From 4adb97db087f7fe98b20de1101264bddb1dcfbfe Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 21 Nov 2021 18:00:35 -0500 Subject: [PATCH] Fixes for 4.19 Signed-off-by: Sasha Levin --- ...l-pointer-dereference-on-pointer-blo.patch | 37 +++ queue-4.19/alsa-isa-not-for-m68k.patch | 88 ++++++ ...-dts-omap-fix-gpmc-mux-add-data-type.patch | 52 ++++ ...cale-fix-arm-sp805-compatible-string.patch | 164 +++++++++++ ...icon-fix-arm-sp805-compatible-string.patch | 61 ++++ ...not-duplicate-flash-partition-label-.patch | 54 ++++ ...-zynqmp-fix-serial-compatible-string.patch | 46 +++ ...-dmi-quirk-mechanism-for-active-high.patch | 98 +++++++ ...gv100.c-fix-corrupted-hdmi-vendor-in.patch | 41 +++ .../f2fs-fix-up-f2fs_lookup-tracepoints.patch | 77 +++++ ...fix-pre-allocated-buf-built-in-firmw.patch | 83 ++++++ ...g-previously-set-num_queue_pairs-for.patch | 135 +++++++++ ...-correct-max_pkt_size-on-vf-rx-queue.patch | 118 ++++++++ ...i40e-fix-display-error-code-in-dmesg.patch | 42 +++ ...l-ptr-dereference-on-vsi-filter-sync.patch | 68 +++++ ...-check-for-null-in-iavf_fix_features.patch | 41 +++ ...-false-positive-asq-arq-errors-while.patch | 43 +++ ...wrong-return-value-of-maple_bus_init.patch | 50 ++++ ...m63xx-add-support-for-clk_get_parent.patch | 65 +++++ ...ure-that-cpu_supports_32bit_kernel-i.patch | 64 +++++ ...on-dt-fix-uninitialized-variable-err.patch | 41 +++ ...antiq-add-support-for-clk_get_parent.patch | 53 ++++ queue-4.19/mips-sni-fix-the-build.patch | 54 ++++ ...x-variable-dereferenced-before-check.patch | 46 +++ ...dr_to_skb-count-transport-header-in-.patch | 75 +++++ ...the-logic-in-nfc_-un-register_device.patch | 129 +++++++++ ...rganize-the-functions-in-nci_request.patch | 62 ++++ ...-two-memory-leaks-detected-with-asan.patch | 56 ++++ ...accel-fix-an-error-handling-path-in-.patch | 46 +++ ...c-5200-dts-fix-memory-node-unit-name.patch | 191 +++++++++++++ ...e-cmplwi-instead-of-3-argument-cmpli.patch | 66 +++++ ...ate-race-cpus_share_cache-update_top.patch | 61 ++++ ...csi-advansys-fix-kernel-pointer-leak.patch | 40 +++ ...ist_add-corruption-in-lpfc_drain_txq.patch | 48 ++++ ...et-fix-alua_tg_pt_gps_count-tracking.patch | 45 +++ ...scsi-target-fix-ordered-tag-handling.patch | 266 ++++++++++++++++++ queue-4.19/series | 43 +++ .../sh-check-return-code-of-request_irq.patch | 45 +++ .../sh-define-__big_endian-for-math-emu.patch | 59 ++++ ...nmet-dependency-warning-for-frame_po.patch | 47 ++++ ...ix-the-softlockup-issue-in-flush_to_.patch | 69 +++++ ...io-check-return-value-after-calling-.patch | 38 +++ ...0-check-return-value-after-calling-p.patch | 40 +++ ...emove-warn_on-in-tps6598x_block_read.patch | 38 +++ 44 files changed, 3085 insertions(+) create mode 100644 queue-4.19/alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch create mode 100644 queue-4.19/alsa-isa-not-for-m68k.patch create mode 100644 queue-4.19/arm-dts-omap-fix-gpmc-mux-add-data-type.patch create mode 100644 queue-4.19/arm64-dts-freescale-fix-arm-sp805-compatible-string.patch create mode 100644 queue-4.19/arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch create mode 100644 queue-4.19/arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch create mode 100644 queue-4.19/arm64-zynqmp-fix-serial-compatible-string.patch create mode 100644 queue-4.19/asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch create mode 100644 queue-4.19/drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch create mode 100644 queue-4.19/f2fs-fix-up-f2fs_lookup-tracepoints.patch create mode 100644 queue-4.19/firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch create mode 100644 queue-4.19/i40e-fix-changing-previously-set-num_queue_pairs-for.patch create mode 100644 queue-4.19/i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch create mode 100644 queue-4.19/i40e-fix-display-error-code-in-dmesg.patch create mode 100644 queue-4.19/i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch create mode 100644 queue-4.19/iavf-check-for-null-in-iavf_fix_features.patch create mode 100644 queue-4.19/iavf-fix-for-the-false-positive-asq-arq-errors-while.patch create mode 100644 queue-4.19/maple-fix-wrong-return-value-of-maple_bus_init.patch create mode 100644 queue-4.19/mips-bcm63xx-add-support-for-clk_get_parent.patch create mode 100644 queue-4.19/mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch create mode 100644 queue-4.19/mips-generic-yamon-dt-fix-uninitialized-variable-err.patch create mode 100644 queue-4.19/mips-lantiq-add-support-for-clk_get_parent.patch create mode 100644 queue-4.19/mips-sni-fix-the-build.patch create mode 100644 queue-4.19/net-bnx2x-fix-variable-dereferenced-before-check.patch create mode 100644 queue-4.19/net-virtio_net_hdr_to_skb-count-transport-header-in-.patch create mode 100644 queue-4.19/nfc-reorder-the-logic-in-nfc_-un-register_device.patch create mode 100644 queue-4.19/nfc-reorganize-the-functions-in-nci_request.patch create mode 100644 queue-4.19/perf-bench-fix-two-memory-leaks-detected-with-asan.patch create mode 100644 queue-4.19/platform-x86-hp_accel-fix-an-error-handling-path-in-.patch create mode 100644 queue-4.19/powerpc-5200-dts-fix-memory-node-unit-name.patch create mode 100644 queue-4.19/powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch create mode 100644 queue-4.19/sched-core-mitigate-race-cpus_share_cache-update_top.patch create mode 100644 queue-4.19/scsi-advansys-fix-kernel-pointer-leak.patch create mode 100644 queue-4.19/scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch create mode 100644 queue-4.19/scsi-target-fix-alua_tg_pt_gps_count-tracking.patch create mode 100644 queue-4.19/scsi-target-fix-ordered-tag-handling.patch create mode 100644 queue-4.19/sh-check-return-code-of-request_irq.patch create mode 100644 queue-4.19/sh-define-__big_endian-for-math-emu.patch create mode 100644 queue-4.19/sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch create mode 100644 queue-4.19/tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch create mode 100644 queue-4.19/usb-host-ohci-tmio-check-return-value-after-calling-.patch create mode 100644 queue-4.19/usb-musb-tusb6010-check-return-value-after-calling-p.patch create mode 100644 queue-4.19/usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch diff --git a/queue-4.19/alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch b/queue-4.19/alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch new file mode 100644 index 00000000000..3ff6daec61f --- /dev/null +++ b/queue-4.19/alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch @@ -0,0 +1,37 @@ +From 44cfa1dfef738636fb67a465b72e144b96a37549 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Oct 2021 03:46:11 -0700 +Subject: ALSA: gus: fix null pointer dereference on pointer block + +From: Chengfeng Ye + +[ Upstream commit a0d21bb3279476c777434c40d969ea88ca64f9aa ] + +The pointer block return from snd_gf1_dma_next_block could be +null, so there is a potential null pointer dereference issue. +Fix this by adding a null check before dereference. + +Signed-off-by: Chengfeng Ye +Link: https://lore.kernel.org/r/20211024104611.9919-1-cyeaa@connect.ust.hk +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/isa/gus/gus_dma.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/isa/gus/gus_dma.c b/sound/isa/gus/gus_dma.c +index 7f95f452f1064..48e76b8fede41 100644 +--- a/sound/isa/gus/gus_dma.c ++++ b/sound/isa/gus/gus_dma.c +@@ -141,6 +141,8 @@ static void snd_gf1_dma_interrupt(struct snd_gus_card * gus) + } + block = snd_gf1_dma_next_block(gus); + spin_unlock(&gus->dma_lock); ++ if (!block) ++ return; + snd_gf1_dma_program(gus, block->addr, block->buf_addr, block->count, (unsigned short) block->cmd); + kfree(block); + #if 0 +-- +2.33.0 + diff --git a/queue-4.19/alsa-isa-not-for-m68k.patch b/queue-4.19/alsa-isa-not-for-m68k.patch new file mode 100644 index 00000000000..e1bd9568649 --- /dev/null +++ b/queue-4.19/alsa-isa-not-for-m68k.patch @@ -0,0 +1,88 @@ +From da626e7b2e26afeb2f987ed5ca82102977ac5e62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 23:26:02 -0700 +Subject: ALSA: ISA: not for M68K + +From: Randy Dunlap + +[ Upstream commit 3c05f1477e62ea5a0a8797ba6a545b1dc751fb31 ] + +On m68k, compiling drivers under SND_ISA causes build errors: + +../sound/core/isadma.c: In function 'snd_dma_program': +../sound/core/isadma.c:33:17: error: implicit declaration of function 'claim_dma_lock' [-Werror=implicit-function-declaration] + 33 | flags = claim_dma_lock(); + | ^~~~~~~~~~~~~~ +../sound/core/isadma.c:41:9: error: implicit declaration of function 'release_dma_lock' [-Werror=implicit-function-declaration] + 41 | release_dma_lock(flags); + | ^~~~~~~~~~~~~~~~ + +../sound/isa/sb/sb16_main.c: In function 'snd_sb16_playback_prepare': +../sound/isa/sb/sb16_main.c:253:72: error: 'DMA_AUTOINIT' undeclared (first use in this function) + 253 | snd_dma_program(dma, runtime->dma_addr, size, DMA_MODE_WRITE | DMA_AUTOINIT); + | ^~~~~~~~~~~~ +../sound/isa/sb/sb16_main.c:253:72: note: each undeclared identifier is reported only once for each function it appears in +../sound/isa/sb/sb16_main.c: In function 'snd_sb16_capture_prepare': +../sound/isa/sb/sb16_main.c:322:71: error: 'DMA_AUTOINIT' undeclared (first use in this function) + 322 | snd_dma_program(dma, runtime->dma_addr, size, DMA_MODE_READ | DMA_AUTOINIT); + | ^~~~~~~~~~~~ + +and more... + +Signed-off-by: Randy Dunlap +Cc: Jaroslav Kysela +Cc: Takashi Iwai +Cc: alsa-devel@alsa-project.org +Cc: linux-m68k@lists.linux-m68k.org +Cc: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20211016062602.3588-1-rdunlap@infradead.org +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/core/Makefile | 2 ++ + sound/isa/Kconfig | 2 +- + sound/pci/Kconfig | 1 + + 3 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/core/Makefile b/sound/core/Makefile +index ee4a4a6b99ba7..d123587c0fd8f 100644 +--- a/sound/core/Makefile ++++ b/sound/core/Makefile +@@ -9,7 +9,9 @@ ifneq ($(CONFIG_SND_PROC_FS),) + snd-y += info.o + snd-$(CONFIG_SND_OSSEMUL) += info_oss.o + endif ++ifneq ($(CONFIG_M68K),y) + snd-$(CONFIG_ISA_DMA_API) += isadma.o ++endif + snd-$(CONFIG_SND_OSSEMUL) += sound_oss.o + snd-$(CONFIG_SND_VMASTER) += vmaster.o + snd-$(CONFIG_SND_JACK) += ctljack.o jack.o +diff --git a/sound/isa/Kconfig b/sound/isa/Kconfig +index d7db1eeebc844..f8f3433925bb4 100644 +--- a/sound/isa/Kconfig ++++ b/sound/isa/Kconfig +@@ -21,7 +21,7 @@ config SND_SB16_DSP + menuconfig SND_ISA + bool "ISA sound devices" + depends on ISA || COMPILE_TEST +- depends on ISA_DMA_API ++ depends on ISA_DMA_API && !M68K + default y + help + Support for sound devices connected via the ISA bus. +diff --git a/sound/pci/Kconfig b/sound/pci/Kconfig +index 4105d9f653d90..bbaf46dc3f804 100644 +--- a/sound/pci/Kconfig ++++ b/sound/pci/Kconfig +@@ -278,6 +278,7 @@ config SND_CS46XX_NEW_DSP + config SND_CS5530 + tristate "CS5530 Audio" + depends on ISA_DMA_API && (X86_32 || COMPILE_TEST) ++ depends on !M68K + select SND_SB16_DSP + help + Say Y here to include support for audio on Cyrix/NatSemi CS5530 chips. +-- +2.33.0 + diff --git a/queue-4.19/arm-dts-omap-fix-gpmc-mux-add-data-type.patch b/queue-4.19/arm-dts-omap-fix-gpmc-mux-add-data-type.patch new file mode 100644 index 00000000000..28f4970f633 --- /dev/null +++ b/queue-4.19/arm-dts-omap-fix-gpmc-mux-add-data-type.patch @@ -0,0 +1,52 @@ +From 124e04ce1cfb180febb33969ba1162ff43ccdeaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Oct 2021 15:08:30 +0300 +Subject: ARM: dts: omap: fix gpmc,mux-add-data type + +From: Roger Quadros + +[ Upstream commit 51b9e22ffd3c4c56cbb7caae9750f70e55ffa603 ] + +gpmc,mux-add-data is not boolean. + +Fixes the below errors flagged by dtbs_check. + +"ethernet@4,0:gpmc,mux-add-data: True is not of type 'array'" + +Signed-off-by: Roger Quadros +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi | 2 +- + arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +index 7f6aefd134514..e7534fe9c53cf 100644 +--- a/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi ++++ b/arch/arm/boot/dts/omap-gpmc-smsc9221.dtsi +@@ -29,7 +29,7 @@ + compatible = "smsc,lan9221","smsc,lan9115"; + bank-width = <2>; + +- gpmc,mux-add-data; ++ gpmc,mux-add-data = <0>; + gpmc,cs-on-ns = <0>; + gpmc,cs-rd-off-ns = <42>; + gpmc,cs-wr-off-ns = <36>; +diff --git a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi +index 82e98ee3023ad..3dbeb7a6c569c 100644 +--- a/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi ++++ b/arch/arm/boot/dts/omap3-overo-tobiduo-common.dtsi +@@ -25,7 +25,7 @@ + compatible = "smsc,lan9221","smsc,lan9115"; + bank-width = <2>; + +- gpmc,mux-add-data; ++ gpmc,mux-add-data = <0>; + gpmc,cs-on-ns = <0>; + gpmc,cs-rd-off-ns = <42>; + gpmc,cs-wr-off-ns = <36>; +-- +2.33.0 + diff --git a/queue-4.19/arm64-dts-freescale-fix-arm-sp805-compatible-string.patch b/queue-4.19/arm64-dts-freescale-fix-arm-sp805-compatible-string.patch new file mode 100644 index 00000000000..bd4b1ea05a8 --- /dev/null +++ b/queue-4.19/arm64-dts-freescale-fix-arm-sp805-compatible-string.patch @@ -0,0 +1,164 @@ +From 43db6805914a9137b45c1c7f234220aab39abeb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 14:35:28 +0200 +Subject: arm64: dts: freescale: fix arm,sp805 compatible string + +From: Michael Walle + +[ Upstream commit 99a7cacc66cae92db40139b57689be2af75fc6b8 ] + +According to Documentation/devicetree/bindings/watchdog/arm,sp805.yaml +the compatible is: + compatible = "arm,sp805", "arm,primecell"; + +The current compatible string doesn't exist at all. Fix it. + +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi | 16 ++++++++-------- + arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi | 16 ++++++++-------- + 2 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +index a07f612ab56b7..b3b87c4c738e6 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1088a.dtsi +@@ -584,56 +584,56 @@ + }; + + cluster1_core0_watchdog: wdt@c000000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc000000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster1_core1_watchdog: wdt@c010000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc010000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster1_core2_watchdog: wdt@c020000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc020000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster1_core3_watchdog: wdt@c030000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc030000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster2_core0_watchdog: wdt@c100000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc100000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster2_core1_watchdog: wdt@c110000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc110000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster2_core2_watchdog: wdt@c120000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc120000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster2_core3_watchdog: wdt@c130000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc130000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +index 8c22ce904e655..73a60fd516e06 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls208xa.dtsi +@@ -222,56 +222,56 @@ + }; + + cluster1_core0_watchdog: wdt@c000000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc000000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster1_core1_watchdog: wdt@c010000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc010000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster2_core0_watchdog: wdt@c100000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc100000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster2_core1_watchdog: wdt@c110000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc110000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster3_core0_watchdog: wdt@c200000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc200000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster3_core1_watchdog: wdt@c210000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc210000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster4_core0_watchdog: wdt@c300000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc300000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; + }; + + cluster4_core1_watchdog: wdt@c310000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xc310000 0x0 0x1000>; + clocks = <&clockgen 4 3>, <&clockgen 4 3>; + clock-names = "apb_pclk", "wdog_clk"; +-- +2.33.0 + diff --git a/queue-4.19/arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch b/queue-4.19/arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch new file mode 100644 index 00000000000..f295e09da82 --- /dev/null +++ b/queue-4.19/arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch @@ -0,0 +1,61 @@ +From 857634a3ce2bf70aba7e0f1929caea5c348264eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 18:51:13 +0200 +Subject: arm64: dts: hisilicon: fix arm,sp805 compatible string + +From: Michael Walle + +[ Upstream commit 894d4f1f77d0e88f1f81af2e1e37333c1c41b631 ] + +According to Documentation/devicetree/bindings/watchdog/arm,sp805.yaml +the compatible is: + compatible = "arm,sp805", "arm,primecell"; + +The current compatible string doesn't exist at all. Fix it. + +Signed-off-by: Michael Walle +Signed-off-by: Wei Xu +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/hisilicon/hi3660.dtsi | 4 ++-- + arch/arm64/boot/dts/hisilicon/hi6220.dtsi | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi +index f432b0a88c65d..6d4dee3cac16b 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi3660.dtsi ++++ b/arch/arm64/boot/dts/hisilicon/hi3660.dtsi +@@ -1062,7 +1062,7 @@ + }; + + watchdog0: watchdog@e8a06000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xe8a06000 0x0 0x1000>; + interrupts = ; + clocks = <&crg_ctrl HI3660_OSC32K>; +@@ -1070,7 +1070,7 @@ + }; + + watchdog1: watchdog@e8a07000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xe8a07000 0x0 0x1000>; + interrupts = ; + clocks = <&crg_ctrl HI3660_OSC32K>; +diff --git a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi +index 247024df714fc..5e9ae262caf3e 100644 +--- a/arch/arm64/boot/dts/hisilicon/hi6220.dtsi ++++ b/arch/arm64/boot/dts/hisilicon/hi6220.dtsi +@@ -830,7 +830,7 @@ + }; + + watchdog0: watchdog@f8005000 { +- compatible = "arm,sp805-wdt", "arm,primecell"; ++ compatible = "arm,sp805", "arm,primecell"; + reg = <0x0 0xf8005000 0x0 0x1000>; + interrupts = ; + clocks = <&ao_ctrl HI6220_WDT0_PCLK>; +-- +2.33.0 + diff --git a/queue-4.19/arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch b/queue-4.19/arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch new file mode 100644 index 00000000000..0f99a08270f --- /dev/null +++ b/queue-4.19/arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch @@ -0,0 +1,54 @@ +From 067a18d5c2d9b670d66be5a96c2cc62c53ed1ef8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 17:25:10 +0200 +Subject: arm64: zynqmp: Do not duplicate flash partition label property + +From: Amit Kumar Mahapatra + +[ Upstream commit 167721a5909f867f8c18c8e78ea58e705ad9bbd4 ] + +In kernel 5.4, support has been added for reading MTD devices via the nvmem +API. +For this the mtd devices are registered as read-only NVMEM providers under +sysfs with the same name as the flash partition label property. + +So if flash partition label property of multiple flash devices are +identical then the second mtd device fails to get registered as a NVMEM +provider. + +This patch fixes the issue by having different label property for different +flashes. + +Signed-off-by: Amit Kumar Mahapatra +Signed-off-by: Michal Simek +Link: https://lore.kernel.org/r/6c4b9b9232b93d9e316a63c086540fd5bf6b8687.1623684253.git.michal.simek@xilinx.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts +index 11cc67184fa9f..f1edd7fcef764 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts ++++ b/arch/arm64/boot/dts/xilinx/zynqmp-zc1751-xm016-dc2.dts +@@ -130,7 +130,7 @@ + reg = <0>; + + partition@0 { +- label = "data"; ++ label = "spi0-data"; + reg = <0x0 0x100000>; + }; + }; +@@ -148,7 +148,7 @@ + reg = <0>; + + partition@0 { +- label = "data"; ++ label = "spi1-data"; + reg = <0x0 0x84000>; + }; + }; +-- +2.33.0 + diff --git a/queue-4.19/arm64-zynqmp-fix-serial-compatible-string.patch b/queue-4.19/arm64-zynqmp-fix-serial-compatible-string.patch new file mode 100644 index 00000000000..5790755f86a --- /dev/null +++ b/queue-4.19/arm64-zynqmp-fix-serial-compatible-string.patch @@ -0,0 +1,46 @@ +From 7a45cd6d2208b3b20d1581d1d69d8f43e60c5f6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 10:58:29 +0200 +Subject: arm64: zynqmp: Fix serial compatible string + +From: Michal Simek + +[ Upstream commit 812fa2f0e9d33564bd0131a69750e0d165f4c82a ] + +Based on commit 65a2c14d4f00 ("dt-bindings: serial: convert Cadence UART +bindings to YAML") compatible string should look like differently that's +why fix it to be aligned with dt binding. + +Signed-off-by: Michal Simek +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/89b36e0a6187cc6b05b27a035efdf79173bd4486.1628240307.git.michal.simek@xilinx.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/xilinx/zynqmp.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +index 8a885ae647b7e..6478bca018197 100644 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi +@@ -574,7 +574,7 @@ + }; + + uart0: serial@ff000000 { +- compatible = "cdns,uart-r1p12", "xlnx,xuartps"; ++ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12"; + status = "disabled"; + interrupt-parent = <&gic>; + interrupts = <0 21 4>; +@@ -583,7 +583,7 @@ + }; + + uart1: serial@ff010000 { +- compatible = "cdns,uart-r1p12", "xlnx,xuartps"; ++ compatible = "xlnx,zynqmp-uart", "cdns,uart-r1p12"; + status = "disabled"; + interrupt-parent = <&gic>; + interrupts = <0 22 4>; +-- +2.33.0 + diff --git a/queue-4.19/asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch b/queue-4.19/asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch new file mode 100644 index 00000000000..9b31dcf1850 --- /dev/null +++ b/queue-4.19/asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch @@ -0,0 +1,98 @@ +From 87ff61e454df4e94d73c1389c422a9b71c85c6ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 2 Oct 2021 23:14:57 +0200 +Subject: ASoC: nau8824: Add DMI quirk mechanism for active-high jack-detect + +From: Hans de Goede + +[ Upstream commit 92d3360108f1839ca40451bad20ff67dd24a1964 ] + +Add a quirk mechanism to allow specifying that active-high jack-detection +should be used on platforms where this info is not available in devicetree. + +And add an entry for the Cyberbook T116 tablet to the DMI table, so that +jack-detection will work properly on this tablet. + +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20211002211459.110124-2-hdegoede@redhat.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/nau8824.c | 40 ++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/sound/soc/codecs/nau8824.c b/sound/soc/codecs/nau8824.c +index 663a208c2f784..4af87340b1655 100644 +--- a/sound/soc/codecs/nau8824.c ++++ b/sound/soc/codecs/nau8824.c +@@ -11,6 +11,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -30,6 +31,12 @@ + + #include "nau8824.h" + ++#define NAU8824_JD_ACTIVE_HIGH BIT(0) ++ ++static int nau8824_quirk; ++static int quirk_override = -1; ++module_param_named(quirk, quirk_override, uint, 0444); ++MODULE_PARM_DESC(quirk, "Board-specific quirk override"); + + static int nau8824_config_sysclk(struct nau8824 *nau8824, + int clk_id, unsigned int freq); +@@ -1878,6 +1885,34 @@ static int nau8824_read_device_properties(struct device *dev, + return 0; + } + ++/* Please keep this list alphabetically sorted */ ++static const struct dmi_system_id nau8824_quirk_table[] = { ++ { ++ /* Cyberbook T116 rugged tablet */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Cherry Trail CR"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_SKU, "20170531"), ++ }, ++ .driver_data = (void *)(NAU8824_JD_ACTIVE_HIGH), ++ }, ++ {} ++}; ++ ++static void nau8824_check_quirks(void) ++{ ++ const struct dmi_system_id *dmi_id; ++ ++ if (quirk_override != -1) { ++ nau8824_quirk = quirk_override; ++ return; ++ } ++ ++ dmi_id = dmi_first_match(nau8824_quirk_table); ++ if (dmi_id) ++ nau8824_quirk = (unsigned long)dmi_id->driver_data; ++} ++ + static int nau8824_i2c_probe(struct i2c_client *i2c, + const struct i2c_device_id *id) + { +@@ -1902,6 +1937,11 @@ static int nau8824_i2c_probe(struct i2c_client *i2c, + nau8824->irq = i2c->irq; + sema_init(&nau8824->jd_sem, 1); + ++ nau8824_check_quirks(); ++ ++ if (nau8824_quirk & NAU8824_JD_ACTIVE_HIGH) ++ nau8824->jkdet_polarity = 0; ++ + nau8824_print_device_properties(nau8824); + + ret = regmap_read(nau8824->regmap, NAU8824_REG_I2C_DEVICE_ID, &value); +-- +2.33.0 + diff --git a/queue-4.19/drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch b/queue-4.19/drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch new file mode 100644 index 00000000000..10823a3207e --- /dev/null +++ b/queue-4.19/drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch @@ -0,0 +1,41 @@ +From be9c59e057a624f968b805008b403d0d8e0530b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 16:36:04 +0100 +Subject: drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame + +From: Hans Verkuil + +[ Upstream commit 3cc1ae1fa70ab369e4645e38ce335a19438093ad ] + +gv100_hdmi_ctrl() writes vendor_infoframe.subpack0_high to 0x6f0110, and +then overwrites it with 0. Just drop the overwrite with 0, that's clearly +a mistake. + +Because of this issue the HDMI VIC is 0 instead of 1 in the HDMI Vendor +InfoFrame when transmitting 4kp30. + +Signed-off-by: Hans Verkuil +Fixes: 290ffeafcc1a ("drm/nouveau/disp/gv100: initial support") +Reviewed-by: Ben Skeggs +Signed-off-by: Karol Herbst +Link: https://patchwork.freedesktop.org/patch/msgid/3d3bd0f7-c150-2479-9350-35d394ee772d@xs4all.nl +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c +index 6e3c450eaacef..3ff49344abc77 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdmigv100.c +@@ -62,7 +62,6 @@ gv100_hdmi_ctrl(struct nvkm_ior *ior, int head, bool enable, u8 max_ac_packet, + nvkm_wr32(device, 0x6f0108 + hdmi, vendor_infoframe.header); + nvkm_wr32(device, 0x6f010c + hdmi, vendor_infoframe.subpack0_low); + nvkm_wr32(device, 0x6f0110 + hdmi, vendor_infoframe.subpack0_high); +- nvkm_wr32(device, 0x6f0110 + hdmi, 0x00000000); + nvkm_wr32(device, 0x6f0114 + hdmi, 0x00000000); + nvkm_wr32(device, 0x6f0118 + hdmi, 0x00000000); + nvkm_wr32(device, 0x6f011c + hdmi, 0x00000000); +-- +2.33.0 + diff --git a/queue-4.19/f2fs-fix-up-f2fs_lookup-tracepoints.patch b/queue-4.19/f2fs-fix-up-f2fs_lookup-tracepoints.patch new file mode 100644 index 00000000000..b407167cede --- /dev/null +++ b/queue-4.19/f2fs-fix-up-f2fs_lookup-tracepoints.patch @@ -0,0 +1,77 @@ +From 9904efc696ed74eaf377faffb8e24d3e6f0d1884 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 22:37:30 +0800 +Subject: f2fs: fix up f2fs_lookup tracepoints + +From: Gao Xiang + +[ Upstream commit 70a9ac36ffd807ac506ed0b849f3e8ce3c6623f2 ] + +Fix up a misuse that the filename pointer isn't always valid in +the ring buffer, and we should copy the content instead. + +Fixes: 0c5e36db17f5 ("f2fs: trace f2fs_lookup") +Signed-off-by: Gao Xiang +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + include/trace/events/f2fs.h | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h +index 795698925d206..52e6456bdb922 100644 +--- a/include/trace/events/f2fs.h ++++ b/include/trace/events/f2fs.h +@@ -751,20 +751,20 @@ TRACE_EVENT(f2fs_lookup_start, + TP_STRUCT__entry( + __field(dev_t, dev) + __field(ino_t, ino) +- __field(const char *, name) ++ __string(name, dentry->d_name.name) + __field(unsigned int, flags) + ), + + TP_fast_assign( + __entry->dev = dir->i_sb->s_dev; + __entry->ino = dir->i_ino; +- __entry->name = dentry->d_name.name; ++ __assign_str(name, dentry->d_name.name); + __entry->flags = flags; + ), + + TP_printk("dev = (%d,%d), pino = %lu, name:%s, flags:%u", + show_dev_ino(__entry), +- __entry->name, ++ __get_str(name), + __entry->flags) + ); + +@@ -778,7 +778,7 @@ TRACE_EVENT(f2fs_lookup_end, + TP_STRUCT__entry( + __field(dev_t, dev) + __field(ino_t, ino) +- __field(const char *, name) ++ __string(name, dentry->d_name.name) + __field(nid_t, cino) + __field(int, err) + ), +@@ -786,14 +786,14 @@ TRACE_EVENT(f2fs_lookup_end, + TP_fast_assign( + __entry->dev = dir->i_sb->s_dev; + __entry->ino = dir->i_ino; +- __entry->name = dentry->d_name.name; ++ __assign_str(name, dentry->d_name.name); + __entry->cino = ino; + __entry->err = err; + ), + + TP_printk("dev = (%d,%d), pino = %lu, name:%s, ino:%u, err:%d", + show_dev_ino(__entry), +- __entry->name, ++ __get_str(name), + __entry->cino, + __entry->err) + ); +-- +2.33.0 + diff --git a/queue-4.19/firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch b/queue-4.19/firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch new file mode 100644 index 00000000000..284649801cc --- /dev/null +++ b/queue-4.19/firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch @@ -0,0 +1,83 @@ +From 80a962d6c5592f0e0fd0222280d9c7407f0a1d8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 17 Sep 2021 11:22:13 -0700 +Subject: firmware_loader: fix pre-allocated buf built-in firmware use + +From: Luis Chamberlain + +[ Upstream commit f7a07f7b96033df7709042ff38e998720a3f7119 ] + +The firmware_loader can be used with a pre-allocated buffer +through the use of the API calls: + + o request_firmware_into_buf() + o request_partial_firmware_into_buf() + +If the firmware was built-in and present, our current check +for if the built-in firmware fits into the pre-allocated buffer +does not return any errors, and we proceed to tell the caller +that everything worked fine. It's a lie and no firmware would +end up being copied into the pre-allocated buffer. So if the +caller trust the result it may end up writing a bunch of 0's +to a device! + +Fix this by making the function that checks for the pre-allocated +buffer return non-void. Since the typical use case is when no +pre-allocated buffer is provided make this return successfully +for that case. If the built-in firmware does *not* fit into the +pre-allocated buffer size return a failure as we should have +been doing before. + +I'm not aware of users of the built-in firmware using the API +calls with a pre-allocated buffer, as such I doubt this fixes +any real life issue. But you never know... perhaps some oddball +private tree might use it. + +In so far as upstream is concerned this just fixes our code for +correctness. + +Signed-off-by: Luis Chamberlain +Link: https://lore.kernel.org/r/20210917182226.3532898-2-mcgrof@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/firmware_loader/main.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/base/firmware_loader/main.c b/drivers/base/firmware_loader/main.c +index 24410a0d6df07..cfa5e598a0dc8 100644 +--- a/drivers/base/firmware_loader/main.c ++++ b/drivers/base/firmware_loader/main.c +@@ -97,12 +97,15 @@ static struct firmware_cache fw_cache; + extern struct builtin_fw __start_builtin_fw[]; + extern struct builtin_fw __end_builtin_fw[]; + +-static void fw_copy_to_prealloc_buf(struct firmware *fw, ++static bool fw_copy_to_prealloc_buf(struct firmware *fw, + void *buf, size_t size) + { +- if (!buf || size < fw->size) +- return; ++ if (!buf) ++ return true; ++ if (size < fw->size) ++ return false; + memcpy(buf, fw->data, fw->size); ++ return true; + } + + static bool fw_get_builtin_firmware(struct firmware *fw, const char *name, +@@ -114,9 +117,7 @@ static bool fw_get_builtin_firmware(struct firmware *fw, const char *name, + if (strcmp(name, b_fw->name) == 0) { + fw->size = b_fw->size; + fw->data = b_fw->data; +- fw_copy_to_prealloc_buf(fw, buf, size); +- +- return true; ++ return fw_copy_to_prealloc_buf(fw, buf, size); + } + } + +-- +2.33.0 + diff --git a/queue-4.19/i40e-fix-changing-previously-set-num_queue_pairs-for.patch b/queue-4.19/i40e-fix-changing-previously-set-num_queue_pairs-for.patch new file mode 100644 index 00000000000..26e4c634460 --- /dev/null +++ b/queue-4.19/i40e-fix-changing-previously-set-num_queue_pairs-for.patch @@ -0,0 +1,135 @@ +From 66c2b94f020f13b690c63149228cc7363037d299 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 13:43:25 +0200 +Subject: i40e: Fix changing previously set num_queue_pairs for PFs + +From: Eryk Rybak + +[ Upstream commit d2a69fefd75683004ffe87166de5635b3267ee07 ] + +Currently, the i40e_vsi_setup_queue_map is basing the count of queues in +TCs on a VSI's alloc_queue_pairs member which is not changed throughout +any user's action (for example via ethtool's set_channels callback). + +This implies that vsi->tc_config.tc_info[n].qcount value that is given +to the kernel via netdev_set_tc_queue() that notifies about the count of +queues per particular traffic class is constant even if user has changed +the total count of queues. + +This in turn caused the kernel warning after setting the queue count to +the lower value than the initial one: + +$ ethtool -l ens801f0 +Channel parameters for ens801f0: +Pre-set maximums: +RX: 0 +TX: 0 +Other: 1 +Combined: 64 +Current hardware settings: +RX: 0 +TX: 0 +Other: 1 +Combined: 64 + +$ ethtool -L ens801f0 combined 40 + +[dmesg] +Number of in use tx queues changed invalidating tc mappings. Priority +traffic classification disabled! + +Reason was that vsi->alloc_queue_pairs stayed at 64 value which was used +to set the qcount on TC0 (by default only TC0 exists so all of the +existing queues are assigned to TC0). we update the offset/qcount via +netdev_set_tc_queue() back to the old value but then the +netif_set_real_num_tx_queues() is using the vsi->num_queue_pairs as a +value which got set to 40. + +Fix it by using vsi->req_queue_pairs as a queue count that will be +distributed across TCs. Do it only for non-zero values, which implies +that user actually requested the new count of queues. + +For VSIs other than main, stay with the vsi->alloc_queue_pairs as we +only allow manipulating the queue count on main VSI. + +Fixes: bc6d33c8d93f ("i40e: Fix the number of queues available to be mapped for use") +Co-developed-by: Maciej Fijalkowski +Signed-off-by: Maciej Fijalkowski +Co-developed-by: Przemyslaw Patynowski +Signed-off-by: Przemyslaw Patynowski +Signed-off-by: Eryk Rybak +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 35 ++++++++++++++------- + 1 file changed, 23 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index d948ca6368422..222eb82d56109 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1765,6 +1765,7 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + bool is_add) + { + struct i40e_pf *pf = vsi->back; ++ u16 num_tc_qps = 0; + u16 sections = 0; + u8 netdev_tc = 0; + u16 numtc = 1; +@@ -1772,13 +1773,29 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + u8 offset; + u16 qmap; + int i; +- u16 num_tc_qps = 0; + + sections = I40E_AQ_VSI_PROP_QUEUE_MAP_VALID; + offset = 0; + ++ if (vsi->type == I40E_VSI_MAIN) { ++ /* This code helps add more queue to the VSI if we have ++ * more cores than RSS can support, the higher cores will ++ * be served by ATR or other filters. Furthermore, the ++ * non-zero req_queue_pairs says that user requested a new ++ * queue count via ethtool's set_channels, so use this ++ * value for queues distribution across traffic classes ++ */ ++ if (vsi->req_queue_pairs > 0) ++ vsi->num_queue_pairs = vsi->req_queue_pairs; ++ else if (pf->flags & I40E_FLAG_MSIX_ENABLED) ++ vsi->num_queue_pairs = pf->num_lan_msix; ++ } ++ + /* Number of queues per enabled TC */ +- num_tc_qps = vsi->alloc_queue_pairs; ++ if (vsi->type == I40E_VSI_MAIN) ++ num_tc_qps = vsi->num_queue_pairs; ++ else ++ num_tc_qps = vsi->alloc_queue_pairs; + if (enabled_tc && (vsi->back->flags & I40E_FLAG_DCB_ENABLED)) { + /* Find numtc from enabled TC bitmap */ + for (i = 0, numtc = 0; i < I40E_MAX_TRAFFIC_CLASS; i++) { +@@ -1856,16 +1873,10 @@ static void i40e_vsi_setup_queue_map(struct i40e_vsi *vsi, + } + ctxt->info.tc_mapping[i] = cpu_to_le16(qmap); + } +- +- /* Set actual Tx/Rx queue pairs */ +- vsi->num_queue_pairs = offset; +- if ((vsi->type == I40E_VSI_MAIN) && (numtc == 1)) { +- if (vsi->req_queue_pairs > 0) +- vsi->num_queue_pairs = vsi->req_queue_pairs; +- else if (pf->flags & I40E_FLAG_MSIX_ENABLED) +- vsi->num_queue_pairs = pf->num_lan_msix; +- } +- ++ /* Do not change previously set num_queue_pairs for PFs */ ++ if ((vsi->type == I40E_VSI_MAIN && numtc != 1) || ++ vsi->type != I40E_VSI_MAIN) ++ vsi->num_queue_pairs = offset; + /* Scheduler section valid can only be set for ADD VSI */ + if (is_add) { + sections |= I40E_AQ_VSI_PROP_SCHED_VALID; +-- +2.33.0 + diff --git a/queue-4.19/i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch b/queue-4.19/i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch new file mode 100644 index 00000000000..258f8332dd6 --- /dev/null +++ b/queue-4.19/i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch @@ -0,0 +1,118 @@ +From 1c5f63d1b271e9eab70cfc1ef2bb4a6db4183da2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Jan 2021 16:17:22 +0000 +Subject: i40e: Fix correct max_pkt_size on VF RX queue + +From: Eryk Rybak + +[ Upstream commit 6afbd7b3c53cb7417189f476e99d431daccb85b0 ] + +Setting VLAN port increasing RX queue max_pkt_size +by 4 bytes to take VLAN tag into account. +Trigger the VF reset when setting port VLAN for +VF to renegotiate its capabilities and reinitialize. + +Fixes: ba4e003d29c1 ("i40e: don't hold spinlock while resetting VF") +Signed-off-by: Sylwester Dziedziuch +Signed-off-by: Aleksandr Loktionov +Signed-off-by: Eryk Rybak +Tested-by: Konrad Jankowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 53 ++++--------------- + 1 file changed, 9 insertions(+), 44 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 3c1533c627fd0..02d245970d7fa 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -621,14 +621,13 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, + u16 vsi_queue_id, + struct virtchnl_rxq_info *info) + { ++ u16 pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id); + struct i40e_pf *pf = vf->pf; ++ struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx]; + struct i40e_hw *hw = &pf->hw; + struct i40e_hmc_obj_rxq rx_ctx; +- u16 pf_queue_id; + int ret = 0; + +- pf_queue_id = i40e_vc_get_pf_queue_id(vf, vsi_id, vsi_queue_id); +- + /* clear the context structure first */ + memset(&rx_ctx, 0, sizeof(struct i40e_hmc_obj_rxq)); + +@@ -666,6 +665,10 @@ static int i40e_config_vsi_rx_queue(struct i40e_vf *vf, u16 vsi_id, + } + rx_ctx.rxmax = info->max_pkt_size; + ++ /* if port VLAN is configured increase the max packet size */ ++ if (vsi->info.pvid) ++ rx_ctx.rxmax += VLAN_HLEN; ++ + /* enable 32bytes desc always */ + rx_ctx.dsize = 1; + +@@ -3927,34 +3930,6 @@ error_param: + return ret; + } + +-/** +- * i40e_vsi_has_vlans - True if VSI has configured VLANs +- * @vsi: pointer to the vsi +- * +- * Check if a VSI has configured any VLANs. False if we have a port VLAN or if +- * we have no configured VLANs. Do not call while holding the +- * mac_filter_hash_lock. +- */ +-static bool i40e_vsi_has_vlans(struct i40e_vsi *vsi) +-{ +- bool have_vlans; +- +- /* If we have a port VLAN, then the VSI cannot have any VLANs +- * configured, as all MAC/VLAN filters will be assigned to the PVID. +- */ +- if (vsi->info.pvid) +- return false; +- +- /* Since we don't have a PVID, we know that if the device is in VLAN +- * mode it must be because of a VLAN filter configured on this VSI. +- */ +- spin_lock_bh(&vsi->mac_filter_hash_lock); +- have_vlans = i40e_is_vsi_in_vlan(vsi); +- spin_unlock_bh(&vsi->mac_filter_hash_lock); +- +- return have_vlans; +-} +- + /** + * i40e_ndo_set_vf_port_vlan + * @netdev: network interface device structure +@@ -4007,19 +3982,9 @@ int i40e_ndo_set_vf_port_vlan(struct net_device *netdev, int vf_id, + /* duplicate request, so just return success */ + goto error_pvid; + +- if (i40e_vsi_has_vlans(vsi)) { +- dev_err(&pf->pdev->dev, +- "VF %d has already configured VLAN filters and the administrator is requesting a port VLAN override.\nPlease unload and reload the VF driver for this change to take effect.\n", +- vf_id); +- /* Administrator Error - knock the VF offline until he does +- * the right thing by reconfiguring his network correctly +- * and then reloading the VF driver. +- */ +- i40e_vc_disable_vf(vf); +- /* During reset the VF got a new VSI, so refresh the pointer. */ +- vsi = pf->vsi[vf->lan_vsi_idx]; +- } +- ++ i40e_vc_disable_vf(vf); ++ /* During reset the VF got a new VSI, so refresh a pointer. */ ++ vsi = pf->vsi[vf->lan_vsi_idx]; + /* Locked once because multiple functions below iterate list */ + spin_lock_bh(&vsi->mac_filter_hash_lock); + +-- +2.33.0 + diff --git a/queue-4.19/i40e-fix-display-error-code-in-dmesg.patch b/queue-4.19/i40e-fix-display-error-code-in-dmesg.patch new file mode 100644 index 00000000000..6886ea41099 --- /dev/null +++ b/queue-4.19/i40e-fix-display-error-code-in-dmesg.patch @@ -0,0 +1,42 @@ +From 35f1cf48db783e5e4796be3d0380bcda87ac88e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 11:26:01 +0200 +Subject: i40e: Fix display error code in dmesg + +From: Grzegorz Szczurek + +[ Upstream commit 5aff430d4e33a0b48a6b3d5beb06f79da23f9916 ] + +Fix misleading display error in dmesg if tc filter return fail. +Only i40e status error code should be converted to string, not linux +error code. Otherwise, we return false information about the error. + +Fixes: 2f4b411a3d67 ("i40e: Enable cloud filters via tc-flower") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Mateusz Palczewski +Tested-by: Dave Switzer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 222eb82d56109..51edc7fdc9b9e 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -7517,9 +7517,8 @@ static int i40e_configure_clsflower(struct i40e_vsi *vsi, + err = i40e_add_del_cloud_filter(vsi, filter, true); + + if (err) { +- dev_err(&pf->pdev->dev, +- "Failed to add cloud filter, err %s\n", +- i40e_stat_str(&pf->hw, err)); ++ dev_err(&pf->pdev->dev, "Failed to add cloud filter, err %d\n", ++ err); + goto err; + } + +-- +2.33.0 + diff --git a/queue-4.19/i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch b/queue-4.19/i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch new file mode 100644 index 00000000000..65d10201226 --- /dev/null +++ b/queue-4.19/i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch @@ -0,0 +1,68 @@ +From 29b859d360c29f6036750d55d9d156e61a2583b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Feb 2021 12:07:48 +0000 +Subject: i40e: Fix NULL ptr dereference on VSI filter sync + +From: Michal Maloszewski + +[ Upstream commit 37d9e304acd903a445df8208b8a13d707902dea6 ] + +Remove the reason of null pointer dereference in sync VSI filters. +Added new I40E_VSI_RELEASING flag to signalize deleting and releasing +of VSI resources to sync this thread with sync filters subtask. +Without this patch it is possible to start update the VSI filter list +after VSI is removed, that's causing a kernel oops. + +Fixes: 41c445ff0f48 ("i40e: main driver core") +Signed-off-by: Grzegorz Szczurek +Signed-off-by: Michal Maloszewski +Reviewed-by: Przemyslaw Patynowski +Reviewed-by: Witold Fijalkowski +Reviewed-by: Jaroslaw Gawin +Reviewed-by: Aleksandr Loktionov +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e.h | 1 + + drivers/net/ethernet/intel/i40e/i40e_main.c | 5 +++-- + 2 files changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e.h b/drivers/net/ethernet/intel/i40e/i40e.h +index 3c921dfc20564..519b595944235 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e.h ++++ b/drivers/net/ethernet/intel/i40e/i40e.h +@@ -166,6 +166,7 @@ enum i40e_vsi_state_t { + __I40E_VSI_OVERFLOW_PROMISC, + __I40E_VSI_REINIT_REQUESTED, + __I40E_VSI_DOWN_REQUESTED, ++ __I40E_VSI_RELEASING, + /* This must be last as it determines the size of the BITMAP */ + __I40E_VSI_STATE_SIZE__, + }; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 062b942517822..d948ca6368422 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -2584,7 +2584,8 @@ static void i40e_sync_filters_subtask(struct i40e_pf *pf) + + for (v = 0; v < pf->num_alloc_vsi; v++) { + if (pf->vsi[v] && +- (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED)) { ++ (pf->vsi[v]->flags & I40E_VSI_FLAG_FILTER_CHANGED) && ++ !test_bit(__I40E_VSI_RELEASING, pf->vsi[v]->state)) { + int ret = i40e_sync_vsi_filters(pf->vsi[v]); + + if (ret) { +@@ -12444,7 +12445,7 @@ int i40e_vsi_release(struct i40e_vsi *vsi) + dev_info(&pf->pdev->dev, "Can't remove PF VSI\n"); + return -ENODEV; + } +- ++ set_bit(__I40E_VSI_RELEASING, vsi->state); + uplink_seid = vsi->uplink_seid; + if (vsi->type != I40E_VSI_SRIOV) { + if (vsi->netdev_registered) { +-- +2.33.0 + diff --git a/queue-4.19/iavf-check-for-null-in-iavf_fix_features.patch b/queue-4.19/iavf-check-for-null-in-iavf_fix_features.patch new file mode 100644 index 00000000000..07eaedd12d3 --- /dev/null +++ b/queue-4.19/iavf-check-for-null-in-iavf_fix_features.patch @@ -0,0 +1,41 @@ +From 4b3c74718f59ed553bfdb2b27af8a759b3ce118d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:53 -0700 +Subject: iavf: check for null in iavf_fix_features + +From: Nicholas Nunley + +[ Upstream commit 8a4a126f4be88eb8b5f00a165ab58c35edf4ef76 ] + +If the driver has lost contact with the PF then it enters a disabled state +and frees adapter->vf_res. However, ndo_fix_features can still be called on +the interface, so we need to check for this condition first. Since we have +no information on the features at this time simply leave them unmodified +and return. + +Fixes: c4445aedfe09 ("i40evf: Fix VLAN features") +Signed-off-by: Nicholas Nunley +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40evf/i40evf_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +index ac5709624c7ad..1fd8cc5ac306c 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c ++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +@@ -3185,7 +3185,8 @@ static netdev_features_t i40evf_fix_features(struct net_device *netdev, + { + struct i40evf_adapter *adapter = netdev_priv(netdev); + +- if (!(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)) ++ if (adapter->vf_res && ++ !(adapter->vf_res->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN)) + features &= ~(NETIF_F_HW_VLAN_CTAG_TX | + NETIF_F_HW_VLAN_CTAG_RX | + NETIF_F_HW_VLAN_CTAG_FILTER); +-- +2.33.0 + diff --git a/queue-4.19/iavf-fix-for-the-false-positive-asq-arq-errors-while.patch b/queue-4.19/iavf-fix-for-the-false-positive-asq-arq-errors-while.patch new file mode 100644 index 00000000000..653ea729d5d --- /dev/null +++ b/queue-4.19/iavf-fix-for-the-false-positive-asq-arq-errors-while.patch @@ -0,0 +1,43 @@ +From 9d06c9e9b610254905d4a1405025d45a45a904e7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 09:48:59 -0700 +Subject: iavf: Fix for the false positive ASQ/ARQ errors while issuing VF + reset + +From: Surabhi Boob + +[ Upstream commit 321421b57a12e933f92b228e0e6d0b2c6541f41d ] + +While issuing VF Reset from the guest OS, the VF driver prints +logs about critical / Overflow error detection. This is not an +actual error since the VF_MBX_ARQLEN register is set to all FF's +for a short period of time and the VF would catch the bits set if +it was reading the register during that spike of time. +This patch introduces an additional check to ignore this condition +since the VF is in reset. + +Fixes: 19b73d8efaa4 ("i40evf: Add additional check for reset") +Signed-off-by: Surabhi Boob +Tested-by: Tony Brelinski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40evf/i40evf_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +index 1fd8cc5ac306c..5a6e579e9e653 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c ++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +@@ -2058,7 +2058,7 @@ static void i40evf_adminq_task(struct work_struct *work) + + /* check for error indications */ + val = rd32(hw, hw->aq.arq.len); +- if (val == 0xdeadbeef) /* indicates device in reset */ ++ if (val == 0xdeadbeef || val == 0xffffffff) /* device in reset */ + goto freedom; + oldval = val; + if (val & I40E_VF_ARQLEN1_ARQVFE_MASK) { +-- +2.33.0 + diff --git a/queue-4.19/maple-fix-wrong-return-value-of-maple_bus_init.patch b/queue-4.19/maple-fix-wrong-return-value-of-maple_bus_init.patch new file mode 100644 index 00000000000..5fcb76c2736 --- /dev/null +++ b/queue-4.19/maple-fix-wrong-return-value-of-maple_bus_init.patch @@ -0,0 +1,50 @@ +From 28370d0fb42a1db15fa0c5e5dccf62b1511c3e1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 10:43:11 +0800 +Subject: maple: fix wrong return value of maple_bus_init(). + +From: Lu Wei + +[ Upstream commit bde82ee391fa6d3ad054313c4aa7b726d32515ce ] + +If KMEM_CACHE or maple_alloc_dev failed, the maple_bus_init() will return 0 +rather than error, because the retval is not changed after KMEM_CACHE or +maple_alloc_dev failed. + +Fixes: 17be2d2b1c33 ("sh: Add maple bus support for the SEGA Dreamcast.") +Reported-by: Hulk Robot +Signed-off-by: Lu Wei +Acked-by: John Paul Adrian Glaubitz +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + drivers/sh/maple/maple.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/sh/maple/maple.c b/drivers/sh/maple/maple.c +index e5d7fb81ad665..44a931d41a132 100644 +--- a/drivers/sh/maple/maple.c ++++ b/drivers/sh/maple/maple.c +@@ -835,8 +835,10 @@ static int __init maple_bus_init(void) + + maple_queue_cache = KMEM_CACHE(maple_buffer, SLAB_HWCACHE_ALIGN); + +- if (!maple_queue_cache) ++ if (!maple_queue_cache) { ++ retval = -ENOMEM; + goto cleanup_bothirqs; ++ } + + INIT_LIST_HEAD(&maple_waitq); + INIT_LIST_HEAD(&maple_sentq); +@@ -849,6 +851,7 @@ static int __init maple_bus_init(void) + if (!mdev[i]) { + while (i-- > 0) + maple_free_dev(mdev[i]); ++ retval = -ENOMEM; + goto cleanup_cache; + } + baseunits[i] = mdev[i]; +-- +2.33.0 + diff --git a/queue-4.19/mips-bcm63xx-add-support-for-clk_get_parent.patch b/queue-4.19/mips-bcm63xx-add-support-for-clk_get_parent.patch new file mode 100644 index 00000000000..f0d83933b8f --- /dev/null +++ b/queue-4.19/mips-bcm63xx-add-support-for-clk_get_parent.patch @@ -0,0 +1,65 @@ +From 551cfef9043bbea19952254abe4b55e3c4fcd98e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 16:42:18 -0800 +Subject: mips: bcm63xx: add support for clk_get_parent() + +From: Randy Dunlap + +[ Upstream commit e8f67482e5a4bc8d0b65d606d08cb60ee123b468 ] + +BCM63XX selects HAVE_LEGACY_CLK but does not provide/support +clk_get_parent(), so add a simple implementation of that +function so that callers of it will build without errors. + +Fixes these build errors: + +mips-linux-ld: drivers/iio/adc/ingenic-adc.o: in function `jz4770_adc_init_clk_div': +ingenic-adc.c:(.text+0xe4): undefined reference to `clk_get_parent' +mips-linux-ld: drivers/iio/adc/ingenic-adc.o: in function `jz4725b_adc_init_clk_div': +ingenic-adc.c:(.text+0x1b8): undefined reference to `clk_get_parent' + +Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs." ) +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Suggested-by: Russell King (Oracle) +Cc: Artur Rojek +Cc: Paul Cercueil +Cc: linux-mips@vger.kernel.org +Cc: Jonathan Cameron +Cc: Lars-Peter Clausen +Cc: linux-iio@vger.kernel.org +Cc: Florian Fainelli +Cc: Andy Shevchenko +Cc: Russell King +Cc: bcm-kernel-feedback-list@broadcom.com +Cc: Jonas Gorski +Reviewed-by: Andy Shevchenko +Acked-by: Jonathan Cameron +Acked-by: Russell King (Oracle) +Acked-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/bcm63xx/clk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/mips/bcm63xx/clk.c b/arch/mips/bcm63xx/clk.c +index 164115944a7fd..aba6e2d6a736c 100644 +--- a/arch/mips/bcm63xx/clk.c ++++ b/arch/mips/bcm63xx/clk.c +@@ -381,6 +381,12 @@ void clk_disable(struct clk *clk) + + EXPORT_SYMBOL(clk_disable); + ++struct clk *clk_get_parent(struct clk *clk) ++{ ++ return NULL; ++} ++EXPORT_SYMBOL(clk_get_parent); ++ + unsigned long clk_get_rate(struct clk *clk) + { + if (!clk) +-- +2.33.0 + diff --git a/queue-4.19/mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch b/queue-4.19/mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch new file mode 100644 index 00000000000..57fc5e5c494 --- /dev/null +++ b/queue-4.19/mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch @@ -0,0 +1,64 @@ +From 7e668b653e2d23a3f2d642e6b783d87ec311ed8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 6 Nov 2021 08:49:11 -0700 +Subject: mips: BCM63XX: ensure that CPU_SUPPORTS_32BIT_KERNEL is set + +From: Randy Dunlap + +[ Upstream commit 5eeaafc8d69373c095e461bdb39e5c9b62228ac5 ] + +Several header files need info on CONFIG_32BIT or CONFIG_64BIT, +but kconfig symbol BCM63XX does not provide that info. This leads +to many build errors, e.g.: + + arch/mips/include/asm/page.h:196:13: error: use of undeclared identifier 'CAC_BASE' + return x - PAGE_OFFSET + PHYS_OFFSET; + arch/mips/include/asm/mach-generic/spaces.h:91:23: note: expanded from macro 'PAGE_OFFSET' + #define PAGE_OFFSET (CAC_BASE + PHYS_OFFSET) + arch/mips/include/asm/io.h:134:28: error: use of undeclared identifier 'CAC_BASE' + return (void *)(address + PAGE_OFFSET - PHYS_OFFSET); + arch/mips/include/asm/mach-generic/spaces.h:91:23: note: expanded from macro 'PAGE_OFFSET' + #define PAGE_OFFSET (CAC_BASE + PHYS_OFFSET) + +arch/mips/include/asm/uaccess.h:82:10: error: use of undeclared identifier '__UA_LIMIT' + return (__UA_LIMIT & (addr | (addr + size) | __ua_size(size))) == 0; + +Selecting the SYS_HAS_CPU_BMIPS* symbols causes SYS_HAS_CPU_BMIPS to be +set, which then selects CPU_SUPPORT_32BIT_KERNEL, which causes +CONFIG_32BIT to be set. (a bit more indirect than v1 [RFC].) + +Fixes: e7300d04bd08 ("MIPS: BCM63xx: Add support for the Broadcom BCM63xx family of SOCs.") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Thomas Bogendoerfer +Cc: Florian Fainelli +Cc: bcm-kernel-feedback-list@broadcom.com +Cc: linux-mips@vger.kernel.org +Cc: Paul Burton +Cc: Maxime Bizon +Cc: Ralf Baechle +Suggested-by: Florian Fainelli +Acked-by: Florian Fainelli +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/Kconfig | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index fb8554c41e803..e513528be3ad7 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -285,6 +285,9 @@ config BCM63XX + select SYS_SUPPORTS_32BIT_KERNEL + select SYS_SUPPORTS_BIG_ENDIAN + select SYS_HAS_EARLY_PRINTK ++ select SYS_HAS_CPU_BMIPS32_3300 ++ select SYS_HAS_CPU_BMIPS4350 ++ select SYS_HAS_CPU_BMIPS4380 + select SWAP_IO_SPACE + select GPIOLIB + select HAVE_CLK +-- +2.33.0 + diff --git a/queue-4.19/mips-generic-yamon-dt-fix-uninitialized-variable-err.patch b/queue-4.19/mips-generic-yamon-dt-fix-uninitialized-variable-err.patch new file mode 100644 index 00000000000..8cbaae7eb00 --- /dev/null +++ b/queue-4.19/mips-generic-yamon-dt-fix-uninitialized-variable-err.patch @@ -0,0 +1,41 @@ +From f834640c0dc737c8cf8e0fd96ef024025b617734 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 23:28:24 +0000 +Subject: MIPS: generic/yamon-dt: fix uninitialized variable error + +From: Colin Ian King + +[ Upstream commit 255e51da15baed47531beefd02f222e4dc01f1c1 ] + +In the case where fw_getenv returns an error when fetching values +for ememsizea and memsize then variable phys_memsize is not assigned +a variable and will be uninitialized on a zero check of phys_memsize. +Fix this by initializing phys_memsize to zero. + +Cleans up cppcheck error: +arch/mips/generic/yamon-dt.c:100:7: error: Uninitialized variable: phys_memsize [uninitvar] + +Fixes: f41d2430bbd6 ("MIPS: generic/yamon-dt: Support > 256MB of RAM") +Signed-off-by: Colin Ian King +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/generic/yamon-dt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/generic/yamon-dt.c b/arch/mips/generic/yamon-dt.c +index 7ba4ad5cc1d66..7b7ba0f76c60e 100644 +--- a/arch/mips/generic/yamon-dt.c ++++ b/arch/mips/generic/yamon-dt.c +@@ -79,7 +79,7 @@ static unsigned int __init gen_fdt_mem_array( + __init int yamon_dt_append_memory(void *fdt, + const struct yamon_mem_region *regions) + { +- unsigned long phys_memsize, memsize; ++ unsigned long phys_memsize = 0, memsize; + __be32 mem_array[2 * MAX_MEM_ARRAY_ENTRIES]; + unsigned int mem_entries; + int i, err, mem_off; +-- +2.33.0 + diff --git a/queue-4.19/mips-lantiq-add-support-for-clk_get_parent.patch b/queue-4.19/mips-lantiq-add-support-for-clk_get_parent.patch new file mode 100644 index 00000000000..fe998bd1eb6 --- /dev/null +++ b/queue-4.19/mips-lantiq-add-support-for-clk_get_parent.patch @@ -0,0 +1,53 @@ +From c85e8af0f76f901834915e01e4682b5837edecaf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 17:20:51 -0800 +Subject: mips: lantiq: add support for clk_get_parent() + +From: Randy Dunlap + +[ Upstream commit fc1aabb088860d6cf9dd03612b7a6f0de91ccac2 ] + +Provide a simple implementation of clk_get_parent() in the +lantiq subarch so that callers of it will build without errors. + +Fixes this build error: +ERROR: modpost: "clk_get_parent" [drivers/iio/adc/ingenic-adc.ko] undefined! + +Fixes: 171bb2f19ed6 ("MIPS: Lantiq: Add initial support for Lantiq SoCs") +Signed-off-by: Randy Dunlap +Suggested-by: Russell King (Oracle) +Cc: linux-mips@vger.kernel.org +Cc: John Crispin +Cc: Thomas Bogendoerfer +Cc: Jonathan Cameron +Cc: linux-iio@vger.kernel.org +Cc: Russell King +Cc: Andy Shevchenko +Acked-by: Jonathan Cameron +Acked-by: John Crispin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/lantiq/clk.