From: Sasha Levin Date: Thu, 20 Aug 2020 04:03:59 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.14.194~16 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c4687c30c9814e113ea3a7950082960aaf9fdcc7;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/alsa-echoaudio-fix-potential-oops-in-snd_echo_resume.patch b/queue-5.4/alsa-echoaudio-fix-potential-oops-in-snd_echo_resume.patch new file mode 100644 index 00000000000..f2c20b80e1e --- /dev/null +++ b/queue-5.4/alsa-echoaudio-fix-potential-oops-in-snd_echo_resume.patch @@ -0,0 +1,45 @@ +From 0c7cdab52a03d1e1f4f0cfcea53269a3bb872008 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 15:46:30 +0800 +Subject: ALSA: echoaudio: Fix potential Oops in snd_echo_resume() + +From: Dinghao Liu + +[ Upstream commit 5a25de6df789cc805a9b8ba7ab5deef5067af47e ] + +Freeing chip on error may lead to an Oops at the next time +the system goes to resume. Fix this by removing all +snd_echo_free() calls on error. + +Fixes: 47b5d028fdce8 ("ALSA: Echoaudio - Add suspend support #2") +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20200813074632.17022-1-dinghao.liu@zju.edu.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/echoaudio/echoaudio.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c +index ca9125726be24..8596ae4c2bdef 100644 +--- a/sound/pci/echoaudio/echoaudio.c ++++ b/sound/pci/echoaudio/echoaudio.c +@@ -2198,7 +2198,6 @@ static int snd_echo_resume(struct device *dev) + if (err < 0) { + kfree(commpage_bak); + dev_err(dev, "resume init_hw err=%d\n", err); +- snd_echo_free(chip); + return err; + } + +@@ -2225,7 +2224,6 @@ static int snd_echo_resume(struct device *dev) + if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED, + KBUILD_MODNAME, chip)) { + dev_err(chip->card->dev, "cannot grab irq\n"); +- snd_echo_free(chip); + return -EBUSY; + } + chip->irq = pci->irq; +-- +2.25.1 + diff --git a/queue-5.4/clk-actions-fix-h_clk-for-actions-s500-soc.patch b/queue-5.4/clk-actions-fix-h_clk-for-actions-s500-soc.patch new file mode 100644 index 00000000000..d246fdf8202 --- /dev/null +++ b/queue-5.4/clk-actions-fix-h_clk-for-actions-s500-soc.patch @@ -0,0 +1,38 @@ +From dd8c535c178bb867d02b230d91654c8e4146bcc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jul 2020 20:05:07 +0300 +Subject: clk: actions: Fix h_clk for Actions S500 SoC + +From: Cristian Ciocaltea + +[ Upstream commit f47ee279d25fb0e010cae5d6e758e39b40eb6378 ] + +The h_clk clock in the Actions Semi S500 SoC clock driver has an +invalid parent. Replace with the correct one. + +Fixes: ed6b4795ece4 ("clk: actions: Add clock driver for S500 SoC") +Signed-off-by: Cristian Ciocaltea +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/c57e7ebabfa970014f073b92fe95b47d3e5a70b1.1593788312.git.cristian.ciocaltea@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/actions/owl-s500.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/actions/owl-s500.c b/drivers/clk/actions/owl-s500.c +index e2007ac4d235d..0eb83a0b70bcc 100644 +--- a/drivers/clk/actions/owl-s500.c ++++ b/drivers/clk/actions/owl-s500.c +@@ -183,7 +183,7 @@ static OWL_GATE(timer_clk, "timer_clk", "hosc", CMU_DEVCLKEN1, 27, 0, 0); + static OWL_GATE(hdmi_clk, "hdmi_clk", "hosc", CMU_DEVCLKEN1, 3, 0, 0); + + /* divider clocks */ +-static OWL_DIVIDER(h_clk, "h_clk", "ahbprevdiv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0); ++static OWL_DIVIDER(h_clk, "h_clk", "ahbprediv_clk", CMU_BUSCLK1, 12, 2, NULL, 0, 0); + static OWL_DIVIDER(rmii_ref_clk, "rmii_ref_clk", "ethernet_pll_clk", CMU_ETHERNETPLL, 1, 1, rmii_ref_div_table, 0, 0); + + /* factor clocks */ +-- +2.25.1 + diff --git a/queue-5.4/clk-bcm2835-do-not-use-prediv-with-bcm2711-s-plls.patch b/queue-5.4/clk-bcm2835-do-not-use-prediv-with-bcm2711-s-plls.patch new file mode 100644 index 00000000000..73cb5454e84 --- /dev/null +++ b/queue-5.4/clk-bcm2835-do-not-use-prediv-with-bcm2711-s-plls.patch @@ -0,0 +1,112 @@ +From 79cb8436f61a8718ced4a0a02dfe0f33bc6b4d7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Jul 2020 20:26:19 +0200 +Subject: clk: bcm2835: Do not use prediv with bcm2711's PLLs + +From: Nicolas Saenz Julienne + +[ Upstream commit f34e4651ce66a754f41203284acf09b28b9dd955 ] + +Contrary to previous SoCs, bcm2711 doesn't have a prescaler in the PLL +feedback loop. Bypass it by zeroing fb_prediv_mask when running on +bcm2711. + +Note that, since the prediv configuration bits were re-purposed, this +was triggering miscalculations on all clocks hanging from the VPU clock, +notably the aux UART, making its output unintelligible. + +Fixes: 42de9ad400af ("clk: bcm2835: Add BCM2711_CLOCK_EMMC2 support") +Reported-by: Nathan Chancellor +Signed-off-by: Nicolas Saenz Julienne +Link: https://lore.kernel.org/r/20200730182619.23246-1-nsaenzjulienne@suse.de +Tested-by: Nathan Chancellor +Reviewed-by: Florian Fainelli +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/bcm/clk-bcm2835.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 6e5d635f030f4..45420b514149f 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -314,6 +314,7 @@ struct bcm2835_cprman { + struct device *dev; + void __iomem *regs; + spinlock_t regs_lock; /* spinlock for all clocks */ ++ unsigned int soc; + + /* + * Real names of cprman clock parents looked up through +@@ -525,6 +526,20 @@ static int bcm2835_pll_is_on(struct clk_hw *hw) + A2W_PLL_CTRL_PRST_DISABLE; + } + ++static u32 bcm2835_pll_get_prediv_mask(struct bcm2835_cprman *cprman, ++ const struct bcm2835_pll_data *data) ++{ ++ /* ++ * On BCM2711 there isn't a pre-divisor available in the PLL feedback ++ * loop. Bits 13:14 of ANA1 (PLLA,PLLB,PLLC,PLLD) have been re-purposed ++ * for to for VCO RANGE bits. ++ */ ++ if (cprman->soc & SOC_BCM2711) ++ return 0; ++ ++ return data->ana->fb_prediv_mask; ++} ++ + static void bcm2835_pll_choose_ndiv_and_fdiv(unsigned long rate, + unsigned long parent_rate, + u32 *ndiv, u32 *fdiv) +@@ -582,7 +597,7 @@ static unsigned long bcm2835_pll_get_rate(struct clk_hw *hw, + ndiv = (a2wctrl & A2W_PLL_CTRL_NDIV_MASK) >> A2W_PLL_CTRL_NDIV_SHIFT; + pdiv = (a2wctrl & A2W_PLL_CTRL_PDIV_MASK) >> A2W_PLL_CTRL_PDIV_SHIFT; + using_prediv = cprman_read(cprman, data->ana_reg_base + 4) & +- data->ana->fb_prediv_mask; ++ bcm2835_pll_get_prediv_mask(cprman, data); + + if (using_prediv) { + ndiv *= 2; +@@ -665,6 +680,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, + struct bcm2835_pll *pll = container_of(hw, struct bcm2835_pll, hw); + struct bcm2835_cprman *cprman = pll->cprman; + const struct bcm2835_pll_data *data = pll->data; ++ u32 prediv_mask = bcm2835_pll_get_prediv_mask(cprman, data); + bool was_using_prediv, use_fb_prediv, do_ana_setup_first; + u32 ndiv, fdiv, a2w_ctl; + u32 ana[4]; +@@ -682,7 +698,7 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, + for (i = 3; i >= 0; i--) + ana[i] = cprman_read(cprman, data->ana_reg_base + i * 4); + +- was_using_prediv = ana[1] & data->ana->fb_prediv_mask; ++ was_using_prediv = ana[1] & prediv_mask; + + ana[0] &= ~data->ana->mask0; + ana[0] |= data->ana->set0; +@@ -692,10 +708,10 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, + ana[3] |= data->ana->set3; + + if (was_using_prediv && !use_fb_prediv) { +- ana[1] &= ~data->ana->fb_prediv_mask; ++ ana[1] &= ~prediv_mask; + do_ana_setup_first = true; + } else if (!was_using_prediv && use_fb_prediv) { +- ana[1] |= data->ana->fb_prediv_mask; ++ ana[1] |= prediv_mask; + do_ana_setup_first = false; + } else { + do_ana_setup_first = true; +@@ -2234,6 +2250,7 @@ static int bcm2835_clk_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, cprman); + + cprman->onecell.num = asize; ++ cprman->soc = pdata->soc; + hws = cprman->onecell.hws; + + for (i = 0; i < asize; i++) { +-- +2.25.1 + diff --git a/queue-5.4/clk-clk-atlas6-fix-return-value-check-in-atlas6_clk_.patch b/queue-5.4/clk-clk-atlas6-fix-return-value-check-in-atlas6_clk_.patch new file mode 100644 index 00000000000..5ba3709fc44 --- /dev/null +++ b/queue-5.4/clk-clk-atlas6-fix-return-value-check-in-atlas6_clk_.patch @@ -0,0 +1,39 @@ +From 40e953a4c0eb77dd2a3044d14fea43b1f7e7f252 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Jul 2020 03:21:43 +0000 +Subject: clk: clk-atlas6: fix return value check in atlas6_clk_init() + +From: Xu Wang + +[ Upstream commit 12b90b40854a8461a02ef19f6f4474cc88d64b66 ] + +In case of error, the function clk_register() returns ERR_PTR() +and never returns NULL. The NULL test in the return value check +should be replaced with IS_ERR(). + +Signed-off-by: Xu Wang +Link: https://lore.kernel.org/r/20200713032143.21362-1-vulab@iscas.ac.cn +Acked-by: Barry Song +Fixes: 7bf21bc81f28 ("clk: sirf: re-arch to make the codes support both prima2 and atlas6") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/sirf/clk-atlas6.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/sirf/clk-atlas6.c b/drivers/clk/sirf/clk-atlas6.c +index c84d5bab7ac28..b95483bb6a5ec 100644 +--- a/drivers/clk/sirf/clk-atlas6.c ++++ b/drivers/clk/sirf/clk-atlas6.c +@@ -135,7 +135,7 @@ static void __init atlas6_clk_init(struct device_node *np) + + for (i = pll1; i < maxclk; i++) { + atlas6_clks[i] = clk_register(NULL, atlas6_clk_hw_array[i]); +- BUG_ON(!atlas6_clks[i]); ++ BUG_ON(IS_ERR(atlas6_clks[i])); + } + clk_register_clkdev(atlas6_clks[cpu], NULL, "cpu"); + clk_register_clkdev(atlas6_clks[io], NULL, "io"); +-- +2.25.1 + diff --git a/queue-5.4/clk-qcom-clk-alpha-pll-remove-unused-incorrect-pll_c.patch b/queue-5.4/clk-qcom-clk-alpha-pll-remove-unused-incorrect-pll_c.patch new file mode 100644 index 00000000000..57063afe840 --- /dev/null +++ b/queue-5.4/clk-qcom-clk-alpha-pll-remove-unused-incorrect-pll_c.patch @@ -0,0 +1,44 @@ +From 03d71094b942de6088b3249f37281a1cb858e84b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 09:52:33 -0400 +Subject: clk: qcom: clk-alpha-pll: remove unused/incorrect PLL_CAL_VAL + +From: Jonathan Marek + +[ Upstream commit c8b9002f44e4a1d2771b2f59f6de900864b1f9d7 ] + +0x44 isn't a register offset, it is the value that goes into CAL_L_VAL. + +Fixes: 548a909597d5 ("clk: qcom: clk-alpha-pll: Add support for Trion PLLs") +Signed-off-by: Jonathan Marek +Tested-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20200709135251.643-3-jonathan@marek.ca +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-alpha-pll.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/clk/qcom/clk-alpha-pll.c b/drivers/clk/qcom/clk-alpha-pll.c +index 055318f979915..a69f53e435ed5 100644 +--- a/drivers/clk/qcom/clk-alpha-pll.c ++++ b/drivers/clk/qcom/clk-alpha-pll.c +@@ -55,7 +55,6 @@ + #define PLL_STATUS(p) ((p)->offset + (p)->regs[PLL_OFF_STATUS]) + #define PLL_OPMODE(p) ((p)->offset + (p)->regs[PLL_OFF_OPMODE]) + #define PLL_FRAC(p) ((p)->offset + (p)->regs[PLL_OFF_FRAC]) +-#define PLL_CAL_VAL(p) ((p)->offset + (p)->regs[PLL_OFF_CAL_VAL]) + + const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = { + [CLK_ALPHA_PLL_TYPE_DEFAULT] = { +@@ -114,7 +113,6 @@ const u8 clk_alpha_pll_regs[][PLL_OFF_MAX_REGS] = { + [PLL_OFF_STATUS] = 0x30, + [PLL_OFF_OPMODE] = 0x38, + [PLL_OFF_ALPHA_VAL] = 0x40, +- [PLL_OFF_CAL_VAL] = 0x44, + }, + }; + EXPORT_SYMBOL_GPL(clk_alpha_pll_regs); +-- +2.25.1 + diff --git a/queue-5.4/clk-qcom-gcc-fix-sm8150-gpu-and-npu-clocks.patch b/queue-5.4/clk-qcom-gcc-fix-sm8150-gpu-and-npu-clocks.patch new file mode 100644 index 00000000000..f008ec020ad --- /dev/null +++ b/queue-5.4/clk-qcom-gcc-fix-sm8150-gpu-and-npu-clocks.patch @@ -0,0 +1,78 @@ +From c02963a682577ad8d654b5aabbaabce9d32ed49c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 09:52:32 -0400 +Subject: clk: qcom: gcc: fix sm8150 GPU and NPU clocks + +From: Jonathan Marek + +[ Upstream commit 667f39b59b494d96ae70f4217637db2ebbee3df0 ] + +Fix the parents and set BRANCH_HALT_SKIP. From the downstream driver it +should be a 500us delay and not skip, however this matches what was done +for other clocks that had 500us delay in downstream. + +Fixes: f73a4230d5bb ("clk: qcom: gcc: Add GPU and NPU clocks for SM8150") +Signed-off-by: Jonathan Marek +Tested-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20200709135251.643-2-jonathan@marek.ca +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sm8150.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-sm8150.c b/drivers/clk/qcom/gcc-sm8150.c +index fad42897a7a7f..ee908fbfeab17 100644 +--- a/drivers/clk/qcom/gcc-sm8150.c ++++ b/drivers/clk/qcom/gcc-sm8150.c +@@ -1616,6 +1616,7 @@ static struct clk_branch gcc_gpu_cfg_ahb_clk = { + }; + + static struct clk_branch gcc_gpu_gpll0_clk_src = { ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52004, + .enable_mask = BIT(15), +@@ -1631,13 +1632,14 @@ static struct clk_branch gcc_gpu_gpll0_clk_src = { + }; + + static struct clk_branch gcc_gpu_gpll0_div_clk_src = { ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52004, + .enable_mask = BIT(16), + .hw.init = &(struct clk_init_data){ + .name = "gcc_gpu_gpll0_div_clk_src", + .parent_hws = (const struct clk_hw *[]){ +- &gcc_gpu_gpll0_clk_src.clkr.hw }, ++ &gpll0_out_even.clkr.hw }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, +@@ -1728,6 +1730,7 @@ static struct clk_branch gcc_npu_cfg_ahb_clk = { + }; + + static struct clk_branch gcc_npu_gpll0_clk_src = { ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52004, + .enable_mask = BIT(18), +@@ -1743,13 +1746,14 @@ static struct clk_branch gcc_npu_gpll0_clk_src = { + }; + + static struct clk_branch gcc_npu_gpll0_div_clk_src = { ++ .halt_check = BRANCH_HALT_SKIP, + .clkr = { + .enable_reg = 0x52004, + .enable_mask = BIT(19), + .hw.init = &(struct clk_init_data){ + .name = "gcc_npu_gpll0_div_clk_src", + .parent_hws = (const struct clk_hw *[]){ +- &gcc_npu_gpll0_clk_src.clkr.hw }, ++ &gpll0_out_even.clkr.hw }, + .num_parents = 1, + .flags = CLK_SET_RATE_PARENT, + .ops = &clk_branch2_ops, +-- +2.25.1 + diff --git a/queue-5.4/clk-qcom-gcc-sdm660-fix-up-gcc_mss_mnoc_bimc_axi_clk.patch b/queue-5.4/clk-qcom-gcc-sdm660-fix-up-gcc_mss_mnoc_bimc_axi_clk.patch new file mode 100644 index 00000000000..cdf4dbb7985 --- /dev/null +++ b/queue-5.4/clk-qcom-gcc-sdm660-fix-up-gcc_mss_mnoc_bimc_axi_clk.patch @@ -0,0 +1,38 @@ +From 09fff77dbf1dbf8343cfd80dbe702feedfdadfc9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Jul 2020 13:12:05 +0200 +Subject: clk: qcom: gcc-sdm660: Fix up gcc_mss_mnoc_bimc_axi_clk + +From: Konrad Dybcio + +[ Upstream commit 3386af51d3bcebcba3f7becdb1ef2e384abe90cf ] + +Add missing halt_check, hwcg_reg and hwcg_bit properties. +These were likely omitted when porting the driver upstream. + +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20200726111215.22361-9-konradybcio@gmail.com +Fixes: f2a76a2955c0 ("clk: qcom: Add Global Clock controller (GCC) driver for SDM660") +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-sdm660.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/clk/qcom/gcc-sdm660.c b/drivers/clk/qcom/gcc-sdm660.c +index bf5730832ef3d..c6fb57cd576f5 100644 +--- a/drivers/clk/qcom/gcc-sdm660.c ++++ b/drivers/clk/qcom/gcc-sdm660.c +@@ -1715,6 +1715,9 @@ static struct clk_branch gcc_mss_cfg_ahb_clk = { + + static struct clk_branch gcc_mss_mnoc_bimc_axi_clk = { + .halt_reg = 0x8a004, ++ .halt_check = BRANCH_HALT, ++ .hwcg_reg = 0x8a004, ++ .hwcg_bit = 1, + .clkr = { + .enable_reg = 0x8a004, + .enable_mask = BIT(0), +-- +2.25.1 + diff --git a/queue-5.4/crypto-af_alg-fix-regression-on-empty-requests.patch b/queue-5.4/crypto-af_alg-fix-regression-on-empty-requests.patch new file mode 100644 index 00000000000..1c5f9c81036 --- /dev/null +++ b/queue-5.4/crypto-af_alg-fix-regression-on-empty-requests.patch @@ -0,0 +1,48 @@ +From 3c9e007ef63ac9a2c5cf2736295046e01563d206 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jul 2020 13:32:21 +1000 +Subject: crypto: af_alg - Fix regression on empty requests + +From: Herbert Xu + +[ Upstream commit 662bb52f50bca16a74fe92b487a14d7dccb85e1a ] + +Some user-space programs rely on crypto requests that have no +control metadata. This broke when a check was added to require +the presence of control metadata with the ctx->init flag. + +This patch fixes the regression by setting ctx->init as long as +one sendmsg(2) has been made, with or without a control message. + +Reported-by: Sachin Sant +Reported-by: Naresh Kamboju +Fixes: f3c802a1f300 ("crypto: algif_aead - Only wake up when...") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index ed8ace8675b77..35e026ba2c7ed 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -851,6 +851,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + err = -EINVAL; + goto unlock; + } ++ ctx->init = true; + + if (init) { + ctx->enc = enc; +@@ -858,7 +859,6 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + memcpy(ctx->iv, con.iv->iv, ivsize); + + ctx->aead_assoclen = con.aead_assoclen; +- ctx->init = true; + } + + while (size) { +-- +2.25.1 + diff --git a/queue-5.4/crypto-algif_aead-fix-uninitialized-ctx-init.patch b/queue-5.4/crypto-algif_aead-fix-uninitialized-ctx-init.patch new file mode 100644 index 00000000000..a2b0063853e --- /dev/null +++ b/queue-5.4/crypto-algif_aead-fix-uninitialized-ctx-init.patch @@ -0,0 +1,80 @@ +From c362525ba3837c6ff77458c991ca25c5d6532ea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Aug 2020 14:58:25 +0200 +Subject: crypto: algif_aead - fix uninitialized ctx->init + +From: Ondrej Mosnacek + +[ Upstream commit 21dfbcd1f5cbff9cf2f9e7e43475aed8d072b0dd ] + +In skcipher_accept_parent_nokey() the whole af_alg_ctx structure is +cleared by memset() after allocation, so add such memset() also to +aead_accept_parent_nokey() so that the new "init" field is also +initialized to zero. Without that the initial ctx->init checks might +randomly return true and cause errors. + +While there, also remove the redundant zero assignments in both +functions. + +Found via libkcapi testsuite. + +Cc: Stephan Mueller +Fixes: f3c802a1f300 ("crypto: algif_aead - Only wake up when ctx->more is zero") +Suggested-by: Herbert Xu +Signed-off-by: Ondrej Mosnacek +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/algif_aead.c | 6 ------ + crypto/algif_skcipher.c | 7 +------ + 2 files changed, 1 insertion(+), 12 deletions(-) + +diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c +index d48d2156e6210..43c6aa784858b 100644 +--- a/crypto/algif_aead.c ++++ b/crypto/algif_aead.c +@@ -558,12 +558,6 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk) + + INIT_LIST_HEAD(&ctx->tsgl_list); + ctx->len = len; +- ctx->used = 0; +- atomic_set(&ctx->rcvused, 0); +- ctx->more = 0; +- ctx->merge = 0; +- ctx->enc = 0; +- ctx->aead_assoclen = 0; + crypto_init_wait(&ctx->wait); + + ask->private = ctx; +diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c +index a51ba22fef58f..81c4022285a7c 100644 +--- a/crypto/algif_skcipher.c ++++ b/crypto/algif_skcipher.c +@@ -333,6 +333,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) + ctx = sock_kmalloc(sk, len, GFP_KERNEL); + if (!ctx) + return -ENOMEM; ++ memset(ctx, 0, len); + + ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(tfm), + GFP_KERNEL); +@@ -340,16 +341,10 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) + sock_kfree_s(sk, ctx, len); + return -ENOMEM; + } +- + memset(ctx->iv, 0, crypto_skcipher_ivsize(tfm)); + + INIT_LIST_HEAD(&ctx->tsgl_list); + ctx->len = len; +- ctx->used = 0; +- atomic_set(&ctx->rcvused, 0); +- ctx->more = 0; +- ctx->merge = 0; +- ctx->enc = 0; + crypto_init_wait(&ctx->wait); + + ask->private = ctx; +-- +2.25.1 + diff --git a/queue-5.4/crypto-algif_aead-only-wake-up-when-ctx-more-is-zero.patch b/queue-5.4/crypto-algif_aead-only-wake-up-when-ctx-more-is-zero.patch new file mode 100644 index 00000000000..3c71b621400 --- /dev/null +++ b/queue-5.4/crypto-algif_aead-only-wake-up-when-ctx-more-is-zero.patch @@ -0,0 +1,141 @@ +From 93400079b5b32cb36a4d53499a7a29ec65c82ca9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 30 May 2020 00:23:49 +1000 +Subject: crypto: algif_aead - Only wake up when ctx->more is zero + +From: Herbert Xu + +[ Upstream commit f3c802a1f30013f8f723b62d7fa49eb9e991da23 ] + +AEAD does not support partial requests so we must not wake up +while ctx->more is set. In order to distinguish between the +case of no data sent yet and a zero-length request, a new init +flag has been added to ctx. + +SKCIPHER has also been modified to ensure that at least a block +of data is available if there is more data to come. + +Fixes: 2d97591ef43d ("crypto: af_alg - consolidation of...") +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/af_alg.c | 11 ++++++++--- + crypto/algif_aead.c | 4 ++-- + crypto/algif_skcipher.c | 4 ++-- + include/crypto/if_alg.h | 4 +++- + 4 files changed, 15 insertions(+), 8 deletions(-) + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index a3b9df99af6de..ed8ace8675b77 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -635,6 +635,7 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, + + if (!ctx->used) + ctx->merge = 0; ++ ctx->init = ctx->more; + } + EXPORT_SYMBOL_GPL(af_alg_pull_tsgl); + +@@ -734,9 +735,10 @@ EXPORT_SYMBOL_GPL(af_alg_wmem_wakeup); + * + * @sk socket of connection to user space + * @flags If MSG_DONTWAIT is set, then only report if function would sleep ++ * @min Set to minimum request size if partial requests are allowed. + * @return 0 when writable memory is available, < 0 upon error + */ +-int af_alg_wait_for_data(struct sock *sk, unsigned flags) ++int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min) + { + DEFINE_WAIT_FUNC(wait, woken_wake_function); + struct alg_sock *ask = alg_sk(sk); +@@ -754,7 +756,9 @@ int af_alg_wait_for_data(struct sock *sk, unsigned flags) + if (signal_pending(current)) + break; + timeout = MAX_SCHEDULE_TIMEOUT; +- if (sk_wait_event(sk, &timeout, (ctx->used || !ctx->more), ++ if (sk_wait_event(sk, &timeout, ++ ctx->init && (!ctx->more || ++ (min && ctx->used >= min)), + &wait)) { + err = 0; + break; +@@ -843,7 +847,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + } + + lock_sock(sk); +- if (!ctx->more && ctx->used) { ++ if (ctx->init && (init || !ctx->more)) { + err = -EINVAL; + goto unlock; + } +@@ -854,6 +858,7 @@ int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + memcpy(ctx->iv, con.iv->iv, ivsize); + + ctx->aead_assoclen = con.aead_assoclen; ++ ctx->init = true; + } + + while (size) { +diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c +index 0ae000a61c7f5..d48d2156e6210 100644 +--- a/crypto/algif_aead.c ++++ b/crypto/algif_aead.c +@@ -106,8 +106,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, + size_t usedpages = 0; /* [in] RX bufs to be used from user */ + size_t processed = 0; /* [in] TX bufs to be consumed */ + +- if (!ctx->used) { +- err = af_alg_wait_for_data(sk, flags); ++ if (!ctx->init || ctx->more) { ++ err = af_alg_wait_for_data(sk, flags, 0); + if (err) + return