From 52bff9fe3f582bb3aeb218430b2e847bc1462b69 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 9 Jul 2020 20:37:24 -0400 Subject: [PATCH] Fixes for 5.4 Signed-off-by: Sasha Levin --- ...dd-missing-pci-ids-for-icl-h-tgl-h-a.patch | 53 ++++ ...oid4-fix-spi-configuration-and-incre.patch | 52 ++++ ...sing-put_device-call-in-imx6q_suspen.patch | 71 +++++ ...sof-intel-add-pci-id-for-cometlake-s.patch | 37 +++ ...ase-bip-in-a-right-way-in-error-path.patch | 72 +++++ ...date-ctime-and-mtime-during-truncate.patch | 49 ++++ ...e-fix-display-initialization-problem.patch | 62 +++++ ...ation-quirks-add-quirk-for-asus-t101.patch | 41 +++ ...ation-quirks-use-generic-orientation.patch | 53 ++++ ...call-of_dma_configure-if-there-s-an-.patch | 55 ++++ ...-do-not-enable-orphaned-window-group.patch | 52 ++++ ...fence-refcnt-leak-when-adding-move-f.patch | 56 ++++ ...u-host1x-detach-driver-on-unregister.patch | 55 ++++ ...ng-accesses-with-read-and-write_once.patch | 110 ++++++++ ...-to-init-in-crq-reset-returns-h_clos.patch | 48 ++++ ...-apply-gfx-quirks-to-untrusted-devic.patch | 113 ++++++++ ...ng-accesses-with-read-and-write_once.patch | 112 ++++++++ ...eta-add-2500basex-support-for-socs-w.patch | 50 ++++ ...eta-fix-serdes-configuration-for-soc.patch | 171 ++++++++++++ ...a-assign-completion-vector-correctly.patch | 40 +++ ...86-rapl-fix-rapl-config-variable-bug.patch | 40 +++ ...move-rapl-support-to-common-x86-code.patch | 109 ++++++++ ...3s64-fix-kernel-crash-with-nested-kv.patch | 71 +++++ queue-5.4/regmap-fix-alignment-issue.patch | 258 ++++++++++++++++++ ...ix-early-pgm-check-handler-execution.patch | 42 +++ ...-cpus_mask-not-cpus_ptr-in-__set_cpu.patch | 43 +++ ...si-mptscsih-fix-read-sense-data-size.patch | 50 ++++ queue-5.4/series | 31 +++ ...-potential-use-after-free-in-spidev_.patch | 76 ++++++ ...-race-between-spidev_release-and-spi.patch | 62 +++++ ...-reference-count-leak-in-dwc3_pci_re.patch | 39 +++ ...ease-entry_stack-size-to-a-full-page.patch | 40 +++ 32 files changed, 2213 insertions(+) create mode 100644 queue-5.4/alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch create mode 100644 queue-5.4/arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch create mode 100644 queue-5.4/arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch create mode 100644 queue-5.4/asoc-sof-intel-add-pci-id-for-cometlake-s.patch create mode 100644 queue-5.4/block-release-bip-in-a-right-way-in-error-path.patch create mode 100644 queue-5.4/cifs-update-ctime-and-mtime-during-truncate.patch create mode 100644 queue-5.4/drm-mcde-fix-display-initialization-problem.patch create mode 100644 queue-5.4/drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch create mode 100644 queue-5.4/drm-panel-orientation-quirks-use-generic-orientation.patch create mode 100644 queue-5.4/drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch create mode 100644 queue-5.4/drm-tegra-hub-do-not-enable-orphaned-window-group.patch create mode 100644 queue-5.4/drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch create mode 100644 queue-5.4/gpu-host1x-detach-driver-on-unregister.patch create mode 100644 queue-5.4/i40e-protect-ring-accesses-with-read-and-write_once.patch create mode 100644 queue-5.4/ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch create mode 100644 queue-5.4/iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch create mode 100644 queue-5.4/ixgbe-protect-ring-accesses-with-read-and-write_once.patch create mode 100644 queue-5.4/net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch create mode 100644 queue-5.4/net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch create mode 100644 queue-5.4/nvme-rdma-assign-completion-vector-correctly.patch create mode 100644 queue-5.4/perf-x86-rapl-fix-rapl-config-variable-bug.patch create mode 100644 queue-5.4/perf-x86-rapl-move-rapl-support-to-common-x86-code.patch create mode 100644 queue-5.4/powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch create mode 100644 queue-5.4/regmap-fix-alignment-issue.patch create mode 100644 queue-5.4/s390-kasan-fix-early-pgm-check-handler-execution.patch create mode 100644 queue-5.4/sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch create mode 100644 queue-5.4/scsi-mptscsih-fix-read-sense-data-size.patch create mode 100644 queue-5.4/spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch create mode 100644 queue-5.4/spi-spidev-fix-a-race-between-spidev_release-and-spi.patch create mode 100644 queue-5.4/usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch create mode 100644 queue-5.4/x86-entry-increase-entry_stack-size-to-a-full-page.patch diff --git a/queue-5.4/alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch b/queue-5.4/alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch new file mode 100644 index 00000000000..14ea7782007 --- /dev/null +++ b/queue-5.4/alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch @@ -0,0 +1,53 @@ +From 51f832ab5c2be65628102846707b43b2fd9dff05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 11:49:09 -0500 +Subject: ALSA: hda: Intel: add missing PCI IDs for ICL-H, TGL-H and EKL + +From: Pierre-Louis Bossart + +[ Upstream commit d50313a5a0d803bcf55121a2b82086633060d05e ] + +Mirror PCI ids used for SOF. + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20200617164909.18225-1-pierre-louis.bossart@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_intel.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 612441508e80a..95b0fdffc504c 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2433,6 +2433,9 @@ static const struct pci_device_id azx_ids[] = { + /* Icelake */ + { PCI_DEVICE(0x8086, 0x34c8), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, ++ /* Icelake-H */ ++ { PCI_DEVICE(0x8086, 0x3dc8), ++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, + /* Jasperlake */ + { PCI_DEVICE(0x8086, 0x38c8), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, +@@ -2441,9 +2444,14 @@ static const struct pci_device_id azx_ids[] = { + /* Tigerlake */ + { PCI_DEVICE(0x8086, 0xa0c8), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, ++ /* Tigerlake-H */ ++ { PCI_DEVICE(0x8086, 0x43c8), ++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, + /* Elkhart Lake */ + { PCI_DEVICE(0x8086, 0x4b55), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, ++ { PCI_DEVICE(0x8086, 0x4b58), ++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, + /* Broxton-P(Apollolake) */ + { PCI_DEVICE(0x8086, 0x5a98), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_BROXTON }, +-- +2.25.1 + diff --git a/queue-5.4/arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch b/queue-5.4/arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch new file mode 100644 index 00000000000..260e67d9cc0 --- /dev/null +++ b/queue-5.4/arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch @@ -0,0 +1,52 @@ +From 2e5a43fe14212401fa49f644480e652724af5880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Jun 2020 17:18:56 -0700 +Subject: ARM: dts: omap4-droid4: Fix spi configuration and increase rate + +From: Tony Lindgren + +[ Upstream commit 0df12a01f4857495816b05f048c4c31439446e35 ] + +We can currently sometimes get "RXS timed out" errors and "EOT timed out" +errors with spi transfers. + +These errors can be made easy to reproduce by reading the cpcap iio +values in a loop while keeping the CPUs busy by also reading /dev/urandom. + +The "RXS timed out" errors we can fix by adding spi-cpol and spi-cpha +in addition to the spi-cs-high property we already have. + +The "EOT timed out" errors we can fix by increasing the spi clock rate +to 9.6 MHz. Looks similar MC13783 PMIC says it works at spi clock rates +up to 20 MHz, so let's assume we can pick any rate up to 20 MHz also +for cpcap. + +Cc: maemo-leste@lists.dyne.org +Cc: Merlijn Wajer +Cc: Pavel Machek +Cc: Sebastian Reichel +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +index 82f7ae030600d..ab91c4ebb1463 100644 +--- a/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi ++++ b/arch/arm/boot/dts/motorola-cpcap-mapphone.dtsi +@@ -13,8 +13,10 @@ + #interrupt-cells = <2>; + #address-cells = <1>; + #size-cells = <0>; +- spi-max-frequency = <3000000>; ++ spi-max-frequency = <9600000>; + spi-cs-high; ++ spi-cpol; ++ spi-cpha; + + cpcap_adc: adc { + compatible = "motorola,mapphone-cpcap-adc"; +-- +2.25.1 + diff --git a/queue-5.4/arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch b/queue-5.4/arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch new file mode 100644 index 00000000000..47877839bbb --- /dev/null +++ b/queue-5.4/arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch @@ -0,0 +1,71 @@ +From 7771c92660bd86a8c7a60f712b537f0d4ff7238a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 4 Jun 2020 20:54:49 +0800 +Subject: ARM: imx6: add missing put_device() call in imx6q_suspend_init() + +From: yu kuai + +[ Upstream commit 4845446036fc9c13f43b54a65c9b757c14f5141b ] + +if of_find_device_by_node() succeed, imx6q_suspend_init() doesn't have a +corresponding put_device(). Thus add a jump target to fix the exception +handling for this function implementation. + +Signed-off-by: yu kuai +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/mach-imx/pm-imx6.c | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c +index 1c0ecad3620e0..baf3b47601af0 100644 +--- a/arch/arm/mach-imx/pm-imx6.c ++++ b/arch/arm/mach-imx/pm-imx6.c +@@ -493,14 +493,14 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) + if (!ocram_pool) { + pr_warn("%s: ocram pool unavailable!\n", __func__); + ret = -ENODEV; +- goto put_node; ++ goto put_device; + } + + ocram_base = gen_pool_alloc(ocram_pool, MX6Q_SUSPEND_OCRAM_SIZE); + if (!ocram_base) { + pr_warn("%s: unable to alloc ocram!\n", __func__); + ret = -ENOMEM; +- goto put_node; ++ goto put_device; + } + + ocram_pbase = gen_pool_virt_to_phys(ocram_pool, ocram_base); +@@ -523,7 +523,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) + ret = imx6_pm_get_base(&pm_info->mmdc_base, socdata->mmdc_compat); + if (ret) { + pr_warn("%s: failed to get mmdc base %d!