From 7850048c1e66bf9436a5a4a32b656a544cac46a1 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Thu, 19 Aug 2021 09:00:07 -0400 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...os-evm-reduce-i2c0-bus-speed-for-tps.patch | 50 +++ ...fix-up-interrupt-controller-node-nam.patch | 54 +++ ...goramo_mlr-depends-on-old-pci-driver.patch | 55 +++ ...-router_xlate-to-return-eprobe_defer.patch | 63 ++++ ...ac-fix-pm-reference-leak-in-usb_dmac.patch | 40 +++ ..._dma-fix-read-after-free-bug-when-te.patch | 83 +++++ ...fix-dynamic-bpp-issue-with-8k30-with.patch | 42 +++ ...workaround-for-hard-hang-on-hpd-on-n.patch | 49 +++ ...he-doorbell-missing-when-in-cgpg-iss.patch | 62 ++++ ...don-t-modify-phy_device-state-concur.patch | 79 +++++ ...check-the-return-value-of-get_gerist.patch | 315 ++++++++++++++++++ ...-of-loop-tests-for-list_for_each_ent.patch | 35 ++ ...n-rmmod-qede-while-automatic-debug-c.patch | 68 ++++ ...printing-an-error-if-target_alloc-re.patch | 45 +++ ...pacity-set-to-zero-after-offlinining.patch | 57 ++++ ...-fix-end-of-loop-tests-for-list_for_.patch | 93 ++++++ ...x-tmf-task-completion-race-condition.patch | 96 ++++++ ...c-avoid-crash-during-rdac_bus_attach.patch | 92 +++++ queue-5.10/series | 19 ++ ...d-module-info-needed-for-autoloading.patch | 56 ++++ 20 files changed, 1453 insertions(+) create mode 100644 queue-5.10/arm-dts-am43x-epos-evm-reduce-i2c0-bus-speed-for-tps.patch create mode 100644 queue-5.10/arm-dts-nomadik-fix-up-interrupt-controller-node-nam.patch create mode 100644 queue-5.10/arm-ixp4xx-goramo_mlr-depends-on-old-pci-driver.patch create mode 100644 queue-5.10/dmaengine-of-dma-router_xlate-to-return-eprobe_defer.patch create mode 100644 queue-5.10/dmaengine-usb-dmac-fix-pm-reference-leak-in-usb_dmac.patch create mode 100644 queue-5.10/dmaengine-xilinx_dma-fix-read-after-free-bug-when-te.patch create mode 100644 queue-5.10/drm-amd-display-fix-dynamic-bpp-issue-with-8k30-with.patch create mode 100644 queue-5.10/drm-amd-display-workaround-for-hard-hang-on-hpd-on-n.patch create mode 100644 queue-5.10/drm-amdgpu-fix-the-doorbell-missing-when-in-cgpg-iss.patch create mode 100644 queue-5.10/net-usb-lan78xx-don-t-modify-phy_device-state-concur.patch create mode 100644 queue-5.10/net-usb-pegasus-check-the-return-value-of-get_gerist.patch create mode 100644 queue-5.10/net-xfrm-fix-end-of-loop-tests-for-list_for_each_ent.patch create mode 100644 queue-5.10/qede-fix-crash-in-rmmod-qede-while-automatic-debug-c.patch create mode 100644 queue-5.10/scsi-core-avoid-printing-an-error-if-target_alloc-re.patch create mode 100644 queue-5.10/scsi-core-fix-capacity-set-to-zero-after-offlinining.patch create mode 100644 queue-5.10/scsi-megaraid_mm-fix-end-of-loop-tests-for-list_for_.patch create mode 100644 queue-5.10/scsi-pm80xx-fix-tmf-task-completion-race-condition.patch create mode 100644 queue-5.10/scsi-scsi_dh_rdac-avoid-crash-during-rdac_bus_attach.patch create mode 100644 queue-5.10/spi-spi-mux-add-module-info-needed-for-autoloading.patch diff --git a/queue-5.10/arm-dts-am43x-epos-evm-reduce-i2c0-bus-speed-for-tps.patch b/queue-5.10/arm-dts-am43x-epos-evm-reduce-i2c0-bus-speed-for-tps.patch new file mode 100644 index 00000000000..1146c3e5f4a --- /dev/null +++ b/queue-5.10/arm-dts-am43x-epos-evm-reduce-i2c0-bus-speed-for-tps.patch @@ -0,0 +1,50 @@ +From f8197c335033dac1b3b273160bc36c6070bc0005 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Jul 2021 09:07:30 -0700 +Subject: ARM: dts: am43x-epos-evm: Reduce i2c0 bus speed for tps65218 + +From: Dave Gerlach + +[ Upstream commit 20a6b3fd8e2e2c063b25fbf2ee74d86b898e5087 ] + +Based on the latest timing specifications for the TPS65218 from the data +sheet, http://www.ti.com/lit/ds/symlink/tps65218.pdf, document SLDS206 +from November 2014, we must change the i2c bus speed to better fit within +the minimum high SCL time required for proper i2c transfer. + +When running at 400khz, measurements show that SCL spends +0.8125 uS/1.666 uS high/low which violates the requirement for minimum +high period of SCL provided in datasheet Table 7.6 which is 1 uS. +Switching to 100khz gives us 5 uS/5 uS high/low which both fall above +the minimum given values for 100 khz, 4.0 uS/4.7 uS high/low. + +Without this patch occasionally a voltage set operation from the kernel +will appear to have worked but the actual voltage reflected on the PMIC +will not have updated, causing problems especially with cpufreq that may +update to a higher OPP without actually raising the voltage on DCDC2, +leading to a hang. + +Signed-off-by: Dave Gerlach +Signed-off-by: Kevin Hilman +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am43x-epos-evm.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts +index 8b696107eef8..d2aebdbc7e0f 100644 +--- a/arch/arm/boot/dts/am43x-epos-evm.dts ++++ b/arch/arm/boot/dts/am43x-epos-evm.dts +@@ -582,7 +582,7 @@ + status = "okay"; + pinctrl-names = "default"; + pinctrl-0 = <&i2c0_pins>; +- clock-frequency = <400000>; ++ clock-frequency = <100000>; + + tps65218: tps65218@24 { + reg = <0x24>; +-- +2.30.2 + diff --git a/queue-5.10/arm-dts-nomadik-fix-up-interrupt-controller-node-nam.patch b/queue-5.10/arm-dts-nomadik-fix-up-interrupt-controller-node-nam.patch new file mode 100644 index 00000000000..f1affcf8e5e --- /dev/null +++ b/queue-5.10/arm-dts-nomadik-fix-up-interrupt-controller-node-nam.patch @@ -0,0 +1,54 @@ +From 1f609966b70d99af96c8bc19abb98d3e26ac887f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Jun 2021 02:01:03 +0200 +Subject: ARM: dts: nomadik: Fix up interrupt controller node names + +From: Sudeep Holla + +[ Upstream commit 47091f473b364c98207c4def197a0ae386fc9af1 ] + +Once the new schema interrupt-controller/arm,vic.yaml is added, we get +the below warnings: + + arch/arm/boot/dts/ste-nomadik-nhk15.dt.yaml: + intc@10140000: $nodename:0: 'intc@10140000' does not match + '^interrupt-controller(@[0-9a-f,]+)*$' + +Fix the node names for the interrupt controller to conform +to the standard node name interrupt-controller@.. + +Signed-off-by: Sudeep Holla +Signed-off-by: Linus Walleij +Cc: Linus Walleij +Link: https://lore.kernel.org/r/20210617210825.3064367-2-sudeep.holla@arm.com +Link: https://lore.kernel.org/r/20210626000103.830184-1-linus.walleij@linaro.org' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/ste-nomadik-stn8815.