From: Sasha Levin Date: Fri, 11 Jun 2021 02:13:07 +0000 (-0400) Subject: Fixes for 5.12 X-Git-Tag: v4.4.273~60 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c99efadac42935e00ba9dcc08b9de5b8a567a15d;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.12 Signed-off-by: Sasha Levin --- diff --git a/queue-5.12/asoc-amd-fix-for-pcm_read-error.patch b/queue-5.12/asoc-amd-fix-for-pcm_read-error.patch new file mode 100644 index 00000000000..cd1ebdc99d0 --- /dev/null +++ b/queue-5.12/asoc-amd-fix-for-pcm_read-error.patch @@ -0,0 +1,117 @@ +From e5c030ba12713f0d1e0bf01a1281afcf66af88cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 01:53:31 +0530 +Subject: ASoC: amd: fix for pcm_read() error + +From: Vijendar Mukunda + +[ Upstream commit 6879e8e759bf9e05eaee85e32ca1a936e6b46da1 ] + +Below phython script throwing pcm_read() error. + +import subprocess + +p = subprocess.Popen(["aplay -t raw -D plughw:1,0 /dev/zero"], shell=True) +subprocess.call(["arecord -Dhw:1,0 --dump-hw-params"], shell=True) +subprocess.call(["arecord -Dhw:1,0 -fdat -d1 /dev/null"], shell=True) +p.kill() + +Handling ACP global external interrupt enable register +causing this issue. +This register got updated wrongly when there is active +stream causing interrupts disabled for active stream. +Refactored code to handle enabling and disabling external interrupts. + +Signed-off-by: Vijendar Mukunda +Link: https://lore.kernel.org/r/1619555017-29858-1-git-send-email-Vijendar.Mukunda@amd.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/raven/acp3x-pcm-dma.c | 10 ---------- + sound/soc/amd/raven/acp3x.h | 1 + + sound/soc/amd/raven/pci-acp3x.c | 15 +++++++++++++++ + 3 files changed, 16 insertions(+), 10 deletions(-) + +diff --git a/sound/soc/amd/raven/acp3x-pcm-dma.c b/sound/soc/amd/raven/acp3x-pcm-dma.c +index 417cda24030c..2447a1e6e913 100644 +--- a/sound/soc/amd/raven/acp3x-pcm-dma.c ++++ b/sound/soc/amd/raven/acp3x-pcm-dma.c +@@ -237,10 +237,6 @@ static int acp3x_dma_open(struct snd_soc_component *component, + return ret; + } + +- if (!adata->play_stream && !adata->capture_stream && +- !adata->i2ssp_play_stream && !adata->i2ssp_capture_stream) +- rv_writel(1, adata->acp3x_base + mmACP_EXTERNAL_INTR_ENB); +- + i2s_data->acp3x_base = adata->acp3x_base; + runtime->private_data = i2s_data; + return ret; +@@ -367,12 +363,6 @@ static int acp3x_dma_close(struct snd_soc_component *component, + } + } + +- /* Disable ACP irq, when the current stream is being closed and +- * another stream is also not active. +- */ +- if (!adata->play_stream && !adata->capture_stream && +- !adata->i2ssp_play_stream && !adata->i2ssp_capture_stream) +- rv_writel(0, adata->acp3x_base + mmACP_EXTERNAL_INTR_ENB); + return 0; + } + +diff --git a/sound/soc/amd/raven/acp3x.h b/sound/soc/amd/raven/acp3x.h +index 03fe93913e12..c3f0c8b7545d 100644 +--- a/sound/soc/amd/raven/acp3x.h ++++ b/sound/soc/amd/raven/acp3x.h +@@ -77,6 +77,7 @@ + #define ACP_POWER_OFF_IN_PROGRESS 0x03 + + #define ACP3x_ITER_IRER_SAMP_LEN_MASK 0x38 ++#define ACP_EXT_INTR_STAT_CLEAR_MASK 0xFFFFFFFF + + struct acp3x_platform_info { + u16 play_i2s_instance; +diff --git a/sound/soc/amd/raven/pci-acp3x.c b/sound/soc/amd/raven/pci-acp3x.c +index d3536fd6a124..a013a607b3d4 100644 +--- a/sound/soc/amd/raven/pci-acp3x.c ++++ b/sound/soc/amd/raven/pci-acp3x.c +@@ -76,6 +76,19 @@ static int acp3x_reset(void __iomem *acp3x_base) + return -ETIMEDOUT; + } + ++static void acp3x_enable_interrupts(void __iomem *acp_base) ++{ ++ rv_writel(0x01, acp_base + mmACP_EXTERNAL_INTR_ENB); ++} ++ ++static void acp3x_disable_interrupts(void __iomem *acp_base) ++{ ++ rv_writel(ACP_EXT_INTR_STAT_CLEAR_MASK, acp_base + ++ mmACP_EXTERNAL_INTR_STAT); ++ rv_writel(0x00, acp_base + mmACP_EXTERNAL_INTR_CNTL); ++ rv_writel(0x00, acp_base + mmACP_EXTERNAL_INTR_ENB); ++} ++ + static int acp3x_init(struct acp3x_dev_data *adata) + { + void __iomem *acp3x_base = adata->acp3x_base; +@@ -93,6 +106,7 @@ static int acp3x_init(struct acp3x_dev_data *adata) + pr_err("ACP3x reset failed\n"); + return ret; + } ++ acp3x_enable_interrupts(acp3x_base); + return 0; + } + +@@ -100,6 +114,7 @@ static int acp3x_deinit(void __iomem *acp3x_base) + { + int ret; + ++ acp3x_disable_interrupts(acp3x_base); + /* Reset */ + ret = acp3x_reset(acp3x_base); + if (ret) { +-- +2.30.2 + diff --git a/queue-5.12/asoc-codecs-lpass-rx-macro-add-missing-module_device.patch b/queue-5.12/asoc-codecs-lpass-rx-macro-add-missing-module_device.patch new file mode 100644 index 00000000000..f0806874abe --- /dev/null +++ b/queue-5.12/asoc-codecs-lpass-rx-macro-add-missing-module_device.patch @@ -0,0 +1,34 @@ +From b2ca74273bf7ef397d90432482841a82d4617a63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 May 2021 11:38:44 +0100 +Subject: ASoC: codecs: lpass-rx-macro: add missing MODULE_DEVICE_TABLE + +From: Srinivas Kandagatla + +[ Upstream commit d4335d058f8430a0ce2b43dab9531f3a3cf9fe2c ] + +Fix module loading by adding missing MODULE_DEVICE_TABLE. + +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20210510103844.1532-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-rx-macro.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/lpass-rx-macro.c b/sound/soc/codecs/lpass-rx-macro.c +index 7878da89d8e0..b7b9c891e2f0 100644 +--- a/sound/soc/codecs/lpass-rx-macro.c ++++ b/sound/soc/codecs/lpass-rx-macro.c +@@ -3581,6 +3581,7 @@ static const struct of_device_id rx_macro_dt_match[] = { + { .compatible = "qcom,sm8250-lpass-rx-macro" }, + { } + }; ++MODULE_DEVICE_TABLE(of, rx_macro_dt_match); + + static struct platform_driver rx_macro_driver = { + .driver = { +-- +2.30.2 + diff --git a/queue-5.12/asoc-codecs-lpass-tx-macro-add-missing-module_device.patch b/queue-5.12/asoc-codecs-lpass-tx-macro-add-missing-module_device.patch new file mode 100644 index 00000000000..af685f05e5b --- /dev/null +++ b/queue-5.12/asoc-codecs-lpass-tx-macro-add-missing-module_device.patch @@ -0,0 +1,38 @@ +From 43ce06f19d7b04d98f115d84a8e3ed8c0ec5eebc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:15:12 +0800 +Subject: ASoC: codecs: lpass-tx-macro: add missing MODULE_DEVICE_TABLE + +From: Bixuan Cui + +[ Upstream commit 14c0c423746fe7232a093a68809a4bc6233eed60 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Bixuan Cui +Reviewed-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20210508031512.53783-1-cuibixuan@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/lpass-tx-macro.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/lpass-tx-macro.c b/sound/soc/codecs/lpass-tx-macro.c +index e8c6c738bbaa..5341ca02951c 100644 +--- a/sound/soc/codecs/lpass-tx-macro.c ++++ b/sound/soc/codecs/lpass-tx-macro.c +@@ -1846,6 +1846,7 @@ static const struct of_device_id tx_macro_dt_match[] = { + { .compatible = "qcom,sm8250-lpass-tx-macro" }, + { } + }; ++MODULE_DEVICE_TABLE(of, tx_macro_dt_match); + static struct platform_driver tx_macro_driver = { + .driver = { + .name = "tx_macro", +-- +2.30.2 + diff --git a/queue-5.12/asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch b/queue-5.12/asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch new file mode 100644 index 00000000000..73ed7ce23aa --- /dev/null +++ b/queue-5.12/asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch @@ -0,0 +1,47 @@ +From a2ad4e872459125d1799a8f99d3158788cd879f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 17:01:45 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Glavey TM800A550L tablet + +From: Hans de Goede + +[ Upstream commit 28c268d3acdd4cbcd2ac320b85609e77f84e74a7 ] + +Add a quirk for the Glavey TM800A550L tablet, this BYTCR tablet has no CHAN +package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which +is the default for BYTCR devices. + +Signed-off-by: Hans de Goede +Acked-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210508150146.28403-1-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index 22912cab5e63..f18932b3d31b 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -574,6 +574,17 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_SSP0_AIF1 | + BYT_RT5640_MCLK_EN), + }, ++ { /* Glavey TM800A550L */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"), ++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"), ++ /* Above strings are too generic, also match on BIOS version */ ++ DMI_MATCH(DMI_BIOS_VERSION, "ZY-8-BI-PX4S70VTR400-X423B-005-D"), ++ }, ++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), +-- +2.30.2 + diff --git a/queue-5.12/asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch b/queue-5.12/asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch new file mode 100644 index 00000000000..f599a30cc17 --- /dev/null +++ b/queue-5.12/asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch @@ -0,0 +1,49 @@ +From 1e5c3676c07f902134e45858bed81fcc9c053fa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 17:01:46 +0200 +Subject: ASoC: Intel: bytcr_rt5640: Add quirk for the Lenovo Miix 3-830 tablet + +From: Hans de Goede + +[ Upstream commit f0353e1f53f92f7b3da91e6669f5d58ee222ebe8 ] + +The Lenovo Miix 3-830 tablet has only 1 speaker, has an internal analog +mic on IN1 and uses JD2 for jack-detect, add a quirk to automatically +apply these settings on Lenovo Miix 3-830 tablets. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20210508150146.28403-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/bytcr_rt5640.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c +index f18932b3d31b..cc24e89a7f8d 100644 +--- a/sound/soc/intel/boards/bytcr_rt5640.c ++++ b/sound/soc/intel/boards/bytcr_rt5640.c +@@ -663,6 +663,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = { + BYT_RT5640_MONO_SPEAKER | + BYT_RT5640_MCLK_EN), + }, ++ { /* Lenovo Miix 3-830 */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_VERSION, "Lenovo MIIX 3-830"), ++ }, ++ .driver_data = (void *)(BYT_RT5640_IN1_MAP | ++ BYT_RT5640_JD_SRC_JD2_IN4N | ++ BYT_RT5640_OVCD_TH_2000UA | ++ BYT_RT5640_OVCD_SF_0P75 | ++ BYT_RT5640_MONO_SPEAKER | ++ BYT_RT5640_DIFF_MIC | ++ BYT_RT5640_SSP0_AIF1 | ++ BYT_RT5640_MCLK_EN), ++ }, + { /* Linx Linx7 tablet */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "LINX"), +-- +2.30.2 + diff --git a/queue-5.12/asoc-max98088-fix-ni-clock-divider-calculation.patch b/queue-5.12/asoc-max98088-fix-ni-clock-divider-calculation.patch new file mode 100644 index 00000000000..6b325e49e38 --- /dev/null +++ b/queue-5.12/asoc-max98088-fix-ni-clock-divider-calculation.patch @@ -0,0 +1,88 @@ +From 07821bb9b4ca53fbaf151a50bdff9d74c4e03862 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 15:54:02 +0200 +Subject: ASoC: max98088: fix ni clock divider calculation + +From: Marco Felsch + +[ Upstream commit 6c9762a78c325107dc37d20ee21002b841679209 ] + +The ni1/ni2 ratio formula [1] uses the pclk which is the prescaled mclk. +The max98088 datasheet [2] has no such formula but table-12 equals so +we can assume that it is the same for both devices. + +While on it make use of DIV_ROUND_CLOSEST_ULL(). + +[1] https://datasheets.maximintegrated.com/en/ds/MAX98089.pdf; page 86 +[2] https://datasheets.maximintegrated.com/en/ds/MAX98088.pdf; page 82 + +Signed-off-by: Marco Felsch +Link: https://lore.kernel.org/r/20210423135402.32105-1-m.felsch@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/max98088.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/max98088.c b/sound/soc/codecs/max98088.c +index 4be24e7f51c8..f8e49e45ce33 100644 +--- a/sound/soc/codecs/max98088.c ++++ b/sound/soc/codecs/max98088.c +@@ -41,6 +41,7 @@ struct max98088_priv { + enum max98088_type devtype; + struct max98088_pdata *pdata; + struct clk *mclk; ++ unsigned char mclk_prescaler; + unsigned int sysclk; + struct max98088_cdata dai[2]; + int eq_textcnt; +@@ -998,13 +999,16 @@ static int max98088_dai1_hw_params(struct snd_pcm_substream *substream, + /* Configure NI when operating as master */ + if (snd_soc_component_read(component, M98088_REG_14_DAI1_FORMAT) + & M98088_DAI_MAS) { ++ unsigned long pclk; ++ + if (max98088->sysclk == 0) { + dev_err(component->dev, "Invalid system clock frequency\n"); + return -EINVAL; + } + ni = 65536ULL * (rate < 50000 ? 96ULL : 48ULL) + * (unsigned long long int)rate; +- do_div(ni, (unsigned long long int)max98088->sysclk); ++ pclk = DIV_ROUND_CLOSEST(max98088->sysclk, max98088->mclk_prescaler); ++ ni = DIV_ROUND_CLOSEST_ULL(ni, pclk); + snd_soc_component_write(component, M98088_REG_12_DAI1_CLKCFG_HI, + (ni >> 8) & 0x7F); + snd_soc_component_write(component, M98088_REG_13_DAI1_CLKCFG_LO, +@@ -1065,13 +1069,16 @@ static int max98088_dai2_hw_params(struct snd_pcm_substream *substream, + /* Configure NI when operating as master */ + if (snd_soc_component_read(component, M98088_REG_1C_DAI2_FORMAT) + & M98088_DAI_MAS) { ++ unsigned long pclk; ++ + if (max98088->sysclk == 0) { + dev_err(component->dev, "Invalid system clock frequency\n"); + return -EINVAL; + } + ni = 65536ULL * (rate < 50000 ? 96ULL : 48ULL) + * (unsigned long long int)rate; +- do_div(ni, (unsigned long long int)max98088->sysclk); ++ pclk = DIV_ROUND_CLOSEST(max98088->sysclk, max98088->mclk_prescaler); ++ ni = DIV_ROUND_CLOSEST_ULL(ni, pclk); + snd_soc_component_write(component, M98088_REG_1A_DAI2_CLKCFG_HI, + (ni >> 8) & 0x7F); + snd_soc_component_write(component, M98088_REG_1B_DAI2_CLKCFG_LO, +@@ -1113,8 +1120,10 @@ static int max98088_dai_set_sysclk(struct snd_soc_dai *dai, + */ + if ((freq >= 10000000) && (freq < 20000000)) { + snd_soc_component_write(component, M98088_REG_10_SYS_CLK, 0x10); ++ max98088->mclk_prescaler = 1; + } else if ((freq >= 20000000) && (freq < 30000000)) { + snd_soc_component_write(component, M98088_REG_10_SYS_CLK, 0x20); ++ max98088->mclk_prescaler = 2; + } else { + dev_err(component->dev, "Invalid master clock frequency\n"); + return -EINVAL; +-- +2.30.2 + diff --git a/queue-5.12/asoc-sti-sas-add-missing-module_device_table.patch b/queue-5.12/asoc-sti-sas-add-missing-module_device_table.patch new file mode 100644 index 00000000000..f25ea6a9efc --- /dev/null +++ b/queue-5.12/asoc-sti-sas-add-missing-module_device_table.patch @@ -0,0 +1,37 @@ +From 5dfff3073e6ec3b80ed9fdaf618f1fad7b240289 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 11:12:25 +0800 +Subject: ASoC: sti-sas: add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit e072b2671606c77538d6a4dd5dda80b508cb4816 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Link: https://lore.kernel.org/r/1620789145-14936-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/sti-sas.