err; + } +diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c +index ec5567c87a6df..a51ba22fef58f 100644 +--- a/crypto/algif_skcipher.c ++++ b/crypto/algif_skcipher.c +@@ -61,8 +61,8 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, + int err = 0; + size_t len = 0; + +- if (!ctx->used) { +- err = af_alg_wait_for_data(sk, flags); ++ if (!ctx->init || (ctx->more && ctx->used < bs)) { ++ err = af_alg_wait_for_data(sk, flags, bs); + if (err) + return err; + } +diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h +index 864849e942c45..c1a8d4a41bb16 100644 +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -135,6 +135,7 @@ struct af_alg_async_req { + * SG? + * @enc: Cryptographic operation to be performed when + * recvmsg is invoked. ++ * @init: True if metadata has been sent. + * @len: Length of memory allocated for this data structure. + */ + struct af_alg_ctx { +@@ -151,6 +152,7 @@ struct af_alg_ctx { + bool more; + bool merge; + bool enc; ++ bool init; + + unsigned int len; + }; +@@ -226,7 +228,7 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset); + void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, + size_t dst_offset); + void af_alg_wmem_wakeup(struct sock *sk); +-int af_alg_wait_for_data(struct sock *sk, unsigned flags); ++int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min); + int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, + unsigned int ivsize); + ssize_t af_alg_sendpage(struct socket *sock, struct page *page, +-- +2.25.1 + diff --git a/queue-5.4/crypto-caam-remove-broken-arc4-support.patch b/queue-5.4/crypto-caam-remove-broken-arc4-support.patch new file mode 100644 index 00000000000..8c3b1480fc8 --- /dev/null +++ b/queue-5.4/crypto-caam-remove-broken-arc4-support.patch @@ -0,0 +1,120 @@ +From 1cb99bafb17c395f9ae030cae0381054d0b0ddab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 16 Jul 2020 21:45:03 +1000 +Subject: crypto: caam - Remove broken arc4 support +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Herbert Xu + +[ Upstream commit eeedb618378f8a09779546a3eeac16b000447d62 ] + +The arc4 algorithm requires storing state in the request context +in order to allow more than one encrypt/decrypt operation. As this +driver does not seem to do that, it means that using it for more +than one operation is broken. + +Fixes: eaed71a44ad9 ("crypto: caam - add ecb(*) support") +Link: https://lore.kernel.org/linux-crypto/CAMj1kXGvMe_A_iQ43Pmygg9xaAM-RLy=_M=v+eg--8xNmv9P+w@mail.gmail.com +Link: https://lore.kernel.org/linux-crypto/20200702101947.682-1-ardb@kernel.org +Signed-off-by: Herbert Xu +Acked-by: Ard Biesheuvel +Acked-by: Horia Geantă +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/caam/caamalg.c | 29 ----------------------------- + drivers/crypto/caam/compat.h | 1 - + 2 files changed, 30 deletions(-) + +diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c +index 4ce9c2b4544a2..fdd994ee55e22 100644 +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -818,12 +818,6 @@ static int ctr_skcipher_setkey(struct crypto_skcipher *skcipher, + return skcipher_setkey(skcipher, key, keylen, ctx1_iv_off); + } + +-static int arc4_skcipher_setkey(struct crypto_skcipher *skcipher, +- const u8 *key, unsigned int keylen) +-{ +- return skcipher_setkey(skcipher, key, keylen, 0); +-} +- + static int des_skcipher_setkey(struct crypto_skcipher *skcipher, + const u8 *key, unsigned int keylen) + { +@@ -2058,21 +2052,6 @@ static struct caam_skcipher_alg driver_algs[] = { + }, + .caam.class1_alg_type = OP_ALG_ALGSEL_3DES | OP_ALG_AAI_ECB, + }, +- { +- .skcipher = { +- .base = { +- .cra_name = "ecb(arc4)", +- .cra_driver_name = "ecb-arc4-caam", +- .cra_blocksize = ARC4_BLOCK_SIZE, +- }, +- .setkey = arc4_skcipher_setkey, +- .encrypt = skcipher_encrypt, +- .decrypt = skcipher_decrypt, +- .min_keysize = ARC4_MIN_KEY_SIZE, +- .max_keysize = ARC4_MAX_KEY_SIZE, +- }, +- .caam.class1_alg_type = OP_ALG_ALGSEL_ARC4 | OP_ALG_AAI_ECB, +- }, + }; + + static struct caam_aead_alg driver_aeads[] = { +@@ -3533,7 +3512,6 @@ int caam_algapi_init(struct device *ctrldev) + struct caam_drv_private *priv = dev_get_drvdata(ctrldev); + int i = 0, err = 0; + u32 aes_vid, aes_inst, des_inst, md_vid, md_inst, ccha_inst, ptha_inst; +- u32 arc4_inst; + unsigned int md_limit = SHA512_DIGEST_SIZE; + bool registered = false, gcm_support; + +@@ -3553,8 +3531,6 @@ int caam_algapi_init(struct device *ctrldev) + CHA_ID_LS_DES_SHIFT; + aes_inst = cha_inst & CHA_ID_LS_AES_MASK; + md_inst = (cha_inst & CHA_ID_LS_MD_MASK) >> CHA_ID_LS_MD_SHIFT; +- arc4_inst = (cha_inst & CHA_ID_LS_ARC4_MASK) >> +- CHA_ID_LS_ARC4_SHIFT; + ccha_inst = 0; + ptha_inst = 0; + +@@ -3575,7 +3551,6 @@ int caam_algapi_init(struct device *ctrldev) + md_inst = mdha & CHA_VER_NUM_MASK; + ccha_inst = rd_reg32(&priv->ctrl->vreg.ccha) & CHA_VER_NUM_MASK; + ptha_inst = rd_reg32(&priv->ctrl->vreg.ptha) & CHA_VER_NUM_MASK; +- arc4_inst = rd_reg32(&priv->ctrl->vreg.afha) & CHA_VER_NUM_MASK; + + gcm_support = aesa & CHA_VER_MISC_AES_GCM; + } +@@ -3598,10 +3573,6 @@ int caam_algapi_init(struct device *ctrldev) + if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES)) + continue; + +- /* Skip ARC4 algorithms if not supported by device */ +- if (!arc4_inst && alg_sel == OP_ALG_ALGSEL_ARC4) +- continue; +- + /* + * Check support for AES modes not available + * on LP devices. +diff --git a/drivers/crypto/caam/compat.h b/drivers/crypto/caam/compat.h +index 60e2a54c19f11..c3c22a8de4c00 100644 +--- a/drivers/crypto/caam/compat.h ++++ b/drivers/crypto/caam/compat.h +@@ -43,7 +43,6 @@ + #include + #include + #include +-#include + #include + #include + #include +-- +2.25.1 + diff --git a/queue-5.4/devres-keep-both-device-name-and-resource-name-in-pr.patch b/queue-5.4/devres-keep-both-device-name-and-resource-name-in-pr.patch new file mode 100644 index 00000000000..054b3a66b2d --- /dev/null +++ b/queue-5.4/devres-keep-both-device-name-and-resource-name-in-pr.patch @@ -0,0 +1,114 @@ +From afba2c5a674ca26faed1916a3258ad741441a2ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jun 2020 12:58:26 +0300 +Subject: devres: keep both device name and resource name in pretty name + +From: Vladimir Oltean + +[ Upstream commit 35bd8c07db2ce8fd2834ef866240613a4ef982e7 ] + +Sometimes debugging a device is easiest using devmem on its register +map, and that can be seen with /proc/iomem. But some device drivers have +many memory regions. Take for example a networking switch. Its memory +map used to look like this in /proc/iomem: + +1fc000000-1fc3fffff : pcie@1f0000000 + 1fc000000-1fc3fffff : 0000:00:00.5 + 1fc010000-1fc01ffff : sys + 1fc030000-1fc03ffff : rew + 1fc060000-1fc0603ff : s2 + 1fc070000-1fc0701ff : devcpu_gcb + 1fc080000-1fc0800ff : qs + 1fc090000-1fc0900cb : ptp + 1fc100000-1fc10ffff : port0 + 1fc110000-1fc11ffff : port1 + 1fc120000-1fc12ffff : port2 + 1fc130000-1fc13ffff : port3 + 1fc140000-1fc14ffff : port4 + 1fc150000-1fc15ffff : port5 + 1fc200000-1fc21ffff : qsys + 1fc280000-1fc28ffff : ana + +But after the patch in Fixes: was applied, the information is now +presented in a much more opaque way: + +1fc000000-1fc3fffff : pcie@1f0000000 + 1fc000000-1fc3fffff : 0000:00:00.5 + 1fc010000-1fc01ffff : 0000:00:00.5 + 1fc030000-1fc03ffff : 0000:00:00.5 + 1fc060000-1fc0603ff : 0000:00:00.5 + 1fc070000-1fc0701ff : 0000:00:00.5 + 1fc080000-1fc0800ff : 0000:00:00.5 + 1fc090000-1fc0900cb : 0000:00:00.5 + 1fc100000-1fc10ffff : 0000:00:00.5 + 1fc110000-1fc11ffff : 0000:00:00.5 + 1fc120000-1fc12ffff : 0000:00:00.5 + 1fc130000-1fc13ffff : 0000:00:00.5 + 1fc140000-1fc14ffff : 0000:00:00.5 + 1fc150000-1fc15ffff : 0000:00:00.5 + 1fc200000-1fc21ffff : 0000:00:00.5 + 1fc280000-1fc28ffff : 0000:00:00.5 + +That patch made a fair comment that /proc/iomem might be confusing when +it shows resources without an associated device, but we can do better +than just hide the resource name altogether. Namely, we can print the +device name _and_ the resource name. Like this: + +1fc000000-1fc3fffff : pcie@1f0000000 + 1fc000000-1fc3fffff : 0000:00:00.5 + 1fc010000-1fc01ffff : 0000:00:00.5 sys + 1fc030000-1fc03ffff : 0000:00:00.5 rew + 1fc060000-1fc0603ff : 0000:00:00.5 s2 + 1fc070000-1fc0701ff : 0000:00:00.5 devcpu_gcb + 1fc080000-1fc0800ff : 0000:00:00.5 qs + 1fc090000-1fc0900cb : 0000:00:00.5 ptp + 1fc100000-1fc10ffff : 0000:00:00.5 port0 + 1fc110000-1fc11ffff : 0000:00:00.5 port1 + 1fc120000-1fc12ffff : 0000:00:00.5 port2 + 1fc130000-1fc13ffff : 0000:00:00.5 port3 + 1fc140000-1fc14ffff : 0000:00:00.5 port4 + 1fc150000-1fc15ffff : 0000:00:00.5 port5 + 1fc200000-1fc21ffff : 0000:00:00.5 qsys + 1fc280000-1fc28ffff : 0000:00:00.5 ana + +Fixes: 8d84b18f5678 ("devres: always use dev_name() in devm_ioremap_resource()") +Signed-off-by: Vladimir Oltean +Link: https://lore.kernel.org/r/20200601095826.1757621-1-olteanv@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + lib/devres.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/lib/devres.c b/lib/devres.c +index 17624d35e82d4..77c80ca9e4856 100644 +--- a/lib/devres.c ++++ b/lib/devres.c +@@ -155,6 +155,7 @@ void __iomem *devm_ioremap_resource(struct device *dev, + { + resource_size_t size; + void __iomem *dest_ptr; ++ char *pretty_name; + + BUG_ON(!dev); + +@@ -165,7 +166,15 @@ void __iomem *devm_ioremap_resource(struct device *dev, + + size = resource_size(res); + +- if (!devm_request_mem_region(dev, res->start, size, dev_name(dev))) { ++ if (res->name) ++ pretty_name = devm_kasprintf(dev, GFP_KERNEL, "%s %s", ++ dev_name(dev), res->name); ++ else ++ pretty_name = devm_kstrdup(dev, dev_name(dev), GFP_KERNEL); ++ if (!pretty_name) ++ return IOMEM_ERR_PTR(-ENOMEM); ++ ++ if (!devm_request_mem_region(dev, res->start, size, pretty_name)) { + dev_err(dev, "can't request region for resource %pR\n", res); + return IOMEM_ERR_PTR(-EBUSY); + } +-- +2.25.1 + diff --git a/queue-5.4/dm-rq-don-t-call-blk_mq_queue_stopped-in-dm_stop_que.patch b/queue-5.4/dm-rq-don-t-call-blk_mq_queue_stopped-in-dm_stop_que.patch new file mode 100644 index 00000000000..d41a6c6fea1 --- /dev/null +++ b/queue-5.4/dm-rq-don-t-call-blk_mq_queue_stopped-in-dm_stop_que.patch @@ -0,0 +1,45 @@ +From 1b5933f439c4c5cc803931dcdd858c7be66efb7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jun 2020 16:42:14 +0800 +Subject: dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() + +From: Ming Lei + +[ Upstream commit e766668c6cd49d741cfb49eaeb38998ba34d27bc ] + +dm_stop_queue() only uses blk_mq_quiesce_queue() so it doesn't +formally stop the blk-mq queue; therefore there is no point making the +blk_mq_queue_stopped() check -- it will never be stopped. + +In addition, even though dm_stop_queue() actually tries to quiesce hw +queues via blk_mq_quiesce_queue(), checking with blk_queue_quiesced() +to avoid unnecessary queue quiesce isn't reliable because: the +QUEUE_FLAG_QUIESCED flag is set before synchronize_rcu() and +dm_stop_queue() may be called when synchronize_rcu() from another +blk_mq_quiesce_queue() is in-progress. + +Fixes: 7b17c2f7292ba ("dm: Fix a race condition related to stopping and starting queues") +Signed-off-by: Ming Lei +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-rq.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c +index 3f8577e2c13be..2bd2444ad99c6 100644 +--- a/drivers/md/dm-rq.c ++++ b/drivers/md/dm-rq.c +@@ -70,9 +70,6 @@ void dm_start_queue(struct request_queue *q) + + void dm_stop_queue(struct request_queue *q) + { +- if (blk_mq_queue_stopped(q)) +- return; +- + blk_mq_quiesce_queue(q); + } + +-- +2.25.1 + diff --git a/queue-5.4/drm-vmwgfx-fix-two-list_for_each-loop-exit-tests.patch b/queue-5.4/drm-vmwgfx-fix-two-list_for_each-loop-exit-tests.patch new file mode 100644 index 00000000000..e75f9122d70 --- /dev/null +++ b/queue-5.4/drm-vmwgfx-fix-two-list_for_each-loop-exit-tests.patch @@ -0,0 +1,62 @@ +From 75bebdfa81ba1c6eeb4ec7f61dfcf0656af2edba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jun 2020 13:39:59 +0300 +Subject: drm/vmwgfx: Fix two list_for_each loop exit tests + +From: Dan Carpenter + +[ Upstream commit 4437c1152ce0e57ab8f401aa696ea6291cc07ab1 ] + +These if statements are supposed to be true if we ended the +list_for_each_entry() loops without hitting a break statement but they +don't work. + +In the first loop, we increment "i" after the "if (i == unit)" condition +so we don't necessarily know that "i" is not equal to unit at the end of +the loop. + +In the second loop we exit when mode is not pointing to a valid +drm_display_mode struct so it doesn't make sense to check "mode->type". + +Fixes: a278724aa23c ("drm/vmwgfx: Implement fbdev on kms v2") +Signed-off-by: Dan Carpenter +Reviewed-by: Roland Scheidegger +Signed-off-by: Roland Scheidegger +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_kms.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +index f47d5710cc951..33b1519887474 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -2666,7 +2666,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, + ++i; + } + +- if (i != unit) { ++ if (&con->head == &dev_priv->dev->mode_config.connector_list) { + DRM_ERROR("Could not find initial display unit.\n"); + ret = -EINVAL; + goto out_unlock; +@@ -2690,13 +2690,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv, + break; + } + +- if (mode->type & DRM_MODE_TYPE_PREFERRED) +- *p_mode = mode; +- else { ++ if (&mode->head == &con->modes) { + WARN_ONCE(true, "Could not find initial preferred mode.\n"); + *p_mode = list_first_entry(&con->modes, + struct drm_display_mode, + head); ++ } else { ++ *p_mode = mode; + } + + out_unlock: +-- +2.25.1 + diff --git a/queue-5.4/drm-vmwgfx-use-correct-vmw_legacy_display_unit-point.patch b/queue-5.4/drm-vmwgfx-use-correct-vmw_legacy_display_unit-point.patch new file mode 100644 index 00000000000..a7375174d17 --- /dev/null +++ b/queue-5.4/drm-vmwgfx-use-correct-vmw_legacy_display_unit-point.patch @@ -0,0 +1,54 @@ +From b05ac3d89744be00ac94812926fb0ca04d554773 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Jun 2020 13:34:37 +0300 +Subject: drm/vmwgfx: Use correct vmw_legacy_display_unit pointer + +From: Dan Carpenter + +[ Upstream commit 1d2c0c565bc0da25f5e899a862fb58e612b222df ] + +The "entry" pointer is an offset from the list head and it doesn't +point to a valid vmw_legacy_display_unit struct. Presumably the +intent was to point to the last entry. + +Also the "i++" wasn't used so I have removed that as well. + +Fixes: d7e1958dbe4a ("drm/vmwgfx: Support older hardware.") +Signed-off-by: Dan Carpenter +Reviewed-by: Roland Scheidegger +Signed-off-by: Roland Scheidegger +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +index 5702219ec38f6..7b54c1f56208f 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c +@@ -81,7 +81,7 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv) + struct vmw_legacy_display_unit *entry; + struct drm_framebuffer *fb = NULL; + struct drm_crtc *crtc = NULL; +- int i = 0; ++ int i; + + /* If there is no display topology the host just assumes + * that the guest will set the same layout as the host. +@@ -92,12 +92,11 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv) + crtc = &entry->base.crtc; + w = max(w, crtc->x + crtc->mode.hdisplay); + h = max(h, crtc->y + crtc->mode.vdisplay); +- i++; + } + + if (crtc == NULL) + return 0; +- fb = entry->base.crtc.primary->state->fb; ++ fb = crtc->primary->state->fb; + + return vmw_kms_write_svga(dev_priv, w, h, fb->pitches[0], + fb->format->cpp[0] * 8, +-- +2.25.1 + diff --git a/queue-5.4/fs-minix-fix-block-limit-check-for-v1-filesystems.patch b/queue-5.4/fs-minix-fix-block-limit-check-for-v1-filesystems.patch new file mode 100644 index 00000000000..b0604ace8c1 --- /dev/null +++ b/queue-5.4/fs-minix-fix-block-limit-check-for-v1-filesystems.patch @@ -0,0 +1,43 @@ +From 50e421f2b760a75a7825d2c19244c4746e659ae3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 18:35:36 -0700 +Subject: fs/minix: fix block limit check for V1 filesystems + +From: Eric Biggers + +[ Upstream commit 0a12c4a8069607247cb8edc3b035a664e636fd9a ] + +The minix filesystem reads its maximum file size from its on-disk +superblock. This value isn't necessarily a multiple of the block size. +When it's not, the V1 block mapping code doesn't allow mapping the last +possible block. Commit 6ed6a722f9ab ("minixfs: fix block limit check") +fixed this in the V2 mapping code. Fix it in the V1 mapping code too. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Biggers +Signed-off-by: Andrew Morton +Cc: Alexander Viro +Cc: Qiujun Huang +Link: http://lkml.kernel.org/r/20200628060846.682158-6-ebiggers@kernel.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/minix/itree_v1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c +index c0d418209ead1..405573a79aab4 100644 +--- a/fs/minix/itree_v1.c ++++ b/fs/minix/itree_v1.c +@@ -29,7 +29,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH]) + if (block < 0) { + printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n", + block, inode->i_sb->s_bdev); +- } else if (block >= inode->i_sb->s_maxbytes/BLOCK_SIZE) { ++ } else if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes) { + if (printk_ratelimit()) + printk("MINIX-fs: block_to_path: " + "block %ld too big on dev %pg\n", +-- +2.25.1 + diff --git a/queue-5.4/fs-minix-remove-expected-error-message-in-block_to_p.patch b/queue-5.4/fs-minix-remove-expected-error-message-in-block_to_p.patch new file mode 100644 index 00000000000..abd607ba38c --- /dev/null +++ b/queue-5.4/fs-minix-remove-expected-error-message-in-block_to_p.patch @@ -0,0 +1,78 @@ +From d95eed580af0471298f0a2824b95512f92dfba3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 18:35:39 -0700 +Subject: fs/minix: remove expected error message in block_to_path() + +From: Eric Biggers + +[ Upstream commit f666f9fb9a36f1c833b9d18923572f0e4d304754 ] + +When truncating a file to a size within the last allowed logical block, +block_to_path() is called with the *next* block. This exceeds the limit, +causing the "block %ld too big" error message to be printed. + +This case isn't actually an error; there are just no more blocks past that +point. So, remove this error message. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Biggers +Signed-off-by: Andrew Morton +Cc: Alexander Viro +Cc: Qiujun Huang +Link: http://lkml.kernel.org/r/20200628060846.682158-7-ebiggers@kernel.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/minix/itree_v1.c | 12 ++++++------ + fs/minix/itree_v2.c | 12 ++++++------ + 2 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c +index 405573a79aab4..1fed906042aa8 100644 +--- a/fs/minix/itree_v1.c ++++ b/fs/minix/itree_v1.c +@@ -29,12 +29,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH]) + if (block < 0) { + printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n", + block, inode->i_sb->s_bdev); +- } else if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes) { +- if (printk_ratelimit()) +- printk("MINIX-fs: block_to_path: " +- "block %ld too big on dev %pg\n", +- block, inode->i_sb->s_bdev); +- } else if (block < 7) { ++ return 0; ++ } ++ if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes) ++ return 0; ++ ++ if (block < 7) { + offsets[n++] = block; + } else if ((block -= 7) < 512) { + offsets[n++] = 7; +diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c +index ee8af2f9e2828..9d00f31a2d9d1 100644 +--- a/fs/minix/itree_v2.c ++++ b/fs/minix/itree_v2.c +@@ -32,12 +32,12 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH]) + if (block < 0) { + printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n", + block, sb->s_bdev); +- } else if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes) { +- if (printk_ratelimit()) +- printk("MINIX-fs: block_to_path: " +- "block %ld too big on dev %pg\n", +- block, sb->s_bdev); +- } else if (block < DIRCOUNT) { ++ return 0; ++ } ++ if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes) ++ return 0; ++ ++ if (block < DIRCOUNT) { + offsets[n++] = block; + } else if ((block -= DIRCOUNT) < INDIRCOUNT(sb)) { + offsets[n++] = DIRCOUNT; +-- +2.25.1 + diff --git a/queue-5.4/fs-minix-set-s_maxbytes-correctly.patch b/queue-5.4/fs-minix-set-s_maxbytes-correctly.patch new file mode 100644 index 00000000000..afa2c525765 --- /dev/null +++ b/queue-5.4/fs-minix-set-s_maxbytes-correctly.patch @@ -0,0 +1,125 @@ +From 52869404092e6905fd655c7914065e2f37bf0137 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 18:35:33 -0700 +Subject: fs/minix: set s_maxbytes correctly + +From: Eric Biggers + +[ Upstream commit 32ac86efff91a3e4ef8c3d1cadd4559e23c8e73a ] + +The minix filesystem leaves super_block::s_maxbytes at MAX_NON_LFS rather +than setting it to the actual filesystem-specific limit. This is broken +because it means userspace doesn't see the standard behavior like getting +EFBIG and SIGXFSZ when exceeding the maximum file size. + +Fix this by setting s_maxbytes correctly. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Eric Biggers +Signed-off-by: Andrew Morton +Cc: Alexander Viro +Cc: Qiujun Huang +Link: http://lkml.kernel.org/r/20200628060846.682158-5-ebiggers@kernel.