From: Sasha Levin Date: Sun, 21 Nov 2021 23:00:34 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v5.15.5~81 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=d7e21e063520530bc45a4284217f7e4a27f9b42f;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch b/queue-5.4/alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch new file mode 100644 index 00000000000..e0c66e341d9 --- /dev/null +++ b/queue-5.4/alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch @@ -0,0 +1,37 @@ +From ed2833aa5ae0a09c9cc40b456d56f040ebcaaacb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Oct 2021 03:46:11 -0700 +Subject: ALSA: gus: fix null pointer dereference on pointer block + +From: Chengfeng Ye + +[ Upstream commit a0d21bb3279476c777434c40d969ea88ca64f9aa ] + +The pointer block return from snd_gf1_dma_next_block could be +null, so there is a potential null pointer dereference issue. +Fix this by adding a null check before dereference. + +Signed-off-by: Chengfeng Ye +Link: https://lore.kernel.org/r/20211024104611.9919-1-cyeaa@connect.ust.hk +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/isa/gus/gus_dma.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c +index a1c770d826dda..6d664dd8dde0b 100644 +--- a/sound/isa/gus/gus_dma.c ++++ b/sound/isa/gus/gus_dma.c +@@ -126,6 +126,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus) + } + block = snd_gf1_dma_next_block(gus); + spin_unlock(&gus->dma_lock); ++ if (!block) ++ return; + snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd); + kfree(block); + #if 0 +-- +2.33.0 + diff --git a/queue-5.4/alsa-isa-not-for-m68k.patch b/queue-5.4/alsa-isa-not-for-m68k.patch new file mode 100644 index 00000000000..842545306f2 --- /dev/null +++ b/queue-5.4/alsa-isa-not-for-m68k.patch @@ -0,0 +1,88 @@ +From 41ba5d8dad96ec4ea24738d22921f73b6e23f7b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 23:26:02 -0700 +Subject: ALSA: ISA: not for M68K + +From: Randy Dunlap + +[ Upstream commit 3c05f1477e62ea5a0a8797ba6a545b1dc751fb31 ] + +On m68k, compiling drivers under SND_ISA causes build errors: + +../sound/core/isadma.c: In function 'snd_dma_program': +../sound/core/isadma.c:33:17: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration] + 33 | flags = claim_dma_lock(); + | ^~~~~~~~~~~~~~ +../sound/core/isadma.c:41:9: error: implicit declaration of function 'release_dma_lock' [-Werror=implicit-function-declaration] + 41 | release_dma_lock(flags); + | ^~~~~~~~~~~~~~~~ + +../sound/isa/sb/sb16_main.c: In function 'snd_sb16_playback_prepare': +../sound/isa/sb/sb16_main.c:253:72: error: 'DMA_AUTOINIT' undeclared (first use in this function) + 253 | snd_dma_program(dma, runtime->dma_addr, size, DMA_MODE_WRITE | DMA_AUTOINIT); + | ^~~~~~~~~~~~ +../sound/isa/sb/sb16_main.c:253:72: note: each undeclared identifier is reported only once for each function it appears in +../sound/isa/sb/sb16_main.c: In function 'snd_sb16_capture_prepare': +../sound/isa/sb/sb16_main.c:322:71: error: 'DMA_AUTOINIT' undeclared (first use in this function) + 322 | snd_dma_program(dma, runtime->dma_addr, size, DMA_MODE_READ | DMA_AUTOINIT); + | ^~~~~~~~~~~~ + +and more... + +Signed-off-by: Randy Dunlap +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: alsa-devel@alsa-project.org +Cc: linux-m68k@lists.linux-m68k.org +Cc: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20211016062602.3588-1-rdunlap@infradead.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/Makefile | 2 ++ + sound/isa/Kconfig | 2 +- + sound/pci/Kconfig | 1 + + 3 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/core/Makefile b/sound/core/Makefile +index ee4a4a6b99ba7..d123587c0fd8f 100644 +--- a/sound/core/Makefile ++++ b/sound/core/Makefile +@@ -9,7 +9,9 @@ ifneq ($(CONFIG_SND_PROC_FS),) + snd-y += info.o + snd-$(CONFIG_SND_OSSEMUL) += info_oss.o + endif ++ifneq ($(CONFIG_M68K),y) + snd-$(CONFIG_ISA_DMA_API) += isadma.o ++endif + snd-$(CONFIG_SND_OSSEMUL) += sound_oss.o + snd-$(CONFIG_SND_VMASTER) += vmaster.o + snd-$(CONFIG_SND_JACK) += ctljack.o jack.o +diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig +index b690ed937cbe8..df2e45c8814e9 100644 +--- a/sound/isa/Kconfig ++++ b/sound/isa/Kconfig +@@ -22,7 +22,7 @@ config SND_SB16_DSP + menuconfig SND_ISA + bool "ISA sound devices" + depends on ISA || COMPILE_TEST +- depends on ISA_DMA_API ++ depends on ISA_DMA_API && !M68K + default y + help + Support for sound devices connected via the ISA bus. +diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig +index 7630f808d087c..6edde2f145025 100644 +--- a/sound/pci/Kconfig ++++ b/sound/pci/Kconfig +@@ -279,6 +279,7 @@ config SND_CS46XX_NEW_DSP + config SND_CS5530 + tristate "CS5530 Audio" + depends on ISA_DMA_API && (X86_32 || COMPILE_TEST) ++ depends on !M68K + select SND_SB16_DSP + help + Say Y here to include support for audio on Cyrix/NatSemi CS5530 chips. +-- +2.33.0 + diff --git a/queue-5.4/arm-dts-ls1021a-move-thermal-zones-node-out-of-soc.patch b/queue-5.4/arm-dts-ls1021a-move-thermal-zones-node-out-of-soc.patch new file mode 100644 index 00000000000..5ffc9937c59 --- /dev/null +++ b/queue-5.4/arm-dts-ls1021a-move-thermal-zones-node-out-of-soc.patch @@ -0,0 +1,105 @@ +From 64d03fd27d91c5c48d34dfb1d8450ffca746b27d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 18:58:22 -0500 +Subject: ARM: dts: ls1021a: move thermal-zones node out of soc/ + +From: Li Yang + +[ Upstream commit 1ee1500ef717eefb5d9bdaf97905cb81b4e69aa4 ] + +This fixes dtbs-check error from simple-bus schema: +soc: thermal-zones: {'type': 'object'} is not allowed for {'cpu-thermal': ..... } + From schema: /home/leo/.local/lib/python3.8/site-packages/dtschema/schemas/simple-bus.yaml + +Signed-off-by: Li Yang +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ls1021a.dtsi | 66 +++++++++++++++++----------------- + 1 file changed, 33 insertions(+), 33 deletions(-) + +diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi +index c62fcca7b4263..aeb8a40b6b601 100644 +--- a/arch/arm/boot/dts/ls1021a.dtsi ++++ b/arch/arm/boot/dts/ls1021a.dtsi +@@ -311,39 +311,6 @@ + #thermal-sensor-cells = <1>; + }; + +- thermal-zones { +- cpu_thermal: cpu-thermal { +- polling-delay-passive = <1000>; +- polling-delay = <5000>; +- +- thermal-sensors = <&tmu 0>; +- +- trips { +- cpu_alert: cpu-alert { +- temperature = <85000>; +- hysteresis = <2000>; +- type = "passive"; +- }; +- cpu_crit: cpu-crit { +- temperature = <95000>; +- hysteresis = <2000>; +- type = "critical"; +- }; +- }; +- +- cooling-maps { +- map0 { +- trip = <&cpu_alert>; +- cooling-device = +- <&cpu0 THERMAL_NO_LIMIT +- THERMAL_NO_LIMIT>, +- <&cpu1 THERMAL_NO_LIMIT +- THERMAL_NO_LIMIT>; +- }; +- }; +- }; +- }; +- + dspi0: spi@2100000 { + compatible = "fsl,ls1021a-v1.0-dspi"; + #address-cells = <1>; +@@ -984,4 +951,37 @@ + }; + + }; ++ ++ thermal-zones { ++ cpu_thermal: cpu-thermal { ++ polling-delay-passive = <1000>; ++ polling-delay = <5000>; ++ ++ thermal-sensors = <&tmu 0>; ++ ++ trips { ++ cpu_alert: cpu-alert { ++ temperature = <85000>; ++ hysteresis = <2000>; ++ type = "passive"; ++ }; ++ cpu_crit: cpu-crit { ++ temperature = <95000>; ++ hysteresis = <2000>; ++ type = "critical"; ++ }; ++ }; ++ ++ cooling-maps { ++ map0 { ++ trip = <&cpu_alert>; ++ cooling-device = ++ <&cpu0 THERMAL_NO_LIMIT ++ THERMAL_NO_LIMIT>, ++ <&cpu1 THERMAL_NO_LIMIT ++ THERMAL_NO_LIMIT>; ++ }; ++ }; ++ }; ++ }; + }; +-- +2.33.0 + diff --git a/queue-5.4/arm-dts-ls1021a-tsn-use-generic-jedec-spi-nor-compat.patch b/queue-5.4/arm-dts-ls1021a-tsn-use-generic-jedec-spi-nor-compat.patch new file mode 100644 index 00000000000..8cf3106d561 --- /dev/null +++ b/queue-5.4/arm-dts-ls1021a-tsn-use-generic-jedec-spi-nor-compat.patch @@ -0,0 +1,39 @@ +From 5e89c4e7017d867bc12a02b31e95ea42256048df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 18:58:23 -0500 +Subject: ARM: dts: ls1021a-tsn: use generic "jedec,spi-nor" compatible for + flash + +From: Li Yang + +[ Upstream commit 05e63b48b20fa70726be505a7660d1a07bc1cffb ] + +We cannot list all the possible chips used in different board revisions, +just use the generic "jedec,spi-nor" compatible instead. This also +fixes dtbs_check error: +['jedec,spi-nor', 's25fl256s1', 's25fl512s'] is too long + +Signed-off-by: Li Yang +Reviewed-by: Kuldeep Singh +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ls1021a-tsn.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/ls1021a-tsn.dts b/arch/arm/boot/dts/ls1021a-tsn.dts +index 5b7689094b70e..7235ce2a32936 100644 +--- a/arch/arm/boot/dts/ls1021a-tsn.dts ++++ b/arch/arm/boot/dts/ls1021a-tsn.dts +@@ -247,7 +247,7 @@ + + flash@0 { + /* Rev. A uses 64MB flash, Rev. B & C use 32MB flash */ +- compatible = "jedec,spi-nor", "s25fl256s1", "s25fl512s"; ++ compatible = "jedec,spi-nor"; + spi-max-frequency = <20000000>; + #address-cells = <1>; + #size-cells = <1>; +-- +2.33.0 + diff --git a/queue-5.4/arm-dts-nsp-fix-mpcore-mmc-node-names.patch b/queue-5.4/arm-dts-nsp-fix-mpcore-mmc-node-names.patch new file mode 100644 index 00000000000..55516d0a06b --- /dev/null +++ b/queue-5.4/arm-dts-nsp-fix-mpcore-mmc-node-names.patch @@ -0,0 +1,50 @@ +From 7f2e3fc038c9fb2e6e069b2839dec531b0630308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Aug 2021 22:37:48 +0000 +Subject: ARM: dts: NSP: Fix mpcore, mmc node names + +From: Matthew Hagan + +[ Upstream commit 15a563d008ef9d04df525f0c476cd7d7127bb883 ] + +Running dtbs_check yielded the issues with bcm-nsp.dtsi. + +Firstly this patch fixes the following message by appending "-bus" to +the mpcore node name: +mpcore@19000000: $nodename:0: 'mpcore@19000000' does not match '^([a-z][a-z0-9\\-]+-bus|bus|soc|axi|ahb|apb)(@[0-9a-f]+)?$' + +Secondly mmc node name. The label name can remain as is. +sdhci@21000: $nodename:0: 'sdhci@21000' does not match '^mmc(@.*)?$' + +Signed-off-by: Matthew Hagan +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm-nsp.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm-nsp.dtsi b/arch/arm/boot/dts/bcm-nsp.dtsi +index 43ff85d31dc12..5a1352fd90d16 100644 +--- a/arch/arm/boot/dts/bcm-nsp.dtsi ++++ b/arch/arm/boot/dts/bcm-nsp.dtsi +@@ -77,7 +77,7 @@ + interrupt-affinity = <&cpu0>, <&cpu1>; + }; + +- mpcore@19000000 { ++ mpcore-bus@19000000 { + compatible = "simple-bus"; + ranges = <0x00000000 0x19000000 0x00023000>; + #address-cells = <1>; +@@ -217,7 +217,7 @@ + #dma-cells = <1>; + }; + +- sdio: sdhci@21000 { ++ sdio: mmc@21000 { + compatible = "brcm,sdhci-iproc-cygnus"; + reg = <0x21000 0x100>; + interrupts = ; +-- +2.33.0 + diff --git a/queue-5.4/arm-dts-omap-fix-gpmc-mux-add-data-type.patch b/queue-5.4/arm-dts-omap-fix-gpmc-mux-add-data-type.patch new file mode 100644 index 00000000000..7c20355bf96 --- /dev/null +++ b/queue-5.4/arm-dts-omap-fix-gpmc-mux-add-data-type.patch @@ -0,0 +1,52 @@ +From 1942c5afe2bdb0cffd798a0eccbb36dd1d75ee78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 15:08:30 +0300 +Subject: ARM: dts: omap: fix gpmc,mux-add-data type + +From: Roger Quadros + +[ Upstream commit 51b9e22ffd3c4c56cbb7caae9750f70e55ffa603 ] + +gpmc,mux-add-data is not boolean. + +Fixes the below errors flagged by dtbs_check. + +"ethernet@4,0:gpmc,mux-add-data: True is not of type 'array'" + +Signed-off-by: Roger Quadros +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 2 +- + arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +index 7f6aefd134514..e7534fe9c53cf 100644 +--- a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi ++++ b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +@@ -29,7 +29,7 @@ + compatible = "smsc,lan9221","smsc,lan9115"; + bank-width = <2>; + +- gpmc,mux-add-data; ++ gpmc,mux-add-data = <0>; + gpmc,cs-on-ns = <0>; + gpmc,cs-rd-off-ns = <42>; + gpmc,cs-wr-off-ns = <36>; +diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi +index e5da3bc6f1050..218a10c0d8159 100644 +--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi ++++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi +@@ -22,7 +22,7 @@ + compatible = "smsc,lan9221","smsc,lan9115"; + bank-width = <2>; + +- gpmc,mux-add-data; ++ gpmc,mux-add-data = <0>; + gpmc,cs-on-ns = <0>; + gpmc,cs-rd-off-ns = <42>; + gpmc,cs-wr-off-ns = <36>; +-- +2.33.0 + diff --git a/queue-5.4/arm64-dts-freescale-fix-arm-sp805-compatible-string.patch b/queue-5.4/arm64-dts-freescale-fix-arm-sp805-compatible-string.patch new file mode 100644 index 00000000000..71ffdc713d7 --- /dev/null +++ b/queue-5.4/arm64-dts-freescale-fix-arm-sp805-compatible-string.patch @@ -0,0 +1,164 @@ +From 8fd2f33575a01022829a7405b06dcbea18a4df8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 14:35:28 +0200 +Subject: arm64: dts: freescale: fix arm,sp805 compatible string + +From: Michael Walle + +[ Upstream commit 99a7cacc66cae92db40139b57689be2af75fc6b8 ] + +According to Documentation/devicetree/bindings/watchdog/arm,sp805.yaml +the compatible is: + compatible = "arm,sp805", "arm,primecell"; + +The current compatible string doesn't exist at all. Fix it. + +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 16 ++++++++-------- + arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 16 ++++++++-------- + 2 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +index 407ebdb35cd2e..6b1b728de9e9c 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +@@ -637,56 +637,56 @@ + }; + + cluster1_core0_watchdog: wdt@c000000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc000000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core1_watchdog: wdt@c010000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc010000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core2_watchdog: wdt@c020000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc020000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core3_watchdog: wdt@c030000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc030000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core0_watchdog: wdt@c100000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc100000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core1_watchdog: wdt@c110000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc110000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core2_watchdog: wdt@c120000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc120000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core3_watchdog: wdt@c130000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc130000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +index 82f0fe6acbfb7..4bf4a22faa61a 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +@@ -227,56 +227,56 @@ + }; + + cluster1_core0_watchdog: wdt@c000000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc000000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster1_core1_watchdog: wdt@c010000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc010000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core0_watchdog: wdt@c100000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc100000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster2_core1_watchdog: wdt@c110000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc110000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster3_core0_watchdog: wdt@c200000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc200000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster3_core1_watchdog: wdt@c210000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc210000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster4_core0_watchdog: wdt@c300000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc300000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; + }; + + cluster4_core1_watchdog: wdt@c310000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc310000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "wdog_clk", "apb_pclk"; +-- +2.33.0 + diff --git a/queue-5.4/arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch b/queue-5.4/arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch new file mode 100644 index 00000000000..6e4edb22923 --- /dev/null +++ b/queue-5.4/arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch @@ -0,0 +1,61 @@ +From cf1824a06940a20af63888d9480ab66f444f9896 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 18:51:13 +0200 +Subject: arm64: dts: hisilicon: fix arm,sp805 compatible string + +From: Michael Walle + +[ Upstream commit 894d4f1f77d0e88f1f81af2e1e37333c1c41b631 ] + +According to Documentation/devicetree/bindings/watchdog/arm,sp805.yaml +the compatible is: + compatible = "arm,sp805", "arm,primecell"; + +The current compatible string doesn't exist at all. Fix it. + +Signed-off-by: Michael Walle +Signed-off-by: Wei Xu +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/hisilicon/hi3660.dtsi | 4 ++-- + arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi +index 253cc345f143a..0c88b72094774 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi ++++ b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi +@@ -1086,7 +1086,7 @@ + }; + + watchdog0: watchdog@e8a06000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xe8a06000 0x0 0x1000>; + interrupts = ; + clocks = <&crg_ctrl HI3660_OSC32K>; +@@ -1094,7 +1094,7 @@ + }; + + watchdog1: watchdog@e8a07000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xe8a07000 0x0 0x1000>; + interrupts = ; + clocks = <&crg_ctrl HI3660_OSC32K>; +diff --git a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi +index 108e2a4227f66..568faaba7ace9 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi ++++ b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi +@@ -839,7 +839,7 @@ + }; + + watchdog0: watchdog@f8005000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xf8005000 0x0 0x1000>; + interrupts = ; + clocks = <&ao_ctrl HI6220_WDT0_PCLK>; +-- +2.33.0 + diff --git a/queue-5.4/arm64-dts-qcom-msm8916-add-unit-name-for-soc-node.patch b/queue-5.4/arm64-dts-qcom-msm8916-add-unit-name-for-soc-node.patch new file mode 100644 index 00000000000..b322ec200c7 --- /dev/null +++ b/queue-5.4/arm64-dts-qcom-msm8916-add-unit-name-for-soc-node.patch @@ -0,0 +1,38 @@ +From 6f3fc87c4fc329cc325edd2494c8baa24f826c85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 17:21:18 +0200 +Subject: arm64: dts: qcom: msm8916: Add unit name for /soc node + +From: Stephan Gerhold + +[ Upstream commit 7a62bfebc8c94bdb6eb8f54f49889dc6b5b79601 ] + +This fixes the following warning when building with W=1: +Warning (unit_address_vs_reg): /soc: node has a reg or ranges property, +but no unit name + +Signed-off-by: Stephan Gerhold +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210921152120.6710-1-stephan@gerhold.net +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8916.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi +index 449843f2184d8..1063f64f73ca4 100644 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi +@@ -358,7 +358,7 @@ + }; + }; + +- soc: soc { ++ soc: soc@0 { + #address-cells = <1>; + #size-cells = <1>; + ranges = <0 0 0 0xffffffff>; +-- +2.33.0 + diff --git a/queue-5.4/arm64-dts-qcom-msm8998-fix-cpu-l2-idle-state-latency.patch b/queue-5.4/arm64-dts-qcom-msm8998-fix-cpu-l2-idle-state-latency.patch new file mode 100644 index 00000000000..6c6446c3a09 --- /dev/null +++ b/queue-5.4/arm64-dts-qcom-msm8998-fix-cpu-l2-idle-state-latency.patch @@ -0,0 +1,95 @@ +From f74d0ac78f618674cb1f34bbe4e7e52e570da47d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Sep 2021 20:31:21 +0200 +Subject: arm64: dts: qcom: msm8998: Fix CPU/L2 idle state latency and + residency + +From: AngeloGioacchino Del Regno + +[ Upstream commit 3f1dcaff642e75c1d2ad03f783fa8a3b1f56dd50 ] + +The entry/exit latency and minimum residency in state for the idle +states of MSM8998 were ..bad: first of all, for all of them the +timings were written for CPU sleep but the min-residency-us param +was miscalculated (supposedly, while porting this from downstream); +Then, the power collapse states are setting PC on both the CPU +cluster *and* the L2 cache, which have different timings: in the +specific case of L2 the times are higher so these ones should be +taken into account instead of the CPU ones. + +This parameter misconfiguration was not giving particular issues +because on MSM8998 there was no CPU scaling at all, so cluster/L2 +power collapse was rarely (if ever) hit. +When CPU scaling is enabled, though, the wrong timings will produce +SoC unstability shown to the user as random, apparently error-less, +sudden reboots and/or lockups. + +This set of parameters are stabilizing the SoC when CPU scaling is +ON and when power collapse is frequently hit. + +Signed-off-by: AngeloGioacchino Del Regno +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20210901183123.1087392-3-angelogioacchino.delregno@somainline.org +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8998.dtsi | 20 ++++++++++++-------- + 1 file changed, 12 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/msm8998.dtsi b/arch/arm64/boot/dts/qcom/msm8998.dtsi +index ccd535edbf4e1..dcb79003ca0e6 100644 +--- a/arch/arm64/boot/dts/qcom/msm8998.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8998.dtsi +@@ -246,38 +246,42 @@ + LITTLE_CPU_SLEEP_0: cpu-sleep-0-0 { + compatible = "arm,idle-state"; + idle-state-name = "little-retention"; ++ /* CPU Retention (C2D), L2 Active */ + arm,psci-suspend-param = <0x00000002>; + entry-latency-us = <81>; + exit-latency-us = <86>; +- min-residency-us = <200>; ++ min-residency-us = <504>; + }; + + LITTLE_CPU_SLEEP_1: cpu-sleep-0-1 { + compatible = "arm,idle-state"; + idle-state-name = "little-power-collapse"; ++ /* CPU + L2 Power Collapse (C3, D4) */ + arm,psci-suspend-param = <0x40000003>; +- entry-latency-us = <273>; +- exit-latency-us = <612>; +- min-residency-us = <1000>; ++ entry-latency-us = <814>; ++ exit-latency-us = <4562>; ++ min-residency-us = <9183>; + local-timer-stop; + }; + + BIG_CPU_SLEEP_0: cpu-sleep-1-0 { + compatible = "arm,idle-state"; + idle-state-name = "big-retention"; ++ /* CPU Retention (C2D), L2 Active */ + arm,psci-suspend-param = <0x00000002>; + entry-latency-us = <79>; + exit-latency-us = <82>; +- min-residency-us = <200>; ++ min-residency-us = <1302>; + }; + + BIG_CPU_SLEEP_1: cpu-sleep-1-1 { + compatible = "arm,idle-state"; + idle-state-name = "big-power-collapse"; ++ /* CPU + L2 Power Collapse (C3, D4) */ + arm,psci-suspend-param = <0x40000003>; +- entry-latency-us = <336>; +- exit-latency-us = <525>; +- min-residency-us = <1000>; ++ entry-latency-us = <724>; ++ exit-latency-us = <2027>; ++ min-residency-us = <9419>; + local-timer-stop; + }; + }; +-- +2.33.0 + diff --git a/queue-5.4/arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch b/queue-5.4/arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch new file mode 100644 index 00000000000..08062caacd5 --- /dev/null +++ b/queue-5.4/arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch @@ -0,0 +1,54 @@ +From 24e70a6ab61a0aea6b3092836459e94dbe3418b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 17:25:10 +0200 +Subject: arm64: zynqmp: Do not duplicate flash partition label property + +From: Amit Kumar Mahapatra + +[ Upstream commit 167721a5909f867f8c18c8e78ea58e705ad9bbd4 ] + +In kernel 5.4, support has been added for reading MTD devices via the nvmem +API. +For this the mtd devices are registered as read-only NVMEM providers under +sysfs with the same name as the flash partition label property. + +So if flash partition label property of multiple flash devices are +identical then the second mtd device fails to get registered as a NVMEM +provider. + +This patch fixes the issue by having different label property for different +flashes. + +Signed-off-by: Amit Kumar Mahapatra +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/6c4b9b9232b93d9e316a63c086540fd5bf6b8687.1623684253.git.michal.simek@xilinx.