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/sti-sas.c b/sound/soc/codecs/sti-sas.c +index ec9933b054ad..423daac9d5a9 100644 +--- a/sound/soc/codecs/sti-sas.c ++++ b/sound/soc/codecs/sti-sas.c +@@ -411,6 +411,7 @@ static const struct of_device_id sti_sas_dev_match[] = { + }, + {}, + }; ++MODULE_DEVICE_TABLE(of, sti_sas_dev_match); + + static int sti_sas_driver_probe(struct platform_device *pdev) + { +-- +2.30.2 + diff --git a/queue-5.12/bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch b/queue-5.12/bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch new file mode 100644 index 00000000000..101c81ed8be --- /dev/null +++ b/queue-5.12/bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch @@ -0,0 +1,41 @@ +From 1932c55f66b37c22b1c6d68da56f74a3b2799dae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 19:00:12 +0800 +Subject: bnx2x: Fix missing error code in bnx2x_iov_init_one() + +From: Jiapeng Chong + +[ Upstream commit 65161c35554f7135e6656b3df1ce2c500ca0bdcf ] + +Eliminate the follow smatch warning: + +drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c:1227 +bnx2x_iov_init_one() warn: missing error code 'err'. + +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +index 9c2f51f23035..9108b497b3c9 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c +@@ -1224,8 +1224,10 @@ int bnx2x_iov_init_one(struct bnx2x *bp, int int_mode_param, + goto failed; + + /* SR-IOV capability was enabled but there are no VFs*/ +- if (iov->total == 0) ++ if (iov->total == 0) { ++ err = -EINVAL; + goto failed; ++ } + + iov->nr_virtfn = min_t(u16, iov->total, num_vfs_param); + +-- +2.30.2 + diff --git a/queue-5.12/bonding-init-notify_work-earlier-to-avoid-uninitiali.patch b/queue-5.12/bonding-init-notify_work-earlier-to-avoid-uninitiali.patch new file mode 100644 index 00000000000..75462e29b14 --- /dev/null +++ b/queue-5.12/bonding-init-notify_work-earlier-to-avoid-uninitiali.patch @@ -0,0 +1,53 @@ +From 90306b14c3e88b5f3175978539cf7e566a3b7e7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:13:35 +0200 +Subject: bonding: init notify_work earlier to avoid uninitialized use + +From: Johannes Berg + +[ Upstream commit 35d96e631860226d5dc4de0fad0a415362ec2457 ] + +If bond_kobj_init() or later kzalloc() in bond_alloc_slave() fail, +then we call kobject_put() on the slave->kobj. This in turn calls +the release function slave_kobj_release() which will always try to +cancel_delayed_work_sync(&slave->notify_work), which shouldn't be +done on an uninitialized work struct. + +Always initialize the work struct earlier to avoid problems here. + +Syzbot bisected this down to a completely pointless commit, some +fault injection may have been at work here that caused the alloc +failure in the first place, which may interact badly with bisect. + +Reported-by: syzbot+bfda097c12a00c8cae67@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Acked-by: Jay Vosburgh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 74cbbb22470b..fa4bf727a48d 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1526,6 +1526,7 @@ static struct slave *bond_alloc_slave(struct bonding *bond, + + slave->bond = bond; + slave->dev = slave_dev; ++ INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); + + if (bond_kobj_init(slave)) + return NULL; +@@ -1538,7 +1539,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond, + return NULL; + } + } +- INIT_DELAYED_WORK(&slave->notify_work, bond_netdev_notify_work); + + return slave; + } +-- +2.30.2 + diff --git a/queue-5.12/bpf-add-deny-list-of-btf-ids-check-for-tracing-progr.patch b/queue-5.12/bpf-add-deny-list-of-btf-ids-check-for-tracing-progr.patch new file mode 100644 index 00000000000..437af9b184a --- /dev/null +++ b/queue-5.12/bpf-add-deny-list-of-btf-ids-check-for-tracing-progr.patch @@ -0,0 +1,88 @@ +From dd89b406366ef3f8011057bdc24831fad63d130e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 13:47:12 +0200 +Subject: bpf: Add deny list of btf ids check for tracing programs + +From: Jiri Olsa + +[ Upstream commit 35e3815fa8102fab4dee75f3547472c66581125d ] + +The recursion check in __bpf_prog_enter and __bpf_prog_exit +leaves some (not inlined) functions unprotected: + +In __bpf_prog_enter: + - migrate_disable is called before prog->active is checked + +In __bpf_prog_exit: + - migrate_enable,rcu_read_unlock_strict are called after + prog->active is decreased + +When attaching trampoline to them we get panic like: + + traps: PANIC: double fault, error_code: 0x0 + double fault: 0000 [#1] SMP PTI + RIP: 0010:__bpf_prog_enter+0x4/0x50 + ... + Call Trace: + + bpf_trampoline_6442466513_0+0x18/0x1000 + migrate_disable+0x5/0x50 + __bpf_prog_enter+0x9/0x50 + bpf_trampoline_6442466513_0+0x18/0x1000 + migrate_disable+0x5/0x50 + __bpf_prog_enter+0x9/0x50 + bpf_trampoline_6442466513_0+0x18/0x1000 + migrate_disable+0x5/0x50 + __bpf_prog_enter+0x9/0x50 + bpf_trampoline_6442466513_0+0x18/0x1000 + migrate_disable+0x5/0x50 + ... + +Fixing this by adding deny list of btf ids for tracing +programs and checking btf id during program verification. +Adding above functions to this list. + +Suggested-by: Alexei Starovoitov +Signed-off-by: Jiri Olsa +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20210429114712.43783-1-jolsa@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/bpf/verifier.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index b186d852fe3d..9e600767803b 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -12556,6 +12556,17 @@ int bpf_check_attach_target(struct bpf_verifier_log *log, + return 0; + } + ++BTF_SET_START(btf_id_deny) ++BTF_ID_UNUSED ++#ifdef CONFIG_SMP ++BTF_ID(func, migrate_disable) ++BTF_ID(func, migrate_enable) ++#endif ++#if !defined CONFIG_PREEMPT_RCU && !defined CONFIG_TINY_RCU ++BTF_ID(func, rcu_read_unlock_strict) ++#endif ++BTF_SET_END(btf_id_deny) ++ + static int check_attach_btf_id(struct bpf_verifier_env *env) + { + struct bpf_prog *prog = env->prog; +@@ -12615,6 +12626,9 @@ static int check_attach_btf_id(struct bpf_verifier_env *env) + ret = bpf_lsm_verify_prog(&env->log, prog); + if (ret < 0) + return ret; ++ } else if (prog->type == BPF_PROG_TYPE_TRACING && ++ btf_id_set_contains(&btf_id_deny, btf_id)) { ++ return -EINVAL; + } + + key = bpf_trampoline_compute_key(tgt_prog, prog->aux->attach_btf, btf_id); +-- +2.30.2 + diff --git a/queue-5.12/bpf-forbid-trampoline-attach-for-functions-with-vari.patch b/queue-5.12/bpf-forbid-trampoline-attach-for-functions-with-vari.patch new file mode 100644 index 00000000000..189d0901174 --- /dev/null +++ b/queue-5.12/bpf-forbid-trampoline-attach-for-functions-with-vari.patch @@ -0,0 +1,62 @@ +From b95e0a80aad6679526049c25dc7bf18d5fc30c09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 15:25:29 +0200 +Subject: bpf: Forbid trampoline attach for functions with variable arguments + +From: Jiri Olsa + +[ Upstream commit 31379397dcc364a59ce764fabb131b645c43e340 ] + +We can't currently allow to attach functions with variable arguments. +The problem is that we should save all the registers for arguments, +which is probably doable, but if caller uses more than 6 arguments, +we need stack data, which will be wrong, because of the extra stack +frame we do in bpf trampoline, so we could crash. + +Also currently there's malformed trampoline code generated for such +functions at the moment as described in: + + https://lore.kernel.org/bpf/20210429212834.82621-1-jolsa@kernel.org/ + +Signed-off-by: Jiri Olsa +Signed-off-by: Daniel Borkmann +Acked-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20210505132529.401047-1-jolsa@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/bpf/btf.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c +index b1a76fe046cb..6bd003568fa5 100644 +--- a/kernel/bpf/btf.c ++++ b/kernel/bpf/btf.c +@@ -5126,6 +5126,12 @@ int btf_distill_func_proto(struct bpf_verifier_log *log, + m->ret_size = ret; + + for (i = 0; i < nargs; i++) { ++ if (i == nargs - 1 && args[i].type == 0) { ++ bpf_log(log, ++ "The function %s with variable args is unsupported.\n", ++ tname); ++ return -EINVAL; ++ } + ret = __get_type_size(btf, args[i].type, &t); + if (ret < 0) { + bpf_log(log, +@@ -5133,6 +5139,12 @@ int btf_distill_func_proto(struct bpf_verifier_log *log, + tname, i, btf_kind_str[BTF_INFO_KIND(t->info)]); + return -EINVAL; + } ++ if (ret == 0) { ++ bpf_log(log, ++ "The function %s has malformed void argument.\n", ++ tname); ++ return -EINVAL; ++ } + m->arg_size[i] = ret; + } + m->nr_args = nargs; +-- +2.30.2 + diff --git a/queue-5.12/bpf-selftests-adjust-few-selftest-result_unpriv-outc.patch b/queue-5.12/bpf-selftests-adjust-few-selftest-result_unpriv-outc.patch new file mode 100644 index 00000000000..1c493c6d804 --- /dev/null +++ b/queue-5.12/bpf-selftests-adjust-few-selftest-result_unpriv-outc.patch @@ -0,0 +1,77 @@ +From 09178b949179888852883c47c72867889e7057e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 08:58:25 +0000 +Subject: bpf, selftests: Adjust few selftest result_unpriv outcomes + +From: Daniel Borkmann + +[ Upstream commit 1bad6fd52be4ce12d207e2820ceb0f29ab31fc53 ] + +Given we don't need to simulate the speculative domain for registers with +immediates anymore since the verifier uses direct imm-based rewrites instead +of having to mask, we can also lift a few cases that were previously rejected. + +Signed-off-by: Daniel Borkmann +Acked-by: Alexei Starovoitov +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/verifier/stack_ptr.c | 2 -- + tools/testing/selftests/bpf/verifier/value_ptr_arith.c | 8 -------- + 2 files changed, 10 deletions(-) + +diff --git a/tools/testing/selftests/bpf/verifier/stack_ptr.c b/tools/testing/selftests/bpf/verifier/stack_ptr.c +index 07eaa04412ae..8ab94d65f3d5 100644 +--- a/tools/testing/selftests/bpf/verifier/stack_ptr.c ++++ b/tools/testing/selftests/bpf/verifier/stack_ptr.c +@@ -295,8 +295,6 @@ + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_1, 0), + BPF_EXIT_INSN(), + }, +- .result_unpriv = REJECT, +- .errstr_unpriv = "invalid write to stack R1 off=0 size=1", + .result = ACCEPT, + .retval = 42, + }, +diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c +index e5913fd3b903..7ae2859d495c 100644 +--- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c ++++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c +@@ -300,8 +300,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +@@ -371,8 +369,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +@@ -472,8 +468,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +@@ -766,8 +760,6 @@ + }, + .fixup_map_array_48b = { 3 }, + .result = ACCEPT, +- .result_unpriv = REJECT, +- .errstr_unpriv = "R0 pointer arithmetic of map value goes out of range", + .retval = 1, + }, + { +-- +2.30.2 + diff --git a/queue-5.12/cgroup-disable-controllers-at-parse-time.patch b/queue-5.12/cgroup-disable-controllers-at-parse-time.patch new file mode 100644 index 00000000000..ff28a220e92 --- /dev/null +++ b/queue-5.12/cgroup-disable-controllers-at-parse-time.patch @@ -0,0 +1,75 @@ +From fc4dccf7ba130f233ef4647d7c9d788520880a41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 13:19:46 -0700 +Subject: cgroup: disable controllers at parse time +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Shakeel Butt + +[ Upstream commit 45e1ba40837ac2f6f4d4716bddb8d44bd7e4a251 ] + +This patch effectively reverts the commit a3e72739b7a7 ("cgroup: fix +too early usage of static_branch_disable()"). The commit 6041186a3258 +("init: initialize jump labels before command line option parsing") has +moved the jump_label_init() before parse_args() which has made the +commit a3e72739b7a7 unnecessary. On the other hand there are +consequences of disabling the controllers later as there are subsystems +doing the controller checks for different decisions. One such incident +is reported [1] regarding the memory controller and its impact on memory +reclaim code. + +[1] https://lore.kernel.org/linux-mm/921e53f3-4b13-aab8-4a9e-e83ff15371e4@nec.com + +Signed-off-by: Shakeel Butt +Reported-by: NOMURA JUNICHI(野村　淳一) +Signed-off-by: Tejun Heo +Tested-by: Jun'ichi Nomura +Signed-off-by: Sasha Levin +--- + kernel/cgroup/cgroup.c | 13 +++++-------- + 1 file changed, 5 insertions(+), 8 deletions(-) + +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 9153b20e5cc6..2529d1f88330 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -5626,8 +5626,6 @@ int __init cgroup_init_early(void) + return 0; + } + +-static u16 cgroup_disable_mask __initdata; +- + /** + * cgroup_init - cgroup initialization + * +@@ -5686,12 +5684,8 @@ int __init cgroup_init(void) + * disabled flag and cftype registration needs kmalloc, + * both of which aren't available during early_init. + */ +- if (cgroup_disable_mask & (1 << ssid)) { +- static_branch_disable(cgroup_subsys_enabled_key[ssid]); +- printk(KERN_INFO "Disabling %s control group subsystem\n", +- ss->name); ++ if (!cgroup_ssid_enabled(ssid)) + continue; +- } + + if (cgroup1_ssid_disabled(ssid)) + printk(KERN_INFO "Disabling %s control group subsystem in v1 mounts\n", +@@ -6206,7 +6200,10 @@ static int __init cgroup_disable(char *str) + if (strcmp(token, ss->name) && + strcmp(token, ss->legacy_name)) + continue; +- cgroup_disable_mask |= 1 << i; ++ ++ static_branch_disable(cgroup_subsys_enabled_key[i]); ++ pr_info("Disabling %s control group subsystem\n", ++ ss->name); + } + } + return 1; +-- +2.30.2 + diff --git a/queue-5.12/dm-verity-fix-require_signatures-module_param-permis.patch b/queue-5.12/dm-verity-fix-require_signatures-module_param-permis.patch new file mode 100644 index 00000000000..c74dc8f6fcc --- /dev/null +++ b/queue-5.12/dm-verity-fix-require_signatures-module_param-permis.patch @@ -0,0 +1,43 @@ +From f8a1d41c53d3bf7e11f7a68dc057efcc6a684ffc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 12:14:21 +0100 +Subject: dm verity: fix require_signatures module_param permissions + +From: John Keeping + +[ Upstream commit 0c1f3193b1cdd21e7182f97dc9bca7d284d18a15 ] + +The third parameter of module_param() is permissions for the sysfs node +but it looks like it is being used as the initial value of the parameter +here. In fact, false here equates to omitting the file from sysfs and +does not affect the value of require_signatures. + +Making the parameter writable is not simple because going from +false->true is fine but it should not be possible to remove the +requirement to verify a signature. But it can be useful to inspect the +value of this parameter from userspace, so change the permissions to +make a read-only file in sysfs. + +Signed-off-by: John Keeping +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-verity-verify-sig.