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/minix/inode.c | 12 +++++++----- + fs/minix/itree_v1.c | 2 +- + fs/minix/itree_v2.c | 3 +-- + fs/minix/minix.h | 1 - + 4 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 0dd929346f3f3..7b09a9158e401 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -150,8 +150,10 @@ static int minix_remount (struct super_block * sb, int * flags, char * data) + return 0; + } + +-static bool minix_check_superblock(struct minix_sb_info *sbi) ++static bool minix_check_superblock(struct super_block *sb) + { ++ struct minix_sb_info *sbi = minix_sb(sb); ++ + if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0) + return false; + +@@ -161,7 +163,7 @@ static bool minix_check_superblock(struct minix_sb_info *sbi) + * of indirect blocks which places the limit well above U32_MAX. + */ + if (sbi->s_version == MINIX_V1 && +- sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE) ++ sb->s_maxbytes > (7 + 512 + 512*512) * BLOCK_SIZE) + return false; + + return true; +@@ -202,7 +204,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + sbi->s_zmap_blocks = ms->s_zmap_blocks; + sbi->s_firstdatazone = ms->s_firstdatazone; + sbi->s_log_zone_size = ms->s_log_zone_size; +- sbi->s_max_size = ms->s_max_size; ++ s->s_maxbytes = ms->s_max_size; + s->s_magic = ms->s_magic; + if (s->s_magic == MINIX_SUPER_MAGIC) { + sbi->s_version = MINIX_V1; +@@ -233,7 +235,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + sbi->s_zmap_blocks = m3s->s_zmap_blocks; + sbi->s_firstdatazone = m3s->s_firstdatazone; + sbi->s_log_zone_size = m3s->s_log_zone_size; +- sbi->s_max_size = m3s->s_max_size; ++ s->s_maxbytes = m3s->s_max_size; + sbi->s_ninodes = m3s->s_ninodes; + sbi->s_nzones = m3s->s_zones; + sbi->s_dirsize = 64; +@@ -245,7 +247,7 @@ static int minix_fill_super(struct super_block *s, void *data, int silent) + } else + goto out_no_fs; + +- if (!minix_check_superblock(sbi)) ++ if (!minix_check_superblock(s)) + goto out_illegal_sb; + + /* +diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c +index 046cc96ee7adb..c0d418209ead1 100644 +--- a/fs/minix/itree_v1.c ++++ b/fs/minix/itree_v1.c +@@ -29,7 +29,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH]) + if (block < 0) { + printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n", + block, inode->i_sb->s_bdev); +- } else if (block >= (minix_sb(inode->i_sb)->s_max_size/BLOCK_SIZE)) { ++ } else if (block >= inode->i_sb->s_maxbytes/BLOCK_SIZE) { + if (printk_ratelimit()) + printk("MINIX-fs: block_to_path: " + "block %ld too big on dev %pg\n", +diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c +index f7fc7eccccccd..ee8af2f9e2828 100644 +--- a/fs/minix/itree_v2.c ++++ b/fs/minix/itree_v2.c +@@ -32,8 +32,7 @@ static int block_to_path(struct inode * inode, long block, int offsets[DEPTH]) + if (block < 0) { + printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n", + block, sb->s_bdev); +- } else if ((u64)block * (u64)sb->s_blocksize >= +- minix_sb(sb)->s_max_size) { ++ } else if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes) { + if (printk_ratelimit()) + printk("MINIX-fs: block_to_path: " + "block %ld too big on dev %pg\n", +diff --git a/fs/minix/minix.h b/fs/minix/minix.h +index df081e8afcc3c..168d45d3de73e 100644 +--- a/fs/minix/minix.h ++++ b/fs/minix/minix.h +@@ -32,7 +32,6 @@ struct minix_sb_info { + unsigned long s_zmap_blocks; + unsigned long s_firstdatazone; + unsigned long s_log_zone_size; +- unsigned long s_max_size; + int s_dirsize; + int s_namelen; + struct buffer_head ** s_imap; +-- +2.25.1 + diff --git a/queue-5.4/fs-ufs-avoid-potential-u32-multiplication-overflow.patch b/queue-5.4/fs-ufs-avoid-potential-u32-multiplication-overflow.patch new file mode 100644 index 00000000000..e9c5c539c73 --- /dev/null +++ b/queue-5.4/fs-ufs-avoid-potential-u32-multiplication-overflow.patch @@ -0,0 +1,44 @@ +From ea6919ebf8aba3fb536abe3c4132fb8e2a3328c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 18:35:53 -0700 +Subject: fs/ufs: avoid potential u32 multiplication overflow + +From: Colin Ian King + +[ Upstream commit 88b2e9b06381551b707d980627ad0591191f7a2d ] + +The 64 bit ino is being compared to the product of two u32 values, +however, the multiplication is being performed using a 32 bit multiply so +there is a potential of an overflow. To be fully safe, cast uspi->s_ncg +to a u64 to ensure a 64 bit multiplication occurs to avoid any chance of +overflow. + +Fixes: f3e2a520f5fb ("ufs: NFS support") +Signed-off-by: Colin Ian King +Signed-off-by: Andrew Morton +Cc: Evgeniy Dushistov +Cc: Alexey Dobriyan +Link: http://lkml.kernel.org/r/20200715170355.1081713-1-colin.king@canonical.com +Addresses-Coverity: ("Unintentional integer overflow") +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ufs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/ufs/super.c b/fs/ufs/super.c +index 1da0be667409b..e3b69fb280e8c 100644 +--- a/fs/ufs/super.c ++++ b/fs/ufs/super.c +@@ -101,7 +101,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block *sb, u64 ino, u32 gene + struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi; + struct inode *inode; + +- if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg) ++ if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg) + return ERR_PTR(-ESTALE); + + inode = ufs_iget(sb, ino); +-- +2.25.1 + diff --git a/queue-5.4/gpu-ipu-v3-image-convert-combine-rotate-no-rotate-ir.patch b/queue-5.4/gpu-ipu-v3-image-convert-combine-rotate-no-rotate-ir.patch new file mode 100644 index 00000000000..a95719c0c67 --- /dev/null +++ b/queue-5.4/gpu-ipu-v3-image-convert-combine-rotate-no-rotate-ir.patch @@ -0,0 +1,118 @@ +From bb9ce6d92568a2992b49130d471725291ae1de97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 15:40:37 -0700 +Subject: gpu: ipu-v3: image-convert: Combine rotate/no-rotate irq handlers + +From: Steve Longerbeam + +[ Upstream commit 0f6245f42ce9b7e4d20f2cda8d5f12b55a44d7d1 ] + +Combine the rotate_irq() and norotate_irq() handlers into a single +eof_irq() handler. + +Signed-off-by: Steve Longerbeam +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/gpu/ipu-v3/ipu-image-convert.c | 58 +++++++++----------------- + 1 file changed, 20 insertions(+), 38 deletions(-) + +diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c +index eeca50d9a1ee4..f8b031ded3cf2 100644 +--- a/drivers/gpu/ipu-v3/ipu-image-convert.c ++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c +@@ -1709,9 +1709,10 @@ static irqreturn_t do_irq(struct ipu_image_convert_run *run) + return IRQ_WAKE_THREAD; + } + +-static irqreturn_t norotate_irq(int irq, void *data) ++static irqreturn_t eof_irq(int irq, void *data) + { + struct ipu_image_convert_chan *chan = data; ++ struct ipu_image_convert_priv *priv = chan->priv; + struct ipu_image_convert_ctx *ctx; + struct ipu_image_convert_run *run; + unsigned long flags; +@@ -1728,45 +1729,26 @@ static irqreturn_t norotate_irq(int irq, void *data) + + ctx = run->ctx; + +- if (ipu_rot_mode_is_irt(ctx->rot_mode)) { +- /* this is a rotation operation, just ignore */ +- spin_unlock_irqrestore(&chan->irqlock, flags); +- return IRQ_HANDLED; +- } +- +- ret = do_irq(run); +-out: +- spin_unlock_irqrestore(&chan->irqlock, flags); +- return ret; +-} +- +-static irqreturn_t rotate_irq(int irq, void *data) +-{ +- struct ipu_image_convert_chan *chan = data; +- struct ipu_image_convert_priv *priv = chan->priv; +- struct ipu_image_convert_ctx *ctx; +- struct ipu_image_convert_run *run; +- unsigned long flags; +- irqreturn_t ret; +- +- spin_lock_irqsave(&chan->irqlock, flags); +- +- /* get current run and its context */ +- run = chan->current_run; +- if (!run) { ++ if (irq == chan->out_eof_irq) { ++ if (ipu_rot_mode_is_irt(ctx->rot_mode)) { ++ /* this is a rotation op, just ignore */ ++ ret = IRQ_HANDLED; ++ goto out; ++ } ++ } else if (irq == chan->rot_out_eof_irq) { ++ if (!ipu_rot_mode_is_irt(ctx->rot_mode)) { ++ /* this was NOT a rotation op, shouldn't happen */ ++ dev_err(priv->ipu->dev, ++ "Unexpected rotation interrupt\n"); ++ ret = IRQ_HANDLED; ++ goto out; ++ } ++ } else { ++ dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq); + ret = IRQ_NONE; + goto out; + } + +- ctx = run->ctx; +- +- if (!ipu_rot_mode_is_irt(ctx->rot_mode)) { +- /* this was NOT a rotation operation, shouldn't happen */ +- dev_err(priv->ipu->dev, "Unexpected rotation interrupt\n"); +- spin_unlock_irqrestore(&chan->irqlock, flags); +- return IRQ_HANDLED; +- } +- + ret = do_irq(run); + out: + spin_unlock_irqrestore(&chan->irqlock, flags); +@@ -1859,7 +1841,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan) + chan->out_chan, + IPU_IRQ_EOF); + +- ret = request_threaded_irq(chan->out_eof_irq, norotate_irq, do_bh, ++ ret = request_threaded_irq(chan->out_eof_irq, eof_irq, do_bh, + 0, "ipu-ic", chan); + if (ret < 0) { + dev_err(priv->ipu->dev, "could not acquire irq %d\n", +@@ -1872,7 +1854,7 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan) + chan->rotation_out_chan, + IPU_IRQ_EOF); + +- ret = request_threaded_irq(chan->rot_out_eof_irq, rotate_irq, do_bh, ++ ret = request_threaded_irq(chan->rot_out_eof_irq, eof_irq, do_bh, + 0, "ipu-ic", chan); + if (ret < 0) { + dev_err(priv->ipu->dev, "could not acquire irq %d\n", +-- +2.25.1 + diff --git a/queue-5.4/gpu-ipu-v3-image-convert-wait-for-all-eofs-before-co.patch b/queue-5.4/gpu-ipu-v3-image-convert-wait-for-all-eofs-before-co.patch new file mode 100644 index 00000000000..448753fe36d --- /dev/null +++ b/queue-5.4/gpu-ipu-v3-image-convert-wait-for-all-eofs-before-co.patch @@ -0,0 +1,249 @@ +From e3e7955343c1c49c359fed594369e337ce35ce3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jun 2020 11:13:37 -0700 +Subject: gpu: ipu-v3: image-convert: Wait for all EOFs before completing a + tile + +From: Steve Longerbeam + +[ Upstream commit dd81d821d0b3f77d949d0cac5c05c1f05b921d46 ] + +Use a bit-mask of EOF irqs to determine when all required idmac +channel EOFs have been received for a tile conversion, and only do +tile completion processing after all EOFs have been received. Otherwise +it was found that a conversion would stall after the completion of a +tile and the start of the next tile, because the input/read idmac +channel had not completed and entered idle state, thus locking up the +channel when attempting to re-start it for the next tile. + +Fixes: 0537db801bb01 ("gpu: ipu-v3: image-convert: reconfigure IC per tile") +Signed-off-by: Steve Longerbeam +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/gpu/ipu-v3/ipu-image-convert.c | 109 +++++++++++++++++++------ + 1 file changed, 82 insertions(+), 27 deletions(-) + +diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c b/drivers/gpu/ipu-v3/ipu-image-convert.c +index f8b031ded3cf2..aa1d4b6d278f7 100644 +--- a/drivers/gpu/ipu-v3/ipu-image-convert.c ++++ b/drivers/gpu/ipu-v3/ipu-image-convert.c +@@ -137,6 +137,17 @@ struct ipu_image_convert_ctx; + struct ipu_image_convert_chan; + struct ipu_image_convert_priv; + ++enum eof_irq_mask { ++ EOF_IRQ_IN = BIT(0), ++ EOF_IRQ_ROT_IN = BIT(1), ++ EOF_IRQ_OUT = BIT(2), ++ EOF_IRQ_ROT_OUT = BIT(3), ++}; ++ ++#define EOF_IRQ_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT) ++#define EOF_IRQ_ROT_COMPLETE (EOF_IRQ_IN | EOF_IRQ_OUT | \ ++ EOF_IRQ_ROT_IN | EOF_IRQ_ROT_OUT) ++ + struct ipu_image_convert_ctx { + struct ipu_image_convert_chan *chan; + +@@ -173,6 +184,9 @@ struct ipu_image_convert_ctx { + /* where to place converted tile in dest image */ + unsigned int out_tile_map[MAX_TILES]; + ++ /* mask of completed EOF irqs at every tile conversion */ ++ enum eof_irq_mask eof_mask; ++ + struct list_head list; + }; + +@@ -189,6 +203,8 @@ struct ipu_image_convert_chan { + struct ipuv3_channel *rotation_out_chan; + + /* the IPU end-of-frame irqs */ ++ int in_eof_irq; ++ int rot_in_eof_irq; + int out_eof_irq; + int rot_out_eof_irq; + +@@ -1380,6 +1396,9 @@ static int convert_start(struct ipu_image_convert_run *run, unsigned int tile) + dev_dbg(priv->ipu->dev, "%s: task %u: starting ctx %p run %p tile %u -> %u\n", + __func__, chan->ic_task, ctx, run, tile, dst_tile); + ++ /* clear EOF irq mask */ ++ ctx->eof_mask = 0; ++ + if (ipu_rot_mode_is_irt(ctx->rot_mode)) { + /* swap width/height for resizer */ + dest_width = d_image->tile[dst_tile].height; +@@ -1615,7 +1634,7 @@ static bool ic_settings_changed(struct ipu_image_convert_ctx *ctx) + } + + /* hold irqlock when calling */ +-static irqreturn_t do_irq(struct ipu_image_convert_run *run) ++static irqreturn_t do_tile_complete(struct ipu_image_convert_run *run) + { + struct ipu_image_convert_ctx *ctx = run->ctx; + struct ipu_image_convert_chan *chan = ctx->chan; +@@ -1700,6 +1719,7 @@ static irqreturn_t do_irq(struct ipu_image_convert_run *run) + ctx->cur_buf_num ^= 1; + } + ++ ctx->eof_mask = 0; /* clear EOF irq mask for next tile */ + ctx->next_tile++; + return IRQ_HANDLED; + done: +@@ -1715,8 +1735,9 @@ static irqreturn_t eof_irq(int irq, void *data) + struct ipu_image_convert_priv *priv = chan->priv; + struct ipu_image_convert_ctx *ctx; + struct ipu_image_convert_run *run; ++ irqreturn_t ret = IRQ_HANDLED; ++ bool tile_complete = false; + unsigned long flags; +- irqreturn_t ret; + + spin_lock_irqsave(&chan->irqlock, flags); + +@@ -1729,27 +1750,33 @@ static irqreturn_t eof_irq(int irq, void *data) + + ctx = run->ctx; + +- if (irq == chan->out_eof_irq) { +- if (ipu_rot_mode_is_irt(ctx->rot_mode)) { +- /* this is a rotation op, just ignore */ +- ret = IRQ_HANDLED; +- goto out; +- } +- } else if (irq == chan->rot_out_eof_irq) { ++ if (irq == chan->in_eof_irq) { ++ ctx->eof_mask |= EOF_IRQ_IN; ++ } else if (irq == chan->out_eof_irq) { ++ ctx->eof_mask |= EOF_IRQ_OUT; ++ } else if (irq == chan->rot_in_eof_irq || ++ irq == chan->rot_out_eof_irq) { + if (!ipu_rot_mode_is_irt(ctx->rot_mode)) { + /* this was NOT a rotation op, shouldn't happen */ + dev_err(priv->ipu->dev, + "Unexpected rotation interrupt\n"); +- ret = IRQ_HANDLED; + goto out; + } ++ ctx->eof_mask |= (irq == chan->rot_in_eof_irq) ? ++ EOF_IRQ_ROT_IN : EOF_IRQ_ROT_OUT; + } else { + dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq); + ret = IRQ_NONE; + goto out; + } + +- ret = do_irq(run); ++ if (ipu_rot_mode_is_irt(ctx->rot_mode)) ++ tile_complete = (ctx->eof_mask == EOF_IRQ_ROT_COMPLETE); ++ else ++ tile_complete = (ctx->eof_mask == EOF_IRQ_COMPLETE); ++ ++ if (tile_complete) ++ ret = do_tile_complete(run); + out: + spin_unlock_irqrestore(&chan->irqlock, flags); + return ret; +@@ -1783,6 +1810,10 @@ static void force_abort(struct ipu_image_convert_ctx *ctx) + + static void release_ipu_resources(struct ipu_image_convert_chan *chan) + { ++ if (chan->in_eof_irq >= 0) ++ free_irq(chan->in_eof_irq, chan); ++ if (chan->rot_in_eof_irq >= 0) ++ free_irq(chan->rot_in_eof_irq, chan); + if (chan->out_eof_irq >= 0) + free_irq(chan->out_eof_irq, chan); + if (chan->rot_out_eof_irq >= 0) +@@ -1801,7 +1832,27 @@ static void release_ipu_resources(struct ipu_image_convert_chan *chan) + + chan->in_chan = chan->out_chan = chan->rotation_in_chan = + chan->rotation_out_chan = NULL; +- chan->out_eof_irq = chan->rot_out_eof_irq = -1; ++ chan->in_eof_irq = -1; ++ chan->rot_in_eof_irq = -1; ++ chan->out_eof_irq = -1; ++ chan->rot_out_eof_irq = -1; ++} ++ ++static int get_eof_irq(struct ipu_image_convert_chan *chan, ++ struct ipuv3_channel *channel) ++{ ++ struct ipu_image_convert_priv *priv = chan->priv; ++ int ret, irq; ++ ++ irq = ipu_idmac_channel_irq(priv->ipu, channel, IPU_IRQ_EOF); ++ ++ ret = request_threaded_irq(irq, eof_irq, do_bh, 0, "ipu-ic", chan); ++ if (ret < 0) { ++ dev_err(priv->ipu->dev, "could not acquire irq %d\n", irq); ++ return ret; ++ } ++ ++ return irq; + } + + static int get_ipu_resources(struct ipu_image_convert_chan *chan) +@@ -1837,31 +1888,33 @@ static int get_ipu_resources(struct ipu_image_convert_chan *chan) + } + + /* acquire the EOF interrupts */ +- chan->out_eof_irq = ipu_idmac_channel_irq(priv->ipu, +- chan->out_chan, +- IPU_IRQ_EOF); ++ ret = get_eof_irq(chan, chan->in_chan); ++ if (ret < 0) { ++ chan->in_eof_irq = -1; ++ goto err; ++ } ++ chan->in_eof_irq = ret; + +- ret = request_threaded_irq(chan->out_eof_irq, eof_irq, do_bh, +- 0, "ipu-ic", chan); ++ ret = get_eof_irq(chan, chan->rotation_in_chan); + if (ret < 0) { +- dev_err(priv->ipu->dev, "could not acquire irq %d\n", +- chan->out_eof_irq); +- chan->out_eof_irq = -1; ++ chan->rot_in_eof_irq = -1; + goto err; + } ++ chan->rot_in_eof_irq = ret; + +- chan->rot_out_eof_irq = ipu_idmac_channel_irq(priv->ipu, +- chan->rotation_out_chan, +- IPU_IRQ_EOF); ++ ret = get_eof_irq(chan, chan->out_chan); ++ if (ret < 0) { ++ chan->out_eof_irq = -1; ++ goto err; ++ } ++ chan->out_eof_irq = ret; + +- ret = request_threaded_irq(chan->rot_out_eof_irq, eof_irq, do_bh, +- 0, "ipu-ic", chan); ++ ret = get_eof_irq(chan, chan->rotation_out_chan); + if (ret < 0) { +- dev_err(priv->ipu->dev, "could not acquire irq %d\n", +- chan->rot_out_eof_irq); + chan->rot_out_eof_irq = -1; + goto err; + } ++ chan->rot_out_eof_irq = ret; + + return 0; + err: +@@ -2440,6 +2493,8 @@ int ipu_image_convert_init(struct ipu_soc *ipu, struct device *dev) + chan->ic_task = i; + chan->priv = priv; + chan->dma_ch = &image_convert_dma_chan[i]; ++ chan->in_eof_irq = -1; ++ chan->rot_in_eof_irq = -1; + chan->out_eof_irq = -1; + chan->rot_out_eof_irq = -1; + +-- +2.25.1 + diff --git a/queue-5.4/i2c-iproc-fix-race-between-client-unreg-and-isr.patch b/queue-5.4/i2c-iproc-fix-race-between-client-unreg-and-isr.patch new file mode 100644 index 00000000000..1d1999597b7 --- /dev/null +++ b/queue-5.4/i2c-iproc-fix-race-between-client-unreg-and-isr.patch @@ -0,0 +1,103 @@ +From ae76bf90f705ce3f239d90e3655b62ba5fa017be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 17:42:40 -0700 +Subject: i2c: iproc: fix race between client unreg and isr + +From: Dhananjay Phadke + +[ Upstream commit b1eef236f50ba6afea680da039ef3a2ca9c43d11 ] + +When i2c client unregisters, synchronize irq before setting +iproc_i2c->slave to NULL. + +(1) disable_irq() +(2) Mask event enable bits in control reg +(3) Erase slave address (avoid further writes to rx fifo) +(4) Flush tx and rx FIFOs +(5) Clear pending event (interrupt) bits in status reg +(6) enable_irq() +(7) Set client pointer to NULL + +Unable to handle kernel NULL pointer dereference at virtual address 0000000000000318 + +[ 371.020421] pc : bcm_iproc_i2c_isr+0x530/0x11f0 +[ 371.025098] lr : __handle_irq_event_percpu+0x6c/0x170 +[ 371.030309] sp : ffff800010003e40 +[ 371.033727] x29: ffff800010003e40 x28: 0000000000000060 +[ 371.039206] x27: ffff800010ca9de0 x26: ffff800010f895df +[ 371.044686] x25: ffff800010f18888 x24: ffff0008f7ff3600 +[ 371.050165] x23: 0000000000000003 x22: 0000000001600000 +[ 371.055645] x21: ffff800010f18888 x20: 0000000001600000 +[ 371.061124] x19: ffff0008f726f080 x18: 0000000000000000 +[ 371.066603] x17: 0000000000000000 x16: 0000000000000000 +[ 371.072082] x15: 0000000000000000 x14: 0000000000000000 +[ 371.077561] x13: 0000000000000000 x12: 0000000000000001 +[ 371.083040] x11: 0000000000000000 x10: 0000000000000040 +[ 371.088519] x9 : ffff800010f317c8 x8 : ffff800010f317c0 +[ 371.093999] x7 : ffff0008f805b3b0 x6 : 0000000000000000 +[ 371.099478] x5 : ffff0008f7ff36a4 x4 : ffff8008ee43d000 +[ 371.104957] x3 : 0000000000000000 x2 : ffff8000107d64c0 +[ 371.110436] x1 : 00000000c00000af x0 : 0000000000000000 + +[ 371.115916] Call trace: +[ 371.118439] bcm_iproc_i2c_isr+0x530/0x11f0 +[ 371.122754] __handle_irq_event_percpu+0x6c/0x170 +[ 371.127606] handle_irq_event_percpu+0x34/0x88 +[ 371.132189] handle_irq_event+0x40/0x120 +[ 371.136234] handle_fasteoi_irq+0xcc/0x1a0 +[ 371.140459] generic_handle_irq+0x24/0x38 +[ 371.144594] __handle_domain_irq+0x60/0xb8 +[ 371.148820] gic_handle_irq+0xc0/0x158 +[ 371.152687] el1_irq+0xb8/0x140 +[ 371.155927] arch_cpu_idle+0x10/0x18 +[ 371.159615] do_idle+0x204/0x290 +[ 371.162943] cpu_startup_entry+0x24/0x60 +[ 371.166990] rest_init+0xb0/0xbc +[ 371.170322] arch_call_rest_init+0xc/0x14 +[ 371.174458] start_kernel+0x404/0x430 + +Fixes: c245d94ed106 ("i2c: iproc: Add multi byte read-write support for slave mode") + +Signed-off-by: Dhananjay Phadke +Reviewed-by: Florian Fainelli +Acked-by: Ray Jui +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-bcm-iproc.c | 13 ++++++++++++- + 1 file changed, 12 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-bcm-iproc.c b/drivers/i2c/busses/i2c-bcm-iproc.c +index 03475f1799730..dd9661c11782a 100644 +--- a/drivers/i2c/busses/i2c-bcm-iproc.c ++++ b/drivers/i2c/busses/i2c-bcm-iproc.c +@@ -1037,7 +1037,7 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave) + if (!iproc_i2c->slave) + return -EINVAL; + +- iproc_i2c->slave = NULL; ++ disable_irq(iproc_i2c->irq); + + /* disable all slave interrupts */ + tmp = iproc_i2c_rd_reg(iproc_i2c, IE_OFFSET); +@@ -1050,6 +1050,17 @@ static int bcm_iproc_i2c_unreg_slave(struct i2c_client *slave) + tmp &= ~BIT(S_CFG_EN_NIC_SMB_ADDR3_SHIFT); + iproc_i2c_wr_reg(iproc_i2c, S_CFG_SMBUS_ADDR_OFFSET, tmp); + ++ /* flush TX/RX FIFOs */ ++ tmp = (BIT(S_FIFO_RX_FLUSH_SHIFT) | BIT(S_FIFO_TX_FLUSH_SHIFT)); ++ iproc_i2c_wr_reg(iproc_i2c, S_FIFO_CTRL_OFFSET, tmp); ++ ++ /* clear all pending slave interrupts */ ++ iproc_i2c_wr_reg(iproc_i2c, IS_OFFSET, ISR_MASK_SLAVE); ++ ++ iproc_i2c->slave = NULL; ++ ++ enable_irq(iproc_i2c->irq); ++ + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.4/i2c-rcar-avoid-race-when-unregistering-slave.patch b/queue-5.4/i2c-rcar-avoid-race-when-unregistering-slave.patch new file mode 100644 index 00000000000..8ad702902e0 --- /dev/null +++ b/queue-5.4/i2c-rcar-avoid-race-when-unregistering-slave.patch @@ -0,0 +1,56 @@ +From 3816fef6df1a58c0a2127bc7199b826ec64e225b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Jul 2020 18:16:06 +0200 +Subject: i2c: rcar: avoid race when unregistering slave +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Wolfram Sang + +[ Upstream commit c7c9e914f9a0478fba4dc6f227cfd69cf84a4063 ] + +Due to the lockless design of the driver, it is theoretically possible +to access a NULL pointer, if a slave interrupt was running while we were +unregistering the slave. To make this rock solid, disable the interrupt +for a short time while we are clearing the interrupt_enable register. +This patch is purely based on code inspection. The OOPS is super-hard to +trigger because clearing SAR (the address) makes interrupts even more +unlikely to happen as well. While here, reinit SCR to SDBS because this +bit should always be set according to documentation. There is no effect, +though, because the interface is disabled. + +Fixes: 7b814d852af6 ("i2c: rcar: avoid race when unregistering slave client") +Signed-off-by: Wolfram Sang +Reviewed-by: Niklas Söderlund +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 3ea6013a3d68a..0b90aa0318df3 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -863,12 +863,14 @@ static int rcar_unreg_slave(struct i2c_client *slave) + + WARN_ON(!priv->slave); + +- /* disable irqs and ensure none is running before clearing ptr */ ++ /* ensure no irq is running before clearing ptr */ ++ disable_irq(priv->irq); + rcar_i2c_write(priv, ICSIER, 0); +- rcar_i2c_write(priv, ICSCR, 0); ++ rcar_i2c_write(priv, ICSSR, 0); ++ enable_irq(priv->irq); ++ rcar_i2c_write(priv, ICSCR, SDBS); + rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */ + +- synchronize_irq(priv->irq); + priv->slave = NULL; + + pm_runtime_put(rcar_i2c_priv_to_dev(priv)); +-- +2.25.1 + diff --git a/queue-5.4/i2c-rcar-slave-only-send-stop-event-when-we-have-bee.patch b/queue-5.4/i2c-rcar-slave-only-send-stop-event-when-we-have-bee.patch new file mode 100644 index 00000000000..55f89f911ce --- /dev/null +++ b/queue-5.4/i2c-rcar-slave-only-send-stop-event-when-we-have-bee.patch @@ -0,0 +1,55 @@ +From 389076f34d8afd3ebdc82d36770be462fb199783 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Jun 2020 17:38:07 +0200 +Subject: i2c: rcar: slave: only send STOP event when we have been addressed + +From: Wolfram Sang + +[ Upstream commit 314139f9f0abdba61ed9a8463bbcb0bf900ac5a2 ] + +When the SSR interrupt is activated, it will detect every STOP condition +on the bus, not only the ones after we have been addressed. So, enable +this interrupt only after we have been addressed, and disable it +otherwise. + +Fixes: de20d1857dd6 ("i2c: rcar: add slave support") +Signed-off-by: Wolfram Sang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-rcar.