From a51ad4a6e1b7ffbf01cae5b926df08076ad43d8b Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 21 Sep 2020 06:41:13 -0400 Subject: [PATCH] Fixes for 5.8 Signed-off-by: Sasha Levin --- ...-unffected-by-arm-erratum-1418040-to.patch | 52 ++++ .../arm64-bpf-fix-branch-offset-in-jit.patch | 196 ++++++++++++ ...-cleanup-uninitialized-dais-on-soc_p.patch | 57 ++++ ...aswell-fix-power-transition-refactor.patch | 285 ++++++++++++++++++ ...da_dsp_generic-fix-nullptr-dereferen.patch | 46 +++ ...oddr-fix-channel-order-on-g12-platfo.patch | 77 +++++ ...mmon-fix-refcount-imbalance-on-error.patch | 43 +++ ...com-set-card-owner-to-avoid-warnings.patch | 96 ++++++ ...fix-return-check-for-devm_regmap_ini.patch | 42 +++ ...eturn-check-for-devm_regmap_init_sdw.patch | 42 +++ ...eturn-check-for-devm_regmap_init_sdw.patch | 42 +++ ...eturn-check-for-devm_regmap_init_sdw.patch | 42 +++ ...core-add-snd_soc_find_dai_with_mutex.patch | 137 +++++++++ ...40-fix-accessing-uninitialized-adcx1.patch | 47 +++ ...sched-requeue_request-for-scheduled-.patch | 86 ++++++ ...x-dfs-mount-with-cifsacl-modefromsid.patch | 52 ++++ ...the-correct-size-when-allocating-mem.patch | 38 +++ ...-initialization-of-mux_pll_src_4plls.patch | 58 ++++ ...-add-timeout-to-vmbus_wait_for_unloa.patch | 54 ++++ ...-hibernation-do-not-hang-forever-in-.patch | 65 ++++ ...uce-context-termination-list-iterati.patch | 111 +++++++ ...-exception-handing-in-mtk_drm_probe-.patch | 46 +++ ...-missing-put_device-call-in-mtk_ddp_.patch | 36 +++ ...-missing-put_device-call-in-mtk_drm_.patch | 69 +++++ ...-missing-put_device-call-in-mtk_hdmi.patch | 92 ++++++ ...-fix-scrolling-of-panel-with-small-h.patch | 46 +++ ...-use-cpu-when-fail-to-get-cmdq-event.patch | 53 ++++ ...c-check-for-efivars-write-capability.patch | 46 +++ ...ndefinite-loop-scanning-for-free-nid.patch | 48 +++ ...of-on-unaligned-end-of-file-dio-read.patch | 56 ++++ ...-font-detection-test-at-fbcon_resize.patch | 52 ++++ ...eport-of-razwi-initiator-coordinates.patch | 76 +++++ ...abanalabs-prevent-user-buff-overflow.patch | 37 +++ ...reapply-i2c-bus-settings-after-reset.patch | 131 ++++++++ ...-generic-definitions-for-bus-frequen.patch | 41 +++ ...dma_ctrl_wait4end-instead-of-dma_ctr.patch | 68 +++++ ...w-bandwidth-for-disabled-paths-as-ze.patch | 51 ++++ ...u-amd-fix-potential-entry-null-deref.patch | 53 ++++ ...e-irte.remapen-bit-for-amd_iommu_act.patch | 62 ++++ ...e-delete-instead-of-delete-to-free-a.patch | 50 +++ ...-check-the-allocation-of-pv-cpu-mask.patch | 73 +++++ ...ps-change-the-definition-of-kvm-type.patch | 81 +++++ ...g-lockdep-fix-used-in-nmi-inversions.patch | 151 ++++++++++ ...wsem-use-this_cpu_-inc-dec-for-read_.patch | 100 ++++++ .../mips-sni-fix-mips_l1_cache_shift.patch | 35 +++ .../mips-sni-fix-spurious-interrupts.patch | 58 ++++ ...-setattr-should-first-return-delegat.patch | 49 +++ ...rr_delay-error-reclaiming-locking-st.patch | 45 +++ ...sync-events-before-freeing-event-str.patch | 36 +++ ...-async-events-before-freeing-event-s.patch | 36 +++ ...async-events-before-freeing-event-st.patch | 36 +++ ...he-api-compile-issue-when-not-inlini.patch | 57 ++++ .../perf-evlist-fix-cpu-thread-map-leak.patch | 68 +++++ .../perf-metric-fix-some-memory-leaks.patch | 70 +++++ ...-event-fix-memory-leak-in-evsel-unit.patch | 68 +++++ ...t-clear-event-s-period-if-set-by-a-t.patch | 143 +++++++++ ...-fix-the-signal-test-inline-assembly.patch | 107 +++++++ ...liases-for-pmu-event-map-aliases-tes.patch | 97 ++++++ ...free-formats-for-perf-pmu-parse-test.patch | 94 ++++++ ...-usb2-phy-disable-phy-charger-detect.patch | 120 ++++++++ ...-radix-fix-boot-failure-with-large-a.patch | 137 +++++++++ ...ce-select-dmaengines-with-depends-on.patch | 37 +++ ...-fix-machine-constraints-application.patch | 63 ++++ ...e.vma-after-early-page-table-changes.patch | 47 +++ .../scsi-libfc-fix-for-double-free.patch | 37 +++ ...error-path-in-sas_notify_lldd_dev_fo.patch | 47 +++ ...-the-rdf-fpin-registration-descripto.patch | 59 ++++ ...ogi-plogi-receive-race-condition-in-.patch | 62 ++++ ...memleak-in-pm8001_exec_internal_task.patch | 37 +++ queue-5.8/series | 74 +++++ ...fix-memory-leak-on-splited-transfers.patch | 77 +++++ ...loopback-test-fix-out-of-bounds-read.patch | 65 ++++ ...op-printk-reading-past-end-of-string.patch | 39 +++ ...fp-fix-fp-unwinding-in-ret_from_fork.patch | 112 +++++++ ...-release-in-flight-mrs-on-disconnect.patch | 42 +++ 75 files changed, 5240 insertions(+) create mode 100644 queue-5.8/arm64-allow-cpus-unffected-by-arm-erratum-1418040-to.patch create mode 100644 queue-5.8/arm64-bpf-fix-branch-offset-in-jit.patch create mode 100644 queue-5.8/asoc-core-do-not-cleanup-uninitialized-dais-on-soc_p.patch create mode 100644 queue-5.8/asoc-intel-haswell-fix-power-transition-refactor.patch create mode 100644 queue-5.8/asoc-intel-skl_hda_dsp_generic-fix-nullptr-dereferen.patch create mode 100644 queue-5.8/asoc-meson-axg-toddr-fix-channel-order-on-g12-platfo.patch create mode 100644 queue-5.8/asoc-qcom-common-fix-refcount-imbalance-on-error.patch create mode 100644 queue-5.8/asoc-qcom-set-card-owner-to-avoid-warnings.patch create mode 100644 queue-5.8/asoc-rt1308-sdw-fix-return-check-for-devm_regmap_ini.patch create mode 100644 queue-5.8/asoc-rt700-fix-return-check-for-devm_regmap_init_sdw.patch create mode 100644 queue-5.8/asoc-rt711-fix-return-check-for-devm_regmap_init_sdw.patch create mode 100644 queue-5.8/asoc-rt715-fix-return-check-for-devm_regmap_init_sdw.patch create mode 100644 queue-5.8/asoc-soc-core-add-snd_soc_find_dai_with_mutex.patch create mode 100644 queue-5.8/asoc-tlv320adcx140-fix-accessing-uninitialized-adcx1.patch create mode 100644 queue-5.8/block-only-call-sched-requeue_request-for-scheduled-.patch create mode 100644 queue-5.8/cifs-fix-dfs-mount-with-cifsacl-modefromsid.patch create mode 100644 queue-5.8/clk-davinci-use-the-correct-size-when-allocating-mem.patch create mode 100644 queue-5.8/clk-rockchip-fix-initialization-of-mux_pll_src_4plls.patch create mode 100644 queue-5.8/drivers-hv-vmbus-add-timeout-to-vmbus_wait_for_unloa.patch create mode 100644 queue-5.8/drivers-hv-vmbus-hibernation-do-not-hang-forever-in-.patch create mode 100644 queue-5.8/drm-i915-gem-reduce-context-termination-list-iterati.patch create mode 100644 queue-5.8/drm-mediatek-add-exception-handing-in-mtk_drm_probe-.patch create mode 100644 queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_ddp_.patch create mode 100644 queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_drm_.patch create mode 100644 queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_hdmi.patch create mode 100644 queue-5.8/drm-mediatek-dsi-fix-scrolling-of-panel-with-small-h.patch create mode 100644 queue-5.8/drm-mediatek-use-cpu-when-fail-to-get-cmdq-event.patch create mode 100644 queue-5.8/efi-efibc-check-for-efivars-write-capability.patch create mode 100644 queue-5.8/f2fs-fix-indefinite-loop-scanning-for-free-nid.patch create mode 100644 queue-5.8/f2fs-return-eof-on-unaligned-end-of-file-dio-read.patch create mode 100644 queue-5.8/fbcon-fix-user-font-detection-test-at-fbcon_resize.patch create mode 100644 queue-5.8/habanalabs-fix-report-of-razwi-initiator-coordinates.patch create mode 100644 queue-5.8/habanalabs-prevent-user-buff-overflow.patch create mode 100644 queue-5.8/i2c-algo-pca-reapply-i2c-bus-settings-after-reset.patch create mode 100644 queue-5.8/i2c-mediatek-fix-generic-definitions-for-bus-frequen.patch create mode 100644 queue-5.8/i2c-mxs-use-mxs_dma_ctrl_wait4end-instead-of-dma_ctr.patch create mode 100644 queue-5.8/interconnect-show-bandwidth-for-disabled-paths-as-ze.patch create mode 100644 queue-5.8/iommu-amd-fix-potential-entry-null-deref.patch create mode 100644 queue-5.8/iommu-amd-restore-irte.remapen-bit-for-amd_iommu_act.patch create mode 100644 queue-5.8/kconfig-qconf-use-delete-instead-of-delete-to-free-a.patch create mode 100644 queue-5.8/kvm-check-the-allocation-of-pv-cpu-mask.patch create mode 100644 queue-5.8/kvm-mips-change-the-definition-of-kvm-type.patch create mode 100644 queue-5.8/locking-lockdep-fix-used-in-nmi-inversions.patch create mode 100644 queue-5.8/locking-percpu-rwsem-use-this_cpu_-inc-dec-for-read_.patch create mode 100644 queue-5.8/mips-sni-fix-mips_l1_cache_shift.patch create mode 100644 queue-5.8/mips-sni-fix-spurious-interrupts.patch create mode 100644 queue-5.8/nfs-zero-stateid-setattr-should-first-return-delegat.patch create mode 100644 queue-5.8/nfsv4.1-handle-err_delay-error-reclaiming-locking-st.patch create mode 100644 queue-5.8/nvme-fc-cancel-async-events-before-freeing-event-str.patch create mode 100644 queue-5.8/nvme-rdma-cancel-async-events-before-freeing-event-s.patch create mode 100644 queue-5.8/nvme-tcp-cancel-async-events-before-freeing-event-st.patch create mode 100644 queue-5.8/openrisc-fix-cache-api-compile-issue-when-not-inlini.patch create mode 100644 queue-5.8/perf-evlist-fix-cpu-thread-map-leak.patch create mode 100644 queue-5.8/perf-metric-fix-some-memory-leaks.patch create mode 100644 queue-5.8/perf-parse-event-fix-memory-leak-in-evsel-unit.patch create mode 100644 queue-5.8/perf-record-don-t-clear-event-s-period-if-set-by-a-t.patch create mode 100644 queue-5.8/perf-test-fix-the-signal-test-inline-assembly.patch create mode 100644 queue-5.8/perf-test-free-aliases-for-pmu-event-map-aliases-tes.patch create mode 100644 queue-5.8/perf-test-free-formats-for-perf-pmu-parse-test.patch create mode 100644 queue-5.8/phy-omap-usb2-phy-disable-phy-charger-detect.patch create mode 100644 queue-5.8/powerpc-book3s64-radix-fix-boot-failure-with-large-a.patch create mode 100644 queue-5.8/rapidio-replace-select-dmaengines-with-depends-on.patch create mode 100644 queue-5.8/regulator-pwm-fix-machine-constraints-application.patch create mode 100644 queue-5.8/riscv-add-sfence.vma-after-early-page-table-changes.patch create mode 100644 queue-5.8/scsi-libfc-fix-for-double-free.patch create mode 100644 queue-5.8/scsi-libsas-fix-error-path-in-sas_notify_lldd_dev_fo.patch create mode 100644 queue-5.8/scsi-lpfc-extend-the-rdf-fpin-registration-descripto.patch create mode 100644 queue-5.8/scsi-lpfc-fix-flogi-plogi-receive-race-condition-in-.patch create mode 100644 queue-5.8/scsi-pm8001-fix-memleak-in-pm8001_exec_internal_task.patch create mode 100644 queue-5.8/spi-fix-memory-leak-on-splited-transfers.patch create mode 100644 queue-5.8/spi-spi-loopback-test-fix-out-of-bounds-read.patch create mode 100644 queue-5.8/sunrpc-stop-printk-reading-past-end-of-string.patch create mode 100644 queue-5.8/x86-unwind-fp-fix-fp-unwinding-in-ret_from_fork.patch create mode 100644 queue-5.8/xprtrdma-release-in-flight-mrs-on-disconnect.patch diff --git a/queue-5.8/arm64-allow-cpus-unffected-by-arm-erratum-1418040-to.patch b/queue-5.8/arm64-allow-cpus-unffected-by-arm-erratum-1418040-to.patch new file mode 100644 index 00000000000..a88e70a1cfd --- /dev/null +++ b/queue-5.8/arm64-allow-cpus-unffected-by-arm-erratum-1418040-to.patch @@ -0,0 +1,52 @@ +From 94f3496be54dbe9eef58bbdadb6f385ec803bec9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 19:16:11 +0100 +Subject: arm64: Allow CPUs unffected by ARM erratum 1418040 to come in late + +From: Marc Zyngier + +[ Upstream commit ed888cb0d1ebce69f12794e89fbd5e2c86d40b8d ] + +Now that we allow CPUs affected by erratum 1418040 to come in late, +this prevents their unaffected sibblings from coming in late (or +coming back after a suspend or hotplug-off, which amounts to the +same thing). + +To allow this, we need to add ARM64_CPUCAP_OPTIONAL_FOR_LATE_CPU, +which amounts to set .type to ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE. + +Fixes: bf87bb0881d0 ("arm64: Allow booting of late CPUs affected by erratum 1418040") +Reported-by: Matthias Kaehlcke +Signed-off-by: Marc Zyngier +Tested-by: Sai Prakash Ranjan +Tested-by: Matthias Kaehlcke +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/20200911181611.2073183-1-maz@kernel.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/cpu_errata.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 2c0b82db825ba..422ed2e38a6c8 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -910,8 +910,12 @@ const struct arm64_cpu_capabilities arm64_errata[] = { + .desc = "ARM erratum 1418040", + .capability = ARM64_WORKAROUND_1418040, + ERRATA_MIDR_RANGE_LIST(erratum_1418040_list), +- .type = (ARM64_CPUCAP_SCOPE_LOCAL_CPU | +- ARM64_CPUCAP_PERMITTED_FOR_LATE_CPU), ++ /* ++ * We need to allow affected CPUs to come in late, but ++ * also need the non-affected CPUs to be able to come ++ * in at any point in time. Wonderful. ++ */ ++ .type = ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE, + }, + #endif + #ifdef CONFIG_ARM64_WORKAROUND_SPECULATIVE_AT +-- +2.25.1 + diff --git a/queue-5.8/arm64-bpf-fix-branch-offset-in-jit.patch b/queue-5.8/arm64-bpf-fix-branch-offset-in-jit.patch new file mode 100644 index 00000000000..0c6a593e0c6 --- /dev/null +++ b/queue-5.8/arm64-bpf-fix-branch-offset-in-jit.patch @@ -0,0 +1,196 @@ +From abb796da62422859331f129990b5f895ec5a794a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 11:49:25 +0300 +Subject: arm64: bpf: Fix branch offset in JIT + +From: Ilias Apalodimas + +[ Upstream commit 32f6865c7aa3c422f710903baa6eb81abc6f559b ] + +Running the eBPF test_verifier leads to random errors looking like this: + +[ 6525.735488] Unexpected kernel BRK exception at EL1 +[ 6525.735502] Internal error: ptrace BRK handler: f2000100 [#1] SMP +[ 6525.741609] Modules linked in: nls_utf8 cifs libdes libarc4 dns_resolver fscache binfmt_misc nls_ascii nls_cp437 vfat fat aes_ce_blk crypto_simd cryptd aes_ce_cipher ghash_ce gf128mul efi_pstore sha2_ce sha256_arm64 sha1_ce evdev efivars efivarfs ip_tables x_tables autofs4 btrfs blake2b_generic xor xor_neon zstd_compress raid6_pq libcrc32c crc32c_generic ahci xhci_pci libahci xhci_hcd igb libata i2c_algo_bit nvme realtek usbcore nvme_core scsi_mod t10_pi netsec mdio_devres of_mdio gpio_keys fixed_phy libphy gpio_mb86s7x +[ 6525.787760] CPU: 3 PID: 7881 Comm: test_verifier Tainted: G W 5.9.0-rc1+ #47 +[ 6525.796111] Hardware name: Socionext SynQuacer E-series DeveloperBox, BIOS build #1 Jun 6 2020 +[ 6525.804812] pstate: 20000005 (nzCv daif -PAN -UAO BTYPE=--) +[ 6525.810390] pc : bpf_prog_c3d01833289b6311_F+0xc8/0x9f4 +[ 6525.815613] lr : bpf_prog_d53bb52e3f4483f9_F+0x38/0xc8c +[ 6525.820832] sp : ffff8000130cbb80 +[ 6525.824141] x29: ffff8000130cbbb0 x28: 0000000000000000 +[ 6525.829451] x27: 000005ef6fcbf39b x26: 0000000000000000 +[ 6525.834759] x25: ffff8000130cbb80 x24: ffff800011dc7038 +[ 6525.840067] x23: ffff8000130cbd00 x22: ffff0008f624d080 +[ 6525.845375] x21: 0000000000000001 x20: ffff800011dc7000 +[ 6525.850682] x19: 0000000000000000 x18: 0000000000000000 +[ 6525.855990] x17: 0000000000000000 x16: 0000000000000000 +[ 6525.861298] x15: 0000000000000000 x14: 0000000000000000 +[ 6525.866606] x13: 0000000000000000 x12: 0000000000000000 +[ 6525.871913] x11: 0000000000000001 x10: ffff8000000a660c +[ 6525.877220] x9 : ffff800010951810 x8 : ffff8000130cbc38 +[ 6525.882528] x7 : 0000000000000000 x6 : 0000009864cfa881 +[ 6525.887836] x5 : 00ffffffffffffff x4 : 002880ba1a0b3e9f +[ 6525.893144] x3 : 0000000000000018 x2 : ffff8000000a4374 +[ 6525.898452] x1 : 000000000000000a x0 : 0000000000000009 +[ 6525.903760] Call trace: +[ 6525.906202] bpf_prog_c3d01833289b6311_F+0xc8/0x9f4 +[ 6525.911076] bpf_prog_d53bb52e3f4483f9_F+0x38/0xc8c +[ 6525.915957] bpf_dispatcher_xdp_func+0x14/0x20 +[ 6525.920398] bpf_test_run+0x70/0x1b0 +[ 6525.923969] bpf_prog_test_run_xdp+0xec/0x190 +[ 6525.928326] __do_sys_bpf+0xc88/0x1b28 +[ 6525.932072] __arm64_sys_bpf+0x24/0x30 +[ 6525.935820] el0_svc_common.constprop.0+0x70/0x168 +[ 6525.940607] do_el0_svc+0x28/0x88 +[ 6525.943920] el0_sync_handler+0x88/0x190 +[ 6525.947838] el0_sync+0x140/0x180 +[ 6525.951154] Code: d4202000 d4202000 d4202000 d4202000 (d4202000) +[ 6525.957249] ---[ end trace cecc3f93b14927e2 ]--- + +The reason is the offset[] creation and later usage, while building +the eBPF body. The code currently omits the first instruction, since +build_insn() will increase our ctx->idx before saving it. +That was fine up until bounded eBPF loops were introduced. After that +introduction, offset[0] must be the offset of the end of prologue which +is the start of the 1st insn while, offset[n] holds the +offset of the end of n-th insn. + +When "taken loop with back jump to 1st insn" test runs, it will +eventually call bpf2a64_offset(-1, 2, ctx). Since negative indexing is +permitted, the current outcome depends on the value stored in +ctx->offset[-1], which has nothing to do with our array. +If the value happens to be 0 the tests will work. If not this error +triggers. + +commit 7c2e988f400e ("bpf: fix x64 JIT code generation for jmp to 1st insn") +fixed an indentical bug on x86 when eBPF bounded loops were introduced. + +So let's fix it by creating the ctx->offset[] differently. Track the +beginning of instruction and account for the extra instruction while +calculating the arm instruction offsets. + +Fixes: 2589726d12a1 ("bpf: introduce bounded loops") +Reported-by: Naresh Kamboju +Reported-by: Jiri Olsa +Co-developed-by: Jean-Philippe Brucker +Co-developed-by: Yauheni Kaliuta +Signed-off-by: Jean-Philippe Brucker +Signed-off-by: Yauheni Kaliuta +Signed-off-by: Ilias Apalodimas +Acked-by: Will Deacon +Link: https://lore.kernel.org/r/20200917084925.177348-1-ilias.apalodimas@linaro.org +Signed-off-by: Catalin Marinas +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 43 +++++++++++++++++++++++++---------- + 1 file changed, 31 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 3cb25b43b368e..1b2d82755e41f 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -141,14 +141,17 @@ static inline void emit_addr_mov_i64(const int reg, const u64 val, + } + } + +-static inline int bpf2a64_offset(int bpf_to, int bpf_from, ++static inline int bpf2a64_offset(int bpf_insn, int off, + const struct jit_ctx *ctx) + { +- int to = ctx->offset[bpf_to]; +- /* -1 to account for the Branch instruction */ +- int from = ctx->offset[bpf_from] - 1; +- +- return to - from; ++ /* BPF JMP offset is relative to the next instruction */ ++ bpf_insn++; ++ /* ++ * Whereas arm64 branch instructions encode the offset ++ * from the branch itself, so we must subtract 1 from the ++ * instruction offset. ++ */ ++ return ctx->offset[bpf_insn + off] - (ctx->offset[bpf_insn] - 1); + } + + static void jit_fill_hole(void *area, unsigned int size) +@@ -578,7 +581,7 @@ emit_bswap_uxt: + + /* JUMP off */ + case BPF_JMP | BPF_JA: +- jmp_offset = bpf2a64_offset(i + off, i, ctx); ++ jmp_offset = bpf2a64_offset(i, off, ctx); + check_imm26(jmp_offset); + emit(A64_B(jmp_offset), ctx); + break; +@@ -605,7 +608,7 @@ emit_bswap_uxt: + case BPF_JMP32 | BPF_JSLE | BPF_X: + emit(A64_CMP(is64, dst, src), ctx); + emit_cond_jmp: +- jmp_offset = bpf2a64_offset(i + off, i, ctx); ++ jmp_offset = bpf2a64_offset(i, off, ctx); + check_imm19(jmp_offset); + switch (BPF_OP(code)) { + case BPF_JEQ: +@@ -837,10 +840,21 @@ static int build_body(struct jit_ctx *ctx, bool extra_pass) + const struct bpf_prog *prog = ctx->prog; + int i; + ++ /* ++ * - offset[0] offset of the end of prologue, ++ * start of the 1st instruction. ++ * - offset[1] - offset of the end of 1st instruction, ++ * start of the 2nd instruction ++ * [....] ++ * - offset[3] - offset of the end of 3rd instruction, ++ * start of 4th instruction ++ */ + for (i = 0; i < prog->len; i++) { + const struct bpf_insn *insn = &prog->insnsi[i]; + int ret; + ++ if (ctx->image == NULL) ++ ctx->offset[i] = ctx->idx; + ret = build_insn(insn, ctx, extra_pass); + if (ret > 0) { + i++; +@@ -848,11 +862,16 @@ static int build_body(struct jit_ctx *ctx, bool extra_pass) + ctx->offset[i] = ctx->idx; + continue; + } +- if (ctx->image == NULL) +- ctx->offset[i] = ctx->idx; + if (ret) + return ret; + } ++ /* ++ * offset is allocated with prog->len + 1 so fill in ++ * the last element with the offset after the last ++ * instruction (end of program) ++ */ ++ if (ctx->image == NULL) ++ ctx->offset[i] = ctx->idx; + + return 0; + } +@@ -928,7 +947,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + memset(&ctx, 0, sizeof(ctx)); + ctx.prog = prog; + +- ctx.offset = kcalloc(prog->len, sizeof(int), GFP_KERNEL); ++ ctx.offset = kcalloc(prog->len + 1, sizeof(int), GFP_KERNEL); + if (ctx.offset == NULL) { + prog = orig_prog; + goto out_off; +@@ -1008,7 +1027,7 @@ skip_init_ctx: + prog->jited_len = image_size; + + if (!prog->is_func || extra_pass) { +- bpf_prog_fill_jited_linfo(prog, ctx.offset); ++ bpf_prog_fill_jited_linfo(prog, ctx.offset + 1); + out_off: + kfree(ctx.offset); + kfree(jit_data); +-- +2.25.1 + diff --git a/queue-5.8/asoc-core-do-not-cleanup-uninitialized-dais-on-soc_p.patch b/queue-5.8/asoc-core-do-not-cleanup-uninitialized-dais-on-soc_p.patch new file mode 100644 index 00000000000..7e3a0fdb5c0 --- /dev/null +++ b/queue-5.8/asoc-core-do-not-cleanup-uninitialized-dais-on-soc_p.patch @@ -0,0 +1,57 @@ +From 5fe7ad989e1bff3cc6b4123a8b808f433e5fbd19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Sep 2020 13:19:39 +0200 +Subject: ASoC: core: Do not cleanup uninitialized dais on soc_pcm_open failure + +From: Cezary Rojewski + +[ Upstream commit 20244b2a8a8728c63233d33146e007dcacbcc5c4 ] + +Introduce for_each_rtd_dais_rollback macro which behaves exactly like +for_each_codec_dais_rollback and its cpu_dais equivalent but for all +dais instead. + +Use newly added macro to fix soc_pcm_open error path and prevent +uninitialized dais from being cleaned-up. + +Signed-off-by: Cezary Rojewski +Fixes: 5d9fa03e6c35 ("ASoC: soc-pcm: tidyup soc_pcm_open() order") +Acked-by: Liam Girdwood +Acked-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/20200907111939.16169-1-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/soc.h | 2 ++ + sound/soc/soc-pcm.c | 2 +- + 2 files changed, 3 insertions(+), 1 deletion(-) + +diff --git a/include/sound/soc.h b/include/sound/soc.h +index bc6ecb10c7649..ca765062787b0 100644 +--- a/include/sound/soc.h ++++ b/include/sound/soc.h +@@ -1205,6 +1205,8 @@ struct snd_soc_pcm_runtime { + ((i) < (rtd)->num_cpus + (rtd)->num_codecs) && \ + ((dai) = (rtd)->dais[i]); \ + (i)++) ++#define for_each_rtd_dais_rollback(rtd, i, dai) \ ++ for (; (--(i) >= 0) && ((dai) = (rtd)->dais[i]);) + + void snd_soc_close_delayed_work(struct snd_soc_pcm_runtime *rtd); + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 74baf1fce053f..918ed77726cc0 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -811,7 +811,7 @@ dynamic: + return 0; + + config_err: +- for_each_rtd_dais(rtd, i, dai) ++ for_each_rtd_dais_rollback(rtd, i, dai) + snd_soc_dai_shutdown(dai, substream); + + snd_soc_link_shutdown(substream); +-- +2.25.1 + diff --git a/queue-5.8/asoc-intel-haswell-fix-power-transition-refactor.patch b/queue-5.8/asoc-intel-haswell-fix-power-transition-refactor.patch new file mode 100644 index 00000000000..8f666a0d25e --- /dev/null +++ b/queue-5.8/asoc-intel-haswell-fix-power-transition-refactor.patch @@ -0,0 +1,285 @@ +From cf7ec554f7b10c341123da39839b264912078aa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 17:30:41 +0200 +Subject: ASoC: Intel: haswell: Fix power transition refactor + +From: Cezary Rojewski + +[ Upstream commit 154549558a622b31702fcaa01ccd85e6e34073de ] + +While addressing existing power-cycle limitations for +sound/soc/intel/haswell solution, change brings regression for standard +audio userspace flows e.g.: when using PulseAudio. + +Occasional sound-card initialization fail is still better than +permanent audio distortions, so revert the change. + +Fixes: 8ec7d6043263 ("ASoC: Intel: haswell: Power transition refactor") +Reported-by: Christian Bundy +Signed-off-by: Cezary Rojewski +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200901153041.14771-1-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/haswell/sst-haswell-dsp.c | 185 ++++++++++------------ + 1 file changed, 81 insertions(+), 104 deletions(-) + +diff --git a/sound/soc/intel/haswell/sst-haswell-dsp.c b/sound/soc/intel/haswell/sst-haswell-dsp.c +index de80e19454c13..88c3f63bded90 100644 +--- a/sound/soc/intel/haswell/sst-haswell-dsp.c ++++ b/sound/soc/intel/haswell/sst-haswell-dsp.c +@@ -243,92 +243,45 @@ static irqreturn_t hsw_irq(int irq, void *context) + return ret; + } + +-#define CSR_DEFAULT_VALUE 0x8480040E +-#define ISC_DEFAULT_VALUE 0x0 +-#define ISD_DEFAULT_VALUE 0x0 +-#define IMC_DEFAULT_VALUE 0x7FFF0003 +-#define IMD_DEFAULT_VALUE 0x7FFF0003 +-#define IPCC_DEFAULT_VALUE 0x0 +-#define IPCD_DEFAULT_VALUE 0x0 +-#define CLKCTL_DEFAULT_VALUE 0x7FF +-#define CSR2_DEFAULT_VALUE 0x0 +-#define LTR_CTRL_DEFAULT_VALUE 0x0 +-#define HMD_CTRL_DEFAULT_VALUE 0x0 +- +-static void hsw_set_shim_defaults(struct sst_dsp *sst) +-{ +- sst_dsp_shim_write_unlocked(sst, SST_CSR, CSR_DEFAULT_VALUE); +- sst_dsp_shim_write_unlocked(sst, SST_ISRX, ISC_DEFAULT_VALUE); +- sst_dsp_shim_write_unlocked(sst, SST_ISRD, ISD_DEFAULT_VALUE); +- sst_dsp_shim_write_unlocked(sst, SST_IMRX, IMC_DEFAULT_VALUE); +- sst_dsp_shim_write_unlocked(sst, SST_IMRD, IMD_DEFAULT_VALUE); +- sst_dsp_shim_write_unlocked(sst, SST_IPCX, IPCC_DEFAULT_VALUE); +- sst_dsp_shim_write_unlocked(sst, SST_IPCD, IPCD_DEFAULT_VALUE); +- sst_dsp_shim_write_unlocked(sst, SST_CLKCTL, CLKCTL_DEFAULT_VALUE); +- sst_dsp_shim_write_unlocked(sst, SST_CSR2, CSR2_DEFAULT_VALUE); +- sst_dsp_shim_write_unlocked(sst, SST_LTRC, LTR_CTRL_DEFAULT_VALUE); +- sst_dsp_shim_write_unlocked(sst, SST_HMDC, HMD_CTRL_DEFAULT_VALUE); +-} +- +-/* all clock-gating minus DCLCGE and DTCGE */ +-#define SST_VDRTCL2_CG_OTHER 