From 38281b4a50253daee8e13072e41881ca8816b473 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 9 Jul 2020 20:37:23 -0400 Subject: [PATCH] Fixes for 5.7 Signed-off-by: Sasha Levin --- ...dd-missing-pci-ids-for-icl-h-tgl-h-a.patch | 53 ++ ...oid4-fix-spi-configuration-and-incre.patch | 52 ++ ...sing-put_device-call-in-imx6q_suspen.patch | 71 +++ ...-4-xx-silver-cpu-cores-to-ssb-safeli.patch | 39 ++ ...ryo-3-4-xx-silver-cpu-cores-to-kpti-.patch | 36 ++ ...x-memleak-with-regmap-not-freed-on-r.patch | 98 ++++ ...sof-intel-add-pci-id-for-cometlake-s.patch | 37 ++ ...ase-bip-in-a-right-way-in-error-path.patch | 72 +++ ...date-ctime-and-mtime-during-truncate.patch | 49 ++ ...e-fix-display-initialization-problem.patch | 62 +++ ...ation-quirks-add-quirk-for-asus-t101.patch | 41 ++ ...ation-quirks-use-generic-orientation.patch | 53 ++ ...call-of_dma_configure-if-there-s-an-.patch | 55 ++ ...-do-not-enable-orphaned-window-group.patch | 52 ++ ...fence-refcnt-leak-in-ttm_bo_vm_fault.patch | 55 ++ ...fence-refcnt-leak-when-adding-move-f.patch | 56 ++ ...an-up-debugfs-in-error-handling-path.patch | 43 ++ ...u-host1x-detach-driver-on-unregister.patch | 55 ++ ...ng-accesses-with-read-and-write_once.patch | 110 ++++ ...-to-init-in-crq-reset-returns-h_clos.patch | 48 ++ ...rotect-ring-accesses-with-write_once.patch | 79 +++ ...-apply-gfx-quirks-to-untrusted-devic.patch | 113 +++++ ...ng-accesses-with-read-and-write_once.patch | 112 ++++ ...eta-add-2500basex-support-for-socs-w.patch | 50 ++ ...eta-fix-serdes-configuration-for-soc.patch | 171 +++++++ .../nfs-fix-memory-leak-of-export_path.patch | 41 ++ ...a-assign-completion-vector-correctly.patch | 40 ++ ...86-rapl-fix-rapl-config-variable-bug.patch | 40 ++ ...move-rapl-support-to-common-x86-code.patch | 109 ++++ ...3s64-fix-kernel-crash-with-nested-kv.patch | 71 +++ queue-5.7/regmap-fix-alignment-issue.patch | 258 ++++++++++ ...ix-early-pgm-check-handler-execution.patch | 42 ++ ...-cpus_mask-not-cpus_ptr-in-__set_cpu.patch | 43 ++ ...si-mptscsih-fix-read-sense-data-size.patch | 50 ++ ...xx-fix-mpi-failure-aen-8200-handling.patch | 477 ++++++++++++++++++ queue-5.7/series | 41 ++ ...-potential-use-after-free-in-spidev_.patch | 76 +++ ...-race-between-spidev_release-and-spi.patch | 62 +++ ...-fix-coherency-of-hif_scan-prototype.patch | 93 ++++ ...-reference-count-leak-in-dwc3_pci_re.patch | 39 ++ ...ease-entry_stack-size-to-a-full-page.patch | 40 ++ ...-dereferencing-r_xprt-rx_ep-after-it.patch | 141 ++++++ 42 files changed, 3325 insertions(+) create mode 100644 queue-5.7/alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch create mode 100644 queue-5.7/arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch create mode 100644 queue-5.7/arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch create mode 100644 queue-5.7/arm64-add-kryo-3-4-xx-silver-cpu-cores-to-ssb-safeli.patch create mode 100644 queue-5.7/arm64-kpti-add-kryo-3-4-xx-silver-cpu-cores-to-kpti-.patch create mode 100644 queue-5.7/asoc-hdac_hda-fix-memleak-with-regmap-not-freed-on-r.patch create mode 100644 queue-5.7/asoc-sof-intel-add-pci-id-for-cometlake-s.patch create mode 100644 queue-5.7/block-release-bip-in-a-right-way-in-error-path.patch create mode 100644 queue-5.7/cifs-update-ctime-and-mtime-during-truncate.patch create mode 100644 queue-5.7/drm-mcde-fix-display-initialization-problem.patch create mode 100644 queue-5.7/drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch create mode 100644 queue-5.7/drm-panel-orientation-quirks-use-generic-orientation.patch create mode 100644 queue-5.7/drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch create mode 100644 queue-5.7/drm-tegra-hub-do-not-enable-orphaned-window-group.patch create mode 100644 queue-5.7/drm-ttm-fix-dma_fence-refcnt-leak-in-ttm_bo_vm_fault.patch create mode 100644 queue-5.7/drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch create mode 100644 queue-5.7/gpu-host1x-clean-up-debugfs-in-error-handling-path.patch create mode 100644 queue-5.7/gpu-host1x-detach-driver-on-unregister.patch create mode 100644 queue-5.7/i40e-protect-ring-accesses-with-read-and-write_once.patch create mode 100644 queue-5.7/ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch create mode 100644 queue-5.7/ice-protect-ring-accesses-with-write_once.patch create mode 100644 queue-5.7/iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch create mode 100644 queue-5.7/ixgbe-protect-ring-accesses-with-read-and-write_once.patch create mode 100644 queue-5.7/net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch create mode 100644 queue-5.7/net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch create mode 100644 queue-5.7/nfs-fix-memory-leak-of-export_path.patch create mode 100644 queue-5.7/nvme-rdma-assign-completion-vector-correctly.patch create mode 100644 queue-5.7/perf-x86-rapl-fix-rapl-config-variable-bug.patch create mode 100644 queue-5.7/perf-x86-rapl-move-rapl-support-to-common-x86-code.patch create mode 100644 queue-5.7/powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch create mode 100644 queue-5.7/regmap-fix-alignment-issue.patch create mode 100644 queue-5.7/s390-kasan-fix-early-pgm-check-handler-execution.patch create mode 100644 queue-5.7/sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch create mode 100644 queue-5.7/scsi-mptscsih-fix-read-sense-data-size.patch create mode 100644 queue-5.7/scsi-qla2xxx-fix-mpi-failure-aen-8200-handling.patch create mode 100644 queue-5.7/spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch create mode 100644 queue-5.7/spi-spidev-fix-a-race-between-spidev_release-and-spi.patch create mode 100644 queue-5.7/staging-wfx-fix-coherency-of-hif_scan-prototype.patch create mode 100644 queue-5.7/usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch create mode 100644 queue-5.7/x86-entry-increase-entry_stack-size-to-a-full-page.patch create mode 100644 queue-5.7/xprtrdma-prevent-dereferencing-r_xprt-rx_ep-after-it.patch diff --git a/queue-5.7/alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch b/queue-5.7/alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch new file mode 100644 index 00000000000..24e95c37557 --- /dev/null +++ b/queue-5.7/alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch @@ -0,0 +1,53 @@ +From 1a22115ad7e591a3b72b2f07de57d8d10284c046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 11:49:09 -0500 +Subject: ALSA: hda: Intel: add missing PCI IDs for ICL-H, TGL-H and EKL + +From: Pierre-Louis Bossart + +[ Upstream commit d50313a5a0d803bcf55121a2b82086633060d05e ] + +Mirror PCI ids used for SOF. + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20200617164909.18225-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_intel.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 41a03c61a74b3..11ec5c56c80e9 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2470,6 +2470,9 @@ static const struct pci_device_id azx_ids[] = { + /* Icelake */ + { PCI_DEVICE(0x8086, 0x34c8), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, ++ /* Icelake-H */ ++ { PCI_DEVICE(0x8086, 0x3dc8), ++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, + /* Jasperlake */ + { PCI_DEVICE(0x8086, 0x38c8), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, +@@ -2478,9 +2481,14 @@ static const struct pci_device_id azx_ids[] = { + /* Tigerlake */ + { PCI_DEVICE(0x8086, 0xa0c8), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, ++ /* Tigerlake-H */ ++ { PCI_DEVICE(0x8086, 0x43c8), ++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, + /* Elkhart Lake */ + { PCI_DEVICE(0x8086, 0x4b55), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, ++ { PCI_DEVICE(0x8086, 0x4b58), ++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, + /* Broxton-P(Apollolake) */ + { PCI_DEVICE(0x8086, 0x5a98), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON }, +-- +2.25.1 + diff --git a/queue-5.7/arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch b/queue-5.7/arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch new file mode 100644 index 00000000000..84e8f77bb32 --- /dev/null +++ b/queue-5.7/arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch @@ -0,0 +1,52 @@ +From a55168dbd70dc8996e4768b9d7c3fdc77344fb45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jun 2020 17:18:56 -0700 +Subject: ARM: dts: omap4-droid4: Fix spi configuration and increase rate + +From: Tony Lindgren + +[ Upstream commit 0df12a01f4857495816b05f048c4c31439446e35 ] + +We can currently sometimes get "RXS timed out" errors and "EOT timed out" +errors with spi transfers. + +These errors can be made easy to reproduce by reading the cpcap iio +values in a loop while keeping the CPUs busy by also reading /dev/urandom. + +The "RXS timed out" errors we can fix by adding spi-cpol and spi-cpha +in addition to the spi-cs-high property we already have. + +The "EOT timed out" errors we can fix by increasing the spi clock rate +to 9.6 MHz. Looks similar MC13783 PMIC says it works at spi clock rates +up to 20 MHz, so let's assume we can pick any rate up to 20 MHz also +for cpcap. + +Cc: maemo-leste@lists.dyne.org +Cc: Merlijn Wajer +Cc: Pavel Machek +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +index e39eee628afd6..08a7d3ce383f2 100644 +--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi ++++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +@@ -13,8 +13,10 @@ + #interrupt-cells = <2>; + #address-cells = <1>; + #size-cells = <0>; +- spi-max-frequency = <3000000>; ++ spi-max-frequency = <9600000>; + spi-cs-high; ++ spi-cpol; ++ spi-cpha; + + cpcap_adc: adc { + compatible = "motorola,mapphone-cpcap-adc"; +-- +2.25.1 + diff --git a/queue-5.7/arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch b/queue-5.7/arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch new file mode 100644 index 00000000000..95216ee0bd9 --- /dev/null +++ b/queue-5.7/arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch @@ -0,0 +1,71 @@ +From 27d2d98e0b6475127d964d3cc7f87129e5556e62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jun 2020 20:54:49 +0800 +Subject: ARM: imx6: add missing put_device() call in imx6q_suspend_init() + +From: yu kuai + +[ Upstream commit 4845446036fc9c13f43b54a65c9b757c14f5141b ] + +if of_find_device_by_node() succeed, imx6q_suspend_init() doesn't have a +corresponding put_device(). Thus add a jump target to fix the exception +handling for this function implementation. + +Signed-off-by: yu kuai +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/pm-imx6.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c +index dd34dff137626..40c74b4c4d730 100644 +--- a/arch/arm/mach-imx/pm-imx6.c ++++ b/arch/arm/mach-imx/pm-imx6.c +@@ -493,14 +493,14 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) + if (!ocram_pool) { + pr_warn("%s: ocram pool unavailable!\n", __func__); + ret = -ENODEV; +- goto put_node; ++ goto put_device; + } + + ocram_base = gen_pool_alloc(ocram_pool, MX6Q_SUSPEND_OCRAM_SIZE); + if (!ocram_base) { + pr_warn("%s: unable to alloc ocram!\n", __func__); + ret = -ENOMEM; +- goto put_node; ++ goto put_device; + } + + ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base); +@@ -523,7 +523,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) + ret = imx6_pm_get_base(&pm_info->mmdc_base, socdata->mmdc_compat); + if (ret) { + pr_warn("%s: failed to get mmdc base %d!\n", __func__, ret); +- goto put_node; ++ goto put_device; + } + + ret = imx6_pm_get_base(&pm_info->src_base, socdata->src_compat); +@@ -570,7 +570,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) + &imx6_suspend, + MX6Q_SUSPEND_OCRAM_SIZE - sizeof(*pm_info)); + +- goto put_node; ++ goto put_device; + + pl310_cache_map_failed: + iounmap(pm_info->gpc_base.vbase); +@@ -580,6 +580,8 @@ iomuxc_map_failed: + iounmap(pm_info->src_base.vbase); + src_map_failed: + iounmap(pm_info->mmdc_base.vbase); ++put_device: ++ put_device(&pdev->dev); + put_node: + of_node_put(node); + +-- +2.25.1 + diff --git a/queue-5.7/arm64-add-kryo-3-4-xx-silver-cpu-cores-to-ssb-safeli.patch b/queue-5.7/arm64-add-kryo-3-4-xx-silver-cpu-cores-to-ssb-safeli.patch new file mode 100644 index 00000000000..a66b8a6e6fd --- /dev/null +++ b/queue-5.7/arm64-add-kryo-3-4-xx-silver-cpu-cores-to-ssb-safeli.patch @@ -0,0 +1,39 @@ +From f621222cb0413dfb19ed6cccdd783778dd482bb2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Jun 2020 16:01:23 +0530 +Subject: arm64: Add KRYO{3,4}XX silver CPU cores to SSB safelist + +From: Sai Prakash Ranjan + +[ Upstream commit 108447fd0d1a34b0929cd26dc637c917a734ebab ] + +QCOM KRYO{3,4}XX silver/LITTLE CPU cores are based on +Cortex-A55 and are SSB safe, hence add them to SSB +safelist -> arm64_ssb_cpus[]. + +Reported-by: Stephen Boyd +Signed-off-by: Sai Prakash Ranjan +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20200625103123.7240-1-saiprakash.ranjan@codeaurora.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/cpu_errata.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index df56d2295d165..0f37045fafab3 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -460,6 +460,8 @@ static const struct midr_range arm64_ssb_cpus[] = { + MIDR_ALL_VERSIONS(MIDR_CORTEX_A53), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A55), + MIDR_ALL_VERSIONS(MIDR_BRAHMA_B53), ++ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_3XX_SILVER), ++ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_4XX_SILVER), + {}, + }; + +-- +2.25.1 + diff --git a/queue-5.7/arm64-kpti-add-kryo-3-4-xx-silver-cpu-cores-to-kpti-.patch b/queue-5.7/arm64-kpti-add-kryo-3-4-xx-silver-cpu-cores-to-kpti-.patch new file mode 100644 index 00000000000..580a5f5517e --- /dev/null +++ b/queue-5.7/arm64-kpti-add-kryo-3-4-xx-silver-cpu-cores-to-kpti-.patch @@ -0,0 +1,36 @@ +From d7cdefad042d431ff4f58954eb5643cf558d8d77 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jun 2020 18:04:06 +0530 +Subject: arm64: kpti: Add KRYO{3, 4}XX silver CPU cores to kpti safelist + +From: Sai Prakash Ranjan + +[ Upstream commit f4617be35b4b547e82d30993f56d631dfc2d5f88 ] + +QCOM KRYO{3,4}XX silver/LITTLE CPU cores are based on Cortex-A55 +and are meltdown safe, hence add them to kpti_safe_list[]. + +Signed-off-by: Sai Prakash Ranjan +Link: https://lore.kernel.org/r/20200624123406.3472-1-saiprakash.ranjan@codeaurora.org +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/cpufeature.