-fix-error-flow-during-rdma-context-initialization.patch b/queue-5.5/rdma-rw-fix-error-flow-during-rdma-context-initialization.patch new file mode 100644 index 00000000000..7078dfe458b --- /dev/null +++ b/queue-5.5/rdma-rw-fix-error-flow-during-rdma-context-initialization.patch @@ -0,0 +1,85 @@ +From 6affca140cbea01f497c4f4e16f1e2be7f74bd04 Mon Sep 17 00:00:00 2001 +From: Max Gurtovoy +Date: Thu, 20 Feb 2020 12:08:18 +0200 +Subject: RDMA/rw: Fix error flow during RDMA context initialization + +From: Max Gurtovoy + +commit 6affca140cbea01f497c4f4e16f1e2be7f74bd04 upstream. + +In case the SGL was mapped for P2P DMA operation, we must unmap it using +pci_p2pdma_unmap_sg during the error unwind of rdma_rw_ctx_init() + +Fixes: 7f73eac3a713 ("PCI/P2PDMA: Introduce pci_p2pdma_unmap_sg()") +Link: https://lore.kernel.org/r/20200220100819.41860-1-maxg@mellanox.com +Signed-off-by: Max Gurtovoy +Reviewed-by: Leon Romanovsky +Reviewed-by: Logan Gunthorpe +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/rw.c | 31 ++++++++++++++++++++----------- + 1 file changed, 20 insertions(+), 11 deletions(-) + +--- a/drivers/infiniband/core/rw.c ++++ b/drivers/infiniband/core/rw.c +@@ -273,6 +273,23 @@ static int rdma_rw_init_single_wr(struct + return 1; + } + ++static void rdma_rw_unmap_sg(struct ib_device *dev, struct scatterlist *sg, ++ u32 sg_cnt, enum dma_data_direction dir) ++{ ++ if (is_pci_p2pdma_page(sg_page(sg))) ++ pci_p2pdma_unmap_sg(dev->dma_device, sg, sg_cnt, dir); ++ else ++ ib_dma_unmap_sg(dev, sg, sg_cnt, dir); ++} ++ ++static int rdma_rw_map_sg(struct ib_device *dev, struct scatterlist *sg, ++ u32 sg_cnt, enum dma_data_direction dir) ++{ ++ if (is_pci_p2pdma_page(sg_page(sg))) ++ return pci_p2pdma_map_sg(dev->dma_device, sg, sg_cnt, dir); ++ return ib_dma_map_sg(dev, sg, sg_cnt, dir); ++} ++ + /** + * rdma_rw_ctx_init - initialize a RDMA READ/WRITE context + * @ctx: context to initialize +@@ -295,11 +312,7 @@ int rdma_rw_ctx_init(struct rdma_rw_ctx + struct ib_device *dev = qp->pd->device; + int ret; + +- if (is_pci_p2pdma_page(sg_page(sg))) +- ret = pci_p2pdma_map_sg(dev->dma_device, sg, sg_cnt, dir); +- else +- ret = ib_dma_map_sg(dev, sg, sg_cnt, dir); +- ++ ret = rdma_rw_map_sg(dev, sg, sg_cnt, dir); + if (!ret) + return -ENOMEM; + sg_cnt = ret; +@@ -338,7 +351,7 @@ int rdma_rw_ctx_init(struct rdma_rw_ctx + return ret; + + out_unmap_sg: +- ib_dma_unmap_sg(dev, sg, sg_cnt, dir); ++ rdma_rw_unmap_sg(dev, sg, sg_cnt, dir); + return ret; + } + EXPORT_SYMBOL(rdma_rw_ctx_init); +@@ -588,11 +601,7 @@ void rdma_rw_ctx_destroy(struct rdma_rw_ + break; + } + +- if (is_pci_p2pdma_page(sg_page(sg))) +- pci_p2pdma_unmap_sg(qp->pd->device->dma_device, sg, +- sg_cnt, dir); +- else +- ib_dma_unmap_sg(qp->pd->device, sg, sg_cnt, dir); ++ rdma_rw_unmap_sg(qp->pd->device, sg, sg_cnt, dir); + } + EXPORT_SYMBOL(rdma_rw_ctx_destroy); + diff --git a/queue-5.5/rdma-siw-fix-failure-handling-during-device-creation.patch b/queue-5.5/rdma-siw-fix-failure-handling-during-device-creation.patch new file mode 100644 index 00000000000..32e5f24c4b4 --- /dev/null +++ b/queue-5.5/rdma-siw-fix-failure-handling-during-device-creation.patch @@ -0,0 +1,47 @@ +From 12e5eef0f4d8087ea7b559f6630be08ffea2d851 Mon Sep 17 00:00:00 2001 +From: Bernard Metzler +Date: Mon, 2 Mar 2020 16:58:14 +0100 +Subject: RDMA/siw: Fix failure handling during device creation + +From: Bernard Metzler + +commit 12e5eef0f4d8087ea7b559f6630be08ffea2d851 upstream. + +A failing call to ib_device_set_netdev() during device creation caused +system