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts +index 2421ec71a201c..41a66787247b6 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts ++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts +@@ -131,7 +131,7 @@ + reg = <0>; + + partition@0 { +- label = "data"; ++ label = "spi0-data"; + reg = <0x0 0x100000>; + }; + }; +@@ -149,7 +149,7 @@ + reg = <0>; + + partition@0 { +- label = "data"; ++ label = "spi1-data"; + reg = <0x0 0x84000>; + }; + }; +-- +2.33.0 + diff --git a/queue-5.4/arm64-zynqmp-fix-serial-compatible-string.patch b/queue-5.4/arm64-zynqmp-fix-serial-compatible-string.patch new file mode 100644 index 00000000000..b6a9e3e96d1 --- /dev/null +++ b/queue-5.4/arm64-zynqmp-fix-serial-compatible-string.patch @@ -0,0 +1,46 @@ +From 3356c2053c70462fe563a84bd9d8cdfd090d4ad2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 10:58:29 +0200 +Subject: arm64: zynqmp: Fix serial compatible string + +From: Michal Simek + +[ Upstream commit 812fa2f0e9d33564bd0131a69750e0d165f4c82a ] + +Based on commit 65a2c14d4f00 ("dt-bindings: serial: convert Cadence UART +bindings to YAML") compatible string should look like differently that's +why fix it to be aligned with dt binding. + +Signed-off-by: Michal Simek +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/89b36e0a6187cc6b05b27a035efdf79173bd4486.1628240307.git.michal.simek@xilinx.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +index a2645262f8623..b92549fb32400 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +@@ -582,7 +582,7 @@ + }; + + uart0: serial@ff000000 { +- compatible = "cdns,uart-r1p12", "xlnx,xuartps"; ++ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12"; + status = "disabled"; + interrupt-parent = <&gic>; + interrupts = <0 21 4>; +@@ -591,7 +591,7 @@ + }; + + uart1: serial@ff010000 { +- compatible = "cdns,uart-r1p12", "xlnx,xuartps"; ++ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12"; + status = "disabled"; + interrupt-parent = <&gic>; + interrupts = <0 22 4>; +-- +2.33.0 + diff --git a/queue-5.4/asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch b/queue-5.4/asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch new file mode 100644 index 00000000000..28fe140c9a1 --- /dev/null +++ b/queue-5.4/asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch @@ -0,0 +1,98 @@ +From 70a01e946cba59d99a38ac7e9f55f011740929c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Oct 2021 23:14:57 +0200 +Subject: ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect + +From: Hans de Goede + +[ Upstream commit 92d3360108f1839ca40451bad20ff67dd24a1964 ] + +Add a quirk mechanism to allow specifying that active-high jack-detection +should be used on platforms where this info is not available in devicetree. + +And add an entry for the Cyberbook T116 tablet to the DMI table, so that +jack-detection will work properly on this tablet. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20211002211459.110124-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8824.c | 40 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c +index 15bd8335f6678..c8ccfa2fff848 100644 +--- a/sound/soc/codecs/nau8824.c ++++ b/sound/soc/codecs/nau8824.c +@@ -8,6 +8,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -27,6 +28,12 @@ + + #include "nau8824.h" + ++#define NAU8824_JD_ACTIVE_HIGH BIT(0) ++ ++static int nau8824_quirk; ++static int quirk_override = -1; ++module_param_named(quirk, quirk_override, uint, 0444); ++MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static int nau8824_config_sysclk(struct nau8824 *nau8824, + int clk_id, unsigned int freq); +@@ -1875,6 +1882,34 @@ static int nau8824_read_device_properties(struct device *dev, + return 0; + } + ++/* Please keep this list alphabetically sorted */ ++static const struct dmi_system_id nau8824_quirk_table[] = { ++ { ++ /* Cyberbook T116 rugged tablet */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "20170531"), ++ }, ++ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH), ++ }, ++ {} ++}; ++ ++static void nau8824_check_quirks(void) ++{ ++ const struct dmi_system_id *dmi_id; ++ ++ if (quirk_override != -1) { ++ nau8824_quirk = quirk_override; ++ return; ++ } ++ ++ dmi_id = dmi_first_match(nau8824_quirk_table); ++ if (dmi_id) ++ nau8824_quirk = (unsigned long)dmi_id->driver_data; ++} ++ + static int nau8824_i2c_probe(struct i2c_client *i2c, + const struct i2c_device_id *id) + { +@@ -1899,6 +1934,11 @@ static int nau8824_i2c_probe(struct i2c_client *i2c, + nau8824->irq = i2c->irq; + sema_init(&nau8824->jd_sem, 1); + ++ nau8824_check_quirks(); ++ ++ if (nau8824_quirk & NAU8824_JD_ACTIVE_HIGH) ++ nau8824->jkdet_polarity = 0; ++ + nau8824_print_device_properties(nau8824); + + ret = regmap_read(nau8824->regmap, NAU8824_REG_I2C_DEVICE_ID, &value); +-- +2.33.0 + diff --git a/queue-5.4/asoc-sof-intel-hda-dai-fix-potential-locking-issue.patch b/queue-5.4/asoc-sof-intel-hda-dai-fix-potential-locking-issue.patch new file mode 100644 index 00000000000..6358c71e40a --- /dev/null +++ b/queue-5.4/asoc-sof-intel-hda-dai-fix-potential-locking-issue.patch @@ -0,0 +1,53 @@ +From f695ae757b454a8bfccc8afa4b4a7f7b758b81f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Sep 2021 14:24:17 -0500 +Subject: ASoC: SOF: Intel: hda-dai: fix potential locking issue + +From: Pierre-Louis Bossart + +[ Upstream commit a20f3b10de61add5e14b6ce4df982f4df2a4cbbc ] + +The initial hdac_stream code was adapted a third time with the same +locking issues. Move the spin_lock outside the loops and make sure the +fields are protected on read/write. + +Signed-off-by: Pierre-Louis Bossart +Acked-by: Mark Brown +Link: https://lore.kernel.org/r/20210924192417.169243-5-pierre-louis.bossart@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-dai.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c +index 3f645200d3a5c..b3cdd10c83ae1 100644 +--- a/sound/soc/sof/intel/hda-dai.c ++++ b/sound/soc/sof/intel/hda-dai.c +@@ -67,6 +67,7 @@ static struct hdac_ext_stream * + return NULL; + } + ++ spin_lock_irq(&bus->reg_lock); + list_for_each_entry(stream, &bus->stream_list, list) { + struct hdac_ext_stream *hstream = + stream_to_hdac_ext_stream(stream); +@@ -106,12 +107,12 @@ static struct hdac_ext_stream * + * is updated in snd_hdac_ext_stream_decouple(). + */ + if (!res->decoupled) +- snd_hdac_ext_stream_decouple(bus, res, true); +- spin_lock_irq(&bus->reg_lock); ++ snd_hdac_ext_stream_decouple_locked(bus, res, true); ++ + res->link_locked = 1; + res->link_substream = substream; +- spin_unlock_irq(&bus->reg_lock); + } ++ spin_unlock_irq(&bus->reg_lock); + + return res; + } +-- +2.33.0 + diff --git a/queue-5.4/clk-ast2600-fix-soc-revision-for-ahb.patch b/queue-5.4/clk-ast2600-fix-soc-revision-for-ahb.patch new file mode 100644 index 00000000000..a119fb1a9e8 --- /dev/null +++ b/queue-5.4/clk-ast2600-fix-soc-revision-for-ahb.patch @@ -0,0 +1,80 @@ +From 9f39bf3277ceb4f5f2e8e8edfe952573618b3d24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Sep 2021 09:24:49 +0930 +Subject: clk/ast2600: Fix soc revision for AHB + +From: Joel Stanley + +[ Upstream commit f45c5b1c27293f834682e89003f88b3512329ab4 ] + +Move the soc revision parsing to the initial probe, saving the driver +from parsing the register multiple times. + +Use this variable to select the correct divisor table for the AHB clock. +Before this fix the A2 would have used the A0 table. + +Fixes: 2d491066ccd4 ("clk: ast2600: Fix AHB clock divider for A1") +Signed-off-by: Joel Stanley +Link: https://lore.kernel.org/r/20210922235449.213631-1-joel@jms.id.au +Reviewed-by: Andrew Jeffery +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-ast2600.c | 12 +++++++----- + 1 file changed, 7 insertions(+), 5 deletions(-) + +diff --git a/drivers/clk/clk-ast2600.c b/drivers/clk/clk-ast2600.c +index af957179b135e..48122f574cb65 100644 +--- a/drivers/clk/clk-ast2600.c ++++ b/drivers/clk/clk-ast2600.c +@@ -48,6 +48,8 @@ static DEFINE_SPINLOCK(aspeed_g6_clk_lock); + static struct clk_hw_onecell_data *aspeed_g6_clk_data; + + static void __iomem *scu_g6_base; ++/* AST2600 revision: A0, A1, A2, etc */ ++static u8 soc_rev; + + /* + * Clocks marked with CLK_IS_CRITICAL: +@@ -190,9 +192,8 @@ static struct clk_hw *ast2600_calc_pll(const char *name, u32 val) + static struct clk_hw *ast2600_calc_apll(const char *name, u32 val) + { + unsigned int mult, div; +- u32 chip_id = readl(scu_g6_base + ASPEED_G6_SILICON_REV); + +- if (((chip_id & CHIP_REVISION_ID) >> 16) >= 2) { ++ if (soc_rev >= 2) { + if (val & BIT(24)) { + /* Pass through mode */ + mult = div = 1; +@@ -664,7 +665,7 @@ static const u32 ast2600_a1_axi_ahb200_tbl[] = { + static void __init aspeed_g6_cc(struct regmap *map) + { + struct clk_hw *hw; +- u32 val, div, divbits, chip_id, axi_div, ahb_div; ++ u32 val, div, divbits, axi_div, ahb_div; + + clk_hw_register_fixed_rate(NULL, "clkin", NULL, 0, 25000000); + +@@ -695,8 +696,7 @@ static void __init aspeed_g6_cc(struct regmap *map) + axi_div = 2; + + divbits = (val >> 11) & 0x3; +- regmap_read(map, ASPEED_G6_SILICON_REV, &chip_id); +- if (chip_id & BIT(16)) { ++ if (soc_rev >= 1) { + if (!divbits) { + ahb_div = ast2600_a1_axi_ahb200_tbl[(val >> 8) & 0x3]; + if (val & BIT(16)) +@@ -741,6 +741,8 @@ static void __init aspeed_g6_cc_init(struct device_node *np) + if (!scu_g6_base) + return; + ++ soc_rev = (readl(scu_g6_base + ASPEED_G6_SILICON_REV) & CHIP_REVISION_ID) >> 16; ++ + aspeed_g6_clk_data = kzalloc(struct_size(aspeed_g6_clk_data, hws, + ASPEED_G6_NUM_CLKS), GFP_KERNEL); + if (!aspeed_g6_clk_data) +-- +2.33.0 + diff --git a/queue-5.4/clk-imx-imx6ul-move-csi_sel-mux-to-correct-base-regi.patch b/queue-5.4/clk-imx-imx6ul-move-csi_sel-mux-to-correct-base-regi.patch new file mode 100644 index 00000000000..ce1715773b3 --- /dev/null +++ b/queue-5.4/clk-imx-imx6ul-move-csi_sel-mux-to-correct-base-regi.patch @@ -0,0 +1,51 @@ +From fada636eeacf35062a157a82a4c730a2f9590586 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Sep 2021 09:28:56 +0200 +Subject: clk: imx: imx6ul: Move csi_sel mux to correct base register + +From: Stefan Riedmueller + +[ Upstream commit 2f9d61869640f732599ec36b984c2b5c46067519 ] + +The csi_sel mux register is located in the CCM register base and not the +CCM_ANALOG register base. So move it to the correct position in code. + +Otherwise changing the parent of the csi clock can lead to a complete +system failure due to the CCM_ANALOG_PLL_SYS_TOG register being falsely +modified. + +Also remove the SET_RATE_PARENT flag since one possible supply for the +csi_sel mux is the system PLL which we don't want to modify. + +Signed-off-by: Stefan Riedmueller +Reviewed-by: Abel Vesa +Link: https://lore.kernel.org/r/20210927072857.3940880-1-s.riedmueller@phytec.de +Signed-off-by: Abel Vesa +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx6ul.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index bc931988fe7b2..f3ac5a524f4ed 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -161,7 +161,6 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + hws[IMX6UL_PLL5_BYPASS] = imx_clk_hw_mux_flags("pll5_bypass", base + 0xa0, 16, 1, pll5_bypass_sels, ARRAY_SIZE(pll5_bypass_sels), CLK_SET_RATE_PARENT); + hws[IMX6UL_PLL6_BYPASS] = imx_clk_hw_mux_flags("pll6_bypass", base + 0xe0, 16, 1, pll6_bypass_sels, ARRAY_SIZE(pll6_bypass_sels), CLK_SET_RATE_PARENT); + hws[IMX6UL_PLL7_BYPASS] = imx_clk_hw_mux_flags("pll7_bypass", base + 0x20, 16, 1, pll7_bypass_sels, ARRAY_SIZE(pll7_bypass_sels), CLK_SET_RATE_PARENT); +- hws[IMX6UL_CLK_CSI_SEL] = imx_clk_hw_mux_flags("csi_sel", base + 0x3c, 9, 2, csi_sels, ARRAY_SIZE(csi_sels), CLK_SET_RATE_PARENT); + + /* Do not bypass PLLs initially */ + clk_set_parent(hws[IMX6UL_PLL1_BYPASS]->clk, hws[IMX6UL_CLK_PLL1]->clk); +@@ -270,6 +269,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + hws[IMX6UL_CLK_ECSPI_SEL] = imx_clk_hw_mux("ecspi_sel", base + 0x38, 18, 1, ecspi_sels, ARRAY_SIZE(ecspi_sels)); + hws[IMX6UL_CLK_LCDIF_PRE_SEL] = imx_clk_hw_mux_flags("lcdif_pre_sel", base + 0x38, 15, 3, lcdif_pre_sels, ARRAY_SIZE(lcdif_pre_sels), CLK_SET_RATE_PARENT); + hws[IMX6UL_CLK_LCDIF_SEL] = imx_clk_hw_mux("lcdif_sel", base + 0x38, 9, 3, lcdif_sels, ARRAY_SIZE(lcdif_sels)); ++ hws[IMX6UL_CLK_CSI_SEL] = imx_clk_hw_mux("csi_sel", base + 0x3c, 9, 2, csi_sels, ARRAY_SIZE(csi_sels)); + + hws[IMX6UL_CLK_LDB_DI0_DIV_SEL] = imx_clk_hw_mux("ldb_di0", base + 0x20, 10, 1, ldb_di0_div_sels, ARRAY_SIZE(ldb_di0_div_sels)); + hws[IMX6UL_CLK_LDB_DI1_DIV_SEL] = imx_clk_hw_mux("ldb_di1", base + 0x20, 11, 1, ldb_di1_div_sels, ARRAY_SIZE(ldb_di1_div_sels)); +-- +2.33.0 + diff --git a/queue-5.4/clk-ingenic-fix-bugs-with-divided-dividers.patch b/queue-5.4/clk-ingenic-fix-bugs-with-divided-dividers.patch new file mode 100644 index 00000000000..2b990800a5c --- /dev/null +++ b/queue-5.4/clk-ingenic-fix-bugs-with-divided-dividers.patch @@ -0,0 +1,58 @@ +From 11cd51e1de0f8ff3c30c8a877b4701b3c74a760e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 1 Oct 2021 18:20:33 +0100 +Subject: clk: ingenic: Fix bugs with divided dividers + +From: Paul Cercueil + +[ Upstream commit ed84ef1cd7eddf933d4ffce2caa8161d6f947245 ] + +Two fixes in one: + +- In the "impose hardware constraints" block, the "logical" divider + value (aka. not translated to the hardware) was clamped to fit in the + register area, but this totally ignored the fact that the divider + value can itself have a fixed divider. + +- The code that made sure that the divider value returned by the + function was a multiple of its own fixed divider could result in a + wrong value being calculated, because it was rounded down instead of + rounded up. + +Fixes: 4afe2d1a6ed5 ("clk: ingenic: Allow divider value to be divided") +Co-developed-by: Artur Rojek +Signed-off-by: Artur Rojek +Signed-off-by: Paul Cercueil +Link: https://lore.kernel.org/r/20211001172033.122329-1-paul@crapouillou.net +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ingenic/cgu.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/clk/ingenic/cgu.c b/drivers/clk/ingenic/cgu.c +index 7490d4f4d9366..dff759c0f6193 100644 +--- a/drivers/clk/ingenic/cgu.c ++++ b/drivers/clk/ingenic/cgu.c +@@ -426,15 +426,15 @@ ingenic_clk_calc_div(const struct ingenic_cgu_clk_info *clk_info, + } + + /* Impose hardware constraints */ +- div = min_t(unsigned, div, 1 << clk_info->div.bits); +- div = max_t(unsigned, div, 1); ++ div = clamp_t(unsigned int, div, clk_info->div.div, ++ clk_info->div.div << clk_info->div.bits); + + /* + * If the divider value itself must be divided before being written to + * the divider register, we must ensure we don't have any bits set that + * would be lost as a result of doing so. + */ +- div /= clk_info->div.div; ++ div = DIV_ROUND_UP(div, clk_info->div.div); + div *= clk_info->div.div; + + return div; +-- +2.33.0 + diff --git a/queue-5.4/clk-qcom-gcc-msm8996-drop-again-gcc_aggre1_pnoc_ahb_.patch b/queue-5.4/clk-qcom-gcc-msm8996-drop-again-gcc_aggre1_pnoc_ahb_.patch new file mode 100644 index 00000000000..d12185098b6 --- /dev/null +++ b/queue-5.4/clk-qcom-gcc-msm8996-drop-again-gcc_aggre1_pnoc_ahb_.patch @@ -0,0 +1,69 @@ +From 2237db4fc72c1432362292c291abeaf72b74a008 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Nov 2021 04:11:55 +0300 +Subject: clk: qcom: gcc-msm8996: Drop (again) gcc_aggre1_pnoc_ahb_clk + +From: Dmitry Baryshkov + +[ Upstream commit 05cf3ec00d460b50088d421fb878a0f83f57e262 ] + +The gcc_aggre1_pnoc_ahb_clk is crucial for the proper MSM8996/APQ8096 +functioning. If it gets disabled, several subsytems will stop working +(including eMMC/SDCC and USB). There are no in-kernel users of this +clock, so it is much simpler to remove from the kernel. + +The clock was first removed in the commit 9e60de1cf270 ("clk: qcom: +Remove gcc_aggre1_pnoc_ahb_clk from msm8996") by Stephen Boyd, but got +added back in the commit b567752144e3 ("clk: qcom: Add some missing gcc +clks for msm8996") by Rajendra Nayak. + +Let's remove it again in hope that nobody adds it back. + +Reported-by: Vladimir Zapolskiy +Cc: Rajendra Nayak +Cc: Konrad Dybcio +Fixes: b567752144e3 ("clk: qcom: Add some missing gcc clks for msm8996") +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20211104011155.2209654-1-dmitry.baryshkov@linaro.org +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-msm8996.c | 15 --------------- + 1 file changed, 15 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-msm8996.c b/drivers/clk/qcom/gcc-msm8996.c +index d004cdaa0e39a..c1e1148f0261d 100644 +--- a/drivers/clk/qcom/gcc-msm8996.c ++++ b/drivers/clk/qcom/gcc-msm8996.c +@@ -2937,20 +2937,6 @@ static struct clk_branch gcc_smmu_aggre0_ahb_clk = { + }, + }; + +-static struct clk_branch gcc_aggre1_pnoc_ahb_clk = { +- .halt_reg = 0x82014, +- .clkr = { +- .enable_reg = 0x82014, +- .enable_mask = BIT(0), +- .hw.init = &(struct clk_init_data){ +- .name = "gcc_aggre1_pnoc_ahb_clk", +- .parent_names = (const char *[]){ "periph_noc_clk_src" }, +- .num_parents = 1, +- .ops = &clk_branch2_ops, +- }, +- }, +-}; +- + static struct clk_branch gcc_aggre2_ufs_axi_clk = { + .halt_reg = 0x83014, + .clkr = { +@@ -3453,7 +3439,6 @@ static struct clk_regmap *gcc_msm8996_clocks[] = { + [GCC_AGGRE0_CNOC_AHB_CLK] = &gcc_aggre0_cnoc_ahb_clk.clkr, + [GCC_SMMU_AGGRE0_AXI_CLK] = &gcc_smmu_aggre0_axi_clk.clkr, + [GCC_SMMU_AGGRE0_AHB_CLK] = &gcc_smmu_aggre0_ahb_clk.clkr, +- [GCC_AGGRE1_PNOC_AHB_CLK] = &gcc_aggre1_pnoc_ahb_clk.clkr, + [GCC_AGGRE2_UFS_AXI_CLK] = &gcc_aggre2_ufs_axi_clk.clkr, + [GCC_AGGRE2_USB3_AXI_CLK] = &gcc_aggre2_usb3_axi_clk.clkr, + [GCC_QSPI_AHB_CLK] = &gcc_qspi_ahb_clk.clkr, +-- +2.33.0 + diff --git a/queue-5.4/drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch b/queue-5.4/drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch new file mode 100644 index 00000000000..1cc75e91bd2 --- /dev/null +++ b/queue-5.4/drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch @@ -0,0 +1,41 @@ +From 011c570ebf3ebc6871d49f23b0bd2aea4eff437c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 16:36:04 +0100 +Subject: drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame + +From: Hans Verkuil + +[ Upstream commit 3cc1ae1fa70ab369e4645e38ce335a19438093ad ] + +gv100_hdmi_ctrl() writes vendor_infoframe.subpack0_high to 0x6f0110, and +then overwrites it with 0. Just drop the overwrite with 0, that's clearly +a mistake. + +Because of this issue the HDMI VIC is 0 instead of 1 in the HDMI Vendor +InfoFrame when transmitting 4kp30. + +Signed-off-by: Hans Verkuil +Fixes: 290ffeafcc1a ("drm/nouveau/disp/gv100: initial support") +Reviewed-by: Ben Skeggs +Signed-off-by: Karol Herbst +Link: https://patchwork.freedesktop.org/patch/msgid/3d3bd0f7-c150-2479-9350-35d394ee772d@xs4all.nl +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c +index 6e3c450eaacef..3ff49344abc77 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c +@@ -62,7 +62,6 @@ gv100_hdmi_ctrl(struct nvkm_ior *ior, int head, bool enable, u8 max_ac_packet, + nvkm_wr32(device, 0x6f0108 + hdmi, vendor_infoframe.header); + nvkm_wr32(device, 0x6f010c + hdmi, vendor_infoframe.subpack0_low); + nvkm_wr32(device, 0x6f0110 + hdmi, vendor_infoframe.subpack0_high); +- nvkm_wr32(device, 0x6f0110 + hdmi, 0x00000000); + nvkm_wr32(device, 0x6f0114 + hdmi, 0x00000000); + nvkm_wr32(device, 0x6f0118 + hdmi, 0x00000000); + nvkm_wr32(device, 0x6f011c + hdmi, 0x00000000); +-- +2.33.0 + diff --git a/queue-5.4/f2fs-fix-up-f2fs_lookup-tracepoints.patch b/queue-5.4/f2fs-fix-up-f2fs_lookup-tracepoints.patch new file mode 100644 index 00000000000..61072620ee3 --- /dev/null +++ b/queue-5.4/f2fs-fix-up-f2fs_lookup-tracepoints.patch @@ -0,0 +1,77 @@ +From e55eee92b0497ed53823cbab6c47e6fbab29296f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 22:37:30 +0800 +Subject: f2fs: fix up f2fs_lookup tracepoints + +From: Gao Xiang + +[ Upstream commit 70a9ac36ffd807ac506ed0b849f3e8ce3c6623f2 ] + +Fix up a misuse that the filename pointer isn't always valid in +the ring buffer, and we should copy the content instead. + +Fixes: 0c5e36db17f5 ("f2fs: trace f2fs_lookup") +Signed-off-by: Gao Xiang +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + include/trace/events/f2fs.