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index 9fac745aa7bb2..b0fb1d5bf2235 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -1059,6 +1059,8 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry, + MIDR_ALL_VERSIONS(MIDR_CORTEX_A73), + MIDR_ALL_VERSIONS(MIDR_HISI_TSV110), + MIDR_ALL_VERSIONS(MIDR_NVIDIA_CARMEL), ++ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_3XX_SILVER), ++ MIDR_ALL_VERSIONS(MIDR_QCOM_KRYO_4XX_SILVER), + { /* sentinel */ } + }; + char const *str = "kpti command line option"; +-- +2.25.1 + diff --git a/queue-5.7/asoc-hdac_hda-fix-memleak-with-regmap-not-freed-on-r.patch b/queue-5.7/asoc-hdac_hda-fix-memleak-with-regmap-not-freed-on-r.patch new file mode 100644 index 00000000000..418dc48765c --- /dev/null +++ b/queue-5.7/asoc-hdac_hda-fix-memleak-with-regmap-not-freed-on-r.patch @@ -0,0 +1,98 @@ +From 5e1999e997b43c4e9e3b9bb2d2e326692ef8449c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 11:41:44 -0500 +Subject: ASoC: hdac_hda: fix memleak with regmap not freed on remove + +From: Pierre-Louis Bossart + +[ Upstream commit a94eaccefea1186947c5c5451fcae2245dd7e714 ] + +kmemleak throws error reports on module load/unload tests, add +snd_hdac_regmap_exit() in .remove(). + +While we are at it, also fix the error handling flow in .probe() to +use snd_hdac_regmap_exit() if needed. + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Daniel Baluta +Reviewed-by: Kai Vehmanen +Reviewed-by: Rander Wang +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Bard Liao +Link: https://lore.kernel.org/r/20200617164144.17859-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/hdac_hda.c | 16 ++++++++++------ + 1 file changed, 10 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/hdac_hda.c b/sound/soc/codecs/hdac_hda.c +index de003acb1951f..473efe9ef998a 100644 +--- a/sound/soc/codecs/hdac_hda.c ++++ b/sound/soc/codecs/hdac_hda.c +@@ -441,13 +441,13 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component) + ret = snd_hda_codec_set_name(hcodec, hcodec->preset->name); + if (ret < 0) { + dev_err(&hdev->dev, "name failed %s\n", hcodec->preset->name); +- goto error; ++ goto error_pm; + } + + ret = snd_hdac_regmap_init(&hcodec->core); + if (ret < 0) { + dev_err(&hdev->dev, "regmap init failed\n"); +- goto error; ++ goto error_pm; + } + + patch = (hda_codec_patch_t)hcodec->preset->driver_data; +@@ -455,7 +455,7 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component) + ret = patch(hcodec); + if (ret < 0) { + dev_err(&hdev->dev, "patch failed %d\n", ret); +- goto error; ++ goto error_regmap; + } + } else { + dev_dbg(&hdev->dev, "no patch file found\n"); +@@ -467,7 +467,7 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component) + ret = snd_hda_codec_parse_pcms(hcodec); + if (ret < 0) { + dev_err(&hdev->dev, "unable to map pcms to dai %d\n", ret); +- goto error; ++ goto error_regmap; + } + + /* HDMI controls need to be created in machine drivers */ +@@ -476,7 +476,7 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component) + if (ret < 0) { + dev_err(&hdev->dev, "unable to create controls %d\n", + ret); +- goto error; ++ goto error_regmap; + } + } + +@@ -496,7 +496,9 @@ static int hdac_hda_codec_probe(struct snd_soc_component *component) + + return 0; + +-error: ++error_regmap: ++ snd_hdac_regmap_exit(hdev); ++error_pm: + pm_runtime_put(&hdev->dev); + error_no_pm: + snd_hdac_ext_bus_link_put(hdev->bus, hlink); +@@ -518,6 +520,8 @@ static void hdac_hda_codec_remove(struct snd_soc_component *component) + + pm_runtime_disable(&hdev->dev); + snd_hdac_ext_bus_link_put(hdev->bus, hlink); ++ ++ snd_hdac_regmap_exit(hdev); + } + + static const struct snd_soc_dapm_route hdac_hda_dapm_routes[] = { +-- +2.25.1 + diff --git a/queue-5.7/asoc-sof-intel-add-pci-id-for-cometlake-s.patch b/queue-5.7/asoc-sof-intel-add-pci-id-for-cometlake-s.patch new file mode 100644 index 00000000000..ef630c2b5b8 --- /dev/null +++ b/queue-5.7/asoc-sof-intel-add-pci-id-for-cometlake-s.patch @@ -0,0 +1,37 @@ +From e221cdf9c5e80e7167ab3bec65c3efc2df1995ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 11:47:54 -0500 +Subject: ASoC: SOF: Intel: add PCI ID for CometLake-S + +From: Pierre-Louis Bossart + +[ Upstream commit 258fb4f4c34a0db9d3834aba6784d7b322176bb9 ] + +Mirror ID added for legacy HDaudio + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20200617164755.18104-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/sof-pci-dev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c +index cec631a1389b5..7b1846aeadd59 100644 +--- a/sound/soc/sof/sof-pci-dev.c ++++ b/sound/soc/sof/sof-pci-dev.c +@@ -427,6 +427,8 @@ static const struct pci_device_id sof_pci_ids[] = { + #if IS_ENABLED(CONFIG_SND_SOC_SOF_COMETLAKE_H) + { PCI_DEVICE(0x8086, 0x06c8), + .driver_data = (unsigned long)&cml_desc}, ++ { PCI_DEVICE(0x8086, 0xa3f0), /* CML-S */ ++ .driver_data = (unsigned long)&cml_desc}, + #endif + #if IS_ENABLED(CONFIG_SND_SOC_SOF_TIGERLAKE) + { PCI_DEVICE(0x8086, 0xa0c8), +-- +2.25.1 + diff --git a/queue-5.7/block-release-bip-in-a-right-way-in-error-path.patch b/queue-5.7/block-release-bip-in-a-right-way-in-error-path.patch new file mode 100644 index 00000000000..e11eada2952 --- /dev/null +++ b/queue-5.7/block-release-bip-in-a-right-way-in-error-path.patch @@ -0,0 +1,72 @@ +From dd7416b8667f7e5e773e0892fd3658d70abff06e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jun 2020 18:21:39 +0800 +Subject: block: release bip in a right way in error path + +From: Chengguang Xu + +[ Upstream commit 0b8eb629a700c0ef15a437758db8255f8444e76c ] + +Release bip using kfree() in error path when that was allocated +by kmalloc(). + +Signed-off-by: Chengguang Xu +Reviewed-by: Christoph Hellwig +Acked-by: Martin K. Petersen +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio-integrity.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/block/bio-integrity.c b/block/bio-integrity.c +index ae07dd78e9518..c9dc2b17ce251 100644 +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -24,6 +24,18 @@ void blk_flush_integrity(void) + flush_workqueue(kintegrityd_wq); + } + ++void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip) ++{ ++ if (bs && mempool_initialized(&bs->bio_integrity_pool)) { ++ if (bip->bip_vec) ++ bvec_free(&bs->bvec_integrity_pool, bip->bip_vec, ++ bip->bip_slab); ++ mempool_free(bip, &bs->bio_integrity_pool); ++ } else { ++ kfree(bip); ++ } ++} ++ + /** + * bio_integrity_alloc - Allocate integrity payload and attach it to bio + * @bio: bio to attach integrity metadata to +@@ -75,7 +87,7 @@ struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio, + + return bip; + err: +- mempool_free(bip, &bs->bio_integrity_pool); ++ __bio_integrity_free(bs, bip); + return ERR_PTR(-ENOMEM); + } + EXPORT_SYMBOL(bio_integrity_alloc); +@@ -96,14 +108,7 @@ void bio_integrity_free(struct bio *bio) + kfree(page_address(bip->bip_vec->bv_page) + + bip->bip_vec->bv_offset); + +- if (bs && mempool_initialized(&bs->bio_integrity_pool)) { +- bvec_free(&bs->bvec_integrity_pool, bip->bip_vec, bip->bip_slab); +- +- mempool_free(bip, &bs->bio_integrity_pool); +- } else { +- kfree(bip); +- } +- ++ __bio_integrity_free(bs, bip); + bio->bi_integrity = NULL; + bio->bi_opf &= ~REQ_INTEGRITY; + } +-- +2.25.1 + diff --git a/queue-5.7/cifs-update-ctime-and-mtime-during-truncate.patch b/queue-5.7/cifs-update-ctime-and-mtime-during-truncate.patch new file mode 100644 index 00000000000..f68b9acc99a --- /dev/null +++ b/queue-5.7/cifs-update-ctime-and-mtime-during-truncate.patch @@ -0,0 +1,49 @@ +From 852e517313a1deb45f30dd9ed166837543b13321 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jun 2020 22:51:29 -0400 +Subject: cifs: update ctime and mtime during truncate + +From: Zhang Xiaoxu + +[ Upstream commit 5618303d8516f8ac5ecfe53ee8e8bc9a40eaf066 ] + +As the man description of the truncate, if the size changed, +then the st_ctime and st_mtime fields should be updated. But +in cifs, we doesn't do it. + +It lead the xfstests generic/313 failed. + +So, add the ATTR_MTIME|ATTR_CTIME flags on attrs when change +the file size + +Reported-by: Hulk Robot +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/inode.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index 430b0b1256547..44a57b65915bf 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -2350,6 +2350,15 @@ set_size_out: + if (rc == 0) { + cifsInode->server_eof = attrs->ia_size; + cifs_setsize(inode, attrs->ia_size); ++ ++ /* ++ * The man page of truncate says if the size changed, ++ * then the st_ctime and st_mtime fields for the file ++ * are updated. ++ */ ++ attrs->ia_ctime = attrs->ia_mtime = current_time(inode); ++ attrs->ia_valid |= ATTR_CTIME | ATTR_MTIME; ++ + cifs_truncate_page(inode->i_mapping, inode->i_size); + } + +-- +2.25.1 + diff --git a/queue-5.7/drm-mcde-fix-display-initialization-problem.patch b/queue-5.7/drm-mcde-fix-display-initialization-problem.patch new file mode 100644 index 00000000000..c2dc2a36458 --- /dev/null +++ b/queue-5.7/drm-mcde-fix-display-initialization-problem.patch @@ -0,0 +1,62 @@ +From 621357d6dbdb0e9794be5fc9f504650dda96c8f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 00:30:26 +0200 +Subject: drm: mcde: Fix display initialization problem + +From: Linus Walleij + +[ Upstream commit b984b6d8b52372b98cce0a6ff6c2787f50665b87 ] + +The following bug appeared in the MCDE driver/display +initialization during the recent merge window. + +First the place we call drm_fbdev_generic_setup() in the +wrong place: this needs to be called AFTER calling +drm_dev_register() else we get this splat: + + ------------[ cut here ]------------ +WARNING: CPU: 0 PID: 1 at ../drivers/gpu/drm/drm_fb_helper.c:2198 drm_fbdev_generic_setup+0x164/0x1a8 +mcde a0350000.mcde: Device has not been registered. +Modules linked in: +Hardware name: ST-Ericsson Ux5x0 platform (Device Tree Support) +[] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[] (show_stack) from [] (dump_stack+0x9c/0xb0) +[] (dump_stack) from [] (__warn+0xb8/0xd0) +[] (__warn) from [] (warn_slowpath_fmt+0x74/0xb8) +[] (warn_slowpath_fmt) from [] (drm_fbdev_generic_setup+0x164/0x1a8) +[] (drm_fbdev_generic_setup) from [] (mcde_drm_bind+0xc4/0x160) +[] (mcde_drm_bind) from [] (try_to_bring_up_master+0x15c/0x1a4) +(...) + +Signed-off-by: Linus Walleij +Reviewed-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20200613223027.4189309-1-linus.walleij@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mcde/mcde_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c +index f28cb7a576ba4..1e7c5aa4d5e62 100644 +--- a/drivers/gpu/drm/mcde/mcde_drv.c ++++ b/drivers/gpu/drm/mcde/mcde_drv.c +@@ -208,7 +208,6 @@ static int mcde_modeset_init(struct drm_device *drm) + + drm_mode_config_reset(drm); + drm_kms_helper_poll_init(drm); +- drm_fbdev_generic_setup(drm, 32); + + return 0; + +@@ -275,6 +274,8 @@ static int mcde_drm_bind(struct device *dev) + if (ret < 0) + goto unbind; + ++ drm_fbdev_generic_setup(drm, 32); ++ + return 0; + + unbind: +-- +2.25.1 + diff --git a/queue-5.7/drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch b/queue-5.7/drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch new file mode 100644 index 00000000000..b66c15a8cef --- /dev/null +++ b/queue-5.7/drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch @@ -0,0 +1,41 @@ +From 1ad4f85150020750598bb44b2621ba60fe310c7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 May 2020 11:30:24 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for Asus T101HA panel + +From: Hans de Goede + +[ Upstream commit 6c22bc18a3b93a38018844636557ad02e588e055 ] + +Like the Asus T100HA the Asus T101HA also uses a panel which has been +mounted 90 degrees rotated, albeit in the opposite direction. +Add a quirk for this. + +Reviewed-by: Emil Velikov +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20200531093025.28050-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index ffd95bfeaa94c..d11d83703931e 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -121,6 +121,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"), + }, + .driver_data = (void *)&asus_t100ha, ++ }, { /* Asus T101HA */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* GPD MicroPC (generic strings, also match on bios date) */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), +-- +2.25.1 + diff --git a/queue-5.7/drm-panel-orientation-quirks-use-generic-orientation.patch b/queue-5.7/drm-panel-orientation-quirks-use-generic-orientation.patch new file mode 100644 index 00000000000..8df1fe1e210 --- /dev/null +++ b/queue-5.7/drm-panel-orientation-quirks-use-generic-orientation.patch @@ -0,0 +1,53 @@ +From d5ebde6b80387672088c4cc56f2b5b9e68d79426 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 May 2020 11:30:25 +0200 +Subject: drm: panel-orientation-quirks: Use generic orientation-data for Acer + S1003 + +From: Hans de Goede + +[ Upstream commit a05caf9e62a85d12da27e814ac13195f4683f21c ] + +The Acer S1003 has proper DMI strings for sys-vendor and product-name, +so we do not need to match by BIOS-date. + +This means that the Acer S1003 can use the generic lcd800x1280_rightside_up +drm_dmi_panel_orientation_data struct which is also used by other quirks. + +Reviewed-by: Emil Velikov +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20200531093025.28050-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index d11d83703931e..d00ea384dcbfe 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -30,12 +30,6 @@ struct drm_dmi_panel_orientation_data { + int orientation; + }; + +-static const struct drm_dmi_panel_orientation_data acer_s1003 = { +- .width = 800, +- .height = 1280, +- .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, +-}; +- + static const struct drm_dmi_panel_orientation_data asus_t100ha = { + .width = 800, + .height = 1280, +@@ -114,7 +108,7 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"), + }, +- .driver_data = (void *)&acer_s1003, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* Asus T100HA */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +-- +2.25.1 + diff --git a/queue-5.7/drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch b/queue-5.7/drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch new file mode 100644 index 00000000000..e3f8bc1df98 --- /dev/null +++ b/queue-5.7/drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch @@ -0,0 +1,55 @@ +From 82a87aa81e6d34b1ad892f827cd937b04a2944ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 May 2020 16:07:24 +0200 +Subject: drm/sun4i: mixer: Call of_dma_configure if there's an IOMMU + +From: Maxime Ripard + +[ Upstream commit 842ec61f4006a6477a9deaedd69131e9f46e4cb5 ] + +The main DRM device is actually a virtual device so it doesn't have the +iommus property, which is instead on the DMA masters, in this case the +mixers. + +Add a call to of_dma_configure with the mixers DT node but on the DRM +virtual device to configure it in the same way than the mixers. + +Reviewed-by: Paul Kocialkowski +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/9a4daf438dd3f2fe07afb23688bfb793a0613d7d.1589378833.git-series.maxime@cerno.tech +(cherry picked from commit b718102dbdfd0285ad559687a30e27cc9124e592) +[Maxime: Applied to -fixes since it missed the merge window and display is + broken without it] +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_mixer.