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/mips/lantiq/clk.c b/arch/mips/lantiq/clk.c +index a263d1b751ffe..a8e309dcd38d7 100644 +--- a/arch/mips/lantiq/clk.c ++++ b/arch/mips/lantiq/clk.c +@@ -160,6 +160,12 @@ void clk_deactivate(struct clk *clk) + } + EXPORT_SYMBOL(clk_deactivate); + ++struct clk *clk_get_parent(struct clk *clk) ++{ ++ return NULL; ++} ++EXPORT_SYMBOL(clk_get_parent); ++ + static inline u32 get_counter_resolution(void) + { + u32 res; +-- +2.33.0 + diff --git a/queue-4.19/mips-sni-fix-the-build.patch b/queue-4.19/mips-sni-fix-the-build.patch new file mode 100644 index 00000000000..f2b86d6be59 --- /dev/null +++ b/queue-4.19/mips-sni-fix-the-build.patch @@ -0,0 +1,54 @@ +From d1f5750a275ca70600683462c296f175d0c76b4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Oct 2021 15:23:12 -0700 +Subject: MIPS: sni: Fix the build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Bart Van Assche + +[ Upstream commit c91cf42f61dc77b289784ea7b15a8531defa41c0 ] + +This patch fixes the following gcc 10 build error: + +arch/mips/sni/time.c: In function ‘a20r_set_periodic’: +arch/mips/sni/time.c:15:26: error: unsigned conversion from ‘int’ to ‘u8’ {aka ‘volatile unsigned char’} changes value from ‘576’ to ‘64’ [-Werror=overflow] + 15 | #define SNI_COUNTER0_DIV ((SNI_CLOCK_TICK_RATE / SNI_COUNTER2_DIV) / HZ) + | ^ +arch/mips/sni/time.c:21:45: note: in expansion of macro ‘SNI_COUNTER0_DIV’ + 21 | *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV; + | ^~~~~~~~~~~~~~~~ + +Cc: linux-mips@vger.kernel.org +Signed-off-by: Bart Van Assche +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/sni/time.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/sni/time.c b/arch/mips/sni/time.c +index dbace1f3e1a97..745ceb945fc50 100644 +--- a/arch/mips/sni/time.c ++++ b/arch/mips/sni/time.c +@@ -18,14 +18,14 @@ static int a20r_set_periodic(struct clock_event_device *evt) + { + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0x34; + wmb(); +- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV; ++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV & 0xff; + wmb(); + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 0) = SNI_COUNTER0_DIV >> 8; + wmb(); + + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 12) = 0xb4; + wmb(); +- *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV; ++ *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV & 0xff; + wmb(); + *(volatile u8 *)(A20R_PT_CLOCK_BASE + 8) = SNI_COUNTER2_DIV >> 8; + wmb(); +-- +2.33.0 + diff --git a/queue-4.19/net-bnx2x-fix-variable-dereferenced-before-check.patch b/queue-4.19/net-bnx2x-fix-variable-dereferenced-before-check.patch new file mode 100644 index 00000000000..f7138bb1659 --- /dev/null +++ b/queue-4.19/net-bnx2x-fix-variable-dereferenced-before-check.patch @@ -0,0 +1,46 @@ +From 90d7e4d5058687cfe05770b273be7a67db766d85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Nov 2021 01:36:36 +0300 +Subject: net: bnx2x: fix variable dereferenced before check + +From: Pavel Skripkin + +[ Upstream commit f8885ac89ce310570e5391fe0bf0ec9c7c9b4fdc ] + +Smatch says: + bnx2x_init_ops.h:640 bnx2x_ilt_client_mem_op() + warn: variable dereferenced before check 'ilt' (see line 638) + +Move ilt_cli variable initialization _after_ ilt validation, because +it's unsafe to deref the pointer before validation check. + +Fixes: 523224a3b3cd ("bnx2x, cnic, bnx2i: use new FW/HSI") +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h +index 1835d2e451c01..fc7fce642666c 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_init_ops.h +@@ -635,11 +635,13 @@ static int bnx2x_ilt_client_mem_op(struct bnx2x *bp, int cli_num, + { + int i, rc; + struct bnx2x_ilt *ilt = BP_ILT(bp); +- struct ilt_client_info *ilt_cli = &ilt->clients[cli_num]; ++ struct ilt_client_info *ilt_cli; + + if (!ilt || !ilt->lines) + return -1; + ++ ilt_cli = &ilt->clients[cli_num]; ++ + if (ilt_cli->flags & (ILT_CLIENT_SKIP_INIT | ILT_CLIENT_SKIP_MEM)) + return 0; + +-- +2.33.0 + diff --git a/queue-4.19/net-virtio_net_hdr_to_skb-count-transport-header-in-.patch b/queue-4.19/net-virtio_net_hdr_to_skb-count-transport-header-in-.patch new file mode 100644 index 00000000000..95b2f988ffc --- /dev/null +++ b/queue-4.19/net-virtio_net_hdr_to_skb-count-transport-header-in-.patch @@ -0,0 +1,75 @@ +From 366e6ed66ec98cb336f9623e1a9d49e80cd84ab1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 17:42:42 +0000 +Subject: net: virtio_net_hdr_to_skb: count transport header in UFO + +From: Jonathan Davies + +[ Upstream commit cf9acc90c80ecbee00334aa85d92f4e74014bcff ] + +virtio_net_hdr_to_skb does not set the skb's gso_size and gso_type +correctly for UFO packets received via virtio-net that are a little over +the GSO size. This can lead to problems elsewhere in the networking +stack, e.g. ovs_vport_send dropping over-sized packets if gso_size is +not set. + +This is due to the comparison + + if (skb->len - p_off > gso_size) + +not properly accounting for the transport layer header. + +p_off includes the size of the transport layer header (thlen), so +skb->len - p_off is the size of the TCP/UDP payload. + +gso_size is read from the virtio-net header. For UFO, fragmentation +happens at the IP level so does not need to include the UDP header. + +Hence the calculation could be comparing a TCP/UDP payload length with +an IP payload length, causing legitimate virtio-net packets to have +lack gso_type/gso_size information. + +Example: a UDP packet with payload size 1473 has IP payload size 1481. +If the guest used UFO, it is not fragmented and the virtio-net header's +flags indicate that it is a GSO frame (VIRTIO_NET_HDR_GSO_UDP), with +gso_size = 1480 for an MTU of 1500. skb->len will be 1515 and p_off +will be 42, so skb->len - p_off = 1473. Hence the comparison fails, and +shinfo->gso_size and gso_type are not set as they should be. + +Instead, add the UDP header length before comparing to gso_size when +using UFO. In this way, it is the size of the IP payload that is +compared to gso_size. + +Fixes: 6dd912f82680 ("net: check untrusted gso_size at kernel entry") +Signed-off-by: Jonathan Davies +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/linux/virtio_net.h | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h +index 8f48264f5dab3..e7330a9a7d7dc 100644 +--- a/include/linux/virtio_net.h ++++ b/include/linux/virtio_net.h +@@ -120,10 +120,15 @@ retry: + + if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) { + u16 gso_size = __virtio16_to_cpu(little_endian, hdr->gso_size); ++ unsigned int nh_off = p_off; + struct skb_shared_info *shinfo = skb_shinfo(skb); + ++ /* UFO may not include transport header in gso_size. */ ++ if (gso_type & SKB_GSO_UDP) ++ nh_off -= thlen; ++ + /* Too small packets are not really GSO ones. */ +- if (skb->len - p_off > gso_size) { ++ if (skb->len - nh_off > gso_size) { + shinfo->gso_size = gso_size; + shinfo->gso_type = gso_type; + +-- +2.33.0 + diff --git a/queue-4.19/nfc-reorder-the-logic-in-nfc_-un-register_device.patch b/queue-4.19/nfc-reorder-the-logic-in-nfc_-un-register_device.patch new file mode 100644 index 00000000000..e6196b41459 --- /dev/null +++ b/queue-4.19/nfc-reorder-the-logic-in-nfc_-un-register_device.patch @@ -0,0 +1,129 @@ +From 6438a518d25ca1eaf6a6ecca460646e118834ff2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Nov 2021 23:26:52 +0800 +Subject: NFC: reorder the logic in nfc_{un,}register_device + +From: Lin Ma + +[ Upstream commit 3e3b5dfcd16a3e254aab61bd1e8c417dd4503102 ] + +There is a potential UAF between the unregistration routine and the NFC +netlink operations. + +The race that cause that UAF can be shown as below: + + (FREE) | (USE) +nfcmrvl_nci_unregister_dev | nfc_genl_dev_up + nci_close_device | + nci_unregister_device | nfc_get_device + nfc_unregister_device | nfc_dev_up + rfkill_destory | + device_del | rfkill_blocked + ... | ... + +The root cause for this race is concluded below: +1. The rfkill_blocked (USE) in nfc_dev_up is supposed to be placed after +the device_is_registered check. +2. Since the netlink operations are possible just after the device_add +in nfc_register_device, the nfc_dev_up() can happen anywhere during the +rfkill creation process, which leads to data race. + +This patch reorder these actions to permit +1. Once device_del is finished, the nfc_dev_up cannot dereference the +rfkill object. +2. The rfkill_register need to be placed after the device_add of nfc_dev +because the parent device need to be created first. So this patch keeps +the order but inject device_lock to prevent the data race. + +Signed-off-by: Lin Ma +Fixes: be055b2f89b5 ("NFC: RFKILL support") +Reviewed-by: Jakub Kicinski +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20211116152652.19217-1-linma@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/nfc/core.c | 32 ++++++++++++++++++-------------- + 1 file changed, 18 insertions(+), 14 deletions(-) + +diff --git a/net/nfc/core.c b/net/nfc/core.c +index 947a470f929d6..ff646d1758d16 100644 +--- a/net/nfc/core.c ++++ b/net/nfc/core.c +@@ -106,13 +106,13 @@ int nfc_dev_up(struct nfc_dev *dev) + + device_lock(&dev->dev); + +- if (dev->rfkill && rfkill_blocked(dev->rfkill)) { +- rc = -ERFKILL; ++ if (!device_is_registered(&dev->dev)) { ++ rc = -ENODEV; + goto error; + } + +- if (!device_is_registered(&dev->dev)) { +- rc = -ENODEV; ++ if (dev->rfkill && rfkill_blocked(dev->rfkill)) { ++ rc = -ERFKILL; + goto error; + } + +@@ -1130,11 +1130,7 @@ int nfc_register_device(struct nfc_dev *dev) + if (rc) + pr_err("Could not register llcp device\n"); + +- rc = nfc_genl_device_added(dev); +- if (rc) +- pr_debug("The userspace won't be notified that the device %s was added\n", +- dev_name(&dev->dev)); +- ++ device_lock(&dev->dev); + dev->rfkill = rfkill_alloc(dev_name(&dev->dev), &dev->dev, + RFKILL_TYPE_NFC, &nfc_rfkill_ops, dev); + if (dev->rfkill) { +@@ -1143,6 +1139,12 @@ int nfc_register_device(struct nfc_dev *dev) + dev->rfkill = NULL; + } + } ++ device_unlock(&dev->dev); ++ ++ rc = nfc_genl_device_added(dev); ++ if (rc) ++ pr_debug("The userspace won't be notified that the device %s was added\n", ++ dev_name(&dev->dev)); + + return 0; + } +@@ -1159,10 +1161,17 @@ void nfc_unregister_device(struct nfc_dev *dev) + + pr_debug("dev_name=%s\n", dev_name(&dev->dev)); + ++ rc = nfc_genl_device_removed(dev); ++ if (rc) ++ pr_debug("The userspace won't be notified that the device %s " ++ "was removed\n", dev_name(&dev->dev)); ++ ++ device_lock(&dev->dev); + if (dev->rfkill) { + rfkill_unregister(dev->rfkill); + rfkill_destroy(dev->rfkill); + } ++ device_unlock(&dev->dev); + + if (dev->ops->check_presence) { + device_lock(&dev->dev); +@@ -1172,11 +1181,6 @@ void nfc_unregister_device(struct nfc_dev *dev) + cancel_work_sync(&dev->check_pres_work); + } + +- rc = nfc_genl_device_removed(dev); +- if (rc) +- pr_debug("The userspace won't be notified that the device %s " +- "was removed\n", dev_name(&dev->dev)); +- + nfc_llcp_unregister_device(dev); + + mutex_lock(&nfc_devlist_mutex); +-- +2.33.0 + diff --git a/queue-4.19/nfc-reorganize-the-functions-in-nci_request.patch b/queue-4.19/nfc-reorganize-the-functions-in-nci_request.patch new file mode 100644 index 00000000000..c2f03428a95 --- /dev/null +++ b/queue-4.19/nfc-reorganize-the-functions-in-nci_request.patch @@ -0,0 +1,62 @@ +From 2e03efe337dbaa9a553a63a2141af233572583f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 15 Nov 2021 22:56:00 +0800 +Subject: NFC: reorganize the functions in nci_request + +From: Lin Ma + +[ Upstream commit 86cdf8e38792545161dbe3350a7eced558ba4d15 ] + +There is a possible data race as shown below: + +thread-A in nci_request() | thread-B in nci_close_device() + | mutex_lock(&ndev->req_lock); +test_bit(NCI_UP, &ndev->flags); | +... | test_and_clear_bit(NCI_UP, &ndev->flags) +mutex_lock(&ndev->req_lock); | + | + +This race will allow __nci_request() to be awaked while the device is +getting removed. + +Similar to commit e2cb6b891ad2 ("bluetooth: eliminate the potential race +condition when removing the HCI controller"). this patch alters the +function sequence in nci_request() to prevent the data races between the +nci_close_device(). + +Signed-off-by: Lin Ma +Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") +Link: https://lore.kernel.org/r/20211115145600.8320-1-linma@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/nfc/nci/core.