crash due to xa_destroy of uninitialized xarray hit by device +deallocation. Fixed by moving xarray initialization before potential +device deallocation. + +Fixes: bdcf26bf9b3a ("rdma/siw: network and RDMA core interface") +Link: https://lore.kernel.org/r/20200302155814.9896-1-bmt@zurich.ibm.com +Reported-by: syzbot+2e80962bedd9559fe0b3@syzkaller.appspotmail.com +Signed-off-by: Bernard Metzler +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/sw/siw/siw_main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/infiniband/sw/siw/siw_main.c ++++ b/drivers/infiniband/sw/siw/siw_main.c +@@ -388,6 +388,9 @@ static struct siw_device *siw_device_cre + { .max_segment_size = SZ_2G }; + base_dev->num_comp_vectors = num_possible_cpus(); + ++ xa_init_flags(&sdev->qp_xa, XA_FLAGS_ALLOC1); ++ xa_init_flags(&sdev->mem_xa, XA_FLAGS_ALLOC1); ++ + ib_set_device_ops(base_dev, &siw_device_ops); + rv = ib_device_set_netdev(base_dev, netdev, 1); + if (rv) +@@ -415,9 +418,6 @@ static struct siw_device *siw_device_cre + sdev->attrs.max_srq_wr = SIW_MAX_SRQ_WR; + sdev->attrs.max_srq_sge = SIW_MAX_SGE; + +- xa_init_flags(&sdev->qp_xa, XA_FLAGS_ALLOC1); +- xa_init_flags(&sdev->mem_xa, XA_FLAGS_ALLOC1); +- + INIT_LIST_HEAD(&sdev->cep_list); + INIT_LIST_HEAD(&sdev->qp_list); + diff --git a/queue-5.5/regulator-qcom_spmi-fix-docs-for-pm8004.patch b/queue-5.5/regulator-qcom_spmi-fix-docs-for-pm8004.patch new file mode 100644 index 00000000000..e3a0b9bb3e9 --- /dev/null +++ b/queue-5.5/regulator-qcom_spmi-fix-docs-for-pm8004.patch @@ -0,0 +1,31 @@ +From a5b0cda136f4f420a8e24e50d19dfcef2f81df2e Mon Sep 17 00:00:00 2001 +From: Petr Vorel +Date: Tue, 28 Jan 2020 00:14:39 +0100 +Subject: regulator: qcom_spmi: Fix docs for PM8004 + +From: Petr Vorel + +commit a5b0cda136f4f420a8e24e50d19dfcef2f81df2e upstream. + +Fixes: 2e36e140b8b8 ("regulator: qcom_spmi: Add support for PM8004 regulators") + +Signed-off-by: Petr Vorel +Link: https://lore.kernel.org/r/20200127231439.3562452-1-petr.vorel@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt ++++ b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt +@@ -161,7 +161,7 @@ The regulator node houses sub-nodes for + sub-node is identified using the node's name, with valid values listed for each + of the PMICs below. + +-pm8005: ++pm8004: + s2, s5 + + pm8005: diff --git a/queue-5.5/regulator-stm32-vrefbuf-fix-a-possible-overshoot-when-re-enabling.patch b/queue-5.5/regulator-stm32-vrefbuf-fix-a-possible-overshoot-when-re-enabling.patch new file mode 100644 index 00000000000..b9af855c436 --- /dev/null +++ b/queue-5.5/regulator-stm32-vrefbuf-fix-a-possible-overshoot-when-re-enabling.patch @@ -0,0 +1,47 @@ +From 02fbabd5f4ed182d2c616e49309f5a3efd9ec671 Mon Sep 17 00:00:00 2001 +From: Fabrice Gasnier +Date: Wed, 4 Mar 2020 09:55:32 +0100 +Subject: regulator: stm32-vrefbuf: fix a possible overshoot when re-enabling + +From: Fabrice Gasnier + +commit 02fbabd5f4ed182d2c616e49309f5a3efd9ec671 upstream. + +There maybe an overshoot, when disabling, then re-enabling vrefbuf +too quickly. VREFBUF is used by ADC/DAC on some boards. When re-enabling +too quickly, an overshoot on the reference voltage make the conversions +inaccurate for a short period of time. +- Don't put the VREFBUF in HiZ when disabling, to force an active +discharge. +- Enforce a 1ms OFF/ON delay + +Fixes: 0cdbf481e927 ("regulator: Add support for stm32-vrefbuf") + +Signed-off-by: Fabrice Gasnier +Message-Id: <1583312132-20932-1-git-send-email-fabrice.gasnier@st.com> +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/regulator/stm32-vrefbuf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/regulator/stm32-vrefbuf.c ++++ b/drivers/regulator/stm32-vrefbuf.c +@@ -88,7 +88,7 @@ static int stm32_vrefbuf_disable(struct + } + + val = readl_relaxed(priv->base + STM32_VREFBUF_CSR); +- val = (val & ~STM32_ENVR) | STM32_HIZ; ++ val &= ~STM32_ENVR; + writel_relaxed(val, priv->base + STM32_VREFBUF_CSR); + + pm_runtime_mark_last_busy(priv->dev); +@@ -175,6 +175,7 @@ static const struct regulator_desc stm32 + .volt_table = stm32_vrefbuf_voltages, + .n_voltages = ARRAY_SIZE(stm32_vrefbuf_voltages), + .ops = &stm32_vrefbuf_volt_ops, ++ .off_on_delay = 1000, + .type = REGULATOR_VOLTAGE, + .owner = THIS_MODULE, + }; diff --git a/queue-5.5/revert-rdma-cma-simplify-rdma_resolve_addr-error-flow.patch b/queue-5.5/revert-rdma-cma-simplify-rdma_resolve_addr-error-flow.patch new file mode 100644 index 00000000000..0ac53a8563e --- /dev/null +++ b/queue-5.5/revert-rdma-cma-simplify-rdma_resolve_addr-error-flow.patch @@ -0,0 +1,70 @@ +From e4103312d7b7afb8a3a7a842a33ef2b1856b2c0f Mon Sep 17 00:00:00 2001 +From: Parav Pandit +Date: Wed, 12 Feb 2020 09:26:29 +0200 +Subject: Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow" + +From: Parav Pandit + +commit e4103312d7b7afb8a3a7a842a33ef2b1856b2c0f upstream. + +This reverts commit 219d2e9dfda9431b808c28d5efc74b404b95b638. + +The call chain below requires the cm_id_priv's destination address to be +setup before performing rdma_bind_addr(). Otherwise source port allocation +fails as cma_port_is_unique() no longer sees the correct tuple to allow +duplicate users of the source port. + +rdma_resolve_addr() + cma_bind_addr() + rdma_bind_addr() + cma_get_port() + cma_alloc_any_port() + cma_port_is_unique() <- compared with zero daddr + +This can result in false failures to connect, particularly if the source +port range is restricted. + +Fixes: 219d2e9dfda9 ("RDMA/cma: Simplify rdma_resolve_addr() error flow") +Link: https://lore.kernel.org/r/20200212072635.682689-4-leon@kernel.org +Signed-off-by: Parav Pandit +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/cma.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -3182,19 +3182,26 @@ int rdma_resolve_addr(struct rdma_cm_id + int ret; + + id_priv = container_of(id, struct rdma_id_private, id); ++ memcpy(cma_dst_addr(id_priv), dst_addr, rdma_addr_size(dst_addr)); + if (id_priv->state == RDMA_CM_IDLE) { + ret = cma_bind_addr(id, src_addr, dst_addr); +- if (ret) ++ if (ret) { ++ memset(cma_dst_addr(id_priv), 0, ++ rdma_addr_size(dst_addr)); + return ret; ++ } + } + +- if (cma_family(id_priv) != dst_addr->sa_family) ++ if (cma_family(id_priv) != dst_addr->sa_family) { ++ memset(cma_dst_addr(id_priv), 0, rdma_addr_size(dst_addr)); + return -EINVAL; ++ } + +- if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_ADDR_QUERY)) ++ if (!cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_ADDR_QUERY)) { ++ memset(cma_dst_addr(id_priv), 0, rdma_addr_size(dst_addr)); + return -EINVAL; ++ } + +- memcpy(cma_dst_addr(id_priv), dst_addr, rdma_addr_size(dst_addr)); + if (cma_any_addr(dst_addr)) { + ret = cma_resolve_loopback(id_priv); + } else { diff --git a/queue-5.5/rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch b/queue-5.5/rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch new file mode 100644 index 00000000000..b2ce5b9a13e --- /dev/null +++ b/queue-5.5/rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch @@ -0,0 +1,32 @@ +From c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec Mon Sep 