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h +index 1796ff99c3e9c..a7613efc271ab 100644 +--- a/include/trace/events/f2fs.h ++++ b/include/trace/events/f2fs.h +@@ -793,20 +793,20 @@ TRACE_EVENT(f2fs_lookup_start, + TP_STRUCT__entry( + __field(dev_t, dev) + __field(ino_t, ino) +- __field(const char *, name) ++ __string(name, dentry->d_name.name) + __field(unsigned int, flags) + ), + + TP_fast_assign( + __entry->dev = dir->i_sb->s_dev; + __entry->ino = dir->i_ino; +- __entry->name = dentry->d_name.name; ++ __assign_str(name, dentry->d_name.name); + __entry->flags = flags; + ), + + TP_printk("dev = (%d,%d), pino = %lu, name:%s, flags:%u", + show_dev_ino(__entry), +- __entry->name, ++ __get_str(name), + __entry->flags) + ); + +@@ -820,7 +820,7 @@ TRACE_EVENT(f2fs_lookup_end, + TP_STRUCT__entry( + __field(dev_t, dev) + __field(ino_t, ino) +- __field(const char *, name) ++ __string(name, dentry->d_name.name) + __field(nid_t, cino) + __field(int, err) + ), +@@ -828,14 +828,14 @@ TRACE_EVENT(f2fs_lookup_end, + TP_fast_assign( + __entry->dev = dir->i_sb->s_dev; + __entry->ino = dir->i_ino; +- __entry->name = dentry->d_name.name; ++ __assign_str(name, dentry->d_name.name); + __entry->cino = ino; + __entry->err = err; + ), + + TP_printk("dev = (%d,%d), pino = %lu, name:%s, ino:%u, err:%d", + show_dev_ino(__entry), +- __entry->name, ++ __get_str(name), + __entry->cino, + __entry->err) + ); +-- +2.33.0 + diff --git a/queue-5.4/firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch b/queue-5.4/firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch new file mode 100644 index 00000000000..9650767a615 --- /dev/null +++ b/queue-5.4/firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch @@ -0,0 +1,83 @@ +From 50ae7fd9eb8b921ca0263e7cfbbd7220904a59c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Sep 2021 11:22:13 -0700 +Subject: firmware_loader: fix pre-allocated buf built-in firmware use + +From: Luis Chamberlain + +[ Upstream commit f7a07f7b96033df7709042ff38e998720a3f7119 ] + +The firmware_loader can be used with a pre-allocated buffer +through the use of the API calls: + + o request_firmware_into_buf() + o request_partial_firmware_into_buf() + +If the firmware was built-in and present, our current check +for if the built-in firmware fits into the pre-allocated buffer +does not return any errors, and we proceed to tell the caller +that everything worked fine. It's a lie and no firmware would +end up being copied into the pre-allocated buffer. So if the +caller trust the result it may end up writing a bunch of 0's +to a device! + +Fix this by making the function that checks for the pre-allocated +buffer return non-void. Since the typical use case is when no +pre-allocated buffer is provided make this return successfully +for that case. If the built-in firmware does *not* fit into the +pre-allocated buffer size return a failure as we should have +been doing before. + +I'm not aware of users of the built-in firmware using the API +calls with a pre-allocated buffer, as such I doubt this fixes +any real life issue. But you never know... perhaps some oddball +private tree might use it. + +In so far as upstream is concerned this just fixes our code for +correctness. + +Signed-off-by: Luis Chamberlain +Link: https://lore.kernel.org/r/20210917182226.3532898-2-mcgrof@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/firmware_loader/main.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c +index 249349f64bfe9..4f6b76bd957ef 100644 +--- a/drivers/base/firmware_loader/main.c ++++ b/drivers/base/firmware_loader/main.c +@@ -98,12 +98,15 @@ static struct firmware_cache fw_cache; + extern struct builtin_fw __start_builtin_fw[]; + extern struct builtin_fw __end_builtin_fw[]; + +-static void fw_copy_to_prealloc_buf(struct firmware *fw, ++static bool fw_copy_to_prealloc_buf(struct firmware *fw, + void *buf, size_t size) + { +- if (!buf || size < fw->size) +- return; ++ if (!buf) ++ return true; ++ if (size < fw->size) ++ return false; + memcpy(buf, fw->data, fw->size); ++ return true; + } + + static bool fw_get_builtin_firmware(struct firmware *fw, const char *name, +@@ -115,9 +118,7 @@ static bool fw_get_builtin_firmware(struct firmware *fw, const char *name, + if (strcmp(name, b_fw->name) == 0) { + fw->size = b_fw->size; + fw->data = b_fw->data; +- fw_copy_to_prealloc_buf(fw, buf, size); +- +- return true; ++ return fw_copy_to_prealloc_buf(fw, buf, size); + } + } + +-- +2.33.0 + diff --git a/queue-5.4/i40e-fix-changing-previously-set-num_queue_pairs-for.patch b/queue-5.4/i40e-fix-changing-previously-set-num_queue_pairs-for.patch new file mode 100644 index 00000000000..1962f3291fa --- /dev/null +++ b/queue-5.4/i40e-fix-changing-previously-set-num_queue_pairs-for.patch @@ -0,0 +1,135 @@ +From cf24e165dc2c002895ba3dc216ff66bfbc62bd3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 13:43:25 +0200 +Subject: i40e: Fix changing previously set num_queue_pairs for PFs + +From: Eryk Rybak + +[ Upstream commit d2a69fefd75683004ffe87166de5635b3267ee07 ] + +Currently, the i40e_vsi_setup_queue_map is basing the count of queues in +TCs on a VSI's alloc_queue_pairs member which is not changed throughout +any user's action (for example via ethtool's set_channels callback). + +This implies that vsi->tc_config.tc_info[n].qcount value that is given +to the kernel via netdev_set_tc_queue() that notifies about the count of +queues per particular traffic class is constant even if user has changed +the total count of queues. + +This in turn caused the kernel warning after setting the queue count to +the lower value than the initial one: + +$ ethtool -l ens801f0 +Channel parameters for ens801f0: +Pre-set maximums: +RX: 0 +TX: 0 +Other: 1 +Combined: 64 +Current hardware settings: +RX: 0 +TX: 0 +Other: 1 +Combined: 64 + +$ ethtool -L ens801f0 combined 40 + +[dmesg] +Number of in use tx queues changed invalidating tc mappings. Priority +traffic classification disabled! + +Reason was that vsi->alloc_queue_pairs stayed at 64 value which was used +to set the qcount on TC0 (by default only TC0 exists so all of the +existing queues are assigned to TC0). we update the offset/qcount via +netdev_set_tc_queue() back to the old value but then the +netif_set_real_num_tx_queues() is using the vsi->num_queue_pairs as a +value which got set to 40. + +Fix it by using vsi->req_queue_pairs as a queue count that will be +distributed across TCs. Do it only for non-zero values, which implies +that user actually requested the new count of queues. + +For VSIs other than main, stay with the vsi->alloc_queue_pairs as we +only allow manipulating the queue count on main VSI. + +Fixes: bc6d33c8d93f ("i40e: Fix the number of queues available to be mapped for use") +Co-developed-by: Maciej Fijalkowski +Signed-off-by: Maciej Fijalkowski +Co-developed-by: Przemyslaw Patynowski +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Eryk Rybak +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 35 ++++++++++++++------- + 1 file changed, 23 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index dcad4a3191cb8..34c453c2b22da 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1776,6 +1776,7 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + bool is_add) + { + struct i40e_pf *pf = vsi->back; ++ u16 num_tc_qps = 0; + u16 sections = 0; + u8 netdev_tc = 0; + u16 numtc = 1; +@@ -1783,13 +1784,29 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + u8 offset; + u16 qmap; + int i; +- u16 num_tc_qps = 0; + + sections = I40E_AQ_VSI_PROP_QUEUE_MAP_VALID; + offset = 0; + ++ if (vsi->type == I40E_VSI_MAIN) { ++ /* This code helps add more queue to the VSI if we have ++ * more cores than RSS can support, the higher cores will ++ * be served by ATR or other filters. Furthermore, the ++ * non-zero req_queue_pairs says that user requested a new ++ * queue count via ethtool's set_channels, so use this ++ * value for queues distribution across traffic classes ++ */ ++ if (vsi->req_queue_pairs > 0) ++ vsi->num_queue_pairs = vsi->req_queue_pairs; ++ else if (pf->flags & I40E_FLAG_MSIX_ENABLED) ++ vsi->num_queue_pairs = pf->num_lan_msix; ++ } ++ + /* Number of queues per enabled TC */ +- num_tc_qps = vsi->alloc_queue_pairs; ++ if (vsi->type == I40E_VSI_MAIN) ++ num_tc_qps = vsi->num_queue_pairs; ++ else ++ num_tc_qps = vsi->alloc_queue_pairs; + if (enabled_tc && (vsi->back->flags & I40E_FLAG_DCB_ENABLED)) { + /* Find numtc from enabled TC bitmap */ + for (i = 0, numtc = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) { +@@ -1867,16 +1884,10 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + } + ctxt->info.tc_mapping[i] = cpu_to_le16(qmap); + } +- +- /* Set actual Tx/Rx queue pairs */ +- vsi->num_queue_pairs = offset; +- if ((vsi->type == I40E_VSI_MAIN) && (numtc == 1)) { +- if (vsi->req_queue_pairs > 0) +- vsi->num_queue_pairs = vsi->req_queue_pairs; +- else if (pf->flags & I40E_FLAG_MSIX_ENABLED) +- vsi->num_queue_pairs = pf->num_lan_msix; +- } +- ++ /* Do not change previously set num_queue_pairs for PFs */ ++ if ((vsi->type == I40E_VSI_MAIN && numtc != 1) || ++ vsi->type != I40E_VSI_MAIN) ++ vsi->num_queue_pairs = offset; + /* Scheduler section valid can only be set for ADD VSI */ + if (is_add) { + sections |= I40E_AQ_VSI_PROP_SCHED_VALID; +-- +2.33.0 + diff --git a/queue-5.4/i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch b/queue-5.4/i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch new file mode 100644 index 00000000000..981acad76cb --- /dev/null +++ b/queue-5.4/i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch @@ -0,0 +1,118 @@ +From 4d15b23f0f6511d7214eb5a8c38caa4b0eacc775 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 16:17:22 +0000 +Subject: i40e: Fix correct max_pkt_size on VF RX queue + +From: Eryk Rybak + +[ Upstream commit 6afbd7b3c53cb7417189f476e99d431daccb85b0 ] + +Setting VLAN port increasing RX queue max_pkt_size +by 4 bytes to take VLAN tag into account. +Trigger the VF reset when setting port VLAN for +VF to renegotiate its capabilities and reinitialize. + +Fixes: ba4e003d29c1 ("i40e: don't hold spinlock while resetting VF") +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Aleksandr Loktionov +Signed-off-by: Eryk Rybak +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 53 ++++--------------- + 1 file changed, 9 insertions(+), 44 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index e561073054865..16641c19b7f73 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -621,14 +621,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, + u16 vsi_queue_id, + struct virtchnl_rxq_info *info) + { ++ u16 pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id); + struct i40e_pf *pf = vf->pf; ++ struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx]; + struct i40e_hw *hw = &pf->hw; + struct i40e_hmc_obj_rxq rx_ctx; +- u16 pf_queue_id; + int ret = 0; + +- pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id); +- + /* clear the context structure first */ + memset(&rx_ctx, 0, sizeof(struct i40e_hmc_obj_rxq)); + +@@ -666,6 +665,10 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, + } + rx_ctx.rxmax = info->max_pkt_size; + ++ /* if port VLAN is configured increase the max packet size */ ++ if (vsi->info.pvid) ++ rx_ctx.rxmax += VLAN_HLEN; ++ + /* enable 32bytes desc always */ + rx_ctx.dsize = 1; + +@@ -4050,34 +4053,6 @@ error_param: + return ret; + } + +-/** +- * i40e_vsi_has_vlans - True if VSI has configured VLANs +- * @vsi: pointer to the vsi +- * +- * Check if a VSI has configured any VLANs. False if we have a port VLAN or if +- * we have no configured VLANs. Do not call while holding the +- * mac_filter_hash_lock. +- */ +-static bool i40e_vsi_has_vlans(struct i40e_vsi *vsi) +-{ +- bool have_vlans; +- +- /* If we have a port VLAN, then the VSI cannot have any VLANs +- * configured, as all MAC/VLAN filters will be assigned to the PVID. +- */ +- if (vsi->info.pvid) +- return false; +- +- /* Since we don't have a PVID, we know that if the device is in VLAN +- * mode it must be because of a VLAN filter configured on this VSI. +- */ +- spin_lock_bh(&vsi->mac_filter_hash_lock); +- have_vlans = i40e_is_vsi_in_vlan(vsi); +- spin_unlock_bh(&vsi->mac_filter_hash_lock); +- +- return have_vlans; +-} +- + /** + * i40e_ndo_set_vf_port_vlan + * @netdev: network interface device structure +@@ -4134,19 +4109,9 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id, + /* duplicate request, so just return success */ + goto error_pvid; + +- if (i40e_vsi_has_vlans(vsi)) { +- dev_err(&pf->pdev->dev, +- "VF %d has already configured VLAN filters and the administrator is requesting a port VLAN override.\nPlease unload and reload the VF driver for this change to take effect.\n", +- vf_id); +- /* Administrator Error - knock the VF offline until he does +- * the right thing by reconfiguring his network correctly +- * and then reloading the VF driver. +- */ +- i40e_vc_disable_vf(vf); +- /* During reset the VF got a new VSI, so refresh the pointer. */ +- vsi = pf->vsi[vf->lan_vsi_idx]; +- } +- ++ i40e_vc_disable_vf(vf); ++ /* During reset the VF got a new VSI, so refresh a pointer. */ ++ vsi = pf->vsi[vf->lan_vsi_idx]; + /* Locked once because multiple functions below iterate list */ + spin_lock_bh(&vsi->mac_filter_hash_lock); + +-- +2.33.0 + diff --git a/queue-5.4/i40e-fix-creation-of-first-queue-by-omitting-it-if-i.patch b/queue-5.4/i40e-fix-creation-of-first-queue-by-omitting-it-if-i.patch new file mode 100644 index 00000000000..8b80892562d --- /dev/null +++ b/queue-5.4/i40e-fix-creation-of-first-queue-by-omitting-it-if-i.patch @@ -0,0 +1,117 @@ +From bbb8d8fa771be5d5b8e76b40df8887aaa9bb92b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 08:37:31 +0000 +Subject: i40e: Fix creation of first queue by omitting it if is not power of + two + +From: Jedrzej Jagielski + +[ Upstream commit 2e6d218c1ec6fb9cd70693b78134cbc35ae0b5a9 ] + +Reject TCs creation with proper message if the first queue +assignment is not equal to the power of two. +The first queue number was checked too late in the second queue +iteration, if second queue was configured at all. Now if first queue value +is not a power of two, then trying to create qdisc will be rejected. + +Fixes: 8f88b3034db3 ("i40e: Add infrastructure for queue channel support") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Jedrzej Jagielski +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 59 +++++++-------------- + 1 file changed, 19 insertions(+), 40 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 5dbbb87423a52..d87771403b578 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -5731,24 +5731,6 @@ static void i40e_remove_queue_channels(struct i40e_vsi *vsi) + INIT_LIST_HEAD(&vsi->ch_list); + } + +-/** +- * i40e_is_any_channel - channel exist or not +- * @vsi: ptr to VSI to which channels are associated with +- * +- * Returns true or false if channel(s) exist for associated VSI or not +- **/ +-static bool i40e_is_any_channel(struct i40e_vsi *vsi) +-{ +- struct i40e_channel *ch, *ch_tmp; +- +- list_for_each_entry_safe(ch, ch_tmp, &vsi->ch_list, list) { +- if (ch->initialized) +- return true; +- } +- +- return false; +-} +- + /** + * i40e_get_max_queues_for_channel + * @vsi: ptr to VSI to which channels are associated with +@@ -6256,26 +6238,15 @@ int i40e_create_queue_channel(struct i40e_vsi *vsi, + /* By default we are in VEPA mode, if this is the first VF/VMDq + * VSI to be added switch to VEB mode. + */ +- if ((!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) || +- (!i40e_is_any_channel(vsi))) { +- if (!is_power_of_2(vsi->tc_config.tc_info[0].qcount)) { +- dev_dbg(&pf->pdev->dev, +- "Failed to create channel. Override queues (%u) not power of 2\n", +- vsi->tc_config.tc_info[0].qcount); +- return -EINVAL; +- } + +- if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) { +- pf->flags |= I40E_FLAG_VEB_MODE_ENABLED; ++ if (!(pf->flags & I40E_FLAG_VEB_MODE_ENABLED)) { ++ pf->flags |= I40E_FLAG_VEB_MODE_ENABLED; + +- if (vsi->type == I40E_VSI_MAIN) { +- if (pf->flags & I40E_FLAG_TC_MQPRIO) +- i40e_do_reset(pf, I40E_PF_RESET_FLAG, +- true); +- else +- i40e_do_reset_safe(pf, +- I40E_PF_RESET_FLAG); +- } ++ if (vsi->type == I40E_VSI_MAIN) { ++ if (pf->flags & I40E_FLAG_TC_MQPRIO) ++ i40e_do_reset(pf, I40E_PF_RESET_FLAG, true); ++ else ++ i40e_do_reset_safe(pf, I40E_PF_RESET_FLAG); + } + /* now onwards for main VSI, number of queues will be value + * of TC0's queue count +@@ -7567,12 +7538,20 @@ config_tc: + vsi->seid); + need_reset = true; + goto exit; +- } else { +- dev_info(&vsi->back->pdev->dev, +- "Setup channel (id:%u) utilizing num_queues %d\n", +- vsi->seid, vsi->tc_config.tc_info[0].qcount); ++ } else if (enabled_tc && ++ (!is_power_of_2(vsi->tc_config.tc_info[0].qcount))) { ++ netdev_info(netdev, ++ "Failed to create channel. Override queues (%u) not power of 2\n", ++ vsi->tc_config.tc_info[0].qcount); ++ ret = -EINVAL; ++ need_reset = true; ++ goto exit; + } + ++ dev_info(&vsi->back->pdev->dev, ++ "Setup channel (id:%u) utilizing num_queues %d\n", ++ vsi->seid, vsi->tc_config.tc_info[0].qcount); ++ + if (pf->flags & I40E_FLAG_TC_MQPRIO) { + if (vsi->mqprio_qopt.max_rate[0]) { + u64 max_tx_rate = vsi->mqprio_qopt.max_rate[0]; +-- +2.33.0 + diff --git a/queue-5.4/i40e-fix-display-error-code-in-dmesg.patch b/queue-5.4/i40e-fix-display-error-code-in-dmesg.patch new file mode 100644 index 00000000000..71615985bd2 --- /dev/null +++ b/queue-5.4/i40e-fix-display-error-code-in-dmesg.patch @@ -0,0 +1,42 @@ +From c616ff5f57ee963102e0656e4743f74c38fd5db0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 11:26:01 +0200 +Subject: i40e: Fix display error code in dmesg + +From: Grzegorz Szczurek + +[ Upstream commit 5aff430d4e33a0b48a6b3d5beb06f79da23f9916 ] + +Fix misleading display error in dmesg if tc filter return fail. +Only i40e status error code should be converted to string, not linux +error code. Otherwise, we return false information about the error. + +Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Mateusz Palczewski +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index d87771403b578..ce237da003ddb 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -8116,9 +8116,8 @@ static int i40e_configure_clsflower(struct i40e_vsi *vsi, + err = i40e_add_del_cloud_filter(vsi, filter, true); + + if (err) { +- dev_err(&pf->pdev->dev, +- "Failed to add cloud filter, err %s\n", +- i40e_stat_str(&pf->hw, err)); ++ dev_err(&pf->pdev->dev, "Failed to add cloud filter, err %d\n", ++ err); + goto err; + } + +-- +2.33.0 + diff --git a/queue-5.4/i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch b/queue-5.4/i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch new file mode 100644 index 00000000000..8500c560b37 --- /dev/null +++ b/queue-5.4/i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch @@ -0,0 +1,68 @@ +From 6a8dc3461fbd2cb71e12d5f97b0e5931c44c2403 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 12:07:48 +0000 +Subject: i40e: Fix NULL ptr dereference on VSI filter sync + +From: Michal Maloszewski + +[ Upstream commit 37d9e304acd903a445df8208b8a13d707902dea6 ] + +Remove the reason of null pointer dereference in sync VSI filters. +Added new I40E_VSI_RELEASING flag to signalize deleting and releasing +of VSI resources to sync this thread with sync filters subtask. +Without this patch it is possible to start update the VSI filter list +after VSI is removed, that's causing a kernel oops. + +Fixes: 41c445ff0f48 ("i40e: main driver core") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Michal Maloszewski +Reviewed-by: Przemyslaw Patynowski +Reviewed-by: Witold Fijalkowski +Reviewed-by: Jaroslaw Gawin +Reviewed-by: Aleksandr Loktionov +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index e571c6116c4b7..e7e61b9a75ecd 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -169,6 +169,7 @@ enum i40e_vsi_state_t { + __I40E_VSI_OVERFLOW_PROMISC, + __I40E_VSI_REINIT_REQUESTED, + __I40E_VSI_DOWN_REQUESTED, ++ __I40E_VSI_RELEASING, + /* This must be last as it determines the size of the BITMAP */ + __I40E_VSI_STATE_SIZE__, + }; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 917be10a5cf5c..dcad4a3191cb8 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -2609,7 +2609,8 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf) + + for (v = 0; v < pf->num_alloc_vsi; v++) { + if (pf->vsi[v] && +- (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED)) { ++ (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED) && ++ !test_bit(__I40E_VSI_RELEASING, pf->vsi[v]->state)) { + int ret = i40e_sync_vsi_filters(pf->vsi[v]); + + if (ret) { +@@ -13388,7 +13389,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi) + dev_info(&pf->pdev->dev, "Can't remove PF VSI\n"); + return -ENODEV; + } +- ++ set_bit(__I40E_VSI_RELEASING, vsi->state); + uplink_seid = vsi->uplink_seid; + if (vsi->type != I40E_VSI_SRIOV) { + if (vsi->netdev_registered) { +-- +2.33.0 + diff --git a/queue-5.4/i40e-fix-ping-is-lost-after-configuring-adq-on-vf.patch b/queue-5.4/i40e-fix-ping-is-lost-after-configuring-adq-on-vf.patch new file mode 100644 index 00000000000..b40dc66f2d8 --- /dev/null +++ b/queue-5.4/i40e-fix-ping-is-lost-after-configuring-adq-on-vf.patch @@ -0,0 +1,184 @@ +From 9c04822cbc8f6bee493a31d733dd7dab02cee467 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 13:43:26 +0200 +Subject: i40e: Fix ping is lost after configuring ADq on VF + +From: Eryk Rybak + +[ Upstream commit 9e0a603cb7dce2a19d98116d42de84b6db26d716 ] + +Properly reconfigure VF VSIs after VF request ADQ. +Created new function to update queue mapping and queue pairs per TC +with AQ update VSI. This sets proper RSS size on NIC. +VFs num_queue_pairs should not be changed during setup of queue maps. +Previously, VF main VSI in ADQ had configured too many queues and had +wrong RSS size, which lead to packets not being consumed and drops in +connectivity. + +Fixes: bc6d33c8d93f ("i40e: Fix the number of queues available to be mapped for use") +Co-developed-by: Przemyslaw Patynowski +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Eryk Rybak +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_main.c | 64 ++++++++++++++++++- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 17 +++-- + 3 files changed, 74 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index e7e61b9a75ecd..f8422dbfd54e6 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -1147,6 +1147,7 @@ void i40e_ptp_save_hw_time(struct i40e_pf *pf); + void i40e_ptp_restore_hw_time(struct i40e_pf *pf); + void i40e_ptp_init(struct i40e_pf *pf); + void i40e_ptp_stop(struct i40e_pf *pf); ++int i40e_update_adq_vsi_queues(struct i40e_vsi *vsi, int vsi_offset); + int i40e_is_vsi_uplink_mode_veb(struct i40e_vsi *vsi); + i40e_status i40e_get_partition_bw_setting(struct i40e_pf *pf); + i40e_status i40e_set_partition_bw_setting(struct i40e_pf *pf); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 34c453c2b22da..5dbbb87423a52 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1787,6 +1787,8 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + + sections = I40E_AQ_VSI_PROP_QUEUE_MAP_VALID; + offset = 0; ++ /* zero out queue mapping, it will get updated on the end of the function */ ++ memset(ctxt->info.queue_mapping, 0, sizeof(ctxt->info.queue_mapping)); + + if (vsi->type == I40E_VSI_MAIN) { + /* This code helps add more queue to the VSI if we have +@@ -1803,10 +1805,12 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + } + + /* Number of queues per enabled TC */ +- if (vsi->type == I40E_VSI_MAIN) ++ if (vsi->type == I40E_VSI_MAIN || ++ (vsi->type == I40E_VSI_SRIOV && vsi->num_queue_pairs != 0)) + num_tc_qps = vsi->num_queue_pairs; + else + num_tc_qps = vsi->alloc_queue_pairs; ++ + if (enabled_tc && (vsi->back->flags & I40E_FLAG_DCB_ENABLED)) { + /* Find numtc from enabled TC bitmap */ + for (i = 0, numtc = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) { +@@ -1884,10 +1888,12 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + } + ctxt->info.tc_mapping[i] = cpu_to_le16(qmap); + } +- /* Do not change previously set num_queue_pairs for PFs */ ++ /* Do not change previously set num_queue_pairs for PFs and VFs*/ + if ((vsi->type == I40E_VSI_MAIN && numtc != 1) || +- vsi->type != I40E_VSI_MAIN) ++ (vsi->type == I40E_VSI_SRIOV && vsi->num_queue_pairs == 0) || ++ (vsi->type != I40E_VSI_MAIN && vsi->type != I40E_VSI_SRIOV)) + vsi->num_queue_pairs = offset; ++ + /* Scheduler section valid can only be set for ADD VSI */ + if (is_add) { + sections |= I40E_AQ_VSI_PROP_SCHED_VALID; +@@ -5383,6 +5389,58 @@ static void i40e_vsi_update_queue_map(struct i40e_vsi *vsi, + sizeof(vsi->info.tc_mapping)); + } + ++/** ++ * i40e_update_adq_vsi_queues - update queue mapping for ADq VSI ++ * @vsi: the VSI being reconfigured ++ * @vsi_offset: offset from main VF VSI ++ */ ++int i40e_update_adq_vsi_queues(struct i40e_vsi *vsi, int vsi_offset) ++{ ++ struct i40e_vsi_context ctxt = {}; ++ struct i40e_pf *pf; ++ struct i40e_hw *hw; ++ int ret; ++ ++ if (!vsi) ++ return I40E_ERR_PARAM; ++ pf = vsi->back; ++ hw = &pf->hw; ++ ++ ctxt.seid = vsi->seid; ++ ctxt.pf_num = hw->pf_id; ++ ctxt.vf_num = vsi->vf_id + hw->func_caps.vf_base_id + vsi_offset; ++ ctxt.uplink_seid = vsi->uplink_seid; ++ ctxt.connection_type = I40E_AQ_VSI_CONN_TYPE_NORMAL; ++ ctxt.flags = I40E_AQ_VSI_TYPE_VF; ++ ctxt.info = vsi->info; ++ ++ i40e_vsi_setup_queue_map(vsi, &ctxt, vsi->tc_config.enabled_tc, ++ false); ++ if (vsi->reconfig_rss) { ++ vsi->rss_size = min_t(int, pf->alloc_rss_size, ++ vsi->num_queue_pairs); ++ ret = i40e_vsi_config_rss(vsi); ++ if (ret) { ++ dev_info(&pf->pdev->dev, "Failed to reconfig rss for num_queues\n"); ++ return ret; ++ } ++ vsi->reconfig_rss = false; ++ } ++ ++ ret = i40e_aq_update_vsi_params(hw, &ctxt, NULL); ++ if (ret) { ++ dev_info(&pf->pdev->dev, "Update vsi config failed, err %s aq_err %s\n", ++ i40e_stat_str(hw, ret), ++ i40e_aq_str(hw, hw->aq.asq_last_status)); ++ return ret; ++ } ++ /* update the local VSI info with updated queue map */ ++ i40e_vsi_update_queue_map(vsi, &ctxt); ++ vsi->info.valid_sections = 0; ++ ++ return ret; ++} ++ + /** + * i40e_vsi_config_tc - Configure VSI Tx Scheduler for given TC map + * @vsi: VSI to be configured +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 16641c19b7f73..6e61aea42a0dd 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2100,11 +2100,12 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) + struct virtchnl_vsi_queue_config_info *qci = + (struct virtchnl_vsi_queue_config_info *)msg; + struct virtchnl_queue_pair_info *qpi; +- struct i40e_pf *pf = vf->pf; + u16 vsi_id, vsi_queue_id = 0; +- u16 num_qps_all = 0; ++ struct i40e_pf *pf = vf->pf; + i40e_status aq_ret = 0; + int i, j = 0, idx = 0; ++ struct i40e_vsi *vsi; ++ u16 num_qps_all = 0; + + if (!test_bit(I40E_VF_STATE_ACTIVE, &vf->vf_states)) { + aq_ret = I40E_ERR_PARAM; +@@ -2193,9 +2194,15 @@ static int i40e_vc_config_queues_msg(struct i40e_vf *vf, u8 *msg) + pf->vsi[vf->lan_vsi_idx]->num_queue_pairs = + qci->num_queue_pairs; + } else { +- for (i = 0; i < vf->num_tc; i++) +- pf->vsi[vf->ch[i].vsi_idx]->num_queue_pairs = +- vf->ch[i].num_qps; ++ for (i = 0; i < vf->num_tc; i++) { ++ vsi = pf->vsi[vf->ch[i].vsi_idx]; ++ vsi->num_queue_pairs = vf->ch[i].num_qps; ++ ++ if (i40e_update_adq_vsi_queues(vsi, i)) { ++ aq_ret = I40E_ERR_CONFIG; ++ goto error_param; ++ } ++ } + } + + error_param: +-- +2.33.0 + diff --git a/queue-5.4/iavf-check-for-null-in-iavf_fix_features.patch b/queue-5.4/iavf-check-for-null-in-iavf_fix_features.patch new file mode 100644 index 00000000000..769dca3358e --- /dev/null +++ b/queue-5.4/iavf-check-for-null-in-iavf_fix_features.patch @@ -0,0 +1,41 @@ +From 4f899c3bb3d4665fa007dc38db0a485abd47e9b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:53 -0700 +Subject: iavf: check for null in iavf_fix_features + +From: Nicholas Nunley + +[ Upstream commit 8a4a126f4be88eb8b5f00a165ab58c35edf4ef76 ] + +If the driver has lost contact with the PF then it enters a disabled state +and frees adapter->vf_res. However, ndo_fix_features can still be called on +the interface, so we need to check for this condition first. Since we have +no information on the features at this time simply leave them unmodified +and return. + +Fixes: c4445aedfe09 ("i40evf: Fix VLAN features") +Signed-off-by: Nicholas Nunley +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index bc46c262b42d8..d6a239ba0240e 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -3425,7 +3425,8 @@ static netdev_features_t iavf_fix_features(struct net_device *netdev, + { + struct iavf_adapter *adapter = netdev_priv(netdev); + +- if (!(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)) ++ if (adapter->vf_res && ++ !(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)) + features &= ~(NETIF_F_HW_VLAN_CTAG_TX | + NETIF_F_HW_VLAN_CTAG_RX | + NETIF_F_HW_VLAN_CTAG_FILTER); +-- +2.33.0 + diff --git a/queue-5.4/iavf-fix-failure-to-exit-out-from-last-all-multicast.patch b/queue-5.4/iavf-fix-failure-to-exit-out-from-last-all-multicast.patch new file mode 100644 index 00000000000..752c12fb1dc --- /dev/null +++ b/queue-5.4/iavf-fix-failure-to-exit-out-from-last-all-multicast.patch @@ -0,0 +1,41 @@ +From 3a9d3d0dc8b580d93a9cf7c527d22aee9e171abf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:56 -0700 +Subject: iavf: Fix failure to exit out from last all-multicast mode + +From: Piotr Marczak + +[ Upstream commit 8905072a192fffe9389255489db250c73ecab008 ] + +The driver could only quit allmulti when allmulti and promisc modes are +turn on at the same time. If promisc had been off there was no way to turn +off allmulti mode. +The patch corrects this behavior. Switching allmulti does not depends on +promisc state mode anymore + +Fixes: f42a5c74da99 ("i40e: Add allmulti support for the VF") +Signed-off-by: Piotr Marczak +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index c7e365267bc0f..43afe887cac9e 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1626,8 +1626,7 @@ static int iavf_process_aq_command(struct iavf_adapter *adapter) + iavf_set_promiscuous(adapter, FLAG_VF_MULTICAST_PROMISC); + return 0; + } +- +- if ((adapter->aq_required & IAVF_FLAG_AQ_RELEASE_PROMISC) && ++ if ((adapter->aq_required & IAVF_FLAG_AQ_RELEASE_PROMISC) || + (adapter->aq_required & IAVF_FLAG_AQ_RELEASE_ALLMULTI)) { + iavf_set_promiscuous(adapter, 0); + return 0; +-- +2.33.0 + diff --git a/queue-5.4/iavf-fix-for-the-false-positive-asq-arq-errors-while.patch b/queue-5.4/iavf-fix-for-the-false-positive-asq-arq-errors-while.patch new file mode 100644 index 00000000000..3676789a24c --- /dev/null +++ b/queue-5.4/iavf-fix-for-the-false-positive-asq-arq-errors-while.patch @@ -0,0 +1,43 @@ +From e7f4bf06104d8390064cd6e16a557192c430f434 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:59 -0700 +Subject: iavf: Fix for the false positive ASQ/ARQ errors while issuing VF + reset + +From: Surabhi Boob + +[ Upstream commit 321421b57a12e933f92b228e0e6d0b2c6541f41d ] + +While issuing VF Reset from the guest OS, the VF driver prints +logs about critical / Overflow error detection. This is not an +actual error since the VF_MBX_ARQLEN register is set to all FF's +for a short period of time and the VF would catch the bits set if +it was reading the register during that spike of time. +This patch introduces an additional check to ignore this condition +since the VF is in reset. + +Fixes: 19b73d8efaa4 ("i40evf: Add additional check for reset") +Signed-off-by: Surabhi Boob +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 6f6cd013eef3e..484c2a6f1625d 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -2341,7 +2341,7 @@ static void iavf_adminq_task(struct work_struct *work) + + /* check for error indications */ + val = rd32(hw, hw->aq.arq.len); +- if (val == 0xdeadbeef) /* indicates device in reset */ ++ if (val == 0xdeadbeef || val == 0xffffffff) /* device in reset */ + goto freedom; + oldval = val; + if (val & IAVF_VF_ARQLEN1_ARQVFE_MASK) { +-- +2.33.0 + diff --git a/queue-5.4/iavf-free-q_vectors-before-queues-in-iavf_disable_vf.patch b/queue-5.4/iavf-free-q_vectors-before-queues-in-iavf_disable_vf.patch new file mode 100644 index 00000000000..a5b0c2d9a4e --- /dev/null +++ b/queue-5.4/iavf-free-q_vectors-before-queues-in-iavf_disable_vf.patch @@ -0,0 +1,41 @@ +From 58c3b91fcce19ec44b8e8d2af26ab12c4f4a0126 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:54 -0700 +Subject: iavf: free q_vectors before queues in iavf_disable_vf + +From: Nicholas Nunley + +[ Upstream commit 89f22f129696ab53cfbc608e0a2184d0fea46ac1 ] + +iavf_free_queues() clears adapter->num_active_queues, which +iavf_free_q_vectors() relies on, so swap the order of these two function +calls in iavf_disable_vf(). This resolves a panic encountered when the +interface is disabled and then later brought up again after PF +communication is restored. + +Fixes: 65c7006f234c ("i40evf: assign num_active_queues inside i40evf_alloc_queues") +Signed-off-by: Nicholas Nunley +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index d6a239ba0240e..c7e365267bc0f 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -2057,8 +2057,8 @@ static void iavf_disable_vf(struct iavf_adapter *adapter) + + iavf_free_misc_irq(adapter); + iavf_reset_interrupt_capability(adapter); +- iavf_free_queues(adapter); + iavf_free_q_vectors(adapter); ++ iavf_free_queues(adapter); + memset(adapter->vf_res, 0, IAVF_VIRTCHNL_VF_RESOURCE_SIZE); + iavf_shutdown_adminq(&adapter->hw); + adapter->netdev->flags &= ~IFF_UP; +-- +2.33.0 + diff --git a/queue-5.4/iavf-prevent-accidental-free-of-filter-structure.patch b/queue-5.4/iavf-prevent-accidental-free-of-filter-structure.patch new file mode 100644 index 00000000000..9763cef662f --- /dev/null +++ b/queue-5.4/iavf-prevent-accidental-free-of-filter-structure.patch @@ -0,0 +1,55 @@ +From 697aaedf8084718895a7db5591c56fd72c2b9695 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:57 -0700 +Subject: iavf: prevent accidental free of filter structure + +From: Jacob Keller + +[ Upstream commit 4f0400803818f2642f066d3eacaf013f23554cc7 ] + +In iavf_config_clsflower, the filter structure could be accidentally +released at the end, if iavf_parse_cls_flower or iavf_handle_tclass ever +return a non-zero but positive value. + +In this case, the function continues through to the end, and will call +kfree() on the filter structure even though it has been added to the +linked list. + +This can actually happen because iavf_parse_cls_flower will return +a positive IAVF_ERR_CONFIG value instead of the traditional negative +error codes. + +Fix this by ensuring that the kfree() check and error checks are +similar. Use the more idiomatic "if (err)" to catch all non-zero error +codes. + +Fixes: 0075fa0fadd0 ("i40evf: Add support to apply cloud filters") +Signed-off-by: Jacob Keller +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 43afe887cac9e..6f6cd013eef3e 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -3033,11 +3033,11 @@ static int iavf_configure_clsflower(struct iavf_adapter *adapter, + /* start out with flow type and eth type IPv4 to begin with */ + filter->f.flow_type = VIRTCHNL_TCP_V4_FLOW; + err = iavf_parse_cls_flower(adapter, cls_flower, filter); +- if (err < 0) ++ if (err) + goto err; + + err = iavf_handle_tclass(adapter, tc, filter); +- if (err < 0) ++ if (err) + goto err; + + /* add filter to the list */ +-- +2.33.0 + diff --git a/queue-5.4/iavf-validate-pointers.patch b/queue-5.4/iavf-validate-pointers.patch new file mode 100644 index 00000000000..4653507cfd3 --- /dev/null +++ b/queue-5.4/iavf-validate-pointers.patch @@ -0,0 +1,50 @@ +From e82bcd6939328cbf13c0beceddd5b07ea46a0efd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:58 -0700 +Subject: iavf: validate pointers + +From: Mitch Williams + +[ Upstream commit 131b0edc4028bb88bb472456b1ddba526cfb7036 ] + +In some cases, the ethtool get_rxfh handler may be called with a null +key or indir parameter. So check these pointers, or you will have a very +bad day. + +Fixes: 43a3d9ba34c9 ("i40evf: Allow PF driver to configure RSS") +Signed-off-by: Mitch Williams +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_ethtool.c | 13 ++++++------- + 1 file changed, 6 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +index 758bef02a2a86..ad1e796e5544a 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +@@ -962,14 +962,13 @@ static int iavf_get_rxfh(struct net_device *netdev, u32 *indir, u8 *key, + + if (hfunc) + *hfunc = ETH_RSS_HASH_TOP; +- if (!indir) +- return 0; +- +- memcpy(key, adapter->rss_key, adapter->rss_key_size); ++ if (key) ++ memcpy(key, adapter->rss_key, adapter->rss_key_size); + +- /* Each 32 bits pointed by 'indir' is stored with a lut entry */ +- for (i = 0; i < adapter->rss_lut_size; i++) +- indir[i] = (u32)adapter->rss_lut[i]; ++ if (indir) ++ /* Each 32 bits pointed by 'indir' is stored with a lut entry */ ++ for (i = 0; i < adapter->rss_lut_size; i++) ++ indir[i] = (u32)adapter->rss_lut[i]; + + return 0; + } +-- +2.33.0 + diff --git a/queue-5.4/iio-imu-st_lsm6dsx-avoid-potential-array-overflow-in.patch b/queue-5.4/iio-imu-st_lsm6dsx-avoid-potential-array-overflow-in.patch new file mode 100644 index 00000000000..b0a9da85329 --- /dev/null +++ b/queue-5.4/iio-imu-st_lsm6dsx-avoid-potential-array-overflow-in.patch @@ -0,0 +1,65 @@ +From ea411f5cd8eeda9165f2489647b11987af62db8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Oct 2021 19:40:03 +0800 +Subject: iio: imu: st_lsm6dsx: Avoid potential array overflow in + st_lsm6dsx_set_odr() + +From: Teng Qi + +[ Upstream commit 94be878c882d8d784ff44c639bf55f3b029f85af ] + +The length of hw->settings->odr_table is 2 and ref_sensor->id is an enum +variable whose value is between 0 and 5. +However, the value ST_LSM6DSX_ID_MAX (i.e. 5) is not caught properly in + switch (sensor->id) { + +If ref_sensor->id is ST_LSM6DSX_ID_MAX, an array overflow will ocurrs in +function st_lsm6dsx_check_odr(): + odr_table = &sensor->hw->settings->odr_table[sensor->id]; + +and in function st_lsm6dsx_set_odr(): + reg = &hw->settings->odr_table[ref_sensor->id].reg; + +To avoid this array overflow, handle ST_LSM6DSX_ID_GYRO explicitly and +return -EINVAL for the default case. + +The enum value ST_LSM6DSX_ID_MAX is only present as an easy way to check +the limit and as such is never used, however this is not locally obvious. + +Reported-by: TOTE Robot +Signed-off-by: Teng Qi +Acked-by: Lorenzo Bianconi +Link: https://lore.kernel.org/r/20211011114003.976221-1-starmiku1207184332@gmail.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +index 057a4b0100106..8850da8e25d69 100644 +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +@@ -1015,6 +1015,8 @@ static int st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u16 req_odr) + int err; + + switch (sensor->id) { ++ case ST_LSM6DSX_ID_GYRO: ++ break; + case ST_LSM6DSX_ID_EXT0: + case ST_LSM6DSX_ID_EXT1: + case ST_LSM6DSX_ID_EXT2: +@@ -1040,8 +1042,8 @@ static int st_lsm6dsx_set_odr(struct st_lsm6dsx_sensor *sensor, u16 req_odr) + } + break; + } +- default: +- break; ++ default: /* should never occur */ ++ return -EINVAL; + } + + if (req_odr > 0) { +-- +2.33.0 + diff --git a/queue-5.4/maple-fix-wrong-return-value-of-maple_bus_init.patch b/queue-5.4/maple-fix-wrong-return-value-of-maple_bus_init.patch new file mode 100644 index 00000000000..228b6245086 --- /dev/null +++ b/queue-5.4/maple-fix-wrong-return-value-of-maple_bus_init.patch @@ -0,0 +1,50 @@ +From 7df56222e24b759f731facf334fbde59e5565067 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 10:43:11 +0800 +Subject: maple: fix wrong return value of maple_bus_init(). + +From: Lu Wei + +[ Upstream commit bde82ee391fa6d3ad054313c4aa7b726d32515ce ] + +If KMEM_CACHE or maple_alloc_dev failed, the maple_bus_init() will return 0 +rather than error, because the retval is not changed after KMEM_CACHE or +maple_alloc_dev failed. + +Fixes: 17be2d2b1c33 ("sh: Add maple bus support for the SEGA Dreamcast.") +Reported-by: Hulk Robot +Signed-off-by: Lu Wei +Acked-by: John Paul Adrian Glaubitz +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + drivers/sh/maple/maple.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c +index e5d7fb81ad665..44a931d41a132 100644 +--- a/drivers/sh/maple/maple.c ++++ b/drivers/sh/maple/maple.c +@@ -835,8 +835,10 @@ static int __init maple_bus_init(void) + + maple_queue_cache = KMEM_CACHE(maple_buffer, SLAB_HWCACHE_ALIGN); + +- if (!maple_queue_cache) ++ if (!maple_queue_cache) { ++ retval = -ENOMEM; + goto cleanup_bothirqs; ++ } + + INIT_LIST_HEAD(&maple_waitq); + INIT_LIST_HEAD(&maple_sentq); +@@ -849,6 +851,7 @@ static int __init maple_bus_init(void) + if (!mdev[i]) { + while (i-- > 0) + maple_free_dev(mdev[i]); ++ retval = -ENOMEM; + goto cleanup_cache; + } + baseunits[i] = mdev[i]; +-- +2.33.0 + diff --git a/queue-5.4/mips-bcm63xx-add-support-for-clk_get_parent.patch b/queue-5.4/mips-bcm63xx-add-support-for-clk_get_parent.patch new file mode 100644 index 00000000000..73fcc8cfcf6 --- /dev/null +++ b/queue-5.4/mips-bcm63xx-add-support-for-clk_get_parent.patch @@ -0,0 +1,65 @@ +From bdbfddb5c72b62613d3e161aca4078e32f063ac1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 16:42:18 -0800 +Subject: mips: bcm63xx: add support for clk_get_parent() + +From: Randy Dunlap + +[ Upstream commit e8f67482e5a4bc8d0b65d606d08cb60ee123b468 ] + +BCM63XX selects HAVE_LEGACY_CLK but does not provide/support +clk_get_parent(), so add a simple implementation of that +function so that callers of it will build without errors. + +Fixes these build errors: + +mips-linux-ld: drivers/iio/adc/ingenic-adc.o: in function `jz4770_adc_init_clk_div': +ingenic-adc.c:(.text+0xe4): undefined reference to `clk_get_parent' +mips-linux-ld: drivers/iio/adc/ingenic-adc.o: in function `jz4725b_adc_init_clk_div': +ingenic-adc.c:(.text+0x1b8): undefined reference to `clk_get_parent' + +Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs." ) +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Suggested-by: Russell King (Oracle) +Cc: Artur Rojek +Cc: Paul Cercueil +Cc: linux-mips@vger.kernel.org +Cc: Jonathan Cameron +Cc: Lars-Peter Clausen +Cc: linux-iio@vger.kernel.org +Cc: Florian Fainelli +Cc: Andy Shevchenko +Cc: Russell King +Cc: bcm-kernel-feedback-list@broadcom.com +Cc: Jonas Gorski +Reviewed-by: Andy Shevchenko +Acked-by: Jonathan Cameron +Acked-by: Russell King (Oracle) +Acked-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/bcm63xx/clk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c +index 164115944a7fd..aba6e2d6a736c 100644 +--- a/arch/mips/bcm63xx/clk.c ++++ b/arch/mips/bcm63xx/clk.c +@@ -381,6 +381,12 @@ void clk_disable(struct clk *clk) + + EXPORT_SYMBOL(clk_disable); + ++struct clk *clk_get_parent(struct clk *clk) ++{ ++ return NULL; ++} ++EXPORT_SYMBOL(clk_get_parent); ++ + unsigned long clk_get_rate(struct clk *clk) + { + if (!clk) +-- +2.33.0 + diff --git a/queue-5.4/mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch b/queue-5.4/mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch new file mode 100644 index 00000000000..b634a275af1 --- /dev/null +++ b/queue-5.4/mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch @@ -0,0 +1,64 @@ +From 4fa99af54e66b67bbb2dc2e35a7a2471f6484c65 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Nov 2021 08:49:11 -0700 +Subject: mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set + +From: Randy Dunlap + +[ Upstream commit 5eeaafc8d69373c095e461bdb39e5c9b62228ac5 ] + +Several header files need info on CONFIG_32BIT or CONFIG_64BIT, +but kconfig symbol BCM63XX does not provide that info. This leads +to many build errors, e.g.: + + arch/mips/include/asm/page.h:196:13: error: use of undeclared identifier 'CAC_BASE' + return x - PAGE_OFFSET + PHYS_OFFSET; + arch/mips/include/asm/mach-generic/spaces.h:91:23: note: expanded from macro 'PAGE_OFFSET' + #define PAGE_OFFSET (CAC_BASE + PHYS_OFFSET) + arch/mips/include/asm/io.h:134:28: error: use of undeclared identifier 'CAC_BASE' + return (void *)(address + PAGE_OFFSET - PHYS_OFFSET); + arch/mips/include/asm/mach-generic/spaces.h:91:23: note: expanded from macro 'PAGE_OFFSET' + #define PAGE_OFFSET (CAC_BASE + PHYS_OFFSET) + +arch/mips/include/asm/uaccess.h:82:10: error: use of undeclared identifier '__UA_LIMIT' + return (__UA_LIMIT & (addr | (addr + size) | __ua_size(size))) == 0; + +Selecting the SYS_HAS_CPU_BMIPS* symbols causes SYS_HAS_CPU_BMIPS to be +set, which then selects CPU_SUPPORT_32BIT_KERNEL, which causes +CONFIG_32BIT to be set. (a bit more indirect than v1 [RFC].) + +Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Thomas Bogendoerfer +Cc: Florian Fainelli +Cc: bcm-kernel-feedback-list@broadcom.com +Cc: linux-mips@vger.kernel.org +Cc: Paul Burton +Cc: Maxime Bizon +Cc: Ralf Baechle +Suggested-by: Florian Fainelli +Acked-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/Kconfig | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index 041d34975ea2c..9749818eed6d6 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -294,6 +294,9 @@ config BCM63XX + select SYS_SUPPORTS_32BIT_KERNEL + select SYS_SUPPORTS_BIG_ENDIAN + select SYS_HAS_EARLY_PRINTK ++ select SYS_HAS_CPU_BMIPS32_3300 ++ select SYS_HAS_CPU_BMIPS4350 ++ select SYS_HAS_CPU_BMIPS4380 + select SWAP_IO_SPACE + select GPIOLIB + select HAVE_CLK +-- +2.33.0 + diff --git a/queue-5.4/mips-generic-yamon-dt-fix-uninitialized-variable-err.patch b/queue-5.4/mips-generic-yamon-dt-fix-uninitialized-variable-err.patch new file mode 100644 index 00000000000..60505edc935 --- /dev/null +++ b/queue-5.4/mips-generic-yamon-dt-fix-uninitialized-variable-err.patch @@ -0,0 +1,41 @@ +From 07eb927bb0f6f49f438bd3c7775b3797e2f82f0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 23:28:24 +0000 +Subject: MIPS: generic/yamon-dt: fix uninitialized variable error + +From: Colin Ian King + +[ Upstream commit 255e51da15baed47531beefd02f222e4dc01f1c1 ] + +In the case where fw_getenv returns an error when fetching values +for ememsizea and memsize then variable phys_memsize is not assigned +a variable and will be uninitialized on a zero check of phys_memsize. +Fix this by initializing phys_memsize to zero. + +Cleans up cppcheck error: +arch/mips/generic/yamon-dt.c:100:7: error: Uninitialized variable: phys_memsize [uninitvar] + +Fixes: f41d2430bbd6 ("MIPS: generic/yamon-dt: Support > 256MB of RAM") +Signed-off-by: Colin Ian King +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/generic/yamon-dt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/generic/yamon-dt.c b/arch/mips/generic/yamon-dt.c +index a3aa22c77cadc..a07a5edbcda78 100644 +--- a/arch/mips/generic/yamon-dt.c ++++ b/arch/mips/generic/yamon-dt.c +@@ -75,7 +75,7 @@ static unsigned int __init gen_fdt_mem_array( + __init int yamon_dt_append_memory(void *fdt, + const struct yamon_mem_region *regions) + { +- unsigned long phys_memsize, memsize; ++ unsigned long phys_memsize = 0, memsize; + __be32 mem_array[2 * MAX_MEM_ARRAY_ENTRIES]; + unsigned int mem_entries; + int i, err, mem_off; +-- +2.33.0 + diff --git a/queue-5.4/mips-lantiq-add-support-for-clk_get_parent.patch b/queue-5.4/mips-lantiq-add-support-for-clk_get_parent.patch new file mode 100644 index 00000000000..0ea4183da79 --- /dev/null +++ b/queue-5.4/mips-lantiq-add-support-for-clk_get_parent.patch @@ -0,0 +1,53 @@ +From 33fc584b2aa50cfb5128fbd11a002aeeddb5a708 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 17:20:51 -0800 +Subject: mips: lantiq: add support for clk_get_parent() + +From: Randy Dunlap + +[ Upstream commit fc1aabb088860d6cf9dd03612b7a6f0de91ccac2 ] + +Provide a simple implementation of clk_get_parent() in the +lantiq subarch so that callers of it will build without errors. + +Fixes this build error: +ERROR: modpost: "clk_get_parent" [drivers/iio/adc/ingenic-adc.ko] undefined! + +Fixes: 171bb2f19ed6 ("MIPS: Lantiq: Add initial support for Lantiq SoCs") +Signed-off-by: Randy Dunlap +Suggested-by: Russell King (Oracle) +Cc: linux-mips@vger.kernel.org +Cc: John Crispin +Cc: Thomas Bogendoerfer +Cc: Jonathan Cameron +Cc: linux-iio@vger.kernel.org +Cc: Russell King +Cc: Andy Shevchenko +Acked-by: Jonathan Cameron +Acked-by: John Crispin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/lantiq/clk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c +index dd819e31fcbbf..4916cccf378fd 100644 +--- a/arch/mips/lantiq/clk.c ++++ b/arch/mips/lantiq/clk.c +@@ -158,6 +158,12 @@ void clk_deactivate(struct clk *clk) + } + EXPORT_SYMBOL(clk_deactivate); + ++struct clk *clk_get_parent(struct clk *clk) ++{ ++ return NULL; ++} ++EXPORT_SYMBOL(clk_get_parent); ++ + static inline u32 get_counter_resolution(void) + { + u32 res; +-- +2.33.0 + diff --git a/queue-5.4/mips-sni-fix-the-build.patch b/queue-5.4/mips-sni-fix-the-build.patch new file mode 100644 index 00000000000..942b50f7c0b --- /dev/null +++ b/queue-5.4/mips-sni-fix-the-build.patch @@ -0,0 +1,54 @@ +From 5cb982059e7135b21631eb9874c8c4b49275b7cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 15:23:12 -0700 +Subject: MIPS: sni: Fix the build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bart Van Assche + +[ Upstream commit c91cf42f61dc77b289784ea7b15a8531defa41c0 ] + +This patch fixes the following gcc 10 build error: + +arch/mips/sni/time.c: In function ‘a20r_set_periodic’: +arch/mips/sni/time.c:15:26: error: unsigned conversion from ‘int’ to ‘u8’ {aka ‘volatile unsigned char’} changes value from ‘576’ to ‘64’ [-Werror=overflow] + 15 | #define SNI_COUNTER0_DIV ((SNI_CLOCK_TICK_RATE / SNI_COUNTER2_DIV) / HZ) + | ^ +arch/mips/sni/time.c:21:45: note: in expansion of macro ‘SNI_COUNTER0_DIV’ + 21 | *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV; + | ^~~~~~~~~~~~~~~~ + +Cc: linux-mips@vger.kernel.org +Signed-off-by: Bart Van Assche +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/sni/time.