\n", __func__, ret); +- goto put_node; ++ goto put_device; + } + + ret = imx6_pm_get_base(&pm_info->src_base, socdata->src_compat); +@@ -570,7 +570,7 @@ static int __init imx6q_suspend_init(const struct imx6_pm_socdata *socdata) + &imx6_suspend, + MX6Q_SUSPEND_OCRAM_SIZE - sizeof(*pm_info)); + +- goto put_node; ++ goto put_device; + + pl310_cache_map_failed: + iounmap(pm_info->gpc_base.vbase); +@@ -580,6 +580,8 @@ iomuxc_map_failed: + iounmap(pm_info->src_base.vbase); + src_map_failed: + iounmap(pm_info->mmdc_base.vbase); ++put_device: ++ put_device(&pdev->dev); + put_node: + of_node_put(node); + +-- +2.25.1 + diff --git a/queue-5.4/asoc-sof-intel-add-pci-id-for-cometlake-s.patch b/queue-5.4/asoc-sof-intel-add-pci-id-for-cometlake-s.patch new file mode 100644 index 00000000000..3c8a3eb0fe2 --- /dev/null +++ b/queue-5.4/asoc-sof-intel-add-pci-id-for-cometlake-s.patch @@ -0,0 +1,37 @@ +From b999f0741c5b972c2cdec0a928f96860b8c1e567 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 11:47:54 -0500 +Subject: ASoC: SOF: Intel: add PCI ID for CometLake-S + +From: Pierre-Louis Bossart + +[ Upstream commit 258fb4f4c34a0db9d3834aba6784d7b322176bb9 ] + +Mirror ID added for legacy HDaudio + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20200617164755.18104-3-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/sof-pci-dev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/sof/sof-pci-dev.c b/sound/soc/sof/sof-pci-dev.c +index d66412a778739..3f79cd03507c9 100644 +--- a/sound/soc/sof/sof-pci-dev.c ++++ b/sound/soc/sof/sof-pci-dev.c +@@ -420,6 +420,8 @@ static const struct pci_device_id sof_pci_ids[] = { + #if IS_ENABLED(CONFIG_SND_SOC_SOF_COMETLAKE_H) + { PCI_DEVICE(0x8086, 0x06c8), + .driver_data = (unsigned long)&cml_desc}, ++ { PCI_DEVICE(0x8086, 0xa3f0), /* CML-S */ ++ .driver_data = (unsigned long)&cml_desc}, + #endif + #if IS_ENABLED(CONFIG_SND_SOC_SOF_TIGERLAKE) + { PCI_DEVICE(0x8086, 0xa0c8), +-- +2.25.1 + diff --git a/queue-5.4/block-release-bip-in-a-right-way-in-error-path.patch b/queue-5.4/block-release-bip-in-a-right-way-in-error-path.patch new file mode 100644 index 00000000000..67f05801365 --- /dev/null +++ b/queue-5.4/block-release-bip-in-a-right-way-in-error-path.patch @@ -0,0 +1,72 @@ +From 695bc1dcb12fb35158d844d324fde398f153b4bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Jun 2020 18:21:39 +0800 +Subject: block: release bip in a right way in error path + +From: Chengguang Xu + +[ Upstream commit 0b8eb629a700c0ef15a437758db8255f8444e76c ] + +Release bip using kfree() in error path when that was allocated +by kmalloc(). + +Signed-off-by: Chengguang Xu +Reviewed-by: Christoph Hellwig +Acked-by: Martin K. Petersen +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bio-integrity.c | 23 ++++++++++++++--------- + 1 file changed, 14 insertions(+), 9 deletions(-) + +diff --git a/block/bio-integrity.c b/block/bio-integrity.c +index ae07dd78e9518..c9dc2b17ce251 100644 +--- a/block/bio-integrity.c ++++ b/block/bio-integrity.c +@@ -24,6 +24,18 @@ void blk_flush_integrity(void) + flush_workqueue(kintegrityd_wq); + } + ++void __bio_integrity_free(struct bio_set *bs, struct bio_integrity_payload *bip) ++{ ++ if (bs && mempool_initialized(&bs->bio_integrity_pool)) { ++ if (bip->bip_vec) ++ bvec_free(&bs->bvec_integrity_pool, bip->bip_vec, ++ bip->bip_slab); ++ mempool_free(bip, &bs->bio_integrity_pool); ++ } else { ++ kfree(bip); ++ } ++} ++ + /** + * bio_integrity_alloc - Allocate integrity payload and attach it to bio + * @bio: bio to attach integrity metadata to +@@ -75,7 +87,7 @@ struct bio_integrity_payload *bio_integrity_alloc(struct bio *bio, + + return bip; + err: +- mempool_free(bip, &bs->bio_integrity_pool); ++ __bio_integrity_free(bs, bip); + return ERR_PTR(-ENOMEM); + } + EXPORT_SYMBOL(bio_integrity_alloc); +@@ -96,14 +108,7 @@ void bio_integrity_free(struct bio *bio) + kfree(page_address(bip->bip_vec->bv_page) + + bip->bip_vec->bv_offset); + +- if (bs && mempool_initialized(&bs->bio_integrity_pool)) { +- bvec_free(&bs->bvec_integrity_pool, bip->bip_vec, bip->bip_slab); +- +- mempool_free(bip, &bs->bio_integrity_pool); +- } else { +- kfree(bip); +- } +- ++ __bio_integrity_free(bs, bip); + bio->bi_integrity = NULL; + bio->bi_opf &= ~REQ_INTEGRITY; + } +-- +2.25.1 + diff --git a/queue-5.4/cifs-update-ctime-and-mtime-during-truncate.patch b/queue-5.4/cifs-update-ctime-and-mtime-during-truncate.patch new file mode 100644 index 00000000000..fa802e3e216 --- /dev/null +++ b/queue-5.4/cifs-update-ctime-and-mtime-during-truncate.patch @@ -0,0 +1,49 @@ +From 584748c19c960e7f31e02d8af5762ec5ac750e25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 19 Jun 2020 22:51:29 -0400 +Subject: cifs: update ctime and mtime during truncate + +From: Zhang Xiaoxu + +[ Upstream commit 5618303d8516f8ac5ecfe53ee8e8bc9a40eaf066 ] + +As the man description of the truncate, if the size changed, +then the st_ctime and st_mtime fields should be updated. But +in cifs, we doesn't do it. + +It lead the xfstests generic/313 failed. + +So, add the ATTR_MTIME|ATTR_CTIME flags on attrs when change +the file size + +Reported-by: Hulk Robot +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/inode.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index 6045b48682752..5ae458505f630 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -2270,6 +2270,15 @@ set_size_out: + if (rc == 0) { + cifsInode->server_eof = attrs->ia_size; + cifs_setsize(inode, attrs->ia_size); ++ ++ /* ++ * The man page of truncate says if the size changed, ++ * then the st_ctime and st_mtime fields for the file ++ * are updated. ++ */ ++ attrs->ia_ctime = attrs->ia_mtime = current_time(inode); ++ attrs->ia_valid |= ATTR_CTIME | ATTR_MTIME; ++ + cifs_truncate_page(inode->i_mapping, inode->i_size); + } + +-- +2.25.1 + diff --git a/queue-5.4/drm-mcde-fix-display-initialization-problem.patch b/queue-5.4/drm-mcde-fix-display-initialization-problem.patch new file mode 100644 index 00000000000..c6ac0f9b240 --- /dev/null +++ b/queue-5.4/drm-mcde-fix-display-initialization-problem.patch @@ -0,0 +1,62 @@ +From 033e170a703238eaa965cc7602d6e06d5b9eea90 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 14 Jun 2020 00:30:26 +0200 +Subject: drm: mcde: Fix display initialization problem + +From: Linus Walleij + +[ Upstream commit b984b6d8b52372b98cce0a6ff6c2787f50665b87 ] + +The following bug appeared in the MCDE driver/display +initialization during the recent merge window. + +First the place we call drm_fbdev_generic_setup() in the +wrong place: this needs to be called AFTER calling +drm_dev_register() else we get this splat: + + ------------[ cut here ]------------ +WARNING: CPU: 0 PID: 1 at ../drivers/gpu/drm/drm_fb_helper.c:2198 drm_fbdev_generic_setup+0x164/0x1a8 +mcde a0350000.mcde: Device has not been registered. +Modules linked in: +Hardware name: ST-Ericsson Ux5x0 platform (Device Tree Support) +[] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[] (show_stack) from [] (dump_stack+0x9c/0xb0) +[] (dump_stack) from [] (__warn+0xb8/0xd0) +[] (__warn) from [] (warn_slowpath_fmt+0x74/0xb8) +[] (warn_slowpath_fmt) from [] (drm_fbdev_generic_setup+0x164/0x1a8) +[] (drm_fbdev_generic_setup) from [] (mcde_drm_bind+0xc4/0x160) +[] (mcde_drm_bind) from [] (try_to_bring_up_master+0x15c/0x1a4) +(...) + +Signed-off-by: Linus Walleij +Reviewed-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20200613223027.4189309-1-linus.walleij@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mcde/mcde_drv.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c +index 5649887d2b901..16e5fb9ec784d 100644 +--- a/drivers/gpu/drm/mcde/mcde_drv.c ++++ b/drivers/gpu/drm/mcde/mcde_drv.c +@@ -215,7 +215,6 @@ static int mcde_modeset_init(struct drm_device *drm) + + drm_mode_config_reset(drm); + drm_kms_helper_poll_init(drm); +- drm_fbdev_generic_setup(drm, 32); + + return 0; + +@@ -282,6 +281,8 @@ static int mcde_drm_bind(struct device *dev) + if (ret < 0) + goto unbind; + ++ drm_fbdev_generic_setup(drm, 32); ++ + return 0; + + unbind: +-- +2.25.1 + diff --git a/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch b/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch new file mode 100644 index 00000000000..9e90743e85c --- /dev/null +++ b/queue-5.4/drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch @@ -0,0 +1,41 @@ +From f5035934c94996be21f60707208841db89bee0d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 May 2020 11:30:24 +0200 +Subject: drm: panel-orientation-quirks: Add quirk for Asus T101HA panel + +From: Hans de Goede + +[ Upstream commit 6c22bc18a3b93a38018844636557ad02e588e055 ] + +Like the Asus T100HA the Asus T101HA also uses a panel which has been +mounted 90 degrees rotated, albeit in the opposite direction. +Add a quirk for this. + +Reviewed-by: Emil Velikov +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20200531093025.28050-1-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index ffd95bfeaa94c..d11d83703931e 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -121,6 +121,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100HAN"), + }, + .driver_data = (void *)&asus_t100ha, ++ }, { /* Asus T101HA */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* GPD MicroPC (generic strings, also match on bios date) */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"), +-- +2.25.1 + diff --git a/queue-5.4/drm-panel-orientation-quirks-use-generic-orientation.patch b/queue-5.4/drm-panel-orientation-quirks-use-generic-orientation.patch new file mode 100644 index 00000000000..486bb8149bd --- /dev/null +++ b/queue-5.4/drm-panel-orientation-quirks-use-generic-orientation.patch @@ -0,0 +1,53 @@ +From 16752963a74c632c87642c2ecd6ccb8a12595eea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 May 2020 11:30:25 +0200 +Subject: drm: panel-orientation-quirks: Use generic orientation-data for Acer + S1003 + +From: Hans de Goede + +[ Upstream commit a05caf9e62a85d12da27e814ac13195f4683f21c ] + +The Acer S1003 has proper DMI strings for sys-vendor and product-name, +so we do not need to match by BIOS-date. + +This means that the Acer S1003 can use the generic lcd800x1280_rightside_up +drm_dmi_panel_orientation_data struct which is also used by other quirks. + +Reviewed-by: Emil Velikov +Signed-off-by: Hans de Goede +Link: https://patchwork.freedesktop.org/patch/msgid/20200531093025.28050-2-hdegoede@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_panel_orientation_quirks.c | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index d11d83703931e..d00ea384dcbfe 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -30,12 +30,6 @@ struct drm_dmi_panel_orientation_data { + int orientation; + }; + +-static const struct drm_dmi_panel_orientation_data acer_s1003 = { +- .width = 800, +- .height = 1280, +- .