17 00:00:00 2001 +From: Jason Gunthorpe +Date: Fri, 21 Feb 2020 15:20:26 +0000 +Subject: RMDA/cm: Fix missing ib_cm_destroy_id() in ib_cm_insert_listen() + +From: Jason Gunthorpe + +commit c14dfddbd869bf0c2bafb7ef260c41d9cebbcfec upstream. + +The algorithm pre-allocates a cm_id since allocation cannot be done while +holding the cm.lock spinlock, however it doesn't free it on one error +path, leading to a memory leak. + +Fixes: 067b171b8679 ("IB/cm: Share listening CM IDs") +Link: https://lore.kernel.org/r/20200221152023.GA8680@ziepe.ca +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/cm.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -1202,6 +1202,7 @@ struct ib_cm_id *ib_cm_insert_listen(str + /* Sharing an ib_cm_id with different handlers is not + * supported */ + spin_unlock_irqrestore(&cm.lock, flags); ++ ib_destroy_cm_id(cm_id); + return ERR_PTR(-EINVAL); + } + refcount_inc(&cm_id_priv->refcount); diff --git a/queue-5.5/series b/queue-5.5/series index 15a5fed5389..f9df6039122 100644 --- a/queue-5.5/series +++ b/queue-5.5/series @@ -132,3 +132,39 @@ asoc-topology-fix-memleak-in-soc_tplg_manifest_load.patch asoc-sof-fix-snd_sof_ipc_stream_posn.patch asoc-intel-skl-fix-pin-debug-prints.patch asoc-intel-skl-fix-possible-buffer-overflow-in-debug-outputs.patch +asoc-pcm-fix-possible-buffer-overflow-in-dpcm-state-sysfs-output.patch +asoc-pcm512x-fix-unbalanced-regulator-enable-call-in-probe-error-path.patch +asoc-intel-skylake-fix-available-clock-counter-incrementation.patch +asoc-dapm-correct-dapm-handling-of-active-widgets-during-shutdown.patch +asoc-soc-component-tidyup-snd_soc_pcm_component_sync_stop.patch +spi-atmel-quadspi-fix-possible-mmio-window-size-overrun.patch +drm-panfrost-don-t-try-to-map-on-error-faults.patch +drm-mediatek-handle-component-type-mtk_disp_ovl_2l-correctly.patch +drm-ttm-fix-leaking-fences-via-ttm_buffer_object_transfer.patch +drm-kirin-revert-fix-for-hikey620-display-offset-problem.patch +drm-sun4i-add-separate-de3-vi-layer-formats.patch +drm-sun4i-fix-de2-vi-layer-format-support.patch +drm-sun4i-de2-de3-remove-unsupported-vi-layer-formats.patch +drm-i915-program-mbus-with-rmw-during-initialization.patch +drm-i915-selftests-fix-return-in-assert_mmap_offset.patch +drm-i915-perf-reintroduce-wait-on-oa-configuration-completion.patch +phy-mapphone-mdm6600-fix-timeouts-by-adding-wake-up-handling.patch +phy-mapphone-mdm6600-fix-write-timeouts-with-shorter-gpio-toggle-interval.patch +arm-dts-imx6-phycore-som-fix-emmc-supply.patch +arm64-dts-imx8qxp-mek-remove-unexisting-ethernet-phy.patch +firmware-imx-misc-align-imx-sc-msg-structs-to-4.patch +firmware-imx-scu-pd-align-imx-sc-msg-structs-to-4.patch +firmware-imx-align-imx_sc_msg_req_cpu_start-to-4.patch +soc-imx-scu-align-imx-sc-msg-structs-to-4.patch +revert-rdma-cma-simplify-rdma_resolve_addr-error-flow.patch +rdma-rw-fix-error-flow-during-rdma-context-initialization.patch +rdma-odp-ensure-the-mm-is-still-alive-before-creating-an-implicit-child.patch +rdma-nldev-fix-crash-when-set-a-qp-to-a-new-counter-but-qpn-is-missing.patch +rdma-siw-fix-failure-handling-during-device-creation.patch +rdma-iwcm-fix-iwcm-work-deallocation.patch +rdma-core-fix-protection-fault-in-ib_mr_pool_destroy.patch +regulator-stm32-vrefbuf-fix-a-possible-overshoot-when-re-enabling.patch +regulator-qcom_spmi-fix-docs-for-pm8004.patch +rmda-cm-fix-missing-ib_cm_destroy_id-in-ib_cm_insert_listen.patch +ib-mlx5-fix-implicit-odp-race.patch +ib-hfi1-qib-ensure-rcu-is-locked-when-accessing-list.patch diff --git