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/sni/time.c b/arch/mips/sni/time.c +index dbace1f3e1a97..745ceb945fc50 100644 +--- a/arch/mips/sni/time.c ++++ b/arch/mips/sni/time.c +@@ -18,14 +18,14 @@ static int a20r_set_periodic(struct clock_event_device *evt) + { + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0x34; + wmb(); +- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV; ++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV & 0xff; + wmb(); + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV >> 8; + wmb(); + + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0xb4; + wmb(); +- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV; ++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV & 0xff; + wmb(); + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV >> 8; + wmb(); +-- +2.33.0 + diff --git a/queue-5.4/net-bnx2x-fix-variable-dereferenced-before-check.patch b/queue-5.4/net-bnx2x-fix-variable-dereferenced-before-check.patch new file mode 100644 index 00000000000..bb2c206e503 --- /dev/null +++ b/queue-5.4/net-bnx2x-fix-variable-dereferenced-before-check.patch @@ -0,0 +1,46 @@ +From 62db9b51bbbad9386517bb73cd0b80654af26056 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 01:36:36 +0300 +Subject: net: bnx2x: fix variable dereferenced before check + +From: Pavel Skripkin + +[ Upstream commit f8885ac89ce310570e5391fe0bf0ec9c7c9b4fdc ] + +Smatch says: + bnx2x_init_ops.h:640 bnx2x_ilt_client_mem_op() + warn: variable dereferenced before check 'ilt' (see line 638) + +Move ilt_cli variable initialization _after_ ilt validation, because +it's unsafe to deref the pointer before validation check. + +Fixes: 523224a3b3cd ("bnx2x, cnic, bnx2i: use new FW/HSI") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h +index 1835d2e451c01..fc7fce642666c 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h +@@ -635,11 +635,13 @@ static int bnx2x_ilt_client_mem_op(struct bnx2x *bp, int cli_num, + { + int i, rc; + struct bnx2x_ilt *ilt = BP_ILT(bp); +- struct ilt_client_info *ilt_cli = &ilt->clients[cli_num]; ++ struct ilt_client_info *ilt_cli; + + if (!ilt || !ilt->lines) + return -1; + ++ ilt_cli = &ilt->clients[cli_num]; ++ + if (ilt_cli->flags & (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM)) + return 0; + +-- +2.33.0 + diff --git a/queue-5.4/net-dpaa2-eth-fix-use-after-free-in-dpaa2_eth_remove.patch b/queue-5.4/net-dpaa2-eth-fix-use-after-free-in-dpaa2_eth_remove.patch new file mode 100644 index 00000000000..898391b847b --- /dev/null +++ b/queue-5.4/net-dpaa2-eth-fix-use-after-free-in-dpaa2_eth_remove.patch @@ -0,0 +1,40 @@ +From 88349911af34bcac3fc4110212b9f04d65641fe5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 18:17:12 +0300 +Subject: net: dpaa2-eth: fix use-after-free in dpaa2_eth_remove + +From: Pavel Skripkin + +[ Upstream commit 9b5a333272a48c2f8b30add7a874e46e8b26129c ] + +Access to netdev after free_netdev() will cause use-after-free bug. +Move debug log before free_netdev() call to avoid it. + +Fixes: 7472dd9f6499 ("staging: fsl-dpaa2/eth: Move print message") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +index 7af7cc7c8669a..34540e604f748 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c +@@ -3616,10 +3616,10 @@ static int dpaa2_eth_remove(struct fsl_mc_device *ls_dev) + + fsl_mc_portal_free(priv->mc_io); + +- free_netdev(net_dev); +- + dev_dbg(net_dev->dev.parent, "Removed interface %s\n", net_dev->name); + ++ free_netdev(net_dev); ++ + return 0; + } + +-- +2.33.0 + diff --git a/queue-5.4/net-sched-act_mirred-drop-dst-for-the-direction-from.patch b/queue-5.4/net-sched-act_mirred-drop-dst-for-the-direction-from.patch new file mode 100644 index 00000000000..ce42c6b3070 --- /dev/null +++ b/queue-5.4/net-sched-act_mirred-drop-dst-for-the-direction-from.patch @@ -0,0 +1,79 @@ +From d4d92e545359153901471eab5657077e54c17167 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 11:33:11 -0500 +Subject: net: sched: act_mirred: drop dst for the direction from egress to + ingress + +From: Xin Long + +[ Upstream commit f799ada6bf2397c351220088b9b0980125c77280 ] + +Without dropping dst, the packets sent from local mirred/redirected +to ingress will may still use the old dst. ip_rcv() will drop it as +the old dst is for output and its .input is dst_discard. + +This patch is to fix by also dropping dst for those packets that are +mirred or redirected from egress to ingress in act_mirred. + +Note that we don't drop it for the direction change from ingress to +egress, as on which there might be a user case attaching a metadata +dst by act_tunnel_key that would be used later. + +Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct") +Signed-off-by: Xin Long +Acked-by: Cong Wang +Reviewed-by: Marcelo Ricardo Leitner +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/act_mirred.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c +index e3ff884a48c56..b87d2a1ee0b16 100644 +--- a/net/sched/act_mirred.c ++++ b/net/sched/act_mirred.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -218,6 +219,7 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + bool want_ingress; + bool is_redirect; + bool expects_nh; ++ bool at_ingress; + int m_eaction; + int mac_len; + bool at_nh; +@@ -253,7 +255,8 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + * ingress - that covers the TC S/W datapath. + */ + is_redirect = tcf_mirred_is_act_redirect(m_eaction); +- use_reinsert = skb_at_tc_ingress(skb) && is_redirect && ++ at_ingress = skb_at_tc_ingress(skb); ++ use_reinsert = at_ingress && is_redirect && + tcf_mirred_can_reinsert(retval); + if (!use_reinsert) { + skb2 = skb_clone(skb, GFP_ATOMIC); +@@ -261,10 +264,12 @@ static int tcf_mirred_act(struct sk_buff *skb, const struct tc_action *a, + goto out; + } + ++ want_ingress = tcf_mirred_act_wants_ingress(m_eaction); ++ + /* All mirred/redirected skbs should clear previous ct info */ + nf_reset_ct(skb2); +- +- want_ingress = tcf_mirred_act_wants_ingress(m_eaction); ++ if (want_ingress && !at_ingress) /* drop dst for egress -> ingress */ ++ skb_dst_drop(skb2); + + expects_nh = want_ingress || !m_mac_header_xmit; + at_nh = skb->data == skb_network_header(skb); +-- +2.33.0 + diff --git a/queue-5.4/net-virtio_net_hdr_to_skb-count-transport-header-in-.patch b/queue-5.4/net-virtio_net_hdr_to_skb-count-transport-header-in-.patch new file mode 100644 index 00000000000..8ebd213fe75 --- /dev/null +++ b/queue-5.4/net-virtio_net_hdr_to_skb-count-transport-header-in-.patch @@ -0,0 +1,75 @@ +From 3b076aa2c87e3f8db9e19311d4b9f35c4f95cf85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 17:42:42 +0000 +Subject: net: virtio_net_hdr_to_skb: count transport header in UFO + +From: Jonathan Davies + +[ Upstream commit cf9acc90c80ecbee00334aa85d92f4e74014bcff ] + +virtio_net_hdr_to_skb does not set the skb's gso_size and gso_type +correctly for UFO packets received via virtio-net that are a little over +the GSO size. This can lead to problems elsewhere in the networking +stack, e.g. ovs_vport_send dropping over-sized packets if gso_size is +not set. + +This is due to the comparison + + if (skb->len - p_off > gso_size) + +not properly accounting for the transport layer header. + +p_off includes the size of the transport layer header (thlen), so +skb->len - p_off is the size of the TCP/UDP payload. + +gso_size is read from the virtio-net header. For UFO, fragmentation +happens at the IP level so does not need to include the UDP header. + +Hence the calculation could be comparing a TCP/UDP payload length with +an IP payload length, causing legitimate virtio-net packets to have +lack gso_type/gso_size information. + +Example: a UDP packet with payload size 1473 has IP payload size 1481. +If the guest used UFO, it is not fragmented and the virtio-net header's +flags indicate that it is a GSO frame (VIRTIO_NET_HDR_GSO_UDP), with +gso_size = 1480 for an MTU of 1500. skb->len will be 1515 and p_off +will be 42, so skb->len - p_off = 1473. Hence the comparison fails, and +shinfo->gso_size and gso_type are not set as they should be. + +Instead, add the UDP header length before comparing to gso_size when +using UFO. In this way, it is the size of the IP payload that is +compared to gso_size. + +Fixes: 6dd912f82680 ("net: check untrusted gso_size at kernel entry") +Signed-off-by: Jonathan Davies +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/virtio_net.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h +index b465f8f3e554f..04e87f4b9417c 100644 +--- a/include/linux/virtio_net.h ++++ b/include/linux/virtio_net.h +@@ -120,10 +120,15 @@ retry: + + if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { + u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); ++ unsigned int nh_off = p_off; + struct skb_shared_info *shinfo = skb_shinfo(skb); + ++ /* UFO may not include transport header in gso_size. */ ++ if (gso_type & SKB_GSO_UDP) ++ nh_off -= thlen; ++ + /* Too small packets are not really GSO ones. */ +- if (skb->len - p_off > gso_size) { ++ if (skb->len - nh_off > gso_size) { + shinfo->gso_size = gso_size; + shinfo->gso_type = gso_type; + +-- +2.33.0 + diff --git a/queue-5.4/nfc-reorder-the-logic-in-nfc_-un-register_device.patch b/queue-5.4/nfc-reorder-the-logic-in-nfc_-un-register_device.patch new file mode 100644 index 00000000000..06603a93026 --- /dev/null +++ b/queue-5.4/nfc-reorder-the-logic-in-nfc_-un-register_device.patch @@ -0,0 +1,129 @@ +From e4b5a369ad4d520027572050bb34214967cc7e08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 23:26:52 +0800 +Subject: NFC: reorder the logic in nfc_{un,}register_device + +From: Lin Ma + +[ Upstream commit 3e3b5dfcd16a3e254aab61bd1e8c417dd4503102 ] + +There is a potential UAF between the unregistration routine and the NFC +netlink operations. + +The race that cause that UAF can be shown as below: + + (FREE) | (USE) +nfcmrvl_nci_unregister_dev | nfc_genl_dev_up + nci_close_device | + nci_unregister_device | nfc_get_device + nfc_unregister_device | nfc_dev_up + rfkill_destory | + device_del | rfkill_blocked + ... | ... + +The root cause for this race is concluded below: +1. The rfkill_blocked (USE) in nfc_dev_up is supposed to be placed after +the device_is_registered check. +2. Since the netlink operations are possible just after the device_add +in nfc_register_device, the nfc_dev_up() can happen anywhere during the +rfkill creation process, which leads to data race. + +This patch reorder these actions to permit +1. Once device_del is finished, the nfc_dev_up cannot dereference the +rfkill object. +2. The rfkill_register need to be placed after the device_add of nfc_dev +because the parent device need to be created first. So this patch keeps +the order but inject device_lock to prevent the data race. + +Signed-off-by: Lin Ma +Fixes: be055b2f89b5 ("NFC: RFKILL support") +Reviewed-by: Jakub Kicinski +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20211116152652.19217-1-linma@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/nfc/core.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/net/nfc/core.c b/net/nfc/core.c +index c5f9c3ee82f8e..e752692d36802 100644 +--- a/net/nfc/core.c ++++ b/net/nfc/core.c +@@ -94,13 +94,13 @@ int nfc_dev_up(struct nfc_dev *dev) + + device_lock(&dev->dev); + +- if (dev->rfkill && rfkill_blocked(dev->rfkill)) { +- rc = -ERFKILL; ++ if (!device_is_registered(&dev->dev)) { ++ rc = -ENODEV; + goto error; + } + +- if (!device_is_registered(&dev->dev)) { +- rc = -ENODEV; ++ if (dev->rfkill && rfkill_blocked(dev->rfkill)) { ++ rc = -ERFKILL; + goto error; + } + +@@ -1118,11 +1118,7 @@ int nfc_register_device(struct nfc_dev *dev) + if (rc) + pr_err("Could not register llcp device\n"); + +- rc = nfc_genl_device_added(dev); +- if (rc) +- pr_debug("The userspace won't be notified that the device %s was added\n", +- dev_name(&dev->dev)); +- ++ device_lock(&dev->dev); + dev->rfkill = rfkill_alloc(dev_name(&dev->dev), &dev->dev, + RFKILL_TYPE_NFC, &nfc_rfkill_ops, dev); + if (dev->rfkill) { +@@ -1131,6 +1127,12 @@ int nfc_register_device(struct nfc_dev *dev) + dev->rfkill = NULL; + } + } ++ device_unlock(&dev->dev); ++ ++ rc = nfc_genl_device_added(dev); ++ if (rc) ++ pr_debug("The userspace won't be notified that the device %s was added\n", ++ dev_name(&dev->dev)); + + return 0; + } +@@ -1147,10 +1149,17 @@ void nfc_unregister_device(struct nfc_dev *dev) + + pr_debug("dev_name=%s\n", dev_name(&dev->dev)); + ++ rc = nfc_genl_device_removed(dev); ++ if (rc) ++ pr_debug("The userspace won't be notified that the device %s " ++ "was removed\n", dev_name(&dev->dev)); ++ ++ device_lock(&dev->dev); + if (dev->rfkill) { + rfkill_unregister(dev->rfkill); + rfkill_destroy(dev->rfkill); + } ++ device_unlock(&dev->dev); + + if (dev->ops->check_presence) { + device_lock(&dev->dev); +@@ -1160,11 +1169,6 @@ void nfc_unregister_device(struct nfc_dev *dev) + cancel_work_sync(&dev->check_pres_work); + } + +- rc = nfc_genl_device_removed(dev); +- if (rc) +- pr_debug("The userspace won't be notified that the device %s " +- "was removed\n", dev_name(&dev->dev)); +- + nfc_llcp_unregister_device(dev); + + mutex_lock(&nfc_devlist_mutex); +-- +2.33.0 + diff --git a/queue-5.4/nfc-reorganize-the-functions-in-nci_request.patch b/queue-5.4/nfc-reorganize-the-functions-in-nci_request.patch new file mode 100644 index 00000000000..0d3b6df39fa --- /dev/null +++ b/queue-5.4/nfc-reorganize-the-functions-in-nci_request.patch @@ -0,0 +1,62 @@ +From 9221de750a193d19858c271781a67023c4f31031 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Nov 2021 22:56:00 +0800 +Subject: NFC: reorganize the functions in nci_request + +From: Lin Ma + +[ Upstream commit 86cdf8e38792545161dbe3350a7eced558ba4d15 ] + +There is a possible data race as shown below: + +thread-A in nci_request() | thread-B in nci_close_device() + | mutex_lock(&ndev->req_lock); +test_bit(NCI_UP, &ndev->flags); | +... | test_and_clear_bit(NCI_UP, &ndev->flags) +mutex_lock(&ndev->req_lock); | + | + +This race will allow __nci_request() to be awaked while the device is +getting removed. + +Similar to commit e2cb6b891ad2 ("bluetooth: eliminate the potential race +condition when removing the HCI controller"). this patch alters the +function sequence in nci_request() to prevent the data races between the +nci_close_device(). + +Signed-off-by: Lin Ma +Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") +Link: https://lore.kernel.org/r/20211115145600.8320-1-linma@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/nfc/nci/core.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index 6a34a0a786eaa..1d0aa9e6044bf 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -144,12 +144,15 @@ inline int nci_request(struct nci_dev *ndev, + { + int rc; + +- if (!test_bit(NCI_UP, &ndev->flags)) +- return -ENETDOWN; +- + /* Serialize all requests */ + mutex_lock(&ndev->req_lock); +- rc = __nci_request(ndev, req, opt, timeout); ++ /* check the state after obtaing the lock against any races ++ * from nci_close_device when the device gets removed. ++ */ ++ if (test_bit(NCI_UP, &ndev->flags)) ++ rc = __nci_request(ndev, req, opt, timeout); ++ else ++ rc = -ENETDOWN; + mutex_unlock(&ndev->req_lock); + + return rc; +-- +2.33.0 + diff --git a/queue-5.4/perf-bench-fix-two-memory-leaks-detected-with-asan.patch b/queue-5.4/perf-bench-fix-two-memory-leaks-detected-with-asan.patch new file mode 100644 index 00000000000..f7305388a92 --- /dev/null +++ b/queue-5.4/perf-bench-fix-two-memory-leaks-detected-with-asan.patch @@ -0,0 +1,56 @@ +From 95b40d75fc9d87bb9719208e6a6c87ff59c9afd9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 04:20:11 +0200 +Subject: perf bench: Fix two memory leaks detected with ASan + +From: Sohaib Mohamed + +[ Upstream commit 92723ea0f11d92496687db8c9725248e9d1e5e1d ] + +ASan reports memory leaks while running: + + $ perf bench sched all + +Fixes: e27454cc6352c422 ("perf bench: Add sched-messaging.c: Benchmark for scheduler and IPC mechanisms based on hackbench") +Signed-off-by: Sohaib Mohamed +Acked-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Hitoshi Mitake +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Paul Russel +Cc: Peter Zijlstra +Cc: Pierre Gondois +Link: http://lore.kernel.org/lkml/20211110022012.16620-1-sohaib.amhmd@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/sched-messaging.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/bench/sched-messaging.c b/tools/perf/bench/sched-messaging.c +index b142d87337be8..9e6e0ca6a2002 100644 +--- a/tools/perf/bench/sched-messaging.c ++++ b/tools/perf/bench/sched-messaging.c +@@ -223,6 +223,8 @@ static unsigned int group(pthread_t *pth, + snd_ctx->out_fds[i] = fds[1]; + if (!thread_mode) + close(fds[0]); ++ ++ free(ctx); + } + + /* Now we have all the fds, fork the senders */ +@@ -239,6 +241,8 @@ static unsigned int group(pthread_t *pth, + for (i = 0; i < num_fds; i++) + close(snd_ctx->out_fds[i]); + ++ free(snd_ctx); ++ + /* Return number of children to reap */ + return num_fds * 2; + } +-- +2.33.0 + diff --git a/queue-5.4/perf-bench-futex-fix-memory-leak-of-perf_cpu_map__ne.patch b/queue-5.4/perf-bench-futex-fix-memory-leak-of-perf_cpu_map__ne.patch new file mode 100644 index 00000000000..173aeed0d66 --- /dev/null +++ b/queue-5.4/perf-bench-futex-fix-memory-leak-of-perf_cpu_map__ne.patch @@ -0,0 +1,93 @@ +From 2aa50def217caed482d0351ea447da73ef63d2a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Nov 2021 22:11:33 +0200 +Subject: perf bench futex: Fix memory leak of perf_cpu_map__new() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sohaib Mohamed + +[ Upstream commit 88e48238d53682281c9de2a0b65d24d3b64542a0 ] + +ASan reports memory leaks while running: + + $ sudo ./perf bench futex all + +The leaks are caused by perf_cpu_map__new not being freed. +This patch adds the missing perf_cpu_map__put since it calls +cpu_map_delete implicitly. + +Fixes: 9c3516d1b850ea93 ("libperf: Add perf_cpu_map__new()/perf_cpu_map__read() functions") +Signed-off-by: Sohaib Mohamed +Cc: Alexander Shishkin +Cc: André Almeida +Cc: Darren Hart +Cc: Davidlohr Bueso +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Sohaib Mohamed +Cc: Thomas Gleixner +Link: http://lore.kernel.org/lkml/20211112201134.77892-1-sohaib.amhmd@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/futex-lock-pi.c | 1 + + tools/perf/bench/futex-requeue.c | 1 + + tools/perf/bench/futex-wake-parallel.c | 1 + + tools/perf/bench/futex-wake.c | 1 + + 4 files changed, 4 insertions(+) + +diff --git a/tools/perf/bench/futex-lock-pi.c b/tools/perf/bench/futex-lock-pi.c +index 30d97121dc4fb..c54013806ba4a 100644 +--- a/tools/perf/bench/futex-lock-pi.c ++++ b/tools/perf/bench/futex-lock-pi.c +@@ -224,6 +224,7 @@ int bench_futex_lock_pi(int argc, const char **argv) + print_summary(); + + free(worker); ++ perf_cpu_map__put(cpu); + return ret; + err: + usage_with_options(bench_futex_lock_pi_usage, options); +diff --git a/tools/perf/bench/futex-requeue.c b/tools/perf/bench/futex-requeue.c +index a00a6891447ab..11b7dbd374864 100644 +--- a/tools/perf/bench/futex-requeue.c ++++ b/tools/perf/bench/futex-requeue.c +@@ -215,6 +215,7 @@ int bench_futex_requeue(int argc, const char **argv) + print_summary(); + + free(worker); ++ perf_cpu_map__put(cpu); + return ret; + err: + usage_with_options(bench_futex_requeue_usage, options); +diff --git a/tools/perf/bench/futex-wake-parallel.c b/tools/perf/bench/futex-wake-parallel.c +index a053cf2b70397..c3033d0905db1 100644 +--- a/tools/perf/bench/futex-wake-parallel.c ++++ b/tools/perf/bench/futex-wake-parallel.c +@@ -319,6 +319,7 @@ int bench_futex_wake_parallel(int argc, const char **argv) + print_summary(); + + free(blocked_worker); ++ perf_cpu_map__put(cpu); + return ret; + } + #endif /* HAVE_PTHREAD_BARRIER */ +diff --git a/tools/perf/bench/futex-wake.c b/tools/perf/bench/futex-wake.c +index 58906e9499bb0..ad44a78392dc4 