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-verity-verify-sig.c b/drivers/md/dm-verity-verify-sig.c +index 29385dc470d5..db61a1f43ae9 100644 +--- a/drivers/md/dm-verity-verify-sig.c ++++ b/drivers/md/dm-verity-verify-sig.c +@@ -15,7 +15,7 @@ + #define DM_VERITY_VERIFY_ERR(s) DM_VERITY_ROOT_HASH_VERIFICATION " " s + + static bool require_signatures; +-module_param(require_signatures, bool, false); ++module_param(require_signatures, bool, 0444); + MODULE_PARM_DESC(require_signatures, + "Verify the roothash of dm-verity hash tree"); + +-- +2.30.2 + diff --git a/queue-5.12/i2c-mpc-implement-erratum-a-004447-workaround.patch b/queue-5.12/i2c-mpc-implement-erratum-a-004447-workaround.patch new file mode 100644 index 00000000000..622e3df201c --- /dev/null +++ b/queue-5.12/i2c-mpc-implement-erratum-a-004447-workaround.patch @@ -0,0 +1,148 @@ +From 53b26d41d8f40a640d322f49c30d0cc700a7e105 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 09:20:52 +1200 +Subject: i2c: mpc: implement erratum A-004447 workaround + +From: Chris Packham + +[ Upstream commit drivers/i2c/busses/i2c-mpc.c ] + +The P2040/P2041 has an erratum where the normal i2c recovery mechanism +does not work. Implement the alternative recovery mechanism documented +in the P2040 Chip Errata Rev Q. + +Signed-off-by: Chris Packham +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mpc.c | 79 +++++++++++++++++++++++++++++++++++- + 1 file changed, 78 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c +index 6a0d55e9e8e3..af349661fd76 100644 +--- a/drivers/i2c/busses/i2c-mpc.c ++++ b/drivers/i2c/busses/i2c-mpc.c +@@ -23,6 +23,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -49,6 +50,7 @@ + #define CCR_MTX 0x10 + #define CCR_TXAK 0x08 + #define CCR_RSTA 0x04 ++#define CCR_RSVD 0x02 + + #define CSR_MCF 0x80 + #define CSR_MAAS 0x40 +@@ -70,6 +72,7 @@ struct mpc_i2c { + u8 fdr, dfsrr; + #endif + struct clk *clk_per; ++ bool has_errata_A004447; + }; + + struct mpc_i2c_divider { +@@ -176,6 +179,75 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing) + return 0; + } + ++static int i2c_mpc_wait_sr(struct mpc_i2c *i2c, int mask) ++{ ++ void __iomem *addr = i2c->base + MPC_I2C_SR; ++ u8 val; ++ ++ return readb_poll_timeout(addr, val, val & mask, 0, 100); ++} ++ ++/* ++ * Workaround for Erratum A004447. From the P2040CE Rev Q ++ * ++ * 1. Set up the frequency divider and sampling rate. ++ * 2. I2CCR - a0h ++ * 3. Poll for I2CSR[MBB] to get set. ++ * 4. If I2CSR[MAL] is set (an indication that SDA is stuck low), then go to ++ * step 5. If MAL is not set, then go to step 13. ++ * 5. I2CCR - 00h ++ * 6. I2CCR - 22h ++ * 7. I2CCR - a2h ++ * 8. Poll for I2CSR[MBB] to get set. ++ * 9. Issue read to I2CDR. ++ * 10. Poll for I2CSR[MIF] to be set. ++ * 11. I2CCR - 82h ++ * 12. Workaround complete. Skip the next steps. ++ * 13. Issue read to I2CDR. ++ * 14. Poll for I2CSR[MIF] to be set. ++ * 15. I2CCR - 80h ++ */ ++static void mpc_i2c_fixup_A004447(struct mpc_i2c *i2c) ++{ ++ int ret; ++ u32 val; ++ ++ writeccr(i2c, CCR_MEN | CCR_MSTA); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MBB); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MBB\n"); ++ return; ++ } ++ ++ val = readb(i2c->base + MPC_I2C_SR); ++ ++ if (val & CSR_MAL) { ++ writeccr(i2c, 0x00); ++ writeccr(i2c, CCR_MSTA | CCR_RSVD); ++ writeccr(i2c, CCR_MEN | CCR_MSTA | CCR_RSVD); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MBB); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MBB\n"); ++ return; ++ } ++ val = readb(i2c->base + MPC_I2C_DR); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MIF); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MIF\n"); ++ return; ++ } ++ writeccr(i2c, CCR_MEN | CCR_RSVD); ++ } else { ++ val = readb(i2c->base + MPC_I2C_DR); ++ ret = i2c_mpc_wait_sr(i2c, CSR_MIF); ++ if (ret) { ++ dev_err(i2c->dev, "timeout waiting for CSR_MIF\n"); ++ return; ++ } ++ writeccr(i2c, CCR_MEN); ++ } ++} ++ + #if defined(CONFIG_PPC_MPC52xx) || defined(CONFIG_PPC_MPC512x) + static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = { + {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23}, +@@ -641,7 +713,10 @@ static int fsl_i2c_bus_recovery(struct i2c_adapter *adap) + { + struct mpc_i2c *i2c = i2c_get_adapdata(adap); + +- mpc_i2c_fixup(i2c); ++ if (i2c->has_errata_A004447) ++ mpc_i2c_fixup_A004447(i2c); ++ else ++ mpc_i2c_fixup(i2c); + + return 0; + } +@@ -745,6 +820,8 @@ static int fsl_i2c_probe(struct platform_device *op) + dev_info(i2c->dev, "timeout %u us\n", mpc_ops.timeout * 1000000 / HZ); + + platform_set_drvdata(op, i2c); ++ if (of_property_read_bool(op->dev.of_node, "fsl,i2c-erratum-a004447")) ++ i2c->has_errata_A004447 = true; + + i2c->adap = mpc_ops; + of_address_to_resource(op->dev.of_node, 0, &res); +-- +2.30.2 + diff --git a/queue-5.12/i2c-mpc-make-use-of-i2c_recover_bus.patch b/queue-5.12/i2c-mpc-make-use-of-i2c_recover_bus.patch new file mode 100644 index 00000000000..01ca2e535d8 --- /dev/null +++ b/queue-5.12/i2c-mpc-make-use-of-i2c_recover_bus.patch @@ -0,0 +1,81 @@ +From fba131d424bc746952c34a922296408a1bb78168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 29 Mar 2021 14:52:03 +1300 +Subject: i2c: mpc: Make use of i2c_recover_bus() + +From: Chris Packham + +[ Upstream commit 65171b2df15eb7545431d75c2729b5062da89b43 ] + +Move the existing calls of mpc_i2c_fixup() to a recovery function +registered via bus_recovery_info. This makes it more obvious that +recovery is supported and allows for a future where recovery is +triggered by the i2c core. + +Signed-off-by: Chris Packham +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mpc.c | 18 ++++++++++++++++-- + 1 file changed, 16 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c +index d94f05c8b8b7..6a0d55e9e8e3 100644 +--- a/drivers/i2c/busses/i2c-mpc.c ++++ b/drivers/i2c/busses/i2c-mpc.c +@@ -586,7 +586,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) { + writeb(status & ~CSR_MAL, + i2c->base + MPC_I2C_SR); +- mpc_i2c_fixup(i2c); ++ i2c_recover_bus(&i2c->adap); + } + return -EIO; + } +@@ -622,7 +622,7 @@ static int mpc_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) + if ((status & (CSR_MCF | CSR_MBB | CSR_RXAK)) != 0) { + writeb(status & ~CSR_MAL, + i2c->base + MPC_I2C_SR); +- mpc_i2c_fixup(i2c); ++ i2c_recover_bus(&i2c->adap); + } + return -EIO; + } +@@ -637,6 +637,15 @@ static u32 mpc_functionality(struct i2c_adapter *adap) + | I2C_FUNC_SMBUS_READ_BLOCK_DATA | I2C_FUNC_SMBUS_BLOCK_PROC_CALL; + } + ++static int fsl_i2c_bus_recovery(struct i2c_adapter *adap) ++{ ++ struct mpc_i2c *i2c = i2c_get_adapdata(adap); ++ ++ mpc_i2c_fixup(i2c); ++ ++ return 0; ++} ++ + static const struct i2c_algorithm mpc_algo = { + .master_xfer = mpc_xfer, + .functionality = mpc_functionality, +@@ -648,6 +657,10 @@ static struct i2c_adapter mpc_ops = { + .timeout = HZ, + }; + ++static struct i2c_bus_recovery_info fsl_i2c_recovery_info = { ++ .recover_bus = fsl_i2c_bus_recovery, ++}; ++ + static const struct of_device_id mpc_i2c_of_match[]; + static int fsl_i2c_probe(struct platform_device *op) + { +@@ -740,6 +753,7 @@ static int fsl_i2c_probe(struct platform_device *op) + i2c_set_adapdata(&i2c->adap, i2c); + i2c->adap.dev.parent = &op->dev; + i2c->adap.dev.of_node = of_node_get(op->dev.of_node); ++ i2c->adap.bus_recovery_info = &fsl_i2c_recovery_info; + + result = i2c_add_adapter(&i2c->adap); + if (result < 0) +-- +2.30.2 + diff --git a/queue-5.12/isdn-misdn-netjet-fix-crash-in-nj_probe.patch b/queue-5.12/isdn-misdn-netjet-fix-crash-in-nj_probe.patch new file mode 100644 index 00000000000..ba266f64173 --- /dev/null +++ b/queue-5.12/isdn-misdn-netjet-fix-crash-in-nj_probe.patch @@ -0,0 +1,168 @@ +From 78a4f0004635415deb29601f324cf68431d363c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 May 2021 07:11:40 +0000 +Subject: isdn: mISDN: netjet: Fix crash in nj_probe: + +From: Zheyu Ma + +[ Upstream commit 9f6f852550d0e1b7735651228116ae9d300f69b3 ] + +'nj_setup' in netjet.c might fail with -EIO and in this case +'card->irq' is initialized and is bigger than zero. A subsequent call to +'nj_release' will free the irq that has not been requested. + +Fix this bug by deleting the previous assignment to 'card->irq' and just +keep the assignment before 'request_irq'. + +The KASAN's log reveals it: + +[ 3.354615 ] WARNING: CPU: 0 PID: 1 at kernel/irq/manage.c:1826 +free_irq+0x100/0x480 +[ 3.355112 ] Modules linked in: +[ 3.355310 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted +5.13.0-rc1-00144-g25a1298726e #13 +[ 3.355816 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS +rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +[ 3.356552 ] RIP: 0010:free_irq+0x100/0x480 +[ 3.356820 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18 +4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 +ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80 +[ 3.358012 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082 +[ 3.358357 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX: +0000000000000000 +[ 3.358814 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI: +00000000ffffffff +[ 3.359272 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09: +0000000000000000 +[ 3.359732 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12: +0000000000000000 +[ 3.360195 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15: +ffff888104dc80a8 +[ 3.360652 ] FS: 0000000000000000(0000) GS:ffff88817bc00000(0000) +knlGS:0000000000000000 +[ 3.361170 ] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 3.361538 ] CR2: 0000000000000000 CR3: 000000000582e000 CR4: +00000000000006f0 +[ 3.362003 ] DR0: 0000000000000000 DR1: 0000000000000000 DR2: +0000000000000000 +[ 3.362175 ] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: +0000000000000400 +[ 3.362175 ] Call Trace: +[ 3.362175 ] nj_release+0x51/0x1e0 +[ 3.362175 ] nj_probe+0x450/0x950 +[ 3.362175 ] ? pci_device_remove+0x110/0x110 +[ 3.362175 ] local_pci_probe+0x45/0xa0 +[ 3.362175 ] pci_device_probe+0x12b/0x1d0 +[ 3.362175 ] really_probe+0x2a9/0x610 +[ 3.362175 ] driver_probe_device+0x90/0x1d0 +[ 3.362175 ] ? mutex_lock_nested+0x1b/0x20 +[ 3.362175 ] device_driver_attach+0x68/0x70 +[ 3.362175 ] __driver_attach+0x124/0x1b0 +[ 3.362175 ] ? device_driver_attach+0x70/0x70 +[ 3.362175 ] bus_for_each_dev+0xbb/0x110 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] driver_attach+0x27/0x30 +[ 3.362175 ] bus_add_driver+0x1eb/0x2a0 +[ 3.362175 ] driver_register+0xa9/0x180 +[ 3.362175 ] __pci_register_driver+0x82/0x90 +[ 3.362175 ] ? w6692_init+0x38/0x38 +[ 3.362175 ] nj_init+0x36/0x38 +[ 3.362175 ] do_one_initcall+0x7f/0x3d0 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 3.362175 ] kernel_init_freeable+0x2aa/0x301 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] kernel_init+0x18/0x190 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ret_from_fork+0x1f/0x30 +[ 3.362175 ] Kernel panic - not syncing: panic_on_warn set ... +[ 3.362175 ] CPU: 0 PID: 1 Comm: swapper/0 Not tainted +5.13.0-rc1-00144-g25a1298726e #13 +[ 3.362175 ] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS +rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 +[ 3.362175 ] Call Trace: +[ 3.362175 ] dump_stack+0xba/0xf5 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] panic+0x15a/0x3f2 +[ 3.362175 ] ? __warn+0xf2/0x150 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] __warn+0x108/0x150 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] report_bug+0x119/0x1c0 +[ 3.362175 ] handle_bug+0x3b/0x80 +[ 3.362175 ] exc_invalid_op+0x18/0x70 +[ 3.362175 ] asm_exc_invalid_op+0x12/0x20 +[ 3.362175 ] RIP: 0010:free_irq+0x100/0x480 +[ 3.362175 ] Code: 6e 08 74 6f 4d 89 f4 e8 5e ac 09 00 4d 8b 74 24 18 +4d 85 f6 75 e3 e8 4f ac 09 00 8b 75 c8 48 c7 c7 78 c1 2e 85 e8 e0 cf f5 +ff <0f> 0b 48 8b 75 c0 4c 89 ff e8 72 33 0b 03 48 8b 43 40 4c 8b a0 80 +[ 3.362175 ] RSP: 0000:ffffc90000017b48 EFLAGS: 00010082 +[ 3.362175 ] RAX: 0000000000000000 RBX: ffff888104dc8000 RCX: +0000000000000000 +[ 3.362175 ] RDX: ffff8881003c8000 RSI: ffffffff8124a9e6 RDI: +00000000ffffffff +[ 3.362175 ] RBP: ffffc90000017b88 R08: 0000000000000000 R09: +0000000000000000 +[ 3.362175 ] R10: ffffc900000179f0 R11: 0000000000001d04 R12: +0000000000000000 +[ 3.362175 ] R13: ffff888107dc6000 R14: ffff888107dc6928 R15: +ffff888104dc80a8 +[ 3.362175 ] ? vprintk+0x76/0x150 +[ 3.362175 ] ? free_irq+0x100/0x480 +[ 3.362175 ] nj_release+0x51/0x1e0 +[ 3.362175 ] nj_probe+0x450/0x950 +[ 3.362175 ] ? pci_device_remove+0x110/0x110 +[ 3.362175 ] local_pci_probe+0x45/0xa0 +[ 3.362175 ] pci_device_probe+0x12b/0x1d0 +[ 3.362175 ] really_probe+0x2a9/0x610 +[ 3.362175 ] driver_probe_device+0x90/0x1d0 +[ 3.362175 ] ? mutex_lock_nested+0x1b/0x20 +[ 3.362175 ] device_driver_attach+0x68/0x70 +[ 3.362175 ] __driver_attach+0x124/0x1b0 +[ 3.362175 ] ? device_driver_attach+0x70/0x70 +[ 3.362175 ] bus_for_each_dev+0xbb/0x110 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] driver_attach+0x27/0x30 +[ 3.362175 ] bus_add_driver+0x1eb/0x2a0 +[ 3.362175 ] driver_register+0xa9/0x180 +[ 3.362175 ] __pci_register_driver+0x82/0x90 +[ 3.362175 ] ? w6692_init+0x38/0x38 +[ 3.362175 ] nj_init+0x36/0x38 +[ 3.362175 ] do_one_initcall+0x7f/0x3d0 +[ 3.362175 ] ? rdinit_setup+0x45/0x45 +[ 3.362175 ] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 3.362175 ] kernel_init_freeable+0x2aa/0x301 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] kernel_init+0x18/0x190 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ? rest_init+0x2c0/0x2c0 +[ 3.362175 ] ret_from_fork+0x1f/0x30 +[ 3.362175 ] Dumping ftrace buffer: +[ 3.362175 ] (ftrace buffer empty) +[ 3.362175 ] Kernel Offset: disabled +[ 3.362175 ] Rebooting in 1 seconds.. + +Reported-by: Zheyu Ma +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/mISDN/netjet.