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi +index 4f38aeecadb3..42abea3ea92c 100644 +--- a/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi ++++ b/arch/arm/boot/dts/ste-nomadik-stn8815.dtsi +@@ -755,14 +755,14 @@ + status = "disabled"; + }; + +- vica: intc@10140000 { ++ vica: interrupt-controller@10140000 { + compatible = "arm,versatile-vic"; + interrupt-controller; + #interrupt-cells = <1>; + reg = <0x10140000 0x20>; + }; + +- vicb: intc@10140020 { ++ vicb: interrupt-controller@10140020 { + compatible = "arm,versatile-vic"; + interrupt-controller; + #interrupt-cells = <1>; +-- +2.30.2 + diff --git a/queue-5.10/arm-ixp4xx-goramo_mlr-depends-on-old-pci-driver.patch b/queue-5.10/arm-ixp4xx-goramo_mlr-depends-on-old-pci-driver.patch new file mode 100644 index 00000000000..15cf471a604 --- /dev/null +++ b/queue-5.10/arm-ixp4xx-goramo_mlr-depends-on-old-pci-driver.patch @@ -0,0 +1,55 @@ +From 5f942aaca9991ec74fa82248f34703641681ef7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 17:16:04 +0200 +Subject: ARM: ixp4xx: goramo_mlr depends on old PCI driver + +From: Arnd Bergmann + +[ Upstream commit 796a8c85b1216618258e08b463d3bef0d7123760 ] + +When this driver is disabled, the board file fails to build, +so add a dependency: + +arch/arm/mach-ixp4xx/goramo_mlr.c: In function 'gmlr_pci_preinit': +arch/arm/mach-ixp4xx/goramo_mlr.c:472:9: error: implicit declaration of function 'ixp4xx_pci_preinit'; did you mean 'iop3xx_pci_preinit'? [-Werror=implicit-function-declaration] + 472 | ixp4xx_pci_preinit(); + | ^~~~~~~~~~~~~~~~~~ + | iop3xx_pci_preinit +arch/arm/mach-ixp4xx/goramo_mlr.c: In function 'gmlr_pci_postinit': +arch/arm/mach-ixp4xx/goramo_mlr.c:481:22: error: implicit declaration of function 'ixp4xx_pci_read' [-Werror=implicit-function-declaration] + 481 | if (!ixp4xx_pci_read(addr, NP_CMD_CONFIGREAD, &value)) { + | ^~~~~~~~~~~~~~~ +arch/arm/mach-ixp4xx/goramo_mlr.c:231:35: error: 'IXP4XX_UART1_BASE_PHYS' undeclared here (not in a function) + 231 | .start = IXP4XX_UART1_BASE_PHYS, + | ^~~~~~~~~~~~~~~~~~~~~~ +arch/arm/mach-ixp4xx/goramo_mlr.c: In function 'gmlr_init': +arch/arm/mach-ixp4xx/goramo_mlr.c:376:9: error: implicit declaration of function 'ixp4xx_sys_init' [-Werror=implicit-function-declaration] + 376 | ixp4xx_sys_init(); + | ^~~~~~~~~~~~~~~ + +Signed-off-by: Arnd Bergmann +Reviewed-by: Linus Walleij +Cc: Linus Walleij +Cc: soc@kernel.org +Link: https://lore.kernel.org/r/20210721151620.2373500-1-arnd@kernel.org' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-ixp4xx/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-ixp4xx/Kconfig b/arch/arm/mach-ixp4xx/Kconfig +index 165c184801e1..57e61e797189 100644 +--- a/arch/arm/mach-ixp4xx/Kconfig ++++ b/arch/arm/mach-ixp4xx/Kconfig +@@ -89,6 +89,7 @@ config MACH_IXDP465 + + config MACH_GORAMO_MLR + bool "GORAMO Multi Link Router" ++ depends on IXP4XX_PCI_LEGACY + help + Say 'Y' here if you want your kernel to support GORAMO + MultiLink router. +-- +2.30.2 + diff --git a/queue-5.10/dmaengine-of-dma-router_xlate-to-return-eprobe_defer.patch b/queue-5.10/dmaengine-of-dma-router_xlate-to-return-eprobe_defer.patch new file mode 100644 index 00000000000..fb27100d223 --- /dev/null +++ b/queue-5.10/dmaengine-of-dma-router_xlate-to-return-eprobe_defer.patch @@ -0,0 +1,63 @@ +From 8981dbd4c751de7fed0988fd0a9cdec3da253182 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Jul 2021 22:00:21 +0300 +Subject: dmaengine: of-dma: router_xlate to return -EPROBE_DEFER if controller + is not yet available + +From: Peter Ujfalusi + +[ Upstream commit eda97cb095f2958bbad55684a6ca3e7d7af0176a ] + +If the router_xlate can not find the controller in the available DMA +devices then it should return with -EPORBE_DEFER in a same way as the +of_dma_request_slave_channel() does. + +The issue can be reproduced if the event router is registered before the +DMA controller itself and a driver would request for a channel before the +controller is registered. +In of_dma_request_slave_channel(): +1. of_dma_find_controller() would find the dma_router +2. ofdma->of_dma_xlate() would fail and returned NULL +3. -ENODEV is returned as error code + +with this patch we would return in this case the correct -EPROBE_DEFER and +the client can try to request the channel later. + +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20210717190021.21897-1-peter.ujfalusi@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/of-dma.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/dma/of-dma.c b/drivers/dma/of-dma.c +index 8a4f608904b9..4be433482053 100644 +--- a/drivers/dma/of-dma.c ++++ b/drivers/dma/of-dma.c +@@ -67,8 +67,12 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, + return NULL; + + ofdma_target = of_dma_find_controller(&dma_spec_target); +- if (!ofdma_target) +- return NULL; ++ if (!ofdma_target) { ++ ofdma->dma_router->route_free(ofdma->dma_router->dev, ++ route_data); ++ chan = ERR_PTR(-EPROBE_DEFER); ++ goto err; ++ } + + chan = ofdma_target->of_dma_xlate(&dma_spec_target, ofdma_target); + if (IS_ERR_OR_NULL(chan)) { +@@ -79,6 +83,7 @@ static struct dma_chan *of_dma_router_xlate(struct of_phandle_args *dma_spec, + chan->route_data = route_data; + } + ++err: + /* + * Need to put the node back since the ofdma->of_dma_route_allocate + * has taken it for generating the new, translated dma_spec +-- +2.30.2 + diff --git a/queue-5.10/dmaengine-usb-dmac-fix-pm-reference-leak-in-usb_dmac.patch b/queue-5.10/dmaengine-usb-dmac-fix-pm-reference-leak-in-usb_dmac.patch new file mode 100644 index 00000000000..c1731894bd7 --- /dev/null +++ b/queue-5.10/dmaengine-usb-dmac-fix-pm-reference-leak-in-usb_dmac.patch @@ -0,0 +1,40 @@ +From b0d32dbf0b067387d132e633a8c26d8ddab3e7ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Jul 2021 20:45:21 +0800 +Subject: dmaengine: usb-dmac: Fix PM reference leak in usb_dmac_probe() + +From: Yu Kuai + +[ Upstream commit 1da569fa7ec8cb0591c74aa3050d4ea1397778b4 ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by moving the error_pm label above the pm_runtime_put() in +the error path. + +Reported-by: Hulk Robot +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20210706124521.1371901-1-yukuai3@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/sh/usb-dmac.