0xB7D +- + static void hsw_set_dsp_D3(struct sst_dsp *sst) + { ++ u32 val; + u32 reg; + +- /* disable clock core gating */ ++ /* Disable core clock gating (VDRTCTL2.DCLCGE = 0) */ + reg = readl(sst->addr.pci_cfg + SST_VDRTCTL2); +- reg &= ~(SST_VDRTCL2_DCLCGE); ++ reg &= ~(SST_VDRTCL2_DCLCGE | SST_VDRTCL2_DTCGE); + writel(reg, sst->addr.pci_cfg + SST_VDRTCTL2); + +- /* stall, reset and set 24MHz XOSC */ +- sst_dsp_shim_update_bits_unlocked(sst, SST_CSR, +- SST_CSR_24MHZ_LPCS | SST_CSR_STALL | SST_CSR_RST, +- SST_CSR_24MHZ_LPCS | SST_CSR_STALL | SST_CSR_RST); +- +- /* DRAM power gating all */ +- reg = readl(sst->addr.pci_cfg + SST_VDRTCTL0); +- reg |= SST_VDRTCL0_ISRAMPGE_MASK | +- SST_VDRTCL0_DSRAMPGE_MASK; +- reg &= ~(SST_VDRTCL0_D3SRAMPGD); +- reg |= SST_VDRTCL0_D3PGD; +- writel(reg, sst->addr.pci_cfg + SST_VDRTCTL0); +- udelay(50); ++ /* enable power gating and switch off DRAM & IRAM blocks */ ++ val = readl(sst->addr.pci_cfg + SST_VDRTCTL0); ++ val |= SST_VDRTCL0_DSRAMPGE_MASK | ++ SST_VDRTCL0_ISRAMPGE_MASK; ++ val &= ~(SST_VDRTCL0_D3PGD | SST_VDRTCL0_D3SRAMPGD); ++ writel(val, sst->addr.pci_cfg + SST_VDRTCTL0); + +- /* PLL shutdown enable */ +- reg = readl(sst->addr.pci_cfg + SST_VDRTCTL2); +- reg |= SST_VDRTCL2_APLLSE_MASK; +- writel(reg, sst->addr.pci_cfg + SST_VDRTCTL2); ++ /* switch off audio PLL */ ++ val = readl(sst->addr.pci_cfg + SST_VDRTCTL2); ++ val |= SST_VDRTCL2_APLLSE_MASK; ++ writel(val, sst->addr.pci_cfg + SST_VDRTCTL2); + +- /* disable MCLK */ ++ /* disable MCLK(clkctl.smos = 0) */ + sst_dsp_shim_update_bits_unlocked(sst, SST_CLKCTL, +- SST_CLKCTL_MASK, 0); +- +- /* switch clock gating */ +- reg = readl(sst->addr.pci_cfg + SST_VDRTCTL2); +- reg |= SST_VDRTCL2_CG_OTHER; +- reg &= ~(SST_VDRTCL2_DTCGE); +- writel(reg, sst->addr.pci_cfg + SST_VDRTCTL2); +- /* enable DTCGE separatelly */ +- reg = readl(sst->addr.pci_cfg + SST_VDRTCTL2); +- reg |= SST_VDRTCL2_DTCGE; +- writel(reg, sst->addr.pci_cfg + SST_VDRTCTL2); ++ SST_CLKCTL_MASK, 0); + +- /* set shim defaults */ +- hsw_set_shim_defaults(sst); +- +- /* set D3 */ +- reg = readl(sst->addr.pci_cfg + SST_PMCS); +- reg |= SST_PMCS_PS_MASK; +- writel(reg, sst->addr.pci_cfg + SST_PMCS); ++ /* Set D3 state, delay 50 us */ ++ val = readl(sst->addr.pci_cfg + SST_PMCS); ++ val |= SST_PMCS_PS_MASK; ++ writel(val, sst->addr.pci_cfg + SST_PMCS); + udelay(50); + +- /* enable clock core gating */ ++ /* Enable core clock gating (VDRTCTL2.DCLCGE = 1), delay 50 us */ + reg = readl(sst->addr.pci_cfg + SST_VDRTCTL2); +- reg |= SST_VDRTCL2_DCLCGE; ++ reg |= SST_VDRTCL2_DCLCGE | SST_VDRTCL2_DTCGE; + writel(reg, sst->addr.pci_cfg + SST_VDRTCTL2); ++ + udelay(50); ++ + } + + static void hsw_reset(struct sst_dsp *sst) +@@ -346,62 +299,75 @@ static void hsw_reset(struct sst_dsp *sst) + SST_CSR_RST | SST_CSR_STALL, SST_CSR_STALL); + } + +-/* recommended CSR state for power-up */ +-#define SST_CSR_D0_MASK (0x18A09C0C | SST_CSR_DCS_MASK) +- + static int hsw_set_dsp_D0(struct sst_dsp *sst) + { +- u32 reg; ++ int tries = 10; ++ u32 reg, fw_dump_bit; + +- /* disable clock core gating */ ++ /* Disable core clock gating (VDRTCTL2.DCLCGE = 0) */ + reg = readl(sst->addr.pci_cfg + SST_VDRTCTL2); +- reg &= ~(SST_VDRTCL2_DCLCGE); ++ reg &= ~(SST_VDRTCL2_DCLCGE | SST_VDRTCL2_DTCGE); + writel(reg, sst->addr.pci_cfg + SST_VDRTCTL2); + +- /* switch clock gating */ +- reg = readl(sst->addr.pci_cfg + SST_VDRTCTL2); +- reg |= SST_VDRTCL2_CG_OTHER; +- reg &= ~(SST_VDRTCL2_DTCGE); +- writel(reg, sst->addr.pci_cfg + SST_VDRTCTL2); ++ /* Disable D3PG (VDRTCTL0.D3PGD = 1) */ ++ reg = readl(sst->addr.pci_cfg + SST_VDRTCTL0); ++ reg |= SST_VDRTCL0_D3PGD; ++ writel(reg, sst->addr.pci_cfg + SST_VDRTCTL0); + +- /* set D0 */ ++ /* Set D0 state */ + reg = readl(sst->addr.pci_cfg + SST_PMCS); +- reg &= ~(SST_PMCS_PS_MASK); ++ reg &= ~SST_PMCS_PS_MASK; + writel(reg, sst->addr.pci_cfg + SST_PMCS); + +- /* DRAM power gating none */ +- reg = readl(sst->addr.pci_cfg + SST_VDRTCTL0); +- reg &= ~(SST_VDRTCL0_ISRAMPGE_MASK | +- SST_VDRTCL0_DSRAMPGE_MASK); +- reg |= SST_VDRTCL0_D3SRAMPGD; +- reg |= SST_VDRTCL0_D3PGD; +- writel(reg, sst->addr.pci_cfg + SST_VDRTCTL0); +- mdelay(10); ++ /* check that ADSP shim is enabled */ ++ while (tries--) { ++ reg = readl(sst->addr.pci_cfg + SST_PMCS) & SST_PMCS_PS_MASK; ++ if (reg == 0) ++ goto finish; ++ ++ msleep(1); ++ } ++ ++ return -ENODEV; + +- /* set shim defaults */ +- hsw_set_shim_defaults(sst); ++finish: ++ /* select SSP1 19.2MHz base clock, SSP clock 0, turn off Low Power Clock */ ++ sst_dsp_shim_update_bits_unlocked(sst, SST_CSR, ++ SST_CSR_S1IOCS | SST_CSR_SBCS1 | SST_CSR_LPCS, 0x0); ++ ++ /* stall DSP core, set clk to 192/96Mhz */ ++ sst_dsp_shim_update_bits_unlocked(sst, ++ SST_CSR, SST_CSR_STALL | SST_CSR_DCS_MASK, ++ SST_CSR_STALL | SST_CSR_DCS(4)); + +- /* restore MCLK */ ++ /* Set 24MHz MCLK, prevent local clock gating, enable SSP0 clock */ + sst_dsp_shim_update_bits_unlocked(sst, SST_CLKCTL, +- SST_CLKCTL_MASK, SST_CLKCTL_MASK); ++ SST_CLKCTL_MASK | SST_CLKCTL_DCPLCG | SST_CLKCTL_SCOE0, ++ SST_CLKCTL_MASK | SST_CLKCTL_DCPLCG | SST_CLKCTL_SCOE0); + +- /* PLL shutdown disable */ ++ /* Stall and reset core, set CSR */ ++ hsw_reset(sst); ++ ++ /* Enable core clock gating (VDRTCTL2.DCLCGE = 1), delay 50 us */ + reg = readl(sst->addr.pci_cfg + SST_VDRTCTL2); +- reg &= ~(SST_VDRTCL2_APLLSE_MASK); ++ reg |= SST_VDRTCL2_DCLCGE | SST_VDRTCL2_DTCGE; + writel(reg, sst->addr.pci_cfg + SST_VDRTCTL2); + +- sst_dsp_shim_update_bits_unlocked(sst, SST_CSR, +- SST_CSR_D0_MASK, SST_CSR_SBCS0 | SST_CSR_SBCS1 | +- SST_CSR_STALL | SST_CSR_DCS(4)); + udelay(50); + +- /* enable clock core gating */ ++ /* switch on audio PLL */ + reg = readl(sst->addr.pci_cfg + SST_VDRTCTL2); +- reg |= SST_VDRTCL2_DCLCGE; ++ reg &= ~SST_VDRTCL2_APLLSE_MASK; + writel(reg, sst->addr.pci_cfg + SST_VDRTCTL2); + +- /* clear reset */ +- sst_dsp_shim_update_bits_unlocked(sst, SST_CSR, SST_CSR_RST, 0); ++ /* set default power gating control, enable power gating control for all blocks. that is, ++ can't be accessed, please enable each block before accessing. */ ++ reg = readl(sst->addr.pci_cfg + SST_VDRTCTL0); ++ reg |= SST_VDRTCL0_DSRAMPGE_MASK | SST_VDRTCL0_ISRAMPGE_MASK; ++ /* for D0, always enable the block(DSRAM[0]) used for FW dump */ ++ fw_dump_bit = 1 << SST_VDRTCL0_DSRAMPGE_SHIFT; ++ writel(reg & ~fw_dump_bit, sst->addr.pci_cfg + SST_VDRTCTL0); ++ + + /* disable DMA finish function for SSP0 & SSP1 */ + sst_dsp_shim_update_bits_unlocked(sst, SST_CSR2, SST_CSR2_SDFD_SSP1, +@@ -418,6 +384,12 @@ static int hsw_set_dsp_D0(struct sst_dsp *sst) + sst_dsp_shim_update_bits(sst, SST_IMRD, (SST_IMRD_DONE | SST_IMRD_BUSY | + SST_IMRD_SSP0 | SST_IMRD_DMAC), 0x0); + ++ /* clear IPC registers */ ++ sst_dsp_shim_write(sst, SST_IPCX, 0x0); ++ sst_dsp_shim_write(sst, SST_IPCD, 0x0); ++ sst_dsp_shim_write(sst, 0x80, 0x6); ++ sst_dsp_shim_write(sst, 0xe0, 0x300a); ++ + return 0; + } + +@@ -443,6 +415,11 @@ static void hsw_sleep(struct sst_dsp *sst) + { + dev_dbg(sst->dev, "HSW_PM dsp runtime suspend\n"); + ++ /* put DSP into reset and stall */ ++ sst_dsp_shim_update_bits(sst, SST_CSR, ++ SST_CSR_24MHZ_LPCS | SST_CSR_RST | SST_CSR_STALL, ++ SST_CSR_RST | SST_CSR_STALL | SST_CSR_24MHZ_LPCS); ++ + hsw_set_dsp_D3(sst); + dev_dbg(sst->dev, "HSW_PM dsp runtime suspend exit\n"); + } +-- +2.25.1 + diff --git a/queue-5.8/asoc-intel-skl_hda_dsp_generic-fix-nullptr-dereferen.patch b/queue-5.8/asoc-intel-skl_hda_dsp_generic-fix-nullptr-dereferen.patch new file mode 100644 index 00000000000..87a70345031 --- /dev/null +++ b/queue-5.8/asoc-intel-skl_hda_dsp_generic-fix-nullptr-dereferen.patch @@ -0,0 +1,46 @@ +From 34777537c4ca9b965722cc95d7eba14266db1120 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Jul 2020 19:35:24 +0200 +Subject: ASoC: Intel: skl_hda_dsp_generic: Fix NULLptr dereference in + autosuspend delay + +From: Mateusz Gorski + +[ Upstream commit 5610921a4435ef45c33702073e64f835f3dca7f1 ] + +Different modules for HDMI codec are used depending on the +"hda_codec_use_common_hdmi" option being enabled or not. Driver private +context for both of them is different. +This leads to null-pointer dereference error when driver tries to set +autosuspend delay for HDMI codec while the option is off (hdac_hdmi +module is used for HDMI). + +Change the string in conditional statement to "ehdaudio0D0" to ensure +that only the HDAudio codec is handled by this function. + +Fixes: 5bf73b1b1dec ("ASoC: intel/skl/hda - fix oops on systems without i915 audio codec") +Signed-off-by: Mateusz Gorski +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20200722173524.30161-1-mateusz.gorski@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/skl_hda_dsp_generic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/intel/boards/skl_hda_dsp_generic.c b/sound/soc/intel/boards/skl_hda_dsp_generic.c +index ca4900036ead9..bc50eda297ab7 100644 +--- a/sound/soc/intel/boards/skl_hda_dsp_generic.c ++++ b/sound/soc/intel/boards/skl_hda_dsp_generic.c +@@ -181,7 +181,7 @@ static void skl_set_hda_codec_autosuspend_delay(struct snd_soc_card *card) + struct snd_soc_dai *dai; + + for_each_card_rtds(card, rtd) { +- if (!strstr(rtd->dai_link->codecs->name, "ehdaudio")) ++ if (!strstr(rtd->dai_link->codecs->name, "ehdaudio0D0")) + continue; + dai = asoc_rtd_to_codec(rtd, 0); + hda_pvt = snd_soc_component_get_drvdata(dai->component); +-- +2.25.1 + diff --git a/queue-5.8/asoc-meson-axg-toddr-fix-channel-order-on-g12-platfo.patch b/queue-5.8/asoc-meson-axg-toddr-fix-channel-order-on-g12-platfo.patch new file mode 100644 index 00000000000..0daa4850888 --- /dev/null +++ b/queue-5.8/asoc-meson-axg-toddr-fix-channel-order-on-g12-platfo.patch @@ -0,0 +1,77 @@ +From a5c984eb1131a9190109b1206f1a7b4d2e422620 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 17:14:38 +0200 +Subject: ASoC: meson: axg-toddr: fix channel order on g12 platforms + +From: Jerome Brunet + +[ Upstream commit 9c4b205a20f483d8a5d1208cfec33e339347d4bd ] + +On g12 and following platforms, The first channel of record with more than +2 channels ends being placed randomly on an even channel of the output. + +On these SoCs, a bit was added to force the first channel to be placed at +the beginning of the output. Apparently the behavior if the bit is not set +is not easily predictable. According to the documentation, this bit is not +present on the axg series. + +Set the bit on g12 and fix the problem. + +Fixes: a3c23a8ad4dc ("ASoC: meson: axg-toddr: add g12a support") +Reported-by: Nicolas Belin +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20200828151438.350974-1-jbrunet@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/axg-toddr.c | 24 +++++++++++++++++++++++- + 1 file changed, 23 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/meson/axg-toddr.c b/sound/soc/meson/axg-toddr.c +index e711abcf8c124..d6adf7edea41f 100644 +--- a/sound/soc/meson/axg-toddr.c ++++ b/sound/soc/meson/axg-toddr.c +@@ -18,6 +18,7 @@ + #define CTRL0_TODDR_SEL_RESAMPLE BIT(30) + #define CTRL0_TODDR_EXT_SIGNED BIT(29) + #define CTRL0_TODDR_PP_MODE BIT(28) ++#define CTRL0_TODDR_SYNC_CH BIT(27) + #define CTRL0_TODDR_TYPE_MASK GENMASK(15, 13) + #define CTRL0_TODDR_TYPE(x) ((x) << 13) + #define CTRL0_TODDR_MSB_POS_MASK GENMASK(12, 8) +@@ -189,10 +190,31 @@ static const struct axg_fifo_match_data axg_toddr_match_data = { + .dai_drv = &axg_toddr_dai_drv + }; + ++static int g12a_toddr_dai_startup(struct snd_pcm_substream *substream, ++ struct snd_soc_dai *dai) ++{ ++ struct axg_fifo *fifo = snd_soc_dai_get_drvdata(dai); ++ int ret; ++ ++ ret = axg_toddr_dai_startup(substream, dai); ++ if (ret) ++ return ret; ++ ++ /* ++ * Make sure the first channel ends up in the at beginning of the output ++ * As weird as it looks, without this the first channel may be misplaced ++ * in memory, with a random shift of 2 channels. ++ */ ++ regmap_update_bits(fifo->map, FIFO_CTRL0, CTRL0_TODDR_SYNC_CH, ++ CTRL0_TODDR_SYNC_CH); ++ ++ return 0; ++} ++ + static const struct snd_soc_dai_ops g12a_toddr_ops = { + .prepare = g12a_toddr_dai_prepare, + .hw_params = axg_toddr_dai_hw_params, +- .startup = axg_toddr_dai_startup, ++ .startup = g12a_toddr_dai_startup, + .shutdown = axg_toddr_dai_shutdown, + }; + +-- +2.25.1 + diff --git a/queue-5.8/asoc-qcom-common-fix-refcount-imbalance-on-error.patch b/queue-5.8/asoc-qcom-common-fix-refcount-imbalance-on-error.patch new file mode 100644 index 00000000000..87d79053606 --- /dev/null +++ b/queue-5.8/asoc-qcom-common-fix-refcount-imbalance-on-error.patch @@ -0,0 +1,43 @@ +From 4e27b9dc457b2c90708ff64cf937aecaad7a2f2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 12:28:27 +0800 +Subject: ASoC: qcom: common: Fix refcount imbalance on error + +From: Dinghao Liu + +[ Upstream commit c1e6414cdc371f9ed82cefebba7538499a3059f9 ] + +for_each_child_of_node returns a node pointer np with +refcount incremented. So when devm_kzalloc fails, a +pairing refcount decrement is needed to keep np's +refcount balanced. + +Fixes: 16395ceee11f8 ("ASoC: qcom: common: Fix NULL pointer in of parser") +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20200820042828.10308-1-dinghao.liu@zju.edu.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/common.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/qcom/common.c b/sound/soc/qcom/common.c +index 8ada4ecba8472..10322690c0eaa 100644 +--- a/sound/soc/qcom/common.c ++++ b/sound/soc/qcom/common.c +@@ -45,8 +45,10 @@ int qcom_snd_parse_of(struct snd_soc_card *card) + + for_each_child_of_node(dev->of_node, np) { + dlc = devm_kzalloc(dev, 2 * sizeof(*dlc), GFP_KERNEL); +- if (!dlc) +- return -ENOMEM; ++ if (!dlc) { ++ ret = -ENOMEM; ++ goto err; ++ } + + link->cpus = &dlc[0]; + link->platforms = &dlc[1]; +-- +2.25.1 + diff --git a/queue-5.8/asoc-qcom-set-card-owner-to-avoid-warnings.patch b/queue-5.8/asoc-qcom-set-card-owner-to-avoid-warnings.patch new file mode 100644 index 00000000000..817d6a89ab4 --- /dev/null +++ b/queue-5.8/asoc-qcom-set-card-owner-to-avoid-warnings.patch @@ -0,0 +1,96 @@ +From 7bdefbb9d2c517946a54d3715b3f480571a5db09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 17:45:11 +0200 +Subject: ASoC: qcom: Set card->owner to avoid warnings + +From: Stephan Gerhold + +[ Upstream commit 3c27ea23ffb43262da6c64964163895951aaed4e ] + +On Linux 5.9-rc1 I get the following warning with apq8016-sbc: + +WARNING: CPU: 2 PID: 69 at sound/core/init.c:207 snd_card_new+0x36c/0x3b0 [snd] +CPU: 2 PID: 69 Comm: kworker/2:1 Not tainted 5.9.0-rc1 #1 +Workqueue: events deferred_probe_work_func +pc : snd_card_new+0x36c/0x3b0 [snd] +lr : snd_card_new+0xf4/0x3b0 [snd] +Call trace: + snd_card_new+0x36c/0x3b0 [snd] + snd_soc_bind_card+0x340/0x9a0 [snd_soc_core] + snd_soc_register_card+0xf4/0x110 [snd_soc_core] + devm_snd_soc_register_card+0x44/0xa0 [snd_soc_core] + apq8016_sbc_platform_probe+0x11c/0x140 [snd_soc_apq8016_sbc] + +This warning was introduced in +commit 81033c6b584b ("ALSA: core: Warn on empty module"). +It looks like we are supposed to set card->owner to THIS_MODULE. + +Fix this for all the qcom ASoC drivers. + +Cc: Srinivas Kandagatla +Fixes: 79119c798649 ("ASoC: qcom: Add Storm machine driver") +Fixes: bdb052e81f62 ("ASoC: qcom: add apq8016 sound card support") +Fixes: a6f933f63f2f ("ASoC: qcom: apq8096: Add db820c machine driver") +Fixes: 6b1687bf76ef ("ASoC: qcom: add sdm845 sound card support") +Signed-off-by: Stephan Gerhold +Link: https://lore.kernel.org/r/20200820154511.203072-1-stephan@gerhold.net +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/apq8016_sbc.c | 1 + + sound/soc/qcom/apq8096.c | 1 + + sound/soc/qcom/sdm845.c | 1 + + sound/soc/qcom/storm.c | 1 + + 4 files changed, 4 insertions(+) + +diff --git a/sound/soc/qcom/apq8016_sbc.c b/sound/soc/qcom/apq8016_sbc.c +index 2ef090f4af9e9..8abc1a95184b2 100644 +--- a/sound/soc/qcom/apq8016_sbc.c ++++ b/sound/soc/qcom/apq8016_sbc.c +@@ -234,6 +234,7 @@ static int apq8016_sbc_platform_probe(struct platform_device *pdev) + return -ENOMEM; + + card->dev = dev; ++ card->owner = THIS_MODULE; + card->dapm_widgets = apq8016_sbc_dapm_widgets; + card->num_dapm_widgets = ARRAY_SIZE(apq8016_sbc_dapm_widgets); + data = apq8016_sbc_parse_of(card); +diff --git a/sound/soc/qcom/apq8096.c b/sound/soc/qcom/apq8096.c +index 287ad2aa27f37..d47bedc259c59 100644 +--- a/sound/soc/qcom/apq8096.c ++++ b/sound/soc/qcom/apq8096.c +@@ -114,6 +114,7 @@ static int apq8096_platform_probe(struct platform_device *pdev) + return -ENOMEM; + + card->dev = dev; ++ card->owner = THIS_MODULE; + dev_set_drvdata(dev, card); + ret = qcom_snd_parse_of(card); + if (ret) +diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c +index 68e9388ff46f1..b5b8465caf56f 100644 +--- a/sound/soc/qcom/sdm845.c ++++ b/sound/soc/qcom/sdm845.c +@@ -557,6 +557,7 @@ static int sdm845_snd_platform_probe(struct platform_device *pdev) + card->dapm_widgets = sdm845_snd_widgets; + card->num_dapm_widgets = ARRAY_SIZE(sdm845_snd_widgets); + card->dev = dev; ++ card->owner = THIS_MODULE; + dev_set_drvdata(dev, card); + ret = qcom_snd_parse_of(card); + if (ret) +diff --git a/sound/soc/qcom/storm.c b/sound/soc/qcom/storm.c +index 3a6e18709b9e2..4ba111c841375 100644 +--- a/sound/soc/qcom/storm.c ++++ b/sound/soc/qcom/storm.c +@@ -96,6 +96,7 @@ static int storm_platform_probe(struct platform_device *pdev) + return -ENOMEM; + + card->dev = &pdev->dev; ++ card->owner = THIS_MODULE; + + ret = snd_soc_of_parse_card_name(card, "qcom,model"); + if (ret) { +-- +2.25.1 + diff --git a/queue-5.8/asoc-rt1308-sdw-fix-return-check-for-devm_regmap_ini.patch b/queue-5.8/asoc-rt1308-sdw-fix-return-check-for-devm_regmap_ini.patch new file mode 100644 index 00000000000..94b230d8a5b --- /dev/null +++ b/queue-5.8/asoc-rt1308-sdw-fix-return-check-for-devm_regmap_ini.patch @@ -0,0 +1,42 @@ +From 70877d713774e528ab57b6f57f9d5dd03ed91500 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 22:03:37 +0530 +Subject: ASoC: rt1308-sdw: Fix return check for devm_regmap_init_sdw() + +From: Vinod Koul + +[ Upstream commit 344850d93c098e1b17e6f89d5e436893e9762ef3 ] + +devm_regmap_init_sdw() returns a valid pointer on success or ERR_PTR on +failure which should be checked with IS_ERR. Also use PTR_ERR for +returning error codes. + +Reported-by: Takashi Iwai +Fixes: a87a6653a28c ("ASoC: rt1308-sdw: add rt1308 SdW amplifier driver") +Signed-off-by: Vinod Koul +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200826163340.3249608-3-vkoul@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt1308-sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt1308-sdw.c b/sound/soc/codecs/rt1308-sdw.c +index b0ba0d2acbdd6..56e952a904a39 100644 +--- a/sound/soc/codecs/rt1308-sdw.c ++++ b/sound/soc/codecs/rt1308-sdw.c +@@ -684,8 +684,8 @@ static int rt1308_sdw_probe(struct sdw_slave *slave, + + /* Regmap Initialization */ + regmap = devm_regmap_init_sdw(slave, &rt1308_sdw_regmap); +- if (!regmap) +- return -EINVAL; ++ if (IS_ERR(regmap)) ++ return PTR_ERR(regmap); + + rt1308_sdw_init(&slave->dev, regmap, slave); + +-- +2.25.1 + diff --git a/queue-5.8/asoc-rt700-fix-return-check-for-devm_regmap_init_sdw.patch b/queue-5.8/asoc-rt700-fix-return-check-for-devm_regmap_init_sdw.patch new file mode 100644 index 00000000000..68b74e13c3c --- /dev/null +++ b/queue-5.8/asoc-rt700-fix-return-check-for-devm_regmap_init_sdw.patch @@ -0,0 +1,42 @@ +From 022ea5d31470114d83ac036e823c0fcf973fe6b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 22:03:40 +0530 +Subject: ASoC: rt700: Fix return check for devm_regmap_init_sdw() + +From: Vinod Koul + +[ Upstream commit db1a4250aef53775ec0094b81454213319cc8c74 ] + +devm_regmap_init_sdw() returns a valid pointer on success or ERR_PTR on +failure which should be checked with IS_ERR. Also use PTR_ERR for +returning error codes. + +Reported-by: Takashi Iwai +Fixes: 7d2a5f9ae41e ("ASoC: rt700: add rt700 codec driver") +Signed-off-by: Vinod Koul +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200826163340.3249608-6-vkoul@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt700-sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt700-sdw.c b/sound/soc/codecs/rt700-sdw.c +index 4d14048d11976..1d24bf0407182 100644 +--- a/sound/soc/codecs/rt700-sdw.c ++++ b/sound/soc/codecs/rt700-sdw.c +@@ -452,8 +452,8 @@ static int rt700_sdw_probe(struct sdw_slave *slave, + + /* Regmap Initialization */ + sdw_regmap = devm_regmap_init_sdw(slave, &rt700_sdw_regmap); +- if (!sdw_regmap) +- return -EINVAL; ++ if (IS_ERR(sdw_regmap)) ++ return PTR_ERR(sdw_regmap); + + regmap = devm_regmap_init(&slave->dev, NULL, + &slave->dev, &rt700_regmap); +-- +2.25.1 + diff --git a/queue-5.8/asoc-rt711-fix-return-check-for-devm_regmap_init_sdw.patch b/queue-5.8/asoc-rt711-fix-return-check-for-devm_regmap_init_sdw.patch new file mode 100644 index 00000000000..3563d1bf84d --- /dev/null +++ b/queue-5.8/asoc-rt711-fix-return-check-for-devm_regmap_init_sdw.patch @@ -0,0 +1,42 @@ +From dc6993ab6ca631cb8c52ff6925c2ac3532f435d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 22:03:38 +0530 +Subject: ASoC: rt711: Fix return check for devm_regmap_init_sdw() + +From: Vinod Koul + +[ Upstream commit be1a4b2c56db860a220c6f74d461188e5733264a ] + +devm_regmap_init_sdw() returns a valid pointer on success or ERR_PTR on +failure which should be checked with IS_ERR. Also use PTR_ERR for +returning error codes. + +Reported-by: Takashi Iwai +Fixes: 320b8b0d13b8 ("ASoC: rt711: add rt711 codec driver") +Signed-off-by: Vinod Koul +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200826163340.3249608-4-vkoul@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt711-sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt711-sdw.c b/sound/soc/codecs/rt711-sdw.c +index 45b928954b580..7efff130a638c 100644 +--- a/sound/soc/codecs/rt711-sdw.c ++++ b/sound/soc/codecs/rt711-sdw.c +@@ -452,8 +452,8 @@ static int rt711_sdw_probe(struct sdw_slave *slave, + + /* Regmap Initialization */ + sdw_regmap = devm_regmap_init_sdw(slave, &rt711_sdw_regmap); +- if (!sdw_regmap) +- return -EINVAL; ++ if (IS_ERR(sdw_regmap)) ++ return PTR_ERR(sdw_regmap); + + regmap = devm_regmap_init(&slave->dev, NULL, + &slave->dev, &rt711_regmap); +-- +2.25.1 + diff --git a/queue-5.8/asoc-rt715-fix-return-check-for-devm_regmap_init_sdw.patch b/queue-5.8/asoc-rt715-fix-return-check-for-devm_regmap_init_sdw.patch new file mode 100644 index 00000000000..1d4dd8a1cd7 --- /dev/null +++ b/queue-5.8/asoc-rt715-fix-return-check-for-devm_regmap_init_sdw.patch @@ -0,0 +1,42 @@ +From 79dda85460be0aa546e1f34b6326d2687bbc451a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 22:03:39 +0530 +Subject: ASoC: rt715: Fix return check for devm_regmap_init_sdw() + +From: Vinod Koul + +[ Upstream commit 282eb0b52e3f0399ee48a4cad0d9ffec840b0164 ] + +devm_regmap_init_sdw() returns a valid pointer on success or ERR_PTR on +failure which should be checked with IS_ERR. Also use PTR_ERR for +returning error codes. + +Reported-by: Takashi Iwai +Fixes: d1ede0641b05 ("ASoC: rt715: add RT715 codec driver") +Signed-off-by: Vinod Koul +Reviewed-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20200826163340.3249608-5-vkoul@kernel.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt715-sdw.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/rt715-sdw.c b/sound/soc/codecs/rt715-sdw.c +index d11b23d6b240a..68a36739f1b0d 100644 +--- a/sound/soc/codecs/rt715-sdw.c ++++ b/sound/soc/codecs/rt715-sdw.c +@@ -527,8 +527,8 @@ static int rt715_sdw_probe(struct sdw_slave *slave, + + /* Regmap Initialization */ + sdw_regmap = devm_regmap_init_sdw(slave, &rt715_sdw_regmap); +- if (!sdw_regmap) +- return -EINVAL; ++ if (IS_ERR(sdw_regmap)) ++ return PTR_ERR(sdw_regmap); + + regmap = devm_regmap_init(&slave->dev, NULL, &slave->dev, + &rt715_regmap); +-- +2.25.1 + diff --git a/queue-5.8/asoc-soc-core-add-snd_soc_find_dai_with_mutex.patch b/queue-5.8/asoc-soc-core-add-snd_soc_find_dai_with_mutex.patch new file mode 100644 index 00000000000..04c142403ae --- /dev/null +++ b/queue-5.8/asoc-soc-core-add-snd_soc_find_dai_with_mutex.patch @@ -0,0 +1,137 @@ +From c6f68b9d57741bbdfd631fb18812c9f3786abfc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 08:55:39 +0900 +Subject: ASoC: soc-core: add snd_soc_find_dai_with_mutex() + +From: Kuninori Morimoto + +[ Upstream commit 20d9fdee72dfaa1fa7588c7a846283bd740e7157 ] + +commit 25612477d20b52 ("ASoC: soc-dai: set dai_link dpcm_ flags with a helper") +added snd_soc_dai_link_set_capabilities(). +But it is using snd_soc_find_dai() (A) which is required client_mutex (B). +And client_mutex is soc-core.c local. + + struct snd_soc_dai *snd_soc_find_dai(xxx) + { + ... +(B) lockdep_assert_held(&client_mutex); + ... + } + + void snd_soc_dai_link_set_capabilities(xxx) + { + ... + for_each_pcm_streams(direction) { + ... + for_each_link_cpus(dai_link, i, cpu) { +(A) dai = snd_soc_find_dai(cpu); + ... + } + ... + for_each_link_codecs(dai_link, i, codec) { +(A) dai = snd_soc_find_dai(codec); + ... + } + } + ... + } + +Because of these background, we will get WARNING if .config has CONFIG_LOCKDEP. + + WARNING: CPU: 2 PID: 53 at sound/soc/soc-core.c:814 snd_soc_find_dai+0xf8/0x100 + CPU: 2 PID: 53 Comm: kworker/2:1 Not tainted 5.7.0-rc1+ #328 + Hardware name: Renesas H3ULCB Kingfisher board based on r8a77951 (DT) + Workqueue: events deferred_probe_work_func + pstate: 60000005 (nZCv daif -PAN -UAO) + pc : snd_soc_find_dai+0xf8/0x100 + lr : snd_soc_find_dai+0xf4/0x100 + ... + Call trace: + snd_soc_find_dai+0xf8/0x100 + snd_soc_dai_link_set_capabilities+0xa0/0x16c + graph_dai_link_of_dpcm+0x390/0x3c0 + graph_for_each_link+0x134/0x200 + graph_probe+0x144/0x230 + platform_drv_probe+0x5c/0xb0 + really_probe+0xe4/0x430 + driver_probe_device+0x60/0xf4 + +snd_soc_find_dai() will be used from (X) CPU/Codec/Platform driver with +mutex lock, and (Y) Card driver without mutex lock. +This snd_soc_dai_link_set_capabilities() is for Card driver, +this means called without mutex. +This patch adds snd_soc_find_dai_with_mutex() to solve it. + +Fixes: 25612477d20b52 ("ASoC: soc-dai: set dai_link dpcm_ flags with a helper") +Signed-off-by: Kuninori Morimoto +Link: https://lore.kernel.org/r/87blixvuab.wl-kuninori.morimoto.gx@renesas.