From: Sasha Levin Date: Mon, 26 Oct 2020 04:58:12 +0000 (-0400) Subject: Fixes for 5.8 X-Git-Tag: v4.4.241~27 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=8cf621bfc9ab6381e3ce677fc39ebca6de09101f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.8 Signed-off-by: Sasha Levin --- diff --git a/queue-5.8/afs-fix-cell-purging-with-aliases.patch b/queue-5.8/afs-fix-cell-purging-with-aliases.patch new file mode 100644 index 00000000000..a6b13f6f8e8 --- /dev/null +++ b/queue-5.8/afs-fix-cell-purging-with-aliases.patch @@ -0,0 +1,61 @@ +From 4d82b0fcb551c9685b3b4a7f71f08857eb9e2f6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 11:05:01 +0100 +Subject: afs: Fix cell purging with aliases + +From: David Howells + +[ Upstream commit 286377f6bdf71568a4cf07104fe44006ae0dba6d ] + +When the afs module is removed, one of the things that has to be done is to +purge the cell database. afs_cell_purge() cancels the management timer and +then starts the cell manager work item to do the purging. This does a +single run through and then assumes that all cells are now purged - but +this is no longer the case. + +With the introduction of alias detection, a later cell in the database can +now be holding an active count on an earlier cell (cell->alias_of). The +purge scan passes by the earlier cell first, but this can't be got rid of +until it has discarded the alias. Ordinarily, afs_unuse_cell() would +handle this by setting the management timer to trigger another pass - but +afs_set_cell_timer() doesn't do anything if the namespace is being removed +(net->live == false). rmmod then hangs in the wait on cells_outstanding in +afs_cell_purge(). + +Fix this by making afs_set_cell_timer() directly queue the cell manager if +net->live is false. This causes additional management passes. + +Queueing the cell manager increments cells_outstanding to make sure the +wait won't complete until all cells are destroyed. + +Fixes: 8a070a964877 ("afs: Detect cell aliases 1 - Cells with root volumes") +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/afs/cell.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/afs/cell.c b/fs/afs/cell.c +index c906000b0ff84..1944be78e9b0d 100644 +--- a/fs/afs/cell.c ++++ b/fs/afs/cell.c +@@ -19,6 +19,7 @@ static unsigned __read_mostly afs_cell_gc_delay = 10; + static unsigned __read_mostly afs_cell_min_ttl = 10 * 60; + static unsigned __read_mostly afs_cell_max_ttl = 24 * 60 * 60; + ++static void afs_queue_cell_manager(struct afs_net *); + static void afs_manage_cell_work(struct work_struct *); + + static void afs_dec_cells_outstanding(struct afs_net *net) +@@ -37,6 +38,8 @@ static void afs_set_cell_timer(struct afs_net *net, time64_t delay) + atomic_inc(&net->cells_outstanding); + if (timer_reduce(&net->cells_timer, jiffies + delay * HZ)) + afs_dec_cells_outstanding(net); ++ } else { ++ afs_queue_cell_manager(net); + } + } + +-- +2.25.1 + diff --git a/queue-5.8/afs-fix-cell-refcounting-by-splitting-the-usage-coun.patch b/queue-5.8/afs-fix-cell-refcounting-by-splitting-the-usage-coun.patch new file mode 100644 index 00000000000..f7eea2e8cc0 --- /dev/null +++ b/queue-5.8/afs-fix-cell-refcounting-by-splitting-the-usage-coun.patch @@ -0,0 +1,665 @@ +From 0ce9592838a94de1e3da9cdb323056e8c1644cd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jul 2019 11:24:59 +0100 +Subject: afs: Fix cell refcounting by splitting the usage counter + +From: David Howells + +[ Upstream commit 88c853c3f5c0a07c5db61b494ee25152535cfeee ] + +Management of the lifetime of afs_cell struct has some problems due to the +usage counter being used to determine whether objects of that type are in +use in addition to whether anyone might be interested in the structure. + +This is made trickier by cell objects being cached for a period of time in +case they're quickly reused as they hold the result of a setup process that +may be slow (DNS lookups, AFS RPC ops). + +Problems include the cached root volume from alias resolution pinning its +parent cell record, rmmod occasionally hanging and occasionally producing +assertion failures. + +Fix this by splitting the count of active users from the struct reference +count. Things then work as follows: + + (1) The cell cache keeps +1 on the cell's activity count and this has to + be dropped before the cell can be removed. afs_manage_cell() tries to + exchange the 1 to a 0 with the cells_lock write-locked, and if + successful, the record is removed from the net->cells. + + (2) One struct ref is 'owned' by the activity count. That is put when the + active count is reduced to 0 (final_destruction label). + + (3) A ref can be held on a cell whilst it is queued for management on a + work queue without confusing the active count. afs_queue_cell() is + added to wrap this. + + (4) The queue's ref is dropped at the end of the management. This is + split out into a separate function, afs_manage_cell_work(). + + (5) The root volume record is put after a cell is removed (at the + final_destruction label) rather then in the RCU destruction routine. + + (6) Volumes hold struct refs, but aren't active users. + + (7) Both counts are displayed in /proc/net/afs/cells. + +There are some management function changes: + + (*) afs_put_cell() now just decrements the refcount and triggers the RCU + destruction if it becomes 0. It no longer sets a timer to have the + manager do this. + + (*) afs_use_cell() and afs_unuse_cell() are added to increase and decrease + the active count. afs_unuse_cell() sets the management timer. + + (*) afs_queue_cell() is added to queue a cell with approprate refs. + +There are also some other fixes: + + (*) Don't let /proc/net/afs/cells access a cell's vllist if it's NULL. + + (*) Make sure that candidate cells in lookups are properly destroyed + rather than being simply kfree'd. This ensures the bits it points to + are destroyed also. + + (*) afs_dec_cells_outstanding() is now called in cell destruction rather + than at "final_destruction". This ensures that cell->net is still + valid to the end of the destructor. + + (*) As a consequence of the previous two changes, move the increment of + net->cells_outstanding that was at the point of insertion into the + tree to the allocation routine to correctly balance things. + +Fixes: 989782dcdc91 ("afs: Overhaul cell database management") +Signed-off-by: David Howells +Signed-off-by: Sasha Levin +--- + fs/afs/cell.c | 149 +++++++++++++++++++++++++++++++-------------- + fs/afs/dynroot.c | 2 +- + fs/afs/internal.h | 8 ++- + fs/afs/mntpt.c | 4 +- + fs/afs/proc.c | 23 ++++--- + fs/afs/super.c | 12 ++-- + fs/afs/vl_alias.c | 8 +-- + fs/afs/vl_rotate.c | 2 +- + fs/afs/volume.c | 4 +- + 9 files changed, 136 insertions(+), 76 deletions(-) + +diff --git a/fs/afs/cell.c b/fs/afs/cell.c +index 5da83e84952a2..c906000b0ff84 100644 +--- a/fs/afs/cell.c ++++ b/fs/afs/cell.c +@@ -19,7 +19,7 @@ static unsigned __read_mostly afs_cell_gc_delay = 10; + static unsigned __read_mostly afs_cell_min_ttl = 10 * 60; + static unsigned __read_mostly afs_cell_max_ttl = 24 * 60 * 60; + +-static void afs_manage_cell(struct work_struct *); ++static void afs_manage_cell_work(struct work_struct *); + + static void afs_dec_cells_outstanding(struct afs_net *net) + { +@@ -62,8 +62,7 @@ static struct afs_cell *afs_find_cell_locked(struct afs_net *net, + cell = net->ws_cell; + if (!cell) + return ERR_PTR(-EDESTADDRREQ); +- afs_get_cell(cell); +- return cell; ++ goto found; + } + + p = net->cells.rb_node; +@@ -85,12 +84,12 @@ static struct afs_cell *afs_find_cell_locked(struct afs_net *net, + return ERR_PTR(-ENOENT); + + found: +- if (!atomic_inc_not_zero(&cell->usage)) +- return ERR_PTR(-ENOENT); +- +- return cell; ++ return afs_use_cell(cell); + } + ++/* ++ * Look up and get an activation reference on a cell record. ++ */ + struct afs_cell *afs_find_cell(struct afs_net *net, + const char *name, unsigned int namesz) + { +@@ -153,8 +152,9 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net, + cell->name[i] = tolower(name[i]); + cell->name[i] = 0; + +- atomic_set(&cell->usage, 2); +- INIT_WORK(&cell->manager, afs_manage_cell); ++ atomic_set(&cell->ref, 1); ++ atomic_set(&cell->active, 0); ++ INIT_WORK(&cell->manager, afs_manage_cell_work); + cell->volumes = RB_ROOT; + INIT_HLIST_HEAD(&cell->proc_volumes); + seqlock_init(&cell->volume_lock); +@@ -193,6 +193,7 @@ static struct afs_cell *afs_alloc_cell(struct afs_net *net, + cell->dns_source = vllist->source; + cell->dns_status = vllist->status; + smp_store_release(&cell->dns_lookup_count, 1); /* vs source/status */ ++ atomic_inc(&net->cells_outstanding); + + _leave(" = %p", cell); + return cell; +@@ -275,12 +276,12 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net, + + cell = candidate; + candidate = NULL; ++ atomic_set(&cell->active, 2); + rb_link_node_rcu(&cell->net_node, parent, pp); + rb_insert_color(&cell->net_node, &net->cells); +- atomic_inc(&net->cells_outstanding); + up_write(&net->cells_lock); + +- queue_work(afs_wq, &cell->manager); ++ afs_queue_cell(cell); + + wait_for_cell: + _debug("wait_for_cell"); +@@ -305,16 +306,17 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net, + if (excl) { + ret = -EEXIST; + } else { +- afs_get_cell(cursor); ++ afs_use_cell(cursor); + ret = 0; + } + up_write(&net->cells_lock); +- kfree(candidate); ++ if (candidate) ++ afs_put_cell(candidate); + if (ret == 0) + goto wait_for_cell; + goto error_noput; + error: +- afs_put_cell(net, cell); ++ afs_unuse_cell(net, cell); + error_noput: + _leave(" = %d [error]", ret); + return ERR_PTR(ret); +@@ -359,7 +361,7 @@ int afs_cell_init(struct afs_net *net, const char *rootcell) + } + + if (!test_and_set_bit(AFS_CELL_FL_NO_GC, &new_root->flags)) +- afs_get_cell(new_root); ++ afs_use_cell(new_root); + + /* install the new cell */ + down_write(&net->cells_lock); +@@ -367,7 +369,7 @@ int afs_cell_init(struct afs_net *net, const char *rootcell) + net->ws_cell = new_root; + up_write(&net->cells_lock); + +- afs_put_cell(net, old_root); ++ afs_unuse_cell(net, old_root); + _leave(" = 0"); + return 0; + } +@@ -473,18 +475,21 @@ static int afs_update_cell(struct afs_cell *cell) + static void afs_cell_destroy(struct rcu_head *rcu) + { + struct afs_cell *cell = container_of(rcu, struct afs_cell, rcu); ++ struct afs_net *net = cell->net; ++ int u; + + _enter("%p{%s}", cell, cell->name); + +- ASSERTCMP(atomic_read(&cell->usage), ==, 0); ++ u = atomic_read(&cell->ref); ++ ASSERTCMP(u, ==, 0); + +- afs_put_volume(cell->net, cell->root_volume, afs_volume_trace_put_cell_root); +- afs_put_vlserverlist(cell->net, rcu_access_pointer(cell->vl_servers)); +- afs_put_cell(cell->net, cell->alias_of); ++ afs_put_vlserverlist(net, rcu_access_pointer(cell->vl_servers)); ++ afs_unuse_cell(net, cell->alias_of); + key_put(cell->anonymous_key); + kfree(cell->name); + kfree(cell); + ++ afs_dec_cells_outstanding(net); + _leave(" [destroyed]"); + } + +@@ -519,16 +524,50 @@ void afs_cells_timer(struct timer_list *timer) + */ + struct afs_cell *afs_get_cell(struct afs_cell *cell) + { +- atomic_inc(&cell->usage); ++ if (atomic_read(&cell->ref) <= 0) ++ BUG(); ++ ++ atomic_inc(&cell->ref); + return cell; + } + + /* + * Drop a reference on a cell record. + */ +-void afs_put_cell(struct afs_net *net, struct afs_cell *cell) ++void afs_put_cell(struct afs_cell *cell) ++{ ++ if (cell) { ++ unsigned int u, a; ++ ++ u = atomic_dec_return(&cell->ref); ++ if (u == 0) { ++ a = atomic_read(&cell->active); ++ WARN(a != 0, "Cell active count %u > 0\n", a); ++ call_rcu(&cell->rcu, afs_cell_destroy); ++ } ++ } ++} ++ ++/* ++ * Note a cell becoming more active. ++ */ ++struct afs_cell *afs_use_cell(struct afs_cell *cell) ++{ ++ if (atomic_read(&cell->ref) <= 0) ++ BUG(); ++ ++ atomic_inc(&cell->active); ++ return cell; ++} ++ ++/* ++ * Record a cell becoming less active. When the active counter reaches 1, it ++ * is scheduled for destruction, but may get reactivated. ++ */ ++void afs_unuse_cell(struct afs_net *net, struct afs_cell *cell) + { + time64_t now, expire_delay; ++ int a; + + if (!cell) + return; +@@ -541,11 +580,21 @@ void afs_put_cell(struct afs_net *net, struct afs_cell *cell) + if (cell->vl_servers->nr_servers) + expire_delay = afs_cell_gc_delay; + +- if (atomic_dec_return(&cell->usage) > 1) +- return; ++ a = atomic_dec_return(&cell->active); ++ WARN_ON(a == 0); ++ if (a == 1) ++ /* 'cell' may now be garbage collected. */ ++ afs_set_cell_timer(net, expire_delay); ++} + +- /* 'cell' may now be garbage collected. */ +- afs_set_cell_timer(net, expire_delay); ++/* ++ * Queue a cell for management, giving the workqueue a ref to hold. ++ */ ++void afs_queue_cell(struct afs_cell *cell) ++{ ++ afs_get_cell(cell); ++ if (!queue_work(afs_wq, &cell->manager)) ++ afs_put_cell(cell); + } + + /* +@@ -645,12 +694,11 @@ static void afs_deactivate_cell(struct afs_net *net, struct afs_cell *cell) + * Manage a cell record, initialising and destroying it, maintaining its DNS + * records. + */ +-static void afs_manage_cell(struct work_struct *work) ++static void afs_manage_cell(struct afs_cell *cell) + { +- struct afs_cell *cell = container_of(work, struct afs_cell, manager); + struct afs_net *net = cell->net; + bool deleted; +- int ret, usage; ++ int ret, active; + + _enter("%s", cell->name); + +@@ -660,10 +708,11 @@ static void afs_manage_cell(struct work_struct *work) + case AFS_CELL_INACTIVE: + case AFS_CELL_FAILED: + down_write(&net->cells_lock); +- usage = 1; +- deleted = atomic_try_cmpxchg_relaxed(&cell->usage, &usage, 0); +- if (deleted) ++ active = 1; ++ deleted = atomic_try_cmpxchg_relaxed(&cell->active, &active, 0); ++ if (deleted) { + rb_erase(&cell->net_node, &net->cells); ++ } + up_write(&net->cells_lock); + if (deleted) + goto final_destruction; +@@ -688,7 +737,7 @@ static void afs_manage_cell(struct work_struct *work) + goto again; + + case AFS_CELL_ACTIVE: +- if (atomic_read(&cell->usage) > 1) { ++ if (atomic_read(&cell->active) > 1) { + if (test_and_clear_bit(AFS_CELL_FL_DO_LOOKUP, &cell->flags)) { + ret = afs_update_cell(cell); + if (ret < 0) +@@ -701,7 +750,7 @@ static void afs_manage_cell(struct work_struct *work) + goto again; + + case AFS_CELL_DEACTIVATING: +- if (atomic_read(&cell->usage) > 1) ++ if (atomic_read(&cell->active) > 1) + goto reverse_deactivation; + afs_deactivate_cell(net, cell); + smp_store_release(&cell->state, AFS_CELL_INACTIVE); +@@ -733,9 +782,18 @@ static void afs_manage_cell(struct work_struct *work) + return; + + final_destruction: +- call_rcu(&cell->rcu, afs_cell_destroy); +- afs_dec_cells_outstanding(net); +- _leave(" [destruct %d]", atomic_read(&net->cells_outstanding)); ++ /* The root volume is pinning the cell */ ++ afs_put_volume(cell->net, cell->root_volume, afs_volume_trace_put_cell_root); ++ cell->root_volume = NULL; ++ afs_put_cell(cell); ++} ++ ++static void afs_manage_cell_work(struct work_struct *work) ++{ ++ struct afs_cell *cell = container_of(work, struct afs_cell, manager); ++ ++ afs_manage_cell(cell); ++ afs_put_cell(cell); + } + + /* +@@ -769,21 +827,20 @@ void afs_manage_cells(struct work_struct *work) + for (cursor = rb_first(&net->cells); cursor; cursor = rb_next(cursor)) { + struct afs_cell *cell = + rb_entry(cursor, struct afs_cell, net_node); +- unsigned usage; ++ unsigned active; + bool sched_cell = false; + +- usage = atomic_read(&cell->usage); +- _debug("manage %s %u", cell->name, usage); ++ active = atomic_read(&cell->active); ++ _debug("manage %s %u %u", cell->name, atomic_read(&cell->ref), active); + +- ASSERTCMP(usage, >=, 1); ++ ASSERTCMP(active, >=, 1); + + if (purging) { + if (test_and_clear_bit(AFS_CELL_FL_NO_GC, &cell->flags)) +- usage = atomic_dec_return(&cell->usage); +- ASSERTCMP(usage, ==, 1); ++ atomic_dec(&cell->active); + } + +- if (usage == 1) { ++ if (active == 1) { + struct afs_vlserver_list *vllist; + time64_t expire_at = cell->last_inactive; + +@@ -806,7 +863,7 @@ void afs_manage_cells(struct work_struct *work) + } + + if (sched_cell) +- queue_work(afs_wq, &cell->manager); ++ afs_queue_cell(cell); + } + + up_read(&net->cells_lock); +@@ -843,7 +900,7 @@ void afs_cell_purge(struct afs_net *net) + ws = net->ws_cell; + net->ws_cell = NULL; + up_write(&net->cells_lock); +- afs_put_cell(net, ws); ++ afs_unuse_cell(net, ws); + + _debug("del timer"); + if (del_timer_sync(&net->cells_timer)) +diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c +index 5b8de4fee6cda..da32797dd4257 100644 +--- a/fs/afs/dynroot.c ++++ b/fs/afs/dynroot.c +@@ -125,7 +125,7 @@ static int afs_probe_cell_name(struct dentry *dentry) + + cell = afs_find_cell(net, name, len); + if (!IS_ERR(cell)) { +- afs_put_cell(net, cell); ++ afs_unuse_cell(net, cell); + return 0; + } + +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index 3c28292c0cc70..522597b401fec 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -363,7 +363,8 @@ struct afs_cell { + #endif + time64_t dns_expiry; /* Time AFSDB/SRV record expires */ + time64_t last_inactive; /* Time of last drop of usage count */ +- atomic_t usage; ++ atomic_t ref; /* Struct refcount */ ++ atomic_t active; /* Active usage counter */ + unsigned long flags; + #define AFS_CELL_FL_NO_GC 0 /* The cell was added manually, don't auto-gc */ + #define AFS_CELL_FL_DO_LOOKUP 1 /* DNS lookup requested */ +@@ -918,8 +919,11 @@ extern int afs_cell_init(struct afs_net *, const char *); + extern struct afs_cell *afs_find_cell(struct afs_net *, const char *, unsigned); + extern struct afs_cell *afs_lookup_cell(struct afs_net *, const char *, unsigned, + const char *, bool); ++extern struct afs_cell *afs_use_cell(struct afs_cell *); ++extern void afs_unuse_cell(struct afs_net *, struct afs_cell *); + extern struct afs_cell *afs_get_cell(struct afs_cell *); +-extern void afs_put_cell(struct afs_net *, struct afs_cell *); ++extern void afs_put_cell(struct afs_cell *); ++extern void afs_queue_cell(struct afs_cell *); + extern void afs_manage_cells(struct work_struct *); + extern void afs_cells_timer(struct timer_list *); + extern void __net_exit afs_cell_purge(struct afs_net *); +diff --git a/fs/afs/mntpt.c b/fs/afs/mntpt.c +index 79bc5f1338edf..c69a0282960cc 100644 +--- a/fs/afs/mntpt.c ++++ b/fs/afs/mntpt.c +@@ -88,7 +88,7 @@ static int afs_mntpt_set_params(struct fs_context *fc, struct dentry *mntpt) + ctx->force = true; + } + if (ctx->cell) { +- afs_put_cell(ctx->net, ctx->cell); ++ afs_unuse_cell(ctx->net, ctx->cell); + ctx->cell = NULL; + } + if (test_bit(AFS_VNODE_PSEUDODIR, &vnode->flags)) { +@@ -124,7 +124,7 @@ static int afs_mntpt_set_params(struct fs_context *fc, struct dentry *mntpt) + char *buf; + + if (src_as->cell) +- ctx->cell = afs_get_cell(src_as->cell); ++ ctx->cell = afs_use_cell(src_as->cell); + + if (size < 2 || size > PAGE_SIZE - 1) + return -EINVAL; +diff --git a/fs/afs/proc.c b/fs/afs/proc.c +index e817fc740ba01..855d7358933b4 100644 +--- a/fs/afs/proc.c ++++ b/fs/afs/proc.c +@@ -38,7 +38,7 @@ static int afs_proc_cells_show(struct seq_file *m, void *v) + + if (v == SEQ_START_TOKEN) { + /* display header on line 1 */ +- seq_puts(m, "USE TTL SV ST NAME\n"); ++ seq_puts(m, "USE ACT TTL SV ST NAME\n"); + return 0; + } + +@@ -46,10 +46,11 @@ static int afs_proc_cells_show(struct seq_file *m, void *v) + vllist = rcu_dereference(cell->vl_servers); + + /* display one cell per line on subsequent lines */ +- seq_printf(m, "%3u %6lld %2u %2u %s\n", +- atomic_read(&cell->usage), ++ seq_printf(m, "%3u %3u %6lld %2u %2u %s\n", ++ atomic_read(&cell->ref), ++ atomic_read(&cell->active), + cell->dns_expiry - ktime_get_real_seconds(), +- vllist->nr_servers, ++ vllist ? vllist->nr_servers : 0, + cell->state, + cell->name); + return 0; +@@ -128,7 +129,7 @@ static int afs_proc_cells_write(struct file *file, char *buf, size_t size) + } + + if (test_and_set_bit(AFS_CELL_FL_NO_GC, &cell->flags)) +- afs_put_cell(net, cell); ++ afs_unuse_cell(net, cell); + } else { + goto inval; + } +@@ -154,13 +155,11 @@ static int afs_proc_rootcell_show(struct seq_file *m, void *v) + struct afs_net *net; + + net = afs_seq2net_single(m); +- if (rcu_access_pointer(net->ws_cell)) { +- rcu_read_lock(); +- cell = rcu_dereference(net->ws_cell); +- if (cell) +- seq_printf(m, "%s\n", cell->name); +- rcu_read_unlock(); +- } ++ down_read(&net->cells_lock); ++ cell = net->ws_cell; ++ if (cell) ++ seq_printf(m, "%s\n", cell->name); ++ up_read(&net->cells_lock); + return 0; + } + +diff --git a/fs/afs/super.c b/fs/afs/super.c +index 0be99016ecfb9..e72c223f831d2 100644 +--- a/fs/afs/super.c ++++ b/fs/afs/super.c +@@ -294,7 +294,7 @@ static int afs_parse_source(struct fs_context *fc, struct fs_parameter *param) + cellnamesz, cellnamesz, cellname ?: ""); + return PTR_ERR(cell); + } +- afs_put_cell(ctx->net, ctx->cell); ++ afs_unuse_cell(ctx->net, ctx->cell); + ctx->cell = cell; + } + +@@ -389,8 +389,8 @@ static int afs_validate_fc(struct fs_context *fc) + _debug("switch to alias"); + key_put(ctx->key); + ctx->key = NULL; +- cell = afs_get_cell(ctx->cell->alias_of); +- afs_put_cell(ctx->net, ctx->cell); ++ cell = afs_use_cell(ctx->cell->alias_of); ++ afs_unuse_cell(ctx->net, ctx->cell); + ctx->cell = cell; + goto reget_key; + } +@@ -508,7 +508,7 @@ static struct afs_super_info *afs_alloc_sbi(struct fs_context *fc) + if (ctx->dyn_root) { + as->dyn_root = true; + } else { +- as->cell = afs_get_cell(ctx->cell); ++ as->cell = afs_use_cell(ctx->cell); + as->volume = afs_get_volume(ctx->volume, + afs_volume_trace_get_alloc_sbi); + } +@@ -521,7 +521,7 @@ static void afs_destroy_sbi(struct afs_super_info *as) + if (as) { + struct afs_net *net = afs_net(as->net_ns); + afs_put_volume(net, as->volume, afs_volume_trace_put_destroy_sbi); +- afs_put_cell(net, as->cell); ++ afs_unuse_cell(net, as->cell); + put_net(as->net_ns); + kfree(as); + } +@@ -607,7 +607,7 @@ static void afs_free_fc(struct fs_context *fc) + + afs_destroy_sbi(fc->s_fs_info); + afs_put_volume(ctx->net, ctx->volume, afs_volume_trace_put_free_fc); +- afs_put_cell(ctx->net, ctx->cell); ++ afs_unuse_cell(ctx->net, ctx->cell); + key_put(ctx->key); + kfree(ctx); + } +diff --git a/fs/afs/vl_alias.c b/fs/afs/vl_alias.c +index 5082ef04e99c5..ddb4cb67d0fd9 100644 +--- a/fs/afs/vl_alias.c ++++ b/fs/afs/vl_alias.c +@@ -177,7 +177,7 @@ static int afs_compare_cell_roots(struct afs_cell *cell) + + is_alias: + rcu_read_unlock(); +- cell->alias_of = afs_get_cell(p); ++ cell->alias_of = afs_use_cell(p); + return 1; + } + +@@ -247,18 +247,18 @@ static int afs_query_for_alias(struct afs_cell *cell, struct key *key) + continue; + if (p->root_volume) + continue; /* Ignore cells that have a root.cell volume. */ +- afs_get_cell(p); ++ afs_use_cell(p); + mutex_unlock(&cell->net->proc_cells_lock); + + if (afs_query_for_alias_one(cell, key, p) != 0) + goto is_alias; + + if (mutex_lock_interruptible(&cell->net->proc_cells_lock) < 0) { +- afs_put_cell(cell->net, p); ++ afs_unuse_cell(cell->net, p); + return -ERESTARTSYS; + } + +- afs_put_cell(cell->net, p); ++ afs_unuse_cell(cell->net, p); + } + + mutex_unlock(&cell->net->proc_cells_lock); +diff --git a/fs/afs/vl_rotate.c b/fs/afs/vl_rotate.c +index f405ca8b240a5..750bd1579f212 100644 +--- a/fs/afs/vl_rotate.c ++++ b/fs/afs/vl_rotate.c +@@ -45,7 +45,7 @@ static bool afs_start_vl_iteration(struct afs_vl_cursor *vc) + cell->dns_expiry <= ktime_get_real_seconds()) { + dns_lookup_count = smp_load_acquire(&cell->dns_lookup_count); + set_bit(AFS_CELL_FL_DO_LOOKUP, &cell->flags); +- queue_work(afs_wq, &cell->manager); ++ afs_queue_cell(cell); + + if (cell->dns_source == DNS_RECORD_UNAVAILABLE) { + if (wait_var_event_interruptible( +diff --git a/fs/afs/volume.c b/fs/afs/volume.c +index 9bc0509e3634c..a838030e95634 100644 +--- a/fs/afs/volume.c ++++ b/fs/afs/volume.c +@@ -106,7 +106,7 @@ static struct afs_volume *afs_alloc_volume(struct afs_fs_context *params, + return volume; + + error_1: +- afs_put_cell(params->net, volume->cell); ++ afs_put_cell(volume->cell); + kfree(volume); + error_0: + return ERR_PTR(ret); +@@ -228,7 +228,7 @@ static void afs_destroy_volume(struct afs_net *net, struct afs_volume *volume) + + afs_remove_volume_from_cell(volume); + afs_put_serverlist(net, rcu_access_pointer(volume->servers)); +- afs_put_cell(net, volume->cell); ++ afs_put_cell(volume->cell); + trace_afs_volume(volume->vid, atomic_read(&volume->usage), + afs_volume_trace_free); + kfree_rcu(volume, rcu); +-- +2.25.1 + diff --git a/queue-5.8/afs-fix-cell-removal.patch b/queue-5.8/afs-fix-cell-removal.patch new file mode 100644 index 00000000000..c5ad1a07415 --- /dev/null +++ b/queue-5.8/afs-fix-cell-removal.patch @@ -0,0 +1,104 @@ +From 09357e0ef91cebbe29458474fc93b9324d717649 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Oct 2020 13:21:14 +0100 +Subject: afs: Fix cell removal + +From: David Howells + +[ Upstream commit 1d0e850a49a5b56f8f3cb51e74a11e2fedb96be6 ] + +Fix cell removal by inserting a more final state than AFS_CELL_FAILED that +indicates that the cell has been unpublished in case the manager is already +requeued and will go through again. The new AFS_CELL_REMOVED state will +just immediately leave the manager function. + +Going through a second time in the AFS_CELL_FAILED state will cause it to +try to remove the cell again, potentially leading to the proc list being +removed. + +Fixes: 989782dcdc91 ("afs: Overhaul cell database management") +Reported-by: syzbot+b994ecf2b023f14832c1@syzkaller.appspotmail.com +Reported-by: syzbot+0e0db88e1eb44a91ae8d@syzkaller.appspotmail.com +Reported-by: syzbot+2d0585e5efcd43d113c2@syzkaller.appspotmail.com +Reported-by: syzbot+1ecc2f9d3387f1d79d42@syzkaller.appspotmail.com +Reported-by: syzbot+18d51774588492bf3f69@syzkaller.appspotmail.com +Reported-by: syzbot+a5e4946b04d6ca8fa5f3@syzkaller.appspotmail.com +Suggested-by: Hillf Danton +Signed-off-by: David Howells +cc: Hillf Danton +Signed-off-by: Sasha Levin +--- + fs/afs/cell.c | 16 ++++++++++------ + fs/afs/internal.h | 1 + + 2 files changed, 11 insertions(+), 6 deletions(-) + +diff --git a/fs/afs/cell.c b/fs/afs/cell.c +index 1944be78e9b0d..bc7ed46aaca9f 100644 +--- a/fs/afs/cell.c ++++ b/fs/afs/cell.c +@@ -291,11 +291,11 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net, + wait_var_event(&cell->state, + ({ + state = smp_load_acquire(&cell->state); /* vs error */ +- state == AFS_CELL_ACTIVE || state == AFS_CELL_FAILED; ++ state == AFS_CELL_ACTIVE || state == AFS_CELL_REMOVED; + })); + + /* Check the state obtained from the wait check. */ +- if (state == AFS_CELL_FAILED) { ++ if (state == AFS_CELL_REMOVED) { + ret = cell->error; + goto error; + } +@@ -700,7 +700,6 @@ static void afs_deactivate_cell(struct afs_net *net, struct afs_cell *cell) + static void afs_manage_cell(struct afs_cell *cell) + { + struct afs_net *net = cell->net; +- bool deleted; + int ret, active; + + _enter("%s", cell->name); +@@ -712,13 +711,15 @@ static void afs_manage_cell(struct afs_cell *cell) + case AFS_CELL_FAILED: + down_write(&net->cells_lock); + active = 1; +- deleted = atomic_try_cmpxchg_relaxed(&cell->active, &active, 0); +- if (deleted) { ++ if (atomic_try_cmpxchg_relaxed(&cell->active, &active, 0)) { + rb_erase(&cell->net_node, &net->cells); ++ smp_store_release(&cell->state, AFS_CELL_REMOVED); + } + up_write(&net->cells_lock); +- if (deleted) ++ if (cell->state == AFS_CELL_REMOVED) { ++ wake_up_var(&cell->state); + goto final_destruction; ++ } + if (cell->state == AFS_CELL_FAILED) + goto done; + smp_store_release(&cell->state, AFS_CELL_UNSET); +@@ -760,6 +761,9 @@ static void afs_manage_cell(struct afs_cell *cell) + wake_up_var(&cell->state); + goto again; + ++ case AFS_CELL_REMOVED: ++ goto done; ++ + default: + break; + } +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index 522597b401fec..7689f4535ef9c 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -326,6 +326,7 @@ enum afs_cell_state { + AFS_CELL_DEACTIVATING, + AFS_CELL_INACTIVE, + AFS_CELL_FAILED, ++ AFS_CELL_REMOVED, + }; + + /* +-- +2.25.1 + diff --git a/queue-5.8/afs-fix-rapid-cell-addition-removal-by-not-using-rcu.patch b/queue-5.8/afs-fix-rapid-cell-addition-removal-by-not-using-rcu.patch new file mode 100644 index 00000000000..d6617a24ba9 --- /dev/null +++ b/queue-5.8/afs-fix-rapid-cell-addition-removal-by-not-using-rcu.patch @@ -0,0 +1,394 @@ +From b9e65e355cbc3e25beb26da5034dcfed3124b080 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 14:11:58 +0100 +Subject: afs: Fix rapid cell addition/removal by not using RCU on cells tree + +From: David Howells + +[ Upstream commit 92e3cc91d8f51ce64a8b7c696377180953dd316e ] + +There are a number of problems that are being seen by the rapidly mounting +and unmounting an afs dynamic root with an explicit cell and volume +specified (which should probably be rejected, but that's a separate issue): + +What the tests are doing is to look up/create a cell record for the name +given and then tear it down again without actually using it to try to talk +to a server. This is repeated endlessly, very fast, and the new cell +collides with the old one if it's not quick enough to reuse it. + +It appears (as suggested by Hillf Danton) that the search through the RB +tree under a read_seqbegin_or_lock() under RCU conditions isn't safe and +that it's not blocking the write_seqlock(), despite taking two passes at +it. He suggested that the code should take a ref on the cell it's +attempting to look at - but this shouldn't be necessary until we've +compared the cell names. It's possible that I'm missing a barrier +somewhere. + +However, using an RCU search for this is overkill, really - we only need to +access the cell name in a few places, and they're places where we're may +end up sleeping anyway. + +Fix this by switching to an R/W semaphore instead. + +Additionally, draw the down_read() call inside the function (renamed to +afs_find_cell()) since all the callers were taking the RCU read lock (or +should've been[*]). + +[*] afs_probe_cell_name() should have been, but that doesn't appear to be +involved in the bug reports. + +The symptoms of this look like: + + general protection fault, probably for non-canonical address 0xf27d208691691fdb: 0000 [#1] PREEMPT SMP KASAN + KASAN: maybe wild-memory-access in range [0x93e924348b48fed8-0x93e924348b48fedf] + ... + RIP: 0010:strncasecmp lib/string.c:52 [inline] + RIP: 0010:strncasecmp+0x5f/0x240 lib/string.c:43 + afs_lookup_cell_rcu+0x313/0x720 fs/afs/cell.c:88 + afs_lookup_cell+0x2ee/0x1440 fs/afs/cell.c:249 + afs_parse_source fs/afs/super.c:290 [inline] + ... + +Fixes: 989782dcdc91 ("afs: Overhaul cell database management") +Reported-by: syzbot+459a5dce0b4cb70fd076@syzkaller.appspotmail.com +Signed-off-by: David Howells +cc: Hillf Danton +cc: syzkaller-bugs@googlegroups.com +Signed-off-by: Sasha Levin +--- + fs/afs/cell.c | 131 ++++++++++++++++++++-------------------------- + fs/afs/dynroot.c | 21 +++----- + fs/afs/internal.h | 6 +-- + fs/afs/main.c | 2 +- + fs/afs/super.c | 4 +- + 5 files changed, 71 insertions(+), 93 deletions(-) + +diff --git a/fs/afs/cell.c b/fs/afs/cell.c +index 5b79cdceefa0f..5da83e84952a2 100644 +--- a/fs/afs/cell.c ++++ b/fs/afs/cell.c +@@ -41,15 +41,15 @@ static void afs_set_cell_timer(struct afs_net *net, time64_t delay) + } + + /* +- * Look up and get an activation reference on a cell record under RCU +- * conditions. The caller must hold the RCU read lock. ++ * Look up and get an activation reference on a cell record. The caller must ++ * hold net->cells_lock at least read-locked. + */ +-struct afs_cell *afs_lookup_cell_rcu(struct afs_net *net, +- const char *name, unsigned int namesz) ++static struct afs_cell *afs_find_cell_locked(struct afs_net *net, ++ const char *name, unsigned int namesz) + { + struct afs_cell *cell = NULL; + struct rb_node *p; +- int n, seq = 0, ret = 0; ++ int n; + + _enter("%*.*s", namesz, namesz, name); + +@@ -58,61 +58,48 @@ struct afs_cell *afs_lookup_cell_rcu(struct afs_net *net, + if (namesz > AFS_MAXCELLNAME) + return ERR_PTR(-ENAMETOOLONG); + +- do { +- /* Unfortunately, rbtree walking doesn't give reliable results +- * under just the RCU read lock, so we have to check for +- * changes. +- */ +- if (cell) +- afs_put_cell(net, cell); +- cell = NULL; +- ret = -ENOENT; +- +- read_seqbegin_or_lock(&net->cells_lock, &seq); +- +- if (!name) { +- cell = rcu_dereference_raw(net->ws_cell); +- if (cell) { +- afs_get_cell(cell); +- ret = 0; +- break; +- } +- ret = -EDESTADDRREQ; +- continue; +- } ++ if (!name) { ++ cell = net->ws_cell; ++ if (!cell) ++ return ERR_PTR(-EDESTADDRREQ); ++ afs_get_cell(cell); ++ return cell; ++ } + +- p = rcu_dereference_raw(net->cells.rb_node); +- while (p) { +- cell = rb_entry(p, struct afs_cell, net_node); +- +- n = strncasecmp(cell->name, name, +- min_t(size_t, cell->name_len, namesz)); +- if (n == 0) +- n = cell->name_len - namesz; +- if (n < 0) { +- p = rcu_dereference_raw(p->rb_left); +- } else if (n > 0) { +- p = rcu_dereference_raw(p->rb_right); +- } else { +- if (atomic_inc_not_zero(&cell->usage)) { +- ret = 0; +- break; +- } +- /* We want to repeat the search, this time with +- * the lock properly locked. +- */ +- } +- cell = NULL; +- } ++ p = net->cells.rb_node; ++ while (p) { ++ cell = rb_entry(p, struct afs_cell, net_node); + +- } while (need_seqretry(&net->cells_lock, seq)); ++ n = strncasecmp(cell->name, name, ++ min_t(size_t, cell->name_len, namesz)); ++ if (n == 0) ++ n = cell->name_len - namesz; ++ if (n < 0) ++ p = p->rb_left; ++ else if (n > 0) ++ p = p->rb_right; ++ else ++ goto found; ++ } ++ ++ return ERR_PTR(-ENOENT); + +- done_seqretry(&net->cells_lock, seq); ++found: ++ if (!atomic_inc_not_zero(&cell->usage)) ++ return ERR_PTR(-ENOENT); + +- if (ret != 0 && cell) +- afs_put_cell(net, cell); ++ return cell; ++} + +- return ret == 0 ? cell : ERR_PTR(ret); ++struct afs_cell *afs_find_cell(struct afs_net *net, ++ const char *name, unsigned int namesz) ++{ ++ struct afs_cell *cell; ++ ++ down_read(&net->cells_lock); ++ cell = afs_find_cell_locked(net, name, namesz); ++ up_read(&net->cells_lock); ++ return cell; + } + + /* +@@ -245,9 +232,7 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net, + _enter("%s,%s", name, vllist); + + if (!excl) { +- rcu_read_lock(); +- cell = afs_lookup_cell_rcu(net, name, namesz); +- rcu_read_unlock(); ++ cell = afs_find_cell(net, name, namesz); + if (!IS_ERR(cell)) + goto wait_for_cell; + } +@@ -268,7 +253,7 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net, + /* Find the insertion point and check to see if someone else added a + * cell whilst we were allocating. + */ +- write_seqlock(&net->cells_lock); ++ down_write(&net->cells_lock); + + pp = &net->cells.rb_node; + parent = NULL; +@@ -293,7 +278,7 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net, + rb_link_node_rcu(&cell->net_node, parent, pp); + rb_insert_color(&cell->net_node, &net->cells); + atomic_inc(&net->cells_outstanding); +- write_sequnlock(&net->cells_lock); ++ up_write(&net->cells_lock); + + queue_work(afs_wq, &cell->manager); + +@@ -323,7 +308,7 @@ struct afs_cell *afs_lookup_cell(struct afs_net *net, + afs_get_cell(cursor); + ret = 0; + } +- write_sequnlock(&net->cells_lock); ++ up_write(&net->cells_lock); + kfree(candidate); + if (ret == 0) + goto wait_for_cell; +@@ -377,10 +362,10 @@ int afs_cell_init(struct afs_net *net, const char *rootcell) + afs_get_cell(new_root); + + /* install the new cell */ +- write_seqlock(&net->cells_lock); +- old_root = rcu_access_pointer(net->ws_cell); +- rcu_assign_pointer(net->ws_cell, new_root); +- write_sequnlock(&net->cells_lock); ++ down_write(&net->cells_lock); ++ old_root = net->ws_cell; ++ net->ws_cell = new_root; ++ up_write(&net->cells_lock); + + afs_put_cell(net, old_root); + _leave(" = 0"); +@@ -674,12 +659,12 @@ static void afs_manage_cell(struct work_struct *work) + switch (cell->state) { + case AFS_CELL_INACTIVE: + case AFS_CELL_FAILED: +- write_seqlock(&net->cells_lock); ++ down_write(&net->cells_lock); + usage = 1; + deleted = atomic_try_cmpxchg_relaxed(&cell->usage, &usage, 0); + if (deleted) + rb_erase(&cell->net_node, &net->cells); +- write_sequnlock(&net->cells_lock); ++ up_write(&net->cells_lock); + if (deleted) + goto final_destruction; + if (cell->state == AFS_CELL_FAILED) +@@ -779,7 +764,7 @@ void afs_manage_cells(struct work_struct *work) + * lack of use and cells whose DNS results have expired and dispatch + * their managers. + */ +- read_seqlock_excl(&net->cells_lock); ++ down_read(&net->cells_lock); + + for (cursor = rb_first(&net->cells); cursor; cursor = rb_next(cursor)) { + struct afs_cell *cell = +@@ -824,7 +809,7 @@ void afs_manage_cells(struct work_struct *work) + queue_work(afs_wq, &cell->manager); + } + +- read_sequnlock_excl(&net->cells_lock); ++ up_read(&net->cells_lock); + + /* Update the timer on the way out. We have to pass an increment on + * cells_outstanding in the namespace that we are in to the timer or +@@ -854,10 +839,10 @@ void afs_cell_purge(struct afs_net *net) + + _enter(""); + +- write_seqlock(&net->cells_lock); +- ws = rcu_access_pointer(net->ws_cell); +- RCU_INIT_POINTER(net->ws_cell, NULL); +- write_sequnlock(&net->cells_lock); ++ down_write(&net->cells_lock); ++ ws = net->ws_cell; ++ net->ws_cell = NULL; ++ up_write(&net->cells_lock); + afs_put_cell(net, ws); + + _debug("del timer"); +diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c +index 7b784af604fd9..5b8de4fee6cda 100644 +--- a/fs/afs/dynroot.c ++++ b/fs/afs/dynroot.c +@@ -123,7 +123,7 @@ static int afs_probe_cell_name(struct dentry *dentry) + len--; + } + +- cell = afs_lookup_cell_rcu(net, name, len); ++ cell = afs_find_cell(net, name, len); + if (!IS_ERR(cell)) { + afs_put_cell(net, cell); + return 0; +@@ -179,7 +179,6 @@ static struct dentry *afs_lookup_atcell(struct dentry *dentry) + struct afs_cell *cell; + struct afs_net *net = afs_d2net(dentry); + struct dentry *ret; +- unsigned int seq = 0; + char *name; + int len; + +@@ -191,17 +190,13 @@ static struct dentry *afs_lookup_atcell(struct dentry *dentry) + if (!name) + goto out_p; + +- rcu_read_lock(); +- do { +- read_seqbegin_or_lock(&net->cells_lock, &seq); +- cell = rcu_dereference_raw(net->ws_cell); +- if (cell) { +- len = cell->name_len; +- memcpy(name, cell->name, len + 1); +- } +- } while (need_seqretry(&net->cells_lock, seq)); +- done_seqretry(&net->cells_lock, seq); +- rcu_read_unlock(); ++ down_read(&net->cells_lock); ++ cell = net->ws_cell; ++ if (cell) { ++ len = cell->name_len; ++ memcpy(name, cell->name, len + 1); ++ } ++ up_read(&net->cells_lock); + + ret = ERR_PTR(-ENOENT); + if (!cell) +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index e1ebead2e505a..3c28292c0cc70 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -263,11 +263,11 @@ struct afs_net { + + /* Cell database */ + struct rb_root cells; +- struct afs_cell __rcu *ws_cell; ++ struct afs_cell *ws_cell; + struct work_struct cells_manager; + struct timer_list cells_timer; + atomic_t cells_outstanding; +- seqlock_t cells_lock; ++ struct rw_semaphore cells_lock; + struct mutex cells_alias_lock; + + struct mutex proc_cells_lock; +@@ -915,7 +915,7 @@ static inline bool afs_cb_is_broken(unsigned int cb_break, + * cell.c + */ + extern int afs_cell_init(struct afs_net *, const char *); +-extern struct afs_cell *afs_lookup_cell_rcu(struct afs_net *, const char *, unsigned); ++extern struct afs_cell *afs_find_cell(struct afs_net *, const char *, unsigned); + extern struct afs_cell *afs_lookup_cell(struct afs_net *, const char *, unsigned, + const char *, bool); + extern struct afs_cell *afs_get_cell(struct afs_cell *); +diff --git a/fs/afs/main.c b/fs/afs/main.c +index 31b472f7c734c..accdd8970e7c0 100644 +--- a/fs/afs/main.c ++++ b/fs/afs/main.c +@@ -78,7 +78,7 @@ static int __net_init afs_net_init(struct net *net_ns) + mutex_init(&net->socket_mutex); + + net->cells = RB_ROOT; +- seqlock_init(&net->cells_lock); ++ init_rwsem(&net->cells_lock); + INIT_WORK(&net->cells_manager, afs_manage_cells); + timer_setup(&net->cells_timer, afs_cells_timer, 0); + +diff --git a/fs/afs/super.c b/fs/afs/super.c +index b552357b1d137..0be99016ecfb9 100644 +--- a/fs/afs/super.c ++++ b/fs/afs/super.c +@@ -634,9 +634,7 @@ static int afs_init_fs_context(struct fs_context *fc) + ctx->net = afs_net(fc->net_ns); + + /* Default to the workstation cell. */ +- rcu_read_lock(); +- cell = afs_lookup_cell_rcu(ctx->net, NULL, 0); +- rcu_read_unlock(); ++ cell = afs_find_cell(ctx->net, NULL, 0); + if (IS_ERR(cell)) + cell = NULL; + ctx->cell = cell; +-- +2.25.1 + diff --git a/queue-5.8/alsa-hda-ca0132-add-ae-7-microphone-selection-comman.patch b/queue-5.8/alsa-hda-ca0132-add-ae-7-microphone-selection-comman.patch new file mode 100644 index 00000000000..8cdebee36c0 --- /dev/null +++ b/queue-5.8/alsa-hda-ca0132-add-ae-7-microphone-selection-comman.patch @@ -0,0 +1,70 @@ +From e9295681101e832fd586ffc9e5b11557c30098f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 16:10:37 -0400 +Subject: ALSA: hda/ca0132 - Add AE-7 microphone selection commands. + +From: Connor McAdams + +[ Upstream commit ed93f9750c6c2ed371347d0aac3dcd31cb9cf256 ] + +Add AE-7 quirk data for setting of microphone. The AE-7 has no front +panel connector, so only rear-mic/line-in have new commands. + +Signed-off-by: Connor McAdams +Link: https://lore.kernel.org/r/20200825201040.30339-19-conmanx360@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_ca0132.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 6dfa864d3fe7b..62a9be5b827eb 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -4675,6 +4675,15 @@ static int ca0132_alt_select_in(struct hda_codec *codec) + ca0113_mmio_command_set(codec, 0x30, 0x28, 0x00); + tmp = FLOAT_THREE; + break; ++ case QUIRK_AE7: ++ ca0113_mmio_command_set(codec, 0x30, 0x28, 0x00); ++ tmp = FLOAT_THREE; ++ chipio_set_conn_rate(codec, MEM_CONNID_MICIN2, ++ SR_96_000); ++ chipio_set_conn_rate(codec, MEM_CONNID_MICOUT2, ++ SR_96_000); ++ dspio_set_uint_param(codec, 0x80, 0x01, FLOAT_ZERO); ++ break; + default: + tmp = FLOAT_ONE; + break; +@@ -4720,6 +4729,14 @@ static int ca0132_alt_select_in(struct hda_codec *codec) + case QUIRK_AE5: + ca0113_mmio_command_set(codec, 0x30, 0x28, 0x00); + break; ++ case QUIRK_AE7: ++ ca0113_mmio_command_set(codec, 0x30, 0x28, 0x3f); ++ chipio_set_conn_rate(codec, MEM_CONNID_MICIN2, ++ SR_96_000); ++ chipio_set_conn_rate(codec, MEM_CONNID_MICOUT2, ++ SR_96_000); ++ dspio_set_uint_param(codec, 0x80, 0x01, FLOAT_ZERO); ++ break; + default: + break; + } +@@ -4729,7 +4746,10 @@ static int ca0132_alt_select_in(struct hda_codec *codec) + if (ca0132_quirk(spec) == QUIRK_R3DI) + chipio_set_conn_rate(codec, 0x0F, SR_96_000); + +- tmp = FLOAT_ZERO; ++ if (ca0132_quirk(spec) == QUIRK_AE7) ++ tmp = FLOAT_THREE; ++ else ++ tmp = FLOAT_ZERO; + dspio_set_uint_param(codec, 0x80, 0x00, tmp); + + switch (ca0132_quirk(spec)) { +-- +2.25.1 + diff --git a/queue-5.8/alsa-hda-ca0132-add-new-quirk-id-for-soundblaster-ae.patch b/queue-5.8/alsa-hda-ca0132-add-new-quirk-id-for-soundblaster-ae.patch new file mode 100644 index 00000000000..be2531b841b --- /dev/null +++ b/queue-5.8/alsa-hda-ca0132-add-new-quirk-id-for-soundblaster-ae.patch @@ -0,0 +1,42 @@ +From cab087b816a3b029aa0efb4c98234d935f6943c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 16:10:29 -0400 +Subject: ALSA: hda/ca0132 - Add new quirk ID for SoundBlaster AE-7. + +From: Connor McAdams + +[ Upstream commit 620f08eea6d6961b789af3fa3ea86725c8c93ece ] + +Add a new PCI subsystem ID for the SoundBlaster AE-7 card. + +Signed-off-by: Connor McAdams +Link: https://lore.kernel.org/r/20200825201040.30339-11-conmanx360@gmail.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/patch_ca0132.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 62a9be5b827eb..a49c322bdbe9d 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -1065,6 +1065,7 @@ enum { + QUIRK_R3DI, + QUIRK_R3D, + QUIRK_AE5, ++ QUIRK_AE7, + }; + + #ifdef CONFIG_PCI +@@ -1184,6 +1185,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = { + SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D), + SND_PCI_QUIRK(0x1102, 0x0018, "Recon3D", QUIRK_R3D), + SND_PCI_QUIRK(0x1102, 0x0051, "Sound Blaster AE-5", QUIRK_AE5), ++ SND_PCI_QUIRK(0x1102, 0x0081, "Sound Blaster AE-7", QUIRK_AE7), + {} + }; + +-- +2.25.1 + diff --git a/queue-5.8/alsa-seq-oss-avoid-mutex-lock-for-a-long-time-ioctl.patch b/queue-5.8/alsa-seq-oss-avoid-mutex-lock-for-a-long-time-ioctl.patch new file mode 100644 index 00000000000..0334043ec05 --- /dev/null +++ b/queue-5.8/alsa-seq-oss-avoid-mutex-lock-for-a-long-time-ioctl.patch @@ -0,0 +1,51 @@ +From c91b06d26c2881c5ae14c8629e0556eb44c679d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Sep 2020 10:38:56 +0200 +Subject: ALSA: seq: oss: Avoid mutex lock for a long-time ioctl + +From: Takashi Iwai + +[ Upstream commit 2759caad2600d503c3b0ed800e7e03d2cd7a4c05 ] + +Recently we applied a fix to cover the whole OSS sequencer ioctls with +the mutex for dealing with the possible races. This works fine in +general, but in theory, this may lead to unexpectedly long stall if an +ioctl like SNDCTL_SEQ_SYNC is issued and an event with the far future +timestamp was queued. + +For fixing such a potential stall, this patch changes the mutex lock +applied conditionally excluding such an ioctl command. Also, change +the mutex_lock() with the interruptible version for user to allow +escaping from the big-hammer mutex. + +Fixes: 80982c7e834e ("ALSA: seq: oss: Serialize ioctls") +Suggested-by: Pavel Machek +Link: https://lore.kernel.org/r/20200922083856.28572-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/seq/oss/seq_oss.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c +index c8b9c0b315d8f..250a92b187265 100644 +--- a/sound/core/seq/oss/seq_oss.c ++++ b/sound/core/seq/oss/seq_oss.c +@@ -174,9 +174,12 @@ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + if (snd_BUG_ON(!dp)) + return -ENXIO; + +- mutex_lock(®ister_mutex); ++ if (cmd != SNDCTL_SEQ_SYNC && ++ mutex_lock_interruptible(®ister_mutex)) ++ return -ERESTARTSYS; + rc = snd_seq_oss_ioctl(dp, cmd, arg); +- mutex_unlock(®ister_mutex); ++ if (cmd != SNDCTL_SEQ_SYNC) ++ mutex_unlock(®ister_mutex); + return rc; + } + +-- +2.25.1 + diff --git a/queue-5.8/arc-plat-hsdk-fix-kconfig-dependency-warning-when-re.patch b/queue-5.8/arc-plat-hsdk-fix-kconfig-dependency-warning-when-re.patch new file mode 100644 index 00000000000..92abaf4e1e5 --- /dev/null +++ b/queue-5.8/arc-plat-hsdk-fix-kconfig-dependency-warning-when-re.patch @@ -0,0 +1,45 @@ +From 6b106c9e1184674de29062681f5203dd279e104c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 14:46:52 +0300 +Subject: arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER + +From: Necip Fazil Yildiran + +[ Upstream commit 63bcf87cb1c57956e1179f1a78dde625c7e3cba7 ] + +When ARC_SOC_HSDK is enabled and RESET_CONTROLLER is disabled, it results +in the following Kbuild warning: + +WARNING: unmet direct dependencies detected for RESET_HSDK + Depends on [n]: RESET_CONTROLLER [=n] && HAS_IOMEM [=y] && (ARC_SOC_HSDK [=y] || COMPILE_TEST [=n]) + Selected by [y]: + - ARC_SOC_HSDK [=y] && ISA_ARCV2 [=y] + +The reason is that ARC_SOC_HSDK selects RESET_HSDK without depending on or +selecting RESET_CONTROLLER while RESET_HSDK is subordinate to +RESET_CONTROLLER. + +Honor the kconfig menu hierarchy to remove kconfig dependency warnings. + +Fixes: a528629dfd3b ("ARC: [plat-hsdk] select CONFIG_RESET_HSDK from Kconfig") +Signed-off-by: Necip Fazil Yildiran +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/plat-hsdk/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig +index ce81018345184..6b5c54576f54d 100644 +--- a/arch/arc/plat-hsdk/Kconfig ++++ b/arch/arc/plat-hsdk/Kconfig +@@ -8,5 +8,6 @@ menuconfig ARC_SOC_HSDK + select ARC_HAS_ACCL_REGS + select ARC_IRQ_NO_AUTOSAVE + select CLK_HSDK ++ select RESET_CONTROLLER + select RESET_HSDK + select HAVE_PCI +-- +2.25.1 + diff --git a/queue-5.8/arm-9007-1-l2c-fix-prefetch-bits-init-in-l2x0_aux_ct.patch b/queue-5.8/arm-9007-1-l2c-fix-prefetch-bits-init-in-l2x0_aux_ct.patch new file mode 100644 index 00000000000..d85854d456b --- /dev/null +++ b/queue-5.8/arm-9007-1-l2c-fix-prefetch-bits-init-in-l2x0_aux_ct.patch @@ -0,0 +1,68 @@ +From 599809ef2739183c372f874fd6e3539628019b62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 16:58:06 +0100 +Subject: ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT + values + +From: Guillaume Tucker + +[ Upstream commit 8e007b367a59bcdf484c81f6df9bd5a4cc179ca6 ] + +The L310_PREFETCH_CTRL register bits 28 and 29 to enable data and +instruction prefetch respectively can also be accessed via the +L2X0_AUX_CTRL register. They appear to be actually wired together in +hardware between the registers. Changing them in the prefetch +register only will get undone when restoring the aux control register +later on. For this reason, set these bits in both registers during +initialisation according to the devicetree property values. + +Link: https://lore.kernel.org/lkml/76f2f3ad5e77e356e0a5b99ceee1e774a2842c25.1597061474.git.guillaume.tucker@collabora.com/ + +Fixes: ec3bd0e68a67 ("ARM: 8391/1: l2c: add options to overwrite prefetching behavior") +Signed-off-by: Guillaume Tucker +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/mm/cache-l2x0.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c +index 12c26eb88afbc..43d91bfd23600 100644 +--- a/arch/arm/mm/cache-l2x0.c ++++ b/arch/arm/mm/cache-l2x0.c +@@ -1249,20 +1249,28 @@ static void __init l2c310_of_parse(const struct device_node *np, + + ret = of_property_read_u32(np, "prefetch-data", &val); + if (ret == 0) { +- if (val) ++ if (val) { + prefetch |= L310_PREFETCH_CTRL_DATA_PREFETCH; +- else ++ *aux_val |= L310_PREFETCH_CTRL_DATA_PREFETCH; ++ } else { + prefetch &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; ++ *aux_val &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; ++ } ++ *aux_mask &= ~L310_PREFETCH_CTRL_DATA_PREFETCH; + } else if (ret != -EINVAL) { + pr_err("L2C-310 OF prefetch-data property value is missing\n"); + } + + ret = of_property_read_u32(np, "prefetch-instr", &val); + if (ret == 0) { +- if (val) ++ if (val) { + prefetch |= L310_PREFETCH_CTRL_INSTR_PREFETCH; +- else ++ *aux_val |= L310_PREFETCH_CTRL_INSTR_PREFETCH; ++ } else { + prefetch &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; ++ *aux_val &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; ++ } ++ *aux_mask &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH; + } else if (ret != -EINVAL) { + pr_err("L2C-310 OF prefetch-instr property value is missing\n"); + } +-- +2.25.1 + diff --git a/queue-5.8/arm-at91-pm-of_node_put-after-its-usage.patch b/queue-5.8/arm-at91-pm-of_node_put-after-its-usage.patch new file mode 100644 index 00000000000..28b728a8cc2 --- /dev/null +++ b/queue-5.8/arm-at91-pm-of_node_put-after-its-usage.patch @@ -0,0 +1,35 @@ +From 601ea875c64c097f516ae07019118c78ce00186e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Aug 2020 11:36:50 +0300 +Subject: ARM: at91: pm: of_node_put() after its usage + +From: Claudiu Beznea + +[ Upstream commit e222f943519564978e082c152b4140a47e93392c ] + +Put node after it has been used. + +Fixes: 13f16017d3e3f ("ARM: at91: pm: Tie the USB clock mask to the pmc") +Signed-off-by: Claudiu Beznea +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/1596616610-15460-4-git-send-email-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/mach-at91/pm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c +index 2aab043441e8f..eae8aaaadc3bf 100644 +--- a/arch/arm/mach-at91/pm.c ++++ b/arch/arm/mach-at91/pm.c +@@ -800,6 +800,7 @@ static void __init at91_pm_init(void (*pm_idle)(void)) + + pmc_np = of_find_matching_node_and_match(NULL, atmel_pmc_ids, &of_id); + soc_pm.data.pmc = of_iomap(pmc_np, 0); ++ of_node_put(pmc_np); + if (!soc_pm.data.pmc) { + pr_err("AT91: PM not supported, PMC not found\n"); + return; +-- +2.25.1 + diff --git a/queue-5.8/arm-dts-imx6sl-fix-rng-node.patch b/queue-5.8/arm-dts-imx6sl-fix-rng-node.patch new file mode 100644 index 00000000000..a42f39ff47f --- /dev/null +++ b/queue-5.8/arm-dts-imx6sl-fix-rng-node.patch @@ -0,0 +1,45 @@ +From e00630ce8095b80797ef88b582c213f2f238ea84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Jul 2020 18:26:01 +0300 +Subject: ARM: dts: imx6sl: fix rng node +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Horia Geantă + +[ Upstream commit 82ffb35c2ce63ef8e0325f75eb48022abcf8edbe ] + +rng DT node was added without a compatible string. + +i.MX driver for RNGC (drivers/char/hw_random/imx-rngc.c) also claims +support for RNGB, and is currently used for i.MX25. + +Let's use this driver also for RNGB block in i.MX6SL. + +Fixes: e29fe21cff96 ("ARM: dts: add device tree source for imx6sl SoC") +Signed-off-by: Horia Geantă +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6sl.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi +index 911d8cf77f2c6..0339a46fa71c5 100644 +--- a/arch/arm/boot/dts/imx6sl.dtsi ++++ b/arch/arm/boot/dts/imx6sl.dtsi +@@ -939,8 +939,10 @@ memory-controller@21b0000 { + }; + + rngb: rngb@21b4000 { ++ compatible = "fsl,imx6sl-rngb", "fsl,imx25-rngb"; + reg = <0x021b4000 0x4000>; + interrupts = <0 5 IRQ_TYPE_LEVEL_HIGH>; ++ clocks = <&clks IMX6SL_CLK_DUMMY>; + }; + + weim: weim@21b8000 { +-- +2.25.1 + diff --git a/queue-5.8/arm-dts-iwg20d-q7-common-fix-touch-controller-probe-.patch b/queue-5.8/arm-dts-iwg20d-q7-common-fix-touch-controller-probe-.patch new file mode 100644 index 00000000000..df618eb1251 --- /dev/null +++ b/queue-5.8/arm-dts-iwg20d-q7-common-fix-touch-controller-probe-.patch @@ -0,0 +1,75 @@ +From 707c59b5e9b278a29ba140fe28954f9150d554c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 09:05:35 +0100 +Subject: ARM: dts: iwg20d-q7-common: Fix touch controller probe failure + +From: Biju Das + +[ Upstream commit 08d7a73fffb6769b1cf2278bf697e692daba3abf ] + +As per the iWave RZ/G1M schematic, the signal LVDS_PPEN controls the +supply voltage for the touch panel, LVDS receiver and RGB LCD panel. Add +a regulator for these device nodes and remove the powerdown-gpios +property from the lvds-receiver node as it results in a touch controller +driver probe failure. + +Fixes: 6f89dd9e9325 ("ARM: dts: iwg20d-q7-common: Add LCD support") +Signed-off-by: Biju Das +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/20200924080535.3641-1-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/iwg20d-q7-common.dtsi | 15 ++++++++++++++- + 1 file changed, 14 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/iwg20d-q7-common.dtsi b/arch/arm/boot/dts/iwg20d-q7-common.dtsi +index ebbe1518ef8a6..63cafd220dba1 100644 +--- a/arch/arm/boot/dts/iwg20d-q7-common.dtsi ++++ b/arch/arm/boot/dts/iwg20d-q7-common.dtsi +@@ -57,7 +57,7 @@ lcd_backlight: backlight { + + lvds-receiver { + compatible = "ti,ds90cf384a", "lvds-decoder"; +- powerdown-gpios = <&gpio7 25 GPIO_ACTIVE_LOW>; ++ power-supply = <&vcc_3v3_tft1>; + + ports { + #address-cells = <1>; +@@ -81,6 +81,7 @@ lvds_receiver_out: endpoint { + panel { + compatible = "edt,etm0700g0dh6"; + backlight = <&lcd_backlight>; ++ power-supply = <&vcc_3v3_tft1>; + + port { + panel_in: endpoint { +@@ -113,6 +114,17 @@ sndcodec: simple-audio-card,codec { + }; + }; + ++ vcc_3v3_tft1: regulator-panel { ++ compatible = "regulator-fixed"; ++ ++ regulator-name = "vcc-3v3-tft1"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ enable-active-high; ++ startup-delay-us = <500>; ++ gpio = <&gpio7 25 GPIO_ACTIVE_HIGH>; ++ }; ++ + vcc_sdhi1: regulator-vcc-sdhi1 { + compatible = "regulator-fixed"; + +@@ -207,6 +219,7 @@ touch: touchpanel@38 { + reg = <0x38>; + interrupt-parent = <&gpio2>; + interrupts = <12 IRQ_TYPE_EDGE_FALLING>; ++ vcc-supply = <&vcc_3v3_tft1>; + }; + }; + +-- +2.25.1 + diff --git a/queue-5.8/arm-dts-meson8-remove-two-invalid-interrupt-lines-fr.patch b/queue-5.8/arm-dts-meson8-remove-two-invalid-interrupt-lines-fr.patch new file mode 100644 index 00000000000..4c4afa3fa34 --- /dev/null +++ b/queue-5.8/arm-dts-meson8-remove-two-invalid-interrupt-lines-fr.patch @@ -0,0 +1,71 @@ +From 07df301a08a27b22d10b679bbdec1d93f3361616 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Aug 2020 20:19:57 +0200 +Subject: ARM: dts: meson8: remove two invalid interrupt lines from the GPU + node + +From: Martin Blumenstingl + +[ Upstream commit 737e7610b545cc901a9696083c1824a7104b8d1b ] + +The 3.10 vendor kernel defines the following GPU 20 interrupt lines: + #define INT_MALI_GP AM_IRQ(160) + #define INT_MALI_GP_MMU AM_IRQ(161) + #define INT_MALI_PP AM_IRQ(162) + #define INT_MALI_PMU AM_IRQ(163) + #define INT_MALI_PP0 AM_IRQ(164) + #define INT_MALI_PP0_MMU AM_IRQ(165) + #define INT_MALI_PP1 AM_IRQ(166) + #define INT_MALI_PP1_MMU AM_IRQ(167) + #define INT_MALI_PP2 AM_IRQ(168) + #define INT_MALI_PP2_MMU AM_IRQ(169) + #define INT_MALI_PP3 AM_IRQ(170) + #define INT_MALI_PP3_MMU AM_IRQ(171) + #define INT_MALI_PP4 AM_IRQ(172) + #define INT_MALI_PP4_MMU AM_IRQ(173) + #define INT_MALI_PP5 AM_IRQ(174) + #define INT_MALI_PP5_MMU AM_IRQ(175) + #define INT_MALI_PP6 AM_IRQ(176) + #define INT_MALI_PP6_MMU AM_IRQ(177) + #define INT_MALI_PP7 AM_IRQ(178) + #define INT_MALI_PP7_MMU AM_IRQ(179) + +However, the driver from the 3.10 vendor kernel does not use the +following four interrupt lines: +- INT_MALI_PP3 +- INT_MALI_PP3_MMU +- INT_MALI_PP7 +- INT_MALI_PP7_MMU + +Drop the "pp3" and "ppmmu3" interrupt lines. This is also important +because there is no matching entry in interrupt-names for it (meaning +the "pp2" interrupt is actually assigned to the "pp3" interrupt line). + +Fixes: 7d3f6b536e72c9 ("ARM: dts: meson8: add the Mali-450 MP6 GPU") +Reported-by: Thomas Graichen +Signed-off-by: Martin Blumenstingl +Signed-off-by: Kevin Hilman +Tested-by: thomas graichen +Reviewed-by: Neil Armstrong +Link: https://lore.kernel.org/r/20200815181957.408649-1-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/meson8.dtsi b/arch/arm/boot/dts/meson8.dtsi +index eedb92526968a..a4ab8b96d0eb6 100644 +--- a/arch/arm/boot/dts/meson8.dtsi ++++ b/arch/arm/boot/dts/meson8.dtsi +@@ -239,8 +239,6 @@ mali: gpu@c0000 { + , + , + , +- , +- , + , + , + , +-- +2.25.1 + diff --git a/queue-5.8/arm-dts-owl-s500-fix-incorrect-ppi-interrupt-specifi.patch b/queue-5.8/arm-dts-owl-s500-fix-incorrect-ppi-interrupt-specifi.patch new file mode 100644 index 00000000000..6888fde8c19 --- /dev/null +++ b/queue-5.8/arm-dts-owl-s500-fix-incorrect-ppi-interrupt-specifi.patch @@ -0,0 +1,53 @@ +From 03b6ac5d8dd193dd70de0ccd8a6a9d1c2f065f79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 16:53:17 +0300 +Subject: ARM: dts: owl-s500: Fix incorrect PPI interrupt specifiers + +From: Cristian Ciocaltea + +[ Upstream commit 55f6c9931f7c32f19cf221211f099dfd8dab3af9 ] + +The PPI interrupts for cortex-a9 were incorrectly specified, fix them. + +Fixes: fdfe7f4f9d85 ("ARM: dts: Add Actions Semi S500 and LeMaker Guitar") +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Peter Korsgaard +Reviewed-by: Manivannan Sadhasivam +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/owl-s500.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/owl-s500.dtsi b/arch/arm/boot/dts/owl-s500.dtsi +index 5ceb6cc4451d2..1dbe4e8b38ac7 100644 +--- a/arch/arm/boot/dts/owl-s500.dtsi ++++ b/arch/arm/boot/dts/owl-s500.dtsi +@@ -84,21 +84,21 @@ scu: scu@b0020000 { + global_timer: timer@b0020200 { + compatible = "arm,cortex-a9-global-timer"; + reg = <0xb0020200 0x100>; +- interrupts = ; ++ interrupts = ; + status = "disabled"; + }; + + twd_timer: timer@b0020600 { + compatible = "arm,cortex-a9-twd-timer"; + reg = <0xb0020600 0x20>; +- interrupts = ; ++ interrupts = ; + status = "disabled"; + }; + + twd_wdt: wdt@b0020620 { + compatible = "arm,cortex-a9-twd-wdt"; + reg = <0xb0020620 0xe0>; +- interrupts = ; ++ interrupts = ; + status = "disabled"; + }; + +-- +2.25.1 + diff --git a/queue-5.8/arm-dts-stm32-fix-dh-pdk2-display-pwm-channel.patch b/queue-5.8/arm-dts-stm32-fix-dh-pdk2-display-pwm-channel.patch new file mode 100644 index 00000000000..5e33946d1b7 --- /dev/null +++ b/queue-5.8/arm-dts-stm32-fix-dh-pdk2-display-pwm-channel.patch @@ -0,0 +1,41 @@ +From 2cb5a25ec4c60a7b2ae4287c63d9f8b85ca0eb70 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Aug 2020 22:32:55 +0200 +Subject: ARM: dts: stm32: Fix DH PDK2 display PWM channel + +From: Marek Vasut + +[ Upstream commit 57592d2a98dbc3bde3ddc062e91a8486bdcb211e ] + +The display PWM channel is number 3 (PWM2 CH4), make it so. + +Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Maxime Coquelin +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +index 9cf6d90fbf69f..e4e3c92eb30d3 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +@@ -25,7 +25,7 @@ clk_ext_audio_codec: clock-codec { + + display_bl: display-bl { + compatible = "pwm-backlight"; +- pwms = <&pwm2 0 500000 PWM_POLARITY_INVERTED>; ++ pwms = <&pwm2 3 500000 PWM_POLARITY_INVERTED>; + brightness-levels = <0 16 22 30 40 55 75 102 138 188 255>; + default-brightness-level = <8>; + enable-gpios = <&gpioi 0 GPIO_ACTIVE_HIGH>; +-- +2.25.1 + diff --git a/queue-5.8/arm-dts-stm32-fix-sdmmc2-pins-on-av96.patch b/queue-5.8/arm-dts-stm32-fix-sdmmc2-pins-on-av96.patch new file mode 100644 index 00000000000..ebbf575015c --- /dev/null +++ b/queue-5.8/arm-dts-stm32-fix-sdmmc2-pins-on-av96.patch @@ -0,0 +1,49 @@ +From 693e6da7c26c650c6d3d0312528cf566ae4bf79d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 01:27:57 +0200 +Subject: ARM: dts: stm32: Fix sdmmc2 pins on AV96 + +From: Marek Vasut + +[ Upstream commit 1ad6e36ec266cedb0d274aa13253ff1fb2eed4ba ] + +The AV96 uses sdmmc2_d47_pins_c and sdmmc2_d47_sleep_pins_c, which +differ from sdmmc2_d47_pins_b and sdmmc2_d47_sleep_pins_b in one +pin, SDMMC2_D5, which is PA15 in the former and PA9 in the later. +The PA15 is correct on AV96, so fix this. This error is likely a +result of rebasing across the stm32mp1 DT pinctrl rework. + +Fixes: 611325f68102 ("ARM: dts: stm32: Add eMMC attached to SDMMC2 on AV96") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Maxime Coquelin +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +index 930202742a3f6..905cd7bb98cf0 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcor-avenger96.dtsi +@@ -295,9 +295,9 @@ &sdmmc1 { + + &sdmmc2 { + pinctrl-names = "default", "opendrain", "sleep"; +- pinctrl-0 = <&sdmmc2_b4_pins_a &sdmmc2_d47_pins_b>; +- pinctrl-1 = <&sdmmc2_b4_od_pins_a &sdmmc2_d47_pins_b>; +- pinctrl-2 = <&sdmmc2_b4_sleep_pins_a &sdmmc2_d47_sleep_pins_b>; ++ pinctrl-0 = <&sdmmc2_b4_pins_a &sdmmc2_d47_pins_c>; ++ pinctrl-1 = <&sdmmc2_b4_od_pins_a &sdmmc2_d47_pins_c>; ++ pinctrl-2 = <&sdmmc2_b4_sleep_pins_a &sdmmc2_d47_sleep_pins_c>; + bus-width = <8>; + mmc-ddr-1_8v; + no-sd; +-- +2.25.1 + diff --git a/queue-5.8/arm-dts-stm32-lxa-mc1-fix-kernel-warning-about-phy-d.patch b/queue-5.8/arm-dts-stm32-lxa-mc1-fix-kernel-warning-about-phy-d.patch new file mode 100644 index 00000000000..80bf2e6ee6e --- /dev/null +++ b/queue-5.8/arm-dts-stm32-lxa-mc1-fix-kernel-warning-about-phy-d.patch @@ -0,0 +1,49 @@ +From c1f17b44a2eb9ec1fd3a7f0ae654bb91284901bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Aug 2020 17:03:56 +0200 +Subject: ARM: dts: stm32: lxa-mc1: Fix kernel warning about PHY delays + +From: Holger Assmann + +[ Upstream commit 42a31ac6698681363363d48335559d212a26a7ca ] + +The KSZ9031 PHY skew timings for rxc/txc, originally set to achieve +the desired phase shift between clock- and data-signal, now trigger a +kernel warning when used in rgmii-id mode: + + *-skew-ps values should be used only with phy-mode = "rgmii" + +This is because commit bcf3440c6dd7 ("net: phy: micrel: add phy-mode +support for the KSZ9031 PHY") now configures own timings when +phy-mode = "rgmii-id". Device trees wanting to set their own delays +should use phy-mode "rgmii" instead as the warning prescribes. + +The "standard" timings now used with "rgmii-id" work fine on this +board, so drop the explicit timings in the device tree and thereby +silence the warning. + +Fixes: 666b5ca85cd3 ("ARM: dts: stm32: add STM32MP1-based Linux Automation MC-1 board") +Signed-off-by: Holger Assmann +Acked-by: Ahmad Fatoum +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts b/arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts +index 5700e6b700d36..b85025d009437 100644 +--- a/arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts ++++ b/arch/arm/boot/dts/stm32mp157c-lxa-mc1.dts +@@ -121,8 +121,6 @@ ethphy: ethernet-phy@3 { /* KSZ9031RN */ + reset-gpios = <&gpiog 0 GPIO_ACTIVE_LOW>; /* ETH_RST# */ + interrupt-parent = <&gpioa>; + interrupts = <6 IRQ_TYPE_EDGE_FALLING>; /* ETH_MDINT# */ +- rxc-skew-ps = <1860>; +- txc-skew-ps = <1860>; + reset-assert-us = <10000>; + reset-deassert-us = <300>; + micrel,force-master; +-- +2.25.1 + diff --git a/queue-5.8/arm-dts-stm32-move-ethernet-phy-into-dh-som-dt.patch b/queue-5.8/arm-dts-stm32-move-ethernet-phy-into-dh-som-dt.patch new file mode 100644 index 00000000000..34f8f10f3fe --- /dev/null +++ b/queue-5.8/arm-dts-stm32-move-ethernet-phy-into-dh-som-dt.patch @@ -0,0 +1,148 @@ +From 1df476f80366402079203a548c7ac440b08c9dca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jul 2020 18:51:40 +0200 +Subject: ARM: dts: stm32: Move ethernet PHY into DH SoM DT + +From: Marek Vasut + +[ Upstream commit b0a07f609600b6fa4c30f783db50c38456804485 ] + +The PHY and the VIO regulator is populated on the SoM, move it +into the SoM DT. + +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Maxime Coquelin +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi | 33 ----------------- + arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 36 +++++++++++++++++++ + 2 files changed, 36 insertions(+), 33 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +index 7c4bd615b3115..9cf6d90fbf69f 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-pdk2.dtsi +@@ -11,7 +11,6 @@ aliases { + serial0 = &uart4; + serial1 = &usart3; + serial2 = &uart8; +- ethernet0 = ðernet0; + }; + + chosen { +@@ -33,16 +32,6 @@ display_bl: display-bl { + status = "okay"; + }; + +- ethernet_vio: vioregulator { +- compatible = "regulator-fixed"; +- regulator-name = "vio"; +- regulator-min-microvolt = <3300000>; +- regulator-max-microvolt = <3300000>; +- gpio = <&gpiog 3 GPIO_ACTIVE_LOW>; +- regulator-always-on; +- regulator-boot-on; +- }; +- + gpio-keys-polled { + compatible = "gpio-keys-polled"; + #size-cells = <0>; +@@ -141,28 +130,6 @@ &cec { + status = "okay"; + }; + +-ðernet0 { +- status = "okay"; +- pinctrl-0 = <ðernet0_rmii_pins_a>; +- pinctrl-1 = <ðernet0_rmii_sleep_pins_a>; +- pinctrl-names = "default", "sleep"; +- phy-mode = "rmii"; +- max-speed = <100>; +- phy-handle = <&phy0>; +- st,eth-ref-clk-sel; +- phy-reset-gpios = <&gpioh 15 GPIO_ACTIVE_LOW>; +- +- mdio0 { +- #address-cells = <1>; +- #size-cells = <0>; +- compatible = "snps,dwmac-mdio"; +- +- phy0: ethernet-phy@1 { +- reg = <1>; +- }; +- }; +-}; +- + &i2c2 { /* Header X22 */ + pinctrl-names = "default"; + pinctrl-0 = <&i2c2_pins_a>; +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +index ba905196fb549..d30a3c60da9b0 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +@@ -9,6 +9,10 @@ + #include + + / { ++ aliases { ++ ethernet0 = ðernet0; ++ }; ++ + memory@c0000000 { + device_type = "memory"; + reg = <0xC0000000 0x40000000>; +@@ -55,6 +59,16 @@ retram: retram@38000000 { + no-map; + }; + }; ++ ++ ethernet_vio: vioregulator { ++ compatible = "regulator-fixed"; ++ regulator-name = "vio"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ gpio = <&gpiog 3 GPIO_ACTIVE_LOW>; ++ regulator-always-on; ++ regulator-boot-on; ++ }; + }; + + &adc { +@@ -94,6 +108,28 @@ &dts { + status = "okay"; + }; + ++ðernet0 { ++ status = "okay"; ++ pinctrl-0 = <ðernet0_rmii_pins_a>; ++ pinctrl-1 = <ðernet0_rmii_sleep_pins_a>; ++ pinctrl-names = "default", "sleep"; ++ phy-mode = "rmii"; ++ max-speed = <100>; ++ phy-handle = <&phy0>; ++ st,eth-ref-clk-sel; ++ phy-reset-gpios = <&gpioh 15 GPIO_ACTIVE_LOW>; ++ ++ mdio0 { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ compatible = "snps,dwmac-mdio"; ++ ++ phy0: ethernet-phy@1 { ++ reg = <1>; ++ }; ++ }; ++}; ++ + &i2c4 { + pinctrl-names = "default"; + pinctrl-0 = <&i2c4_pins_a>; +-- +2.25.1 + diff --git a/queue-5.8/arm-dts-stm32-swap-phy-reset-gpio-and-tsc2004-irq-on.patch b/queue-5.8/arm-dts-stm32-swap-phy-reset-gpio-and-tsc2004-irq-on.patch new file mode 100644 index 00000000000..9fa7591f820 --- /dev/null +++ b/queue-5.8/arm-dts-stm32-swap-phy-reset-gpio-and-tsc2004-irq-on.patch @@ -0,0 +1,52 @@ +From e25fb61f5a199044df36a5d51612cbdbaff60f37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 14:14:12 +0200 +Subject: ARM: dts: stm32: Swap PHY reset GPIO and TSC2004 IRQ on DHCOM SOM + +From: Marek Vasut + +[ Upstream commit 9ad98319e95263469d8ca2cb543c37c5a2f40980 ] + +On the production revision of the SoM, 587-200, the PHY reset GPIO and +touchscreen IRQs are swapped to prevent collision between EXTi IRQs, +reflect that in DT. + +Fixes: 34e0c7847dcf ("ARM: dts: stm32: Add DH Electronics DHCOM STM32MP1 SoM and PDK2 board") +Signed-off-by: Marek Vasut +Cc: Alexandre Torgue +Cc: Maxime Coquelin +Cc: Patrice Chotard +Cc: Patrick Delaunay +Cc: linux-stm32@st-md-mailman.stormreply.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Alexandre Torgue +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +index d30a3c60da9b0..a87ebc4843963 100644 +--- a/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/stm32mp15xx-dhcom-som.dtsi +@@ -117,7 +117,7 @@ ðernet0 { + max-speed = <100>; + phy-handle = <&phy0>; + st,eth-ref-clk-sel; +- phy-reset-gpios = <&gpioh 15 GPIO_ACTIVE_LOW>; ++ phy-reset-gpios = <&gpioh 3 GPIO_ACTIVE_LOW>; + + mdio0 { + #address-cells = <1>; +@@ -285,7 +285,7 @@ touchscreen@49 { + compatible = "ti,tsc2004"; + reg = <0x49>; + vio-supply = <&v3v3>; +- interrupts-extended = <&gpioh 3 IRQ_TYPE_EDGE_FALLING>; ++ interrupts-extended = <&gpioh 15 IRQ_TYPE_EDGE_FALLING>; + }; + + eeprom@50 { +-- +2.25.1 + diff --git a/queue-5.8/arm-dts-sun8i-r40-bananapi-m2-ultra-fix-dcdc1-regula.patch b/queue-5.8/arm-dts-sun8i-r40-bananapi-m2-ultra-fix-dcdc1-regula.patch new file mode 100644 index 00000000000..678c88e36d7 --- /dev/null +++ b/queue-5.8/arm-dts-sun8i-r40-bananapi-m2-ultra-fix-dcdc1-regula.patch @@ -0,0 +1,54 @@ +From 8e0ed44c739bb42f9cc41acfa365adb4af12561b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 21:36:49 +0200 +Subject: ARM: dts: sun8i: r40: bananapi-m2-ultra: Fix dcdc1 regulator + +From: Jernej Skrabec + +[ Upstream commit 3658a2b7f3e16c7053eb8d70657b94bb62c5a0f4 ] + +DCDC1 regulator powers many different subsystems. While some of them can +work at 3.0 V, some of them can not. For example, VCC-HDMI can only work +between 3.24 V and 3.36 V. According to OS images provided by the board +manufacturer this regulator should be set to 3.3 V. + +Set DCDC1 and DCDC1SW to 3.3 V in order to fix this. + +Fixes: da7ac948fa93 ("ARM: dts: sun8i: Add board dts file for Banana Pi M2 Ultra") +Signed-off-by: Jernej Skrabec +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20200824193649.978197-1-jernej.skrabec@siol.net +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +index 42d62d1ba1dc7..ea15073f0c79c 100644 +--- a/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts ++++ b/arch/arm/boot/dts/sun8i-r40-bananapi-m2-ultra.dts +@@ -223,16 +223,16 @@ ®_aldo3 { + }; + + ®_dc1sw { +- regulator-min-microvolt = <3000000>; +- regulator-max-microvolt = <3000000>; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; + regulator-name = "vcc-gmac-phy"; + }; + + ®_dcdc1 { + regulator-always-on; +- regulator-min-microvolt = <3000000>; +- regulator-max-microvolt = <3000000>; +- regulator-name = "vcc-3v0"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-name = "vcc-3v3"; + }; + + ®_dcdc2 { +-- +2.25.1 + diff --git a/queue-5.8/arm-omap2-restore-mpu-power-domain-if-cpu_cluster_pm.patch b/queue-5.8/arm-omap2-restore-mpu-power-domain-if-cpu_cluster_pm.patch new file mode 100644 index 00000000000..44b2c80367a --- /dev/null +++ b/queue-5.8/arm-omap2-restore-mpu-power-domain-if-cpu_cluster_pm.patch @@ -0,0 +1,42 @@ +From 710beb3d29b089497daf8d8cdb78e9cfb3208797 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Sep 2020 09:16:22 +0300 +Subject: ARM: OMAP2+: Restore MPU power domain if cpu_cluster_pm_enter() fails + +From: Tony Lindgren + +[ Upstream commit 8f04aea048d56f3e39a7e543939450246542a6fc ] + +If cpu_cluster_pm_enter() fails, we need to set MPU power domain back +to enabled to prevent the next WFI from potentially triggering an +undesired MPU power domain state change. + +We already do this for omap_enter_idle_smp() but are missing it for +omap_enter_idle_coupled(). + +Fixes: 55be2f50336f ("ARM: OMAP2+: Handle errors for cpu_pm") +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/cpuidle44xx.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/mach-omap2/cpuidle44xx.c b/arch/arm/mach-omap2/cpuidle44xx.c +index 6f5f89711f256..a92d277f81a08 100644 +--- a/arch/arm/mach-omap2/cpuidle44xx.c ++++ b/arch/arm/mach-omap2/cpuidle44xx.c +@@ -174,8 +174,10 @@ static int omap_enter_idle_coupled(struct cpuidle_device *dev, + */ + if (mpuss_can_lose_context) { + error = cpu_cluster_pm_enter(); +- if (error) ++ if (error) { ++ omap_set_pwrdm_state(mpu_pd, PWRDM_POWER_ON); + goto cpu_cluster_pm_out; ++ } + } + } + +-- +2.25.1 + diff --git a/queue-5.8/arm-s3c24xx-fix-mmc-gpio-lookup-tables.patch b/queue-5.8/arm-s3c24xx-fix-mmc-gpio-lookup-tables.patch new file mode 100644 index 00000000000..b9bfc31702e --- /dev/null +++ b/queue-5.8/arm-s3c24xx-fix-mmc-gpio-lookup-tables.patch @@ -0,0 +1,107 @@ +From 0ede6f20576487678715338b777f35029e4a2763 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 20:20:20 +0200 +Subject: ARM: s3c24xx: fix mmc gpio lookup tables + +From: Arnd Bergmann + +[ Upstream commit 3af4e8774b6d03683932b0961998e01355bccd74 ] + +The gpio controller names differ between s3c24xx and s3c64xx, +and it seems that these all got the wrong names, using GPx instead +of GPIOx. + +Fixes: d2951dfa070d ("mmc: s3cmci: Use the slot GPIO descriptor") +Signed-off-by: Arnd Bergmann +Reviewed-by: Linus Walleij +Link: https://lore.kernel.org/r/20200806182059.2431-3-krzk@kernel.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm/mach-s3c24xx/mach-at2440evb.c | 2 +- + arch/arm/mach-s3c24xx/mach-h1940.c | 4 ++-- + arch/arm/mach-s3c24xx/mach-mini2440.c | 4 ++-- + arch/arm/mach-s3c24xx/mach-n30.c | 4 ++-- + arch/arm/mach-s3c24xx/mach-rx1950.c | 4 ++-- + 5 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm/mach-s3c24xx/mach-at2440evb.c b/arch/arm/mach-s3c24xx/mach-at2440evb.c +index 58c5ef3cf1d7e..2d370f7f75fa2 100644 +--- a/arch/arm/mach-s3c24xx/mach-at2440evb.c ++++ b/arch/arm/mach-s3c24xx/mach-at2440evb.c +@@ -143,7 +143,7 @@ static struct gpiod_lookup_table at2440evb_mci_gpio_table = { + .dev_id = "s3c2410-sdi", + .table = { + /* Card detect S3C2410_GPG(10) */ +- GPIO_LOOKUP("GPG", 10, "cd", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("GPIOG", 10, "cd", GPIO_ACTIVE_LOW), + { }, + }, + }; +diff --git a/arch/arm/mach-s3c24xx/mach-h1940.c b/arch/arm/mach-s3c24xx/mach-h1940.c +index e1c372e5447b6..82cc37513779c 100644 +--- a/arch/arm/mach-s3c24xx/mach-h1940.c ++++ b/arch/arm/mach-s3c24xx/mach-h1940.c +@@ -468,9 +468,9 @@ static struct gpiod_lookup_table h1940_mmc_gpio_table = { + .dev_id = "s3c2410-sdi", + .table = { + /* Card detect S3C2410_GPF(5) */ +- GPIO_LOOKUP("GPF", 5, "cd", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("GPIOF", 5, "cd", GPIO_ACTIVE_LOW), + /* Write protect S3C2410_GPH(8) */ +- GPIO_LOOKUP("GPH", 8, "wp", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("GPIOH", 8, "wp", GPIO_ACTIVE_LOW), + { }, + }, + }; +diff --git a/arch/arm/mach-s3c24xx/mach-mini2440.c b/arch/arm/mach-s3c24xx/mach-mini2440.c +index 9035f868fb34e..3a5b1124037b2 100644 +--- a/arch/arm/mach-s3c24xx/mach-mini2440.c ++++ b/arch/arm/mach-s3c24xx/mach-mini2440.c +@@ -244,9 +244,9 @@ static struct gpiod_lookup_table mini2440_mmc_gpio_table = { + .dev_id = "s3c2410-sdi", + .table = { + /* Card detect S3C2410_GPG(8) */ +- GPIO_LOOKUP("GPG", 8, "cd", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("GPIOG", 8, "cd", GPIO_ACTIVE_LOW), + /* Write protect S3C2410_GPH(8) */ +- GPIO_LOOKUP("GPH", 8, "wp", GPIO_ACTIVE_HIGH), ++ GPIO_LOOKUP("GPIOH", 8, "wp", GPIO_ACTIVE_HIGH), + { }, + }, + }; +diff --git a/arch/arm/mach-s3c24xx/mach-n30.c b/arch/arm/mach-s3c24xx/mach-n30.c +index d856f23939aff..ffa20f52aa832 100644 +--- a/arch/arm/mach-s3c24xx/mach-n30.c ++++ b/arch/arm/mach-s3c24xx/mach-n30.c +@@ -359,9 +359,9 @@ static struct gpiod_lookup_table n30_mci_gpio_table = { + .dev_id = "s3c2410-sdi", + .table = { + /* Card detect S3C2410_GPF(1) */ +- GPIO_LOOKUP("GPF", 1, "cd", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("GPIOF", 1, "cd", GPIO_ACTIVE_LOW), + /* Write protect S3C2410_GPG(10) */ +- GPIO_LOOKUP("GPG", 10, "wp", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("GPIOG", 10, "wp", GPIO_ACTIVE_LOW), + { }, + }, + }; +diff --git a/arch/arm/mach-s3c24xx/mach-rx1950.c b/arch/arm/mach-s3c24xx/mach-rx1950.c +index fde98b175c752..c0a06f123cfea 100644 +--- a/arch/arm/mach-s3c24xx/mach-rx1950.c ++++ b/arch/arm/mach-s3c24xx/mach-rx1950.c +@@ -571,9 +571,9 @@ static struct gpiod_lookup_table rx1950_mmc_gpio_table = { + .dev_id = "s3c2410-sdi", + .table = { + /* Card detect S3C2410_GPF(5) */ +- GPIO_LOOKUP("GPF", 5, "cd", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("GPIOF", 5, "cd", GPIO_ACTIVE_LOW), + /* Write protect S3C2410_GPH(8) */ +- GPIO_LOOKUP("GPH", 8, "wp", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("GPIOH", 8, "wp", GPIO_ACTIVE_LOW), + { }, + }, + }; +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-actions-limit-address-range-for-pinctrl-no.patch b/queue-5.8/arm64-dts-actions-limit-address-range-for-pinctrl-no.patch new file mode 100644 index 00000000000..d9752daaa96 --- /dev/null +++ b/queue-5.8/arm64-dts-actions-limit-address-range-for-pinctrl-no.patch @@ -0,0 +1,54 @@ +From cdbac705d4cab2df4c95d940a11476054b2b6401 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jul 2020 23:12:02 +0530 +Subject: arm64: dts: actions: limit address range for pinctrl node + +From: Amit Singh Tomar + +[ Upstream commit 4bb1eb3cd4bd6241d5e5f99bbfd801ea5a007b6c ] + +After commit 7cdf8446ed1d ("arm64: dts: actions: Add pinctrl node for +Actions Semi S700") following error has been observed while booting +Linux on Cubieboard7-lite(based on S700 SoC). + +[ 0.257415] pinctrl-s700 e01b0000.pinctrl: can't request region for +resource [mem 0xe01b0000-0xe01b0fff] +[ 0.266902] pinctrl-s700: probe of e01b0000.pinctrl failed with error -16 + +This is due to the fact that memory range for "sps" power domain controller +clashes with pinctrl. + +One way to fix it, is to limit pinctrl address range which is safe +to do as current pinctrl driver uses address range only up to 0x100. + +This commit limits the pinctrl address range to 0x100 so that it doesn't +conflict with sps range. + +Fixes: 7cdf8446ed1d ("arm64: dts: actions: Add pinctrl node for Actions +Semi S700") + +Reviewed-by: Manivannan Sadhasivam +Suggested-by: Andre Przywara +Signed-off-by: Amit Singh Tomar +Signed-off-by: Manivannan Sadhasivam +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/actions/s700.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/actions/s700.dtsi b/arch/arm64/boot/dts/actions/s700.dtsi +index 2006ad5424fa6..f8eb72bb41254 100644 +--- a/arch/arm64/boot/dts/actions/s700.dtsi ++++ b/arch/arm64/boot/dts/actions/s700.dtsi +@@ -231,7 +231,7 @@ timer: timer@e024c000 { + + pinctrl: pinctrl@e01b0000 { + compatible = "actions,s700-pinctrl"; +- reg = <0x0 0xe01b0000 0x0 0x1000>; ++ reg = <0x0 0xe01b0000 0x0 0x100>; + clocks = <&cmu CLK_GPIO>; + gpio-controller; + gpio-ranges = <&pinctrl 0 0 136>; +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-allwinner-h5-remove-mali-gpu-pmu-module.patch b/queue-5.8/arm64-dts-allwinner-h5-remove-mali-gpu-pmu-module.patch new file mode 100644 index 00000000000..bc4becaf201 --- /dev/null +++ b/queue-5.8/arm64-dts-allwinner-h5-remove-mali-gpu-pmu-module.patch @@ -0,0 +1,52 @@ +From 08e8078cf9c1c050bb368e08197804065db31438 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Aug 2020 14:27:55 +0800 +Subject: arm64: dts: allwinner: h5: remove Mali GPU PMU module + +From: Qiang Yu + +[ Upstream commit 2933bf3528007f834fb7f5eab033f9c5b0683f91 ] + +H5's Mali GPU PMU is not present or working corretly although +H5 datasheet record its interrupt vector. + +Adding this module will miss lead lima driver try to shutdown +it and get waiting timeout. This problem is not exposed before +lima runtime PM support is added. + +Fixes: bb39ed07e55b ("arm64: dts: allwinner: h5: Add device node for Mali-450 GPU") +Signed-off-by: Qiang Yu +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20200822062755.534761-1-yuq825@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi +index 4462a68c06815..cdc4209f94d0e 100644 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5.dtsi +@@ -125,8 +125,7 @@ mali: gpu@1e80000 { + , + , + , +- , +- ; ++ ; + interrupt-names = "gp", + "gpmmu", + "pp", +@@ -137,8 +136,7 @@ mali: gpu@1e80000 { + "pp2", + "ppmmu2", + "pp3", +- "ppmmu3", +- "pmu"; ++ "ppmmu3"; + clocks = <&ccu CLK_BUS_GPU>, <&ccu CLK_GPU>; + clock-names = "bus", "core"; + resets = <&ccu RST_BUS_GPU>; +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-imx8mq-add-missing-interrupts-to-gpc.patch b/queue-5.8/arm64-dts-imx8mq-add-missing-interrupts-to-gpc.patch new file mode 100644 index 00000000000..3e5a4dfe63e --- /dev/null +++ b/queue-5.8/arm64-dts-imx8mq-add-missing-interrupts-to-gpc.patch @@ -0,0 +1,41 @@ +From a3e47b740d9932fd4003867da2d99ca09f5f31d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 16:53:09 +0200 +Subject: arm64: dts: imx8mq: Add missing interrupts to GPC + +From: Krzysztof Kozlowski + +[ Upstream commit 791619f66843a213784efb2f171be98933bad991 ] + +The i.MX General Power Controller v2 device node was missing interrupts +property necessary to route its interrupt to GIC. This also fixes the +dbts_check warnings like: + + arch/arm64/boot/dts/freescale/imx8mq-evk.dt.yaml: gpc@303a0000: + {'compatible': ... '$nodename': ['gpc@303a0000']} is not valid under any of the given schemas + arch/arm64/boot/dts/freescale/imx8mq-evk.dt.yaml: gpc@303a0000: 'interrupts' is a required property + +Fixes: fdbcc04da246 ("arm64: dts: imx8mq: add GPC power domains") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Lucas Stach +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/imx8mq.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mq.dtsi b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +index 66ac66856e7e8..077e12a0de3f9 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mq.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mq.dtsi +@@ -614,6 +614,7 @@ src: reset-controller@30390000 { + gpc: gpc@303a0000 { + compatible = "fsl,imx8mq-gpc"; + reg = <0x303a0000 0x10000>; ++ interrupts = ; + interrupt-parent = <&gic>; + interrupt-controller; + #interrupt-cells = <3>; +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-meson-vim3-correct-led-polarity.patch b/queue-5.8/arm64-dts-meson-vim3-correct-led-polarity.patch new file mode 100644 index 00000000000..1cc9167b097 --- /dev/null +++ b/queue-5.8/arm64-dts-meson-vim3-correct-led-polarity.patch @@ -0,0 +1,43 @@ +From fa3a77ee930ad55ff2a44d67db27510a44129f85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Aug 2020 16:18:50 +0200 +Subject: arm64: dts: meson: vim3: correct led polarity + +From: Jerome Brunet + +[ Upstream commit 1f9d87d08e4a2299e86f8a1600aedf87ecd3b636 ] + +The LEDs on the vim3 are active when the gpio is high, not low. + +Fixes: c6d29c66e582 ("arm64: dts: meson-g12b-khadas-vim3: add initial device-tree") +Signed-off-by: Jerome Brunet +Signed-off-by: Kevin Hilman +Link: https://lore.kernel.org/r/20200803141850.172704-1-jbrunet@baylibre.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi b/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi +index ff5ba85b7562e..833bbc3359c44 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-khadas-vim3.dtsi +@@ -41,13 +41,13 @@ leds { + + led-white { + label = "vim3:white:sys"; +- gpios = <&gpio_ao GPIOAO_4 GPIO_ACTIVE_LOW>; ++ gpios = <&gpio_ao GPIOAO_4 GPIO_ACTIVE_HIGH>; + linux,default-trigger = "heartbeat"; + }; + + led-red { + label = "vim3:red"; +- gpios = <&gpio_expander 5 GPIO_ACTIVE_LOW>; ++ gpios = <&gpio_expander 5 GPIO_ACTIVE_HIGH>; + }; + }; + +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-mt8173-elm-fix-nor_flash-node-property.patch b/queue-5.8/arm64-dts-mt8173-elm-fix-nor_flash-node-property.patch new file mode 100644 index 00000000000..e143ebd70b0 --- /dev/null +++ b/queue-5.8/arm64-dts-mt8173-elm-fix-nor_flash-node-property.patch @@ -0,0 +1,45 @@ +From 28c314dcec092881f111fe8e01980a33cc7258ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jul 2020 15:41:24 +0800 +Subject: arm64: dts: mt8173: elm: Fix nor_flash node property + +From: Hsin-Yi Wang + +[ Upstream commit 1276be23fd53e1c4e752966d0eab42aa54a343da ] + +bus-width and non-removable is not used by the driver. +max-frequency should be spi-max-frequency for flash node. + +Fixes: 689b937bedde ("arm64: dts: mediatek: add mt8173 elm and hana board") +Reported-by: Nicolas Boichat +Signed-off-by: Hsin-Yi Wang +Reviewed-by: Enric Balletbo i Serra +Link: https://lore.kernel.org/r/20200727074124.3779237-1-hsinyi@chromium.org +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi +index a5a12b2599a4a..01522dd10603e 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8173-elm.dtsi +@@ -431,12 +431,11 @@ &nor_flash { + status = "okay"; + pinctrl-names = "default"; + pinctrl-0 = <&nor_gpio1_pins>; +- bus-width = <8>; +- max-frequency = <50000000>; +- non-removable; ++ + flash@0 { + compatible = "jedec,spi-nor"; + reg = <0>; ++ spi-max-frequency = <50000000>; + }; + }; + +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-qcom-msm8916-fix-mdp-dsi-interrupts.patch b/queue-5.8/arm64-dts-qcom-msm8916-fix-mdp-dsi-interrupts.patch new file mode 100644 index 00000000000..772531daf15 --- /dev/null +++ b/queue-5.8/arm64-dts-qcom-msm8916-fix-mdp-dsi-interrupts.patch @@ -0,0 +1,54 @@ +From cb980876856f809c107d10414d7e84d2ce249e05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 09:12:11 +0200 +Subject: arm64: dts: qcom: msm8916: Fix MDP/DSI interrupts + +From: Stephan Gerhold + +[ Upstream commit 027cca9eb5b450c3f6bb916ba999144c2ec23cb7 ] + +The mdss node sets #interrupt-cells = <1>, so its interrupts +should be referenced using a single cell (in this case: only the +interrupt number). + +However, right now the mdp/dsi node both have two interrupt cells +set, e.g. interrupts = <4 0>. The 0 is probably meant to say +IRQ_TYPE_NONE (= 0), but with #interrupt-cells = <1> this is +actually interpreted as a second interrupt line. + +Remove the IRQ flags from both interrupts to fix this. + +Fixes: 305410ffd1b2 ("arm64: dts: msm8916: Add display support") +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20200915071221.72895-5-stephan@gerhold.net +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 729d36ff2e247..103d2226c579b 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -1021,7 +1021,7 @@ mdp: mdp@1a01000 { + reg-names = "mdp_phys"; + + interrupt-parent = <&mdss>; +- interrupts = <0 0>; ++ interrupts = <0>; + + clocks = <&gcc GCC_MDSS_AHB_CLK>, + <&gcc GCC_MDSS_AXI_CLK>, +@@ -1053,7 +1053,7 @@ dsi0: dsi@1a98000 { + reg-names = "dsi_ctrl"; + + interrupt-parent = <&mdss>; +- interrupts = <4 0>; ++ interrupts = <4>; + + assigned-clocks = <&gcc BYTE0_CLK_SRC>, + <&gcc PCLK0_CLK_SRC>; +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-qcom-msm8916-remove-one-more-thermal-trip-.patch b/queue-5.8/arm64-dts-qcom-msm8916-remove-one-more-thermal-trip-.patch new file mode 100644 index 00000000000..e6baee4a06d --- /dev/null +++ b/queue-5.8/arm64-dts-qcom-msm8916-remove-one-more-thermal-trip-.patch @@ -0,0 +1,71 @@ +From 754195383fee33a078836b0ffb14cf99e5eaa922 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 09:12:09 +0200 +Subject: arm64: dts: qcom: msm8916: Remove one more thermal trip point unit + name + +From: Stephan Gerhold + +[ Upstream commit e6859ae8603c5946b8f3ecbd9b4f02b72955b9d0 ] + +Commit fe2aff0c574d2 ("arm64: dts: qcom: msm8916: remove unit name for thermal trip points") +removed the unit names for most of the thermal trip points defined +in msm8916.dtsi, but missed to update the one for cpu0_1-thermal. + +So why wasn't this spotted by "make dtbs_check"? Apparently, the name +of the thermal zone is already invalid: thermal-zones.yaml specifies +a regex of ^[a-zA-Z][a-zA-Z0-9\\-]{1,12}-thermal$, so it is not allowed +to contain underscores. Therefore the thermal zone was never verified +using the DTB schema. + +After replacing the underscore in the thermal zone name, the warning +shows up: + + apq8016-sbc.dt.yaml: thermal-zones: cpu0-1-thermal:trips: 'trip-point@0' + does not match any of the regexes: '^[a-zA-Z][a-zA-Z0-9\\-_]{0,63}$', 'pinctrl-[0-9]+' + +Fix up the thermal zone names and remove the unit name for the trip point. + +Cc: Amit Kucheria +Fixes: fe2aff0c574d2 ("arm64: dts: qcom: msm8916: remove unit name for thermal trip points") +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20200915071221.72895-3-stephan@gerhold.net +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 32bd140ac9fd4..729d36ff2e247 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -228,14 +228,14 @@ pmu { + }; + + thermal-zones { +- cpu0_1-thermal { ++ cpu0-1-thermal { + polling-delay-passive = <250>; + polling-delay = <1000>; + + thermal-sensors = <&tsens 5>; + + trips { +- cpu0_1_alert0: trip-point@0 { ++ cpu0_1_alert0: trip-point0 { + temperature = <75000>; + hysteresis = <2000>; + type = "passive"; +@@ -258,7 +258,7 @@ map0 { + }; + }; + +- cpu2_3-thermal { ++ cpu2-3-thermal { + polling-delay-passive = <250>; + polling-delay = <1000>; + +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-qcom-pm8916-remove-invalid-reg-size-from-w.patch b/queue-5.8/arm64-dts-qcom-pm8916-remove-invalid-reg-size-from-w.patch new file mode 100644 index 00000000000..6276641d171 --- /dev/null +++ b/queue-5.8/arm64-dts-qcom-pm8916-remove-invalid-reg-size-from-w.patch @@ -0,0 +1,48 @@ +From c6b34d297de590c4b683c2c7c7bcbb527da26298 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 09:12:10 +0200 +Subject: arm64: dts: qcom: pm8916: Remove invalid reg size from wcd_codec + +From: Stephan Gerhold + +[ Upstream commit c2f0cbb57dbac6da3d38b47b5b96de0fe4e23884 ] + +Tha parent node of "wcd_codec" specifies #address-cells = <1> +and #size-cells = <0>, which means that each resource should be +described by one cell for the address and size omitted. + +However, wcd_codec currently lists 0x200 as second cell (probably +the size of the resource). When parsing this would be treated like +another memory resource - which is entirely wrong. + +To quote the device tree specification [1]: + "If the parent node specifies a value of 0 for #size-cells, + the length field in the value of reg shall be omitted." + +[1]: https://www.devicetree.org/specifications/ + +Fixes: 5582fcb3829f ("arm64: dts: apq8016-sbc: add analog audio support with multicodec") +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20200915071221.72895-4-stephan@gerhold.net +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/pm8916.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/pm8916.dtsi b/arch/arm64/boot/dts/qcom/pm8916.dtsi +index 0bcdf04711079..adf9a5988cdc2 100644 +--- a/arch/arm64/boot/dts/qcom/pm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/pm8916.dtsi +@@ -119,7 +119,7 @@ pm8916_vib: vibrator@c000 { + + wcd_codec: codec@f000 { + compatible = "qcom,pm8916-wcd-analog-codec"; +- reg = <0xf000 0x200>; ++ reg = <0xf000>; + reg-names = "pmic-codec-core"; + clocks = <&gcc GCC_CODEC_DIGCODEC_CLK>; + clock-names = "mclk"; +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-qcom-sc7180-drop-flags-on-mdss-irqs.patch b/queue-5.8/arm64-dts-qcom-sc7180-drop-flags-on-mdss-irqs.patch new file mode 100644 index 00000000000..97b53b8b7a9 --- /dev/null +++ b/queue-5.8/arm64-dts-qcom-sc7180-drop-flags-on-mdss-irqs.patch @@ -0,0 +1,50 @@ +From 829e56b457edc8fd4a1ca8d68243fd97fbdaa3f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 12:25:03 -0700 +Subject: arm64: dts: qcom: sc7180: Drop flags on mdss irqs + +From: Stephen Boyd + +[ Upstream commit 51e9874d382e089f664b3ce12773bbbaece5f369 ] + +The number of interrupt cells for the mdss interrupt controller is 1, +meaning there should only be one cell for the interrupt number, not two +where the second cell is the irq flags. Drop the second cell to match +the binding. + +Cc: Kalyan Thota +Cc: Harigovindan P +Link: https://lore.kernel.org/r/20200811192503.1811462-1-swboyd@chromium.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi +index cfeeddcea7887..7f1b75b2bcee3 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi +@@ -2357,7 +2357,7 @@ mdp: mdp@ae01000 { + <19200000>; + + interrupt-parent = <&mdss>; +- interrupts = <0 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <0>; + + status = "disabled"; + +@@ -2380,7 +2380,7 @@ dsi0: dsi@ae94000 { + reg-names = "dsi_ctrl"; + + interrupt-parent = <&mdss>; +- interrupts = <4 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <4>; + + clocks = <&dispcc DISP_CC_MDSS_BYTE0_CLK>, + <&dispcc DISP_CC_MDSS_BYTE0_INTF_CLK>, +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-qcom-sc7180-fix-the-llcc-base-register-siz.patch b/queue-5.8/arm64-dts-qcom-sc7180-fix-the-llcc-base-register-siz.patch new file mode 100644 index 00000000000..16ba473fe8f --- /dev/null +++ b/queue-5.8/arm64-dts-qcom-sc7180-fix-the-llcc-base-register-siz.patch @@ -0,0 +1,40 @@ +From cee427dd4a66637dd0bb784132445d7eae75fc27 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 20:25:14 +0530 +Subject: arm64: dts: qcom: sc7180: Fix the LLCC base register size + +From: Sai Prakash Ranjan + +[ Upstream commit efe788361f72914017515223414d3f20abe4b403 ] + +There is one LLCC logical bank(LLCC0) on SC7180 SoC and the +size of the LLCC0 base is 0x50000(320KB) not 2MB, so correct +the size and fix copy paste mistake carried over from SDM845. + +Reviewed-by: Douglas Anderson +Fixes: 7cee5c742899 ("arm64: dts: qcom: sc7180: Fix node order") +Fixes: c831fa299996 ("arm64: dts: qcom: sc7180: Add Last level cache controller node") +Signed-off-by: Sai Prakash Ranjan +Link: https://lore.kernel.org/r/20200818145514.16262-1-saiprakash.ranjan@codeaurora.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi +index 31b9217bb5bfe..cfeeddcea7887 100644 +--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi ++++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi +@@ -2193,7 +2193,7 @@ dc_noc: interconnect@9160000 { + + system-cache-controller@9200000 { + compatible = "qcom,sc7180-llcc"; +- reg = <0 0x09200000 0 0x200000>, <0 0x09600000 0 0x50000>; ++ reg = <0 0x09200000 0 0x50000>, <0 0x09600000 0 0x50000>; + reg-names = "llcc_base", "llcc_broadcast_base"; + interrupts = ; + }; +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-renesas-r8a774c0-fix-msiof1-dma-channels.patch b/queue-5.8/arm64-dts-renesas-r8a774c0-fix-msiof1-dma-channels.patch new file mode 100644 index 00000000000..97026b6515d --- /dev/null +++ b/queue-5.8/arm64-dts-renesas-r8a774c0-fix-msiof1-dma-channels.patch @@ -0,0 +1,39 @@ +From 007aa4783bcdaef71666595fc85b2d0cae4258e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 15:21:17 +0200 +Subject: arm64: dts: renesas: r8a774c0: Fix MSIOF1 DMA channels + +From: Geert Uytterhoeven + +[ Upstream commit c91dfc9818df5f43c10c727f1cecaebdb5e2fa92 ] + +According to Technical Update TN-RCT-S0352A/E, MSIOF1 DMA can only be +used with SYS-DMAC0 on R-Car E3. + +Fixes: 62c0056f1c3eb15d ("arm64: dts: renesas: r8a774c0: Add MSIOF nodes") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20200917132117.8515-3-geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a774c0.dtsi | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi +index 42171190cce46..065e8fe3a071c 100644 +--- a/arch/arm64/boot/dts/renesas/r8a774c0.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a774c0.dtsi +@@ -1214,9 +1214,8 @@ msiof1: spi@e6ea0000 { + reg = <0 0xe6ea0000 0 0x0064>; + interrupts = ; + clocks = <&cpg CPG_MOD 210>; +- dmas = <&dmac1 0x43>, <&dmac1 0x42>, +- <&dmac2 0x43>, <&dmac2 0x42>; +- dma-names = "tx", "rx", "tx", "rx"; ++ dmas = <&dmac0 0x43>, <&dmac0 0x42>; ++ dma-names = "tx", "rx"; + power-domains = <&sysc R8A774C0_PD_ALWAYS_ON>; + resets = <&cpg 210>; + #address-cells = <1>; +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-renesas-r8a77990-fix-msiof1-dma-channels.patch b/queue-5.8/arm64-dts-renesas-r8a77990-fix-msiof1-dma-channels.patch new file mode 100644 index 00000000000..42ec6f64331 --- /dev/null +++ b/queue-5.8/arm64-dts-renesas-r8a77990-fix-msiof1-dma-channels.patch @@ -0,0 +1,39 @@ +From 0c1c567883f46dda8837d219c76f6d411526f5ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 15:21:16 +0200 +Subject: arm64: dts: renesas: r8a77990: Fix MSIOF1 DMA channels + +From: Geert Uytterhoeven + +[ Upstream commit 453802c463abd003a7c38ffbc90b67ba162335b6 ] + +According to Technical Update TN-RCT-S0352A/E, MSIOF1 DMA can only be +used with SYS-DMAC0 on R-Car E3. + +Fixes: 8517042060b55a37 ("arm64: dts: renesas: r8a77990: Add DMA properties to MSIOF nodes") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20200917132117.8515-2-geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a77990.dtsi | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a77990.dtsi b/arch/arm64/boot/dts/renesas/r8a77990.dtsi +index 1991bdc36792f..27f74df8efbde 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77990.dtsi ++++ b/arch/arm64/boot/dts/renesas/r8a77990.dtsi +@@ -1192,9 +1192,8 @@ msiof1: spi@e6ea0000 { + reg = <0 0xe6ea0000 0 0x0064>; + interrupts = ; + clocks = <&cpg CPG_MOD 210>; +- dmas = <&dmac1 0x43>, <&dmac1 0x42>, +- <&dmac2 0x43>, <&dmac2 0x42>; +- dma-names = "tx", "rx", "tx", "rx"; ++ dmas = <&dmac0 0x43>, <&dmac0 0x42>; ++ dma-names = "tx", "rx"; + power-domains = <&sysc R8A77990_PD_ALWAYS_ON>; + resets = <&cpg 210>; + #address-cells = <1>; +-- +2.25.1 + diff --git a/queue-5.8/arm64-dts-zynqmp-remove-additional-compatible-string.patch b/queue-5.8/arm64-dts-zynqmp-remove-additional-compatible-string.patch new file mode 100644 index 00000000000..fb9e48bb494 --- /dev/null +++ b/queue-5.8/arm64-dts-zynqmp-remove-additional-compatible-string.patch @@ -0,0 +1,60 @@ +From 05e0d37b3addde1cff34081d5e20079603cda84f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 10:59:14 +0200 +Subject: arm64: dts: zynqmp: Remove additional compatible string for i2c IPs + +From: Michal Simek + +[ Upstream commit 35292518cb0a626fcdcabf739aed75060a018ab5 ] + +DT binding permits only one compatible string which was decribed in past by +commit 63cab195bf49 ("i2c: removed work arounds in i2c driver for Zynq +Ultrascale+ MPSoC"). +The commit aea37006e183 ("dt-bindings: i2c: cadence: Migrate i2c-cadence +documentation to YAML") has converted binding to yaml and the following +issues is reported: +...: i2c@ff030000: compatible: Additional items are not allowed +('cdns,i2c-r1p10' was unexpected) + From schema: +.../Documentation/devicetree/bindings/i2c/cdns,i2c-r1p10.yaml fds +...: i2c@ff030000: compatible: ['cdns,i2c-r1p14', 'cdns,i2c-r1p10'] is too +long + +The commit c415f9e8304a ("ARM64: zynqmp: Fix i2c node's compatible string") +has added the second compatible string but without removing origin one. +The patch is only keeping one compatible string "cdns,i2c-r1p14". + +Fixes: c415f9e8304a ("ARM64: zynqmp: Fix i2c node's compatible string") +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/cc294ae1a79ef845af6809ddb4049f0c0f5bb87a.1598259551.git.michal.simek@xilinx.com +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +index 9174ddc76bdc3..b8d04c5748bf3 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +@@ -500,7 +500,7 @@ gpio: gpio@ff0a0000 { + }; + + i2c0: i2c@ff020000 { +- compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; ++ compatible = "cdns,i2c-r1p14"; + status = "disabled"; + interrupt-parent = <&gic>; + interrupts = <0 17 4>; +@@ -511,7 +511,7 @@ i2c0: i2c@ff020000 { + }; + + i2c1: i2c@ff030000 { +- compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; ++ compatible = "cdns,i2c-r1p14"; + status = "disabled"; + interrupt-parent = <&gic>; + interrupts = <0 18 4>; +-- +2.25.1 + diff --git a/queue-5.8/arm64-kprobe-add-checks-for-armv8.3-pauth-combined-i.patch b/queue-5.8/arm64-kprobe-add-checks-for-armv8.3-pauth-combined-i.patch new file mode 100644 index 00000000000..94f445b19c6 --- /dev/null +++ b/queue-5.8/arm64-kprobe-add-checks-for-armv8.3-pauth-combined-i.patch @@ -0,0 +1,125 @@ +From 4d2fb9817badb4a091ab57d4e6069eb02e6daaa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 14:06:51 +0530 +Subject: arm64: kprobe: add checks for ARMv8.3-PAuth combined instructions + +From: Amit Daniel Kachhap + +[ Upstream commit 93396936ed0ce2c6f44140bd14728611d0bb065e ] + +Currently the ARMv8.3-PAuth combined branch instructions (braa, retaa +etc.) are not simulated for out-of-line execution with a handler. Hence the +uprobe of such instructions leads to kernel warnings in a loop as they are +not explicitly checked and fall into INSN_GOOD categories. Other combined +instructions like LDRAA and LDRBB can be probed. + +The issue of the combined branch instructions is fixed by adding +group definitions of all such instructions and rejecting their probes. +The instruction groups added are br_auth(braa, brab, braaz and brabz), +blr_auth(blraa, blrab, blraaz and blrabz), ret_auth(retaa and retab) and +eret_auth(eretaa and eretab). + +Warning log: + WARNING: CPU: 0 PID: 156 at arch/arm64/kernel/probes/uprobes.c:182 uprobe_single_step_handler+0x34/0x50 + Modules linked in: + CPU: 0 PID: 156 Comm: func Not tainted 5.9.0-rc3 #188 + Hardware name: Foundation-v8A (DT) + pstate: 804003c9 (Nzcv DAIF +PAN -UAO BTYPE=--) + pc : uprobe_single_step_handler+0x34/0x50 + lr : single_step_handler+0x70/0xf8 + sp : ffff800012af3e30 + x29: ffff800012af3e30 x28: ffff000878723b00 + x27: 0000000000000000 x26: 0000000000000000 + x25: 0000000000000000 x24: 0000000000000000 + x23: 0000000060001000 x22: 00000000cb000022 + x21: ffff800012065ce8 x20: ffff800012af3ec0 + x19: ffff800012068d50 x18: 0000000000000000 + x17: 0000000000000000 x16: 0000000000000000 + x15: 0000000000000000 x14: 0000000000000000 + x13: 0000000000000000 x12: 0000000000000000 + x11: 0000000000000000 x10: 0000000000000000 + x9 : ffff800010085c90 x8 : 0000000000000000 + x7 : 0000000000000000 x6 : ffff80001205a9c8 + x5 : ffff80001205a000 x4 : ffff80001233db80 + x3 : ffff8000100a7a60 x2 : 0020000000000003 + x1 : 0000fffffffff008 x0 : ffff800012af3ec0 + Call trace: + uprobe_single_step_handler+0x34/0x50 + single_step_handler+0x70/0xf8 + do_debug_exception+0xb8/0x130 + el0_sync_handler+0x138/0x1b8 + el0_sync+0x158/0x180 + +Fixes: 74afda4016a7 ("arm64: compile the kernel with ptrauth return address signing") +Fixes: 04ca3204fa09 ("arm64: enable pointer authentication") +Signed-off-by: Amit Daniel Kachhap +Reviewed-by: Dave Martin +Link: https://lore.kernel.org/r/20200914083656.21428-2-amit.kachhap@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/insn.h | 4 ++++ + arch/arm64/kernel/insn.c | 5 ++++- + arch/arm64/kernel/probes/decode-insn.c | 3 ++- + 3 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/include/asm/insn.h b/arch/arm64/include/asm/insn.h +index 0bc46149e4917..4b39293d0f72d 100644 +--- a/arch/arm64/include/asm/insn.h ++++ b/arch/arm64/include/asm/insn.h +@@ -359,9 +359,13 @@ __AARCH64_INSN_FUNCS(brk, 0xFFE0001F, 0xD4200000) + __AARCH64_INSN_FUNCS(exception, 0xFF000000, 0xD4000000) + __AARCH64_INSN_FUNCS(hint, 0xFFFFF01F, 0xD503201F) + __AARCH64_INSN_FUNCS(br, 0xFFFFFC1F, 0xD61F0000) ++__AARCH64_INSN_FUNCS(br_auth, 0xFEFFF800, 0xD61F0800) + __AARCH64_INSN_FUNCS(blr, 0xFFFFFC1F, 0xD63F0000) ++__AARCH64_INSN_FUNCS(blr_auth, 0xFEFFF800, 0xD63F0800) + __AARCH64_INSN_FUNCS(ret, 0xFFFFFC1F, 0xD65F0000) ++__AARCH64_INSN_FUNCS(ret_auth, 0xFFFFFBFF, 0xD65F0BFF) + __AARCH64_INSN_FUNCS(eret, 0xFFFFFFFF, 0xD69F03E0) ++__AARCH64_INSN_FUNCS(eret_auth, 0xFFFFFBFF, 0xD69F0BFF) + __AARCH64_INSN_FUNCS(mrs, 0xFFF00000, 0xD5300000) + __AARCH64_INSN_FUNCS(msr_imm, 0xFFF8F01F, 0xD500401F) + __AARCH64_INSN_FUNCS(msr_reg, 0xFFF00000, 0xD5100000) +diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c +index a107375005bc9..ccc8c9e22b258 100644 +--- a/arch/arm64/kernel/insn.c ++++ b/arch/arm64/kernel/insn.c +@@ -176,7 +176,7 @@ bool __kprobes aarch64_insn_uses_literal(u32 insn) + + bool __kprobes aarch64_insn_is_branch(u32 insn) + { +- /* b, bl, cb*, tb*, b.cond, br, blr */ ++ /* b, bl, cb*, tb*, ret*, b.cond, br*, blr* */ + + return aarch64_insn_is_b(insn) || + aarch64_insn_is_bl(insn) || +@@ -185,8 +185,11 @@ bool __kprobes aarch64_insn_is_branch(u32 insn) + aarch64_insn_is_tbz(insn) || + aarch64_insn_is_tbnz(insn) || + aarch64_insn_is_ret(insn) || ++ aarch64_insn_is_ret_auth(insn) || + aarch64_insn_is_br(insn) || ++ aarch64_insn_is_br_auth(insn) || + aarch64_insn_is_blr(insn) || ++ aarch64_insn_is_blr_auth(insn) || + aarch64_insn_is_bcond(insn); + } + +diff --git a/arch/arm64/kernel/probes/decode-insn.c b/arch/arm64/kernel/probes/decode-insn.c +index 263d5fba4c8a3..c541fb48886e3 100644 +--- a/arch/arm64/kernel/probes/decode-insn.c ++++ b/arch/arm64/kernel/probes/decode-insn.c +@@ -29,7 +29,8 @@ static bool __kprobes aarch64_insn_is_steppable(u32 insn) + aarch64_insn_is_msr_imm(insn) || + aarch64_insn_is_msr_reg(insn) || + aarch64_insn_is_exception(insn) || +- aarch64_insn_is_eret(insn)) ++ aarch64_insn_is_eret(insn) || ++ aarch64_insn_is_eret_auth(insn)) + return false; + + /* +-- +2.25.1 + diff --git a/queue-5.8/arm64-mm-use-single-quantity-to-represent-the-pa-to-.patch b/queue-5.8/arm64-mm-use-single-quantity-to-represent-the-pa-to-.patch new file mode 100644 index 00000000000..329db89db2d --- /dev/null +++ b/queue-5.8/arm64-mm-use-single-quantity-to-represent-the-pa-to-.patch @@ -0,0 +1,153 @@ +From ff3f4c09f3344f0f9a7ae9fdbea9b279d53228c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 17:35:59 +0200 +Subject: arm64: mm: use single quantity to represent the PA to VA translation + +From: Ard Biesheuvel + +[ Upstream commit 7bc1a0f9e1765830e945669c99c59c35cf9bca82 ] + +On arm64, the global variable memstart_addr represents the physical +address of PAGE_OFFSET, and so physical to virtual translations or +vice versa used to come down to simple additions or subtractions +involving the values of PAGE_OFFSET and memstart_addr. + +When support for 52-bit virtual addressing was introduced, we had to +deal with PAGE_OFFSET potentially being outside of the region that +can be covered by the virtual range (as the 52-bit VA capable build +needs to be able to run on systems that are only 48-bit VA capable), +and for this reason, another translation was introduced, and recorded +in the global variable physvirt_offset. + +However, if we go back to the original definition of memstart_addr, +i.e., the physical address of PAGE_OFFSET, it turns out that there is +no need for two separate translations: instead, we can simply subtract +the size of the unaddressable VA space from memstart_addr to make the +available physical memory appear in the 48-bit addressable VA region. + +This simplifies things, but also fixes a bug on KASLR builds, which +may update memstart_addr later on in arm64_memblock_init(), but fails +to update vmemmap and physvirt_offset accordingly. + +Fixes: 5383cc6efed1 ("arm64: mm: Introduce vabits_actual") +Signed-off-by: Ard Biesheuvel +Reviewed-by: Steve Capper +Link: https://lore.kernel.org/r/20201008153602.9467-2-ardb@kernel.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/include/asm/memory.h | 5 ++--- + arch/arm64/include/asm/pgtable.h | 4 ++-- + arch/arm64/mm/init.c | 30 ++++++++++-------------------- + 3 files changed, 14 insertions(+), 25 deletions(-) + +diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h +index a1871bb32bb17..d207f63eb68e1 100644 +--- a/arch/arm64/include/asm/memory.h ++++ b/arch/arm64/include/asm/memory.h +@@ -163,7 +163,6 @@ extern u64 vabits_actual; + #include + #include + +-extern s64 physvirt_offset; + extern s64 memstart_addr; + /* PHYS_OFFSET - the physical address of the start of memory. */ + #define PHYS_OFFSET ({ VM_BUG_ON(memstart_addr & 1); memstart_addr; }) +@@ -239,7 +238,7 @@ static inline const void *__tag_set(const void *addr, u8 tag) + */ + #define __is_lm_address(addr) (!(((u64)addr) & BIT(vabits_actual - 1))) + +-#define __lm_to_phys(addr) (((addr) + physvirt_offset)) ++#define __lm_to_phys(addr) (((addr) & ~PAGE_OFFSET) + PHYS_OFFSET) + #define __kimg_to_phys(addr) ((addr) - kimage_voffset) + + #define __virt_to_phys_nodebug(x) ({ \ +@@ -257,7 +256,7 @@ extern phys_addr_t __phys_addr_symbol(unsigned long x); + #define __phys_addr_symbol(x) __pa_symbol_nodebug(x) + #endif /* CONFIG_DEBUG_VIRTUAL */ + +-#define __phys_to_virt(x) ((unsigned long)((x) - physvirt_offset)) ++#define __phys_to_virt(x) ((unsigned long)((x) - PHYS_OFFSET) | PAGE_OFFSET) + #define __phys_to_kimg(x) ((unsigned long)((x) + kimage_voffset)) + + /* +diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h +index 758e2d1577d0c..a1745d6ea4b58 100644 +--- a/arch/arm64/include/asm/pgtable.h ++++ b/arch/arm64/include/asm/pgtable.h +@@ -23,6 +23,8 @@ + #define VMALLOC_START (MODULES_END) + #define VMALLOC_END (- PUD_SIZE - VMEMMAP_SIZE - SZ_64K) + ++#define vmemmap ((struct page *)VMEMMAP_START - (memstart_addr >> PAGE_SHIFT)) ++ + #define FIRST_USER_ADDRESS 0UL + + #ifndef __ASSEMBLY__ +@@ -33,8 +35,6 @@ + #include + #include + +-extern struct page *vmemmap; +- + extern void __pte_error(const char *file, int line, unsigned long val); + extern void __pmd_error(const char *file, int line, unsigned long val); + extern void __pud_error(const char *file, int line, unsigned long val); +diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c +index 1e93cfc7c47ad..ca4410eb230a3 100644 +--- a/arch/arm64/mm/init.c ++++ b/arch/arm64/mm/init.c +@@ -54,12 +54,6 @@ + s64 memstart_addr __ro_after_init = -1; + EXPORT_SYMBOL(memstart_addr); + +-s64 physvirt_offset __ro_after_init; +-EXPORT_SYMBOL(physvirt_offset); +- +-struct page *vmemmap __ro_after_init; +-EXPORT_SYMBOL(vmemmap); +- + /* + * We create both ZONE_DMA and ZONE_DMA32. ZONE_DMA covers the first 1G of + * memory as some devices, namely the Raspberry Pi 4, have peripherals with +@@ -290,20 +284,6 @@ void __init arm64_memblock_init(void) + memstart_addr = round_down(memblock_start_of_DRAM(), + ARM64_MEMSTART_ALIGN); + +- physvirt_offset = PHYS_OFFSET - PAGE_OFFSET; +- +- vmemmap = ((struct page *)VMEMMAP_START - (memstart_addr >> PAGE_SHIFT)); +- +- /* +- * If we are running with a 52-bit kernel VA config on a system that +- * does not support it, we have to offset our vmemmap and physvirt_offset +- * s.t. we avoid the 52-bit portion of the direct linear map +- */ +- if (IS_ENABLED(CONFIG_ARM64_VA_BITS_52) && (vabits_actual != 52)) { +- vmemmap += (_PAGE_OFFSET(48) - _PAGE_OFFSET(52)) >> PAGE_SHIFT; +- physvirt_offset = PHYS_OFFSET - _PAGE_OFFSET(48); +- } +- + /* + * Remove the memory that we will not be able to cover with the + * linear mapping. Take care not to clip the kernel which may be +@@ -318,6 +298,16 @@ void __init arm64_memblock_init(void) + memblock_remove(0, memstart_addr); + } + ++ /* ++ * If we are running with a 52-bit kernel VA config on a system that ++ * does not support it, we have to place the available physical ++ * memory in the 48-bit addressable part of the linear region, i.e., ++ * we have to move it upward. Since memstart_addr represents the ++ * physical address of PAGE_OFFSET, we have to *subtract* from it. ++ */ ++ if (IS_ENABLED(CONFIG_ARM64_VA_BITS_52) && (vabits_actual != 52)) ++ memstart_addr -= _PAGE_OFFSET(48) - _PAGE_OFFSET(52); ++ + /* + * Apply the memory limit if it was set. Since the kernel may be loaded + * high up in memory, add back the kernel region that must be accessible +-- +2.25.1 + diff --git a/queue-5.8/arm64-perf-add-missing-isb-in-armv8pmu_enable_counte.patch b/queue-5.8/arm64-perf-add-missing-isb-in-armv8pmu_enable_counte.patch new file mode 100644 index 00000000000..18dbe23afe8 --- /dev/null +++ b/queue-5.8/arm64-perf-add-missing-isb-in-armv8pmu_enable_counte.patch @@ -0,0 +1,62 @@ +From e2d05a9d084fc20a78f5e0a466f94cdd7086aba1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 12:07:00 +0100 +Subject: arm64: perf: Add missing ISB in armv8pmu_enable_counter() + +From: Alexandru Elisei + +[ Upstream commit 490d7b7c0845eacf5593db333fd2ae7715416e16 ] + +Writes to the PMXEVTYPER_EL0 register are not self-synchronising. In +armv8pmu_enable_event(), the PE can reorder configuring the event type +after we have enabled the counter and the interrupt. This can lead to an +interrupt being asserted because of the previous event type that we were +counting using the same counter, not the one that we've just configured. + +The same rationale applies to writes to the PMINTENSET_EL1 register. The PE +can reorder enabling the interrupt at any point in the future after we have +enabled the event. + +Prevent both situations from happening by adding an ISB just before we +enable the event counter. + +Fixes: 030896885ade ("arm64: Performance counters support") +Reported-by: Julien Thierry +Signed-off-by: Alexandru Elisei +Tested-by: Sumit Garg (Developerbox) +Cc: Julien Thierry +Cc: Will Deacon +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Ingo Molnar +Cc: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Catalin Marinas +Link: https://lore.kernel.org/r/20200924110706.254996-2-alexandru.elisei@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/perf_event.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c +index 581602413a130..c26d84ff0e224 100644 +--- a/arch/arm64/kernel/perf_event.c ++++ b/arch/arm64/kernel/perf_event.c +@@ -510,6 +510,11 @@ static u32 armv8pmu_event_cnten_mask(struct perf_event *event) + + static inline void armv8pmu_enable_counter(u32 mask) + { ++ /* ++ * Make sure event configuration register writes are visible before we ++ * enable the counter. ++ * */ ++ isb(); + write_sysreg(mask, pmcntenset_el0); + } + +-- +2.25.1 + diff --git a/queue-5.8/asoc-cros_ec_codec-fix-kconfig-dependency-warning-fo.patch b/queue-5.8/asoc-cros_ec_codec-fix-kconfig-dependency-warning-fo.patch new file mode 100644 index 00000000000..69692970551 --- /dev/null +++ b/queue-5.8/asoc-cros_ec_codec-fix-kconfig-dependency-warning-fo.patch @@ -0,0 +1,48 @@ +From 41d9a9f9a35f655d16282c531fe044339feb2a46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 17:18:04 +0300 +Subject: ASoC: cros_ec_codec: fix kconfig dependency warning for + SND_SOC_CROS_EC_CODEC + +From: Necip Fazil Yildiran + +[ Upstream commit 50b18e4a2608e3897f3787eaa7dfa869b40d9923 ] + +When SND_SOC_CROS_EC_CODEC is enabled and CRYPTO is disabled, it results +in the following Kbuild warning: + +WARNING: unmet direct dependencies detected for CRYPTO_LIB_SHA256 + Depends on [n]: CRYPTO [=n] + Selected by [y]: + - SND_SOC_CROS_EC_CODEC [=y] && SOUND [=y] && !UML && SND [=y] && SND_SOC [=y] && CROS_EC [=y] + +The reason is that SND_SOC_CROS_EC_CODEC selects CRYPTO_LIB_SHA256 without +depending on or selecting CRYPTO while CRYPTO_LIB_SHA256 is subordinate to +CRYPTO. + +Honor the kconfig menu hierarchy to remove kconfig dependency warnings. + +Fixes: 93fa0af4790a ("ASoC: cros_ec_codec: switch to library API for SHA-256") +Signed-off-by: Necip Fazil Yildiran +Link: https://lore.kernel.org/r/20200917141803.92889-1-fazilyildiran@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index 986a6308818b2..2a8484f37496c 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -539,6 +539,7 @@ config SND_SOC_CQ0093VC + config SND_SOC_CROS_EC_CODEC + tristate "codec driver for ChromeOS EC" + depends on CROS_EC ++ select CRYPTO + select CRYPTO_LIB_SHA256 + help + If you say yes here you will get support for the +-- +2.25.1 + diff --git a/queue-5.8/asoc-fsl-imx-es8328-add-missing-put_device-call-in-i.patch b/queue-5.8/asoc-fsl-imx-es8328-add-missing-put_device-call-in-i.patch new file mode 100644 index 00000000000..60c81e252cf --- /dev/null +++ b/queue-5.8/asoc-fsl-imx-es8328-add-missing-put_device-call-in-i.patch @@ -0,0 +1,75 @@ +From 8f57ffa3f2b4ccfacd8d04fc243375b9ec1451db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 21:02:24 +0800 +Subject: ASoC: fsl: imx-es8328: add missing put_device() call in + imx_es8328_probe() + +From: Yu Kuai + +[ Upstream commit e525db7e4b44c5b2b5aac0dad24e23cb58c54d22 ] + +if of_find_device_by_node() succeed, imx_es8328_probe() doesn't have +a corresponding put_device(). Thus add a jump target to fix the exception +handling for this function implementation. + +Fixes: 7e7292dba215 ("ASoC: fsl: add imx-es8328 machine driver") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20200825130224.1488694-1-yukuai3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-es8328.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/fsl/imx-es8328.c b/sound/soc/fsl/imx-es8328.c +index 15a27a2cd0cae..fad1eb6253d53 100644 +--- a/sound/soc/fsl/imx-es8328.c ++++ b/sound/soc/fsl/imx-es8328.c +@@ -145,13 +145,13 @@ static int imx_es8328_probe(struct platform_device *pdev) + data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL); + if (!data) { + ret = -ENOMEM; +- goto fail; ++ goto put_device; + } + + comp = devm_kzalloc(dev, 3 * sizeof(*comp), GFP_KERNEL); + if (!comp) { + ret = -ENOMEM; +- goto fail; ++ goto put_device; + } + + data->dev = dev; +@@ -182,12 +182,12 @@ static int imx_es8328_probe(struct platform_device *pdev) + ret = snd_soc_of_parse_card_name(&data->card, "model"); + if (ret) { + dev_err(dev, "Unable to parse card name\n"); +- goto fail; ++ goto put_device; + } + ret = snd_soc_of_parse_audio_routing(&data->card, "audio-routing"); + if (ret) { + dev_err(dev, "Unable to parse routing: %d\n", ret); +- goto fail; ++ goto put_device; + } + data->card.num_links = 1; + data->card.owner = THIS_MODULE; +@@ -196,10 +196,12 @@ static int imx_es8328_probe(struct platform_device *pdev) + ret = snd_soc_register_card(&data->card); + if (ret) { + dev_err(dev, "Unable to register: %d\n", ret); +- goto fail; ++ goto put_device; + } + + platform_set_drvdata(pdev, data); ++put_device: ++ put_device(&ssi_pdev->dev); + fail: + of_node_put(ssi_np); + of_node_put(codec_np); +-- +2.25.1 + diff --git a/queue-5.8/asoc-fsl_sai-instantiate-snd_soc_dai_driver.patch b/queue-5.8/asoc-fsl_sai-instantiate-snd_soc_dai_driver.patch new file mode 100644 index 00000000000..fb276004d00 --- /dev/null +++ b/queue-5.8/asoc-fsl_sai-instantiate-snd_soc_dai_driver.patch @@ -0,0 +1,92 @@ +From 4020f03bf33435edeafb5066f2f504b68a487b1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 18:26:00 +0800 +Subject: ASoC: fsl_sai: Instantiate snd_soc_dai_driver + +From: Shengjiu Wang + +[ Upstream commit 22a16145af824f91014d07f8664114859900b9e6 ] + +Instantiate snd_soc_dai_driver for independent symmetric control. +Otherwise the symmetric setting may be overwritten by other +instance. + +Fixes: 08fdf65e37d5 ("ASoC: fsl_sai: Add asynchronous mode support") +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1600424760-32071-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_sai.c | 19 +++++++++++-------- + sound/soc/fsl/fsl_sai.h | 1 + + 2 files changed, 12 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c +index 7031869a023a1..211e29a73a41a 100644 +--- a/sound/soc/fsl/fsl_sai.c ++++ b/sound/soc/fsl/fsl_sai.c +@@ -694,7 +694,7 @@ static int fsl_sai_dai_probe(struct snd_soc_dai *cpu_dai) + return 0; + } + +-static struct snd_soc_dai_driver fsl_sai_dai = { ++static struct snd_soc_dai_driver fsl_sai_dai_template = { + .probe = fsl_sai_dai_probe, + .playback = { + .stream_name = "CPU-Playback", +@@ -966,12 +966,15 @@ static int fsl_sai_probe(struct platform_device *pdev) + return ret; + } + ++ memcpy(&sai->cpu_dai_drv, &fsl_sai_dai_template, ++ sizeof(fsl_sai_dai_template)); ++ + /* Sync Tx with Rx as default by following old DT binding */ + sai->synchronous[RX] = true; + sai->synchronous[TX] = false; +- fsl_sai_dai.symmetric_rates = 1; +- fsl_sai_dai.symmetric_channels = 1; +- fsl_sai_dai.symmetric_samplebits = 1; ++ sai->cpu_dai_drv.symmetric_rates = 1; ++ sai->cpu_dai_drv.symmetric_channels = 1; ++ sai->cpu_dai_drv.symmetric_samplebits = 1; + + if (of_find_property(np, "fsl,sai-synchronous-rx", NULL) && + of_find_property(np, "fsl,sai-asynchronous", NULL)) { +@@ -988,9 +991,9 @@ static int fsl_sai_probe(struct platform_device *pdev) + /* Discard all settings for asynchronous mode */ + sai->synchronous[RX] = false; + sai->synchronous[TX] = false; +- fsl_sai_dai.symmetric_rates = 0; +- fsl_sai_dai.symmetric_channels = 0; +- fsl_sai_dai.symmetric_samplebits = 0; ++ sai->cpu_dai_drv.symmetric_rates = 0; ++ sai->cpu_dai_drv.symmetric_channels = 0; ++ sai->cpu_dai_drv.symmetric_samplebits = 0; + } + + if (of_find_property(np, "fsl,sai-mclk-direction-output", NULL) && +@@ -1019,7 +1022,7 @@ static int fsl_sai_probe(struct platform_device *pdev) + pm_runtime_enable(&pdev->dev); + + ret = devm_snd_soc_register_component(&pdev->dev, &fsl_component, +- &fsl_sai_dai, 1); ++ &sai->cpu_dai_drv, 1); + if (ret) + goto err_pm_disable; + +diff --git a/sound/soc/fsl/fsl_sai.h b/sound/soc/fsl/fsl_sai.h +index 6aba7d28f5f34..677ecfc1ec68f 100644 +--- a/sound/soc/fsl/fsl_sai.h ++++ b/sound/soc/fsl/fsl_sai.h +@@ -180,6 +180,7 @@ struct fsl_sai { + unsigned int bclk_ratio; + + const struct fsl_sai_soc_data *soc_data; ++ struct snd_soc_dai_driver cpu_dai_drv; + struct snd_dmaengine_dai_dma_data dma_params_rx; + struct snd_dmaengine_dai_dma_data dma_params_tx; + }; +-- +2.25.1 + diff --git a/queue-5.8/asoc-intel-sof_rt5682-override-quirk-data-for-tgl_ma.patch b/queue-5.8/asoc-intel-sof_rt5682-override-quirk-data-for-tgl_ma.patch new file mode 100644 index 00000000000..0d266fd879b --- /dev/null +++ b/queue-5.8/asoc-intel-sof_rt5682-override-quirk-data-for-tgl_ma.patch @@ -0,0 +1,51 @@ +From 65657436f7e74c608bce664275a5302a65df0d9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 14:55:59 -0500 +Subject: ASoC: Intel: sof_rt5682: override quirk data for tgl_max98373_rt5682 + +From: Sathyanarayana Nujella + +[ Upstream commit 3e1734b64ce786c54dc98adcfe67941e6011d735 ] + +A Chrome System based on tgl_max98373_rt5682 has different SSP interface +configurations. Using DMI data of this variant DUT, override quirk +data. + +Reviewed-by: Guennadi Liakhovetski +Signed-off-by: Sathyanarayana Nujella +Signed-off-by: Mac Chiang +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200821195603.215535-13-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/sof_rt5682.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/sound/soc/intel/boards/sof_rt5682.c b/sound/soc/intel/boards/sof_rt5682.c +index 13a48b0c35aef..11233c3aeadfb 100644 +--- a/sound/soc/intel/boards/sof_rt5682.c ++++ b/sound/soc/intel/boards/sof_rt5682.c +@@ -118,6 +118,19 @@ static const struct dmi_system_id sof_rt5682_quirk_table[] = { + .driver_data = (void *)(SOF_RT5682_MCLK_EN | + SOF_RT5682_SSP_CODEC(0)), + }, ++ { ++ .callback = sof_rt5682_quirk_cb, ++ .matches = { ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Volteer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Terrador"), ++ }, ++ .driver_data = (void *)(SOF_RT5682_MCLK_EN | ++ SOF_RT5682_SSP_CODEC(0) | ++ SOF_SPEAKER_AMP_PRESENT | ++ SOF_MAX98373_SPEAKER_AMP_PRESENT | ++ SOF_RT5682_SSP_AMP(2) | ++ SOF_RT5682_NUM_HDMIDEV(4)), ++ }, + {} + }; + +-- +2.25.1 + diff --git a/queue-5.8/asoc-qcom-lpass-cpu-fix-concurrency-issue.patch b/queue-5.8/asoc-qcom-lpass-cpu-fix-concurrency-issue.patch new file mode 100644 index 00000000000..741fcbae7cd --- /dev/null +++ b/queue-5.8/asoc-qcom-lpass-cpu-fix-concurrency-issue.patch @@ -0,0 +1,62 @@ +From f32c10ae29583788262aeea86cf5dcf96133460d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Aug 2020 16:23:02 +0530 +Subject: ASoC: qcom: lpass-cpu: fix concurrency issue + +From: Rohit kumar + +[ Upstream commit 753a6e17942f6f425ca622e1610625998312ad89 ] + +i2sctl register value is set to 0 during hw_free(). This +impacts any ongoing concurrent session on the same i2s +port. As trigger() stop already resets enable bit to 0, +there is no need of explicit hw_free. Removing it to +fix the issue. + +Fixes: 80beab8e1d86 ("ASoC: qcom: Add LPASS CPU DAI driver") +Signed-off-by: Rohit kumar +Reviewed-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/1597402388-14112-7-git-send-email-rohitkr@codeaurora.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/lpass-cpu.c | 16 ---------------- + 1 file changed, 16 deletions(-) + +diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c +index e00a4af29c13f..f25da84f175ac 100644 +--- a/sound/soc/qcom/lpass-cpu.c ++++ b/sound/soc/qcom/lpass-cpu.c +@@ -209,21 +209,6 @@ static int lpass_cpu_daiops_hw_params(struct snd_pcm_substream *substream, + return 0; + } + +-static int lpass_cpu_daiops_hw_free(struct snd_pcm_substream *substream, +- struct snd_soc_dai *dai) +-{ +- struct lpass_data *drvdata = snd_soc_dai_get_drvdata(dai); +- int ret; +- +- ret = regmap_write(drvdata->lpaif_map, +- LPAIF_I2SCTL_REG(drvdata->variant, dai->driver->id), +- 0); +- if (ret) +- dev_err(dai->dev, "error writing to i2sctl reg: %d\n", ret); +- +- return ret; +-} +- + static int lpass_cpu_daiops_prepare(struct snd_pcm_substream *substream, + struct snd_soc_dai *dai) + { +@@ -304,7 +289,6 @@ const struct snd_soc_dai_ops asoc_qcom_lpass_cpu_dai_ops = { + .startup = lpass_cpu_daiops_startup, + .shutdown = lpass_cpu_daiops_shutdown, + .hw_params = lpass_cpu_daiops_hw_params, +- .hw_free = lpass_cpu_daiops_hw_free, + .prepare = lpass_cpu_daiops_prepare, + .trigger = lpass_cpu_daiops_trigger, + }; +-- +2.25.1 + diff --git a/queue-5.8/asoc-qcom-lpass-platform-fix-memory-leak.patch b/queue-5.8/asoc-qcom-lpass-platform-fix-memory-leak.patch new file mode 100644 index 00000000000..eb5d5b067d3 --- /dev/null +++ b/queue-5.8/asoc-qcom-lpass-platform-fix-memory-leak.patch @@ -0,0 +1,46 @@ +From 0eaa0def92726d2ac4e753d2d382048269491946 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Aug 2020 16:23:00 +0530 +Subject: ASoC: qcom: lpass-platform: fix memory leak + +From: Rohit kumar + +[ Upstream commit 5fd188215d4eb52703600d8986b22311099a5940 ] + +lpass_pcm_data is never freed. Free it in close +ops to avoid memory leak. + +Fixes: 022d00ee0b55 ("ASoC: lpass-platform: Fix broken pcm data usage") +Signed-off-by: Rohit kumar +Reviewed-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/1597402388-14112-5-git-send-email-rohitkr@codeaurora.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/lpass-platform.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c +index 34f7fd1bab1cf..693839deebfe8 100644 +--- a/sound/soc/qcom/lpass-platform.c ++++ b/sound/soc/qcom/lpass-platform.c +@@ -61,7 +61,7 @@ static int lpass_platform_pcmops_open(struct snd_soc_component *component, + int ret, dma_ch, dir = substream->stream; + struct lpass_pcm_data *data; + +- data = devm_kzalloc(soc_runtime->dev, sizeof(*data), GFP_KERNEL); ++ data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + +@@ -118,6 +118,7 @@ static int lpass_platform_pcmops_close(struct snd_soc_component *component, + if (v->free_dma_channel) + v->free_dma_channel(drvdata, data->dma_ch); + ++ kfree(data); + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.8/asoc-sof-add-topology-filename-override-based-on-dmi.patch b/queue-5.8/asoc-sof-add-topology-filename-override-based-on-dmi.patch new file mode 100644 index 00000000000..faf0637930d --- /dev/null +++ b/queue-5.8/asoc-sof-add-topology-filename-override-based-on-dmi.patch @@ -0,0 +1,94 @@ +From c36a24ba16b56899f80e9be1bbbd0649074da394 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 14:56:00 -0500 +Subject: ASoC: SOF: Add topology filename override based on dmi data match + +From: Sathyanarayana Nujella + +[ Upstream commit 5253a73d567dcd75e62834ff5f502ea9470e5722 ] + +Add topology filename override based on system DMI data matching, +typically to account for a different hardware layout. + +In ACPI based systems, the tplg_filename is pre-defined in an ACPI +machine table. When a DMI quirk is detected, the +sof_pdata->tplg_filename is not set with the hard-coded ACPI value, +and instead is set with the DMI-specific filename. + +Reviewed-by: Guennadi Liakhovetski +Signed-off-by: Sathyanarayana Nujella +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200821195603.215535-14-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda.c | 8 +++++++- + sound/soc/sof/sof-pci-dev.c | 24 ++++++++++++++++++++++++ + 2 files changed, 31 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/sof/intel/hda.c b/sound/soc/sof/intel/hda.c +index 63ca920c8e6e0..7152e6d1cf673 100644 +--- a/sound/soc/sof/intel/hda.c ++++ b/sound/soc/sof/intel/hda.c +@@ -1179,7 +1179,13 @@ void hda_machine_select(struct snd_sof_dev *sdev) + + mach = snd_soc_acpi_find_machine(desc->machines); + if (mach) { +- sof_pdata->tplg_filename = mach->sof_tplg_filename; ++ /* ++ * If tplg file name is overridden, use it instead of ++ * the one set in mach table ++ */ ++ if (!sof_pdata->tplg_filename) ++ sof_pdata->tplg_filename = mach->sof_tplg_filename; ++ + sof_pdata->machine = mach; + + if (mach->link_mask) { +diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c +index aa3532ba14349..f3a8140773db5 100644 +--- a/sound/soc/sof/sof-pci-dev.c ++++ b/sound/soc/sof/sof-pci-dev.c +@@ -35,8 +35,28 @@ static int sof_pci_debug; + module_param_named(sof_pci_debug, sof_pci_debug, int, 0444); + MODULE_PARM_DESC(sof_pci_debug, "SOF PCI debug options (0x0 all off)"); + ++static const char *sof_override_tplg_name; ++ + #define SOF_PCI_DISABLE_PM_RUNTIME BIT(0) + ++static int sof_tplg_cb(const struct dmi_system_id *id) ++{ ++ sof_override_tplg_name = id->driver_data; ++ return 1; ++} ++ ++static const struct dmi_system_id sof_tplg_table[] = { ++ { ++ .callback = sof_tplg_cb, ++ .matches = { ++ DMI_MATCH(DMI_PRODUCT_FAMILY, "Google_Volteer"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Terrador"), ++ }, ++ .driver_data = "sof-tgl-rt5682-ssp0-max98373-ssp2.tplg", ++ }, ++ {} ++}; ++ + static const struct dmi_system_id community_key_platforms[] = { + { + .ident = "Up Squared", +@@ -347,6 +367,10 @@ static int sof_pci_probe(struct pci_dev *pci, + sof_pdata->tplg_filename_prefix = + sof_pdata->desc->default_tplg_path; + ++ dmi_check_system(sof_tplg_table); ++ if (sof_override_tplg_name) ++ sof_pdata->tplg_filename = sof_override_tplg_name; ++ + #if IS_ENABLED(CONFIG_SND_SOC_SOF_PROBE_WORK_QUEUE) + /* set callback to enable runtime_pm */ + sof_pdata->sof_probe_complete = sof_pci_probe_complete; +-- +2.25.1 + diff --git a/queue-5.8/asoc-sof-control-add-size-checks-for-ext_bytes-contr.patch b/queue-5.8/asoc-sof-control-add-size-checks-for-ext_bytes-contr.patch new file mode 100644 index 00000000000..bbd55c7b337 --- /dev/null +++ b/queue-5.8/asoc-sof-control-add-size-checks-for-ext_bytes-contr.patch @@ -0,0 +1,56 @@ +From f1f07c6a7d2267d01ff0f9536a983b97be4782ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 14:08:12 +0300 +Subject: ASoC: SOF: control: add size checks for ext_bytes control .put() + +From: Pierre-Louis Bossart + +[ Upstream commit 2ca210112ad91880d2d5a3f85fecc838600afbce ] + +Make sure the TLV header and size are consistent before copying from +userspace. + +Fixes: c3078f5397046 ('ASoC: SOF: Add Sound Open Firmware KControl support') +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Guennadi Liakhovetski +Signed-off-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20200921110814.2910477-4-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/control.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/soc/sof/control.c b/sound/soc/sof/control.c +index 186eea105bb15..009938d45ddd9 100644 +--- a/sound/soc/sof/control.c ++++ b/sound/soc/sof/control.c +@@ -298,6 +298,10 @@ int snd_sof_bytes_ext_put(struct snd_kcontrol *kcontrol, + const struct snd_ctl_tlv __user *tlvd = + (const struct snd_ctl_tlv __user *)binary_data; + ++ /* make sure we have at least a header */ ++ if (size < sizeof(struct snd_ctl_tlv)) ++ return -EINVAL; ++ + /* + * The beginning of bytes data contains a header from where + * the length (as bytes) is needed to know the correct copy +@@ -306,6 +310,13 @@ int snd_sof_bytes_ext_put(struct snd_kcontrol *kcontrol, + if (copy_from_user(&header, tlvd, sizeof(const struct snd_ctl_tlv))) + return -EFAULT; + ++ /* make sure TLV info is consistent */ ++ if (header.length + sizeof(struct snd_ctl_tlv) > size) { ++ dev_err_ratelimited(scomp->dev, "error: inconsistent TLV, data %d + header %zu > %d\n", ++ header.length, sizeof(struct snd_ctl_tlv), size); ++ return -EINVAL; ++ } ++ + /* be->max is coming from topology */ + if (header.length > be->max) { + dev_err_ratelimited(scomp->dev, "error: Bytes data size %d exceeds max %d.\n", +-- +2.25.1 + diff --git a/queue-5.8/asoc-tas2770-add-missing-bias-level-power-states.patch b/queue-5.8/asoc-tas2770-add-missing-bias-level-power-states.patch new file mode 100644 index 00000000000..213f43cf860 --- /dev/null +++ b/queue-5.8/asoc-tas2770-add-missing-bias-level-power-states.patch @@ -0,0 +1,43 @@ +From cc256deb576cb7ae4872344236d9571b6b5b8be9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 14:05:41 -0500 +Subject: ASoC: tas2770: Add missing bias level power states + +From: Dan Murphy + +[ Upstream commit 4272caf34aa4699eca8e6e7f4a8e5ea2bde275c9 ] + +Add the BIAS_STANDBY and BIAS_PREPARE to the set_bias_level or else the +driver will return -EINVAL which is not correct as they are valid +states. + +Fixes: 1a476abc723e6 ("tas2770: add tas2770 smart PA kernel driver") +Signed-off-by: Dan Murphy +Link: https://lore.kernel.org/r/20200918190548.12598-2-dmurphy@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2770.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c +index 9f759c51ca435..4d67b1c160380 100644 +--- a/sound/soc/codecs/tas2770.c ++++ b/sound/soc/codecs/tas2770.c +@@ -57,7 +57,12 @@ static int tas2770_set_bias_level(struct snd_soc_component *component, + TAS2770_PWR_CTRL_MASK, + TAS2770_PWR_CTRL_ACTIVE); + break; +- ++ case SND_SOC_BIAS_STANDBY: ++ case SND_SOC_BIAS_PREPARE: ++ snd_soc_component_update_bits(component, ++ TAS2770_PWR_CTRL, ++ TAS2770_PWR_CTRL_MASK, TAS2770_PWR_CTRL_MUTE); ++ break; + case SND_SOC_BIAS_OFF: + snd_soc_component_update_bits(component, + TAS2770_PWR_CTRL, +-- +2.25.1 + diff --git a/queue-5.8/asoc-tas2770-fix-calling-reset-in-probe.patch b/queue-5.8/asoc-tas2770-fix-calling-reset-in-probe.patch new file mode 100644 index 00000000000..eda7b077f68 --- /dev/null +++ b/queue-5.8/asoc-tas2770-fix-calling-reset-in-probe.patch @@ -0,0 +1,48 @@ +From 5dc817607dcf2e87a7ed0d09001b9eda34e44a3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 14:05:40 -0500 +Subject: ASoC: tas2770: Fix calling reset in probe + +From: Dan Murphy + +[ Upstream commit b0bcbe615756d5923eec4e95996e4041627e5741 ] + +tas2770_reset is called during i2c probe. The reset calls the +snd_soc_component_write which depends on the tas2770->component being +available. The component pointer is not set until codec_probe so move +the reset to the codec_probe after the pointer is set. + +Fixes: 1a476abc723e6 ("tas2770: add tas2770 smart PA kernel driver") +Signed-off-by: Dan Murphy +Link: https://lore.kernel.org/r/20200918190548.12598-1-dmurphy@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2770.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c +index cf071121c8398..9f759c51ca435 100644 +--- a/sound/soc/codecs/tas2770.c ++++ b/sound/soc/codecs/tas2770.c +@@ -574,6 +574,8 @@ static int tas2770_codec_probe(struct snd_soc_component *component) + + tas2770->component = component; + ++ tas2770_reset(tas2770); ++ + return 0; + } + +@@ -770,8 +772,6 @@ static int tas2770_i2c_probe(struct i2c_client *client, + tas2770->channel_size = 0; + tas2770->slot_width = 0; + +- tas2770_reset(tas2770); +- + result = tas2770_register_codec(tas2770); + if (result) + dev_err(tas2770->dev, "Register codec failed.\n"); +-- +2.25.1 + diff --git a/queue-5.8/asoc-tas2770-fix-error-handling-with-update_bits.patch b/queue-5.8/asoc-tas2770-fix-error-handling-with-update_bits.patch new file mode 100644 index 00000000000..dd1db02a4b4 --- /dev/null +++ b/queue-5.8/asoc-tas2770-fix-error-handling-with-update_bits.patch @@ -0,0 +1,180 @@ +From bf43762f4dec228cd3f673a773b946d15c1ed403 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 14:05:46 -0500 +Subject: ASoC: tas2770: Fix error handling with update_bits + +From: Dan Murphy + +[ Upstream commit cadab0aefcbadf488b16caf2770430e69f4d7839 ] + +snd_soc_update_bits returns a 1 when the bit was successfully updated, +returns a 0 is no update was needed and a negative if the call failed. +The code is currently failing the case of a successful update by just +checking for a non-zero number. Modify these checks and return the error +code only if there is a negative. + +Fixes: 1a476abc723e6 ("tas2770: add tas2770 smart PA kernel driver") +Signed-off-by: Dan Murphy +Link: https://lore.kernel.org/r/20200918190548.12598-7-dmurphy@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2770.c | 52 ++++++++++++++++++-------------------- + 1 file changed, 24 insertions(+), 28 deletions(-) + +diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c +index f6c3c5aaab653..8d88ed5578ddd 100644 +--- a/sound/soc/codecs/tas2770.c ++++ b/sound/soc/codecs/tas2770.c +@@ -140,23 +140,18 @@ static int tas2770_dac_event(struct snd_soc_dapm_widget *w, + TAS2770_PWR_CTRL, + TAS2770_PWR_CTRL_MASK, + TAS2770_PWR_CTRL_MUTE); +- if (ret) +- goto end; + break; + case SND_SOC_DAPM_PRE_PMD: + ret = snd_soc_component_update_bits(component, + TAS2770_PWR_CTRL, + TAS2770_PWR_CTRL_MASK, + TAS2770_PWR_CTRL_SHUTDOWN); +- if (ret) +- goto end; + break; + default: + dev_err(tas2770->dev, "Not supported evevt\n"); + return -EINVAL; + } + +-end: + if (ret < 0) + return ret; + +@@ -248,6 +243,9 @@ static int tas2770_set_bitwidth(struct tas2770_priv *tas2770, int bitwidth) + return -EINVAL; + } + ++ if (ret < 0) ++ return ret; ++ + tas2770->channel_size = bitwidth; + + ret = snd_soc_component_update_bits(component, +@@ -256,16 +254,15 @@ static int tas2770_set_bitwidth(struct tas2770_priv *tas2770, int bitwidth) + TAS2770_TDM_CFG_REG5_50_MASK, + TAS2770_TDM_CFG_REG5_VSNS_ENABLE | + tas2770->v_sense_slot); +- if (ret) +- goto end; ++ if (ret < 0) ++ return ret; ++ + ret = snd_soc_component_update_bits(component, + TAS2770_TDM_CFG_REG6, + TAS2770_TDM_CFG_REG6_ISNS_MASK | + TAS2770_TDM_CFG_REG6_50_MASK, + TAS2770_TDM_CFG_REG6_ISNS_ENABLE | + tas2770->i_sense_slot); +- +-end: + if (ret < 0) + return ret; + +@@ -283,36 +280,35 @@ static int tas2770_set_samplerate(struct tas2770_priv *tas2770, int samplerate) + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_SMP_MASK, + TAS2770_TDM_CFG_REG0_SMP_48KHZ); +- if (ret) +- goto end; ++ if (ret < 0) ++ return ret; ++ + ret = snd_soc_component_update_bits(component, + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_31_MASK, + TAS2770_TDM_CFG_REG0_31_44_1_48KHZ); +- if (ret) +- goto end; + break; + case 44100: + ret = snd_soc_component_update_bits(component, + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_SMP_MASK, + TAS2770_TDM_CFG_REG0_SMP_44_1KHZ); +- if (ret) +- goto end; ++ if (ret < 0) ++ return ret; ++ + ret = snd_soc_component_update_bits(component, + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_31_MASK, + TAS2770_TDM_CFG_REG0_31_44_1_48KHZ); +- if (ret) +- goto end; + break; + case 96000: + ret = snd_soc_component_update_bits(component, + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_SMP_MASK, + TAS2770_TDM_CFG_REG0_SMP_48KHZ); +- if (ret) +- goto end; ++ if (ret < 0) ++ return ret; ++ + ret = snd_soc_component_update_bits(component, + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_31_MASK, +@@ -323,8 +319,9 @@ static int tas2770_set_samplerate(struct tas2770_priv *tas2770, int samplerate) + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_SMP_MASK, + TAS2770_TDM_CFG_REG0_SMP_44_1KHZ); +- if (ret) +- goto end; ++ if (ret < 0) ++ return ret; ++ + ret = snd_soc_component_update_bits(component, + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_31_MASK, +@@ -335,22 +332,22 @@ static int tas2770_set_samplerate(struct tas2770_priv *tas2770, int samplerate) + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_SMP_MASK, + TAS2770_TDM_CFG_REG0_SMP_48KHZ); +- if (ret) +- goto end; ++ if (ret < 0) ++ return ret; ++ + ret = snd_soc_component_update_bits(component, + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_31_MASK, + TAS2770_TDM_CFG_REG0_31_176_4_192KHZ); +- if (ret) +- goto end; + break; + case 17640: + ret = snd_soc_component_update_bits(component, + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_SMP_MASK, + TAS2770_TDM_CFG_REG0_SMP_44_1KHZ); +- if (ret) +- goto end; ++ if (ret < 0) ++ return ret; ++ + ret = snd_soc_component_update_bits(component, + TAS2770_TDM_CFG_REG0, + TAS2770_TDM_CFG_REG0_31_MASK, +@@ -360,7 +357,6 @@ static int tas2770_set_samplerate(struct tas2770_priv *tas2770, int samplerate) + ret = -EINVAL; + } + +-end: + if (ret < 0) + return ret; + +-- +2.25.1 + diff --git a/queue-5.8/asoc-tas2770-fix-required-dt-properties-in-the-code.patch b/queue-5.8/asoc-tas2770-fix-required-dt-properties-in-the-code.patch new file mode 100644 index 00000000000..41ee81f959b --- /dev/null +++ b/queue-5.8/asoc-tas2770-fix-required-dt-properties-in-the-code.patch @@ -0,0 +1,71 @@ +From 48fd741e3a8343ee6f17a066a7e6bec1b8e3a262 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 14:05:43 -0500 +Subject: ASoC: tas2770: Fix required DT properties in the code + +From: Dan Murphy + +[ Upstream commit 4b8ab8a7761fe2ba1c4e741703a848cb8f390f79 ] + +The devicetree binding indicates that the ti,asi-format, ti,imon-slot-no +and ti,vmon-slot-no are not required but the driver requires them or it +fails to probe. Honor the binding and allow these entries to be optional +and set the corresponding values to the default values for each as defined +in the data sheet. + +Fixes: 1a476abc723e6 ("tas2770: add tas2770 smart PA kernel driver") +Signed-off-by: Dan Murphy +Link: https://lore.kernel.org/r/20200918190548.12598-4-dmurphy@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2770.c | 21 ++++++++++----------- + 1 file changed, 10 insertions(+), 11 deletions(-) + +diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c +index 4d67b1c160380..f6c3c5aaab653 100644 +--- a/sound/soc/codecs/tas2770.c ++++ b/sound/soc/codecs/tas2770.c +@@ -707,29 +707,28 @@ static int tas2770_parse_dt(struct device *dev, struct tas2770_priv *tas2770) + rc = fwnode_property_read_u32(dev->fwnode, "ti,asi-format", + &tas2770->asi_format); + if (rc) { +- dev_err(tas2770->dev, "Looking up %s property failed %d\n", +- "ti,asi-format", rc); +- goto end; ++ dev_info(tas2770->dev, "Property %s is missing setting default slot\n", ++ "ti,asi-format"); ++ tas2770->asi_format = 0; + } + + rc = fwnode_property_read_u32(dev->fwnode, "ti,imon-slot-no", + &tas2770->i_sense_slot); + if (rc) { +- dev_err(tas2770->dev, "Looking up %s property failed %d\n", +- "ti,imon-slot-no", rc); +- goto end; ++ dev_info(tas2770->dev, "Property %s is missing setting default slot\n", ++ "ti,imon-slot-no"); ++ tas2770->i_sense_slot = 0; + } + + rc = fwnode_property_read_u32(dev->fwnode, "ti,vmon-slot-no", + &tas2770->v_sense_slot); + if (rc) { +- dev_err(tas2770->dev, "Looking up %s property failed %d\n", +- "ti,vmon-slot-no", rc); +- goto end; ++ dev_info(tas2770->dev, "Property %s is missing setting default slot\n", ++ "ti,vmon-slot-no"); ++ tas2770->v_sense_slot = 2; + } + +-end: +- return rc; ++ return 0; + } + + static int tas2770_i2c_probe(struct i2c_client *client, +-- +2.25.1 + diff --git a/queue-5.8/asoc-tas2770-fix-unbalanced-calls-to-pm_runtime.patch b/queue-5.8/asoc-tas2770-fix-unbalanced-calls-to-pm_runtime.patch new file mode 100644 index 00000000000..239bc22fbfb --- /dev/null +++ b/queue-5.8/asoc-tas2770-fix-unbalanced-calls-to-pm_runtime.patch @@ -0,0 +1,59 @@ +From c593bd1c76e72bf58c29f1f95f4d6c6abb51a2fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 14:05:44 -0500 +Subject: ASoC: tas2770: Fix unbalanced calls to pm_runtime + +From: Dan Murphy + +[ Upstream commit d3d71c99b541040da198f43da3bbd85d8e9598cb ] + +Fix the unbalanced call to the pm_runtime_disable when removing the +module. pm_runtime_enable is not called nor is the pm_runtime setup in +the code. Remove the i2c_remove function and the pm_runtime_disable. + +Fixes: 1a476abc723e6 ("tas2770: add tas2770 smart PA kernel driver") +Signed-off-by: Dan Murphy +Link: https://lore.kernel.org/r/20200918190548.12598-5-dmurphy@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tas2770.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/sound/soc/codecs/tas2770.c b/sound/soc/codecs/tas2770.c +index 8d88ed5578ddd..531bf32043813 100644 +--- a/sound/soc/codecs/tas2770.c ++++ b/sound/soc/codecs/tas2770.c +@@ -16,7 +16,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -780,13 +779,6 @@ static int tas2770_i2c_probe(struct i2c_client *client, + return result; + } + +-static int tas2770_i2c_remove(struct i2c_client *client) +-{ +- pm_runtime_disable(&client->dev); +- return 0; +-} +- +- + static const struct i2c_device_id tas2770_i2c_id[] = { + { "tas2770", 0}, + { } +@@ -807,7 +799,6 @@ static struct i2c_driver tas2770_i2c_driver = { + .of_match_table = of_match_ptr(tas2770_of_match), + }, + .probe = tas2770_i2c_probe, +- .remove = tas2770_i2c_remove, + .id_table = tas2770_i2c_id, + }; + +-- +2.25.1 + diff --git a/queue-5.8/asoc-tlv320adcx140-fix-digital-gain-range.patch b/queue-5.8/asoc-tlv320adcx140-fix-digital-gain-range.patch new file mode 100644 index 00000000000..ef6f7aff3c3 --- /dev/null +++ b/queue-5.8/asoc-tlv320adcx140-fix-digital-gain-range.patch @@ -0,0 +1,39 @@ +From 947dce0d046fa96d08ae205e8b3d16aa85c1bc6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 11:04:17 +0200 +Subject: ASoC: tlv320adcx140: Fix digital gain range + +From: Camel Guo + +[ Upstream commit 73154aca4a03a2ab4833fd36683feb884af06d4b ] + +According to its datasheet, the digital gain should be -100 dB when +CHx_DVOL is 1 and 27 dB when CHx_DVOL is 255. But with the current +dig_vol_tlv, "Digital CHx Out Volume" shows 27.5 dB if CHx_DVOL is 255 +and -95.5 dB if CHx_DVOL is 1. This commit fixes this bug. + +Fixes: 689c7655b50c ("ASoC: tlv320adcx140: Add the tlv320adcx140 codec driver family") +Signed-off-by: Camel Guo +Link: https://lore.kernel.org/r/20200908090417.16695-1-camel.guo@axis.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320adcx140.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c +index 03fb50175d876..a6273ccb84013 100644 +--- a/sound/soc/codecs/tlv320adcx140.c ++++ b/sound/soc/codecs/tlv320adcx140.c +@@ -154,7 +154,7 @@ static const struct regmap_config adcx140_i2c_regmap = { + }; + + /* Digital Volume control. From -100 to 27 dB in 0.5 dB steps */ +-static DECLARE_TLV_DB_SCALE(dig_vol_tlv, -10000, 50, 0); ++static DECLARE_TLV_DB_SCALE(dig_vol_tlv, -10050, 50, 0); + + /* ADC gain. From 0 to 42 dB in 1 dB steps */ + static DECLARE_TLV_DB_SCALE(adc_tlv, 0, 100, 0); +-- +2.25.1 + diff --git a/queue-5.8/asoc-tlv320aic32x4-fix-bdiv-clock-rate-derivation.patch b/queue-5.8/asoc-tlv320aic32x4-fix-bdiv-clock-rate-derivation.patch new file mode 100644 index 00000000000..fdc1e109916 --- /dev/null +++ b/queue-5.8/asoc-tlv320aic32x4-fix-bdiv-clock-rate-derivation.patch @@ -0,0 +1,60 @@ +From d4100b0a275fccb9478faa60fd86e2d8139fa0f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 19:31:39 +0200 +Subject: ASoC: tlv320aic32x4: Fix bdiv clock rate derivation + +From: Miquel Raynal + +[ Upstream commit 40b37136287ba6b34aa2f1f6123f3d6d205dc2f0 ] + +Current code expects a single channel to be always used. Fix this +situation by forwarding the number of channels used. Then fix the +derivation of the bdiv clock rate. + +Fixes: 96c3bb00239d ("ASoC: tlv320aic32x4: Dynamically Determine Clocking") +Suggested-by: Alexandre Belloni +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/r/20200911173140.29984-3-miquel.raynal@bootlin.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320aic32x4.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/codecs/tlv320aic32x4.c b/sound/soc/codecs/tlv320aic32x4.c +index d087f3b20b1d5..50b66cf9ea8f9 100644 +--- a/sound/soc/codecs/tlv320aic32x4.c ++++ b/sound/soc/codecs/tlv320aic32x4.c +@@ -665,7 +665,7 @@ static int aic32x4_set_processing_blocks(struct snd_soc_component *component, + } + + static int aic32x4_setup_clocks(struct snd_soc_component *component, +- unsigned int sample_rate) ++ unsigned int sample_rate, unsigned int channels) + { + u8 aosr; + u16 dosr; +@@ -753,7 +753,9 @@ static int aic32x4_setup_clocks(struct snd_soc_component *component, + dosr); + + clk_set_rate(clocks[5].clk, +- sample_rate * 32); ++ sample_rate * 32 * ++ channels); ++ + return 0; + } + } +@@ -775,7 +777,8 @@ static int aic32x4_hw_params(struct snd_pcm_substream *substream, + u8 iface1_reg = 0; + u8 dacsetup_reg = 0; + +- aic32x4_setup_clocks(component, params_rate(params)); ++ aic32x4_setup_clocks(component, params_rate(params), ++ params_channels(params)); + + switch (params_width(params)) { + case 16: +-- +2.25.1 + diff --git a/queue-5.8/asoc-topology-disable-size-checks-for-bytes_ext-cont.patch b/queue-5.8/asoc-topology-disable-size-checks-for-bytes_ext-cont.patch new file mode 100644 index 00000000000..5a202e128f7 --- /dev/null +++ b/queue-5.8/asoc-topology-disable-size-checks-for-bytes_ext-cont.patch @@ -0,0 +1,70 @@ +From f3416ea4277ea6e6f27d6cf03f4b583609cfcf93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 13:39:12 +0300 +Subject: ASoC: topology: disable size checks for bytes_ext controls if needed + +From: Pierre-Louis Bossart + +[ Upstream commit 6788fc1a66a0c1d1cec7a0f84f94b517eae8611c ] + +When CONFIG_SND_CTL_VALIDATION is set, accesses to extended bytes +control generate spurious error messages when the size exceeds 512 +bytes, such as + +[ 11.224223] sof_sdw sof_sdw: control 2:0:0:EQIIR5.0 eqiir_coef_5:0: +invalid count 1024 + +In addition the error check returns -EINVAL which has the nasty side +effect of preventing applications accessing controls from working, +e.g. + +root@plb:~# alsamixer +cannot load mixer controls: Invalid argument + +It's agreed that the control interface has been abused since 2014, but +forcing a check should not prevent existing solutions from working. + +This patch skips the checks conditionally if CONFIG_SND_CTL_VALIDATION +is set and the byte array provided by topology is > 512. This +preserves the checks for all other cases. + +Fixes: 1a3232d2f61d2 ('ASoC: topology: Add support for TLV bytes controls') +BugLink: https://github.com/thesofproject/linux/issues/2430 +Reported-by: Takashi Iwai +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Bard Liao +Reviewed-by: Jaska Uimonen +Signed-off-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20200917103912.2565907-1-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-topology.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index 6eaa00c210117..a5460155b3f64 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -592,6 +592,17 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr, + k->info = snd_soc_bytes_info_ext; + k->tlv.c = snd_soc_bytes_tlv_callback; + ++ /* ++ * When a topology-based implementation abuses the ++ * control interface and uses bytes_ext controls of ++ * more than 512 bytes, we need to disable the size ++ * checks, otherwise accesses to such controls will ++ * return an -EINVAL error and prevent the card from ++ * being configured. ++ */ ++ if (IS_ENABLED(CONFIG_SND_CTL_VALIDATION) && sbe->max > 512) ++ k->access |= SNDRV_CTL_ELEM_ACCESS_SKIP_CHECK; ++ + ext_ops = tplg->bytes_ext_ops; + num_ops = tplg->bytes_ext_ops_count; + for (i = 0; i < num_ops; i++) { +-- +2.25.1 + diff --git a/queue-5.8/asoc-wm_adsp-pass-full-name-to-snd_ctl_notify.patch b/queue-5.8/asoc-wm_adsp-pass-full-name-to-snd_ctl_notify.patch new file mode 100644 index 00000000000..c952370cfbb --- /dev/null +++ b/queue-5.8/asoc-wm_adsp-pass-full-name-to-snd_ctl_notify.patch @@ -0,0 +1,70 @@ +From 7429c5cf5d9c5e989a3ed14905504b3ee671ef2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Oct 2020 16:24:25 +0100 +Subject: ASoC: wm_adsp: Pass full name to snd_ctl_notify + +From: Adam Brickman + +[ Upstream commit 20441614d89867142060d3bcd79cc111d8ba7a8e ] + +A call to wm_adsp_write_ctl() could cause a kernel crash if it +does not retrieve a valid kcontrol from snd_soc_card_get_kcontrol(). +This can happen due to a missing control name prefix. Then, +snd_ctl_notify() crashes when it tries to use the id field. + +Modified wm_adsp_write_ctl() to incorporate the name_prefix (if applicable) +such that it is able to retrieve a valid id field from the kcontrol +once the platform has booted. + +Fixes: eb65ccdb0836 ("ASoC: wm_adsp: Expose mixer control API") +Signed-off-by: Adam Brickman +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20201001152425.8590-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 20 +++++++++++++++++++- + 1 file changed, 19 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index 519ca2e696372..18f62fde92537 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -2043,6 +2043,7 @@ int wm_adsp_write_ctl(struct wm_adsp *dsp, const char *name, int type, + { + struct wm_coeff_ctl *ctl; + struct snd_kcontrol *kcontrol; ++ char ctl_name[SNDRV_CTL_ELEM_ID_NAME_MAXLEN]; + int ret; + + ctl = wm_adsp_get_ctl(dsp, name, type, alg); +@@ -2053,8 +2054,25 @@ int wm_adsp_write_ctl(struct wm_adsp *dsp, const char *name, int type, + return -EINVAL; + + ret = wm_coeff_write_ctrl(ctl, buf, len); ++ if (ret) ++ return ret; ++ ++ if (ctl->flags & WMFW_CTL_FLAG_SYS) ++ return 0; ++ ++ if (dsp->component->name_prefix) ++ snprintf(ctl_name, SNDRV_CTL_ELEM_ID_NAME_MAXLEN, "%s %s", ++ dsp->component->name_prefix, ctl->name); ++ else ++ snprintf(ctl_name, SNDRV_CTL_ELEM_ID_NAME_MAXLEN, "%s", ++ ctl->name); ++ ++ kcontrol = snd_soc_card_get_kcontrol(dsp->component->card, ctl_name); ++ if (!kcontrol) { ++ adsp_err(dsp, "Can't find kcontrol %s\n", ctl_name); ++ return -EINVAL; ++ } + +- kcontrol = snd_soc_card_get_kcontrol(dsp->component->card, ctl->name); + snd_ctl_notify(dsp->component->card->snd_card, + SNDRV_CTL_EVENT_MASK_VALUE, &kcontrol->id); + +-- +2.25.1 + diff --git a/queue-5.8/ath10k-check-idx-validity-in-__ath10k_htt_rx_ring_fi.patch b/queue-5.8/ath10k-check-idx-validity-in-__ath10k_htt_rx_ring_fi.patch new file mode 100644 index 00000000000..9b43d7721c7 --- /dev/null +++ b/queue-5.8/ath10k-check-idx-validity-in-__ath10k_htt_rx_ring_fi.patch @@ -0,0 +1,68 @@ +From 07b65053c6895ab873e6895df9240eac97d04c40 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jun 2020 18:11:05 -0400 +Subject: ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() + +From: Zekun Shen + +[ Upstream commit bad60b8d1a7194df38fd7fe4b22f3f4dcf775099 ] + +The idx in __ath10k_htt_rx_ring_fill_n function lives in +consistent dma region writable by the device. Malfunctional +or malicious device could manipulate such idx to have a OOB +write. Either by + htt->rx_ring.netbufs_ring[idx] = skb; +or by + ath10k_htt_set_paddrs_ring(htt, paddr, idx); + +The idx can also be negative as it's signed, giving a large +memory space to write to. + +It's possibly exploitable by corruptting a legit pointer with +a skb pointer. And then fill skb with payload as rougue object. + +Part of the log here. Sometimes it appears as UAF when writing +to a freed memory by chance. + + [ 15.594376] BUG: unable to handle page fault for address: ffff887f5c1804f0 + [ 15.595483] #PF: supervisor write access in kernel mode + [ 15.596250] #PF: error_code(0x0002) - not-present page + [ 15.597013] PGD 0 P4D 0 + [ 15.597395] Oops: 0002 [#1] SMP KASAN PTI + [ 15.597967] CPU: 0 PID: 82 Comm: kworker/u2:2 Not tainted 5.6.0 #69 + [ 15.598843] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), + BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014 + [ 15.600438] Workqueue: ath10k_wq ath10k_core_register_work [ath10k_core] + [ 15.601389] RIP: 0010:__ath10k_htt_rx_ring_fill_n + (linux/drivers/net/wireless/ath/ath10k/htt_rx.c:173) ath10k_core + +Signed-off-by: Zekun Shen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200623221105.3486-1-bruceshenzk@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/htt_rx.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c +index d787cbead56ab..215ade6faf328 100644 +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -142,6 +142,14 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num) + BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2); + + idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr); ++ ++ if (idx < 0 || idx >= htt->rx_ring.size) { ++ ath10k_err(htt->ar, "rx ring index is not valid, firmware malfunctioning?\n"); ++ idx &= htt->rx_ring.size_mask; ++ ret = -ENOMEM; ++ goto fail; ++ } ++ + while (num > 0) { + skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN); + if (!skb) { +-- +2.25.1 + diff --git a/queue-5.8/ath10k-fix-the-size-used-in-a-dma_free_coherent-call.patch b/queue-5.8/ath10k-fix-the-size-used-in-a-dma_free_coherent-call.patch new file mode 100644 index 00000000000..fec08a2670c --- /dev/null +++ b/queue-5.8/ath10k-fix-the-size-used-in-a-dma_free_coherent-call.patch @@ -0,0 +1,39 @@ +From ad9f62199b864f8ce4acd6c2b3cb5e04c8aa1c9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 14:22:27 +0200 +Subject: ath10k: Fix the size used in a 'dma_free_coherent()' call in an error + handling path + +From: Christophe JAILLET + +[ Upstream commit 454530a9950b5a26d4998908249564cedfc4babc ] + +Update the size used in 'dma_free_coherent()' in order to match the one +used in the corresponding 'dma_alloc_coherent()'. + +Fixes: 1863008369ae ("ath10k: fix shadow register implementation for WCN3990") +Signed-off-by: Christophe JAILLET +Reviewed-by: Rakesh Pillai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200802122227.678637-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/ce.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/ce.c b/drivers/net/wireless/ath/ath10k/ce.c +index 294fbc1e89ab8..e6e0284e47837 100644 +--- a/drivers/net/wireless/ath/ath10k/ce.c ++++ b/drivers/net/wireless/ath/ath10k/ce.c +@@ -1555,7 +1555,7 @@ ath10k_ce_alloc_src_ring(struct ath10k *ar, unsigned int ce_id, + ret = ath10k_ce_alloc_shadow_base(ar, src_ring, nentries); + if (ret) { + dma_free_coherent(ar->dev, +- (nentries * sizeof(struct ce_desc_64) + ++ (nentries * sizeof(struct ce_desc) + + CE_DESC_RING_ALIGN), + src_ring->base_addr_owner_space_unaligned, + base_addr); +-- +2.25.1 + diff --git a/queue-5.8/ath10k-provide-survey-info-as-accumulated-data.patch b/queue-5.8/ath10k-provide-survey-info-as-accumulated-data.patch new file mode 100644 index 00000000000..eb587a47c63 --- /dev/null +++ b/queue-5.8/ath10k-provide-survey-info-as-accumulated-data.patch @@ -0,0 +1,73 @@ +From 4fc1118eec63c6047212997cc632a95702b22313 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jun 2020 20:29:03 +0300 +Subject: ath10k: provide survey info as accumulated data + +From: Venkateswara Naralasetty + +[ Upstream commit 720e5c03e5cb26d33d97f55192b791bb48478aa5 ] + +It is expected that the returned counters by .get_survey are monotonic +increasing. But the data from ath10k gets reset to zero regularly. Channel +active/busy time are then showing incorrect values (less than previous or +sometimes zero) for the currently active channel during successive survey +dump commands. + +example: + + $ iw dev wlan0 survey dump + Survey data from wlan0 + frequency: 5180 MHz [in use] + channel active time: 54995 ms + channel busy time: 432 ms + channel receive time: 0 ms + channel transmit time: 59 ms + ... + + $ iw dev wlan0 survey dump + Survey data from wlan0 + frequency: 5180 MHz [in use] + channel active time: 32592 ms + channel busy time: 254 ms + channel receive time: 0 ms + channel transmit time: 0 ms + ... + +The correct way to handle this is to use the non-clearing +WMI_BSS_SURVEY_REQ_TYPE_READ wmi_bss_survey_req_type. The firmware will +then accumulate the survey data and handle wrap arounds. + +Tested-on: QCA9984 hw1.0 10.4-3.5.3-00057 +Tested-on: QCA988X hw2.0 10.2.4-1.0-00047 +Tested-on: QCA9888 hw2.0 10.4-3.9.0.2-00024 +Tested-on: QCA4019 hw1.0 10.4-3.6-00140 + +Fixes: fa7937e3d5c2 ("ath10k: update bss channel survey information") +Signed-off-by: Venkateswara Naralasetty +Tested-by: Markus Theil +Tested-by: John Deere <24601deerej@gmail.com> +[sven@narfation.org: adjust commit message] +Signed-off-by: Sven Eckelmann +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1592232686-28712-1-git-send-email-kvalo@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/mac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 919d15584d4a2..77daca67a8e14 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -7283,7 +7283,7 @@ ath10k_mac_update_bss_chan_survey(struct ath10k *ar, + struct ieee80211_channel *channel) + { + int ret; +- enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR; ++ enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ; + + lockdep_assert_held(&ar->conf_mutex); + +-- +2.25.1 + diff --git a/queue-5.8/ath11k-add-checked-value-for-ath11k_ahb_remove.patch b/queue-5.8/ath11k-add-checked-value-for-ath11k_ahb_remove.patch new file mode 100644 index 00000000000..0f8ac40b9c5 --- /dev/null +++ b/queue-5.8/ath11k-add-checked-value-for-ath11k_ahb_remove.patch @@ -0,0 +1,49 @@ +From 728c7d6c726c777a35863b2c2cc6afc67e7debee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 16:21:22 +0300 +Subject: ath11k: Add checked value for ath11k_ahb_remove + +From: Bo YU + +[ Upstream commit 80b892fc8a90e91498babf0f6817139e5ec64b5c ] + +Return value form wait_for_completion_timeout should to be checked. + +This is detected by Coverity: #CID:1464479 (CHECKED_RETURN) + +Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") +Signed-off-by: Bo YU +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200621095136.7xdbzkthoxuw2qow@debian.debian-2 +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/ahb.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c +index 30092841ac464..a0314c1c84653 100644 +--- a/drivers/net/wireless/ath/ath11k/ahb.c ++++ b/drivers/net/wireless/ath/ath11k/ahb.c +@@ -981,12 +981,16 @@ static int ath11k_ahb_probe(struct platform_device *pdev) + static int ath11k_ahb_remove(struct platform_device *pdev) + { + struct ath11k_base *ab = platform_get_drvdata(pdev); ++ unsigned long left; + + reinit_completion(&ab->driver_recovery); + +- if (test_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags)) +- wait_for_completion_timeout(&ab->driver_recovery, +- ATH11K_AHB_RECOVERY_TIMEOUT); ++ if (test_bit(ATH11K_FLAG_RECOVERY, &ab->dev_flags)) { ++ left = wait_for_completion_timeout(&ab->driver_recovery, ++ ATH11K_AHB_RECOVERY_TIMEOUT); ++ if (!left) ++ ath11k_warn(ab, "failed to receive recovery response completion\n"); ++ } + + set_bit(ATH11K_FLAG_UNREGISTERING, &ab->dev_flags); + cancel_work_sync(&ab->restart_work); +-- +2.25.1 + diff --git a/queue-5.8/ath11k-fix-a-double-free-and-a-memory-leak.patch b/queue-5.8/ath11k-fix-a-double-free-and-a-memory-leak.patch new file mode 100644 index 00000000000..f4b3731aa9d --- /dev/null +++ b/queue-5.8/ath11k-fix-a-double-free-and-a-memory-leak.patch @@ -0,0 +1,58 @@ +From 32a28eb2a0adcc34c9c27ab74a99a8e77b91cd14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Sep 2020 14:26:25 -0700 +Subject: ath11k: fix a double free and a memory leak + +From: Tom Rix + +[ Upstream commit 7e8453e35e406981d7c529ff8f804285bc894ba3 ] + +clang static analyzer reports this problem + +mac.c:6204:2: warning: Attempt to free released memory + kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +The channels pointer is allocated in ath11k_mac_setup_channels_rates() +When it fails midway, it cleans up the memory it has already allocated. +So the error handling needs to skip freeing the memory. + +There is a second problem. +ath11k_mac_setup_channels_rates(), allocates 3 channels. err_free +misses releasing ar->mac.sbands[NL80211_BAND_6GHZ].channels + +Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") +Signed-off-by: Tom Rix +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200906212625.17059-1-trix@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/mac.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c +index 2836a0f197ab0..fc5be7e8c043e 100644 +--- a/drivers/net/wireless/ath/ath11k/mac.c ++++ b/drivers/net/wireless/ath/ath11k/mac.c +@@ -5824,7 +5824,7 @@ static int __ath11k_mac_register(struct ath11k *ar) + ret = ath11k_mac_setup_channels_rates(ar, + cap->supported_bands); + if (ret) +- goto err_free; ++ goto err; + + ath11k_mac_setup_ht_vht_cap(ar, cap, &ht_cap); + ath11k_mac_setup_he_cap(ar, cap); +@@ -5938,7 +5938,9 @@ static int __ath11k_mac_register(struct ath11k *ar) + err_free: + kfree(ar->mac.sbands[NL80211_BAND_2GHZ].channels); + kfree(ar->mac.sbands[NL80211_BAND_5GHZ].channels); ++ kfree(ar->mac.sbands[NL80211_BAND_6GHZ].channels); + ++err: + SET_IEEE80211_DEV(ar->hw, NULL); + return ret; + } +-- +2.25.1 + diff --git a/queue-5.8/ath11k-fix-possible-memleak-in-ath11k_qmi_init_servi.patch b/queue-5.8/ath11k-fix-possible-memleak-in-ath11k_qmi_init_servi.patch new file mode 100644 index 00000000000..ed3c03fb271 --- /dev/null +++ b/queue-5.8/ath11k-fix-possible-memleak-in-ath11k_qmi_init_servi.patch @@ -0,0 +1,36 @@ +From 68836d3728c4a738cb158c66201fef49e000d822 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 17:36:44 +0800 +Subject: ath11k: Fix possible memleak in ath11k_qmi_init_service + +From: Wang Yufen + +[ Upstream commit 28f1632118818d9dccabf4c0fccfe49686742317 ] + +When qmi_add_lookup fail, we should destroy the workqueue + +Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices") +Reported-by: Hulk Robot +Signed-off-by: Wang Yufen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1595237804-66297-1-git-send-email-wangyufen@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath11k/qmi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/wireless/ath/ath11k/qmi.c b/drivers/net/wireless/ath/ath11k/qmi.c +index c00a99ad8dbc1..497cff7e64cc5 100644 +--- a/drivers/net/wireless/ath/ath11k/qmi.c ++++ b/drivers/net/wireless/ath/ath11k/qmi.c +@@ -2419,6 +2419,7 @@ int ath11k_qmi_init_service(struct ath11k_base *ab) + ATH11K_QMI_WLFW_SERVICE_INS_ID_V01); + if (ret < 0) { + ath11k_warn(ab, "failed to add qmi lookup\n"); ++ destroy_workqueue(ab->qmi.event_wq); + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.8/ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch b/queue-5.8/ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch new file mode 100644 index 00000000000..464ca741eab --- /dev/null +++ b/queue-5.8/ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch @@ -0,0 +1,39 @@ +From 7842c02f0be77581c3d48a2d1ff1f39e4ef22ebd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 17:13:15 +0300 +Subject: ath6kl: prevent potential array overflow in ath6kl_add_new_sta() + +From: Dan Carpenter + +[ Upstream commit 54f9ab7b870934b70e5a21786d951fbcf663970f ] + +The value for "aid" comes from skb->data so Smatch marks it as +untrusted. If it's invalid then it can result in an out of bounds array +access in ath6kl_add_new_sta(). + +Fixes: 572e27c00c9d ("ath6kl: Fix AP mode connect event parsing and TIM updates") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200813141315.GB457408@mwanda +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c +index 5e7ea838a9218..814131a0680a4 100644 +--- a/drivers/net/wireless/ath/ath6kl/main.c ++++ b/drivers/net/wireless/ath/ath6kl/main.c +@@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr, + + ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid); + ++ if (aid < 1 || aid > AP_MAX_NUM_STA) ++ return; ++ + if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) { + struct ieee80211_mgmt *mgmt = + (struct ieee80211_mgmt *) assoc_info; +-- +2.25.1 + diff --git a/queue-5.8/ath6kl-wmi-prevent-a-shift-wrapping-bug-in-ath6kl_wm.patch b/queue-5.8/ath6kl-wmi-prevent-a-shift-wrapping-bug-in-ath6kl_wm.patch new file mode 100644 index 00000000000..ee33ba32721 --- /dev/null +++ b/queue-5.8/ath6kl-wmi-prevent-a-shift-wrapping-bug-in-ath6kl_wm.patch @@ -0,0 +1,43 @@ +From 1c54c76a159a68949e165b3b4626a0505bc17852 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 17:27:32 +0300 +Subject: ath6kl: wmi: prevent a shift wrapping bug in + ath6kl_wmi_delete_pstream_cmd() + +From: Dan Carpenter + +[ Upstream commit 6a950755cec1a90ddaaff3e4acb5333617441c32 ] + +The "tsid" is a user controlled u8 which comes from debugfs. Values +more than 15 are invalid because "active_tsids" is a 16 bit variable. +If the value of "tsid" is more than 31 then that leads to a shift +wrapping bug. + +Fixes: 8fffd9e5ec9e ("ath6kl: Implement support for QOS-enable and QOS-disable from userspace") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200918142732.GA909725@mwanda +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath6kl/wmi.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c +index 6885d2ded53a8..3d5db84d64650 100644 +--- a/drivers/net/wireless/ath/ath6kl/wmi.c ++++ b/drivers/net/wireless/ath/ath6kl/wmi.c +@@ -2645,6 +2645,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class, + return -EINVAL; + } + ++ if (tsid >= 16) { ++ ath6kl_err("invalid tsid: %d\n", tsid); ++ return -EINVAL; ++ } ++ + skb = ath6kl_wmi_get_new_buf(sizeof(*cmd)); + if (!skb) + return -ENOMEM; +-- +2.25.1 + diff --git a/queue-5.8/ath9k-fix-potential-out-of-bounds-in-ath9k_htc_txcom.patch b/queue-5.8/ath9k-fix-potential-out-of-bounds-in-ath9k_htc_txcom.patch new file mode 100644 index 00000000000..b8e140e2889 --- /dev/null +++ b/queue-5.8/ath9k-fix-potential-out-of-bounds-in-ath9k_htc_txcom.patch @@ -0,0 +1,42 @@ +From 2261beac8776843a4229b6529f0290eca53397c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 17:12:53 +0300 +Subject: ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() + +From: Dan Carpenter + +[ Upstream commit 2705cd7558e718a7240c64eb0afb2edad5f8c190 ] + +The value of "htc_hdr->endpoint_id" comes from skb->data so Smatch marks +it as untrusted so we have to check it before using it as an array +offset. + +This is similar to a bug that syzkaller found in commit e4ff08a4d727 +("ath9k: Fix use-after-free Write in ath9k_htc_rx_msg") so it is +probably a real issue. + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Signed-off-by: Dan Carpenter +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200813141253.GA457408@mwanda +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_hst.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index d2e062eaf5614..510e61e97dbcb 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -339,6 +339,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle, + + if (skb) { + htc_hdr = (struct htc_frame_hdr *) skb->data; ++ if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint)) ++ goto ret; + endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id]; + skb_pull(skb, sizeof(struct htc_frame_hdr)); + +-- +2.25.1 + diff --git a/queue-5.8/ath9k-hif_usb-fix-race-condition-between-usb_get_urb.patch b/queue-5.8/ath9k-hif_usb-fix-race-condition-between-usb_get_urb.patch new file mode 100644 index 00000000000..ce8eb731028 --- /dev/null +++ b/queue-5.8/ath9k-hif_usb-fix-race-condition-between-usb_get_urb.patch @@ -0,0 +1,92 @@ +From 5d666a1400db78d496c2f5eb1faf33c8b4f53d63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 03:14:27 -0400 +Subject: ath9k: hif_usb: fix race condition between usb_get_urb() and + usb_kill_anchored_urbs() + +From: Brooke Basile + +[ Upstream commit 03fb92a432ea5abe5909bca1455b7e44a9380480 ] + +Calls to usb_kill_anchored_urbs() after usb_kill_urb() on multiprocessor +systems create a race condition in which usb_kill_anchored_urbs() deallocates +the URB before the completer callback is called in usb_kill_urb(), resulting +in a use-after-free. +To fix this, add proper lock protection to usb_kill_urb() calls that can +possibly run concurrently with usb_kill_anchored_urbs(). + +Reported-by: syzbot+89bd486af9427a9fc605@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=cabffad18eb74197f84871802fd2c5117b61febf +Signed-off-by: Brooke Basile +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200911071427.32354-1-brookebasile@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/hif_usb.c | 19 +++++++++++++++++++ + 1 file changed, 19 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c +index 3f563e02d17da..2ed98aaed6fb5 100644 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c +@@ -449,10 +449,19 @@ static void hif_usb_stop(void *hif_handle) + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); + + /* The pending URBs have to be canceled. */ ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); + list_for_each_entry_safe(tx_buf, tx_buf_tmp, + &hif_dev->tx.tx_pending, list) { ++ usb_get_urb(tx_buf->urb); ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); + usb_kill_urb(tx_buf->urb); ++ list_del(&tx_buf->list); ++ usb_free_urb(tx_buf->urb); ++ kfree(tx_buf->buf); ++ kfree(tx_buf); ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); + } ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); + + usb_kill_anchored_urbs(&hif_dev->mgmt_submitted); + } +@@ -762,27 +771,37 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev) + struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL; + unsigned long flags; + ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); + list_for_each_entry_safe(tx_buf, tx_buf_tmp, + &hif_dev->tx.tx_buf, list) { ++ usb_get_urb(tx_buf->urb); ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); + usb_kill_urb(tx_buf->urb); + list_del(&tx_buf->list); + usb_free_urb(tx_buf->urb); + kfree(tx_buf->buf); + kfree(tx_buf); ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); + } ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); + + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); + hif_dev->tx.flags |= HIF_USB_TX_FLUSH; + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); + ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); + list_for_each_entry_safe(tx_buf, tx_buf_tmp, + &hif_dev->tx.tx_pending, list) { ++ usb_get_urb(tx_buf->urb); ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); + usb_kill_urb(tx_buf->urb); + list_del(&tx_buf->list); + usb_free_urb(tx_buf->urb); + kfree(tx_buf->buf); + kfree(tx_buf); ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags); + } ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags); + + usb_kill_anchored_urbs(&hif_dev->mgmt_submitted); + } +-- +2.25.1 + diff --git a/queue-5.8/backlight-sky81452-backlight-fix-refcount-imbalance-.patch b/queue-5.8/backlight-sky81452-backlight-fix-refcount-imbalance-.patch new file mode 100644 index 00000000000..5d53d6eff37 --- /dev/null +++ b/queue-5.8/backlight-sky81452-backlight-fix-refcount-imbalance-.patch @@ -0,0 +1,37 @@ +From 4a1b91bf70ec3f72fec0ca865271190d1408ae4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 14:38:17 +0800 +Subject: backlight: sky81452-backlight: Fix refcount imbalance on error + +From: dinghao.liu@zju.edu.cn + +[ Upstream commit b7a4f80bc316a56d6ec8750e93e66f42431ed960 ] + +When of_property_read_u32_array() returns an error code, a +pairing refcount decrement is needed to keep np's refcount +balanced. + +Fixes: f705806c9f355 ("backlight: Add support Skyworks SKY81452 backlight driver") +Signed-off-by: Dinghao Liu +Reviewed-by: Daniel Thompson +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/sky81452-backlight.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/video/backlight/sky81452-backlight.c b/drivers/video/backlight/sky81452-backlight.c +index 2355f00f57732..1f6301375fd33 100644 +--- a/drivers/video/backlight/sky81452-backlight.c ++++ b/drivers/video/backlight/sky81452-backlight.c +@@ -196,6 +196,7 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt( + num_entry); + if (ret < 0) { + dev_err(dev, "led-sources node is invalid.\n"); ++ of_node_put(np); + return ERR_PTR(-EINVAL); + } + +-- +2.25.1 + diff --git a/queue-5.8/binder-remove-bogus-warning-on-failed-same-process-t.patch b/queue-5.8/binder-remove-bogus-warning-on-failed-same-process-t.patch new file mode 100644 index 00000000000..e179f46789a --- /dev/null +++ b/queue-5.8/binder-remove-bogus-warning-on-failed-same-process-t.patch @@ -0,0 +1,47 @@ +From c0e7050aece5df155c20a74a38bf0d6d7f914e87 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 18:53:59 +0200 +Subject: binder: Remove bogus warning on failed same-process transaction + +From: Jann Horn + +[ Upstream commit e8b8ae7ce32e17a5c29f0289e9e2a39c7dcaa1b8 ] + +While binder transactions with the same binder_proc as sender and recipient +are forbidden, transactions with the same task_struct as sender and +recipient are possible (even though currently there is a weird check in +binder_transaction() that rejects them in the target==0 case). +Therefore, task_struct identities can't be used to distinguish whether +the caller is running in the context of the sender or the recipient. + +Since I see no easy way to make this WARN_ON() useful and correct, let's +just remove it. + +Fixes: 44d8047f1d87 ("binder: use standard functions to allocate fds") +Reported-by: syzbot+e113a0b970b7b3f394ba@syzkaller.appspotmail.com +Acked-by: Christian Brauner +Acked-by: Todd Kjos +Signed-off-by: Jann Horn +Link: https://lore.kernel.org/r/20200806165359.2381483-1-jannh@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/android/binder.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index af85d37aef680..adab46ca5dff7 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -2324,8 +2324,6 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, + * file is done when the transaction is torn + * down. + */ +- WARN_ON(failed_at && +- proc->tsk == current->group_leader); + } break; + case BINDER_TYPE_PTR: + /* +-- +2.25.1 + diff --git a/queue-5.8/blk-mq-move-cancel-of-hctx-run_work-to-the-front-of-.patch b/queue-5.8/blk-mq-move-cancel-of-hctx-run_work-to-the-front-of-.patch new file mode 100644 index 00000000000..47c93b4c97e --- /dev/null +++ b/queue-5.8/blk-mq-move-cancel-of-hctx-run_work-to-the-front-of-.patch @@ -0,0 +1,61 @@ +From db14f10b30713c92bb3671bfcadff8fe290024e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 01:00:14 -0700 +Subject: blk-mq: move cancel of hctx->run_work to the front of blk_exit_queue + +From: Yang Yang + +[ Upstream commit 47ce030b7ac5a5259a9a5919f230b52497afc31a ] + +blk_exit_queue will free elevator_data, while blk_mq_run_work_fn +will access it. Move cancel of hctx->run_work to the front of +blk_exit_queue to avoid use-after-free. + +Fixes: 1b97871b501f ("blk-mq: move cancel of hctx->run_work into blk_mq_hw_sysfs_release") +Signed-off-by: Yang Yang +Reviewed-by: Ming Lei +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq-sysfs.c | 2 -- + block/blk-sysfs.c | 9 ++++++++- + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c +index 062229395a507..7b52e7657b2d1 100644 +--- a/block/blk-mq-sysfs.c ++++ b/block/blk-mq-sysfs.c +@@ -36,8 +36,6 @@ static void blk_mq_hw_sysfs_release(struct kobject *kobj) + struct blk_mq_hw_ctx *hctx = container_of(kobj, struct blk_mq_hw_ctx, + kobj); + +- cancel_delayed_work_sync(&hctx->run_work); +- + if (hctx->flags & BLK_MQ_F_BLOCKING) + cleanup_srcu_struct(hctx->srcu); + blk_free_flush_queue(hctx->fq); +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 02643e149d5e1..95fea6c18baf7 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -896,9 +896,16 @@ static void __blk_release_queue(struct work_struct *work) + + blk_free_queue_stats(q->stats); + +- if (queue_is_mq(q)) ++ if (queue_is_mq(q)) { ++ struct blk_mq_hw_ctx *hctx; ++ int i; ++ + cancel_delayed_work_sync(&q->requeue_work); + ++ queue_for_each_hw_ctx(q, hctx, i) ++ cancel_delayed_work_sync(&hctx->run_work); ++ } ++ + blk_exit_queue(q); + + blk_queue_free_zone_bitmaps(q); +-- +2.25.1 + diff --git a/queue-5.8/block-ratelimit-handle_bad_sector-message.patch b/queue-5.8/block-ratelimit-handle_bad_sector-message.patch new file mode 100644 index 00000000000..a97726a0ec7 --- /dev/null +++ b/queue-5.8/block-ratelimit-handle_bad_sector-message.patch @@ -0,0 +1,47 @@ +From 6f9169fd179b4ce6b4e1f8535674ca26a1e0842b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 22:37:23 +0900 +Subject: block: ratelimit handle_bad_sector() message + +From: Tetsuo Handa + +[ Upstream commit f4ac712e4fe009635344b9af5d890fe25fcc8c0d ] + +syzbot is reporting unkillable task [1], for the caller is failing to +handle a corrupted filesystem image which attempts to access beyond +the end of the device. While we need to fix the caller, flooding the +console with handle_bad_sector() message is unlikely useful. + +[1] https://syzkaller.appspot.com/bug?id=f1f49fb971d7a3e01bd8ab8cff2ff4572ccf3092 + +Signed-off-by: Tetsuo Handa +Reviewed-by: Christoph Hellwig +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-core.