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c +index 36af8fdb66586..3ea6013a3d68a 100644 +--- a/drivers/i2c/busses/i2c-rcar.c ++++ b/drivers/i2c/busses/i2c-rcar.c +@@ -580,13 +580,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv) + rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR); + } + +- rcar_i2c_write(priv, ICSSR, ~SAR & 0xff); ++ /* Clear SSR, too, because of old STOPs to other clients than us */ ++ rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff); + } + + /* master sent stop */ + if (ssr_filtered & SSR) { + i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value); +- rcar_i2c_write(priv, ICSIER, SAR | SSR); ++ rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSSR, ~SSR & 0xff); + } + +@@ -850,7 +851,7 @@ static int rcar_reg_slave(struct i2c_client *slave) + priv->slave = slave; + rcar_i2c_write(priv, ICSAR, slave->addr); + rcar_i2c_write(priv, ICSSR, 0); +- rcar_i2c_write(priv, ICSIER, SAR | SSR); ++ rcar_i2c_write(priv, ICSIER, SAR); + rcar_i2c_write(priv, ICSCR, SIE | SDBS); + + return 0; +-- +2.25.1 + diff --git a/queue-5.4/ib-uverbs-set-iova-on-ib-mr-in-uverbs-layer.patch b/queue-5.4/ib-uverbs-set-iova-on-ib-mr-in-uverbs-layer.patch new file mode 100644 index 00000000000..b4f63332e47 --- /dev/null +++ b/queue-5.4/ib-uverbs-set-iova-on-ib-mr-in-uverbs-layer.patch @@ -0,0 +1,75 @@ +From bf1a9020583551f8be9c8260cf75055a33f405b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 30 Jun 2020 12:39:11 +0300 +Subject: IB/uverbs: Set IOVA on IB MR in uverbs layer + +From: Yishai Hadas + +[ Upstream commit 04c0a5fcfcf65aade2fb238b6336445f1a99b646 ] + +Set IOVA on IB MR in uverbs layer to let all drivers have it, this +includes both reg/rereg MR flows. +As part of this change cleaned-up this setting from the drivers that +already did it by themselves in their user flows. + +Fixes: e6f0330106f4 ("mlx4_ib: set user mr attributes in struct ib_mr") +Link: https://lore.kernel.org/r/20200630093916.332097-3-leon@kernel.org +Signed-off-by: Yishai Hadas +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/uverbs_cmd.c | 4 ++++ + drivers/infiniband/hw/cxgb4/mem.c | 1 - + drivers/infiniband/hw/mlx4/mr.c | 1 - + 3 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index e2ddcb0dc4ee3..c398d1a64614c 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -757,6 +757,7 @@ static int ib_uverbs_reg_mr(struct uverbs_attr_bundle *attrs) + mr->uobject = uobj; + atomic_inc(&pd->usecnt); + mr->res.type = RDMA_RESTRACK_MR; ++ mr->iova = cmd.hca_va; + rdma_restrack_uadd(&mr->res); + + uobj->object = mr; +@@ -847,6 +848,9 @@ static int ib_uverbs_rereg_mr(struct uverbs_attr_bundle *attrs) + atomic_dec(&old_pd->usecnt); + } + ++ if (cmd.flags & IB_MR_REREG_TRANS) ++ mr->iova = cmd.hca_va; ++ + memset(&resp, 0, sizeof(resp)); + resp.lkey = mr->lkey; + resp.rkey = mr->rkey; +diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c +index 35c284af574da..dcb58cef336d9 100644 +--- a/drivers/infiniband/hw/cxgb4/mem.c ++++ b/drivers/infiniband/hw/cxgb4/mem.c +@@ -399,7 +399,6 @@ static int finish_mem_reg(struct c4iw_mr *mhp, u32 stag) + mmid = stag >> 8; + mhp->ibmr.rkey = mhp->ibmr.lkey = stag; + mhp->ibmr.length = mhp->attr.len; +- mhp->ibmr.iova = mhp->attr.va_fbo; + mhp->ibmr.page_size = 1U << (mhp->attr.page_size + 12); + pr_debug("mmid 0x%x mhp %p\n", mmid, mhp); + return xa_insert_irq(&mhp->rhp->mrs, mmid, mhp, GFP_KERNEL); +diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c +index 6ae503cfc5264..9114cb7307692 100644 +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -439,7 +439,6 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, + + mr->ibmr.rkey = mr->ibmr.lkey = mr->mmr.key; + mr->ibmr.length = length; +- mr->ibmr.iova = virt_addr; + mr->ibmr.page_size = 1U << shift; + + return &mr->ibmr; +-- +2.25.1 + diff --git a/queue-5.4/input-sentelic-fix-error-return-when-fsp_reg_write-f.patch b/queue-5.4/input-sentelic-fix-error-return-when-fsp_reg_write-f.patch new file mode 100644 index 00000000000..8d4e4ef2585 --- /dev/null +++ b/queue-5.4/input-sentelic-fix-error-return-when-fsp_reg_write-f.patch @@ -0,0 +1,39 @@ +From 11c7fbb176ee4f984cf609ad7e96afec865430f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 15:35:34 -0700 +Subject: Input: sentelic - fix error return when fsp_reg_write fails + +From: Colin Ian King + +[ Upstream commit ea38f06e0291986eb93beb6d61fd413607a30ca4 ] + +Currently when the call to fsp_reg_write fails -EIO is not being returned +because the count is being returned instead of the return value in retval. +Fix this by returning the value in retval instead of count. + +Addresses-Coverity: ("Unused value") +Fixes: fc69f4a6af49 ("Input: add new driver for Sentelic Finger Sensing Pad") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20200603141218.131663-1-colin.king@canonical.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/mouse/sentelic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c +index e99d9bf1a267d..e78c4c7eda34d 100644 +--- a/drivers/input/mouse/sentelic.c ++++ b/drivers/input/mouse/sentelic.c +@@ -441,7 +441,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, void *data, + + fsp_reg_write_enable(psmouse, false); + +- return count; ++ return retval; + } + + PSMOUSE_DEFINE_WO_ATTR(setreg, S_IWUSR, NULL, fsp_attr_set_setreg); +-- +2.25.1 + diff --git a/queue-5.4/iommu-omap-check-for-failure-of-a-call-to-omap_iommu.patch b/queue-5.4/iommu-omap-check-for-failure-of-a-call-to-omap_iommu.patch new file mode 100644 index 00000000000..09ac4dfded3 --- /dev/null +++ b/queue-5.4/iommu-omap-check-for-failure-of-a-call-to-omap_iommu.patch @@ -0,0 +1,43 @@ +From f0db7d7cbd94101ff8bf73dd1880a1d502831a21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Jul 2020 20:22:11 +0100 +Subject: iommu/omap: Check for failure of a call to omap_iommu_dump_ctx + +From: Colin Ian King + +[ Upstream commit dee9d154f40c58d02f69acdaa5cfd1eae6ebc28b ] + +It is possible for the call to omap_iommu_dump_ctx to return +a negative error number, so check for the failure and return +the error number rather than pass the negative value to +simple_read_from_buffer. + +Fixes: 14e0e6796a0d ("OMAP: iommu: add initial debugfs support") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20200714192211.744776-1-colin.king@canonical.com +Addresses-Coverity: ("Improper use of negative value") +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/omap-iommu-debug.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c +index 8e19bfa94121e..a99afb5d9011c 100644 +--- a/drivers/iommu/omap-iommu-debug.c ++++ b/drivers/iommu/omap-iommu-debug.c +@@ -98,8 +98,11 @@ static ssize_t debug_read_regs(struct file *file, char __user *userbuf, + mutex_lock(&iommu_debug_lock); + + bytes = omap_iommu_dump_ctx(obj, p, count); ++ if (bytes < 0) ++ goto err; + bytes = simple_read_from_buffer(userbuf, count, ppos, buf, bytes); + ++err: + mutex_unlock(&iommu_debug_lock); + kfree(buf); + +-- +2.25.1 + diff --git a/queue-5.4/iommu-vt-d-enforce-pasid-devtlb-field-mask.patch b/queue-5.4/iommu-vt-d-enforce-pasid-devtlb-field-mask.patch new file mode 100644 index 00000000000..15ba9441f2a --- /dev/null +++ b/queue-5.4/iommu-vt-d-enforce-pasid-devtlb-field-mask.patch @@ -0,0 +1,40 @@ +From 4b2caa9f72ca85fce902df2565f66010b61eb028 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jul 2020 09:49:14 +0800 +Subject: iommu/vt-d: Enforce PASID devTLB field mask + +From: Liu Yi L + +[ Upstream commit 5f77d6ca5ca74e4b4a5e2e010f7ff50c45dea326 ] + +Set proper masks to avoid invalid input spillover to reserved bits. + +Signed-off-by: Liu Yi L +Signed-off-by: Jacob Pan +Signed-off-by: Lu Baolu +Reviewed-by: Eric Auger +Link: https://lore.kernel.org/r/20200724014925.15523-2-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + include/linux/intel-iommu.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h +index 1e5dad8b8e59b..ed870da78326b 100644 +--- a/include/linux/intel-iommu.h ++++ b/include/linux/intel-iommu.h +@@ -359,8 +359,8 @@ enum { + + #define QI_DEV_EIOTLB_ADDR(a) ((u64)(a) & VTD_PAGE_MASK) + #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11) +-#define QI_DEV_EIOTLB_GLOB(g) ((u64)g) +-#define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32) ++#define QI_DEV_EIOTLB_GLOB(g) ((u64)(g) & 0x1) ++#define QI_DEV_EIOTLB_PASID(p) ((u64)((p) & 0xfffff) << 32) + #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16) + #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4) + #define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \ +-- +2.25.1 + diff --git a/queue-5.4/libnvdimm-security-ensure-sysfs-poll-thread-woke-up-.patch b/queue-5.4/libnvdimm-security-ensure-sysfs-poll-thread-woke-up-.patch new file mode 100644 index 00000000000..2f1f47cd501 --- /dev/null +++ b/queue-5.4/libnvdimm-security-ensure-sysfs-poll-thread-woke-up-.patch @@ -0,0 +1,60 @@ +From cc6eba97e16afcebd087da67baf341c4f5176b21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Aug 2020 16:41:39 -0600 +Subject: libnvdimm/security: ensure sysfs poll thread woke up and fetch + updated attr + +From: Jane Chu + +[ Upstream commit 7f674025d9f7321dea11b802cc0ab3f09cbe51c5 ] + +commit 7d988097c546 ("acpi/nfit, libnvdimm/security: Add security DSM overwrite support") +adds a sysfs_notify_dirent() to wake up userspace poll thread when the "overwrite" +operation has completed. But the notification is issued before the internal +dimm security state and flags have been updated, so the userspace poll thread +wakes up and fetches the not-yet-updated attr and falls back to sleep, forever. +But if user from another terminal issue "ndctl wait-overwrite nmemX" again, +the command returns instantly. + +Link: https://lore.kernel.org/r/1596494499-9852-3-git-send-email-jane.chu@oracle.com +Fixes: 7d988097c546 ("acpi/nfit, libnvdimm/security: Add security DSM overwrite support") +Cc: Dave Jiang +Cc: Dan Williams +Reviewed-by: Dave Jiang +Signed-off-by: Jane Chu +Signed-off-by: Vishal Verma +Signed-off-by: Sasha Levin +--- + drivers/nvdimm/security.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c +index acfd211c01b9c..35d265014e1ec 100644 +--- a/drivers/nvdimm/security.c ++++ b/drivers/nvdimm/security.c +@@ -450,14 +450,19 @@ void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm) + else + dev_dbg(&nvdimm->dev, "overwrite completed\n"); + +- if (nvdimm->sec.overwrite_state) +- sysfs_notify_dirent(nvdimm->sec.overwrite_state); ++ /* ++ * Mark the overwrite work done and update dimm security flags, ++ * then send a sysfs event notification to wake up userspace ++ * poll threads to picked up the changed state. ++ */ + nvdimm->sec.overwrite_tmo = 0; + clear_bit(NDD_SECURITY_OVERWRITE, &nvdimm->flags); + clear_bit(NDD_WORK_PENDING, &nvdimm->flags); +- put_device(&nvdimm->dev); + nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); + nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); ++ if (nvdimm->sec.overwrite_state) ++ sysfs_notify_dirent(nvdimm->sec.overwrite_state); ++ put_device(&nvdimm->dev); + } + + void nvdimm_security_overwrite_query(struct work_struct *work) +-- +2.25.1 + diff --git a/queue-5.4/libnvdimm-security-fix-a-typo.patch b/queue-5.4/libnvdimm-security-fix-a-typo.patch new file mode 100644 index 00000000000..5f38e456611 --- /dev/null +++ b/queue-5.4/libnvdimm-security-fix-a-typo.patch @@ -0,0 +1,40 @@ +From 9ab043b0ee7d686e542e953a55016e25f6273476 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Aug 2020 16:41:37 -0600 +Subject: libnvdimm/security: fix a typo + +From: Jane Chu + +[ Upstream commit dad42d17558f316e9e807698cd4207359b636084 ] + +commit d78c620a2e82 ("libnvdimm/security: Introduce a 'frozen' attribute") +introduced a typo, causing a 'nvdimm->sec.flags' update being overwritten +by the subsequent update meant for 'nvdimm->sec.ext_flags'. + +Link: https://lore.kernel.org/r/1596494499-9852-1-git-send-email-jane.chu@oracle.com +Fixes: d78c620a2e82 ("libnvdimm/security: Introduce a 'frozen' attribute") +Cc: Dan Williams +Reviewed-by: Dave Jiang +Signed-off-by: Jane Chu +Signed-off-by: Vishal Verma +Signed-off-by: Sasha Levin +--- + drivers/nvdimm/security.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvdimm/security.c b/drivers/nvdimm/security.c +index 89b85970912db..acfd211c01b9c 100644 +--- a/drivers/nvdimm/security.c ++++ b/drivers/nvdimm/security.c +@@ -457,7 +457,7 @@ void __nvdimm_security_overwrite_query(struct nvdimm *nvdimm) + clear_bit(NDD_WORK_PENDING, &nvdimm->flags); + put_device(&nvdimm->dev); + nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_USER); +- nvdimm->sec.flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); ++ nvdimm->sec.ext_flags = nvdimm_security_flags(nvdimm, NVDIMM_MASTER); + } + + void nvdimm_security_overwrite_query(struct work_struct *work) +-- +2.25.1 + diff --git a/queue-5.4/md-cluster-fix-potential-error-pointer-dereference-i.patch b/queue-5.4/md-cluster-fix-potential-error-pointer-dereference-i.patch new file mode 100644 index 00000000000..371fd0bd541 --- /dev/null +++ b/queue-5.4/md-cluster-fix-potential-error-pointer-dereference-i.patch @@ -0,0 +1,38 @@ +From a84177aa6ea141f731879ec937ff113dd67f34a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Aug 2020 13:16:45 +0300 +Subject: md-cluster: Fix potential error pointer dereference in + resize_bitmaps() + +From: Dan Carpenter + +[ Upstream commit e8abe1de43dac658dacbd04a4543e0c988a8d386 ] + +The error handling calls md_bitmap_free(bitmap) which checks for NULL +but will Oops if we pass an error pointer. Let's set "bitmap" to NULL +on this error path. + +Fixes: afd756286083 ("md-cluster/raid10: resize all the bitmaps before start reshape") +Signed-off-by: Dan Carpenter +Reviewed-by: Guoqing Jiang +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + drivers/md/md-cluster.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 73fd50e779754..d50737ec40394 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -1139,6 +1139,7 @@ static int resize_bitmaps(struct mddev *mddev, sector_t newsize, sector_t oldsiz + bitmap = get_bitmap_from_slot(mddev, i); + if (IS_ERR(bitmap)) { + pr_err("can't get bitmap from slot %d\n", i); ++ bitmap = NULL; + goto out; + } + counts = &bitmap->counts; +-- +2.25.1 + diff --git a/queue-5.4/media-rockchip-rga-introduce-color-fmt-macros-and-re.patch b/queue-5.4/media-rockchip-rga-introduce-color-fmt-macros-and-re.patch new file mode 100644 index 00000000000..6cb0b255857 --- /dev/null +++ b/queue-5.4/media-rockchip-rga-introduce-color-fmt-macros-and-re.patch @@ -0,0 +1,83 @@ +From 8266091a903961242c26e4f09b27375e6e874a97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 18:42:44 +0200 +Subject: media: rockchip: rga: Introduce color fmt macros and refactor CSC + mode logic + +From: Paul Kocialkowski + +[ Upstream commit ded874ece29d3fe2abd3775810a06056067eb68c ] + +This introduces two macros: RGA_COLOR_FMT_IS_YUV and RGA_COLOR_FMT_IS_RGB +which allow quick checking of the colorspace familily of a RGA color format. + +These macros are then used to refactor the logic for CSC mode selection. +The two nested tests for input colorspace are simplified into a single one, +with a logical and, making the whole more readable. + +Signed-off-by: Paul Kocialkowski +Reviewed-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rga/rga-hw.c | 23 +++++++++----------- + drivers/media/platform/rockchip/rga/rga-hw.h | 5 +++++ + 2 files changed, 15 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c +index 4be6dcf292fff..5607ee8d19176 100644 +--- a/drivers/media/platform/rockchip/rga/rga-hw.c ++++ b/drivers/media/platform/rockchip/rga/rga-hw.c +@@ -200,22 +200,19 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx) + dst_info.data.format = ctx->out.fmt->hw_format; + dst_info.data.swap = ctx->out.fmt->color_swap; + +- if (ctx->in.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) { +- if (ctx->out.fmt->hw_format < RGA_COLOR_FMT_YUV422SP) { +- switch (ctx->in.colorspace) { +- case V4L2_COLORSPACE_REC709: +- src_info.data.csc_mode = +- RGA_SRC_CSC_MODE_BT709_R0; +- break; +- default: +- src_info.data.csc_mode = +- RGA_SRC_CSC_MODE_BT601_R0; +- break; +- } ++ if (RGA_COLOR_FMT_IS_YUV(ctx->in.fmt->hw_format) && ++ RGA_COLOR_FMT_IS_RGB(ctx->out.fmt->hw_format)) { ++ switch (ctx->in.colorspace) { ++ case V4L2_COLORSPACE_REC709: ++ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0; ++ break; ++ default: ++ src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT601_R0; ++ break; + } + } + +- if (ctx->out.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) { ++ if (RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) { + switch (ctx->out.colorspace) { + case V4L2_COLORSPACE_REC709: + dst_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0; +diff --git a/drivers/media/platform/rockchip/rga/rga-hw.h b/drivers/media/platform/rockchip/rga/rga-hw.h +index 96cb0314dfa70..e8917e5630a48 100644 +--- a/drivers/media/platform/rockchip/rga/rga-hw.h ++++ b/drivers/media/platform/rockchip/rga/rga-hw.h +@@ -95,6 +95,11 @@ + #define RGA_COLOR_FMT_CP_8BPP 15 + #define RGA_COLOR_FMT_MASK 15 + ++#define RGA_COLOR_FMT_IS_YUV(fmt) \ ++ (((fmt) >= RGA_COLOR_FMT_YUV422SP) && ((fmt) < RGA_COLOR_FMT_CP_1BPP)) ++#define RGA_COLOR_FMT_IS_RGB(fmt) \ ++ ((fmt) < RGA_COLOR_FMT_YUV422SP) ++ + #define RGA_COLOR_NONE_SWAP 0 + #define RGA_COLOR_RB_SWAP 1 + #define RGA_COLOR_ALPHA_SWAP 2 +-- +2.25.1 + diff --git a/queue-5.4/media-rockchip-rga-only-set-output-csc-mode-for-rgb-.patch b/queue-5.4/media-rockchip-rga-only-set-output-csc-mode-for-rgb-.patch new file mode 100644 index 00000000000..61729da3a9a --- /dev/null +++ b/queue-5.4/media-rockchip-rga-only-set-output-csc-mode-for-rgb-.patch @@ -0,0 +1,55 @@ +From 782b3c4aa7c525fc234105c0d1807123a790cbb3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 30 Apr 2020 18:42:45 +0200 +Subject: media: rockchip: rga: Only set output CSC mode for RGB input + +From: Paul Kocialkowski + +[ Upstream commit 0f879bab72f47e8ba2421a984e7acfa763d3e84e ] + +Setting the output CSC mode is required for a YUV output, but must not +be set when the input is also YUV. Doing this (as tested with a YUV420P +to YUV420P conversion) results in wrong colors. + +Adapt the logic to only set the output CSC mode when the output is YUV and +the input is RGB. Also add a comment to clarify the rationale. + +Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support") +Signed-off-by: Paul Kocialkowski +Reviewed-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/rockchip/rga/rga-hw.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c b/drivers/media/platform/rockchip/rga/rga-hw.c +index 5607ee8d19176..aaa96f256356b 100644 +--- a/drivers/media/platform/rockchip/rga/rga-hw.c ++++ b/drivers/media/platform/rockchip/rga/rga-hw.c +@@ -200,6 +200,11 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx) + dst_info.data.format = ctx->out.fmt->hw_format; + dst_info.data.swap = ctx->out.fmt->color_swap; + ++ /* ++ * CSC mode must only be set when the colorspace families differ between ++ * input and output. It must remain unset (zeroed) if both are the same. ++ */ ++ + if (RGA_COLOR_FMT_IS_YUV(ctx->in.fmt->hw_format) && + RGA_COLOR_FMT_IS_RGB(ctx->out.fmt->hw_format)) { + switch (ctx->in.colorspace) { +@@ -212,7 +217,8 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx) + } + } + +- if (RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) { ++ if (RGA_COLOR_FMT_IS_RGB(ctx->in.fmt->hw_format) && ++ RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) { + switch (ctx->out.colorspace) { + case V4L2_COLORSPACE_REC709: + dst_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0; +-- +2.25.1 + diff --git a/queue-5.4/mfd-arizona-ensure-32k-clock-is-put-on-driver-unbind.patch b/queue-5.4/mfd-arizona-ensure-32k-clock-is-put-on-driver-unbind.patch new file mode 100644 index 00000000000..3ca2cbca3e6 --- /dev/null +++ b/queue-5.4/mfd-arizona-ensure-32k-clock-is-put-on-driver-unbind.patch @@ -0,0 +1,65 @@ +From ac46ee8e03aa575afeda55aa9e0a19b50340ea38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jun 2020 14:53:21 +0100 +Subject: mfd: arizona: Ensure 32k clock is put on driver unbind and error + +From: Charles Keepax + +[ Upstream commit ddff6c45b21d0437ce0c85f8ac35d7b5480513d7 ] + +Whilst it doesn't matter if the internal 32k clock register settings +are cleaned up on exit, as the part will be turned off losing any +settings, hence the driver hasn't historially bothered. The external +clock should however be cleaned up, as it could cause clocks to be +left on, and will at best generate a warning on unbind. + +Add clean up on both the probe error path and unbind for the 32k +clock. + +Fixes: cdd8da8cc66b ("mfd: arizona: Add gating of external MCLKn clocks") +Signed-off-by: Charles Keepax +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/arizona-core.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c +index 4a31907a4525f..3ff872c205eeb 100644 +--- a/drivers/mfd/arizona-core.c ++++ b/drivers/mfd/arizona-core.c +@@ -1430,6 +1430,15 @@ int arizona_dev_init(struct arizona *arizona) + arizona_irq_exit(arizona); + err_pm: + pm_runtime_disable(arizona->dev); ++ ++ switch (arizona->pdata.clk32k_src) { ++ case ARIZONA_32KZ_MCLK1: ++ case ARIZONA_32KZ_MCLK2: ++ arizona_clk32k_disable(arizona); ++ break; ++ default: ++ break; ++ } + err_reset: + arizona_enable_reset(arizona); + regulator_disable(arizona->dcvdd); +@@ -1452,6 +1461,15 @@ int arizona_dev_exit(struct arizona *arizona) + regulator_disable(arizona->dcvdd); + regulator_put(arizona->dcvdd); + ++ switch (arizona->pdata.clk32k_src) { ++ case ARIZONA_32KZ_MCLK1: ++ case ARIZONA_32KZ_MCLK2: ++ arizona_clk32k_disable(arizona); ++ break; ++ default: ++ break; ++ } ++ + mfd_remove_devices(arizona->dev); + arizona_free_irq(arizona, ARIZONA_IRQ_UNDERCLOCKED, arizona); + arizona_free_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, arizona); +-- +2.25.1 + diff --git a/queue-5.4/mfd-dln2-run-event-handler-loop-under-spinlock.patch b/queue-5.4/mfd-dln2-run-event-handler-loop-under-spinlock.patch new file mode 100644 index 00000000000..d9e95fced54 --- /dev/null +++ b/queue-5.4/mfd-dln2-run-event-handler-loop-under-spinlock.patch @@ -0,0 +1,68 @@ +From 935d7c79c137bc4c617142e5480849ddbff283d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Jul 2020 16:02:46 +0300 +Subject: mfd: dln2: Run event handler loop under spinlock + +From: Andy Shevchenko + +[ Upstream commit 3d858942250820b9adc35f963a257481d6d4c81d ] + +The event handler loop must be run with interrupts disabled. +Otherwise we will have a warning: + +[ 1970.785649] irq 31 handler lineevent_irq_handler+0x0/0x20 enabled interrupts +[ 1970.792739] WARNING: CPU: 0 PID: 0 at kernel/irq/handle.c:159 __handle_irq_event_percpu+0x162/0x170 +[ 1970.860732] RIP: 0010:__handle_irq_event_percpu+0x162/0x170 +... +[ 1970.946994] Call Trace: +[ 1970.949446] +[ 1970.951471] handle_irq_event_percpu+0x2c/0x80 +[ 1970.955921] handle_irq_event+0x23/0x43 +[ 1970.959766] handle_simple_irq+0x57/0x70 +[ 1970.963695] generic_handle_irq+0x42/0x50 +[ 1970.967717] dln2_rx+0xc1/0x210 [dln2] +[ 1970.971479] ? usb_hcd_unmap_urb_for_dma+0xa6/0x1c0 +[ 1970.976362] __usb_hcd_giveback_urb+0x77/0xe0 +[ 1970.980727] usb_giveback_urb_bh+0x8e/0xe0 +[ 1970.984837] tasklet_action_common.isra.0+0x4a/0xe0 +... + +Recently xHCI driver switched to tasklets in the commit 36dc01657b49 +("usb: host: xhci: Support running urb giveback in tasklet context"). + +The handle_irq_event_* functions are expected to be called with interrupts +disabled and they rightfully complain here because we run in tasklet context +with interrupts enabled. + +Use a event spinlock to protect event handler from being interrupted. + +Note, that there are only two users of this GPIO and ADC drivers and both of +them are using generic_handle_irq() which makes above happen. + +Fixes: 338a12814297 ("mfd: Add support for Diolan DLN-2 devices") +Signed-off-by: Andy Shevchenko +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/dln2.