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + include/sound/soc.h | 2 ++ + sound/soc/soc-core.c | 13 +++++++++++++ + sound/soc/soc-dai.c | 4 ++-- + 3 files changed, 17 insertions(+), 2 deletions(-) + +diff --git a/include/sound/soc.h b/include/sound/soc.h +index 3ce7f0f5aa929..bc6ecb10c7649 100644 +--- a/include/sound/soc.h ++++ b/include/sound/soc.h +@@ -1373,6 +1373,8 @@ void snd_soc_unregister_dai(struct snd_soc_dai *dai); + + struct snd_soc_dai *snd_soc_find_dai( + const struct snd_soc_dai_link_component *dlc); ++struct snd_soc_dai *snd_soc_find_dai_with_mutex( ++ const struct snd_soc_dai_link_component *dlc); + + #include + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index f1d641cd48da9..20ca1d38b4b87 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -834,6 +834,19 @@ struct snd_soc_dai *snd_soc_find_dai( + } + EXPORT_SYMBOL_GPL(snd_soc_find_dai); + ++struct snd_soc_dai *snd_soc_find_dai_with_mutex( ++ const struct snd_soc_dai_link_component *dlc) ++{ ++ struct snd_soc_dai *dai; ++ ++ mutex_lock(&client_mutex); ++ dai = snd_soc_find_dai(dlc); ++ mutex_unlock(&client_mutex); ++ ++ return dai; ++} ++EXPORT_SYMBOL_GPL(snd_soc_find_dai_with_mutex); ++ + static int soc_dai_link_sanity_check(struct snd_soc_card *card, + struct snd_soc_dai_link *link) + { +diff --git a/sound/soc/soc-dai.c b/sound/soc/soc-dai.c +index cecbbed2de9d5..0e04ad7689cd9 100644 +--- a/sound/soc/soc-dai.c ++++ b/sound/soc/soc-dai.c +@@ -410,14 +410,14 @@ void snd_soc_dai_link_set_capabilities(struct snd_soc_dai_link *dai_link) + supported_codec = false; + + for_each_link_cpus(dai_link, i, cpu) { +- dai = snd_soc_find_dai(cpu); ++ dai = snd_soc_find_dai_with_mutex(cpu); + if (dai && snd_soc_dai_stream_valid(dai, direction)) { + supported_cpu = true; + break; + } + } + for_each_link_codecs(dai_link, i, codec) { +- dai = snd_soc_find_dai(codec); ++ dai = snd_soc_find_dai_with_mutex(codec); + if (dai && snd_soc_dai_stream_valid(dai, direction)) { + supported_codec = true; + break; +-- +2.25.1 + diff --git a/queue-5.8/asoc-tlv320adcx140-fix-accessing-uninitialized-adcx1.patch b/queue-5.8/asoc-tlv320adcx140-fix-accessing-uninitialized-adcx1.patch new file mode 100644 index 00000000000..66138227af4 --- /dev/null +++ b/queue-5.8/asoc-tlv320adcx140-fix-accessing-uninitialized-adcx1.patch @@ -0,0 +1,47 @@ +From 7f9af9a0ab46004b69457f6c5b6121087404cbcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 15:57:35 +0200 +Subject: ASoC: tlv320adcx140: Fix accessing uninitialized adcx140->dev + +From: Camel Guo + +[ Upstream commit 2569231d71dff82cfd6e82ab3871776f72ec53b6 ] + +In adcx140_i2c_probe, adcx140->dev is accessed before its +initialization. This commit fixes this bug. + +Fixes: 689c7655b50c ("ASoC: tlv320adcx140: Add the tlv320adcx140 codec driver family") +Acked-by: Dan Murphy +Signed-off-by: Camel Guo +Link: https://lore.kernel.org/r/20200901135736.32036-1-camel.guo@axis.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/tlv320adcx140.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/tlv320adcx140.c b/sound/soc/codecs/tlv320adcx140.c +index 35fe8ee5bce9f..03fb50175d876 100644 +--- a/sound/soc/codecs/tlv320adcx140.c ++++ b/sound/soc/codecs/tlv320adcx140.c +@@ -930,6 +930,8 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, + if (!adcx140) + return -ENOMEM; + ++ adcx140->dev = &i2c->dev; ++ + adcx140->gpio_reset = devm_gpiod_get_optional(adcx140->dev, + "reset", GPIOD_OUT_LOW); + if (IS_ERR(adcx140->gpio_reset)) +@@ -957,7 +959,7 @@ static int adcx140_i2c_probe(struct i2c_client *i2c, + ret); + return ret; + } +- adcx140->dev = &i2c->dev; ++ + i2c_set_clientdata(i2c, adcx140); + + return devm_snd_soc_register_component(&i2c->dev, +-- +2.25.1 + diff --git a/queue-5.8/block-only-call-sched-requeue_request-for-scheduled-.patch b/queue-5.8/block-only-call-sched-requeue_request-for-scheduled-.patch new file mode 100644 index 00000000000..bd80b9c951a --- /dev/null +++ b/queue-5.8/block-only-call-sched-requeue_request-for-scheduled-.patch @@ -0,0 +1,86 @@ +From 53a937f0e8334fc0fe40dab3390099db743e9366 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 13:46:37 -0700 +Subject: block: only call sched requeue_request() for scheduled requests + +From: Omar Sandoval + +[ Upstream commit e8a8a185051a460e3eb0617dca33f996f4e31516 ] + +Yang Yang reported the following crash caused by requeueing a flush +request in Kyber: + + [ 2.517297] Unable to handle kernel paging request at virtual address ffffffd8071c0b00 + ... + [ 2.517468] pc : clear_bit+0x18/0x2c + [ 2.517502] lr : sbitmap_queue_clear+0x40/0x228 + [ 2.517503] sp : ffffff800832bc60 pstate : 00c00145 + ... + [ 2.517599] Process ksoftirqd/5 (pid: 51, stack limit = 0xffffff8008328000) + [ 2.517602] Call trace: + [ 2.517606] clear_bit+0x18/0x2c + [ 2.517619] kyber_finish_request+0x74/0x80 + [ 2.517627] blk_mq_requeue_request+0x3c/0xc0 + [ 2.517637] __scsi_queue_insert+0x11c/0x148 + [ 2.517640] scsi_softirq_done+0x114/0x130 + [ 2.517643] blk_done_softirq+0x7c/0xb0 + [ 2.517651] __do_softirq+0x208/0x3bc + [ 2.517657] run_ksoftirqd+0x34/0x60 + [ 2.517663] smpboot_thread_fn+0x1c4/0x2c0 + [ 2.517667] kthread+0x110/0x120 + [ 2.517669] ret_from_fork+0x10/0x18 + +This happens because Kyber doesn't track flush requests, so +kyber_finish_request() reads a garbage domain token. Only call the +scheduler's requeue_request() hook if RQF_ELVPRIV is set (like we do for +the finish_request() hook in blk_mq_free_request()). Now that we're +handling it in blk-mq, also remove the check from BFQ. + +Reported-by: Yang Yang +Signed-off-by: Omar Sandoval +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 12 ------------ + block/blk-mq-sched.h | 2 +- + 2 files changed, 1 insertion(+), 13 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 50c8f034c01c5..caa4fa7f42b84 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -5895,18 +5895,6 @@ static void bfq_finish_requeue_request(struct request *rq) + struct bfq_queue *bfqq = RQ_BFQQ(rq); + struct bfq_data *bfqd; + +- /* +- * Requeue and finish hooks are invoked in blk-mq without +- * checking whether the involved request is actually still +- * referenced in the scheduler. To handle this fact, the +- * following two checks make this function exit in case of +- * spurious invocations, for which there is nothing to do. +- * +- * First, check whether rq has nothing to do with an elevator. +- */ +- if (unlikely(!(rq->rq_flags & RQF_ELVPRIV))) +- return; +- + /* + * rq either is not associated with any icq, or is an already + * requeued request that has not (yet) been re-inserted into +diff --git a/block/blk-mq-sched.h b/block/blk-mq-sched.h +index 126021fc3a11f..e81ca1bf6e10b 100644 +--- a/block/blk-mq-sched.h ++++ b/block/blk-mq-sched.h +@@ -66,7 +66,7 @@ static inline void blk_mq_sched_requeue_request(struct request *rq) + struct request_queue *q = rq->q; + struct elevator_queue *e = q->elevator; + +- if (e && e->type->ops.requeue_request) ++ if ((rq->rq_flags & RQF_ELVPRIV) && e && e->type->ops.requeue_request) + e->type->ops.requeue_request(rq); + } + +-- +2.25.1 + diff --git a/queue-5.8/cifs-fix-dfs-mount-with-cifsacl-modefromsid.patch b/queue-5.8/cifs-fix-dfs-mount-with-cifsacl-modefromsid.patch new file mode 100644 index 00000000000..3720d3f2912 --- /dev/null +++ b/queue-5.8/cifs-fix-dfs-mount-with-cifsacl-modefromsid.patch @@ -0,0 +1,52 @@ +From ab127f536b5f1a8d8f1be39d880065b17dfb1fc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 10:02:39 +1000 +Subject: cifs: fix DFS mount with cifsacl/modefromsid + +From: Ronnie Sahlberg + +[ Upstream commit 01ec372cef1e5afa4ab843bbaf88a6fcb64dc14c ] + +RHBZ: 1871246 + +If during cifs_lookup()/get_inode_info() we encounter a DFS link +and we use the cifsacl or modefromsid mount options we must suppress +any -EREMOTE errors that triggers or else we will not be able to follow +the DFS link and automount the target. + +This fixes an issue with modefromsid/cifsacl where these mountoptions +would break DFS and we would no longer be able to access the share. + +Signed-off-by: Ronnie Sahlberg +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/inode.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index ce95801e9b664..7708175062eba 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -1017,6 +1017,8 @@ handle_mnt_opt: + if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MODE_FROM_SID) { + rc = cifs_acl_to_fattr(cifs_sb, &fattr, *inode, true, + full_path, fid); ++ if (rc == -EREMOTE) ++ rc = 0; + if (rc) { + cifs_dbg(FYI, "%s: Get mode from SID failed. rc=%d\n", + __func__, rc); +@@ -1025,6 +1027,8 @@ handle_mnt_opt: + } else if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_CIFS_ACL) { + rc = cifs_acl_to_fattr(cifs_sb, &fattr, *inode, false, + full_path, fid); ++ if (rc == -EREMOTE) ++ rc = 0; + if (rc) { + cifs_dbg(FYI, "%s: Getting ACL failed with error: %d\n", + __func__, rc); +-- +2.25.1 + diff --git a/queue-5.8/clk-davinci-use-the-correct-size-when-allocating-mem.patch b/queue-5.8/clk-davinci-use-the-correct-size-when-allocating-mem.patch new file mode 100644 index 00000000000..7ea673f5177 --- /dev/null +++ b/queue-5.8/clk-davinci-use-the-correct-size-when-allocating-mem.patch @@ -0,0 +1,38 @@ +From 29a79c38e96298fe7329401ec717a94071551949 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Aug 2020 16:49:59 +0200 +Subject: clk: davinci: Use the correct size when allocating memory + +From: Christophe JAILLET + +[ Upstream commit 3dabfa2bda48dab717986609762ce2a49335eb99 ] + +'sizeof(*pllen)' should be used in place of 'sizeof(*pllout)' to avoid a +small over-allocation. + +Fixes: 2d1726915159 ("clk: davinci: New driver for davinci PLL clocks") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20200809144959.747986-1-christophe.jaillet@wanadoo.fr +Reviewed-by: David Lechner +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/davinci/pll.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/davinci/pll.c b/drivers/clk/davinci/pll.c +index 8a23d5dfd1f8d..5f063e1be4b14 100644 +--- a/drivers/clk/davinci/pll.c ++++ b/drivers/clk/davinci/pll.c +@@ -491,7 +491,7 @@ struct clk *davinci_pll_clk_register(struct device *dev, + parent_name = postdiv_name; + } + +- pllen = kzalloc(sizeof(*pllout), GFP_KERNEL); ++ pllen = kzalloc(sizeof(*pllen), GFP_KERNEL); + if (!pllen) { + ret = -ENOMEM; + goto err_unregister_postdiv; +-- +2.25.1 + diff --git a/queue-5.8/clk-rockchip-fix-initialization-of-mux_pll_src_4plls.patch b/queue-5.8/clk-rockchip-fix-initialization-of-mux_pll_src_4plls.patch new file mode 100644 index 00000000000..75220db9851 --- /dev/null +++ b/queue-5.8/clk-rockchip-fix-initialization-of-mux_pll_src_4plls.patch @@ -0,0 +1,58 @@ +From e1157447fcc6bfc3f02ad3292ba4ad78334dd04f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Aug 2020 21:40:20 -0700 +Subject: clk: rockchip: Fix initialization of mux_pll_src_4plls_p +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Nathan Chancellor + +[ Upstream commit e9c006bc782c488f485ffe50de20b44e1e3daa18 ] + +A new warning in Clang points out that the initialization of +mux_pll_src_4plls_p appears incorrect: + +../drivers/clk/rockchip/clk-rk3228.c:140:58: warning: suspicious +concatenation of string literals in an array initialization; did you +mean to separate the elements with a comma? [-Wstring-concatenation] +PNAME(mux_pll_src_4plls_p) = { "cpll", "gpll", "hdmiphy" "usb480m" }; + ^ + , +../drivers/clk/rockchip/clk-rk3228.c:140:48: note: place parentheses +around the string literal to silence warning +PNAME(mux_pll_src_4plls_p) = { "cpll", "gpll", "hdmiphy" "usb480m" }; + ^ +1 warning generated. + +Given the name of the variable and the same variable name in rv1108, it +seems that this should have been four distinct elements. Fix it up by +adding the comma as suggested. + +Fixes: 307a2e9ac524 ("clk: rockchip: add clock controller for rk3228") +Link: https://github.com/ClangBuiltLinux/linux/issues/1123 +Signed-off-by: Nathan Chancellor +Link: https://lore.kernel.org/r/20200810044020.2063350-1-natechancellor@gmail.com +Reviewed-by: Heiko Stübner +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/rockchip/clk-rk3228.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/rockchip/clk-rk3228.c b/drivers/clk/rockchip/clk-rk3228.c +index d7243c09cc843..47d6482dda9df 100644 +--- a/drivers/clk/rockchip/clk-rk3228.c ++++ b/drivers/clk/rockchip/clk-rk3228.c +@@ -137,7 +137,7 @@ PNAME(mux_usb480m_p) = { "usb480m_phy", "xin24m" }; + PNAME(mux_hdmiphy_p) = { "hdmiphy_phy", "xin24m" }; + PNAME(mux_aclk_cpu_src_p) = { "cpll_aclk_cpu", "gpll_aclk_cpu", "hdmiphy_aclk_cpu" }; + +-PNAME(mux_pll_src_4plls_p) = { "cpll", "gpll", "hdmiphy" "usb480m" }; ++PNAME(mux_pll_src_4plls_p) = { "cpll", "gpll", "hdmiphy", "usb480m" }; + PNAME(mux_pll_src_3plls_p) = { "cpll", "gpll", "hdmiphy" }; + PNAME(mux_pll_src_2plls_p) = { "cpll", "gpll" }; + PNAME(mux_sclk_hdmi_cec_p) = { "cpll", "gpll", "xin24m" }; +-- +2.25.1 + diff --git a/queue-5.8/drivers-hv-vmbus-add-timeout-to-vmbus_wait_for_unloa.patch b/queue-5.8/drivers-hv-vmbus-add-timeout-to-vmbus_wait_for_unloa.patch new file mode 100644 index 00000000000..d68205f0e52 --- /dev/null +++ b/queue-5.8/drivers-hv-vmbus-add-timeout-to-vmbus_wait_for_unloa.patch @@ -0,0 +1,54 @@ +From 01527e29ef00590bd71dcee2f91fed11facbf9af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Sep 2020 12:47:29 -0700 +Subject: Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload + +From: Michael Kelley + +[ Upstream commit 911e1987efc8f3e6445955fbae7f54b428b92bd3 ] + +vmbus_wait_for_unload() looks for a CHANNELMSG_UNLOAD_RESPONSE message +coming from Hyper-V. But if the message isn't found for some reason, +the panic path gets hung forever. Add a timeout of 10 seconds to prevent +this. + +Fixes: 415719160de3 ("Drivers: hv: vmbus: avoid scheduling in interrupt context in vmbus_initiate_unload()") +Signed-off-by: Michael Kelley +Reviewed-by: Dexuan Cui +Reviewed-by: Vitaly Kuznetsov +Link: https://lore.kernel.org/r/1600026449-23651-1-git-send-email-mikelley@microsoft.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/channel_mgmt.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 417a95e5094dd..af7832e131674 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -750,7 +750,7 @@ static void vmbus_wait_for_unload(void) + void *page_addr; + struct hv_message *msg; + struct vmbus_channel_message_header *hdr; +- u32 message_type; ++ u32 message_type, i; + + /* + * CHANNELMSG_UNLOAD_RESPONSE is always delivered to the CPU which was +@@ -760,8 +760,11 @@ static void vmbus_wait_for_unload(void) + * functional and vmbus_unload_response() will complete + * vmbus_connection.unload_event. If not, the last thing we can do is + * read message pages for all CPUs directly. ++ * ++ * Wait no more than 10 seconds so that the panic path can't get ++ * hung forever in case the response message isn't seen. + */ +- while (1) { ++ for (i = 0; i < 1000; i++) { + if (completion_done(&vmbus_connection.unload_event)) + break; + +-- +2.25.1 + diff --git a/queue-5.8/drivers-hv-vmbus-hibernation-do-not-hang-forever-in-.patch b/queue-5.8/drivers-hv-vmbus-hibernation-do-not-hang-forever-in-.patch new file mode 100644 index 00000000000..13dc29c2963 --- /dev/null +++ b/queue-5.8/drivers-hv-vmbus-hibernation-do-not-hang-forever-in-.patch @@ -0,0 +1,65 @@ +From f251feb976ca20d4bb0a0ed5997539552d7be681 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 19:55:55 -0700 +Subject: Drivers: hv: vmbus: hibernation: do not hang forever in + vmbus_bus_resume() + +From: Dexuan Cui + +[ Upstream commit 19873eec7e13fda140a0ebc75d6664e57c00bfb1 ] + +After we Stop and later Start a VM that uses Accelerated Networking (NIC +SR-IOV), currently the VF vmbus device's Instance GUID can change, so after +vmbus_bus_resume() -> vmbus_request_offers(), vmbus_onoffer() can not find +the original vmbus channel of the VF, and hence we can't complete() +vmbus_connection.ready_for_resume_event in check_ready_for_resume_event(), +and the VM hangs in vmbus_bus_resume() forever. + +Fix the issue by adding a timeout, so the resuming can still succeed, and +the saved state is not lost, and according to my test, the user can disable +Accelerated Networking and then will be able to SSH into the VM for +further recovery. Also prevent the VM in question from suspending again. + +The host will be fixed so in future the Instance GUID will stay the same +across hibernation. + +Fixes: d8bd2d442bb2 ("Drivers: hv: vmbus: Resume after fixing up old primary channels") +Signed-off-by: Dexuan Cui +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20200905025555.45614-1-decui@microsoft.com +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/vmbus_drv.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index d69f4efa37198..dacdd8d2eb1b3 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2383,7 +2383,10 @@ static int vmbus_bus_suspend(struct device *dev) + if (atomic_read(&vmbus_connection.nr_chan_close_on_suspend) > 0) + wait_for_completion(&vmbus_connection.ready_for_suspend_event); + +- WARN_ON(atomic_read(&vmbus_connection.nr_chan_fixup_on_resume) != 0); ++ if (atomic_read(&vmbus_connection.nr_chan_fixup_on_resume) != 0) { ++ pr_err("Can not suspend due to a previous failed resuming\n"); ++ return -EBUSY; ++ } + + mutex_lock(&vmbus_connection.channel_mutex); + +@@ -2459,7 +2462,9 @@ static int vmbus_bus_resume(struct device *dev) + + vmbus_request_offers(); + +- wait_for_completion(&vmbus_connection.ready_for_resume_event); ++ if (wait_for_completion_timeout( ++ &vmbus_connection.ready_for_resume_event, 10 * HZ) == 0) ++ pr_err("Some vmbus device is missing after suspending?\n"); + + /* Reset the event for the next suspend. */ + reinit_completion(&vmbus_connection.ready_for_suspend_event); +-- +2.25.1 + diff --git a/queue-5.8/drm-i915-gem-reduce-context-termination-list-iterati.patch b/queue-5.8/drm-i915-gem-reduce-context-termination-list-iterati.patch new file mode 100644 index 00000000000..2f9902e3a5c --- /dev/null +++ b/queue-5.8/drm-i915-gem-reduce-context-termination-list-iterati.patch @@ -0,0 +1,111 @@ +From 45d920bd786f761089dc5e3082b6ef2f38dced30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 11:59:54 +0100 +Subject: drm/i915/gem: Reduce context termination list iteration guard to RCU + +From: Chris Wilson + +[ Upstream commit c2314b8bd4c009793b6f9d57bc8363af034e02ca ] + +As we now protect the timeline list using RCU, we can drop the +timeline->mutex for guarding the list iteration during context close, as +we are searching for an inflight request. Any new request will see the +context is banned and not be submitted. In doing so, pull the checks for +a concurrent submission of the request (notably the +i915_request_completed()) under the engine spinlock, to fully serialise +with __i915_request_submit()). That is in the case of preempt-to-busy +where the request may be completed during the __i915_request_submit(), +we need to be careful that we sample the request status after +serialising so that we don't miss the request the engine is actually +submitting. + +Fixes: 4a3174152147 ("drm/i915/gem: Refine occupancy test in kill_context()") +References: d22d2d073ef8 ("drm/i915: Protect i915_request_await_start from early waits") # rcu protection of timeline->requests +References: https://gitlab.freedesktop.org/drm/intel/-/issues/1622 +References: https://gitlab.freedesktop.org/drm/intel/-/issues/2158 +Signed-off-by: Chris Wilson +Reviewed-by: Tvrtko Ursulin +Link: https://patchwork.freedesktop.org/patch/msgid/20200806105954.7766-1-chris@chris-wilson.co.uk +Signed-off-by: Rodrigo Vivi +Signed-off-by: Joonas Lahtinen +(cherry picked from commit 736e785f9b28cd9ef2d16a80960a04fd00e64b22) +Signed-off-by: Jani Nikula +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gem/i915_gem_context.c | 32 ++++++++++++--------- + 1 file changed, 19 insertions(+), 13 deletions(-) + +diff --git a/drivers/gpu/drm/i915/gem/i915_gem_context.c b/drivers/gpu/drm/i915/gem/i915_gem_context.c +index 30c229fcb4046..6dce7d8b463eb 100644 +--- a/drivers/gpu/drm/i915/gem/i915_gem_context.c ++++ b/drivers/gpu/drm/i915/gem/i915_gem_context.c +@@ -440,29 +440,36 @@ static bool __cancel_engine(struct intel_engine_cs *engine) + return __reset_engine(engine); + } + +-static struct intel_engine_cs *__active_engine(struct i915_request *rq) ++static bool ++__active_engine(struct i915_request *rq, struct intel_engine_cs **active) + { + struct intel_engine_cs *engine, *locked; ++ bool ret = false; + + /* + * Serialise with __i915_request_submit() so that it sees + * is-banned?, or we know the request is already inflight. ++ * ++ * Note that rq->engine is unstable, and so we double ++ * check that we have acquired the lock on the final engine. + */ + locked = READ_ONCE(rq->engine); + spin_lock_irq(&locked->active.lock); + while (unlikely(locked != (engine = READ_ONCE(rq->engine)))) { + spin_unlock(&locked->active.lock); +- spin_lock(&engine->active.lock); + locked = engine; ++ spin_lock(&locked->active.lock); + } + +- engine = NULL; +- if (i915_request_is_active(rq) && rq->fence.error != -EIO) +- engine = rq->engine; ++ if (!i915_request_completed(rq)) { ++ if (i915_request_is_active(rq) && rq->fence.error != -EIO) ++ *active = locked; ++ ret = true; ++ } + + spin_unlock_irq(&locked->active.lock); + +- return engine; ++ return ret; + } + + static struct intel_engine_cs *active_engine(struct intel_context *ce) +@@ -473,17 +480,16 @@ static struct intel_engine_cs *active_engine(struct intel_context *ce) + if (!ce->timeline) + return NULL; + +- mutex_lock(&ce->timeline->mutex); +- list_for_each_entry_reverse(rq, &ce->timeline->requests, link) { +- if (i915_request_completed(rq)) +- break; ++ rcu_read_lock(); ++ list_for_each_entry_rcu(rq, &ce->timeline->requests, link) { ++ if (i915_request_is_active(rq) && i915_request_completed(rq)) ++ continue; + + /* Check with the backend if the request is inflight */ +- engine = __active_engine(rq); +- if (engine) ++ if (__active_engine(rq, &engine)) + break; + } +- mutex_unlock(&ce->timeline->mutex); ++ rcu_read_unlock(); + + return engine; + } +-- +2.25.1 + diff --git a/queue-5.8/drm-mediatek-add-exception-handing-in-mtk_drm_probe-.patch b/queue-5.8/drm-mediatek-add-exception-handing-in-mtk_drm_probe-.patch new file mode 100644 index 00000000000..f449d0fb85e --- /dev/null +++ b/queue-5.8/drm-mediatek-add-exception-handing-in-mtk_drm_probe-.patch @@ -0,0 +1,46 @@ +From 6f887cb098311bc8933d878e38cc931d6a6d652d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 16:49:42 +0800 +Subject: drm/mediatek: Add exception handing in mtk_drm_probe() if component + init fail + +From: Yu Kuai + +[ Upstream commit 64c194c00789889b0f9454f583712f079ba414ee ] + +mtk_ddp_comp_init() is called in a loop in mtk_drm_probe(), if it +fail, previous successive init component is not proccessed. + +Thus uninitialize valid component and put their device if component +init failed. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Yu Kuai +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index 040a8f393fe24..7ad0433539f45 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -544,8 +544,13 @@ err_pm: + pm_runtime_disable(dev); + err_node: + of_node_put(private->mutex_node); +- for (i = 0; i < DDP_COMPONENT_ID_MAX; i++) ++ for (i = 0; i < DDP_COMPONENT_ID_MAX; i++) { + of_node_put(private->comp_node[i]); ++ if (private->ddp_comp[i]) { ++ put_device(private->ddp_comp[i]->larb_dev); ++ private->ddp_comp[i] = NULL; ++ } ++ } + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_ddp_.patch b/queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_ddp_.patch new file mode 100644 index 00000000000..bff25ce2e9f --- /dev/null +++ b/queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_ddp_.patch @@ -0,0 +1,36 @@ +From c84a6e4b9ccb4f2eb085a0cfadc51d1fcd79acab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Sep 2020 16:30:58 +0800 +Subject: drm/mediatek: Add missing put_device() call in mtk_ddp_comp_init() + +From: Yu Kuai + +[ Upstream commit d494c257271153633a05c11e6dec85ddfc7700ee ] + +if of_find_device_by_node() succeed, mtk_ddp_comp_init() doesn't have +a corresponding put_device(). Thus add put_device() to fix the exception +handling for this function implementation. + +Fixes: d0afe37f5209 ("drm/mediatek: support CMDQ interface in ddp component") +Signed-off-by: Yu Kuai +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +index 57c88de9a3293..526648885b97e 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_ddp_comp.c +@@ -496,6 +496,7 @@ int mtk_ddp_comp_init(struct device *dev, struct device_node *node, + #if IS_REACHABLE(CONFIG_MTK_CMDQ) + if (of_address_to_resource(node, 0, &res) != 0) { + dev_err(dev, "Missing reg in %s node\n", node->full_name); ++ put_device(&larb_pdev->dev); + return -EINVAL; + } + comp->regs_pa = res.start; +-- +2.25.1 + diff --git a/queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_drm_.patch b/queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_drm_.patch new file mode 100644 index 00000000000..12fe55d8b56 --- /dev/null +++ b/queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_drm_.patch @@ -0,0 +1,69 @@ +From fd9fa5b7c08aa121e1a4300d07c8f484810ebba4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 19:21:19 +0800 +Subject: drm/mediatek: Add missing put_device() call in mtk_drm_kms_init() + +From: Yu Kuai + +[ Upstream commit 2132940f2192824acf160d115192755f7c58a847 ] + +if of_find_device_by_node() succeed, mtk_drm_kms_init() doesn't have +a corresponding put_device(). Thus add jump target to fix the exception +handling for this function implementation. + +Fixes: 119f5173628a ("drm/mediatek: Add DRM Driver for Mediatek SoC MT8173.") +Signed-off-by: Yu Kuai +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_drv.