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP, +-}; +- + static const struct drm_dmi_panel_orientation_data asus_t100ha = { + .width = 800, + .height = 1280, +@@ -114,7 +108,7 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Acer"), + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "One S1003"), + }, +- .driver_data = (void *)&acer_s1003, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* Asus T100HA */ + .matches = { + DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), +-- +2.25.1 + diff --git a/queue-5.4/drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch b/queue-5.4/drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch new file mode 100644 index 00000000000..99ee7a1cfad --- /dev/null +++ b/queue-5.4/drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch @@ -0,0 +1,55 @@ +From 99e19a0f06e53027b4b9fb998cf557627c8c62af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 May 2020 16:07:24 +0200 +Subject: drm/sun4i: mixer: Call of_dma_configure if there's an IOMMU + +From: Maxime Ripard + +[ Upstream commit 842ec61f4006a6477a9deaedd69131e9f46e4cb5 ] + +The main DRM device is actually a virtual device so it doesn't have the +iommus property, which is instead on the DMA masters, in this case the +mixers. + +Add a call to of_dma_configure with the mixers DT node but on the DRM +virtual device to configure it in the same way than the mixers. + +Reviewed-by: Paul Kocialkowski +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/9a4daf438dd3f2fe07afb23688bfb793a0613d7d.1589378833.git-series.maxime@cerno.tech +(cherry picked from commit b718102dbdfd0285ad559687a30e27cc9124e592) +[Maxime: Applied to -fixes since it missed the merge window and display is + broken without it] +Signed-off-by: Maxime Ripard +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/sun4i/sun8i_mixer.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.c b/drivers/gpu/drm/sun4i/sun8i_mixer.c +index 18b4881f44814..e24f225d80f1f 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.c ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.c +@@ -452,6 +452,19 @@ static int sun8i_mixer_bind(struct device *dev, struct device *master, + mixer->engine.ops = &sun8i_engine_ops; + mixer->engine.node = dev->of_node; + ++ if (of_find_property(dev->of_node, "iommus", NULL)) { ++ /* ++ * This assume we have the same DMA constraints for ++ * all our the mixers in our pipeline. This sounds ++ * bad, but it has always been the case for us, and ++ * DRM doesn't do per-device allocation either, so we ++ * would need to fix DRM first... ++ */ ++ ret = of_dma_configure(drm->dev, dev->of_node, true); ++ if (ret) ++ return ret; ++ } ++ + /* + * While this function can fail, we shouldn't do anything + * if this happens. Some early DE2 DT entries don't provide +-- +2.25.1 + diff --git a/queue-5.4/drm-tegra-hub-do-not-enable-orphaned-window-group.patch b/queue-5.4/drm-tegra-hub-do-not-enable-orphaned-window-group.patch new file mode 100644 index 00000000000..08fce6a74c6 --- /dev/null +++ b/queue-5.4/drm-tegra-hub-do-not-enable-orphaned-window-group.patch @@ -0,0 +1,52 @@ +From f98d2ee52c5248bb7dd126f290f937c135360822 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 19 May 2020 02:03:01 -0700 +Subject: drm/tegra: hub: Do not enable orphaned window group + +From: Nicolin Chen + +[ Upstream commit ef4e417eb3ec7fe657928f10ac1d2154d8a5fb38 ] + +Though the unconditional enable/disable code is not a final solution, +we don't want to run into a NULL pointer situation when window group +doesn't link to its DC parent if the DC is disabled in Device Tree. + +So this patch simply adds a check to make sure that window group has +a valid parent before running into tegra_windowgroup_enable/disable. + +Signed-off-by: Nicolin Chen +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/hub.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/tegra/hub.c b/drivers/gpu/drm/tegra/hub.c +index 839b49c40e514..767fb440a79d9 100644 +--- a/drivers/gpu/drm/tegra/hub.c ++++ b/drivers/gpu/drm/tegra/hub.c +@@ -141,7 +141,9 @@ int tegra_display_hub_prepare(struct tegra_display_hub *hub) + for (i = 0; i < hub->soc->num_wgrps; i++) { + struct tegra_windowgroup *wgrp = &hub->wgrps[i]; + +- tegra_windowgroup_enable(wgrp); ++ /* Skip orphaned window group whose parent DC is disabled */ ++ if (wgrp->parent) ++ tegra_windowgroup_enable(wgrp); + } + + return 0; +@@ -158,7 +160,9 @@ void tegra_display_hub_cleanup(struct tegra_display_hub *hub) + for (i = 0; i < hub->soc->num_wgrps; i++) { + struct tegra_windowgroup *wgrp = &hub->wgrps[i]; + +- tegra_windowgroup_disable(wgrp); ++ /* Skip orphaned window group whose parent DC is disabled */ ++ if (wgrp->parent) ++ tegra_windowgroup_disable(wgrp); + } + } + +-- +2.25.1 + diff --git a/queue-5.4/drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch b/queue-5.4/drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch new file mode 100644 index 00000000000..56ad14a6430 --- /dev/null +++ b/queue-5.4/drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch @@ -0,0 +1,56 @@ +From d16dffa06e94a766cc508fb659b0d88b8ae6fc6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jun 2020 20:30:25 +0800 +Subject: drm/ttm: Fix dma_fence refcnt leak when adding move fence +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Xiyu Yang + +[ Upstream commit 11425c4519e2c974a100fc984867046d905b9380 ] + +ttm_bo_add_move_fence() invokes dma_fence_get(), which returns a +reference of the specified dma_fence object to "fence" with increased +refcnt. + +When ttm_bo_add_move_fence() returns, local variable "fence" becomes +invalid, so the refcount should be decreased to keep refcount balanced. + +The reference counting issue happens in one exception handling path of +ttm_bo_add_move_fence(). When no_wait_gpu flag is equals to true, the +function forgets to decrease the refcnt increased by dma_fence_get(), +causing a refcnt leak. + +Fix this issue by calling dma_fence_put() when no_wait_gpu flag is +equals to true. + +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/370221/ +Signed-off-by: Christian König +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/ttm/ttm_bo.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c +index abf165b2f64fc..3ce8ad7603c7f 100644 +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -941,8 +941,10 @@ static int ttm_bo_add_move_fence(struct ttm_buffer_object *bo, + if (!fence) + return 0; + +- if (no_wait_gpu) ++ if (no_wait_gpu) { ++ dma_fence_put(fence); + return -EBUSY; ++ } + + dma_resv_add_shared_fence(bo->base.resv, fence); + +-- +2.25.1 + diff --git a/queue-5.4/gpu-host1x-detach-driver-on-unregister.patch b/queue-5.4/gpu-host1x-detach-driver-on-unregister.patch new file mode 100644 index 00000000000..08eb534cfaa --- /dev/null +++ b/queue-5.4/gpu-host1x-detach-driver-on-unregister.patch @@ -0,0 +1,55 @@ +From c19ffdc5e0a0846ff6fe2e5dba02b2b3a607dcb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Apr 2020 19:38:02 +0200 +Subject: gpu: host1x: Detach driver on unregister + +From: Thierry Reding + +[ Upstream commit d9a0a05bf8c76e6dc79230669a8b5d685b168c30 ] + +Currently when a host1x device driver is unregistered, it is not +detached from the host1x controller, which means that the device +will stay around and when the driver is registered again, it may +bind to the old, stale device rather than the new one that was +created from scratch upon driver registration. This in turn can +cause various weird crashes within the driver core because it is +confronted with a device that was already deleted. + +Fix this by detaching the driver from the host1x controller when +it is unregistered. This ensures that the deleted device also is +no longer present in the device list that drivers will bind to. + +Reported-by: Sowjanya Komatineni +Signed-off-by: Thierry Reding +Tested-by: Sowjanya Komatineni +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/bus.