100644 +--- a/tools/perf/bench/futex-wake.c ++++ b/tools/perf/bench/futex-wake.c +@@ -209,5 +209,6 @@ int bench_futex_wake(int argc, const char **argv) + print_summary(); + + free(worker); ++ perf_cpu_map__put(cpu); + return ret; + } +-- +2.33.0 + diff --git a/queue-5.4/perf-bpf-avoid-memory-leak-from-perf_env__insert_btf.patch b/queue-5.4/perf-bpf-avoid-memory-leak-from-perf_env__insert_btf.patch new file mode 100644 index 00000000000..ae3a7e7ab9a --- /dev/null +++ b/queue-5.4/perf-bpf-avoid-memory-leak-from-perf_env__insert_btf.patch @@ -0,0 +1,113 @@ +From d2be9165e217322dcce0241a726bd2d59be460d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Nov 2021 23:45:25 -0800 +Subject: perf bpf: Avoid memory leak from perf_env__insert_btf() + +From: Ian Rogers + +[ Upstream commit 4924b1f7c46711762fd0e65c135ccfbcfd6ded1f ] + +perf_env__insert_btf() doesn't insert if a duplicate BTF id is +encountered and this causes a memory leak. Modify the function to return +a success/error value and then free the memory if insertion didn't +happen. + +v2. Adds a return -1 when the insertion error occurs in + perf_env__fetch_btf. This doesn't affect anything as the result is + never checked. + +Fixes: 3792cb2ff43b1b19 ("perf bpf: Save BTF in a rbtree in perf_env") +Signed-off-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Alexei Starovoitov +Cc: Andrii Nakryiko +Cc: Daniel Borkmann +Cc: Jiri Olsa +Cc: John Fastabend +Cc: KP Singh +Cc: Mark Rutland +Cc: Martin KaFai Lau +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Stephane Eranian +Cc: Tiezhu Yang +Cc: Yonghong Song +Cc: bpf@vger.kernel.org +Cc: netdev@vger.kernel.org +Link: http://lore.kernel.org/lkml/20211112074525.121633-1-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/bpf-event.c | 6 +++++- + tools/perf/util/env.c | 5 ++++- + tools/perf/util/env.h | 2 +- + 3 files changed, 10 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c +index c766813d56be0..782c0c8a9a836 100644 +--- a/tools/perf/util/bpf-event.c ++++ b/tools/perf/util/bpf-event.c +@@ -108,7 +108,11 @@ static int perf_env__fetch_btf(struct perf_env *env, + node->data_size = data_size; + memcpy(node->data, data, data_size); + +- perf_env__insert_btf(env, node); ++ if (!perf_env__insert_btf(env, node)) { ++ /* Insertion failed because of a duplicate. */ ++ free(node); ++ return -1; ++ } + return 0; + } + +diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c +index 0fafcf264d235..ef64e197bc8df 100644 +--- a/tools/perf/util/env.c ++++ b/tools/perf/util/env.c +@@ -69,12 +69,13 @@ out: + return node; + } + +-void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) ++bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) + { + struct rb_node *parent = NULL; + __u32 btf_id = btf_node->id; + struct btf_node *node; + struct rb_node **p; ++ bool ret = true; + + down_write(&env->bpf_progs.lock); + p = &env->bpf_progs.btfs.rb_node; +@@ -88,6 +89,7 @@ void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) + p = &(*p)->rb_right; + } else { + pr_debug("duplicated btf %u\n", btf_id); ++ ret = false; + goto out; + } + } +@@ -97,6 +99,7 @@ void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node) + env->bpf_progs.btfs_cnt++; + out: + up_write(&env->bpf_progs.lock); ++ return ret; + } + + struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id) +diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h +index db40906e29373..37028215d4a53 100644 +--- a/tools/perf/util/env.h ++++ b/tools/perf/util/env.h +@@ -117,6 +117,6 @@ void perf_env__insert_bpf_prog_info(struct perf_env *env, + struct bpf_prog_info_node *info_node); + struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env, + __u32 prog_id); +-void perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node); ++bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node); + struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id); + #endif /* __PERF_ENV_H */ +-- +2.33.0 + diff --git a/queue-5.4/perf-tests-remove-bash-construct-from-record-zstd_co.patch b/queue-5.4/perf-tests-remove-bash-construct-from-record-zstd_co.patch new file mode 100644 index 00000000000..5de3a9e0aa2 --- /dev/null +++ b/queue-5.4/perf-tests-remove-bash-construct-from-record-zstd_co.patch @@ -0,0 +1,62 @@ +From 5b1c22e6838ad12a4eddee9a2d92b05d29d118fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 Oct 2021 14:48:26 +0100 +Subject: perf tests: Remove bash construct from record+zstd_comp_decomp.sh + +From: James Clark + +[ Upstream commit a9cdc1c5e3700a5200e5ca1f90b6958b6483845b ] + +Commit 463538a383a2 ("perf tests: Fix test 68 zstd compression for +s390") inadvertently removed the -g flag from all platforms rather than +just s390, because the [[ ]] construct fails in sh. Changing to single +brackets restores testing of call graphs and removes the following error +from the output: + + $ ./perf test -v 85 + 85: Zstd perf.data compression/decompression : + --- start --- + test child forked, pid 50643 + Collecting compressed record file: + ./tests/shell/record+zstd_comp_decomp.sh: 15: [[: not found + +Fixes: 463538a383a2 ("perf tests: Fix test 68 zstd compression for s390") +Signed-off-by: James Clark +Cc: Alexander Shishkin +Cc: Florian Fainelli +Cc: Ian Rogers +Cc: Jiri Olsa +Cc: John Fastabend +Cc: KP Singh +Cc: Mark Rutland +Cc: Martin KaFai Lau +Cc: Namhyung Kim +Cc: Song Liu +Cc: Sumanth Korikkar +Cc: Thomas Richter +Cc: Yonghong Song +Cc: bpf@vger.kernel.org +Cc: netdev@vger.kernel.org +Link: https://lore.kernel.org/r/20211028134828.65774-3-james.clark@arm.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/shell/record+zstd_comp_decomp.sh | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/tests/shell/record+zstd_comp_decomp.sh b/tools/perf/tests/shell/record+zstd_comp_decomp.sh +index 045723b3d9928..c62af807198de 100755 +--- a/tools/perf/tests/shell/record+zstd_comp_decomp.sh ++++ b/tools/perf/tests/shell/record+zstd_comp_decomp.sh +@@ -12,7 +12,7 @@ skip_if_no_z_record() { + + collect_z_record() { + echo "Collecting compressed record file:" +- [[ "$(uname -m)" != s390x ]] && gflag='-g' ++ [ "$(uname -m)" != s390x ] && gflag='-g' + $perf_tool record -o $trace_file $gflag -z -F 5000 -- \ + dd count=500 if=/dev/urandom of=/dev/null + } +-- +2.33.0 + diff --git a/queue-5.4/platform-x86-hp_accel-fix-an-error-handling-path-in-.patch b/queue-5.4/platform-x86-hp_accel-fix-an-error-handling-path-in-.patch new file mode 100644 index 00000000000..26eb3d7311d --- /dev/null +++ b/queue-5.4/platform-x86-hp_accel-fix-an-error-handling-path-in-.patch @@ -0,0 +1,46 @@ +From 1a84c9ee7f2ce1873d0db2cacc86bfaa5026dbb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Nov 2021 20:57:07 +0100 +Subject: platform/x86: hp_accel: Fix an error handling path in + 'lis3lv02d_probe()' + +From: Christophe JAILLET + +[ Upstream commit c961a7d2aa23ae19e0099fbcdf1040fb760eea83 ] + +If 'led_classdev_register()' fails, some additional resources should be +released. + +Add the missing 'i8042_remove_filter()' and 'lis3lv02d_remove_fs()' calls +that are already in the remove function but are missing here. + +Fixes: a4c724d0723b ("platform: hp_accel: add a i8042 filter to remove HPQ6000 data from kb bus stream") +Fixes: 9e0c79782143 ("lis3lv02d: merge with leds hp disk") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/5a4f218f8f16d2e3a7906b7ca3654ffa946895f8.1636314074.git.christophe.jaillet@wanadoo.fr +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/hp_accel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index 8c0867bda8280..0dfaa1a43b674 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -372,9 +372,11 @@ static int lis3lv02d_add(struct acpi_device *device) + INIT_WORK(&hpled_led.work, delayed_set_status_worker); + ret = led_classdev_register(NULL, &hpled_led.led_classdev); + if (ret) { ++ i8042_remove_filter(hp_accel_i8042_filter); + lis3lv02d_joystick_disable(&lis3_dev); + lis3lv02d_poweroff(&lis3_dev); + flush_work(&hpled_led.work); ++ lis3lv02d_remove_fs(&lis3_dev); + return ret; + } + +-- +2.33.0 + diff --git a/queue-5.4/powerpc-5200-dts-fix-memory-node-unit-name.patch b/queue-5.4/powerpc-5200-dts-fix-memory-node-unit-name.patch new file mode 100644 index 00000000000..fa9ab588a48 --- /dev/null +++ b/queue-5.4/powerpc-5200-dts-fix-memory-node-unit-name.patch @@ -0,0 +1,191 @@ +From 3572fe62fd2a381bd3778ee49ccbf413bfc4e5db Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 00:05:31 +0200 +Subject: powerpc/5200: dts: fix memory node unit name + +From: Anatolij Gustschin + +[ Upstream commit aed2886a5e9ffc8269a4220bff1e9e030d3d2eb1 ] + +Fixes build warnings: +Warning (unit_address_vs_reg): /memory: node has a reg or ranges property, but no unit name + +Signed-off-by: Anatolij Gustschin +Reviewed-by: Rob Herring +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211013220532.24759-4-agust@denx.de +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/charon.dts | 2 +- + arch/powerpc/boot/dts/digsy_mtc.dts | 2 +- + arch/powerpc/boot/dts/lite5200.dts | 2 +- + arch/powerpc/boot/dts/lite5200b.dts | 2 +- + arch/powerpc/boot/dts/media5200.dts | 2 +- + arch/powerpc/boot/dts/mpc5200b.dtsi | 2 +- + arch/powerpc/boot/dts/o2d.dts | 2 +- + arch/powerpc/boot/dts/o2d.dtsi | 2 +- + arch/powerpc/boot/dts/o2dnt2.dts | 2 +- + arch/powerpc/boot/dts/o3dnt.dts | 2 +- + arch/powerpc/boot/dts/pcm032.dts | 2 +- + arch/powerpc/boot/dts/tqm5200.dts | 2 +- + 12 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/powerpc/boot/dts/charon.dts b/arch/powerpc/boot/dts/charon.dts +index 408b486b13dff..cd589539f313f 100644 +--- a/arch/powerpc/boot/dts/charon.dts ++++ b/arch/powerpc/boot/dts/charon.dts +@@ -35,7 +35,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x08000000>; // 128MB + }; +diff --git a/arch/powerpc/boot/dts/digsy_mtc.dts b/arch/powerpc/boot/dts/digsy_mtc.dts +index 0e5e9d3acf79f..19a14e62e65f4 100644 +--- a/arch/powerpc/boot/dts/digsy_mtc.dts ++++ b/arch/powerpc/boot/dts/digsy_mtc.dts +@@ -16,7 +16,7 @@ + model = "intercontrol,digsy-mtc"; + compatible = "intercontrol,digsy-mtc"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x02000000>; // 32MB + }; + +diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts +index cb2782dd6132c..e7b194775d783 100644 +--- a/arch/powerpc/boot/dts/lite5200.dts ++++ b/arch/powerpc/boot/dts/lite5200.dts +@@ -32,7 +32,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts +index 2b86c81f90485..547cbe726ff23 100644 +--- a/arch/powerpc/boot/dts/lite5200b.dts ++++ b/arch/powerpc/boot/dts/lite5200b.dts +@@ -31,7 +31,7 @@ + led4 { gpios = <&gpio_simple 2 1>; }; + }; + +- memory { ++ memory@0 { + reg = <0x00000000 0x10000000>; // 256MB + }; + +diff --git a/arch/powerpc/boot/dts/media5200.dts b/arch/powerpc/boot/dts/media5200.dts +index 61cae9dcddef4..f3188018faceb 100644 +--- a/arch/powerpc/boot/dts/media5200.dts ++++ b/arch/powerpc/boot/dts/media5200.dts +@@ -32,7 +32,7 @@ + }; + }; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB RAM + }; + +diff --git a/arch/powerpc/boot/dts/mpc5200b.dtsi b/arch/powerpc/boot/dts/mpc5200b.dtsi +index 648fe31795f49..8b796f3b11da7 100644 +--- a/arch/powerpc/boot/dts/mpc5200b.dtsi ++++ b/arch/powerpc/boot/dts/mpc5200b.dtsi +@@ -33,7 +33,7 @@ + }; + }; + +- memory: memory { ++ memory: memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/boot/dts/o2d.dts b/arch/powerpc/boot/dts/o2d.dts +index 24a46f65e5299..e0a8d3034417f 100644 +--- a/arch/powerpc/boot/dts/o2d.dts ++++ b/arch/powerpc/boot/dts/o2d.dts +@@ -12,7 +12,7 @@ + model = "ifm,o2d"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/o2d.dtsi b/arch/powerpc/boot/dts/o2d.dtsi +index 6661955a2be47..b55a9e5bd828c 100644 +--- a/arch/powerpc/boot/dts/o2d.dtsi ++++ b/arch/powerpc/boot/dts/o2d.dtsi +@@ -19,7 +19,7 @@ + model = "ifm,o2d"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x04000000>; // 64MB + }; + +diff --git a/arch/powerpc/boot/dts/o2dnt2.dts b/arch/powerpc/boot/dts/o2dnt2.dts +index eeba7f5507d5d..c2eedbd1f5fcb 100644 +--- a/arch/powerpc/boot/dts/o2dnt2.dts ++++ b/arch/powerpc/boot/dts/o2dnt2.dts +@@ -12,7 +12,7 @@ + model = "ifm,o2dnt2"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/o3dnt.dts b/arch/powerpc/boot/dts/o3dnt.dts +index fd00396b0593e..e4c1bdd412716 100644 +--- a/arch/powerpc/boot/dts/o3dnt.dts ++++ b/arch/powerpc/boot/dts/o3dnt.dts +@@ -12,7 +12,7 @@ + model = "ifm,o3dnt"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x04000000>; // 64MB + }; + +diff --git a/arch/powerpc/boot/dts/pcm032.dts b/arch/powerpc/boot/dts/pcm032.dts +index c259c6b3ac5ab..5674f978b9830 100644 +--- a/arch/powerpc/boot/dts/pcm032.dts ++++ b/arch/powerpc/boot/dts/pcm032.dts +@@ -22,7 +22,7 @@ + model = "phytec,pcm032"; + compatible = "phytec,pcm032"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/tqm5200.dts b/arch/powerpc/boot/dts/tqm5200.dts +index 9ed0bc78967e1..5bb25a9e40a01 100644 +--- a/arch/powerpc/boot/dts/tqm5200.dts ++++ b/arch/powerpc/boot/dts/tqm5200.dts +@@ -32,7 +32,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +-- +2.33.0 + diff --git a/queue-5.4/powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch b/queue-5.4/powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch new file mode 100644 index 00000000000..3c29bfb27a4 --- /dev/null +++ b/queue-5.4/powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch @@ -0,0 +1,66 @@ +From 2f23d0ab070604623724bb5fd2a83f2aed46373d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 13:44:24 +1100 +Subject: powerpc/dcr: Use cmplwi instead of 3-argument cmpli +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +[ Upstream commit fef071be57dc43679a32d5b0e6ee176d6f12e9f2 ] + +In dcr-low.S we use cmpli with three arguments, instead of four +arguments as defined in the ISA: + + cmpli cr0,r3,1024 + +This appears to be a PPC440-ism, looking at the "PPC440x5 CPU Core +User’s Manual" it shows cmpli having no L field, but implied to be 0 due +to the core being 32-bit. It mentions that the ISA defines four +arguments and recommends using cmplwi. + +It also corresponds to the old POWER instruction set, which had no L +field there, a reserved bit instead. + +dcr-low.S is only built 32-bit, because it is only built when +DCR_NATIVE=y, which is only selected by 40x and 44x. Looking at the +generated code (with gcc/gas) we see cmplwi as expected. + +Although gas is happy with the 3-argument version when building for +32-bit, the LLVM assembler is not and errors out with: + + arch/powerpc/sysdev/dcr-low.S:27:10: error: invalid operand for instruction + cmpli 0,%r3,1024; ... + ^ + +Switch to the cmplwi extended opcode, which avoids any confusion when +reading the ISA, fixes the issue with the LLVM assembler, and also means +the code could be built 64-bit in future (though that's very unlikely). + +Reported-by: Nick Desaulniers +Reviewed-by: Nick Desaulniers +Signed-off-by: Michael Ellerman +BugLink: https://github.com/ClangBuiltLinux/linux/issues/1419 +Link: https://lore.kernel.org/r/20211014024424.528848-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/dcr-low.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/sysdev/dcr-low.S b/arch/powerpc/sysdev/dcr-low.S +index efeeb1b885a17..329b9c4ae5429 100644 +--- a/arch/powerpc/sysdev/dcr-low.S ++++ b/arch/powerpc/sysdev/dcr-low.S +@@ -11,7 +11,7 @@ + #include + + #define DCR_ACCESS_PROLOG(table) \ +- cmpli cr0,r3,1024; \ ++ cmplwi cr0,r3,1024; \ + rlwinm r3,r3,4,18,27; \ + lis r5,table@h; \ + ori r5,r5,table@l; \ +-- +2.33.0 + diff --git a/queue-5.4/rdma-bnxt_re-check-if-the-vlan-is-valid-before-repor.patch b/queue-5.4/rdma-bnxt_re-check-if-the-vlan-is-valid-before-repor.patch new file mode 100644 index 00000000000..7388b047b71 --- /dev/null +++ b/queue-5.4/rdma-bnxt_re-check-if-the-vlan-is-valid-before-repor.patch @@ -0,0 +1,57 @@ +From d8112048db774a9e87047b775e33f01b14f30d69 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 05:32:42 -0700 +Subject: RDMA/bnxt_re: Check if the vlan is valid before reporting + +From: Selvin Xavier + +[ Upstream commit 6bda39149d4b8920fdb8744090653aca3daa792d ] + +When VF is configured with default vlan, HW strips the vlan from the +packet and driver receives it in Rx completion. VLAN needs to be reported +for UD work completion only if the vlan is configured on the host. Add a +check for valid vlan in the UD receive path. + +Link: https://lore.kernel.org/r/1631709163-2287-12-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index a96f9142fe08e..dd006b177b544 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -3081,8 +3081,11 @@ static void bnxt_re_process_res_ud_wc(struct bnxt_re_qp *qp, + struct ib_wc *wc, + struct bnxt_qplib_cqe *cqe) + { ++ struct bnxt_re_dev *rdev; ++ u16 vlan_id = 0; + u8 nw_type; + ++ rdev = qp->rdev; + wc->opcode = IB_WC_RECV; + wc->status = __rc_to_ib_wc_status(cqe->status); + +@@ -3094,9 +3097,12 @@ static void bnxt_re_process_res_ud_wc(struct bnxt_re_qp *qp, + memcpy(wc->smac, cqe->smac, ETH_ALEN); + wc->wc_flags |= IB_WC_WITH_SMAC; + if (cqe->flags & CQ_RES_UD_FLAGS_META_FORMAT_VLAN) { +- wc->vlan_id = (cqe->cfa_meta & 0xFFF); +- if (wc->vlan_id < 0x1000) +- wc->wc_flags |= IB_WC_WITH_VLAN; ++ vlan_id = (cqe->cfa_meta & 0xFFF); ++ } ++ /* Mark only if vlan_id is non zero */ ++ if (vlan_id && bnxt_re_check_if_vlan_valid(rdev, vlan_id)) { ++ wc->vlan_id = vlan_id; ++ wc->wc_flags |= IB_WC_WITH_VLAN; + } + nw_type = (cqe->flags & CQ_RES_UD_FLAGS_ROCE_IP_VER_MASK) >> + CQ_RES_UD_FLAGS_ROCE_IP_VER_SFT; +-- +2.33.0 + diff --git a/queue-5.4/sched-core-mitigate-race-cpus_share_cache-update_top.patch b/queue-5.4/sched-core-mitigate-race-cpus_share_cache-update_top.patch new file mode 100644 index 00000000000..ae7d5ab669c --- /dev/null +++ b/queue-5.4/sched-core-mitigate-race-cpus_share_cache-update_top.patch @@ -0,0 +1,61 @@ +From d7fd604052b2e8817592daae67a460fee0ddefa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Nov 2021 17:51:20 +0000 +Subject: sched/core: Mitigate race + cpus_share_cache()/update_top_cache_domain() + +From: Vincent Donnefort + +[ Upstream commit 42dc938a590c96eeb429e1830123fef2366d9c80 ] + +Nothing protects the access to the per_cpu variable sd_llc_id. When testing +the same CPU (i.e. this_cpu == that_cpu), a race condition exists with +update_top_cache_domain(). One scenario being: + + CPU1 CPU2 + ================================================================== + + per_cpu(sd_llc_id, CPUX) => 0 + partition_sched_domains_locked() + detach_destroy_domains() + cpus_share_cache(CPUX, CPUX) update_top_cache_domain(CPUX) + per_cpu(sd_llc_id, CPUX) => 0 + per_cpu(sd_llc_id, CPUX) = CPUX + per_cpu(sd_llc_id, CPUX) => CPUX + return false + +ttwu_queue_cond() wouldn't catch smp_processor_id() == cpu and the result +is a warning triggered from ttwu_queue_wakelist(). + +Avoid a such race in cpus_share_cache() by always returning true when +this_cpu == that_cpu. + +Fixes: 518cd6234178 ("sched: Only queue remote wakeups when crossing cache boundaries") +Reported-by: Jing-Ting Wu +Signed-off-by: Vincent Donnefort +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Valentin Schneider +Reviewed-by: Vincent Guittot +Link: https://lore.kernel.org/r/20211104175120.857087-1-vincent.donnefort@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 5dc43d37e6a2b..f8ca0738d729e 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -2482,6 +2482,9 @@ out: + + bool cpus_share_cache(int this_cpu, int that_cpu) + { ++ if (this_cpu == that_cpu) ++ return true; ++ + return per_cpu(sd_llc_id, this_cpu) == per_cpu(sd_llc_id, that_cpu); + } + #endif /* CONFIG_SMP */ +-- +2.33.0 + diff --git a/queue-5.4/scsi-advansys-fix-kernel-pointer-leak.patch b/queue-5.4/scsi-advansys-fix-kernel-pointer-leak.patch new file mode 100644 index 00000000000..943014f0be6 --- /dev/null +++ b/queue-5.4/scsi-advansys-fix-kernel-pointer-leak.patch @@ -0,0 +1,40 @@ +From 0c81f0dba7b53b70137b01d2c31f7f5f95a585ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 20:25:37 +0800 +Subject: scsi: advansys: Fix kernel pointer leak + +From: Guo Zhi + +[ Upstream commit d4996c6eac4c81b8872043e9391563f67f13e406 ] + +Pointers should be printed with %p or %px rather than cast to 'unsigned +long' and printed with %lx. + +Change %lx to %p to print the hashed pointer. + +Link: https://lore.kernel.org/r/20210929122538.1158235-1-qtxuning1999@sjtu.edu.cn +Signed-off-by: Guo Zhi +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/advansys.