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c +index 8f7ceb698226..1cc06900153e 100644 +--- a/drivers/dma/sh/usb-dmac.c ++++ b/drivers/dma/sh/usb-dmac.c +@@ -855,8 +855,8 @@ static int usb_dmac_probe(struct platform_device *pdev) + + error: + of_dma_controller_free(pdev->dev.of_node); +- pm_runtime_put(&pdev->dev); + error_pm: ++ pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + return ret; + } +-- +2.30.2 + diff --git a/queue-5.10/dmaengine-xilinx_dma-fix-read-after-free-bug-when-te.patch b/queue-5.10/dmaengine-xilinx_dma-fix-read-after-free-bug-when-te.patch new file mode 100644 index 00000000000..508654a799a --- /dev/null +++ b/queue-5.10/dmaengine-xilinx_dma-fix-read-after-free-bug-when-te.patch @@ -0,0 +1,83 @@ +From 3916a86d6399b28ed2a392885f9bc0c14ed6c8b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 00:43:38 +0100 +Subject: dmaengine: xilinx_dma: Fix read-after-free bug when terminating + transfers + +From: Adrian Larumbe + +[ Upstream commit 7dd2dd4ff9f3abda601f22b9d01441a0869d20d7 ] + +When user calls dmaengine_terminate_sync, the driver will clean up any +remaining descriptors for all the pending or active transfers that had +previously been submitted. However, this might happen whilst the tasklet is +invoking the DMA callback for the last finished transfer, so by the time it +returns and takes over the channel's spinlock, the list of completed +descriptors it was traversing is no longer valid. This leads to a +read-after-free situation. + +Fix it by signalling whether a user-triggered termination has happened by +means of a boolean variable. + +Signed-off-by: Adrian Larumbe +Link: https://lore.kernel.org/r/20210706234338.7696-3-adrian.martinezlarumbe@imgtec.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/xilinx/xilinx_dma.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c +index 79777550a6ff..9ffdbeec436b 100644 +--- a/drivers/dma/xilinx/xilinx_dma.c ++++ b/drivers/dma/xilinx/xilinx_dma.c +@@ -394,6 +394,7 @@ struct xilinx_dma_tx_descriptor { + * @genlock: Support genlock mode + * @err: Channel has errors + * @idle: Check for channel idle ++ * @terminating: Check for channel being synchronized by user + * @tasklet: Cleanup work after irq + * @config: Device configuration info + * @flush_on_fsync: Flush on Frame sync +@@ -431,6 +432,7 @@ struct xilinx_dma_chan { + bool genlock; + bool err; + bool idle; ++ bool terminating; + struct tasklet_struct tasklet; + struct xilinx_vdma_config config; + bool flush_on_fsync; +@@ -1049,6 +1051,13 @@ static void xilinx_dma_chan_desc_cleanup(struct xilinx_dma_chan *chan) + /* Run any dependencies, then free the descriptor */ + dma_run_dependencies(&desc->async_tx); + xilinx_dma_free_tx_descriptor(chan, desc); ++ ++ /* ++ * While we ran a callback the user called a terminate function, ++ * which takes care of cleaning up any remaining descriptors ++ */ ++ if (chan->terminating) ++ break; + } + + spin_unlock_irqrestore(&chan->lock, flags); +@@ -1965,6 +1974,8 @@ static dma_cookie_t xilinx_dma_tx_submit(struct dma_async_tx_descriptor *tx) + if (desc->cyclic) + chan->cyclic = true; + ++ chan->terminating = false; ++ + spin_unlock_irqrestore(&chan->lock, flags); + + return cookie; +@@ -2436,6 +2447,7 @@ static int xilinx_dma_terminate_all(struct dma_chan *dchan) + + xilinx_dma_chan_reset(chan); + /* Remove and free all of the descriptors in the lists */ ++ chan->terminating = true; + xilinx_dma_free_descriptors(chan); + chan->idle = true; + +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-fix-dynamic-bpp-issue-with-8k30-with.patch b/queue-5.10/drm-amd-display-fix-dynamic-bpp-issue-with-8k30-with.patch new file mode 100644 index 00000000000..7fba8f99a28 --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-dynamic-bpp-issue-with-8k30-with.patch @@ -0,0 +1,42 @@ +From 7552de7776afa82975360209cc24dabbb0ae1fbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Jul 2021 18:24:06 -0400 +Subject: drm/amd/display: Fix Dynamic bpp issue with 8K30 with Navi 1X + +From: Bing Guo + +[ Upstream commit 06050a0f01dbac2ca33145ef19a72041206ea983 ] + +Why: +In DCN2x, HW doesn't automatically divide MASTER_UPDATE_LOCK_DB_X +by the number of pipes ODM Combined. + +How: +Set MASTER_UPDATE_LOCK_DB_X to the value that is adjusted by the +number of pipes ODM Combined. + +Reviewed-by: Martin Leung +Acked-by: Aurabindo Pillai +Signed-off-by: Bing Guo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c +index d8b18c515d06..e3cfb442a062 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_optc.c +@@ -357,7 +357,7 @@ void optc2_lock_doublebuffer_enable(struct timing_generator *optc) + + REG_UPDATE_2(OTG_GLOBAL_CONTROL1, + MASTER_UPDATE_LOCK_DB_X, +- h_blank_start - 200 - 1, ++ (h_blank_start - 200 - 1) / optc1->opp_count, + MASTER_UPDATE_LOCK_DB_Y, + v_blank_start - 1); + } +-- +2.30.2 + diff --git a/queue-5.10/drm-amd-display-workaround-for-hard-hang-on-hpd-on-n.patch b/queue-5.10/drm-amd-display-workaround-for-hard-hang-on-hpd-on-n.patch new file mode 100644 index 00000000000..4d546c98e0d --- /dev/null +++ b/queue-5.10/drm-amd-display-workaround-for-hard-hang-on-hpd-on-n.patch @@ -0,0 +1,49 @@ +From 2384be5de7a901507501b90fc763cfbde37db40f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Jul 2021 14:48:54 -0400 +Subject: drm/amd/display: workaround for hard hang on HPD on native DP + +From: Qingqing Zhuo + +[ Upstream commit c4152b297d56d3696ad0a9003169bc5b98ad7b72 ] + +[Why] +HPD disable and enable sequences are not mutually exclusive +on Linux. For HPDs that spans over 1s (i.e. HPD low = 1s), +part of the disable sequence (specifically, a request to SMU +to lower refclk) could come right before the call to PHY +enable, causing DMUB to access an unresponsive PHY +and thus a hard hang on the system. + +[How] +Disable 48mhz refclk off on native DP. + +Reviewed-by: Hersen Wu +Acked-by: Aurabindo Pillai +Signed-off-by: Qingqing Zhuo +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +index 1c6e401dd4cc..0eba391e597f 100644 +--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c ++++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dcn21/rn_clk_mgr.c +@@ -66,9 +66,11 @@ int rn_get_active_display_cnt_wa( + for (i = 0; i < context->stream_count; i++) { + const struct dc_stream_state *stream = context->streams[i]; + ++ /* Extend the WA to DP for Linux*/ + if (stream->signal == SIGNAL_TYPE_HDMI_TYPE_A || + stream->signal == SIGNAL_TYPE_DVI_SINGLE_LINK || +- stream->signal == SIGNAL_TYPE_DVI_DUAL_LINK) ++ stream->signal == SIGNAL_TYPE_DVI_DUAL_LINK || ++ stream->signal == SIGNAL_TYPE_DISPLAY_PORT) + tmds_present = true; + } + +-- +2.30.2 + diff --git a/queue-5.10/drm-amdgpu-fix-the-doorbell-missing-when-in-cgpg-iss.patch b/queue-5.10/drm-amdgpu-fix-the-doorbell-missing-when-in-cgpg-iss.patch new file mode 100644 index 00000000000..0fcd5a2a0a0 --- /dev/null +++ b/queue-5.10/drm-amdgpu-fix-the-doorbell-missing-when-in-cgpg-iss.patch @@ -0,0 +1,62 @@ +From 9f52a53b32b1ef73dfd3aa4cd6fa8372db5e015e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 09:55:01 +0800 +Subject: drm/amdgpu: fix the doorbell missing when in CGPG issue for renoir. + +From: Yifan Zhang + +[ Upstream commit 1c0539a6fc8a4a4b77278e35d763073890de96b9 ] + +If GC has entered CGPG, ringing doorbell > first page doesn't wakeup GC. +Enlarge CP_MEC_DOORBELL_RANGE_UPPER to workaround this issue. + +Signed-off-by: Yifan Zhang +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 21 ++++++++++++++++++++- + 1 file changed, 