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_drv.c b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +index 7ad0433539f45..b77dc36be4224 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c +@@ -165,7 +165,7 @@ static int mtk_drm_kms_init(struct drm_device *drm) + + ret = drmm_mode_config_init(drm); + if (ret) +- return ret; ++ goto put_mutex_dev; + + drm->mode_config.min_width = 64; + drm->mode_config.min_height = 64; +@@ -182,7 +182,7 @@ static int mtk_drm_kms_init(struct drm_device *drm) + + ret = component_bind_all(drm->dev, drm); + if (ret) +- return ret; ++ goto put_mutex_dev; + + /* + * We currently support two fixed data streams, each optional, +@@ -229,7 +229,7 @@ static int mtk_drm_kms_init(struct drm_device *drm) + } + if (!dma_dev->dma_parms) { + ret = -ENOMEM; +- goto err_component_unbind; ++ goto put_dma_dev; + } + + ret = dma_set_max_seg_size(dma_dev, (unsigned int)DMA_BIT_MASK(32)); +@@ -256,9 +256,12 @@ static int mtk_drm_kms_init(struct drm_device *drm) + err_unset_dma_parms: + if (private->dma_parms_allocated) + dma_dev->dma_parms = NULL; ++put_dma_dev: ++ put_device(private->dma_dev); + err_component_unbind: + component_unbind_all(drm->dev, drm); +- ++put_mutex_dev: ++ put_device(private->mutex_dev); + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_hdmi.patch b/queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_hdmi.patch new file mode 100644 index 00000000000..70f04d75d35 --- /dev/null +++ b/queue-5.8/drm-mediatek-add-missing-put_device-call-in-mtk_hdmi.patch @@ -0,0 +1,92 @@ +From 814455f87fbb93aee67e227a9c3140859e9c09aa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 19:21:51 +0800 +Subject: drm/mediatek: Add missing put_device() call in + mtk_hdmi_dt_parse_pdata() + +From: Yu Kuai + +[ Upstream commit 0680a622318b8d657323b94082f4b9a44038dfee ] + +if of_find_device_by_node() succeed, mtk_drm_kms_init() doesn't have +a corresponding put_device(). Thus add jump target to fix the exception +handling for this function implementation. + +Fixes: 8f83f26891e1 ("drm/mediatek: Add HDMI support") +Signed-off-by: Yu Kuai +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_hdmi.c | 26 ++++++++++++++++++-------- + 1 file changed, 18 insertions(+), 8 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c +index 1eebe310470af..a9704822c0334 100644 +--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c ++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c +@@ -1507,25 +1507,30 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, + dev_err(dev, + "Failed to get system configuration registers: %d\n", + ret); +- return ret; ++ goto put_device; + } + hdmi->sys_regmap = regmap; + + mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); + hdmi->regs = devm_ioremap_resource(dev, mem); +- if (IS_ERR(hdmi->regs)) +- return PTR_ERR(hdmi->regs); ++ if (IS_ERR(hdmi->regs)) { ++ ret = PTR_ERR(hdmi->regs); ++ goto put_device; ++ } + + remote = of_graph_get_remote_node(np, 1, 0); +- if (!remote) +- return -EINVAL; ++ if (!remote) { ++ ret = -EINVAL; ++ goto put_device; ++ } + + if (!of_device_is_compatible(remote, "hdmi-connector")) { + hdmi->next_bridge = of_drm_find_bridge(remote); + if (!hdmi->next_bridge) { + dev_err(dev, "Waiting for external bridge\n"); + of_node_put(remote); +- return -EPROBE_DEFER; ++ ret = -EPROBE_DEFER; ++ goto put_device; + } + } + +@@ -1534,7 +1539,8 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, + dev_err(dev, "Failed to find ddc-i2c-bus node in %pOF\n", + remote); + of_node_put(remote); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_device; + } + of_node_put(remote); + +@@ -1542,10 +1548,14 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi, + of_node_put(i2c_np); + if (!hdmi->ddc_adpt) { + dev_err(dev, "Failed to get ddc i2c adapter by node\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_device; + } + + return 0; ++put_device: ++ put_device(hdmi->cec_dev); ++ return ret; + } + + /* +-- +2.25.1 + diff --git a/queue-5.8/drm-mediatek-dsi-fix-scrolling-of-panel-with-small-h.patch b/queue-5.8/drm-mediatek-dsi-fix-scrolling-of-panel-with-small-h.patch new file mode 100644 index 00000000000..02e9ee09ece --- /dev/null +++ b/queue-5.8/drm-mediatek-dsi-fix-scrolling-of-panel-with-small-h.patch @@ -0,0 +1,46 @@ +From 47f9f86bdfc3df6e09e085cf765364b4f7c4a4de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 21:06:40 +0800 +Subject: drm/mediatek: dsi: Fix scrolling of panel with small hfp or hbp + +From: Jitao Shi + +[ Upstream commit 35bf948f1edbf507f6e57e0879fa6ea36d2d2930 ] + +horizontal_backporch_byte should be hbp * bpp - hbp extra bytes. +So remove the wrong subtraction 10. + +Fixes: 7a5bc4e22ecf ("drm/mediatek: change the dsi phytiming calculate method") +Signed-off-by: Jitao Shi +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_dsi.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_dsi.c b/drivers/gpu/drm/mediatek/mtk_dsi.c +index 02ac55c13a80b..ee011a0633841 100644 +--- a/drivers/gpu/drm/mediatek/mtk_dsi.c ++++ b/drivers/gpu/drm/mediatek/mtk_dsi.c +@@ -470,14 +470,13 @@ static void mtk_dsi_config_vdo_timing(struct mtk_dsi *dsi) + horizontal_sync_active_byte = (vm->hsync_len * dsi_tmp_buf_bpp - 10); + + if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_SYNC_PULSE) +- horizontal_backporch_byte = +- (vm->hback_porch * dsi_tmp_buf_bpp - 10); ++ horizontal_backporch_byte = vm->hback_porch * dsi_tmp_buf_bpp; + else +- horizontal_backporch_byte = ((vm->hback_porch + vm->hsync_len) * +- dsi_tmp_buf_bpp - 10); ++ horizontal_backporch_byte = (vm->hback_porch + vm->hsync_len) * ++ dsi_tmp_buf_bpp; + + data_phy_cycles = timing->lpx + timing->da_hs_prepare + +- timing->da_hs_zero + timing->da_hs_exit + 3; ++ timing->da_hs_zero + timing->da_hs_exit; + + if (dsi->mode_flags & MIPI_DSI_MODE_VIDEO_BURST) { + if ((vm->hfront_porch + vm->hback_porch) * dsi_tmp_buf_bpp > +-- +2.25.1 + diff --git a/queue-5.8/drm-mediatek-use-cpu-when-fail-to-get-cmdq-event.patch b/queue-5.8/drm-mediatek-use-cpu-when-fail-to-get-cmdq-event.patch new file mode 100644 index 00000000000..cc8515f0613 --- /dev/null +++ b/queue-5.8/drm-mediatek-use-cpu-when-fail-to-get-cmdq-event.patch @@ -0,0 +1,53 @@ +From 7a4a204c49f56c50ca3106391f5570438fdc1e6a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 07:39:52 +0800 +Subject: drm/mediatek: Use CPU when fail to get cmdq event + +From: Chun-Kuang Hu + +[ Upstream commit f85acdad07fe36b91f2244263a890bf372528326 ] + +Even though cmdq client is created successfully, without the cmdq event, +cmdq could not work correctly, so use CPU when fail to get cmdq event. + +Fixes: 60fa8c13ab1a ("drm/mediatek: Move gce event property to mutex device node") +Signed-off-by: Chun-Kuang Hu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_drm_crtc.c | 20 +++++++++++++------- + 1 file changed, 13 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +index 7cd8f415fd029..d8b43500f12d1 100644 +--- a/drivers/gpu/drm/mediatek/mtk_drm_crtc.c ++++ b/drivers/gpu/drm/mediatek/mtk_drm_crtc.c +@@ -834,13 +834,19 @@ int mtk_drm_crtc_create(struct drm_device *drm_dev, + drm_crtc_index(&mtk_crtc->base)); + mtk_crtc->cmdq_client = NULL; + } +- ret = of_property_read_u32_index(priv->mutex_node, +- "mediatek,gce-events", +- drm_crtc_index(&mtk_crtc->base), +- &mtk_crtc->cmdq_event); +- if (ret) +- dev_dbg(dev, "mtk_crtc %d failed to get mediatek,gce-events property\n", +- drm_crtc_index(&mtk_crtc->base)); ++ ++ if (mtk_crtc->cmdq_client) { ++ ret = of_property_read_u32_index(priv->mutex_node, ++ "mediatek,gce-events", ++ drm_crtc_index(&mtk_crtc->base), ++ &mtk_crtc->cmdq_event); ++ if (ret) { ++ dev_dbg(dev, "mtk_crtc %d failed to get mediatek,gce-events property\n", ++ drm_crtc_index(&mtk_crtc->base)); ++ cmdq_mbox_destroy(mtk_crtc->cmdq_client); ++ mtk_crtc->cmdq_client = NULL; ++ } ++ } + #endif + return 0; + } +-- +2.25.1 + diff --git a/queue-5.8/efi-efibc-check-for-efivars-write-capability.patch b/queue-5.8/efi-efibc-check-for-efivars-write-capability.patch new file mode 100644 index 00000000000..b37567d9344 --- /dev/null +++ b/queue-5.8/efi-efibc-check-for-efivars-write-capability.patch @@ -0,0 +1,46 @@ +From 2d4def74f0d574d6e23fe3399bf800cfe41678e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 18:12:09 +0300 +Subject: efi: efibc: check for efivars write capability + +From: Ard Biesheuvel + +[ Upstream commit 46908326c6b801201f1e46f5ed0db6e85bef74ae ] + +Branden reports that commit + + f88814cc2578c1 ("efi/efivars: Expose RT service availability via efivars abstraction") + +regresses UEFI platforms that implement GetVariable but not SetVariable +when booting kernels that have EFIBC (bootloader control) enabled. + +The reason is that EFIBC is a user of the efivars abstraction, which was +updated to permit users that rely only on the read capability, but not on +the write capability. EFIBC is in the latter category, so it has to check +explicitly whether efivars supports writes. + +Fixes: f88814cc2578c1 ("efi/efivars: Expose RT service availability via efivars abstraction") +Tested-by: Branden Sherrell +Link: https://lore.kernel.org/linux-efi/AE217103-C96F-4AFC-8417-83EC11962004@gmail.com/ +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + drivers/firmware/efi/efibc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/efi/efibc.c b/drivers/firmware/efi/efibc.c +index 35dccc88ac0af..15a47539dc563 100644 +--- a/drivers/firmware/efi/efibc.c ++++ b/drivers/firmware/efi/efibc.c +@@ -84,7 +84,7 @@ static int __init efibc_init(void) + { + int ret; + +- if (!efi_enabled(EFI_RUNTIME_SERVICES)) ++ if (!efivars_kobject() || !efivar_supports_writes()) + return -ENODEV; + + ret = register_reboot_notifier(&efibc_reboot_notifier); +-- +2.25.1 + diff --git a/queue-5.8/f2fs-fix-indefinite-loop-scanning-for-free-nid.patch b/queue-5.8/f2fs-fix-indefinite-loop-scanning-for-free-nid.patch new file mode 100644 index 00000000000..683715d9a2a --- /dev/null +++ b/queue-5.8/f2fs-fix-indefinite-loop-scanning-for-free-nid.patch @@ -0,0 +1,48 @@ +From d7e20bb537e404b15e0b85d6b16ca0b1777e7cef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Aug 2020 15:40:14 +0530 +Subject: f2fs: fix indefinite loop scanning for free nid + +From: Sahitya Tummala + +[ Upstream commit e2cab031ba7b5003cd12185b3ef38f1a75e3dae8 ] + +If the sbi->ckpt->next_free_nid is not NAT block aligned and if there +are free nids in that NAT block between the start of the block and +next_free_nid, then those free nids will not be scanned in scan_nat_page(). +This results into mismatch between nm_i->available_nids and the sum of +nm_i->free_nid_count of all NAT blocks scanned. And nm_i->available_nids +will always be greater than the sum of free nids in all the blocks. +Under this condition, if we use all the currently scanned free nids, +then it will loop forever in f2fs_alloc_nid() as nm_i->available_nids +is still not zero but nm_i->free_nid_count of that partially scanned +NAT block is zero. + +Fix this to align the nm_i->next_scan_nid to the first nid of the +corresponding NAT block. + +Signed-off-by: Sahitya Tummala +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 98736d0598b8d..0fde35611df18 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -2375,6 +2375,9 @@ static int __f2fs_build_free_nids(struct f2fs_sb_info *sbi, + if (unlikely(nid >= nm_i->max_nid)) + nid = 0; + ++ if (unlikely(nid % NAT_ENTRY_PER_BLOCK)) ++ nid = NAT_BLOCK_OFFSET(nid) * NAT_ENTRY_PER_BLOCK; ++ + /* Enough entries */ + if (nm_i->nid_cnt[FREE_NID] >= NAT_ENTRY_PER_BLOCK) + return 0; +-- +2.25.1 + diff --git a/queue-5.8/f2fs-return-eof-on-unaligned-end-of-file-dio-read.patch b/queue-5.8/f2fs-return-eof-on-unaligned-end-of-file-dio-read.patch new file mode 100644 index 00000000000..8c07d5d2635 --- /dev/null +++ b/queue-5.8/f2fs-return-eof-on-unaligned-end-of-file-dio-read.patch @@ -0,0 +1,56 @@ +From 9f1f16023adb55e884834171341c4c639c7e7093 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 16:07:31 -0400 +Subject: f2fs: Return EOF on unaligned end of file DIO read + +From: Gabriel Krisman Bertazi + +[ Upstream commit 20d0a107fb35f37578b919f62bd474d6d358d579 ] + +Reading past end of file returns EOF for aligned reads but -EINVAL for +unaligned reads on f2fs. While documentation is not strict about this +corner case, most filesystem returns EOF on this case, like iomap +filesystems. This patch consolidates the behavior for f2fs, by making +it return EOF(0). + +it can be verified by a read loop on a file that does a partial read +before EOF (A file that doesn't end at an aligned address). The +following code fails on an unaligned file on f2fs, but not on +btrfs, ext4, and xfs. + + while (done < total) { + ssize_t delta = pread(fd, buf + done, total - done, off + done); + if (!delta) + break; + ... + } + +It is arguable whether filesystems should actually return EOF or +-EINVAL, but since iomap filesystems support it, and so does the +original DIO code, it seems reasonable to consolidate on that. + +Signed-off-by: Gabriel Krisman Bertazi +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 6e9017e6a8197..403e8033c974b 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -3463,6 +3463,9 @@ static int check_direct_IO(struct inode *inode, struct iov_iter *iter, + unsigned long align = offset | iov_iter_alignment(iter); + struct block_device *bdev = inode->i_sb->s_bdev; + ++ if (iov_iter_rw(iter) == READ && offset >= i_size_read(inode)) ++ return 1; ++ + if (align & blocksize_mask) { + if (bdev) + blkbits = blksize_bits(bdev_logical_block_size(bdev)); +-- +2.25.1 + diff --git a/queue-5.8/fbcon-fix-user-font-detection-test-at-fbcon_resize.patch b/queue-5.8/fbcon-fix-user-font-detection-test-at-fbcon_resize.patch new file mode 100644 index 00000000000..278960a27ea --- /dev/null +++ b/queue-5.8/fbcon-fix-user-font-detection-test-at-fbcon_resize.patch @@ -0,0 +1,52 @@ +From 42da9fb47d75151c16dfef8dde2858c050a8f6e1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 07:57:06 +0900 +Subject: fbcon: Fix user font detection test at fbcon_resize(). + +From: Tetsuo Handa + +[ Upstream commit ec0972adecb391a8d8650832263a4790f3bfb4df ] + +syzbot is reporting OOB read at fbcon_resize() [1], for +commit 39b3cffb8cf31117 ("fbcon: prevent user font height or width change + from causing potential out-of-bounds access") is by error using +registered_fb[con2fb_map[vc->vc_num]]->fbcon_par->p->userfont (which was +set to non-zero) instead of fb_display[vc->vc_num].userfont (which remains +zero for that display). + +We could remove tricky userfont flag [2], for we can determine it by +comparing address of the font data and addresses of built-in font data. +But since that commit is failing to fix the original OOB read [3], this +patch keeps the change minimal in case we decide to revert altogether. + +[1] https://syzkaller.appspot.com/bug?id=ebcbbb6576958a496500fee9cf7aa83ea00b5920 +[2] https://syzkaller.appspot.com/text?tag=Patch&x=14030853900000 +[3] https://syzkaller.appspot.com/bug?id=6fba8c186d97cf1011ab17660e633b1cc4e080c9 + +Reported-by: syzbot +Signed-off-by: Tetsuo Handa +Fixes: 39b3cffb8cf31117 ("fbcon: prevent user font height or width change from causing potential out-of-bounds access") +Cc: George Kennedy +Link: https://lore.kernel.org/r/f6e3e611-8704-1263-d163-f52c906a4f06@I-love.SAKURA.ne.jp +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/core/fbcon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c +index b36bfe10c712c..09cb46e94f405 100644 +--- a/drivers/video/fbdev/core/fbcon.c ++++ b/drivers/video/fbdev/core/fbcon.c +@@ -2018,7 +2018,7 @@ static int fbcon_resize(struct vc_data *vc, unsigned int width, + struct fb_var_screeninfo var = info->var; + int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh; + +- if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) { ++ if (p->userfont && FNTSIZE(vc->vc_font.data)) { + int size; + int pitch = PITCH(vc->vc_font.width); + +-- +2.25.1 + diff --git a/queue-5.8/habanalabs-fix-report-of-razwi-initiator-coordinates.patch b/queue-5.8/habanalabs-fix-report-of-razwi-initiator-coordinates.patch new file mode 100644 index 00000000000..4b23eb77577 --- /dev/null +++ b/queue-5.8/habanalabs-fix-report-of-razwi-initiator-coordinates.patch @@ -0,0 +1,76 @@ +From 0e8e9938a0862ab839be433a250956084c6271d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Aug 2020 17:34:26 +0300 +Subject: habanalabs: fix report of RAZWI initiator coordinates + +From: Ofir Bitton + +[ Upstream commit 69c6e18d0ce9980c8c6708f1fdb4ba843f8df172 ] + +All initiator coordinates received upon an 'MMU page fault RAZWI +event' should be the routers coordinates, the only exception is the +DMA initiators for which the reported coordinates correspond to +their actual location. + +Signed-off-by: Ofir Bitton +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + .../habanalabs/include/gaudi/gaudi_masks.h | 32 +++++++++---------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/misc/habanalabs/include/gaudi/gaudi_masks.h b/drivers/misc/habanalabs/include/gaudi/gaudi_masks.h +index 96f08050ef0fb..6c50f015eda47 100644 +--- a/drivers/misc/habanalabs/include/gaudi/gaudi_masks.h ++++ b/drivers/misc/habanalabs/include/gaudi/gaudi_masks.h +@@ -378,15 +378,15 @@ enum axi_id { + ((((y) & RAZWI_INITIATOR_Y_MASK) << RAZWI_INITIATOR_Y_SHIFT) | \ + (((x) & RAZWI_INITIATOR_X_MASK) << RAZWI_INITIATOR_X_SHIFT)) + +-#define RAZWI_INITIATOR_ID_X_Y_TPC0_NIC0 RAZWI_INITIATOR_ID_X_Y(1, 0) +-#define RAZWI_INITIATOR_ID_X_Y_TPC1 RAZWI_INITIATOR_ID_X_Y(2, 0) +-#define RAZWI_INITIATOR_ID_X_Y_MME0_0 RAZWI_INITIATOR_ID_X_Y(3, 0) +-#define RAZWI_INITIATOR_ID_X_Y_MME0_1 RAZWI_INITIATOR_ID_X_Y(4, 0) +-#define RAZWI_INITIATOR_ID_X_Y_MME1_0 RAZWI_INITIATOR_ID_X_Y(5, 0) +-#define RAZWI_INITIATOR_ID_X_Y_MME1_1 RAZWI_INITIATOR_ID_X_Y(6, 0) +-#define RAZWI_INITIATOR_ID_X_Y_TPC2 RAZWI_INITIATOR_ID_X_Y(7, 0) ++#define RAZWI_INITIATOR_ID_X_Y_TPC0_NIC0 RAZWI_INITIATOR_ID_X_Y(1, 1) ++#define RAZWI_INITIATOR_ID_X_Y_TPC1 RAZWI_INITIATOR_ID_X_Y(2, 1) ++#define RAZWI_INITIATOR_ID_X_Y_MME0_0 RAZWI_INITIATOR_ID_X_Y(3, 1) ++#define RAZWI_INITIATOR_ID_X_Y_MME0_1 RAZWI_INITIATOR_ID_X_Y(4, 1) ++#define RAZWI_INITIATOR_ID_X_Y_MME1_0 RAZWI_INITIATOR_ID_X_Y(5, 1) ++#define RAZWI_INITIATOR_ID_X_Y_MME1_1 RAZWI_INITIATOR_ID_X_Y(6, 1) ++#define RAZWI_INITIATOR_ID_X_Y_TPC2 RAZWI_INITIATOR_ID_X_Y(7, 1) + #define RAZWI_INITIATOR_ID_X_Y_TPC3_PCI_CPU_PSOC \ +- RAZWI_INITIATOR_ID_X_Y(8, 0) ++ RAZWI_INITIATOR_ID_X_Y(8, 1) + #define RAZWI_INITIATOR_ID_X_Y_DMA_IF_W_S_0 RAZWI_INITIATOR_ID_X_Y(0, 1) + #define RAZWI_INITIATOR_ID_X_Y_DMA_IF_E_S_0 RAZWI_INITIATOR_ID_X_Y(9, 1) + #define RAZWI_INITIATOR_ID_X_Y_DMA_IF_W_S_1 RAZWI_INITIATOR_ID_X_Y(0, 2) +@@ -395,14 +395,14 @@ enum axi_id { + #define RAZWI_INITIATOR_ID_X_Y_DMA_IF_E_N_0 RAZWI_INITIATOR_ID_X_Y(9, 3) + #define RAZWI_INITIATOR_ID_X_Y_DMA_IF_W_N_1 RAZWI_INITIATOR_ID_X_Y(0, 4) + #define RAZWI_INITIATOR_ID_X_Y_DMA_IF_E_N_1 RAZWI_INITIATOR_ID_X_Y(9, 4) +-#define RAZWI_INITIATOR_ID_X_Y_TPC4_NIC1_NIC2 RAZWI_INITIATOR_ID_X_Y(1, 5) +-#define RAZWI_INITIATOR_ID_X_Y_TPC5 RAZWI_INITIATOR_ID_X_Y(2, 5) +-#define RAZWI_INITIATOR_ID_X_Y_MME2_0 RAZWI_INITIATOR_ID_X_Y(3, 5) +-#define RAZWI_INITIATOR_ID_X_Y_MME2_1 RAZWI_INITIATOR_ID_X_Y(4, 5) +-#define RAZWI_INITIATOR_ID_X_Y_MME3_0 RAZWI_INITIATOR_ID_X_Y(5, 5) +-#define RAZWI_INITIATOR_ID_X_Y_MME3_1 RAZWI_INITIATOR_ID_X_Y(6, 5) +-#define RAZWI_INITIATOR_ID_X_Y_TPC6 RAZWI_INITIATOR_ID_X_Y(7, 5) +-#define RAZWI_INITIATOR_ID_X_Y_TPC7_NIC4_NIC5 RAZWI_INITIATOR_ID_X_Y(8, 5) ++#define RAZWI_INITIATOR_ID_X_Y_TPC4_NIC1_NIC2 RAZWI_INITIATOR_ID_X_Y(1, 6) ++#define RAZWI_INITIATOR_ID_X_Y_TPC5 RAZWI_INITIATOR_ID_X_Y(2, 6) ++#define RAZWI_INITIATOR_ID_X_Y_MME2_0 RAZWI_INITIATOR_ID_X_Y(3, 6) ++#define RAZWI_INITIATOR_ID_X_Y_MME2_1 RAZWI_INITIATOR_ID_X_Y(4, 6) ++#define RAZWI_INITIATOR_ID_X_Y_MME3_0 RAZWI_INITIATOR_ID_X_Y(5, 6) ++#define RAZWI_INITIATOR_ID_X_Y_MME3_1 RAZWI_INITIATOR_ID_X_Y(6, 6) ++#define RAZWI_INITIATOR_ID_X_Y_TPC6 RAZWI_INITIATOR_ID_X_Y(7, 6) ++#define RAZWI_INITIATOR_ID_X_Y_TPC7_NIC4_NIC5 RAZWI_INITIATOR_ID_X_Y(8, 6) + + #define PSOC_ETR_AXICTL_PROTCTRLBIT1_SHIFT 1 + +-- +2.25.1 + diff --git a/queue-5.8/habanalabs-prevent-user-buff-overflow.patch b/queue-5.8/habanalabs-prevent-user-buff-overflow.patch new file mode 100644 index 00000000000..7a1aa319331 --- /dev/null +++ b/queue-5.8/habanalabs-prevent-user-buff-overflow.patch @@ -0,0 +1,37 @@ +From 618fa3da132a6e9b4adc3cadfe4af3af4c51c8b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Aug 2020 17:40:33 +0300 +Subject: habanalabs: prevent user buff overflow + +From: Moti Haimovski + +[ Upstream commit 6396feabf7a4104a4ddfecc00b8aac535c631a66 ] + +This commit fixes a potential debugfs issue that may occur when +reading the clock gating mask into the user buffer since the +user buffer size was not taken into consideration. + +Signed-off-by: Moti Haimovski +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/misc/habanalabs/debugfs.c b/drivers/misc/habanalabs/debugfs.c +index 6c2b9cf45e831..650922061bdc7 100644 +--- a/drivers/misc/habanalabs/debugfs.c ++++ b/drivers/misc/habanalabs/debugfs.c +@@ -982,7 +982,7 @@ static ssize_t hl_clk_gate_read(struct file *f, char __user *buf, + return 0; + + sprintf(tmp_buf, "0x%llx\n", hdev->clock_gating_mask); +- rc = simple_read_from_buffer(buf, strlen(tmp_buf) + 1, ppos, tmp_buf, ++ rc = simple_read_from_buffer(buf, count, ppos, tmp_buf, + strlen(tmp_buf) + 1); + + return rc; +-- +2.25.1 + diff --git a/queue-5.8/i2c-algo-pca-reapply-i2c-bus-settings-after-reset.patch b/queue-5.8/i2c-algo-pca-reapply-i2c-bus-settings-after-reset.patch new file mode 100644 index 00000000000..fa176e2e619 --- /dev/null +++ b/queue-5.8/i2c-algo-pca-reapply-i2c-bus-settings-after-reset.patch @@ -0,0 +1,131 @@ +From 419f3616054186380c07b65c378e55bcc26d173f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 08:32:47 +1200 +Subject: i2c: algo: pca: Reapply i2c bus settings after reset + +From: Evan Nimmo + +[ Upstream commit 0a355aeb24081e4538d4d424cd189f16c0bbd983 ] + +If something goes wrong (such as the SCL being stuck low) then we need +to reset the PCA chip. The issue with this is that on reset we lose all +config settings and the chip ends up in a disabled state which results +in a lock up/high CPU usage. We need to re-apply any configuration that +had previously been set and re-enable the chip. + +Signed-off-by: Evan Nimmo +Reviewed-by: Chris Packham +Reviewed-by: Andy Shevchenko +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/algos/i2c-algo-pca.c | 35 +++++++++++++++++++++----------- + include/linux/i2c-algo-pca.h | 15 ++++++++++++++ + 2 files changed, 38 insertions(+), 12 deletions(-) + +diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c +index 388978775be04..edc6985c696f0 100644 +--- a/drivers/i2c/algos/i2c-algo-pca.c ++++ b/drivers/i2c/algos/i2c-algo-pca.c +@@ -41,8 +41,22 @@ static void pca_reset(struct i2c_algo_pca_data *adap) + pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_IPRESET); + pca_outw(adap, I2C_PCA_IND, 0xA5); + pca_outw(adap, I2C_PCA_IND, 0x5A); ++ ++ /* ++ * After a reset we need to re-apply any configuration ++ * (calculated in pca_init) to get the bus in a working state. ++ */ ++ pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_IMODE); ++ pca_outw(adap, I2C_PCA_IND, adap->bus_settings.mode); ++ pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_ISCLL); ++ pca_outw(adap, I2C_PCA_IND, adap->bus_settings.tlow); ++ pca_outw(adap, I2C_PCA_INDPTR, I2C_PCA_ISCLH); ++ pca_outw(adap, I2C_PCA_IND, adap->bus_settings.thi); ++ ++ pca_set_con(adap, I2C_PCA_CON_ENSIO); + } else { + adap->reset_chip(adap->data); ++ pca_set_con(adap, I2C_PCA_CON_ENSIO | adap->bus_settings.clock_freq); + } + } + +@@ -423,13 +437,14 @@ static int pca_init(struct i2c_adapter *adap) + " Use the nominal frequency.