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c +index 4faa8d2e5d045..707f4287ab4a0 100644 +--- a/drivers/mfd/dln2.c ++++ b/drivers/mfd/dln2.c +@@ -287,7 +287,11 @@ static void dln2_rx(struct urb *urb) + len = urb->actual_length - sizeof(struct dln2_header); + + if (handle == DLN2_HANDLE_EVENT) { ++ unsigned long flags; ++ ++ spin_lock_irqsave(&dln2->event_cb_lock, flags); + dln2_run_event_callbacks(dln2, id, echo, data, len); ++ spin_unlock_irqrestore(&dln2->event_cb_lock, flags); + } else { + /* URB will be re-submitted in _dln2_transfer (free_rx_slot) */ + if (dln2_transfer_complete(dln2, urb, handle, echo)) +-- +2.25.1 + diff --git a/queue-5.4/mmc-renesas_sdhi_internal_dmac-clean-up-the-code-for.patch b/queue-5.4/mmc-renesas_sdhi_internal_dmac-clean-up-the-code-for.patch new file mode 100644 index 00000000000..5700ba949ff --- /dev/null +++ b/queue-5.4/mmc-renesas_sdhi_internal_dmac-clean-up-the-code-for.patch @@ -0,0 +1,64 @@ +From 4a4703e8729a91cb74f0507d86d19608080131a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 May 2020 16:01:05 +0900 +Subject: mmc: renesas_sdhi_internal_dmac: clean up the code for dma complete + +From: Yoshihiro Shimoda + +[ Upstream commit 2b26e34e9af3fa24fa1266e9ea2d66a1f7d62dc0 ] + +To add end() operation in the future, clean the code of +renesas_sdhi_internal_dmac_complete_tasklet_fn(). No behavior change. + +Signed-off-by: Yoshihiro Shimoda +Link: https://lore.kernel.org/r/1590044466-28372-3-git-send-email-yoshihiro.shimoda.uh@renesas.com +Tested-by: Wolfram Sang +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/renesas_sdhi_internal_dmac.c | 18 +++++++++++++----- + 1 file changed, 13 insertions(+), 5 deletions(-) + +diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +index a66f8d6d61d1b..cb89f0578d425 100644 +--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c ++++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c +@@ -229,15 +229,12 @@ static void renesas_sdhi_internal_dmac_issue_tasklet_fn(unsigned long arg) + DTRAN_CTRL_DM_START); + } + +-static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg) ++static bool renesas_sdhi_internal_dmac_complete(struct tmio_mmc_host *host) + { +- struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg; + enum dma_data_direction dir; + +- spin_lock_irq(&host->lock); +- + if (!host->data) +- goto out; ++ return false; + + if (host->data->flags & MMC_DATA_READ) + dir = DMA_FROM_DEVICE; +@@ -250,6 +247,17 @@ static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg) + if (dir == DMA_FROM_DEVICE) + clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags); + ++ return true; ++} ++ ++static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg) ++{ ++ struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg; ++ ++ spin_lock_irq(&host->lock); ++ if (!renesas_sdhi_internal_dmac_complete(host)) ++ goto out; ++ + tmio_mmc_do_data_irq(host); + out: + spin_unlock_irq(&host->lock); +-- +2.25.1 + diff --git a/queue-5.4/mtd-rawnand-fsl_upm-remove-unused-mtd-var.patch b/queue-5.4/mtd-rawnand-fsl_upm-remove-unused-mtd-var.patch new file mode 100644 index 00000000000..b128b83865a --- /dev/null +++ b/queue-5.4/mtd-rawnand-fsl_upm-remove-unused-mtd-var.patch @@ -0,0 +1,37 @@ +From ea0ad38142469fb96c3a26d3d57a47b2b7302df5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 3 Jun 2020 15:49:13 +0200 +Subject: mtd: rawnand: fsl_upm: Remove unused mtd var + +From: Boris Brezillon + +[ Upstream commit ccc49eff77bee2885447a032948959a134029fe3 ] + +The mtd var in fun_wait_rnb() is now unused, let's get rid of it and +fix the warning resulting from this unused var. + +Fixes: 50a487e7719c ("mtd: rawnand: Pass a nand_chip object to chip->dev_ready()") +Signed-off-by: Boris Brezillon +Reviewed-by: Miquel Raynal +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20200603134922.1352340-2-boris.brezillon@collabora.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/fsl_upm.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/fsl_upm.c b/drivers/mtd/nand/raw/fsl_upm.c +index 1054cc070747e..20b0ee174dc61 100644 +--- a/drivers/mtd/nand/raw/fsl_upm.c ++++ b/drivers/mtd/nand/raw/fsl_upm.c +@@ -62,7 +62,6 @@ static int fun_chip_ready(struct nand_chip *chip) + static void fun_wait_rnb(struct fsl_upm_nand *fun) + { + if (fun->rnb_gpio[fun->mchip_number] >= 0) { +- struct mtd_info *mtd = nand_to_mtd(&fun->chip); + int cnt = 1000000; + + while (--cnt && !fun_chip_ready(&fun->chip)) +-- +2.25.1 + diff --git a/queue-5.4/net-qcom-emac-add-missed-clk_disable_unprepare-in-er.patch b/queue-5.4/net-qcom-emac-add-missed-clk_disable_unprepare-in-er.patch new file mode 100644 index 00000000000..4b9605e1c1a --- /dev/null +++ b/queue-5.4/net-qcom-emac-add-missed-clk_disable_unprepare-in-er.patch @@ -0,0 +1,58 @@ +From b142e3804a1ad7ab6ebc92634314a48de48579b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 10:57:05 +0800 +Subject: net: qcom/emac: add missed clk_disable_unprepare in error path of + emac_clks_phase1_init + +From: Wang Hai + +[ Upstream commit 50caa777a3a24d7027748e96265728ce748b41ef ] + +Fix the missing clk_disable_unprepare() before return +from emac_clks_phase1_init() in the error handling case. + +Fixes: b9b17debc69d ("net: emac: emac gigabit ethernet controller driver") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Acked-by: Timur Tabi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/emac/emac.c | 17 ++++++++++++++--- + 1 file changed, 14 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c b/drivers/net/ethernet/qualcomm/emac/emac.c +index c84ab052ef265..3eee8df359a12 100644 +--- a/drivers/net/ethernet/qualcomm/emac/emac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac.c +@@ -485,13 +485,24 @@ static int emac_clks_phase1_init(struct platform_device *pdev, + + ret = clk_prepare_enable(adpt->clk[EMAC_CLK_CFG_AHB]); + if (ret) +- return ret; ++ goto disable_clk_axi; + + ret = clk_set_rate(adpt->clk[EMAC_CLK_HIGH_SPEED], 19200000); + if (ret) +- return ret; ++ goto disable_clk_cfg_ahb; ++ ++ ret = clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]); ++ if (ret) ++ goto disable_clk_cfg_ahb; + +- return clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]); ++ return 0; ++ ++disable_clk_cfg_ahb: ++ clk_disable_unprepare(adpt->clk[EMAC_CLK_CFG_AHB]); ++disable_clk_axi: ++ clk_disable_unprepare(adpt->clk[EMAC_CLK_AXI]); ++ ++ return ret; + } + + /* Enable clocks; needs emac_clks_phase1_init to be called before */ +-- +2.25.1 + diff --git a/queue-5.4/nfs-ensure-correct-writeback-errors-are-returned-on-.patch b/queue-5.4/nfs-ensure-correct-writeback-errors-are-returned-on-.patch new file mode 100644 index 00000000000..e023932b355 --- /dev/null +++ b/queue-5.4/nfs-ensure-correct-writeback-errors-are-returned-on-.patch @@ -0,0 +1,76 @@ +From 8676dce9f059378784f3da4ebef6368dbcb4970c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Aug 2020 07:10:38 -0400 +Subject: nfs: ensure correct writeback errors are returned on close() + +From: Scott Mayhew + +[ Upstream commit 67dd23f9e6fbaf163431912ef5599c5e0693476c ] + +nfs_wb_all() calls filemap_write_and_wait(), which uses +filemap_check_errors() to determine the error to return. +filemap_check_errors() only looks at the mapping->flags and will +therefore only return either -ENOSPC or -EIO. To ensure that the +correct error is returned on close(), nfs{,4}_file_flush() should call +filemap_check_wb_err() which looks at the errseq value in +mapping->wb_err without consuming it. + +Fixes: 6fbda89b257f ("NFS: Replace custom error reporting mechanism with +generic one") +Signed-off-by: Scott Mayhew +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/file.c | 5 ++++- + fs/nfs/nfs4file.c | 5 ++++- + 2 files changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 95dc90570786c..348f67c8f3224 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -140,6 +140,7 @@ static int + nfs_file_flush(struct file *file, fl_owner_t id) + { + struct inode *inode = file_inode(file); ++ errseq_t since; + + dprintk("NFS: flush(%pD2)\n", file); + +@@ -148,7 +149,9 @@ nfs_file_flush(struct file *file, fl_owner_t id) + return 0; + + /* Flush writes to the server and return any errors */ +- return nfs_wb_all(inode); ++ since = filemap_sample_wb_err(file->f_mapping); ++ nfs_wb_all(inode); ++ return filemap_check_wb_err(file->f_mapping, since); + } + + ssize_t +diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c +index fb55c04cdc6bd..534b6fd70ffdb 100644 +--- a/fs/nfs/nfs4file.c ++++ b/fs/nfs/nfs4file.c +@@ -109,6 +109,7 @@ static int + nfs4_file_flush(struct file *file, fl_owner_t id) + { + struct inode *inode = file_inode(file); ++ errseq_t since; + + dprintk("NFS: flush(%pD2)\n", file); + +@@ -124,7 +125,9 @@ nfs4_file_flush(struct file *file, fl_owner_t id) + return filemap_fdatawrite(file->f_mapping); + + /* Flush writes to the server and return any errors */ +- return nfs_wb_all(inode); ++ since = filemap_sample_wb_err(file->f_mapping); ++ nfs_wb_all(inode); ++ return filemap_check_wb_err(file->f_mapping, since); + } + + #ifdef CONFIG_NFS_V4_2 +-- +2.25.1 + diff --git a/queue-5.4/nfs-fix-getxattr-kernel-panic-and-memory-overflow.patch b/queue-5.4/nfs-fix-getxattr-kernel-panic-and-memory-overflow.patch new file mode 100644 index 00000000000..fd60df9cb18 --- /dev/null +++ b/queue-5.4/nfs-fix-getxattr-kernel-panic-and-memory-overflow.patch @@ -0,0 +1,55 @@ +From 62d8d570047fd8884e94e107322817f9b5bed1bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Aug 2020 12:23:19 -0500 +Subject: nfs: Fix getxattr kernel panic and memory overflow + +From: Jeffrey Mitchell + +[ Upstream commit b4487b93545214a9db8cbf32e86411677b0cca21 ] + +Move the buffer size check to decode_attr_security_label() before memcpy() +Only call memcpy() if the buffer is large enough + +Fixes: aa9c2669626c ("NFS: Client implementation of Labeled-NFS") +Signed-off-by: Jeffrey Mitchell +[Trond: clean up duplicate test of label->len != 0] +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 2 -- + fs/nfs/nfs4xdr.c | 6 +++++- + 2 files changed, 5 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 1a1bd2fe6e98d..d0cb827b72cfa 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -5811,8 +5811,6 @@ static int _nfs4_get_security_label(struct inode *inode, void *buf, + return ret; + if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL)) + return -ENOENT; +- if (buflen < label.len) +- return -ERANGE; + return 0; + } + +diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c +index 7c0ff1a3b5914..677751bc3a334 100644 +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -4169,7 +4169,11 @@ static int decode_attr_security_label(struct xdr_stream *xdr, uint32_t *bitmap, + return -EIO; + if (len < NFS4_MAXLABELLEN) { + if (label) { +- memcpy(label->label, p, len); ++ if (label->len) { ++ if (label->len < len) ++ return -ERANGE; ++ memcpy(label->label, p, len); ++ } + label->len = len; + label->pi = pi; + label->lfs = lfs; +-- +2.25.1 + diff --git a/queue-5.4/nfs-nfs_file_write-should-check-for-writeback-errors.patch b/queue-5.4/nfs-nfs_file_write-should-check-for-writeback-errors.patch new file mode 100644 index 00000000000..31580670cc8 --- /dev/null +++ b/queue-5.4/nfs-nfs_file_write-should-check-for-writeback-errors.patch @@ -0,0 +1,74 @@ +From 2f28eb15462b43ebecb73b2437b1324bd2e8b90e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 1 Aug 2020 07:10:39 -0400 +Subject: nfs: nfs_file_write() should check for writeback errors + +From: Scott Mayhew + +[ Upstream commit ce368536dd614452407dc31e2449eb84681a06af ] + +The NFS_CONTEXT_ERROR_WRITE flag (as well as the check of said flag) was +removed by commit 6fbda89b257f. The absence of an error check allows +writes to be continually queued up for a server that may no longer be +able to handle them. Fix it by adding an error check using the generic +error reporting functions. + +Fixes: 6fbda89b257f ("NFS: Replace custom error reporting mechanism with generic one") +Signed-off-by: Scott Mayhew +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/file.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 348f67c8f3224..387a2cfa7e172 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -583,12 +583,14 @@ static const struct vm_operations_struct nfs_file_vm_ops = { + .page_mkwrite = nfs_vm_page_mkwrite, + }; + +-static int nfs_need_check_write(struct file *filp, struct inode *inode) ++static int nfs_need_check_write(struct file *filp, struct inode *inode, ++ int error) + { + struct nfs_open_context *ctx; + + ctx = nfs_file_open_context(filp); +- if (nfs_ctx_key_to_expire(ctx, inode)) ++ if (nfs_error_is_fatal_on_server(error) || ++ nfs_ctx_key_to_expire(ctx, inode)) + return 1; + return 0; + } +@@ -599,6 +601,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + struct inode *inode = file_inode(file); + unsigned long written = 0; + ssize_t result; ++ errseq_t since; ++ int error; + + result = nfs_key_timeout_notify(file, inode); + if (result) +@@ -623,6 +627,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + if (iocb->ki_pos > i_size_read(inode)) + nfs_revalidate_mapping(inode, file->f_mapping); + ++ since = filemap_sample_wb_err(file->f_mapping); + nfs_start_io_write(inode); + result = generic_write_checks(iocb, from); + if (result > 0) { +@@ -641,7 +646,8 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + goto out; + + /* Return error values */ +- if (nfs_need_check_write(file, inode)) { ++ error = filemap_check_wb_err(file->f_mapping, since); ++ if (nfs_need_check_write(file, inode, error)) { + int err = nfs_wb_all(inode); + if (err < 0) + result = err; +-- +2.25.1 + diff --git a/queue-5.4/octeontx2-af-change-struct-qmem-entry_sz-from-u8-to-.patch b/queue-5.4/octeontx2-af-change-struct-qmem-entry_sz-from-u8-to-.patch new file mode 100644 index 00000000000..50814146a63 --- /dev/null +++ b/queue-5.4/octeontx2-af-change-struct-qmem-entry_sz-from-u8-to-.patch @@ -0,0 +1,39 @@ +From 8ab55cdc4a46bf061e4f0cf00ed1a157b023ee28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 20:53:21 -0700 +Subject: octeontx2-af: change (struct qmem)->entry_sz from u8 to u16 + +From: Eric Dumazet + +[ Upstream commit 393415203f5c916b5907e0a7c89f4c2c5a9c5505 ] + +We need to increase TSO_HEADER_SIZE from 128 to 256. + +Since otx2_sq_init() calls qmem_alloc() with TSO_HEADER_SIZE, +we need to change (struct qmem)->entry_sz to avoid truncation to 0. + +Fixes: 7a37245ef23f ("octeontx2-af: NPA block admin queue init") +Signed-off-by: Eric Dumazet +Cc: Sunil Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/common.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/common.h b/drivers/net/ethernet/marvell/octeontx2/af/common.h +index 413c3f254cf85..c881a573da662 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/common.h ++++ b/drivers/net/ethernet/marvell/octeontx2/af/common.h +@@ -43,7 +43,7 @@ struct qmem { + void *base; + dma_addr_t iova; + int alloc_sz; +- u8 entry_sz; ++ u16 entry_sz; + u8 align; + u32 qsize; + }; +-- +2.25.1 + diff --git a/queue-5.4/openrisc-fix-oops-caused-when-dumping-stack.patch b/queue-5.4/openrisc-fix-oops-caused-when-dumping-stack.patch new file mode 100644 index 00000000000..c6ff5f6d6f5 --- /dev/null +++ b/queue-5.4/openrisc-fix-oops-caused-when-dumping-stack.patch @@ -0,0 +1,97 @@ +From 7fff7796cf4c308abfb495c0c45c629ee94b231f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 06:19:46 +0900 +Subject: openrisc: Fix oops caused when dumping stack + +From: Stafford Horne + +[ Upstream commit 57b8e277c33620e115633cdf700a260b55095460 ] + +When dumping a stack with 'cat /proc/#/stack' the kernel would oops. +For example: + + # cat /proc/690/stack + Unable to handle kernel access + at virtual address 0x7fc60f58 + + Oops#: 0000 + CPU #: 0 + PC: c00097fc SR: 0000807f SP: d6f09b9c + GPR00: 00000000 GPR01: d6f09b9c GPR02: d6f09bb8 GPR03: d6f09bc4 + GPR04: 7fc60f5c GPR05: c00099b4 GPR06: 00000000 GPR07: d6f09ba3 + GPR08: ffffff00 GPR09: c0009804 GPR10: d6f08000 GPR11: 00000000 + GPR12: ffffe000 GPR13: dbb86000 GPR14: 00000001 GPR15: dbb86250 + GPR16: 7fc60f63 GPR17: 00000f5c GPR18: d6f09bc4 GPR19: 00000000 + GPR20: c00099b4 GPR21: ffffffc0 GPR22: 00000000 GPR23: 00000000 + GPR24: 00000001 GPR25: 000002c6 GPR26: d78b6850 GPR27: 00000001 + GPR28: 00000000 GPR29: dbb86000 GPR30: ffffffff GPR31: dbb862fc + RES: 00000000 oGPR11: ffffffff + Process cat (pid: 702, stackpage=d79d6000) + + Stack: + Call trace: + [<598977f2>] save_stack_trace_tsk+0x40/0x74 + [<95063f0e>] stack_trace_save_tsk+0x44/0x58 + [] proc_pid_stack+0xd0/0x13c + [] proc_single_show+0x6c/0xf0 + [] seq_read+0x1b4/0x688 + [<2d6c7480>] do_iter_read+0x208/0x248 + [<2182a2fb>] vfs_readv+0x64/0x90 + +This was caused by the stack trace code in save_stack_trace_tsk using +the wrong stack pointer. It was using the user stack pointer instead of +the kernel stack pointer. Fix this by using the right stack. + +Also for good measure we add try_get_task_stack/put_task_stack to ensure +the task is not lost while we are walking it's stack. + +Fixes: eecac38b0423a ("openrisc: support framepointers and STACKTRACE_SUPPORT") +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/kernel/stacktrace.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/arch/openrisc/kernel/stacktrace.c b/arch/openrisc/kernel/stacktrace.c +index 43f140a28bc72..54d38809e22cb 100644 +--- a/arch/openrisc/kernel/stacktrace.c ++++ b/arch/openrisc/kernel/stacktrace.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -68,12 +69,25 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct stack_trace *trace) + { + unsigned long *sp = NULL; + ++ if (!try_get_task_stack(tsk)) ++ return; ++ + if (tsk == current) + sp = (unsigned long *) &sp; +- else +- sp = (unsigned long *) KSTK_ESP(tsk); ++ else { ++ unsigned long ksp; ++ ++ /* Locate stack from kernel context */ ++ ksp = task_thread_info(tsk)->ksp; ++ ksp += STACK_FRAME_OVERHEAD; /* redzone */ ++ ksp += sizeof(struct pt_regs); ++ ++ sp = (unsigned long *) ksp; ++ } + + unwind_stack(trace, sp, save_stack_address_nosched); ++ ++ put_task_stack(tsk); + } + EXPORT_SYMBOL_GPL(save_stack_trace_tsk); + +-- +2.25.1 + diff --git a/queue-5.4/perf-bench-mem-always-memset-source-before-memcpy.patch b/queue-5.4/perf-bench-mem-always-memset-source-before-memcpy.patch new file mode 100644 index 00000000000..2c4817110e3 --- /dev/null +++ b/queue-5.4/perf-bench-mem-always-memset-source-before-memcpy.patch @@ -0,0 +1,105 @@ +From 69707e056115426c35f0a0ea28f8e2f9538d03ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 15:34:04 +0200 +Subject: perf bench mem: Always memset source before memcpy + +From: Vincent Whitchurch + +[ Upstream commit 1beaef29c34154ccdcb3f1ae557f6883eda18840 ] + +For memcpy, the source pages are memset to zero only when --cycles is +used. This leads to wildly different results with or without --cycles, +since all sources pages are likely to be mapped to the same zero page +without explicit writes. + +Before this fix: + +$ export cmd="./perf stat -e LLC-loads -- ./perf bench \ + mem memcpy -s 1024MB -l 100 -f default" +$ $cmd + + 2,935,826 LLC-loads + 3.821677452 seconds time elapsed + +$ $cmd --cycles + + 217,533,436 LLC-loads + 8.616725985 seconds time elapsed + +After this fix: + +$ $cmd + + 214,459,686 LLC-loads + 8.674301124 seconds time elapsed + +$ $cmd --cycles + + 214,758,651 LLC-loads + 8.644480006 seconds time elapsed + +Fixes: 47b5757bac03c338 ("perf bench mem: Move boilerplate memory allocation to the infrastructure") +Signed-off-by: Vincent Whitchurch +Cc: Alexander Shishkin +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: kernel@axis.com +Link: http://lore.kernel.org/lkml/20200810133404.30829-1-vincent.whitchurch@axis.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/mem-functions.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/tools/perf/bench/mem-functions.c b/tools/perf/bench/mem-functions.c +index 9235b76501be8..19d45c377ac18 100644 +--- a/tools/perf/bench/mem-functions.c ++++ b/tools/perf/bench/mem-functions.c +@@ -223,12 +223,8 @@ static int bench_mem_common(int argc, const char **argv, struct bench_mem_info * + return 0; + } + +-static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst) ++static void memcpy_prefault(memcpy_t fn, size_t size, void *src, void *dst) + { +- u64 cycle_start = 0ULL, cycle_end = 0ULL; +- memcpy_t fn = r->fn.memcpy; +- int i; +- + /* Make sure to always prefault zero pages even if MMAP_THRESH is crossed: */ + memset(src, 0, size); + +@@ -237,6 +233,15 @@ static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, vo + * to not measure page fault overhead: + */ + fn(dst, src, size); ++} ++ ++static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, void *dst) ++{ ++ u64 cycle_start = 0ULL, cycle_end = 0ULL; ++ memcpy_t fn = r->fn.memcpy; ++ int i; ++ ++ memcpy_prefault(fn, size, src, dst); + + cycle_start = get_cycles(); + for (i = 0; i < nr_loops; ++i) +@@ -252,11 +257,7 @@ static double do_memcpy_gettimeofday(const struct function *r, size_t size, void + memcpy_t fn = r->fn.memcpy; + int i; + +- /* +- * We prefault the freshly allocated memory range here, +- * to not measure page fault overhead: +- */ +- fn(dst, src, size); ++ memcpy_prefault(fn, size, src, dst); + + BUG_ON(gettimeofday(&tv_start, NULL)); + for (i = 0; i < nr_loops; ++i) +-- +2.25.1 + diff --git a/queue-5.4/perf-x86-rapl-fix-missing-psys-sysfs-attributes.patch b/queue-5.4/perf-x86-rapl-fix-missing-psys-sysfs-attributes.patch new file mode 100644 index 00000000000..e1a82aea39d --- /dev/null +++ b/queue-5.4/perf-x86-rapl-fix-missing-psys-sysfs-attributes.patch @@ -0,0 +1,43 @@ +From 99f6924c586b6e5a5adf60a57032cb04c6474e1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 23:31:47 +0800 +Subject: perf/x86/rapl: Fix missing psys sysfs attributes + +From: Zhang Rui + +[ Upstream commit 4bb5fcb97a5df0bbc0a27e0252b1e7ce140a8431 ] + +This fixes a problem introduced by commit: + + 5fb5273a905c ("perf/x86/rapl: Use new MSR detection interface") + +that perf event sysfs attributes for psys RAPL domain are missing. + +Fixes: 5fb5273a905c ("perf/x86/rapl: Use new MSR detection interface") +Signed-off-by: Zhang Rui +Signed-off-by: Ingo Molnar +Reviewed-by: Kan Liang +Reviewed-by: Len Brown +Acked-by: Jiri Olsa +Link: https://lore.kernel.org/r/20200811153149.12242-2-rui.zhang@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/rapl.