20 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index fb15e8b5af32..ac3a88197b2f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -1271,6 +1271,16 @@ static bool is_raven_kicker(struct amdgpu_device *adev) + return false; + } + ++static bool check_if_enlarge_doorbell_range(struct amdgpu_device *adev) ++{ ++ if ((adev->asic_type == CHIP_RENOIR) && ++ (adev->gfx.me_fw_version >= 0x000000a5) && ++ (adev->gfx.me_feature_version >= 52)) ++ return true; ++ else ++ return false; ++} ++ + static void gfx_v9_0_check_if_need_gfxoff(struct amdgpu_device *adev) + { + if (gfx_v9_0_should_disable_gfxoff(adev->pdev)) +@@ -3619,7 +3629,16 @@ static int gfx_v9_0_kiq_init_register(struct amdgpu_ring *ring) + if (ring->use_doorbell) { + WREG32_SOC15(GC, 0, mmCP_MEC_DOORBELL_RANGE_LOWER, + (adev->doorbell_index.kiq * 2) << 2); +- WREG32_SOC15(GC, 0, mmCP_MEC_DOORBELL_RANGE_UPPER, ++ /* If GC has entered CGPG, ringing doorbell > first page ++ * doesn't wakeup GC. Enlarge CP_MEC_DOORBELL_RANGE_UPPER to ++ * workaround this issue. And this change has to align with firmware ++ * update. ++ */ ++ if (check_if_enlarge_doorbell_range(adev)) ++ WREG32_SOC15(GC, 0, mmCP_MEC_DOORBELL_RANGE_UPPER, ++ (adev->doorbell.size - 4)); ++ else ++ WREG32_SOC15(GC, 0, mmCP_MEC_DOORBELL_RANGE_UPPER, + (adev->doorbell_index.userqueue_end * 2) << 2); + } + +-- +2.30.2 + diff --git a/queue-5.10/net-usb-lan78xx-don-t-modify-phy_device-state-concur.patch b/queue-5.10/net-usb-lan78xx-don-t-modify-phy_device-state-concur.patch new file mode 100644 index 00000000000..71fae20828c --- /dev/null +++ b/queue-5.10/net-usb-lan78xx-don-t-modify-phy_device-state-concur.patch @@ -0,0 +1,79 @@ +From 8b71d1aa65646fc98215b88809839adf34a50402 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Aug 2021 11:13:39 +0300 +Subject: net: usb: lan78xx: don't modify phy_device state concurrently + +From: Ivan T. Ivanov + +[ Upstream commit 6b67d4d63edece1033972214704c04f36c5be89a ] + +Currently phy_device state could be left in inconsistent state shown +by following alert message[1]. This is because phy_read_status could +be called concurrently from lan78xx_delayedwork, phy_state_machine and +__ethtool_get_link. Fix this by making sure that phy_device state is +updated atomically. + +[1] lan78xx 1-1.1.1:1.0 eth0: No phy led trigger registered for speed(-1) + +Signed-off-by: Ivan T. Ivanov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/lan78xx.c | 16 ++++++++++++---- + 1 file changed, 12 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 65b315bc60ab..a5cd42bae962 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1159,7 +1159,7 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) + { + struct phy_device *phydev = dev->net->phydev; + struct ethtool_link_ksettings ecmd; +- int ladv, radv, ret; ++ int ladv, radv, ret, link; + u32 buf; + + /* clear LAN78xx interrupt status */ +@@ -1167,9 +1167,12 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) + if (unlikely(ret < 0)) + return -EIO; + ++ mutex_lock(&phydev->lock); + phy_read_status(phydev); ++ link = phydev->link; ++ mutex_unlock(&phydev->lock); + +- if (!phydev->link && dev->link_on) { ++ if (!link && dev->link_on) { + dev->link_on = false; + + /* reset MAC */ +@@ -1182,7 +1185,7 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) + return -EIO; + + del_timer(&dev->stat_monitor); +- } else if (phydev->link && !dev->link_on) { ++ } else if (link && !dev->link_on) { + dev->link_on = true; + + phy_ethtool_ksettings_get(phydev, &ecmd); +@@ -1471,9 +1474,14 @@ static int lan78xx_set_eee(struct net_device *net, struct ethtool_eee *edata) + + static u32 lan78xx_get_link(struct net_device *net) + { ++ u32 link; ++ ++ mutex_lock(&net->phydev->lock); + phy_read_status(net->phydev); ++ link = net->phydev->link; ++ mutex_unlock(&net->phydev->lock); + +- return net->phydev->link; ++ return link; + } + + static void lan78xx_get_drvinfo(struct net_device *net, +-- +2.30.2 + diff --git a/queue-5.10/net-usb-pegasus-check-the-return-value-of-get_gerist.patch b/queue-5.10/net-usb-pegasus-check-the-return-value-of-get_gerist.patch new file mode 100644 index 00000000000..d55bab57759 --- /dev/null +++ b/queue-5.10/net-usb-pegasus-check-the-return-value-of-get_gerist.patch @@ -0,0 +1,315 @@ +From 6bf52d19096b8ee7d643c527e299257d743d7f4a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Aug 2021 20:25:23 +0300 +Subject: net: usb: pegasus: Check the return value of get_geristers() and + friends; + +From: Petko Manolov + +[ Upstream commit 8a160e2e9aeb8318159b48701ad8a6e22274372d ] + +Certain call sites of get_geristers() did not do proper error handling. This +could be a problem as get_geristers() typically return the data via pointer to a +buffer. If an error occurred the code is carelessly manipulating the wrong data. + +Signed-off-by: Petko Manolov +Reviewed-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/usb/pegasus.c | 108 ++++++++++++++++++++++++++------------ + 1 file changed, 75 insertions(+), 33 deletions(-) + +diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c +index 0d7935924e58..fb1a8c4486dd 100644 +--- a/drivers/net/usb/pegasus.c ++++ b/drivers/net/usb/pegasus.c +@@ -132,9 +132,15 @@ static int get_registers(pegasus_t *pegasus, __u16 indx, __u16 size, void *data) + static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size, + const void *data) + { +- return usb_control_msg_send(pegasus->usb, 0, PEGASUS_REQ_SET_REGS, ++ int ret; ++ ++ ret = usb_control_msg_send(pegasus->usb, 0, PEGASUS_REQ_SET_REGS, + PEGASUS_REQT_WRITE, 0, indx, data, size, + 1000, GFP_NOIO); ++ if (ret < 0) ++ netif_dbg(pegasus, drv, pegasus->net, "%s failed with %d\n", __func__, ret); ++ ++ return ret; + } + + /* +@@ -145,10 +151,15 @@ static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size, + static int set_register(pegasus_t *pegasus, __u16 indx, __u8 data) + { + void *buf = &data; ++ int ret; + +- return usb_control_msg_send(pegasus->usb, 0, PEGASUS_REQ_SET_REG, ++ ret = usb_control_msg_send(pegasus->usb, 0, PEGASUS_REQ_SET_REG, + PEGASUS_REQT_WRITE, data, indx, buf, 1, + 1000, GFP_NOIO); ++ if (ret < 0) ++ netif_dbg(pegasus, drv, pegasus->net, "%s failed with %d\n", __func__, ret); ++ ++ return ret; + } + + static int update_eth_regs_async(pegasus_t *pegasus) +@@ -188,10 +199,9 @@ static int update_eth_regs_async(pegasus_t *pegasus) + + static int __mii_op(pegasus_t *p, __u8 phy, __u8 indx, __u16 *regd, __u8 cmd) + { +- int i; +- __u8 data[4] = { phy, 0, 0, indx }; ++ int i, ret; + __le16 regdi; +- int ret = -ETIMEDOUT; ++ __u8 data[4] = { phy, 0, 0, indx }; + + if (cmd & PHY_WRITE) { + __le16 *t = (__le16 *) & data[1]; +@@ -207,12 +217,15 @@ static int __mii_op(pegasus_t *p, __u8 phy, __u8 indx, __u16 *regd, __u8 cmd) + if (data[0] & PHY_DONE) + break; + } +- if (i >= REG_TIMEOUT) ++ if (i >= REG_TIMEOUT) { ++ ret = -ETIMEDOUT; + goto fail; ++ } + if (cmd & PHY_READ) { + ret = get_registers(p, PhyData, 2, ®di); ++ if (ret < 0) ++ goto fail; + *regd = le16_to_cpu(regdi); +- return ret; + } + return 0; + fail: +@@ -235,9 +248,13 @@ static int write_mii_word(pegasus_t *pegasus, __u8 phy, __u8 indx, __u16 *regd) + static int mdio_read(struct net_device *dev, int phy_id, int loc) + { + pegasus_t *pegasus = netdev_priv(dev); ++ int ret; + u16 res; + +- read_mii_word(pegasus, phy_id, loc, &res); ++ ret = read_mii_word(pegasus, phy_id, loc, &res); ++ if (ret < 0) ++ return ret; ++ + return (int)res; + } + +@@ -251,10 +268,9 @@ static void mdio_write(struct net_device *dev, int phy_id, int loc, int val) + + static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata) + { +- int i; +- __u8 tmp = 0; ++ int ret, i; + __le16 retdatai; +- int ret; ++ __u8 tmp = 0; + + set_register(pegasus, EpromCtrl, 0); + set_register(pegasus, EpromOffset, index); +@@ -262,21 +278,25 @@ static int read_eprom_word(pegasus_t *pegasus, __u8 index, __u16 *retdata) + + for (i = 0; i < REG_TIMEOUT; i++) { + ret = get_registers(pegasus, EpromCtrl, 1, &tmp); ++ if (ret < 0) ++ goto fail; + if (tmp & EPROM_DONE) + break; +- if (ret == -ESHUTDOWN) +- goto fail; + } +- if (i >= REG_TIMEOUT) ++ if (i >= REG_TIMEOUT) { ++ ret = -ETIMEDOUT; + goto fail; ++ } + + ret = get_registers(pegasus, EpromData, 2, &retdatai); ++ if (ret < 0) ++ goto fail; + *retdata = le16_to_cpu(retdatai); + return ret; + + fail: +- netif_warn(pegasus, drv, pegasus->net, "%s failed\n", __func__); +- return -ETIMEDOUT; ++ netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__); ++ return ret; + } + + #ifdef PEGASUS_WRITE_EEPROM +@@ -324,10 +344,10 @@ static int write_eprom_word(pegasus_t *pegasus, __u8 index, __u16 data) + return ret; + + fail: +- netif_warn(pegasus, drv, pegasus->net, "%s failed\n", __func__); ++ netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__); + return -ETIMEDOUT; + } +-#endif /* PEGASUS_WRITE_EEPROM */ ++#endif /* PEGASUS_WRITE_EEPROM */ + + static inline int get_node_id(pegasus_t *pegasus, u8 *id) + { +@@ -367,19 +387,21 @@ static void set_ethernet_addr(pegasus_t *pegasus) + return; + err: + eth_hw_addr_random(pegasus->net); +- dev_info(&pegasus->intf->dev, "software assigned MAC address.\n"); ++ netif_dbg(pegasus, drv, pegasus->net, "software assigned MAC address.\n"); + + return; + } + + static inline int reset_mac(pegasus_t *pegasus) + { ++ int ret, i; + __u8 data = 0x8; +- int i; + + set_register(pegasus, EthCtrl1, data); + for (i = 0; i < REG_TIMEOUT; i++) { +- get_registers(pegasus, EthCtrl1, 1, &data); ++ ret = get_registers(pegasus, EthCtrl1, 1, &data); ++ if (ret < 0) ++ goto fail; + if (~data & 0x08) { + if (loopback) + break; +@@ -402,22 +424,29 @@ static inline int reset_mac(pegasus_t *pegasus) + } + if (usb_dev_id[pegasus->dev_index].vendor == VENDOR_ELCON) { + __u16 auxmode; +- read_mii_word(pegasus, 3, 0x1b, &auxmode); ++ ret = read_mii_word(pegasus, 3, 0x1b, &auxmode); ++ if (ret < 0) ++ goto fail; + auxmode |= 4; + write_mii_word(pegasus, 3, 0x1b, &auxmode); + } + + return 0; ++fail: ++ netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__); ++ return ret; + } + + static int enable_net_traffic(struct net_device *dev, struct usb_device *usb) + { +- __u16 linkpart; +- __u8 data[4]; + pegasus_t *pegasus = netdev_priv(dev); + int ret; ++ __u16 linkpart; ++ __u8 data[4]; + +- read_mii_word(pegasus, pegasus->phy, MII_LPA, &linkpart); ++ ret = read_mii_word(pegasus, pegasus->phy, MII_LPA, &linkpart); ++ if (ret < 0) ++ goto fail; + data[0] = 0xc8; /* TX & RX enable, append status, no CRC */ + data[1] = 0; + if (linkpart & (ADVERTISE_100FULL | ADVERTISE_10FULL)) +@@ -435,11 +464,16 @@ static int enable_net_traffic(struct net_device *dev, struct usb_device *usb) + usb_dev_id[pegasus->dev_index].vendor == VENDOR_LINKSYS2 || + usb_dev_id[pegasus->dev_index].vendor == VENDOR_DLINK) { + u16 auxmode; +- read_mii_word(pegasus, 0, 0x1b, &auxmode); ++ ret = read_mii_word(pegasus, 0, 0x1b, &auxmode); ++ if (ret < 0) ++ goto fail; + auxmode |= 4; + write_mii_word(pegasus, 0, 0x1b, &auxmode); + } + ++ return 0; ++fail: ++ netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__); + return ret; + } + +@@ -447,9 +481,9 @@ static void read_bulk_callback(struct urb *urb) + { + pegasus_t *pegasus = urb->context; + struct net_device *net; ++ u8 *buf = urb->transfer_buffer; + int rx_status, count = urb->actual_length; + int status = urb->status; +- u8 *buf = urb->transfer_buffer; + __u16 pkt_len; + + if (!pegasus) +@@ -1005,8 +1039,7 @@ static int pegasus_ioctl(struct net_device *net, struct ifreq *rq, int cmd) + data[0] = pegasus->phy; + fallthrough; + case SIOCDEVPRIVATE + 1: +- read_mii_word(pegasus, data[0], data[1] & 0x1f, &data[3]); +- res = 0; ++ res = read_mii_word(pegasus, data[0], data[1] & 0x1f, &data[3]); + break; + case SIOCDEVPRIVATE + 2: + if (!capable(CAP_NET_ADMIN)) +@@ -1040,22 +1073,25 @@ static void pegasus_set_multicast(struct net_device *net) + + static __u8 mii_phy_probe(pegasus_t *pegasus) + { +- int i; ++ int i, ret; + __u16 tmp; + + for (i = 0; i < 32; i++) { +- read_mii_word(pegasus, i, MII_BMSR, &tmp); ++ ret = read_mii_word(pegasus, i, MII_BMSR, &tmp); ++ if (ret < 0) ++ goto fail; + if (tmp == 0 || tmp == 0xffff || (tmp & BMSR_MEDIA) == 0) + continue; + else + return i; + } +- ++fail: + return 0xff; + } + + static inline void setup_pegasus_II(pegasus_t *pegasus) + { ++ int ret; + __u8 data = 0xa5; + + set_register(pegasus, Reg1d, 0); +@@ -1067,7 +1103,9 @@ static inline void setup_pegasus_II(pegasus_t *pegasus) + set_register(pegasus, Reg7b, 2); + + set_register(pegasus, 0x83, data); +- get_registers(pegasus, 0x83, 1, &data); ++ ret = get_registers(pegasus, 0x83, 1, &data); ++ if (ret < 0) ++ goto fail; + + if (data == 0xa5) + pegasus->chip = 0x8513; +@@ -1082,6 +1120,10 @@ static inline void setup_pegasus_II(pegasus_t *pegasus) + set_register(pegasus, Reg81, 6); + else + set_register(pegasus, Reg81, 2); ++ ++ return; ++fail: ++ netif_dbg(pegasus, drv, pegasus->net, "%s failed\n", __func__); + } + + static void check_carrier(struct work_struct *work) +-- +2.30.2 + diff --git a/queue-5.10/net-xfrm-fix-end-of-loop-tests-for-list_for_each_ent.patch b/queue-5.10/net-xfrm-fix-end-of-loop-tests-for-list_for_each_ent.patch new file mode 100644 index 00000000000..a6760ca7b39 --- /dev/null +++ b/queue-5.10/net-xfrm-fix-end-of-loop-tests-for-list_for_each_ent.patch @@ -0,0 +1,35 @@ +From