\n", adap->name); + } + +- pca_reset(pca_data); +- + clock = pca_clock(pca_data); + printk(KERN_INFO "%s: Clock frequency is %dkHz\n", + adap->name, freqs[clock]); + +- pca_set_con(pca_data, I2C_PCA_CON_ENSIO | clock); ++ /* Store settings as these will be needed when the PCA chip is reset */ ++ pca_data->bus_settings.clock_freq = clock; ++ ++ pca_reset(pca_data); + } else { + int clock; + int mode; +@@ -496,19 +511,15 @@ static int pca_init(struct i2c_adapter *adap) + thi = tlow * min_thi / min_tlow; + } + ++ /* Store settings as these will be needed when the PCA chip is reset */ ++ pca_data->bus_settings.mode = mode; ++ pca_data->bus_settings.tlow = tlow; ++ pca_data->bus_settings.thi = thi; ++ + pca_reset(pca_data); + + printk(KERN_INFO + "%s: Clock frequency is %dHz\n", adap->name, clock * 100); +- +- pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_IMODE); +- pca_outw(pca_data, I2C_PCA_IND, mode); +- pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_ISCLL); +- pca_outw(pca_data, I2C_PCA_IND, tlow); +- pca_outw(pca_data, I2C_PCA_INDPTR, I2C_PCA_ISCLH); +- pca_outw(pca_data, I2C_PCA_IND, thi); +- +- pca_set_con(pca_data, I2C_PCA_CON_ENSIO); + } + udelay(500); /* 500 us for oscillator to stabilise */ + +diff --git a/include/linux/i2c-algo-pca.h b/include/linux/i2c-algo-pca.h +index d03071732db4a..7c522fdd9ea73 100644 +--- a/include/linux/i2c-algo-pca.h ++++ b/include/linux/i2c-algo-pca.h +@@ -53,6 +53,20 @@ + #define I2C_PCA_CON_SI 0x08 /* Serial Interrupt */ + #define I2C_PCA_CON_CR 0x07 /* Clock Rate (MASK) */ + ++/** ++ * struct pca_i2c_bus_settings - The configured PCA i2c bus settings ++ * @mode: Configured i2c bus mode ++ * @tlow: Configured SCL LOW period ++ * @thi: Configured SCL HIGH period ++ * @clock_freq: The configured clock frequency ++ */ ++struct pca_i2c_bus_settings { ++ int mode; ++ int tlow; ++ int thi; ++ int clock_freq; ++}; ++ + struct i2c_algo_pca_data { + void *data; /* private low level data */ + void (*write_byte) (void *data, int reg, int val); +@@ -64,6 +78,7 @@ struct i2c_algo_pca_data { + * For PCA9665, use the frequency you want here. */ + unsigned int i2c_clock; + unsigned int chip; ++ struct pca_i2c_bus_settings bus_settings; + }; + + int i2c_pca_add_bus(struct i2c_adapter *); +-- +2.25.1 + diff --git a/queue-5.8/i2c-mediatek-fix-generic-definitions-for-bus-frequen.patch b/queue-5.8/i2c-mediatek-fix-generic-definitions-for-bus-frequen.patch new file mode 100644 index 00000000000..354427fe0fd --- /dev/null +++ b/queue-5.8/i2c-mediatek-fix-generic-definitions-for-bus-frequen.patch @@ -0,0 +1,41 @@ +From 2e4b8377dfdb636c7dac76caf2f60cbd2e95aab9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 19:55:41 +0800 +Subject: i2c: mediatek: Fix generic definitions for bus frequency + +From: Qii Wang + +[ Upstream commit ff6f3aff46beb3c29e0802cffcc559e1756c4814 ] + +The max frequency of mediatek i2c controller driver is +I2C_MAX_HIGH_SPEED_MODE_FREQ, not I2C_MAX_FAST_MODE_PLUS_FREQ. +Fix it. + +Fixes: 90224e6468e1 ("i2c: drivers: Use generic definitions for bus frequencies") +Reviewed-by: Yingjoe Chen +Reviewed-by: Andy Shevchenko +Signed-off-by: Qii Wang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index deef69e569062..b099139cbb91e 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -658,8 +658,8 @@ static int mtk_i2c_calculate_speed(struct mtk_i2c *i2c, unsigned int clk_src, + unsigned int cnt_mul; + int ret = -EINVAL; + +- if (target_speed > I2C_MAX_FAST_MODE_PLUS_FREQ) +- target_speed = I2C_MAX_FAST_MODE_PLUS_FREQ; ++ if (target_speed > I2C_MAX_HIGH_SPEED_MODE_FREQ) ++ target_speed = I2C_MAX_HIGH_SPEED_MODE_FREQ; + + max_step_cnt = mtk_i2c_max_step_cnt(target_speed); + base_step_cnt = max_step_cnt; +-- +2.25.1 + diff --git a/queue-5.8/i2c-mxs-use-mxs_dma_ctrl_wait4end-instead-of-dma_ctr.patch b/queue-5.8/i2c-mxs-use-mxs_dma_ctrl_wait4end-instead-of-dma_ctr.patch new file mode 100644 index 00000000000..efdd99d113d --- /dev/null +++ b/queue-5.8/i2c-mxs-use-mxs_dma_ctrl_wait4end-instead-of-dma_ctr.patch @@ -0,0 +1,68 @@ +From cc3ea881d13b1bbfcbe0ac60ec50cfd7950651d9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 17:01:39 +0200 +Subject: i2c: mxs: use MXS_DMA_CTRL_WAIT4END instead of DMA_CTRL_ACK + +From: Matthias Schiffer + +[ Upstream commit 6eb158ec0a45dbfd98bc6971c461b7d4d5bf61b3 ] + +The driver-specific usage of the DMA_CTRL_ACK flag was replaced with a +custom flag in commit ceeeb99cd821 ("dmaengine: mxs: rename custom flag"), +but i2c-mxs was not updated to use the new flag, completely breaking I2C +transactions using DMA. + +Fixes: ceeeb99cd821 ("dmaengine: mxs: rename custom flag") +Signed-off-by: Matthias Schiffer +Reviewed-by: Fabio Estevam +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mxs.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c +index 9587347447f0f..c4b08a9244614 100644 +--- a/drivers/i2c/busses/i2c-mxs.c ++++ b/drivers/i2c/busses/i2c-mxs.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + #define DRIVER_NAME "mxs-i2c" + +@@ -200,7 +201,8 @@ static int mxs_i2c_dma_setup_xfer(struct i2c_adapter *adap, + dma_map_sg(i2c->dev, &i2c->sg_io[0], 1, DMA_TO_DEVICE); + desc = dmaengine_prep_slave_sg(i2c->dmach, &i2c->sg_io[0], 1, + DMA_MEM_TO_DEV, +- DMA_PREP_INTERRUPT | DMA_CTRL_ACK); ++ DMA_PREP_INTERRUPT | ++ MXS_DMA_CTRL_WAIT4END); + if (!desc) { + dev_err(i2c->dev, + "Failed to get DMA data write descriptor.\n"); +@@ -228,7 +230,8 @@ static int mxs_i2c_dma_setup_xfer(struct i2c_adapter *adap, + dma_map_sg(i2c->dev, &i2c->sg_io[1], 1, DMA_FROM_DEVICE); + desc = dmaengine_prep_slave_sg(i2c->dmach, &i2c->sg_io[1], 1, + DMA_DEV_TO_MEM, +- DMA_PREP_INTERRUPT | DMA_CTRL_ACK); ++ DMA_PREP_INTERRUPT | ++ MXS_DMA_CTRL_WAIT4END); + if (!desc) { + dev_err(i2c->dev, + "Failed to get DMA data write descriptor.\n"); +@@ -260,7 +263,8 @@ static int mxs_i2c_dma_setup_xfer(struct i2c_adapter *adap, + dma_map_sg(i2c->dev, i2c->sg_io, 2, DMA_TO_DEVICE); + desc = dmaengine_prep_slave_sg(i2c->dmach, i2c->sg_io, 2, + DMA_MEM_TO_DEV, +- DMA_PREP_INTERRUPT | DMA_CTRL_ACK); ++ DMA_PREP_INTERRUPT | ++ MXS_DMA_CTRL_WAIT4END); + if (!desc) { + dev_err(i2c->dev, + "Failed to get DMA data write descriptor.\n"); +-- +2.25.1 + diff --git a/queue-5.8/interconnect-show-bandwidth-for-disabled-paths-as-ze.patch b/queue-5.8/interconnect-show-bandwidth-for-disabled-paths-as-ze.patch new file mode 100644 index 00000000000..b1484553959 --- /dev/null +++ b/queue-5.8/interconnect-show-bandwidth-for-disabled-paths-as-ze.patch @@ -0,0 +1,51 @@ +From 0bc449f3b738a6fbe4abfeba2f343bcdc21c4d31 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jul 2020 10:50:12 -0700 +Subject: interconnect: Show bandwidth for disabled paths as zero in debugfs + +From: Matthias Kaehlcke + +[ Upstream commit b1910c6b9983817160e04d4e87b2dc1413c5361a ] + +For disabled paths the 'interconnect_summary' in debugfs currently shows +the orginally requested bandwidths. This is confusing, since the bandwidth +requests aren't active. Instead show the bandwidths for disabled +paths/requests as zero. + +Signed-off-by: Matthias Kaehlcke +Reviewed-by: Evan Green +Link: https://lore.kernel.org/r/20200729104933.1.If8e80e4c0c7ddf99056f6e726e59505ed4e127f3@changeid +Signed-off-by: Georgi Djakov +Signed-off-by: Sasha Levin +--- + drivers/interconnect/core.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c +index 9e1ab701785c7..0162a9af93237 100644 +--- a/drivers/interconnect/core.c ++++ b/drivers/interconnect/core.c +@@ -55,12 +55,18 @@ static int icc_summary_show(struct seq_file *s, void *data) + + icc_summary_show_one(s, n); + hlist_for_each_entry(r, &n->req_list, req_node) { ++ u32 avg_bw = 0, peak_bw = 0; ++ + if (!r->dev) + continue; + ++ if (r->enabled) { ++ avg_bw = r->avg_bw; ++ peak_bw = r->peak_bw; ++ } ++ + seq_printf(s, " %-27s %12u %12u %12u\n", +- dev_name(r->dev), r->tag, r->avg_bw, +- r->peak_bw); ++ dev_name(r->dev), r->tag, avg_bw, peak_bw); + } + } + } +-- +2.25.1 + diff --git a/queue-5.8/iommu-amd-fix-potential-entry-null-deref.patch b/queue-5.8/iommu-amd-fix-potential-entry-null-deref.patch new file mode 100644 index 00000000000..9c785082377 --- /dev/null +++ b/queue-5.8/iommu-amd-fix-potential-entry-null-deref.patch @@ -0,0 +1,53 @@ +From c2ac38fd0306d83c0a333d0b8daabaacb16423d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 18:16:21 +0100 +Subject: iommu/amd: Fix potential @entry null deref + +From: Joao Martins + +[ Upstream commit 14c4acc5ed22c21f9821103be7c48efdf9763584 ] + +After commit 26e495f34107 ("iommu/amd: Restore IRTE.RemapEn bit after +programming IRTE"), smatch warns: + + drivers/iommu/amd/iommu.c:3870 amd_iommu_deactivate_guest_mode() + warn: variable dereferenced before check 'entry' (see line 3867) + +Fix this by moving the @valid assignment to after @entry has been checked +for NULL. + +Fixes: 26e495f34107 ("iommu/amd: Restore IRTE.RemapEn bit after programming IRTE") +Reported-by: Dan Carpenter +Signed-off-by: Joao Martins +Reviewed-by: Suravee Suthikulpanit +Cc: Suravee Suthikulpanit +Link: https://lore.kernel.org/r/20200910171621.12879-1-joao.m.martins@oracle.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 37c74c842f3a3..48fe272da6e9c 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -3855,12 +3855,14 @@ int amd_iommu_deactivate_guest_mode(void *data) + struct amd_ir_data *ir_data = (struct amd_ir_data *)data; + struct irte_ga *entry = (struct irte_ga *) ir_data->entry; + struct irq_cfg *cfg = ir_data->cfg; +- u64 valid = entry->lo.fields_remap.valid; ++ u64 valid; + + if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) || + !entry || !entry->lo.fields_vapic.guest_mode) + return 0; + ++ valid = entry->lo.fields_remap.valid; ++ + entry->lo.val = 0; + entry->hi.val = 0; + +-- +2.25.1 + diff --git a/queue-5.8/iommu-amd-restore-irte.remapen-bit-for-amd_iommu_act.patch b/queue-5.8/iommu-amd-restore-irte.remapen-bit-for-amd_iommu_act.patch new file mode 100644 index 00000000000..e75f2f26efd --- /dev/null +++ b/queue-5.8/iommu-amd-restore-irte.remapen-bit-for-amd_iommu_act.patch @@ -0,0 +1,62 @@ +From 645b0140070e07ce2f7f5533aed3414a1c1b108f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 11:17:20 +0000 +Subject: iommu/amd: Restore IRTE.RemapEn bit for amd_iommu_activate_guest_mode + +From: Suravee Suthikulpanit + +[ Upstream commit e97685abd5d711c885053d4949178f7ab9acbaef ] + +Commit e52d58d54a32 ("iommu/amd: Use cmpxchg_double() when updating +128-bit IRTE") removed an assumption that modify_irte_ga always set +the valid bit, which requires the callers to set the appropriate value +for the struct irte_ga.valid bit before calling the function. + +Similar to the commit 26e495f34107 ("iommu/amd: Restore IRTE.RemapEn +bit after programming IRTE"), which is for the function +amd_iommu_deactivate_guest_mode(). + +The same change is also needed for the amd_iommu_activate_guest_mode(). +Otherwise, this could trigger IO_PAGE_FAULT for the VFIO based VMs with +AVIC enabled. + +Fixes: e52d58d54a321 ("iommu/amd: Use cmpxchg_double() when updating 128-bit IRTE") +Reported-by: Maxim Levitsky +Signed-off-by: Suravee Suthikulpanit +Tested-by: Maxim Levitsky +Reviewed-by: Joao Martins +Reviewed-by: Maxim Levitsky +Cc: Joao Martins +Link: https://lore.kernel.org/r/20200916111720.43913-1-suravee.suthikulpanit@amd.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/iommu.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c +index 48fe272da6e9c..a51dcf26b09f2 100644 +--- a/drivers/iommu/amd/iommu.c ++++ b/drivers/iommu/amd/iommu.c +@@ -3831,14 +3831,18 @@ int amd_iommu_activate_guest_mode(void *data) + { + struct amd_ir_data *ir_data = (struct amd_ir_data *)data; + struct irte_ga *entry = (struct irte_ga *) ir_data->entry; ++ u64 valid; + + if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) || + !entry || entry->lo.fields_vapic.guest_mode) + return 0; + ++ valid = entry->lo.fields_vapic.valid; ++ + entry->lo.val = 0; + entry->hi.val = 0; + ++ entry->lo.fields_vapic.valid = valid; + entry->lo.fields_vapic.guest_mode = 1; + entry->lo.fields_vapic.ga_log_intr = 1; + entry->hi.fields.ga_root_ptr = ir_data->ga_root_ptr; +-- +2.25.1 + diff --git a/queue-5.8/kconfig-qconf-use-delete-instead-of-delete-to-free-a.patch b/queue-5.8/kconfig-qconf-use-delete-instead-of-delete-to-free-a.patch new file mode 100644 index 00000000000..0efc1e06763 --- /dev/null +++ b/queue-5.8/kconfig-qconf-use-delete-instead-of-delete-to-free-a.patch @@ -0,0 +1,50 @@ +From 6c339051501d6ce7e6a766b8fcc93fea13d6efb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 07:16:37 +0900 +Subject: kconfig: qconf: use delete[] instead of delete to free array (again) + +From: Masahiro Yamada + +[ Upstream commit a608b6a646e8816bc0db156baad2e0679fa4d137 ] + +Commit c9b09a9249e6 ("kconfig: qconf: use delete[] instead of delete +to free array") fixed two lines, but there is one more. +(cppcheck does not report it for some reason...) + +This was detected by Clang. + +"make HOSTCXX=clang++ xconfig" reports the following: + +scripts/kconfig/qconf.cc:1279:2: warning: 'delete' applied to a pointer that was allocated with 'new[]'; did you mean 'delete[]'? [-Wmismatched-new-delete] + delete data; + ^ + [] +scripts/kconfig/qconf.cc:1239:15: note: allocated with 'new[]' here + char *data = new char[count + 1]; + ^ + +Fixes: c4f7398bee9c ("kconfig: qconf: make debug links work again") +Fixes: c9b09a9249e6 ("kconfig: qconf: use delete[] instead of delete to free array") +Signed-off-by: Masahiro Yamada +Reviewed-by: Nick Desaulniers +Signed-off-by: Sasha Levin +--- + scripts/kconfig/qconf.cc | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/kconfig/qconf.cc b/scripts/kconfig/qconf.cc +index 5ceb93010a973..aedcc3343719e 100644 +--- a/scripts/kconfig/qconf.cc ++++ b/scripts/kconfig/qconf.cc +@@ -1263,7 +1263,7 @@ void ConfigInfoView::clicked(const QUrl &url) + } + + free(result); +- delete data; ++ delete[] data; + } + + QMenu* ConfigInfoView::createStandardContextMenu(const QPoint & pos) +-- +2.25.1 + diff --git a/queue-5.8/kvm-check-the-allocation-of-pv-cpu-mask.patch b/queue-5.8/kvm-check-the-allocation-of-pv-cpu-mask.patch new file mode 100644 index 00000000000..c76e0f0bf11 --- /dev/null +++ b/queue-5.8/kvm-check-the-allocation-of-pv-cpu-mask.patch @@ -0,0 +1,73 @@ +From 7892a446a898c5917facd424d81daec0869d11ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Sep 2020 19:41:37 +0800 +Subject: KVM: Check the allocation of pv cpu mask + +From: Haiwei Li + +[ Upstream commit 0f990222108d214a0924d920e6095b58107d7b59 ] + +check the allocation of per-cpu __pv_cpu_mask. Initialize ops only when +successful. + +Signed-off-by: Haiwei Li +Message-Id: +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/kvm.c | 22 +++++++++++++++++++--- + 1 file changed, 19 insertions(+), 3 deletions(-) + +diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c +index df63786e7bfa4..d6219f3181d63 100644 +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -638,7 +638,6 @@ static void __init kvm_guest_init(void) + } + + if (pv_tlb_flush_supported()) { +- pv_ops.mmu.flush_tlb_others = kvm_flush_tlb_others; + pv_ops.mmu.tlb_remove_table = tlb_remove_table; + pr_info("KVM setup pv remote TLB flush\n"); + } +@@ -750,6 +749,14 @@ static __init int activate_jump_labels(void) + } + arch_initcall(activate_jump_labels); + ++static void kvm_free_pv_cpu_mask(void) ++{ ++ unsigned int cpu; ++ ++ for_each_possible_cpu(cpu) ++ free_cpumask_var(per_cpu(__pv_cpu_mask, cpu)); ++} ++ + static __init int kvm_alloc_cpumask(void) + { + int cpu; +@@ -768,11 +775,20 @@ static __init int kvm_alloc_cpumask(void) + + if (alloc) + for_each_possible_cpu(cpu) { +- zalloc_cpumask_var_node(per_cpu_ptr(&__pv_cpu_mask, cpu), +- GFP_KERNEL, cpu_to_node(cpu)); ++ if (!zalloc_cpumask_var_node( ++ per_cpu_ptr(&__pv_cpu_mask, cpu), ++ GFP_KERNEL, cpu_to_node(cpu))) { ++ goto zalloc_cpumask_fail; ++ } + } + ++ apic->send_IPI_mask_allbutself = kvm_send_ipi_mask_allbutself; ++ pv_ops.mmu.flush_tlb_others = kvm_flush_tlb_others; + return 0; ++ ++zalloc_cpumask_fail: ++ kvm_free_pv_cpu_mask(); ++ return -ENOMEM; + } + arch_initcall(kvm_alloc_cpumask); + +-- +2.25.1 + diff --git a/queue-5.8/kvm-mips-change-the-definition-of-kvm-type.patch b/queue-5.8/kvm-mips-change-the-definition-of-kvm-type.patch new file mode 100644 index 00000000000..860cf6b5cfe --- /dev/null +++ b/queue-5.8/kvm-mips-change-the-definition-of-kvm-type.patch @@ -0,0 +1,81 @@ +From 33b9665dd27df5e3befc52c15ec4381c442aca28 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Sep 2020 18:33:51 +0800 +Subject: KVM: MIPS: Change the definition of kvm type + +From: Huacai Chen + +[ Upstream commit 15e9e35cd1dec2bc138464de6bf8ef828df19235 ] + +MIPS defines two kvm types: + + #define KVM_VM_MIPS_TE 0 + #define KVM_VM_MIPS_VZ 1 + +In Documentation/virt/kvm/api.rst it is said that "You probably want to +use 0 as machine type", which implies that type 0 be the "automatic" or +"default" type. And, in user-space libvirt use the null-machine (with +type 0) to detect the kvm capability, which returns "KVM not supported" +on a VZ platform. + +I try to fix it in QEMU but it is ugly: +https://lists.nongnu.org/archive/html/qemu-devel/2020-08/msg05629.html + +And Thomas Huth suggests me to change the definition of kvm type: +https://lists.nongnu.org/archive/html/qemu-devel/2020-09/msg03281.html + +So I define like this: + + #define KVM_VM_MIPS_AUTO 0 + #define KVM_VM_MIPS_VZ 1 + #define KVM_VM_MIPS_TE 2 + +Since VZ and TE cannot co-exists, using type 0 on a TE platform will +still return success (so old user-space tools have no problems on new +kernels); the advantage is that using type 0 on a VZ platform will not +return failure. So, the only problem is "new user-space tools use type +2 on old kernels", but if we treat this as a kernel bug, we can backport +this patch to old stable kernels. + +Signed-off-by: Huacai Chen +Message-Id: <1599734031-28746-1-git-send-email-chenhc@lemote.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/mips/kvm/mips.c | 2 ++ + include/uapi/linux/kvm.h | 5 +++-- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c +index 666d3350b4ac1..6c6836669ce16 100644 +--- a/arch/mips/kvm/mips.c ++++ b/arch/mips/kvm/mips.c +@@ -137,6 +137,8 @@ extern void kvm_init_loongson_ipi(struct kvm *kvm); + int kvm_arch_init_vm(struct kvm *kvm, unsigned long type) + { + switch (type) { ++ case KVM_VM_MIPS_AUTO: ++ break; + #ifdef CONFIG_KVM_MIPS_VZ + case KVM_VM_MIPS_VZ: + #else +diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h +index 4fdf303165827..65fd95f9784ce 100644 +--- a/include/uapi/linux/kvm.h ++++ b/include/uapi/linux/kvm.h +@@ -789,9 +789,10 @@ struct kvm_ppc_resize_hpt { + #define KVM_VM_PPC_HV 1 + #define KVM_VM_PPC_PR 2 + +-/* on MIPS, 0 forces trap & emulate, 1 forces VZ ASE */ +-#define KVM_VM_MIPS_TE 0 ++/* on MIPS, 0 indicates auto, 1 forces VZ ASE, 2 forces trap & emulate */ ++#define KVM_VM_MIPS_AUTO 0 + #define KVM_VM_MIPS_VZ 1 ++#define KVM_VM_MIPS_TE 2 + + #define KVM_S390_SIE_PAGE_OFFSET 1 + +-- +2.25.1 + diff --git a/queue-5.8/locking-lockdep-fix-used-in-nmi-inversions.patch b/queue-5.8/locking-lockdep-fix-used-in-nmi-inversions.patch new file mode 100644 index 00000000000..9e7f6789df4 --- /dev/null +++ b/queue-5.8/locking-lockdep-fix-used-in-nmi-inversions.patch @@ -0,0 +1,151 @@ +From 7fc3161647f77922b04ef776e159e9e32c4e8ddf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 18:03:23 +0200 +Subject: locking/lockdep: Fix "USED" <- "IN-NMI" inversions + +From: peterz@infradead.org + +[ Upstream commit 23870f1227680d2aacff6f79c3ab2222bd04e86e ] + +During the LPC RCU BoF Paul asked how come the "USED" <- "IN-NMI" +detector doesn't trip over rcu_read_lock()'s lockdep annotation. + +Looking into this I found a very embarrasing typo in +verify_lock_unused(): + + - if (!(class->usage_mask & LOCK_USED)) + + if (!(class->usage_mask & LOCKF_USED)) + +fixing that will indeed cause rcu_read_lock() to insta-splat :/ + +The above typo means that instead of testing for: 0x100 (1 << +LOCK_USED), we test for 8 (LOCK_USED), which corresponds to (1 << +LOCK_ENABLED_HARDIRQ). + +So instead of testing for _any_ used lock, it will only match any lock +used with interrupts enabled. + +The rcu_read_lock() annotation uses .check=0, which means it will not +set any of the interrupt bits and will thus never match. + +In order to properly fix the situation and allow rcu_read_lock() to +correctly work, split LOCK_USED into LOCK_USED and LOCK_USED_READ and by +having .read users set USED_READ and test USED, pure read-recursive +locks are permitted. + +Fixes: f6f48e180404 ("lockdep: Teach lockdep about "USED" <- "IN-NMI" inversions") +Signed-off-by: Peter Zijlstra (Intel) +Signed-off-by: Ingo Molnar +Tested-by: Masami Hiramatsu +Acked-by: Paul E. McKenney +Link: https://lore.kernel.org/r/20200902160323.GK1362448@hirez.programming.kicks-ass.net +Signed-off-by: Sasha Levin +--- + kernel/locking/lockdep.c | 35 +++++++++++++++++++++++++----- + kernel/locking/lockdep_internals.h | 2 ++ + 2 files changed, 31 insertions(+), 6 deletions(-) + +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index 29a8de4c50b90..a611dedac7d60 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -3923,13 +3923,18 @@ static int separate_irq_context(struct task_struct *curr, + static int mark_lock(struct task_struct *curr, struct held_lock *this, + enum lock_usage_bit new_bit) + { +- unsigned int new_mask = 1 << new_bit, ret = 1; ++ unsigned int old_mask, new_mask, ret = 1; + + if (new_bit >= LOCK_USAGE_STATES) { + DEBUG_LOCKS_WARN_ON(1); + return 0; + } + ++ if (new_bit == LOCK_USED && this->read) ++ new_bit = LOCK_USED_READ; ++ ++ new_mask = 1 << new_bit; ++ + /* + * If already set then do not dirty the cacheline, + * nor do any checks: +@@ -3942,13 +3947,22 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this, + /* + * Make sure we didn't race: + */ +- if (unlikely(hlock_class(this)->usage_mask & new_mask)) { +- graph_unlock(); +- return 1; +- } ++ if (unlikely(hlock_class(this)->usage_mask & new_mask)) ++ goto unlock; + ++ old_mask = hlock_class(this)->usage_mask; + hlock_class(this)->usage_mask |= new_mask; + ++ /* ++ * Save one usage_traces[] entry and map both LOCK_USED and ++ * LOCK_USED_READ onto the same entry. ++ */ ++ if (new_bit == LOCK_USED || new_bit == LOCK_USED_READ) { ++ if (old_mask & (LOCKF_USED | LOCKF_USED_READ)) ++ goto unlock; ++ new_bit = LOCK_USED; ++ } ++ + if (!(hlock_class(this)->usage_traces[new_bit] = save_trace())) + return 0; + +@@ -3962,6 +3976,7 @@ static int mark_lock(struct task_struct *curr, struct held_lock *this, + return 0; + } + ++unlock: + graph_unlock(); + + /* +@@ -4896,12 +4911,20 @@ static void verify_lock_unused(struct lockdep_map *lock, struct held_lock *hlock + { + #ifdef CONFIG_PROVE_LOCKING + struct lock_class *class = look_up_lock_class(lock, subclass); ++ unsigned long mask = LOCKF_USED; + + /* if it doesn't have a class (yet), it certainly hasn't been used yet */ + if (!class) + return; + +- if (!(class->usage_mask & LOCK_USED)) ++ /* ++ * READ locks only conflict with USED, such that if we only ever use ++ * READ locks, there is no deadlock possible -- RCU. ++ */ ++ if (!hlock->read) ++ mask |= LOCKF_USED_READ; ++ ++ if (!