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/block/blk-core.c b/block/blk-core.c +index 619a3dcd3f5e7..8d6435b731186 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -798,11 +798,10 @@ static void handle_bad_sector(struct bio *bio, sector_t maxsector) + { + char b[BDEVNAME_SIZE]; + +- printk(KERN_INFO "attempt to access beyond end of device\n"); +- printk(KERN_INFO "%s: rw=%d, want=%Lu, limit=%Lu\n", +- bio_devname(bio, b), bio->bi_opf, +- (unsigned long long)bio_end_sector(bio), +- (long long)maxsector); ++ pr_info_ratelimited("attempt to access beyond end of device\n" ++ "%s: rw=%d, want=%llu, limit=%llu\n", ++ bio_devname(bio, b), bio->bi_opf, ++ bio_end_sector(bio), maxsector); + } + + #ifdef CONFIG_FAIL_MAKE_REQUEST +-- +2.25.1 + diff --git a/queue-5.8/bluetooth-btusb-fix-memleak-in-btusb_mtk_submit_wmt_.patch b/queue-5.8/bluetooth-btusb-fix-memleak-in-btusb_mtk_submit_wmt_.patch new file mode 100644 index 00000000000..447e831e66e --- /dev/null +++ b/queue-5.8/bluetooth-btusb-fix-memleak-in-btusb_mtk_submit_wmt_.patch @@ -0,0 +1,34 @@ +From 6fa209aa4bc942a0ee5f81154c2bee3d63bb0a4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Aug 2020 15:44:21 +0800 +Subject: Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb + +From: Dinghao Liu + +[ Upstream commit d33fe77bdf75806d785dabf90d21d962122e5296 ] + +When kmalloc() on buf fails, urb should be freed just like +when kmalloc() on dr fails. + +Signed-off-by: Dinghao Liu +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index a5fef9aa419fd..91a0c84d55c97 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -2849,6 +2849,7 @@ static int btusb_mtk_submit_wmt_recv_urb(struct hci_dev *hdev) + buf = kmalloc(size, GFP_KERNEL); + if (!buf) { + kfree(dr); ++ usb_free_urb(urb); + return -ENOMEM; + } + +-- +2.25.1 + diff --git a/queue-5.8/bluetooth-clear-suspend-tasks-on-unregister.patch b/queue-5.8/bluetooth-clear-suspend-tasks-on-unregister.patch new file mode 100644 index 00000000000..ab7df60b3b9 --- /dev/null +++ b/queue-5.8/bluetooth-clear-suspend-tasks-on-unregister.patch @@ -0,0 +1,53 @@ +From 6ab146336219a3e251efe531b4fe890456caaeb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Aug 2020 09:51:27 -0700 +Subject: Bluetooth: Clear suspend tasks on unregister + +From: Abhishek Pandit-Subedi + +[ Upstream commit 0e9952804ec9c8ba60f131225eab80634339f042 ] + +While unregistering, make sure to clear the suspend tasks before +cancelling the work. If the unregister is called during resume from +suspend, this will unnecessarily add 2s to the resume time otherwise. + +Fixes: 4e8c36c3b0d73d (Bluetooth: Fix suspend notifier race) +Signed-off-by: Abhishek Pandit-Subedi +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index fc28dc201b936..0f4e5a31f983c 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3280,6 +3280,16 @@ void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr, + } + } + ++static void hci_suspend_clear_tasks(struct hci_dev *hdev) ++{ ++ int i; ++ ++ for (i = 0; i < __SUSPEND_NUM_TASKS; i++) ++ clear_bit(i, hdev->suspend_tasks); ++ ++ wake_up(&hdev->suspend_wait_q); ++} ++ + static int hci_suspend_wait_event(struct hci_dev *hdev) + { + #define WAKE_COND \ +@@ -3609,6 +3619,7 @@ void hci_unregister_dev(struct hci_dev *hdev) + cancel_work_sync(&hdev->power_on); + + unregister_pm_notifier(&hdev->suspend_notifier); ++ hci_suspend_clear_tasks(hdev); + cancel_work_sync(&hdev->suspend_prepare); + + hci_dev_do_close(hdev); +-- +2.25.1 + diff --git a/queue-5.8/bluetooth-hci_uart-cancel-init-work-before-unregiste.patch b/queue-5.8/bluetooth-hci_uart-cancel-init-work-before-unregiste.patch new file mode 100644 index 00000000000..b948e7b8842 --- /dev/null +++ b/queue-5.8/bluetooth-hci_uart-cancel-init-work-before-unregiste.patch @@ -0,0 +1,51 @@ +From a0409c6afda59d0e0cd9b0962422e7751f159702 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Aug 2020 11:29:56 -0500 +Subject: Bluetooth: hci_uart: Cancel init work before unregistering + +From: Samuel Holland + +[ Upstream commit 3b799254cf6f481460719023d7a18f46651e5e7f ] + +If hci_uart_tty_close() or hci_uart_unregister_device() is called while +hu->init_ready is scheduled, hci_register_dev() could be called after +the hci_uart is torn down. Avoid this by ensuring the work is complete +or canceled before checking the HCI_UART_REGISTERED flag. + +Fixes: 9f2aee848fe6 ("Bluetooth: Add delayed init sequence support for UART controllers") +Signed-off-by: Samuel Holland +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_ldisc.c | 1 + + drivers/bluetooth/hci_serdev.c | 2 ++ + 2 files changed, 3 insertions(+) + +diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c +index 85a30fb9177bb..f83d67eafc9f0 100644 +--- a/drivers/bluetooth/hci_ldisc.c ++++ b/drivers/bluetooth/hci_ldisc.c +@@ -538,6 +538,7 @@ static void hci_uart_tty_close(struct tty_struct *tty) + clear_bit(HCI_UART_PROTO_READY, &hu->flags); + percpu_up_write(&hu->proto_lock); + ++ cancel_work_sync(&hu->init_ready); + cancel_work_sync(&hu->write_work); + + if (hdev) { +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index 7b233312e723f..3977bba485c22 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -355,6 +355,8 @@ void hci_uart_unregister_device(struct hci_uart *hu) + struct hci_dev *hdev = hu->hdev; + + clear_bit(HCI_UART_PROTO_READY, &hu->flags); ++ ++ cancel_work_sync(&hu->init_ready); + if (test_bit(HCI_UART_REGISTERED, &hu->flags)) + hci_unregister_dev(hdev); + hci_free_dev(hdev); +-- +2.25.1 + diff --git a/queue-5.8/bluetooth-only-mark-socket-zapped-after-unlocking.patch b/queue-5.8/bluetooth-only-mark-socket-zapped-after-unlocking.patch new file mode 100644 index 00000000000..84af0a6d2a2 --- /dev/null +++ b/queue-5.8/bluetooth-only-mark-socket-zapped-after-unlocking.patch @@ -0,0 +1,73 @@ +From b4fb79b4ade7553f5d50992dc734e452bd64804f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 15:33:18 -0700 +Subject: Bluetooth: Only mark socket zapped after unlocking + +From: Abhishek Pandit-Subedi + +[ Upstream commit 20ae4089d0afeb24e9ceb026b996bfa55c983cc2 ] + +Since l2cap_sock_teardown_cb doesn't acquire the channel lock before +setting the socket as zapped, it could potentially race with +l2cap_sock_release which frees the socket. Thus, wait until the cleanup +is complete before marking the socket as zapped. + +This race was reproduced on a JBL GO speaker after the remote device +rejected L2CAP connection due to resource unavailability. + +Here is a dmesg log with debug logs from a repro of this bug: +[ 3465.424086] Bluetooth: hci_core.c:hci_acldata_packet() hci0 len 16 handle 0x0003 flags 0x0002 +[ 3465.424090] Bluetooth: hci_conn.c:hci_conn_enter_active_mode() hcon 00000000cfedd07d mode 0 +[ 3465.424094] Bluetooth: l2cap_core.c:l2cap_recv_acldata() conn 000000007eae8952 len 16 flags 0x2 +[ 3465.424098] Bluetooth: l2cap_core.c:l2cap_recv_frame() len 12, cid 0x0001 +[ 3465.424102] Bluetooth: l2cap_core.c:l2cap_raw_recv() conn 000000007eae8952 +[ 3465.424175] Bluetooth: l2cap_core.c:l2cap_sig_channel() code 0x03 len 8 id 0x0c +[ 3465.424180] Bluetooth: l2cap_core.c:l2cap_connect_create_rsp() dcid 0x0045 scid 0x0000 result 0x02 status 0x00 +[ 3465.424189] Bluetooth: l2cap_core.c:l2cap_chan_put() chan 000000006acf9bff orig refcnt 4 +[ 3465.424196] Bluetooth: l2cap_core.c:l2cap_chan_del() chan 000000006acf9bff, conn 000000007eae8952, err 111, state BT_CONNECT +[ 3465.424203] Bluetooth: l2cap_sock.c:l2cap_sock_teardown_cb() chan 000000006acf9bff state BT_CONNECT +[ 3465.424221] Bluetooth: l2cap_core.c:l2cap_chan_put() chan 000000006acf9bff orig refcnt 3 +[ 3465.424226] Bluetooth: hci_core.h:hci_conn_drop() hcon 00000000cfedd07d orig refcnt 6 +[ 3465.424234] BUG: spinlock bad magic on CPU#2, kworker/u17:0/159 +[ 3465.425626] Bluetooth: hci_sock.c:hci_sock_sendmsg() sock 000000002bb0cb64 sk 00000000a7964053 +[ 3465.430330] lock: 0xffffff804410aac0, .magic: 00000000, .owner: /-1, .owner_cpu: 0 +[ 3465.430332] Causing a watchdog bite! + +Signed-off-by: Abhishek Pandit-Subedi +Reported-by: Balakrishna Godavarthi +Reviewed-by: Manish Mandlik +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/l2cap_sock.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c +index c7fc28a465fdb..fa66e27b73635 100644 +--- a/net/bluetooth/l2cap_sock.c ++++ b/net/bluetooth/l2cap_sock.c +@@ -1521,8 +1521,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) + + parent = bt_sk(sk)->parent; + +- sock_set_flag(sk, SOCK_ZAPPED); +- + switch (chan->state) { + case BT_OPEN: + case BT_BOUND: +@@ -1549,8 +1547,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err) + + break; + } +- + release_sock(sk); ++ ++ /* Only zap after cleanup to avoid use after free race */ ++ sock_set_flag(sk, SOCK_ZAPPED); ++ + } + + static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state, +-- +2.25.1 + diff --git a/queue-5.8/bluetooth-re-order-clearing-suspend-tasks.patch b/queue-5.8/bluetooth-re-order-clearing-suspend-tasks.patch new file mode 100644 index 00000000000..4029d3c29f7 --- /dev/null +++ b/queue-5.8/bluetooth-re-order-clearing-suspend-tasks.patch @@ -0,0 +1,38 @@ +From fc78cefcb4a6ddffd17047325ad00c82d46ba33c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 16:53:59 -0700 +Subject: Bluetooth: Re-order clearing suspend tasks + +From: Abhishek Pandit-Subedi + +[ Upstream commit 3eec158d5eca7dd455118d9e00568aad2371219f ] + +Unregister_pm_notifier is a blocking call so suspend tasks should be +cleared beforehand. Otherwise, the notifier will wait for completion +before returning (and we encounter a 2s timeout on resume). + +Fixes: 0e9952804ec9c8 (Bluetooth: Clear suspend tasks on unregister) +Signed-off-by: Abhishek Pandit-Subedi +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c +index 0f4e5a31f983c..131d29e902a30 100644 +--- a/net/bluetooth/hci_core.c ++++ b/net/bluetooth/hci_core.c +@@ -3618,8 +3618,8 @@ void hci_unregister_dev(struct hci_dev *hdev) + + cancel_work_sync(&hdev->power_on); + +- unregister_pm_notifier(&hdev->suspend_notifier); + hci_suspend_clear_tasks(hdev); ++ unregister_pm_notifier(&hdev->suspend_notifier); + cancel_work_sync(&hdev->suspend_prepare); + + hci_dev_do_close(hdev); +-- +2.25.1 + diff --git a/queue-5.8/bpf-disallow-attaching-modify_return-tracing-functio.patch b/queue-5.8/bpf-disallow-attaching-modify_return-tracing-functio.patch new file mode 100644 index 00000000000..0b714ed8a47 --- /dev/null +++ b/queue-5.8/bpf-disallow-attaching-modify_return-tracing-functio.patch @@ -0,0 +1,52 @@ +From c1fe1cb5873ca1c260cccb05be97014a3bb35352 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 23:25:00 +0200 +Subject: bpf: disallow attaching modify_return tracing functions to other BPF + programs +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit 1af9270e908cd50a4f5d815c9b6f794c7d57ed07 ] + +From the checks and commit messages for modify_return, it seems it was +never the intention that it should be possible to attach a tracing program +with expected_attach_type == BPF_MODIFY_RETURN to another BPF program. +However, check_attach_modify_return() will only look at the function name, +so if the target function starts with "security_", the attach will be +allowed even for bpf2bpf attachment. + +Fix this oversight by also blocking the modification if a target program is +supplied. + +Fixes: 18644cec714a ("bpf: Fix use-after-free in fmod_ret check") +Fixes: 6ba43b761c41 ("bpf: Attachment verification for BPF_MODIFY_RETURN") +Acked-by: Andrii Nakryiko +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 89b07db146763..c953dfbbaa6a9 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -10862,6 +10862,11 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) + } + + if (prog->expected_attach_type == BPF_MODIFY_RETURN) { ++ if (tgt_prog) { ++ verbose(env, "can't modify return codes of BPF programs\n"); ++ ret = -EINVAL; ++ goto out; ++ } + ret = check_attach_modify_return(prog, addr); + if (ret) + verbose(env, "%s() is not modifiable\n", +-- +2.25.1 + diff --git a/queue-5.8/bpf-limit-caller-s-stack-depth-256-for-subprogs-with.patch b/queue-5.8/bpf-limit-caller-s-stack-depth-256-for-subprogs-with.patch new file mode 100644 index 00000000000..a93063882c8 --- /dev/null +++ b/queue-5.8/bpf-limit-caller-s-stack-depth-256-for-subprogs-with.patch @@ -0,0 +1,85 @@ +From 7ea85ff6ce41fcbd8be7b598091193402f48169c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 23:10:07 +0200 +Subject: bpf: Limit caller's stack depth 256 for subprogs with tailcalls + +From: Maciej Fijalkowski + +[ Upstream commit 7f6e4312e15a5c370e84eaa685879b6bdcc717e4 ] + +Protect against potential stack overflow that might happen when bpf2bpf +calls get combined with tailcalls. Limit the caller's stack depth for +such case down to 256 so that the worst case scenario would result in 8k +stack size (32 which is tailcall limit * 256 = 8k). + +Suggested-by: Alexei Starovoitov +Signed-off-by: Maciej Fijalkowski +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + include/linux/bpf_verifier.h | 1 + + kernel/bpf/verifier.c | 29 +++++++++++++++++++++++++++++ + 2 files changed, 30 insertions(+) + +diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h +index ca08db4ffb5f7..ce3f5231aa698 100644 +--- a/include/linux/bpf_verifier.h ++++ b/include/linux/bpf_verifier.h +@@ -358,6 +358,7 @@ struct bpf_subprog_info { + u32 start; /* insn idx of function entry point */ + u32 linfo_idx; /* The idx to the main_prog->aux->linfo */ + u16 stack_depth; /* max. stack depth used by this function */ ++ bool has_tail_call; + }; + + /* single container for all structs +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index c953dfbbaa6a9..12eb9e47d101c 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -1470,6 +1470,10 @@ static int check_subprogs(struct bpf_verifier_env *env) + for (i = 0; i < insn_cnt; i++) { + u8 code = insn[i].code; + ++ if (code == (BPF_JMP | BPF_CALL) && ++ insn[i].imm == BPF_FUNC_tail_call && ++ insn[i].src_reg != BPF_PSEUDO_CALL) ++ subprog[cur_subprog].has_tail_call = true; + if (BPF_CLASS(code) != BPF_JMP && BPF_CLASS(code) != BPF_JMP32) + goto next; + if (BPF_OP(code) == BPF_EXIT || BPF_OP(code) == BPF_CALL) +@@ -2951,6 +2955,31 @@ static int check_max_stack_depth(struct bpf_verifier_env *env) + int ret_prog[MAX_CALL_FRAMES]; + + process_func: ++ /* protect against potential stack overflow that might happen when ++ * bpf2bpf calls get combined with tailcalls. Limit the caller's stack ++ * depth for such case down to 256 so that the worst case scenario ++ * would result in 8k stack size (32 which is tailcall limit * 256 = ++ * 8k). ++ * ++ * To get the idea what might happen, see an example: ++ * func1 -> sub rsp, 128 ++ * subfunc1 -> sub rsp, 256 ++ * tailcall1 -> add rsp, 256 ++ * func2 -> sub rsp, 192 (total stack size = 128 + 192 = 320) ++ * subfunc2 -> sub rsp, 64 ++ * subfunc22 -> sub rsp, 128 ++ * tailcall2 -> add rsp, 128 ++ * func3 -> sub rsp, 32 (total stack size 128 + 192 + 64 + 32 = 416) ++ * ++ * tailcall will unwind the current stack frame but it will not get rid ++ * of caller's stack as shown on the example above. ++ */ ++ if (idx && subprog[idx].has_tail_call && depth >= 256) { ++ verbose(env, ++ "tail_calls are not allowed when call stack of previous frames is %d bytes. Too large\n", ++ depth); ++ return -EACCES; ++ } + /* round up to 32-bytes, since this is granularity + * of interpreter stack size + */ +-- +2.25.1 + diff --git a/queue-5.8/bpf-sockmap-remove-skb_orphan-and-let-normal-skb_kfr.patch b/queue-5.8/bpf-sockmap-remove-skb_orphan-and-let-normal-skb_kfr.patch new file mode 100644 index 00000000000..6ddc708f1df --- /dev/null +++ b/queue-5.8/bpf-sockmap-remove-skb_orphan-and-let-normal-skb_kfr.patch @@ -0,0 +1,66 @@ +From eb299b7eccea3503395e699dc9de284f3cbf5941 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 11:37:35 -0700 +Subject: bpf, sockmap: Remove skb_orphan and let normal skb_kfree do cleanup + +From: John Fastabend + +[ Upstream commit 10d58d006356a075a7b056e0f6502db416d1a261 ] + +Calling skb_orphan() is unnecessary in the strp rcv handler because the skb +is from a skb_clone() in __strp_recv. So it never has a destructor or a +sk assigned. Plus its confusing to read because it might hint to the reader +that the skb could have an sk assigned which is not true. Even if we did +have an sk assigned it would be cleaner to simply wait for the upcoming +kfree_skb(). + +Additionally, move the comment about strparser clone up so its closer to +the logic it is describing and add to it so that it is more complete. + +Fixes: 604326b41a6fb ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: John Fastabend +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/160226865548.5692.9098315689984599579.stgit@john-Precision-5820-Tower +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index 6a32a1fd34f8c..053472c48354b 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -662,15 +662,16 @@ static int sk_psock_bpf_run(struct sk_psock *psock, struct bpf_prog *prog, + { + int ret; + ++ /* strparser clones the skb before handing it to a upper layer, ++ * meaning we have the same data, but sk is NULL. We do want an ++ * sk pointer though when we run the BPF program. So we set it ++ * here and then NULL it to ensure we don't trigger a BUG_ON() ++ * in skb/sk operations later if kfree_skb is called with a ++ * valid skb->sk pointer and no destructor assigned. ++ */ + skb->sk = psock->sk; + bpf_compute_data_end_sk_skb(skb); + ret = bpf_prog_run_pin_on_cpu(prog, skb); +- /* strparser clones the skb before handing it to a upper layer, +- * meaning skb_orphan has been called. We NULL sk on the way out +- * to ensure we don't trigger a BUG_ON() in skb/sk operations +- * later and because we are not charging the memory of this skb +- * to any socket yet. +- */ + skb->sk = NULL; + return ret; + } +@@ -795,7 +796,6 @@ static void sk_psock_strp_read(struct strparser *strp, struct sk_buff *skb) + } + prog = READ_ONCE(psock->progs.skb_verdict); + if (likely(prog)) { +- skb_orphan(skb); + tcp_skb_bpf_redirect_clear(skb); + ret = sk_psock_bpf_run(psock, prog, skb); + ret = sk_psock_map_verd(ret, tcp_skb_bpf_redirect_fetch(skb)); +-- +2.25.1 + diff --git a/queue-5.8/bpf-use-raw_spin_trylock-for-pcpu_freelist_push-pop-.patch b/queue-5.8/bpf-use-raw_spin_trylock-for-pcpu_freelist_push-pop-.patch new file mode 100644 index 00000000000..2efdc3427b6 --- /dev/null +++ b/queue-5.8/bpf-use-raw_spin_trylock-for-pcpu_freelist_push-pop-.patch @@ -0,0 +1,252 @@ +From 62238afd8acdf1cb7618260b4f736cffcb8322e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Oct 2020 09:58:38 -0700 +Subject: bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI + +From: Song Liu + +[ Upstream commit 39d8f0d1026a990604770a658708f5845f7dbec0 ] + +Recent improvements in LOCKDEP highlighted a potential A-A deadlock with +pcpu_freelist in NMI: + +./tools/testing/selftests/bpf/test_progs -t stacktrace_build_id_nmi + +[ 18.984807] ================================ +[ 18.984807] WARNING: inconsistent lock state +[ 18.984808] 5.9.0-rc6-01771-g1466de1330e1 #2967 Not tainted +[ 18.984809] -------------------------------- +[ 18.984809] inconsistent {INITIAL USE} -> {IN-NMI} usage. +[ 18.984810] test_progs/1990 [HC2[2]:SC0[0]:HE0:SE1] takes: +[ 18.984810] ffffe8ffffc219c0 (&head->lock){....}-{2:2}, at: __pcpu_freelist_pop+0xe3/0x180 +[ 18.984813] {INITIAL USE} state was registered at: +[ 18.984814] lock_acquire+0x175/0x7c0 +[ 18.984814] _raw_spin_lock+0x2c/0x40 +[ 18.984815] __pcpu_freelist_pop+0xe3/0x180 +[ 18.984815] pcpu_freelist_pop+0x31/0x40 +[ 18.984816] htab_map_alloc+0xbbf/0xf40 +[ 18.984816] __do_sys_bpf+0x5aa/0x3ed0 +[ 18.984817] do_syscall_64+0x2d/0x40 +[ 18.984818] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[ 18.984818] irq event stamp: 12 +[...] +[ 18.984822] other info that might help us debug this: +[ 18.984823] Possible unsafe locking scenario: +[ 18.984823] +[ 18.984824] CPU0 +[ 18.984824] ---- +[ 18.984824] lock(&head->lock); +[ 18.984826] +[ 18.984826] lock(&head->lock); +[ 18.984827] +[ 18.984828] *** DEADLOCK *** +[ 18.984828] +[ 18.984829] 2 locks held by test_progs/1990: +[...] +[ 18.984838] +[ 18.984838] dump_stack+0x9a/0xd0 +[ 18.984839] lock_acquire+0x5c9/0x7c0 +[ 18.984839] ? lock_release+0x6f0/0x6f0 +[ 18.984840] ? __pcpu_freelist_pop+0xe3/0x180 +[ 18.984840] _raw_spin_lock+0x2c/0x40 +[ 18.984841] ? __pcpu_freelist_pop+0xe3/0x180 +[ 18.984841] __pcpu_freelist_pop+0xe3/0x180 +[ 18.984842] pcpu_freelist_pop+0x17/0x40 +[ 18.984842] ? lock_release+0x6f0/0x6f0 +[ 18.984843] __bpf_get_stackid+0x534/0xaf0 +[ 18.984843] bpf_prog_1fd9e30e1438d3c5_oncpu+0x73/0x350 +[ 18.984844] bpf_overflow_handler+0x12f/0x3f0 + +This is because pcpu_freelist_head.lock is accessed in both NMI and +non-NMI context. Fix this issue by using raw_spin_trylock() in NMI. + +Since NMI interrupts non-NMI context, when NMI context tries to lock the +raw_spinlock, non-NMI context of the same CPU may already have locked a +lock and is blocked from unlocking the lock. For a system with N CPUs, +there could be N NMIs at the same time, and they may block N non-NMI +raw_spinlocks. This is tricky for pcpu_freelist_push(), where unlike +_pop(), failing _push() means leaking memory. This issue is more likely to +trigger in non-SMP system. + +Fix this issue with an extra list, pcpu_freelist.extralist. The extralist +is primarily used to take _push() when raw_spin_trylock() failed on all +the per CPU lists. It should be empty most of the time. The following +table summarizes the behavior of pcpu_freelist in NMI and non-NMI: + +non-NMI pop(): use _lock(); check per CPU lists first; + if all per CPU lists are empty, check extralist; + if extralist is empty, return NULL. + +non-NMI push(): use _lock(); only push to per CPU lists. + +NMI pop(): use _trylock(); check per CPU lists first; + if all per CPU lists are locked or empty, check extralist; + if extralist is locked or empty, return NULL. + +NMI push(): use _trylock(); check per CPU lists first; + if all per CPU lists are locked; try push to extralist; + if extralist is also locked, keep trying on per CPU lists. + +Reported-by: Alexei Starovoitov +Signed-off-by: Song Liu +Signed-off-by: Daniel Borkmann +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20201005165838.3735218-1-songliubraving@fb.com +Signed-off-by: Sasha Levin +--- + kernel/bpf/percpu_freelist.c | 101 +++++++++++++++++++++++++++++++++-- + kernel/bpf/percpu_freelist.h | 1 + + 2 files changed, 97 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/percpu_freelist.c b/kernel/bpf/percpu_freelist.c +index b367430e611c7..3d897de890612 100644 +--- a/kernel/bpf/percpu_freelist.c ++++ b/kernel/bpf/percpu_freelist.c +@@ -17,6 +17,8 @@ int pcpu_freelist_init(struct pcpu_freelist *s) + raw_spin_lock_init(&head->lock); + head->first = NULL; + } ++ raw_spin_lock_init(&s->extralist.lock); ++ s->extralist.first = NULL; + return 0; + } + +@@ -40,12 +42,50 @@ static inline void ___pcpu_freelist_push(struct pcpu_freelist_head *head, + raw_spin_unlock(&head->lock); + } + ++static inline bool pcpu_freelist_try_push_extra(struct pcpu_freelist *s, ++ struct pcpu_freelist_node *node) ++{ ++ if (!raw_spin_trylock(&s->extralist.lock)) ++ return false; ++ ++ pcpu_freelist_push_node(&s->extralist, node); ++ raw_spin_unlock(&s->extralist.lock); ++ return true; ++} ++ ++static inline void ___pcpu_freelist_push_nmi(struct pcpu_freelist *s, ++ struct pcpu_freelist_node *node) ++{ ++ int cpu, orig_cpu; ++ ++ orig_cpu = cpu = raw_smp_processor_id(); ++ while (1) { ++ struct pcpu_freelist_head *head; ++ ++ head = per_cpu_ptr(s->freelist, cpu); ++ if (raw_spin_trylock(&head->lock)) { ++ pcpu_freelist_push_node(head, node); ++ raw_spin_unlock(&head->lock); ++ return; ++ } ++ cpu = cpumask_next(cpu, cpu_possible_mask); ++ if (cpu >= nr_cpu_ids) ++ cpu = 0; ++ ++ /* cannot lock any per cpu lock, try extralist */ ++ if (cpu == orig_cpu && ++ pcpu_freelist_try_push_extra(s, node)) ++ return; ++ } ++} ++ + void __pcpu_freelist_push(struct pcpu_freelist *s, + struct pcpu_freelist_node *node) + { +- struct pcpu_freelist_head *head = this_cpu_ptr(s->freelist); +- +- ___pcpu_freelist_push(head, node); ++ if (in_nmi()) ++ ___pcpu_freelist_push_nmi(s, node); ++ else ++ ___pcpu_freelist_push(this_cpu_ptr(s->freelist), node); + } + + void pcpu_freelist_push(struct pcpu_freelist *s, +@@ -81,7 +121,7 @@ void pcpu_freelist_populate(struct pcpu_freelist *s, void *buf, u32 elem_size, + } + } + +-struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *s) ++static struct pcpu_freelist_node *___pcpu_freelist_pop(struct pcpu_freelist *s) + { + struct pcpu_freelist_head *head; + struct pcpu_freelist_node *node; +@@ -102,8 +142,59 @@ struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *s) + if (cpu >= nr_cpu_ids) + cpu = 0; + if (cpu == orig_cpu) +- return NULL; ++ break; ++ } ++ ++ /* per cpu lists are all empty, try extralist */ ++ raw_spin_lock(&s->extralist.lock); ++ node = s->extralist.first; ++ if (node) ++ s->extralist.first = node->next; ++ raw_spin_unlock(&s->extralist.lock); ++ return node; ++} ++ ++static struct pcpu_freelist_node * ++___pcpu_freelist_pop_nmi(struct pcpu_freelist *s) ++{ ++ struct pcpu_freelist_head *head; ++ struct pcpu_freelist_node *node; ++ int orig_cpu, cpu; ++ ++ orig_cpu = cpu = raw_smp_processor_id(); ++ while (1) { ++ head = per_cpu_ptr(s->freelist, cpu); ++ if (raw_spin_trylock(&head->lock)) { ++ node = head->first; ++ if (node) { ++ head->first = node->next; ++ raw_spin_unlock(&head->lock); ++ return node; ++ } ++ raw_spin_unlock(&head->lock); ++ } ++ cpu = cpumask_next(cpu, cpu_possible_mask); ++ if (cpu >= nr_cpu_ids) ++ cpu = 0; ++ if (cpu == orig_cpu) ++ break; + } ++ ++ /* cannot pop from per cpu lists, try extralist */ ++ if (!raw_spin_trylock(&s->extralist.lock)) ++ return NULL; ++ node = s->extralist.first; ++ if (node) ++ s->extralist.first = node->next; ++ raw_spin_unlock(&s->extralist.lock); ++ return node; ++} ++ ++struct pcpu_freelist_node *__pcpu_freelist_pop(struct pcpu_freelist *s) ++{ ++ if (in_nmi()) ++ return ___pcpu_freelist_pop_nmi(s); ++ return ___pcpu_freelist_pop(s); + } + + struct pcpu_freelist_node *pcpu_freelist_pop(struct pcpu_freelist *s) +diff --git a/kernel/bpf/percpu_freelist.h b/kernel/bpf/percpu_freelist.h +index fbf8a8a289791..3c76553cfe571 100644 +--- a/kernel/bpf/percpu_freelist.h ++++ b/kernel/bpf/percpu_freelist.h +@@ -13,6 +13,7 @@ struct pcpu_freelist_head { + + struct pcpu_freelist { + struct pcpu_freelist_head __percpu *freelist; ++ struct pcpu_freelist_head extralist; + }; + + struct pcpu_freelist_node { +-- +2.25.1 + diff --git a/queue-5.8/brcm80211-fix-possible-memleak-in-brcmf_proto_msgbuf.patch b/queue-5.8/brcm80211-fix-possible-memleak-in-brcmf_proto_msgbuf.patch new file mode 100644 index 00000000000..125b7137257 --- /dev/null +++ b/queue-5.8/brcm80211-fix-possible-memleak-in-brcmf_proto_msgbuf.patch @@ -0,0 +1,37 @@ +From 195e350cae1100eef04553cc83659c499874c112 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Jul 2020 17:36:05 +0800 +Subject: brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach + +From: Wang Yufen + +[ Upstream commit 6c151410d5b57e6bb0d91a735ac511459539a7bf ] + +When brcmf_proto_msgbuf_attach fail and msgbuf->txflow_wq != NULL, +we should destroy the workqueue. + +Reported-by: Hulk Robot +Signed-off-by: Wang Yufen +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1595237765-66238-1-git-send-email-wangyufen@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +index 8bb4f1fa790e7..1bb270e782ff2 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c +@@ -1619,6 +1619,8 @@ int brcmf_proto_msgbuf_attach(struct brcmf_pub *drvr) + BRCMF_TX_IOCTL_MAX_MSG_SIZE, + msgbuf->ioctbuf, + msgbuf->ioctbuf_handle); ++ if (msgbuf->txflow_wq) ++ destroy_workqueue(msgbuf->txflow_wq); + kfree(msgbuf); + } + return -ENOMEM; +-- +2.25.1 + diff --git a/queue-5.8/brcmfmac-check-ndev-pointer.patch b/queue-5.8/brcmfmac-check-ndev-pointer.patch new file mode 100644 index 00000000000..e4d11922cc9 --- /dev/null +++ b/queue-5.8/brcmfmac-check-ndev-pointer.patch @@ -0,0 +1,54 @@ +From c8708c93a72513f5f4b93a81b9a95a3bbb5ff2f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 09:18:04 -0700 +Subject: brcmfmac: check ndev pointer + +From: Tom Rix + +[ Upstream commit 9c9f015bc9f8839831c7ba0a6d731a3853c464e2 ] + +Clang static analysis reports this error + +brcmfmac/core.c:490:4: warning: Dereference of null pointer + (*ifp)->ndev->stats.rx_errors++; + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +In this block of code + + if (ret || !(*ifp) || !(*ifp)->ndev) { + if (ret != -ENODATA && *ifp) + (*ifp)->ndev->stats.rx_errors++; + brcmu_pkt_buf_free_skb(skb); + return -ENODATA; + } + +(*ifp)->ndev being NULL is caught as an error +But then it is used to report the error. + +So add a check before using it. + +Fixes: 91b632803ee4 ("brcmfmac: Use net_device_stats from struct net_device") +Signed-off-by: Tom Rix +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200802161804.6126-1-trix@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +index c88655acc78c7..76b478f70b4bb 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c +@@ -483,7 +483,7 @@ static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb, + ret = brcmf_proto_hdrpull(drvr, true, skb, ifp); + + if (ret || !(*ifp) || !(*ifp)->ndev) { +- if (ret != -ENODATA && *ifp) ++ if (ret != -ENODATA && *ifp && (*ifp)->ndev) + (*ifp)->ndev->stats.rx_errors++; + brcmu_pkt_buf_free_skb(skb); + return -ENODATA; +-- +2.25.1 + diff --git a/queue-5.8/brcmsmac-fix-memory-leak-in-wlc_phy_attach_lcnphy.patch b/queue-5.8/brcmsmac-fix-memory-leak-in-wlc_phy_attach_lcnphy.patch new file mode 100644 index 00000000000..eceab2e5350 --- /dev/null +++ b/queue-5.8/brcmsmac-fix-memory-leak-in-wlc_phy_attach_lcnphy.patch @@ -0,0 +1,43 @@ +From a28a9d6b0d9d1deea04e8892dc12e9334d62196b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 12:17:41 +0000 +Subject: brcmsmac: fix memory leak in wlc_phy_attach_lcnphy + +From: Keita Suzuki + +[ Upstream commit f4443293d741d1776b86ed1dd8c4e4285d0775fc ] + +When wlc_phy_txpwr_srom_read_lcnphy fails in wlc_phy_attach_lcnphy, +the allocated pi->u.pi_lcnphy is leaked, since struct brcms_phy will be +freed in the caller function. + +Fix this by calling wlc_phy_detach_lcnphy in the error handler of +wlc_phy_txpwr_srom_read_lcnphy before returning. + +Signed-off-by: Keita Suzuki +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200908121743.23108-1-keitasuzuki.park@sslab.ics.keio.ac.jp +Signed-off-by: Sasha Levin +--- + .../net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +index 7ef36234a25dc..66797dc5e90d5 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c +@@ -5065,8 +5065,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi) + pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft; + pi->pi_fptr.detach = wlc_phy_detach_lcnphy; + +- if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) ++ if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) { ++ kfree(pi->u.pi_lcnphy); + return false; ++ } + + if (LCNREV_IS(pi->pubpi.phy_rev, 1)) { + if (pi_lcn->lcnphy_tempsense_option == 3) { +-- +2.25.1 + diff --git a/queue-5.8/btrfs-add-owner-and-fs_info-to-alloc_state-io_tree.patch b/queue-5.8/btrfs-add-owner-and-fs_info-to-alloc_state-io_tree.patch new file mode 100644 index 00000000000..9d4ba1d1216 --- /dev/null +++ b/queue-5.8/btrfs-add-owner-and-fs_info-to-alloc_state-io_tree.patch @@ -0,0 +1,83 @@ +From 0699201d830a8f5fd2db7d3bad4f4fc9fe72cba6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 15:42:46 +0800 +Subject: btrfs: add owner and fs_info to alloc_state io_tree + +From: Qu Wenruo + +[ Upstream commit 154f7cb86809a3a796bffbc7a5a7ce0dee585eaa ] + +Commit 1c11b63eff2a ("btrfs: replace pending/pinned chunks lists with io +tree") introduced btrfs_device::alloc_state extent io tree, but it +doesn't initialize the fs_info and owner member. + +This means the following features are not properly supported: + +- Fs owner report for insert_state() error + Without fs_info initialized, although btrfs_err() won't panic, it + won't output which fs is causing the error. + +- Wrong owner for trace events + alloc_state will get the owner as pinned extents. + +Fix this by assiging proper fs_info and owner for +btrfs_device::alloc_state. + +Fixes: 1c11b63eff2a ("btrfs: replace pending/pinned chunks lists with io tree") +Reviewed-by: Nikolay Borisov +Signed-off-by: Qu Wenruo +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/extent-io-tree.h | 1 + + fs/btrfs/volumes.c | 7 ++++--- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/fs/btrfs/extent-io-tree.h b/fs/btrfs/extent-io-tree.h +index 8bbb734f3f514..49384d55a908f 100644 +--- a/fs/btrfs/extent-io-tree.h ++++ b/fs/btrfs/extent-io-tree.h +@@ -48,6 +48,7 @@ enum { + IO_TREE_INODE_FILE_EXTENT, + IO_TREE_LOG_CSUM_RANGE, + IO_TREE_SELFTEST, ++ IO_TREE_DEVICE_ALLOC_STATE, + }; + + struct extent_io_tree { +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 79e9a80bd37a0..f9d8bd3099488 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -406,7 +406,7 @@ void __exit btrfs_cleanup_fs_uuids(void) + * Returned struct is not linked onto any lists and must be destroyed using + * btrfs_free_device. + */ +-static struct btrfs_device *__alloc_device(void) ++static struct btrfs_device *__alloc_device(struct btrfs_fs_info *fs_info) + { + struct btrfs_device *dev; + +@@ -433,7 +433,8 @@ static struct btrfs_device *__alloc_device(void) + btrfs_device_data_ordered_init(dev); + INIT_RADIX_TREE(&dev->reada_zones, GFP_NOFS & ~__GFP_DIRECT_RECLAIM); + INIT_RADIX_TREE(&dev->reada_extents, GFP_NOFS & ~__GFP_DIRECT_RECLAIM); +- extent_io_tree_init(NULL, &dev->alloc_state, 0, NULL); ++ extent_io_tree_init(fs_info, &dev->alloc_state, ++ IO_TREE_DEVICE_ALLOC_STATE, NULL); + + return dev; + } +@@ -6545,7 +6546,7 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info, + if (WARN_ON(!devid && !fs_info)) + return ERR_PTR(-EINVAL); + +- dev = __alloc_device(); ++ dev = __alloc_device(fs_info); + if (IS_ERR(dev)) + return dev; + +-- +2.25.1 + diff --git a/queue-5.8/bus-mhi-core-fix-the-building-of-mhi-module.patch b/queue-5.8/bus-mhi-core-fix-the-building-of-mhi-module.patch new file mode 100644 index 00000000000..d6a449cafe6 --- /dev/null +++ b/queue-5.8/bus-mhi-core-fix-the-building-of-mhi-module.patch @@ -0,0 +1,40 @@ +From 554cc8080a48105264e956062fa42c3830fea544 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Sep 2020 23:22:17 +0530 +Subject: bus: mhi: core: Fix the building of MHI module + +From: Manivannan Sadhasivam + +[ Upstream commit 5fc4997fd9d065c98fb312ef56ffadffccc6d61d ] + +The Kbuild rule to build MHI should use the append operator. This fixes +the below warning reported by Kbuild test bot. + +WARNING: modpost: missing MODULE_LICENSE() in +drivers/bus/mhi/core/main.o +WARNING: modpost: missing MODULE_LICENSE() in drivers/bus/mhi/core/pm.o +WARNING: modpost: missing MODULE_LICENSE() in +drivers/bus/mhi/core/boot.o + +Fixes: 0cbf260820fa ("bus: mhi: core: Add support for registering MHI controllers") +Reported-by: kernel test robot +Signed-off-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20200929175218.8178-19-manivannan.sadhasivam@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/bus/mhi/core/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bus/mhi/core/Makefile b/drivers/bus/mhi/core/Makefile +index 66e2700c9032a..bc1469778cf87 100644 +--- a/drivers/bus/mhi/core/Makefile ++++ b/drivers/bus/mhi/core/Makefile +@@ -1,3 +1,3 @@ +-obj-$(CONFIG_MHI_BUS) := mhi.o ++obj-$(CONFIG_MHI_BUS) += mhi.o + + mhi-y := init.o main.o pm.o boot.o +-- +2.25.1 + diff --git a/queue-5.8/can-flexcan-flexcan_chip_stop-add-error-handling-and.patch b/queue-5.8/can-flexcan-flexcan_chip_stop-add-error-handling-and.patch new file mode 100644 index 00000000000..0769eebdb3e --- /dev/null +++ b/queue-5.8/can-flexcan-flexcan_chip_stop-add-error-handling-and.patch @@ -0,0 +1,95 @@ +From 0aa445740d4d642b8952dd8f1d0b68efe1457235 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Sep 2020 16:44:19 +0200 +Subject: can: flexcan: flexcan_chip_stop(): add error handling and propagate + error value + +From: Joakim Zhang + +[ Upstream commit 9ad02c7f4f279504bdd38ab706fdc97d5f2b2a9c ] + +This patch implements error handling and propagates the error value of +flexcan_chip_stop(). This function will be called from flexcan_suspend() +in an upcoming patch in some SoCs which support LPSR mode. + +Add a new function flexcan_chip_stop_disable_on_error() that tries to +disable the chip even in case of errors. + +Signed-off-by: Joakim Zhang +[mkl: introduce flexcan_chip_stop_disable_on_error() and use it in flexcan_close()] +Signed-off-by: Marc Kleine-Budde +Link: https://lore.kernel.org/r/20200922144429.2613631-11-mkl@pengutronix.de +Signed-off-by: Sasha Levin +--- + drivers/net/can/flexcan.c | 34 ++++++++++++++++++++++++++++------ + 1 file changed, 28 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 94d10ec954a05..2ac7a667bde35 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -1260,18 +1260,23 @@ static int flexcan_chip_start(struct net_device *dev) + return err; + } + +-/* flexcan_chip_stop ++/* __flexcan_chip_stop + * +- * this functions is entered with clocks enabled ++ * this function is entered with clocks enabled + */ +-static void flexcan_chip_stop(struct net_device *dev) ++static int __flexcan_chip_stop(struct net_device *dev, bool disable_on_error) + { + struct flexcan_priv *priv = netdev_priv(dev); + struct flexcan_regs __iomem *regs = priv->regs; ++ int err; + + /* freeze + disable module */ +- flexcan_chip_freeze(priv); +- flexcan_chip_disable(priv); ++ err = flexcan_chip_freeze(priv); ++ if (err && !disable_on_error) ++ return err; ++ err = flexcan_chip_disable(priv); ++ if (err && !disable_on_error) ++ goto out_chip_unfreeze; + + /* Disable all interrupts */ + priv->write(0, ®s->imask2); +@@ -1281,6 +1286,23 @@ static void flexcan_chip_stop(struct net_device *dev) + + flexcan_transceiver_disable(priv); + priv->can.state = CAN_STATE_STOPPED; ++ ++ return 0; ++ ++ out_chip_unfreeze: ++ flexcan_chip_unfreeze(priv); ++ ++ return err; ++} ++ ++static inline int flexcan_chip_stop_disable_on_error(struct net_device *dev) ++{ ++ return __flexcan_chip_stop(dev, true); ++} ++ ++static inline int flexcan_chip_stop(struct net_device *dev) ++{ ++ return __flexcan_chip_stop(dev, false); + } + + static int flexcan_open(struct net_device *dev) +@@ -1362,7 +1384,7 @@ static int flexcan_close(struct net_device *dev) + + netif_stop_queue(dev); + can_rx_offload_disable(&priv->offload); +- flexcan_chip_stop(dev); ++ flexcan_chip_stop_disable_on_error(dev); + + can_rx_offload_del(&priv->offload); + free_irq(dev->irq, dev); +-- +2.25.1 + diff --git a/queue-5.8/clk-at91-clk-main-update-key-before-writing-at91_ckg.patch b/queue-5.8/clk-at91-clk-main-update-key-before-writing-at91_ckg.patch new file mode 100644 index 00000000000..6196d692572 --- /dev/null +++ b/queue-5.8/clk-at91-clk-main-update-key-before-writing-at91_ckg.patch @@ -0,0 +1,52 @@ +From 633dfe0062dbea195a9137b65dbf13b3229413eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 09:59:10 +0300 +Subject: clk: at91: clk-main: update key before writing AT91_CKGR_MOR + +From: Claudiu Beznea + +[ Upstream commit 85d071e7f19a6a9abf30476b90b3819642568756 ] + +SAMA5D2 datasheet specifies on chapter 33.22.8 (PMC Clock Generator +Main Oscillator Register) that writing any value other than +0x37 on KEY field aborts the write operation. Use the key when +selecting main clock parent. + +Fixes: 27cb1c2083373 ("clk: at91: rework main clk implementation") +Signed-off-by: Claudiu Beznea +Reviewed-by: Alexandre Belloni +Link: https://lore.kernel.org/r/1598338751-20607-3-git-send-email-claudiu.beznea@microchip.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/clk-main.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c +index 37c22667e8319..4313ecb2af5b2 100644 +--- a/drivers/clk/at91/clk-main.c ++++ b/drivers/clk/at91/clk-main.c +@@ -437,12 +437,17 @@ static int clk_sam9x5_main_set_parent(struct clk_hw *hw, u8 index) + return -EINVAL; + + regmap_read(regmap, AT91_CKGR_MOR, &tmp); +- tmp &= ~MOR_KEY_MASK; + + if (index && !(tmp & AT91_PMC_MOSCSEL)) +- regmap_write(regmap, AT91_CKGR_MOR, tmp | AT91_PMC_MOSCSEL); ++ tmp = AT91_PMC_MOSCSEL; + else if (!index && (tmp & AT91_PMC_MOSCSEL)) +- regmap_write(regmap, AT91_CKGR_MOR, tmp & ~AT91_PMC_MOSCSEL); ++ tmp = 0; ++ else ++ return 0; ++ ++ regmap_update_bits(regmap, AT91_CKGR_MOR, ++ AT91_PMC_MOSCSEL | MOR_KEY_MASK, ++ tmp | AT91_PMC_KEY); + + while (!clk_sam9x5_main_ready(regmap)) + cpu_relax(); +-- +2.25.1 + diff --git a/queue-5.8/clk-bcm2835-add-missing-release-if-devm_clk_hw_regis.patch b/queue-5.8/clk-bcm2835-add-missing-release-if-devm_clk_hw_regis.patch new file mode 100644 index 00000000000..1fbce2a41b6 --- /dev/null +++ b/queue-5.8/clk-bcm2835-add-missing-release-if-devm_clk_hw_regis.patch @@ -0,0 +1,41 @@ +From bcb05fec1c71116b30fda64d41b8d2775c05c321 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Aug 2020 18:11:58 -0500 +Subject: clk: bcm2835: add missing release if devm_clk_hw_register fails + +From: Navid Emamdoost + +[ Upstream commit f6c992ca7dd4f49042eec61f3fb426c94d901675 ] + +In the implementation of bcm2835_register_pll(), the allocated pll is +leaked if devm_clk_hw_register() fails to register hw. Release pll if +devm_clk_hw_register() fails. + +Signed-off-by: Navid Emamdoost +Link: https://lore.kernel.org/r/20200809231202.15811-1-navid.emamdoost@gmail.com +Fixes: 41691b8862e2 ("clk: bcm2835: Add support for programming the audio domain clocks") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/bcm/clk-bcm2835.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 011802f1a6df9..f18b4d9e9455b 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -1337,8 +1337,10 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman, + pll->hw.init = &init; + + ret = devm_clk_hw_register(cprman->dev, &pll->hw); +- if (ret) ++ if (ret) { ++ kfree(pll); + return NULL; ++ } + return &pll->hw; + } + +-- +2.25.1 + diff --git a/queue-5.8/clk-imx8mq-fix-usdhc-parents-order.patch b/queue-5.8/clk-imx8mq-fix-usdhc-parents-order.patch new file mode 100644 index 00000000000..4da74e33639 --- /dev/null +++ b/queue-5.8/clk-imx8mq-fix-usdhc-parents-order.patch @@ -0,0 +1,54 @@ +From f55c98f03552caade0c15bdca290283d0693b898 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 12:25:44 +0300 +Subject: clk: imx8mq: Fix usdhc parents order + +From: Abel Vesa + +[ Upstream commit b159c63d82ff8ffddc6c6f0eb881b113b36ecad7 ] + +According to the latest RM (see Table 5-1. Clock Root Table), +both usdhc root clocks have the parent order as follows: + +000 - 25M_REF_CLK +001 - SYSTEM_PLL1_DIV2 +010 - SYSTEM_PLL1_CLK +011 - SYSTEM_PLL2_DIV2 +100 - SYSTEM_PLL3_CLK +101 - SYSTEM_PLL1_DIV3 +110 - AUDIO_PLL2_CLK +111 - SYSTEM_PLL1_DIV8 + +So the audio_pll2_out and sys3_pll_out have to be swapped. + +Fixes: b80522040cd3 ("clk: imx: Add clock driver for i.MX8MQ CCM") +Signed-off-by: Abel Vesa +Reported-by: Cosmin Stefan Stoica +Link: https://lore.kernel.org/r/1602753944-30757-1-git-send-email-abel.vesa@nxp.com +Reviewed-by: Fabio Estevam +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx8mq.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/imx/clk-imx8mq.c b/drivers/clk/imx/clk-imx8mq.c +index a64aace213c27..7762c5825e77d 100644 +--- a/drivers/clk/imx/clk-imx8mq.c ++++ b/drivers/clk/imx/clk-imx8mq.c +@@ -157,10 +157,10 @@ static const char * const imx8mq_qspi_sels[] = {"osc_25m", "sys1_pll_400m", "sys + "audio_pll2_out", "sys1_pll_266m", "sys3_pll_out", "sys1_pll_100m", }; + + static const char * const imx8mq_usdhc1_sels[] = {"osc_25m", "sys1_pll_400m", "sys1_pll_800m", "sys2_pll_500m", +- "audio_pll2_out", "sys1_pll_266m", "sys3_pll_out", "sys1_pll_100m", }; ++ "sys3_pll_out", "sys1_pll_266m", "audio_pll2_out", "sys1_pll_100m", }; + + static const char * const imx8mq_usdhc2_sels[] = {"osc_25m", "sys1_pll_400m", "sys1_pll_800m", "sys2_pll_500m", +- "audio_pll2_out", "sys1_pll_266m", "sys3_pll_out", "sys1_pll_100m", }; ++ "sys3_pll_out", "sys1_pll_266m", "audio_pll2_out", "sys1_pll_100m", }; + + static const char * const imx8mq_i2c1_sels[] = {"osc_25m", "sys1_pll_160m", "sys2_pll_50m", "sys3_pll_out", "audio_pll1_out", + "video_pll1_out", "audio_pll2_out", "sys1_pll_133m", }; +-- +2.25.1 + diff --git a/queue-5.8/clk-keystone-sci-clk-fix-parsing-assigned-clock-data.patch b/queue-5.8/clk-keystone-sci-clk-fix-parsing-assigned-clock-data.patch new file mode 100644 index 00000000000..d17e2bdb7c6 --- /dev/null +++ b/queue-5.8/clk-keystone-sci-clk-fix-parsing-assigned-clock-data.patch @@ -0,0 +1,40 @@ +From 2fcdd492c0551f2944b3d9a923a09e923b85e743 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 11:57:38 +0300 +Subject: clk: keystone: sci-clk: fix parsing assigned-clock data during probe + +From: Tero Kristo + +[ Upstream commit 2f05cced7307489faab873367fb20cd212e1d890 ] + +The DT clock probe loop incorrectly terminates after processing "clocks" +only, fix this by re-starting the loop when all entries for current +DT property have been parsed. + +Fixes: 8e48b33f9def ("clk: keystone: sci-clk: probe clocks from DT instead of firmware") +Reported-by: Peter Ujfalusi +Signed-off-by: Tero Kristo +Link: https://lore.kernel.org/r/20200907085740.1083-2-t-kristo@ti.com +Acked-by: Santosh Shilimkar +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/keystone/sci-clk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/keystone/sci-clk.c b/drivers/clk/keystone/sci-clk.c +index 7edf8c8432b67..64ea895f1a7df 100644 +--- a/drivers/clk/keystone/sci-clk.c ++++ b/drivers/clk/keystone/sci-clk.c +@@ -522,7 +522,7 @@ static int ti_sci_scan_clocks_from_dt(struct sci_clk_provider *provider) + np = of_find_node_with_property(np, *clk_name); + if (!np) { + clk_name++; +- break; ++ continue; + } + + if (!of_device_is_available(np)) +-- +2.25.1 + diff --git a/queue-5.8/clk-mediatek-add-uart0-clock-support.patch b/queue-5.8/clk-mediatek-add-uart0-clock-support.patch new file mode 100644 index 00000000000..3a48ef781df --- /dev/null +++ b/queue-5.8/clk-mediatek-add-uart0-clock-support.patch @@ -0,0 +1,37 @@ +From 424135738ec844bac4304dfb92a1953e48e72b30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jul 2020 21:30:16 +0800 +Subject: clk: mediatek: add UART0 clock support + +From: Hanks Chen + +[ Upstream commit 804a892456b73604b7ecfb1b00a96a29f3d2aedf ] + +Add MT6779 UART0 clock support. + +Fixes: 710774e04861 ("clk: mediatek: Add MT6779 clock support") +Signed-off-by: Wendell Lin +Signed-off-by: Hanks Chen +Reviewed-by: Matthias Brugger +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/mediatek/clk-mt6779.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/mediatek/clk-mt6779.c b/drivers/clk/mediatek/clk-mt6779.c +index 9766cccf5844c..6e0d3a1667291 100644 +--- a/drivers/clk/mediatek/clk-mt6779.c ++++ b/drivers/clk/mediatek/clk-mt6779.c +@@ -919,6 +919,8 @@ static const struct mtk_gate infra_clks[] = { + "pwm_sel", 19), + GATE_INFRA0(CLK_INFRA_PWM, "infra_pwm", + "pwm_sel", 21), ++ GATE_INFRA0(CLK_INFRA_UART0, "infra_uart0", ++ "uart_sel", 22), + GATE_INFRA0(CLK_INFRA_UART1, "infra_uart1", + "uart_sel", 23), + GATE_INFRA0(CLK_INFRA_UART2, "infra_uart2", +-- +2.25.1 + diff --git a/queue-5.8/clk-meson-axg-audio-separate-axg-and-g12a-regmap-tab.patch b/queue-5.8/clk-meson-axg-audio-separate-axg-and-g12a-regmap-tab.patch new file mode 100644 index 00000000000..e4c12578606 --- /dev/null +++ b/queue-5.8/clk-meson-axg-audio-separate-axg-and-g12a-regmap-tab.patch @@ -0,0 +1,177 @@ +From 0fbca14f101554fa847f00dd1dc0bbddb4501dfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jul 2020 17:43:58 +0200 +Subject: clk: meson: axg-audio: separate axg and g12a regmap tables + +From: Jerome Brunet + +[ Upstream commit cdabb1ffc7c2349b8930f752df1edcafc1d37cc1 ] + +There are more differences than what we initially thought. +Let's keeps things clear and separate the axg and g12a regmap tables of the +audio clock controller. + +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20200729154359.1983085-3-jbrunet@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/axg-audio.c | 135 ++++++++++++++++++++++++++++++++-- + 1 file changed, 127 insertions(+), 8 deletions(-) + +diff --git a/drivers/clk/meson/axg-audio.c b/drivers/clk/meson/axg-audio.c +index 53715e36326c6..9918cb375de30 100644 +--- a/drivers/clk/meson/axg-audio.c ++++ b/drivers/clk/meson/axg-audio.c +@@ -1209,13 +1209,132 @@ static struct clk_hw_onecell_data sm1_audio_hw_onecell_data = { + }; + + +-/* Convenience table to populate regmap in .probe() +- * Note that this table is shared between both AXG and G12A, +- * with spdifout_b clocks being exclusive to G12A. Since those +- * clocks are not declared within the AXG onecell table, we do not +- * feel the need to have separate AXG/G12A regmap tables. +- */ ++/* Convenience table to populate regmap in .probe(). */ + static struct clk_regmap *const axg_clk_regmaps[] = { ++ &ddr_arb, ++ &pdm, ++ &tdmin_a, ++ &tdmin_b, ++ &tdmin_c, ++ &tdmin_lb, ++ &tdmout_a, ++ &tdmout_b, ++ &tdmout_c, ++ &frddr_a, ++ &frddr_b, ++ &frddr_c, ++ &toddr_a, ++ &toddr_b, ++ &toddr_c, ++ &loopback, ++ &spdifin, ++ &spdifout, ++ &resample, ++ &power_detect, ++ &mst_a_mclk_sel, ++ &mst_b_mclk_sel, ++ &mst_c_mclk_sel, ++ &mst_d_mclk_sel, ++ &mst_e_mclk_sel, ++ &mst_f_mclk_sel, ++ &mst_a_mclk_div, ++ &mst_b_mclk_div, ++ &mst_c_mclk_div, ++ &mst_d_mclk_div, ++ &mst_e_mclk_div, ++ &mst_f_mclk_div, ++ &mst_a_mclk, ++ &mst_b_mclk, ++ &mst_c_mclk, ++ &mst_d_mclk, ++ &mst_e_mclk, ++ &mst_f_mclk, ++ &spdifout_clk_sel, ++ &spdifout_clk_div, ++ &spdifout_clk, ++ &spdifin_clk_sel, ++ &spdifin_clk_div, ++ &spdifin_clk, ++ &pdm_dclk_sel, ++ &pdm_dclk_div, ++ &pdm_dclk, ++ &pdm_sysclk_sel, ++ &pdm_sysclk_div, ++ &pdm_sysclk, ++ &mst_a_sclk_pre_en, ++ &mst_b_sclk_pre_en, ++ &mst_c_sclk_pre_en, ++ &mst_d_sclk_pre_en, ++ &mst_e_sclk_pre_en, ++ &mst_f_sclk_pre_en, ++ &mst_a_sclk_div, ++ &mst_b_sclk_div, ++ &mst_c_sclk_div, ++ &mst_d_sclk_div, ++ &mst_e_sclk_div, ++ &mst_f_sclk_div, ++ &mst_a_sclk_post_en, ++ &mst_b_sclk_post_en, ++ &mst_c_sclk_post_en, ++ &mst_d_sclk_post_en, ++ &mst_e_sclk_post_en, ++ &mst_f_sclk_post_en, ++ &mst_a_sclk, ++ &mst_b_sclk, ++ &mst_c_sclk, ++ &mst_d_sclk, ++ &mst_e_sclk, ++ &mst_f_sclk, ++ &mst_a_lrclk_div, ++ &mst_b_lrclk_div, ++ &mst_c_lrclk_div, ++ &mst_d_lrclk_div, ++ &mst_e_lrclk_div, ++ &mst_f_lrclk_div, ++ &mst_a_lrclk, ++ &mst_b_lrclk, ++ &mst_c_lrclk, ++ &mst_d_lrclk, ++ &mst_e_lrclk, ++ &mst_f_lrclk, ++ &tdmin_a_sclk_sel, ++ &tdmin_b_sclk_sel, ++ &tdmin_c_sclk_sel, ++ &tdmin_lb_sclk_sel, ++ &tdmout_a_sclk_sel, ++ &tdmout_b_sclk_sel, ++ &tdmout_c_sclk_sel, ++ &tdmin_a_sclk_pre_en, ++ &tdmin_b_sclk_pre_en, ++ &tdmin_c_sclk_pre_en, ++ &tdmin_lb_sclk_pre_en, ++ &tdmout_a_sclk_pre_en, ++ &tdmout_b_sclk_pre_en, ++ &tdmout_c_sclk_pre_en, ++ &tdmin_a_sclk_post_en, ++ &tdmin_b_sclk_post_en, ++ &tdmin_c_sclk_post_en, ++ &tdmin_lb_sclk_post_en, ++ &tdmout_a_sclk_post_en, ++ &tdmout_b_sclk_post_en, ++ &tdmout_c_sclk_post_en, ++ &tdmin_a_sclk, ++ &tdmin_b_sclk, ++ &tdmin_c_sclk, ++ &tdmin_lb_sclk, ++ &tdmout_a_sclk, ++ &tdmout_b_sclk, ++ &tdmout_c_sclk, ++ &tdmin_a_lrclk, ++ &tdmin_b_lrclk, ++ &tdmin_c_lrclk, ++ &tdmin_lb_lrclk, ++ &tdmout_a_lrclk, ++ &tdmout_b_lrclk, ++ &tdmout_c_lrclk, ++}; ++ ++static struct clk_regmap *const g12a_clk_regmaps[] = { + &ddr_arb, + &pdm, + &tdmin_a, +@@ -1713,8 +1832,8 @@ static const struct audioclk_data axg_audioclk_data = { + }; + + static const struct audioclk_data g12a_audioclk_data = { +- .regmap_clks = axg_clk_regmaps, +- .regmap_clk_num = ARRAY_SIZE(axg_clk_regmaps), ++ .regmap_clks = g12a_clk_regmaps, ++ .regmap_clk_num = ARRAY_SIZE(g12a_clk_regmaps), + .hw_onecell_data = &g12a_audio_hw_onecell_data, + .reset_offset = AUDIO_SW_RESET, + .reset_num = 26, +-- +2.25.1 + diff --git a/queue-5.8/clk-meson-g12a-mark-fclk_div2-as-critical.patch b/queue-5.8/clk-meson-g12a-mark-fclk_div2-as-critical.patch new file mode 100644 index 00000000000..8688b664334 --- /dev/null +++ b/queue-5.8/clk-meson-g12a-mark-fclk_div2-as-critical.patch @@ -0,0 +1,55 @@ +From b8581a433d62cc804507c9ec43df0d220f7fd342 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 17:52:05 +0200 +Subject: clk: meson: g12a: mark fclk_div2 as critical + +From: Stefan Agner + +[ Upstream commit 2c4e80e06790cb49ad2603855d30c5aac2209c47 ] + +On Amlogic Meson G12b platform, similar to fclk_div3, the fclk_div2 +seems to be necessary for the system to operate correctly as well. + +Typically, the clock also gets chosen by the eMMC peripheral. This +probably masked the problem so far. However, when booting from a SD +card the clock seems to get disabled which leads to a system freeze. + +Let's mark this clock as critical, fixing boot from SD card on G12b +platforms. + +Fixes: 085a4ea93d54 ("clk: meson: g12a: add peripheral clock controller") +Signed-off-by: Stefan Agner +Signed-off-by: Jerome Brunet +Tested-by: Anand Moon +Cc: Marek Szyprowski +Link: https://lore.kernel.org/r/577e0129e8ee93972d92f13187ff4e4286182f67.1598629915.git.stefan@agner.ch +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/g12a.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/clk/meson/g12a.c b/drivers/clk/meson/g12a.c +index 30c15766ebb16..05d032be15c8f 100644 +--- a/drivers/clk/meson/g12a.c ++++ b/drivers/clk/meson/g12a.c +@@ -298,6 +298,17 @@ static struct clk_regmap g12a_fclk_div2 = { + &g12a_fclk_div2_div.hw + }, + .num_parents = 1, ++ /* ++ * Similar to fclk_div3, it seems that this clock is used by ++ * the resident firmware and is required by the platform to ++ * operate correctly. ++ * Until the following condition are met, we need this clock to ++ * be marked as critical: ++ * a) Mark the clock used by a firmware resource, if possible ++ * b) CCF has a clock hand-off mechanism to make the sure the ++ * clock stays on until the proper driver comes along ++ */ ++ .flags = CLK_IS_CRITICAL, + }, + }; + +-- +2.25.1 + diff --git a/queue-5.8/clk-qcom-gcc-sdm660-fix-wrong-parent_map.patch b/queue-5.8/clk-qcom-gcc-sdm660-fix-wrong-parent_map.patch new file mode 100644 index 00000000000..a1e445fbeb7 --- /dev/null +++ b/queue-5.8/clk-qcom-gcc-sdm660-fix-wrong-parent_map.patch @@ -0,0 +1,37 @@ +From 047a728cbf65784e1b944259c21fce8bb2cddefe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Sep 2020 14:09:09 +0200 +Subject: clk: qcom: gcc-sdm660: Fix wrong parent_map + +From: Konrad Dybcio + +[ Upstream commit d46e5a39f9be9288f1ce2170c4c7f8098f4e7f68 ] + +This was likely overlooked while porting the driver upstream. + +Reported-by: Pavel Dubrova +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20200922120909.97203-1-konradybcio@gmail.com +Fixes: f2a76a2955c0 ("clk: qcom: Add Global Clock controller (GCC) driver for SDM660") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sdm660.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-sdm660.c b/drivers/clk/qcom/gcc-sdm660.c +index c6fb57cd576f5..aa5c0c6ead017 100644 +--- a/drivers/clk/qcom/gcc-sdm660.c ++++ b/drivers/clk/qcom/gcc-sdm660.c +@@ -666,7 +666,7 @@ static struct clk_rcg2 hmss_rbcpr_clk_src = { + .cmd_rcgr = 0x48044, + .mnd_width = 0, + .hid_width = 5, +- .parent_map = gcc_parent_map_xo_gpll0_gpll0_early_div, ++ .parent_map = gcc_parent_map_xo_gpll0, + .freq_tbl = ftbl_hmss_rbcpr_clk_src, + .clkr.hw.init = &(struct clk_init_data){ + .name = "hmss_rbcpr_clk_src", +-- +2.25.1 + diff --git a/queue-5.8/clk-rockchip-initialize-hw-to-error-to-avoid-undefin.patch b/queue-5.8/clk-rockchip-initialize-hw-to-error-to-avoid-undefin.patch new file mode 100644 index 00000000000..5cb377e3433 --- /dev/null +++ b/queue-5.8/clk-rockchip-initialize-hw-to-error-to-avoid-undefin.patch @@ -0,0 +1,44 @@ +From 3d6b8f4637334ad28601e3f375c12bdcb56d3d31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Sep 2020 17:41:44 -0700 +Subject: clk: rockchip: Initialize hw to error to avoid undefined behavior + +From: Stephen Boyd + +[ Upstream commit b608f11d49ec671739604cc763248d8e8fadbbeb ] + +We can get down to this return value from ERR_CAST() without +initializing hw. Set it to -ENOMEM so that we always return something +sane. + +Fixes the following smatch warning: + +drivers/clk/rockchip/clk-half-divider.c:228 rockchip_clk_register_halfdiv() error: uninitialized symbol 'hw'. +drivers/clk/rockchip/clk-half-divider.c:228 rockchip_clk_register_halfdiv() warn: passing zero to 'ERR_CAST' + +Cc: Elaine Zhang +Cc: Heiko Stuebner +Fixes: 956060a52795 ("clk: rockchip: add support for half divider") +Reviewed-by: Heiko Stuebner +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-half-divider.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/rockchip/clk-half-divider.c b/drivers/clk/rockchip/clk-half-divider.c +index b333fc28c94b6..37c858d689e0d 100644 +--- a/drivers/clk/rockchip/clk-half-divider.c ++++ b/drivers/clk/rockchip/clk-half-divider.c +@@ -166,7 +166,7 @@ struct clk *rockchip_clk_register_halfdiv(const char *name, + unsigned long flags, + spinlock_t *lock) + { +- struct clk *clk; ++ struct clk *clk = ERR_PTR(-ENOMEM); + struct clk_mux *mux = NULL; + struct clk_gate *gate = NULL; + struct clk_divider *div = NULL; +-- +2.25.1 + diff --git a/queue-5.8/coresight-cti-disclaim-device-only-when-it-s-claimed.patch b/queue-5.8/coresight-cti-disclaim-device-only-when-it-s-claimed.patch new file mode 100644 index 00000000000..54c3d788582 --- /dev/null +++ b/queue-5.8/coresight-cti-disclaim-device-only-when-it-s-claimed.patch @@ -0,0 +1,64 @@ +From d3edad57b4b5d79314ebd77cdea49fb3475c9d97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 13:17:26 -0600 +Subject: coresight: cti: disclaim device only when it's claimed + +From: Tingwei Zhang + +[ Upstream commit 0dee28268ddbe53a981d4d87faf5dc0f1700e698 ] + +Coresight_claim_device() is called in cti_starting_cpu() only +when CTI is enabled while coresight_disclaim_device() is called +uncontionally in cti_dying_cpu(). This triggered below WARNING. +Only call disclaim device when CTI device is enabled to fix it. + +[ 75.989643] WARNING: CPU: 1 PID: 14 at +kernel/drivers/hwtracing/coresight/coresight.c:209 +coresight_disclaim_device_unlocked+0x10/0x24 +[ 75.989697] CPU: 1 PID: 14 Comm: migration/1 Not tainted +5.9.0-rc1-gff1304be0a05-dirty #21 +[ 75.989709] Hardware name: Thundercomm Dragonboard 845c (DT) +[ 75.989737] pstate: 80c00085 (Nzcv daIf +PAN +UAO BTYPE=--) +[ 75.989758] pc : coresight_disclaim_device_unlocked+0x10/0x24 +[ 75.989775] lr : coresight_disclaim_device+0x24/0x38 +[ 75.989783] sp : ffff800011cd3c90 +. +[ 75.990018] Call trace: +[ 75.990041] coresight_disclaim_device_unlocked+0x10/0x24 +[ 75.990066] cti_dying_cpu+0x34/0x4c +[ 75.990101] cpuhp_invoke_callback+0x84/0x1e0 +[ 75.990121] take_cpu_down+0x90/0xe0 +[ 75.990154] multi_cpu_stop+0x134/0x160 +[ 75.990171] cpu_stopper_thread+0xb0/0x13c +[ 75.990196] smpboot_thread_fn+0x1c4/0x270 +[ 75.990222] kthread+0x128/0x154 +[ 75.990251] ret_from_fork+0x10/0x18 + +Fixes: e9b880581d55 ("coresight: cti: Add CPU Hotplug handling to CTI driver") +Reviewed-by: Mike Leach +Signed-off-by: Tingwei Zhang +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200916191737.4001561-6-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-cti.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-cti.c b/drivers/hwtracing/coresight/coresight-cti.c +index 3ccc703dc9409..d6fea6efec71f 100644 +--- a/drivers/hwtracing/coresight/coresight-cti.c ++++ b/drivers/hwtracing/coresight/coresight-cti.c +@@ -742,7 +742,8 @@ static int cti_dying_cpu(unsigned int cpu) + + spin_lock(&drvdata->spinlock); + drvdata->config.hw_powered = false; +- coresight_disclaim_device(drvdata->base); ++ if (drvdata->config.hw_enabled) ++ coresight_disclaim_device(drvdata->base); + spin_unlock(&drvdata->spinlock); + return 0; + } +-- +2.25.1 + diff --git a/queue-5.8/coresight-cti-fix-bug-clearing-sysfs-links-on-callba.patch b/queue-5.8/coresight-cti-fix-bug-clearing-sysfs-links-on-callba.patch new file mode 100644 index 00000000000..e3bbdb1094c --- /dev/null +++ b/queue-5.8/coresight-cti-fix-bug-clearing-sysfs-links-on-callba.patch @@ -0,0 +1,70 @@ +From 3039e273da0c32005fecd7b2c8c2125ee7169a12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 10:35:06 -0600 +Subject: coresight: cti: Fix bug clearing sysfs links on callback + +From: Mike Leach + +[ Upstream commit cab280bf3533c72f95ebdb65ce534b5cdc4729dc ] + +During module unload, a coresight driver module will call back into +the CTI driver to remove any links between the two devices. + +The current code has 2 issues:- +1) in the CTI driver the matching code is matching to the wrong device +so misses all the links. +2) The callback is called too late in the unload process resulting in a +crash. + +This fixes both the issues. + +Fixes: 177af8285b59 ("coresight: cti: Enable CTI associated with devices") +Reported-by: Tingwei Zhang +Acked-by: Suzuki K Poulose +Signed-off-by: Mike Leach +Signed-off-by: Tingwei Zhang +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200928163513.70169-19-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-cti.c | 2 +- + drivers/hwtracing/coresight/coresight.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-cti.c b/drivers/hwtracing/coresight/coresight-cti.c +index 92aa535f9e134..167fbc2e7033f 100644 +--- a/drivers/hwtracing/coresight/coresight-cti.c ++++ b/drivers/hwtracing/coresight/coresight-cti.c +@@ -592,7 +592,7 @@ void cti_remove_assoc_from_csdev(struct coresight_device *csdev) + ctidrv = csdev_to_cti_drvdata(csdev->ect_dev); + ctidev = &ctidrv->ctidev; + list_for_each_entry(tc, &ctidev->trig_cons, node) { +- if (tc->con_dev == csdev->ect_dev) { ++ if (tc->con_dev == csdev) { + cti_remove_sysfs_link(ctidrv, tc); + tc->con_dev = NULL; + break; +diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c +index f3efbb3b2b4d1..cf03af09c6ced 100644 +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -1023,7 +1023,6 @@ static void coresight_device_release(struct device *dev) + { + struct coresight_device *csdev = to_coresight_device(dev); + +- cti_remove_assoc_from_csdev(csdev); + fwnode_handle_put(csdev->dev.fwnode); + kfree(csdev->refcnt); + kfree(csdev); +@@ -1357,6 +1356,7 @@ void coresight_unregister(struct coresight_device *csdev) + { + etm_perf_del_symlink_sink(csdev); + /* Remove references of that device in the topology */ ++ cti_remove_assoc_from_csdev(csdev); + coresight_remove_conns(csdev); + coresight_release_platform_data(csdev, csdev->pdata); + device_unregister(&csdev->dev); +-- +2.25.1 + diff --git a/queue-5.8/coresight-cti-fix-remove-sysfs-link-error.patch b/queue-5.8/coresight-cti-fix-remove-sysfs-link-error.patch new file mode 100644 index 00000000000..999923dd15f --- /dev/null +++ b/queue-5.8/coresight-cti-fix-remove-sysfs-link-error.patch @@ -0,0 +1,69 @@ +From 4b7ada9a8db0692f98ae7b5b6ad780b3c92665ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 10:35:05 -0600 +Subject: coresight: cti: Fix remove sysfs link error + +From: Mike Leach + +[ Upstream commit 1cce921bce7dcf6fef9bdfa4dcc9406383274408 ] + +CTI code to remove sysfs link to other devices on shutdown, incorrectly +tries to remove a single ended link when these are all double ended. This +implementation leaves elements in the link info structure undefined which +results in a crash in recent tests for driver module unload. + +This patch corrects the link removal code. + +Fixes: 73274abb6557 ("coresight: cti: Add in sysfs links to other coresight devices") +Reported-by: Tingwei Zhang +Signed-off-by: Mike Leach +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200928163513.70169-18-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-cti.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-cti.c b/drivers/hwtracing/coresight/coresight-cti.c +index 47f3c9abae303..92aa535f9e134 100644 +--- a/drivers/hwtracing/coresight/coresight-cti.c ++++ b/drivers/hwtracing/coresight/coresight-cti.c +@@ -494,12 +494,15 @@ static bool cti_add_sysfs_link(struct cti_drvdata *drvdata, + return !link_err; + } + +-static void cti_remove_sysfs_link(struct cti_trig_con *tc) ++static void cti_remove_sysfs_link(struct cti_drvdata *drvdata, ++ struct cti_trig_con *tc) + { + struct coresight_sysfs_link link_info; + ++ link_info.orig = drvdata->csdev; + link_info.orig_name = tc->con_dev_name; + link_info.target = tc->con_dev; ++ link_info.target_name = dev_name(&drvdata->csdev->dev); + coresight_remove_sysfs_link(&link_info); + } + +@@ -590,7 +593,7 @@ void cti_remove_assoc_from_csdev(struct coresight_device *csdev) + ctidev = &ctidrv->ctidev; + list_for_each_entry(tc, &ctidev->trig_cons, node) { + if (tc->con_dev == csdev->ect_dev) { +- cti_remove_sysfs_link(tc); ++ cti_remove_sysfs_link(ctidrv, tc); + tc->con_dev = NULL; + break; + } +@@ -634,7 +637,7 @@ static void cti_remove_conn_xrefs(struct cti_drvdata *drvdata) + if (tc->con_dev) { + coresight_set_assoc_ectdev_mutex(tc->con_dev, + NULL); +- cti_remove_sysfs_link(tc); ++ cti_remove_sysfs_link(drvdata, tc); + tc->con_dev = NULL; + } + } +-- +2.25.1 + diff --git a/queue-5.8/coresight-cti-remove-pm_runtime_get_sync-from-cpu-ho.patch b/queue-5.8/coresight-cti-remove-pm_runtime_get_sync-from-cpu-ho.patch new file mode 100644 index 00000000000..6cc8adfe878 --- /dev/null +++ b/queue-5.8/coresight-cti-remove-pm_runtime_get_sync-from-cpu-ho.patch @@ -0,0 +1,81 @@ +From cbd1ba04e28cf83a8abdf00fefe3b61dab75e814 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 13:17:27 -0600 +Subject: coresight: cti: remove pm_runtime_get_sync() from CPU hotplug + +From: Tingwei Zhang + +[ Upstream commit 6e8836c6df5327bdb24211424f1ad1411d1ed64a ] + +Below BUG is triggered by call pm_runtime_get_sync() in +cti_cpuhp_enable_hw(). It's in CPU hotplug callback with interrupt +disabled. Pm_runtime_get_sync() calls clock driver to enable clock +which could sleep. Remove pm_runtime_get_sync() in cti_cpuhp_enable_hw() +since pm_runtime_get_sync() is called in cti_enabld and pm_runtime_put() +is called in cti_disabled. No need to increase pm count when CPU gets +online since it's not decreased when CPU is offline. + +[ 105.800279] BUG: scheduling while atomic: swapper/1/0/0x00000002 +[ 105.800290] Modules linked in: +[ 105.800327] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G W +5.9.0-rc1-gff1304be0a05-dirty #21 +[ 105.800337] Hardware name: Thundercomm Dragonboard 845c (DT) +[ 105.800353] Call trace: +[ 105.800414] dump_backtrace+0x0/0x1d4 +[ 105.800439] show_stack+0x14/0x1c +[ 105.800462] dump_stack+0xc0/0x100 +[ 105.800490] __schedule_bug+0x58/0x74 +[ 105.800523] __schedule+0x590/0x65c +[ 105.800538] schedule+0x78/0x10c +[ 105.800553] schedule_timeout+0x188/0x250 +[ 105.800585] qmp_send.constprop.10+0x12c/0x1b0 +[ 105.800599] qmp_qdss_clk_prepare+0x18/0x20 +[ 105.800622] clk_core_prepare+0x48/0xd4 +[ 105.800639] clk_prepare+0x20/0x34 +[ 105.800663] amba_pm_runtime_resume+0x54/0x90 +[ 105.800695] __rpm_callback+0xdc/0x138 +[ 105.800709] rpm_callback+0x24/0x78 +[ 105.800724] rpm_resume+0x328/0x47c +[ 105.800739] __pm_runtime_resume+0x50/0x74 +[ 105.800768] cti_starting_cpu+0x40/0xa4 +[ 105.800795] cpuhp_invoke_callback+0x84/0x1e0 +[ 105.800814] notify_cpu_starting+0x9c/0xb8 +[ 105.800834] secondary_start_kernel+0xd8/0x164 +[ 105.800933] CPU1: Booted secondary processor 0x0000000100 [0x517f803c] + +Fixes: e9b880581d55 ("coresight: cti: Add CPU Hotplug handling to CTI driver") +Reviewed-by: Mike Leach +Signed-off-by: Tingwei Zhang +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200916191737.4001561-7-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-cti.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-cti.c b/drivers/hwtracing/coresight/coresight-cti.c +index d6fea6efec71f..c4e9cc7034ab7 100644 +--- a/drivers/hwtracing/coresight/coresight-cti.c ++++ b/drivers/hwtracing/coresight/coresight-cti.c +@@ -141,9 +141,7 @@ static int cti_enable_hw(struct cti_drvdata *drvdata) + static void cti_cpuhp_enable_hw(struct cti_drvdata *drvdata) + { + struct cti_config *config = &drvdata->config; +- struct device *dev = &drvdata->csdev->dev; + +- pm_runtime_get_sync(dev->parent); + spin_lock(&drvdata->spinlock); + config->hw_powered = true; + +@@ -163,7 +161,6 @@ static void cti_cpuhp_enable_hw(struct cti_drvdata *drvdata) + /* did not re-enable due to no claim / no request */ + cti_hp_not_enabled: + spin_unlock(&drvdata->spinlock); +- pm_runtime_put(dev->parent); + } + + /* disable hardware */ +-- +2.25.1 + diff --git a/queue-5.8/coresight-cti-write-regsiters-directly-in-cti_enable.patch b/queue-5.8/coresight-cti-write-regsiters-directly-in-cti_enable.patch new file mode 100644 index 00000000000..f8175c93a5f --- /dev/null +++ b/queue-5.8/coresight-cti-write-regsiters-directly-in-cti_enable.patch @@ -0,0 +1,117 @@ +From 2c316ebdf1e4a7209bc7a841256e61a3e8f55988 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 13:17:30 -0600 +Subject: coresight: cti: Write regsiters directly in cti_enable_hw() + +From: Tingwei Zhang + +[ Upstream commit 984f37efa3857dcefa649fbdf64abb94591935c3 ] + +Deadlock as below is triggered by one CPU holds drvdata->spinlock +and calls cti_enable_hw(). Smp_call_function_single() is called +in cti_enable_hw() and tries to let another CPU write CTI registers. +That CPU is trying to get drvdata->spinlock in cti_cpu_pm_notify() +and doesn't response to IPI from smp_call_function_single(). + +[ 988.335937] CPU: 6 PID: 10258 Comm: sh Tainted: G W L +5.8.0-rc6-mainline-16783-gc38daa79b26b-dirty #1 +[ 988.346364] Hardware name: Thundercomm Dragonboard 845c (DT) +[ 988.352073] pstate: 20400005 (nzCv daif +PAN -UAO BTYPE=--) +[ 988.357689] pc : smp_call_function_single+0x158/0x1b8 +[ 988.362782] lr : smp_call_function_single+0x124/0x1b8 +... +[ 988.451638] Call trace: +[ 988.454119] smp_call_function_single+0x158/0x1b8 +[ 988.458866] cti_enable+0xb4/0xf8 [coresight_cti] +[ 988.463618] coresight_control_assoc_ectdev+0x6c/0x128 [coresight] +[ 988.469855] coresight_enable+0x1f0/0x364 [coresight] +[ 988.474957] enable_source_store+0x5c/0x9c [coresight] +[ 988.480140] dev_attr_store+0x14/0x28 +[ 988.483839] sysfs_kf_write+0x38/0x4c +[ 988.487532] kernfs_fop_write+0x1c0/0x2b0 +[ 988.491585] vfs_write+0xfc/0x300 +[ 988.494931] ksys_write+0x78/0xe0 +[ 988.498283] __arm64_sys_write+0x18/0x20 +[ 988.502240] el0_svc_common+0x98/0x160 +[ 988.506024] do_el0_svc+0x78/0x80 +[ 988.509377] el0_sync_handler+0xd4/0x270 +[ 988.513337] el0_sync+0x164/0x180 + +This change write CTI registers directly in cti_enable_hw(). +Config->hw_powered has been checked to be true with spinlock holded. +CTI is powered and can be programmed until spinlock is released. + +Fixes: 6a0953ce7de9 ("coresight: cti: Add CPU idle pm notifer to CTI devices") +Signed-off-by: Tingwei Zhang +[Re-ordered variable declaration] +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200916191737.4001561-10-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-cti.c | 24 +++++---------------- + 1 file changed, 5 insertions(+), 19 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-cti.c b/drivers/hwtracing/coresight/coresight-cti.c +index c4e9cc7034ab7..47f3c9abae303 100644 +--- a/drivers/hwtracing/coresight/coresight-cti.c ++++ b/drivers/hwtracing/coresight/coresight-cti.c +@@ -86,22 +86,16 @@ void cti_write_all_hw_regs(struct cti_drvdata *drvdata) + CS_LOCK(drvdata->base); + } + +-static void cti_enable_hw_smp_call(void *info) +-{ +- struct cti_drvdata *drvdata = info; +- +- cti_write_all_hw_regs(drvdata); +-} +- + /* write regs to hardware and enable */ + static int cti_enable_hw(struct cti_drvdata *drvdata) + { + struct cti_config *config = &drvdata->config; + struct device *dev = &drvdata->csdev->dev; ++ unsigned long flags; + int rc = 0; + + pm_runtime_get_sync(dev->parent); +- spin_lock(&drvdata->spinlock); ++ spin_lock_irqsave(&drvdata->spinlock, flags); + + /* no need to do anything if enabled or unpowered*/ + if (config->hw_enabled || !config->hw_powered) +@@ -112,19 +106,11 @@ static int cti_enable_hw(struct cti_drvdata *drvdata) + if (rc) + goto cti_err_not_enabled; + +- if (drvdata->ctidev.cpu >= 0) { +- rc = smp_call_function_single(drvdata->ctidev.cpu, +- cti_enable_hw_smp_call, +- drvdata, 1); +- if (rc) +- goto cti_err_not_enabled; +- } else { +- cti_write_all_hw_regs(drvdata); +- } ++ cti_write_all_hw_regs(drvdata); + + config->hw_enabled = true; + atomic_inc(&drvdata->config.enable_req_count); +- spin_unlock(&drvdata->spinlock); ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); + return rc; + + cti_state_unchanged: +@@ -132,7 +118,7 @@ static int cti_enable_hw(struct cti_drvdata *drvdata) + + /* cannot enable due to error */ + cti_err_not_enabled: +- spin_unlock(&drvdata->spinlock); ++ spin_unlock_irqrestore(&drvdata->spinlock, flags); + pm_runtime_put(dev->parent); + return rc; + } +-- +2.25.1 + diff --git a/queue-5.8/coresight-etm-perf-fix-warning-caused-by-etm_setup_a.patch b/queue-5.8/coresight-etm-perf-fix-warning-caused-by-etm_setup_a.patch new file mode 100644 index 00000000000..9df952dea09 --- /dev/null +++ b/queue-5.8/coresight-etm-perf-fix-warning-caused-by-etm_setup_a.patch @@ -0,0 +1,47 @@ +From 77af4be6c6de104b0a4287b3eefc3a9abd9db533 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 10:34:56 -0600 +Subject: coresight: etm: perf: Fix warning caused by etm_setup_aux failure + +From: Tingwei Zhang + +[ Upstream commit 716f5652a13122364a65e694386b9b26f5e98c51 ] + +When coresight_build_path() fails on all the cpus, etm_setup_aux +calls etm_free_aux() to free allocated event_data. +WARN_ON(cpumask_empty(mask) will be triggered since cpu mask is empty. +Check event_data->snk_config is not NULL first to avoid this +warning. + +Fixes: f5200aa9831f38 ("coresight: perf: Refactor function free_event_data()") +Reviewed-by: Mike Leach +Reviewed-by: Suzuki K Poulose +Signed-off-by: Tingwei Zhang +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200928163513.70169-9-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm-perf.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c +index c4b9898e28418..9b0c5d719232f 100644 +--- a/drivers/hwtracing/coresight/coresight-etm-perf.c ++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c +@@ -126,10 +126,10 @@ static void free_sink_buffer(struct etm_event_data *event_data) + cpumask_t *mask = &event_data->mask; + struct coresight_device *sink; + +- if (WARN_ON(cpumask_empty(mask))) ++ if (!event_data->snk_config) + return; + +- if (!event_data->snk_config) ++ if (WARN_ON(cpumask_empty(mask))) + return; + + cpu = cpumask_first(mask); +-- +2.25.1 + diff --git a/queue-5.8/coresight-etm4x-ensure-default-perf-settings-filter-.patch b/queue-5.8/coresight-etm4x-ensure-default-perf-settings-filter-.patch new file mode 100644 index 00000000000..b9d45e4ce82 --- /dev/null +++ b/queue-5.8/coresight-etm4x-ensure-default-perf-settings-filter-.patch @@ -0,0 +1,124 @@ +From 8e1369448ae36ac47b99cc6e7e0f11429fccf3d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 13:17:28 -0600 +Subject: coresight: etm4x: Ensure default perf settings filter user/kernel + +From: Mike Leach + +[ Upstream commit 096dcfb9cd6fefa7c03884b50c247593dc5f7dd3 ] + +Moving from using an address filter to trace the default "all addresses" +range to no filtering to acheive the same result, has caused the perf +filtering of kernel/user address spaces from not working unless an +explicit address filter was used. + +This is due to the original code using a side-effect of the address +filtering rather than setting the global TRCVICTLR exception level +filtering. + +The use of the mode sysfs file is also similarly affected. + +A helper function is added to fix both instances. + +Fixes: ae2041510d5d ("coresight: etmv4: Update default filter and initialisation") +Reported-by: Leo Yan +Tested-by: Leo Yan +Reviewed-by: Leo Yan +Signed-off-by: Mike Leach +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200916191737.4001561-8-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x.c | 32 +++++++++++++------ + drivers/hwtracing/coresight/coresight-etm4x.h | 3 ++ + 2 files changed, 25 insertions(+), 10 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c +index a970bd17edf8d..7a247273b7e0a 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x.c +@@ -52,6 +52,7 @@ static struct etmv4_drvdata *etmdrvdata[NR_CPUS]; + static void etm4_set_default_config(struct etmv4_config *config); + static int etm4_set_event_filters(struct etmv4_drvdata *drvdata, + struct perf_event *event); ++static u64 etm4_get_access_type(struct etmv4_config *config); + + static enum cpuhp_state hp_online; + +@@ -779,6 +780,22 @@ static void etm4_init_arch_data(void *info) + CS_LOCK(drvdata->base); + } + ++/* Set ELx trace filter access in the TRCVICTLR register */ ++static void etm4_set_victlr_access(struct etmv4_config *config) ++{ ++ u64 access_type; ++ ++ config->vinst_ctrl &= ~(ETM_EXLEVEL_S_VICTLR_MASK | ETM_EXLEVEL_NS_VICTLR_MASK); ++ ++ /* ++ * TRCVICTLR::EXLEVEL_NS:EXLEVELS: Set kernel / user filtering ++ * bits in vinst_ctrl, same bit pattern as TRCACATRn values returned by ++ * etm4_get_access_type() but with a relative shift in this register. ++ */ ++ access_type = etm4_get_access_type(config) << ETM_EXLEVEL_LSHIFT_TRCVICTLR; ++ config->vinst_ctrl |= (u32)access_type; ++} ++ + static void etm4_set_default_config(struct etmv4_config *config) + { + /* disable all events tracing */ +@@ -796,6 +813,9 @@ static void etm4_set_default_config(struct etmv4_config *config) + + /* TRCVICTLR::EVENT = 0x01, select the always on logic */ + config->vinst_ctrl = BIT(0); ++ ++ /* TRCVICTLR::EXLEVEL_NS:EXLEVELS: Set kernel / user filtering */ ++ etm4_set_victlr_access(config); + } + + static u64 etm4_get_ns_access_type(struct etmv4_config *config) +@@ -1060,7 +1080,7 @@ static int etm4_set_event_filters(struct etmv4_drvdata *drvdata, + + void etm4_config_trace_mode(struct etmv4_config *config) + { +- u32 addr_acc, mode; ++ u32 mode; + + mode = config->mode; + mode &= (ETM_MODE_EXCL_KERN | ETM_MODE_EXCL_USER); +@@ -1072,15 +1092,7 @@ void etm4_config_trace_mode(struct etmv4_config *config) + if (!(mode & ETM_MODE_EXCL_KERN) && !(mode & ETM_MODE_EXCL_USER)) + return; + +- addr_acc = config->addr_acc[ETM_DEFAULT_ADDR_COMP]; +- /* clear default config */ +- addr_acc &= ~(ETM_EXLEVEL_NS_APP | ETM_EXLEVEL_NS_OS | +- ETM_EXLEVEL_NS_HYP); +- +- addr_acc |= etm4_get_ns_access_type(config); +- +- config->addr_acc[ETM_DEFAULT_ADDR_COMP] = addr_acc; +- config->addr_acc[ETM_DEFAULT_ADDR_COMP + 1] = addr_acc; ++ etm4_set_victlr_access(config); + } + + static int etm4_online_cpu(unsigned int cpu) +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.h b/drivers/hwtracing/coresight/coresight-etm4x.h +index 47729e04aac72..ab38f9afd821a 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.h ++++ b/drivers/hwtracing/coresight/coresight-etm4x.h +@@ -192,6 +192,9 @@ + #define ETM_EXLEVEL_NS_HYP BIT(14) + #define ETM_EXLEVEL_NS_NA BIT(15) + ++/* access level control in TRCVICTLR - same bits as TRCACATRn but shifted */ ++#define ETM_EXLEVEL_LSHIFT_TRCVICTLR 8 ++ + /* secure / non secure masks - TRCVICTLR, IDR3 */ + #define ETM_EXLEVEL_S_VICTLR_MASK GENMASK(19, 16) + /* NS MON (EL3) mode never implemented */ +-- +2.25.1 + diff --git a/queue-5.8/coresight-etm4x-fix-etm4_count-race-by-moving-cpuhp-.patch b/queue-5.8/coresight-etm4x-fix-etm4_count-race-by-moving-cpuhp-.patch new file mode 100644 index 00000000000..2a83f337d86 --- /dev/null +++ b/queue-5.8/coresight-etm4x-fix-etm4_count-race-by-moving-cpuhp-.patch @@ -0,0 +1,178 @@ +From 08e0d0f60e0856e22219f5a01fbccbb7e1258113 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 13:17:22 -0600 +Subject: coresight: etm4x: Fix etm4_count race by moving cpuhp callbacks to + init + +From: Sai Prakash Ranjan + +[ Upstream commit 2d1a8bfb61ec0177343e99ebd745e3e4ceb0d0d5 ] + +etm4_count keeps track of number of ETMv4 registered and on some systems, +a race is observed on etm4_count variable which can lead to multiple calls +to cpuhp_setup_state_nocalls_cpuslocked(). This function internally calls +cpuhp_store_callbacks() which prevents multiple registrations of callbacks +for a given state and due to this race, it returns -EBUSY leading to ETM +probe failures like below. + + coresight-etm4x: probe of 7040000.etm failed with error -16 + +This race can easily be triggered with async probe by setting probe type +as PROBE_PREFER_ASYNCHRONOUS and with ETM power management property +"arm,coresight-loses-context-with-cpu". + +Prevent this race by moving cpuhp callbacks to etm driver init since the +cpuhp callbacks doesn't have to depend on the etm4_count and can be once +setup during driver init. Similarly we move cpu_pm notifier registration +to driver init and completely remove etm4_count usage. Also now we can +use non cpuslocked version of cpuhp callbacks with this movement. + +Fixes: 9b6a3f3633a5 ("coresight: etmv4: Fix CPU power management setup in probe() function") +Fixes: 58eb457be028 ("hwtracing/coresight-etm4x: Convert to hotplug state machine") +Suggested-by: Suzuki K Poulose +Tested-by: Stephen Boyd +Reviewed-by: Stephen Boyd +Reviewed-by: Suzuki K Poulose +Signed-off-by: Sai Prakash Ranjan +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200916191737.4001561-2-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x.c | 65 +++++++++---------- + 1 file changed, 31 insertions(+), 34 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c +index 6089c481f8f19..a970bd17edf8d 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x.c +@@ -48,8 +48,6 @@ module_param(pm_save_enable, int, 0444); + MODULE_PARM_DESC(pm_save_enable, + "Save/restore state on power down: 1 = never, 2 = self-hosted"); + +-/* The number of ETMv4 currently registered */ +-static int etm4_count; + static struct etmv4_drvdata *etmdrvdata[NR_CPUS]; + static void etm4_set_default_config(struct etmv4_config *config); + static int etm4_set_event_filters(struct etmv4_drvdata *drvdata, +@@ -1394,28 +1392,25 @@ static struct notifier_block etm4_cpu_pm_nb = { + .notifier_call = etm4_cpu_pm_notify, + }; + +-/* Setup PM. Called with cpus locked. Deals with error conditions and counts */ +-static int etm4_pm_setup_cpuslocked(void) ++/* Setup PM. Deals with error conditions and counts */ ++static int __init etm4_pm_setup(void) + { + int ret; + +- if (etm4_count++) +- return 0; +- + ret = cpu_pm_register_notifier(&etm4_cpu_pm_nb); + if (ret) +- goto reduce_count; ++ return ret; + +- ret = cpuhp_setup_state_nocalls_cpuslocked(CPUHP_AP_ARM_CORESIGHT_STARTING, +- "arm/coresight4:starting", +- etm4_starting_cpu, etm4_dying_cpu); ++ ret = cpuhp_setup_state_nocalls(CPUHP_AP_ARM_CORESIGHT_STARTING, ++ "arm/coresight4:starting", ++ etm4_starting_cpu, etm4_dying_cpu); + + if (ret) + goto unregister_notifier; + +- ret = cpuhp_setup_state_nocalls_cpuslocked(CPUHP_AP_ONLINE_DYN, +- "arm/coresight4:online", +- etm4_online_cpu, NULL); ++ ret = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN, ++ "arm/coresight4:online", ++ etm4_online_cpu, NULL); + + /* HP dyn state ID returned in ret on success */ + if (ret > 0) { +@@ -1424,21 +1419,15 @@ static int etm4_pm_setup_cpuslocked(void) + } + + /* failed dyn state - remove others */ +- cpuhp_remove_state_nocalls_cpuslocked(CPUHP_AP_ARM_CORESIGHT_STARTING); ++ cpuhp_remove_state_nocalls(CPUHP_AP_ARM_CORESIGHT_STARTING); + + unregister_notifier: + cpu_pm_unregister_notifier(&etm4_cpu_pm_nb); +- +-reduce_count: +- --etm4_count; + return ret; + } + +-static void etm4_pm_clear(void) ++static void __init etm4_pm_clear(void) + { +- if (--etm4_count != 0) +- return; +- + cpu_pm_unregister_notifier(&etm4_cpu_pm_nb); + cpuhp_remove_state_nocalls(CPUHP_AP_ARM_CORESIGHT_STARTING); + if (hp_online) { +@@ -1491,22 +1480,12 @@ static int etm4_probe(struct amba_device *adev, const struct amba_id *id) + if (!desc.name) + return -ENOMEM; + +- cpus_read_lock(); + etmdrvdata[drvdata->cpu] = drvdata; + + if (smp_call_function_single(drvdata->cpu, + etm4_init_arch_data, drvdata, 1)) + dev_err(dev, "ETM arch init failed\n"); + +- ret = etm4_pm_setup_cpuslocked(); +- cpus_read_unlock(); +- +- /* etm4_pm_setup_cpuslocked() does its own cleanup - exit on error */ +- if (ret) { +- etmdrvdata[drvdata->cpu] = NULL; +- return ret; +- } +- + if (etm4_arch_supported(drvdata->arch) == false) { + ret = -EINVAL; + goto err_arch_supported; +@@ -1553,7 +1532,6 @@ static int etm4_probe(struct amba_device *adev, const struct amba_id *id) + + err_arch_supported: + etmdrvdata[drvdata->cpu] = NULL; +- etm4_pm_clear(); + return ret; + } + +@@ -1591,4 +1569,23 @@ static struct amba_driver etm4x_driver = { + .probe = etm4_probe, + .id_table = etm4_ids, + }; +-builtin_amba_driver(etm4x_driver); ++ ++static int __init etm4x_init(void) ++{ ++ int ret; ++ ++ ret = etm4_pm_setup(); ++ ++ /* etm4_pm_setup() does its own cleanup - exit on error */ ++ if (ret) ++ return ret; ++ ++ ret = amba_driver_register(&etm4x_driver); ++ if (ret) { ++ pr_err("Error registering etm4x driver\n"); ++ etm4_pm_clear(); ++ } ++ ++ return ret; ++} ++device_initcall(etm4x_init); +-- +2.25.1 + diff --git a/queue-5.8/coresight-etm4x-fix-issues-on-trcseqevr-access.patch b/queue-5.8/coresight-etm4x-fix-issues-on-trcseqevr-access.patch new file mode 100644 index 00000000000..ce92d453867 --- /dev/null +++ b/queue-5.8/coresight-etm4x-fix-issues-on-trcseqevr-access.patch @@ -0,0 +1,52 @@ +From f7e4b81ebf480d4a72dbacded0fdbc7bb7cc090e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 13:17:32 -0600 +Subject: coresight: etm4x: Fix issues on trcseqevr access + +From: Jonathan Zhou + +[ Upstream commit 4cd83037cd957ad97756055355ab4ee63f259380 ] + +The TRCSEQEVR(3) is reserved, using '@nrseqstate - 1' instead to avoid +accessing the reserved register. + +Fixes: f188b5e76aae ("coresight: etm4x: Save/restore state across CPU low power states") +Cc: Mathieu Poirier +Cc: Suzuki K Poulose +Cc: Mike Leach +Cc: Shaokun Zhang +Signed-off-by: Jonathan Zhou +[Fixed capital letter in title] +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200916191737.4001561-12-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c +index 7a247273b7e0a..d6395aeffd99d 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x.c +@@ -1189,7 +1189,7 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata) + state->trcvdsacctlr = readl(drvdata->base + TRCVDSACCTLR); + state->trcvdarcctlr = readl(drvdata->base + TRCVDARCCTLR); + +- for (i = 0; i < drvdata->nrseqstate; i++) ++ for (i = 0; i < drvdata->nrseqstate - 1; i++) + state->trcseqevr[i] = readl(drvdata->base + TRCSEQEVRn(i)); + + state->trcseqrstevr = readl(drvdata->base + TRCSEQRSTEVR); +@@ -1294,7 +1294,7 @@ static void etm4_cpu_restore(struct etmv4_drvdata *drvdata) + writel_relaxed(state->trcvdsacctlr, drvdata->base + TRCVDSACCTLR); + writel_relaxed(state->trcvdarcctlr, drvdata->base + TRCVDARCCTLR); + +- for (i = 0; i < drvdata->nrseqstate; i++) ++ for (i = 0; i < drvdata->nrseqstate - 1; i++) + writel_relaxed(state->trcseqevr[i], + drvdata->base + TRCSEQEVRn(i)); + +-- +2.25.1 + diff --git a/queue-5.8/coresight-etm4x-fix-issues-within-reset-interface-of.patch b/queue-5.8/coresight-etm4x-fix-issues-within-reset-interface-of.patch new file mode 100644 index 00000000000..3ac3bb3df02 --- /dev/null +++ b/queue-5.8/coresight-etm4x-fix-issues-within-reset-interface-of.patch @@ -0,0 +1,42 @@ +From 744add5913101add4e6f9c67a241e22bb816e27a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 13:17:29 -0600 +Subject: coresight: etm4x: Fix issues within reset interface of sysfs + +From: Jonathan Zhou + +[ Upstream commit 4020fc8d4658dc1dbc27c5644bcb6254caa05e5e ] + +The member @nr_addr_cmp is not a bool value, using operator '>' +instead to avoid unexpected failure. + +Fixes: a77de2637c9e ("coresight: etm4x: moving sysFS entries to a dedicated file") +Cc: Mathieu Poirier +Cc: Suzuki K Poulose +Cc: Mike Leach +Cc: Shaokun Zhang +Signed-off-by: Jonathan Zhou +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200916191737.4001561-9-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x-sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +index b673e738bc9a8..a588cd6de01c7 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +@@ -206,7 +206,7 @@ static ssize_t reset_store(struct device *dev, + * each trace run. + */ + config->vinst_ctrl = BIT(0); +- if (drvdata->nr_addr_cmp == true) { ++ if (drvdata->nr_addr_cmp > 0) { + config->mode |= ETM_MODE_VIEWINST_STARTSTOP; + /* SSSTATUS, bit[9] */ + config->vinst_ctrl |= BIT(9); +-- +2.25.1 + diff --git a/queue-5.8/coresight-etm4x-fix-save-and-restore-of-trcvmidcctlr.patch b/queue-5.8/coresight-etm4x-fix-save-and-restore-of-trcvmidcctlr.patch new file mode 100644 index 00000000000..33e34e456e9 --- /dev/null +++ b/queue-5.8/coresight-etm4x-fix-save-and-restore-of-trcvmidcctlr.patch @@ -0,0 +1,53 @@ +From 1cfa6c6d962a21d280e4b3b8172082b58a8b1a02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 10:35:13 -0600 +Subject: coresight: etm4x: Fix save and restore of TRCVMIDCCTLR1 register + +From: Sai Prakash Ranjan + +[ Upstream commit 3477326277451000bc667dfcc4fd0774c039184c ] + +In commit f188b5e76aae ("coresight: etm4x: Save/restore state +across CPU low power states"), mistakenly TRCVMIDCCTLR1 register +value was saved in trcvmidcctlr0 state variable which is used to +store TRCVMIDCCTLR0 register value in etm4x_cpu_save() and then +same value is written back to both TRCVMIDCCTLR0 and TRCVMIDCCTLR1 +in etm4x_cpu_restore(). There is already a trcvmidcctlr1 state +variable available for TRCVMIDCCTLR1, so use it. + +Fixes: f188b5e76aae ("coresight: etm4x: Save/restore state across CPU low power states") +Reviewed-by: Suzuki K Poulose +Signed-off-by: Sai Prakash Ranjan +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200928163513.70169-26-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm4x.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c b/drivers/hwtracing/coresight/coresight-etm4x.c +index d6395aeffd99d..d4e74b03c1e0f 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x.c +@@ -1233,7 +1233,7 @@ static int etm4_cpu_save(struct etmv4_drvdata *drvdata) + state->trccidcctlr1 = readl(drvdata->base + TRCCIDCCTLR1); + + state->trcvmidcctlr0 = readl(drvdata->base + TRCVMIDCCTLR0); +- state->trcvmidcctlr0 = readl(drvdata->base + TRCVMIDCCTLR1); ++ state->trcvmidcctlr1 = readl(drvdata->base + TRCVMIDCCTLR1); + + state->trcclaimset = readl(drvdata->base + TRCCLAIMCLR); + +@@ -1343,7 +1343,7 @@ static void etm4_cpu_restore(struct etmv4_drvdata *drvdata) + writel_relaxed(state->trccidcctlr1, drvdata->base + TRCCIDCCTLR1); + + writel_relaxed(state->trcvmidcctlr0, drvdata->base + TRCVMIDCCTLR0); +- writel_relaxed(state->trcvmidcctlr0, drvdata->base + TRCVMIDCCTLR1); ++ writel_relaxed(state->trcvmidcctlr1, drvdata->base + TRCVMIDCCTLR1); + + writel_relaxed(state->trcclaimset, drvdata->base + TRCCLAIMSET); + +-- +2.25.1 + diff --git a/queue-5.8/coresight-etm4x-handle-unreachable-sink-in-perf-mode.patch b/queue-5.8/coresight-etm4x-handle-unreachable-sink-in-perf-mode.patch new file mode 100644 index 00000000000..2976ec25ec7 --- /dev/null +++ b/queue-5.8/coresight-etm4x-handle-unreachable-sink-in-perf-mode.patch @@ -0,0 +1,120 @@ +From d4757a22122fc50ac31a0adf637a67b7f4a9ff8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 13:17:31 -0600 +Subject: coresight: etm4x: Handle unreachable sink in perf mode + +From: Suzuki K Poulose + +[ Upstream commit 859d510e58dac94f0b204b7b5cccafbc130d2291 ] + +If the specified/hinted sink is not reachable from a subset of the CPUs, +we could end up unable to trace the event on those CPUs. This +is the best effort we could do until we support 1:1 configurations. +Fail gracefully in such cases avoiding a WARN_ON, which can be easily +triggered by the user on certain platforms (Arm N1SDP), with the following +trace paths : + + CPU0 + \ + -- Funnel0 --> ETF0 --> + / \ + CPU1 \ + MainFunnel + CPU2 / + \ / + -- Funnel1 --> ETF1 --> + / + CPU1 + +$ perf record --per-thread -e cs_etm/@ETF0/u -- + +could trigger the following WARNING, when the event is scheduled +on CPU2. + +[10919.513250] ------------[ cut here ]------------ +[10919.517861] WARNING: CPU: 2 PID: 24021 at +drivers/hwtracing/coresight/coresight-etm-perf.c:316 etm_event_start+0xf8/0x100 +... + +[10919.564403] CPU: 2 PID: 24021 Comm: perf Not tainted 5.8.0+ #24 +[10919.570308] pstate: 80400089 (Nzcv daIf +PAN -UAO BTYPE=--) +[10919.575865] pc : etm_event_start+0xf8/0x100 +[10919.580034] lr : etm_event_start+0x80/0x100 +[10919.584202] sp : fffffe001932f940 +[10919.587502] x29: fffffe001932f940 x28: fffffc834995f800 +[10919.592799] x27: 0000000000000000 x26: fffffe0011f3ced0 +[10919.598095] x25: fffffc837fce244c x24: fffffc837fce2448 +[10919.603391] x23: 0000000000000002 x22: fffffc8353529c00 +[10919.608688] x21: fffffc835bb31000 x20: 0000000000000000 +[10919.613984] x19: fffffc837fcdcc70 x18: 0000000000000000 +[10919.619281] x17: 0000000000000000 x16: 0000000000000000 +[10919.624577] x15: 0000000000000000 x14: 00000000000009f8 +[10919.629874] x13: 00000000000009f8 x12: 0000000000000018 +[10919.635170] x11: 0000000000000000 x10: 0000000000000000 +[10919.640467] x9 : fffffe00108cd168 x8 : 0000000000000000 +[10919.645763] x7 : 0000000000000020 x6 : 0000000000000001 +[10919.651059] x5 : 0000000000000002 x4 : 0000000000000001 +[10919.656356] x3 : 0000000000000000 x2 : 0000000000000000 +[10919.661652] x1 : fffffe836eb40000 x0 : 0000000000000000 +[10919.666949] Call trace: +[10919.669382] etm_event_start+0xf8/0x100 +[10919.673203] etm_event_add+0x40/0x60 +[10919.676765] event_sched_in.isra.134+0xcc/0x210 +[10919.681281] merge_sched_in+0xb0/0x2a8 +[10919.685017] visit_groups_merge.constprop.140+0x15c/0x4b8 +[10919.690400] ctx_sched_in+0x15c/0x170 +[10919.694048] perf_event_sched_in+0x6c/0xa0 +[10919.698130] ctx_resched+0x60/0xa0 +[10919.701517] perf_event_exec+0x288/0x2f0 +[10919.705425] begin_new_exec+0x4c8/0xf58 +[10919.709247] load_elf_binary+0x66c/0xf30 +[10919.713155] exec_binprm+0x15c/0x450 +[10919.716716] __do_execve_file+0x508/0x748 +[10919.720711] __arm64_sys_execve+0x40/0x50 +[10919.724707] do_el0_svc+0xf4/0x1b8 +[10919.728095] el0_sync_handler+0xf8/0x124 +[10919.732003] el0_sync+0x140/0x180 + +Even though we don't support using separate sinks for the ETMs yet (e.g, +for 1:1 configurations), we should at least honor the user's choice and +handle the limitations gracefully, by simply skipping the tracing on ETMs +which can't reach the requested sink. + +Fixes: f9d81a657bb8 ("coresight: perf: Allow tracing on hotplugged CPUs") +Cc: Mathieu Poirier +Cc: Mike Leach +Reported-by: Jeremy Linton +Tested-by: Jeremy Linton +Signed-off-by: Suzuki K Poulose +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200916191737.4001561-11-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-etm-perf.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c +index 84f1dcb698272..c4b9898e28418 100644 +--- a/drivers/hwtracing/coresight/coresight-etm-perf.c ++++ b/drivers/hwtracing/coresight/coresight-etm-perf.c +@@ -310,6 +310,16 @@ static void etm_event_start(struct perf_event *event, int flags) + if (!event_data) + goto fail; + ++ /* ++ * Check if this ETM is allowed to trace, as decided ++ * at etm_setup_aux(). This could be due to an unreachable ++ * sink from this ETM. We can't do much in this case if ++ * the sink was specified or hinted to the driver. For ++ * now, simply don't record anything on this ETM. ++ */ ++ if (!cpumask_test_cpu(cpu, &event_data->mask)) ++ goto fail_end_stop; ++ + path = etm_event_cpu_path(event_data, cpu); + /* We need a sink, no need to continue without one */ + sink = coresight_get_sink(path); +-- +2.25.1 + diff --git a/queue-5.8/coresight-fix-offset-by-one-error-in-counting-ports.patch b/queue-5.8/coresight-fix-offset-by-one-error-in-counting-ports.patch new file mode 100644 index 00000000000..202f9190428 --- /dev/null +++ b/queue-5.8/coresight-fix-offset-by-one-error-in-counting-ports.patch @@ -0,0 +1,105 @@ +From babd51b35e41c001ecb83046aaa239ec52d4c5fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 13:17:24 -0600 +Subject: coresight: fix offset by one error in counting ports + +From: Mian Yousaf Kaukab + +[ Upstream commit 9554c3551ed35d79b029e5e69383ae33117d9765 ] + +Since port-numbers start from 0, add 1 to port-number to get the port +count. + +Fix following crash when Coresight is enabled on ACPI based systems: + +[ 61.061736] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000008 +... +[ 61.135494] pc : acpi_coresight_parse_graph+0x1c4/0x37c +[ 61.140705] lr : acpi_coresight_parse_graph+0x160/0x37c +[ 61.145915] sp : ffff800012f4ba40 +[ 61.145917] x29: ffff800012f4ba40 x28: ffff00becce62f98 +[ 61.159896] x27: 0000000000000005 x26: ffff00becd8a7c88 +[ 61.165195] x25: ffff00becd8a7d88 x24: ffff00becce62f80 +[ 61.170492] x23: ffff800011ef99c0 x22: ffff009efb8bc010 +[ 61.175790] x21: 0000000000000018 x20: 0000000000000005 +[ 61.181087] x19: ffff00becce62e80 x18: 0000000000000020 +[ 61.186385] x17: 0000000000000001 x16: 00000000000002a8 +[ 61.191682] x15: ffff000838648550 x14: ffffffffffffffff +[ 61.196980] x13: 0000000000000000 x12: ffff00becce62d87 +[ 61.202277] x11: 00000000ffffff76 x10: 000000000000002e +[ 61.207575] x9 : ffff8000107e1a68 x8 : ffff00becce63000 +[ 61.212873] x7 : 0000000000000018 x6 : 000000000000003f +[ 61.218170] x5 : 0000000000000000 x4 : 0000000000000000 +[ 61.223467] x3 : 0000000000000000 x2 : 0000000000000000 +[ 61.228764] x1 : ffff00becce62f80 x0 : 0000000000000000 +[ 61.234062] Call trace: +[ 61.236497] acpi_coresight_parse_graph+0x1c4/0x37c +[ 61.241361] coresight_get_platform_data+0xdc/0x130 +[ 61.246225] tmc_probe+0x138/0x2dc +[ 61.246227] amba_probe+0xdc/0x220 +[ 61.255779] really_probe+0xe8/0x49c +[ 61.255781] driver_probe_device+0xec/0x140 +[ 61.255782] device_driver_attach+0xc8/0xd0 +[ 61.255785] __driver_attach+0xac/0x180 +[ 61.265857] bus_for_each_dev+0x78/0xcc +[ 61.265859] driver_attach+0x2c/0x40 +[ 61.265861] bus_add_driver+0x150/0x244 +[ 61.265863] driver_register+0x80/0x13c +[ 61.273591] amba_driver_register+0x60/0x70 +[ 61.273594] tmc_driver_init+0x20/0x2c +[ 61.281582] do_one_initcall+0x50/0x230 +[ 61.281585] do_initcalls+0x104/0x144 +[ 61.291831] kernel_init_freeable+0x168/0x1dc +[ 61.291834] kernel_init+0x1c/0x120 +[ 61.299215] ret_from_fork+0x10/0x18 +[ 61.299219] Code: b9400022 f9400660 9b277c42 8b020000 (f9400404) +[ 61.307381] ---[ end trace 63c6c3d7ec6a9b7c ]--- +[ 61.315225] Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b + +Fixes: d375b356e687 ("coresight: Fix support for sparsely populated ports") +Reported-by: Ruediger Oertel +Tested-by: Jeremy Linton +Reviewed-by: Suzuki K Poulose +Reviewed-by: Jeremy Linton +Signed-off-by: Mian Yousaf Kaukab +Signed-off-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200916191737.4001561-4-mathieu.poirier@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/coresight/coresight-platform.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/hwtracing/coresight/coresight-platform.c b/drivers/hwtracing/coresight/coresight-platform.c +index e4912abda3aa2..85a6c099ddeb1 100644 +--- a/drivers/hwtracing/coresight/coresight-platform.c ++++ b/drivers/hwtracing/coresight/coresight-platform.c +@@ -712,11 +712,11 @@ static int acpi_coresight_parse_graph(struct acpi_device *adev, + return dir; + + if (dir == ACPI_CORESIGHT_LINK_MASTER) { +- if (ptr->outport > pdata->nr_outport) +- pdata->nr_outport = ptr->outport; ++ if (ptr->outport >= pdata->nr_outport) ++ pdata->nr_outport = ptr->outport + 1; + ptr++; + } else { +- WARN_ON(pdata->nr_inport == ptr->child_port); ++ WARN_ON(pdata->nr_inport == ptr->child_port + 1); + /* + * We do not track input port connections for a device. + * However we need the highest port number described, +@@ -724,8 +724,8 @@ static int acpi_coresight_parse_graph(struct acpi_device *adev, + * record for an output connection. Hence, do not move + * the ptr for input connections + */ +- if (ptr->child_port > pdata->nr_inport) +- pdata->nr_inport = ptr->child_port; ++ if (ptr->child_port >= pdata->nr_inport) ++ pdata->nr_inport = ptr->child_port + 1; + } + } + +-- +2.25.1 + diff --git a/queue-5.8/cpufreq-armada-37xx-add-missing-module_device_table.patch b/queue-5.8/cpufreq-armada-37xx-add-missing-module_device_table.patch new file mode 100644 index 00000000000..4d390d25f51 --- /dev/null +++ b/queue-5.8/cpufreq-armada-37xx-add-missing-module_device_table.patch @@ -0,0 +1,47 @@ +From 931976febca77465c676d06919162a0c8abcfc19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 15:27:16 +0200 +Subject: cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit c942d1542f1bc5001216fabce9cb8ffbe515777e ] + +CONFIG_ARM_ARMADA_37XX_CPUFREQ is tristate option and therefore this +cpufreq driver can be compiled as a module. This patch adds missing +MODULE_DEVICE_TABLE which generates correct modalias for automatic +loading of this cpufreq driver when is compiled as an external module. + +Reviewed-by: Andrew Lunn +Signed-off-by: Pali Rohár +Fixes: 92ce45fb875d7 ("cpufreq: Add DVFS support for Armada 37xx") +[ Viresh: Added __maybe_unused ] +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-37xx-cpufreq.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/cpufreq/armada-37xx-cpufreq.c b/drivers/cpufreq/armada-37xx-cpufreq.c +index df1c941260d14..b4af4094309b0 100644 +--- a/drivers/cpufreq/armada-37xx-cpufreq.c ++++ b/drivers/cpufreq/armada-37xx-cpufreq.c +@@ -484,6 +484,12 @@ static int __init armada37xx_cpufreq_driver_init(void) + /* late_initcall, to guarantee the driver is loaded after A37xx clock driver */ + late_initcall(armada37xx_cpufreq_driver_init); + ++static const struct of_device_id __maybe_unused armada37xx_cpufreq_of_match[] = { ++ { .compatible = "marvell,armada-3700-nb-pm" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, armada37xx_cpufreq_of_match); ++ + MODULE_AUTHOR("Gregory CLEMENT "); + MODULE_DESCRIPTION("Armada 37xx cpufreq driver"); + MODULE_LICENSE("GPL"); +-- +2.25.1 + diff --git a/queue-5.8/cpufreq-powernv-fix-frame-size-overflow-in-powernv_c.patch b/queue-5.8/cpufreq-powernv-fix-frame-size-overflow-in-powernv_c.patch new file mode 100644 index 00000000000..9e5f1147101 --- /dev/null +++ b/queue-5.8/cpufreq-powernv-fix-frame-size-overflow-in-powernv_c.patch @@ -0,0 +1,52 @@ +From 0ba72ba0a5e9f1e5ec7b1b61b3de320d31cf4a25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Sep 2020 13:32:54 +0530 +Subject: cpufreq: powernv: Fix frame-size-overflow in + powernv_cpufreq_reboot_notifier + +From: Srikar Dronamraju + +[ Upstream commit a2d0230b91f7e23ceb5d8fb6a9799f30517ec33a ] + +The patch avoids allocating cpufreq_policy on stack hence fixing frame +size overflow in 'powernv_cpufreq_reboot_notifier': + + drivers/cpufreq/powernv-cpufreq.c: In function powernv_cpufreq_reboot_notifier: + drivers/cpufreq/powernv-cpufreq.c:906:1: error: the frame size of 2064 bytes is larger than 2048 bytes + +Fixes: cf30af76 ("cpufreq: powernv: Set the cpus to nominal frequency during reboot/kexec") +Signed-off-by: Srikar Dronamraju +Reviewed-by: Daniel Axtens +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200922080254.41497-1-srikar@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/powernv-cpufreq.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c +index 8646eb197cd96..31f5c4ebbac9f 100644 +--- a/drivers/cpufreq/powernv-cpufreq.c ++++ b/drivers/cpufreq/powernv-cpufreq.c +@@ -884,12 +884,15 @@ static int powernv_cpufreq_reboot_notifier(struct notifier_block *nb, + unsigned long action, void *unused) + { + int cpu; +- struct cpufreq_policy cpu_policy; ++ struct cpufreq_policy *cpu_policy; + + rebooting = true; + for_each_online_cpu(cpu) { +- cpufreq_get_policy(&cpu_policy, cpu); +- powernv_cpufreq_target_index(&cpu_policy, get_nominal_index()); ++ cpu_policy = cpufreq_cpu_get(cpu); ++ if (!cpu_policy) ++ continue; ++ powernv_cpufreq_target_index(cpu_policy, get_nominal_index()); ++ cpufreq_cpu_put(cpu_policy); + } + + return NOTIFY_DONE; +-- +2.25.1 + diff --git a/queue-5.8/crypto-algif_skcipher-ebusy-on-aio-should-be-an-erro.patch b/queue-5.8/crypto-algif_skcipher-ebusy-on-aio-should-be-an-erro.patch new file mode 100644 index 00000000000..af5cd0d8174 --- /dev/null +++ b/queue-5.8/crypto-algif_skcipher-ebusy-on-aio-should-be-an-erro.patch @@ -0,0 +1,37 @@ +From bd06fcefa1ae2eb5e114a740a587d3c034471a8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 17:03:27 +1000 +Subject: crypto: algif_skcipher - EBUSY on aio should be an error + +From: Herbert Xu + +[ Upstream commit 2a05b029c1ee045b886ebf9efef9985ca23450de ] + +I removed the MAY_BACKLOG flag on the aio path a while ago but +the error check still incorrectly interpreted EBUSY as success. +This may cause the submitter to wait for a request that will never +complete. + +Fixes: dad419970637 ("crypto: algif_skcipher - Do not set...") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/algif_skcipher.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c +index 81c4022285a7c..30069a92a9b22 100644 +--- a/crypto/algif_skcipher.c ++++ b/crypto/algif_skcipher.c +@@ -123,7 +123,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, + crypto_skcipher_decrypt(&areq->cra_u.skcipher_req); + + /* AIO operation in progress */ +- if (err == -EINPROGRESS || err == -EBUSY) ++ if (err == -EINPROGRESS) + return -EIOCBQUEUED; + + sock_put(sk); +-- +2.25.1 + diff --git a/queue-5.8/crypto-ccp-fix-error-handling.patch b/queue-5.8/crypto-ccp-fix-error-handling.patch new file mode 100644 index 00000000000..6ea2298552c --- /dev/null +++ b/queue-5.8/crypto-ccp-fix-error-handling.patch @@ -0,0 +1,35 @@ +From 568a84880f4e1435af3ebdf6d0b5701933b414c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 13:34:35 +0200 +Subject: crypto: ccp - fix error handling + +From: Pavel Machek + +[ Upstream commit e356c49c6cf0db3f00e1558749170bd56e47652d ] + +Fix resource leak in error handling. + +Signed-off-by: Pavel Machek (CIP) +Acked-by: John Allen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/ccp-ops.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c +index 64112c736810e..7234b95241e91 100644 +--- a/drivers/crypto/ccp/ccp-ops.c ++++ b/drivers/crypto/ccp/ccp-ops.c +@@ -1746,7 +1746,7 @@ ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd) + break; + default: + ret = -EINVAL; +- goto e_ctx; ++ goto e_data; + } + } else { + /* Stash the context */ +-- +2.25.1 + diff --git a/queue-5.8/crypto-ccree-fix-runtime-pm-imbalance-on-error.patch b/queue-5.8/crypto-ccree-fix-runtime-pm-imbalance-on-error.patch new file mode 100644 index 00000000000..cb1a7160105 --- /dev/null +++ b/queue-5.8/crypto-ccree-fix-runtime-pm-imbalance-on-error.patch @@ -0,0 +1,44 @@ +From 5b67672c4451832c429cba49bdc21df827f738fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 16:15:13 +0800 +Subject: crypto: ccree - fix runtime PM imbalance on error + +From: dinghao.liu@zju.edu.cn + +[ Upstream commit b7b57a5643c2ae45afe6aa5e73363b553cacd14b ] + +pm_runtime_get_sync() increments the runtime PM usage counter +even when it returns an error code. However, users of cc_pm_get(), +a direct wrapper of pm_runtime_get_sync(), assume that PM usage +counter will not change on error. Thus a pairing decrement is needed +on the error handling path to keep the counter balanced. + +Fixes: 8c7849a30255c ("crypto: ccree - simplify Runtime PM handling") +Signed-off-by: Dinghao Liu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccree/cc_pm.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/ccree/cc_pm.c b/drivers/crypto/ccree/cc_pm.c +index d39e1664fc7ed..3c65bf070c908 100644 +--- a/drivers/crypto/ccree/cc_pm.c ++++ b/drivers/crypto/ccree/cc_pm.c +@@ -65,8 +65,12 @@ const struct dev_pm_ops ccree_pm = { + int cc_pm_get(struct device *dev) + { + int rc = pm_runtime_get_sync(dev); ++ if (rc < 0) { ++ pm_runtime_put_noidle(dev); ++ return rc; ++ } + +- return (rc == 1 ? 0 : rc); ++ return 0; + } + + void cc_pm_put_suspend(struct device *dev) +-- +2.25.1 + diff --git a/queue-5.8/crypto-hisilicon-fixed-memory-allocation-error.patch b/queue-5.8/crypto-hisilicon-fixed-memory-allocation-error.patch new file mode 100644 index 00000000000..8923c96d636 --- /dev/null +++ b/queue-5.8/crypto-hisilicon-fixed-memory-allocation-error.patch @@ -0,0 +1,72 @@ +From 104177d16a20b2ccdc17ae6fded5514304b445f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 19:56:43 +0800 +Subject: crypto: hisilicon - fixed memory allocation error + +From: Longfang Liu + +[ Upstream commit 24efcec2919afa7d56f848c83a605b46c8042a53 ] + +1. Fix the bug of 'mac' memory leak as allocating 'pbuf' failing. +2. Fix the bug of 'qps' leak as allocating 'qp_ctx' failing. + +Signed-off-by: Longfang Liu +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/hisilicon/sec2/sec_crypto.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/crypto/hisilicon/sec2/sec_crypto.c b/drivers/crypto/hisilicon/sec2/sec_crypto.c +index 64614a9bdf219..047826f18bd35 100644 +--- a/drivers/crypto/hisilicon/sec2/sec_crypto.c ++++ b/drivers/crypto/hisilicon/sec2/sec_crypto.c +@@ -332,11 +332,14 @@ static int sec_alg_resource_alloc(struct sec_ctx *ctx, + ret = sec_alloc_pbuf_resource(dev, res); + if (ret) { + dev_err(dev, "fail to alloc pbuf dma resource!\n"); +- goto alloc_fail; ++ goto alloc_pbuf_fail; + } + } + + return 0; ++alloc_pbuf_fail: ++ if (ctx->alg_type == SEC_AEAD) ++ sec_free_mac_resource(dev, qp_ctx->res); + alloc_fail: + sec_free_civ_resource(dev, res); + +@@ -447,8 +450,10 @@ static int sec_ctx_base_init(struct sec_ctx *ctx) + ctx->fake_req_limit = QM_Q_DEPTH >> 1; + ctx->qp_ctx = kcalloc(sec->ctx_q_num, sizeof(struct sec_qp_ctx), + GFP_KERNEL); +- if (!ctx->qp_ctx) +- return -ENOMEM; ++ if (!ctx->qp_ctx) { ++ ret = -ENOMEM; ++ goto err_destroy_qps; ++ } + + for (i = 0; i < sec->ctx_q_num; i++) { + ret = sec_create_qp_ctx(&sec->qm, ctx, i, 0); +@@ -457,12 +462,15 @@ static int sec_ctx_base_init(struct sec_ctx *ctx) + } + + return 0; ++ + err_sec_release_qp_ctx: + for (i = i - 1; i >= 0; i--) + sec_release_qp_ctx(ctx, &ctx->qp_ctx[i]); + +- sec_destroy_qps(ctx->qps, sec->ctx_q_num); + kfree(ctx->qp_ctx); ++err_destroy_qps: ++ sec_destroy_qps(ctx->qps, sec->ctx_q_num); ++ + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.8/crypto-ixp4xx-fix-the-size-used-in-a-dma_free_cohere.patch b/queue-5.8/crypto-ixp4xx-fix-the-size-used-in-a-dma_free_cohere.patch new file mode 100644 index 00000000000..cdaaba64305 --- /dev/null +++ b/queue-5.8/crypto-ixp4xx-fix-the-size-used-in-a-dma_free_cohere.patch @@ -0,0 +1,36 @@ +From 7c8b093d9e0389e3a9ef0d0c3a0ce3855719c45e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 16:56:48 +0200 +Subject: crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call + +From: Christophe JAILLET + +[ Upstream commit f7ade9aaf66bd5599690acf0597df2c0f6cd825a ] + +Update the size used in 'dma_free_coherent()' in order to match the one +used in the corresponding 'dma_alloc_coherent()', in 'setup_crypt_desc()'. + +Fixes: 81bef0150074 ("crypto: ixp4xx - Hardware crypto support for IXP4xx CPUs") +Signed-off-by: Christophe JAILLET +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ixp4xx_crypto.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c +index ad73fc9466821..3be6e0db0f9fc 100644 +--- a/drivers/crypto/ixp4xx_crypto.c ++++ b/drivers/crypto/ixp4xx_crypto.c +@@ -528,7 +528,7 @@ static void release_ixp_crypto(struct device *dev) + + if (crypt_virt) { + dma_free_coherent(dev, +- NPE_QLEN_TOTAL * sizeof( struct crypt_ctl), ++ NPE_QLEN * sizeof(struct crypt_ctl), + crypt_virt, crypt_phys); + } + } +-- +2.25.1 + diff --git a/queue-5.8/crypto-mediatek-fix-wrong-return-value-in-mtk_desc_r.patch b/queue-5.8/crypto-mediatek-fix-wrong-return-value-in-mtk_desc_r.patch new file mode 100644 index 00000000000..52222ab3878 --- /dev/null +++ b/queue-5.8/crypto-mediatek-fix-wrong-return-value-in-mtk_desc_r.patch @@ -0,0 +1,46 @@ +From 31257cbcf5c85ab9d9cbb8bbb695b53f9cbc9939 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 19:15:32 +0800 +Subject: crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc() + +From: Tianjia Zhang + +[ Upstream commit 8cbde6c6a6d2b1599ff90f932304aab7e32fce89 ] + +In case of memory allocation failure, a negative error code should +be returned. + +Fixes: 785e5c616c849 ("crypto: mediatek - Add crypto driver support for some MediaTek chips") +Cc: Ryder Lee +Signed-off-by: Tianjia Zhang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/mediatek/mtk-platform.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/mediatek/mtk-platform.c b/drivers/crypto/mediatek/mtk-platform.c +index 7e3ad085b5bdd..ef4339e84d034 100644 +--- a/drivers/crypto/mediatek/mtk-platform.c ++++ b/drivers/crypto/mediatek/mtk-platform.c +@@ -442,7 +442,7 @@ static void mtk_desc_dma_free(struct mtk_cryp *cryp) + static int mtk_desc_ring_alloc(struct mtk_cryp *cryp) + { + struct mtk_ring **ring = cryp->ring; +- int i, err = ENOMEM; ++ int i; + + for (i = 0; i < MTK_RING_MAX; i++) { + ring[i] = kzalloc(sizeof(**ring), GFP_KERNEL); +@@ -476,7 +476,7 @@ static int mtk_desc_ring_alloc(struct mtk_cryp *cryp) + ring[i]->cmd_base, ring[i]->cmd_dma); + kfree(ring[i]); + } +- return err; ++ return -ENOMEM; + } + + static int mtk_crypto_probe(struct platform_device *pdev) +-- +2.25.1 + diff --git a/queue-5.8/crypto-omap-sham-fix-digcnt-register-handling-with-e.patch b/queue-5.8/crypto-omap-sham-fix-digcnt-register-handling-with-e.patch new file mode 100644 index 00000000000..801cf1784ae --- /dev/null +++ b/queue-5.8/crypto-omap-sham-fix-digcnt-register-handling-with-e.patch @@ -0,0 +1,39 @@ +From 3942b981d98c17fd6587af52a493587212186437 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 10:56:24 +0300 +Subject: crypto: omap-sham - fix digcnt register handling with export/import + +From: Tero Kristo + +[ Upstream commit 3faf757bad75f3fc1b2736f0431e295a073a7423 ] + +Running export/import for hashes in peculiar order (mostly done by +openssl) can mess up the internal book keeping of the OMAP SHA core. +Fix by forcibly writing the correct DIGCNT back to hardware. This issue +was noticed while transitioning to openssl 1.1 support. + +Fixes: 0d373d603202 ("crypto: omap-sham - Add OMAP4/AM33XX SHAM Support") +Signed-off-by: Tero Kristo +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/omap-sham.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c +index 82691a057d2a1..bc956dfb34de6 100644 +--- a/drivers/crypto/omap-sham.c ++++ b/drivers/crypto/omap-sham.c +@@ -456,6 +456,9 @@ static void omap_sham_write_ctrl_omap4(struct omap_sham_dev *dd, size_t length, + struct omap_sham_reqctx *ctx = ahash_request_ctx(dd->req); + u32 val, mask; + ++ if (likely(ctx->digcnt)) ++ omap_sham_write(dd, SHA_REG_DIGCNT(dd), ctx->digcnt); ++ + /* + * Setting ALGO_CONST only for the first iteration and + * CLOSE_HASH only for the last one. Note that flags mode bits +-- +2.25.1 + diff --git a/queue-5.8/crypto-picoxcell-fix-potential-race-condition-bug.patch b/queue-5.8/crypto-picoxcell-fix-potential-race-condition-bug.patch new file mode 100644 index 00000000000..1de4037ccff --- /dev/null +++ b/queue-5.8/crypto-picoxcell-fix-potential-race-condition-bug.patch @@ -0,0 +1,55 @@ +From 3d854236bda9c1cd7cf089a5f10a3f6e923c9ad1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 18:00:24 +0530 +Subject: crypto: picoxcell - Fix potential race condition bug + +From: Madhuparna Bhowmik + +[ Upstream commit 64f4a62e3b17f1e473f971127c2924cae42afc82 ] + +engine->stat_irq_thresh was initialized after device_create_file() in +the probe function, the initialization may race with call to +spacc_stat_irq_thresh_store() which updates engine->stat_irq_thresh, +therefore initialize it before creating the file in probe function. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: ce92136843cb ("crypto: picoxcell - add support for the...") +Signed-off-by: Madhuparna Bhowmik +Acked-by: Jamie Iles +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/picoxcell_crypto.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/crypto/picoxcell_crypto.c b/drivers/crypto/picoxcell_crypto.c +index 7384e91c8b32b..0d32b641a7f9d 100644 +--- a/drivers/crypto/picoxcell_crypto.c ++++ b/drivers/crypto/picoxcell_crypto.c +@@ -1666,11 +1666,6 @@ static int spacc_probe(struct platform_device *pdev) + goto err_clk_put; + } + +- ret = device_create_file(&pdev->dev, &dev_attr_stat_irq_thresh); +- if (ret) +- goto err_clk_disable; +- +- + /* + * Use an IRQ threshold of 50% as a default. This seems to be a + * reasonable trade off of latency against throughput but can be +@@ -1678,6 +1673,10 @@ static int spacc_probe(struct platform_device *pdev) + */ + engine->stat_irq_thresh = (engine->fifo_sz / 2); + ++ ret = device_create_file(&pdev->dev, &dev_attr_stat_irq_thresh); ++ if (ret) ++ goto err_clk_disable; ++ + /* + * Configure the interrupts. We only use the STAT_CNT interrupt as we + * only submit a new packet for processing when we complete another in +-- +2.25.1 + diff --git a/queue-5.8/crypto-stm32-crc32-avoid-lock-if-hardware-is-already.patch b/queue-5.8/crypto-stm32-crc32-avoid-lock-if-hardware-is-already.patch new file mode 100644 index 00000000000..46134074770 --- /dev/null +++ b/queue-5.8/crypto-stm32-crc32-avoid-lock-if-hardware-is-already.patch @@ -0,0 +1,87 @@ +From 6b15462b357f5e11b5a94dfbf11902e941b7e244 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 08:33:44 +0200 +Subject: crypto: stm32/crc32 - Avoid lock if hardware is already used + +From: Nicolas Toromanoff + +[ Upstream commit bbf2cb1ea1e1428589d7f4d652bed15b265ce92d ] + +If STM32 CRC device is already in use, calculate CRC by software. + +This will release CPU constraint for a concurrent access to the +hardware, and avoid masking irqs during the whole block processing. + +Fixes: 7795c0baf5ac ("crypto: stm32/crc32 - protect from concurrent accesses") + +Signed-off-by: Nicolas Toromanoff +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/stm32/Kconfig | 1 + + drivers/crypto/stm32/stm32-crc32.c | 15 ++++++++++++--- + 2 files changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/stm32/Kconfig b/drivers/crypto/stm32/Kconfig +index 4ef3eb11361c2..4a4c3284ae1f3 100644 +--- a/drivers/crypto/stm32/Kconfig ++++ b/drivers/crypto/stm32/Kconfig +@@ -3,6 +3,7 @@ config CRYPTO_DEV_STM32_CRC + tristate "Support for STM32 crc accelerators" + depends on ARCH_STM32 + select CRYPTO_HASH ++ select CRC32 + help + This enables support for the CRC32 hw accelerator which can be found + on STMicroelectronics STM32 SOC. +diff --git a/drivers/crypto/stm32/stm32-crc32.c b/drivers/crypto/stm32/stm32-crc32.c +index 3ba41148c2a46..2c13f5214d2cf 100644 +--- a/drivers/crypto/stm32/stm32-crc32.c ++++ b/drivers/crypto/stm32/stm32-crc32.c +@@ -6,6 +6,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -147,7 +148,6 @@ static int burst_update(struct shash_desc *desc, const u8 *d8, + struct stm32_crc_desc_ctx *ctx = shash_desc_ctx(desc); + struct stm32_crc_ctx *mctx = crypto_shash_ctx(desc->tfm); + struct stm32_crc *crc; +- unsigned long flags; + + crc = stm32_crc_get_next_crc(); + if (!crc) +@@ -155,7 +155,15 @@ static int burst_update(struct shash_desc *desc, const u8 *d8, + + pm_runtime_get_sync(crc->dev); + +- spin_lock_irqsave(&crc->lock, flags); ++ if (!spin_trylock(&crc->lock)) { ++ /* Hardware is busy, calculate crc32 by software */ ++ if (mctx->poly == CRC32_POLY_LE) ++ ctx->partial = crc32_le(ctx->partial, d8, length); ++ else ++ ctx->partial = __crc32c_le(ctx->partial, d8, length); ++ ++ goto pm_out; ++ } + + /* + * Restore previously calculated CRC for this context as init value +@@ -195,8 +203,9 @@ static int burst_update(struct shash_desc *desc, const u8 *d8, + /* Store partial result */ + ctx->partial = readl_relaxed(crc->regs + CRC_DR); + +- spin_unlock_irqrestore(&crc->lock, flags); ++ spin_unlock(&crc->lock); + ++pm_out: + pm_runtime_mark_last_busy(crc->dev); + pm_runtime_put_autosuspend(crc->dev); + +-- +2.25.1 + diff --git a/queue-5.8/crypto-sun8i-ce-handle-endianness-of-t_common_ctl.patch b/queue-5.8/crypto-sun8i-ce-handle-endianness-of-t_common_ctl.patch new file mode 100644 index 00000000000..3b56fbd5e37 --- /dev/null +++ b/queue-5.8/crypto-sun8i-ce-handle-endianness-of-t_common_ctl.patch @@ -0,0 +1,40 @@ +From d85d12c8452aec74d5feaf1cf03e77f00a6d5880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 07:23:05 +0000 +Subject: crypto: sun8i-ce - handle endianness of t_common_ctl + +From: Corentin Labbe + +[ Upstream commit 87f34260f5e09a4578132ad1c05aef2d707dd4bf ] + +t_common_ctl is LE32 so we need to convert its value before using it. +This value is only used on H6 (ignored on other SoCs) and not handling +the endianness cause failure on xRNG/hashes operations on H6 when running BE. + +Fixes: 06f751b61329 ("crypto: allwinner - Add sun8i-ce Crypto Engine") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c +index b957061424a1f..8f3d6d31da52f 100644 +--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c ++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-core.c +@@ -120,7 +120,10 @@ int sun8i_ce_run_task(struct sun8i_ce_dev *ce, int flow, const char *name) + /* Be sure all data is written before enabling the task */ + wmb(); + +- v = 1 | (ce->chanlist[flow].tl->t_common_ctl & 0x7F) << 8; ++ /* Only H6 needs to write a part of t_common_ctl along with "1", but since it is ignored ++ * on older SoCs, we have no reason to complicate things. ++ */ ++ v = 1 | ((le32_to_cpu(ce->chanlist[flow].tl->t_common_ctl) & 0x7F) << 8); + writel(v, ce->base + CE_TLR); + mutex_unlock(&ce->mlock); + +-- +2.25.1 + diff --git a/queue-5.8/cypto-mediatek-fix-leaks-in-mtk_desc_ring_alloc.patch b/queue-5.8/cypto-mediatek-fix-leaks-in-mtk_desc_ring_alloc.patch new file mode 100644 index 00000000000..26f0431ea07 --- /dev/null +++ b/queue-5.8/cypto-mediatek-fix-leaks-in-mtk_desc_ring_alloc.patch @@ -0,0 +1,46 @@ +From addd9e46ffa0a2d9fe77f54591ce6390ffa40c91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 11:00:51 +0800 +Subject: cypto: mediatek - fix leaks in mtk_desc_ring_alloc + +From: Xiaoliang Pang + +[ Upstream commit 228d284aac61283cde508a925d666f854b57af63 ] + +In the init loop, if an error occurs in function 'dma_alloc_coherent', +then goto the err_cleanup section, after run i--, +in the array ring, the struct mtk_ring with index i will not be released, +causing memory leaks + +Fixes: 785e5c616c849 ("crypto: mediatek - Add crypto driver support for some MediaTek chips") +Cc: Ryder Lee +Signed-off-by: Xiaoliang Pang +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/mediatek/mtk-platform.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/mediatek/mtk-platform.c b/drivers/crypto/mediatek/mtk-platform.c +index ef4339e84d034..efce3a83b35a8 100644 +--- a/drivers/crypto/mediatek/mtk-platform.c ++++ b/drivers/crypto/mediatek/mtk-platform.c +@@ -469,13 +469,13 @@ static int mtk_desc_ring_alloc(struct mtk_cryp *cryp) + return 0; + + err_cleanup: +- for (; i--; ) { ++ do { + dma_free_coherent(cryp->dev, MTK_DESC_RING_SZ, + ring[i]->res_base, ring[i]->res_dma); + dma_free_coherent(cryp->dev, MTK_DESC_RING_SZ, + ring[i]->cmd_base, ring[i]->cmd_dma); + kfree(ring[i]); +- } ++ } while (i--); + return -ENOMEM; + } + +-- +2.25.1 + diff --git a/queue-5.8/dmaengine-dmatest-check-list-for-emptiness-before-ac.patch b/queue-5.8/dmaengine-dmatest-check-list-for-emptiness-before-ac.patch new file mode 100644 index 00000000000..6f3175b7199 --- /dev/null +++ b/queue-5.8/dmaengine-dmatest-check-list-for-emptiness-before-ac.patch @@ -0,0 +1,58 @@ +From e2190d9b4d94e26452e4d149ed91b5305bc7a569 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Sep 2020 14:58:46 +0300 +Subject: dmaengine: dmatest: Check list for emptiness before access its last + entry + +From: Andy Shevchenko + +[ Upstream commit b28de385b71abf31ce68ec0387638bee26ae9024 ] + +After writing a garbage to the channel we get an Oops in dmatest_chan_set() +due to access to last entry in the empty list. + +[ 212.670672] BUG: unable to handle page fault for address: fffffff000000020 +[ 212.677562] #PF: supervisor read access in kernel mode +[ 212.682702] #PF: error_code(0x0000) - not-present page +... +[ 212.710074] RIP: 0010:dmatest_chan_set+0x149/0x2d0 [dmatest] +[ 212.715739] Code: e8 cc f9 ff ff 48 8b 1d 0d 55 00 00 48 83 7b 10 00 0f 84 63 01 00 00 48 c7 c7 d0 65 4d c0 e8 ee 4a f5 e1 48 89 c6 48 8b 43 10 <48> 8b 40 20 48 8b 78 58 48 85 ff 0f 84 f5 00 00 00 e8 b1 41 f5 e1 + +Fix this by checking list for emptiness before accessing its last entry. + +Fixes: d53513d5dc28 ("dmaengine: dmatest: Add support for multi channel testing") +Cc: Vladimir Murzin +Signed-off-by: Andy Shevchenko +Tested-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20200922115847.30100-2-andriy.shevchenko@linux.intel.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dmatest.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c +index 323822372b4ce..7480fc1042093 100644 +--- a/drivers/dma/dmatest.c ++++ b/drivers/dma/dmatest.c +@@ -1240,15 +1240,14 @@ static int dmatest_chan_set(const char *val, const struct kernel_param *kp) + add_threaded_test(info); + + /* Check if channel was added successfully */ +- dtc = list_last_entry(&info->channels, struct dmatest_chan, node); +- +- if (dtc->chan) { ++ if (!list_empty(&info->channels)) { + /* + * if new channel was not successfully added, revert the + * "test_channel" string to the name of the last successfully + * added channel. exception for when users issues empty string + * to channel parameter. + */ ++ dtc = list_last_entry(&info->channels, struct dmatest_chan, node); + if ((strcmp(dma_chan_name(dtc->chan), strim(test_channel)) != 0) + && (strcmp("", strim(test_channel)) != 0)) { + ret = -EINVAL; +-- +2.25.1 + diff --git a/queue-5.8/dmaengine-dw-activate-fifo-mode-for-memory-periphera.patch b/queue-5.8/dmaengine-dw-activate-fifo-mode-for-memory-periphera.patch new file mode 100644 index 00000000000..255b8cba253 --- /dev/null +++ b/queue-5.8/dmaengine-dw-activate-fifo-mode-for-memory-periphera.patch @@ -0,0 +1,65 @@ +From 3c89fb1680b91b4360e6595521da08a34263677c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 23:08:23 +0300 +Subject: dmaengine: dw: Activate FIFO-mode for memory peripherals only + +From: Serge Semin + +[ Upstream commit 6d9459d04081c796fc67c2bb771f4e4ebb5744c4 ] + +CFGx.FIFO_MODE field controls a DMA-controller "FIFO readiness" criterion. +In other words it determines when to start pushing data out of a DW +DMAC channel FIFO to a destination peripheral or from a source +peripheral to the DW DMAC channel FIFO. Currently FIFO-mode is set to one +for all DW DMAC channels. It means they are tuned to flush data out of +FIFO (to a memory peripheral or by accepting the burst transaction +requests) when FIFO is at least half-full (except at the end of the block +transfer, when FIFO-flush mode is activated) and are configured to get +data to the FIFO when it's at least half-empty. + +Such configuration is a good choice when there is no slave device involved +in the DMA transfers. In that case the number of bursts per block is less +than when CFGx.FIFO_MODE = 0 and, hence, the bus utilization will improve. +But the latency of DMA transfers may increase when CFGx.FIFO_MODE = 1, +since DW DMAC will wait for the channel FIFO contents to be either +half-full or half-empty depending on having the destination or the source +transfers. Such latencies might be dangerous in case if the DMA transfers +are expected to be performed from/to a slave device. Since normally +peripheral devices keep data in internal FIFOs, any latency at some +critical moment may cause one being overflown and consequently losing +data. This especially concerns a case when either a peripheral device is +relatively fast or the DW DMAC engine is relatively slow with respect to +the incoming data pace. + +In order to solve problems, which might be caused by the latencies +described above, let's enable the FIFO half-full/half-empty "FIFO +readiness" criterion only for DMA transfers with no slave device involved. +Thanks to the commit 99ba8b9b0d97 ("dmaengine: dw: Initialize channel +before each transfer") we can freely do that in the generic +dw_dma_initialize_chan() method. + +Signed-off-by: Serge Semin +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20200731200826.9292-3-Sergey.Semin@baikalelectronics.ru +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw/dw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/dw/dw.c b/drivers/dma/dw/dw.c +index 7a085b3c1854c..d9810980920a1 100644 +--- a/drivers/dma/dw/dw.c ++++ b/drivers/dma/dw/dw.c +@@ -14,7 +14,7 @@ + static void dw_dma_initialize_chan(struct dw_dma_chan *dwc) + { + struct dw_dma *dw = to_dw_dma(dwc->chan.device); +- u32 cfghi = DWC_CFGH_FIFO_MODE; ++ u32 cfghi = is_slave_direction(dwc->direction) ? 0 : DWC_CFGH_FIFO_MODE; + u32 cfglo = DWC_CFGL_CH_PRIOR(dwc->priority); + bool hs_polarity = dwc->dws.hs_polarity; + +-- +2.25.1 + diff --git a/queue-5.8/dmaengine-dw-add-dma-channels-mask-cell-support.patch b/queue-5.8/dmaengine-dw-add-dma-channels-mask-cell-support.patch new file mode 100644 index 00000000000..cba4a0bbec2 --- /dev/null +++ b/queue-5.8/dmaengine-dw-add-dma-channels-mask-cell-support.patch @@ -0,0 +1,114 @@ +From c3c8a059d5cdf2ae2ac2fc6348bff87c412d2710 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 23:08:26 +0300 +Subject: dmaengine: dw: Add DMA-channels mask cell support + +From: Serge Semin + +[ Upstream commit e8ee6c8cb61b676f1a2d6b942329e98224bd8ee9 ] + +DW DMA IP-core provides a way to synthesize the DMA controller with +channels having different parameters like maximum burst-length, +multi-block support, maximum data width, etc. Those parameters both +explicitly and implicitly affect the channels performance. Since DMA slave +devices might be very demanding to the DMA performance, let's provide a +functionality for the slaves to be assigned with DW DMA channels, which +performance according to the platform engineer fulfill their requirements. +After this patch is applied it can be done by passing the mask of suitable +DMA-channels either directly in the dw_dma_slave structure instance or as +a fifth cell of the DMA DT-property. If mask is zero or not provided, then +there is no limitation on the channels allocation. + +For instance Baikal-T1 SoC is equipped with a DW DMAC engine, which first +two channels are synthesized with max burst length of 16, while the rest +of the channels have been created with max-burst-len=4. It would seem that +the first two channels must be faster than the others and should be more +preferable for the time-critical DMA slave devices. In practice it turned +out that the situation is quite the opposite. The channels with +max-burst-len=4 demonstrated a better performance than the channels with +max-burst-len=16 even when they both had been initialized with the same +settings. The performance drop of the first two DMA-channels made them +unsuitable for the DW APB SSI slave device. No matter what settings they +are configured with, full-duplex SPI transfers occasionally experience the +Rx FIFO overflow. It means that the DMA-engine doesn't keep up with +incoming data pace even though the SPI-bus is enabled with speed of 25MHz +while the DW DMA controller is clocked with 50MHz signal. There is no such +problem has been noticed for the channels synthesized with +max-burst-len=4. + +Signed-off-by: Serge Semin +Link: https://lore.kernel.org/r/20200731200826.9292-6-Sergey.Semin@baikalelectronics.ru +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/dw/core.c | 4 ++++ + drivers/dma/dw/of.c | 7 +++++-- + include/linux/platform_data/dma-dw.h | 2 ++ + 3 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/dw/core.c b/drivers/dma/dw/core.c +index a1b56f52db2f2..5e7fdc0b6e3db 100644 +--- a/drivers/dma/dw/core.c ++++ b/drivers/dma/dw/core.c +@@ -772,6 +772,10 @@ bool dw_dma_filter(struct dma_chan *chan, void *param) + if (dws->dma_dev != chan->device->dev) + return false; + ++ /* permit channels in accordance with the channels mask */ ++ if (dws->channels && !(dws->channels & dwc->mask)) ++ return false; ++ + /* We have to copy data since dws can be temporary storage */ + memcpy(&dwc->dws, dws, sizeof(struct dw_dma_slave)); + +diff --git a/drivers/dma/dw/of.c b/drivers/dma/dw/of.c +index 9e27831dee324..43e975fb67142 100644 +--- a/drivers/dma/dw/of.c ++++ b/drivers/dma/dw/of.c +@@ -22,18 +22,21 @@ static struct dma_chan *dw_dma_of_xlate(struct of_phandle_args *dma_spec, + }; + dma_cap_mask_t cap; + +- if (dma_spec->args_count != 3) ++ if (dma_spec->args_count < 3 || dma_spec->args_count > 4) + return NULL; + + slave.src_id = dma_spec->args[0]; + slave.dst_id = dma_spec->args[0]; + slave.m_master = dma_spec->args[1]; + slave.p_master = dma_spec->args[2]; ++ if (dma_spec->args_count >= 4) ++ slave.channels = dma_spec->args[3]; + + if (WARN_ON(slave.src_id >= DW_DMA_MAX_NR_REQUESTS || + slave.dst_id >= DW_DMA_MAX_NR_REQUESTS || + slave.m_master >= dw->pdata->nr_masters || +- slave.p_master >= dw->pdata->nr_masters)) ++ slave.p_master >= dw->pdata->nr_masters || ++ slave.channels >= BIT(dw->pdata->nr_channels))) + return NULL; + + dma_cap_zero(cap); +diff --git a/include/linux/platform_data/dma-dw.h b/include/linux/platform_data/dma-dw.h +index f3eaf9ec00a1b..70078be166e3c 100644 +--- a/include/linux/platform_data/dma-dw.h ++++ b/include/linux/platform_data/dma-dw.h +@@ -21,6 +21,7 @@ + * @dst_id: dst request line + * @m_master: memory master for transfers on allocated channel + * @p_master: peripheral master for transfers on allocated channel ++ * @channels: mask of the channels permitted for allocation (zero value means any) + * @hs_polarity:set active low polarity of handshake interface + */ + struct dw_dma_slave { +@@ -29,6 +30,7 @@ struct dw_dma_slave { + u8 dst_id; + u8 m_master; + u8 p_master; ++ u8 channels; + bool hs_polarity; + }; + +-- +2.25.1 + diff --git a/queue-5.8/dmaengine-ioat-allocate-correct-size-for-descriptor-.patch b/queue-5.8/dmaengine-ioat-allocate-correct-size-for-descriptor-.patch new file mode 100644 index 00000000000..3fa70e1d91e --- /dev/null +++ b/queue-5.8/dmaengine-ioat-allocate-correct-size-for-descriptor-.patch @@ -0,0 +1,49 @@ +From a7d8de71b0488bf85d0b3945f99a7fb0db49b858 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Sep 2020 14:08:44 -0600 +Subject: dmaengine: ioat: Allocate correct size for descriptor chunk + +From: Logan Gunthorpe + +[ Upstream commit 028926e4ac8f21af343c25794117fd13c08b1712 ] + +dma_alloc_coherent() is called with a fixed SZ_2M size, but frees happen +with IOAT_CHUNK_SIZE. Recently, IOAT_CHUNK_SIZE was reduced to 512M but +the allocation did not change. To fix, change to using the +IOAT_CHUNK_SIZE define. + +This was caught with the upcoming patchset for converting Intel platforms to the +dma-iommu implementation. It has a warning when the unmapped size differs from +the mapped size. + +Fixes: a02254f8a676 ("dmaengine: ioat: Decreasing allocation chunk size 2M->512K") +Suggested-by: Robin Murphy +Signed-off-by: Logan Gunthorpe +Acked-by: Dave Jiang +Cc: Vinod Koul +Cc: Dave Jiang +Cc: Dan Williams +Link: https://lore.kernel.org/intel-gfx/776771a2-247a-d1be-d882-bee02d919ae0@deltatee.com/ +Link: https://lore.kernel.org/r/20200922200844.2982-1-logang@deltatee.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/ioat/dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c +index fd782aee02d92..98c56606ab1a9 100644 +--- a/drivers/dma/ioat/dma.c ++++ b/drivers/dma/ioat/dma.c +@@ -389,7 +389,7 @@ ioat_alloc_ring(struct dma_chan *c, int order, gfp_t flags) + struct ioat_descs *descs = &ioat_chan->descs[i]; + + descs->virt = dma_alloc_coherent(to_dev(ioat_chan), +- SZ_2M, &descs->hw, flags); ++ IOAT_CHUNK_SIZE, &descs->hw, flags); + if (!descs->virt) { + int idx; + +-- +2.25.1 + diff --git a/queue-5.8/drivers-perf-thunderx2_pmu-fix-memory-resource-error.patch b/queue-5.8/drivers-perf-thunderx2_pmu-fix-memory-resource-error.patch new file mode 100644 index 00000000000..3f3c67fc245 --- /dev/null +++ b/queue-5.8/drivers-perf-thunderx2_pmu-fix-memory-resource-error.patch @@ -0,0 +1,59 @@ +From 539a662561e47e24da555734ad17b60554235f89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 16:41:10 -0400 +Subject: drivers/perf: thunderx2_pmu: Fix memory resource error handling + +From: Mark Salter + +[ Upstream commit 688494a407d1419a6b158c644b262c61cde39f48 ] + +In tx2_uncore_pmu_init_dev(), a call to acpi_dev_get_resources() is used +to create a list _CRS resources which is searched for the device base +address. There is an error check following this: + + if (!rentry->res) + return NULL + +In no case, will rentry->res be NULL, so the test is useless. Even +if the test worked, it comes before the resource list memory is +freed. None of this really matters as long as the ACPI table has +the memory resource. Let's clean it up so that it makes sense and +will give a meaningful error should firmware leave out the memory +resource. + +Fixes: 69c32972d593 ("drivers/perf: Add Cavium ThunderX2 SoC UNCORE PMU driver") +Signed-off-by: Mark Salter +Link: https://lore.kernel.org/r/20200915204110.326138-2-msalter@redhat.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/thunderx2_pmu.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/perf/thunderx2_pmu.c b/drivers/perf/thunderx2_pmu.c +index aac9823b0c6bb..e116815fa8092 100644 +--- a/drivers/perf/thunderx2_pmu.c ++++ b/drivers/perf/thunderx2_pmu.c +@@ -805,14 +805,17 @@ static struct tx2_uncore_pmu *tx2_uncore_pmu_init_dev(struct device *dev, + list_for_each_entry(rentry, &list, node) { + if (resource_type(rentry->res) == IORESOURCE_MEM) { + res = *rentry->res; ++ rentry = NULL; + break; + } + } ++ acpi_dev_free_resource_list(&list); + +- if (!rentry->res) ++ if (rentry) { ++ dev_err(dev, "PMU type %d: Fail to find resource\n", type); + return NULL; ++ } + +- acpi_dev_free_resource_list(&list); + base = devm_ioremap_resource(dev, &res); + if (IS_ERR(base)) { + dev_err(dev, "PMU type %d: Fail to map resource\n", type); +-- +2.25.1 + diff --git a/queue-5.8/drivers-perf-xgene_pmu-fix-uninitialized-resource-st.patch b/queue-5.8/drivers-perf-xgene_pmu-fix-uninitialized-resource-st.patch new file mode 100644 index 00000000000..a6c04d18c94 --- /dev/null +++ b/queue-5.8/drivers-perf-xgene_pmu-fix-uninitialized-resource-st.patch @@ -0,0 +1,126 @@ +From 23848396e853130a2747cce135ddc14a5927e54d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 16:41:09 -0400 +Subject: drivers/perf: xgene_pmu: Fix uninitialized resource struct + +From: Mark Salter + +[ Upstream commit a76b8236edcf5b785d044b930f9e14ad02b4a484 ] + +This splat was reported on newer Fedora kernels booting on certain +X-gene based machines: + + xgene-pmu APMC0D83:00: X-Gene PMU version 3 + Unable to handle kernel read from unreadable memory at virtual \ + address 0000000000004006 + ... + Call trace: + string+0x50/0x100 + vsnprintf+0x160/0x750 + devm_kvasprintf+0x5c/0xb4 + devm_kasprintf+0x54/0x60 + __devm_ioremap_resource+0xdc/0x1a0 + devm_ioremap_resource+0x14/0x20 + acpi_get_pmu_hw_inf.isra.0+0x84/0x15c + acpi_pmu_dev_add+0xbc/0x21c + acpi_ns_walk_namespace+0x16c/0x1e4 + acpi_walk_namespace+0xb4/0xfc + xgene_pmu_probe_pmu_dev+0x7c/0xe0 + xgene_pmu_probe.part.0+0x2c0/0x310 + xgene_pmu_probe+0x54/0x64 + platform_drv_probe+0x60/0xb4 + really_probe+0xe8/0x4a0 + driver_probe_device+0xe4/0x100 + device_driver_attach+0xcc/0xd4 + __driver_attach+0xb0/0x17c + bus_for_each_dev+0x6c/0xb0 + driver_attach+0x30/0x40 + bus_add_driver+0x154/0x250 + driver_register+0x84/0x140 + __platform_driver_register+0x54/0x60 + xgene_pmu_driver_init+0x28/0x34 + do_one_initcall+0x40/0x204 + do_initcalls+0x104/0x144 + kernel_init_freeable+0x198/0x210 + kernel_init+0x20/0x12c + ret_from_fork+0x10/0x18 + Code: 91000400 110004e1 eb08009f 540000c0 (38646846) + ---[ end trace f08c10566496a703 ]--- + +This is due to use of an uninitialized local resource struct in the xgene +pmu driver. The thunderx2_pmu driver avoids this by using the resource list +constructed by acpi_dev_get_resources() rather than using a callback from +that function. The callback in the xgene driver didn't fully initialize +the resource. So get rid of the callback and search the resource list as +done by thunderx2. + +Fixes: 832c927d119b ("perf: xgene: Add APM X-Gene SoC Performance Monitoring Unit driver") +Signed-off-by: Mark Salter +Link: https://lore.kernel.org/r/20200915204110.326138-1-msalter@redhat.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/perf/xgene_pmu.c | 32 +++++++++++++++++--------------- + 1 file changed, 17 insertions(+), 15 deletions(-) + +diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c +index edac28cd25ddc..633cf07ba6723 100644 +--- a/drivers/perf/xgene_pmu.c ++++ b/drivers/perf/xgene_pmu.c +@@ -1453,17 +1453,6 @@ static char *xgene_pmu_dev_name(struct device *dev, u32 type, int id) + } + + #if defined(CONFIG_ACPI) +-static int acpi_pmu_dev_add_resource(struct acpi_resource *ares, void *data) +-{ +- struct resource *res = data; +- +- if (ares->type == ACPI_RESOURCE_TYPE_FIXED_MEMORY32) +- acpi_dev_resource_memory(ares, res); +- +- /* Always tell the ACPI core to skip this resource */ +- return 1; +-} +- + static struct + xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu, + struct acpi_device *adev, u32 type) +@@ -1475,6 +1464,7 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu, + struct hw_pmu_info *inf; + void __iomem *dev_csr; + struct resource res; ++ struct resource_entry *rentry; + int enable_bit; + int rc; + +@@ -1483,11 +1473,23 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu, + return NULL; + + INIT_LIST_HEAD(&resource_list); +- rc = acpi_dev_get_resources(adev, &resource_list, +- acpi_pmu_dev_add_resource, &res); ++ rc = acpi_dev_get_resources(adev, &resource_list, NULL, NULL); ++ if (rc <= 0) { ++ dev_err(dev, "PMU type %d: No resources found\n", type); ++ return NULL; ++ } ++ ++ list_for_each_entry(rentry, &resource_list, node) { ++ if (resource_type(rentry->res) == IORESOURCE_MEM) { ++ res = *rentry->res; ++ rentry = NULL; ++ break; ++ } ++ } + acpi_dev_free_resource_list(&resource_list); +- if (rc < 0) { +- dev_err(dev, "PMU type %d: No resource address found\n", type); ++ ++ if (rentry) { ++ dev_err(dev, "PMU type %d: No memory resource found\n", type); + return NULL; + } + +-- +2.25.1 + diff --git a/queue-5.8/drivers-virt-fsl_hypervisor-fix-error-handling-path.patch b/queue-5.8/drivers-virt-fsl_hypervisor-fix-error-handling-path.patch new file mode 100644 index 00000000000..ec5617653cf --- /dev/null +++ b/queue-5.8/drivers-virt-fsl_hypervisor-fix-error-handling-path.patch @@ -0,0 +1,99 @@ +From 6d6f2dfc475f2531ae21890394dced099dbaf9ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 02:51:11 +0530 +Subject: drivers/virt/fsl_hypervisor: Fix error handling path + +From: Souptick Joarder + +[ Upstream commit 7f360bec37857bfd5a48cef21d86f58a09a3df63 ] + +First, when memory allocation for sg_list_unaligned failed, there +is a bug of calling put_pages() as we haven't pinned any pages. + +Second, if get_user_pages_fast() failed we should unpin num_pinned +pages. + +This will address both. + +As part of these changes, minor update in documentation. + +Fixes: 6db7199407ca ("drivers/virt: introduce Freescale hypervisor management driver") +Signed-off-by: Souptick Joarder +Reviewed-by: Dan Carpenter +Reviewed-by: John Hubbard +Link: https://lore.kernel.org/r/1598995271-6755-1-git-send-email-jrdr.linux@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/virt/fsl_hypervisor.c | 17 ++++++++--------- + 1 file changed, 8 insertions(+), 9 deletions(-) + +diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c +index 1b0b11b55d2a0..46ee0a0998b6f 100644 +--- a/drivers/virt/fsl_hypervisor.c ++++ b/drivers/virt/fsl_hypervisor.c +@@ -157,7 +157,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) + + unsigned int i; + long ret = 0; +- int num_pinned; /* return value from get_user_pages() */ ++ int num_pinned = 0; /* return value from get_user_pages_fast() */ + phys_addr_t remote_paddr; /* The next address in the remote buffer */ + uint32_t count; /* The number of bytes left to copy */ + +@@ -174,7 +174,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) + return -EINVAL; + + /* +- * The array of pages returned by get_user_pages() covers only ++ * The array of pages returned by get_user_pages_fast() covers only + * page-aligned memory. Since the user buffer is probably not + * page-aligned, we need to handle the discrepancy. + * +@@ -224,7 +224,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) + + /* + * 'pages' is an array of struct page pointers that's initialized by +- * get_user_pages(). ++ * get_user_pages_fast(). + */ + pages = kcalloc(num_pages, sizeof(struct page *), GFP_KERNEL); + if (!pages) { +@@ -241,7 +241,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) + if (!sg_list_unaligned) { + pr_debug("fsl-hv: could not allocate S/G list\n"); + ret = -ENOMEM; +- goto exit; ++ goto free_pages; + } + sg_list = PTR_ALIGN(sg_list_unaligned, sizeof(struct fh_sg_list)); + +@@ -250,7 +250,6 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) + num_pages, param.source != -1 ? FOLL_WRITE : 0, pages); + + if (num_pinned != num_pages) { +- /* get_user_pages() failed */ + pr_debug("fsl-hv: could not lock source buffer\n"); + ret = (num_pinned < 0) ? num_pinned : -EFAULT; + goto exit; +@@ -292,13 +291,13 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p) + virt_to_phys(sg_list), num_pages); + + exit: +- if (pages) { +- for (i = 0; i < num_pages; i++) +- if (pages[i]) +- put_page(pages[i]); ++ if (pages && (num_pinned > 0)) { ++ for (i = 0; i < num_pinned; i++) ++ put_page(pages[i]); + } + + kfree(sg_list_unaligned); ++free_pages: + kfree(pages); + + if (!ret) +-- +2.25.1 + diff --git a/queue-5.8/drm-amd-display-fix-potential-integer-overflow-when-.patch b/queue-5.8/drm-amd-display-fix-potential-integer-overflow-when-.patch new file mode 100644 index 00000000000..a6e37d19617 --- /dev/null +++ b/queue-5.8/drm-amd-display-fix-potential-integer-overflow-when-.patch @@ -0,0 +1,40 @@ +From 9a9d4af9efe4587c4a9c135c88d70fe13b0360c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 13:09:14 +0100 +Subject: drm/amd/display: fix potential integer overflow when shifting 32 bit + variable bl_pwm + +From: Colin Ian King + +[ Upstream commit 1d5503331b12a76266049289747dfd94f1643fde ] + +The 32 bit unsigned integer bl_pwm is being shifted using 32 bit arithmetic +and then being assigned to a 64 bit unsigned integer. There is a potential +for a 32 bit overflow so cast bl_pwm to enforce a 64 bit shift operation +to avoid this. + +Addresses-Coverity: ("unintentional integer overflow") +Fixes: 3ba01817365c ("drm/amd/display: Move panel_cntl specific register from abm to panel_cntl.") +Signed-off-by: Colin Ian King +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dce/dce_panel_cntl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dce/dce_panel_cntl.c b/drivers/gpu/drm/amd/display/dc/dce/dce_panel_cntl.c +index ebff9b1e312e5..124c081a0f2ca 100644 +--- a/drivers/gpu/drm/amd/display/dc/dce/dce_panel_cntl.c ++++ b/drivers/gpu/drm/amd/display/dc/dce/dce_panel_cntl.c +@@ -75,7 +75,7 @@ static unsigned int calculate_16_bit_backlight_from_pwm(struct dce_panel_cntl *d + else + bl_pwm &= 0xFFFF; + +- current_backlight = bl_pwm << (1 + bl_int_count); ++ current_backlight = (uint64_t)bl_pwm << (1 + bl_int_count); + + if (bl_period == 0) + bl_period = 0xFFFF; +-- +2.25.1 + diff --git a/queue-5.8/drm-amd-display-fix-wrong-return-value-in-dm_update_.patch b/queue-5.8/drm-amd-display-fix-wrong-return-value-in-dm_update_.patch new file mode 100644 index 00000000000..3b8df7719dc --- /dev/null +++ b/queue-5.8/drm-amd-display-fix-wrong-return-value-in-dm_update_.patch @@ -0,0 +1,38 @@ +From 0de4294afce65059cfcf073f9f041b0d2ca91f2a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 19:15:36 +0800 +Subject: drm/amd/display: Fix wrong return value in dm_update_plane_state() + +From: Tianjia Zhang + +[ Upstream commit c35376137e940c3389df2726a92649c01a9844b4 ] + +On an error exit path, a negative error code should be returned +instead of a positive return value. + +Fixes: 9e869063b0021 ("drm/amd/display: Move iteration out of dm_update_planes") +Cc: Leo Li +Signed-off-by: Tianjia Zhang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 7c1cc0ba30a55..78cf9e4fddbdf 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -8178,8 +8178,7 @@ static int dm_update_plane_state(struct dc *dc, + dm_old_plane_state->dc_state, + dm_state->context)) { + +- ret = EINVAL; +- return ret; ++ return -EINVAL; + } + + +-- +2.25.1 + diff --git a/queue-5.8/drm-amd-display-screen-corruption-on-dual-displays-d.patch b/queue-5.8/drm-amd-display-screen-corruption-on-dual-displays-d.patch new file mode 100644 index 00000000000..b027500fdd2 --- /dev/null +++ b/queue-5.8/drm-amd-display-screen-corruption-on-dual-displays-d.patch @@ -0,0 +1,76 @@ +From 94712920b777e4588d0ed90412e2d560a051441f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jul 2020 15:35:41 -0400 +Subject: drm/amd/display: Screen corruption on dual displays (DP+USB-C) + +From: Qingqing Zhuo + +[ Upstream commit ce271b40a91f781af3dee985c39e841ac5148766 ] + +[why] +Current pipe merge and split logic only supports cases where new +dc_state is allocated and relies on dc->current_state to gather +information from previous dc_state. + +Calls to validate_bandwidth on UPDATE_TYPE_MED would cause an issue +because there is no new dc_state allocated, and data in +dc->current_state would be overwritten during pipe merge. + +[how] +Only allow validate_bandwidth when new dc_state space is created. + +Signed-off-by: Qingqing Zhuo +Reviewed-by: Nicholas Kazlauskas +Acked-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc.c | 2 +- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 3 +++ + drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 3 +++ + 3 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c +index d016f50e187c8..d261f425b80ec 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -2538,7 +2538,7 @@ void dc_commit_updates_for_stream(struct dc *dc, + + copy_stream_update_to_stream(dc, context, stream, stream_update); + +- if (update_type > UPDATE_TYPE_FAST) { ++ if (update_type >= UPDATE_TYPE_FULL) { + if (!dc->res_pool->funcs->validate_bandwidth(dc, context, false)) { + DC_ERROR("Mode validation failed for stream update!\n"); + dc_release_state(context); +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +index 20bdabebbc434..76cd4f3de4eaf 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -3165,6 +3165,9 @@ static noinline bool dcn20_validate_bandwidth_fp(struct dc *dc, + context->bw_ctx.dml.soc.allow_dram_clock_one_display_vactive = + dc->debug.enable_dram_clock_change_one_display_vactive; + ++ /*Unsafe due to current pipe merge and split logic*/ ++ ASSERT(context != dc->current_state); ++ + if (fast_validate) { + return dcn20_validate_bandwidth_internal(dc, context, true); + } +diff --git a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +index f00a568350848..c6ab3dee4fd69 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +@@ -1184,6 +1184,9 @@ bool dcn21_validate_bandwidth(struct dc *dc, struct dc_state *context, + + BW_VAL_TRACE_COUNT(); + ++ /*Unsafe due to current pipe merge and split logic*/ ++ ASSERT(context != dc->current_state); ++ + out = dcn20_fast_validate_bw(dc, context, pipes, &pipe_cnt, pipe_split_from, &vlevel); + + if (pipe_cnt == 0) +-- +2.25.1 + diff --git a/queue-5.8/drm-crc-debugfs-fix-memleak-in-crc_control_write.patch b/queue-5.8/drm-crc-debugfs-fix-memleak-in-crc_control_write.patch new file mode 100644 index 00000000000..d3ede1d38c4 --- /dev/null +++ b/queue-5.8/drm-crc-debugfs-fix-memleak-in-crc_control_write.patch @@ -0,0 +1,43 @@ +From 0b04e82eda42f6a78bf363f1a1f25030acba9bd8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 16:22:28 +0800 +Subject: drm/crc-debugfs: Fix memleak in crc_control_write + +From: Dinghao Liu + +[ Upstream commit f7ec68b341dbd5da13d4c65ce444dcd605f1c42e ] + +When verify_crc_source() fails, source needs to be freed. +However, current code is returning directly and ends up +leaking memory. + +Fixes: d5cc15a0c66e ("drm: crc: Introduce verify_crc_source callback") +Signed-off-by: Dinghao Liu +Reviewed-by: Laurent Pinchart +[danvet: change Fixes: tag per Laurent's review] +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20200819082228.26847-1-dinghao.liu@zju.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_debugfs_crc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/drm_debugfs_crc.c b/drivers/gpu/drm/drm_debugfs_crc.c +index 5d67a41f7c3a8..3dd70d813f694 100644 +--- a/drivers/gpu/drm/drm_debugfs_crc.c ++++ b/drivers/gpu/drm/drm_debugfs_crc.c +@@ -144,8 +144,10 @@ static ssize_t crc_control_write(struct file *file, const char __user *ubuf, + source[len - 1] = '\0'; + + ret = crtc->funcs->verify_crc_source(crtc, source, &values_cnt); +- if (ret) ++ if (ret) { ++ kfree(source); + return ret; ++ } + + spin_lock_irq(&crc->lock); + +-- +2.25.1 + diff --git a/queue-5.8/drm-fix-double-free-for-gbo-in-drm_gem_vram_init-and.patch b/queue-5.8/drm-fix-double-free-for-gbo-in-drm_gem_vram_init-and.patch new file mode 100644 index 00000000000..9758a4898a3 --- /dev/null +++ b/queue-5.8/drm-fix-double-free-for-gbo-in-drm_gem_vram_init-and.patch @@ -0,0 +1,172 @@ +From ffc33b44f71a4f3cd332e49572f8897ebfe08e6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 10:32:36 +0200 +Subject: drm: fix double free for gbo in drm_gem_vram_init and + drm_gem_vram_create + +From: Jia Yang + +[ Upstream commit da62cb7230f0871c30dc9789071f63229158d261 ] + +I got a use-after-free report when doing some fuzz test: + +If ttm_bo_init() fails, the "gbo" and "gbo->bo.base" will be +freed by ttm_buffer_object_destroy() in ttm_bo_init(). But +then drm_gem_vram_create() and drm_gem_vram_init() will free +"gbo" and "gbo->bo.base" again. + +BUG: KMSAN: use-after-free in drm_vma_offset_remove+0xb3/0x150 +CPU: 0 PID: 24282 Comm: syz-executor.1 Tainted: G B W 5.7.0-rc4-msan #2 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 +Call Trace: + __dump_stack + dump_stack+0x1c9/0x220 + kmsan_report+0xf7/0x1e0 + __msan_warning+0x58/0xa0 + drm_vma_offset_remove+0xb3/0x150 + drm_gem_free_mmap_offset + drm_gem_object_release+0x159/0x180 + drm_gem_vram_init + drm_gem_vram_create+0x7c5/0x990 + drm_gem_vram_fill_create_dumb + drm_gem_vram_driver_dumb_create+0x238/0x590 + drm_mode_create_dumb + drm_mode_create_dumb_ioctl+0x41d/0x450 + drm_ioctl_kernel+0x5a4/0x710 + drm_ioctl+0xc6f/0x1240 + vfs_ioctl + ksys_ioctl + __do_sys_ioctl + __se_sys_ioctl+0x2e9/0x410 + __x64_sys_ioctl+0x4a/0x70 + do_syscall_64+0xb8/0x160 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 +RIP: 0033:0x4689b9 +Code: fd e0 fa ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb e0 fa ff c3 66 2e 0f 1f 84 00 00 00 00 +RSP: 002b:00007f368fa4dc98 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +RAX: ffffffffffffffda RBX: 000000000076bf00 RCX: 00000000004689b9 +RDX: 0000000020000240 RSI: 00000000c02064b2 RDI: 0000000000000003 +RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 00000000004d17e0 R14: 00007f368fa4e6d4 R15: 000000000076bf0c + +Uninit was created at: + kmsan_save_stack_with_flags + kmsan_internal_poison_shadow+0x66/0xd0 + kmsan_slab_free+0x6e/0xb0 + slab_free_freelist_hook + slab_free + kfree+0x571/0x30a0 + drm_gem_vram_destroy + ttm_buffer_object_destroy+0xc8/0x130 + ttm_bo_release + kref_put + ttm_bo_put+0x117d/0x23e0 + ttm_bo_init_reserved+0x11c0/0x11d0 + ttm_bo_init+0x289/0x3f0 + drm_gem_vram_init + drm_gem_vram_create+0x775/0x990 + drm_gem_vram_fill_create_dumb + drm_gem_vram_driver_dumb_create+0x238/0x590 + drm_mode_create_dumb + drm_mode_create_dumb_ioctl+0x41d/0x450 + drm_ioctl_kernel+0x5a4/0x710 + drm_ioctl+0xc6f/0x1240 + vfs_ioctl + ksys_ioctl + __do_sys_ioctl + __se_sys_ioctl+0x2e9/0x410 + __x64_sys_ioctl+0x4a/0x70 + do_syscall_64+0xb8/0x160 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +If ttm_bo_init() fails, the "gbo" will be freed by +ttm_buffer_object_destroy() in ttm_bo_init(). But then +drm_gem_vram_create() and drm_gem_vram_init() will free +"gbo" again. + +Reported-by: Hulk Robot +Reported-by: butt3rflyh4ck +Signed-off-by: Jia Yang +Signed-off-by: Thomas Zimmermann +Reviewed-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20200714083238.28479-2-tzimmermann@suse.de +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_gem_vram_helper.c | 28 +++++++++++++++------------ + 1 file changed, 16 insertions(+), 12 deletions(-) + +diff --git a/drivers/gpu/drm/drm_gem_vram_helper.c b/drivers/gpu/drm/drm_gem_vram_helper.c +index 8b2d5c945c95c..1d85af9a481ac 100644 +--- a/drivers/gpu/drm/drm_gem_vram_helper.c ++++ b/drivers/gpu/drm/drm_gem_vram_helper.c +@@ -175,6 +175,10 @@ static void drm_gem_vram_placement(struct drm_gem_vram_object *gbo, + } + } + ++/* ++ * Note that on error, drm_gem_vram_init will free the buffer object. ++ */ ++ + static int drm_gem_vram_init(struct drm_device *dev, + struct drm_gem_vram_object *gbo, + size_t size, unsigned long pg_align) +@@ -184,15 +188,19 @@ static int drm_gem_vram_init(struct drm_device *dev, + int ret; + size_t acc_size; + +- if (WARN_ONCE(!vmm, "VRAM MM not initialized")) ++ if (WARN_ONCE(!vmm, "VRAM MM not initialized")) { ++ kfree(gbo); + return -EINVAL; ++ } + bdev = &vmm->bdev; + + gbo->bo.base.funcs = &drm_gem_vram_object_funcs; + + ret = drm_gem_object_init(dev, &gbo->bo.base, size); +- if (ret) ++ if (ret) { ++ kfree(gbo); + return ret; ++ } + + acc_size = ttm_bo_dma_acc_size(bdev, size, sizeof(*gbo)); + +@@ -203,13 +211,13 @@ static int drm_gem_vram_init(struct drm_device *dev, + &gbo->placement, pg_align, false, acc_size, + NULL, NULL, ttm_buffer_object_destroy); + if (ret) +- goto err_drm_gem_object_release; ++ /* ++ * A failing ttm_bo_init will call ttm_buffer_object_destroy ++ * to release gbo->bo.base and kfree gbo. ++ */ ++ return ret; + + return 0; +- +-err_drm_gem_object_release: +- drm_gem_object_release(&gbo->bo.base); +- return ret; + } + + /** +@@ -243,13 +251,9 @@ struct drm_gem_vram_object *drm_gem_vram_create(struct drm_device *dev, + + ret = drm_gem_vram_init(dev, gbo, size, pg_align); + if (ret < 0) +- goto err_kfree; ++ return ERR_PTR(ret); + + return gbo; +- +-err_kfree: +- kfree(gbo); +- return ERR_PTR(ret); + } + EXPORT_SYMBOL(drm_gem_vram_create); + +-- +2.25.1 + diff --git a/queue-5.8/drm-gma500-fix-error-check.patch b/queue-5.8/drm-gma500-fix-error-check.patch new file mode 100644 index 00000000000..221e9f9d9f8 --- /dev/null +++ b/queue-5.8/drm-gma500-fix-error-check.patch @@ -0,0 +1,54 @@ +From 7c4d124bfd902aa4956c8edb532deb8149722daf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Aug 2020 13:59:11 -0700 +Subject: drm/gma500: fix error check + +From: Tom Rix + +[ Upstream commit cdd296cdae1af2d27dae3fcfbdf12c5252ab78cf ] + +Reviewing this block of code in cdv_intel_dp_init() + +ret = cdv_intel_dp_aux_native_read(gma_encoder, DP_DPCD_REV, ... + +cdv_intel_edp_panel_vdd_off(gma_encoder); +if (ret == 0) { + /* if this fails, presume the device is a ghost */ + DRM_INFO("failed to retrieve link info, disabling eDP\n"); + drm_encoder_cleanup(encoder); + cdv_intel_dp_destroy(connector); + goto err_priv; +} else { + +The (ret == 0) is not strict enough. +cdv_intel_dp_aux_native_read() returns > 0 on success +otherwise it is failure. + +So change to <= + +Fixes: d112a8163f83 ("gma500/cdv: Add eDP support") + +Signed-off-by: Tom Rix +Signed-off-by: Patrik Jakobsson +Link: https://patchwork.freedesktop.org/patch/msgid/20200805205911.20927-1-trix@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c +index f41cbb753bb46..720a767118c9c 100644 +--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c ++++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c +@@ -2078,7 +2078,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev + intel_dp->dpcd, + sizeof(intel_dp->dpcd)); + cdv_intel_edp_panel_vdd_off(gma_encoder); +- if (ret == 0) { ++ if (ret <= 0) { + /* if this fails, presume the device is a ghost */ + DRM_INFO("failed to retrieve link info, disabling eDP\n"); + drm_encoder_cleanup(encoder); +-- +2.25.1 + diff --git a/queue-5.8/drm-mediatek-reduce-clear-event.patch b/queue-5.8/drm-mediatek-reduce-clear-event.patch new file mode 100644 index 00000000000..9f18380dca1 --- /dev/null +++ b/queue-5.8/drm-mediatek-reduce-clear-event.patch @@ -0,0 +1,40 @@ +From afbeb8a0ce4d674dbc14af7f525458c40581d999 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jul 2020 23:45:14 +0800 +Subject: drm/mediatek: reduce clear event + +From: Dennis YC Hsieh + +[ Upstream commit bee1abc9cc021f50b90f22a589d9ddc816a80db0 ] + +No need to clear event again since event always clear before wait. +This fix depend on patch: + "soc: mediatek: cmdq: add clear option in cmdq_pkt_wfe api" + +Fixes: 2f965be7f9008 ("drm/mediatek: apply CMDQ control flow") +Signed-off-by: Dennis YC Hsieh +Reviewed-by: Bibby Hsieh +Acked-by: Chun-Kuang Hu +Link: https://lore.kernel.org/r/1594136714-11650-10-git-send-email-dennis-yc.hsieh@mediatek.com +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index f64c83dc6644e..2d01a293aa782 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -485,7 +485,7 @@ static void mtk_drm_crtc_hw_config(struct mtk_drm_crtc *mtk_crtc) + mbox_flush(mtk_crtc->cmdq_client->chan, 2000); + cmdq_handle = cmdq_pkt_create(mtk_crtc->cmdq_client, PAGE_SIZE); + cmdq_pkt_clear_event(cmdq_handle, mtk_crtc->cmdq_event); +- cmdq_pkt_wfe(cmdq_handle, mtk_crtc->cmdq_event, true); ++ cmdq_pkt_wfe(cmdq_handle, mtk_crtc->cmdq_event, false); + mtk_crtc_ddp_config(crtc, cmdq_handle); + cmdq_pkt_flush_async(cmdq_handle, ddp_cmdq_cb, cmdq_handle); + } +-- +2.25.1 + diff --git a/queue-5.8/drm-msm-a6xx-fix-a-potential-overflow-issue.patch b/queue-5.8/drm-msm-a6xx-fix-a-potential-overflow-issue.patch new file mode 100644 index 00000000000..4d373d75c37 --- /dev/null +++ b/queue-5.8/drm-msm-a6xx-fix-a-potential-overflow-issue.patch @@ -0,0 +1,37 @@ +From 6c41f8ad1dee46f2078f1ba294d80369323388af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Sep 2020 18:25:58 +0800 +Subject: drm/msm/a6xx: fix a potential overflow issue + +From: Zhenzhong Duan + +[ Upstream commit 08d3ab4b46339bc6f97e83b54a3fb4f8bf8f4cd9 ] + +It's allocating an array of a6xx_gpu_state_obj structure rathor than +its pointers. + +This patch fix it. + +Signed-off-by: Zhenzhong Duan +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +index d6023ba8033c0..3bb567812b990 100644 +--- a/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c ++++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu_state.c +@@ -864,7 +864,7 @@ static void a6xx_get_indexed_registers(struct msm_gpu *gpu, + int i; + + a6xx_state->indexed_regs = state_kcalloc(a6xx_state, count, +- sizeof(a6xx_state->indexed_regs)); ++ sizeof(*a6xx_state->indexed_regs)); + if (!a6xx_state->indexed_regs) + return; + +-- +2.25.1 + diff --git a/queue-5.8/drm-msm-adreno-fix-probe-without-iommu.patch b/queue-5.8/drm-msm-adreno-fix-probe-without-iommu.patch new file mode 100644 index 00000000000..7bf7738b43b --- /dev/null +++ b/queue-5.8/drm-msm-adreno-fix-probe-without-iommu.patch @@ -0,0 +1,48 @@ +From 46fcc77bd8efb8092aeceb2cefe2ef5ebb5bc7a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 18:08:53 +0200 +Subject: drm/msm/adreno: fix probe without iommu + +From: Luca Weiss + +[ Upstream commit 0a48db562c6264da2ae8013491efd6e8dc780520 ] + +The function iommu_domain_alloc returns NULL on platforms without IOMMU +such as msm8974. This resulted in PTR_ERR(-ENODEV) being assigned to +gpu->aspace so the correct code path wasn't taken. + +Fixes: ccac7ce373c1 ("drm/msm: Refactor address space initialization") +Signed-off-by: Luca Weiss +Reviewed-by: Jordan Crouse +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/adreno/adreno_gpu.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +index a74ccc5b8220d..5b5809c0e44b3 100644 +--- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c ++++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c +@@ -189,10 +189,16 @@ struct msm_gem_address_space * + adreno_iommu_create_address_space(struct msm_gpu *gpu, + struct platform_device *pdev) + { +- struct iommu_domain *iommu = iommu_domain_alloc(&platform_bus_type); +- struct msm_mmu *mmu = msm_iommu_new(&pdev->dev, iommu); ++ struct iommu_domain *iommu; ++ struct msm_mmu *mmu; + struct msm_gem_address_space *aspace; + ++ iommu = iommu_domain_alloc(&platform_bus_type); ++ if (!iommu) ++ return NULL; ++ ++ mmu = msm_iommu_new(&pdev->dev, iommu); ++ + aspace = msm_gem_address_space_create(mmu, "gpu", SZ_16M, + 0xffffffff - SZ_16M); + +-- +2.25.1 + diff --git a/queue-5.8/drm-msm-avoid-div-by-zero-in-dpu_crtc_atomic_check.patch b/queue-5.8/drm-msm-avoid-div-by-zero-in-dpu_crtc_atomic_check.patch new file mode 100644 index 00000000000..7353e9e242d --- /dev/null +++ b/queue-5.8/drm-msm-avoid-div-by-zero-in-dpu_crtc_atomic_check.patch @@ -0,0 +1,83 @@ +From 05547ede6894bdd2744360908437e186f5e16b3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 14:59:41 -0700 +Subject: drm/msm: Avoid div-by-zero in dpu_crtc_atomic_check() + +From: Stephen Boyd + +[ Upstream commit 22f760941844dbcee6ee446e1896532f6dff01ef ] + +The cstate->num_mixers member is only set to a non-zero value once +dpu_encoder_virt_mode_set() is called, but the atomic check function can +be called by userspace before that. Let's avoid the div-by-zero here and +inside _dpu_crtc_setup_lm_bounds() by skipping this part of the atomic +check if dpu_encoder_virt_mode_set() hasn't been called yet. This fixes +an UBSAN warning: + + UBSAN: Undefined behaviour in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c:860:31 + division by zero + CPU: 7 PID: 409 Comm: frecon Tainted: G S 5.4.31 #128 + Hardware name: Google Trogdor (rev0) (DT) + Call trace: + dump_backtrace+0x0/0x14c + show_stack+0x20/0x2c + dump_stack+0xa0/0xd8 + __ubsan_handle_divrem_overflow+0xec/0x110 + dpu_crtc_atomic_check+0x97c/0x9d4 + drm_atomic_helper_check_planes+0x160/0x1c8 + drm_atomic_helper_check+0x54/0xbc + drm_atomic_check_only+0x6a8/0x880 + drm_atomic_commit+0x20/0x5c + drm_atomic_helper_set_config+0x98/0xa0 + drm_mode_setcrtc+0x308/0x5dc + drm_ioctl_kernel+0x9c/0x114 + drm_ioctl+0x2ac/0x4b0 + drm_compat_ioctl+0xe8/0x13c + __arm64_compat_sys_ioctl+0x184/0x324 + el0_svc_common+0xa4/0x154 + el0_svc_compat_handler+0x + +Cc: Abhinav Kumar +Cc: Jeykumar Sankaran +Cc: Jordan Crouse +Cc: Sean Paul +Fixes: 25fdd5933e4c ("drm/msm: Add SDM845 DPU support") +Signed-off-by: Stephen Boyd +Reviewed-by: Abhinav Kumar +Tested-by: Sai Prakash Ranjan +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +index 1026e1e5bec10..4d81a0c73616f 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c +@@ -881,7 +881,7 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, + struct drm_plane *plane; + struct drm_display_mode *mode; + +- int cnt = 0, rc = 0, mixer_width, i, z_pos; ++ int cnt = 0, rc = 0, mixer_width = 0, i, z_pos; + + struct dpu_multirect_plane_states multirect_plane[DPU_STAGE_MAX * 2]; + int multirect_count = 0; +@@ -914,9 +914,11 @@ static int dpu_crtc_atomic_check(struct drm_crtc *crtc, + + memset(pipe_staged, 0, sizeof(pipe_staged)); + +- mixer_width = mode->hdisplay / cstate->num_mixers; ++ if (cstate->num_mixers) { ++ mixer_width = mode->hdisplay / cstate->num_mixers; + +- _dpu_crtc_setup_lm_bounds(crtc, state); ++ _dpu_crtc_setup_lm_bounds(crtc, state); ++ } + + crtc_rect.x2 = mode->hdisplay; + crtc_rect.y2 = mode->vdisplay; +-- +2.25.1 + diff --git a/queue-5.8/drm-mxsfb-check-framebuffer-pitch.patch b/queue-5.8/drm-mxsfb-check-framebuffer-pitch.patch new file mode 100644 index 00000000000..5cdc68f5eca --- /dev/null +++ b/queue-5.8/drm-mxsfb-check-framebuffer-pitch.patch @@ -0,0 +1,71 @@ +From 3d6669c564c9e059a4e57af770e55a8bfd295a85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 16:16:54 +0200 +Subject: drm: mxsfb: check framebuffer pitch + +From: Stefan Agner + +[ Upstream commit d5a0c816900419105a12e7471bf074319dfa34be ] + +The lcdif IP does not support a framebuffer pitch (stride) other than +framebuffer width. Check for equality and reject the framebuffer +otherwise. + +This prevents a distorted picture when using 640x800 and running the +Mesa graphics stack. Mesa tries to use a cache aligned stride, which +leads at that particular resolution to width != stride. Currently +Mesa has no fallback behavior, but rejecting this configuration allows +userspace to handle the issue correctly. + +Fixes: 45d59d704080 ("drm: Add new driver for MXSFB controller") +Signed-off-by: Stefan Agner +Reviewed-by: Laurent Pinchart +Link: https://patchwork.freedesktop.org/patch/msgid/20200908141654.266836-1-stefan@agner.ch +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mxsfb/mxsfb_drv.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mxsfb/mxsfb_drv.c b/drivers/gpu/drm/mxsfb/mxsfb_drv.c +index 497cf443a9afa..0b02e65a89e79 100644 +--- a/drivers/gpu/drm/mxsfb/mxsfb_drv.c ++++ b/drivers/gpu/drm/mxsfb/mxsfb_drv.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -87,8 +88,26 @@ void mxsfb_disable_axi_clk(struct mxsfb_drm_private *mxsfb) + clk_disable_unprepare(mxsfb->clk_axi); + } + ++static struct drm_framebuffer * ++mxsfb_fb_create(struct drm_device *dev, struct drm_file *file_priv, ++ const struct drm_mode_fb_cmd2 *mode_cmd) ++{ ++ const struct drm_format_info *info; ++ ++ info = drm_get_format_info(dev, mode_cmd); ++ if (!info) ++ return ERR_PTR(-EINVAL); ++ ++ if (mode_cmd->width * info->cpp[0] != mode_cmd->pitches[0]) { ++ dev_dbg(dev->dev, "Invalid pitch: fb width must match pitch\n"); ++ return ERR_PTR(-EINVAL); ++ } ++ ++ return drm_gem_fb_create(dev, file_priv, mode_cmd); ++} ++ + static const struct drm_mode_config_funcs mxsfb_mode_config_funcs = { +- .fb_create = drm_gem_fb_create, ++ .fb_create = mxsfb_fb_create, + .atomic_check = drm_atomic_helper_check, + .atomic_commit = drm_atomic_helper_commit, + }; +-- +2.25.1 + diff --git a/queue-5.8/drm-panel-fix-bpc-for-ortustech-com43h4m85ulc-panel.patch b/queue-5.8/drm-panel-fix-bpc-for-ortustech-com43h4m85ulc-panel.patch new file mode 100644 index 00000000000..2dbdd6775f3 --- /dev/null +++ b/queue-5.8/drm-panel-fix-bpc-for-ortustech-com43h4m85ulc-panel.patch @@ -0,0 +1,39 @@ +From 144487cebba92e669a2374a448e18f734cf154f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 03:32:54 +0300 +Subject: drm: panel: Fix bpc for OrtusTech COM43H4M85ULC panel + +From: Laurent Pinchart + +[ Upstream commit 3b8095169982ff4ec2a1b4be61b7224bbef23b48 ] + +The OrtusTech COM43H4M85ULC panel is a 18-bit RGB panel. Commit +f098f168e91c ("drm: panel: Fix bus format for OrtusTech COM43H4M85ULC +panel") has fixed the bus formats, but forgot to address the bpc value. +Set it to 6. + +Fixes: f098f168e91c ("drm: panel: Fix bus format for OrtusTech COM43H4M85ULC panel") +Signed-off-by: Laurent Pinchart +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20200824003254.21904-1-laurent.pinchart@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 85fa4027d82d7..4b4ca31a2d577 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -2862,7 +2862,7 @@ static const struct drm_display_mode ortustech_com43h4m85ulc_mode = { + static const struct panel_desc ortustech_com43h4m85ulc = { + .modes = &ortustech_com43h4m85ulc_mode, + .num_modes = 1, +- .bpc = 8, ++ .bpc = 6, + .size = { + .width = 56, + .height = 93, +-- +2.25.1 + diff --git a/queue-5.8/drm-panel-fix-bus-format-for-ortustech-com43h4m85ulc.patch b/queue-5.8/drm-panel-fix-bus-format-for-ortustech-com43h4m85ulc.patch new file mode 100644 index 00000000000..23b78972313 --- /dev/null +++ b/queue-5.8/drm-panel-fix-bus-format-for-ortustech-com43h4m85ulc.patch @@ -0,0 +1,37 @@ +From 4936077280e8f121fb8b022512feecbce10db465 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 01:02:44 +0300 +Subject: drm: panel: Fix bus format for OrtusTech COM43H4M85ULC panel + +From: Laurent Pinchart + +[ Upstream commit f098f168e91ca915c6cf8aa316136af647792f2f ] + +The OrtusTech COM43H4M85ULC panel is a 18-bit RGB panel, set the bus +format to MEDIA_BUS_FMT_RGB666_1X18. + +Fixes: 725c9d40f3fe ("drm/panel: Add support for OrtusTech COM43H4M85ULC panel") +Signed-off-by: Laurent Pinchart +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20200812220244.24500-1-laurent.pinchart@ideasonboard.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panel/panel-simple.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 7debf2ca42522..85fa4027d82d7 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -2867,7 +2867,7 @@ static const struct panel_desc ortustech_com43h4m85ulc = { + .width = 56, + .height = 93, + }, +- .bus_format = MEDIA_BUS_FMT_RGB888_1X24, ++ .bus_format = MEDIA_BUS_FMT_RGB666_1X18, + .bus_flags = DRM_BUS_FLAG_DE_HIGH | DRM_BUS_FLAG_PIXDATA_DRIVE_POSEDGE, + .connector_type = DRM_MODE_CONNECTOR_DPI, + }; +-- +2.25.1 + diff --git a/queue-5.8/drm-panfrost-add-amlogic-gpu-integration-quirks.patch b/queue-5.8/drm-panfrost-add-amlogic-gpu-integration-quirks.patch new file mode 100644 index 00000000000..70f82e91048 --- /dev/null +++ b/queue-5.8/drm-panfrost-add-amlogic-gpu-integration-quirks.patch @@ -0,0 +1,49 @@ +From 563f9f573391b436dbab98b55dce5679e651109b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 17:01:47 +0200 +Subject: drm/panfrost: add Amlogic GPU integration quirks + +From: Neil Armstrong + +[ Upstream commit afcd0c7d3d4c22afc8befcfc906db6ce3058d3ee ] + +This adds the required GPU quirks, including the quirk in the PWR +registers at the GPU reset time and the IOMMU quirk for shareability +issues observed on G52 in Amlogic G12B SoCs. + +Signed-off-by: Neil Armstrong +Reviewed-by: Steven Price +Reviewed-by: Alyssa Rosenzweig +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20200916150147.25753-4-narmstrong@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/panfrost_drv.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/drivers/gpu/drm/panfrost/panfrost_drv.c b/drivers/gpu/drm/panfrost/panfrost_drv.c +index 882fecc33fdb1..6e11a73e81aa3 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_drv.c ++++ b/drivers/gpu/drm/panfrost/panfrost_drv.c +@@ -667,7 +667,18 @@ static const struct panfrost_compatible default_data = { + .pm_domain_names = NULL, + }; + ++static const struct panfrost_compatible amlogic_data = { ++ .num_supplies = ARRAY_SIZE(default_supplies), ++ .supply_names = default_supplies, ++ .vendor_quirk = panfrost_gpu_amlogic_quirk, ++}; ++ + static const struct of_device_id dt_match[] = { ++ /* Set first to probe before the generic compatibles */ ++ { .compatible = "amlogic,meson-gxm-mali", ++ .data = &amlogic_data, }, ++ { .compatible = "amlogic,meson-g12a-mali", ++ .data = &amlogic_data, }, + { .compatible = "arm,mali-t604", .data = &default_data, }, + { .compatible = "arm,mali-t624", .data = &default_data, }, + { .compatible = "arm,mali-t628", .data = &default_data, }, +-- +2.25.1 + diff --git a/queue-5.8/drm-panfrost-add-amlogic-reset-quirk-callback.patch b/queue-5.8/drm-panfrost-add-amlogic-reset-quirk-callback.patch new file mode 100644 index 00000000000..c744e203a30 --- /dev/null +++ b/queue-5.8/drm-panfrost-add-amlogic-reset-quirk-callback.patch @@ -0,0 +1,81 @@ +From 9c866fcff87b6f62804cb2fa8d39582f76a18745 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 17:01:46 +0200 +Subject: drm/panfrost: add amlogic reset quirk callback + +From: Neil Armstrong + +[ Upstream commit 110003002291525bb209f47e6dbf121a63249a97 ] + +The T820, G31 & G52 GPUs integrated by Amlogic in the respective GXM, +G12A/SM1 & G12B SoCs needs a quirk in the PWR registers at the GPU reset +time. + +Since the Amlogic's integration of the GPU cores with the SoC is not +publicly documented we do not know what does these values, but they +permit having a fully functional GPU running with Panfrost. + +Signed-off-by: Neil Armstrong +[Steven: Fix typo in commit log] +Reviewed-by: Steven Price +Reviewed-by: Alyssa Rosenzweig +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20200916150147.25753-3-narmstrong@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/panfrost_gpu.c | 11 +++++++++++ + drivers/gpu/drm/panfrost/panfrost_gpu.h | 2 ++ + drivers/gpu/drm/panfrost/panfrost_regs.h | 4 ++++ + 3 files changed, 17 insertions(+) + +diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c +index dfe4c9151eaf2..a9d08a2927aa3 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c +@@ -75,6 +75,17 @@ int panfrost_gpu_soft_reset(struct panfrost_device *pfdev) + return 0; + } + ++void panfrost_gpu_amlogic_quirk(struct panfrost_device *pfdev) ++{ ++ /* ++ * The Amlogic integrated Mali-T820, Mali-G31 & Mali-G52 needs ++ * these undocumented bits in GPU_PWR_OVERRIDE1 to be set in order ++ * to operate correctly. ++ */ ++ gpu_write(pfdev, GPU_PWR_KEY, GPU_PWR_KEY_UNLOCK); ++ gpu_write(pfdev, GPU_PWR_OVERRIDE1, 0xfff | (0x20 << 16)); ++} ++ + static void panfrost_gpu_init_quirks(struct panfrost_device *pfdev) + { + u32 quirks = 0; +diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.h b/drivers/gpu/drm/panfrost/panfrost_gpu.h +index 4112412087b27..468c51e7e46db 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gpu.h ++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.h +@@ -16,4 +16,6 @@ int panfrost_gpu_soft_reset(struct panfrost_device *pfdev); + void panfrost_gpu_power_on(struct panfrost_device *pfdev); + void panfrost_gpu_power_off(struct panfrost_device *pfdev); + ++void panfrost_gpu_amlogic_quirk(struct panfrost_device *pfdev); ++ + #endif +diff --git a/drivers/gpu/drm/panfrost/panfrost_regs.h b/drivers/gpu/drm/panfrost/panfrost_regs.h +index ea38ac60581c6..eddaa62ad8b0e 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_regs.h ++++ b/drivers/gpu/drm/panfrost/panfrost_regs.h +@@ -51,6 +51,10 @@ + #define GPU_STATUS 0x34 + #define GPU_STATUS_PRFCNT_ACTIVE BIT(2) + #define GPU_LATEST_FLUSH_ID 0x38 ++#define GPU_PWR_KEY 0x50 /* (WO) Power manager key register */ ++#define GPU_PWR_KEY_UNLOCK 0x2968A819 ++#define GPU_PWR_OVERRIDE0 0x54 /* (RW) Power manager override settings */ ++#define GPU_PWR_OVERRIDE1 0x58 /* (RW) Power manager override settings */ + #define GPU_FAULT_STATUS 0x3C + #define GPU_FAULT_ADDRESS_LO 0x40 + #define GPU_FAULT_ADDRESS_HI 0x44 +-- +2.25.1 + diff --git a/queue-5.8/drm-panfrost-add-support-for-vendor-quirk.patch b/queue-5.8/drm-panfrost-add-support-for-vendor-quirk.patch new file mode 100644 index 00000000000..f301671f507 --- /dev/null +++ b/queue-5.8/drm-panfrost-add-support-for-vendor-quirk.patch @@ -0,0 +1,58 @@ +From ddb115c115c2eeb823aa5c5a34ae81816f93a4e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 17:01:45 +0200 +Subject: drm/panfrost: add support for vendor quirk + +From: Neil Armstrong + +[ Upstream commit 91e89097b86f566636ea5a7329c79d5521be46d2 ] + +The T820, G31 & G52 GPUs integrated by Amlogic in the respective GXM, +G12A/SM1 & G12B SoCs needs a quirk in the PWR registers after each reset. + +This adds a callback in the device compatible struct of permit this. + +Signed-off-by: Neil Armstrong +[Steven: Fix typo in commit log] +Reviewed-by: Steven Price +Reviewed-by: Alyssa Rosenzweig +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20200916150147.25753-2-narmstrong@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/panfrost_device.h | 3 +++ + drivers/gpu/drm/panfrost/panfrost_gpu.c | 4 ++++ + 2 files changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/panfrost/panfrost_device.h b/drivers/gpu/drm/panfrost/panfrost_device.h +index c30c719a80594..3c4a85213c15f 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_device.h ++++ b/drivers/gpu/drm/panfrost/panfrost_device.h +@@ -69,6 +69,9 @@ struct panfrost_compatible { + int num_pm_domains; + /* Only required if num_pm_domains > 1. */ + const char * const *pm_domain_names; ++ ++ /* Vendor implementation quirks callback */ ++ void (*vendor_quirk)(struct panfrost_device *pfdev); + }; + + struct panfrost_device { +diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c +index a9d08a2927aa3..165403878ad9b 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c +@@ -146,6 +146,10 @@ static void panfrost_gpu_init_quirks(struct panfrost_device *pfdev) + + if (quirks) + gpu_write(pfdev, GPU_JM_CONFIG, quirks); ++ ++ /* Here goes platform specific quirks */ ++ if (pfdev->comp->vendor_quirk) ++ pfdev->comp->vendor_quirk(pfdev); + } + + #define MAX_HW_REVS 6 +-- +2.25.1 + diff --git a/queue-5.8/drm-panfrost-ensure-gpu-quirks-are-always-initialise.patch b/queue-5.8/drm-panfrost-ensure-gpu-quirks-are-always-initialise.patch new file mode 100644 index 00000000000..ef0a258f74d --- /dev/null +++ b/queue-5.8/drm-panfrost-ensure-gpu-quirks-are-always-initialise.patch @@ -0,0 +1,50 @@ +From 1f0fc779d055374529bd60b3f618e8875bdfd923 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 13:29:57 +0100 +Subject: drm/panfrost: Ensure GPU quirks are always initialised + +From: Steven Price + +[ Upstream commit 8c3c818c23a5bbce6ff180dd2ee04415241df77c ] + +The GPU 'CONFIG' registers used to work around hardware issues are +cleared on reset so need to be programmed every time the GPU is reset. +However panfrost_device_reset() failed to do this. + +To avoid this in future instead move the call to +panfrost_gpu_init_quirks() to panfrost_gpu_power_on() so that the +regsiters are always programmed just before the cores are powered. + +Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") +Signed-off-by: Steven Price +Reviewed-by: Alyssa Rosenzweig +Link: https://patchwork.freedesktop.org/patch/msgid/20200909122957.51667-1-steven.price@arm.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/panfrost_gpu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c +index f2c1ddc41a9bf..689b92893e0e1 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c +@@ -304,6 +304,8 @@ void panfrost_gpu_power_on(struct panfrost_device *pfdev) + int ret; + u32 val; + ++ panfrost_gpu_init_quirks(pfdev); ++ + /* Just turn on everything for now */ + gpu_write(pfdev, L2_PWRON_LO, pfdev->features.l2_present); + ret = readl_relaxed_poll_timeout(pfdev->iomem + L2_READY_LO, +@@ -355,7 +357,6 @@ int panfrost_gpu_init(struct panfrost_device *pfdev) + return err; + } + +- panfrost_gpu_init_quirks(pfdev); + panfrost_gpu_power_on(pfdev); + + return 0; +-- +2.25.1 + diff --git a/queue-5.8/drm-panfrost-increase-readl_relaxed_poll_timeout-val.patch b/queue-5.8/drm-panfrost-increase-readl_relaxed_poll_timeout-val.patch new file mode 100644 index 00000000000..63373551ff1 --- /dev/null +++ b/queue-5.8/drm-panfrost-increase-readl_relaxed_poll_timeout-val.patch @@ -0,0 +1,54 @@ +From 84ff309e322692c6cf33f1dba45fa7d6ea860cec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 14:17:38 +0000 +Subject: drm/panfrost: increase readl_relaxed_poll_timeout values + +From: Christian Hewitt + +[ Upstream commit c2df75ad2a9f205820e4bc0db936d3d9af3da1ae ] + +Amlogic SoC devices report the following errors frequently causing excessive +dmesg log spam and early log rotataion, although the errors appear to be +harmless as everything works fine: + +[ 7.202702] panfrost ffe40000.gpu: error powering up gpu L2 +[ 7.203760] panfrost ffe40000.gpu: error powering up gpu shader + +ARM staff have advised increasing the timeout values to eliminate the errors +in most normal scenarios, and testing with several different G31/G52 devices +shows 20000 to be a reliable value. + +Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") +Suggested-by: Steven Price +Signed-off-by: Christian Hewitt +Reviewed-by: Steven Price +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20201008141738.13560-1-christianshewitt@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/panfrost_gpu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c +index 689b92893e0e1..dfe4c9151eaf2 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c +@@ -309,13 +309,13 @@ void panfrost_gpu_power_on(struct panfrost_device *pfdev) + /* Just turn on everything for now */ + gpu_write(pfdev, L2_PWRON_LO, pfdev->features.l2_present); + ret = readl_relaxed_poll_timeout(pfdev->iomem + L2_READY_LO, +- val, val == pfdev->features.l2_present, 100, 1000); ++ val, val == pfdev->features.l2_present, 100, 20000); + if (ret) + dev_err(pfdev->dev, "error powering up gpu L2"); + + gpu_write(pfdev, SHADER_PWRON_LO, pfdev->features.shader_present); + ret = readl_relaxed_poll_timeout(pfdev->iomem + SHADER_READY_LO, +- val, val == pfdev->features.shader_present, 100, 1000); ++ val, val == pfdev->features.shader_present, 100, 20000); + if (ret) + dev_err(pfdev->dev, "error powering up gpu shader"); + +-- +2.25.1 + diff --git a/queue-5.8/drm-radeon-prefer-lower-feedback-dividers.patch b/queue-5.8/drm-radeon-prefer-lower-feedback-dividers.patch new file mode 100644 index 00000000000..06a5025071e --- /dev/null +++ b/queue-5.8/drm-radeon-prefer-lower-feedback-dividers.patch @@ -0,0 +1,48 @@ +From fa094c12465f76bc87546234215bb5d62a0ee03e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 01:33:48 +0800 +Subject: drm/radeon: Prefer lower feedback dividers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Kai-Heng Feng + +[ Upstream commit 5150dd85bdfa08143cacf1b4249121651bed3c35 ] + +Commit 2e26ccb119bd ("drm/radeon: prefer lower reference dividers") +fixed screen flicker for HP Compaq nx9420 but breaks other laptops like +Asus X50SL. + +Turns out we also need to favor lower feedback dividers. + +Users confirmed this change fixes the regression and doesn't regress the +original fix. + +Fixes: 2e26ccb119bd ("drm/radeon: prefer lower reference dividers") +BugLink: https://bugs.launchpad.net/bugs/1791312 +BugLink: https://bugs.launchpad.net/bugs/1861554 +Reviewed-by: Christian König +Signed-off-by: Kai-Heng Feng +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/radeon/radeon_display.