ece16e4b2c6c76ccd170732d9bd2f1aafe1ae01f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Jul 2021 23:23:55 +0530 +Subject: net: xfrm: Fix end of loop tests for list_for_each_entry + +From: Harshvardhan Jha + +[ Upstream commit 480e93e12aa04d857f7cc2e6fcec181c0d690404 ] + +The list_for_each_entry() iterator, "pos" in this code, can never be +NULL so the warning will never be printed. + +Signed-off-by: Harshvardhan Jha +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_ipcomp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c +index 4d422447aadc..0814320472f1 100644 +--- a/net/xfrm/xfrm_ipcomp.c ++++ b/net/xfrm/xfrm_ipcomp.c +@@ -250,7 +250,7 @@ static void ipcomp_free_tfms(struct crypto_comp * __percpu *tfms) + break; + } + +- WARN_ON(!pos); ++ WARN_ON(list_entry_is_head(pos, &ipcomp_tfms_list, list)); + + if (--pos->users) + return; +-- +2.30.2 + diff --git a/queue-5.10/qede-fix-crash-in-rmmod-qede-while-automatic-debug-c.patch b/queue-5.10/qede-fix-crash-in-rmmod-qede-while-automatic-debug-c.patch new file mode 100644 index 00000000000..1fec6c9c708 --- /dev/null +++ b/queue-5.10/qede-fix-crash-in-rmmod-qede-while-automatic-debug-c.patch @@ -0,0 +1,68 @@ +From 5019cd5678162c58fbb1fa39cefa74a716da55b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jul 2021 14:43:06 +0300 +Subject: qede: fix crash in rmmod qede while automatic debug collection + +From: Prabhakar Kushwaha + +[ Upstream commit 1159e25c137422bdc48ee96e3fb014bd942092c6 ] + +A crash has been observed if rmmod is done while automatic debug +collection in progress. It is due to a race condition between +both of them. + +To fix stop the sp_task during unload to avoid running qede_sp_task +even if they are schedule during removal process. + +Signed-off-by: Alok Prasad +Signed-off-by: Shai Malin +Signed-off-by: Ariel Elior +Signed-off-by: Prabhakar Kushwaha +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qede/qede.h | 1 + + drivers/net/ethernet/qlogic/qede/qede_main.c | 8 ++++++++ + 2 files changed, 9 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qede/qede.h b/drivers/net/ethernet/qlogic/qede/qede.h +index 3efc5899f656..f313fd730331 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede.h ++++ b/drivers/net/ethernet/qlogic/qede/qede.h +@@ -494,6 +494,7 @@ struct qede_fastpath { + #define QEDE_SP_HW_ERR 4 + #define QEDE_SP_ARFS_CONFIG 5 + #define QEDE_SP_AER 7 ++#define QEDE_SP_DISABLE 8 + + #ifdef CONFIG_RFS_ACCEL + int qede_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb, +diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c +index 05e3a3b60269..d9a3c811ac8b 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -1006,6 +1006,13 @@ static void qede_sp_task(struct work_struct *work) + struct qede_dev *edev = container_of(work, struct qede_dev, + sp_task.work); + ++ /* Disable execution of this deferred work once ++ * qede removal is in progress, this stop any future ++ * scheduling of sp_task. ++ */ ++ if (test_bit(QEDE_SP_DISABLE, &edev->sp_flags)) ++ return; ++ + /* The locking scheme depends on the specific flag: + * In case of QEDE_SP_RECOVERY, acquiring the RTNL lock is required to + * ensure that ongoing flows are ended and new ones are not started. +@@ -1297,6 +1304,7 @@ static void __qede_remove(struct pci_dev *pdev, enum qede_remove_mode mode) + qede_rdma_dev_remove(edev, (mode == QEDE_REMOVE_RECOVERY)); + + if (mode != QEDE_REMOVE_RECOVERY) { ++ set_bit(QEDE_SP_DISABLE, &edev->sp_flags); + unregister_netdev(ndev); + + cancel_delayed_work_sync(&edev->sp_task); +-- +2.30.2 + diff --git a/queue-5.10/scsi-core-avoid-printing-an-error-if-target_alloc-re.patch b/queue-5.10/scsi-core-avoid-printing-an-error-if-target_alloc-re.patch new file mode 100644 index 00000000000..203529ad99f --- /dev/null +++ b/queue-5.10/scsi-core-avoid-printing-an-error-if-target_alloc-re.patch @@ -0,0 +1,45 @@ +From f0a7821f14607fe5a2c039aa630231367d2190f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jul 2021 17:24:02 +0530 +Subject: scsi: core: Avoid printing an error if target_alloc() returns -ENXIO + +From: Sreekanth Reddy + +[ Upstream commit 70edd2e6f652f67d854981fd67f9ad0f1deaea92 ] + +Avoid printing a 'target allocation failed' error if the driver +target_alloc() callback function returns -ENXIO. This return value +indicates that the corresponding H:C:T:L entry is empty. + +Removing this error reduces the scan time if the user issues SCAN_WILD_CARD +scan operation through sysfs parameter on a host with a lot of empty +H:C:T:L entries. + +Avoiding the printk on -ENXIO matches the behavior of the other callback +functions during scanning. + +Link: https://lore.kernel.org/r/20210726115402.1936-1-sreekanth.reddy@broadcom.com +Signed-off-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_scan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c +index 9af50e6f94c4..8e474b145249 100644 +--- a/drivers/scsi/scsi_scan.c ++++ b/drivers/scsi/scsi_scan.c +@@ -453,7 +453,8 @@ static struct scsi_target *scsi_alloc_target(struct device *parent, + error = shost->hostt->target_alloc(starget); + + if(error) { +- dev_printk(KERN_ERR, dev, "target allocation failed, error %d\n", error); ++ if (error != -ENXIO) ++ dev_err(dev, "target allocation failed, error %d\n", error); + /* don't want scsi_target_reap to do the final + * put because it will be under the host lock */ + scsi_target_destroy(starget); +-- +2.30.2 + diff --git a/queue-5.10/scsi-core-fix-capacity-set-to-zero-after-offlinining.patch b/queue-5.10/scsi-core-fix-capacity-set-to-zero-after-offlinining.patch new file mode 100644 index 00000000000..7515ac72e6d --- /dev/null +++ b/queue-5.10/scsi-core-fix-capacity-set-to-zero-after-offlinining.patch @@ -0,0 +1,57 @@ +From d74b758335111ebb0c3cc55807c32c2da2c96629 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Jul 2021 11:44:55 +0800 +Subject: scsi: core: Fix capacity set to zero after offlinining device + +From: lijinlin + +[ Upstream commit f0f82e2476f6adb9c7a0135cfab8091456990c99 ] + +After adding physical volumes to a volume group through vgextend, the +kernel will rescan the partitions. This in turn will cause the device +capacity to be queried. + +If the device status is set to offline through sysfs at this time, READ +CAPACITY command will return a result which the host byte is +DID_NO_CONNECT, and the capacity of the device will be set to zero in +read_capacity_error(). After setting device status back to running, the +capacity of the device will remain stuck at zero. + +Fix this issue by rescanning device when the device state changes to +SDEV_RUNNING. + +Link: https://lore.kernel.org/r/20210727034455.1494960-1-lijinlin3@huawei.com +Reviewed-by: Bart Van Assche +Signed-off-by: lijinlin +Signed-off-by: Wu Bo +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_sysfs.