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.c b/drivers/gpu/drm/sun4i/sun8i_mixer.c +index 4a64f7ae437a8..19b3b41847046 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c +@@ -452,6 +452,19 @@ static int sun8i_mixer_bind(struct device *dev, struct device *master, + mixer->engine.ops = &sun8i_engine_ops; + mixer->engine.node = dev->of_node; + ++ if (of_find_property(dev->of_node, "iommus", NULL)) { ++ /* ++ * This assume we have the same DMA constraints for ++ * all our the mixers in our pipeline. This sounds ++ * bad, but it has always been the case for us, and ++ * DRM doesn't do per-device allocation either, so we ++ * would need to fix DRM first... ++ */ ++ ret = of_dma_configure(drm->dev, dev->of_node, true); ++ if (ret) ++ return ret; ++ } ++ + /* + * While this function can fail, we shouldn't do anything + * if this happens. Some early DE2 DT entries don't provide +-- +2.25.1 + diff --git a/queue-5.7/drm-tegra-hub-do-not-enable-orphaned-window-group.patch b/queue-5.7/drm-tegra-hub-do-not-enable-orphaned-window-group.patch new file mode 100644 index 00000000000..3531ed78f83 --- /dev/null +++ b/queue-5.7/drm-tegra-hub-do-not-enable-orphaned-window-group.patch @@ -0,0 +1,52 @@ +From 31a23e8d192bf9df138d37446db204909e959d2c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 May 2020 02:03:01 -0700 +Subject: drm/tegra: hub: Do not enable orphaned window group + +From: Nicolin Chen + +[ Upstream commit ef4e417eb3ec7fe657928f10ac1d2154d8a5fb38 ] + +Though the unconditional enable/disable code is not a final solution, +we don't want to run into a NULL pointer situation when window group +doesn't link to its DC parent if the DC is disabled in Device Tree. + +So this patch simply adds a check to make sure that window group has +a valid parent before running into tegra_windowgroup_enable/disable. + +Signed-off-by: Nicolin Chen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/hub.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/hub.c b/drivers/gpu/drm/tegra/hub.c +index 8183e617bf6b8..a2ef8f218d4ec 100644 +--- a/drivers/gpu/drm/tegra/hub.c ++++ b/drivers/gpu/drm/tegra/hub.c +@@ -149,7 +149,9 @@ int tegra_display_hub_prepare(struct tegra_display_hub *hub) + for (i = 0; i < hub->soc->num_wgrps; i++) { + struct tegra_windowgroup *wgrp = &hub->wgrps[i]; + +- tegra_windowgroup_enable(wgrp); ++ /* Skip orphaned window group whose parent DC is disabled */ ++ if (wgrp->parent) ++ tegra_windowgroup_enable(wgrp); + } + + return 0; +@@ -166,7 +168,9 @@ void tegra_display_hub_cleanup(struct tegra_display_hub *hub) + for (i = 0; i < hub->soc->num_wgrps; i++) { + struct tegra_windowgroup *wgrp = &hub->wgrps[i]; + +- tegra_windowgroup_disable(wgrp); ++ /* Skip orphaned window group whose parent DC is disabled */ ++ if (wgrp->parent) ++ tegra_windowgroup_disable(wgrp); + } + } + +-- +2.25.1 + diff --git a/queue-5.7/drm-ttm-fix-dma_fence-refcnt-leak-in-ttm_bo_vm_fault.patch b/queue-5.7/drm-ttm-fix-dma_fence-refcnt-leak-in-ttm_bo_vm_fault.patch new file mode 100644 index 00000000000..d18184811c0 --- /dev/null +++ b/queue-5.7/drm-ttm-fix-dma_fence-refcnt-leak-in-ttm_bo_vm_fault.patch @@ -0,0 +1,55 @@ +From 3ae84d73b1e386e4e50a02679cb5838b6571c6a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jun 2020 20:28:38 +0800 +Subject: drm/ttm: Fix dma_fence refcnt leak in ttm_bo_vm_fault_reserved +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiyu Yang + +[ Upstream commit 37cc4b95d13f311c04aa8e9daacca3905ad45ca7 ] + +ttm_bo_vm_fault_reserved() invokes dma_fence_get(), which returns a +reference of the specified dma_fence object to "moving" with increased +refcnt. + +When ttm_bo_vm_fault_reserved() returns, local variable "moving" becomes +invalid, so the refcount should be decreased to keep refcount balanced. + +The reference counting issue happens in several exception handling paths +of ttm_bo_vm_fault_reserved(). When those error scenarios occur such as +"err" equals to -EBUSY, the function forgets to decrease the refcnt +increased by dma_fence_get(), causing a refcnt leak. + +Fix this issue by calling dma_fence_put() when no_wait_gpu flag is +equals to true. + +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/370219/ +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_bo_vm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c +index 0ad30b1129821..72100b84c7a90 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo_vm.c ++++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c +@@ -300,8 +300,10 @@ vm_fault_t ttm_bo_vm_fault_reserved(struct vm_fault *vmf, + break; + case -EBUSY: + case -ERESTARTSYS: ++ dma_fence_put(moving); + return VM_FAULT_NOPAGE; + default: ++ dma_fence_put(moving); + return VM_FAULT_SIGBUS; + } + +-- +2.25.1 + diff --git a/queue-5.7/drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch b/queue-5.7/drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch new file mode 100644 index 00000000000..e0f3d84c0d4 --- /dev/null +++ b/queue-5.7/drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch @@ -0,0 +1,56 @@ +From 317e68dc36073f373a6dd2a95b72d19202c3f97d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jun 2020 20:30:25 +0800 +Subject: drm/ttm: Fix dma_fence refcnt leak when adding move fence +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiyu Yang + +[ Upstream commit 11425c4519e2c974a100fc984867046d905b9380 ] + +ttm_bo_add_move_fence() invokes dma_fence_get(), which returns a +reference of the specified dma_fence object to "fence" with increased +refcnt. + +When ttm_bo_add_move_fence() returns, local variable "fence" becomes +invalid, so the refcount should be decreased to keep refcount balanced. + +The reference counting issue happens in one exception handling path of +ttm_bo_add_move_fence(). When no_wait_gpu flag is equals to true, the +function forgets to decrease the refcnt increased by dma_fence_get(), +causing a refcnt leak. + +Fix this issue by calling dma_fence_put() when no_wait_gpu flag is +equals to true. + +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/370221/ +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_bo.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c +index 9e07c3f75156b..ef5bc00c73e23 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -881,8 +881,10 @@ static int ttm_bo_add_move_fence(struct ttm_buffer_object *bo, + if (!fence) + return 0; + +- if (no_wait_gpu) ++ if (no_wait_gpu) { ++ dma_fence_put(fence); + return -EBUSY; ++ } + + dma_resv_add_shared_fence(bo->base.resv, fence); + +-- +2.25.1 + diff --git a/queue-5.7/gpu-host1x-clean-up-debugfs-in-error-handling-path.patch b/queue-5.7/gpu-host1x-clean-up-debugfs-in-error-handling-path.patch new file mode 100644 index 00000000000..9ac51d100fe --- /dev/null +++ b/queue-5.7/gpu-host1x-clean-up-debugfs-in-error-handling-path.patch @@ -0,0 +1,43 @@ +From eb8cd7ec8fd29c05cc565a39c4bac92ea9c4a48b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 26 Apr 2020 21:16:30 +0200 +Subject: gpu: host1x: Clean up debugfs in error handling path + +From: Christophe JAILLET + +[ Upstream commit 109be8b23fb2ec8e2d309325ee3b7a49eab63961 ] + +host1x_debug_init() must be reverted in an error handling path. + +This is already fixed in the remove function since commit 44156eee91ba +("gpu: host1x: Clean up debugfs on removal") + +Signed-off-by: Christophe JAILLET +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/dev.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c +index d24344e919227..3c0f151847bae 100644 +--- a/drivers/gpu/host1x/dev.c ++++ b/drivers/gpu/host1x/dev.c +@@ -468,11 +468,12 @@ static int host1x_probe(struct platform_device *pdev) + + err = host1x_register(host); + if (err < 0) +- goto deinit_intr; ++ goto deinit_debugfs; + + return 0; + +-deinit_intr: ++deinit_debugfs: ++ host1x_debug_deinit(host); + host1x_intr_deinit(host); + deinit_syncpt: + host1x_syncpt_deinit(host); +-- +2.25.1 + diff --git a/queue-5.7/gpu-host1x-detach-driver-on-unregister.patch b/queue-5.7/gpu-host1x-detach-driver-on-unregister.patch new file mode 100644 index 00000000000..938e4b02ff3 --- /dev/null +++ b/queue-5.7/gpu-host1x-detach-driver-on-unregister.patch @@ -0,0 +1,55 @@ +From 5730b6145b35cee47cae2cf5b654e50c5195fd6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Apr 2020 19:38:02 +0200 +Subject: gpu: host1x: Detach driver on unregister + +From: Thierry Reding + +[ Upstream commit d9a0a05bf8c76e6dc79230669a8b5d685b168c30 ] + +Currently when a host1x device driver is unregistered, it is not +detached from the host1x controller, which means that the device +will stay around and when the driver is registered again, it may +bind to the old, stale device rather than the new one that was +created from scratch upon driver registration. This in turn can +cause various weird crashes within the driver core because it is +confronted with a device that was already deleted. + +Fix this by detaching the driver from the host1x controller when +it is unregistered. This ensures that the deleted device also is +no longer present in the device list that drivers will bind to. + +Reported-by: Sowjanya Komatineni +Signed-off-by: Thierry Reding +Tested-by: Sowjanya Komatineni +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/bus.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c +index 6a995db51d6d8..e201f62d62c0c 100644 +--- a/drivers/gpu/host1x/bus.c ++++ b/drivers/gpu/host1x/bus.c +@@ -686,8 +686,17 @@ EXPORT_SYMBOL(host1x_driver_register_full); + */ + void host1x_driver_unregister(struct host1x_driver *driver) + { ++ struct host1x *host1x; ++ + driver_unregister(&driver->driver); + ++ mutex_lock(&devices_lock); ++ ++ list_for_each_entry(host1x, &devices, list) ++ host1x_detach_driver(host1x, driver); ++ ++ mutex_unlock(&devices_lock); ++ + mutex_lock(&drivers_lock); + list_del_init(&driver->list); + mutex_unlock(&drivers_lock); +-- +2.25.1 + diff --git a/queue-5.7/i40e-protect-ring-accesses-with-read-and-write_once.patch b/queue-5.7/i40e-protect-ring-accesses-with-read-and-write_once.patch new file mode 100644 index 00000000000..096d6c1e8c7 --- /dev/null +++ b/queue-5.7/i40e-protect-ring-accesses-with-read-and-write_once.patch @@ -0,0 +1,110 @@ +From 5977d30803884c9d4081189172ff0610f4d9561f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2020 13:19:44 +0000 +Subject: i40e: protect ring accesses with READ- and WRITE_ONCE + +From: Ciara Loftus + +[ Upstream commit d59e267912cd90b0adf33b4659050d831e746317 ] + +READ_ONCE should be used when reading rings prior to accessing the +statistics pointer. Introduce this as well as the corresponding WRITE_ONCE +usage when allocating and freeing the rings, to ensure protected access. + +Signed-off-by: Ciara Loftus +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 29 ++++++++++++++------- + 1 file changed, 19 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 2a037ec244b94..80dc5fcb82db7 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -439,11 +439,15 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev, + i40e_get_netdev_stats_struct_tx(ring, stats); + + if (i40e_enabled_xdp_vsi(vsi)) { +- ring++; ++ ring = READ_ONCE(vsi->xdp_rings[i]); ++ if (!ring) ++ continue; + i40e_get_netdev_stats_struct_tx(ring, stats); + } + +- ring++; ++ ring = READ_ONCE(vsi->rx_rings[i]); ++ if (!ring) ++ continue; + do { + start = u64_stats_fetch_begin_irq(&ring->syncp); + packets = ring->stats.packets; +@@ -787,6 +791,8 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi) + for (q = 0; q < vsi->num_queue_pairs; q++) { + /* locate Tx ring */ + p = READ_ONCE(vsi->tx_rings[q]); ++ if (!p) ++ continue; + + do { + start = u64_stats_fetch_begin_irq(&p->syncp); +@@ -800,8 +806,11 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi) + tx_linearize += p->tx_stats.tx_linearize; + tx_force_wb += p->tx_stats.tx_force_wb; + +- /* Rx queue is part of the same block as Tx queue */ +- p = &p[1]; ++ /* locate Rx ring */ ++ p = READ_ONCE(vsi->rx_rings[q]); ++ if (!p) ++ continue; ++ + do { + start = u64_stats_fetch_begin_irq(&p->syncp); + packets = p->stats.packets; +@@ -10816,10 +10825,10 @@ static void i40e_vsi_clear_rings(struct i40e_vsi *vsi) + if (vsi->tx_rings && vsi->tx_rings[0]) { + for (i = 0; i < vsi->alloc_queue_pairs; i++) { + kfree_rcu(vsi->tx_rings[i], rcu); +- vsi->tx_rings[i] = NULL; +- vsi->rx_rings[i] = NULL; ++ WRITE_ONCE(vsi->tx_rings[i], NULL); ++ WRITE_ONCE(vsi->rx_rings[i], NULL); + if (vsi->xdp_rings) +- vsi->xdp_rings[i] = NULL; ++ WRITE_ONCE(vsi->xdp_rings[i], NULL); + } + } + } +@@ -10853,7 +10862,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi) + if (vsi->back->hw_features & I40E_HW_WB_ON_ITR_CAPABLE) + ring->flags = I40E_TXR_FLAGS_WB_ON_ITR; + ring->itr_setting = pf->tx_itr_default; +- vsi->tx_rings[i] = ring++; ++ WRITE_ONCE(vsi->tx_rings[i], ring++); + + if (!i40e_enabled_xdp_vsi(vsi)) + goto setup_rx; +@@ -10871,7 +10880,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi) + ring->flags = I40E_TXR_FLAGS_WB_ON_ITR; + set_ring_xdp(ring); + ring->itr_setting = pf->tx_itr_default; +- vsi->xdp_rings[i] = ring++; ++ WRITE_ONCE(vsi->xdp_rings[i], ring++); + + setup_rx: + ring->queue_index = i; +@@ -10884,7 +10893,7 @@ setup_rx: + ring->size = 0; + ring->dcb_tc = 0; + ring->itr_setting = pf->rx_itr_default; +- vsi->rx_rings[i] = ring; ++ WRITE_ONCE(vsi->rx_rings[i], ring); + } + + return 0; +-- +2.25.1 + diff --git a/queue-5.7/ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch b/queue-5.7/ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch new file mode 100644 index 00000000000..592a46f583e --- /dev/null +++ b/queue-5.7/ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch @@ -0,0 +1,48 @@ +From e857e651a508bceb4b8a618c0638c1e2601d2b83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 15:24:13 -0400 +Subject: ibmvnic: continue to init in CRQ reset returns H_CLOSED + +From: Dany Madden + +[ Upstream commit 8b40eb73509f5704a0e8cd25de0163876299f1a7 ] + +Continue the reset path when partner adapter is not ready or H_CLOSED is +returned from reset crq. This patch allows the CRQ init to proceed to +establish a valid CRQ for traffic to flow after reset. + +Signed-off-by: Dany Madden +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 2baf7b3ff4cbf..0fd7eae25fe9d 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1971,13 +1971,18 @@ static int do_reset(struct ibmvnic_adapter *adapter, + release_sub_crqs(adapter, 1); + } else { + rc = ibmvnic_reset_crq(adapter); +- if (!rc) ++ if (rc == H_CLOSED || rc == H_SUCCESS) { + rc = vio_enable_interrupts(adapter->vdev); ++ if (rc) ++ netdev_err(adapter->netdev, ++ "Reset failed to enable interrupts. rc=%d\n", ++ rc); ++ } + } + + if (rc) { + netdev_err(adapter->netdev, +- "Couldn't initialize crq. rc=%d\n", rc); ++ "Reset couldn't initialize crq. rc=%d\n", rc); + goto out; + } + +-- +2.25.1 + diff --git a/queue-5.7/ice-protect-ring-accesses-with-write_once.patch b/queue-5.7/ice-protect-ring-accesses-with-write_once.patch new file mode 100644 index 00000000000..3f20e61972a --- /dev/null +++ b/queue-5.7/ice-protect-ring-accesses-with-write_once.patch @@ -0,0 +1,79 @@ +From a73b0e5543be4b400610a401c6c66538160a3e7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2020 13:19:45 +0000 +Subject: ice: protect ring accesses with WRITE_ONCE + +From: Ciara Loftus + +[ Upstream commit b1d95cc2391ffac0c5b27256a4fb0d2cfb021a29 ] + +The READ_ONCE macro is used when reading rings prior to accessing the +statistics pointer. The corresponding WRITE_ONCE usage when allocating and +freeing the rings to ensure protected access was not in place. Introduce +this. + +Signed-off-by: Ciara Loftus +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ice/ice_lib.c | 8 ++++---- + drivers/net/ethernet/intel/ice/ice_main.c | 2 +- + 2 files changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c +index 2f256bf45efcf..6dd839b325259 100644 +--- a/drivers/net/ethernet/intel/ice/ice_lib.c ++++ b/drivers/net/ethernet/intel/ice/ice_lib.c +@@ -1063,7 +1063,7 @@ static void ice_vsi_clear_rings(struct ice_vsi *vsi) + for (i = 0; i < vsi->alloc_txq; i++) { + if (vsi->tx_rings[i]) { + kfree_rcu(vsi->tx_rings[i], rcu); +- vsi->tx_rings[i] = NULL; ++ WRITE_ONCE(vsi->tx_rings[i], NULL); + } + } + } +@@ -1071,7 +1071,7 @@ static void ice_vsi_clear_rings(struct ice_vsi *vsi) + for (i = 0; i < vsi->alloc_rxq; i++) { + if (vsi->rx_rings[i]) { + kfree_rcu(vsi->rx_rings[i], rcu); +- vsi->rx_rings[i] = NULL; ++ WRITE_ONCE(vsi->rx_rings[i], NULL); + } + } + } +@@ -1104,7 +1104,7 @@ static int ice_vsi_alloc_rings(struct ice_vsi *vsi) + ring->vsi = vsi; + ring->dev = dev; + ring->count = vsi->num_tx_desc; +- vsi->tx_rings[i] = ring; ++ WRITE_ONCE(vsi->tx_rings[i], ring); + } + + /* Allocate Rx rings */ +@@ -1123,7 +1123,7 @@ static int ice_vsi_alloc_rings(struct ice_vsi *vsi) + ring->netdev = vsi->netdev; + ring->dev = dev; + ring->count = vsi->num_rx_desc; +- vsi->rx_rings[i] = ring; ++ WRITE_ONCE(vsi->rx_rings[i], ring); + } + + return 0; +diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c +index 69e50331e08e9..7fd2ec63f128e 100644 +--- a/drivers/net/ethernet/intel/ice/ice_main.c ++++ b/drivers/net/ethernet/intel/ice/ice_main.c +@@ -1701,7 +1701,7 @@ static int ice_xdp_alloc_setup_rings(struct ice_vsi *vsi) + xdp_ring->netdev = NULL; + xdp_ring->dev = dev; + xdp_ring->count = vsi->num_tx_desc; +- vsi->xdp_rings[i] = xdp_ring; ++ WRITE_ONCE(vsi->xdp_rings[i], xdp_ring); + if (ice_setup_tx_ring(xdp_ring)) + goto free_xdp_rings; + ice_set_ring_xdp(xdp_ring); +-- +2.25.1 + diff --git a/queue-5.7/iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch b/queue-5.7/iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch new file mode 100644 index 00000000000..71dbfa01ca6 --- /dev/null +++ b/queue-5.7/iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch @@ -0,0 +1,113 @@ +From 71ee591af579d88caa48fb682df5bb9e6f5fc3af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jun 2020 07:13:42 +0800 +Subject: iommu/vt-d: Don't apply gfx quirks to untrusted devices + +From: Rajat Jain + +[ Upstream commit 67e8a5b18d41af9298db5c17193f671f235cce01 ] + +Currently, an external malicious PCI device can masquerade the VID:PID +of faulty gfx devices, and thus apply iommu quirks to effectively +disable the IOMMU restrictions for itself. + +Thus we need to ensure that the device we are applying quirks to, is +indeed an internal trusted device. + +Signed-off-by: Rajat Jain +Reviewed-by: Ashok Raj +Reviewed-by: Mika Westerberg +Acked-by: Lu Baolu +Link: https://lore.kernel.org/r/20200622231345.29722-4-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-iommu.c | 37 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 34b2ed91cf4d9..2acf2842c3bd2 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -6206,6 +6206,23 @@ intel_iommu_domain_set_attr(struct iommu_domain *domain, + return ret; + } + ++/* ++ * Check that the device does not live on an external facing PCI port that is ++ * marked as untrusted. Such devices should not be able to apply quirks and ++ * thus not be able to bypass the IOMMU restrictions. ++ */ ++static bool risky_device(struct pci_dev *pdev) ++{ ++ if (pdev->untrusted) { ++ pci_info(pdev, ++ "Skipping IOMMU quirk for dev [%04X:%04X] on untrusted PCI link\n", ++ pdev->vendor, pdev->device); ++ pci_info(pdev, "Please check with your BIOS/Platform vendor about this\n"); ++ return true; ++ } ++ return false; ++} ++ + const struct iommu_ops intel_iommu_ops = { + .capable = intel_iommu_capable, + .domain_alloc = intel_iommu_domain_alloc, +@@ -6235,6 +6252,9 @@ const struct iommu_ops intel_iommu_ops = { + + static void quirk_iommu_igfx(struct pci_dev *dev) + { ++ if (risky_device(dev)) ++ return; ++ + pci_info(dev, "Disabling IOMMU for graphics on this chipset\n"); + dmar_map_gfx = 0; + } +@@ -6276,6 +6296,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163D, quirk_iommu_igfx); + + static void quirk_iommu_rwbf(struct pci_dev *dev) + { ++ if (risky_device(dev)) ++ return; ++ + /* + * Mobile 4 Series Chipset neglects to set RWBF capability, + * but needs it. Same seems to hold for the desktop versions. +@@ -6306,6 +6329,9 @@ static void quirk_calpella_no_shadow_gtt(struct pci_dev *dev) + { + unsigned short ggc; + ++ if (risky_device(dev)) ++ return; ++ + if (pci_read_config_word(dev, GGC, &ggc)) + return; + +@@ -6339,6 +6365,12 @@ static void __init check_tylersburg_isoch(void) + pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x3a3e, NULL); + if (!pdev) + return; ++ ++ if (risky_device(pdev)) { ++ pci_dev_put(pdev); ++ return; ++ } ++ + pci_dev_put(pdev); + + /* System Management Registers. Might be hidden, in which case +@@ -6348,6 +6380,11 @@ static void __init check_tylersburg_isoch(void) + if (!pdev) + return; + ++ if (risky_device(pdev)) { ++ pci_dev_put(pdev); ++ return; ++ } ++ + if (pci_read_config_dword(pdev, 0x188, &vtisochctrl)) { + pci_dev_put(pdev); + return; +-- +2.25.1 + diff --git a/queue-5.7/ixgbe-protect-ring-accesses-with-read-and-write_once.patch b/queue-5.7/ixgbe-protect-ring-accesses-with-read-and-write_once.patch new file mode 100644 index 00000000000..206f095e807 --- /dev/null +++ b/queue-5.7/ixgbe-protect-ring-accesses-with-read-and-write_once.patch @@ -0,0 +1,112 @@ +From 4c97aaffde03827dcfdaec57a830d74eda87ac0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2020 13:19:43 +0000 +Subject: ixgbe: protect ring accesses with READ- and WRITE_ONCE + +From: Ciara Loftus + +[ Upstream commit f140ad9fe2ae16f385f8fe4dc9cf67bb4c51d794 ] + +READ_ONCE should be used when reading rings prior to accessing the +statistics pointer. Introduce this as well as the corresponding WRITE_ONCE +usage when allocating and freeing the rings, to ensure protected access. + +Signed-off-by: Ciara Loftus +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 12 ++++++------ + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 14 +++++++++++--- + 2 files changed, 17 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c +index fd9f5d41b5942..2e35c5706cf10 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c +@@ -921,7 +921,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter, + ring->queue_index = txr_idx; + + /* assign ring to adapter */ +- adapter->tx_ring[txr_idx] = ring; ++ WRITE_ONCE(adapter->tx_ring[txr_idx], ring); + + /* update count and index */ + txr_count--; +@@ -948,7 +948,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter, + set_ring_xdp(ring); + + /* assign ring to adapter */ +- adapter->xdp_ring[xdp_idx] = ring; ++ WRITE_ONCE(adapter->xdp_ring[xdp_idx], ring); + + /* update count and index */ + xdp_count--; +@@ -991,7 +991,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter, + ring->queue_index = rxr_idx; + + /* assign ring to adapter */ +- adapter->rx_ring[rxr_idx] = ring; ++ WRITE_ONCE(adapter->rx_ring[rxr_idx], ring); + + /* update count and index */ + rxr_count--; +@@ -1020,13 +1020,13 @@ static void ixgbe_free_q_vector(struct ixgbe_adapter *adapter, int v_idx) + + ixgbe_for_each_ring(ring, q_vector->tx) { + if (ring_is_xdp(ring)) +- adapter->xdp_ring[ring->queue_index] = NULL; ++ WRITE_ONCE(adapter->xdp_ring[ring->queue_index], NULL); + else +- adapter->tx_ring[ring->queue_index] = NULL; ++ WRITE_ONCE(adapter->tx_ring[ring->queue_index], NULL); + } + + ixgbe_for_each_ring(ring, q_vector->rx) +- adapter->rx_ring[ring->queue_index] = NULL; ++ WRITE_ONCE(adapter->rx_ring[ring->queue_index], NULL); + + adapter->q_vector[v_idx] = NULL; + napi_hash_del(&q_vector->napi); +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index ea6834bae04c0..a32a072761aa2 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -7065,7 +7065,10 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter) + } + + for (i = 0; i < adapter->num_rx_queues; i++) { +- struct ixgbe_ring *rx_ring = adapter->rx_ring[i]; ++ struct ixgbe_ring *rx_ring = READ_ONCE(adapter->rx_ring[i]); ++ ++ if (!rx_ring) ++ continue; + non_eop_descs += rx_ring->rx_stats.non_eop_descs; + alloc_rx_page += rx_ring->rx_stats.alloc_rx_page; + alloc_rx_page_failed += rx_ring->rx_stats.alloc_rx_page_failed; +@@ -7086,15 +7089,20 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter) + packets = 0; + /* gather some stats to the adapter struct that are per queue */ + for (i = 0; i < adapter->num_tx_queues; i++) { +- struct ixgbe_ring *tx_ring = adapter->tx_ring[i]; ++ struct ixgbe_ring *tx_ring = READ_ONCE(adapter->tx_ring[i]); ++ ++ if (!tx_ring) ++ continue; + restart_queue += tx_ring->tx_stats.restart_queue; + tx_busy += tx_ring->tx_stats.tx_busy; + bytes += tx_ring->stats.bytes; + packets += tx_ring->stats.packets; + } + for (i = 0; i < adapter->num_xdp_queues; i++) { +- struct ixgbe_ring *xdp_ring = adapter->xdp_ring[i]; ++ struct ixgbe_ring *xdp_ring = READ_ONCE(adapter->xdp_ring[i]); + ++ if (!xdp_ring) ++ continue; + restart_queue += xdp_ring->tx_stats.restart_queue; + tx_busy += xdp_ring->tx_stats.tx_busy; + bytes += xdp_ring->stats.bytes; +-- +2.25.1 + diff --git a/queue-5.7/net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch b/queue-5.7/net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch new file mode 100644 index 00000000000..5921a032926 --- /dev/null +++ b/queue-5.7/net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch @@ -0,0 +1,50 @@ +From 7b58bb64e92e62152695b59b3a91875c92ba5393 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 10:31:40 +0200 +Subject: net: ethernet: mvneta: Add 2500BaseX support for SoCs without comphy + +From: Sascha Hauer + +[ Upstream commit 1a642ca7f38992b086101fe204a1ae3c90ed8016 ] + +The older SoCs like Armada XP support a 2500BaseX mode in the datasheets +referred to as DR-SGMII (Double rated SGMII) or HS-SGMII (High Speed +SGMII). This is an upclocked 1000BaseX mode, thus +PHY_INTERFACE_MODE_2500BASEX is the appropriate mode define for it. +adding support for it merely means writing the correct magic value into +the MVNETA_SERDES_CFG register. + +Signed-off-by: Sascha Hauer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 401eeeca89660..af578a5813bd2 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -110,6 +110,7 @@ + #define MVNETA_SERDES_CFG 0x24A0 + #define MVNETA_SGMII_SERDES_PROTO 0x0cc7 + #define MVNETA_QSGMII_SERDES_PROTO 0x0667 ++#define MVNETA_HSGMII_SERDES_PROTO 0x1107 + #define MVNETA_TYPE_PRIO 0x24bc + #define MVNETA_FORCE_UNI BIT(21) + #define MVNETA_TXQ_CMD_1 0x24e4 +@@ -3558,6 +3559,11 @@ static int mvneta_config_interface(struct mvneta_port *pp, + mvreg_write(pp, MVNETA_SERDES_CFG, + MVNETA_SGMII_SERDES_PROTO); + break; ++ ++ case PHY_INTERFACE_MODE_2500BASEX: ++ mvreg_write(pp, MVNETA_SERDES_CFG, ++ MVNETA_HSGMII_SERDES_PROTO); ++ break; + default: + return -EINVAL; + } +-- +2.25.1 + diff --git a/queue-5.7/net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch b/queue-5.7/net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch new file mode 100644 index 00000000000..2cf03094249 --- /dev/null +++ b/queue-5.7/net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch @@ -0,0 +1,171 @@ +From 63a972fd09c791a5197139b7792f3fbddfda5bd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 10:31:39 +0200 +Subject: net: ethernet: mvneta: Fix Serdes configuration for SoCs without + comphy + +From: Sascha Hauer + +[ Upstream commit b4748553f53f2971e07d2619f13d461daac0f3bb ] + +The MVNETA_SERDES_CFG register is only available on older SoCs like the +Armada XP. On newer SoCs like the Armada 38x the fields are moved to +comphy. This patch moves the writes to this register next to the comphy +initialization, so that depending on the SoC either comphy or +MVNETA_SERDES_CFG is configured. +With this we no longer write to the MVNETA_SERDES_CFG on SoCs where it +doesn't exist. + +Suggested-by: Russell King +Signed-off-by: Sascha Hauer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 80 +++++++++++++++------------ + 1 file changed, 44 insertions(+), 36 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 43b44a1e8f69e..401eeeca89660 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -106,6 +106,7 @@ + #define MVNETA_TX_IN_PRGRS BIT(1) + #define MVNETA_TX_FIFO_EMPTY BIT(8) + #define MVNETA_RX_MIN_FRAME_SIZE 0x247c ++/* Only exists on Armada XP and Armada 370 */ + #define MVNETA_SERDES_CFG 0x24A0 + #define MVNETA_SGMII_SERDES_PROTO 0x0cc7 + #define MVNETA_QSGMII_SERDES_PROTO 0x0667 +@@ -3523,26 +3524,55 @@ static int mvneta_setup_txqs(struct mvneta_port *pp) + return 0; + } + +-static int mvneta_comphy_init(struct mvneta_port *pp) ++static int mvneta_comphy_init(struct mvneta_port *pp, phy_interface_t interface) + { + int ret; + +- if (!pp->comphy) +- return 0; +- +- ret = phy_set_mode_ext(pp->comphy, PHY_MODE_ETHERNET, +- pp->phy_interface); ++ ret = phy_set_mode_ext(pp->comphy, PHY_MODE_ETHERNET, interface); + if (ret) + return ret; + + return phy_power_on(pp->comphy); + } + ++static int mvneta_config_interface(struct mvneta_port *pp, ++ phy_interface_t interface) ++{ ++ int ret = 0; ++ ++ if (pp->comphy) { ++ if (interface == PHY_INTERFACE_MODE_SGMII || ++ interface == PHY_INTERFACE_MODE_1000BASEX || ++ interface == PHY_INTERFACE_MODE_2500BASEX) { ++ ret = mvneta_comphy_init(pp, interface); ++ } ++ } else { ++ switch (interface) { ++ case PHY_INTERFACE_MODE_QSGMII: ++ mvreg_write(pp, MVNETA_SERDES_CFG, ++ MVNETA_QSGMII_SERDES_PROTO); ++ break; ++ ++ case PHY_INTERFACE_MODE_SGMII: ++ case PHY_INTERFACE_MODE_1000BASEX: ++ mvreg_write(pp, MVNETA_SERDES_CFG, ++ MVNETA_SGMII_SERDES_PROTO); ++ break; ++ default: ++ return -EINVAL; ++ } ++ } ++ ++ pp->phy_interface = interface; ++ ++ return ret; ++} ++ + static void mvneta_start_dev(struct mvneta_port *pp) + { + int cpu; + +- WARN_ON(mvneta_comphy_init(pp)); ++ WARN_ON(mvneta_config_interface(pp, pp->phy_interface)); + + mvneta_max_rx_size_set(pp, pp->pkt_size); + mvneta_txq_max_tx_size_set(pp, pp->pkt_size); +@@ -3920,14 +3950,10 @@ static void mvneta_mac_config(struct phylink_config *config, unsigned int mode, + if (state->speed == SPEED_2500) + new_ctrl4 |= MVNETA_GMAC4_SHORT_PREAMBLE_ENABLE; + +- if (pp->comphy && pp->phy_interface != state->interface && +- (state->interface == PHY_INTERFACE_MODE_SGMII || +- state->interface == PHY_INTERFACE_MODE_1000BASEX || +- state->interface == PHY_INTERFACE_MODE_2500BASEX)) { +- pp->phy_interface = state->interface; +- +- WARN_ON(phy_power_off(pp->comphy)); +- WARN_ON(mvneta_comphy_init(pp)); ++ if (pp->phy_interface != state->interface) { ++ if (pp->comphy) ++ WARN_ON(phy_power_off(pp->comphy)); ++ WARN_ON(mvneta_config_interface(pp, state->interface)); + } + + if (new_ctrl0 != gmac_ctrl0) +@@ -4971,20 +4997,10 @@ static void mvneta_conf_mbus_windows(struct mvneta_port *pp, + } + + /* Power up the port */ +-static int mvneta_port_power_up(struct mvneta_port *pp, int phy_mode) ++static void mvneta_port_power_up(struct mvneta_port *pp, int phy_mode) + { + /* MAC Cause register should be cleared */ + mvreg_write(pp, MVNETA_UNIT_INTR_CAUSE, 0); +- +- if (phy_mode == PHY_INTERFACE_MODE_QSGMII) +- mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_QSGMII_SERDES_PROTO); +- else if (phy_mode == PHY_INTERFACE_MODE_SGMII || +- phy_interface_mode_is_8023z(phy_mode)) +- mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO); +- else if (!phy_interface_mode_is_rgmii(phy_mode)) +- return -EINVAL; +- +- return 0; + } + + /* Device initialization routine */ +@@ -5170,11 +5186,7 @@ static int mvneta_probe(struct platform_device *pdev) + if (err < 0) + goto err_netdev; + +- err = mvneta_port_power_up(pp, phy_mode); +- if (err < 0) { +- dev_err(&pdev->dev, "can't power up port\n"); +- goto err_netdev; +- } ++ mvneta_port_power_up(pp, phy_mode); + + /* Armada3700 network controller does not support per-cpu + * operation, so only single NAPI should be initialized. +@@ -5328,11 +5340,7 @@ static int mvneta_resume(struct device *device) + } + } + mvneta_defaults_set(pp); +- err = mvneta_port_power_up(pp, pp->phy_interface); +- if (err < 0) { +- dev_err(device, "can't power up port\n"); +- return err; +- } ++ mvneta_port_power_up(pp, pp->phy_interface); + + netif_device_attach(dev); + +-- +2.25.1 + diff --git a/queue-5.7/nfs-fix-memory-leak-of-export_path.patch b/queue-5.7/nfs-fix-memory-leak-of-export_path.patch new file mode 100644 index 00000000000..b628ab5a8a2 --- /dev/null +++ b/queue-5.7/nfs-fix-memory-leak-of-export_path.patch @@ -0,0 +1,41 @@ +From 0ff3626bda78ca9d190e9dff43e48a4b1bb40256 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 12 Jun 2020 15:45:49 -0700 +Subject: nfs: Fix memory leak of export_path + +From: Tom Rix + +[ Upstream commit 4659ed7cc8514369043053463514408ca16ad6f3 ] + +The try_location function is called within a loop by nfs_follow_referral. +try_location calls nfs4_pathname_string to created the export_path. +nfs4_pathname_string allocates the memory. export_path is stored in the +nfs_fs_context/fs_context structure similarly as hostname and source. +But whereas the ctx hostname and source are freed before assignment, +export_path is not. So if there are multiple loops, the new export_path +will overwrite the old without the old being freed. + +So call kfree for export_path. + +Signed-off-by: Tom Rix +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4namespace.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4namespace.c b/fs/nfs/nfs4namespace.c +index a3ab6e219061b..873342308dc0d 100644 +--- a/fs/nfs/nfs4namespace.c ++++ b/fs/nfs/nfs4namespace.c +@@ -308,6 +308,7 @@ static int try_location(struct fs_context *fc, + if (IS_ERR(export_path)) + return PTR_ERR(export_path); + ++ kfree(ctx->nfs_server.export_path); + ctx->nfs_server.export_path = export_path; + + source = kmalloc(len + 1 + ctx->nfs_server.export_path_len + 1, +-- +2.25.1 + diff --git a/queue-5.7/nvme-rdma-assign-completion-vector-correctly.patch b/queue-5.7/nvme-rdma-assign-completion-vector-correctly.patch new file mode 100644 index 00000000000..953a5e4736c --- /dev/null +++ b/queue-5.7/nvme-rdma-assign-completion-vector-correctly.patch @@ -0,0 +1,40 @@ +From 0819da5efb3a8c960b6a8bc76db166e54a686e97 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jun 2020 17:55:25 +0300 +Subject: nvme-rdma: assign completion vector correctly + +From: Max Gurtovoy + +[ Upstream commit 032a9966a22a3596addf81dacf0c1736dfedc32a ] + +The completion vector index that is given during CQ creation can't +exceed the number of support vectors by the underlying RDMA device. This +violation currently can accure, for example, in case one will try to +connect with N regular read/write queues and M poll queues and the sum +of N + M > num_supported_vectors. This will lead to failure in establish +a connection to remote target. Instead, in that case, share a completion +vector between queues. + +Signed-off-by: Max Gurtovoy +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index cac8a930396a0..1f9a45145d0d3 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -443,7 +443,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue) + * Spread I/O queues completion vectors according their queue index. + * Admin queues can always go on completion vector 0. + */ +- comp_vector = idx == 0 ? idx : idx - 1; ++ comp_vector = (idx == 0 ? idx : idx - 1) % ibdev->num_comp_vectors; + + /* Polling queues need direct cq polling context */ + if (nvme_rdma_poll_queue(queue)) +-- +2.25.1 + diff --git a/queue-5.7/perf-x86-rapl-fix-rapl-config-variable-bug.patch b/queue-5.7/perf-x86-rapl-fix-rapl-config-variable-bug.patch new file mode 100644 index 00000000000..18673c2a00d --- /dev/null +++ b/queue-5.7/perf-x86-rapl-fix-rapl-config-variable-bug.patch @@ -0,0 +1,40 @@ +From e43cba66b3a6948a8e2112ba4ad7cd6c8469e5fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 May 2020 13:16:14 -0700 +Subject: perf/x86/rapl: Fix RAPL config variable bug + +From: Stephane Eranian + +[ Upstream commit 16accae3d97f97d7f61c4ee5d0002bccdef59088 ] + +This patch fixes a bug introduced by: + + fd3ae1e1587d6 ("perf/x86/rapl: Move RAPL support to common x86 code") + +The Kconfig variable name was wrong. It was missing the CONFIG_ prefix. + +Signed-off-by: Stephane Eranian +Signed-off-by: Ingo Molnar +Tested-by: Kim Phillips +Acked-by: Peter Zijlstra +Link: https://lore.kernel.org/r/20200528201614.250182-1-eranian@google.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/Makefile b/arch/x86/events/Makefile +index b418ef6878796..726e83c0a31a1 100644 +--- a/arch/x86/events/Makefile ++++ b/arch/x86/events/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0-only + obj-y += core.o probe.o +-obj-$(PERF_EVENTS_INTEL_RAPL) += rapl.o ++obj-$(CONFIG_PERF_EVENTS_INTEL_RAPL) += rapl.o + obj-y += amd/ + obj-$(CONFIG_X86_LOCAL_APIC) += msr.o + obj-$(CONFIG_CPU_SUP_INTEL) += intel/ +-- +2.25.1 + diff --git a/queue-5.7/perf-x86-rapl-move-rapl-support-to-common-x86-code.patch b/queue-5.7/perf-x86-rapl-move-rapl-support-to-common-x86-code.patch new file mode 100644 index 00000000000..f58b0d2f0e2 --- /dev/null +++ b/queue-5.7/perf-x86-rapl-move-rapl-support-to-common-x86-code.patch @@ -0,0 +1,109 @@ +From 353535e51950d9a9ae679cd3606884345c91d92d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 15:46:55 -0700 +Subject: perf/x86/rapl: Move RAPL support to common x86 code + +From: Stephane Eranian + +[ Upstream commit fd3ae1e1587d64ef8cc8e361903d33625458073e ] + +To prepare for support of both Intel and AMD RAPL. + +As per the AMD PPR, Fam17h support Package RAPL counters to monitor power usage. +The RAPL counter operates as with Intel RAPL, and as such it is beneficial +to share the code. + +No change in functionality. + +Signed-off-by: Stephane Eranian +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20200527224659.206129-2-eranian@google.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/Kconfig | 6 +++--- + arch/x86/events/Makefile | 1 + + arch/x86/events/intel/Makefile | 2 -- + arch/x86/events/{intel => }/rapl.c | 9 ++++++--- + 4 files changed, 10 insertions(+), 8 deletions(-) + rename arch/x86/events/{intel => }/rapl.c (98%) + +diff --git a/arch/x86/events/Kconfig b/arch/x86/events/Kconfig +index 9a7a1446cb3a0..4a809c6cbd2f5 100644 +--- a/arch/x86/events/Kconfig ++++ b/arch/x86/events/Kconfig +@@ -10,11 +10,11 @@ config PERF_EVENTS_INTEL_UNCORE + available on NehalemEX and more modern processors. + + config PERF_EVENTS_INTEL_RAPL +- tristate "Intel rapl performance events" +- depends on PERF_EVENTS && CPU_SUP_INTEL && PCI ++ tristate "Intel/AMD rapl performance events" ++ depends on PERF_EVENTS && (CPU_SUP_INTEL || CPU_SUP_AMD) && PCI + default y + ---help--- +- Include support for Intel rapl performance events for power ++ Include support for Intel and AMD rapl performance events for power + monitoring on modern processors. + + config PERF_EVENTS_INTEL_CSTATE +diff --git a/arch/x86/events/Makefile b/arch/x86/events/Makefile +index 9e07f554333fb..b418ef6878796 100644 +--- a/arch/x86/events/Makefile ++++ b/arch/x86/events/Makefile +@@ -1,5 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0-only + obj-y += core.o probe.o ++obj-$(PERF_EVENTS_INTEL_RAPL) += rapl.o + obj-y += amd/ + obj-$(CONFIG_X86_LOCAL_APIC) += msr.o + obj-$(CONFIG_CPU_SUP_INTEL) += intel/ +diff --git a/arch/x86/events/intel/Makefile b/arch/x86/events/intel/Makefile +index 3468b0c1dc7c9..e67a5886336c1 100644 +--- a/arch/x86/events/intel/Makefile ++++ b/arch/x86/events/intel/Makefile +@@ -2,8 +2,6 @@ + obj-$(CONFIG_CPU_SUP_INTEL) += core.o bts.o + obj-$(CONFIG_CPU_SUP_INTEL) += ds.o knc.o + obj-$(CONFIG_CPU_SUP_INTEL) += lbr.o p4.o p6.o pt.o +-obj-$(CONFIG_PERF_EVENTS_INTEL_RAPL) += intel-rapl-perf.o +-intel-rapl-perf-objs := rapl.o + obj-$(CONFIG_PERF_EVENTS_INTEL_UNCORE) += intel-uncore.o + intel-uncore-objs := uncore.o uncore_nhmex.o uncore_snb.o uncore_snbep.o + obj-$(CONFIG_PERF_EVENTS_INTEL_CSTATE) += intel-cstate.o +diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/rapl.c +similarity index 98% +rename from arch/x86/events/intel/rapl.c +rename to arch/x86/events/rapl.c +index a5dbd25852cb7..ece043fb7b494 100644 +--- a/arch/x86/events/intel/rapl.c ++++ b/arch/x86/events/rapl.c +@@ -1,11 +1,14 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Support Intel RAPL energy consumption counters ++ * Support Intel/AMD RAPL energy consumption counters + * Copyright (C) 2013 Google, Inc., Stephane Eranian + * + * Intel RAPL interface is specified in the IA-32 Manual Vol3b + * section 14.7.1 (September 2013) + * ++ * AMD RAPL interface for Fam17h is described in the public PPR: ++ * https://bugzilla.kernel.org/show_bug.cgi?id=206537 ++ * + * RAPL provides more controls than just reporting energy consumption + * however here we only expose the 3 energy consumption free running + * counters (pp0, pkg, dram). +@@ -58,8 +61,8 @@ + #include + #include + #include +-#include "../perf_event.h" +-#include "../probe.h" ++#include "perf_event.h" ++#include "probe.h" + + MODULE_LICENSE("GPL"); + +-- +2.25.1 + diff --git a/queue-5.7/powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch b/queue-5.7/powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch new file mode 100644 index 00000000000..368dc6d8225 --- /dev/null +++ b/queue-5.7/powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch @@ -0,0 +1,71 @@ +From eed83aaf8b34dbe4d943840ca9c08a492df8c537 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jun 2020 17:31:59 +0530 +Subject: powerpc/kvm/book3s64: Fix kernel crash with nested kvm & + DEBUG_VIRTUAL + +From: Aneesh Kumar K.V + +[ Upstream commit c1ed1754f271f6b7acb1bfdc8cfb62220fbed423 ] + +With CONFIG_DEBUG_VIRTUAL=y, __pa() checks for addr value and if it's +less than PAGE_OFFSET it leads to a BUG(). + + #define __pa(x) + ({ + VIRTUAL_BUG_ON((unsigned long)(x) < PAGE_OFFSET); + (unsigned long)(x) & 0x0fffffffffffffffUL; + }) + + kernel BUG at arch/powerpc/kvm/book3s_64_mmu_radix.c:43! + cpu 0x70: Vector: 700 (Program Check) at [c0000018a2187360] + pc: c000000000161b30: __kvmhv_copy_tofrom_guest_radix+0x130/0x1f0 + lr: c000000000161d5c: kvmhv_copy_from_guest_radix+0x3c/0x80 + ... + kvmhv_copy_from_guest_radix+0x3c/0x80 + kvmhv_load_from_eaddr+0x48/0xc0 + kvmppc_ld+0x98/0x1e0 + kvmppc_load_last_inst+0x50/0x90 + kvmppc_hv_emulate_mmio+0x288/0x2b0 + kvmppc_book3s_radix_page_fault+0xd8/0x2b0 + kvmppc_book3s_hv_page_fault+0x37c/0x1050 + kvmppc_vcpu_run_hv+0xbb8/0x1080 + kvmppc_vcpu_run+0x34/0x50 + kvm_arch_vcpu_ioctl_run+0x2fc/0x410 + kvm_vcpu_ioctl+0x2b4/0x8f0 + ksys_ioctl+0xf4/0x150 + sys_ioctl+0x28/0x80 + system_call_exception+0x104/0x1d0 + system_call_common+0xe8/0x214 + +kvmhv_copy_tofrom_guest_radix() uses a NULL value for to/from to +indicate direction of copy. + +Avoid calling __pa() if the value is NULL to avoid the BUG(). + +Signed-off-by: Aneesh Kumar K.V +[mpe: Massage change log a bit to mention CONFIG_DEBUG_VIRTUAL] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200611120159.680284-1-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_64_mmu_radix.