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index df1a7eb736517..840c4bf6307fd 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -933,7 +933,7 @@ static void avivo_get_fb_ref_div(unsigned nom, unsigned den, unsigned post_div, + + /* get matching reference and feedback divider */ + *ref_div = min(max(den/post_div, 1u), ref_div_max); +- *fb_div = DIV_ROUND_CLOSEST(nom * *ref_div * post_div, den); ++ *fb_div = max(nom * *ref_div * post_div / den, 1u); + + /* limit fb divider to its maximum */ + if (*fb_div > fb_div_max) { +-- +2.25.1 + diff --git a/queue-5.8/drm-rcar-du-put-reference-to-vsp-device.patch b/queue-5.8/drm-rcar-du-put-reference-to-vsp-device.patch new file mode 100644 index 00000000000..da8867786c9 --- /dev/null +++ b/queue-5.8/drm-rcar-du-put-reference-to-vsp-device.patch @@ -0,0 +1,62 @@ +From f858a62c82d797c2715b1bb2a271905f171d388e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 02:23:47 +0300 +Subject: drm: rcar-du: Put reference to VSP device + +From: Laurent Pinchart + +[ Upstream commit 2a32dbdc2c7db5463483fa01fb220fd1b770c6bc ] + +The reference to the VSP device acquired with of_find_device_by_node() +in rcar_du_vsp_init() is never released. Fix it with a drmm action, +which gets run both in the probe error path and in the remove path. + +Fixes: 6d62ef3ac30b ("drm: rcar-du: Expose the VSP1 compositor through KMS planes") +Reported-by: Yu Kuai +Reviewed-by: Kieran Bingham +Signed-off-by: Laurent Pinchart +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/rcar-du/rcar_du_vsp.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c +index f1a81c9b184d4..fa09b3ae8b9d4 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_vsp.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_vsp.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -341,6 +342,13 @@ static const struct drm_plane_funcs rcar_du_vsp_plane_funcs = { + .atomic_destroy_state = rcar_du_vsp_plane_atomic_destroy_state, + }; + ++static void rcar_du_vsp_cleanup(struct drm_device *dev, void *res) ++{ ++ struct rcar_du_vsp *vsp = res; ++ ++ put_device(vsp->vsp); ++} ++ + int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np, + unsigned int crtcs) + { +@@ -357,6 +365,10 @@ int rcar_du_vsp_init(struct rcar_du_vsp *vsp, struct device_node *np, + + vsp->vsp = &pdev->dev; + ++ ret = drmm_add_action(rcdu->ddev, rcar_du_vsp_cleanup, vsp); ++ if (ret < 0) ++ return ret; ++ + ret = vsp1_du_init(vsp->vsp); + if (ret < 0) + return ret; +-- +2.25.1 + diff --git a/queue-5.8/drm-vgem-add-missing-platform_device_unregister-in-v.patch b/queue-5.8/drm-vgem-add-missing-platform_device_unregister-in-v.patch new file mode 100644 index 00000000000..c92797270bd --- /dev/null +++ b/queue-5.8/drm-vgem-add-missing-platform_device_unregister-in-v.patch @@ -0,0 +1,38 @@ +From 54249c4fb4c7daf60a646c756495ffc39a8415ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 20:59:42 +0800 +Subject: drm/vgem: add missing platform_device_unregister() in vgem_init() + +From: Qinglang Miao + +[ Upstream commit 57fb54082d5d14512dfd21bc39d91945d3ad1ee9 ] + +When vgem_init() get into out_put, the unregister call of +vgem_device->platform is missing. So add it before return. + +Fixes: 363de9e7d4f6 ("drm/vgem: Use drmm_add_final_kfree") +Signed-off-by: Qinglang Miao +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20200810125942.186637-1-miaoqinglang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vgem/vgem_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vgem/vgem_drv.c b/drivers/gpu/drm/vgem/vgem_drv.c +index fa39d140adc6c..94825ec3a09d8 100644 +--- a/drivers/gpu/drm/vgem/vgem_drv.c ++++ b/drivers/gpu/drm/vgem/vgem_drv.c +@@ -471,8 +471,8 @@ static int __init vgem_init(void) + + out_put: + drm_dev_put(&vgem_device->drm); ++ platform_device_unregister(vgem_device->platform); + return ret; +- + out_unregister: + platform_device_unregister(vgem_device->platform); + out_free: +-- +2.25.1 + diff --git a/queue-5.8/drm-vkms-add-missing-platform_device_unregister-in-v.patch b/queue-5.8/drm-vkms-add-missing-platform_device_unregister-in-v.patch new file mode 100644 index 00000000000..23c14e023ee --- /dev/null +++ b/queue-5.8/drm-vkms-add-missing-platform_device_unregister-in-v.patch @@ -0,0 +1,38 @@ +From 5f2f6f1d8117c0210cb745e17f0ed03dbb0300e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 21:00:11 +0800 +Subject: drm/vkms: add missing platform_device_unregister() in vkms_init() + +From: Qinglang Miao + +[ Upstream commit 7995bd13296111d672d8c5959f5e81dbbbda5286 ] + +When vkms_init() get into out_put, the unregister call of +vkms_device->platform is missing. So add it before return. + +Fixes: ac19f140bc27 ("drm/vkms: Use drmm_add_final_kfree") +Signed-off-by: Qinglang Miao +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20200810130011.187691-1-miaoqinglang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vkms/vkms_drv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_drv.c b/drivers/gpu/drm/vkms/vkms_drv.c +index 1e8b2169d8341..e6a3ea1b399a7 100644 +--- a/drivers/gpu/drm/vkms/vkms_drv.c ++++ b/drivers/gpu/drm/vkms/vkms_drv.c +@@ -188,8 +188,8 @@ static int __init vkms_init(void) + + out_put: + drm_dev_put(&vkms_device->drm); ++ platform_device_unregister(vkms_device->platform); + return ret; +- + out_unregister: + platform_device_unregister(vkms_device->platform); + out_free: +-- +2.25.1 + diff --git a/queue-5.8/drm-vkms-fix-xrgb-on-compute-crc.patch b/queue-5.8/drm-vkms-fix-xrgb-on-compute-crc.patch new file mode 100644 index 00000000000..340db702cfd --- /dev/null +++ b/queue-5.8/drm-vkms-fix-xrgb-on-compute-crc.patch @@ -0,0 +1,39 @@ +From d38bba7345e38b233a1dfb08d0c345e721d7b34e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jul 2020 17:25:24 -0300 +Subject: drm/vkms: fix xrgb on compute crc + +From: Melissa Wen + +[ Upstream commit 0986191186128b10b6bbfa5220fc587ed5725e49 ] + +The previous memset operation was not correctly zeroing the alpha +channel to compute the crc, and as a result, the IGT subtest +kms_cursor_crc/pipe-A-cursor-alpha-transparent fails. + +Fixes: db7f419c06d7c ("drm/vkms: Compute CRC with Cursor Plane") + +Signed-off-by: Melissa Wen +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20200730202524.5upzuh4irboru7my@smtp.gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vkms/vkms_composer.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/vkms/vkms_composer.c b/drivers/gpu/drm/vkms/vkms_composer.c +index 4af2f19480f4f..b8b060354667e 100644 +--- a/drivers/gpu/drm/vkms/vkms_composer.c ++++ b/drivers/gpu/drm/vkms/vkms_composer.c +@@ -33,7 +33,7 @@ static uint32_t compute_crc(void *vaddr_out, struct vkms_composer *composer) + + (i * composer->pitch) + + (j * composer->cpp); + /* XRGB format ignores Alpha channel */ +- memset(vaddr_out + src_offset + 24, 0, 8); ++ bitmap_clear(vaddr_out + src_offset, 24, 8); + crc = crc32_le(crc, vaddr_out + src_offset, + sizeof(u32)); + } +-- +2.25.1 + diff --git a/queue-5.8/dt-bindings-crypto-specify-that-allwinner-sun8i-a33-.patch b/queue-5.8/dt-bindings-crypto-specify-that-allwinner-sun8i-a33-.patch new file mode 100644 index 00000000000..ee448e2bd5f --- /dev/null +++ b/queue-5.8/dt-bindings-crypto-specify-that-allwinner-sun8i-a33-.patch @@ -0,0 +1,51 @@ +From a8209c2ca0ce942d1c36969ac7362caa6e55dcd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 19:54:37 +0200 +Subject: dt-bindings: crypto: Specify that allwinner, sun8i-a33-crypto needs + reset + +From: Corentin Labbe + +[ Upstream commit 884d1a334ae8130fabede56f59b224619ad6bca4 ] + +When adding allwinner,sun8i-a33-crypto, I forgot to add that it needs reset. +Furthermore, there are no need to use items to list only one compatible +in compatible list. + +Fixes: f81547ba7a98 ("dt-bindings: crypto: add new compatible for A33 SS") +Signed-off-by: Corentin Labbe +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20200907175437.4464-1-clabbe.montjoie@gmail.com +Signed-off-by: Sasha Levin +--- + .../bindings/crypto/allwinner,sun4i-a10-crypto.yaml | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/Documentation/devicetree/bindings/crypto/allwinner,sun4i-a10-crypto.yaml b/Documentation/devicetree/bindings/crypto/allwinner,sun4i-a10-crypto.yaml +index fc823572bcff2..90c6d039b91b0 100644 +--- a/Documentation/devicetree/bindings/crypto/allwinner,sun4i-a10-crypto.yaml ++++ b/Documentation/devicetree/bindings/crypto/allwinner,sun4i-a10-crypto.yaml +@@ -23,8 +23,7 @@ properties: + - items: + - const: allwinner,sun7i-a20-crypto + - const: allwinner,sun4i-a10-crypto +- - items: +- - const: allwinner,sun8i-a33-crypto ++ - const: allwinner,sun8i-a33-crypto + + reg: + maxItems: 1 +@@ -59,7 +58,9 @@ if: + properties: + compatible: + contains: +- const: allwinner,sun6i-a31-crypto ++ enum: ++ - allwinner,sun6i-a31-crypto ++ - allwinner,sun8i-a33-crypto + + then: + required: +-- +2.25.1 + diff --git a/queue-5.8/edac-aspeed-fix-handling-of-platform_get_irq-error.patch b/queue-5.8/edac-aspeed-fix-handling-of-platform_get_irq-error.patch new file mode 100644 index 00000000000..dc8d105d33d --- /dev/null +++ b/queue-5.8/edac-aspeed-fix-handling-of-platform_get_irq-error.patch @@ -0,0 +1,43 @@ +From fa10e37b6210638cd7637a1f591da4fc297800f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 09:07:42 +0200 +Subject: EDAC/aspeed: Fix handling of platform_get_irq() error + +From: Krzysztof Kozlowski + +[ Upstream commit afce6996943be265fa39240b67025cfcb1bcdfb1 ] + +platform_get_irq() returns a negative error number on error. In such a +case, comparison to 0 would pass the check therefore check the return +value properly, whether it is negative. + + [ bp: Massage commit message. ] + +Fixes: 9b7e6242ee4e ("EDAC, aspeed: Add an Aspeed AST2500 EDAC driver") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Borislav Petkov +Reviewed-by: Stefan Schaeckeler +Link: https://lkml.kernel.org/r/20200827070743.26628-1-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/edac/aspeed_edac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/edac/aspeed_edac.c b/drivers/edac/aspeed_edac.c +index b194658b8b5c9..fbec28dc661d7 100644 +--- a/drivers/edac/aspeed_edac.c ++++ b/drivers/edac/aspeed_edac.c +@@ -209,8 +209,8 @@ static int config_irq(void *ctx, struct platform_device *pdev) + /* register interrupt handler */ + irq = platform_get_irq(pdev, 0); + dev_dbg(&pdev->dev, "got irq %d\n", irq); +- if (!irq) +- return -ENODEV; ++ if (irq < 0) ++ return irq; + + rc = devm_request_irq(&pdev->dev, irq, mcr_isr, IRQF_TRIGGER_HIGH, + DRV_NAME, ctx); +-- +2.25.1 + diff --git a/queue-5.8/edac-i5100-fix-error-handling-order-in-i5100_init_on.patch b/queue-5.8/edac-i5100-fix-error-handling-order-in-i5100_init_on.patch new file mode 100644 index 00000000000..7ddd9be96b0 --- /dev/null +++ b/queue-5.8/edac-i5100-fix-error-handling-order-in-i5100_init_on.patch @@ -0,0 +1,69 @@ +From d4c049cfe969aa68da1021135525ac3f66f5c84b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 20:14:37 +0800 +Subject: EDAC/i5100: Fix error handling order in i5100_init_one() + +From: Dinghao Liu + +[ Upstream commit 857a3139bd8be4f702c030c8ca06f3fd69c1741a ] + +When pci_get_device_func() fails, the driver doesn't need to execute +pci_dev_put(). mci should still be freed, though, to prevent a memory +leak. When pci_enable_device() fails, the error injection PCI device +"einj" doesn't need to be disabled either. + + [ bp: Massage commit message, rename label to "bail_mc_free". ] + +Fixes: 52608ba205461 ("i5100_edac: probe for device 19 function 0") +Signed-off-by: Dinghao Liu +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20200826121437.31606-1-dinghao.liu@zju.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/edac/i5100_edac.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c +index 191aa7c19ded7..324a46b8479b0 100644 +--- a/drivers/edac/i5100_edac.c ++++ b/drivers/edac/i5100_edac.c +@@ -1061,16 +1061,15 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + PCI_DEVICE_ID_INTEL_5100_19, 0); + if (!einj) { + ret = -ENODEV; +- goto bail_einj; ++ goto bail_mc_free; + } + + rc = pci_enable_device(einj); + if (rc < 0) { + ret = rc; +- goto bail_disable_einj; ++ goto bail_einj; + } + +- + mci->pdev = &pdev->dev; + + priv = mci->pvt_info; +@@ -1136,14 +1135,14 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + bail_scrub: + priv->scrub_enable = 0; + cancel_delayed_work_sync(&(priv->i5100_scrubbing)); +- edac_mc_free(mci); +- +-bail_disable_einj: + pci_disable_device(einj); + + bail_einj: + pci_dev_put(einj); + ++bail_mc_free: ++ edac_mc_free(mci); ++ + bail_disable_ch1: + pci_disable_device(ch1mm); + +-- +2.25.1 + diff --git a/queue-5.8/edac-ti-fix-handling-of-platform_get_irq-error.patch b/queue-5.8/edac-ti-fix-handling-of-platform_get_irq-error.patch new file mode 100644 index 00000000000..87d599d9ba4 --- /dev/null +++ b/queue-5.8/edac-ti-fix-handling-of-platform_get_irq-error.patch @@ -0,0 +1,42 @@ +From 860d8929f41dbb5097c9dece6fa3440181ef70b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 09:07:43 +0200 +Subject: EDAC/ti: Fix handling of platform_get_irq() error + +From: Krzysztof Kozlowski + +[ Upstream commit 66077adb70a2a9e92540155b2ace33ec98299c90 ] + +platform_get_irq() returns a negative error number on error. In such a +case, comparison to 0 would pass the check therefore check the return +value properly, whether it is negative. + + [ bp: Massage commit message. ] + +Fixes: 86a18ee21e5e ("EDAC, ti: Add support for TI keystone and DRA7xx EDAC") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Borislav Petkov +Reviewed-by: Tero Kristo +Link: https://lkml.kernel.org/r/20200827070743.26628-2-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/edac/ti_edac.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/edac/ti_edac.c b/drivers/edac/ti_edac.c +index 8be3e89a510e4..d7419a90a2f5b 100644 +--- a/drivers/edac/ti_edac.c ++++ b/drivers/edac/ti_edac.c +@@ -278,7 +278,8 @@ static int ti_edac_probe(struct platform_device *pdev) + + /* add EMIF ECC error handler */ + error_irq = platform_get_irq(pdev, 0); +- if (!error_irq) { ++ if (error_irq < 0) { ++ ret = error_irq; + edac_printk(KERN_ERR, EDAC_MOD_NAME, + "EMIF irq number not defined.\n"); + goto err; +-- +2.25.1 + diff --git a/queue-5.8/ext4-disallow-modifying-dax-inode-flag-if-inline_dat.patch b/queue-5.8/ext4-disallow-modifying-dax-inode-flag-if-inline_dat.patch new file mode 100644 index 00000000000..8855f79fa59 --- /dev/null +++ b/queue-5.8/ext4-disallow-modifying-dax-inode-flag-if-inline_dat.patch @@ -0,0 +1,55 @@ +From f1857b794c44514d90f250829b98ecc647235f15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 16:43:30 +0800 +Subject: ext4: disallow modifying DAX inode flag if inline_data has been set + +From: Xiao Yang + +[ Upstream commit aa2f77920b743c44e02e2dc8474bbf8bd30007a2 ] + +inline_data is mutually exclusive to DAX so enabling both of them triggers +the following issue: +------------------------------------------ +# mkfs.ext4 -F -O inline_data /dev/pmem1 +... +# mount /dev/pmem1 /mnt +# echo 'test' >/mnt/file +# lsattr -l /mnt/file +/mnt/file Inline_Data +# xfs_io -c "chattr +x" /mnt/file +# xfs_io -c "lsattr -v" /mnt/file +[dax] /mnt/file +# umount /mnt +# mount /dev/pmem1 /mnt +# cat /mnt/file +cat: /mnt/file: Numerical result out of range +------------------------------------------ + +Fixes: b383a73f2b83 ("fs/ext4: Introduce DAX inode flag") +Signed-off-by: Xiao Yang +Reviewed-by: Jan Kara +Reviewed-by: Ira Weiny +Reviewed-by: Andreas Dilger +Link: https://lore.kernel.org/r/20200828084330.15776-1-yangx.jy@cn.fujitsu.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/ext4.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index ff46defc65683..dc943e714d142 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -466,7 +466,7 @@ struct flex_groups { + + /* Flags which are mutually exclusive to DAX */ + #define EXT4_DAX_MUT_EXCL (EXT4_VERITY_FL | EXT4_ENCRYPT_FL |\ +- EXT4_JOURNAL_DATA_FL) ++ EXT4_JOURNAL_DATA_FL | EXT4_INLINE_DATA_FL) + + /* Mask out flags that are inappropriate for the given type of inode. */ + static inline __u32 ext4_mask_flags(umode_t mode, __u32 flags) +-- +2.25.1 + diff --git a/queue-5.8/ext4-discard-preallocations-before-releasing-group-l.patch b/queue-5.8/ext4-discard-preallocations-before-releasing-group-l.patch new file mode 100644 index 00000000000..bb6d3d67cee --- /dev/null +++ b/queue-5.8/ext4-discard-preallocations-before-releasing-group-l.patch @@ -0,0 +1,99 @@ +From fafb4cd70f3d99fa4b97b89789ee010fa411a12f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 17:09:59 +0200 +Subject: ext4: discard preallocations before releasing group lock + +From: Jan Kara + +[ Upstream commit 5b3dc19dda6691e8ab574e8eede1aef6f02a4f1c ] + +ext4_mb_discard_group_preallocations() can be releasing group lock with +preallocations accumulated on its local list. Thus although +discard_pa_seq was incremented and concurrent allocating processes will +be retrying allocations, it can happen that premature ENOSPC error is +returned because blocks used for preallocations are not available for +reuse yet. Make sure we always free locally accumulated preallocations +before releasing group lock. + +Fixes: 07b5b8e1ac40 ("ext4: mballoc: introduce pcpu seqcnt for freeing PA to improve ENOSPC handling") +Signed-off-by: Jan Kara +Link: https://lore.kernel.org/r/20200924150959.4335-1-jack@suse.cz +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 33 +++++++++++++-------------------- + 1 file changed, 13 insertions(+), 20 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 787a894f5d1da..79d32ea606aa1 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -4037,7 +4037,7 @@ ext4_mb_discard_group_preallocations(struct super_block *sb, + struct ext4_buddy e4b; + int err; + int busy = 0; +- int free = 0; ++ int free, free_total = 0; + + mb_debug(sb, "discard preallocation for group %u\n", group); + if (list_empty(&grp->bb_prealloc_list)) +@@ -4065,6 +4065,7 @@ ext4_mb_discard_group_preallocations(struct super_block *sb, + + INIT_LIST_HEAD(&list); + repeat: ++ free = 0; + ext4_lock_group(sb, group); + list_for_each_entry_safe(pa, tmp, + &grp->bb_prealloc_list, pa_group_list) { +@@ -4094,22 +4095,6 @@ ext4_mb_discard_group_preallocations(struct super_block *sb, + list_add(&pa->u.pa_tmp_list, &list); + } + +- /* if we still need more blocks and some PAs were used, try again */ +- if (free < needed && busy) { +- busy = 0; +- ext4_unlock_group(sb, group); +- cond_resched(); +- goto repeat; +- } +- +- /* found anything to free? */ +- if (list_empty(&list)) { +- BUG_ON(free != 0); +- mb_debug(sb, "Someone else may have freed PA for this group %u\n", +- group); +- goto out; +- } +- + /* now free all selected PAs */ + list_for_each_entry_safe(pa, tmp, &list, u.pa_tmp_list) { + +@@ -4127,14 +4112,22 @@ ext4_mb_discard_group_preallocations(struct super_block *sb, + call_rcu(&(pa)->u.pa_rcu, ext4_mb_pa_callback); + } + +-out: ++ free_total += free; ++ ++ /* if we still need more blocks and some PAs were used, try again */ ++ if (free_total < needed && busy) { ++ ext4_unlock_group(sb, group); ++ cond_resched(); ++ busy = 0; ++ goto repeat; ++ } + ext4_unlock_group(sb, group); + ext4_mb_unload_buddy(&e4b); + put_bh(bitmap_bh); + out_dbg: + mb_debug(sb, "discarded (%d) blocks preallocated for group %u bb_free (%d)\n", +- free, group, grp->bb_free); +- return free; ++ free_total, group, grp->bb_free); ++ return free_total; + } + + /* +-- +2.25.1 + diff --git a/queue-5.8/ext4-fix-dead-loop-in-ext4_mb_new_blocks.patch b/queue-5.8/ext4-fix-dead-loop-in-ext4_mb_new_blocks.patch new file mode 100644 index 00000000000..740e437ca9e --- /dev/null +++ b/queue-5.8/ext4-fix-dead-loop-in-ext4_mb_new_blocks.patch @@ -0,0 +1,73 @@ +From 7928fc60c49d09ddb9d94ceb695dac4d39bb0365 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 19:38:59 +0800 +Subject: ext4: fix dead loop in ext4_mb_new_blocks + +From: Ye Bin + +[ Upstream commit 70022da804f0f3f152115688885608c39182082e ] + +As we test disk offline/online with running fsstress, we find fsstress +process is keeping running state. +kworker/u32:3-262 [004] ...1 140.787471: ext4_mb_discard_preallocations: dev 8,32 needed 114 +.... +kworker/u32:3-262 [004] ...1 140.787471: ext4_mb_discard_preallocations: dev 8,32 needed 114 + +ext4_mb_new_blocks +repeat: + ext4_mb_discard_preallocations_should_retry(sb, ac, &seq) + freed = ext4_mb_discard_preallocations + ext4_mb_discard_group_preallocations + this_cpu_inc(discard_pa_seq); + ---> freed == 0 + seq_retry = ext4_get_discard_pa_seq_sum + for_each_possible_cpu(__cpu) + __seq += per_cpu(discard_pa_seq, __cpu); + if (seq_retry != *seq) { + *seq = seq_retry; + ret = true; + } + +As we see seq_retry is sum of discard_pa_seq every cpu, if +ext4_mb_discard_group_preallocations return zero discard_pa_seq in this +cpu maybe increase one, so condition "seq_retry != *seq" have always +been met. +Ritesh Harjani suggest to in ext4_mb_discard_group_preallocations function we +only increase discard_pa_seq when there is some PA to free. + +Fixes: 07b5b8e1ac40 ("ext4: mballoc: introduce pcpu seqcnt for freeing PA to improve ENOSPC handling") +Signed-off-by: Ye Bin +Reviewed-by: Jan Kara +Reviewed-by: Ritesh Harjani +Link: https://lore.kernel.org/r/20200916113859.1556397-3-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index e88eff999bd15..787a894f5d1da 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -4066,7 +4066,6 @@ ext4_mb_discard_group_preallocations(struct super_block *sb, + INIT_LIST_HEAD(&list); + repeat: + ext4_lock_group(sb, group); +- this_cpu_inc(discard_pa_seq); + list_for_each_entry_safe(pa, tmp, + &grp->bb_prealloc_list, pa_group_list) { + spin_lock(&pa->pa_lock); +@@ -4083,6 +4082,9 @@ ext4_mb_discard_group_preallocations(struct super_block *sb, + /* seems this one can be freed ... */ + ext4_mb_mark_pa_deleted(sb, pa); + ++ if (!free) ++ this_cpu_inc(discard_pa_seq); ++ + /* we can trust pa_free ... */ + free += pa->pa_free; + +-- +2.25.1 + diff --git a/queue-5.8/ext4-limit-entries-returned-when-counting-fsmap-reco.patch b/queue-5.8/ext4-limit-entries-returned-when-counting-fsmap-reco.patch new file mode 100644 index 00000000000..7070273f4c8 --- /dev/null +++ b/queue-5.8/ext4-limit-entries-returned-when-counting-fsmap-reco.patch @@ -0,0 +1,40 @@ +From e8393511dc84bd5857fbd355daa395f65c6e9dd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Oct 2020 15:21:48 -0700 +Subject: ext4: limit entries returned when counting fsmap records + +From: Darrick J. Wong + +[ Upstream commit af8c53c8bc087459b1aadd4c94805d8272358d79 ] + +If userspace asked fsmap to try to count the number of entries, we cannot +return more than UINT_MAX entries because fmh_entries is u32. +Therefore, stop counting if we hit this limit or else we will waste time +to return truncated results. + +Fixes: 0c9ec4beecac ("ext4: support GETFSMAP ioctls") +Signed-off-by: Darrick J. Wong +Link: https://lore.kernel.org/r/20201001222148.GA49520@magnolia +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/fsmap.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c +index dbccf46f17709..37347ba868b70 100644 +--- a/fs/ext4/fsmap.c ++++ b/fs/ext4/fsmap.c +@@ -108,6 +108,9 @@ static int ext4_getfsmap_helper(struct super_block *sb, + + /* Are we just counting mappings? */ + if (info->gfi_head->fmh_count == 0) { ++ if (info->gfi_head->fmh_entries == UINT_MAX) ++ return EXT4_QUERY_RANGE_ABORT; ++ + if (rec_fsblk > info->gfi_next_fsblk) + info->gfi_head->fmh_entries++; + +-- +2.25.1 + diff --git a/queue-5.8/f2fs-reject-casefold-inode-flag-without-casefold-fea.patch b/queue-5.8/f2fs-reject-casefold-inode-flag-without-casefold-fea.patch new file mode 100644 index 00000000000..90d1ebd4d80 --- /dev/null +++ b/queue-5.8/f2fs-reject-casefold-inode-flag-without-casefold-fea.patch @@ -0,0 +1,69 @@ +From 5be2261b6dde7a19d879f0b699720e4b99089a31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 12:15:22 -0700 +Subject: f2fs: reject CASEFOLD inode flag without casefold feature + +From: Eric Biggers + +[ Upstream commit f6322f3f1212e005e7e6aa82ceb62be53030a64b ] + +syzbot reported: + + general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN + KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] + CPU: 0 PID: 6860 Comm: syz-executor835 Not tainted 5.9.0-rc8-syzkaller #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + RIP: 0010:utf8_casefold+0x43/0x1b0 fs/unicode/utf8-core.c:107 + [...] + Call Trace: + f2fs_init_casefolded_name fs/f2fs/dir.c:85 [inline] + __f2fs_setup_filename fs/f2fs/dir.c:118 [inline] + f2fs_prepare_lookup+0x3bf/0x640 fs/f2fs/dir.c:163 + f2fs_lookup+0x10d/0x920 fs/f2fs/namei.c:494 + __lookup_hash+0x115/0x240 fs/namei.c:1445 + filename_create+0x14b/0x630 fs/namei.c:3467 + user_path_create fs/namei.c:3524 [inline] + do_mkdirat+0x56/0x310 fs/namei.c:3664 + do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + [...] + +The problem is that an inode has F2FS_CASEFOLD_FL set, but the +filesystem doesn't have the casefold feature flag set, and therefore +super_block::s_encoding is NULL. + +Fix this by making sanity_check_inode() reject inodes that have +F2FS_CASEFOLD_FL when the filesystem doesn't have the casefold feature. + +Reported-by: syzbot+05139c4039d0679e19ff@syzkaller.appspotmail.com +Fixes: 2c2eb7a300cd ("f2fs: Support case-insensitive file name lookups") +Signed-off-by: Eric Biggers +Reviewed-by: Gabriel Krisman Bertazi +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/inode.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index 44582a4db513e..1e014535c2530 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -287,6 +287,13 @@ static bool sanity_check_inode(struct inode *inode, struct page *node_page) + return false; + } + ++ if ((fi->i_flags & F2FS_CASEFOLD_FL) && !f2fs_sb_has_casefold(sbi)) { ++ set_sbi_flag(sbi, SBI_NEED_FSCK); ++ f2fs_warn(sbi, "%s: inode (ino=%lx) has casefold flag, but casefold feature is off", ++ __func__, inode->i_ino); ++ return false; ++ } ++ + if (f2fs_has_extra_attr(inode) && f2fs_sb_has_compression(sbi) && + fi->i_flags & F2FS_COMPR_FL && + F2FS_FITS_IN_INODE(ri, fi->i_extra_isize, +-- +2.25.1 + diff --git a/queue-5.8/f2fs-wait-for-sysfs-kobject-removal-before-freeing-f.patch b/queue-5.8/f2fs-wait-for-sysfs-kobject-removal-before-freeing-f.patch new file mode 100644 index 00000000000..675dea139ac --- /dev/null +++ b/queue-5.8/f2fs-wait-for-sysfs-kobject-removal-before-freeing-f.patch @@ -0,0 +1,78 @@ +From 7027cdff8d5173aa421ce09b3eed84bd17921b92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Oct 2020 14:09:48 +0100 +Subject: f2fs: wait for sysfs kobject removal before freeing f2fs_sb_info + +From: Jamie Iles + +[ Upstream commit ae284d87abade58c8db7760c808f311ef1ce693c ] + +syzkaller found that with CONFIG_DEBUG_KOBJECT_RELEASE=y, unmounting an +f2fs filesystem could result in the following splat: + + kobject: 'loop5' ((____ptrval____)): kobject_release, parent 0000000000000000 (delayed 250) + kobject: 'f2fs_xattr_entry-7:5' ((____ptrval____)): kobject_release, parent 0000000000000000 (delayed 750) + ------------[ cut here ]------------ + ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x98 + WARNING: CPU: 0 PID: 699 at lib/debugobjects.c:485 debug_print_object+0x180/0x240 + Kernel panic - not syncing: panic_on_warn set ... + CPU: 0 PID: 699 Comm: syz-executor.5 Tainted: G S 5.9.0-rc8+ #101 + Hardware name: linux,dummy-virt (DT) + Call trace: + dump_backtrace+0x0/0x4d8 + show_stack+0x34/0x48 + dump_stack+0x174/0x1f8 + panic+0x360/0x7a0 + __warn+0x244/0x2ec + report_bug+0x240/0x398 + bug_handler+0x50/0xc0 + call_break_hook+0x160/0x1d8 + brk_handler+0x30/0xc0 + do_debug_exception+0x184/0x340 + el1_dbg+0x48/0xb0 + el1_sync_handler+0x170/0x1c8 + el1_sync+0x80/0x100 + debug_print_object+0x180/0x240 + debug_check_no_obj_freed+0x200/0x430 + slab_free_freelist_hook+0x190/0x210 + kfree+0x13c/0x460 + f2fs_put_super+0x624/0xa58 + generic_shutdown_super+0x120/0x300 + kill_block_super+0x94/0xf8 + kill_f2fs_super+0x244/0x308 + deactivate_locked_super+0x104/0x150 + deactivate_super+0x118/0x148 + cleanup_mnt+0x27c/0x3c0 + __cleanup_mnt+0x28/0x38 + task_work_run+0x10c/0x248 + do_notify_resume+0x9d4/0x1188 + work_pending+0x8/0x34c + +Like the error handling for f2fs_register_sysfs(), we need to wait for +the kobject to be destroyed before returning to prevent a potential +use-after-free. + +Fixes: bf9e697ecd42 ("f2fs: expose features to sysfs entry") +Cc: Jaegeuk Kim +Cc: Chao Yu +Signed-off-by: Jamie Iles +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/sysfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c +index c5e32ceb94827..e186d3af61368 100644 +--- a/fs/f2fs/sysfs.c ++++ b/fs/f2fs/sysfs.c +@@ -964,4 +964,5 @@ void f2fs_unregister_sysfs(struct f2fs_sb_info *sbi) + } + kobject_del(&sbi->s_kobj); + kobject_put(&sbi->s_kobj); ++ wait_for_completion(&sbi->s_kobj_unregister); + } +-- +2.25.1 + diff --git a/queue-5.8/fbmem-add-margin-check-to-fb_check_caps.patch b/queue-5.8/fbmem-add-margin-check-to-fb_check_caps.patch new file mode 100644 index 00000000000..dc5ab018d1d --- /dev/null +++ b/queue-5.8/fbmem-add-margin-check-to-fb_check_caps.patch @@ -0,0 +1,47 @@ +From 76ef00cb6bfdd6e4f1219ba5fe2979275a5de90d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jul 2020 15:26:03 -0400 +Subject: fbmem: add margin check to fb_check_caps() + +From: George Kennedy + +[ Upstream commit a49145acfb975d921464b84fe00279f99827d816 ] + +A fb_ioctl() FBIOPUT_VSCREENINFO call with invalid xres setting +or yres setting in struct fb_var_screeninfo will result in a +KASAN: vmalloc-out-of-bounds failure in bitfill_aligned() as +the margins are being cleared. The margins are cleared in +chunks and if the xres setting or yres setting is a value of +zero upto the chunk size, the failure will occur. + +Add a margin check to validate xres and yres settings. + +Signed-off-by: George Kennedy +Reported-by: syzbot+e5fd3e65515b48c02a30@syzkaller.appspotmail.com +Reviewed-by: Dan Carpenter +Cc: Dhaval Giani +Signed-off-by: Bartlomiej Zolnierkiewicz +Link: https://patchwork.freedesktop.org/patch/msgid/1594149963-13801-1-git-send-email-george.kennedy@oracle.com +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbmem.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c +index da7c88ffaa6a8..1136b569ccb7c 100644 +--- a/drivers/video/fbdev/core/fbmem.c ++++ b/drivers/video/fbdev/core/fbmem.c +@@ -1006,6 +1006,10 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var) + return 0; + } + ++ /* bitfill_aligned() assumes that it's at least 8x8 */ ++ if (var->xres < 8 || var->yres < 8) ++ return -EINVAL; ++ + ret = info->fbops->fb_check_var(var, info); + + if (ret) +-- +2.25.1 + diff --git a/queue-5.8/firmware-arm_scmi-fix-null-pointer-dereference-in-ma.patch b/queue-5.8/firmware-arm_scmi-fix-null-pointer-dereference-in-ma.patch new file mode 100644 index 00000000000..81ce06762c2 --- /dev/null +++ b/queue-5.8/firmware-arm_scmi-fix-null-pointer-dereference-in-ma.patch @@ -0,0 +1,72 @@ +From ac142caa2fc0621e1780169ddc2287766ddff04c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 12:26:11 +0100 +Subject: firmware: arm_scmi: Fix NULL pointer dereference in mailbox_chan_free + +From: Sudeep Holla + +[ Upstream commit 6ed6c558234f0b6c22e47a3c2feddce3d02324dd ] + +scmi_mailbox is obtained from cinfo->transport_info and the first +call to mailbox_chan_free frees the channel and sets cinfo->transport_info +to NULL. Care is taken to check for non NULL smbox->chan but smbox can +itself be NULL. Fix it by checking for it without which, kernel crashes +with below NULL pointer dereference and eventually kernel panic. + + Unable to handle kernel NULL pointer dereference at + virtual address 0000000000000038 + Modules linked in: scmi_module(-) + Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno + Development Platform, BIOS EDK II Sep 2 2020 + pstate: 80000005 (Nzcv daif -PAN -UAO BTYPE=--) + pc : mailbox_chan_free+0x2c/0x70 [scmi_module] + lr : idr_for_each+0x6c/0xf8 + Call trace: + mailbox_chan_free+0x2c/0x70 [scmi_module] + idr_for_each+0x6c/0xf8 + scmi_remove+0xa8/0xf0 [scmi_module] + platform_drv_remove+0x34/0x58 + device_release_driver_internal+0x118/0x1f0 + driver_detach+0x58/0xe8 + bus_remove_driver+0x64/0xe0 + driver_unregister+0x38/0x68 + platform_driver_unregister+0x1c/0x28 + scmi_driver_exit+0x38/0x44 [scmi_module] + ---[ end trace 17bde19f50436de9 ]--- + Kernel panic - not syncing: Fatal exception + SMP: stopping secondary CPUs + Kernel Offset: 0x1d0000 from 0xffff800010000000 + PHYS_OFFSET: 0x80000000 + CPU features: 0x0240022,25806004 + Memory Limit: none + ---[ end Kernel panic - not syncing: Fatal exception ]--- + +Link: https://lore.kernel.org/r/20200908112611.31515-1-sudeep.holla@arm.com +Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type") +Cc: Cristian Marussi +Cc: Viresh Kumar +Tested-by: Cristian Marussi +Reviewed-by: Cristian Marussi +Reviewed-by: Viresh Kumar +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/mailbox.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/arm_scmi/mailbox.c b/drivers/firmware/arm_scmi/mailbox.c +index 6998dc86b5ce8..b797a713c3313 100644 +--- a/drivers/firmware/arm_scmi/mailbox.c ++++ b/drivers/firmware/arm_scmi/mailbox.c +@@ -110,7 +110,7 @@ static int mailbox_chan_free(int id, void *p, void *data) + struct scmi_chan_info *cinfo = p; + struct scmi_mailbox *smbox = cinfo->transport_info; + +- if (!IS_ERR(smbox->chan)) { ++ if (smbox && !IS_ERR(smbox->chan)) { + mbox_free_channel(smbox->chan); + cinfo->transport_info = NULL; + smbox->chan = NULL; +-- +2.25.1 + diff --git a/queue-5.8/fix-use-after-free-in-get_capset_info-callback.patch b/queue-5.8/fix-use-after-free-in-get_capset_info-callback.patch new file mode 100644 index 00000000000..6fdf71ece45 --- /dev/null +++ b/queue-5.8/fix-use-after-free-in-get_capset_info-callback.patch @@ -0,0 +1,61 @@ +From 890370b2c0348a717ac601b23e14d4e841082a02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 14:08:25 -0700 +Subject: Fix use after free in get_capset_info callback. + +From: Doug Horn + +[ Upstream commit e219688fc5c3d0d9136f8d29d7e0498388f01440 ] + +If a response to virtio_gpu_cmd_get_capset_info takes longer than +five seconds to return, the callback will access freed kernel memory +in vg->capsets. + +Signed-off-by: Doug Horn +Link: http://patchwork.freedesktop.org/patch/msgid/20200902210847.2689-2-gurchetansingh@chromium.org +Signed-off-by: Gerd Hoffmann +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/virtio/virtgpu_kms.c | 2 ++ + drivers/gpu/drm/virtio/virtgpu_vq.c | 10 +++++++--- + 2 files changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c +index 0a5c8cf409fb8..dc8cb8dfce58e 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_kms.c ++++ b/drivers/gpu/drm/virtio/virtgpu_kms.c +@@ -80,8 +80,10 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev, + vgdev->capsets[i].id > 0, 5 * HZ); + if (ret == 0) { + DRM_ERROR("timed out waiting for cap set %d\n", i); ++ spin_lock(&vgdev->display_info_lock); + kfree(vgdev->capsets); + vgdev->capsets = NULL; ++ spin_unlock(&vgdev->display_info_lock); + return; + } + DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n", +diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c +index 9e663a5d99526..2517450bf46ba 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_vq.c ++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c +@@ -684,9 +684,13 @@ static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev, + int i = le32_to_cpu(cmd->capset_index); + + spin_lock(&vgdev->display_info_lock); +- vgdev->capsets[i].id = le32_to_cpu(resp->capset_id); +- vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version); +- vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size); ++ if (vgdev->capsets) { ++ vgdev->capsets[i].id = le32_to_cpu(resp->capset_id); ++ vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version); ++ vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size); ++ } else { ++ DRM_ERROR("invalid capset memory."); ++ } + spin_unlock(&vgdev->display_info_lock); + wake_up(&vgdev->resp_wq); + } +-- +2.25.1 + diff --git a/queue-5.8/fs-dlm-fix-configfs-memory-leak.patch b/queue-5.8/fs-dlm-fix-configfs-memory-leak.patch new file mode 100644 index 00000000000..417b0253942 --- /dev/null +++ b/queue-5.8/fs-dlm-fix-configfs-memory-leak.patch @@ -0,0 +1,70 @@ +From 98f50ddbb82f62bade4abef9ddd1846287937739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 15:02:51 -0400 +Subject: fs: dlm: fix configfs memory leak + +From: Alexander Aring + +[ Upstream commit 3d2825c8c6105b0f36f3ff72760799fa2e71420e ] + +This patch fixes the following memory detected by kmemleak and umount +gfs2 filesystem which removed the last lockspace: + +unreferenced object 0xffff9264f482f600 (size 192): + comm "dlm_controld", pid 325, jiffies 4294690276 (age 48.136s) + hex dump (first 32 bytes): + 00 00 00 00 00 00 00 00 6e 6f 64 65 73 00 00 00 ........nodes... + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000060481d7>] make_space+0x41/0x130 + [<000000008d905d46>] configfs_mkdir+0x1a2/0x5f0 + [<00000000729502cf>] vfs_mkdir+0x155/0x210 + [<000000000369bcf1>] do_mkdirat+0x6d/0x110 + [<00000000cc478a33>] do_syscall_64+0x33/0x40 + [<00000000ce9ccf01>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +The patch just remembers the "nodes" entry pointer in space as I think +it's created as subdirectory when parent "spaces" is created. In +function drop_space() we will lost the pointer reference to nds because +configfs_remove_default_groups(). However as this subdirectory is always +available when "spaces" exists it will just be freed when "spaces" will be +freed. + +Signed-off-by: Alexander Aring +Signed-off-by: David Teigland +Signed-off-by: Sasha Levin +--- + fs/dlm/config.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/dlm/config.c b/fs/dlm/config.c +index 3b21082e1b550..3b1012a3c4396 100644 +--- a/fs/dlm/config.c ++++ b/fs/dlm/config.c +@@ -216,6 +216,7 @@ struct dlm_space { + struct list_head members; + struct mutex members_lock; + int members_count; ++ struct dlm_nodes *nds; + }; + + struct dlm_comms { +@@ -424,6 +425,7 @@ static struct config_group *make_space(struct config_group *g, const char *name) + INIT_LIST_HEAD(&sp->members); + mutex_init(&sp->members_lock); + sp->members_count = 0; ++ sp->nds = nds; + return &sp->group; + + fail: +@@ -445,6 +447,7 @@ static void drop_space(struct config_group *g, struct config_item *i) + static void release_space(struct config_item *i) + { + struct dlm_space *sp = config_item_to_space(i); ++ kfree(sp->nds); + kfree(sp); + } + +-- +2.25.1 + diff --git a/queue-5.8/fs-fix-null-dereference-due-to-data-race-in-prepend_.patch b/queue-5.8/fs-fix-null-dereference-due-to-data-race-in-prepend_.patch new file mode 100644 index 00000000000..475337daedb --- /dev/null +++ b/queue-5.8/fs-fix-null-dereference-due-to-data-race-in-prepend_.patch @@ -0,0 +1,68 @@ +From 9310454588e03ca0ba43cfd902969bd5cf553c66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Oct 2020 13:45:28 -0700 +Subject: fs: fix NULL dereference due to data race in prepend_path() + +From: Andrii Nakryiko + +[ Upstream commit 09cad07547445bf3a41683e4d3abcd154c123ef5 ] + +Fix data race in prepend_path() with re-reading mnt->mnt_ns twice +without holding the lock. + +is_mounted() does check for NULL, but is_anon_ns(mnt->mnt_ns) might +re-read the pointer again which could be NULL already, if in between +reads one of kern_unmount()/kern_unmount_array()/umount_tree() sets +mnt->mnt_ns to NULL. + +This is seen in production with the following stack trace: + + BUG: kernel NULL pointer dereference, address: 0000000000000048 + ... + RIP: 0010:prepend_path.isra.4+0x1ce/0x2e0 + Call Trace: + d_path+0xe6/0x150 + proc_pid_readlink+0x8f/0x100 + vfs_readlink+0xf8/0x110 + do_readlinkat+0xfd/0x120 + __x64_sys_readlinkat+0x1a/0x20 + do_syscall_64+0x42/0x110 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: f2683bd8d5bd ("[PATCH] fix d_absolute_path() interplay with fsmount()") +Signed-off-by: Andrii Nakryiko +Reviewed-by: Josef Bacik +Cc: Alexander Viro +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/d_path.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/d_path.c b/fs/d_path.c +index 0f1fc1743302f..a69e2cd36e6e3 100644 +--- a/fs/d_path.c ++++ b/fs/d_path.c +@@ -102,6 +102,8 @@ static int prepend_path(const struct path *path, + + if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) { + struct mount *parent = READ_ONCE(mnt->mnt_parent); ++ struct mnt_namespace *mnt_ns; ++ + /* Escaped? */ + if (dentry != vfsmnt->mnt_root) { + bptr = *buffer; +@@ -116,7 +118,9 @@ static int prepend_path(const struct path *path, + vfsmnt = &mnt->mnt; + continue; + } +- if (is_mounted(vfsmnt) && !is_anon_ns(mnt->mnt_ns)) ++ mnt_ns = READ_ONCE(mnt->mnt_ns); ++ /* open-coded is_mounted() to use local mnt_ns */ ++ if (!IS_ERR_OR_NULL(mnt_ns) && !is_anon_ns(mnt_ns)) + error = 1; // absolute root + else + error = 2; // detached or not attached yet +-- +2.25.1 + diff --git a/queue-5.8/fscrypt-restrict-iv_ino_lblk_32-to-ino_bits-32.patch b/queue-5.8/fscrypt-restrict-iv_ino_lblk_32-to-ino_bits-32.patch new file mode 100644 index 00000000000..555eafb9a7d --- /dev/null +++ b/queue-5.8/fscrypt-restrict-iv_ino_lblk_32-to-ino_bits-32.patch @@ -0,0 +1,65 @@ +From 214651bb78bb50ea9c2c400413d3c2ea2f11c537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 13:38:41 -0700 +Subject: fscrypt: restrict IV_INO_LBLK_32 to ino_bits <= 32 + +From: Eric Biggers + +[ Upstream commit 5e895bd4d5233cb054447d0491d4e63c8496d419 ] + +When an encryption policy has the IV_INO_LBLK_32 flag set, the IV +generation method involves hashing the inode number. This is different +from fscrypt's other IV generation methods, where the inode number is +either not used at all or is included directly in the IVs. + +Therefore, in principle IV_INO_LBLK_32 can work with any length inode +number. However, currently fscrypt gets the inode number from +inode::i_ino, which is 'unsigned long'. So currently the implementation +limit is actually 32 bits (like IV_INO_LBLK_64), since longer inode +numbers will have been truncated by the VFS on 32-bit platforms. + +Fix fscrypt_supported_v2_policy() to enforce the correct limit. + +This doesn't actually matter currently, since only ext4 and f2fs support +IV_INO_LBLK_32, and they both only support 32-bit inode numbers. But we +might as well fix it in case it matters in the future. + +Ideally inode::i_ino would instead be made 64-bit, but for now it's not +needed. (Note, this limit does *not* prevent filesystems with 64-bit +inode numbers from adding fscrypt support, since IV_INO_LBLK_* support +is optional and is useful only on certain hardware.) + +Fixes: e3b1078bedd3 ("fscrypt: add support for IV_INO_LBLK_32 policies") +Reported-by: Jeff Layton +Link: https://lore.kernel.org/r/20200824203841.1707847-1-ebiggers@kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Sasha Levin +--- + fs/crypto/policy.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c +index d23ff162c78bc..0b32c64eb4053 100644 +--- a/fs/crypto/policy.c ++++ b/fs/crypto/policy.c +@@ -178,10 +178,15 @@ static bool fscrypt_supported_v2_policy(const struct fscrypt_policy_v2 *policy, + 32, 32)) + return false; + ++ /* ++ * IV_INO_LBLK_32 hashes the inode number, so in principle it can ++ * support any ino_bits. However, currently the inode number is gotten ++ * from inode::i_ino which is 'unsigned long'. So for now the ++ * implementation limit is 32 bits. ++ */ + if ((policy->flags & FSCRYPT_POLICY_FLAG_IV_INO_LBLK_32) && +- /* This uses hashed inode numbers, so ino_bits doesn't matter. */ + !supported_iv_ino_lblk_policy(policy, inode, "IV_INO_LBLK_32", +- INT_MAX, 32)) ++ 32, 32)) + return false; + + if (memchr_inv(policy->__reserved, 0, sizeof(policy->__reserved))) { +-- +2.25.1 + diff --git a/queue-5.8/habanalabs-cast-to-u64-before-shift-31-bits.patch b/queue-5.8/habanalabs-cast-to-u64-before-shift-31-bits.patch new file mode 100644 index 00000000000..50aa50f07ee --- /dev/null +++ b/queue-5.8/habanalabs-cast-to-u64-before-shift-31-bits.patch @@ -0,0 +1,91 @@ +From c088da0fbb3781e0bf5ce9af3127171576b955ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Aug 2020 11:24:03 +0300 +Subject: habanalabs: cast to u64 before shift > 31 bits + +From: Oded Gabbay + +[ Upstream commit f763946aefe67b3ea58696b75a930ba1ed886a83 ] + +When shifting a boolean variable by more than 31 bits and putting the +result into a u64 variable, we need to cast the boolean into unsigned 64 +bits to prevent possible overflow. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/gaudi/gaudi.c | 8 +++++--- + drivers/misc/habanalabs/goya/goya.c | 8 +++++--- + 2 files changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/misc/habanalabs/gaudi/gaudi.c b/drivers/misc/habanalabs/gaudi/gaudi.c +index ca183733847b6..bcc45bf7af2c8 100644 +--- a/drivers/misc/habanalabs/gaudi/gaudi.c ++++ b/drivers/misc/habanalabs/gaudi/gaudi.c +@@ -6285,7 +6285,7 @@ static bool gaudi_is_device_idle(struct hl_device *hdev, u32 *mask, + is_idle &= is_eng_idle; + + if (mask) +- *mask |= !is_eng_idle << ++ *mask |= ((u64) !is_eng_idle) << + (GAUDI_ENGINE_ID_DMA_0 + dma_id); + if (s) + seq_printf(s, fmt, dma_id, +@@ -6308,7 +6308,8 @@ static bool gaudi_is_device_idle(struct hl_device *hdev, u32 *mask, + is_idle &= is_eng_idle; + + if (mask) +- *mask |= !is_eng_idle << (GAUDI_ENGINE_ID_TPC_0 + i); ++ *mask |= ((u64) !is_eng_idle) << ++ (GAUDI_ENGINE_ID_TPC_0 + i); + if (s) + seq_printf(s, fmt, i, + is_eng_idle ? "Y" : "N", +@@ -6336,7 +6337,8 @@ static bool gaudi_is_device_idle(struct hl_device *hdev, u32 *mask, + is_idle &= is_eng_idle; + + if (mask) +- *mask |= !is_eng_idle << (GAUDI_ENGINE_ID_MME_0 + i); ++ *mask |= ((u64) !is_eng_idle) << ++ (GAUDI_ENGINE_ID_MME_0 + i); + if (s) { + if (!is_slave) + seq_printf(s, fmt, i, +diff --git a/drivers/misc/habanalabs/goya/goya.c b/drivers/misc/habanalabs/goya/goya.c +index c179085ced7b8..a8041a39fae31 100644 +--- a/drivers/misc/habanalabs/goya/goya.c ++++ b/drivers/misc/habanalabs/goya/goya.c +@@ -5098,7 +5098,8 @@ static bool goya_is_device_idle(struct hl_device *hdev, u32 *mask, + is_idle &= is_eng_idle; + + if (mask) +- *mask |= !is_eng_idle << (GOYA_ENGINE_ID_DMA_0 + i); ++ *mask |= ((u64) !is_eng_idle) << ++ (GOYA_ENGINE_ID_DMA_0 + i); + if (s) + seq_printf(s, dma_fmt, i, is_eng_idle ? "Y" : "N", + qm_glbl_sts0, dma_core_sts0); +@@ -5121,7 +5122,8 @@ static bool goya_is_device_idle(struct hl_device *hdev, u32 *mask, + is_idle &= is_eng_idle; + + if (mask) +- *mask |= !is_eng_idle << (GOYA_ENGINE_ID_TPC_0 + i); ++ *mask |= ((u64) !is_eng_idle) << ++ (GOYA_ENGINE_ID_TPC_0 + i); + if (s) + seq_printf(s, fmt, i, is_eng_idle ? "Y" : "N", + qm_glbl_sts0, cmdq_glbl_sts0, tpc_cfg_sts); +@@ -5141,7 +5143,7 @@ static bool goya_is_device_idle(struct hl_device *hdev, u32 *mask, + is_idle &= is_eng_idle; + + if (mask) +- *mask |= !is_eng_idle << GOYA_ENGINE_ID_MME_0; ++ *mask |= ((u64) !is_eng_idle) << GOYA_ENGINE_ID_MME_0; + if (s) { + seq_printf(s, fmt, 0, is_eng_idle ? "Y" : "N", qm_glbl_sts0, + cmdq_glbl_sts0, mme_arch_sts); +-- +2.25.1 + diff --git a/queue-5.8/hid-hid-input-fix-stylus-battery-reporting.patch b/queue-5.8/hid-hid-input-fix-stylus-battery-reporting.patch new file mode 100644 index 00000000000..8d844907f68 --- /dev/null +++ b/queue-5.8/hid-hid-input-fix-stylus-battery-reporting.patch @@ -0,0 +1,49 @@ +From b07746d357312c94787b3e124f12bb34fe3c800e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 16:35:52 -0700 +Subject: HID: hid-input: fix stylus battery reporting + +From: Dmitry Torokhov + +[ Upstream commit 505f394fa239cecb76d916aa858f87ed7ea7fde4 ] + +With commit 4f3882177240 hid-input started clearing of "ignored" usages +to avoid using garbage that might have been left in them. However +"battery strength" usages should not be ignored, as we do want to +use them. + +Fixes: 4f3882177240 ("HID: hid-input: clear unmapped usages") +Reported-by: Kenneth Albanowski +Tested-by: Kenneth Albanowski +Signed-off-by: Dmitry Torokhov +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-input.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index e3d475f4baf66..b2bff932c524f 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -797,7 +797,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + case 0x3b: /* Battery Strength */ + hidinput_setup_battery(device, HID_INPUT_REPORT, field); + usage->type = EV_PWR; +- goto ignore; ++ return; + + case 0x3c: /* Invert */ + map_key_clear(BTN_TOOL_RUBBER); +@@ -1059,7 +1059,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel + case HID_DC_BATTERYSTRENGTH: + hidinput_setup_battery(device, HID_INPUT_REPORT, field); + usage->type = EV_PWR; +- goto ignore; ++ return; + } + goto unknown; + +-- +2.25.1 + diff --git a/queue-5.8/hid-ite-add-usb-id-match-for-acer-one-s1003-keyboard.patch b/queue-5.8/hid-ite-add-usb-id-match-for-acer-one-s1003-keyboard.patch new file mode 100644 index 00000000000..a0edf7e295d --- /dev/null +++ b/queue-5.8/hid-ite-add-usb-id-match-for-acer-one-s1003-keyboard.patch @@ -0,0 +1,61 @@ +From 9e20f484c94acac8e481e591c9420cc265230ee2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 09:56:42 +0200 +Subject: HID: ite: Add USB id match for Acer One S1003 keyboard dock + +From: Hans de Goede + +[ Upstream commit 5bf2f2f331ad812c9b7eea6e14a3ea328acbffc0 ] + +The Acer One S1003 2-in-1 keyboard dock uses a Synaptics S910xx touchpad +which is connected to an ITE 8910 USB keyboard controller chip. + +This keyboard has the same quirk for its rfkill / airplane mode hotkey as +other keyboards with ITE keyboard chips, it only sends a single release +event when pressed and released, it never sends a press event. + +This commit adds this keyboards USB id to the hid-ite id-table, fixing +the rfkill key not working on this keyboard. Note that like for the +Acer Aspire Switch 10 (SW5-012) the id-table entry matches on the +HID_GROUP_GENERIC generic group so that hid-ite only binds to the +keyboard interface and the mouse/touchpad interface is left untouched +so that hid-multitouch can bind to it. + +Signed-off-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-ite.c | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 0ca8906a6f839..b269c792d25dc 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1123,6 +1123,7 @@ + #define USB_DEVICE_ID_SYNAPTICS_DELL_K12A 0x2819 + #define USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012 0x2968 + #define USB_DEVICE_ID_SYNAPTICS_TP_V103 0x5710 ++#define USB_DEVICE_ID_SYNAPTICS_ACER_ONE_S1003 0x73f5 + #define USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5 0x81a7 + + #define USB_VENDOR_ID_TEXAS_INSTRUMENTS 0x2047 +diff --git a/drivers/hid/hid-ite.c b/drivers/hid/hid-ite.c +index 6c55682c59740..044a93f3c1178 100644 +--- a/drivers/hid/hid-ite.c ++++ b/drivers/hid/hid-ite.c +@@ -44,6 +44,10 @@ static const struct hid_device_id ite_devices[] = { + { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, + USB_VENDOR_ID_SYNAPTICS, + USB_DEVICE_ID_SYNAPTICS_ACER_SWITCH5_012) }, ++ /* ITE8910 USB kbd ctlr, with Synaptics touchpad connected to it. */ ++ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC, ++ USB_VENDOR_ID_SYNAPTICS, ++ USB_DEVICE_ID_SYNAPTICS_ACER_ONE_S1003) }, + { } + }; + MODULE_DEVICE_TABLE(hid, ite_devices); +-- +2.25.1 + diff --git a/queue-5.8/hid-multitouch-lenovo-x1-tablet-gen3-trackpoint-and-.patch b/queue-5.8/hid-multitouch-lenovo-x1-tablet-gen3-trackpoint-and-.patch new file mode 100644 index 00000000000..6ed7f54dba4 --- /dev/null +++ b/queue-5.8/hid-multitouch-lenovo-x1-tablet-gen3-trackpoint-and-.patch @@ -0,0 +1,57 @@ +From 6c67f02791947794c939c5cf0e6adabbc8154b77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Sep 2020 11:48:10 +0200 +Subject: HID: multitouch: Lenovo X1 Tablet Gen3 trackpoint and buttons +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mikael Wikström + +[ Upstream commit 140958da9ab53a7df9e9ccc7678ea64655279ac1 ] + +One more device that needs 40d5bb87 to resolve regression for the trackpoint +and three mouse buttons on the type cover of the Lenovo X1 Tablet Gen3. + +It is probably also needed for the Lenovo X1 Tablet Gen2 with PID 0x60a3 + +Signed-off-by: Mikael Wikström +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-multitouch.c | 6 ++++++ + 2 files changed, 7 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index b49ec7dde6457..0ca8906a6f839 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -726,6 +726,7 @@ + #define USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL 0x6049 + #define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067 + #define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085 ++#define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5 + #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d + #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_6019 0x6019 + #define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_602E 0x602e +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index e3152155c4b85..99f041afd5c0c 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -1973,6 +1973,12 @@ static const struct hid_device_id mt_devices[] = { + HID_DEVICE(BUS_I2C, HID_GROUP_GENERIC, + USB_VENDOR_ID_LG, I2C_DEVICE_ID_LG_7010) }, + ++ /* Lenovo X1 TAB Gen 3 */ ++ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT, ++ HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, ++ USB_VENDOR_ID_LENOVO, ++ USB_DEVICE_ID_LENOVO_X1_TAB3) }, ++ + /* MosArt panels */ + { .driver_data = MT_CLS_CONFIDENCE_MINUS_ONE, + MT_USB_DEVICE(USB_VENDOR_ID_ASUS, +-- +2.25.1 + diff --git a/queue-5.8/hid-roccat-add-bounds-checking-in-kone_sysfs_write_s.patch b/queue-5.8/hid-roccat-add-bounds-checking-in-kone_sysfs_write_s.patch new file mode 100644 index 00000000000..6ae5ac5d645 --- /dev/null +++ b/queue-5.8/hid-roccat-add-bounds-checking-in-kone_sysfs_write_s.patch @@ -0,0 +1,78 @@ +From 0b2fbff4277dd02f63e020899c49f53c7c8b47a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 11:57:35 +0300 +Subject: HID: roccat: add bounds checking in kone_sysfs_write_settings() + +From: Dan Carpenter + +[ Upstream commit d4f98dbfe717490e771b6e701904bfcf4b4557f0 ] + +This code doesn't check if "settings->startup_profile" is within bounds +and that could result in an out of bounds array access. What the code +does do is it checks if the settings can be written to the firmware, so +it's possible that the firmware has a bounds check? It's safer and +easier to verify when the bounds checking is done in the kernel. + +Fixes: 14bf62cde794 ("HID: add driver for Roccat Kone gaming mouse") +Signed-off-by: Dan Carpenter +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-roccat-kone.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c +index 1a6e600197d0b..509b9bb1362cb 100644 +--- a/drivers/hid/hid-roccat-kone.c ++++ b/drivers/hid/hid-roccat-kone.c +@@ -294,31 +294,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj, + struct kone_device *kone = hid_get_drvdata(dev_get_drvdata(dev)); + struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev)); + int retval = 0, difference, old_profile; ++ struct kone_settings *settings = (struct kone_settings *)buf; + + /* I need to get my data in one piece */ + if (off != 0 || count != sizeof(struct kone_settings)) + return -EINVAL; + + mutex_lock(&kone->kone_lock); +- difference = memcmp(buf, &kone->settings, sizeof(struct kone_settings)); ++ difference = memcmp(settings, &kone->settings, ++ sizeof(struct kone_settings)); + if (difference) { +- retval = kone_set_settings(usb_dev, +- (struct kone_settings const *)buf); +- if (retval) { +- mutex_unlock(&kone->kone_lock); +- return retval; ++ if (settings->startup_profile < 1 || ++ settings->startup_profile > 5) { ++ retval = -EINVAL; ++ goto unlock; + } + ++ retval = kone_set_settings(usb_dev, settings); ++ if (retval) ++ goto unlock; ++ + old_profile = kone->settings.startup_profile; +- memcpy(&kone->settings, buf, sizeof(struct kone_settings)); ++ memcpy(&kone->settings, settings, sizeof(struct kone_settings)); + + kone_profile_activated(kone, kone->settings.startup_profile); + + if (kone->settings.startup_profile != old_profile) + kone_profile_report(kone, kone->settings.startup_profile); + } ++unlock: + mutex_unlock(&kone->kone_lock); + ++ if (retval) ++ return retval; ++ + return sizeof(struct kone_settings); + } + static BIN_ATTR(settings, 0660, kone_sysfs_read_settings, +-- +2.25.1 + diff --git a/queue-5.8/hv-clocksource-add-notrace-attribute-to-read_hv_sche.patch b/queue-5.8/hv-clocksource-add-notrace-attribute-to-read_hv_sche.patch new file mode 100644 index 00000000000..600db1ed1d2 --- /dev/null +++ b/queue-5.8/hv-clocksource-add-notrace-attribute-to-read_hv_sche.patch @@ -0,0 +1,96 @@ +From 58b048e83260e20b022abd0de45ff3bcbc408f67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 17:11:17 +0200 +Subject: hv: clocksource: Add notrace attribute to read_hv_sched_clock_*() + functions + +From: Mohammed Gamal + +[ Upstream commit 1f3aed01473c41c9f896fbf4c30d330655e8aa7c ] + +When selecting function_graph tracer with the command: + # echo function_graph > /sys/kernel/debug/tracing/current_tracer + +The kernel crashes with the following stack trace: + +[69703.122389] BUG: stack guard page was hit at 000000001056545c (stack is 00000000fa3f8fed..0000000005d39503) +[69703.122403] kernel stack overflow (double-fault): 0000 [#1] SMP PTI +[69703.122413] CPU: 0 PID: 16982 Comm: bash Kdump: loaded Not tainted 4.18.0-236.el8.x86_64 #1 +[69703.122420] Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.0 12/17/2019 +[69703.122433] RIP: 0010repare_ftrace_return+0xa/0x110 +[69703.122458] Code: 05 00 0f 0b 48 c7 c7 10 ca 69 ae 0f b6 f0 e8 4b 52 0c 00 31 c0 eb ca 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 56 41 55 41 54 <53> 48 83 ec 18 65 48 8b 04 25 28 00 00 00 48 89 45 d8 31 c0 48 85 +[69703.122467] RSP: 0018:ffffbd6d01118000 EFLAGS: 00010086 +[69703.122476] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000003 +[69703.122484] RDX: 0000000000000000 RSI: ffffbd6d011180d8 RDI: ffffffffadce7550 +[69703.122491] RBP: ffffbd6d01118018 R08: 0000000000000000 R09: ffff9d4b09266000 +[69703.122498] R10: ffff9d4b0fc04540 R11: ffff9d4b0fc20a00 R12: ffff9d4b6e42aa90 +[69703.122506] R13: ffff9d4b0fc20ab8 R14: 00000000000003e8 R15: ffffbd6d0111837c +[69703.122514] FS: 00007fd5f2588740(0000) GS:ffff9d4b6e400000(0000) knlGS:0000000000000000 +[69703.122521] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[69703.122528] CR2: ffffbd6d01117ff8 CR3: 00000000565d8001 CR4: 00000000003606f0 +[69703.122538] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[69703.122545] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[69703.122552] Call Trace: +[69703.122568] ftrace_graph_caller+0x6b/0xa0 +[69703.122589] ? read_hv_sched_clock_tsc+0x5/0x20 +[69703.122599] read_hv_sched_clock_tsc+0x5/0x20 +[69703.122611] sched_clock+0x5/0x10 +[69703.122621] sched_clock_local+0x12/0x80 +[69703.122631] sched_clock_cpu+0x8c/0xb0 +[69703.122644] trace_clock_global+0x21/0x90 +[69703.122655] ring_buffer_lock_reserve+0x100/0x3c0 +[69703.122671] trace_buffer_lock_reserve+0x16/0x50 +[69703.122683] __trace_graph_entry+0x28/0x90 +[69703.122695] trace_graph_entry+0xfd/0x1a0 +[69703.122705] ? read_hv_clock_tsc_cs+0x10/0x10 +[69703.122714] ? sched_clock+0x5/0x10 +[69703.122723] prepare_ftrace_return+0x99/0x110 +[69703.122734] ? read_hv_clock_tsc_cs+0x10/0x10 +[69703.122743] ? sched_clock+0x5/0x10 +[69703.122752] ftrace_graph_caller+0x6b/0xa0 +[69703.122768] ? read_hv_clock_tsc_cs+0x10/0x10 +[69703.122777] ? sched_clock+0x5/0x10 +[69703.122786] ? read_hv_sched_clock_tsc+0x5/0x20 +[69703.122796] ? ring_buffer_unlock_commit+0x1d/0xa0 +[69703.122805] read_hv_sched_clock_tsc+0x5/0x20 +[69703.122814] ftrace_graph_caller+0xa0/0xa0 +[ ... recursion snipped ... ] + +Setting the notrace attribute for read_hv_sched_clock_msr() and +read_hv_sched_clock_tsc() fixes it. + +Fixes: bd00cd52d5be ("clocksource/drivers/hyperv: Add Hyper-V specific sched clock function") +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Mohammed Gamal +Link: https://lore.kernel.org/r/20200924151117.767442-1-mgamal@redhat.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/clocksource/hyperv_timer.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clocksource/hyperv_timer.c b/drivers/clocksource/hyperv_timer.c +index 09aa44cb8a91d..ba04cb381cd3f 100644 +--- a/drivers/clocksource/hyperv_timer.c ++++ b/drivers/clocksource/hyperv_timer.c +@@ -341,7 +341,7 @@ static u64 notrace read_hv_clock_tsc_cs(struct clocksource *arg) + return read_hv_clock_tsc(); + } + +-static u64 read_hv_sched_clock_tsc(void) ++static u64 notrace read_hv_sched_clock_tsc(void) + { + return (read_hv_clock_tsc() - hv_sched_clock_offset) * + (NSEC_PER_SEC / HV_CLOCK_HZ); +@@ -404,7 +404,7 @@ static u64 notrace read_hv_clock_msr_cs(struct clocksource *arg) + return read_hv_clock_msr(); + } + +-static u64 read_hv_sched_clock_msr(void) ++static u64 notrace read_hv_sched_clock_msr(void) + { + return (read_hv_clock_msr() - hv_sched_clock_offset) * + (NSEC_PER_SEC / HV_CLOCK_HZ); +-- +2.25.1 + diff --git a/queue-5.8/hwmon-bt1-pvt-cache-current-update-timeout.patch b/queue-5.8/hwmon-bt1-pvt-cache-current-update-timeout.patch new file mode 100644 index 00000000000..fc6c1bc87cf --- /dev/null +++ b/queue-5.8/hwmon-bt1-pvt-cache-current-update-timeout.patch @@ -0,0 +1,207 @@ +From e57034c731fee8b13856831dca33ccf6dc4302b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Sep 2020 14:09:22 +0300 +Subject: hwmon: (bt1-pvt) Cache current update timeout + +From: Serge Semin + +[ Upstream commit 0015503e5f6357f286bef34d039e43359fa4efd4 ] + +Instead of converting the update timeout data to the milliseconds each +time on the read procedure let's preserve the currently set timeout in the +dedicated driver private data cache. The cached value will be then used in +the timeout read method and in the alarm-less data conversion to prevent +the caller task hanging up in case if the PVT sensor is suddenly powered +down. + +Fixes: 87976ce2825d ("hwmon: Add Baikal-T1 PVT sensor driver") +Signed-off-by: Serge Semin +Link: https://lore.kernel.org/r/20200920110924.19741-3-Sergey.Semin@baikalelectronics.ru +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/bt1-pvt.c | 85 ++++++++++++++++++++++------------------- + drivers/hwmon/bt1-pvt.h | 3 ++ + 2 files changed, 49 insertions(+), 39 deletions(-) + +diff --git a/drivers/hwmon/bt1-pvt.c b/drivers/hwmon/bt1-pvt.c +index f4b7353c078a8..2600426a3b21c 100644 +--- a/drivers/hwmon/bt1-pvt.c ++++ b/drivers/hwmon/bt1-pvt.c +@@ -655,44 +655,16 @@ static int pvt_write_trim(struct pvt_hwmon *pvt, long val) + + static int pvt_read_timeout(struct pvt_hwmon *pvt, long *val) + { +- unsigned long rate; +- ktime_t kt; +- u32 data; +- +- rate = clk_get_rate(pvt->clks[PVT_CLOCK_REF].clk); +- if (!rate) +- return -ENODEV; +- +- /* +- * Don't bother with mutex here, since we just read data from MMIO. +- * We also have to scale the ticks timeout up to compensate the +- * ms-ns-data translations. +- */ +- data = readl(pvt->regs + PVT_TTIMEOUT) + 1; ++ int ret; + +- /* +- * Calculate ref-clock based delay (Ttotal) between two consecutive +- * data samples of the same sensor. So we first must calculate the +- * delay introduced by the internal ref-clock timer (Tref * Fclk). +- * Then add the constant timeout cuased by each conversion latency +- * (Tmin). The basic formulae for each conversion is following: +- * Ttotal = Tref * Fclk + Tmin +- * Note if alarms are enabled the sensors are polled one after +- * another, so in order to have the delay being applicable for each +- * sensor the requested value must be equally redistirbuted. +- */ +-#if defined(CONFIG_SENSORS_BT1_PVT_ALARMS) +- kt = ktime_set(PVT_SENSORS_NUM * (u64)data, 0); +- kt = ktime_divns(kt, rate); +- kt = ktime_add_ns(kt, PVT_SENSORS_NUM * PVT_TOUT_MIN); +-#else +- kt = ktime_set(data, 0); +- kt = ktime_divns(kt, rate); +- kt = ktime_add_ns(kt, PVT_TOUT_MIN); +-#endif ++ ret = mutex_lock_interruptible(&pvt->iface_mtx); ++ if (ret) ++ return ret; + + /* Return the result in msec as hwmon sysfs interface requires. */ +- *val = ktime_to_ms(kt); ++ *val = ktime_to_ms(pvt->timeout); ++ ++ mutex_unlock(&pvt->iface_mtx); + + return 0; + } +@@ -700,7 +672,7 @@ static int pvt_read_timeout(struct pvt_hwmon *pvt, long *val) + static int pvt_write_timeout(struct pvt_hwmon *pvt, long val) + { + unsigned long rate; +- ktime_t kt; ++ ktime_t kt, cache; + u32 data; + int ret; + +@@ -713,7 +685,7 @@ static int pvt_write_timeout(struct pvt_hwmon *pvt, long val) + * between all available sensors to have the requested delay + * applicable to each individual sensor. + */ +- kt = ms_to_ktime(val); ++ cache = kt = ms_to_ktime(val); + #if defined(CONFIG_SENSORS_BT1_PVT_ALARMS) + kt = ktime_divns(kt, PVT_SENSORS_NUM); + #endif +@@ -742,6 +714,7 @@ static int pvt_write_timeout(struct pvt_hwmon *pvt, long val) + return ret; + + pvt_set_tout(pvt, data); ++ pvt->timeout = cache; + + mutex_unlock(&pvt->iface_mtx); + +@@ -1018,10 +991,17 @@ static int pvt_check_pwr(struct pvt_hwmon *pvt) + return ret; + } + +-static void pvt_init_iface(struct pvt_hwmon *pvt) ++static int pvt_init_iface(struct pvt_hwmon *pvt) + { ++ unsigned long rate; + u32 trim, temp; + ++ rate = clk_get_rate(pvt->clks[PVT_CLOCK_REF].clk); ++ if (!rate) { ++ dev_err(pvt->dev, "Invalid reference clock rate\n"); ++ return -ENODEV; ++ } ++ + /* + * Make sure all interrupts and controller are disabled so not to + * accidentally have ISR executed before the driver data is fully +@@ -1036,12 +1016,37 @@ static void pvt_init_iface(struct pvt_hwmon *pvt) + pvt_set_mode(pvt, pvt_info[pvt->sensor].mode); + pvt_set_tout(pvt, PVT_TOUT_DEF); + ++ /* ++ * Preserve the current ref-clock based delay (Ttotal) between the ++ * sensors data samples in the driver data so not to recalculate it ++ * each time on the data requests and timeout reads. It consists of the ++ * delay introduced by the internal ref-clock timer (N / Fclk) and the ++ * constant timeout caused by each conversion latency (Tmin): ++ * Ttotal = N / Fclk + Tmin ++ * If alarms are enabled the sensors are polled one after another and ++ * in order to get the next measurement of a particular sensor the ++ * caller will have to wait for at most until all the others are ++ * polled. In that case the formulae will look a bit different: ++ * Ttotal = 5 * (N / Fclk + Tmin) ++ */ ++#if defined(CONFIG_SENSORS_BT1_PVT_ALARMS) ++ pvt->timeout = ktime_set(PVT_SENSORS_NUM * PVT_TOUT_DEF, 0); ++ pvt->timeout = ktime_divns(pvt->timeout, rate); ++ pvt->timeout = ktime_add_ns(pvt->timeout, PVT_SENSORS_NUM * PVT_TOUT_MIN); ++#else ++ pvt->timeout = ktime_set(PVT_TOUT_DEF, 0); ++ pvt->timeout = ktime_divns(pvt->timeout, rate); ++ pvt->timeout = ktime_add_ns(pvt->timeout, PVT_TOUT_MIN); ++#endif ++ + trim = PVT_TRIM_DEF; + if (!of_property_read_u32(pvt->dev->of_node, + "baikal,pvt-temp-offset-millicelsius", &temp)) + trim = pvt_calc_trim(temp); + + pvt_set_trim(pvt, trim); ++ ++ return 0; + } + + static int pvt_request_irq(struct pvt_hwmon *pvt) +@@ -1149,7 +1154,9 @@ static int pvt_probe(struct platform_device *pdev) + if (ret) + return ret; + +- pvt_init_iface(pvt); ++ ret = pvt_init_iface(pvt); ++ if (ret) ++ return ret; + + ret = pvt_request_irq(pvt); + if (ret) +diff --git a/drivers/hwmon/bt1-pvt.h b/drivers/hwmon/bt1-pvt.h +index 5eac73e948854..93b8dd5e7c944 100644 +--- a/drivers/hwmon/bt1-pvt.h ++++ b/drivers/hwmon/bt1-pvt.h +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -201,6 +202,7 @@ struct pvt_cache { + * if alarms are disabled). + * @sensor: current PVT sensor the data conversion is being performed for. + * @cache: data cache descriptor. ++ * @timeout: conversion timeout cache. + */ + struct pvt_hwmon { + struct device *dev; +@@ -214,6 +216,7 @@ struct pvt_hwmon { + struct mutex iface_mtx; + enum pvt_sensor_type sensor; + struct pvt_cache cache[PVT_SENSORS_NUM]; ++ ktime_t timeout; + }; + + /* +-- +2.25.1 + diff --git a/queue-5.8/hwmon-bt1-pvt-test-sensor-power-supply-on-probe.patch b/queue-5.8/hwmon-bt1-pvt-test-sensor-power-supply-on-probe.patch new file mode 100644 index 00000000000..b709321c7be --- /dev/null +++ b/queue-5.8/hwmon-bt1-pvt-test-sensor-power-supply-on-probe.patch @@ -0,0 +1,95 @@ +From c3c146ce9e428b43b560bd470038382013a5a747 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Sep 2020 14:09:21 +0300 +Subject: hwmon: (bt1-pvt) Test sensor power supply on probe + +From: Serge Semin + +[ Upstream commit a6db1561291fc0f2f9aa23bf38f381adc63e7b14 ] + +Baikal-T1 PVT sensor has got a dedicated power supply domain (feed up by +the external GPVT/VPVT_18 pins). In case if it isn't powered up, the +registers will be accessible, but the sensor conversion just won't happen. +Due to that an attempt to read data from any PVT sensor will cause the +task hanging up. For instance that will happen if XP11 jumper isn't +installed on the Baikal-T1-based BFK3.1 board. Let's at least test whether +the conversion work on the device probe procedure. By doing so will make +sure that the PVT sensor is powered up at least at boot time. + +Fixes: 87976ce2825d ("hwmon: Add Baikal-T1 PVT sensor driver") +Signed-off-by: Serge Semin +Link: https://lore.kernel.org/r/20200920110924.19741-2-Sergey.Semin@baikalelectronics.ru +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/bt1-pvt.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/drivers/hwmon/bt1-pvt.c b/drivers/hwmon/bt1-pvt.c +index 94698cae04971..f4b7353c078a8 100644 +--- a/drivers/hwmon/bt1-pvt.c ++++ b/drivers/hwmon/bt1-pvt.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -982,6 +983,41 @@ static int pvt_request_clks(struct pvt_hwmon *pvt) + return 0; + } + ++static int pvt_check_pwr(struct pvt_hwmon *pvt) ++{ ++ unsigned long tout; ++ int ret = 0; ++ u32 data; ++ ++ /* ++ * Test out the sensor conversion functionality. If it is not done on ++ * time then the domain must have been unpowered and we won't be able ++ * to use the device later in this driver. ++ * Note If the power source is lost during the normal driver work the ++ * data read procedure will either return -ETIMEDOUT (for the ++ * alarm-less driver configuration) or just stop the repeated ++ * conversion. In the later case alas we won't be able to detect the ++ * problem. ++ */ ++ pvt_update(pvt->regs + PVT_INTR_MASK, PVT_INTR_ALL, PVT_INTR_ALL); ++ pvt_update(pvt->regs + PVT_CTRL, PVT_CTRL_EN, PVT_CTRL_EN); ++ pvt_set_tout(pvt, 0); ++ readl(pvt->regs + PVT_DATA); ++ ++ tout = PVT_TOUT_MIN / NSEC_PER_USEC; ++ usleep_range(tout, 2 * tout); ++ ++ data = readl(pvt->regs + PVT_DATA); ++ if (!(data & PVT_DATA_VALID)) { ++ ret = -ENODEV; ++ dev_err(pvt->dev, "Sensor is powered down\n"); ++ } ++ ++ pvt_update(pvt->regs + PVT_CTRL, PVT_CTRL_EN, 0); ++ ++ return ret; ++} ++ + static void pvt_init_iface(struct pvt_hwmon *pvt) + { + u32 trim, temp; +@@ -1109,6 +1145,10 @@ static int pvt_probe(struct platform_device *pdev) + if (ret) + return ret; + ++ ret = pvt_check_pwr(pvt); ++ if (ret) ++ return ret; ++ + pvt_init_iface(pvt); + + ret = pvt_request_irq(pvt); +-- +2.25.1 + diff --git a/queue-5.8/hwmon-bt1-pvt-wait-for-the-completion-with-timeout.patch b/queue-5.8/hwmon-bt1-pvt-wait-for-the-completion-with-timeout.patch new file mode 100644 index 00000000000..00f6bc78b1f --- /dev/null +++ b/queue-5.8/hwmon-bt1-pvt-wait-for-the-completion-with-timeout.patch @@ -0,0 +1,66 @@ +From e5dc98c4519e6b7b90c166ea20a4d259505e5133 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Sep 2020 14:09:23 +0300 +Subject: hwmon: (bt1-pvt) Wait for the completion with timeout + +From: Serge Semin + +[ Upstream commit 0ffd21d5985506d164ada9e8fff6daae8ef469a1 ] + +If the PVT sensor is suddenly powered down while a caller is waiting for +the conversion completion, the request won't be finished and the task will +hang up on this procedure until the power is back up again. Let's call the +wait_for_completion_timeout() method instead to prevent that. The cached +timeout is exactly what we need to predict for how long conversion could +normally last. + +Fixes: 87976ce2825d ("hwmon: Add Baikal-T1 PVT sensor driver") +Signed-off-by: Serge Semin +Link: https://lore.kernel.org/r/20200920110924.19741-4-Sergey.Semin@baikalelectronics.ru +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/bt1-pvt.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/bt1-pvt.c b/drivers/hwmon/bt1-pvt.c +index 2600426a3b21c..3e1d56585b91a 100644 +--- a/drivers/hwmon/bt1-pvt.c ++++ b/drivers/hwmon/bt1-pvt.c +@@ -477,6 +477,7 @@ static int pvt_read_data(struct pvt_hwmon *pvt, enum pvt_sensor_type type, + long *val) + { + struct pvt_cache *cache = &pvt->cache[type]; ++ unsigned long timeout; + u32 data; + int ret; + +@@ -500,7 +501,14 @@ static int pvt_read_data(struct pvt_hwmon *pvt, enum pvt_sensor_type type, + pvt_update(pvt->regs + PVT_INTR_MASK, PVT_INTR_DVALID, 0); + pvt_update(pvt->regs + PVT_CTRL, PVT_CTRL_EN, PVT_CTRL_EN); + +- wait_for_completion(&cache->conversion); ++ /* ++ * Wait with timeout since in case if the sensor is suddenly powered ++ * down the request won't be completed and the caller will hang up on ++ * this procedure until the power is back up again. Multiply the ++ * timeout by the factor of two to prevent a false timeout. ++ */ ++ timeout = 2 * usecs_to_jiffies(ktime_to_us(pvt->timeout)); ++ ret = wait_for_completion_timeout(&cache->conversion, timeout); + + pvt_update(pvt->regs + PVT_CTRL, PVT_CTRL_EN, 0); + pvt_update(pvt->regs + PVT_INTR_MASK, PVT_INTR_DVALID, +@@ -510,6 +518,9 @@ static int pvt_read_data(struct pvt_hwmon *pvt, enum pvt_sensor_type type, + + mutex_unlock(&pvt->iface_mtx); + ++ if (!ret) ++ return -ETIMEDOUT; ++ + if (type == PVT_TEMP) + *val = pvt_calc_poly(&poly_N_to_temp, data); + else +-- +2.25.1 + diff --git a/queue-5.8/hwmon-pmbus-max34440-fix-status-register-reads-for-m.patch b/queue-5.8/hwmon-pmbus-max34440-fix-status-register-reads-for-m.patch new file mode 100644 index 00000000000..bb569a7d979 --- /dev/null +++ b/queue-5.8/hwmon-pmbus-max34440-fix-status-register-reads-for-m.patch @@ -0,0 +1,55 @@ +From 76d2209af164540fe753bf35154c070dd558fe4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 14:39:29 -0700 +Subject: hwmon: (pmbus/max34440) Fix status register reads for + MAX344{51,60,61} + +From: Guenter Roeck + +[ Upstream commit 6c094b31ea2ad773824362ba0fccb88d36f8d32d ] + +Starting with MAX34451, the chips of this series support STATUS_IOUT and +STATUS_TEMPERATURE commands, and no longer report over-current and +over-temperature status with STATUS_MFR_SPECIFIC. + +Fixes: 7a001dbab4ade ("hwmon: (pmbus/max34440) Add support for MAX34451.") +Fixes: 50115ac9b6f35 ("hwmon: (pmbus/max34440) Add support for MAX34460 and MAX34461") +Reported-by: Steve Foreman +Cc: Steve Foreman +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/max34440.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/hwmon/pmbus/max34440.c b/drivers/hwmon/pmbus/max34440.c +index 18b4e071067f7..de04dff28945b 100644 +--- a/drivers/hwmon/pmbus/max34440.c ++++ b/drivers/hwmon/pmbus/max34440.c +@@ -388,7 +388,6 @@ static struct pmbus_driver_info max34440_info[] = { + .func[18] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, + .func[19] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, + .func[20] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, +- .read_byte_data = max34440_read_byte_data, + .read_word_data = max34440_read_word_data, + .write_word_data = max34440_write_word_data, + }, +@@ -419,7 +418,6 @@ static struct pmbus_driver_info max34440_info[] = { + .func[15] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, + .func[16] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, + .func[17] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, +- .read_byte_data = max34440_read_byte_data, + .read_word_data = max34440_read_word_data, + .write_word_data = max34440_write_word_data, + }, +@@ -455,7 +453,6 @@ static struct pmbus_driver_info max34440_info[] = { + .func[19] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, + .func[20] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, + .func[21] = PMBUS_HAVE_TEMP | PMBUS_HAVE_STATUS_TEMP, +- .read_byte_data = max34440_read_byte_data, + .read_word_data = max34440_read_word_data, + .write_word_data = max34440_write_word_data, + }, +-- +2.25.1 + diff --git a/queue-5.8/hwmon-w83627ehf-fix-a-resource-leak-in-probe.patch b/queue-5.8/hwmon-w83627ehf-fix-a-resource-leak-in-probe.patch new file mode 100644 index 00000000000..b7fcb023de7 --- /dev/null +++ b/queue-5.8/hwmon-w83627ehf-fix-a-resource-leak-in-probe.patch @@ -0,0 +1,47 @@ +From 38b26accb7c6928865f0f5c8a37b181238919fc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 15:52:12 +0300 +Subject: hwmon: (w83627ehf) Fix a resource leak in probe + +From: Dan Carpenter + +[ Upstream commit 18360b33a071e5883250fd1e04bfdeff8c3887a3 ] + +Smatch has a new check for resource leaks which found a bug in probe: + + drivers/hwmon/w83627ehf.c:2417 w83627ehf_probe() + warn: 'res->start' not released on lines: 2412. + +We need to clean up if devm_hwmon_device_register_with_info() fails. + +Fixes: 266cd5835947 ("hwmon: (w83627ehf) convert to with_info interface") +Signed-off-by: Dan Carpenter +Reviewed-by: Dr. David Alan Gilbert +Link: https://lore.kernel.org/r/20200921125212.GA1128194@mwanda +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/w83627ehf.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c +index 5a5120121e507..3964ceab2817c 100644 +--- a/drivers/hwmon/w83627ehf.c ++++ b/drivers/hwmon/w83627ehf.c +@@ -1951,8 +1951,12 @@ static int w83627ehf_probe(struct platform_device *pdev) + data, + &w83627ehf_chip_info, + w83627ehf_groups); ++ if (IS_ERR(hwmon_dev)) { ++ err = PTR_ERR(hwmon_dev); ++ goto exit_release; ++ } + +- return PTR_ERR_OR_ZERO(hwmon_dev); ++ return 0; + + exit_release: + release_region(res->start, IOREGION_LENGTH); +-- +2.25.1 + diff --git a/queue-5.8/i2c-core-restore-acpi_walk_dep_device_list-getting-c.patch b/queue-5.8/i2c-core-restore-acpi_walk_dep_device_list-getting-c.patch new file mode 100644 index 00000000000..9b0a7ea3ffd --- /dev/null +++ b/queue-5.8/i2c-core-restore-acpi_walk_dep_device_list-getting-c.patch @@ -0,0 +1,79 @@ +From e900ed08ccc9816c0f9912ea6b82c7e0807820a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Oct 2020 16:41:58 +0200 +Subject: i2c: core: Restore acpi_walk_dep_device_list() getting called after + registering the ACPI i2c devs + +From: Hans de Goede + +[ Upstream commit 8058d69905058ec8f467a120b5ec5bb831ea67f3 ] + +Commit 21653a4181ff ("i2c: core: Call i2c_acpi_install_space_handler() +before i2c_acpi_register_devices()")'s intention was to only move the +acpi_install_address_space_handler() call to the point before where +the ACPI declared i2c-children of the adapter where instantiated by +i2c_acpi_register_devices(). + +But i2c_acpi_install_space_handler() had a call to +acpi_walk_dep_device_list() hidden (that is I missed it) at the end +of it, so as an unwanted side-effect now acpi_walk_dep_device_list() +was also being called before i2c_acpi_register_devices(). + +Move the acpi_walk_dep_device_list() call to the end of +i2c_acpi_register_devices(), so that it is once again called *after* +the i2c_client-s hanging of the adapter have been created. + +This fixes the Microsoft Surface Go 2 hanging at boot. + +Fixes: 21653a4181ff ("i2c: core: Call i2c_acpi_install_space_handler() before i2c_acpi_register_devices()") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=209627 +Reported-by: Rainer Finke +Reported-by: Kieran Bingham +Suggested-by: Maximilian Luz +Tested-by: Kieran Bingham +Signed-off-by: Hans de Goede +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-acpi.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c +index 2ade99b105b91..bbf8dd491d245 100644 +--- a/drivers/i2c/i2c-core-acpi.c ++++ b/drivers/i2c/i2c-core-acpi.c +@@ -264,6 +264,7 @@ static acpi_status i2c_acpi_add_device(acpi_handle handle, u32 level, + void i2c_acpi_register_devices(struct i2c_adapter *adap) + { + acpi_status status; ++ acpi_handle handle; + + if (!has_acpi_companion(&adap->dev)) + return; +@@ -274,6 +275,15 @@ void i2c_acpi_register_devices(struct i2c_adapter *adap) + adap, NULL); + if (ACPI_FAILURE(status)) + dev_warn(&adap->dev, "failed to enumerate I2C slaves\n"); ++ ++ if (!adap->dev.parent) ++ return; ++ ++ handle = ACPI_HANDLE(adap->dev.parent); ++ if (!handle) ++ return; ++ ++ acpi_walk_dep_device_list(handle); + } + + const struct acpi_device_id * +@@ -729,7 +739,6 @@ int i2c_acpi_install_space_handler(struct i2c_adapter *adapter) + return -ENOMEM; + } + +- acpi_walk_dep_device_list(handle); + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.8/i2c-rcar-auto-select-reset_controller.patch b/queue-5.8/i2c-rcar-auto-select-reset_controller.patch new file mode 100644 index 00000000000..49ddc27aaac --- /dev/null +++ b/queue-5.8/i2c-rcar-auto-select-reset_controller.patch @@ -0,0 +1,39 @@ +From f950872d5f4c398ccffb69833565cc9fa2e63261 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 11:23:30 +0200 +Subject: i2c: rcar: Auto select RESET_CONTROLLER + +From: Dirk Behme + +[ Upstream commit 5b9bacf28a973a6b16510493416baeefa2c06289 ] + +The i2c-rcar driver utilizes the Generic Reset Controller kernel +feature, so select the RESET_CONTROLLER option when the I2C_RCAR +option is selected with a Gen3 SoC. + +Fixes: 2b16fd63059ab9 ("i2c: rcar: handle RXDMA HW behaviour on Gen3") +Signed-off-by: Dirk Behme +Signed-off-by: Andy Lowe +[erosca: Add "if ARCH_RCAR_GEN3" per Wolfram's request] +Signed-off-by: Eugeniu Rosca +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig +index 735bf31a3fdff..6546d6cf3c24c 100644 +--- a/drivers/i2c/busses/Kconfig ++++ b/drivers/i2c/busses/Kconfig +@@ -1191,6 +1191,7 @@ config I2C_RCAR + tristate "Renesas R-Car I2C Controller" + depends on ARCH_RENESAS || COMPILE_TEST + select I2C_SLAVE ++ select RESET_CONTROLLER if ARCH_RCAR_GEN3 + help + If you say yes to this option, support will be included for the + R-Car I2C controller. +-- +2.25.1 + diff --git a/queue-5.8/i3c-master-add-i3c_master_attach_boardinfo-to-preser.patch b/queue-5.8/i3c-master-add-i3c_master_attach_boardinfo-to-preser.patch new file mode 100644 index 00000000000..990377db6f1 --- /dev/null +++ b/queue-5.8/i3c-master-add-i3c_master_attach_boardinfo-to-preser.patch @@ -0,0 +1,66 @@ +From 58dbdf0582e8858b54413a2199667d6391df6b25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 May 2020 11:32:22 +0200 +Subject: i3c: master add i3c_master_attach_boardinfo to preserve boardinfo + +From: Parshuram Thombare + +[ Upstream commit 9da36a7ec42135428e1d41621e3703429bda3b2e ] + +Boardinfo was lost if I3C object for devices with boardinfo +available are not created or not added to the I3C device list +because of some failure e.g. SETDASA failed, retrieve info failed etc +This patch adds i3c_master_attach_boardinfo which scan boardinfo list +in the master object and 'attach' it to the I3C device object. + +Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure") +Signed-off-by: Parshuram Thombare +Signed-off-by: Boris Brezillon +Link: https://lore.kernel.org/linux-i3c/1590053542-389-1-git-send-email-pthombar@cadence.com +Signed-off-by: Sasha Levin +--- + drivers/i3c/master.c | 19 +++++++++++++++++-- + 1 file changed, 17 insertions(+), 2 deletions(-) + +diff --git a/drivers/i3c/master.c b/drivers/i3c/master.c +index 97f2e29265da7..cc7564446ccd2 100644 +--- a/drivers/i3c/master.c ++++ b/drivers/i3c/master.c +@@ -1782,6 +1782,21 @@ static void i3c_master_bus_cleanup(struct i3c_master_controller *master) + i3c_master_detach_free_devs(master); + } + ++static void i3c_master_attach_boardinfo(struct i3c_dev_desc *i3cdev) ++{ ++ struct i3c_master_controller *master = i3cdev->common.master; ++ struct i3c_dev_boardinfo *i3cboardinfo; ++ ++ list_for_each_entry(i3cboardinfo, &master->boardinfo.i3c, node) { ++ if (i3cdev->info.pid != i3cboardinfo->pid) ++ continue; ++ ++ i3cdev->boardinfo = i3cboardinfo; ++ i3cdev->info.static_addr = i3cboardinfo->static_addr; ++ return; ++ } ++} ++ + static struct i3c_dev_desc * + i3c_master_search_i3c_dev_duplicate(struct i3c_dev_desc *refdev) + { +@@ -1837,10 +1852,10 @@ int i3c_master_add_i3c_dev_locked(struct i3c_master_controller *master, + if (ret) + goto err_detach_dev; + ++ i3c_master_attach_boardinfo(newdev); ++ + olddev = i3c_master_search_i3c_dev_duplicate(newdev); + if (olddev) { +- newdev->boardinfo = olddev->boardinfo; +- newdev->info.static_addr = olddev->info.static_addr; + newdev->dev = olddev->dev; + if (newdev->dev) + newdev->dev->desc = newdev; +-- +2.25.1 + diff --git a/queue-5.8/i3c-master-fix-error-return-in-cdns_i3c_master_probe.patch b/queue-5.8/i3c-master-fix-error-return-in-cdns_i3c_master_probe.patch new file mode 100644 index 00000000000..621000ba4d8 --- /dev/null +++ b/queue-5.8/i3c-master-fix-error-return-in-cdns_i3c_master_probe.patch @@ -0,0 +1,40 @@ +From a81492d628a39e80710fce06bcfa63e56f686de5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 11:33:50 +0800 +Subject: i3c: master: Fix error return in cdns_i3c_master_probe() + +From: Jing Xiangfeng + +[ Upstream commit abea14bfdebbe9bd02f2ad24a1f3a878ed21c8f0 ] + +Fix to return negative error code -ENOMEM from the error handling +case instead of 0. + +Fixes: 603f2bee2c54 ("i3c: master: Add driver for Cadence IP") +Signed-off-by: Jing Xiangfeng +Signed-off-by: Boris Brezillon +Link: https://lore.kernel.org/linux-i3c/20200911033350.23904-1-jingxiangfeng@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/i3c/master/i3c-master-cdns.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/i3c/master/i3c-master-cdns.c b/drivers/i3c/master/i3c-master-cdns.c +index 3fee8bd7fe20b..3f2226928fe05 100644 +--- a/drivers/i3c/master/i3c-master-cdns.c ++++ b/drivers/i3c/master/i3c-master-cdns.c +@@ -1635,8 +1635,10 @@ static int cdns_i3c_master_probe(struct platform_device *pdev) + master->ibi.slots = devm_kcalloc(&pdev->dev, master->ibi.num_slots, + sizeof(*master->ibi.slots), + GFP_KERNEL); +- if (!master->ibi.slots) ++ if (!master->ibi.slots) { ++ ret = -ENOMEM; + goto err_disable_sysclk; ++ } + + writel(IBIR_THR(1), master->regs + CMD_IBI_THR_CTRL); + writel(MST_INT_IBIR_THR, master->regs + MST_IER); +-- +2.25.1 + diff --git a/queue-5.8/i40iw-add-support-to-make-destroy-qp-synchronous.patch b/queue-5.8/i40iw-add-support-to-make-destroy-qp-synchronous.patch new file mode 100644 index 00000000000..5ac41ffc8e4 --- /dev/null +++ b/queue-5.8/i40iw-add-support-to-make-destroy-qp-synchronous.patch @@ -0,0 +1,408 @@ +From 351fb035ab8b8aa1b5a1e89547bba3d1aa89f30d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 08:18:12 -0500 +Subject: i40iw: Add support to make destroy QP synchronous + +From: Sindhu, Devale + +[ Upstream commit f2334964e969762e266a616acf9377f6046470a2 ] + +Occasionally ib_write_bw crash is seen due to access of a pd object in +i40iw_sc_qp_destroy after it is freed. Destroy qp is not synchronous in +i40iw and thus the iwqp object could be referencing a pd object that is +freed by ib core as a result of successful return from i40iw_destroy_qp. + +Wait in i40iw_destroy_qp till all QP references are released and destroy +the QP and its associated resources before returning. Switch to use the +refcount API vs atomic API for lifetime management of the qp. + + RIP: 0010:i40iw_sc_qp_destroy+0x4b/0x120 [i40iw] + [...] + RSP: 0018:ffffb4a7042e3ba8 EFLAGS: 00010002 + RAX: 0000000000000000 RBX: 0000000000000001 RCX: dead000000000122 + RDX: ffffb4a7042e3bac RSI: ffff8b7ef9b1e940 RDI: ffff8b7efbf09080 + RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 + R10: 8080808080808080 R11: 0000000000000010 R12: ffff8b7efbf08050 + R13: 0000000000000001 R14: ffff8b7f15042928 R15: ffff8b7ef9b1e940 + FS: 0000000000000000(0000) GS:ffff8b7f2fa00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000400 CR3: 000000020d60a006 CR4: 00000000001606e0 + Call Trace: + i40iw_exec_cqp_cmd+0x4d3/0x5c0 [i40iw] + ? try_to_wake_up+0x1ea/0x5d0 + ? __switch_to_asm+0x40/0x70 + i40iw_process_cqp_cmd+0x95/0xa0 [i40iw] + i40iw_handle_cqp_op+0x42/0x1a0 [i40iw] + ? cm_event_handler+0x13c/0x1f0 [iw_cm] + i40iw_rem_ref+0xa0/0xf0 [i40iw] + cm_work_handler+0x99c/0xd10 [iw_cm] + process_one_work+0x1a1/0x360 + worker_thread+0x30/0x380 + ? process_one_work+0x360/0x360 + kthread+0x10c/0x130 + ? kthread_park+0x80/0x80 + ret_from_fork+0x35/0x40 + +Fixes: d37498417947 ("i40iw: add files for iwarp interface") +Link: https://lore.kernel.org/r/20200916131811.2077-1-shiraz.saleem@intel.com +Reported-by: Kamal Heib +Signed-off-by: Sindhu, Devale +Signed-off-by: Shiraz, Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/i40iw/i40iw.h | 9 ++-- + drivers/infiniband/hw/i40iw/i40iw_cm.c | 10 ++-- + drivers/infiniband/hw/i40iw/i40iw_hw.c | 4 +- + drivers/infiniband/hw/i40iw/i40iw_utils.c | 59 ++++------------------- + drivers/infiniband/hw/i40iw/i40iw_verbs.c | 31 ++++++++---- + drivers/infiniband/hw/i40iw/i40iw_verbs.h | 3 +- + 6 files changed, 45 insertions(+), 71 deletions(-) + +diff --git a/drivers/infiniband/hw/i40iw/i40iw.h b/drivers/infiniband/hw/i40iw/i40iw.h +index 49d92638e0dbb..9a2b87cc3d301 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw.h ++++ b/drivers/infiniband/hw/i40iw/i40iw.h +@@ -409,8 +409,8 @@ static inline struct i40iw_qp *to_iwqp(struct ib_qp *ibqp) + } + + /* i40iw.c */ +-void i40iw_add_ref(struct ib_qp *); +-void i40iw_rem_ref(struct ib_qp *); ++void i40iw_qp_add_ref(struct ib_qp *ibqp); ++void i40iw_qp_rem_ref(struct ib_qp *ibqp); + struct ib_qp *i40iw_get_qp(struct ib_device *, int); + + void i40iw_flush_wqes(struct i40iw_device *iwdev, +@@ -554,9 +554,8 @@ enum i40iw_status_code i40iw_manage_qhash(struct i40iw_device *iwdev, + bool wait); + void i40iw_receive_ilq(struct i40iw_sc_vsi *vsi, struct i40iw_puda_buf *rbuf); + void i40iw_free_sqbuf(struct i40iw_sc_vsi *vsi, void *bufp); +-void i40iw_free_qp_resources(struct i40iw_device *iwdev, +- struct i40iw_qp *iwqp, +- u32 qp_num); ++void i40iw_free_qp_resources(struct i40iw_qp *iwqp); ++ + enum i40iw_status_code i40iw_obj_aligned_mem(struct i40iw_device *iwdev, + struct i40iw_dma_mem *memptr, + u32 size, u32 mask); +diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c +index fa7a5ff498c73..56c1e9abc52dc 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c +@@ -2322,7 +2322,7 @@ static void i40iw_rem_ref_cm_node(struct i40iw_cm_node *cm_node) + iwqp = cm_node->iwqp; + if (iwqp) { + iwqp->cm_node = NULL; +- i40iw_rem_ref(&iwqp->ibqp); ++ i40iw_qp_rem_ref(&iwqp->ibqp); + cm_node->iwqp = NULL; + } else if (cm_node->qhash_set) { + i40iw_get_addr_info(cm_node, &nfo); +@@ -3452,7 +3452,7 @@ void i40iw_cm_disconn(struct i40iw_qp *iwqp) + kfree(work); + return; + } +- i40iw_add_ref(&iwqp->ibqp); ++ i40iw_qp_add_ref(&iwqp->ibqp); + spin_unlock_irqrestore(&iwdev->qptable_lock, flags); + + work->iwqp = iwqp; +@@ -3623,7 +3623,7 @@ static void i40iw_disconnect_worker(struct work_struct *work) + + kfree(dwork); + i40iw_cm_disconn_true(iwqp); +- i40iw_rem_ref(&iwqp->ibqp); ++ i40iw_qp_rem_ref(&iwqp->ibqp); + } + + /** +@@ -3745,7 +3745,7 @@ int i40iw_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) + cm_node->lsmm_size = accept.size + conn_param->private_data_len; + i40iw_cm_init_tsa_conn(iwqp, cm_node); + cm_id->add_ref(cm_id); +- i40iw_add_ref(&iwqp->ibqp); ++ i40iw_qp_add_ref(&iwqp->ibqp); + + attr.qp_state = IB_QPS_RTS; + cm_node->qhash_set = false; +@@ -3908,7 +3908,7 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) + iwqp->cm_node = cm_node; + cm_node->iwqp = iwqp; + iwqp->cm_id = cm_id; +- i40iw_add_ref(&iwqp->ibqp); ++ i40iw_qp_add_ref(&iwqp->ibqp); + + if (cm_node->state != I40IW_CM_STATE_OFFLOADED) { + cm_node->state = I40IW_CM_STATE_SYN_SENT; +diff --git a/drivers/infiniband/hw/i40iw/i40iw_hw.c b/drivers/infiniband/hw/i40iw/i40iw_hw.c +index ae8b97c306657..a7512508f7e60 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_hw.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_hw.c +@@ -313,7 +313,7 @@ void i40iw_process_aeq(struct i40iw_device *iwdev) + __func__, info->qp_cq_id); + continue; + } +- i40iw_add_ref(&iwqp->ibqp); ++ i40iw_qp_add_ref(&iwqp->ibqp); + spin_unlock_irqrestore(&iwdev->qptable_lock, flags); + qp = &iwqp->sc_qp; + spin_lock_irqsave(&iwqp->lock, flags); +@@ -427,7 +427,7 @@ void i40iw_process_aeq(struct i40iw_device *iwdev) + break; + } + if (info->qp) +- i40iw_rem_ref(&iwqp->ibqp); ++ i40iw_qp_rem_ref(&iwqp->ibqp); + } while (1); + + if (aeqcnt) +diff --git a/drivers/infiniband/hw/i40iw/i40iw_utils.c b/drivers/infiniband/hw/i40iw/i40iw_utils.c +index 016524683e17e..72db7c1dc2998 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_utils.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_utils.c +@@ -479,25 +479,6 @@ void i40iw_cleanup_pending_cqp_op(struct i40iw_device *iwdev) + } + } + +-/** +- * i40iw_free_qp - callback after destroy cqp completes +- * @cqp_request: cqp request for destroy qp +- * @num: not used +- */ +-static void i40iw_free_qp(struct i40iw_cqp_request *cqp_request, u32 num) +-{ +- struct i40iw_sc_qp *qp = (struct i40iw_sc_qp *)cqp_request->param; +- struct i40iw_qp *iwqp = (struct i40iw_qp *)qp->back_qp; +- struct i40iw_device *iwdev; +- u32 qp_num = iwqp->ibqp.qp_num; +- +- iwdev = iwqp->iwdev; +- +- i40iw_rem_pdusecount(iwqp->iwpd, iwdev); +- i40iw_free_qp_resources(iwdev, iwqp, qp_num); +- i40iw_rem_devusecount(iwdev); +-} +- + /** + * i40iw_wait_event - wait for completion + * @iwdev: iwarp device +@@ -618,26 +599,23 @@ void i40iw_rem_pdusecount(struct i40iw_pd *iwpd, struct i40iw_device *iwdev) + } + + /** +- * i40iw_add_ref - add refcount for qp ++ * i40iw_qp_add_ref - add refcount for qp + * @ibqp: iqarp qp + */ +-void i40iw_add_ref(struct ib_qp *ibqp) ++void i40iw_qp_add_ref(struct ib_qp *ibqp) + { + struct i40iw_qp *iwqp = (struct i40iw_qp *)ibqp; + +- atomic_inc(&iwqp->refcount); ++ refcount_inc(&iwqp->refcount); + } + + /** +- * i40iw_rem_ref - rem refcount for qp and free if 0 ++ * i40iw_qp_rem_ref - rem refcount for qp and free if 0 + * @ibqp: iqarp qp + */ +-void i40iw_rem_ref(struct ib_qp *ibqp) ++void i40iw_qp_rem_ref(struct ib_qp *ibqp) + { + struct i40iw_qp *iwqp; +- enum i40iw_status_code status; +- struct i40iw_cqp_request *cqp_request; +- struct cqp_commands_info *cqp_info; + struct i40iw_device *iwdev; + u32 qp_num; + unsigned long flags; +@@ -645,7 +623,7 @@ void i40iw_rem_ref(struct ib_qp *ibqp) + iwqp = to_iwqp(ibqp); + iwdev = iwqp->iwdev; + spin_lock_irqsave(&iwdev->qptable_lock, flags); +- if (!atomic_dec_and_test(&iwqp->refcount)) { ++ if (!refcount_dec_and_test(&iwqp->refcount)) { + spin_unlock_irqrestore(&iwdev->qptable_lock, flags); + return; + } +@@ -653,25 +631,8 @@ void i40iw_rem_ref(struct ib_qp *ibqp) + qp_num = iwqp->ibqp.qp_num; + iwdev->qp_table[qp_num] = NULL; + spin_unlock_irqrestore(&iwdev->qptable_lock, flags); +- cqp_request = i40iw_get_cqp_request(&iwdev->cqp, false); +- if (!cqp_request) +- return; +- +- cqp_request->callback_fcn = i40iw_free_qp; +- cqp_request->param = (void *)&iwqp->sc_qp; +- cqp_info = &cqp_request->info; +- cqp_info->cqp_cmd = OP_QP_DESTROY; +- cqp_info->post_sq = 1; +- cqp_info->in.u.qp_destroy.qp = &iwqp->sc_qp; +- cqp_info->in.u.qp_destroy.scratch = (uintptr_t)cqp_request; +- cqp_info->in.u.qp_destroy.remove_hash_idx = true; +- status = i40iw_handle_cqp_op(iwdev, cqp_request); +- if (!status) +- return; ++ complete(&iwqp->free_qp); + +- i40iw_rem_pdusecount(iwqp->iwpd, iwdev); +- i40iw_free_qp_resources(iwdev, iwqp, qp_num); +- i40iw_rem_devusecount(iwdev); + } + + /** +@@ -938,7 +899,7 @@ static void i40iw_terminate_timeout(struct timer_list *t) + struct i40iw_sc_qp *qp = (struct i40iw_sc_qp *)&iwqp->sc_qp; + + i40iw_terminate_done(qp, 1); +- i40iw_rem_ref(&iwqp->ibqp); ++ i40iw_qp_rem_ref(&iwqp->ibqp); + } + + /** +@@ -950,7 +911,7 @@ void i40iw_terminate_start_timer(struct i40iw_sc_qp *qp) + struct i40iw_qp *iwqp; + + iwqp = (struct i40iw_qp *)qp->back_qp; +- i40iw_add_ref(&iwqp->ibqp); ++ i40iw_qp_add_ref(&iwqp->ibqp); + timer_setup(&iwqp->terminate_timer, i40iw_terminate_timeout, 0); + iwqp->terminate_timer.expires = jiffies + HZ; + add_timer(&iwqp->terminate_timer); +@@ -966,7 +927,7 @@ void i40iw_terminate_del_timer(struct i40iw_sc_qp *qp) + + iwqp = (struct i40iw_qp *)qp->back_qp; + if (del_timer(&iwqp->terminate_timer)) +- i40iw_rem_ref(&iwqp->ibqp); ++ i40iw_qp_rem_ref(&iwqp->ibqp); + } + + /** +diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +index c3087b8738ed7..2419de36e943d 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +@@ -364,11 +364,11 @@ static struct i40iw_pbl *i40iw_get_pbl(unsigned long va, + * @iwqp: qp ptr (user or kernel) + * @qp_num: qp number assigned + */ +-void i40iw_free_qp_resources(struct i40iw_device *iwdev, +- struct i40iw_qp *iwqp, +- u32 qp_num) ++void i40iw_free_qp_resources(struct i40iw_qp *iwqp) + { + struct i40iw_pbl *iwpbl = &iwqp->iwpbl; ++ struct i40iw_device *iwdev = iwqp->iwdev; ++ u32 qp_num = iwqp->ibqp.qp_num; + + i40iw_ieq_cleanup_qp(iwdev->vsi.ieq, &iwqp->sc_qp); + i40iw_dealloc_push_page(iwdev, &iwqp->sc_qp); +@@ -402,6 +402,10 @@ static void i40iw_clean_cqes(struct i40iw_qp *iwqp, struct i40iw_cq *iwcq) + static int i40iw_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) + { + struct i40iw_qp *iwqp = to_iwqp(ibqp); ++ struct ib_qp_attr attr; ++ struct i40iw_device *iwdev = iwqp->iwdev; ++ ++ memset(&attr, 0, sizeof(attr)); + + iwqp->destroyed = 1; + +@@ -416,7 +420,15 @@ static int i40iw_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) + } + } + +- i40iw_rem_ref(&iwqp->ibqp); ++ attr.qp_state = IB_QPS_ERR; ++ i40iw_modify_qp(&iwqp->ibqp, &attr, IB_QP_STATE, NULL); ++ i40iw_qp_rem_ref(&iwqp->ibqp); ++ wait_for_completion(&iwqp->free_qp); ++ i40iw_cqp_qp_destroy_cmd(&iwdev->sc_dev, &iwqp->sc_qp); ++ i40iw_rem_pdusecount(iwqp->iwpd, iwdev); ++ i40iw_free_qp_resources(iwqp); ++ i40iw_rem_devusecount(iwdev); ++ + return 0; + } + +@@ -577,6 +589,7 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd, + qp->back_qp = (void *)iwqp; + qp->push_idx = I40IW_INVALID_PUSH_PAGE_INDEX; + ++ iwqp->iwdev = iwdev; + iwqp->ctx_info.iwarp_info = &iwqp->iwarp_info; + + if (i40iw_allocate_dma_mem(dev->hw, +@@ -601,7 +614,6 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd, + goto error; + } + +- iwqp->iwdev = iwdev; + iwqp->iwpd = iwpd; + iwqp->ibqp.qp_num = qp_num; + qp = &iwqp->sc_qp; +@@ -715,7 +727,7 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd, + goto error; + } + +- i40iw_add_ref(&iwqp->ibqp); ++ refcount_set(&iwqp->refcount, 1); + spin_lock_init(&iwqp->lock); + iwqp->sig_all = (init_attr->sq_sig_type == IB_SIGNAL_ALL_WR) ? 1 : 0; + iwdev->qp_table[qp_num] = iwqp; +@@ -737,10 +749,11 @@ static struct ib_qp *i40iw_create_qp(struct ib_pd *ibpd, + } + init_completion(&iwqp->sq_drained); + init_completion(&iwqp->rq_drained); ++ init_completion(&iwqp->free_qp); + + return &iwqp->ibqp; + error: +- i40iw_free_qp_resources(iwdev, iwqp, qp_num); ++ i40iw_free_qp_resources(iwqp); + return ERR_PTR(err_code); + } + +@@ -2657,13 +2670,13 @@ static const struct ib_device_ops i40iw_dev_ops = { + .get_hw_stats = i40iw_get_hw_stats, + .get_port_immutable = i40iw_port_immutable, + .iw_accept = i40iw_accept, +- .iw_add_ref = i40iw_add_ref, ++ .iw_add_ref = i40iw_qp_add_ref, + .iw_connect = i40iw_connect, + .iw_create_listen = i40iw_create_listen, + .iw_destroy_listen = i40iw_destroy_listen, + .iw_get_qp = i40iw_get_qp, + .iw_reject = i40iw_reject, +- .iw_rem_ref = i40iw_rem_ref, ++ .iw_rem_ref = i40iw_qp_rem_ref, + .map_mr_sg = i40iw_map_mr_sg, + .mmap = i40iw_mmap, + .modify_qp = i40iw_modify_qp, +diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.h b/drivers/infiniband/hw/i40iw/i40iw_verbs.h +index 331bc21cbcc73..bab71f3e56374 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.h +@@ -139,7 +139,7 @@ struct i40iw_qp { + struct i40iw_qp_host_ctx_info ctx_info; + struct i40iwarp_offload_info iwarp_info; + void *allocated_buffer; +- atomic_t refcount; ++ refcount_t refcount; + struct iw_cm_id *cm_id; + void *cm_node; + struct ib_mr *lsmm_mr; +@@ -174,5 +174,6 @@ struct i40iw_qp { + struct i40iw_dma_mem ietf_mem; + struct completion sq_drained; + struct completion rq_drained; ++ struct completion free_qp; + }; + #endif +-- +2.25.1 + diff --git a/queue-5.8/ib-mlx4-adjust-delayed-work-when-a-dup-is-observed.patch b/queue-5.8/ib-mlx4-adjust-delayed-work-when-a-dup-is-observed.patch new file mode 100644 index 00000000000..5c7d4c73288 --- /dev/null +++ b/queue-5.8/ib-mlx4-adjust-delayed-work-when-a-dup-is-observed.patch @@ -0,0 +1,41 @@ +From ea8e72bab9f179ad7e036fc9eff2866e508c465b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Aug 2020 08:19:41 +0200 +Subject: IB/mlx4: Adjust delayed work when a dup is observed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 785167a114855c5aa75efca97000e405c2cc85bf ] + +When scheduling delayed work to clean up the cache, if the entry already +has been scheduled for deletion, we adjust the delay. + +Fixes: 3cf69cc8dbeb ("IB/mlx4: Add CM paravirtualization") +Link: https://lore.kernel.org/r/20200803061941.1139994-7-haakon.bugge@oracle.com +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/cm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c +index b591861934b3c..81d6a3460b55d 100644 +--- a/drivers/infiniband/hw/mlx4/cm.c ++++ b/drivers/infiniband/hw/mlx4/cm.c +@@ -280,6 +280,9 @@ static void schedule_delayed(struct ib_device *ibdev, struct id_map_entry *id) + if (!sriov->is_going_down && !id->scheduled_delete) { + id->scheduled_delete = 1; + schedule_delayed_work(&id->timeout, CM_CLEANUP_CACHE_TIMEOUT); ++ } else if (id->scheduled_delete) { ++ /* Adjust timeout if already scheduled */ ++ mod_delayed_work(system_wq, &id->timeout, CM_CLEANUP_CACHE_TIMEOUT); + } + spin_unlock_irqrestore(&sriov->going_down_lock, flags); + spin_unlock(&sriov->id_map_lock); +-- +2.25.1 + diff --git a/queue-5.8/ib-mlx4-fix-starvation-in-paravirt-mux-demux.patch b/queue-5.8/ib-mlx4-fix-starvation-in-paravirt-mux-demux.patch new file mode 100644 index 00000000000..635837e7f6e --- /dev/null +++ b/queue-5.8/ib-mlx4-fix-starvation-in-paravirt-mux-demux.patch @@ -0,0 +1,181 @@ +From c1848471333213a29de82b3a662075a61b1ab238 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Aug 2020 08:19:39 +0200 +Subject: IB/mlx4: Fix starvation in paravirt mux/demux +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 7fd1507df7cee9c533f38152fcd1dd769fcac6ce ] + +The mlx4 driver will proxy MAD packets through the PF driver. A VM or an +instantiated VF will send its MAD packets to the PF driver using +loop-back. The PF driver will be informed by an interrupt, but defer the +handling and polling of CQEs to a worker thread running on an ordered +work-queue. + +Consider the following scenario: the VMs will in short proximity in time, +for example due to a network event, send many MAD packets to the PF +driver. Lets say there are K VMs, each sending N packets. + +The interrupt from the first VM will start the worker thread, which will +poll N CQEs. A common case here is where the PF driver will multiplex the +packets received from the VMs out on the wire QP. + +But before the wire QP has returned a send CQE and associated interrupt, +the other K - 1 VMs have sent their N packets as well. + +The PF driver has to multiplex K * N packets out on the wire QP. But the +send-queue on the wire QP has a finite capacity. + +So, in this scenario, if K * N is larger than the send-queue capacity of +the wire QP, we will get MAD packets dropped on the floor with this +dynamic debug message: + +mlx4_ib_multiplex_mad: failed sending GSI to wire on behalf of slave 2 (-11) + +and this despite the fact that the wire send-queue could have capacity, +but the PF driver isn't aware, because the wire send CQEs have not yet +been polled. + +We can also have a similar scenario inbound, with a wire recv-queue larger +than the tunnel QP's send-queue. If many remote peers send MAD packets to +the very same VM, the tunnel send-queue destined to the VM could allegedly +be construed to be full by the PF driver. + +This starvation is fixed by introducing separate work queues for the wire +QPs vs. the tunnel QPs. + +With this fix, using a dual ported HCA, 8 VFs instantiated, we could run +cmtime on each of the 18 interfaces towards a similar configured peer, +each cmtime instance with 800 QPs (all in all 14400 QPs) without a single +CM packet getting lost. + +Fixes: 3cf69cc8dbeb ("IB/mlx4: Add CM paravirtualization") +Link: https://lore.kernel.org/r/20200803061941.1139994-5-haakon.bugge@oracle.com +Signed-off-by: HÃ¥kon Bugge +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx4/mad.c | 34 +++++++++++++++++++++++++--- + drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 ++ + 2 files changed, 33 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c +index abe68708d6d6e..2cbdba4da9dfe 100644 +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -1299,6 +1299,18 @@ static void mlx4_ib_tunnel_comp_handler(struct ib_cq *cq, void *arg) + spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags); + } + ++static void mlx4_ib_wire_comp_handler(struct ib_cq *cq, void *arg) ++{ ++ unsigned long flags; ++ struct mlx4_ib_demux_pv_ctx *ctx = cq->cq_context; ++ struct mlx4_ib_dev *dev = to_mdev(ctx->ib_dev); ++ ++ spin_lock_irqsave(&dev->sriov.going_down_lock, flags); ++ if (!dev->sriov.is_going_down && ctx->state == DEMUX_PV_STATE_ACTIVE) ++ queue_work(ctx->wi_wq, &ctx->work); ++ spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags); ++} ++ + static int mlx4_ib_post_pv_qp_buf(struct mlx4_ib_demux_pv_ctx *ctx, + struct mlx4_ib_demux_pv_qp *tun_qp, + int index) +@@ -2001,7 +2013,8 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port, + cq_size *= 2; + + cq_attr.cqe = cq_size; +- ctx->cq = ib_create_cq(ctx->ib_dev, mlx4_ib_tunnel_comp_handler, ++ ctx->cq = ib_create_cq(ctx->ib_dev, ++ create_tun ? mlx4_ib_tunnel_comp_handler : mlx4_ib_wire_comp_handler, + NULL, ctx, &cq_attr); + if (IS_ERR(ctx->cq)) { + ret = PTR_ERR(ctx->cq); +@@ -2038,6 +2051,7 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port, + INIT_WORK(&ctx->work, mlx4_ib_sqp_comp_worker); + + ctx->wq = to_mdev(ibdev)->sriov.demux[port - 1].wq; ++ ctx->wi_wq = to_mdev(ibdev)->sriov.demux[port - 1].wi_wq; + + ret = ib_req_notify_cq(ctx->cq, IB_CQ_NEXT_COMP); + if (ret) { +@@ -2181,7 +2195,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, + goto err_mcg; + } + +- snprintf(name, sizeof name, "mlx4_ibt%d", port); ++ snprintf(name, sizeof(name), "mlx4_ibt%d", port); + ctx->wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); + if (!ctx->wq) { + pr_err("Failed to create tunnelling WQ for port %d\n", port); +@@ -2189,7 +2203,15 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, + goto err_wq; + } + +- snprintf(name, sizeof name, "mlx4_ibud%d", port); ++ snprintf(name, sizeof(name), "mlx4_ibwi%d", port); ++ ctx->wi_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); ++ if (!ctx->wi_wq) { ++ pr_err("Failed to create wire WQ for port %d\n", port); ++ ret = -ENOMEM; ++ goto err_wiwq; ++ } ++ ++ snprintf(name, sizeof(name), "mlx4_ibud%d", port); + ctx->ud_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM); + if (!ctx->ud_wq) { + pr_err("Failed to create up/down WQ for port %d\n", port); +@@ -2200,6 +2222,10 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev, + return 0; + + err_udwq: ++ destroy_workqueue(ctx->wi_wq); ++ ctx->wi_wq = NULL; ++ ++err_wiwq: + destroy_workqueue(ctx->wq); + ctx->wq = NULL; + +@@ -2247,12 +2273,14 @@ static void mlx4_ib_free_demux_ctx(struct mlx4_ib_demux_ctx *ctx) + ctx->tun[i]->state = DEMUX_PV_STATE_DOWNING; + } + flush_workqueue(ctx->wq); ++ flush_workqueue(ctx->wi_wq); + for (i = 0; i < dev->dev->caps.sqp_demux; i++) { + destroy_pv_resources(dev, i, ctx->port, ctx->tun[i], 0); + free_pv_object(dev, i, ctx->port); + } + kfree(ctx->tun); + destroy_workqueue(ctx->ud_wq); ++ destroy_workqueue(ctx->wi_wq); + destroy_workqueue(ctx->wq); + } + } +diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h +index 6f4ea1067095e..5ec3b747c1aea 100644 +--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h ++++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h +@@ -454,6 +454,7 @@ struct mlx4_ib_demux_pv_ctx { + struct ib_pd *pd; + struct work_struct work; + struct workqueue_struct *wq; ++ struct workqueue_struct *wi_wq; + struct mlx4_ib_demux_pv_qp qp[2]; + }; + +@@ -461,6 +462,7 @@ struct mlx4_ib_demux_ctx { + struct ib_device *ib_dev; + int port; + struct workqueue_struct *wq; ++ struct workqueue_struct *wi_wq; + struct workqueue_struct *ud_wq; + spinlock_t ud_lock; + atomic64_t subnet_prefix; +-- +2.25.1 + diff --git a/queue-5.8/ib-rdmavt-fix-sizeof-mismatch.patch b/queue-5.8/ib-rdmavt-fix-sizeof-mismatch.patch new file mode 100644 index 00000000000..a150b0b828a --- /dev/null +++ b/queue-5.8/ib-rdmavt-fix-sizeof-mismatch.patch @@ -0,0 +1,46 @@ +From 1062fa7a658113e928b6cfdf28e3c7d9a1f37def Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 10:52:04 +0100 +Subject: IB/rdmavt: Fix sizeof mismatch + +From: Colin Ian King + +[ Upstream commit 8e71f694e0c819db39af2336f16eb9689f1ae53f ] + +An incorrect sizeof is being used, struct rvt_ibport ** is not correct, it +should be struct rvt_ibport *. Note that since ** is the same size as +* this is not causing any issues. Improve this fix by using +sizeof(*rdi->ports) as this allows us to not even reference the type +of the pointer. Also remove line breaks as the entire statement can +fit on one line. + +Link: https://lore.kernel.org/r/20201008095204.82683-1-colin.king@canonical.com +Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)") +Fixes: ff6acd69518e ("IB/rdmavt: Add device structure allocation") +Signed-off-by: Colin Ian King +Reviewed-by: Ira Weiny +Acked-by: Dennis Dalessandro +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rdmavt/vt.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/infiniband/sw/rdmavt/vt.c b/drivers/infiniband/sw/rdmavt/vt.c +index f904bb34477ae..2d534c450f3c8 100644 +--- a/drivers/infiniband/sw/rdmavt/vt.c ++++ b/drivers/infiniband/sw/rdmavt/vt.c +@@ -95,9 +95,7 @@ struct rvt_dev_info *rvt_alloc_device(size_t size, int nports) + if (!rdi) + return rdi; + +- rdi->ports = kcalloc(nports, +- sizeof(struct rvt_ibport **), +- GFP_KERNEL); ++ rdi->ports = kcalloc(nports, sizeof(*rdi->ports), GFP_KERNEL); + if (!rdi->ports) + ib_dealloc_device(&rdi->ibdev); + +-- +2.25.1 + diff --git a/queue-5.8/ibmvnic-set-up-200gbps-speed.patch b/queue-5.8/ibmvnic-set-up-200gbps-speed.patch new file mode 100644 index 00000000000..d22f9fa39c6 --- /dev/null +++ b/queue-5.8/ibmvnic-set-up-200gbps-speed.patch @@ -0,0 +1,60 @@ +From 52e3c033ee934ba5ba9853a9dcb0867bb432f178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Sep 2020 19:06:25 -0500 +Subject: ibmvnic: set up 200GBPS speed + +From: Lijun Pan + +[ Upstream commit b9cd795b0e4860f482bf3741d12e1c8f3ec1cfc9 ] + +Set up the speed according to crq->query_phys_parms.rsp.speed. +Fix IBMVNIC_10GBPS typo. + +Fixes: f8d6ae0d27ec ("ibmvnic: Report actual backing device speed and duplex values") +Signed-off-by: Lijun Pan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 5 ++++- + drivers/net/ethernet/ibm/ibmvnic.h | 2 +- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 4dd3625a4fbc8..3e0aab04d86fb 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -4610,7 +4610,7 @@ static int handle_query_phys_parms_rsp(union ibmvnic_crq *crq, + case IBMVNIC_1GBPS: + adapter->speed = SPEED_1000; + break; +- case IBMVNIC_10GBP: ++ case IBMVNIC_10GBPS: + adapter->speed = SPEED_10000; + break; + case IBMVNIC_25GBPS: +@@ -4625,6 +4625,9 @@ static int handle_query_phys_parms_rsp(union ibmvnic_crq *crq, + case IBMVNIC_100GBPS: + adapter->speed = SPEED_100000; + break; ++ case IBMVNIC_200GBPS: ++ adapter->speed = SPEED_200000; ++ break; + default: + if (netif_carrier_ok(netdev)) + netdev_warn(netdev, "Unknown speed 0x%08x\n", rspeed); +diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h +index f8416e1d4cf09..43feb96b0a68a 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.h ++++ b/drivers/net/ethernet/ibm/ibmvnic.h +@@ -373,7 +373,7 @@ struct ibmvnic_phys_parms { + #define IBMVNIC_10MBPS 0x40000000 + #define IBMVNIC_100MBPS 0x20000000 + #define IBMVNIC_1GBPS 0x10000000 +-#define IBMVNIC_10GBP 0x08000000 ++#define IBMVNIC_10GBPS 0x08000000 + #define IBMVNIC_40GBPS 0x04000000 + #define IBMVNIC_100GBPS 0x02000000 + #define IBMVNIC_25GBPS 0x01000000 +-- +2.25.1 + diff --git a/queue-5.8/ida-free-allocated-bitmap-in-error-path.patch b/queue-5.8/ida-free-allocated-bitmap-in-error-path.patch new file mode 100644 index 00000000000..df0a9cce5bb --- /dev/null +++ b/queue-5.8/ida-free-allocated-bitmap-in-error-path.patch @@ -0,0 +1,88 @@ +From 54c0954fad7ea5fcc7adebe451d4d6de1d471a7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Apr 2020 14:26:13 -0400 +Subject: ida: Free allocated bitmap in error path + +From: Matthew Wilcox (Oracle) + +[ Upstream commit a219b856a2b993da234108307be772448f22b0ce ] + +If a bitmap needs to be allocated, and then by the time the thread +is scheduled to be run again all the indices which would satisfy the +allocation have been allocated then we would leak the allocation. Almost +impossible to hit in practice, but a trivial fix. Found by Coverity. + +Fixes: f32f004cddf8 ("ida: Convert to XArray") +Reported-by: coverity-bot +Reviewed-by: Kees Cook +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Sasha Levin +--- + lib/idr.c | 1 + + tools/testing/radix-tree/idr-test.c | 29 +++++++++++++++++++++++++++++ + 2 files changed, 30 insertions(+) + +diff --git a/lib/idr.c b/lib/idr.c +index c2cf2c52bbde5..4d2eef0259d2c 100644 +--- a/lib/idr.c ++++ b/lib/idr.c +@@ -470,6 +470,7 @@ int ida_alloc_range(struct ida *ida, unsigned int min, unsigned int max, + goto retry; + nospc: + xas_unlock_irqrestore(&xas, flags); ++ kfree(alloc); + return -ENOSPC; + } + EXPORT_SYMBOL(ida_alloc_range); +diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c +index 8995092d541ec..3b796dd5e5772 100644 +--- a/tools/testing/radix-tree/idr-test.c ++++ b/tools/testing/radix-tree/idr-test.c +@@ -523,8 +523,27 @@ static void *ida_random_fn(void *arg) + return NULL; + } + ++static void *ida_leak_fn(void *arg) ++{ ++ struct ida *ida = arg; ++ time_t s = time(NULL); ++ int i, ret; ++ ++ rcu_register_thread(); ++ ++ do for (i = 0; i < 1000; i++) { ++ ret = ida_alloc_range(ida, 128, 128, GFP_KERNEL); ++ if (ret >= 0) ++ ida_free(ida, 128); ++ } while (time(NULL) < s + 2); ++ ++ rcu_unregister_thread(); ++ return NULL; ++} ++ + void ida_thread_tests(void) + { ++ DEFINE_IDA(ida); + pthread_t threads[20]; + int i; + +@@ -536,6 +555,16 @@ void ida_thread_tests(void) + + while (i--) + pthread_join(threads[i], NULL); ++ ++ for (i = 0; i < ARRAY_SIZE(threads); i++) ++ if (pthread_create(&threads[i], NULL, ida_leak_fn, &ida)) { ++ perror("creating ida thread"); ++ exit(1); ++ } ++ ++ while (i--) ++ pthread_join(threads[i], NULL); ++ assert(ida_is_empty(&ida)); + } + + void ida_tests(void) +-- +2.25.1 + diff --git a/queue-5.8/iio-adc-stm32-adc-fix-runtime-autosuspend-delay-when.patch b/queue-5.8/iio-adc-stm32-adc-fix-runtime-autosuspend-delay-when.patch new file mode 100644 index 00000000000..7bc904c7300 --- /dev/null +++ b/queue-5.8/iio-adc-stm32-adc-fix-runtime-autosuspend-delay-when.patch @@ -0,0 +1,72 @@ +From 9bb69aa41e4b255bc74d0c82cf50d8e8e4edb333 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jul 2020 16:55:28 +0200 +Subject: iio: adc: stm32-adc: fix runtime autosuspend delay when slow polling + +From: Fabrice Gasnier + +[ Upstream commit c537d3457542a398caa1fe58e0976c5f83cf7281 ] + +When the ADC is runtime suspended and starting a conversion, the stm32-adc +driver calls pm_runtime_get_sync() that gets cascaded to the parent +(e.g. runtime resume of stm32-adc-core driver). This also kicks the +autosuspend delay (e.g. 2s) of the parent. +Once the ADC is active, calling pm_runtime_get_sync() again (upon a new +capture) won't kick the autosuspend delay for the parent (stm32-adc-core +driver) as already active. + +Currently, this makes the stm32-adc-core driver go in suspend state +every 2s when doing slow polling. As an example, doing a capture, e.g. +cat in_voltageY_raw at a 0.2s rate, the auto suspend delay for the parent +isn't refreshed. Once it expires, the parent immediately falls into +runtime suspended state, in between two captures, as soon as the child +driver falls into runtime suspend state: +- e.g. after 2s, + child calls pm_runtime_put_autosuspend() + 100ms + autosuspend delay of the child. +- stm32-adc-core switches off regulators, clocks and so on. +- They get switched on back again 100ms later in this example (at 2.2s). + +So, use runtime_idle() callback in stm32-adc-core driver to call +pm_runtime_mark_last_busy() for the parent driver (stm32-adc-core), +to avoid this. + +Fixes: 9bdbb1139ca1 ("iio: adc: stm32-adc: add power management support") +Signed-off-by: Fabrice Gasnier +Reviewed-by: Ulf Hansson +Link: https://lore.kernel.org/r/1593615328-5180-1-git-send-email-fabrice.gasnier@st.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/stm32-adc-core.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/drivers/iio/adc/stm32-adc-core.c b/drivers/iio/adc/stm32-adc-core.c +index 0e2068ec068b8..358636954619d 100644 +--- a/drivers/iio/adc/stm32-adc-core.c ++++ b/drivers/iio/adc/stm32-adc-core.c +@@ -794,6 +794,13 @@ static int stm32_adc_core_runtime_resume(struct device *dev) + { + return stm32_adc_core_hw_start(dev); + } ++ ++static int stm32_adc_core_runtime_idle(struct device *dev) ++{ ++ pm_runtime_mark_last_busy(dev); ++ ++ return 0; ++} + #endif + + static const struct dev_pm_ops stm32_adc_core_pm_ops = { +@@ -801,7 +808,7 @@ static const struct dev_pm_ops stm32_adc_core_pm_ops = { + pm_runtime_force_resume) + SET_RUNTIME_PM_OPS(stm32_adc_core_runtime_suspend, + stm32_adc_core_runtime_resume, +- NULL) ++ stm32_adc_core_runtime_idle) + }; + + static const struct stm32_adc_priv_cfg stm32f4_adc_priv_cfg = { +-- +2.25.1 + diff --git a/queue-5.8/ima-fix-null-pointer-dereference-in-ima_file_hash.patch b/queue-5.8/ima-fix-null-pointer-dereference-in-ima_file_hash.patch new file mode 100644 index 00000000000..b420bcfbdbe --- /dev/null +++ b/queue-5.8/ima-fix-null-pointer-dereference-in-ima_file_hash.patch @@ -0,0 +1,78 @@ +From 1067001512a576a10f14ba5ff9e8ac1cff1a8705 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 18:02:42 +0000 +Subject: ima: Fix NULL pointer dereference in ima_file_hash + +From: KP Singh + +[ Upstream commit aa662fc04f5b290b3979332588bf8d812b189962 ] + +ima_file_hash can be called when there is no iint->ima_hash available +even though the inode exists in the integrity cache. It is fairly +common for a file to not have a hash. (e.g. an mknodat, prior to the +file being closed). + +Another example where this can happen (suggested by Jann Horn): + +Process A does: + + while(1) { + unlink("/tmp/imafoo"); + fd = open("/tmp/imafoo", O_RDWR|O_CREAT|O_TRUNC, 0700); + if (fd == -1) { + perror("open"); + continue; + } + write(fd, "A", 1); + close(fd); + } + +and Process B does: + + while (1) { + int fd = open("/tmp/imafoo", O_RDONLY); + if (fd == -1) + continue; + char *mapping = mmap(NULL, 0x1000, PROT_READ|PROT_EXEC, + MAP_PRIVATE, fd, 0); + if (mapping != MAP_FAILED) + munmap(mapping, 0x1000); + close(fd); + } + +Due to the race to get the iint->mutex between ima_file_hash and +process_measurement iint->ima_hash could still be NULL. + +Fixes: 6beea7afcc72 ("ima: add the ability to query the cached hash of a given file") +Signed-off-by: KP Singh +Reviewed-by: Florent Revest +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/ima/ima_main.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index c1583d98c5e50..0b8f17570f210 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -531,6 +531,16 @@ int ima_file_hash(struct file *file, char *buf, size_t buf_size) + return -EOPNOTSUPP; + + mutex_lock(&iint->mutex); ++ ++ /* ++ * ima_file_hash can be called when ima_collect_measurement has still ++ * not been called, we might not always have a hash. ++ */ ++ if (!iint->ima_hash) { ++ mutex_unlock(&iint->mutex); ++ return -EOPNOTSUPP; ++ } ++ + if (buf) { + size_t copied_size; + +-- +2.25.1 + diff --git a/queue-5.8/input-elants_i2c-fix-typo-for-an-attribute-to-show-c.patch b/queue-5.8/input-elants_i2c-fix-typo-for-an-attribute-to-show-c.patch new file mode 100644 index 00000000000..ec0e4e5d91c --- /dev/null +++ b/queue-5.8/input-elants_i2c-fix-typo-for-an-attribute-to-show-c.patch @@ -0,0 +1,37 @@ +From 50cd8b82ee29a69f6a6d8b264fd89c1f2b935c33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 10:26:57 -0700 +Subject: Input: elants_i2c - fix typo for an attribute to show calibration + count + +From: Johnny Chuang + +[ Upstream commit 93f634069707cfe562c38739f5062feccbe9a834 ] + +Fixed typo for command from 0xE0 to 0xD0. + +Fixes: cf520c643012 ("Input: elants_i2c - provide an attribute to show calibration count") +Signed-off-by: Johnny Chuang +Link: https://lore.kernel.org/r/1600238783-32303-1-git-send-email-johnny.chuang.emc@gmail.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/elants_i2c.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/elants_i2c.c b/drivers/input/touchscreen/elants_i2c.c +index 5477a5718202a..db7f27d4734a9 100644 +--- a/drivers/input/touchscreen/elants_i2c.c ++++ b/drivers/input/touchscreen/elants_i2c.c +@@ -90,7 +90,7 @@ + /* FW read command, 0x53 0x?? 0x0, 0x01 */ + #define E_ELAN_INFO_FW_VER 0x00 + #define E_ELAN_INFO_BC_VER 0x10 +-#define E_ELAN_INFO_REK 0xE0 ++#define E_ELAN_INFO_REK 0xD0 + #define E_ELAN_INFO_TEST_VER 0xE0 + #define E_ELAN_INFO_FW_ID 0xF0 + #define E_INFO_OSR 0xD6 +-- +2.25.1 + diff --git a/queue-5.8/input-ep93xx_keypad-fix-handling-of-platform_get_irq.patch b/queue-5.8/input-ep93xx_keypad-fix-handling-of-platform_get_irq.patch new file mode 100644 index 00000000000..f4eea4a5843 --- /dev/null +++ b/queue-5.8/input-ep93xx_keypad-fix-handling-of-platform_get_irq.patch @@ -0,0 +1,39 @@ +From 43d466e76b1ef8e61510f013a2795d34f05667a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 17:51:05 -0700 +Subject: Input: ep93xx_keypad - fix handling of platform_get_irq() error + +From: Krzysztof Kozlowski + +[ Upstream commit 7d50f6656dacf085a00beeedbc48b19a37d17881 ] + +platform_get_irq() returns -ERRNO on error. In such case comparison +to 0 would pass the check. + +Fixes: 60214f058f44 ("Input: ep93xx_keypad - update driver to new core support") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200828145744.3636-1-krzk@kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/ep93xx_keypad.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/keyboard/ep93xx_keypad.c b/drivers/input/keyboard/ep93xx_keypad.c +index 7c70492d9d6b5..f831f01501d58 100644 +--- a/drivers/input/keyboard/ep93xx_keypad.c ++++ b/drivers/input/keyboard/ep93xx_keypad.c +@@ -250,8 +250,8 @@ static int ep93xx_keypad_probe(struct platform_device *pdev) + } + + keypad->irq = platform_get_irq(pdev, 0); +- if (!keypad->irq) { +- err = -ENXIO; ++ if (keypad->irq < 0) { ++ err = keypad->irq; + goto failed_free; + } + +-- +2.25.1 + diff --git a/queue-5.8/input-imx6ul_tsc-clean-up-some-errors-in-imx6ul_tsc_.patch b/queue-5.8/input-imx6ul_tsc-clean-up-some-errors-in-imx6ul_tsc_.patch new file mode 100644 index 00000000000..45f92a324bd --- /dev/null +++ b/queue-5.8/input-imx6ul_tsc-clean-up-some-errors-in-imx6ul_tsc_.patch @@ -0,0 +1,67 @@ +From e5cec5ec9eaf595f3318b786af806fa252ef7c33 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 10:17:01 -0700 +Subject: Input: imx6ul_tsc - clean up some errors in imx6ul_tsc_resume() + +From: Dan Carpenter + +[ Upstream commit 30df23c5ecdfb8da5b0bc17ceef67eff9e1b0957 ] + +If imx6ul_tsc_init() fails then we need to clean up the clocks. + +I reversed the "if (input_dev->users) {" condition to make the code a +bit simpler. + +Fixes: 6cc527b05847 ("Input: imx6ul_tsc - propagate the errors") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20200905124942.GC183976@mwanda +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/imx6ul_tsc.c | 27 +++++++++++++++----------- + 1 file changed, 16 insertions(+), 11 deletions(-) + +diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c +index 9ed258854349b..5e6ba5c4eca2a 100644 +--- a/drivers/input/touchscreen/imx6ul_tsc.c ++++ b/drivers/input/touchscreen/imx6ul_tsc.c +@@ -530,20 +530,25 @@ static int __maybe_unused imx6ul_tsc_resume(struct device *dev) + + mutex_lock(&input_dev->mutex); + +- if (input_dev->users) { +- retval = clk_prepare_enable(tsc->adc_clk); +- if (retval) +- goto out; +- +- retval = clk_prepare_enable(tsc->tsc_clk); +- if (retval) { +- clk_disable_unprepare(tsc->adc_clk); +- goto out; +- } ++ if (!input_dev->users) ++ goto out; + +- retval = imx6ul_tsc_init(tsc); ++ retval = clk_prepare_enable(tsc->adc_clk); ++ if (retval) ++ goto out; ++ ++ retval = clk_prepare_enable(tsc->tsc_clk); ++ if (retval) { ++ clk_disable_unprepare(tsc->adc_clk); ++ goto out; + } + ++ retval = imx6ul_tsc_init(tsc); ++ if (retval) { ++ clk_disable_unprepare(tsc->tsc_clk); ++ clk_disable_unprepare(tsc->adc_clk); ++ goto out; ++ } + out: + mutex_unlock(&input_dev->mutex); + return retval; +-- +2.25.1 + diff --git a/queue-5.8/input-omap4-keypad-fix-handling-of-platform_get_irq-.patch b/queue-5.8/input-omap4-keypad-fix-handling-of-platform_get_irq-.patch new file mode 100644 index 00000000000..fee14618654 --- /dev/null +++ b/queue-5.8/input-omap4-keypad-fix-handling-of-platform_get_irq-.patch @@ -0,0 +1,41 @@ +From 4c314010d570bb8994b40269dbcd52797bc8b4ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 17:52:15 -0700 +Subject: Input: omap4-keypad - fix handling of platform_get_irq() error + +From: Krzysztof Kozlowski + +[ Upstream commit 4738dd1992fa13acfbbd71800c71c612f466fa44 ] + +platform_get_irq() returns -ERRNO on error. In such case comparison +to 0 would pass the check. + +Fixes: f3a1ba60dbdb ("Input: omap4-keypad - use platform device helpers") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200828145744.3636-2-krzk@kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/omap4-keypad.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c +index 94c94d7f5155f..d6c924032aaa8 100644 +--- a/drivers/input/keyboard/omap4-keypad.c ++++ b/drivers/input/keyboard/omap4-keypad.c +@@ -240,10 +240,8 @@ static int omap4_keypad_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (!irq) { +- dev_err(&pdev->dev, "no keyboard irq assigned\n"); +- return -EINVAL; +- } ++ if (irq < 0) ++ return irq; + + keypad_data = kzalloc(sizeof(struct omap4_keypad), GFP_KERNEL); + if (!keypad_data) { +-- +2.25.1 + diff --git a/queue-5.8/input-stmfts-fix-a-vs-typo.patch b/queue-5.8/input-stmfts-fix-a-vs-typo.patch new file mode 100644 index 00000000000..a2611c0ea29 --- /dev/null +++ b/queue-5.8/input-stmfts-fix-a-vs-typo.patch @@ -0,0 +1,37 @@ +From 8cfeb08dd6b395aca8038043663031c3b7630037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 10:26:09 -0700 +Subject: Input: stmfts - fix a & vs && typo + +From: YueHaibing + +[ Upstream commit d04afe14b23651e7a8bc89727a759e982a8458e4 ] + +In stmfts_sysfs_hover_enable_write(), we should check value and +sdata->hover_enabled is all true. + +Fixes: 78bcac7b2ae1 ("Input: add support for the STMicroelectronics FingerTip touchscreen") +Signed-off-by: YueHaibing +Link: https://lore.kernel.org/r/20200916141941.16684-1-yuehaibing@huawei.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/stmfts.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c +index b54cc64e4ea64..389356332c54a 100644 +--- a/drivers/input/touchscreen/stmfts.c ++++ b/drivers/input/touchscreen/stmfts.c +@@ -479,7 +479,7 @@ static ssize_t stmfts_sysfs_hover_enable_write(struct device *dev, + + mutex_lock(&sdata->mutex); + +- if (value & sdata->hover_enabled) ++ if (value && sdata->hover_enabled) + goto out; + + if (sdata->running) +-- +2.25.1 + diff --git a/queue-5.8/input-sun4i-ps2-fix-handling-of-platform_get_irq-err.patch b/queue-5.8/input-sun4i-ps2-fix-handling-of-platform_get_irq-err.patch new file mode 100644 index 00000000000..788a48f957c --- /dev/null +++ b/queue-5.8/input-sun4i-ps2-fix-handling-of-platform_get_irq-err.patch @@ -0,0 +1,55 @@ +From 56802f6f7b65af148abbf88b3846827cb0e96693 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 17:56:40 -0700 +Subject: Input: sun4i-ps2 - fix handling of platform_get_irq() error + +From: Krzysztof Kozlowski + +[ Upstream commit cafb3abea6136e59ea534004e5773361e196bb94 ] + +platform_get_irq() returns -ERRNO on error. In such case comparison +to 0 would pass the check. + +Fixes: e443631d20f5 ("Input: serio - add support for Alwinner A10/A20 PS/2 controller") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20200828145744.3636-4-krzk@kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/serio/sun4i-ps2.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/input/serio/sun4i-ps2.c b/drivers/input/serio/sun4i-ps2.c +index a681a2c04e399..f15ed3dcdb9b2 100644 +--- a/drivers/input/serio/sun4i-ps2.c ++++ b/drivers/input/serio/sun4i-ps2.c +@@ -211,7 +211,6 @@ static int sun4i_ps2_probe(struct platform_device *pdev) + struct sun4i_ps2data *drvdata; + struct serio *serio; + struct device *dev = &pdev->dev; +- unsigned int irq; + int error; + + drvdata = kzalloc(sizeof(struct sun4i_ps2data), GFP_KERNEL); +@@ -264,14 +263,12 @@ static int sun4i_ps2_probe(struct platform_device *pdev) + writel(0, drvdata->reg_base + PS2_REG_GCTL); + + /* Get IRQ for the device */ +- irq = platform_get_irq(pdev, 0); +- if (!irq) { +- dev_err(dev, "no IRQ found\n"); +- error = -ENXIO; ++ drvdata->irq = platform_get_irq(pdev, 0); ++ if (drvdata->irq < 0) { ++ error = drvdata->irq; + goto err_disable_clk; + } + +- drvdata->irq = irq; + drvdata->serio = serio; + drvdata->dev = dev; + +-- +2.25.1 + diff --git a/queue-5.8/input-twl4030_keypad-fix-handling-of-platform_get_ir.patch b/queue-5.8/input-twl4030_keypad-fix-handling-of-platform_get_ir.patch new file mode 100644 index 00000000000..de7b11324de --- /dev/null +++ b/queue-5.8/input-twl4030_keypad-fix-handling-of-platform_get_ir.patch @@ -0,0 +1,51 @@ +From 04a00dc72c5789eef1fdbaf6378fe9f1a7a33502 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 17:56:19 -0700 +Subject: Input: twl4030_keypad - fix handling of platform_get_irq() error + +From: Krzysztof Kozlowski + +[ Upstream commit c277e1f0dc3c7d7b5b028e20dd414df241642036 ] + +platform_get_irq() returns -ERRNO on error. In such case casting to +unsigned and comparing to 0 would pass the check. + +Fixes: 7abf38d6d13c ("Input: twl4030-keypad - add device tree support") +Reported-by: kernel test robot +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200828145744.3636-3-krzk@kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/twl4030_keypad.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c +index af3a6824f1a4d..77e0743a3cf85 100644 +--- a/drivers/input/keyboard/twl4030_keypad.c ++++ b/drivers/input/keyboard/twl4030_keypad.c +@@ -50,7 +50,7 @@ struct twl4030_keypad { + bool autorepeat; + unsigned int n_rows; + unsigned int n_cols; +- unsigned int irq; ++ int irq; + + struct device *dbg_dev; + struct input_dev *input; +@@ -376,10 +376,8 @@ static int twl4030_kp_probe(struct platform_device *pdev) + } + + kp->irq = platform_get_irq(pdev, 0); +- if (!kp->irq) { +- dev_err(&pdev->dev, "no keyboard irq assigned\n"); +- return -EINVAL; +- } ++ if (kp->irq < 0) ++ return kp->irq; + + error = matrix_keypad_build_keymap(keymap_data, NULL, + TWL4030_MAX_ROWS, +-- +2.25.1 + diff --git a/queue-5.8/iomap-clear-page-error-before-beginning-a-write.patch b/queue-5.8/iomap-clear-page-error-before-beginning-a-write.patch new file mode 100644 index 00000000000..bb136fc35b6 --- /dev/null +++ b/queue-5.8/iomap-clear-page-error-before-beginning-a-write.patch @@ -0,0 +1,51 @@ +From c8ea84afdbbc16efb2e887d837c54b4d6cf967b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 08:26:17 -0700 +Subject: iomap: Clear page error before beginning a write + +From: Matthew Wilcox (Oracle) + +[ Upstream commit e6e7ca92623a43156100306861272e04d46385fc ] + +If we find a page in write_begin which is !Uptodate, we need +to clear any error on the page before starting to read data +into it. This matches how filemap_fault(), do_read_cache_page() +and generic_file_buffered_read() handle PageError on !Uptodate pages. +When calling iomap_set_range_uptodate() in __iomap_write_begin(), blocks +were not being marked as uptodate. + +This was found with generic/127 and a specially modified kernel which +would fail (some) readahead I/Os. The test read some bytes in a prior +page which caused readahead to extend into page 0x34. There was +a subsequent write to page 0x34, followed by a read to page 0x34. +Because the blocks were still marked as !Uptodate, the read caused all +blocks to be re-read, overwriting the write. With this change, and the +next one, the bytes which were written are marked as being Uptodate, so +even though the page is still marked as !Uptodate, the blocks containing +the written data are not re-read from storage. + +Fixes: 9dc55f1389f9 ("iomap: add support for sub-pagesize buffered I/O without buffer heads") +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/iomap/buffered-io.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c +index bcfc288dba3fb..c95454784df48 100644 +--- a/fs/iomap/buffered-io.c ++++ b/fs/iomap/buffered-io.c +@@ -578,6 +578,7 @@ __iomap_write_begin(struct inode *inode, loff_t pos, unsigned len, int flags, + + if (PageUptodate(page)) + return 0; ++ ClearPageError(page); + + do { + iomap_adjust_read_range(inode, iop, &block_start, +-- +2.25.1 + diff --git a/queue-5.8/iomap-fix-warn_on_once-from-unprivileged-users.patch b/queue-5.8/iomap-fix-warn_on_once-from-unprivileged-users.patch new file mode 100644 index 00000000000..a13b90f7e4f --- /dev/null +++ b/queue-5.8/iomap-fix-warn_on_once-from-unprivileged-users.patch @@ -0,0 +1,48 @@ +From f4f11e409c95b954e9e1fcca0e24a1211c73e702 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 08:26:15 -0700 +Subject: iomap: fix WARN_ON_ONCE() from unprivileged users + +From: Qian Cai + +[ Upstream commit a805c111650cdba6ee880f528abdd03c1af82089 ] + +It is trivial to trigger a WARN_ON_ONCE(1) in iomap_dio_actor() by +unprivileged users which would taint the kernel, or worse - panic if +panic_on_warn or panic_on_taint is set. Hence, just convert it to +pr_warn_ratelimited() to let users know their workloads are racing. +Thank Dave Chinner for the initial analysis of the racing reproducers. + +Signed-off-by: Qian Cai +Reviewed-by: Christoph Hellwig +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/iomap/direct-io.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/fs/iomap/direct-io.c b/fs/iomap/direct-io.c +index ec7b78e6fecaf..28d656b15300b 100644 +--- a/fs/iomap/direct-io.c ++++ b/fs/iomap/direct-io.c +@@ -387,6 +387,16 @@ iomap_dio_actor(struct inode *inode, loff_t pos, loff_t length, + return iomap_dio_bio_actor(inode, pos, length, dio, iomap); + case IOMAP_INLINE: + return iomap_dio_inline_actor(inode, pos, length, dio, iomap); ++ case IOMAP_DELALLOC: ++ /* ++ * DIO is not serialised against mmap() access at all, and so ++ * if the page_mkwrite occurs between the writeback and the ++ * iomap_apply() call in the DIO path, then it will see the ++ * DELALLOC block that the page-mkwrite allocated. ++ */ ++ pr_warn_ratelimited("Direct I/O collision with buffered writes! File: %pD4 Comm: %.20s\n", ++ dio->iocb->ki_filp, current->comm); ++ return -EIO; + default: + WARN_ON_ONCE(1); + return -EIO; +-- +2.25.1 + diff --git a/queue-5.8/iomap-mark-read-blocks-uptodate-in-write_begin.patch b/queue-5.8/iomap-mark-read-blocks-uptodate-in-write_begin.patch new file mode 100644 index 00000000000..81e4b981acd --- /dev/null +++ b/queue-5.8/iomap-mark-read-blocks-uptodate-in-write_begin.patch @@ -0,0 +1,62 @@ +From 79148b2349147c038041defc7dd91a153540b1e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 08:26:18 -0700 +Subject: iomap: Mark read blocks uptodate in write_begin + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 14284fedf59f1647264f4603d64418cf1fcd3eb0 ] + +When bringing (portions of) a page uptodate, we were marking blocks that +were zeroed as being uptodate, but not blocks that were read from storage. + +Like the previous commit, this problem was found with generic/127 and +a kernel which failed readahead I/Os. This bug causes writes to be +silently lost when working with flaky storage. + +Fixes: 9dc55f1389f9 ("iomap: add support for sub-pagesize buffered I/O without buffer heads") +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/iomap/buffered-io.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c +index c95454784df48..897ab9a26a74c 100644 +--- a/fs/iomap/buffered-io.c ++++ b/fs/iomap/buffered-io.c +@@ -574,7 +574,6 @@ __iomap_write_begin(struct inode *inode, loff_t pos, unsigned len, int flags, + loff_t block_start = pos & ~(block_size - 1); + loff_t block_end = (pos + len + block_size - 1) & ~(block_size - 1); + unsigned from = offset_in_page(pos), to = from + len, poff, plen; +- int status; + + if (PageUptodate(page)) + return 0; +@@ -595,14 +594,13 @@ __iomap_write_begin(struct inode *inode, loff_t pos, unsigned len, int flags, + if (WARN_ON_ONCE(flags & IOMAP_WRITE_F_UNSHARE)) + return -EIO; + zero_user_segments(page, poff, from, to, poff + plen); +- iomap_set_range_uptodate(page, poff, plen); +- continue; ++ } else { ++ int status = iomap_read_page_sync(block_start, page, ++ poff, plen, srcmap); ++ if (status) ++ return status; + } +- +- status = iomap_read_page_sync(block_start, page, poff, plen, +- srcmap); +- if (status) +- return status; ++ iomap_set_range_uptodate(page, poff, plen); + } while ((block_start += plen) < block_end); + + return 0; +-- +2.25.1 + diff --git a/queue-5.8/iomap-use-kzalloc-to-allocate-iomap_page.patch b/queue-5.8/iomap-use-kzalloc-to-allocate-iomap_page.patch new file mode 100644 index 00000000000..37a578e3ab0 --- /dev/null +++ b/queue-5.8/iomap-use-kzalloc-to-allocate-iomap_page.patch @@ -0,0 +1,49 @@ +From 1edded45b0e903c61568aed2f5e33bb6eb38b1d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 08:58:39 -0700 +Subject: iomap: Use kzalloc to allocate iomap_page + +From: Matthew Wilcox (Oracle) + +[ Upstream commit a6901d4d148dcbad7efb3174afbdf68c995618c2 ] + +We can skip most of the initialisation, although spinlocks still +need explicit initialisation as architectures may use a non-zero +value to indicate unlocked. The comment is no longer useful as +attach_page_private() handles the refcount now. + +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: Christoph Hellwig +Reviewed-by: Dave Chinner +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/iomap/buffered-io.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c +index 897ab9a26a74c..b115e7d47fcec 100644 +--- a/fs/iomap/buffered-io.c ++++ b/fs/iomap/buffered-io.c +@@ -49,16 +49,8 @@ iomap_page_create(struct inode *inode, struct page *page) + if (iop || i_blocksize(inode) == PAGE_SIZE) + return iop; + +- iop = kmalloc(sizeof(*iop), GFP_NOFS | __GFP_NOFAIL); +- atomic_set(&iop->read_count, 0); +- atomic_set(&iop->write_count, 0); ++ iop = kzalloc(sizeof(*iop), GFP_NOFS | __GFP_NOFAIL); + spin_lock_init(&iop->uptodate_lock); +- bitmap_zero(iop->uptodate, PAGE_SIZE / SECTOR_SIZE); +- +- /* +- * migrate_page_move_mapping() assumes that pages with private data have +- * their count elevated by 1. +- */ + attach_page_private(page, iop); + return iop; + } +-- +2.25.1 + diff --git a/queue-5.8/iommu-qcom-add-missing-put_device-call-in-qcom_iommu.patch b/queue-5.8/iommu-qcom-add-missing-put_device-call-in-qcom_iommu.patch new file mode 100644 index 00000000000..e8d7bc3139f --- /dev/null +++ b/queue-5.8/iommu-qcom-add-missing-put_device-call-in-qcom_iommu.patch @@ -0,0 +1,54 @@ +From dfa11c9198f908105183aba78d1c9d3ffd5c9aea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Sep 2020 09:40:37 +0800 +Subject: iommu/qcom: add missing put_device() call in qcom_iommu_of_xlate() + +From: Yu Kuai + +[ Upstream commit e2eae09939a89e0994f7965ba3c676a5eac8b4b0 ] + +if of_find_device_by_node() succeed, qcom_iommu_of_xlate() doesn't have +a corresponding put_device(). Thus add put_device() to fix the exception +handling for this function implementation. + +Fixes: 0ae349a0f33f ("iommu/qcom: Add qcom_iommu") +Acked-by: Rob Clark +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20200929014037.2436663-1-yukuai3@huawei.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/qcom_iommu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/qcom_iommu.c b/drivers/iommu/qcom_iommu.c +index d176df569af8f..78d813bd0dcc8 100644 +--- a/drivers/iommu/qcom_iommu.c ++++ b/drivers/iommu/qcom_iommu.c +@@ -578,8 +578,10 @@ static int qcom_iommu_of_xlate(struct device *dev, struct of_phandle_args *args) + * index into qcom_iommu->ctxs: + */ + if (WARN_ON(asid < 1) || +- WARN_ON(asid > qcom_iommu->num_ctxs)) ++ WARN_ON(asid > qcom_iommu->num_ctxs)) { ++ put_device(&iommu_pdev->dev); + return -EINVAL; ++ } + + if (!dev_iommu_priv_get(dev)) { + dev_iommu_priv_set(dev, qcom_iommu); +@@ -588,8 +590,10 @@ static int qcom_iommu_of_xlate(struct device *dev, struct of_phandle_args *args) + * multiple different iommu devices. Multiple context + * banks are ok, but multiple devices are not: + */ +- if (WARN_ON(qcom_iommu != dev_iommu_priv_get(dev))) ++ if (WARN_ON(qcom_iommu != dev_iommu_priv_get(dev))) { ++ put_device(&iommu_pdev->dev); + return -EINVAL; ++ } + } + + return iommu_fwspec_add_ids(dev, &asid, 1); +-- +2.25.1 + diff --git a/queue-5.8/ip_gre-set-dev-hard_header_len-and-dev-needed_headro.patch b/queue-5.8/ip_gre-set-dev-hard_header_len-and-dev-needed_headro.patch new file mode 100644 index 00000000000..bcef9684dbf --- /dev/null +++ b/queue-5.8/ip_gre-set-dev-hard_header_len-and-dev-needed_headro.patch @@ -0,0 +1,90 @@ +From e8cfd2949489e21c2482173e3201500d7dcb46d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Oct 2020 16:17:21 -0700 +Subject: ip_gre: set dev->hard_header_len and dev->needed_headroom properly + +From: Cong Wang + +[ Upstream commit fdafed459998e2be0e877e6189b24cb7a0183224 ] + +GRE tunnel has its own header_ops, ipgre_header_ops, and sets it +conditionally. When it is set, it assumes the outer IP header is +already created before ipgre_xmit(). + +This is not true when we send packets through a raw packet socket, +where L2 headers are supposed to be constructed by user. Packet +socket calls dev_validate_header() to validate the header. But +GRE tunnel does not set dev->hard_header_len, so that check can +be simply bypassed, therefore uninit memory could be passed down +to ipgre_xmit(). Similar for dev->needed_headroom. + +dev->hard_header_len is supposed to be the length of the header +created by dev->header_ops->create(), so it should be used whenever +header_ops is set, and dev->needed_headroom should be used when it +is not set. + +Reported-and-tested-by: syzbot+4a2c52677a8a1aa283cb@syzkaller.appspotmail.com +Cc: William Tu +Acked-by: Willem de Bruijn +Signed-off-by: Cong Wang +Acked-by: Xie He +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 4e31f23e4117e..e70291748889b 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -625,9 +625,7 @@ static netdev_tx_t ipgre_xmit(struct sk_buff *skb, + } + + if (dev->header_ops) { +- /* Need space for new headers */ +- if (skb_cow_head(skb, dev->needed_headroom - +- (tunnel->hlen + sizeof(struct iphdr)))) ++ if (skb_cow_head(skb, 0)) + goto free_skb; + + tnl_params = (const struct iphdr *)skb->data; +@@ -748,7 +746,11 @@ static void ipgre_link_update(struct net_device *dev, bool set_mtu) + len = tunnel->tun_hlen - len; + tunnel->hlen = tunnel->hlen + len; + +- dev->needed_headroom = dev->needed_headroom + len; ++ if (dev->header_ops) ++ dev->hard_header_len += len; ++ else ++ dev->needed_headroom += len; ++ + if (set_mtu) + dev->mtu = max_t(int, dev->mtu - len, 68); + +@@ -944,6 +946,7 @@ static void __gre_tunnel_init(struct net_device *dev) + tunnel->parms.iph.protocol = IPPROTO_GRE; + + tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen; ++ dev->needed_headroom = tunnel->hlen + sizeof(tunnel->parms.iph); + + dev->features |= GRE_FEATURES; + dev->hw_features |= GRE_FEATURES; +@@ -987,10 +990,14 @@ static int ipgre_tunnel_init(struct net_device *dev) + return -EINVAL; + dev->flags = IFF_BROADCAST; + dev->header_ops = &ipgre_header_ops; ++ dev->hard_header_len = tunnel->hlen + sizeof(*iph); ++ dev->needed_headroom = 0; + } + #endif + } else if (!tunnel->collect_md) { + dev->header_ops = &ipgre_header_ops; ++ dev->hard_header_len = tunnel->hlen + sizeof(*iph); ++ dev->needed_headroom = 0; + } + + return ip_tunnel_init(dev); +-- +2.25.1 + diff --git a/queue-5.8/ipmi_si-fix-wrong-return-value-in-try_smi_init.patch b/queue-5.8/ipmi_si-fix-wrong-return-value-in-try_smi_init.patch new file mode 100644 index 00000000000..1322731edc9 --- /dev/null +++ b/queue-5.8/ipmi_si-fix-wrong-return-value-in-try_smi_init.patch @@ -0,0 +1,38 @@ +From 52c7c413600f46e8a1a3c9427f98c67d83109c30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Oct 2020 22:52:12 +0800 +Subject: ipmi_si: Fix wrong return value in try_smi_init() + +From: Tianjia Zhang + +[ Upstream commit 8fe7990ceda8597e407d06bffc4bdbe835a93ece ] + +On an error exit path, a negative error code should be returned +instead of a positive return value. + +Fixes: 90b2d4f15ff7 ("ipmi_si: Remove hacks for adding a dummy platform devices") +Cc: Corey Minyard +Signed-off-by: Tianjia Zhang +Message-Id: <20201005145212.84435-1-tianjia.zhang@linux.alibaba.com> +Signed-off-by: Corey Minyard +Signed-off-by: Sasha Levin +--- + drivers/char/ipmi/ipmi_si_intf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c +index 77b8d551ae7fe..dd559661c15b3 100644 +--- a/drivers/char/ipmi/ipmi_si_intf.c ++++ b/drivers/char/ipmi/ipmi_si_intf.c +@@ -1963,7 +1963,7 @@ static int try_smi_init(struct smi_info *new_smi) + /* Do this early so it's available for logs. */ + if (!new_smi->io.dev) { + pr_err("IPMI interface added with no device\n"); +- rv = EIO; ++ rv = -EIO; + goto out_err; + } + +-- +2.25.1 + diff --git a/queue-5.8/ipvs-clear-skb-tstamp-in-forwarding-path.patch b/queue-5.8/ipvs-clear-skb-tstamp-in-forwarding-path.patch new file mode 100644 index 00000000000..7b3bc5516eb --- /dev/null +++ b/queue-5.8/ipvs-clear-skb-tstamp-in-forwarding-path.patch @@ -0,0 +1,59 @@ +From dcdde9c18b9c570fdf3e74cf0fb335c4ba0e4dcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 21:24:25 +0300 +Subject: ipvs: clear skb->tstamp in forwarding path + +From: Julian Anastasov + +[ Upstream commit 7980d2eabde82be86c5be18aa3d07e88ec13c6a1 ] + +fq qdisc requires tstamp to be cleared in forwarding path + +Reported-by: Evgeny B +Link: https://bugzilla.kernel.org/show_bug.cgi?id=209427 +Suggested-by: Eric Dumazet +Fixes: 8203e2d844d3 ("net: clear skb->tstamp in forwarding paths") +Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") +Fixes: 80b14dee2bea ("net: Add a new socket option for a future transmit time.") +Signed-off-by: Julian Anastasov +Reviewed-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_xmit.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c +index b00866d777fe0..d2e5a8f644b80 100644 +--- a/net/netfilter/ipvs/ip_vs_xmit.c ++++ b/net/netfilter/ipvs/ip_vs_xmit.c +@@ -609,6 +609,8 @@ static inline int ip_vs_tunnel_xmit_prepare(struct sk_buff *skb, + if (ret == NF_ACCEPT) { + nf_reset_ct(skb); + skb_forward_csum(skb); ++ if (skb->dev) ++ skb->tstamp = 0; + } + return ret; + } +@@ -649,6 +651,8 @@ static inline int ip_vs_nat_send_or_cont(int pf, struct sk_buff *skb, + + if (!local) { + skb_forward_csum(skb); ++ if (skb->dev) ++ skb->tstamp = 0; + NF_HOOK(pf, NF_INET_LOCAL_OUT, cp->ipvs->net, NULL, skb, + NULL, skb_dst(skb)->dev, dst_output); + } else +@@ -669,6 +673,8 @@ static inline int ip_vs_send_or_cont(int pf, struct sk_buff *skb, + if (!local) { + ip_vs_drop_early_demux_sk(skb); + skb_forward_csum(skb); ++ if (skb->dev) ++ skb->tstamp = 0; + NF_HOOK(pf, NF_INET_LOCAL_OUT, cp->ipvs->net, NULL, skb, + NULL, skb_dst(skb)->dev, dst_output); + } else +-- +2.25.1 + diff --git a/queue-5.8/ipvs-fix-uninit-value-in-do_ip_vs_set_ctl.patch b/queue-5.8/ipvs-fix-uninit-value-in-do_ip_vs_set_ctl.patch new file mode 100644 index 00000000000..d76f53ea469 --- /dev/null +++ b/queue-5.8/ipvs-fix-uninit-value-in-do_ip_vs_set_ctl.patch @@ -0,0 +1,52 @@ +From f0e8307cf6d6c3c2296df2ec98cfcbfaabc76968 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 03:46:40 -0400 +Subject: ipvs: Fix uninit-value in do_ip_vs_set_ctl() + +From: Peilin Ye + +[ Upstream commit c5a8a8498eed1c164afc94f50a939c1a10abf8ad ] + +do_ip_vs_set_ctl() is referencing uninitialized stack value when `len` is +zero. Fix it. + +Reported-by: syzbot+23b5f9e7caf61d9a3898@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?id=46ebfb92a8a812621a001ef04d90dfa459520fe2 +Suggested-by: Julian Anastasov +Signed-off-by: Peilin Ye +Acked-by: Julian Anastasov +Reviewed-by: Simon Horman +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/ipvs/ip_vs_ctl.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index 412656c34f205..beeafa42aad76 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -2471,6 +2471,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) + /* Set timeout values for (tcp tcpfin udp) */ + ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg); + goto out_unlock; ++ } else if (!len) { ++ /* No more commands with len == 0 below */ ++ ret = -EINVAL; ++ goto out_unlock; + } + + usvc_compat = (struct ip_vs_service_user *)arg; +@@ -2547,9 +2551,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) + break; + case IP_VS_SO_SET_DELDEST: + ret = ip_vs_del_dest(svc, &udest); +- break; +- default: +- ret = -EINVAL; + } + + out_unlock: +-- +2.25.1 + diff --git a/queue-5.8/iwlwifi-dbg-remove-no-filter-condition.patch b/queue-5.8/iwlwifi-dbg-remove-no-filter-condition.patch new file mode 100644 index 00000000000..6a56d1cdd3d --- /dev/null +++ b/queue-5.8/iwlwifi-dbg-remove-no-filter-condition.patch @@ -0,0 +1,43 @@ +From 18873145b562fe9d8aaca3401bb7d682e2c5e348 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Sep 2020 16:31:19 +0300 +Subject: iwlwifi: dbg: remove no filter condition + +From: Mordechay Goodstein + +[ Upstream commit bfdb157127dab2a85d4096a68a00ad568c9eb590 ] + +Currently if group-id and command-id values are zero we +trigger and collect every RX frame, +this is not the right behavior and zero value +should be handled like any other filter. + +Signed-off-by: Mordechay Goodstein +Fixes: 3ed34fbf9d3b ("iwlwifi: dbg_ini: support FW response/notification region type") +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20200930161256.6a0aae2c0507.I7bd72968279d586af420472707d53106b35efc08@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +index 27116c7d3f4f8..641da49b1b86e 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +@@ -947,9 +947,8 @@ static bool iwl_dbg_tlv_check_fw_pkt(struct iwl_fw_runtime *fwrt, + struct iwl_rx_packet *pkt = tp_data->fw_pkt; + struct iwl_cmd_header *wanted_hdr = (void *)&trig_data; + +- if (pkt && ((wanted_hdr->cmd == 0 && wanted_hdr->group_id == 0) || +- (pkt->hdr.cmd == wanted_hdr->cmd && +- pkt->hdr.group_id == wanted_hdr->group_id))) { ++ if (pkt && (pkt->hdr.cmd == wanted_hdr->cmd && ++ pkt->hdr.group_id == wanted_hdr->group_id)) { + struct iwl_rx_packet *fw_pkt = + kmemdup(pkt, + sizeof(*pkt) + iwl_rx_packet_payload_len(pkt), +-- +2.25.1 + diff --git a/queue-5.8/iwlwifi-dbg-run-init_cfg-function-once-per-driver-lo.patch b/queue-5.8/iwlwifi-dbg-run-init_cfg-function-once-per-driver-lo.patch new file mode 100644 index 00000000000..34ae9019881 --- /dev/null +++ b/queue-5.8/iwlwifi-dbg-run-init_cfg-function-once-per-driver-lo.patch @@ -0,0 +1,40 @@ +From 2fb5913de8e9a709a2e1cc23450312bde4c320f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Sep 2020 16:31:21 +0300 +Subject: iwlwifi: dbg: run init_cfg function once per driver load + +From: Mordechay Goodstein + +[ Upstream commit 42f8a2735cc218b6b372134684d4cd3c1423f123 ] + +Every time we call init_cfg driver appends the enabled triggers +to the active triggers while this should be done only once per +driver load. + +Signed-off-by: Mordechay Goodstein +Fixes: 14124b25780d ("iwlwifi: dbg_ini: implement monitor allocation flow") +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20200930161256.79bd622e604a.Ie0f79d2ea90ca5cdf363f56194ead81b0a2c6202@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +index 641da49b1b86e..48269a4cf8964 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c +@@ -1011,6 +1011,9 @@ static void iwl_dbg_tlv_init_cfg(struct iwl_fw_runtime *fwrt) + enum iwl_fw_ini_buffer_location *ini_dest = &fwrt->trans->dbg.ini_dest; + int ret, i; + ++ if (*ini_dest != IWL_FW_INI_LOCATION_INVALID) ++ return; ++ + IWL_DEBUG_FW(fwrt, + "WRT: Generating active triggers list, domain 0x%x\n", + fwrt->trans->dbg.domains_bitmap); +-- +2.25.1 + diff --git a/queue-5.8/iwlwifi-mvm-split-a-print-to-avoid-a-warning-in-roc.patch b/queue-5.8/iwlwifi-mvm-split-a-print-to-avoid-a-warning-in-roc.patch new file mode 100644 index 00000000000..beb52b8ebb3 --- /dev/null +++ b/queue-5.8/iwlwifi-mvm-split-a-print-to-avoid-a-warning-in-roc.patch @@ -0,0 +1,45 @@ +From 9427426ed29adffc590070e1f8c05a598a68bb7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Sep 2020 10:31:20 +0300 +Subject: iwlwifi: mvm: split a print to avoid a WARNING in ROC + +From: Emmanuel Grumbach + +[ Upstream commit 903b3f9badf1d54f77b468b96706dab679b45b14 ] + +A print in the remain on channel code was too long and caused +a WARNING, split it. + +Signed-off-by: Emmanuel Grumbach +Fixes: dc28e12f2125 ("iwlwifi: mvm: ROC: Extend the ROC max delay duration & limit ROC duration") +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20200930102759.58d57c0bdc68.Ib06008665e7bf1199c360aa92691d9c74fb84990@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index 77916231ff7d3..03b73003b0095 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -3685,9 +3685,12 @@ static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm, + tail->apply_time_max_delay = cpu_to_le32(delay); + + IWL_DEBUG_TE(mvm, +- "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n", +- channel->hw_value, req_dur, duration, delay, +- dtim_interval); ++ "ROC: Requesting to remain on channel %u for %ums\n", ++ channel->hw_value, req_dur); ++ IWL_DEBUG_TE(mvm, ++ "\t(requested = %ums, max_delay = %ums, dtim_interval = %ums)\n", ++ duration, delay, dtim_interval); ++ + /* Set the node address */ + memcpy(tail->node_addr, vif->addr, ETH_ALEN); + +-- +2.25.1 + diff --git a/queue-5.8/kbuild-deb-pkg-do-not-build-linux-headers-package-if.patch b/queue-5.8/kbuild-deb-pkg-do-not-build-linux-headers-package-if.patch new file mode 100644 index 00000000000..84b90564bc3 --- /dev/null +++ b/queue-5.8/kbuild-deb-pkg-do-not-build-linux-headers-package-if.patch @@ -0,0 +1,88 @@ +From 3cdd9e914757aff300c797975ab2f2bef337712b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Oct 2020 03:38:19 +0900 +Subject: kbuild: deb-pkg: do not build linux-headers package if + CONFIG_MODULES=n +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Masahiro Yamada + +[ Upstream commit bac977cbc0d6731fb8e67c2be0e4acbd959e10b3 ] + +Since commit 269a535ca931 ("modpost: generate vmlinux.symvers and +reuse it for the second modpost"), with CONFIG_MODULES disabled, +"make deb-pkg" (or "make bindeb-pkg") fails with: + + find: ‘Module.symvers’: No such file or directory + +If CONFIG_MODULES is disabled, it doesn't really make sense to build +the linux-headers package. + +Fixes: 269a535ca931 ("modpost: generate vmlinux.symvers and reuse it for the second modpost") +Reported-by: Josh Triplett +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/package/builddeb | 6 ++++-- + scripts/package/mkdebian | 19 ++++++++++++------- + 2 files changed, 16 insertions(+), 9 deletions(-) + +diff --git a/scripts/package/builddeb b/scripts/package/builddeb +index 6df3c9f8b2da6..8277144298a00 100755 +--- a/scripts/package/builddeb ++++ b/scripts/package/builddeb +@@ -202,8 +202,10 @@ EOF + done + + if [ "$ARCH" != "um" ]; then +- deploy_kernel_headers debian/linux-headers +- create_package linux-headers-$version debian/linux-headers ++ if is_enabled CONFIG_MODULES; then ++ deploy_kernel_headers debian/linux-headers ++ create_package linux-headers-$version debian/linux-headers ++ fi + + deploy_libc_headers debian/linux-libc-dev + create_package linux-libc-dev debian/linux-libc-dev +diff --git a/scripts/package/mkdebian b/scripts/package/mkdebian +index df1adbfb8ead0..9342517778bf3 100755 +--- a/scripts/package/mkdebian ++++ b/scripts/package/mkdebian +@@ -183,13 +183,6 @@ Description: Linux kernel, version $version + This package contains the Linux kernel, modules and corresponding other + files, version: $version. + +-Package: $kernel_headers_packagename +-Architecture: $debarch +-Description: Linux kernel headers for $version on $debarch +- This package provides kernel header files for $version on $debarch +- . +- This is useful for people who need to build external modules +- + Package: linux-libc-dev + Section: devel + Provides: linux-kernel-headers +@@ -200,6 +193,18 @@ Description: Linux support headers for userspace development + Multi-Arch: same + EOF + ++if is_enabled CONFIG_MODULES; then ++cat <> debian/control ++ ++Package: $kernel_headers_packagename ++Architecture: $debarch ++Description: Linux kernel headers for $version on $debarch ++ This package provides kernel header files for $version on $debarch ++ . ++ This is useful for people who need to build external modules ++EOF ++fi ++ + if is_enabled CONFIG_DEBUG_INFO; then + cat <> debian/control + +-- +2.25.1 + diff --git a/queue-5.8/kdb-fix-pager-search-for-multi-line-strings.patch b/queue-5.8/kdb-fix-pager-search-for-multi-line-strings.patch new file mode 100644 index 00000000000..ceabc5db8ce --- /dev/null +++ b/queue-5.8/kdb-fix-pager-search-for-multi-line-strings.patch @@ -0,0 +1,55 @@ +From f1c68edcbc08ec86e74c0f08252fc46ab105ba8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 15:17:08 +0100 +Subject: kdb: Fix pager search for multi-line strings + +From: Daniel Thompson + +[ Upstream commit d081a6e353168f15e63eb9e9334757f20343319f ] + +Currently using forward search doesn't handle multi-line strings correctly. +The search routine replaces line breaks with \0 during the search and, for +regular searches ("help | grep Common\n"), there is code after the line +has been discarded or printed to replace the break character. + +However during a pager search ("help\n" followed by "/Common\n") when the +string is matched we will immediately return to normal output and the code +that should restore the \n becomes unreachable. Fix this by restoring the +replaced character when we disable the search mode and update the comment +accordingly. + +Fixes: fb6daa7520f9d ("kdb: Provide forward search at more prompt") +Link: https://lore.kernel.org/r/20200909141708.338273-1-daniel.thompson@linaro.org +Reviewed-by: Douglas Anderson +Signed-off-by: Daniel Thompson +Signed-off-by: Sasha Levin +--- + kernel/debug/kdb/kdb_io.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c +index 683a799618ade..bc827bd547c81 100644 +--- a/kernel/debug/kdb/kdb_io.c ++++ b/kernel/debug/kdb/kdb_io.c +@@ -706,12 +706,16 @@ int vkdb_printf(enum kdb_msgsrc src, const char *fmt, va_list ap) + size_avail = sizeof(kdb_buffer) - len; + goto kdb_print_out; + } +- if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) ++ if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) { + /* + * This was a interactive search (using '/' at more +- * prompt) and it has completed. Clear the flag. ++ * prompt) and it has completed. Replace the \0 with ++ * its original value to ensure multi-line strings ++ * are handled properly, and return to normal mode. + */ ++ *cphold = replaced_byte; + kdb_grepping_flag = 0; ++ } + /* + * at this point the string is a full line and + * should be printed, up to the null. +-- +2.25.1 + diff --git a/queue-5.8/kvm-ioapic-break-infinite-recursion-on-lazy-eoi.patch b/queue-5.8/kvm-ioapic-break-infinite-recursion-on-lazy-eoi.patch new file mode 100644 index 00000000000..830513825f4 --- /dev/null +++ b/queue-5.8/kvm-ioapic-break-infinite-recursion-on-lazy-eoi.patch @@ -0,0 +1,72 @@ +From b6ad04bb7354f54f9dcdb904817c17b1261b513f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Oct 2020 04:13:24 -0400 +Subject: KVM: ioapic: break infinite recursion on lazy EOI + +From: Vitaly Kuznetsov + +[ Upstream commit 77377064c3a94911339f13ce113b3abf265e06da ] + +During shutdown the IOAPIC trigger mode is reset to edge triggered +while the vfio-pci INTx is still registered with a resampler. +This allows us to get into an infinite loop: + +ioapic_set_irq + -> ioapic_lazy_update_eoi + -> kvm_ioapic_update_eoi_one + -> kvm_notify_acked_irq + -> kvm_notify_acked_gsi + -> (via irq_acked fn ptr) irqfd_resampler_ack + -> kvm_set_irq + -> (via set fn ptr) kvm_set_ioapic_irq + -> kvm_ioapic_set_irq + -> ioapic_set_irq + +Commit 8be8f932e3db ("kvm: ioapic: Restrict lazy EOI update to +edge-triggered interrupts", 2020-05-04) acknowledges that this recursion +loop exists and tries to avoid it at the call to ioapic_lazy_update_eoi, +but at this point the scenario is already set, we have an edge interrupt +with resampler on the same gsi. + +Fortunately, the only user of irq ack notifiers (in addition to resamplefd) +is i8254 timer interrupt reinjection. These are edge-triggered, so in +principle they would need the call to kvm_ioapic_update_eoi_one from +ioapic_lazy_update_eoi, but they already disable AVIC(*), so they don't +need the lazy EOI behavior. Therefore, remove the call to +kvm_ioapic_update_eoi_one from ioapic_lazy_update_eoi. + +This fixes CVE-2020-27152. Note that this issue cannot happen with +SR-IOV assigned devices because virtual functions do not have INTx, +only MSI. + +Fixes: f458d039db7e ("kvm: ioapic: Lazy update IOAPIC EOI") +Suggested-by: Paolo Bonzini +Tested-by: Alex Williamson +Signed-off-by: Vitaly Kuznetsov +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/ioapic.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c +index d057376bd3d33..698969e18fe35 100644 +--- a/arch/x86/kvm/ioapic.c ++++ b/arch/x86/kvm/ioapic.c +@@ -197,12 +197,9 @@ static void ioapic_lazy_update_eoi(struct kvm_ioapic *ioapic, int irq) + + /* + * If no longer has pending EOI in LAPICs, update +- * EOI for this vetor. ++ * EOI for this vector. + */ + rtc_irq_eoi(ioapic, vcpu, entry->fields.vector); +- kvm_ioapic_update_eoi_one(vcpu, ioapic, +- entry->fields.trig_mode, +- irq); + break; + } + } +-- +2.25.1 + diff --git a/queue-5.8/kvm-x86-emulating-rdpid-failure-shall-return-ud-rath.patch b/queue-5.8/kvm-x86-emulating-rdpid-failure-shall-return-ud-rath.patch new file mode 100644 index 00000000000..b546a8aa94a --- /dev/null +++ b/queue-5.8/kvm-x86-emulating-rdpid-failure-shall-return-ud-rath.patch @@ -0,0 +1,39 @@ +From 8219e2d50e104b00390c8ec182e67fa8153b63ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 10:23:42 +0800 +Subject: KVM: x86: emulating RDPID failure shall return #UD rather than #GP + +From: Robert Hoo + +[ Upstream commit a9e2e0ae686094571378c72d8146b5a1a92d0652 ] + +Per Intel's SDM, RDPID takes a #UD if it is unsupported, which is more or +less what KVM is emulating when MSR_TSC_AUX is not available. In fact, +there are no scenarios in which RDPID is supposed to #GP. + +Fixes: fb6d4d340e ("KVM: x86: emulate RDPID") +Signed-off-by: Robert Hoo +Message-Id: <1598581422-76264-1-git-send-email-robert.hu@linux.intel.com> +Reviewed-by: Jim Mattson +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/emulate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index d0e2825ae6174..571cb8657e53e 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -3594,7 +3594,7 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt) + u64 tsc_aux = 0; + + if (ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux)) +- return emulate_gp(ctxt, 0); ++ return emulate_ud(ctxt); + ctxt->dst.val = tsc_aux; + return X86EMUL_CONTINUE; + } +-- +2.25.1 + diff --git a/queue-5.8/lib-crc32.c-fix-trivial-typo-in-preprocessor-conditi.patch b/queue-5.8/lib-crc32.c-fix-trivial-typo-in-preprocessor-conditi.patch new file mode 100644 index 00000000000..1c2f35d0ea4 --- /dev/null +++ b/queue-5.8/lib-crc32.c-fix-trivial-typo-in-preprocessor-conditi.patch @@ -0,0 +1,45 @@ +From ef83474efdbfcce89169eb5454bd1237d622035c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 20:11:38 -0700 +Subject: lib/crc32.c: fix trivial typo in preprocessor condition + +From: Tobias Jordan + +[ Upstream commit 904542dc56524f921a6bab0639ff6249c01e775f ] + +Whether crc32_be needs a lookup table is chosen based on CRC_LE_BITS. +Obviously, the _be function should be governed by the _BE_ define. + +This probably never pops up as it's hard to come up with a configuration +where CRC_BE_BITS isn't the same as CRC_LE_BITS and as nobody is using +bitwise CRC anyway. + +Fixes: 46c5801eaf86 ("crc32: bolt on crc32c") +Signed-off-by: Tobias Jordan +Signed-off-by: Andrew Morton +Cc: Krzysztof Kozlowski +Cc: Jonathan Corbet +Cc: Mauro Carvalho Chehab +Link: https://lkml.kernel.org/r/20200923182122.GA3338@agrajag.zerfleddert.de +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/crc32.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/crc32.c b/lib/crc32.c +index 4a20455d1f61e..bf60ef26a45c2 100644 +--- a/lib/crc32.c ++++ b/lib/crc32.c +@@ -331,7 +331,7 @@ static inline u32 __pure crc32_be_generic(u32 crc, unsigned char const *p, + return crc; + } + +-#if CRC_LE_BITS == 1 ++#if CRC_BE_BITS == 1 + u32 __pure crc32_be(u32 crc, unsigned char const *p, size_t len) + { + return crc32_be_generic(crc, p, len, NULL, CRC32_POLY_BE); +-- +2.25.1 + diff --git a/queue-5.8/libbpf-close-map-fd-if-init-map-slots-failed.patch b/queue-5.8/libbpf-close-map-fd-if-init-map-slots-failed.patch new file mode 100644 index 00000000000..57c3aa9b285 --- /dev/null +++ b/queue-5.8/libbpf-close-map-fd-if-init-map-slots-failed.patch @@ -0,0 +1,102 @@ +From 87843e88da06fbe6fcf011f0f8a678343ce25087 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Oct 2020 10:13:43 +0800 +Subject: libbpf: Close map fd if init map slots failed + +From: Hangbin Liu + +[ Upstream commit a0f2b7acb4b1d29127ff99c714233b973afd1411 ] + +Previously we forgot to close the map fd if bpf_map_update_elem() +failed during map slot init, which will leak map fd. + +Let's move map slot initialization to new function init_map_slots() to +simplify the code. And close the map fd if init slot failed. + +Reported-by: Andrii Nakryiko +Signed-off-by: Hangbin Liu +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20201006021345.3817033-2-liuhangbin@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 55 ++++++++++++++++++++++++++---------------- + 1 file changed, 34 insertions(+), 21 deletions(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index e4d304247c1ba..3e71c2f69afe8 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -3677,6 +3677,36 @@ static int bpf_object__create_map(struct bpf_object *obj, struct bpf_map *map) + return 0; + } + ++static int init_map_slots(struct bpf_map *map) ++{ ++ const struct bpf_map *targ_map; ++ unsigned int i; ++ int fd, err; ++ ++ for (i = 0; i < map->init_slots_sz; i++) { ++ if (!map->init_slots[i]) ++ continue; ++ ++ targ_map = map->init_slots[i]; ++ fd = bpf_map__fd(targ_map); ++ err = bpf_map_update_elem(map->fd, &i, &fd, 0); ++ if (err) { ++ err = -errno; ++ pr_warn("map '%s': failed to initialize slot [%d] to map '%s' fd=%d: %d\n", ++ map->name, i, targ_map->name, ++ fd, err); ++ return err; ++ } ++ pr_debug("map '%s': slot [%d] set to map '%s' fd=%d\n", ++ map->name, i, targ_map->name, fd); ++ } ++ ++ zfree(&map->init_slots); ++ map->init_slots_sz = 0; ++ ++ return 0; ++} ++ + static int + bpf_object__create_maps(struct bpf_object *obj) + { +@@ -3719,28 +3749,11 @@ bpf_object__create_maps(struct bpf_object *obj) + } + + if (map->init_slots_sz) { +- for (j = 0; j < map->init_slots_sz; j++) { +- const struct bpf_map *targ_map; +- int fd; +- +- if (!map->init_slots[j]) +- continue; +- +- targ_map = map->init_slots[j]; +- fd = bpf_map__fd(targ_map); +- err = bpf_map_update_elem(map->fd, &j, &fd, 0); +- if (err) { +- err = -errno; +- pr_warn("map '%s': failed to initialize slot [%d] to map '%s' fd=%d: %d\n", +- map->name, j, targ_map->name, +- fd, err); +- goto err_out; +- } +- pr_debug("map '%s': slot [%d] set to map '%s' fd=%d\n", +- map->name, j, targ_map->name, fd); ++ err = init_map_slots(map); ++ if (err < 0) { ++ zclose(map->fd); ++ goto err_out; + } +- zfree(&map->init_slots); +- map->init_slots_sz = 0; + } + + if (map->pin_path && !map->pinned) { +-- +2.25.1 + diff --git a/queue-5.8/libbpf-fix-unintentional-success-return-code-in-bpf_.patch b/queue-5.8/libbpf-fix-unintentional-success-return-code-in-bpf_.patch new file mode 100644 index 00000000000..0e39434fe7d --- /dev/null +++ b/queue-5.8/libbpf-fix-unintentional-success-return-code-in-bpf_.patch @@ -0,0 +1,40 @@ +From 04fb98521e899b4eba907023f2454485c39fbd3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 00:55:49 -0700 +Subject: libbpf: Fix unintentional success return code in bpf_object__load + +From: Alex Gartrell + +[ Upstream commit ef05afa66c59c2031a3798916ef3ff3778232129 ] + +There are code paths where EINVAL is returned directly without setting +errno. In that case, errno could be 0, which would mask the +failure. For example, if a careless programmer set log_level to 10000 +out of laziness, they would have to spend a long time trying to figure +out why. + +Fixes: 4f33ddb4e3e2 ("libbpf: Propagate EPERM to caller on program load") +Signed-off-by: Alex Gartrell +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20200826075549.1858580-1-alexgartrell@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 236c91aff48f8..e4d304247c1ba 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -5253,7 +5253,7 @@ load_program(struct bpf_program *prog, struct bpf_insn *insns, int insns_cnt, + free(log_buf); + goto retry_load; + } +- ret = -errno; ++ ret = errno ? -errno : -LIBBPF_ERRNO__LOAD; + cp = libbpf_strerror_r(errno, errmsg, sizeof(errmsg)); + pr_warn("load bpf program failed: %s\n", cp); + pr_perm_msg(ret); +-- +2.25.1 + diff --git a/queue-5.8/lightnvm-fix-out-of-bounds-write-to-array-devices-in.patch b/queue-5.8/lightnvm-fix-out-of-bounds-write-to-array-devices-in.patch new file mode 100644 index 00000000000..c1fab888371 --- /dev/null +++ b/queue-5.8/lightnvm-fix-out-of-bounds-write-to-array-devices-in.patch @@ -0,0 +1,42 @@ +From 50398c78356ea2b7fbc259bdf2a251309bf39da3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Oct 2020 15:33:51 +0100 +Subject: lightnvm: fix out-of-bounds write to array devices->info[] + +From: Colin Ian King + +[ Upstream commit a48faebe65b0db55a73b9220c3d919eee849bb79 ] + +There is an off-by-one array check that can lead to a out-of-bounds +write to devices->info[i]. Fix this by checking by using >= rather +than > for the size check. Also replace hard-coded array size limit +with ARRAY_SIZE on the array. + +Addresses-Coverity: ("Out-of-bounds write") +Fixes: cd9e9808d18f ("lightnvm: Support for Open-Channel SSDs") +Signed-off-by: Colin Ian King +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/lightnvm/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/lightnvm/core.c b/drivers/lightnvm/core.c +index db38a68abb6c0..a6f4ca438bca1 100644 +--- a/drivers/lightnvm/core.c ++++ b/drivers/lightnvm/core.c +@@ -1315,8 +1315,9 @@ static long nvm_ioctl_get_devices(struct file *file, void __user *arg) + strlcpy(info->bmname, "gennvm", sizeof(info->bmname)); + i++; + +- if (i > 31) { +- pr_err("max 31 devices can be reported.\n"); ++ if (i >= ARRAY_SIZE(devices->info)) { ++ pr_err("max %zd devices can be reported.\n", ++ ARRAY_SIZE(devices->info)); + break; + } + } +-- +2.25.1 + diff --git a/queue-5.8/m68knommu-include-sdhc-support-only-when-hardware-ha.patch b/queue-5.8/m68knommu-include-sdhc-support-only-when-hardware-ha.patch new file mode 100644 index 00000000000..867cdc8a70b --- /dev/null +++ b/queue-5.8/m68knommu-include-sdhc-support-only-when-hardware-ha.patch @@ -0,0 +1,79 @@ +From 42a252861e95abc3cd4cc288f85a2b825862b722 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 12:55:20 +1000 +Subject: m68knommu: include SDHC support only when hardware has it +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Greg Ungerer + +[ Upstream commit 322c512f476f07e960cecd447ef22c15bed0e5f1 ] + +The mere fact that the kernel has the MMC subsystem enabled (CONFIG_MMC +enabled) does not mean that the underlying hardware platform has the +SDHC hardware present. Within the ColdFire hardware defines that is +signified by MCFSDHC_BASE being defined with an address. + +The platform data for the ColdFire parts is including the SDHC hardware +if CONFIG_MMC is enabled, instead of MCFSDHC_BASE. This means that if +you are compiling for a ColdFire target that does not support SDHC but +enable CONFIG_MMC you will fail to compile with errors like this: + + arch/m68k/coldfire/device.c:565:12: error: ‘MCFSDHC_BASE’ undeclared here (not in a function) + .start = MCFSDHC_BASE, + ^ + arch/m68k/coldfire/device.c:566:25: error: ‘MCFSDHC_SIZE’ undeclared here (not in a function) + .end = MCFSDHC_BASE + MCFSDHC_SIZE - 1, + ^ + arch/m68k/coldfire/device.c:569:12: error: ‘MCF_IRQ_SDHC’ undeclared here (not in a function) + .start = MCF_IRQ_SDHC, + ^ + +Make the SDHC platform support depend on MCFSDHC_BASE, that is only +include it if the specific ColdFire SoC has that hardware module. + +Fixes: 991f5c4dd2422881 ("m68k: mcf5441x: add support for esdhc mmc controller") +Signed-off-by: Greg Ungerer +Reviewed-by: Geert Uytterhoeven +Reviewed-by: Angelo Dureghello +Tested-by: Angelo Dureghello +Signed-off-by: Sasha Levin +--- + arch/m68k/coldfire/device.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/m68k/coldfire/device.c b/arch/m68k/coldfire/device.c +index 9ef4ec0aea008..59f7dfe50a4d0 100644 +--- a/arch/m68k/coldfire/device.c ++++ b/arch/m68k/coldfire/device.c +@@ -554,7 +554,7 @@ static struct platform_device mcf_edma = { + }; + #endif /* IS_ENABLED(CONFIG_MCF_EDMA) */ + +-#if IS_ENABLED(CONFIG_MMC) ++#ifdef MCFSDHC_BASE + static struct mcf_esdhc_platform_data mcf_esdhc_data = { + .max_bus_width = 4, + .cd_type = ESDHC_CD_NONE, +@@ -579,7 +579,7 @@ static struct platform_device mcf_esdhc = { + .resource = mcf_esdhc_resources, + .dev.platform_data = &mcf_esdhc_data, + }; +-#endif /* IS_ENABLED(CONFIG_MMC) */ ++#endif /* MCFSDHC_BASE */ + + static struct platform_device *mcf_devices[] __initdata = { + &mcf_uart, +@@ -613,7 +613,7 @@ static struct platform_device *mcf_devices[] __initdata = { + #if IS_ENABLED(CONFIG_MCF_EDMA) + &mcf_edma, + #endif +-#if IS_ENABLED(CONFIG_MMC) ++#ifdef MCFSDHC_BASE + &mcf_esdhc, + #endif + }; +-- +2.25.1 + diff --git a/queue-5.8/mac80211-handle-lack-of-sband-bitrates-in-rates.patch b/queue-5.8/mac80211-handle-lack-of-sband-bitrates-in-rates.patch new file mode 100644 index 00000000000..2300bac5f72 --- /dev/null +++ b/queue-5.8/mac80211-handle-lack-of-sband-bitrates-in-rates.patch @@ -0,0 +1,58 @@ +From eea3fb4f8851b9831b5a8aa769a24be803c96620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Oct 2020 09:45:21 -0700 +Subject: mac80211: handle lack of sband->bitrates in rates + +From: Thomas Pedersen + +[ Upstream commit 8b783d104e7f40684333d2ec155fac39219beb2f ] + +Even though a driver or mac80211 shouldn't produce a +legacy bitrate if sband->bitrates doesn't exist, don't +crash if that is the case either. + +This fixes a kernel panic if station dump is run before +last_rate can be updated with a data frame when +sband->bitrates is missing (eg. in S1G bands). + +Signed-off-by: Thomas Pedersen +Link: https://lore.kernel.org/r/20201005164522.18069-1-thomas@adapt-ip.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/cfg.c | 3 ++- + net/mac80211/sta_info.c | 4 ++++ + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 1079a07e43e49..d74cfec685477 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -709,7 +709,8 @@ void sta_set_rate_info_tx(struct sta_info *sta, + u16 brate; + + sband = ieee80211_get_sband(sta->sdata); +- if (sband) { ++ WARN_ON_ONCE(sband && !sband->bitrates); ++ if (sband && sband->bitrates) { + brate = sband->bitrates[rate->idx].bitrate; + rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift); + } +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 05e966f1609e2..b93916c382cdb 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -2122,6 +2122,10 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u32 rate, + int rate_idx = STA_STATS_GET(LEGACY_IDX, rate); + + sband = local->hw.wiphy->bands[band]; ++ ++ if (WARN_ON_ONCE(!sband->bitrates)) ++ break; ++ + brate = sband->bitrates[rate_idx].bitrate; + if (rinfo->bw == RATE_INFO_BW_5) + shift = 2; +-- +2.25.1 + diff --git a/queue-5.8/maiblox-mediatek-fix-handling-of-platform_get_irq-er.patch b/queue-5.8/maiblox-mediatek-fix-handling-of-platform_get_irq-er.patch new file mode 100644 index 00000000000..a929af3971d --- /dev/null +++ b/queue-5.8/maiblox-mediatek-fix-handling-of-platform_get_irq-er.patch @@ -0,0 +1,49 @@ +From 7fbc3ac3e38965f246a16bfe429643bf68b06dd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 09:31:28 +0200 +Subject: maiblox: mediatek: Fix handling of platform_get_irq() error + +From: Krzysztof Kozlowski + +[ Upstream commit 558e4c36ec9f2722af4fe8ef84dc812bcdb5c43a ] + +platform_get_irq() returns -ERRNO on error. In such case casting to u32 +and comparing to 0 would pass the check. + +Fixes: 623a6143a845 ("mailbox: mediatek: Add Mediatek CMDQ driver") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mtk-cmdq-mailbox.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c +index b24822ad8409c..9963bb9cd74fa 100644 +--- a/drivers/mailbox/mtk-cmdq-mailbox.c ++++ b/drivers/mailbox/mtk-cmdq-mailbox.c +@@ -69,7 +69,7 @@ struct cmdq_task { + struct cmdq { + struct mbox_controller mbox; + void __iomem *base; +- u32 irq; ++ int irq; + u32 thread_nr; + u32 irq_mask; + struct cmdq_thread *thread; +@@ -466,10 +466,8 @@ static int cmdq_probe(struct platform_device *pdev) + } + + cmdq->irq = platform_get_irq(pdev, 0); +- if (!cmdq->irq) { +- dev_err(dev, "failed to get irq\n"); +- return -EINVAL; +- } ++ if (cmdq->irq < 0) ++ return cmdq->irq; + + cmdq->thread_nr = (u32)(unsigned long)of_device_get_match_data(dev); + cmdq->irq_mask = GENMASK(cmdq->thread_nr - 1, 0); +-- +2.25.1 + diff --git a/queue-5.8/mailbox-avoid-timer-start-from-callback.patch b/queue-5.8/mailbox-avoid-timer-start-from-callback.patch new file mode 100644 index 00000000000..491c48c0f2c --- /dev/null +++ b/queue-5.8/mailbox-avoid-timer-start-from-callback.patch @@ -0,0 +1,75 @@ +From f1c1b4dd6e3c1bacb7112fded8e2a3627832e7df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Oct 2020 12:20:56 -0500 +Subject: mailbox: avoid timer start from callback + +From: Jassi Brar + +[ Upstream commit c7dacf5b0f32957b24ef29df1207dc2cd8307743 ] + +If the txdone is done by polling, it is possible for msg_submit() to start +the timer while txdone_hrtimer() callback is running. If the timer needs +recheduling, it could already be enqueued by the time hrtimer_forward_now() +is called, leading hrtimer to loudly complain. + +WARNING: CPU: 3 PID: 74 at kernel/time/hrtimer.c:932 hrtimer_forward+0xc4/0x110 +CPU: 3 PID: 74 Comm: kworker/u8:1 Not tainted 5.9.0-rc2-00236-gd3520067d01c-dirty #5 +Hardware name: Libre Computer AML-S805X-AC (DT) +Workqueue: events_freezable_power_ thermal_zone_device_check +pstate: 20000085 (nzCv daIf -PAN -UAO BTYPE=--) +pc : hrtimer_forward+0xc4/0x110 +lr : txdone_hrtimer+0xf8/0x118 +[...] + +This can be fixed by not starting the timer from the callback path. Which +requires the timer reloading as long as any message is queued on the +channel, and not just when current tx is not done yet. + +Fixes: 0cc67945ea59 ("mailbox: switch to hrtimer for tx_complete polling") +Reported-by: Da Xue +Reviewed-by: Sudeep Holla +Tested-by: Sudeep Holla +Acked-by: Jerome Brunet +Tested-by: Jerome Brunet +Signed-off-by: Jassi Brar +Signed-off-by: Sasha Levin +--- + drivers/mailbox/mailbox.