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c +index d6e344fa33ad..4dcced95c8b4 100644 +--- a/drivers/scsi/scsi_sysfs.c ++++ b/drivers/scsi/scsi_sysfs.c +@@ -807,11 +807,14 @@ store_state_field(struct device *dev, struct device_attribute *attr, + mutex_lock(&sdev->state_mutex); + ret = scsi_device_set_state(sdev, state); + /* +- * If the device state changes to SDEV_RUNNING, we need to run +- * the queue to avoid I/O hang. ++ * If the device state changes to SDEV_RUNNING, we need to ++ * rescan the device to revalidate it, and run the queue to ++ * avoid I/O hang. + */ +- if (ret == 0 && state == SDEV_RUNNING) ++ if (ret == 0 && state == SDEV_RUNNING) { ++ scsi_rescan_device(dev); + blk_mq_run_hw_queues(sdev->request_queue, true); ++ } + mutex_unlock(&sdev->state_mutex); + + return ret == 0 ? count : -EINVAL; +-- +2.30.2 + diff --git a/queue-5.10/scsi-megaraid_mm-fix-end-of-loop-tests-for-list_for_.patch b/queue-5.10/scsi-megaraid_mm-fix-end-of-loop-tests-for-list_for_.patch new file mode 100644 index 00000000000..afbea5b60cd --- /dev/null +++ b/queue-5.10/scsi-megaraid_mm-fix-end-of-loop-tests-for-list_for_.patch @@ -0,0 +1,93 @@ +From 6b082feb42418651d28eb19071f311305dfddfa6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Jul 2021 13:16:42 +0530 +Subject: scsi: megaraid_mm: Fix end of loop tests for list_for_each_entry() + +From: Harshvardhan Jha + +[ Upstream commit 77541f78eadfe9fdb018a7b8b69f0f2af2cf4b82 ] + +The list_for_each_entry() iterator, "adapter" in this code, can never be +NULL. If we exit the loop without finding the correct adapter then +"adapter" points invalid memory that is an offset from the list head. This +will eventually lead to memory corruption and presumably a kernel crash. + +Link: https://lore.kernel.org/r/20210708074642.23599-1-harshvardhan.jha@oracle.com +Acked-by: Sumit Saxena +Signed-off-by: Harshvardhan Jha +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_mm.c | 21 +++++++++++++++------ + 1 file changed, 15 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c +index 8df53446641a..422b726e2ac1 100644 +--- a/drivers/scsi/megaraid/megaraid_mm.c ++++ b/drivers/scsi/megaraid/megaraid_mm.c +@@ -238,7 +238,7 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) + mimd_t mimd; + uint32_t adapno; + int iterator; +- ++ bool is_found; + + if (copy_from_user(&mimd, umimd, sizeof(mimd_t))) { + *rval = -EFAULT; +@@ -254,12 +254,16 @@ mraid_mm_get_adapter(mimd_t __user *umimd, int *rval) + + adapter = NULL; + iterator = 0; ++ is_found = false; + + list_for_each_entry(adapter, &adapters_list_g, list) { +- if (iterator++ == adapno) break; ++ if (iterator++ == adapno) { ++ is_found = true; ++ break; ++ } + } + +- if (!adapter) { ++ if (!is_found) { + *rval = -ENODEV; + return NULL; + } +@@ -725,6 +729,7 @@ ioctl_done(uioc_t *kioc) + uint32_t adapno; + int iterator; + mraid_mmadp_t* adapter; ++ bool is_found; + + /* + * When the kioc returns from driver, make sure it still doesn't +@@ -747,19 +752,23 @@ ioctl_done(uioc_t *kioc) + iterator = 0; + adapter = NULL; + adapno = kioc->adapno; ++ is_found = false; + + con_log(CL_ANN, ( KERN_WARNING "megaraid cmm: completed " + "ioctl that was timedout before\n")); + + list_for_each_entry(adapter, &adapters_list_g, list) { +- if (iterator++ == adapno) break; ++ if (iterator++ == adapno) { ++ is_found = true; ++ break; ++ } + } + + kioc->timedout = 0; + +- if (adapter) { ++ if (is_found) + mraid_mm_dealloc_kioc( adapter, kioc ); +- } ++ + } + else { + wake_up(&wait_q); +-- +2.30.2 + diff --git a/queue-5.10/scsi-pm80xx-fix-tmf-task-completion-race-condition.patch b/queue-5.10/scsi-pm80xx-fix-tmf-task-completion-race-condition.patch new file mode 100644 index 00000000000..0df67fc7a2f --- /dev/null +++ b/queue-5.10/scsi-pm80xx-fix-tmf-task-completion-race-condition.patch @@ -0,0 +1,96 @@ +From d87ec1a3e3b08c9ca955d03d181336921c6b4a1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 11:59:45 -0700 +Subject: scsi: pm80xx: Fix TMF task completion race condition + +From: Igor Pylypiv + +[ Upstream commit d712d3fb484b7fa8d1d57e9ca6f134bb9d8c18b1 ] + +The TMF timeout timer may trigger at the same time when the response from a +controller is being handled. When this happens the SAS task may get freed +before the response processing is finished. + +Fix this by calling complete() only when SAS_TASK_STATE_DONE is not set. + +A similar race condition was fixed in commit b90cd6f2b905 ("scsi: libsas: +fix a race condition when smp task timeout") + +Link: https://lore.kernel.org/r/20210707185945.35559-1-ipylypiv@google.com +Reviewed-by: Vishakha Channapattan +Acked-by: Jack Wang +Signed-off-by: Igor Pylypiv +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 32 +++++++++++++++----------------- + 1 file changed, 15 insertions(+), 17 deletions(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index 39de9a9360d3..c3bb58885033 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -684,8 +684,7 @@ int pm8001_dev_found(struct domain_device *dev) + + void pm8001_task_done(struct sas_task *task) + { +- if (!del_timer(&task->slow_task->timer)) +- return; ++ del_timer(&task->slow_task->timer); + complete(&task->slow_task->completion); + } + +@@ -693,9 +692,14 @@ static void pm8001_tmf_timedout(struct timer_list *t) + { + struct sas_task_slow *slow = from_timer(slow, t, timer); + struct sas_task *task = slow->task; ++ unsigned long flags; + +- task->task_state_flags |= SAS_TASK_STATE_ABORTED; +- complete(&task->slow_task->completion); ++ spin_lock_irqsave(&task->task_state_lock, flags); ++ if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) { ++ task->task_state_flags |= SAS_TASK_STATE_ABORTED; ++ complete(&task->slow_task->completion); ++ } ++ spin_unlock_irqrestore(&task->task_state_lock, flags); + } + + #define PM8001_TASK_TIMEOUT 20 +@@ -748,13 +752,10 @@ static int pm8001_exec_internal_tmf_task(struct domain_device *dev, + } + res = -TMF_RESP_FUNC_FAILED; + /* Even TMF timed out, return direct. */ +- if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) { +- if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) { +- pm8001_dbg(pm8001_ha, FAIL, +- "TMF task[%x]timeout.\n", +- tmf->tmf); +- goto ex_err; +- } ++ if (task->task_state_flags & SAS_TASK_STATE_ABORTED) { ++ pm8001_dbg(pm8001_ha, FAIL, "TMF task[%x]timeout.\n", ++ tmf->tmf); ++ goto ex_err; + } + + if (task->task_status.resp == SAS_TASK_COMPLETE && +@@ -834,12 +835,9 @@ pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha, + wait_for_completion(&task->slow_task->completion); + res = TMF_RESP_FUNC_FAILED; + /* Even TMF timed out, return direct. */ +- if ((task->task_state_flags & SAS_TASK_STATE_ABORTED)) { +- if (!