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/isdn/hardware/mISDN/netjet.c b/drivers/isdn/hardware/mISDN/netjet.c +index ee925b58bbce..2a1ddd47a096 100644 +--- a/drivers/isdn/hardware/mISDN/netjet.c ++++ b/drivers/isdn/hardware/mISDN/netjet.c +@@ -1100,7 +1100,6 @@ nj_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + card->typ = NETJET_S_TJ300; + + card->base = pci_resource_start(pdev, 0); +- card->irq = pdev->irq; + pci_set_drvdata(pdev, card); + err = setup_instance(card); + if (err) +-- +2.30.2 + diff --git a/queue-5.12/makefile-lto-have-linker-check-wframe-larger-than.patch b/queue-5.12/makefile-lto-have-linker-check-wframe-larger-than.patch new file mode 100644 index 00000000000..02d8fbf8191 --- /dev/null +++ b/queue-5.12/makefile-lto-have-linker-check-wframe-larger-than.patch @@ -0,0 +1,62 @@ +From c5cb3cb90978b0de588295ff0a8e7186ecb7a3e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Mar 2021 17:09:41 -0800 +Subject: Makefile: LTO: have linker check -Wframe-larger-than + +From: Nick Desaulniers + +[ Upstream commit 24845dcb170e16b3100bd49743687648c71387ae ] + +-Wframe-larger-than= requires stack frame information, which the +frontend cannot provide. This diagnostic is emitted late during +compilation once stack frame size is available. + +When building with LTO, the frontend simply lowers C to LLVM IR and does +not have stack frame information, so it cannot emit this diagnostic. +When the linker drives LTO, it restarts optimizations and lowers LLVM IR +to object code. At that point, it has stack frame information but +doesn't know to check for a specific max stack frame size. + +I consider this a bug in LLVM that we need to fix. There are some +details we're working out related to LTO such as which value to use when +there are multiple different values specified per TU, or how to +propagate these to compiler synthesized routines properly, if at all. + +Until it's fixed, ensure we don't miss these. At that point we can wrap +this in a compiler version guard or revert this based on the minimum +support version of Clang. + +The error message is not generated during link: + LTO vmlinux.o +ld.lld: warning: stack size limit exceeded (8224) in foobarbaz + +Cc: Sami Tolvanen +Reported-by: Candle Sun +Suggested-by: Fangrui Song +Signed-off-by: Nick Desaulniers +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20210312010942.1546679-1-ndesaulniers@google.com +Signed-off-by: Sasha Levin +--- + Makefile | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/Makefile b/Makefile +index ebc02c56db03..358a2b103de9 100644 +--- a/Makefile ++++ b/Makefile +@@ -912,6 +912,11 @@ CC_FLAGS_LTO += -fvisibility=hidden + + # Limit inlining across translation units to reduce binary size + KBUILD_LDFLAGS += -mllvm -import-instr-limit=5 ++ ++# Check for frame size exceeding threshold during prolog/epilog insertion. ++ifneq ($(CONFIG_FRAME_WARN),0) ++KBUILD_LDFLAGS += -plugin-opt=-warn-stack-size=$(CONFIG_FRAME_WARN) ++endif + endif + + ifdef CONFIG_LTO +-- +2.30.2 + diff --git a/queue-5.12/mips-fix-kernel-hang-under-function_graph_tracer-and.patch b/queue-5.12/mips-fix-kernel-hang-under-function_graph_tracer-and.patch new file mode 100644 index 00000000000..e5e36039ea9 --- /dev/null +++ b/queue-5.12/mips-fix-kernel-hang-under-function_graph_tracer-and.patch @@ -0,0 +1,105 @@ +From 57cfc1a7cfbc1a54bb105c137fdf816f01844aec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 19:02:01 +0800 +Subject: MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER + +From: Tiezhu Yang + +[ Upstream commit 78cf0eb926cb1abeff2106bae67752e032fe5f3e ] + +When update the latest mainline kernel with the following three configs, +the kernel hangs during startup: + +(1) CONFIG_FUNCTION_GRAPH_TRACER=y +(2) CONFIG_PREEMPT_TRACER=y +(3) CONFIG_FTRACE_STARTUP_TEST=y + +When update the latest mainline kernel with the above two configs (1) +and (2), the kernel starts normally, but it still hangs when execute +the following command: + +echo "function_graph" > /sys/kernel/debug/tracing/current_tracer + +Without CONFIG_PREEMPT_TRACER=y, the above two kinds of kernel hangs +disappeared, so it seems that CONFIG_PREEMPT_TRACER has some influences +with function_graph tracer at the first glance. + +I use ejtag to find out the epc address is related with preempt_enable() +in the file arch/mips/lib/mips-atomic.c, because function tracing can +trace the preempt_{enable,disable} calls that are traced, replace them +with preempt_{enable,disable}_notrace to prevent function tracing from +going into an infinite loop, and then it can fix the kernel hang issue. + +By the way, it seems that this commit is a complement and improvement of +commit f93a1a00f2bd ("MIPS: Fix crash that occurs when function tracing +is enabled"). + +Signed-off-by: Tiezhu Yang +Cc: Steven Rostedt +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/lib/mips-atomic.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/mips/lib/mips-atomic.c b/arch/mips/lib/mips-atomic.c +index de03838b343b..a9b72eacfc0b 100644 +--- a/arch/mips/lib/mips-atomic.c ++++ b/arch/mips/lib/mips-atomic.c +@@ -37,7 +37,7 @@ + */ + notrace void arch_local_irq_disable(void) + { +- preempt_disable(); ++ preempt_disable_notrace(); + + __asm__ __volatile__( + " .set push \n" +@@ -53,7 +53,7 @@ notrace void arch_local_irq_disable(void) + : /* no inputs */ + : "memory"); + +- preempt_enable(); ++ preempt_enable_notrace(); + } + EXPORT_SYMBOL(arch_local_irq_disable); + +@@ -61,7 +61,7 @@ notrace unsigned long arch_local_irq_save(void) + { + unsigned long flags; + +- preempt_disable(); ++ preempt_disable_notrace(); + + __asm__ __volatile__( + " .set push \n" +@@ -78,7 +78,7 @@ notrace unsigned long arch_local_irq_save(void) + : /* no inputs */ + : "memory"); + +- preempt_enable(); ++ preempt_enable_notrace(); + + return flags; + } +@@ -88,7 +88,7 @@ notrace void arch_local_irq_restore(unsigned long flags) + { + unsigned long __tmp1; + +- preempt_disable(); ++ preempt_disable_notrace(); + + __asm__ __volatile__( + " .set push \n" +@@ -106,7 +106,7 @@ notrace void arch_local_irq_restore(unsigned long flags) + : "0" (flags) + : "memory"); + +- preempt_enable(); ++ preempt_enable_notrace(); + } + EXPORT_SYMBOL(arch_local_irq_restore); + +-- +2.30.2 + diff --git a/queue-5.12/net-appletalk-cops-fix-data-race-in-cops_probe1.patch b/queue-5.12/net-appletalk-cops-fix-data-race-in-cops_probe1.patch new file mode 100644 index 00000000000..98e61bcf742 --- /dev/null +++ b/queue-5.12/net-appletalk-cops-fix-data-race-in-cops_probe1.patch @@ -0,0 +1,49 @@ +From ebabc7537463d5c73f2a600ea937a7b1fe1a00ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 19:07:12 +0530 +Subject: net: appletalk: cops: Fix data race in cops_probe1 + +From: Saubhik Mukherjee + +[ Upstream commit a4dd4fc6105e54393d637450a11d4cddb5fabc4f ] + +In cops_probe1(), there is a write to dev->base_addr after requesting an +interrupt line and registering the interrupt handler cops_interrupt(). +The handler might be called in parallel to handle an interrupt. +cops_interrupt() tries to read dev->base_addr leading to a potential +data race. So write to dev->base_addr before calling request_irq(). + +Found by Linux Driver Verification project (linuxtesting.org). + +Signed-off-by: Saubhik Mukherjee +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/appletalk/cops.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/appletalk/cops.c b/drivers/net/appletalk/cops.c +index ba8e70a8e312..6b12ce822e51 100644 +--- a/drivers/net/appletalk/cops.c ++++ b/drivers/net/appletalk/cops.c +@@ -327,6 +327,8 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr) + break; + } + ++ dev->base_addr = ioaddr; ++ + /* Reserve any actual interrupt. */ + if (dev->irq) { + retval = request_irq(dev->irq, cops_interrupt, 0, dev->name, dev); +@@ -334,8 +336,6 @@ static int __init cops_probe1(struct net_device *dev, int ioaddr) + goto err_out; + } + +- dev->base_addr = ioaddr; +- + lp = netdev_priv(dev); + spin_lock_init(&lp->lock); + +-- +2.30.2 + diff --git a/queue-5.12/net-dsa-microchip-enable-phy-errata-workaround-on-95.patch b/queue-5.12/net-dsa-microchip-enable-phy-errata-workaround-on-95.patch new file mode 100644 index 00000000000..79daa95c240 --- /dev/null +++ b/queue-5.12/net-dsa-microchip-enable-phy-errata-workaround-on-95.patch @@ -0,0 +1,35 @@ +From 15ffb76f0c36dc19862c6fc823a5555d7964da68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 15:29:53 -0500 +Subject: net: dsa: microchip: enable phy errata workaround on 9567 + +From: George McCollister + +[ Upstream commit 8c42a49738f16af0061f9ae5c2f5a955f268d9e3 ] + +Also enable phy errata workaround on 9567 since has the same errata as +the 9477 according to the manufacture's documentation. + +Signed-off-by: George McCollister +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/microchip/ksz9477.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/dsa/microchip/ksz9477.c b/drivers/net/dsa/microchip/ksz9477.c +index 55e5d479acce..854e25f43fa7 100644 +--- a/drivers/net/dsa/microchip/ksz9477.c ++++ b/drivers/net/dsa/microchip/ksz9477.c +@@ -1530,6 +1530,7 @@ static const struct ksz_chip_data ksz9477_switch_chips[] = { + .num_statics = 16, + .cpu_ports = 0x7F, /* can be configured as cpu port */ + .port_cnt = 7, /* total physical port count */ ++ .phy_errata_9477 = true, + }, + }; + +-- +2.30.2 + diff --git a/queue-5.12/net-macb-ensure-the-device-is-available-before-acces.patch b/queue-5.12/net-macb-ensure-the-device-is-available-before-acces.patch new file mode 100644 index 00000000000..bd4b49ed525 --- /dev/null +++ b/queue-5.12/net-macb-ensure-the-device-is-available-before-acces.patch @@ -0,0 +1,46 @@ +From 0c0c69fb3475f86c069afdd89c1f58637e75cf24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 May 2021 17:16:11 +0800 +Subject: net: macb: ensure the device is available before accessing GEMGXL + control registers + +From: Zong Li + +[ Upstream commit 5eff1461a6dec84f04fafa9128548bad51d96147 ] + +If runtime power menagement is enabled, the gigabit ethernet PLL would +be disabled after macb_probe(). During this period of time, the system +would hang up if we try to access GEMGXL control registers. + +We can't put runtime_pm_get/runtime_pm_put/ there due to the issue of +sleep inside atomic section (7fa2955ff70ce453 ("sh_eth: Fix sleeping +function called from invalid context"). Add netif_running checking to +ensure the device is available before accessing GEMGXL device. + +Changed in v2: + - Use netif_running instead of its own flag + +Signed-off-by: Zong Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/cadence/macb_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c +index 0f6a6cb7e98d..51b19172d63b 100644 +--- a/drivers/net/ethernet/cadence/macb_main.c ++++ b/drivers/net/ethernet/cadence/macb_main.c +@@ -2837,6 +2837,9 @@ static struct net_device_stats *gem_get_stats(struct macb *bp) + struct gem_stats *hwstat = &bp->hw_stats.gem; + struct net_device_stats *nstat = &bp->dev->stats; + ++ if (!netif_running(bp->dev)) ++ return nstat; ++ + gem_update_stats(bp); + + nstat->rx_errors = (hwstat->rx_frame_check_sequence_errors + +-- +2.30.2 + diff --git a/queue-5.12/net-mdiobus-get-rid-of-a-bug_on.patch b/queue-5.12/net-mdiobus-get-rid-of-a-bug_on.patch new file mode 100644 index 00000000000..c719adff122 --- /dev/null +++ b/queue-5.12/net-mdiobus-get-rid-of-a-bug_on.patch @@ -0,0 +1,41 @@ +From 0c3172d31b27385f1cb69347a263369271e41a24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 12:04:13 +0300 +Subject: net: mdiobus: get rid of a BUG_ON() + +From: Dan Carpenter + +[ Upstream commit 1dde47a66d4fb181830d6fa000e5ea86907b639e ] + +We spotted a bug recently during a review where a driver was +unregistering a bus that wasn't registered, which would trigger this +BUG_ON(). Let's handle that situation more gracefully, and just print +a warning and return. + +Reported-by: Russell King (Oracle) +Signed-off-by: Dan Carpenter +Reviewed-by: Russell King (Oracle) +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/mdio_bus.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c +index 823518554079..d3c916821b11 100644 +--- a/drivers/net/phy/mdio_bus.c ++++ b/drivers/net/phy/mdio_bus.c +@@ -607,7 +607,8 @@ void mdiobus_unregister(struct mii_bus *bus) + struct mdio_device *mdiodev; + int i; + +- BUG_ON(bus->state != MDIOBUS_REGISTERED); ++ if (WARN_ON_ONCE(bus->state != MDIOBUS_REGISTERED)) ++ return; + bus->state = MDIOBUS_UNREGISTERED; + + for (i = 0; i < PHY_MAX_ADDR; i++) { +-- +2.30.2 + diff --git a/queue-5.12/net-nfc-rawsock.c-fix-a-permission-check-bug.patch b/queue-5.12/net-nfc-rawsock.c-fix-a-permission-check-bug.patch new file mode 100644 index 00000000000..414df91b818 --- /dev/null +++ b/queue-5.12/net-nfc-rawsock.c-fix-a-permission-check-bug.patch @@ -0,0 +1,34 @@ +From 7ca31b569b02664a7dc8e90a31a3ef95cd50d4ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:52:30 +0800 +Subject: net/nfc/rawsock.c: fix a permission check bug + +From: Jeimon + +[ Upstream commit 8ab78863e9eff11910e1ac8bcf478060c29b379e ] + +The function rawsock_create() calls a privileged function sk_alloc(), which requires a ns-aware check to check net->user_ns, i.e., ns_capable(). However, the original code checks the init_user_ns using capable(). So we replace the capable() with ns_capable(). + +Signed-off-by: Jeimon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/nfc/rawsock.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/nfc/rawsock.c b/net/nfc/rawsock.c +index 9c7eb8455ba8..5f1d438a0a23 100644 +--- a/net/nfc/rawsock.c ++++ b/net/nfc/rawsock.c +@@ -329,7 +329,7 @@ static int rawsock_create(struct net *net, struct socket *sock, + return -ESOCKTNOSUPPORT; + + if (sock->type == SOCK_RAW) { +- if (!capable(CAP_NET_RAW)) ++ if (!ns_capable(net->user_ns, CAP_NET_RAW)) + return -EPERM; + sock->ops = &rawsock_raw_ops; + } else { +-- +2.30.2 + diff --git a/queue-5.12/net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch b/queue-5.12/net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch new file mode 100644 index 00000000000..f8c12afbefb --- /dev/null +++ b/queue-5.12/net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch @@ -0,0 +1,108 @@ +From 6ac81a9d6a7174e0fa6c3b1411c3c607bdde7274 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 12:32:36 +0000 +Subject: net/qla3xxx: fix schedule while atomic in ql_sem_spinlock + +From: Zheyu Ma + +[ Upstream commit 13a6f3153922391e90036ba2267d34eed63196fc ] + +When calling the 'ql_sem_spinlock', the driver has already acquired the +spin lock, so the driver should not call 'ssleep' in atomic context. + +This bug can be fixed by using 'mdelay' instead of 'ssleep'. + +The KASAN's log reveals it: + +[ 3.238124 ] BUG: scheduling while atomic: swapper/0/1/0x00000002 +[ 3.238748 ] 2 locks held by swapper/0/1: +[ 3.239151 ] #0: ffff88810177b240 (&dev->mutex){....}-{3:3}, at: +__device_driver_lock+0x41/0x60 +[ 3.240026 ] #1: ffff888107c60e28 (&qdev->hw_lock){....}-{2:2}, at: +ql3xxx_probe+0x2aa/0xea0 +[ 3.240873 ] Modules linked in: +[ 3.241187 ] irq event stamp: 460854 +[ 3.241541 ] hardirqs last enabled at (460853): [] +_raw_spin_unlock_irqrestore+0x4f/0x70 +[ 3.242245 ] hardirqs last disabled at (460854): [] +_raw_spin_lock_irqsave+0x2a/0x70 +[ 3.242245 ] softirqs last enabled at (446076): [] +__do_softirq+0x2e4/0x4b1 +[ 3.242245 ] softirqs last disabled at (446069): [] +irq_exit_rcu+0x100/0x110 +[ 3.242245 ] Preemption disabled at: +[ 3.242245 ] [] ql3xxx_probe+0x2aa/0xea0 +[ 3.242245 ] Kernel panic - not syncing: scheduling while atomic +[ 3.242245 ] CPU: 2 PID: 1 Comm: swapper/0 Not tainted +5.13.0-rc1-00145 +-gee7dc339169-dirty #16 +[ 3.242245 ] Call Trace: +[ 3.242245 ] dump_stack+0xba/0xf5 +[ 3.242245 ] ? ql3xxx_probe+0x1f0/0xea0 +[ 3.242245 ] panic+0x15a/0x3f2 +[ 3.242245 ] ? vprintk+0x76/0x150 +[ 3.242245 ] ? ql3xxx_probe+0x2aa/0xea0 +[ 3.242245 ] __schedule_bug+0xae/0xe0 +[ 3.242245 ] __schedule+0x72e/0xa00 +[ 3.242245 ] schedule+0x43/0xf0 +[ 3.242245 ] schedule_timeout+0x28b/0x500 +[ 3.242245 ] ? del_timer_sync+0xf0/0xf0 +[ 3.242245 ] ? msleep+0x2f/0x70 +[ 3.242245 ] msleep+0x59/0x70 +[ 3.242245 ] ql3xxx_probe+0x307/0xea0 +[ 3.242245 ] ? _raw_spin_unlock_irqrestore+0x3a/0x70 +[ 3.242245 ] ? pci_device_remove+0x110/0x110 +[ 3.242245 ] local_pci_probe+0x45/0xa0 +[ 3.242245 ] pci_device_probe+0x12b/0x1d0 +[ 3.242245 ] really_probe+0x2a9/0x610 +[ 3.242245 ] driver_probe_device+0x90/0x1d0 +[ 3.242245 ] ? mutex_lock_nested+0x1b/0x20 +[ 3.242245 ] device_driver_attach+0x68/0x70 +[ 3.242245 ] __driver_attach+0x124/0x1b0 +[ 3.242245 ] ? device_driver_attach+0x70/0x70 +[ 3.242245 ] bus_for_each_dev+0xbb/0x110 +[ 3.242245 ] ? rdinit_setup+0x45/0x45 +[ 3.242245 ] driver_attach+0x27/0x30 +[ 3.242245 ] bus_add_driver+0x1eb/0x2a0 +[ 3.242245 ] driver_register+0xa9/0x180 +[ 3.242245 ] __pci_register_driver+0x82/0x90 +[ 3.242245 ] ? yellowfin_init+0x25/0x25 +[ 3.242245 ] ql3xxx_driver_init+0x23/0x25 +[ 3.242245 ] do_one_initcall+0x7f/0x3d0 +[ 3.242245 ] ? rdinit_setup+0x45/0x45 +[ 3.242245 ] ? rcu_read_lock_sched_held+0x4f/0x80 +[ 3.242245 ] kernel_init_freeable+0x2aa/0x301 +[ 3.242245 ] ? rest_init+0x2c0/0x2c0 +[ 3.242245 ] kernel_init+0x18/0x190 +[ 3.242245 ] ? rest_init+0x2c0/0x2c0 +[ 3.242245 ] ? rest_init+0x2c0/0x2c0 +[ 3.242245 ] ret_from_fork+0x1f/0x30 +[ 3.242245 ] Dumping ftrace buffer: +[ 3.242245 ] (ftrace buffer empty) +[ 3.242245 ] Kernel Offset: disabled +[ 3.242245 ] Rebooting in 1 seconds. + +Reported-by: Zheyu Ma +Signed-off-by: Zheyu Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qla3xxx.