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c +index 0b821a5b2db84..3e7d4b20ab34f 100644 +--- a/drivers/mailbox/mailbox.c ++++ b/drivers/mailbox/mailbox.c +@@ -82,9 +82,12 @@ static void msg_submit(struct mbox_chan *chan) + exit: + spin_unlock_irqrestore(&chan->lock, flags); + +- if (!err && (chan->txdone_method & TXDONE_BY_POLL)) +- /* kick start the timer immediately to avoid delays */ +- hrtimer_start(&chan->mbox->poll_hrt, 0, HRTIMER_MODE_REL); ++ /* kick start the timer immediately to avoid delays */ ++ if (!err && (chan->txdone_method & TXDONE_BY_POLL)) { ++ /* but only if not already active */ ++ if (!hrtimer_active(&chan->mbox->poll_hrt)) ++ hrtimer_start(&chan->mbox->poll_hrt, 0, HRTIMER_MODE_REL); ++ } + } + + static void tx_tick(struct mbox_chan *chan, int r) +@@ -122,11 +125,10 @@ static enum hrtimer_restart txdone_hrtimer(struct hrtimer *hrtimer) + struct mbox_chan *chan = &mbox->chans[i]; + + if (chan->active_req && chan->cl) { ++ resched = true; + txdone = chan->mbox->ops->last_tx_done(chan); + if (txdone) + tx_tick(chan, 0); +- else +- resched = true; + } + } + +-- +2.25.1 + diff --git a/queue-5.8/md-bitmap-fix-memory-leak-of-temporary-bitmap.patch b/queue-5.8/md-bitmap-fix-memory-leak-of-temporary-bitmap.patch new file mode 100644 index 00000000000..7db3d2910f0 --- /dev/null +++ b/queue-5.8/md-bitmap-fix-memory-leak-of-temporary-bitmap.patch @@ -0,0 +1,60 @@ +From 4bd2e67aec6596e210a68c5ffd697b75b38275a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Sep 2020 13:40:13 +0800 +Subject: md/bitmap: fix memory leak of temporary bitmap + +From: Zhao Heming + +[ Upstream commit 1383b347a8ae4a69c04ae3746e6cb5c8d38e2585 ] + +Callers of get_bitmap_from_slot() are responsible to free the bitmap. + +Suggested-by: Guoqing Jiang +Signed-off-by: Zhao Heming +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md-bitmap.c | 3 ++- + drivers/md/md-cluster.c | 1 + + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 95a5f3757fa30..19b2601be3c5e 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -1949,6 +1949,7 @@ int md_bitmap_load(struct mddev *mddev) + } + EXPORT_SYMBOL_GPL(md_bitmap_load); + ++/* caller need to free returned bitmap with md_bitmap_free() */ + struct bitmap *get_bitmap_from_slot(struct mddev *mddev, int slot) + { + int rv = 0; +@@ -2012,6 +2013,7 @@ int md_bitmap_copy_from_slot(struct mddev *mddev, int slot, + md_bitmap_unplug(mddev->bitmap); + *low = lo; + *high = hi; ++ md_bitmap_free(bitmap); + + return rv; + } +@@ -2615,4 +2617,3 @@ struct attribute_group md_bitmap_group = { + .name = "bitmap", + .attrs = md_bitmap_attrs, + }; +- +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index d50737ec40394..afbbc552c3275 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -1166,6 +1166,7 @@ static int resize_bitmaps(struct mddev *mddev, sector_t newsize, sector_t oldsiz + * can't resize bitmap + */ + goto out; ++ md_bitmap_free(bitmap); + } + + return 0; +-- +2.25.1 + diff --git a/queue-5.8/media-ati_remote-sanity-check-for-both-endpoints.patch b/queue-5.8/media-ati_remote-sanity-check-for-both-endpoints.patch new file mode 100644 index 00000000000..7f0acec8a63 --- /dev/null +++ b/queue-5.8/media-ati_remote-sanity-check-for-both-endpoints.patch @@ -0,0 +1,40 @@ +From aabf41e4f9068b3265c64dc3159290f1f14799f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 15:50:51 +0200 +Subject: media: ati_remote: sanity check for both endpoints + +From: Oliver Neukum + +[ Upstream commit a8be80053ea74bd9c3f9a3810e93b802236d6498 ] + +If you do sanity checks, you should do them for both endpoints. +Hence introduce checking for endpoint type for the output +endpoint, too. + +Reported-by: syzbot+998261c2ae5932458f6c@syzkaller.appspotmail.com +Signed-off-by: Oliver Neukum +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/ati_remote.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c +index 9cdef17b4793f..c12dda73cdd53 100644 +--- a/drivers/media/rc/ati_remote.c ++++ b/drivers/media/rc/ati_remote.c +@@ -835,6 +835,10 @@ static int ati_remote_probe(struct usb_interface *interface, + err("%s: endpoint_in message size==0? \n", __func__); + return -ENODEV; + } ++ if (!usb_endpoint_is_int_out(endpoint_out)) { ++ err("%s: Unexpected endpoint_out\n", __func__); ++ return -ENODEV; ++ } + + ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL); + rc_dev = rc_allocate_device(RC_DRIVER_SCANCODE); +-- +2.25.1 + diff --git a/queue-5.8/media-atomisp-fix-memleak-in-ia_css_stream_create.patch b/queue-5.8/media-atomisp-fix-memleak-in-ia_css_stream_create.patch new file mode 100644 index 00000000000..d2973e16cc4 --- /dev/null +++ b/queue-5.8/media-atomisp-fix-memleak-in-ia_css_stream_create.patch @@ -0,0 +1,37 @@ +From 77c099953929dc3eec9cc43e42c08827bd5bef43 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 07:49:16 +0200 +Subject: media: atomisp: fix memleak in ia_css_stream_create + +From: Dinghao Liu + +[ Upstream commit c1bca5b5ced0cbd779d56f60cdbc9f5e6f6449fe ] + +When aspect_ratio_crop_init() fails, curr_stream needs +to be freed just like what we've done in the following +error paths. However, current code is returning directly +and ends up leaking memory. + +Signed-off-by: Dinghao Liu +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/sh_css.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/atomisp/pci/sh_css.c b/drivers/staging/media/atomisp/pci/sh_css.c +index 54434c2dbaf90..8473e14370747 100644 +--- a/drivers/staging/media/atomisp/pci/sh_css.c ++++ b/drivers/staging/media/atomisp/pci/sh_css.c +@@ -9521,7 +9521,7 @@ ia_css_stream_create(const struct ia_css_stream_config *stream_config, + if (err) + { + IA_CSS_LEAVE_ERR(err); +- return err; ++ goto ERR; + } + #endif + for (i = 0; i < num_pipes; i++) +-- +2.25.1 + diff --git a/queue-5.8/media-bdisp-fix-runtime-pm-imbalance-on-error.patch b/queue-5.8/media-bdisp-fix-runtime-pm-imbalance-on-error.patch new file mode 100644 index 00000000000..79b8d8a55f4 --- /dev/null +++ b/queue-5.8/media-bdisp-fix-runtime-pm-imbalance-on-error.patch @@ -0,0 +1,46 @@ +From 89223544e80564bcd22e9627c5f3eef7b16e8672 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 May 2020 12:00:21 +0200 +Subject: media: bdisp: Fix runtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit dbd2f2dc025f9be8ae063e4f270099677238f620 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus a pairing decrement is needed on +the error handling path to keep the counter balanced. + +Signed-off-by: Dinghao Liu +Reviewed-by: Fabien Dessenne +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/bdisp/bdisp-v4l2.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +index af2d5eb782cee..e1d150584bdc2 100644 +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c +@@ -1371,7 +1371,7 @@ static int bdisp_probe(struct platform_device *pdev) + ret = pm_runtime_get_sync(dev); + if (ret < 0) { + dev_err(dev, "failed to set PM\n"); +- goto err_dbg; ++ goto err_pm; + } + + /* Filters */ +@@ -1399,7 +1399,6 @@ static int bdisp_probe(struct platform_device *pdev) + bdisp_hw_free_filters(bdisp->dev); + err_pm: + pm_runtime_put(dev); +-err_dbg: + bdisp_debugfs_remove(bdisp); + err_v4l2: + v4l2_device_unregister(&bdisp->v4l2_dev); +-- +2.25.1 + diff --git a/queue-5.8/media-camss-fix-a-reference-count-leak.patch b/queue-5.8/media-camss-fix-a-reference-count-leak.patch new file mode 100644 index 00000000000..dec7745d63d --- /dev/null +++ b/queue-5.8/media-camss-fix-a-reference-count-leak.patch @@ -0,0 +1,42 @@ +From c021b3c68df0dfe377d27925f1b01112fd73d82e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 01:27:12 +0200 +Subject: media: camss: Fix a reference count leak. + +From: Qiushi Wu + +[ Upstream commit d0675b67b42eb4f1a840d1513b5b00f78312f833 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code, causing incorrect ref count if +PM runtime put is not called in error handling paths. +Thus call pm_runtime_put_sync() if pm_runtime_get_sync() fails. + +Fixes: 02afa816dbbf ("media: camss: Add basic runtime PM support") +Signed-off-by: Qiushi Wu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/camss/camss-csiphy.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/camss/camss-csiphy.c b/drivers/media/platform/qcom/camss/camss-csiphy.c +index 008afb85023be..3c5b9082ad723 100644 +--- a/drivers/media/platform/qcom/camss/camss-csiphy.c ++++ b/drivers/media/platform/qcom/camss/camss-csiphy.c +@@ -176,8 +176,10 @@ static int csiphy_set_power(struct v4l2_subdev *sd, int on) + int ret; + + ret = pm_runtime_get_sync(dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_sync(dev); + return ret; ++ } + + ret = csiphy_set_clock_rates(csiphy); + if (ret < 0) { +-- +2.25.1 + diff --git a/queue-5.8/media-exynos4-is-fix-a-reference-count-leak-due-to-p.patch b/queue-5.8/media-exynos4-is-fix-a-reference-count-leak-due-to-p.patch new file mode 100644 index 00000000000..58dcfe4c807 --- /dev/null +++ b/queue-5.8/media-exynos4-is-fix-a-reference-count-leak-due-to-p.patch @@ -0,0 +1,41 @@ +From aef38cefd6cbfee0c7268454808a166c844c27cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 05:10:58 +0200 +Subject: media: exynos4-is: Fix a reference count leak due to + pm_runtime_get_sync + +From: Qiushi Wu + +[ Upstream commit c47f7c779ef0458a58583f00c9ed71b7f5a4d0a2 ] + +On calling pm_runtime_get_sync() the reference count of the device +is incremented. In case of failure, decrement the +reference count before returning the error. + +Signed-off-by: Qiushi Wu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/media-dev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c +index 2f90607c3797d..a07d796f63df0 100644 +--- a/drivers/media/platform/exynos4-is/media-dev.c ++++ b/drivers/media/platform/exynos4-is/media-dev.c +@@ -484,8 +484,10 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd) + return -ENXIO; + + ret = pm_runtime_get_sync(fmd->pmf); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put(fmd->pmf); + return ret; ++ } + + fmd->num_sensors = 0; + +-- +2.25.1 + diff --git a/queue-5.8/media-exynos4-is-fix-a-reference-count-leak.patch b/queue-5.8/media-exynos4-is-fix-a-reference-count-leak.patch new file mode 100644 index 00000000000..371e084eb0f --- /dev/null +++ b/queue-5.8/media-exynos4-is-fix-a-reference-count-leak.patch @@ -0,0 +1,41 @@ +From dcb8a9045490f32abb028d58b78e735c3020c323 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 05:01:11 +0200 +Subject: media: exynos4-is: Fix a reference count leak + +From: Qiushi Wu + +[ Upstream commit 64157b2cb1940449e7df2670e85781c690266588 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code, causing incorrect ref count if +pm_runtime_put_noidle() is not called in error handling paths. +Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails. + +Signed-off-by: Qiushi Wu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/mipi-csis.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c +index 540151bbf58f2..1aac167abb175 100644 +--- a/drivers/media/platform/exynos4-is/mipi-csis.c ++++ b/drivers/media/platform/exynos4-is/mipi-csis.c +@@ -510,8 +510,10 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int enable) + if (enable) { + s5pcsis_clear_counters(state); + ret = pm_runtime_get_sync(&state->pdev->dev); +- if (ret && ret != 1) ++ if (ret && ret != 1) { ++ pm_runtime_put_noidle(&state->pdev->dev); + return ret; ++ } + } + + mutex_lock(&state->lock); +-- +2.25.1 + diff --git a/queue-5.8/media-exynos4-is-fix-several-reference-count-leaks-d.patch b/queue-5.8/media-exynos4-is-fix-several-reference-count-leaks-d.patch new file mode 100644 index 00000000000..a26dabb008c --- /dev/null +++ b/queue-5.8/media-exynos4-is-fix-several-reference-count-leaks-d.patch @@ -0,0 +1,55 @@ +From 5197abde47ae4206d754f8db6932afd79b09933d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 05:18:29 +0200 +Subject: media: exynos4-is: Fix several reference count leaks due to + pm_runtime_get_sync + +From: Qiushi Wu + +[ Upstream commit 7ef64ceea0008c17e94a8a2c60c5d6d46f481996 ] + +On calling pm_runtime_get_sync() the reference count of the device +is incremented. In case of failure, decrement the +reference count before returning the error. + +Signed-off-by: Qiushi Wu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/fimc-isp.c | 4 +++- + drivers/media/platform/exynos4-is/fimc-lite.c | 2 +- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c +index cde0d254ec1c4..a77c49b185115 100644 +--- a/drivers/media/platform/exynos4-is/fimc-isp.c ++++ b/drivers/media/platform/exynos4-is/fimc-isp.c +@@ -305,8 +305,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, int on) + + if (on) { + ret = pm_runtime_get_sync(&is->pdev->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put(&is->pdev->dev); + return ret; ++ } + set_bit(IS_ST_PWR_ON, &is->state); + + ret = fimc_is_start_firmware(is); +diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c +index 394e0818f2d5c..92130d7791378 100644 +--- a/drivers/media/platform/exynos4-is/fimc-lite.c ++++ b/drivers/media/platform/exynos4-is/fimc-lite.c +@@ -470,7 +470,7 @@ static int fimc_lite_open(struct file *file) + set_bit(ST_FLITE_IN_USE, &fimc->state); + ret = pm_runtime_get_sync(&fimc->pdev->dev); + if (ret < 0) +- goto unlock; ++ goto err_pm; + + ret = v4l2_fh_open(file); + if (ret < 0) +-- +2.25.1 + diff --git a/queue-5.8/media-firewire-fix-memory-leak.patch b/queue-5.8/media-firewire-fix-memory-leak.patch new file mode 100644 index 00000000000..8a2b21d189e --- /dev/null +++ b/queue-5.8/media-firewire-fix-memory-leak.patch @@ -0,0 +1,39 @@ +From db0ca34356c45c20e0379eb325c14d99109b6504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Sep 2020 11:01:37 +0200 +Subject: media: firewire: fix memory leak + +From: Pavel Machek + +[ Upstream commit b28e32798c78a346788d412f1958f36bb760ec03 ] + +Fix memory leak in node_probe. + +Signed-off-by: Pavel Machek (CIP) +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/firewire/firedtv-fw.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c +index 3f1ca40b9b987..8a8585261bb80 100644 +--- a/drivers/media/firewire/firedtv-fw.c ++++ b/drivers/media/firewire/firedtv-fw.c +@@ -272,8 +272,10 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id) + + name_len = fw_csr_string(unit->directory, CSR_MODEL, + name, sizeof(name)); +- if (name_len < 0) +- return name_len; ++ if (name_len < 0) { ++ err = name_len; ++ goto fail_free; ++ } + for (i = ARRAY_SIZE(model_names); --i; ) + if (strlen(model_names[i]) <= name_len && + strncmp(name, model_names[i], name_len) == 0) +-- +2.25.1 + diff --git a/queue-5.8/media-hantro-h264-get-the-correct-fallback-reference.patch b/queue-5.8/media-hantro-h264-get-the-correct-fallback-reference.patch new file mode 100644 index 00000000000..2aad3edbd54 --- /dev/null +++ b/queue-5.8/media-hantro-h264-get-the-correct-fallback-reference.patch @@ -0,0 +1,44 @@ +From e06719878f3ed803d9280059241a3164349000f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jul 2020 19:05:37 +0200 +Subject: media: hantro: h264: Get the correct fallback reference buffer + +From: Ezequiel Garcia + +[ Upstream commit 6d9e8cd0553bb03e8ab9d4d2d7d17f3fb639bd86 ] + +If the bitstream and the application are incorrectly configuring +the reference pictures, the hardware will need to fallback +to using some other reference picture. + +When the post-processor is enabled, the fallback buffer +should be a shadow buffer (postproc.dec_q), and not a +CAPTURE queue buffer, since the latter is post-processed +and not really the output of the decoder core. + +Fixes: 8c2d66b036c77 ("media: hantro: Support color conversion via post-processing") +Signed-off-by: Ezequiel Garcia +Reviewed-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/hantro/hantro_h264.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/hantro/hantro_h264.c b/drivers/staging/media/hantro/hantro_h264.c +index d561f125085a7..d72ebbd17a692 100644 +--- a/drivers/staging/media/hantro/hantro_h264.c ++++ b/drivers/staging/media/hantro/hantro_h264.c +@@ -327,7 +327,7 @@ dma_addr_t hantro_h264_get_ref_buf(struct hantro_ctx *ctx, + */ + dst_buf = hantro_get_dst_buf(ctx); + buf = &dst_buf->vb2_buf; +- dma_addr = vb2_dma_contig_plane_dma_addr(buf, 0); ++ dma_addr = hantro_get_dec_buf_addr(ctx, buf); + } + + return dma_addr; +-- +2.25.1 + diff --git a/queue-5.8/media-hantro-postproc-fix-motion-vector-space-alloca.patch b/queue-5.8/media-hantro-postproc-fix-motion-vector-space-alloca.patch new file mode 100644 index 00000000000..4c8bcccb570 --- /dev/null +++ b/queue-5.8/media-hantro-postproc-fix-motion-vector-space-alloca.patch @@ -0,0 +1,47 @@ +From 89a0fc78a68ae41bfbfe6a54d422b67a6efbd30d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jul 2020 19:05:38 +0200 +Subject: media: hantro: postproc: Fix motion vector space allocation + +From: Ezequiel Garcia + +[ Upstream commit 669ccf19ed2059b9d517664a2dbbf6bde87e1414 ] + +When the post-processor is enabled, the driver allocates +"shadow buffers" which are used for the decoder core, +and exposes the post-processed buffers to userspace. + +For this reason, extra motion vector space has to +be allocated on the shadow buffers, which the driver +wasn't doing. Fix it. + +This fix should address artifacts on high profile bitstreams. + +Fixes: 8c2d66b036c77 ("media: hantro: Support color conversion via post-processing") +Signed-off-by: Ezequiel Garcia +Reviewed-by: Philipp Zabel +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/hantro/hantro_postproc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/hantro/hantro_postproc.c b/drivers/staging/media/hantro/hantro_postproc.c +index 44062ffceaea7..6d2a8f2a8f0bb 100644 +--- a/drivers/staging/media/hantro/hantro_postproc.c ++++ b/drivers/staging/media/hantro/hantro_postproc.c +@@ -118,7 +118,9 @@ int hantro_postproc_alloc(struct hantro_ctx *ctx) + unsigned int num_buffers = cap_queue->num_buffers; + unsigned int i, buf_size; + +- buf_size = ctx->dst_fmt.plane_fmt[0].sizeimage; ++ buf_size = ctx->dst_fmt.plane_fmt[0].sizeimage + ++ hantro_h264_mv_size(ctx->dst_fmt.width, ++ ctx->dst_fmt.height); + + for (i = 0; i < num_buffers; ++i) { + struct hantro_aux_buf *priv = &ctx->postproc.dec_q[i]; +-- +2.25.1 + diff --git a/queue-5.8/media-i2c-ov5640-enable-data-pins-on-poweron-for-dvp.patch b/queue-5.8/media-i2c-ov5640-enable-data-pins-on-poweron-for-dvp.patch new file mode 100644 index 00000000000..827329061fc --- /dev/null +++ b/queue-5.8/media-i2c-ov5640-enable-data-pins-on-poweron-for-dvp.patch @@ -0,0 +1,141 @@ +From ab863c8b8c0ce6415c206c59caba9f3a9569d453 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 22:18:32 +0200 +Subject: media: i2c: ov5640: Enable data pins on poweron for DVP mode + +From: Lad Prabhakar + +[ Upstream commit 576f5d4ba8f672953513280510abf9a736b015cc ] + +During testing this sensor on iW-RainboW-G21D-Qseven platform in 8-bit DVP +mode with rcar-vin bridge noticed the capture worked fine for the first run +(with yavta), but for subsequent runs the bridge driver waited for the +frame to be captured. Debugging further noticed the data lines were +enabled/disabled in stream on/off callback and dumping the register +contents 0x3017/0x3018 in ov5640_set_stream_dvp() reported the correct +values, but yet frame capturing failed. + +To get around this issue data lines are enabled in s_power callback. +(Also the sensor remains in power down mode if not streaming so power +consumption shouldn't be affected) + +Fixes: f22996db44e2d ("media: ov5640: add support of DVP parallel interface") +Signed-off-by: Lad Prabhakar +Reviewed-by: Biju Das +Tested-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5640.c | 73 +++++++++++++++++++++----------------- + 1 file changed, 40 insertions(+), 33 deletions(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 90db5443c4248..3a4268aa5f023 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -276,8 +276,7 @@ static inline struct v4l2_subdev *ctrl_to_sd(struct v4l2_ctrl *ctrl) + /* YUV422 UYVY VGA@30fps */ + static const struct reg_value ov5640_init_setting_30fps_VGA[] = { + {0x3103, 0x11, 0, 0}, {0x3008, 0x82, 0, 5}, {0x3008, 0x42, 0, 0}, +- {0x3103, 0x03, 0, 0}, {0x3017, 0x00, 0, 0}, {0x3018, 0x00, 0, 0}, +- {0x3630, 0x36, 0, 0}, ++ {0x3103, 0x03, 0, 0}, {0x3630, 0x36, 0, 0}, + {0x3631, 0x0e, 0, 0}, {0x3632, 0xe2, 0, 0}, {0x3633, 0x12, 0, 0}, + {0x3621, 0xe0, 0, 0}, {0x3704, 0xa0, 0, 0}, {0x3703, 0x5a, 0, 0}, + {0x3715, 0x78, 0, 0}, {0x3717, 0x01, 0, 0}, {0x370b, 0x60, 0, 0}, +@@ -1283,33 +1282,6 @@ static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on) + if (ret) + return ret; + +- /* +- * enable VSYNC/HREF/PCLK DVP control lines +- * & D[9:6] DVP data lines +- * +- * PAD OUTPUT ENABLE 01 +- * - 6: VSYNC output enable +- * - 5: HREF output enable +- * - 4: PCLK output enable +- * - [3:0]: D[9:6] output enable +- */ +- ret = ov5640_write_reg(sensor, +- OV5640_REG_PAD_OUTPUT_ENABLE01, +- on ? 0x7f : 0); +- if (ret) +- return ret; +- +- /* +- * enable D[5:0] DVP data lines +- * +- * PAD OUTPUT ENABLE 02 +- * - [7:2]: D[5:0] output enable +- */ +- ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE02, +- on ? 0xfc : 0); +- if (ret) +- return ret; +- + return ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, on ? + OV5640_REG_SYS_CTRL0_SW_PWUP : + OV5640_REG_SYS_CTRL0_SW_PWDN); +@@ -2069,6 +2041,40 @@ static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on) + return 0; + } + ++static int ov5640_set_power_dvp(struct ov5640_dev *sensor, bool on) ++{ ++ int ret; ++ ++ if (!on) { ++ /* Reset settings to their default values. */ ++ ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE01, 0x00); ++ ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE02, 0x00); ++ return 0; ++ } ++ ++ /* ++ * enable VSYNC/HREF/PCLK DVP control lines ++ * & D[9:6] DVP data lines ++ * ++ * PAD OUTPUT ENABLE 01 ++ * - 6: VSYNC output enable ++ * - 5: HREF output enable ++ * - 4: PCLK output enable ++ * - [3:0]: D[9:6] output enable ++ */ ++ ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE01, 0x7f); ++ if (ret) ++ return ret; ++ ++ /* ++ * enable D[5:0] DVP data lines ++ * ++ * PAD OUTPUT ENABLE 02 ++ * - [7:2]: D[5:0] output enable ++ */ ++ return ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE02, 0xfc); ++} ++ + static int ov5640_set_power(struct ov5640_dev *sensor, bool on) + { + int ret = 0; +@@ -2083,11 +2089,12 @@ static int ov5640_set_power(struct ov5640_dev *sensor, bool on) + goto power_off; + } + +- if (sensor->ep.bus_type == V4L2_MBUS_CSI2_DPHY) { ++ if (sensor->ep.bus_type == V4L2_MBUS_CSI2_DPHY) + ret = ov5640_set_power_mipi(sensor, on); +- if (ret) +- goto power_off; +- } ++ else ++ ret = ov5640_set_power_dvp(sensor, on); ++ if (ret) ++ goto power_off; + + if (!on) + ov5640_set_power_off(sensor); +-- +2.25.1 + diff --git a/queue-5.8/media-i2c-ov5640-remain-in-power-down-for-dvp-mode-u.patch b/queue-5.8/media-i2c-ov5640-remain-in-power-down-for-dvp-mode-u.patch new file mode 100644 index 00000000000..372ab0d58aa --- /dev/null +++ b/queue-5.8/media-i2c-ov5640-remain-in-power-down-for-dvp-mode-u.patch @@ -0,0 +1,70 @@ +From 0c1b90e25f024e18b9d3f9fd8a8edf96260c0c5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 22:18:30 +0200 +Subject: media: i2c: ov5640: Remain in power down for DVP mode unless + streaming + +From: Lad Prabhakar + +[ Upstream commit 3b987d70e903962eb8c5961ba166c345a49d1a0b ] + +Keep the sensor in software power down mode and wake up only in +ov5640_set_stream_dvp() callback. + +Signed-off-by: Lad Prabhakar +Reviewed-by: Biju Das +Tested-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5640.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index ab19e04720d3a..6e558a7e2d244 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -34,6 +34,8 @@ + #define OV5640_REG_SYS_RESET02 0x3002 + #define OV5640_REG_SYS_CLOCK_ENABLE02 0x3006 + #define OV5640_REG_SYS_CTRL0 0x3008 ++#define OV5640_REG_SYS_CTRL0_SW_PWDN 0x42 ++#define OV5640_REG_SYS_CTRL0_SW_PWUP 0x02 + #define OV5640_REG_CHIP_ID 0x300a + #define OV5640_REG_IO_MIPI_CTRL00 0x300e + #define OV5640_REG_PAD_OUTPUT_ENABLE01 0x3017 +@@ -1120,6 +1122,12 @@ static int ov5640_load_regs(struct ov5640_dev *sensor, + val = regs->val; + mask = regs->mask; + ++ /* remain in power down mode for DVP */ ++ if (regs->reg_addr == OV5640_REG_SYS_CTRL0 && ++ val == OV5640_REG_SYS_CTRL0_SW_PWUP && ++ sensor->ep.bus_type != V4L2_MBUS_CSI2_DPHY) ++ continue; ++ + if (mask) + ret = ov5640_mod_reg(sensor, reg_addr, mask, val); + else +@@ -1297,9 +1305,14 @@ static int ov5640_set_stream_dvp(struct ov5640_dev *sensor, bool on) + * PAD OUTPUT ENABLE 02 + * - [7:2]: D[5:0] output enable + */ +- return ov5640_write_reg(sensor, +- OV5640_REG_PAD_OUTPUT_ENABLE02, +- on ? 0xfc : 0); ++ ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT_ENABLE02, ++ on ? 0xfc : 0); ++ if (ret) ++ return ret; ++ ++ return ov5640_write_reg(sensor, OV5640_REG_SYS_CTRL0, on ? ++ OV5640_REG_SYS_CTRL0_SW_PWUP : ++ OV5640_REG_SYS_CTRL0_SW_PWDN); + } + + static int ov5640_set_stream_mipi(struct ov5640_dev *sensor, bool on) +-- +2.25.1 + diff --git a/queue-5.8/media-i2c-ov5640-separate-out-mipi-configuration-fro.patch b/queue-5.8/media-i2c-ov5640-separate-out-mipi-configuration-fro.patch new file mode 100644 index 00000000000..86bb59a3c17 --- /dev/null +++ b/queue-5.8/media-i2c-ov5640-separate-out-mipi-configuration-fro.patch @@ -0,0 +1,164 @@ +From 481c5d7b713d22d5cafc02446b79887711c85e0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 22:18:31 +0200 +Subject: media: i2c: ov5640: Separate out mipi configuration from s_power + +From: Lad Prabhakar + +[ Upstream commit b1751ae652fb95919c08df5bdd739ccf9886158a ] + +In preparation for adding DVP configuration in s_power callback +move mipi configuration into separate function + +Signed-off-by: Lad Prabhakar +Reviewed-by: Biju Das +Tested-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5640.c | 116 +++++++++++++++++++------------------ + 1 file changed, 60 insertions(+), 56 deletions(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 6e558a7e2d244..90db5443c4248 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -2014,6 +2014,61 @@ static void ov5640_set_power_off(struct ov5640_dev *sensor) + clk_disable_unprepare(sensor->xclk); + } + ++static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on) ++{ ++ int ret; ++ ++ if (!on) { ++ /* Reset MIPI bus settings to their default values. */ ++ ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x58); ++ ov5640_write_reg(sensor, OV5640_REG_MIPI_CTRL00, 0x04); ++ ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT00, 0x00); ++ return 0; ++ } ++ ++ /* ++ * Power up MIPI HS Tx and LS Rx; 2 data lanes mode ++ * ++ * 0x300e = 0x40 ++ * [7:5] = 010 : 2 data lanes mode (see FIXME note in ++ * "ov5640_set_stream_mipi()") ++ * [4] = 0 : Power up MIPI HS Tx ++ * [3] = 0 : Power up MIPI LS Rx ++ * [2] = 0 : MIPI interface disabled ++ */ ++ ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x40); ++ if (ret) ++ return ret; ++ ++ /* ++ * Gate clock and set LP11 in 'no packets mode' (idle) ++ * ++ * 0x4800 = 0x24 ++ * [5] = 1 : Gate clock when 'no packets' ++ * [2] = 1 : MIPI bus in LP11 when 'no packets' ++ */ ++ ret = ov5640_write_reg(sensor, OV5640_REG_MIPI_CTRL00, 0x24); ++ if (ret) ++ return ret; ++ ++ /* ++ * Set data lanes and clock in LP11 when 'sleeping' ++ * ++ * 0x3019 = 0x70 ++ * [6] = 1 : MIPI data lane 2 in LP11 when 'sleeping' ++ * [5] = 1 : MIPI data lane 1 in LP11 when 'sleeping' ++ * [4] = 1 : MIPI clock lane in LP11 when 'sleeping' ++ */ ++ ret = ov5640_write_reg(sensor, OV5640_REG_PAD_OUTPUT00, 0x70); ++ if (ret) ++ return ret; ++ ++ /* Give lanes some time to coax into LP11 state. */ ++ usleep_range(500, 1000); ++ ++ return 0; ++} ++ + static int ov5640_set_power(struct ov5640_dev *sensor, bool on) + { + int ret = 0; +@@ -2026,67 +2081,16 @@ static int ov5640_set_power(struct ov5640_dev *sensor, bool on) + ret = ov5640_restore_mode(sensor); + if (ret) + goto power_off; ++ } + +- /* We're done here for DVP bus, while CSI-2 needs setup. */ +- if (sensor->ep.bus_type != V4L2_MBUS_CSI2_DPHY) +- return 0; +- +- /* +- * Power up MIPI HS Tx and LS Rx; 2 data lanes mode +- * +- * 0x300e = 0x40 +- * [7:5] = 010 : 2 data lanes mode (see FIXME note in +- * "ov5640_set_stream_mipi()") +- * [4] = 0 : Power up MIPI HS Tx +- * [3] = 0 : Power up MIPI LS Rx +- * [2] = 0 : MIPI interface disabled +- */ +- ret = ov5640_write_reg(sensor, +- OV5640_REG_IO_MIPI_CTRL00, 0x40); +- if (ret) +- goto power_off; +- +- /* +- * Gate clock and set LP11 in 'no packets mode' (idle) +- * +- * 0x4800 = 0x24 +- * [5] = 1 : Gate clock when 'no packets' +- * [2] = 1 : MIPI bus in LP11 when 'no packets' +- */ +- ret = ov5640_write_reg(sensor, +- OV5640_REG_MIPI_CTRL00, 0x24); +- if (ret) +- goto power_off; +- +- /* +- * Set data lanes and clock in LP11 when 'sleeping' +- * +- * 0x3019 = 0x70 +- * [6] = 1 : MIPI data lane 2 in LP11 when 'sleeping' +- * [5] = 1 : MIPI data lane 1 in LP11 when 'sleeping' +- * [4] = 1 : MIPI clock lane in LP11 when 'sleeping' +- */ +- ret = ov5640_write_reg(sensor, +- OV5640_REG_PAD_OUTPUT00, 0x70); ++ if (sensor->ep.bus_type == V4L2_MBUS_CSI2_DPHY) { ++ ret = ov5640_set_power_mipi(sensor, on); + if (ret) + goto power_off; ++ } + +- /* Give lanes some time to coax into LP11 state. */ +- usleep_range(500, 1000); +- +- } else { +- if (sensor->ep.bus_type == V4L2_MBUS_CSI2_DPHY) { +- /* Reset MIPI bus settings to their default values. */ +- ov5640_write_reg(sensor, +- OV5640_REG_IO_MIPI_CTRL00, 0x58); +- ov5640_write_reg(sensor, +- OV5640_REG_MIPI_CTRL00, 0x04); +- ov5640_write_reg(sensor, +- OV5640_REG_PAD_OUTPUT00, 0x00); +- } +- ++ if (!on) + ov5640_set_power_off(sensor); +- } + + return 0; + +-- +2.25.1 + diff --git a/queue-5.8/media-m5mols-check-function-pointer-in-m5mols_sensor.patch b/queue-5.8/media-m5mols-check-function-pointer-in-m5mols_sensor.patch new file mode 100644 index 00000000000..6b5b6c9a1a7 --- /dev/null +++ b/queue-5.8/media-m5mols-check-function-pointer-in-m5mols_sensor.patch @@ -0,0 +1,45 @@ +From fbcc95e7aaafbc9f55d7f2dc18b4194d19f4dcee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jul 2020 17:34:47 +0200 +Subject: media: m5mols: Check function pointer in m5mols_sensor_power + +From: Tom Rix + +[ Upstream commit 52438c4463ac904d14bf3496765e67750766f3a6 ] + +clang static analysis reports this error + +m5mols_core.c:767:4: warning: Called function pointer + is null (null dereference) [core.CallAndMessage] + info->set_power(&client->dev, 0); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +In other places, the set_power ptr is checked. +So add a check. + +Fixes: bc125106f8af ("[media] Add support for M-5MOLS 8 Mega Pixel camera ISP") +Signed-off-by: Tom Rix +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/m5mols/m5mols_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c +index de295114ca482..21666d705e372 100644 +--- a/drivers/media/i2c/m5mols/m5mols_core.c ++++ b/drivers/media/i2c/m5mols/m5mols_core.c +@@ -764,7 +764,8 @@ static int m5mols_sensor_power(struct m5mols_info *info, bool enable) + + ret = regulator_bulk_enable(ARRAY_SIZE(supplies), supplies); + if (ret) { +- info->set_power(&client->dev, 0); ++ if (info->set_power) ++ info->set_power(&client->dev, 0); + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.8/media-media-pci-prevent-memory-leak-in-bttv_probe.patch b/queue-5.8/media-media-pci-prevent-memory-leak-in-bttv_probe.patch new file mode 100644 index 00000000000..94a5187ad51 --- /dev/null +++ b/queue-5.8/media-media-pci-prevent-memory-leak-in-bttv_probe.patch @@ -0,0 +1,65 @@ +From ad5feb1a5509ba07e11a918a958ef2b2f20a8d1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Apr 2020 11:52:30 +0200 +Subject: media: media/pci: prevent memory leak in bttv_probe + +From: Xiaolong Huang + +[ Upstream commit 7b817585b730665126b45df5508dd69526448bc8 ] + +In bttv_probe if some functions such as pci_enable_device, +pci_set_dma_mask and request_mem_region fails the allocated + memory for btv should be released. + +Signed-off-by: Xiaolong Huang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/bt8xx/bttv-driver.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c +index 9144f795fb933..b721720f9845a 100644 +--- a/drivers/media/pci/bt8xx/bttv-driver.c ++++ b/drivers/media/pci/bt8xx/bttv-driver.c +@@ -4013,11 +4013,13 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) + btv->id = dev->device; + if (pci_enable_device(dev)) { + pr_warn("%d: Can't enable device\n", btv->c.nr); +- return -EIO; ++ result = -EIO; ++ goto free_mem; + } + if (pci_set_dma_mask(dev, DMA_BIT_MASK(32))) { + pr_warn("%d: No suitable DMA available\n", btv->c.nr); +- return -EIO; ++ result = -EIO; ++ goto free_mem; + } + if (!request_mem_region(pci_resource_start(dev,0), + pci_resource_len(dev,0), +@@ -4025,7 +4027,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) + pr_warn("%d: can't request iomem (0x%llx)\n", + btv->c.nr, + (unsigned long long)pci_resource_start(dev, 0)); +- return -EBUSY; ++ result = -EBUSY; ++ goto free_mem; + } + pci_set_master(dev); + pci_set_command(dev); +@@ -4211,6 +4214,10 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) + release_mem_region(pci_resource_start(btv->c.pci,0), + pci_resource_len(btv->c.pci,0)); + pci_disable_device(btv->c.pci); ++ ++free_mem: ++ bttvs[btv->c.nr] = NULL; ++ kfree(btv); + return result; + } + +-- +2.25.1 + diff --git a/queue-5.8/media-mx2_emmaprp-fix-memleak-in-emmaprp_probe.patch b/queue-5.8/media-mx2_emmaprp-fix-memleak-in-emmaprp_probe.patch new file mode 100644 index 00000000000..5167dbb5183 --- /dev/null +++ b/queue-5.8/media-mx2_emmaprp-fix-memleak-in-emmaprp_probe.patch @@ -0,0 +1,44 @@ +From 4dbd86e460764d3408f2703a500120e48d25f648 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 11:26:04 +0200 +Subject: media: mx2_emmaprp: Fix memleak in emmaprp_probe + +From: Dinghao Liu + +[ Upstream commit 21d387b8d372f859d9e87fdcc7c3b4a432737f4d ] + +When platform_get_irq() fails, we should release +vfd and unregister pcdev->v4l2_dev just like the +subsequent error paths. + +Fixes: d4e192cc44914 ("media: mx2_emmaprp: Check for platform_get_irq() error") +Signed-off-by: Dinghao Liu +Reviewed-by: Fabio Estevam +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mx2_emmaprp.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/mx2_emmaprp.c b/drivers/media/platform/mx2_emmaprp.c +index df78df59da456..08a5473b56104 100644 +--- a/drivers/media/platform/mx2_emmaprp.c ++++ b/drivers/media/platform/mx2_emmaprp.c +@@ -852,8 +852,11 @@ static int emmaprp_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, pcdev); + + irq = platform_get_irq(pdev, 0); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto rel_vdev; ++ } ++ + ret = devm_request_irq(&pdev->dev, irq, emmaprp_irq, 0, + dev_name(&pdev->dev), pcdev); + if (ret) +-- +2.25.1 + diff --git a/queue-5.8/media-omap3isp-fix-memleak-in-isp_probe.patch b/queue-5.8/media-omap3isp-fix-memleak-in-isp_probe.patch new file mode 100644 index 00000000000..f00eb4e75cf --- /dev/null +++ b/queue-5.8/media-omap3isp-fix-memleak-in-isp_probe.patch @@ -0,0 +1,41 @@ +From 34950c742759a86ab0d0b99e683840123b050b8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 08:53:52 +0200 +Subject: media: omap3isp: Fix memleak in isp_probe + +From: Dinghao Liu + +[ Upstream commit d8fc21c17099635e8ebd986d042be65a6c6b5bd0 ] + +When devm_ioremap_resource() fails, isp should be +freed just like other error paths in isp_probe. + +Fixes: 8644cdf972dd6 ("[media] omap3isp: Replace many MMIO regions by two") +Signed-off-by: Dinghao Liu +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/isp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index b91e472ee764e..de066757726de 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -2328,8 +2328,10 @@ static int isp_probe(struct platform_device *pdev) + mem = platform_get_resource(pdev, IORESOURCE_MEM, i); + isp->mmio_base[map_idx] = + devm_ioremap_resource(isp->dev, mem); +- if (IS_ERR(isp->mmio_base[map_idx])) +- return PTR_ERR(isp->mmio_base[map_idx]); ++ if (IS_ERR(isp->mmio_base[map_idx])) { ++ ret = PTR_ERR(isp->mmio_base[map_idx]); ++ goto error; ++ } + } + + ret = isp_get_clocks(isp); +-- +2.25.1 + diff --git a/queue-5.8/media-ov5640-correct-bit-div-register-in-clock-tree-.patch b/queue-5.8/media-ov5640-correct-bit-div-register-in-clock-tree-.patch new file mode 100644 index 00000000000..25332fb56f7 --- /dev/null +++ b/queue-5.8/media-ov5640-correct-bit-div-register-in-clock-tree-.patch @@ -0,0 +1,39 @@ +From 1fb6dca3963b09a82402676a144c5e9cc71b0e95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Aug 2020 11:06:58 +0200 +Subject: media: ov5640: Correct Bit Div register in clock tree diagram + +From: Paul Kocialkowski + +[ Upstream commit 4c85f628f6639e3e3e0a7788416154f28dfcae4f ] + +Although the code is correct and doing the right thing, the clock diagram +showed the wrong register for the bit divider, which had me doubting the +understanding of the tree. Fix this to avoid doubts in the future. + +Signed-off-by: Paul Kocialkowski +Fixes: aa2882481cada ("media: ov5640: Adjust the clock based on the expected rate") +Acked-by: Jacopo Mondi +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/ov5640.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c +index 2fe4a7ac05929..ab19e04720d3a 100644 +--- a/drivers/media/i2c/ov5640.c ++++ b/drivers/media/i2c/ov5640.c +@@ -751,7 +751,7 @@ static int ov5640_mod_reg(struct ov5640_dev *sensor, u16 reg, + * +->| PLL Root Div | - reg 0x3037, bit 4 + * +-+------------+ + * | +---------+ +- * +->| Bit Div | - reg 0x3035, bits 0-3 ++ * +->| Bit Div | - reg 0x3034, bits 0-3 + * +-+-------+ + * | +-------------+ + * +->| SCLK Div | - reg 0x3108, bits 0-1 +-- +2.25.1 + diff --git a/queue-5.8/media-platform-fcp-fix-a-reference-count-leak.patch b/queue-5.8/media-platform-fcp-fix-a-reference-count-leak.patch new file mode 100644 index 00000000000..a0cacc739ad --- /dev/null +++ b/queue-5.8/media-platform-fcp-fix-a-reference-count-leak.patch @@ -0,0 +1,42 @@ +From 510f5a32ad90feac1e5378c821479e0114909179 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 01:19:44 +0200 +Subject: media: platform: fcp: Fix a reference count leak. + +From: Qiushi Wu + +[ Upstream commit 63e36a381d92a9cded97e90d481ee22566557dd1 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code, causing incorrect ref count if +pm_runtime_put_noidle() is not called in error handling paths. +Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails. + +Fixes: 6eaafbdb668b ("[media] v4l: rcar-fcp: Keep the coding style consistent") +Signed-off-by: Qiushi Wu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar-fcp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c +index 5c6b00737fe75..05c712e00a2a7 100644 +--- a/drivers/media/platform/rcar-fcp.c ++++ b/drivers/media/platform/rcar-fcp.c +@@ -103,8 +103,10 @@ int rcar_fcp_enable(struct rcar_fcp_device *fcp) + return 0; + + ret = pm_runtime_get_sync(fcp->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(fcp->dev); + return ret; ++ } + + return 0; + } +-- +2.25.1 + diff --git a/queue-5.8/media-platform-s3c-camif-fix-runtime-pm-imbalance-on.patch b/queue-5.8/media-platform-s3c-camif-fix-runtime-pm-imbalance-on.patch new file mode 100644 index 00000000000..52022fe6f2d --- /dev/null +++ b/queue-5.8/media-platform-s3c-camif-fix-runtime-pm-imbalance-on.patch @@ -0,0 +1,53 @@ +From 3742176a377418d8f856b51a5587e284478f1e9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 May 2020 15:29:33 +0200 +Subject: media: platform: s3c-camif: Fix runtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit dafa3605fe60d5a61239d670919b2a36e712481e ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus a pairing decrement is needed on +the error handling path to keep the counter balanced. + +Also, call pm_runtime_disable() when pm_runtime_get_sync() returns +an error code. + +Signed-off-by: Dinghao Liu +Reviewed-by: Sylwester Nawrocki +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s3c-camif/camif-core.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/s3c-camif/camif-core.c b/drivers/media/platform/s3c-camif/camif-core.c +index c6fbcd7036d6d..ee624804862e2 100644 +--- a/drivers/media/platform/s3c-camif/camif-core.c ++++ b/drivers/media/platform/s3c-camif/camif-core.c +@@ -464,7 +464,7 @@ static int s3c_camif_probe(struct platform_device *pdev) + + ret = camif_media_dev_init(camif); + if (ret < 0) +- goto err_alloc; ++ goto err_pm; + + ret = camif_register_sensor(camif); + if (ret < 0) +@@ -498,10 +498,9 @@ static int s3c_camif_probe(struct platform_device *pdev) + media_device_unregister(&camif->media_dev); + media_device_cleanup(&camif->media_dev); + camif_unregister_media_entities(camif); +-err_alloc: ++err_pm: + pm_runtime_put(dev); + pm_runtime_disable(dev); +-err_pm: + camif_clk_put(camif); + err_clk: + s3c_camif_unregister_subdev(camif); +-- +2.25.1 + diff --git a/queue-5.8/media-platform-sti-hva-fix-runtime-pm-imbalance-on-e.patch b/queue-5.8/media-platform-sti-hva-fix-runtime-pm-imbalance-on-e.patch new file mode 100644 index 00000000000..5271a0c5c82 --- /dev/null +++ b/queue-5.8/media-platform-sti-hva-fix-runtime-pm-imbalance-on-e.patch @@ -0,0 +1,37 @@ +From f6c83490998f8f7bfeb107e8c99b323be496ed89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 May 2020 12:05:02 +0200 +Subject: media: platform: sti: hva: Fix runtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit d912a1d9e9afe69c6066c1ceb6bfc09063074075 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus a pairing decrement is needed on +the error handling path to keep the counter balanced. + +Signed-off-by: Dinghao Liu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/hva/hva-hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c +index bb13348be0832..43f279e2a6a38 100644 +--- a/drivers/media/platform/sti/hva/hva-hw.c ++++ b/drivers/media/platform/sti/hva/hva-hw.c +@@ -389,7 +389,7 @@ int hva_hw_probe(struct platform_device *pdev, struct hva_dev *hva) + ret = pm_runtime_get_sync(dev); + if (ret < 0) { + dev_err(dev, "%s failed to set PM\n", HVA_PREFIX); +- goto err_clk; ++ goto err_pm; + } + + /* check IP hardware version */ +-- +2.25.1 + diff --git a/queue-5.8/media-rcar-csi2-allocate-v4l2_async_subdev-dynamical.patch b/queue-5.8/media-rcar-csi2-allocate-v4l2_async_subdev-dynamical.patch new file mode 100644 index 00000000000..a5c912c44ee --- /dev/null +++ b/queue-5.8/media-rcar-csi2-allocate-v4l2_async_subdev-dynamical.patch @@ -0,0 +1,84 @@ +From cb8d641e9f74aec4140fbb1ccba74d44d7ba661e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 22:59:38 +0200 +Subject: media: rcar-csi2: Allocate v4l2_async_subdev dynamically + +From: Laurent Pinchart + +[ Upstream commit 2cac7cbfb4099980e78244359ab9c6f056d6a7ec ] + +v4l2_async_notifier_add_subdev() requires the asd to be allocated +dynamically, but the rcar-csi2 driver embeds it in the rcar_csi2 +structure. This causes memory corruption when the notifier is destroyed +at remove time with v4l2_async_notifier_cleanup(). + +Fix this issue by registering the asd with +v4l2_async_notifier_add_fwnode_subdev(), which allocates it dynamically +internally. + +Fixes: 769afd212b16 ("media: rcar-csi2: add Renesas R-Car MIPI CSI-2 receiver driver") +Signed-off-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar-vin/rcar-csi2.c | 24 +++++++++------------ + 1 file changed, 10 insertions(+), 14 deletions(-) + +diff --git a/drivers/media/platform/rcar-vin/rcar-csi2.c b/drivers/media/platform/rcar-vin/rcar-csi2.c +index 151e6a90c5fbc..d9bc8cef7db58 100644 +--- a/drivers/media/platform/rcar-vin/rcar-csi2.c ++++ b/drivers/media/platform/rcar-vin/rcar-csi2.c +@@ -361,7 +361,6 @@ struct rcar_csi2 { + struct media_pad pads[NR_OF_RCAR_CSI2_PAD]; + + struct v4l2_async_notifier notifier; +- struct v4l2_async_subdev asd; + struct v4l2_subdev *remote; + + struct v4l2_mbus_framefmt mf; +@@ -810,6 +809,8 @@ static int rcsi2_parse_v4l2(struct rcar_csi2 *priv, + + static int rcsi2_parse_dt(struct rcar_csi2 *priv) + { ++ struct v4l2_async_subdev *asd; ++ struct fwnode_handle *fwnode; + struct device_node *ep; + struct v4l2_fwnode_endpoint v4l2_ep = { .bus_type = 0 }; + int ret; +@@ -833,24 +834,19 @@ static int rcsi2_parse_dt(struct rcar_csi2 *priv) + return ret; + } + +- priv->asd.match.fwnode = +- fwnode_graph_get_remote_endpoint(of_fwnode_handle(ep)); +- priv->asd.match_type = V4L2_ASYNC_MATCH_FWNODE; +- ++ fwnode = fwnode_graph_get_remote_endpoint(of_fwnode_handle(ep)); + of_node_put(ep); + +- v4l2_async_notifier_init(&priv->notifier); +- +- ret = v4l2_async_notifier_add_subdev(&priv->notifier, &priv->asd); +- if (ret) { +- fwnode_handle_put(priv->asd.match.fwnode); +- return ret; +- } ++ dev_dbg(priv->dev, "Found '%pOF'\n", to_of_node(fwnode)); + ++ v4l2_async_notifier_init(&priv->notifier); + priv->notifier.ops = &rcar_csi2_notify_ops; + +- dev_dbg(priv->dev, "Found '%pOF'\n", +- to_of_node(priv->asd.match.fwnode)); ++ asd = v4l2_async_notifier_add_fwnode_subdev(&priv->notifier, fwnode, ++ sizeof(*asd)); ++ fwnode_handle_put(fwnode); ++ if (IS_ERR(asd)) ++ return PTR_ERR(asd); + + ret = v4l2_async_subdev_notifier_register(&priv->subdev, + &priv->notifier); +-- +2.25.1 + diff --git a/queue-5.8/media-rcar-vin-fix-a-reference-count-leak.patch b/queue-5.8/media-rcar-vin-fix-a-reference-count-leak.patch new file mode 100644 index 00000000000..960bbe1c3ee --- /dev/null +++ b/queue-5.8/media-rcar-vin-fix-a-reference-count-leak.patch @@ -0,0 +1,41 @@ +From 6d4e6fbf3024cb4c2d6b6dd9f1501900568a8f2d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 00:30:08 +0200 +Subject: media: rcar-vin: Fix a reference count leak. + +From: Qiushi Wu + +[ Upstream commit aaffa0126a111d65f4028c503c76192d4cc93277 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus call pm_runtime_put_noidle() +if pm_runtime_get_sync() fails. + +Fixes: 90dedce9bc54 ("media: rcar-vin: add function to manipulate Gen3 chsel value") +Signed-off-by: Qiushi Wu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar-vin/rcar-dma.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/rcar-vin/rcar-dma.c b/drivers/media/platform/rcar-vin/rcar-dma.c +index 1a30cd0363711..95bc9e0e87926 100644 +--- a/drivers/media/platform/rcar-vin/rcar-dma.c ++++ b/drivers/media/platform/rcar-vin/rcar-dma.c +@@ -1392,8 +1392,10 @@ int rvin_set_channel_routing(struct rvin_dev *vin, u8 chsel) + int ret; + + ret = pm_runtime_get_sync(vin->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(vin->dev); + return ret; ++ } + + /* Make register writes take effect immediately. */ + vnmc = rvin_read(vin, VNMC_REG); +-- +2.25.1 + diff --git a/queue-5.8/media-rcar_drif-allocate-v4l2_async_subdev-dynamical.patch b/queue-5.8/media-rcar_drif-allocate-v4l2_async_subdev-dynamical.patch new file mode 100644 index 00000000000..d44abca36ef --- /dev/null +++ b/queue-5.8/media-rcar_drif-allocate-v4l2_async_subdev-dynamical.patch @@ -0,0 +1,82 @@ +From 804fac429d5921fb1fe605e995cc0bc2230e78c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 22:59:37 +0200 +Subject: media: rcar_drif: Allocate v4l2_async_subdev dynamically + +From: Laurent Pinchart + +[ Upstream commit 468e986dac0e94194334ca6d0abf3af8c250792e ] + +v4l2_async_notifier_add_subdev() requires the asd to be allocated +dynamically, but the rcar-drif driver embeds it in the +rcar_drif_graph_ep structure. This causes memory corruption when the +notifier is destroyed at remove time with v4l2_async_notifier_cleanup(). + +Fix this issue by registering the asd with +v4l2_async_notifier_add_fwnode_subdev(), which allocates it dynamically +internally. + +Fixes: d079f94c9046 ("media: platform: Switch to v4l2_async_notifier_add_subdev") +Signed-off-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_drif.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c +index 3f1e5cb8b1976..f318cd4b8086f 100644 +--- a/drivers/media/platform/rcar_drif.c ++++ b/drivers/media/platform/rcar_drif.c +@@ -185,7 +185,6 @@ struct rcar_drif_frame_buf { + /* OF graph endpoint's V4L2 async data */ + struct rcar_drif_graph_ep { + struct v4l2_subdev *subdev; /* Async matched subdev */ +- struct v4l2_async_subdev asd; /* Async sub-device descriptor */ + }; + + /* DMA buffer */ +@@ -1109,12 +1108,6 @@ static int rcar_drif_notify_bound(struct v4l2_async_notifier *notifier, + struct rcar_drif_sdr *sdr = + container_of(notifier, struct rcar_drif_sdr, notifier); + +- if (sdr->ep.asd.match.fwnode != +- of_fwnode_handle(subdev->dev->of_node)) { +- rdrif_err(sdr, "subdev %s cannot bind\n", subdev->name); +- return -EINVAL; +- } +- + v4l2_set_subdev_hostdata(subdev, sdr); + sdr->ep.subdev = subdev; + rdrif_dbg(sdr, "bound asd %s\n", subdev->name); +@@ -1218,7 +1211,7 @@ static int rcar_drif_parse_subdevs(struct rcar_drif_sdr *sdr) + { + struct v4l2_async_notifier *notifier = &sdr->notifier; + struct fwnode_handle *fwnode, *ep; +- int ret; ++ struct v4l2_async_subdev *asd; + + v4l2_async_notifier_init(notifier); + +@@ -1237,12 +1230,13 @@ static int rcar_drif_parse_subdevs(struct rcar_drif_sdr *sdr) + return -EINVAL; + } + +- sdr->ep.asd.match.fwnode = fwnode; +- sdr->ep.asd.match_type = V4L2_ASYNC_MATCH_FWNODE; +- ret = v4l2_async_notifier_add_subdev(notifier, &sdr->ep.asd); ++ asd = v4l2_async_notifier_add_fwnode_subdev(notifier, fwnode, ++ sizeof(*asd)); + fwnode_handle_put(fwnode); ++ if (IS_ERR(asd)) ++ return PTR_ERR(asd); + +- return ret; ++ return 0; + } + + /* Check if the given device is the primary bond */ +-- +2.25.1 + diff --git a/queue-5.8/media-rcar_drif-fix-fwnode-reference-leak-when-parsi.patch b/queue-5.8/media-rcar_drif-fix-fwnode-reference-leak-when-parsi.patch new file mode 100644 index 00000000000..32297b23d58 --- /dev/null +++ b/queue-5.8/media-rcar_drif-fix-fwnode-reference-leak-when-parsi.patch @@ -0,0 +1,63 @@ +From beb84cdb5f245ffed63b5d5ec6a3098f7274c87a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 22:59:36 +0200 +Subject: media: rcar_drif: Fix fwnode reference leak when parsing DT + +From: Laurent Pinchart + +[ Upstream commit cdd4f7824994c9254acc6e415750529ea2d2cfe0 ] + +The fwnode reference corresponding to the endpoint is leaked in an error +path of the rcar_drif_parse_subdevs() function. Fix it, and reorganize +fwnode reference handling in the function to release references early, +simplifying error paths. + +Signed-off-by: Laurent Pinchart +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rcar_drif.c | 16 +++++----------- + 1 file changed, 5 insertions(+), 11 deletions(-) + +diff --git a/drivers/media/platform/rcar_drif.c b/drivers/media/platform/rcar_drif.c +index 3d2451ac347d7..3f1e5cb8b1976 100644 +--- a/drivers/media/platform/rcar_drif.c ++++ b/drivers/media/platform/rcar_drif.c +@@ -1227,28 +1227,22 @@ static int rcar_drif_parse_subdevs(struct rcar_drif_sdr *sdr) + if (!ep) + return 0; + ++ /* Get the endpoint properties */ ++ rcar_drif_get_ep_properties(sdr, ep); ++ + fwnode = fwnode_graph_get_remote_port_parent(ep); ++ fwnode_handle_put(ep); + if (!fwnode) { + dev_warn(sdr->dev, "bad remote port parent\n"); +- fwnode_handle_put(ep); + return -EINVAL; + } + + sdr->ep.asd.match.fwnode = fwnode; + sdr->ep.asd.match_type = V4L2_ASYNC_MATCH_FWNODE; + ret = v4l2_async_notifier_add_subdev(notifier, &sdr->ep.asd); +- if (ret) { +- fwnode_handle_put(fwnode); +- return ret; +- } +- +- /* Get the endpoint properties */ +- rcar_drif_get_ep_properties(sdr, ep); +- + fwnode_handle_put(fwnode); +- fwnode_handle_put(ep); + +- return 0; ++ return ret; + } + + /* Check if the given device is the primary bond */ +-- +2.25.1 + diff --git a/queue-5.8/media-revert-media-exynos4-is-add-missed-check-for-p.patch b/queue-5.8/media-revert-media-exynos4-is-add-missed-check-for-p.patch new file mode 100644 index 00000000000..ff7f93b76a7 --- /dev/null +++ b/queue-5.8/media-revert-media-exynos4-is-add-missed-check-for-p.patch @@ -0,0 +1,47 @@ +From cc83691ca78f70d59eb9710a0533acd6670db54a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 17:32:39 +0200 +Subject: media: Revert "media: exynos4-is: Add missed check for + pinctrl_lookup_state()" + +From: Sylwester Nawrocki + +[ Upstream commit 00d21f325d58567d81d9172096692d0a9ea7f725 ] + +The "idle" pinctrl state is optional as documented in the DT binding. +The change introduced by the commit being reverted makes that pinctrl state +mandatory and breaks initialization of the whole media driver, since the +"idle" state is not specified in any mainline dts. + +This reverts commit 18ffec750578 ("media: exynos4-is: Add missed check for pinctrl_lookup_state()") +to fix the regression. + +Fixes: 18ffec750578 ("media: exynos4-is: Add missed check for pinctrl_lookup_state()") +Signed-off-by: Sylwester Nawrocki +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/exynos4-is/media-dev.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c +index 9c31d950cddf7..2f90607c3797d 100644 +--- a/drivers/media/platform/exynos4-is/media-dev.c ++++ b/drivers/media/platform/exynos4-is/media-dev.c +@@ -1268,11 +1268,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd) + if (IS_ERR(pctl->state_default)) + return PTR_ERR(pctl->state_default); + ++ /* PINCTRL_STATE_IDLE is optional */ + pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl, + PINCTRL_STATE_IDLE); +- if (IS_ERR(pctl->state_idle)) +- return PTR_ERR(pctl->state_idle); +- + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.8/media-rockchip-rga-fix-a-reference-count-leak.patch b/queue-5.8/media-rockchip-rga-fix-a-reference-count-leak.patch new file mode 100644 index 00000000000..ec4825a1cd6 --- /dev/null +++ b/queue-5.8/media-rockchip-rga-fix-a-reference-count-leak.patch @@ -0,0 +1,38 @@ +From fd4a499739939cde0d176a30622e1c8dae76791c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 01:13:49 +0200 +Subject: media: rockchip/rga: Fix a reference count leak. + +From: Qiushi Wu + +[ Upstream commit 884d638e0853c4b5f01eb6d048fc3b6239012404 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus call pm_runtime_put_noidle() +if pm_runtime_get_sync() fails. + +Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support") +Signed-off-by: Qiushi Wu +Reviewed-by: Heiko Stuebner +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rga/rga-buf.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/rockchip/rga/rga-buf.c b/drivers/media/platform/rockchip/rga/rga-buf.c +index 36b821ccc1dba..bf9a75b75083b 100644 +--- a/drivers/media/platform/rockchip/rga/rga-buf.c ++++ b/drivers/media/platform/rockchip/rga/rga-buf.c +@@ -81,6 +81,7 @@ static int rga_buf_start_streaming(struct vb2_queue *q, unsigned int count) + + ret = pm_runtime_get_sync(rga->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(rga->dev); + rga_buf_return_buffers(q, VB2_BUF_STATE_QUEUED); + return ret; + } +-- +2.25.1 + diff --git a/queue-5.8/media-s5p-mfc-fix-a-reference-count-leak.patch b/queue-5.8/media-s5p-mfc-fix-a-reference-count-leak.patch new file mode 100644 index 00000000000..edaf44418c1 --- /dev/null +++ b/queue-5.8/media-s5p-mfc-fix-a-reference-count-leak.patch @@ -0,0 +1,42 @@ +From c9b35a857c035401e0f3861c31b77fae48178fbd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 04:31:22 +0200 +Subject: media: s5p-mfc: Fix a reference count leak + +From: Qiushi Wu + +[ Upstream commit 78741ce98c2e36188e2343434406b0e0bc50b0e7 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code, causing incorrect ref count if +pm_runtime_put_noidle() is not called in error handling paths. +Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails. + +Fixes: c5086f130a77 ("[media] s5p-mfc: Use clock gating only on MFC v5 hardware") +Signed-off-by: Qiushi Wu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/s5p-mfc/s5p_mfc_pm.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c +index 7d52431c2c837..62d2320a72186 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c +@@ -79,8 +79,10 @@ int s5p_mfc_power_on(void) + int i, ret = 0; + + ret = pm_runtime_get_sync(pm->device); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(pm->device); + return ret; ++ } + + /* clock control */ + for (i = 0; i < pm->num_clocks; i++) { +-- +2.25.1 + diff --git a/queue-5.8/media-saa7134-avoid-a-shift-overflow.patch b/queue-5.8/media-saa7134-avoid-a-shift-overflow.patch new file mode 100644 index 00000000000..11384260f92 --- /dev/null +++ b/queue-5.8/media-saa7134-avoid-a-shift-overflow.patch @@ -0,0 +1,39 @@ +From e6612c8f9e12fbe3a7e1d642e9ed0b49d2ed7f14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 08:37:12 +0200 +Subject: media: saa7134: avoid a shift overflow + +From: Mauro Carvalho Chehab + +[ Upstream commit 15a36aae1ec1c1f17149b6113b92631791830740 ] + +As reported by smatch: + drivers/media/pci/saa7134//saa7134-tvaudio.c:686 saa_dsp_writel() warn: should 'reg << 2' be a 64 bit type? + +On a 64-bits Kernel, the shift might be bigger than 32 bits. + +In real, this should never happen, but let's shut up the warning. + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-tvaudio.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-tvaudio.c b/drivers/media/pci/saa7134/saa7134-tvaudio.c +index 79e1afb710758..5cc4ef21f9d37 100644 +--- a/drivers/media/pci/saa7134/saa7134-tvaudio.c ++++ b/drivers/media/pci/saa7134/saa7134-tvaudio.c +@@ -683,7 +683,8 @@ int saa_dsp_writel(struct saa7134_dev *dev, int reg, u32 value) + { + int err; + +- audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", reg << 2, value); ++ audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", ++ (reg << 2) & 0xffffffff, value); + err = saa_dsp_wait_bit(dev,SAA7135_DSP_RWSTATE_WRR); + if (err < 0) + return err; +-- +2.25.1 + diff --git a/queue-5.8/media-st-delta-fix-reference-count-leak-in-delta_run.patch b/queue-5.8/media-st-delta-fix-reference-count-leak-in-delta_run.patch new file mode 100644 index 00000000000..afe179173b4 --- /dev/null +++ b/queue-5.8/media-st-delta-fix-reference-count-leak-in-delta_run.patch @@ -0,0 +1,40 @@ +From 97e1b344218b6fa9d359e1d1b4e8f059346e25ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 05:58:41 +0200 +Subject: media: st-delta: Fix reference count leak in delta_run_work + +From: Aditya Pakki + +[ Upstream commit 57cc666d36adc7b45e37ba4cd7bc4e44ec4c43d7 ] + +delta_run_work() calls delta_get_sync() that increments +the reference counter. In case of failure, decrement the reference +count by calling delta_put_autosuspend(). + +Signed-off-by: Aditya Pakki +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/delta/delta-v4l2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/sti/delta/delta-v4l2.c b/drivers/media/platform/sti/delta/delta-v4l2.c +index 2503224eeee51..c691b3d81549d 100644 +--- a/drivers/media/platform/sti/delta/delta-v4l2.c ++++ b/drivers/media/platform/sti/delta/delta-v4l2.c +@@ -954,8 +954,10 @@ static void delta_run_work(struct work_struct *work) + /* enable the hardware */ + if (!dec->pm) { + ret = delta_get_sync(ctx); +- if (ret) ++ if (ret) { ++ delta_put_autosuspend(ctx); + goto err; ++ } + } + + /* decode this access unit */ +-- +2.25.1 + diff --git a/queue-5.8/media-staging-intel-ipu3-css-correctly-reset-some-me.patch b/queue-5.8/media-staging-intel-ipu3-css-correctly-reset-some-me.patch new file mode 100644 index 00000000000..5394ba24eec --- /dev/null +++ b/queue-5.8/media-staging-intel-ipu3-css-correctly-reset-some-me.patch @@ -0,0 +1,38 @@ +From 86b46a1b95f5d73aa27e320ba1a3e3657e3c70eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Aug 2020 15:11:24 +0200 +Subject: media: staging/intel-ipu3: css: Correctly reset some memory + +From: Christophe JAILLET + +[ Upstream commit 08913a8e458e03f886a1a1154a6501fcb9344c39 ] + +The intent here is to reset the whole 'scaler_coeffs_luma' array, not just +the first element. + +Fixes: e11110a5b744 ("media: staging/intel-ipu3: css: Compute and program ccs") +Signed-off-by: Christophe JAILLET +Reviewed-by: Bingbu Cao +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/ipu3/ipu3-css-params.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/ipu3/ipu3-css-params.c b/drivers/staging/media/ipu3/ipu3-css-params.c +index fbd53d7c097cd..e9d6bd9e9332a 100644 +--- a/drivers/staging/media/ipu3/ipu3-css-params.c ++++ b/drivers/staging/media/ipu3/ipu3-css-params.c +@@ -159,7 +159,7 @@ imgu_css_scaler_calc(u32 input_width, u32 input_height, u32 target_width, + + memset(&cfg->scaler_coeffs_chroma, 0, + sizeof(cfg->scaler_coeffs_chroma)); +- memset(&cfg->scaler_coeffs_luma, 0, sizeof(*cfg->scaler_coeffs_luma)); ++ memset(&cfg->scaler_coeffs_luma, 0, sizeof(cfg->scaler_coeffs_luma)); + do { + phase_step_correction++; + +-- +2.25.1 + diff --git a/queue-5.8/media-sti-fix-reference-count-leaks.patch b/queue-5.8/media-sti-fix-reference-count-leaks.patch new file mode 100644 index 00000000000..e77a8a8cad5 --- /dev/null +++ b/queue-5.8/media-sti-fix-reference-count-leaks.patch @@ -0,0 +1,45 @@ +From dbbbd37181f7a38acdbeacd4c49586b3cfbae256 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 05:31:06 +0200 +Subject: media: sti: Fix reference count leaks + +From: Qiushi Wu + +[ Upstream commit 6f4432bae9f2d12fc1815b5e26cc07e69bcad0df ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code, causing incorrect ref count if +pm_runtime_put_noidle() is not called in error handling paths. +Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails. + +Signed-off-by: Qiushi Wu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/sti/hva/hva-hw.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c +index 401aaafa17109..bb13348be0832 100644 +--- a/drivers/media/platform/sti/hva/hva-hw.c ++++ b/drivers/media/platform/sti/hva/hva-hw.c +@@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct hva_dev *hva) + + if (pm_runtime_get_sync(dev) < 0) { + dev_err(dev, "%s failed to get pm_runtime\n", HVA_PREFIX); ++ pm_runtime_put_noidle(dev); + mutex_unlock(&hva->protect_mutex); + return -EFAULT; + } +@@ -553,6 +554,7 @@ void hva_hw_dump_regs(struct hva_dev *hva, struct seq_file *s) + + if (pm_runtime_get_sync(dev) < 0) { + seq_puts(s, "Cannot wake up IP\n"); ++ pm_runtime_put_noidle(dev); + mutex_unlock(&hva->protect_mutex); + return; + } +-- +2.25.1 + diff --git a/queue-5.8/media-stm32-dcmi-fix-a-reference-count-leak.patch b/queue-5.8/media-stm32-dcmi-fix-a-reference-count-leak.patch new file mode 100644 index 00000000000..8b259a471c6 --- /dev/null +++ b/queue-5.8/media-stm32-dcmi-fix-a-reference-count-leak.patch @@ -0,0 +1,48 @@ +From a9ef19208fb83060ab51f8f58dd5ddaf6a339028 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 04:36:59 +0200 +Subject: media: stm32-dcmi: Fix a reference count leak + +From: Qiushi Wu + +[ Upstream commit 88f50a05f907d96a27a9ce3cc9e8cbb91a6f0f22 ] + +Calling pm_runtime_get_sync increments the counter even in case of +failure, causing incorrect ref count if pm_runtime_put is not +called in error handling paths. Thus replace the jump target +"err_release_buffers" by "err_pm_putw". + +Fixes: 152e0bf60219 ("media: stm32-dcmi: add power saving support") +Signed-off-by: Qiushi Wu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/stm32/stm32-dcmi.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/media/platform/stm32/stm32-dcmi.c b/drivers/media/platform/stm32/stm32-dcmi.c +index b8931490b83b7..fd1c41cba52fc 100644 +--- a/drivers/media/platform/stm32/stm32-dcmi.c ++++ b/drivers/media/platform/stm32/stm32-dcmi.c +@@ -733,7 +733,7 @@ static int dcmi_start_streaming(struct vb2_queue *vq, unsigned int count) + if (ret < 0) { + dev_err(dcmi->dev, "%s: Failed to start streaming, cannot get sync (%d)\n", + __func__, ret); +- goto err_release_buffers; ++ goto err_pm_put; + } + + ret = media_pipeline_start(&dcmi->vdev->entity, &dcmi->pipeline); +@@ -837,8 +837,6 @@ static int dcmi_start_streaming(struct vb2_queue *vq, unsigned int count) + + err_pm_put: + pm_runtime_put(dcmi->dev); +- +-err_release_buffers: + spin_lock_irq(&dcmi->irqlock); + /* + * Return all buffers to vb2 in QUEUED state. +-- +2.25.1 + diff --git a/queue-5.8/media-tc358743-cleanup-tc358743_cec_isr.patch b/queue-5.8/media-tc358743-cleanup-tc358743_cec_isr.patch new file mode 100644 index 00000000000..e34d294dd9f --- /dev/null +++ b/queue-5.8/media-tc358743-cleanup-tc358743_cec_isr.patch @@ -0,0 +1,72 @@ +From db2060db74baee70f1e1613583e572aed39a0dad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 20:32:12 +0200 +Subject: media: tc358743: cleanup tc358743_cec_isr + +From: Tom Rix + +[ Upstream commit 877cb8a444dad2304e891294afb0915fe3c278d6 ] + +tc358743_cec_isr is misnammed, it is not the main isr. +So rename it to be consistent with its siblings, +tc358743_cec_handler. + +It also does not check if its input parameter 'handled' is +is non NULL like its siblings, so add a check. + +Fixes: a0ec8d1dc42e ("media: tc358743: add CEC support") +Signed-off-by: Tom Rix +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/tc358743.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index 211caade9f998..cff99cf61ed4d 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -919,8 +919,8 @@ static const struct cec_adap_ops tc358743_cec_adap_ops = { + .adap_monitor_all_enable = tc358743_cec_adap_monitor_all_enable, + }; + +-static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus, +- bool *handled) ++static void tc358743_cec_handler(struct v4l2_subdev *sd, u16 intstatus, ++ bool *handled) + { + struct tc358743_state *state = to_state(sd); + unsigned int cec_rxint, cec_txint; +@@ -953,7 +953,8 @@ static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus, + cec_transmit_attempt_done(state->cec_adap, + CEC_TX_STATUS_ERROR); + } +- *handled = true; ++ if (handled) ++ *handled = true; + } + if ((intstatus & MASK_CEC_RINT) && + (cec_rxint & MASK_CECRIEND)) { +@@ -968,7 +969,8 @@ static void tc358743_cec_isr(struct v4l2_subdev *sd, u16 intstatus, + msg.msg[i] = v & 0xff; + } + cec_received_msg(state->cec_adap, &msg); +- *handled = true; ++ if (handled) ++ *handled = true; + } + i2c_wr16(sd, INTSTATUS, + intstatus & (MASK_CEC_RINT | MASK_CEC_TINT)); +@@ -1432,7 +1434,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled) + + #ifdef CONFIG_VIDEO_TC358743_CEC + if (intstatus & (MASK_CEC_RINT | MASK_CEC_TINT)) { +- tc358743_cec_isr(sd, intstatus, handled); ++ tc358743_cec_handler(sd, intstatus, handled); + i2c_wr16(sd, INTSTATUS, + intstatus & (MASK_CEC_RINT | MASK_CEC_TINT)); + intstatus &= ~(MASK_CEC_RINT | MASK_CEC_TINT); +-- +2.25.1 + diff --git a/queue-5.8/media-tc358743-initialize-variable.patch b/queue-5.8/media-tc358743-initialize-variable.patch new file mode 100644 index 00000000000..3536aca79a4 --- /dev/null +++ b/queue-5.8/media-tc358743-initialize-variable.patch @@ -0,0 +1,42 @@ +From 588602e3d5d28e70198ff569969f24a28fe1e655 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Aug 2020 18:30:43 +0200 +Subject: media: tc358743: initialize variable + +From: Tom Rix + +[ Upstream commit 274cf92d5dff5c2fec1a518078542ffe70d07646 ] + +clang static analysis flags this error + +tc358743.c:1468:9: warning: Branch condition evaluates + to a garbage value + return handled ? IRQ_HANDLED : IRQ_NONE; + ^~~~~~~ +handled should be initialized to false. + +Fixes: d747b806abf4 ("[media] tc358743: add direct interrupt handling") +Signed-off-by: Tom Rix +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/tc358743.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c +index dbbab75f135ec..211caade9f998 100644 +--- a/drivers/media/i2c/tc358743.c ++++ b/drivers/media/i2c/tc358743.c +@@ -1461,7 +1461,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled) + static irqreturn_t tc358743_irq_handler(int irq, void *dev_id) + { + struct tc358743_state *state = dev_id; +- bool handled; ++ bool handled = false; + + tc358743_isr(&state->sd, 0, &handled); + +-- +2.25.1 + diff --git a/queue-5.8/media-ti-vpe-fix-a-missing-check-and-reference-count.patch b/queue-5.8/media-ti-vpe-fix-a-missing-check-and-reference-count.patch new file mode 100644 index 00000000000..df553fce514 --- /dev/null +++ b/queue-5.8/media-ti-vpe-fix-a-missing-check-and-reference-count.patch @@ -0,0 +1,42 @@ +From 8aefa4b5d0b7bc69d4e5d0739e516678eba8fd0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 04:56:05 +0200 +Subject: media: ti-vpe: Fix a missing check and reference count leak + +From: Qiushi Wu + +[ Upstream commit 7dae2aaaf432767ca7aa11fa84643a7c2600dbdd ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code, causing incorrect ref count if +pm_runtime_put_noidle() is not called in error handling paths. +And also, when the call of function vpe_runtime_get() failed, +we won't call vpe_runtime_put(). +Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails +inside vpe_runtime_get(). + +Fixes: 4571912743ac ("[media] v4l: ti-vpe: Add VPE mem to mem driver") +Signed-off-by: Qiushi Wu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/ti-vpe/vpe.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c +index cff2fcd6d812a..82d3ee45e2e90 100644 +--- a/drivers/media/platform/ti-vpe/vpe.c ++++ b/drivers/media/platform/ti-vpe/vpe.c +@@ -2475,6 +2475,8 @@ static int vpe_runtime_get(struct platform_device *pdev) + + r = pm_runtime_get_sync(&pdev->dev); + WARN_ON(r < 0); ++ if (r) ++ pm_runtime_put_noidle(&pdev->dev); + return r < 0 ? r : 0; + } + +-- +2.25.1 + diff --git a/queue-5.8/media-tuner-simple-fix-regression-in-simple_set_radi.patch b/queue-5.8/media-tuner-simple-fix-regression-in-simple_set_radi.patch new file mode 100644 index 00000000000..c41064206b4 --- /dev/null +++ b/queue-5.8/media-tuner-simple-fix-regression-in-simple_set_radi.patch @@ -0,0 +1,66 @@ +From 59d55256b33abb523c8bca3f706e9df126db046b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Aug 2020 23:15:47 +0200 +Subject: media: tuner-simple: fix regression in simple_set_radio_freq + +From: Tom Rix + +[ Upstream commit 505bfc2a142f12ce7bc7a878b44abc3496f2e747 ] + +clang static analysis reports this problem + +tuner-simple.c:714:13: warning: Assigned value is + garbage or undefined + buffer[1] = buffer[3]; + ^ ~~~~~~~~~ +In simple_set_radio_freq buffer[3] used to be done +in-function with a switch of tuner type, now done +by a call to simple_radio_bandswitch which has this case + + case TUNER_TENA_9533_DI: + case TUNER_YMEC_TVF_5533MF: + tuner_dbg("This tuner doesn't ... + return 0; + +which does not set buffer[3]. In the old logic, this case +would have returned 0 from simple_set_radio_freq. + +Recover this old behavior by returning an error for this +codition. Since the old simple_set_radio_freq behavior +returned a 0, do the same. + +Fixes: c7a9f3aa1e1b ("V4L/DVB (7129): tuner-simple: move device-specific code into three separate functions") +Signed-off-by: Tom Rix +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/tuners/tuner-simple.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/tuners/tuner-simple.c b/drivers/media/tuners/tuner-simple.c +index b6e70fada3fb2..8fb186b25d6af 100644 +--- a/drivers/media/tuners/tuner-simple.c ++++ b/drivers/media/tuners/tuner-simple.c +@@ -500,7 +500,7 @@ static int simple_radio_bandswitch(struct dvb_frontend *fe, u8 *buffer) + case TUNER_TENA_9533_DI: + case TUNER_YMEC_TVF_5533MF: + tuner_dbg("This tuner doesn't have FM. Most cards have a TEA5767 for FM\n"); +- return 0; ++ return -EINVAL; + case TUNER_PHILIPS_FM1216ME_MK3: + case TUNER_PHILIPS_FM1236_MK3: + case TUNER_PHILIPS_FMD1216ME_MK3: +@@ -702,7 +702,8 @@ static int simple_set_radio_freq(struct dvb_frontend *fe, + TUNER_RATIO_SELECT_50; /* 50 kHz step */ + + /* Bandswitch byte */ +- simple_radio_bandswitch(fe, &buffer[0]); ++ if (simple_radio_bandswitch(fe, &buffer[0])) ++ return 0; + + /* Convert from 1/16 kHz V4L steps to 1/20 MHz (=50 kHz) PLL steps + freq * (1 Mhz / 16000 V4L steps) * (20 PLL steps / 1 MHz) = +-- +2.25.1 + diff --git a/queue-5.8/media-uvcvideo-ensure-all-probed-info-is-returned-to.patch b/queue-5.8/media-uvcvideo-ensure-all-probed-info-is-returned-to.patch new file mode 100644 index 00000000000..25eff713c2e --- /dev/null +++ b/queue-5.8/media-uvcvideo-ensure-all-probed-info-is-returned-to.patch @@ -0,0 +1,84 @@ +From cd5b69e1bc97b57fdac863ce0697346a1f37abad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Aug 2020 03:21:33 +0200 +Subject: media: uvcvideo: Ensure all probed info is returned to v4l2 + +From: Adam Goode + +[ Upstream commit 8a652a17e3c005dcdae31b6c8fdf14382a29cbbe ] + +bFrameIndex and bFormatIndex can be negotiated by the camera during +probing, resulting in the camera choosing a different format than +expected. v4l2 can already accommodate such changes, but the code was +not updating the proper fields. + +Without such a change, v4l2 would potentially interpret the payload +incorrectly, causing corrupted output. This was happening on the +Elgato HD60 S+, which currently always renegotiates to format 1. + +As an aside, the Elgato firmware is buggy and should not be renegotating, +but it is still a valid thing for the camera to do. Both macOS and Windows +will properly probe and read uncorrupted images from this camera. + +With this change, both qv4l2 and chromium can now read uncorrupted video +from the Elgato HD60 S+. + +[Add blank lines, remove periods at the of messages] + +Signed-off-by: Adam Goode +Signed-off-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_v4l2.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c +index 0335e69b70abe..5e6f3153b5ff8 100644 +--- a/drivers/media/usb/uvc/uvc_v4l2.c ++++ b/drivers/media/usb/uvc/uvc_v4l2.c +@@ -247,11 +247,41 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream, + if (ret < 0) + goto done; + ++ /* After the probe, update fmt with the values returned from ++ * negotiation with the device. ++ */ ++ for (i = 0; i < stream->nformats; ++i) { ++ if (probe->bFormatIndex == stream->format[i].index) { ++ format = &stream->format[i]; ++ break; ++ } ++ } ++ ++ if (i == stream->nformats) { ++ uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n", ++ probe->bFormatIndex); ++ return -EINVAL; ++ } ++ ++ for (i = 0; i < format->nframes; ++i) { ++ if (probe->bFrameIndex == format->frame[i].bFrameIndex) { ++ frame = &format->frame[i]; ++ break; ++ } ++ } ++ ++ if (i == format->nframes) { ++ uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n", ++ probe->bFrameIndex); ++ return -EINVAL; ++ } ++ + fmt->fmt.pix.width = frame->wWidth; + fmt->fmt.pix.height = frame->wHeight; + fmt->fmt.pix.field = V4L2_FIELD_NONE; + fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(format, frame); + fmt->fmt.pix.sizeimage = probe->dwMaxVideoFrameSize; ++ fmt->fmt.pix.pixelformat = format->fcc; + fmt->fmt.pix.colorspace = format->colorspace; + + if (uvc_format != NULL) +-- +2.25.1 + diff --git a/queue-5.8/media-uvcvideo-set-media-controller-entity-functions.patch b/queue-5.8/media-uvcvideo-set-media-controller-entity-functions.patch new file mode 100644 index 00000000000..040fe5be08b --- /dev/null +++ b/queue-5.8/media-uvcvideo-set-media-controller-entity-functions.patch @@ -0,0 +1,78 @@ +From 1204d69819fe1e68748ad375e3565545e04aa02c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Jun 2020 04:05:49 +0200 +Subject: media: uvcvideo: Set media controller entity functions + +From: Laurent Pinchart + +[ Upstream commit d6834b4b58d110814aaf3469e7fd87d34ae5ae81 ] + +The media controller core prints a warning when an entity is registered +without a function being set. This affects the uvcvideo driver, as the +warning was added without first addressing the issue in existing +drivers. The problem is harmless, but unnecessarily worries users. Fix +it by mapping UVC entity types to MC entity functions as accurately as +possible using the existing functions. + +Fixes: b50bde4e476d ("[media] v4l2-subdev: use MEDIA_ENT_T_UNKNOWN for new subdevs") +Signed-off-by: Laurent Pinchart +Reviewed-by: Kieran Bingham +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_entity.c | 35 ++++++++++++++++++++++++++++++ + 1 file changed, 35 insertions(+) + +diff --git a/drivers/media/usb/uvc/uvc_entity.c b/drivers/media/usb/uvc/uvc_entity.c +index b4499cddeffe5..ca3a9c2eec271 100644 +--- a/drivers/media/usb/uvc/uvc_entity.c ++++ b/drivers/media/usb/uvc/uvc_entity.c +@@ -73,10 +73,45 @@ static int uvc_mc_init_entity(struct uvc_video_chain *chain, + int ret; + + if (UVC_ENTITY_TYPE(entity) != UVC_TT_STREAMING) { ++ u32 function; ++ + v4l2_subdev_init(&entity->subdev, &uvc_subdev_ops); + strscpy(entity->subdev.name, entity->name, + sizeof(entity->subdev.name)); + ++ switch (UVC_ENTITY_TYPE(entity)) { ++ case UVC_VC_SELECTOR_UNIT: ++ function = MEDIA_ENT_F_VID_MUX; ++ break; ++ case UVC_VC_PROCESSING_UNIT: ++ case UVC_VC_EXTENSION_UNIT: ++ /* For lack of a better option. */ ++ function = MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER; ++ break; ++ case UVC_COMPOSITE_CONNECTOR: ++ case UVC_COMPONENT_CONNECTOR: ++ function = MEDIA_ENT_F_CONN_COMPOSITE; ++ break; ++ case UVC_SVIDEO_CONNECTOR: ++ function = MEDIA_ENT_F_CONN_SVIDEO; ++ break; ++ case UVC_ITT_CAMERA: ++ function = MEDIA_ENT_F_CAM_SENSOR; ++ break; ++ case UVC_TT_VENDOR_SPECIFIC: ++ case UVC_ITT_VENDOR_SPECIFIC: ++ case UVC_ITT_MEDIA_TRANSPORT_INPUT: ++ case UVC_OTT_VENDOR_SPECIFIC: ++ case UVC_OTT_DISPLAY: ++ case UVC_OTT_MEDIA_TRANSPORT_OUTPUT: ++ case UVC_EXTERNAL_VENDOR_SPECIFIC: ++ default: ++ function = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN; ++ break; ++ } ++ ++ entity->subdev.entity.function = function; ++ + ret = media_entity_pads_init(&entity->subdev.entity, + entity->num_pads, entity->pads); + +-- +2.25.1 + diff --git a/queue-5.8/media-uvcvideo-silence-shift-out-of-bounds-warning.patch b/queue-5.8/media-uvcvideo-silence-shift-out-of-bounds-warning.patch new file mode 100644 index 00000000000..f8e0923fa6e --- /dev/null +++ b/queue-5.8/media-uvcvideo-silence-shift-out-of-bounds-warning.patch @@ -0,0 +1,54 @@ +From e45044daca2449f51c17f07938def06bd89ea7c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 01:56:49 +0200 +Subject: media: uvcvideo: Silence shift-out-of-bounds warning + +From: Laurent Pinchart + +[ Upstream commit 171994e498a0426cbe17f874c5c6af3c0af45200 ] + +UBSAN reports a shift-out-of-bounds warning in uvc_get_le_value(). The +report is correct, but the issue should be harmless as the computed +value isn't used when the shift is negative. This may however cause +incorrect behaviour if a negative shift could generate adverse side +effects (such as a trap on some architectures for instance). + +Regardless of whether that may happen or not, silence the warning as a +full WARN backtrace isn't nice. + +Reported-by: Bart Van Assche +Fixes: c0efd232929c ("V4L/DVB (8145a): USB Video Class driver") +Signed-off-by: Laurent Pinchart +Reviewed-by: Bart Van Assche +Tested-by: Bart Van Assche +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/uvc/uvc_ctrl.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c +index e399b9fad7574..a30a8a731eda8 100644 +--- a/drivers/media/usb/uvc/uvc_ctrl.c ++++ b/drivers/media/usb/uvc/uvc_ctrl.c +@@ -773,12 +773,16 @@ static s32 uvc_get_le_value(struct uvc_control_mapping *mapping, + offset &= 7; + mask = ((1LL << bits) - 1) << offset; + +- for (; bits > 0; data++) { ++ while (1) { + u8 byte = *data & mask; + value |= offset > 0 ? (byte >> offset) : (byte << (-offset)); + bits -= 8 - (offset > 0 ? offset : 0); ++ if (bits <= 0) ++ break; ++ + offset -= 8; + mask = (1 << bits) - 1; ++ data++; + } + + /* Sign-extend the value if needed. */ +-- +2.25.1 + diff --git a/queue-5.8/media-venus-core-fix-error-handling-in-probe.patch b/queue-5.8/media-venus-core-fix-error-handling-in-probe.patch new file mode 100644 index 00000000000..604caffc1ff --- /dev/null +++ b/queue-5.8/media-venus-core-fix-error-handling-in-probe.patch @@ -0,0 +1,72 @@ +From 396b10f958353e95d8461acc6a6540603af4a709 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jul 2020 09:16:42 +0200 +Subject: media: venus: core: Fix error handling in probe + +From: Rajendra Nayak + +[ Upstream commit 98cd831088c64aa8fe7e1d2a8bb94b6faba0462b ] + +Post a successful pm_ops->core_get, an error in probe +should exit by doing a pm_ops->core_put which seems +to be missing. So fix it. + +Signed-off-by: Rajendra Nayak +Reviewed-by: Bjorn Andersson +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/core.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c +index 203c6538044fb..bfcaba37d60fe 100644 +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -224,13 +224,15 @@ static int venus_probe(struct platform_device *pdev) + + ret = dma_set_mask_and_coherent(dev, core->res->dma_mask); + if (ret) +- return ret; ++ goto err_core_put; + + if (!dev->dma_parms) { + dev->dma_parms = devm_kzalloc(dev, sizeof(*dev->dma_parms), + GFP_KERNEL); +- if (!dev->dma_parms) +- return -ENOMEM; ++ if (!dev->dma_parms) { ++ ret = -ENOMEM; ++ goto err_core_put; ++ } + } + dma_set_max_seg_size(dev, DMA_BIT_MASK(32)); + +@@ -242,11 +244,11 @@ static int venus_probe(struct platform_device *pdev) + IRQF_TRIGGER_HIGH | IRQF_ONESHOT, + "venus", core); + if (ret) +- return ret; ++ goto err_core_put; + + ret = hfi_create(core, &venus_core_ops); + if (ret) +- return ret; ++ goto err_core_put; + + pm_runtime_enable(dev); + +@@ -302,6 +304,9 @@ static int venus_probe(struct platform_device *pdev) + pm_runtime_set_suspended(dev); + pm_runtime_disable(dev); + hfi_destroy(core); ++err_core_put: ++ if (core->pm_ops->core_put) ++ core->pm_ops->core_put(dev); + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.8/media-venus-core-fix-runtime-pm-imbalance-in-venus_p.patch b/queue-5.8/media-venus-core-fix-runtime-pm-imbalance-in-venus_p.patch new file mode 100644 index 00000000000..0534141d8bc --- /dev/null +++ b/queue-5.8/media-venus-core-fix-runtime-pm-imbalance-in-venus_p.patch @@ -0,0 +1,53 @@ +From be63701f0d151adabc8e8d1603feae6bdad9702c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jun 2020 07:55:23 +0200 +Subject: media: venus: core: Fix runtime PM imbalance in venus_probe + +From: Dinghao Liu + +[ Upstream commit bbe516e976fce538db96bd2b7287df942faa14a3 ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus a pairing decrement is needed on +the error handling path to keep the counter balanced. For other error +paths after this call, things are the same. + +Fix this by adding pm_runtime_put_noidle() after 'err_runtime_disable' +label. But in this case, the error path after pm_runtime_put_sync() +will decrease PM usage counter twice. Thus add an extra +pm_runtime_get_noresume() in this path to balance PM counter. + +Signed-off-by: Dinghao Liu +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c +index bfcaba37d60fe..321ad77cb6cf4 100644 +--- a/drivers/media/platform/qcom/venus/core.c ++++ b/drivers/media/platform/qcom/venus/core.c +@@ -289,8 +289,10 @@ static int venus_probe(struct platform_device *pdev) + goto err_core_deinit; + + ret = pm_runtime_put_sync(dev); +- if (ret) ++ if (ret) { ++ pm_runtime_get_noresume(dev); + goto err_dev_unregister; ++ } + + return 0; + +@@ -301,6 +303,7 @@ static int venus_probe(struct platform_device *pdev) + err_venus_shutdown: + venus_shutdown(core); + err_runtime_disable: ++ pm_runtime_put_noidle(dev); + pm_runtime_set_suspended(dev); + pm_runtime_disable(dev); + hfi_destroy(core); +-- +2.25.1 + diff --git a/queue-5.8/media-venus-fixes-for-list-corruption.patch b/queue-5.8/media-venus-fixes-for-list-corruption.patch new file mode 100644 index 00000000000..4532fc19d13 --- /dev/null +++ b/queue-5.8/media-venus-fixes-for-list-corruption.patch @@ -0,0 +1,79 @@ +From e1c921997df6c200e9aecbcb99d51eed82917f55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Aug 2020 13:48:45 +0200 +Subject: media: venus: fixes for list corruption + +From: Vikash Garodia + +[ Upstream commit e1c69c4eef61ffe295b747992c6fd849e6cd747d ] + +There are few list handling issues while adding and deleting +node in the registered buf list in the driver. +1. list addition - buffer added into the list during buf_init +while not deleted during cleanup. +2. list deletion - In capture streamoff, the list was reinitialized. +As a result, if any node was present in the list, it would +lead to issue while cleaning up that node during buf_cleanup. + +Corresponding call traces below: +[ 165.751014] Call trace: +[ 165.753541] __list_add_valid+0x58/0x88 +[ 165.757532] venus_helper_vb2_buf_init+0x74/0xa8 [venus_core] +[ 165.763450] vdec_buf_init+0x34/0xb4 [venus_dec] +[ 165.768271] __buf_prepare+0x598/0x8a0 [videobuf2_common] +[ 165.773820] vb2_core_qbuf+0xb4/0x334 [videobuf2_common] +[ 165.779298] vb2_qbuf+0x78/0xb8 [videobuf2_v4l2] +[ 165.784053] v4l2_m2m_qbuf+0x80/0xf8 [v4l2_mem2mem] +[ 165.789067] v4l2_m2m_ioctl_qbuf+0x2c/0x38 [v4l2_mem2mem] +[ 165.794624] v4l_qbuf+0x48/0x58 + +[ 1797.556001] Call trace: +[ 1797.558516] __list_del_entry_valid+0x88/0x9c +[ 1797.562989] vdec_buf_cleanup+0x54/0x228 [venus_dec] +[ 1797.568088] __buf_prepare+0x270/0x8a0 [videobuf2_common] +[ 1797.573625] vb2_core_qbuf+0xb4/0x338 [videobuf2_common] +[ 1797.579082] vb2_qbuf+0x78/0xb8 [videobuf2_v4l2] +[ 1797.583830] v4l2_m2m_qbuf+0x80/0xf8 [v4l2_mem2mem] +[ 1797.588843] v4l2_m2m_ioctl_qbuf+0x2c/0x38 [v4l2_mem2mem] +[ 1797.594389] v4l_qbuf+0x48/0x58 + +Signed-off-by: Vikash Garodia +Reviewed-by: Fritz Koenig +Signed-off-by: Stanimir Varbanov +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/qcom/venus/vdec.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/platform/qcom/venus/vdec.c b/drivers/media/platform/qcom/venus/vdec.c +index 7c4c483d54389..76be14efbfb09 100644 +--- a/drivers/media/platform/qcom/venus/vdec.c ++++ b/drivers/media/platform/qcom/venus/vdec.c +@@ -1088,8 +1088,6 @@ static int vdec_stop_capture(struct venus_inst *inst) + break; + } + +- INIT_LIST_HEAD(&inst->registeredbufs); +- + return ret; + } + +@@ -1189,6 +1187,14 @@ static int vdec_buf_init(struct vb2_buffer *vb) + static void vdec_buf_cleanup(struct vb2_buffer *vb) + { + struct venus_inst *inst = vb2_get_drv_priv(vb->vb2_queue); ++ struct vb2_v4l2_buffer *vbuf = to_vb2_v4l2_buffer(vb); ++ struct venus_buffer *buf = to_venus_buffer(vbuf); ++ ++ mutex_lock(&inst->lock); ++ if (vb->type == V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE) ++ if (!list_empty(&inst->registeredbufs)) ++ list_del_init(&buf->reg_list); ++ mutex_unlock(&inst->lock); + + inst->buf_count--; + if (!inst->buf_count) +-- +2.25.1 + diff --git a/queue-5.8/media-vivid-fix-global-out-of-bounds-read-in-precalc.patch b/queue-5.8/media-vivid-fix-global-out-of-bounds-read-in-precalc.patch new file mode 100644 index 00000000000..0618ad566b4 --- /dev/null +++ b/queue-5.8/media-vivid-fix-global-out-of-bounds-read-in-precalc.patch @@ -0,0 +1,53 @@ +From 8ae229db0b9e231e1377489189ef6cd814c375fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 14:46:45 +0200 +Subject: media: vivid: Fix global-out-of-bounds read in precalculate_color() + +From: Peilin Ye + +[ Upstream commit e3158a5e7e661786b3ab650c7e4d21024e8eff0f ] + +vivid_meta_out_process() is setting `brightness`, `contrast`, `saturation` +and `hue` using tpg_s_*(). This is wrong, since tpg_s_*() do not provide +range checks. Using tpg_s_*() here also makes the control framework +out-of-sync with the actual values. Use v4l2_ctrl_s_ctrl() instead. + +This issue has been reported by syzbot as an out-of-bounds read bug in +precalculate_color(). + +Reported-and-tested-by: syzbot+02d9172bf4c43104cd70@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=02d9172bf4c43104cd70 + +Fixes: 746facd39370 ("media: vivid: Add metadata output support") +Suggested-by: Hans Verkuil +Signed-off-by: Peilin Ye +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/test-drivers/vivid/vivid-meta-out.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/test-drivers/vivid/vivid-meta-out.c b/drivers/media/test-drivers/vivid/vivid-meta-out.c +index ff8a039aba72e..95835b52b58fc 100644 +--- a/drivers/media/test-drivers/vivid/vivid-meta-out.c ++++ b/drivers/media/test-drivers/vivid/vivid-meta-out.c +@@ -164,10 +164,11 @@ void vivid_meta_out_process(struct vivid_dev *dev, + { + struct vivid_meta_out_buf *meta = vb2_plane_vaddr(&buf->vb.vb2_buf, 0); + +- tpg_s_brightness(&dev->tpg, meta->brightness); +- tpg_s_contrast(&dev->tpg, meta->contrast); +- tpg_s_saturation(&dev->tpg, meta->saturation); +- tpg_s_hue(&dev->tpg, meta->hue); ++ v4l2_ctrl_s_ctrl(dev->brightness, meta->brightness); ++ v4l2_ctrl_s_ctrl(dev->contrast, meta->contrast); ++ v4l2_ctrl_s_ctrl(dev->saturation, meta->saturation); ++ v4l2_ctrl_s_ctrl(dev->hue, meta->hue); ++ + dprintk(dev, 2, " %s brightness %u contrast %u saturation %u hue %d\n", + __func__, meta->brightness, meta->contrast, + meta->saturation, meta->hue); +-- +2.25.1 + diff --git a/queue-5.8/media-vsp1-fix-runtime-pm-imbalance-on-error.patch b/queue-5.8/media-vsp1-fix-runtime-pm-imbalance-on-error.patch new file mode 100644 index 00000000000..18e2c602b65 --- /dev/null +++ b/queue-5.8/media-vsp1-fix-runtime-pm-imbalance-on-error.patch @@ -0,0 +1,59 @@ +From 8a1dc1f50dd217caabc8619542f453070f5d0bf7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jun 2020 07:29:19 +0200 +Subject: media: vsp1: Fix runtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit 98fae901c8883640202802174a4bd70a1b9118bd ] + +pm_runtime_get_sync() increments the runtime PM usage counter even +when it returns an error code. Thus a pairing decrement is needed on +the error handling path to keep the counter balanced. + +Signed-off-by: Dinghao Liu +Reviewed-by: Kieran Bingham +Reviewed-by: Laurent Pinchart +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/vsp1/vsp1_drv.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c +index c650e45bb0ad1..dc62533cf32ce 100644 +--- a/drivers/media/platform/vsp1/vsp1_drv.c ++++ b/drivers/media/platform/vsp1/vsp1_drv.c +@@ -562,7 +562,12 @@ int vsp1_device_get(struct vsp1_device *vsp1) + int ret; + + ret = pm_runtime_get_sync(vsp1->dev); +- return ret < 0 ? ret : 0; ++ if (ret < 0) { ++ pm_runtime_put_noidle(vsp1->dev); ++ return ret; ++ } ++ ++ return 0; + } + + /* +@@ -845,12 +850,12 @@ static int vsp1_probe(struct platform_device *pdev) + /* Configure device parameters based on the version register. */ + pm_runtime_enable(&pdev->dev); + +- ret = pm_runtime_get_sync(&pdev->dev); ++ ret = vsp1_device_get(vsp1); + if (ret < 0) + goto done; + + vsp1->version = vsp1_read(vsp1, VI6_IP_VERSION); +- pm_runtime_put_sync(&pdev->dev); ++ vsp1_device_put(vsp1); + + for (i = 0; i < ARRAY_SIZE(vsp1_device_infos); ++i) { + if ((vsp1->version & VI6_IP_VERSION_MODEL_MASK) == +-- +2.25.1 + diff --git a/queue-5.8/memory-fsl-corenet-cf-fix-handling-of-platform_get_i.patch b/queue-5.8/memory-fsl-corenet-cf-fix-handling-of-platform_get_i.patch new file mode 100644 index 00000000000..6b15a924139 --- /dev/null +++ b/queue-5.8/memory-fsl-corenet-cf-fix-handling-of-platform_get_i.patch @@ -0,0 +1,40 @@ +From 14b53cd2e906f943eb60d6037b8766297cb2128b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 09:33:15 +0200 +Subject: memory: fsl-corenet-cf: Fix handling of platform_get_irq() error + +From: Krzysztof Kozlowski + +[ Upstream commit dd85345abca60a8916617e8d75c0f9ce334336dd ] + +platform_get_irq() returns -ERRNO on error. In such case comparison +to 0 would pass the check. + +Fixes: 54afbec0d57f ("memory: Freescale CoreNet Coherency Fabric error reporting driver") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20200827073315.29351-1-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/memory/fsl-corenet-cf.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/memory/fsl-corenet-cf.c b/drivers/memory/fsl-corenet-cf.c +index 0b0ed72016da8..0309bd5a18008 100644 +--- a/drivers/memory/fsl-corenet-cf.c ++++ b/drivers/memory/fsl-corenet-cf.c +@@ -211,10 +211,8 @@ static int ccf_probe(struct platform_device *pdev) + dev_set_drvdata(&pdev->dev, ccf); + + irq = platform_get_irq(pdev, 0); +- if (!irq) { +- dev_err(&pdev->dev, "%s: no irq\n", __func__); +- return -ENXIO; +- } ++ if (irq < 0) ++ return irq; + + ret = devm_request_irq(&pdev->dev, irq, ccf_irq, 0, pdev->name, ccf); + if (ret) { +-- +2.25.1 + diff --git a/queue-5.8/memory-omap-gpmc-fix-a-couple-off-by-ones.patch b/queue-5.8/memory-omap-gpmc-fix-a-couple-off-by-ones.patch new file mode 100644 index 00000000000..11422fecda2 --- /dev/null +++ b/queue-5.8/memory-omap-gpmc-fix-a-couple-off-by-ones.patch @@ -0,0 +1,48 @@ +From c6f152d34515074d5a1730a399b9360ccbcc107d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 13:47:07 +0300 +Subject: memory: omap-gpmc: Fix a couple off by ones + +From: Dan Carpenter + +[ Upstream commit 4c54228ac8fd55044195825873c50a524131fa53 ] + +These comparisons should be >= instead of > to prevent reading one +element beyond the end of the gpmc_cs[] array. + +Fixes: cdd6928c589a ("ARM: OMAP2+: Add device-tree support for NOR flash") +Fixes: f37e4580c409 ("ARM: OMAP2: Dynamic allocator for GPMC memory space") +Signed-off-by: Dan Carpenter +Acked-by: Roger Quadros +Link: https://lore.kernel.org/r/20200825104707.GB278587@mwanda +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/omap-gpmc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c +index eff26c1b13940..b5055577843a2 100644 +--- a/drivers/memory/omap-gpmc.c ++++ b/drivers/memory/omap-gpmc.c +@@ -949,7 +949,7 @@ static int gpmc_cs_remap(int cs, u32 base) + int ret; + u32 old_base, size; + +- if (cs > gpmc_cs_num) { ++ if (cs >= gpmc_cs_num) { + pr_err("%s: requested chip-select is disabled\n", __func__); + return -ENODEV; + } +@@ -984,7 +984,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base) + struct resource *res = &gpmc->mem; + int r = -1; + +- if (cs > gpmc_cs_num) { ++ if (cs >= gpmc_cs_num) { + pr_err("%s: requested chip-select is disabled\n", __func__); + return -ENODEV; + } +-- +2.25.1 + diff --git a/queue-5.8/memory-omap-gpmc-fix-build-error-without-config_of.patch b/queue-5.8/memory-omap-gpmc-fix-build-error-without-config_of.patch new file mode 100644 index 00000000000..eab8cd78125 --- /dev/null +++ b/queue-5.8/memory-omap-gpmc-fix-build-error-without-config_of.patch @@ -0,0 +1,45 @@ +From a8891a9e05b4613b892db986be7e4c7f18ca1d91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 20:53:16 +0800 +Subject: memory: omap-gpmc: Fix build error without CONFIG_OF + +From: YueHaibing + +[ Upstream commit 13d029ee51da365aa9c859db0c7395129252bde8 ] + +If CONFIG_OF is n, gcc fails: + +drivers/memory/omap-gpmc.o: In function `gpmc_omap_onenand_set_timings': + omap-gpmc.c:(.text+0x2a88): undefined reference to `gpmc_read_settings_dt' + +Add gpmc_read_settings_dt() helper function, which zero the gpmc_settings +so the caller doesn't proceed with random/invalid settings. + +Fixes: a758f50f10cf ("mtd: onenand: omap2: Configure driver from DT") +Signed-off-by: YueHaibing +Acked-by: Roger Quadros +Link: https://lore.kernel.org/r/20200827125316.20780-1-yuehaibing@huawei.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/omap-gpmc.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c +index b5055577843a2..27bc417029e11 100644 +--- a/drivers/memory/omap-gpmc.c ++++ b/drivers/memory/omap-gpmc.c +@@ -2274,6 +2274,10 @@ static void gpmc_probe_dt_children(struct platform_device *pdev) + } + } + #else ++void gpmc_read_settings_dt(struct device_node *np, struct gpmc_settings *p) ++{ ++ memset(p, 0, sizeof(*p)); ++} + static int gpmc_probe_dt(struct platform_device *pdev) + { + return 0; +-- +2.25.1 + diff --git a/queue-5.8/mfd-sm501-fix-leaks-in-probe.patch b/queue-5.8/mfd-sm501-fix-leaks-in-probe.patch new file mode 100644 index 00000000000..3537d4f4ed9 --- /dev/null +++ b/queue-5.8/mfd-sm501-fix-leaks-in-probe.patch @@ -0,0 +1,42 @@ +From 2730f4f98922db2a8ca372c5cf0e05b47dcf7fb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 14:33:26 +0300 +Subject: mfd: sm501: Fix leaks in probe() + +From: Dan Carpenter + +[ Upstream commit 8ce24f8967df2836b4557a23e74dc4bb098249f1 ] + +This code should clean up if sm501_init_dev() fails. + +Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") +Signed-off-by: Dan Carpenter +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/sm501.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c +index ccd62b9639528..6d2f4a0a901dc 100644 +--- a/drivers/mfd/sm501.c ++++ b/drivers/mfd/sm501.c +@@ -1415,8 +1415,14 @@ static int sm501_plat_probe(struct platform_device *dev) + goto err_claim; + } + +- return sm501_init_dev(sm); ++ ret = sm501_init_dev(sm); ++ if (ret) ++ goto err_unmap; ++ ++ return 0; + ++ err_unmap: ++ iounmap(sm->regs); + err_claim: + release_mem_region(sm->io_res->start, 0x100); + err_res: +-- +2.25.1 + diff --git a/queue-5.8/mic-vop-copy-data-to-kernel-space-then-write-to-io-m.patch b/queue-5.8/mic-vop-copy-data-to-kernel-space-then-write-to-io-m.patch new file mode 100644 index 00000000000..078772cd298 --- /dev/null +++ b/queue-5.8/mic-vop-copy-data-to-kernel-space-then-write-to-io-m.patch @@ -0,0 +1,63 @@ +From c7a14c9bc75c994fab39947dcab7969d89d64e60 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Sep 2020 17:11:06 +0800 +Subject: mic: vop: copy data to kernel space then write to io memory + +From: Sherry Sun + +[ Upstream commit 675f0ad4046946e80412896436164d172cd92238 ] + +Read and write io memory should address align on ARCH ARM. Change to use +memcpy_toio to avoid kernel panic caused by the address un-align issue. + +Signed-off-by: Sherry Sun +Signed-off-by: Joakim Zhang +Link: https://lore.kernel.org/r/20200929091106.24624-5-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/mic/vop/vop_vringh.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c +index 30eac172f0170..d069947b09345 100644 +--- a/drivers/misc/mic/vop/vop_vringh.c ++++ b/drivers/misc/mic/vop/vop_vringh.c +@@ -602,6 +602,7 @@ static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf, + size_t partlen; + bool dma = VOP_USE_DMA && vi->dma_ch; + int err = 0; ++ size_t offset = 0; + + if (dma) { + dma_alignment = 1 << vi->dma_ch->device->copy_align; +@@ -655,13 +656,20 @@ static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf, + * We are copying to IO below and should ideally use something + * like copy_from_user_toio(..) if it existed. + */ +- if (copy_from_user((void __force *)dbuf, ubuf, len)) { +- err = -EFAULT; +- dev_err(vop_dev(vdev), "%s %d err %d\n", +- __func__, __LINE__, err); +- goto err; ++ while (len) { ++ partlen = min_t(size_t, len, VOP_INT_DMA_BUF_SIZE); ++ ++ if (copy_from_user(vvr->buf, ubuf + offset, partlen)) { ++ err = -EFAULT; ++ dev_err(vop_dev(vdev), "%s %d err %d\n", ++ __func__, __LINE__, err); ++ goto err; ++ } ++ memcpy_toio(dbuf + offset, vvr->buf, partlen); ++ offset += partlen; ++ vdev->out_bytes += partlen; ++ len -= partlen; + } +- vdev->out_bytes += len; + err = 0; + err: + vpdev->hw_ops->unmap(vpdev, dbuf); +-- +2.25.1 + diff --git a/queue-5.8/microblaze-fix-kbuild-redundant-file-warning.patch b/queue-5.8/microblaze-fix-kbuild-redundant-file-warning.patch new file mode 100644 index 00000000000..a3dfcbcf447 --- /dev/null +++ b/queue-5.8/microblaze-fix-kbuild-redundant-file-warning.patch @@ -0,0 +1,42 @@ +From f493b8463205f58a966d905c501494cbadbbedbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Aug 2020 09:38:58 -0700 +Subject: microblaze: fix kbuild redundant file warning + +From: Randy Dunlap + +[ Upstream commit 4a17e8513376bb23f814d3e340a5692a12c69369 ] + +Fix build warning since this file is already listed in +include/asm-generic/Kbuild. + +../scripts/Makefile.asm-generic:25: redundant generic-y found in arch/microblaze/include/asm/Kbuild: hw_irq.h + +Fixes: 630f289b7114 ("asm-generic: make more kernel-space headers mandatory") +Signed-off-by: Randy Dunlap +Cc: Michal Simek +Cc: Michal Simek +Cc: Masahiro Yamada +Reviewed-by: Masahiro Yamada +Link: https://lore.kernel.org/r/4d992aee-8a69-1769-e622-8d6d6e316346@infradead.org +Signed-off-by: Michal Simek +Signed-off-by: Sasha Levin +--- + arch/microblaze/include/asm/Kbuild | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/microblaze/include/asm/Kbuild b/arch/microblaze/include/asm/Kbuild +index 2e87a9b6d312f..63bce836b9f10 100644 +--- a/arch/microblaze/include/asm/Kbuild ++++ b/arch/microblaze/include/asm/Kbuild +@@ -1,7 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 + generated-y += syscall_table.h + generic-y += extable.h +-generic-y += hw_irq.h + generic-y += kvm_para.h + generic-y += local64.h + generic-y += mcs_spinlock.h +-- +2.25.1 + diff --git a/queue-5.8/misc-mic-scif-fix-error-handling-path.patch b/queue-5.8/misc-mic-scif-fix-error-handling-path.patch new file mode 100644 index 00000000000..78298a57391 --- /dev/null +++ b/queue-5.8/misc-mic-scif-fix-error-handling-path.patch @@ -0,0 +1,65 @@ +From 0a92b57ffdd8a64facd2888f37753e9b1bab9c47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Sep 2020 08:21:35 +0530 +Subject: misc: mic: scif: Fix error handling path + +From: Souptick Joarder + +[ Upstream commit a81072a9c0ae734b7889929b0bc070fe3f353f0e ] + +Inside __scif_pin_pages(), when map_flags != SCIF_MAP_KERNEL it +will call pin_user_pages_fast() to map nr_pages. However, +pin_user_pages_fast() might fail with a return value -ERRNO. + +The return value is stored in pinned_pages->nr_pages. which in +turn is passed to unpin_user_pages(), which expects +pinned_pages->nr_pages >=0, else disaster. + +Fix this by assigning pinned_pages->nr_pages to 0 if +pin_user_pages_fast() returns -ERRNO. + +Fixes: ba612aa8b487 ("misc: mic: SCIF memory registration and unregistration") +Cc: John Hubbard +Cc: Ira Weiny +Cc: Dan Carpenter +Reviewed-by: John Hubbard +Signed-off-by: Souptick Joarder +Link: https://lore.kernel.org/r/1600570295-29546-1-git-send-email-jrdr.linux@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/mic/scif/scif_rma.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c +index 406cd5abfa726..56c784699eb8e 100644 +--- a/drivers/misc/mic/scif/scif_rma.c ++++ b/drivers/misc/mic/scif/scif_rma.c +@@ -1384,6 +1384,8 @@ int __scif_pin_pages(void *addr, size_t len, int *out_prot, + (prot & SCIF_PROT_WRITE) ? FOLL_WRITE : 0, + pinned_pages->pages); + if (nr_pages != pinned_pages->nr_pages) { ++ if (pinned_pages->nr_pages < 0) ++ pinned_pages->nr_pages = 0; + if (try_upgrade) { + if (ulimit) + __scif_dec_pinned_vm_lock(mm, nr_pages); +@@ -1400,7 +1402,6 @@ int __scif_pin_pages(void *addr, size_t len, int *out_prot, + + if (pinned_pages->nr_pages < nr_pages) { + err = -EFAULT; +- pinned_pages->nr_pages = nr_pages; + goto dec_pinned; + } + +@@ -1413,7 +1414,6 @@ int __scif_pin_pages(void *addr, size_t len, int *out_prot, + __scif_dec_pinned_vm_lock(mm, nr_pages); + /* Something went wrong! Rollback */ + error_unmap: +- pinned_pages->nr_pages = nr_pages; + scif_destroy_pinned_pages(pinned_pages); + *pages = NULL; + dev_dbg(scif_info.mdev.this_device, +-- +2.25.1 + diff --git a/queue-5.8/misc-rtsx-fix-memory-leak-in-rtsx_pci_probe.patch b/queue-5.8/misc-rtsx-fix-memory-leak-in-rtsx_pci_probe.patch new file mode 100644 index 00000000000..6599d1155e7 --- /dev/null +++ b/queue-5.8/misc-rtsx-fix-memory-leak-in-rtsx_pci_probe.patch @@ -0,0 +1,46 @@ +From ef0ad6b563c9d099271c974b4ed372a4a63f375b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 07:18:51 +0000 +Subject: misc: rtsx: Fix memory leak in rtsx_pci_probe + +From: Keita Suzuki + +[ Upstream commit bc28369c6189009b66d9619dd9f09bd8c684bb98 ] + +When mfd_add_devices() fail, pcr->slots should also be freed. However, +the current implementation does not free the member, leading to a memory +leak. + +Fix this by adding a new goto label that frees pcr->slots. + +Signed-off-by: Keita Suzuki +Link: https://lore.kernel.org/r/20200909071853.4053-1-keitasuzuki.park@sslab.ics.keio.ac.jp +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/cardreader/rtsx_pcr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/cardreader/rtsx_pcr.c b/drivers/misc/cardreader/rtsx_pcr.c +index 0d5928bc1b6d7..82246f7aec6fb 100644 +--- a/drivers/misc/cardreader/rtsx_pcr.c ++++ b/drivers/misc/cardreader/rtsx_pcr.c +@@ -1536,12 +1536,14 @@ static int rtsx_pci_probe(struct pci_dev *pcidev, + ret = mfd_add_devices(&pcidev->dev, pcr->id, rtsx_pcr_cells, + ARRAY_SIZE(rtsx_pcr_cells), NULL, 0, NULL); + if (ret < 0) +- goto disable_irq; ++ goto free_slots; + + schedule_delayed_work(&pcr->idle_work, msecs_to_jiffies(200)); + + return 0; + ++free_slots: ++ kfree(pcr->slots); + disable_irq: + free_irq(pcr->irq, (void *)pcr); + disable_msi: +-- +2.25.1 + diff --git a/queue-5.8/misc-vop-add-round_up-x-4-for-vring_size-to-avoid-ke.patch b/queue-5.8/misc-vop-add-round_up-x-4-for-vring_size-to-avoid-ke.patch new file mode 100644 index 00000000000..eae138b6abb --- /dev/null +++ b/queue-5.8/misc-vop-add-round_up-x-4-for-vring_size-to-avoid-ke.patch @@ -0,0 +1,91 @@ +From 3ee562c0addf85ccd69481269012a1fdda17aaf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Sep 2020 17:11:05 +0800 +Subject: misc: vop: add round_up(x,4) for vring_size to avoid kernel panic + +From: Sherry Sun + +[ Upstream commit cc1a2679865a94b83804822996eed010a50a7c1d ] + +Since struct _mic_vring_info and vring are allocated together and follow +vring, if the vring_size() is not four bytes aligned, which will cause +the start address of struct _mic_vring_info is not four byte aligned. +For example, when vring entries is 128, the vring_size() will be 5126 +bytes. The _mic_vring_info struct layout in ddr looks like: +0x90002400: 00000000 00390000 EE010000 0000C0FF +Here 0x39 is the avail_idx member, and 0xC0FFEE01 is the magic member. + +When EP use ioread32(magic) to reads the magic in RC's share memory, it +will cause kernel panic on ARM64 platform due to the cross-byte io read. +Here read magic in user space use le32toh(vr0->info->magic) will meet +the same issue. +So add round_up(x,4) for vring_size, then the struct _mic_vring_info +will store in this way: +0x90002400: 00000000 00000000 00000039 C0FFEE01 +Which will avoid kernel panic when read magic in struct _mic_vring_info. + +Signed-off-by: Sherry Sun +Signed-off-by: Joakim Zhang +Link: https://lore.kernel.org/r/20200929091106.24624-4-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/mic/vop/vop_main.c | 2 +- + drivers/misc/mic/vop/vop_vringh.c | 4 ++-- + samples/mic/mpssd/mpssd.c | 4 ++-- + 3 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c +index 85942f6717c57..8aadc6055df17 100644 +--- a/drivers/misc/mic/vop/vop_main.c ++++ b/drivers/misc/mic/vop/vop_main.c +@@ -320,7 +320,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev, + /* First assign the vring's allocated in host memory */ + vqconfig = _vop_vq_config(vdev->desc) + index; + memcpy_fromio(&config, vqconfig, sizeof(config)); +- _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN); ++ _vr_size = round_up(vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN), 4); + vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info)); + va = vpdev->hw_ops->remap(vpdev, le64_to_cpu(config.address), vr_size); + if (!va) +diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c +index d069947b09345..7014ffe88632e 100644 +--- a/drivers/misc/mic/vop/vop_vringh.c ++++ b/drivers/misc/mic/vop/vop_vringh.c +@@ -296,7 +296,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev, + + num = le16_to_cpu(vqconfig[i].num); + mutex_init(&vvr->vr_mutex); +- vr_size = PAGE_ALIGN(vring_size(num, MIC_VIRTIO_RING_ALIGN) + ++ vr_size = PAGE_ALIGN(round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4) + + sizeof(struct _mic_vring_info)); + vr->va = (void *) + __get_free_pages(GFP_KERNEL | __GFP_ZERO, +@@ -308,7 +308,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev, + goto err; + } + vr->len = vr_size; +- vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN); ++ vr->info = vr->va + round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4); + vr->info->magic = cpu_to_le32(MIC_MAGIC + vdev->virtio_id + i); + vr_addr = dma_map_single(&vpdev->dev, vr->va, vr_size, + DMA_BIDIRECTIONAL); +diff --git a/samples/mic/mpssd/mpssd.c b/samples/mic/mpssd/mpssd.c +index a11bf6c5b53b4..cd3f16a6f5caf 100644 +--- a/samples/mic/mpssd/mpssd.c ++++ b/samples/mic/mpssd/mpssd.c +@@ -403,9 +403,9 @@ mic_virtio_copy(struct mic_info *mic, int fd, + + static inline unsigned _vring_size(unsigned int num, unsigned long align) + { +- return ((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num) ++ return _ALIGN_UP(((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num) + + align - 1) & ~(align - 1)) +- + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num; ++ + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num, 4); + } + + /* +-- +2.25.1 + diff --git a/queue-5.8/mm-error_inject-fix-allow_error_inject-function-sign.patch b/queue-5.8/mm-error_inject-fix-allow_error_inject-function-sign.patch new file mode 100644 index 00000000000..d61751b9ae5 --- /dev/null +++ b/queue-5.8/mm-error_inject-fix-allow_error_inject-function-sign.patch @@ -0,0 +1,67 @@ +From 86bea7fababae11e35ee868fc5630ad5cc5b18c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 15:01:10 -0700 +Subject: mm/error_inject: Fix allow_error_inject function signatures. + +From: Alexei Starovoitov + +[ Upstream commit 76cd61739fd107a7f7ec4c24a045e98d8ee150f0 ] + +'static' and 'static noinline' function attributes make no guarantees that +gcc/clang won't optimize them. The compiler may decide to inline 'static' +function and in such case ALLOW_ERROR_INJECT becomes meaningless. The compiler +could have inlined __add_to_page_cache_locked() in one callsite and didn't +inline in another. In such case injecting errors into it would cause +unpredictable behavior. It's worse with 'static noinline' which won't be +inlined, but it still can be optimized. Like the compiler may decide to remove +one argument or constant propagate the value depending on the callsite. + +To avoid such issues make sure that these functions are global noinline. + +Fixes: af3b854492f3 ("mm/page_alloc.c: allow error injection") +Fixes: cfcbfb1382db ("mm/filemap.c: enable error injection at add_to_page_cache()") +Signed-off-by: Alexei Starovoitov +Signed-off-by: Daniel Borkmann +Reviewed-by: Josef Bacik +Link: https://lore.kernel.org/bpf/20200827220114.69225-2-alexei.starovoitov@gmail.com +Signed-off-by: Sasha Levin +--- + mm/filemap.c | 8 ++++---- + mm/page_alloc.c | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/mm/filemap.c b/mm/filemap.c +index 385759c4ce4be..6c3b879116212 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -826,10 +826,10 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask) + } + EXPORT_SYMBOL_GPL(replace_page_cache_page); + +-static int __add_to_page_cache_locked(struct page *page, +- struct address_space *mapping, +- pgoff_t offset, gfp_t gfp_mask, +- void **shadowp) ++noinline int __add_to_page_cache_locked(struct page *page, ++ struct address_space *mapping, ++ pgoff_t offset, gfp_t gfp_mask, ++ void **shadowp) + { + XA_STATE(xas, &mapping->i_pages, offset); + int huge = PageHuge(page); +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 43f6d91f57156..802f00540a3d2 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -3487,7 +3487,7 @@ static inline bool __should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) + + #endif /* CONFIG_FAIL_PAGE_ALLOC */ + +-static noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) ++noinline bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) + { + return __should_fail_alloc_page(gfp_mask, order); + } +-- +2.25.1 + diff --git a/queue-5.8/mm-memcg-fix-device-private-memcg-accounting.patch b/queue-5.8/mm-memcg-fix-device-private-memcg-accounting.patch new file mode 100644 index 00000000000..7df45b9bc46 --- /dev/null +++ b/queue-5.8/mm-memcg-fix-device-private-memcg-accounting.patch @@ -0,0 +1,61 @@ +From ed74db9498f996510e072fc6bf9cc7d373fb65e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 16:53:13 -0700 +Subject: mm/memcg: fix device private memcg accounting + +From: Ralph Campbell + +[ Upstream commit 9a137153fc8798a89d8fce895cd0a06ea5b8e37c ] + +The code in mc_handle_swap_pte() checks for non_swap_entry() and returns +NULL before checking is_device_private_entry() so device private pages are +never handled. Fix this by checking for non_swap_entry() after handling +device private swap PTEs. + +I assume the memory cgroup accounting would be off somehow when moving +a process to another memory cgroup. Currently, the device private page +is charged like a normal anonymous page when allocated and is uncharged +when the page is freed so I think that path is OK. + +Signed-off-by: Ralph Campbell +Signed-off-by: Andrew Morton +Acked-by: Johannes Weiner +Cc: Michal Hocko +Cc: Vladimir Davydov +Cc: Jerome Glisse +Cc: Balbir Singh +Cc: Ira Weiny +Link: https://lkml.kernel.org/r/20201009215952.2726-1-rcampbell@nvidia.com +xFixes: c733a82874a7 ("mm/memcontrol: support MEMORY_DEVICE_PRIVATE") +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/memcontrol.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 13f559af1ab6a..6795bdf662566 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -5276,7 +5276,7 @@ static struct page *mc_handle_swap_pte(struct vm_area_struct *vma, + struct page *page = NULL; + swp_entry_t ent = pte_to_swp_entry(ptent); + +- if (!(mc.flags & MOVE_ANON) || non_swap_entry(ent)) ++ if (!(mc.flags & MOVE_ANON)) + return NULL; + + /* +@@ -5295,6 +5295,9 @@ static struct page *mc_handle_swap_pte(struct vm_area_struct *vma, + return page; + } + ++ if (non_swap_entry(ent)) ++ return NULL; ++ + /* + * Because lookup_swap_cache() updates some statistics counter, + * we call find_get_page() with swapper_space directly. +-- +2.25.1 + diff --git a/queue-5.8/mm-mmu_notifier-fix-mmget-assert-in-__mmu_interval_n.patch b/queue-5.8/mm-mmu_notifier-fix-mmget-assert-in-__mmu_interval_n.patch new file mode 100644 index 00000000000..9cfb08a5605 --- /dev/null +++ b/queue-5.8/mm-mmu_notifier-fix-mmget-assert-in-__mmu_interval_n.patch @@ -0,0 +1,49 @@ +From fe5cb9c1da4800f1d8411f22cb03bf982e3f5e7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 20:07:43 -0700 +Subject: mm/mmu_notifier: fix mmget() assert in __mmu_interval_notifier_insert +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jann Horn + +[ Upstream commit c9682d10271e1025ebfbb1675c7afffbef5c6856 ] + +The comment talks about having to hold mmget() (which means mm_users), but +the actual check is on mm_count (which would be mmgrab()). + +Given that MMU notifiers are torn down in mmput() -> __mmput() -> +exit_mmap() -> mmu_notifier_release(), I believe that the comment is +correct and the check should be on mm->mm_users. Fix it up accordingly. + +Fixes: 99cb252f5e68 ("mm/mmu_notifier: add an interval tree notifier") +Signed-off-by: Jann Horn +Signed-off-by: Andrew Morton +Reviewed-by: Jason Gunthorpe +Cc: John Hubbard +Cc: Christoph Hellwig +Cc: Christian König +Signed-off-by: Sasha Levin +--- + mm/mmu_notifier.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/mm/mmu_notifier.c b/mm/mmu_notifier.c +index 352bb9f3ecc02..0d31b4ee63c04 100644 +--- a/mm/mmu_notifier.c ++++ b/mm/mmu_notifier.c +@@ -913,7 +913,7 @@ static int __mmu_interval_notifier_insert( + return -EOVERFLOW; + + /* Must call with a mmget() held */ +- if (WARN_ON(atomic_read(&mm->mm_count) <= 0)) ++ if (WARN_ON(atomic_read(&mm->mm_users) <= 0)) + return -EINVAL; + + /* pairs with mmdrop in mmu_interval_notifier_remove() */ +-- +2.25.1 + diff --git a/queue-5.8/mm-oom_adj-don-t-loop-through-tasks-in-__set_oom_adj.patch b/queue-5.8/mm-oom_adj-don-t-loop-through-tasks-in-__set_oom_adj.patch new file mode 100644 index 00000000000..a885e1701cf --- /dev/null +++ b/queue-5.8/mm-oom_adj-don-t-loop-through-tasks-in-__set_oom_adj.patch @@ -0,0 +1,187 @@ +From 3102a09533b12c06d419d9f0664c849b67b9a341 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 16:58:35 -0700 +Subject: mm, oom_adj: don't loop through tasks in __set_oom_adj when not + necessary + +From: Suren Baghdasaryan + +[ Upstream commit 67197a4f28d28d0b073ab0427b03cb2ee5382578 ] + +Currently __set_oom_adj loops through all processes in the system to keep +oom_score_adj and oom_score_adj_min in sync between processes sharing +their mm. This is done for any task with more that one mm_users, which +includes processes with multiple threads (sharing mm and signals). +However for such processes the loop is unnecessary because their signal +structure is shared as well. + +Android updates oom_score_adj whenever a tasks changes its role +(background/foreground/...) or binds to/unbinds from a service, making it +more/less important. Such operation can happen frequently. We noticed +that updates to oom_score_adj became more expensive and after further +investigation found out that the patch mentioned in "Fixes" introduced a +regression. Using Pixel 4 with a typical Android workload, write time to +oom_score_adj increased from ~3.57us to ~362us. Moreover this regression +linearly depends on the number of multi-threaded processes running on the +system. + +Mark the mm with a new MMF_MULTIPROCESS flag bit when task is created with +(CLONE_VM && !CLONE_THREAD && !CLONE_VFORK). Change __set_oom_adj to use +MMF_MULTIPROCESS instead of mm_users to decide whether oom_score_adj +update should be synchronized between multiple processes. To prevent +races between clone() and __set_oom_adj(), when oom_score_adj of the +process being cloned might be modified from userspace, we use +oom_adj_mutex. Its scope is changed to global. + +The combination of (CLONE_VM && !CLONE_THREAD) is rarely used except for +the case of vfork(). To prevent performance regressions of vfork(), we +skip taking oom_adj_mutex and setting MMF_MULTIPROCESS when CLONE_VFORK is +specified. Clearing the MMF_MULTIPROCESS flag (when the last process +sharing the mm exits) is left out of this patch to keep it simple and +because it is believed that this threading model is rare. Should there +ever be a need for optimizing that case as well, it can be done by hooking +into the exit path, likely following the mm_update_next_owner pattern. + +With the combination of (CLONE_VM && !CLONE_THREAD && !CLONE_VFORK) being +quite rare, the regression is gone after the change is applied. + +[surenb@google.com: v3] + Link: https://lkml.kernel.org/r/20200902012558.2335613-1-surenb@google.com + +Fixes: 44a70adec910 ("mm, oom_adj: make sure processes sharing mm have same view of oom_score_adj") +Reported-by: Tim Murray +Suggested-by: Michal Hocko +Signed-off-by: Suren Baghdasaryan +Signed-off-by: Andrew Morton +Acked-by: Christian Brauner +Acked-by: Michal Hocko +Acked-by: Oleg Nesterov +Cc: Ingo Molnar +Cc: Peter Zijlstra +Cc: Thomas Gleixner +Cc: Eugene Syromiatnikov +Cc: Christian Kellner +Cc: Adrian Reber +Cc: Shakeel Butt +Cc: Aleksa Sarai +Cc: Alexey Dobriyan +Cc: "Eric W. Biederman" +Cc: Alexey Gladkov +Cc: Michel Lespinasse +Cc: Daniel Jordan +Cc: Andrei Vagin +Cc: Bernd Edlinger +Cc: John Johansen +Cc: Yafang Shao +Link: https://lkml.kernel.org/r/20200824153036.3201505-1-surenb@google.com +Debugged-by: Minchan Kim +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/proc/base.c | 3 +-- + include/linux/oom.h | 1 + + include/linux/sched/coredump.h | 1 + + kernel/fork.c | 21 +++++++++++++++++++++ + mm/oom_kill.c | 2 ++ + 5 files changed, 26 insertions(+), 2 deletions(-) + +diff --git a/fs/proc/base.c b/fs/proc/base.c +index d86c0afc8a859..297ff606ae0f6 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -1046,7 +1046,6 @@ static ssize_t oom_adj_read(struct file *file, char __user *buf, size_t count, + + static int __set_oom_adj(struct file *file, int oom_adj, bool legacy) + { +- static DEFINE_MUTEX(oom_adj_mutex); + struct mm_struct *mm = NULL; + struct task_struct *task; + int err = 0; +@@ -1086,7 +1085,7 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy) + struct task_struct *p = find_lock_task_mm(task); + + if (p) { +- if (atomic_read(&p->mm->mm_users) > 1) { ++ if (test_bit(MMF_MULTIPROCESS, &p->mm->flags)) { + mm = p->mm; + mmgrab(mm); + } +diff --git a/include/linux/oom.h b/include/linux/oom.h +index c696c265f0193..b9df34326772c 100644 +--- a/include/linux/oom.h ++++ b/include/linux/oom.h +@@ -55,6 +55,7 @@ struct oom_control { + }; + + extern struct mutex oom_lock; ++extern struct mutex oom_adj_mutex; + + static inline void set_current_oom_origin(void) + { +diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h +index ecdc6542070f1..dfd82eab29025 100644 +--- a/include/linux/sched/coredump.h ++++ b/include/linux/sched/coredump.h +@@ -72,6 +72,7 @@ static inline int get_dumpable(struct mm_struct *mm) + #define MMF_DISABLE_THP 24 /* disable THP for all VMAs */ + #define MMF_OOM_VICTIM 25 /* mm is the oom victim */ + #define MMF_OOM_REAP_QUEUED 26 /* mm was queued for oom_reaper */ ++#define MMF_MULTIPROCESS 27 /* mm is shared between processes */ + #define MMF_DISABLE_THP_MASK (1 << MMF_DISABLE_THP) + + #define MMF_INIT_MASK (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\ +diff --git a/kernel/fork.c b/kernel/fork.c +index efc5493203ae0..0074bbe8c66f1 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1830,6 +1830,25 @@ static __always_inline void delayed_free_task(struct task_struct *tsk) + free_task(tsk); + } + ++static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk) ++{ ++ /* Skip if kernel thread */ ++ if (!tsk->mm) ++ return; ++ ++ /* Skip if spawning a thread or using vfork */ ++ if ((clone_flags & (CLONE_VM | CLONE_THREAD | CLONE_VFORK)) != CLONE_VM) ++ return; ++ ++ /* We need to synchronize with __set_oom_adj */ ++ mutex_lock(&oom_adj_mutex); ++ set_bit(MMF_MULTIPROCESS, &tsk->mm->flags); ++ /* Update the values in case they were changed after copy_signal */ ++ tsk->signal->oom_score_adj = current->signal->oom_score_adj; ++ tsk->signal->oom_score_adj_min = current->signal->oom_score_adj_min; ++ mutex_unlock(&oom_adj_mutex); ++} ++ + /* + * This creates a new process as a copy of the old one, + * but does not actually start it yet. +@@ -2310,6 +2329,8 @@ static __latent_entropy struct task_struct *copy_process( + trace_task_newtask(p, clone_flags); + uprobe_copy_process(p, clone_flags); + ++ copy_oom_score_adj(clone_flags, p); ++ + return p; + + bad_fork_cancel_cgroup: +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index 6e94962893ee8..67e5bb0900b37 100644 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -64,6 +64,8 @@ int sysctl_oom_dump_tasks = 1; + * and mark_oom_victim + */ + DEFINE_MUTEX(oom_lock); ++/* Serializes oom_score_adj and oom_score_adj_min updates */ ++DEFINE_MUTEX(oom_adj_mutex); + + static inline bool is_memcg_oom(struct oom_control *oc) + { +-- +2.25.1 + diff --git a/queue-5.8/mm-page_owner-change-split_page_owner-to-take-a-coun.patch b/queue-5.8/mm-page_owner-change-split_page_owner-to-take-a-coun.patch new file mode 100644 index 00000000000..2fe3b959614 --- /dev/null +++ b/queue-5.8/mm-page_owner-change-split_page_owner-to-take-a-coun.patch @@ -0,0 +1,106 @@ +From 5f71e4401fdd89fd524c1fbf77dfcb5aa5f23e00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 20:05:29 -0700 +Subject: mm/page_owner: change split_page_owner to take a count + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 8fb156c9ee2db94f7127c930c89917634a1a9f56 ] + +The implementation of split_page_owner() prefers a count rather than the +old order of the page. When we support a variable size THP, we won't +have the order at this point, but we will have the number of pages. +So change the interface to what the caller and callee would prefer. + +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Andrew Morton +Reviewed-by: SeongJae Park +Acked-by: Kirill A. Shutemov +Cc: Huang Ying +Link: https://lkml.kernel.org/r/20200908195539.25896-4-willy@infradead.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + include/linux/page_owner.h | 6 +++--- + mm/huge_memory.c | 2 +- + mm/page_alloc.c | 2 +- + mm/page_owner.c | 4 ++-- + 4 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/include/linux/page_owner.h b/include/linux/page_owner.h +index 8679ccd722e89..3468794f83d23 100644 +--- a/include/linux/page_owner.h ++++ b/include/linux/page_owner.h +@@ -11,7 +11,7 @@ extern struct page_ext_operations page_owner_ops; + extern void __reset_page_owner(struct page *page, unsigned int order); + extern void __set_page_owner(struct page *page, + unsigned int order, gfp_t gfp_mask); +-extern void __split_page_owner(struct page *page, unsigned int order); ++extern void __split_page_owner(struct page *page, unsigned int nr); + extern void __copy_page_owner(struct page *oldpage, struct page *newpage); + extern void __set_page_owner_migrate_reason(struct page *page, int reason); + extern void __dump_page_owner(struct page *page); +@@ -31,10 +31,10 @@ static inline void set_page_owner(struct page *page, + __set_page_owner(page, order, gfp_mask); + } + +-static inline void split_page_owner(struct page *page, unsigned int order) ++static inline void split_page_owner(struct page *page, unsigned int nr) + { + if (static_branch_unlikely(&page_owner_inited)) +- __split_page_owner(page, order); ++ __split_page_owner(page, nr); + } + static inline void copy_page_owner(struct page *oldpage, struct page *newpage) + { +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 74300e337c3c7..358403422104b 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2449,7 +2449,7 @@ static void __split_huge_page(struct page *page, struct list_head *list, + + ClearPageCompound(head); + +- split_page_owner(head, HPAGE_PMD_ORDER); ++ split_page_owner(head, HPAGE_PMD_NR); + + /* See comment in __split_huge_page_tail() */ + if (PageAnon(head)) { +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 802f00540a3d2..8cc774340d490 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -3213,7 +3213,7 @@ void split_page(struct page *page, unsigned int order) + + for (i = 1; i < (1 << order); i++) + set_page_refcounted(page + i); +- split_page_owner(page, order); ++ split_page_owner(page, 1 << order); + } + EXPORT_SYMBOL_GPL(split_page); + +diff --git a/mm/page_owner.c b/mm/page_owner.c +index 3604615094235..4ca3051a10358 100644 +--- a/mm/page_owner.c ++++ b/mm/page_owner.c +@@ -204,7 +204,7 @@ void __set_page_owner_migrate_reason(struct page *page, int reason) + page_owner->last_migrate_reason = reason; + } + +-void __split_page_owner(struct page *page, unsigned int order) ++void __split_page_owner(struct page *page, unsigned int nr) + { + int i; + struct page_ext *page_ext = lookup_page_ext(page); +@@ -213,7 +213,7 @@ void __split_page_owner(struct page *page, unsigned int order) + if (unlikely(!page_ext)) + return; + +- for (i = 0; i < (1 << order); i++) { ++ for (i = 0; i < nr; i++) { + page_owner = get_page_owner(page_ext); + page_owner->order = 0; + page_ext = page_ext_next(page_ext); +-- +2.25.1 + diff --git a/queue-5.8/mm-swapfile.c-fix-potential-memory-leak-in-sys_swapo.patch b/queue-5.8/mm-swapfile.c-fix-potential-memory-leak-in-sys_swapo.patch new file mode 100644 index 00000000000..2e55ebde6a0 --- /dev/null +++ b/queue-5.8/mm-swapfile.c-fix-potential-memory-leak-in-sys_swapo.patch @@ -0,0 +1,48 @@ +From 349e1dc06e41062460bff7c653dfc6f0d2ae7519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 16:52:30 -0700 +Subject: mm/swapfile.c: fix potential memory leak in sys_swapon + +From: Miaohe Lin + +[ Upstream commit 822bca52ee7eb279acfba261a423ed7ac47d6f73 ] + +If we failed to drain inode, we would forget to free the swap address +space allocated by init_swap_address_space() above. + +Fixes: dc617f29dbe5 ("vfs: don't allow writes to swap files") +Signed-off-by: Miaohe Lin +Signed-off-by: Andrew Morton +Reviewed-by: Darrick J. Wong +Link: https://lkml.kernel.org/r/20200930101803.53884-1-linmiaohe@huawei.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/swapfile.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 26707c5dc9fce..605294e4df684 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -3336,7 +3336,7 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) + error = inode_drain_writes(inode); + if (error) { + inode->i_flags &= ~S_SWAPFILE; +- goto bad_swap_unlock_inode; ++ goto free_swap_address_space; + } + + mutex_lock(&swapon_mutex); +@@ -3361,6 +3361,8 @@ SYSCALL_DEFINE2(swapon, const char __user *, specialfile, int, swap_flags) + + error = 0; + goto out; ++free_swap_address_space: ++ exit_swap_address_space(p->type); + bad_swap_unlock_inode: + inode_unlock(inode); + bad_swap: +-- +2.25.1 + diff --git a/queue-5.8/mmc-sdio-check-for-cistpl_vers_1-buffer-size.patch b/queue-5.8/mmc-sdio-check-for-cistpl_vers_1-buffer-size.patch new file mode 100644 index 00000000000..a69aaa08973 --- /dev/null +++ b/queue-5.8/mmc-sdio-check-for-cistpl_vers_1-buffer-size.patch @@ -0,0 +1,40 @@ +From dedfb23fd04cbf6d3430241323e244c2150f1c1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Jul 2020 15:38:34 +0200 +Subject: mmc: sdio: Check for CISTPL_VERS_1 buffer size +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 8ebe2607965d3e2dc02029e8c7dd35fbe508ffd0 ] + +Before parsing CISTPL_VERS_1 structure check that its size is at least two +bytes to prevent buffer overflow. + +Signed-off-by: Pali Rohár +Link: https://lore.kernel.org/r/20200727133837.19086-2-pali@kernel.org +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/sdio_cis.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c +index e0655278c5c32..3efaa9534a777 100644 +--- a/drivers/mmc/core/sdio_cis.c ++++ b/drivers/mmc/core/sdio_cis.c +@@ -26,6 +26,9 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func, + unsigned i, nr_strings; + char **buffer, *string; + ++ if (size < 2) ++ return 0; ++ + /* Find all null-terminated (including zero length) strings in + the TPLLV1_INFO field. Trailing garbage is ignored. */ + buf += 2; +-- +2.25.1 + diff --git a/queue-5.8/module-statically-initialize-init-section-freeing-da.patch b/queue-5.8/module-statically-initialize-init-section-freeing-da.patch new file mode 100644 index 00000000000..0be19670b3c --- /dev/null +++ b/queue-5.8/module-statically-initialize-init-section-freeing-da.patch @@ -0,0 +1,89 @@ +From 25ef7d34d8d0829a821aabfc010465b6431ec50a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 13:32:20 -0400 +Subject: module: statically initialize init section freeing data + +From: Daniel Jordan + +[ Upstream commit fdf09ab887829cd1b671e45d9549f8ec1ffda0fa ] + +Corentin hit the following workqueue warning when running with +CRYPTO_MANAGER_EXTRA_TESTS: + + WARNING: CPU: 2 PID: 147 at kernel/workqueue.c:1473 __queue_work+0x3b8/0x3d0 + Modules linked in: ghash_generic + CPU: 2 PID: 147 Comm: modprobe Not tainted + 5.6.0-rc1-next-20200214-00068-g166c9264f0b1-dirty #545 + Hardware name: Pine H64 model A (DT) + pc : __queue_work+0x3b8/0x3d0 + Call trace: + __queue_work+0x3b8/0x3d0 + queue_work_on+0x6c/0x90 + do_init_module+0x188/0x1f0 + load_module+0x1d00/0x22b0 + +I wasn't able to reproduce on x86 or rpi 3b+. + +This is + + WARN_ON(!list_empty(&work->entry)) + +from __queue_work(), and it happens because the init_free_wq work item +isn't initialized in time for a crypto test that requests the gcm +module. Some crypto tests were recently moved earlier in boot as +explained in commit c4741b230597 ("crypto: run initcalls for generic +implementations earlier"), which went into mainline less than two weeks +before the Fixes commit. + +Avoid the warning by statically initializing init_free_wq and the +corresponding llist. + +Link: https://lore.kernel.org/lkml/20200217204803.GA13479@Red/ +Fixes: 1a7b7d922081 ("modules: Use vmalloc special flag") +Reported-by: Corentin Labbe +Tested-by: Corentin Labbe +Tested-on: sun50i-h6-pine-h64 +Tested-on: imx8mn-ddr4-evk +Tested-on: sun50i-a64-bananapi-m64 +Reviewed-by: Eric Biggers +Signed-off-by: Daniel Jordan +Signed-off-by: Jessica Yu +Signed-off-by: Sasha Levin +--- + kernel/module.c | 13 +++---------- + 1 file changed, 3 insertions(+), 10 deletions(-) + +diff --git a/kernel/module.c b/kernel/module.c +index 08c46084d8cca..991395d60f59c 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -91,8 +91,9 @@ EXPORT_SYMBOL_GPL(module_mutex); + static LIST_HEAD(modules); + + /* Work queue for freeing init sections in success case */ +-static struct work_struct init_free_wq; +-static struct llist_head init_free_list; ++static void do_free_init(struct work_struct *w); ++static DECLARE_WORK(init_free_wq, do_free_init); ++static LLIST_HEAD(init_free_list); + + #ifdef CONFIG_MODULES_TREE_LOOKUP + +@@ -3551,14 +3552,6 @@ static void do_free_init(struct work_struct *w) + } + } + +-static int __init modules_wq_init(void) +-{ +- INIT_WORK(&init_free_wq, do_free_init); +- init_llist_head(&init_free_list); +- return 0; +-} +-module_init(modules_wq_init); +- + /* + * This is where the real work happens. + * +-- +2.25.1 + diff --git a/queue-5.8/mt76-mt7915-fix-possible-memory-leak-in-mt7915_mcu_a.patch b/queue-5.8/mt76-mt7915-fix-possible-memory-leak-in-mt7915_mcu_a.patch new file mode 100644 index 00000000000..11a4247b008 --- /dev/null +++ b/queue-5.8/mt76-mt7915-fix-possible-memory-leak-in-mt7915_mcu_a.patch @@ -0,0 +1,59 @@ +From 24d49061bdd9232bee36cf8259def4edd47b4cff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 20:29:01 +0200 +Subject: mt76: mt7915: fix possible memory leak in mt7915_mcu_add_beacon + +From: Lorenzo Bianconi + +[ Upstream commit 071c8ce8e92a86b8bf78678e78eb4b79fdc16768 ] + +Release mcu message memory in case of failure in mt7915_mcu_add_beacon +routine + +Fixes: e57b7901469fc ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt7915/mcu.c | 18 ++++++++++-------- + 1 file changed, 10 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index 8fb8255650a7e..6969579e6b1dd 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -2267,14 +2267,6 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, + struct bss_info_bcn *bcn; + int len = MT7915_BEACON_UPDATE_SIZE + MAX_BEACON_SIZE; + +- rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len); +- if (IS_ERR(rskb)) +- return PTR_ERR(rskb); +- +- tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn)); +- bcn = (struct bss_info_bcn *)tlv; +- bcn->enable = en; +- + skb = ieee80211_beacon_get_template(hw, vif, &offs); + if (!skb) + return -EINVAL; +@@ -2285,6 +2277,16 @@ int mt7915_mcu_add_beacon(struct ieee80211_hw *hw, + return -EINVAL; + } + ++ rskb = mt7915_mcu_alloc_sta_req(dev, mvif, NULL, len); ++ if (IS_ERR(rskb)) { ++ dev_kfree_skb(skb); ++ return PTR_ERR(rskb); ++ } ++ ++ tlv = mt7915_mcu_add_tlv(rskb, BSS_INFO_OFFLOAD, sizeof(*bcn)); ++ bcn = (struct bss_info_bcn *)tlv; ++ bcn->enable = en; ++ + if (mvif->band_idx) { + info = IEEE80211_SKB_CB(skb); + info->hw_queue |= MT_TX_HW_QUEUE_EXT_PHY; +-- +2.25.1 + diff --git a/queue-5.8/mtd-hyperbus-hbmc-am654-fix-direct-mapping-setup-fla.patch b/queue-5.8/mtd-hyperbus-hbmc-am654-fix-direct-mapping-setup-fla.patch new file mode 100644 index 00000000000..e8b4f3002dc --- /dev/null +++ b/queue-5.8/mtd-hyperbus-hbmc-am654-fix-direct-mapping-setup-fla.patch @@ -0,0 +1,45 @@ +From 1f792903e1f5b28cd150a3682ebf7a494e451fe0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 13:42:12 +0530 +Subject: mtd: hyperbus: hbmc-am654: Fix direct mapping setup flash access + +From: Vignesh Raghavendra + +[ Upstream commit aca31ce96814c84d1a41aaa109c15abe61005af7 ] + +Setting up of direct mapping should be done with flash node's IO +address space and not with controller's IO region. + +Fixes: b6fe8bc67d2d3 ("mtd: hyperbus: move direct mapping setup to AM654 HBMC driver") +Signed-off-by: Vignesh Raghavendra +Link: https://lore.kernel.org/r/20200924081214.16934-3-vigneshr@ti.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/hyperbus/hbmc-am654.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/hyperbus/hbmc-am654.c b/drivers/mtd/hyperbus/hbmc-am654.c +index f350a0809f880..a808fa28cd9a1 100644 +--- a/drivers/mtd/hyperbus/hbmc-am654.c ++++ b/drivers/mtd/hyperbus/hbmc-am654.c +@@ -70,7 +70,8 @@ static int am654_hbmc_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, priv); + +- ret = of_address_to_resource(np, 0, &res); ++ priv->hbdev.np = of_get_next_child(np, NULL); ++ ret = of_address_to_resource(priv->hbdev.np, 0, &res); + if (ret) + return ret; + +@@ -103,7 +104,6 @@ static int am654_hbmc_probe(struct platform_device *pdev) + priv->ctlr.dev = dev; + priv->ctlr.ops = &am654_hbmc_ops; + priv->hbdev.ctlr = &priv->ctlr; +- priv->hbdev.np = of_get_next_child(dev->of_node, NULL); + ret = hyperbus_register_device(&priv->hbdev); + if (ret) { + dev_err(dev, "failed to register controller\n"); +-- +2.25.1 + diff --git a/queue-5.8/mtd-lpddr-fix-excessive-stack-usage-with-clang.patch b/queue-5.8/mtd-lpddr-fix-excessive-stack-usage-with-clang.patch new file mode 100644 index 00000000000..76be58ffed0 --- /dev/null +++ b/queue-5.8/mtd-lpddr-fix-excessive-stack-usage-with-clang.patch @@ -0,0 +1,96 @@ +From 1e09dce10415c1f2127dc04e62aad6476e967041 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 May 2020 16:01:16 +0200 +Subject: mtd: lpddr: fix excessive stack usage with clang + +From: Arnd Bergmann + +[ Upstream commit 3e1b6469f8324bee5927b063e2aca30d3e56b907 ] + +Building lpddr2_nvm with clang can result in a giant stack usage +in one function: + +drivers/mtd/lpddr/lpddr2_nvm.c:399:12: error: stack frame size of 1144 bytes in function 'lpddr2_nvm_probe' [-Werror,-Wframe-larger-than=] + +The problem is that clang decides to build a copy of the mtd_info +structure on the stack and then do a memcpy() into the actual version. It +shouldn't really do it that way, but it's not strictly a bug either. + +As a workaround, use a static const version of the structure to assign +most of the members upfront and then only set the few members that +require runtime knowledge at probe time. + +Fixes: 96ba9dd65788 ("mtd: lpddr: add driver for LPDDR2-NVM PCM memories") +Signed-off-by: Arnd Bergmann +Reviewed-by: Nathan Chancellor +Acked-by: Miquel Raynal +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20200505140136.263461-1-arnd@arndb.de +Signed-off-by: Sasha Levin +--- + drivers/mtd/lpddr/lpddr2_nvm.c | 35 ++++++++++++++++++---------------- + 1 file changed, 19 insertions(+), 16 deletions(-) + +diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c +index 0f1547f09d08b..72f5c7b300790 100644 +--- a/drivers/mtd/lpddr/lpddr2_nvm.c ++++ b/drivers/mtd/lpddr/lpddr2_nvm.c +@@ -393,6 +393,17 @@ static int lpddr2_nvm_lock(struct mtd_info *mtd, loff_t start_add, + return lpddr2_nvm_do_block_op(mtd, start_add, len, LPDDR2_NVM_LOCK); + } + ++static const struct mtd_info lpddr2_nvm_mtd_info = { ++ .type = MTD_RAM, ++ .writesize = 1, ++ .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK), ++ ._read = lpddr2_nvm_read, ++ ._write = lpddr2_nvm_write, ++ ._erase = lpddr2_nvm_erase, ++ ._unlock = lpddr2_nvm_unlock, ++ ._lock = lpddr2_nvm_lock, ++}; ++ + /* + * lpddr2_nvm driver probe method + */ +@@ -433,6 +444,7 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) + .pfow_base = OW_BASE_ADDRESS, + .fldrv_priv = pcm_data, + }; ++ + if (IS_ERR(map->virt)) + return PTR_ERR(map->virt); + +@@ -444,22 +456,13 @@ static int lpddr2_nvm_probe(struct platform_device *pdev) + return PTR_ERR(pcm_data->ctl_regs); + + /* Populate mtd_info data structure */ +- *mtd = (struct mtd_info) { +- .dev = { .parent = &pdev->dev }, +- .name = pdev->dev.init_name, +- .type = MTD_RAM, +- .priv = map, +- .size = resource_size(add_range), +- .erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width, +- .writesize = 1, +- .writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width, +- .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK), +- ._read = lpddr2_nvm_read, +- ._write = lpddr2_nvm_write, +- ._erase = lpddr2_nvm_erase, +- ._unlock = lpddr2_nvm_unlock, +- ._lock = lpddr2_nvm_lock, +- }; ++ *mtd = lpddr2_nvm_mtd_info; ++ mtd->dev.parent = &pdev->dev; ++ mtd->name = pdev->dev.init_name; ++ mtd->priv = map; ++ mtd->size = resource_size(add_range); ++ mtd->erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width; ++ mtd->writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width; + + /* Verify the presence of the device looking for PFOW string */ + if (!lpddr2_nvm_pfow_present(map)) { +-- +2.25.1 + diff --git a/queue-5.8/mtd-mtdoops-don-t-write-panic-data-twice.patch b/queue-5.8/mtd-mtdoops-don-t-write-panic-data-twice.patch new file mode 100644 index 00000000000..0b55f295dd4 --- /dev/null +++ b/queue-5.8/mtd-mtdoops-don-t-write-panic-data-twice.patch @@ -0,0 +1,49 @@ +From 129384a1a864cb84251251da6a946652c69ddea1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 15:42:17 +1200 +Subject: mtd: mtdoops: Don't write panic data twice + +From: Mark Tomlinson + +[ Upstream commit c1cf1d57d1492235309111ea6a900940213a9166 ] + +If calling mtdoops_write, don't also schedule work to be done later. + +Although this appears to not be causing an issue, possibly because the +scheduled work will never get done, it is confusing. + +Fixes: 016c1291ce70 ("mtd: mtdoops: do not use mtd->panic_write directly") +Signed-off-by: Mark Tomlinson +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20200903034217.23079-1-mark.tomlinson@alliedtelesis.co.nz +Signed-off-by: Sasha Levin +--- + drivers/mtd/mtdoops.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c +index 4ced68be7ed7e..774970bfcf859 100644 +--- a/drivers/mtd/mtdoops.c ++++ b/drivers/mtd/mtdoops.c +@@ -279,12 +279,13 @@ static void mtdoops_do_dump(struct kmsg_dumper *dumper, + kmsg_dump_get_buffer(dumper, true, cxt->oops_buf + MTDOOPS_HEADER_SIZE, + record_size - MTDOOPS_HEADER_SIZE, NULL); + +- /* Panics must be written immediately */ +- if (reason != KMSG_DUMP_OOPS) ++ if (reason != KMSG_DUMP_OOPS) { ++ /* Panics must be written immediately */ + mtdoops_write(cxt, 1); +- +- /* For other cases, schedule work to write it "nicely" */ +- schedule_work(&cxt->work_write); ++ } else { ++ /* For other cases, schedule work to write it "nicely" */ ++ schedule_work(&cxt->work_write); ++ } + } + + static void mtdoops_notify_add(struct mtd_info *mtd) +-- +2.25.1 + diff --git a/queue-5.8/mtd-rawnand-ams-delta-fix-non-of-build-warning.patch b/queue-5.8/mtd-rawnand-ams-delta-fix-non-of-build-warning.patch new file mode 100644 index 00000000000..e38ac7a6e0c --- /dev/null +++ b/queue-5.8/mtd-rawnand-ams-delta-fix-non-of-build-warning.patch @@ -0,0 +1,52 @@ +From fc28413248e458b4d960ee1dc79ff421f01dbf06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Sep 2020 10:04:03 +0200 +Subject: mtd: rawnand: ams-delta: Fix non-OF build warning + +From: Janusz Krzysztofik + +[ Upstream commit 6d11178762f7c8338a028b428198383b8978b280 ] + +Commit 7c2f66a960fc ("mtd: rawnand: ams-delta: Add module device +tables") introduced an OF module device table but wrapped a reference +to it with of_match_ptr() which resolves to NULL in non-OF configs. +That resulted in a clang compiler warning on unused variable in non-OF +builds. Fix it. + +drivers/mtd/nand/raw/ams-delta.c:373:34: warning: unused variable 'gpio_nand_of_id_table' [-Wunused-const-variable] + static const struct of_device_id gpio_nand_of_id_table[] = { + ^ + 1 warning generated. + +Fixes: 7c2f66a960fc ("mtd: rawnand: ams-delta: Add module device tables") +Reported-by: kernel test robot +Signed-off-by: Janusz Krzysztofik +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20200919080403.17520-1-jmkrzyszt@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/ams-delta.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mtd/nand/raw/ams-delta.c b/drivers/mtd/nand/raw/ams-delta.c +index 3711e7a0436cd..b3390028c6bfb 100644 +--- a/drivers/mtd/nand/raw/ams-delta.c ++++ b/drivers/mtd/nand/raw/ams-delta.c +@@ -400,12 +400,14 @@ static int gpio_nand_remove(struct platform_device *pdev) + return 0; + } + ++#ifdef CONFIG_OF + static const struct of_device_id gpio_nand_of_id_table[] = { + { + /* sentinel */ + }, + }; + MODULE_DEVICE_TABLE(of, gpio_nand_of_id_table); ++#endif + + static const struct platform_device_id gpio_nand_plat_id_table[] = { + { +-- +2.25.1 + diff --git a/queue-5.8/mtd-rawnand-stm32_fmc2-fix-a-buffer-overflow.patch b/queue-5.8/mtd-rawnand-stm32_fmc2-fix-a-buffer-overflow.patch new file mode 100644 index 00000000000..be40f2a6c17 --- /dev/null +++ b/queue-5.8/mtd-rawnand-stm32_fmc2-fix-a-buffer-overflow.patch @@ -0,0 +1,40 @@ +From 5580c42d5c1e724561ce186416022ea21a17dd54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Jul 2020 11:52:07 +0200 +Subject: mtd: rawnand: stm32_fmc2: fix a buffer overflow + +From: Christophe Kerello + +[ Upstream commit ab16f54ef3cdb6bbc06a36f636a89e6db8a6cea3 ] + +This patch solves following static checker warning: +drivers/mtd/nand/raw/stm32_fmc2_nand.c:350 stm32_fmc2_nfc_select_chip() +error: buffer overflow 'nfc->data_phys_addr' 2 <= 2 + +The CS value can only be 0 or 1. + +Signed-off-by: Christophe Kerello +Fixes: 2cd457f328c1 ("mtd: rawnand: stm32_fmc2: add STM32 FMC2 NAND flash controller driver") +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/1595325127-32693-1-git-send-email-christophe.kerello@st.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/stm32_fmc2_nand.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/stm32_fmc2_nand.c b/drivers/mtd/nand/raw/stm32_fmc2_nand.c +index 65c9d17b25a3c..dce6d7a10a364 100644 +--- a/drivers/mtd/nand/raw/stm32_fmc2_nand.c ++++ b/drivers/mtd/nand/raw/stm32_fmc2_nand.c +@@ -1791,7 +1791,7 @@ static int stm32_fmc2_nfc_parse_child(struct stm32_fmc2_nfc *nfc, + return ret; + } + +- if (cs > FMC2_MAX_CE) { ++ if (cs >= FMC2_MAX_CE) { + dev_err(nfc->dev, "invalid reg value: %d\n", cs); + return -EINVAL; + } +-- +2.25.1 + diff --git a/queue-5.8/mtd-rawnand-vf610-disable-clk-on-error-handling-path.patch b/queue-5.8/mtd-rawnand-vf610-disable-clk-on-error-handling-path.patch new file mode 100644 index 00000000000..148f7cc59af --- /dev/null +++ b/queue-5.8/mtd-rawnand-vf610-disable-clk-on-error-handling-path.patch @@ -0,0 +1,43 @@ +From 76b2848cd43a16dee2c185f33ec2a9255ee0b2b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 10:26:34 +0300 +Subject: mtd: rawnand: vf610: disable clk on error handling path in probe + +From: Evgeny Novikov + +[ Upstream commit cb7dc3178a9862614b1e7567d77f4679f027a074 ] + +vf610_nfc_probe() does not invoke clk_disable_unprepare() on one error +handling path. The patch fixes that. + +Found by Linux Driver Verification project (linuxtesting.org). + +Fixes: 6f0ce4dfc5a3 ("mtd: rawnand: vf610: Avoid a potential NULL pointer dereference") +Signed-off-by: Evgeny Novikov +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20200806072634.23528-1-novikov@ispras.ru +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/vf610_nfc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/vf610_nfc.c b/drivers/mtd/nand/raw/vf610_nfc.c +index 7248c59011836..fcca45e2abe20 100644 +--- a/drivers/mtd/nand/raw/vf610_nfc.c ++++ b/drivers/mtd/nand/raw/vf610_nfc.c +@@ -852,8 +852,10 @@ static int vf610_nfc_probe(struct platform_device *pdev) + } + + of_id = of_match_device(vf610_nfc_dt_ids, &pdev->dev); +- if (!of_id) +- return -ENODEV; ++ if (!of_id) { ++ err = -ENODEV; ++ goto err_disable_clk; ++ } + + nfc->variant = (enum vf610_nfc_variant)of_id->data; + +-- +2.25.1 + diff --git a/queue-5.8/mtd-spinand-gigadevice-add-qe-bit.patch b/queue-5.8/mtd-spinand-gigadevice-add-qe-bit.patch new file mode 100644 index 00000000000..53a1394df59 --- /dev/null +++ b/queue-5.8/mtd-spinand-gigadevice-add-qe-bit.patch @@ -0,0 +1,80 @@ +From 1a0d958f713735665ce8a994c4d68b4bf4597f41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 18:51:20 +0200 +Subject: mtd: spinand: gigadevice: Add QE Bit + +From: Hauke Mehrtens + +[ Upstream commit aea7687e77bebce5b67fab9d03347bd8df7933c7 ] + +The following GigaDevice chips have the QE BIT in the feature flags, I +checked the datasheets, but did not try this. +* GD5F1GQ4xExxG +* GD5F1GQ4xFxxG +* GD5F1GQ4UAYIG +* GD5F4GQ4UAYIG + +The Quad operations like 0xEB mention that the QE bit has to be set. + +Fixes: c93c613214ac ("mtd: spinand: add support for GigaDevice GD5FxGQ4xA") +Signed-off-by: Hauke Mehrtens +Tested-by: Chuanhong Guo +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20200820165121.3192-3-hauke@hauke-m.de +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/spi/gigadevice.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/mtd/nand/spi/gigadevice.c b/drivers/mtd/nand/spi/gigadevice.c +index 679d3c43e15aa..0b7667e60780f 100644 +--- a/drivers/mtd/nand/spi/gigadevice.c ++++ b/drivers/mtd/nand/spi/gigadevice.c +@@ -202,7 +202,7 @@ static const struct spinand_info gigadevice_spinand_table[] = { + SPINAND_INFO_OP_VARIANTS(&read_cache_variants, + &write_cache_variants, + &update_cache_variants), +- 0, ++ SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&gd5fxgq4xa_ooblayout, + gd5fxgq4xa_ecc_get_status)), + SPINAND_INFO("GD5F2GQ4xA", +@@ -212,7 +212,7 @@ static const struct spinand_info gigadevice_spinand_table[] = { + SPINAND_INFO_OP_VARIANTS(&read_cache_variants, + &write_cache_variants, + &update_cache_variants), +- 0, ++ SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&gd5fxgq4xa_ooblayout, + gd5fxgq4xa_ecc_get_status)), + SPINAND_INFO("GD5F4GQ4xA", +@@ -222,7 +222,7 @@ static const struct spinand_info gigadevice_spinand_table[] = { + SPINAND_INFO_OP_VARIANTS(&read_cache_variants, + &write_cache_variants, + &update_cache_variants), +- 0, ++ SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&gd5fxgq4xa_ooblayout, + gd5fxgq4xa_ecc_get_status)), + SPINAND_INFO("GD5F1GQ4UExxG", +@@ -232,7 +232,7 @@ static const struct spinand_info gigadevice_spinand_table[] = { + SPINAND_INFO_OP_VARIANTS(&read_cache_variants, + &write_cache_variants, + &update_cache_variants), +- 0, ++ SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&gd5fxgq4_variant2_ooblayout, + gd5fxgq4uexxg_ecc_get_status)), + SPINAND_INFO("GD5F1GQ4UFxxG", +@@ -242,7 +242,7 @@ static const struct spinand_info gigadevice_spinand_table[] = { + SPINAND_INFO_OP_VARIANTS(&read_cache_variants_f, + &write_cache_variants, + &update_cache_variants), +- 0, ++ SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&gd5fxgq4_variant2_ooblayout, + gd5fxgq4ufxxg_ecc_get_status)), + }; +-- +2.25.1 + diff --git a/queue-5.8/mtd-spinand-gigadevice-only-one-dummy-byte-in-quadio.patch b/queue-5.8/mtd-spinand-gigadevice-only-one-dummy-byte-in-quadio.patch new file mode 100644 index 00000000000..41d70068c57 --- /dev/null +++ b/queue-5.8/mtd-spinand-gigadevice-only-one-dummy-byte-in-quadio.patch @@ -0,0 +1,51 @@ +From d2fa21fa554fcfabceb8e7a9cb01480117d20f1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 18:51:19 +0200 +Subject: mtd: spinand: gigadevice: Only one dummy byte in QUADIO + +From: Hauke Mehrtens + +[ Upstream commit 6387ad9caf8f09747a8569e5876086b72ee9382c ] + +The datasheet only lists one dummy byte in the 0xEH operation for the +following chips: +* GD5F1GQ4xExxG +* GD5F1GQ4xFxxG +* GD5F1GQ4UAYIG +* GD5F4GQ4UAYIG + +Fixes: c93c613214ac ("mtd: spinand: add support for GigaDevice GD5FxGQ4xA") +Signed-off-by: Hauke Mehrtens +Tested-by: Chuanhong Guo +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20200820165121.3192-2-hauke@hauke-m.de +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/spi/gigadevice.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/spi/gigadevice.c b/drivers/mtd/nand/spi/gigadevice.c +index d219c970042a2..679d3c43e15aa 100644 +--- a/drivers/mtd/nand/spi/gigadevice.c ++++ b/drivers/mtd/nand/spi/gigadevice.c +@@ -21,7 +21,7 @@ + #define GD5FXGQ4UXFXXG_STATUS_ECC_UNCOR_ERROR (7 << 4) + + static SPINAND_OP_VARIANTS(read_cache_variants, +- SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 2, NULL, 0), ++ SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 1, NULL, 0), + SPINAND_PAGE_READ_FROM_CACHE_X4_OP(0, 1, NULL, 0), + SPINAND_PAGE_READ_FROM_CACHE_DUALIO_OP(0, 1, NULL, 0), + SPINAND_PAGE_READ_FROM_CACHE_X2_OP(0, 1, NULL, 0), +@@ -29,7 +29,7 @@ static SPINAND_OP_VARIANTS(read_cache_variants, + SPINAND_PAGE_READ_FROM_CACHE_OP(false, 0, 1, NULL, 0)); + + static SPINAND_OP_VARIANTS(read_cache_variants_f, +- SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 2, NULL, 0), ++ SPINAND_PAGE_READ_FROM_CACHE_QUADIO_OP(0, 1, NULL, 0), + SPINAND_PAGE_READ_FROM_CACHE_X4_OP_3A(0, 1, NULL, 0), + SPINAND_PAGE_READ_FROM_CACHE_DUALIO_OP(0, 1, NULL, 0), + SPINAND_PAGE_READ_FROM_CACHE_X2_OP_3A(0, 1, NULL, 0), +-- +2.25.1 + diff --git a/queue-5.8/mwifiex-do-not-use-gfp_kernel-in-atomic-context.patch b/queue-5.8/mwifiex-do-not-use-gfp_kernel-in-atomic-context.patch new file mode 100644 index 00000000000..63d26548e5e --- /dev/null +++ b/queue-5.8/mwifiex-do-not-use-gfp_kernel-in-atomic-context.patch @@ -0,0 +1,51 @@ +From 68f288a1ed9ab4646c7009ad327a2a5c36eea5bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Aug 2020 11:29:06 +0200 +Subject: mwifiex: Do not use GFP_KERNEL in atomic context + +From: Christophe JAILLET + +[ Upstream commit d2ab7f00f4321370a8ee14e5630d4349fdacc42e ] + +A possible call chain is as follow: + mwifiex_sdio_interrupt (sdio.c) + --> mwifiex_main_process (main.c) + --> mwifiex_process_cmdresp (cmdevt.c) + --> mwifiex_process_sta_cmdresp (sta_cmdresp.c) + --> mwifiex_ret_802_11_scan (scan.c) + --> mwifiex_parse_single_response_buf (scan.c) + +'mwifiex_sdio_interrupt()' is an interrupt function. + +Also note that 'mwifiex_ret_802_11_scan()' already uses GFP_ATOMIC. + +So use GFP_ATOMIC instead of GFP_KERNEL when memory is allocated in +'mwifiex_parse_single_response_buf()'. + +Fixes: 7c6fa2a843c5 ("mwifiex: use cfg80211 dynamic scan table and cfg80211_get_bss API") +or +Fixes: 601216e12c65e ("mwifiex: process RX packets in SDIO IRQ thread directly") +Signed-off-by: Christophe JAILLET +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200809092906.744621-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/scan.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c +index ff932627a46c1..2fb69a590bd8e 100644 +--- a/drivers/net/wireless/marvell/mwifiex/scan.c ++++ b/drivers/net/wireless/marvell/mwifiex/scan.c +@@ -1889,7 +1889,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info, + chan, CFG80211_BSS_FTYPE_UNKNOWN, + bssid, timestamp, + cap_info_bitmap, beacon_period, +- ie_buf, ie_len, rssi, GFP_KERNEL); ++ ie_buf, ie_len, rssi, GFP_ATOMIC); + if (bss) { + bss_priv = (struct mwifiex_bss_priv *)bss->priv; + bss_priv->band = band; +-- +2.25.1 + diff --git a/queue-5.8/mwifiex-don-t-call-del_timer_sync-on-uninitialized-t.patch b/queue-5.8/mwifiex-don-t-call-del_timer_sync-on-uninitialized-t.patch new file mode 100644 index 00000000000..2bd1fd92554 --- /dev/null +++ b/queue-5.8/mwifiex-don-t-call-del_timer_sync-on-uninitialized-t.patch @@ -0,0 +1,54 @@ +From 7438859381d4aa7d77c5b6bfe5fb0f4ccfc27c17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 17:27:19 +0900 +Subject: mwifiex: don't call del_timer_sync() on uninitialized timer + +From: Tetsuo Handa + +[ Upstream commit 621a3a8b1c0ecf16e1e5667ea5756a76a082b738 ] + +syzbot is reporting that del_timer_sync() is called from +mwifiex_usb_cleanup_tx_aggr() from mwifiex_unregister_dev() without +checking timer_setup() from mwifiex_usb_tx_init() was called [1]. + +Ganapathi Bhat proposed a possibly cleaner fix, but it seems that +that fix was forgotten [2]. + +"grep -FrB1 'del_timer' drivers/ | grep -FA1 '.function)'" says that +currently there are 28 locations which call del_timer[_sync]() only if +that timer's function field was initialized (because timer_setup() sets +that timer's function field). Therefore, let's use same approach here. + +[1] https://syzkaller.appspot.com/bug?id=26525f643f454dd7be0078423e3cdb0d57744959 +[2] https://lkml.kernel.org/r/CA+ASDXMHt2gq9Hy+iP_BYkWXsSreWdp3_bAfMkNcuqJ3K+-jbQ@mail.gmail.com + +Reported-by: syzbot +Cc: Ganapathi Bhat +Cc: Brian Norris +Signed-off-by: Tetsuo Handa +Reviewed-by: Brian Norris +Acked-by: Ganapathi Bhat +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200821082720.7716-1-penguin-kernel@I-love.SAKURA.ne.jp +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/usb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c +index 6f3cfde4654cc..426e39d4ccf0f 100644 +--- a/drivers/net/wireless/marvell/mwifiex/usb.c ++++ b/drivers/net/wireless/marvell/mwifiex/usb.c +@@ -1353,7 +1353,8 @@ static void mwifiex_usb_cleanup_tx_aggr(struct mwifiex_adapter *adapter) + skb_dequeue(&port->tx_aggr.aggr_list))) + mwifiex_write_data_complete(adapter, skb_tmp, + 0, -1); +- del_timer_sync(&port->tx_aggr.timer_cnxt.hold_timer); ++ if (port->tx_aggr.timer_cnxt.hold_timer.function) ++ del_timer_sync(&port->tx_aggr.timer_cnxt.hold_timer); + port->tx_aggr.timer_cnxt.is_hold_timer_set = false; + port->tx_aggr.timer_cnxt.hold_tmo_msecs = 0; + } +-- +2.25.1 + diff --git a/queue-5.8/mwifiex-fix-double-free.patch b/queue-5.8/mwifiex-fix-double-free.patch new file mode 100644 index 00000000000..7321a8543cd --- /dev/null +++ b/queue-5.8/mwifiex-fix-double-free.patch @@ -0,0 +1,50 @@ +From f4dfdc103d6a256983231c3c101a00b294dc027a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Oct 2020 06:19:31 -0700 +Subject: mwifiex: fix double free + +From: Tom Rix + +[ Upstream commit 53708f4fd9cfe389beab5c8daa763bcd0e0b4aef ] + +clang static analysis reports this problem: + +sdio.c:2403:3: warning: Attempt to free released memory + kfree(card->mpa_rx.buf); + ^~~~~~~~~~~~~~~~~~~~~~~ + +When mwifiex_init_sdio() fails in its first call to +mwifiex_alloc_sdio_mpa_buffer, it falls back to calling it +again. If the second alloc of mpa_tx.buf fails, the error +handler will try to free the old, previously freed mpa_rx.buf. +Reviewing the code, it looks like a second double free would +happen with mwifiex_cleanup_sdio(). + +So set both pointers to NULL when they are freed. + +Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver") +Signed-off-by: Tom Rix +Reviewed-by: Brian Norris +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201004131931.29782-1-trix@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/sdio.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c +index a042965962a2d..1b6bee5465288 100644 +--- a/drivers/net/wireless/marvell/mwifiex/sdio.c ++++ b/drivers/net/wireless/marvell/mwifiex/sdio.c +@@ -1976,6 +1976,8 @@ static int mwifiex_alloc_sdio_mpa_buffers(struct mwifiex_adapter *adapter, + kfree(card->mpa_rx.buf); + card->mpa_tx.buf_size = 0; + card->mpa_rx.buf_size = 0; ++ card->mpa_tx.buf = NULL; ++ card->mpa_rx.buf = NULL; + } + + return ret; +-- +2.25.1 + diff --git a/queue-5.8/net-dsa-rtl8366-check-validity-of-passed-vlans.patch b/queue-5.8/net-dsa-rtl8366-check-validity-of-passed-vlans.patch new file mode 100644 index 00000000000..1aeaca52779 --- /dev/null +++ b/queue-5.8/net-dsa-rtl8366-check-validity-of-passed-vlans.patch @@ -0,0 +1,49 @@ +From da66ae111c9e6b13d2acff68cb91d11152627b51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 00:09:34 +0200 +Subject: net: dsa: rtl8366: Check validity of passed VLANs + +From: Linus Walleij + +[ Upstream commit 6641a2c42b0a307b7638d10e5d4b90debc61389d ] + +The rtl8366_set_vlan() and rtl8366_set_pvid() get invalid +VLANs tossed at it, especially VLAN0, something the hardware +and driver cannot handle. Check validity and bail out like +we do in the other callbacks. + +Reviewed-by: Florian Fainelli +Signed-off-by: Linus Walleij +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/rtl8366.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c +index 99cdb2f18fa2f..a62d76a048dfa 100644 +--- a/drivers/net/dsa/rtl8366.c ++++ b/drivers/net/dsa/rtl8366.c +@@ -43,6 +43,9 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, + int ret; + int i; + ++ if (!smi->ops->is_vlan_valid(smi, vid)) ++ return -EINVAL; ++ + dev_dbg(smi->dev, + "setting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n", + vid, member, untag); +@@ -118,6 +121,9 @@ int rtl8366_set_pvid(struct realtek_smi *smi, unsigned int port, + int ret; + int i; + ++ if (!smi->ops->is_vlan_valid(smi, vid)) ++ return -EINVAL; ++ + /* Try to find an existing MC entry for this VID */ + for (i = 0; i < smi->num_vlan_mc; i++) { + ret = smi->ops->get_vlan_mc(smi, i, &vlanmc); +-- +2.25.1 + diff --git a/queue-5.8/net-dsa-rtl8366-refactor-vlan-pvid-init.patch b/queue-5.8/net-dsa-rtl8366-refactor-vlan-pvid-init.patch new file mode 100644 index 00000000000..7711e8d4a17 --- /dev/null +++ b/queue-5.8/net-dsa-rtl8366-refactor-vlan-pvid-init.patch @@ -0,0 +1,398 @@ +From 63023a55e9088a3f0c41347576f10d3153c2a00d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 00:09:35 +0200 +Subject: net: dsa: rtl8366: Refactor VLAN/PVID init + +From: Linus Walleij + +[ Upstream commit 7e1301ed1881447d2a25f9c6423738c33cbca133 ] + +The VLANs and PVIDs on the RTL8366 utilizes a "member +configuration" (MC) which is largely unexplained in the +code. + +This set-up requires a special ordering: rtl8366_set_pvid() +must be called first, followed by rtl8366_set_vlan(), +else the MC will not be properly allocated. Relax this +by factoring out the code obtaining an MC and reuse +the helper in both rtl8366_set_pvid() and +rtl8366_set_vlan() so we remove this strict ordering +requirement. + +In the process, add some better comments and debug prints +so people who read the code understand what is going on. + +Reviewed-by: Florian Fainelli +Signed-off-by: Linus Walleij +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/realtek-smi-core.h | 4 +- + drivers/net/dsa/rtl8366.c | 273 +++++++++++++++-------------- + 2 files changed, 146 insertions(+), 131 deletions(-) + +diff --git a/drivers/net/dsa/realtek-smi-core.h b/drivers/net/dsa/realtek-smi-core.h +index 9a63b51e1d82f..6f2dab7e33d65 100644 +--- a/drivers/net/dsa/realtek-smi-core.h ++++ b/drivers/net/dsa/realtek-smi-core.h +@@ -25,6 +25,9 @@ struct rtl8366_mib_counter { + const char *name; + }; + ++/** ++ * struct rtl8366_vlan_mc - Virtual LAN member configuration ++ */ + struct rtl8366_vlan_mc { + u16 vid; + u16 untag; +@@ -119,7 +122,6 @@ int realtek_smi_setup_mdio(struct realtek_smi *smi); + int rtl8366_mc_is_used(struct realtek_smi *smi, int mc_index, int *used); + int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, + u32 untag, u32 fid); +-int rtl8366_get_pvid(struct realtek_smi *smi, int port, int *val); + int rtl8366_set_pvid(struct realtek_smi *smi, unsigned int port, + unsigned int vid); + int rtl8366_enable_vlan4k(struct realtek_smi *smi, bool enable); +diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c +index a62d76a048dfa..b941d45edd641 100644 +--- a/drivers/net/dsa/rtl8366.c ++++ b/drivers/net/dsa/rtl8366.c +@@ -36,12 +36,110 @@ int rtl8366_mc_is_used(struct realtek_smi *smi, int mc_index, int *used) + } + EXPORT_SYMBOL_GPL(rtl8366_mc_is_used); + ++/** ++ * rtl8366_obtain_mc() - retrieve or allocate a VLAN member configuration ++ * @smi: the Realtek SMI device instance ++ * @vid: the VLAN ID to look up or allocate ++ * @vlanmc: the pointer will be assigned to a pointer to a valid member config ++ * if successful ++ * @return: index of a new member config or negative error number ++ */ ++static int rtl8366_obtain_mc(struct realtek_smi *smi, int vid, ++ struct rtl8366_vlan_mc *vlanmc) ++{ ++ struct rtl8366_vlan_4k vlan4k; ++ int ret; ++ int i; ++ ++ /* Try to find an existing member config entry for this VID */ ++ for (i = 0; i < smi->num_vlan_mc; i++) { ++ ret = smi->ops->get_vlan_mc(smi, i, vlanmc); ++ if (ret) { ++ dev_err(smi->dev, "error searching for VLAN MC %d for VID %d\n", ++ i, vid); ++ return ret; ++ } ++ ++ if (vid == vlanmc->vid) ++ return i; ++ } ++ ++ /* We have no MC entry for this VID, try to find an empty one */ ++ for (i = 0; i < smi->num_vlan_mc; i++) { ++ ret = smi->ops->get_vlan_mc(smi, i, vlanmc); ++ if (ret) { ++ dev_err(smi->dev, "error searching for VLAN MC %d for VID %d\n", ++ i, vid); ++ return ret; ++ } ++ ++ if (vlanmc->vid == 0 && vlanmc->member == 0) { ++ /* Update the entry from the 4K table */ ++ ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k); ++ if (ret) { ++ dev_err(smi->dev, "error looking for 4K VLAN MC %d for VID %d\n", ++ i, vid); ++ return ret; ++ } ++ ++ vlanmc->vid = vid; ++ vlanmc->member = vlan4k.member; ++ vlanmc->untag = vlan4k.untag; ++ vlanmc->fid = vlan4k.fid; ++ ret = smi->ops->set_vlan_mc(smi, i, vlanmc); ++ if (ret) { ++ dev_err(smi->dev, "unable to set/update VLAN MC %d for VID %d\n", ++ i, vid); ++ return ret; ++ } ++ ++ dev_dbg(smi->dev, "created new MC at index %d for VID %d\n", ++ i, vid); ++ return i; ++ } ++ } ++ ++ /* MC table is full, try to find an unused entry and replace it */ ++ for (i = 0; i < smi->num_vlan_mc; i++) { ++ int used; ++ ++ ret = rtl8366_mc_is_used(smi, i, &used); ++ if (ret) ++ return ret; ++ ++ if (!used) { ++ /* Update the entry from the 4K table */ ++ ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k); ++ if (ret) ++ return ret; ++ ++ vlanmc->vid = vid; ++ vlanmc->member = vlan4k.member; ++ vlanmc->untag = vlan4k.untag; ++ vlanmc->fid = vlan4k.fid; ++ ret = smi->ops->set_vlan_mc(smi, i, vlanmc); ++ if (ret) { ++ dev_err(smi->dev, "unable to set/update VLAN MC %d for VID %d\n", ++ i, vid); ++ return ret; ++ } ++ dev_dbg(smi->dev, "recycled MC at index %i for VID %d\n", ++ i, vid); ++ return i; ++ } ++ } ++ ++ dev_err(smi->dev, "all VLAN member configurations are in use\n"); ++ return -ENOSPC; ++} ++ + int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, + u32 untag, u32 fid) + { ++ struct rtl8366_vlan_mc vlanmc; + struct rtl8366_vlan_4k vlan4k; ++ int mc; + int ret; +- int i; + + if (!smi->ops->is_vlan_valid(smi, vid)) + return -EINVAL; +@@ -66,136 +164,58 @@ int rtl8366_set_vlan(struct realtek_smi *smi, int vid, u32 member, + "resulting VLAN%d 4k members: 0x%02x, untagged: 0x%02x\n", + vid, vlan4k.member, vlan4k.untag); + +- /* Try to find an existing MC entry for this VID */ +- for (i = 0; i < smi->num_vlan_mc; i++) { +- struct rtl8366_vlan_mc vlanmc; +- +- ret = smi->ops->get_vlan_mc(smi, i, &vlanmc); +- if (ret) +- return ret; +- +- if (vid == vlanmc.vid) { +- /* update the MC entry */ +- vlanmc.member |= member; +- vlanmc.untag |= untag; +- vlanmc.fid = fid; +- +- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); ++ /* Find or allocate a member config for this VID */ ++ ret = rtl8366_obtain_mc(smi, vid, &vlanmc); ++ if (ret < 0) ++ return ret; ++ mc = ret; + +- dev_dbg(smi->dev, +- "resulting VLAN%d MC members: 0x%02x, untagged: 0x%02x\n", +- vid, vlanmc.member, vlanmc.untag); ++ /* Update the MC entry */ ++ vlanmc.member |= member; ++ vlanmc.untag |= untag; ++ vlanmc.fid = fid; + +- break; +- } +- } ++ /* Commit updates to the MC entry */ ++ ret = smi->ops->set_vlan_mc(smi, mc, &vlanmc); ++ if (ret) ++ dev_err(smi->dev, "failed to commit changes to VLAN MC index %d for VID %d\n", ++ mc, vid); ++ else ++ dev_dbg(smi->dev, ++ "resulting VLAN%d MC members: 0x%02x, untagged: 0x%02x\n", ++ vid, vlanmc.member, vlanmc.untag); + + return ret; + } + EXPORT_SYMBOL_GPL(rtl8366_set_vlan); + +-int rtl8366_get_pvid(struct realtek_smi *smi, int port, int *val) +-{ +- struct rtl8366_vlan_mc vlanmc; +- int ret; +- int index; +- +- ret = smi->ops->get_mc_index(smi, port, &index); +- if (ret) +- return ret; +- +- ret = smi->ops->get_vlan_mc(smi, index, &vlanmc); +- if (ret) +- return ret; +- +- *val = vlanmc.vid; +- return 0; +-} +-EXPORT_SYMBOL_GPL(rtl8366_get_pvid); +- + int rtl8366_set_pvid(struct realtek_smi *smi, unsigned int port, + unsigned int vid) + { + struct rtl8366_vlan_mc vlanmc; +- struct rtl8366_vlan_4k vlan4k; ++ int mc; + int ret; +- int i; + + if (!smi->ops->is_vlan_valid(smi, vid)) + return -EINVAL; + +- /* Try to find an existing MC entry for this VID */ +- for (i = 0; i < smi->num_vlan_mc; i++) { +- ret = smi->ops->get_vlan_mc(smi, i, &vlanmc); +- if (ret) +- return ret; +- +- if (vid == vlanmc.vid) { +- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); +- if (ret) +- return ret; +- +- ret = smi->ops->set_mc_index(smi, port, i); +- return ret; +- } +- } +- +- /* We have no MC entry for this VID, try to find an empty one */ +- for (i = 0; i < smi->num_vlan_mc; i++) { +- ret = smi->ops->get_vlan_mc(smi, i, &vlanmc); +- if (ret) +- return ret; +- +- if (vlanmc.vid == 0 && vlanmc.member == 0) { +- /* Update the entry from the 4K table */ +- ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k); +- if (ret) +- return ret; +- +- vlanmc.vid = vid; +- vlanmc.member = vlan4k.member; +- vlanmc.untag = vlan4k.untag; +- vlanmc.fid = vlan4k.fid; +- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); +- if (ret) +- return ret; +- +- ret = smi->ops->set_mc_index(smi, port, i); +- return ret; +- } +- } +- +- /* MC table is full, try to find an unused entry and replace it */ +- for (i = 0; i < smi->num_vlan_mc; i++) { +- int used; +- +- ret = rtl8366_mc_is_used(smi, i, &used); +- if (ret) +- return ret; +- +- if (!used) { +- /* Update the entry from the 4K table */ +- ret = smi->ops->get_vlan_4k(smi, vid, &vlan4k); +- if (ret) +- return ret; +- +- vlanmc.vid = vid; +- vlanmc.member = vlan4k.member; +- vlanmc.untag = vlan4k.untag; +- vlanmc.fid = vlan4k.fid; +- ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); +- if (ret) +- return ret; ++ /* Find or allocate a member config for this VID */ ++ ret = rtl8366_obtain_mc(smi, vid, &vlanmc); ++ if (ret < 0) ++ return ret; ++ mc = ret; + +- ret = smi->ops->set_mc_index(smi, port, i); +- return ret; +- } ++ ret = smi->ops->set_mc_index(smi, port, mc); ++ if (ret) { ++ dev_err(smi->dev, "set PVID: failed to set MC index %d for port %d\n", ++ mc, port); ++ return ret; + } + +- dev_err(smi->dev, +- "all VLAN member configurations are in use\n"); ++ dev_dbg(smi->dev, "set PVID: the PVID for port %d set to %d using existing MC index %d\n", ++ port, vid, mc); + +- return -ENOSPC; ++ return 0; + } + EXPORT_SYMBOL_GPL(rtl8366_set_pvid); + +@@ -395,7 +415,8 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port, + if (!smi->ops->is_vlan_valid(smi, vid)) + return; + +- dev_info(smi->dev, "add VLAN on port %d, %s, %s\n", ++ dev_info(smi->dev, "add VLAN %d on port %d, %s, %s\n", ++ vlan->vid_begin, + port, + untagged ? "untagged" : "tagged", + pvid ? " PVID" : "no PVID"); +@@ -404,34 +425,26 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port, + dev_err(smi->dev, "port is DSA or CPU port\n"); + + for (vid = vlan->vid_begin; vid <= vlan->vid_end; vid++) { +- int pvid_val = 0; +- +- dev_info(smi->dev, "add VLAN %04x\n", vid); + member |= BIT(port); + + if (untagged) + untag |= BIT(port); + +- /* To ensure that we have a valid MC entry for this VLAN, +- * initialize the port VLAN ID here. +- */ +- ret = rtl8366_get_pvid(smi, port, &pvid_val); +- if (ret < 0) { +- dev_err(smi->dev, "could not lookup PVID for port %d\n", +- port); +- return; +- } +- if (pvid_val == 0) { +- ret = rtl8366_set_pvid(smi, port, vid); +- if (ret < 0) +- return; +- } +- + ret = rtl8366_set_vlan(smi, vid, member, untag, 0); + if (ret) + dev_err(smi->dev, + "failed to set up VLAN %04x", + vid); ++ ++ ret = rtl8366_set_pvid(smi, port, vid); ++ if (ret) ++ dev_err(smi->dev, ++ "failed to set PVID on port %d to VLAN %04x", ++ port, vid); ++ ++ if (!ret) ++ dev_dbg(smi->dev, "VLAN add: added VLAN %d with PVID on port %d\n", ++ vid, port); + } + } + EXPORT_SYMBOL_GPL(rtl8366_vlan_add); +-- +2.25.1 + diff --git a/queue-5.8/net-dsa-rtl8366-skip-pvid-setting-if-not-requested.patch b/queue-5.8/net-dsa-rtl8366-skip-pvid-setting-if-not-requested.patch new file mode 100644 index 00000000000..05ffabb219c --- /dev/null +++ b/queue-5.8/net-dsa-rtl8366-skip-pvid-setting-if-not-requested.patch @@ -0,0 +1,38 @@ +From b66c7a2695a783b3c3b56c2b87accd60859a4590 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Sep 2020 00:29:54 +0200 +Subject: net: dsa: rtl8366: Skip PVID setting if not requested + +From: Linus Walleij + +[ Upstream commit 3dfe8dde093a07e82fa472c0f8c29a7f6a2006a5 ] + +We go to lengths to determine whether the PVID should be set +for this port or not, and then fail to take it into account. +Fix this oversight. + +Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver") +Signed-off-by: Linus Walleij +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/rtl8366.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c +index b941d45edd641..49c626a336803 100644 +--- a/drivers/net/dsa/rtl8366.c ++++ b/drivers/net/dsa/rtl8366.c +@@ -436,6 +436,9 @@ void rtl8366_vlan_add(struct dsa_switch *ds, int port, + "failed to set up VLAN %04x", + vid); + ++ if (!pvid) ++ continue; ++ + ret = rtl8366_set_pvid(smi, port, vid); + if (ret) + dev_err(smi->dev, +-- +2.25.1 + diff --git a/queue-5.8/net-dsa-rtl8366rb-support-all-4096-vlans.patch b/queue-5.8/net-dsa-rtl8366rb-support-all-4096-vlans.patch new file mode 100644 index 00000000000..c07659716de --- /dev/null +++ b/queue-5.8/net-dsa-rtl8366rb-support-all-4096-vlans.patch @@ -0,0 +1,38 @@ +From 286ebbd918769cf92af4a34c485a28fb7fe931c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Sep 2020 22:37:33 +0200 +Subject: net: dsa: rtl8366rb: Support all 4096 VLANs + +From: Linus Walleij + +[ Upstream commit a7920efdd86d8a0d74402dbc80ead03b023294ba ] + +There is an off-by-one error in rtl8366rb_is_vlan_valid() +making VLANs 0..4094 valid while it should be 1..4095. +Fix it. + +Fixes: d8652956cf37 ("net: dsa: realtek-smi: Add Realtek SMI driver") +Signed-off-by: Linus Walleij +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/rtl8366rb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/dsa/rtl8366rb.c b/drivers/net/dsa/rtl8366rb.c +index fd1977590cb4b..c83b332656a4b 100644 +--- a/drivers/net/dsa/rtl8366rb.c ++++ b/drivers/net/dsa/rtl8366rb.c +@@ -1270,7 +1270,7 @@ static bool rtl8366rb_is_vlan_valid(struct realtek_smi *smi, unsigned int vlan) + if (smi->vlan4k_enabled) + max = RTL8366RB_NUM_VIDS - 1; + +- if (vlan == 0 || vlan >= max) ++ if (vlan == 0 || vlan > max) + return false; + + return true; +-- +2.25.1 + diff --git a/queue-5.8/net-enic-cure-the-enic-api-locking-trainwreck.patch b/queue-5.8/net-enic-cure-the-enic-api-locking-trainwreck.patch new file mode 100644 index 00000000000..93a4fc606de --- /dev/null +++ b/queue-5.8/net-enic-cure-the-enic-api-locking-trainwreck.patch @@ -0,0 +1,157 @@ +From 97a05c6abf706aab434d62e07db190ffffcd81e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Sep 2020 22:25:10 +0200 +Subject: net: enic: Cure the enic api locking trainwreck + +From: Thomas Gleixner + +[ Upstream commit a53b59ece86c86d16d12ccdaa1ad0c78250a9d96 ] + +enic_dev_wait() has a BUG_ON(in_interrupt()). + +Chasing the callers of enic_dev_wait() revealed the gems of enic_reset() +and enic_tx_hang_reset() which are both invoked through work queues in +order to be able to call rtnl_lock(). So far so good. + +After locking rtnl both functions acquire enic::enic_api_lock which +serializes against the (ab)use from infiniband. This is where the +trainwreck starts. + +enic::enic_api_lock is a spin_lock() which implicitly disables preemption, +but both functions invoke a ton of functions under that lock which can +sleep. The BUG_ON(in_interrupt()) does not trigger in that case because it +can't detect the preempt disabled condition. + +This clearly has never been tested with any of the mandatory debug options +for 7+ years, which would have caught that for sure. + +Cure it by adding a enic_api_busy member to struct enic, which is modified +and evaluated with enic::enic_api_lock held. + +If enic_api_devcmd_proxy_by_index() observes enic::enic_api_busy as true, +it drops enic::enic_api_lock and busy waits for enic::enic_api_busy to +become false. + +It would be smarter to wait for a completion of that busy period, but +enic_api_devcmd_proxy_by_index() is called with other spin locks held which +obviously can't sleep. + +Remove the BUG_ON(in_interrupt()) check as well because it's incomplete and +with proper debugging enabled the problem would have been caught from the +debug checks in schedule_timeout(). + +Fixes: 0b038566c0ea ("drivers/net: enic: Add an interface for USNIC to interact with firmware") +Signed-off-by: Thomas Gleixner +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cisco/enic/enic.h | 1 + + drivers/net/ethernet/cisco/enic/enic_api.c | 6 +++++ + drivers/net/ethernet/cisco/enic/enic_main.c | 27 ++++++++++++++++----- + 3 files changed, 28 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h +index 18f3aeb88f22a..c67a16a48d624 100644 +--- a/drivers/net/ethernet/cisco/enic/enic.h ++++ b/drivers/net/ethernet/cisco/enic/enic.h +@@ -169,6 +169,7 @@ struct enic { + u16 num_vfs; + #endif + spinlock_t enic_api_lock; ++ bool enic_api_busy; + struct enic_port_profile *pp; + + /* work queue cache line section */ +diff --git a/drivers/net/ethernet/cisco/enic/enic_api.c b/drivers/net/ethernet/cisco/enic/enic_api.c +index b161f24522b87..b028ea2dec2b9 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_api.c ++++ b/drivers/net/ethernet/cisco/enic/enic_api.c +@@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf, + struct vnic_dev *vdev = enic->vdev; + + spin_lock(&enic->enic_api_lock); ++ while (enic->enic_api_busy) { ++ spin_unlock(&enic->enic_api_lock); ++ cpu_relax(); ++ spin_lock(&enic->enic_api_lock); ++ } ++ + spin_lock_bh(&enic->devcmd_lock); + + vnic_dev_cmd_proxy_by_index_start(vdev, vf); +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index cd5fe4f6b54ce..21093f33d2d73 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -2140,8 +2140,6 @@ static int enic_dev_wait(struct vnic_dev *vdev, + int done; + int err; + +- BUG_ON(in_interrupt()); +- + err = start(vdev, arg); + if (err) + return err; +@@ -2329,6 +2327,13 @@ static int enic_set_rss_nic_cfg(struct enic *enic) + rss_hash_bits, rss_base_cpu, rss_enable); + } + ++static void enic_set_api_busy(struct enic *enic, bool busy) ++{ ++ spin_lock(&enic->enic_api_lock); ++ enic->enic_api_busy = busy; ++ spin_unlock(&enic->enic_api_lock); ++} ++ + static void enic_reset(struct work_struct *work) + { + struct enic *enic = container_of(work, struct enic, reset); +@@ -2338,7 +2343,9 @@ static void enic_reset(struct work_struct *work) + + rtnl_lock(); + +- spin_lock(&enic->enic_api_lock); ++ /* Stop any activity from infiniband */ ++ enic_set_api_busy(enic, true); ++ + enic_stop(enic->netdev); + enic_dev_soft_reset(enic); + enic_reset_addr_lists(enic); +@@ -2346,7 +2353,10 @@ static void enic_reset(struct work_struct *work) + enic_set_rss_nic_cfg(enic); + enic_dev_set_ig_vlan_rewrite_mode(enic); + enic_open(enic->netdev); +- spin_unlock(&enic->enic_api_lock); ++ ++ /* Allow infiniband to fiddle with the device again */ ++ enic_set_api_busy(enic, false); ++ + call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); + + rtnl_unlock(); +@@ -2358,7 +2368,9 @@ static void enic_tx_hang_reset(struct work_struct *work) + + rtnl_lock(); + +- spin_lock(&enic->enic_api_lock); ++ /* Stop any activity from infiniband */ ++ enic_set_api_busy(enic, true); ++ + enic_dev_hang_notify(enic); + enic_stop(enic->netdev); + enic_dev_hang_reset(enic); +@@ -2367,7 +2379,10 @@ static void enic_tx_hang_reset(struct work_struct *work) + enic_set_rss_nic_cfg(enic); + enic_dev_set_ig_vlan_rewrite_mode(enic); + enic_open(enic->netdev); +- spin_unlock(&enic->enic_api_lock); ++ ++ /* Allow infiniband to fiddle with the device again */ ++ enic_set_api_busy(enic, false); ++ + call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev); + + rtnl_unlock(); +-- +2.25.1 + diff --git a/queue-5.8/net-fec-fix-phy-init-after-phy_reset_after_clk_enabl.patch b/queue-5.8/net-fec-fix-phy-init-after-phy_reset_after_clk_enabl.patch new file mode 100644 index 00000000000..e66fd897e1c --- /dev/null +++ b/queue-5.8/net-fec-fix-phy-init-after-phy_reset_after_clk_enabl.patch @@ -0,0 +1,49 @@ +From 7640b60d7b6fcee9e5701ceee7c19c7aae064210 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Oct 2020 15:52:53 +0200 +Subject: net: fec: Fix PHY init after phy_reset_after_clk_enable() + +From: Marek Vasut + +[ Upstream commit 0da1ccbbefb662915228bc17e1c7d4ad28b3ddab ] + +The phy_reset_after_clk_enable() does a PHY reset, which means the PHY +loses its register settings. The fec_enet_mii_probe() starts the PHY +and does the necessary calls to configure the PHY via PHY framework, +and loads the correct register settings into the PHY. Therefore, +fec_enet_mii_probe() should be called only after the PHY has been +reset, not before as it is now. + +Fixes: 1b0a83ac04e3 ("net: fec: add phy_reset_after_clk_enable() support") +Reviewed-by: Andrew Lunn +Tested-by: Richard Leitner +Signed-off-by: Marek Vasut +Cc: Christoph Niedermaier +Cc: David S. Miller +Cc: NXP Linux Team +Cc: Shawn Guo +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index e1cd795556294..388d1a5e2f918 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3017,6 +3017,11 @@ fec_enet_open(struct net_device *ndev) + if (ret) + goto err_enet_mii_probe; + ++ /* Probe and connect to PHY when open the interface */ ++ ret = fec_enet_mii_probe(ndev); ++ if (ret) ++ goto err_enet_mii_probe; ++ + if (fep->quirks & FEC_QUIRK_ERR006687) + imx6q_cpuidle_fec_irqs_used(); + +-- +2.25.1 + diff --git a/queue-5.8/net-korina-fix-kfree-of-rx-tx-descriptor-array.patch b/queue-5.8/net-korina-fix-kfree-of-rx-tx-descriptor-array.patch new file mode 100644 index 00000000000..6d5c6fe05e0 --- /dev/null +++ b/queue-5.8/net-korina-fix-kfree-of-rx-tx-descriptor-array.patch @@ -0,0 +1,46 @@ +From 3681e5d18958a8728de7d0c5834dfd0d0c556683 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Oct 2020 00:03:29 +0200 +Subject: net: korina: fix kfree of rx/tx descriptor array + +From: Valentin Vidic + +[ Upstream commit 3af5f0f5c74ecbaf757ef06c3f80d56751277637 ] + +kmalloc returns KSEG0 addresses so convert back from KSEG1 +in kfree. Also make sure array is freed when the driver is +unloaded from the kernel. + +Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC") +Signed-off-by: Valentin Vidic +Acked-by: Willem de Bruijn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/korina.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c +index 03e034918d147..af441d699a57a 100644 +--- a/drivers/net/ethernet/korina.c ++++ b/drivers/net/ethernet/korina.c +@@ -1113,7 +1113,7 @@ static int korina_probe(struct platform_device *pdev) + return rc; + + probe_err_register: +- kfree(lp->td_ring); ++ kfree(KSEG0ADDR(lp->td_ring)); + probe_err_td_ring: + iounmap(lp->tx_dma_regs); + probe_err_dma_tx: +@@ -1133,6 +1133,7 @@ static int korina_remove(struct platform_device *pdev) + iounmap(lp->eth_regs); + iounmap(lp->rx_dma_regs); + iounmap(lp->tx_dma_regs); ++ kfree(KSEG0ADDR(lp->td_ring)); + + unregister_netdev(bif->dev); + free_netdev(bif->dev); +-- +2.25.1 + diff --git a/queue-5.8/net-mlx5-don-t-call-timecounter-cyc2time-directly-fr.patch b/queue-5.8/net-mlx5-don-t-call-timecounter-cyc2time-directly-fr.patch new file mode 100644 index 00000000000..65f1dacc196 --- /dev/null +++ b/queue-5.8/net-mlx5-don-t-call-timecounter-cyc2time-directly-fr.patch @@ -0,0 +1,38 @@ +From d467c2d437da62d010267ebfb5d1aa12aee7f439 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 12:07:10 +0300 +Subject: net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow + +From: Eran Ben Elisha + +[ Upstream commit 0d2ffdc8d4002a62de31ff7aa3bef28c843c3cbe ] + +Before calling timecounter_cyc2time(), clock->lock must be taken. +Use mlx5_timecounter_cyc2time instead which guarantees a safe access. + +Fixes: afc98a0b46d8 ("net/mlx5: Update ptp_clock_event foreach PPS event") +Signed-off-by: Eran Ben Elisha +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +index 2d55b7c22c034..4e7cfa22b3d2f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c +@@ -550,8 +550,9 @@ static int mlx5_pps_event(struct notifier_block *nb, + switch (clock->ptp_info.pin_config[pin].func) { + case PTP_PF_EXTTS: + ptp_event.index = pin; +- ptp_event.timestamp = timecounter_cyc2time(&clock->tc, +- be64_to_cpu(eqe->data.pps.time_stamp)); ++ ptp_event.timestamp = ++ mlx5_timecounter_cyc2time(clock, ++ be64_to_cpu(eqe->data.pps.time_stamp)); + if (clock->pps_info.enabled) { + ptp_event.type = PTP_CLOCK_PPSUSR; + ptp_event.pps_times.ts_real = +-- +2.25.1 + diff --git a/queue-5.8/net-mlx5-fix-uninitialized-variable-warning.patch b/queue-5.8/net-mlx5-fix-uninitialized-variable-warning.patch new file mode 100644 index 00000000000..eb5a4e5507b --- /dev/null +++ b/queue-5.8/net-mlx5-fix-uninitialized-variable-warning.patch @@ -0,0 +1,38 @@ +From 32f9fd52bfc9ac68ec88dfe2c493146686f77fb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 14:59:30 +0300 +Subject: net/mlx5: Fix uninitialized variable warning + +From: Moshe Tal + +[ Upstream commit 19f5b63bc9932d51292d72c9dc3ec95e5dfa2289 ] + +Add variable initialization to eliminate the warning +"variable may be used uninitialized". + +Fixes: 5f29458b77d5 ("net/mlx5e: Support dump callback in TX reporter") +Signed-off-by: Moshe Tal +Reviewed-by: Aya Levin +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en/health.