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c +index a242a62caaa16..7b3e52ff5f516 100644 +--- a/drivers/scsi/advansys.c ++++ b/drivers/scsi/advansys.c +@@ -3366,8 +3366,8 @@ static void asc_prt_adv_board_info(struct seq_file *m, struct Scsi_Host *shost) + shost->host_no); + + seq_printf(m, +- " iop_base 0x%lx, cable_detect: %X, err_code %u\n", +- (unsigned long)v->iop_base, ++ " iop_base 0x%p, cable_detect: %X, err_code %u\n", ++ v->iop_base, + AdvReadWordRegister(iop_base,IOPW_SCSI_CFG1) & CABLE_DETECT, + v->err_code); + +-- +2.33.0 + diff --git a/queue-5.4/scsi-core-sysfs-fix-hang-when-device-state-is-set-vi.patch b/queue-5.4/scsi-core-sysfs-fix-hang-when-device-state-is-set-vi.patch new file mode 100644 index 00000000000..567667d23a3 --- /dev/null +++ b/queue-5.4/scsi-core-sysfs-fix-hang-when-device-state-is-set-vi.patch @@ -0,0 +1,102 @@ +From 33d6411e11d4515ad5d88e13187e0b8fe86981c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 5 Nov 2021 17:10:48 -0500 +Subject: scsi: core: sysfs: Fix hang when device state is set via sysfs + +From: Mike Christie + +[ Upstream commit 4edd8cd4e86dd3047e5294bbefcc0a08f66a430f ] + +This fixes a regression added with: + +commit f0f82e2476f6 ("scsi: core: Fix capacity set to zero after +offlinining device") + +The problem is that after iSCSI recovery, iscsid will call into the kernel +to set the dev's state to running, and with that patch we now call +scsi_rescan_device() with the state_mutex held. If the SCSI error handler +thread is just starting to test the device in scsi_send_eh_cmnd() then it's +going to try to grab the state_mutex. + +We are then stuck, because when scsi_rescan_device() tries to send its I/O +scsi_queue_rq() calls -> scsi_host_queue_ready() -> scsi_host_in_recovery() +which will return true (the host state is still in recovery) and I/O will +just be requeued. scsi_send_eh_cmnd() will then never be able to grab the +state_mutex to finish error handling. + +To prevent the deadlock move the rescan-related code to after we drop the +state_mutex. + +This also adds a check for if we are already in the running state. This +prevents extra scans and helps the iscsid case where if the transport class +has already onlined the device during its recovery process then we don't +need userspace to do it again plus possibly block that daemon. + +Link: https://lore.kernel.org/r/20211105221048.6541-3-michael.christie@oracle.com +Fixes: f0f82e2476f6 ("scsi: core: Fix capacity set to zero after offlinining device") +Cc: Bart Van Assche +Cc: lijinlin +Cc: Wu Bo +Reviewed-by: Lee Duncan +Reviewed-by: Wu Bo +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_sysfs.c | 30 +++++++++++++++++++----------- + 1 file changed, 19 insertions(+), 11 deletions(-) + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index 12064ce76777d..16432d42a50aa 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -776,6 +776,7 @@ store_state_field(struct device *dev, struct device_attribute *attr, + int i, ret; + struct scsi_device *sdev = to_scsi_device(dev); + enum scsi_device_state state = 0; ++ bool rescan_dev = false; + + for (i = 0; i < ARRAY_SIZE(sdev_states); i++) { + const int len = strlen(sdev_states[i].name); +@@ -794,20 +795,27 @@ store_state_field(struct device *dev, struct device_attribute *attr, + } + + mutex_lock(&sdev->state_mutex); +- ret = scsi_device_set_state(sdev, state); +- /* +- * If the device state changes to SDEV_RUNNING, we need to +- * run the queue to avoid I/O hang, and rescan the device +- * to revalidate it. Running the queue first is necessary +- * because another thread may be waiting inside +- * blk_mq_freeze_queue_wait() and because that call may be +- * waiting for pending I/O to finish. +- */ +- if (ret == 0 && state == SDEV_RUNNING) { ++ if (sdev->sdev_state == SDEV_RUNNING && state == SDEV_RUNNING) { ++ ret = count; ++ } else { ++ ret = scsi_device_set_state(sdev, state); ++ if (ret == 0 && state == SDEV_RUNNING) ++ rescan_dev = true; ++ } ++ mutex_unlock(&sdev->state_mutex); ++ ++ if (rescan_dev) { ++ /* ++ * If the device state changes to SDEV_RUNNING, we need to ++ * run the queue to avoid I/O hang, and rescan the device ++ * to revalidate it. Running the queue first is necessary ++ * because another thread may be waiting inside ++ * blk_mq_freeze_queue_wait() and because that call may be ++ * waiting for pending I/O to finish. ++ */ + blk_mq_run_hw_queues(sdev->request_queue, true); + scsi_rescan_device(dev); + } +- mutex_unlock(&sdev->state_mutex); + + return ret == 0 ? count : -EINVAL; + } +-- +2.33.0 + diff --git a/queue-5.4/scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch b/queue-5.4/scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch new file mode 100644 index 00000000000..e87909b6e29 --- /dev/null +++ b/queue-5.4/scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch @@ -0,0 +1,48 @@ +From d49e1cdcaa6b0a9c6bf704fc317ad3d01b5ad059 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Sep 2021 16:31:46 -0700 +Subject: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() + +From: James Smart + +[ Upstream commit 99154581b05c8fb22607afb7c3d66c1bace6aa5d ] + +When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass +the requests to the adapter. If such an attempt fails, a local "fail_msg" +string is set and a log message output. The job is then added to a +completions list for cancellation. + +Processing of any further jobs from the txq list continues, but since +"fail_msg" remains set, jobs are added to the completions list regardless +of whether a wqe was passed to the adapter. If successfully added to +txcmplq, jobs are added to both lists resulting in list corruption. + +Fix by clearing the fail_msg string after adding a job to the completions +list. This stops the subsequent jobs from being added to the completions +list unless they had an appropriate failure. + +Link: https://lore.kernel.org/r/20210910233159.115896-2-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 4a7ceaa34341c..51bab0979527b 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -19692,6 +19692,7 @@ lpfc_drain_txq(struct lpfc_hba *phba) + fail_msg, + piocbq->iotag, piocbq->sli4_xritag); + list_add_tail(&piocbq->list, &completions); ++ fail_msg = NULL; + } + spin_unlock_irqrestore(&pring->ring_lock, iflags); + } +-- +2.33.0 + diff --git a/queue-5.4/scsi-target-fix-alua_tg_pt_gps_count-tracking.patch b/queue-5.4/scsi-target-fix-alua_tg_pt_gps_count-tracking.patch new file mode 100644 index 00000000000..f657a28f1f9 --- /dev/null +++ b/queue-5.4/scsi-target-fix-alua_tg_pt_gps_count-tracking.patch @@ -0,0 +1,45 @@ +From 28ea1b072f7e29004aef53854ac02dbb69e0e374 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 21:04:20 -0500 +Subject: scsi: target: Fix alua_tg_pt_gps_count tracking + +From: Mike Christie + +[ Upstream commit 1283c0d1a32bb924324481586b5d6e8e76f676ba ] + +We can't free the tg_pt_gp in core_alua_set_tg_pt_gp_id() because it's +still accessed via configfs. Its release must go through the normal +configfs/refcount process. + +The max alua_tg_pt_gps_count check should probably have been done in +core_alua_allocate_tg_pt_gp(), but with the current code userspace could +have created 0x0000ffff + 1 groups, but only set the id for 0x0000ffff. +Then it could have deleted a group with an ID set, and then set the ID for +that extra group and it would work ok. + +It's unlikely, but just in case this patch continues to allow that type of +behavior, and just fixes the kfree() while in use bug. + +Link: https://lore.kernel.org/r/20210930020422.92578-4-michael.christie@oracle.com +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_alua.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c +index 385e4cf9cfa63..0fc3135d3e4f6 100644 +--- a/drivers/target/target_core_alua.c ++++ b/drivers/target/target_core_alua.c +@@ -1702,7 +1702,6 @@ int core_alua_set_tg_pt_gp_id( + pr_err("Maximum ALUA alua_tg_pt_gps_count:" + " 0x0000ffff reached\n"); + spin_unlock(&dev->t10_alua.tg_pt_gps_lock); +- kmem_cache_free(t10_alua_tg_pt_gp_cache, tg_pt_gp); + return -ENOSPC; + } + again: +-- +2.33.0 + diff --git a/queue-5.4/scsi-target-fix-ordered-tag-handling.patch b/queue-5.4/scsi-target-fix-ordered-tag-handling.patch new file mode 100644 index 00000000000..716252ceaa0 --- /dev/null +++ b/queue-5.4/scsi-target-fix-ordered-tag-handling.patch @@ -0,0 +1,266 @@ +From 88bc1cbd1da370bce66e2926b9c6c77b9d063104 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 21:04:19 -0500 +Subject: scsi: target: Fix ordered tag handling + +From: Mike Christie + +[ Upstream commit ed1227e080990ffec5bf39006ec8a57358e6689a ] + +This patch fixes the following bugs: + +1. If there are multiple ordered cmds queued and multiple simple cmds + completing, target_restart_delayed_cmds() could be called on different + CPUs and each instance could start a ordered cmd. They could then run in + different orders than they were queued. + +2. target_restart_delayed_cmds() and target_handle_task_attr() can race + where: + + 1. target_handle_task_attr() has passed the simple_cmds == 0 check. + + 2. transport_complete_task_attr() then decrements simple_cmds to 0. + + 3. transport_complete_task_attr() runs target_restart_delayed_cmds() and + it does not see any cmds on the delayed_cmd_list. + + 4. target_handle_task_attr() adds the cmd to the delayed_cmd_list. + + The cmd will then end up timing out. + +3. If we are sent > 1 ordered cmds and simple_cmds == 0, we can execute + them out of order, because target_handle_task_attr() will hit that + simple_cmds check first and return false for all ordered cmds sent. + +4. We run target_restart_delayed_cmds() after every cmd completion, so if + there is more than 1 simple cmd running, we start executing ordered cmds + after that first cmd instead of waiting for all of them to complete. + +5. Ordered cmds are not supposed to start until HEAD OF QUEUE and all older + cmds have completed, and not just simple. + +6. It's not a bug but it doesn't make sense to take the delayed_cmd_lock + for every cmd completion when ordered cmds are almost never used. Just + replacing that lock with an atomic increases IOPs by up to 10% when + completions are spread over multiple CPUs and there are multiple + sessions/ mqs/thread accessing the same device. + +This patch moves the queued delayed handling to a per device work to +serialze the cmd executions for each device and adds a new counter to track +HEAD_OF_QUEUE and SIMPLE cmds. We can then check the new counter to +determine when to run the work on the completion path. + +Link: https://lore.kernel.org/r/20210930020422.92578-3-michael.christie@oracle.com +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_device.c | 2 + + drivers/target/target_core_internal.h | 1 + + drivers/target/target_core_transport.c | 76 ++++++++++++++++++-------- + include/target/target_core_base.h | 6 +- + 4 files changed, 61 insertions(+), 24 deletions(-) + +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index 2d19f0e332b01..20fe287039857 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -758,6 +758,8 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) + INIT_LIST_HEAD(&dev->t10_alua.lba_map_list); + spin_lock_init(&dev->t10_alua.lba_map_lock); + ++ INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work); ++ + dev->t10_wwn.t10_dev = dev; + dev->t10_alua.t10_dev = dev; + +diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h +index e7b3c6e5d5744..e4f072a680d41 100644 +--- a/drivers/target/target_core_internal.h ++++ b/drivers/target/target_core_internal.h +@@ -150,6 +150,7 @@ int transport_dump_vpd_ident(struct t10_vpd *, unsigned char *, int); + void transport_clear_lun_ref(struct se_lun *); + sense_reason_t target_cmd_size_check(struct se_cmd *cmd, unsigned int size); + void target_qf_do_work(struct work_struct *work); ++void target_do_delayed_work(struct work_struct *work); + bool target_check_wce(struct se_device *dev); + bool target_check_fua(struct se_device *dev); + void __target_execute_cmd(struct se_cmd *, bool); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 5cf9e7677926f..f52fe40002259 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2021,32 +2021,35 @@ static bool target_handle_task_attr(struct se_cmd *cmd) + */ + switch (cmd->sam_task_attr) { + case TCM_HEAD_TAG: ++ atomic_inc_mb(&dev->non_ordered); + pr_debug("Added HEAD_OF_QUEUE for CDB: 0x%02x\n", + cmd->t_task_cdb[0]); + return false; + case TCM_ORDERED_TAG: +- atomic_inc_mb(&dev->dev_ordered_sync); ++ atomic_inc_mb(&dev->delayed_cmd_count); + + pr_debug("Added ORDERED for CDB: 0x%02x to ordered list\n", + cmd->t_task_cdb[0]); +- +- /* +- * Execute an ORDERED command if no other older commands +- * exist that need to be completed first. +- */ +- if (!atomic_read(&dev->simple_cmds)) +- return false; + break; + default: + /* + * For SIMPLE and UNTAGGED Task Attribute commands + */ +- atomic_inc_mb(&dev->simple_cmds); ++ atomic_inc_mb(&dev->non_ordered); ++ ++ if (atomic_read(&dev->delayed_cmd_count) == 0) ++ return false; + break; + } + +- if (atomic_read(&dev->dev_ordered_sync) == 0) +- return false; ++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) { ++ atomic_inc_mb(&dev->delayed_cmd_count); ++ /* ++ * We will account for this when we dequeue from the delayed ++ * list. ++ */ ++ atomic_dec_mb(&dev->non_ordered); ++ } + + spin_lock(&dev->delayed_cmd_lock); + list_add_tail(&cmd->se_delayed_node, &dev->delayed_cmd_list); +@@ -2054,6 +2057,12 @@ static bool target_handle_task_attr(struct se_cmd *cmd) + + pr_debug("Added CDB: 0x%02x Task Attr: 0x%02x to delayed CMD listn", + cmd->t_task_cdb[0], cmd->sam_task_attr); ++ /* ++ * We may have no non ordered cmds when this function started or we ++ * could have raced with the last simple/head cmd completing, so kick ++ * the delayed handler here. ++ */ ++ schedule_work(&dev->delayed_cmd_work); + return true; + } + +@@ -2091,29 +2100,48 @@ EXPORT_SYMBOL(target_execute_cmd); + * Process all commands up to the last received ORDERED task attribute which + * requires another blocking boundary + */ +-static void target_restart_delayed_cmds(struct se_device *dev) ++void target_do_delayed_work(struct work_struct *work) + { +- for (;;) { ++ struct se_device *dev = container_of(work, struct se_device, ++ delayed_cmd_work); ++ ++ spin_lock(&dev->delayed_cmd_lock); ++ while (!dev->ordered_sync_in_progress) { + struct se_cmd *cmd; + +- spin_lock(&dev->delayed_cmd_lock); +- if (list_empty(&dev->delayed_cmd_list)) { +- spin_unlock(&dev->delayed_cmd_lock); ++ if (list_empty(&dev->delayed_cmd_list)) + break; +- } + + cmd = list_entry(dev->delayed_cmd_list.next, + struct se_cmd, se_delayed_node); ++ ++ if (cmd->sam_task_attr == TCM_ORDERED_TAG) { ++ /* ++ * Check if we started with: ++ * [ordered] [simple] [ordered] ++ * and we are now at the last ordered so we have to wait ++ * for the simple cmd. ++ */ ++ if (atomic_read(&dev->non_ordered) > 0) ++ break; ++ ++ dev->ordered_sync_in_progress = true; ++ } ++ + list_del(&cmd->se_delayed_node); ++ atomic_dec_mb(&dev->delayed_cmd_count); + spin_unlock(&dev->delayed_cmd_lock); + ++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) ++ atomic_inc_mb(&dev->non_ordered); ++ + cmd->transport_state |= CMD_T_SENT; + + __target_execute_cmd(cmd, true); + +- if (cmd->sam_task_attr == TCM_ORDERED_TAG) +- break; ++ spin_lock(&dev->delayed_cmd_lock); + } ++ spin_unlock(&dev->delayed_cmd_lock); + } + + /* +@@ -2131,14 +2159,17 @@ static void transport_complete_task_attr(struct se_cmd *cmd) + goto restart; + + if (cmd->sam_task_attr == TCM_SIMPLE_TAG) { +- atomic_dec_mb(&dev->simple_cmds); ++ atomic_dec_mb(&dev->non_ordered); + dev->dev_cur_ordered_id++; + } else if (cmd->sam_task_attr == TCM_HEAD_TAG) { ++ atomic_dec_mb(&dev->non_ordered); + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev_cur_ordered_id: %u for HEAD_OF_QUEUE\n", + dev->dev_cur_ordered_id); + } else if (cmd->sam_task_attr == TCM_ORDERED_TAG) { +- atomic_dec_mb(&dev->dev_ordered_sync); ++ spin_lock(&dev->delayed_cmd_lock); ++ dev->ordered_sync_in_progress = false; ++ spin_unlock(&dev->delayed_cmd_lock); + + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n", +@@ -2147,7 +2178,8 @@ static void transport_complete_task_attr(struct se_cmd *cmd) + cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET; + + restart: +- target_restart_delayed_cmds(dev); ++ if (atomic_read(&dev->delayed_cmd_count) > 0) ++ schedule_work(&dev->delayed_cmd_work); + } + + static void transport_complete_qf(struct se_cmd *cmd) +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index 7c9716fe731e2..59d7ebb8bbaf4 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -781,8 +781,9 @@ struct se_device { + atomic_long_t read_bytes; + atomic_long_t write_bytes; + /* Active commands on this virtual SE device */ +- atomic_t simple_cmds; +- atomic_t dev_ordered_sync; ++ atomic_t non_ordered; ++ bool ordered_sync_in_progress; ++ atomic_t delayed_cmd_count; + atomic_t dev_qf_count; + u32 export_count; + spinlock_t delayed_cmd_lock; +@@ -804,6 +805,7 @@ struct se_device { + struct list_head dev_sep_list; + struct list_head dev_tmr_list; + struct work_struct qf_work_queue; ++ struct work_struct delayed_cmd_work; + struct list_head delayed_cmd_list; + struct list_head state_list; + struct list_head qf_cmd_list; +-- +2.33.0 + diff --git a/queue-5.4/series b/queue-5.4/series new file mode 100644 index 00000000000..3c7aae0e684 --- /dev/null +++ b/queue-5.4/series @@ -0,0 +1,71 @@ +arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch +arm64-zynqmp-fix-serial-compatible-string.patch +arm-dts-nsp-fix-mpcore-mmc-node-names.patch +scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch +arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch +rdma-bnxt_re-check-if-the-vlan-is-valid-before-repor.patch +usb-musb-tusb6010-check-return-value-after-calling-p.patch +usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch +arm64-dts-qcom-msm8998-fix-cpu-l2-idle-state-latency.patch +arm64-dts-qcom-msm8916-add-unit-name-for-soc-node.patch +arm64-dts-freescale-fix-arm-sp805-compatible-string.patch +asoc-sof-intel-hda-dai-fix-potential-locking-issue.patch +clk-imx-imx6ul-move-csi_sel-mux-to-correct-base-regi.patch +asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch +scsi-advansys-fix-kernel-pointer-leak.patch +firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch +arm-dts-omap-fix-gpmc-mux-add-data-type.patch +usb-host-ohci-tmio-check-return-value-after-calling-.patch +arm-dts-ls1021a-move-thermal-zones-node-out-of-soc.patch +arm-dts-ls1021a-tsn-use-generic-jedec-spi-nor-compat.patch +alsa-isa-not-for-m68k.patch +tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch +mips-sni-fix-the-build.patch +scsi-target-fix-ordered-tag-handling.patch +scsi-target-fix-alua_tg_pt_gps_count-tracking.patch +iio-imu-st_lsm6dsx-avoid-potential-array-overflow-in.patch +powerpc-5200-dts-fix-memory-node-unit-name.patch +alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch +powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch +sh-check-return-code-of-request_irq.patch +maple-fix-wrong-return-value-of-maple_bus_init.patch +f2fs-fix-up-f2fs_lookup-tracepoints.patch +sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch +sh-math-emu-drop-unused-functions.patch +sh-define-__big_endian-for-math-emu.patch +clk-ingenic-fix-bugs-with-divided-dividers.patch +clk-ast2600-fix-soc-revision-for-ahb.patch +clk-qcom-gcc-msm8996-drop-again-gcc_aggre1_pnoc_ahb_.patch +mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch +sched-core-mitigate-race-cpus_share_cache-update_top.patch +tracing-save-normal-string-variables.patch +tracing-histogram-do-not-copy-the-fixed-size-char-ar.patch +perf-bpf-avoid-memory-leak-from-perf_env__insert_btf.patch +perf-bench-futex-fix-memory-leak-of-perf_cpu_map__ne.patch +perf-tests-remove-bash-construct-from-record-zstd_co.patch +tracing-add-length-protection-to-histogram-string-co.patch +net-bnx2x-fix-variable-dereferenced-before-check.patch +iavf-check-for-null-in-iavf_fix_features.patch +iavf-free-q_vectors-before-queues-in-iavf_disable_vf.patch +iavf-fix-failure-to-exit-out-from-last-all-multicast.patch +iavf-prevent-accidental-free-of-filter-structure.patch +iavf-validate-pointers.patch +iavf-fix-for-the-false-positive-asq-arq-errors-while.patch +mips-generic-yamon-dt-fix-uninitialized-variable-err.patch +mips-bcm63xx-add-support-for-clk_get_parent.patch +mips-lantiq-add-support-for-clk_get_parent.patch +platform-x86-hp_accel-fix-an-error-handling-path-in-.patch +scsi-core-sysfs-fix-hang-when-device-state-is-set-vi.patch +net-sched-act_mirred-drop-dst-for-the-direction-from.patch +net-dpaa2-eth-fix-use-after-free-in-dpaa2_eth_remove.patch +net-virtio_net_hdr_to_skb-count-transport-header-in-.patch +i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch +i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch +i40e-fix-changing-previously-set-num_queue_pairs-for.patch +i40e-fix-ping-is-lost-after-configuring-adq-on-vf.patch +i40e-fix-creation-of-first-queue-by-omitting-it-if-i.patch +i40e-fix-display-error-code-in-dmesg.patch +nfc-reorganize-the-functions-in-nci_request.patch +drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch +nfc-reorder-the-logic-in-nfc_-un-register_device.patch +perf-bench-fix-two-memory-leaks-detected-with-asan.patch diff --git a/queue-5.4/sh-check-return-code-of-request_irq.patch b/queue-5.4/sh-check-return-code-of-request_irq.patch new file mode 100644 index 00000000000..c352ac6d62a --- /dev/null +++ b/queue-5.4/sh-check-return-code-of-request_irq.patch @@ -0,0 +1,45 @@ +From 02810049c573055c92034242ea63012478b8fd12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Dec 2020 12:54:01 -0800 +Subject: sh: check return code of request_irq + +From: Nick Desaulniers + +[ Upstream commit 0e38225c92c7964482a8bb6b3e37fde4319e965c ] + +request_irq is marked __must_check, but the call in shx3_prepare_cpus +has a void return type, so it can't propagate failure to the caller. +Follow cues from hexagon and just print an error. + +Fixes: c7936b9abcf5 ("sh: smp: Hook in to the generic IPI handler for SH-X3 SMP.") +Cc: Miguel Ojeda +Cc: Paul Mundt +Reported-by: Guenter Roeck +Signed-off-by: Nick Desaulniers +Tested-by: John Paul Adrian Glaubitz +Reviewed-by: Miguel Ojeda +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh4a/smp-shx3.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c +index f8a2bec0f260b..1261dc7b84e8b 100644 +--- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c ++++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c +@@ -73,8 +73,9 @@ static void shx3_prepare_cpus(unsigned int max_cpus) + BUILD_BUG_ON(SMP_MSG_NR >= 8); + + for (i = 0; i < SMP_MSG_NR; i++) +- request_irq(104 + i, ipi_interrupt_handler, +- IRQF_PERCPU, "IPI", (void *)(long)i); ++ if (request_irq(104 + i, ipi_interrupt_handler, ++ IRQF_PERCPU, "IPI", (void *)(long)i)) ++ pr_err("Failed to request irq %d\n", i); + + for (i = 0; i < max_cpus; i++) + set_cpu_present(i, true); +-- +2.33.0 + diff --git a/queue-5.4/sh-define-__big_endian-for-math-emu.patch b/queue-5.4/sh-define-__big_endian-for-math-emu.patch new file mode 100644 index 00000000000..67f714d9d5a --- /dev/null +++ b/queue-5.4/sh-define-__big_endian-for-math-emu.patch @@ -0,0 +1,59 @@ +From 6704b3a0ba28062d5fa819636c0613dd76b7d5ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 17:19:13 -0700 +Subject: sh: define __BIG_ENDIAN for math-emu + +From: Randy Dunlap + +[ Upstream commit b929926f01f2d14635345d22eafcf60feed1085e ] + +Fix this by defining both ENDIAN macros in + so that they can be utilized in + according to the latter's comment: +/* Allow sfp-machine to have its own byte order definitions. */ + +(This is what is done in arch/nds32/include/asm/sfp-machine.h.) + +This placates these build warnings: + +In file included from ../arch/sh/math-emu/math.c:23: +.../include/math-emu/single.h:50:21: warning: "__BIG_ENDIAN" is not defined, evaluates to 0 [-Wundef] + 50 | #if __BYTE_ORDER == __BIG_ENDIAN +In file included from ../arch/sh/math-emu/math.c:24: +.../include/math-emu/double.h:59:21: warning: "__BIG_ENDIAN" is not defined, evaluates to 0 [-Wundef] + 59 | #if __BYTE_ORDER == __BIG_ENDIAN + +Fixes: 4b565680d163 ("sh: math-emu support") +Signed-off-by: Randy Dunlap +Cc: Yoshinori Sato +Cc: John Paul Adrian Glaubitz +Reviewed-by: Geert Uytterhoeven +Tested-by: John Paul Adrian Glaubitz +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/include/asm/sfp-machine.