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/host1x/bus.c b/drivers/gpu/host1x/bus.c +index 742aa9ff21b87..fcda8621ae6f9 100644 +--- a/drivers/gpu/host1x/bus.c ++++ b/drivers/gpu/host1x/bus.c +@@ -686,8 +686,17 @@ EXPORT_SYMBOL(host1x_driver_register_full); + */ + void host1x_driver_unregister(struct host1x_driver *driver) + { ++ struct host1x *host1x; ++ + driver_unregister(&driver->driver); + ++ mutex_lock(&devices_lock); ++ ++ list_for_each_entry(host1x, &devices, list) ++ host1x_detach_driver(host1x, driver); ++ ++ mutex_unlock(&devices_lock); ++ + mutex_lock(&drivers_lock); + list_del_init(&driver->list); + mutex_unlock(&drivers_lock); +-- +2.25.1 + diff --git a/queue-5.4/i40e-protect-ring-accesses-with-read-and-write_once.patch b/queue-5.4/i40e-protect-ring-accesses-with-read-and-write_once.patch new file mode 100644 index 00000000000..78e8d4b632a --- /dev/null +++ b/queue-5.4/i40e-protect-ring-accesses-with-read-and-write_once.patch @@ -0,0 +1,110 @@ +From 42fff6051ab899de6b054e4638d8e275c745c223 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2020 13:19:44 +0000 +Subject: i40e: protect ring accesses with READ- and WRITE_ONCE + +From: Ciara Loftus + +[ Upstream commit d59e267912cd90b0adf33b4659050d831e746317 ] + +READ_ONCE should be used when reading rings prior to accessing the +statistics pointer. Introduce this as well as the corresponding WRITE_ONCE +usage when allocating and freeing the rings, to ensure protected access. + +Signed-off-by: Ciara Loftus +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 29 ++++++++++++++------- + 1 file changed, 19 insertions(+), 10 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index a8dd0228b6787..095ed81cc0ba4 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -458,11 +458,15 @@ static void i40e_get_netdev_stats_struct(struct net_device *netdev, + i40e_get_netdev_stats_struct_tx(ring, stats); + + if (i40e_enabled_xdp_vsi(vsi)) { +- ring++; ++ ring = READ_ONCE(vsi->xdp_rings[i]); ++ if (!ring) ++ continue; + i40e_get_netdev_stats_struct_tx(ring, stats); + } + +- ring++; ++ ring = READ_ONCE(vsi->rx_rings[i]); ++ if (!ring) ++ continue; + do { + start = u64_stats_fetch_begin_irq(&ring->syncp); + packets = ring->stats.packets; +@@ -806,6 +810,8 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi) + for (q = 0; q < vsi->num_queue_pairs; q++) { + /* locate Tx ring */ + p = READ_ONCE(vsi->tx_rings[q]); ++ if (!p) ++ continue; + + do { + start = u64_stats_fetch_begin_irq(&p->syncp); +@@ -819,8 +825,11 @@ static void i40e_update_vsi_stats(struct i40e_vsi *vsi) + tx_linearize += p->tx_stats.tx_linearize; + tx_force_wb += p->tx_stats.tx_force_wb; + +- /* Rx queue is part of the same block as Tx queue */ +- p = &p[1]; ++ /* locate Rx ring */ ++ p = READ_ONCE(vsi->rx_rings[q]); ++ if (!p) ++ continue; ++ + do { + start = u64_stats_fetch_begin_irq(&p->syncp); + packets = p->stats.packets; +@@ -10816,10 +10825,10 @@ static void i40e_vsi_clear_rings(struct i40e_vsi *vsi) + if (vsi->tx_rings && vsi->tx_rings[0]) { + for (i = 0; i < vsi->alloc_queue_pairs; i++) { + kfree_rcu(vsi->tx_rings[i], rcu); +- vsi->tx_rings[i] = NULL; +- vsi->rx_rings[i] = NULL; ++ WRITE_ONCE(vsi->tx_rings[i], NULL); ++ WRITE_ONCE(vsi->rx_rings[i], NULL); + if (vsi->xdp_rings) +- vsi->xdp_rings[i] = NULL; ++ WRITE_ONCE(vsi->xdp_rings[i], NULL); + } + } + } +@@ -10853,7 +10862,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi) + if (vsi->back->hw_features & I40E_HW_WB_ON_ITR_CAPABLE) + ring->flags = I40E_TXR_FLAGS_WB_ON_ITR; + ring->itr_setting = pf->tx_itr_default; +- vsi->tx_rings[i] = ring++; ++ WRITE_ONCE(vsi->tx_rings[i], ring++); + + if (!i40e_enabled_xdp_vsi(vsi)) + goto setup_rx; +@@ -10871,7 +10880,7 @@ static int i40e_alloc_rings(struct i40e_vsi *vsi) + ring->flags = I40E_TXR_FLAGS_WB_ON_ITR; + set_ring_xdp(ring); + ring->itr_setting = pf->tx_itr_default; +- vsi->xdp_rings[i] = ring++; ++ WRITE_ONCE(vsi->xdp_rings[i], ring++); + + setup_rx: + ring->queue_index = i; +@@ -10884,7 +10893,7 @@ setup_rx: + ring->size = 0; + ring->dcb_tc = 0; + ring->itr_setting = pf->rx_itr_default; +- vsi->rx_rings[i] = ring; ++ WRITE_ONCE(vsi->rx_rings[i], ring); + } + + return 0; +-- +2.25.1 + diff --git a/queue-5.4/ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch b/queue-5.4/ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch new file mode 100644 index 00000000000..42b862b63c0 --- /dev/null +++ b/queue-5.4/ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch @@ -0,0 +1,48 @@ +From 3db8f94b0367d56e6513894bf82e3291eb1b1668 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 15:24:13 -0400 +Subject: ibmvnic: continue to init in CRQ reset returns H_CLOSED + +From: Dany Madden + +[ Upstream commit 8b40eb73509f5704a0e8cd25de0163876299f1a7 ] + +Continue the reset path when partner adapter is not ready or H_CLOSED is +returned from reset crq. This patch allows the CRQ init to proceed to +establish a valid CRQ for traffic to flow after reset. + +Signed-off-by: Dany Madden +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/ibm/ibmvnic.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 4f503b9a674c4..d585973606990 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -1878,13 +1878,18 @@ static int do_reset(struct ibmvnic_adapter *adapter, + release_sub_crqs(adapter, 1); + } else { + rc = ibmvnic_reset_crq(adapter); +- if (!rc) ++ if (rc == H_CLOSED || rc == H_SUCCESS) { + rc = vio_enable_interrupts(adapter->vdev); ++ if (rc) ++ netdev_err(adapter->netdev, ++ "Reset failed to enable interrupts. rc=%d\n", ++ rc); ++ } + } + + if (rc) { + netdev_err(adapter->netdev, +- "Couldn't initialize crq. rc=%d\n", rc); ++ "Reset couldn't initialize crq. rc=%d\n", rc); + goto out; + } + +-- +2.25.1 + diff --git a/queue-5.4/iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch b/queue-5.4/iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch new file mode 100644 index 00000000000..a7a7733b368 --- /dev/null +++ b/queue-5.4/iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch @@ -0,0 +1,113 @@ +From b8eb364bcecb219da8ac2f7ffbd4d06ad1eeaca1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jun 2020 07:13:42 +0800 +Subject: iommu/vt-d: Don't apply gfx quirks to untrusted devices + +From: Rajat Jain + +[ Upstream commit 67e8a5b18d41af9298db5c17193f671f235cce01 ] + +Currently, an external malicious PCI device can masquerade the VID:PID +of faulty gfx devices, and thus apply iommu quirks to effectively +disable the IOMMU restrictions for itself. + +Thus we need to ensure that the device we are applying quirks to, is +indeed an internal trusted device. + +Signed-off-by: Rajat Jain +Reviewed-by: Ashok Raj +Reviewed-by: Mika Westerberg +Acked-by: Lu Baolu +Link: https://lore.kernel.org/r/20200622231345.29722-4-baolu.lu@linux.intel.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-iommu.c | 37 +++++++++++++++++++++++++++++++++++++ + 1 file changed, 37 insertions(+) + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 6366b5fbb3a46..cdc1f4736a116 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -5962,6 +5962,23 @@ static bool intel_iommu_is_attach_deferred(struct iommu_domain *domain, + return dev->archdata.iommu == DEFER_DEVICE_DOMAIN_INFO; + } + ++/* ++ * Check that the device does not live on an external facing PCI port that is ++ * marked as untrusted. Such devices should not be able to apply quirks and ++ * thus not be able to bypass the IOMMU restrictions. ++ */ ++static bool risky_device(struct pci_dev *pdev) ++{ ++ if (pdev->untrusted) { ++ pci_info(pdev, ++ "Skipping IOMMU quirk for dev [%04X:%04X] on untrusted PCI link\n", ++ pdev->vendor, pdev->device); ++ pci_info(pdev, "Please check with your BIOS/Platform vendor about this\n"); ++ return true; ++ } ++ return false; ++} ++ + const struct iommu_ops intel_iommu_ops = { + .capable = intel_iommu_capable, + .domain_alloc = intel_iommu_domain_alloc, +@@ -5990,6 +6007,9 @@ const struct iommu_ops intel_iommu_ops = { + + static void quirk_iommu_igfx(struct pci_dev *dev) + { ++ if (risky_device(dev)) ++ return; ++ + pci_info(dev, "Disabling IOMMU for graphics on this chipset\n"); + dmar_map_gfx = 0; + } +@@ -6031,6 +6051,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x163D, quirk_iommu_igfx); + + static void quirk_iommu_rwbf(struct pci_dev *dev) + { ++ if (risky_device(dev)) ++ return; ++ + /* + * Mobile 4 Series Chipset neglects to set RWBF capability, + * but needs it. Same seems to hold for the desktop versions. +@@ -6061,6 +6084,9 @@ static void quirk_calpella_no_shadow_gtt(struct pci_dev *dev) + { + unsigned short ggc; + ++ if (risky_device(dev)) ++ return; ++ + if (pci_read_config_word(dev, GGC, &ggc)) + return; + +@@ -6094,6 +6120,12 @@ static void __init check_tylersburg_isoch(void) + pdev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x3a3e, NULL); + if (!pdev) + return; ++ ++ if (risky_device(pdev)) { ++ pci_dev_put(pdev); ++ return; ++ } ++ + pci_dev_put(pdev); + + /* System Management Registers. Might be hidden, in which case +@@ -6103,6 +6135,11 @@ static void __init check_tylersburg_isoch(void) + if (!pdev) + return; + ++ if (risky_device(pdev)) { ++ pci_dev_put(pdev); ++ return; ++ } ++ + if (pci_read_config_dword(pdev, 0x188, &vtisochctrl)) { + pci_dev_put(pdev); + return; +-- +2.25.1 + diff --git a/queue-5.4/ixgbe-protect-ring-accesses-with-read-and-write_once.patch b/queue-5.4/ixgbe-protect-ring-accesses-with-read-and-write_once.patch new file mode 100644 index 00000000000..ba7c26cf325 --- /dev/null +++ b/queue-5.4/ixgbe-protect-ring-accesses-with-read-and-write_once.patch @@ -0,0 +1,112 @@ +From c4d847aa8e2f156faa5057e8cd892efd06306f3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 9 Jun 2020 13:19:43 +0000 +Subject: ixgbe: protect ring accesses with READ- and WRITE_ONCE + +From: Ciara Loftus + +[ Upstream commit f140ad9fe2ae16f385f8fe4dc9cf67bb4c51d794 ] + +READ_ONCE should be used when reading rings prior to accessing the +statistics pointer. Introduce this as well as the corresponding WRITE_ONCE +usage when allocating and freeing the rings, to ensure protected access. + +Signed-off-by: Ciara Loftus +Tested-by: Andrew Bowers +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c | 12 ++++++------ + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 14 +++++++++++--- + 2 files changed, 17 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c +index cc3196ae5aea8..636e6e840afa2 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c +@@ -923,7 +923,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter, + ring->queue_index = txr_idx; + + /* assign ring to adapter */ +- adapter->tx_ring[txr_idx] = ring; ++ WRITE_ONCE(adapter->tx_ring[txr_idx], ring); + + /* update count and index */ + txr_count--; +@@ -950,7 +950,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter, + set_ring_xdp(ring); + + /* assign ring to adapter */ +- adapter->xdp_ring[xdp_idx] = ring; ++ WRITE_ONCE(adapter->xdp_ring[xdp_idx], ring); + + /* update count and index */ + xdp_count--; +@@ -993,7 +993,7 @@ static int