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c b/drivers/net/ethernet/qlogic/qla3xxx.c +index 214e347097a7..2376b2729633 100644 +--- a/drivers/net/ethernet/qlogic/qla3xxx.c ++++ b/drivers/net/ethernet/qlogic/qla3xxx.c +@@ -114,7 +114,7 @@ static int ql_sem_spinlock(struct ql3_adapter *qdev, + value = readl(&port_regs->CommonRegs.semaphoreReg); + if ((value & (sem_mask >> 16)) == sem_bits) + return 0; +- ssleep(1); ++ mdelay(1000); + } while (--seconds); + return -1; + } +-- +2.30.2 + diff --git a/queue-5.12/net-sfc-fix-non-freed-irq-in-legacy-irq-mode.patch b/queue-5.12/net-sfc-fix-non-freed-irq-in-legacy-irq-mode.patch new file mode 100644 index 00000000000..9e1fa9dfa5c --- /dev/null +++ b/queue-5.12/net-sfc-fix-non-freed-irq-in-legacy-irq-mode.patch @@ -0,0 +1,68 @@ +From 3eee3a762d7c082ecb6281cc82901107df4525ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 16:38:35 +0200 +Subject: net:sfc: fix non-freed irq in legacy irq mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Íñigo Huguet + +[ Upstream commit 8f03eeb6e0a0a0b8d617ee0a4bce729e47130036 ] + +SFC driver can be configured via modparam to work using MSI-X, MSI or +legacy IRQ interrupts. In the last one, the interrupt was not properly +released on module remove. + +It was not freed because the flag irqs_hooked was not set during +initialization in the case of using legacy IRQ. + +Example of (trimmed) trace during module remove without this fix: + +remove_proc_entry: removing non-empty directory 'irq/125', leaking at least '0000:3b:00.1' +WARNING: CPU: 39 PID: 3658 at fs/proc/generic.c:715 remove_proc_entry+0x15c/0x170 +...trimmed... +Call Trace: + unregister_irq_proc+0xe3/0x100 + free_desc+0x29/0x70 + irq_free_descs+0x47/0x70 + mp_unmap_irq+0x58/0x60 + acpi_unregister_gsi_ioapic+0x2a/0x40 + acpi_pci_irq_disable+0x78/0xb0 + pci_disable_device+0xd1/0x100 + efx_pci_remove+0xa1/0x1e0 [sfc] + pci_device_remove+0x38/0xa0 + __device_release_driver+0x177/0x230 + driver_detach+0xcb/0x110 + bus_remove_driver+0x58/0xd0 + pci_unregister_driver+0x2a/0xb0 + efx_exit_module+0x24/0xf40 [sfc] + __do_sys_delete_module.constprop.0+0x171/0x280 + ? exit_to_user_mode_prepare+0x83/0x1d0 + do_syscall_64+0x3d/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae +RIP: 0033:0x7f9f9385800b +...trimmed... + +Signed-off-by: Íñigo Huguet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/nic.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c +index d1e908846f5d..22fbb0ae77fb 100644 +--- a/drivers/net/ethernet/sfc/nic.c ++++ b/drivers/net/ethernet/sfc/nic.c +@@ -90,6 +90,7 @@ int efx_nic_init_interrupt(struct efx_nic *efx) + efx->pci_dev->irq); + goto fail1; + } ++ efx->irqs_hooked = true; + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.12/netlink-disable-irqs-for-netlink_lock_table.patch b/queue-5.12/netlink-disable-irqs-for-netlink_lock_table.patch new file mode 100644 index 00000000000..8acf8be95d3 --- /dev/null +++ b/queue-5.12/netlink-disable-irqs-for-netlink_lock_table.patch @@ -0,0 +1,75 @@ +From dd22635845d9040ffd65074f349ecc13a006bd7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:38:09 +0200 +Subject: netlink: disable IRQs for netlink_lock_table() + +From: Johannes Berg + +[ Upstream commit 1d482e666b8e74c7555dbdfbfb77205eeed3ff2d ] + +Syzbot reports that in mac80211 we have a potential deadlock +between our "local->stop_queue_reasons_lock" (spinlock) and +netlink's nl_table_lock (rwlock). This is because there's at +least one situation in which we might try to send a netlink +message with this spinlock held while it is also possible to +take the spinlock from a hardirq context, resulting in the +following deadlock scenario reported by lockdep: + + CPU0 CPU1 + ---- ---- + lock(nl_table_lock); + local_irq_disable(); + lock(&local->queue_stop_reason_lock); + lock(nl_table_lock); + + lock(&local->queue_stop_reason_lock); + +This seems valid, we can take the queue_stop_reason_lock in +any kind of context ("CPU0"), and call ieee80211_report_ack_skb() +with the spinlock held and IRQs disabled ("CPU1") in some +code path (ieee80211_do_stop() via ieee80211_free_txskb()). + +Short of disallowing netlink use in scenarios like these +(which would be rather complex in mac80211's case due to +the deep callchain), it seems the only fix for this is to +disable IRQs while nl_table_lock is held to avoid hitting +this scenario, this disallows the "CPU0" portion of the +reported deadlock. + +Note that the writer side (netlink_table_grab()) already +disables IRQs for this lock. + +Unfortunately though, this seems like a huge hammer, and +maybe the whole netlink table locking should be reworked. + +Reported-by: syzbot+69ff9dff50dcfe14ddd4@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 3a62f97acf39..6133e412b948 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -461,11 +461,13 @@ void netlink_table_ungrab(void) + static inline void + netlink_lock_table(void) + { ++ unsigned long flags; ++ + /* read_lock() synchronizes us to netlink_table_grab */ + +- read_lock(&nl_table_lock); ++ read_lock_irqsave(&nl_table_lock, flags); + atomic_inc(&nl_table_users); +- read_unlock(&nl_table_lock); ++ read_unlock_irqrestore(&nl_table_lock, flags); + } + + static inline void +-- +2.30.2 + diff --git a/queue-5.12/nvme-fabrics-decode-host-pathing-error-for-connect.patch b/queue-5.12/nvme-fabrics-decode-host-pathing-error-for-connect.patch new file mode 100644 index 00000000000..ece67252b34 --- /dev/null +++ b/queue-5.12/nvme-fabrics-decode-host-pathing-error-for-connect.patch @@ -0,0 +1,40 @@ +From 3ef2d83cab626e566f3b1c922f50e7181b13ce3f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 10:23:46 +0200 +Subject: nvme-fabrics: decode host pathing error for connect + +From: Hannes Reinecke + +[ Upstream commit 4d9442bf263ac45d495bb7ecf75009e59c0622b2 ] + +Add an additional decoding for 'host pathing error' during connect. + +Signed-off-by: Hannes Reinecke +Reviewed-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Himanshu Madhani +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fabrics.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 604ab0e5a2ad..fb02ca2e3096 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -336,6 +336,11 @@ static void nvmf_log_connect_error(struct nvme_ctrl *ctrl, + cmd->connect.recfmt); + break; + ++ case NVME_SC_HOST_PATH_ERROR: ++ dev_err(ctrl->device, ++ "Connect command failed: host path error\n"); ++ break; ++ + default: + dev_err(ctrl->device, + "Connect command failed, error wo/DNR bit: %d\n", +-- +2.30.2 + diff --git a/queue-5.12/nvme-tcp-remove-incorrect-kconfig-dep-in-blk_dev_nvm.patch b/queue-5.12/nvme-tcp-remove-incorrect-kconfig-dep-in-blk_dev_nvm.patch new file mode 100644 index 00000000000..132d9248839 --- /dev/null +++ b/queue-5.12/nvme-tcp-remove-incorrect-kconfig-dep-in-blk_dev_nvm.patch @@ -0,0 +1,37 @@ +From cbbd65a38d89a2198b0c5b939a71ae9839ad716d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 14:51:15 -0700 +Subject: nvme-tcp: remove incorrect Kconfig dep in BLK_DEV_NVME + +From: Sagi Grimberg + +[ Upstream commit 042a3eaad6daeabcfaf163aa44da8ea3cf8b5496 ] + +We need to select NVME_CORE. + +Signed-off-by: Sagi Grimberg +Reviewed-by: Max Gurtovoy +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/Kconfig | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig +index a44d49d63968..494675aeaaad 100644 +--- a/drivers/nvme/host/Kconfig ++++ b/drivers/nvme/host/Kconfig +@@ -71,7 +71,8 @@ config NVME_FC + config NVME_TCP + tristate "NVM Express over Fabrics TCP host driver" + depends on INET +- depends on BLK_DEV_NVME ++ depends on BLOCK ++ select NVME_CORE + select NVME_FABRICS + select CRYPTO + select CRYPTO_CRC32C +-- +2.30.2 + diff --git a/queue-5.12/nvmet-fix-false-keep-alive-timeout-when-a-controller.patch b/queue-5.12/nvmet-fix-false-keep-alive-timeout-when-a-controller.patch new file mode 100644 index 00000000000..2a2a9828a47 --- /dev/null +++ b/queue-5.12/nvmet-fix-false-keep-alive-timeout-when-a-controller.patch @@ -0,0 +1,83 @@ +From 9642999b4329f72ba9e5a1b917a79f532e6302b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 08:49:05 -0700 +Subject: nvmet: fix false keep-alive timeout when a controller is torn down + +From: Sagi Grimberg + +[ Upstream commit aaeadd7075dc9e184bc7876e9dd7b3bada771df2 ] + +Controller teardown flow may take some time in case it has many I/O +queues, and the host may not send us keep-alive during this period. +Hence reset the traffic based keep-alive timer so we don't trigger +a controller teardown as a result of a keep-alive expiration. + +Reported-by: Yi Zhang +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Reviewed-by: Hannes Reinecke +Tested-by: Yi Zhang +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/core.c | 15 +++++++++++---- + drivers/nvme/target/nvmet.h | 2 +- + 2 files changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 7d16cb4cd8ac..83921dab8368 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -388,10 +388,10 @@ static void nvmet_keep_alive_timer(struct work_struct *work) + { + struct nvmet_ctrl *ctrl = container_of(to_delayed_work(work), + struct nvmet_ctrl, ka_work); +- bool cmd_seen = ctrl->cmd_seen; ++ bool reset_tbkas = ctrl->reset_tbkas; + +- ctrl->cmd_seen = false; +- if (cmd_seen) { ++ ctrl->reset_tbkas = false; ++ if (reset_tbkas) { + pr_debug("ctrl %d reschedule traffic based keep-alive timer\n", + ctrl->cntlid); + schedule_delayed_work(&ctrl->ka_work, ctrl->kato * HZ); +@@ -804,6 +804,13 @@ void nvmet_sq_destroy(struct nvmet_sq *sq) + percpu_ref_exit(&sq->ref); + + if (ctrl) { ++ /* ++ * The teardown flow may take some time, and the host may not ++ * send us keep-alive during this period, hence reset the ++ * traffic based keep-alive timer so we don't trigger a ++ * controller teardown as a result of a keep-alive expiration. ++ */ ++ ctrl->reset_tbkas = true; + nvmet_ctrl_put(ctrl); + sq->ctrl = NULL; /* allows reusing the queue later */ + } +@@ -953,7 +960,7 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq, + } + + if (sq->ctrl) +- sq->ctrl->cmd_seen = true; ++ sq->ctrl->reset_tbkas = true; + + return true; + +diff --git a/drivers/nvme/target/nvmet.h b/drivers/nvme/target/nvmet.h +index 5aad34b106dc..43a668dc8bc4 100644 +--- a/drivers/nvme/target/nvmet.h ++++ b/drivers/nvme/target/nvmet.h +@@ -166,7 +166,7 @@ struct nvmet_ctrl { + struct nvmet_subsys *subsys; + struct nvmet_sq **sqs; + +- bool cmd_seen; ++ bool reset_tbkas; + + struct mutex lock; + u64 cap; +-- +2.30.2 + diff --git a/queue-5.12/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch b/queue-5.12/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch new file mode 100644 index 00000000000..cb6cffd63a6 --- /dev/null +++ b/queue-5.12/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch @@ -0,0 +1,45 @@ +From 90b7f49b8c66012273ef54552e002776ce5886f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 09:20:51 +1200 +Subject: powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P1010 i2c + controllers + +From: Chris Packham + +[ Upstream commit 19ae697a1e4edf1d755b413e3aa38da65e2db23b ] + +The i2c controllers on the P1010 have an erratum where the documented +scheme for i2c bus recovery will not work (A-004447). A different +mechanism is needed which is documented in the P1010 Chip Errata Rev L. + +Signed-off-by: Chris Packham +Acked-by: Michael Ellerman +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/fsl/p1010si-post.dtsi | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi +index 1b4aafc1f6a2..9716a0484ecf 100644 +--- a/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi ++++ b/arch/powerpc/boot/dts/fsl/p1010si-post.dtsi +@@ -122,7 +122,15 @@ + }; + + /include/ "pq3-i2c-0.dtsi" ++ i2c@3000 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "pq3-i2c-1.dtsi" ++ i2c@3100 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "pq3-duart-0.dtsi" + /include/ "pq3-espi-0.dtsi" + spi0: spi@7000 { +-- +2.30.2 + diff --git a/queue-5.12/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch b/queue-5.12/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch new file mode 100644 index 00000000000..561f2e229be --- /dev/null +++ b/queue-5.12/powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch @@ -0,0 +1,54 @@ +From 3fb840f68bc60751004dcc00d71112adc4a5be38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 09:20:50 +1200 +Subject: powerpc/fsl: set fsl,i2c-erratum-a004447 flag for P2041 i2c + controllers + +From: Chris Packham + +[ Upstream commit 7adc7b225cddcfd0f346d10144fd7a3d3d9f9ea7 ] + +The i2c controllers on the P2040/P2041 have an erratum where the +documented scheme for i2c bus recovery will not work (A-004447). A +different mechanism is needed which is documented in the P2040 Chip +Errata Rev Q (latest available at the time of writing). + +Signed-off-by: Chris Packham +Acked-by: Michael Ellerman +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/fsl/p2041si-post.dtsi | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi +index 872e4485dc3f..ddc018d42252 100644 +--- a/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi ++++ b/arch/powerpc/boot/dts/fsl/p2041si-post.dtsi +@@ -371,7 +371,23 @@ + }; + + /include/ "qoriq-i2c-0.dtsi" ++ i2c@118000 { ++ fsl,i2c-erratum-a004447; ++ }; ++ ++ i2c@118100 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "qoriq-i2c-1.dtsi" ++ i2c@119000 { ++ fsl,i2c-erratum-a004447; ++ }; ++ ++ i2c@119100 { ++ fsl,i2c-erratum-a004447; ++ }; ++ + /include/ "qoriq-duart-0.dtsi" + /include/ "qoriq-duart-1.dtsi" + /include/ "qoriq-gpio-0.dtsi" +-- +2.30.2 + diff --git a/queue-5.12/rds-tcp-loopback-connection-can-hang.patch b/queue-5.12/rds-tcp-loopback-connection-can-hang.patch new file mode 100644 index 00000000000..92e1368e25e --- /dev/null +++ b/queue-5.12/rds-tcp-loopback-connection-can-hang.patch @@ -0,0 +1,121 @@ +From f311db77e4f3293025cc07864ce2a7f01702bdc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 May 2021 11:08:06 -0700 +Subject: RDS tcp loopback connection can hang + +From: Rao Shoaib + +[ Upstream commit aced3ce57cd37b5ca332bcacd370d01f5a8c5371 ] + +When TCP is used as transport and a program on the +system connects to RDS port 16385, connection is +accepted but denied per the rules of RDS. However, +RDS connections object is left in the list. Next +loopback connection will select that connection +object as it is at the head of list. The connection +attempt will hang as the connection object is set +to connect over TCP which is not allowed + +The issue can be reproduced easily, use rds-ping +to ping a local IP address. After that use any +program like ncat to connect to the same IP +address and port 16385. This will hang so ctrl-c out. +Now try rds-ping, it will hang. + +To fix the issue