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/rapl.c b/arch/x86/events/rapl.c +index 3c222d6fdee3b..187c72a58e69c 100644 +--- a/arch/x86/events/rapl.c ++++ b/arch/x86/events/rapl.c +@@ -642,7 +642,7 @@ static const struct attribute_group *rapl_attr_update[] = { + &rapl_events_pkg_group, + &rapl_events_ram_group, + &rapl_events_gpu_group, +- &rapl_events_gpu_group, ++ &rapl_events_psys_group, + NULL, + }; + +-- +2.25.1 + diff --git a/queue-5.4/platform-chrome-cros_ec_ishtp-fix-a-double-unlock-is.patch b/queue-5.4/platform-chrome-cros_ec_ishtp-fix-a-double-unlock-is.patch new file mode 100644 index 00000000000..dbcd1ce4dc4 --- /dev/null +++ b/queue-5.4/platform-chrome-cros_ec_ishtp-fix-a-double-unlock-is.patch @@ -0,0 +1,46 @@ +From fcf29ad069d0fcbc04d6b6e4ed3cb0e5165599c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 22 May 2020 22:16:08 -0500 +Subject: platform/chrome: cros_ec_ishtp: Fix a double-unlock issue +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Qiushi Wu + +[ Upstream commit aaa3cbbac326c95308e315f1ab964a3369c4d07d ] + +In function cros_ec_ishtp_probe(), "up_write" is already called +before function "cros_ec_dev_init". But "up_write" will be called +again after the calling of the function "cros_ec_dev_init" failed. +Thus add a call of the function “down_write” in this if branch +for the completion of the exception handling. + +Fixes: 26a14267aff2 ("platform/chrome: Add ChromeOS EC ISHTP driver") +Signed-off-by: Qiushi Wu +Tested-by: Mathew King +Signed-off-by: Enric Balletbo i Serra +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_ishtp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c +index 25ca2c894b4de..ab0662a33b41a 100644 +--- a/drivers/platform/chrome/cros_ec_ishtp.c ++++ b/drivers/platform/chrome/cros_ec_ishtp.c +@@ -645,8 +645,10 @@ static int cros_ec_ishtp_probe(struct ishtp_cl_device *cl_device) + + /* Register croc_ec_dev mfd */ + rv = cros_ec_dev_init(client_data); +- if (rv) ++ if (rv) { ++ down_write(&init_lock); + goto end_cros_ec_dev_init_error; ++ } + + return 0; + +-- +2.25.1 + diff --git a/queue-5.4/pwm-bcm-iproc-handle-clk_get_rate-return.patch b/queue-5.4/pwm-bcm-iproc-handle-clk_get_rate-return.patch new file mode 100644 index 00000000000..043366a4bf9 --- /dev/null +++ b/queue-5.4/pwm-bcm-iproc-handle-clk_get_rate-return.patch @@ -0,0 +1,55 @@ +From f82ea525251f1b21cedc733a0a8a7ac60b33fea1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 21:46:06 -0700 +Subject: pwm: bcm-iproc: handle clk_get_rate() return +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rayagonda Kokatanur + +[ Upstream commit 6ced5ff0be8e94871ba846dfbddf69d21363f3d7 ] + +Handle clk_get_rate() returning 0 to avoid possible division by zero. + +Fixes: daa5abc41c80 ("pwm: Add support for Broadcom iProc PWM controller") +Signed-off-by: Rayagonda Kokatanur +Signed-off-by: Scott Branden +Reviewed-by: Ray Jui +Reviewed-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-bcm-iproc.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c +index 1f829edd8ee70..d392a828fc493 100644 +--- a/drivers/pwm/pwm-bcm-iproc.c ++++ b/drivers/pwm/pwm-bcm-iproc.c +@@ -85,8 +85,6 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + u64 tmp, multi, rate; + u32 value, prescale; + +- rate = clk_get_rate(ip->clk); +- + value = readl(ip->base + IPROC_PWM_CTRL_OFFSET); + + if (value & BIT(IPROC_PWM_CTRL_EN_SHIFT(pwm->hwpwm))) +@@ -99,6 +97,13 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, struct pwm_device *pwm, + else + state->polarity = PWM_POLARITY_INVERSED; + ++ rate = clk_get_rate(ip->clk); ++ if (rate == 0) { ++ state->period = 0; ++ state->duty_cycle = 0; ++ return; ++ } ++ + value = readl(ip->base + IPROC_PWM_PRESCALE_OFFSET); + prescale = value >> IPROC_PWM_PRESCALE_SHIFT(pwm->hwpwm); + prescale &= IPROC_PWM_PRESCALE_MAX; +-- +2.25.1 + diff --git a/queue-5.4/rdma-counter-allow-manually-bind-qps-with-different-.patch b/queue-5.4/rdma-counter-allow-manually-bind-qps-with-different-.patch new file mode 100644 index 00000000000..e934ce9cde4 --- /dev/null +++ b/queue-5.4/rdma-counter-allow-manually-bind-qps-with-different-.patch @@ -0,0 +1,41 @@ +From cfaa9c063f70947c187da88c328399a579daa451 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jul 2020 11:29:33 +0300 +Subject: RDMA/counter: Allow manually bind QPs with different pids to same + counter + +From: Mark Zhang + +[ Upstream commit cbeb7d896c0f296451ffa7b67e7706786b8364c8 ] + +In manual mode allow bind user QPs with different pids to same counter, +since this is allowed in auto mode. +Bind kernel QPs and user QPs to the same counter are not allowed. + +Fixes: 1bd8e0a9d0fd ("RDMA/counter: Allow manual mode configuration support") +Link: https://lore.kernel.org/r/20200702082933.424537-4-leon@kernel.org +Signed-off-by: Mark Zhang +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/counters.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c +index 42809f612c2c4..f454d63008d69 100644 +--- a/drivers/infiniband/core/counters.c ++++ b/drivers/infiniband/core/counters.c +@@ -487,7 +487,7 @@ int rdma_counter_bind_qpn(struct ib_device *dev, u8 port, + goto err; + } + +- if (counter->res.task != qp->res.task) { ++ if (rdma_is_kernel_res(&counter->res) != rdma_is_kernel_res(&qp->res)) { + ret = -EINVAL; + goto err_task; + } +-- +2.25.1 + diff --git a/queue-5.4/rdma-counter-only-bind-user-qps-in-auto-mode.patch b/queue-5.4/rdma-counter-only-bind-user-qps-in-auto-mode.patch new file mode 100644 index 00000000000..35090f48927 --- /dev/null +++ b/queue-5.4/rdma-counter-only-bind-user-qps-in-auto-mode.patch @@ -0,0 +1,40 @@ +From d8f97d346638608cef4451f495e7d9a877b99a54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jul 2020 11:29:32 +0300 +Subject: RDMA/counter: Only bind user QPs in auto mode + +From: Mark Zhang + +[ Upstream commit c9f557421e505f75da4234a6af8eff46bc08614b ] + +In auto mode only bind user QPs to a dynamic counter, since this feature +is mainly used for system statistic and diagnostic purpose, while there's +no need to counter kernel QPs so far. + +Fixes: 99fa331dc862 ("RDMA/counter: Add "auto" configuration mode support") +Link: https://lore.kernel.org/r/20200702082933.424537-3-leon@kernel.org +Signed-off-by: Mark Zhang +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/counters.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/counters.c b/drivers/infiniband/core/counters.c +index 11210bf7fd61b..42809f612c2c4 100644 +--- a/drivers/infiniband/core/counters.c ++++ b/drivers/infiniband/core/counters.c +@@ -284,7 +284,7 @@ int rdma_counter_bind_qp_auto(struct ib_qp *qp, u8 port) + struct rdma_counter *counter; + int ret; + +- if (!qp->res.valid) ++ if (!qp->res.valid || rdma_is_kernel_res(&qp->res)) + return 0; + + if (!rdma_is_port_valid(dev, port)) +-- +2.25.1 + diff --git a/queue-5.4/rdma-ipoib-fix-abba-deadlock-with-ipoib_reap_ah.patch b/queue-5.4/rdma-ipoib-fix-abba-deadlock-with-ipoib_reap_ah.patch new file mode 100644 index 00000000000..f3a93480bf4 --- /dev/null +++ b/queue-5.4/rdma-ipoib-fix-abba-deadlock-with-ipoib_reap_ah.patch @@ -0,0 +1,216 @@ +From e29e5e4276f57d26e6febba6350104801b10a668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jun 2020 20:42:19 +0300 +Subject: RDMA/ipoib: Fix ABBA deadlock with ipoib_reap_ah() + +From: Jason Gunthorpe + +[ Upstream commit 65936bf25f90fe440bb2d11624c7d10fab266639 ] + +ipoib_mcast_carrier_on_task() insanely open codes a rtnl_lock() such that +the only time flush_workqueue() can be called is if it also clears +IPOIB_FLAG_OPER_UP. + +Thus the flush inside ipoib_flush_ah() will deadlock if it gets unlucky +enough, and lockdep doesn't help us to find it early: + + CPU0 CPU1 CPU2 + __ipoib_ib_dev_flush() + down_read(vlan_rwsem) + + ipoib_vlan_add() + rtnl_trylock() + down_write(vlan_rwsem) + + ipoib_mcast_carrier_on_task() + while (!rtnl_trylock()) + msleep(20); + + ipoib_flush_ah() + flush_workqueue(priv->wq) + +Clean up the ah_reaper related functions and lifecycle to make sense: + + - Start/Stop of the reaper should only be done in open/stop NDOs, not in + any other places + + - cancel and flush of the reaper should only happen in the stop NDO. + cancel is only functional when combined with IPOIB_STOP_REAPER. + + - Non-stop places were flushing the AH's just need to flush out dead AH's + synchronously and ignore the background task completely. It is fully + locked and harmless to leave running. + +Which ultimately fixes the ABBA deadlock by removing the unnecessary +flush_workqueue() from the problematic place under the vlan_rwsem. + +Fixes: efc82eeeae4e ("IB/ipoib: No longer use flush as a parameter") +Link: https://lore.kernel.org/r/20200625174219.290842-1-kamalheib1@gmail.com +Reported-by: Kamal Heib +Tested-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/ipoib/ipoib_ib.c | 65 ++++++++++------------- + drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 + + 2 files changed, 31 insertions(+), 36 deletions(-) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index 6ee64c25aaff4..494f413dc3c6c 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -670,13 +670,12 @@ int ipoib_send(struct net_device *dev, struct sk_buff *skb, + return rc; + } + +-static void __ipoib_reap_ah(struct net_device *dev) ++static void ipoib_reap_dead_ahs(struct ipoib_dev_priv *priv) + { +- struct ipoib_dev_priv *priv = ipoib_priv(dev); + struct ipoib_ah *ah, *tah; + unsigned long flags; + +- netif_tx_lock_bh(dev); ++ netif_tx_lock_bh(priv->dev); + spin_lock_irqsave(&priv->lock, flags); + + list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list) +@@ -687,37 +686,37 @@ static void __ipoib_reap_ah(struct net_device *dev) + } + + spin_unlock_irqrestore(&priv->lock, flags); +- netif_tx_unlock_bh(dev); ++ netif_tx_unlock_bh(priv->dev); + } + + void ipoib_reap_ah(struct work_struct *work) + { + struct ipoib_dev_priv *priv = + container_of(work, struct ipoib_dev_priv, ah_reap_task.work); +- struct net_device *dev = priv->dev; + +- __ipoib_reap_ah(dev); ++ ipoib_reap_dead_ahs(priv); + + if (!test_bit(IPOIB_STOP_REAPER, &priv->flags)) + queue_delayed_work(priv->wq, &priv->ah_reap_task, + round_jiffies_relative(HZ)); + } + +-static void ipoib_flush_ah(struct net_device *dev) ++static void ipoib_start_ah_reaper(struct ipoib_dev_priv *priv) + { +- struct ipoib_dev_priv *priv = ipoib_priv(dev); +- +- cancel_delayed_work(&priv->ah_reap_task); +- flush_workqueue(priv->wq); +- ipoib_reap_ah(&priv->ah_reap_task.work); ++ clear_bit(IPOIB_STOP_REAPER, &priv->flags); ++ queue_delayed_work(priv->wq, &priv->ah_reap_task, ++ round_jiffies_relative(HZ)); + } + +-static void ipoib_stop_ah(struct net_device *dev) ++static void ipoib_stop_ah_reaper(struct ipoib_dev_priv *priv) + { +- struct ipoib_dev_priv *priv = ipoib_priv(dev); +- + set_bit(IPOIB_STOP_REAPER, &priv->flags); +- ipoib_flush_ah(dev); ++ cancel_delayed_work(&priv->ah_reap_task); ++ /* ++ * After ipoib_stop_ah_reaper() we always go through ++ * ipoib_reap_dead_ahs() which ensures the work is really stopped and ++ * does a final flush out of the dead_ah's list ++ */ + } + + static int recvs_pending(struct net_device *dev) +@@ -846,16 +845,6 @@ int ipoib_ib_dev_stop_default(struct net_device *dev) + return 0; + } + +-void ipoib_ib_dev_stop(struct net_device *dev) +-{ +- struct ipoib_dev_priv *priv = ipoib_priv(dev); +- +- priv->rn_ops->ndo_stop(dev); +- +- clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); +- ipoib_flush_ah(dev); +-} +- + int ipoib_ib_dev_open_default(struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); +@@ -899,10 +888,7 @@ int ipoib_ib_dev_open(struct net_device *dev) + return -1; + } + +- clear_bit(IPOIB_STOP_REAPER, &priv->flags); +- queue_delayed_work(priv->wq, &priv->ah_reap_task, +- round_jiffies_relative(HZ)); +- ++ ipoib_start_ah_reaper(priv); + if (priv->rn_ops->ndo_open(dev)) { + pr_warn("%s: Failed to open dev\n", dev->name); + goto dev_stop; +@@ -913,13 +899,20 @@ int ipoib_ib_dev_open(struct net_device *dev) + return 0; + + dev_stop: +- set_bit(IPOIB_STOP_REAPER, &priv->flags); +- cancel_delayed_work(&priv->ah_reap_task); +- set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); +- ipoib_ib_dev_stop(dev); ++ ipoib_stop_ah_reaper(priv); + return -1; + } + ++void ipoib_ib_dev_stop(struct net_device *dev) ++{ ++ struct ipoib_dev_priv *priv = ipoib_priv(dev); ++ ++ priv->rn_ops->ndo_stop(dev); ++ ++ clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); ++ ipoib_stop_ah_reaper(priv); ++} ++ + void ipoib_pkey_dev_check_presence(struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); +@@ -1230,7 +1223,7 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, + ipoib_mcast_dev_flush(dev); + if (oper_up) + set_bit(IPOIB_FLAG_OPER_UP, &priv->flags); +- ipoib_flush_ah(dev); ++ ipoib_reap_dead_ahs(priv); + } + + if (level >= IPOIB_FLUSH_NORMAL) +@@ -1305,7 +1298,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev) + * the neighbor garbage collection is stopped and reaped. + * That should all be done now, so make a final ah flush. + */ +- ipoib_stop_ah(dev); ++ ipoib_reap_dead_ahs(priv); + + clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags); + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 4fd095fd63b6f..044bcacad6e48 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -1979,6 +1979,8 @@ static void ipoib_ndo_uninit(struct net_device *dev) + + /* no more works over the priv->wq */ + if (priv->wq) { ++ /* See ipoib_mcast_carrier_on_task() */ ++ WARN_ON(test_bit(IPOIB_FLAG_OPER_UP, &priv->flags)); + flush_workqueue(priv->wq); + destroy_workqueue(priv->wq); + priv->wq = NULL; +-- +2.25.1 + diff --git a/queue-5.4/rdma-ipoib-return-void-from-ipoib_ib_dev_stop.patch b/queue-5.4/rdma-ipoib-return-void-from-ipoib_ib_dev_stop.patch new file mode 100644 index 00000000000..0dda0f29752 --- /dev/null +++ b/queue-5.4/rdma-ipoib-return-void-from-ipoib_ib_dev_stop.patch @@ -0,0 +1,59 @@ +From 3542cc9e0eceec5a3372f708e9c93a8a65c7f593 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jun 2020 13:52:36 +0300 +Subject: RDMA/ipoib: Return void from ipoib_ib_dev_stop() + +From: Kamal Heib + +[ Upstream commit 95a5631f6c9f3045f26245e6045244652204dfdb ] + +The return value from ipoib_ib_dev_stop() is always 0 - change it to be +void. + +Link: https://lore.kernel.org/r/20200623105236.18683-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/ulp/ipoib/ipoib.h | 2 +- + drivers/infiniband/ulp/ipoib/ipoib_ib.c | 4 +--- + 2 files changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h b/drivers/infiniband/ulp/ipoib/ipoib.h +index 0e5f27caf2b2d..50a3557386090 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib.h ++++ b/drivers/infiniband/ulp/ipoib/ipoib.h +@@ -515,7 +515,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev); + + int ipoib_ib_dev_open_default(struct net_device *dev); + int ipoib_ib_dev_open(struct net_device *dev); +-int ipoib_ib_dev_stop(struct net_device *dev); ++void ipoib_ib_dev_stop(struct net_device *dev); + void ipoib_ib_dev_up(struct net_device *dev); + void ipoib_ib_dev_down(struct net_device *dev); + int ipoib_ib_dev_stop_default(struct net_device *dev); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index da3c5315bbb51..6ee64c25aaff4 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -846,7 +846,7 @@ int ipoib_ib_dev_stop_default(struct net_device *dev) + return 0; + } + +-int ipoib_ib_dev_stop(struct net_device *dev) ++void ipoib_ib_dev_stop(struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); + +@@ -854,8 +854,6 @@ int ipoib_ib_dev_stop(struct net_device *dev) + + clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags); + ipoib_flush_ah(dev); +- +- return 0; + } + + int ipoib_ib_dev_open_default(struct net_device *dev) +-- +2.25.1 + diff --git a/queue-5.4/recordmcount-fix-build-failure-on-non-arm64.patch b/queue-5.4/recordmcount-fix-build-failure-on-non-arm64.patch new file mode 100644 index 00000000000..54acc653c35 --- /dev/null +++ b/queue-5.4/recordmcount-fix-build-failure-on-non-arm64.patch @@ -0,0 +1,48 @@ +From fe176a53c711231b88ed3c29fa551bc3b321de64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Aug 2020 08:48:22 +0000 +Subject: recordmcount: Fix build failure on non arm64 + +From: Christophe Leroy + +[ Upstream commit 3df14264ad9930733a8166e5bd0eccc1727564bb ] + +Commit ea0eada45632 leads to the following build failure on powerpc: + + HOSTCC scripts/recordmcount +scripts/recordmcount.c: In function 'arm64_is_fake_mcount': +scripts/recordmcount.c:440: error: 'R_AARCH64_CALL26' undeclared (first use in this function) +scripts/recordmcount.c:440: error: (Each undeclared identifier is reported only once +scripts/recordmcount.c:440: error: for each function it appears in.) +make[2]: *** [scripts/recordmcount] Error 1 + +Make sure R_AARCH64_CALL26 is always defined. + +Fixes: ea0eada45632 ("recordmcount: only record relocation of type R_AARCH64_CALL26 on arm64.") +Signed-off-by: Christophe Leroy +Acked-by: Steven Rostedt (VMware) +Acked-by: Gregory Herrero +Cc: Gregory Herrero +Link: https://lore.kernel.org/r/5ca1be21fa6ebf73203b45fd9aadd2bafb5e6b15.1597049145.git.christophe.leroy@csgroup.eu +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + scripts/recordmcount.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c +index e59022b3f1254..b9c2ee7ab43fa 100644 +--- a/scripts/recordmcount.c ++++ b/scripts/recordmcount.c +@@ -42,6 +42,8 @@ + #define R_ARM_THM_CALL 10 + #define R_ARM_CALL 28 + ++#define R_AARCH64_CALL26 283 ++ + static int fd_map; /* File descriptor for file being modified. */ + static int mmap_failed; /* Boolean flag. */ + static char gpfx; /* prefix for global symbol name (sometimes '_') */ +-- +2.25.1 + diff --git a/queue-5.4/scsi-lpfc-nvmet-avoid-hang-use-after-free-again-when.patch b/queue-5.4/scsi-lpfc-nvmet-avoid-hang-use-after-free-again-when.patch new file mode 100644 index 00000000000..40474fb777c --- /dev/null +++ b/queue-5.4/scsi-lpfc-nvmet-avoid-hang-use-after-free-again-when.patch @@ -0,0 +1,48 @@ +From d286f494e9b9d5a4cea179ef1a57b411b1675312 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jul 2020 19:10:11 -0400 +Subject: scsi: lpfc: nvmet: Avoid hang / use-after-free again when destroying + targetport + +From: Ewan D. Milne + +[ Upstream commit af6de8c60fe9433afa73cea6fcccdccd98ad3e5e ] + +We cannot wait on a completion object in the lpfc_nvme_targetport structure +in the _destroy_targetport() code path because the NVMe/fc transport will +free that structure immediately after the .targetport_delete() callback. +This results in a use-after-free, and a crash if slub_debug=FZPU is +enabled. + +An earlier fix put put the completion on the stack, but commit 2a0fb340fcc8 +("scsi: lpfc: Correct localport timeout duration error") subsequently +changed the code to reference the completion through a pointer in the +object rather than the local stack variable. Fix this by using the stack +variable directly. + +Link: https://lore.kernel.org/r/20200729231011.13240-1-emilne@redhat.com +Fixes: 2a0fb340fcc8 ("scsi: lpfc: Correct localport timeout duration error") +Reviewed-by: James Smart +Signed-off-by: Ewan D. Milne +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_nvmet.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c +index 9884228800a50..f14394ab0e037 100644 +--- a/drivers/scsi/lpfc/lpfc_nvmet.c ++++ b/drivers/scsi/lpfc/lpfc_nvmet.c +@@ -1923,7 +1923,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba) + } + tgtp->tport_unreg_cmp = &tport_unreg_cmp; + nvmet_fc_unregister_targetport(phba->targetport); +- if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp, ++ if (!wait_for_completion_timeout(&tport_unreg_cmp, + msecs_to_jiffies(LPFC_NVMET_WAIT_TMO))) + lpfc_printf_log(phba, KERN_ERR, LOG_NVME, + "6179 Unreg targetport x%px timeout " +-- +2.25.1 + diff --git a/queue-5.4/selftests-bpf-test_progs-indicate-to-shell-on-non-ac.patch b/queue-5.4/selftests-bpf-test_progs-indicate-to-shell-on-non-ac.patch new file mode 100644 index 00000000000..a05b1740e34 --- /dev/null +++ b/queue-5.4/selftests-bpf-test_progs-indicate-to-shell-on-non-ac.patch @@ -0,0 +1,39 @@ +From 9b2ebe90a09121b2ec09311d33ecf69b00cd85b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Jul 2020 23:44:07 +0200 +Subject: selftests/bpf: Test_progs indicate to shell on non-actions + +From: Jesper Dangaard Brouer + +[ Upstream commit 6c92bd5cd4650c39dd929565ee172984c680fead ] + +When a user selects a non-existing test the summary is printed with +indication 0 for all info types, and shell "success" (EXIT_SUCCESS) is +indicated. This can be understood by a human end-user, but for shell +scripting is it useful to indicate a shell failure (EXIT_FAILURE). + +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Alexei Starovoitov +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/159363984736.930467.17956007131403952343.stgit@firesoul +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_progs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c +index 8cb3469dd11f2..a7d06724c18c2 100644 +--- a/tools/testing/selftests/bpf/test_progs.c ++++ b/tools/testing/selftests/bpf/test_progs.c +@@ -584,5 +584,8 @@ int main(int argc, char **argv) + free(env.test_selector.num_set); + free(env.subtest_selector.num_set); + ++ if (env.succ_cnt + env.fail_cnt + env.skip_cnt == 0) ++ return EXIT_FAILURE; ++ + return env.fail_cnt ? EXIT_FAILURE : EXIT_SUCCESS; + } +-- +2.25.1 + diff --git a/queue-5.4/selftests-bpf-test_progs-use-another-shell-exit-on-n.patch b/queue-5.4/selftests-bpf-test_progs-use-another-shell-exit-on-n.patch new file mode 100644 index 00000000000..6aab806783f --- /dev/null +++ b/queue-5.4/selftests-bpf-test_progs-use-another-shell-exit-on-n.patch @@ -0,0 +1,54 @@ +From 4f75316ba7fce51228ccdb28b316100c48ad373c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jul 2020 09:12:19 +0200 +Subject: selftests/bpf: test_progs use another shell exit on non-actions + +From: Jesper Dangaard Brouer + +[ Upstream commit 3220fb667842a9725cbb71656f406eadb03c094b ] + +This is a follow up adjustment to commit 6c92bd5cd465 ("selftests/bpf: +Test_progs indicate to shell on non-actions"), that returns shell exit +indication EXIT_FAILURE (value 1) when user selects a non-existing test. + +The problem with using EXIT_FAILURE is that a shell script cannot tell +the difference between a non-existing test and the test failing. + +This patch uses value 2 as shell exit indication. +(Aside note unrecognized option parameters use value 64). + +Fixes: 6c92bd5cd465 ("selftests/bpf: Test_progs indicate to shell on non-actions") +Signed-off-by: Jesper Dangaard Brouer +Signed-off-by: Daniel Borkmann +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/159410593992.1093222.90072558386094370.stgit@firesoul +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/test_progs.