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/health.c b/drivers/net/ethernet/mellanox/mlx5/core/en/health.c +index 7283443868f3c..13c87ab50b267 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en/health.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en/health.c +@@ -212,8 +212,8 @@ static int mlx5e_health_rsc_fmsg_binary(struct devlink_fmsg *fmsg, + + { + u32 data_size; ++ int err = 0; + u32 offset; +- int err; + + for (offset = 0; offset < value_len; offset += data_size) { + data_size = value_len - offset; +-- +2.25.1 + diff --git a/queue-5.8/net-stmmac-fix-incorrect-location-to-set-real_num_rx.patch b/queue-5.8/net-stmmac-fix-incorrect-location-to-set-real_num_rx.patch new file mode 100644 index 00000000000..949a9c35a0d --- /dev/null +++ b/queue-5.8/net-stmmac-fix-incorrect-location-to-set-real_num_rx.patch @@ -0,0 +1,53 @@ +From 498a74f66549a53abfde4b972a6136201eacc1ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 09:28:39 +0800 +Subject: net: stmmac: Fix incorrect location to set real_num_rx|tx_queues + +From: Aashish Verma + +[ Upstream commit 686cff3d7022ddf35d7e38bc80191eb92de5989a ] + +netif_set_real_num_tx_queues() & netif_set_real_num_rx_queues() should be +used to inform network stack about the real Tx & Rx queue (active) number +in both stmmac_open() and stmmac_resume(), therefore, we move the code +from stmmac_dvr_probe() to stmmac_hw_setup(). + +Fixes: c02b7a914551 net: stmmac: use netif_set_real_num_{rx,tx}_queues + +Signed-off-by: Aashish Verma +Signed-off-by: Ong Boon Leong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 73465e5f5a417..44ceba8ceae1a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -2736,6 +2736,10 @@ static int stmmac_hw_setup(struct net_device *dev, bool init_ptp) + stmmac_enable_tbs(priv, priv->ioaddr, enable, chan); + } + ++ /* Configure real RX and TX queues */ ++ netif_set_real_num_rx_queues(dev, priv->plat->rx_queues_to_use); ++ netif_set_real_num_tx_queues(dev, priv->plat->tx_queues_to_use); ++ + /* Start the ball rolling... */ + stmmac_start_all_dma(priv); + +@@ -4819,10 +4823,6 @@ int stmmac_dvr_probe(struct device *device, + + stmmac_check_ether_addr(priv); + +- /* Configure real RX and TX queues */ +- netif_set_real_num_rx_queues(ndev, priv->plat->rx_queues_to_use); +- netif_set_real_num_tx_queues(ndev, priv->plat->tx_queues_to_use); +- + ndev->netdev_ops = &stmmac_netdev_ops; + + ndev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | +-- +2.25.1 + diff --git a/queue-5.8/net-stmmac-use-netif_tx_start-stop_all_queues-functi.patch b/queue-5.8/net-stmmac-use-netif_tx_start-stop_all_queues-functi.patch new file mode 100644 index 00000000000..ec241db3858 --- /dev/null +++ b/queue-5.8/net-stmmac-use-netif_tx_start-stop_all_queues-functi.patch @@ -0,0 +1,101 @@ +From 6c0b633337a00c352cd97c7925ab4239c218b715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 09:28:40 +0800 +Subject: net: stmmac: use netif_tx_start|stop_all_queues() function + +From: Ong Boon Leong + +[ Upstream commit 9f19306d166688a73356aa636c62e698bf2063cc ] + +The current implementation of stmmac_stop_all_queues() and +stmmac_start_all_queues() will not work correctly when the value of +tx_queues_to_use is changed through ethtool -L DEVNAME rx N tx M command. + +Also, netif_tx_start|stop_all_queues() are only needed in driver open() +and close() only. + +Fixes: c22a3f48 net: stmmac: adding multiple napi mechanism + +Signed-off-by: Ong Boon Leong +Signed-off-by: Voon Weifeng +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/stmicro/stmmac/stmmac_main.c | 33 +------------------ + 1 file changed, 1 insertion(+), 32 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 44ceba8ceae1a..d4be2559bb73d 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -176,32 +176,6 @@ static void stmmac_enable_all_queues(struct stmmac_priv *priv) + } + } + +-/** +- * stmmac_stop_all_queues - Stop all queues +- * @priv: driver private structure +- */ +-static void stmmac_stop_all_queues(struct stmmac_priv *priv) +-{ +- u32 tx_queues_cnt = priv->plat->tx_queues_to_use; +- u32 queue; +- +- for (queue = 0; queue < tx_queues_cnt; queue++) +- netif_tx_stop_queue(netdev_get_tx_queue(priv->dev, queue)); +-} +- +-/** +- * stmmac_start_all_queues - Start all queues +- * @priv: driver private structure +- */ +-static void stmmac_start_all_queues(struct stmmac_priv *priv) +-{ +- u32 tx_queues_cnt = priv->plat->tx_queues_to_use; +- u32 queue; +- +- for (queue = 0; queue < tx_queues_cnt; queue++) +- netif_tx_start_queue(netdev_get_tx_queue(priv->dev, queue)); +-} +- + static void stmmac_service_event_schedule(struct stmmac_priv *priv) + { + if (!test_bit(STMMAC_DOWN, &priv->state) && +@@ -2866,7 +2840,7 @@ static int stmmac_open(struct net_device *dev) + } + + stmmac_enable_all_queues(priv); +- stmmac_start_all_queues(priv); ++ netif_tx_start_all_queues(priv->dev); + + return 0; + +@@ -2907,8 +2881,6 @@ static int stmmac_release(struct net_device *dev) + phylink_stop(priv->phylink); + phylink_disconnect_phy(priv->phylink); + +- stmmac_stop_all_queues(priv); +- + stmmac_disable_all_queues(priv); + + for (chan = 0; chan < priv->plat->tx_queues_to_use; chan++) +@@ -5078,7 +5050,6 @@ int stmmac_suspend(struct device *dev) + mutex_lock(&priv->lock); + + netif_device_detach(ndev); +- stmmac_stop_all_queues(priv); + + stmmac_disable_all_queues(priv); + +@@ -5203,8 +5174,6 @@ int stmmac_resume(struct device *dev) + + stmmac_enable_all_queues(priv); + +- stmmac_start_all_queues(priv); +- + mutex_unlock(&priv->lock); + + if (!device_may_wakeup(priv->device)) { +-- +2.25.1 + diff --git a/queue-5.8/net-wilc1000-clean-up-resource-in-error-path-of-init.patch b/queue-5.8/net-wilc1000-clean-up-resource-in-error-path-of-init.patch new file mode 100644 index 00000000000..97a942c58c3 --- /dev/null +++ b/queue-5.8/net-wilc1000-clean-up-resource-in-error-path-of-init.patch @@ -0,0 +1,44 @@ +From f018706b79ba9618827f845766fa790a1976ae3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 08:30:19 -0400 +Subject: net: wilc1000: clean up resource in error path of init mon interface + +From: Huang Guobin + +[ Upstream commit 55bd149978679742374c800e56e8f6bc74378bbe ] + +The wilc_wfi_init_mon_int() forgets to clean up resource when +register_netdevice() failed. Add the missed call to fix it. +And the return value of netdev_priv can't be NULL, so remove +the unnecessary error handling. + +Fixes: 588713006ea4 ("staging: wilc1000: avoid the use of 'wilc_wfi_mon' static variable") +Reported-by: Hulk Robot +Signed-off-by: Huang Guobin +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200917123019.206382-1-huangguobin4@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/staging/wilc1000/mon.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/staging/wilc1000/mon.c b/drivers/staging/wilc1000/mon.c +index 60331417bd983..66f1c870f4f69 100644 +--- a/drivers/staging/wilc1000/mon.c ++++ b/drivers/staging/wilc1000/mon.c +@@ -236,11 +236,10 @@ struct net_device *wilc_wfi_init_mon_interface(struct wilc *wl, + + if (register_netdevice(wl->monitor_dev)) { + netdev_err(real_dev, "register_netdevice failed\n"); ++ free_netdev(wl->monitor_dev); + return NULL; + } + priv = netdev_priv(wl->monitor_dev); +- if (!priv) +- return NULL; + + priv->real_ndev = real_dev; + +-- +2.25.1 + diff --git a/queue-5.8/netfilter-conntrack-connection-timeout-after-re-regi.patch b/queue-5.8/netfilter-conntrack-connection-timeout-after-re-regi.patch new file mode 100644 index 00000000000..b4dabd5323d --- /dev/null +++ b/queue-5.8/netfilter-conntrack-connection-timeout-after-re-regi.patch @@ -0,0 +1,64 @@ +From 690db2f22adaa30fc96a0beb9a66aa94a8c10514 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Oct 2020 12:32:52 -0700 +Subject: netfilter: conntrack: connection timeout after re-register + +From: Francesco Ruggeri + +[ Upstream commit 4f25434bccc28cf8a07876ef5142a2869a674353 ] + +If the first packet conntrack sees after a re-register is an outgoing +keepalive packet with no data (SEG.SEQ = SND.NXT-1), td_end is set to +SND.NXT-1. +When the peer correctly acknowledges SND.NXT, tcp_in_window fails +check III (Upper bound for valid (s)ack: sack <= receiver.td_end) and +returns false, which cascades into nf_conntrack_in setting +skb->_nfct = 0 and in later conntrack iptables rules not matching. +In cases where iptables are dropping packets that do not match +conntrack rules this can result in idle tcp connections to time out. + +v2: adjust td_end when getting the reply rather than when sending out + the keepalive packet. + +Fixes: f94e63801ab2 ("netfilter: conntrack: reset tcp maxwin on re-register") +Signed-off-by: Francesco Ruggeri +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_tcp.c | 19 +++++++++++++------ + 1 file changed, 13 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 1926fd56df56a..848b137151c26 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -541,13 +541,20 @@ static bool tcp_in_window(const struct nf_conn *ct, + swin = win << sender->td_scale; + sender->td_maxwin = (swin == 0 ? 1 : swin); + sender->td_maxend = end + sender->td_maxwin; +- /* +- * We haven't seen traffic in the other direction yet +- * but we have to tweak window tracking to pass III +- * and IV until that happens. +- */ +- if (receiver->td_maxwin == 0) ++ if (receiver->td_maxwin == 0) { ++ /* We haven't seen traffic in the other ++ * direction yet but we have to tweak window ++ * tracking to pass III and IV until that ++ * happens. ++ */ + receiver->td_end = receiver->td_maxend = sack; ++ } else if (sack == receiver->td_end + 1) { ++ /* Likely a reply to a keepalive. ++ * Needed for III. ++ */ ++ receiver->td_end++; ++ } ++ + } + } else if (((state->state == TCP_CONNTRACK_SYN_SENT + && dir == IP_CT_DIR_ORIGINAL) +-- +2.25.1 + diff --git a/queue-5.8/netfilter-ebtables-fixes-dropping-of-small-packets-i.patch b/queue-5.8/netfilter-ebtables-fixes-dropping-of-small-packets-i.patch new file mode 100644 index 00000000000..f4633778142 --- /dev/null +++ b/queue-5.8/netfilter-ebtables-fixes-dropping-of-small-packets-i.patch @@ -0,0 +1,70 @@ +From 285a9589636718c19ed844d2b00ebfa115e2c978 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Oct 2020 12:36:15 +0000 +Subject: netfilter: ebtables: Fixes dropping of small packets in bridge nat +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Timothée COCAULT + +[ Upstream commit 63137bc5882a1882c553d389fdeeeace86ee1741 ] + +Fixes an error causing small packets to get dropped. skb_ensure_writable +expects the second parameter to be a length in the ethernet payload.=20 +If we want to write the ethernet header (src, dst), we should pass 0. +Otherwise, packets with small payloads (< ETH_ALEN) will get dropped. + +Fixes: c1a831167901 ("netfilter: bridge: convert skb_make_writable to skb_ensure_writable") +Signed-off-by: Timothée COCAULT +Reviewed-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/bridge/netfilter/ebt_dnat.c | 2 +- + net/bridge/netfilter/ebt_redirect.c | 2 +- + net/bridge/netfilter/ebt_snat.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c +index 12a4f4d936810..3fda71a8579d1 100644 +--- a/net/bridge/netfilter/ebt_dnat.c ++++ b/net/bridge/netfilter/ebt_dnat.c +@@ -21,7 +21,7 @@ ebt_dnat_tg(struct sk_buff *skb, const struct xt_action_param *par) + { + const struct ebt_nat_info *info = par->targinfo; + +- if (skb_ensure_writable(skb, ETH_ALEN)) ++ if (skb_ensure_writable(skb, 0)) + return EBT_DROP; + + ether_addr_copy(eth_hdr(skb)->h_dest, info->mac); +diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c +index 0cad62a4052b9..307790562b492 100644 +--- a/net/bridge/netfilter/ebt_redirect.c ++++ b/net/bridge/netfilter/ebt_redirect.c +@@ -21,7 +21,7 @@ ebt_redirect_tg(struct sk_buff *skb, const struct xt_action_param *par) + { + const struct ebt_redirect_info *info = par->targinfo; + +- if (skb_ensure_writable(skb, ETH_ALEN)) ++ if (skb_ensure_writable(skb, 0)) + return EBT_DROP; + + if (xt_hooknum(par) != NF_BR_BROUTING) +diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c +index 27443bf229a3b..7dfbcdfc30e5d 100644 +--- a/net/bridge/netfilter/ebt_snat.c ++++ b/net/bridge/netfilter/ebt_snat.c +@@ -22,7 +22,7 @@ ebt_snat_tg(struct sk_buff *skb, const struct xt_action_param *par) + { + const struct ebt_nat_info *info = par->targinfo; + +- if (skb_ensure_writable(skb, ETH_ALEN * 2)) ++ if (skb_ensure_writable(skb, 0)) + return EBT_DROP; + + ether_addr_copy(eth_hdr(skb)->h_source, info->mac); +-- +2.25.1 + diff --git a/queue-5.8/netfilter-nf_fwd_netdev-clear-timestamp-in-forwardin.patch b/queue-5.8/netfilter-nf_fwd_netdev-clear-timestamp-in-forwardin.patch new file mode 100644 index 00000000000..952c122e1b7 --- /dev/null +++ b/queue-5.8/netfilter-nf_fwd_netdev-clear-timestamp-in-forwardin.patch @@ -0,0 +1,49 @@ +From f48b6e9853360b07c06a434b0486ed663028c39a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 12:55:52 +0200 +Subject: netfilter: nf_fwd_netdev: clear timestamp in forwarding path + +From: Pablo Neira Ayuso + +[ Upstream commit c77761c8a59405cb7aa44188b30fffe13fbdd02d ] + +Similar to 7980d2eabde8 ("ipvs: clear skb->tstamp in forwarding path"). +fq qdisc requires tstamp to be cleared in forwarding path. + +Fixes: 8203e2d844d3 ("net: clear skb->tstamp in forwarding paths") +Fixes: fb420d5d91c1 ("tcp/fq: move back to CLOCK_MONOTONIC") +Fixes: 80b14dee2bea ("net: Add a new socket option for a future transmit time.") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_dup_netdev.c | 1 + + net/netfilter/nft_fwd_netdev.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/net/netfilter/nf_dup_netdev.c b/net/netfilter/nf_dup_netdev.c +index 2b01a151eaa80..a579e59ee5c5e 100644 +--- a/net/netfilter/nf_dup_netdev.c ++++ b/net/netfilter/nf_dup_netdev.c +@@ -19,6 +19,7 @@ static void nf_do_netdev_egress(struct sk_buff *skb, struct net_device *dev) + skb_push(skb, skb->mac_len); + + skb->dev = dev; ++ skb->tstamp = 0; + dev_queue_xmit(skb); + } + +diff --git a/net/netfilter/nft_fwd_netdev.c b/net/netfilter/nft_fwd_netdev.c +index 3087e23297dbf..b77985986b24e 100644 +--- a/net/netfilter/nft_fwd_netdev.c ++++ b/net/netfilter/nft_fwd_netdev.c +@@ -138,6 +138,7 @@ static void nft_fwd_neigh_eval(const struct nft_expr *expr, + return; + + skb->dev = dev; ++ skb->tstamp = 0; + neigh_xmit(neigh_table, dev, addr, skb); + out: + regs->verdict.code = verdict; +-- +2.25.1 + diff --git a/queue-5.8/netfilter-nf_log-missing-vlan-offload-tag-and-proto.patch b/queue-5.8/netfilter-nf_log-missing-vlan-offload-tag-and-proto.patch new file mode 100644 index 00000000000..c1c368e00c2 --- /dev/null +++ b/queue-5.8/netfilter-nf_log-missing-vlan-offload-tag-and-proto.patch @@ -0,0 +1,139 @@ +From 9ca495606cfe5f04dbdf595f25f86961715ac71f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Oct 2020 17:06:06 +0200 +Subject: netfilter: nf_log: missing vlan offload tag and proto + +From: Pablo Neira Ayuso + +[ Upstream commit 0d9826bc18ce356e8909919ad681ad65d0a6061e ] + +Dump vlan tag and proto for the usual vlan offload case if the +NF_LOG_MACDECODE flag is set on. Without this information the logging is +misleading as there is no reference to the VLAN header. + +[12716.993704] test: IN=veth0 OUT= MACSRC=86:6c:92:ea:d6:73 MACDST=0e:3b:eb:86:73:76 VPROTO=8100 VID=10 MACPROTO=0800 SRC=192.168.10.2 DST=172.217.168.163 LEN=52 TOS=0x00 PREC=0x00 TTL=64 ID=2548 DF PROTO=TCP SPT=55848 DPT=80 WINDOW=501 RES=0x00 ACK FIN URGP=0 +[12721.157643] test: IN=veth0 OUT= MACSRC=86:6c:92:ea:d6:73 MACDST=0e:3b:eb:86:73:76 VPROTO=8100 VID=10 MACPROTO=0806 ARP HTYPE=1 PTYPE=0x0800 OPCODE=2 MACSRC=86:6c:92:ea:d6:73 IPSRC=192.168.10.2 MACDST=0e:3b:eb:86:73:76 IPDST=192.168.10.1 + +Fixes: 83e96d443b37 ("netfilter: log: split family specific code to nf_log_{ip,ip6,common}.c files") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + include/net/netfilter/nf_log.h | 1 + + net/ipv4/netfilter/nf_log_arp.c | 19 +++++++++++++++++-- + net/ipv4/netfilter/nf_log_ipv4.c | 6 ++++-- + net/ipv6/netfilter/nf_log_ipv6.c | 8 +++++--- + net/netfilter/nf_log_common.c | 12 ++++++++++++ + 5 files changed, 39 insertions(+), 7 deletions(-) + +diff --git a/include/net/netfilter/nf_log.h b/include/net/netfilter/nf_log.h +index 0d3920896d502..716db4a0fed89 100644 +--- a/include/net/netfilter/nf_log.h ++++ b/include/net/netfilter/nf_log.h +@@ -108,6 +108,7 @@ int nf_log_dump_tcp_header(struct nf_log_buf *m, const struct sk_buff *skb, + unsigned int logflags); + void nf_log_dump_sk_uid_gid(struct net *net, struct nf_log_buf *m, + struct sock *sk); ++void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb); + void nf_log_dump_packet_common(struct nf_log_buf *m, u_int8_t pf, + unsigned int hooknum, const struct sk_buff *skb, + const struct net_device *in, +diff --git a/net/ipv4/netfilter/nf_log_arp.c b/net/ipv4/netfilter/nf_log_arp.c +index 7a83f881efa9e..136030ad2e546 100644 +--- a/net/ipv4/netfilter/nf_log_arp.c ++++ b/net/ipv4/netfilter/nf_log_arp.c +@@ -43,16 +43,31 @@ static void dump_arp_packet(struct nf_log_buf *m, + const struct nf_loginfo *info, + const struct sk_buff *skb, unsigned int nhoff) + { +- const struct arphdr *ah; +- struct arphdr _arph; + const struct arppayload *ap; + struct arppayload _arpp; ++ const struct arphdr *ah; ++ unsigned int logflags; ++ struct arphdr _arph; + + ah = skb_header_pointer(skb, 0, sizeof(_arph), &_arph); + if (ah == NULL) { + nf_log_buf_add(m, "TRUNCATED"); + return; + } ++ ++ if (info->type == NF_LOG_TYPE_LOG) ++ logflags = info->u.log.logflags; ++ else ++ logflags = NF_LOG_DEFAULT_MASK; ++ ++ if (logflags & NF_LOG_MACDECODE) { ++ nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", ++ eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); ++ nf_log_dump_vlan(m, skb); ++ nf_log_buf_add(m, "MACPROTO=%04x ", ++ ntohs(eth_hdr(skb)->h_proto)); ++ } ++ + nf_log_buf_add(m, "ARP HTYPE=%d PTYPE=0x%04x OPCODE=%d", + ntohs(ah->ar_hrd), ntohs(ah->ar_pro), ntohs(ah->ar_op)); + +diff --git a/net/ipv4/netfilter/nf_log_ipv4.c b/net/ipv4/netfilter/nf_log_ipv4.c +index 0c72156130b68..d07583fac8f8c 100644 +--- a/net/ipv4/netfilter/nf_log_ipv4.c ++++ b/net/ipv4/netfilter/nf_log_ipv4.c +@@ -284,8 +284,10 @@ static void dump_ipv4_mac_header(struct nf_log_buf *m, + + switch (dev->type) { + case ARPHRD_ETHER: +- nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ", +- eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, ++ nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", ++ eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); ++ nf_log_dump_vlan(m, skb); ++ nf_log_buf_add(m, "MACPROTO=%04x ", + ntohs(eth_hdr(skb)->h_proto)); + return; + default: +diff --git a/net/ipv6/netfilter/nf_log_ipv6.c b/net/ipv6/netfilter/nf_log_ipv6.c +index da64550a57075..8210ff34ed9b7 100644 +--- a/net/ipv6/netfilter/nf_log_ipv6.c ++++ b/net/ipv6/netfilter/nf_log_ipv6.c +@@ -297,9 +297,11 @@ static void dump_ipv6_mac_header(struct nf_log_buf *m, + + switch (dev->type) { + case ARPHRD_ETHER: +- nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM MACPROTO=%04x ", +- eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest, +- ntohs(eth_hdr(skb)->h_proto)); ++ nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ", ++ eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest); ++ nf_log_dump_vlan(m, skb); ++ nf_log_buf_add(m, "MACPROTO=%04x ", ++ ntohs(eth_hdr(skb)->h_proto)); + return; + default: + break; +diff --git a/net/netfilter/nf_log_common.c b/net/netfilter/nf_log_common.c +index ae5628ddbe6d7..fd7c5f0f5c25b 100644 +--- a/net/netfilter/nf_log_common.c ++++ b/net/netfilter/nf_log_common.c +@@ -171,6 +171,18 @@ nf_log_dump_packet_common(struct nf_log_buf *m, u_int8_t pf, + } + EXPORT_SYMBOL_GPL(nf_log_dump_packet_common); + ++void nf_log_dump_vlan(struct nf_log_buf *m, const struct sk_buff *skb) ++{ ++ u16 vid; ++ ++ if (!skb_vlan_tag_present(skb)) ++ return; ++ ++ vid = skb_vlan_tag_get(skb); ++ nf_log_buf_add(m, "VPROTO=%04x VID=%u ", ntohs(skb->vlan_proto), vid); ++} ++EXPORT_SYMBOL_GPL(nf_log_dump_vlan); ++ + /* bridge and netdev logging families share this code. */ + void nf_log_l2packet(struct net *net, u_int8_t pf, + __be16 protocol, +-- +2.25.1 + diff --git a/queue-5.8/netsec-ignore-phy-mode-device-property-on-acpi-syste.patch b/queue-5.8/netsec-ignore-phy-mode-device-property-on-acpi-syste.patch new file mode 100644 index 00000000000..a3b1e4df879 --- /dev/null +++ b/queue-5.8/netsec-ignore-phy-mode-device-property-on-acpi-syste.patch @@ -0,0 +1,121 @@ +From 116b79760465354b5ae55daa687481618cd21fe7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 18 Oct 2020 18:36:25 +0200 +Subject: netsec: ignore 'phy-mode' device property on ACPI systems + +From: Ard Biesheuvel + +[ Upstream commit acd7aaf51b20263a7e62d2a26569988c63bdd3d8 ] + +Since commit bbc4d71d63549bc ("net: phy: realtek: fix rtl8211e rx/tx +delay config"), the Realtek PHY driver will override any TX/RX delay +set by hardware straps if the phy-mode device property does not match. + +This is causing problems on SynQuacer based platforms (the only SoC +that incorporates the netsec hardware), since many were built with +this Realtek PHY, and shipped with firmware that defines the phy-mode +as 'rgmii', even though the PHY is configured for TX and RX delay using +pull-ups. + +From the driver's perspective, we should not make any assumptions in +the general case that the PHY hardware does not require any initial +configuration. However, the situation is slightly different for ACPI +boot, since it implies rich firmware with AML abstractions to handle +hardware details that are not exposed to the OS. So in the ACPI case, +it is reasonable to assume that the PHY comes up in the right mode, +regardless of whether the mode is set by straps, by boot time firmware +or by AML executed by the ACPI interpreter. + +So let's ignore the 'phy-mode' device property when probing the netsec +driver in ACPI mode, and hardcode the mode to PHY_INTERFACE_MODE_NA, +which should work with any PHY provided that it is configured by the +time the driver attaches to it. While at it, document that omitting +the mode is permitted for DT probing as well, by setting the phy-mode +DT property to the empty string. + +Fixes: 533dd11a12f6 ("net: socionext: Add Synquacer NetSec driver") +Signed-off-by: Ard Biesheuvel +Reviewed-by: Ilias Apalodimas +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20201018163625.2392-1-ardb@kernel.org +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../bindings/net/socionext-netsec.txt | 4 +++- + drivers/net/ethernet/socionext/netsec.c | 24 +++++++++++++------ + 2 files changed, 20 insertions(+), 8 deletions(-) + +diff --git a/Documentation/devicetree/bindings/net/socionext-netsec.txt b/Documentation/devicetree/bindings/net/socionext-netsec.txt +index 9d6c9feb12ff1..a3c1dffaa4bb4 100644 +--- a/Documentation/devicetree/bindings/net/socionext-netsec.txt ++++ b/Documentation/devicetree/bindings/net/socionext-netsec.txt +@@ -30,7 +30,9 @@ Optional properties: (See ethernet.txt file in the same directory) + - max-frame-size: See ethernet.txt in the same directory. + + The MAC address will be determined using the optional properties +-defined in ethernet.txt. ++defined in ethernet.txt. The 'phy-mode' property is required, but may ++be set to the empty string if the PHY configuration is programmed by ++the firmware or set by hardware straps, and needs to be preserved. + + Example: + eth0: ethernet@522d0000 { +diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c +index 0f366cc50b74c..7f8be61a37089 100644 +--- a/drivers/net/ethernet/socionext/netsec.c ++++ b/drivers/net/ethernet/socionext/netsec.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -1836,6 +1837,14 @@ static const struct net_device_ops netsec_netdev_ops = { + static int netsec_of_probe(struct platform_device *pdev, + struct netsec_priv *priv, u32 *phy_addr) + { ++ int err; ++ ++ err = of_get_phy_mode(pdev->dev.of_node, &priv->phy_interface); ++ if (err) { ++ dev_err(&pdev->dev, "missing required property 'phy-mode'\n"); ++ return err; ++ } ++ + priv->phy_np = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0); + if (!priv->phy_np) { + dev_err(&pdev->dev, "missing required property 'phy-handle'\n"); +@@ -1862,6 +1871,14 @@ static int netsec_acpi_probe(struct platform_device *pdev, + if (!IS_ENABLED(CONFIG_ACPI)) + return -ENODEV; + ++ /* ACPI systems are assumed to configure the PHY in firmware, so ++ * there is really no need to discover the PHY mode from the DSDT. ++ * Since firmware is known to exist in the field that configures the ++ * PHY correctly but passes the wrong mode string in the phy-mode ++ * device property, we have no choice but to ignore it. ++ */ ++ priv->phy_interface = PHY_INTERFACE_MODE_NA; ++ + ret = device_property_read_u32(&pdev->dev, "phy-channel", phy_addr); + if (ret) { + dev_err(&pdev->dev, +@@ -1998,13 +2015,6 @@ static int netsec_probe(struct platform_device *pdev) + priv->msg_enable = NETIF_MSG_TX_ERR | NETIF_MSG_HW | NETIF_MSG_DRV | + NETIF_MSG_LINK | NETIF_MSG_PROBE; + +- priv->phy_interface = device_get_phy_mode(&pdev->dev); +- if ((int)priv->phy_interface < 0) { +- dev_err(&pdev->dev, "missing required property 'phy-mode'\n"); +- ret = -ENODEV; +- goto free_ndev; +- } +- + priv->ioaddr = devm_ioremap(&pdev->dev, mmio_res->start, + resource_size(mmio_res)); + if (!priv->ioaddr) { +-- +2.25.1 + diff --git a/queue-5.8/nfs-add-missing-posix-local_lock-constant-table-defi.patch b/queue-5.8/nfs-add-missing-posix-local_lock-constant-table-defi.patch new file mode 100644 index 00000000000..0ed4712b68a --- /dev/null +++ b/queue-5.8/nfs-add-missing-posix-local_lock-constant-table-defi.patch @@ -0,0 +1,35 @@ +From 5ff275e56f9bbb9c5cb9e53db25d3a5b50729452 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Oct 2020 10:03:12 -0400 +Subject: nfs: add missing "posix" local_lock constant table definition + +From: Scott Mayhew + +[ Upstream commit a2d24bcb97dc7b0be1cb891e60ae133bdf36c786 ] + +"mount -o local_lock=posix..." was broken by the mount API conversion +due to the missing constant. + +Fixes: e38bb238ed8c ("NFS: Convert mount option parsing to use functionality from fs_parser.h") +Signed-off-by: Scott Mayhew +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/fs_context.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/fs_context.c b/fs/nfs/fs_context.c +index ccc88be88d6ae..a30b4bcb95a2c 100644 +--- a/fs/nfs/fs_context.c ++++ b/fs/nfs/fs_context.c +@@ -94,6 +94,7 @@ enum { + static const struct constant_table nfs_param_enums_local_lock[] = { + { "all", Opt_local_lock_all }, + { "flock", Opt_local_lock_flock }, ++ { "posix", Opt_local_lock_posix }, + { "none", Opt_local_lock_none }, + {} + }; +-- +2.25.1 + diff --git a/queue-5.8/nl80211-fix-non-split-wiphy-information.patch b/queue-5.8/nl80211-fix-non-split-wiphy-information.patch new file mode 100644 index 00000000000..41b82dd605f --- /dev/null +++ b/queue-5.8/nl80211-fix-non-split-wiphy-information.patch @@ -0,0 +1,49 @@ +From 903962e291757431339b6482863222bc545f878d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 13:07:18 +0200 +Subject: nl80211: fix non-split wiphy information + +From: Johannes Berg + +[ Upstream commit ab10c22bc3b2024f0c9eafa463899a071eac8d97 ] + +When dumping wiphy information, we try to split the data into +many submessages, but for old userspace we still support the +old mode where this doesn't happen. + +However, in this case we were not resetting our state correctly +and dumping multiple messages for each wiphy, which would have +broken such older userspace. + +This was broken pretty much immediately afterwards because it +only worked in the original commit where non-split dumps didn't +have any more data than split dumps... + +Fixes: fe1abafd942f ("nl80211: re-add channel width and extended capa advertising") +Signed-off-by: Johannes Berg +Link: https://lore.kernel.org/r/20200928130717.3e6d9c6bada2.Ie0f151a8d0d00a8e1e18f6a8c9244dd02496af67@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 7cbb94b4d4917..47ab86ee192ac 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -2355,7 +2355,10 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev, + * case we'll continue with more data in the next round, + * but break unconditionally so unsplit data stops here. + */ +- state->split_start++; ++ if (state->split) ++ state->split_start++; ++ else ++ state->split_start = 0; + break; + case 9: + if (rdev->wiphy.extended_capabilities && +-- +2.25.1 + diff --git a/queue-5.8/nl80211-fix-obss-pd-min-and-max-offset-validation.patch b/queue-5.8/nl80211-fix-obss-pd-min-and-max-offset-validation.patch new file mode 100644 index 00000000000..28d717f3d14 --- /dev/null +++ b/queue-5.8/nl80211-fix-obss-pd-min-and-max-offset-validation.patch @@ -0,0 +1,59 @@ +From 1da0c4381cbfd514a5737d077a88c961d3193f4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 00:28:10 -0700 +Subject: nl80211: fix OBSS PD min and max offset validation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rajkumar Manoharan + +[ Upstream commit 6c8b6e4a5f745ec49286ac0a3f1d591a34818f82 ] + +The SRG min and max offset won't present when SRG Information Present of +SR control field of Spatial Reuse Parameter Set element set to 0. Per +spec. IEEE802.11ax D7.0, SRG OBSS PD Min Offset ≤ SRG OBSS PD Max +Offset. Hence fix the constrain check to allow same values in both +offset and also call appropriate nla_get function to read the values. + +Fixes: 796e90f42b7e ("cfg80211: add support for parsing OBBS_PD attributes") +Signed-off-by: Rajkumar Manoharan +Link: https://lore.kernel.org/r/1601278091-20313-1-git-send-email-rmanohar@codeaurora.org +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 18 ++++++++---------- + 1 file changed, 8 insertions(+), 10 deletions(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 4d7b255067225..7cbb94b4d4917 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -4683,16 +4683,14 @@ static int nl80211_parse_he_obss_pd(struct nlattr *attrs, + if (err) + return err; + +- if (!tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] || +- !tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]) +- return -EINVAL; +- +- he_obss_pd->min_offset = +- nla_get_u32(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]); +- he_obss_pd->max_offset = +- nla_get_u32(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]); +- +- if (he_obss_pd->min_offset >= he_obss_pd->max_offset) ++ if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]) ++ he_obss_pd->min_offset = ++ nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]); ++ if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]) ++ he_obss_pd->max_offset = ++ nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]); ++ ++ if (he_obss_pd->min_offset > he_obss_pd->max_offset) + return -EINVAL; + + he_obss_pd->enable = true; +-- +2.25.1 + diff --git a/queue-5.8/ntb-hw-amd-fix-an-issue-about-leak-system-resources.patch b/queue-5.8/ntb-hw-amd-fix-an-issue-about-leak-system-resources.patch new file mode 100644 index 00000000000..2fc4dbdb58a --- /dev/null +++ b/queue-5.8/ntb-hw-amd-fix-an-issue-about-leak-system-resources.patch @@ -0,0 +1,36 @@ +From e4a8ece90ef23c19a57b8350163849da69995a51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 09:59:57 +0800 +Subject: NTB: hw: amd: fix an issue about leak system resources + +From: Kaige Li + +[ Upstream commit 44a0a3c17919db1498cebb02ecf3cf4abc1ade7b ] + +The related system resources were not released when pci_set_dma_mask(), +pci_set_consistent_dma_mask(), or pci_iomap() return error in the +amd_ntb_init_pci() function. Add pci_release_regions() to fix it. + +Fixes: a1b3695820aa ("NTB: Add support for AMD PCI-Express Non-Transparent Bridge") +Signed-off-by: Kaige Li +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/amd/ntb_hw_amd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c +index 88e1db65be02c..71428d8cbcfc5 100644 +--- a/drivers/ntb/hw/amd/ntb_hw_amd.c ++++ b/drivers/ntb/hw/amd/ntb_hw_amd.c +@@ -1203,6 +1203,7 @@ static int amd_ntb_init_pci(struct amd_ntb_dev *ndev, + + err_dma_mask: + pci_clear_master(pdev); ++ pci_release_regions(pdev); + err_pci_regions: + pci_disable_device(pdev); + err_pci_enable: +-- +2.25.1 + diff --git a/queue-5.8/ntb-intel-fix-memleak-in-intel_ntb_pci_probe.patch b/queue-5.8/ntb-intel-fix-memleak-in-intel_ntb_pci_probe.patch new file mode 100644 index 00000000000..6223bc0884d --- /dev/null +++ b/queue-5.8/ntb-intel-fix-memleak-in-intel_ntb_pci_probe.patch @@ -0,0 +1,37 @@ +From e0cc37d637ce357ca2ffac56d8497798417b058e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Aug 2020 14:55:12 +0800 +Subject: ntb: intel: Fix memleak in intel_ntb_pci_probe + +From: Dinghao Liu + +[ Upstream commit dbb8df5c2d27610a87b0168a8acc89d73fbfde94 ] + +The default error branch of a series of pdev_is_gen calls +should free ndev just like what we've done in these calls. + +Fixes: 26bfe3d0b227 ("ntb: intel: Add Icelake (gen4) support for Intel NTB") +Signed-off-by: Dinghao Liu +Acked-by: Dave Jiang +Signed-off-by: Jon Mason +Signed-off-by: Sasha Levin +--- + drivers/ntb/hw/intel/ntb_hw_gen1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ntb/hw/intel/ntb_hw_gen1.c b/drivers/ntb/hw/intel/ntb_hw_gen1.c +index 423f9b8fbbcf5..fa561d455f7c8 100644 +--- a/drivers/ntb/hw/intel/ntb_hw_gen1.c ++++ b/drivers/ntb/hw/intel/ntb_hw_gen1.c +@@ -1893,7 +1893,7 @@ static int intel_ntb_pci_probe(struct pci_dev *pdev, + goto err_init_dev; + } else { + rc = -EINVAL; +- goto err_ndev; ++ goto err_init_pci; + } + + ndev_reset_unsafe_flags(ndev); +-- +2.25.1 + diff --git a/queue-5.8/ntfs-add-check-for-mft-record-size-in-superblock.patch b/queue-5.8/ntfs-add-check-for-mft-record-size-in-superblock.patch new file mode 100644 index 00000000000..4327871a6b2 --- /dev/null +++ b/queue-5.8/ntfs-add-check-for-mft-record-size-in-superblock.patch @@ -0,0 +1,46 @@ +From 4f87bcc7c7522e3b90b412f4ce94118f2e04ac24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 16:48:17 -0700 +Subject: ntfs: add check for mft record size in superblock + +From: Rustam Kovhaev + +[ Upstream commit 4f8c94022f0bc3babd0a124c0a7dcdd7547bd94e ] + +Number of bytes allocated for mft record should be equal to the mft record +size stored in ntfs superblock as reported by syzbot, userspace might +trigger out-of-bounds read by dereferencing ctx->attr in ntfs_attr_find() + +Reported-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com +Signed-off-by: Rustam Kovhaev +Signed-off-by: Andrew Morton +Tested-by: syzbot+aed06913f36eff9b544e@syzkaller.appspotmail.com +Acked-by: Anton Altaparmakov +Link: https://syzkaller.appspot.com/bug?extid=aed06913f36eff9b544e +Link: https://lkml.kernel.org/r/20200824022804.226242-1-rkovhaev@gmail.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ntfs/inode.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c +index d4359a1df3d5e..84933a0af49b6 100644 +--- a/fs/ntfs/inode.c ++++ b/fs/ntfs/inode.c +@@ -1809,6 +1809,12 @@ int ntfs_read_inode_mount(struct inode *vi) + brelse(bh); + } + ++ if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) { ++ ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.", ++ le32_to_cpu(m->bytes_allocated), vol->mft_record_size); ++ goto err_out; ++ } ++ + /* Apply the mst fixups. */ + if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) { + /* FIXME: Try to use the $MFTMirr now. */ +-- +2.25.1 + diff --git a/queue-5.8/nvmem-core-fix-missing-of_node_put-in-of_nvmem_devic.patch b/queue-5.8/nvmem-core-fix-missing-of_node_put-in-of_nvmem_devic.patch new file mode 100644 index 00000000000..22fbfdadabe --- /dev/null +++ b/queue-5.8/nvmem-core-fix-missing-of_node_put-in-of_nvmem_devic.patch @@ -0,0 +1,49 @@ +From 66b2458323fbe5650d87bf17ea2c4d48549b4eb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 14:44:37 +0100 +Subject: nvmem: core: fix missing of_node_put() in of_nvmem_device_get() + +From: Vadym Kochan + +[ Upstream commit b1c194dcdb1425fa59eec61ab927cfff33096149 ] + +of_parse_phandle() returns device_node with incremented ref count +which needs to be decremented by of_node_put() when device_node +is not used. + +Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.") +Signed-off-by: Vadym Kochan +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20200917134437.16637-5-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index 927eb5f6003f0..394e75dede725 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -823,6 +823,7 @@ struct nvmem_device *of_nvmem_device_get(struct device_node *np, const char *id) + { + + struct device_node *nvmem_np; ++ struct nvmem_device *nvmem; + int index = 0; + + if (id) +@@ -832,7 +833,9 @@ struct nvmem_device *of_nvmem_device_get(struct device_node *np, const char *id) + if (!nvmem_np) + return ERR_PTR(-ENOENT); + +- return __nvmem_device_get(nvmem_np, device_match_of_node); ++ nvmem = __nvmem_device_get(nvmem_np, device_match_of_node); ++ of_node_put(nvmem_np); ++ return nvmem; + } + EXPORT_SYMBOL_GPL(of_nvmem_device_get); + #endif +-- +2.25.1 + diff --git a/queue-5.8/nvmem-core-fix-possibly-memleak-when-use-nvmem_cell_.patch b/queue-5.8/nvmem-core-fix-possibly-memleak-when-use-nvmem_cell_.patch new file mode 100644 index 00000000000..8456dbfff87 --- /dev/null +++ b/queue-5.8/nvmem-core-fix-possibly-memleak-when-use-nvmem_cell_.patch @@ -0,0 +1,115 @@ +From 0d959a117e7a8c521eb6a61e25f2547b2ad3e9ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Sep 2020 23:44:56 +0300 +Subject: nvmem: core: fix possibly memleak when use + nvmem_cell_info_to_nvmem_cell() + +From: Vadym Kochan + +[ Upstream commit fc9eec4d643597cf4cb2fef17d48110e677610da ] + +Fix missing 'kfree_const(cell->name)' when call to +nvmem_cell_info_to_nvmem_cell() in several places: + + * after nvmem_cell_info_to_nvmem_cell() failed during + nvmem_add_cells() + + * during nvmem_device_cell_{read,write} when cell->name is + kstrdup'ed() without calling kfree_const() at the end, but + really there is no reason to do that 'dup, because the cell + instance is allocated on the stack for some short period to be + read/write without exposing it to the caller. + +So the new nvmem_cell_info_to_nvmem_cell_nodup() helper is introduced +which is used to convert cell_info -> cell without name duplication as +a lighweight version of nvmem_cell_info_to_nvmem_cell(). + +Fixes: e2a5402ec7c6 ("nvmem: Add nvmem_device based consumer apis.") +Reviewed-by: Srinivas Kandagatla +Acked-by: Srinivas Kandagatla +Signed-off-by: Vadym Kochan +Link: https://lore.kernel.org/r/20200923204456.14032-1-vadym.kochan@plvision.eu +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/nvmem/core.c | 33 ++++++++++++++++++++++++--------- + 1 file changed, 24 insertions(+), 9 deletions(-) + +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index 394e75dede725..4aca5b4a87d75 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -355,16 +355,14 @@ static void nvmem_cell_add(struct nvmem_cell *cell) + blocking_notifier_call_chain(&nvmem_notifier, NVMEM_CELL_ADD, cell); + } + +-static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem, +- const struct nvmem_cell_info *info, +- struct nvmem_cell *cell) ++static int nvmem_cell_info_to_nvmem_cell_nodup(struct nvmem_device *nvmem, ++ const struct nvmem_cell_info *info, ++ struct nvmem_cell *cell) + { + cell->nvmem = nvmem; + cell->offset = info->offset; + cell->bytes = info->bytes; +- cell->name = kstrdup_const(info->name, GFP_KERNEL); +- if (!cell->name) +- return -ENOMEM; ++ cell->name = info->name; + + cell->bit_offset = info->bit_offset; + cell->nbits = info->nbits; +@@ -376,13 +374,30 @@ static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem, + if (!IS_ALIGNED(cell->offset, nvmem->stride)) { + dev_err(&nvmem->dev, + "cell %s unaligned to nvmem stride %d\n", +- cell->name, nvmem->stride); ++ cell->name ?: "", nvmem->stride); + return -EINVAL; + } + + return 0; + } + ++static int nvmem_cell_info_to_nvmem_cell(struct nvmem_device *nvmem, ++ const struct nvmem_cell_info *info, ++ struct nvmem_cell *cell) ++{ ++ int err; ++ ++ err = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, cell); ++ if (err) ++ return err; ++ ++ cell->name = kstrdup_const(info->name, GFP_KERNEL); ++ if (!cell->name) ++ return -ENOMEM; ++ ++ return 0; ++} ++ + /** + * nvmem_add_cells() - Add cell information to an nvmem device + * +@@ -1436,7 +1451,7 @@ ssize_t nvmem_device_cell_read(struct nvmem_device *nvmem, + if (!nvmem) + return -EINVAL; + +- rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell); ++ rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell); + if (rc) + return rc; + +@@ -1466,7 +1481,7 @@ int nvmem_device_cell_write(struct nvmem_device *nvmem, + if (!nvmem) + return -EINVAL; + +- rc = nvmem_cell_info_to_nvmem_cell(nvmem, info, &cell); ++ rc = nvmem_cell_info_to_nvmem_cell_nodup(nvmem, info, &cell); + if (rc) + return rc; + +-- +2.25.1 + diff --git a/queue-5.8/nvmet-fix-uninitialized-work-for-zero-kato.patch b/queue-5.8/nvmet-fix-uninitialized-work-for-zero-kato.patch new file mode 100644 index 00000000000..2741eb224f9 --- /dev/null +++ b/queue-5.8/nvmet-fix-uninitialized-work-for-zero-kato.patch @@ -0,0 +1,55 @@ +From a1385db979f0808113cabf1813d9660788631b79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 09:51:40 +0800 +Subject: nvmet: fix uninitialized work for zero kato + +From: zhenwei pi + +[ Upstream commit 85bd23f3dc09a2ae9e56885420e52c54bf983713 ] + +When connecting a controller with a zero kato value using the following +command line + + nvme connect -t tcp -n NQN -a ADDR -s PORT --keep-alive-tmo=0 + +the warning below can be reproduced: + +WARNING: CPU: 1 PID: 241 at kernel/workqueue.c:1627 __queue_delayed_work+0x6d/0x90 +with trace: + mod_delayed_work_on+0x59/0x90 + nvmet_update_cc+0xee/0x100 [nvmet] + nvmet_execute_prop_set+0x72/0x80 [nvmet] + nvmet_tcp_try_recv_pdu+0x2f7/0x770 [nvmet_tcp] + nvmet_tcp_io_work+0x63f/0xb2d [nvmet_tcp] + ... + +This is caused by queuing up an uninitialized work. Althrough the +keep-alive timer is disabled during allocating the controller (fixed in +0d3b6a8d213a), ka_work still has a chance to run (called by +nvmet_start_ctrl). + +Fixes: 0d3b6a8d213a ("nvmet: Disable keep-alive timer when kato is cleared to 0h") +Signed-off-by: zhenwei pi +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 58b035cc67a01..75ed95a250fb5 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -1142,7 +1142,8 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl) + * in case a host died before it enabled the controller. Hence, simply + * reset the keep alive timer when the controller is enabled. + */ +- mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ); ++ if (ctrl->kato) ++ mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ); + } + + static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl) +-- +2.25.1 + diff --git a/queue-5.8/ocxl-fix-kconfig-dependency-warning-for-ocxl.patch b/queue-5.8/ocxl-fix-kconfig-dependency-warning-for-ocxl.patch new file mode 100644 index 00000000000..4f748e4a38d --- /dev/null +++ b/queue-5.8/ocxl-fix-kconfig-dependency-warning-for-ocxl.patch @@ -0,0 +1,54 @@ +From 861ad01cec7b60fb146120a75ec9ce7935edeb53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 12:41:49 +0300 +Subject: ocxl: fix kconfig dependency warning for OCXL + +From: Necip Fazil Yildiran + +[ Upstream commit 4b53a3c72116118d86fab4112277e1dc4edf273c ] + +When OCXL is enabled and HOTPLUG_PCI is disabled, it results in the +following Kbuild warning: + +WARNING: unmet direct dependencies detected for HOTPLUG_PCI_POWERNV + Depends on [n]: PCI [=y] && HOTPLUG_PCI [=n] && PPC_POWERNV [=y] && EEH [=y] + Selected by [y]: + - OCXL [=y] && PPC_POWERNV [=y] && PCI [=y] && EEH [=y] + +The reason is that OCXL selects HOTPLUG_PCI_POWERNV without depending on +or selecting HOTPLUG_PCI while HOTPLUG_PCI_POWERNV is subordinate to +HOTPLUG_PCI. + +HOTPLUG_PCI_POWERNV is a visible symbol with a set of dependencies. +Selecting it will lead to overlooking its other dependencies as well. + +Let OCXL depend on HOTPLUG_PCI_POWERNV instead to avoid Kbuild issues. + +Fixes: 49ce94b8677c ("ocxl: Add PCI hotplug dependency to Kconfig") +Acked-by: Frederic Barrat +Signed-off-by: Necip Fazil Yildiran +Link: https://lore.kernel.org/r/20200918094148.20525-1-fazilyildiran@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/ocxl/Kconfig | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/misc/ocxl/Kconfig b/drivers/misc/ocxl/Kconfig +index 2d2266c1439ef..51b51f3774701 100644 +--- a/drivers/misc/ocxl/Kconfig ++++ b/drivers/misc/ocxl/Kconfig +@@ -9,9 +9,8 @@ config OCXL_BASE + + config OCXL + tristate "OpenCAPI coherent accelerator support" +- depends on PPC_POWERNV && PCI && EEH ++ depends on PPC_POWERNV && PCI && EEH && HOTPLUG_PCI_POWERNV + select OCXL_BASE +- select HOTPLUG_PCI_POWERNV + default m + help + Select this option to enable the ocxl driver for Open +-- +2.25.1 + diff --git a/queue-5.8/opp-prevent-memory-leak-in-dev_pm_opp_attach_genpd.patch b/queue-5.8/opp-prevent-memory-leak-in-dev_pm_opp_attach_genpd.patch new file mode 100644 index 00000000000..7d37a3d3065 --- /dev/null +++ b/queue-5.8/opp-prevent-memory-leak-in-dev_pm_opp_attach_genpd.patch @@ -0,0 +1,55 @@ +From b0658cd9025514ee97cad3d50434c9f3e55979ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Aug 2020 11:22:37 +0530 +Subject: opp: Prevent memory leak in dev_pm_opp_attach_genpd() + +From: Viresh Kumar + +[ Upstream commit cb60e9602cce1593eb1e9cdc8ee562815078a354 ] + +If dev_pm_opp_attach_genpd() is called multiple times (once for each CPU +sharing the table), then it would result in unwanted behavior like +memory leak, attaching the domain multiple times, etc. + +Handle that by checking and returning earlier if the domains are already +attached. Now that dev_pm_opp_detach_genpd() can get called multiple +times as well, we need to protect that too. + +Note that the virtual device pointers aren't returned in this case, as +they may become unavailable to some callers during the middle of the +operation. + +Reported-by: Stephan Gerhold +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/core.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 91dcad982d362..11d192fb2e813 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -1918,6 +1918,9 @@ static void _opp_detach_genpd(struct opp_table *opp_table) + { + int index; + ++ if (!opp_table->genpd_virt_devs) ++ return; ++ + for (index = 0; index < opp_table->required_opp_count; index++) { + if (!opp_table->genpd_virt_devs[index]) + continue; +@@ -1964,6 +1967,9 @@ struct opp_table *dev_pm_opp_attach_genpd(struct device *dev, + if (!opp_table) + return ERR_PTR(-ENOMEM); + ++ if (opp_table->genpd_virt_devs) ++ return opp_table; ++ + /* + * If the genpd's OPP table isn't already initialized, parsing of the + * required-opps fail for dev. We should retry this after genpd's OPP +-- +2.25.1 + diff --git a/queue-5.8/overflow-include-header-file-with-size_max-declarati.patch b/queue-5.8/overflow-include-header-file-with-size_max-declarati.patch new file mode 100644 index 00000000000..8c39d52b41c --- /dev/null +++ b/queue-5.8/overflow-include-header-file-with-size_max-declarati.patch @@ -0,0 +1,42 @@ +From dc587b3a1e468594278c430e9ae79a6adc98c100 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Sep 2020 13:29:28 +0300 +Subject: overflow: Include header file with SIZE_MAX declaration + +From: Leon Romanovsky + +[ Upstream commit a4947e84f23474803b62a2759b5808147e4e15f9 ] + +The various array_size functions use SIZE_MAX define, but missed limits.h +causes to failure to compile code that needs overflow.h. + + In file included from drivers/infiniband/core/uverbs_std_types_device.c:6: + ./include/linux/overflow.h: In function 'array_size': + ./include/linux/overflow.h:258:10: error: 'SIZE_MAX' undeclared (first use in this function) + 258 | return SIZE_MAX; + | ^~~~~~~~ + +Fixes: 610b15c50e86 ("overflow.h: Add allocation size calculation helpers") +Link: https://lore.kernel.org/r/20200913102928.134985-1-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + include/linux/overflow.h | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/include/linux/overflow.h b/include/linux/overflow.h +index 93fcef105061b..ff3c48f0abc5b 100644 +--- a/include/linux/overflow.h ++++ b/include/linux/overflow.h +@@ -3,6 +3,7 @@ + #define __LINUX_OVERFLOW_H + + #include ++#include + + /* + * In the fallback code below, we need to compute the minimum and +-- +2.25.1 + diff --git a/queue-5.8/pci-aardvark-check-for-errors-from-pci_bridge_emul_i.patch b/queue-5.8/pci-aardvark-check-for-errors-from-pci_bridge_emul_i.patch new file mode 100644 index 00000000000..7c228d416f0 --- /dev/null +++ b/queue-5.8/pci-aardvark-check-for-errors-from-pci_bridge_emul_i.patch @@ -0,0 +1,63 @@ +From 26375dab66a9e53bfc0065df83ef622a85b31db5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 13:10:35 +0200 +Subject: PCI: aardvark: Check for errors from pci_bridge_emul_init() call +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 7862a6134456c8b4f8c39e8c94aa97e5c2f7f2b7 ] + +Function pci_bridge_emul_init() may fail so correctly check for errors. + +Link: https://lore.kernel.org/r/20200907111038.5811-3-pali@kernel.org +Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space") +Signed-off-by: Pali Rohár +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Marek Behún +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-aardvark.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index 8caa80b19cf86..d5f58684d962c 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -608,7 +608,7 @@ static struct pci_bridge_emul_ops advk_pci_bridge_emul_ops = { + * Initialize the configuration space of the PCI-to-PCI bridge + * associated with the given PCIe interface. + */ +-static void advk_sw_pci_bridge_init(struct advk_pcie *pcie) ++static int advk_sw_pci_bridge_init(struct advk_pcie *pcie) + { + struct pci_bridge_emul *bridge = &pcie->bridge; + +@@ -634,8 +634,7 @@ static void advk_sw_pci_bridge_init(struct advk_pcie *pcie) + bridge->data = pcie; + bridge->ops = &advk_pci_bridge_emul_ops; + +- pci_bridge_emul_init(bridge, 0); +- ++ return pci_bridge_emul_init(bridge, 0); + } + + static bool advk_pcie_valid_device(struct advk_pcie *pcie, struct pci_bus *bus, +@@ -1169,7 +1168,11 @@ static int advk_pcie_probe(struct platform_device *pdev) + + advk_pcie_setup_hw(pcie); + +- advk_sw_pci_bridge_init(pcie); ++ ret = advk_sw_pci_bridge_init(pcie); ++ if (ret) { ++ dev_err(dev, "Failed to register emulated root PCI bridge\n"); ++ return ret; ++ } + + ret = advk_pcie_init_irq_domain(pcie); + if (ret) { +-- +2.25.1 + diff --git a/queue-5.8/pci-aardvark-fix-compilation-on-s390.patch b/queue-5.8/pci-aardvark-fix-compilation-on-s390.patch new file mode 100644 index 00000000000..209c29d1c2b --- /dev/null +++ b/queue-5.8/pci-aardvark-fix-compilation-on-s390.patch @@ -0,0 +1,49 @@ +From 5714e0d48792d4fe6a8b6c4c0fbff41bfb2b20d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 13:10:34 +0200 +Subject: PCI: aardvark: Fix compilation on s390 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit b32c012e4b98f0126aa327be2d1f409963057643 ] + +Include linux/gpio/consumer.h instead of linux/gpio.h, as is said in the +latter file. + +This was reported by kernel test bot when compiling for s390. + + drivers/pci/controller/pci-aardvark.c:350:2: error: implicit declaration of function 'gpiod_set_value_cansleep' [-Werror,-Wimplicit-function-declaration] + drivers/pci/controller/pci-aardvark.c:1074:21: error: implicit declaration of function 'devm_gpiod_get_from_of_node' [-Werror,-Wimplicit-function-declaration] + drivers/pci/controller/pci-aardvark.c:1076:14: error: use of undeclared identifier 'GPIOD_OUT_LOW' + +Link: https://lore.kernel.org/r/202006211118.LxtENQfl%25lkp@intel.com +Link: https://lore.kernel.org/r/20200907111038.5811-2-pali@kernel.org +Fixes: 5169a9851daa ("PCI: aardvark: Issue PERST via GPIO") +Reported-by: kernel test robot +Signed-off-by: Pali Rohár +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Marek Behún +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-aardvark.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index 90ff291c24f09..8caa80b19cf86 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -9,7 +9,7 @@ + */ + + #include +-#include ++#include + #include + #include + #include +-- +2.25.1 + diff --git a/queue-5.8/pci-designware-ep-fix-the-header-type-check.patch b/queue-5.8/pci-designware-ep-fix-the-header-type-check.patch new file mode 100644 index 00000000000..465091e33b0 --- /dev/null +++ b/queue-5.8/pci-designware-ep-fix-the-header-type-check.patch @@ -0,0 +1,53 @@ +From 48b9717ad8a848d03722974c87dedb6ced258897 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 17:27:46 +0800 +Subject: PCI: designware-ep: Fix the Header Type check + +From: Hou Zhiqiang + +[ Upstream commit 16270a92355722e387e9ca19627c5a4d7bae1354 ] + +The current check will result in the multiple function device +fails to initialize. So fix the check by masking out the +multiple function bit. + +Link: https://lore.kernel.org/r/20200818092746.24366-1-Zhiqiang.Hou@nxp.com +Fixes: 0b24134f7888 ("PCI: dwc: Add validation that PCIe core is set to correct mode") +Signed-off-by: Hou Zhiqiang +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Rob Herring +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/dwc/pcie-designware-ep.c | 3 ++- + include/uapi/linux/pci_regs.h | 1 + + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/dwc/pcie-designware-ep.c b/drivers/pci/controller/dwc/pcie-designware-ep.c +index 5e5b8821bed8c..ce1c00ea5fdca 100644 +--- a/drivers/pci/controller/dwc/pcie-designware-ep.c ++++ b/drivers/pci/controller/dwc/pcie-designware-ep.c +@@ -505,7 +505,8 @@ int dw_pcie_ep_init_complete(struct dw_pcie_ep *ep) + u32 reg; + int i; + +- hdr_type = dw_pcie_readb_dbi(pci, PCI_HEADER_TYPE); ++ hdr_type = dw_pcie_readb_dbi(pci, PCI_HEADER_TYPE) & ++ PCI_HEADER_TYPE_MASK; + if (hdr_type != PCI_HEADER_TYPE_NORMAL) { + dev_err(pci->dev, + "PCIe controller is not set to EP mode (hdr_type:0x%x)!\n", +diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h +index f9701410d3b52..57a222014cd20 100644 +--- a/include/uapi/linux/pci_regs.h ++++ b/include/uapi/linux/pci_regs.h +@@ -76,6 +76,7 @@ + #define PCI_CACHE_LINE_SIZE 0x0c /* 8 bits */ + #define PCI_LATENCY_TIMER 0x0d /* 8 bits */ + #define PCI_HEADER_TYPE 0x0e /* 8 bits */ ++#define PCI_HEADER_TYPE_MASK 0x7f + #define PCI_HEADER_TYPE_NORMAL 0 + #define PCI_HEADER_TYPE_BRIDGE 1 + #define PCI_HEADER_TYPE_CARDBUS 2 +-- +2.25.1 + diff --git a/queue-5.8/pci-hv-fix-hibernation-in-case-interrupts-are-not-re.patch b/queue-5.8/pci-hv-fix-hibernation-in-case-interrupts-are-not-re.patch new file mode 100644 index 00000000000..522ff2ce434 --- /dev/null +++ b/queue-5.8/pci-hv-fix-hibernation-in-case-interrupts-are-not-re.patch @@ -0,0 +1,151 @@ +From 019d074ad3352110d2c55f4c73a9c402ac067f6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Oct 2020 01:51:58 -0700 +Subject: PCI: hv: Fix hibernation in case interrupts are not re-created + +From: Dexuan Cui + +[ Upstream commit 915cff7f38c5e4d47f187f8049245afc2cb3e503 ] + +pci_restore_msi_state() directly writes the MSI/MSI-X related registers +via MMIO. On a physical machine, this works perfectly; for a Linux VM +running on a hypervisor, which typically enables IOMMU interrupt remapping, +the hypervisor usually should trap and emulate the MMIO accesses in order +to re-create the necessary interrupt remapping table entries in the IOMMU, +otherwise the interrupts can not work in the VM after hibernation. + +Hyper-V is different from other hypervisors in that it does not trap and +emulate the MMIO accesses, and instead it uses a para-virtualized method, +which requires the VM to call hv_compose_msi_msg() to notify the hypervisor +of the info that would be passed to the hypervisor in the case of the +trap-and-emulate method. This is not an issue to a lot of PCI device +drivers, which destroy and re-create the interrupts across hibernation, so +hv_compose_msi_msg() is called automatically. However, some PCI device +drivers (e.g. the in-tree GPU driver nouveau and the out-of-tree Nvidia +proprietary GPU driver) do not destroy and re-create MSI/MSI-X interrupts +across hibernation, so hv_pci_resume() has to call hv_compose_msi_msg(), +otherwise the PCI device drivers can no longer receive interrupts after +the VM resumes from hibernation. + +Hyper-V is also different in that chip->irq_unmask() may fail in a +Linux VM running on Hyper-V (on a physical machine, chip->irq_unmask() +can not fail because unmasking an MSI/MSI-X register just means an MMIO +write): during hibernation, when a CPU is offlined, the kernel tries +to move the interrupt to the remaining CPUs that haven't been offlined +yet. In this case, hv_irq_unmask() -> hv_do_hypercall() always fails +because the vmbus channel has been closed: here the early "return" in +hv_irq_unmask() means the pci_msi_unmask_irq() is not called, i.e. the +desc->masked remains "true", so later after hibernation, the MSI interrupt +always remains masked, which is incorrect. Refer to cpu_disable_common() +-> fixup_irqs() -> irq_migrate_all_off_this_cpu() -> migrate_one_irq(): + +static bool migrate_one_irq(struct irq_desc *desc) +{ +... + if (maskchip && chip->irq_mask) + chip->irq_mask(d); +... + err = irq_do_set_affinity(d, affinity, false); +... + if (maskchip && chip->irq_unmask) + chip->irq_unmask(d); + +Fix the issue by calling pci_msi_unmask_irq() unconditionally in +hv_irq_unmask(). Also suppress the error message for hibernation because +the hypercall failure during hibernation does not matter (at this time +all the devices have been frozen). Note: the correct affinity info is +still updated into the irqdata data structure in migrate_one_irq() -> +irq_do_set_affinity() -> hv_set_affinity(), so later when the VM +resumes, hv_pci_restore_msi_state() is able to correctly restore +the interrupt with the correct affinity. + +Link: https://lore.kernel.org/r/20201002085158.9168-1-decui@microsoft.com +Fixes: ac82fc832708 ("PCI: hv: Add hibernation support") +Signed-off-by: Dexuan Cui +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Jake Oshins +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-hyperv.c | 50 +++++++++++++++++++++++++++-- + 1 file changed, 47 insertions(+), 3 deletions(-) + +diff --git a/drivers/pci/controller/pci-hyperv.c b/drivers/pci/controller/pci-hyperv.c +index bf40ff09c99d6..95c04b0ffeb16 100644 +--- a/drivers/pci/controller/pci-hyperv.c ++++ b/drivers/pci/controller/pci-hyperv.c +@@ -1275,11 +1275,25 @@ static void hv_irq_unmask(struct irq_data *data) + exit_unlock: + spin_unlock_irqrestore(&hbus->retarget_msi_interrupt_lock, flags); + +- if (res) { ++ /* ++ * During hibernation, when a CPU is offlined, the kernel tries ++ * to move the interrupt to the remaining CPUs that haven't ++ * been offlined yet. In this case, the below hv_do_hypercall() ++ * always fails since the vmbus channel has been closed: ++ * refer to cpu_disable_common() -> fixup_irqs() -> ++ * irq_migrate_all_off_this_cpu() -> migrate_one_irq(). ++ * ++ * Suppress the error message for hibernation because the failure ++ * during hibernation does not matter (at this time all the devices ++ * have been frozen). Note: the correct affinity info is still updated ++ * into the irqdata data structure in migrate_one_irq() -> ++ * irq_do_set_affinity() -> hv_set_affinity(), so later when the VM ++ * resumes, hv_pci_restore_msi_state() is able to correctly restore ++ * the interrupt with the correct affinity. ++ */ ++ if (res && hbus->state != hv_pcibus_removing) + dev_err(&hbus->hdev->device, + "%s() failed: %#llx", __func__, res); +- return; +- } + + pci_msi_unmask_irq(data); + } +@@ -3368,6 +3382,34 @@ static int hv_pci_suspend(struct hv_device *hdev) + return 0; + } + ++static int hv_pci_restore_msi_msg(struct pci_dev *pdev, void *arg) ++{ ++ struct msi_desc *entry; ++ struct irq_data *irq_data; ++ ++ for_each_pci_msi_entry(entry, pdev) { ++ irq_data = irq_get_irq_data(entry->irq); ++ if (WARN_ON_ONCE(!irq_data)) ++ return -EINVAL; ++ ++ hv_compose_msi_msg(irq_data, &entry->msg); ++ } ++ ++ return 0; ++} ++ ++/* ++ * Upon resume, pci_restore_msi_state() -> ... -> __pci_write_msi_msg() ++ * directly writes the MSI/MSI-X registers via MMIO, but since Hyper-V ++ * doesn't trap and emulate the MMIO accesses, here hv_compose_msi_msg() ++ * must be used to ask Hyper-V to re-create the IOMMU Interrupt Remapping ++ * Table entries. ++ */ ++static void hv_pci_restore_msi_state(struct hv_pcibus_device *hbus) ++{ ++ pci_walk_bus(hbus->pci_bus, hv_pci_restore_msi_msg, NULL); ++} ++ + static int hv_pci_resume(struct hv_device *hdev) + { + struct hv_pcibus_device *hbus = hv_get_drvdata(hdev); +@@ -3401,6 +3443,8 @@ static int hv_pci_resume(struct hv_device *hdev) + + prepopulate_bars(hbus); + ++ hv_pci_restore_msi_state(hbus); ++ + hbus->state = hv_pcibus_installed; + return 0; + out: +-- +2.25.1 + diff --git a/queue-5.8/pci-iov-mark-vfs-as-not-implementing-pci_command_mem.patch b/queue-5.8/pci-iov-mark-vfs-as-not-implementing-pci_command_mem.patch new file mode 100644 index 00000000000..5eb8b8ec05b --- /dev/null +++ b/queue-5.8/pci-iov-mark-vfs-as-not-implementing-pci_command_mem.patch @@ -0,0 +1,53 @@ +From dcd6883c94c4aace7ac0bbce6b971910f9e1469d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 10:59:55 -0400 +Subject: PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY + +From: Matthew Rosato + +[ Upstream commit 12856e7acde4702b7c3238c15fcba86ff6aa507f ] + +For VFs, the Memory Space Enable bit in the Command Register is +hard-wired to 0. + +Add a new bit to signify devices where the Command Register Memory +Space Enable bit does not control the device's response to MMIO +accesses. + +Fixes: abafbc551fdd ("vfio-pci: Invalidate mmaps and block MMIO access on disabled memory") +Signed-off-by: Matthew Rosato +Acked-by: Bjorn Helgaas +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/pci/iov.c | 1 + + include/linux/pci.h | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c +index b37e08c4f9d1a..4afd4ee4f7f04 100644 +--- a/drivers/pci/iov.c ++++ b/drivers/pci/iov.c +@@ -180,6 +180,7 @@ int pci_iov_add_virtfn(struct pci_dev *dev, int id) + virtfn->device = iov->vf_device; + virtfn->is_virtfn = 1; + virtfn->physfn = pci_dev_get(dev); ++ virtfn->no_command_memory = 1; + + if (id == 0) + pci_read_vf_config_common(virtfn); +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 34c1c4f45288f..1bc3c020672fd 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -439,6 +439,7 @@ struct pci_dev { + unsigned int is_probed:1; /* Device probing in progress */ + unsigned int link_active_reporting:1;/* Device capable of reporting link active */ + unsigned int no_vf_scan:1; /* Don't scan for VFs after IOV enablement */ ++ unsigned int no_command_memory:1; /* No PCI_COMMAND_MEMORY */ + pci_dev_flags_t dev_flags; + atomic_t enable_cnt; /* pci_enable_device has been called */ + +-- +2.25.1 + diff --git a/queue-5.8/pci-iproc-set-affinity-mask-on-msi-interrupts.patch b/queue-5.8/pci-iproc-set-affinity-mask-on-msi-interrupts.patch new file mode 100644 index 00000000000..5ec60ee4499 --- /dev/null +++ b/queue-5.8/pci-iproc-set-affinity-mask-on-msi-interrupts.patch @@ -0,0 +1,55 @@ +From 326158417c406cb096801130f938477942227b47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Aug 2020 15:52:40 +1200 +Subject: PCI: iproc: Set affinity mask on MSI interrupts + +From: Mark Tomlinson + +[ Upstream commit eb7eacaa5b9e4f665bd08d416c8f88e63d2f123c ] + +The core interrupt code expects the irq_set_affinity call to update the +effective affinity for the interrupt. This was not being done, so update +iproc_msi_irq_set_affinity() to do so. + +Link: https://lore.kernel.org/r/20200803035241.7737-1-mark.tomlinson@alliedtelesis.co.nz +Fixes: 3bc2b2348835 ("PCI: iproc: Add iProc PCIe MSI support") +Signed-off-by: Mark Tomlinson +Signed-off-by: Lorenzo Pieralisi +Reviewed-by: Ray Jui +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-iproc-msi.c | 13 +++++++++---- + 1 file changed, 9 insertions(+), 4 deletions(-) + +diff --git a/drivers/pci/controller/pcie-iproc-msi.c b/drivers/pci/controller/pcie-iproc-msi.c +index 3176ad3ab0e52..908475d27e0e7 100644 +--- a/drivers/pci/controller/pcie-iproc-msi.c ++++ b/drivers/pci/controller/pcie-iproc-msi.c +@@ -209,15 +209,20 @@ static int iproc_msi_irq_set_affinity(struct irq_data *data, + struct iproc_msi *msi = irq_data_get_irq_chip_data(data); + int target_cpu = cpumask_first(mask); + int curr_cpu; ++ int ret; + + curr_cpu = hwirq_to_cpu(msi, data->hwirq); + if (curr_cpu == target_cpu) +- return IRQ_SET_MASK_OK_DONE; ++ ret = IRQ_SET_MASK_OK_DONE; ++ else { ++ /* steer MSI to the target CPU */ ++ data->hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq) + target_cpu; ++ ret = IRQ_SET_MASK_OK; ++ } + +- /* steer MSI to the target CPU */ +- data->hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq) + target_cpu; ++ irq_data_update_effective_affinity(data, cpumask_of(target_cpu)); + +- return IRQ_SET_MASK_OK; ++ return ret; + } + + static void iproc_msi_irq_compose_msi_msg(struct irq_data *data, +-- +2.25.1 + diff --git a/queue-5.8/perf-core-fix-race-in-the-perf_mmap_close-function.patch b/queue-5.8/perf-core-fix-race-in-the-perf_mmap_close-function.patch new file mode 100644 index 00000000000..1681f7fb70c --- /dev/null +++ b/queue-5.8/perf-core-fix-race-in-the-perf_mmap_close-function.patch @@ -0,0 +1,103 @@ +From 64f0c66473f459ac51ae9da1710132b494078881 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 13:53:11 +0200 +Subject: perf/core: Fix race in the perf_mmap_close() function + +From: Jiri Olsa + +[ Upstream commit f91072ed1b7283b13ca57fcfbece5a3b92726143 ] + +There's a possible race in perf_mmap_close() when checking ring buffer's +mmap_count refcount value. The problem is that the mmap_count check is +not atomic because we call atomic_dec() and atomic_read() separately. + + perf_mmap_close: + ... + atomic_dec(&rb->mmap_count); + ... + if (atomic_read(&rb->mmap_count)) + goto out_put; + + + free_uid + +out_put: + ring_buffer_put(rb); /* could be last */ + +The race can happen when we have two (or more) events sharing same ring +buffer and they go through atomic_dec() and then they both see 0 as refcount +value later in atomic_read(). Then both will go on and execute code which +is meant to be run just once. + +The code that detaches ring buffer is probably fine to be executed more +than once, but the problem is in calling free_uid(), which will later on +demonstrate in related crashes and refcount warnings, like: + + refcount_t: addition on 0; use-after-free. + ... + RIP: 0010:refcount_warn_saturate+0x6d/0xf + ... + Call Trace: + prepare_creds+0x190/0x1e0 + copy_creds+0x35/0x172 + copy_process+0x471/0x1a80 + _do_fork+0x83/0x3a0 + __do_sys_wait4+0x83/0x90 + __do_sys_clone+0x85/0xa0 + do_syscall_64+0x5b/0x1e0 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Using atomic decrease and check instead of separated calls. + +Tested-by: Michael Petlan +Signed-off-by: Jiri Olsa +Signed-off-by: Ingo Molnar +Acked-by: Peter Zijlstra +Acked-by: Namhyung Kim +Acked-by: Wade Mealing +Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole"); +Link: https://lore.kernel.org/r/20200916115311.GE2301783@krava +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index fd8cd00099dae..38eeb297255e4 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5852,11 +5852,11 @@ static void perf_pmu_output_stop(struct perf_event *event); + static void perf_mmap_close(struct vm_area_struct *vma) + { + struct perf_event *event = vma->vm_file->private_data; +- + struct perf_buffer *rb = ring_buffer_get(event); + struct user_struct *mmap_user = rb->mmap_user; + int mmap_locked = rb->mmap_locked; + unsigned long size = perf_data_size(rb); ++ bool detach_rest = false; + + if (event->pmu->event_unmapped) + event->pmu->event_unmapped(event, vma->vm_mm); +@@ -5887,7 +5887,8 @@ static void perf_mmap_close(struct vm_area_struct *vma) + mutex_unlock(&event->mmap_mutex); + } + +- atomic_dec(&rb->mmap_count); ++ if (atomic_dec_and_test(&rb->mmap_count)) ++ detach_rest = true; + + if (!atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex)) + goto out_put; +@@ -5896,7 +5897,7 @@ static void perf_mmap_close(struct vm_area_struct *vma) + mutex_unlock(&event->mmap_mutex); + + /* If there's still other mmap()s of this buffer, we're done. */ +- if (atomic_read(&rb->mmap_count)) ++ if (!detach_rest) + goto out_put; + + /* +-- +2.25.1 + diff --git a/queue-5.8/perf-correct-snoopx-field-offset.patch b/queue-5.8/perf-correct-snoopx-field-offset.patch new file mode 100644 index 00000000000..37d93d31e95 --- /dev/null +++ b/queue-5.8/perf-correct-snoopx-field-offset.patch @@ -0,0 +1,40 @@ +From 4d0c44eb8c86d05c362c590fa9dcc7cfe772b2f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 21:46:37 +0100 +Subject: perf: correct SNOOPX field offset + +From: Al Grant + +[ Upstream commit f3d301c1f2f5676465cdf3259737ea19cc82731f ] + +perf_event.h has macros that define the field offsets in the +data_src bitmask in perf records. The SNOOPX and REMOTE offsets +were both 37. These are distinct fields, and the bitfield layout +in perf_mem_data_src confirms that SNOOPX should be at offset 38. + +Fixes: 52839e653b5629bd ("perf tools: Add support for printing new mem_info encodings") +Signed-off-by: Al Grant +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Andi Kleen +Link: https://lkml.kernel.org/r/4ac9f5cc-4388-b34a-9999-418a4099415d@foss.arm.com +Signed-off-by: Sasha Levin +--- + include/uapi/linux/perf_event.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h +index 7b2d6fc9e6ed7..dc33e3051819d 100644 +--- a/include/uapi/linux/perf_event.h ++++ b/include/uapi/linux/perf_event.h +@@ -1155,7 +1155,7 @@ union perf_mem_data_src { + + #define PERF_MEM_SNOOPX_FWD 0x01 /* forward */ + /* 1 free */ +-#define PERF_MEM_SNOOPX_SHIFT 37 ++#define PERF_MEM_SNOOPX_SHIFT 38 + + /* locked instruction */ + #define PERF_MEM_LOCK_NA 0x01 /* not available */ +-- +2.25.1 + diff --git a/queue-5.8/perf-intel-pt-fix-context_switch-event-has-no-tid-er.patch b/queue-5.8/perf-intel-pt-fix-context_switch-event-has-no-tid-er.patch new file mode 100644 index 00000000000..be29ed685f8 --- /dev/null +++ b/queue-5.8/perf-intel-pt-fix-context_switch-event-has-no-tid-er.patch @@ -0,0 +1,152 @@ +From 01fd689487b48ae538a0bfff37df60dbbc623cf5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 11:49:23 +0300 +Subject: perf intel-pt: Fix "context_switch event has no tid" error + +From: Adrian Hunter + +[ Upstream commit 7d537a8d2e76bc4fc71e34545ceaa463ac2cd928 ] + +A context_switch event can have no tid because pids can be detached from +a task while the task is still running (in do_exit()). Note this won't +happen with per-task contexts because then tracing stops at +perf_event_exit_task() + +If a task with no tid gets preempted, or a dying task gets preempted and +its parent releases it, when it subsequently gets switched back in, +Intel PT will not be able to determine what task is running and prints +an error "context_switch event has no tid". However, it is not really an +error because the task is in kernel space and the decoder can continue +to decode successfully. Fix by changing the error to be only a logged +message, and make allowance for tid == -1. + +Example: + + Using 5.9-rc4 with Preemptible Kernel (Low-Latency Desktop) e.g. + $ uname -r + 5.9.0-rc4 + $ grep PREEMPT .config + # CONFIG_PREEMPT_NONE is not set + # CONFIG_PREEMPT_VOLUNTARY is not set + CONFIG_PREEMPT=y + CONFIG_PREEMPT_COUNT=y + CONFIG_PREEMPTION=y + CONFIG_PREEMPT_RCU=y + CONFIG_PREEMPT_NOTIFIERS=y + CONFIG_DRM_I915_PREEMPT_TIMEOUT=640 + CONFIG_DEBUG_PREEMPT=y + # CONFIG_PREEMPT_TRACER is not set + # CONFIG_PREEMPTIRQ_DELAY_TEST is not set + +Before: + + $ cat forkit.c + + #include + #include + #include + + int main() + { + pid_t child; + int status = 0; + + child = fork(); + if (child == 0) + return 123; + wait(&status); + return 0; + } + + $ gcc -o forkit forkit.c + $ sudo ~/bin/perf record --kcore -a -m,64M -e intel_pt/cyc/k & + [1] 11016 + $ taskset 2 ./forkit + $ sudo pkill perf + $ [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 17.262 MB perf.data ] + + [1]+ Terminated sudo ~/bin/perf record --kcore -a -m,64M -e intel_pt/cyc/k + $ sudo ~/bin/perf script --show-task-events --show-switch-events --itrace=iqqe-o -C 1 --ns | grep -C 2 forkit + context_switch event has no tid + taskset 11019 [001] 66663.270045029: 1 instructions:k: ffffffffb1d9f844 strnlen_user+0xb4 ([kernel.kallsyms]) + taskset 11019 [001] 66663.270201816: 1 instructions:k: ffffffffb1a83121 unmap_page_range+0x561 ([kernel.kallsyms]) + forkit 11019 [001] 66663.270327553: PERF_RECORD_COMM exec: forkit:11019/11019 + forkit 11019 [001] 66663.270420028: 1 instructions:k: ffffffffb1db9537 __clear_user+0x27 ([kernel.kallsyms]) + forkit 11019 [001] 66663.270648704: 1 instructions:k: ffffffffb18829e6 do_user_addr_fault+0xf6 ([kernel.kallsyms]) + forkit 11019 [001] 66663.270833163: 1 instructions:k: ffffffffb230a825 irqentry_exit_to_user_mode+0x15 ([kernel.kallsyms]) + forkit 11019 [001] 66663.271092359: 1 instructions:k: ffffffffb1aea3d9 lock_page_memcg+0x9 ([kernel.kallsyms]) + forkit 11019 [001] 66663.271207092: PERF_RECORD_FORK(11020:11020):(11019:11019) + forkit 11019 [001] 66663.271234775: PERF_RECORD_SWITCH_CPU_WIDE OUT next pid/tid: 11020/11020 + forkit 11020 [001] 66663.271238407: PERF_RECORD_SWITCH_CPU_WIDE IN prev pid/tid: 11019/11019 + forkit 11020 [001] 66663.271312066: 1 instructions:k: ffffffffb1a88140 handle_mm_fault+0x10 ([kernel.kallsyms]) + forkit 11020 [001] 66663.271476225: PERF_RECORD_EXIT(11020:11020):(11019:11019) + forkit 11020 [001] 66663.271497488: PERF_RECORD_SWITCH_CPU_WIDE OUT preempt next pid/tid: 11019/11019 + forkit 11019 [001] 66663.271500523: PERF_RECORD_SWITCH_CPU_WIDE IN prev pid/tid: 11020/11020 + forkit 11019 [001] 66663.271517241: 1 instructions:k: ffffffffb24012cd error_entry+0x6d ([kernel.kallsyms]) + forkit 11019 [001] 66663.271664080: PERF_RECORD_EXIT(11019:11019):(1386:1386) + +After: + + $ sudo ~/bin/perf script --show-task-events --show-switch-events --itrace=iqqe-o -C 1 --ns | grep -C 2 forkit + taskset 11019 [001] 66663.270045029: 1 instructions:k: ffffffffb1d9f844 strnlen_user+0xb4 ([kernel.kallsyms]) + taskset 11019 [001] 66663.270201816: 1 instructions:k: ffffffffb1a83121 unmap_page_range+0x561 ([kernel.kallsyms]) + forkit 11019 [001] 66663.270327553: PERF_RECORD_COMM exec: forkit:11019/11019 + forkit 11019 [001] 66663.270420028: 1 instructions:k: ffffffffb1db9537 __clear_user+0x27 ([kernel.kallsyms]) + forkit 11019 [001] 66663.270648704: 1 instructions:k: ffffffffb18829e6 do_user_addr_fault+0xf6 ([kernel.kallsyms]) + forkit 11019 [001] 66663.270833163: 1 instructions:k: ffffffffb230a825 irqentry_exit_to_user_mode+0x15 ([kernel.kallsyms]) + forkit 11019 [001] 66663.271092359: 1 instructions:k: ffffffffb1aea3d9 lock_page_memcg+0x9 ([kernel.kallsyms]) + forkit 11019 [001] 66663.271207092: PERF_RECORD_FORK(11020:11020):(11019:11019) + forkit 11019 [001] 66663.271234775: PERF_RECORD_SWITCH_CPU_WIDE OUT next pid/tid: 11020/11020 + forkit 11020 [001] 66663.271238407: PERF_RECORD_SWITCH_CPU_WIDE IN prev pid/tid: 11019/11019 + forkit 11020 [001] 66663.271312066: 1 instructions:k: ffffffffb1a88140 handle_mm_fault+0x10 ([kernel.kallsyms]) + forkit 11020 [001] 66663.271476225: PERF_RECORD_EXIT(11020:11020):(11019:11019) + forkit 11020 [001] 66663.271497488: PERF_RECORD_SWITCH_CPU_WIDE OUT preempt next pid/tid: 11019/11019 + forkit 11019 [001] 66663.271500523: PERF_RECORD_SWITCH_CPU_WIDE IN prev pid/tid: 11020/11020 + forkit 11019 [001] 66663.271517241: 1 instructions:k: ffffffffb24012cd error_entry+0x6d ([kernel.kallsyms]) + forkit 11019 [001] 66663.271664080: PERF_RECORD_EXIT(11019:11019):(1386:1386) + forkit 11019 [001] 66663.271688752: PERF_RECORD_SWITCH_CPU_WIDE OUT next pid/tid: -1/-1 + :-1 -1 [001] 66663.271692086: PERF_RECORD_SWITCH_CPU_WIDE IN prev pid/tid: 11019/11019 + :-1 -1 [001] 66663.271707466: 1 instructions:k: ffffffffb18eb096 update_load_avg+0x306 ([kernel.kallsyms]) + +Fixes: 86c2786994bd7c ("perf intel-pt: Add support for PERF_RECORD_SWITCH") +Signed-off-by: Adrian Hunter +Cc: Andi Kleen +Cc: Jiri Olsa +Cc: Yu-cheng Yu +Link: http://lore.kernel.org/lkml/20200909084923.9096-3-adrian.hunter@intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/intel-pt.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index 9357b5f62c273..bc88175e377ce 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -1071,6 +1071,8 @@ static void intel_pt_set_pid_tid_cpu(struct intel_pt *pt, + + if (queue->tid == -1 || pt->have_sched_switch) { + ptq->tid = machine__get_current_tid(pt->machine, ptq->cpu); ++ if (ptq->tid == -1) ++ ptq->pid = -1; + thread__zput(ptq->thread); + } + +@@ -2561,10 +2563,8 @@ static int intel_pt_context_switch(struct intel_pt *pt, union perf_event *event, + tid = sample->tid; + } + +- if (tid == -1) { +- pr_err("context_switch event has no tid\n"); +- return -EINVAL; +- } ++ if (tid == -1) ++ intel_pt_log("context_switch event has no tid\n"); + + intel_pt_log("context_switch: cpu %d pid %d tid %d time %"PRIu64" tsc %#"PRIx64"\n", + cpu, pid, tid, sample->time, perf_time_to_tsc(sample->time, +-- +2.25.1 + diff --git a/queue-5.8/perf-stat-fix-out-of-bounds-cpu-map-access-when-hand.patch b/queue-5.8/perf-stat-fix-out-of-bounds-cpu-map-access-when-hand.patch new file mode 100644 index 00000000000..c0cc6de0400 --- /dev/null +++ b/queue-5.8/perf-stat-fix-out-of-bounds-cpu-map-access-when-hand.patch @@ -0,0 +1,70 @@ +From 862ab6e9fb8726c8006077209be87c6cb43b820f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Oct 2020 17:13:11 +0900 +Subject: perf stat: Fix out of bounds CPU map access when handling armv8_pmu + events + +From: Namhyung Kim + +[ Upstream commit bef69bd7cfc363ab94b84ea29102f3e913ed3c6c ] + +It was reported that 'perf stat' crashed when using with armv8_pmu (CPU) +events with the task mode. As 'perf stat' uses an empty cpu map for +task mode but armv8_pmu has its own cpu mask, it has confused which map +it should use when accessing file descriptors and this causes segfaults: + + (gdb) bt + #0 0x0000000000603fc8 in perf_evsel__close_fd_cpu (evsel=, + cpu=) at evsel.c:122 + #1 perf_evsel__close_cpu (evsel=evsel@entry=0x716e950, cpu=7) at evsel.c:156 + #2 0x00000000004d4718 in evlist__close (evlist=0x70a7cb0) at util/evlist.c:1242 + #3 0x0000000000453404 in __run_perf_stat (argc=3, argc@entry=1, argv=0x30, + argv@entry=0xfffffaea2f90, run_idx=119, run_idx@entry=1701998435) + at builtin-stat.c:929 + #4 0x0000000000455058 in run_perf_stat (run_idx=1701998435, argv=0xfffffaea2f90, + argc=1) at builtin-stat.c:947 + #5 cmd_stat (argc=1, argv=0xfffffaea2f90) at builtin-stat.c:2357 + #6 0x00000000004bb888 in run_builtin (p=p@entry=0x9764b8 , + argc=argc@entry=4, argv=argv@entry=0xfffffaea2f90) at perf.c:312 + #7 0x00000000004bbb54 in handle_internal_command (argc=argc@entry=4, + argv=argv@entry=0xfffffaea2f90) at perf.c:364 + #8 0x0000000000435378 in run_argv (argcp=, + argv=) at perf.c:408 + #9 main (argc=4, argv=0xfffffaea2f90) at perf.c:538 + +To fix this, I simply used the given cpu map unless the evsel actually +is not a system-wide event (like uncore events). + +Fixes: 7736627b865d ("perf stat: Use affinity for closing file descriptors") +Reported-by: Wei Li +Signed-off-by: Namhyung Kim +Tested-by: Barry Song +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/20201007081311.1831003-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/lib/perf/evlist.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/lib/perf/evlist.c b/tools/lib/perf/evlist.c +index 6a875a0f01bb0..233592c5a52c7 100644 +--- a/tools/lib/perf/evlist.c ++++ b/tools/lib/perf/evlist.c +@@ -45,6 +45,9 @@ static void __perf_evlist__propagate_maps(struct perf_evlist *evlist, + if (!evsel->own_cpus || evlist->has_user_cpus) { + perf_cpu_map__put(evsel->cpus); + evsel->cpus = perf_cpu_map__get(evlist->cpus); ++ } else if (!evsel->system_wide && perf_cpu_map__empty(evlist->cpus)) { ++ perf_cpu_map__put(evsel->cpus); ++ evsel->cpus = perf_cpu_map__get(evlist->cpus); + } else if (evsel->cpus != evsel->own_cpus) { + perf_cpu_map__put(evsel->cpus); + evsel->cpus = perf_cpu_map__get(evsel->own_cpus); +-- +2.25.1 + diff --git a/queue-5.8/perf-stat-skip-duration_time-in-setup_system_wide.patch b/queue-5.8/perf-stat-skip-duration_time-in-setup_system_wide.patch new file mode 100644 index 00000000000..b232c9d1104 --- /dev/null +++ b/queue-5.8/perf-stat-skip-duration_time-in-setup_system_wide.patch @@ -0,0 +1,75 @@ +From afc9467d6d4b051506c1f7103486a5b5fc3b1071 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Sep 2020 09:50:04 +0800 +Subject: perf stat: Skip duration_time in setup_system_wide + +From: Jin Yao + +[ Upstream commit 002a3d690f95804bdef6b70b26154103518e13d9 ] + +Some metrics (such as DRAM_BW_Use) consists of uncore events and +duration_time. For uncore events, counter->core.system_wide is true. But +for duration_time, counter->core.system_wide is false so +target.system_wide is set to false. + +Then 'enable_on_exec' is set in perf_event_attr of uncore event. Kernel +will return error when trying to open the uncore event. + +This patch skips the duration_time in setup_system_wide then +target.system_wide will be set to true for the evlist of uncore events + +duration_time. + +Before (tested on skylake desktop): + + # perf stat -M DRAM_BW_Use -- sleep 1 + Error: + The sys_perf_event_open() syscall returned with 22 (Invalid argument) for event (arb/event=0x84,umask=0x1/). + /bin/dmesg | grep -i perf may provide additional information. + +After: + + # perf stat -M DRAM_BW_Use -- sleep 1 + + Performance counter stats for 'system wide': + + 169 arb/event=0x84,umask=0x1/ # 0.00 DRAM_BW_Use + 40,427 arb/event=0x81,umask=0x1/ + 1,000,902,197 ns duration_time + + 1.000902197 seconds time elapsed + +Fixes: e3ba76deef23064f ("perf tools: Force uncore events to system wide monitoring") +Signed-off-by: Jin Yao +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Jin Yao +Cc: Jiri Olsa +Cc: Kan Liang +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20200922015004.30114-1-yao.jin@linux.intel.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-stat.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index 6e2502de755a8..6494383687f89 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -1963,8 +1963,10 @@ static void setup_system_wide(int forks) + struct evsel *counter; + + evlist__for_each_entry(evsel_list, counter) { +- if (!counter->core.system_wide) ++ if (!counter->core.system_wide && ++ strcmp(counter->name, "duration_time")) { + return; ++ } + } + + if (evsel_list->core.nr_entries) +-- +2.25.1 + diff --git a/queue-5.8/perf-tools-make-gtk2-support-opt-in.patch b/queue-5.8/perf-tools-make-gtk2-support-opt-in.patch new file mode 100644 index 00000000000..d48d398bbd9 --- /dev/null +++ b/queue-5.8/perf-tools-make-gtk2-support-opt-in.patch @@ -0,0 +1,169 @@ +From b89f81b9444f615bf0530813bcab5e904d12e4e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 17:11:59 -0300 +Subject: perf tools: Make GTK2 support opt-in + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 4751bddd3f983af2004ec470ca38b42d7a8a53bc ] + +This is bitrotting, nobody is stepping up to work on it, and since we +treat warnings as errors, feature detection is failing in its main, +faster test (tools/build/feature/test-all.c) because of the GTK+2 +infobar check. + +So make this opt-in, at some point ditch this if nobody volunteers to +take care of this. + +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Namhyung Kim +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/Makefile.feature | 5 ++--- + tools/build/feature/Makefile | 2 +- + tools/build/feature/test-all.c | 10 ---------- + tools/perf/Makefile.config | 4 +++- + tools/perf/Makefile.perf | 6 +++--- + tools/perf/builtin-version.c | 1 - + 6 files changed, 9 insertions(+), 19 deletions(-) + +diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature +index e7818b44b48ee..6e5c907680b1a 100644 +--- a/tools/build/Makefile.feature ++++ b/tools/build/Makefile.feature +@@ -38,8 +38,6 @@ FEATURE_TESTS_BASIC := \ + get_current_dir_name \ + gettid \ + glibc \ +- gtk2 \ +- gtk2-infobar \ + libbfd \ + libcap \ + libelf \ +@@ -81,6 +79,8 @@ FEATURE_TESTS_EXTRA := \ + compile-32 \ + compile-x32 \ + cplus-demangle \ ++ gtk2 \ ++ gtk2-infobar \ + hello \ + libbabeltrace \ + libbfd-liberty \ +@@ -110,7 +110,6 @@ FEATURE_DISPLAY ?= \ + dwarf \ + dwarf_getlocations \ + glibc \ +- gtk2 \ + libbfd \ + libcap \ + libelf \ +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 93b590d81209c..1796a09365f5d 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -89,7 +89,7 @@ __BUILDXX = $(CXX) $(CXXFLAGS) -MD -Wall -Werror -o $@ $(patsubst %.bin,%.cpp,$( + ############################### + + $(OUTPUT)test-all.bin: +- $(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -I/usr/include/slang -lslang $(shell $(PKG_CONFIG) --libs --cflags gtk+-2.0 2>/dev/null) $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma ++ $(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -I/usr/include/slang -lslang $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma + + $(OUTPUT)test-hello.bin: + $(BUILD) +diff --git a/tools/build/feature/test-all.c b/tools/build/feature/test-all.c +index 5479e543b1947..d2623992ccd61 100644 +--- a/tools/build/feature/test-all.c ++++ b/tools/build/feature/test-all.c +@@ -78,14 +78,6 @@ + # include "test-libslang.c" + #undef main + +-#define main main_test_gtk2 +-# include "test-gtk2.c" +-#undef main +- +-#define main main_test_gtk2_infobar +-# include "test-gtk2-infobar.c" +-#undef main +- + #define main main_test_libbfd + # include "test-libbfd.c" + #undef main +@@ -205,8 +197,6 @@ int main(int argc, char *argv[]) + main_test_libelf_getshdrstrndx(); + main_test_libunwind(); + main_test_libslang(); +- main_test_gtk2(argc, argv); +- main_test_gtk2_infobar(argc, argv); + main_test_libbfd(); + main_test_backtrace(); + main_test_libnuma(); +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index 513633809c81e..ab6dbd8ef6cf6 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -716,12 +716,14 @@ ifndef NO_SLANG + endif + endif + +-ifndef NO_GTK2 ++ifdef GTK2 + FLAGS_GTK2=$(CFLAGS) $(LDFLAGS) $(EXTLIBS) $(shell $(PKG_CONFIG) --libs --cflags gtk+-2.0 2>/dev/null) ++ $(call feature_check,gtk2) + ifneq ($(feature-gtk2), 1) + msg := $(warning GTK2 not found, disables GTK2 support. Please install gtk2-devel or libgtk2.0-dev); + NO_GTK2 := 1 + else ++ $(call feature_check,gtk2-infobar) + ifeq ($(feature-gtk2-infobar), 1) + GTK_CFLAGS := -DHAVE_GTK_INFO_BAR_SUPPORT + endif +diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf +index 86dbb51bb2723..bc45b1a61d3a3 100644 +--- a/tools/perf/Makefile.perf ++++ b/tools/perf/Makefile.perf +@@ -48,7 +48,7 @@ include ../scripts/utilities.mak + # + # Define NO_SLANG if you do not want TUI support. + # +-# Define NO_GTK2 if you do not want GTK+ GUI support. ++# Define GTK2 if you want GTK+ GUI support. + # + # Define NO_DEMANGLE if you do not want C++ symbol demangling. + # +@@ -384,7 +384,7 @@ ifneq ($(OUTPUT),) + CFLAGS += -I$(OUTPUT) + endif + +-ifndef NO_GTK2 ++ifdef GTK2 + ALL_PROGRAMS += $(OUTPUT)libperf-gtk.so + GTK_IN := $(OUTPUT)gtk-in.o + endif +@@ -876,7 +876,7 @@ check: $(OUTPUT)common-cmds.h + + ### Installation rules + +-ifndef NO_GTK2 ++ifdef GTK2 + install-gtk: $(OUTPUT)libperf-gtk.so + $(call QUIET_INSTALL, 'GTK UI') \ + $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(libdir_SQ)'; \ +diff --git a/tools/perf/builtin-version.c b/tools/perf/builtin-version.c +index 05cf2af9e2c27..d09ec2f030719 100644 +--- a/tools/perf/builtin-version.c ++++ b/tools/perf/builtin-version.c +@@ -60,7 +60,6 @@ static void library_status(void) + STATUS(HAVE_DWARF_SUPPORT, dwarf); + STATUS(HAVE_DWARF_GETLOCATIONS_SUPPORT, dwarf_getlocations); + STATUS(HAVE_GLIBC_SUPPORT, glibc); +- STATUS(HAVE_GTK2_SUPPORT, gtk2); + #ifndef HAVE_SYSCALL_TABLE_SUPPORT + STATUS(HAVE_LIBAUDIT_SUPPORT, libaudit); + #endif +-- +2.25.1 + diff --git a/queue-5.8/perf-trace-fix-off-by-ones-in-memset-after-realloc-i.patch b/queue-5.8/perf-trace-fix-off-by-ones-in-memset-after-realloc-i.patch new file mode 100644 index 00000000000..da332ab9f17 --- /dev/null +++ b/queue-5.8/perf-trace-fix-off-by-ones-in-memset-after-realloc-i.patch @@ -0,0 +1,70 @@ +From 9eebb9e32f80655be9a0103d679defc0285f1150 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Oct 2020 11:34:19 +0200 +Subject: perf trace: Fix off by ones in memset() after realloc() in arches + using libaudit + +From: Jiri Slaby + +[ Upstream commit f3013f7ed465479e60c1ab1921a5718fc541cc3b ] + +'perf trace ls' started crashing after commit d21cb73a9025 on +!HAVE_SYSCALL_TABLE_SUPPORT configs (armv7l here) like this: + + 0 strlen () at ../sysdeps/arm/armv6t2/strlen.S:126 + 1 0xb6800780 in __vfprintf_internal (s=0xbeff9908, s@entry=0xbeff9900, format=0xa27160 "]: %s()", ap=..., mode_flags=) at vfprintf-internal.c:1688 + ... + 5 0x0056ecdc in fprintf (__fmt=0xa27160 "]: %s()", __stream=) at /usr/include/bits/stdio2.h:100 + 6 trace__sys_exit (trace=trace@entry=0xbeffc710, evsel=evsel@entry=0xd968d0, event=, sample=sample@entry=0xbeffc3e8) at builtin-trace.c:2475 + 7 0x00566d40 in trace__handle_event (sample=0xbeffc3e8, event=, trace=0xbeffc710) at builtin-trace.c:3122 + ... + 15 main (argc=2, argv=0xbefff6e8) at perf.c:538 + +It is because memset in trace__read_syscall_info zeroes wrong memory: + +1) when initializing for the first time, it does not reset the last id. + +2) in other cases, it resets the last id of previous buffer. + +ad 1) it causes the crash above as sc->name used in the fprintf above + contains garbage. + +ad 2) it sets nonexistent from true back to false for id 11 here. Not + sure, what the consequences are. + +So fix it by introducing a special case for the initial initialization +and do the right +1 in both cases. + +Fixes: d21cb73a9025 ("perf trace: Grow the syscall table as needed when using libaudit") +Signed-off-by: Jiri Slaby +Cc: Adrian Hunter +Cc: Jiri Olsa +Cc: Namhyung Kim +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20201001093419.15761-1-jslaby@suse.cz +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-trace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c +index 4cbb64edc9983..83e8cd663b4e4 100644 +--- a/tools/perf/builtin-trace.c ++++ b/tools/perf/builtin-trace.c +@@ -1762,7 +1762,11 @@ static int trace__read_syscall_info(struct trace *trace, int id) + if (table == NULL) + return -ENOMEM; + +- memset(table + trace->sctbl->syscalls.max_id, 0, (id - trace->sctbl->syscalls.max_id) * sizeof(*sc)); ++ // Need to memset from offset 0 and +1 members if brand new ++ if (trace->syscalls.table == NULL) ++ memset(table, 0, (id + 1) * sizeof(*sc)); ++ else ++ memset(table + trace->sctbl->syscalls.max_id + 1, 0, (id - trace->sctbl->syscalls.max_id) * sizeof(*sc)); + + trace->syscalls.table = table; + trace->sctbl->syscalls.max_id = id; +-- +2.25.1 + diff --git a/queue-5.8/perf-x86-fix-n_pair-for-cancelled-txn.patch b/queue-5.8/perf-x86-fix-n_pair-for-cancelled-txn.patch new file mode 100644 index 00000000000..c4e967a18f8 --- /dev/null +++ b/queue-5.8/perf-x86-fix-n_pair-for-cancelled-txn.patch @@ -0,0 +1,81 @@ +From 6d63ce837c2556052fb18541874f7b5c10e5a869 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Oct 2020 23:28:52 -0400 +Subject: perf/x86: Fix n_pair for cancelled txn + +[ Upstream commit 871a93b0aad65a7f44ee25f2d17932ef6d559850 ] + +Kan reported that n_metric gets corrupted for cancelled transactions; +a similar issue exists for n_pair for AMD's Large Increment thing. + +The problem was confirmed and confirmed fixed by Kim using: + + sudo perf stat -e "{cycles,cycles,cycles,cycles}:D" -a sleep 10 & + + # should succeed: + sudo perf stat -e "{fp_ret_sse_avx_ops.all}:D" -a workload + + # should fail: + sudo perf stat -e "{fp_ret_sse_avx_ops.all,fp_ret_sse_avx_ops.all,cycles}:D" -a workload + + # previously failed, now succeeds with this patch: + sudo perf stat -e "{fp_ret_sse_avx_ops.all}:D" -a workload + +Fixes: 5738891229a2 ("perf/x86/amd: Add support for Large Increment per Cycle Events") +Reported-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Kim Phillips +Link: https://lkml.kernel.org/r/20201005082516.GG2628@hirez.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + arch/x86/events/core.c | 6 +++++- + arch/x86/events/perf_event.h | 1 + + 2 files changed, 6 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 4103665c6e032..29640b4079af0 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -1087,8 +1087,10 @@ static int collect_events(struct cpu_hw_events *cpuc, struct perf_event *leader, + + cpuc->event_list[n] = event; + n++; +- if (is_counter_pair(&event->hw)) ++ if (is_counter_pair(&event->hw)) { + cpuc->n_pair++; ++ cpuc->n_txn_pair++; ++ } + } + return n; + } +@@ -1953,6 +1955,7 @@ static void x86_pmu_start_txn(struct pmu *pmu, unsigned int txn_flags) + + perf_pmu_disable(pmu); + __this_cpu_write(cpu_hw_events.n_txn, 0); ++ __this_cpu_write(cpu_hw_events.n_txn_pair, 0); + } + + /* +@@ -1978,6 +1981,7 @@ static void x86_pmu_cancel_txn(struct pmu *pmu) + */ + __this_cpu_sub(cpu_hw_events.n_added, __this_cpu_read(cpu_hw_events.n_txn)); + __this_cpu_sub(cpu_hw_events.n_events, __this_cpu_read(cpu_hw_events.n_txn)); ++ __this_cpu_sub(cpu_hw_events.n_pair, __this_cpu_read(cpu_hw_events.n_txn_pair)); + perf_pmu_enable(pmu); + } + +diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h +index e17a3d8a47ede..d4d482d16fe18 100644 +--- a/arch/x86/events/perf_event.h ++++ b/arch/x86/events/perf_event.h +@@ -198,6 +198,7 @@ struct cpu_hw_events { + they've never been enabled yet */ + int n_txn; /* the # last events in the below arrays; + added in the current transaction */ ++ int n_txn_pair; + int assign[X86_PMC_IDX_MAX]; /* event to counter assignment */ + u64 tags[X86_PMC_IDX_MAX]; + +-- +2.25.1 + diff --git a/queue-5.8/perf-x86-intel-ds-fix-x86_pmu_stop-warning-for-large.patch b/queue-5.8/perf-x86-intel-ds-fix-x86_pmu_stop-warning-for-large.patch new file mode 100644 index 00000000000..8b81c10c881 --- /dev/null +++ b/queue-5.8/perf-x86-intel-ds-fix-x86_pmu_stop-warning-for-large.patch @@ -0,0 +1,161 @@ +From e6b0705aa276ee01b0c1889226e08bc73dfad742 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 14:06:49 -0700 +Subject: perf/x86/intel/ds: Fix x86_pmu_stop warning for large PEBS + +From: Kan Liang + +[ Upstream commit 35d1ce6bec133679ff16325d335217f108b84871 ] + +A warning as below may be triggered when sampling with large PEBS. + +[ 410.411250] perf: interrupt took too long (72145 > 71975), lowering +kernel.perf_event_max_sample_rate to 2000 +[ 410.724923] ------------[ cut here ]------------ +[ 410.729822] WARNING: CPU: 0 PID: 16397 at arch/x86/events/core.c:1422 +x86_pmu_stop+0x95/0xa0 +[ 410.933811] x86_pmu_del+0x50/0x150 +[ 410.937304] event_sched_out.isra.0+0xbc/0x210 +[ 410.941751] group_sched_out.part.0+0x53/0xd0 +[ 410.946111] ctx_sched_out+0x193/0x270 +[ 410.949862] __perf_event_task_sched_out+0x32c/0x890 +[ 410.954827] ? set_next_entity+0x98/0x2d0 +[ 410.958841] __schedule+0x592/0x9c0 +[ 410.962332] schedule+0x5f/0xd0 +[ 410.965477] exit_to_usermode_loop+0x73/0x120 +[ 410.969837] prepare_exit_to_usermode+0xcd/0xf0 +[ 410.974369] ret_from_intr+0x2a/0x3a +[ 410.977946] RIP: 0033:0x40123c +[ 411.079661] ---[ end trace bc83adaea7bb664a ]--- + +In the non-overflow context, e.g., context switch, with large PEBS, perf +may stop an event twice. An example is below. + + //max_samples_per_tick is adjusted to 2 + //NMI is triggered + intel_pmu_handle_irq() + handle_pmi_common() + drain_pebs() + __intel_pmu_pebs_event() + perf_event_overflow() + __perf_event_account_interrupt() + hwc->interrupts = 1 + return 0 + //A context switch happens right after the NMI. + //In the same tick, the perf_throttled_seq is not changed. + perf_event_task_sched_out() + perf_pmu_sched_task() + intel_pmu_drain_pebs_buffer() + __intel_pmu_pebs_event() + perf_event_overflow() + __perf_event_account_interrupt() + ++hwc->interrupts >= max_samples_per_tick + return 1 + x86_pmu_stop(); # First stop + perf_event_context_sched_out() + task_ctx_sched_out() + ctx_sched_out() + event_sched_out() + x86_pmu_del() + x86_pmu_stop(); # Second stop and trigger the warning + +Perf should only invoke the perf_event_overflow() in the overflow +context. + +Current drain_pebs() is called from: +- handle_pmi_common() -- overflow context +- intel_pmu_pebs_sched_task() -- non-overflow context +- intel_pmu_pebs_disable() -- non-overflow context +- intel_pmu_auto_reload_read() -- possible overflow context + With PERF_SAMPLE_READ + PERF_FORMAT_GROUP, the function may be + invoked in the NMI handler. But, before calling the function, the + PEBS buffer has already been drained. The __intel_pmu_pebs_event() + will not be called in the possible overflow context. + +To fix the issue, an indicator is required to distinguish between the +overflow context aka handle_pmi_common() and other cases. +The dummy regs pointer can be used as the indicator. + +In the non-overflow context, perf should treat the last record the same +as other PEBS records, and doesn't invoke the generic overflow handler. + +Fixes: 21509084f999 ("perf/x86/intel: Handle multiple records in the PEBS buffer") +Reported-by: Like Xu +Suggested-by: Peter Zijlstra (Intel) +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Tested-by: Like Xu +Link: https://lkml.kernel.org/r/20200902210649.2743-1-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/ds.c | 32 ++++++++++++++++++++------------ + 1 file changed, 20 insertions(+), 12 deletions(-) + +diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c +index dc43cc124e096..221d1766d6e6c 100644 +--- a/arch/x86/events/intel/ds.c ++++ b/arch/x86/events/intel/ds.c +@@ -670,9 +670,7 @@ int intel_pmu_drain_bts_buffer(void) + + static inline void intel_pmu_drain_pebs_buffer(void) + { +- struct pt_regs regs; +- +- x86_pmu.drain_pebs(®s); ++ x86_pmu.drain_pebs(NULL); + } + + /* +@@ -1737,6 +1735,7 @@ static void __intel_pmu_pebs_event(struct perf_event *event, + struct x86_perf_regs perf_regs; + struct pt_regs *regs = &perf_regs.regs; + void *at = get_next_pebs_record_by_bit(base, top, bit); ++ struct pt_regs dummy_iregs; + + if (hwc->flags & PERF_X86_EVENT_AUTO_RELOAD) { + /* +@@ -1749,6 +1748,9 @@ static void __intel_pmu_pebs_event(struct perf_event *event, + } else if (!intel_pmu_save_and_restart(event)) + return; + ++ if (!iregs) ++ iregs = &dummy_iregs; ++ + while (count > 1) { + setup_sample(event, iregs, at, &data, regs); + perf_event_output(event, &data, regs); +@@ -1758,16 +1760,22 @@ static void __intel_pmu_pebs_event(struct perf_event *event, + } + + setup_sample(event, iregs, at, &data, regs); +- +- /* +- * All but the last records are processed. +- * The last one is left to be able to call the overflow handler. +- */ +- if (perf_event_overflow(event, &data, regs)) { +- x86_pmu_stop(event, 0); +- return; ++ if (iregs == &dummy_iregs) { ++ /* ++ * The PEBS records may be drained in the non-overflow context, ++ * e.g., large PEBS + context switch. Perf should treat the ++ * last record the same as other PEBS records, and doesn't ++ * invoke the generic overflow handler. ++ */ ++ perf_event_output(event, &data, regs); ++ } else { ++ /* ++ * All but the last records are processed. ++ * The last one is left to be able to call the overflow handler. ++ */ ++ if (perf_event_overflow(event, &data, regs)) ++ x86_pmu_stop(event, 0); + } +- + } + + static void intel_pmu_drain_pebs_core(struct pt_regs *iregs) +-- +2.25.1 + diff --git a/queue-5.8/perf-x86-intel-uncore-fix-the-scale-of-the-imc-free-.patch b/queue-5.8/perf-x86-intel-uncore-fix-the-scale-of-the-imc-free-.patch new file mode 100644 index 00000000000..d72de1d6778 --- /dev/null +++ b/queue-5.8/perf-x86-intel-uncore-fix-the-scale-of-the-imc-free-.patch @@ -0,0 +1,72 @@ +From 9cd82d2d5f26914bf72b13a31ffac023aa5b3c06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 06:32:40 -0700 +Subject: perf/x86/intel/uncore: Fix the scale of the IMC free-running events + +From: Kan Liang + +[ Upstream commit 8191016a026b8dfbb14dea64efc8e723ee99fe65 ] + +The "MiB" result of the IMC free-running bandwidth events, +uncore_imc_free_running/read/ and uncore_imc_free_running/write/ are 16 +times too small. + +The "MiB" value equals the raw IMC free-running bandwidth counter value +times a "scale" which is inaccurate. + +The IMC free-running bandwidth events should be incremented per 64B +cache line, not DWs (4 bytes). The "scale" should be 6.103515625e-5. +Fix the "scale" for both Snow Ridge and Ice Lake. + +Fixes: 2b3b76b5ec67 ("perf/x86/intel/uncore: Add Ice Lake server uncore support") +Fixes: ee49532b38dd ("perf/x86/intel/uncore: Add IMC uncore support for Snow Ridge") +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20200928133240.12977-1-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/uncore_snbep.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c +index 07652fa20ebbe..6a03fe8054a81 100644 +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -4550,10 +4550,10 @@ static struct uncore_event_desc snr_uncore_imc_freerunning_events[] = { + INTEL_UNCORE_EVENT_DESC(dclk, "event=0xff,umask=0x10"), + + INTEL_UNCORE_EVENT_DESC(read, "event=0xff,umask=0x20"), +- INTEL_UNCORE_EVENT_DESC(read.scale, "3.814697266e-6"), ++ INTEL_UNCORE_EVENT_DESC(read.scale, "6.103515625e-5"), + INTEL_UNCORE_EVENT_DESC(read.unit, "MiB"), + INTEL_UNCORE_EVENT_DESC(write, "event=0xff,umask=0x21"), +- INTEL_UNCORE_EVENT_DESC(write.scale, "3.814697266e-6"), ++ INTEL_UNCORE_EVENT_DESC(write.scale, "6.103515625e-5"), + INTEL_UNCORE_EVENT_DESC(write.unit, "MiB"), + { /* end: all zeroes */ }, + }; +@@ -5009,17 +5009,17 @@ static struct uncore_event_desc icx_uncore_imc_freerunning_events[] = { + INTEL_UNCORE_EVENT_DESC(dclk, "event=0xff,umask=0x10"), + + INTEL_UNCORE_EVENT_DESC(read, "event=0xff,umask=0x20"), +- INTEL_UNCORE_EVENT_DESC(read.scale, "3.814697266e-6"), ++ INTEL_UNCORE_EVENT_DESC(read.scale, "6.103515625e-5"), + INTEL_UNCORE_EVENT_DESC(read.unit, "MiB"), + INTEL_UNCORE_EVENT_DESC(write, "event=0xff,umask=0x21"), +- INTEL_UNCORE_EVENT_DESC(write.scale, "3.814697266e-6"), ++ INTEL_UNCORE_EVENT_DESC(write.scale, "6.103515625e-5"), + INTEL_UNCORE_EVENT_DESC(write.unit, "MiB"), + + INTEL_UNCORE_EVENT_DESC(ddrt_read, "event=0xff,umask=0x30"), +- INTEL_UNCORE_EVENT_DESC(ddrt_read.scale, "3.814697266e-6"), ++ INTEL_UNCORE_EVENT_DESC(ddrt_read.scale, "6.103515625e-5"), + INTEL_UNCORE_EVENT_DESC(ddrt_read.unit, "MiB"), + INTEL_UNCORE_EVENT_DESC(ddrt_write, "event=0xff,umask=0x31"), +- INTEL_UNCORE_EVENT_DESC(ddrt_write.scale, "3.814697266e-6"), ++ INTEL_UNCORE_EVENT_DESC(ddrt_write.scale, "6.103515625e-5"), + INTEL_UNCORE_EVENT_DESC(ddrt_write.unit, "MiB"), + { /* end: all zeroes */ }, + }; +-- +2.25.1 + diff --git a/queue-5.8/perf-x86-intel-uncore-reduce-the-number-of-cbox-coun.patch b/queue-5.8/perf-x86-intel-uncore-reduce-the-number-of-cbox-coun.patch new file mode 100644 index 00000000000..30c356ab0e4 --- /dev/null +++ b/queue-5.8/perf-x86-intel-uncore-reduce-the-number-of-cbox-coun.patch @@ -0,0 +1,47 @@ +From aee246ead8eae77b72dd1a96d78d1950c85b0297 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 06:49:05 -0700 +Subject: perf/x86/intel/uncore: Reduce the number of CBOX counters + +From: Kan Liang + +[ Upstream commit ee139385432e919f4d1f59b80edbc073cdae1391 ] + +An oops is triggered by the fuzzy test. + +[ 327.853081] unchecked MSR access error: RDMSR from 0x70c at rIP: +0xffffffffc082c820 (uncore_msr_read_counter+0x10/0x50 [intel_uncore]) +[ 327.853083] Call Trace: +[ 327.853085] +[ 327.853089] uncore_pmu_event_start+0x85/0x170 [intel_uncore] +[ 327.853093] uncore_pmu_event_add+0x1a4/0x410 [intel_uncore] +[ 327.853097] ? event_sched_in.isra.118+0xca/0x240 + +There are 2 GP counters for each CBOX, but the current code claims 4 +counters. Accessing the invalid registers triggers the oops. + +Fixes: 6e394376ee89 ("perf/x86/intel/uncore: Add Intel Icelake uncore support") +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20200925134905.8839-3-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/uncore_snb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c +index 300937cc8795b..3b70c2ff177c0 100644 +--- a/arch/x86/events/intel/uncore_snb.c ++++ b/arch/x86/events/intel/uncore_snb.c +@@ -314,7 +314,7 @@ static struct intel_uncore_ops icl_uncore_msr_ops = { + + static struct intel_uncore_type icl_uncore_cbox = { + .name = "cbox", +- .num_counters = 4, ++ .num_counters = 2, + .perf_ctr_bits = 44, + .perf_ctr = ICL_UNC_CBO_0_PER_CTR0, + .event_ctl = SNB_UNC_CBO_0_PERFEVTSEL0, +-- +2.25.1 + diff --git a/queue-5.8/perf-x86-intel-uncore-update-ice-lake-uncore-units.patch b/queue-5.8/perf-x86-intel-uncore-update-ice-lake-uncore-units.patch new file mode 100644 index 00000000000..4ec5fcd4907 --- /dev/null +++ b/queue-5.8/perf-x86-intel-uncore-update-ice-lake-uncore-units.patch @@ -0,0 +1,118 @@ +From 661ee7b99146496b2f890a6c501d03763ea5adb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 06:49:04 -0700 +Subject: perf/x86/intel/uncore: Update Ice Lake uncore units + +From: Kan Liang + +[ Upstream commit 8f5d41f3a0f495435c88ebba8fc150c931c10fef ] + +There are some updates for the Icelake model specific uncore performance +monitors. (The update can be found at 10th generation intel core +processors families specification update Revision 004, ICL068) + +1) Counter 0 of ARB uncore unit is not available for software use +2) The global 'enable bit' (bit 29) and 'freeze bit' (bit 31) of + MSR_UNC_PERF_GLOBAL_CTRL cannot be used to control counter behavior. + Needs to use local enable in event select MSR. + +Accessing the modified bit/registers will be ignored by HW. Users may +observe inaccurate results with the current code. + +The changes of the MSR_UNC_PERF_GLOBAL_CTRL imply that groups cannot be +read atomically anymore. Although the error of the result for a group +becomes a bit bigger, it still far lower than not using a group. The +group support is still kept. Only Remove the *_box() related +implementation. + +Since the counter 0 of ARB uncore unit is not available, update the MSR +address for the ARB uncore unit. + +There is no change for IMC uncore unit, which only include free-running +counters. + +Fixes: 6e394376ee89 ("perf/x86/intel/uncore: Add Intel Icelake uncore support") +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20200925134905.8839-2-kan.liang@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/uncore_snb.c | 29 +++++++++++++++++++++++++---- + 1 file changed, 25 insertions(+), 4 deletions(-) + +diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c +index 1038e9f1e3542..300937cc8795b 100644 +--- a/arch/x86/events/intel/uncore_snb.c ++++ b/arch/x86/events/intel/uncore_snb.c +@@ -115,6 +115,10 @@ + #define ICL_UNC_CBO_0_PER_CTR0 0x702 + #define ICL_UNC_CBO_MSR_OFFSET 0x8 + ++/* ICL ARB register */ ++#define ICL_UNC_ARB_PER_CTR 0x3b1 ++#define ICL_UNC_ARB_PERFEVTSEL 0x3b3 ++ + DEFINE_UNCORE_FORMAT_ATTR(event, event, "config:0-7"); + DEFINE_UNCORE_FORMAT_ATTR(umask, umask, "config:8-15"); + DEFINE_UNCORE_FORMAT_ATTR(edge, edge, "config:18"); +@@ -302,6 +306,12 @@ void skl_uncore_cpu_init(void) + snb_uncore_arb.ops = &skl_uncore_msr_ops; + } + ++static struct intel_uncore_ops icl_uncore_msr_ops = { ++ .disable_event = snb_uncore_msr_disable_event, ++ .enable_event = snb_uncore_msr_enable_event, ++ .read_counter = uncore_msr_read_counter, ++}; ++ + static struct intel_uncore_type icl_uncore_cbox = { + .name = "cbox", + .num_counters = 4, +@@ -310,7 +320,7 @@ static struct intel_uncore_type icl_uncore_cbox = { + .event_ctl = SNB_UNC_CBO_0_PERFEVTSEL0, + .event_mask = SNB_UNC_RAW_EVENT_MASK, + .msr_offset = ICL_UNC_CBO_MSR_OFFSET, +- .ops = &skl_uncore_msr_ops, ++ .ops = &icl_uncore_msr_ops, + .format_group = &snb_uncore_format_group, + }; + +@@ -339,13 +349,25 @@ static struct intel_uncore_type icl_uncore_clockbox = { + .single_fixed = 1, + .event_mask = SNB_UNC_CTL_EV_SEL_MASK, + .format_group = &icl_uncore_clock_format_group, +- .ops = &skl_uncore_msr_ops, ++ .ops = &icl_uncore_msr_ops, + .event_descs = icl_uncore_events, + }; + ++static struct intel_uncore_type icl_uncore_arb = { ++ .name = "arb", ++ .num_counters = 1, ++ .num_boxes = 1, ++ .perf_ctr_bits = 44, ++ .perf_ctr = ICL_UNC_ARB_PER_CTR, ++ .event_ctl = ICL_UNC_ARB_PERFEVTSEL, ++ .event_mask = SNB_UNC_RAW_EVENT_MASK, ++ .ops = &icl_uncore_msr_ops, ++ .format_group = &snb_uncore_format_group, ++}; ++ + static struct intel_uncore_type *icl_msr_uncores[] = { + &icl_uncore_cbox, +- &snb_uncore_arb, ++ &icl_uncore_arb, + &icl_uncore_clockbox, + NULL, + }; +@@ -363,7 +385,6 @@ void icl_uncore_cpu_init(void) + { + uncore_msr_uncores = icl_msr_uncores; + icl_uncore_cbox.num_boxes = icl_get_cbox_num(); +- snb_uncore_arb.ops = &skl_uncore_msr_ops; + } + + enum { +-- +2.25.1 + diff --git a/queue-5.8/phy-rockchip-dphy-rx0-include-linux-delay.h.patch b/queue-5.8/phy-rockchip-dphy-rx0-include-linux-delay.h.patch new file mode 100644 index 00000000000..d93dc17467f --- /dev/null +++ b/queue-5.8/phy-rockchip-dphy-rx0-include-linux-delay.h.patch @@ -0,0 +1,39 @@ +From f394e5dc30f98727994d88c7be8800855942d73d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 22:56:18 +0000 +Subject: phy: rockchip-dphy-rx0: Include linux/delay.h + +From: Tomasz Figa + +[ Upstream commit 488e3f52a82775bf9a4826a9eb59f10336c3f012 ] + +Fix an implicit declaration of usleep_range(): + +drivers/phy/rockchip/phy-rockchip-dphy-rx0.c: In function 'rk_dphy_enable': +drivers/phy/rockchip/phy-rockchip-dphy-rx0.c:203:2: error: implicit declaration of function 'usleep_range' [-Werror=implicit-function-declaration] + +Fixes: 32abcc4491c62 ("media: staging: phy-rockchip-dphy-rx0: add Rockchip MIPI Synopsys DPHY RX0 driver") +Signed-off-by: Tomasz Figa +Reviewed-by: Heiko Stuebner +Link: https://lore.kernel.org/r/20200921225618.52529-1-tfiga@chromium.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + .../staging/media/phy-rockchip-dphy-rx0/phy-rockchip-dphy-rx0.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/media/phy-rockchip-dphy-rx0/phy-rockchip-dphy-rx0.c b/drivers/staging/media/phy-rockchip-dphy-rx0/phy-rockchip-dphy-rx0.c +index 7c4df6d48c43d..4df9476ef2a9b 100644 +--- a/drivers/staging/media/phy-rockchip-dphy-rx0/phy-rockchip-dphy-rx0.c ++++ b/drivers/staging/media/phy-rockchip-dphy-rx0/phy-rockchip-dphy-rx0.c +@@ -16,6 +16,7 @@ + */ + + #include ++#include + #include + #include + #include +-- +2.25.1 + diff --git a/queue-5.8/pinctrl-aspeed-use-the-right-pinconf-mask.patch b/queue-5.8/pinctrl-aspeed-use-the-right-pinconf-mask.patch new file mode 100644 index 00000000000..e980997ea44 --- /dev/null +++ b/queue-5.8/pinctrl-aspeed-use-the-right-pinconf-mask.patch @@ -0,0 +1,47 @@ +From a66be3722894e6a27f4cde14297c146cec287148 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 12:26:30 +0930 +Subject: pinctrl: aspeed: Use the right pinconf mask + +From: Andrew Jeffery + +[ Upstream commit 1d6db5ae6b090d1a8edfcb36b9bf47c5f4fe27f6 ] + +The Aspeed pinconf data structures are split into 'conf' and 'map' +types, where the 'conf' struct defines which register and bitfield to +manipulate, while the 'map' struct defines what value to write to +the register and bitfield. + +Both structs have a mask member, and the wrong mask was being used to +tell the regmap which bits to update. + +A todo is to look at whether we can remove the mask from the 'map' +struct. + +Fixes: 5f52c853847f ("pinctrl: aspeed: Use masks to describe pinconf bitfields") +Signed-off-by: Andrew Jeffery +Reviewed-by: Joel Stanley +Cc: Johnny Huang +Link: https://lore.kernel.org/r/20200910025631.2996342-3-andrew@aj.id.au +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/aspeed/pinctrl-aspeed.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/aspeed/pinctrl-aspeed.c b/drivers/pinctrl/aspeed/pinctrl-aspeed.c +index b625a657171e6..11e27136032b9 100644 +--- a/drivers/pinctrl/aspeed/pinctrl-aspeed.c ++++ b/drivers/pinctrl/aspeed/pinctrl-aspeed.c +@@ -515,7 +515,7 @@ int aspeed_pin_config_set(struct pinctrl_dev *pctldev, unsigned int offset, + val = pmap->val << __ffs(pconf->mask); + + rc = regmap_update_bits(pdata->scu, pconf->reg, +- pmap->mask, val); ++ pconf->mask, val); + + if (rc < 0) + return rc; +-- +2.25.1 + diff --git a/queue-5.8/pinctrl-bcm-fix-kconfig-dependency-warning-when-gpio.patch b/queue-5.8/pinctrl-bcm-fix-kconfig-dependency-warning-when-gpio.patch new file mode 100644 index 00000000000..35d1d4de28e --- /dev/null +++ b/queue-5.8/pinctrl-bcm-fix-kconfig-dependency-warning-when-gpio.patch @@ -0,0 +1,47 @@ +From 7b7b4f33c70983b794827c39689ac4e4ab2211f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 17:40:26 +0300 +Subject: pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB + +From: Necip Fazil Yildiran + +[ Upstream commit 513034d8b089b9a49dab57845aee70e830fe7334 ] + +When PINCTRL_BCM2835 is enabled and GPIOLIB is disabled, it results in the +following Kbuild warning: + +WARNING: unmet direct dependencies detected for GPIOLIB_IRQCHIP + Depends on [n]: GPIOLIB [=n] + Selected by [y]: + - PINCTRL_BCM2835 [=y] && PINCTRL [=y] && OF [=y] && (ARCH_BCM2835 [=n] || ARCH_BRCMSTB [=n] || COMPILE_TEST [=y]) + +The reason is that PINCTRL_BCM2835 selects GPIOLIB_IRQCHIP without +depending on or selecting GPIOLIB while GPIOLIB_IRQCHIP is subordinate to +GPIOLIB. + +Honor the kconfig menu hierarchy to remove kconfig dependency warnings. + +Fixes: 85ae9e512f43 ("pinctrl: bcm2835: switch to GPIOLIB_IRQCHIP") +Signed-off-by: Necip Fazil Yildiran +Link: https://lore.kernel.org/r/20200914144025.371370-1-fazilyildiran@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/bcm/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pinctrl/bcm/Kconfig b/drivers/pinctrl/bcm/Kconfig +index dcf7df797af75..0ed14de0134cf 100644 +--- a/drivers/pinctrl/bcm/Kconfig ++++ b/drivers/pinctrl/bcm/Kconfig +@@ -23,6 +23,7 @@ config PINCTRL_BCM2835 + select PINMUX + select PINCONF + select GENERIC_PINCONF ++ select GPIOLIB + select GPIOLIB_IRQCHIP + default ARCH_BCM2835 || ARCH_BRCMSTB + help +-- +2.25.1 + diff --git a/queue-5.8/pinctrl-devicetree-keep-deferring-even-on-timeout.patch b/queue-5.8/pinctrl-devicetree-keep-deferring-even-on-timeout.patch new file mode 100644 index 00000000000..0a67167947f --- /dev/null +++ b/queue-5.8/pinctrl-devicetree-keep-deferring-even-on-timeout.patch @@ -0,0 +1,51 @@ +From 78dc31c1c9daa57f0aca90957da3017e65ff8ffe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 16:33:48 +0200 +Subject: pinctrl: devicetree: Keep deferring even on timeout + +From: Thierry Reding + +[ Upstream commit 84f28fc38d2ff99e2ac623325ba37809da611b8e ] + +driver_deferred_probe_check_state() may return -ETIMEDOUT instead of +-EPROBE_DEFER after all built-in drivers have been probed. This can +cause issues for built-in drivers that depend on resources provided by +loadable modules. + +One such case happens on Tegra where I2C controllers are used during +early boot to set up the system PMIC, so the I2C driver needs to be a +built-in driver. At the same time, some instances of the I2C controller +depend on the DPAUX hardware for pinmuxing. Since the DPAUX is handled +by the display driver, which is usually not built-in, the pin control +states will not become available until after the root filesystem has +been mounted and the display driver loaded from it. + +Fixes: bec6c0ecb243 ("pinctrl: Remove use of driver_deferred_probe_check_state_continue()") +Suggested-by: John Stultz +Signed-off-by: Thierry Reding +Link: https://lore.kernel.org/r/20200825143348.1358679-1-thierry.reding@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/devicetree.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index c6fe7d64c9137..c7448be64d073 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -129,9 +129,8 @@ static int dt_to_map_one_config(struct pinctrl *p, + if (!np_pctldev || of_node_is_root(np_pctldev)) { + of_node_put(np_pctldev); + ret = driver_deferred_probe_check_state(p->dev); +- /* keep deferring if modules are enabled unless we've timed out */ +- if (IS_ENABLED(CONFIG_MODULES) && !allow_default && +- (ret == -ENODEV)) ++ /* keep deferring if modules are enabled */ ++ if (IS_ENABLED(CONFIG_MODULES) && !allow_default && ret < 0) + ret = -EPROBE_DEFER; + return ret; + } +-- +2.25.1 + diff --git a/queue-5.8/pinctrl-mcp23s08-fix-mcp23x17-precious-range.patch b/queue-5.8/pinctrl-mcp23s08-fix-mcp23x17-precious-range.patch new file mode 100644 index 00000000000..e52f8a86846 --- /dev/null +++ b/queue-5.8/pinctrl-mcp23s08-fix-mcp23x17-precious-range.patch @@ -0,0 +1,42 @@ +From ee392c7bdde9739572b26dba295ea20776fa0404 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 22:32:26 +0100 +Subject: pinctrl: mcp23s08: Fix mcp23x17 precious range + +From: Thomas Preston + +[ Upstream commit b9b7fb29433b906635231d0a111224efa009198c ] + +On page 23 of the datasheet [0] it says "The register remains unchanged +until the interrupt is cleared via a read of INTCAP or GPIO." Include +INTCAPA and INTCAPB registers in precious range, so that they aren't +accidentally cleared when we read via debugfs. + +[0] https://ww1.microchip.com/downloads/en/DeviceDoc/20001952C.pdf + +Fixes: 8f38910ba4f6 ("pinctrl: mcp23s08: switch to regmap caching") +Signed-off-by: Thomas Preston +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20200828213226.1734264-3-thomas.preston@codethink.co.uk +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-mcp23s08.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c +index 5641df67bcf55..235a141182bf6 100644 +--- a/drivers/pinctrl/pinctrl-mcp23s08.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08.c +@@ -109,7 +109,7 @@ static const struct regmap_access_table mcp23x17_volatile_table = { + }; + + static const struct regmap_range mcp23x17_precious_range = { +- .range_min = MCP_GPIO << 1, ++ .range_min = MCP_INTCAP << 1, + .range_max = MCP_GPIO << 1, + }; + +-- +2.25.1 + diff --git a/queue-5.8/pinctrl-mcp23s08-fix-mcp23x17_regmap-initialiser.patch b/queue-5.8/pinctrl-mcp23s08-fix-mcp23x17_regmap-initialiser.patch new file mode 100644 index 00000000000..c90f8b738bf --- /dev/null +++ b/queue-5.8/pinctrl-mcp23s08-fix-mcp23x17_regmap-initialiser.patch @@ -0,0 +1,84 @@ +From f003067d1d0af709639093fccc781096e471ad51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 22:32:25 +0100 +Subject: pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser + +From: Thomas Preston + +[ Upstream commit b445f6237744df5e8d4f56f8733b2108c611220a ] + +The mcp23x17_regmap is initialised with structs named "mcp23x16". +However, the mcp23s08 driver doesn't support the MCP23016 device yet, so +this appears to be a typo. + +Fixes: 8f38910ba4f6 ("pinctrl: mcp23s08: switch to regmap caching") +Signed-off-by: Thomas Preston +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20200828213226.1734264-2-thomas.preston@codethink.co.uk +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-mcp23s08.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c +index 151931b593f6e..5641df67bcf55 100644 +--- a/drivers/pinctrl/pinctrl-mcp23s08.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08.c +@@ -87,7 +87,7 @@ const struct regmap_config mcp23x08_regmap = { + }; + EXPORT_SYMBOL_GPL(mcp23x08_regmap); + +-static const struct reg_default mcp23x16_defaults[] = { ++static const struct reg_default mcp23x17_defaults[] = { + {.reg = MCP_IODIR << 1, .def = 0xffff}, + {.reg = MCP_IPOL << 1, .def = 0x0000}, + {.reg = MCP_GPINTEN << 1, .def = 0x0000}, +@@ -98,23 +98,23 @@ static const struct reg_default mcp23x16_defaults[] = { + {.reg = MCP_OLAT << 1, .def = 0x0000}, + }; + +-static const struct regmap_range mcp23x16_volatile_range = { ++static const struct regmap_range mcp23x17_volatile_range = { + .range_min = MCP_INTF << 1, + .range_max = MCP_GPIO << 1, + }; + +-static const struct regmap_access_table mcp23x16_volatile_table = { +- .yes_ranges = &mcp23x16_volatile_range, ++static const struct regmap_access_table mcp23x17_volatile_table = { ++ .yes_ranges = &mcp23x17_volatile_range, + .n_yes_ranges = 1, + }; + +-static const struct regmap_range mcp23x16_precious_range = { ++static const struct regmap_range mcp23x17_precious_range = { + .range_min = MCP_GPIO << 1, + .range_max = MCP_GPIO << 1, + }; + +-static const struct regmap_access_table mcp23x16_precious_table = { +- .yes_ranges = &mcp23x16_precious_range, ++static const struct regmap_access_table mcp23x17_precious_table = { ++ .yes_ranges = &mcp23x17_precious_range, + .n_yes_ranges = 1, + }; + +@@ -124,10 +124,10 @@ const struct regmap_config mcp23x17_regmap = { + + .reg_stride = 2, + .max_register = MCP_OLAT << 1, +- .volatile_table = &mcp23x16_volatile_table, +- .precious_table = &mcp23x16_precious_table, +- .reg_defaults = mcp23x16_defaults, +- .num_reg_defaults = ARRAY_SIZE(mcp23x16_defaults), ++ .volatile_table = &mcp23x17_volatile_table, ++ .precious_table = &mcp23x17_precious_table, ++ .reg_defaults = mcp23x17_defaults, ++ .num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults), + .cache_type = REGCACHE_FLAT, + .val_format_endian = REGMAP_ENDIAN_LITTLE, + }; +-- +2.25.1 + diff --git a/queue-5.8/pinctrl-qcom-set-irqchip_set_type_masked-and-irqchip.patch b/queue-5.8/pinctrl-qcom-set-irqchip_set_type_masked-and-irqchip.patch new file mode 100644 index 00000000000..90502abba1f --- /dev/null +++ b/queue-5.8/pinctrl-qcom-set-irqchip_set_type_masked-and-irqchip.patch @@ -0,0 +1,48 @@ +From af0dfd58434dd0d0991c9255a843e5798958c9ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 10:01:59 +0530 +Subject: pinctrl: qcom: Set IRQCHIP_SET_TYPE_MASKED and + IRQCHIP_MASK_ON_SUSPEND flags + +From: Maulik Shah + +[ Upstream commit c5f72aeb659eb2f809b9531d759651514d42aa3a ] + +Both IRQCHIP_SET_TYPE_MASKED and IRQCHIP_MASK_ON_SUSPEND flags are already +set for msmgpio's parent PDC irqchip but GPIO interrupts do not get masked +during suspend or during setting irq type since genirq checks irqchip flag +of msmgpio irqchip which forwards these calls to its parent PDC irqchip. + +Add irqchip specific flags for msmgpio irqchip to mask non wakeirqs during +suspend and mask before setting irq type. Masking before changing type make +sures any spurious interrupt is not detected during this operation. + +Fixes: e35a6ae0eb3a ("pinctrl/msm: Setup GPIO chip in hierarchy") +Signed-off-by: Maulik Shah +Signed-off-by: Marc Zyngier +Tested-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Acked-by: Bjorn Andersson +Acked-by: Linus Walleij +Link: https://lore.kernel.org/r/1601267524-20199-2-git-send-email-mkshah@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index c322f30a20648..a28a96ac2b671 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -1226,6 +1226,8 @@ static int msm_gpio_init(struct msm_pinctrl *pctrl) + pctrl->irq_chip.irq_release_resources = msm_gpio_irq_relres; + pctrl->irq_chip.irq_set_affinity = msm_gpio_irq_set_affinity; + pctrl->irq_chip.irq_set_vcpu_affinity = msm_gpio_irq_set_vcpu_affinity; ++ pctrl->irq_chip.flags = IRQCHIP_MASK_ON_SUSPEND | ++ IRQCHIP_SET_TYPE_MASKED; + + np = of_parse_phandle(pctrl->dev->of_node, "wakeup-parent", 0); + if (np) { +-- +2.25.1 + diff --git a/queue-5.8/pinctrl-qcom-use-return-value-from-irq_set_wake-call.patch b/queue-5.8/pinctrl-qcom-use-return-value-from-irq_set_wake-call.patch new file mode 100644 index 00000000000..0aef97b89c0 --- /dev/null +++ b/queue-5.8/pinctrl-qcom-use-return-value-from-irq_set_wake-call.patch @@ -0,0 +1,58 @@ +From 281ba5a96faa3c00fdd6ef45c4e1fbee4fb010d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 10:02:00 +0530 +Subject: pinctrl: qcom: Use return value from irq_set_wake() call + +From: Maulik Shah + +[ Upstream commit f41aaca593377a4fe3984459fd4539481263b4cd ] + +msmgpio irqchip was not using return value of irq_set_irq_wake() callback +since previously GIC-v3 irqchip neither had IRQCHIP_SKIP_SET_WAKE flag nor +it implemented .irq_set_wake callback. This lead to irq_set_irq_wake() +return error -ENXIO. + +However from 'commit 4110b5cbb014 ("irqchip/gic-v3: Allow interrupt to be +configured as wake-up sources")' GIC irqchip has IRQCHIP_SKIP_SET_WAKE +flag. + +Use return value from irq_set_irq_wake() and irq_chip_set_wake_parent() +instead of always returning success. + +Fixes: e35a6ae0eb3a ("pinctrl/msm: Setup GPIO chip in hierarchy") +Signed-off-by: Maulik Shah +Signed-off-by: Marc Zyngier +Tested-by: Stephen Boyd +Reviewed-by: Douglas Anderson +Reviewed-by: Stephen Boyd +Acked-by: Bjorn Andersson +Acked-by: Linus Walleij +Link: https://lore.kernel.org/r/1601267524-20199-3-git-send-email-mkshah@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/qcom/pinctrl-msm.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index a28a96ac2b671..22283ba797cd0 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -1060,12 +1060,10 @@ static int msm_gpio_irq_set_wake(struct irq_data *d, unsigned int on) + * when TLMM is powered on. To allow that, enable the GPIO + * summary line to be wakeup capable at GIC. + */ +- if (d->parent_data) +- irq_chip_set_wake_parent(d, on); +- +- irq_set_irq_wake(pctrl->irq, on); ++ if (d->parent_data && test_bit(d->hwirq, pctrl->skip_wake_irqs)) ++ return irq_chip_set_wake_parent(d, on); + +- return 0; ++ return irq_set_irq_wake(pctrl->irq, on); + } + + static int msm_gpio_irq_reqres(struct irq_data *d) +-- +2.25.1 + diff --git a/queue-5.8/platform-chrome-cros_ec_lightbar-reduce-ligthbar-get.patch b/queue-5.8/platform-chrome-cros_ec_lightbar-reduce-ligthbar-get.patch new file mode 100644 index 00000000000..8d86b033776 --- /dev/null +++ b/queue-5.8/platform-chrome-cros_ec_lightbar-reduce-ligthbar-get.patch @@ -0,0 +1,47 @@ +From 8b767cdf0a7273f36b830a56f07bc75557f6dab3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Aug 2020 23:59:37 -0700 +Subject: platform/chrome: cros_ec_lightbar: Reduce ligthbar get version + command + +From: Gwendal Grignou + +[ Upstream commit 1e7913ff5f9f1b73146ad8522958bd266f22a510 ] + +By default, the lightbar commands are set to the biggest lightbar command +and response. That length is greater than 128 bytes and may not work on +all machines. But all EC are probed for lightbar by sending a get version +request. Set that request size precisely. + +Before the command would be: + + cros_ec_cmd: version: 0, command: EC_CMD_LIGHTBAR_CMD, outsize: 194, insize: 128, result: 0 + +Afer: + + cros_ec_cmd: version: 0, command: EC_CMD_LIGHTBAR_CMD, outsize: 1, insize: 8, result: 0 + +Fixes: a841178445bb7 ("mfd: cros_ec: Use a zero-length array for command data") +Signed-off-by: Gwendal Grignou +Signed-off-by: Enric Balletbo i Serra +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_lightbar.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c +index b59180bff5a3e..ef61298c30bdd 100644 +--- a/drivers/platform/chrome/cros_ec_lightbar.c ++++ b/drivers/platform/chrome/cros_ec_lightbar.c +@@ -116,6 +116,8 @@ static int get_lightbar_version(struct cros_ec_dev *ec, + + param = (struct ec_params_lightbar *)msg->data; + param->cmd = LIGHTBAR_CMD_VERSION; ++ msg->outsize = sizeof(param->cmd); ++ msg->result = sizeof(resp->version); + ret = cros_ec_cmd_xfer_status(ec->ec_dev, msg); + if (ret < 0) { + ret = 0; +-- +2.25.1 + diff --git a/queue-5.8/platform-x86-mlx-platform-remove-psu-eeprom-configur.patch b/queue-5.8/platform-x86-mlx-platform-remove-psu-eeprom-configur.patch new file mode 100644 index 00000000000..54dd0264d9c --- /dev/null +++ b/queue-5.8/platform-x86-mlx-platform-remove-psu-eeprom-configur.patch @@ -0,0 +1,71 @@ +From b10920e401b564f4c464ab76519ddbf8a7d12d12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Sep 2020 20:20:49 +0300 +Subject: platform/x86: mlx-platform: Remove PSU EEPROM configuration + +From: Vadim Pasternak + +[ Upstream commit c071afcea6ecf24a3c119f25ce9f71ffd55b5dc2 ] + +Remove PSU EEPROM configuration for systems class equipped with +Mellanox chip Spectrume-2. Till now all the systems from this class +used few types of power units, all equipped with EEPROM device with +address space two bytes. Thus, all these devices have been handled by +EEPROM driver "24c32". +There is a new requirement is to support power unit replacement by "off +the shelf" device, matching electrical required parameters. Such device +could be equipped with different EEPROM type, which could be one byte +address space addressing or even could be not equipped with EEPROM. +In such case "24c32" will not work. + +Fixes: 1bd42d94ccab ("platform/x86: mlx-platform: Add support for new 200G IB and Ethernet systems") +Signed-off-by: Vadim Pasternak +Reviewed-by: Hans de Goede +Link: https://lore.kernel.org/r/20200923172053.26296-2-vadimp@nvidia.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/mlx-platform.c | 15 ++------------- + 1 file changed, 2 insertions(+), 13 deletions(-) + +diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c +index c27548fd386ac..0d2ed6d1f9c79 100644 +--- a/drivers/platform/x86/mlx-platform.c ++++ b/drivers/platform/x86/mlx-platform.c +@@ -319,15 +319,6 @@ static struct i2c_board_info mlxplat_mlxcpld_psu[] = { + }, + }; + +-static struct i2c_board_info mlxplat_mlxcpld_ng_psu[] = { +- { +- I2C_BOARD_INFO("24c32", 0x51), +- }, +- { +- I2C_BOARD_INFO("24c32", 0x50), +- }, +-}; +- + static struct i2c_board_info mlxplat_mlxcpld_pwr[] = { + { + I2C_BOARD_INFO("dps460", 0x59), +@@ -752,15 +743,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_ng_psu_items_data[] = { + .label = "psu1", + .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, + .mask = BIT(0), +- .hpdev.brdinfo = &mlxplat_mlxcpld_ng_psu[0], +- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR, ++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE, + }, + { + .label = "psu2", + .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, + .mask = BIT(1), +- .hpdev.brdinfo = &mlxplat_mlxcpld_ng_psu[1], +- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR, ++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE, + }, + }; + +-- +2.25.1 + diff --git a/queue-5.8/pm-hibernate-remove-the-bogus-call-to-get_gendisk-in.patch b/queue-5.8/pm-hibernate-remove-the-bogus-call-to-get_gendisk-in.patch new file mode 100644 index 00000000000..5b601cc212d --- /dev/null +++ b/queue-5.8/pm-hibernate-remove-the-bogus-call-to-get_gendisk-in.patch @@ -0,0 +1,49 @@ +From 81acf2aa10c6b63e0a68535f91d6e9f6e7c79a67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 18:14:47 +0200 +Subject: PM: hibernate: remove the bogus call to get_gendisk() in + software_resume() + +From: Christoph Hellwig + +[ Upstream commit 428805c0c5e76ef643b1fbc893edfb636b3d8aef ] + +get_gendisk grabs a reference on the disk and file operation, so this +code will leak both of them while having absolutely no use for the +gendisk itself. + +This effectively reverts commit 2df83fa4bce421f ("PM / Hibernate: Use +get_gendisk to verify partition if resume_file is integer format") + +Signed-off-by: Christoph Hellwig +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/hibernate.c | 11 ----------- + 1 file changed, 11 deletions(-) + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index 02ec716a49271..0e60e10ed66a3 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -851,17 +851,6 @@ static int software_resume(void) + + /* Check if the device is there */ + swsusp_resume_device = name_to_dev_t(resume_file); +- +- /* +- * name_to_dev_t is ineffective to verify parition if resume_file is in +- * integer format. (e.g. major:minor) +- */ +- if (isdigit(resume_file[0]) && resume_wait) { +- int partno; +- while (!get_gendisk(swsusp_resume_device, &partno)) +- msleep(10); +- } +- + if (!swsusp_resume_device) { + /* + * Some device discovery might still be in progress; we need +-- +2.25.1 + diff --git a/queue-5.8/powerpc-64-fix-irq-replay-missing-preempt.patch b/queue-5.8/powerpc-64-fix-irq-replay-missing-preempt.patch new file mode 100644 index 00000000000..146fd89c526 --- /dev/null +++ b/queue-5.8/powerpc-64-fix-irq-replay-missing-preempt.patch @@ -0,0 +1,55 @@ +From dfc853465ec45e5ed5b49a2d2688a09405ba9ce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 21:46:45 +1000 +Subject: powerpc/64: fix irq replay missing preempt + +From: Nicholas Piggin + +[ Upstream commit 903fd31d3212ab72d564c68f6cfb5d04db68773e ] + +Prior to commit 3282a3da25bd ("powerpc/64: Implement soft interrupt +replay in C"), replayed interrupts returned by the regular interrupt +exit code, which performs preemption in case an interrupt had set +need_resched. + +This logic was missed by the conversion. Adding preempt_disable/enable +around the interrupt replay and final irq enable will reschedule if +needed. + +Fixes: 3282a3da25bd ("powerpc/64: Implement soft interrupt replay in C") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200915114650.3980244-1-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/irq.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c +index 05b1cc0e009e4..297ee79febc6c 100644 +--- a/arch/powerpc/kernel/irq.c ++++ b/arch/powerpc/kernel/irq.c +@@ -368,6 +368,12 @@ notrace void arch_local_irq_restore(unsigned long mask) + } + } + ++ /* ++ * Disable preempt here, so that the below preempt_enable will ++ * perform resched if required (a replayed interrupt may set ++ * need_resched). ++ */ ++ preempt_disable(); + irq_soft_mask_set(IRQS_ALL_DISABLED); + trace_hardirqs_off(); + +@@ -377,6 +383,7 @@ notrace void arch_local_irq_restore(unsigned long mask) + trace_hardirqs_on(); + irq_soft_mask_set(IRQS_ENABLED); + __hard_irq_enable(); ++ preempt_enable(); + } + EXPORT_SYMBOL(arch_local_irq_restore); + +-- +2.25.1 + diff --git a/queue-5.8/powerpc-64-fix-irq-replay-pt_regs-softe-value.patch b/queue-5.8/powerpc-64-fix-irq-replay-pt_regs-softe-value.patch new file mode 100644 index 00000000000..683e5153c7c --- /dev/null +++ b/queue-5.8/powerpc-64-fix-irq-replay-pt_regs-softe-value.patch @@ -0,0 +1,44 @@ +From 770a895ed6a34b541832abd9f68b0d05f0e7a30a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 21:46:46 +1000 +Subject: powerpc/64: fix irq replay pt_regs->softe value + +From: Nicholas Piggin + +[ Upstream commit 2b48e96be2f9f7151197fd25dc41487054bc6f5b ] + +Replayed interrupts get an "artificial" struct pt_regs constructed to +pass to interrupt handler functions. This did not get the softe field +set correctly, it's as though the interrupt has hit while irqs are +disabled. It should be IRQS_ENABLED. + +This is possibly harmless, asynchronous handlers should not be testing +if irqs were disabled, but it might be possible for example some code +is shared with synchronous or NMI handlers, and it makes more sense if +debug output looks at this. + +Fixes: 3282a3da25bd ("powerpc/64: Implement soft interrupt replay in C") +Signed-off-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200915114650.3980244-2-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c +index 297ee79febc6c..3a22281a8264e 100644 +--- a/arch/powerpc/kernel/irq.c ++++ b/arch/powerpc/kernel/irq.c +@@ -214,7 +214,7 @@ void replay_soft_interrupts(void) + struct pt_regs regs; + + ppc_save_regs(®s); +- regs.softe = IRQS_ALL_DISABLED; ++ regs.softe = IRQS_ENABLED; + + again: + if (IS_ENABLED(CONFIG_PPC_IRQ_SOFT_MASK_DEBUG)) +-- +2.25.1 + diff --git a/queue-5.8/powerpc-64s-radix-fix-mm_cpumask-trimming-race-vs-kt.patch b/queue-5.8/powerpc-64s-radix-fix-mm_cpumask-trimming-race-vs-kt.patch new file mode 100644 index 00000000000..d20993d2ffc --- /dev/null +++ b/queue-5.8/powerpc-64s-radix-fix-mm_cpumask-trimming-race-vs-kt.patch @@ -0,0 +1,116 @@ +From 477b808005aa103e04d27657a59280126319e928 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 14:52:19 +1000 +Subject: powerpc/64s/radix: Fix mm_cpumask trimming race vs kthread_use_mm + +From: Nicholas Piggin + +[ Upstream commit a665eec0a22e11cdde708c1c256a465ebe768047 ] + +Commit 0cef77c7798a7 ("powerpc/64s/radix: flush remote CPUs out of +single-threaded mm_cpumask") added a mechanism to trim the mm_cpumask of +a process under certain conditions. One of the assumptions is that +mm_users would not be incremented via a reference outside the process +context with mmget_not_zero() then go on to kthread_use_mm() via that +reference. + +That invariant was broken by io_uring code (see previous sparc64 fix), +but I'll point Fixes: to the original powerpc commit because we are +changing that assumption going forward, so this will make backports +match up. + +Fix this by no longer relying on that assumption, but by having each CPU +check the mm is not being used, and clearing their own bit from the mask +only if it hasn't been switched-to by the time the IPI is processed. + +This relies on commit 38cf307c1f20 ("mm: fix kthread_use_mm() vs TLB +invalidate") and ARCH_WANT_IRQS_OFF_ACTIVATE_MM to disable irqs over mm +switch sequences. + +Fixes: 0cef77c7798a7 ("powerpc/64s/radix: flush remote CPUs out of single-threaded mm_cpumask") +Signed-off-by: Nicholas Piggin +Reviewed-by: Michael Ellerman +Depends-on: 38cf307c1f20 ("mm: fix kthread_use_mm() vs TLB invalidate") +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200914045219.3736466-5-npiggin@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/tlb.h | 13 ------------- + arch/powerpc/mm/book3s64/radix_tlb.c | 23 ++++++++++++++++------- + 2 files changed, 16 insertions(+), 20 deletions(-) + +diff --git a/arch/powerpc/include/asm/tlb.h b/arch/powerpc/include/asm/tlb.h +index 862985cf51804..cf87bbdcfdcb2 100644 +--- a/arch/powerpc/include/asm/tlb.h ++++ b/arch/powerpc/include/asm/tlb.h +@@ -67,19 +67,6 @@ static inline int mm_is_thread_local(struct mm_struct *mm) + return false; + return cpumask_test_cpu(smp_processor_id(), mm_cpumask(mm)); + } +-static inline void mm_reset_thread_local(struct mm_struct *mm) +-{ +- WARN_ON(atomic_read(&mm->context.copros) > 0); +- /* +- * It's possible for mm_access to take a reference on mm_users to +- * access the remote mm from another thread, but it's not allowed +- * to set mm_cpumask, so mm_users may be > 1 here. +- */ +- WARN_ON(current->mm != mm); +- atomic_set(&mm->context.active_cpus, 1); +- cpumask_clear(mm_cpumask(mm)); +- cpumask_set_cpu(smp_processor_id(), mm_cpumask(mm)); +-} + #else /* CONFIG_PPC_BOOK3S_64 */ + static inline int mm_is_thread_local(struct mm_struct *mm) + { +diff --git a/arch/powerpc/mm/book3s64/radix_tlb.c b/arch/powerpc/mm/book3s64/radix_tlb.c +index b5cc9b23cf024..277a07772e7d6 100644 +--- a/arch/powerpc/mm/book3s64/radix_tlb.c ++++ b/arch/powerpc/mm/book3s64/radix_tlb.c +@@ -644,19 +644,29 @@ static void do_exit_flush_lazy_tlb(void *arg) + struct mm_struct *mm = arg; + unsigned long pid = mm->context.id; + ++ /* ++ * A kthread could have done a mmget_not_zero() after the flushing CPU ++ * checked mm_is_singlethreaded, and be in the process of ++ * kthread_use_mm when interrupted here. In that case, current->mm will ++ * be set to mm, because kthread_use_mm() setting ->mm and switching to ++ * the mm is done with interrupts off. ++ */ + if (current->mm == mm) +- return; /* Local CPU */ ++ goto out_flush; + + if (current->active_mm == mm) { +- /* +- * Must be a kernel thread because sender is single-threaded. +- */ +- BUG_ON(current->mm); ++ WARN_ON_ONCE(current->mm != NULL); ++ /* Is a kernel thread and is using mm as the lazy tlb */ + mmgrab(&init_mm); +- switch_mm(mm, &init_mm, current); + current->active_mm = &init_mm; ++ switch_mm_irqs_off(mm, &init_mm, current); + mmdrop(mm); + } ++ ++ atomic_dec(&mm->context.active_cpus); ++ cpumask_clear_cpu(smp_processor_id(), mm_cpumask(mm)); ++ ++out_flush: + _tlbiel_pid(pid, RIC_FLUSH_ALL); + } + +@@ -671,7 +681,6 @@ static void exit_flush_lazy_tlbs(struct mm_struct *mm) + */ + smp_call_function_many(mm_cpumask(mm), do_exit_flush_lazy_tlb, + (void *)mm, 1); +- mm_reset_thread_local(mm); + } + + void radix__flush_tlb_mm(struct mm_struct *mm) +-- +2.25.1 + diff --git a/queue-5.8/powerpc-book3s64-hash-4k-support-large-linear-mappin.patch b/queue-5.8/powerpc-book3s64-hash-4k-support-large-linear-mappin.patch new file mode 100644 index 00000000000..a54ea5a6d5b --- /dev/null +++ b/queue-5.8/powerpc-book3s64-hash-4k-support-large-linear-mappin.patch @@ -0,0 +1,74 @@ +From 4c4af3f04c7cb69dc53f4e1a19028f37e886c886 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 8 Jun 2020 12:39:03 +0530 +Subject: powerpc/book3s64/hash/4k: Support large linear mapping range with 4K + +From: Aneesh Kumar K.V + +[ Upstream commit 7746406baa3bc9e23fdd7b7da2f04d86e25ab837 ] + +With commit: 0034d395f89d ("powerpc/mm/hash64: Map all the kernel +regions in the same 0xc range"), we now split the 64TB address range +into 4 contexts each of 16TB. That implies we can do only 16TB linear +mapping. + +On some systems, eg. Power9, memory attached to nodes > 0 will appear +above 16TB in the linear mapping. This resulted in kernel crash when +we boot such systems in hash translation mode with 4K PAGE_SIZE. + +This patch updates the kernel mapping such that we now start supporting upto +61TB of memory with 4K. The kernel mapping now looks like below 4K PAGE_SIZE +and hash translation. + + vmalloc start = 0xc0003d0000000000 + IO start = 0xc0003e0000000000 + vmemmap start = 0xc0003f0000000000 + +Our MAX_PHYSMEM_BITS for 4K is still 64TB even though we can only map 61TB. +We prevent bolt mapping anything outside 61TB range by checking against +H_VMALLOC_START. + +Fixes: 0034d395f89d ("powerpc/mm/hash64: Map all the kernel regions in the same 0xc range") +Reported-by: Cameron Berkenpas +Signed-off-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200608070904.387440-3-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/book3s/64/hash-4k.h | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/arch/powerpc/include/asm/book3s/64/hash-4k.h b/arch/powerpc/include/asm/book3s/64/hash-4k.h +index 3f9ae3585ab98..80c9534148821 100644 +--- a/arch/powerpc/include/asm/book3s/64/hash-4k.h ++++ b/arch/powerpc/include/asm/book3s/64/hash-4k.h +@@ -13,20 +13,19 @@ + */ + #define MAX_EA_BITS_PER_CONTEXT 46 + +-#define REGION_SHIFT (MAX_EA_BITS_PER_CONTEXT - 2) + + /* +- * Our page table limit us to 64TB. Hence for the kernel mapping, +- * each MAP area is limited to 16 TB. +- * The four map areas are: linear mapping, vmap, IO and vmemmap ++ * Our page table limit us to 64TB. For 64TB physical memory, we only need 64GB ++ * of vmemmap space. To better support sparse memory layout, we use 61TB ++ * linear map range, 1TB of vmalloc, 1TB of I/O and 1TB of vmememmap. + */ ++#define REGION_SHIFT (40) + #define H_KERN_MAP_SIZE (ASM_CONST(1) << REGION_SHIFT) + + /* +- * Define the address range of the kernel non-linear virtual area +- * 16TB ++ * Define the address range of the kernel non-linear virtual area (61TB) + */ +-#define H_KERN_VIRT_START ASM_CONST(0xc000100000000000) ++#define H_KERN_VIRT_START ASM_CONST(0xc0003d0000000000) + + #ifndef __ASSEMBLY__ + #define H_PTE_TABLE_SIZE (sizeof(pte_t) << H_PTE_INDEX_SIZE) +-- +2.25.1 + diff --git a/queue-5.8/powerpc-icp-hv-fix-missing-of_node_put-in-success-pa.patch b/queue-5.8/powerpc-icp-hv-fix-missing-of_node_put-in-success-pa.patch new file mode 100644 index 00000000000..6b574d14e0f --- /dev/null +++ b/queue-5.8/powerpc-icp-hv-fix-missing-of_node_put-in-success-pa.patch @@ -0,0 +1,37 @@ +From 29095aa57d557f4885836bac0ee8d4c99175ca3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Jul 2018 10:03:27 +0200 +Subject: powerpc/icp-hv: Fix missing of_node_put() in success path + +From: Nicholas Mc Guire + +[ Upstream commit d3e669f31ec35856f5e85df9224ede5bdbf1bc7b ] + +Both of_find_compatible_node() and of_find_node_by_type() will return +a refcounted node on success - thus for the success path the node must +be explicitly released with a of_node_put(). + +Fixes: 0b05ac6e2480 ("powerpc/xics: Rewrite XICS driver") +Signed-off-by: Nicholas Mc Guire +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1530691407-3991-1-git-send-email-hofrat@osadl.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/xics/icp-hv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/sysdev/xics/icp-hv.c b/arch/powerpc/sysdev/xics/icp-hv.c +index ad8117148ea3b..21b9d1bf39ff6 100644 +--- a/arch/powerpc/sysdev/xics/icp-hv.c ++++ b/arch/powerpc/sysdev/xics/icp-hv.c +@@ -174,6 +174,7 @@ int icp_hv_init(void) + + icp_ops = &icp_hv_ops; + ++ of_node_put(np); + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.8/powerpc-kasan-fix-config_kasan_vmalloc-for-8xx.patch b/queue-5.8/powerpc-kasan-fix-config_kasan_vmalloc-for-8xx.patch new file mode 100644 index 00000000000..90e3e0b2e58 --- /dev/null +++ b/queue-5.8/powerpc-kasan-fix-config_kasan_vmalloc-for-8xx.patch @@ -0,0 +1,81 @@ +From 2afdcb85c485d57add83927bec1b453a489e1453 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 05:05:38 +0000 +Subject: powerpc/kasan: Fix CONFIG_KASAN_VMALLOC for 8xx + +From: Christophe Leroy + +[ Upstream commit 4c42dc5c69a8f24c467a6c997909d2f1d4efdc7f ] + +Before the commit identified below, pages tables allocation was +performed after the allocation of final shadow area for linear memory. +But that commit switched the order, leading to page tables being +already allocated at the time 8xx kasan_init_shadow_8M() is called. +Due to this, kasan_init_shadow_8M() doesn't map the needed +shadow entries because there are already page tables. + +kasan_init_shadow_8M() installs huge PMD entries instead of page +tables. We could at that time free the page tables, but there is no +point in creating page tables that get freed before being used. + +Only book3s/32 hash needs early allocation of page tables. For other +variants, we can keep the initial order and create remaining page +tables after the allocation of final shadow memory for linear mem. + +Move back the allocation of shadow page tables for +CONFIG_KASAN_VMALLOC into kasan_init() after the loop which creates +final shadow memory for linear mem. + +Fixes: 41ea93cf7ba4 ("powerpc/kasan: Fix shadow pages allocation failure") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/8ae4554357da4882612644a74387ae05525b2aaa.1599800716.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/kasan/kasan_init_32.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c +index 019b0c0bbbf31..ca91d04d0a7ae 100644 +--- a/arch/powerpc/mm/kasan/kasan_init_32.c ++++ b/arch/powerpc/mm/kasan/kasan_init_32.c +@@ -121,8 +121,7 @@ void __init kasan_mmu_init(void) + { + int ret; + +- if (early_mmu_has_feature(MMU_FTR_HPTE_TABLE) || +- IS_ENABLED(CONFIG_KASAN_VMALLOC)) { ++ if (early_mmu_has_feature(MMU_FTR_HPTE_TABLE)) { + ret = kasan_init_shadow_page_tables(KASAN_SHADOW_START, KASAN_SHADOW_END); + + if (ret) +@@ -133,11 +132,11 @@ void __init kasan_mmu_init(void) + void __init kasan_init(void) + { + struct memblock_region *reg; ++ int ret; + + for_each_memblock(memory, reg) { + phys_addr_t base = reg->base; + phys_addr_t top = min(base + reg->size, total_lowmem); +- int ret; + + if (base >= top) + continue; +@@ -147,6 +146,13 @@ void __init kasan_init(void) + panic("kasan: kasan_init_region() failed"); + } + ++ if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) { ++ ret = kasan_init_shadow_page_tables(KASAN_SHADOW_START, KASAN_SHADOW_END); ++ ++ if (ret) ++ panic("kasan: kasan_init_shadow_page_tables() failed"); ++ } ++ + kasan_remap_early_shadow_ro(); + + clear_page(kasan_early_shadow_page); +-- +2.25.1 + diff --git a/queue-5.8/powerpc-papr_scm-add-papr-command-family-to-pass-thr.patch b/queue-5.8/powerpc-papr_scm-add-papr-command-family-to-pass-thr.patch new file mode 100644 index 00000000000..ed0f65baa7c --- /dev/null +++ b/queue-5.8/powerpc-papr_scm-add-papr-command-family-to-pass-thr.patch @@ -0,0 +1,46 @@ +From eb67ee2a5a0772296654cbfef55af85f88cf6768 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 02:49:04 +0530 +Subject: powerpc/papr_scm: Add PAPR command family to pass-through command-set + +From: Vaibhav Jain + +[ Upstream commit 13135b461cf205941308984bd3271ec7d403dc40 ] + +Add NVDIMM_FAMILY_PAPR to the list of valid 'dimm_family_mask' +acceptable by papr_scm. This is needed as since commit +92fe2aa859f5 ("libnvdimm: Validate command family indices") libnvdimm +performs a validation of 'nd_cmd_pkg.nd_family' received as part of +ND_CMD_CALL processing to ensure only known command families can use +the general ND_CMD_CALL pass-through functionality. + +Without this change the ND_CMD_CALL pass-through targeting +NVDIMM_FAMILY_PAPR error out with -EINVAL. + +Fixes: 92fe2aa859f5 ("libnvdimm: Validate command family indices") +Signed-off-by: Vaibhav Jain +Reviewed-by: Ira Weiny +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200913211904.24472-1-vaibhav@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/papr_scm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/powerpc/platforms/pseries/papr_scm.c b/arch/powerpc/platforms/pseries/papr_scm.c +index 9c569078a09fd..6c2c66450dac8 100644 +--- a/arch/powerpc/platforms/pseries/papr_scm.c ++++ b/arch/powerpc/platforms/pseries/papr_scm.c +@@ -702,6 +702,9 @@ static int papr_scm_nvdimm_init(struct papr_scm_priv *p) + p->bus_desc.of_node = p->pdev->dev.of_node; + p->bus_desc.provider_name = kstrdup(p->pdev->name, GFP_KERNEL); + ++ /* Set the dimm command family mask to accept PDSMs */ ++ set_bit(NVDIMM_FAMILY_PAPR, &p->bus_desc.dimm_family_mask); ++ + if (!p->bus_desc.provider_name) + return -ENOMEM; + +-- +2.25.1 + diff --git a/queue-5.8/powerpc-perf-exclude-pmc5-6-from-the-irrelevant-pmu-.patch b/queue-5.8/powerpc-perf-exclude-pmc5-6-from-the-irrelevant-pmu-.patch new file mode 100644 index 00000000000..7d1cf9ca5b6 --- /dev/null +++ b/queue-5.8/powerpc-perf-exclude-pmc5-6-from-the-irrelevant-pmu-.patch @@ -0,0 +1,61 @@ +From 4ac5abe661c6c4704240c44a44fde1cab9c1ad51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 03:10:04 -0400 +Subject: powerpc/perf: Exclude pmc5/6 from the irrelevant PMU group + constraints + +From: Athira Rajeev + +[ Upstream commit 3b6c3adbb2fa42749c3d38cfc4d4d0b7e096bb7b ] + +PMU counter support functions enforces event constraints for group of +events to check if all events in a group can be monitored. Incase of +event codes using PMC5 and PMC6 ( 500fa and 600f4 respectively ), not +all constraints are applicable, say the threshold or sample bits. But +current code includes pmc5 and pmc6 in some group constraints (like +IC_DC Qualifier bits) which is actually not applicable and hence +results in those events not getting counted when scheduled along with +group of other events. Patch fixes this by excluding PMC5/6 from +constraints which are not relevant for it. + +Fixes: 7ffd948 ("powerpc/perf: factor out power8 pmu functions") +Signed-off-by: Athira Rajeev +Reviewed-by: Madhavan Srinivasan +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1600672204-1610-1-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/isa207-common.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c +index 4c86da5eb28ab..0b5c8f4fbdbfd 100644 +--- a/arch/powerpc/perf/isa207-common.c ++++ b/arch/powerpc/perf/isa207-common.c +@@ -269,6 +269,15 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp) + + mask |= CNST_PMC_MASK(pmc); + value |= CNST_PMC_VAL(pmc); ++ ++ /* ++ * PMC5 and PMC6 are used to count cycles and instructions and ++ * they do not support most of the constraint bits. Add a check ++ * to exclude PMC5/6 from most of the constraints except for ++ * EBB/BHRB. ++ */ ++ if (pmc >= 5) ++ goto ebb_bhrb; + } + + if (pmc <= 4) { +@@ -335,6 +344,7 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp) + } + } + ++ebb_bhrb: + if (!pmc && ebb) + /* EBB events must specify the PMC */ + return -1; +-- +2.25.1 + diff --git a/queue-5.8/powerpc-perf-hv-gpci-fix-starting-index-value.patch b/queue-5.8/powerpc-perf-hv-gpci-fix-starting-index-value.patch new file mode 100644 index 00000000000..32a3b2fabac --- /dev/null +++ b/queue-5.8/powerpc-perf-hv-gpci-fix-starting-index-value.patch @@ -0,0 +1,76 @@ +From d2e96d1fa568af4cb5ea42c463eb35c67fd432ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Oct 2020 13:19:39 +0530 +Subject: powerpc/perf/hv-gpci: Fix starting index value + +From: Kajol Jain + +[ Upstream commit 0f9866f7e85765bbda86666df56c92f377c3bc10 ] + +Commit 9e9f60108423f ("powerpc/perf/{hv-gpci, hv-common}: generate +requests with counters annotated") adds a framework for defining +gpci counters. +In this patch, they adds starting_index value as '0xffffffffffffffff'. +which is wrong as starting_index is of size 32 bits. + +Because of this, incase we try to run hv-gpci event we get error. + +In power9 machine: + +command#: perf stat -e hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/ + -C 0 -I 1000 +event syntax error: '..bie_count_and_time_tlbie_instructions_issued/' + \___ value too big for format, maximum is 4294967295 + +This patch fix this issue and changes starting_index value to '0xffffffff' + +After this patch: + +command#: perf stat -e hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/ -C 0 -I 1000 + 1.000085786 1,024 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/ + 2.000287818 1,024 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/ + 2.439113909 17,408 hv_gpci/system_tlbie_count_and_time_tlbie_instructions_issued/ + +Fixes: 9e9f60108423 ("powerpc/perf/{hv-gpci, hv-common}: generate requests with counters annotated") +Signed-off-by: Kajol Jain +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201003074943.338618-1-kjain@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/hv-gpci-requests.h | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/powerpc/perf/hv-gpci-requests.h b/arch/powerpc/perf/hv-gpci-requests.h +index e608f9db12ddc..8965b4463d433 100644 +--- a/arch/powerpc/perf/hv-gpci-requests.h ++++ b/arch/powerpc/perf/hv-gpci-requests.h +@@ -95,7 +95,7 @@ REQUEST(__field(0, 8, partition_id) + + #define REQUEST_NAME system_performance_capabilities + #define REQUEST_NUM 0x40 +-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" ++#define REQUEST_IDX_KIND "starting_index=0xffffffff" + #include I(REQUEST_BEGIN) + REQUEST(__field(0, 1, perf_collect_privileged) + __field(0x1, 1, capability_mask) +@@ -223,7 +223,7 @@ REQUEST(__field(0, 2, partition_id) + + #define REQUEST_NAME system_hypervisor_times + #define REQUEST_NUM 0xF0 +-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" ++#define REQUEST_IDX_KIND "starting_index=0xffffffff" + #include I(REQUEST_BEGIN) + REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors) + __count(0x8, 8, time_spent_processing_virtual_processor_timers) +@@ -234,7 +234,7 @@ REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors) + + #define REQUEST_NAME system_tlbie_count_and_time + #define REQUEST_NUM 0xF4 +-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff" ++#define REQUEST_IDX_KIND "starting_index=0xffffffff" + #include I(REQUEST_BEGIN) + REQUEST(__count(0, 8, tlbie_instructions_issued) + /* +-- +2.25.1 + diff --git a/queue-5.8/powerpc-powernv-dump-fix-race-while-processing-opal-.patch b/queue-5.8/powerpc-powernv-dump-fix-race-while-processing-opal-.patch new file mode 100644 index 00000000000..aa1b8d2a758 --- /dev/null +++ b/queue-5.8/powerpc-powernv-dump-fix-race-while-processing-opal-.patch @@ -0,0 +1,117 @@ +From 52d5831714badf7b76bb153bf0e2116ec3673207 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Oct 2020 22:12:10 +0530 +Subject: powerpc/powernv/dump: Fix race while processing OPAL dump + +From: Vasant Hegde + +[ Upstream commit 0a43ae3e2beb77e3481d812834d33abe270768ab ] + +Every dump reported by OPAL is exported to userspace through a sysfs +interface and notified using kobject_uevent(). The userspace daemon +(opal_errd) then reads the dump and acknowledges that the dump is +saved safely to disk. Once acknowledged the kernel removes the +respective sysfs file entry causing respective resources to be +released including kobject. + +However it's possible the userspace daemon may already be scanning +dump entries when a new sysfs dump entry is created by the kernel. +User daemon may read this new entry and ack it even before kernel can +notify userspace about it through kobject_uevent() call. If that +happens then we have a potential race between +dump_ack_store->kobject_put() and kobject_uevent which can lead to +use-after-free of a kernfs object resulting in a kernel crash. + +This patch fixes this race by protecting the sysfs file +creation/notification by holding a reference count on kobject until we +safely send kobject_uevent(). + +The function create_dump_obj() returns the dump object which if used +by caller function will end up in use-after-free problem again. +However, the return value of create_dump_obj() function isn't being +used today and there is no need as well. Hence change it to return +void to make this fix complete. + +Fixes: c7e64b9ce04a ("powerpc/powernv Platform dump interface") +Signed-off-by: Vasant Hegde +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201017164210.264619-1-hegdevasant@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/powernv/opal-dump.c | 41 +++++++++++++++------- + 1 file changed, 29 insertions(+), 12 deletions(-) + +diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c +index 543c816fa99ef..0e6693bacb7e7 100644 +--- a/arch/powerpc/platforms/powernv/opal-dump.c ++++ b/arch/powerpc/platforms/powernv/opal-dump.c +@@ -318,15 +318,14 @@ static ssize_t dump_attr_read(struct file *filep, struct kobject *kobj, + return count; + } + +-static struct dump_obj *create_dump_obj(uint32_t id, size_t size, +- uint32_t type) ++static void create_dump_obj(uint32_t id, size_t size, uint32_t type) + { + struct dump_obj *dump; + int rc; + + dump = kzalloc(sizeof(*dump), GFP_KERNEL); + if (!dump) +- return NULL; ++ return; + + dump->kobj.kset = dump_kset; + +@@ -346,21 +345,39 @@ static struct dump_obj *create_dump_obj(uint32_t id, size_t size, + rc = kobject_add(&dump->kobj, NULL, "0x%x-0x%x", type, id); + if (rc) { + kobject_put(&dump->kobj); +- return NULL; ++ return; + } + ++ /* ++ * As soon as the sysfs file for this dump is created/activated there is ++ * a chance the opal_errd daemon (or any userspace) might read and ++ * acknowledge the dump before kobject_uevent() is called. If that ++ * happens then there is a potential race between ++ * dump_ack_store->kobject_put() and kobject_uevent() which leads to a ++ * use-after-free of a kernfs object resulting in a kernel crash. ++ * ++ * To avoid that, we need to take a reference on behalf of the bin file, ++ * so that our reference remains valid while we call kobject_uevent(). ++ * We then drop our reference before exiting the function, leaving the ++ * bin file to drop the last reference (if it hasn't already). ++ */ ++ ++ /* Take a reference for the bin file */ ++ kobject_get(&dump->kobj); + rc = sysfs_create_bin_file(&dump->kobj, &dump->dump_attr); +- if (rc) { ++ if (rc == 0) { ++ kobject_uevent(&dump->kobj, KOBJ_ADD); ++ ++ pr_info("%s: New platform dump. ID = 0x%x Size %u\n", ++ __func__, dump->id, dump->size); ++ } else { ++ /* Drop reference count taken for bin file */ + kobject_put(&dump->kobj); +- return NULL; + } + +- pr_info("%s: New platform dump. ID = 0x%x Size %u\n", +- __func__, dump->id, dump->size); +- +- kobject_uevent(&dump->kobj, KOBJ_ADD); +- +- return dump; ++ /* Drop our reference */ ++ kobject_put(&dump->kobj); ++ return; + } + + static irqreturn_t process_dump(int irq, void *data) +-- +2.25.1 + diff --git a/queue-5.8/powerpc-pseries-avoid-using-addr_to_pfn-in-real-mode.patch b/queue-5.8/powerpc-pseries-avoid-using-addr_to_pfn-in-real-mode.patch new file mode 100644 index 00000000000..a369bb67f68 --- /dev/null +++ b/queue-5.8/powerpc-pseries-avoid-using-addr_to_pfn-in-real-mode.patch @@ -0,0 +1,219 @@ +From 0c5ace0a56999f2c7ddc6a5af9946f9ce8663c75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jul 2020 12:09:46 +0530 +Subject: powerpc/pseries: Avoid using addr_to_pfn in real mode + +From: Ganesh Goudar + +[ Upstream commit 4ff753feab021242144818b9a3ba011238218145 ] + +When an UE or memory error exception is encountered the MCE handler +tries to find the pfn using addr_to_pfn() which takes effective +address as an argument, later pfn is used to poison the page where +memory error occurred, recent rework in this area made addr_to_pfn +to run in real mode, which can be fatal as it may try to access +memory outside RMO region. + +Have two helper functions to separate things to be done in real mode +and virtual mode without changing any functionality. This also fixes +the following error as the use of addr_to_pfn is now moved to virtual +mode. + +Without this change following kernel crash is seen on hitting UE. + +[ 485.128036] Oops: Kernel access of bad area, sig: 11 [#1] +[ 485.128040] LE SMP NR_CPUS=2048 NUMA pSeries +[ 485.128047] Modules linked in: +[ 485.128067] CPU: 15 PID: 6536 Comm: insmod Kdump: loaded Tainted: G OE 5.7.0 #22 +[ 485.128074] NIP: c00000000009b24c LR: c0000000000398d8 CTR: c000000000cd57c0 +[ 485.128078] REGS: c000000003f1f970 TRAP: 0300 Tainted: G OE (5.7.0) +[ 485.128082] MSR: 8000000000001003 CR: 28008284 XER: 00000001 +[ 485.128088] CFAR: c00000000009b190 DAR: c0000001fab00000 DSISR: 40000000 IRQMASK: 1 +[ 485.128088] GPR00: 0000000000000001 c000000003f1fbf0 c000000001634300 0000b0fa01000000 +[ 485.128088] GPR04: d000000002220000 0000000000000000 00000000fab00000 0000000000000022 +[ 485.128088] GPR08: c0000001fab00000 0000000000000000 c0000001fab00000 c000000003f1fc14 +[ 485.128088] GPR12: 0000000000000008 c000000003ff5880 d000000002100008 0000000000000000 +[ 485.128088] GPR16: 000000000000ff20 000000000000fff1 000000000000fff2 d0000000021a1100 +[ 485.128088] GPR20: d000000002200000 c00000015c893c50 c000000000d49b28 c00000015c893c50 +[ 485.128088] GPR24: d0000000021a0d08 c0000000014e5da8 d0000000021a0818 000000000000000a +[ 485.128088] GPR28: 0000000000000008 000000000000000a c0000000017e2970 000000000000000a +[ 485.128125] NIP [c00000000009b24c] __find_linux_pte+0x11c/0x310 +[ 485.128130] LR [c0000000000398d8] addr_to_pfn+0x138/0x170 +[ 485.128133] Call Trace: +[ 485.128135] Instruction dump: +[ 485.128138] 3929ffff 7d4a3378 7c883c36 7d2907b4 794a1564 7d294038 794af082 3900ffff +[ 485.128144] 79291f24 790af00e 78e70020 7d095214 <7c69502a> 2fa30000 419e011c 70690040 +[ 485.128152] ---[ end trace d34b27e29ae0e340 ]--- + +Fixes: 9ca766f9891d ("powerpc/64s/pseries: machine check convert to use common event code") +Signed-off-by: Ganesh Goudar +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200724063946.21378-1-ganeshgr@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/ras.c | 118 ++++++++++++++++----------- + 1 file changed, 69 insertions(+), 49 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c +index 13c86a292c6d7..b2b245b25edba 100644 +--- a/arch/powerpc/platforms/pseries/ras.c ++++ b/arch/powerpc/platforms/pseries/ras.c +@@ -521,18 +521,55 @@ int pSeries_system_reset_exception(struct pt_regs *regs) + return 0; /* need to perform reset */ + } + ++static int mce_handle_err_realmode(int disposition, u8 error_type) ++{ ++#ifdef CONFIG_PPC_BOOK3S_64 ++ if (disposition == RTAS_DISP_NOT_RECOVERED) { ++ switch (error_type) { ++ case MC_ERROR_TYPE_SLB: ++ case MC_ERROR_TYPE_ERAT: ++ /* ++ * Store the old slb content in paca before flushing. ++ * Print this when we go to virtual mode. ++ * There are chances that we may hit MCE again if there ++ * is a parity error on the SLB entry we trying to read ++ * for saving. Hence limit the slb saving to single ++ * level of recursion. ++ */ ++ if (local_paca->in_mce == 1) ++ slb_save_contents(local_paca->mce_faulty_slbs); ++ flush_and_reload_slb(); ++ disposition = RTAS_DISP_FULLY_RECOVERED; ++ break; ++ default: ++ break; ++ } ++ } else if (disposition == RTAS_DISP_LIMITED_RECOVERY) { ++ /* Platform corrected itself but could be degraded */ ++ pr_err("MCE: limited recovery, system may be degraded\n"); ++ disposition = RTAS_DISP_FULLY_RECOVERED; ++ } ++#endif ++ return disposition; ++} + +-static int mce_handle_error(struct pt_regs *regs, struct rtas_error_log *errp) ++static int mce_handle_err_virtmode(struct pt_regs *regs, ++ struct rtas_error_log *errp, ++ struct pseries_mc_errorlog *mce_log, ++ int disposition) + { + struct mce_error_info mce_err = { 0 }; +- unsigned long eaddr = 0, paddr = 0; +- struct pseries_errorlog *pseries_log; +- struct pseries_mc_errorlog *mce_log; +- int disposition = rtas_error_disposition(errp); + int initiator = rtas_error_initiator(errp); + int severity = rtas_error_severity(errp); ++ unsigned long eaddr = 0, paddr = 0; + u8 error_type, err_sub_type; + ++ if (!mce_log) ++ goto out; ++ ++ error_type = mce_log->error_type; ++ err_sub_type = rtas_mc_error_sub_type(mce_log); ++ + if (initiator == RTAS_INITIATOR_UNKNOWN) + mce_err.initiator = MCE_INITIATOR_UNKNOWN; + else if (initiator == RTAS_INITIATOR_CPU) +@@ -571,18 +608,7 @@ static int mce_handle_error(struct pt_regs *regs, struct rtas_error_log *errp) + mce_err.error_type = MCE_ERROR_TYPE_UNKNOWN; + mce_err.error_class = MCE_ECLASS_UNKNOWN; + +- if (!rtas_error_extended(errp)) +- goto out; +- +- pseries_log = get_pseries_errorlog(errp, PSERIES_ELOG_SECT_ID_MCE); +- if (pseries_log == NULL) +- goto out; +- +- mce_log = (struct pseries_mc_errorlog *)pseries_log->data; +- error_type = mce_log->error_type; +- err_sub_type = rtas_mc_error_sub_type(mce_log); +- +- switch (mce_log->error_type) { ++ switch (error_type) { + case MC_ERROR_TYPE_UE: + mce_err.error_type = MCE_ERROR_TYPE_UE; + mce_common_process_ue(regs, &mce_err); +@@ -682,37 +708,31 @@ static int mce_handle_error(struct pt_regs *regs, struct rtas_error_log *errp) + mce_err.error_type = MCE_ERROR_TYPE_UNKNOWN; + break; + } ++out: ++ save_mce_event(regs, disposition == RTAS_DISP_FULLY_RECOVERED, ++ &mce_err, regs->nip, eaddr, paddr); ++ return disposition; ++} + +-#ifdef CONFIG_PPC_BOOK3S_64 +- if (disposition == RTAS_DISP_NOT_RECOVERED) { +- switch (error_type) { +- case MC_ERROR_TYPE_SLB: +- case MC_ERROR_TYPE_ERAT: +- /* +- * Store the old slb content in paca before flushing. +- * Print this when we go to virtual mode. +- * There are chances that we may hit MCE again if there +- * is a parity error on the SLB entry we trying to read +- * for saving. Hence limit the slb saving to single +- * level of recursion. +- */ +- if (local_paca->in_mce == 1) +- slb_save_contents(local_paca->mce_faulty_slbs); +- flush_and_reload_slb(); +- disposition = RTAS_DISP_FULLY_RECOVERED; +- break; +- default: +- break; +- } +- } else if (disposition == RTAS_DISP_LIMITED_RECOVERY) { +- /* Platform corrected itself but could be degraded */ +- printk(KERN_ERR "MCE: limited recovery, system may " +- "be degraded\n"); +- disposition = RTAS_DISP_FULLY_RECOVERED; +- } +-#endif ++static int mce_handle_error(struct pt_regs *regs, struct rtas_error_log *errp) ++{ ++ struct pseries_errorlog *pseries_log; ++ struct pseries_mc_errorlog *mce_log = NULL; ++ int disposition = rtas_error_disposition(errp); ++ u8 error_type; ++ ++ if (!rtas_error_extended(errp)) ++ goto out; ++ ++ pseries_log = get_pseries_errorlog(errp, PSERIES_ELOG_SECT_ID_MCE); ++ if (!pseries_log) ++ goto out; ++ ++ mce_log = (struct pseries_mc_errorlog *)pseries_log->data; ++ error_type = mce_log->error_type; ++ ++ disposition = mce_handle_err_realmode(disposition, error_type); + +-out: + /* + * Enable translation as we will be accessing per-cpu variables + * in save_mce_event() which may fall outside RMO region, also +@@ -723,10 +743,10 @@ static int mce_handle_error(struct pt_regs *regs, struct rtas_error_log *errp) + * Note: All the realmode handling like flushing SLB entries for + * SLB multihit is done by now. + */ ++out: + mtmsr(mfmsr() | MSR_IR | MSR_DR); +- save_mce_event(regs, disposition == RTAS_DISP_FULLY_RECOVERED, +- &mce_err, regs->nip, eaddr, paddr); +- ++ disposition = mce_handle_err_virtmode(regs, errp, mce_log, ++ disposition); + return disposition; + } + +-- +2.25.1 + diff --git a/queue-5.8/powerpc-pseries-explicitly-reschedule-during-drmem_l.patch b/queue-5.8/powerpc-pseries-explicitly-reschedule-during-drmem_l.patch new file mode 100644 index 00000000000..fa1784b2685 --- /dev/null +++ b/queue-5.8/powerpc-pseries-explicitly-reschedule-during-drmem_l.patch @@ -0,0 +1,76 @@ +From 6d6d0bcf4b61fec05390d591da948c9ab1c49001 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 10:11:31 -0500 +Subject: powerpc/pseries: explicitly reschedule during drmem_lmb list + traversal + +From: Nathan Lynch + +[ Upstream commit 9d6792ffe140240ae54c881cc4183f9acc24b4df ] + +The drmem lmb list can have hundreds of thousands of entries, and +unfortunately lookups take the form of linear searches. As long as +this is the case, traversals have the potential to monopolize the CPU +and provoke lockup reports, workqueue stalls, and the like unless +they explicitly yield. + +Rather than placing cond_resched() calls within various +for_each_drmem_lmb() loop blocks in the code, put it in the iteration +expression of the loop macro itself so users can't omit it. + +Introduce a drmem_lmb_next() iteration helper function which calls +cond_resched() at a regular interval during array traversal. Each +iteration of the loop in DLPAR code paths can involve around ten RTAS +calls which can each take up to 250us, so this ensures the check is +performed at worst every few milliseconds. + +Fixes: 6c6ea53725b3 ("powerpc/mm: Separate ibm, dynamic-memory data from DT format") +Signed-off-by: Nathan Lynch +Reviewed-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200813151131.2070161-1-nathanl@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/drmem.h | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/include/asm/drmem.h b/arch/powerpc/include/asm/drmem.h +index 414d209f45bbe..1ec6de1a88514 100644 +--- a/arch/powerpc/include/asm/drmem.h ++++ b/arch/powerpc/include/asm/drmem.h +@@ -8,6 +8,8 @@ + #ifndef _ASM_POWERPC_LMB_H + #define _ASM_POWERPC_LMB_H + ++#include ++ + struct drmem_lmb { + u64 base_addr; + u32 drc_index; +@@ -26,8 +28,22 @@ struct drmem_lmb_info { + + extern struct drmem_lmb_info *drmem_info; + ++static inline struct drmem_lmb *drmem_lmb_next(struct drmem_lmb *lmb, ++ const struct drmem_lmb *start) ++{ ++ /* ++ * DLPAR code paths can take several milliseconds per element ++ * when interacting with firmware. Ensure that we don't ++ * unfairly monopolize the CPU. ++ */ ++ if (((++lmb - start) % 16) == 0) ++ cond_resched(); ++ ++ return lmb; ++} ++ + #define for_each_drmem_lmb_in_range(lmb, start, end) \ +- for ((lmb) = (start); (lmb) < (end); (lmb)++) ++ for ((lmb) = (start); (lmb) < (end); lmb = drmem_lmb_next(lmb, start)) + + #define for_each_drmem_lmb(lmb) \ + for_each_drmem_lmb_in_range((lmb), \ +-- +2.25.1 + diff --git a/queue-5.8/powerpc-pseries-fix-missing-of_node_put-in-rng_init.patch b/queue-5.8/powerpc-pseries-fix-missing-of_node_put-in-rng_init.patch new file mode 100644 index 00000000000..0e2bf0f82b6 --- /dev/null +++ b/queue-5.8/powerpc-pseries-fix-missing-of_node_put-in-rng_init.patch @@ -0,0 +1,37 @@ +From c9868676e8f2ae5e2a7cadd7af2f5dfdd92fcc96 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Jul 2018 11:08:16 +0200 +Subject: powerpc/pseries: Fix missing of_node_put() in rng_init() + +From: Nicholas Mc Guire + +[ Upstream commit 67c3e59443f5fc77be39e2ce0db75fbfa78c7965 ] + +The call to of_find_compatible_node() returns a node pointer with +refcount incremented thus it must be explicitly decremented here +before returning. + +Fixes: a489043f4626 ("powerpc/pseries: Implement arch_get_random_long() based on H_RANDOM") +Signed-off-by: Nicholas Mc Guire +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1530522496-14816-1-git-send-email-hofrat@osadl.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/rng.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c +index bbb97169bf63e..6268545947b83 100644 +--- a/arch/powerpc/platforms/pseries/rng.c ++++ b/arch/powerpc/platforms/pseries/rng.c +@@ -36,6 +36,7 @@ static __init int rng_init(void) + + ppc_md.get_random_seed = pseries_get_random_long; + ++ of_node_put(dn); + return 0; + } + machine_subsys_initcall(pseries, rng_init); +-- +2.25.1 + diff --git a/queue-5.8/powerpc-pseries-svm-allocate-swiotlb-buffer-anywhere.patch b/queue-5.8/powerpc-pseries-svm-allocate-swiotlb-buffer-anywhere.patch new file mode 100644 index 00000000000..f51ae86b51e --- /dev/null +++ b/queue-5.8/powerpc-pseries-svm-allocate-swiotlb-buffer-anywhere.patch @@ -0,0 +1,128 @@ +From f5d2008e4ed654938c74316e22bb06f9b757a9d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 19:11:26 -0300 +Subject: powerpc/pseries/svm: Allocate SWIOTLB buffer anywhere in memory + +From: Thiago Jung Bauermann + +[ Upstream commit eae9eec476d13fad9af6da1f44a054ee02b7b161 ] + +POWER secure guests (i.e., guests which use the Protected Execution +Facility) need to use SWIOTLB to be able to do I/O with the +hypervisor, but they don't need the SWIOTLB memory to be in low +addresses since the hypervisor doesn't have any addressing limitation. + +This solves a SWIOTLB initialization problem we are seeing in secure +guests with 128 GB of RAM: they are configured with 4 GB of +crashkernel reserved memory, which leaves no space for SWIOTLB in low +addresses. + +To do this, we use mostly the same code as swiotlb_init(), but +allocate the buffer using memblock_alloc() instead of +memblock_alloc_low(). + +Fixes: 2efbc58f157a ("powerpc/pseries/svm: Force SWIOTLB for secure guests") +Signed-off-by: Thiago Jung Bauermann +Reviewed-by: Konrad Rzeszutek Wilk +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200818221126.391073-1-bauerman@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/svm.h | 4 ++++ + arch/powerpc/mm/mem.c | 6 +++++- + arch/powerpc/platforms/pseries/svm.c | 26 ++++++++++++++++++++++++++ + 3 files changed, 35 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/include/asm/svm.h b/arch/powerpc/include/asm/svm.h +index 85580b30aba48..7546402d796af 100644 +--- a/arch/powerpc/include/asm/svm.h ++++ b/arch/powerpc/include/asm/svm.h +@@ -15,6 +15,8 @@ static inline bool is_secure_guest(void) + return mfmsr() & MSR_S; + } + ++void __init svm_swiotlb_init(void); ++ + void dtl_cache_ctor(void *addr); + #define get_dtl_cache_ctor() (is_secure_guest() ? dtl_cache_ctor : NULL) + +@@ -25,6 +27,8 @@ static inline bool is_secure_guest(void) + return false; + } + ++static inline void svm_swiotlb_init(void) {} ++ + #define get_dtl_cache_ctor() NULL + + #endif /* CONFIG_PPC_SVM */ +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index c2c11eb8dcfca..0f21bcb16405a 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -50,6 +50,7 @@ + #include + #include + #include ++#include + + #include + +@@ -290,7 +291,10 @@ void __init mem_init(void) + * back to to-down. + */ + memblock_set_bottom_up(true); +- swiotlb_init(0); ++ if (is_secure_guest()) ++ svm_swiotlb_init(); ++ else ++ swiotlb_init(0); + #endif + + high_memory = (void *) __va(max_low_pfn * PAGE_SIZE); +diff --git a/arch/powerpc/platforms/pseries/svm.c b/arch/powerpc/platforms/pseries/svm.c +index 40c0637203d5b..81085eb8f2255 100644 +--- a/arch/powerpc/platforms/pseries/svm.c ++++ b/arch/powerpc/platforms/pseries/svm.c +@@ -7,6 +7,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -34,6 +35,31 @@ static int __init init_svm(void) + } + machine_early_initcall(pseries, init_svm); + ++/* ++ * Initialize SWIOTLB. Essentially the same as swiotlb_init(), except that it ++ * can allocate the buffer anywhere in memory. Since the hypervisor doesn't have ++ * any addressing limitation, we don't need to allocate it in low addresses. ++ */ ++void __init svm_swiotlb_init(void) ++{ ++ unsigned char *vstart; ++ unsigned long bytes, io_tlb_nslabs; ++ ++ io_tlb_nslabs = (swiotlb_size_or_default() >> IO_TLB_SHIFT); ++ io_tlb_nslabs = ALIGN(io_tlb_nslabs, IO_TLB_SEGSIZE); ++ ++ bytes = io_tlb_nslabs << IO_TLB_SHIFT; ++ ++ vstart = memblock_alloc(PAGE_ALIGN(bytes), PAGE_SIZE); ++ if (vstart && !swiotlb_init_with_tbl(vstart, io_tlb_nslabs, false)) ++ return; ++ ++ if (io_tlb_start) ++ memblock_free_early(io_tlb_start, ++ PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT)); ++ panic("SVM: Cannot allocate SWIOTLB buffer"); ++} ++ + int set_memory_encrypted(unsigned long addr, int numpages) + { + if (!PAGE_ALIGNED(addr)) +-- +2.25.1 + diff --git a/queue-5.8/powerpc-tau-check-processor-type-before-enabling-tau.patch b/queue-5.8/powerpc-tau-check-processor-type-before-enabling-tau.patch new file mode 100644 index 00000000000..9ec39162e11 --- /dev/null +++ b/queue-5.8/powerpc-tau-check-processor-type-before-enabling-tau.patch @@ -0,0 +1,116 @@ +From a5e4cc076a20eb9900d596c223a1526ac2f748ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Sep 2020 09:02:20 +1000 +Subject: powerpc/tau: Check processor type before enabling TAU interrupt + +From: Finn Thain + +[ Upstream commit 5e3119e15fed5b9a9a7e528665ff098a4a8dbdbc ] + +According to Freescale's documentation, MPC74XX processors have an +erratum that prevents the TAU interrupt from working, so don't try to +use it when running on those processors. + +Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") +Signed-off-by: Finn Thain +Tested-by: Stan Johnson +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/c281611544768e758bd58fe812cf702a5bd2d042.1599260540.git.fthain@telegraphics.com.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/tau_6xx.c | 33 ++++++++++++++------------------- + arch/powerpc/platforms/Kconfig | 5 ++--- + 2 files changed, 16 insertions(+), 22 deletions(-) + +diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c +index b8d7e7d498e0a..614b5b272d9c6 100644 +--- a/arch/powerpc/kernel/tau_6xx.c ++++ b/arch/powerpc/kernel/tau_6xx.c +@@ -40,6 +40,8 @@ static struct tau_temp + unsigned char grew; + } tau[NR_CPUS]; + ++static bool tau_int_enable; ++ + #undef DEBUG + + /* TODO: put these in a /proc interface, with some sanity checks, and maybe +@@ -54,22 +56,13 @@ static struct tau_temp + + static void set_thresholds(unsigned long cpu) + { +-#ifdef CONFIG_TAU_INT +- /* +- * setup THRM1, +- * threshold, valid bit, enable interrupts, interrupt when below threshold +- */ +- mtspr(SPRN_THRM1, THRM1_THRES(tau[cpu].low) | THRM1_V | THRM1_TIE | THRM1_TID); ++ u32 maybe_tie = tau_int_enable ? THRM1_TIE : 0; + +- /* setup THRM2, +- * threshold, valid bit, enable interrupts, interrupt when above threshold +- */ +- mtspr (SPRN_THRM2, THRM1_THRES(tau[cpu].high) | THRM1_V | THRM1_TIE); +-#else +- /* same thing but don't enable interrupts */ +- mtspr(SPRN_THRM1, THRM1_THRES(tau[cpu].low) | THRM1_V | THRM1_TID); +- mtspr(SPRN_THRM2, THRM1_THRES(tau[cpu].high) | THRM1_V); +-#endif ++ /* setup THRM1, threshold, valid bit, interrupt when below threshold */ ++ mtspr(SPRN_THRM1, THRM1_THRES(tau[cpu].low) | THRM1_V | maybe_tie | THRM1_TID); ++ ++ /* setup THRM2, threshold, valid bit, interrupt when above threshold */ ++ mtspr(SPRN_THRM2, THRM1_THRES(tau[cpu].high) | THRM1_V | maybe_tie); + } + + static void TAUupdate(int cpu) +@@ -142,9 +135,8 @@ static void tau_timeout(void * info) + local_irq_save(flags); + cpu = smp_processor_id(); + +-#ifndef CONFIG_TAU_INT +- TAUupdate(cpu); +-#endif ++ if (!tau_int_enable) ++ TAUupdate(cpu); + + size = tau[cpu].high - tau[cpu].low; + if (size > min_window && ! tau[cpu].grew) { +@@ -225,6 +217,9 @@ static int __init TAU_init(void) + return 1; + } + ++ tau_int_enable = IS_ENABLED(CONFIG_TAU_INT) && ++ !strcmp(cur_cpu_spec->platform, "ppc750"); ++ + tau_workq = alloc_workqueue("tau", WQ_UNBOUND, 1, 0); + if (!tau_workq) + return -ENOMEM; +@@ -234,7 +229,7 @@ static int __init TAU_init(void) + queue_work(tau_workq, &tau_work); + + pr_info("Thermal assist unit using %s, shrink_timer: %d ms\n", +- IS_ENABLED(CONFIG_TAU_INT) ? "interrupts" : "workqueue", shrink_timer); ++ tau_int_enable ? "interrupts" : "workqueue", shrink_timer); + tau_initialized = 1; + + return 0; +diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig +index fb7515b4fa9c6..9fe36f0b54c1a 100644 +--- a/arch/powerpc/platforms/Kconfig ++++ b/arch/powerpc/platforms/Kconfig +@@ -223,9 +223,8 @@ config TAU + temperature within 2-4 degrees Celsius. This option shows the current + on-die temperature in /proc/cpuinfo if the cpu supports it. + +- Unfortunately, on some chip revisions, this sensor is very inaccurate +- and in many cases, does not work at all, so don't assume the cpu +- temp is actually what /proc/cpuinfo says it is. ++ Unfortunately, this sensor is very inaccurate when uncalibrated, so ++ don't assume the cpu temp is actually what /proc/cpuinfo says it is. + + config TAU_INT + bool "Interrupt driven TAU driver (DANGEROUS)" +-- +2.25.1 + diff --git a/queue-5.8/powerpc-tau-convert-from-timer-to-workqueue.patch b/queue-5.8/powerpc-tau-convert-from-timer-to-workqueue.patch new file mode 100644 index 00000000000..68799a5a195 --- /dev/null +++ b/queue-5.8/powerpc-tau-convert-from-timer-to-workqueue.patch @@ -0,0 +1,153 @@ +From 98fd77ea488dfc2a3c36a4b3201e382cb82b8158 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Sep 2020 09:02:20 +1000 +Subject: powerpc/tau: Convert from timer to workqueue + +From: Finn Thain + +[ Upstream commit b1c6a0a10bfaf36ec82fde6f621da72407fa60a1 ] + +Since commit 19dbdcb8039cf ("smp: Warn on function calls from softirq +context") the Thermal Assist Unit driver causes a warning like the +following when CONFIG_SMP is enabled. + + ------------[ cut here ]------------ + WARNING: CPU: 0 PID: 0 at kernel/smp.c:428 smp_call_function_many_cond+0xf4/0x38c + Modules linked in: + CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-pmac #3 + NIP: c00b37a8 LR: c00b3abc CTR: c001218c + REGS: c0799c60 TRAP: 0700 Not tainted (5.7.0-pmac) + MSR: 00029032 CR: 42000224 XER: 00000000 + GPR00: c00b3abc c0799d18 c076e300 c079ef5c c0011fec 00000000 00000000 00000000 + GPR08: 00000100 00000100 00008000 ffffffff 42000224 00000000 c079d040 c079d044 + GPR16: 00000001 00000000 00000004 c0799da0 c079f054 c07a0000 c07a0000 00000000 + GPR24: c0011fec 00000000 c079ef5c c079ef5c 00000000 00000000 00000000 00000000 + NIP [c00b37a8] smp_call_function_many_cond+0xf4/0x38c + LR [c00b3abc] on_each_cpu+0x38/0x68 + Call Trace: + [c0799d18] [ffffffff] 0xffffffff (unreliable) + [c0799d68] [c00b3abc] on_each_cpu+0x38/0x68 + [c0799d88] [c0096704] call_timer_fn.isra.26+0x20/0x7c + [c0799d98] [c0096b40] run_timer_softirq+0x1d4/0x3fc + [c0799df8] [c05b4368] __do_softirq+0x118/0x240 + [c0799e58] [c0039c44] irq_exit+0xc4/0xcc + [c0799e68] [c000ade8] timer_interrupt+0x1b0/0x230 + [c0799ea8] [c0013520] ret_from_except+0x0/0x14 + --- interrupt: 901 at arch_cpu_idle+0x24/0x6c + LR = arch_cpu_idle+0x24/0x6c + [c0799f70] [00000001] 0x1 (unreliable) + [c0799f80] [c0060990] do_idle+0xd8/0x17c + [c0799fa0] [c0060ba8] cpu_startup_entry+0x24/0x28 + [c0799fb0] [c072d220] start_kernel+0x434/0x44c + [c0799ff0] [00003860] 0x3860 + Instruction dump: + 8129f204 2f890000 40beff98 3d20c07a 8929eec4 2f890000 40beff88 0fe00000 + 81220000 552805de 550802ef 4182ff84 <0fe00000> 3860ffff 7f65db78 7f44d378 + ---[ end trace 34a886e47819c2eb ]--- + +Don't call on_each_cpu() from a timer callback, call it from a worker +thread instead. + +Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") +Tested-by: Stan Johnson +Signed-off-by: Finn Thain +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/bb61650bea4f4c91fb8e24b9a6f130a1438651a7.1599260540.git.fthain@telegraphics.com.