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c +index 33c23af6709d4..1008bbbb3af9c 100644 +--- a/net/nfc/nci/core.c ++++ b/net/nfc/nci/core.c +@@ -156,12 +156,15 @@ inline int nci_request(struct nci_dev *ndev, + { + int rc; + +- if (!test_bit(NCI_UP, &ndev->flags)) +- return -ENETDOWN; +- + /* Serialize all requests */ + mutex_lock(&ndev->req_lock); +- rc = __nci_request(ndev, req, opt, timeout); ++ /* check the state after obtaing the lock against any races ++ * from nci_close_device when the device gets removed. ++ */ ++ if (test_bit(NCI_UP, &ndev->flags)) ++ rc = __nci_request(ndev, req, opt, timeout); ++ else ++ rc = -ENETDOWN; + mutex_unlock(&ndev->req_lock); + + return rc; +-- +2.33.0 + diff --git a/queue-4.19/perf-bench-fix-two-memory-leaks-detected-with-asan.patch b/queue-4.19/perf-bench-fix-two-memory-leaks-detected-with-asan.patch new file mode 100644 index 00000000000..01bf99ebb85 --- /dev/null +++ b/queue-4.19/perf-bench-fix-two-memory-leaks-detected-with-asan.patch @@ -0,0 +1,56 @@ +From 74a09e87169ebb10c3fd0a8252c276a23d9e8c76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 10 Nov 2021 04:20:11 +0200 +Subject: perf bench: Fix two memory leaks detected with ASan + +From: Sohaib Mohamed + +[ Upstream commit 92723ea0f11d92496687db8c9725248e9d1e5e1d ] + +ASan reports memory leaks while running: + + $ perf bench sched all + +Fixes: e27454cc6352c422 ("perf bench: Add sched-messaging.c: Benchmark for scheduler and IPC mechanisms based on hackbench") +Signed-off-by: Sohaib Mohamed +Acked-by: Ian Rogers +Cc: Alexander Shishkin +Cc: Hitoshi Mitake +Cc: Jiri Olsa +Cc: Mark Rutland +Cc: Namhyung Kim +Cc: Paul Russel +Cc: Peter Zijlstra +Cc: Pierre Gondois +Link: http://lore.kernel.org/lkml/20211110022012.16620-1-sohaib.amhmd@gmail.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/bench/sched-messaging.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/perf/bench/sched-messaging.c b/tools/perf/bench/sched-messaging.c +index f9d7641ae8338..b4e13db991e9e 100644 +--- a/tools/perf/bench/sched-messaging.c ++++ b/tools/perf/bench/sched-messaging.c +@@ -226,6 +226,8 @@ static unsigned int group(pthread_t *pth, + snd_ctx->out_fds[i] = fds[1]; + if (!thread_mode) + close(fds[0]); ++ ++ free(ctx); + } + + /* Now we have all the fds, fork the senders */ +@@ -242,6 +244,8 @@ static unsigned int group(pthread_t *pth, + for (i = 0; i < num_fds; i++) + close(snd_ctx->out_fds[i]); + ++ free(snd_ctx); ++ + /* Return number of children to reap */ + return num_fds * 2; + } +-- +2.33.0 + diff --git a/queue-4.19/platform-x86-hp_accel-fix-an-error-handling-path-in-.patch b/queue-4.19/platform-x86-hp_accel-fix-an-error-handling-path-in-.patch new file mode 100644 index 00000000000..cadff0031a1 --- /dev/null +++ b/queue-4.19/platform-x86-hp_accel-fix-an-error-handling-path-in-.patch @@ -0,0 +1,46 @@ +From fcc86506db06dbe4b28a743680740fcdcacb54f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Nov 2021 20:57:07 +0100 +Subject: platform/x86: hp_accel: Fix an error handling path in + 'lis3lv02d_probe()' + +From: Christophe JAILLET + +[ Upstream commit c961a7d2aa23ae19e0099fbcdf1040fb760eea83 ] + +If 'led_classdev_register()' fails, some additional resources should be +released. + +Add the missing 'i8042_remove_filter()' and 'lis3lv02d_remove_fs()' calls +that are already in the remove function but are missing here. + +Fixes: a4c724d0723b ("platform: hp_accel: add a i8042 filter to remove HPQ6000 data from kb bus stream") +Fixes: 9e0c79782143 ("lis3lv02d: merge with leds hp disk") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/5a4f218f8f16d2e3a7906b7ca3654ffa946895f8.1636314074.git.christophe.jaillet@wanadoo.fr +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/hp_accel.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c +index 9c3c83ef445bf..075332c6890d0 100644 +--- a/drivers/platform/x86/hp_accel.c ++++ b/drivers/platform/x86/hp_accel.c +@@ -383,9 +383,11 @@ static int lis3lv02d_add(struct acpi_device *device) + INIT_WORK(&hpled_led.work, delayed_set_status_worker); + ret = led_classdev_register(NULL, &hpled_led.led_classdev); + if (ret) { ++ i8042_remove_filter(hp_accel_i8042_filter); + lis3lv02d_joystick_disable(&lis3_dev); + lis3lv02d_poweroff(&lis3_dev); + flush_work(&hpled_led.work); ++ lis3lv02d_remove_fs(&lis3_dev); + return ret; + } + +-- +2.33.0 + diff --git a/queue-4.19/powerpc-5200-dts-fix-memory-node-unit-name.patch b/queue-4.19/powerpc-5200-dts-fix-memory-node-unit-name.patch new file mode 100644 index 00000000000..adeb1b5f9b8 --- /dev/null +++ b/queue-4.19/powerpc-5200-dts-fix-memory-node-unit-name.patch @@ -0,0 +1,191 @@ +From 7f3f6fa32a84e9b1abb1b13b9ba01d4b5cc383ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 00:05:31 +0200 +Subject: powerpc/5200: dts: fix memory node unit name + +From: Anatolij Gustschin + +[ Upstream commit aed2886a5e9ffc8269a4220bff1e9e030d3d2eb1 ] + +Fixes build warnings: +Warning (unit_address_vs_reg): /memory: node has a reg or ranges property, but no unit name + +Signed-off-by: Anatolij Gustschin +Reviewed-by: Rob Herring +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20211013220532.24759-4-agust@denx.de +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/dts/charon.dts | 2 +- + arch/powerpc/boot/dts/digsy_mtc.dts | 2 +- + arch/powerpc/boot/dts/lite5200.dts | 2 +- + arch/powerpc/boot/dts/lite5200b.dts | 2 +- + arch/powerpc/boot/dts/media5200.dts | 2 +- + arch/powerpc/boot/dts/mpc5200b.dtsi | 2 +- + arch/powerpc/boot/dts/o2d.dts | 2 +- + arch/powerpc/boot/dts/o2d.dtsi | 2 +- + arch/powerpc/boot/dts/o2dnt2.dts | 2 +- + arch/powerpc/boot/dts/o3dnt.dts | 2 +- + arch/powerpc/boot/dts/pcm032.dts | 2 +- + arch/powerpc/boot/dts/tqm5200.dts | 2 +- + 12 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/powerpc/boot/dts/charon.dts b/arch/powerpc/boot/dts/charon.dts +index 0e00e508eaa6a..1c8fe20752e6a 100644 +--- a/arch/powerpc/boot/dts/charon.dts ++++ b/arch/powerpc/boot/dts/charon.dts +@@ -39,7 +39,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x08000000>; // 128MB + }; +diff --git a/arch/powerpc/boot/dts/digsy_mtc.dts b/arch/powerpc/boot/dts/digsy_mtc.dts +index c3922fc03e0b1..1a002cc487d57 100644 +--- a/arch/powerpc/boot/dts/digsy_mtc.dts ++++ b/arch/powerpc/boot/dts/digsy_mtc.dts +@@ -20,7 +20,7 @@ + model = "intercontrol,digsy-mtc"; + compatible = "intercontrol,digsy-mtc"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x02000000>; // 32MB + }; + +diff --git a/arch/powerpc/boot/dts/lite5200.dts b/arch/powerpc/boot/dts/lite5200.dts +index 179a1785d6454..18d137a3393f0 100644 +--- a/arch/powerpc/boot/dts/lite5200.dts ++++ b/arch/powerpc/boot/dts/lite5200.dts +@@ -36,7 +36,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/boot/dts/lite5200b.dts b/arch/powerpc/boot/dts/lite5200b.dts +index 5abb46c5cc951..29419cf81e044 100644 +--- a/arch/powerpc/boot/dts/lite5200b.dts ++++ b/arch/powerpc/boot/dts/lite5200b.dts +@@ -35,7 +35,7 @@ + led4 { gpios = <&gpio_simple 2 1>; }; + }; + +- memory { ++ memory@0 { + reg = <0x00000000 0x10000000>; // 256MB + }; + +diff --git a/arch/powerpc/boot/dts/media5200.dts b/arch/powerpc/boot/dts/media5200.dts +index 843f156a49c46..3ae4432165f75 100644 +--- a/arch/powerpc/boot/dts/media5200.dts ++++ b/arch/powerpc/boot/dts/media5200.dts +@@ -36,7 +36,7 @@ + }; + }; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB RAM + }; + +diff --git a/arch/powerpc/boot/dts/mpc5200b.dtsi b/arch/powerpc/boot/dts/mpc5200b.dtsi +index 969b2200b2f97..ecfba675b5611 100644 +--- a/arch/powerpc/boot/dts/mpc5200b.dtsi ++++ b/arch/powerpc/boot/dts/mpc5200b.dtsi +@@ -37,7 +37,7 @@ + }; + }; + +- memory: memory { ++ memory: memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +diff --git a/arch/powerpc/boot/dts/o2d.dts b/arch/powerpc/boot/dts/o2d.dts +index 9f6dd4d889b32..5a676e8141caf 100644 +--- a/arch/powerpc/boot/dts/o2d.dts ++++ b/arch/powerpc/boot/dts/o2d.dts +@@ -16,7 +16,7 @@ + model = "ifm,o2d"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/o2d.dtsi b/arch/powerpc/boot/dts/o2d.dtsi +index cf073e693f24d..1b4df5f64b580 100644 +--- a/arch/powerpc/boot/dts/o2d.dtsi ++++ b/arch/powerpc/boot/dts/o2d.dtsi +@@ -23,7 +23,7 @@ + model = "ifm,o2d"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x04000000>; // 64MB + }; + +diff --git a/arch/powerpc/boot/dts/o2dnt2.dts b/arch/powerpc/boot/dts/o2dnt2.dts +index a0f5b97a4f06e..5184c461a205f 100644 +--- a/arch/powerpc/boot/dts/o2dnt2.dts ++++ b/arch/powerpc/boot/dts/o2dnt2.dts +@@ -16,7 +16,7 @@ + model = "ifm,o2dnt2"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/o3dnt.dts b/arch/powerpc/boot/dts/o3dnt.dts +index acce49326491b..045b901719245 100644 +--- a/arch/powerpc/boot/dts/o3dnt.dts ++++ b/arch/powerpc/boot/dts/o3dnt.dts +@@ -16,7 +16,7 @@ + model = "ifm,o3dnt"; + compatible = "ifm,o2d"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x04000000>; // 64MB + }; + +diff --git a/arch/powerpc/boot/dts/pcm032.dts b/arch/powerpc/boot/dts/pcm032.dts +index 576249bf2fb91..637e14286dde5 100644 +--- a/arch/powerpc/boot/dts/pcm032.dts ++++ b/arch/powerpc/boot/dts/pcm032.dts +@@ -26,7 +26,7 @@ + model = "phytec,pcm032"; + compatible = "phytec,pcm032"; + +- memory { ++ memory@0 { + reg = <0x00000000 0x08000000>; // 128MB + }; + +diff --git a/arch/powerpc/boot/dts/tqm5200.dts b/arch/powerpc/boot/dts/tqm5200.dts +index 1db07f6cf133c..68b9e8240fb5b 100644 +--- a/arch/powerpc/boot/dts/tqm5200.dts ++++ b/arch/powerpc/boot/dts/tqm5200.dts +@@ -36,7 +36,7 @@ + }; + }; + +- memory { ++ memory@0 { + device_type = "memory"; + reg = <0x00000000 0x04000000>; // 64MB + }; +-- +2.33.0 + diff --git a/queue-4.19/powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch b/queue-4.19/powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch new file mode 100644 index 00000000000..bf3e007cc34 --- /dev/null +++ b/queue-4.19/powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch @@ -0,0 +1,66 @@ +From cefdc300d8ed9c2e8e0a72718fe967b06cd9e617 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 14 Oct 2021 13:44:24 +1100 +Subject: powerpc/dcr: Use cmplwi instead of 3-argument cmpli +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michael Ellerman + +[ Upstream commit fef071be57dc43679a32d5b0e6ee176d6f12e9f2 ] + +In dcr-low.S we use cmpli with three arguments, instead of four +arguments as defined in the ISA: + + cmpli cr0,r3,1024 + +This appears to be a PPC440-ism, looking at the "PPC440x5 CPU Core +User’s Manual" it shows cmpli having no L field, but implied to be 0 due +to the core being 32-bit. It mentions that the ISA defines four +arguments and recommends using cmplwi. + +It also corresponds to the old POWER instruction set, which had no L +field there, a reserved bit instead. + +dcr-low.S is only built 32-bit, because it is only built when +DCR_NATIVE=y, which is only selected by 40x and 44x. Looking at the +generated code (with gcc/gas) we see cmplwi as expected. + +Although gas is happy with the 3-argument version when building for +32-bit, the LLVM assembler is not and errors out with: + + arch/powerpc/sysdev/dcr-low.S:27:10: error: invalid operand for instruction + cmpli 0,%r3,1024; ... + ^ + +Switch to the cmplwi extended opcode, which avoids any confusion when +reading the ISA, fixes the issue with the LLVM assembler, and also means +the code could be built 64-bit in future (though that's very unlikely). + +Reported-by: Nick Desaulniers +Reviewed-by: Nick Desaulniers +Signed-off-by: Michael Ellerman +BugLink: https://github.com/ClangBuiltLinux/linux/issues/1419 +Link: https://lore.kernel.org/r/20211014024424.528848-1-mpe@ellerman.id.au +Signed-off-by: Sasha Levin +--- + arch/powerpc/sysdev/dcr-low.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/sysdev/dcr-low.S b/arch/powerpc/sysdev/dcr-low.S +index e687bb2003ff0..5589fbe48bbdc 100644 +--- a/arch/powerpc/sysdev/dcr-low.S ++++ b/arch/powerpc/sysdev/dcr-low.S +@@ -15,7 +15,7 @@ + #include + + #define DCR_ACCESS_PROLOG(table) \ +- cmpli cr0,r3,1024; \ ++ cmplwi cr0,r3,1024; \ + rlwinm r3,r3,4,18,27; \ + lis r5,table@h; \ + ori r5,r5,table@l; \ +-- +2.33.0 + diff --git a/queue-4.19/sched-core-mitigate-race-cpus_share_cache-update_top.patch b/queue-4.19/sched-core-mitigate-race-cpus_share_cache-update_top.patch new file mode 100644 index 00000000000..59a506a95b4 --- /dev/null +++ b/queue-4.19/sched-core-mitigate-race-cpus_share_cache-update_top.patch @@ -0,0 +1,61 @@ +From 9a1fe8216236cbc083e9ca39fd9a524443a60b63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Nov 2021 17:51:20 +0000 +Subject: sched/core: Mitigate race + cpus_share_cache()/update_top_cache_domain() + +From: Vincent Donnefort + +[ Upstream commit 42dc938a590c96eeb429e1830123fef2366d9c80 ] + +Nothing protects the access to the per_cpu variable sd_llc_id. When testing +the same CPU (i.e. this_cpu == that_cpu), a race condition exists with +update_top_cache_domain(). One scenario being: + + CPU1 CPU2 + ================================================================== + + per_cpu(sd_llc_id, CPUX) => 0 + partition_sched_domains_locked() + detach_destroy_domains() + cpus_share_cache(CPUX, CPUX) update_top_cache_domain(CPUX) + per_cpu(sd_llc_id, CPUX) => 0 + per_cpu(sd_llc_id, CPUX) = CPUX + per_cpu(sd_llc_id, CPUX) => CPUX + return false + +ttwu_queue_cond() wouldn't catch smp_processor_id() == cpu and the result +is a warning triggered from ttwu_queue_wakelist(). + +Avoid a such race in cpus_share_cache() by always returning true when +this_cpu == that_cpu. + +Fixes: 518cd6234178 ("sched: Only queue remote wakeups when crossing cache boundaries") +Reported-by: Jing-Ting Wu +Signed-off-by: Vincent Donnefort +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Valentin Schneider +Reviewed-by: Vincent Guittot +Link: https://lore.kernel.org/r/20211104175120.857087-1-vincent.donnefort@arm.com +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 013b1c6cb4ed9..32af895bd86b3 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1821,6 +1821,9 @@ out: + + bool cpus_share_cache(int this_cpu, int that_cpu) + { ++ if (this_cpu == that_cpu) ++ return true; ++ + return per_cpu(sd_llc_id, this_cpu) == per_cpu(sd_llc_id, that_cpu); + } + #endif /* CONFIG_SMP */ +-- +2.33.0 + diff --git a/queue-4.19/scsi-advansys-fix-kernel-pointer-leak.patch b/queue-4.19/scsi-advansys-fix-kernel-pointer-leak.patch new file mode 100644 index 00000000000..7e492595f8d --- /dev/null +++ b/queue-4.19/scsi-advansys-fix-kernel-pointer-leak.patch @@ -0,0 +1,40 @@ +From 26c5f593a8c3389537a40b8244c4a9524ae9d6a7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 20:25:37 +0800 +Subject: scsi: advansys: Fix kernel pointer leak + +From: Guo Zhi + +[ Upstream commit d4996c6eac4c81b8872043e9391563f67f13e406 ] + +Pointers should be printed with %p or %px rather than cast to 'unsigned +long' and printed with %lx. + +Change %lx to %p to print the hashed pointer. + +Link: https://lore.kernel.org/r/20210929122538.1158235-1-qtxuning1999@sjtu.edu.cn +Signed-off-by: Guo Zhi +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/advansys.