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/sh/include/asm/sfp-machine.h b/arch/sh/include/asm/sfp-machine.h +index cbc7cf8c97ce6..2d2423478b71d 100644 +--- a/arch/sh/include/asm/sfp-machine.h ++++ b/arch/sh/include/asm/sfp-machine.h +@@ -13,6 +13,14 @@ + #ifndef _SFP_MACHINE_H + #define _SFP_MACHINE_H + ++#ifdef __BIG_ENDIAN__ ++#define __BYTE_ORDER __BIG_ENDIAN ++#define __LITTLE_ENDIAN 0 ++#else ++#define __BYTE_ORDER __LITTLE_ENDIAN ++#define __BIG_ENDIAN 0 ++#endif ++ + #define _FP_W_TYPE_SIZE 32 + #define _FP_W_TYPE unsigned long + #define _FP_WS_TYPE signed long +-- +2.33.0 + diff --git a/queue-5.4/sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch b/queue-5.4/sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch new file mode 100644 index 00000000000..0484fbbe736 --- /dev/null +++ b/queue-5.4/sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch @@ -0,0 +1,47 @@ +From dff9787484d9273980280d77adaaab2a0c728fb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 17:19:10 -0700 +Subject: sh: fix kconfig unmet dependency warning for FRAME_POINTER + +From: Randy Dunlap + +[ Upstream commit fda1bc533094a7db68b11e7503d2c6c73993d12a ] + +FRAME_POINTER depends on DEBUG_KERNEL so DWARF_UNWINDER should +depend on DEBUG_KERNEL before selecting FRAME_POINTER. + +WARNING: unmet direct dependencies detected for FRAME_POINTER + Depends on [n]: DEBUG_KERNEL [=n] && (M68K || UML || SUPERH [=y]) || ARCH_WANT_FRAME_POINTERS [=n] + Selected by [y]: + - DWARF_UNWINDER [=y] + +Fixes: bd353861c735 ("sh: dwarf unwinder support.") +Signed-off-by: Randy Dunlap +Cc: Matt Fleming +Cc: Matt Fleming +Cc: Yoshinori Sato +Cc: John Paul Adrian Glaubitz +Cc: Geert Uytterhoeven +Reviewed-by: Geert Uytterhoeven +Tested-by: John Paul Adrian Glaubitz +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/Kconfig.debug | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug +index 010b6c33bbba2..71acd3d9b9e83 100644 +--- a/arch/sh/Kconfig.debug ++++ b/arch/sh/Kconfig.debug +@@ -58,6 +58,7 @@ config DUMP_CODE + + config DWARF_UNWINDER + bool "Enable the DWARF unwinder for stacktraces" ++ depends on DEBUG_KERNEL + select FRAME_POINTER + depends on SUPERH32 + default n +-- +2.33.0 + diff --git a/queue-5.4/sh-math-emu-drop-unused-functions.patch b/queue-5.4/sh-math-emu-drop-unused-functions.patch new file mode 100644 index 00000000000..8b9f1f73a30 --- /dev/null +++ b/queue-5.4/sh-math-emu-drop-unused-functions.patch @@ -0,0 +1,147 @@ +From 43047b982f146995a4bac33a241ca16658fd6e59 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 17:19:12 -0700 +Subject: sh: math-emu: drop unused functions + +From: Randy Dunlap + +[ Upstream commit e25c252a9b033523c626f039d4b9a304f12f6775 ] + +Delete ieee_fpe_handler() since it is not used. After that is done, +delete denormal_to_double() since it is not used: + +.../arch/sh/math-emu/math.c:505:12: error: 'ieee_fpe_handler' defined but not used [-Werror=unused-function] + 505 | static int ieee_fpe_handler(struct pt_regs *regs) + +.../arch/sh/math-emu/math.c:477:13: error: 'denormal_to_double' defined but not used [-Werror=unused-function] + 477 | static void denormal_to_double(struct sh_fpu_soft_struct *fpu, int n) + +Fixes: 7caf62de25554da3 ("sh: remove unused do_fpu_error") +Signed-off-by: Randy Dunlap +Cc: Takashi YOSHII +Cc: Yoshinori Sato +Cc: John Paul Adrian Glaubitz +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/math-emu/math.c | 103 ---------------------------------------- + 1 file changed, 103 deletions(-) + +diff --git a/arch/sh/math-emu/math.c b/arch/sh/math-emu/math.c +index e8be0eca0444a..615ba932c398e 100644 +--- a/arch/sh/math-emu/math.c ++++ b/arch/sh/math-emu/math.c +@@ -467,109 +467,6 @@ static int fpu_emulate(u16 code, struct sh_fpu_soft_struct *fregs, struct pt_reg + return id_sys(fregs, regs, code); + } + +-/** +- * denormal_to_double - Given denormalized float number, +- * store double float +- * +- * @fpu: Pointer to sh_fpu_soft structure +- * @n: Index to FP register +- */ +-static void denormal_to_double(struct sh_fpu_soft_struct *fpu, int n) +-{ +- unsigned long du, dl; +- unsigned long x = fpu->fpul; +- int exp = 1023 - 126; +- +- if (x != 0 && (x & 0x7f800000) == 0) { +- du = (x & 0x80000000); +- while ((x & 0x00800000) == 0) { +- x <<= 1; +- exp--; +- } +- x &= 0x007fffff; +- du |= (exp << 20) | (x >> 3); +- dl = x << 29; +- +- fpu->fp_regs[n] = du; +- fpu->fp_regs[n+1] = dl; +- } +-} +- +-/** +- * ieee_fpe_handler - Handle denormalized number exception +- * +- * @regs: Pointer to register structure +- * +- * Returns 1 when it's handled (should not cause exception). +- */ +-static int ieee_fpe_handler(struct pt_regs *regs) +-{ +- unsigned short insn = *(unsigned short *)regs->pc; +- unsigned short finsn; +- unsigned long nextpc; +- int nib[4] = { +- (insn >> 12) & 0xf, +- (insn >> 8) & 0xf, +- (insn >> 4) & 0xf, +- insn & 0xf}; +- +- if (nib[0] == 0xb || +- (nib[0] == 0x4 && nib[2] == 0x0 && nib[3] == 0xb)) /* bsr & jsr */ +- regs->pr = regs->pc + 4; +- +- if (nib[0] == 0xa || nib[0] == 0xb) { /* bra & bsr */ +- nextpc = regs->pc + 4 + ((short) ((insn & 0xfff) << 4) >> 3); +- finsn = *(unsigned short *) (regs->pc + 2); +- } else if (nib[0] == 0x8 && nib[1] == 0xd) { /* bt/s */ +- if (regs->sr & 1) +- nextpc = regs->pc + 4 + ((char) (insn & 0xff) << 1); +- else +- nextpc = regs->pc + 4; +- finsn = *(unsigned short *) (regs->pc + 2); +- } else if (nib[0] == 0x8 && nib[1] == 0xf) { /* bf/s */ +- if (regs->sr & 1) +- nextpc = regs->pc + 4; +- else +- nextpc = regs->pc + 4 + ((char) (insn & 0xff) << 1); +- finsn = *(unsigned short *) (regs->pc + 2); +- } else if (nib[0] == 0x4 && nib[3] == 0xb && +- (nib[2] == 0x0 || nib[2] == 0x2)) { /* jmp & jsr */ +- nextpc = regs->regs[nib[1]]; +- finsn = *(unsigned short *) (regs->pc + 2); +- } else if (nib[0] == 0x0 && nib[3] == 0x3 && +- (nib[2] == 0x0 || nib[2] == 0x2)) { /* braf & bsrf */ +- nextpc = regs->pc + 4 + regs->regs[nib[1]]; +- finsn = *(unsigned short *) (regs->pc + 2); +- } else if (insn == 0x000b) { /* rts */ +- nextpc = regs->pr; +- finsn = *(unsigned short *) (regs->pc + 2); +- } else { +- nextpc = regs->pc + 2; +- finsn = insn; +- } +- +- if ((finsn & 0xf1ff) == 0xf0ad) { /* fcnvsd */ +- struct task_struct *tsk = current; +- +- if ((tsk->thread.xstate->softfpu.fpscr & (1 << 17))) { +- /* FPU error */ +- denormal_to_double (&tsk->thread.xstate->softfpu, +- (finsn >> 8) & 0xf); +- tsk->thread.xstate->softfpu.fpscr &= +- ~(FPSCR_CAUSE_MASK | FPSCR_FLAG_MASK); +- task_thread_info(tsk)->status |= TS_USEDFPU; +- } else { +- force_sig_fault(SIGFPE, FPE_FLTINV, +- (void __user *)regs->pc); +- } +- +- regs->pc = nextpc; +- return 1; +- } +- +- return 0; +-} +- + /** + * fpu_init - Initialize FPU registers + * @fpu: Pointer to software emulated FPU registers. +-- +2.33.0 + diff --git a/queue-5.4/tracing-add-length-protection-to-histogram-string-co.patch b/queue-5.4/tracing-add-length-protection-to-histogram-string-co.patch new file mode 100644 index 00000000000..9fbeb771f0b --- /dev/null +++ b/queue-5.4/tracing-add-length-protection-to-histogram-string-co.patch @@ -0,0 +1,87 @@ +From 0a0e233a0c25593f817b6d9ed48fb2d2fd080870 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 13:28:34 -0500 +Subject: tracing: Add length protection to histogram string copies + +From: Steven Rostedt (VMware) + +[ Upstream commit 938aa33f14657c9ed9deea348b7d6f14b6d69cb7 ] + +The string copies to the histogram storage has a max size of 256 bytes +(defined by MAX_FILTER_STR_VAL). Only the string size of the event field +needs to be copied to the event storage, but no more than what is in the +event storage. Although nothing should be bigger than 256 bytes, there's +no protection against overwriting of the storage if one day there is. + +Copy no more than the destination size, and enforce it. + +Also had to turn MAX_FILTER_STR_VAL into an unsigned int, to keep the +min() comparison of the string sizes of comparable types. + +Link: https://lore.kernel.org/all/CAHk-=wjREUihCGrtRBwfX47y_KrLCGjiq3t6QtoNJpmVrAEb1w@mail.gmail.com/ +Link: https://lkml.kernel.org/r/20211114132834.183429a4@rorschach.local.home + +Cc: Ingo Molnar +Cc: Andrew Morton +Cc: Tom Zanussi +Reported-by: Linus Torvalds +Reviewed-by: Masami Hiramatsu +Fixes: 63f84ae6b82b ("tracing/histogram: Do not copy the fixed-size char array field over the field size") +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + include/linux/trace_events.h | 2 +- + kernel/trace/trace_events_hist.c | 9 +++++++-- + 2 files changed, 8 insertions(+), 3 deletions(-) + +diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h +index 30a8cdcfd4a4f..41cf69b4516bd 100644 +--- a/include/linux/trace_events.h ++++ b/include/linux/trace_events.h +@@ -425,7 +425,7 @@ struct trace_event_file { + + #define PERF_MAX_TRACE_SIZE 2048 + +-#define MAX_FILTER_STR_VAL 256 /* Should handle KSYM_SYMBOL_LEN */ ++#define MAX_FILTER_STR_VAL 256U /* Should handle KSYM_SYMBOL_LEN */ + + enum event_trigger_type { + ETT_NONE = (0), +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 8b33a3c872750..37aa8e33f5635 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -3530,8 +3530,10 @@ static inline void __update_field_vars(struct tracing_map_elt *elt, + if (val->flags & HIST_FIELD_FL_STRING) { + char *str = elt_data->field_var_str[j++]; + char *val_str = (char *)(uintptr_t)var_val; ++ unsigned int size; + +- strscpy(str, val_str, val->size); ++ size = min(val->size, STR_VAR_LEN_MAX); ++ strscpy(str, val_str, size); + var_val = (u64)(uintptr_t)str; + } + tracing_map_set_var(elt, var_idx, var_val); +@@ -5352,6 +5354,7 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, + if (hist_field->flags & HIST_FIELD_FL_STRING) { + unsigned int str_start, var_str_idx, idx; + char *str, *val_str; ++ unsigned int size; + + str_start = hist_data->n_field_var_str + + hist_data->n_save_var_str; +@@ -5360,7 +5363,9 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, + + str = elt_data->field_var_str[idx]; + val_str = (char *)(uintptr_t)hist_val; +- strscpy(str, val_str, hist_field->size); ++ ++ size = min(hist_field->size, STR_VAR_LEN_MAX); ++ strscpy(str, val_str, size); + + hist_val = (u64)(uintptr_t)str; + } +-- +2.33.0 + diff --git a/queue-5.4/tracing-histogram-do-not-copy-the-fixed-size-char-ar.patch b/queue-5.4/tracing-histogram-do-not-copy-the-fixed-size-char-ar.patch new file mode 100644 index 00000000000..600201c1e5f --- /dev/null +++ b/queue-5.4/tracing-histogram-do-not-copy-the-fixed-size-char-ar.patch @@ -0,0 +1,69 @@ +From 12ef293e7ba0ec193e886b6d888e6fba4c991dbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Nov 2021 01:02:08 +0900 +Subject: tracing/histogram: Do not copy the fixed-size char array field over + the field size + +From: Masami Hiramatsu + +[ Upstream commit 63f84ae6b82bb4dff672f76f30c6fd7b9d3766bc ] + +Do not copy the fixed-size char array field of the events over +the field size. The histogram treats char array as a string and +there are 2 types of char array in the event, fixed-size and +dynamic string. The dynamic string (__data_loc) field must be +null terminated, but the fixed-size char array field may not +be null terminated (not a string, but just a data). +In that case, histogram can copy the data after the field. +This uses the original field size for fixed-size char array +field to restrict the histogram not to access over the original +field size. + +Link: https://lkml.kernel.org/r/163673292822.195747.3696966210526410250.stgit@devnote2 + +Fixes: 02205a6752f2 (tracing: Add support for 'field variables') +Signed-off-by: Masami Hiramatsu +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events_hist.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index 9a73c187d241e..8b33a3c872750 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -2590,9 +2590,10 @@ static struct hist_field *create_hist_field(struct hist_trigger_data *hist_data, + if (!hist_field->type) + goto free; + +- if (field->filter_type == FILTER_STATIC_STRING) ++ if (field->filter_type == FILTER_STATIC_STRING) { + hist_field->fn = hist_field_string; +- else if (field->filter_type == FILTER_DYN_STRING) ++ hist_field->size = field->size; ++ } else if (field->filter_type == FILTER_DYN_STRING) + hist_field->fn = hist_field_dynstring; + else + hist_field->fn = hist_field_pstring; +@@ -3530,7 +3531,7 @@ static inline void __update_field_vars(struct tracing_map_elt *elt, + char *str = elt_data->field_var_str[j++]; + char *val_str = (char *)(uintptr_t)var_val; + +- strscpy(str, val_str, STR_VAR_LEN_MAX); ++ strscpy(str, val_str, val->size); + var_val = (u64)(uintptr_t)str; + } + tracing_map_set_var(elt, var_idx, var_val); +@@ -5359,7 +5360,7 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, + + str = elt_data->field_var_str[idx]; + val_str = (char *)(uintptr_t)hist_val; +- strscpy(str, val_str, STR_VAR_LEN_MAX); ++ strscpy(str, val_str, hist_field->size); + + hist_val = (u64)(uintptr_t)str; + } +-- +2.33.0 + diff --git a/queue-5.4/tracing-save-normal-string-variables.patch b/queue-5.4/tracing-save-normal-string-variables.patch new file mode 100644 index 00000000000..a387e382065 --- /dev/null +++ b/queue-5.4/tracing-save-normal-string-variables.patch @@ -0,0 +1,113 @@ +From 1d4e27b43b5af59861031546b26b087d8aec68e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Oct 2020 17:14:05 -0500 +Subject: tracing: Save normal string variables + +From: Tom Zanussi + +[ Upstream commit 63a1e5de3006f4ad713e4d72bcb404d0301e853d ] + +String variables created as field variables and save variables are +already handled properly by having their values copied when set. The +same isn't done for normal variables, but needs to be - simply saving +a pointer to a string contained in an old event isn't sufficient, +since that event's data may quickly become overwritten and therefore a +string pointer to it could yield garbage. + +This change uses the same mechanism as field variables and simply +appends the new strings to the existing per-element field_var_str[] +array allocated for that purpose. + +Link: https://lkml.kernel.org/r/1c1a03798b02e67307412a0c719d1bfb69b13007.1601848695.git.zanussi@kernel.org + +Fixes: 02205a6752f2 (tracing: Add support for 'field variables') +Signed-off-by: Tom Zanussi +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace_events_hist.c | 34 ++++++++++++++++++++++++++++++-- + 1 file changed, 32 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c +index f63766366e238..9a73c187d241e 100644 +--- a/kernel/trace/trace_events_hist.c ++++ b/kernel/trace/trace_events_hist.c +@@ -149,6 +149,8 @@ struct hist_field { + */ + unsigned int var_ref_idx; + bool read_once; ++ ++ unsigned int var_str_idx; + }; + + static u64 hist_field_none(struct hist_field *field, +@@ -351,6 +353,7 @@ struct hist_trigger_data { + unsigned int n_keys; + unsigned int n_fields; + unsigned int n_vars; ++ unsigned int n_var_str; + unsigned int key_size; + struct tracing_map_sort_key sort_keys[TRACING_MAP_SORT_KEYS_MAX]; + unsigned int n_sort_keys; +@@ -2305,7 +2308,12 @@ static int hist_trigger_elt_data_alloc(struct tracing_map_elt *elt) + } + } + +- n_str = hist_data->n_field_var_str + hist_data->n_save_var_str; ++ n_str = hist_data->n_field_var_str + hist_data->n_save_var_str + ++ hist_data->n_var_str; ++ if (n_str > SYNTH_FIELDS_MAX) { ++ hist_elt_data_free(elt_data); ++ return -EINVAL; ++ } + + size = STR_VAR_LEN_MAX; + +@@ -4599,6 +4607,7 @@ static int create_var_field(struct hist_trigger_data *hist_data, + { + struct trace_array *tr = hist_data->event_file->tr; + unsigned long flags = 0; ++ int ret; + + if (WARN_ON(val_idx >= TRACING_MAP_VALS_MAX + TRACING_MAP_VARS_MAX)) + return -EINVAL; +@@ -4613,7 +4622,12 @@ static int create_var_field(struct hist_trigger_data *hist_data, + if (WARN_ON(hist_data->n_vars > TRACING_MAP_VARS_MAX)) + return -EINVAL; + +- return __create_val_field(hist_data, val_idx, file, var_name, expr_str, flags); ++ ret = __create_val_field(hist_data, val_idx, file, var_name, expr_str, flags); ++ ++ if (hist_data->fields[val_idx]->flags & HIST_FIELD_FL_STRING) ++ hist_data->fields[val_idx]->var_str_idx = hist_data->n_var_str++; ++ ++ return ret; + } + + static int create_val_fields(struct hist_trigger_data *hist_data, +@@ -5333,6 +5347,22 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, + hist_val = hist_field->fn(hist_field, elt, rbe, rec); + if (hist_field->flags & HIST_FIELD_FL_VAR) { + var_idx = hist_field->var.idx; ++ ++ if (hist_field->flags & HIST_FIELD_FL_STRING) { ++ unsigned int str_start, var_str_idx, idx; ++ char *str, *val_str; ++ ++ str_start = hist_data->n_field_var_str + ++ hist_data->n_save_var_str; ++ var_str_idx = hist_field->var_str_idx; ++ idx = str_start + var_str_idx; ++ ++ str = elt_data->field_var_str[idx]; ++ val_str = (char *)(uintptr_t)hist_val; ++ strscpy(str, val_str, STR_VAR_LEN_MAX); ++ ++ hist_val = (u64)(uintptr_t)str; ++ } + tracing_map_set_var(elt, var_idx, hist_val); + continue; + } +-- +2.33.0 + diff --git a/queue-5.4/tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch b/queue-5.4/tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch new file mode 100644 index 00000000000..14989d3dc52 --- /dev/null +++ b/queue-5.4/tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch @@ -0,0 +1,69 @@ +From 51f045ca120e816ca85bbedc3ad992105aa6d50c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Oct 2021 22:08:24 +0800 +Subject: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc + +From: Guanghui Feng + +[ Upstream commit 3968ddcf05fb4b9409cd1859feb06a5b0550a1c1 ] + +When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup, +which look like this one: + + Workqueue: events_unbound flush_to_ldisc + Call trace: + dump_backtrace+0x0/0x1ec + show_stack+0x24/0x30 + dump_stack+0xd0/0x128 + panic+0x15c/0x374 + watchdog_timer_fn+0x2b8/0x304 + __run_hrtimer+0x88/0x2c0 + __hrtimer_run_queues+0xa4/0x120 + hrtimer_interrupt+0xfc/0x270 + arch_timer_handler_phys+0x40/0x50 + handle_percpu_devid_irq+0x94/0x220 + __handle_domain_irq+0x88/0xf0 + gic_handle_irq+0x84/0xfc + el1_irq+0xc8/0x180 + slip_unesc+0x80/0x214 [slip] + tty_ldisc_receive_buf+0x64/0x80 + tty_port_default_receive_buf+0x50/0x90 + flush_to_ldisc+0xbc/0x110 + process_one_work+0x1d4/0x4b0 + worker_thread+0x180/0x430 + kthread+0x11c/0x120 + +In the testcase pty04, The first process call the write syscall to send +data to the pty master. At the same time, the workqueue will do the +flush_to_ldisc to pop data in a loop until there is no more data left. +When the sender and workqueue running in different core, the sender sends +data fastly in full time which will result in workqueue doing work in loop +for a long time and occuring softlockup in flush_to_ldisc with kernel +configured without preempt. So I add need_resched check and cond_resched +in the flush_to_ldisc loop to avoid it. + +Signed-off-by: Guanghui Feng +Link: https://lore.kernel.org/r/1633961304-24759-1-git-send-email-guanghuifeng@linux.alibaba.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/tty_buffer.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index ec145a59f1993..bb148dbfbb88f 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -534,6 +534,9 @@ static void flush_to_ldisc(struct work_struct *work) + if (!count) + break; + head->read += count; ++ ++ if (need_resched()) ++ cond_resched(); + } + + mutex_unlock(&buf->lock); +-- +2.33.0 + diff --git a/queue-5.4/usb-host-ohci-tmio-check-return-value-after-calling-.patch b/queue-5.4/usb-host-ohci-tmio-check-return-value-after-calling-.patch new file mode 100644 index 00000000000..e23432e5e4a --- /dev/null +++ b/queue-5.4/usb-host-ohci-tmio-check-return-value-after-calling-.patch @@ -0,0 +1,38 @@ +From 89de92859abbf34444c1f2441d946bee05683960 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Oct 2021 21:49:20 +0800 +Subject: usb: host: ohci-tmio: check return value after calling + platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit 9eff2b2e59fda25051ab36cd1cb5014661df657b ] + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Acked-by: Alan Stern +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20211011134920.118477-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ohci-tmio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c +index fed43c6dd85cc..b611c8b09a89f 100644 +--- a/drivers/usb/host/ohci-tmio.c ++++ b/drivers/usb/host/ohci-tmio.c +@@ -199,7 +199,7 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev) + if (usb_disabled()) + return -ENODEV; + +- if (!cell) ++ if (!cell || !regs || !config || !sram) + return -EINVAL; + + if (irq < 0) +-- +2.33.0 + diff --git a/queue-5.4/usb-musb-tusb6010-check-return-value-after-calling-p.patch b/queue-5.4/usb-musb-tusb6010-check-return-value-after-calling-p.patch new file mode 100644 index 00000000000..a68a74e3319 --- /dev/null +++ b/queue-5.4/usb-musb-tusb6010-check-return-value-after-calling-p.patch @@ -0,0 +1,40 @@ +From f5f69e6bd9d20dd79155ea31e9362860ab5d2a84 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 11:49:25 +0800 +Subject: usb: musb: tusb6010: check return value after calling + platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit 14651496a3de6807a17c310f63c894ea0c5d858e ] + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210915034925.2399823-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/tusb6010.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c +index 4ecfbf6bb1fa8..902507da8aa85 100644 +--- a/drivers/usb/musb/tusb6010.c ++++ b/drivers/usb/musb/tusb6010.c +@@ -1103,6 +1103,11 @@ static int tusb_musb_init(struct musb *musb) + + /* dma address for async dma */ + mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!mem) { ++ pr_debug("no async dma resource?\n"); ++ ret = -ENODEV; ++ goto done; ++ } + musb->async = mem->start; + + /* dma address for sync dma */ +-- +2.33.0 + diff --git a/queue-5.4/usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch b/queue-5.4/usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch new file mode 100644 index 00000000000..8007bd4bb91 --- /dev/null +++ b/queue-5.4/usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch @@ -0,0 +1,38 @@ +From 250d9d344811ba8cb4a0549bfa281097bb2259d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Sep 2021 16:02:35 +0200 +Subject: usb: typec: tipd: Remove WARN_ON in tps6598x_block_read + +From: Sven Peter + +[ Upstream commit b7a0a63f3fed57d413bb857de164ea9c3984bc4e ] + +Calling tps6598x_block_read with a higher than allowed len can be +handled by just returning an error. There's no need to crash systems +with panic-on-warn enabled. + +Reviewed-by: Heikki Krogerus +Signed-off-by: Sven Peter +Link: https://lore.kernel.org/r/20210914140235.65955-3-sven@svenpeter.dev +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/tps6598x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c +index a38d1409f15b7..67bebee693301 100644 +--- a/drivers/usb/typec/tps6598x.c ++++ b/drivers/usb/typec/tps6598x.c +@@ -109,7 +109,7 @@ tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len) + u8 data[TPS_MAX_LEN + 1]; + int ret; + +- if (WARN_ON(len + 1 > sizeof(data))) ++ if (len + 1 > sizeof(data)) + return -EINVAL; + + if (!tps->i2c_protocol) +-- +2.33.0 +