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/tau_6xx.c | 38 +++++++++++++++++------------------ + 1 file changed, 18 insertions(+), 20 deletions(-) + +diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c +index 976d5bc1b5176..268205cc347da 100644 +--- a/arch/powerpc/kernel/tau_6xx.c ++++ b/arch/powerpc/kernel/tau_6xx.c +@@ -13,13 +13,14 @@ + */ + + #include +-#include + #include + #include + #include + #include + #include + #include ++#include ++#include + + #include + #include +@@ -39,8 +40,6 @@ static struct tau_temp + unsigned char grew; + } tau[NR_CPUS]; + +-struct timer_list tau_timer; +- + #undef DEBUG + + /* TODO: put these in a /proc interface, with some sanity checks, and maybe +@@ -50,7 +49,7 @@ struct timer_list tau_timer; + #define step_size 2 /* step size when temp goes out of range */ + #define window_expand 1 /* expand the window by this much */ + /* configurable values for shrinking the window */ +-#define shrink_timer 2*HZ /* period between shrinking the window */ ++#define shrink_timer 2000 /* period between shrinking the window */ + #define min_window 2 /* minimum window size, degrees C */ + + static void set_thresholds(unsigned long cpu) +@@ -187,14 +186,18 @@ static void tau_timeout(void * info) + local_irq_restore(flags); + } + +-static void tau_timeout_smp(struct timer_list *unused) +-{ ++static struct workqueue_struct *tau_workq; + +- /* schedule ourselves to be run again */ +- mod_timer(&tau_timer, jiffies + shrink_timer) ; ++static void tau_work_func(struct work_struct *work) ++{ ++ msleep(shrink_timer); + on_each_cpu(tau_timeout, NULL, 0); ++ /* schedule ourselves to be run again */ ++ queue_work(tau_workq, work); + } + ++DECLARE_WORK(tau_work, tau_work_func); ++ + /* + * setup the TAU + * +@@ -227,21 +230,16 @@ static int __init TAU_init(void) + return 1; + } + +- +- /* first, set up the window shrinking timer */ +- timer_setup(&tau_timer, tau_timeout_smp, 0); +- tau_timer.expires = jiffies + shrink_timer; +- add_timer(&tau_timer); ++ tau_workq = alloc_workqueue("tau", WQ_UNBOUND, 1, 0); ++ if (!tau_workq) ++ return -ENOMEM; + + on_each_cpu(TAU_init_smp, NULL, 0); + +- printk("Thermal assist unit "); +-#ifdef CONFIG_TAU_INT +- printk("using interrupts, "); +-#else +- printk("using timers, "); +-#endif +- printk("shrink_timer: %d jiffies\n", shrink_timer); ++ queue_work(tau_workq, &tau_work); ++ ++ pr_info("Thermal assist unit using %s, shrink_timer: %d ms\n", ++ IS_ENABLED(CONFIG_TAU_INT) ? "interrupts" : "workqueue", shrink_timer); + tau_initialized = 1; + + return 0; +-- +2.25.1 + diff --git a/queue-5.8/powerpc-tau-disable-tau-between-measurements.patch b/queue-5.8/powerpc-tau-disable-tau-between-measurements.patch new file mode 100644 index 00000000000..5c12efbf4b0 --- /dev/null +++ b/queue-5.8/powerpc-tau-disable-tau-between-measurements.patch @@ -0,0 +1,199 @@ +From b70724dc556329828a995167d45302461616151b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Sep 2020 09:02:20 +1000 +Subject: powerpc/tau: Disable TAU between measurements + +From: Finn Thain + +[ Upstream commit e63d6fb5637e92725cf143559672a34b706bca4f ] + +Enabling CONFIG_TAU_INT causes random crashes: + +Unrecoverable exception 1700 at c0009414 (msr=1000) +Oops: Unrecoverable exception, sig: 6 [#1] +BE PAGE_SIZE=4K MMU=Hash SMP NR_CPUS=2 PowerMac +Modules linked in: +CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.7.0-pmac-00043-gd5f545e1a8593 #5 +NIP: c0009414 LR: c0009414 CTR: c00116fc +REGS: c0799eb8 TRAP: 1700 Not tainted (5.7.0-pmac-00043-gd5f545e1a8593) +MSR: 00001000 CR: 22000228 XER: 00000100 + +GPR00: 00000000 c0799f70 c076e300 00800000 0291c0ac 00e00000 c076e300 00049032 +GPR08: 00000001 c00116fc 00000000 dfbd3200 ffffffff 007f80a8 00000000 00000000 +GPR16: 00000000 00000000 00000000 00000000 00000000 00000000 00000000 c075ce04 +GPR24: c075ce04 dfff8880 c07b0000 c075ce04 00080000 00000001 c079ef98 c079ef5c +NIP [c0009414] arch_cpu_idle+0x24/0x6c +LR [c0009414] arch_cpu_idle+0x24/0x6c +Call Trace: +[c0799f70] [00000001] 0x1 (unreliable) +[c0799f80] [c0060990] do_idle+0xd8/0x17c +[c0799fa0] [c0060ba4] cpu_startup_entry+0x20/0x28 +[c0799fb0] [c072d220] start_kernel+0x434/0x44c +[c0799ff0] [00003860] 0x3860 +Instruction dump: +XXXXXXXX XXXXXXXX XXXXXXXX 3d20c07b XXXXXXXX XXXXXXXX XXXXXXXX 7c0802a6 +XXXXXXXX XXXXXXXX XXXXXXXX 4e800421 XXXXXXXX XXXXXXXX XXXXXXXX 7d2000a6 +---[ end trace 3a0c9b5cb216db6b ]--- + +Resolve this problem by disabling each THRMn comparator when handling +the associated THRMn interrupt and by disabling the TAU entirely when +updating THRMn thresholds. + +Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") +Signed-off-by: Finn Thain +Tested-by: Stan Johnson +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/5a0ba3dc5612c7aac596727331284a3676c08472.1599260540.git.fthain@telegraphics.com.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/tau_6xx.c | 65 +++++++++++++--------------------- + arch/powerpc/platforms/Kconfig | 9 ++--- + 2 files changed, 26 insertions(+), 48 deletions(-) + +diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c +index 614b5b272d9c6..0b4694b8d2482 100644 +--- a/arch/powerpc/kernel/tau_6xx.c ++++ b/arch/powerpc/kernel/tau_6xx.c +@@ -42,8 +42,6 @@ static struct tau_temp + + static bool tau_int_enable; + +-#undef DEBUG +- + /* TODO: put these in a /proc interface, with some sanity checks, and maybe + * dynamic adjustment to minimize # of interrupts */ + /* configurable values for step size and how much to expand the window when +@@ -67,42 +65,33 @@ static void set_thresholds(unsigned long cpu) + + static void TAUupdate(int cpu) + { +- unsigned thrm; +- +-#ifdef DEBUG +- printk("TAUupdate "); +-#endif ++ u32 thrm; ++ u32 bits = THRM1_TIV | THRM1_TIN | THRM1_V; + + /* if both thresholds are crossed, the step_sizes cancel out + * and the window winds up getting expanded twice. */ +- if((thrm = mfspr(SPRN_THRM1)) & THRM1_TIV){ /* is valid? */ +- if(thrm & THRM1_TIN){ /* crossed low threshold */ +- if (tau[cpu].low >= step_size){ +- tau[cpu].low -= step_size; +- tau[cpu].high -= (step_size - window_expand); +- } +- tau[cpu].grew = 1; +-#ifdef DEBUG +- printk("low threshold crossed "); +-#endif ++ thrm = mfspr(SPRN_THRM1); ++ if ((thrm & bits) == bits) { ++ mtspr(SPRN_THRM1, 0); ++ ++ if (tau[cpu].low >= step_size) { ++ tau[cpu].low -= step_size; ++ tau[cpu].high -= (step_size - window_expand); + } ++ tau[cpu].grew = 1; ++ pr_debug("%s: low threshold crossed\n", __func__); + } +- if((thrm = mfspr(SPRN_THRM2)) & THRM1_TIV){ /* is valid? */ +- if(thrm & THRM1_TIN){ /* crossed high threshold */ +- if (tau[cpu].high <= 127-step_size){ +- tau[cpu].low += (step_size - window_expand); +- tau[cpu].high += step_size; +- } +- tau[cpu].grew = 1; +-#ifdef DEBUG +- printk("high threshold crossed "); +-#endif ++ thrm = mfspr(SPRN_THRM2); ++ if ((thrm & bits) == bits) { ++ mtspr(SPRN_THRM2, 0); ++ ++ if (tau[cpu].high <= 127 - step_size) { ++ tau[cpu].low += (step_size - window_expand); ++ tau[cpu].high += step_size; + } ++ tau[cpu].grew = 1; ++ pr_debug("%s: high threshold crossed\n", __func__); + } +- +-#ifdef DEBUG +- printk("grew = %d\n", tau[cpu].grew); +-#endif + } + + #ifdef CONFIG_TAU_INT +@@ -127,17 +116,17 @@ void TAUException(struct pt_regs * regs) + static void tau_timeout(void * info) + { + int cpu; +- unsigned long flags; + int size; + int shrink; + +- /* disabling interrupts *should* be okay */ +- local_irq_save(flags); + cpu = smp_processor_id(); + + if (!tau_int_enable) + TAUupdate(cpu); + ++ /* Stop thermal sensor comparisons and interrupts */ ++ mtspr(SPRN_THRM3, 0); ++ + size = tau[cpu].high - tau[cpu].low; + if (size > min_window && ! tau[cpu].grew) { + /* do an exponential shrink of half the amount currently over size */ +@@ -159,18 +148,12 @@ static void tau_timeout(void * info) + + set_thresholds(cpu); + +- /* +- * Do the enable every time, since otherwise a bunch of (relatively) +- * complex sleep code needs to be added. One mtspr every time +- * tau_timeout is called is probably not a big deal. +- * ++ /* Restart thermal sensor comparisons and interrupts. + * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet" + * recommends that "the maximum value be set in THRM3 under all + * conditions." + */ + mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E); +- +- local_irq_restore(flags); + } + + static struct workqueue_struct *tau_workq; +diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig +index 9fe36f0b54c1a..b439b027a42f1 100644 +--- a/arch/powerpc/platforms/Kconfig ++++ b/arch/powerpc/platforms/Kconfig +@@ -227,7 +227,7 @@ config TAU + don't assume the cpu temp is actually what /proc/cpuinfo says it is. + + config TAU_INT +- bool "Interrupt driven TAU driver (DANGEROUS)" ++ bool "Interrupt driven TAU driver (EXPERIMENTAL)" + depends on TAU + help + The TAU supports an interrupt driven mode which causes an interrupt +@@ -235,12 +235,7 @@ config TAU_INT + to get notified the temp has exceeded a range. With this option off, + a timer is used to re-check the temperature periodically. + +- However, on some cpus it appears that the TAU interrupt hardware +- is buggy and can cause a situation which would lead unexplained hard +- lockups. +- +- Unless you are extending the TAU driver, or enjoy kernel/hardware +- debugging, leave this option off. ++ If in doubt, say N here. + + config TAU_AVERAGE + bool "Average high and low temp" +-- +2.25.1 + diff --git a/queue-5.8/powerpc-tau-remove-duplicated-set_thresholds-call.patch b/queue-5.8/powerpc-tau-remove-duplicated-set_thresholds-call.patch new file mode 100644 index 00000000000..d2781adee4f --- /dev/null +++ b/queue-5.8/powerpc-tau-remove-duplicated-set_thresholds-call.patch @@ -0,0 +1,44 @@ +From 8f3ad1fdf6c8ae02e731ebd2d6a0c0e3ff92b37d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Sep 2020 09:02:20 +1000 +Subject: powerpc/tau: Remove duplicated set_thresholds() call + +From: Finn Thain + +[ Upstream commit 420ab2bc7544d978a5d0762ee736412fe9c796ab ] + +The commentary at the call site seems to disagree with the code. The +conditional prevents calling set_thresholds() via the exception handler, +which appears to crash. Perhaps that's because it immediately triggers +another TAU exception. Anyway, calling set_thresholds() from TAUupdate() +is redundant because tau_timeout() does so. + +Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") +Signed-off-by: Finn Thain +Tested-by: Stan Johnson +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/d7c7ee33232cf72a6a6bbb6ef05838b2e2b113c0.1599260540.git.fthain@telegraphics.com.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/tau_6xx.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c +index 268205cc347da..b8d7e7d498e0a 100644 +--- a/arch/powerpc/kernel/tau_6xx.c ++++ b/arch/powerpc/kernel/tau_6xx.c +@@ -110,11 +110,6 @@ static void TAUupdate(int cpu) + #ifdef DEBUG + printk("grew = %d\n", tau[cpu].grew); + #endif +- +-#ifndef CONFIG_TAU_INT /* tau_timeout will do this if not using interrupts */ +- set_thresholds(cpu); +-#endif +- + } + + #ifdef CONFIG_TAU_INT +-- +2.25.1 + diff --git a/queue-5.8/powerpc-tau-use-appropriate-temperature-sample-inter.patch b/queue-5.8/powerpc-tau-use-appropriate-temperature-sample-inter.patch new file mode 100644 index 00000000000..8d8d1b88596 --- /dev/null +++ b/queue-5.8/powerpc-tau-use-appropriate-temperature-sample-inter.patch @@ -0,0 +1,68 @@ +From 1b7472d8b9b14f8a589281a3e380af34964121ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Sep 2020 09:02:20 +1000 +Subject: powerpc/tau: Use appropriate temperature sample interval + +From: Finn Thain + +[ Upstream commit 66943005cc41f48e4d05614e8f76c0ca1812f0fd ] + +According to the MPC750 Users Manual, the SITV value in Thermal +Management Register 3 is 13 bits long. The present code calculates the +SITV value as 60 * 500 cycles. This would overflow to give 10 us on +a 500 MHz CPU rather than the intended 60 us. (But according to the +Microprocessor Datasheet, there is also a factor of 266 that has to be +applied to this value on certain parts i.e. speed sort above 266 MHz.) +Always use the maximum cycle count, as recommended by the Datasheet. + +Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") +Signed-off-by: Finn Thain +Tested-by: Stan Johnson +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/896f542e5f0f1d6cf8218524c2b67d79f3d69b3c.1599260540.git.fthain@telegraphics.com.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/reg.h | 2 +- + arch/powerpc/kernel/tau_6xx.c | 12 ++++-------- + 2 files changed, 5 insertions(+), 9 deletions(-) + +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h +index 88e6c78100d9b..c750afc62887c 100644 +--- a/arch/powerpc/include/asm/reg.h ++++ b/arch/powerpc/include/asm/reg.h +@@ -815,7 +815,7 @@ + #define THRM1_TIN (1 << 31) + #define THRM1_TIV (1 << 30) + #define THRM1_THRES(x) ((x&0x7f)<<23) +-#define THRM3_SITV(x) ((x&0x3fff)<<1) ++#define THRM3_SITV(x) ((x & 0x1fff) << 1) + #define THRM1_TID (1<<2) + #define THRM1_TIE (1<<1) + #define THRM1_V (1<<0) +diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c +index e2ab8a111b693..976d5bc1b5176 100644 +--- a/arch/powerpc/kernel/tau_6xx.c ++++ b/arch/powerpc/kernel/tau_6xx.c +@@ -178,15 +178,11 @@ static void tau_timeout(void * info) + * complex sleep code needs to be added. One mtspr every time + * tau_timeout is called is probably not a big deal. + * +- * Enable thermal sensor and set up sample interval timer +- * need 20 us to do the compare.. until a nice 'cpu_speed' function +- * call is implemented, just assume a 500 mhz clock. It doesn't really +- * matter if we take too long for a compare since it's all interrupt +- * driven anyway. +- * +- * use a extra long time.. (60 us @ 500 mhz) ++ * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet" ++ * recommends that "the maximum value be set in THRM3 under all ++ * conditions." + */ +- mtspr(SPRN_THRM3, THRM3_SITV(500*60) | THRM3_E); ++ mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E); + + local_irq_restore(flags); + } +-- +2.25.1 + diff --git a/queue-5.8/powerpc-watchpoint-add-hw_len-wherever-missing.patch b/queue-5.8/powerpc-watchpoint-add-hw_len-wherever-missing.patch new file mode 100644 index 00000000000..a233ec3ae82 --- /dev/null +++ b/queue-5.8/powerpc-watchpoint-add-hw_len-wherever-missing.patch @@ -0,0 +1,53 @@ +From c0657332a60a3dfe3fcc97a8baeecc5bfeb22c35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 09:59:43 +0530 +Subject: powerpc/watchpoint: Add hw_len wherever missing + +From: Ravi Bangoria + +[ Upstream commit 58da5984d2ea6d95f3f9d9e8dd9f7e1b0dddfb3c ] + +There are couple of places where we set len but not hw_len. For +ptrace/perf watchpoints, when CONFIG_HAVE_HW_BREAKPOINT=Y, hw_len +will be calculated and set internally while parsing watchpoint. +But when CONFIG_HAVE_HW_BREAKPOINT=N, we need to manually set +'hw_len'. Similarly for xmon as well, hw_len needs to be set +directly. + +Fixes: b57aeab811db ("powerpc/watchpoint: Fix length calculation for unaligned target") +Signed-off-by: Ravi Bangoria +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200902042945.129369-7-ravi.bangoria@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/ptrace/ptrace-noadv.c | 1 + + arch/powerpc/xmon/xmon.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/arch/powerpc/kernel/ptrace/ptrace-noadv.c b/arch/powerpc/kernel/ptrace/ptrace-noadv.c +index 697c7e4b5877f..8bd8d8de5c40b 100644 +--- a/arch/powerpc/kernel/ptrace/ptrace-noadv.c ++++ b/arch/powerpc/kernel/ptrace/ptrace-noadv.c +@@ -219,6 +219,7 @@ long ppc_set_hwdebug(struct task_struct *child, struct ppc_hw_breakpoint *bp_inf + brk.address = ALIGN_DOWN(bp_info->addr, HW_BREAKPOINT_SIZE); + brk.type = HW_BRK_TYPE_TRANSLATE; + brk.len = DABR_MAX_LEN; ++ brk.hw_len = DABR_MAX_LEN; + if (bp_info->trigger_type & PPC_BREAKPOINT_TRIGGER_READ) + brk.type |= HW_BRK_TYPE_READ; + if (bp_info->trigger_type & PPC_BREAKPOINT_TRIGGER_WRITE) +diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c +index 7efe4bc3ccf63..ac5862cee142a 100644 +--- a/arch/powerpc/xmon/xmon.c ++++ b/arch/powerpc/xmon/xmon.c +@@ -962,6 +962,7 @@ static void insert_cpu_bpts(void) + brk.address = dabr[i].address; + brk.type = (dabr[i].enabled & HW_BRK_TYPE_DABR) | HW_BRK_TYPE_PRIV_ALL; + brk.len = 8; ++ brk.hw_len = 8; + __set_breakpoint(i, &brk); + } + } +-- +2.25.1 + diff --git a/queue-5.8/powerpc-watchpoint-fix-handling-of-vector-instructio.patch b/queue-5.8/powerpc-watchpoint-fix-handling-of-vector-instructio.patch new file mode 100644 index 00000000000..a3b51107bba --- /dev/null +++ b/queue-5.8/powerpc-watchpoint-fix-handling-of-vector-instructio.patch @@ -0,0 +1,39 @@ +From 4daa00d0473cca303870e21283ec6a32571986a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 09:59:39 +0530 +Subject: powerpc/watchpoint: Fix handling of vector instructions + +From: Ravi Bangoria + +[ Upstream commit 4441eb02333a9b46a0d919aa7a6d3b137b5f2562 ] + +Vector load/store instructions are special because they are always +aligned. Thus unaligned EA needs to be aligned down before comparing +it with watch ranges. Otherwise we might consider valid event as +invalid. + +Fixes: 74c6881019b7 ("powerpc/watchpoint: Prepare handler to handle more than one watchpoint") +Signed-off-by: Ravi Bangoria +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200902042945.129369-3-ravi.bangoria@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/hw_breakpoint.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c +index f39e86d751144..2190be70c7fd9 100644 +--- a/arch/powerpc/kernel/hw_breakpoint.c ++++ b/arch/powerpc/kernel/hw_breakpoint.c +@@ -643,6 +643,8 @@ static void get_instr_detail(struct pt_regs *regs, struct ppc_inst *instr, + if (*type == CACHEOP) { + *size = cache_op_size(); + *ea &= ~(*size - 1); ++ } else if (*type == LOAD_VMX || *type == STORE_VMX) { ++ *ea &= ~(*size - 1); + } + } + +-- +2.25.1 + diff --git a/queue-5.8/powerpc-watchpoint-fix-quadword-instruction-handling.patch b/queue-5.8/powerpc-watchpoint-fix-quadword-instruction-handling.patch new file mode 100644 index 00000000000..39c16220204 --- /dev/null +++ b/queue-5.8/powerpc-watchpoint-fix-quadword-instruction-handling.patch @@ -0,0 +1,67 @@ +From e896e6ea4b0323a1ebb95e8e4361c01fc456d272 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 09:59:38 +0530 +Subject: powerpc/watchpoint: Fix quadword instruction handling on p10 + predecessors + +From: Ravi Bangoria + +[ Upstream commit 4759c11ed20454b7b36db4ec15f7d5aa1519af4a ] + +On p10 predecessors, watchpoint with quadword access is compared at +quadword length. If the watch range is doubleword or less than that +in a first half of quadword aligned 16 bytes, and if there is any +unaligned quadword access which will access only the 2nd half, the +handler should consider it as extraneous and emulate/single-step it +before continuing. + +Fixes: 74c6881019b7 ("powerpc/watchpoint: Prepare handler to handle more than one watchpoint") +Reported-by: Pedro Miraglia Franco de Carvalho +Signed-off-by: Ravi Bangoria +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200902042945.129369-2-ravi.bangoria@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/hw_breakpoint.h | 1 + + arch/powerpc/kernel/hw_breakpoint.c | 12 ++++++++++-- + 2 files changed, 11 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/include/asm/hw_breakpoint.h b/arch/powerpc/include/asm/hw_breakpoint.h +index cb424799da0dc..5a00da670a407 100644 +--- a/arch/powerpc/include/asm/hw_breakpoint.h ++++ b/arch/powerpc/include/asm/hw_breakpoint.h +@@ -40,6 +40,7 @@ struct arch_hw_breakpoint { + #else + #define HW_BREAKPOINT_SIZE 0x8 + #endif ++#define HW_BREAKPOINT_SIZE_QUADWORD 0x10 + + #define DABR_MAX_LEN 8 + #define DAWR_MAX_LEN 512 +diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c +index c55e67bab2710..f39e86d751144 100644 +--- a/arch/powerpc/kernel/hw_breakpoint.c ++++ b/arch/powerpc/kernel/hw_breakpoint.c +@@ -519,9 +519,17 @@ static bool ea_hw_range_overlaps(unsigned long ea, int size, + struct arch_hw_breakpoint *info) + { + unsigned long hw_start_addr, hw_end_addr; ++ unsigned long align_size = HW_BREAKPOINT_SIZE; + +- hw_start_addr = ALIGN_DOWN(info->address, HW_BREAKPOINT_SIZE); +- hw_end_addr = ALIGN(info->address + info->len, HW_BREAKPOINT_SIZE); ++ /* ++ * On p10 predecessors, quadword is handle differently then ++ * other instructions. ++ */ ++ if (!cpu_has_feature(CPU_FTR_ARCH_31) && size == 16) ++ align_size = HW_BREAKPOINT_SIZE_QUADWORD; ++ ++ hw_start_addr = ALIGN_DOWN(info->address, align_size); ++ hw_end_addr = ALIGN(info->address + info->len, align_size); + + return ((ea < hw_end_addr) && (ea + size > hw_start_addr)); + } +-- +2.25.1 + diff --git a/queue-5.8/pseries-drmem-don-t-cache-node-id-in-drmem_lmb-struc.patch b/queue-5.8/pseries-drmem-don-t-cache-node-id-in-drmem_lmb-struc.patch new file mode 100644 index 00000000000..77cca520af6 --- /dev/null +++ b/queue-5.8/pseries-drmem-don-t-cache-node-id-in-drmem_lmb-struc.patch @@ -0,0 +1,210 @@ +From b1ef9a41a09fca93187cd2a8fb717a970af59eb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 20:51:15 -0500 +Subject: pseries/drmem: don't cache node id in drmem_lmb struct + +From: Scott Cheloha + +[ Upstream commit e5e179aa3a39c818db8fbc2dce8d2cd24adaf657 ] + +At memory hot-remove time we can retrieve an LMB's nid from its +corresponding memory_block. There is no need to store the nid +in multiple locations. + +Note that lmb_to_memblock() uses find_memory_block() to get the +corresponding memory_block. As find_memory_block() runs in sub-linear +time this approach is negligibly slower than what we do at present. + +In exchange for this lookup at hot-remove time we no longer need to +call memory_add_physaddr_to_nid() during drmem_init() for each LMB. +On powerpc, memory_add_physaddr_to_nid() is a linear search, so this +spares us an O(n^2) initialization during boot. + +On systems with many LMBs that initialization overhead is palpable and +disruptive. For example, on a box with 249854 LMBs we're seeing +drmem_init() take upwards of 30 seconds to complete: + +[ 53.721639] drmem: initializing drmem v2 +[ 80.604346] watchdog: BUG: soft lockup - CPU#65 stuck for 23s! [swapper/0:1] +[ 80.604377] Modules linked in: +[ 80.604389] CPU: 65 PID: 1 Comm: swapper/0 Not tainted 5.6.0-rc2+ #4 +[ 80.604397] NIP: c0000000000a4980 LR: c0000000000a4940 CTR: 0000000000000000 +[ 80.604407] REGS: c0002dbff8493830 TRAP: 0901 Not tainted (5.6.0-rc2+) +[ 80.604412] MSR: 8000000002009033 CR: 44000248 XER: 0000000d +[ 80.604431] CFAR: c0000000000a4a38 IRQMASK: 0 +[ 80.604431] GPR00: c0000000000a4940 c0002dbff8493ac0 c000000001904400 c0003cfffffede30 +[ 80.604431] GPR04: 0000000000000000 c000000000f4095a 000000000000002f 0000000010000000 +[ 80.604431] GPR08: c0000bf7ecdb7fb8 c0000bf7ecc2d3c8 0000000000000008 c00c0002fdfb2001 +[ 80.604431] GPR12: 0000000000000000 c00000001e8ec200 +[ 80.604477] NIP [c0000000000a4980] hot_add_scn_to_nid+0xa0/0x3e0 +[ 80.604486] LR [c0000000000a4940] hot_add_scn_to_nid+0x60/0x3e0 +[ 80.604492] Call Trace: +[ 80.604498] [c0002dbff8493ac0] [c0000000000a4940] hot_add_scn_to_nid+0x60/0x3e0 (unreliable) +[ 80.604509] [c0002dbff8493b20] [c000000000087c10] memory_add_physaddr_to_nid+0x20/0x60 +[ 80.604521] [c0002dbff8493b40] [c0000000010d4880] drmem_init+0x25c/0x2f0 +[ 80.604530] [c0002dbff8493c10] [c000000000010154] do_one_initcall+0x64/0x2c0 +[ 80.604540] [c0002dbff8493ce0] [c0000000010c4aa0] kernel_init_freeable+0x2d8/0x3a0 +[ 80.604550] [c0002dbff8493db0] [c000000000010824] kernel_init+0x2c/0x148 +[ 80.604560] [c0002dbff8493e20] [c00000000000b648] ret_from_kernel_thread+0x5c/0x74 +[ 80.604567] Instruction dump: +[ 80.604574] 392918e8 e9490000 e90a000a e92a0000 80ea000c 1d080018 3908ffe8 7d094214 +[ 80.604586] 7fa94040 419d00dc e9490010 714a0088 <2faa0008> 409e00ac e9490000 7fbe5040 +[ 89.047390] drmem: 249854 LMB(s) + +With a patched kernel on the same machine we're no longer seeing the +soft lockup. drmem_init() now completes in negligible time, even when +the LMB count is large. + +Fixes: b2d3b5ee66f2 ("powerpc/pseries: Track LMB nid instead of using device tree") +Signed-off-by: Scott Cheloha +Reviewed-by: Nathan Lynch +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200811015115.63677-1-cheloha@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/drmem.h | 21 ---------------- + arch/powerpc/mm/drmem.c | 6 +---- + .../platforms/pseries/hotplug-memory.c | 24 ++++++++++++------- + 3 files changed, 17 insertions(+), 34 deletions(-) + +diff --git a/arch/powerpc/include/asm/drmem.h b/arch/powerpc/include/asm/drmem.h +index 1ec6de1a88514..c711fe8901109 100644 +--- a/arch/powerpc/include/asm/drmem.h ++++ b/arch/powerpc/include/asm/drmem.h +@@ -15,9 +15,6 @@ struct drmem_lmb { + u32 drc_index; + u32 aa_index; + u32 flags; +-#ifdef CONFIG_MEMORY_HOTPLUG +- int nid; +-#endif + }; + + struct drmem_lmb_info { +@@ -120,22 +117,4 @@ static inline void invalidate_lmb_associativity_index(struct drmem_lmb *lmb) + lmb->aa_index = 0xffffffff; + } + +-#ifdef CONFIG_MEMORY_HOTPLUG +-static inline void lmb_set_nid(struct drmem_lmb *lmb) +-{ +- lmb->nid = memory_add_physaddr_to_nid(lmb->base_addr); +-} +-static inline void lmb_clear_nid(struct drmem_lmb *lmb) +-{ +- lmb->nid = -1; +-} +-#else +-static inline void lmb_set_nid(struct drmem_lmb *lmb) +-{ +-} +-static inline void lmb_clear_nid(struct drmem_lmb *lmb) +-{ +-} +-#endif +- + #endif /* _ASM_POWERPC_LMB_H */ +diff --git a/arch/powerpc/mm/drmem.c b/arch/powerpc/mm/drmem.c +index 59327cefbc6a6..873fcfc7b8756 100644 +--- a/arch/powerpc/mm/drmem.c ++++ b/arch/powerpc/mm/drmem.c +@@ -362,10 +362,8 @@ static void __init init_drmem_v1_lmbs(const __be32 *prop) + if (!drmem_info->lmbs) + return; + +- for_each_drmem_lmb(lmb) { ++ for_each_drmem_lmb(lmb) + read_drconf_v1_cell(lmb, &prop); +- lmb_set_nid(lmb); +- } + } + + static void __init init_drmem_v2_lmbs(const __be32 *prop) +@@ -410,8 +408,6 @@ static void __init init_drmem_v2_lmbs(const __be32 *prop) + + lmb->aa_index = dr_cell.aa_index; + lmb->flags = dr_cell.flags; +- +- lmb_set_nid(lmb); + } + } + } +diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c +index 8b748690dac22..9f236149b4027 100644 +--- a/arch/powerpc/platforms/pseries/hotplug-memory.c ++++ b/arch/powerpc/platforms/pseries/hotplug-memory.c +@@ -356,25 +356,32 @@ static int dlpar_add_lmb(struct drmem_lmb *); + + static int dlpar_remove_lmb(struct drmem_lmb *lmb) + { ++ struct memory_block *mem_block; + unsigned long block_sz; + int rc; + + if (!lmb_is_removable(lmb)) + return -EINVAL; + ++ mem_block = lmb_to_memblock(lmb); ++ if (mem_block == NULL) ++ return -EINVAL; ++ + rc = dlpar_offline_lmb(lmb); +- if (rc) ++ if (rc) { ++ put_device(&mem_block->dev); + return rc; ++ } + + block_sz = pseries_memory_block_size(); + +- __remove_memory(lmb->nid, lmb->base_addr, block_sz); ++ __remove_memory(mem_block->nid, lmb->base_addr, block_sz); ++ put_device(&mem_block->dev); + + /* Update memory regions for memory remove */ + memblock_remove(lmb->base_addr, block_sz); + + invalidate_lmb_associativity_index(lmb); +- lmb_clear_nid(lmb); + lmb->flags &= ~DRCONF_MEM_ASSIGNED; + + return 0; +@@ -631,7 +638,7 @@ static int dlpar_memory_remove_by_ic(u32 lmbs_to_remove, u32 drc_index) + static int dlpar_add_lmb(struct drmem_lmb *lmb) + { + unsigned long block_sz; +- int rc; ++ int nid, rc; + + if (lmb->flags & DRCONF_MEM_ASSIGNED) + return -EINVAL; +@@ -642,11 +649,13 @@ static int dlpar_add_lmb(struct drmem_lmb *lmb) + return rc; + } + +- lmb_set_nid(lmb); + block_sz = memory_block_size_bytes(); + ++ /* Find the node id for this address. */ ++ nid = memory_add_physaddr_to_nid(lmb->base_addr); ++ + /* Add the memory */ +- rc = __add_memory(lmb->nid, lmb->base_addr, block_sz); ++ rc = __add_memory(nid, lmb->base_addr, block_sz); + if (rc) { + invalidate_lmb_associativity_index(lmb); + return rc; +@@ -654,9 +663,8 @@ static int dlpar_add_lmb(struct drmem_lmb *lmb) + + rc = dlpar_online_lmb(lmb); + if (rc) { +- __remove_memory(lmb->nid, lmb->base_addr, block_sz); ++ __remove_memory(nid, lmb->base_addr, block_sz); + invalidate_lmb_associativity_index(lmb); +- lmb_clear_nid(lmb); + } else { + lmb->flags |= DRCONF_MEM_ASSIGNED; + } +-- +2.25.1 + diff --git a/queue-5.8/pty-do-tty_flip_buffer_push-without-port-lock-in-pty.patch b/queue-5.8/pty-do-tty_flip_buffer_push-without-port-lock-in-pty.patch new file mode 100644 index 00000000000..c2785f9643e --- /dev/null +++ b/queue-5.8/pty-do-tty_flip_buffer_push-without-port-lock-in-pty.patch @@ -0,0 +1,140 @@ +From a403302984922e19d550f222a1e2363373026045 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 14:00:45 +0200 +Subject: pty: do tty_flip_buffer_push without port->lock in pty_write + +From: Artem Savkov + +[ Upstream commit 71a174b39f10b4b93223d374722aa894b5d8a82e ] + +b6da31b2c07c "tty: Fix data race in tty_insert_flip_string_fixed_flag" +puts tty_flip_buffer_push under port->lock introducing the following +possible circular locking dependency: + +[30129.876566] ====================================================== +[30129.876566] WARNING: possible circular locking dependency detected +[30129.876567] 5.9.0-rc2+ #3 Tainted: G S W +[30129.876568] ------------------------------------------------------ +[30129.876568] sysrq.sh/1222 is trying to acquire lock: +[30129.876569] ffffffff92c39480 (console_owner){....}-{0:0}, at: console_unlock+0x3fe/0xa90 + +[30129.876572] but task is already holding lock: +[30129.876572] ffff888107cb9018 (&pool->lock/1){-.-.}-{2:2}, at: show_workqueue_state.cold.55+0x15b/0x6ca + +[30129.876576] which lock already depends on the new lock. + +[30129.876577] the existing dependency chain (in reverse order) is: + +[30129.876578] -> #3 (&pool->lock/1){-.-.}-{2:2}: +[30129.876581] _raw_spin_lock+0x30/0x70 +[30129.876581] __queue_work+0x1a3/0x10f0 +[30129.876582] queue_work_on+0x78/0x80 +[30129.876582] pty_write+0x165/0x1e0 +[30129.876583] n_tty_write+0x47f/0xf00 +[30129.876583] tty_write+0x3d6/0x8d0 +[30129.876584] vfs_write+0x1a8/0x650 + +[30129.876588] -> #2 (&port->lock#2){-.-.}-{2:2}: +[30129.876590] _raw_spin_lock_irqsave+0x3b/0x80 +[30129.876591] tty_port_tty_get+0x1d/0xb0 +[30129.876592] tty_port_default_wakeup+0xb/0x30 +[30129.876592] serial8250_tx_chars+0x3d6/0x970 +[30129.876593] serial8250_handle_irq.part.12+0x216/0x380 +[30129.876593] serial8250_default_handle_irq+0x82/0xe0 +[30129.876594] serial8250_interrupt+0xdd/0x1b0 +[30129.876595] __handle_irq_event_percpu+0xfc/0x850 + +[30129.876602] -> #1 (&port->lock){-.-.}-{2:2}: +[30129.876605] _raw_spin_lock_irqsave+0x3b/0x80 +[30129.876605] serial8250_console_write+0x12d/0x900 +[30129.876606] console_unlock+0x679/0xa90 +[30129.876606] register_console+0x371/0x6e0 +[30129.876607] univ8250_console_init+0x24/0x27 +[30129.876607] console_init+0x2f9/0x45e + +[30129.876609] -> #0 (console_owner){....}-{0:0}: +[30129.876611] __lock_acquire+0x2f70/0x4e90 +[30129.876612] lock_acquire+0x1ac/0xad0 +[30129.876612] console_unlock+0x460/0xa90 +[30129.876613] vprintk_emit+0x130/0x420 +[30129.876613] printk+0x9f/0xc5 +[30129.876614] show_pwq+0x154/0x618 +[30129.876615] show_workqueue_state.cold.55+0x193/0x6ca +[30129.876615] __handle_sysrq+0x244/0x460 +[30129.876616] write_sysrq_trigger+0x48/0x4a +[30129.876616] proc_reg_write+0x1a6/0x240 +[30129.876617] vfs_write+0x1a8/0x650 + +[30129.876619] other info that might help us debug this: + +[30129.876620] Chain exists of: +[30129.876621] console_owner --> &port->lock#2 --> &pool->lock/1 + +[30129.876625] Possible unsafe locking scenario: + +[30129.876626] CPU0 CPU1 +[30129.876626] ---- ---- +[30129.876627] lock(&pool->lock/1); +[30129.876628] lock(&port->lock#2); +[30129.876630] lock(&pool->lock/1); +[30129.876631] lock(console_owner); + +[30129.876633] *** DEADLOCK *** + +[30129.876634] 5 locks held by sysrq.sh/1222: +[30129.876634] #0: ffff8881d3ce0470 (sb_writers#3){.+.+}-{0:0}, at: vfs_write+0x359/0x650 +[30129.876637] #1: ffffffff92c612c0 (rcu_read_lock){....}-{1:2}, at: __handle_sysrq+0x4d/0x460 +[30129.876640] #2: ffffffff92c612c0 (rcu_read_lock){....}-{1:2}, at: show_workqueue_state+0x5/0xf0 +[30129.876642] #3: ffff888107cb9018 (&pool->lock/1){-.-.}-{2:2}, at: show_workqueue_state.cold.55+0x15b/0x6ca +[30129.876645] #4: ffffffff92c39980 (console_lock){+.+.}-{0:0}, at: vprintk_emit+0x123/0x420 + +[30129.876648] stack backtrace: +[30129.876649] CPU: 3 PID: 1222 Comm: sysrq.sh Tainted: G S W 5.9.0-rc2+ #3 +[30129.876649] Hardware name: Intel Corporation 2012 Client Platform/Emerald Lake 2, BIOS ACRVMBY1.86C.0078.P00.1201161002 01/16/2012 +[30129.876650] Call Trace: +[30129.876650] dump_stack+0x9d/0xe0 +[30129.876651] check_noncircular+0x34f/0x410 +[30129.876653] __lock_acquire+0x2f70/0x4e90 +[30129.876656] lock_acquire+0x1ac/0xad0 +[30129.876658] console_unlock+0x460/0xa90 +[30129.876660] vprintk_emit+0x130/0x420 +[30129.876660] printk+0x9f/0xc5 +[30129.876661] show_pwq+0x154/0x618 +[30129.876662] show_workqueue_state.cold.55+0x193/0x6ca +[30129.876664] __handle_sysrq+0x244/0x460 +[30129.876665] write_sysrq_trigger+0x48/0x4a +[30129.876665] proc_reg_write+0x1a6/0x240 +[30129.876666] vfs_write+0x1a8/0x650 + +It looks like the commit was aimed to protect tty_insert_flip_string and +there is no need for tty_flip_buffer_push to be under this lock. + +Fixes: b6da31b2c07c ("tty: Fix data race in tty_insert_flip_string_fixed_flag") +Signed-off-by: Artem Savkov +Acked-by: Jiri Slaby +Link: https://lore.kernel.org/r/20200902120045.3693075-1-asavkov@redhat.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/pty.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c +index 00099a8439d21..c6a1d8c4e6894 100644 +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -120,10 +120,10 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) + spin_lock_irqsave(&to->port->lock, flags); + /* Stuff the data into the input queue of the other end */ + c = tty_insert_flip_string(to->port, buf, c); ++ spin_unlock_irqrestore(&to->port->lock, flags); + /* And shovel */ + if (c) + tty_flip_buffer_push(to->port); +- spin_unlock_irqrestore(&to->port->lock, flags); + } + return c; + } +-- +2.25.1 + diff --git a/queue-5.8/pwm-img-fix-null-pointer-access-in-probe.patch b/queue-5.8/pwm-img-fix-null-pointer-access-in-probe.patch new file mode 100644 index 00000000000..f6ac2bd4897 --- /dev/null +++ b/queue-5.8/pwm-img-fix-null-pointer-access-in-probe.patch @@ -0,0 +1,53 @@ +From 931f7336c350fe83b59698721fc8f963eecee255 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 19:14:25 +0200 +Subject: pwm: img: Fix null pointer access in probe + +From: Hauke Mehrtens + +[ Upstream commit b39c0615d0667b3a6f2f5c4bf99ffadf3b518bb1 ] + +dev_get_drvdata() is called in img_pwm_runtime_resume() before the +driver data is set. +When pm_runtime_enabled() returns false in img_pwm_probe() it calls +img_pwm_runtime_resume() which results in a null pointer access. + +This patch fixes the problem by setting the driver data earlier in the +img_pwm_probe() function. + +This crash was seen when booting the Imagination Technologies Creator +Ci40 (Marduk) with kernel 5.4 in OpenWrt. + +Fixes: e690ae526216 ("pwm: img: Add runtime PM") +Signed-off-by: Hauke Mehrtens +Acked-by: Lee Jones +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-img.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pwm/pwm-img.c b/drivers/pwm/pwm-img.c +index 599a0f66a3845..a34d95ed70b20 100644 +--- a/drivers/pwm/pwm-img.c ++++ b/drivers/pwm/pwm-img.c +@@ -277,6 +277,8 @@ static int img_pwm_probe(struct platform_device *pdev) + return PTR_ERR(pwm->pwm_clk); + } + ++ platform_set_drvdata(pdev, pwm); ++ + pm_runtime_set_autosuspend_delay(&pdev->dev, IMG_PWM_PM_TIMEOUT); + pm_runtime_use_autosuspend(&pdev->dev); + pm_runtime_enable(&pdev->dev); +@@ -313,7 +315,6 @@ static int img_pwm_probe(struct platform_device *pdev) + goto err_suspend; + } + +- platform_set_drvdata(pdev, pwm); + return 0; + + err_suspend: +-- +2.25.1 + diff --git a/queue-5.8/pwm-lpss-add-range-limit-check-for-the-base_unit-reg.patch b/queue-5.8/pwm-lpss-add-range-limit-check-for-the-base_unit-reg.patch new file mode 100644 index 00000000000..bfcfa5f5930 --- /dev/null +++ b/queue-5.8/pwm-lpss-add-range-limit-check-for-the-base_unit-reg.patch @@ -0,0 +1,68 @@ +From 3e5a2aeac9159c406dc9da47878b1b9167952197 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 13:23:24 +0200 +Subject: pwm: lpss: Add range limit check for the base_unit register value + +From: Hans de Goede + +[ Upstream commit ef9f60daab309558c8bb3e086a9a11ee40bd6061 ] + +When the user requests a high enough period ns value, then the +calculations in pwm_lpss_prepare() might result in a base_unit value of 0. + +But according to the data-sheet the way the PWM controller works is that +each input clock-cycle the base_unit gets added to a N bit counter and +that counter overflowing determines the PWM output frequency. Adding 0 +to the counter is a no-op. The data-sheet even explicitly states that +writing 0 to the base_unit bits will result in the PWM outputting a +continuous 0 signal. + +When the user requestes a low enough period ns value, then the +calculations in pwm_lpss_prepare() might result in a base_unit value +which is bigger then base_unit_range - 1. Currently the codes for this +deals with this by applying a mask: + + base_unit &= (base_unit_range - 1); + +But this means that we let the value overflow the range, we throw away the +higher bits and store whatever value is left in the lower bits into the +register leading to a random output frequency, rather then clamping the +output frequency to the highest frequency which the hardware can do. + +This commit fixes both issues by clamping the base_unit value to be +between 1 and (base_unit_range - 1). + +Fixes: 684309e5043e ("pwm: lpss: Avoid potential overflow of base_unit") +Reviewed-by: Andy Shevchenko +Acked-by: Thierry Reding +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20200903112337.4113-5-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-lpss.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c +index 43b1fc634af1a..da9bc3d10104a 100644 +--- a/drivers/pwm/pwm-lpss.c ++++ b/drivers/pwm/pwm-lpss.c +@@ -97,6 +97,8 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm, + freq *= base_unit_range; + + base_unit = DIV_ROUND_CLOSEST_ULL(freq, c); ++ /* base_unit must not be 0 and we also want to avoid overflowing it */ ++ base_unit = clamp_val(base_unit, 1, base_unit_range - 1); + + on_time_div = 255ULL * duty_ns; + do_div(on_time_div, period_ns); +@@ -105,7 +107,6 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm, + orig_ctrl = ctrl = pwm_lpss_read(pwm); + ctrl &= ~PWM_ON_TIME_DIV_MASK; + ctrl &= ~((base_unit_range - 1) << PWM_BASE_UNIT_SHIFT); +- base_unit &= (base_unit_range - 1); + ctrl |= (u32) base_unit << PWM_BASE_UNIT_SHIFT; + ctrl |= on_time_div; + +-- +2.25.1 + diff --git a/queue-5.8/pwm-lpss-fix-off-by-one-error-in-base_unit-math-in-p.patch b/queue-5.8/pwm-lpss-fix-off-by-one-error-in-base_unit-math-in-p.patch new file mode 100644 index 00000000000..2d3ed312014 --- /dev/null +++ b/queue-5.8/pwm-lpss-fix-off-by-one-error-in-base_unit-math-in-p.patch @@ -0,0 +1,68 @@ +From 6604ada48e8147e4f85e85224682eab2b807cd29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 13:23:23 +0200 +Subject: pwm: lpss: Fix off by one error in base_unit math in + pwm_lpss_prepare() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Hans de Goede + +[ Upstream commit 181f4d2f44463fe09fe4df02e03095cb87151c29 ] + +According to the data-sheet the way the PWM controller works is that +each input clock-cycle the base_unit gets added to a N bit counter and +that counter overflowing determines the PWM output frequency. + +So assuming e.g. a 16 bit counter this means that if base_unit is set to 1, +after 65535 input clock-cycles the counter has been increased from 0 to +65535 and it will overflow on the next cycle, so it will overflow after +every 65536 clock cycles and thus the calculations done in +pwm_lpss_prepare() should use 65536 and not 65535. + +This commit fixes this. Note this also aligns the calculations in +pwm_lpss_prepare() with those in pwm_lpss_get_state(). + +Note this effectively reverts commit 684309e5043e ("pwm: lpss: Avoid +potential overflow of base_unit"). The next patch in this series really +fixes the potential overflow of the base_unit value. + +Fixes: 684309e5043e ("pwm: lpss: Avoid potential overflow of base_unit") +Reviewed-by: Andy Shevchenko +Acked-by: Uwe Kleine-König +Acked-by: Thierry Reding +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20200903112337.4113-4-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-lpss.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c +index 9d965ffe66d1e..43b1fc634af1a 100644 +--- a/drivers/pwm/pwm-lpss.c ++++ b/drivers/pwm/pwm-lpss.c +@@ -93,7 +93,7 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm, + * The equation is: + * base_unit = round(base_unit_range * freq / c) + */ +- base_unit_range = BIT(lpwm->info->base_unit_bits) - 1; ++ base_unit_range = BIT(lpwm->info->base_unit_bits); + freq *= base_unit_range; + + base_unit = DIV_ROUND_CLOSEST_ULL(freq, c); +@@ -104,8 +104,8 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm, + + orig_ctrl = ctrl = pwm_lpss_read(pwm); + ctrl &= ~PWM_ON_TIME_DIV_MASK; +- ctrl &= ~(base_unit_range << PWM_BASE_UNIT_SHIFT); +- base_unit &= base_unit_range; ++ ctrl &= ~((base_unit_range - 1) << PWM_BASE_UNIT_SHIFT); ++ base_unit &= (base_unit_range - 1); + ctrl |= (u32) base_unit << PWM_BASE_UNIT_SHIFT; + ctrl |= on_time_div; + +-- +2.25.1 + diff --git a/queue-5.8/pwm-rockchip-keep-enabled-pwms-running-while-probing.patch b/queue-5.8/pwm-rockchip-keep-enabled-pwms-running-while-probing.patch new file mode 100644 index 00000000000..9cacf37349c --- /dev/null +++ b/queue-5.8/pwm-rockchip-keep-enabled-pwms-running-while-probing.patch @@ -0,0 +1,60 @@ +From 0a6286cd9ce2e4dcd40fc904e2472a535f315d16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Sep 2020 15:33:06 -0400 +Subject: pwm: rockchip: Keep enabled PWMs running while probing +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Simon South + +[ Upstream commit 457f74abbed060a0395f75ab5297f2d76cada516 ] + +Following commit cfc4c189bc70 ("pwm: Read initial hardware state at +request time") the Rockchip PWM driver can no longer assume a device's +pwm_state structure has been populated after a call to pwmchip_add(). +Consequently, the test in rockchip_pwm_probe() intended to prevent the +driver from stopping PWM devices already enabled by the bootloader no +longer functions reliably and this can lead to the kernel hanging +during startup, particularly on devices like the Pinebook Pro that use +a PWM-controlled backlight for their display. + +Avoid this by querying the device directly at probe time to determine +whether or not it is enabled. + +Fixes: cfc4c189bc70 ("pwm: Read initial hardware state at request time") +Signed-off-by: Simon South +Reviewed-by: Uwe Kleine-König +Reviewed-by: Heiko Stuebner +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-rockchip.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/pwm/pwm-rockchip.c b/drivers/pwm/pwm-rockchip.c +index eb8c9cb645a6c..098e94335cb5b 100644 +--- a/drivers/pwm/pwm-rockchip.c ++++ b/drivers/pwm/pwm-rockchip.c +@@ -288,6 +288,7 @@ static int rockchip_pwm_probe(struct platform_device *pdev) + const struct of_device_id *id; + struct rockchip_pwm_chip *pc; + struct resource *r; ++ u32 enable_conf, ctrl; + int ret, count; + + id = of_match_device(rockchip_pwm_dt_ids, &pdev->dev); +@@ -362,7 +363,9 @@ static int rockchip_pwm_probe(struct platform_device *pdev) + } + + /* Keep the PWM clk enabled if the PWM appears to be up and running. */ +- if (!pwm_is_enabled(pc->chip.pwms)) ++ enable_conf = pc->data->enable_conf; ++ ctrl = readl_relaxed(pc->base + pc->data->regs.ctrl); ++ if ((ctrl & enable_conf) != enable_conf) + clk_disable(pc->clk); + + return 0; +-- +2.25.1 + diff --git a/queue-5.8/qtnfmac-fix-resource-leaks-on-unsupported-iftype-err.patch b/queue-5.8/qtnfmac-fix-resource-leaks-on-unsupported-iftype-err.patch new file mode 100644 index 00000000000..ea6d69a10d2 --- /dev/null +++ b/queue-5.8/qtnfmac-fix-resource-leaks-on-unsupported-iftype-err.patch @@ -0,0 +1,46 @@ +From ae62760626b5d7cbee6e2b1295e97da55167adba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 14:22:24 +0100 +Subject: qtnfmac: fix resource leaks on unsupported iftype error return path + +From: Colin Ian King + +[ Upstream commit 63f6982075d890d7563e2469643f05a37d193f01 ] + +Currently if an unsupported iftype is detected the error return path +does not free the cmd_skb leading to a resource leak. Fix this by +free'ing cmd_skb. + +Addresses-Coverity: ("Resource leak") +Fixes: 805b28c05c8e ("qtnfmac: prepare for AP_VLAN interface type support") +Signed-off-by: Colin Ian King +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200925132224.21638-1-colin.king@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/quantenna/qtnfmac/commands.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c +index f40d8c3c3d9e5..f3ccbd2b10847 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c +@@ -869,6 +869,7 @@ int qtnf_cmd_send_del_intf(struct qtnf_vif *vif) + default: + pr_warn("VIF%u.%u: unsupported iftype %d\n", vif->mac->macid, + vif->vifid, vif->wdev.iftype); ++ dev_kfree_skb(cmd_skb); + ret = -EINVAL; + goto out; + } +@@ -1924,6 +1925,7 @@ int qtnf_cmd_send_change_sta(struct qtnf_vif *vif, const u8 *mac, + break; + default: + pr_err("unsupported iftype %d\n", vif->wdev.iftype); ++ dev_kfree_skb(cmd_skb); + ret = -EINVAL; + goto out; + } +-- +2.25.1 + diff --git a/queue-5.8/quota-clear-padding-in-v2r1_mem2diskdqb.patch b/queue-5.8/quota-clear-padding-in-v2r1_mem2diskdqb.patch new file mode 100644 index 00000000000..1929dcb1697 --- /dev/null +++ b/queue-5.8/quota-clear-padding-in-v2r1_mem2diskdqb.patch @@ -0,0 +1,114 @@ +From 2e88c457423de9258d6a7a02cf57f6df515e420c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 11:36:19 -0700 +Subject: quota: clear padding in v2r1_mem2diskdqb() + +From: Eric Dumazet + +[ Upstream commit 3d3dc274ce736227e3197868ff749cff2f175f63 ] + +Freshly allocated memory contains garbage, better make sure +to init all struct v2r1_disk_dqblk fields to avoid KMSAN report: + +BUG: KMSAN: uninit-value in qtree_entry_unused+0x137/0x1b0 fs/quota/quota_tree.c:218 +CPU: 0 PID: 23373 Comm: syz-executor.1 Not tainted 5.9.0-rc4-syzkaller #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0x21c/0x280 lib/dump_stack.c:118 + kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:122 + __msan_warning+0x58/0xa0 mm/kmsan/kmsan_instr.c:219 + qtree_entry_unused+0x137/0x1b0 fs/quota/quota_tree.c:218 + v2r1_mem2diskdqb+0x43d/0x710 fs/quota/quota_v2.c:285 + qtree_write_dquot+0x226/0x870 fs/quota/quota_tree.c:394 + v2_write_dquot+0x1ad/0x280 fs/quota/quota_v2.c:333 + dquot_commit+0x4af/0x600 fs/quota/dquot.c:482 + ext4_write_dquot fs/ext4/super.c:5934 [inline] + ext4_mark_dquot_dirty+0x4d8/0x6a0 fs/ext4/super.c:5985 + mark_dquot_dirty fs/quota/dquot.c:347 [inline] + mark_all_dquot_dirty fs/quota/dquot.c:385 [inline] + dquot_alloc_inode+0xc05/0x12b0 fs/quota/dquot.c:1755 + __ext4_new_inode+0x8204/0x9d70 fs/ext4/ialloc.c:1155 + ext4_tmpfile+0x41a/0x850 fs/ext4/namei.c:2686 + vfs_tmpfile+0x2a2/0x570 fs/namei.c:3283 + do_tmpfile fs/namei.c:3316 [inline] + path_openat+0x4035/0x6a90 fs/namei.c:3359 + do_filp_open+0x2b8/0x710 fs/namei.c:3395 + do_sys_openat2+0xa88/0x1140 fs/open.c:1168 + do_sys_open fs/open.c:1184 [inline] + __do_compat_sys_openat fs/open.c:1242 [inline] + __se_compat_sys_openat+0x2a4/0x310 fs/open.c:1240 + __ia32_compat_sys_openat+0x56/0x70 fs/open.c:1240 + do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline] + __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139 + do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162 + do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205 + entry_SYSENTER_compat_after_hwframe+0x4d/0x5c +RIP: 0023:0xf7ff4549 +Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 +RSP: 002b:00000000f55cd0cc EFLAGS: 00000296 ORIG_RAX: 0000000000000127 +RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000020000000 +RDX: 0000000000410481 RSI: 0000000000000000 RDI: 0000000000000000 +RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 +R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + +Uninit was created at: + kmsan_save_stack_with_flags mm/kmsan/kmsan.c:143 [inline] + kmsan_internal_poison_shadow+0x66/0xd0 mm/kmsan/kmsan.c:126 + kmsan_slab_alloc+0x8a/0xe0 mm/kmsan/kmsan_hooks.c:80 + slab_alloc_node mm/slub.c:2907 [inline] + slab_alloc mm/slub.c:2916 [inline] + __kmalloc+0x2bb/0x4b0 mm/slub.c:3982 + kmalloc include/linux/slab.h:559 [inline] + getdqbuf+0x56/0x150 fs/quota/quota_tree.c:52 + qtree_write_dquot+0xf2/0x870 fs/quota/quota_tree.c:378 + v2_write_dquot+0x1ad/0x280 fs/quota/quota_v2.c:333 + dquot_commit+0x4af/0x600 fs/quota/dquot.c:482 + ext4_write_dquot fs/ext4/super.c:5934 [inline] + ext4_mark_dquot_dirty+0x4d8/0x6a0 fs/ext4/super.c:5985 + mark_dquot_dirty fs/quota/dquot.c:347 [inline] + mark_all_dquot_dirty fs/quota/dquot.c:385 [inline] + dquot_alloc_inode+0xc05/0x12b0 fs/quota/dquot.c:1755 + __ext4_new_inode+0x8204/0x9d70 fs/ext4/ialloc.c:1155 + ext4_tmpfile+0x41a/0x850 fs/ext4/namei.c:2686 + vfs_tmpfile+0x2a2/0x570 fs/namei.c:3283 + do_tmpfile fs/namei.c:3316 [inline] + path_openat+0x4035/0x6a90 fs/namei.c:3359 + do_filp_open+0x2b8/0x710 fs/namei.c:3395 + do_sys_openat2+0xa88/0x1140 fs/open.c:1168 + do_sys_open fs/open.c:1184 [inline] + __do_compat_sys_openat fs/open.c:1242 [inline] + __se_compat_sys_openat+0x2a4/0x310 fs/open.c:1240 + __ia32_compat_sys_openat+0x56/0x70 fs/open.c:1240 + do_syscall_32_irqs_on arch/x86/entry/common.c:80 [inline] + __do_fast_syscall_32+0x129/0x180 arch/x86/entry/common.c:139 + do_fast_syscall_32+0x6a/0xc0 arch/x86/entry/common.c:162 + do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:205 + entry_SYSENTER_compat_after_hwframe+0x4d/0x5c + +Fixes: 498c60153ebb ("quota: Implement quota format with 64-bit space and inode limits") +Link: https://lore.kernel.org/r/20200924183619.4176790-1-edumazet@google.com +Signed-off-by: Eric Dumazet +Cc: Jan Kara +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/quota/quota_v2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c +index 58fc2a7c7fd19..e69a2bfdd81c0 100644 +--- a/fs/quota/quota_v2.c ++++ b/fs/quota/quota_v2.c +@@ -282,6 +282,7 @@ static void v2r1_mem2diskdqb(void *dp, struct dquot *dquot) + d->dqb_curspace = cpu_to_le64(m->dqb_curspace); + d->dqb_btime = cpu_to_le64(m->dqb_btime); + d->dqb_id = cpu_to_le32(from_kqid(&init_user_ns, dquot->dq_id)); ++ d->dqb_pad = 0; + if (qtree_entry_unused(info, dp)) + d->dqb_itime = cpu_to_le64(1); + } +-- +2.25.1 + diff --git a/queue-5.8/ramfs-fix-nommu-mmap-with-gaps-in-the-page-cache.patch b/queue-5.8/ramfs-fix-nommu-mmap-with-gaps-in-the-page-cache.patch new file mode 100644 index 00000000000..30008d75e62 --- /dev/null +++ b/queue-5.8/ramfs-fix-nommu-mmap-with-gaps-in-the-page-cache.patch @@ -0,0 +1,42 @@ +From bec826aa0c1f94e5b432385dddc01d7184e84e07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 20:13:04 -0700 +Subject: ramfs: fix nommu mmap with gaps in the page cache + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 50b7d85680086126d7bd91dae81d57d4cb1ab6b7 ] + +ramfs needs to check that pages are both physically contiguous and +contiguous in the file. If the page cache happens to have, eg, page A for +index 0 of the file, no page for index 1, and page A+1 for index 2, then +an mmap of the first two pages of the file will succeed when it should +fail. + +Fixes: 642fb4d1f1dd ("[PATCH] NOMMU: Provide shared-writable mmap support on ramfs") +Signed-off-by: Matthew Wilcox (Oracle) +Signed-off-by: Andrew Morton +Cc: David Howells +Link: https://lkml.kernel.org/r/20200914122239.GO6583@casper.infradead.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ramfs/file-nommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c +index 4146954549560..355523f4a4bf3 100644 +--- a/fs/ramfs/file-nommu.c ++++ b/fs/ramfs/file-nommu.c +@@ -224,7 +224,7 @@ static unsigned long ramfs_nommu_get_unmapped_area(struct file *file, + if (!pages) + goto out_free; + +- nr = find_get_pages(inode->i_mapping, &pgoff, lpages, pages); ++ nr = find_get_pages_contig(inode->i_mapping, pgoff, lpages, pages); + if (nr != lpages) + goto out_free_pages; /* leave if some pages were missing */ + +-- +2.25.1 + diff --git a/queue-5.8/rapidio-fix-error-handling-path.patch b/queue-5.8/rapidio-fix-error-handling-path.patch new file mode 100644 index 00000000000..840fb9d68b7 --- /dev/null +++ b/queue-5.8/rapidio-fix-error-handling-path.patch @@ -0,0 +1,71 @@ +From 4846dd0b92870e846f069e577c9ec4ad53ed58f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 20:13:15 -0700 +Subject: rapidio: fix error handling path + +From: Souptick Joarder + +[ Upstream commit fa63f083b3492b5ed5332b8d7c90b03b5ef24a1d ] + +rio_dma_transfer() attempts to clamp the return value of +pin_user_pages_fast() to be >= 0. However, the attempt fails because +nr_pages is overridden a few lines later, and restored to the undesirable +-ERRNO value. + +The return value is ultimately stored in nr_pages, which in turn is passed +to unpin_user_pages(), which expects nr_pages >= 0, else, disaster. + +Fix this by fixing the nesting of the assignment to nr_pages: nr_pages +should be clamped to zero if pin_user_pages_fast() returns -ERRNO, or set +to the return value of pin_user_pages_fast(), otherwise. + +[jhubbard@nvidia.com: new changelog] + +Fixes: e8de370188d09 ("rapidio: add mport char device driver") +Signed-off-by: Souptick Joarder +Signed-off-by: Andrew Morton +Reviewed-by: Ira Weiny +Reviewed-by: John Hubbard +Cc: Matthew Wilcox +Cc: Matt Porter +Cc: Alexandre Bounine +Cc: Gustavo A. R. Silva +Cc: Madhuparna Bhowmik +Cc: Dan Carpenter +Link: https://lkml.kernel.org/r/1600227737-20785-1-git-send-email-jrdr.linux@gmail.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/rapidio/devices/rio_mport_cdev.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c +index 451608e960a18..438cbf994c57f 100644 +--- a/drivers/rapidio/devices/rio_mport_cdev.c ++++ b/drivers/rapidio/devices/rio_mport_cdev.c +@@ -871,15 +871,16 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode, + rmcd_error("pin_user_pages_fast err=%ld", + pinned); + nr_pages = 0; +- } else ++ } else { + rmcd_error("pinned %ld out of %ld pages", + pinned, nr_pages); ++ /* ++ * Set nr_pages up to mean "how many pages to unpin, in ++ * the error handler: ++ */ ++ nr_pages = pinned; ++ } + ret = -EFAULT; +- /* +- * Set nr_pages up to mean "how many pages to unpin, in +- * the error handler: +- */ +- nr_pages = pinned; + goto err_pg; + } + +-- +2.25.1 + diff --git a/queue-5.8/rapidio-fix-the-missed-put_device-for-rio_mport_add_.patch b/queue-5.8/rapidio-fix-the-missed-put_device-for-rio_mport_add_.patch new file mode 100644 index 00000000000..2090996a40b --- /dev/null +++ b/queue-5.8/rapidio-fix-the-missed-put_device-for-rio_mport_add_.patch @@ -0,0 +1,56 @@ +From ace99acf907caf959202a53f5dd2e4f544456331 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 20:13:18 -0700 +Subject: rapidio: fix the missed put_device() for rio_mport_add_riodev + +From: Jing Xiangfeng + +[ Upstream commit 85094c05eeb47d195a74a25366a2db066f1c9d47 ] + +rio_mport_add_riodev() misses to call put_device() when the device already +exists. Add the missed function call to fix it. + +Fixes: e8de370188d0 ("rapidio: add mport char device driver") +Signed-off-by: Jing Xiangfeng +Signed-off-by: Andrew Morton +Reviewed-by: Dan Carpenter +Cc: Matt Porter +Cc: Alexandre Bounine +Cc: Gustavo A. R. Silva +Cc: John Hubbard +Cc: Kees Cook +Cc: Madhuparna Bhowmik +Link: https://lkml.kernel.org/r/20200922072525.42330-1-jingxiangfeng@huawei.com +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + drivers/rapidio/devices/rio_mport_cdev.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c +index 438cbf994c57f..152946e033d17 100644 +--- a/drivers/rapidio/devices/rio_mport_cdev.c ++++ b/drivers/rapidio/devices/rio_mport_cdev.c +@@ -1680,6 +1680,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv, + struct rio_dev *rdev; + struct rio_switch *rswitch = NULL; + struct rio_mport *mport; ++ struct device *dev; + size_t size; + u32 rval; + u32 swpinfo = 0; +@@ -1694,8 +1695,10 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv, + rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name, + dev_info.comptag, dev_info.destid, dev_info.hopcount); + +- if (bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name)) { ++ dev = bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name); ++ if (dev) { + rmcd_debug(RDEV, "device %s already exists", dev_info.name); ++ put_device(dev); + return -EEXIST; + } + +-- +2.25.1 + diff --git a/queue-5.8/ras-cec-fix-cec_init-prototype.patch b/queue-5.8/ras-cec-fix-cec_init-prototype.patch new file mode 100644 index 00000000000..ba4dec40b00 --- /dev/null +++ b/queue-5.8/ras-cec-fix-cec_init-prototype.patch @@ -0,0 +1,65 @@ +From 11629d3690405f1a482065b7bbd666c7910529c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Aug 2020 11:57:08 +0200 +Subject: RAS/CEC: Fix cec_init() prototype + +From: Luca Stefani + +[ Upstream commit 85e6084e0b436cabe9c909e679937998ffbf9c9d ] + +late_initcall() expects a function that returns an integer. Update the +function signature to match. + + [ bp: Massage commit message into proper sentences. ] + +Fixes: 9554bfe403bd ("x86/mce: Convert the CEC to use the MCE notifier") +Signed-off-by: Luca Stefani +Signed-off-by: Borislav Petkov +Reviewed-by: Sami Tolvanen +Tested-by: Sami Tolvanen +Link: https://lkml.kernel.org/r/20200805095708.83939-1-luca.stefani.ge1@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/ras/cec.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/ras/cec.c b/drivers/ras/cec.c +index 569d9ad2c5942..6939aa5b3dc7f 100644 +--- a/drivers/ras/cec.c ++++ b/drivers/ras/cec.c +@@ -553,20 +553,20 @@ static struct notifier_block cec_nb = { + .priority = MCE_PRIO_CEC, + }; + +-static void __init cec_init(void) ++static int __init cec_init(void) + { + if (ce_arr.disabled) +- return; ++ return -ENODEV; + + ce_arr.array = (void *)get_zeroed_page(GFP_KERNEL); + if (!ce_arr.array) { + pr_err("Error allocating CE array page!\n"); +- return; ++ return -ENOMEM; + } + + if (create_debugfs_nodes()) { + free_page((unsigned long)ce_arr.array); +- return; ++ return -ENOMEM; + } + + INIT_DELAYED_WORK(&cec_work, cec_work_fn); +@@ -575,6 +575,7 @@ static void __init cec_init(void) + mce_register_decode_chain(&cec_nb); + + pr_info("Correctable Errors collector initialized.\n"); ++ return 0; + } + late_initcall(cec_init); + +-- +2.25.1 + diff --git a/queue-5.8/rcu-tree-force-quiescent-state-on-callback-overload.patch b/queue-5.8/rcu-tree-force-quiescent-state-on-callback-overload.patch new file mode 100644 index 00000000000..7e276829c22 --- /dev/null +++ b/queue-5.8/rcu-tree-force-quiescent-state-on-callback-overload.patch @@ -0,0 +1,44 @@ +From a668648ad26657d1d2573d8d5a7a5c0fab55005b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 22 Jun 2020 00:07:27 +0530 +Subject: rcu/tree: Force quiescent state on callback overload + +From: Neeraj Upadhyay + +[ Upstream commit 9c39245382de4d52a122641952900709d4a9950b ] + +On callback overload, it is necessary to quickly detect idle CPUs, +and rcu_gp_fqs_check_wake() checks for this condition. Unfortunately, +the code following the call to this function does not repeat this check, +which means that in reality no actual quiescent-state forcing, instead +only a couple of quick and pointless wakeups at the beginning of the +grace period. + +This commit therefore adds a check for the RCU_GP_FLAG_OVLD flag in +the post-wakeup "if" statement in rcu_gp_fqs_loop(). + +Fixes: 1fca4d12f4637 ("rcu: Expedite first two FQS scans under callback-overload conditions") +Reviewed-by: Joel Fernandes (Google) +Signed-off-by: Neeraj Upadhyay +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index 1e9e500ff7906..572a79b1a8510 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -1882,7 +1882,7 @@ static void rcu_gp_fqs_loop(void) + break; + /* If time for quiescent-state forcing, do it. */ + if (!time_after(rcu_state.jiffies_force_qs, jiffies) || +- (gf & RCU_GP_FLAG_FQS)) { ++ (gf & (RCU_GP_FLAG_FQS | RCU_GP_FLAG_OVLD))) { + trace_rcu_grace_period(rcu_state.name, rcu_state.gp_seq, + TPS("fqsstart")); + rcu_gp_fqs(first_gp_fqs); +-- +2.25.1 + diff --git a/queue-5.8/rcutorture-properly-set-rcu_fwds-for-oom-handling.patch b/queue-5.8/rcutorture-properly-set-rcu_fwds-for-oom-handling.patch new file mode 100644 index 00000000000..e8d5386188c --- /dev/null +++ b/queue-5.8/rcutorture-properly-set-rcu_fwds-for-oom-handling.patch @@ -0,0 +1,59 @@ +From d6b758e57e523d867dfdfdf8d6f34a201f220830 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 19 Jul 2020 14:40:31 -0700 +Subject: rcutorture: Properly set rcu_fwds for OOM handling + +From: Paul E. McKenney + +[ Upstream commit c8fa63714763b7795a3f5fb7ed6d000763e6dccc ] + +The conversion of rcu_fwds to dynamic allocation failed to actually +allocate the required structure. This commit therefore allocates it, +frees it, and updates rcu_fwds accordingly. While in the area, it +abstracts the cleanup actions into rcu_torture_fwd_prog_cleanup(). + +Fixes: 5155be9994e5 ("rcutorture: Dynamically allocate rcu_fwds structure") +Reported-by: kernel test robot +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcutorture.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c +index efb792e13fca9..23ec68d8ff3aa 100644 +--- a/kernel/rcu/rcutorture.c ++++ b/kernel/rcu/rcutorture.c +@@ -2154,9 +2154,20 @@ static int __init rcu_torture_fwd_prog_init(void) + return -ENOMEM; + spin_lock_init(&rfp->rcu_fwd_lock); + rfp->rcu_fwd_cb_tail = &rfp->rcu_fwd_cb_head; ++ rcu_fwds = rfp; + return torture_create_kthread(rcu_torture_fwd_prog, rfp, fwd_prog_task); + } + ++static void rcu_torture_fwd_prog_cleanup(void) ++{ ++ struct rcu_fwd *rfp; ++ ++ torture_stop_kthread(rcu_torture_fwd_prog, fwd_prog_task); ++ rfp = rcu_fwds; ++ rcu_fwds = NULL; ++ kfree(rfp); ++} ++ + /* Callback function for RCU barrier testing. */ + static void rcu_torture_barrier_cbf(struct rcu_head *rcu) + { +@@ -2360,7 +2371,7 @@ rcu_torture_cleanup(void) + + show_rcu_gp_kthreads(); + rcu_torture_barrier_cleanup(); +- torture_stop_kthread(rcu_torture_fwd_prog, fwd_prog_task); ++ rcu_torture_fwd_prog_cleanup(); + torture_stop_kthread(rcu_torture_stall, stall_task); + torture_stop_kthread(rcu_torture_writer, writer_task); + +-- +2.25.1 + diff --git a/queue-5.8/rdma-allow-fail-of-destroy-cq.patch b/queue-5.8/rdma-allow-fail-of-destroy-cq.patch new file mode 100644 index 00000000000..3bbc09dbd29 --- /dev/null +++ b/queue-5.8/rdma-allow-fail-of-destroy-cq.patch @@ -0,0 +1,645 @@ +From 1a255488fbd020516f17cc5103f62787edcdd990 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 15:09:18 +0300 +Subject: RDMA: Allow fail of destroy CQ + +From: Leon Romanovsky + +[ Upstream commit 43d781b9fa562f0c6e50f62c870fbfeb9dc85213 ] + +Like any other verbs objects, CQ shouldn't fail during destroy, but +mlx5_ib didn't follow this contract with mixed IB verbs objects with +DEVX. Such mix causes to the situation where FW and kernel are fully +interdependent on the reference counting of each side. + +Kernel verbs and drivers that don't have DEVX flows shouldn't fail. + +Fixes: e39afe3d6dbd ("RDMA: Convert CQ allocations to be under core responsibility") +Link: https://lore.kernel.org/r/20200907120921.476363-7-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cq.c | 5 ++++- + drivers/infiniband/core/verbs.c | 9 +++++++-- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 3 ++- + drivers/infiniband/hw/bnxt_re/ib_verbs.h | 2 +- + drivers/infiniband/hw/cxgb4/cq.c | 3 ++- + drivers/infiniband/hw/cxgb4/iw_cxgb4.h | 2 +- + drivers/infiniband/hw/efa/efa.h | 2 +- + drivers/infiniband/hw/efa/efa_verbs.c | 3 ++- + drivers/infiniband/hw/hns/hns_roce_cq.c | 3 ++- + drivers/infiniband/hw/hns/hns_roce_device.h | 4 ++-- + drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 3 ++- + drivers/infiniband/hw/i40iw/i40iw_verbs.c | 3 ++- + drivers/infiniband/hw/mlx4/cq.c | 3 ++- + drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 +- + drivers/infiniband/hw/mlx5/cq.c | 9 +++++++-- + drivers/infiniband/hw/mlx5/mlx5_ib.h | 2 +- + drivers/infiniband/hw/mthca/mthca_provider.c | 3 ++- + drivers/infiniband/hw/ocrdma/ocrdma_verbs.c | 3 ++- + drivers/infiniband/hw/ocrdma/ocrdma_verbs.h | 2 +- + drivers/infiniband/hw/qedr/verbs.c | 5 +++-- + drivers/infiniband/hw/qedr/verbs.h | 2 +- + drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 4 ++-- + drivers/infiniband/hw/usnic/usnic_ib_verbs.h | 2 +- + drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c | 3 ++- + drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h | 2 +- + drivers/infiniband/sw/rdmavt/cq.c | 3 ++- + drivers/infiniband/sw/rdmavt/cq.h | 2 +- + drivers/infiniband/sw/rxe/rxe_verbs.c | 3 ++- + drivers/infiniband/sw/siw/siw_verbs.c | 3 ++- + drivers/infiniband/sw/siw/siw_verbs.h | 2 +- + include/rdma/ib_verbs.h | 6 ++++-- + 31 files changed, 66 insertions(+), 37 deletions(-) + +diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c +index 2efe825689e3e..19e36e52181be 100644 +--- a/drivers/infiniband/core/cq.c ++++ b/drivers/infiniband/core/cq.c +@@ -319,6 +319,8 @@ EXPORT_SYMBOL(__ib_alloc_cq_any); + */ + void ib_free_cq(struct ib_cq *cq) + { ++ int ret; ++ + if (WARN_ON_ONCE(atomic_read(&cq->usecnt))) + return; + if (WARN_ON_ONCE(cq->cqe_used)) +@@ -340,8 +342,9 @@ void ib_free_cq(struct ib_cq *cq) + + rdma_dim_destroy(cq); + trace_cq_free(cq); ++ ret = cq->device->ops.destroy_cq(cq, NULL); ++ WARN_ONCE(ret, "Destroy of kernel CQ shouldn't fail"); + rdma_restrack_del(&cq->res); +- cq->device->ops.destroy_cq(cq, NULL); + kfree(cq->wc); + kfree(cq); + } +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index 1b0ea945756f0..2e397d18dbf44 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -2016,16 +2016,21 @@ EXPORT_SYMBOL(rdma_set_cq_moderation); + + int ib_destroy_cq_user(struct ib_cq *cq, struct ib_udata *udata) + { ++ int ret; ++ + if (WARN_ON_ONCE(cq->shared)) + return -EOPNOTSUPP; + + if (atomic_read(&cq->usecnt)) + return -EBUSY; + ++ ret = cq->device->ops.destroy_cq(cq, udata); ++ if (ret) ++ return ret; ++ + rdma_restrack_del(&cq->res); +- cq->device->ops.destroy_cq(cq, udata); + kfree(cq); +- return 0; ++ return ret; + } + EXPORT_SYMBOL(ib_destroy_cq_user); + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index cb6e873039df5..9f69abf01d331 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -2714,7 +2714,7 @@ int bnxt_re_post_recv(struct ib_qp *ib_qp, const struct ib_recv_wr *wr, + } + + /* Completion Queues */ +-void bnxt_re_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) ++int bnxt_re_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + { + struct bnxt_re_cq *cq; + struct bnxt_qplib_nq *nq; +@@ -2730,6 +2730,7 @@ void bnxt_re_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + atomic_dec(&rdev->cq_count); + nq->budget--; + kfree(cq->cql); ++ return 0; + } + + int bnxt_re_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.h b/drivers/infiniband/hw/bnxt_re/ib_verbs.h +index e5fbbeba6d28d..f4a0ded67a8aa 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.h ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.h +@@ -193,7 +193,7 @@ int bnxt_re_post_recv(struct ib_qp *qp, const struct ib_recv_wr *recv_wr, + const struct ib_recv_wr **bad_recv_wr); + int bnxt_re_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); +-void bnxt_re_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); ++int bnxt_re_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); + int bnxt_re_poll_cq(struct ib_cq *cq, int num_entries, struct ib_wc *wc); + int bnxt_re_req_notify_cq(struct ib_cq *cq, enum ib_cq_notify_flags flags); + struct ib_mr *bnxt_re_get_dma_mr(struct ib_pd *pd, int mr_access_flags); +diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c +index b1bb61c65f4f6..7b076fc23cf38 100644 +--- a/drivers/infiniband/hw/cxgb4/cq.c ++++ b/drivers/infiniband/hw/cxgb4/cq.c +@@ -967,7 +967,7 @@ int c4iw_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc) + return !err || err == -ENODATA ? npolled : err; + } + +-void c4iw_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) ++int c4iw_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + { + struct c4iw_cq *chp; + struct c4iw_ucontext *ucontext; +@@ -985,6 +985,7 @@ void c4iw_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + ucontext ? &ucontext->uctx : &chp->cq.rdev->uctx, + chp->destroy_skb, chp->wr_waitp); + c4iw_put_wr_wait(chp->wr_waitp); ++ return 0; + } + + int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, +diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h +index e8e11bd95e429..de0f278e31501 100644 +--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h ++++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h +@@ -992,7 +992,7 @@ struct ib_mr *c4iw_reg_user_mr(struct ib_pd *pd, u64 start, + struct ib_udata *udata); + struct ib_mr *c4iw_get_dma_mr(struct ib_pd *pd, int acc); + int c4iw_dereg_mr(struct ib_mr *ib_mr, struct ib_udata *udata); +-void c4iw_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata); ++int c4iw_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata); + int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); + int c4iw_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags); +diff --git a/drivers/infiniband/hw/efa/efa.h b/drivers/infiniband/hw/efa/efa.h +index 1889dd172a252..05f593940e7b0 100644 +--- a/drivers/infiniband/hw/efa/efa.h ++++ b/drivers/infiniband/hw/efa/efa.h +@@ -139,7 +139,7 @@ int efa_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata); + struct ib_qp *efa_create_qp(struct ib_pd *ibpd, + struct ib_qp_init_attr *init_attr, + struct ib_udata *udata); +-void efa_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata); ++int efa_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata); + int efa_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); + struct ib_mr *efa_reg_mr(struct ib_pd *ibpd, u64 start, u64 length, +diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c +index 7dd082441333c..bd2caa2353c75 100644 +--- a/drivers/infiniband/hw/efa/efa_verbs.c ++++ b/drivers/infiniband/hw/efa/efa_verbs.c +@@ -843,7 +843,7 @@ static int efa_destroy_cq_idx(struct efa_dev *dev, int cq_idx) + return efa_com_destroy_cq(&dev->edev, ¶ms); + } + +-void efa_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) ++int efa_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + { + struct efa_dev *dev = to_edev(ibcq->device); + struct efa_cq *cq = to_ecq(ibcq); +@@ -856,6 +856,7 @@ void efa_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + efa_destroy_cq_idx(dev, cq->cq_idx); + efa_free_mapped(dev, cq->cpu_addr, cq->dma_addr, cq->size, + DMA_FROM_DEVICE); ++ return 0; + } + + static int cq_mmap_entries_setup(struct efa_dev *dev, struct efa_cq *cq, +diff --git a/drivers/infiniband/hw/hns/hns_roce_cq.c b/drivers/infiniband/hw/hns/hns_roce_cq.c +index e87d616f79882..c5acf3332519b 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_cq.c ++++ b/drivers/infiniband/hw/hns/hns_roce_cq.c +@@ -311,7 +311,7 @@ int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr, + return ret; + } + +-void hns_roce_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) ++int hns_roce_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + { + struct hns_roce_dev *hr_dev = to_hr_dev(ib_cq->device); + struct hns_roce_cq *hr_cq = to_hr_cq(ib_cq); +@@ -322,6 +322,7 @@ void hns_roce_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + free_cq_buf(hr_dev, hr_cq); + free_cq_db(hr_dev, hr_cq, udata); + free_cqc(hr_dev, hr_cq); ++ return 0; + } + + void hns_roce_cq_completion(struct hns_roce_dev *hr_dev, u32 cqn) +diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h +index c69453a62767c..77ca55b559a0a 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_device.h ++++ b/drivers/infiniband/hw/hns/hns_roce_device.h +@@ -929,7 +929,7 @@ struct hns_roce_hw { + int (*poll_cq)(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc); + int (*dereg_mr)(struct hns_roce_dev *hr_dev, struct hns_roce_mr *mr, + struct ib_udata *udata); +- void (*destroy_cq)(struct ib_cq *ibcq, struct ib_udata *udata); ++ int (*destroy_cq)(struct ib_cq *ibcq, struct ib_udata *udata); + int (*modify_cq)(struct ib_cq *cq, u16 cq_count, u16 cq_period); + int (*init_eq)(struct hns_roce_dev *hr_dev); + void (*cleanup_eq)(struct hns_roce_dev *hr_dev); +@@ -1246,7 +1246,7 @@ int to_hr_qp_type(int qp_type); + int hns_roce_create_cq(struct ib_cq *ib_cq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); + +-void hns_roce_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata); ++int hns_roce_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata); + int hns_roce_db_map_user(struct hns_roce_ucontext *context, + struct ib_udata *udata, unsigned long virt, + struct hns_roce_db *db); +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c +index cf39f560b8001..87c93f303b9a8 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c +@@ -3573,7 +3573,7 @@ int hns_roce_v1_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) + return 0; + } + +-static void hns_roce_v1_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) ++static int hns_roce_v1_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + { + struct hns_roce_dev *hr_dev = to_hr_dev(ibcq->device); + struct hns_roce_cq *hr_cq = to_hr_cq(ibcq); +@@ -3604,6 +3604,7 @@ static void hns_roce_v1_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + } + wait_time++; + } ++ return 0; + } + + static void set_eq_cons_index_v1(struct hns_roce_eq *eq, int req_not) +diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +index 19af29a48c559..c3087b8738ed7 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +@@ -1053,7 +1053,7 @@ void i40iw_cq_wq_destroy(struct i40iw_device *iwdev, struct i40iw_sc_cq *cq) + * @ib_cq: cq pointer + * @udata: user data or NULL for kernel object + */ +-static void i40iw_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) ++static int i40iw_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + { + struct i40iw_cq *iwcq; + struct i40iw_device *iwdev; +@@ -1065,6 +1065,7 @@ static void i40iw_destroy_cq(struct ib_cq *ib_cq, struct ib_udata *udata) + i40iw_cq_wq_destroy(iwdev, cq); + cq_free_resources(iwdev, iwcq); + i40iw_rem_devusecount(iwdev); ++ return 0; + } + + /** +diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c +index f8b936b76dcdf..3851316407ceb 100644 +--- a/drivers/infiniband/hw/mlx4/cq.c ++++ b/drivers/infiniband/hw/mlx4/cq.c +@@ -475,7 +475,7 @@ int mlx4_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata) + return err; + } + +-void mlx4_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) ++int mlx4_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) + { + struct mlx4_ib_dev *dev = to_mdev(cq->device); + struct mlx4_ib_cq *mcq = to_mcq(cq); +@@ -495,6 +495,7 @@ void mlx4_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) + mlx4_db_free(dev->dev, &mcq->db); + } + ib_umem_release(mcq->umem); ++ return 0; + } + + static void dump_cqe(void *cqe) +diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h +index 5ec3b747c1aea..bac526a703173 100644 +--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h ++++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h +@@ -738,7 +738,7 @@ int mlx4_ib_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period); + int mlx4_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata); + int mlx4_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); +-void mlx4_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); ++int mlx4_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); + int mlx4_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc); + int mlx4_ib_arm_cq(struct ib_cq *cq, enum ib_cq_notify_flags flags); + void __mlx4_ib_cq_clean(struct mlx4_ib_cq *cq, u32 qpn, struct mlx4_ib_srq *srq); +diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c +index 3ca379513d0e6..ec634085e1d9a 100644 +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -1024,16 +1024,21 @@ int mlx5_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + return err; + } + +-void mlx5_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) ++int mlx5_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) + { + struct mlx5_ib_dev *dev = to_mdev(cq->device); + struct mlx5_ib_cq *mcq = to_mcq(cq); ++ int ret; ++ ++ ret = mlx5_core_destroy_cq(dev->mdev, &mcq->mcq); ++ if (ret) ++ return ret; + +- mlx5_core_destroy_cq(dev->mdev, &mcq->mcq); + if (udata) + destroy_cq_user(mcq, udata); + else + destroy_cq_kernel(dev, mcq); ++ return 0; + } + + static int is_equal_rsn(struct mlx5_cqe64 *cqe64, u32 rsn) +diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h +index 5dbe3eb0d9cb9..3825cdec6ac68 100644 +--- a/drivers/infiniband/hw/mlx5/mlx5_ib.h ++++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h +@@ -1180,7 +1180,7 @@ int mlx5_ib_read_wqe_srq(struct mlx5_ib_srq *srq, int wqe_index, void *buffer, + size_t buflen, size_t *bc); + int mlx5_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); +-void mlx5_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); ++int mlx5_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); + int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc); + int mlx5_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags); + int mlx5_ib_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period); +diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c +index 9fa2f9164a47b..2ad15adf304e5 100644 +--- a/drivers/infiniband/hw/mthca/mthca_provider.c ++++ b/drivers/infiniband/hw/mthca/mthca_provider.c +@@ -789,7 +789,7 @@ static int mthca_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *uda + return ret; + } + +-static void mthca_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) ++static int mthca_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) + { + if (udata) { + struct mthca_ucontext *context = +@@ -808,6 +808,7 @@ static void mthca_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) + to_mcq(cq)->set_ci_db_index); + } + mthca_free_cq(to_mdev(cq->device), to_mcq(cq)); ++ return 0; + } + + static inline u32 convert_access(int acc) +diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +index d11c74390a124..927c70d1ffbc3 100644 +--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c ++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.c +@@ -1056,7 +1056,7 @@ static void ocrdma_flush_cq(struct ocrdma_cq *cq) + spin_unlock_irqrestore(&cq->cq_lock, flags); + } + +-void ocrdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) ++int ocrdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + { + struct ocrdma_cq *cq = get_ocrdma_cq(ibcq); + struct ocrdma_eq *eq = NULL; +@@ -1081,6 +1081,7 @@ void ocrdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + ocrdma_get_db_addr(dev, pdid), + dev->nic_info.db_page_size); + } ++ return 0; + } + + static int ocrdma_add_qpn_map(struct ocrdma_dev *dev, struct ocrdma_qp *qp) +diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h +index 3a5010881be5b..c46412dff924a 100644 +--- a/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h ++++ b/drivers/infiniband/hw/ocrdma/ocrdma_verbs.h +@@ -72,7 +72,7 @@ void ocrdma_dealloc_pd(struct ib_pd *pd, struct ib_udata *udata); + int ocrdma_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); + int ocrdma_resize_cq(struct ib_cq *, int cqe, struct ib_udata *); +-void ocrdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata); ++int ocrdma_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata); + + struct ib_qp *ocrdma_create_qp(struct ib_pd *, + struct ib_qp_init_attr *attrs, +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 1a7f1f805be3e..8092821680438 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1050,7 +1050,7 @@ int qedr_resize_cq(struct ib_cq *ibcq, int new_cnt, struct ib_udata *udata) + #define QEDR_DESTROY_CQ_MAX_ITERATIONS (10) + #define QEDR_DESTROY_CQ_ITER_DURATION (10) + +-void qedr_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) ++int qedr_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + { + struct qedr_dev *dev = get_qedr_dev(ibcq->device); + struct qed_rdma_destroy_cq_out_params oparams; +@@ -1065,7 +1065,7 @@ void qedr_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + /* GSIs CQs are handled by driver, so they don't exist in the FW */ + if (cq->cq_type == QEDR_CQ_TYPE_GSI) { + qedr_db_recovery_del(dev, cq->db_addr, &cq->db.data); +- return; ++ return 0; + } + + iparams.icid = cq->icid; +@@ -1113,6 +1113,7 @@ void qedr_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + * Since the destroy CQ ramrod has also been received on the EQ we can + * be certain that there's no event handler in process. + */ ++ return 0; + } + + static inline int get_gid_info_from_table(struct ib_qp *ibqp, +diff --git a/drivers/infiniband/hw/qedr/verbs.h b/drivers/infiniband/hw/qedr/verbs.h +index 5e02387e068d1..e0db3bc1653e2 100644 +--- a/drivers/infiniband/hw/qedr/verbs.h ++++ b/drivers/infiniband/hw/qedr/verbs.h +@@ -52,7 +52,7 @@ void qedr_dealloc_pd(struct ib_pd *pd, struct ib_udata *udata); + int qedr_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); + int qedr_resize_cq(struct ib_cq *, int cqe, struct ib_udata *); +-void qedr_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata); ++int qedr_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata); + int qedr_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags); + struct ib_qp *qedr_create_qp(struct ib_pd *, struct ib_qp_init_attr *attrs, + struct ib_udata *); +diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c +index b8a77ce115908..586ff16be1bb3 100644 +--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.c ++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.c +@@ -596,9 +596,9 @@ int usnic_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + return 0; + } + +-void usnic_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) ++int usnic_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) + { +- return; ++ return 0; + } + + struct ib_mr *usnic_ib_reg_mr(struct ib_pd *pd, u64 start, u64 length, +diff --git a/drivers/infiniband/hw/usnic/usnic_ib_verbs.h b/drivers/infiniband/hw/usnic/usnic_ib_verbs.h +index 2aedf78c13cf2..f13b08c59b9a3 100644 +--- a/drivers/infiniband/hw/usnic/usnic_ib_verbs.h ++++ b/drivers/infiniband/hw/usnic/usnic_ib_verbs.h +@@ -60,7 +60,7 @@ int usnic_ib_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + int attr_mask, struct ib_udata *udata); + int usnic_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); +-void usnic_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); ++int usnic_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); + struct ib_mr *usnic_ib_reg_mr(struct ib_pd *pd, u64 start, u64 length, + u64 virt_addr, int access_flags, + struct ib_udata *udata); +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c +index 4f6cc0de7ef95..6d3e6389e47da 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c +@@ -235,7 +235,7 @@ static void pvrdma_free_cq(struct pvrdma_dev *dev, struct pvrdma_cq *cq) + * @cq: the completion queue to destroy. + * @udata: user data or null for kernel object + */ +-void pvrdma_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) ++int pvrdma_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) + { + struct pvrdma_cq *vcq = to_vcq(cq); + union pvrdma_cmd_req req; +@@ -261,6 +261,7 @@ void pvrdma_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) + + pvrdma_free_cq(dev, vcq); + atomic_dec(&dev->num_cqs); ++ return 0; + } + + static inline struct pvrdma_cqe *get_cqe(struct pvrdma_cq *cq, int i) +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h +index 267702226f108..af36e9f767eed 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h +@@ -411,7 +411,7 @@ int pvrdma_map_mr_sg(struct ib_mr *ibmr, struct scatterlist *sg, + int sg_nents, unsigned int *sg_offset); + int pvrdma_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); +-void pvrdma_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); ++int pvrdma_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); + int pvrdma_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc); + int pvrdma_req_notify_cq(struct ib_cq *cq, enum ib_cq_notify_flags flags); + int pvrdma_create_ah(struct ib_ah *ah, struct rdma_ah_init_attr *init_attr, +diff --git a/drivers/infiniband/sw/rdmavt/cq.c b/drivers/infiniband/sw/rdmavt/cq.c +index 04d2e72017fed..19248be140933 100644 +--- a/drivers/infiniband/sw/rdmavt/cq.c ++++ b/drivers/infiniband/sw/rdmavt/cq.c +@@ -315,7 +315,7 @@ int rvt_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + * + * Called by ib_destroy_cq() in the generic verbs code. + */ +-void rvt_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) ++int rvt_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + { + struct rvt_cq *cq = ibcq_to_rvtcq(ibcq); + struct rvt_dev_info *rdi = cq->rdi; +@@ -328,6 +328,7 @@ void rvt_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + kref_put(&cq->ip->ref, rvt_release_mmap_info); + else + vfree(cq->kqueue); ++ return 0; + } + + /** +diff --git a/drivers/infiniband/sw/rdmavt/cq.h b/drivers/infiniband/sw/rdmavt/cq.h +index 5e26a2eb19a4c..feb01e7ee0044 100644 +--- a/drivers/infiniband/sw/rdmavt/cq.h ++++ b/drivers/infiniband/sw/rdmavt/cq.h +@@ -53,7 +53,7 @@ + + int rvt_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); +-void rvt_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata); ++int rvt_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata); + int rvt_req_notify_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags notify_flags); + int rvt_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata); + int rvt_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *entry); +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 00ba6fb1e6763..452748b3854b5 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -816,13 +816,14 @@ static int rxe_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + return rxe_add_to_pool(&rxe->cq_pool, &cq->pelem); + } + +-static void rxe_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) ++static int rxe_destroy_cq(struct ib_cq *ibcq, struct ib_udata *udata) + { + struct rxe_cq *cq = to_rcq(ibcq); + + rxe_cq_disable(cq); + + rxe_drop_ref(cq); ++ return 0; + } + + static int rxe_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata) +diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c +index 987e2ba05dbc0..7e657f90ca4f4 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.c ++++ b/drivers/infiniband/sw/siw/siw_verbs.c +@@ -1064,7 +1064,7 @@ int siw_post_receive(struct ib_qp *base_qp, const struct ib_recv_wr *wr, + return rv > 0 ? 0 : rv; + } + +-void siw_destroy_cq(struct ib_cq *base_cq, struct ib_udata *udata) ++int siw_destroy_cq(struct ib_cq *base_cq, struct ib_udata *udata) + { + struct siw_cq *cq = to_siw_cq(base_cq); + struct siw_device *sdev = to_siw_dev(base_cq->device); +@@ -1082,6 +1082,7 @@ void siw_destroy_cq(struct ib_cq *base_cq, struct ib_udata *udata) + atomic_dec(&sdev->num_cq); + + vfree(cq->queue); ++ return 0; + } + + /* +diff --git a/drivers/infiniband/sw/siw/siw_verbs.h b/drivers/infiniband/sw/siw/siw_verbs.h +index 1a731989fad60..b0b7488869104 100644 +--- a/drivers/infiniband/sw/siw/siw_verbs.h ++++ b/drivers/infiniband/sw/siw/siw_verbs.h +@@ -63,7 +63,7 @@ int siw_post_send(struct ib_qp *base_qp, const struct ib_send_wr *wr, + const struct ib_send_wr **bad_wr); + int siw_post_receive(struct ib_qp *base_qp, const struct ib_recv_wr *wr, + const struct ib_recv_wr **bad_wr); +-void siw_destroy_cq(struct ib_cq *base_cq, struct ib_udata *udata); ++int siw_destroy_cq(struct ib_cq *base_cq, struct ib_udata *udata); + int siw_poll_cq(struct ib_cq *base_cq, int num_entries, struct ib_wc *wc); + int siw_req_notify_cq(struct ib_cq *base_cq, enum ib_cq_notify_flags flags); + struct ib_mr *siw_reg_user_mr(struct ib_pd *base_pd, u64 start, u64 len, +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index bfd1f38c495c7..d7809f203715f 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -2465,7 +2465,7 @@ struct ib_device_ops { + int (*create_cq)(struct ib_cq *cq, const struct ib_cq_init_attr *attr, + struct ib_udata *udata); + int (*modify_cq)(struct ib_cq *cq, u16 cq_count, u16 cq_period); +- void (*destroy_cq)(struct ib_cq *cq, struct ib_udata *udata); ++ int (*destroy_cq)(struct ib_cq *cq, struct ib_udata *udata); + int (*resize_cq)(struct ib_cq *cq, int cqe, struct ib_udata *udata); + struct ib_mr *(*get_dma_mr)(struct ib_pd *pd, int mr_access_flags); + struct ib_mr *(*reg_user_mr)(struct ib_pd *pd, u64 start, u64 length, +@@ -3922,7 +3922,9 @@ int ib_destroy_cq_user(struct ib_cq *cq, struct ib_udata *udata); + */ + static inline void ib_destroy_cq(struct ib_cq *cq) + { +- ib_destroy_cq_user(cq, NULL); ++ int ret = ib_destroy_cq_user(cq, NULL); ++ ++ WARN_ONCE(ret, "Destroy of kernel CQ shouldn't fail"); + } + + /** +-- +2.25.1 + diff --git a/queue-5.8/rdma-cma-combine-cma_ndev_work-with-cma_work.patch b/queue-5.8/rdma-cma-combine-cma_ndev_work-with-cma_work.patch new file mode 100644 index 00000000000..bbd8a5a05e5 --- /dev/null +++ b/queue-5.8/rdma-cma-combine-cma_ndev_work-with-cma_work.patch @@ -0,0 +1,100 @@ +From 4398caa79e29a28a14d4d1026f5595a04ca2d191 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 11:11:19 +0300 +Subject: RDMA/cma: Combine cma_ndev_work with cma_work + +From: Jason Gunthorpe + +[ Upstream commit 7e85bcda8bfe883f4244672ed79f81b7762a1a7e ] + +These are the same thing, except that cma_ndev_work doesn't have a state +transition. Signal no state transition by setting old_state and new_state +== 0. + +In all cases the handler function should not be called once +rdma_destroy_id() has progressed passed setting the state. + +Link: https://lore.kernel.org/r/20200902081122.745412-6-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 38 +++++++---------------------------- + 1 file changed, 7 insertions(+), 31 deletions(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 26de0dab60bbb..015b2fe509dca 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -363,12 +363,6 @@ struct cma_work { + struct rdma_cm_event event; + }; + +-struct cma_ndev_work { +- struct work_struct work; +- struct rdma_id_private *id; +- struct rdma_cm_event event; +-}; +- + struct iboe_mcast_work { + struct work_struct work; + struct rdma_id_private *id; +@@ -2646,32 +2640,14 @@ static void cma_work_handler(struct work_struct *_work) + struct rdma_id_private *id_priv = work->id; + + mutex_lock(&id_priv->handler_mutex); +- if (!cma_comp_exch(id_priv, work->old_state, work->new_state)) ++ if (READ_ONCE(id_priv->state) == RDMA_CM_DESTROYING || ++ READ_ONCE(id_priv->state) == RDMA_CM_DEVICE_REMOVAL) + goto out_unlock; +- +- if (cma_cm_event_handler(id_priv, &work->event)) { +- cma_id_put(id_priv); +- destroy_id_handler_unlock(id_priv); +- goto out_free; ++ if (work->old_state != 0 || work->new_state != 0) { ++ if (!cma_comp_exch(id_priv, work->old_state, work->new_state)) ++ goto out_unlock; + } + +-out_unlock: +- mutex_unlock(&id_priv->handler_mutex); +- cma_id_put(id_priv); +-out_free: +- kfree(work); +-} +- +-static void cma_ndev_work_handler(struct work_struct *_work) +-{ +- struct cma_ndev_work *work = container_of(_work, struct cma_ndev_work, work); +- struct rdma_id_private *id_priv = work->id; +- +- mutex_lock(&id_priv->handler_mutex); +- if (id_priv->state == RDMA_CM_DESTROYING || +- id_priv->state == RDMA_CM_DEVICE_REMOVAL) +- goto out_unlock; +- + if (cma_cm_event_handler(id_priv, &work->event)) { + cma_id_put(id_priv); + destroy_id_handler_unlock(id_priv); +@@ -4652,7 +4628,7 @@ EXPORT_SYMBOL(rdma_leave_multicast); + static int cma_netdev_change(struct net_device *ndev, struct rdma_id_private *id_priv) + { + struct rdma_dev_addr *dev_addr; +- struct cma_ndev_work *work; ++ struct cma_work *work; + + dev_addr = &id_priv->id.route.addr.dev_addr; + +@@ -4665,7 +4641,7 @@ static int cma_netdev_change(struct net_device *ndev, struct rdma_id_private *id + if (!work) + return -ENOMEM; + +- INIT_WORK(&work->work, cma_ndev_work_handler); ++ INIT_WORK(&work->work, cma_work_handler); + work->id = id_priv; + work->event.event = RDMA_CM_EVENT_ADDR_CHANGE; + cma_id_get(id_priv); +-- +2.25.1 + diff --git a/queue-5.8/rdma-cma-consolidate-the-destruction-of-a-cma_multic.patch b/queue-5.8/rdma-cma-consolidate-the-destruction-of-a-cma_multic.patch new file mode 100644 index 00000000000..d083519500c --- /dev/null +++ b/queue-5.8/rdma-cma-consolidate-the-destruction-of-a-cma_multic.patch @@ -0,0 +1,116 @@ +From 3fb72b250a3a76bb23f895186e4437426086838d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 11:11:21 +0300 +Subject: RDMA/cma: Consolidate the destruction of a cma_multicast in one place + +From: Jason Gunthorpe + +[ Upstream commit 3788d2997bc0150ea911a964d5b5a2e11808a936 ] + +Two places were open coding this sequence, and also pull in +cma_leave_roce_mc_group() which was called only once. + +Link: https://lore.kernel.org/r/20200902081122.745412-8-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 63 +++++++++++++++++------------------ + 1 file changed, 31 insertions(+), 32 deletions(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 0c3c7b85c65df..32cb654fe4b8c 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -1777,19 +1777,30 @@ static void cma_release_port(struct rdma_id_private *id_priv) + mutex_unlock(&lock); + } + +-static void cma_leave_roce_mc_group(struct rdma_id_private *id_priv, +- struct cma_multicast *mc) ++static void destroy_mc(struct rdma_id_private *id_priv, ++ struct cma_multicast *mc) + { +- struct rdma_dev_addr *dev_addr = &id_priv->id.route.addr.dev_addr; +- struct net_device *ndev = NULL; ++ if (rdma_cap_ib_mcast(id_priv->id.device, id_priv->id.port_num)) { ++ ib_sa_free_multicast(mc->multicast.ib); ++ kfree(mc); ++ return; ++ } + +- if (dev_addr->bound_dev_if) +- ndev = dev_get_by_index(dev_addr->net, dev_addr->bound_dev_if); +- if (ndev) { +- cma_igmp_send(ndev, &mc->multicast.ib->rec.mgid, false); +- dev_put(ndev); ++ if (rdma_protocol_roce(id_priv->id.device, ++ id_priv->id.port_num)) { ++ struct rdma_dev_addr *dev_addr = ++ &id_priv->id.route.addr.dev_addr; ++ struct net_device *ndev = NULL; ++ ++ if (dev_addr->bound_dev_if) ++ ndev = dev_get_by_index(dev_addr->net, ++ dev_addr->bound_dev_if); ++ if (ndev) { ++ cma_igmp_send(ndev, &mc->multicast.ib->rec.mgid, false); ++ dev_put(ndev); ++ } ++ kref_put(&mc->mcref, release_mc); + } +- kref_put(&mc->mcref, release_mc); + } + + static void cma_leave_mc_groups(struct rdma_id_private *id_priv) +@@ -1797,16 +1808,10 @@ static void cma_leave_mc_groups(struct rdma_id_private *id_priv) + struct cma_multicast *mc; + + while (!list_empty(&id_priv->mc_list)) { +- mc = container_of(id_priv->mc_list.next, +- struct cma_multicast, list); ++ mc = list_first_entry(&id_priv->mc_list, struct cma_multicast, ++ list); + list_del(&mc->list); +- if (rdma_cap_ib_mcast(id_priv->cma_dev->device, +- id_priv->id.port_num)) { +- ib_sa_free_multicast(mc->multicast.ib); +- kfree(mc); +- } else { +- cma_leave_roce_mc_group(id_priv, mc); +- } ++ destroy_mc(id_priv, mc); + } + } + +@@ -4595,20 +4600,14 @@ void rdma_leave_multicast(struct rdma_cm_id *id, struct sockaddr *addr) + id_priv = container_of(id, struct rdma_id_private, id); + spin_lock_irq(&id_priv->lock); + list_for_each_entry(mc, &id_priv->mc_list, list) { +- if (!memcmp(&mc->addr, addr, rdma_addr_size(addr))) { +- list_del(&mc->list); +- spin_unlock_irq(&id_priv->lock); +- +- BUG_ON(id_priv->cma_dev->device != id->device); ++ if (memcmp(&mc->addr, addr, rdma_addr_size(addr)) != 0) ++ continue; ++ list_del(&mc->list); ++ spin_unlock_irq(&id_priv->lock); + +- if (rdma_cap_ib_mcast(id->device, id->port_num)) { +- ib_sa_free_multicast(mc->multicast.ib); +- kfree(mc); +- } else if (rdma_protocol_roce(id->device, id->port_num)) { +- cma_leave_roce_mc_group(id_priv, mc); +- } +- return; +- } ++ WARN_ON(id_priv->cma_dev->device != id->device); ++ destroy_mc(id_priv, mc); ++ return; + } + spin_unlock_irq(&id_priv->lock); + } +-- +2.25.1 + diff --git a/queue-5.8/rdma-cma-fix-use-after-free-race-in-roce-multicast-j.patch b/queue-5.8/rdma-cma-fix-use-after-free-race-in-roce-multicast-j.patch new file mode 100644 index 00000000000..49609a38432 --- /dev/null +++ b/queue-5.8/rdma-cma-fix-use-after-free-race-in-roce-multicast-j.patch @@ -0,0 +1,393 @@ +From 4160a19360820bf8fd051b56d54261c7e6e37597 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 11:11:22 +0300 +Subject: RDMA/cma: Fix use after free race in roce multicast join + +From: Jason Gunthorpe + +[ Upstream commit b5de0c60cc30c2a3513c7188c73f3f29acc29234 ] + +The roce path triggers a work queue that continues to touch the id_priv +but doesn't hold any reference on it. Futher, unlike in the IB case, the +work queue is not fenced during rdma_destroy_id(). + +This can trigger a use after free if a destroy is triggered in the +incredibly narrow window after the queue_work and the work starting and +obtaining the handler_mutex. + +The only purpose of this work queue is to run the ULP event callback from +the standard context, so switch the design to use the existing +cma_work_handler() scheme. This simplifies quite a lot of the flow: + +- Use the cma_work_handler() callback to launch the work for roce. This + requires generating the event synchronously inside the + rdma_join_multicast(), which in turn means the dummy struct + ib_sa_multicast can become a simple stack variable. + +- cm_work_handler() used the id_priv kref, so we can entirely eliminate + the kref inside struct cma_multicast. Since the cma_multicast never + leaks into an unprotected work queue the kfree can be done at the same + time as for IB. + +- Eliminating the general multicast.ib requires using cma_set_mgid() in a + few places to recompute the mgid. + +Fixes: 3c86aa70bf67 ("RDMA/cm: Add RDMA CM support for IBoE devices") +Link: https://lore.kernel.org/r/20200902081122.745412-9-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 196 +++++++++++++++------------------- + 1 file changed, 88 insertions(+), 108 deletions(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 32cb654fe4b8c..d28c7c6940b00 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -68,6 +68,9 @@ static const char * const cma_events[] = { + [RDMA_CM_EVENT_TIMEWAIT_EXIT] = "timewait exit", + }; + ++static void cma_set_mgid(struct rdma_id_private *id_priv, struct sockaddr *addr, ++ union ib_gid *mgid); ++ + const char *__attribute_const__ rdma_event_msg(enum rdma_cm_event_type event) + { + size_t index = event; +@@ -345,13 +348,10 @@ struct ib_device *cma_get_ib_dev(struct cma_device *cma_dev) + + struct cma_multicast { + struct rdma_id_private *id_priv; +- union { +- struct ib_sa_multicast *ib; +- } multicast; ++ struct ib_sa_multicast *sa_mc; + struct list_head list; + void *context; + struct sockaddr_storage addr; +- struct kref mcref; + u8 join_state; + }; + +@@ -363,12 +363,6 @@ struct cma_work { + struct rdma_cm_event event; + }; + +-struct iboe_mcast_work { +- struct work_struct work; +- struct rdma_id_private *id; +- struct cma_multicast *mc; +-}; +- + union cma_ip_addr { + struct in6_addr ip6; + struct { +@@ -477,14 +471,6 @@ static void cma_attach_to_dev(struct rdma_id_private *id_priv, + rdma_start_port(cma_dev->device)]; + } + +-static inline void release_mc(struct kref *kref) +-{ +- struct cma_multicast *mc = container_of(kref, struct cma_multicast, mcref); +- +- kfree(mc->multicast.ib); +- kfree(mc); +-} +- + static void cma_release_dev(struct rdma_id_private *id_priv) + { + mutex_lock(&lock); +@@ -1780,14 +1766,10 @@ static void cma_release_port(struct rdma_id_private *id_priv) + static void destroy_mc(struct rdma_id_private *id_priv, + struct cma_multicast *mc) + { +- if (rdma_cap_ib_mcast(id_priv->id.device, id_priv->id.port_num)) { +- ib_sa_free_multicast(mc->multicast.ib); +- kfree(mc); +- return; +- } ++ if (rdma_cap_ib_mcast(id_priv->id.device, id_priv->id.port_num)) ++ ib_sa_free_multicast(mc->sa_mc); + +- if (rdma_protocol_roce(id_priv->id.device, +- id_priv->id.port_num)) { ++ if (rdma_protocol_roce(id_priv->id.device, id_priv->id.port_num)) { + struct rdma_dev_addr *dev_addr = + &id_priv->id.route.addr.dev_addr; + struct net_device *ndev = NULL; +@@ -1796,11 +1778,15 @@ static void destroy_mc(struct rdma_id_private *id_priv, + ndev = dev_get_by_index(dev_addr->net, + dev_addr->bound_dev_if); + if (ndev) { +- cma_igmp_send(ndev, &mc->multicast.ib->rec.mgid, false); ++ union ib_gid mgid; ++ ++ cma_set_mgid(id_priv, (struct sockaddr *)&mc->addr, ++ &mgid); ++ cma_igmp_send(ndev, &mgid, false); + dev_put(ndev); + } +- kref_put(&mc->mcref, release_mc); + } ++ kfree(mc); + } + + static void cma_leave_mc_groups(struct rdma_id_private *id_priv) +@@ -2663,6 +2649,8 @@ static void cma_work_handler(struct work_struct *_work) + mutex_unlock(&id_priv->handler_mutex); + cma_id_put(id_priv); + out_free: ++ if (work->event.event == RDMA_CM_EVENT_MULTICAST_JOIN) ++ rdma_destroy_ah_attr(&work->event.param.ud.ah_attr); + kfree(work); + } + +@@ -4276,53 +4264,66 @@ int rdma_disconnect(struct rdma_cm_id *id) + } + EXPORT_SYMBOL(rdma_disconnect); + ++static void cma_make_mc_event(int status, struct rdma_id_private *id_priv, ++ struct ib_sa_multicast *multicast, ++ struct rdma_cm_event *event, ++ struct cma_multicast *mc) ++{ ++ struct rdma_dev_addr *dev_addr; ++ enum ib_gid_type gid_type; ++ struct net_device *ndev; ++ ++ if (!status) ++ status = cma_set_qkey(id_priv, be32_to_cpu(multicast->rec.qkey)); ++ else ++ pr_debug_ratelimited("RDMA CM: MULTICAST_ERROR: failed to join multicast. status %d\n", ++ status); ++ ++ event->status = status; ++ event->param.ud.private_data = mc->context; ++ if (status) { ++ event->event = RDMA_CM_EVENT_MULTICAST_ERROR; ++ return; ++ } ++ ++ dev_addr = &id_priv->id.route.addr.dev_addr; ++ ndev = dev_get_by_index(dev_addr->net, dev_addr->bound_dev_if); ++ gid_type = ++ id_priv->cma_dev ++ ->default_gid_type[id_priv->id.port_num - ++ rdma_start_port( ++ id_priv->cma_dev->device)]; ++ ++ event->event = RDMA_CM_EVENT_MULTICAST_JOIN; ++ if (ib_init_ah_from_mcmember(id_priv->id.device, id_priv->id.port_num, ++ &multicast->rec, ndev, gid_type, ++ &event->param.ud.ah_attr)) { ++ event->event = RDMA_CM_EVENT_MULTICAST_ERROR; ++ goto out; ++ } ++ ++ event->param.ud.qp_num = 0xFFFFFF; ++ event->param.ud.qkey = be32_to_cpu(multicast->rec.qkey); ++ ++out: ++ if (ndev) ++ dev_put(ndev); ++} ++ + static int cma_ib_mc_handler(int status, struct ib_sa_multicast *multicast) + { +- struct rdma_id_private *id_priv; + struct cma_multicast *mc = multicast->context; ++ struct rdma_id_private *id_priv = mc->id_priv; + struct rdma_cm_event event = {}; + int ret = 0; + +- id_priv = mc->id_priv; + mutex_lock(&id_priv->handler_mutex); + if (id_priv->state != RDMA_CM_ADDR_BOUND && + id_priv->state != RDMA_CM_ADDR_RESOLVED) + goto out; + +- if (!status) +- status = cma_set_qkey(id_priv, be32_to_cpu(multicast->rec.qkey)); +- else +- pr_debug_ratelimited("RDMA CM: MULTICAST_ERROR: failed to join multicast. status %d\n", +- status); +- event.status = status; +- event.param.ud.private_data = mc->context; +- if (!status) { +- struct rdma_dev_addr *dev_addr = +- &id_priv->id.route.addr.dev_addr; +- struct net_device *ndev = +- dev_get_by_index(dev_addr->net, dev_addr->bound_dev_if); +- enum ib_gid_type gid_type = +- id_priv->cma_dev->default_gid_type[id_priv->id.port_num - +- rdma_start_port(id_priv->cma_dev->device)]; +- +- event.event = RDMA_CM_EVENT_MULTICAST_JOIN; +- ret = ib_init_ah_from_mcmember(id_priv->id.device, +- id_priv->id.port_num, +- &multicast->rec, +- ndev, gid_type, +- &event.param.ud.ah_attr); +- if (ret) +- event.event = RDMA_CM_EVENT_MULTICAST_ERROR; +- +- event.param.ud.qp_num = 0xFFFFFF; +- event.param.ud.qkey = be32_to_cpu(multicast->rec.qkey); +- if (ndev) +- dev_put(ndev); +- } else +- event.event = RDMA_CM_EVENT_MULTICAST_ERROR; +- ++ cma_make_mc_event(status, id_priv, multicast, &event, mc); + ret = cma_cm_event_handler(id_priv, &event); +- + rdma_destroy_ah_attr(&event.param.ud.ah_attr); + if (ret) { + destroy_id_handler_unlock(id_priv); +@@ -4412,23 +4413,10 @@ static int cma_join_ib_multicast(struct rdma_id_private *id_priv, + IB_SA_MCMEMBER_REC_MTU | + IB_SA_MCMEMBER_REC_HOP_LIMIT; + +- mc->multicast.ib = ib_sa_join_multicast(&sa_client, id_priv->id.device, +- id_priv->id.port_num, &rec, +- comp_mask, GFP_KERNEL, +- cma_ib_mc_handler, mc); +- return PTR_ERR_OR_ZERO(mc->multicast.ib); +-} +- +-static void iboe_mcast_work_handler(struct work_struct *work) +-{ +- struct iboe_mcast_work *mw = container_of(work, struct iboe_mcast_work, work); +- struct cma_multicast *mc = mw->mc; +- struct ib_sa_multicast *m = mc->multicast.ib; +- +- mc->multicast.ib->context = mc; +- cma_ib_mc_handler(0, m); +- kref_put(&mc->mcref, release_mc); +- kfree(mw); ++ mc->sa_mc = ib_sa_join_multicast(&sa_client, id_priv->id.device, ++ id_priv->id.port_num, &rec, comp_mask, ++ GFP_KERNEL, cma_ib_mc_handler, mc); ++ return PTR_ERR_OR_ZERO(mc->sa_mc); + } + + static void cma_iboe_set_mgid(struct sockaddr *addr, union ib_gid *mgid, +@@ -4463,52 +4451,47 @@ static void cma_iboe_set_mgid(struct sockaddr *addr, union ib_gid *mgid, + static int cma_iboe_join_multicast(struct rdma_id_private *id_priv, + struct cma_multicast *mc) + { +- struct iboe_mcast_work *work; ++ struct cma_work *work; + struct rdma_dev_addr *dev_addr = &id_priv->id.route.addr.dev_addr; + int err = 0; + struct sockaddr *addr = (struct sockaddr *)&mc->addr; + struct net_device *ndev = NULL; ++ struct ib_sa_multicast ib; + enum ib_gid_type gid_type; + bool send_only; + + send_only = mc->join_state == BIT(SENDONLY_FULLMEMBER_JOIN); + +- if (cma_zero_addr((struct sockaddr *)&mc->addr)) ++ if (cma_zero_addr(addr)) + return -EINVAL; + + work = kzalloc(sizeof *work, GFP_KERNEL); + if (!work) + return -ENOMEM; + +- mc->multicast.ib = kzalloc(sizeof(struct ib_sa_multicast), GFP_KERNEL); +- if (!mc->multicast.ib) { +- err = -ENOMEM; +- goto out1; +- } +- + gid_type = id_priv->cma_dev->default_gid_type[id_priv->id.port_num - + rdma_start_port(id_priv->cma_dev->device)]; +- cma_iboe_set_mgid(addr, &mc->multicast.ib->rec.mgid, gid_type); ++ cma_iboe_set_mgid(addr, &ib.rec.mgid, gid_type); + +- mc->multicast.ib->rec.pkey = cpu_to_be16(0xffff); ++ ib.rec.pkey = cpu_to_be16(0xffff); + if (id_priv->id.ps == RDMA_PS_UDP) +- mc->multicast.ib->rec.qkey = cpu_to_be32(RDMA_UDP_QKEY); ++ ib.rec.qkey = cpu_to_be32(RDMA_UDP_QKEY); + + if (dev_addr->bound_dev_if) + ndev = dev_get_by_index(dev_addr->net, dev_addr->bound_dev_if); + if (!ndev) { + err = -ENODEV; +- goto out2; ++ goto err_free; + } +- mc->multicast.ib->rec.rate = iboe_get_rate(ndev); +- mc->multicast.ib->rec.hop_limit = 1; +- mc->multicast.ib->rec.mtu = iboe_get_mtu(ndev->mtu); ++ ib.rec.rate = iboe_get_rate(ndev); ++ ib.rec.hop_limit = 1; ++ ib.rec.mtu = iboe_get_mtu(ndev->mtu); + + if (addr->sa_family == AF_INET) { + if (gid_type == IB_GID_TYPE_ROCE_UDP_ENCAP) { +- mc->multicast.ib->rec.hop_limit = IPV6_DEFAULT_HOPLIMIT; ++ ib.rec.hop_limit = IPV6_DEFAULT_HOPLIMIT; + if (!send_only) { +- err = cma_igmp_send(ndev, &mc->multicast.ib->rec.mgid, ++ err = cma_igmp_send(ndev, &ib.rec.mgid, + true); + } + } +@@ -4517,24 +4500,22 @@ static int cma_iboe_join_multicast(struct rdma_id_private *id_priv, + err = -ENOTSUPP; + } + dev_put(ndev); +- if (err || !mc->multicast.ib->rec.mtu) { ++ if (err || !ib.rec.mtu) { + if (!err) + err = -EINVAL; +- goto out2; ++ goto err_free; + } + rdma_ip2gid((struct sockaddr *)&id_priv->id.route.addr.src_addr, +- &mc->multicast.ib->rec.port_gid); ++ &ib.rec.port_gid); + work->id = id_priv; +- work->mc = mc; +- INIT_WORK(&work->work, iboe_mcast_work_handler); +- kref_get(&mc->mcref); ++ INIT_WORK(&work->work, cma_work_handler); ++ cma_make_mc_event(0, id_priv, &ib, &work->event, mc); ++ /* Balances with cma_id_put() in cma_work_handler */ ++ cma_id_get(id_priv); + queue_work(cma_wq, &work->work); +- + return 0; + +-out2: +- kfree(mc->multicast.ib); +-out1: ++err_free: + kfree(work); + return err; + } +@@ -4558,7 +4539,7 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr, + !cma_comp(id_priv, RDMA_CM_ADDR_RESOLVED)) + return -EINVAL; + +- mc = kmalloc(sizeof *mc, GFP_KERNEL); ++ mc = kzalloc(sizeof(*mc), GFP_KERNEL); + if (!mc) + return -ENOMEM; + +@@ -4568,7 +4549,6 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr, + mc->join_state = join_state; + + if (rdma_protocol_roce(id->device, id->port_num)) { +- kref_init(&mc->mcref); + ret = cma_iboe_join_multicast(id_priv, mc); + if (ret) + goto out_err; +-- +2.25.1 + diff --git a/queue-5.8/rdma-cma-remove-dead-code-for-kernel-rdmacm-multicas.patch b/queue-5.8/rdma-cma-remove-dead-code-for-kernel-rdmacm-multicas.patch new file mode 100644 index 00000000000..619f38e459e --- /dev/null +++ b/queue-5.8/rdma-cma-remove-dead-code-for-kernel-rdmacm-multicas.patch @@ -0,0 +1,69 @@ +From a24a5418cbac668ed54b00537d9ef14c3626c0e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 11:11:20 +0300 +Subject: RDMA/cma: Remove dead code for kernel rdmacm multicast + +From: Jason Gunthorpe + +[ Upstream commit 1bb5091def706732c749df9aae45fbca003696f2 ] + +There is no kernel user of RDMA CM multicast so this code managing the +multicast subscription of the kernel-only internal QP is dead. Remove it. + +This makes the bug fixes in the next patches much simpler. + +Link: https://lore.kernel.org/r/20200902081122.745412-7-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 19 ++++--------------- + 1 file changed, 4 insertions(+), 15 deletions(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 015b2fe509dca..0c3c7b85c65df 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -4289,16 +4289,6 @@ static int cma_ib_mc_handler(int status, struct ib_sa_multicast *multicast) + else + pr_debug_ratelimited("RDMA CM: MULTICAST_ERROR: failed to join multicast. status %d\n", + status); +- mutex_lock(&id_priv->qp_mutex); +- if (!status && id_priv->id.qp) { +- status = ib_attach_mcast(id_priv->id.qp, &multicast->rec.mgid, +- be16_to_cpu(multicast->rec.mlid)); +- if (status) +- pr_debug_ratelimited("RDMA CM: MULTICAST_ERROR: failed to attach QP. status %d\n", +- status); +- } +- mutex_unlock(&id_priv->qp_mutex); +- + event.status = status; + event.param.ud.private_data = mc->context; + if (!status) { +@@ -4551,6 +4541,10 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr, + struct cma_multicast *mc; + int ret; + ++ /* Not supported for kernel QPs */ ++ if (WARN_ON(id->qp)) ++ return -EINVAL; ++ + if (!id->device) + return -EINVAL; + +@@ -4605,11 +4599,6 @@ void rdma_leave_multicast(struct rdma_cm_id *id, struct sockaddr *addr) + list_del(&mc->list); + spin_unlock_irq(&id_priv->lock); + +- if (id->qp) +- ib_detach_mcast(id->qp, +- &mc->multicast.ib->rec.mgid, +- be16_to_cpu(mc->multicast.ib->rec.mlid)); +- + BUG_ON(id_priv->cma_dev->device != id->device); + + if (rdma_cap_ib_mcast(id->device, id->port_num)) { +-- +2.25.1 + diff --git a/queue-5.8/rdma-core-delete-function-indirection-for-alloc-free.patch b/queue-5.8/rdma-core-delete-function-indirection-for-alloc-free.patch new file mode 100644 index 00000000000..1b419878aba --- /dev/null +++ b/queue-5.8/rdma-core-delete-function-indirection-for-alloc-free.patch @@ -0,0 +1,196 @@ +From ffc4fd2c4a18a9353b06ad18d8e112fc5d97a18f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 15:09:17 +0300 +Subject: RDMA/core: Delete function indirection for alloc/free kernel CQ + +From: Leon Romanovsky + +[ Upstream commit 7e3c66c9a989d5b53387ceebc88b9e4a9b1d6434 ] + +The ib_alloc_cq*() and ib_free_cq*() are solely kernel verbs to manage CQs +and doesn't need extra indirection just to call same functions with +constant parameter NULL as udata. + +Link: https://lore.kernel.org/r/20200907120921.476363-6-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cq.c | 27 +++++++--------- + include/rdma/ib_verbs.h | 62 ++++-------------------------------- + 2 files changed, 18 insertions(+), 71 deletions(-) + +diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c +index a92fc3f90bb5b..2efe825689e3e 100644 +--- a/drivers/infiniband/core/cq.c ++++ b/drivers/infiniband/core/cq.c +@@ -197,24 +197,22 @@ static void ib_cq_completion_workqueue(struct ib_cq *cq, void *private) + } + + /** +- * __ib_alloc_cq_user - allocate a completion queue ++ * __ib_alloc_cq allocate a completion queue + * @dev: device to allocate the CQ for + * @private: driver private data, accessible from cq->cq_context + * @nr_cqe: number of CQEs to allocate + * @comp_vector: HCA completion vectors for this CQ + * @poll_ctx: context to poll the CQ from. + * @caller: module owner name. +- * @udata: Valid user data or NULL for kernel object + * + * This is the proper interface to allocate a CQ for in-kernel users. A + * CQ allocated with this interface will automatically be polled from the + * specified context. The ULP must use wr->wr_cqe instead of wr->wr_id + * to use this CQ abstraction. + */ +-struct ib_cq *__ib_alloc_cq_user(struct ib_device *dev, void *private, +- int nr_cqe, int comp_vector, +- enum ib_poll_context poll_ctx, +- const char *caller, struct ib_udata *udata) ++struct ib_cq *__ib_alloc_cq(struct ib_device *dev, void *private, int nr_cqe, ++ int comp_vector, enum ib_poll_context poll_ctx, ++ const char *caller) + { + struct ib_cq_init_attr cq_attr = { + .cqe = nr_cqe, +@@ -277,7 +275,7 @@ struct ib_cq *__ib_alloc_cq_user(struct ib_device *dev, void *private, + out_destroy_cq: + rdma_dim_destroy(cq); + rdma_restrack_del(&cq->res); +- cq->device->ops.destroy_cq(cq, udata); ++ cq->device->ops.destroy_cq(cq, NULL); + out_free_wc: + kfree(cq->wc); + out_free_cq: +@@ -285,7 +283,7 @@ struct ib_cq *__ib_alloc_cq_user(struct ib_device *dev, void *private, + trace_cq_alloc_error(nr_cqe, comp_vector, poll_ctx, ret); + return ERR_PTR(ret); + } +-EXPORT_SYMBOL(__ib_alloc_cq_user); ++EXPORT_SYMBOL(__ib_alloc_cq); + + /** + * __ib_alloc_cq_any - allocate a completion queue +@@ -310,17 +308,16 @@ struct ib_cq *__ib_alloc_cq_any(struct ib_device *dev, void *private, + atomic_inc_return(&counter) % + min_t(int, dev->num_comp_vectors, num_online_cpus()); + +- return __ib_alloc_cq_user(dev, private, nr_cqe, comp_vector, poll_ctx, +- caller, NULL); ++ return __ib_alloc_cq(dev, private, nr_cqe, comp_vector, poll_ctx, ++ caller); + } + EXPORT_SYMBOL(__ib_alloc_cq_any); + + /** +- * ib_free_cq_user - free a completion queue ++ * ib_free_cq - free a completion queue + * @cq: completion queue to free. +- * @udata: User data or NULL for kernel object + */ +-void ib_free_cq_user(struct ib_cq *cq, struct ib_udata *udata) ++void ib_free_cq(struct ib_cq *cq) + { + if (WARN_ON_ONCE(atomic_read(&cq->usecnt))) + return; +@@ -344,11 +341,11 @@ void ib_free_cq_user(struct ib_cq *cq, struct ib_udata *udata) + rdma_dim_destroy(cq); + trace_cq_free(cq); + rdma_restrack_del(&cq->res); +- cq->device->ops.destroy_cq(cq, udata); ++ cq->device->ops.destroy_cq(cq, NULL); + kfree(cq->wc); + kfree(cq); + } +-EXPORT_SYMBOL(ib_free_cq_user); ++EXPORT_SYMBOL(ib_free_cq); + + void ib_cq_pool_init(struct ib_device *dev) + { +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index ef2f3986c4933..bfd1f38c495c7 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -3834,46 +3834,15 @@ static inline int ib_post_recv(struct ib_qp *qp, + return qp->device->ops.post_recv(qp, recv_wr, bad_recv_wr ? : &dummy); + } + +-struct ib_cq *__ib_alloc_cq_user(struct ib_device *dev, void *private, +- int nr_cqe, int comp_vector, +- enum ib_poll_context poll_ctx, +- const char *caller, struct ib_udata *udata); +- +-/** +- * ib_alloc_cq_user: Allocate kernel/user CQ +- * @dev: The IB device +- * @private: Private data attached to the CQE +- * @nr_cqe: Number of CQEs in the CQ +- * @comp_vector: Completion vector used for the IRQs +- * @poll_ctx: Context used for polling the CQ +- * @udata: Valid user data or NULL for kernel objects +- */ +-static inline struct ib_cq *ib_alloc_cq_user(struct ib_device *dev, +- void *private, int nr_cqe, +- int comp_vector, +- enum ib_poll_context poll_ctx, +- struct ib_udata *udata) +-{ +- return __ib_alloc_cq_user(dev, private, nr_cqe, comp_vector, poll_ctx, +- KBUILD_MODNAME, udata); +-} +- +-/** +- * ib_alloc_cq: Allocate kernel CQ +- * @dev: The IB device +- * @private: Private data attached to the CQE +- * @nr_cqe: Number of CQEs in the CQ +- * @comp_vector: Completion vector used for the IRQs +- * @poll_ctx: Context used for polling the CQ +- * +- * NOTE: for user cq use ib_alloc_cq_user with valid udata! +- */ ++struct ib_cq *__ib_alloc_cq(struct ib_device *dev, void *private, int nr_cqe, ++ int comp_vector, enum ib_poll_context poll_ctx, ++ const char *caller); + static inline struct ib_cq *ib_alloc_cq(struct ib_device *dev, void *private, + int nr_cqe, int comp_vector, + enum ib_poll_context poll_ctx) + { +- return ib_alloc_cq_user(dev, private, nr_cqe, comp_vector, poll_ctx, +- NULL); ++ return __ib_alloc_cq(dev, private, nr_cqe, comp_vector, poll_ctx, ++ KBUILD_MODNAME); + } + + struct ib_cq *__ib_alloc_cq_any(struct ib_device *dev, void *private, +@@ -3895,26 +3864,7 @@ static inline struct ib_cq *ib_alloc_cq_any(struct ib_device *dev, + KBUILD_MODNAME); + } + +-/** +- * ib_free_cq_user - Free kernel/user CQ +- * @cq: The CQ to free +- * @udata: Valid user data or NULL for kernel objects +- * +- * NOTE: This function shouldn't be called on shared CQs. +- */ +-void ib_free_cq_user(struct ib_cq *cq, struct ib_udata *udata); +- +-/** +- * ib_free_cq - Free kernel CQ +- * @cq: The CQ to free +- * +- * NOTE: for user cq use ib_free_cq_user with valid udata! +- */ +-static inline void ib_free_cq(struct ib_cq *cq) +-{ +- ib_free_cq_user(cq, NULL); +-} +- ++void ib_free_cq(struct ib_cq *cq); + int ib_process_cq_direct(struct ib_cq *cq, int budget); + + /** +-- +2.25.1 + diff --git a/queue-5.8/rdma-hns-add-a-check-for-current-state-before-modify.patch b/queue-5.8/rdma-hns-add-a-check-for-current-state-before-modify.patch new file mode 100644 index 00000000000..a7ce13df77b --- /dev/null +++ b/queue-5.8/rdma-hns-add-a-check-for-current-state-before-modify.patch @@ -0,0 +1,45 @@ +From 694d789279debb89c3fe2b34c9b9537a8e746cc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 19:07:54 +0800 +Subject: RDMA/hns: Add a check for current state before modifying QP + +From: Lang Cheng + +[ Upstream commit e0ef0f68c4c0d85b1eb63f38d5d10324361280e8 ] + +It should be considered an illegal operation if the ULP attempts to modify +a QP from another state to the current hardware state. Otherwise, the ULP +can modify some fields of QPC at any time. For example, for a QP in state +of RTS, modify it from RTR to RTS can change the PSN, which is always not +as expected. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Link: https://lore.kernel.org/r/1598353674-24270-1-git-send-email-liweihang@huawei.com +Signed-off-by: Lang Cheng +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 4edea397b6b80..4486c9b7c3e43 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -1171,8 +1171,10 @@ int hns_roce_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + + mutex_lock(&hr_qp->mutex); + +- cur_state = attr_mask & IB_QP_CUR_STATE ? +- attr->cur_qp_state : (enum ib_qp_state)hr_qp->state; ++ if (attr_mask & IB_QP_CUR_STATE && attr->cur_qp_state != hr_qp->state) ++ goto out; ++ ++ cur_state = hr_qp->state; + new_state = attr_mask & IB_QP_STATE ? attr->qp_state : cur_state; + + if (ibqp->uobject && +-- +2.25.1 + diff --git a/queue-5.8/rdma-hns-add-check-for-the-validity-of-sl-configurat.patch b/queue-5.8/rdma-hns-add-check-for-the-validity-of-sl-configurat.patch new file mode 100644 index 00000000000..03a1af3ef10 --- /dev/null +++ b/queue-5.8/rdma-hns-add-check-for-the-validity-of-sl-configurat.patch @@ -0,0 +1,67 @@ +From cdf41b47a3b6b096c8f8ea40581f72ec2c99cce3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Sep 2020 18:03:18 +0800 +Subject: RDMA/hns: Add check for the validity of sl configuration + +From: Jiaran Zhang + +[ Upstream commit 172505cfa3a8ee98acaa569fd3be97697b333958 ] + +According to the RoCE v1 specification, the sl (service level) 0-7 are +mapped directly to priorities 0-7 respectively, sl 8-15 are reserved. The +driver should verify whether the the value of sl is larger than 7, if so, +an exception should be returned. + +Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") +Link: https://lore.kernel.org/r/1600509802-44382-5-git-send-email-liweihang@huawei.com +Signed-off-by: Jiaran Zhang +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 12 ++++++++++-- + drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 ++ + 2 files changed, 12 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 38a48ab3e1d02..0f995aa23b9a9 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -4287,11 +4287,19 @@ static int hns_roce_v2_set_path(struct ib_qp *ibqp, + V2_QPC_BYTE_28_FL_S, 0); + memcpy(context->dgid, grh->dgid.raw, sizeof(grh->dgid.raw)); + memset(qpc_mask->dgid, 0, sizeof(grh->dgid.raw)); ++ ++ hr_qp->sl = rdma_ah_get_sl(&attr->ah_attr); ++ if (unlikely(hr_qp->sl > MAX_SERVICE_LEVEL)) { ++ ibdev_err(ibdev, ++ "failed to fill QPC, sl (%d) shouldn't be larger than %d.\n", ++ hr_qp->sl, MAX_SERVICE_LEVEL); ++ return -EINVAL; ++ } ++ + roce_set_field(context->byte_28_at_fl, V2_QPC_BYTE_28_SL_M, +- V2_QPC_BYTE_28_SL_S, rdma_ah_get_sl(&attr->ah_attr)); ++ V2_QPC_BYTE_28_SL_S, hr_qp->sl); + roce_set_field(qpc_mask->byte_28_at_fl, V2_QPC_BYTE_28_SL_M, + V2_QPC_BYTE_28_SL_S, 0); +- hr_qp->sl = rdma_ah_get_sl(&attr->ah_attr); + + return 0; + } +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +index 4f840997c6c73..c6a280bdbfaaf 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +@@ -1957,6 +1957,8 @@ struct hns_roce_eq_context { + #define HNS_ROCE_V2_AEQE_EVENT_QUEUE_NUM_S 0 + #define HNS_ROCE_V2_AEQE_EVENT_QUEUE_NUM_M GENMASK(23, 0) + ++#define MAX_SERVICE_LEVEL 0x7 ++ + struct hns_roce_wqe_atomic_seg { + __le64 fetchadd_swap_data; + __le64 cmp_data; +-- +2.25.1 + diff --git a/queue-5.8/rdma-hns-fix-configuration-of-ack_req_freq-in-qpc.patch b/queue-5.8/rdma-hns-fix-configuration-of-ack_req_freq-in-qpc.patch new file mode 100644 index 00000000000..cba7c9335af --- /dev/null +++ b/queue-5.8/rdma-hns-fix-configuration-of-ack_req_freq-in-qpc.patch @@ -0,0 +1,73 @@ +From 3edd009cb5245314897aa74d997cd6a3daa4cfe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Sep 2020 18:03:21 +0800 +Subject: RDMA/hns: Fix configuration of ack_req_freq in QPC + +From: Weihang Li + +[ Upstream commit fbed9d2be292504e04caa2057e3a9477a1e1d040 ] + +The hardware will add AckReq flag in BTH header according to the value of +ack_req_freq to request ACK from responder for the packets with this flag. +It should be greater than or equal to lp_pktn_ini instead of using a fixed +value. + +Fixes: 7b9bd73ed13d ("RDMA/hns: Fix wrong assignment of lp_pktn_ini in QPC") +Link: https://lore.kernel.org/r/1600509802-44382-8-git-send-email-liweihang@huawei.com +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index a55a850a8b997..d3b983d9f757b 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -3640,9 +3640,6 @@ static void modify_qp_reset_to_init(struct ib_qp *ibqp, + V2_QPC_BYTE_76_SRQ_EN_S, 1); + } + +- roce_set_field(context->byte_172_sq_psn, V2_QPC_BYTE_172_ACK_REQ_FREQ_M, +- V2_QPC_BYTE_172_ACK_REQ_FREQ_S, 4); +- + roce_set_bit(context->byte_172_sq_psn, V2_QPC_BYTE_172_FRE_S, 1); + + hr_qp->access_flags = attr->qp_access_flags; +@@ -3983,6 +3980,7 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp, + dma_addr_t trrl_ba; + dma_addr_t irrl_ba; + enum ib_mtu mtu; ++ u8 lp_pktn_ini; + u8 port_num; + u64 *mtts; + u8 *dmac; +@@ -4090,13 +4088,21 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp, + } + + #define MAX_LP_MSG_LEN 65536 +- /* MTU*(2^LP_PKTN_INI) shouldn't be bigger than 64kb */ ++ /* MTU * (2 ^ LP_PKTN_INI) shouldn't be bigger than 64KB */ ++ lp_pktn_ini = ilog2(MAX_LP_MSG_LEN / ib_mtu_enum_to_int(mtu)); ++ + roce_set_field(context->byte_56_dqpn_err, V2_QPC_BYTE_56_LP_PKTN_INI_M, +- V2_QPC_BYTE_56_LP_PKTN_INI_S, +- ilog2(MAX_LP_MSG_LEN / ib_mtu_enum_to_int(mtu))); ++ V2_QPC_BYTE_56_LP_PKTN_INI_S, lp_pktn_ini); + roce_set_field(qpc_mask->byte_56_dqpn_err, V2_QPC_BYTE_56_LP_PKTN_INI_M, + V2_QPC_BYTE_56_LP_PKTN_INI_S, 0); + ++ /* ACK_REQ_FREQ should be larger than or equal to LP_PKTN_INI */ ++ roce_set_field(context->byte_172_sq_psn, V2_QPC_BYTE_172_ACK_REQ_FREQ_M, ++ V2_QPC_BYTE_172_ACK_REQ_FREQ_S, lp_pktn_ini); ++ roce_set_field(qpc_mask->byte_172_sq_psn, ++ V2_QPC_BYTE_172_ACK_REQ_FREQ_M, ++ V2_QPC_BYTE_172_ACK_REQ_FREQ_S, 0); ++ + roce_set_bit(qpc_mask->byte_108_rx_reqepsn, + V2_QPC_BYTE_108_RX_REQ_PSN_ERR_S, 0); + roce_set_field(qpc_mask->byte_96_rx_reqmsn, V2_QPC_BYTE_96_RX_REQ_MSN_M, +-- +2.25.1 + diff --git a/queue-5.8/rdma-hns-fix-missing-sq_sig_type-when-querying-qp.patch b/queue-5.8/rdma-hns-fix-missing-sq_sig_type-when-querying-qp.patch new file mode 100644 index 00000000000..954754b5579 --- /dev/null +++ b/queue-5.8/rdma-hns-fix-missing-sq_sig_type-when-querying-qp.patch @@ -0,0 +1,36 @@ +From eb0a7a1901d2e32d080d0aa7da21f1028d8290bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Sep 2020 18:03:22 +0800 +Subject: RDMA/hns: Fix missing sq_sig_type when querying QP + +From: Weihang Li + +[ Upstream commit 05df49279f8926178ecb3ce88e61b63104cd6293 ] + +The sq_sig_type field should be filled when querying QP, or the users may +get a wrong value. + +Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") +Link: https://lore.kernel.org/r/1600509802-44382-9-git-send-email-liweihang@huawei.com +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index d3b983d9f757b..37809a0b50e25 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -4819,6 +4819,7 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, + } + + qp_init_attr->cap = qp_attr->cap; ++ qp_init_attr->sq_sig_type = hr_qp->sq_signal_bits; + + out: + mutex_unlock(&hr_qp->mutex); +-- +2.25.1 + diff --git a/queue-5.8/rdma-hns-fix-the-wrong-value-of-rnr_retry-when-query.patch b/queue-5.8/rdma-hns-fix-the-wrong-value-of-rnr_retry-when-query.patch new file mode 100644 index 00000000000..3b6b0bf4835 --- /dev/null +++ b/queue-5.8/rdma-hns-fix-the-wrong-value-of-rnr_retry-when-query.patch @@ -0,0 +1,40 @@ +From 6cbb95f6099bad6e1f85e3a871b6538b926b945b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Sep 2020 18:03:20 +0800 +Subject: RDMA/hns: Fix the wrong value of rnr_retry when querying qp + +From: Wenpeng Liang + +[ Upstream commit 99fcf82521d91468ee6115a3c253aa032dc63cbc ] + +The rnr_retry returned to the user is not correct, it should be got from +another fields in QPC. + +Fixes: bfe860351e31 ("RDMA/hns: Fix cast from or to restricted __le32 for driver") +Link: https://lore.kernel.org/r/1600509802-44382-7-git-send-email-liweihang@huawei.com +Signed-off-by: Wenpeng Liang +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index fdd9605c67630..a55a850a8b997 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -4795,7 +4795,9 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr, + qp_attr->retry_cnt = roce_get_field(context.byte_212_lsn, + V2_QPC_BYTE_212_RETRY_CNT_M, + V2_QPC_BYTE_212_RETRY_CNT_S); +- qp_attr->rnr_retry = le32_to_cpu(context.rq_rnr_timer); ++ qp_attr->rnr_retry = roce_get_field(context.byte_244_rnr_rxack, ++ V2_QPC_BYTE_244_RNR_CNT_M, ++ V2_QPC_BYTE_244_RNR_CNT_S); + + done: + qp_attr->cur_qp_state = qp_attr->qp_state; +-- +2.25.1 + diff --git a/queue-5.8/rdma-hns-set-the-unsupported-wr-opcode.patch b/queue-5.8/rdma-hns-set-the-unsupported-wr-opcode.patch new file mode 100644 index 00000000000..ede351e2a10 --- /dev/null +++ b/queue-5.8/rdma-hns-set-the-unsupported-wr-opcode.patch @@ -0,0 +1,37 @@ +From f1ac8051ef39742de47996b546ce4994925fce32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 21:50:15 +0800 +Subject: RDMA/hns: Set the unsupported wr opcode + +From: Lijun Ou + +[ Upstream commit 22d3e1ed2cc837af87f76c3c8a4ccf4455e225c5 ] + +hip06 does not support IB_WR_LOCAL_INV, so the ps_opcode should be set to +an invalid value instead of being left uninitialized. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Fixes: a2f3d4479fe9 ("RDMA/hns: Avoid unncessary initialization") +Link: https://lore.kernel.org/r/1600350615-115217-1-git-send-email-oulijun@huawei.com +Signed-off-by: Lijun Ou +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v1.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c +index 87c93f303b9a8..5a0c90e0b367b 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c +@@ -271,7 +271,6 @@ static int hns_roce_v1_post_send(struct ib_qp *ibqp, + ps_opcode = HNS_ROCE_WQE_OPCODE_SEND; + break; + case IB_WR_LOCAL_INV: +- break; + case IB_WR_ATOMIC_CMP_AND_SWP: + case IB_WR_ATOMIC_FETCH_AND_ADD: + case IB_WR_LSO: +-- +2.25.1 + diff --git a/queue-5.8/rdma-hns-solve-the-overflow-of-the-calc_pg_sz.patch b/queue-5.8/rdma-hns-solve-the-overflow-of-the-calc_pg_sz.patch new file mode 100644 index 00000000000..946f756df3d --- /dev/null +++ b/queue-5.8/rdma-hns-solve-the-overflow-of-the-calc_pg_sz.patch @@ -0,0 +1,44 @@ +From 53119405f4ba51f273e8f4284c0787788e7fd887 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Sep 2020 18:03:19 +0800 +Subject: RDMA/hns: Solve the overflow of the calc_pg_sz() + +From: Jiaran Zhang + +[ Upstream commit 768202a0825d447de785e87ff1ea1d3c86a71727 ] + +calc_pg_sz() may gets a data calculation overflow if the PAGE_SIZE is 64 KB +and hop_num is 2. It is because that all variables involved in calculation +are defined in type of int. So change the type of bt_chunk_size, +buf_chunk_size and obj_per_chunk_default to u64. + +Fixes: ba6bb7e97421 ("RDMA/hns: Add interfaces to get pf capabilities from firmware") +Link: https://lore.kernel.org/r/1600509802-44382-6-git-send-email-liweihang@huawei.com +Signed-off-by: Jiaran Zhang +Signed-off-by: Weihang Li +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +index 0f995aa23b9a9..fdd9605c67630 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +@@ -1770,9 +1770,9 @@ static void calc_pg_sz(int obj_num, int obj_size, int hop_num, int ctx_bt_num, + int *buf_page_size, int *bt_page_size, u32 hem_type) + { + u64 obj_per_chunk; +- int bt_chunk_size = 1 << PAGE_SHIFT; +- int buf_chunk_size = 1 << PAGE_SHIFT; +- int obj_per_chunk_default = buf_chunk_size / obj_size; ++ u64 bt_chunk_size = PAGE_SIZE; ++ u64 buf_chunk_size = PAGE_SIZE; ++ u64 obj_per_chunk_default = buf_chunk_size / obj_size; + + *buf_page_size = 0; + *bt_page_size = 0; +-- +2.25.1 + diff --git a/queue-5.8/rdma-ipoib-set-rtnl_link_ops-for-ipoib-interfaces.patch b/queue-5.8/rdma-ipoib-set-rtnl_link_ops-for-ipoib-interfaces.patch new file mode 100644 index 00000000000..3087fe7d5c6 --- /dev/null +++ b/queue-5.8/rdma-ipoib-set-rtnl_link_ops-for-ipoib-interfaces.patch @@ -0,0 +1,84 @@ +From 7ac8d8f6a9b3b6b6704144bc54b30ac674ff2b07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Oct 2020 16:29:48 +0300 +Subject: RDMA/ipoib: Set rtnl_link_ops for ipoib interfaces + +From: Kamal Heib + +[ Upstream commit 5ce2dced8e95e76ff7439863a118a053a7fc6f91 ] + +Report the "ipoib pkey", "mode" and "umcast" netlink attributes for every +IPoiB interface type, not just children created with 'ip link add'. + +After setting the rtnl_link_ops for the parent interface, implement the +dellink() callback to block users from trying to remove it. + +Fixes: 862096a8bbf8 ("IB/ipoib: Add more rtnl_link_ops callbacks") +Link: https://lore.kernel.org/r/20201004132948.26669-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 ++ + drivers/infiniband/ulp/ipoib/ipoib_netlink.c | 11 +++++++++++ + drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 2 ++ + 3 files changed, 15 insertions(+) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index ef60e8e4ae67b..7c0bb2642d232 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -2470,6 +2470,8 @@ static struct net_device *ipoib_add_port(const char *format, + /* call event handler to ensure pkey in sync */ + queue_work(ipoib_workqueue, &priv->flush_heavy); + ++ ndev->rtnl_link_ops = ipoib_get_link_ops(); ++ + result = register_netdev(ndev); + if (result) { + pr_warn("%s: couldn't register ipoib port %d; error %d\n", +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c +index 38c984d16996d..d5a90a66b45cf 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c +@@ -144,6 +144,16 @@ static int ipoib_new_child_link(struct net *src_net, struct net_device *dev, + return 0; + } + ++static void ipoib_del_child_link(struct net_device *dev, struct list_head *head) ++{ ++ struct ipoib_dev_priv *priv = ipoib_priv(dev); ++ ++ if (!priv->parent) ++ return; ++ ++ unregister_netdevice_queue(dev, head); ++} ++ + static size_t ipoib_get_size(const struct net_device *dev) + { + return nla_total_size(2) + /* IFLA_IPOIB_PKEY */ +@@ -158,6 +168,7 @@ static struct rtnl_link_ops ipoib_link_ops __read_mostly = { + .priv_size = sizeof(struct ipoib_dev_priv), + .setup = ipoib_setup_common, + .newlink = ipoib_new_child_link, ++ .dellink = ipoib_del_child_link, + .changelink = ipoib_changelink, + .get_size = ipoib_get_size, + .fill_info = ipoib_fill_info, +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +index 30865605e0980..4c50a87ed7cc2 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c +@@ -195,6 +195,8 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey) + } + priv = ipoib_priv(ndev); + ++ ndev->rtnl_link_ops = ipoib_get_link_ops(); ++ + result = __ipoib_vlan_add(ppriv, priv, pkey, IPOIB_LEGACY_CHILD); + + if (result && ndev->reg_state == NETREG_UNINITIALIZED) +-- +2.25.1 + diff --git a/queue-5.8/rdma-mlx5-disable-ib_device_mem_mgt_extensions-if-ib.patch b/queue-5.8/rdma-mlx5-disable-ib_device_mem_mgt_extensions-if-ib.patch new file mode 100644 index 00000000000..38c11816898 --- /dev/null +++ b/queue-5.8/rdma-mlx5-disable-ib_device_mem_mgt_extensions-if-ib.patch @@ -0,0 +1,42 @@ +From 0e6457292836a893d11ed5ba33d9ea5e2c923cd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 14:26:52 +0300 +Subject: RDMA/mlx5: Disable IB_DEVICE_MEM_MGT_EXTENSIONS if IB_WR_REG_MR can't + work + +From: Jason Gunthorpe + +[ Upstream commit 0ec52f0194638e2d284ad55eba5a7aff753de1b9 ] + +set_reg_wr() always fails if !umr_modify_entity_size_disabled because +mlx5_ib_can_use_umr() always fails. Without set_reg_wr() IB_WR_REG_MR +doesn't work and that means the device should not advertise +IB_DEVICE_MEM_MGT_EXTENSIONS. + +Fixes: 841b07f99a47 ("IB/mlx5: Block MR WR if UMR is not possible") +Link: https://lore.kernel.org/r/20200914112653.345244-5-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 6f99ed03d88e7..1f4aa2647a6f3 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -867,7 +867,9 @@ static int mlx5_ib_query_device(struct ib_device *ibdev, + /* We support 'Gappy' memory registration too */ + props->device_cap_flags |= IB_DEVICE_SG_GAPS_REG; + } +- props->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS; ++ /* IB_WR_REG_MR always requires changing the entity size with UMR */ ++ if (!MLX5_CAP_GEN(dev->mdev, umr_modify_entity_size_disabled)) ++ props->device_cap_flags |= IB_DEVICE_MEM_MGT_EXTENSIONS; + if (MLX5_CAP_GEN(mdev, sho)) { + props->device_cap_flags |= IB_DEVICE_INTEGRITY_HANDOVER; + /* At this stage no support for signature handover */ +-- +2.25.1 + diff --git a/queue-5.8/rdma-mlx5-fix-potential-race-between-destroy-and-cqe.patch b/queue-5.8/rdma-mlx5-fix-potential-race-between-destroy-and-cqe.patch new file mode 100644 index 00000000000..8408cf4c998 --- /dev/null +++ b/queue-5.8/rdma-mlx5-fix-potential-race-between-destroy-and-cqe.patch @@ -0,0 +1,47 @@ +From 94efd6eb940f3265383544f95f3dbe62c90873b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Aug 2020 11:40:04 +0300 +Subject: RDMA/mlx5: Fix potential race between destroy and CQE poll + +From: Leon Romanovsky + +[ Upstream commit 4b916ed9f9e85f705213ca8d69771d3c1cd6ee5a ] + +The SRQ can be destroyed right before mlx5_cmd_get_srq is called. +In such case the latter will return NULL instead of expected SRQ. + +Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters") +Link: https://lore.kernel.org/r/20200830084010.102381-5-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/cq.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c +index 0c18cb6a2f148..3ca379513d0e6 100644 +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -168,7 +168,7 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe, + { + enum rdma_link_layer ll = rdma_port_get_link_layer(qp->ibqp.device, 1); + struct mlx5_ib_dev *dev = to_mdev(qp->ibqp.device); +- struct mlx5_ib_srq *srq; ++ struct mlx5_ib_srq *srq = NULL; + struct mlx5_ib_wq *wq; + u16 wqe_ctr; + u8 roce_packet_type; +@@ -180,7 +180,8 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe, + + if (qp->ibqp.xrcd) { + msrq = mlx5_cmd_get_srq(dev, be32_to_cpu(cqe->srqn)); +- srq = to_mibsrq(msrq); ++ if (msrq) ++ srq = to_mibsrq(msrq); + } else { + srq = to_msrq(qp->ibqp.srq); + } +-- +2.25.1 + diff --git a/queue-5.8/rdma-mlx5-make-mkeys-always-owned-by-the-kernel-s-pd.patch b/queue-5.8/rdma-mlx5-make-mkeys-always-owned-by-the-kernel-s-pd.patch new file mode 100644 index 00000000000..396f73ae334 --- /dev/null +++ b/queue-5.8/rdma-mlx5-make-mkeys-always-owned-by-the-kernel-s-pd.patch @@ -0,0 +1,120 @@ +From 54f704f53118bbb0eb62dccc78efb865e8365fda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 14:26:51 +0300 +Subject: RDMA/mlx5: Make mkeys always owned by the kernel's PD when not + enabled + +From: Jason Gunthorpe + +[ Upstream commit 5eb29f0d13a66502b91954597270003c90fb66c5 ] + +Any mkey that is not enabled and assigned to userspace should have the PD +set to a kernel owned PD. + +When cache entries are created for the first time the PDN is set to 0, +which is probably a kernel PD, but be explicit. + +When a MR is registered using the hybrid reg_create with UMR xlt & enable +the disabled mkey is pointing at the user PD, keep it pointing at the +kernel until a UMR enables it and sets the user PD. + +Fixes: 9ec4483a3f0f ("IB/mlx5: Move MRs to a kernel PD when freeing them to the MR cache") +Link: https://lore.kernel.org/r/20200914112653.345244-4-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mr.c | 51 +++++++++++++++++---------------- + 1 file changed, 26 insertions(+), 25 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 8d975c4d93060..85c9a1ffdbb64 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -50,6 +50,29 @@ enum { + static void + create_mkey_callback(int status, struct mlx5_async_work *context); + ++static void set_mkc_access_pd_addr_fields(void *mkc, int acc, u64 start_addr, ++ struct ib_pd *pd) ++{ ++ struct mlx5_ib_dev *dev = to_mdev(pd->device); ++ ++ MLX5_SET(mkc, mkc, a, !!(acc & IB_ACCESS_REMOTE_ATOMIC)); ++ MLX5_SET(mkc, mkc, rw, !!(acc & IB_ACCESS_REMOTE_WRITE)); ++ MLX5_SET(mkc, mkc, rr, !!(acc & IB_ACCESS_REMOTE_READ)); ++ MLX5_SET(mkc, mkc, lw, !!(acc & IB_ACCESS_LOCAL_WRITE)); ++ MLX5_SET(mkc, mkc, lr, 1); ++ ++ if (MLX5_CAP_GEN(dev->mdev, relaxed_ordering_write)) ++ MLX5_SET(mkc, mkc, relaxed_ordering_write, ++ !!(acc & IB_ACCESS_RELAXED_ORDERING)); ++ if (MLX5_CAP_GEN(dev->mdev, relaxed_ordering_read)) ++ MLX5_SET(mkc, mkc, relaxed_ordering_read, ++ !!(acc & IB_ACCESS_RELAXED_ORDERING)); ++ ++ MLX5_SET(mkc, mkc, pd, to_mpd(pd)->pdn); ++ MLX5_SET(mkc, mkc, qpn, 0xffffff); ++ MLX5_SET64(mkc, mkc, start_addr, start_addr); ++} ++ + static void + assign_mkey_variant(struct mlx5_ib_dev *dev, struct mlx5_core_mkey *mkey, + u32 *in) +@@ -152,12 +175,12 @@ static struct mlx5_ib_mr *alloc_cache_mr(struct mlx5_cache_ent *ent, void *mkc) + mr->cache_ent = ent; + mr->dev = ent->dev; + ++ set_mkc_access_pd_addr_fields(mkc, 0, 0, ent->dev->umrc.pd); + MLX5_SET(mkc, mkc, free, 1); + MLX5_SET(mkc, mkc, umr_en, 1); + MLX5_SET(mkc, mkc, access_mode_1_0, ent->access_mode & 0x3); + MLX5_SET(mkc, mkc, access_mode_4_2, (ent->access_mode >> 2) & 0x7); + +- MLX5_SET(mkc, mkc, qpn, 0xffffff); + MLX5_SET(mkc, mkc, translations_octword_size, ent->xlt); + MLX5_SET(mkc, mkc, log_page_size, ent->page); + return mr; +@@ -774,29 +797,6 @@ int mlx5_mr_cache_cleanup(struct mlx5_ib_dev *dev) + return 0; + } + +-static void set_mkc_access_pd_addr_fields(void *mkc, int acc, u64 start_addr, +- struct ib_pd *pd) +-{ +- struct mlx5_ib_dev *dev = to_mdev(pd->device); +- +- MLX5_SET(mkc, mkc, a, !!(acc & IB_ACCESS_REMOTE_ATOMIC)); +- MLX5_SET(mkc, mkc, rw, !!(acc & IB_ACCESS_REMOTE_WRITE)); +- MLX5_SET(mkc, mkc, rr, !!(acc & IB_ACCESS_REMOTE_READ)); +- MLX5_SET(mkc, mkc, lw, !!(acc & IB_ACCESS_LOCAL_WRITE)); +- MLX5_SET(mkc, mkc, lr, 1); +- +- if (MLX5_CAP_GEN(dev->mdev, relaxed_ordering_write)) +- MLX5_SET(mkc, mkc, relaxed_ordering_write, +- !!(acc & IB_ACCESS_RELAXED_ORDERING)); +- if (MLX5_CAP_GEN(dev->mdev, relaxed_ordering_read)) +- MLX5_SET(mkc, mkc, relaxed_ordering_read, +- !!(acc & IB_ACCESS_RELAXED_ORDERING)); +- +- MLX5_SET(mkc, mkc, pd, to_mpd(pd)->pdn); +- MLX5_SET(mkc, mkc, qpn, 0xffffff); +- MLX5_SET64(mkc, mkc, start_addr, start_addr); +-} +- + struct ib_mr *mlx5_ib_get_dma_mr(struct ib_pd *pd, int acc) + { + struct mlx5_ib_dev *dev = to_mdev(pd->device); +@@ -1190,7 +1190,8 @@ static struct mlx5_ib_mr *reg_create(struct ib_mr *ibmr, struct ib_pd *pd, + MLX5_SET(create_mkey_in, in, pg_access, !!(pg_cap)); + + mkc = MLX5_ADDR_OF(create_mkey_in, in, memory_key_mkey_entry); +- set_mkc_access_pd_addr_fields(mkc, access_flags, virt_addr, pd); ++ set_mkc_access_pd_addr_fields(mkc, access_flags, virt_addr, ++ populate ? pd : dev->umrc.pd); + MLX5_SET(mkc, mkc, free, !populate); + MLX5_SET(mkc, mkc, access_mode_1_0, MLX5_MKC_ACCESS_MODE_MTT); + MLX5_SET(mkc, mkc, umr_en, 1); +-- +2.25.1 + diff --git a/queue-5.8/rdma-mlx5-use-set_mkc_access_pd_addr_fields-in-reg_c.patch b/queue-5.8/rdma-mlx5-use-set_mkc_access_pd_addr_fields-in-reg_c.patch new file mode 100644 index 00000000000..1999715d63f --- /dev/null +++ b/queue-5.8/rdma-mlx5-use-set_mkc_access_pd_addr_fields-in-reg_c.patch @@ -0,0 +1,57 @@ +From a431da229e8f3f0ae97ff1ce44ffcb0870d8cb08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 14:26:50 +0300 +Subject: RDMA/mlx5: Use set_mkc_access_pd_addr_fields() in reg_create() + +From: Jason Gunthorpe + +[ Upstream commit 1c97ca3da0d12e0156a177f48ed3184c3f202002 ] + +reg_create() open codes this helper, use the shared code. + +Link: https://lore.kernel.org/r/20200914112653.345244-3-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mlx5/mr.c | 15 +-------------- + 1 file changed, 1 insertion(+), 14 deletions(-) + +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 44683073be0c4..8d975c4d93060 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1190,29 +1190,16 @@ static struct mlx5_ib_mr *reg_create(struct ib_mr *ibmr, struct ib_pd *pd, + MLX5_SET(create_mkey_in, in, pg_access, !!(pg_cap)); + + mkc = MLX5_ADDR_OF(create_mkey_in, in, memory_key_mkey_entry); ++ set_mkc_access_pd_addr_fields(mkc, access_flags, virt_addr, pd); + MLX5_SET(mkc, mkc, free, !populate); + MLX5_SET(mkc, mkc, access_mode_1_0, MLX5_MKC_ACCESS_MODE_MTT); +- if (MLX5_CAP_GEN(dev->mdev, relaxed_ordering_write)) +- MLX5_SET(mkc, mkc, relaxed_ordering_write, +- !!(access_flags & IB_ACCESS_RELAXED_ORDERING)); +- if (MLX5_CAP_GEN(dev->mdev, relaxed_ordering_read)) +- MLX5_SET(mkc, mkc, relaxed_ordering_read, +- !!(access_flags & IB_ACCESS_RELAXED_ORDERING)); +- MLX5_SET(mkc, mkc, a, !!(access_flags & IB_ACCESS_REMOTE_ATOMIC)); +- MLX5_SET(mkc, mkc, rw, !!(access_flags & IB_ACCESS_REMOTE_WRITE)); +- MLX5_SET(mkc, mkc, rr, !!(access_flags & IB_ACCESS_REMOTE_READ)); +- MLX5_SET(mkc, mkc, lw, !!(access_flags & IB_ACCESS_LOCAL_WRITE)); +- MLX5_SET(mkc, mkc, lr, 1); + MLX5_SET(mkc, mkc, umr_en, 1); + +- MLX5_SET64(mkc, mkc, start_addr, virt_addr); + MLX5_SET64(mkc, mkc, len, length); +- MLX5_SET(mkc, mkc, pd, to_mpd(pd)->pdn); + MLX5_SET(mkc, mkc, bsf_octword_size, 0); + MLX5_SET(mkc, mkc, translations_octword_size, + get_octo_len(virt_addr, length, page_shift)); + MLX5_SET(mkc, mkc, log_page_size, page_shift); +- MLX5_SET(mkc, mkc, qpn, 0xffffff); + if (populate) { + MLX5_SET(create_mkey_in, in, translations_octword_actual_size, + get_octo_len(virt_addr, length, page_shift)); +-- +2.25.1 + diff --git a/queue-5.8/rdma-qedr-fix-doorbell-setting.patch b/queue-5.8/rdma-qedr-fix-doorbell-setting.patch new file mode 100644 index 00000000000..9dfcc21722e --- /dev/null +++ b/queue-5.8/rdma-qedr-fix-doorbell-setting.patch @@ -0,0 +1,37 @@ +From 15412817c34f9000f440c49774efa96deb85d69e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 19:57:35 +0300 +Subject: RDMA/qedr: Fix doorbell setting + +From: Michal Kalderon + +[ Upstream commit 0b1eddc1964351cd5ce57aff46853ed4ce9ebbff ] + +Change the doorbell setting so that the maximum value between the last and +current value is set. This is to avoid doorbells being lost. + +Fixes: a7efd7773e31 ("qedr: Add support for PD,PKEY and CQ verbs") +Link: https://lore.kernel.org/r/20200902165741.8355-3-michal.kalderon@marvell.com +Signed-off-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index c6165c6390a71..7de96ac4ce543 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -998,7 +998,7 @@ int qedr_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + /* Generate doorbell address. */ + cq->db.data.icid = cq->icid; + cq->db_addr = dev->db_addr + db_offset; +- cq->db.data.params = DB_AGG_CMD_SET << ++ cq->db.data.params = DB_AGG_CMD_MAX << + RDMA_PWM_VAL32_DATA_AGG_CMD_SHIFT; + + /* point to the very last element, passing it we will toggle */ +-- +2.25.1 + diff --git a/queue-5.8/rdma-qedr-fix-inline-size-returned-for-iwarp.patch b/queue-5.8/rdma-qedr-fix-inline-size-returned-for-iwarp.patch new file mode 100644 index 00000000000..9483d0fe6db --- /dev/null +++ b/queue-5.8/rdma-qedr-fix-inline-size-returned-for-iwarp.patch @@ -0,0 +1,40 @@ +From c1e819ec3402d00172f66c4a3397b50bb75a77b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 19:57:40 +0300 +Subject: RDMA/qedr: Fix inline size returned for iWARP + +From: Michal Kalderon + +[ Upstream commit fbf58026b2256e9cd5f241a4801d79d3b2b7b89d ] + +commit 59e8970b3798 ("RDMA/qedr: Return max inline data in QP query +result") changed query_qp max_inline size to return the max roce inline +size. When iwarp was introduced, this should have been modified to return +the max inline size based on protocol. This size is cached in the device +attributes + +Fixes: 69ad0e7fe845 ("RDMA/qedr: Add support for iWARP in user space") +Link: https://lore.kernel.org/r/20200902165741.8355-8-michal.kalderon@marvell.com +Signed-off-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/verbs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 7de96ac4ce543..820e351277d1b 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -2637,7 +2637,7 @@ int qedr_query_qp(struct ib_qp *ibqp, + qp_attr->cap.max_recv_wr = qp->rq.max_wr; + qp_attr->cap.max_send_sge = qp->sq.max_sges; + qp_attr->cap.max_recv_sge = qp->rq.max_sges; +- qp_attr->cap.max_inline_data = ROCE_REQ_MAX_INLINE_DATA_SIZE; ++ qp_attr->cap.max_inline_data = dev->attr.max_inline; + qp_init_attr->cap = qp_attr->cap; + + qp_attr->ah_attr.type = RDMA_AH_ATTR_TYPE_ROCE; +-- +2.25.1 + diff --git a/queue-5.8/rdma-qedr-fix-qp-structure-memory-leak.patch b/queue-5.8/rdma-qedr-fix-qp-structure-memory-leak.patch new file mode 100644 index 00000000000..3b36cda4b0c --- /dev/null +++ b/queue-5.8/rdma-qedr-fix-qp-structure-memory-leak.patch @@ -0,0 +1,52 @@ +From 0abb43bd32d827742833434562283a10e4baf90e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 19:57:34 +0300 +Subject: RDMA/qedr: Fix qp structure memory leak + +From: Michal Kalderon + +[ Upstream commit 098e345a1a8faaad6e4e54d138773466cecc45d4 ] + +The qedr_qp structure wasn't freed when the protocol was RoCE. kmemleak +output when running basic RoCE scenario. + +unreferenced object 0xffff927ad7e22c00 (size 1024): + comm "ib_send_bw", pid 7082, jiffies 4384133693 (age 274.698s) + hex dump (first 32 bytes): + 00 b0 cd a2 79 92 ff ff 00 3f a1 a2 79 92 ff ff ....y....?..y... + 00 ee 5c dd 80 92 ff ff 00 f6 5c dd 80 92 ff ff ..\.......\..... + backtrace: + [<00000000b2ba0f35>] qedr_create_qp+0xb3/0x6c0 [qedr] + [<00000000e85a43dd>] ib_uverbs_handler_UVERBS_METHOD_QP_CREATE+0x555/0xad0 [ib_uverbs] + [<00000000fee4d029>] ib_uverbs_cmd_verbs+0xa5a/0xb80 [ib_uverbs] + [<000000005d622660>] ib_uverbs_ioctl+0xa4/0x110 [ib_uverbs] + [<00000000eb4cdc71>] ksys_ioctl+0x87/0xc0 + [<00000000abe6b23a>] __x64_sys_ioctl+0x16/0x20 + [<0000000046e7cef4>] do_syscall_64+0x4d/0x90 + [<00000000c6948f76>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Fixes: 1212767e23bb ("qedr: Add wrapping generic structure for qpidr and adjust idr routines.") +Link: https://lore.kernel.org/r/20200902165741.8355-2-michal.kalderon@marvell.com +Signed-off-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/verbs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 8092821680438..c6165c6390a71 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -2753,6 +2753,8 @@ int qedr_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) + + if (rdma_protocol_iwarp(&dev->ibdev, 1)) + qedr_iw_qp_rem_ref(&qp->ibqp); ++ else ++ kfree(qp); + + return 0; + } +-- +2.25.1 + diff --git a/queue-5.8/rdma-qedr-fix-resource-leak-in-qedr_create_qp.patch b/queue-5.8/rdma-qedr-fix-resource-leak-in-qedr_create_qp.patch new file mode 100644 index 00000000000..c2f4b5c1631 --- /dev/null +++ b/queue-5.8/rdma-qedr-fix-resource-leak-in-qedr_create_qp.patch @@ -0,0 +1,117 @@ +From cda407b199054bfd554ad7154d09e43482049817 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 12:51:59 +0000 +Subject: RDMA/qedr: Fix resource leak in qedr_create_qp +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Keita Suzuki + +[ Upstream commit 3e45410fe3c202ffb619f301beff0644f717e132 ] + +When xa_insert() fails, the acquired resource in qedr_create_qp should +also be freed. However, current implementation does not handle the error. + +Fix this by adding a new goto label that calls qedr_free_qp_resources. + +Fixes: 1212767e23bb ("qedr: Add wrapping generic structure for qpidr and adjust idr routines.") +Link: https://lore.kernel.org/r/20200911125159.4577-1-keitasuzuki.park@sslab.ics.keio.ac.jp +Signed-off-by: Keita Suzuki +Acked-by: Michal Kalderon  +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/verbs.c | 52 ++++++++++++++++-------------- + 1 file changed, 27 insertions(+), 25 deletions(-) + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 820e351277d1b..41813e9d771ff 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -2113,6 +2113,28 @@ static int qedr_create_kernel_qp(struct qedr_dev *dev, + return rc; + } + ++static int qedr_free_qp_resources(struct qedr_dev *dev, struct qedr_qp *qp, ++ struct ib_udata *udata) ++{ ++ struct qedr_ucontext *ctx = ++ rdma_udata_to_drv_context(udata, struct qedr_ucontext, ++ ibucontext); ++ int rc; ++ ++ if (qp->qp_type != IB_QPT_GSI) { ++ rc = dev->ops->rdma_destroy_qp(dev->rdma_ctx, qp->qed_qp); ++ if (rc) ++ return rc; ++ } ++ ++ if (qp->create_type == QEDR_QP_CREATE_USER) ++ qedr_cleanup_user(dev, ctx, qp); ++ else ++ qedr_cleanup_kernel(dev, qp); ++ ++ return 0; ++} ++ + struct ib_qp *qedr_create_qp(struct ib_pd *ibpd, + struct ib_qp_init_attr *attrs, + struct ib_udata *udata) +@@ -2159,19 +2181,21 @@ struct ib_qp *qedr_create_qp(struct ib_pd *ibpd, + rc = qedr_create_kernel_qp(dev, qp, ibpd, attrs); + + if (rc) +- goto err; ++ goto out_free_qp; + + qp->ibqp.qp_num = qp->qp_id; + + if (rdma_protocol_iwarp(&dev->ibdev, 1)) { + rc = xa_insert(&dev->qps, qp->qp_id, qp, GFP_KERNEL); + if (rc) +- goto err; ++ goto out_free_qp_resources; + } + + return &qp->ibqp; + +-err: ++out_free_qp_resources: ++ qedr_free_qp_resources(dev, qp, udata); ++out_free_qp: + kfree(qp); + + return ERR_PTR(-EFAULT); +@@ -2672,28 +2696,6 @@ int qedr_query_qp(struct ib_qp *ibqp, + return rc; + } + +-static int qedr_free_qp_resources(struct qedr_dev *dev, struct qedr_qp *qp, +- struct ib_udata *udata) +-{ +- struct qedr_ucontext *ctx = +- rdma_udata_to_drv_context(udata, struct qedr_ucontext, +- ibucontext); +- int rc; +- +- if (qp->qp_type != IB_QPT_GSI) { +- rc = dev->ops->rdma_destroy_qp(dev->rdma_ctx, qp->qed_qp); +- if (rc) +- return rc; +- } +- +- if (qp->create_type == QEDR_QP_CREATE_USER) +- qedr_cleanup_user(dev, ctx, qp); +- else +- qedr_cleanup_kernel(dev, qp); +- +- return 0; +-} +- + int qedr_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata) + { + struct qedr_qp *qp = get_qedr_qp(ibqp); +-- +2.25.1 + diff --git a/queue-5.8/rdma-qedr-fix-return-code-if-accept-is-called-on-a-d.patch b/queue-5.8/rdma-qedr-fix-return-code-if-accept-is-called-on-a-d.patch new file mode 100644 index 00000000000..721a06437a1 --- /dev/null +++ b/queue-5.8/rdma-qedr-fix-return-code-if-accept-is-called-on-a-d.patch @@ -0,0 +1,49 @@ +From 30ca800bdf91eaa3c5ebc08297f91f004b9ede39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 19:57:37 +0300 +Subject: RDMA/qedr: Fix return code if accept is called on a destroyed qp + +From: Michal Kalderon + +[ Upstream commit 8a5a10a1a74465065c75d9de1aa6685e1f1aa117 ] + +In iWARP, accept could be called after a QP is already destroyed. In this +case an error should be returned and not success. + +Fixes: 82af6d19d8d9 ("RDMA/qedr: Fix synchronization methods and memory leaks in qedr") +Link: https://lore.kernel.org/r/20200902165741.8355-5-michal.kalderon@marvell.com +Signed-off-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/qedr_iw_cm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/qedr/qedr_iw_cm.c b/drivers/infiniband/hw/qedr/qedr_iw_cm.c +index 97fc7dd353b04..c7169d2c69e5b 100644 +--- a/drivers/infiniband/hw/qedr/qedr_iw_cm.c ++++ b/drivers/infiniband/hw/qedr/qedr_iw_cm.c +@@ -736,7 +736,7 @@ int qedr_iw_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) + struct qedr_dev *dev = ep->dev; + struct qedr_qp *qp; + struct qed_iwarp_accept_in params; +- int rc = 0; ++ int rc; + + DP_DEBUG(dev, QEDR_MSG_IWARP, "Accept on qpid=%d\n", conn_param->qpn); + +@@ -759,8 +759,10 @@ int qedr_iw_accept(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) + params.ord = conn_param->ord; + + if (test_and_set_bit(QEDR_IWARP_CM_WAIT_FOR_CONNECT, +- &qp->iwarp_cm_flags)) ++ &qp->iwarp_cm_flags)) { ++ rc = -EINVAL; + goto err; /* QP already destroyed */ ++ } + + rc = dev->ops->iwarp_accept(dev->rdma_ctx, ¶ms); + if (rc) { +-- +2.25.1 + diff --git a/queue-5.8/rdma-qedr-fix-use-of-uninitialized-field.patch b/queue-5.8/rdma-qedr-fix-use-of-uninitialized-field.patch new file mode 100644 index 00000000000..5a526770241 --- /dev/null +++ b/queue-5.8/rdma-qedr-fix-use-of-uninitialized-field.patch @@ -0,0 +1,37 @@ +From 3d0cbbce196c51f405e585319cd0cb086fa7c48e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 19:57:36 +0300 +Subject: RDMA/qedr: Fix use of uninitialized field + +From: Michal Kalderon + +[ Upstream commit a379ad54e55a12618cae7f6333fd1b3071de9606 ] + +dev->attr.page_size_caps was used uninitialized when setting device +attributes + +Fixes: ec72fce401c6 ("qedr: Add support for RoCE HW init") +Link: https://lore.kernel.org/r/20200902165741.8355-4-michal.kalderon@marvell.com +Signed-off-by: Michal Kalderon +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/qedr/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c +index ccaedfd53e49e..679766abb436e 100644 +--- a/drivers/infiniband/hw/qedr/main.c ++++ b/drivers/infiniband/hw/qedr/main.c +@@ -601,7 +601,7 @@ static int qedr_set_device_attr(struct qedr_dev *dev) + qed_attr = dev->ops->rdma_query_device(dev->rdma_ctx); + + /* Part 2 - check capabilities */ +- page_size = ~dev->attr.page_size_caps + 1; ++ page_size = ~qed_attr->page_size_caps + 1; + if (page_size > PAGE_SIZE) { + DP_ERR(dev, + "Kernel PAGE_SIZE is %ld which is smaller than minimum page size (%d) required by qedr\n", +-- +2.25.1 + diff --git a/queue-5.8/rdma-rtrs-srv-incorporate-ib_register_client-into-rt.patch b/queue-5.8/rdma-rtrs-srv-incorporate-ib_register_client-into-rt.patch new file mode 100644 index 00000000000..c3af7585309 --- /dev/null +++ b/queue-5.8/rdma-rtrs-srv-incorporate-ib_register_client-into-rt.patch @@ -0,0 +1,193 @@ +From 7f19850e3448f88318ec5141b8e3abe5f9de3e3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 16:01:06 +0530 +Subject: RDMA/rtrs-srv: Incorporate ib_register_client into rtrs server init + +From: Md Haris Iqbal + +[ Upstream commit 558d52b2976b1db3098139aa83ceb9af9066a0e7 ] + +The rnbd_server module's communication manager (cm) initialization depends +on the registration of the "network namespace subsystem" of the RDMA CM +agent module. As such, when the kernel is configured to load the +rnbd_server and the RDMA cma module during initialization; and if the +rnbd_server module is initialized before RDMA cma module, a null ptr +dereference occurs during the RDMA bind operation. + +Call trace: + + Call Trace: + ? xas_load+0xd/0x80 + xa_load+0x47/0x80 + cma_ps_find+0x44/0x70 + rdma_bind_addr+0x782/0x8b0 + ? get_random_bytes+0x35/0x40 + rtrs_srv_cm_init+0x50/0x80 + rtrs_srv_open+0x102/0x180 + ? rnbd_client_init+0x6e/0x6e + rnbd_srv_init_module+0x34/0x84 + ? rnbd_client_init+0x6e/0x6e + do_one_initcall+0x4a/0x200 + kernel_init_freeable+0x1f1/0x26e + ? rest_init+0xb0/0xb0 + kernel_init+0xe/0x100 + ret_from_fork+0x22/0x30 + Modules linked in: + CR2: 0000000000000015 + +All this happens cause the cm init is in the call chain of the module +init, which is not a preferred practice. + +So remove the call to rdma_create_id() from the module init call chain. +Instead register rtrs-srv as an ib client, which makes sure that the +rdma_create_id() is called only when an ib device is added. + +Fixes: 9cb837480424 ("RDMA/rtrs: server: main functionality") +Link: https://lore.kernel.org/r/20200907103106.104530-1-haris.iqbal@cloud.ionos.com +Reported-by: kernel test robot +Signed-off-by: Md Haris Iqbal +Reviewed-by: Jack Wang +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/rtrs/rtrs-srv.c | 76 +++++++++++++++++++++++++- + drivers/infiniband/ulp/rtrs/rtrs-srv.h | 7 +++ + 2 files changed, 80 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.c b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +index 28f6414dfa3dc..d6f93601712e4 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.c ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.c +@@ -16,6 +16,7 @@ + #include "rtrs-srv.h" + #include "rtrs-log.h" + #include ++#include + + MODULE_DESCRIPTION("RDMA Transport Server"); + MODULE_LICENSE("GPL"); +@@ -31,6 +32,7 @@ MODULE_LICENSE("GPL"); + static struct rtrs_rdma_dev_pd dev_pd; + static mempool_t *chunk_pool; + struct class *rtrs_dev_class; ++static struct rtrs_srv_ib_ctx ib_ctx; + + static int __read_mostly max_chunk_size = DEFAULT_MAX_CHUNK_SIZE; + static int __read_mostly sess_queue_depth = DEFAULT_SESS_QUEUE_DEPTH; +@@ -2042,6 +2044,70 @@ static void free_srv_ctx(struct rtrs_srv_ctx *ctx) + kfree(ctx); + } + ++static int rtrs_srv_add_one(struct ib_device *device) ++{ ++ struct rtrs_srv_ctx *ctx; ++ int ret = 0; ++ ++ mutex_lock(&ib_ctx.ib_dev_mutex); ++ if (ib_ctx.ib_dev_count) ++ goto out; ++ ++ /* ++ * Since our CM IDs are NOT bound to any ib device we will create them ++ * only once ++ */ ++ ctx = ib_ctx.srv_ctx; ++ ret = rtrs_srv_rdma_init(ctx, ib_ctx.port); ++ if (ret) { ++ /* ++ * We errored out here. ++ * According to the ib code, if we encounter an error here then the ++ * error code is ignored, and no more calls to our ops are made. ++ */ ++ pr_err("Failed to initialize RDMA connection"); ++ goto err_out; ++ } ++ ++out: ++ /* ++ * Keep a track on the number of ib devices added ++ */ ++ ib_ctx.ib_dev_count++; ++ ++err_out: ++ mutex_unlock(&ib_ctx.ib_dev_mutex); ++ return ret; ++} ++ ++static void rtrs_srv_remove_one(struct ib_device *device, void *client_data) ++{ ++ struct rtrs_srv_ctx *ctx; ++ ++ mutex_lock(&ib_ctx.ib_dev_mutex); ++ ib_ctx.ib_dev_count--; ++ ++ if (ib_ctx.ib_dev_count) ++ goto out; ++ ++ /* ++ * Since our CM IDs are NOT bound to any ib device we will remove them ++ * only once, when the last device is removed ++ */ ++ ctx = ib_ctx.srv_ctx; ++ rdma_destroy_id(ctx->cm_id_ip); ++ rdma_destroy_id(ctx->cm_id_ib); ++ ++out: ++ mutex_unlock(&ib_ctx.ib_dev_mutex); ++} ++ ++static struct ib_client rtrs_srv_client = { ++ .name = "rtrs_server", ++ .add = rtrs_srv_add_one, ++ .remove = rtrs_srv_remove_one ++}; ++ + /** + * rtrs_srv_open() - open RTRS server context + * @ops: callback functions +@@ -2060,7 +2126,11 @@ struct rtrs_srv_ctx *rtrs_srv_open(struct rtrs_srv_ops *ops, u16 port) + if (!ctx) + return ERR_PTR(-ENOMEM); + +- err = rtrs_srv_rdma_init(ctx, port); ++ mutex_init(&ib_ctx.ib_dev_mutex); ++ ib_ctx.srv_ctx = ctx; ++ ib_ctx.port = port; ++ ++ err = ib_register_client(&rtrs_srv_client); + if (err) { + free_srv_ctx(ctx); + return ERR_PTR(err); +@@ -2099,8 +2169,8 @@ static void close_ctx(struct rtrs_srv_ctx *ctx) + */ + void rtrs_srv_close(struct rtrs_srv_ctx *ctx) + { +- rdma_destroy_id(ctx->cm_id_ip); +- rdma_destroy_id(ctx->cm_id_ib); ++ ib_unregister_client(&rtrs_srv_client); ++ mutex_destroy(&ib_ctx.ib_dev_mutex); + close_ctx(ctx); + free_srv_ctx(ctx); + } +diff --git a/drivers/infiniband/ulp/rtrs/rtrs-srv.h b/drivers/infiniband/ulp/rtrs/rtrs-srv.h +index dc95b0932f0df..08b0b8a6eebe6 100644 +--- a/drivers/infiniband/ulp/rtrs/rtrs-srv.h ++++ b/drivers/infiniband/ulp/rtrs/rtrs-srv.h +@@ -118,6 +118,13 @@ struct rtrs_srv_ctx { + struct list_head srv_list; + }; + ++struct rtrs_srv_ib_ctx { ++ struct rtrs_srv_ctx *srv_ctx; ++ u16 port; ++ struct mutex ib_dev_mutex; ++ int ib_dev_count; ++}; ++ + extern struct class *rtrs_dev_class; + + void close_sess(struct rtrs_srv_sess *sess); +-- +2.25.1 + diff --git a/queue-5.8/rdma-rxe-fix-skb-lifetime-in-rxe_rcv_mcast_pkt.patch b/queue-5.8/rdma-rxe-fix-skb-lifetime-in-rxe_rcv_mcast_pkt.patch new file mode 100644 index 00000000000..9e1987118f5 --- /dev/null +++ b/queue-5.8/rdma-rxe-fix-skb-lifetime-in-rxe_rcv_mcast_pkt.patch @@ -0,0 +1,79 @@ +From 1ae861d6fcd478199252563659a6e719904abc2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 15:36:52 -0500 +Subject: RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt() + +From: Bob Pearson + +[ Upstream commit e7ec96fc7932f48a6d6cdd05bf82004a1a04285b ] + +The changes referenced below replaced sbk_clone)_ by taking additional +references, passing the skb along and then freeing the skb. This +deleted the packets before they could be processed and additionally +passed bad data in each packet. Since pkt is stored in skb->cb +changing pkt->qp changed it for all the packets. + +Replace skb_get() by sbk_clone() in rxe_rcv_mcast_pkt() for cases where +multiple QPs are receiving multicast packets on the same address. + +Delete kfree_skb() because the packets need to live until they have been +processed by each QP. They are freed later. + +Fixes: 86af61764151 ("IB/rxe: remove unnecessary skb_clone") +Fixes: fe896ceb5772 ("IB/rxe: replace refcount_inc with skb_get") +Link: https://lore.kernel.org/r/20201008203651.256958-1-rpearson@hpe.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_recv.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c +index 46e111c218fd4..be6416a982c70 100644 +--- a/drivers/infiniband/sw/rxe/rxe_recv.c ++++ b/drivers/infiniband/sw/rxe/rxe_recv.c +@@ -281,6 +281,8 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb) + struct rxe_mc_elem *mce; + struct rxe_qp *qp; + union ib_gid dgid; ++ struct sk_buff *per_qp_skb; ++ struct rxe_pkt_info *per_qp_pkt; + int err; + + if (skb->protocol == htons(ETH_P_IP)) +@@ -309,21 +311,26 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb) + if (err) + continue; + +- /* if *not* the last qp in the list +- * increase the users of the skb then post to the next qp ++ /* for all but the last qp create a new clone of the ++ * skb and pass to the qp. + */ + if (mce->qp_list.next != &mcg->qp_list) +- skb_get(skb); ++ per_qp_skb = skb_clone(skb, GFP_ATOMIC); ++ else ++ per_qp_skb = skb; + +- pkt->qp = qp; ++ per_qp_pkt = SKB_TO_PKT(per_qp_skb); ++ per_qp_pkt->qp = qp; + rxe_add_ref(qp); +- rxe_rcv_pkt(pkt, skb); ++ rxe_rcv_pkt(per_qp_pkt, per_qp_skb); + } + + spin_unlock_bh(&mcg->mcg_lock); + + rxe_drop_ref(mcg); /* drop ref from rxe_pool_get_key. */ + ++ return; ++ + err1: + kfree_skb(skb); + } +-- +2.25.1 + diff --git a/queue-5.8/rdma-rxe-handle-skb_clone-failure-in-rxe_recv.c.patch b/queue-5.8/rdma-rxe-handle-skb_clone-failure-in-rxe_recv.c.patch new file mode 100644 index 00000000000..bec6636e64d --- /dev/null +++ b/queue-5.8/rdma-rxe-handle-skb_clone-failure-in-rxe_recv.c.patch @@ -0,0 +1,43 @@ +From b56ac3f59e1ee99d6929e96bec07035edc9cf6e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 13:42:37 -0500 +Subject: RDMA/rxe: Handle skb_clone() failure in rxe_recv.c + +From: Bob Pearson + +[ Upstream commit 71abf20b28ff87fee6951ec2218d5ce7969c4e87 ] + +If skb_clone() is unable to allocate memory for a new sk_buff this is not +detected by the current code. + +Check for a NULL return and continue. This is similar to other errors in +this loop over QPs attached to the multicast address and consistent with +the unreliable UD transport. + +Fixes: e7ec96fc7932f ("RDMA/rxe: Fix skb lifetime in rxe_rcv_mcast_pkt()") +Addresses-Coverity-ID: 1497804: Null pointer dereferences (NULL_RETURNS) +Link: https://lore.kernel.org/r/20201013184236.5231-1-rpearson@hpe.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_recv.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c +index be6416a982c70..9bfb98056fc2a 100644 +--- a/drivers/infiniband/sw/rxe/rxe_recv.c ++++ b/drivers/infiniband/sw/rxe/rxe_recv.c +@@ -319,6 +319,9 @@ static void rxe_rcv_mcast_pkt(struct rxe_dev *rxe, struct sk_buff *skb) + else + per_qp_skb = skb; + ++ if (unlikely(!per_qp_skb)) ++ continue; ++ + per_qp_pkt = SKB_TO_PKT(per_qp_skb); + per_qp_pkt->qp = qp; + rxe_add_ref(qp); +-- +2.25.1 + diff --git a/queue-5.8/rdma-ucma-add-missing-locking-around-rdma_leave_mult.patch b/queue-5.8/rdma-ucma-add-missing-locking-around-rdma_leave_mult.patch new file mode 100644 index 00000000000..fd0229f6579 --- /dev/null +++ b/queue-5.8/rdma-ucma-add-missing-locking-around-rdma_leave_mult.patch @@ -0,0 +1,38 @@ +From 39fde0fb428a7f7389d209835c00e783d5586ddb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 15:05:22 +0300 +Subject: RDMA/ucma: Add missing locking around rdma_leave_multicast() + +From: Jason Gunthorpe + +[ Upstream commit 38e03d092699891c3237b5aee9e8029d4ede0956 ] + +All entry points to the rdma_cm from a ULP must be single threaded, +even this error unwinds. Add the missing locking. + +Fixes: 7c11910783a1 ("RDMA/ucma: Put a lock around every call to the rdma_cm layer") +Link: https://lore.kernel.org/r/20200818120526.702120-11-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/ucma.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index cf283b70bf877..2643d5dbe1da8 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -1512,7 +1512,9 @@ static ssize_t ucma_process_join(struct ucma_file *file, + return 0; + + err3: ++ mutex_lock(&ctx->mutex); + rdma_leave_multicast(ctx->cm_id, (struct sockaddr *) &mc->addr); ++ mutex_unlock(&ctx->mutex); + ucma_cleanup_mc_events(mc); + err2: + xa_erase(&multicast_table, mc->id); +-- +2.25.1 + diff --git a/queue-5.8/rdma-ucma-fix-locking-for-ctx-events_reported.patch b/queue-5.8/rdma-ucma-fix-locking-for-ctx-events_reported.patch new file mode 100644 index 00000000000..7cb19341ede --- /dev/null +++ b/queue-5.8/rdma-ucma-fix-locking-for-ctx-events_reported.patch @@ -0,0 +1,58 @@ +From 001caa88a3a0f4fabc25a2aa77b2d1a3d8335f8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 15:05:21 +0300 +Subject: RDMA/ucma: Fix locking for ctx->events_reported + +From: Jason Gunthorpe + +[ Upstream commit 98837c6c3d7285f6eca86480b6f7fac6880e27a8 ] + +This value is locked under the file->mut, ensure it is held whenever +touching it. + +The case in ucma_migrate_id() is a race, while in ucma_free_uctx() it is +already not possible for the write side to run, the movement is just for +clarity. + +Fixes: 88314e4dda1e ("RDMA/cma: add support for rdma_migrate_id()") +Link: https://lore.kernel.org/r/20200818120526.702120-10-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/ucma.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index d03dacaef7880..cf283b70bf877 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -586,6 +586,7 @@ static int ucma_free_ctx(struct ucma_context *ctx) + list_move_tail(&uevent->list, &list); + } + list_del(&ctx->list); ++ events_reported = ctx->events_reported; + mutex_unlock(&ctx->file->mut); + + list_for_each_entry_safe(uevent, tmp, &list, list) { +@@ -595,7 +596,6 @@ static int ucma_free_ctx(struct ucma_context *ctx) + kfree(uevent); + } + +- events_reported = ctx->events_reported; + mutex_destroy(&ctx->mutex); + kfree(ctx); + return events_reported; +@@ -1678,7 +1678,9 @@ static ssize_t ucma_migrate_id(struct ucma_file *new_file, + + cur_file = ctx->file; + if (cur_file == new_file) { ++ mutex_lock(&cur_file->mut); + resp.events_reported = ctx->events_reported; ++ mutex_unlock(&cur_file->mut); + goto response; + } + +-- +2.25.1 + diff --git a/queue-5.8/rdma-umem-fix-ib_umem_find_best_pgsz-for-mappings-th.patch b/queue-5.8/rdma-umem-fix-ib_umem_find_best_pgsz-for-mappings-th.patch new file mode 100644 index 00000000000..ed31a61e9d7 --- /dev/null +++ b/queue-5.8/rdma-umem-fix-ib_umem_find_best_pgsz-for-mappings-th.patch @@ -0,0 +1,60 @@ +From 5a8dbb68c59b991b6c615fd3f1f37f6a4dba1070 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 19:41:42 -0300 +Subject: RDMA/umem: Fix ib_umem_find_best_pgsz() for mappings that cross a + page boundary + +From: Jason Gunthorpe + +[ Upstream commit a40c20dabdf9045270767c75918feb67f0727c89 ] + +It is possible for a single SGL to span an aligned boundary, eg if the SGL +is + + 61440 -> 90112 + +Then the length is 28672, which currently limits the block size to +32k. With a 32k page size the two covering blocks will be: + + 32768->65536 and 65536->98304 + +However, the correct answer is a 128K block size which will span the whole +28672 bytes in a single block. + +Instead of limiting based on length figure out which high IOVA bits don't +change between the start and end addresses. That is the highest useful +page size. + +Fixes: 4a35339958f1 ("RDMA/umem: Add API to find best driver supported page size in an MR") +Link: https://lore.kernel.org/r/1-v2-270386b7e60b+28f4-umem_1_jgg@nvidia.com +Reviewed-by: Leon Romanovsky +Reviewed-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/umem.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index 82455a1392f1d..1173b8cbe92b5 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -156,8 +156,13 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, + return 0; + + va = virt; +- /* max page size not to exceed MR length */ +- mask = roundup_pow_of_two(umem->length); ++ /* The best result is the smallest page size that results in the minimum ++ * number of required pages. Compute the largest page size that could ++ * work based on VA address bits that don't change. ++ */ ++ mask = pgsz_bitmap & ++ GENMASK(BITS_PER_LONG - 1, ++ bits_per((umem->length - 1 + virt) ^ virt)); + /* offset into first SGL */ + pgoff = umem->address & ~PAGE_MASK; + +-- +2.25.1 + diff --git a/queue-5.8/rdma-umem-fix-signature-of-stub-ib_umem_find_best_pg.patch b/queue-5.8/rdma-umem-fix-signature-of-stub-ib_umem_find_best_pg.patch new file mode 100644 index 00000000000..491f4fbd60f --- /dev/null +++ b/queue-5.8/rdma-umem-fix-signature-of-stub-ib_umem_find_best_pg.patch @@ -0,0 +1,44 @@ +From d44416ddadf9e4ef98e538fe704c865704db8c71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 15:17:08 -0300 +Subject: RDMA/umem: Fix signature of stub ib_umem_find_best_pgsz() + +From: Jason Gunthorpe + +[ Upstream commit 61690d01db32eb1f94adc9ac2b8bb741d34e4671 ] + +The original function returns unsigned long and 0 on failure. + +Fixes: 4a35339958f1 ("RDMA/umem: Add API to find best driver supported page size in an MR") +Link: https://lore.kernel.org/r/0-v1-982a13cc5c6d+501ae-fix_best_pgsz_stub_jgg@nvidia.com +Reviewed-by: Gal Pressman +Acked-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + include/rdma/ib_umem.h | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h +index e3518fd6b95b1..9353910915d41 100644 +--- a/include/rdma/ib_umem.h ++++ b/include/rdma/ib_umem.h +@@ -95,10 +95,11 @@ static inline int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offs + size_t length) { + return -EINVAL; + } +-static inline int ib_umem_find_best_pgsz(struct ib_umem *umem, +- unsigned long pgsz_bitmap, +- unsigned long virt) { +- return -EINVAL; ++static inline unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, ++ unsigned long pgsz_bitmap, ++ unsigned long virt) ++{ ++ return 0; + } + + #endif /* CONFIG_INFINIBAND_USER_MEM */ +-- +2.25.1 + diff --git a/queue-5.8/rdma-umem-prevent-small-pages-from-being-returned-by.patch b/queue-5.8/rdma-umem-prevent-small-pages-from-being-returned-by.patch new file mode 100644 index 00000000000..212eb79901e --- /dev/null +++ b/queue-5.8/rdma-umem-prevent-small-pages-from-being-returned-by.patch @@ -0,0 +1,53 @@ +From 04e4b7ad8f54fc8f6bb40e2e5552f308a30749eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 19:41:43 -0300 +Subject: RDMA/umem: Prevent small pages from being returned by + ib_umem_find_best_pgsz() + +From: Jason Gunthorpe + +[ Upstream commit 10c75ccb54e4fe548cb16d7ed426d7d709e6ae76 ] + +rdma_for_each_block() makes assumptions about how the SGL is constructed +that don't work if the block size is below the page size used to to build +the SGL. + +The rules for umem SGL construction require that the SG's all be PAGE_SIZE +aligned and we don't encode the actual byte offset of the VA range inside +the SGL using offset and length. So rdma_for_each_block() has no idea +where the actual starting/ending point is to compute the first/last block +boundary if the starting address should be within a SGL. + +Fixing the SGL construction turns out to be really hard, and will be the +subject of other patches. For now block smaller pages. + +Fixes: 4a35339958f1 ("RDMA/umem: Add API to find best driver supported page size in an MR") +Link: https://lore.kernel.org/r/2-v2-270386b7e60b+28f4-umem_1_jgg@nvidia.com +Reviewed-by: Leon Romanovsky +Reviewed-by: Shiraz Saleem +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/umem.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index 1173b8cbe92b5..7e765fe211607 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -151,6 +151,12 @@ unsigned long ib_umem_find_best_pgsz(struct ib_umem *umem, + dma_addr_t mask; + int i; + ++ /* rdma_for_each_block() has a bug if the page size is smaller than the ++ * page size used to build the umem. For now prevent smaller page sizes ++ * from being returned. ++ */ ++ pgsz_bitmap &= GENMASK(BITS_PER_LONG - 1, PAGE_SHIFT); ++ + /* At minimum, drivers must support PAGE_SIZE or smaller */ + if (WARN_ON(!(pgsz_bitmap & GENMASK(PAGE_SHIFT, 0)))) + return 0; +-- +2.25.1 + diff --git a/queue-5.8/regulator-resolve-supply-after-creating-regulator.patch b/queue-5.8/regulator-resolve-supply-after-creating-regulator.patch new file mode 100644 index 00000000000..9795a0dd298 --- /dev/null +++ b/queue-5.8/regulator-resolve-supply-after-creating-regulator.patch @@ -0,0 +1,67 @@ +From 0af557a6f70572ff6282057c64c52d8e7f370352 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Sep 2020 23:32:41 +0200 +Subject: regulator: resolve supply after creating regulator +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michał Mirosław + +[ Upstream commit aea6cb99703e17019e025aa71643b4d3e0a24413 ] + +When creating a new regulator its supply cannot create the sysfs link +because the device is not yet published. Remove early supply resolving +since it will be done later anyway. This makes the following error +disappear and the symlinks get created instead. + + DCDC_REG1: supplied by VSYS + VSYS: could not add device link regulator.3 err -2 + +Note: It doesn't fix the problem for bypassed regulators, though. + +Fixes: 45389c47526d ("regulator: core: Add early supply resolution for regulators") +Signed-off-by: Michał Mirosław +Link: https://lore.kernel.org/r/ba09e0a8617ffeeb25cb4affffe6f3149319cef8.1601155770.git.mirq-linux@rere.qmqm.pl +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/core.c | 21 +++++++++++++-------- + 1 file changed, 13 insertions(+), 8 deletions(-) + +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index be8c709a74883..25e601bf9383e 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -5187,15 +5187,20 @@ regulator_register(const struct regulator_desc *regulator_desc, + else if (regulator_desc->supply_name) + rdev->supply_name = regulator_desc->supply_name; + +- /* +- * Attempt to resolve the regulator supply, if specified, +- * but don't return an error if we fail because we will try +- * to resolve it again later as more regulators are added. +- */ +- if (regulator_resolve_supply(rdev)) +- rdev_dbg(rdev, "unable to resolve supply\n"); +- + ret = set_machine_constraints(rdev, constraints); ++ if (ret == -EPROBE_DEFER) { ++ /* Regulator might be in bypass mode and so needs its supply ++ * to set the constraints */ ++ /* FIXME: this currently triggers a chicken-and-egg problem ++ * when creating -SUPPLY symlink in sysfs to a regulator ++ * that is just being created */ ++ ret = regulator_resolve_supply(rdev); ++ if (!ret) ++ ret = set_machine_constraints(rdev, constraints); ++ else ++ rdev_dbg(rdev, "unable to resolve supply early: %pe\n", ++ ERR_PTR(ret)); ++ } + if (ret < 0) + goto wash; + +-- +2.25.1 + diff --git a/queue-5.8/reiserfs-fix-memory-leak-in-reiserfs_parse_options.patch b/queue-5.8/reiserfs-fix-memory-leak-in-reiserfs_parse_options.patch new file mode 100644 index 00000000000..1fee54e918d --- /dev/null +++ b/queue-5.8/reiserfs-fix-memory-leak-in-reiserfs_parse_options.patch @@ -0,0 +1,49 @@ +From 82c70fffc6bcbc69f6b784e91d0f7b8ad8aee283 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Mar 2020 14:01:44 +0100 +Subject: reiserfs: Fix memory leak in reiserfs_parse_options() + +From: Jan Kara + +[ Upstream commit e9d4709fcc26353df12070566970f080e651f0c9 ] + +When a usrjquota or grpjquota mount option is used multiple times, we +will leak memory allocated for the file name. Make sure the last setting +is used and all the previous ones are properly freed. + +Reported-by: syzbot+c9e294bbe0333a6b7640@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/reiserfs/super.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c +index a6bce5b1fb1dc..1b9c7a387dc71 100644 +--- a/fs/reiserfs/super.c ++++ b/fs/reiserfs/super.c +@@ -1258,6 +1258,10 @@ static int reiserfs_parse_options(struct super_block *s, + "turned on."); + return 0; + } ++ if (qf_names[qtype] != ++ REISERFS_SB(s)->s_qf_names[qtype]) ++ kfree(qf_names[qtype]); ++ qf_names[qtype] = NULL; + if (*arg) { /* Some filename specified? */ + if (REISERFS_SB(s)->s_qf_names[qtype] + && strcmp(REISERFS_SB(s)->s_qf_names[qtype], +@@ -1287,10 +1291,6 @@ static int reiserfs_parse_options(struct super_block *s, + else + *mount_options |= 1 << REISERFS_GRPQUOTA; + } else { +- if (qf_names[qtype] != +- REISERFS_SB(s)->s_qf_names[qtype]) +- kfree(qf_names[qtype]); +- qf_names[qtype] = NULL; + if (qtype == USRQUOTA) + *mount_options &= ~(1 << REISERFS_USRQUOTA); + else +-- +2.25.1 + diff --git a/queue-5.8/reiserfs-only-call-unlock_new_inode-if-i_new.patch b/queue-5.8/reiserfs-only-call-unlock_new_inode-if-i_new.patch new file mode 100644 index 00000000000..7f432acd4c8 --- /dev/null +++ b/queue-5.8/reiserfs-only-call-unlock_new_inode-if-i_new.patch @@ -0,0 +1,44 @@ +From 301a836c3f5d8365c7c33104fde159dd4b0fc6dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Jun 2020 00:00:57 -0700 +Subject: reiserfs: only call unlock_new_inode() if I_NEW + +From: Eric Biggers + +[ Upstream commit 8859bf2b1278d064a139e3031451524a49a56bd0 ] + +unlock_new_inode() is only meant to be called after a new inode has +already been inserted into the hash table. But reiserfs_new_inode() can +call it even before it has inserted the inode, triggering the WARNING in +unlock_new_inode(). Fix this by only calling unlock_new_inode() if the +inode has the I_NEW flag set, indicating that it's in the table. + +This addresses the syzbot report "WARNING in unlock_new_inode" +(https://syzkaller.appspot.com/bug?extid=187510916eb6a14598f7). + +Link: https://lore.kernel.org/r/20200628070057.820213-1-ebiggers@kernel.org +Reported-by: syzbot+187510916eb6a14598f7@syzkaller.appspotmail.com +Signed-off-by: Eric Biggers +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/reiserfs/inode.