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c +index d4e532a63f08e..2f27faf24b2cb 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c +@@ -40,7 +40,8 @@ unsigned long __kvmhv_copy_tofrom_guest_radix(int lpid, int pid, + /* Can't access quadrants 1 or 2 in non-HV mode, call the HV to do it */ + if (kvmhv_on_pseries()) + return plpar_hcall_norets(H_COPY_TOFROM_GUEST, lpid, pid, eaddr, +- __pa(to), __pa(from), n); ++ (to != NULL) ? __pa(to): 0, ++ (from != NULL) ? __pa(from): 0, n); + + quadrant = 1; + if (!pid) +-- +2.25.1 + diff --git a/queue-5.7/regmap-fix-alignment-issue.patch b/queue-5.7/regmap-fix-alignment-issue.patch new file mode 100644 index 00000000000..8c421cdd39c --- /dev/null +++ b/queue-5.7/regmap-fix-alignment-issue.patch @@ -0,0 +1,258 @@ +From ae855cece48015642a094766ab90664a7578d8a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 May 2020 11:53:00 +0200 +Subject: regmap: fix alignment issue + +From: Jens Thoms Toerring + +[ Upstream commit 53d860952c8215cf9ae1ea33409c8cb71ad6ad3d ] + +The assembly and disassembly of data to be sent to or received from +a device invoke functions regmap_format_XX() and regmap_parse_XX() +that extract or insert data items from or into a buffer, using +assignments. In some cases the functions are called with a buffer +pointer with an odd address. On architectures with strict alignment +requirements this can result in a kernel crash. The assignments +have been replaced by functions that take alignment into account. + +Signed-off-by: Jens Thoms Toerring +Link: https://lore.kernel.org/r/20200531095300.GA27570@toerring.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 100 ++++++++++++++++------------------- + 1 file changed, 46 insertions(+), 54 deletions(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 508bbd6ea4396..320d23de02c29 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #define CREATE_TRACE_POINTS + #include "trace.h" +@@ -249,22 +250,20 @@ static void regmap_format_8(void *buf, unsigned int val, unsigned int shift) + + static void regmap_format_16_be(void *buf, unsigned int val, unsigned int shift) + { +- __be16 *b = buf; +- +- b[0] = cpu_to_be16(val << shift); ++ put_unaligned_be16(val << shift, buf); + } + + static void regmap_format_16_le(void *buf, unsigned int val, unsigned int shift) + { +- __le16 *b = buf; +- +- b[0] = cpu_to_le16(val << shift); ++ put_unaligned_le16(val << shift, buf); + } + + static void regmap_format_16_native(void *buf, unsigned int val, + unsigned int shift) + { +- *(u16 *)buf = val << shift; ++ u16 v = val << shift; ++ ++ memcpy(buf, &v, sizeof(v)); + } + + static void regmap_format_24(void *buf, unsigned int val, unsigned int shift) +@@ -280,43 +279,39 @@ static void regmap_format_24(void *buf, unsigned int val, unsigned int shift) + + static void regmap_format_32_be(void *buf, unsigned int val, unsigned int shift) + { +- __be32 *b = buf; +- +- b[0] = cpu_to_be32(val << shift); ++ put_unaligned_be32(val << shift, buf); + } + + static void regmap_format_32_le(void *buf, unsigned int val, unsigned int shift) + { +- __le32 *b = buf; +- +- b[0] = cpu_to_le32(val << shift); ++ put_unaligned_le32(val << shift, buf); + } + + static void regmap_format_32_native(void *buf, unsigned int val, + unsigned int shift) + { +- *(u32 *)buf = val << shift; ++ u32 v = val << shift; ++ ++ memcpy(buf, &v, sizeof(v)); + } + + #ifdef CONFIG_64BIT + static void regmap_format_64_be(void *buf, unsigned int val, unsigned int shift) + { +- __be64 *b = buf; +- +- b[0] = cpu_to_be64((u64)val << shift); ++ put_unaligned_be64((u64) val << shift, buf); + } + + static void regmap_format_64_le(void *buf, unsigned int val, unsigned int shift) + { +- __le64 *b = buf; +- +- b[0] = cpu_to_le64((u64)val << shift); ++ put_unaligned_le64((u64) val << shift, buf); + } + + static void regmap_format_64_native(void *buf, unsigned int val, + unsigned int shift) + { +- *(u64 *)buf = (u64)val << shift; ++ u64 v = (u64) val << shift; ++ ++ memcpy(buf, &v, sizeof(v)); + } + #endif + +@@ -333,35 +328,34 @@ static unsigned int regmap_parse_8(const void *buf) + + static unsigned int regmap_parse_16_be(const void *buf) + { +- const __be16 *b = buf; +- +- return be16_to_cpu(b[0]); ++ return get_unaligned_be16(buf); + } + + static unsigned int regmap_parse_16_le(const void *buf) + { +- const __le16 *b = buf; +- +- return le16_to_cpu(b[0]); ++ return get_unaligned_le16(buf); + } + + static void regmap_parse_16_be_inplace(void *buf) + { +- __be16 *b = buf; ++ u16 v = get_unaligned_be16(buf); + +- b[0] = be16_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static void regmap_parse_16_le_inplace(void *buf) + { +- __le16 *b = buf; ++ u16 v = get_unaligned_le16(buf); + +- b[0] = le16_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static unsigned int regmap_parse_16_native(const void *buf) + { +- return *(u16 *)buf; ++ u16 v; ++ ++ memcpy(&v, buf, sizeof(v)); ++ return v; + } + + static unsigned int regmap_parse_24(const void *buf) +@@ -376,69 +370,67 @@ static unsigned int regmap_parse_24(const void *buf) + + static unsigned int regmap_parse_32_be(const void *buf) + { +- const __be32 *b = buf; +- +- return be32_to_cpu(b[0]); ++ return get_unaligned_be32(buf); + } + + static unsigned int regmap_parse_32_le(const void *buf) + { +- const __le32 *b = buf; +- +- return le32_to_cpu(b[0]); ++ return get_unaligned_le32(buf); + } + + static void regmap_parse_32_be_inplace(void *buf) + { +- __be32 *b = buf; ++ u32 v = get_unaligned_be32(buf); + +- b[0] = be32_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static void regmap_parse_32_le_inplace(void *buf) + { +- __le32 *b = buf; ++ u32 v = get_unaligned_le32(buf); + +- b[0] = le32_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static unsigned int regmap_parse_32_native(const void *buf) + { +- return *(u32 *)buf; ++ u32 v; ++ ++ memcpy(&v, buf, sizeof(v)); ++ return v; + } + + #ifdef CONFIG_64BIT + static unsigned int regmap_parse_64_be(const void *buf) + { +- const __be64 *b = buf; +- +- return be64_to_cpu(b[0]); ++ return get_unaligned_be64(buf); + } + + static unsigned int regmap_parse_64_le(const void *buf) + { +- const __le64 *b = buf; +- +- return le64_to_cpu(b[0]); ++ return get_unaligned_le64(buf); + } + + static void regmap_parse_64_be_inplace(void *buf) + { +- __be64 *b = buf; ++ u64 v = get_unaligned_be64(buf); + +- b[0] = be64_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static void regmap_parse_64_le_inplace(void *buf) + { +- __le64 *b = buf; ++ u64 v = get_unaligned_le64(buf); + +- b[0] = le64_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static unsigned int regmap_parse_64_native(const void *buf) + { +- return *(u64 *)buf; ++ u64 v; ++ ++ memcpy(&v, buf, sizeof(v)); ++ return v; + } + #endif + +-- +2.25.1 + diff --git a/queue-5.7/s390-kasan-fix-early-pgm-check-handler-execution.patch b/queue-5.7/s390-kasan-fix-early-pgm-check-handler-execution.patch new file mode 100644 index 00000000000..ae5feb2f65c --- /dev/null +++ b/queue-5.7/s390-kasan-fix-early-pgm-check-handler-execution.patch @@ -0,0 +1,42 @@ +From 00fd5028e7db12c6537070d7db39f4b13de526f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 15:05:49 +0200 +Subject: s390/kasan: fix early pgm check handler execution + +From: Vasily Gorbik + +[ Upstream commit 998f5bbe3dbdab81c1cfb1aef7c3892f5d24f6c7 ] + +Currently if early_pgm_check_handler is called it ends up in pgm check +loop. The problem is that early_pgm_check_handler is instrumented by +KASAN but executed without DAT flag enabled which leads to addressing +exception when KASAN checks try to access shadow memory. + +Fix that by executing early handlers with DAT flag on under KASAN as +expected. + +Reported-and-tested-by: Alexander Egorenkov +Reviewed-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/early.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c +index cd241ee66eff4..0782772318580 100644 +--- a/arch/s390/kernel/early.c ++++ b/arch/s390/kernel/early.c +@@ -170,6 +170,8 @@ static noinline __init void setup_lowcore_early(void) + psw_t psw; + + psw.mask = PSW_MASK_BASE | PSW_DEFAULT_KEY | PSW_MASK_EA | PSW_MASK_BA; ++ if (IS_ENABLED(CONFIG_KASAN)) ++ psw.mask |= PSW_MASK_DAT; + psw.addr = (unsigned long) s390_base_ext_handler; + S390_lowcore.external_new_psw = psw; + psw.addr = (unsigned long) s390_base_pgm_handler; +-- +2.25.1 + diff --git a/queue-5.7/sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch b/queue-5.7/sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch new file mode 100644 index 00000000000..e5793675c44 --- /dev/null +++ b/queue-5.7/sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch @@ -0,0 +1,43 @@ +From 0a249c0d13583c70eaad763721c5365375a59b6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 14:17:42 +0200 +Subject: sched/core: Check cpus_mask, not cpus_ptr in + __set_cpus_allowed_ptr(), to fix mask corruption + +From: Scott Wood + +[ Upstream commit fd844ba9ae59b51e34e77105d79f8eca780b3bd6 ] + +This function is concerned with the long-term CPU mask, not the +transitory mask the task might have while migrate disabled. Before +this patch, if a task was migrate-disabled at the time +__set_cpus_allowed_ptr() was called, and the new mask happened to be +equal to the CPU that the task was running on, then the mask update +would be lost. + +Signed-off-by: Scott Wood +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Link: https://lkml.kernel.org/r/20200617121742.cpxppyi7twxmpin7@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index f2618ade80479..8034434b10400 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1637,7 +1637,7 @@ static int __set_cpus_allowed_ptr(struct task_struct *p, + goto out; + } + +- if (cpumask_equal(p->cpus_ptr, new_mask)) ++ if (cpumask_equal(&p->cpus_mask, new_mask)) + goto out; + + /* +-- +2.25.1 + diff --git a/queue-5.7/scsi-mptscsih-fix-read-sense-data-size.patch b/queue-5.7/scsi-mptscsih-fix-read-sense-data-size.patch new file mode 100644 index 00000000000..a9d2be31e25 --- /dev/null +++ b/queue-5.7/scsi-mptscsih-fix-read-sense-data-size.patch @@ -0,0 +1,50 @@ +From 202155da0b565826488459184ee83c50caddb3ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 17:04:46 +0200 +Subject: scsi: mptscsih: Fix read sense data size + +From: Tomas Henzl + +[ Upstream commit afe89f115e84edbc76d316759e206580a06c6973 ] + +The sense data buffer in sense_buf_pool is allocated with size of +MPT_SENSE_BUFFER_ALLOC(64) (multiplied by req_depth) while SNS_LEN(sc)(96) +is used when reading the data. That may lead to a read from unallocated +area, sometimes from another (unallocated) page. To fix this, limit the +read size to MPT_SENSE_BUFFER_ALLOC. + +Link: https://lore.kernel.org/r/20200616150446.4840-1-thenzl@redhat.com +Co-developed-by: Stanislav Saner +Signed-off-by: Stanislav Saner +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/message/fusion/mptscsih.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c +index f0737c57ed5fc..1491561d2e5c9 100644 +--- a/drivers/message/fusion/mptscsih.c ++++ b/drivers/message/fusion/mptscsih.c +@@ -118,8 +118,6 @@ int mptscsih_suspend(struct pci_dev *pdev, pm_message_t state); + int mptscsih_resume(struct pci_dev *pdev); + #endif + +-#define SNS_LEN(scp) SCSI_SENSE_BUFFERSIZE +- + + /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/ + /* +@@ -2422,7 +2420,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR + /* Copy the sense received into the scsi command block. */ + req_index = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx); + sense_data = ((u8 *)ioc->sense_buf_pool + (req_index * MPT_SENSE_BUFFER_ALLOC)); +- memcpy(sc->sense_buffer, sense_data, SNS_LEN(sc)); ++ memcpy(sc->sense_buffer, sense_data, MPT_SENSE_BUFFER_ALLOC); + + /* Log SMART data (asc = 0x5D, non-IM case only) if required. + */ +-- +2.25.1 + diff --git a/queue-5.7/scsi-qla2xxx-fix-mpi-failure-aen-8200-handling.patch b/queue-5.7/scsi-qla2xxx-fix-mpi-failure-aen-8200-handling.patch new file mode 100644 index 00000000000..173265e07e5 --- /dev/null +++ b/queue-5.7/scsi-qla2xxx-fix-mpi-failure-aen-8200-handling.patch @@ -0,0 +1,477 @@ +From 093ad2733e5bfb2e0dace389d67d7705151083f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 31 Mar 2020 03:40:13 -0700 +Subject: scsi: qla2xxx: Fix MPI failure AEN (8200) handling + +From: Arun Easi + +[ Upstream commit cbb01c2f2f630f1497f703c51ff21538ae2d86b8 ] + +Today, upon an MPI failure AEN, on top of collecting an MPI dump, a regular +firmware dump is also taken and then chip reset. This is disruptive to IOs +and not required. Make the firmware dump collection, followed by chip +reset, optional (not done by default). + +Firmware dump buffer and MPI dump buffer are independent of each +other with this change and each can have dump that was taken at two +different times for two different issues. The MPI dump is saved in a +separate buffer and is retrieved differently from firmware dump. + +To collect full dump on MPI failure AEN, a module parameter is +introduced: + ql2xfulldump_on_mpifail (default: 0) + +Link: https://lore.kernel.org/r/20200331104015.24868-2-njavali@marvell.com +Reported-by: kbuild test robot +Reviewed-by: Himanshu Madhani +Signed-off-by: Arun Easi +Signed-off-by: Nilesh Javali +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla2xxx/qla_attr.c | 30 +++++++- + drivers/scsi/qla2xxx/qla_def.h | 13 +++- + drivers/scsi/qla2xxx/qla_gbl.h | 3 + + drivers/scsi/qla2xxx/qla_init.c | 2 + + drivers/scsi/qla2xxx/qla_isr.c | 54 +++++++++----- + drivers/scsi/qla2xxx/qla_os.c | 6 ++ + drivers/scsi/qla2xxx/qla_tmpl.c | 121 ++++++++++++++++++++++++++------ + 7 files changed, 186 insertions(+), 43 deletions(-) + +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 2c9e5ac24692d..c4917f441b10a 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -26,7 +26,8 @@ qla2x00_sysfs_read_fw_dump(struct file *filp, struct kobject *kobj, + struct qla_hw_data *ha = vha->hw; + int rval = 0; + +- if (!(ha->fw_dump_reading || ha->mctp_dump_reading)) ++ if (!(ha->fw_dump_reading || ha->mctp_dump_reading || ++ ha->mpi_fw_dump_reading)) + return 0; + + mutex_lock(&ha->optrom_mutex); +@@ -42,6 +43,10 @@ qla2x00_sysfs_read_fw_dump(struct file *filp, struct kobject *kobj, + } else if (ha->mctp_dumped && ha->mctp_dump_reading) { + rval = memory_read_from_buffer(buf, count, &off, ha->mctp_dump, + MCTP_DUMP_SIZE); ++ } else if (ha->mpi_fw_dumped && ha->mpi_fw_dump_reading) { ++ rval = memory_read_from_buffer(buf, count, &off, ++ ha->mpi_fw_dump, ++ ha->mpi_fw_dump_len); + } else if (ha->fw_dump_reading) { + rval = memory_read_from_buffer(buf, count, &off, ha->fw_dump, + ha->fw_dump_len); +@@ -103,7 +108,6 @@ qla2x00_sysfs_write_fw_dump(struct file *filp, struct kobject *kobj, + qla82xx_set_reset_owner(vha); + qla8044_idc_unlock(ha); + } else { +- ha->fw_dump_mpi = 1; + qla2x00_system_error(vha); + } + break; +@@ -137,6 +141,22 @@ qla2x00_sysfs_write_fw_dump(struct file *filp, struct kobject *kobj, + vha->host_no); + } + break; ++ case 8: ++ if (!ha->mpi_fw_dump_reading) ++ break; ++ ql_log(ql_log_info, vha, 0x70e7, ++ "MPI firmware dump cleared on (%ld).\n", vha->host_no); ++ ha->mpi_fw_dump_reading = 0; ++ ha->mpi_fw_dumped = 0; ++ break; ++ case 9: ++ if (ha->mpi_fw_dumped && !ha->mpi_fw_dump_reading) { ++ ha->mpi_fw_dump_reading = 1; ++ ql_log(ql_log_info, vha, 0x70e8, ++ "Raw MPI firmware dump ready for read on (%ld).