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/test_progs.c b/tools/testing/selftests/bpf/test_progs.c +index a7d06724c18c2..48bbe8e0ce48d 100644 +--- a/tools/testing/selftests/bpf/test_progs.c ++++ b/tools/testing/selftests/bpf/test_progs.c +@@ -7,6 +7,8 @@ + #include + #include + ++#define EXIT_NO_TEST 2 ++ + /* defined in test_progs.h */ + struct test_env env; + +@@ -585,7 +587,7 @@ int main(int argc, char **argv) + free(env.subtest_selector.num_set); + + if (env.succ_cnt + env.fail_cnt + env.skip_cnt == 0) +- return EXIT_FAILURE; ++ return EXIT_NO_TEST; + + return env.fail_cnt ? EXIT_FAILURE : EXIT_SUCCESS; + } +-- +2.25.1 + diff --git a/queue-5.4/selftests-powerpc-ptrace-pkey-don-t-update-expected-.patch b/queue-5.4/selftests-powerpc-ptrace-pkey-don-t-update-expected-.patch new file mode 100644 index 00000000000..4a3de694792 --- /dev/null +++ b/queue-5.4/selftests-powerpc-ptrace-pkey-don-t-update-expected-.patch @@ -0,0 +1,53 @@ +From 3940d204f0f2517a725632aa3c2d9bf21115e4d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 08:59:45 +0530 +Subject: selftests/powerpc: ptrace-pkey: Don't update expected UAMOR value + +From: Aneesh Kumar K.V + +[ Upstream commit 3563b9bea0ca7f53e4218b5e268550341a49f333 ] + +With commit 4a4a5e5d2aad ("powerpc/pkeys: key allocation/deallocation +must not change pkey registers") we are not updating UAMOR on key +allocation. So don't update the expected uamor value in the test. + +Fixes: 4a4a5e5d2aad ("powerpc/pkeys: key allocation/deallocation must not change pkey registers") +Signed-off-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200709032946.881753-23-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +index bc33d748d95b4..3694613f418f6 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +@@ -101,15 +101,20 @@ static int child(struct shared_info *info) + */ + info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor); + ++ /* ++ * if PKEY_DISABLE_EXECUTE succeeded we should update the expected_iamr ++ */ + if (disable_execute) + info->expected_iamr |= 1ul << pkeyshift(pkey1); + else + info->expected_iamr &= ~(1ul << pkeyshift(pkey1)); + +- info->expected_iamr &= ~(1ul << pkeyshift(pkey2) | 1ul << pkeyshift(pkey3)); ++ /* ++ * We allocated pkey2 and pkey 3 above. Clear the IAMR bits. ++ */ ++ info->expected_iamr &= ~(1ul << pkeyshift(pkey2)); ++ info->expected_iamr &= ~(1ul << pkeyshift(pkey3)); + +- info->expected_uamor |= 3ul << pkeyshift(pkey1) | +- 3ul << pkeyshift(pkey2); + /* + * Create an IAMR value different from expected value. + * Kernel will reject an IAMR and UAMOR change. +-- +2.25.1 + diff --git a/queue-5.4/selftests-powerpc-ptrace-pkey-rename-variables-to-ma.patch b/queue-5.4/selftests-powerpc-ptrace-pkey-rename-variables-to-ma.patch new file mode 100644 index 00000000000..7152c4d6c9c --- /dev/null +++ b/queue-5.4/selftests-powerpc-ptrace-pkey-rename-variables-to-ma.patch @@ -0,0 +1,112 @@ +From 1e3705d3b126a8a6b6527c4d953806ef4b8f6ba5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 08:59:43 +0530 +Subject: selftests/powerpc: ptrace-pkey: Rename variables to make it easier to + follow code + +From: Aneesh Kumar K.V + +[ Upstream commit 9a11f12e0a6c374b3ef1ce81e32ce477d28eb1b8 ] + +Rename variable to indicate that they are invalid values which we will +use to test ptrace update of pkeys. + +Signed-off-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200709032946.881753-21-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + .../selftests/powerpc/ptrace/ptrace-pkey.c | 26 +++++++++---------- + 1 file changed, 13 insertions(+), 13 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +index bdbbbe8431e03..f9216c7a1829e 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +@@ -44,7 +44,7 @@ struct shared_info { + unsigned long amr2; + + /* AMR value that ptrace should refuse to write to the child. */ +- unsigned long amr3; ++ unsigned long invalid_amr; + + /* IAMR value the parent expects to read from the child. */ + unsigned long expected_iamr; +@@ -57,8 +57,8 @@ struct shared_info { + * (even though they're valid ones) because userspace doesn't have + * access to those registers. + */ +- unsigned long new_iamr; +- unsigned long new_uamor; ++ unsigned long invalid_iamr; ++ unsigned long invalid_uamor; + }; + + static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights) +@@ -100,7 +100,7 @@ static int child(struct shared_info *info) + + info->amr1 |= 3ul << pkeyshift(pkey1); + info->amr2 |= 3ul << pkeyshift(pkey2); +- info->amr3 |= info->amr2 | 3ul << pkeyshift(pkey3); ++ info->invalid_amr |= info->amr2 | 3ul << pkeyshift(pkey3); + + if (disable_execute) + info->expected_iamr |= 1ul << pkeyshift(pkey1); +@@ -111,8 +111,8 @@ static int child(struct shared_info *info) + + info->expected_uamor |= 3ul << pkeyshift(pkey1) | + 3ul << pkeyshift(pkey2); +- info->new_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2); +- info->new_uamor |= 3ul << pkeyshift(pkey1); ++ info->invalid_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2); ++ info->invalid_uamor |= 3ul << pkeyshift(pkey1); + + /* + * We won't use pkey3. We just want a plausible but invalid key to test +@@ -196,9 +196,9 @@ static int parent(struct shared_info *info, pid_t pid) + PARENT_SKIP_IF_UNSUPPORTED(ret, &info->child_sync); + PARENT_FAIL_IF(ret, &info->child_sync); + +- info->amr1 = info->amr2 = info->amr3 = regs[0]; +- info->expected_iamr = info->new_iamr = regs[1]; +- info->expected_uamor = info->new_uamor = regs[2]; ++ info->amr1 = info->amr2 = info->invalid_amr = regs[0]; ++ info->expected_iamr = info->invalid_iamr = regs[1]; ++ info->expected_uamor = info->invalid_uamor = regs[2]; + + /* Wake up child so that it can set itself up. */ + ret = prod_child(&info->child_sync); +@@ -234,10 +234,10 @@ static int parent(struct shared_info *info, pid_t pid) + return ret; + + /* Write invalid AMR value in child. */ +- ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->amr3, 1); ++ ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->invalid_amr, 1); + PARENT_FAIL_IF(ret, &info->child_sync); + +- printf("%-30s AMR: %016lx\n", ptrace_write_running, info->amr3); ++ printf("%-30s AMR: %016lx\n", ptrace_write_running, info->invalid_amr); + + /* Wake up child so that it can verify it didn't change. */ + ret = prod_child(&info->child_sync); +@@ -249,7 +249,7 @@ static int parent(struct shared_info *info, pid_t pid) + + /* Try to write to IAMR. */ + regs[0] = info->amr1; +- regs[1] = info->new_iamr; ++ regs[1] = info->invalid_iamr; + ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 2); + PARENT_FAIL_IF(!ret, &info->child_sync); + +@@ -257,7 +257,7 @@ static int parent(struct shared_info *info, pid_t pid) + ptrace_write_running, regs[0], regs[1]); + + /* Try to write to IAMR and UAMOR. */ +- regs[2] = info->new_uamor; ++ regs[2] = info->invalid_uamor; + ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 3); + PARENT_FAIL_IF(!ret, &info->child_sync); + +-- +2.25.1 + diff --git a/queue-5.4/selftests-powerpc-ptrace-pkey-update-the-test-to-mar.patch b/queue-5.4/selftests-powerpc-ptrace-pkey-update-the-test-to-mar.patch new file mode 100644 index 00000000000..0ad3a338829 --- /dev/null +++ b/queue-5.4/selftests-powerpc-ptrace-pkey-update-the-test-to-mar.patch @@ -0,0 +1,85 @@ +From 2b50dbb558164474a04451e9b8cdc105a7c313f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Jul 2020 08:59:44 +0530 +Subject: selftests/powerpc: ptrace-pkey: Update the test to mark an invalid + pkey correctly + +From: Aneesh Kumar K.V + +[ Upstream commit 0eaa3b5ca7b5a76e3783639c828498343be66a01 ] + +Signed-off-by: Aneesh Kumar K.V +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200709032946.881753-22-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + .../selftests/powerpc/ptrace/ptrace-pkey.c | 30 ++++++++----------- + 1 file changed, 12 insertions(+), 18 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +index f9216c7a1829e..bc33d748d95b4 100644 +--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c ++++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c +@@ -66,11 +66,6 @@ static int sys_pkey_alloc(unsigned long flags, unsigned long init_access_rights) + return syscall(__NR_pkey_alloc, flags, init_access_rights); + } + +-static int sys_pkey_free(int pkey) +-{ +- return syscall(__NR_pkey_free, pkey); +-} +- + static int child(struct shared_info *info) + { + unsigned long reg; +@@ -100,7 +95,11 @@ static int child(struct shared_info *info) + + info->amr1 |= 3ul << pkeyshift(pkey1); + info->amr2 |= 3ul << pkeyshift(pkey2); +- info->invalid_amr |= info->amr2 | 3ul << pkeyshift(pkey3); ++ /* ++ * invalid amr value where we try to force write ++ * things which are deined by a uamor setting. ++ */ ++ info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor); + + if (disable_execute) + info->expected_iamr |= 1ul << pkeyshift(pkey1); +@@ -111,17 +110,12 @@ static int child(struct shared_info *info) + + info->expected_uamor |= 3ul << pkeyshift(pkey1) | + 3ul << pkeyshift(pkey2); +- info->invalid_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2); +- info->invalid_uamor |= 3ul << pkeyshift(pkey1); +- + /* +- * We won't use pkey3. We just want a plausible but invalid key to test +- * whether ptrace will let us write to AMR bits we are not supposed to. +- * +- * This also tests whether the kernel restores the UAMOR permissions +- * after a key is freed. ++ * Create an IAMR value different from expected value. ++ * Kernel will reject an IAMR and UAMOR change. + */ +- sys_pkey_free(pkey3); ++ info->invalid_iamr = info->expected_iamr | (1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2)); ++ info->invalid_uamor = info->expected_uamor & ~(0x3ul << pkeyshift(pkey1)); + + printf("%-30s AMR: %016lx pkey1: %d pkey2: %d pkey3: %d\n", + user_write, info->amr1, pkey1, pkey2, pkey3); +@@ -196,9 +190,9 @@ static int parent(struct shared_info *info, pid_t pid) + PARENT_SKIP_IF_UNSUPPORTED(ret, &info->child_sync); + PARENT_FAIL_IF(ret, &info->child_sync); + +- info->amr1 = info->amr2 = info->invalid_amr = regs[0]; +- info->expected_iamr = info->invalid_iamr = regs[1]; +- info->expected_uamor = info->invalid_uamor = regs[2]; ++ info->amr1 = info->amr2 = regs[0]; ++ info->expected_iamr = regs[1]; ++ info->expected_uamor = regs[2]; + + /* Wake up child so that it can set itself up. */ + ret = prod_child(&info->child_sync); +-- +2.25.1 + diff --git a/queue-5.4/series b/queue-5.4/series index d3a4603e224..2f271e39c50 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -74,3 +74,71 @@ remoteproc-qcom_q6v5_mss-validate-modem-blob-firmware-size-before-load.patch drm-imx-imx-ldb-disable-both-channels-for-split-mode-in-enc-disable.patch orangefs-get-rid-of-knob-code.patch pinctrl-ingenic-properly-detect-gpio-direction-when-configured-for-irq.patch +crypto-algif_aead-only-wake-up-when-ctx-more-is-zero.patch +mfd-arizona-ensure-32k-clock-is-put-on-driver-unbind.patch +octeontx2-af-change-struct-qmem-entry_sz-from-u8-to-.patch +mtd-rawnand-fsl_upm-remove-unused-mtd-var.patch +platform-chrome-cros_ec_ishtp-fix-a-double-unlock-is.patch +rdma-ipoib-return-void-from-ipoib_ib_dev_stop.patch +rdma-ipoib-fix-abba-deadlock-with-ipoib_reap_ah.patch +media-rockchip-rga-introduce-color-fmt-macros-and-re.patch +media-rockchip-rga-only-set-output-csc-mode-for-rgb-.patch +ib-uverbs-set-iova-on-ib-mr-in-uverbs-layer.patch +selftests-bpf-test_progs-indicate-to-shell-on-non-ac.patch +selftests-bpf-test_progs-use-another-shell-exit-on-n.patch +usb-serial-ftdi_sio-make-process-packet-buffer-unsig.patch +usb-serial-ftdi_sio-clean-up-receive-processing.patch +usb-serial-ftdi_sio-fix-break-and-sysrq-handling.patch +crypto-af_alg-fix-regression-on-empty-requests.patch +devres-keep-both-device-name-and-resource-name-in-pr.patch +rdma-counter-only-bind-user-qps-in-auto-mode.patch +rdma-counter-allow-manually-bind-qps-with-different-.patch +mmc-renesas_sdhi_internal_dmac-clean-up-the-code-for.patch +crypto-caam-remove-broken-arc4-support.patch +gpu-ipu-v3-image-convert-combine-rotate-no-rotate-ir.patch +gpu-ipu-v3-image-convert-wait-for-all-eofs-before-co.patch +dm-rq-don-t-call-blk_mq_queue_stopped-in-dm_stop_que.patch +clk-actions-fix-h_clk-for-actions-s500-soc.patch +selftests-powerpc-ptrace-pkey-rename-variables-to-ma.patch +selftests-powerpc-ptrace-pkey-update-the-test-to-mar.patch +selftests-powerpc-ptrace-pkey-don-t-update-expected-.patch +iommu-omap-check-for-failure-of-a-call-to-omap_iommu.patch +clk-qcom-gcc-fix-sm8150-gpu-and-npu-clocks.patch +clk-qcom-clk-alpha-pll-remove-unused-incorrect-pll_c.patch +iommu-vt-d-enforce-pasid-devtlb-field-mask.patch +i2c-rcar-slave-only-send-stop-event-when-we-have-bee.patch +clk-qcom-gcc-sdm660-fix-up-gcc_mss_mnoc_bimc_axi_clk.patch +clk-clk-atlas6-fix-return-value-check-in-atlas6_clk_.patch +pwm-bcm-iproc-handle-clk_get_rate-return.patch +tools-build-feature-use-cc-and-cxx-from-parent.patch +i2c-rcar-avoid-race-when-unregistering-slave.patch +nfs-ensure-correct-writeback-errors-are-returned-on-.patch +ubifs-fix-wrong-orphan-node-deletion-in-ubifs_jnl_up.patch +clk-bcm2835-do-not-use-prediv-with-bcm2711-s-plls.patch +libnvdimm-security-fix-a-typo.patch +libnvdimm-security-ensure-sysfs-poll-thread-woke-up-.patch +openrisc-fix-oops-caused-when-dumping-stack.patch +scsi-lpfc-nvmet-avoid-hang-use-after-free-again-when.patch +nfs-nfs_file_write-should-check-for-writeback-errors.patch +watchdog-initialize-device-before-misc_register.patch +md-cluster-fix-potential-error-pointer-dereference-i.patch +x86-tsr-fix-tsc-frequency-enumeration-bug-on-lightni.patch +input-sentelic-fix-error-return-when-fsp_reg_write-f.patch +recordmcount-fix-build-failure-on-non-arm64.patch +drm-vmwgfx-use-correct-vmw_legacy_display_unit-point.patch +drm-vmwgfx-fix-two-list_for_each-loop-exit-tests.patch +net-qcom-emac-add-missed-clk_disable_unprepare-in-er.patch +nfs-fix-getxattr-kernel-panic-and-memory-overflow.patch +fs-minix-set-s_maxbytes-correctly.patch +fs-minix-fix-block-limit-check-for-v1-filesystems.patch +fs-minix-remove-expected-error-message-in-block_to_p.patch +fs-ufs-avoid-potential-u32-multiplication-overflow.patch +test_kmod-avoid-potential-double-free-in-trigger_con.patch +i2c-iproc-fix-race-between-client-unreg-and-isr.patch +mfd-dln2-run-event-handler-loop-under-spinlock.patch +crypto-algif_aead-fix-uninitialized-ctx-init.patch +alsa-echoaudio-fix-potential-oops-in-snd_echo_resume.patch +perf-bench-mem-always-memset-source-before-memcpy.patch +tools-build-feature-quote-cc-and-cxx-for-their-argum.patch +perf-x86-rapl-fix-missing-psys-sysfs-attributes.patch +sh-landisk-add-missing-initialization-of-sh_io_port_.patch diff --git a/queue-5.4/sh-landisk-add-missing-initialization-of-sh_io_port_.patch b/queue-5.4/sh-landisk-add-missing-initialization-of-sh_io_port_.patch new file mode 100644 index 00000000000..fe7e512ce54 --- /dev/null +++ b/queue-5.4/sh-landisk-add-missing-initialization-of-sh_io_port_.patch @@ -0,0 +1,45 @@ +From 9403d69266ff1326290c0a645c8ae2fbc6704501 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Aug 2020 14:42:45 +0200 +Subject: sh: landisk: Add missing initialization of sh_io_port_base + +From: Geert Uytterhoeven + +[ Upstream commit 0c64a0dce51faa9c706fdf1f957d6f19878f4b81 ] + +The Landisk setup code maps the CF IDE area using ioremap_prot(), and +passes the resulting virtual addresses to the pata_platform driver, +disguising them as I/O port addresses. Hence the pata_platform driver +translates them again using ioport_map(). +As CONFIG_GENERIC_IOMAP=n, and CONFIG_HAS_IOPORT_MAP=y, the +SuperH-specific mapping code in arch/sh/kernel/ioport.c translates +I/O port addresses to virtual addresses by adding sh_io_port_base, which +defaults to -1, thus breaking the assumption of an identity mapping. + +Fix this by setting sh_io_port_base to zero. + +Fixes: 37b7a97884ba64bf ("sh: machvec IO death.") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/boards/mach-landisk/setup.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/sh/boards/mach-landisk/setup.c b/arch/sh/boards/mach-landisk/setup.c +index 16b4d8b0bb850..2c44b94f82fb2 100644 +--- a/arch/sh/boards/mach-landisk/setup.c ++++ b/arch/sh/boards/mach-landisk/setup.c +@@ -82,6 +82,9 @@ device_initcall(landisk_devices_setup); + + static void __init landisk_setup(char **cmdline_p) + { ++ /* I/O port identity mapping */ ++ __set_io_port_base(0); ++ + /* LED ON */ + __raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED); + +-- +2.25.1 + diff --git a/queue-5.4/test_kmod-avoid-potential-double-free-in-trigger_con.patch b/queue-5.4/test_kmod-avoid-potential-double-free-in-trigger_con.patch new file mode 100644 index 00000000000..5f0f0fd27e8 --- /dev/null +++ b/queue-5.4/test_kmod-avoid-potential-double-free-in-trigger_con.patch @@ -0,0 +1,65 @@ +From 0ff05e740be03784345c278c3399e09697e6afc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Aug 2020 18:36:16 -0700 +Subject: test_kmod: avoid potential double free in trigger_config_run_type() + +From: Tiezhu Yang + +[ Upstream commit 0776d1231bec0c7ab43baf440a3f5ef5f49dd795 ] + +Reset the member "test_fs" of the test configuration after a call of the +function "kfree_const" to a null pointer so that a double memory release +will not be performed. + +Fixes: d9c6a72d6fa2 ("kmod: add test driver to stress test the module loader") +Signed-off-by: Tiezhu Yang +Signed-off-by: Luis Chamberlain +Signed-off-by: Andrew Morton +Acked-by: Luis Chamberlain +Cc: Alexei Starovoitov +Cc: Al Viro +Cc: Christian Brauner +Cc: Chuck Lever +Cc: David Howells +Cc: David S. Miller +Cc: Greg Kroah-Hartman +Cc: Jakub Kicinski +Cc: James Morris +Cc: Jarkko Sakkinen +Cc: J. Bruce Fields +Cc: Jens Axboe +Cc: Josh Triplett +Cc: Kees Cook +Cc: Lars Ellenberg +Cc: Nikolay Aleksandrov +Cc: Philipp Reisner +Cc: Roopa Prabhu +Cc: "Serge E. Hallyn" +Cc: Sergei Trofimovich +Cc: Sergey Kvachonok +Cc: Shuah Khan +Cc: Tony Vroon +Cc: Christoph Hellwig +Link: http://lkml.kernel.org/r/20200610154923.27510-4-mcgrof@kernel.org +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/test_kmod.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/test_kmod.c b/lib/test_kmod.c +index 9cf77628fc913..87a0cc750ea23 100644 +--- a/lib/test_kmod.c ++++ b/lib/test_kmod.c +@@ -745,7 +745,7 @@ static int trigger_config_run_type(struct kmod_test_device *test_dev, + break; + case TEST_KMOD_FS_TYPE: + kfree_const(config->test_fs); +- config->test_driver = NULL; ++ config->test_fs = NULL; + copied = config_copy_test_fs(config, test_str, + strlen(test_str)); + break; +-- +2.25.1 + diff --git a/queue-5.4/tools-build-feature-quote-cc-and-cxx-for-their-argum.patch b/queue-5.4/tools-build-feature-quote-cc-and-cxx-for-their-argum.patch new file mode 100644 index 00000000000..dc5b5245e17 --- /dev/null +++ b/queue-5.4/tools-build-feature-quote-cc-and-cxx-for-their-argum.patch @@ -0,0 +1,93 @@ +From 3457977328e90c084be84ff8a5355b37202e6eb7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Aug 2020 17:15:17 -0500 +Subject: tools build feature: Quote CC and CXX for their arguments +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel Díaz + +[ Upstream commit fa5c893181ed2ca2f96552f50073786d2cfce6c0 ] + +When using a cross-compilation environment, such as OpenEmbedded, +the CC an CXX variables are set to something more than just a +command: there are arguments (such as --sysroot) that need to be +passed on to the compiler so that the right set of headers and +libraries are used. + +For the particular case that our systems detected, CC is set to +the following: + + export CC="aarch64-linaro-linux-gcc --sysroot=/oe/build/tmp/work/machine/perf/1.0-r9/recipe-sysroot" + +Without quotes, detection is as follows: + + Auto-detecting system features: + ... dwarf: [ OFF ] + ... dwarf_getlocations: [ OFF ] + ... glibc: [ OFF ] + ... gtk2: [ OFF ] + ... libbfd: [ OFF ] + ... libcap: [ OFF ] + ... libelf: [ OFF ] + ... libnuma: [ OFF ] + ... numa_num_possible_cpus: [ OFF ] + ... libperl: [ OFF ] + ... libpython: [ OFF ] + ... libcrypto: [ OFF ] + ... libunwind: [ OFF ] + ... libdw-dwarf-unwind: [ OFF ] + ... zlib: [ OFF ] + ... lzma: [ OFF ] + ... get_cpuid: [ OFF ] + ... bpf: [ OFF ] + ... libaio: [ OFF ] + ... libzstd: [ OFF ] + ... disassembler-four-args: [ OFF ] + + Makefile.config:414: *** No gnu/libc-version.h found, please install glibc-dev[el]. Stop. + Makefile.perf:230: recipe for target 'sub-make' failed + make[1]: *** [sub-make] Error 2 + Makefile:69: recipe for target 'all' failed + make: *** [all] Error 2 + +With CC and CXX quoted, some of those features are now detected. + +Fixes: e3232c2f39ac ("tools build feature: Use CC and CXX from parent") +Signed-off-by: Daniel Díaz +Reviewed-by: Thomas Hebb +Cc: Alexei Starovoitov +Cc: Andrii Nakryiko +Cc: Daniel Borkmann +Cc: Jiri Olsa +Cc: John Fastabend +Cc: KP Singh +Cc: Martin KaFai Lau +Cc: Namhyung Kim +Cc: Song Liu +Cc: Stephane Eranian +Cc: Yonghong Song +Link: http://lore.kernel.org/lkml/20200812221518.2869003-1-daniel.diaz@linaro.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/Makefile.feature | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature +index e80a1a8e287f8..8c6e1ea67f213 100644 +--- a/tools/build/Makefile.feature ++++ b/tools/build/Makefile.feature +@@ -8,7 +8,7 @@ endif + + feature_check = $(eval $(feature_check_code)) + define feature_check_code +- feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC=$(CC) CXX=$(CXX) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) ++ feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC="$(CC)" CXX="$(CXX)" CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) + endef + + feature_set = $(eval $(feature_set_code)) +-- +2.25.1 + diff --git a/queue-5.4/tools-build-feature-use-cc-and-cxx-from-parent.patch b/queue-5.4/tools-build-feature-use-cc-and-cxx-from-parent.patch new file mode 100644 index 00000000000..754bd616b36 --- /dev/null +++ b/queue-5.4/tools-build-feature-use-cc-and-cxx-from-parent.patch @@ -0,0 +1,91 @@ +From 1b5ff808c322cf3bcaa0350e6a0121ce5b1ee9d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Jul 2020 21:08:14 -0700 +Subject: tools build feature: Use CC and CXX from parent + +From: Thomas Hebb + +[ Upstream commit e3232c2f39acafd5a29128425bc30b9884642cfa ] + +commit c8c188679ccf ("tools build: Use the same CC for feature detection +and actual build") changed these assignments from unconditional (:=) to +conditional (?