(class->usage_mask & mask)) + return; + + hlock->class_idx = class - lock_classes; +diff --git a/kernel/locking/lockdep_internals.h b/kernel/locking/lockdep_internals.h +index baca699b94e91..b0be1560ed17a 100644 +--- a/kernel/locking/lockdep_internals.h ++++ b/kernel/locking/lockdep_internals.h +@@ -19,6 +19,7 @@ enum lock_usage_bit { + #include "lockdep_states.h" + #undef LOCKDEP_STATE + LOCK_USED, ++ LOCK_USED_READ, + LOCK_USAGE_STATES + }; + +@@ -40,6 +41,7 @@ enum { + #include "lockdep_states.h" + #undef LOCKDEP_STATE + __LOCKF(USED) ++ __LOCKF(USED_READ) + }; + + #define LOCKDEP_STATE(__STATE) LOCKF_ENABLED_##__STATE | +-- +2.25.1 + diff --git a/queue-5.8/locking-percpu-rwsem-use-this_cpu_-inc-dec-for-read_.patch b/queue-5.8/locking-percpu-rwsem-use-this_cpu_-inc-dec-for-read_.patch new file mode 100644 index 00000000000..1c14b4df7fc --- /dev/null +++ b/queue-5.8/locking-percpu-rwsem-use-this_cpu_-inc-dec-for-read_.patch @@ -0,0 +1,100 @@ +From 2eb8d04f0d2644e662db0b4ffa256db510234681 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 22:07:50 +0800 +Subject: locking/percpu-rwsem: Use this_cpu_{inc,dec}() for read_count + +From: Hou Tao + +[ Upstream commit e6b1a44eccfcab5e5e280be376f65478c3b2c7a2 ] + +The __this_cpu*() accessors are (in general) IRQ-unsafe which, given +that percpu-rwsem is a blocking primitive, should be just fine. + +However, file_end_write() is used from IRQ context and will cause +load-store issues on architectures where the per-cpu accessors are not +natively irq-safe. + +Fix it by using the IRQ-safe this_cpu_*() for operations on +read_count. This will generate more expensive code on a number of +platforms, which might cause a performance regression for some of the +other percpu-rwsem users. + +If any such is reported, we can consider alternative solutions. + +Fixes: 70fe2f48152e ("aio: fix freeze protection of aio writes") +Signed-off-by: Hou Tao +Signed-off-by: Peter Zijlstra (Intel) +Acked-by: Will Deacon +Acked-by: Oleg Nesterov +Link: https://lkml.kernel.org/r/20200915140750.137881-1-houtao1@huawei.com +Signed-off-by: Sasha Levin +--- + include/linux/percpu-rwsem.h | 8 ++++---- + kernel/locking/percpu-rwsem.c | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/include/linux/percpu-rwsem.h b/include/linux/percpu-rwsem.h +index 5e033fe1ff4e9..5fda40f97fe91 100644 +--- a/include/linux/percpu-rwsem.h ++++ b/include/linux/percpu-rwsem.h +@@ -60,7 +60,7 @@ static inline void percpu_down_read(struct percpu_rw_semaphore *sem) + * anything we did within this RCU-sched read-size critical section. + */ + if (likely(rcu_sync_is_idle(&sem->rss))) +- __this_cpu_inc(*sem->read_count); ++ this_cpu_inc(*sem->read_count); + else + __percpu_down_read(sem, false); /* Unconditional memory barrier */ + /* +@@ -79,7 +79,7 @@ static inline bool percpu_down_read_trylock(struct percpu_rw_semaphore *sem) + * Same as in percpu_down_read(). + */ + if (likely(rcu_sync_is_idle(&sem->rss))) +- __this_cpu_inc(*sem->read_count); ++ this_cpu_inc(*sem->read_count); + else + ret = __percpu_down_read(sem, true); /* Unconditional memory barrier */ + preempt_enable(); +@@ -103,7 +103,7 @@ static inline void percpu_up_read(struct percpu_rw_semaphore *sem) + * Same as in percpu_down_read(). + */ + if (likely(rcu_sync_is_idle(&sem->rss))) { +- __this_cpu_dec(*sem->read_count); ++ this_cpu_dec(*sem->read_count); + } else { + /* + * slowpath; reader will only ever wake a single blocked +@@ -115,7 +115,7 @@ static inline void percpu_up_read(struct percpu_rw_semaphore *sem) + * aggregate zero, as that is the only time it matters) they + * will also see our critical section. + */ +- __this_cpu_dec(*sem->read_count); ++ this_cpu_dec(*sem->read_count); + rcuwait_wake_up(&sem->writer); + } + preempt_enable(); +diff --git a/kernel/locking/percpu-rwsem.c b/kernel/locking/percpu-rwsem.c +index 8bbafe3e5203d..70a32a576f3f2 100644 +--- a/kernel/locking/percpu-rwsem.c ++++ b/kernel/locking/percpu-rwsem.c +@@ -45,7 +45,7 @@ EXPORT_SYMBOL_GPL(percpu_free_rwsem); + + static bool __percpu_down_read_trylock(struct percpu_rw_semaphore *sem) + { +- __this_cpu_inc(*sem->read_count); ++ this_cpu_inc(*sem->read_count); + + /* + * Due to having preemption disabled the decrement happens on +@@ -71,7 +71,7 @@ static bool __percpu_down_read_trylock(struct percpu_rw_semaphore *sem) + if (likely(!atomic_read_acquire(&sem->block))) + return true; + +- __this_cpu_dec(*sem->read_count); ++ this_cpu_dec(*sem->read_count); + + /* Prod writer to re-evaluate readers_active_check() */ + rcuwait_wake_up(&sem->writer); +-- +2.25.1 + diff --git a/queue-5.8/mips-sni-fix-mips_l1_cache_shift.patch b/queue-5.8/mips-sni-fix-mips_l1_cache_shift.patch new file mode 100644 index 00000000000..6a4264dccbf --- /dev/null +++ b/queue-5.8/mips-sni-fix-mips_l1_cache_shift.patch @@ -0,0 +1,35 @@ +From 6dd1acb9b11a1469ecd370933481f8d635194fcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 18:05:00 +0200 +Subject: MIPS: SNI: Fix MIPS_L1_CACHE_SHIFT + +From: Thomas Bogendoerfer + +[ Upstream commit 564c836fd945a94b5dd46597d6b7adb464092650 ] + +Commit 930beb5ac09a ("MIPS: introduce MIPS_L1_CACHE_SHIFT_") forgot +to select the correct MIPS_L1_CACHE_SHIFT for SNI RM. This breaks non +coherent DMA because of a wrong allocation alignment. + +Fixes: 930beb5ac09a ("MIPS: introduce MIPS_L1_CACHE_SHIFT_") +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig +index c43ad3b3cea4b..daa24f1e14831 100644 +--- a/arch/mips/Kconfig ++++ b/arch/mips/Kconfig +@@ -876,6 +876,7 @@ config SNI_RM + select I8253 + select I8259 + select ISA ++ select MIPS_L1_CACHE_SHIFT_6 + select SWAP_IO_SPACE if CPU_BIG_ENDIAN + select SYS_HAS_CPU_R4X00 + select SYS_HAS_CPU_R5000 +-- +2.25.1 + diff --git a/queue-5.8/mips-sni-fix-spurious-interrupts.patch b/queue-5.8/mips-sni-fix-spurious-interrupts.patch new file mode 100644 index 00000000000..581076d4cca --- /dev/null +++ b/queue-5.8/mips-sni-fix-spurious-interrupts.patch @@ -0,0 +1,58 @@ +From 760179080bae65f3ca6b9f524ff5582aa514416f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Sep 2020 15:54:37 +0200 +Subject: MIPS: SNI: Fix spurious interrupts + +From: Thomas Bogendoerfer + +[ Upstream commit b959b97860d0fee8c8f6a3e641d3c2ad76eab6be ] + +On A20R machines the interrupt pending bits in cause register need to be +updated by requesting the chipset to do it. This needs to be done to +find the interrupt cause and after interrupt service. In +commit 0b888c7f3a03 ("MIPS: SNI: Convert to new irq_chip functions") the +function to do after service update got lost, which caused spurious +interrupts. + +Fixes: 0b888c7f3a03 ("MIPS: SNI: Convert to new irq_chip functions") +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/sni/a20r.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/sni/a20r.c b/arch/mips/sni/a20r.c +index b09dc844985a8..eeeec18c420a6 100644 +--- a/arch/mips/sni/a20r.c ++++ b/arch/mips/sni/a20r.c +@@ -143,7 +143,10 @@ static struct platform_device sc26xx_pdev = { + }, + }; + +-static u32 a20r_ack_hwint(void) ++/* ++ * Trigger chipset to update CPU's CAUSE IP field ++ */ ++static u32 a20r_update_cause_ip(void) + { + u32 status = read_c0_status(); + +@@ -205,12 +208,14 @@ static void a20r_hwint(void) + int irq; + + clear_c0_status(IE_IRQ0); +- status = a20r_ack_hwint(); ++ status = a20r_update_cause_ip(); + cause = read_c0_cause(); + + irq = ffs(((cause & status) >> 8) & 0xf8); + if (likely(irq > 0)) + do_IRQ(SNI_A20R_IRQ_BASE + irq - 1); ++ ++ a20r_update_cause_ip(); + set_c0_status(IE_IRQ0); + } + +-- +2.25.1 + diff --git a/queue-5.8/nfs-zero-stateid-setattr-should-first-return-delegat.patch b/queue-5.8/nfs-zero-stateid-setattr-should-first-return-delegat.patch new file mode 100644 index 00000000000..4006a420987 --- /dev/null +++ b/queue-5.8/nfs-zero-stateid-setattr-should-first-return-delegat.patch @@ -0,0 +1,49 @@ +From a9e99229ff35fd5a65fe64ce45a61be39dae894e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Sep 2020 17:39:12 -0400 +Subject: NFS: Zero-stateid SETATTR should first return delegation + +From: Chuck Lever + +[ Upstream commit 644c9f40cf71969f29add32f32349e71d4995c0b ] + +If a write delegation isn't available, the Linux NFS client uses +a zero-stateid when performing a SETATTR. + +NFSv4.0 provides no mechanism for an NFS server to match such a +request to a particular client. It recalls all delegations for that +file, even delegations held by the client issuing the request. If +that client happens to hold a read delegation, the server will +recall it immediately, resulting in an NFS4ERR_DELAY/CB_RECALL/ +DELEGRETURN sequence. + +Optimize out this pipeline bubble by having the client return any +delegations it may hold on a file before it issues a +SETATTR(zero-stateid) on that file. + +Signed-off-by: Chuck Lever +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 7f337188a2829..08b1fb0a9225a 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -3272,8 +3272,10 @@ static int _nfs4_do_setattr(struct inode *inode, + + /* Servers should only apply open mode checks for file size changes */ + truncate = (arg->iap->ia_valid & ATTR_SIZE) ? true : false; +- if (!truncate) ++ if (!truncate) { ++ nfs4_inode_make_writeable(inode); + goto zero_stateid; ++ } + + if (nfs4_copy_delegation_stateid(inode, FMODE_WRITE, &arg->stateid, &delegation_cred)) { + /* Use that stateid */ +-- +2.25.1 + diff --git a/queue-5.8/nfsv4.1-handle-err_delay-error-reclaiming-locking-st.patch b/queue-5.8/nfsv4.1-handle-err_delay-error-reclaiming-locking-st.patch new file mode 100644 index 00000000000..35357a2ba49 --- /dev/null +++ b/queue-5.8/nfsv4.1-handle-err_delay-error-reclaiming-locking-st.patch @@ -0,0 +1,45 @@ +From 3c162d32d7ecbb9342c8a3d40a0d4e1dc023fe3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Aug 2020 18:52:43 -0400 +Subject: NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation + recall + +From: Olga Kornievskaia + +[ Upstream commit 3d7a9520f0c3e6a68b6de8c5812fc8b6d7a52626 ] + +A client should be able to handle getting an ERR_DELAY error +while doing a LOCK call to reclaim state due to delegation being +recalled. This is a transient error that can happen due to server +moving its volumes and invalidating its file location cache and +upon reference to it during the LOCK call needing to do an +expensive lookup (leading to an ERR_DELAY error on a PUTFH). + +Signed-off-by: Olga Kornievskaia +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 45e0585e0667c..7f337188a2829 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -7271,7 +7271,12 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state, + err = nfs4_set_lock_state(state, fl); + if (err != 0) + return err; +- err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW); ++ do { ++ err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW); ++ if (err != -NFS4ERR_DELAY) ++ break; ++ ssleep(1); ++ } while (err == -NFS4ERR_DELAY); + return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err); + } + +-- +2.25.1 + diff --git a/queue-5.8/nvme-fc-cancel-async-events-before-freeing-event-str.patch b/queue-5.8/nvme-fc-cancel-async-events-before-freeing-event-str.patch new file mode 100644 index 00000000000..1801f539a0a --- /dev/null +++ b/queue-5.8/nvme-fc-cancel-async-events-before-freeing-event-str.patch @@ -0,0 +1,36 @@ +From caae3393b57dc064ed1e2f668c025fae20b33f3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 17:42:54 -0500 +Subject: nvme-fc: cancel async events before freeing event struct + +From: David Milburn + +[ Upstream commit e126e8210e950bb83414c4f57b3120ddb8450742 ] + +Cancel async event work in case async event has been queued up, and +nvme_fc_submit_async_event() runs after event has been freed. + +Signed-off-by: David Milburn +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/fc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 1a2b6910509ca..92c966ac34c20 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -2158,6 +2158,7 @@ nvme_fc_term_aen_ops(struct nvme_fc_ctrl *ctrl) + struct nvme_fc_fcp_op *aen_op; + int i; + ++ cancel_work_sync(&ctrl->ctrl.async_event_work); + aen_op = ctrl->aen_ops; + for (i = 0; i < NVME_NR_AEN_COMMANDS; i++, aen_op++) { + __nvme_fc_exit_request(ctrl, aen_op); +-- +2.25.1 + diff --git a/queue-5.8/nvme-rdma-cancel-async-events-before-freeing-event-s.patch b/queue-5.8/nvme-rdma-cancel-async-events-before-freeing-event-s.patch new file mode 100644 index 00000000000..743a1e15971 --- /dev/null +++ b/queue-5.8/nvme-rdma-cancel-async-events-before-freeing-event-s.patch @@ -0,0 +1,36 @@ +From eebb5492715ce531a15450533744868cc2bd23b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 17:42:52 -0500 +Subject: nvme-rdma: cancel async events before freeing event struct + +From: David Milburn + +[ Upstream commit 925dd04c1f9825194b9e444c12478084813b2b5d ] + +Cancel async event work in case async event has been queued up, and +nvme_rdma_submit_async_event() runs after event has been freed. + +Signed-off-by: David Milburn +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 6c07bb55b0f83..4a0bc8927048a 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -809,6 +809,7 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, + blk_mq_free_tag_set(ctrl->ctrl.admin_tagset); + } + if (ctrl->async_event_sqe.data) { ++ cancel_work_sync(&ctrl->ctrl.async_event_work); + nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe, + sizeof(struct nvme_command), DMA_TO_DEVICE); + ctrl->async_event_sqe.data = NULL; +-- +2.25.1 + diff --git a/queue-5.8/nvme-tcp-cancel-async-events-before-freeing-event-st.patch b/queue-5.8/nvme-tcp-cancel-async-events-before-freeing-event-st.patch new file mode 100644 index 00000000000..06df1b42fb3 --- /dev/null +++ b/queue-5.8/nvme-tcp-cancel-async-events-before-freeing-event-st.patch @@ -0,0 +1,36 @@ +From 522d393bb38cefcbd4629a0fa9fa36fe60e8910a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 17:42:53 -0500 +Subject: nvme-tcp: cancel async events before freeing event struct + +From: David Milburn + +[ Upstream commit ceb1e0874dba5cbfc4e0b4145796a4bfb3716e6a ] + +Cancel async event work in case async event has been queued up, and +nvme_tcp_submit_async_event() runs after event has been freed. + +Signed-off-by: David Milburn +Reviewed-by: Keith Busch +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index f1f66bf96cbb9..24467eea73999 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -1567,6 +1567,7 @@ static struct blk_mq_tag_set *nvme_tcp_alloc_tagset(struct nvme_ctrl *nctrl, + static void nvme_tcp_free_admin_queue(struct nvme_ctrl *ctrl) + { + if (to_tcp_ctrl(ctrl)->async_req.pdu) { ++ cancel_work_sync(&ctrl->async_event_work); + nvme_tcp_free_async_req(to_tcp_ctrl(ctrl)); + to_tcp_ctrl(ctrl)->async_req.pdu = NULL; + } +-- +2.25.1 + diff --git a/queue-5.8/openrisc-fix-cache-api-compile-issue-when-not-inlini.patch b/queue-5.8/openrisc-fix-cache-api-compile-issue-when-not-inlini.patch new file mode 100644 index 00000000000..89b4a76e7e3 --- /dev/null +++ b/queue-5.8/openrisc-fix-cache-api-compile-issue-when-not-inlini.patch @@ -0,0 +1,57 @@ +From 59c4d727580cc89a752bf248fe0d0aafc62fd3ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Sep 2020 05:48:58 +0900 +Subject: openrisc: Fix cache API compile issue when not inlining + +From: Stafford Horne + +[ Upstream commit 3ae90d764093dfcd6ab8ab6875377302892c87d4 ] + +I found this when compiling a kbuild random config with GCC 11. The +config enables CONFIG_DEBUG_SECTION_MISMATCH, which sets CFLAGS +-fno-inline-functions-called-once. This causes the call to cache_loop in +cache.c to not be inlined causing the below compile error. + + In file included from arch/openrisc/mm/cache.c:13: + arch/openrisc/mm/cache.c: In function 'cache_loop': + ./arch/openrisc/include/asm/spr.h:16:27: warning: 'asm' operand 0 probably does not match constraints + 16 | #define mtspr(_spr, _val) __asm__ __volatile__ ( \ + | ^~~~~~~ + arch/openrisc/mm/cache.c:25:3: note: in expansion of macro 'mtspr' + 25 | mtspr(reg, line); + | ^~~~~ + ./arch/openrisc/include/asm/spr.h:16:27: error: impossible constraint in 'asm' + 16 | #define mtspr(_spr, _val) __asm__ __volatile__ ( \ + | ^~~~~~~ + arch/openrisc/mm/cache.c:25:3: note: in expansion of macro 'mtspr' + 25 | mtspr(reg, line); + | ^~~~~ + make[1]: *** [scripts/Makefile.build:283: arch/openrisc/mm/cache.o] Error 1 + +The asm constraint "K" requires a immediate constant argument to mtspr, +however because of no inlining a register argument is passed causing a +failure. Fix this by using __always_inline. + +Link: https://lore.kernel.org/lkml/202008200453.ohnhqkjQ%25lkp@intel.com/ +Signed-off-by: Stafford Horne +Signed-off-by: Sasha Levin +--- + arch/openrisc/mm/cache.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/openrisc/mm/cache.c b/arch/openrisc/mm/cache.c +index 08f56af387ac4..534a52ec5e667 100644 +--- a/arch/openrisc/mm/cache.c ++++ b/arch/openrisc/mm/cache.c +@@ -16,7 +16,7 @@ + #include + #include + +-static void cache_loop(struct page *page, const unsigned int reg) ++static __always_inline void cache_loop(struct page *page, const unsigned int reg) + { + unsigned long paddr = page_to_pfn(page) << PAGE_SHIFT; + unsigned long line = paddr & ~(L1_CACHE_BYTES - 1); +-- +2.25.1 + diff --git a/queue-5.8/perf-evlist-fix-cpu-thread-map-leak.patch b/queue-5.8/perf-evlist-fix-cpu-thread-map-leak.patch new file mode 100644 index 00000000000..1ec9dd22d7a --- /dev/null +++ b/queue-5.8/perf-evlist-fix-cpu-thread-map-leak.patch @@ -0,0 +1,68 @@ +From a715b21346595f2e78b721b9b647886ee1e435b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 12:18:11 +0900 +Subject: perf evlist: Fix cpu/thread map leak + +From: Namhyung Kim + +[ Upstream commit bfd1b83d75e44a9f65de30accb3dd3b5940bd3ac ] + +Asan reported leak of cpu and thread maps as they have one more refcount +than released. I found that after setting evlist maps it should release +it's refcount. + +It seems to be broken from the beginning so I chose the original commit +as the culprit. But not sure how it's applied to stable trees since +there are many changes in the code after that. + +Fixes: 7e2ed097538c5 ("perf evlist: Store pointer to the cpu and thread maps") +Fixes: 4112eb1899c0e ("perf evlist: Default to syswide target when no thread/cpu maps set") +Signed-off-by: Namhyung Kim +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Ian Rogers +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/20200915031819.386559-4-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/evlist.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c +index ab48be4cf2584..b279888bb1aab 100644 +--- a/tools/perf/util/evlist.c ++++ b/tools/perf/util/evlist.c +@@ -946,6 +946,10 @@ int perf_evlist__create_maps(struct evlist *evlist, struct target *target) + + perf_evlist__set_maps(&evlist->core, cpus, threads); + ++ /* as evlist now has references, put count here */ ++ perf_cpu_map__put(cpus); ++ perf_thread_map__put(threads); ++ + return 0; + + out_delete_threads: +@@ -1273,11 +1277,12 @@ static int perf_evlist__create_syswide_maps(struct evlist *evlist) + goto out_put; + + perf_evlist__set_maps(&evlist->core, cpus, threads); +-out: +- return err; ++ ++ perf_thread_map__put(threads); + out_put: + perf_cpu_map__put(cpus); +- goto out; ++out: ++ return err; + } + + int evlist__open(struct evlist *evlist) +-- +2.25.1 + diff --git a/queue-5.8/perf-metric-fix-some-memory-leaks.patch b/queue-5.8/perf-metric-fix-some-memory-leaks.patch new file mode 100644 index 00000000000..aecc4e9bbd0 --- /dev/null +++ b/queue-5.8/perf-metric-fix-some-memory-leaks.patch @@ -0,0 +1,70 @@ +From 95573f70dec80d90e4d51857ee85759e6db3878e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 12:18:09 +0900 +Subject: perf metric: Fix some memory leaks + +From: Namhyung Kim + +[ Upstream commit 4f57a1ed749a81ec553d89233cab53db9365e193 ] + +I found some memory leaks while reading the metric code. Some are real +and others only occur in the error path. When it failed during metric +or event parsing, it should release all resources properly. + +Fixes: b18f3e365019d ("perf stat: Support JSON metrics in perf stat") +Signed-off-by: Namhyung Kim +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Ian Rogers +Cc: John Garry +Cc: Kajol Jain +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/20200915031819.386559-2-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/metricgroup.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/tools/perf/util/metricgroup.c b/tools/perf/util/metricgroup.c +index 9e21aa767e417..344a75718afc3 100644 +--- a/tools/perf/util/metricgroup.c ++++ b/tools/perf/util/metricgroup.c +@@ -443,6 +443,9 @@ void metricgroup__print(bool metrics, bool metricgroups, char *filter, + continue; + strlist__add(me->metrics, s); + } ++ ++ if (!raw) ++ free(s); + } + free(omg); + } +@@ -726,7 +729,7 @@ int metricgroup__parse_groups(const struct option *opt, + ret = metricgroup__add_metric_list(str, metric_no_group, + &extra_events, &group_list); + if (ret) +- return ret; ++ goto out; + pr_debug("adding %s\n", extra_events.buf); + bzero(&parse_error, sizeof(parse_error)); + ret = parse_events(perf_evlist, extra_events.buf, &parse_error); +@@ -734,11 +737,11 @@ int metricgroup__parse_groups(const struct option *opt, + parse_events_print_error(&parse_error, extra_events.buf); + goto out; + } +- strbuf_release(&extra_events); + ret = metricgroup__setup_events(&group_list, metric_no_merge, + perf_evlist, metric_events); + out: + metricgroup__free_egroups(&group_list); ++ strbuf_release(&extra_events); + return ret; + } + +-- +2.25.1 + diff --git a/queue-5.8/perf-parse-event-fix-memory-leak-in-evsel-unit.patch b/queue-5.8/perf-parse-event-fix-memory-leak-in-evsel-unit.patch new file mode 100644 index 00000000000..babb761aa16 --- /dev/null +++ b/queue-5.8/perf-parse-event-fix-memory-leak-in-evsel-unit.patch @@ -0,0 +1,68 @@ +From 37b45d88d13662c2315b9309fa0f975fe274d6ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 12:18:13 +0900 +Subject: perf parse-event: Fix memory leak in evsel->unit + +From: Namhyung Kim + +[ Upstream commit b12eea5ad8e77f8a380a141e3db67c07432dde16 ] + +The evsel->unit borrows a pointer of pmu event or alias instead of +owns a string. But tool event (duration_time) passes a result of +strdup() caused a leak. + +It was found by ASAN during metric test: + + Direct leak of 210 byte(s) in 70 object(s) allocated from: + #0 0x7fe366fca0b5 in strdup (/lib/x86_64-linux-gnu/libasan.so.5+0x920b5) + #1 0x559fbbcc6ea3 in add_event_tool util/parse-events.c:414 + #2 0x559fbbcc6ea3 in parse_events_add_tool util/parse-events.c:1414 + #3 0x559fbbd8474d in parse_events_parse util/parse-events.y:439 + #4 0x559fbbcc95da in parse_events__scanner util/parse-events.c:2096 + #5 0x559fbbcc95da in __parse_events util/parse-events.c:2141 + #6 0x559fbbc28555 in check_parse_id tests/pmu-events.c:406 + #7 0x559fbbc28555 in check_parse_id tests/pmu-events.c:393 + #8 0x559fbbc28555 in check_parse_cpu tests/pmu-events.c:415 + #9 0x559fbbc28555 in test_parsing tests/pmu-events.c:498 + #10 0x559fbbc0109b in run_test tests/builtin-test.c:410 + #11 0x559fbbc0109b in test_and_print tests/builtin-test.c:440 + #12 0x559fbbc03e69 in __cmd_test tests/builtin-test.c:695 + #13 0x559fbbc03e69 in cmd_test tests/builtin-test.c:807 + #14 0x559fbbc691f4 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:312 + #15 0x559fbbb071a8 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:364 + #16 0x559fbbb071a8 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:408 + #17 0x559fbbb071a8 in main /home/namhyung/project/linux/tools/perf/perf.c:538 + #18 0x7fe366b68cc9 in __libc_start_main ../csu/libc-start.c:308 + +Fixes: f0fbb114e3025 ("perf stat: Implement duration_time as a proper event") +Signed-off-by: Namhyung Kim +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Ian Rogers +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/20200915031819.386559-6-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/parse-events.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c +index 4476de0e678aa..c1120d8196fae 100644 +--- a/tools/perf/util/parse-events.c ++++ b/tools/perf/util/parse-events.c +@@ -410,7 +410,7 @@ static int add_event_tool(struct list_head *list, int *idx, + return -ENOMEM; + evsel->tool_event = tool_event; + if (tool_event == PERF_TOOL_DURATION_TIME) +- evsel->unit = strdup("ns"); ++ evsel->unit = "ns"; + return 0; + } + +-- +2.25.1 + diff --git a/queue-5.8/perf-record-don-t-clear-event-s-period-if-set-by-a-t.patch b/queue-5.8/perf-record-don-t-clear-event-s-period-if-set-by-a-t.patch new file mode 100644 index 00000000000..3b836624bfe --- /dev/null +++ b/queue-5.8/perf-record-don-t-clear-event-s-period-if-set-by-a-t.patch @@ -0,0 +1,143 @@ +From e642fe44d20b9e9dce9c540ebfd42bf79315ec12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 19:56:54 -0700 +Subject: perf record: Don't clear event's period if set by a term + +From: Ian Rogers + +[ Upstream commit 3b0a18c1aa6cbfa7b0dd513b6be9893ef6e6ac30 ] + +If events in a group explicitly set a frequency or period with leader +sampling, don't disable the samples on those events. + +Prior to 5.8: + + perf record -e '{cycles/period=12345000/,instructions/period=6789000/}:S' + +would clear the attributes then apply the config terms. In commit +5f34278867b7 leader sampling configuration was moved to after applying the +config terms, in the example, making the instructions' event have its period +cleared. + +This change makes it so that sampling is only disabled if configuration +terms aren't present. + +Committer testing: + +Before: + + # perf record -e '{cycles/period=1/,instructions/period=2/}:S' sleep 1 + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.051 MB perf.data (6 samples) ] + # + # perf evlist -v + cycles/period=1/: size: 120, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|READ|ID, read_format: ID|GROUP, disabled: 1, mmap: 1, comm: 1, enable_on_exec: 1, task: 1, sample_id_all: 1, exclude_guest: 1, mmap2: 1, comm_exec: 1, ksymbol: 1, bpf_event: 1 + instructions/period=2/: size: 120, config: 0x1, sample_type: IP|TID|TIME|READ|ID, read_format: ID|GROUP, sample_id_all: 1, exclude_guest: 1 + # + +After: + + # perf record -e '{cycles/period=1/,instructions/period=2/}:S' sleep 0.0001 + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.052 MB perf.data (4 samples) ] + # perf evlist -v + cycles/period=1/: size: 120, { sample_period, sample_freq }: 1, sample_type: IP|TID|TIME|READ|ID, read_format: ID|GROUP, disabled: 1, mmap: 1, comm: 1, enable_on_exec: 1, task: 1, sample_id_all: 1, exclude_guest: 1, mmap2: 1, comm_exec: 1, ksymbol: 1, bpf_event: 1 + instructions/period=2/: size: 120, config: 0x1, { sample_period, sample_freq }: 2, sample_type: IP|TID|TIME|READ|ID, read_format: ID|GROUP, sample_id_all: 1, exclude_guest: 1 + # + +Fixes: 5f34278867b7 ("perf evlist: Move leader-sampling configuration") +Signed-off-by: Ian Rogers +Acked-by: Adrian Hunter +Acked-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Alexei Starovoitov +Cc: Andi Kleen +Cc: Andrii Nakryiko +Cc: Athira Jajeev +Cc: Daniel Borkmann +Cc: John Fastabend +Cc: KP Singh +Cc: Mark Rutland +Cc: Martin KaFai Lau +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Song Liu +Cc: Stephane Eranian +Cc: Yonghong Song +Link: http://lore.kernel.org/lkml/20200912025655.1337192-4-irogers@google.