\n", ++ vha->host_no); ++ } ++ break; + } + return count; + } +@@ -706,7 +726,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj, + scsi_unblock_requests(vha->host); + break; + case 0x2025d: +- if (!IS_QLA81XX(ha) && !IS_QLA83XX(ha)) ++ if (!IS_QLA81XX(ha) && !IS_QLA83XX(ha) && ++ !IS_QLA27XX(ha) && !IS_QLA28XX(ha)) + return -EPERM; + + ql_log(ql_log_info, vha, 0x706f, +@@ -724,6 +745,8 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj, + qla83xx_idc_audit(vha, IDC_AUDIT_TIMESTAMP); + qla83xx_idc_unlock(vha, 0); + break; ++ } else if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) { ++ qla27xx_reset_mpi(vha); + } else { + /* Make sure FC side is not in reset */ + WARN_ON_ONCE(qla2x00_wait_for_hba_online(vha) != +@@ -737,6 +760,7 @@ qla2x00_sysfs_write_reset(struct file *filp, struct kobject *kobj, + scsi_unblock_requests(vha->host); + break; + } ++ break; + case 0x2025e: + if (!IS_P3P_TYPE(ha) || vha != base_vha) { + ql_log(ql_log_info, vha, 0x7071, +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index 47c7a56438b54..daa9e936887bb 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -3223,6 +3223,7 @@ struct isp_operations { + uint32_t); + + void (*fw_dump) (struct scsi_qla_host *, int); ++ void (*mpi_fw_dump)(struct scsi_qla_host *, int); + + int (*beacon_on) (struct scsi_qla_host *); + int (*beacon_off) (struct scsi_qla_host *); +@@ -3748,6 +3749,11 @@ struct qlt_hw_data { + + #define LEAK_EXCHG_THRESH_HOLD_PERCENT 75 /* 75 percent */ + ++struct qla_hw_data_stat { ++ u32 num_fw_dump; ++ u32 num_mpi_reset; ++}; ++ + /* + * Qlogic host adapter specific data structure. + */ +@@ -4230,7 +4236,6 @@ struct qla_hw_data { + uint32_t fw_dump_len; + u32 fw_dump_alloc_len; + bool fw_dumped; +- bool fw_dump_mpi; + unsigned long fw_dump_cap_flags; + #define RISC_PAUSE_CMPL 0 + #define DMA_SHUTDOWN_CMPL 1 +@@ -4241,6 +4246,10 @@ struct qla_hw_data { + #define ISP_MBX_RDY 6 + #define ISP_SOFT_RESET_CMPL 7 + int fw_dump_reading; ++ void *mpi_fw_dump; ++ u32 mpi_fw_dump_len; ++ int mpi_fw_dump_reading:1; ++ int mpi_fw_dumped:1; + int prev_minidump_failed; + dma_addr_t eft_dma; + void *eft; +@@ -4454,6 +4463,8 @@ struct qla_hw_data { + uint16_t last_zio_threshold; + + #define DEFAULT_ZIO_THRESHOLD 5 ++ ++ struct qla_hw_data_stat stat; + }; + + struct active_regions { +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index 1b93f5b4d77d9..b20c5fa122fb2 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -173,6 +173,7 @@ extern int ql2xenablemsix; + extern int qla2xuseresexchforels; + extern int ql2xexlogins; + extern int ql2xdifbundlinginternalbuffers; ++extern int ql2xfulldump_on_mpifail; + + extern int qla2x00_loop_reset(scsi_qla_host_t *); + extern void qla2x00_abort_all_cmds(scsi_qla_host_t *, int); +@@ -645,6 +646,7 @@ extern void qla82xx_fw_dump(scsi_qla_host_t *, int); + extern void qla8044_fw_dump(scsi_qla_host_t *, int); + + extern void qla27xx_fwdump(scsi_qla_host_t *, int); ++extern void qla27xx_mpi_fwdump(scsi_qla_host_t *, int); + extern ulong qla27xx_fwdt_calculate_dump_size(struct scsi_qla_host *, void *); + extern int qla27xx_fwdt_template_valid(void *); + extern ulong qla27xx_fwdt_template_size(void *); +@@ -933,5 +935,6 @@ extern void qla24xx_process_purex_list(struct purex_list *); + + /* nvme.c */ + void qla_nvme_unregister_remote_port(struct fc_port *fcport); ++void qla27xx_reset_mpi(scsi_qla_host_t *vha); + void qla_handle_els_plogi_done(scsi_qla_host_t *vha, struct event_arg *ea); + #endif /* _QLA_GBL_H */ +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index cfbb4294fb8bb..53686246f5664 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -3339,6 +3339,8 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) + dump_size / 1024); + + if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) { ++ ha->mpi_fw_dump = (char *)fw_dump + ++ ha->fwdt[1].dump_size; + mutex_unlock(&ha->optrom_mutex); + return; + } +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 8a78d395bbc8f..4d9ec7ee59cc7 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -756,6 +756,39 @@ qla2x00_find_fcport_by_nportid(scsi_qla_host_t *vha, port_id_t *id, + return NULL; + } + ++/* Shall be called only on supported adapters. */ ++static void ++qla27xx_handle_8200_aen(scsi_qla_host_t *vha, uint16_t *mb) ++{ ++ struct qla_hw_data *ha = vha->hw; ++ bool reset_isp_needed = 0; ++ ++ ql_log(ql_log_warn, vha, 0x02f0, ++ "MPI Heartbeat stop. MPI reset is%s needed. " ++ "MB0[%xh] MB1[%xh] MB2[%xh] MB3[%xh]\n", ++ mb[0] & BIT_8 ? "" : " not", ++ mb[0], mb[1], mb[2], mb[3]); ++ ++ if ((mb[1] & BIT_8) == 0) ++ return; ++ ++ ql_log(ql_log_warn, vha, 0x02f1, ++ "MPI Heartbeat stop. FW dump needed\n"); ++ ++ if (ql2xfulldump_on_mpifail) { ++ ha->isp_ops->fw_dump(vha, 1); ++ reset_isp_needed = 1; ++ } ++ ++ ha->isp_ops->mpi_fw_dump(vha, 1); ++ ++ if (reset_isp_needed) { ++ vha->hw->flags.fw_init_done = 0; ++ set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags); ++ qla2xxx_wake_dpc(vha); ++ } ++} ++ + /** + * qla2x00_async_event() - Process aynchronous events. + * @vha: SCSI driver HA context +@@ -871,9 +904,9 @@ skip_rio: + "ISP System Error - mbx1=%xh mbx2=%xh mbx3=%xh.\n ", + mb[1], mb[2], mb[3]); + +- ha->fw_dump_mpi = +- (IS_QLA27XX(ha) || IS_QLA28XX(ha)) && +- RD_REG_WORD(®24->mailbox7) & BIT_8; ++ if ((IS_QLA27XX(ha) || IS_QLA28XX(ha)) && ++ RD_REG_WORD(®24->mailbox7) & BIT_8) ++ ha->isp_ops->mpi_fw_dump(vha, 1); + ha->isp_ops->fw_dump(vha, 1); + ha->flags.fw_init_done = 0; + QLA_FW_STOPPED(ha); +@@ -1374,20 +1407,7 @@ global_port_update: + + case MBA_IDC_AEN: + if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) { +- ha->flags.fw_init_done = 0; +- ql_log(ql_log_warn, vha, 0xffff, +- "MPI Heartbeat stop. Chip reset needed. MB0[%xh] MB1[%xh] MB2[%xh] MB3[%xh]\n", +- mb[0], mb[1], mb[2], mb[3]); +- +- if ((mb[1] & BIT_8) || +- (mb[2] & BIT_8)) { +- ql_log(ql_log_warn, vha, 0xd013, +- "MPI Heartbeat stop. FW dump needed\n"); +- ha->fw_dump_mpi = 1; +- ha->isp_ops->fw_dump(vha, 1); +- } +- set_bit(ISP_ABORT_NEEDED, &vha->dpc_flags); +- qla2xxx_wake_dpc(vha); ++ qla27xx_handle_8200_aen(vha, mb); + } else if (IS_QLA83XX(ha)) { + mb[4] = RD_REG_WORD(®24->mailbox4); + mb[5] = RD_REG_WORD(®24->mailbox5); +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 9179bb4caed84..1120d133204c2 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -35,6 +35,11 @@ static int apidev_major; + */ + struct kmem_cache *srb_cachep; + ++int ql2xfulldump_on_mpifail; ++module_param(ql2xfulldump_on_mpifail, int, S_IRUGO | S_IWUSR); ++MODULE_PARM_DESC(ql2xfulldump_on_mpifail, ++ "Set this to take full dump on MPI hang."); ++ + /* + * CT6 CTX allocation cache + */ +@@ -2518,6 +2523,7 @@ static struct isp_operations qla27xx_isp_ops = { + .read_nvram = NULL, + .write_nvram = NULL, + .fw_dump = qla27xx_fwdump, ++ .mpi_fw_dump = qla27xx_mpi_fwdump, + .beacon_on = qla24xx_beacon_on, + .beacon_off = qla24xx_beacon_off, + .beacon_blink = qla83xx_beacon_blink, +diff --git a/drivers/scsi/qla2xxx/qla_tmpl.c b/drivers/scsi/qla2xxx/qla_tmpl.c +index 6aeb1c3fb7a87..3423638624344 100644 +--- a/drivers/scsi/qla2xxx/qla_tmpl.c ++++ b/drivers/scsi/qla2xxx/qla_tmpl.c +@@ -12,6 +12,33 @@ + #define IOBASE(vha) IOBAR(ISPREG(vha)) + #define INVALID_ENTRY ((struct qla27xx_fwdt_entry *)0xffffffffffffffffUL) + ++/* hardware_lock assumed held. */ ++static void ++qla27xx_write_remote_reg(struct scsi_qla_host *vha, ++ u32 addr, u32 data) ++{ ++ char *reg = (char *)ISPREG(vha); ++ ++ ql_dbg(ql_dbg_misc, vha, 0xd300, ++ "%s: addr/data = %xh/%xh\n", __func__, addr, data); ++ ++ WRT_REG_DWORD(reg + IOBASE(vha), 0x40); ++ WRT_REG_DWORD(reg + 0xc4, data); ++ WRT_REG_DWORD(reg + 0xc0, addr); ++} ++ ++void ++qla27xx_reset_mpi(scsi_qla_host_t *vha) ++{ ++ ql_dbg(ql_dbg_misc + ql_dbg_verbose, vha, 0xd301, ++ "Entered %s.\n", __func__); ++ ++ qla27xx_write_remote_reg(vha, 0x104050, 0x40004); ++ qla27xx_write_remote_reg(vha, 0x10405c, 0x4); ++ ++ vha->hw->stat.num_mpi_reset++; ++} ++ + static inline void + qla27xx_insert16(uint16_t value, void *buf, ulong *len) + { +@@ -997,6 +1024,62 @@ qla27xx_fwdt_template_valid(void *p) + return true; + } + ++void ++qla27xx_mpi_fwdump(scsi_qla_host_t *vha, int hardware_locked) ++{ ++ ulong flags = 0; ++ bool need_mpi_reset = 1; ++ ++#ifndef __CHECKER__ ++ if (!hardware_locked) ++ spin_lock_irqsave(&vha->hw->hardware_lock, flags); ++#endif ++ if (!vha->hw->mpi_fw_dump) { ++ ql_log(ql_log_warn, vha, 0x02f3, "-> mpi_fwdump no buffer\n"); ++ } else if (vha->hw->mpi_fw_dumped) { ++ ql_log(ql_log_warn, vha, 0x02f4, ++ "-> MPI firmware already dumped (%p) -- ignoring request\n", ++ vha->hw->mpi_fw_dump); ++ } else { ++ struct fwdt *fwdt = &vha->hw->fwdt[1]; ++ ulong len; ++ void *buf = vha->hw->mpi_fw_dump; ++ ++ ql_log(ql_log_warn, vha, 0x02f5, "-> fwdt1 running...\n"); ++ if (!fwdt->template) { ++ ql_log(ql_log_warn, vha, 0x02f6, ++ "-> fwdt1 no template\n"); ++ goto bailout; ++ } ++ len = qla27xx_execute_fwdt_template(vha, fwdt->template, buf); ++ if (len == 0) { ++ goto bailout; ++ } else if (len != fwdt->dump_size) { ++ ql_log(ql_log_warn, vha, 0x02f7, ++ "-> fwdt1 fwdump residual=%+ld\n", ++ fwdt->dump_size - len); ++ } else { ++ need_mpi_reset = 0; ++ } ++ ++ vha->hw->mpi_fw_dump_len = len; ++ vha->hw->mpi_fw_dumped = 1; ++ ++ ql_log(ql_log_warn, vha, 0x02f8, ++ "-> MPI firmware dump saved to buffer (%lu/%p)\n", ++ vha->host_no, vha->hw->mpi_fw_dump); ++ qla2x00_post_uevent_work(vha, QLA_UEVENT_CODE_FW_DUMP); ++ } ++ ++bailout: ++ if (need_mpi_reset) ++ qla27xx_reset_mpi(vha); ++#ifndef __CHECKER__ ++ if (!hardware_locked) ++ spin_unlock_irqrestore(&vha->hw->hardware_lock, flags); ++#endif ++} ++ + void + qla27xx_fwdump(scsi_qla_host_t *vha, int hardware_locked) + { +@@ -1015,30 +1098,25 @@ qla27xx_fwdump(scsi_qla_host_t *vha, int hardware_locked) + vha->hw->fw_dump); + } else { + struct fwdt *fwdt = vha->hw->fwdt; +- uint j; + ulong len; + void *buf = vha->hw->fw_dump; +- uint count = vha->hw->fw_dump_mpi ? 2 : 1; +- +- for (j = 0; j < count; j++, fwdt++, buf += len) { +- ql_log(ql_log_warn, vha, 0xd011, +- "-> fwdt%u running...\n", j); +- if (!fwdt->template) { +- ql_log(ql_log_warn, vha, 0xd012, +- "-> fwdt%u no template\n", j); +- break; +- } +- len = qla27xx_execute_fwdt_template(vha, +- fwdt->template, buf); +- if (len == 0) { +- goto bailout; +- } else if (len != fwdt->dump_size) { +- ql_log(ql_log_warn, vha, 0xd013, +- "-> fwdt%u fwdump residual=%+ld\n", +- j, fwdt->dump_size - len); +- } ++ ++ ql_log(ql_log_warn, vha, 0xd011, "-> fwdt0 running...\n"); ++ if (!fwdt->template) { ++ ql_log(ql_log_warn, vha, 0xd012, ++ "-> fwdt0 no template\n"); ++ goto bailout; + } +- vha->hw->fw_dump_len = buf - (void *)vha->hw->fw_dump; ++ len = qla27xx_execute_fwdt_template(vha, fwdt->template, buf); ++ if (len == 0) { ++ goto bailout; ++ } else if (len != fwdt->dump_size) { ++ ql_log(ql_log_warn, vha, 0xd013, ++ "-> fwdt0 fwdump residual=%+ld\n", ++ fwdt->dump_size - len); ++ } ++ ++ vha->hw->fw_dump_len = len; + vha->hw->fw_dumped = 1; + + ql_log(ql_log_warn, vha, 0xd015, +@@ -1048,7 +1126,6 @@ qla27xx_fwdump(scsi_qla_host_t *vha, int hardware_locked) + } + + bailout: +- vha->hw->fw_dump_mpi = 0; + #ifndef __CHECKER__ + if (!hardware_locked) + spin_unlock_irqrestore(&vha->hw->hardware_lock, flags); +-- +2.25.1 + diff --git a/queue-5.7/series b/queue-5.7/series index f25facc5904..424b5cd876c 100644 --- a/queue-5.7/series +++ b/queue-5.7/series @@ -1,3 +1,44 @@ kvm-s390-reduce-number-of-io-pins-to-1.patch spi-spi-fsl-dspi-adding-shutdown-hook.patch spi-spi-fsl-dspi-fix-lockup-if-device-is-removed-dur.patch +regmap-fix-alignment-issue.patch +perf-x86-rapl-move-rapl-support-to-common-x86-code.patch +perf-x86-rapl-fix-rapl-config-variable-bug.patch +arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch +drm-ttm-fix-dma_fence-refcnt-leak-in-ttm_bo_vm_fault.patch +drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch +gpu-host1x-clean-up-debugfs-in-error-handling-path.patch +drm-tegra-hub-do-not-enable-orphaned-window-group.patch +gpu-host1x-detach-driver-on-unregister.patch +staging-wfx-fix-coherency-of-hif_scan-prototype.patch +drm-mcde-fix-display-initialization-problem.patch +asoc-sof-intel-add-pci-id-for-cometlake-s.patch +asoc-hdac_hda-fix-memleak-with-regmap-not-freed-on-r.patch +alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch +spi-spidev-fix-a-race-between-spidev_release-and-spi.patch +spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch +net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch +net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch +ixgbe-protect-ring-accesses-with-read-and-write_once.patch +i40e-protect-ring-accesses-with-read-and-write_once.patch +ice-protect-ring-accesses-with-write_once.patch +ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch +powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch +xprtrdma-prevent-dereferencing-r_xprt-rx_ep-after-it.patch +iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch +drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch +drm-panel-orientation-quirks-use-generic-orientation.patch +s390-kasan-fix-early-pgm-check-handler-execution.patch +drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch +cifs-update-ctime-and-mtime-during-truncate.patch +arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch +scsi-qla2xxx-fix-mpi-failure-aen-8200-handling.patch +scsi-mptscsih-fix-read-sense-data-size.patch +usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch +arm64-kpti-add-kryo-3-4-xx-silver-cpu-cores-to-kpti-.patch +block-release-bip-in-a-right-way-in-error-path.patch +nvme-rdma-assign-completion-vector-correctly.patch +x86-entry-increase-entry_stack-size-to-a-full-page.patch +arm64-add-kryo-3-4-xx-silver-cpu-cores-to-ssb-safeli.patch +nfs-fix-memory-leak-of-export_path.patch +sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch diff --git a/queue-5.7/spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch b/queue-5.7/spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch new file mode 100644 index 00000000000..80275ac399c --- /dev/null +++ b/queue-5.7/spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch @@ -0,0 +1,76 @@ +From e7fe7430e984179bf5ca9d0b527ba36425d84f46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 11:21:25 +0800 +Subject: spi: spidev: fix a potential use-after-free in spidev_release() + +From: Zhenzhong Duan + +[ Upstream commit 06096cc6c5a84ced929634b0d79376b94c65a4bd ] + +If an spi device is unbounded from the driver before the release +process, there will be an NULL pointer reference when it's +referenced in