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c +index e43fed96704d8..c76d563dec0e1 100644 +--- a/fs/reiserfs/inode.c ++++ b/fs/reiserfs/inode.c +@@ -2159,7 +2159,8 @@ int reiserfs_new_inode(struct reiserfs_transaction_handle *th, + out_inserted_sd: + clear_nlink(inode); + th->t_trans_id = 0; /* so the caller can't use this handle later */ +- unlock_new_inode(inode); /* OK to do even if we hadn't locked it */ ++ if (inode->i_state & I_NEW) ++ unlock_new_inode(inode); + iput(inode); + return err; + } +-- +2.25.1 + diff --git a/queue-5.8/remoteproc-mediatek-fix-null-pointer-dereference-on-.patch b/queue-5.8/remoteproc-mediatek-fix-null-pointer-dereference-on-.patch new file mode 100644 index 00000000000..68a6bafd39e --- /dev/null +++ b/queue-5.8/remoteproc-mediatek-fix-null-pointer-dereference-on-.patch @@ -0,0 +1,43 @@ +From ba18054339a66172741ebfd4efb80a18d6977368 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 16:24:28 +0100 +Subject: remoteproc/mediatek: fix null pointer dereference on null scp pointer + +From: Colin Ian King + +[ Upstream commit 434ac4d51407ce3764a6ae96a89d90b8ae2826fb ] + +Currently when pointer scp is null a dev_err is being called that +references the pointer which is the very thing we are trying to +avoid doing. Remove the extraneous error message to avoid this +issue. + +Addresses-Coverity: ("Dereference after null check") +Fixes: 63c13d61eafe ("remoteproc/mediatek: add SCP support for mt8183") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20200918152428.27258-1-colin.king@canonical.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/mtk_scp_ipi.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/remoteproc/mtk_scp_ipi.c b/drivers/remoteproc/mtk_scp_ipi.c +index 3d3d87210ef2c..58d1d7e571d66 100644 +--- a/drivers/remoteproc/mtk_scp_ipi.c ++++ b/drivers/remoteproc/mtk_scp_ipi.c +@@ -30,10 +30,8 @@ int scp_ipi_register(struct mtk_scp *scp, + scp_ipi_handler_t handler, + void *priv) + { +- if (!scp) { +- dev_err(scp->dev, "scp device is not ready\n"); ++ if (!scp) + return -EPROBE_DEFER; +- } + + if (WARN_ON(id >= SCP_IPI_MAX) || WARN_ON(handler == NULL)) + return -EINVAL; +-- +2.25.1 + diff --git a/queue-5.8/rpmsg-avoid-double-free-in-mtk_rpmsg_register_device.patch b/queue-5.8/rpmsg-avoid-double-free-in-mtk_rpmsg_register_device.patch new file mode 100644 index 00000000000..8339caaf49e --- /dev/null +++ b/queue-5.8/rpmsg-avoid-double-free-in-mtk_rpmsg_register_device.patch @@ -0,0 +1,52 @@ +From d1c051e1f619ce902a7b597007a584b81d18d412 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 08:05:58 +0800 +Subject: rpmsg: Avoid double-free in mtk_rpmsg_register_device + +From: Nicolas Boichat + +[ Upstream commit 231331b2dbd71487159a0400d9ffd967eb0d0e08 ] + +If rpmsg_register_device fails, it will call +mtk_rpmsg_release_device which already frees mdev. + +Fixes: 7017996951fd ("rpmsg: add rpmsg support for mt8183 SCP.") +Signed-off-by: Nicolas Boichat +Reviewed-by: Mathieu Poirier +Link: https://lore.kernel.org/r/20200903080547.v3.1.I56cf27cd59f4013bd074dc622c8b8248b034a4cc@changeid +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/mtk_rpmsg.c | 9 +-------- + 1 file changed, 1 insertion(+), 8 deletions(-) + +diff --git a/drivers/rpmsg/mtk_rpmsg.c b/drivers/rpmsg/mtk_rpmsg.c +index 83f2b8804ee98..96a17ec291401 100644 +--- a/drivers/rpmsg/mtk_rpmsg.c ++++ b/drivers/rpmsg/mtk_rpmsg.c +@@ -200,7 +200,6 @@ static int mtk_rpmsg_register_device(struct mtk_rpmsg_rproc_subdev *mtk_subdev, + struct rpmsg_device *rpdev; + struct mtk_rpmsg_device *mdev; + struct platform_device *pdev = mtk_subdev->pdev; +- int ret; + + mdev = kzalloc(sizeof(*mdev), GFP_KERNEL); + if (!mdev) +@@ -219,13 +218,7 @@ static int mtk_rpmsg_register_device(struct mtk_rpmsg_rproc_subdev *mtk_subdev, + rpdev->dev.parent = &pdev->dev; + rpdev->dev.release = mtk_rpmsg_release_device; + +- ret = rpmsg_register_device(rpdev); +- if (ret) { +- kfree(mdev); +- return ret; +- } +- +- return 0; ++ return rpmsg_register_device(rpdev); + } + + static void mtk_register_device_work_function(struct work_struct *register_work) +-- +2.25.1 + diff --git a/queue-5.8/rpmsg-smd-fix-a-kobj-leak-in-in-qcom_smd_parse_edge.patch b/queue-5.8/rpmsg-smd-fix-a-kobj-leak-in-in-qcom_smd_parse_edge.patch new file mode 100644 index 00000000000..e52462d19fc --- /dev/null +++ b/queue-5.8/rpmsg-smd-fix-a-kobj-leak-in-in-qcom_smd_parse_edge.patch @@ -0,0 +1,111 @@ +From eb48bc28f8f2d360e37efc131b6367548dd1ff92 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 10:18:41 +0300 +Subject: rpmsg: smd: Fix a kobj leak in in qcom_smd_parse_edge() + +From: Dan Carpenter + +[ Upstream commit e69ee0cf655e8e0c4a80f4319e36019b74f17639 ] + +We need to call of_node_put(node) on the error paths for this function. + +Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20200908071841.GA294938@mwanda +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/rpmsg/qcom_smd.c | 32 ++++++++++++++++++++++---------- + 1 file changed, 22 insertions(+), 10 deletions(-) + +diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c +index 4abbeea782fa4..19903de6268db 100644 +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -1338,7 +1338,7 @@ static int qcom_smd_parse_edge(struct device *dev, + ret = of_property_read_u32(node, key, &edge->edge_id); + if (ret) { + dev_err(dev, "edge missing %s property\n", key); +- return -EINVAL; ++ goto put_node; + } + + edge->remote_pid = QCOM_SMEM_HOST_ANY; +@@ -1349,32 +1349,37 @@ static int qcom_smd_parse_edge(struct device *dev, + edge->mbox_client.knows_txdone = true; + edge->mbox_chan = mbox_request_channel(&edge->mbox_client, 0); + if (IS_ERR(edge->mbox_chan)) { +- if (PTR_ERR(edge->mbox_chan) != -ENODEV) +- return PTR_ERR(edge->mbox_chan); ++ if (PTR_ERR(edge->mbox_chan) != -ENODEV) { ++ ret = PTR_ERR(edge->mbox_chan); ++ goto put_node; ++ } + + edge->mbox_chan = NULL; + + syscon_np = of_parse_phandle(node, "qcom,ipc", 0); + if (!syscon_np) { + dev_err(dev, "no qcom,ipc node\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto put_node; + } + + edge->ipc_regmap = syscon_node_to_regmap(syscon_np); +- if (IS_ERR(edge->ipc_regmap)) +- return PTR_ERR(edge->ipc_regmap); ++ if (IS_ERR(edge->ipc_regmap)) { ++ ret = PTR_ERR(edge->ipc_regmap); ++ goto put_node; ++ } + + key = "qcom,ipc"; + ret = of_property_read_u32_index(node, key, 1, &edge->ipc_offset); + if (ret < 0) { + dev_err(dev, "no offset in %s\n", key); +- return -EINVAL; ++ goto put_node; + } + + ret = of_property_read_u32_index(node, key, 2, &edge->ipc_bit); + if (ret < 0) { + dev_err(dev, "no bit in %s\n", key); +- return -EINVAL; ++ goto put_node; + } + } + +@@ -1385,7 +1390,8 @@ static int qcom_smd_parse_edge(struct device *dev, + irq = irq_of_parse_and_map(node, 0); + if (irq < 0) { + dev_err(dev, "required smd interrupt missing\n"); +- return -EINVAL; ++ ret = irq; ++ goto put_node; + } + + ret = devm_request_irq(dev, irq, +@@ -1393,12 +1399,18 @@ static int qcom_smd_parse_edge(struct device *dev, + node->name, edge); + if (ret) { + dev_err(dev, "failed to request smd irq\n"); +- return ret; ++ goto put_node; + } + + edge->irq = irq; + + return 0; ++ ++put_node: ++ of_node_put(node); ++ edge->of_node = NULL; ++ ++ return ret; + } + + /* +-- +2.25.1 + diff --git a/queue-5.8/rtc-ds1307-clear-osf-flag-on-ds1388-when-setting-tim.patch b/queue-5.8/rtc-ds1307-clear-osf-flag-on-ds1388-when-setting-tim.patch new file mode 100644 index 00000000000..e8a8156ed6a --- /dev/null +++ b/queue-5.8/rtc-ds1307-clear-osf-flag-on-ds1388-when-setting-tim.patch @@ -0,0 +1,38 @@ +From 0be68d90927753d1878a7a1dbca85045056c5985 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 13:35:43 +1200 +Subject: rtc: ds1307: Clear OSF flag on DS1388 when setting time + +From: Chris Packham + +[ Upstream commit f471b05f76e4b1b6ba07ebc7681920a5c5b97c5d ] + +Ensure the OSF flag is cleared on the DS1388 when the clock is set. + +Fixes: df11b323b16f ("rtc: ds1307: handle oscillator failure flags for ds1388 variant") +Signed-off-by: Chris Packham +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20200818013543.4283-1-chris.packham@alliedtelesis.co.nz +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-ds1307.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c +index 49702942bb086..70b198423deba 100644 +--- a/drivers/rtc/rtc-ds1307.c ++++ b/drivers/rtc/rtc-ds1307.c +@@ -352,6 +352,10 @@ static int ds1307_set_time(struct device *dev, struct rtc_time *t) + regmap_update_bits(ds1307->regmap, DS1340_REG_FLAG, + DS1340_BIT_OSF, 0); + break; ++ case ds_1388: ++ regmap_update_bits(ds1307->regmap, DS1388_REG_FLAG, ++ DS1388_BIT_OSF, 0); ++ break; + case mcp794xx: + /* + * these bits were cleared when preparing the date/time +-- +2.25.1 + diff --git a/queue-5.8/rtl8xxxu-prevent-potential-memory-leak.patch b/queue-5.8/rtl8xxxu-prevent-potential-memory-leak.patch new file mode 100644 index 00000000000..7592b553cb8 --- /dev/null +++ b/queue-5.8/rtl8xxxu-prevent-potential-memory-leak.patch @@ -0,0 +1,65 @@ +From 4a7ab7defc3a2a05f66f79e5993f2d5697966363 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Sep 2020 12:04:24 +0800 +Subject: rtl8xxxu: prevent potential memory leak + +From: Chris Chiu + +[ Upstream commit 86279456a4d47782398d3cb8193f78f672e36cac ] + +Free the skb if usb_submit_urb fails on rx_urb. And free the urb +no matter usb_submit_urb succeeds or not in rtl8xxxu_submit_int_urb. + +Signed-off-by: Chris Chiu +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200906040424.22022-1-chiu@endlessm.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +index 19efae462a242..5cd7ef3625c5e 100644 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c +@@ -5795,7 +5795,6 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) + ret = usb_submit_urb(urb, GFP_KERNEL); + if (ret) { + usb_unanchor_urb(urb); +- usb_free_urb(urb); + goto error; + } + +@@ -5804,6 +5803,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw) + rtl8xxxu_write32(priv, REG_USB_HIMR, val32); + + error: ++ usb_free_urb(urb); + return ret; + } + +@@ -6318,6 +6318,7 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) + struct rtl8xxxu_priv *priv = hw->priv; + struct rtl8xxxu_rx_urb *rx_urb; + struct rtl8xxxu_tx_urb *tx_urb; ++ struct sk_buff *skb; + unsigned long flags; + int ret, i; + +@@ -6368,6 +6369,13 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw) + rx_urb->hw = hw; + + ret = rtl8xxxu_submit_rx_urb(priv, rx_urb); ++ if (ret) { ++ if (ret != -ENOMEM) { ++ skb = (struct sk_buff *)rx_urb->urb.context; ++ dev_kfree_skb(skb); ++ } ++ rtl8xxxu_queue_rx_urb(priv, rx_urb); ++ } + } + + schedule_delayed_work(&priv->ra_watchdog, 2 * HZ); +-- +2.25.1 + diff --git a/queue-5.8/rtw88-don-t-treat-null-pointer-as-an-array.patch b/queue-5.8/rtw88-don-t-treat-null-pointer-as-an-array.patch new file mode 100644 index 00000000000..5d657ea0acc --- /dev/null +++ b/queue-5.8/rtw88-don-t-treat-null-pointer-as-an-array.patch @@ -0,0 +1,46 @@ +From 2a49c60280b3abdbda1554a2a2cfd6e225adc1b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 14:17:16 -0700 +Subject: rtw88: don't treat NULL pointer as an array + +From: Brian Norris + +[ Upstream commit 22b726cbdd09d9891ede8aa122a950d2d0ae5e09 ] + +I'm not a standards expert, but this really looks to be undefined +behavior, when chip->dig_cck may be NULL. (And, we're trying to do a +NULL check a few lines down, because some chip variants will use NULL.) + +Fixes: fc637a860a82 ("rtw88: 8723d: Set IG register for CCK rate") +Signed-off-by: Brian Norris +Acked-by: Yan-Hsuan Chuang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200821211716.1631556-1-briannorris@chromium.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/phy.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/phy.c b/drivers/net/wireless/realtek/rtw88/phy.c +index 8d93f31597469..9687b376d221b 100644 +--- a/drivers/net/wireless/realtek/rtw88/phy.c ++++ b/drivers/net/wireless/realtek/rtw88/phy.c +@@ -147,12 +147,13 @@ void rtw_phy_dig_write(struct rtw_dev *rtwdev, u8 igi) + { + struct rtw_chip_info *chip = rtwdev->chip; + struct rtw_hal *hal = &rtwdev->hal; +- const struct rtw_hw_reg *dig_cck = &chip->dig_cck[0]; + u32 addr, mask; + u8 path; + +- if (dig_cck) ++ if (chip->dig_cck) { ++ const struct rtw_hw_reg *dig_cck = &chip->dig_cck[0]; + rtw_write32_mask(rtwdev, dig_cck->addr, dig_cck->mask, igi >> 1); ++ } + + for (path = 0; path < hal->rf_path_num; path++) { + addr = chip->dig[path].addr; +-- +2.25.1 + diff --git a/queue-5.8/rtw88-fix-potential-probe-error-handling-race-with-w.patch b/queue-5.8/rtw88-fix-potential-probe-error-handling-race-with-w.patch new file mode 100644 index 00000000000..a77702aa02c --- /dev/null +++ b/queue-5.8/rtw88-fix-potential-probe-error-handling-race-with-w.patch @@ -0,0 +1,48 @@ +From a62b3a4e2fc1b2439d2fb6faa938de42af3318bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Sep 2020 15:26:21 +0200 +Subject: rtw88: Fix potential probe error handling race with wow firmware + loading +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andreas Färber + +[ Upstream commit ac4bac99161e8f7a7a9faef70d8ca8f69d5493a9 ] + +If rtw_core_init() fails to load the wow firmware, rtw_core_deinit() +will not get called to clean up the regular firmware. + +Ensure that an error loading the wow firmware does not produce an oops +for the regular firmware by waiting on its completion to be signalled +before returning. Also release the loaded firmware. + +Fixes: c8e5695eae99 ("rtw88: load wowlan firmware if wowlan is supported") +Cc: Chin-Yen Lee +Cc: Yan-Hsuan Chuang +Signed-off-by: Andreas Färber +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200920132621.26468-3-afaerber@suse.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 80b880b671eaa..6a881d0be9bf0 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1465,6 +1465,9 @@ int rtw_core_init(struct rtw_dev *rtwdev) + ret = rtw_load_firmware(rtwdev, RTW_WOWLAN_FW); + if (ret) { + rtw_warn(rtwdev, "no wow firmware loaded\n"); ++ wait_for_completion(&rtwdev->fw.completion); ++ if (rtwdev->fw.firmware) ++ release_firmware(rtwdev->fw.firmware); + return ret; + } + } +-- +2.25.1 + diff --git a/queue-5.8/rtw88-fix-probe-error-handling-race-with-firmware-lo.patch b/queue-5.8/rtw88-fix-probe-error-handling-race-with-firmware-lo.patch new file mode 100644 index 00000000000..9888e7e9123 --- /dev/null +++ b/queue-5.8/rtw88-fix-probe-error-handling-race-with-firmware-lo.patch @@ -0,0 +1,111 @@ +From 8dee23e00bd35f23a0465e2883346c58da2ebdc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Sep 2020 15:26:20 +0200 +Subject: rtw88: Fix probe error handling race with firmware loading +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andreas Färber + +[ Upstream commit ecda9cda3338b594a1b82d62018c247132a39e57 ] + +In case of rtw8822be, a probe failure after successful rtw_core_init() +has been observed to occasionally lead to an oops from rtw_load_firmware_cb(): + +[ 3.924268] pci 0001:01:00.0: [10ec:b822] type 00 class 0xff0000 +[ 3.930531] pci 0001:01:00.0: reg 0x10: [io 0x0000-0x00ff] +[ 3.936360] pci 0001:01:00.0: reg 0x18: [mem 0x00000000-0x0000ffff 64bit] +[ 3.944042] pci 0001:01:00.0: supports D1 D2 +[ 3.948438] pci 0001:01:00.0: PME# supported from D0 D1 D2 D3hot D3cold +[ 3.957312] pci 0001:01:00.0: BAR 2: no space for [mem size 0x00010000 64bit] +[ 3.964645] pci 0001:01:00.0: BAR 2: failed to assign [mem size 0x00010000 64bit] +[ 3.972332] pci 0001:01:00.0: BAR 0: assigned [io 0x10000-0x100ff] +[ 3.986240] rtw_8822be 0001:01:00.0: enabling device (0000 -> 0001) +[ 3.992735] rtw_8822be 0001:01:00.0: failed to map pci memory +[ 3.998638] rtw_8822be 0001:01:00.0: failed to request pci io region +[ 4.005166] rtw_8822be 0001:01:00.0: failed to setup pci resources +[ 4.011580] rtw_8822be: probe of 0001:01:00.0 failed with error -12 +[ 4.018827] cfg80211: Loading compiled-in X.509 certificates for regulatory database +[ 4.029121] cfg80211: Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7' +[ 4.050828] Unable to handle kernel paging request at virtual address edafeaac9607952c +[ 4.058975] Mem abort info: +[ 4.058980] ESR = 0x96000004 +[ 4.058990] EC = 0x25: DABT (current EL), IL = 32 bits +[ 4.070353] SET = 0, FnV = 0 +[ 4.073487] EA = 0, S1PTW = 0 +[ 4.073501] dw-apb-uart 98007800.serial: forbid DMA for kernel console +[ 4.076723] Data abort info: +[ 4.086415] ISV = 0, ISS = 0x00000004 +[ 4.087731] Freeing unused kernel memory: 1792K +[ 4.090391] CM = 0, WnR = 0 +[ 4.098091] [edafeaac9607952c] address between user and kernel address ranges +[ 4.105418] Internal error: Oops: 96000004 [#1] PREEMPT SMP +[ 4.111129] Modules linked in: +[ 4.114275] CPU: 1 PID: 31 Comm: kworker/1:1 Not tainted 5.9.0-rc5-next-20200915+ #700 +[ 4.122386] Hardware name: Realtek Saola EVB (DT) +[ 4.127223] Workqueue: events request_firmware_work_func +[ 4.132676] pstate: 60000005 (nZCv daif -PAN -UAO BTYPE=--) +[ 4.138393] pc : rtw_load_firmware_cb+0x54/0xbc +[ 4.143040] lr : request_firmware_work_func+0x44/0xb4 +[ 4.148217] sp : ffff800010133d70 +[ 4.151616] x29: ffff800010133d70 x28: 0000000000000000 +[ 4.157069] x27: 0000000000000000 x26: 0000000000000000 +[ 4.162520] x25: 0000000000000000 x24: 0000000000000000 +[ 4.167971] x23: ffff00007ac21908 x22: ffff00007ebb2100 +[ 4.173424] x21: ffff00007ad35880 x20: edafeaac96079504 +[ 4.178877] x19: ffff00007ad35870 x18: 0000000000000000 +[ 4.184328] x17: 00000000000044d8 x16: 0000000000004310 +[ 4.189780] x15: 0000000000000800 x14: 00000000ef006305 +[ 4.195231] x13: ffffffff00000000 x12: ffffffffffffffff +[ 4.200682] x11: 0000000000000020 x10: 0000000000000003 +[ 4.206135] x9 : 0000000000000000 x8 : ffff00007e73f680 +[ 4.211585] x7 : 0000000000000000 x6 : ffff80001119b588 +[ 4.217036] x5 : ffff00007e649c80 x4 : ffff00007e649c80 +[ 4.222487] x3 : ffff80001119b588 x2 : ffff8000108d1718 +[ 4.227940] x1 : ffff800011bd5000 x0 : ffff00007ac21600 +[ 4.233391] Call trace: +[ 4.235906] rtw_load_firmware_cb+0x54/0xbc +[ 4.240198] request_firmware_work_func+0x44/0xb4 +[ 4.245027] process_one_work+0x178/0x1e4 +[ 4.249142] worker_thread+0x1d0/0x268 +[ 4.252989] kthread+0xe8/0xf8 +[ 4.256127] ret_from_fork+0x10/0x18 +[ 4.259800] Code: f94013f5 a8c37bfd d65f03c0 f9000260 (f9401681) +[ 4.266049] ---[ end trace f822ebae1a8545c2 ]--- + +To avoid this, wait on the completion callbacks in rtw_core_deinit() +before releasing firmware and continuing teardown. + +Note that rtw_wait_firmware_completion() was introduced with +c8e5695eae9959fc5774c0f490f2450be8bad3de ("rtw88: load wowlan firmware +if wowlan is supported"), so backports to earlier branches may need to +inline wait_for_completion(&rtwdev->fw.completion) instead. + +Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver") +Fixes: c8e5695eae99 ("rtw88: load wowlan firmware if wowlan is supported") +Cc: Yan-Hsuan Chuang +Signed-off-by: Andreas Färber +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200920132621.26468-2-afaerber@suse.de +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw88/main.c b/drivers/net/wireless/realtek/rtw88/main.c +index 665d4bbdee6a0..80b880b671eaa 100644 +--- a/drivers/net/wireless/realtek/rtw88/main.c ++++ b/drivers/net/wireless/realtek/rtw88/main.c +@@ -1479,6 +1479,8 @@ void rtw_core_deinit(struct rtw_dev *rtwdev) + struct rtw_rsvd_page *rsvd_pkt, *tmp; + unsigned long flags; + ++ rtw_wait_firmware_completion(rtwdev); ++ + if (fw->firmware) + release_firmware(fw->firmware); + +-- +2.25.1 + diff --git a/queue-5.8/rtw88-increse-the-size-of-rx-buffer-size.patch b/queue-5.8/rtw88-increse-the-size-of-rx-buffer-size.patch new file mode 100644 index 00000000000..a4067083293 --- /dev/null +++ b/queue-5.8/rtw88-increse-the-size-of-rx-buffer-size.patch @@ -0,0 +1,39 @@ +From 9b1aeab1d249844dab0cb6266360665c811d4c78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 14:12:15 +0800 +Subject: rtw88: increse the size of rx buffer size + +From: Tzu-En Huang + +[ Upstream commit ee755732b7a16af018daa77d9562d2493fb7092f ] + +The vht capability of MAX_MPDU_LENGTH is 11454 in rtw88; however, the rx +buffer size for each packet is 8192. When receiving packets that are +larger than rx buffer size, it will leads to rx buffer ring overflow. + +Signed-off-by: Tzu-En Huang +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200925061219.23754-2-tehuang@realtek.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/pci.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/realtek/rtw88/pci.h b/drivers/net/wireless/realtek/rtw88/pci.h +index 024c2bc275cbe..ca17aa9cf7dc7 100644 +--- a/drivers/net/wireless/realtek/rtw88/pci.h ++++ b/drivers/net/wireless/realtek/rtw88/pci.h +@@ -9,8 +9,8 @@ + #define RTK_BEQ_TX_DESC_NUM 256 + + #define RTK_MAX_RX_DESC_NUM 512 +-/* 8K + rx desc size */ +-#define RTK_PCI_RX_BUF_SIZE (8192 + 24) ++/* 11K + rx desc size */ ++#define RTK_PCI_RX_BUF_SIZE (11454 + 24) + + #define RTK_PCI_CTRL 0x300 + #define BIT_RST_TRXDMA_INTF BIT(20) +-- +2.25.1 + diff --git a/queue-5.8/rtw88-pci-power-cycle-device-during-shutdown.patch b/queue-5.8/rtw88-pci-power-cycle-device-during-shutdown.patch new file mode 100644 index 00000000000..ba483ab3935 --- /dev/null +++ b/queue-5.8/rtw88-pci-power-cycle-device-during-shutdown.patch @@ -0,0 +1,47 @@ +From 5f61394497750690dc6a561a271112c5c459ca4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Sep 2020 00:55:08 +0800 +Subject: rtw88: pci: Power cycle device during shutdown + +From: Kai-Heng Feng + +[ Upstream commit 44492e70adc8086c42d3745d21d591657a427f04 ] + +There are reports that 8822CE fails to work rtw88 with "failed to read DBI +register" error. Also I have a system with 8723DE which freezes the whole +system when the rtw88 is probing the device. + +According to [1], platform firmware may not properly power manage the +device during shutdown. I did some expirements and putting the device to +D3 can workaround the issue. + +So let's power cycle the device by putting the device to D3 at shutdown +to prevent the issue from happening. + +[1] https://bugzilla.kernel.org/show_bug.cgi?id=206411#c9 + +BugLink: https://bugs.launchpad.net/bugs/1872984 +Signed-off-by: Kai-Heng Feng +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200928165508.20775-1-kai.heng.feng@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/realtek/rtw88/pci.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/realtek/rtw88/pci.c b/drivers/net/wireless/realtek/rtw88/pci.c +index 3413973bc4750..7f1f5073b9f4d 100644 +--- a/drivers/net/wireless/realtek/rtw88/pci.c ++++ b/drivers/net/wireless/realtek/rtw88/pci.c +@@ -1599,6 +1599,8 @@ void rtw_pci_shutdown(struct pci_dev *pdev) + + if (chip->ops->shutdown) + chip->ops->shutdown(rtwdev); ++ ++ pci_set_power_state(pdev, PCI_D3hot); + } + EXPORT_SYMBOL(rtw_pci_shutdown); + +-- +2.25.1 + diff --git a/queue-5.8/s390-pci-mark-all-vfs-as-not-implementing-pci_comman.patch b/queue-5.8/s390-pci-mark-all-vfs-as-not-implementing-pci_comman.patch new file mode 100644 index 00000000000..83746321319 --- /dev/null +++ b/queue-5.8/s390-pci-mark-all-vfs-as-not-implementing-pci_comman.patch @@ -0,0 +1,45 @@ +From 6c5f169ccc6e3b18c64e0e2f6d302b6e9d6bdb17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 10:59:56 -0400 +Subject: s390/pci: Mark all VFs as not implementing PCI_COMMAND_MEMORY + +From: Matthew Rosato + +[ Upstream commit 08b6e22b850c28b6032da1e4d767a33116e23dfb ] + +For s390 we can have VFs that are passed-through without the associated +PF. Firmware provides an emulation layer to allow these devices to +operate independently, but is missing emulation of the Memory Space +Enable bit. For these as well as linked VFs, set no_command_memory +which specifies these devices do not implement PCI_COMMAND_MEMORY. + +Fixes: abafbc551fdd ("vfio-pci: Invalidate mmaps and block MMIO access on disabled memory") +Signed-off-by: Matthew Rosato +Reviewed-by: Niklas Schnelle +Reviewed-by: Pierre Morel +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + arch/s390/pci/pci_bus.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/pci/pci_bus.c b/arch/s390/pci/pci_bus.c +index 5967f30141563..c93486a9989bc 100644 +--- a/arch/s390/pci/pci_bus.c ++++ b/arch/s390/pci/pci_bus.c +@@ -197,9 +197,10 @@ void pcibios_bus_add_device(struct pci_dev *pdev) + * With pdev->no_vf_scan the common PCI probing code does not + * perform PF/VF linking. + */ +- if (zdev->vfn) ++ if (zdev->vfn) { + zpci_bus_setup_virtfn(zdev->zbus, pdev, zdev->vfn); +- ++ pdev->no_command_memory = 1; ++ } + } + + static int zpci_bus_add_device(struct zpci_bus *zbus, struct zpci_dev *zdev) +-- +2.25.1 + diff --git a/queue-5.8/s390-qeth-strictly-order-bridge-address-events.patch b/queue-5.8/s390-qeth-strictly-order-bridge-address-events.patch new file mode 100644 index 00000000000..e943ad3d38f --- /dev/null +++ b/queue-5.8/s390-qeth-strictly-order-bridge-address-events.patch @@ -0,0 +1,215 @@ +From fb538911d11db15ff92e0588cba365eb92c9d4f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 10:17:05 +0200 +Subject: s390/qeth: strictly order bridge address events + +From: Julian Wiedmann + +[ Upstream commit 9d6a569a4cbab5a8b4c959d4e312daeecb7c9f09 ] + +The current code for bridge address events has two shortcomings in its +control sequence: + +1. after disabling address events via PNSO, we don't flush the remaining + events from the event_wq. So if the feature is re-enabled fast + enough, stale events could leak over. +2. PNSO and the events' arrival via the READ ccw device are unordered. + So even if we flushed the workqueue, it's difficult to say whether + the READ device might produce more events onto the workqueue + afterwards. + +Fix this by +1. explicitly fencing off the events when we no longer care, in the + READ device's event handler. This ensures that once we flush the + workqueue, it doesn't get additional address events. +2. Flush the workqueue after disabling the events & fencing them off. + As the code that triggers the flush will typically hold the sbp_lock, + we need to rework the worker code to avoid a deadlock here in case + of a 'notifications-stopped' event. In case of lock contention, + requeue such an event with a delay. We'll eventually aquire the lock, + or spot that the feature has been disabled and the event can thus be + discarded. + +This leaves the theoretical race that a stale event could arrive +_after_ we re-enabled ourselves to receive events again. Such an event +would be impossible to distinguish from a 'good' event, nothing we can +do about it. + +Signed-off-by: Julian Wiedmann +Reviewed-by: Alexandra Winter +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/s390/net/qeth_core.h | 6 ++++ + drivers/s390/net/qeth_l2_main.c | 53 ++++++++++++++++++++++++++++----- + drivers/s390/net/qeth_l2_sys.c | 1 + + 3 files changed, 52 insertions(+), 8 deletions(-) + +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index 51ea56b73a97d..4e30047d76c46 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -680,6 +680,11 @@ struct qeth_card_blkt { + int inter_packet_jumbo; + }; + ++enum qeth_pnso_mode { ++ QETH_PNSO_NONE, ++ QETH_PNSO_BRIDGEPORT, ++}; ++ + #define QETH_BROADCAST_WITH_ECHO 0x01 + #define QETH_BROADCAST_WITHOUT_ECHO 0x02 + struct qeth_card_info { +@@ -696,6 +701,7 @@ struct qeth_card_info { + /* no bitfield, we take a pointer on these two: */ + u8 has_lp2lp_cso_v6; + u8 has_lp2lp_cso_v4; ++ enum qeth_pnso_mode pnso_mode; + enum qeth_card_types type; + enum qeth_link_types link_type; + int broadcast_capable; +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index b4e06aeb6dc1c..0384b45a72658 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -273,6 +273,17 @@ static int qeth_l2_vlan_rx_kill_vid(struct net_device *dev, + return qeth_l2_send_setdelvlan(card, vid, IPA_CMD_DELVLAN); + } + ++static void qeth_l2_set_pnso_mode(struct qeth_card *card, ++ enum qeth_pnso_mode mode) ++{ ++ spin_lock_irq(get_ccwdev_lock(CARD_RDEV(card))); ++ WRITE_ONCE(card->info.pnso_mode, mode); ++ spin_unlock_irq(get_ccwdev_lock(CARD_RDEV(card))); ++ ++ if (mode == QETH_PNSO_NONE) ++ drain_workqueue(card->event_wq); ++} ++ + static void qeth_l2_stop_card(struct qeth_card *card) + { + QETH_CARD_TEXT(card, 2, "stopcard"); +@@ -291,7 +302,7 @@ static void qeth_l2_stop_card(struct qeth_card *card) + + qeth_qdio_clear_card(card, 0); + qeth_clear_working_pool_list(card); +- flush_workqueue(card->event_wq); ++ qeth_l2_set_pnso_mode(card, QETH_PNSO_NONE); + qeth_flush_local_addrs(card); + card->info.promisc_mode = 0; + } +@@ -1165,19 +1176,34 @@ static void qeth_bridge_state_change(struct qeth_card *card, + } + + struct qeth_addr_change_data { +- struct work_struct worker; ++ struct delayed_work dwork; + struct qeth_card *card; + struct qeth_ipacmd_addr_change ac_event; + }; + + static void qeth_addr_change_event_worker(struct work_struct *work) + { +- struct qeth_addr_change_data *data = +- container_of(work, struct qeth_addr_change_data, worker); ++ struct delayed_work *dwork = to_delayed_work(work); ++ struct qeth_addr_change_data *data; ++ struct qeth_card *card; + int i; + ++ data = container_of(dwork, struct qeth_addr_change_data, dwork); ++ card = data->card; ++ + QETH_CARD_TEXT(data->card, 4, "adrchgew"); ++ ++ if (READ_ONCE(card->info.pnso_mode) == QETH_PNSO_NONE) ++ goto free; ++ + if (data->ac_event.lost_event_mask) { ++ /* Potential re-config in progress, try again later: */ ++ if (!mutex_trylock(&card->sbp_lock)) { ++ queue_delayed_work(card->event_wq, dwork, ++ msecs_to_jiffies(100)); ++ return; ++ } ++ + dev_info(&data->card->gdev->dev, + "Address change notification stopped on %s (%s)\n", + data->card->dev->name, +@@ -1186,8 +1212,9 @@ static void qeth_addr_change_event_worker(struct work_struct *work) + : (data->ac_event.lost_event_mask == 0x02) + ? "Bridge port state change" + : "Unknown reason"); +- mutex_lock(&data->card->sbp_lock); ++ + data->card->options.sbp.hostnotification = 0; ++ card->info.pnso_mode = QETH_PNSO_NONE; + mutex_unlock(&data->card->sbp_lock); + qeth_bridge_emit_host_event(data->card, anev_abort, + 0, NULL, NULL); +@@ -1201,6 +1228,8 @@ static void qeth_addr_change_event_worker(struct work_struct *work) + &entry->token, + &entry->addr_lnid); + } ++ ++free: + kfree(data); + } + +@@ -1212,6 +1241,9 @@ static void qeth_addr_change_event(struct qeth_card *card, + struct qeth_addr_change_data *data; + int extrasize; + ++ if (card->info.pnso_mode == QETH_PNSO_NONE) ++ return; ++ + QETH_CARD_TEXT(card, 4, "adrchgev"); + if (cmd->hdr.return_code != 0x0000) { + if (cmd->hdr.return_code == 0x0010) { +@@ -1231,11 +1263,11 @@ static void qeth_addr_change_event(struct qeth_card *card, + QETH_CARD_TEXT(card, 2, "ACNalloc"); + return; + } +- INIT_WORK(&data->worker, qeth_addr_change_event_worker); ++ INIT_DELAYED_WORK(&data->dwork, qeth_addr_change_event_worker); + data->card = card; + memcpy(&data->ac_event, hostevs, + sizeof(struct qeth_ipacmd_addr_change) + extrasize); +- queue_work(card->event_wq, &data->worker); ++ queue_delayed_work(card->event_wq, &data->dwork, 0); + } + + /* SETBRIDGEPORT support; sending commands */ +@@ -1556,9 +1588,14 @@ int qeth_bridgeport_an_set(struct qeth_card *card, int enable) + + if (enable) { + qeth_bridge_emit_host_event(card, anev_reset, 0, NULL, NULL); ++ qeth_l2_set_pnso_mode(card, QETH_PNSO_BRIDGEPORT); + rc = qeth_l2_pnso(card, 1, qeth_bridgeport_an_set_cb, card); +- } else ++ if (rc) ++ qeth_l2_set_pnso_mode(card, QETH_PNSO_NONE); ++ } else { + rc = qeth_l2_pnso(card, 0, NULL, NULL); ++ qeth_l2_set_pnso_mode(card, QETH_PNSO_NONE); ++ } + return rc; + } + +diff --git a/drivers/s390/net/qeth_l2_sys.c b/drivers/s390/net/qeth_l2_sys.c +index 86bcae992f725..4695d25e54f24 100644 +--- a/drivers/s390/net/qeth_l2_sys.c ++++ b/drivers/s390/net/qeth_l2_sys.c +@@ -157,6 +157,7 @@ static ssize_t qeth_bridgeport_hostnotification_store(struct device *dev, + rc = -EBUSY; + else if (qeth_card_hw_is_reachable(card)) { + rc = qeth_bridgeport_an_set(card, enable); ++ /* sbp_lock ensures ordering vs notifications-stopped events */ + if (!rc) + card->options.sbp.hostnotification = enable; + } else +-- +2.25.1 + diff --git a/queue-5.8/samples-bpf-fix-to-xdpsock-to-avoid-recycling-frames.patch b/queue-5.8/samples-bpf-fix-to-xdpsock-to-avoid-recycling-frames.patch new file mode 100644 index 00000000000..64b94fe915c --- /dev/null +++ b/queue-5.8/samples-bpf-fix-to-xdpsock-to-avoid-recycling-frames.patch @@ -0,0 +1,71 @@ +From 2fd78b6374825d97d03c6b1e0036be0198d0a761 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Aug 2020 00:17:17 +0800 +Subject: samples/bpf: Fix to xdpsock to avoid recycling frames +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Weqaar Janjua + +[ Upstream commit b69e56cf765155dcac0037d7d0f162a2afab76c2 ] + +The txpush program in the xdpsock sample application is supposed +to send out all packets in the umem in a round-robin fashion. +The problem is that it only cycled through the first BATCH_SIZE +worth of packets. Fixed this so that it cycles through all buffers +in the umem as intended. + +Fixes: 248c7f9c0e21 ("samples/bpf: convert xdpsock to use libbpf for AF_XDP access") +Signed-off-by: Weqaar Janjua +Signed-off-by: Daniel Borkmann +Acked-by: Björn Töpel +Link: https://lore.kernel.org/bpf/20200828161717.42705-1-weqaar.a.janjua@intel.com +Signed-off-by: Sasha Levin +--- + samples/bpf/xdpsock_user.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/samples/bpf/xdpsock_user.c b/samples/bpf/xdpsock_user.c +index c91e91362a0c6..0151bb0b2fc71 100644 +--- a/samples/bpf/xdpsock_user.c ++++ b/samples/bpf/xdpsock_user.c +@@ -921,7 +921,7 @@ static void rx_drop_all(void) + } + } + +-static void tx_only(struct xsk_socket_info *xsk, u32 frame_nb, int batch_size) ++static void tx_only(struct xsk_socket_info *xsk, u32 *frame_nb, int batch_size) + { + u32 idx; + unsigned int i; +@@ -934,14 +934,14 @@ static void tx_only(struct xsk_socket_info *xsk, u32 frame_nb, int batch_size) + for (i = 0; i < batch_size; i++) { + struct xdp_desc *tx_desc = xsk_ring_prod__tx_desc(&xsk->tx, + idx + i); +- tx_desc->addr = (frame_nb + i) << XSK_UMEM__DEFAULT_FRAME_SHIFT; ++ tx_desc->addr = (*frame_nb + i) << XSK_UMEM__DEFAULT_FRAME_SHIFT; + tx_desc->len = PKT_SIZE; + } + + xsk_ring_prod__submit(&xsk->tx, batch_size); + xsk->outstanding_tx += batch_size; +- frame_nb += batch_size; +- frame_nb %= NUM_FRAMES; ++ *frame_nb += batch_size; ++ *frame_nb %= NUM_FRAMES; + complete_tx_only(xsk, batch_size); + } + +@@ -997,7 +997,7 @@ static void tx_only_all(void) + } + + for (i = 0; i < num_socks; i++) +- tx_only(xsks[i], frame_nb[i], batch_size); ++ tx_only(xsks[i], &frame_nb[i], batch_size); + + pkt_cnt += batch_size; + +-- +2.25.1 + diff --git a/queue-5.8/sched-fair-fix-wrong-cpu-selecting-from-isolated-dom.patch b/queue-5.8/sched-fair-fix-wrong-cpu-selecting-from-isolated-dom.patch new file mode 100644 index 00000000000..928bfe3f515 --- /dev/null +++ b/queue-5.8/sched-fair-fix-wrong-cpu-selecting-from-isolated-dom.patch @@ -0,0 +1,80 @@ +From 16fab48dc47f1e8d88ad98dcf3b115a9855d3168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 14:48:47 +0800 +Subject: sched/fair: Fix wrong cpu selecting from isolated domain + +From: Xunlei Pang + +[ Upstream commit df3cb4ea1fb63ff326488efd671ba3c39034255e ] + +We've met problems that occasionally tasks with full cpumask +(e.g. by putting it into a cpuset or setting to full affinity) +were migrated to our isolated cpus in production environment. + +After some analysis, we found that it is due to the current +select_idle_smt() not considering the sched_domain mask. + +Steps to reproduce on my 31-CPU hyperthreads machine: +1. with boot parameter: "isolcpus=domain,2-31" + (thread lists: 0,16 and 1,17) +2. cgcreate -g cpu:test; cgexec -g cpu:test "test_threads" +3. some threads will be migrated to the isolated cpu16~17. + +Fix it by checking the valid domain mask in select_idle_smt(). + +Fixes: 10e2f1acd010 ("sched/core: Rewrite and improve select_idle_siblings()) +Reported-by: Wetp Zhang +Signed-off-by: Xunlei Pang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Jiang Biao +Reviewed-by: Vincent Guittot +Link: https://lkml.kernel.org/r/1600930127-76857-1-git-send-email-xlpang@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index f71e8b0e0346a..60c5a80f325b6 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -6067,7 +6067,7 @@ static int select_idle_core(struct task_struct *p, struct sched_domain *sd, int + /* + * Scan the local SMT mask for idle CPUs. + */ +-static int select_idle_smt(struct task_struct *p, int target) ++static int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target) + { + int cpu; + +@@ -6075,7 +6075,8 @@ static int select_idle_smt(struct task_struct *p, int target) + return -1; + + for_each_cpu(cpu, cpu_smt_mask(target)) { +- if (!cpumask_test_cpu(cpu, p->cpus_ptr)) ++ if (!cpumask_test_cpu(cpu, p->cpus_ptr) || ++ !cpumask_test_cpu(cpu, sched_domain_span(sd))) + continue; + if (available_idle_cpu(cpu) || sched_idle_cpu(cpu)) + return cpu; +@@ -6091,7 +6092,7 @@ static inline int select_idle_core(struct task_struct *p, struct sched_domain *s + return -1; + } + +-static inline int select_idle_smt(struct task_struct *p, int target) ++static inline int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target) + { + return -1; + } +@@ -6266,7 +6267,7 @@ static int select_idle_sibling(struct task_struct *p, int prev, int target) + if ((unsigned)i < nr_cpumask_bits) + return i; + +- i = select_idle_smt(p, target); ++ i = select_idle_smt(p, sd, target); + if ((unsigned)i < nr_cpumask_bits) + return i; + +-- +2.25.1 + diff --git a/queue-5.8/sched-fair-fix-wrong-negative-conversion-in-find_ene.patch b/queue-5.8/sched-fair-fix-wrong-negative-conversion-in-find_ene.patch new file mode 100644 index 00000000000..2e9fc3ea90c --- /dev/null +++ b/queue-5.8/sched-fair-fix-wrong-negative-conversion-in-find_ene.patch @@ -0,0 +1,47 @@ +From 45f00f3eff5cf29291df246822651c06c84cbca8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 09:30:04 +0100 +Subject: sched/fair: Fix wrong negative conversion in + find_energy_efficient_cpu() + +From: Lukasz Luba + +[ Upstream commit da0777d35f47892f359c3f73ea155870bb595700 ] + +In find_energy_efficient_cpu() 'cpu_cap' could be less that 'util'. +It might be because of RT, DL (so higher sched class than CFS), irq or +thermal pressure signal, which reduce the capacity value. +In such situation the result of 'cpu_cap - util' might be negative but +stored in the unsigned long. Then it might be compared with other unsigned +long when uclamp_rq_util_with() reduced the 'util' such that is passes the +fits_capacity() check. + +Prevent this situation and make the arithmetic more safe. + +Fixes: 1d42509e475cd ("sched/fair: Make EAS wakeup placement consider uclamp restrictions") +Signed-off-by: Lukasz Luba +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Valentin Schneider +Link: https://lkml.kernel.org/r/20200810083004.26420-1-lukasz.luba@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 6b3b59cc51d6c..f71e8b0e0346a 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -6586,7 +6586,8 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) + + util = cpu_util_next(cpu, p, cpu); + cpu_cap = capacity_of(cpu); +- spare_cap = cpu_cap - util; ++ spare_cap = cpu_cap; ++ lsub_positive(&spare_cap, util); + + /* + * Skip CPUs that cannot satisfy the capacity request. +-- +2.25.1 + diff --git a/queue-5.8/sched-fair-use-dst-group-while-checking-imbalance-fo.patch b/queue-5.8/sched-fair-use-dst-group-while-checking-imbalance-fo.patch new file mode 100644 index 00000000000..b42712e15d0 --- /dev/null +++ b/queue-5.8/sched-fair-use-dst-group-while-checking-imbalance-fo.patch @@ -0,0 +1,193 @@ +From 4c6540f9cca48edd30c2c8fd4abea34572769195 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 23:18:49 +0100 +Subject: sched/fair: Use dst group while checking imbalance for NUMA balancer + +From: Barry Song + +[ Upstream commit 233e7aca4c8a2c764f556bba9644c36154017e7f ] + +Barry Song noted the following + + Something is wrong. In find_busiest_group(), we are checking if + src has higher load, however, in task_numa_find_cpu(), we are + checking if dst will have higher load after balancing. It seems + it is not sensible to check src. + + It maybe cause wrong imbalance value, for example, + + if dst_running = env->dst_stats.nr_running + 1 results in 3 or + above, and src_running = env->src_stats.nr_running - 1 results + in 1; + + The current code is thinking imbalance as 0 since src_running is + smaller than 2. This is inconsistent with load balancer. + +Basically, in find_busiest_group(), the NUMA imbalance is ignored if moving +a task "from an almost idle domain" to a "domain with spare capacity". This +patch forbids movement "from a misplaced domain" to "an almost idle domain" +as that is closer to what the CPU load balancer expects. + +This patch is not a universal win. The old behaviour was intended to allow +a task from an almost idle NUMA node to migrate to its preferred node if +the destination had capacity but there are corner cases. For example, +a NAS compute load could be parallelised to use 1/3rd of available CPUs +but not all those potential tasks are active at all times allowing this +logic to trigger. An obvious example is specjbb 2005 running various +numbers of warehouses on a 2 socket box with 80 cpus. + +specjbb + 5.9.0-rc4 5.9.0-rc4 + vanilla dstbalance-v1r1 +Hmean tput-1 46425.00 ( 0.00%) 43394.00 * -6.53%* +Hmean tput-2 98416.00 ( 0.00%) 96031.00 * -2.42%* +Hmean tput-3 150184.00 ( 0.00%) 148783.00 * -0.93%* +Hmean tput-4 200683.00 ( 0.00%) 197906.00 * -1.38%* +Hmean tput-5 236305.00 ( 0.00%) 245549.00 * 3.91%* +Hmean tput-6 281559.00 ( 0.00%) 285692.00 * 1.47%* +Hmean tput-7 338558.00 ( 0.00%) 334467.00 * -1.21%* +Hmean tput-8 340745.00 ( 0.00%) 372501.00 * 9.32%* +Hmean tput-9 424343.00 ( 0.00%) 413006.00 * -2.67%* +Hmean tput-10 421854.00 ( 0.00%) 434261.00 * 2.94%* +Hmean tput-11 493256.00 ( 0.00%) 485330.00 * -1.61%* +Hmean tput-12 549573.00 ( 0.00%) 529959.00 * -3.57%* +Hmean tput-13 593183.00 ( 0.00%) 555010.00 * -6.44%* +Hmean tput-14 588252.00 ( 0.00%) 599166.00 * 1.86%* +Hmean tput-15 623065.00 ( 0.00%) 642713.00 * 3.15%* +Hmean tput-16 703924.00 ( 0.00%) 660758.00 * -6.13%* +Hmean tput-17 666023.00 ( 0.00%) 697675.00 * 4.75%* +Hmean tput-18 761502.00 ( 0.00%) 758360.00 * -0.41%* +Hmean tput-19 796088.00 ( 0.00%) 798368.00 * 0.29%* +Hmean tput-20 733564.00 ( 0.00%) 823086.00 * 12.20%* +Hmean tput-21 840980.00 ( 0.00%) 856711.00 * 1.87%* +Hmean tput-22 804285.00 ( 0.00%) 872238.00 * 8.45%* +Hmean tput-23 795208.00 ( 0.00%) 889374.00 * 11.84%* +Hmean tput-24 848619.00 ( 0.00%) 966783.00 * 13.92%* +Hmean tput-25 750848.00 ( 0.00%) 903790.00 * 20.37%* +Hmean tput-26 780523.00 ( 0.00%) 962254.00 * 23.28%* +Hmean tput-27 1042245.00 ( 0.00%) 991544.00 * -4.86%* +Hmean tput-28 1090580.00 ( 0.00%) 1035926.00 * -5.01%* +Hmean tput-29 999483.00 ( 0.00%) 1082948.00 * 8.35%* +Hmean tput-30 1098663.00 ( 0.00%) 1113427.00 * 1.34%* +Hmean tput-31 1125671.00 ( 0.00%) 1134175.00 * 0.76%* +Hmean tput-32 968167.00 ( 0.00%) 1250286.00 * 29.14%* +Hmean tput-33 1077676.00 ( 0.00%) 1060893.00 * -1.56%* +Hmean tput-34 1090538.00 ( 0.00%) 1090933.00 * 0.04%* +Hmean tput-35 967058.00 ( 0.00%) 1107421.00 * 14.51%* +Hmean tput-36 1051745.00 ( 0.00%) 1210663.00 * 15.11%* +Hmean tput-37 1019465.00 ( 0.00%) 1351446.00 * 32.56%* +Hmean tput-38 1083102.00 ( 0.00%) 1064541.00 * -1.71%* +Hmean tput-39 1232990.00 ( 0.00%) 1303623.00 * 5.73%* +Hmean tput-40 1175542.00 ( 0.00%) 1340943.00 * 14.07%* +Hmean tput-41 1127826.00 ( 0.00%) 1339492.00 * 18.77%* +Hmean tput-42 1198313.00 ( 0.00%) 1411023.00 * 17.75%* +Hmean tput-43 1163733.00 ( 0.00%) 1228253.00 * 5.54%* +Hmean tput-44 1305562.00 ( 0.00%) 1357886.00 * 4.01%* +Hmean tput-45 1326752.00 ( 0.00%) 1406061.00 * 5.98%* +Hmean tput-46 1339424.00 ( 0.00%) 1418451.00 * 5.90%* +Hmean tput-47 1415057.00 ( 0.00%) 1381570.00 * -2.37%* +Hmean tput-48 1392003.00 ( 0.00%) 1421167.00 * 2.10%* +Hmean tput-49 1408374.00 ( 0.00%) 1418659.00 * 0.73%* +Hmean tput-50 1359822.00 ( 0.00%) 1391070.00 * 2.30%* +Hmean tput-51 1414246.00 ( 0.00%) 1392679.00 * -1.52%* +Hmean tput-52 1432352.00 ( 0.00%) 1354020.00 * -5.47%* +Hmean tput-53 1387563.00 ( 0.00%) 1409563.00 * 1.59%* +Hmean tput-54 1406420.00 ( 0.00%) 1388711.00 * -1.26%* +Hmean tput-55 1438804.00 ( 0.00%) 1387472.00 * -3.57%* +Hmean tput-56 1399465.00 ( 0.00%) 1400296.00 * 0.06%* +Hmean tput-57 1428132.00 ( 0.00%) 1396399.00 * -2.22%* +Hmean tput-58 1432385.00 ( 0.00%) 1386253.00 * -3.22%* +Hmean tput-59 1421612.00 ( 0.00%) 1371416.00 * -3.53%* +Hmean tput-60 1429423.00 ( 0.00%) 1389412.00 * -2.80%* +Hmean tput-61 1396230.00 ( 0.00%) 1351122.00 * -3.23%* +Hmean tput-62 1418396.00 ( 0.00%) 1383098.00 * -2.49%* +Hmean tput-63 1409918.00 ( 0.00%) 1374662.00 * -2.50%* +Hmean tput-64 1410236.00 ( 0.00%) 1376216.00 * -2.41%* +Hmean tput-65 1396405.00 ( 0.00%) 1364418.00 * -2.29%* +Hmean tput-66 1395975.00 ( 0.00%) 1357326.00 * -2.77%* +Hmean tput-67 1392986.00 ( 0.00%) 1349642.00 * -3.11%* +Hmean tput-68 1386541.00 ( 0.00%) 1343261.00 * -3.12%* +Hmean tput-69 1374407.00 ( 0.00%) 1342588.00 * -2.32%* +Hmean tput-70 1377513.00 ( 0.00%) 1334654.00 * -3.11%* +Hmean tput-71 1369319.00 ( 0.00%) 1334952.00 * -2.51%* +Hmean tput-72 1354635.00 ( 0.00%) 1329005.00 * -1.89%* +Hmean tput-73 1350933.00 ( 0.00%) 1318942.00 * -2.37%* +Hmean tput-74 1351714.00 ( 0.00%) 1316347.00 * -2.62%* +Hmean tput-75 1352198.00 ( 0.00%) 1309974.00 * -3.12%* +Hmean tput-76 1349490.00 ( 0.00%) 1286064.00 * -4.70%* +Hmean tput-77 1336131.00 ( 0.00%) 1303684.00 * -2.43%* +Hmean tput-78 1308896.00 ( 0.00%) 1271024.00 * -2.89%* +Hmean tput-79 1326703.00 ( 0.00%) 1290862.00 * -2.70%* +Hmean tput-80 1336199.00 ( 0.00%) 1291629.00 * -3.34%* + +The performance at the mid-point is better but not universally better. The +patch is a mixed bag depending on the workload, machine and overall +levels of utilisation. Sometimes it's better (sometimes much better), +other times it is worse (sometimes much worse). Given that there isn't a +universally good decision in this section and more people seem to prefer +the patch then it may be best to keep the LB decisions consistent and +revisit imbalance handling when the load balancer code changes settle down. + +Jirka Hladky added the following observation. + + Our results are mostly in line with what you see. We observe + big gains (20-50%) when the system is loaded to 1/3 of the + maximum capacity and mixed results at the full load - some + workloads benefit from the patch at the full load, others not, + but performance changes at the full load are mostly within the + noise of results (+/-5%). Overall, we think this patch is helpful. + +[mgorman@techsingularity.net: Rewrote changelog] +Fixes: fb86f5b211 ("sched/numa: Use similar logic to the load balancer for moving between domains with spare capacity") +Signed-off-by: Barry Song +Signed-off-by: Mel Gorman +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20200921221849.GI3179@techsingularity.net +Signed-off-by: Sasha Levin +--- + kernel/sched/fair.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 60c5a80f325b6..f3496556b6992 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -1550,7 +1550,7 @@ struct task_numa_env { + + static unsigned long cpu_load(struct rq *rq); + static unsigned long cpu_util(int cpu); +-static inline long adjust_numa_imbalance(int imbalance, int src_nr_running); ++static inline long adjust_numa_imbalance(int imbalance, int nr_running); + + static inline enum + numa_type numa_classify(unsigned int imbalance_pct, +@@ -1927,7 +1927,7 @@ static void task_numa_find_cpu(struct task_numa_env *env, + src_running = env->src_stats.nr_running - 1; + dst_running = env->dst_stats.nr_running + 1; + imbalance = max(0, dst_running - src_running); +- imbalance = adjust_numa_imbalance(imbalance, src_running); ++ imbalance = adjust_numa_imbalance(imbalance, dst_running); + + /* Use idle CPU if there is no imbalance */ + if (!imbalance) { +@@ -8945,7 +8945,7 @@ static inline void update_sd_lb_stats(struct lb_env *env, struct sd_lb_stats *sd + } + } + +-static inline long adjust_numa_imbalance(int imbalance, int src_nr_running) ++static inline long adjust_numa_imbalance(int imbalance, int nr_running) + { + unsigned int imbalance_min; + +@@ -8954,7 +8954,7 @@ static inline long adjust_numa_imbalance(int imbalance, int src_nr_running) + * tasks that remain local when the source domain is almost idle. + */ + imbalance_min = 2; +- if (src_nr_running <= imbalance_min) ++ if (nr_running <= imbalance_min) + return 0; + + return imbalance; +-- +2.25.1 + diff --git a/queue-5.8/sched-features-fix-config_jump_label-case.patch b/queue-5.8/sched-features-fix-config_jump_label-case.patch new file mode 100644 index 00000000000..03d17868da7 --- /dev/null +++ b/queue-5.8/sched-features-fix-config_jump_label-case.patch @@ -0,0 +1,99 @@ +From 2097f0c5c41dc1987a232889ae686b509d5dcd4c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 07:31:14 +0200 +Subject: sched/features: Fix !CONFIG_JUMP_LABEL case + +From: Juri Lelli + +[ Upstream commit a73f863af4ce9730795eab7097fb2102e6854365 ] + +Commit: + + 765cc3a4b224e ("sched/core: Optimize sched_feat() for !CONFIG_SCHED_DEBUG builds") + +made sched features static for !CONFIG_SCHED_DEBUG configurations, but +overlooked the CONFIG_SCHED_DEBUG=y and !CONFIG_JUMP_LABEL cases. + +For the latter echoing changes to /sys/kernel/debug/sched_features has +the nasty effect of effectively changing what sched_features reports, +but without actually changing the scheduler behaviour (since different +translation units get different sysctl_sched_features). + +Fix CONFIG_SCHED_DEBUG=y and !CONFIG_JUMP_LABEL configurations by properly +restructuring ifdefs. + +Fixes: 765cc3a4b224e ("sched/core: Optimize sched_feat() for !CONFIG_SCHED_DEBUG builds") +Co-developed-by: Daniel Bristot de Oliveira +Signed-off-by: Daniel Bristot de Oliveira +Signed-off-by: Juri Lelli +Signed-off-by: Ingo Molnar +Acked-by: Patrick Bellasi +Reviewed-by: Valentin Schneider +Link: https://lore.kernel.org/r/20201013053114.160628-1-juri.lelli@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 2 +- + kernel/sched/sched.h | 13 ++++++++++--- + 2 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index f788cd61df212..1c68621743ac2 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -39,7 +39,7 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(sched_overutilized_tp); + + DEFINE_PER_CPU_SHARED_ALIGNED(struct rq, runqueues); + +-#if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_JUMP_LABEL) ++#ifdef CONFIG_SCHED_DEBUG + /* + * Debugging: various feature bits + * +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index c82857e2e288a..0b1485ac19c4e 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1600,7 +1600,7 @@ enum { + + #undef SCHED_FEAT + +-#if defined(CONFIG_SCHED_DEBUG) && defined(CONFIG_JUMP_LABEL) ++#ifdef CONFIG_SCHED_DEBUG + + /* + * To support run-time toggling of sched features, all the translation units +@@ -1608,6 +1608,7 @@ enum { + */ + extern const_debug unsigned int sysctl_sched_features; + ++#ifdef CONFIG_JUMP_LABEL + #define SCHED_FEAT(name, enabled) \ + static __always_inline bool static_branch_##name(struct static_key *key) \ + { \ +@@ -1620,7 +1621,13 @@ static __always_inline bool static_branch_##name(struct static_key *key) \ + extern struct static_key sched_feat_keys[__SCHED_FEAT_NR]; + #define sched_feat(x) (static_branch_##x(&sched_feat_keys[__SCHED_FEAT_##x])) + +-#else /* !(SCHED_DEBUG && CONFIG_JUMP_LABEL) */ ++#else /* !CONFIG_JUMP_LABEL */ ++ ++#define sched_feat(x) (sysctl_sched_features & (1UL << __SCHED_FEAT_##x)) ++ ++#endif /* CONFIG_JUMP_LABEL */ ++ ++#else /* !SCHED_DEBUG */ + + /* + * Each translation unit has its own copy of sysctl_sched_features to allow +@@ -1636,7 +1643,7 @@ static const_debug __maybe_unused unsigned int sysctl_sched_features = + + #define sched_feat(x) !!(sysctl_sched_features & (1UL << __SCHED_FEAT_##x)) + +-#endif /* SCHED_DEBUG && CONFIG_JUMP_LABEL */ ++#endif /* SCHED_DEBUG */ + + extern struct static_key_false sched_numa_balancing; + extern struct static_key_false sched_schedstats; +-- +2.25.1 + diff --git a/queue-5.8/scsi-be2iscsi-fix-a-theoretical-leak-in-beiscsi_crea.patch b/queue-5.8/scsi-be2iscsi-fix-a-theoretical-leak-in-beiscsi_crea.patch new file mode 100644 index 00000000000..8ddb334b6c3 --- /dev/null +++ b/queue-5.8/scsi-be2iscsi-fix-a-theoretical-leak-in-beiscsi_crea.patch @@ -0,0 +1,62 @@ +From 66b5d66f78a21279a910a8c32f05eac88f483fb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 12:13:00 +0300 +Subject: scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() + +From: Dan Carpenter + +[ Upstream commit 38b2db564d9ab7797192ef15d7aade30633ceeae ] + +The be_fill_queue() function can only fail when "eq_vaddress" is NULL and +since it's non-NULL here that means the function call can't fail. But +imagine if it could, then in that situation we would want to store the +"paddr" so that dma memory can be released. + +Link: https://lore.kernel.org/r/20200928091300.GD377727@mwanda +Fixes: bfead3b2cb46 ("[SCSI] be2iscsi: Adding msix and mcc_rings V3") +Signed-off-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/be2iscsi/be_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index 9b81cfbbc5c53..239e04c03cf90 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -3020,6 +3020,7 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba, + goto create_eq_error; + } + ++ mem->dma = paddr; + mem->va = eq_vaddress; + ret = be_fill_queue(eq, phba->params.num_eq_entries, + sizeof(struct be_eq_entry), eq_vaddress); +@@ -3029,7 +3030,6 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba, + goto create_eq_error; + } + +- mem->dma = paddr; + ret = beiscsi_cmd_eq_create(&phba->ctrl, eq, + BEISCSI_EQ_DELAY_DEF); + if (ret) { +@@ -3086,6 +3086,7 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba, + goto create_cq_error; + } + ++ mem->dma = paddr; + ret = be_fill_queue(cq, phba->params.num_cq_entries, + sizeof(struct sol_cqe), cq_vaddress); + if (ret) { +@@ -3095,7 +3096,6 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba, + goto create_cq_error; + } + +- mem->dma = paddr; + ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false, + false, 0); + if (ret) { +-- +2.25.1 + diff --git a/queue-5.8/scsi-bfa-fix-error-return-in-bfad_pci_init.patch b/queue-5.8/scsi-bfa-fix-error-return-in-bfad_pci_init.patch new file mode 100644 index 00000000000..0807d313491 --- /dev/null +++ b/queue-5.8/scsi-bfa-fix-error-return-in-bfad_pci_init.patch @@ -0,0 +1,35 @@ +From 6d72eaa0977f2dbf43e6002d29a7c1bb1b0fdaa7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 14:24:23 +0800 +Subject: scsi: bfa: Fix error return in bfad_pci_init() + +From: Jing Xiangfeng + +[ Upstream commit f0f6c3a4fcb80fcbcce4ff6739996dd98c228afd ] + +Fix to return error code -ENODEV from the error handling case instead of 0. + +Link: https://lore.kernel.org/r/20200925062423.161504-1-jingxiangfeng@huawei.com +Fixes: 11ea3824140c ("scsi: bfa: fix calls to dma_set_mask_and_coherent()") +Signed-off-by: Jing Xiangfeng +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bfa/bfad.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c +index bc5d84f87d8fc..440ef32be048f 100644 +--- a/drivers/scsi/bfa/bfad.c ++++ b/drivers/scsi/bfa/bfad.c +@@ -749,6 +749,7 @@ bfad_pci_init(struct pci_dev *pdev, struct bfad_s *bfad) + + if (bfad->pci_bar0_kva == NULL) { + printk(KERN_ERR "Fail to map bar0\n"); ++ rc = -ENODEV; + goto out_release_region; + } + +-- +2.25.1 + diff --git a/queue-5.8/scsi-csiostor-fix-wrong-return-value-in-csio_hw_prep.patch b/queue-5.8/scsi-csiostor-fix-wrong-return-value-in-csio_hw_prep.patch new file mode 100644 index 00000000000..325a8910a8b --- /dev/null +++ b/queue-5.8/scsi-csiostor-fix-wrong-return-value-in-csio_hw_prep.patch @@ -0,0 +1,38 @@ +From b13aa763ac02661ea17bffc70373017f7fa6edcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 19:15:31 +0800 +Subject: scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() + +From: Tianjia Zhang + +[ Upstream commit 44f4daf8678ae5f08c93bbe70792f90cd88e4649 ] + +On an error exit path, a negative error code should be returned instead of +a positive return value. + +Link: https://lore.kernel.org/r/20200802111531.5065-1-tianjia.zhang@linux.alibaba.com +Fixes: f40e74ffa3de ("csiostor:firmware upgrade fix") +Cc: Praveen Madhavan +Signed-off-by: Tianjia Zhang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/csiostor/csio_hw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c +index 950f9cdf0577f..5d0f42031d121 100644 +--- a/drivers/scsi/csiostor/csio_hw.c ++++ b/drivers/scsi/csiostor/csio_hw.c +@@ -2384,7 +2384,7 @@ static int csio_hw_prep_fw(struct csio_hw *hw, struct fw_info *fw_info, + FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c), + FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k), + FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k)); +- ret = EINVAL; ++ ret = -EINVAL; + goto bye; + } + +-- +2.25.1 + diff --git a/queue-5.8/scsi-ibmvfc-fix-error-return-in-ibmvfc_probe.patch b/queue-5.8/scsi-ibmvfc-fix-error-return-in-ibmvfc_probe.patch new file mode 100644 index 00000000000..6f74f75bdef --- /dev/null +++ b/queue-5.8/scsi-ibmvfc-fix-error-return-in-ibmvfc_probe.patch @@ -0,0 +1,36 @@ +From 463215e6664317a211d3124cf23603af8767585e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 16:39:49 +0800 +Subject: scsi: ibmvfc: Fix error return in ibmvfc_probe() + +From: Jing Xiangfeng + +[ Upstream commit 5e48a084f4e824e1b624d3fd7ddcf53d2ba69e53 ] + +Fix to return error code PTR_ERR() from the error handling case instead of +0. + +Link: https://lore.kernel.org/r/20200907083949.154251-1-jingxiangfeng@huawei.com +Acked-by: Tyrel Datwyler +Signed-off-by: Jing Xiangfeng +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ibmvscsi/ibmvfc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c +index 635f6f9cffc40..ef91f3d01f989 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c +@@ -4928,6 +4928,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id) + if (IS_ERR(vhost->work_thread)) { + dev_err(dev, "Couldn't create kernel thread: %ld\n", + PTR_ERR(vhost->work_thread)); ++ rc = PTR_ERR(vhost->work_thread); + goto free_host_mem; + } + +-- +2.25.1 + diff --git a/queue-5.8/scsi-mpt3sas-fix-sync-irqs.patch b/queue-5.8/scsi-mpt3sas-fix-sync-irqs.patch new file mode 100644 index 00000000000..bbe6c505d99 --- /dev/null +++ b/queue-5.8/scsi-mpt3sas-fix-sync-irqs.patch @@ -0,0 +1,60 @@ +From dc8345662a5022ffd82d033ae9bcb8f0b270fc8f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 16:21:26 +0200 +Subject: scsi: mpt3sas: Fix sync irqs + +From: Tomas Henzl + +[ Upstream commit 45181eab8ba79ed7a41b549f00500c0093828521 ] + +_base_process_reply_queue() called from _base_interrupt() may schedule a +new irq poll. Fix this by calling synchronize_irq() first. + +Also ensure that enable_irq() is called only when necessary to avoid +"Unbalanced enable for IRQ..." errors. + +Link: https://lore.kernel.org/r/20200910142126.8147-1-thenzl@redhat.com +Fixes: 320e77acb327 ("scsi: mpt3sas: Irq poll to avoid CPU hard lockups") +Acked-by: Sreekanth Reddy +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index a85c9672c6ea3..a67749c8f4ab3 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -1808,18 +1808,22 @@ mpt3sas_base_sync_reply_irqs(struct MPT3SAS_ADAPTER *ioc) + /* TMs are on msix_index == 0 */ + if (reply_q->msix_index == 0) + continue; ++ synchronize_irq(pci_irq_vector(ioc->pdev, reply_q->msix_index)); + if (reply_q->irq_poll_scheduled) { + /* Calling irq_poll_disable will wait for any pending + * callbacks to have completed. + */ + irq_poll_disable(&reply_q->irqpoll); + irq_poll_enable(&reply_q->irqpoll); +- reply_q->irq_poll_scheduled = false; +- reply_q->irq_line_enable = true; +- enable_irq(reply_q->os_irq); +- continue; ++ /* check how the scheduled poll has ended, ++ * clean up only if necessary ++ */ ++ if (reply_q->irq_poll_scheduled) { ++ reply_q->irq_poll_scheduled = false; ++ reply_q->irq_line_enable = true; ++ enable_irq(reply_q->os_irq); ++ } + } +- synchronize_irq(pci_irq_vector(ioc->pdev, reply_q->msix_index)); + } + } + +-- +2.25.1 + diff --git a/queue-5.8/scsi-mvumi-fix-error-return-in-mvumi_io_attach.patch b/queue-5.8/scsi-mvumi-fix-error-return-in-mvumi_io_attach.patch new file mode 100644 index 00000000000..6bdbc12ca69 --- /dev/null +++ b/queue-5.8/scsi-mvumi-fix-error-return-in-mvumi_io_attach.patch @@ -0,0 +1,34 @@ +From 112e90ae804fe9b60ed205b2f660c6decae322ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 20:38:48 +0800 +Subject: scsi: mvumi: Fix error return in mvumi_io_attach() + +From: Jing Xiangfeng + +[ Upstream commit 055f15ab2cb4a5cbc4c0a775ef3d0066e0fa9b34 ] + +Return PTR_ERR() from the error handling case instead of 0. + +Link: https://lore.kernel.org/r/20200910123848.93649-1-jingxiangfeng@huawei.com +Signed-off-by: Jing Xiangfeng +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mvumi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c +index 8906aceda4c43..0354898d7cac1 100644 +--- a/drivers/scsi/mvumi.c ++++ b/drivers/scsi/mvumi.c +@@ -2425,6 +2425,7 @@ static int mvumi_io_attach(struct mvumi_hba *mhba) + if (IS_ERR(mhba->dm_thread)) { + dev_err(&mhba->pdev->dev, + "failed to create device scan thread\n"); ++ ret = PTR_ERR(mhba->dm_thread); + mutex_unlock(&mhba->sas_discovery_mutex); + goto fail_create_thread; + } +-- +2.25.1 + diff --git a/queue-5.8/scsi-qedf-return-success-if-stale-rport-is-encounter.patch b/queue-5.8/scsi-qedf-return-success-if-stale-rport-is-encounter.patch new file mode 100644 index 00000000000..9822556239c --- /dev/null +++ b/queue-5.8/scsi-qedf-return-success-if-stale-rport-is-encounter.patch @@ -0,0 +1,37 @@ +From f68e929a5021ac2d4936608f22de3a5015076c58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 05:14:40 -0700 +Subject: scsi: qedf: Return SUCCESS if stale rport is encountered + +From: Saurav Kashyap + +[ Upstream commit 10aff62fab263ad7661780816551420cea956ebb ] + +If SUCCESS is not returned, error handling will escalate. Return SUCCESS +similar to other conditions in this function. + +Link: https://lore.kernel.org/r/20200907121443.5150-6-jhasan@marvell.com +Signed-off-by: Saurav Kashyap +Signed-off-by: Javed Hasan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedf/qedf_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 51cfab9d1afdc..ed3054fffa344 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -704,7 +704,7 @@ static int qedf_eh_abort(struct scsi_cmnd *sc_cmd) + rdata = fcport->rdata; + if (!rdata || !kref_get_unless_zero(&rdata->kref)) { + QEDF_ERR(&qedf->dbg_ctx, "stale rport, sc_cmd=%p\n", sc_cmd); +- rc = 1; ++ rc = SUCCESS; + goto out; + } + +-- +2.25.1 + diff --git a/queue-5.8/scsi-qedi-fix-list_del-corruption-while-removing-act.patch b/queue-5.8/scsi-qedi-fix-list_del-corruption-while-removing-act.patch new file mode 100644 index 00000000000..6336d4478ad --- /dev/null +++ b/queue-5.8/scsi-qedi-fix-list_del-corruption-while-removing-act.patch @@ -0,0 +1,71 @@ +From 09a27ec72846612da776db5f09b21d7f4a5cd496 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 02:56:52 -0700 +Subject: scsi: qedi: Fix list_del corruption while removing active I/O + +From: Nilesh Javali + +[ Upstream commit 28b35d17f9f8573d4646dd8df08917a4076a6b63 ] + +While aborting the I/O, the firmware cleanup task timed out and driver +deleted the I/O from active command list. Some time later the firmware +sent the cleanup task response and driver again deleted the I/O from +active command list causing firmware to send completion for non-existent +I/O and list_del corruption of active command list. + +Add fix to check if I/O is present before deleting it from the active +command list to ensure firmware sends valid I/O completion and protect +against list_del corruption. + +Link: https://lore.kernel.org/r/20200908095657.26821-4-mrangankar@marvell.com +Signed-off-by: Nilesh Javali +Signed-off-by: Manish Rangankar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_fw.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c +index 32586800620bd..90aa64604ad78 100644 +--- a/drivers/scsi/qedi/qedi_fw.c ++++ b/drivers/scsi/qedi/qedi_fw.c +@@ -825,8 +825,11 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi, + qedi_clear_task_idx(qedi_conn->qedi, rtid); + + spin_lock(&qedi_conn->list_lock); +- list_del_init(&dbg_cmd->io_cmd); +- qedi_conn->active_cmd_count--; ++ if (likely(dbg_cmd->io_cmd_in_list)) { ++ dbg_cmd->io_cmd_in_list = false; ++ list_del_init(&dbg_cmd->io_cmd); ++ qedi_conn->active_cmd_count--; ++ } + spin_unlock(&qedi_conn->list_lock); + qedi_cmd->state = CLEANUP_RECV; + wake_up_interruptible(&qedi_conn->wait_queue); +@@ -1244,6 +1247,7 @@ int qedi_cleanup_all_io(struct qedi_ctx *qedi, struct qedi_conn *qedi_conn, + qedi_conn->cmd_cleanup_req++; + qedi_iscsi_cleanup_task(ctask, true); + ++ cmd->io_cmd_in_list = false; + list_del_init(&cmd->io_cmd); + qedi_conn->active_cmd_count--; + QEDI_WARN(&qedi->dbg_ctx, +@@ -1455,8 +1459,11 @@ static void qedi_tmf_work(struct work_struct *work) + spin_unlock_bh(&qedi_conn->tmf_work_lock); + + spin_lock(&qedi_conn->list_lock); +- list_del_init(&cmd->io_cmd); +- qedi_conn->active_cmd_count--; ++ if (likely(cmd->io_cmd_in_list)) { ++ cmd->io_cmd_in_list = false; ++ list_del_init(&cmd->io_cmd); ++ qedi_conn->active_cmd_count--; ++ } + spin_unlock(&qedi_conn->list_lock); + + clear_bit(QEDI_CONN_FW_CLEANUP, &qedi_conn->flags); +-- +2.25.1 + diff --git a/queue-5.8/scsi-qedi-mark-all-connections-for-recovery-on-link-.patch b/queue-5.8/scsi-qedi-mark-all-connections-for-recovery-on-link-.patch new file mode 100644 index 00000000000..d134231c9d5 --- /dev/null +++ b/queue-5.8/scsi-qedi-mark-all-connections-for-recovery-on-link-.patch @@ -0,0 +1,56 @@ +From ca6856196194bcd46dc23a5cfee4ed6667fb8a1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 02:56:55 -0700 +Subject: scsi: qedi: Mark all connections for recovery on link down event + +From: Nilesh Javali + +[ Upstream commit 4118879be3755b38171063dfd4a57611d4b20a83 ] + +For short time cable pulls, the in-flight I/O to the firmware is never +cleaned up, resulting in the behaviour of stale I/O completion causing +list_del corruption and soft lockup of the system. + +On link down event, mark all the connections for recovery, causing cleanup +of all the in-flight I/O immediately. + +Link: https://lore.kernel.org/r/20200908095657.26821-7-mrangankar@marvell.com +Signed-off-by: Nilesh Javali +Signed-off-by: Manish Rangankar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_main.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index 81a307695cc91..569fa4b28e4e2 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -1127,6 +1127,15 @@ static void qedi_schedule_recovery_handler(void *dev) + schedule_delayed_work(&qedi->recovery_work, 0); + } + ++static void qedi_set_conn_recovery(struct iscsi_cls_session *cls_session) ++{ ++ struct iscsi_session *session = cls_session->dd_data; ++ struct iscsi_conn *conn = session->leadconn; ++ struct qedi_conn *qedi_conn = conn->dd_data; ++ ++ qedi_start_conn_recovery(qedi_conn->qedi, qedi_conn); ++} ++ + static void qedi_link_update(void *dev, struct qed_link_output *link) + { + struct qedi_ctx *qedi = (struct qedi_ctx *)dev; +@@ -1138,6 +1147,7 @@ static void qedi_link_update(void *dev, struct qed_link_output *link) + QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO, + "Link Down event.\n"); + atomic_set(&qedi->link_state, QEDI_LINK_DOWN); ++ iscsi_host_for_each_session(qedi->shost, qedi_set_conn_recovery); + } + } + +-- +2.25.1 + diff --git a/queue-5.8/scsi-qedi-protect-active-command-list-to-avoid-list-.patch b/queue-5.8/scsi-qedi-protect-active-command-list-to-avoid-list-.patch new file mode 100644 index 00000000000..d4b8ca6df16 --- /dev/null +++ b/queue-5.8/scsi-qedi-protect-active-command-list-to-avoid-list-.patch @@ -0,0 +1,108 @@ +From f99438245a5263001e9c00d510df7bc9aabcf83a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 02:56:53 -0700 +Subject: scsi: qedi: Protect active command list to avoid list corruption + +From: Nilesh Javali + +[ Upstream commit c0650e28448d606c84f76c34333dba30f61de993 ] + +Protect active command list for non-I/O commands like login response, +logout response, text response, and recovery cleanup of active list to +avoid list corruption. + +Link: https://lore.kernel.org/r/20200908095657.26821-5-mrangankar@marvell.com +Signed-off-by: Nilesh Javali +Signed-off-by: Manish Rangankar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_fw.c | 8 ++++++++ + drivers/scsi/qedi/qedi_iscsi.c | 2 ++ + 2 files changed, 10 insertions(+) + +diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c +index 946cebc4c9322..32586800620bd 100644 +--- a/drivers/scsi/qedi/qedi_fw.c ++++ b/drivers/scsi/qedi/qedi_fw.c +@@ -59,6 +59,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi, + "Freeing tid=0x%x for cid=0x%x\n", + cmd->task_id, qedi_conn->iscsi_conn_id); + ++ spin_lock(&qedi_conn->list_lock); + if (likely(cmd->io_cmd_in_list)) { + cmd->io_cmd_in_list = false; + list_del_init(&cmd->io_cmd); +@@ -69,6 +70,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi, + cmd->task_id, qedi_conn->iscsi_conn_id, + &cmd->io_cmd); + } ++ spin_unlock(&qedi_conn->list_lock); + + cmd->state = RESPONSE_RECEIVED; + qedi_clear_task_idx(qedi, cmd->task_id); +@@ -122,6 +124,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi, + "Freeing tid=0x%x for cid=0x%x\n", + cmd->task_id, qedi_conn->iscsi_conn_id); + ++ spin_lock(&qedi_conn->list_lock); + if (likely(cmd->io_cmd_in_list)) { + cmd->io_cmd_in_list = false; + list_del_init(&cmd->io_cmd); +@@ -132,6 +135,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi, + cmd->task_id, qedi_conn->iscsi_conn_id, + &cmd->io_cmd); + } ++ spin_unlock(&qedi_conn->list_lock); + + cmd->state = RESPONSE_RECEIVED; + qedi_clear_task_idx(qedi, cmd->task_id); +@@ -222,11 +226,13 @@ static void qedi_process_tmf_resp(struct qedi_ctx *qedi, + + tmf_hdr = (struct iscsi_tm *)qedi_cmd->task->hdr; + ++ spin_lock(&qedi_conn->list_lock); + if (likely(qedi_cmd->io_cmd_in_list)) { + qedi_cmd->io_cmd_in_list = false; + list_del_init(&qedi_cmd->io_cmd); + qedi_conn->active_cmd_count--; + } ++ spin_unlock(&qedi_conn->list_lock); + + if (((tmf_hdr->flags & ISCSI_FLAG_TM_FUNC_MASK) == + ISCSI_TM_FUNC_LOGICAL_UNIT_RESET) || +@@ -288,11 +294,13 @@ static void qedi_process_login_resp(struct qedi_ctx *qedi, + ISCSI_LOGIN_RESPONSE_HDR_DATA_SEG_LEN_MASK; + qedi_conn->gen_pdu.resp_wr_ptr = qedi_conn->gen_pdu.resp_buf + pld_len; + ++ spin_lock(&qedi_conn->list_lock); + if (likely(cmd->io_cmd_in_list)) { + cmd->io_cmd_in_list = false; + list_del_init(&cmd->io_cmd); + qedi_conn->active_cmd_count--; + } ++ spin_unlock(&qedi_conn->list_lock); + + memset(task_ctx, '\0', sizeof(*task_ctx)); + +diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c +index 425e665ec08b2..6e92625df4b7c 100644 +--- a/drivers/scsi/qedi/qedi_iscsi.c ++++ b/drivers/scsi/qedi/qedi_iscsi.c +@@ -975,11 +975,13 @@ static void qedi_cleanup_active_cmd_list(struct qedi_conn *qedi_conn) + { + struct qedi_cmd *cmd, *cmd_tmp; + ++ spin_lock(&qedi_conn->list_lock); + list_for_each_entry_safe(cmd, cmd_tmp, &qedi_conn->active_cmd_list, + io_cmd) { + list_del_init(&cmd->io_cmd); + qedi_conn->active_cmd_count--; + } ++ spin_unlock(&qedi_conn->list_lock); + } + + static void qedi_ep_disconnect(struct iscsi_endpoint *ep) +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla2xxx-fix-the-size-used-in-a-dma_free_coheren.patch b/queue-5.8/scsi-qla2xxx-fix-the-size-used-in-a-dma_free_coheren.patch new file mode 100644 index 00000000000..14e83958945 --- /dev/null +++ b/queue-5.8/scsi-qla2xxx-fix-the-size-used-in-a-dma_free_coheren.patch @@ -0,0 +1,39 @@ +From 65a25b29c3613a01e223ee0746f64827fb4d38e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 13:07:21 +0200 +Subject: scsi: qla2xxx: Fix the size used in a 'dma_free_coherent()' call + +From: Christophe JAILLET + +[ Upstream commit 650b323c8e7c3ac4830a20895b1d444fd68dd787 ] + +Update the size used in 'dma_free_coherent()' in order to match the one +used in the corresponding 'dma_alloc_coherent()'. + +[mkp: removed memset() hunk that has already been addressed] + +Link: https://lore.kernel.org/r/20200802110721.677707-1-christophe.jaillet@wanadoo.fr +Fixes: 4161cee52df8 ("[SCSI] qla4xxx: Add host statistics support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_mbx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index fdb2ce7acb912..9f5d3aa1d8745 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -4908,7 +4908,7 @@ qla25xx_set_els_cmds_supported(scsi_qla_host_t *vha) + "Done %s.\n", __func__); + } + +- dma_free_coherent(&ha->pdev->dev, DMA_POOL_SIZE, ++ dma_free_coherent(&ha->pdev->dev, ELS_CMD_MAP_SIZE, + els_cmd_map, els_cmd_map_dma); + + return rval; +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla2xxx-fix-wrong-return-value-in-qla_nvme_regi.patch b/queue-5.8/scsi-qla2xxx-fix-wrong-return-value-in-qla_nvme_regi.patch new file mode 100644 index 00000000000..c6df9911052 --- /dev/null +++ b/queue-5.8/scsi-qla2xxx-fix-wrong-return-value-in-qla_nvme_regi.patch @@ -0,0 +1,38 @@ +From a85e2d62e91ee89934008efb71ea54cd2dfe614b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 19:15:30 +0800 +Subject: scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() + +From: Tianjia Zhang + +[ Upstream commit ca4fb89a3d714a770e9c73c649da830f3f4a5326 ] + +On an error exit path, a negative error code should be returned instead of +a positive return value. + +Link: https://lore.kernel.org/r/20200802111530.5020-1-tianjia.zhang@linux.alibaba.com +Fixes: 8777e4314d39 ("scsi: qla2xxx: Migrate NVME N2N handling into state machine") +Cc: Quinn Tran +Signed-off-by: Tianjia Zhang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_nvme.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c +index 262dfd7635a48..7b14fd1cb0309 100644 +--- a/drivers/scsi/qla2xxx/qla_nvme.c ++++ b/drivers/scsi/qla2xxx/qla_nvme.c +@@ -683,7 +683,7 @@ int qla_nvme_register_hba(struct scsi_qla_host *vha) + struct nvme_fc_port_template *tmpl; + struct qla_hw_data *ha; + struct nvme_fc_port_info pinfo; +- int ret = EINVAL; ++ int ret = -EINVAL; + + if (!IS_ENABLED(CONFIG_NVME_FC)) + return ret; +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla2xxx-fix-wrong-return-value-in-qlt_chk_unres.patch b/queue-5.8/scsi-qla2xxx-fix-wrong-return-value-in-qlt_chk_unres.patch new file mode 100644 index 00000000000..5b6a1b42570 --- /dev/null +++ b/queue-5.8/scsi-qla2xxx-fix-wrong-return-value-in-qlt_chk_unres.patch @@ -0,0 +1,41 @@ +From c6b8d5c369db04d25667b6ab28c0654bfcc0fbe6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 19:15:28 +0800 +Subject: scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg() + +From: Tianjia Zhang + +[ Upstream commit bbf2d06a9d767718bfe6028d6288c03edb98554a ] + +In the case of a failed retry, a positive value EIO is returned here. I +think this is a typo error. It is necessary to return an error value. + +[mkp: caller checks != 0 but the rest of the file uses -Exxx so fix this up +to be consistent] + +Link: https://lore.kernel.org/r/20200802111528.4974-1-tianjia.zhang@linux.alibaba.com +Fixes: 0691094ff3f2 ("scsi: qla2xxx: Add logic to detect ABTS hang and response completion") +Cc: Quinn Tran +Signed-off-by: Tianjia Zhang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 90289162dbd4c..a034e9caa2997 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -5668,7 +5668,7 @@ static int qlt_chk_unresolv_exchg(struct scsi_qla_host *vha, + /* found existing exchange */ + qpair->retry_term_cnt++; + if (qpair->retry_term_cnt >= 5) { +- rc = EIO; ++ rc = -EIO; + qpair->retry_term_cnt = 0; + ql_log(ql_log_warn, vha, 0xffff, + "Unable to send ABTS Respond. Dumping firmware.\n"); +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla2xxx-warn-if-done-or-free-are-called-on-an-a.patch b/queue-5.8/scsi-qla2xxx-warn-if-done-or-free-are-called-on-an-a.patch new file mode 100644 index 00000000000..80a31a06656 --- /dev/null +++ b/queue-5.8/scsi-qla2xxx-warn-if-done-or-free-are-called-on-an-a.patch @@ -0,0 +1,76 @@ +From 22f4b0e90716e6c83f3d14e43fd68df031dc2ce1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 10:15:13 +0200 +Subject: scsi: qla2xxx: Warn if done() or free() are called on an already + freed srb + +From: Daniel Wagner + +[ Upstream commit c0014f94218ea3a312f6235febea0d626c5f2154 ] + +Emit a warning when ->done or ->free are called on an already freed +srb. There is a hidden use-after-free bug in the driver which corrupts +the srb memory pool which originates from the cleanup callbacks. + +An extensive search didn't bring any lights on the real problem. The +initial fix was to set both pointers to NULL and try to catch invalid +accesses. But instead the memory corruption was gone and the driver +didn't crash. Since not all calling places check for NULL pointer, add +explicitly default handlers. With this we workaround the memory +corruption and add a debug help. + +Link: https://lore.kernel.org/r/20200908081516.8561-2-dwagner@suse.de +Reviewed-by: Martin Wilck +Reviewed-by: Arun Easi +Signed-off-by: Daniel Wagner +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_init.c | 10 ++++++++++ + drivers/scsi/qla2xxx/qla_inline.h | 5 +++++ + 2 files changed, 15 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 2861c636dd651..f17ab22ad0e4a 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -63,6 +63,16 @@ void qla2x00_sp_free(srb_t *sp) + qla2x00_rel_sp(sp); + } + ++void qla2xxx_rel_done_warning(srb_t *sp, int res) ++{ ++ WARN_ONCE(1, "Calling done() of an already freed srb %p object\n", sp); ++} ++ ++void qla2xxx_rel_free_warning(srb_t *sp) ++{ ++ WARN_ONCE(1, "Calling free() of an already freed srb %p object\n", sp); ++} ++ + /* Asynchronous Login/Logout Routines -------------------------------------- */ + + unsigned long +diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h +index 1fb6ccac07ccd..26d9c78d4c52c 100644 +--- a/drivers/scsi/qla2xxx/qla_inline.h ++++ b/drivers/scsi/qla2xxx/qla_inline.h +@@ -207,10 +207,15 @@ qla2xxx_get_qpair_sp(scsi_qla_host_t *vha, struct qla_qpair *qpair, + return sp; + } + ++void qla2xxx_rel_done_warning(srb_t *sp, int res); ++void qla2xxx_rel_free_warning(srb_t *sp); ++ + static inline void + qla2xxx_rel_qpair_sp(struct qla_qpair *qpair, srb_t *sp) + { + sp->qpair = NULL; ++ sp->done = qla2xxx_rel_done_warning; ++ sp->free = qla2xxx_rel_free_warning; + mempool_free(sp, qpair->srb_mempool); + QLA_QPAIR_MARK_NOT_BUSY(qpair); + } +-- +2.25.1 + diff --git a/queue-5.8/scsi-qla4xxx-fix-an-error-handling-path-in-qla4xxx_g.patch b/queue-5.8/scsi-qla4xxx-fix-an-error-handling-path-in-qla4xxx_g.patch new file mode 100644 index 00000000000..7b95167166b --- /dev/null +++ b/queue-5.8/scsi-qla4xxx-fix-an-error-handling-path-in-qla4xxx_g.patch @@ -0,0 +1,38 @@ +From d0978529194660535e75e30d6ab50052873631d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 12:15:27 +0200 +Subject: scsi: qla4xxx: Fix an error handling path in + 'qla4xxx_get_host_stats()' + +From: Christophe JAILLET + +[ Upstream commit 574918e69720fe62ab3eb42ec3750230c8d16b06 ] + +Update the size used in 'dma_free_coherent()' in order to match the one +used in the corresponding 'dma_alloc_coherent()'. + +Link: https://lore.kernel.org/r/20200802101527.676054-1-christophe.jaillet@wanadoo.fr +Fixes: 4161cee52df8 ("[SCSI] qla4xxx: Add host statistics support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla4xxx/ql4_os.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index 5dc697ce8b5dd..4a6b15dc36aaf 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -1220,7 +1220,7 @@ static int qla4xxx_get_host_stats(struct Scsi_Host *shost, char *buf, int len) + le64_to_cpu(ql_iscsi_stats->iscsi_sequence_error); + exit_host_stats: + if (ql_iscsi_stats) +- dma_free_coherent(&ha->pdev->dev, host_stats_size, ++ dma_free_coherent(&ha->pdev->dev, stats_size, + ql_iscsi_stats, iscsi_stats_dma); + + ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n", +-- +2.25.1 + diff --git a/queue-5.8/scsi-smartpqi-avoid-crashing-kernel-for-controller-i.patch b/queue-5.8/scsi-smartpqi-avoid-crashing-kernel-for-controller-i.patch new file mode 100644 index 00000000000..637776049ee --- /dev/null +++ b/queue-5.8/scsi-smartpqi-avoid-crashing-kernel-for-controller-i.patch @@ -0,0 +1,247 @@ +From 35cc07f8423135ee9647ca886dd56cb2a8048315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 16:01:33 -0500 +Subject: scsi: smartpqi: Avoid crashing kernel for controller issues + +From: Kevin Barnett + +[ Upstream commit 9e68cccc8ef7206f0bccd590378d0dca8f9b4f57 ] + +Eliminate kernel panics when getting invalid responses from controller. +Take controller offline instead of causing kernel panics. + +Link: https://lore.kernel.org/r/159622929306.30579.16523318707596752828.stgit@brunhilda +Reviewed-by: Scott Teel +Reviewed-by: Scott Benesh +Reviewed-by: Prasad Munirathnam +Reviewed-by: Martin Wilck +Signed-off-by: Kevin Barnett +Signed-off-by: Don Brace +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/smartpqi/smartpqi.h | 2 +- + drivers/scsi/smartpqi/smartpqi_init.c | 101 +++++++++++++++++--------- + 2 files changed, 68 insertions(+), 35 deletions(-) + +diff --git a/drivers/scsi/smartpqi/smartpqi.h b/drivers/scsi/smartpqi/smartpqi.h +index 1129fe7a27edd..ee069a8b442a7 100644 +--- a/drivers/scsi/smartpqi/smartpqi.h ++++ b/drivers/scsi/smartpqi/smartpqi.h +@@ -359,7 +359,7 @@ struct pqi_event_response { + struct pqi_iu_header header; + u8 event_type; + u8 reserved2 : 7; +- u8 request_acknowlege : 1; ++ u8 request_acknowledge : 1; + __le16 event_id; + __le32 additional_event_id; + union { +diff --git a/drivers/scsi/smartpqi/smartpqi_init.c b/drivers/scsi/smartpqi/smartpqi_init.c +index cd157f11eb222..10afbaaa4a82f 100644 +--- a/drivers/scsi/smartpqi/smartpqi_init.c ++++ b/drivers/scsi/smartpqi/smartpqi_init.c +@@ -542,8 +542,7 @@ static int pqi_build_raid_path_request(struct pqi_ctrl_info *ctrl_info, + put_unaligned_be16(cdb_length, &cdb[7]); + break; + default: +- dev_err(&ctrl_info->pci_dev->dev, "unknown command 0x%c\n", +- cmd); ++ dev_err(&ctrl_info->pci_dev->dev, "unknown command 0x%c\n", cmd); + break; + } + +@@ -2462,7 +2461,6 @@ static int pqi_raid_bypass_submit_scsi_cmd(struct pqi_ctrl_info *ctrl_info, + offload_to_mirror = + (offload_to_mirror >= layout_map_count - 1) ? + 0 : offload_to_mirror + 1; +- WARN_ON(offload_to_mirror >= layout_map_count); + device->offload_to_mirror = offload_to_mirror; + /* + * Avoid direct use of device->offload_to_mirror within this +@@ -2915,10 +2913,14 @@ static int pqi_interpret_task_management_response( + return rc; + } + +-static unsigned int pqi_process_io_intr(struct pqi_ctrl_info *ctrl_info, +- struct pqi_queue_group *queue_group) ++static inline void pqi_invalid_response(struct pqi_ctrl_info *ctrl_info) ++{ ++ pqi_take_ctrl_offline(ctrl_info); ++} ++ ++static int pqi_process_io_intr(struct pqi_ctrl_info *ctrl_info, struct pqi_queue_group *queue_group) + { +- unsigned int num_responses; ++ int num_responses; + pqi_index_t oq_pi; + pqi_index_t oq_ci; + struct pqi_io_request *io_request; +@@ -2930,6 +2932,13 @@ static unsigned int pqi_process_io_intr(struct pqi_ctrl_info *ctrl_info, + + while (1) { + oq_pi = readl(queue_group->oq_pi); ++ if (oq_pi >= ctrl_info->num_elements_per_oq) { ++ pqi_invalid_response(ctrl_info); ++ dev_err(&ctrl_info->pci_dev->dev, ++ "I/O interrupt: producer index (%u) out of range (0-%u): consumer index: %u\n", ++ oq_pi, ctrl_info->num_elements_per_oq - 1, oq_ci); ++ return -1; ++ } + if (oq_pi == oq_ci) + break; + +@@ -2938,10 +2947,22 @@ static unsigned int pqi_process_io_intr(struct pqi_ctrl_info *ctrl_info, + (oq_ci * PQI_OPERATIONAL_OQ_ELEMENT_LENGTH); + + request_id = get_unaligned_le16(&response->request_id); +- WARN_ON(request_id >= ctrl_info->max_io_slots); ++ if (request_id >= ctrl_info->max_io_slots) { ++ pqi_invalid_response(ctrl_info); ++ dev_err(&ctrl_info->pci_dev->dev, ++ "request ID in response (%u) out of range (0-%u): producer index: %u consumer index: %u\n", ++ request_id, ctrl_info->max_io_slots - 1, oq_pi, oq_ci); ++ return -1; ++ } + + io_request = &ctrl_info->io_request_pool[request_id]; +- WARN_ON(atomic_read(&io_request->refcount) == 0); ++ if (atomic_read(&io_request->refcount) == 0) { ++ pqi_invalid_response(ctrl_info); ++ dev_err(&ctrl_info->pci_dev->dev, ++ "request ID in response (%u) does not match an outstanding I/O request: producer index: %u consumer index: %u\n", ++ request_id, oq_pi, oq_ci); ++ return -1; ++ } + + switch (response->header.iu_type) { + case PQI_RESPONSE_IU_RAID_PATH_IO_SUCCESS: +@@ -2971,24 +2992,22 @@ static unsigned int pqi_process_io_intr(struct pqi_ctrl_info *ctrl_info, + io_request->error_info = ctrl_info->error_buffer + + (get_unaligned_le16(&response->error_index) * + PQI_ERROR_BUFFER_ELEMENT_LENGTH); +- pqi_process_io_error(response->header.iu_type, +- io_request); ++ pqi_process_io_error(response->header.iu_type, io_request); + break; + default: ++ pqi_invalid_response(ctrl_info); + dev_err(&ctrl_info->pci_dev->dev, +- "unexpected IU type: 0x%x\n", +- response->header.iu_type); +- break; ++ "unexpected IU type: 0x%x: producer index: %u consumer index: %u\n", ++ response->header.iu_type, oq_pi, oq_ci); ++ return -1; + } + +- io_request->io_complete_callback(io_request, +- io_request->context); ++ io_request->io_complete_callback(io_request, io_request->context); + + /* + * Note that the I/O request structure CANNOT BE TOUCHED after + * returning from the I/O completion callback! + */ +- + oq_ci = (oq_ci + 1) % ctrl_info->num_elements_per_oq; + } + +@@ -3301,9 +3320,9 @@ static void pqi_ofa_capture_event_payload(struct pqi_event *event, + } + } + +-static unsigned int pqi_process_event_intr(struct pqi_ctrl_info *ctrl_info) ++static int pqi_process_event_intr(struct pqi_ctrl_info *ctrl_info) + { +- unsigned int num_events; ++ int num_events; + pqi_index_t oq_pi; + pqi_index_t oq_ci; + struct pqi_event_queue *event_queue; +@@ -3317,26 +3336,31 @@ static unsigned int pqi_process_event_intr(struct pqi_ctrl_info *ctrl_info) + + while (1) { + oq_pi = readl(event_queue->oq_pi); ++ if (oq_pi >= PQI_NUM_EVENT_QUEUE_ELEMENTS) { ++ pqi_invalid_response(ctrl_info); ++ dev_err(&ctrl_info->pci_dev->dev, ++ "event interrupt: producer index (%u) out of range (0-%u): consumer index: %u\n", ++ oq_pi, PQI_NUM_EVENT_QUEUE_ELEMENTS - 1, oq_ci); ++ return -1; ++ } ++ + if (oq_pi == oq_ci) + break; + + num_events++; +- response = event_queue->oq_element_array + +- (oq_ci * PQI_EVENT_OQ_ELEMENT_LENGTH); ++ response = event_queue->oq_element_array + (oq_ci * PQI_EVENT_OQ_ELEMENT_LENGTH); + + event_index = + pqi_event_type_to_event_index(response->event_type); + +- if (event_index >= 0) { +- if (response->request_acknowlege) { +- event = &ctrl_info->events[event_index]; +- event->pending = true; +- event->event_type = response->event_type; +- event->event_id = response->event_id; +- event->additional_event_id = +- response->additional_event_id; ++ if (event_index >= 0 && response->request_acknowledge) { ++ event = &ctrl_info->events[event_index]; ++ event->pending = true; ++ event->event_type = response->event_type; ++ event->event_id = response->event_id; ++ event->additional_event_id = response->additional_event_id; ++ if (event->event_type == PQI_EVENT_TYPE_OFA) + pqi_ofa_capture_event_payload(event, response); +- } + } + + oq_ci = (oq_ci + 1) % PQI_NUM_EVENT_QUEUE_ELEMENTS; +@@ -3451,7 +3475,8 @@ static irqreturn_t pqi_irq_handler(int irq, void *data) + { + struct pqi_ctrl_info *ctrl_info; + struct pqi_queue_group *queue_group; +- unsigned int num_responses_handled; ++ int num_io_responses_handled; ++ int num_events_handled; + + queue_group = data; + ctrl_info = queue_group->ctrl_info; +@@ -3459,17 +3484,25 @@ static irqreturn_t pqi_irq_handler(int irq, void *data) + if (!pqi_is_valid_irq(ctrl_info)) + return IRQ_NONE; + +- num_responses_handled = pqi_process_io_intr(ctrl_info, queue_group); ++ num_io_responses_handled = pqi_process_io_intr(ctrl_info, queue_group); ++ if (num_io_responses_handled < 0) ++ goto out; + +- if (irq == ctrl_info->event_irq) +- num_responses_handled += pqi_process_event_intr(ctrl_info); ++ if (irq == ctrl_info->event_irq) { ++ num_events_handled = pqi_process_event_intr(ctrl_info); ++ if (num_events_handled < 0) ++ goto out; ++ } else { ++ num_events_handled = 0; ++ } + +- if (num_responses_handled) ++ if (num_io_responses_handled + num_events_handled > 0) + atomic_inc(&ctrl_info->num_interrupts); + + pqi_start_io(ctrl_info, queue_group, RAID_PATH, NULL); + pqi_start_io(ctrl_info, queue_group, AIO_PATH, NULL); + ++out: + return IRQ_HANDLED; + } + +-- +2.25.1 + diff --git a/queue-5.8/scsi-target-core-add-control-field-for-trace-events.patch b/queue-5.8/scsi-target-core-add-control-field-for-trace-events.patch new file mode 100644 index 00000000000..dcf019cebe3 --- /dev/null +++ b/queue-5.8/scsi-target-core-add-control-field-for-trace-events.patch @@ -0,0 +1,113 @@ +From b3686bac2bb63a2934b9871d7cd5bb917b9f5947 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Sep 2020 15:59:57 +0300 +Subject: scsi: target: core: Add CONTROL field for trace events + +From: Roman Bolshakov + +[ Upstream commit 7010645ba7256992818b518163f46bd4cdf8002a ] + +trace-cmd report doesn't show events from target subsystem because +scsi_command_size() leaks through event format string: + + [target:target_sequencer_start] function scsi_command_size not defined + [target:target_cmd_complete] function scsi_command_size not defined + +Addition of scsi_command_size() to plugin_scsi.c in trace-cmd doesn't +help because an expression is used inside TP_printk(). trace-cmd event +parser doesn't understand minus sign inside [ ]: + + Error: expected ']' but read '-' + +Rather than duplicating kernel code in plugin_scsi.c, provide a dedicated +field for CONTROL byte. + +Link: https://lore.kernel.org/r/20200929125957.83069-1-r.bolshakov@yadro.com +Reviewed-by: Mike Christie +Signed-off-by: Roman Bolshakov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + include/scsi/scsi_common.h | 7 +++++++ + include/trace/events/target.h | 12 ++++++------ + 2 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h +index 731ac09ed2313..5b567b43e1b16 100644 +--- a/include/scsi/scsi_common.h ++++ b/include/scsi/scsi_common.h +@@ -25,6 +25,13 @@ scsi_command_size(const unsigned char *cmnd) + scsi_varlen_cdb_length(cmnd) : COMMAND_SIZE(cmnd[0]); + } + ++static inline unsigned char ++scsi_command_control(const unsigned char *cmnd) ++{ ++ return (cmnd[0] == VARIABLE_LENGTH_CMD) ? ++ cmnd[1] : cmnd[COMMAND_SIZE(cmnd[0]) - 1]; ++} ++ + /* Returns a human-readable name for the device */ + extern const char *scsi_device_type(unsigned type); + +diff --git a/include/trace/events/target.h b/include/trace/events/target.h +index 77408edd29d2a..67fad2677ed55 100644 +--- a/include/trace/events/target.h ++++ b/include/trace/events/target.h +@@ -141,6 +141,7 @@ TRACE_EVENT(target_sequencer_start, + __field( unsigned int, opcode ) + __field( unsigned int, data_length ) + __field( unsigned int, task_attribute ) ++ __field( unsigned char, control ) + __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE ) + __string( initiator, cmd->se_sess->se_node_acl->initiatorname ) + ), +@@ -151,6 +152,7 @@ TRACE_EVENT(target_sequencer_start, + __entry->opcode = cmd->t_task_cdb[0]; + __entry->data_length = cmd->data_length; + __entry->task_attribute = cmd->sam_task_attr; ++ __entry->control = scsi_command_control(cmd->t_task_cdb); + memcpy(__entry->cdb, cmd->t_task_cdb, TCM_MAX_COMMAND_SIZE); + __assign_str(initiator, cmd->se_sess->se_node_acl->initiatorname); + ), +@@ -160,9 +162,7 @@ TRACE_EVENT(target_sequencer_start, + __entry->tag, show_opcode_name(__entry->opcode), + __entry->data_length, __print_hex(__entry->cdb, 16), + show_task_attribute_name(__entry->task_attribute), +- scsi_command_size(__entry->cdb) <= 16 ? +- __entry->cdb[scsi_command_size(__entry->cdb) - 1] : +- __entry->cdb[1] ++ __entry->control + ) + ); + +@@ -178,6 +178,7 @@ TRACE_EVENT(target_cmd_complete, + __field( unsigned int, opcode ) + __field( unsigned int, data_length ) + __field( unsigned int, task_attribute ) ++ __field( unsigned char, control ) + __field( unsigned char, scsi_status ) + __field( unsigned char, sense_length ) + __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE ) +@@ -191,6 +192,7 @@ TRACE_EVENT(target_cmd_complete, + __entry->opcode = cmd->t_task_cdb[0]; + __entry->data_length = cmd->data_length; + __entry->task_attribute = cmd->sam_task_attr; ++ __entry->control = scsi_command_control(cmd->t_task_cdb); + __entry->scsi_status = cmd->scsi_status; + __entry->sense_length = cmd->scsi_status == SAM_STAT_CHECK_CONDITION ? + min(18, ((u8 *) cmd->sense_buffer)[SPC_ADD_SENSE_LEN_OFFSET] + 8) : 0; +@@ -208,9 +210,7 @@ TRACE_EVENT(target_cmd_complete, + show_opcode_name(__entry->opcode), + __entry->data_length, __print_hex(__entry->cdb, 16), + show_task_attribute_name(__entry->task_attribute), +- scsi_command_size(__entry->cdb) <= 16 ? +- __entry->cdb[scsi_command_size(__entry->cdb) - 1] : +- __entry->cdb[1] ++ __entry->control + ) + ); + +-- +2.25.1 + diff --git a/queue-5.8/scsi-target-tcmu-fix-warning-page-may-be-used-uninit.patch b/queue-5.8/scsi-target-tcmu-fix-warning-page-may-be-used-uninit.patch new file mode 100644 index 00000000000..6f1e837fb43 --- /dev/null +++ b/queue-5.8/scsi-target-tcmu-fix-warning-page-may-be-used-uninit.patch @@ -0,0 +1,39 @@ +From ced8fff8e6260261d492eed856f421fe012f2dfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Sep 2020 17:19:20 -0700 +Subject: scsi: target: tcmu: Fix warning: 'page' may be used uninitialized + +From: John Donnelly + +[ Upstream commit 61741d8699e1fc764a309ebd20211bb1cb193110 ] + +Corrects drivers/target/target_core_user.c:688:6: warning: 'page' may be +used uninitialized. + +Link: https://lore.kernel.org/r/20200924001920.43594-1-john.p.donnelly@oracle.com +Fixes: 3c58f737231e ("scsi: target: tcmu: Optimize use of flush_dcache_page") +Cc: Mike Christie +Acked-by: Mike Christie +Signed-off-by: John Donnelly +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_user.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index 0209bc23e631e..13a280c780c39 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -669,7 +669,7 @@ static void scatter_data_area(struct tcmu_dev *udev, + void *from, *to = NULL; + size_t copy_bytes, to_offset, offset; + struct scatterlist *sg; +- struct page *page; ++ struct page *page = NULL; + + for_each_sg(data_sg, sg, data_nents, i) { + int sg_remaining = sg->length; +-- +2.25.1 + diff --git a/queue-5.8/scsi-ufs-make-ufshcd_print_trs-consider-ufshcd_quirk.patch b/queue-5.8/scsi-ufs-make-ufshcd_print_trs-consider-ufshcd_quirk.patch new file mode 100644 index 00000000000..ee5512ecd32 --- /dev/null +++ b/queue-5.8/scsi-ufs-make-ufshcd_print_trs-consider-ufshcd_quirk.patch @@ -0,0 +1,45 @@ +From a463ec9c9277e0f70368cfa4d3170ede747fa777 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 19:10:40 -0700 +Subject: scsi: ufs: Make ufshcd_print_trs() consider + UFSHCD_QUIRK_PRDT_BYTE_GRAN + +From: Eric Biggers + +[ Upstream commit cc770ce34aeeff21991f162f0db1a758ea672727 ] + +Fix ufshcd_print_trs() to consider UFSHCD_QUIRK_PRDT_BYTE_GRAN when using +utp_transfer_req_desc::prd_table_length, so that it doesn't treat the +number of bytes as the number of entries. + +Originally from Kiwoong Kim +(https://lkml.kernel.org/r/20200218233115.8185-1-kwmad.kim@samsung.com). + +Link: https://lore.kernel.org/r/20200826021040.152148-1-ebiggers@kernel.org +Fixes: 26f968d7de82 ("scsi: ufs: Introduce UFSHCD_QUIRK_PRDT_BYTE_GRAN quirk") +Cc: Alim Akhtar +Cc: Kiwoong Kim +Signed-off-by: Eric Biggers +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufshcd.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 8bc8e4e62c045..e5f75b2e07e2c 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -484,6 +484,9 @@ void ufshcd_print_trs(struct ufs_hba *hba, unsigned long bitmap, bool pr_prdt) + + prdt_length = le16_to_cpu( + lrbp->utr_descriptor_ptr->prd_table_length); ++ if (hba->quirks & UFSHCD_QUIRK_PRDT_BYTE_GRAN) ++ prdt_length /= sizeof(struct ufshcd_sg_entry); ++ + dev_err(hba->dev, + "UPIU[%d] - PRDT - %d entries phys@0x%llx\n", + tag, prdt_length, +-- +2.25.1 + diff --git a/queue-5.8/scsi-ufs-ufs-mediatek-fix-host_pa_tactivate-quirk.patch b/queue-5.8/scsi-ufs-ufs-mediatek-fix-host_pa_tactivate-quirk.patch new file mode 100644 index 00000000000..7f85de519ce --- /dev/null +++ b/queue-5.8/scsi-ufs-ufs-mediatek-fix-host_pa_tactivate-quirk.patch @@ -0,0 +1,42 @@ +From 7813b49d9fa74d5d1f281ba7626179dd94f79808 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 14:45:05 +0800 +Subject: scsi: ufs: ufs-mediatek: Fix HOST_PA_TACTIVATE quirk + +From: Stanley Chu + +[ Upstream commit a3e40b80dc951057033dce86f0e675b2b822b513 ] + +Simply add HOST_PA_TACTIVATE quirk back since it was incorrectly removed +before. + +Link: https://lore.kernel.org/r/20200908064507.30774-3-stanley.chu@mediatek.com +Fixes: 47d054580a75 ("scsi: ufs-mediatek: fix HOST_PA_TACTIVATE quirk for Samsung UFS Devices") +Signed-off-by: Stanley Chu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-mediatek.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/scsi/ufs/ufs-mediatek.c b/drivers/scsi/ufs/ufs-mediatek.c +index d56ce8d97d4e8..7ad127f213977 100644 +--- a/drivers/scsi/ufs/ufs-mediatek.c ++++ b/drivers/scsi/ufs/ufs-mediatek.c +@@ -585,13 +585,7 @@ static int ufs_mtk_apply_dev_quirks(struct ufs_hba *hba) + + static void ufs_mtk_fixup_dev_quirks(struct ufs_hba *hba) + { +- struct ufs_dev_info *dev_info = &hba->dev_info; +- u16 mid = dev_info->wmanufacturerid; +- + ufshcd_fixup_dev_quirks(hba, ufs_mtk_dev_fixups); +- +- if (mid == UFS_VENDOR_SAMSUNG) +- hba->dev_quirks &= ~UFS_DEVICE_QUIRK_HOST_PA_TACTIVATE; + } + + /** +-- +2.25.1 + diff --git a/queue-5.8/scsi-ufs-ufs-qcom-fix-race-conditions-caused-by-ufs_.patch b/queue-5.8/scsi-ufs-ufs-qcom-fix-race-conditions-caused-by-ufs_.patch new file mode 100644 index 00000000000..465e1ed9b6e --- /dev/null +++ b/queue-5.8/scsi-ufs-ufs-qcom-fix-race-conditions-caused-by-ufs_.patch @@ -0,0 +1,53 @@ +From e1aaa30be44a785123f8e80ca79fee2ecd507eb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Aug 2020 05:15:48 -0700 +Subject: scsi: ufs: ufs-qcom: Fix race conditions caused by + ufs_qcom_testbus_config() + +From: Can Guo + +[ Upstream commit 89dd87acd40a44de8ff3358138aedf8f73f4efc6 ] + +If ufs_qcom_dump_dbg_regs() calls ufs_qcom_testbus_config() from +ufshcd_suspend/resume and/or clk gate/ungate context, pm_runtime_get_sync() +and ufshcd_hold() will cause a race condition. Fix this by removing the +unnecessary calls of pm_runtime_get_sync() and ufshcd_hold(). + +Link: https://lore.kernel.org/r/1596975355-39813-3-git-send-email-cang@codeaurora.org +Reviewed-by: Hongwu Su +Reviewed-by: Avri Altman +Reviewed-by: Bean Huo +Reviewed-by: Asutosh Das +Signed-off-by: Can Guo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/ufs/ufs-qcom.c | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c +index 2e6ddb5cdfc23..7da27eed1fe7b 100644 +--- a/drivers/scsi/ufs/ufs-qcom.c ++++ b/drivers/scsi/ufs/ufs-qcom.c +@@ -1604,9 +1604,6 @@ int ufs_qcom_testbus_config(struct ufs_qcom_host *host) + */ + } + mask <<= offset; +- +- pm_runtime_get_sync(host->hba->dev); +- ufshcd_hold(host->hba, false); + ufshcd_rmwl(host->hba, TEST_BUS_SEL, + (u32)host->testbus.select_major << 19, + REG_UFS_CFG1); +@@ -1619,8 +1616,6 @@ int ufs_qcom_testbus_config(struct ufs_qcom_host *host) + * committed before returning. + */ + mb(); +- ufshcd_release(host->hba); +- pm_runtime_put_sync(host->hba->dev); + + return 0; + } +-- +2.25.1 + diff --git a/queue-5.8/selftests-bpf-fix-endianness-issue-in-sk_assign.patch b/queue-5.8/selftests-bpf-fix-endianness-issue-in-sk_assign.patch new file mode 100644 index 00000000000..d8209438c41 --- /dev/null +++ b/queue-5.8/selftests-bpf-fix-endianness-issue-in-sk_assign.patch @@ -0,0 +1,41 @@ +From 8aedac6dcc4148b4c108b135462b40e4cb52f066 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 13:38:15 +0200 +Subject: selftests/bpf: Fix endianness issue in sk_assign + +From: Ilya Leoshkevich + +[ Upstream commit b6ed6cf4a3acdeab9aed8e0a524850761ec9b152 ] + +server_map's value size is 8, but the test tries to put an int there. +This sort of works on x86 (unless followed by non-0), but hard fails on +s390. + +Fix by using __s64 instead of int. + +Fixes: 2d7824ffd25c ("selftests: bpf: Add test for sk_assign") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20200915113815.3768217-1-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/sk_assign.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/sk_assign.c b/tools/testing/selftests/bpf/prog_tests/sk_assign.c +index 47fa04adc1471..21c2d265c3e8e 100644 +--- a/tools/testing/selftests/bpf/prog_tests/sk_assign.c ++++ b/tools/testing/selftests/bpf/prog_tests/sk_assign.c +@@ -265,7 +265,7 @@ void test_sk_assign(void) + TEST("ipv6 udp port redir", AF_INET6, SOCK_DGRAM, false), + TEST("ipv6 udp addr redir", AF_INET6, SOCK_DGRAM, true), + }; +- int server = -1; ++ __s64 server = -1; + int server_map; + int self_net; + +-- +2.25.1 + diff --git a/queue-5.8/selftests-bpf-fix-endianness-issue-in-test_sockopt_s.patch b/queue-5.8/selftests-bpf-fix-endianness-issue-in-test_sockopt_s.patch new file mode 100644 index 00000000000..1de826b7457 --- /dev/null +++ b/queue-5.8/selftests-bpf-fix-endianness-issue-in-test_sockopt_s.patch @@ -0,0 +1,43 @@ +From 8c1d99be79e2ce16da32a47a0a395f1f1b984fb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 13:39:28 +0200 +Subject: selftests/bpf: Fix endianness issue in test_sockopt_sk + +From: Ilya Leoshkevich + +[ Upstream commit fec47bbc10b243690f5d0ee484a0bbdee273e71b ] + +getsetsockopt() calls getsockopt() with optlen == 1, but then checks +the resulting int. It is ok on little endian, but not on big endian. + +Fix by checking char instead. + +Fixes: 8a027dc0d8f5 ("selftests/bpf: add sockopt test that exercises sk helpers") +Signed-off-by: Ilya Leoshkevich +Signed-off-by: Daniel Borkmann +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20200915113928.3768496-1-iii@linux.ibm.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/sockopt_sk.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c b/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c +index 5f54c6aec7f07..b25c9c45c1484 100644 +--- a/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c ++++ b/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c +@@ -45,9 +45,9 @@ static int getsetsockopt(void) + goto err; + } + +- if (*(int *)big_buf != 0x08) { ++ if (*big_buf != 0x08) { + log_err("Unexpected getsockopt(IP_TOS) optval 0x%x != 0x08", +- *(int *)big_buf); ++ (int)*big_buf); + goto err; + } + +-- +2.25.1 + diff --git a/queue-5.8/selftests-bpf-fix-overflow-tests-to-reflect-iter-siz.patch b/queue-5.8/selftests-bpf-fix-overflow-tests-to-reflect-iter-siz.patch new file mode 100644 index 00000000000..2280552bb5d --- /dev/null +++ b/queue-5.8/selftests-bpf-fix-overflow-tests-to-reflect-iter-siz.patch @@ -0,0 +1,62 @@ +From ae7bbfe6edebea2c8576f6a3e973682d7226efa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 12:31:08 +0100 +Subject: selftests/bpf: Fix overflow tests to reflect iter size increase + +From: Alan Maguire + +[ Upstream commit eb58bbf2e5c7917aa30bf8818761f26bbeeb2290 ] + +bpf iter size increase to PAGE_SIZE << 3 means overflow tests assuming +page size need to be bumped also. + +Signed-off-by: Alan Maguire +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/1601292670-1616-7-git-send-email-alan.maguire@oracle.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/prog_tests/bpf_iter.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/tools/testing/selftests/bpf/prog_tests/bpf_iter.c b/tools/testing/selftests/bpf/prog_tests/bpf_iter.c +index 87c29dde1cf96..669f195de2fa0 100644 +--- a/tools/testing/selftests/bpf/prog_tests/bpf_iter.c ++++ b/tools/testing/selftests/bpf/prog_tests/bpf_iter.c +@@ -249,7 +249,7 @@ static void test_overflow(bool test_e2big_overflow, bool ret1) + struct bpf_map_info map_info = {}; + struct bpf_iter_test_kern4 *skel; + struct bpf_link *link; +- __u32 page_size; ++ __u32 iter_size; + char *buf; + + skel = bpf_iter_test_kern4__open(); +@@ -271,19 +271,19 @@ static void test_overflow(bool test_e2big_overflow, bool ret1) + "map_creation failed: %s\n", strerror(errno))) + goto free_map1; + +- /* bpf_seq_printf kernel buffer is one page, so one map ++ /* bpf_seq_printf kernel buffer is 8 pages, so one map + * bpf_seq_write will mostly fill it, and the other map + * will partially fill and then trigger overflow and need + * bpf_seq_read restart. + */ +- page_size = sysconf(_SC_PAGE_SIZE); ++ iter_size = sysconf(_SC_PAGE_SIZE) << 3; + + if (test_e2big_overflow) { +- skel->rodata->print_len = (page_size + 8) / 8; +- expected_read_len = 2 * (page_size + 8); ++ skel->rodata->print_len = (iter_size + 8) / 8; ++ expected_read_len = 2 * (iter_size + 8); + } else if (!ret1) { +- skel->rodata->print_len = (page_size - 8) / 8; +- expected_read_len = 2 * (page_size - 8); ++ skel->rodata->print_len = (iter_size - 8) / 8; ++ expected_read_len = 2 * (iter_size - 8); + } else { + skel->rodata->print_len = 1; + expected_read_len = 2 * 8; +-- +2.25.1 + diff --git a/queue-5.8/selftests-bpf-fix-test_sysctl_loop-1-2-failure-due-t.patch b/queue-5.8/selftests-bpf-fix-test_sysctl_loop-1-2-failure-due-t.patch new file mode 100644 index 00000000000..656f48257df --- /dev/null +++ b/queue-5.8/selftests-bpf-fix-test_sysctl_loop-1-2-failure-due-t.patch @@ -0,0 +1,129 @@ +From be8713c99b52495e7f7061f96341bcdc41cabacb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 10:15:42 -0700 +Subject: selftests/bpf: Fix test_sysctl_loop{1, 2} failure due to clang change + +From: Yonghong Song + +[ Upstream commit 7fb5eefd76394cfefb380724a87ca40b47d44405 ] + +Andrii reported that with latest clang, when building selftests, we have +error likes: + error: progs/test_sysctl_loop1.c:23:16: in function sysctl_tcp_mem i32 (%struct.bpf_sysctl*): + Looks like the BPF stack limit of 512 bytes is exceeded. + Please move large on stack variables into BPF per-cpu array map. + +The error is triggered by the following LLVM patch: + https://reviews.llvm.org/D87134 + +For example, the following code is from test_sysctl_loop1.c: + static __always_inline int is_tcp_mem(struct bpf_sysctl *ctx) + { + volatile char tcp_mem_name[] = "net/ipv4/tcp_mem/very_very_very_very_long_pointless_string"; + ... + } +Without the above LLVM patch, the compiler did optimization to load the string +(59 bytes long) with 7 64bit loads, 1 8bit load and 1 16bit load, +occupying 64 byte stack size. + +With the above LLVM patch, the compiler only uses 8bit loads, but subregister is 32bit. +So stack requirements become 4 * 59 = 236 bytes. Together with other stuff on +the stack, total stack size exceeds 512 bytes, hence compiler complains and quits. + +To fix the issue, removing "volatile" key word or changing "volatile" to +"const"/"static const" does not work, the string is put in .rodata.str1.1 section, +which libbpf did not process it and errors out with + libbpf: elf: skipping unrecognized data section(6) .rodata.str1.1 + libbpf: prog 'sysctl_tcp_mem': bad map relo against '.L__const.is_tcp_mem.tcp_mem_name' + in section '.rodata.str1.1' + +Defining the string const as global variable can fix the issue as it puts the string constant +in '.rodata' section which is recognized by libbpf. In the future, when libbpf can process +'.rodata.str*.*' properly, the global definition can be changed back to local definition. + +Defining tcp_mem_name as a global, however, triggered a verifier failure. + ./test_progs -n 7/21 + libbpf: load bpf program failed: Permission denied + libbpf: -- BEGIN DUMP LOG --- + libbpf: + invalid stack off=0 size=1 + verification time 6975 usec + stack depth 160+64 + processed 889 insns (limit 1000000) max_states_per_insn 4 total_states + 14 peak_states 14 mark_read 10 + + libbpf: -- END LOG -- + libbpf: failed to load program 'sysctl_tcp_mem' + libbpf: failed to load object 'test_sysctl_loop2.o' + test_bpf_verif_scale:FAIL:114 + #7/21 test_sysctl_loop2.o:FAIL +This actually exposed a bpf program bug. In test_sysctl_loop{1,2}, we have code +like + const char tcp_mem_name[] = "<...long string...>"; + ... + char name[64]; + ... + for (i = 0; i < sizeof(tcp_mem_name); ++i) + if (name[i] != tcp_mem_name[i]) + return 0; +In the above code, if sizeof(tcp_mem_name) > 64, name[i] access may be +out of bound. The sizeof(tcp_mem_name) is 59 for test_sysctl_loop1.c and +79 for test_sysctl_loop2.c. + +Without promotion-to-global change, old compiler generates code where +the overflowed stack access is actually filled with valid value, so hiding +the bpf program bug. With promotion-to-global change, the code is different, +more specifically, the previous loading constants to stack is gone, and +"name" occupies stack[-64:0] and overflow access triggers a verifier error. +To fix the issue, adjust "name" buffer size properly. + +Reported-by: Andrii Nakryiko +Signed-off-by: Yonghong Song +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20200909171542.3673449-1-yhs@fb.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/progs/test_sysctl_loop1.c | 4 ++-- + tools/testing/selftests/bpf/progs/test_sysctl_loop2.c | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c b/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c +index 458b0d69133e4..553a282d816ab 100644 +--- a/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c ++++ b/tools/testing/selftests/bpf/progs/test_sysctl_loop1.c +@@ -18,11 +18,11 @@ + #define MAX_ULONG_STR_LEN 7 + #define MAX_VALUE_STR_LEN (TCP_MEM_LOOPS * MAX_ULONG_STR_LEN) + ++const char tcp_mem_name[] = "net/ipv4/tcp_mem/very_very_very_very_long_pointless_string"; + static __always_inline int is_tcp_mem(struct bpf_sysctl *ctx) + { +- volatile char tcp_mem_name[] = "net/ipv4/tcp_mem/very_very_very_very_long_pointless_string"; + unsigned char i; +- char name[64]; ++ char name[sizeof(tcp_mem_name)]; + int ret; + + memset(name, 0, sizeof(name)); +diff --git a/tools/testing/selftests/bpf/progs/test_sysctl_loop2.c b/tools/testing/selftests/bpf/progs/test_sysctl_loop2.c +index b2e6f9b0894d8..2b64bc563a12e 100644 +--- a/tools/testing/selftests/bpf/progs/test_sysctl_loop2.c ++++ b/tools/testing/selftests/bpf/progs/test_sysctl_loop2.c +@@ -18,11 +18,11 @@ + #define MAX_ULONG_STR_LEN 7 + #define MAX_VALUE_STR_LEN (TCP_MEM_LOOPS * MAX_ULONG_STR_LEN) + ++const char tcp_mem_name[] = "net/ipv4/tcp_mem/very_very_very_very_long_pointless_string_to_stress_byte_loop"; + static __attribute__((noinline)) int is_tcp_mem(struct bpf_sysctl *ctx) + { +- volatile char tcp_mem_name[] = "net/ipv4/tcp_mem/very_very_very_very_long_pointless_string_to_stress_byte_loop"; + unsigned char i; +- char name[64]; ++ char name[sizeof(tcp_mem_name)]; + int ret; + + memset(name, 0, sizeof(name)); +-- +2.25.1 + diff --git a/queue-5.8/selftests-bpf-fix-test_vmlinux-test-to-use-bpf_probe.patch b/queue-5.8/selftests-bpf-fix-test_vmlinux-test-to-use-bpf_probe.patch new file mode 100644 index 00000000000..cb9e33d54da --- /dev/null +++ b/queue-5.8/selftests-bpf-fix-test_vmlinux-test-to-use-bpf_probe.patch @@ -0,0 +1,76 @@ +From 3f56e14febce2c2fb0e7937c24689b2dcd2f150d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 14:33:54 -0700 +Subject: selftests/bpf: Fix test_vmlinux test to use bpf_probe_read_user() + +From: Andrii Nakryiko + +[ Upstream commit 02f47faa25db134f6043fb6b12a68b5d4c980bb6 ] + +The test is reading UAPI kernel structure from user-space. So it doesn't need +CO-RE relocations and has to use bpf_probe_read_user(). + +Fixes: acbd06206bbb ("selftests/bpf: Add vmlinux.h selftest exercising tracing of syscalls") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20200818213356.2629020-6-andriin@fb.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/progs/test_vmlinux.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_vmlinux.c b/tools/testing/selftests/bpf/progs/test_vmlinux.c +index 5611b564d3b1c..f54b2293c490f 100644 +--- a/tools/testing/selftests/bpf/progs/test_vmlinux.c ++++ b/tools/testing/selftests/bpf/progs/test_vmlinux.c +@@ -19,12 +19,14 @@ SEC("tp/syscalls/sys_enter_nanosleep") + int handle__tp(struct trace_event_raw_sys_enter *args) + { + struct __kernel_timespec *ts; ++ long tv_nsec; + + if (args->id != __NR_nanosleep) + return 0; + + ts = (void *)args->args[0]; +- if (BPF_CORE_READ(ts, tv_nsec) != MY_TV_NSEC) ++ if (bpf_probe_read_user(&tv_nsec, sizeof(ts->tv_nsec), &ts->tv_nsec) || ++ tv_nsec != MY_TV_NSEC) + return 0; + + tp_called = true; +@@ -35,12 +37,14 @@ SEC("raw_tp/sys_enter") + int BPF_PROG(handle__raw_tp, struct pt_regs *regs, long id) + { + struct __kernel_timespec *ts; ++ long tv_nsec; + + if (id != __NR_nanosleep) + return 0; + + ts = (void *)PT_REGS_PARM1_CORE(regs); +- if (BPF_CORE_READ(ts, tv_nsec) != MY_TV_NSEC) ++ if (bpf_probe_read_user(&tv_nsec, sizeof(ts->tv_nsec), &ts->tv_nsec) || ++ tv_nsec != MY_TV_NSEC) + return 0; + + raw_tp_called = true; +@@ -51,12 +55,14 @@ SEC("tp_btf/sys_enter") + int BPF_PROG(handle__tp_btf, struct pt_regs *regs, long id) + { + struct __kernel_timespec *ts; ++ long tv_nsec; + + if (id != __NR_nanosleep) + return 0; + + ts = (void *)PT_REGS_PARM1_CORE(regs); +- if (BPF_CORE_READ(ts, tv_nsec) != MY_TV_NSEC) ++ if (bpf_probe_read_user(&tv_nsec, sizeof(ts->tv_nsec), &ts->tv_nsec) || ++ tv_nsec != MY_TV_NSEC) + return 0; + + tp_btf_called = true; +-- +2.25.1 + diff --git a/queue-5.8/selftests-ftrace-change-synthetic-event-name-for-int.patch b/queue-5.8/selftests-ftrace-change-synthetic-event-name-for-int.patch new file mode 100644 index 00000000000..6cfb28934a0 --- /dev/null +++ b/queue-5.8/selftests-ftrace-change-synthetic-event-name-for-int.patch @@ -0,0 +1,52 @@ +From cc8652107298339f627f4293a015e22c9579b18d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 09:17:56 -0500 +Subject: selftests/ftrace: Change synthetic event name for + inter-event-combined test + +From: Tom Zanussi + +[ Upstream commit 96378b2088faea68f1fb05ea6b9a566fc569a44c ] + +This test uses waking+wakeup_latency as an event name, which doesn't +make sense since it includes an operator. Illegal names are now +detected by the synthetic event command parsing, which causes this +test to fail. Change the name to 'waking_plus_wakeup_latency' to +prevent this. + +Link: https://lkml.kernel.org/r/a1ee2f76ff28ef7166fb788ca8be968887808920.1602598160.git.zanussi@kernel.org + +Fixes: f06eec4d0f2c (selftests: ftrace: Add inter-event hist triggers testcases) +Acked-by: Masami Hiramatsu +Tested-by: Masami Hiramatsu +Signed-off-by: Tom Zanussi +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + .../inter-event/trigger-inter-event-combined-hist.tc | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc +index 7449a4b8f1f9a..9098f1e7433fd 100644 +--- a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-inter-event-combined-hist.tc +@@ -25,12 +25,12 @@ echo 'wakeup_latency u64 lat pid_t pid' >> synthetic_events + echo 'hist:keys=pid:ts1=common_timestamp.usecs if comm=="ping"' >> events/sched/sched_wakeup/trigger + echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts1:onmatch(sched.sched_wakeup).wakeup_latency($wakeup_lat,next_pid) if next_comm=="ping"' > events/sched/sched_switch/trigger + +-echo 'waking+wakeup_latency u64 lat; pid_t pid' >> synthetic_events +-echo 'hist:keys=pid,lat:sort=pid,lat:ww_lat=$waking_lat+$wakeup_lat:onmatch(synthetic.wakeup_latency).waking+wakeup_latency($ww_lat,pid)' >> events/synthetic/wakeup_latency/trigger +-echo 'hist:keys=pid,lat:sort=pid,lat' >> events/synthetic/waking+wakeup_latency/trigger ++echo 'waking_plus_wakeup_latency u64 lat; pid_t pid' >> synthetic_events ++echo 'hist:keys=pid,lat:sort=pid,lat:ww_lat=$waking_lat+$wakeup_lat:onmatch(synthetic.wakeup_latency).waking_plus_wakeup_latency($ww_lat,pid)' >> events/synthetic/wakeup_latency/trigger ++echo 'hist:keys=pid,lat:sort=pid,lat' >> events/synthetic/waking_plus_wakeup_latency/trigger + + ping $LOCALHOST -c 3 +-if ! grep -q "pid:" events/synthetic/waking+wakeup_latency/hist; then ++if ! grep -q "pid:" events/synthetic/waking_plus_wakeup_latency/hist; then + fail "Failed to create combined histogram" + fi + +-- +2.25.1 + diff --git a/queue-5.8/selftests-lkdtm-use-comm-instead-of-diff-for-dmesg.patch b/queue-5.8/selftests-lkdtm-use-comm-instead-of-diff-for-dmesg.patch new file mode 100644 index 00000000000..6a622870750 --- /dev/null +++ b/queue-5.8/selftests-lkdtm-use-comm-instead-of-diff-for-dmesg.patch @@ -0,0 +1,40 @@ +From 6a26e453d986cd491eba5c841224b8bb4fff8942 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 14:17:00 -0700 +Subject: selftests/lkdtm: Use "comm" instead of "diff" for dmesg + +From: Kees Cook + +[ Upstream commit d00451c8118f8f7ab8e057bc6ee2f8b7d70b6a1c ] + +Instead of full GNU diff (which smaller boot environments may not have), +use "comm" which is more available. + +Reported-by: Naresh Kamboju +Cc: linux-kselftest@vger.kernel.org +Fixes: f131d9edc29d ("selftests/lkdtm: Don't clear dmesg when running tests") +Signed-off-by: Kees Cook +Acked-by: Shuah Khan +Link: https://lore.kernel.org/r/20200909211700.2399399-1-keescook@chromium.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/lkdtm/run.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/lkdtm/run.sh b/tools/testing/selftests/lkdtm/run.sh +index 8383eb89d88a9..bb7a1775307b8 100755 +--- a/tools/testing/selftests/lkdtm/run.sh ++++ b/tools/testing/selftests/lkdtm/run.sh +@@ -82,7 +82,7 @@ dmesg > "$DMESG" + ($SHELL -c 'cat <(echo '"$test"') >'"$TRIGGER" 2>/dev/null) || true + + # Record and dump the results +-dmesg | diff --changed-group-format='%>' --unchanged-group-format='' "$DMESG" - > "$LOG" || true ++dmesg | comm --nocheck-order -13 "$DMESG" - > "$LOG" || true + + cat "$LOG" + # Check for expected output +-- +2.25.1 + diff --git a/queue-5.8/selftests-mptcp-interpret-n-as-a-new-line.patch b/queue-5.8/selftests-mptcp-interpret-n-as-a-new-line.patch new file mode 100644 index 00000000000..7038176d375 --- /dev/null +++ b/queue-5.8/selftests-mptcp-interpret-n-as-a-new-line.patch @@ -0,0 +1,66 @@ +From 172f9e99288ac393ebeb0481ed623c7448835729 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 15:13:51 +0200 +Subject: selftests: mptcp: interpret \n as a new line + +From: Matthieu Baerts + +[ Upstream commit 8b974778f998ab1be23eca7436fc13d2d8c6bd59 ] + +In case of errors, this message was printed: + + (...) + # read: Resource temporarily unavailable + # client exit code 0, server 3 + # \nnetns ns1-0-BJlt5D socket stat for 10003: + (...) + +Obviously, the idea was to add a new line before the socket stat and not +print "\nnetns". + +Fixes: b08fbf241064 ("selftests: add test-cases for MPTCP MP_JOIN") +Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp") +Signed-off-by: Matthieu Baerts +Acked-by: Paolo Abeni +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/net/mptcp/mptcp_connect.sh | 4 ++-- + tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 ++-- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.sh b/tools/testing/selftests/net/mptcp/mptcp_connect.sh +index acf02e156d20f..ed163e4ad4344 100755 +--- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh +@@ -421,9 +421,9 @@ do_transfer() + duration=$(printf "(duration %05sms)" $duration) + if [ ${rets} -ne 0 ] || [ ${retc} -ne 0 ]; then + echo "$duration [ FAIL ] client exit code $retc, server $rets" 1>&2 +- echo "\nnetns ${listener_ns} socket stat for $port:" 1>&2 ++ echo -e "\nnetns ${listener_ns} socket stat for ${port}:" 1>&2 + ip netns exec ${listener_ns} ss -nita 1>&2 -o "sport = :$port" +- echo "\nnetns ${connector_ns} socket stat for $port:" 1>&2 ++ echo -e "\nnetns ${connector_ns} socket stat for ${port}:" 1>&2 + ip netns exec ${connector_ns} ss -nita 1>&2 -o "dport = :$port" + + cat "$capout" +diff --git a/tools/testing/selftests/net/mptcp/mptcp_join.sh b/tools/testing/selftests/net/mptcp/mptcp_join.sh +index dd42c2f692d01..9cb0c6af326ba 100755 +--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh ++++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh +@@ -167,9 +167,9 @@ do_transfer() + + if [ ${rets} -ne 0 ] || [ ${retc} -ne 0 ]; then + echo " client exit code $retc, server $rets" 1>&2 +- echo "\nnetns ${listener_ns} socket stat for $port:" 1>&2 ++ echo -e "\nnetns ${listener_ns} socket stat for ${port}:" 1>&2 + ip netns exec ${listener_ns} ss -nita 1>&2 -o "sport = :$port" +- echo "\nnetns ${connector_ns} socket stat for $port:" 1>&2 ++ echo -e "\nnetns ${connector_ns} socket stat for ${port}:" 1>&2 + ip netns exec ${connector_ns} ss -nita 1>&2 -o "dport = :$port" + + cat "$capout" +-- +2.25.1 + diff --git a/queue-5.8/selftests-powerpc-fix-eeh-basic.sh-exit-codes.patch b/queue-5.8/selftests-powerpc-fix-eeh-basic.sh-exit-codes.patch new file mode 100644 index 00000000000..52f775715ce --- /dev/null +++ b/queue-5.8/selftests-powerpc-fix-eeh-basic.sh-exit-codes.patch @@ -0,0 +1,63 @@ +From 0291f14fb1aaa4e896c3c6be90d6213dc24f2bd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Oct 2020 13:47:11 +1100 +Subject: selftests/powerpc: Fix eeh-basic.sh exit codes + +From: Oliver O'Halloran + +[ Upstream commit 996f9e0f93f16211945c8d5f18f296a88cb32f91 ] + +The kselftests test running infrastructure expects tests to finish with an +exit code of 4 if the test decided it should be skipped. Currently +eeh-basic.sh exits with the number of devices that failed to recover, so if +four devices didn't recover we'll report a skip instead of a fail. + +Fix this by checking if the return code is non-zero and report success +and failure by returning 0 or 1 respectively. For the cases where should +actually skip return 4. + +Fixes: 85d86c8aa52e ("selftests/powerpc: Add basic EEH selftest") +Signed-off-by: Oliver O'Halloran +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201014024711.1138386-1-oohall@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/eeh/eeh-basic.sh | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/eeh/eeh-basic.sh b/tools/testing/selftests/powerpc/eeh/eeh-basic.sh +index 8a8d0f456946c..0d783e1065c86 100755 +--- a/tools/testing/selftests/powerpc/eeh/eeh-basic.sh ++++ b/tools/testing/selftests/powerpc/eeh/eeh-basic.sh +@@ -1,17 +1,19 @@ + #!/bin/sh + # SPDX-License-Identifier: GPL-2.0-only + ++KSELFTESTS_SKIP=4 ++ + . ./eeh-functions.sh + + if ! eeh_supported ; then + echo "EEH not supported on this system, skipping" +- exit 0; ++ exit $KSELFTESTS_SKIP; + fi + + if [ ! -e "/sys/kernel/debug/powerpc/eeh_dev_check" ] && \ + [ ! -e "/sys/kernel/debug/powerpc/eeh_dev_break" ] ; then + echo "debugfs EEH testing files are missing. Is debugfs mounted?" +- exit 1; ++ exit $KSELFTESTS_SKIP; + fi + + pre_lspci=`mktemp` +@@ -84,4 +86,5 @@ echo "$failed devices failed to recover ($dev_count tested)" + lspci | diff -u $pre_lspci - + rm -f $pre_lspci + +-exit $failed ++test "$failed" == 0 ++exit $? +-- +2.25.1 + diff --git a/queue-5.8/selftests-remove-fmod_ret-from-test_overhead.patch b/queue-5.8/selftests-remove-fmod_ret-from-test_overhead.patch new file mode 100644 index 00000000000..8e09d0a3385 --- /dev/null +++ b/queue-5.8/selftests-remove-fmod_ret-from-test_overhead.patch @@ -0,0 +1,147 @@ +From 6ef2f57147a5283a078f4f258ea972987a4e2a04 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 23:25:11 +0200 +Subject: selftests: Remove fmod_ret from test_overhead +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Toke Høiland-Jørgensen + +[ Upstream commit b000def2e052fc8ddea31a18019f6ebe044defb3 ] + +The test_overhead prog_test included an fmod_ret program that attached to +__set_task_comm() in the kernel. However, this function was never listed as +allowed for return modification, so this only worked because of the +verifier skipping tests when a trampoline already existed for the attach +point. Now that the verifier checks have been fixed, remove fmod_ret from +the test so it works again. + +Fixes: 4eaf0b5c5e04 ("selftest/bpf: Fmod_ret prog and implement test_overhead as part of bench") +Acked-by: Andrii Nakryiko +Signed-off-by: Toke Høiland-Jørgensen +Signed-off-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/bench.c | 3 --- + .../testing/selftests/bpf/benchs/bench_rename.c | 17 ----------------- + .../selftests/bpf/prog_tests/test_overhead.c | 14 +------------- + .../testing/selftests/bpf/progs/test_overhead.c | 6 ------ + 4 files changed, 1 insertion(+), 39 deletions(-) + +diff --git a/tools/testing/selftests/bpf/bench.c b/tools/testing/selftests/bpf/bench.c +index 944ad4721c83c..da14eaac71d03 100644 +--- a/tools/testing/selftests/bpf/bench.c ++++ b/tools/testing/selftests/bpf/bench.c +@@ -311,7 +311,6 @@ extern const struct bench bench_rename_kretprobe; + extern const struct bench bench_rename_rawtp; + extern const struct bench bench_rename_fentry; + extern const struct bench bench_rename_fexit; +-extern const struct bench bench_rename_fmodret; + extern const struct bench bench_trig_base; + extern const struct bench bench_trig_tp; + extern const struct bench bench_trig_rawtp; +@@ -332,7 +331,6 @@ static const struct bench *benchs[] = { + &bench_rename_rawtp, + &bench_rename_fentry, + &bench_rename_fexit, +- &bench_rename_fmodret, + &bench_trig_base, + &bench_trig_tp, + &bench_trig_rawtp, +@@ -462,4 +460,3 @@ int main(int argc, char **argv) + + return 0; + } +- +diff --git a/tools/testing/selftests/bpf/benchs/bench_rename.c b/tools/testing/selftests/bpf/benchs/bench_rename.c +index e74cff40f4fea..a967674098ada 100644 +--- a/tools/testing/selftests/bpf/benchs/bench_rename.c ++++ b/tools/testing/selftests/bpf/benchs/bench_rename.c +@@ -106,12 +106,6 @@ static void setup_fexit() + attach_bpf(ctx.skel->progs.prog5); + } + +-static void setup_fmodret() +-{ +- setup_ctx(); +- attach_bpf(ctx.skel->progs.prog6); +-} +- + static void *consumer(void *input) + { + return NULL; +@@ -182,14 +176,3 @@ const struct bench bench_rename_fexit = { + .report_progress = hits_drops_report_progress, + .report_final = hits_drops_report_final, + }; +- +-const struct bench bench_rename_fmodret = { +- .name = "rename-fmodret", +- .validate = validate, +- .setup = setup_fmodret, +- .producer_thread = producer, +- .consumer_thread = consumer, +- .measure = measure, +- .report_progress = hits_drops_report_progress, +- .report_final = hits_drops_report_final, +-}; +diff --git a/tools/testing/selftests/bpf/prog_tests/test_overhead.c b/tools/testing/selftests/bpf/prog_tests/test_overhead.c +index 2702df2b23433..9966685866fdf 100644 +--- a/tools/testing/selftests/bpf/prog_tests/test_overhead.c ++++ b/tools/testing/selftests/bpf/prog_tests/test_overhead.c +@@ -61,10 +61,9 @@ void test_test_overhead(void) + const char *raw_tp_name = "raw_tp/task_rename"; + const char *fentry_name = "fentry/__set_task_comm"; + const char *fexit_name = "fexit/__set_task_comm"; +- const char *fmodret_name = "fmod_ret/__set_task_comm"; + const char *kprobe_func = "__set_task_comm"; + struct bpf_program *kprobe_prog, *kretprobe_prog, *raw_tp_prog; +- struct bpf_program *fentry_prog, *fexit_prog, *fmodret_prog; ++ struct bpf_program *fentry_prog, *fexit_prog; + struct bpf_object *obj; + struct bpf_link *link; + int err, duration = 0; +@@ -97,11 +96,6 @@ void test_test_overhead(void) + if (CHECK(!fexit_prog, "find_probe", + "prog '%s' not found\n", fexit_name)) + goto cleanup; +- fmodret_prog = bpf_object__find_program_by_title(obj, fmodret_name); +- if (CHECK(!fmodret_prog, "find_probe", +- "prog '%s' not found\n", fmodret_name)) +- goto cleanup; +- + err = bpf_object__load(obj); + if (CHECK(err, "obj_load", "err %d\n", err)) + goto cleanup; +@@ -148,12 +142,6 @@ void test_test_overhead(void) + test_run("fexit"); + bpf_link__destroy(link); + +- /* attach fmod_ret */ +- link = bpf_program__attach_trace(fmodret_prog); +- if (CHECK(IS_ERR(link), "attach fmod_ret", "err %ld\n", PTR_ERR(link))) +- goto cleanup; +- test_run("fmod_ret"); +- bpf_link__destroy(link); + cleanup: + prctl(PR_SET_NAME, comm, 0L, 0L, 0L); + bpf_object__close(obj); +diff --git a/tools/testing/selftests/bpf/progs/test_overhead.c b/tools/testing/selftests/bpf/progs/test_overhead.c +index 42403d088abc9..abb7344b531f4 100644 +--- a/tools/testing/selftests/bpf/progs/test_overhead.c ++++ b/tools/testing/selftests/bpf/progs/test_overhead.c +@@ -39,10 +39,4 @@ int BPF_PROG(prog5, struct task_struct *tsk, const char *buf, bool exec) + return 0; + } + +-SEC("fmod_ret/__set_task_comm") +-int BPF_PROG(prog6, struct task_struct *tsk, const char *buf, bool exec) +-{ +- return !tsk; +-} +- + char _license[] SEC("license") = "GPL"; +-- +2.25.1 + diff --git a/queue-5.8/selftests-vm-add-fragment-config_gup_benchmark.patch b/queue-5.8/selftests-vm-add-fragment-config_gup_benchmark.patch new file mode 100644 index 00000000000..8f7479cae70 --- /dev/null +++ b/queue-5.8/selftests-vm-add-fragment-config_gup_benchmark.patch @@ -0,0 +1,45 @@ +From c66e833a46323f768f4bce689b0bb7f7598c6e4d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 15:26:18 +0300 +Subject: selftests: vm: add fragment CONFIG_GUP_BENCHMARK + +From: Anatoly Pugachev + +[ Upstream commit cae1d5a2c5a491141faa747e9944ba40ab4ab786 ] + +When running gup_benchmark test the following output states that +the config options is missing. + +$ sudo ./gup_benchmark +open: No such file or directory + +$ sudo strace -e trace=file ./gup_benchmark 2>&1 | tail -3 +openat(AT_FDCWD, "/sys/kernel/debug/gup_benchmark", O_RDWR) = -1 ENOENT +(No such file or directory) +open: No such file or directory ++++ exited with 1 +++ + +Fix it by adding config option fragment. + +Fixes: 64c349f4ae78 ("mm: add infrastructure for get_user_pages_fast() benchmarking") +Signed-off-by: Anatoly Pugachev +CC: Jiri Kosina +CC: Shuah Khan +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/vm/config | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/vm/config b/tools/testing/selftests/vm/config +index 3ba674b64fa9f..69dd0d1aa30b2 100644 +--- a/tools/testing/selftests/vm/config ++++ b/tools/testing/selftests/vm/config +@@ -3,3 +3,4 @@ CONFIG_USERFAULTFD=y + CONFIG_TEST_VMALLOC=m + CONFIG_DEVICE_PRIVATE=y + CONFIG_TEST_HMM=m ++CONFIG_GUP_BENCHMARK=y +-- +2.25.1 + diff --git a/queue-5.8/series b/queue-5.8/series index 14164beb706..2ad473a8faf 100644 --- a/queue-5.8/series +++ b/queue-5.8/series @@ -76,3 +76,551 @@ ima-don-t-ignore-errors-from-crypto_shash_update.patch crypto-algif_aead-do-not-set-may_backlog-on-the-async-path.patch crypto-caam-qi-add-fallback-for-xts-with-more-than-8b-iv.patch crypto-caam-qi-add-support-for-more-xts-key-lengths.patch +ras-cec-fix-cec_init-prototype.patch +sched-fair-fix-wrong-negative-conversion-in-find_ene.patch +microblaze-fix-kbuild-redundant-file-warning.patch +edac-i5100-fix-error-handling-order-in-i5100_init_on.patch +edac-aspeed-fix-handling-of-platform_get_irq-error.patch +edac-ti-fix-handling-of-platform_get_irq-error.patch +perf-x86-intel-ds-fix-x86_pmu_stop-warning-for-large.patch +x86-fpu-allow-multiple-bits-in-clearcpuid-parameter.patch +arm64-kprobe-add-checks-for-armv8.3-pauth-combined-i.patch +drivers-perf-xgene_pmu-fix-uninitialized-resource-st.patch +drivers-perf-thunderx2_pmu-fix-memory-resource-error.patch +sched-fair-fix-wrong-cpu-selecting-from-isolated-dom.patch +sched-fair-use-dst-group-while-checking-imbalance-fo.patch +arm64-perf-add-missing-isb-in-armv8pmu_enable_counte.patch +perf-x86-intel-uncore-update-ice-lake-uncore-units.patch +perf-x86-intel-uncore-reduce-the-number-of-cbox-coun.patch +perf-x86-intel-uncore-fix-the-scale-of-the-imc-free-.patch +x86-nmi-fix-nmi_handle-duration-miscalculation.patch +x86-events-amd-iommu-fix-sizeof-mismatch.patch +pinctrl-qcom-set-irqchip_set_type_masked-and-irqchip.patch +pinctrl-qcom-use-return-value-from-irq_set_wake-call.patch +perf-x86-fix-n_pair-for-cancelled-txn.patch +perf-core-fix-race-in-the-perf_mmap_close-function.patch +crypto-algif_skcipher-ebusy-on-aio-should-be-an-erro.patch +crypto-mediatek-fix-wrong-return-value-in-mtk_desc_r.patch +crypto-ixp4xx-fix-the-size-used-in-a-dma_free_cohere.patch +crypto-picoxcell-fix-potential-race-condition-bug.patch +media-vivid-fix-global-out-of-bounds-read-in-precalc.patch +media-tuner-simple-fix-regression-in-simple_set_radi.patch +crypto-ccree-fix-runtime-pm-imbalance-on-error.patch +media-revert-media-exynos4-is-add-missed-check-for-p.patch +media-hantro-h264-get-the-correct-fallback-reference.patch +media-hantro-postproc-fix-motion-vector-space-alloca.patch +media-ov5640-correct-bit-div-register-in-clock-tree-.patch +media-m5mols-check-function-pointer-in-m5mols_sensor.patch +fscrypt-restrict-iv_ino_lblk_32-to-ino_bits-32.patch +media-uvcvideo-set-media-controller-entity-functions.patch +media-uvcvideo-silence-shift-out-of-bounds-warning.patch +media-staging-intel-ipu3-css-correctly-reset-some-me.patch +media-omap3isp-fix-memleak-in-isp_probe.patch +media-i2c-ov5640-remain-in-power-down-for-dvp-mode-u.patch +media-i2c-ov5640-separate-out-mipi-configuration-fro.patch +media-i2c-ov5640-enable-data-pins-on-poweron-for-dvp.patch +media-rcar_drif-fix-fwnode-reference-leak-when-parsi.patch +media-rcar_drif-allocate-v4l2_async_subdev-dynamical.patch +media-rcar-csi2-allocate-v4l2_async_subdev-dynamical.patch +spi-fsi-handle-9-to-15-byte-transfers-lengths.patch +spi-fsi-fix-use-of-the-bneq-sequencer-instruction.patch +spi-fsi-implement-restricted-size-for-certain-contro.patch +spi-dw-pci-free-previously-allocated-irqs-if-desc-se.patch +crypto-omap-sham-fix-digcnt-register-handling-with-e.patch +hwmon-pmbus-max34440-fix-status-register-reads-for-m.patch +hwmon-w83627ehf-fix-a-resource-leak-in-probe.patch +cypto-mediatek-fix-leaks-in-mtk_desc_ring_alloc.patch +crypto-stm32-crc32-avoid-lock-if-hardware-is-already.patch +crypto-sun8i-ce-handle-endianness-of-t_common_ctl.patch +media-mx2_emmaprp-fix-memleak-in-emmaprp_probe.patch +media-tc358743-initialize-variable.patch +media-tc358743-cleanup-tc358743_cec_isr.patch +media-rcar-vin-fix-a-reference-count-leak.patch +media-rockchip-rga-fix-a-reference-count-leak.patch +media-platform-fcp-fix-a-reference-count-leak.patch +media-camss-fix-a-reference-count-leak.patch +media-s5p-mfc-fix-a-reference-count-leak.patch +media-stm32-dcmi-fix-a-reference-count-leak.patch +media-ti-vpe-fix-a-missing-check-and-reference-count.patch +regulator-resolve-supply-after-creating-regulator.patch +pinctrl-bcm-fix-kconfig-dependency-warning-when-gpio.patch +spi-spi-s3c64xx-swap-s3c64xx_spi_set_cs-and-s3c64xx_.patch +spi-spi-s3c64xx-check-return-values.patch +hwmon-bt1-pvt-test-sensor-power-supply-on-probe.patch +hwmon-bt1-pvt-cache-current-update-timeout.patch +hwmon-bt1-pvt-wait-for-the-completion-with-timeout.patch +btrfs-add-owner-and-fs_info-to-alloc_state-io_tree.patch +blk-mq-move-cancel-of-hctx-run_work-to-the-front-of-.patch +ath10k-provide-survey-info-as-accumulated-data.patch +drm-vkms-fix-xrgb-on-compute-crc.patch +bluetooth-hci_uart-cancel-init-work-before-unregiste.patch +drm-amd-display-fix-wrong-return-value-in-dm_update_.patch +drm-vgem-add-missing-platform_device_unregister-in-v.patch +drm-vkms-add-missing-platform_device_unregister-in-v.patch +drm-panel-fix-bus-format-for-ortustech-com43h4m85ulc.patch +ath6kl-prevent-potential-array-overflow-in-ath6kl_ad.patch +ath9k-fix-potential-out-of-bounds-in-ath9k_htc_txcom.patch +ath10k-fix-the-size-used-in-a-dma_free_coherent-call.patch +wcn36xx-fix-reported-802.11n-rx_highest-rate-wcn3660.patch +asoc-qcom-lpass-platform-fix-memory-leak.patch +asoc-qcom-lpass-cpu-fix-concurrency-issue.patch +ath11k-fix-possible-memleak-in-ath11k_qmi_init_servi.patch +brcmfmac-check-ndev-pointer.patch +mwifiex-do-not-use-gfp_kernel-in-atomic-context.patch +staging-rtl8192u-do-not-use-gfp_kernel-in-atomic-con.patch +drm-amd-display-fix-potential-integer-overflow-when-.patch +selftests-bpf-fix-test_vmlinux-test-to-use-bpf_probe.patch +drm-gma500-fix-error-check.patch +scsi-qla4xxx-fix-an-error-handling-path-in-qla4xxx_g.patch +scsi-qla2xxx-fix-the-size-used-in-a-dma_free_coheren.patch +scsi-qla2xxx-fix-wrong-return-value-in-qlt_chk_unres.patch +scsi-qla2xxx-fix-wrong-return-value-in-qla_nvme_regi.patch +scsi-csiostor-fix-wrong-return-value-in-csio_hw_prep.patch +libbpf-fix-unintentional-success-return-code-in-bpf_.patch +wilc1000-fix-memleak-in-wilc_sdio_probe.patch +wilc1000-fix-memleak-in-wilc_bus_probe.patch +rtw88-don-t-treat-null-pointer-as-an-array.patch +drm-radeon-prefer-lower-feedback-dividers.patch +backlight-sky81452-backlight-fix-refcount-imbalance-.patch +staging-emxx_udc-fix-passing-of-null-to-dma_alloc_co.patch +vmci-check-return-value-of-get_user_pages_fast-for-e.patch +mm-error_inject-fix-allow_error_inject-function-sign.patch +drm-panel-fix-bpc-for-ortustech-com43h4m85ulc-panel.patch +samples-bpf-fix-to-xdpsock-to-avoid-recycling-frames.patch +drm-crc-debugfs-fix-memleak-in-crc_control_write.patch +bluetooth-clear-suspend-tasks-on-unregister.patch +selftests-vm-add-fragment-config_gup_benchmark.patch +scsi-ufs-make-ufshcd_print_trs-consider-ufshcd_quirk.patch +binder-remove-bogus-warning-on-failed-same-process-t.patch +tty-serial-earlycon-dependency.patch +tty-hvcs-don-t-null-tty-driver_data-until-hvcs_clean.patch +pty-do-tty_flip_buffer_push-without-port-lock-in-pty.patch +pwm-lpss-fix-off-by-one-error-in-base_unit-math-in-p.patch +pwm-lpss-add-range-limit-check-for-the-base_unit-reg.patch +drivers-virt-fsl_hypervisor-fix-error-handling-path.patch +ath11k-fix-a-double-free-and-a-memory-leak.patch +video-fbdev-vga16fb-fix-setting-of-pixclock-because-.patch +video-fbdev-sis-fix-null-ptr-dereference.patch +video-fbdev-radeon-fix-memleak-in-radeonfb_pci_regis.patch +asoc-fsl-imx-es8328-add-missing-put_device-call-in-i.patch +scsi-ufs-ufs-mediatek-fix-host_pa_tactivate-quirk.patch +hid-roccat-add-bounds-checking-in-kone_sysfs_write_s.patch +drm-msm-avoid-div-by-zero-in-dpu_crtc_atomic_check.patch +drm-panfrost-ensure-gpu-quirks-are-always-initialise.patch +iomap-clear-page-error-before-beginning-a-write.patch +iomap-mark-read-blocks-uptodate-in-write_begin.patch +selftests-lkdtm-use-comm-instead-of-diff-for-dmesg.patch +bluetooth-re-order-clearing-suspend-tasks.patch +pinctrl-mcp23s08-fix-mcp23x17_regmap-initialiser.patch +pinctrl-mcp23s08-fix-mcp23x17-precious-range.patch +pinctrl-devicetree-keep-deferring-even-on-timeout.patch +drm-msm-adreno-fix-probe-without-iommu.patch +net-mlx5-fix-uninitialized-variable-warning.patch +net-mlx5-don-t-call-timecounter-cyc2time-directly-fr.patch +scsi-mpt3sas-fix-sync-irqs.patch +net-stmmac-fix-incorrect-location-to-set-real_num_rx.patch +net-stmmac-use-netif_tx_start-stop_all_queues-functi.patch +xfs-force-the-log-after-remapping-a-synchronous-writ.patch +cpufreq-armada-37xx-add-missing-module_device_table.patch +drm-mxsfb-check-framebuffer-pitch.patch +ima-fix-null-pointer-dereference-in-ima_file_hash.patch +asoc-topology-disable-size-checks-for-bytes_ext-cont.patch +asoc-tlv320adcx140-fix-digital-gain-range.patch +coresight-etm4x-fix-etm4_count-race-by-moving-cpuhp-.patch +coresight-fix-offset-by-one-error-in-counting-ports.patch +coresight-cti-disclaim-device-only-when-it-s-claimed.patch +coresight-cti-remove-pm_runtime_get_sync-from-cpu-ho.patch +coresight-etm4x-ensure-default-perf-settings-filter-.patch +coresight-etm4x-fix-issues-within-reset-interface-of.patch +coresight-cti-write-regsiters-directly-in-cti_enable.patch +coresight-etm4x-handle-unreachable-sink-in-perf-mode.patch +coresight-etm4x-fix-issues-on-trcseqevr-access.patch +nvmem-core-fix-missing-of_node_put-in-of_nvmem_devic.patch +selftests-mptcp-interpret-n-as-a-new-line.patch +selftests-bpf-fix-endianness-issue-in-sk_assign.patch +selftests-bpf-fix-endianness-issue-in-test_sockopt_s.patch +xhci-don-t-create-endpoint-debugfs-entry-before-ring.patch +net-dsa-rtl8366-check-validity-of-passed-vlans.patch +net-dsa-rtl8366-refactor-vlan-pvid-init.patch +net-dsa-rtl8366-skip-pvid-setting-if-not-requested.patch +net-wilc1000-clean-up-resource-in-error-path-of-init.patch +asoc-tas2770-fix-calling-reset-in-probe.patch +asoc-tas2770-add-missing-bias-level-power-states.patch +asoc-tas2770-fix-required-dt-properties-in-the-code.patch +asoc-tas2770-fix-error-handling-with-update_bits.patch +asoc-tlv320aic32x4-fix-bdiv-clock-rate-derivation.patch +net-dsa-rtl8366rb-support-all-4096-vlans.patch +asoc-sof-control-add-size-checks-for-ext_bytes-contr.patch +asoc-tas2770-fix-unbalanced-calls-to-pm_runtime.patch +spi-omap2-mcspi-improve-performance-waiting-for-chst.patch +ath11k-add-checked-value-for-ath11k_ahb_remove.patch +ath6kl-wmi-prevent-a-shift-wrapping-bug-in-ath6kl_wm.patch +drm-rcar-du-put-reference-to-vsp-device.patch +phy-rockchip-dphy-rx0-include-linux-delay.h.patch +dmaengine-dmatest-check-list-for-emptiness-before-ac.patch +asoc-cros_ec_codec-fix-kconfig-dependency-warning-fo.patch +misc-mic-scif-fix-error-handling-path.patch +alsa-seq-oss-avoid-mutex-lock-for-a-long-time-ioctl.patch +usb-dwc2-fix-parameter-type-in-function-pointer-prot.patch +usb-dwc3-core-properly-default-unspecified-speed.patch +usb-dwc2-add-missing-cleanups-when-usb_add_gadget_ud.patch +rtw88-fix-probe-error-handling-race-with-firmware-lo.patch +rtw88-fix-potential-probe-error-handling-race-with-w.patch +mt76-mt7915-fix-possible-memory-leak-in-mt7915_mcu_a.patch +quota-clear-padding-in-v2r1_mem2diskdqb.patch +slimbus-core-check-get_addr-before-removing-laddr-id.patch +slimbus-core-do-not-enter-to-clock-pause-mode-in-cor.patch +slimbus-qcom-ngd-ctrl-disable-ngd-in-qmi-server-down.patch +asoc-fsl_sai-instantiate-snd_soc_dai_driver.patch +hid-hid-input-fix-stylus-battery-reporting.patch +tty-hvc-fix-link-error-with-config_serial_core_conso.patch +nvmem-core-fix-possibly-memleak-when-use-nvmem_cell_.patch +hv-clocksource-add-notrace-attribute-to-read_hv_sche.patch +nl80211-fix-obss-pd-min-and-max-offset-validation.patch +iomap-use-kzalloc-to-allocate-iomap_page.patch +coresight-etm-perf-fix-warning-caused-by-etm_setup_a.patch +coresight-cti-fix-remove-sysfs-link-error.patch +coresight-cti-fix-bug-clearing-sysfs-links-on-callba.patch +coresight-etm4x-fix-save-and-restore-of-trcvmidcctlr.patch +ibmvnic-set-up-200gbps-speed.patch +bpf-disallow-attaching-modify_return-tracing-functio.patch +selftests-remove-fmod_ret-from-test_overhead.patch +qtnfmac-fix-resource-leaks-on-unsupported-iftype-err.patch +pinctrl-aspeed-use-the-right-pinconf-mask.patch +iommu-qcom-add-missing-put_device-call-in-qcom_iommu.patch +iio-adc-stm32-adc-fix-runtime-autosuspend-delay-when.patch +net-enic-cure-the-enic-api-locking-trainwreck.patch +mfd-sm501-fix-leaks-in-probe.patch +asoc-wm_adsp-pass-full-name-to-snd_ctl_notify.patch +iwlwifi-mvm-split-a-print-to-avoid-a-warning-in-roc.patch +iwlwifi-dbg-remove-no-filter-condition.patch +iwlwifi-dbg-run-init_cfg-function-once-per-driver-lo.patch +usb-gadget-f_ncm-fix-ncm_bitrate-for-superspeed-and-.patch +usb-gadget-u_serial-clear-suspended-flag-when-discon.patch +usb-gadget-u_ether-enable-qmult-on-superspeed-plus-a.patch +bus-mhi-core-fix-the-building-of-mhi-module.patch +ocxl-fix-kconfig-dependency-warning-for-ocxl.patch +nl80211-fix-non-split-wiphy-information.patch +usb-dwc2-fix-intr-out-transfers-in-ddma-mode.patch +scsi-target-tcmu-fix-warning-page-may-be-used-uninit.patch +scsi-be2iscsi-fix-a-theoretical-leak-in-beiscsi_crea.patch +dmaengine-ioat-allocate-correct-size-for-descriptor-.patch +ipmi_si-fix-wrong-return-value-in-try_smi_init.patch +tracing-fix-parse_synth_field-error-handling.patch +platform-x86-mlx-platform-remove-psu-eeprom-configur.patch +mwifiex-fix-double-free.patch +net-fec-fix-phy-init-after-phy_reset_after_clk_enabl.patch +drm-panfrost-increase-readl_relaxed_poll_timeout-val.patch +ipvs-clear-skb-tstamp-in-forwarding-path.patch +bpf-sockmap-remove-skb_orphan-and-let-normal-skb_kfr.patch +net-korina-fix-kfree-of-rx-tx-descriptor-array.patch +netfilter-nf_log-missing-vlan-offload-tag-and-proto.patch +mm-swapfile.c-fix-potential-memory-leak-in-sys_swapo.patch +mm-memcg-fix-device-private-memcg-accounting.patch +mm-oom_adj-don-t-loop-through-tasks-in-__set_oom_adj.patch +fs-fix-null-dereference-due-to-data-race-in-prepend_.patch +selftests-ftrace-change-synthetic-event-name-for-int.patch +tracing-handle-synthetic-event-array-field-type-chec.patch +i3c-master-add-i3c_master_attach_boardinfo-to-preser.patch +ib-mlx4-fix-starvation-in-paravirt-mux-demux.patch +ib-mlx4-adjust-delayed-work-when-a-dup-is-observed.patch +powerpc-pseries-fix-missing-of_node_put-in-rng_init.patch +powerpc-icp-hv-fix-missing-of_node_put-in-success-pa.patch +rcu-tree-force-quiescent-state-on-callback-overload.patch +rcutorture-properly-set-rcu_fwds-for-oom-handling.patch +rdma-ucma-fix-locking-for-ctx-events_reported.patch +rdma-ucma-add-missing-locking-around-rdma_leave_mult.patch +mtd-lpddr-fix-excessive-stack-usage-with-clang.patch +rdma-hns-add-a-check-for-current-state-before-modify.patch +rdma-umem-fix-signature-of-stub-ib_umem_find_best_pg.patch +powerpc-pseries-explicitly-reschedule-during-drmem_l.patch +pseries-drmem-don-t-cache-node-id-in-drmem_lmb-struc.patch +rdma-mlx5-fix-potential-race-between-destroy-and-cqe.patch +mtd-mtdoops-don-t-write-panic-data-twice.patch +perf-tools-make-gtk2-support-opt-in.patch +tools-feature-add-missing-lzstd-to-the-fast-path-fea.patch +arm-9007-1-l2c-fix-prefetch-bits-init-in-l2x0_aux_ct.patch +xfs-fix-finobt-btree-block-recovery-ordering.patch +m68knommu-include-sdhc-support-only-when-hardware-ha.patch +arc-plat-hsdk-fix-kconfig-dependency-warning-when-re.patch +ida-free-allocated-bitmap-in-error-path.patch +xfs-limit-entries-returned-when-counting-fsmap-recor.patch +xfs-fix-deadlock-and-streamline-xfs_getfsmap-perform.patch +nfs-add-missing-posix-local_lock-constant-table-defi.patch +xfs-fix-high-key-handling-in-the-rt-allocator-s-quer.patch +rdma-rtrs-srv-incorporate-ib_register_client-into-rt.patch +rdma-core-delete-function-indirection-for-alloc-free.patch +rdma-allow-fail-of-destroy-cq.patch +rdma-umem-fix-ib_umem_find_best_pgsz-for-mappings-th.patch +rdma-umem-prevent-small-pages-from-being-returned-by.patch +rdma-qedr-fix-qp-structure-memory-leak.patch +rdma-qedr-fix-doorbell-setting.patch +rdma-qedr-fix-use-of-uninitialized-field.patch +rdma-qedr-fix-return-code-if-accept-is-called-on-a-d.patch +rdma-qedr-fix-inline-size-returned-for-iwarp.patch +powerpc-pseries-svm-allocate-swiotlb-buffer-anywhere.patch +powerpc-watchpoint-fix-quadword-instruction-handling.patch +powerpc-watchpoint-fix-handling-of-vector-instructio.patch +powerpc-watchpoint-add-hw_len-wherever-missing.patch +powerpc-book3s64-hash-4k-support-large-linear-mappin.patch +powerpc-tau-use-appropriate-temperature-sample-inter.patch +powerpc-tau-convert-from-timer-to-workqueue.patch +powerpc-tau-remove-duplicated-set_thresholds-call.patch +powerpc-tau-check-processor-type-before-enabling-tau.patch +powerpc-tau-disable-tau-between-measurements.patch +powerpc-kasan-fix-config_kasan_vmalloc-for-8xx.patch +powerpc-64s-radix-fix-mm_cpumask-trimming-race-vs-kt.patch +rdma-cma-combine-cma_ndev_work-with-cma_work.patch +rdma-cma-remove-dead-code-for-kernel-rdmacm-multicas.patch +rdma-cma-consolidate-the-destruction-of-a-cma_multic.patch +rdma-cma-fix-use-after-free-race-in-roce-multicast-j.patch +perf-intel-pt-fix-context_switch-event-has-no-tid-er.patch +rdma-qedr-fix-resource-leak-in-qedr_create_qp.patch +rdma-hns-set-the-unsupported-wr-opcode.patch +rdma-mlx5-use-set_mkc_access_pd_addr_fields-in-reg_c.patch +rdma-mlx5-make-mkeys-always-owned-by-the-kernel-s-pd.patch +rdma-mlx5-disable-ib_device_mem_mgt_extensions-if-ib.patch +i40iw-add-support-to-make-destroy-qp-synchronous.patch +perf-stat-skip-duration_time-in-setup_system_wide.patch +rdma-hns-add-check-for-the-validity-of-sl-configurat.patch +rdma-hns-solve-the-overflow-of-the-calc_pg_sz.patch +rdma-hns-fix-the-wrong-value-of-rnr_retry-when-query.patch +rdma-hns-fix-configuration-of-ack_req_freq-in-qpc.patch +rdma-hns-fix-missing-sq_sig_type-when-querying-qp.patch +mtd-hyperbus-hbmc-am654-fix-direct-mapping-setup-fla.patch +mtd-rawnand-stm32_fmc2-fix-a-buffer-overflow.patch +mtd-rawnand-vf610-disable-clk-on-error-handling-path.patch +mtd-spinand-gigadevice-only-one-dummy-byte-in-quadio.patch +mtd-spinand-gigadevice-add-qe-bit.patch +mtd-rawnand-ams-delta-fix-non-of-build-warning.patch +kdb-fix-pager-search-for-multi-line-strings.patch +overflow-include-header-file-with-size_max-declarati.patch +rdma-ipoib-set-rtnl_link_ops-for-ipoib-interfaces.patch +powerpc-64-fix-irq-replay-missing-preempt.patch +powerpc-64-fix-irq-replay-pt_regs-softe-value.patch +powerpc-perf-exclude-pmc5-6-from-the-irrelevant-pmu-.patch +powerpc-perf-hv-gpci-fix-starting-index-value.patch +perf-stat-fix-out-of-bounds-cpu-map-access-when-hand.patch +i3c-master-fix-error-return-in-cdns_i3c_master_probe.patch +powerpc-papr_scm-add-papr-command-family-to-pass-thr.patch +cpufreq-powernv-fix-frame-size-overflow-in-powernv_c.patch +ib-rdmavt-fix-sizeof-mismatch.patch +rdma-rxe-fix-skb-lifetime-in-rxe_rcv_mcast_pkt.patch +f2fs-reject-casefold-inode-flag-without-casefold-fea.patch +um-vector-use-gfp_atomic-under-spin-lock.patch +um-time-travel-fix-irq-handling-in-time_travel_handl.patch +maiblox-mediatek-fix-handling-of-platform_get_irq-er.patch +perf-trace-fix-off-by-ones-in-memset-after-realloc-i.patch +selftests-powerpc-fix-eeh-basic.sh-exit-codes.patch +f2fs-wait-for-sysfs-kobject-removal-before-freeing-f.patch +afs-fix-rapid-cell-addition-removal-by-not-using-rcu.patch +afs-fix-cell-refcounting-by-splitting-the-usage-coun.patch +afs-fix-cell-purging-with-aliases.patch +afs-fix-cell-removal.patch +rdma-rxe-handle-skb_clone-failure-in-rxe_recv.c.patch +mm-page_owner-change-split_page_owner-to-take-a-coun.patch +mm-mmu_notifier-fix-mmget-assert-in-__mmu_interval_n.patch +lib-crc32.c-fix-trivial-typo-in-preprocessor-conditi.patch +ramfs-fix-nommu-mmap-with-gaps-in-the-page-cache.patch +rapidio-fix-error-handling-path.patch +rapidio-fix-the-missed-put_device-for-rio_mport_add_.patch +mailbox-avoid-timer-start-from-callback.patch +clk-meson-axg-audio-separate-axg-and-g12a-regmap-tab.patch +rtc-ds1307-clear-osf-flag-on-ds1388-when-setting-tim.patch +i2c-rcar-auto-select-reset_controller.patch +clk-meson-g12a-mark-fclk_div2-as-critical.patch +pci-designware-ep-fix-the-header-type-check.patch +pci-aardvark-fix-compilation-on-s390.patch +pci-aardvark-check-for-errors-from-pci_bridge_emul_i.patch +pci-iproc-set-affinity-mask-on-msi-interrupts.patch +rpmsg-smd-fix-a-kobj-leak-in-in-qcom_smd_parse_edge.patch +rpmsg-avoid-double-free-in-mtk_rpmsg_register_device.patch +pci-iov-mark-vfs-as-not-implementing-pci_command_mem.patch +vfio-add-a-singleton-check-for-vfio_group_pin_pages.patch +s390-pci-mark-all-vfs-as-not-implementing-pci_comman.patch +vfio-pci-decouple-pci_command_memory-bit-checks-from.patch +vfio-fix-a-missed-vfio-group-put-in-vfio_pin_pages.patch +vfio-type1-fix-dirty-bitmap-calculation-in-vfio_dma_.patch +clk-qcom-gcc-sdm660-fix-wrong-parent_map.patch +clk-keystone-sci-clk-fix-parsing-assigned-clock-data.patch +pwm-rockchip-keep-enabled-pwms-running-while-probing.patch +pwm-img-fix-null-pointer-access-in-probe.patch +remoteproc-mediatek-fix-null-pointer-dereference-on-.patch +pci-hv-fix-hibernation-in-case-interrupts-are-not-re.patch +clk-rockchip-initialize-hw-to-error-to-avoid-undefin.patch +clk-mediatek-add-uart0-clock-support.patch +module-statically-initialize-init-section-freeing-da.patch +clk-at91-clk-main-update-key-before-writing-at91_ckg.patch +clk-bcm2835-add-missing-release-if-devm_clk_hw_regis.patch +kbuild-deb-pkg-do-not-build-linux-headers-package-if.patch +watchdog-fix-memleak-in-watchdog_cdev_register.patch +watchdog-use-put_device-on-error.patch +watchdog-sp5100-fix-definition-of-efch_pm_decodeen3.patch +svcrdma-fix-bounce-buffers-for-unaligned-offsets-and.patch +ext4-fix-dead-loop-in-ext4_mb_new_blocks.patch +ext4-discard-preallocations-before-releasing-group-l.patch +ext4-disallow-modifying-dax-inode-flag-if-inline_dat.patch +ext4-limit-entries-returned-when-counting-fsmap-reco.patch +vfio-pci-clear-token-on-bypass-registration-failure.patch +vfio-iommu-type1-fix-memory-leak-in-vfio_iommu_type1.patch +clk-imx8mq-fix-usdhc-parents-order.patch +sunrpc-fix-copying-of-multiple-pages-in-gss_read_pro.patch +platform-chrome-cros_ec_lightbar-reduce-ligthbar-get.patch +input-elants_i2c-fix-typo-for-an-attribute-to-show-c.patch +input-imx6ul_tsc-clean-up-some-errors-in-imx6ul_tsc_.patch +input-stmfts-fix-a-vs-typo.patch +input-ep93xx_keypad-fix-handling-of-platform_get_irq.patch +input-omap4-keypad-fix-handling-of-platform_get_irq-.patch +input-twl4030_keypad-fix-handling-of-platform_get_ir.patch +input-sun4i-ps2-fix-handling-of-platform_get_irq-err.patch +kvm-x86-emulating-rdpid-failure-shall-return-ud-rath.patch +scsi-bfa-fix-error-return-in-bfad_pci_init.patch +arm64-mm-use-single-quantity-to-represent-the-pa-to-.patch +netfilter-conntrack-connection-timeout-after-re-regi.patch +netfilter-ebtables-fixes-dropping-of-small-packets-i.patch +netsec-ignore-phy-mode-device-property-on-acpi-syste.patch +netfilter-nf_fwd_netdev-clear-timestamp-in-forwardin.patch +soc-xilinx-fix-error-code-in-zynqmp_pm_probe.patch +arm64-dts-meson-vim3-correct-led-polarity.patch +arm-dts-imx6sl-fix-rng-node.patch +arm-at91-pm-of_node_put-after-its-usage.patch +arm-s3c24xx-fix-mmc-gpio-lookup-tables.patch +arm-dts-sun8i-r40-bananapi-m2-ultra-fix-dcdc1-regula.patch +arm64-dts-allwinner-h5-remove-mali-gpu-pmu-module.patch +memory-omap-gpmc-fix-a-couple-off-by-ones.patch +memory-omap-gpmc-fix-build-error-without-config_of.patch +arm64-dts-qcom-sc7180-fix-the-llcc-base-register-siz.patch +memory-fsl-corenet-cf-fix-handling-of-platform_get_i.patch +firmware-arm_scmi-fix-null-pointer-dereference-in-ma.patch +arm64-dts-imx8mq-add-missing-interrupts-to-gpc.patch +arm64-dts-qcom-sc7180-drop-flags-on-mdss-irqs.patch +soc-qcom-pdr-fixup-array-type-of-get_domain_list_res.patch +arm64-dts-qcom-msm8916-remove-one-more-thermal-trip-.patch +arm64-dts-qcom-pm8916-remove-invalid-reg-size-from-w.patch +arm64-dts-qcom-msm8916-fix-mdp-dsi-interrupts.patch +soc-qcom-apr-fixup-the-error-displayed-on-lookup-fai.patch +dt-bindings-crypto-specify-that-allwinner-sun8i-a33-.patch +arm64-dts-renesas-r8a77990-fix-msiof1-dma-channels.patch +arm64-dts-renesas-r8a774c0-fix-msiof1-dma-channels.patch +arm64-dts-mt8173-elm-fix-nor_flash-node-property.patch +arm64-dts-actions-limit-address-range-for-pinctrl-no.patch +arm-dts-owl-s500-fix-incorrect-ppi-interrupt-specifi.patch +soc-fsl-qbman-fix-return-value-on-success.patch +arm-omap2-restore-mpu-power-domain-if-cpu_cluster_pm.patch +arm-dts-stm32-fix-sdmmc2-pins-on-av96.patch +arm-dts-stm32-lxa-mc1-fix-kernel-warning-about-phy-d.patch +arm-dts-stm32-move-ethernet-phy-into-dh-som-dt.patch +arm-dts-stm32-swap-phy-reset-gpio-and-tsc2004-irq-on.patch +arm-dts-stm32-fix-dh-pdk2-display-pwm-channel.patch +arm-dts-iwg20d-q7-common-fix-touch-controller-probe-.patch +soc-mediatek-cmdq-add-clear-option-in-cmdq_pkt_wfe-a.patch +drm-mediatek-reduce-clear-event.patch +arm64-dts-zynqmp-remove-additional-compatible-string.patch +arm-dts-meson8-remove-two-invalid-interrupt-lines-fr.patch +lightnvm-fix-out-of-bounds-write-to-array-devices-in.patch +powerpc-powernv-dump-fix-race-while-processing-opal-.patch +powerpc-pseries-avoid-using-addr_to_pfn-in-real-mode.patch +nvmet-fix-uninitialized-work-for-zero-kato.patch +kvm-ioapic-break-infinite-recursion-on-lazy-eoi.patch +ntb-hw-amd-fix-an-issue-about-leak-system-resources.patch +ntb-intel-fix-memleak-in-intel_ntb_pci_probe.patch +sched-features-fix-config_jump_label-case.patch +perf-correct-snoopx-field-offset.patch +i2c-core-restore-acpi_walk_dep_device_list-getting-c.patch +md-bitmap-fix-memory-leak-of-temporary-bitmap.patch +block-ratelimit-handle_bad_sector-message.patch +x86-dumpstack-fix-misleading-instruction-pointer-err.patch +crypto-ccp-fix-error-handling.patch +x86-asm-replace-__force_order-with-a-memory-clobber.patch +x86-mce-add-skylake-quirk-for-patrol-scrub-reported-.patch +media-firewire-fix-memory-leak.patch +media-ati_remote-sanity-check-for-both-endpoints.patch +media-st-delta-fix-reference-count-leak-in-delta_run.patch +media-sti-fix-reference-count-leaks.patch +media-exynos4-is-fix-several-reference-count-leaks-d.patch +media-exynos4-is-fix-a-reference-count-leak-due-to-p.patch +media-exynos4-is-fix-a-reference-count-leak.patch +media-vsp1-fix-runtime-pm-imbalance-on-error.patch +media-platform-s3c-camif-fix-runtime-pm-imbalance-on.patch +media-platform-sti-hva-fix-runtime-pm-imbalance-on-e.patch +media-bdisp-fix-runtime-pm-imbalance-on-error.patch +media-media-pci-prevent-memory-leak-in-bttv_probe.patch +x86-mce-annotate-mce_rd-wrmsrl-with-noinstr.patch +crypto-hisilicon-fixed-memory-allocation-error.patch +spi-fsi-fix-clock-running-too-fast.patch +x86-mce-make-mce_rdmsrl-panic-on-an-inaccessible-msr.patch +media-uvcvideo-ensure-all-probed-info-is-returned-to.patch +mmc-sdio-check-for-cistpl_vers_1-buffer-size.patch +media-saa7134-avoid-a-shift-overflow.patch +media-atomisp-fix-memleak-in-ia_css_stream_create.patch +media-venus-fixes-for-list-corruption.patch +fs-dlm-fix-configfs-memory-leak.patch +media-venus-core-fix-error-handling-in-probe.patch +media-venus-core-fix-runtime-pm-imbalance-in-venus_p.patch +ntfs-add-check-for-mft-record-size-in-superblock.patch +ip_gre-set-dev-hard_header_len-and-dev-needed_headro.patch +mac80211-handle-lack-of-sband-bitrates-in-rates.patch +staging-wfx-fix-handling-of-mmic-error.patch +libbpf-close-map-fd-if-init-map-slots-failed.patch +bpf-use-raw_spin_trylock-for-pcpu_freelist_push-pop-.patch +pm-hibernate-remove-the-bogus-call-to-get_gendisk-in.patch +scsi-mvumi-fix-error-return-in-mvumi_io_attach.patch +scsi-target-core-add-control-field-for-trace-events.patch +mic-vop-copy-data-to-kernel-space-then-write-to-io-m.patch +misc-vop-add-round_up-x-4-for-vring_size-to-avoid-ke.patch +usb-dwc3-add-splitdisable-quirk-for-hisilicon-kirin-.patch +usb-gadget-function-printer-fix-use-after-free-in-__.patch +rtw88-pci-power-cycle-device-during-shutdown.patch +udf-limit-sparing-table-size.patch +udf-avoid-accessing-uninitialized-data-on-failed-ino.patch +rtw88-increse-the-size-of-rx-buffer-size.patch +selftests-bpf-fix-overflow-tests-to-reflect-iter-siz.patch +usb-cdc-acm-handle-broken-union-descriptors.patch +usb-dwc3-simple-add-support-for-hikey-970.patch +habanalabs-cast-to-u64-before-shift-31-bits.patch +can-flexcan-flexcan_chip_stop-add-error-handling-and.patch +hid-multitouch-lenovo-x1-tablet-gen3-trackpoint-and-.patch +ath9k-hif_usb-fix-race-condition-between-usb_get_urb.patch +drm-panfrost-add-amlogic-gpu-integration-quirks.patch +drm-panfrost-add-amlogic-reset-quirk-callback.patch +drm-panfrost-add-support-for-vendor-quirk.patch +bpf-limit-caller-s-stack-depth-256-for-subprogs-with.patch +misc-rtsx-fix-memory-leak-in-rtsx_pci_probe.patch +reiserfs-only-call-unlock_new_inode-if-i_new.patch +opp-prevent-memory-leak-in-dev_pm_opp_attach_genpd.patch +xfs-make-sure-the-rt-allocator-doesn-t-run-off-the-e.patch +usb-ohci-default-to-per-port-over-current-protection.patch +drm-fix-double-free-for-gbo-in-drm_gem_vram_init-and.patch +bluetooth-only-mark-socket-zapped-after-unlocking.patch +drm-msm-a6xx-fix-a-potential-overflow-issue.patch +iomap-fix-warn_on_once-from-unprivileged-users.patch +scsi-ibmvfc-fix-error-return-in-ibmvfc_probe.patch +scsi-qla2xxx-warn-if-done-or-free-are-called-on-an-a.patch +selftests-bpf-fix-test_sysctl_loop-1-2-failure-due-t.patch +brcmsmac-fix-memory-leak-in-wlc_phy_attach_lcnphy.patch +rtl8xxxu-prevent-potential-memory-leak.patch +fix-use-after-free-in-get_capset_info-callback.patch +hid-ite-add-usb-id-match-for-acer-one-s1003-keyboard.patch +scsi-qedf-return-success-if-stale-rport-is-encounter.patch +scsi-qedi-mark-all-connections-for-recovery-on-link-.patch +scsi-qedi-protect-active-command-list-to-avoid-list-.patch +scsi-qedi-fix-list_del-corruption-while-removing-act.patch +fbmem-add-margin-check-to-fb_check_caps.patch +tty-ipwireless-fix-error-handling.patch +bluetooth-btusb-fix-memleak-in-btusb_mtk_submit_wmt_.patch +ipvs-fix-uninit-value-in-do_ip_vs_set_ctl.patch +reiserfs-fix-memory-leak-in-reiserfs_parse_options.patch +s390-qeth-strictly-order-bridge-address-events.patch +mwifiex-don-t-call-del_timer_sync-on-uninitialized-t.patch +alsa-hda-ca0132-add-ae-7-microphone-selection-comman.patch +alsa-hda-ca0132-add-new-quirk-id-for-soundblaster-ae.patch +asoc-sof-add-topology-filename-override-based-on-dmi.patch +asoc-intel-sof_rt5682-override-quirk-data-for-tgl_ma.patch +scsi-smartpqi-avoid-crashing-kernel-for-controller-i.patch +brcm80211-fix-possible-memleak-in-brcmf_proto_msgbuf.patch +usb-core-solve-race-condition-in-anchor-cleanup-func.patch +scsi-ufs-ufs-qcom-fix-race-conditions-caused-by-ufs_.patch +drm-amd-display-screen-corruption-on-dual-displays-d.patch +dmaengine-dw-add-dma-channels-mask-cell-support.patch +dmaengine-dw-activate-fifo-mode-for-memory-periphera.patch +ath10k-check-idx-validity-in-__ath10k_htt_rx_ring_fi.patch diff --git a/queue-5.8/slimbus-core-check-get_addr-before-removing-laddr-id.patch b/queue-5.8/slimbus-core-check-get_addr-before-removing-laddr-id.patch new file mode 100644 index 00000000000..ab7ad7ff050 --- /dev/null +++ b/queue-5.8/slimbus-core-check-get_addr-before-removing-laddr-id.patch @@ -0,0 +1,42 @@ +From e5480adebab2fcb387e3ac00f27e4af12fce0d62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 10:55:18 +0100 +Subject: slimbus: core: check get_addr before removing laddr ida + +From: Srinivas Kandagatla + +[ Upstream commit f97769fde678e111a1b7b165b380d8a3dfe54f4e ] + +logical address can be either assigned by the SLIMBus controller or the core. +Core uses IDA in cases where get_addr callback is not provided by the +controller. +Core already has this check while allocating IDR, however during absence +reporting this is not checked. This patch fixes this issue. + +Fixes: 46a2bb5a7f7e ("slimbus: core: Add slim controllers support") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20200925095520.27316-2-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/slimbus/core.c b/drivers/slimbus/core.c +index ae1e248a8fb8a..58b63ae0e75a6 100644 +--- a/drivers/slimbus/core.c ++++ b/drivers/slimbus/core.c +@@ -326,8 +326,8 @@ void slim_report_absent(struct slim_device *sbdev) + mutex_lock(&ctrl->lock); + sbdev->is_laddr_valid = false; + mutex_unlock(&ctrl->lock); +- +- ida_simple_remove(&ctrl->laddr_ida, sbdev->laddr); ++ if (!ctrl->get_laddr) ++ ida_simple_remove(&ctrl->laddr_ida, sbdev->laddr); + slim_device_update_status(sbdev, SLIM_DEVICE_STATUS_DOWN); + } + EXPORT_SYMBOL_GPL(slim_report_absent); +-- +2.25.1 + diff --git a/queue-5.8/slimbus-core-do-not-enter-to-clock-pause-mode-in-cor.patch b/queue-5.8/slimbus-core-do-not-enter-to-clock-pause-mode-in-cor.patch new file mode 100644 index 00000000000..749d81a1229 --- /dev/null +++ b/queue-5.8/slimbus-core-do-not-enter-to-clock-pause-mode-in-cor.patch @@ -0,0 +1,38 @@ +From 887602a9ce1fdce355efa70fce9be67159bed274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 10:55:19 +0100 +Subject: slimbus: core: do not enter to clock pause mode in core + +From: Srinivas Kandagatla + +[ Upstream commit df2c471c4ae07e18a0396db670dca2ef867c5153 ] + +Let the controller logic decide when to enter into clock pause mode! +Entering in to pause mode during unregistration does not really make +sense as the controller is totally going down at that point in time. + +Fixes: 4b14e62ad3c9e ("slimbus: Add support for 'clock-pause' feature") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20200925095520.27316-3-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/core.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/slimbus/core.c b/drivers/slimbus/core.c +index 58b63ae0e75a6..1d2bc181da050 100644 +--- a/drivers/slimbus/core.c ++++ b/drivers/slimbus/core.c +@@ -301,8 +301,6 @@ int slim_unregister_controller(struct slim_controller *ctrl) + { + /* Remove all clients */ + device_for_each_child(ctrl->dev, NULL, slim_ctrl_remove_device); +- /* Enter Clock Pause */ +- slim_ctrl_clk_pause(ctrl, false, 0); + ida_simple_remove(&ctrl_ida, ctrl->id); + + return 0; +-- +2.25.1 + diff --git a/queue-5.8/slimbus-qcom-ngd-ctrl-disable-ngd-in-qmi-server-down.patch b/queue-5.8/slimbus-qcom-ngd-ctrl-disable-ngd-in-qmi-server-down.patch new file mode 100644 index 00000000000..fd2626ce267 --- /dev/null +++ b/queue-5.8/slimbus-qcom-ngd-ctrl-disable-ngd-in-qmi-server-down.patch @@ -0,0 +1,45 @@ +From 1ce33cb75acdf227c99805f48924c214bb40214a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 10:55:20 +0100 +Subject: slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback + +From: Srinivas Kandagatla + +[ Upstream commit 709ec3f7fc5773ac4aa6fb22c3f0ac8103c674db ] + +In QMI new server notification we enable the NGD however during +delete server notification we do not disable the NGD. + +This can lead to multiple instances of NGD being enabled, so make +sure that we disable NGD in delete server callback to fix this issue! + +Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20200925095520.27316-4-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index 743ee7b4e63f2..218aefc3531cd 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1277,9 +1277,13 @@ static void qcom_slim_ngd_qmi_del_server(struct qmi_handle *hdl, + { + struct qcom_slim_ngd_qmi *qmi = + container_of(hdl, struct qcom_slim_ngd_qmi, svc_event_hdl); ++ struct qcom_slim_ngd_ctrl *ctrl = ++ container_of(qmi, struct qcom_slim_ngd_ctrl, qmi); + + qmi->svc_info.sq_node = 0; + qmi->svc_info.sq_port = 0; ++ ++ qcom_slim_ngd_enable(ctrl, false); + } + + static struct qmi_ops qcom_slim_ngd_qmi_svc_event_ops = { +-- +2.25.1 + diff --git a/queue-5.8/soc-fsl-qbman-fix-return-value-on-success.patch b/queue-5.8/soc-fsl-qbman-fix-return-value-on-success.patch new file mode 100644 index 00000000000..76725da6487 --- /dev/null +++ b/queue-5.8/soc-fsl-qbman-fix-return-value-on-success.patch @@ -0,0 +1,38 @@ +From d1b2a29200dddac1dce04b9652a88de7ca6c262c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Sep 2020 22:26:25 +0200 +Subject: soc: fsl: qbman: Fix return value on success + +From: Krzysztof Kozlowski + +[ Upstream commit 750cf40c0f7088f36a8a5d102e0488b1ac47faf5 ] + +On error the function was meant to return -ERRNO. This also fixes +compile warning: + + drivers/soc/fsl/qbman/bman.c:640:6: warning: variable 'err' set but not used [-Wunused-but-set-variable] + +Fixes: 0505d00c8dba ("soc/fsl/qbman: Cleanup buffer pools if BMan was initialized prior to bootup") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Li Yang +Signed-off-by: Sasha Levin +--- + drivers/soc/fsl/qbman/bman.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/fsl/qbman/bman.c b/drivers/soc/fsl/qbman/bman.c +index f4fb527d83018..c5dd026fe889f 100644 +--- a/drivers/soc/fsl/qbman/bman.c ++++ b/drivers/soc/fsl/qbman/bman.c +@@ -660,7 +660,7 @@ int bm_shutdown_pool(u32 bpid) + } + done: + put_affine_portal(); +- return 0; ++ return err; + } + + struct gen_pool *bm_bpalloc; +-- +2.25.1 + diff --git a/queue-5.8/soc-mediatek-cmdq-add-clear-option-in-cmdq_pkt_wfe-a.patch b/queue-5.8/soc-mediatek-cmdq-add-clear-option-in-cmdq_pkt_wfe-a.patch new file mode 100644 index 00000000000..362549d77a8 --- /dev/null +++ b/queue-5.8/soc-mediatek-cmdq-add-clear-option-in-cmdq_pkt_wfe-a.patch @@ -0,0 +1,97 @@ +From 3fe168af558501989ec4ab327bab8af0cb0b0ae8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jul 2020 23:45:13 +0800 +Subject: soc: mediatek: cmdq: add clear option in cmdq_pkt_wfe api + +From: Dennis YC Hsieh + +[ Upstream commit 23c22299cd290409c6b78f57c42b64f8dfb6dd92 ] + +Add clear parameter to let client decide if +event should be clear to 0 after GCE receive it. + +Signed-off-by: Dennis YC Hsieh +Acked-by: Chun-Kuang Hu +Link: https://lore.kernel.org/r/1594136714-11650-9-git-send-email-dennis-yc.hsieh@mediatek.com +[mb: fix commit message] +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 2 +- + drivers/soc/mediatek/mtk-cmdq-helper.c | 5 +++-- + include/linux/mailbox/mtk-cmdq-mailbox.h | 3 +-- + include/linux/soc/mediatek/mtk-cmdq.h | 5 +++-- + 4 files changed, 8 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index d8b43500f12d1..f64c83dc6644e 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -485,7 +485,7 @@ static void mtk_drm_crtc_hw_config(struct mtk_drm_crtc *mtk_crtc) + mbox_flush(mtk_crtc->cmdq_client->chan, 2000); + cmdq_handle = cmdq_pkt_create(mtk_crtc->cmdq_client, PAGE_SIZE); + cmdq_pkt_clear_event(cmdq_handle, mtk_crtc->cmdq_event); +- cmdq_pkt_wfe(cmdq_handle, mtk_crtc->cmdq_event); ++ cmdq_pkt_wfe(cmdq_handle, mtk_crtc->cmdq_event, true); + mtk_crtc_ddp_config(crtc, cmdq_handle); + cmdq_pkt_flush_async(cmdq_handle, ddp_cmdq_cb, cmdq_handle); + } +diff --git a/drivers/soc/mediatek/mtk-cmdq-helper.c b/drivers/soc/mediatek/mtk-cmdq-helper.c +index 87ee9f767b7af..d8ace96832bac 100644 +--- a/drivers/soc/mediatek/mtk-cmdq-helper.c ++++ b/drivers/soc/mediatek/mtk-cmdq-helper.c +@@ -213,15 +213,16 @@ int cmdq_pkt_write_mask(struct cmdq_pkt *pkt, u8 subsys, + } + EXPORT_SYMBOL(cmdq_pkt_write_mask); + +-int cmdq_pkt_wfe(struct cmdq_pkt *pkt, u16 event) ++int cmdq_pkt_wfe(struct cmdq_pkt *pkt, u16 event, bool clear) + { + struct cmdq_instruction inst = { {0} }; ++ u32 clear_option = clear ? CMDQ_WFE_UPDATE : 0; + + if (event >= CMDQ_MAX_EVENT) + return -EINVAL; + + inst.op = CMDQ_CODE_WFE; +- inst.value = CMDQ_WFE_OPTION; ++ inst.value = CMDQ_WFE_OPTION | clear_option; + inst.event = event; + + return cmdq_pkt_append_command(pkt, inst); +diff --git a/include/linux/mailbox/mtk-cmdq-mailbox.h b/include/linux/mailbox/mtk-cmdq-mailbox.h +index a4dc45fbec0a4..23bc366f6c3b3 100644 +--- a/include/linux/mailbox/mtk-cmdq-mailbox.h ++++ b/include/linux/mailbox/mtk-cmdq-mailbox.h +@@ -27,8 +27,7 @@ + * bit 16-27: update value + * bit 31: 1 - update, 0 - no update + */ +-#define CMDQ_WFE_OPTION (CMDQ_WFE_UPDATE | CMDQ_WFE_WAIT | \ +- CMDQ_WFE_WAIT_VALUE) ++#define CMDQ_WFE_OPTION (CMDQ_WFE_WAIT | CMDQ_WFE_WAIT_VALUE) + + /** cmdq event maximum */ + #define CMDQ_MAX_EVENT 0x3ff +diff --git a/include/linux/soc/mediatek/mtk-cmdq.h b/include/linux/soc/mediatek/mtk-cmdq.h +index a74c1d5acdf3c..cb71dca985589 100644 +--- a/include/linux/soc/mediatek/mtk-cmdq.h ++++ b/include/linux/soc/mediatek/mtk-cmdq.h +@@ -105,11 +105,12 @@ int cmdq_pkt_write_mask(struct cmdq_pkt *pkt, u8 subsys, + /** + * cmdq_pkt_wfe() - append wait for event command to the CMDQ packet + * @pkt: the CMDQ packet +- * @event: the desired event type to "wait and CLEAR" ++ * @event: the desired event type to wait ++ * @clear: clear event or not after event arrive + * + * Return: 0 for success; else the error code is returned + */ +-int cmdq_pkt_wfe(struct cmdq_pkt *pkt, u16 event); ++int cmdq_pkt_wfe(struct cmdq_pkt *pkt, u16 event, bool clear); + + /** + * cmdq_pkt_clear_event() - append clear event command to the CMDQ packet +-- +2.25.1 + diff --git a/queue-5.8/soc-qcom-apr-fixup-the-error-displayed-on-lookup-fai.patch b/queue-5.8/soc-qcom-apr-fixup-the-error-displayed-on-lookup-fai.patch new file mode 100644 index 00000000000..ec0fb924a2c --- /dev/null +++ b/queue-5.8/soc-qcom-apr-fixup-the-error-displayed-on-lookup-fai.patch @@ -0,0 +1,37 @@ +From 7d118e5f861d6d686743e06be7223b9cf278524a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 21:12:32 +0530 +Subject: soc: qcom: apr: Fixup the error displayed on lookup failure + +From: Sibi Sankar + +[ Upstream commit ba34f977c333f96c8acd37ec30e232220399f5a5 ] + +APR client incorrectly prints out "ret" variable on pdr_add_lookup failure, +it should be printing the error value returned by the lookup instead. + +Fixes: 8347356626028 ("soc: qcom: apr: Add avs/audio tracking functionality") +Signed-off-by: Sibi Sankar +Link: https://lore.kernel.org/r/20200915154232.27523-1-sibis@codeaurora.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/apr.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/apr.c b/drivers/soc/qcom/apr.c +index 1f35b097c6356..7abfc8c4fdc72 100644 +--- a/drivers/soc/qcom/apr.c ++++ b/drivers/soc/qcom/apr.c +@@ -328,7 +328,7 @@ static int of_apr_add_pd_lookups(struct device *dev) + + pds = pdr_add_lookup(apr->pdr, service_name, service_path); + if (IS_ERR(pds) && PTR_ERR(pds) != -EALREADY) { +- dev_err(dev, "pdr add lookup failed: %d\n", ret); ++ dev_err(dev, "pdr add lookup failed: %ld\n", PTR_ERR(pds)); + return PTR_ERR(pds); + } + } +-- +2.25.1 + diff --git a/queue-5.8/soc-qcom-pdr-fixup-array-type-of-get_domain_list_res.patch b/queue-5.8/soc-qcom-pdr-fixup-array-type-of-get_domain_list_res.patch new file mode 100644 index 00000000000..f28b0ad7933 --- /dev/null +++ b/queue-5.8/soc-qcom-pdr-fixup-array-type-of-get_domain_list_res.patch @@ -0,0 +1,47 @@ +From 38fb366e952c50a0af8f3d47b42db01f2530be6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 20:28:07 +0530 +Subject: soc: qcom: pdr: Fixup array type of get_domain_list_resp message + +From: Sibi Sankar + +[ Upstream commit 7a366707bb6a93baeb1a9ef46c4b9c875e0132d6 ] + +The array type of get_domain_list_resp is incorrectly marked as NO_ARRAY. +Due to which the following error was observed when using pdr helpers with +the downstream proprietary pd-mapper. Fix this up by marking it as +VAR_LEN_ARRAY instead. + +Err logs: +qmi_decode_struct_elem: Fault in decoding: dl(2), db(27), tl(160), i(1), el(1) +failed to decode incoming message +PDR: tms/servreg get domain list txn wait failed: -14 +PDR: service lookup for tms/servreg failed: -14 + +Tested-by: Rishabh Bhatnagar +Fixes: fbe639b44a82 ("soc: qcom: Introduce Protection Domain Restart helpers") +Reported-by: Rishabh Bhatnagar +Signed-off-by: Sibi Sankar +Link: https://lore.kernel.org/r/20200914145807.1224-1-sibis@codeaurora.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/pdr_internal.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/qcom/pdr_internal.h b/drivers/soc/qcom/pdr_internal.h +index 15b5002e4127b..ab9ae8cdfa54c 100644 +--- a/drivers/soc/qcom/pdr_internal.h ++++ b/drivers/soc/qcom/pdr_internal.h +@@ -185,7 +185,7 @@ struct qmi_elem_info servreg_get_domain_list_resp_ei[] = { + .data_type = QMI_STRUCT, + .elem_len = SERVREG_DOMAIN_LIST_LENGTH, + .elem_size = sizeof(struct servreg_location_entry), +- .array_type = NO_ARRAY, ++ .array_type = VAR_LEN_ARRAY, + .tlv_type = 0x12, + .offset = offsetof(struct servreg_get_domain_list_resp, + domain_list), +-- +2.25.1 + diff --git a/queue-5.8/soc-xilinx-fix-error-code-in-zynqmp_pm_probe.patch b/queue-5.8/soc-xilinx-fix-error-code-in-zynqmp_pm_probe.patch new file mode 100644 index 00000000000..2b89ff60548 --- /dev/null +++ b/queue-5.8/soc-xilinx-fix-error-code-in-zynqmp_pm_probe.patch @@ -0,0 +1,37 @@ +From 1bcbfa15e47ec6547a234ed5d76763cb2b7aa056 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jun 2020 14:00:20 +0300 +Subject: soc: xilinx: Fix error code in zynqmp_pm_probe() + +From: Dan Carpenter + +[ Upstream commit a6f2f0fdc73aacc6e10ae48ae78634dba26702d4 ] + +This should be returning PTR_ERR() but it returns IS_ERR() instead. + +Fixes: ffdbae28d9d1 ("drivers: soc: xilinx: Use mailbox IPI callback") +Signed-off-by: Dan Carpenter +Reviewed-by: Michal Simek +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/20200605110020.GA978434@mwanda +Signed-off-by: Sasha Levin +--- + drivers/soc/xilinx/zynqmp_power.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/soc/xilinx/zynqmp_power.c b/drivers/soc/xilinx/zynqmp_power.c +index 31ff49fcd078b..c556623dae024 100644 +--- a/drivers/soc/xilinx/zynqmp_power.c ++++ b/drivers/soc/xilinx/zynqmp_power.c +@@ -205,7 +205,7 @@ static int zynqmp_pm_probe(struct platform_device *pdev) + rx_chan = mbox_request_channel_byname(client, "rx"); + if (IS_ERR(rx_chan)) { + dev_err(&pdev->dev, "Failed to request rx channel\n"); +- return IS_ERR(rx_chan); ++ return PTR_ERR(rx_chan); + } + } else if (of_find_property(pdev->dev.of_node, "interrupts", NULL)) { + irq = platform_get_irq(pdev, 0); +-- +2.25.1 + diff --git a/queue-5.8/spi-dw-pci-free-previously-allocated-irqs-if-desc-se.patch b/queue-5.8/spi-dw-pci-free-previously-allocated-irqs-if-desc-se.patch new file mode 100644 index 00000000000..1f23cf92544 --- /dev/null +++ b/queue-5.8/spi-dw-pci-free-previously-allocated-irqs-if-desc-se.patch @@ -0,0 +1,65 @@ +From c3e4a3fc0f2cbc55ff80cf0cfc41db964080cd63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 09:22:49 +0800 +Subject: spi: dw-pci: free previously allocated IRQs if desc->setup() fails + +From: Jay Fang + +[ Upstream commit 9599f341889c87e56bb944659c32490d05e2532f ] + +Free previously allocated IRQs when return an error code of desc->setup() +which is not always successful. And simplify the code by adding a goto +label. + +Fixes: 8f5c285f3ef5 ("SPI: designware: pci: Switch over to MSI interrupts") +CC: Felipe Balbi +Signed-off-by: Jay Fang +Link: https://lore.kernel.org/r/1600132969-53037-1-git-send-email-f.fangjian@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-dw-pci.c | 16 +++++++++------- + 1 file changed, 9 insertions(+), 7 deletions(-) + +diff --git a/drivers/spi/spi-dw-pci.c b/drivers/spi/spi-dw-pci.c +index 2ea73809ca345..271839a8add0e 100644 +--- a/drivers/spi/spi-dw-pci.c ++++ b/drivers/spi/spi-dw-pci.c +@@ -127,18 +127,16 @@ static int spi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (desc->setup) { + ret = desc->setup(dws); + if (ret) +- return ret; ++ goto err_free_irq_vectors; + } + } else { +- pci_free_irq_vectors(pdev); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_free_irq_vectors; + } + + ret = dw_spi_add_host(&pdev->dev, dws); +- if (ret) { +- pci_free_irq_vectors(pdev); +- return ret; +- } ++ if (ret) ++ goto err_free_irq_vectors; + + /* PCI hook and SPI hook use the same drv data */ + pci_set_drvdata(pdev, dws); +@@ -152,6 +150,10 @@ static int spi_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + pm_runtime_allow(&pdev->dev); + + return 0; ++ ++err_free_irq_vectors: ++ pci_free_irq_vectors(pdev); ++ return ret; + } + + static void spi_pci_remove(struct pci_dev *pdev) +-- +2.25.1 + diff --git a/queue-5.8/spi-fsi-fix-clock-running-too-fast.patch b/queue-5.8/spi-fsi-fix-clock-running-too-fast.patch new file mode 100644 index 00000000000..316d89eb199 --- /dev/null +++ b/queue-5.8/spi-fsi-fix-clock-running-too-fast.patch @@ -0,0 +1,42 @@ +From 40b48c6c3db9a88715fe3cba079520a9a62df647 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 17:28:53 -0500 +Subject: spi: fsi: Fix clock running too fast + +From: Brad Bishop + +[ Upstream commit 0b546bbe9474ff23e6843916ad6d567f703b2396 ] + +Use a clock divider tuned to a 200MHz FSI bus frequency (the maximum). Use +of the previous divider at 200MHz results in corrupt data from endpoint +devices. Ideally the clock divider would be calculated from the FSI clock, +but that would require some significant work on the FSI driver. With FSI +frequencies slower than 200MHz, the SPI clock will simply run slower, but +safely. + +Signed-off-by: Brad Bishop +Signed-off-by: Eddie James +Signed-off-by: Joel Stanley +Link: https://lore.kernel.org/r/20200909222857.28653-3-eajames@linux.ibm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsi.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-fsi.c b/drivers/spi/spi-fsi.c +index ef5e0826a53c3..a702e9d7d68c0 100644 +--- a/drivers/spi/spi-fsi.c ++++ b/drivers/spi/spi-fsi.c +@@ -403,7 +403,7 @@ static int fsi_spi_transfer_init(struct fsi_spi *ctx) + u64 status = 0ULL; + u64 wanted_clock_cfg = SPI_FSI_CLOCK_CFG_ECC_DISABLE | + SPI_FSI_CLOCK_CFG_SCK_NO_DEL | +- FIELD_PREP(SPI_FSI_CLOCK_CFG_SCK_DIV, 4); ++ FIELD_PREP(SPI_FSI_CLOCK_CFG_SCK_DIV, 19); + + end = jiffies + msecs_to_jiffies(SPI_FSI_INIT_TIMEOUT_MS); + do { +-- +2.25.1 + diff --git a/queue-5.8/spi-fsi-fix-use-of-the-bneq-sequencer-instruction.patch b/queue-5.8/spi-fsi-fix-use-of-the-bneq-sequencer-instruction.patch new file mode 100644 index 00000000000..a11d1d5a761 --- /dev/null +++ b/queue-5.8/spi-fsi-fix-use-of-the-bneq-sequencer-instruction.patch @@ -0,0 +1,109 @@ +From 04657f5e37dad5f4bea10dddecadb8f0e6082b53 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 17:28:54 -0500 +Subject: spi: fsi: Fix use of the bneq+ sequencer instruction + +From: Brad Bishop + +[ Upstream commit 7909eebb2bea7fdbb2de0aa794cf29843761ed5b ] + +All of the switches in N2_count_control in the counter configuration are +required to make the branch if not equal and increment command work. +Set them when using bneq+. + +A side effect of this mode requires a dummy write to TDR when both +transmitting and receiving otherwise the controller won't start shifting +receive data. + +It is likely not possible to avoid TDR underrun errors in this mode and +they are harmless, so do not check for them. + +Fixes: bbb6b2f9865b ("spi: Add FSI-attached SPI controller driver") +Signed-off-by: Brad Bishop +Signed-off-by: Eddie James +Reviewed-by: Joel Stanley +Signed-off-by: Joel Stanley +Link: https://lore.kernel.org/r/20200909222857.28653-4-eajames@linux.ibm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsi.c | 28 +++++++++++++++++++++++++--- + 1 file changed, 25 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-fsi.c b/drivers/spi/spi-fsi.c +index 8f64af0140e09..bb18b407cdcf3 100644 +--- a/drivers/spi/spi-fsi.c ++++ b/drivers/spi/spi-fsi.c +@@ -29,6 +29,10 @@ + #define SPI_FSI_ERROR 0x0 + #define SPI_FSI_COUNTER_CFG 0x1 + #define SPI_FSI_COUNTER_CFG_LOOPS(x) (((u64)(x) & 0xffULL) << 32) ++#define SPI_FSI_COUNTER_CFG_N2_RX BIT_ULL(8) ++#define SPI_FSI_COUNTER_CFG_N2_TX BIT_ULL(9) ++#define SPI_FSI_COUNTER_CFG_N2_IMPLICIT BIT_ULL(10) ++#define SPI_FSI_COUNTER_CFG_N2_RELOAD BIT_ULL(11) + #define SPI_FSI_CFG1 0x2 + #define SPI_FSI_CLOCK_CFG 0x3 + #define SPI_FSI_CLOCK_CFG_MM_ENABLE BIT_ULL(32) +@@ -61,7 +65,7 @@ + #define SPI_FSI_STATUS_RDR_OVERRUN BIT_ULL(62) + #define SPI_FSI_STATUS_RDR_FULL BIT_ULL(63) + #define SPI_FSI_STATUS_ANY_ERROR \ +- (SPI_FSI_STATUS_ERROR | SPI_FSI_STATUS_TDR_UNDERRUN | \ ++ (SPI_FSI_STATUS_ERROR | \ + SPI_FSI_STATUS_TDR_OVERRUN | SPI_FSI_STATUS_RDR_UNDERRUN | \ + SPI_FSI_STATUS_RDR_OVERRUN) + #define SPI_FSI_PORT_CTRL 0x9 +@@ -238,6 +242,7 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx, + int rc; + u8 len = min(transfer->len, 8U); + u8 rem = transfer->len % len; ++ u64 cfg = 0ULL; + + loops = transfer->len / len; + +@@ -258,8 +263,14 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx, + if (loops > 1) { + fsi_spi_sequence_add(seq, SPI_FSI_SEQUENCE_BRANCH(idx)); + +- rc = fsi_spi_write_reg(ctx, SPI_FSI_COUNTER_CFG, +- SPI_FSI_COUNTER_CFG_LOOPS(loops - 1)); ++ cfg = SPI_FSI_COUNTER_CFG_LOOPS(loops - 1); ++ if (transfer->rx_buf) ++ cfg |= SPI_FSI_COUNTER_CFG_N2_RX | ++ SPI_FSI_COUNTER_CFG_N2_TX | ++ SPI_FSI_COUNTER_CFG_N2_IMPLICIT | ++ SPI_FSI_COUNTER_CFG_N2_RELOAD; ++ ++ rc = fsi_spi_write_reg(ctx, SPI_FSI_COUNTER_CFG, cfg); + if (rc) + return rc; + } +@@ -275,6 +286,7 @@ static int fsi_spi_transfer_data(struct fsi_spi *ctx, + { + int rc = 0; + u64 status = 0ULL; ++ u64 cfg = 0ULL; + + if (transfer->tx_buf) { + int nb; +@@ -312,6 +324,16 @@ static int fsi_spi_transfer_data(struct fsi_spi *ctx, + u64 in = 0ULL; + u8 *rx = transfer->rx_buf; + ++ rc = fsi_spi_read_reg(ctx, SPI_FSI_COUNTER_CFG, &cfg); ++ if (rc) ++ return rc; ++ ++ if (cfg & SPI_FSI_COUNTER_CFG_N2_IMPLICIT) { ++ rc = fsi_spi_write_reg(ctx, SPI_FSI_DATA_TX, 0); ++ if (rc) ++ return rc; ++ } ++ + while (transfer->len > recv) { + do { + rc = fsi_spi_read_reg(ctx, SPI_FSI_STATUS, +-- +2.25.1 + diff --git a/queue-5.8/spi-fsi-handle-9-to-15-byte-transfers-lengths.patch b/queue-5.8/spi-fsi-handle-9-to-15-byte-transfers-lengths.patch new file mode 100644 index 00000000000..16b1e6be191 --- /dev/null +++ b/queue-5.8/spi-fsi-handle-9-to-15-byte-transfers-lengths.patch @@ -0,0 +1,50 @@ +From 9b9bde9c09d57dc75563f74030b1c0966e5c3165 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 17:28:52 -0500 +Subject: spi: fsi: Handle 9 to 15 byte transfers lengths + +From: Brad Bishop + +[ Upstream commit 2b3cef0fc757bd06ed9b83bd4c436bfa55f47370 ] + +The trailing - 8 bytes of transfer data in this size range is no +longer ignored. + +Fixes: bbb6b2f9865b ("spi: Add FSI-attached SPI controller driver") +Signed-off-by: Brad Bishop +Signed-off-by: Eddie James +Reviewed-by: Joel Stanley +Signed-off-by: Joel Stanley +Link: https://lore.kernel.org/r/20200909222857.28653-2-eajames@linux.ibm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi-fsi.c b/drivers/spi/spi-fsi.c +index 37a3e0f8e7526..8f64af0140e09 100644 +--- a/drivers/spi/spi-fsi.c ++++ b/drivers/spi/spi-fsi.c +@@ -258,15 +258,15 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx, + if (loops > 1) { + fsi_spi_sequence_add(seq, SPI_FSI_SEQUENCE_BRANCH(idx)); + +- if (rem) +- fsi_spi_sequence_add(seq, rem); +- + rc = fsi_spi_write_reg(ctx, SPI_FSI_COUNTER_CFG, + SPI_FSI_COUNTER_CFG_LOOPS(loops - 1)); + if (rc) + return rc; + } + ++ if (rem) ++ fsi_spi_sequence_add(seq, rem); ++ + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.8/spi-fsi-implement-restricted-size-for-certain-contro.patch b/queue-5.8/spi-fsi-implement-restricted-size-for-certain-contro.patch new file mode 100644 index 00000000000..3efb6a7883d --- /dev/null +++ b/queue-5.8/spi-fsi-implement-restricted-size-for-certain-contro.patch @@ -0,0 +1,190 @@ +From 3a0bececed59abb06369d20f9cf1a5af8ba6bbe8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 17:28:56 -0500 +Subject: spi: fsi: Implement restricted size for certain controllers + +From: Eddie James + +[ Upstream commit 49c9fc1d7c101eceaddb655e4f0e062b0c8f403b ] + +Some of the FSI-attached SPI controllers cannot use the loop command in +programming the sequencer due to security requirements. Check the +devicetree compatibility that indicates this condition and restrict the +size for these controllers. Also, add more transfers directly in the +sequence up to the length of the sequence register. + +Fixes: bbb6b2f9865b ("spi: Add FSI-attached SPI controller driver") +Signed-off-by: Eddie James +Reviewed-by: Joel Stanley +Signed-off-by: Joel Stanley +Link: https://lore.kernel.org/r/20200909222857.28653-6-eajames@linux.ibm.