(task->task_state_flags & SAS_TASK_STATE_DONE)) { +- pm8001_dbg(pm8001_ha, FAIL, +- "TMF task timeout.\n"); +- goto ex_err; +- } ++ if (task->task_state_flags & SAS_TASK_STATE_ABORTED) { ++ pm8001_dbg(pm8001_ha, FAIL, "TMF task timeout.\n"); ++ goto ex_err; + } + + if (task->task_status.resp == SAS_TASK_COMPLETE && +-- +2.30.2 + diff --git a/queue-5.10/scsi-scsi_dh_rdac-avoid-crash-during-rdac_bus_attach.patch b/queue-5.10/scsi-scsi_dh_rdac-avoid-crash-during-rdac_bus_attach.patch new file mode 100644 index 00000000000..b137eef0f09 --- /dev/null +++ b/queue-5.10/scsi-scsi_dh_rdac-avoid-crash-during-rdac_bus_attach.patch @@ -0,0 +1,92 @@ +From 56ff2e914fcdbcaafee5b26fb92bafa79afe0c2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Jan 2021 14:31:03 +0800 +Subject: scsi: scsi_dh_rdac: Avoid crash during rdac_bus_attach() + +From: Ye Bin + +[ Upstream commit bc546c0c9abb3bb2fb46866b3d1e6ade9695a5f6 ] + +The following BUG_ON() was observed during RDAC scan: + +[595952.944297] kernel BUG at drivers/scsi/device_handler/scsi_dh_rdac.c:427! +[595952.951143] Internal error: Oops - BUG: 0 [#1] SMP +...... +[595953.251065] Call trace: +[595953.259054] check_ownership+0xb0/0x118 +[595953.269794] rdac_bus_attach+0x1f0/0x4b0 +[595953.273787] scsi_dh_handler_attach+0x3c/0xe8 +[595953.278211] scsi_dh_add_device+0xc4/0xe8 +[595953.282291] scsi_sysfs_add_sdev+0x8c/0x2a8 +[595953.286544] scsi_probe_and_add_lun+0x9fc/0xd00 +[595953.291142] __scsi_scan_target+0x598/0x630 +[595953.295395] scsi_scan_target+0x120/0x130 +[595953.299481] fc_user_scan+0x1a0/0x1c0 [scsi_transport_fc] +[595953.304944] store_scan+0xb0/0x108 +[595953.308420] dev_attr_store+0x44/0x60 +[595953.312160] sysfs_kf_write+0x58/0x80 +[595953.315893] kernfs_fop_write+0xe8/0x1f0 +[595953.319888] __vfs_write+0x60/0x190 +[595953.323448] vfs_write+0xac/0x1c0 +[595953.326836] ksys_write+0x74/0xf0 +[595953.330221] __arm64_sys_write+0x24/0x30 + +Code is in check_ownership: + + list_for_each_entry_rcu(tmp, &h->ctlr->dh_list, node) { + /* h->sdev should always be valid */ + BUG_ON(!tmp->sdev); + tmp->sdev->access_state = access_state; + } + + rdac_bus_attach + initialize_controller + list_add_rcu(&h->node, &h->ctlr->dh_list); + h->sdev = sdev; + + rdac_bus_detach + list_del_rcu(&h->node); + h->sdev = NULL; + +Fix the race between rdac_bus_attach() and rdac_bus_detach() where h->sdev +is NULL when processing the RDAC attach. + +Link: https://lore.kernel.org/r/20210113063103.2698953-1-yebin10@huawei.com +Reviewed-by: Bart Van Assche +Signed-off-by: Ye Bin +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_rdac.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_rdac.c b/drivers/scsi/device_handler/scsi_dh_rdac.c +index 5efc959493ec..85a71bafaea7 100644 +--- a/drivers/scsi/device_handler/scsi_dh_rdac.c ++++ b/drivers/scsi/device_handler/scsi_dh_rdac.c +@@ -453,8 +453,8 @@ static int initialize_controller(struct scsi_device *sdev, + if (!h->ctlr) + err = SCSI_DH_RES_TEMP_UNAVAIL; + else { +- list_add_rcu(&h->node, &h->ctlr->dh_list); + h->sdev = sdev; ++ list_add_rcu(&h->node, &h->ctlr->dh_list); + } + spin_unlock(&list_lock); + err = SCSI_DH_OK; +@@ -778,11 +778,11 @@ static void rdac_bus_detach( struct scsi_device *sdev ) + spin_lock(&list_lock); + if (h->ctlr) { + list_del_rcu(&h->node); +- h->sdev = NULL; + kref_put(&h->ctlr->kref, release_controller); + } + spin_unlock(&list_lock); + sdev->handler_data = NULL; ++ synchronize_rcu(); + kfree(h); + } + +-- +2.30.2 + diff --git a/queue-5.10/series b/queue-5.10/series index ccd4b6df7db..52deaf73ccf 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -14,3 +14,22 @@ kvm-x86-factor-out-x86-instruction-emulation-with-de.patch kvm-x86-fix-warning-caused-by-stale-emulation-contex.patch usb-core-avoid-warnings-for-0-length-descriptor-requ.patch usb-core-fix-incorrect-pipe-calculation-in-do_proc_c.patch +dmaengine-xilinx_dma-fix-read-after-free-bug-when-te.patch +dmaengine-usb-dmac-fix-pm-reference-leak-in-usb_dmac.patch +spi-spi-mux-add-module-info-needed-for-autoloading.patch +net-xfrm-fix-end-of-loop-tests-for-list_for_each_ent.patch +arm-dts-am43x-epos-evm-reduce-i2c0-bus-speed-for-tps.patch +dmaengine-of-dma-router_xlate-to-return-eprobe_defer.patch +scsi-pm80xx-fix-tmf-task-completion-race-condition.patch +scsi-megaraid_mm-fix-end-of-loop-tests-for-list_for_.patch +scsi-scsi_dh_rdac-avoid-crash-during-rdac_bus_attach.patch +scsi-core-avoid-printing-an-error-if-target_alloc-re.patch +scsi-core-fix-capacity-set-to-zero-after-offlinining.patch +drm-amdgpu-fix-the-doorbell-missing-when-in-cgpg-iss.patch +qede-fix-crash-in-rmmod-qede-while-automatic-debug-c.patch +arm-dts-nomadik-fix-up-interrupt-controller-node-nam.patch +arm-ixp4xx-goramo_mlr-depends-on-old-pci-driver.patch +net-usb-pegasus-check-the-return-value-of-get_gerist.patch +net-usb-lan78xx-don-t-modify-phy_device-state-concur.patch +drm-amd-display-fix-dynamic-bpp-issue-with-8k30-with.patch +drm-amd-display-workaround-for-hard-hang-on-hpd-on-n.patch diff --git a/queue-5.10/spi-spi-mux-add-module-info-needed-for-autoloading.patch b/queue-5.10/spi-spi-mux-add-module-info-needed-for-autoloading.patch new file mode 100644 index 00000000000..05d3e65700b --- /dev/null +++ b/queue-5.10/spi-spi-mux-add-module-info-needed-for-autoloading.patch @@ -0,0 +1,56 @@ +From d040a12d45872eead608a8e74ba853e0fffee969 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Jul 2021 11:53:21 +0200 +Subject: spi: spi-mux: Add module info needed for autoloading +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 1d5ccab95f06675a269f4cb223a1e3f6d1ebef42 ] + +With the spi device table udev can autoload the spi-mux module in +the presence of an spi-mux device. + +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20210721095321.2165453-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mux.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/spi/spi-mux.c b/drivers/spi/spi-mux.c +index 37dfc6e82804..9708b7827ff7 100644 +--- a/drivers/spi/spi-mux.c ++++ b/drivers/spi/spi-mux.c +@@ -167,10 +167,17 @@ err_put_ctlr: + return ret; + } + ++static const struct spi_device_id spi_mux_id[] = { ++ { "spi-mux" }, ++ { } ++}; ++MODULE_DEVICE_TABLE(spi, spi_mux_id); ++ + static const struct of_device_id spi_mux_of_match[] = { + { .compatible = "spi-mux" }, + { } + }; ++MODULE_DEVICE_TABLE(of, spi_mux_of_match); + + static struct spi_driver spi_mux_driver = { + .probe = spi_mux_probe, +@@ -178,6 +185,7 @@ static struct spi_driver spi_mux_driver = { + .name = "spi-mux", + .of_match_table = spi_mux_of_match, + }, ++ .id_table = spi_mux_id, + }; + + module_spi_driver(spi_mux_driver); +-- +2.30.2 + -- 2.47.3