ixgbe_alloc_q_vector(struct ixgbe_adapter *adapter, + ring->queue_index = rxr_idx; + + /* assign ring to adapter */ +- adapter->rx_ring[rxr_idx] = ring; ++ WRITE_ONCE(adapter->rx_ring[rxr_idx], ring); + + /* update count and index */ + rxr_count--; +@@ -1022,13 +1022,13 @@ static void ixgbe_free_q_vector(struct ixgbe_adapter *adapter, int v_idx) + + ixgbe_for_each_ring(ring, q_vector->tx) { + if (ring_is_xdp(ring)) +- adapter->xdp_ring[ring->queue_index] = NULL; ++ WRITE_ONCE(adapter->xdp_ring[ring->queue_index], NULL); + else +- adapter->tx_ring[ring->queue_index] = NULL; ++ WRITE_ONCE(adapter->tx_ring[ring->queue_index], NULL); + } + + ixgbe_for_each_ring(ring, q_vector->rx) +- adapter->rx_ring[ring->queue_index] = NULL; ++ WRITE_ONCE(adapter->rx_ring[ring->queue_index], NULL); + + adapter->q_vector[v_idx] = NULL; + napi_hash_del(&q_vector->napi); +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index edaa0bffa5c35..5336bfcd2d701 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -7064,7 +7064,10 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter) + } + + for (i = 0; i < adapter->num_rx_queues; i++) { +- struct ixgbe_ring *rx_ring = adapter->rx_ring[i]; ++ struct ixgbe_ring *rx_ring = READ_ONCE(adapter->rx_ring[i]); ++ ++ if (!rx_ring) ++ continue; + non_eop_descs += rx_ring->rx_stats.non_eop_descs; + alloc_rx_page += rx_ring->rx_stats.alloc_rx_page; + alloc_rx_page_failed += rx_ring->rx_stats.alloc_rx_page_failed; +@@ -7085,15 +7088,20 @@ void ixgbe_update_stats(struct ixgbe_adapter *adapter) + packets = 0; + /* gather some stats to the adapter struct that are per queue */ + for (i = 0; i < adapter->num_tx_queues; i++) { +- struct ixgbe_ring *tx_ring = adapter->tx_ring[i]; ++ struct ixgbe_ring *tx_ring = READ_ONCE(adapter->tx_ring[i]); ++ ++ if (!tx_ring) ++ continue; + restart_queue += tx_ring->tx_stats.restart_queue; + tx_busy += tx_ring->tx_stats.tx_busy; + bytes += tx_ring->stats.bytes; + packets += tx_ring->stats.packets; + } + for (i = 0; i < adapter->num_xdp_queues; i++) { +- struct ixgbe_ring *xdp_ring = adapter->xdp_ring[i]; ++ struct ixgbe_ring *xdp_ring = READ_ONCE(adapter->xdp_ring[i]); + ++ if (!xdp_ring) ++ continue; + restart_queue += xdp_ring->tx_stats.restart_queue; + tx_busy += xdp_ring->tx_stats.tx_busy; + bytes += xdp_ring->stats.bytes; +-- +2.25.1 + diff --git a/queue-5.4/net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch b/queue-5.4/net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch new file mode 100644 index 00000000000..72dd1f13457 --- /dev/null +++ b/queue-5.4/net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch @@ -0,0 +1,50 @@ +From aac232a511428a627c56fd96690b110dfea06208 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 10:31:40 +0200 +Subject: net: ethernet: mvneta: Add 2500BaseX support for SoCs without comphy + +From: Sascha Hauer + +[ Upstream commit 1a642ca7f38992b086101fe204a1ae3c90ed8016 ] + +The older SoCs like Armada XP support a 2500BaseX mode in the datasheets +referred to as DR-SGMII (Double rated SGMII) or HS-SGMII (High Speed +SGMII). This is an upclocked 1000BaseX mode, thus +PHY_INTERFACE_MODE_2500BASEX is the appropriate mode define for it. +adding support for it merely means writing the correct magic value into +the MVNETA_SERDES_CFG register. + +Signed-off-by: Sascha Hauer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index b0599b205b36e..9799253948281 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -108,6 +108,7 @@ + #define MVNETA_SERDES_CFG 0x24A0 + #define MVNETA_SGMII_SERDES_PROTO 0x0cc7 + #define MVNETA_QSGMII_SERDES_PROTO 0x0667 ++#define MVNETA_HSGMII_SERDES_PROTO 0x1107 + #define MVNETA_TYPE_PRIO 0x24bc + #define MVNETA_FORCE_UNI BIT(21) + #define MVNETA_TXQ_CMD_1 0x24e4 +@@ -3199,6 +3200,11 @@ static int mvneta_config_interface(struct mvneta_port *pp, + mvreg_write(pp, MVNETA_SERDES_CFG, + MVNETA_SGMII_SERDES_PROTO); + break; ++ ++ case PHY_INTERFACE_MODE_2500BASEX: ++ mvreg_write(pp, MVNETA_SERDES_CFG, ++ MVNETA_HSGMII_SERDES_PROTO); ++ break; + default: + return -EINVAL; + } +-- +2.25.1 + diff --git a/queue-5.4/net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch b/queue-5.4/net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch new file mode 100644 index 00000000000..9f8a27bdb6c --- /dev/null +++ b/queue-5.4/net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch @@ -0,0 +1,171 @@ +From 83c7e3a7b847ccc10eca607b2504d375c05654ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 10:31:39 +0200 +Subject: net: ethernet: mvneta: Fix Serdes configuration for SoCs without + comphy + +From: Sascha Hauer + +[ Upstream commit b4748553f53f2971e07d2619f13d461daac0f3bb ] + +The MVNETA_SERDES_CFG register is only available on older SoCs like the +Armada XP. On newer SoCs like the Armada 38x the fields are moved to +comphy. This patch moves the writes to this register next to the comphy +initialization, so that depending on the SoC either comphy or +MVNETA_SERDES_CFG is configured. +With this we no longer write to the MVNETA_SERDES_CFG on SoCs where it +doesn't exist. + +Suggested-by: Russell King +Signed-off-by: Sascha Hauer +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 80 +++++++++++++++------------ + 1 file changed, 44 insertions(+), 36 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index a10ae28ebc8aa..b0599b205b36e 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -104,6 +104,7 @@ + #define MVNETA_TX_IN_PRGRS BIT(1) + #define MVNETA_TX_FIFO_EMPTY BIT(8) + #define MVNETA_RX_MIN_FRAME_SIZE 0x247c ++/* Only exists on Armada XP and Armada 370 */ + #define MVNETA_SERDES_CFG 0x24A0 + #define MVNETA_SGMII_SERDES_PROTO 0x0cc7 + #define MVNETA_QSGMII_SERDES_PROTO 0x0667 +@@ -3164,26 +3165,55 @@ static int mvneta_setup_txqs(struct mvneta_port *pp) + return 0; + } + +-static int mvneta_comphy_init(struct mvneta_port *pp) ++static int mvneta_comphy_init(struct mvneta_port *pp, phy_interface_t interface) + { + int ret; + +- if (!pp->comphy) +- return 0; +- +- ret = phy_set_mode_ext(pp->comphy, PHY_MODE_ETHERNET, +- pp->phy_interface); ++ ret = phy_set_mode_ext(pp->comphy, PHY_MODE_ETHERNET, interface); + if (ret) + return ret; + + return phy_power_on(pp->comphy); + } + ++static int mvneta_config_interface(struct mvneta_port *pp, ++ phy_interface_t interface) ++{ ++ int ret = 0; ++ ++ if (pp->comphy) { ++ if (interface == PHY_INTERFACE_MODE_SGMII || ++ interface == PHY_INTERFACE_MODE_1000BASEX || ++ interface == PHY_INTERFACE_MODE_2500BASEX) { ++ ret = mvneta_comphy_init(pp, interface); ++ } ++ } else { ++ switch (interface) { ++ case PHY_INTERFACE_MODE_QSGMII: ++ mvreg_write(pp, MVNETA_SERDES_CFG, ++ MVNETA_QSGMII_SERDES_PROTO); ++ break; ++ ++ case PHY_INTERFACE_MODE_SGMII: ++ case PHY_INTERFACE_MODE_1000BASEX: ++ mvreg_write(pp, MVNETA_SERDES_CFG, ++ MVNETA_SGMII_SERDES_PROTO); ++ break; ++ default: ++ return -EINVAL; ++ } ++ } ++ ++ pp->phy_interface = interface; ++ ++ return ret; ++} ++ + static void mvneta_start_dev(struct mvneta_port *pp) + { + int cpu; + +- WARN_ON(mvneta_comphy_init(pp)); ++ WARN_ON(mvneta_config_interface(pp, pp->phy_interface)); + + mvneta_max_rx_size_set(pp, pp->pkt_size); + mvneta_txq_max_tx_size_set(pp, pp->pkt_size); +@@ -3561,14 +3591,10 @@ static void mvneta_mac_config(struct phylink_config *config, unsigned int mode, + if (state->speed == SPEED_2500) + new_ctrl4 |= MVNETA_GMAC4_SHORT_PREAMBLE_ENABLE; + +- if (pp->comphy && pp->phy_interface != state->interface && +- (state->interface == PHY_INTERFACE_MODE_SGMII || +- state->interface == PHY_INTERFACE_MODE_1000BASEX || +- state->interface == PHY_INTERFACE_MODE_2500BASEX)) { +- pp->phy_interface = state->interface; +- +- WARN_ON(phy_power_off(pp->comphy)); +- WARN_ON(mvneta_comphy_init(pp)); ++ if (pp->phy_interface != state->interface) { ++ if (pp->comphy) ++ WARN_ON(phy_power_off(pp->comphy)); ++ WARN_ON(mvneta_config_interface(pp, state->interface)); + } + + if (new_ctrl0 != gmac_ctrl0) +@@ -4464,20 +4490,10 @@ static void mvneta_conf_mbus_windows(struct mvneta_port *pp, + } + + /* Power up the port */ +-static int mvneta_port_power_up(struct mvneta_port *pp, int phy_mode) ++static void mvneta_port_power_up(struct mvneta_port *pp, int phy_mode) + { + /* MAC Cause register should be cleared */ + mvreg_write(pp, MVNETA_UNIT_INTR_CAUSE, 0); +- +- if (phy_mode == PHY_INTERFACE_MODE_QSGMII) +- mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_QSGMII_SERDES_PROTO); +- else if (phy_mode == PHY_INTERFACE_MODE_SGMII || +- phy_interface_mode_is_8023z(phy_mode)) +- mvreg_write(pp, MVNETA_SERDES_CFG, MVNETA_SGMII_SERDES_PROTO); +- else if (!phy_interface_mode_is_rgmii(phy_mode)) +- return -EINVAL; +- +- return 0; + } + + /* Device initialization routine */ +@@ -4661,11 +4677,7 @@ static int mvneta_probe(struct platform_device *pdev) + if (err < 0) + goto err_netdev; + +- err = mvneta_port_power_up(pp, phy_mode); +- if (err < 0) { +- dev_err(&pdev->dev, "can't power up port\n"); +- goto err_netdev; +- } ++ mvneta_port_power_up(pp, phy_mode); + + /* Armada3700 network controller does not support per-cpu + * operation, so only single NAPI should be initialized. +@@ -4818,11 +4830,7 @@ static int mvneta_resume(struct device *device) + } + } + mvneta_defaults_set(pp); +- err = mvneta_port_power_up(pp, pp->phy_interface); +- if (err < 0) { +- dev_err(device, "can't power up port\n"); +- return err; +- } ++ mvneta_port_power_up(pp, pp->phy_interface); + + netif_device_attach(dev); + +-- +2.25.1 + diff --git a/queue-5.4/nvme-rdma-assign-completion-vector-correctly.patch b/queue-5.4/nvme-rdma-assign-completion-vector-correctly.patch new file mode 100644 index 00000000000..9bcced18f7d --- /dev/null +++ b/queue-5.4/nvme-rdma-assign-completion-vector-correctly.patch @@ -0,0 +1,40 @@ +From 33e92d7a3c6dee073303304d815264233b73e6bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Jun 2020 17:55:25 +0300 +Subject: nvme-rdma: assign completion vector correctly + +From: Max Gurtovoy + +[ Upstream commit 032a9966a22a3596addf81dacf0c1736dfedc32a ] + +The completion vector index that is given during CQ creation can't +exceed the number of support vectors by the underlying RDMA device. This +violation currently can accure, for example, in case one will try to +connect with N regular read/write queues and M poll queues and the sum +of N + M > num_supported_vectors. This will lead to failure in establish +a connection to remote target. Instead, in that case, share a completion +vector between queues. + +Signed-off-by: Max Gurtovoy +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 73e8475ddc8ab..cd0d499781908 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -451,7 +451,7 @@ static int nvme_rdma_create_queue_ib(struct nvme_rdma_queue *queue) + * Spread I/O queues completion vectors according their queue index. + * Admin queues can always go on completion vector 0. + */ +- comp_vector = idx == 0 ? idx : idx - 1; ++ comp_vector = (idx == 0 ? idx : idx - 1) % ibdev->num_comp_vectors; + + /* Polling queues need direct cq polling context */ + if (nvme_rdma_poll_queue(queue)) +-- +2.25.1 + diff --git a/queue-5.4/perf-x86-rapl-fix-rapl-config-variable-bug.patch b/queue-5.4/perf-x86-rapl-fix-rapl-config-variable-bug.patch new file mode 100644 index 00000000000..cef8ba87726 --- /dev/null +++ b/queue-5.4/perf-x86-rapl-fix-rapl-config-variable-bug.patch @@ -0,0 +1,40 @@ +From 7ebd8d1926da1d49e037dc7b25cb7c42b132f8f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 28 May 2020 13:16:14 -0700 +Subject: perf/x86/rapl: Fix RAPL config variable bug + +From: Stephane Eranian + +[ Upstream commit 16accae3d97f97d7f61c4ee5d0002bccdef59088 ] + +This patch fixes a bug introduced by: + + fd3ae1e1587d6 ("perf/x86/rapl: Move RAPL support to common x86 code") + +The Kconfig variable name was wrong. It was missing the CONFIG_ prefix. + +Signed-off-by: Stephane Eranian +Signed-off-by: Ingo Molnar +Tested-by: Kim Phillips +Acked-by: Peter Zijlstra +Link: https://lore.kernel.org/r/20200528201614.250182-1-eranian@google.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/Makefile b/arch/x86/events/Makefile +index b418ef6878796..726e83c0a31a1 100644 +--- a/arch/x86/events/Makefile ++++ b/arch/x86/events/Makefile +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0-only + obj-y += core.o probe.o +-obj-$(PERF_EVENTS_INTEL_RAPL) += rapl.o ++obj-$(CONFIG_PERF_EVENTS_INTEL_RAPL) += rapl.o + obj-y += amd/ + obj-$(CONFIG_X86_LOCAL_APIC) += msr.o + obj-$(CONFIG_CPU_SUP_INTEL) += intel/ +-- +2.25.1 + diff --git a/queue-5.4/perf-x86-rapl-move-rapl-support-to-common-x86-code.patch b/queue-5.4/perf-x86-rapl-move-rapl-support-to-common-x86-code.patch new file mode 100644 index 00000000000..137fb35345e --- /dev/null +++ b/queue-5.4/perf-x86-rapl-move-rapl-support-to-common-x86-code.patch @@ -0,0 +1,109 @@ +From ba0bf86c953c0c5b392d50c4dbb69a89e237802e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 27 May 2020 15:46:55 -0700 +Subject: perf/x86/rapl: Move RAPL support to common x86 code + +From: Stephane Eranian + +[ Upstream commit fd3ae1e1587d64ef8cc8e361903d33625458073e ] + +To prepare for support of both Intel and AMD RAPL. + +As per the AMD PPR, Fam17h support Package RAPL counters to monitor power usage. +The RAPL counter operates as with Intel RAPL, and as such it is beneficial +to share the code. + +No change in functionality. + +Signed-off-by: Stephane Eranian +Signed-off-by: Ingo Molnar +Link: https://lore.kernel.org/r/20200527224659.206129-2-eranian@google.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/Kconfig | 6 +++--- + arch/x86/events/Makefile | 1 + + arch/x86/events/intel/Makefile | 2 -- + arch/x86/events/{intel => }/rapl.c | 9 ++++++--- + 4 files changed, 10 insertions(+), 8 deletions(-) + rename arch/x86/events/{intel => }/rapl.c (98%) + +diff --git a/arch/x86/events/Kconfig b/arch/x86/events/Kconfig +index 9a7a1446cb3a0..4a809c6cbd2f5 100644 +--- a/arch/x86/events/Kconfig ++++ b/arch/x86/events/Kconfig +@@ -10,11 +10,11 @@ config PERF_EVENTS_INTEL_UNCORE + available on NehalemEX and more modern processors. + + config PERF_EVENTS_INTEL_RAPL +- tristate "Intel rapl performance events" +- depends on PERF_EVENTS && CPU_SUP_INTEL && PCI ++ tristate "Intel/AMD rapl performance events" ++ depends on PERF_EVENTS && (CPU_SUP_INTEL || CPU_SUP_AMD) && PCI + default y + ---help--- +- Include support for Intel rapl performance events for power ++ Include support for Intel and AMD rapl performance events for power + monitoring on modern processors. + + config PERF_EVENTS_INTEL_CSTATE +diff --git a/arch/x86/events/Makefile b/arch/x86/events/Makefile +index 9e07f554333fb..b418ef6878796 100644 +--- a/arch/x86/events/Makefile ++++ b/arch/x86/events/Makefile +@@ -1,5 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0-only + obj-y += core.o probe.o ++obj-$(PERF_EVENTS_INTEL_RAPL) += rapl.o + obj-y += amd/ + obj-$(CONFIG_X86_LOCAL_APIC) += msr.o + obj-$(CONFIG_CPU_SUP_INTEL) += intel/ +diff --git a/arch/x86/events/intel/Makefile b/arch/x86/events/intel/Makefile +index 3468b0c1dc7c9..e67a5886336c1 100644 +--- a/arch/x86/events/intel/Makefile ++++ b/arch/x86/events/intel/Makefile +@@ -2,8 +2,6 @@ + obj-$(CONFIG_CPU_SUP_INTEL) += core.o bts.o + obj-$(CONFIG_CPU_SUP_INTEL) += ds.o knc.o + obj-$(CONFIG_CPU_SUP_INTEL) += lbr.o p4.o p6.o pt.o +-obj-$(CONFIG_PERF_EVENTS_INTEL_RAPL) += intel-rapl-perf.o +-intel-rapl-perf-objs := rapl.o + obj-$(CONFIG_PERF_EVENTS_INTEL_UNCORE) += intel-uncore.o + intel-uncore-objs := uncore.o uncore_nhmex.o uncore_snb.o uncore_snbep.o + obj-$(CONFIG_PERF_EVENTS_INTEL_CSTATE) += intel-cstate.o +diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/rapl.c +similarity index 98% +rename from arch/x86/events/intel/rapl.c +rename to arch/x86/events/rapl.c +index 5053a403e4ae0..3c222d6fdee3b 100644 +--- a/arch/x86/events/intel/rapl.c ++++ b/arch/x86/events/rapl.c +@@ -1,11 +1,14 @@ + // SPDX-License-Identifier: GPL-2.0-only + /* +- * Support Intel RAPL energy consumption counters ++ * Support Intel/AMD RAPL energy consumption counters + * Copyright (C) 2013 Google, Inc., Stephane Eranian + * + * Intel RAPL interface is specified in the IA-32 Manual Vol3b + * section 14.7.1 (September 2013) + * ++ * AMD RAPL interface for Fam17h is described in the public PPR: ++ * https://bugzilla.kernel.org/show_bug.cgi?id=206537 ++ * + * RAPL provides more controls than just reporting energy consumption + * however here we only expose the 3 energy consumption free running + * counters (pp0, pkg, dram). +@@ -58,8 +61,8 @@ + #include + #include + #include +-#include "../perf_event.h" +-#include "../probe.h" ++#include "perf_event.h" ++#include "probe.h" + + MODULE_LICENSE("GPL"); + +-- +2.25.1 + diff --git a/queue-5.4/powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch b/queue-5.4/powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch new file mode 100644 index 00000000000..6179432dc0c --- /dev/null +++ b/queue-5.4/powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch @@ -0,0 +1,71 @@ +From 04df90920ec535ce9d843b4888302f185929b9af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 11 Jun 2020 17:31:59 +0530 +Subject: powerpc/kvm/book3s64: Fix kernel crash with nested kvm & + DEBUG_VIRTUAL + +From: Aneesh Kumar K.V + +[ Upstream commit c1ed1754f271f6b7acb1bfdc8cfb62220fbed423 ] + +With CONFIG_DEBUG_VIRTUAL=y, __pa() checks for addr value and if it's +less than PAGE_OFFSET it leads to a BUG(). + + #define __pa(x) + ({ + VIRTUAL_BUG_ON((unsigned long)(x) < PAGE_OFFSET); + (unsigned long)(x) & 0x0fffffffffffffffUL; + }) + + kernel BUG at arch/powerpc/kvm/book3s_64_mmu_radix.c:43! + cpu 0x70: Vector: 700 (Program Check) at [c0000018a2187360] + pc: c000000000161b30: __kvmhv_copy_tofrom_guest_radix+0x130/0x1f0 + lr: c000000000161d5c: kvmhv_copy_from_guest_radix+0x3c/0x80 + ... + kvmhv_copy_from_guest_radix+0x3c/0x80 + kvmhv_load_from_eaddr+0x48/0xc0 + kvmppc_ld+0x98/0x1e0 + kvmppc_load_last_inst+0x50/0x90 + kvmppc_hv_emulate_mmio+0x288/0x2b0 + kvmppc_book3s_radix_page_fault+0xd8/0x2b0 + kvmppc_book3s_hv_page_fault+0x37c/0x1050 + kvmppc_vcpu_run_hv+0xbb8/0x1080 + kvmppc_vcpu_run+0x34/0x50 + kvm_arch_vcpu_ioctl_run+0x2fc/0x410 + kvm_vcpu_ioctl+0x2b4/0x8f0 + ksys_ioctl+0xf4/0x150 + sys_ioctl+0x28/0x80 + system_call_exception+0x104/0x1d0 + system_call_common+0xe8/0x214 + +kvmhv_copy_tofrom_guest_radix() uses a NULL value for to/from to +indicate direction of copy. + +Avoid calling __pa() if the value is NULL to avoid the BUG(). + +Signed-off-by: Aneesh Kumar K.V +[mpe: Massage change log a bit to mention CONFIG_DEBUG_VIRTUAL] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200611120159.680284-1-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_64_mmu_radix.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c +index 43b56f8f6bebd..da8375437d161 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c +@@ -38,7 +38,8 @@ unsigned long __kvmhv_copy_tofrom_guest_radix(int lpid, int pid, + /* Can't access quadrants 1 or 2 in non-HV mode, call the HV to do it */ + if (kvmhv_on_pseries()) + return plpar_hcall_norets(H_COPY_TOFROM_GUEST, lpid, pid, eaddr, +- __pa(to), __pa(from), n); ++ (to != NULL) ? __pa(to): 0, ++ (from != NULL) ? __pa(from): 0, n); + + quadrant = 1; + if (!pid) +-- +2.25.1 + diff --git a/queue-5.4/regmap-fix-alignment-issue.patch b/queue-5.4/regmap-fix-alignment-issue.patch new file mode 100644 index 00000000000..e6b324bd86d --- /dev/null +++ b/queue-5.4/regmap-fix-alignment-issue.patch @@ -0,0 +1,258 @@ +From ac61030d7fe8ae20538a5ab877667b18785ae120 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 31 May 2020 11:53:00 +0200 +Subject: regmap: fix alignment issue + +From: Jens Thoms Toerring + +[ Upstream commit 53d860952c8215cf9ae1ea33409c8cb71ad6ad3d ] + +The assembly and disassembly of data to be sent to or received from +a device invoke functions regmap_format_XX() and regmap_parse_XX() +that extract or insert data items from or into a buffer, using +assignments. In some cases the functions are called with a buffer +pointer with an odd address. On architectures with strict alignment +requirements this can result in a kernel crash. The assignments +have been replaced by functions that take alignment into account. + +Signed-off-by: Jens Thoms Toerring +Link: https://lore.kernel.org/r/20200531095300.GA27570@toerring.