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-fsi.c | 65 +++++++++++++++++++++++++++++++++++-------- + 1 file changed, 53 insertions(+), 12 deletions(-) + +diff --git a/drivers/spi/spi-fsi.c b/drivers/spi/spi-fsi.c +index bb18b407cdcf3..ef5e0826a53c3 100644 +--- a/drivers/spi/spi-fsi.c ++++ b/drivers/spi/spi-fsi.c +@@ -24,7 +24,8 @@ + + #define SPI_FSI_BASE 0x70000 + #define SPI_FSI_INIT_TIMEOUT_MS 1000 +-#define SPI_FSI_MAX_TRANSFER_SIZE 2048 ++#define SPI_FSI_MAX_XFR_SIZE 2048 ++#define SPI_FSI_MAX_XFR_SIZE_RESTRICTED 32 + + #define SPI_FSI_ERROR 0x0 + #define SPI_FSI_COUNTER_CFG 0x1 +@@ -74,6 +75,8 @@ struct fsi_spi { + struct device *dev; /* SPI controller device */ + struct fsi_device *fsi; /* FSI2SPI CFAM engine device */ + u32 base; ++ size_t max_xfr_size; ++ bool restricted; + }; + + struct fsi_spi_sequence { +@@ -209,8 +212,12 @@ static int fsi_spi_reset(struct fsi_spi *ctx) + if (rc) + return rc; + +- return fsi_spi_write_reg(ctx, SPI_FSI_CLOCK_CFG, +- SPI_FSI_CLOCK_CFG_RESET2); ++ rc = fsi_spi_write_reg(ctx, SPI_FSI_CLOCK_CFG, ++ SPI_FSI_CLOCK_CFG_RESET2); ++ if (rc) ++ return rc; ++ ++ return fsi_spi_write_reg(ctx, SPI_FSI_STATUS, 0ULL); + } + + static int fsi_spi_sequence_add(struct fsi_spi_sequence *seq, u8 val) +@@ -218,8 +225,8 @@ static int fsi_spi_sequence_add(struct fsi_spi_sequence *seq, u8 val) + /* + * Add the next byte of instruction to the 8-byte sequence register. + * Then decrement the counter so that the next instruction will go in +- * the right place. Return the number of "slots" left in the sequence +- * register. ++ * the right place. Return the index of the slot we just filled in the ++ * sequence register. + */ + seq->data |= (u64)val << seq->bit; + seq->bit -= 8; +@@ -237,9 +244,11 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx, + struct fsi_spi_sequence *seq, + struct spi_transfer *transfer) + { ++ bool docfg = false; + int loops; + int idx; + int rc; ++ u8 val = 0; + u8 len = min(transfer->len, 8U); + u8 rem = transfer->len % len; + u64 cfg = 0ULL; +@@ -247,22 +256,42 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx, + loops = transfer->len / len; + + if (transfer->tx_buf) { +- idx = fsi_spi_sequence_add(seq, +- SPI_FSI_SEQUENCE_SHIFT_OUT(len)); ++ val = SPI_FSI_SEQUENCE_SHIFT_OUT(len); ++ idx = fsi_spi_sequence_add(seq, val); ++ + if (rem) + rem = SPI_FSI_SEQUENCE_SHIFT_OUT(rem); + } else if (transfer->rx_buf) { +- idx = fsi_spi_sequence_add(seq, +- SPI_FSI_SEQUENCE_SHIFT_IN(len)); ++ val = SPI_FSI_SEQUENCE_SHIFT_IN(len); ++ idx = fsi_spi_sequence_add(seq, val); ++ + if (rem) + rem = SPI_FSI_SEQUENCE_SHIFT_IN(rem); + } else { + return -EINVAL; + } + ++ if (ctx->restricted) { ++ const int eidx = rem ? 5 : 6; ++ ++ while (loops > 1 && idx <= eidx) { ++ idx = fsi_spi_sequence_add(seq, val); ++ loops--; ++ docfg = true; ++ } ++ ++ if (loops > 1) { ++ dev_warn(ctx->dev, "No sequencer slots; aborting.\n"); ++ return -EINVAL; ++ } ++ } ++ + if (loops > 1) { + fsi_spi_sequence_add(seq, SPI_FSI_SEQUENCE_BRANCH(idx)); ++ docfg = true; ++ } + ++ if (docfg) { + cfg = SPI_FSI_COUNTER_CFG_LOOPS(loops - 1); + if (transfer->rx_buf) + cfg |= SPI_FSI_COUNTER_CFG_N2_RX | +@@ -273,6 +302,8 @@ static int fsi_spi_sequence_transfer(struct fsi_spi *ctx, + rc = fsi_spi_write_reg(ctx, SPI_FSI_COUNTER_CFG, cfg); + if (rc) + return rc; ++ } else { ++ fsi_spi_write_reg(ctx, SPI_FSI_COUNTER_CFG, 0ULL); + } + + if (rem) +@@ -429,7 +460,7 @@ static int fsi_spi_transfer_one_message(struct spi_controller *ctlr, + + /* Sequencer must do shift out (tx) first. */ + if (!transfer->tx_buf || +- transfer->len > SPI_FSI_MAX_TRANSFER_SIZE) { ++ transfer->len > (ctx->max_xfr_size + 8)) { + rc = -EINVAL; + goto error; + } +@@ -453,7 +484,7 @@ static int fsi_spi_transfer_one_message(struct spi_controller *ctlr, + + /* Sequencer can only do shift in (rx) after tx. */ + if (next->rx_buf) { +- if (next->len > SPI_FSI_MAX_TRANSFER_SIZE) { ++ if (next->len > ctx->max_xfr_size) { + rc = -EINVAL; + goto error; + } +@@ -498,7 +529,9 @@ static int fsi_spi_transfer_one_message(struct spi_controller *ctlr, + + static size_t fsi_spi_max_transfer_size(struct spi_device *spi) + { +- return SPI_FSI_MAX_TRANSFER_SIZE; ++ struct fsi_spi *ctx = spi_controller_get_devdata(spi->controller); ++ ++ return ctx->max_xfr_size; + } + + static int fsi_spi_probe(struct device *dev) +@@ -546,6 +579,14 @@ static int fsi_spi_probe(struct device *dev) + ctx->fsi = fsi; + ctx->base = base + SPI_FSI_BASE; + ++ if (of_device_is_compatible(np, "ibm,fsi2spi-restricted")) { ++ ctx->restricted = true; ++ ctx->max_xfr_size = SPI_FSI_MAX_XFR_SIZE_RESTRICTED; ++ } else { ++ ctx->restricted = false; ++ ctx->max_xfr_size = SPI_FSI_MAX_XFR_SIZE; ++ } ++ + rc = devm_spi_register_controller(dev, ctlr); + if (rc) + spi_controller_put(ctlr); +-- +2.25.1 + diff --git a/queue-5.8/spi-omap2-mcspi-improve-performance-waiting-for-chst.patch b/queue-5.8/spi-omap2-mcspi-improve-performance-waiting-for-chst.patch new file mode 100644 index 00000000000..ce6af10b13b --- /dev/null +++ b/queue-5.8/spi-omap2-mcspi-improve-performance-waiting-for-chst.patch @@ -0,0 +1,74 @@ +From 3164347854f3818cab0fa3999d855072e07fa87c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 17:56:24 +0530 +Subject: spi: omap2-mcspi: Improve performance waiting for CHSTAT + +From: Aswath Govindraju + +[ Upstream commit 7b1d96813317358312440d0d07abbfbeb0ef8d22 ] + +This reverts commit 13d515c796 (spi: omap2-mcspi: Switch to +readl_poll_timeout()). + +The amount of time spent polling for the MCSPI_CHSTAT bits to be set on +AM335x-icev2 platform is less than 1us (about 0.6us) in most cases, with +or without using DMA. So, in most cases the function need not sleep. +Also, setting the sleep_usecs to zero would not be optimal here because +ktime_add_us() used in readl_poll_timeout() is slower compared to the +direct addition used after the revert. So, it is sub-optimal to use +readl_poll_timeout in this case. + +When DMA is not enabled, this revert results in an increase of about 27% +in throughput and decrease of about 20% in CPU usage. However, the CPU +usage and throughput are almost the same when used with DMA. + +Therefore, fix this by reverting the commit which switched to using +readl_poll_timeout(). + +Fixes: 13d515c796ad ("spi: omap2-mcspi: Switch to readl_poll_timeout()") +Signed-off-by: Aswath Govindraju +Link: https://lore.kernel.org/r/20200910122624.8769-1-a-govindraju@ti.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-omap2-mcspi.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index e9e256718ef4a..10d8a722b0833 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -24,7 +24,6 @@ + #include + #include + #include +-#include + + #include + #include +@@ -349,9 +348,19 @@ static void omap2_mcspi_set_fifo(const struct spi_device *spi, + + static int mcspi_wait_for_reg_bit(void __iomem *reg, unsigned long bit) + { +- u32 val; +- +- return readl_poll_timeout(reg, val, val & bit, 1, MSEC_PER_SEC); ++ unsigned long timeout; ++ ++ timeout = jiffies + msecs_to_jiffies(1000); ++ while (!(readl_relaxed(reg) & bit)) { ++ if (time_after(jiffies, timeout)) { ++ if (!(readl_relaxed(reg) & bit)) ++ return -ETIMEDOUT; ++ else ++ return 0; ++ } ++ cpu_relax(); ++ } ++ return 0; + } + + static int mcspi_wait_for_completion(struct omap2_mcspi *mcspi, +-- +2.25.1 + diff --git a/queue-5.8/spi-spi-s3c64xx-check-return-values.patch b/queue-5.8/spi-spi-s3c64xx-check-return-values.patch new file mode 100644 index 00000000000..ebbd3fb7438 --- /dev/null +++ b/queue-5.8/spi-spi-s3c64xx-check-return-values.patch @@ -0,0 +1,183 @@ +From 904b163c79ed0f953f0f4f2336dfc9d010f0906e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Oct 2020 14:22:37 +0200 +Subject: spi: spi-s3c64xx: Check return values +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Łukasz Stelmach + +[ Upstream commit 2f4db6f705c5cba85d23836c19b44d9687dc1334 ] + +Check return values in prepare_dma() and s3c64xx_spi_config() and +propagate errors upwards. + +Fixes: 788437273fa8 ("spi: s3c64xx: move to generic dmaengine API") +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Łukasz Stelmach +Link: https://lore.kernel.org/r/20201002122243.26849-4-l.stelmach@samsung.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c64xx.c | 50 ++++++++++++++++++++++++++++++++------- + 1 file changed, 41 insertions(+), 9 deletions(-) + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index fb5e2ba4b6b97..6587a7dc3f5ba 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -122,6 +122,7 @@ + + struct s3c64xx_spi_dma_data { + struct dma_chan *ch; ++ dma_cookie_t cookie; + enum dma_transfer_direction direction; + }; + +@@ -264,12 +265,13 @@ static void s3c64xx_spi_dmacb(void *data) + spin_unlock_irqrestore(&sdd->lock, flags); + } + +-static void prepare_dma(struct s3c64xx_spi_dma_data *dma, ++static int prepare_dma(struct s3c64xx_spi_dma_data *dma, + struct sg_table *sgt) + { + struct s3c64xx_spi_driver_data *sdd; + struct dma_slave_config config; + struct dma_async_tx_descriptor *desc; ++ int ret; + + memset(&config, 0, sizeof(config)); + +@@ -293,12 +295,24 @@ static void prepare_dma(struct s3c64xx_spi_dma_data *dma, + + desc = dmaengine_prep_slave_sg(dma->ch, sgt->sgl, sgt->nents, + dma->direction, DMA_PREP_INTERRUPT); ++ if (!desc) { ++ dev_err(&sdd->pdev->dev, "unable to prepare %s scatterlist", ++ dma->direction == DMA_DEV_TO_MEM ? "rx" : "tx"); ++ return -ENOMEM; ++ } + + desc->callback = s3c64xx_spi_dmacb; + desc->callback_param = dma; + +- dmaengine_submit(desc); ++ dma->cookie = dmaengine_submit(desc); ++ ret = dma_submit_error(dma->cookie); ++ if (ret) { ++ dev_err(&sdd->pdev->dev, "DMA submission failed"); ++ return -EIO; ++ } ++ + dma_async_issue_pending(dma->ch); ++ return 0; + } + + static void s3c64xx_spi_set_cs(struct spi_device *spi, bool enable) +@@ -348,11 +362,12 @@ static bool s3c64xx_spi_can_dma(struct spi_master *master, + return xfer->len > (FIFO_LVL_MASK(sdd) >> 1) + 1; + } + +-static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd, ++static int s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd, + struct spi_transfer *xfer, int dma_mode) + { + void __iomem *regs = sdd->regs; + u32 modecfg, chcfg; ++ int ret = 0; + + modecfg = readl(regs + S3C64XX_SPI_MODE_CFG); + modecfg &= ~(S3C64XX_SPI_MODE_TXDMA_ON | S3C64XX_SPI_MODE_RXDMA_ON); +@@ -378,7 +393,7 @@ static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd, + chcfg |= S3C64XX_SPI_CH_TXCH_ON; + if (dma_mode) { + modecfg |= S3C64XX_SPI_MODE_TXDMA_ON; +- prepare_dma(&sdd->tx_dma, &xfer->tx_sg); ++ ret = prepare_dma(&sdd->tx_dma, &xfer->tx_sg); + } else { + switch (sdd->cur_bpw) { + case 32: +@@ -410,12 +425,17 @@ static void s3c64xx_enable_datapath(struct s3c64xx_spi_driver_data *sdd, + writel(((xfer->len * 8 / sdd->cur_bpw) & 0xffff) + | S3C64XX_SPI_PACKET_CNT_EN, + regs + S3C64XX_SPI_PACKET_CNT); +- prepare_dma(&sdd->rx_dma, &xfer->rx_sg); ++ ret = prepare_dma(&sdd->rx_dma, &xfer->rx_sg); + } + } + ++ if (ret) ++ return ret; ++ + writel(modecfg, regs + S3C64XX_SPI_MODE_CFG); + writel(chcfg, regs + S3C64XX_SPI_CH_CFG); ++ ++ return 0; + } + + static u32 s3c64xx_spi_wait_for_timeout(struct s3c64xx_spi_driver_data *sdd, +@@ -548,9 +568,10 @@ static int s3c64xx_wait_for_pio(struct s3c64xx_spi_driver_data *sdd, + return 0; + } + +-static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd) ++static int s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd) + { + void __iomem *regs = sdd->regs; ++ int ret; + u32 val; + + /* Disable Clock */ +@@ -598,7 +619,9 @@ static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd) + + if (sdd->port_conf->clk_from_cmu) { + /* The src_clk clock is divided internally by 2 */ +- clk_set_rate(sdd->src_clk, sdd->cur_speed * 2); ++ ret = clk_set_rate(sdd->src_clk, sdd->cur_speed * 2); ++ if (ret) ++ return ret; + } else { + /* Configure Clock */ + val = readl(regs + S3C64XX_SPI_CLK_CFG); +@@ -612,6 +635,8 @@ static void s3c64xx_spi_config(struct s3c64xx_spi_driver_data *sdd) + val |= S3C64XX_SPI_ENCLK_ENABLE; + writel(val, regs + S3C64XX_SPI_CLK_CFG); + } ++ ++ return 0; + } + + #define XFER_DMAADDR_INVALID DMA_BIT_MASK(32) +@@ -654,7 +679,9 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master, + sdd->cur_bpw = bpw; + sdd->cur_speed = speed; + sdd->cur_mode = spi->mode; +- s3c64xx_spi_config(sdd); ++ status = s3c64xx_spi_config(sdd); ++ if (status) ++ return status; + } + + if (!is_polling(sdd) && (xfer->len > fifo_len) && +@@ -681,10 +708,15 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master, + /* Start the signals */ + s3c64xx_spi_set_cs(spi, true); + +- s3c64xx_enable_datapath(sdd, xfer, use_dma); ++ status = s3c64xx_enable_datapath(sdd, xfer, use_dma); + + spin_unlock_irqrestore(&sdd->lock, flags); + ++ if (status) { ++ dev_err(&spi->dev, "failed to enable data path for transfer: %d\n", status); ++ break; ++ } ++ + if (use_dma) + status = s3c64xx_wait_for_dma(sdd, xfer); + else +-- +2.25.1 + diff --git a/queue-5.8/spi-spi-s3c64xx-swap-s3c64xx_spi_set_cs-and-s3c64xx_.patch b/queue-5.8/spi-spi-s3c64xx-swap-s3c64xx_spi_set_cs-and-s3c64xx_.patch new file mode 100644 index 00000000000..4ab8263ed3a --- /dev/null +++ b/queue-5.8/spi-spi-s3c64xx-swap-s3c64xx_spi_set_cs-and-s3c64xx_.patch @@ -0,0 +1,47 @@ +From 59771445d123e73c1b0cdc99fe5658ae5ddfa455 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Oct 2020 14:22:35 +0200 +Subject: spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and + s3c64xx_enable_datapath() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Łukasz Stelmach + +[ Upstream commit 581e2b41977dfc2d4c26c8e976f89c43bb92f9bf ] + +Fix issues with DMA transfers bigger than 512 bytes on Exynos3250. Without +the patches such transfers fail to complete. This solution to the problem +is found in the vendor kernel for ARTIK5 boards based on Exynos3250. + +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Łukasz Stelmach +Link: https://lore.kernel.org/r/20201002122243.26849-2-l.stelmach@samsung.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-s3c64xx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index cf67ea60dc0ed..fb5e2ba4b6b97 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -678,11 +678,11 @@ static int s3c64xx_spi_transfer_one(struct spi_master *master, + sdd->state &= ~RXBUSY; + sdd->state &= ~TXBUSY; + +- s3c64xx_enable_datapath(sdd, xfer, use_dma); +- + /* Start the signals */ + s3c64xx_spi_set_cs(spi, true); + ++ s3c64xx_enable_datapath(sdd, xfer, use_dma); ++ + spin_unlock_irqrestore(&sdd->lock, flags); + + if (use_dma) +-- +2.25.1 + diff --git a/queue-5.8/staging-emxx_udc-fix-passing-of-null-to-dma_alloc_co.patch b/queue-5.8/staging-emxx_udc-fix-passing-of-null-to-dma_alloc_co.patch new file mode 100644 index 00000000000..ece0f7cefbf --- /dev/null +++ b/queue-5.8/staging-emxx_udc-fix-passing-of-null-to-dma_alloc_co.patch @@ -0,0 +1,51 @@ +From b238fdc67e7d4e9f92da8772d31f1ca2436301cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 10:19:28 +0100 +Subject: staging: emxx_udc: Fix passing of NULL to dma_alloc_coherent() + +From: Alex Dewar + +[ Upstream commit cc34073c6248e9cec801bf690d1455f264d12357 ] + +In nbu2ss_eq_queue() memory is allocated with dma_alloc_coherent(), +though, strangely, NULL is passed as the struct device* argument. Pass +the UDC's device instead. Fix up the corresponding call to +dma_free_coherent() in the same way. + +Build-tested on x86 only. + +Fixes: 33aa8d45a4fe ("staging: emxx_udc: Add Emma Mobile USB Gadget driver") +Reported-by: Dan Carpenter +Signed-off-by: Alex Dewar +Link: https://lore.kernel.org/r/20200825091928.55794-1-alex.dewar90@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/emxx_udc/emxx_udc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c +index 03929b9d3a8bc..d0725bc8b48a4 100644 +--- a/drivers/staging/emxx_udc/emxx_udc.c ++++ b/drivers/staging/emxx_udc/emxx_udc.c +@@ -2593,7 +2593,7 @@ static int nbu2ss_ep_queue(struct usb_ep *_ep, + + if (req->unaligned) { + if (!ep->virt_buf) +- ep->virt_buf = dma_alloc_coherent(NULL, PAGE_SIZE, ++ ep->virt_buf = dma_alloc_coherent(udc->dev, PAGE_SIZE, + &ep->phys_buf, + GFP_ATOMIC | GFP_DMA); + if (ep->epnum > 0) { +@@ -3148,7 +3148,7 @@ static int nbu2ss_drv_remove(struct platform_device *pdev) + for (i = 0; i < NUM_ENDPOINTS; i++) { + ep = &udc->ep[i]; + if (ep->virt_buf) +- dma_free_coherent(NULL, PAGE_SIZE, (void *)ep->virt_buf, ++ dma_free_coherent(udc->dev, PAGE_SIZE, (void *)ep->virt_buf, + ep->phys_buf); + } + +-- +2.25.1 + diff --git a/queue-5.8/staging-rtl8192u-do-not-use-gfp_kernel-in-atomic-con.patch b/queue-5.8/staging-rtl8192u-do-not-use-gfp_kernel-in-atomic-con.patch new file mode 100644 index 00000000000..56d94203cb8 --- /dev/null +++ b/queue-5.8/staging-rtl8192u-do-not-use-gfp_kernel-in-atomic-con.patch @@ -0,0 +1,47 @@ +From 0f34353ba972ca24fb4c8b042068c0a30ad6ed32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 19:34:58 +0200 +Subject: staging: rtl8192u: Do not use GFP_KERNEL in atomic context + +From: Christophe JAILLET + +[ Upstream commit acac75bb451fd39344eb54fad6602dfc9482e970 ] + +'rtl8192_irq_rx_tasklet()' is a tasklet initialized in +'rtl8192_init_priv_task()'. +>From this function it is possible to allocate some memory with the +GFP_KERNEL flag, which is not allowed in the atomic context of a tasklet. + +Use GFP_ATOMIC instead. + +The call chain is: + rtl8192_irq_rx_tasklet (in r8192U_core.c) + --> rtl8192_rx_nomal (in r8192U_core.c) + --> ieee80211_rx (in ieee80211/ieee80211_rx.c) + --> RxReorderIndicatePacket (in ieee80211/ieee80211_rx.c) + +Fixes: 79a5ccd97209 ("staging: rtl8192u: fix large frame size compiler warning") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20200813173458.758284-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c +index 195d963c4fbb4..b6fee7230ce05 100644 +--- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c ++++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c +@@ -597,7 +597,7 @@ static void RxReorderIndicatePacket(struct ieee80211_device *ieee, + + prxbIndicateArray = kmalloc_array(REORDER_WIN_SIZE, + sizeof(struct ieee80211_rxb *), +- GFP_KERNEL); ++ GFP_ATOMIC); + if (!prxbIndicateArray) + return; + +-- +2.25.1 + diff --git a/queue-5.8/staging-wfx-fix-handling-of-mmic-error.patch b/queue-5.8/staging-wfx-fix-handling-of-mmic-error.patch new file mode 100644 index 00000000000..dbdf666f1d1 --- /dev/null +++ b/queue-5.8/staging-wfx-fix-handling-of-mmic-error.patch @@ -0,0 +1,46 @@ +From d4cf5f501bdb2898a79e46bfb87463c1f773628a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Oct 2020 12:19:37 +0200 +Subject: staging: wfx: fix handling of MMIC error +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jérôme Pouiller + +[ Upstream commit 8d350c14ee5eb62ecd40b0991248bfbce511954d ] + +As expected, when the device detect a MMIC error, it returns a specific +status. However, it also strip IV from the frame (don't ask me why). + +So, with the current code, mac80211 detects a corrupted frame and it +drops it before it handle the MMIC error. The expected behavior would be +to detect MMIC error then to renegotiate the EAP session. + +So, this patch correctly informs mac80211 that IV is not available. So, +mac80211 correctly takes into account the MMIC error. + +Signed-off-by: Jérôme Pouiller +Link: https://lore.kernel.org/r/20201007101943.749898-2-Jerome.Pouiller@silabs.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/wfx/data_rx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/wfx/data_rx.c b/drivers/staging/wfx/data_rx.c +index 0e959ebc38b56..a9fb5165b33d9 100644 +--- a/drivers/staging/wfx/data_rx.c ++++ b/drivers/staging/wfx/data_rx.c +@@ -80,7 +80,7 @@ void wfx_rx_cb(struct wfx_vif *wvif, + goto drop; + + if (arg->status == HIF_STATUS_RX_FAIL_MIC) +- hdr->flag |= RX_FLAG_MMIC_ERROR; ++ hdr->flag |= RX_FLAG_MMIC_ERROR | RX_FLAG_IV_STRIPPED; + else if (arg->status) + goto drop; + +-- +2.25.1 + diff --git a/queue-5.8/sunrpc-fix-copying-of-multiple-pages-in-gss_read_pro.patch b/queue-5.8/sunrpc-fix-copying-of-multiple-pages-in-gss_read_pro.patch new file mode 100644 index 00000000000..2f97f3423e6 --- /dev/null +++ b/queue-5.8/sunrpc-fix-copying-of-multiple-pages-in-gss_read_pro.patch @@ -0,0 +1,84 @@ +From 633b7c0ec3e2f042a0606b13cb10bbebcca0c7cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Oct 2020 13:42:27 +0200 +Subject: SUNRPC: fix copying of multiple pages in gss_read_proxy_verf() + +From: Martijn de Gouw + +[ Upstream commit d48c8124749c9a5081fe68680f83605e272c984b ] + +When the passed token is longer than 4032 bytes, the remaining part +of the token must be copied from the rqstp->rq_arg.pages. But the +copy must make sure it happens in a consecutive way. + +With the existing code, the first memcpy copies 'length' bytes from +argv->iobase, but since the header is in front, this never fills the +whole first page of in_token->pages. + +The mecpy in the loop copies the following bytes, but starts writing at +the next page of in_token->pages. This leaves the last bytes of page 0 +unwritten. + +Symptoms were that users with many groups were not able to access NFS +exports, when using Active Directory as the KDC. + +Signed-off-by: Martijn de Gouw +Fixes: 5866efa8cbfb "SUNRPC: Fix svcauth_gss_proxy_init()" +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + net/sunrpc/auth_gss/svcauth_gss.c | 27 +++++++++++++++++---------- + 1 file changed, 17 insertions(+), 10 deletions(-) + +diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c +index c28051f7d217d..653c317694406 100644 +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -1104,9 +1104,9 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp, + struct gssp_in_token *in_token) + { + struct kvec *argv = &rqstp->rq_arg.head[0]; +- unsigned int page_base, length; +- int pages, i, res; +- size_t inlen; ++ unsigned int length, pgto_offs, pgfrom_offs; ++ int pages, i, res, pgto, pgfrom; ++ size_t inlen, to_offs, from_offs; + + res = gss_read_common_verf(gc, argv, authp, in_handle); + if (res) +@@ -1134,17 +1134,24 @@ static int gss_read_proxy_verf(struct svc_rqst *rqstp, + memcpy(page_address(in_token->pages[0]), argv->iov_base, length); + inlen -= length; + +- i = 1; +- page_base = rqstp->rq_arg.page_base; ++ to_offs = length; ++ from_offs = rqstp->rq_arg.page_base; + while (inlen) { +- length = min_t(unsigned int, inlen, PAGE_SIZE); +- memcpy(page_address(in_token->pages[i]), +- page_address(rqstp->rq_arg.pages[i]) + page_base, ++ pgto = to_offs >> PAGE_SHIFT; ++ pgfrom = from_offs >> PAGE_SHIFT; ++ pgto_offs = to_offs & ~PAGE_MASK; ++ pgfrom_offs = from_offs & ~PAGE_MASK; ++ ++ length = min_t(unsigned int, inlen, ++ min_t(unsigned int, PAGE_SIZE - pgto_offs, ++ PAGE_SIZE - pgfrom_offs)); ++ memcpy(page_address(in_token->pages[pgto]) + pgto_offs, ++ page_address(rqstp->rq_arg.pages[pgfrom]) + pgfrom_offs, + length); + ++ to_offs += length; ++ from_offs += length; + inlen -= length; +- page_base = 0; +- i++; + } + return 0; + } +-- +2.25.1 + diff --git a/queue-5.8/svcrdma-fix-bounce-buffers-for-unaligned-offsets-and.patch b/queue-5.8/svcrdma-fix-bounce-buffers-for-unaligned-offsets-and.patch new file mode 100644 index 00000000000..de89b87d845 --- /dev/null +++ b/queue-5.8/svcrdma-fix-bounce-buffers-for-unaligned-offsets-and.patch @@ -0,0 +1,40 @@ +From 1ba86e9fbcffee0064fbfc6e785391f310e03616 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Oct 2020 22:33:43 +0300 +Subject: svcrdma: fix bounce buffers for unaligned offsets and multiple pages + +From: Dan Aloni + +[ Upstream commit c327a310ec4d6ecbea13185ed56c11def441d9ab ] + +This was discovered using O_DIRECT at the client side, with small +unaligned file offsets or IOs that span multiple file pages. + +Fixes: e248aa7be86 ("svcrdma: Remove max_sge check at connect time") +Signed-off-by: Dan Aloni +Signed-off-by: J. Bruce Fields +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/svc_rdma_sendto.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sunrpc/xprtrdma/svc_rdma_sendto.c b/net/sunrpc/xprtrdma/svc_rdma_sendto.c +index 38e7c3c8c4a9c..e4f410084c748 100644 +--- a/net/sunrpc/xprtrdma/svc_rdma_sendto.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_sendto.c +@@ -637,10 +637,11 @@ static int svc_rdma_pull_up_reply_msg(struct svcxprt_rdma *rdma, + while (remaining) { + len = min_t(u32, PAGE_SIZE - pageoff, remaining); + +- memcpy(dst, page_address(*ppages), len); ++ memcpy(dst, page_address(*ppages) + pageoff, len); + remaining -= len; + dst += len; + pageoff = 0; ++ ppages++; + } + } + +-- +2.25.1 + diff --git a/queue-5.8/tools-feature-add-missing-lzstd-to-the-fast-path-fea.patch b/queue-5.8/tools-feature-add-missing-lzstd-to-the-fast-path-fea.patch new file mode 100644 index 00000000000..94bb722410c --- /dev/null +++ b/queue-5.8/tools-feature-add-missing-lzstd-to-the-fast-path-fea.patch @@ -0,0 +1,57 @@ +From d3fd12ae3c587b45a5794b6348f8eaec8676c534 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 17:20:02 -0300 +Subject: tools feature: Add missing -lzstd to the fast path feature detection + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 6c014694b1d2702cdc736d17b60746e7b95ba664 ] + +We were failing that due to GTK2+ and then for the ZSTD test, which made +test-all.c, the fast path feature detection file to fail and thus +trigger building all of the feature tests, slowing down the test. + +Eventually the ZSTD test would be built and would succeed, since it had +the needed -lzstd, avoiding: + + $ cat /tmp/build/perf/feature/test-all.make.output + /usr/bin/ld: /tmp/ccRRJQ4u.o: in function `main_test_libzstd': + /home/acme/git/perf/tools/build/feature/test-libzstd.c:8: undefined reference to `ZSTD_createCStream' + /usr/bin/ld: /home/acme/git/perf/tools/build/feature/test-libzstd.c:9: undefined reference to `ZSTD_freeCStream' + collect2: error: ld returned 1 exit status + $ + +Fix it by adding -lzstd to the test-all target. + +Now I need an entry to 'perf test' to make sure that +/tmp/build/perf/feature/test-all.make.output is empty... + +Fixes: 3b1c5d9659718263 ("tools build: Implement libzstd feature check, LIBZSTD_DIR and NO_LIBZSTD defines") +Reviewed-by: Alexei Budankov +Acked-by: Namhyung Kim +Cc: Adrian Hunter +Cc: Ian Rogers +Cc: Jiri Olsa +Link: http://lore.kernel.org/lkml/20200904202611.GJ3753976@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/feature/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 1796a09365f5d..85d341e25eaec 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -89,7 +89,7 @@ __BUILDXX = $(CXX) $(CXXFLAGS) -MD -Wall -Werror -o $@ $(patsubst %.bin,%.cpp,$( + ############################### + + $(OUTPUT)test-all.bin: +- $(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -I/usr/include/slang -lslang $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma ++ $(BUILD) -fstack-protector-all -O2 -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -I/usr/include/slang -lslang $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl -lz -llzma -lzstd + + $(OUTPUT)test-hello.bin: + $(BUILD) +-- +2.25.1 + diff --git a/queue-5.8/tracing-fix-parse_synth_field-error-handling.patch b/queue-5.8/tracing-fix-parse_synth_field-error-handling.patch new file mode 100644 index 00000000000..efc40345328 --- /dev/null +++ b/queue-5.8/tracing-fix-parse_synth_field-error-handling.patch @@ -0,0 +1,61 @@ +From a13dc65d832db9a1c78952b3bcbeea0a9ee146fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Oct 2020 17:14:04 -0500 +Subject: tracing: Fix parse_synth_field() error handling + +From: Tom Zanussi + +[ Upstream commit 8fbeb52a598c7ab5aa603d6bb083b8a8d16d607a ] + +synth_field_size() returns either a positive size or an error (zero or +a negative value). However, the existing code assumes the only error +value is 0. It doesn't handle negative error codes, as it assigns +directly to field->size (a size_t; unsigned), thereby interpreting the +error code as a valid size instead. + +Do the test before assignment to field->size. + +[ axelrasmussen@google.com: changelog addition, first paragraph above ] + +Link: https://lkml.kernel.org/r/9b6946d9776b2eeb43227678158196de1c3c6e1d.1601848695.git.zanussi@kernel.org + +Fixes: 4b147936fa50 (tracing: Add support for 'synthetic' events) +Reviewed-by: Masami Hiramatsu +Tested-by: Axel Rasmussen +Signed-off-by: Tom Zanussi +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events_synth.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c +index c6cca0d1d5840..46a96686e93c6 100644 +--- a/kernel/trace/trace_events_synth.c ++++ b/kernel/trace/trace_events_synth.c +@@ -465,6 +465,7 @@ static struct synth_field *parse_synth_field(int argc, const char **argv, + struct synth_field *field; + const char *prefix = NULL, *field_type = argv[0], *field_name, *array; + int len, ret = 0; ++ ssize_t size; + + if (field_type[0] == ';') + field_type++; +@@ -520,11 +521,12 @@ static struct synth_field *parse_synth_field(int argc, const char **argv, + field->type[len - 1] = '\0'; + } + +- field->size = synth_field_size(field->type); +- if (!field->size) { ++ size = synth_field_size(field->type); ++ if (size <= 0) { + ret = -EINVAL; + goto free; + } ++ field->size = size; + + if (synth_field_is_string(field->type)) + field->is_string = true; +-- +2.25.1 + diff --git a/queue-5.8/tracing-handle-synthetic-event-array-field-type-chec.patch b/queue-5.8/tracing-handle-synthetic-event-array-field-type-chec.patch new file mode 100644 index 00000000000..d270a21dad6 --- /dev/null +++ b/queue-5.8/tracing-handle-synthetic-event-array-field-type-chec.patch @@ -0,0 +1,105 @@ +From 65ac985f22f070ff239f0ef266cd67cda0baf236 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 09:17:57 -0500 +Subject: tracing: Handle synthetic event array field type checking correctly + +From: Tom Zanussi + +[ Upstream commit 10819e25799aae564005b6049a45e9808797b3bb ] + +Since synthetic event array types are derived from the field name, +there may be a semicolon at the end of the type which should be +stripped off. + +If there are more characters following that, normal type string +checking will result in an invalid type. + +Without this patch, you can end up with an invalid field type string +that gets displayed in both the synthetic event description and the +event format: + +Before: + + # echo 'myevent char str[16]; int v' >> synthetic_events + # cat synthetic_events + myevent char[16]; str; int v + + name: myevent + ID: 1936 + format: + field:unsigned short common_type; offset:0; size:2; signed:0; + field:unsigned char common_flags; offset:2; size:1; signed:0; + field:unsigned char common_preempt_count; offset:3; size:1; signed:0; + field:int common_pid; offset:4; size:4; signed:1; + + field:char str[16];; offset:8; size:16; signed:1; + field:int v; offset:40; size:4; signed:1; + + print fmt: "str=%s, v=%d", REC->str, REC->v + +After: + + # echo 'myevent char str[16]; int v' >> synthetic_events + # cat synthetic_events + myevent char[16] str; int v + + # cat events/synthetic/myevent/format + name: myevent + ID: 1936 + format: + field:unsigned short common_type; offset:0; size:2; signed:0; + field:unsigned char common_flags; offset:2; size:1; signed:0; + field:unsigned char common_preempt_count; offset:3; size:1; signed:0; + field:int common_pid; offset:4; size:4; signed:1; + + field:char str[16]; offset:8; size:16; signed:1; + field:int v; offset:40; size:4; signed:1; + + print fmt: "str=%s, v=%d", REC->str, REC->v + +Link: https://lkml.kernel.org/r/6587663b56c2d45ab9d8c8472a2110713cdec97d.1602598160.git.zanussi@kernel.org + +[ : wrote parse_synth_field() snippet. ] +Fixes: 4b147936fa50 (tracing: Add support for 'synthetic' events) +Reported-by: Masami Hiramatsu +Tested-by: Masami Hiramatsu +Signed-off-by: Tom Zanussi +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events_synth.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/trace_events_synth.c b/kernel/trace/trace_events_synth.c +index 46a96686e93c6..c8892156db341 100644 +--- a/kernel/trace/trace_events_synth.c ++++ b/kernel/trace/trace_events_synth.c +@@ -132,7 +132,7 @@ static int synth_field_string_size(char *type) + start += sizeof("char[") - 1; + + end = strchr(type, ']'); +- if (!end || end < start) ++ if (!end || end < start || type + strlen(type) > end + 1) + return -EINVAL; + + len = end - start; +@@ -502,8 +502,14 @@ static struct synth_field *parse_synth_field(int argc, const char **argv, + if (field_type[0] == ';') + field_type++; + len = strlen(field_type) + 1; +- if (array) +- len += strlen(array); ++ ++ if (array) { ++ int l = strlen(array); ++ ++ if (l && array[l - 1] == ';') ++ l--; ++ len += l; ++ } + if (prefix) + len += strlen(prefix); + +-- +2.25.1 + diff --git a/queue-5.8/tty-hvc-fix-link-error-with-config_serial_core_conso.patch b/queue-5.8/tty-hvc-fix-link-error-with-config_serial_core_conso.patch new file mode 100644 index 00000000000..cc283542fbf --- /dev/null +++ b/queue-5.8/tty-hvc-fix-link-error-with-config_serial_core_conso.patch @@ -0,0 +1,41 @@ +From 5795a26c2fdca24f4a1be762fa979b4448f90bc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Sep 2020 14:35:35 +0800 +Subject: tty: hvc: fix link error with CONFIG_SERIAL_CORE_CONSOLE=n + +From: Yang Yingliang + +[ Upstream commit 75fc65079d8253e1c25a5f8348111a85d71e0f01 ] + +aarch64-linux-gnu-ld: drivers/tty/hvc/hvc_dcc.o: in function `dcc_early_write': +hvc_dcc.c:(.text+0x164): undefined reference to `uart_console_write' + +The driver uses the uart_console_write(), but SERIAL_CORE_CONSOLE is not +selected, so uart_console_write is not defined, then we get the error. +Fix this by selecting SERIAL_CORE_CONSOLE. + +Fixes: d1a1af2cdf19 ("hvc: dcc: Add earlycon support") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20200919063535.2809707-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/hvc/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/hvc/Kconfig b/drivers/tty/hvc/Kconfig +index d1b27b0522a3c..8d60e0ff67b4d 100644 +--- a/drivers/tty/hvc/Kconfig ++++ b/drivers/tty/hvc/Kconfig +@@ -81,6 +81,7 @@ config HVC_DCC + bool "ARM JTAG DCC console" + depends on ARM || ARM64 + select HVC_DRIVER ++ select SERIAL_CORE_CONSOLE + help + This console uses the JTAG DCC on ARM to create a console under the HVC + driver. This console is used through a JTAG only on ARM. If you don't have +-- +2.25.1 + diff --git a/queue-5.8/tty-hvcs-don-t-null-tty-driver_data-until-hvcs_clean.patch b/queue-5.8/tty-hvcs-don-t-null-tty-driver_data-until-hvcs_clean.patch new file mode 100644 index 00000000000..bdc3e04da29 --- /dev/null +++ b/queue-5.8/tty-hvcs-don-t-null-tty-driver_data-until-hvcs_clean.patch @@ -0,0 +1,66 @@ +From a38f6ecfdd09f70f93200f1598d5deea631be17e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 18:46:38 -0500 +Subject: tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() + +From: Tyrel Datwyler + +[ Upstream commit 63ffcbdad738e3d1c857027789a2273df3337624 ] + +The code currently NULLs tty->driver_data in hvcs_close() with the +intent of informing the next call to hvcs_open() that device needs to be +reconfigured. However, when hvcs_cleanup() is called we copy hvcsd from +tty->driver_data which was previoulsy NULLed by hvcs_close() and our +call to tty_port_put(&hvcsd->port) doesn't actually do anything since +&hvcsd->port ends up translating to NULL by chance. This has the side +effect that when hvcs_remove() is called we have one too many port +references preventing hvcs_destuct_port() from ever being called. This +also prevents us from reusing the /dev/hvcsX node in a future +hvcs_probe() and we can eventually run out of /dev/hvcsX devices. + +Fix this by waiting to NULL tty->driver_data in hvcs_cleanup(). + +Fixes: 27bf7c43a19c ("TTY: hvcs, add tty install") +Signed-off-by: Tyrel Datwyler +Link: https://lore.kernel.org/r/20200820234643.70412-1-tyreld@linux.ibm.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/hvc/hvcs.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c +index 55105ac38f89b..509d1042825a1 100644 +--- a/drivers/tty/hvc/hvcs.c ++++ b/drivers/tty/hvc/hvcs.c +@@ -1216,13 +1216,6 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp) + + tty_wait_until_sent(tty, HVCS_CLOSE_WAIT); + +- /* +- * This line is important because it tells hvcs_open that this +- * device needs to be re-configured the next time hvcs_open is +- * called. +- */ +- tty->driver_data = NULL; +- + free_irq(irq, hvcsd); + return; + } else if (hvcsd->port.count < 0) { +@@ -1237,6 +1230,13 @@ static void hvcs_cleanup(struct tty_struct * tty) + { + struct hvcs_struct *hvcsd = tty->driver_data; + ++ /* ++ * This line is important because it tells hvcs_open that this ++ * device needs to be re-configured the next time hvcs_open is ++ * called. ++ */ ++ tty->driver_data = NULL; ++ + tty_port_put(&hvcsd->port); + } + +-- +2.25.1 + diff --git a/queue-5.8/tty-ipwireless-fix-error-handling.patch b/queue-5.8/tty-ipwireless-fix-error-handling.patch new file mode 100644 index 00000000000..971388c0782 --- /dev/null +++ b/queue-5.8/tty-ipwireless-fix-error-handling.patch @@ -0,0 +1,60 @@ +From c6b5a87abca8d1828ee119ad714855a5cba88809 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Aug 2020 12:19:40 -0400 +Subject: tty: ipwireless: fix error handling + +From: Tong Zhang + +[ Upstream commit db332356222d9429731ab9395c89cca403828460 ] + +ipwireless_send_packet() can only return 0 on success and -ENOMEM on +error, the caller should check non zero for error condition + +Signed-off-by: Tong Zhang +Acked-by: David Sterba +Link: https://lore.kernel.org/r/20200821161942.36589-1-ztong0001@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/ipwireless/network.c | 4 ++-- + drivers/tty/ipwireless/tty.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/ipwireless/network.c b/drivers/tty/ipwireless/network.c +index cf20616340a1a..fe569f6294a24 100644 +--- a/drivers/tty/ipwireless/network.c ++++ b/drivers/tty/ipwireless/network.c +@@ -117,7 +117,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel, + skb->len, + notify_packet_sent, + network); +- if (ret == -1) { ++ if (ret < 0) { + skb_pull(skb, 2); + return 0; + } +@@ -134,7 +134,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel, + notify_packet_sent, + network); + kfree(buf); +- if (ret == -1) ++ if (ret < 0) + return 0; + } + kfree_skb(skb); +diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c +index fad3401e604d9..23584769fc292 100644 +--- a/drivers/tty/ipwireless/tty.c ++++ b/drivers/tty/ipwireless/tty.c +@@ -218,7 +218,7 @@ static int ipw_write(struct tty_struct *linux_tty, + ret = ipwireless_send_packet(tty->hardware, IPW_CHANNEL_RAS, + buf, count, + ipw_write_packet_sent_callback, tty); +- if (ret == -1) { ++ if (ret < 0) { + mutex_unlock(&tty->ipw_tty_mutex); + return 0; + } +-- +2.25.1 + diff --git a/queue-5.8/tty-serial-earlycon-dependency.patch b/queue-5.8/tty-serial-earlycon-dependency.patch new file mode 100644 index 00000000000..a6737433138 --- /dev/null +++ b/queue-5.8/tty-serial-earlycon-dependency.patch @@ -0,0 +1,38 @@ +From 6bd03f3722ebb05fa7143f0506e6fca716b1c5b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 08:39:50 -0400 +Subject: tty: serial: earlycon dependency + +From: Tong Zhang + +[ Upstream commit 0fb9342d06b0f667b915ba58bfefc030e534a218 ] + +parse_options() in drivers/tty/serial/earlycon.c calls uart_parse_earlycon +in drivers/tty/serial/serial_core.c therefore selecting SERIAL_EARLYCON +should automatically select SERIAL_CORE, otherwise will result in symbol +not found error during linking if SERIAL_CORE is not configured as builtin + +Fixes: 9aac5887595b ("tty/serial: add generic serial earlycon") +Signed-off-by: Tong Zhang +Link: https://lore.kernel.org/r/20200828123949.2642-1-ztong0001@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig +index 780908d435577..896b9c77117d3 100644 +--- a/drivers/tty/serial/Kconfig ++++ b/drivers/tty/serial/Kconfig +@@ -8,6 +8,7 @@ menu "Serial drivers" + + config SERIAL_EARLYCON + bool ++ depends on SERIAL_CORE + help + Support for early consoles with the earlycon parameter. This enables + the console before standard serial driver is probed. The console is +-- +2.25.1 + diff --git a/queue-5.8/udf-avoid-accessing-uninitialized-data-on-failed-ino.patch b/queue-5.8/udf-avoid-accessing-uninitialized-data-on-failed-ino.patch new file mode 100644 index 00000000000..fb694e3e866 --- /dev/null +++ b/queue-5.8/udf-avoid-accessing-uninitialized-data-on-failed-ino.patch @@ -0,0 +1,62 @@ +From cb6f2d5d498d76b1e1080216ea881ec270320fb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 12:14:03 +0200 +Subject: udf: Avoid accessing uninitialized data on failed inode read + +From: Jan Kara + +[ Upstream commit 044e2e26f214e5ab26af85faffd8d1e4ec066931 ] + +When we fail to read inode, some data accessed in udf_evict_inode() may +be uninitialized. Move the accesses to !is_bad_inode() branch. + +Reported-by: syzbot+91f02b28f9bb5f5f1341@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/inode.c | 25 ++++++++++++++----------- + 1 file changed, 14 insertions(+), 11 deletions(-) + +diff --git a/fs/udf/inode.c b/fs/udf/inode.c +index adaba8e8b326e..566118417e562 100644 +--- a/fs/udf/inode.c ++++ b/fs/udf/inode.c +@@ -139,21 +139,24 @@ void udf_evict_inode(struct inode *inode) + struct udf_inode_info *iinfo = UDF_I(inode); + int want_delete = 0; + +- if (!inode->i_nlink && !is_bad_inode(inode)) { +- want_delete = 1; +- udf_setsize(inode, 0); +- udf_update_inode(inode, IS_SYNC(inode)); ++ if (!is_bad_inode(inode)) { ++ if (!inode->i_nlink) { ++ want_delete = 1; ++ udf_setsize(inode, 0); ++ udf_update_inode(inode, IS_SYNC(inode)); ++ } ++ if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && ++ inode->i_size != iinfo->i_lenExtents) { ++ udf_warn(inode->i_sb, ++ "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n", ++ inode->i_ino, inode->i_mode, ++ (unsigned long long)inode->i_size, ++ (unsigned long long)iinfo->i_lenExtents); ++ } + } + truncate_inode_pages_final(&inode->i_data); + invalidate_inode_buffers(inode); + clear_inode(inode); +- if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB && +- inode->i_size != iinfo->i_lenExtents) { +- udf_warn(inode->i_sb, "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n", +- inode->i_ino, inode->i_mode, +- (unsigned long long)inode->i_size, +- (unsigned long long)iinfo->i_lenExtents); +- } + kfree(iinfo->i_ext.i_data); + iinfo->i_ext.i_data = NULL; + udf_clear_extent_cache(inode); +-- +2.25.1 + diff --git a/queue-5.8/udf-limit-sparing-table-size.patch b/queue-5.8/udf-limit-sparing-table-size.patch new file mode 100644 index 00000000000..c00bce631f6 --- /dev/null +++ b/queue-5.8/udf-limit-sparing-table-size.patch @@ -0,0 +1,40 @@ +From 745ec3abd74f2b0d60eea05524441a8dc7241a79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Sep 2020 14:53:08 +0200 +Subject: udf: Limit sparing table size + +From: Jan Kara + +[ Upstream commit 44ac6b829c4e173fdf6df18e6dd86aecf9a3dc99 ] + +Although UDF standard allows it, we don't support sparing table larger +than a single block. Check it during mount so that we don't try to +access memory beyond end of buffer. + +Reported-by: syzbot+9991561e714f597095da@syzkaller.appspotmail.com +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/udf/super.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/fs/udf/super.c b/fs/udf/super.c +index f747bf72edbe0..a6ce0ddb392c7 100644 +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -1353,6 +1353,12 @@ static int udf_load_sparable_map(struct super_block *sb, + (int)spm->numSparingTables); + return -EIO; + } ++ if (le32_to_cpu(spm->sizeSparingTable) > sb->s_blocksize) { ++ udf_err(sb, "error loading logical volume descriptor: " ++ "Too big sparing table size (%u)\n", ++ le32_to_cpu(spm->sizeSparingTable)); ++ return -EIO; ++ } + + for (i = 0; i < spm->numSparingTables; i++) { + loc = le32_to_cpu(spm->locSparingTable[i]); +-- +2.25.1 + diff --git a/queue-5.8/um-time-travel-fix-irq-handling-in-time_travel_handl.patch b/queue-5.8/um-time-travel-fix-irq-handling-in-time_travel_handl.patch new file mode 100644 index 00000000000..7ac18c11fab --- /dev/null +++ b/queue-5.8/um-time-travel-fix-irq-handling-in-time_travel_handl.patch @@ -0,0 +1,57 @@ +From fecfc43f2adda92f379ed8cca3c8b6167295176d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 11:31:12 +0200 +Subject: um: time-travel: Fix IRQ handling in time_travel_handle_message() + +From: Johannes Berg + +[ Upstream commit ebef8ea2ba967026192a26f4529890893919bc57 ] + +As the comment here indicates, we need to do the polling in the +idle loop without blocking interrupts, since interrupts can be +vhost-user messages that we must process even while in our idle +loop. + +I don't know why I explained one thing and implemented another, +but we have indeed observed random hangs due to this, depending +on the timing of the messages. + +Fixes: 88ce64249233 ("um: Implement time-travel=ext") +Signed-off-by: Johannes Berg +Acked-By: Anton Ivanov +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/kernel/time.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/arch/um/kernel/time.c b/arch/um/kernel/time.c +index 25eaa6a0c6583..c07436e89e599 100644 +--- a/arch/um/kernel/time.c ++++ b/arch/um/kernel/time.c +@@ -70,13 +70,17 @@ static void time_travel_handle_message(struct um_timetravel_msg *msg, + * read of the message and write of the ACK. + */ + if (mode != TTMH_READ) { ++ bool disabled = irqs_disabled(); ++ ++ BUG_ON(mode == TTMH_IDLE && !disabled); ++ ++ if (disabled) ++ local_irq_enable(); + while (os_poll(1, &time_travel_ext_fd) != 0) { +- if (mode == TTMH_IDLE) { +- BUG_ON(!irqs_disabled()); +- local_irq_enable(); +- local_irq_disable(); +- } ++ /* nothing */ + } ++ if (disabled) ++ local_irq_disable(); + } + + ret = os_read_file(time_travel_ext_fd, msg, sizeof(*msg)); +-- +2.25.1 + diff --git a/queue-5.8/um-vector-use-gfp_atomic-under-spin-lock.patch b/queue-5.8/um-vector-use-gfp_atomic-under-spin-lock.patch new file mode 100644 index 00000000000..66b2e1ff7b7 --- /dev/null +++ b/queue-5.8/um-vector-use-gfp_atomic-under-spin-lock.patch @@ -0,0 +1,46 @@ +From f834070d8f1e9d9a12f2fd2c1ee6fbac50e5bf86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jun 2020 13:20:07 +0800 +Subject: um: vector: Use GFP_ATOMIC under spin lock + +From: Tiezhu Yang + +[ Upstream commit e4e721fe4ccb504a29d1e8d4047667557281d932 ] + +Use GFP_ATOMIC instead of GFP_KERNEL under spin lock to fix possible +sleep-in-atomic-context bugs. + +Fixes: 9807019a62dc ("um: Loadable BPF "Firmware" for vector drivers") +Signed-off-by: Tiezhu Yang +Acked-By: Anton Ivanov +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/vector_kern.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/um/drivers/vector_kern.c b/arch/um/drivers/vector_kern.c +index 8735c468230a5..555203e3e7b45 100644 +--- a/arch/um/drivers/vector_kern.c ++++ b/arch/um/drivers/vector_kern.c +@@ -1403,7 +1403,7 @@ static int vector_net_load_bpf_flash(struct net_device *dev, + kfree(vp->bpf->filter); + vp->bpf->filter = NULL; + } else { +- vp->bpf = kmalloc(sizeof(struct sock_fprog), GFP_KERNEL); ++ vp->bpf = kmalloc(sizeof(struct sock_fprog), GFP_ATOMIC); + if (vp->bpf == NULL) { + netdev_err(dev, "failed to allocate memory for firmware\n"); + goto flash_fail; +@@ -1415,7 +1415,7 @@ static int vector_net_load_bpf_flash(struct net_device *dev, + if (request_firmware(&fw, efl->data, &vdevice->pdev.dev)) + goto flash_fail; + +- vp->bpf->filter = kmemdup(fw->data, fw->size, GFP_KERNEL); ++ vp->bpf->filter = kmemdup(fw->data, fw->size, GFP_ATOMIC); + if (!vp->bpf->filter) + goto free_buffer; + +-- +2.25.1 + diff --git a/queue-5.8/usb-cdc-acm-handle-broken-union-descriptors.patch b/queue-5.8/usb-cdc-acm-handle-broken-union-descriptors.patch new file mode 100644 index 00000000000..1eb4d67fe4b --- /dev/null +++ b/queue-5.8/usb-cdc-acm-handle-broken-union-descriptors.patch @@ -0,0 +1,61 @@ +From 35a8acf48453f46bf5b28a602f3fb56eb7bf5aeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 15:59:49 +0200 +Subject: USB: cdc-acm: handle broken union descriptors + +From: Johan Hovold + +[ Upstream commit 960c7339de27c6d6fec13b54880501c3576bb08d ] + +Handle broken union functional descriptors where the master-interface +doesn't exist or where its class is of neither Communication or Data +type (as required by the specification) by falling back to +"combined-interface" probing. + +Note that this still allows for handling union descriptors with switched +interfaces. + +This specifically makes the Whistler radio scanners TRX series devices +work with the driver without adding further quirks to the device-id +table. + +Reported-by: Daniel Caujolle-Bert +Tested-by: Daniel Caujolle-Bert +Acked-by: Oliver Neukum +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20200921135951.24045-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/class/cdc-acm.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 7499ba118665a..c02488d469185 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1243,9 +1243,21 @@ static int acm_probe(struct usb_interface *intf, + } + } + } else { ++ int class = -1; ++ + data_intf_num = union_header->bSlaveInterface0; + control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0); + data_interface = usb_ifnum_to_if(usb_dev, data_intf_num); ++ ++ if (control_interface) ++ class = control_interface->cur_altsetting->desc.bInterfaceClass; ++ ++ if (class != USB_CLASS_COMM && class != USB_CLASS_CDC_DATA) { ++ dev_dbg(&intf->dev, "Broken union descriptor, assuming single interface\n"); ++ combined_interfaces = 1; ++ control_interface = data_interface = intf; ++ goto look_for_collapsed_interface; ++ } + } + + if (!control_interface || !data_interface) { +-- +2.25.1 + diff --git a/queue-5.8/usb-core-solve-race-condition-in-anchor-cleanup-func.patch b/queue-5.8/usb-core-solve-race-condition-in-anchor-cleanup-func.patch new file mode 100644 index 00000000000..a5cc3a99243 --- /dev/null +++ b/queue-5.8/usb-core-solve-race-condition-in-anchor-cleanup-func.patch @@ -0,0 +1,202 @@ +From 95448afa0b74716cf3f9ac2749f65593a7e5c90c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Jul 2020 08:46:50 +0300 +Subject: usb: core: Solve race condition in anchor cleanup functions + +From: Eli Billauer + +[ Upstream commit fbc299437c06648afcc7891e6e2e6638dd48d4df ] + +usb_kill_anchored_urbs() is commonly used to cancel all URBs on an +anchor just before releasing resources which the URBs rely on. By doing +so, users of this function rely on that no completer callbacks will take +place from any URB on the anchor after it returns. + +However if this function is called in parallel with __usb_hcd_giveback_urb +processing a URB on the anchor, the latter may call the completer +callback after usb_kill_anchored_urbs() returns. This can lead to a +kernel panic due to use after release of memory in interrupt context. + +The race condition is that __usb_hcd_giveback_urb() first unanchors the URB +and then makes the completer callback. Such URB is hence invisible to +usb_kill_anchored_urbs(), allowing it to return before the completer has +been called, since the anchor's urb_list is empty. + +Even worse, if the racing completer callback resubmits the URB, it may +remain in the system long after usb_kill_anchored_urbs() returns. + +Hence list_empty(&anchor->urb_list), which is used in the existing +while-loop, doesn't reliably ensure that all URBs of the anchor are gone. + +A similar problem exists with usb_poison_anchored_urbs() and +usb_scuttle_anchored_urbs(). + +This patch adds an external do-while loop, which ensures that all URBs +are indeed handled before these three functions return. This change has +no effect at all unless the race condition occurs, in which case the +loop will busy-wait until the racing completer callback has finished. +This is a rare condition, so the CPU waste of this spinning is +negligible. + +The additional do-while loop relies on usb_anchor_check_wakeup(), which +returns true iff the anchor list is empty, and there is no +__usb_hcd_giveback_urb() in the system that is in the middle of the +unanchor-before-complete phase. The @suspend_wakeups member of +struct usb_anchor is used for this purpose, which was introduced to solve +another problem which the same race condition causes, in commit +6ec4147e7bdb ("usb-anchor: Delay usb_wait_anchor_empty_timeout wake up +till completion is done"). + +The surely_empty variable is necessary, because usb_anchor_check_wakeup() +must be called with the lock held to prevent races. However the spinlock +must be released and reacquired if the outer loop spins with an empty +URB list while waiting for the unanchor-before-complete passage to finish: +The completer callback may very well attempt to take the very same lock. + +To summarize, using usb_anchor_check_wakeup() means that the patched +functions can return only when the anchor's list is empty, and there is +no invisible URB being processed. Since the inner while loop finishes on +the empty list condition, the new do-while loop will terminate as well, +except for when the said race condition occurs. + +Signed-off-by: Eli Billauer +Acked-by: Oliver Neukum +Acked-by: Alan Stern +Link: https://lore.kernel.org/r/20200731054650.30644-1-eli.billauer@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/urb.c | 89 +++++++++++++++++++++++++----------------- + 1 file changed, 54 insertions(+), 35 deletions(-) + +diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c +index da923ec176122..31ca5abb4c12a 100644 +--- a/drivers/usb/core/urb.c ++++ b/drivers/usb/core/urb.c +@@ -772,11 +772,12 @@ void usb_block_urb(struct urb *urb) + EXPORT_SYMBOL_GPL(usb_block_urb); + + /** +- * usb_kill_anchored_urbs - cancel transfer requests en masse ++ * usb_kill_anchored_urbs - kill all URBs associated with an anchor + * @anchor: anchor the requests are bound to + * +- * this allows all outstanding URBs to be killed starting +- * from the back of the queue ++ * This kills all outstanding URBs starting from the back of the queue, ++ * with guarantee that no completer callbacks will take place from the ++ * anchor after this function returns. + * + * This routine should not be called by a driver after its disconnect + * method has returned. +@@ -784,20 +785,26 @@ EXPORT_SYMBOL_GPL(usb_block_urb); + void usb_kill_anchored_urbs(struct usb_anchor *anchor) + { + struct urb *victim; ++ int surely_empty; + +- spin_lock_irq(&anchor->lock); +- while (!list_empty(&anchor->urb_list)) { +- victim = list_entry(anchor->urb_list.prev, struct urb, +- anchor_list); +- /* we must make sure the URB isn't freed before we kill it*/ +- usb_get_urb(victim); +- spin_unlock_irq(&anchor->lock); +- /* this will unanchor the URB */ +- usb_kill_urb(victim); +- usb_put_urb(victim); ++ do { + spin_lock_irq(&anchor->lock); +- } +- spin_unlock_irq(&anchor->lock); ++ while (!list_empty(&anchor->urb_list)) { ++ victim = list_entry(anchor->urb_list.prev, ++ struct urb, anchor_list); ++ /* make sure the URB isn't freed before we kill it */ ++ usb_get_urb(victim); ++ spin_unlock_irq(&anchor->lock); ++ /* this will unanchor the URB */ ++ usb_kill_urb(victim); ++ usb_put_urb(victim); ++ spin_lock_irq(&anchor->lock); ++ } ++ surely_empty = usb_anchor_check_wakeup(anchor); ++ ++ spin_unlock_irq(&anchor->lock); ++ cpu_relax(); ++ } while (!surely_empty); + } + EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs); + +@@ -816,21 +823,27 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs); + void usb_poison_anchored_urbs(struct usb_anchor *anchor) + { + struct urb *victim; ++ int surely_empty; + +- spin_lock_irq(&anchor->lock); +- anchor->poisoned = 1; +- while (!list_empty(&anchor->urb_list)) { +- victim = list_entry(anchor->urb_list.prev, struct urb, +- anchor_list); +- /* we must make sure the URB isn't freed before we kill it*/ +- usb_get_urb(victim); +- spin_unlock_irq(&anchor->lock); +- /* this will unanchor the URB */ +- usb_poison_urb(victim); +- usb_put_urb(victim); ++ do { + spin_lock_irq(&anchor->lock); +- } +- spin_unlock_irq(&anchor->lock); ++ anchor->poisoned = 1; ++ while (!list_empty(&anchor->urb_list)) { ++ victim = list_entry(anchor->urb_list.prev, ++ struct urb, anchor_list); ++ /* make sure the URB isn't freed before we kill it */ ++ usb_get_urb(victim); ++ spin_unlock_irq(&anchor->lock); ++ /* this will unanchor the URB */ ++ usb_poison_urb(victim); ++ usb_put_urb(victim); ++ spin_lock_irq(&anchor->lock); ++ } ++ surely_empty = usb_anchor_check_wakeup(anchor); ++ ++ spin_unlock_irq(&anchor->lock); ++ cpu_relax(); ++ } while (!surely_empty); + } + EXPORT_SYMBOL_GPL(usb_poison_anchored_urbs); + +@@ -970,14 +983,20 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor) + { + struct urb *victim; + unsigned long flags; ++ int surely_empty; ++ ++ do { ++ spin_lock_irqsave(&anchor->lock, flags); ++ while (!list_empty(&anchor->urb_list)) { ++ victim = list_entry(anchor->urb_list.prev, ++ struct urb, anchor_list); ++ __usb_unanchor_urb(victim, anchor); ++ } ++ surely_empty = usb_anchor_check_wakeup(anchor); + +- spin_lock_irqsave(&anchor->lock, flags); +- while (!list_empty(&anchor->urb_list)) { +- victim = list_entry(anchor->urb_list.prev, struct urb, +- anchor_list); +- __usb_unanchor_urb(victim, anchor); +- } +- spin_unlock_irqrestore(&anchor->lock, flags); ++ spin_unlock_irqrestore(&anchor->lock, flags); ++ cpu_relax(); ++ } while (!surely_empty); + } + + EXPORT_SYMBOL_GPL(usb_scuttle_anchored_urbs); +-- +2.25.1 + diff --git a/queue-5.8/usb-dwc2-add-missing-cleanups-when-usb_add_gadget_ud.patch b/queue-5.8/usb-dwc2-add-missing-cleanups-when-usb_add_gadget_ud.patch new file mode 100644 index 00000000000..34fa175a46f --- /dev/null +++ b/queue-5.8/usb-dwc2-add-missing-cleanups-when-usb_add_gadget_ud.patch @@ -0,0 +1,48 @@ +From 016c305f65bfa22c7d38eaeb59813bc2d1f385e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Jul 2020 00:50:43 +0200 +Subject: usb: dwc2: Add missing cleanups when usb_add_gadget_udc() fails + +From: Martin Blumenstingl + +[ Upstream commit e1c08cf23172ed6fb228d75efc9f4c80a6812116 ] + +Call dwc2_debugfs_exit() and dwc2_hcd_remove() (if the HCD was enabled +earlier) when usb_add_gadget_udc() has failed. This ensures that the +debugfs entries created by dwc2_debugfs_init() as well as the HCD are +cleaned up in the error path. + +Fixes: 207324a321a866 ("usb: dwc2: Postponed gadget registration to the udc class driver") +Acked-by: Minas Harutyunyan +Signed-off-by: Martin Blumenstingl +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/platform.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/platform.c b/drivers/usb/dwc2/platform.c +index db9fd4bd1a38c..b28e90e0b685d 100644 +--- a/drivers/usb/dwc2/platform.c ++++ b/drivers/usb/dwc2/platform.c +@@ -584,12 +584,16 @@ static int dwc2_driver_probe(struct platform_device *dev) + if (retval) { + hsotg->gadget.udc = NULL; + dwc2_hsotg_remove(hsotg); +- goto error_init; ++ goto error_debugfs; + } + } + #endif /* CONFIG_USB_DWC2_PERIPHERAL || CONFIG_USB_DWC2_DUAL_ROLE */ + return 0; + ++error_debugfs: ++ dwc2_debugfs_exit(hsotg); ++ if (hsotg->hcd_enabled) ++ dwc2_hcd_remove(hsotg); + error_init: + if (hsotg->params.activate_stm_id_vb_detection) + regulator_disable(hsotg->usb33d); +-- +2.25.1 + diff --git a/queue-5.8/usb-dwc2-fix-intr-out-transfers-in-ddma-mode.patch b/queue-5.8/usb-dwc2-fix-intr-out-transfers-in-ddma-mode.patch new file mode 100644 index 00000000000..63778647030 --- /dev/null +++ b/queue-5.8/usb-dwc2-fix-intr-out-transfers-in-ddma-mode.patch @@ -0,0 +1,143 @@ +From c85916abdcd56db7fe53ec51cc181169943d855b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 18:08:39 +0400 +Subject: usb: dwc2: Fix INTR OUT transfers in DDMA mode. + +From: Minas Harutyunyan + +[ Upstream commit b2c586eb07efab982419f32b7c3bd96829bc8bcd ] + +In DDMA mode if INTR OUT transfers mps not multiple of 4 then single packet +corresponds to single descriptor. + +Descriptor limit set to mps and desc chain limit set to mps * +MAX_DMA_DESC_NUM_GENERIC. On that descriptors complete, to calculate +transfer size should be considered correction value for each descriptor. + +In start request function, if "continue" is true then dma buffer address +should be incremmented by offset for all type of transfers, not only for +Control DATA_OUT transfers. + +Fixes: cf77b5fb9b394 ("usb: dwc2: gadget: Transfer length limit checking for DDMA") +Fixes: e02f9aa6119e0 ("usb: dwc2: gadget: EP 0 specific DDMA programming") +Fixes: aa3e8bc81311e ("usb: dwc2: gadget: DDMA transfer start and complete") + +Signed-off-by: Minas Harutyunyan +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/gadget.c | 40 ++++++++++++++++++++++++++++++++------- + 1 file changed, 33 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index 7faf5f8c056d4..642926f9670e6 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -712,8 +712,11 @@ static u32 dwc2_hsotg_read_frameno(struct dwc2_hsotg *hsotg) + */ + static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep) + { ++ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc; + int is_isoc = hs_ep->isochronous; + unsigned int maxsize; ++ u32 mps = hs_ep->ep.maxpacket; ++ int dir_in = hs_ep->dir_in; + + if (is_isoc) + maxsize = (hs_ep->dir_in ? DEV_DMA_ISOC_TX_NBYTES_LIMIT : +@@ -722,6 +725,11 @@ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep) + else + maxsize = DEV_DMA_NBYTES_LIMIT * MAX_DMA_DESC_NUM_GENERIC; + ++ /* Interrupt OUT EP with mps not multiple of 4 */ ++ if (hs_ep->index) ++ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4)) ++ maxsize = mps * MAX_DMA_DESC_NUM_GENERIC; ++ + return maxsize; + } + +@@ -737,11 +745,14 @@ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep) + * Isochronous - descriptor rx/tx bytes bitfield limit, + * Control In/Bulk/Interrupt - multiple of mps. This will allow to not + * have concatenations from various descriptors within one packet. ++ * Interrupt OUT - if mps not multiple of 4 then a single packet corresponds ++ * to a single descriptor. + * + * Selects corresponding mask for RX/TX bytes as well. + */ + static u32 dwc2_gadget_get_desc_params(struct dwc2_hsotg_ep *hs_ep, u32 *mask) + { ++ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc; + u32 mps = hs_ep->ep.maxpacket; + int dir_in = hs_ep->dir_in; + u32 desc_size = 0; +@@ -765,6 +776,13 @@ static u32 dwc2_gadget_get_desc_params(struct dwc2_hsotg_ep *hs_ep, u32 *mask) + desc_size -= desc_size % mps; + } + ++ /* Interrupt OUT EP with mps not multiple of 4 */ ++ if (hs_ep->index) ++ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4)) { ++ desc_size = mps; ++ *mask = DEV_DMA_NBYTES_MASK; ++ } ++ + return desc_size; + } + +@@ -1123,13 +1141,7 @@ static void dwc2_hsotg_start_req(struct dwc2_hsotg *hsotg, + length += (mps - (length % mps)); + } + +- /* +- * If more data to send, adjust DMA for EP0 out data stage. +- * ureq->dma stays unchanged, hence increment it by already +- * passed passed data count before starting new transaction. +- */ +- if (!index && hsotg->ep0_state == DWC2_EP0_DATA_OUT && +- continuing) ++ if (continuing) + offset = ureq->actual; + + /* Fill DDMA chain entries */ +@@ -2320,22 +2332,36 @@ static void dwc2_hsotg_change_ep_iso_parity(struct dwc2_hsotg *hsotg, + */ + static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep) + { ++ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc; + struct dwc2_hsotg *hsotg = hs_ep->parent; + unsigned int bytes_rem = 0; ++ unsigned int bytes_rem_correction = 0; + struct dwc2_dma_desc *desc = hs_ep->desc_list; + int i; + u32 status; ++ u32 mps = hs_ep->ep.maxpacket; ++ int dir_in = hs_ep->dir_in; + + if (!desc) + return -EINVAL; + ++ /* Interrupt OUT EP with mps not multiple of 4 */ ++ if (hs_ep->index) ++ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4)) ++ bytes_rem_correction = 4 - (mps % 4); ++ + for (i = 0; i < hs_ep->desc_count; ++i) { + status = desc->status; + bytes_rem += status & DEV_DMA_NBYTES_MASK; ++ bytes_rem -= bytes_rem_correction; + + if (status & DEV_DMA_STS_MASK) + dev_err(hsotg->dev, "descriptor %d closed with %x\n", + i, status & DEV_DMA_STS_MASK); ++ ++ if (status & DEV_DMA_L) ++ break; ++ + desc++; + } + +-- +2.25.1 + diff --git a/queue-5.8/usb-dwc2-fix-parameter-type-in-function-pointer-prot.patch b/queue-5.8/usb-dwc2-fix-parameter-type-in-function-pointer-prot.patch new file mode 100644 index 00000000000..60f715a3bfb --- /dev/null +++ b/queue-5.8/usb-dwc2-fix-parameter-type-in-function-pointer-prot.patch @@ -0,0 +1,88 @@ +From d384d2c0011422045613b67f6436c74fa4e5a341 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jul 2020 23:03:54 -0700 +Subject: usb: dwc2: Fix parameter type in function pointer prototype + +From: Nathan Chancellor + +[ Upstream commit 362b9398c962c9ec563653444e15ef9032ef3a90 ] + +When booting up on a Raspberry Pi 4 with Control Flow Integrity checking +enabled, the following warning/panic happens: + +[ 1.626435] CFI failure (target: dwc2_set_bcm_params+0x0/0x4): +[ 1.632408] WARNING: CPU: 0 PID: 32 at kernel/cfi.c:30 __cfi_check_fail+0x54/0x5c +[ 1.640021] Modules linked in: +[ 1.643137] CPU: 0 PID: 32 Comm: kworker/0:1 Not tainted 5.8.0-rc6-next-20200724-00051-g89ba619726de #1 +[ 1.652693] Hardware name: Raspberry Pi 4 Model B Rev 1.2 (DT) +[ 1.658637] Workqueue: events deferred_probe_work_func +[ 1.663870] pstate: 60000005 (nZCv daif -PAN -UAO BTYPE=--) +[ 1.669542] pc : __cfi_check_fail+0x54/0x5c +[ 1.673798] lr : __cfi_check_fail+0x54/0x5c +[ 1.678050] sp : ffff8000102bbaa0 +[ 1.681419] x29: ffff8000102bbaa0 x28: ffffab09e21c7000 +[ 1.686829] x27: 0000000000000402 x26: ffff0000f6e7c228 +[ 1.692238] x25: 00000000fb7cdb0d x24: 0000000000000005 +[ 1.697647] x23: ffffab09e2515000 x22: ffffab09e069a000 +[ 1.703055] x21: 4c550309df1cf4c1 x20: ffffab09e2433c60 +[ 1.708462] x19: ffffab09e160dc50 x18: ffff0000f6e8cc78 +[ 1.713870] x17: 0000000000000041 x16: ffffab09e0bce6f8 +[ 1.719278] x15: ffffab09e1c819b7 x14: 0000000000000003 +[ 1.724686] x13: 00000000ffffefff x12: 0000000000000000 +[ 1.730094] x11: 0000000000000000 x10: 00000000ffffffff +[ 1.735501] x9 : c932f7abfc4bc600 x8 : c932f7abfc4bc600 +[ 1.740910] x7 : 077207610770075f x6 : ffff0000f6c38f00 +[ 1.746317] x5 : 0000000000000000 x4 : 0000000000000000 +[ 1.751723] x3 : 0000000000000000 x2 : 0000000000000000 +[ 1.757129] x1 : ffff8000102bb7d8 x0 : 0000000000000032 +[ 1.762539] Call trace: +[ 1.765030] __cfi_check_fail+0x54/0x5c +[ 1.768938] __cfi_check+0x5fa6c/0x66afc +[ 1.772932] dwc2_init_params+0xd74/0xd78 +[ 1.777012] dwc2_driver_probe+0x484/0x6ec +[ 1.781180] platform_drv_probe+0xb4/0x100 +[ 1.785350] really_probe+0x228/0x63c +[ 1.789076] driver_probe_device+0x80/0xc0 +[ 1.793247] __device_attach_driver+0x114/0x160 +[ 1.797857] bus_for_each_drv+0xa8/0x128 +[ 1.801851] __device_attach.llvm.14901095709067289134+0xc0/0x170 +[ 1.808050] bus_probe_device+0x44/0x100 +[ 1.812044] deferred_probe_work_func+0x78/0xb8 +[ 1.816656] process_one_work+0x204/0x3c4 +[ 1.820736] worker_thread+0x2f0/0x4c4 +[ 1.824552] kthread+0x174/0x184 +[ 1.827837] ret_from_fork+0x10/0x18 + +CFI validates that all indirect calls go to a function with the same +exact function pointer prototype. In this case, dwc2_set_bcm_params +is the target, which has a parameter of type 'struct dwc2_hsotg *', +but it is being implicitly cast to have a parameter of type 'void *' +because that is the set_params function pointer prototype. Make the +function pointer protoype match the definitions so that there is no +more violation. + +Fixes: 7de1debcd2de ("usb: dwc2: Remove platform static params") +Link: https://github.com/ClangBuiltLinux/linux/issues/1107 +Signed-off-by: Nathan Chancellor +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc2/params.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c +index ce736d67c7c34..fd73ddd8eb753 100644 +--- a/drivers/usb/dwc2/params.c ++++ b/drivers/usb/dwc2/params.c +@@ -860,7 +860,7 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg) + int dwc2_init_params(struct dwc2_hsotg *hsotg) + { + const struct of_device_id *match; +- void (*set_params)(void *data); ++ void (*set_params)(struct dwc2_hsotg *data); + + dwc2_set_default_params(hsotg); + dwc2_get_device_properties(hsotg); +-- +2.25.1 + diff --git a/queue-5.8/usb-dwc3-add-splitdisable-quirk-for-hisilicon-kirin-.patch b/queue-5.8/usb-dwc3-add-splitdisable-quirk-for-hisilicon-kirin-.patch new file mode 100644 index 00000000000..384154048b5 --- /dev/null +++ b/queue-5.8/usb-dwc3-add-splitdisable-quirk-for-hisilicon-kirin-.patch @@ -0,0 +1,126 @@ +From 814b1a1efae5dc38b27e691ff87fd284fc8150f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 09:20:56 +0200 +Subject: usb: dwc3: Add splitdisable quirk for Hisilicon Kirin Soc + +From: Yu Chen + +[ Upstream commit f580170f135af14e287560d94045624d4242d712 ] + +SPLIT_BOUNDARY_DISABLE should be set for DesignWare USB3 DRD Core +of Hisilicon Kirin Soc when dwc3 core act as host. + +[mchehab: dropped a dev_dbg() as only traces are now allowwed on this driver] + +Signed-off-by: Yu Chen +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.c | 25 +++++++++++++++++++++++++ + drivers/usb/dwc3/core.h | 7 +++++++ + 2 files changed, 32 insertions(+) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 7c5a18f9f66c8..928a85b0d1cdd 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -119,6 +119,7 @@ static void __dwc3_set_mode(struct work_struct *work) + struct dwc3 *dwc = work_to_dwc(work); + unsigned long flags; + int ret; ++ u32 reg; + + if (dwc->dr_mode != USB_DR_MODE_OTG) + return; +@@ -172,6 +173,11 @@ static void __dwc3_set_mode(struct work_struct *work) + otg_set_vbus(dwc->usb2_phy->otg, true); + phy_set_mode(dwc->usb2_generic_phy, PHY_MODE_USB_HOST); + phy_set_mode(dwc->usb3_generic_phy, PHY_MODE_USB_HOST); ++ if (dwc->dis_split_quirk) { ++ reg = dwc3_readl(dwc->regs, DWC3_GUCTL3); ++ reg |= DWC3_GUCTL3_SPLITDISABLE; ++ dwc3_writel(dwc->regs, DWC3_GUCTL3, reg); ++ } + } + break; + case DWC3_GCTL_PRTCAP_DEVICE: +@@ -1350,6 +1356,9 @@ static void dwc3_get_properties(struct dwc3 *dwc) + dwc->dis_metastability_quirk = device_property_read_bool(dev, + "snps,dis_metastability_quirk"); + ++ dwc->dis_split_quirk = device_property_read_bool(dev, ++ "snps,dis-split-quirk"); ++ + dwc->lpm_nyet_threshold = lpm_nyet_threshold; + dwc->tx_de_emphasis = tx_de_emphasis; + +@@ -1867,10 +1876,26 @@ static int dwc3_resume(struct device *dev) + + return 0; + } ++ ++static void dwc3_complete(struct device *dev) ++{ ++ struct dwc3 *dwc = dev_get_drvdata(dev); ++ u32 reg; ++ ++ if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST && ++ dwc->dis_split_quirk) { ++ reg = dwc3_readl(dwc->regs, DWC3_GUCTL3); ++ reg |= DWC3_GUCTL3_SPLITDISABLE; ++ dwc3_writel(dwc->regs, DWC3_GUCTL3, reg); ++ } ++} ++#else ++#define dwc3_complete NULL + #endif /* CONFIG_PM_SLEEP */ + + static const struct dev_pm_ops dwc3_dev_pm_ops = { + SET_SYSTEM_SLEEP_PM_OPS(dwc3_suspend, dwc3_resume) ++ .complete = dwc3_complete, + SET_RUNTIME_PM_OPS(dwc3_runtime_suspend, dwc3_runtime_resume, + dwc3_runtime_idle) + }; +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index 013f42a2b5dcc..af5533b097133 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -138,6 +138,7 @@ + #define DWC3_GEVNTCOUNT(n) (0xc40c + ((n) * 0x10)) + + #define DWC3_GHWPARAMS8 0xc600 ++#define DWC3_GUCTL3 0xc60c + #define DWC3_GFLADJ 0xc630 + + /* Device Registers */ +@@ -380,6 +381,9 @@ + /* Global User Control Register 2 */ + #define DWC3_GUCTL2_RST_ACTBITLATER BIT(14) + ++/* Global User Control Register 3 */ ++#define DWC3_GUCTL3_SPLITDISABLE BIT(14) ++ + /* Device Configuration Register */ + #define DWC3_DCFG_DEVADDR(addr) ((addr) << 3) + #define DWC3_DCFG_DEVADDR_MASK DWC3_DCFG_DEVADDR(0x7f) +@@ -1052,6 +1056,7 @@ struct dwc3_scratchpad_array { + * 2 - No de-emphasis + * 3 - Reserved + * @dis_metastability_quirk: set to disable metastability quirk. ++ * @dis_split_quirk: set to disable split boundary. + * @imod_interval: set the interrupt moderation interval in 250ns + * increments or 0 to disable. + */ +@@ -1245,6 +1250,8 @@ struct dwc3 { + + unsigned dis_metastability_quirk:1; + ++ unsigned dis_split_quirk:1; ++ + u16 imod_interval; + }; + +-- +2.25.1 + diff --git a/queue-5.8/usb-dwc3-core-properly-default-unspecified-speed.patch b/queue-5.8/usb-dwc3-core-properly-default-unspecified-speed.patch new file mode 100644 index 00000000000..3c0f27a302e --- /dev/null +++ b/queue-5.8/usb-dwc3-core-properly-default-unspecified-speed.patch @@ -0,0 +1,87 @@ +From 4dbe141aec635d1934b95d243a83392b92e6b1ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jul 2020 14:01:02 -0700 +Subject: usb: dwc3: core: Properly default unspecified speed + +From: Thinh Nguyen + +[ Upstream commit b574ce3ee45937f4a01edc98c59213bfc7effe50 ] + +If the maximum_speed is not specified, default the device speed base on +its HW capability. Don't prematurely check HW capability before +validating the maximum_speed device property. The device property takes +precedence in dwc->maximum_speed. + +Fixes: 0e1e5c47f7a9 ("usb: dwc3: add support for USB 2.0-only core configuration") +Reported-by: Chunfeng Yun +Signed-off-by: Thinh Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/core.c | 35 ++++++++++++++++++----------------- + 1 file changed, 18 insertions(+), 17 deletions(-) + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 25c686a752b0f..7c5a18f9f66c8 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -930,13 +930,6 @@ static int dwc3_core_init(struct dwc3 *dwc) + */ + dwc3_writel(dwc->regs, DWC3_GUID, LINUX_VERSION_CODE); + +- /* Handle USB2.0-only core configuration */ +- if (DWC3_GHWPARAMS3_SSPHY_IFC(dwc->hwparams.hwparams3) == +- DWC3_GHWPARAMS3_SSPHY_IFC_DIS) { +- if (dwc->maximum_speed == USB_SPEED_SUPER) +- dwc->maximum_speed = USB_SPEED_HIGH; +- } +- + ret = dwc3_phy_setup(dwc); + if (ret) + goto err0; +@@ -1382,6 +1375,8 @@ bool dwc3_has_imod(struct dwc3 *dwc) + static void dwc3_check_params(struct dwc3 *dwc) + { + struct device *dev = dwc->dev; ++ unsigned int hwparam_gen = ++ DWC3_GHWPARAMS3_SSPHY_IFC(dwc->hwparams.hwparams3); + + /* Check for proper value of imod_interval */ + if (dwc->imod_interval && !dwc3_has_imod(dwc)) { +@@ -1413,17 +1408,23 @@ static void dwc3_check_params(struct dwc3 *dwc) + dwc->maximum_speed); + /* fall through */ + case USB_SPEED_UNKNOWN: +- /* default to superspeed */ +- dwc->maximum_speed = USB_SPEED_SUPER; +- +- /* +- * default to superspeed plus if we are capable. +- */ +- if ((DWC3_IP_IS(DWC31) || DWC3_IP_IS(DWC32)) && +- (DWC3_GHWPARAMS3_SSPHY_IFC(dwc->hwparams.hwparams3) == +- DWC3_GHWPARAMS3_SSPHY_IFC_GEN2)) ++ switch (hwparam_gen) { ++ case DWC3_GHWPARAMS3_SSPHY_IFC_GEN2: + dwc->maximum_speed = USB_SPEED_SUPER_PLUS; +- ++ break; ++ case DWC3_GHWPARAMS3_SSPHY_IFC_GEN1: ++ if (DWC3_IP_IS(DWC32)) ++ dwc->maximum_speed = USB_SPEED_SUPER_PLUS; ++ else ++ dwc->maximum_speed = USB_SPEED_SUPER; ++ break; ++ case DWC3_GHWPARAMS3_SSPHY_IFC_DIS: ++ dwc->maximum_speed = USB_SPEED_HIGH; ++ break; ++ default: ++ dwc->maximum_speed = USB_SPEED_SUPER; ++ break; ++ } + break; + } + } +-- +2.25.1 + diff --git a/queue-5.8/usb-dwc3-simple-add-support-for-hikey-970.patch b/queue-5.8/usb-dwc3-simple-add-support-for-hikey-970.patch new file mode 100644 index 00000000000..4504bcdbf96 --- /dev/null +++ b/queue-5.8/usb-dwc3-simple-add-support-for-hikey-970.patch @@ -0,0 +1,95 @@ +From 73a0920a8435e3dc6970dd218b61202b62de98d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 11:58:23 +0200 +Subject: usb: dwc3: simple: add support for Hikey 970 + +From: Mauro Carvalho Chehab + +[ Upstream commit b68d9251561f33661e53dd618f1cafe7ec9ec3c2 ] + +This binding driver is needed for Hikey 970 to work, +as otherwise a Serror is produced: + + [ 1.837458] SError Interrupt on CPU0, code 0xbf000002 -- SError + [ 1.837462] CPU: 0 PID: 74 Comm: kworker/0:1 Not tainted 5.8.0+ #205 + [ 1.837463] Hardware name: HiKey970 (DT) + [ 1.837465] Workqueue: events deferred_probe_work_func + [ 1.837467] pstate: 20000005 (nzCv daif -PAN -UAO BTYPE=--) + [ 1.837468] pc : _raw_spin_unlock_irqrestore+0x18/0x50 + [ 1.837469] lr : regmap_unlock_spinlock+0x14/0x20 + [ 1.837470] sp : ffff8000124dba60 + [ 1.837471] x29: ffff8000124dba60 x28: 0000000000000000 + [ 1.837474] x27: ffff0001b7e854c8 x26: ffff80001204ea18 + [ 1.837476] x25: 0000000000000005 x24: ffff800011f918f8 + [ 1.837479] x23: ffff800011fbb588 x22: ffff0001b7e40e00 + [ 1.837481] x21: 0000000000000100 x20: 0000000000000000 + [ 1.837483] x19: ffff0001b767ec00 x18: 00000000ff10c000 + [ 1.837485] x17: 0000000000000002 x16: 0000b0740fdb9950 + [ 1.837488] x15: ffff8000116c1198 x14: ffffffffffffffff + [ 1.837490] x13: 0000000000000030 x12: 0101010101010101 + [ 1.837493] x11: 0000000000000020 x10: ffff0001bf17d130 + [ 1.837495] x9 : 0000000000000000 x8 : ffff0001b6938080 + [ 1.837497] x7 : 0000000000000000 x6 : 000000000000003f + [ 1.837500] x5 : 0000000000000000 x4 : 0000000000000000 + [ 1.837502] x3 : ffff80001096a880 x2 : 0000000000000000 + [ 1.837505] x1 : ffff0001b7e40e00 x0 : 0000000100000001 + [ 1.837507] Kernel panic - not syncing: Asynchronous SError Interrupt + [ 1.837509] CPU: 0 PID: 74 Comm: kworker/0:1 Not tainted 5.8.0+ #205 + [ 1.837510] Hardware name: HiKey970 (DT) + [ 1.837511] Workqueue: events deferred_probe_work_func + [ 1.837513] Call trace: + [ 1.837514] dump_backtrace+0x0/0x1e0 + [ 1.837515] show_stack+0x18/0x24 + [ 1.837516] dump_stack+0xc0/0x11c + [ 1.837517] panic+0x15c/0x324 + [ 1.837518] nmi_panic+0x8c/0x90 + [ 1.837519] arm64_serror_panic+0x78/0x84 + [ 1.837520] do_serror+0x158/0x15c + [ 1.837521] el1_error+0x84/0x100 + [ 1.837522] _raw_spin_unlock_irqrestore+0x18/0x50 + [ 1.837523] regmap_write+0x58/0x80 + [ 1.837524] hi3660_reset_deassert+0x28/0x34 + [ 1.837526] reset_control_deassert+0x50/0x260 + [ 1.837527] reset_control_deassert+0xf4/0x260 + [ 1.837528] dwc3_probe+0x5dc/0xe6c + [ 1.837529] platform_drv_probe+0x54/0xb0 + [ 1.837530] really_probe+0xe0/0x490 + [ 1.837531] driver_probe_device+0xf4/0x160 + [ 1.837532] __device_attach_driver+0x8c/0x114 + [ 1.837533] bus_for_each_drv+0x78/0xcc + [ 1.837534] __device_attach+0x108/0x1a0 + [ 1.837535] device_initial_probe+0x14/0x20 + [ 1.837537] bus_probe_device+0x98/0xa0 + [ 1.837538] deferred_probe_work_func+0x88/0xe0 + [ 1.837539] process_one_work+0x1cc/0x350 + [ 1.837540] worker_thread+0x2c0/0x470 + [ 1.837541] kthread+0x154/0x160 + [ 1.837542] ret_from_fork+0x10/0x30 + [ 1.837569] SMP: stopping secondary CPUs + [ 1.837570] Kernel Offset: 0x1d0000 from 0xffff800010000000 + [ 1.837571] PHYS_OFFSET: 0x0 + [ 1.837572] CPU features: 0x240002,20882004 + [ 1.837573] Memory Limit: none + +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-of-simple.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c +index 8852fbfdead4e..336253ff55749 100644 +--- a/drivers/usb/dwc3/dwc3-of-simple.c ++++ b/drivers/usb/dwc3/dwc3-of-simple.c +@@ -176,6 +176,7 @@ static const struct of_device_id of_dwc3_simple_match[] = { + { .compatible = "cavium,octeon-7130-usb-uctl" }, + { .compatible = "sprd,sc9860-dwc3" }, + { .compatible = "allwinner,sun50i-h6-dwc3" }, ++ { .compatible = "hisilicon,hi3670-dwc3" }, + { /* Sentinel */ } + }; + MODULE_DEVICE_TABLE(of, of_dwc3_simple_match); +-- +2.25.1 + diff --git a/queue-5.8/usb-gadget-f_ncm-fix-ncm_bitrate-for-superspeed-and-.patch b/queue-5.8/usb-gadget-f_ncm-fix-ncm_bitrate-for-superspeed-and-.patch new file mode 100644 index 00000000000..958437447c0 --- /dev/null +++ b/queue-5.8/usb-gadget-f_ncm-fix-ncm_bitrate-for-superspeed-and-.patch @@ -0,0 +1,70 @@ +From f11a542a87408d740a8b10a46bfa8d0b2e6cce5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 14:55:03 +0900 +Subject: usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lorenzo Colitti + +[ Upstream commit 986499b1569af980a819817f17238015b27793f6 ] + +Currently, SuperSpeed NCM gadgets report a speed of 851 Mbps +in USB_CDC_NOTIFY_SPEED_CHANGE. But the calculation appears to +assume 16 packets per microframe, and USB 3 and above no longer +use microframes. + +Maximum speed is actually much higher. On a direct connection, +theoretical throughput is at most 3.86 Gbps for gen1x1 and +9.36 Gbps for gen2x1, and I have seen gadget->host iperf +throughput of >2 Gbps for gen1x1 and >4 Gbps for gen2x1. + +Unfortunately the ConnectionSpeedChange defined in the CDC spec +only uses 32-bit values, so we can't report accurate numbers for +10Gbps and above. So, report 3.75Gbps for SuperSpeed (which is +roughly maximum theoretical performance) and 4.25Gbps for +SuperSpeed Plus (which is close to the maximum that we can report +in a 32-bit unsigned integer). + +This results in: + +[50879.191272] cdc_ncm 2-2:1.0 enx228b127e050c: renamed from usb0 +[50879.234778] cdc_ncm 2-2:1.0 enx228b127e050c: 3750 mbit/s downlink 3750 mbit/s uplink + +on SuperSpeed and: + +[50798.434527] cdc_ncm 8-2:1.0 enx228b127e050c: renamed from usb0 +[50798.524278] cdc_ncm 8-2:1.0 enx228b127e050c: 4250 mbit/s downlink 4250 mbit/s uplink + +on SuperSpeed Plus. + +Fixes: 1650113888fe ("usb: gadget: f_ncm: add SuperSpeed descriptors for CDC NCM") +Reviewed-by: Maciej Å»enczykowski +Signed-off-by: Lorenzo Colitti +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_ncm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c +index 1f638759a9533..7672fa25085b0 100644 +--- a/drivers/usb/gadget/function/f_ncm.c ++++ b/drivers/usb/gadget/function/f_ncm.c +@@ -85,8 +85,10 @@ static inline struct f_ncm *func_to_ncm(struct usb_function *f) + /* peak (theoretical) bulk transfer rate in bits-per-second */ + static inline unsigned ncm_bitrate(struct usb_gadget *g) + { +- if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) +- return 13 * 1024 * 8 * 1000 * 8; ++ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS) ++ return 4250000000U; ++ else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER) ++ return 3750000000U; + else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH) + return 13 * 512 * 8 * 1000 * 8; + else +-- +2.25.1 + diff --git a/queue-5.8/usb-gadget-function-printer-fix-use-after-free-in-__.patch b/queue-5.8/usb-gadget-function-printer-fix-use-after-free-in-__.patch new file mode 100644 index 00000000000..2731487b036 --- /dev/null +++ b/queue-5.8/usb-gadget-function-printer-fix-use-after-free-in-__.patch @@ -0,0 +1,181 @@ +From f46d922d496214ac8afc0612f7fd2f5f43fd5a38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Jun 2020 11:05:33 +0800 +Subject: usb: gadget: function: printer: fix use-after-free in __lock_acquire + +From: Zqiang + +[ Upstream commit e8d5f92b8d30bb4ade76494490c3c065e12411b1 ] + +Fix this by increase object reference count. + +BUG: KASAN: use-after-free in __lock_acquire+0x3fd4/0x4180 +kernel/locking/lockdep.c:3831 +Read of size 8 at addr ffff8880683b0018 by task syz-executor.0/3377 + +CPU: 1 PID: 3377 Comm: syz-executor.0 Not tainted 5.6.11 #1 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 +Call Trace: + __dump_stack lib/dump_stack.c:77 [inline] + dump_stack+0xce/0x128 lib/dump_stack.c:118 + print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 + __kasan_report+0x131/0x1b0 mm/kasan/report.c:506 + kasan_report+0x12/0x20 mm/kasan/common.c:641 + __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 + __lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831 + lock_acquire+0x127/0x350 kernel/locking/lockdep.c:4488 + __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] + _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 + printer_ioctl+0x4a/0x110 drivers/usb/gadget/function/f_printer.c:723 + vfs_ioctl fs/ioctl.c:47 [inline] + ksys_ioctl+0xfb/0x130 fs/ioctl.c:763 + __do_sys_ioctl fs/ioctl.c:772 [inline] + __se_sys_ioctl fs/ioctl.c:770 [inline] + __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770 + do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 + entry_SYSCALL_64_after_hwframe+0x49/0xbe +RIP: 0033:0x4531a9 +Code: ed 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 +89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d +01 f0 ff ff 0f 83 bb 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 +RSP: 002b:00007fd14ad72c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 +RAX: ffffffffffffffda RBX: 000000000073bfa8 RCX: 00000000004531a9 +RDX: fffffffffffffff9 RSI: 000000000000009e RDI: 0000000000000003 +RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004bbd61 +R13: 00000000004d0a98 R14: 00007fd14ad736d4 R15: 00000000ffffffff + +Allocated by task 2393: + save_stack+0x21/0x90 mm/kasan/common.c:72 + set_track mm/kasan/common.c:80 [inline] + __kasan_kmalloc.constprop.3+0xa7/0xd0 mm/kasan/common.c:515 + kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529 + kmem_cache_alloc_trace+0xfa/0x2d0 mm/slub.c:2813 + kmalloc include/linux/slab.h:555 [inline] + kzalloc include/linux/slab.h:669 [inline] + gprinter_alloc+0xa1/0x870 drivers/usb/gadget/function/f_printer.c:1416 + usb_get_function+0x58/0xc0 drivers/usb/gadget/functions.c:61 + config_usb_cfg_link+0x1ed/0x3e0 drivers/usb/gadget/configfs.c:444 + configfs_symlink+0x527/0x11d0 fs/configfs/symlink.c:202 + vfs_symlink+0x33d/0x5b0 fs/namei.c:4201 + do_symlinkat+0x11b/0x1d0 fs/namei.c:4228 + __do_sys_symlinkat fs/namei.c:4242 [inline] + __se_sys_symlinkat fs/namei.c:4239 [inline] + __x64_sys_symlinkat+0x73/0xb0 fs/namei.c:4239 + do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +Freed by task 3368: + save_stack+0x21/0x90 mm/kasan/common.c:72 + set_track mm/kasan/common.c:80 [inline] + kasan_set_free_info mm/kasan/common.c:337 [inline] + __kasan_slab_free+0x135/0x190 mm/kasan/common.c:476 + kasan_slab_free+0xe/0x10 mm/kasan/common.c:485 + slab_free_hook mm/slub.c:1444 [inline] + slab_free_freelist_hook mm/slub.c:1477 [inline] + slab_free mm/slub.c:3034 [inline] + kfree+0xf7/0x410 mm/slub.c:3995 + gprinter_free+0x49/0xd0 drivers/usb/gadget/function/f_printer.c:1353 + usb_put_function+0x38/0x50 drivers/usb/gadget/functions.c:87 + config_usb_cfg_unlink+0x2db/0x3b0 drivers/usb/gadget/configfs.c:485 + configfs_unlink+0x3b9/0x7f0 fs/configfs/symlink.c:250 + vfs_unlink+0x287/0x570 fs/namei.c:4073 + do_unlinkat+0x4f9/0x620 fs/namei.c:4137 + __do_sys_unlink fs/namei.c:4184 [inline] + __se_sys_unlink fs/namei.c:4182 [inline] + __x64_sys_unlink+0x42/0x50 fs/namei.c:4182 + do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 + entry_SYSCALL_64_after_hwframe+0x49/0xbe + +The buggy address belongs to the object at ffff8880683b0000 + which belongs to the cache kmalloc-1k of size 1024 +The buggy address is located 24 bytes inside of + 1024-byte region [ffff8880683b0000, ffff8880683b0400) +The buggy address belongs to the page: +page:ffffea0001a0ec00 refcount:1 mapcount:0 mapping:ffff88806c00e300 +index:0xffff8880683b1800 compound_mapcount: 0 +flags: 0x100000000010200(slab|head) +raw: 0100000000010200 0000000000000000 0000000600000001 ffff88806c00e300 +raw: ffff8880683b1800 000000008010000a 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Reported-by: Kyungtae Kim +Signed-off-by: Zqiang +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_printer.c | 16 ++++++++++++++-- + 1 file changed, 14 insertions(+), 2 deletions(-) + +diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c +index 9c7ed2539ff77..8ed1295d7e350 100644 +--- a/drivers/usb/gadget/function/f_printer.c ++++ b/drivers/usb/gadget/function/f_printer.c +@@ -31,6 +31,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -64,7 +65,7 @@ struct printer_dev { + struct usb_gadget *gadget; + s8 interface; + struct usb_ep *in_ep, *out_ep; +- ++ struct kref kref; + struct list_head rx_reqs; /* List of free RX structs */ + struct list_head rx_reqs_active; /* List of Active RX xfers */ + struct list_head rx_buffers; /* List of completed xfers */ +@@ -218,6 +219,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget, + + /*-------------------------------------------------------------------------*/ + ++static void printer_dev_free(struct kref *kref) ++{ ++ struct printer_dev *dev = container_of(kref, struct printer_dev, kref); ++ ++ kfree(dev); ++} ++ + static struct usb_request * + printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags) + { +@@ -348,6 +356,7 @@ printer_open(struct inode *inode, struct file *fd) + + spin_unlock_irqrestore(&dev->lock, flags); + ++ kref_get(&dev->kref); + DBG(dev, "printer_open returned %x\n", ret); + return ret; + } +@@ -365,6 +374,7 @@ printer_close(struct inode *inode, struct file *fd) + dev->printer_status &= ~PRINTER_SELECTED; + spin_unlock_irqrestore(&dev->lock, flags); + ++ kref_put(&dev->kref, printer_dev_free); + DBG(dev, "printer_close\n"); + + return 0; +@@ -1350,7 +1360,8 @@ static void gprinter_free(struct usb_function *f) + struct f_printer_opts *opts; + + opts = container_of(f->fi, struct f_printer_opts, func_inst); +- kfree(dev); ++ ++ kref_put(&dev->kref, printer_dev_free); + mutex_lock(&opts->lock); + --opts->refcnt; + mutex_unlock(&opts->lock); +@@ -1419,6 +1430,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi) + return ERR_PTR(-ENOMEM); + } + ++ kref_init(&dev->kref); + ++opts->refcnt; + dev->minor = opts->minor; + dev->pnp_string = opts->pnp_string; +-- +2.25.1 + diff --git a/queue-5.8/usb-gadget-u_ether-enable-qmult-on-superspeed-plus-a.patch b/queue-5.8/usb-gadget-u_ether-enable-qmult-on-superspeed-plus-a.patch new file mode 100644 index 00000000000..8368ea179c2 --- /dev/null +++ b/queue-5.8/usb-gadget-u_ether-enable-qmult-on-superspeed-plus-a.patch @@ -0,0 +1,56 @@ +From 85a84ab51ad4beca9184bec6d9e6b7afc10662a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 01:19:49 +0900 +Subject: usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lorenzo Colitti + +[ Upstream commit 4eea21dc67b0c6ba15ae41b1defa113a680a858e ] + +The u_ether driver has a qmult setting that multiplies the +transmit queue length (which by default is 2). + +The intent is that it should be enabled at high/super speed, but +because the code does not explicitly check for USB_SUPER_PLUS, +it is disabled at that speed. + +Fix this by ensuring that the queue multiplier is enabled for any +wired link at high speed or above. Using >= for USB_SPEED_* +constants seems correct because it is what the gadget_is_xxxspeed +functions do. + +The queue multiplier substantially helps performance at higher +speeds. On a direct SuperSpeed Plus link to a Linux laptop, +iperf3 single TCP stream: + +Before (qmult=1): 1.3 Gbps +After (qmult=5): 3.2 Gbps + +Fixes: 04617db7aa68 ("usb: gadget: add SS descriptors to Ethernet gadget") +Reviewed-by: Maciej Å»enczykowski +Signed-off-by: Lorenzo Colitti +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_ether.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c +index fbe96ef1ac7a4..891e9f7f40d59 100644 +--- a/drivers/usb/gadget/function/u_ether.c ++++ b/drivers/usb/gadget/function/u_ether.c +@@ -93,7 +93,7 @@ struct eth_dev { + static inline int qlen(struct usb_gadget *gadget, unsigned qmult) + { + if (gadget_is_dualspeed(gadget) && (gadget->speed == USB_SPEED_HIGH || +- gadget->speed == USB_SPEED_SUPER)) ++ gadget->speed >= USB_SPEED_SUPER)) + return qmult * DEFAULT_QLEN; + else + return DEFAULT_QLEN; +-- +2.25.1 + diff --git a/queue-5.8/usb-gadget-u_serial-clear-suspended-flag-when-discon.patch b/queue-5.8/usb-gadget-u_serial-clear-suspended-flag-when-discon.patch new file mode 100644 index 00000000000..27c51d6256a --- /dev/null +++ b/queue-5.8/usb-gadget-u_serial-clear-suspended-flag-when-discon.patch @@ -0,0 +1,41 @@ +From f2e54753a912539376f9613d1fdbbf59dea02d56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 09:01:32 +0900 +Subject: usb: gadget: u_serial: clear suspended flag when disconnecting + +From: Yoshihiro Shimoda + +[ Upstream commit d98ef43bfb65b5201e1afe36aaf8c4f9d71b4307 ] + +The commit aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume +callbacks") set/cleared the suspended flag in USB bus suspend/resume +only. But, when a USB cable is disconnected in the suspend, since some +controllers will not detect USB bus resume, the suspended flag is not +cleared. After that, user cannot send any data. To fix the issue, +clears the suspended flag in the gserial_disconnect(). + +Fixes: aba3a8d01d62 ("usb: gadget: u_serial: add suspend resume callbacks") +Signed-off-by: Yoshihiro Shimoda +Tested-by: Linh Phung +Tested-by: Tam Nguyen +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_serial.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c +index 3cfc6e2eba71a..e0e3cb2f6f3bc 100644 +--- a/drivers/usb/gadget/function/u_serial.c ++++ b/drivers/usb/gadget/function/u_serial.c +@@ -1391,6 +1391,7 @@ void gserial_disconnect(struct gserial *gser) + if (port->port.tty) + tty_hangup(port->port.tty); + } ++ port->suspended = false; + spin_unlock_irqrestore(&port->port_lock, flags); + + /* disable endpoints, aborting down any active I/O */ +-- +2.25.1 + diff --git a/queue-5.8/usb-ohci-default-to-per-port-over-current-protection.patch b/queue-5.8/usb-ohci-default-to-per-port-over-current-protection.patch new file mode 100644 index 00000000000..80e37dfc596 --- /dev/null +++ b/queue-5.8/usb-ohci-default-to-per-port-over-current-protection.patch @@ -0,0 +1,78 @@ +From b76e2130ece2dd1fb6c81780b737c01d2c03400f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 09:25:11 +1200 +Subject: usb: ohci: Default to per-port over-current protection + +From: Hamish Martin + +[ Upstream commit b77d2a0a223bc139ee8904991b2922d215d02636 ] + +Some integrated OHCI controller hubs do not expose all ports of the hub +to pins on the SoC. In some cases the unconnected ports generate +spurious over-current events. For example the Broadcom 56060/Ranger 2 SoC +contains a nominally 3 port hub but only the first port is wired. + +Default behaviour for ohci-platform driver is to use global over-current +protection mode (AKA "ganged"). This leads to the spurious over-current +events affecting all ports in the hub. + +We now alter the default to use per-port over-current protection. + +This patch results in the following configuration changes depending +on quirks: +- For quirk OHCI_QUIRK_SUPERIO no changes. These systems remain set up + for ganged power switching and no over-current protection. +- For quirk OHCI_QUIRK_AMD756 or OHCI_QUIRK_HUB_POWER power switching + remains at none, while over-current protection is now guaranteed to be + set to per-port rather than the previous behaviour where it was either + none or global over-current protection depending on the value at + function entry. + +Suggested-by: Alan Stern +Acked-by: Alan Stern +Signed-off-by: Hamish Martin +Link: https://lore.kernel.org/r/20200910212512.16670-1-hamish.martin@alliedtelesis.co.nz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ohci-hcd.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c +index 4de91653a2c7b..5eb62240c7f87 100644 +--- a/drivers/usb/host/ohci-hcd.c ++++ b/drivers/usb/host/ohci-hcd.c +@@ -673,20 +673,24 @@ static int ohci_run (struct ohci_hcd *ohci) + + /* handle root hub init quirks ... */ + val = roothub_a (ohci); +- val &= ~(RH_A_PSM | RH_A_OCPM); ++ /* Configure for per-port over-current protection by default */ ++ val &= ~RH_A_NOCP; ++ val |= RH_A_OCPM; + if (ohci->flags & OHCI_QUIRK_SUPERIO) { +- /* NSC 87560 and maybe others */ ++ /* NSC 87560 and maybe others. ++ * Ganged power switching, no over-current protection. ++ */ + val |= RH_A_NOCP; +- val &= ~(RH_A_POTPGT | RH_A_NPS); +- ohci_writel (ohci, val, &ohci->regs->roothub.a); ++ val &= ~(RH_A_POTPGT | RH_A_NPS | RH_A_PSM | RH_A_OCPM); + } else if ((ohci->flags & OHCI_QUIRK_AMD756) || + (ohci->flags & OHCI_QUIRK_HUB_POWER)) { + /* hub power always on; required for AMD-756 and some +- * Mac platforms. ganged overcurrent reporting, if any. ++ * Mac platforms. + */ + val |= RH_A_NPS; +- ohci_writel (ohci, val, &ohci->regs->roothub.a); + } ++ ohci_writel(ohci, val, &ohci->regs->roothub.a); ++ + ohci_writel (ohci, RH_HS_LPSC, &ohci->regs->roothub.status); + ohci_writel (ohci, (val & RH_A_NPS) ? 0 : RH_B_PPCM, + &ohci->regs->roothub.b); +-- +2.25.1 + diff --git a/queue-5.8/vfio-add-a-singleton-check-for-vfio_group_pin_pages.patch b/queue-5.8/vfio-add-a-singleton-check-for-vfio_group_pin_pages.patch new file mode 100644 index 00000000000..fcabe93e1b4 --- /dev/null +++ b/queue-5.8/vfio-add-a-singleton-check-for-vfio_group_pin_pages.patch @@ -0,0 +1,43 @@ +From f99ed7b06de29c38fc2e4e2aaf4939bc13900760 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 10:28:33 +0800 +Subject: vfio: add a singleton check for vfio_group_pin_pages + +From: Yan Zhao + +[ Upstream commit 7ef32e52368f62a4e041a4f0abefb4fb64e7fd4a ] + +Page pinning is used both to translate and pin device mappings for DMA +purpose, as well as to indicate to the IOMMU backend to limit the dirty +page scope to those pages that have been pinned, in the case of an IOMMU +backed device. +To support this, the vfio_pin_pages() interface limits itself to only +singleton groups such that the IOMMU backend can consider dirty page +scope only at the group level. Implement the same requirement for the +vfio_group_pin_pages() interface. + +Fixes: 95fc87b44104 ("vfio: Selective dirty page tracking if IOMMU backed device pins pages") +Signed-off-by: Yan Zhao +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/vfio.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c +index 580099afeaffa..2a70e25cfe954 100644 +--- a/drivers/vfio/vfio.c ++++ b/drivers/vfio/vfio.c +@@ -2050,6 +2050,9 @@ int vfio_group_pin_pages(struct vfio_group *group, + if (!group || !user_iova_pfn || !phys_pfn || !npage) + return -EINVAL; + ++ if (group->dev_counter > 1) ++ return -EINVAL; ++ + if (npage > VFIO_PIN_PAGES_MAX_ENTRIES) + return -E2BIG; + +-- +2.25.1 + diff --git a/queue-5.8/vfio-fix-a-missed-vfio-group-put-in-vfio_pin_pages.patch b/queue-5.8/vfio-fix-a-missed-vfio-group-put-in-vfio_pin_pages.patch new file mode 100644 index 00000000000..c1916813a0f --- /dev/null +++ b/queue-5.8/vfio-fix-a-missed-vfio-group-put-in-vfio_pin_pages.patch @@ -0,0 +1,40 @@ +From e092cd4a1a550f7edea492990f27de2f747dc4a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 10:29:27 +0800 +Subject: vfio: fix a missed vfio group put in vfio_pin_pages + +From: Yan Zhao + +[ Upstream commit 28b130244061863cf0437b7af1625fb45ec1a71e ] + +When error occurs, need to put vfio group after a successful get. + +Fixes: 95fc87b44104 ("vfio: Selective dirty page tracking if IOMMU backed device pins pages") +Signed-off-by: Yan Zhao +Reviewed-by: Cornelia Huck +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/vfio.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c +index 2a70e25cfe954..fbff5c4743c5e 100644 +--- a/drivers/vfio/vfio.c ++++ b/drivers/vfio/vfio.c +@@ -1948,8 +1948,10 @@ int vfio_pin_pages(struct device *dev, unsigned long *user_pfn, int npage, + if (!group) + return -ENODEV; + +- if (group->dev_counter > 1) +- return -EINVAL; ++ if (group->dev_counter > 1) { ++ ret = -EINVAL; ++ goto err_pin_pages; ++ } + + ret = vfio_group_add_container_user(group); + if (ret) +-- +2.25.1 + diff --git a/queue-5.8/vfio-iommu-type1-fix-memory-leak-in-vfio_iommu_type1.patch b/queue-5.8/vfio-iommu-type1-fix-memory-leak-in-vfio_iommu_type1.patch new file mode 100644 index 00000000000..b11dd5e9773 --- /dev/null +++ b/queue-5.8/vfio-iommu-type1-fix-memory-leak-in-vfio_iommu_type1.patch @@ -0,0 +1,39 @@ +From 27fead4b2f383b65f1c7d8bf9a36cda2af0ac940 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Oct 2020 17:35:58 +0800 +Subject: vfio iommu type1: Fix memory leak in vfio_iommu_type1_pin_pages + +From: Xiaoyang Xu + +[ Upstream commit 2e6cfd496f5b57034cf2aec738799571b5a52124 ] + +pfn is not added to pfn_list when vfio_add_to_pfn_list fails. +vfio_unpin_page_external will exit directly without calling +vfio_iova_put_vfio_pfn. This will lead to a memory leak. + +Fixes: a54eb55045ae ("vfio iommu type1: Add support for mediated devices") +Signed-off-by: Xiaoyang Xu +[aw: simplified logic, add Fixes] +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/vfio_iommu_type1.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index eb7bb14e4f62a..00d3cf12e92c3 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -693,7 +693,8 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data, + + ret = vfio_add_to_pfn_list(dma, iova, phys_pfn[i]); + if (ret) { +- vfio_unpin_page_external(dma, iova, do_accounting); ++ if (put_pfn(phys_pfn[i], dma->prot) && do_accounting) ++ vfio_lock_acct(dma, -1, true); + goto pin_unwind; + } + +-- +2.25.1 + diff --git a/queue-5.8/vfio-pci-clear-token-on-bypass-registration-failure.patch b/queue-5.8/vfio-pci-clear-token-on-bypass-registration-failure.patch new file mode 100644 index 00000000000..000615cf219 --- /dev/null +++ b/queue-5.8/vfio-pci-clear-token-on-bypass-registration-failure.patch @@ -0,0 +1,47 @@ +From cc27c09dfe8b8cdac7693159652cab9e867308f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Oct 2020 07:13:55 -0600 +Subject: vfio/pci: Clear token on bypass registration failure + +From: Alex Williamson + +[ Upstream commit 852b1beecb6ff9326f7ca4bc0fe69ae860ebdb9e ] + +The eventfd context is used as our irqbypass token, therefore if an +eventfd is re-used, our token is the same. The irqbypass code will +return an -EBUSY in this case, but we'll still attempt to unregister +the producer, where if that duplicate token still exists, results in +removing the wrong object. Clear the token of failed producers so +that they harmlessly fall out when unregistered. + +Fixes: 6d7425f109d2 ("vfio: Register/unregister irq_bypass_producer") +Reported-by: guomin chen +Tested-by: guomin chen +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci_intrs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c +index 1d9fb25929459..869dce5f134dd 100644 +--- a/drivers/vfio/pci/vfio_pci_intrs.c ++++ b/drivers/vfio/pci/vfio_pci_intrs.c +@@ -352,11 +352,13 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev, + vdev->ctx[vector].producer.token = trigger; + vdev->ctx[vector].producer.irq = irq; + ret = irq_bypass_register_producer(&vdev->ctx[vector].producer); +- if (unlikely(ret)) ++ if (unlikely(ret)) { + dev_info(&pdev->dev, + "irq bypass producer (token %p) registration fails: %d\n", + vdev->ctx[vector].producer.token, ret); + ++ vdev->ctx[vector].producer.token = NULL; ++ } + vdev->ctx[vector].trigger = trigger; + + return 0; +-- +2.25.1 + diff --git a/queue-5.8/vfio-pci-decouple-pci_command_memory-bit-checks-from.patch b/queue-5.8/vfio-pci-decouple-pci_command_memory-bit-checks-from.patch new file mode 100644 index 00000000000..83ae60a32d2 --- /dev/null +++ b/queue-5.8/vfio-pci-decouple-pci_command_memory-bit-checks-from.patch @@ -0,0 +1,88 @@ +From dc0ffdadb23af27f33c19504df5c8aef80c5f721 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 10:59:57 -0400 +Subject: vfio/pci: Decouple PCI_COMMAND_MEMORY bit checks from is_virtfn + +From: Matthew Rosato + +[ Upstream commit 515ecd5368f1510152fa4f9b9ce55b66ac56c334 ] + +While it is true that devices with is_virtfn=1 will have a Memory Space +Enable bit that is hard-wired to 0, this is not the only case where we +see this behavior -- For example some bare-metal hypervisors lack +Memory Space Enable bit emulation for devices not setting is_virtfn +(s390). Fix this by instead checking for the newly-added +no_command_memory bit which directly denotes the need for +PCI_COMMAND_MEMORY emulation in vfio. + +Fixes: abafbc551fdd ("vfio-pci: Invalidate mmaps and block MMIO access on disabled memory") +Signed-off-by: Matthew Rosato +Reviewed-by: Niklas Schnelle +Reviewed-by: Pierre Morel +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci_config.c | 24 ++++++++++++++---------- + 1 file changed, 14 insertions(+), 10 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c +index d98843feddce0..5076d0155bc3f 100644 +--- a/drivers/vfio/pci/vfio_pci_config.c ++++ b/drivers/vfio/pci/vfio_pci_config.c +@@ -406,7 +406,7 @@ bool __vfio_pci_memory_enabled(struct vfio_pci_device *vdev) + * PF SR-IOV capability, there's therefore no need to trigger + * faults based on the virtual value. + */ +- return pdev->is_virtfn || (cmd & PCI_COMMAND_MEMORY); ++ return pdev->no_command_memory || (cmd & PCI_COMMAND_MEMORY); + } + + /* +@@ -520,8 +520,8 @@ static int vfio_basic_config_read(struct vfio_pci_device *vdev, int pos, + + count = vfio_default_config_read(vdev, pos, count, perm, offset, val); + +- /* Mask in virtual memory enable for SR-IOV devices */ +- if (offset == PCI_COMMAND && vdev->pdev->is_virtfn) { ++ /* Mask in virtual memory enable */ ++ if (offset == PCI_COMMAND && vdev->pdev->no_command_memory) { + u16 cmd = le16_to_cpu(*(__le16 *)&vdev->vconfig[PCI_COMMAND]); + u32 tmp_val = le32_to_cpu(*val); + +@@ -589,9 +589,11 @@ static int vfio_basic_config_write(struct vfio_pci_device *vdev, int pos, + * shows it disabled (phys_mem/io, then the device has + * undergone some kind of backdoor reset and needs to be + * restored before we allow it to enable the bars. +- * SR-IOV devices will trigger this, but we catch them later ++ * SR-IOV devices will trigger this - for mem enable let's ++ * catch this now and for io enable it will be caught later + */ +- if ((new_mem && virt_mem && !phys_mem) || ++ if ((new_mem && virt_mem && !phys_mem && ++ !pdev->no_command_memory) || + (new_io && virt_io && !phys_io) || + vfio_need_bar_restore(vdev)) + vfio_bar_restore(vdev); +@@ -1734,12 +1736,14 @@ int vfio_config_init(struct vfio_pci_device *vdev) + vconfig[PCI_INTERRUPT_PIN]); + + vconfig[PCI_INTERRUPT_PIN] = 0; /* Gratuitous for good VFs */ +- ++ } ++ if (pdev->no_command_memory) { + /* +- * VFs do no implement the memory enable bit of the COMMAND +- * register therefore we'll not have it set in our initial +- * copy of config space after pci_enable_device(). For +- * consistency with PFs, set the virtual enable bit here. ++ * VFs and devices that set pdev->no_command_memory do not ++ * implement the memory enable bit of the COMMAND register ++ * therefore we'll not have it set in our initial copy of ++ * config space after pci_enable_device(). For consistency ++ * with PFs, set the virtual enable bit here. + */ + *(__le16 *)&vconfig[PCI_COMMAND] |= + cpu_to_le16(PCI_COMMAND_MEMORY); +-- +2.25.1 + diff --git a/queue-5.8/vfio-type1-fix-dirty-bitmap-calculation-in-vfio_dma_.patch b/queue-5.8/vfio-type1-fix-dirty-bitmap-calculation-in-vfio_dma_.patch new file mode 100644 index 00000000000..cac039e54a2 --- /dev/null +++ b/queue-5.8/vfio-type1-fix-dirty-bitmap-calculation-in-vfio_dma_.patch @@ -0,0 +1,40 @@ +From b6b13db93239e859133f89a8a8cc5df8dcc6a417 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 10:30:05 +0800 +Subject: vfio/type1: fix dirty bitmap calculation in vfio_dma_rw + +From: Yan Zhao + +[ Upstream commit 2c5af98592f65517170c7bcc714566590d3f7397 ] + +The count of dirtied pages is not only determined by count of copied +pages, but also by the start offset. + +e.g. if offset = PAGE_SIZE - 1, and *copied=2, the dirty pages count +is 2, instead of 1 or 0. + +Fixes: d6a4c185660c ("vfio iommu: Implementation of ioctl for dirty pages tracking") +Signed-off-by: Yan Zhao +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/vfio_iommu_type1.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index f48f0db908a46..eb7bb14e4f62a 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -2899,7 +2899,8 @@ static int vfio_iommu_type1_dma_rw_chunk(struct vfio_iommu *iommu, + * size + */ + bitmap_set(dma->bitmap, offset >> pgshift, +- *copied >> pgshift); ++ ((offset + *copied - 1) >> pgshift) - ++ (offset >> pgshift) + 1); + } + } else + *copied = copy_from_user(data, (void __user *)vaddr, +-- +2.25.1 + diff --git a/queue-5.8/video-fbdev-radeon-fix-memleak-in-radeonfb_pci_regis.patch b/queue-5.8/video-fbdev-radeon-fix-memleak-in-radeonfb_pci_regis.patch new file mode 100644 index 00000000000..e35d09dd239 --- /dev/null +++ b/queue-5.8/video-fbdev-radeon-fix-memleak-in-radeonfb_pci_regis.patch @@ -0,0 +1,40 @@ +From 883a4e48f9591fc9d6bcf2cf91210202faf67880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 14:29:00 +0800 +Subject: video: fbdev: radeon: Fix memleak in radeonfb_pci_register + +From: Dinghao Liu + +[ Upstream commit fe6c6a4af2be8c15bac77f7ea160f947c04840d1 ] + +When radeon_kick_out_firmware_fb() fails, info should be +freed just like the subsequent error paths. + +Fixes: 069ee21a82344 ("fbdev: Fix loading of module radeonfb on PowerMac") +Signed-off-by: Dinghao Liu +Reviewed-by: Mathieu Malaterre +Cc: Kangjie Lu +Cc: Benjamin Herrenschmidt +Signed-off-by: Bartlomiej Zolnierkiewicz +Link: https://patchwork.freedesktop.org/patch/msgid/20200825062900.11210-1-dinghao.liu@zju.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/aty/radeon_base.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/aty/radeon_base.c b/drivers/video/fbdev/aty/radeon_base.c +index e116a3f9ad566..687bd2c0d5040 100644 +--- a/drivers/video/fbdev/aty/radeon_base.c ++++ b/drivers/video/fbdev/aty/radeon_base.c +@@ -2311,7 +2311,7 @@ static int radeonfb_pci_register(struct pci_dev *pdev, + + ret = radeon_kick_out_firmware_fb(pdev); + if (ret) +- return ret; ++ goto err_release_fb; + + /* request the mem regions */ + ret = pci_request_region(pdev, 0, "radeonfb framebuffer"); +-- +2.25.1 + diff --git a/queue-5.8/video-fbdev-sis-fix-null-ptr-dereference.patch b/queue-5.8/video-fbdev-sis-fix-null-ptr-dereference.patch new file mode 100644 index 00000000000..205e40450ed --- /dev/null +++ b/queue-5.8/video-fbdev-sis-fix-null-ptr-dereference.patch @@ -0,0 +1,78 @@ +From 9e35d90dcd1162ad16714d9ffafc5bf4d388ddae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Aug 2020 07:52:08 -0700 +Subject: video: fbdev: sis: fix null ptr dereference + +From: Tom Rix + +[ Upstream commit ad6f93e9cd56f0b10e9b22e3e137d17a1a035242 ] + +Clang static analysis reports this representative error + +init.c:2501:18: warning: Array access (from variable 'queuedata') results + in a null pointer dereference + templ |= ((queuedata[i] & 0xc0) << 3); + +This is the problem block of code + + if(ModeNo > 0x13) { + ... + if(SiS_Pr->ChipType == SIS_730) { + queuedata = &FQBQData730[0]; + } else { + queuedata = &FQBQData[0]; + } + } else { + + } + +queuedata is not set in the else block + +Reviewing the old code, the arrays FQBQData730 and FQBQData were +used directly. + +So hoist the setting of queuedata out of the if-else block. + +Fixes: 544393fe584d ("[PATCH] sisfb update") +Signed-off-by: Tom Rix +Cc: Thomas Winischhofer +Cc: Andrew Morton +Signed-off-by: Bartlomiej Zolnierkiewicz +Link: https://patchwork.freedesktop.org/patch/msgid/20200805145208.17727-1-trix@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/sis/init.c | 11 +++++------ + 1 file changed, 5 insertions(+), 6 deletions(-) + +diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c +index dfe3eb769638b..fde27feae5d0c 100644 +--- a/drivers/video/fbdev/sis/init.c ++++ b/drivers/video/fbdev/sis/init.c +@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo, + + i = 0; + ++ if (SiS_Pr->ChipType == SIS_730) ++ queuedata = &FQBQData730[0]; ++ else ++ queuedata = &FQBQData[0]; ++ + if(ModeNo > 0x13) { + + /* Get VCLK */ +@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo, + /* Get half colordepth */ + colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)]; + +- if(SiS_Pr->ChipType == SIS_730) { +- queuedata = &FQBQData730[0]; +- } else { +- queuedata = &FQBQData[0]; +- } +- + do { + templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth; + +-- +2.25.1 + diff --git a/queue-5.8/video-fbdev-vga16fb-fix-setting-of-pixclock-because-.patch b/queue-5.8/video-fbdev-vga16fb-fix-setting-of-pixclock-because-.patch new file mode 100644 index 00000000000..a17c5f7a37e --- /dev/null +++ b/queue-5.8/video-fbdev-vga16fb-fix-setting-of-pixclock-because-.patch @@ -0,0 +1,87 @@ +From be37e9a15bcff504e50a88bc2249481509c4455b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 18:02:27 +0100 +Subject: video: fbdev: vga16fb: fix setting of pixclock because a + pass-by-value error + +From: Colin Ian King + +[ Upstream commit c72fab81ceaa54408b827a2f0486d9a0f4be34cf ] + +The pixclock is being set locally because it is being passed as a +pass-by-value argument rather than pass-by-reference, so the computed +pixclock is never being set in var->pixclock. Fix this by passing +by reference. + +[This dates back to 2002, I found the offending commit from the git +history git://git.kernel.org/pub/scm/linux/kernel/git/tglx/history.git ] + +Addresses-Coverity: ("Unused value") +Signed-off-by: Colin Ian King +Cc: Daniel Vetter +Cc: Jani Nikula +[b.zolnierkie: minor patch summary fixup] +[b.zolnierkie: removed "Fixes:" tag (not in upstream tree)] +Signed-off-by: Bartlomiej Zolnierkiewicz +Link: https://patchwork.freedesktop.org/patch/msgid/20200723170227.996229-1-colin.king@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/vga16fb.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c +index 578d3541e3d6f..1e8a38a7967d8 100644 +--- a/drivers/video/fbdev/vga16fb.c ++++ b/drivers/video/fbdev/vga16fb.c +@@ -243,7 +243,7 @@ static void vga16fb_update_fix(struct fb_info *info) + } + + static void vga16fb_clock_chip(struct vga16fb_par *par, +- unsigned int pixclock, ++ unsigned int *pixclock, + const struct fb_info *info, + int mul, int div) + { +@@ -259,14 +259,14 @@ static void vga16fb_clock_chip(struct vga16fb_par *par, + { 0 /* bad */, 0x00, 0x00}}; + int err; + +- pixclock = (pixclock * mul) / div; ++ *pixclock = (*pixclock * mul) / div; + best = vgaclocks; +- err = pixclock - best->pixclock; ++ err = *pixclock - best->pixclock; + if (err < 0) err = -err; + for (ptr = vgaclocks + 1; ptr->pixclock; ptr++) { + int tmp; + +- tmp = pixclock - ptr->pixclock; ++ tmp = *pixclock - ptr->pixclock; + if (tmp < 0) tmp = -tmp; + if (tmp < err) { + err = tmp; +@@ -275,7 +275,7 @@ static void vga16fb_clock_chip(struct vga16fb_par *par, + } + par->misc |= best->misc; + par->clkdiv = best->seq_clock_mode; +- pixclock = (best->pixclock * div) / mul; ++ *pixclock = (best->pixclock * div) / mul; + } + + #define FAIL(X) return -EINVAL +@@ -497,10 +497,10 @@ static int vga16fb_check_var(struct fb_var_screeninfo *var, + + if (mode & MODE_8BPP) + /* pixel clock == vga clock / 2 */ +- vga16fb_clock_chip(par, var->pixclock, info, 1, 2); ++ vga16fb_clock_chip(par, &var->pixclock, info, 1, 2); + else + /* pixel clock == vga clock */ +- vga16fb_clock_chip(par, var->pixclock, info, 1, 1); ++ vga16fb_clock_chip(par, &var->pixclock, info, 1, 1); + + var->red.offset = var->green.offset = var->blue.offset = + var->transp.offset = 0; +-- +2.25.1 + diff --git a/queue-5.8/vmci-check-return-value-of-get_user_pages_fast-for-e.patch b/queue-5.8/vmci-check-return-value-of-get_user_pages_fast-for-e.patch new file mode 100644 index 00000000000..2dbada3de98 --- /dev/null +++ b/queue-5.8/vmci-check-return-value-of-get_user_pages_fast-for-e.patch @@ -0,0 +1,57 @@ +From a32d66e6f9ac501523ee1ca6630881e6263058e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 17:45:18 +0100 +Subject: VMCI: check return value of get_user_pages_fast() for errors + +From: Alex Dewar + +[ Upstream commit 90ca6333fd65f318c47bff425e1ea36c0a5539f6 ] + +In a couple of places in qp_host_get_user_memory(), +get_user_pages_fast() is called without properly checking for errors. If +e.g. -EFAULT is returned, this negative value will then be passed on to +qp_release_pages(), which expects a u64 as input. + +Fix this by only calling qp_release_pages() when we have a positive +number returned. + +Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.") +Signed-off-by: Alex Dewar +Link: https://lore.kernel.org/r/20200825164522.412392-1-alex.dewar90@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c +index 8531ae7811956..c49065887e8f5 100644 +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c +@@ -657,8 +657,9 @@ static int qp_host_get_user_memory(u64 produce_uva, + if (retval < (int)produce_q->kernel_if->num_pages) { + pr_debug("get_user_pages_fast(produce) failed (retval=%d)", + retval); +- qp_release_pages(produce_q->kernel_if->u.h.header_page, +- retval, false); ++ if (retval > 0) ++ qp_release_pages(produce_q->kernel_if->u.h.header_page, ++ retval, false); + err = VMCI_ERROR_NO_MEM; + goto out; + } +@@ -670,8 +671,9 @@ static int qp_host_get_user_memory(u64 produce_uva, + if (retval < (int)consume_q->kernel_if->num_pages) { + pr_debug("get_user_pages_fast(consume) failed (retval=%d)", + retval); +- qp_release_pages(consume_q->kernel_if->u.h.header_page, +- retval, false); ++ if (retval > 0) ++ qp_release_pages(consume_q->kernel_if->u.h.header_page, ++ retval, false); + qp_release_pages(produce_q->kernel_if->u.h.header_page, + produce_q->kernel_if->num_pages, false); + err = VMCI_ERROR_NO_MEM; +-- +2.25.1 + diff --git a/queue-5.8/watchdog-fix-memleak-in-watchdog_cdev_register.patch b/queue-5.8/watchdog-fix-memleak-in-watchdog_cdev_register.patch new file mode 100644 index 00000000000..c393e9ab296 --- /dev/null +++ b/queue-5.8/watchdog-fix-memleak-in-watchdog_cdev_register.patch @@ -0,0 +1,42 @@ +From 10e10dbc865c8c956662f2907bda674796fda48d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 10:40:01 +0800 +Subject: watchdog: Fix memleak in watchdog_cdev_register + +From: Dinghao Liu + +[ Upstream commit 5afb6d203d0293512aa2c6ae098274a2a4f6ed02 ] + +When watchdog_kworker is NULL, we should free wd_data +before the function returns to prevent memleak. + +Fixes: 664a39236e718 ("watchdog: Introduce hardware maximum heartbeat in watchdog core") +Signed-off-by: Dinghao Liu +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20200824024001.25474-1-dinghao.liu@zju.edu.cn +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/watchdog_dev.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index b535f5fa279b9..d772dff789f3c 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -991,8 +991,10 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) + wd_data->wdd = wdd; + wdd->wd_data = wd_data; + +- if (IS_ERR_OR_NULL(watchdog_kworker)) ++ if (IS_ERR_OR_NULL(watchdog_kworker)) { ++ kfree(wd_data); + return -ENODEV; ++ } + + device_initialize(&wd_data->dev); + wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); +-- +2.25.1 + diff --git a/queue-5.8/watchdog-sp5100-fix-definition-of-efch_pm_decodeen3.patch b/queue-5.8/watchdog-sp5100-fix-definition-of-efch_pm_decodeen3.patch new file mode 100644 index 00000000000..5df1d2956a2 --- /dev/null +++ b/queue-5.8/watchdog-sp5100-fix-definition-of-efch_pm_decodeen3.patch @@ -0,0 +1,39 @@ +From d692da34fc8a823cb49c57930741b3f3f31bd294 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 09:31:08 -0700 +Subject: watchdog: sp5100: Fix definition of EFCH_PM_DECODEEN3 + +From: Guenter Roeck + +[ Upstream commit 08c619b4923056b5dd2d5045757468c76ad0e3fe ] + +EFCH_PM_DECODEEN3 is supposed to access DECODEEN register bits 24..31, +in other words the register at byte offset 3. + +Cc: Jan Kiszka +Fixes: 887d2ec51e34b ("watchdog: sp5100_tco: Add support for recent FCH versions") +Tested-by: Jan Kiszka +Link: https://lore.kernel.org/r/20200910163109.235136-1-linux@roeck-us.net +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/sp5100_tco.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/sp5100_tco.h b/drivers/watchdog/sp5100_tco.h +index 87eaf357ae01f..adf015aa4126f 100644 +--- a/drivers/watchdog/sp5100_tco.h ++++ b/drivers/watchdog/sp5100_tco.h +@@ -70,7 +70,7 @@ + #define EFCH_PM_DECODEEN_WDT_TMREN BIT(7) + + +-#define EFCH_PM_DECODEEN3 0x00 ++#define EFCH_PM_DECODEEN3 0x03 + #define EFCH_PM_DECODEEN_SECOND_RES GENMASK(1, 0) + #define EFCH_PM_WATCHDOG_DISABLE ((u8)GENMASK(3, 2)) + +-- +2.25.1 + diff --git a/queue-5.8/watchdog-use-put_device-on-error.patch b/queue-5.8/watchdog-use-put_device-on-error.patch new file mode 100644 index 00000000000..b0714febdf3 --- /dev/null +++ b/queue-5.8/watchdog-use-put_device-on-error.patch @@ -0,0 +1,39 @@ +From 7167f8e8eaa0ffcecd92fbc788ed8ed33c346218 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 11:12:30 +0800 +Subject: watchdog: Use put_device on error + +From: Dinghao Liu + +[ Upstream commit 937425d4cd3ae4e2882b41e332bbbab616bcf0ad ] + +We should use put_device() instead of freeing device +directly after device_initialize(). + +Fixes: cb36e29bb0e4b ("watchdog: initialize device before misc_register") +Signed-off-by: Dinghao Liu +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20200824031230.31050-1-dinghao.liu@zju.edu.cn +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/watchdog_dev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index d772dff789f3c..c2065615fd6ca 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -1020,7 +1020,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) + pr_err("%s: a legacy watchdog module is probably present.\n", + wdd->info->identity); + old_wd_data = NULL; +- kfree(wd_data); ++ put_device(&wd_data->dev); + return err; + } + } +-- +2.25.1 + diff --git a/queue-5.8/wcn36xx-fix-reported-802.11n-rx_highest-rate-wcn3660.patch b/queue-5.8/wcn36xx-fix-reported-802.11n-rx_highest-rate-wcn3660.patch new file mode 100644 index 00000000000..84efc5f95dc --- /dev/null +++ b/queue-5.8/wcn36xx-fix-reported-802.11n-rx_highest-rate-wcn3660.patch @@ -0,0 +1,41 @@ +From aa5c4244a9e3f82698cd6f0701dab3c30e53f4bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 2 Aug 2020 01:48:24 +0100 +Subject: wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 + +From: Bryan O'Donoghue + +[ Upstream commit 3b9fb6791e7113679b1eb472e6ce1659e80f5797 ] + +Qualcomm's document "80-WL007-1 Rev. J" states that the highest rx rate for +the WCN3660 and WCN3680 on MCS 7 is 150 Mbps not the 72 Mbps stated here. + +This patch fixes the data-rate declared in the 5GHz table. + +Fixes: 8e84c2582169 ("wcn36xx: mac80211 driver for Qualcomm WCN3660/WCN3680 +hardware") + +Signed-off-by: Bryan O'Donoghue +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200802004824.1307124-1-bryan.odonoghue@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/wcn36xx/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c +index 702b689c06df3..f3ea629764fa8 100644 +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -163,7 +163,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = { + .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16, + .mcs = { + .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, }, +- .rx_highest = cpu_to_le16(72), ++ .rx_highest = cpu_to_le16(150), + .tx_params = IEEE80211_HT_MCS_TX_DEFINED, + } + } +-- +2.25.1 + diff --git a/queue-5.8/wilc1000-fix-memleak-in-wilc_bus_probe.patch b/queue-5.8/wilc1000-fix-memleak-in-wilc_bus_probe.patch new file mode 100644 index 00000000000..676072954b3 --- /dev/null +++ b/queue-5.8/wilc1000-fix-memleak-in-wilc_bus_probe.patch @@ -0,0 +1,43 @@ +From f1a05d4af892cf04a823203b6b9ec1b6738a21b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 13:52:56 +0800 +Subject: wilc1000: Fix memleak in wilc_bus_probe + +From: Dinghao Liu + +[ Upstream commit 9a19a939abfa7d949f584a7ad872e683473fdc14 ] + +When devm_clk_get() returns -EPROBE_DEFER, spi_priv +should be freed just like when wilc_cfg80211_init() +fails. + +Fixes: 854d66df74aed ("staging: wilc1000: look for rtc_clk clock in spi mode") +Signed-off-by: Dinghao Liu +Acked-by: Ajay Singh +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200820055256.24333-1-dinghao.liu@zju.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/staging/wilc1000/spi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/wilc1000/spi.c b/drivers/staging/wilc1000/spi.c +index 3f19e3f38a397..a18dac0aa6b67 100644 +--- a/drivers/staging/wilc1000/spi.c ++++ b/drivers/staging/wilc1000/spi.c +@@ -112,9 +112,10 @@ static int wilc_bus_probe(struct spi_device *spi) + wilc->dev_irq_num = spi->irq; + + wilc->rtc_clk = devm_clk_get(&spi->dev, "rtc_clk"); +- if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER) ++ if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER) { ++ kfree(spi_priv); + return -EPROBE_DEFER; +- else if (!IS_ERR(wilc->rtc_clk)) ++ } else if (!IS_ERR(wilc->rtc_clk)) + clk_prepare_enable(wilc->rtc_clk); + + return 0; +-- +2.25.1 + diff --git a/queue-5.8/wilc1000-fix-memleak-in-wilc_sdio_probe.patch b/queue-5.8/wilc1000-fix-memleak-in-wilc_sdio_probe.patch new file mode 100644 index 00000000000..f85a38c9bb2 --- /dev/null +++ b/queue-5.8/wilc1000-fix-memleak-in-wilc_sdio_probe.patch @@ -0,0 +1,43 @@ +From 9c103fd75ff79748d5318d947e2e2d3bdc6f5005 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 13:48:19 +0800 +Subject: wilc1000: Fix memleak in wilc_sdio_probe + +From: Dinghao Liu + +[ Upstream commit 8d95ab34b21ee0f870a9185b6457e8f6eb54914c ] + +When devm_clk_get() returns -EPROBE_DEFER, sdio_priv +should be freed just like when wilc_cfg80211_init() +fails. + +Fixes: 8692b047e86cf ("staging: wilc1000: look for rtc_clk clock") +Signed-off-by: Dinghao Liu +Acked-by: Ajay Singh +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200820054819.23365-1-dinghao.liu@zju.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/staging/wilc1000/sdio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/wilc1000/sdio.c b/drivers/staging/wilc1000/sdio.c +index 36eb589263bfd..b14e4ed6134fc 100644 +--- a/drivers/staging/wilc1000/sdio.c ++++ b/drivers/staging/wilc1000/sdio.c +@@ -151,9 +151,10 @@ static int wilc_sdio_probe(struct sdio_func *func, + wilc->dev = &func->dev; + + wilc->rtc_clk = devm_clk_get(&func->card->dev, "rtc"); +- if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER) ++ if (PTR_ERR_OR_ZERO(wilc->rtc_clk) == -EPROBE_DEFER) { ++ kfree(sdio_priv); + return -EPROBE_DEFER; +- else if (!IS_ERR(wilc->rtc_clk)) ++ } else if (!IS_ERR(wilc->rtc_clk)) + clk_prepare_enable(wilc->rtc_clk); + + dev_info(&func->dev, "Driver Initializing success\n"); +-- +2.25.1 + diff --git a/queue-5.8/x86-asm-replace-__force_order-with-a-memory-clobber.patch b/queue-5.8/x86-asm-replace-__force_order-with-a-memory-clobber.patch new file mode 100644 index 00000000000..afdba588f76 --- /dev/null +++ b/queue-5.8/x86-asm-replace-__force_order-with-a-memory-clobber.patch @@ -0,0 +1,177 @@ +From 852ee71cd82d965205cec1af79a6288ff4269f91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 19:21:52 -0400 +Subject: x86/asm: Replace __force_order with a memory clobber + +From: Arvind Sankar + +[ Upstream commit aa5cacdc29d76a005cbbee018a47faa6e724dd2d ] + +The CRn accessor functions use __force_order as a dummy operand to +prevent the compiler from reordering CRn reads/writes with respect to +each other. + +The fact that the asm is volatile should be enough to prevent this: +volatile asm statements should be executed in program order. However GCC +4.9.x and 5.x have a bug that might result in reordering. This was fixed +in 8.1, 7.3 and 6.5. Versions prior to these, including 5.x and 4.9.x, +may reorder volatile asm statements with respect to each other. + +There are some issues with __force_order as implemented: +- It is used only as an input operand for the write functions, and hence + doesn't do anything additional to prevent reordering writes. +- It allows memory accesses to be cached/reordered across write + functions, but CRn writes affect the semantics of memory accesses, so + this could be dangerous. +- __force_order is not actually defined in the kernel proper, but the + LLVM toolchain can in some cases require a definition: LLVM (as well + as GCC 4.9) requires it for PIE code, which is why the compressed + kernel has a definition, but also the clang integrated assembler may + consider the address of __force_order to be significant, resulting in + a reference that requires a definition. + +Fix this by: +- Using a memory clobber for the write functions to additionally prevent + caching/reordering memory accesses across CRn writes. +- Using a dummy input operand with an arbitrary constant address for the + read functions, instead of a global variable. This will prevent reads + from being reordered across writes, while allowing memory loads to be + cached/reordered across CRn reads, which should be safe. + +Signed-off-by: Arvind Sankar +Signed-off-by: Borislav Petkov +Reviewed-by: Kees Cook +Reviewed-by: Miguel Ojeda +Tested-by: Nathan Chancellor +Tested-by: Sedat Dilek +Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82602 +Link: https://lore.kernel.org/lkml/20200527135329.1172644-1-arnd@arndb.de/ +Link: https://lkml.kernel.org/r/20200902232152.3709896-1-nivedita@alum.mit.edu +Signed-off-by: Sasha Levin +--- + arch/x86/boot/compressed/pgtable_64.c | 9 --------- + arch/x86/include/asm/special_insns.h | 28 ++++++++++++++------------- + arch/x86/kernel/cpu/common.c | 4 ++-- + 3 files changed, 17 insertions(+), 24 deletions(-) + +diff --git a/arch/x86/boot/compressed/pgtable_64.c b/arch/x86/boot/compressed/pgtable_64.c +index c8862696a47b9..7d0394f4ebf97 100644 +--- a/arch/x86/boot/compressed/pgtable_64.c ++++ b/arch/x86/boot/compressed/pgtable_64.c +@@ -5,15 +5,6 @@ + #include "pgtable.h" + #include "../string.h" + +-/* +- * __force_order is used by special_insns.h asm code to force instruction +- * serialization. +- * +- * It is not referenced from the code, but GCC < 5 with -fPIE would fail +- * due to an undefined symbol. Define it to make these ancient GCCs work. +- */ +-unsigned long __force_order; +- + #define BIOS_START_MIN 0x20000U /* 128K, less than this is insane */ + #define BIOS_START_MAX 0x9f000U /* 640K, absolute maximum */ + +diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h +index eb8e781c43539..b8f7c9659ef6b 100644 +--- a/arch/x86/include/asm/special_insns.h ++++ b/arch/x86/include/asm/special_insns.h +@@ -11,45 +11,47 @@ + #include + + /* +- * Volatile isn't enough to prevent the compiler from reordering the +- * read/write functions for the control registers and messing everything up. +- * A memory clobber would solve the problem, but would prevent reordering of +- * all loads stores around it, which can hurt performance. Solution is to +- * use a variable and mimic reads and writes to it to enforce serialization ++ * The compiler should not reorder volatile asm statements with respect to each ++ * other: they should execute in program order. However GCC 4.9.x and 5.x have ++ * a bug (which was fixed in 8.1, 7.3 and 6.5) where they might reorder ++ * volatile asm. The write functions are not affected since they have memory ++ * clobbers preventing reordering. To prevent reads from being reordered with ++ * respect to writes, use a dummy memory operand. + */ +-extern unsigned long __force_order; ++ ++#define __FORCE_ORDER "m"(*(unsigned int *)0x1000UL) + + void native_write_cr0(unsigned long val); + + static inline unsigned long native_read_cr0(void) + { + unsigned long val; +- asm volatile("mov %%cr0,%0\n\t" : "=r" (val), "=m" (__force_order)); ++ asm volatile("mov %%cr0,%0\n\t" : "=r" (val) : __FORCE_ORDER); + return val; + } + + static __always_inline unsigned long native_read_cr2(void) + { + unsigned long val; +- asm volatile("mov %%cr2,%0\n\t" : "=r" (val), "=m" (__force_order)); ++ asm volatile("mov %%cr2,%0\n\t" : "=r" (val) : __FORCE_ORDER); + return val; + } + + static __always_inline void native_write_cr2(unsigned long val) + { +- asm volatile("mov %0,%%cr2": : "r" (val), "m" (__force_order)); ++ asm volatile("mov %0,%%cr2": : "r" (val) : "memory"); + } + + static inline unsigned long __native_read_cr3(void) + { + unsigned long val; +- asm volatile("mov %%cr3,%0\n\t" : "=r" (val), "=m" (__force_order)); ++ asm volatile("mov %%cr3,%0\n\t" : "=r" (val) : __FORCE_ORDER); + return val; + } + + static inline void native_write_cr3(unsigned long val) + { +- asm volatile("mov %0,%%cr3": : "r" (val), "m" (__force_order)); ++ asm volatile("mov %0,%%cr3": : "r" (val) : "memory"); + } + + static inline unsigned long native_read_cr4(void) +@@ -64,10 +66,10 @@ static inline unsigned long native_read_cr4(void) + asm volatile("1: mov %%cr4, %0\n" + "2:\n" + _ASM_EXTABLE(1b, 2b) +- : "=r" (val), "=m" (__force_order) : "0" (0)); ++ : "=r" (val) : "0" (0), __FORCE_ORDER); + #else + /* CR4 always exists on x86_64. */ +- asm volatile("mov %%cr4,%0\n\t" : "=r" (val), "=m" (__force_order)); ++ asm volatile("mov %%cr4,%0\n\t" : "=r" (val) : __FORCE_ORDER); + #endif + return val; + } +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 95c090a45b4b4..d8ef789e00c15 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -358,7 +358,7 @@ void native_write_cr0(unsigned long val) + unsigned long bits_missing = 0; + + set_register: +- asm volatile("mov %0,%%cr0": "+r" (val), "+m" (__force_order)); ++ asm volatile("mov %0,%%cr0": "+r" (val) : : "memory"); + + if (static_branch_likely(&cr_pinning)) { + if (unlikely((val & X86_CR0_WP) != X86_CR0_WP)) { +@@ -377,7 +377,7 @@ void native_write_cr4(unsigned long val) + unsigned long bits_changed = 0; + + set_register: +- asm volatile("mov %0,%%cr4": "+r" (val), "+m" (cr4_pinned_bits)); ++ asm volatile("mov %0,%%cr4": "+r" (val) : : "memory"); + + if (static_branch_likely(&cr_pinning)) { + if (unlikely((val & cr4_pinned_mask) != cr4_pinned_bits)) { +-- +2.25.1 + diff --git a/queue-5.8/x86-dumpstack-fix-misleading-instruction-pointer-err.patch b/queue-5.8/x86-dumpstack-fix-misleading-instruction-pointer-err.patch new file mode 100644 index 00000000000..abff529b81f --- /dev/null +++ b/queue-5.8/x86-dumpstack-fix-misleading-instruction-pointer-err.patch @@ -0,0 +1,50 @@ +From 46f6feb45972e862250f0c9dedab2063c305033a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Oct 2020 04:29:16 +0000 +Subject: x86/dumpstack: Fix misleading instruction pointer error message + +From: Mark Mossberg + +[ Upstream commit 238c91115cd05c71447ea071624a4c9fe661f970 ] + +Printing "Bad RIP value" if copy_code() fails can be misleading for +userspace pointers, since copy_code() can fail if the instruction +pointer is valid but the code is paged out. This is because copy_code() +calls copy_from_user_nmi() for userspace pointers, which disables page +fault handling. + +This is reproducible in OOM situations, where it's plausible that the +code may be reclaimed in the time between entry into the kernel and when +this message is printed. This leaves a misleading log in dmesg that +suggests instruction pointer corruption has occurred, which may alarm +users. + +Change the message to state the error condition more precisely. + + [ bp: Massage a bit. ] + +Signed-off-by: Mark Mossberg +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20201002042915.403558-1-mark.mossberg@gmail.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/dumpstack.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c +index 7401cc12c3ccf..42679610c9bea 100644 +--- a/arch/x86/kernel/dumpstack.c ++++ b/arch/x86/kernel/dumpstack.c +@@ -115,7 +115,8 @@ void show_opcodes(struct pt_regs *regs, const char *loglvl) + unsigned long prologue = regs->ip - PROLOGUE_SIZE; + + if (copy_code(regs, opcodes, prologue, sizeof(opcodes))) { +- printk("%sCode: Bad RIP value.\n", loglvl); ++ printk("%sCode: Unable to access opcode bytes at RIP 0x%lx.\n", ++ loglvl, prologue); + } else { + printk("%sCode: %" __stringify(PROLOGUE_SIZE) "ph <%02x> %" + __stringify(EPILOGUE_SIZE) "ph\n", loglvl, opcodes, +-- +2.25.1 + diff --git a/queue-5.8/x86-events-amd-iommu-fix-sizeof-mismatch.patch b/queue-5.8/x86-events-amd-iommu-fix-sizeof-mismatch.patch new file mode 100644 index 00000000000..ff129784f21 --- /dev/null +++ b/queue-5.8/x86-events-amd-iommu-fix-sizeof-mismatch.patch @@ -0,0 +1,40 @@ +From e449cbb00de474a2556226639d0eeb4e70bc16eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Oct 2020 12:39:00 +0100 +Subject: x86/events/amd/iommu: Fix sizeof mismatch + +From: Colin Ian King + +[ Upstream commit 59d5396a4666195f89a67e118e9e627ddd6f53a1 ] + +An incorrect sizeof is being used, struct attribute ** is not correct, +it should be struct attribute *. Note that since ** is the same size as +* this is not causing any issues. Improve this fix by using sizeof(*attrs) +as this allows us to not even reference the type of the pointer. + +Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)") +Fixes: 51686546304f ("x86/events/amd/iommu: Fix sysfs perf attribute groups") +Signed-off-by: Colin Ian King +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20201001113900.58889-1-colin.king@canonical.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/amd/iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/amd/iommu.c b/arch/x86/events/amd/iommu.c +index fb616203ce427..be50ef8572cce 100644 +--- a/arch/x86/events/amd/iommu.c ++++ b/arch/x86/events/amd/iommu.c +@@ -379,7 +379,7 @@ static __init int _init_events_attrs(void) + while (amd_iommu_v2_event_descs[i].attr.attr.name) + i++; + +- attrs = kcalloc(i + 1, sizeof(struct attribute **), GFP_KERNEL); ++ attrs = kcalloc(i + 1, sizeof(*attrs), GFP_KERNEL); + if (!attrs) + return -ENOMEM; + +-- +2.25.1 + diff --git a/queue-5.8/x86-fpu-allow-multiple-bits-in-clearcpuid-parameter.patch b/queue-5.8/x86-fpu-allow-multiple-bits-in-clearcpuid-parameter.patch new file mode 100644 index 00000000000..90ba35925a0 --- /dev/null +++ b/queue-5.8/x86-fpu-allow-multiple-bits-in-clearcpuid-parameter.patch @@ -0,0 +1,102 @@ +From 7376cd3f14fe75ceb4a4739e64c0e4eb8e9ddebf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 17:39:19 -0400 +Subject: x86/fpu: Allow multiple bits in clearcpuid= parameter + +From: Arvind Sankar + +[ Upstream commit 0a4bb5e5507a585532cc413125b921c8546fc39f ] + +Commit + + 0c2a3913d6f5 ("x86/fpu: Parse clearcpuid= as early XSAVE argument") + +changed clearcpuid parsing from __setup() to cmdline_find_option(). +While the __setup() function would have been called for each clearcpuid= +parameter on the command line, cmdline_find_option() will only return +the last one, so the change effectively made it impossible to disable +more than one bit. + +Allow a comma-separated list of bit numbers as the argument for +clearcpuid to allow multiple bits to be disabled again. Log the bits +being disabled for informational purposes. + +Also fix the check on the return value of cmdline_find_option(). It +returns -1 when the option is not found, so testing as a boolean is +incorrect. + +Fixes: 0c2a3913d6f5 ("x86/fpu: Parse clearcpuid= as early XSAVE argument") +Signed-off-by: Arvind Sankar +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20200907213919.2423441-1-nivedita@alum.mit.edu +Signed-off-by: Sasha Levin +--- + .../admin-guide/kernel-parameters.txt | 2 +- + arch/x86/kernel/fpu/init.c | 30 ++++++++++++++----- + 2 files changed, 23 insertions(+), 9 deletions(-) + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index fb95fad81c79a..6746f91ebc490 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -577,7 +577,7 @@ + loops can be debugged more effectively on production + systems. + +- clearcpuid=BITNUM [X86] ++ clearcpuid=BITNUM[,BITNUM...] [X86] + Disable CPUID feature X for the kernel. See + arch/x86/include/asm/cpufeatures.h for the valid bit + numbers. Note the Linux specific bits are not necessarily +diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c +index 61ddc3a5e5c2b..f8ff895aaf7e1 100644 +--- a/arch/x86/kernel/fpu/init.c ++++ b/arch/x86/kernel/fpu/init.c +@@ -243,9 +243,9 @@ static void __init fpu__init_system_ctx_switch(void) + */ + static void __init fpu__init_parse_early_param(void) + { +- char arg[32]; ++ char arg[128]; + char *argptr = arg; +- int bit; ++ int arglen, res, bit; + + #ifdef CONFIG_X86_32 + if (cmdline_find_option_bool(boot_command_line, "no387")) +@@ -268,12 +268,26 @@ static void __init fpu__init_parse_early_param(void) + if (cmdline_find_option_bool(boot_command_line, "noxsaves")) + setup_clear_cpu_cap(X86_FEATURE_XSAVES); + +- if (cmdline_find_option(boot_command_line, "clearcpuid", arg, +- sizeof(arg)) && +- get_option(&argptr, &bit) && +- bit >= 0 && +- bit < NCAPINTS * 32) +- setup_clear_cpu_cap(bit); ++ arglen = cmdline_find_option(boot_command_line, "clearcpuid", arg, sizeof(arg)); ++ if (arglen <= 0) ++ return; ++ ++ pr_info("Clearing CPUID bits:"); ++ do { ++ res = get_option(&argptr, &bit); ++ if (res == 0 || res == 3) ++ break; ++ ++ /* If the argument was too long, the last bit may be cut off */ ++ if (res == 1 && arglen >= sizeof(arg)) ++ break; ++ ++ if (bit >= 0 && bit < NCAPINTS * 32) { ++ pr_cont(" " X86_CAP_FMT, x86_cap_flag(bit)); ++ setup_clear_cpu_cap(bit); ++ } ++ } while (res == 2); ++ pr_cont("\n"); + } + + /* +-- +2.25.1 + diff --git a/queue-5.8/x86-mce-add-skylake-quirk-for-patrol-scrub-reported-.patch b/queue-5.8/x86-mce-add-skylake-quirk-for-patrol-scrub-reported-.patch new file mode 100644 index 00000000000..60b904f1f1e --- /dev/null +++ b/queue-5.8/x86-mce-add-skylake-quirk-for-patrol-scrub-reported-.patch @@ -0,0 +1,108 @@ +From 3d5f51b2ff05bcdbdab4a7ac165d723686d12677 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Sep 2020 19:13:12 -0700 +Subject: x86/mce: Add Skylake quirk for patrol scrub reported errors + +From: Borislav Petkov + +[ Upstream commit fd258dc4442c5c1c069c6b5b42bfe7d10cddda95 ] + +The patrol scrubber in Skylake and Cascade Lake systems can be configured +to report uncorrected errors using a special signature in the machine +check bank and to signal using CMCI instead of machine check. + +Update the severity calculation mechanism to allow specifying the model, +minimum stepping and range of machine check bank numbers. + +Add a new rule to detect the special signature (on model 0x55, stepping +>=4 in any of the memory controller banks). + + [ bp: Rewrite it. + aegl: Productize it. ] + +Suggested-by: Youquan Song +Signed-off-by: Borislav Petkov +Co-developed-by: Tony Luck +Signed-off-by: Tony Luck +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20200930021313.31810-2-tony.luck@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/severity.c | 28 ++++++++++++++++++++++++++-- + 1 file changed, 26 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mce/severity.c b/arch/x86/kernel/cpu/mce/severity.c +index e1da619add192..567ce09a02868 100644 +--- a/arch/x86/kernel/cpu/mce/severity.c ++++ b/arch/x86/kernel/cpu/mce/severity.c +@@ -9,9 +9,11 @@ + #include + #include + #include +-#include + #include + ++#include ++#include ++ + #include "internal.h" + + /* +@@ -40,9 +42,14 @@ static struct severity { + unsigned char context; + unsigned char excp; + unsigned char covered; ++ unsigned char cpu_model; ++ unsigned char cpu_minstepping; ++ unsigned char bank_lo, bank_hi; + char *msg; + } severities[] = { + #define MCESEV(s, m, c...) { .sev = MCE_ ## s ## _SEVERITY, .msg = m, ## c } ++#define BANK_RANGE(l, h) .bank_lo = l, .bank_hi = h ++#define MODEL_STEPPING(m, s) .cpu_model = m, .cpu_minstepping = s + #define KERNEL .context = IN_KERNEL + #define USER .context = IN_USER + #define KERNEL_RECOV .context = IN_KERNEL_RECOV +@@ -97,7 +104,6 @@ static struct severity { + KEEP, "Corrected error", + NOSER, BITCLR(MCI_STATUS_UC) + ), +- + /* + * known AO MCACODs reported via MCE or CMC: + * +@@ -113,6 +119,18 @@ static struct severity { + AO, "Action optional: last level cache writeback error", + SER, MASK(MCI_UC_AR|MCACOD, MCI_STATUS_UC|MCACOD_L3WB) + ), ++ /* ++ * Quirk for Skylake/Cascade Lake. Patrol scrubber may be configured ++ * to report uncorrected errors using CMCI with a special signature. ++ * UC=0, MSCOD=0x0010, MCACOD=binary(000X 0000 1100 XXXX) reported ++ * in one of the memory controller banks. ++ * Set severity to "AO" for same action as normal patrol scrub error. ++ */ ++ MCESEV( ++ AO, "Uncorrected Patrol Scrub Error", ++ SER, MASK(MCI_STATUS_UC|MCI_ADDR|0xffffeff0, MCI_ADDR|0x001000c0), ++ MODEL_STEPPING(INTEL_FAM6_SKYLAKE_X, 4), BANK_RANGE(13, 18) ++ ), + + /* ignore OVER for UCNA */ + MCESEV( +@@ -324,6 +342,12 @@ static int mce_severity_intel(struct mce *m, int tolerant, char **msg, bool is_e + continue; + if (s->excp && excp != s->excp) + continue; ++ if (s->cpu_model && boot_cpu_data.x86_model != s->cpu_model) ++ continue; ++ if (s->cpu_minstepping && boot_cpu_data.x86_stepping < s->cpu_minstepping) ++ continue; ++ if (s->bank_lo && (m->bank < s->bank_lo || m->bank > s->bank_hi)) ++ continue; + if (msg) + *msg = s->msg; + s->covered = 1; +-- +2.25.1 + diff --git a/queue-5.8/x86-mce-annotate-mce_rd-wrmsrl-with-noinstr.patch b/queue-5.8/x86-mce-annotate-mce_rd-wrmsrl-with-noinstr.patch new file mode 100644 index 00000000000..adb45b1d3d3 --- /dev/null +++ b/queue-5.8/x86-mce-annotate-mce_rd-wrmsrl-with-noinstr.patch @@ -0,0 +1,87 @@ +From da43b0f9542f40da1920398599a9c7f3309e419e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 19:21:28 +0200 +Subject: x86/mce: Annotate mce_rd/wrmsrl() with noinstr + +From: Borislav Petkov + +[ Upstream commit e100777016fdf6ec3a9d7c1773b15a2b5eca6c55 ] + +They do get called from the #MC handler which is already marked +"noinstr". + +Commit + + e2def7d49d08 ("x86/mce: Make mce_rdmsrl() panic on an inaccessible MSR") + +already got rid of the instrumentation in the MSR accessors, fix the +annotation now too, in order to get rid of: + + vmlinux.o: warning: objtool: do_machine_check()+0x4a: call to mce_rdmsrl() leaves .noinstr.text section + +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20200915194020.28807-1-bp@alien8.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/core.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c +index 14e4b4d17ee5b..d8dca24feccbe 100644 +--- a/arch/x86/kernel/cpu/mce/core.c ++++ b/arch/x86/kernel/cpu/mce/core.c +@@ -371,16 +371,25 @@ static int msr_to_offset(u32 msr) + } + + /* MSR access wrappers used for error injection */ +-static u64 mce_rdmsrl(u32 msr) ++static noinstr u64 mce_rdmsrl(u32 msr) + { + u64 v; + + if (__this_cpu_read(injectm.finished)) { +- int offset = msr_to_offset(msr); ++ int offset; ++ u64 ret; + ++ instrumentation_begin(); ++ ++ offset = msr_to_offset(msr); + if (offset < 0) +- return 0; +- return *(u64 *)((char *)this_cpu_ptr(&injectm) + offset); ++ ret = 0; ++ else ++ ret = *(u64 *)((char *)this_cpu_ptr(&injectm) + offset); ++ ++ instrumentation_end(); ++ ++ return ret; + } + + if (rdmsrl_safe(msr, &v)) { +@@ -396,13 +405,19 @@ static u64 mce_rdmsrl(u32 msr) + return v; + } + +-static void mce_wrmsrl(u32 msr, u64 v) ++static noinstr void mce_wrmsrl(u32 msr, u64 v) + { + if (__this_cpu_read(injectm.finished)) { +- int offset = msr_to_offset(msr); ++ int offset; + ++ instrumentation_begin(); ++ ++ offset = msr_to_offset(msr); + if (offset >= 0) + *(u64 *)((char *)this_cpu_ptr(&injectm) + offset) = v; ++ ++ instrumentation_end(); ++ + return; + } + wrmsrl(msr, v); +-- +2.25.1 + diff --git a/queue-5.8/x86-mce-make-mce_rdmsrl-panic-on-an-inaccessible-msr.patch b/queue-5.8/x86-mce-make-mce_rdmsrl-panic-on-an-inaccessible-msr.patch new file mode 100644 index 00000000000..c620dddf712 --- /dev/null +++ b/queue-5.8/x86-mce-make-mce_rdmsrl-panic-on-an-inaccessible-msr.patch @@ -0,0 +1,178 @@ +From 9576b5d54650bf3eef35731b5ac831e49e1114d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Sep 2020 23:02:52 +0200 +Subject: x86/mce: Make mce_rdmsrl() panic on an inaccessible MSR + +From: Borislav Petkov + +[ Upstream commit e2def7d49d0812ea40a224161b2001b2e815dce2 ] + +If an exception needs to be handled while reading an MSR - which is in +most of the cases caused by a #GP on a non-existent MSR - then this +is most likely the incarnation of a BIOS or a hardware bug. Such bug +violates the architectural guarantee that MCA banks are present with all +MSRs belonging to them. + +The proper fix belongs in the hardware/firmware - not in the kernel. + +Handling an #MC exception which is raised while an NMI is being handled +would cause the nasty NMI nesting issue because of the shortcoming of +IRET of reenabling NMIs when executed. And the machine is in an #MC +context already so be at its side. + +Tracing MSR accesses while in #MC is another no-no due to tracing being +inherently a bad idea in atomic context: + + vmlinux.o: warning: objtool: do_machine_check()+0x4a: call to mce_rdmsrl() leaves .noinstr.text section + +so remove all that "additional" functionality from mce_rdmsrl() and +provide it with a special exception handler which panics the machine +when that MSR is not accessible. + +The exception handler prints a human-readable message explaining what +the panic reason is but, what is more, it panics while in the #GP +handler and latter won't have executed an IRET, thus opening the NMI +nesting issue in the case when the #MC has happened while handling +an NMI. (#MC itself won't be reenabled until MCG_STATUS hasn't been +cleared). + +Suggested-by: Andy Lutomirski +Suggested-by: Peter Zijlstra +[ Add missing prototypes for ex_handler_* ] +Reported-by: kernel test robot +Signed-off-by: Borislav Petkov +Reviewed-by: Tony Luck +Link: https://lkml.kernel.org/r/20200906212130.GA28456@zn.tnic +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/cpu/mce/core.c | 72 +++++++++++++++++++++++++----- + arch/x86/kernel/cpu/mce/internal.h | 10 +++++ + 2 files changed, 70 insertions(+), 12 deletions(-) + +diff --git a/arch/x86/kernel/cpu/mce/core.c b/arch/x86/kernel/cpu/mce/core.c +index d8dca24feccbe..07673a034d39c 100644 +--- a/arch/x86/kernel/cpu/mce/core.c ++++ b/arch/x86/kernel/cpu/mce/core.c +@@ -370,10 +370,28 @@ static int msr_to_offset(u32 msr) + return -1; + } + ++__visible bool ex_handler_rdmsr_fault(const struct exception_table_entry *fixup, ++ struct pt_regs *regs, int trapnr, ++ unsigned long error_code, ++ unsigned long fault_addr) ++{ ++ pr_emerg("MSR access error: RDMSR from 0x%x at rIP: 0x%lx (%pS)\n", ++ (unsigned int)regs->cx, regs->ip, (void *)regs->ip); ++ ++ show_stack_regs(regs); ++ ++ panic("MCA architectural violation!\n"); ++ ++ while (true) ++ cpu_relax(); ++ ++ return true; ++} ++ + /* MSR access wrappers used for error injection */ + static noinstr u64 mce_rdmsrl(u32 msr) + { +- u64 v; ++ DECLARE_ARGS(val, low, high); + + if (__this_cpu_read(injectm.finished)) { + int offset; +@@ -392,21 +410,43 @@ static noinstr u64 mce_rdmsrl(u32 msr) + return ret; + } + +- if (rdmsrl_safe(msr, &v)) { +- WARN_ONCE(1, "mce: Unable to read MSR 0x%x!\n", msr); +- /* +- * Return zero in case the access faulted. This should +- * not happen normally but can happen if the CPU does +- * something weird, or if the code is buggy. +- */ +- v = 0; +- } ++ /* ++ * RDMSR on MCA MSRs should not fault. If they do, this is very much an ++ * architectural violation and needs to be reported to hw vendor. Panic ++ * the box to not allow any further progress. ++ */ ++ asm volatile("1: rdmsr\n" ++ "2:\n" ++ _ASM_EXTABLE_HANDLE(1b, 2b, ex_handler_rdmsr_fault) ++ : EAX_EDX_RET(val, low, high) : "c" (msr)); + +- return v; ++ ++ return EAX_EDX_VAL(val, low, high); ++} ++ ++__visible bool ex_handler_wrmsr_fault(const struct exception_table_entry *fixup, ++ struct pt_regs *regs, int trapnr, ++ unsigned long error_code, ++ unsigned long fault_addr) ++{ ++ pr_emerg("MSR access error: WRMSR to 0x%x (tried to write 0x%08x%08x) at rIP: 0x%lx (%pS)\n", ++ (unsigned int)regs->cx, (unsigned int)regs->dx, (unsigned int)regs->ax, ++ regs->ip, (void *)regs->ip); ++ ++ show_stack_regs(regs); ++ ++ panic("MCA architectural violation!\n"); ++ ++ while (true) ++ cpu_relax(); ++ ++ return true; + } + + static noinstr void mce_wrmsrl(u32 msr, u64 v) + { ++ u32 low, high; ++ + if (__this_cpu_read(injectm.finished)) { + int offset; + +@@ -420,7 +460,15 @@ static noinstr void mce_wrmsrl(u32 msr, u64 v) + + return; + } +- wrmsrl(msr, v); ++ ++ low = (u32)v; ++ high = (u32)(v >> 32); ++ ++ /* See comment in mce_rdmsrl() */ ++ asm volatile("1: wrmsr\n" ++ "2:\n" ++ _ASM_EXTABLE_HANDLE(1b, 2b, ex_handler_wrmsr_fault) ++ : : "c" (msr), "a"(low), "d" (high) : "memory"); + } + + /* +diff --git a/arch/x86/kernel/cpu/mce/internal.h b/arch/x86/kernel/cpu/mce/internal.h +index 6473070b5da49..b122610e9046a 100644 +--- a/arch/x86/kernel/cpu/mce/internal.h ++++ b/arch/x86/kernel/cpu/mce/internal.h +@@ -185,4 +185,14 @@ extern bool amd_filter_mce(struct mce *m); + static inline bool amd_filter_mce(struct mce *m) { return false; }; + #endif + ++__visible bool ex_handler_rdmsr_fault(const struct exception_table_entry *fixup, ++ struct pt_regs *regs, int trapnr, ++ unsigned long error_code, ++ unsigned long fault_addr); ++ ++__visible bool ex_handler_wrmsr_fault(const struct exception_table_entry *fixup, ++ struct pt_regs *regs, int trapnr, ++ unsigned long error_code, ++ unsigned long fault_addr); ++ + #endif /* __X86_MCE_INTERNAL_H__ */ +-- +2.25.1 + diff --git a/queue-5.8/x86-nmi-fix-nmi_handle-duration-miscalculation.patch b/queue-5.8/x86-nmi-fix-nmi_handle-duration-miscalculation.patch new file mode 100644 index 00000000000..b8b4076ef6d --- /dev/null +++ b/queue-5.8/x86-nmi-fix-nmi_handle-duration-miscalculation.patch @@ -0,0 +1,57 @@ +From b9993992ee25bf7b647b7d7cdb5e76c7bda1999c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 10:56:41 +0800 +Subject: x86/nmi: Fix nmi_handle() duration miscalculation + +From: Libing Zhou + +[ Upstream commit f94c91f7ba3ba7de2bc8aa31be28e1abb22f849e ] + +When nmi_check_duration() is checking the time an NMI handler took to +execute, the whole_msecs value used should be read from the @duration +argument, not from the ->max_duration, the latter being used to store +the current maximal duration. + + [ bp: Rewrite commit message. ] + +Fixes: 248ed51048c4 ("x86/nmi: Remove irq_work from the long duration NMI handler") +Suggested-by: Peter Zijlstra (Intel) +Signed-off-by: Libing Zhou +Signed-off-by: Borislav Petkov +Cc: Changbin Du +Link: https://lkml.kernel.org/r/20200820025641.44075-1-libing.zhou@nokia-sbell.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/nmi.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c +index d7c5e44b26f73..091752c3a19e2 100644 +--- a/arch/x86/kernel/nmi.c ++++ b/arch/x86/kernel/nmi.c +@@ -102,7 +102,6 @@ fs_initcall(nmi_warning_debugfs); + + static void nmi_check_duration(struct nmiaction *action, u64 duration) + { +- u64 whole_msecs = READ_ONCE(action->max_duration); + int remainder_ns, decimal_msecs; + + if (duration < nmi_longest_ns || duration < action->max_duration) +@@ -110,12 +109,12 @@ static void nmi_check_duration(struct nmiaction *action, u64 duration) + + action->max_duration = duration; + +- remainder_ns = do_div(whole_msecs, (1000 * 1000)); ++ remainder_ns = do_div(duration, (1000 * 1000)); + decimal_msecs = remainder_ns / 1000; + + printk_ratelimited(KERN_INFO + "INFO: NMI handler (%ps) took too long to run: %lld.%03d msecs\n", +- action->handler, whole_msecs, decimal_msecs); ++ action->handler, duration, decimal_msecs); + } + + static int nmi_handle(unsigned int type, struct pt_regs *regs) +-- +2.25.1 + diff --git a/queue-5.8/xfs-fix-deadlock-and-streamline-xfs_getfsmap-perform.patch b/queue-5.8/xfs-fix-deadlock-and-streamline-xfs_getfsmap-perform.patch new file mode 100644 index 00000000000..c1dcbf0a604 --- /dev/null +++ b/queue-5.8/xfs-fix-deadlock-and-streamline-xfs_getfsmap-perform.patch @@ -0,0 +1,341 @@ +From 5aca7b6dd7bce9d010a5b045daaa059af95203ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Oct 2020 10:56:07 -0700 +Subject: xfs: fix deadlock and streamline xfs_getfsmap performance + +From: Darrick J. Wong + +[ Upstream commit 8ffa90e1145c70c7ac47f14b59583b2296d89e72 ] + +Refactor xfs_getfsmap to improve its performance: instead of indirectly +calling a function that copies one record to userspace at a time, create +a shadow buffer in the kernel and copy the whole array once at the end. +On the author's computer, this reduces the runtime on his /home by ~20%. + +This also eliminates a deadlock when running GETFSMAP against the +realtime device. The current code locks the rtbitmap to create +fsmappings and copies them into userspace, having not released the +rtbitmap lock. If the userspace buffer is an mmap of a sparse file that +itself resides on the realtime device, the write page fault will recurse +into the fs for allocation, which will deadlock on the rtbitmap lock. + +Fixes: 4c934c7dd60c ("xfs: report realtime space information via the rtbitmap") +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Reviewed-by: Chandan Babu R +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_fsmap.c | 45 +++++++------- + fs/xfs/xfs_fsmap.h | 6 +- + fs/xfs/xfs_ioctl.c | 144 ++++++++++++++++++++++++++++++--------------- + 3 files changed, 124 insertions(+), 71 deletions(-) + +diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c +index aa36e7daf82c4..9ce5e7d5bf8f2 100644 +--- a/fs/xfs/xfs_fsmap.c ++++ b/fs/xfs/xfs_fsmap.c +@@ -26,7 +26,7 @@ + #include "xfs_rtalloc.h" + + /* Convert an xfs_fsmap to an fsmap. */ +-void ++static void + xfs_fsmap_from_internal( + struct fsmap *dest, + struct xfs_fsmap *src) +@@ -155,8 +155,7 @@ xfs_fsmap_owner_from_rmap( + /* getfsmap query state */ + struct xfs_getfsmap_info { + struct xfs_fsmap_head *head; +- xfs_fsmap_format_t formatter; /* formatting fn */ +- void *format_arg; /* format buffer */ ++ struct fsmap *fsmap_recs; /* mapping records */ + struct xfs_buf *agf_bp; /* AGF, for refcount queries */ + xfs_daddr_t next_daddr; /* next daddr we expect */ + u64 missing_owner; /* owner of holes */ +@@ -224,6 +223,20 @@ xfs_getfsmap_is_shared( + return 0; + } + ++static inline void ++xfs_getfsmap_format( ++ struct xfs_mount *mp, ++ struct xfs_fsmap *xfm, ++ struct xfs_getfsmap_info *info) ++{ ++ struct fsmap *rec; ++ ++ trace_xfs_getfsmap_mapping(mp, xfm); ++ ++ rec = &info->fsmap_recs[info->head->fmh_entries++]; ++ xfs_fsmap_from_internal(rec, xfm); ++} ++ + /* + * Format a reverse mapping for getfsmap, having translated rm_startblock + * into the appropriate daddr units. +@@ -288,10 +301,7 @@ xfs_getfsmap_helper( + fmr.fmr_offset = 0; + fmr.fmr_length = rec_daddr - info->next_daddr; + fmr.fmr_flags = FMR_OF_SPECIAL_OWNER; +- error = info->formatter(&fmr, info->format_arg); +- if (error) +- return error; +- info->head->fmh_entries++; ++ xfs_getfsmap_format(mp, &fmr, info); + } + + if (info->last) +@@ -323,11 +333,8 @@ xfs_getfsmap_helper( + if (shared) + fmr.fmr_flags |= FMR_OF_SHARED; + } +- error = info->formatter(&fmr, info->format_arg); +- if (error) +- return error; +- info->head->fmh_entries++; + ++ xfs_getfsmap_format(mp, &fmr, info); + out: + rec_daddr += XFS_FSB_TO_BB(mp, rec->rm_blockcount); + if (info->next_daddr < rec_daddr) +@@ -795,11 +802,11 @@ xfs_getfsmap_check_keys( + #endif /* CONFIG_XFS_RT */ + + /* +- * Get filesystem's extents as described in head, and format for +- * output. Calls formatter to fill the user's buffer until all +- * extents are mapped, until the passed-in head->fmh_count slots have +- * been filled, or until the formatter short-circuits the loop, if it +- * is tracking filled-in extents on its own. ++ * Get filesystem's extents as described in head, and format for output. Fills ++ * in the supplied records array until there are no more reverse mappings to ++ * return or head.fmh_entries == head.fmh_count. In the second case, this ++ * function returns -ECANCELED to indicate that more records would have been ++ * returned. + * + * Key to Confusion + * ---------------- +@@ -819,8 +826,7 @@ int + xfs_getfsmap( + struct xfs_mount *mp, + struct xfs_fsmap_head *head, +- xfs_fsmap_format_t formatter, +- void *arg) ++ struct fsmap *fsmap_recs) + { + struct xfs_trans *tp = NULL; + struct xfs_fsmap dkeys[2]; /* per-dev keys */ +@@ -895,8 +901,7 @@ xfs_getfsmap( + + info.next_daddr = head->fmh_keys[0].fmr_physical + + head->fmh_keys[0].fmr_length; +- info.formatter = formatter; +- info.format_arg = arg; ++ info.fsmap_recs = fsmap_recs; + info.head = head; + + /* +diff --git a/fs/xfs/xfs_fsmap.h b/fs/xfs/xfs_fsmap.h +index c6c57739b8626..a0775788e7b13 100644 +--- a/fs/xfs/xfs_fsmap.h ++++ b/fs/xfs/xfs_fsmap.h +@@ -27,13 +27,9 @@ struct xfs_fsmap_head { + struct xfs_fsmap fmh_keys[2]; /* low and high keys */ + }; + +-void xfs_fsmap_from_internal(struct fsmap *dest, struct xfs_fsmap *src); + void xfs_fsmap_to_internal(struct xfs_fsmap *dest, struct fsmap *src); + +-/* fsmap to userspace formatter - copy to user & advance pointer */ +-typedef int (*xfs_fsmap_format_t)(struct xfs_fsmap *, void *); +- + int xfs_getfsmap(struct xfs_mount *mp, struct xfs_fsmap_head *head, +- xfs_fsmap_format_t formatter, void *arg); ++ struct fsmap *out_recs); + + #endif /* __XFS_FSMAP_H__ */ +diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c +index a190212ca85d0..e2a8edcb367bb 100644 +--- a/fs/xfs/xfs_ioctl.c ++++ b/fs/xfs/xfs_ioctl.c +@@ -1707,39 +1707,17 @@ xfs_ioc_getbmap( + return error; + } + +-struct getfsmap_info { +- struct xfs_mount *mp; +- struct fsmap_head __user *data; +- unsigned int idx; +- __u32 last_flags; +-}; +- +-STATIC int +-xfs_getfsmap_format(struct xfs_fsmap *xfm, void *priv) +-{ +- struct getfsmap_info *info = priv; +- struct fsmap fm; +- +- trace_xfs_getfsmap_mapping(info->mp, xfm); +- +- info->last_flags = xfm->fmr_flags; +- xfs_fsmap_from_internal(&fm, xfm); +- if (copy_to_user(&info->data->fmh_recs[info->idx++], &fm, +- sizeof(struct fsmap))) +- return -EFAULT; +- +- return 0; +-} +- + STATIC int + xfs_ioc_getfsmap( + struct xfs_inode *ip, + struct fsmap_head __user *arg) + { +- struct getfsmap_info info = { NULL }; + struct xfs_fsmap_head xhead = {0}; + struct fsmap_head head; +- bool aborted = false; ++ struct fsmap *recs; ++ unsigned int count; ++ __u32 last_flags = 0; ++ bool done = false; + int error; + + if (copy_from_user(&head, arg, sizeof(struct fsmap_head))) +@@ -1751,38 +1729,112 @@ xfs_ioc_getfsmap( + sizeof(head.fmh_keys[1].fmr_reserved))) + return -EINVAL; + ++ /* ++ * Use an internal memory buffer so that we don't have to copy fsmap ++ * data to userspace while holding locks. Start by trying to allocate ++ * up to 128k for the buffer, but fall back to a single page if needed. ++ */ ++ count = min_t(unsigned int, head.fmh_count, ++ 131072 / sizeof(struct fsmap)); ++ recs = kvzalloc(count * sizeof(struct fsmap), GFP_KERNEL); ++ if (!recs) { ++ count = min_t(unsigned int, head.fmh_count, ++ PAGE_SIZE / sizeof(struct fsmap)); ++ recs = kvzalloc(count * sizeof(struct fsmap), GFP_KERNEL); ++ if (!recs) ++ return -ENOMEM; ++ } ++ + xhead.fmh_iflags = head.fmh_iflags; +- xhead.fmh_count = head.fmh_count; + xfs_fsmap_to_internal(&xhead.fmh_keys[0], &head.fmh_keys[0]); + xfs_fsmap_to_internal(&xhead.fmh_keys[1], &head.fmh_keys[1]); + + trace_xfs_getfsmap_low_key(ip->i_mount, &xhead.fmh_keys[0]); + trace_xfs_getfsmap_high_key(ip->i_mount, &xhead.fmh_keys[1]); + +- info.mp = ip->i_mount; +- info.data = arg; +- error = xfs_getfsmap(ip->i_mount, &xhead, xfs_getfsmap_format, &info); +- if (error == -ECANCELED) { +- error = 0; +- aborted = true; +- } else if (error) +- return error; ++ head.fmh_entries = 0; ++ do { ++ struct fsmap __user *user_recs; ++ struct fsmap *last_rec; ++ ++ user_recs = &arg->fmh_recs[head.fmh_entries]; ++ xhead.fmh_entries = 0; ++ xhead.fmh_count = min_t(unsigned int, count, ++ head.fmh_count - head.fmh_entries); ++ ++ /* Run query, record how many entries we got. */ ++ error = xfs_getfsmap(ip->i_mount, &xhead, recs); ++ switch (error) { ++ case 0: ++ /* ++ * There are no more records in the result set. Copy ++ * whatever we got to userspace and break out. ++ */ ++ done = true; ++ break; ++ case -ECANCELED: ++ /* ++ * The internal memory buffer is full. Copy whatever ++ * records we got to userspace and go again if we have ++ * not yet filled the userspace buffer. ++ */ ++ error = 0; ++ break; ++ default: ++ goto out_free; ++ } ++ head.fmh_entries += xhead.fmh_entries; ++ head.fmh_oflags = xhead.fmh_oflags; + +- /* If we didn't abort, set the "last" flag in the last fmx */ +- if (!aborted && info.idx) { +- info.last_flags |= FMR_OF_LAST; +- if (copy_to_user(&info.data->fmh_recs[info.idx - 1].fmr_flags, +- &info.last_flags, sizeof(info.last_flags))) +- return -EFAULT; ++ /* ++ * If the caller wanted a record count or there aren't any ++ * new records to return, we're done. ++ */ ++ if (head.fmh_count == 0 || xhead.fmh_entries == 0) ++ break; ++ ++ /* Copy all the records we got out to userspace. */ ++ if (copy_to_user(user_recs, recs, ++ xhead.fmh_entries * sizeof(struct fsmap))) { ++ error = -EFAULT; ++ goto out_free; ++ } ++ ++ /* Remember the last record flags we copied to userspace. */ ++ last_rec = &recs[xhead.fmh_entries - 1]; ++ last_flags = last_rec->fmr_flags; ++ ++ /* Set up the low key for the next iteration. */ ++ xfs_fsmap_to_internal(&xhead.fmh_keys[0], last_rec); ++ trace_xfs_getfsmap_low_key(ip->i_mount, &xhead.fmh_keys[0]); ++ } while (!done && head.fmh_entries < head.fmh_count); ++ ++ /* ++ * If there are no more records in the query result set and we're not ++ * in counting mode, mark the last record returned with the LAST flag. ++ */ ++ if (done && head.fmh_count > 0 && head.fmh_entries > 0) { ++ struct fsmap __user *user_rec; ++ ++ last_flags |= FMR_OF_LAST; ++ user_rec = &arg->fmh_recs[head.fmh_entries - 1]; ++ ++ if (copy_to_user(&user_rec->fmr_flags, &last_flags, ++ sizeof(last_flags))) { ++ error = -EFAULT; ++ goto out_free; ++ } + } + + /* copy back header */ +- head.fmh_entries = xhead.fmh_entries; +- head.fmh_oflags = xhead.fmh_oflags; +- if (copy_to_user(arg, &head, sizeof(struct fsmap_head))) +- return -EFAULT; ++ if (copy_to_user(arg, &head, sizeof(struct fsmap_head))) { ++ error = -EFAULT; ++ goto out_free; ++ } + +- return 0; ++out_free: ++ kmem_free(recs); ++ return error; + } + + STATIC int +-- +2.25.1 + diff --git a/queue-5.8/xfs-fix-finobt-btree-block-recovery-ordering.patch b/queue-5.8/xfs-fix-finobt-btree-block-recovery-ordering.patch new file mode 100644 index 00000000000..acb452fb4b4 --- /dev/null +++ b/queue-5.8/xfs-fix-finobt-btree-block-recovery-ordering.patch @@ -0,0 +1,49 @@ +From 573fb356e069817ebb898e64090f1e7b65c38dd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Sep 2020 07:28:52 -0700 +Subject: xfs: fix finobt btree block recovery ordering + +From: Dave Chinner + +[ Upstream commit 671459676ab0e1d371c8d6b184ad1faa05b6941e ] + +Nathan popped up on #xfs and pointed out that we fail to handle +finobt btree blocks in xlog_recover_get_buf_lsn(). This means they +always fall through the entire magic number matching code to "recover +immediately". Whilst most of the time this is the correct behaviour, +occasionally it will be incorrect and could potentially overwrite +more recent metadata because we don't check the LSN in the on disk +metadata at all. + +This bug has been present since the finobt was first introduced, and +is a potential cause of the occasional xfs_iget_check_free_state() +failures we see that indicate that the inode btree state does not +match the on disk inode state. + +Fixes: aafc3c246529 ("xfs: support the XFS_BTNUM_FINOBT free inode btree type") +Reported-by: Nathan Scott +Signed-off-by: Dave Chinner +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Reviewed-by: Brian Foster +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_buf_item_recover.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/fs/xfs/xfs_buf_item_recover.c b/fs/xfs/xfs_buf_item_recover.c +index 04faa7310c4f0..8140bd870226a 100644 +--- a/fs/xfs/xfs_buf_item_recover.c ++++ b/fs/xfs/xfs_buf_item_recover.c +@@ -721,6 +721,8 @@ xlog_recover_get_buf_lsn( + case XFS_ABTC_MAGIC: + case XFS_RMAP_CRC_MAGIC: + case XFS_REFC_CRC_MAGIC: ++ case XFS_FIBT_CRC_MAGIC: ++ case XFS_FIBT_MAGIC: + case XFS_IBT_CRC_MAGIC: + case XFS_IBT_MAGIC: { + struct xfs_btree_block *btb = blk; +-- +2.25.1 + diff --git a/queue-5.8/xfs-fix-high-key-handling-in-the-rt-allocator-s-quer.patch b/queue-5.8/xfs-fix-high-key-handling-in-the-rt-allocator-s-quer.patch new file mode 100644 index 00000000000..ebc3bcc6862 --- /dev/null +++ b/queue-5.8/xfs-fix-high-key-handling-in-the-rt-allocator-s-quer.patch @@ -0,0 +1,100 @@ +From a92abbc84aa14e8972740120f4ed9a20caf4c453 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 08:46:27 -0700 +Subject: xfs: fix high key handling in the rt allocator's query_range function + +From: Darrick J. Wong + +[ Upstream commit d88850bd5516a77c6f727e8b6cefb64e0cc929c7 ] + +Fix some off-by-one errors in xfs_rtalloc_query_range. The highest key +in the realtime bitmap is always one less than the number of rt extents, +which means that the key clamp at the start of the function is wrong. +The 4th argument to xfs_rtfind_forw is the highest rt extent that we +want to probe, which means that passing 1 less than the high key is +wrong. Finally, drop the rem variable that controls the loop because we +can compare the iteration point (rtstart) against the high key directly. + +The sordid history of this function is that the original commit (fb3c3) +incorrectly passed (high_rec->ar_startblock - 1) as the 'limit' parameter +to xfs_rtfind_forw. This was wrong because the "high key" is supposed +to be the largest key for which the caller wants result rows, not the +key for the first row that could possibly be outside the range that the +caller wants to see. + +A subsequent attempt (8ad56) to strengthen the parameter checking added +incorrect clamping of the parameters to the number of rt blocks in the +system (despite the bitmap functions all taking units of rt extents) to +avoid querying ranges past the end of rt bitmap file but failed to fix +the incorrect _rtfind_forw parameter. The original _rtfind_forw +parameter error then survived the conversion of the startblock and +blockcount fields to rt extents (a0e5c), and the most recent off-by-one +fix (a3a37) thought it was patching a problem when the end of the rt +volume is not in use, but none of these fixes actually solved the +original problem that the author was confused about the "limit" argument +to xfs_rtfind_forw. + +Sadly, all four of these patches were written by this author and even +his own usage of this function and rt testing were inadequate to get +this fixed quickly. + +Original-problem: fb3c3de2f65c ("xfs: add a couple of queries to iterate free extents in the rtbitmap") +Not-fixed-by: 8ad560d2565e ("xfs: strengthen rtalloc query range checks") +Not-fixed-by: a0e5c435babd ("xfs: fix xfs_rtalloc_rec units") +Fixes: a3a374bf1889 ("xfs: fix off-by-one error in xfs_rtalloc_query_range") +Signed-off-by: Darrick J. Wong +Reviewed-by: Chandan Babu R +Signed-off-by: Sasha Levin +--- + fs/xfs/libxfs/xfs_rtbitmap.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/fs/xfs/libxfs/xfs_rtbitmap.c b/fs/xfs/libxfs/xfs_rtbitmap.c +index 9498ced947be9..2a38576189307 100644 +--- a/fs/xfs/libxfs/xfs_rtbitmap.c ++++ b/fs/xfs/libxfs/xfs_rtbitmap.c +@@ -1018,7 +1018,6 @@ xfs_rtalloc_query_range( + struct xfs_mount *mp = tp->t_mountp; + xfs_rtblock_t rtstart; + xfs_rtblock_t rtend; +- xfs_rtblock_t rem; + int is_free; + int error = 0; + +@@ -1027,13 +1026,12 @@ xfs_rtalloc_query_range( + if (low_rec->ar_startext >= mp->m_sb.sb_rextents || + low_rec->ar_startext == high_rec->ar_startext) + return 0; +- if (high_rec->ar_startext > mp->m_sb.sb_rextents) +- high_rec->ar_startext = mp->m_sb.sb_rextents; ++ high_rec->ar_startext = min(high_rec->ar_startext, ++ mp->m_sb.sb_rextents - 1); + + /* Iterate the bitmap, looking for discrepancies. */ + rtstart = low_rec->ar_startext; +- rem = high_rec->ar_startext - rtstart; +- while (rem) { ++ while (rtstart <= high_rec->ar_startext) { + /* Is the first block free? */ + error = xfs_rtcheck_range(mp, tp, rtstart, 1, 1, &rtend, + &is_free); +@@ -1042,7 +1040,7 @@ xfs_rtalloc_query_range( + + /* How long does the extent go for? */ + error = xfs_rtfind_forw(mp, tp, rtstart, +- high_rec->ar_startext - 1, &rtend); ++ high_rec->ar_startext, &rtend); + if (error) + break; + +@@ -1055,7 +1053,6 @@ xfs_rtalloc_query_range( + break; + } + +- rem -= rtend - rtstart + 1; + rtstart = rtend + 1; + } + +-- +2.25.1 + diff --git a/queue-5.8/xfs-force-the-log-after-remapping-a-synchronous-writ.patch b/queue-5.8/xfs-force-the-log-after-remapping-a-synchronous-writ.patch new file mode 100644 index 00000000000..20dcf3b92c8 --- /dev/null +++ b/queue-5.8/xfs-force-the-log-after-remapping-a-synchronous-writ.patch @@ -0,0 +1,66 @@ +From a588ee9f8c3458489188f0e81e14563b6424055b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 10:20:16 -0700 +Subject: xfs: force the log after remapping a synchronous-writes file + +From: Darrick J. Wong + +[ Upstream commit 5ffce3cc22a0e89813ed0c7162a68b639aef9ab6 ] + +Commit 5833112df7e9 tried to make it so that a remap operation would +force the log out to disk if the filesystem is mounted with mandatory +synchronous writes. Unfortunately, that commit failed to handle the +case where the inode or the file descriptor require mandatory +synchronous writes. + +Refactor the check into into a helper that will look for all three +conditions, and now we can treat reflink just like any other synchronous +write. + +Fixes: 5833112df7e9 ("xfs: reflink should force the log out if mounted with wsync") +Signed-off-by: Darrick J. Wong +Reviewed-by: Brian Foster +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_file.c | 17 ++++++++++++++++- + 1 file changed, 16 insertions(+), 1 deletion(-) + +diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c +index 4d7385426149c..3ebc73ccc1337 100644 +--- a/fs/xfs/xfs_file.c ++++ b/fs/xfs/xfs_file.c +@@ -1005,6 +1005,21 @@ xfs_file_fadvise( + return ret; + } + ++/* Does this file, inode, or mount want synchronous writes? */ ++static inline bool xfs_file_sync_writes(struct file *filp) ++{ ++ struct xfs_inode *ip = XFS_I(file_inode(filp)); ++ ++ if (ip->i_mount->m_flags & XFS_MOUNT_WSYNC) ++ return true; ++ if (filp->f_flags & (__O_SYNC | O_DSYNC)) ++ return true; ++ if (IS_SYNC(file_inode(filp))) ++ return true; ++ ++ return false; ++} ++ + STATIC loff_t + xfs_file_remap_range( + struct file *file_in, +@@ -1062,7 +1077,7 @@ xfs_file_remap_range( + if (ret) + goto out_unlock; + +- if (mp->m_flags & XFS_MOUNT_WSYNC) ++ if (xfs_file_sync_writes(file_in) || xfs_file_sync_writes(file_out)) + xfs_log_force_inode(dest); + out_unlock: + xfs_reflink_remap_unlock(file_in, file_out); +-- +2.25.1 + diff --git a/queue-5.8/xfs-limit-entries-returned-when-counting-fsmap-recor.patch b/queue-5.8/xfs-limit-entries-returned-when-counting-fsmap-recor.patch new file mode 100644 index 00000000000..b26283a6038 --- /dev/null +++ b/queue-5.8/xfs-limit-entries-returned-when-counting-fsmap-recor.patch @@ -0,0 +1,40 @@ +From 65127e09ae5928cac3ef88edb33346965a357c6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Oct 2020 10:56:07 -0700 +Subject: xfs: limit entries returned when counting fsmap records + +From: Darrick J. Wong + +[ Upstream commit acd1ac3aa22fd58803a12d26b1ab7f70232f8d8d ] + +If userspace asked fsmap to count the number of entries, we cannot +return more than UINT_MAX entries because fmh_entries is u32. +Therefore, stop counting if we hit this limit or else we will waste time +to return truncated results. + +Fixes: e89c041338ed ("xfs: implement the GETFSMAP ioctl") +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Reviewed-by: Chandan Babu R +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_fsmap.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c +index 4eebcec4aae6c..aa36e7daf82c4 100644 +--- a/fs/xfs/xfs_fsmap.c ++++ b/fs/xfs/xfs_fsmap.c +@@ -256,6 +256,9 @@ xfs_getfsmap_helper( + + /* Are we just counting mappings? */ + if (info->head->fmh_count == 0) { ++ if (info->head->fmh_entries == UINT_MAX) ++ return -ECANCELED; ++ + if (rec_daddr > info->next_daddr) + info->head->fmh_entries++; + +-- +2.25.1 + diff --git a/queue-5.8/xfs-make-sure-the-rt-allocator-doesn-t-run-off-the-e.patch b/queue-5.8/xfs-make-sure-the-rt-allocator-doesn-t-run-off-the-e.patch new file mode 100644 index 00000000000..7b35ae27e60 --- /dev/null +++ b/queue-5.8/xfs-make-sure-the-rt-allocator-doesn-t-run-off-the-e.patch @@ -0,0 +1,58 @@ +From 028a9cf564ab6aec26ead2dc2ced8c19baa6ba56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 14:21:06 -0700 +Subject: xfs: make sure the rt allocator doesn't run off the end + +From: Darrick J. Wong + +[ Upstream commit 2a6ca4baed620303d414934aa1b7b0a8e7bab05f ] + +There's an overflow bug in the realtime allocator. If the rt volume is +large enough to handle a single allocation request that is larger than +the maximum bmap extent length and the rt bitmap ends exactly on a +bitmap block boundary, it's possible that the near allocator will try to +check the freeness of a range that extends past the end of the bitmap. +This fails with a corruption error and shuts down the fs. + +Therefore, constrain maxlen so that the range scan cannot run off the +end of the rt bitmap. + +Signed-off-by: Darrick J. Wong +Reviewed-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + fs/xfs/xfs_rtalloc.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c +index 6209e7b6b895b..86994d7f7cba3 100644 +--- a/fs/xfs/xfs_rtalloc.c ++++ b/fs/xfs/xfs_rtalloc.c +@@ -247,6 +247,9 @@ xfs_rtallocate_extent_block( + end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1; + i <= end; + i++) { ++ /* Make sure we don't scan off the end of the rt volume. */ ++ maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i; ++ + /* + * See if there's a free extent of maxlen starting at i. + * If it's not so then next will contain the first non-free. +@@ -442,6 +445,14 @@ xfs_rtallocate_extent_near( + */ + if (bno >= mp->m_sb.sb_rextents) + bno = mp->m_sb.sb_rextents - 1; ++ ++ /* Make sure we don't run off the end of the rt volume. */ ++ maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno; ++ if (maxlen < minlen) { ++ *rtblock = NULLRTBLOCK; ++ return 0; ++ } ++ + /* + * Try the exact allocation first. + */ +-- +2.25.1 + diff --git a/queue-5.8/xhci-don-t-create-endpoint-debugfs-entry-before-ring.patch b/queue-5.8/xhci-don-t-create-endpoint-debugfs-entry-before-ring.patch new file mode 100644 index 00000000000..7a18c56b9e3 --- /dev/null +++ b/queue-5.8/xhci-don-t-create-endpoint-debugfs-entry-before-ring.patch @@ -0,0 +1,51 @@ +From db509bef154a0c45a02b7aee48edab3fa20e5d95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Sep 2020 16:17:51 +0300 +Subject: xhci: don't create endpoint debugfs entry before ring buffer is set. + +From: Mathias Nyman + +[ Upstream commit 167657a1bb5fcde53ac304ce6c564bd90a2f9185 ] + +Make sure xHC completes the configure endpoint command and xhci driver +sets the ring pointers correctly before we create the user readable +debugfs file. + +In theory there was a small gap where a user could have read the +debugfs file and cause a NULL pointer dereference error as ring +pointer was not yet set, in practise we want this change to simplify +the upcoming streams debugfs support. + +Fixes: 02b6fdc2a153 ("usb: xhci: Add debugfs interface for xHCI driver") +Signed-off-by: Mathias Nyman +Link: https://lore.kernel.org/r/20200918131752.16488-10-mathias.nyman@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/xhci.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 113ab5d3cbfe5..f665da34a8f73 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -1915,8 +1915,6 @@ static int xhci_add_endpoint(struct usb_hcd *hcd, struct usb_device *udev, + ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index); + trace_xhci_add_endpoint(ep_ctx); + +- xhci_debugfs_create_endpoint(xhci, virt_dev, ep_index); +- + xhci_dbg(xhci, "add ep 0x%x, slot id %d, new drop flags = %#x, new add flags = %#x\n", + (unsigned int) ep->desc.bEndpointAddress, + udev->slot_id, +@@ -2949,6 +2947,7 @@ static int xhci_check_bandwidth(struct usb_hcd *hcd, struct usb_device *udev) + xhci_check_bw_drop_ep_streams(xhci, virt_dev, i); + virt_dev->eps[i].ring = virt_dev->eps[i].new_ring; + virt_dev->eps[i].new_ring = NULL; ++ xhci_debugfs_create_endpoint(xhci, virt_dev, i); + } + command_cleanup: + kfree(command->completion); +-- +2.25.1 +