=) so that they wouldn't clobber values from the +environment. However, conditional assignment does not work properly for +variables that Make implicitly sets, among which are CC and CXX. To +quote tools/scripts/Makefile.include, which handles this properly: + + # Makefiles suck: This macro sets a default value of $(2) for the + # variable named by $(1), unless the variable has been set by + # environment or command line. This is necessary for CC and AR + # because make sets default values, so the simpler ?= approach + # won't work as expected. + +In other words, the conditional assignments will not run even if the +variables are not overridden in the environment; Make will set CC to +"cc" and CXX to "g++" when it starts[1], meaning the variables are not +empty by the time the conditional assignments are evaluated. This breaks +cross-compilation when CROSS_COMPILE is set but CC isn't, since "cc" +gets used for feature detection instead of the cross compiler (and +likewise for CXX). + +To fix the issue, just pass down the values of CC and CXX computed by +the parent Makefile, which gets included by the Makefile that actually +builds whatever we're detecting features for and so is guaranteed to +have good values. This is a better solution anyway, since it means we +aren't trying to replicate the logic of the parent build system and so +don't risk it getting out of sync. + +Leave PKG_CONFIG alone, since 1) there's no common logic to compute it +in Makefile.include, and 2) it's not an implicit variable, so +conditional assignment works properly. + +[1] https://www.gnu.org/software/make/manual/html_node/Implicit-Variables.html + +Fixes: c8c188679ccf ("tools build: Use the same CC for feature detection and actual build") +Signed-off-by: Thomas Hebb +Acked-by: Jiri Olsa +Cc: David Carrillo-Cisneros +Cc: Ian Rogers +Cc: Igor Lubashev +Cc: Namhyung Kim +Cc: Quentin Monnet +Cc: Song Liu +Cc: Stephane Eranian +Cc: thomas hebb +Link: http://lore.kernel.org/lkml/0a6e69d1736b0fa231a648f50b0cce5d8a6734ef.1595822871.git.tommyhebb@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/build/Makefile.feature | 2 +- + tools/build/feature/Makefile | 2 -- + 2 files changed, 1 insertion(+), 3 deletions(-) + +diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature +index 8a19753cc26aa..e80a1a8e287f8 100644 +--- a/tools/build/Makefile.feature ++++ b/tools/build/Makefile.feature +@@ -8,7 +8,7 @@ endif + + feature_check = $(eval $(feature_check_code)) + define feature_check_code +- feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) ++ feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC=$(CC) CXX=$(CXX) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0) + endef + + feature_set = $(eval $(feature_set_code)) +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 8499385365c02..054e09ab4a9e4 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -70,8 +70,6 @@ FILES= \ + + FILES := $(addprefix $(OUTPUT),$(FILES)) + +-CC ?= $(CROSS_COMPILE)gcc +-CXX ?= $(CROSS_COMPILE)g++ + PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config + LLVM_CONFIG ?= llvm-config + +-- +2.25.1 + diff --git a/queue-5.4/ubifs-fix-wrong-orphan-node-deletion-in-ubifs_jnl_up.patch b/queue-5.4/ubifs-fix-wrong-orphan-node-deletion-in-ubifs_jnl_up.patch new file mode 100644 index 00000000000..95e37c7bc6c --- /dev/null +++ b/queue-5.4/ubifs-fix-wrong-orphan-node-deletion-in-ubifs_jnl_up.patch @@ -0,0 +1,86 @@ +From ee6f089268436b4a2ac77f64fc8e7baad2deea14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jul 2020 20:51:40 +0800 +Subject: ubifs: Fix wrong orphan node deletion in ubifs_jnl_update|rename + +From: Zhihao Cheng + +[ Upstream commit 094b6d1295474f338201b846a1f15e72eb0b12cf ] + +There a wrong orphan node deleting in error handling path in +ubifs_jnl_update() and ubifs_jnl_rename(), which may cause +following error msg: + + UBIFS error (ubi0:0 pid 1522): ubifs_delete_orphan [ubifs]: + missing orphan ino 65 + +Fix this by checking whether the node has been operated for +adding to orphan list before being deleted, + +Signed-off-by: Zhihao Cheng +Fixes: 823838a486888cf484e ("ubifs: Add hashes to the tree node cache") +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/journal.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c +index 826dad0243dcc..a6ae2428e4c96 100644 +--- a/fs/ubifs/journal.c ++++ b/fs/ubifs/journal.c +@@ -539,7 +539,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, + const struct fscrypt_name *nm, const struct inode *inode, + int deletion, int xent) + { +- int err, dlen, ilen, len, lnum, ino_offs, dent_offs; ++ int err, dlen, ilen, len, lnum, ino_offs, dent_offs, orphan_added = 0; + int aligned_dlen, aligned_ilen, sync = IS_DIRSYNC(dir); + int last_reference = !!(deletion && inode->i_nlink == 0); + struct ubifs_inode *ui = ubifs_inode(inode); +@@ -630,6 +630,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, + goto out_finish; + } + ui->del_cmtno = c->cmt_no; ++ orphan_added = 1; + } + + err = write_head(c, BASEHD, dent, len, &lnum, &dent_offs, sync); +@@ -702,7 +703,7 @@ int ubifs_jnl_update(struct ubifs_info *c, const struct inode *dir, + kfree(dent); + out_ro: + ubifs_ro_mode(c, err); +- if (last_reference) ++ if (orphan_added) + ubifs_delete_orphan(c, inode->i_ino); + finish_reservation(c); + return err; +@@ -1217,7 +1218,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, + void *p; + union ubifs_key key; + struct ubifs_dent_node *dent, *dent2; +- int err, dlen1, dlen2, ilen, lnum, offs, len; ++ int err, dlen1, dlen2, ilen, lnum, offs, len, orphan_added = 0; + int aligned_dlen1, aligned_dlen2, plen = UBIFS_INO_NODE_SZ; + int last_reference = !!(new_inode && new_inode->i_nlink == 0); + int move = (old_dir != new_dir); +@@ -1333,6 +1334,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, + goto out_finish; + } + new_ui->del_cmtno = c->cmt_no; ++ orphan_added = 1; + } + + err = write_head(c, BASEHD, dent, len, &lnum, &offs, sync); +@@ -1414,7 +1416,7 @@ int ubifs_jnl_rename(struct ubifs_info *c, const struct inode *old_dir, + release_head(c, BASEHD); + out_ro: + ubifs_ro_mode(c, err); +- if (last_reference) ++ if (orphan_added) + ubifs_delete_orphan(c, new_inode->i_ino); + out_finish: + finish_reservation(c); +-- +2.25.1 + diff --git a/queue-5.4/usb-serial-ftdi_sio-clean-up-receive-processing.patch b/queue-5.4/usb-serial-ftdi_sio-clean-up-receive-processing.patch new file mode 100644 index 00000000000..0d3e7c00f24 --- /dev/null +++ b/queue-5.4/usb-serial-ftdi_sio-clean-up-receive-processing.patch @@ -0,0 +1,75 @@ +From bc76f0d858ff877d5908a8e84c777d3cfd6dc5c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jul 2020 14:49:52 +0200 +Subject: USB: serial: ftdi_sio: clean up receive processing + +From: Johan Hovold + +[ Upstream commit ce054039ba5e47b75a3be02a00274e52b06a6456 ] + +Clean up receive processing by dropping the character pointer and +keeping the length argument unchanged throughout the function. + +Also make it more apparent that sysrq processing can consume a +characters by adding an explicit continue. + +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/ftdi_sio.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 96b9e2768ac5c..33f1cca7eaa61 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -2483,7 +2483,6 @@ static int ftdi_process_packet(struct usb_serial_port *port, + struct ftdi_private *priv, unsigned char *buf, int len) + { + unsigned char status; +- unsigned char *ch; + int i; + char flag; + +@@ -2526,8 +2525,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, + else + priv->transmit_empty = 0; + +- len -= 2; +- if (!len) ++ if (len == 2) + return 0; /* status only */ + + /* +@@ -2556,19 +2554,20 @@ static int ftdi_process_packet(struct usb_serial_port *port, + } + } + +- port->icount.rx += len; +- ch = buf + 2; ++ port->icount.rx += len - 2; + + if (port->port.console && port->sysrq) { +- for (i = 0; i < len; i++, ch++) { +- if (!usb_serial_handle_sysrq_char(port, *ch)) +- tty_insert_flip_char(&port->port, *ch, flag); ++ for (i = 2; i < len; i++) { ++ if (usb_serial_handle_sysrq_char(port, buf[i])) ++ continue; ++ tty_insert_flip_char(&port->port, buf[i], flag); + } + } else { +- tty_insert_flip_string_fixed_flag(&port->port, ch, flag, len); ++ tty_insert_flip_string_fixed_flag(&port->port, buf + 2, flag, ++ len - 2); + } + +- return len; ++ return len - 2; + } + + static void ftdi_process_read_urb(struct urb *urb) +-- +2.25.1 + diff --git a/queue-5.4/usb-serial-ftdi_sio-fix-break-and-sysrq-handling.patch b/queue-5.4/usb-serial-ftdi_sio-fix-break-and-sysrq-handling.patch new file mode 100644 index 00000000000..427e4dca839 --- /dev/null +++ b/queue-5.4/usb-serial-ftdi_sio-fix-break-and-sysrq-handling.patch @@ -0,0 +1,87 @@ +From 3b8d18c85b3304ff5e5b281c1ad216da1c105c2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jul 2020 14:49:53 +0200 +Subject: USB: serial: ftdi_sio: fix break and sysrq handling + +From: Johan Hovold + +[ Upstream commit 733fff67941dad64b8a630450b8372b1873edc41 ] + +Only the last NUL in a packet should be flagged as a break character, +for example, to avoid dropping unrelated characters when IGNBRK is set. + +Also make sysrq work by consuming the break character instead of having +it immediately cancel the sysrq request, and by not processing it +prematurely to avoid triggering a sysrq based on an unrelated character +received in the same packet (which was received *before* the break). + +Note that the break flag can be left set also for a packet received +immediately following a break and that and an ending NUL in such a +packet will continue to be reported as a break as there's no good way to +tell it apart from an actual break. + +Tested on FT232R and FT232H. + +Fixes: 72fda3ca6fc1 ("USB: serial: ftd_sio: implement sysrq handling on break") +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/ftdi_sio.c | 24 +++++++++++++++++------- + 1 file changed, 17 insertions(+), 7 deletions(-) + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 33f1cca7eaa61..07b146d7033a6 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -2483,6 +2483,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, + struct ftdi_private *priv, unsigned char *buf, int len) + { + unsigned char status; ++ bool brkint = false; + int i; + char flag; + +@@ -2534,13 +2535,17 @@ static int ftdi_process_packet(struct usb_serial_port *port, + */ + flag = TTY_NORMAL; + if (buf[1] & FTDI_RS_ERR_MASK) { +- /* Break takes precedence over parity, which takes precedence +- * over framing errors */ +- if (buf[1] & FTDI_RS_BI) { +- flag = TTY_BREAK; ++ /* ++ * Break takes precedence over parity, which takes precedence ++ * over framing errors. Note that break is only associated ++ * with the last character in the buffer and only when it's a ++ * NUL. ++ */ ++ if (buf[1] & FTDI_RS_BI && buf[len - 1] == '\0') { + port->icount.brk++; +- usb_serial_handle_break(port); +- } else if (buf[1] & FTDI_RS_PE) { ++ brkint = true; ++ } ++ if (buf[1] & FTDI_RS_PE) { + flag = TTY_PARITY; + port->icount.parity++; + } else if (buf[1] & FTDI_RS_FE) { +@@ -2556,8 +2561,13 @@ static int ftdi_process_packet(struct usb_serial_port *port, + + port->icount.rx += len - 2; + +- if (port->port.console && port->sysrq) { ++ if (brkint || (port->port.console && port->sysrq)) { + for (i = 2; i < len; i++) { ++ if (brkint && i == len - 1) { ++ if (usb_serial_handle_break(port)) ++ return len - 3; ++ flag = TTY_BREAK; ++ } + if (usb_serial_handle_sysrq_char(port, buf[i])) + continue; + tty_insert_flip_char(&port->port, buf[i], flag); +-- +2.25.1 + diff --git a/queue-5.4/usb-serial-ftdi_sio-make-process-packet-buffer-unsig.patch b/queue-5.4/usb-serial-ftdi_sio-make-process-packet-buffer-unsig.patch new file mode 100644 index 00000000000..b4a147d3c60 --- /dev/null +++ b/queue-5.4/usb-serial-ftdi_sio-make-process-packet-buffer-unsig.patch @@ -0,0 +1,96 @@ +From 63f197a419a92fb828ffe7d1308aff3cf482646e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Jul 2020 14:49:51 +0200 +Subject: USB: serial: ftdi_sio: make process-packet buffer unsigned + +From: Johan Hovold + +[ Upstream commit ab4cc4ef6724ea588e835fc1e764c4b4407a70b7 ] + +Use an unsigned type for the process-packet buffer argument and give it +a more apt name. + +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Johan Hovold +Signed-off-by: Sasha Levin +--- + drivers/usb/serial/ftdi_sio.c | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index 9ad44a96dfe3a..96b9e2768ac5c 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -2480,12 +2480,12 @@ static int ftdi_prepare_write_buffer(struct usb_serial_port *port, + #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE) + + static int ftdi_process_packet(struct usb_serial_port *port, +- struct ftdi_private *priv, char *packet, int len) ++ struct ftdi_private *priv, unsigned char *buf, int len) + { ++ unsigned char status; ++ unsigned char *ch; + int i; +- char status; + char flag; +- char *ch; + + if (len < 2) { + dev_dbg(&port->dev, "malformed packet\n"); +@@ -2495,7 +2495,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, + /* Compare new line status to the old one, signal if different/ + N.B. packet may be processed more than once, but differences + are only processed once. */ +- status = packet[0] & FTDI_STATUS_B0_MASK; ++ status = buf[0] & FTDI_STATUS_B0_MASK; + if (status != priv->prev_status) { + char diff_status = status ^ priv->prev_status; + +@@ -2521,7 +2521,7 @@ static int ftdi_process_packet(struct usb_serial_port *port, + } + + /* save if the transmitter is empty or not */ +- if (packet[1] & FTDI_RS_TEMT) ++ if (buf[1] & FTDI_RS_TEMT) + priv->transmit_empty = 1; + else + priv->transmit_empty = 0; +@@ -2535,29 +2535,29 @@ static int ftdi_process_packet(struct usb_serial_port *port, + * data payload to avoid over-reporting. + */ + flag = TTY_NORMAL; +- if (packet[1] & FTDI_RS_ERR_MASK) { ++ if (buf[1] & FTDI_RS_ERR_MASK) { + /* Break takes precedence over parity, which takes precedence + * over framing errors */ +- if (packet[1] & FTDI_RS_BI) { ++ if (buf[1] & FTDI_RS_BI) { + flag = TTY_BREAK; + port->icount.brk++; + usb_serial_handle_break(port); +- } else if (packet[1] & FTDI_RS_PE) { ++ } else if (buf[1] & FTDI_RS_PE) { + flag = TTY_PARITY; + port->icount.parity++; +- } else if (packet[1] & FTDI_RS_FE) { ++ } else if (buf[1] & FTDI_RS_FE) { + flag = TTY_FRAME; + port->icount.frame++; + } + /* Overrun is special, not associated with a char */ +- if (packet[1] & FTDI_RS_OE) { ++ if (buf[1] & FTDI_RS_OE) { + port->icount.overrun++; + tty_insert_flip_char(&port->port, 0, TTY_OVERRUN); + } + } + + port->icount.rx += len; +- ch = packet + 2; ++ ch = buf + 2; + + if (port->port.console && port->sysrq) { + for (i = 0; i < len; i++, ch++) { +-- +2.25.1 + diff --git a/queue-5.4/watchdog-initialize-device-before-misc_register.patch b/queue-5.4/watchdog-initialize-device-before-misc_register.patch new file mode 100644 index 00000000000..e6ca717f9c8 --- /dev/null +++ b/queue-5.4/watchdog-initialize-device-before-misc_register.patch @@ -0,0 +1,119 @@ +From f7a8c1b4a5caf20af947f48218324838fb30e250 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Jul 2020 12:31:09 +0200 +Subject: watchdog: initialize device before misc_register + +From: Krzysztof Sobota + +[ Upstream commit cb36e29bb0e4b0c33c3d5866a0a4aebace4c99b7 ] + +When watchdog device is being registered, it calls misc_register that +makes watchdog available for systemd to open. This is a data race +scenario, because when device is open it may still have device struct +not initialized - this in turn causes a crash. This patch moves +device initialization before misc_register call and it solves the +problem printed below. + +------------[ cut here ]------------ +WARNING: CPU: 3 PID: 1 at lib/kobject.c:612 kobject_get+0x50/0x54 +kobject: '(null)' ((ptrval)): is not initialized, yet kobject_get() is being called. +Modules linked in: k2_reset_status(O) davinci_wdt(+) sfn_platform_hwbcn(O) fsmddg_sfn(O) clk_misc_mmap(O) clk_sw_bcn(O) fsp_reset(O) cma_mod(O) slave_sup_notif(O) fpga_master(O) latency(O+) evnotify(O) enable_arm_pmu(O) xge(O) rio_mport_cdev br_netfilter bridge stp llc nvrd_checksum(O) ipv6 +CPU: 3 PID: 1 Comm: systemd Tainted: G O 4.19.113-g2579778-fsm4_k2 #1 +Hardware name: Keystone +[] (unwind_backtrace) from [] (show_stack+0x18/0x1c) +[] (show_stack) from [] (dump_stack+0xb4/0xe8) +[] (dump_stack) from [] (__warn+0xfc/0x114) +[] (__warn) from [] (warn_slowpath_fmt+0x50/0x74) +[] (warn_slowpath_fmt) from [] (kobject_get+0x50/0x54) +[] (kobject_get) from [] (get_device+0x1c/0x24) +[] (get_device) from [] (watchdog_open+0x90/0xf0) +[] (watchdog_open) from [] (misc_open+0x130/0x17c) +[] (misc_open) from [] (chrdev_open+0xec/0x1a8) +[] (chrdev_open) from [] (do_dentry_open+0x204/0x3cc) +[] (do_dentry_open) from [] (path_openat+0x330/0x1148) +[] (path_openat) from [] (do_filp_open+0x78/0xec) +[] (do_filp_open) from [] (do_sys_open+0x130/0x1f4) +[] (do_sys_open) from [] (ret_fast_syscall+0x0/0x28) +Exception stack(0xd2ceffa8 to 0xd2cefff0) +ffa0: b6f69968 00000000 ffffff9c b6ebd210 000a0001 00000000 +ffc0: b6f69968 00000000 00000000 00000142 fffffffd ffffffff 00b65530 bed7bb78 +ffe0: 00000142 bed7ba70 b6cc2503 b6cc41d6 +---[ end trace 7b16eb105513974f ]--- + +------------[ cut here ]------------ +WARNING: CPU: 3 PID: 1 at lib/refcount.c:153 kobject_get+0x24/0x54 +refcount_t: increment on 0; use-after-free. +Modules linked in: k2_reset_status(O) davinci_wdt(+) sfn_platform_hwbcn(O) fsmddg_sfn(O) clk_misc_mmap(O) clk_sw_bcn(O) fsp_reset(O) cma_mod(O) slave_sup_notif(O) fpga_master(O) latency(O+) evnotify(O) enable_arm_pmu(O) xge(O) rio_mport_cdev br_netfilter bridge stp llc nvrd_checksum(O) ipv6 +CPU: 3 PID: 1 Comm: systemd Tainted: G W O 4.19.113-g2579778-fsm4_k2 #1 +Hardware name: Keystone +[] (unwind_backtrace) from [] (show_stack+0x18/0x1c) +[] (show_stack) from [] (dump_stack+0xb4/0xe8) +[] (dump_stack) from [] (__warn+0xfc/0x114) +[] (__warn) from [] (warn_slowpath_fmt+0x50/0x74) +[] (warn_slowpath_fmt) from [] (kobject_get+0x24/0x54) +[] (kobject_get) from [] (get_device+0x1c/0x24) +[] (get_device) from [] (watchdog_open+0x90/0xf0) +[] (watchdog_open) from [] (misc_open+0x130/0x17c) +[] (misc_open) from [] (chrdev_open+0xec/0x1a8) +[] (chrdev_open) from [] (do_dentry_open+0x204/0x3cc) +[] (do_dentry_open) from [] (path_openat+0x330/0x1148) +[] (path_openat) from [] (do_filp_open+0x78/0xec) +[] (do_filp_open) from [] (do_sys_open+0x130/0x1f4) +[] (do_sys_open) from [] (ret_fast_syscall+0x0/0x28) +Exception stack(0xd2ceffa8 to 0xd2cefff0) +ffa0: b6f69968 00000000 ffffff9c b6ebd210 000a0001 00000000 +ffc0: b6f69968 00000000 00000000 00000142 fffffffd ffffffff 00b65530 bed7bb78 +ffe0: 00000142 bed7ba70 b6cc2503 b6cc41d6 +---[ end trace 7b16eb1055139750 ]--- + +Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev") +Reviewed-by: Guenter Roeck +Reviewed-by: Alexander Sverdlin +Signed-off-by: Krzysztof Sobota +Link: https://lore.kernel.org/r/20200717103109.14660-1-krzysztof.sobota@nokia.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/watchdog_dev.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index c4147e93aa7d4..3729f99fd8eca 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -974,6 +974,15 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) + if (IS_ERR_OR_NULL(watchdog_kworker)) + return -ENODEV; + ++ device_initialize(&wd_data->dev); ++ wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); ++ wd_data->dev.class = &watchdog_class; ++ wd_data->dev.parent = wdd->parent; ++ wd_data->dev.groups = wdd->groups; ++ wd_data->dev.release = watchdog_core_data_release; ++ dev_set_drvdata(&wd_data->dev, wdd); ++ dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); ++ + kthread_init_work(&wd_data->work, watchdog_ping_work); + hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD); + wd_data->timer.function = watchdog_timer_expired; +@@ -994,15 +1003,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd) + } + } + +- device_initialize(&wd_data->dev); +- wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id); +- wd_data->dev.class = &watchdog_class; +- wd_data->dev.parent = wdd->parent; +- wd_data->dev.groups = wdd->groups; +- wd_data->dev.release = watchdog_core_data_release; +- dev_set_drvdata(&wd_data->dev, wdd); +- dev_set_name(&wd_data->dev, "watchdog%d", wdd->id); +- + /* Fill in the data structures */ + cdev_init(&wd_data->cdev, &watchdog_fops); + +-- +2.25.1 + diff --git a/queue-5.4/x86-tsr-fix-tsc-frequency-enumeration-bug-on-lightni.patch b/queue-5.4/x86-tsr-fix-tsc-frequency-enumeration-bug-on-lightni.patch new file mode 100644 index 00000000000..9ea1c4db805 --- /dev/null +++ b/queue-5.4/x86-tsr-fix-tsc-frequency-enumeration-bug-on-lightni.patch @@ -0,0 +1,54 @@ +From 406c10dafaa29ae46900fb7b4fbc8178180cadfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Aug 2020 15:56:36 +0800 +Subject: x86/tsr: Fix tsc frequency enumeration bug on Lightning Mountain SoC + +From: Dilip Kota + +[ Upstream commit 7d98585860d845e36ee612832a5ff021f201dbaf ] + +Frequency descriptor of Lightning Mountain SoC doesn't have all the +frequency entries so resulting in the below failure causing a kernel hang: + + Error MSR_FSB_FREQ index 15 is unknown + tsc: Fast TSC calibration failed + +So, add all the frequency entries in the Lightning Mountain SoC frequency +descriptor. + +Fixes: 0cc5359d8fd45 ("x86/cpu: Update init data for new Airmont CPU model") +Fixes: 812c2d7506fd ("x86/tsc_msr: Use named struct initializers") +Signed-off-by: Dilip Kota +Signed-off-by: Ingo Molnar +Reviewed-by: Andy Shevchenko +Link: https://lore.kernel.org/r/211c643ae217604b46cbec43a2c0423946dc7d2d.1596440057.git.eswara.kota@linux.intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/tsc_msr.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c +index c65adaf813848..41200706e6da1 100644 +--- a/arch/x86/kernel/tsc_msr.c ++++ b/arch/x86/kernel/tsc_msr.c +@@ -133,10 +133,15 @@ static const struct freq_desc freq_desc_ann = { + .mask = 0x0f, + }; + +-/* 24 MHz crystal? : 24 * 13 / 4 = 78 MHz */ ++/* ++ * 24 MHz crystal? : 24 * 13 / 4 = 78 MHz ++ * Frequency step for Lightning Mountain SoC is fixed to 78 MHz, ++ * so all the frequency entries are 78000. ++ */ + static const struct freq_desc freq_desc_lgm = { + .use_msr_plat = true, +- .freqs = { 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000 }, ++ .freqs = { 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000, ++ 78000, 78000, 78000, 78000, 78000, 78000, 78000, 78000 }, + .mask = 0x0f, + }; + +-- +2.25.1 +