this patch adds checks to disallow +the connection object creation and destroys the +connection object. + +Signed-off-by: Rao Shoaib +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/rds/connection.c | 23 +++++++++++++++++------ + net/rds/tcp.c | 4 ++-- + net/rds/tcp.h | 3 ++- + net/rds/tcp_listen.c | 6 ++++++ + 4 files changed, 27 insertions(+), 9 deletions(-) + +diff --git a/net/rds/connection.c b/net/rds/connection.c +index f2fcab182095..a3bc4b54d491 100644 +--- a/net/rds/connection.c ++++ b/net/rds/connection.c +@@ -240,12 +240,23 @@ static struct rds_connection *__rds_conn_create(struct net *net, + if (loop_trans) { + rds_trans_put(loop_trans); + conn->c_loopback = 1; +- if (is_outgoing && trans->t_prefer_loopback) { +- /* "outgoing" connection - and the transport +- * says it wants the connection handled by the +- * loopback transport. This is what TCP does. +- */ +- trans = &rds_loop_transport; ++ if (trans->t_prefer_loopback) { ++ if (likely(is_outgoing)) { ++ /* "outgoing" connection to local address. ++ * Protocol says it wants the connection ++ * handled by the loopback transport. ++ * This is what TCP does. ++ */ ++ trans = &rds_loop_transport; ++ } else { ++ /* No transport currently in use ++ * should end up here, but if it ++ * does, reset/destroy the connection. ++ */ ++ kmem_cache_free(rds_conn_slab, conn); ++ conn = ERR_PTR(-EOPNOTSUPP); ++ goto out; ++ } + } + } + +diff --git a/net/rds/tcp.c b/net/rds/tcp.c +index 43db0eca911f..abf19c0e3ba0 100644 +--- a/net/rds/tcp.c ++++ b/net/rds/tcp.c +@@ -313,8 +313,8 @@ out: + } + #endif + +-static int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr, +- __u32 scope_id) ++int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr, ++ __u32 scope_id) + { + struct net_device *dev = NULL; + #if IS_ENABLED(CONFIG_IPV6) +diff --git a/net/rds/tcp.h b/net/rds/tcp.h +index bad9cf49d565..dc8d745d6857 100644 +--- a/net/rds/tcp.h ++++ b/net/rds/tcp.h +@@ -59,7 +59,8 @@ u32 rds_tcp_snd_una(struct rds_tcp_connection *tc); + u64 rds_tcp_map_seq(struct rds_tcp_connection *tc, u32 seq); + extern struct rds_transport rds_tcp_transport; + void rds_tcp_accept_work(struct sock *sk); +- ++int rds_tcp_laddr_check(struct net *net, const struct in6_addr *addr, ++ __u32 scope_id); + /* tcp_connect.c */ + int rds_tcp_conn_path_connect(struct rds_conn_path *cp); + void rds_tcp_conn_path_shutdown(struct rds_conn_path *conn); +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index 101cf14215a0..09cadd556d1e 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -167,6 +167,12 @@ int rds_tcp_accept_one(struct socket *sock) + } + #endif + ++ if (!rds_tcp_laddr_check(sock_net(sock->sk), peer_addr, dev_if)) { ++ /* local address connection is only allowed via loopback */ ++ ret = -EOPNOTSUPP; ++ goto out; ++ } ++ + conn = rds_conn_create(sock_net(sock->sk), + my_addr, peer_addr, + &rds_tcp_transport, 0, GFP_KERNEL, dev_if); +-- +2.30.2 + diff --git a/queue-5.12/scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch b/queue-5.12/scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch new file mode 100644 index 00000000000..5fa21dc2ad9 --- /dev/null +++ b/queue-5.12/scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch @@ -0,0 +1,36 @@ +From 6b4ff108777d4477a50bb3c046887393e5cb83cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 23:14:16 -0700 +Subject: scsi: bnx2fc: Return failure if io_req is already in ABTS processing + +From: Javed Hasan + +[ Upstream commit 122c81c563b0c1c6b15ff76a9159af5ee1f21563 ] + +Return failure from bnx2fc_eh_abort() if io_req is already in ABTS +processing. + +Link: https://lore.kernel.org/r/20210519061416.19321-1-jhasan@marvell.com +Reviewed-by: Himanshu Madhani +Signed-off-by: Javed Hasan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/bnx2fc/bnx2fc_io.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c +index 1a0dc18d6915..ed300a279a38 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_io.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_io.c +@@ -1220,6 +1220,7 @@ int bnx2fc_eh_abort(struct scsi_cmnd *sc_cmd) + was a result from the ABTS request rather than the CLEANUP + request */ + set_bit(BNX2FC_FLAG_IO_CLEANUP, &io_req->req_flags); ++ rc = FAILED; + goto done; + } + +-- +2.30.2 + diff --git a/queue-5.12/scsi-hisi_sas-drop-free_irq-of-devm_request_irq-allo.patch b/queue-5.12/scsi-hisi_sas-drop-free_irq-of-devm_request_irq-allo.patch new file mode 100644 index 00000000000..e59155be471 --- /dev/null +++ b/queue-5.12/scsi-hisi_sas-drop-free_irq-of-devm_request_irq-allo.patch @@ -0,0 +1,49 @@ +From 1d5c43a7cc027423eecb0446fe2c9f9381265701 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 21:05:19 +0800 +Subject: scsi: hisi_sas: Drop free_irq() of devm_request_irq() allocated irq + +From: Yang Yingliang + +[ Upstream commit 7907a021e4bbfa29cccacd2ba2dade894d9a7d4c ] + +irqs allocated with devm_request_irq() should not be freed using +free_irq(). Doing so causes a dangling pointer and a subsequent double +free. + +Link: https://lore.kernel.org/r/20210519130519.2661938-1-yangyingliang@huawei.com +Reported-by: Hulk Robot +Acked-by: John Garry +Signed-off-by: Yang Yingliang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 4580e081e489..b21246b1ba99 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -4799,14 +4799,14 @@ hisi_sas_v3_destroy_irqs(struct pci_dev *pdev, struct hisi_hba *hisi_hba) + { + int i; + +- free_irq(pci_irq_vector(pdev, 1), hisi_hba); +- free_irq(pci_irq_vector(pdev, 2), hisi_hba); +- free_irq(pci_irq_vector(pdev, 11), hisi_hba); ++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 1), hisi_hba); ++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 2), hisi_hba); ++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, 11), hisi_hba); + for (i = 0; i < hisi_hba->cq_nvecs; i++) { + struct hisi_sas_cq *cq = &hisi_hba->cq[i]; + int nr = hisi_sas_intr_conv ? 16 : 16 + i; + +- free_irq(pci_irq_vector(pdev, nr), cq); ++ devm_free_irq(&pdev->dev, pci_irq_vector(pdev, nr), cq); + } + pci_free_irq_vectors(pdev); + } +-- +2.30.2 + diff --git a/queue-5.12/scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch b/queue-5.12/scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch new file mode 100644 index 00000000000..7bfd173919e --- /dev/null +++ b/queue-5.12/scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch @@ -0,0 +1,82 @@ +From 6766089faa4f2ceb4e9ee5595bdb4ec3f6dedf16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 23:35:54 +0300 +Subject: scsi: target: qla2xxx: Wait for stop_phase1 at WWN removal + +From: Dmitry Bogdanov + +[ Upstream commit 2ef7665dfd88830f15415ba007c7c9a46be7acd8 ] + +Target de-configuration panics at high CPU load because TPGT and WWPN can +be removed on separate threads. + +TPGT removal requests a reset HBA on a separate thread and waits for reset +complete (phase1). Due to high CPU load that HBA reset can be delayed for +some time. + +WWPN removal does qlt_stop_phase2(). There it is believed that phase1 has +already completed and thus tgt.tgt_ops is subsequently cleared. However, +tgt.tgt_ops is needed to process incoming traffic and therefore this will +cause one of the following panics: + +NIP qlt_reset+0x7c/0x220 [qla2xxx] +LR qlt_reset+0x68/0x220 [qla2xxx] +Call Trace: +0xc000003ffff63a78 (unreliable) +qlt_handle_imm_notify+0x800/0x10c0 [qla2xxx] +qlt_24xx_atio_pkt+0x208/0x590 [qla2xxx] +qlt_24xx_process_atio_queue+0x33c/0x7a0 [qla2xxx] +qla83xx_msix_atio_q+0x54/0x90 [qla2xxx] + +or + +NIP qlt_24xx_handle_abts+0xd0/0x2a0 [qla2xxx] +LR qlt_24xx_handle_abts+0xb4/0x2a0 [qla2xxx] +Call Trace: +qlt_24xx_handle_abts+0x90/0x2a0 [qla2xxx] (unreliable) +qlt_24xx_process_atio_queue+0x500/0x7a0 [qla2xxx] +qla83xx_msix_atio_q+0x54/0x90 [qla2xxx] + +or + +NIP qlt_create_sess+0x90/0x4e0 [qla2xxx] +LR qla24xx_do_nack_work+0xa8/0x180 [qla2xxx] +Call Trace: +0xc0000000348fba30 (unreliable) +qla24xx_do_nack_work+0xa8/0x180 [qla2xxx] +qla2x00_do_work+0x674/0xbf0 [qla2xxx] +qla2x00_iocb_work_fn + +The patch fixes the issue by serializing qlt_stop_phase1() and +qlt_stop_phase2() functions to make WWPN removal wait for phase1 +completion. + +Link: https://lore.kernel.org/r/20210415203554.27890-1-d.bogdanov@yadro.com +Reviewed-by: Roman Bolshakov +Signed-off-by: Dmitry Bogdanov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_target.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 480e7d2dcf3e..745d6d98c02e 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1558,10 +1558,12 @@ void qlt_stop_phase2(struct qla_tgt *tgt) + return; + } + ++ mutex_lock(&tgt->ha->optrom_mutex); + mutex_lock(&vha->vha_tgt.tgt_mutex); + tgt->tgt_stop = 0; + tgt->tgt_stopped = 1; + mutex_unlock(&vha->vha_tgt.tgt_mutex); ++ mutex_unlock(&tgt->ha->optrom_mutex); + + ql_dbg(ql_dbg_tgt_mgt, vha, 0xf00c, "Stop of tgt %p finished\n", + tgt); +-- +2.30.2 + diff --git a/queue-5.12/scsi-vmw_pvscsi-set-correct-residual-data-length.patch b/queue-5.12/scsi-vmw_pvscsi-set-correct-residual-data-length.patch new file mode 100644 index 00000000000..d485ddf4829 --- /dev/null +++ b/queue-5.12/scsi-vmw_pvscsi-set-correct-residual-data-length.patch @@ -0,0 +1,71 @@ +From 6db5e3468779a0fa5aceacb19189320b6154bf55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 09:49:32 +0000 +Subject: scsi: vmw_pvscsi: Set correct residual data length + +From: Matt Wang + +[ Upstream commit e662502b3a782d479e67736a5a1c169a703d853a ] + +Some commands (such as INQUIRY) may return less data than the initiator +requested. To avoid conducting useless information, set the right residual +count to make upper layer aware of this. + +Before (INQUIRY PAGE 0xB0 with 128B buffer): + +$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00 +SCSI Status: Good + +Received 128 bytes of data: + 00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............ + 10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@.... + 20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... ..... + 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + +After: + +$ sg_raw -r 128 /dev/sda 12 01 B0 00 80 00 +SCSI Status: Good + +Received 64 bytes of data: +00 00 b0 00 3c 01 00 00 00 00 00 00 00 00 00 00 00 ...<............ +10 00 00 00 00 00 01 00 00 00 00 00 40 00 00 08 00 ...........@.... +20 80 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 .......... ..... +30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + +[mkp: clarified description] + +Link: https://lore.kernel.org/r/03C41093-B62E-43A2-913E-CFC92F1C70C3@vmware.com +Signed-off-by: Matt Wang +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/vmw_pvscsi.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index 8a79605d9652..b9969fce6b4d 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -585,7 +585,13 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter, + case BTSTAT_SUCCESS: + case BTSTAT_LINKED_COMMAND_COMPLETED: + case BTSTAT_LINKED_COMMAND_COMPLETED_WITH_FLAG: +- /* If everything went fine, let's move on.. */ ++ /* ++ * Commands like INQUIRY may transfer less data than ++ * requested by the initiator via bufflen. Set residual ++ * count to make upper layer aware of the actual amount ++ * of data returned. ++ */ ++ scsi_set_resid(cmd, scsi_bufflen(cmd) - e->dataLen); + cmd->result = (DID_OK << 16); + break; + +-- +2.30.2 + diff --git a/queue-5.12/series b/queue-5.12/series index 54cd2a3f714..0b737a1eeca 100644 --- a/queue-5.12/series +++ b/queue-5.12/series @@ -1 +1,48 @@ proc-track-proc-pid-attr-opener-mm_struct.patch +asoc-max98088-fix-ni-clock-divider-calculation.patch +asoc-amd-fix-for-pcm_read-error.patch +spi-fix-spi-device-unregister-flow.patch +spi-spi-zynq-qspi-fix-stack-violation-bug.patch +bpf-forbid-trampoline-attach-for-functions-with-vari.patch +asoc-codecs-lpass-rx-macro-add-missing-module_device.patch +asoc-codecs-lpass-tx-macro-add-missing-module_device.patch +net-nfc-rawsock.c-fix-a-permission-check-bug.patch +usb-cdns3-fix-runtime-pm-imbalance-on-error.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-glavey-tm8.patch +asoc-intel-bytcr_rt5640-add-quirk-for-the-lenovo-mii.patch +bpf-add-deny-list-of-btf-ids-check-for-tracing-progr.patch +vfio-ccw-reset-fsm-state-to-idle-inside-fsm.patch +vfio-ccw-serialize-fsm-idle-state-with-i-o-completio.patch +asoc-sti-sas-add-missing-module_device_table.patch +spi-sprd-add-missing-module_device_table.patch +usb-chipidea-udc-assign-interrupt-number-to-usb-gadg.patch +isdn-misdn-netjet-fix-crash-in-nj_probe.patch +bonding-init-notify_work-earlier-to-avoid-uninitiali.patch +netlink-disable-irqs-for-netlink_lock_table.patch +net-mdiobus-get-rid-of-a-bug_on.patch +cgroup-disable-controllers-at-parse-time.patch +wq-handle-vm-suspension-in-stall-detection.patch +net-qla3xxx-fix-schedule-while-atomic-in-ql_sem_spin.patch +rds-tcp-loopback-connection-can-hang.patch +net-sfc-fix-non-freed-irq-in-legacy-irq-mode.patch +scsi-bnx2fc-return-failure-if-io_req-is-already-in-a.patch +scsi-vmw_pvscsi-set-correct-residual-data-length.patch +scsi-hisi_sas-drop-free_irq-of-devm_request_irq-allo.patch +scsi-target-qla2xxx-wait-for-stop_phase1-at-wwn-remo.patch +net-macb-ensure-the-device-is-available-before-acces.patch +net-appletalk-cops-fix-data-race-in-cops_probe1.patch +net-dsa-microchip-enable-phy-errata-workaround-on-95.patch +makefile-lto-have-linker-check-wframe-larger-than.patch +nvme-fabrics-decode-host-pathing-error-for-connect.patch +mips-fix-kernel-hang-under-function_graph_tracer-and.patch +bpf-selftests-adjust-few-selftest-result_unpriv-outc.patch +dm-verity-fix-require_signatures-module_param-permis.patch +bnx2x-fix-missing-error-code-in-bnx2x_iov_init_one.patch +nvme-tcp-remove-incorrect-kconfig-dep-in-blk_dev_nvm.patch +nvmet-fix-false-keep-alive-timeout-when-a-controller.patch +powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p20.patch +powerpc-fsl-set-fsl-i2c-erratum-a004447-flag-for-p10.patch +spi-don-t-have-controller-clean-up-spi-device-before.patch +spi-cleanup-on-failure-of-initial-setup.patch +i2c-mpc-make-use-of-i2c_recover_bus.patch +i2c-mpc-implement-erratum-a-004447-workaround.patch diff --git a/queue-5.12/spi-cleanup-on-failure-of-initial-setup.patch b/queue-5.12/spi-cleanup-on-failure-of-initial-setup.patch new file mode 100644 index 00000000000..db0d20f641b --- /dev/null +++ b/queue-5.12/spi-cleanup-on-failure-of-initial-setup.patch @@ -0,0 +1,267 @@ +From 65fe3945104bbaefc0db97cc7673a1cd408a7e46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 23:10:56 +0200 +Subject: spi: Cleanup on failure of initial setup + +From: Lukas Wunner + +[ Upstream commit 2ec6f20b33eb4f62ab90bdcd620436c883ec3af6 ] + +Commit c7299fea6769 ("spi: Fix spi device unregister flow") changed the +SPI core's behavior if the ->setup() hook returns an error upon adding +an spi_device: Before, the ->cleanup() hook was invoked to free any +allocations that were made by ->setup(). With the commit, that's no +longer the case, so the ->setup() hook is expected to free the +allocations itself. + +I've identified 5 drivers which depend on the old behavior and am fixing +them up hereinafter: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c +spi-omap2-mcspi.c spi-pxa2xx.c + +Importantly, ->setup() is not only invoked on spi_device *addition*: +It may subsequently be called to *change* SPI parameters. If changing +these SPI parameters fails, freeing memory allocations would be wrong. +That should only be done if the spi_device is finally destroyed. +I am therefore using a bool "initial_setup" in 4 of the affected drivers +to differentiate between the invocation on *adding* the spi_device and +any subsequent invocations: spi-bitbang.c spi-fsl-spi.c spi-omap-uwire.c +spi-omap2-mcspi.c + +In spi-pxa2xx.c, it seems the ->setup() hook can only fail on spi_device +addition, not any subsequent calls. It therefore doesn't need the bool. + +It's worth noting that 5 other drivers already perform a cleanup if the +->setup() hook fails. Before c7299fea6769, they caused a double-free +if ->setup() failed on spi_device addition. Since the commit, they're +fine. These drivers are: spi-mpc512x-psc.c spi-pl022.c spi-s3c64xx.c +spi-st-ssc4.c spi-tegra114.c + +(spi-pxa2xx.c also already performs a cleanup, but only in one of +several error paths.) + +Fixes: c7299fea6769 ("spi: Fix spi device unregister flow") +Signed-off-by: Lukas Wunner +Cc: Saravana Kannan +Acked-by: Andy Shevchenko # pxa2xx +Link: https://lore.kernel.org/r/f76a0599469f265b69c371538794101fa37b5536.1622149321.git.lukas@wunner.