spi_slave_abort(). + +Fix it by checking it's already freed before reference. + +Signed-off-by: Zhenzhong Duan +Link: https://lore.kernel.org/r/20200618032125.4650-2-zhenzhong.duan@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 82e6481fdf950..012a89123067c 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -608,15 +608,20 @@ err_find_dev: + static int spidev_release(struct inode *inode, struct file *filp) + { + struct spidev_data *spidev; ++ int dofree; + + mutex_lock(&device_list_lock); + spidev = filp->private_data; + filp->private_data = NULL; + ++ spin_lock_irq(&spidev->spi_lock); ++ /* ... after we unbound from the underlying device? */ ++ dofree = (spidev->spi == NULL); ++ spin_unlock_irq(&spidev->spi_lock); ++ + /* last close? */ + spidev->users--; + if (!spidev->users) { +- int dofree; + + kfree(spidev->tx_buffer); + spidev->tx_buffer = NULL; +@@ -624,19 +629,14 @@ static int spidev_release(struct inode *inode, struct file *filp) + kfree(spidev->rx_buffer); + spidev->rx_buffer = NULL; + +- spin_lock_irq(&spidev->spi_lock); +- if (spidev->spi) +- spidev->speed_hz = spidev->spi->max_speed_hz; +- +- /* ... after we unbound from the underlying device? */ +- dofree = (spidev->spi == NULL); +- spin_unlock_irq(&spidev->spi_lock); +- + if (dofree) + kfree(spidev); ++ else ++ spidev->speed_hz = spidev->spi->max_speed_hz; + } + #ifdef CONFIG_SPI_SLAVE +- spi_slave_abort(spidev->spi); ++ if (!dofree) ++ spi_slave_abort(spidev->spi); + #endif + mutex_unlock(&device_list_lock); + +-- +2.25.1 + diff --git a/queue-5.7/spi-spidev-fix-a-race-between-spidev_release-and-spi.patch b/queue-5.7/spi-spidev-fix-a-race-between-spidev_release-and-spi.patch new file mode 100644 index 00000000000..15de82a35a2 --- /dev/null +++ b/queue-5.7/spi-spidev-fix-a-race-between-spidev_release-and-spi.patch @@ -0,0 +1,62 @@ +From 5eec445efb3788c77b634fd885548f86689a95d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 11:21:24 +0800 +Subject: spi: spidev: fix a race between spidev_release and spidev_remove + +From: Zhenzhong Duan + +[ Upstream commit abd42781c3d2155868821f1b947ae45bbc33330d ] + +Imagine below scene, spidev is referenced after it's freed. + +spidev_release() spidev_remove() +... + spin_lock_irq(&spidev->spi_lock); + spidev->spi = NULL; + spin_unlock_irq(&spidev->spi_lock); +mutex_lock(&device_list_lock); +dofree = (spidev->spi == NULL); +if (dofree) + kfree(spidev); +mutex_unlock(&device_list_lock); + mutex_lock(&device_list_lock); + list_del(&spidev->device_entry); + device_destroy(spidev_class, spidev->devt); + clear_bit(MINOR(spidev->devt), minors); + if (spidev->users == 0) + kfree(spidev); + mutex_unlock(&device_list_lock); + +Fix it by resetting spidev->spi in device_list_lock's protection. + +Signed-off-by: Zhenzhong Duan +Link: https://lore.kernel.org/r/20200618032125.4650-1-zhenzhong.duan@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 80dd1025b9530..82e6481fdf950 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -786,13 +786,13 @@ static int spidev_remove(struct spi_device *spi) + { + struct spidev_data *spidev = spi_get_drvdata(spi); + ++ /* prevent new opens */ ++ mutex_lock(&device_list_lock); + /* make sure ops on existing fds can abort cleanly */ + spin_lock_irq(&spidev->spi_lock); + spidev->spi = NULL; + spin_unlock_irq(&spidev->spi_lock); + +- /* prevent new opens */ +- mutex_lock(&device_list_lock); + list_del(&spidev->device_entry); + device_destroy(spidev_class, spidev->devt); + clear_bit(MINOR(spidev->devt), minors); +-- +2.25.1 + diff --git a/queue-5.7/staging-wfx-fix-coherency-of-hif_scan-prototype.patch b/queue-5.7/staging-wfx-fix-coherency-of-hif_scan-prototype.patch new file mode 100644 index 00000000000..7382653f676 --- /dev/null +++ b/queue-5.7/staging-wfx-fix-coherency-of-hif_scan-prototype.patch @@ -0,0 +1,93 @@ +From 38a7dcbd768ce5de89dc5600ba076d8442ef3495 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 May 2020 14:12:56 +0200 +Subject: staging: wfx: fix coherency of hif_scan() prototype +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jérôme Pouiller + +[ Upstream commit 29de523a6270a308d12d21f4fecf52dac491e226 ] + +The function hif_scan() return the timeout for the completion of the +scan request. It is the only function from hif_tx.c that return another +thing than just an error code. This behavior is not coherent with the +rest of file. Worse, if value returned is positive, the caller can't +make say if it is a timeout or the value returned by the hardware. + +Uniformize API with other HIF functions, only return the error code and +pass timeout with parameters. + +Signed-off-by: Jérôme Pouiller +Link: https://lore.kernel.org/r/20200529121256.1045521-1-Jerome.Pouiller@silabs.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/wfx/hif_tx.c | 6 ++++-- + drivers/staging/wfx/hif_tx.h | 2 +- + drivers/staging/wfx/scan.c | 6 +++--- + 3 files changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/staging/wfx/hif_tx.c b/drivers/staging/wfx/hif_tx.c +index 20b3045d76674..15ff60a584668 100644 +--- a/drivers/staging/wfx/hif_tx.c ++++ b/drivers/staging/wfx/hif_tx.c +@@ -222,7 +222,7 @@ int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, void *val, + } + + int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req, +- int chan_start_idx, int chan_num) ++ int chan_start_idx, int chan_num, int *timeout) + { + int ret, i; + struct hif_msg *hif; +@@ -269,11 +269,13 @@ int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req, + tmo_chan_fg = 512 * USEC_PER_TU + body->probe_delay; + tmo_chan_fg *= body->num_of_probe_requests; + tmo = chan_num * max(tmo_chan_bg, tmo_chan_fg) + 512 * USEC_PER_TU; ++ if (timeout) ++ *timeout = usecs_to_jiffies(tmo); + + wfx_fill_header(hif, wvif->id, HIF_REQ_ID_START_SCAN, buf_len); + ret = wfx_cmd_send(wvif->wdev, hif, NULL, 0, false); + kfree(hif); +- return ret ? ret : usecs_to_jiffies(tmo); ++ return ret; + } + + int hif_stop_scan(struct wfx_vif *wvif) +diff --git a/drivers/staging/wfx/hif_tx.h b/drivers/staging/wfx/hif_tx.h +index f8520a14c14cd..7a21338470eeb 100644 +--- a/drivers/staging/wfx/hif_tx.h ++++ b/drivers/staging/wfx/hif_tx.h +@@ -43,7 +43,7 @@ int hif_read_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, + int hif_write_mib(struct wfx_dev *wdev, int vif_id, u16 mib_id, + void *buf, size_t buf_size); + int hif_scan(struct wfx_vif *wvif, struct cfg80211_scan_request *req80211, +- int chan_start, int chan_num); ++ int chan_start, int chan_num, int *timeout); + int hif_stop_scan(struct wfx_vif *wvif); + int hif_join(struct wfx_vif *wvif, const struct ieee80211_bss_conf *conf, + struct ieee80211_channel *channel, const u8 *ssid, int ssidlen); +diff --git a/drivers/staging/wfx/scan.c b/drivers/staging/wfx/scan.c +index 9aa14331affd6..d47b8a3ba403c 100644 +--- a/drivers/staging/wfx/scan.c ++++ b/drivers/staging/wfx/scan.c +@@ -56,10 +56,10 @@ static int send_scan_req(struct wfx_vif *wvif, + wfx_tx_lock_flush(wvif->wdev); + wvif->scan_abort = false; + reinit_completion(&wvif->scan_complete); +- timeout = hif_scan(wvif, req, start_idx, i - start_idx); +- if (timeout < 0) { ++ ret = hif_scan(wvif, req, start_idx, i - start_idx, &timeout); ++ if (ret) { + wfx_tx_unlock(wvif->wdev); +- return timeout; ++ return -EIO; + } + ret = wait_for_completion_timeout(&wvif->scan_complete, timeout); + if (req->channels[start_idx]->max_power != wvif->vif->bss_conf.txpower) +-- +2.25.1 + diff --git a/queue-5.7/usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch b/queue-5.7/usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch new file mode 100644 index 00000000000..2dfec6631ef --- /dev/null +++ b/queue-5.7/usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch @@ -0,0 +1,39 @@ +From f0464bcf45b17d700ec03adf01c307edc5482eda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jun 2020 22:15:25 -0500 +Subject: usb: dwc3: pci: Fix reference count leak in dwc3_pci_resume_work + +From: Aditya Pakki + +[ Upstream commit 2655971ad4b34e97dd921df16bb0b08db9449df7 ] + +dwc3_pci_resume_work() calls pm_runtime_get_sync() that increments +the reference counter. In case of failure, decrement the reference +before returning. + +Signed-off-by: Aditya Pakki +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index b67372737dc9b..96c05b121fac8 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -206,8 +206,10 @@ static void dwc3_pci_resume_work(struct work_struct *work) + int ret; + + ret = pm_runtime_get_sync(&dwc3->dev); +- if (ret) ++ if (ret) { ++ pm_runtime_put_sync_autosuspend(&dwc3->dev); + return; ++ } + + pm_runtime_mark_last_busy(&dwc3->dev); + pm_runtime_put_sync_autosuspend(&dwc3->dev); +-- +2.25.1 + diff --git a/queue-5.7/x86-entry-increase-entry_stack-size-to-a-full-page.patch b/queue-5.7/x86-entry-increase-entry_stack-size-to-a-full-page.patch new file mode 100644 index 00000000000..deb7995053f --- /dev/null +++ b/queue-5.7/x86-entry-increase-entry_stack-size-to-a-full-page.patch @@ -0,0 +1,40 @@ +From 43d0e399a442128876094cfaaaf7c02679a7e446 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 18:25:57 +0200 +Subject: x86/entry: Increase entry_stack size to a full page + +From: Peter Zijlstra + +[ Upstream commit c7aadc09321d8f9a1d3bd1e6d8a47222ecddf6c5 ] + +Marco crashed in bad_iret with a Clang11/KCSAN build due to +overflowing the stack. Now that we run C code on it, expand it to a +full page. + +Suggested-by: Andy Lutomirski +Reported-by: Marco Elver +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Lai Jiangshan +Tested-by: Marco Elver +Link: https://lkml.kernel.org/r/20200618144801.819246178@infradead.org +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/processor.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index c4e8fd709cf67..e38befea287fc 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -370,7 +370,7 @@ struct x86_hw_tss { + #define IO_BITMAP_OFFSET_INVALID (__KERNEL_TSS_LIMIT + 1) + + struct entry_stack { +- unsigned long words[64]; ++ char stack[PAGE_SIZE]; + }; + + struct entry_stack_page { +-- +2.25.1 + diff --git a/queue-5.7/xprtrdma-prevent-dereferencing-r_xprt-rx_ep-after-it.patch b/queue-5.7/xprtrdma-prevent-dereferencing-r_xprt-rx_ep-after-it.patch new file mode 100644 index 00000000000..1ddd74b338a --- /dev/null +++ b/queue-5.7/xprtrdma-prevent-dereferencing-r_xprt-rx_ep-after-it.patch @@ -0,0 +1,141 @@ +From c5a9edefaf60b29888b8b9ca6f699b40fc61286b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Jun 2020 09:20:52 -0400 +Subject: xprtrdma: Prevent dereferencing r_xprt->rx_ep after it is freed + +From: Chuck Lever + +[ Upstream commit 2acc5cae292355f5f18ad377a2a966e7f03c8fec ] + +r_xprt->rx_ep is known to be good while the transport's send lock is +held. Otherwise additional references on rx_ep must be held when it +is used outside of that lock's critical sections. + +For now, bump the rx_ep reference count once whenever there is at +least one outstanding Receive WR. This avoids the memory bandwidth +overhead of taking and releasing the reference count for every +ib_post_recv() and Receive completion. + +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/verbs.c | 33 +++++++++++++++++++++++---------- + 1 file changed, 23 insertions(+), 10 deletions(-) + +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 05c4d3a9cda27..db0259c6467ef 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -84,7 +84,8 @@ static void rpcrdma_rep_destroy(struct rpcrdma_rep *rep); + static void rpcrdma_reps_unmap(struct rpcrdma_xprt *r_xprt); + static void rpcrdma_mrs_create(struct rpcrdma_xprt *r_xprt); + static void rpcrdma_mrs_destroy(struct rpcrdma_xprt *r_xprt); +-static int rpcrdma_ep_destroy(struct rpcrdma_ep *ep); ++static void rpcrdma_ep_get(struct rpcrdma_ep *ep); ++static int rpcrdma_ep_put(struct rpcrdma_ep *ep); + static struct rpcrdma_regbuf * + rpcrdma_regbuf_alloc(size_t size, enum dma_data_direction direction, + gfp_t flags); +@@ -97,7 +98,8 @@ static void rpcrdma_regbuf_free(struct rpcrdma_regbuf *rb); + */ + static void rpcrdma_xprt_drain(struct rpcrdma_xprt *r_xprt) + { +- struct rdma_cm_id *id = r_xprt->rx_ep->re_id; ++ struct rpcrdma_ep *ep = r_xprt->rx_ep; ++ struct rdma_cm_id *id = ep->re_id; + + /* Flush Receives, then wait for deferred Reply work + * to complete. +@@ -108,6 +110,8 @@ static void rpcrdma_xprt_drain(struct rpcrdma_xprt *r_xprt) + * local invalidations. + */ + ib_drain_sq(id->qp); ++ ++ rpcrdma_ep_put(ep); + } + + /** +@@ -267,7 +271,7 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) + xprt_force_disconnect(xprt); + goto disconnected; + case RDMA_CM_EVENT_ESTABLISHED: +- kref_get(&ep->re_kref); ++ rpcrdma_ep_get(ep); + ep->re_connect_status = 1; + rpcrdma_update_cm_private(ep, &event->param.conn); + trace_xprtrdma_inline_thresh(ep); +@@ -290,7 +294,7 @@ rpcrdma_cm_event_handler(struct rdma_cm_id *id, struct rdma_cm_event *event) + ep->re_connect_status = -ECONNABORTED; + disconnected: + xprt_force_disconnect(xprt); +- return rpcrdma_ep_destroy(ep); ++ return rpcrdma_ep_put(ep); + default: + break; + } +@@ -346,7 +350,7 @@ out: + return ERR_PTR(rc); + } + +-static void rpcrdma_ep_put(struct kref *kref) ++static void rpcrdma_ep_destroy(struct kref *kref) + { + struct rpcrdma_ep *ep = container_of(kref, struct rpcrdma_ep, re_kref); + +@@ -370,13 +374,18 @@ static void rpcrdma_ep_put(struct kref *kref) + module_put(THIS_MODULE); + } + ++static noinline void rpcrdma_ep_get(struct rpcrdma_ep *ep) ++{ ++ kref_get(&ep->re_kref); ++} ++ + /* Returns: + * %0 if @ep still has a positive kref count, or + * %1 if @ep was destroyed successfully. + */ +-static int rpcrdma_ep_destroy(struct rpcrdma_ep *ep) ++static noinline int rpcrdma_ep_put(struct rpcrdma_ep *ep) + { +- return kref_put(&ep->re_kref, rpcrdma_ep_put); ++ return kref_put(&ep->re_kref, rpcrdma_ep_destroy); + } + + static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) +@@ -493,7 +502,7 @@ static int rpcrdma_ep_create(struct rpcrdma_xprt *r_xprt) + return 0; + + out_destroy: +- rpcrdma_ep_destroy(ep); ++ rpcrdma_ep_put(ep); + rdma_destroy_id(id); + out_free: + kfree(ep); +@@ -522,8 +531,12 @@ retry: + + ep->re_connect_status = 0; + xprt_clear_connected(xprt); +- + rpcrdma_reset_cwnd(r_xprt); ++ ++ /* Bump the ep's reference count while there are ++ * outstanding Receives. ++ */ ++ rpcrdma_ep_get(ep); + rpcrdma_post_recvs(r_xprt, true); + + rc = rpcrdma_sendctxs_create(r_xprt); +@@ -588,7 +601,7 @@ void rpcrdma_xprt_disconnect(struct rpcrdma_xprt *r_xprt) + rpcrdma_mrs_destroy(r_xprt); + rpcrdma_sendctxs_destroy(r_xprt); + +- if (rpcrdma_ep_destroy(ep)) ++ if (rpcrdma_ep_put(ep)) + rdma_destroy_id(id); + + r_xprt->rx_ep = NULL; +-- +2.25.1 + -- 2.47.3