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/record.c | 34 ++++++++++++++++++++++++++-------- + 1 file changed, 26 insertions(+), 8 deletions(-) + +diff --git a/tools/perf/util/record.c b/tools/perf/util/record.c +index a4cc11592f6b3..ea9aa1d7cf501 100644 +--- a/tools/perf/util/record.c ++++ b/tools/perf/util/record.c +@@ -2,6 +2,7 @@ + #include "debug.h" + #include "evlist.h" + #include "evsel.h" ++#include "evsel_config.h" + #include "parse-events.h" + #include + #include +@@ -33,11 +34,24 @@ static struct evsel *evsel__read_sampler(struct evsel *evsel, struct evlist *evl + return leader; + } + ++static u64 evsel__config_term_mask(struct evsel *evsel) ++{ ++ struct evsel_config_term *term; ++ struct list_head *config_terms = &evsel->config_terms; ++ u64 term_types = 0; ++ ++ list_for_each_entry(term, config_terms, list) { ++ term_types |= 1 << term->type; ++ } ++ return term_types; ++} ++ + static void evsel__config_leader_sampling(struct evsel *evsel, struct evlist *evlist) + { + struct perf_event_attr *attr = &evsel->core.attr; + struct evsel *leader = evsel->leader; + struct evsel *read_sampler; ++ u64 term_types, freq_mask; + + if (!leader->sample_read) + return; +@@ -47,16 +61,20 @@ static void evsel__config_leader_sampling(struct evsel *evsel, struct evlist *ev + if (evsel == read_sampler) + return; + ++ term_types = evsel__config_term_mask(evsel); + /* +- * Disable sampling for all group members other than the leader in +- * case the leader 'leads' the sampling, except when the leader is an +- * AUX area event, in which case the 2nd event in the group is the one +- * that 'leads' the sampling. ++ * Disable sampling for all group members except those with explicit ++ * config terms or the leader. In the case of an AUX area event, the 2nd ++ * event in the group is the one that 'leads' the sampling. + */ +- attr->freq = 0; +- attr->sample_freq = 0; +- attr->sample_period = 0; +- attr->write_backward = 0; ++ freq_mask = (1 << EVSEL__CONFIG_TERM_FREQ) | (1 << EVSEL__CONFIG_TERM_PERIOD); ++ if ((term_types & freq_mask) == 0) { ++ attr->freq = 0; ++ attr->sample_freq = 0; ++ attr->sample_period = 0; ++ } ++ if ((term_types & (1 << EVSEL__CONFIG_TERM_OVERWRITE)) == 0) ++ attr->write_backward = 0; + + /* + * We don't get a sample for slave events, we make them when delivering +-- +2.25.1 + diff --git a/queue-5.8/perf-test-fix-the-signal-test-inline-assembly.patch b/queue-5.8/perf-test-fix-the-signal-test-inline-assembly.patch new file mode 100644 index 00000000000..29a521f8139 --- /dev/null +++ b/queue-5.8/perf-test-fix-the-signal-test-inline-assembly.patch @@ -0,0 +1,107 @@ +From 69d8902b07d2facaa11fce2faff387cde65ba029 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Sep 2020 15:00:05 +0200 +Subject: perf test: Fix the "signal" test inline assembly + +From: Jiri Olsa + +[ Upstream commit 8a39e8c4d9baf65d88f66d49ac684df381e30055 ] + +When compiling with DEBUG=1 on Fedora 32 I'm getting crash for 'perf +test signal': + + Program received signal SIGSEGV, Segmentation fault. + 0x0000000000c68548 in __test_function () + (gdb) bt + #0 0x0000000000c68548 in __test_function () + #1 0x00000000004d62e9 in test_function () at tests/bp_signal.c:61 + #2 0x00000000004d689a in test__bp_signal (test=0xa8e280 DW_AT_producer : (indirect string, offset: 0x254a): GNU C99 10.2.1 20200723 (Red Hat 10.2.1-1) -mtune=generic -march=x86-64 -ggdb3 -std=gnu99 -fno-omit-frame-pointer -funwind-tables -fstack-protector-all + ^^^^^ + ^^^^^ + ^^^^^ + $ + +Before: + + $ perf test signal + 20: Breakpoint overflow signal handler : FAILED! + $ + +After: + + $ perf test signal + 20: Breakpoint overflow signal handler : Ok + $ + +Fixes: 8fd34e1cce18 ("perf test: Improve bp_signal") +Signed-off-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Cc: Alexander Shishkin +Cc: Michael Petlan +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Wang Nan +Link: http://lore.kernel.org/lkml/20200911130005.1842138-1-jolsa@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/bp_signal.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/tests/bp_signal.c b/tools/perf/tests/bp_signal.c +index da8ec1e8e0648..cc9fbcedb3646 100644 +--- a/tools/perf/tests/bp_signal.c ++++ b/tools/perf/tests/bp_signal.c +@@ -45,10 +45,13 @@ volatile long the_var; + #if defined (__x86_64__) + extern void __test_function(volatile long *ptr); + asm ( ++ ".pushsection .text;" + ".globl __test_function\n" ++ ".type __test_function, @function;" + "__test_function:\n" + "incq (%rdi)\n" +- "ret\n"); ++ "ret\n" ++ ".popsection\n"); + #else + static void __test_function(volatile long *ptr) + { +-- +2.25.1 + diff --git a/queue-5.8/perf-test-free-aliases-for-pmu-event-map-aliases-tes.patch b/queue-5.8/perf-test-free-aliases-for-pmu-event-map-aliases-tes.patch new file mode 100644 index 00000000000..7f7237bdd3f --- /dev/null +++ b/queue-5.8/perf-test-free-aliases-for-pmu-event-map-aliases-tes.patch @@ -0,0 +1,97 @@ +From 776a58f05c1c218e4bea7e27111e346866d2264c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 12:18:18 +0900 +Subject: perf test: Free aliases for PMU event map aliases test + +From: Namhyung Kim + +[ Upstream commit 22fe5a25b5d8c4f8008dc4a8738d6d8a5f5ddbe9 ] + +The aliases were never released causing the following leaks: + + Indirect leak of 1224 byte(s) in 9 object(s) allocated from: + #0 0x7feefb830628 in malloc (/lib/x86_64-linux-gnu/libasan.so.5+0x107628) + #1 0x56332c8f1b62 in __perf_pmu__new_alias util/pmu.c:322 + #2 0x56332c8f401f in pmu_add_cpu_aliases_map util/pmu.c:778 + #3 0x56332c792ce9 in __test__pmu_event_aliases tests/pmu-events.c:295 + #4 0x56332c792ce9 in test_aliases tests/pmu-events.c:367 + #5 0x56332c76a09b in run_test tests/builtin-test.c:410 + #6 0x56332c76a09b in test_and_print tests/builtin-test.c:440 + #7 0x56332c76ce69 in __cmd_test tests/builtin-test.c:695 + #8 0x56332c76ce69 in cmd_test tests/builtin-test.c:807 + #9 0x56332c7d2214 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:312 + #10 0x56332c6701a8 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:364 + #11 0x56332c6701a8 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:408 + #12 0x56332c6701a8 in main /home/namhyung/project/linux/tools/perf/perf.c:538 + #13 0x7feefb359cc9 in __libc_start_main ../csu/libc-start.c:308 + +Fixes: 956a78356c24c ("perf test: Test pmu-events aliases") +Signed-off-by: Namhyung Kim +Reviewed-by: John Garry +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Ian Rogers +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/20200915031819.386559-11-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/pmu-events.c | 5 +++++ + tools/perf/util/pmu.c | 2 +- + tools/perf/util/pmu.h | 1 + + 3 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/tools/perf/tests/pmu-events.c b/tools/perf/tests/pmu-events.c +index ab64b4a4e2848..343d36965836a 100644 +--- a/tools/perf/tests/pmu-events.c ++++ b/tools/perf/tests/pmu-events.c +@@ -274,6 +274,7 @@ static int __test__pmu_event_aliases(char *pmu_name, int *count) + int res = 0; + bool use_uncore_table; + struct pmu_events_map *map = __test_pmu_get_events_map(); ++ struct perf_pmu_alias *a, *tmp; + + if (!map) + return -1; +@@ -347,6 +348,10 @@ static int __test__pmu_event_aliases(char *pmu_name, int *count) + pmu_name, alias->name); + } + ++ list_for_each_entry_safe(a, tmp, &aliases, list) { ++ list_del(&a->list); ++ perf_pmu_free_alias(a); ++ } + free(pmu); + return res; + } +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index 93fe72a9dc0b2..97882e55321fe 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -272,7 +272,7 @@ static void perf_pmu_update_alias(struct perf_pmu_alias *old, + } + + /* Delete an alias entry. */ +-static void perf_pmu_free_alias(struct perf_pmu_alias *newalias) ++void perf_pmu_free_alias(struct perf_pmu_alias *newalias) + { + zfree(&newalias->name); + zfree(&newalias->desc); +diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h +index f971d9aa4570a..1db31cbd21887 100644 +--- a/tools/perf/util/pmu.h ++++ b/tools/perf/util/pmu.h +@@ -111,6 +111,7 @@ void pmu_add_cpu_aliases_map(struct list_head *head, struct perf_pmu *pmu, + + struct pmu_events_map *perf_pmu__find_map(struct perf_pmu *pmu); + bool pmu_uncore_alias_match(const char *pmu_name, const char *name); ++void perf_pmu_free_alias(struct perf_pmu_alias *alias); + + int perf_pmu__convert_scale(const char *scale, char **end, double *sval); + +-- +2.25.1 + diff --git a/queue-5.8/perf-test-free-formats-for-perf-pmu-parse-test.patch b/queue-5.8/perf-test-free-formats-for-perf-pmu-parse-test.patch new file mode 100644 index 00000000000..b100b9c8e19 --- /dev/null +++ b/queue-5.8/perf-test-free-formats-for-perf-pmu-parse-test.patch @@ -0,0 +1,94 @@ +From 02986f7e94178a54e4003d33d75fdcf897427c7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Sep 2020 12:18:19 +0900 +Subject: perf test: Free formats for perf pmu parse test + +From: Namhyung Kim + +[ Upstream commit d26383dcb2b4b8629fde05270b4e3633be9e3d4b ] + +The following leaks were detected by ASAN: + + Indirect leak of 360 byte(s) in 9 object(s) allocated from: + #0 0x7fecc305180e in calloc (/lib/x86_64-linux-gnu/libasan.so.5+0x10780e) + #1 0x560578f6dce5 in perf_pmu__new_format util/pmu.c:1333 + #2 0x560578f752fc in perf_pmu_parse util/pmu.y:59 + #3 0x560578f6a8b7 in perf_pmu__format_parse util/pmu.c:73 + #4 0x560578e07045 in test__pmu tests/pmu.c:155 + #5 0x560578de109b in run_test tests/builtin-test.c:410 + #6 0x560578de109b in test_and_print tests/builtin-test.c:440 + #7 0x560578de401a in __cmd_test tests/builtin-test.c:661 + #8 0x560578de401a in cmd_test tests/builtin-test.c:807 + #9 0x560578e49354 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:312 + #10 0x560578ce71a8 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:364 + #11 0x560578ce71a8 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:408 + #12 0x560578ce71a8 in main /home/namhyung/project/linux/tools/perf/perf.c:538 + #13 0x7fecc2b7acc9 in __libc_start_main ../csu/libc-start.c:308 + +Fixes: cff7f956ec4a1 ("perf tests: Move pmu tests into separate object") +Signed-off-by: Namhyung Kim +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Andi Kleen +Cc: Ian Rogers +Cc: Mark Rutland +Cc: Peter Zijlstra +Cc: Stephane Eranian +Link: http://lore.kernel.org/lkml/20200915031819.386559-12-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/tests/pmu.c | 1 + + tools/perf/util/pmu.c | 11 +++++++++++ + tools/perf/util/pmu.h | 1 + + 3 files changed, 13 insertions(+) + +diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c +index 5c11fe2b30406..714e6830a758f 100644 +--- a/tools/perf/tests/pmu.c ++++ b/tools/perf/tests/pmu.c +@@ -173,6 +173,7 @@ int test__pmu(struct test *test __maybe_unused, int subtest __maybe_unused) + ret = 0; + } while (0); + ++ perf_pmu__del_formats(&formats); + test_format_dir_put(format); + return ret; + } +diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c +index 97882e55321fe..483da97ac4459 100644 +--- a/tools/perf/util/pmu.c ++++ b/tools/perf/util/pmu.c +@@ -1352,6 +1352,17 @@ void perf_pmu__set_format(unsigned long *bits, long from, long to) + set_bit(b, bits); + } + ++void perf_pmu__del_formats(struct list_head *formats) ++{ ++ struct perf_pmu_format *fmt, *tmp; ++ ++ list_for_each_entry_safe(fmt, tmp, formats, list) { ++ list_del(&fmt->list); ++ free(fmt->name); ++ free(fmt); ++ } ++} ++ + static int sub_non_neg(int a, int b) + { + if (b > a) +diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h +index 1db31cbd21887..28778b47fb4b7 100644 +--- a/tools/perf/util/pmu.h ++++ b/tools/perf/util/pmu.h +@@ -92,6 +92,7 @@ int perf_pmu__new_format(struct list_head *list, char *name, + int config, unsigned long *bits); + void perf_pmu__set_format(unsigned long *bits, long from, long to); + int perf_pmu__format_parse(char *dir, struct list_head *head); ++void perf_pmu__del_formats(struct list_head *formats); + + struct perf_pmu *perf_pmu__scan(struct perf_pmu *pmu); + +-- +2.25.1 + diff --git a/queue-5.8/phy-omap-usb2-phy-disable-phy-charger-detect.patch b/queue-5.8/phy-omap-usb2-phy-disable-phy-charger-detect.patch new file mode 100644 index 00000000000..0d62478977e --- /dev/null +++ b/queue-5.8/phy-omap-usb2-phy-disable-phy-charger-detect.patch @@ -0,0 +1,120 @@ +From 266e68f923f81a103b15d00d9826a552a4bc9ea2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Aug 2020 10:51:26 +0300 +Subject: phy: omap-usb2-phy: disable PHY charger detect + +From: Roger Quadros + +[ Upstream commit ad7a7acaedcf45071c822b6c983f9c1e084041c9 ] + +AM654x PG1.0 has a silicon bug that D+ is pulled high after POR, which +could cause enumeration failure with some USB hubs. Disabling the +USB2_PHY Charger Detect function will put D+ into the normal state. + +This addresses Silicon Errata: +i2075 - "USB2PHY: USB2PHY Charger Detect is Enabled by Default Without VBUS +Presence" + +Signed-off-by: Roger Quadros +Tested-by: Jan Kiszka +Link: https://lore.kernel.org/r/20200824075127.14902-2-rogerq@ti.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/ti/phy-omap-usb2.c | 47 +++++++++++++++++++++++++++++----- + 1 file changed, 40 insertions(+), 7 deletions(-) + +diff --git a/drivers/phy/ti/phy-omap-usb2.c b/drivers/phy/ti/phy-omap-usb2.c +index cb2dd3230fa76..507f79d14adb8 100644 +--- a/drivers/phy/ti/phy-omap-usb2.c ++++ b/drivers/phy/ti/phy-omap-usb2.c +@@ -22,10 +22,15 @@ + #include + #include + #include ++#include + + #define USB2PHY_ANA_CONFIG1 0x4c + #define USB2PHY_DISCON_BYP_LATCH BIT(31) + ++#define USB2PHY_CHRG_DET 0x14 ++#define USB2PHY_CHRG_DET_USE_CHG_DET_REG BIT(29) ++#define USB2PHY_CHRG_DET_DIS_CHG_DET BIT(28) ++ + /* SoC Specific USB2_OTG register definitions */ + #define AM654_USB2_OTG_PD BIT(8) + #define AM654_USB2_VBUS_DET_EN BIT(5) +@@ -43,6 +48,7 @@ + #define OMAP_USB2_HAS_START_SRP BIT(0) + #define OMAP_USB2_HAS_SET_VBUS BIT(1) + #define OMAP_USB2_CALIBRATE_FALSE_DISCONNECT BIT(2) ++#define OMAP_USB2_DISABLE_CHRG_DET BIT(3) + + struct omap_usb { + struct usb_phy phy; +@@ -236,6 +242,13 @@ static int omap_usb_init(struct phy *x) + omap_usb_writel(phy->phy_base, USB2PHY_ANA_CONFIG1, val); + } + ++ if (phy->flags & OMAP_USB2_DISABLE_CHRG_DET) { ++ val = omap_usb_readl(phy->phy_base, USB2PHY_CHRG_DET); ++ val |= USB2PHY_CHRG_DET_USE_CHG_DET_REG | ++ USB2PHY_CHRG_DET_DIS_CHG_DET; ++ omap_usb_writel(phy->phy_base, USB2PHY_CHRG_DET, val); ++ } ++ + return 0; + } + +@@ -329,6 +342,26 @@ static const struct of_device_id omap_usb2_id_table[] = { + }; + MODULE_DEVICE_TABLE(of, omap_usb2_id_table); + ++static void omap_usb2_init_errata(struct omap_usb *phy) ++{ ++ static const struct soc_device_attribute am65x_sr10_soc_devices[] = { ++ { .family = "AM65X", .revision = "SR1.0" }, ++ { /* sentinel */ } ++ }; ++ ++ /* ++ * Errata i2075: USB2PHY: USB2PHY Charger Detect is Enabled by ++ * Default Without VBUS Presence. ++ * ++ * AM654x SR1.0 has a silicon bug due to which D+ is pulled high after ++ * POR, which could cause enumeration failure with some USB hubs. ++ * Disabling the USB2_PHY Charger Detect function will put D+ ++ * into the normal state. ++ */ ++ if (soc_device_match(am65x_sr10_soc_devices)) ++ phy->flags |= OMAP_USB2_DISABLE_CHRG_DET; ++} ++ + static int omap_usb2_probe(struct platform_device *pdev) + { + struct omap_usb *phy; +@@ -366,14 +399,14 @@ static int omap_usb2_probe(struct platform_device *pdev) + phy->mask = phy_data->mask; + phy->power_on = phy_data->power_on; + phy->power_off = phy_data->power_off; ++ phy->flags = phy_data->flags; + +- if (phy_data->flags & OMAP_USB2_CALIBRATE_FALSE_DISCONNECT) { +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- phy->phy_base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(phy->phy_base)) +- return PTR_ERR(phy->phy_base); +- phy->flags |= OMAP_USB2_CALIBRATE_FALSE_DISCONNECT; +- } ++ omap_usb2_init_errata(phy); ++ ++ res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ phy->phy_base = devm_ioremap_resource(&pdev->dev, res); ++ if (IS_ERR(phy->phy_base)) ++ return PTR_ERR(phy->phy_base); + + phy->syscon_phy_power = syscon_regmap_lookup_by_phandle(node, + "syscon-phy-power"); +-- +2.25.1 + diff --git a/queue-5.8/powerpc-book3s64-radix-fix-boot-failure-with-large-a.patch b/queue-5.8/powerpc-book3s64-radix-fix-boot-failure-with-large-a.patch new file mode 100644 index 00000000000..95a803bfd9d --- /dev/null +++ b/queue-5.8/powerpc-book3s64-radix-fix-boot-failure-with-large-a.patch @@ -0,0 +1,137 @@ +From 37a3e251f0ab2ce9baa29bf48253466e4b3a7bbe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 15:38:52 +0530 +Subject: powerpc/book3s64/radix: Fix boot failure with large amount of guest + memory + +From: Aneesh Kumar K.V + +[ Upstream commit 103a8542cb35b5130f732d00b0419a594ba1b517 ] + +If the hypervisor doesn't support hugepages, the kernel ends up allocating a large +number of page table pages. The early page table allocation was wrongly +setting the max memblock limit to ppc64_rma_size with radix translation +which resulted in boot failure as shown below. + +Kernel panic - not syncing: +early_alloc_pgtable: Failed to allocate 16777216 bytes align=0x1000000 nid=-1 from=0x0000000000000000 max_addr=0xffffffffffffffff + CPU: 0 PID: 0 Comm: swapper Not tainted 5.8.0-24.9-default+ #2 + Call Trace: + [c0000000016f3d00] [c0000000007c6470] dump_stack+0xc4/0x114 (unreliable) + [c0000000016f3d40] [c00000000014c78c] panic+0x164/0x418 + [c0000000016f3dd0] [c000000000098890] early_alloc_pgtable+0xe0/0xec + [c0000000016f3e60] [c0000000010a5440] radix__early_init_mmu+0x360/0x4b4 + [c0000000016f3ef0] [c000000001099bac] early_init_mmu+0x1c/0x3c + [c0000000016f3f10] [c00000000109a320] early_setup+0x134/0x170 + +This was because the kernel was checking for the radix feature before we enable the +feature via mmu_features. This resulted in the kernel using hash restrictions on +radix. + +Rework the early init code such that the kernel boot with memblock restrictions +as imposed by hash. At that point, the kernel still hasn't finalized the +translation the kernel will end up using. + +We have three different ways of detecting radix. + +1. dt_cpu_ftrs_scan -> used only in case of PowerNV +2. ibm,pa-features -> Used when we don't use cpu_dt_ftr_scan +3. CAS -> Where we negotiate with hypervisor about the supported translation. + +We look at 1 or 2 early in the boot and after that, we look at the CAS vector to +finalize the translation the kernel will use. We also support a kernel command +line option (disable_radix) to switch to hash. + +Update the memblock limit after mmu_early_init_devtree() if the kernel is going +to use radix translation. This forces some of the memblock allocations we do before +mmu_early_init_devtree() to be within the RMA limit. + +Fixes: 2bfd65e45e87 ("powerpc/mm/radix: Add radix callbacks for early init routines") +Reported-by: Shirisha Ganta +Signed-off-by: Aneesh Kumar K.V +Reviewed-by: Hari Bathini +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20200828100852.426575-1-aneesh.kumar@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/book3s/64/mmu.h | 10 +++++----- + arch/powerpc/mm/book3s64/radix_pgtable.c | 15 --------------- + arch/powerpc/mm/init_64.c | 11 +++++++++-- + 3 files changed, 14 insertions(+), 22 deletions(-) + +diff --git a/arch/powerpc/include/asm/book3s/64/mmu.h b/arch/powerpc/include/asm/book3s/64/mmu.h +index 5393a535240c7..dfbbffa0eb2e2 100644 +--- a/arch/powerpc/include/asm/book3s/64/mmu.h ++++ b/arch/powerpc/include/asm/book3s/64/mmu.h +@@ -228,14 +228,14 @@ static inline void early_init_mmu_secondary(void) + + extern void hash__setup_initial_memory_limit(phys_addr_t first_memblock_base, + phys_addr_t first_memblock_size); +-extern void radix__setup_initial_memory_limit(phys_addr_t first_memblock_base, +- phys_addr_t first_memblock_size); + static inline void setup_initial_memory_limit(phys_addr_t first_memblock_base, + phys_addr_t first_memblock_size) + { +- if (early_radix_enabled()) +- return radix__setup_initial_memory_limit(first_memblock_base, +- first_memblock_size); ++ /* ++ * Hash has more strict restrictions. At this point we don't ++ * know which translations we will pick. Hence go with hash ++ * restrictions. ++ */ + return hash__setup_initial_memory_limit(first_memblock_base, + first_memblock_size); + } +diff --git a/arch/powerpc/mm/book3s64/radix_pgtable.c b/arch/powerpc/mm/book3s64/radix_pgtable.c +index c2989c1718839..1e9a298020a63 100644 +--- a/arch/powerpc/mm/book3s64/radix_pgtable.c ++++ b/arch/powerpc/mm/book3s64/radix_pgtable.c +@@ -654,21 +654,6 @@ void radix__mmu_cleanup_all(void) + } + } + +-void radix__setup_initial_memory_limit(phys_addr_t first_memblock_base, +- phys_addr_t first_memblock_size) +-{ +- /* +- * We don't currently support the first MEMBLOCK not mapping 0 +- * physical on those processors +- */ +- BUG_ON(first_memblock_base != 0); +- +- /* +- * Radix mode is not limited by RMA / VRMA addressing. +- */ +- ppc64_rma_size = ULONG_MAX; +-} +- + #ifdef CONFIG_MEMORY_HOTPLUG + static void free_pte_table(pte_t *pte_start, pmd_t *pmd) + { +diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c +index bc73abf0bc25e..ef566fc43933e 100644 +--- a/arch/powerpc/mm/init_64.c ++++ b/arch/powerpc/mm/init_64.c +@@ -431,9 +431,16 @@ void __init mmu_early_init_devtree(void) + if (!(mfmsr() & MSR_HV)) + early_check_vec5(); + +- if (early_radix_enabled()) ++ if (early_radix_enabled()) { + radix__early_init_devtree(); +- else ++ /* ++ * We have finalized the translation we are going to use by now. ++ * Radix mode is not limited by RMA / VRMA addressing. ++ * Hence don't limit memblock allocations. ++ */ ++ ppc64_rma_size = ULONG_MAX; ++ memblock_set_current_limit(MEMBLOCK_ALLOC_ANYWHERE); ++ } else + hash__early_init_devtree(); + } + #endif /* CONFIG_PPC_BOOK3S_64 */ +-- +2.25.1 + diff --git a/queue-5.8/rapidio-replace-select-dmaengines-with-depends-on.patch b/queue-5.8/rapidio-replace-select-dmaengines-with-depends-on.patch new file mode 100644 index 00000000000..173451b4374 --- /dev/null +++ b/queue-5.8/rapidio-replace-select-dmaengines-with-depends-on.patch @@ -0,0 +1,37 @@ +From 3897e3fbf919355488142501ab3d1d8f12c35a86 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Jul 2020 01:19:40 +0300 +Subject: rapidio: Replace 'select' DMAENGINES 'with depends on' + +From: Laurent Pinchart + +[ Upstream commit d2b86100245080cfdf1e95e9e07477474c1be2bd ] + +Enabling a whole subsystem from a single driver 'select' is frowned +upon and won't be accepted in new drivers, that need to use 'depends on' +instead. Existing selection of DMAENGINES will then cause circular +dependencies. Replace them with a dependency. + +Signed-off-by: Laurent Pinchart +Acked-by: Randy Dunlap +Signed-off-by: Sasha Levin +--- + drivers/rapidio/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/rapidio/Kconfig b/drivers/rapidio/Kconfig +index e4c422d806bee..b9f8514909bf0 100644 +--- a/drivers/rapidio/Kconfig ++++ b/drivers/rapidio/Kconfig +@@ -37,7 +37,7 @@ config RAPIDIO_ENABLE_RX_TX_PORTS + config RAPIDIO_DMA_ENGINE + bool "DMA Engine support for RapidIO" + depends on RAPIDIO +- select DMADEVICES ++ depends on DMADEVICES + select DMA_ENGINE + help + Say Y here if you want to use DMA Engine frameork for RapidIO data +-- +2.25.1 + diff --git a/queue-5.8/regulator-pwm-fix-machine-constraints-application.patch b/queue-5.8/regulator-pwm-fix-machine-constraints-application.patch new file mode 100644 index 00000000000..ce03566d19c --- /dev/null +++ b/queue-5.8/regulator-pwm-fix-machine-constraints-application.patch @@ -0,0 +1,63 @@ +From 9bef9290d674dfb8f6f8f8a672a0e572be0e52fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 15:09:52 +0200 +Subject: regulator: pwm: Fix machine constraints application + +From: Vincent Whitchurch + +[ Upstream commit 59ae97a7a9e1499c2070e29841d1c4be4ae2994a ] + +If the zero duty cycle doesn't correspond to any voltage in the voltage +table, the PWM regulator returns an -EINVAL from get_voltage_sel() which +results in the core erroring out with a "failed to get the current +voltage" and ending up not applying the machine constraints. + +Instead, return -ENOTRECOVERABLE which makes the core set the voltage +since it's at an unknown value. + +For example, with this device tree: + + fooregulator { + compatible = "pwm-regulator"; + pwms = <&foopwm 0 100000>; + regulator-min-microvolt = <2250000>; + regulator-max-microvolt = <2250000>; + regulator-name = "fooregulator"; + regulator-always-on; + regulator-boot-on; + voltage-table = <2250000 30>; + }; + +Before this patch: + + fooregulator: failed to get the current voltage(-22) + +After this patch: + + fooregulator: Setting 2250000-2250000uV + fooregulator: 2250 mV + +Signed-off-by: Vincent Whitchurch +Link: https://lore.kernel.org/r/20200902130952.24880-1-vincent.whitchurch@axis.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/regulator/pwm-regulator.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/regulator/pwm-regulator.c b/drivers/regulator/pwm-regulator.c +index 638329bd0745e..62ad7c4e7e7c8 100644 +--- a/drivers/regulator/pwm-regulator.c ++++ b/drivers/regulator/pwm-regulator.c +@@ -279,7 +279,7 @@ static int pwm_regulator_init_table(struct platform_device *pdev, + return ret; + } + +- drvdata->state = -EINVAL; ++ drvdata->state = -ENOTRECOVERABLE; + drvdata->duty_cycle_table = duty_cycle_table; + drvdata->desc.ops = &pwm_regulator_voltage_table_ops; + drvdata->desc.n_voltages = length / sizeof(*duty_cycle_table); +-- +2.25.1 + diff --git a/queue-5.8/riscv-add-sfence.vma-after-early-page-table-changes.patch b/queue-5.8/riscv-add-sfence.vma-after-early-page-table-changes.patch new file mode 100644 index 00000000000..7ba0fe7d064 --- /dev/null +++ b/queue-5.8/riscv-add-sfence.vma-after-early-page-table-changes.patch @@ -0,0 +1,47 @@ +From 603ec6616df0ae589dc25523b3a5054911ebabc6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 Aug 2020 11:02:05 +0800 +Subject: riscv: Add sfence.vma after early page table changes + +From: Greentime Hu + +[ Upstream commit 21190b74bcf3a36ebab9a715088c29f59877e1f3 ] + +This invalidates local TLB after modifying the page tables during early init as +it's too early to handle suprious faults as we otherwise do. + +Fixes: f2c17aabc917 ("RISC-V: Implement compile-time fixed mappings") +Reported-by: Syven Wang +Signed-off-by: Syven Wang +Signed-off-by: Greentime Hu +Reviewed-by: Anup Patel +[Palmer: Cleaned up the commit text] +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/mm/init.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c +index 79e9d55bdf1ac..e229d95f470b8 100644 +--- a/arch/riscv/mm/init.c ++++ b/arch/riscv/mm/init.c +@@ -226,12 +226,11 @@ void __set_fixmap(enum fixed_addresses idx, phys_addr_t phys, pgprot_t prot) + + ptep = &fixmap_pte[pte_index(addr)]; + +- if (pgprot_val(prot)) { ++ if (pgprot_val(prot)) + set_pte(ptep, pfn_pte(phys >> PAGE_SHIFT, prot)); +- } else { ++ else + pte_clear(&init_mm, addr, ptep); +- local_flush_tlb_page(addr); +- } ++ local_flush_tlb_page(addr); + } + + static pte_t *__init get_pte_virt(phys_addr_t pa) +-- +2.25.1 + diff --git a/queue-5.8/scsi-libfc-fix-for-double-free.patch b/queue-5.8/scsi-libfc-fix-for-double-free.patch new file mode 100644 index 00000000000..5b06099b136 --- /dev/null +++ b/queue-5.8/scsi-libfc-fix-for-double-free.patch @@ -0,0 +1,37 @@ +From 6e48f5799a2d468deceb0f7537433b7c9b851859 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Aug 2020 02:39:40 -0700 +Subject: scsi: libfc: Fix for double free() + +From: Javed Hasan + +[ Upstream commit 5a5b80f98534416b3b253859897e2ba1dc241e70 ] + +Fix for '&fp->skb' double free. + +Link: +https://lore.kernel.org/r/20200825093940.19612-1-jhasan@marvell.com +Reported-by: Dan Carpenter +Signed-off-by: Javed Hasan +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libfc/fc_disc.