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bitbang.c | 18 ++++++++++++++---- + drivers/spi/spi-fsl-spi.c | 4 ++++ + drivers/spi/spi-omap-uwire.c | 9 ++++++++- + drivers/spi/spi-omap2-mcspi.c | 33 ++++++++++++++++++++------------- + drivers/spi/spi-pxa2xx.c | 9 ++++++++- + 5 files changed, 54 insertions(+), 19 deletions(-) + +diff --git a/drivers/spi/spi-bitbang.c b/drivers/spi/spi-bitbang.c +index 1a7352abd878..3d8948a17095 100644 +--- a/drivers/spi/spi-bitbang.c ++++ b/drivers/spi/spi-bitbang.c +@@ -181,6 +181,8 @@ int spi_bitbang_setup(struct spi_device *spi) + { + struct spi_bitbang_cs *cs = spi->controller_state; + struct spi_bitbang *bitbang; ++ bool initial_setup = false; ++ int retval; + + bitbang = spi_master_get_devdata(spi->master); + +@@ -189,22 +191,30 @@ int spi_bitbang_setup(struct spi_device *spi) + if (!cs) + return -ENOMEM; + spi->controller_state = cs; ++ initial_setup = true; + } + + /* per-word shift register access, in hardware or bitbanging */ + cs->txrx_word = bitbang->txrx_word[spi->mode & (SPI_CPOL|SPI_CPHA)]; +- if (!cs->txrx_word) +- return -EINVAL; ++ if (!cs->txrx_word) { ++ retval = -EINVAL; ++ goto err_free; ++ } + + if (bitbang->setup_transfer) { +- int retval = bitbang->setup_transfer(spi, NULL); ++ retval = bitbang->setup_transfer(spi, NULL); + if (retval < 0) +- return retval; ++ goto err_free; + } + + dev_dbg(&spi->dev, "%s, %u nsec/bit\n", __func__, 2 * cs->nsecs); + + return 0; ++ ++err_free: ++ if (initial_setup) ++ kfree(cs); ++ return retval; + } + EXPORT_SYMBOL_GPL(spi_bitbang_setup); + +diff --git a/drivers/spi/spi-fsl-spi.c b/drivers/spi/spi-fsl-spi.c +index d0e5aa18b7ba..bdf94cc7be1a 100644 +--- a/drivers/spi/spi-fsl-spi.c ++++ b/drivers/spi/spi-fsl-spi.c +@@ -440,6 +440,7 @@ static int fsl_spi_setup(struct spi_device *spi) + { + struct mpc8xxx_spi *mpc8xxx_spi; + struct fsl_spi_reg __iomem *reg_base; ++ bool initial_setup = false; + int retval; + u32 hw_mode; + struct spi_mpc8xxx_cs *cs = spi_get_ctldata(spi); +@@ -452,6 +453,7 @@ static int fsl_spi_setup(struct spi_device *spi) + if (!cs) + return -ENOMEM; + spi_set_ctldata(spi, cs); ++ initial_setup = true; + } + mpc8xxx_spi = spi_master_get_devdata(spi->master); + +@@ -475,6 +477,8 @@ static int fsl_spi_setup(struct spi_device *spi) + retval = fsl_spi_setup_transfer(spi, NULL); + if (retval < 0) { + cs->hw_mode = hw_mode; /* Restore settings */ ++ if (initial_setup) ++ kfree(cs); + return retval; + } + +diff --git a/drivers/spi/spi-omap-uwire.c b/drivers/spi/spi-omap-uwire.c +index 71402f71ddd8..df28c6664aba 100644 +--- a/drivers/spi/spi-omap-uwire.c ++++ b/drivers/spi/spi-omap-uwire.c +@@ -424,15 +424,22 @@ done: + static int uwire_setup(struct spi_device *spi) + { + struct uwire_state *ust = spi->controller_state; ++ bool initial_setup = false; ++ int status; + + if (ust == NULL) { + ust = kzalloc(sizeof(*ust), GFP_KERNEL); + if (ust == NULL) + return -ENOMEM; + spi->controller_state = ust; ++ initial_setup = true; + } + +- return uwire_setup_transfer(spi, NULL); ++ status = uwire_setup_transfer(spi, NULL); ++ if (status && initial_setup) ++ kfree(ust); ++ ++ return status; + } + + static void uwire_cleanup(struct spi_device *spi) +diff --git a/drivers/spi/spi-omap2-mcspi.c b/drivers/spi/spi-omap2-mcspi.c +index d4c9510af393..3596bbe4b776 100644 +--- a/drivers/spi/spi-omap2-mcspi.c ++++ b/drivers/spi/spi-omap2-mcspi.c +@@ -1032,8 +1032,22 @@ static void omap2_mcspi_release_dma(struct spi_master *master) + } + } + ++static void omap2_mcspi_cleanup(struct spi_device *spi) ++{ ++ struct omap2_mcspi_cs *cs; ++ ++ if (spi->controller_state) { ++ /* Unlink controller state from context save list */ ++ cs = spi->controller_state; ++ list_del(&cs->node); ++ ++ kfree(cs); ++ } ++} ++ + static int omap2_mcspi_setup(struct spi_device *spi) + { ++ bool initial_setup = false; + int ret; + struct omap2_mcspi *mcspi = spi_master_get_devdata(spi->master); + struct omap2_mcspi_regs *ctx = &mcspi->ctx; +@@ -1051,35 +1065,28 @@ static int omap2_mcspi_setup(struct spi_device *spi) + spi->controller_state = cs; + /* Link this to context save list */ + list_add_tail(&cs->node, &ctx->cs); ++ initial_setup = true; + } + + ret = pm_runtime_get_sync(mcspi->dev); + if (ret < 0) { + pm_runtime_put_noidle(mcspi->dev); ++ if (initial_setup) ++ omap2_mcspi_cleanup(spi); + + return ret; + } + + ret = omap2_mcspi_setup_transfer(spi, NULL); ++ if (ret && initial_setup) ++ omap2_mcspi_cleanup(spi); ++ + pm_runtime_mark_last_busy(mcspi->dev); + pm_runtime_put_autosuspend(mcspi->dev); + + return ret; + } + +-static void omap2_mcspi_cleanup(struct spi_device *spi) +-{ +- struct omap2_mcspi_cs *cs; +- +- if (spi->controller_state) { +- /* Unlink controller state from context save list */ +- cs = spi->controller_state; +- list_del(&cs->node); +- +- kfree(cs); +- } +-} +- + static irqreturn_t omap2_mcspi_irq_handler(int irq, void *data) + { + struct omap2_mcspi *mcspi = data; +diff --git a/drivers/spi/spi-pxa2xx.c b/drivers/spi/spi-pxa2xx.c +index 0cc767283674..825cc5b2ab2f 100644 +--- a/drivers/spi/spi-pxa2xx.c ++++ b/drivers/spi/spi-pxa2xx.c +@@ -1254,6 +1254,8 @@ static int setup_cs(struct spi_device *spi, struct chip_data *chip, + chip->gpio_cs_inverted = spi->mode & SPI_CS_HIGH; + + err = gpiod_direction_output(gpiod, !chip->gpio_cs_inverted); ++ if (err) ++ gpiod_put(chip->gpiod_cs); + } + + return err; +@@ -1267,6 +1269,7 @@ static int setup(struct spi_device *spi) + struct driver_data *drv_data = + spi_controller_get_devdata(spi->controller); + uint tx_thres, tx_hi_thres, rx_thres; ++ int err; + + switch (drv_data->ssp_type) { + case QUARK_X1000_SSP: +@@ -1413,7 +1416,11 @@ static int setup(struct spi_device *spi) + if (drv_data->ssp_type == CE4100_SSP) + return 0; + +- return setup_cs(spi, chip, chip_info); ++ err = setup_cs(spi, chip, chip_info); ++ if (err) ++ kfree(chip); ++ ++ return err; + } + + static void cleanup(struct spi_device *spi) +-- +2.30.2 + diff --git a/queue-5.12/spi-don-t-have-controller-clean-up-spi-device-before.patch b/queue-5.12/spi-don-t-have-controller-clean-up-spi-device-before.patch new file mode 100644 index 00000000000..5be03a6cf01 --- /dev/null +++ b/queue-5.12/spi-don-t-have-controller-clean-up-spi-device-before.patch @@ -0,0 +1,51 @@ +From 8b3656e1de1db1df091fa1d4f17cb390418dfc58 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 09:47:34 -0700 +Subject: spi: Don't have controller clean up spi device before driver unbind + +From: Saravana Kannan + +[ Upstream commit 27e7db56cf3dffd302bd7ddfacb1d405cf671a2a ] + +When a spi device is unregistered and triggers a driver unbind, the +driver might need to access the spi device. So, don't have the +controller clean up the spi device before the driver is unbound. Clean +up the spi device after the driver is unbound. + +Fixes: c7299fea6769 ("spi: Fix spi device unregister flow") +Reported-by: Lukas Wunner +Signed-off-by: Saravana Kannan +Tested-by: Andy Shevchenko +Link: https://lore.kernel.org/r/20210505164734.175546-1-saravanak@google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 125116ab3386..e067c54e87dd 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -717,15 +717,15 @@ void spi_unregister_device(struct spi_device *spi) + if (!spi) + return; + +- spi_cleanup(spi); +- + if (spi->dev.of_node) { + of_node_clear_flag(spi->dev.of_node, OF_POPULATED); + of_node_put(spi->dev.of_node); + } + if (ACPI_COMPANION(&spi->dev)) + acpi_device_clear_enumerated(ACPI_COMPANION(&spi->dev)); +- device_unregister(&spi->dev); ++ device_del(&spi->dev); ++ spi_cleanup(spi); ++ put_device(&spi->dev); + } + EXPORT_SYMBOL_GPL(spi_unregister_device); + +-- +2.30.2 + diff --git a/queue-5.12/spi-fix-spi-device-unregister-flow.patch b/queue-5.12/spi-fix-spi-device-unregister-flow.patch new file mode 100644 index 00000000000..bcd7e7a836b --- /dev/null +++ b/queue-5.12/spi-fix-spi-device-unregister-flow.patch @@ -0,0 +1,92 @@ +From 9b40419858840f67a21562d01967a48433db2f26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 16:56:38 -0700 +Subject: spi: Fix spi device unregister flow + +From: Saravana Kannan + +[ Upstream commit c7299fea67696db5bd09d924d1f1080d894f92ef ] + +When an SPI device is unregistered, the spi->controller->cleanup() is +called in the device's release callback. That's wrong for a couple of +reasons: + +1. spi_dev_put() can be called before spi_add_device() is called. And + it's spi_add_device() that calls spi_setup(). This will cause clean() + to get called without the spi device ever being setup. + +2. There's no guarantee that the controller's driver would be present by + the time the spi device's release function gets called. + +3. It also causes "sleeping in atomic context" stack dump[1] when device + link deletion code does a put_device() on the spi device. + +Fix these issues by simply moving the cleanup from the device release +callback to the actual spi_unregister_device() function. + +[1] - https://lore.kernel.org/lkml/CAHp75Vc=FCGcUyS0v6fnxme2YJ+qD+Y-hQDQLa2JhWNON9VmsQ@mail.gmail.com/ + +Signed-off-by: Saravana Kannan +Link: https://lore.kernel.org/r/20210426235638.1285530-1-saravanak@google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 6ae7418f648c..125116ab3386 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -47,10 +47,6 @@ static void spidev_release(struct device *dev) + { + struct spi_device *spi = to_spi_device(dev); + +- /* spi controllers may cleanup for released devices */ +- if (spi->controller->cleanup) +- spi->controller->cleanup(spi); +- + spi_controller_put(spi->controller); + kfree(spi->driver_override); + kfree(spi); +@@ -558,6 +554,12 @@ static int spi_dev_check(struct device *dev, void *data) + return 0; + } + ++static void spi_cleanup(struct spi_device *spi) ++{ ++ if (spi->controller->cleanup) ++ spi->controller->cleanup(spi); ++} ++ + /** + * spi_add_device - Add spi_device allocated with spi_alloc_device + * @spi: spi_device to register +@@ -622,11 +624,13 @@ int spi_add_device(struct spi_device *spi) + + /* Device may be bound to an active driver when this returns */ + status = device_add(&spi->dev); +- if (status < 0) ++ if (status < 0) { + dev_err(dev, "can't add %s, status %d\n", + dev_name(&spi->dev), status); +- else ++ spi_cleanup(spi); ++ } else { + dev_dbg(dev, "registered child %s\n", dev_name(&spi->dev)); ++ } + + done: + mutex_unlock(&spi_add_lock); +@@ -713,6 +717,8 @@ void spi_unregister_device(struct spi_device *spi) + if (!spi) + return; + ++ spi_cleanup(spi); ++ + if (spi->dev.of_node) { + of_node_clear_flag(spi->dev.of_node, OF_POPULATED); + of_node_put(spi->dev.of_node); +-- +2.30.2 + diff --git a/queue-5.12/spi-spi-zynq-qspi-fix-stack-violation-bug.patch b/queue-5.12/spi-spi-zynq-qspi-fix-stack-violation-bug.patch new file mode 100644 index 00000000000..5492aa02ad1 --- /dev/null +++ b/queue-5.12/spi-spi-zynq-qspi-fix-stack-violation-bug.patch @@ -0,0 +1,53 @@ +From 683b89c6a499290db5e117f837b22d5809c678d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 23:38:02 -0600 +Subject: spi: spi-zynq-qspi: Fix stack violation bug + +From: Karen Dombroski + +[ Upstream commit 6d5ff8e632a4f2389c331e5554cd1c2a9a28c7aa ] + +When the number of bytes for the op is greater than one, the read could +run off the end of the function stack and cause a crash. + +This patch restores the behaviour of safely reading out of the original +opcode location. + +Signed-off-by: Karen Dombroski +Signed-off-by: Amit Kumar Mahapatra +Link: https://lore.kernel.org/r/20210429053802.17650-3-amit.kumar-mahapatra@xilinx.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-zynq-qspi.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c +index 5d8a5ee62fa2..2765289028fa 100644 +--- a/drivers/spi/spi-zynq-qspi.c ++++ b/drivers/spi/spi-zynq-qspi.c +@@ -528,18 +528,17 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, + struct zynq_qspi *xqspi = spi_controller_get_devdata(mem->spi->master); + int err = 0, i; + u8 *tmpbuf; +- u8 opcode = op->cmd.opcode; + + dev_dbg(xqspi->dev, "cmd:%#x mode:%d.%d.%d.%d\n", +- opcode, op->cmd.buswidth, op->addr.buswidth, ++ op->cmd.opcode, op->cmd.buswidth, op->addr.buswidth, + op->dummy.buswidth, op->data.buswidth); + + zynq_qspi_chipselect(mem->spi, true); + zynq_qspi_config_op(xqspi, mem->spi); + +- if (op->cmd.nbytes) { ++ if (op->cmd.opcode) { + reinit_completion(&xqspi->data_completion); +- xqspi->txbuf = &opcode; ++ xqspi->txbuf = (u8 *)&op->cmd.opcode; + xqspi->rxbuf = NULL; + xqspi->tx_bytes = op->cmd.nbytes; + xqspi->rx_bytes = op->cmd.nbytes; +-- +2.30.2 + diff --git a/queue-5.12/spi-sprd-add-missing-module_device_table.patch b/queue-5.12/spi-sprd-add-missing-module_device_table.patch new file mode 100644 index 00000000000..692c372c17b --- /dev/null +++ b/queue-5.12/spi-sprd-add-missing-module_device_table.patch @@ -0,0 +1,37 @@ +From 7bfe7c7348166186b61df1eb0532722ced49bce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 17:35:34 +0800 +Subject: spi: sprd: Add missing MODULE_DEVICE_TABLE + +From: Chunyan Zhang + +[ Upstream commit 7907cad7d07e0055789ec0c534452f19dfe1fc80 ] + +MODULE_DEVICE_TABLE is used to extract the device information out of the +driver and builds a table when being compiled. If using this macro, +kernel can find the driver if available when the device is plugged in, +and then loads that driver and initializes the device. + +Signed-off-by: Chunyan Zhang +Link: https://lore.kernel.org/r/20210512093534.243040-1-zhang.lyra@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sprd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-sprd.c b/drivers/spi/spi-sprd.c +index b41a75749b49..28e70db9bbba 100644 +--- a/drivers/spi/spi-sprd.c ++++ b/drivers/spi/spi-sprd.c +@@ -1068,6 +1068,7 @@ static const struct of_device_id sprd_spi_of_match[] = { + { .compatible = "sprd,sc9860-spi", }, + { /* sentinel */ } + }; ++MODULE_DEVICE_TABLE(of, sprd_spi_of_match); + + static struct platform_driver sprd_spi_driver = { + .driver = { +-- +2.30.2 + diff --git a/queue-5.12/usb-cdns3-fix-runtime-pm-imbalance-on-error.patch b/queue-5.12/usb-cdns3-fix-runtime-pm-imbalance-on-error.patch new file mode 100644 index 00000000000..8c5be25b76f --- /dev/null +++ b/queue-5.12/usb-cdns3-fix-runtime-pm-imbalance-on-error.patch @@ -0,0 +1,39 @@ +From fb54b8d1c2d6a1e0be4decc93b96a3561404008b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Apr 2021 13:49:07 +0800 +Subject: usb: cdns3: Fix runtime PM imbalance on error + +From: Dinghao Liu + +[ Upstream commit 07adc0225484fc199e3dc15ec889f75f498c4fca ] + +When cdns3_gadget_start() fails, a pairing PM usage counter +decrement is needed to keep the counter balanced. + +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20210412054908.7975-1-dinghao.liu@zju.edu.cn +Signed-off-by: Peter Chen +Signed-off-by: Sasha Levin +--- + drivers/usb/cdns3/cdns3-gadget.