a/queue-5.5/soc-imx-scu-align-imx-sc-msg-structs-to-4.patch b/queue-5.5/soc-imx-scu-align-imx-sc-msg-structs-to-4.patch new file mode 100644 index 00000000000..0cd346a72df --- /dev/null +++ b/queue-5.5/soc-imx-scu-align-imx-sc-msg-structs-to-4.patch @@ -0,0 +1,36 @@ +From f10e58a5d20e1cf3a39a842da92c9dd0c3c23849 Mon Sep 17 00:00:00 2001 +From: Leonard Crestez +Date: Thu, 20 Feb 2020 18:29:39 +0200 +Subject: soc: imx-scu: Align imx sc msg structs to 4 + +From: Leonard Crestez + +commit f10e58a5d20e1cf3a39a842da92c9dd0c3c23849 upstream. + +The imx SC api strongly assumes that messages are composed out of +4-bytes words but some of our message structs have odd sizeofs. + +This produces many oopses with CONFIG_KASAN=y. + +Fix by marking with __aligned(4). + +Fixes: 73feb4d0f8f1 ("soc: imx-scu: Add SoC UID(unique identifier) support") +Signed-off-by: Leonard Crestez +Signed-off-by: Shawn Guo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/imx/soc-imx-scu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/soc/imx/soc-imx-scu.c ++++ b/drivers/soc/imx/soc-imx-scu.c +@@ -25,7 +25,7 @@ struct imx_sc_msg_misc_get_soc_id { + u32 id; + } resp; + } data; +-} __packed; ++} __packed __aligned(4); + + struct imx_sc_msg_misc_get_soc_uid { + struct imx_sc_rpc_msg hdr; diff --git a/queue-5.5/spi-atmel-quadspi-fix-possible-mmio-window-size-overrun.patch b/queue-5.5/spi-atmel-quadspi-fix-possible-mmio-window-size-overrun.patch new file mode 100644 index 00000000000..b83e5239ad8 --- /dev/null +++ b/queue-5.5/spi-atmel-quadspi-fix-possible-mmio-window-size-overrun.patch @@ -0,0 +1,63 @@ +From 8e093ea4d3593379be46b845b9e823179558047e Mon Sep 17 00:00:00 2001 +From: Tudor Ambarus +Date: Fri, 28 Feb 2020 15:55:32 +0000 +Subject: spi: atmel-quadspi: fix possible MMIO window size overrun + +From: Tudor Ambarus + +commit 8e093ea4d3593379be46b845b9e823179558047e upstream. + +The QSPI controller memory space is limited to 128MB: +0x9000_00000-0x9800_00000/0XD000_0000--0XD800_0000. + +There are nor flashes that are bigger in size than the memory size +supported by the controller: Micron MT25QL02G (256 MB). + +Check if the address exceeds the MMIO window size. An improvement +would be to add support for regular SPI mode and fall back to it +when the flash memories overrun the controller's memory space. + +Fixes: 0e6aae08e9ae ("spi: Add QuadSPI driver for Atmel SAMA5D2") +Signed-off-by: Tudor Ambarus +Link: https://lore.kernel.org/r/20200228155437.1558219-1-tudor.ambarus@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/spi/atmel-quadspi.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/spi/atmel-quadspi.c ++++ b/drivers/spi/atmel-quadspi.c +@@ -149,6 +149,7 @@ struct atmel_qspi { + struct clk *qspick; + struct platform_device *pdev; + const struct atmel_qspi_caps *caps; ++ resource_size_t mmap_size; + u32 pending; + u32 mr; + u32 scr; +@@ -329,6 +330,14 @@ static int atmel_qspi_exec_op(struct spi + u32 sr, offset; + int err; + ++ /* ++ * Check if the address exceeds the MMIO window size. An improvement ++ * would be to add support for regular SPI mode and fall back to it ++ * when the flash memories overrun the controller's memory space. ++ */ ++ if (op->addr.val + op->data.nbytes > aq->mmap_size) ++ return -ENOTSUPP; ++ + err = atmel_qspi_set_cfg(aq, op, &offset); + if (err) + return err; +@@ -480,6 +489,8 @@ static int atmel_qspi_probe(struct platf + goto exit; + } + ++ aq->mmap_size = resource_size(res); ++ + /* Get the peripheral clock */ + aq->pclk = devm_clk_get(&pdev->dev, "pclk"); + if (IS_ERR(aq->pclk))