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/scsi/libfc/fc_disc.c b/drivers/scsi/libfc/fc_disc.c +index e00dc4693fcbd..589ddf003886e 100644 +--- a/drivers/scsi/libfc/fc_disc.c ++++ b/drivers/scsi/libfc/fc_disc.c +@@ -634,8 +634,6 @@ free_fp: + fc_frame_free(fp); + out: + kref_put(&rdata->kref, fc_rport_destroy); +- if (!IS_ERR(fp)) +- fc_frame_free(fp); + } + + /** +-- +2.25.1 + diff --git a/queue-5.8/scsi-libsas-fix-error-path-in-sas_notify_lldd_dev_fo.patch b/queue-5.8/scsi-libsas-fix-error-path-in-sas_notify_lldd_dev_fo.patch new file mode 100644 index 00000000000..7c18aa9b6a5 --- /dev/null +++ b/queue-5.8/scsi-libsas-fix-error-path-in-sas_notify_lldd_dev_fo.patch @@ -0,0 +1,47 @@ +From 57dbb17a6a7d6ae32d002ab4a225380105f825ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Sep 2020 15:58:36 +0300 +Subject: scsi: libsas: Fix error path in sas_notify_lldd_dev_found() + +From: Dan Carpenter + +[ Upstream commit 244359c99fd90f1c61c3944f93250f8219435c75 ] + +In sas_notify_lldd_dev_found(), if we can't allocate the necessary +resources, then it seems like the wrong thing to mark the device as found +and to increment the reference count. None of the callers ever drop the +reference in that situation. + +[mkp: tweaked commit desc based on feedback from John] + +Link: https://lore.kernel.org/r/20200905125836.GF183976@mwanda +Fixes: 735f7d2fedf5 ("[SCSI] libsas: fix domain_device leak") +Reviewed-by: Jason Yan +Acked-by: John Garry +Signed-off-by: Dan Carpenter +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libsas/sas_discover.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/libsas/sas_discover.c b/drivers/scsi/libsas/sas_discover.c +index daf951b0b3f55..13ad2b3d314e2 100644 +--- a/drivers/scsi/libsas/sas_discover.c ++++ b/drivers/scsi/libsas/sas_discover.c +@@ -182,10 +182,11 @@ int sas_notify_lldd_dev_found(struct domain_device *dev) + pr_warn("driver on host %s cannot handle device %016llx, error:%d\n", + dev_name(sas_ha->dev), + SAS_ADDR(dev->sas_addr), res); ++ return res; + } + set_bit(SAS_DEV_FOUND, &dev->state); + kref_get(&dev->kref); +- return res; ++ return 0; + } + + +-- +2.25.1 + diff --git a/queue-5.8/scsi-lpfc-extend-the-rdf-fpin-registration-descripto.patch b/queue-5.8/scsi-lpfc-extend-the-rdf-fpin-registration-descripto.patch new file mode 100644 index 00000000000..1ad0ca174a4 --- /dev/null +++ b/queue-5.8/scsi-lpfc-extend-the-rdf-fpin-registration-descripto.patch @@ -0,0 +1,59 @@ +From d36e36278b3fcedbc1f018160b6451bf19e450c8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 10:53:31 -0700 +Subject: scsi: lpfc: Extend the RDF FPIN Registration descriptor for + additional events + +From: James Smart + +[ Upstream commit 441f6b5b097d74a8aa72ec0d8992ef820e2b3773 ] + +Currently the driver registers for Link Integrity events only. + +This patch adds registration for the following FPIN types: + + - Delivery Notifications + - Congestion Notification + - Peer Congestion Notification + +Link: https://lore.kernel.org/r/20200828175332.130300-4-james.smart@broadcom.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 3 +++ + drivers/scsi/lpfc/lpfc_hw4.h | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 7b6a210825677..519c7be404e75 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -3512,6 +3512,9 @@ lpfc_issue_els_rdf(struct lpfc_vport *vport, uint8_t retry) + FC_TLV_DESC_LENGTH_FROM_SZ(prdf->reg_d1)); + prdf->reg_d1.reg_desc.count = cpu_to_be32(ELS_RDF_REG_TAG_CNT); + prdf->reg_d1.desc_tags[0] = cpu_to_be32(ELS_DTAG_LNK_INTEGRITY); ++ prdf->reg_d1.desc_tags[1] = cpu_to_be32(ELS_DTAG_DELIVERY); ++ prdf->reg_d1.desc_tags[2] = cpu_to_be32(ELS_DTAG_PEER_CONGEST); ++ prdf->reg_d1.desc_tags[3] = cpu_to_be32(ELS_DTAG_CONGESTION); + + lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, + "Issue RDF: did:x%x", +diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h +index 6dfff03765471..c7085769170d7 100644 +--- a/drivers/scsi/lpfc/lpfc_hw4.h ++++ b/drivers/scsi/lpfc/lpfc_hw4.h +@@ -4797,7 +4797,7 @@ struct send_frame_wqe { + uint32_t fc_hdr_wd5; /* word 15 */ + }; + +-#define ELS_RDF_REG_TAG_CNT 1 ++#define ELS_RDF_REG_TAG_CNT 4 + struct lpfc_els_rdf_reg_desc { + struct fc_df_desc_fpin_reg reg_desc; /* descriptor header */ + __be32 desc_tags[ELS_RDF_REG_TAG_CNT]; +-- +2.25.1 + diff --git a/queue-5.8/scsi-lpfc-fix-flogi-plogi-receive-race-condition-in-.patch b/queue-5.8/scsi-lpfc-fix-flogi-plogi-receive-race-condition-in-.patch new file mode 100644 index 00000000000..615c90e6aeb --- /dev/null +++ b/queue-5.8/scsi-lpfc-fix-flogi-plogi-receive-race-condition-in-.patch @@ -0,0 +1,62 @@ +From 3abd325314d3e21fa76f8df238be450c1cdd9ea5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Aug 2020 10:53:30 -0700 +Subject: scsi: lpfc: Fix FLOGI/PLOGI receive race condition in pt2pt discovery + +From: James Smart + +[ Upstream commit 7b08e89f98cee9907895fabb64cf437bc505ce9a ] + +The driver is unable to successfully login with remote device. During pt2pt +login, the driver completes its FLOGI request with the remote device having +WWN precedence. The remote device issues its own (delayed) FLOGI after +accepting the driver's and, upon transmitting the FLOGI, immediately +recognizes it has already processed the driver's FLOGI thus it transitions +to sending a PLOGI before waiting for an ACC to its FLOGI. + +In the driver, the FLOGI is received and an ACC sent, followed by the PLOGI +being received and an ACC sent. The issue is that the PLOGI reception +occurs before the response from the adapter from the FLOGI ACC is +received. Processing of the PLOGI sets state flags to perform the REG_RPI +mailbox command and proceed with the rest of discovery on the port. The +same completion routine used by both FLOGI and PLOGI is generic in +nature. One of the things it does is clear flags, and those flags happen to +drive the rest of discovery. So what happened was the PLOGI processing set +the flags, the FLOGI ACC completion cleared them, thus when the PLOGI ACC +completes it doesn't see the flags and stops. + +Fix by modifying the generic completion routine to not clear the rest of +discovery flag (NLP_ACC_REGLOGIN) unless the completion is also associated +with performing a mailbox command as part of its handling. For things such +as FLOGI ACC, there isn't a subsequent action to perform with the adapter, +thus there is no mailbox cmd ptr. PLOGI ACC though will perform REG_RPI +upon completion, thus there is a mailbox cmd ptr. + +Link: https://lore.kernel.org/r/20200828175332.130300-3-james.smart@broadcom.com +Co-developed-by: Dick Kennedy +Signed-off-by: Dick Kennedy +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 3d670568a2760..7b6a210825677 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -4644,7 +4644,9 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + out: + if (ndlp && NLP_CHK_NODE_ACT(ndlp) && shost) { + spin_lock_irq(shost->host_lock); +- ndlp->nlp_flag &= ~(NLP_ACC_REGLOGIN | NLP_RM_DFLT_RPI); ++ if (mbox) ++ ndlp->nlp_flag &= ~NLP_ACC_REGLOGIN; ++ ndlp->nlp_flag &= ~NLP_RM_DFLT_RPI; + spin_unlock_irq(shost->host_lock); + + /* If the node is not being used by another discovery thread, +-- +2.25.1 + diff --git a/queue-5.8/scsi-pm8001-fix-memleak-in-pm8001_exec_internal_task.patch b/queue-5.8/scsi-pm8001-fix-memleak-in-pm8001_exec_internal_task.patch new file mode 100644 index 00000000000..c05f86be991 --- /dev/null +++ b/queue-5.8/scsi-pm8001-fix-memleak-in-pm8001_exec_internal_task.patch @@ -0,0 +1,37 @@ +From b3a50a5c01df854e927e7967c3bd99f77c61ba0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Aug 2020 17:14:53 +0800 +Subject: scsi: pm8001: Fix memleak in pm8001_exec_internal_task_abort + +From: Dinghao Liu + +[ Upstream commit ea403fde7552bd61bad6ea45e3feb99db77cb31e ] + +When pm8001_tag_alloc() fails, task should be freed just like it is done in +the subsequent error paths. + +Link: https://lore.kernel.org/r/20200823091453.4782-1-dinghao.liu@zju.edu.cn +Acked-by: Jack Wang +Signed-off-by: Dinghao Liu +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_sas.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c +index b7cbc312843e9..da9fd8a5f8cae 100644 +--- a/drivers/scsi/pm8001/pm8001_sas.c ++++ b/drivers/scsi/pm8001/pm8001_sas.c +@@ -818,7 +818,7 @@ pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha, + + res = pm8001_tag_alloc(pm8001_ha, &ccb_tag); + if (res) +- return res; ++ goto ex_err; + ccb = &pm8001_ha->ccb_info[ccb_tag]; + ccb->device = pm8001_dev; + ccb->ccb_tag = ccb_tag; +-- +2.25.1 + diff --git a/queue-5.8/series b/queue-5.8/series index 7e06e5bb07a..4a4e8c8b787 100644 --- a/queue-5.8/series +++ b/queue-5.8/series @@ -6,3 +6,77 @@ dt-bindings-pci-intel-lgm-pcie-fix-matching-on-all-snps-dw-pcie-instances.patch hv_netvsc-remove-unlikely-from-netvsc_select_queue.patch loop-set-correct-device-size-when-using-loop_configure.patch firmware_loader-fix-memory-leak-for-paged-buffer.patch +xprtrdma-release-in-flight-mrs-on-disconnect.patch +nfsv4.1-handle-err_delay-error-reclaiming-locking-st.patch +phy-omap-usb2-phy-disable-phy-charger-detect.patch +habanalabs-prevent-user-buff-overflow.patch +habanalabs-fix-report-of-razwi-initiator-coordinates.patch +scsi-pm8001-fix-memleak-in-pm8001_exec_internal_task.patch +scsi-libfc-fix-for-double-free.patch +scsi-lpfc-fix-flogi-plogi-receive-race-condition-in-.patch +scsi-lpfc-extend-the-rdf-fpin-registration-descripto.patch +regulator-pwm-fix-machine-constraints-application.patch +spi-spi-loopback-test-fix-out-of-bounds-read.patch +interconnect-show-bandwidth-for-disabled-paths-as-ze.patch +nfs-zero-stateid-setattr-should-first-return-delegat.patch +sunrpc-stop-printk-reading-past-end-of-string.patch +rapidio-replace-select-dmaengines-with-depends-on.patch +cifs-fix-dfs-mount-with-cifsacl-modefromsid.patch +openrisc-fix-cache-api-compile-issue-when-not-inlini.patch +nvme-fc-cancel-async-events-before-freeing-event-str.patch +nvme-rdma-cancel-async-events-before-freeing-event-s.patch +nvme-tcp-cancel-async-events-before-freeing-event-st.patch +block-only-call-sched-requeue_request-for-scheduled-.patch +f2fs-fix-indefinite-loop-scanning-for-free-nid.patch +f2fs-return-eof-on-unaligned-end-of-file-dio-read.patch +i2c-algo-pca-reapply-i2c-bus-settings-after-reset.patch +spi-fix-memory-leak-on-splited-transfers.patch +kvm-check-the-allocation-of-pv-cpu-mask.patch +kvm-mips-change-the-definition-of-kvm-type.patch +clk-davinci-use-the-correct-size-when-allocating-mem.patch +clk-rockchip-fix-initialization-of-mux_pll_src_4plls.patch +asoc-intel-skl_hda_dsp_generic-fix-nullptr-dereferen.patch +asoc-qcom-set-card-owner-to-avoid-warnings.patch +asoc-rt1308-sdw-fix-return-check-for-devm_regmap_ini.patch +asoc-rt711-fix-return-check-for-devm_regmap_init_sdw.patch +asoc-rt715-fix-return-check-for-devm_regmap_init_sdw.patch +asoc-rt700-fix-return-check-for-devm_regmap_init_sdw.patch +asoc-qcom-common-fix-refcount-imbalance-on-error.patch +drm-mediatek-dsi-fix-scrolling-of-panel-with-small-h.patch +powerpc-book3s64-radix-fix-boot-failure-with-large-a.patch +asoc-soc-core-add-snd_soc_find_dai_with_mutex.patch +asoc-meson-axg-toddr-fix-channel-order-on-g12-platfo.patch +asoc-tlv320adcx140-fix-accessing-uninitialized-adcx1.patch +asoc-intel-haswell-fix-power-transition-refactor.patch +asoc-core-do-not-cleanup-uninitialized-dais-on-soc_p.patch +drivers-hv-vmbus-hibernation-do-not-hang-forever-in-.patch +scsi-libsas-fix-error-path-in-sas_notify_lldd_dev_fo.patch +arm64-allow-cpus-unffected-by-arm-erratum-1418040-to.patch +drivers-hv-vmbus-add-timeout-to-vmbus_wait_for_unloa.patch +perf-test-fix-the-signal-test-inline-assembly.patch +perf-record-don-t-clear-event-s-period-if-set-by-a-t.patch +mips-sni-fix-mips_l1_cache_shift.patch +perf-test-free-aliases-for-pmu-event-map-aliases-tes.patch +perf-metric-fix-some-memory-leaks.patch +perf-evlist-fix-cpu-thread-map-leak.patch +perf-parse-event-fix-memory-leak-in-evsel-unit.patch +perf-test-free-formats-for-perf-pmu-parse-test.patch +drm-i915-gem-reduce-context-termination-list-iterati.patch +fbcon-fix-user-font-detection-test-at-fbcon_resize.patch +mips-sni-fix-spurious-interrupts.patch +drm-mediatek-use-cpu-when-fail-to-get-cmdq-event.patch +drm-mediatek-add-missing-put_device-call-in-mtk_ddp_.patch +drm-mediatek-add-exception-handing-in-mtk_drm_probe-.patch +drm-mediatek-add-missing-put_device-call-in-mtk_drm_.patch +drm-mediatek-add-missing-put_device-call-in-mtk_hdmi.patch +arm64-bpf-fix-branch-offset-in-jit.patch +iommu-amd-fix-potential-entry-null-deref.patch +iommu-amd-restore-irte.remapen-bit-for-amd_iommu_act.patch +kconfig-qconf-use-delete-instead-of-delete-to-free-a.patch +i2c-mediatek-fix-generic-definitions-for-bus-frequen.patch +i2c-mxs-use-mxs_dma_ctrl_wait4end-instead-of-dma_ctr.patch +riscv-add-sfence.vma-after-early-page-table-changes.patch +locking-lockdep-fix-used-in-nmi-inversions.patch +efi-efibc-check-for-efivars-write-capability.patch +locking-percpu-rwsem-use-this_cpu_-inc-dec-for-read_.patch +x86-unwind-fp-fix-fp-unwinding-in-ret_from_fork.patch diff --git a/queue-5.8/spi-fix-memory-leak-on-splited-transfers.patch b/queue-5.8/spi-fix-memory-leak-on-splited-transfers.patch new file mode 100644 index 00000000000..1456aa68e75 --- /dev/null +++ b/queue-5.8/spi-fix-memory-leak-on-splited-transfers.patch @@ -0,0 +1,77 @@ +From a446766ef86fc276c8874680d859eb3415962e9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 17:11:29 +0200 +Subject: spi: Fix memory leak on splited transfers + +From: Gustav Wiklander + +[ Upstream commit b59a7ca15464c78ea1ba3b280cfc5ac5ece11ade ] + +In the prepare_message callback the bus driver has the +opportunity to split a transfer into smaller chunks. +spi_map_msg is done after prepare_message. + +Function spi_res_release releases the splited transfers +in the message. Therefore spi_res_release should be called +after spi_map_msg. + +The previous try at this was commit c9ba7a16d0f1 +which released the splited transfers after +spi_finalize_current_message had been called. +This introduced a race since the message struct could be +out of scope because the spi_sync call got completed. + +Fixes this leak on spi bus driver spi-bcm2835.c when transfer +size is greater than 65532: + +Kmemleak: +sg_alloc_table+0x28/0xc8 +spi_map_buf+0xa4/0x300 +__spi_pump_messages+0x370/0x748 +__spi_sync+0x1d4/0x270 +spi_sync+0x34/0x58 +spi_test_execute_msg+0x60/0x340 [spi_loopback_test] +spi_test_run_iter+0x548/0x578 [spi_loopback_test] +spi_test_run_test+0x94/0x140 [spi_loopback_test] +spi_test_run_tests+0x150/0x180 [spi_loopback_test] +spi_loopback_test_probe+0x50/0xd0 [spi_loopback_test] +spi_drv_probe+0x84/0xe0 + +Signed-off-by: Gustav Wiklander +Link: https://lore.kernel.org/r/20200908151129.15915-1-gustav.wiklander@axis.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 5c5a95792c0d3..65ca552654794 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -1305,8 +1305,6 @@ out: + if (msg->status && ctlr->handle_err) + ctlr->handle_err(ctlr, msg); + +- spi_res_release(ctlr, msg); +- + spi_finalize_current_message(ctlr); + + return ret; +@@ -1694,6 +1692,13 @@ void spi_finalize_current_message(struct spi_controller *ctlr) + + spi_unmap_msg(ctlr, mesg); + ++ /* In the prepare_messages callback the spi bus has the opportunity to ++ * split a transfer to smaller chunks. ++ * Release splited transfers here since spi_map_msg is done on the ++ * splited transfers. ++ */ ++ spi_res_release(ctlr, mesg); ++ + if (ctlr->cur_msg_prepared && ctlr->unprepare_message) { + ret = ctlr->unprepare_message(ctlr, mesg); + if (ret) { +-- +2.25.1 + diff --git a/queue-5.8/spi-spi-loopback-test-fix-out-of-bounds-read.patch b/queue-5.8/spi-spi-loopback-test-fix-out-of-bounds-read.patch new file mode 100644 index 00000000000..0294796a38c --- /dev/null +++ b/queue-5.8/spi-spi-loopback-test-fix-out-of-bounds-read.patch @@ -0,0 +1,65 @@ +From fa26143e2f5658bee7ba0fdf0acfb2444a78aa38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Sep 2020 15:23:41 +0200 +Subject: spi: spi-loopback-test: Fix out-of-bounds read + +From: Vincent Whitchurch + +[ Upstream commit 837ba18dfcd4db21ad58107c65bfe89753aa56d7 ] + +The "tx/rx-transfer - crossing PAGE_SIZE" test always fails when +len=131071 and rx_offset >= 5: + + spi-loopback-test spi0.0: Running test tx/rx-transfer - crossing PAGE_SIZE + ... + with iteration values: len = 131071, tx_off = 0, rx_off = 3 + with iteration values: len = 131071, tx_off = 0, rx_off = 4 + with iteration values: len = 131071, tx_off = 0, rx_off = 5 + loopback strangeness - rx changed outside of allowed range at: ...a4321000 + spi_msg@ffffffd5a4157690 + frame_length: 131071 + actual_length: 131071 + spi_transfer@ffffffd5a41576f8 + len: 131071 + tx_buf: ffffffd5a4340ffc + +Note that rx_offset > 3 can only occur if the SPI controller driver sets +->dma_alignment to a higher value than 4, so most SPI controller drivers +are not affect. + +The allocated Rx buffer is of size SPI_TEST_MAX_SIZE_PLUS, which is 132 +KiB (assuming 4 KiB pages). This test uses an initial offset into the +rx_buf of PAGE_SIZE - 4, and a len of 131071, so the range expected to +be written in this transfer ends at (4096 - 4) + 5 + 131071 == 132 KiB, +which is also the end of the allocated buffer. But the code which +verifies the content of the buffer reads a byte beyond the allocated +buffer and spuriously fails because this out-of-bounds read doesn't +return the expected value. + +Fix this by using ITERATE_LEN instead of ITERATE_MAX_LEN to avoid +testing sizes which cause out-of-bounds reads. + +Signed-off-by: Vincent Whitchurch +Link: https://lore.kernel.org/r/20200902132341.7079-1-vincent.whitchurch@axis.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-loopback-test.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c +index b6d79cd156fb5..da1153ec9f0e3 100644 +--- a/drivers/spi/spi-loopback-test.c ++++ b/drivers/spi/spi-loopback-test.c +@@ -90,7 +90,7 @@ static struct spi_test spi_tests[] = { + { + .description = "tx/rx-transfer - crossing PAGE_SIZE", + .fill_option = FILL_COUNT_8, +- .iterate_len = { ITERATE_MAX_LEN }, ++ .iterate_len = { ITERATE_LEN }, + .iterate_tx_align = ITERATE_ALIGN, + .iterate_rx_align = ITERATE_ALIGN, + .transfer_count = 1, +-- +2.25.1 + diff --git a/queue-5.8/sunrpc-stop-printk-reading-past-end-of-string.patch b/queue-5.8/sunrpc-stop-printk-reading-past-end-of-string.patch new file mode 100644 index 00000000000..613e5311e9a --- /dev/null +++ b/queue-5.8/sunrpc-stop-printk-reading-past-end-of-string.patch @@ -0,0 +1,39 @@ +From 59c34837d4b6c6c4d5e862fbb364699d414a1e08 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Sep 2020 10:03:26 -0400 +Subject: SUNRPC: stop printk reading past end of string + +From: J. Bruce Fields + +[ Upstream commit 8c6b6c793ed32b8f9770ebcdf1ba99af423c303b ] + +Since p points at raw xdr data, there's no guarantee that it's NULL +terminated, so we should give a length. And probably escape any special +characters too. + +Reported-by: Zhi Li +Signed-off-by: J. Bruce Fields +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/rpcb_clnt.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/rpcb_clnt.c b/net/sunrpc/rpcb_clnt.c +index c27123e6ba80c..4a67685c83eb4 100644 +--- a/net/sunrpc/rpcb_clnt.c ++++ b/net/sunrpc/rpcb_clnt.c +@@ -982,8 +982,8 @@ static int rpcb_dec_getaddr(struct rpc_rqst *req, struct xdr_stream *xdr, + p = xdr_inline_decode(xdr, len); + if (unlikely(p == NULL)) + goto out_fail; +- dprintk("RPC: %5u RPCB_%s reply: %s\n", req->rq_task->tk_pid, +- req->rq_task->tk_msg.rpc_proc->p_name, (char *)p); ++ dprintk("RPC: %5u RPCB_%s reply: %*pE\n", req->rq_task->tk_pid, ++ req->rq_task->tk_msg.rpc_proc->p_name, len, (char *)p); + + if (rpc_uaddr2sockaddr(req->rq_xprt->xprt_net, (char *)p, len, + sap, sizeof(address)) == 0) +-- +2.25.1 + diff --git a/queue-5.8/x86-unwind-fp-fix-fp-unwinding-in-ret_from_fork.patch b/queue-5.8/x86-unwind-fp-fix-fp-unwinding-in-ret_from_fork.patch new file mode 100644 index 00000000000..692dd0c09d3 --- /dev/null +++ b/queue-5.8/x86-unwind-fp-fix-fp-unwinding-in-ret_from_fork.patch @@ -0,0 +1,112 @@ +From ec978ae5e3c8a8ed754213deba8ee3255a299ed9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Sep 2020 12:04:22 -0500 +Subject: x86/unwind/fp: Fix FP unwinding in ret_from_fork + +From: Josh Poimboeuf + +[ Upstream commit 6f9885a36c006d798319661fa849f9c2922223b9 ] + +There have been some reports of "bad bp value" warnings printed by the +frame pointer unwinder: + + WARNING: kernel stack regs at 000000005bac7112 in sh:1014 has bad 'bp' value 0000000000000000 + +This warning happens when unwinding from an interrupt in +ret_from_fork(). If entry code gets interrupted, the state of the +frame pointer (rbp) may be undefined, which can confuse the unwinder, +resulting in warnings like the above. + +There's an in_entry_code() check which normally silences such +warnings for entry code. But in this case, ret_from_fork() is getting +interrupted. It recently got moved out of .entry.text, so the +in_entry_code() check no longer works. + +It could be moved back into .entry.text, but that would break the +noinstr validation because of the call to schedule_tail(). + +Instead, initialize each new task's RBP to point to the task's entry +regs via an encoded frame pointer. That will allow the unwinder to +reach the end of the stack gracefully. + +Fixes: b9f6976bfb94 ("x86/entry/64: Move non entry code into .text section") +Reported-by: Naresh Kamboju +Reported-by: Logan Gunthorpe +Signed-off-by: Josh Poimboeuf +Signed-off-by: Borislav Petkov +Acked-by: Peter Zijlstra (Intel) +Acked-by: Thomas Gleixner +Link: https://lkml.kernel.org/r/f366bbf5a8d02e2318ee312f738112d0af74d16f.1600103007.git.jpoimboe@redhat.com +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/frame.h | 19 +++++++++++++++++++ + arch/x86/kernel/process.c | 3 ++- + 2 files changed, 21 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/frame.h b/arch/x86/include/asm/frame.h +index 296b346184b27..fb42659f6e988 100644 +--- a/arch/x86/include/asm/frame.h ++++ b/arch/x86/include/asm/frame.h +@@ -60,12 +60,26 @@ + #define FRAME_END "pop %" _ASM_BP "\n" + + #ifdef CONFIG_X86_64 ++ + #define ENCODE_FRAME_POINTER \ + "lea 1(%rsp), %rbp\n\t" ++ ++static inline unsigned long encode_frame_pointer(struct pt_regs *regs) ++{ ++ return (unsigned long)regs + 1; ++} ++ + #else /* !CONFIG_X86_64 */ ++ + #define ENCODE_FRAME_POINTER \ + "movl %esp, %ebp\n\t" \ + "andl $0x7fffffff, %ebp\n\t" ++ ++static inline unsigned long encode_frame_pointer(struct pt_regs *regs) ++{ ++ return (unsigned long)regs & 0x7fffffff; ++} ++ + #endif /* CONFIG_X86_64 */ + + #endif /* __ASSEMBLY__ */ +@@ -83,6 +97,11 @@ + + #define ENCODE_FRAME_POINTER + ++static inline unsigned long encode_frame_pointer(struct pt_regs *regs) ++{ ++ return 0; ++} ++ + #endif + + #define FRAME_BEGIN +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index fe67dbd76e517..bff502e779e44 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -42,6 +42,7 @@ + #include + #include + #include ++#include + + #include "process.h" + +@@ -133,7 +134,7 @@ int copy_thread_tls(unsigned long clone_flags, unsigned long sp, + fork_frame = container_of(childregs, struct fork_frame, regs); + frame = &fork_frame->frame; + +- frame->bp = 0; ++ frame->bp = encode_frame_pointer(childregs); + frame->ret_addr = (unsigned long) ret_from_fork; + p->thread.sp = (unsigned long) fork_frame; + p->thread.io_bitmap = NULL; +-- +2.25.1 + diff --git a/queue-5.8/xprtrdma-release-in-flight-mrs-on-disconnect.patch b/queue-5.8/xprtrdma-release-in-flight-mrs-on-disconnect.patch new file mode 100644 index 00000000000..2c63ae98d01 --- /dev/null +++ b/queue-5.8/xprtrdma-release-in-flight-mrs-on-disconnect.patch @@ -0,0 +1,42 @@ +From c304131f4d3a4875029b188076ccc160ba5ef571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Aug 2020 11:19:26 -0400 +Subject: xprtrdma: Release in-flight MRs on disconnect + +From: Chuck Lever + +[ Upstream commit 5de55ce951a1466e31ff68a7bc6b0a7ce3cb5947 ] + +Dan Aloni reports that when a server disconnects abruptly, a few +memory regions are left DMA mapped. Over time this leak could pin +enough I/O resources to slow or even deadlock an NFS/RDMA client. + +I found that if a transport disconnects before pending Send and +FastReg WRs can be posted, the to-be-registered MRs are stranded on +the req's rl_registered list and never released -- since they +weren't posted, there's no Send completion to DMA unmap them. + +Reported-by: Dan Aloni +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtrdma/verbs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 75c646743df3e..ca89f24a1590b 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -933,6 +933,8 @@ static void rpcrdma_req_reset(struct rpcrdma_req *req) + + rpcrdma_regbuf_dma_unmap(req->rl_sendbuf); + rpcrdma_regbuf_dma_unmap(req->rl_recvbuf); ++ ++ frwr_reset(req); + } + + /* ASSUMPTION: the rb_allreqs list is stable for the duration, +-- +2.25.1 + -- 2.47.3