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/cdns3/cdns3-gadget.c b/drivers/usb/cdns3/cdns3-gadget.c +index 582bfeceedb4..a49fc68ec2ef 100644 +--- a/drivers/usb/cdns3/cdns3-gadget.c ++++ b/drivers/usb/cdns3/cdns3-gadget.c +@@ -3255,8 +3255,10 @@ static int __cdns3_gadget_init(struct cdns *cdns) + pm_runtime_get_sync(cdns->dev); + + ret = cdns3_gadget_start(cdns); +- if (ret) ++ if (ret) { ++ pm_runtime_put_sync(cdns->dev); + return ret; ++ } + + /* + * Because interrupt line can be shared with other components in +-- +2.30.2 + diff --git a/queue-5.12/usb-chipidea-udc-assign-interrupt-number-to-usb-gadg.patch b/queue-5.12/usb-chipidea-udc-assign-interrupt-number-to-usb-gadg.patch new file mode 100644 index 00000000000..b065d5d3b7a --- /dev/null +++ b/queue-5.12/usb-chipidea-udc-assign-interrupt-number-to-usb-gadg.patch @@ -0,0 +1,103 @@ +From c6e5c3a5e5032517f64fd7e6c67367182de9014c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 18:59:44 +0800 +Subject: usb: chipidea: udc: assign interrupt number to USB gadget structure + +From: Li Jun + +[ Upstream commit 9e3927f6373da54cb17e17f4bd700907e1123d2f ] + +Chipidea also need sync interrupt before unbind the udc while +gadget remove driver, otherwise setup irq handling may happen +while unbind, see below dump generated from android function +switch stress test: + +[ 4703.503056] android_work: sent uevent USB_STATE=CONNECTED +[ 4703.514642] android_work: sent uevent USB_STATE=DISCONNECTED +[ 4703.651339] android_work: sent uevent USB_STATE=CONNECTED +[ 4703.661806] init: Control message: Processed ctl.stop for 'adbd' from pid: 561 (system_server) +[ 4703.673469] init: processing action (init.svc.adbd=stopped) from (/system/etc/init/hw/init.usb.configfs.rc:14) +[ 4703.676451] Unable to handle kernel read from unreadable memory at virtual address 0000000000000090 +[ 4703.676454] Mem abort info: +[ 4703.676458] ESR = 0x96000004 +[ 4703.676461] EC = 0x25: DABT (current EL), IL = 32 bits +[ 4703.676464] SET = 0, FnV = 0 +[ 4703.676466] EA = 0, S1PTW = 0 +[ 4703.676468] Data abort info: +[ 4703.676471] ISV = 0, ISS = 0x00000004 +[ 4703.676473] CM = 0, WnR = 0 +[ 4703.676478] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004a867000 +[ 4703.676481] [0000000000000090] pgd=0000000000000000, p4d=0000000000000000 +[ 4703.676503] Internal error: Oops: 96000004 [#1] PREEMPT SMP +[ 4703.758297] Modules linked in: synaptics_dsx_i2c moal(O) mlan(O) +[ 4703.764327] CPU: 0 PID: 235 Comm: lmkd Tainted: G W O 5.10.9-00001-g3f5fd8487c38-dirty #63 +[ 4703.773720] Hardware name: NXP i.MX8MNano EVK board (DT) +[ 4703.779033] pstate: 60400085 (nZCv daIf +PAN -UAO -TCO BTYPE=--) +[ 4703.785046] pc : _raw_write_unlock_bh+0xc0/0x2c8 +[ 4703.789667] lr : android_setup+0x4c/0x168 +[ 4703.793676] sp : ffff80001256bd80 +[ 4703.796989] x29: ffff80001256bd80 x28: 00000000000000a8 +[ 4703.802304] x27: ffff800012470000 x26: ffff80006d923000 +[ 4703.807616] x25: ffff800012471000 x24: ffff00000b091140 +[ 4703.812929] x23: ffff0000077dbd38 x22: ffff0000077da490 +[ 4703.818242] x21: ffff80001256be30 x20: 0000000000000000 +[ 4703.823554] x19: 0000000000000080 x18: ffff800012561048 +[ 4703.828867] x17: 0000000000000000 x16: 0000000000000039 +[ 4703.834180] x15: ffff8000106ad258 x14: ffff80001194c277 +[ 4703.839493] x13: 0000000000003934 x12: 0000000000000000 +[ 4703.844805] x11: 0000000000000000 x10: 0000000000000001 +[ 4703.850117] x9 : 0000000000000000 x8 : 0000000000000090 +[ 4703.855429] x7 : 6f72646e61203a70 x6 : ffff8000124f2450 +[ 4703.860742] x5 : ffffffffffffffff x4 : 0000000000000009 +[ 4703.866054] x3 : ffff8000108a290c x2 : ffff00007fb3a9c8 +[ 4703.871367] x1 : 0000000000000000 x0 : 0000000000000090 +[ 4703.876681] Call trace: +[ 4703.879129] _raw_write_unlock_bh+0xc0/0x2c8 +[ 4703.883397] android_setup+0x4c/0x168 +[ 4703.887059] udc_irq+0x824/0xa9c +[ 4703.890287] ci_irq+0x124/0x148 +[ 4703.893429] __handle_irq_event_percpu+0x84/0x268 +[ 4703.898131] handle_irq_event+0x64/0x14c +[ 4703.902054] handle_fasteoi_irq+0x110/0x210 +[ 4703.906236] __handle_domain_irq+0x8c/0xd4 +[ 4703.910332] gic_handle_irq+0x6c/0x124 +[ 4703.914081] el1_irq+0xdc/0x1c0 +[ 4703.917221] _raw_spin_unlock_irq+0x20/0x54 +[ 4703.921405] finish_task_switch+0x84/0x224 +[ 4703.925502] __schedule+0x4a4/0x734 +[ 4703.928990] schedule+0xa0/0xe8 +[ 4703.932132] do_notify_resume+0x150/0x184 +[ 4703.936140] work_pending+0xc/0x40c +[ 4703.939633] Code: d5384613 521b0a69 d5184609 f9800111 (885ffd01) +[ 4703.945732] ---[ end trace ba5c1875ae49d53c ]--- +[ 4703.950350] Kernel panic - not syncing: Oops: Fatal exception in interrupt +[ 4703.957223] SMP: stopping secondary CPUs +[ 4703.961151] Kernel Offset: disabled +[ 4703.964638] CPU features: 0x0240002,2000200c +[ 4703.968905] Memory Limit: none +[ 4703.971963] Rebooting in 5 seconds.. + +Tested-by: faqiang.zhu +Signed-off-by: Li Jun +Link: https://lore.kernel.org/r/1620989984-7653-1-git-send-email-jun.li@nxp.com +Signed-off-by: Peter Chen +Signed-off-by: Sasha Levin +--- + drivers/usb/chipidea/udc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index c16d900cdaee..393f216b9161 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -2061,6 +2061,7 @@ static int udc_start(struct ci_hdrc *ci) + ci->gadget.name = ci->platdata->name; + ci->gadget.otg_caps = otg_caps; + ci->gadget.sg_supported = 1; ++ ci->gadget.irq = ci->irq; + + if (ci->platdata->flags & CI_HDRC_REQUIRES_ALIGNED_DMA) + ci->gadget.quirk_avoids_skb_reserve = 1; +-- +2.30.2 + diff --git a/queue-5.12/vfio-ccw-reset-fsm-state-to-idle-inside-fsm.patch b/queue-5.12/vfio-ccw-reset-fsm-state-to-idle-inside-fsm.patch new file mode 100644 index 00000000000..67c0a88bf70 --- /dev/null +++ b/queue-5.12/vfio-ccw-reset-fsm-state-to-idle-inside-fsm.patch @@ -0,0 +1,57 @@ +From 137c55d8fd4ef578f607d01f121d026676be0fba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 21:56:30 +0200 +Subject: vfio-ccw: Reset FSM state to IDLE inside FSM + +From: Eric Farman + +[ Upstream commit 6c02ac4c9211edabe17bda437ac97e578756f31b ] + +When an I/O request is made, the fsm_io_request() routine +moves the FSM state from IDLE to CP_PROCESSING, and then +fsm_io_helper() moves it to CP_PENDING if the START SUBCHANNEL +received a cc0. Yet, the error case to go from CP_PROCESSING +back to IDLE is done after the FSM call returns. + +Let's move this up into the FSM proper, to provide some +better symmetry when unwinding in this case. + +Signed-off-by: Eric Farman +Reviewed-by: Cornelia Huck +Acked-by: Matthew Rosato +Message-Id: <20210511195631.3995081-3-farman@linux.ibm.com> +Signed-off-by: Cornelia Huck +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/vfio_ccw_fsm.c | 1 + + drivers/s390/cio/vfio_ccw_ops.c | 2 -- + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fsm.c +index 23e61aa638e4..e435a9cd92da 100644 +--- a/drivers/s390/cio/vfio_ccw_fsm.c ++++ b/drivers/s390/cio/vfio_ccw_fsm.c +@@ -318,6 +318,7 @@ static void fsm_io_request(struct vfio_ccw_private *private, + } + + err_out: ++ private->state = VFIO_CCW_STATE_IDLE; + trace_vfio_ccw_fsm_io_request(scsw->cmd.fctl, schid, + io_region->ret_code, errstr); + } +diff --git a/drivers/s390/cio/vfio_ccw_ops.c b/drivers/s390/cio/vfio_ccw_ops.c +index 767ac41686fe..5971641964c6 100644 +--- a/drivers/s390/cio/vfio_ccw_ops.c ++++ b/drivers/s390/cio/vfio_ccw_ops.c +@@ -276,8 +276,6 @@ static ssize_t vfio_ccw_mdev_write_io_region(struct vfio_ccw_private *private, + } + + vfio_ccw_fsm_event(private, VFIO_CCW_EVENT_IO_REQ); +- if (region->ret_code != 0) +- private->state = VFIO_CCW_STATE_IDLE; + ret = (region->ret_code != 0) ? region->ret_code : count; + + out_unlock: +-- +2.30.2 + diff --git a/queue-5.12/vfio-ccw-serialize-fsm-idle-state-with-i-o-completio.patch b/queue-5.12/vfio-ccw-serialize-fsm-idle-state-with-i-o-completio.patch new file mode 100644 index 00000000000..6b3901a4474 --- /dev/null +++ b/queue-5.12/vfio-ccw-serialize-fsm-idle-state-with-i-o-completio.patch @@ -0,0 +1,85 @@ +From bdb70788e2a041786de47e32571c0c9cdc72ccc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 21:56:31 +0200 +Subject: vfio-ccw: Serialize FSM IDLE state with I/O completion + +From: Eric Farman + +[ Upstream commit 2af7a834a435460d546f0cf0a8b8e4d259f1d910 ] + +Today, the stacked call to vfio_ccw_sch_io_todo() does three things: + + 1) Update a solicited IRB with CP information, and release the CP + if the interrupt was the end of a START operation. + 2) Copy the IRB data into the io_region, under the protection of + the io_mutex + 3) Reset the vfio-ccw FSM state to IDLE to acknowledge that + vfio-ccw can accept more work. + +The trouble is that step 3 is (A) invoked for both solicited and +unsolicited interrupts, and (B) sitting after the mutex for step 2. +This second piece becomes a problem if it processes an interrupt +for a CLEAR SUBCHANNEL while another thread initiates a START, +thus allowing the CP and FSM states to get out of sync. That is: + + CPU 1 CPU 2 + fsm_do_clear() + fsm_irq() + fsm_io_request() + vfio_ccw_sch_io_todo() + fsm_io_helper() + +Since the FSM state and CP should be kept in sync, let's make a +note when the CP is released, and rely on that as an indication +that the FSM should also be reset at the end of this routine and +open up the device for more work. + +Signed-off-by: Eric Farman +Acked-by: Matthew Rosato +Reviewed-by: Cornelia Huck +Message-Id: <20210511195631.3995081-4-farman@linux.ibm.com> +Signed-off-by: Cornelia Huck +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/vfio_ccw_drv.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/drivers/s390/cio/vfio_ccw_drv.c b/drivers/s390/cio/vfio_ccw_drv.c +index 8c625b530035..9b61e9b131ad 100644 +--- a/drivers/s390/cio/vfio_ccw_drv.c ++++ b/drivers/s390/cio/vfio_ccw_drv.c +@@ -86,6 +86,7 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) + struct vfio_ccw_private *private; + struct irb *irb; + bool is_final; ++ bool cp_is_finished = false; + + private = container_of(work, struct vfio_ccw_private, io_work); + irb = &private->irb; +@@ -94,14 +95,21 @@ static void vfio_ccw_sch_io_todo(struct work_struct *work) + (SCSW_ACTL_DEVACT | SCSW_ACTL_SCHACT)); + if (scsw_is_solicited(&irb->scsw)) { + cp_update_scsw(&private->cp, &irb->scsw); +- if (is_final && private->state == VFIO_CCW_STATE_CP_PENDING) ++ if (is_final && private->state == VFIO_CCW_STATE_CP_PENDING) { + cp_free(&private->cp); ++ cp_is_finished = true; ++ } + } + mutex_lock(&private->io_mutex); + memcpy(private->io_region->irb_area, irb, sizeof(*irb)); + mutex_unlock(&private->io_mutex); + +- if (private->mdev && is_final) ++ /* ++ * Reset to IDLE only if processing of a channel program ++ * has finished. Do not overwrite a possible processing ++ * state if the final interrupt was for HSCH or CSCH. ++ */ ++ if (private->mdev && cp_is_finished) + private->state = VFIO_CCW_STATE_IDLE; + + if (private->io_trigger) +-- +2.30.2 + diff --git a/queue-5.12/wq-handle-vm-suspension-in-stall-detection.patch b/queue-5.12/wq-handle-vm-suspension-in-stall-detection.patch new file mode 100644 index 00000000000..0133e56f6f0 --- /dev/null +++ b/queue-5.12/wq-handle-vm-suspension-in-stall-detection.patch @@ -0,0 +1,89 @@ +From f7668818020e2d467a27105e6e71b919e89c9c3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 19:14:22 +0900 +Subject: wq: handle VM suspension in stall detection + +From: Sergey Senozhatsky + +[ Upstream commit 940d71c6462e8151c78f28e4919aa8882ff2054e ] + +If VCPU is suspended (VM suspend) in wq_watchdog_timer_fn() then +once this VCPU resumes it will see the new jiffies value, while it +may take a while before IRQ detects PVCLOCK_GUEST_STOPPED on this +VCPU and updates all the watchdogs via pvclock_touch_watchdogs(). +There is a small chance of misreported WQ stalls in the meantime, +because new jiffies is time_after() old 'ts + thresh'. + +wq_watchdog_timer_fn() +{ + for_each_pool(pool, pi) { + if (time_after(jiffies, ts + thresh)) { + pr_emerg("BUG: workqueue lockup - pool"); + } + } +} + +Save jiffies at the beginning of this function and use that value +for stall detection. If VM gets suspended then we continue using +"old" jiffies value and old WQ touch timestamps. If IRQ at some +point restarts the stall detection cycle (pvclock_touch_watchdogs()) +then old jiffies will always be before new 'ts + thresh'. + +Signed-off-by: Sergey Senozhatsky +Signed-off-by: Tejun Heo +Signed-off-by: Sasha Levin +--- + kernel/workqueue.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 79f2319543ce..994eafd25d64 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -50,6 +50,7 @@ + #include + #include + #include ++#include + + #include "workqueue_internal.h" + +@@ -5772,6 +5773,7 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) + { + unsigned long thresh = READ_ONCE(wq_watchdog_thresh) * HZ; + bool lockup_detected = false; ++ unsigned long now = jiffies; + struct worker_pool *pool; + int pi; + +@@ -5786,6 +5788,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) + if (list_empty(&pool->worklist)) + continue; + ++ /* ++ * If a virtual machine is stopped by the host it can look to ++ * the watchdog like a stall. ++ */ ++ kvm_check_and_clear_guest_paused(); ++ + /* get the latest of pool and touched timestamps */ + if (pool->cpu >= 0) + touched = READ_ONCE(per_cpu(wq_watchdog_touched_cpu, pool->cpu)); +@@ -5799,12 +5807,12 @@ static void wq_watchdog_timer_fn(struct timer_list *unused) + ts = touched; + + /* did we stall? */ +- if (time_after(jiffies, ts + thresh)) { ++ if (time_after(now, ts + thresh)) { + lockup_detected = true; + pr_emerg("BUG: workqueue lockup - pool"); + pr_cont_pool_info(pool); + pr_cont(" stuck for %us!\n", +- jiffies_to_msecs(jiffies - pool_ts) / 1000); ++ jiffies_to_msecs(now - pool_ts) / 1000); + } + } + +-- +2.30.2 +