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/base/regmap/regmap.c | 100 ++++++++++++++++------------------- + 1 file changed, 46 insertions(+), 54 deletions(-) + +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index 508bbd6ea4396..320d23de02c29 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #define CREATE_TRACE_POINTS + #include "trace.h" +@@ -249,22 +250,20 @@ static void regmap_format_8(void *buf, unsigned int val, unsigned int shift) + + static void regmap_format_16_be(void *buf, unsigned int val, unsigned int shift) + { +- __be16 *b = buf; +- +- b[0] = cpu_to_be16(val << shift); ++ put_unaligned_be16(val << shift, buf); + } + + static void regmap_format_16_le(void *buf, unsigned int val, unsigned int shift) + { +- __le16 *b = buf; +- +- b[0] = cpu_to_le16(val << shift); ++ put_unaligned_le16(val << shift, buf); + } + + static void regmap_format_16_native(void *buf, unsigned int val, + unsigned int shift) + { +- *(u16 *)buf = val << shift; ++ u16 v = val << shift; ++ ++ memcpy(buf, &v, sizeof(v)); + } + + static void regmap_format_24(void *buf, unsigned int val, unsigned int shift) +@@ -280,43 +279,39 @@ static void regmap_format_24(void *buf, unsigned int val, unsigned int shift) + + static void regmap_format_32_be(void *buf, unsigned int val, unsigned int shift) + { +- __be32 *b = buf; +- +- b[0] = cpu_to_be32(val << shift); ++ put_unaligned_be32(val << shift, buf); + } + + static void regmap_format_32_le(void *buf, unsigned int val, unsigned int shift) + { +- __le32 *b = buf; +- +- b[0] = cpu_to_le32(val << shift); ++ put_unaligned_le32(val << shift, buf); + } + + static void regmap_format_32_native(void *buf, unsigned int val, + unsigned int shift) + { +- *(u32 *)buf = val << shift; ++ u32 v = val << shift; ++ ++ memcpy(buf, &v, sizeof(v)); + } + + #ifdef CONFIG_64BIT + static void regmap_format_64_be(void *buf, unsigned int val, unsigned int shift) + { +- __be64 *b = buf; +- +- b[0] = cpu_to_be64((u64)val << shift); ++ put_unaligned_be64((u64) val << shift, buf); + } + + static void regmap_format_64_le(void *buf, unsigned int val, unsigned int shift) + { +- __le64 *b = buf; +- +- b[0] = cpu_to_le64((u64)val << shift); ++ put_unaligned_le64((u64) val << shift, buf); + } + + static void regmap_format_64_native(void *buf, unsigned int val, + unsigned int shift) + { +- *(u64 *)buf = (u64)val << shift; ++ u64 v = (u64) val << shift; ++ ++ memcpy(buf, &v, sizeof(v)); + } + #endif + +@@ -333,35 +328,34 @@ static unsigned int regmap_parse_8(const void *buf) + + static unsigned int regmap_parse_16_be(const void *buf) + { +- const __be16 *b = buf; +- +- return be16_to_cpu(b[0]); ++ return get_unaligned_be16(buf); + } + + static unsigned int regmap_parse_16_le(const void *buf) + { +- const __le16 *b = buf; +- +- return le16_to_cpu(b[0]); ++ return get_unaligned_le16(buf); + } + + static void regmap_parse_16_be_inplace(void *buf) + { +- __be16 *b = buf; ++ u16 v = get_unaligned_be16(buf); + +- b[0] = be16_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static void regmap_parse_16_le_inplace(void *buf) + { +- __le16 *b = buf; ++ u16 v = get_unaligned_le16(buf); + +- b[0] = le16_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static unsigned int regmap_parse_16_native(const void *buf) + { +- return *(u16 *)buf; ++ u16 v; ++ ++ memcpy(&v, buf, sizeof(v)); ++ return v; + } + + static unsigned int regmap_parse_24(const void *buf) +@@ -376,69 +370,67 @@ static unsigned int regmap_parse_24(const void *buf) + + static unsigned int regmap_parse_32_be(const void *buf) + { +- const __be32 *b = buf; +- +- return be32_to_cpu(b[0]); ++ return get_unaligned_be32(buf); + } + + static unsigned int regmap_parse_32_le(const void *buf) + { +- const __le32 *b = buf; +- +- return le32_to_cpu(b[0]); ++ return get_unaligned_le32(buf); + } + + static void regmap_parse_32_be_inplace(void *buf) + { +- __be32 *b = buf; ++ u32 v = get_unaligned_be32(buf); + +- b[0] = be32_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static void regmap_parse_32_le_inplace(void *buf) + { +- __le32 *b = buf; ++ u32 v = get_unaligned_le32(buf); + +- b[0] = le32_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static unsigned int regmap_parse_32_native(const void *buf) + { +- return *(u32 *)buf; ++ u32 v; ++ ++ memcpy(&v, buf, sizeof(v)); ++ return v; + } + + #ifdef CONFIG_64BIT + static unsigned int regmap_parse_64_be(const void *buf) + { +- const __be64 *b = buf; +- +- return be64_to_cpu(b[0]); ++ return get_unaligned_be64(buf); + } + + static unsigned int regmap_parse_64_le(const void *buf) + { +- const __le64 *b = buf; +- +- return le64_to_cpu(b[0]); ++ return get_unaligned_le64(buf); + } + + static void regmap_parse_64_be_inplace(void *buf) + { +- __be64 *b = buf; ++ u64 v = get_unaligned_be64(buf); + +- b[0] = be64_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static void regmap_parse_64_le_inplace(void *buf) + { +- __le64 *b = buf; ++ u64 v = get_unaligned_le64(buf); + +- b[0] = le64_to_cpu(b[0]); ++ memcpy(buf, &v, sizeof(v)); + } + + static unsigned int regmap_parse_64_native(const void *buf) + { +- return *(u64 *)buf; ++ u64 v; ++ ++ memcpy(&v, buf, sizeof(v)); ++ return v; + } + #endif + +-- +2.25.1 + diff --git a/queue-5.4/s390-kasan-fix-early-pgm-check-handler-execution.patch b/queue-5.4/s390-kasan-fix-early-pgm-check-handler-execution.patch new file mode 100644 index 00000000000..e74f8c0d8fc --- /dev/null +++ b/queue-5.4/s390-kasan-fix-early-pgm-check-handler-execution.patch @@ -0,0 +1,42 @@ +From f58cdf218bb86193359acfbb258f9c2478d75f79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 15:05:49 +0200 +Subject: s390/kasan: fix early pgm check handler execution + +From: Vasily Gorbik + +[ Upstream commit 998f5bbe3dbdab81c1cfb1aef7c3892f5d24f6c7 ] + +Currently if early_pgm_check_handler is called it ends up in pgm check +loop. The problem is that early_pgm_check_handler is instrumented by +KASAN but executed without DAT flag enabled which leads to addressing +exception when KASAN checks try to access shadow memory. + +Fix that by executing early handlers with DAT flag on under KASAN as +expected. + +Reported-and-tested-by: Alexander Egorenkov +Reviewed-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/early.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c +index b432d63d0b373..2531776cf6cf9 100644 +--- a/arch/s390/kernel/early.c ++++ b/arch/s390/kernel/early.c +@@ -169,6 +169,8 @@ static noinline __init void setup_lowcore_early(void) + psw_t psw; + + psw.mask = PSW_MASK_BASE | PSW_DEFAULT_KEY | PSW_MASK_EA | PSW_MASK_BA; ++ if (IS_ENABLED(CONFIG_KASAN)) ++ psw.mask |= PSW_MASK_DAT; + psw.addr = (unsigned long) s390_base_ext_handler; + S390_lowcore.external_new_psw = psw; + psw.addr = (unsigned long) s390_base_pgm_handler; +-- +2.25.1 + diff --git a/queue-5.4/sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch b/queue-5.4/sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch new file mode 100644 index 00000000000..b12d4145138 --- /dev/null +++ b/queue-5.4/sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch @@ -0,0 +1,43 @@ +From 1cc216bd8f60c579b2358826d01722bf8c03fa79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 14:17:42 +0200 +Subject: sched/core: Check cpus_mask, not cpus_ptr in + __set_cpus_allowed_ptr(), to fix mask corruption + +From: Scott Wood + +[ Upstream commit fd844ba9ae59b51e34e77105d79f8eca780b3bd6 ] + +This function is concerned with the long-term CPU mask, not the +transitory mask the task might have while migrate disabled. Before +this patch, if a task was migrate-disabled at the time +__set_cpus_allowed_ptr() was called, and the new mask happened to be +equal to the CPU that the task was running on, then the mask update +would be lost. + +Signed-off-by: Scott Wood +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Link: https://lkml.kernel.org/r/20200617121742.cpxppyi7twxmpin7@linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 7238ef445dafb..8b3e99d095ae0 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -1649,7 +1649,7 @@ static int __set_cpus_allowed_ptr(struct task_struct *p, + goto out; + } + +- if (cpumask_equal(p->cpus_ptr, new_mask)) ++ if (cpumask_equal(&p->cpus_mask, new_mask)) + goto out; + + dest_cpu = cpumask_any_and(cpu_valid_mask, new_mask); +-- +2.25.1 + diff --git a/queue-5.4/scsi-mptscsih-fix-read-sense-data-size.patch b/queue-5.4/scsi-mptscsih-fix-read-sense-data-size.patch new file mode 100644 index 00000000000..75b33ff538e --- /dev/null +++ b/queue-5.4/scsi-mptscsih-fix-read-sense-data-size.patch @@ -0,0 +1,50 @@ +From 386c9e0af9b82b9b9d8f4ac9d27058f7061b81ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 16 Jun 2020 17:04:46 +0200 +Subject: scsi: mptscsih: Fix read sense data size + +From: Tomas Henzl + +[ Upstream commit afe89f115e84edbc76d316759e206580a06c6973 ] + +The sense data buffer in sense_buf_pool is allocated with size of +MPT_SENSE_BUFFER_ALLOC(64) (multiplied by req_depth) while SNS_LEN(sc)(96) +is used when reading the data. That may lead to a read from unallocated +area, sometimes from another (unallocated) page. To fix this, limit the +read size to MPT_SENSE_BUFFER_ALLOC. + +Link: https://lore.kernel.org/r/20200616150446.4840-1-thenzl@redhat.com +Co-developed-by: Stanislav Saner +Signed-off-by: Stanislav Saner +Signed-off-by: Tomas Henzl +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/message/fusion/mptscsih.