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c +index 713f69033f201..2856b0ce7ab9a 100644 +--- a/drivers/scsi/advansys.c ++++ b/drivers/scsi/advansys.c +@@ -3370,8 +3370,8 @@ static void asc_prt_adv_board_info(struct seq_file *m, struct Scsi_Host *shost) + shost->host_no); + + seq_printf(m, +- " iop_base 0x%lx, cable_detect: %X, err_code %u\n", +- (unsigned long)v->iop_base, ++ " iop_base 0x%p, cable_detect: %X, err_code %u\n", ++ v->iop_base, + AdvReadWordRegister(iop_base,IOPW_SCSI_CFG1) & CABLE_DETECT, + v->err_code); + +-- +2.33.0 + diff --git a/queue-4.19/scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch b/queue-4.19/scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch new file mode 100644 index 00000000000..f131327720e --- /dev/null +++ b/queue-4.19/scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch @@ -0,0 +1,48 @@ +From 69e66647a33fa0111bf58fef0c73a5bcfe4b6874 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 10 Sep 2021 16:31:46 -0700 +Subject: scsi: lpfc: Fix list_add() corruption in lpfc_drain_txq() + +From: James Smart + +[ Upstream commit 99154581b05c8fb22607afb7c3d66c1bace6aa5d ] + +When parsing the txq list in lpfc_drain_txq(), the driver attempts to pass +the requests to the adapter. If such an attempt fails, a local "fail_msg" +string is set and a log message output. The job is then added to a +completions list for cancellation. + +Processing of any further jobs from the txq list continues, but since +"fail_msg" remains set, jobs are added to the completions list regardless +of whether a wqe was passed to the adapter. If successfully added to +txcmplq, jobs are added to both lists resulting in list corruption. + +Fix by clearing the fail_msg string after adding a job to the completions +list. This stops the subsequent jobs from being added to the completions +list unless they had an appropriate failure. + +Link: https://lore.kernel.org/r/20210910233159.115896-2-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 40d6537e64dd6..e72fc88aeb40e 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -19171,6 +19171,7 @@ lpfc_drain_txq(struct lpfc_hba *phba) + fail_msg, + piocbq->iotag, piocbq->sli4_xritag); + list_add_tail(&piocbq->list, &completions); ++ fail_msg = NULL; + } + spin_unlock_irqrestore(&pring->ring_lock, iflags); + } +-- +2.33.0 + diff --git a/queue-4.19/scsi-target-fix-alua_tg_pt_gps_count-tracking.patch b/queue-4.19/scsi-target-fix-alua_tg_pt_gps_count-tracking.patch new file mode 100644 index 00000000000..04042b63411 --- /dev/null +++ b/queue-4.19/scsi-target-fix-alua_tg_pt_gps_count-tracking.patch @@ -0,0 +1,45 @@ +From 97c15138bed7e015d29469116d3b8a29f70171eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 21:04:20 -0500 +Subject: scsi: target: Fix alua_tg_pt_gps_count tracking + +From: Mike Christie + +[ Upstream commit 1283c0d1a32bb924324481586b5d6e8e76f676ba ] + +We can't free the tg_pt_gp in core_alua_set_tg_pt_gp_id() because it's +still accessed via configfs. Its release must go through the normal +configfs/refcount process. + +The max alua_tg_pt_gps_count check should probably have been done in +core_alua_allocate_tg_pt_gp(), but with the current code userspace could +have created 0x0000ffff + 1 groups, but only set the id for 0x0000ffff. +Then it could have deleted a group with an ID set, and then set the ID for +that extra group and it would work ok. + +It's unlikely, but just in case this patch continues to allow that type of +behavior, and just fixes the kfree() while in use bug. + +Link: https://lore.kernel.org/r/20210930020422.92578-4-michael.christie@oracle.com +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_alua.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c +index e46ca968009c0..804956c712a5a 100644 +--- a/drivers/target/target_core_alua.c ++++ b/drivers/target/target_core_alua.c +@@ -1716,7 +1716,6 @@ int core_alua_set_tg_pt_gp_id( + pr_err("Maximum ALUA alua_tg_pt_gps_count:" + " 0x0000ffff reached\n"); + spin_unlock(&dev->t10_alua.tg_pt_gps_lock); +- kmem_cache_free(t10_alua_tg_pt_gp_cache, tg_pt_gp); + return -ENOSPC; + } + again: +-- +2.33.0 + diff --git a/queue-4.19/scsi-target-fix-ordered-tag-handling.patch b/queue-4.19/scsi-target-fix-ordered-tag-handling.patch new file mode 100644 index 00000000000..03ff687c7a4 --- /dev/null +++ b/queue-4.19/scsi-target-fix-ordered-tag-handling.patch @@ -0,0 +1,266 @@ +From afe7761b7a2865a5497eb0a18cfd22d897297a0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Sep 2021 21:04:19 -0500 +Subject: scsi: target: Fix ordered tag handling + +From: Mike Christie + +[ Upstream commit ed1227e080990ffec5bf39006ec8a57358e6689a ] + +This patch fixes the following bugs: + +1. If there are multiple ordered cmds queued and multiple simple cmds + completing, target_restart_delayed_cmds() could be called on different + CPUs and each instance could start a ordered cmd. They could then run in + different orders than they were queued. + +2. target_restart_delayed_cmds() and target_handle_task_attr() can race + where: + + 1. target_handle_task_attr() has passed the simple_cmds == 0 check. + + 2. transport_complete_task_attr() then decrements simple_cmds to 0. + + 3. transport_complete_task_attr() runs target_restart_delayed_cmds() and + it does not see any cmds on the delayed_cmd_list. + + 4. target_handle_task_attr() adds the cmd to the delayed_cmd_list. + + The cmd will then end up timing out. + +3. If we are sent > 1 ordered cmds and simple_cmds == 0, we can execute + them out of order, because target_handle_task_attr() will hit that + simple_cmds check first and return false for all ordered cmds sent. + +4. We run target_restart_delayed_cmds() after every cmd completion, so if + there is more than 1 simple cmd running, we start executing ordered cmds + after that first cmd instead of waiting for all of them to complete. + +5. Ordered cmds are not supposed to start until HEAD OF QUEUE and all older + cmds have completed, and not just simple. + +6. It's not a bug but it doesn't make sense to take the delayed_cmd_lock + for every cmd completion when ordered cmds are almost never used. Just + replacing that lock with an atomic increases IOPs by up to 10% when + completions are spread over multiple CPUs and there are multiple + sessions/ mqs/thread accessing the same device. + +This patch moves the queued delayed handling to a per device work to +serialze the cmd executions for each device and adds a new counter to track +HEAD_OF_QUEUE and SIMPLE cmds. We can then check the new counter to +determine when to run the work on the completion path. + +Link: https://lore.kernel.org/r/20210930020422.92578-3-michael.christie@oracle.com +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/target/target_core_device.c | 2 + + drivers/target/target_core_internal.h | 1 + + drivers/target/target_core_transport.c | 76 ++++++++++++++++++-------- + include/target/target_core_base.h | 6 +- + 4 files changed, 61 insertions(+), 24 deletions(-) + +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index 22e97a93728db..1b381519c1649 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -790,6 +790,8 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) + INIT_LIST_HEAD(&dev->t10_alua.lba_map_list); + spin_lock_init(&dev->t10_alua.lba_map_lock); + ++ INIT_WORK(&dev->delayed_cmd_work, target_do_delayed_work); ++ + dev->t10_wwn.t10_dev = dev; + dev->t10_alua.t10_dev = dev; + +diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h +index 0c66355879301..c7e1fadcc5cc5 100644 +--- a/drivers/target/target_core_internal.h ++++ b/drivers/target/target_core_internal.h +@@ -151,6 +151,7 @@ void transport_clear_lun_ref(struct se_lun *); + void transport_send_task_abort(struct se_cmd *); + sense_reason_t target_cmd_size_check(struct se_cmd *cmd, unsigned int size); + void target_qf_do_work(struct work_struct *work); ++void target_do_delayed_work(struct work_struct *work); + bool target_check_wce(struct se_device *dev); + bool target_check_fua(struct se_device *dev); + void __target_execute_cmd(struct se_cmd *, bool); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 9c60a090cfd17..64481a3a34d44 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -1990,32 +1990,35 @@ static bool target_handle_task_attr(struct se_cmd *cmd) + */ + switch (cmd->sam_task_attr) { + case TCM_HEAD_TAG: ++ atomic_inc_mb(&dev->non_ordered); + pr_debug("Added HEAD_OF_QUEUE for CDB: 0x%02x\n", + cmd->t_task_cdb[0]); + return false; + case TCM_ORDERED_TAG: +- atomic_inc_mb(&dev->dev_ordered_sync); ++ atomic_inc_mb(&dev->delayed_cmd_count); + + pr_debug("Added ORDERED for CDB: 0x%02x to ordered list\n", + cmd->t_task_cdb[0]); +- +- /* +- * Execute an ORDERED command if no other older commands +- * exist that need to be completed first. +- */ +- if (!atomic_read(&dev->simple_cmds)) +- return false; + break; + default: + /* + * For SIMPLE and UNTAGGED Task Attribute commands + */ +- atomic_inc_mb(&dev->simple_cmds); ++ atomic_inc_mb(&dev->non_ordered); ++ ++ if (atomic_read(&dev->delayed_cmd_count) == 0) ++ return false; + break; + } + +- if (atomic_read(&dev->dev_ordered_sync) == 0) +- return false; ++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) { ++ atomic_inc_mb(&dev->delayed_cmd_count); ++ /* ++ * We will account for this when we dequeue from the delayed ++ * list. ++ */ ++ atomic_dec_mb(&dev->non_ordered); ++ } + + spin_lock(&dev->delayed_cmd_lock); + list_add_tail(&cmd->se_delayed_node, &dev->delayed_cmd_list); +@@ -2023,6 +2026,12 @@ static bool target_handle_task_attr(struct se_cmd *cmd) + + pr_debug("Added CDB: 0x%02x Task Attr: 0x%02x to delayed CMD listn", + cmd->t_task_cdb[0], cmd->sam_task_attr); ++ /* ++ * We may have no non ordered cmds when this function started or we ++ * could have raced with the last simple/head cmd completing, so kick ++ * the delayed handler here. ++ */ ++ schedule_work(&dev->delayed_cmd_work); + return true; + } + +@@ -2073,29 +2082,48 @@ EXPORT_SYMBOL(target_execute_cmd); + * Process all commands up to the last received ORDERED task attribute which + * requires another blocking boundary + */ +-static void target_restart_delayed_cmds(struct se_device *dev) ++void target_do_delayed_work(struct work_struct *work) + { +- for (;;) { ++ struct se_device *dev = container_of(work, struct se_device, ++ delayed_cmd_work); ++ ++ spin_lock(&dev->delayed_cmd_lock); ++ while (!dev->ordered_sync_in_progress) { + struct se_cmd *cmd; + +- spin_lock(&dev->delayed_cmd_lock); +- if (list_empty(&dev->delayed_cmd_list)) { +- spin_unlock(&dev->delayed_cmd_lock); ++ if (list_empty(&dev->delayed_cmd_list)) + break; +- } + + cmd = list_entry(dev->delayed_cmd_list.next, + struct se_cmd, se_delayed_node); ++ ++ if (cmd->sam_task_attr == TCM_ORDERED_TAG) { ++ /* ++ * Check if we started with: ++ * [ordered] [simple] [ordered] ++ * and we are now at the last ordered so we have to wait ++ * for the simple cmd. ++ */ ++ if (atomic_read(&dev->non_ordered) > 0) ++ break; ++ ++ dev->ordered_sync_in_progress = true; ++ } ++ + list_del(&cmd->se_delayed_node); ++ atomic_dec_mb(&dev->delayed_cmd_count); + spin_unlock(&dev->delayed_cmd_lock); + ++ if (cmd->sam_task_attr != TCM_ORDERED_TAG) ++ atomic_inc_mb(&dev->non_ordered); ++ + cmd->transport_state |= CMD_T_SENT; + + __target_execute_cmd(cmd, true); + +- if (cmd->sam_task_attr == TCM_ORDERED_TAG) +- break; ++ spin_lock(&dev->delayed_cmd_lock); + } ++ spin_unlock(&dev->delayed_cmd_lock); + } + + /* +@@ -2113,14 +2141,17 @@ static void transport_complete_task_attr(struct se_cmd *cmd) + goto restart; + + if (cmd->sam_task_attr == TCM_SIMPLE_TAG) { +- atomic_dec_mb(&dev->simple_cmds); ++ atomic_dec_mb(&dev->non_ordered); + dev->dev_cur_ordered_id++; + } else if (cmd->sam_task_attr == TCM_HEAD_TAG) { ++ atomic_dec_mb(&dev->non_ordered); + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev_cur_ordered_id: %u for HEAD_OF_QUEUE\n", + dev->dev_cur_ordered_id); + } else if (cmd->sam_task_attr == TCM_ORDERED_TAG) { +- atomic_dec_mb(&dev->dev_ordered_sync); ++ spin_lock(&dev->delayed_cmd_lock); ++ dev->ordered_sync_in_progress = false; ++ spin_unlock(&dev->delayed_cmd_lock); + + dev->dev_cur_ordered_id++; + pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n", +@@ -2129,7 +2160,8 @@ static void transport_complete_task_attr(struct se_cmd *cmd) + cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET; + + restart: +- target_restart_delayed_cmds(dev); ++ if (atomic_read(&dev->delayed_cmd_count) > 0) ++ schedule_work(&dev->delayed_cmd_work); + } + + static void transport_complete_qf(struct se_cmd *cmd) +diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h +index 2cfd3b4573b06..ac59a03d0d00e 100644 +--- a/include/target/target_core_base.h ++++ b/include/target/target_core_base.h +@@ -774,8 +774,9 @@ struct se_device { + atomic_long_t read_bytes; + atomic_long_t write_bytes; + /* Active commands on this virtual SE device */ +- atomic_t simple_cmds; +- atomic_t dev_ordered_sync; ++ atomic_t non_ordered; ++ bool ordered_sync_in_progress; ++ atomic_t delayed_cmd_count; + atomic_t dev_qf_count; + u32 export_count; + spinlock_t delayed_cmd_lock; +@@ -798,6 +799,7 @@ struct se_device { + struct list_head dev_tmr_list; + struct workqueue_struct *tmr_wq; + struct work_struct qf_work_queue; ++ struct work_struct delayed_cmd_work; + struct list_head delayed_cmd_list; + struct list_head state_list; + struct list_head qf_cmd_list; +-- +2.33.0 + diff --git a/queue-4.19/series b/queue-4.19/series index 80cf8f00219..4c930db2f7c 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -256,3 +256,46 @@ pci-msi-deal-with-devices-lying-about-their-msi-mask-capability.patch pci-add-msi-masking-quirk-for-nvidia-ion-ahci.patch erofs-remove-the-occupied-parameter-from-z_erofs_pagevec_enqueue.patch erofs-fix-unsafe-pagevec-reuse-of-hooked-pclusters.patch +arm64-zynqmp-do-not-duplicate-flash-partition-label-.patch +arm64-zynqmp-fix-serial-compatible-string.patch +scsi-lpfc-fix-list_add-corruption-in-lpfc_drain_txq.patch +arm64-dts-hisilicon-fix-arm-sp805-compatible-string.patch +usb-musb-tusb6010-check-return-value-after-calling-p.patch +usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch +arm64-dts-freescale-fix-arm-sp805-compatible-string.patch +asoc-nau8824-add-dmi-quirk-mechanism-for-active-high.patch +scsi-advansys-fix-kernel-pointer-leak.patch +firmware_loader-fix-pre-allocated-buf-built-in-firmw.patch +arm-dts-omap-fix-gpmc-mux-add-data-type.patch +usb-host-ohci-tmio-check-return-value-after-calling-.patch +alsa-isa-not-for-m68k.patch +tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch +mips-sni-fix-the-build.patch +scsi-target-fix-ordered-tag-handling.patch +scsi-target-fix-alua_tg_pt_gps_count-tracking.patch +powerpc-5200-dts-fix-memory-node-unit-name.patch +alsa-gus-fix-null-pointer-dereference-on-pointer-blo.patch +powerpc-dcr-use-cmplwi-instead-of-3-argument-cmpli.patch +sh-check-return-code-of-request_irq.patch +maple-fix-wrong-return-value-of-maple_bus_init.patch +f2fs-fix-up-f2fs_lookup-tracepoints.patch +sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch +sh-define-__big_endian-for-math-emu.patch +mips-bcm63xx-ensure-that-cpu_supports_32bit_kernel-i.patch +sched-core-mitigate-race-cpus_share_cache-update_top.patch +drm-nouveau-hdmigv100.c-fix-corrupted-hdmi-vendor-in.patch +net-bnx2x-fix-variable-dereferenced-before-check.patch +iavf-check-for-null-in-iavf_fix_features.patch +iavf-fix-for-the-false-positive-asq-arq-errors-while.patch +mips-generic-yamon-dt-fix-uninitialized-variable-err.patch +mips-bcm63xx-add-support-for-clk_get_parent.patch +mips-lantiq-add-support-for-clk_get_parent.patch +platform-x86-hp_accel-fix-an-error-handling-path-in-.patch +net-virtio_net_hdr_to_skb-count-transport-header-in-.patch +i40e-fix-correct-max_pkt_size-on-vf-rx-queue.patch +i40e-fix-null-ptr-dereference-on-vsi-filter-sync.patch +i40e-fix-changing-previously-set-num_queue_pairs-for.patch +i40e-fix-display-error-code-in-dmesg.patch +nfc-reorganize-the-functions-in-nci_request.patch +nfc-reorder-the-logic-in-nfc_-un-register_device.patch +perf-bench-fix-two-memory-leaks-detected-with-asan.patch diff --git a/queue-4.19/sh-check-return-code-of-request_irq.patch b/queue-4.19/sh-check-return-code-of-request_irq.patch new file mode 100644 index 00000000000..3cfbf7b45dc --- /dev/null +++ b/queue-4.19/sh-check-return-code-of-request_irq.patch @@ -0,0 +1,45 @@ +From 8652ddcddb834b363bd1417e4cf825f85e7bcdce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Dec 2020 12:54:01 -0800 +Subject: sh: check return code of request_irq + +From: Nick Desaulniers + +[ Upstream commit 0e38225c92c7964482a8bb6b3e37fde4319e965c ] + +request_irq is marked __must_check, but the call in shx3_prepare_cpus +has a void return type, so it can't propagate failure to the caller. +Follow cues from hexagon and just print an error. + +Fixes: c7936b9abcf5 ("sh: smp: Hook in to the generic IPI handler for SH-X3 SMP.") +Cc: Miguel Ojeda +Cc: Paul Mundt +Reported-by: Guenter Roeck +Signed-off-by: Nick Desaulniers +Tested-by: John Paul Adrian Glaubitz +Reviewed-by: Miguel Ojeda +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/kernel/cpu/sh4a/smp-shx3.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/sh/kernel/cpu/sh4a/smp-shx3.c b/arch/sh/kernel/cpu/sh4a/smp-shx3.c +index 0d3637c494bfe..c1f66c35e0c12 100644 +--- a/arch/sh/kernel/cpu/sh4a/smp-shx3.c ++++ b/arch/sh/kernel/cpu/sh4a/smp-shx3.c +@@ -76,8 +76,9 @@ static void shx3_prepare_cpus(unsigned int max_cpus) + BUILD_BUG_ON(SMP_MSG_NR >= 8); + + for (i = 0; i < SMP_MSG_NR; i++) +- request_irq(104 + i, ipi_interrupt_handler, +- IRQF_PERCPU, "IPI", (void *)(long)i); ++ if (request_irq(104 + i, ipi_interrupt_handler, ++ IRQF_PERCPU, "IPI", (void *)(long)i)) ++ pr_err("Failed to request irq %d\n", i); + + for (i = 0; i < max_cpus; i++) + set_cpu_present(i, true); +-- +2.33.0 + diff --git a/queue-4.19/sh-define-__big_endian-for-math-emu.patch b/queue-4.19/sh-define-__big_endian-for-math-emu.patch new file mode 100644 index 00000000000..a6ea91567df --- /dev/null +++ b/queue-4.19/sh-define-__big_endian-for-math-emu.patch @@ -0,0 +1,59 @@ +From 4b4840a771bc62009a37a00a1dfb807d75260e6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 17:19:13 -0700 +Subject: sh: define __BIG_ENDIAN for math-emu + +From: Randy Dunlap + +[ Upstream commit b929926f01f2d14635345d22eafcf60feed1085e ] + +Fix this by defining both ENDIAN macros in + so that they can be utilized in + according to the latter's comment: +/* Allow sfp-machine to have its own byte order definitions. */ + +(This is what is done in arch/nds32/include/asm/sfp-machine.h.) + +This placates these build warnings: + +In file included from ../arch/sh/math-emu/math.c:23: +.../include/math-emu/single.h:50:21: warning: "__BIG_ENDIAN" is not defined, evaluates to 0 [-Wundef] + 50 | #if __BYTE_ORDER == __BIG_ENDIAN +In file included from ../arch/sh/math-emu/math.c:24: +.../include/math-emu/double.h:59:21: warning: "__BIG_ENDIAN" is not defined, evaluates to 0 [-Wundef] + 59 | #if __BYTE_ORDER == __BIG_ENDIAN + +Fixes: 4b565680d163 ("sh: math-emu support") +Signed-off-by: Randy Dunlap +Cc: Yoshinori Sato +Cc: John Paul Adrian Glaubitz +Reviewed-by: Geert Uytterhoeven +Tested-by: John Paul Adrian Glaubitz +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/include/asm/sfp-machine.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/arch/sh/include/asm/sfp-machine.h b/arch/sh/include/asm/sfp-machine.h +index d3c548443f2a6..dd195c6f3b9d8 100644 +--- a/arch/sh/include/asm/sfp-machine.h ++++ b/arch/sh/include/asm/sfp-machine.h +@@ -25,6 +25,14 @@ + #ifndef _SFP_MACHINE_H + #define _SFP_MACHINE_H + ++#ifdef __BIG_ENDIAN__ ++#define __BYTE_ORDER __BIG_ENDIAN ++#define __LITTLE_ENDIAN 0 ++#else ++#define __BYTE_ORDER __LITTLE_ENDIAN ++#define __BIG_ENDIAN 0 ++#endif ++ + #define _FP_W_TYPE_SIZE 32 + #define _FP_W_TYPE unsigned long + #define _FP_WS_TYPE signed long +-- +2.33.0 + diff --git a/queue-4.19/sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch b/queue-4.19/sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch new file mode 100644 index 00000000000..3da467850ac --- /dev/null +++ b/queue-4.19/sh-fix-kconfig-unmet-dependency-warning-for-frame_po.patch @@ -0,0 +1,47 @@ +From a94a65d20d286e30a9bc163e3f301c0b73b34d21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Oct 2021 17:19:10 -0700 +Subject: sh: fix kconfig unmet dependency warning for FRAME_POINTER + +From: Randy Dunlap + +[ Upstream commit fda1bc533094a7db68b11e7503d2c6c73993d12a ] + +FRAME_POINTER depends on DEBUG_KERNEL so DWARF_UNWINDER should +depend on DEBUG_KERNEL before selecting FRAME_POINTER. + +WARNING: unmet direct dependencies detected for FRAME_POINTER + Depends on [n]: DEBUG_KERNEL [=n] && (M68K || UML || SUPERH [=y]) || ARCH_WANT_FRAME_POINTERS [=n] + Selected by [y]: + - DWARF_UNWINDER [=y] + +Fixes: bd353861c735 ("sh: dwarf unwinder support.") +Signed-off-by: Randy Dunlap +Cc: Matt Fleming +Cc: Matt Fleming +Cc: Yoshinori Sato +Cc: John Paul Adrian Glaubitz +Cc: Geert Uytterhoeven +Reviewed-by: Geert Uytterhoeven +Tested-by: John Paul Adrian Glaubitz +Signed-off-by: Rich Felker +Signed-off-by: Sasha Levin +--- + arch/sh/Kconfig.debug | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/sh/Kconfig.debug b/arch/sh/Kconfig.debug +index 010b6c33bbba2..71acd3d9b9e83 100644 +--- a/arch/sh/Kconfig.debug ++++ b/arch/sh/Kconfig.debug +@@ -58,6 +58,7 @@ config DUMP_CODE + + config DWARF_UNWINDER + bool "Enable the DWARF unwinder for stacktraces" ++ depends on DEBUG_KERNEL + select FRAME_POINTER + depends on SUPERH32 + default n +-- +2.33.0 + diff --git a/queue-4.19/tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch b/queue-4.19/tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch new file mode 100644 index 00000000000..fd13eb138ed --- /dev/null +++ b/queue-4.19/tty-tty_buffer-fix-the-softlockup-issue-in-flush_to_.patch @@ -0,0 +1,69 @@ +From 377a42c42855d034d82c5b39f3cccd713bb92bd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Oct 2021 22:08:24 +0800 +Subject: tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc + +From: Guanghui Feng + +[ Upstream commit 3968ddcf05fb4b9409cd1859feb06a5b0550a1c1 ] + +When running ltp testcase(ltp/testcases/kernel/pty/pty04.c) with arm64, there is a soft lockup, +which look like this one: + + Workqueue: events_unbound flush_to_ldisc + Call trace: + dump_backtrace+0x0/0x1ec + show_stack+0x24/0x30 + dump_stack+0xd0/0x128 + panic+0x15c/0x374 + watchdog_timer_fn+0x2b8/0x304 + __run_hrtimer+0x88/0x2c0 + __hrtimer_run_queues+0xa4/0x120 + hrtimer_interrupt+0xfc/0x270 + arch_timer_handler_phys+0x40/0x50 + handle_percpu_devid_irq+0x94/0x220 + __handle_domain_irq+0x88/0xf0 + gic_handle_irq+0x84/0xfc + el1_irq+0xc8/0x180 + slip_unesc+0x80/0x214 [slip] + tty_ldisc_receive_buf+0x64/0x80 + tty_port_default_receive_buf+0x50/0x90 + flush_to_ldisc+0xbc/0x110 + process_one_work+0x1d4/0x4b0 + worker_thread+0x180/0x430 + kthread+0x11c/0x120 + +In the testcase pty04, The first process call the write syscall to send +data to the pty master. At the same time, the workqueue will do the +flush_to_ldisc to pop data in a loop until there is no more data left. +When the sender and workqueue running in different core, the sender sends +data fastly in full time which will result in workqueue doing work in loop +for a long time and occuring softlockup in flush_to_ldisc with kernel +configured without preempt. So I add need_resched check and cond_resched +in the flush_to_ldisc loop to avoid it. + +Signed-off-by: Guanghui Feng +Link: https://lore.kernel.org/r/1633961304-24759-1-git-send-email-guanghuifeng@linux.alibaba.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/tty_buffer.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c +index ee3aa57bc0e7b..6b0cb633679d9 100644 +--- a/drivers/tty/tty_buffer.c ++++ b/drivers/tty/tty_buffer.c +@@ -529,6 +529,9 @@ static void flush_to_ldisc(struct work_struct *work) + if (!count) + break; + head->read += count; ++ ++ if (need_resched()) ++ cond_resched(); + } + + mutex_unlock(&buf->lock); +-- +2.33.0 + diff --git a/queue-4.19/usb-host-ohci-tmio-check-return-value-after-calling-.patch b/queue-4.19/usb-host-ohci-tmio-check-return-value-after-calling-.patch new file mode 100644 index 00000000000..cabd094040d --- /dev/null +++ b/queue-4.19/usb-host-ohci-tmio-check-return-value-after-calling-.patch @@ -0,0 +1,38 @@ +From 5b6e704b373086dbf8078d6cfbe46848d9bb41e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Oct 2021 21:49:20 +0800 +Subject: usb: host: ohci-tmio: check return value after calling + platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit 9eff2b2e59fda25051ab36cd1cb5014661df657b ] + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Acked-by: Alan Stern +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20211011134920.118477-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ohci-tmio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c +index 983a00e2988dc..702d78e0d903a 100644 +--- a/drivers/usb/host/ohci-tmio.c ++++ b/drivers/usb/host/ohci-tmio.c +@@ -196,7 +196,7 @@ static int ohci_hcd_tmio_drv_probe(struct platform_device *dev) + if (usb_disabled()) + return -ENODEV; + +- if (!cell) ++ if (!cell || !regs || !config || !sram) + return -EINVAL; + + if (irq < 0) +-- +2.33.0 + diff --git a/queue-4.19/usb-musb-tusb6010-check-return-value-after-calling-p.patch b/queue-4.19/usb-musb-tusb6010-check-return-value-after-calling-p.patch new file mode 100644 index 00000000000..338cafa5fd3 --- /dev/null +++ b/queue-4.19/usb-musb-tusb6010-check-return-value-after-calling-p.patch @@ -0,0 +1,40 @@ +From b81c6aebf96876db50ba9d03ca6cdd881aabe311 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Sep 2021 11:49:25 +0800 +Subject: usb: musb: tusb6010: check return value after calling + platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit 14651496a3de6807a17c310f63c894ea0c5d858e ] + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210915034925.2399823-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/musb/tusb6010.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c +index 4ecfbf6bb1fa8..902507da8aa85 100644 +--- a/drivers/usb/musb/tusb6010.c ++++ b/drivers/usb/musb/tusb6010.c +@@ -1103,6 +1103,11 @@ static int tusb_musb_init(struct musb *musb) + + /* dma address for async dma */ + mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!mem) { ++ pr_debug("no async dma resource?\n"); ++ ret = -ENODEV; ++ goto done; ++ } + musb->async = mem->start; + + /* dma address for sync dma */ +-- +2.33.0 + diff --git a/queue-4.19/usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch b/queue-4.19/usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch new file mode 100644 index 00000000000..3edfa2c9616 --- /dev/null +++ b/queue-4.19/usb-typec-tipd-remove-warn_on-in-tps6598x_block_read.patch @@ -0,0 +1,38 @@ +From e0ecffd99ffac0f4cadb9f17507b700750cdd7df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Sep 2021 16:02:35 +0200 +Subject: usb: typec: tipd: Remove WARN_ON in tps6598x_block_read + +From: Sven Peter + +[ Upstream commit b7a0a63f3fed57d413bb857de164ea9c3984bc4e ] + +Calling tps6598x_block_read with a higher than allowed len can be +handled by just returning an error. There's no need to crash systems +with panic-on-warn enabled. + +Reviewed-by: Heikki Krogerus +Signed-off-by: Sven Peter +Link: https://lore.kernel.org/r/20210914140235.65955-3-sven@svenpeter.dev +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/typec/tps6598x.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/typec/tps6598x.c b/drivers/usb/typec/tps6598x.c +index 987b8fcfb2aae..a4dd23a8f1954 100644 +--- a/drivers/usb/typec/tps6598x.c ++++ b/drivers/usb/typec/tps6598x.c +@@ -93,7 +93,7 @@ tps6598x_block_read(struct tps6598x *tps, u8 reg, void *val, size_t len) + u8 data[TPS_MAX_LEN + 1]; + int ret; + +- if (WARN_ON(len + 1 > sizeof(data))) ++ if (len + 1 > sizeof(data)) + return -EINVAL; + + if (!tps->i2c_protocol) +-- +2.33.0 + -- 2.47.2