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c +index f0737c57ed5fc..1491561d2e5c9 100644 +--- a/drivers/message/fusion/mptscsih.c ++++ b/drivers/message/fusion/mptscsih.c +@@ -118,8 +118,6 @@ int mptscsih_suspend(struct pci_dev *pdev, pm_message_t state); + int mptscsih_resume(struct pci_dev *pdev); + #endif + +-#define SNS_LEN(scp) SCSI_SENSE_BUFFERSIZE +- + + /*=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=*/ + /* +@@ -2422,7 +2420,7 @@ mptscsih_copy_sense_data(struct scsi_cmnd *sc, MPT_SCSI_HOST *hd, MPT_FRAME_HDR + /* Copy the sense received into the scsi command block. */ + req_index = le16_to_cpu(mf->u.frame.hwhdr.msgctxu.fld.req_idx); + sense_data = ((u8 *)ioc->sense_buf_pool + (req_index * MPT_SENSE_BUFFER_ALLOC)); +- memcpy(sc->sense_buffer, sense_data, SNS_LEN(sc)); ++ memcpy(sc->sense_buffer, sense_data, MPT_SENSE_BUFFER_ALLOC); + + /* Log SMART data (asc = 0x5D, non-IM case only) if required. + */ +-- +2.25.1 + diff --git a/queue-5.4/series b/queue-5.4/series index f25facc5904..42f45f94b4f 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -1,3 +1,34 @@ kvm-s390-reduce-number-of-io-pins-to-1.patch spi-spi-fsl-dspi-adding-shutdown-hook.patch spi-spi-fsl-dspi-fix-lockup-if-device-is-removed-dur.patch +regmap-fix-alignment-issue.patch +perf-x86-rapl-move-rapl-support-to-common-x86-code.patch +perf-x86-rapl-fix-rapl-config-variable-bug.patch +arm-dts-omap4-droid4-fix-spi-configuration-and-incre.patch +drm-ttm-fix-dma_fence-refcnt-leak-when-adding-move-f.patch +drm-tegra-hub-do-not-enable-orphaned-window-group.patch +gpu-host1x-detach-driver-on-unregister.patch +drm-mcde-fix-display-initialization-problem.patch +asoc-sof-intel-add-pci-id-for-cometlake-s.patch +alsa-hda-intel-add-missing-pci-ids-for-icl-h-tgl-h-a.patch +spi-spidev-fix-a-race-between-spidev_release-and-spi.patch +spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch +net-ethernet-mvneta-fix-serdes-configuration-for-soc.patch +net-ethernet-mvneta-add-2500basex-support-for-socs-w.patch +ixgbe-protect-ring-accesses-with-read-and-write_once.patch +i40e-protect-ring-accesses-with-read-and-write_once.patch +ibmvnic-continue-to-init-in-crq-reset-returns-h_clos.patch +powerpc-kvm-book3s64-fix-kernel-crash-with-nested-kv.patch +iommu-vt-d-don-t-apply-gfx-quirks-to-untrusted-devic.patch +drm-panel-orientation-quirks-add-quirk-for-asus-t101.patch +drm-panel-orientation-quirks-use-generic-orientation.patch +s390-kasan-fix-early-pgm-check-handler-execution.patch +drm-sun4i-mixer-call-of_dma_configure-if-there-s-an-.patch +cifs-update-ctime-and-mtime-during-truncate.patch +arm-imx6-add-missing-put_device-call-in-imx6q_suspen.patch +scsi-mptscsih-fix-read-sense-data-size.patch +usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch +block-release-bip-in-a-right-way-in-error-path.patch +nvme-rdma-assign-completion-vector-correctly.patch +x86-entry-increase-entry_stack-size-to-a-full-page.patch +sched-core-check-cpus_mask-not-cpus_ptr-in-__set_cpu.patch diff --git a/queue-5.4/spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch b/queue-5.4/spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch new file mode 100644 index 00000000000..4cd14a7eb76 --- /dev/null +++ b/queue-5.4/spi-spidev-fix-a-potential-use-after-free-in-spidev_.patch @@ -0,0 +1,76 @@ +From 2488f1dc4fb8df2660844245c3de2bddb1c04450 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 11:21:25 +0800 +Subject: spi: spidev: fix a potential use-after-free in spidev_release() + +From: Zhenzhong Duan + +[ Upstream commit 06096cc6c5a84ced929634b0d79376b94c65a4bd ] + +If an spi device is unbounded from the driver before the release +process, there will be an NULL pointer reference when it's +referenced in spi_slave_abort(). + +Fix it by checking it's already freed before reference. + +Signed-off-by: Zhenzhong Duan +Link: https://lore.kernel.org/r/20200618032125.4650-2-zhenzhong.duan@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 20 ++++++++++---------- + 1 file changed, 10 insertions(+), 10 deletions(-) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index 88d0976215fac..ac6bf1fbbfe68 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -605,15 +605,20 @@ err_find_dev: + static int spidev_release(struct inode *inode, struct file *filp) + { + struct spidev_data *spidev; ++ int dofree; + + mutex_lock(&device_list_lock); + spidev = filp->private_data; + filp->private_data = NULL; + ++ spin_lock_irq(&spidev->spi_lock); ++ /* ... after we unbound from the underlying device? */ ++ dofree = (spidev->spi == NULL); ++ spin_unlock_irq(&spidev->spi_lock); ++ + /* last close? */ + spidev->users--; + if (!spidev->users) { +- int dofree; + + kfree(spidev->tx_buffer); + spidev->tx_buffer = NULL; +@@ -621,19 +626,14 @@ static int spidev_release(struct inode *inode, struct file *filp) + kfree(spidev->rx_buffer); + spidev->rx_buffer = NULL; + +- spin_lock_irq(&spidev->spi_lock); +- if (spidev->spi) +- spidev->speed_hz = spidev->spi->max_speed_hz; +- +- /* ... after we unbound from the underlying device? */ +- dofree = (spidev->spi == NULL); +- spin_unlock_irq(&spidev->spi_lock); +- + if (dofree) + kfree(spidev); ++ else ++ spidev->speed_hz = spidev->spi->max_speed_hz; + } + #ifdef CONFIG_SPI_SLAVE +- spi_slave_abort(spidev->spi); ++ if (!dofree) ++ spi_slave_abort(spidev->spi); + #endif + mutex_unlock(&device_list_lock); + +-- +2.25.1 + diff --git a/queue-5.4/spi-spidev-fix-a-race-between-spidev_release-and-spi.patch b/queue-5.4/spi-spidev-fix-a-race-between-spidev_release-and-spi.patch new file mode 100644 index 00000000000..c0cf7c0a5f7 --- /dev/null +++ b/queue-5.4/spi-spidev-fix-a-race-between-spidev_release-and-spi.patch @@ -0,0 +1,62 @@ +From 726ed34eb3d6c7d0fdc13d38133d5a3ddd7f36ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Jun 2020 11:21:24 +0800 +Subject: spi: spidev: fix a race between spidev_release and spidev_remove + +From: Zhenzhong Duan + +[ Upstream commit abd42781c3d2155868821f1b947ae45bbc33330d ] + +Imagine below scene, spidev is referenced after it's freed. + +spidev_release() spidev_remove() +... + spin_lock_irq(&spidev->spi_lock); + spidev->spi = NULL; + spin_unlock_irq(&spidev->spi_lock); +mutex_lock(&device_list_lock); +dofree = (spidev->spi == NULL); +if (dofree) + kfree(spidev); +mutex_unlock(&device_list_lock); + mutex_lock(&device_list_lock); + list_del(&spidev->device_entry); + device_destroy(spidev_class, spidev->devt); + clear_bit(MINOR(spidev->devt), minors); + if (spidev->users == 0) + kfree(spidev); + mutex_unlock(&device_list_lock); + +Fix it by resetting spidev->spi in device_list_lock's protection. + +Signed-off-by: Zhenzhong Duan +Link: https://lore.kernel.org/r/20200618032125.4650-1-zhenzhong.duan@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spidev.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c +index ab2c3848f5bf8..88d0976215fac 100644 +--- a/drivers/spi/spidev.c ++++ b/drivers/spi/spidev.c +@@ -783,13 +783,13 @@ static int spidev_remove(struct spi_device *spi) + { + struct spidev_data *spidev = spi_get_drvdata(spi); + ++ /* prevent new opens */ ++ mutex_lock(&device_list_lock); + /* make sure ops on existing fds can abort cleanly */ + spin_lock_irq(&spidev->spi_lock); + spidev->spi = NULL; + spin_unlock_irq(&spidev->spi_lock); + +- /* prevent new opens */ +- mutex_lock(&device_list_lock); + list_del(&spidev->device_entry); + device_destroy(spidev_class, spidev->devt); + clear_bit(MINOR(spidev->devt), minors); +-- +2.25.1 + diff --git a/queue-5.4/usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch b/queue-5.4/usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch new file mode 100644 index 00000000000..36d9a7eef2c --- /dev/null +++ b/queue-5.4/usb-dwc3-pci-fix-reference-count-leak-in-dwc3_pci_re.patch @@ -0,0 +1,39 @@ +From 1be19b7b9961c480186f2d80cfeb833f8a0e53c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 13 Jun 2020 22:15:25 -0500 +Subject: usb: dwc3: pci: Fix reference count leak in dwc3_pci_resume_work + +From: Aditya Pakki + +[ Upstream commit 2655971ad4b34e97dd921df16bb0b08db9449df7 ] + +dwc3_pci_resume_work() calls pm_runtime_get_sync() that increments +the reference counter. In case of failure, decrement the reference +before returning. + +Signed-off-by: Aditya Pakki +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index b67372737dc9b..96c05b121fac8 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -206,8 +206,10 @@ static void dwc3_pci_resume_work(struct work_struct *work) + int ret; + + ret = pm_runtime_get_sync(&dwc3->dev); +- if (ret) ++ if (ret) { ++ pm_runtime_put_sync_autosuspend(&dwc3->dev); + return; ++ } + + pm_runtime_mark_last_busy(&dwc3->dev); + pm_runtime_put_sync_autosuspend(&dwc3->dev); +-- +2.25.1 + diff --git a/queue-5.4/x86-entry-increase-entry_stack-size-to-a-full-page.patch b/queue-5.4/x86-entry-increase-entry_stack-size-to-a-full-page.patch new file mode 100644 index 00000000000..6abc513480b --- /dev/null +++ b/queue-5.4/x86-entry-increase-entry_stack-size-to-a-full-page.patch @@ -0,0 +1,40 @@ +From dd46741d9abb95c043e12c7c0497ea3e19726dfd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 17 Jun 2020 18:25:57 +0200 +Subject: x86/entry: Increase entry_stack size to a full page + +From: Peter Zijlstra + +[ Upstream commit c7aadc09321d8f9a1d3bd1e6d8a47222ecddf6c5 ] + +Marco crashed in bad_iret with a Clang11/KCSAN build due to +overflowing the stack. Now that we run C code on it, expand it to a +full page. + +Suggested-by: Andy Lutomirski +Reported-by: Marco Elver +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Lai Jiangshan +Tested-by: Marco Elver +Link: https://lkml.kernel.org/r/20200618144801.819246178@infradead.org +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/processor.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 54f5d54280f60..a07dfdf7759ec 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -334,7 +334,7 @@ struct x86_hw_tss { + #define INVALID_IO_BITMAP_OFFSET 0x8000 + + struct entry_stack { +- unsigned long words[64]; ++ char stack[PAGE_SIZE]; + }; + + struct entry_stack_page { +-- +2.25.1 + -- 2.47.3