From b27255455dd28f75941ae631f2ba9f8f3edea9d9 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 1 Mar 2021 11:50:30 +0100 Subject: [PATCH] 5.11-stable patches added patches: acpi-configfs-add-missing-check-after-configfs_register_default_group.patch acpi-property-fix-fwnode-string-properties-matching.patch alsa-fireface-fix-to-parse-sync-status-register-of-latter-protocol.patch alsa-hda-add-another-cometlake-h-pci-id.patch alsa-hda-hdmi-drop-bogus-check-at-closing-a-stream.patch alsa-hda-realtek-modify-eapd-in-the-alc886.patch alsa-hda-realtek-quirk-for-hp-spectre-x360-14-amp-setup.patch alsa-usb-audio-add-implicit-fb-quirk-for-boss-gp-10.patch alsa-usb-audio-correct-document-for-snd_usb_endpoint_free_all.patch alsa-usb-audio-don-t-avoid-stopping-the-stream-at-disconnection.patch alsa-usb-audio-handle-invalid-running-state-at-releasing-ep.patch alsa-usb-audio-more-strict-state-change-in-ep.patch arm64-dts-agilex-fix-phy-interface-bit-shift-for-gmac1-and-gmac2.patch arm64-ptrace-fix-seccomp-of-traced-syscall-1-no_syscall.patch asoc-siu-fix-build-error-by-a-wrong-const-prefix.patch bcache-give-btree_io_wq-correct-semantics-again.patch bcache-move-journal-work-to-new-flush-wq.patch blk-settings-align-max_sectors-on-logical_block_size-boundary.patch btrfs-abort-the-transaction-if-we-fail-to-inc-ref-in-btrfs_copy_root.patch btrfs-account-for-new-extents-being-deleted-in-total_bytes_pinned.patch btrfs-add-asserts-for-deleting-backref-cache-nodes.patch btrfs-do-not-cleanup-upper-nodes-in-btrfs_backref_cleanup_node.patch btrfs-do-not-warn-if-we-can-t-find-the-reloc-root-when-looking-up-backref.patch btrfs-fix-extent-buffer-leak-on-failure-to-copy-root.patch btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch btrfs-handle-space_info-total_bytes_pinned-inside-the-delayed-ref-itself.patch btrfs-splice-remaining-dirty_bg-s-onto-the-transaction-dirty-bg-list.patch cpufreq-acpi-set-cpuinfo.max_freq-directly-if-max-boost-is-known.patch crypto-aesni-prevent-misaligned-buffers-on-the-stack.patch crypto-arm64-sha-add-missing-module-aliases.patch crypto-michael_mic-fix-broken-misalignment-handling.patch crypto-sun4i-ss-checking-sg-length-is-not-sufficient.patch crypto-sun4i-ss-handle-bigendian-for-cipher.patch crypto-sun4i-ss-initialize-need_fallback.patch crypto-sun4i-ss-iv-register-does-not-work-on-a10-and-a13.patch drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch drm-amd-display-add-fpu-wrappers-to-dcn21_validate_bandwidth.patch drm-amd-display-add-vupdate_no_lock-interrupts-for-dcn2.1.patch drm-amd-display-remove-assert-from-dcn10_get_dig_frontend.patch drm-amdgpu-fix-cgts_tcc_disable-register-offset-on-gfx10.3.patch drm-amdgpu-fix-shutdown-and-poweroff-process-failed-with-s0ix.patch drm-amdgpu-set-reference-clock-to-100mhz-on-renoir-v2.patch drm-amdkfd-fix-recursive-lock-warnings.patch drm-i915-gt-correct-surface-base-address-for-renderclear.patch drm-i915-gt-flush-before-changing-register-state.patch drm-modes-switch-to-64bit-maths-to-avoid-integer-overflow.patch drm-nouveau-kms-handle-mdp-connectors.patch drm-panel-kd35t133-allow-using-non-continuous-dsi-clock.patch drm-rockchip-require-the-ytr-modifier-for-afbc.patch drm-sched-cancel-and-flush-all-outstanding-jobs-before-finish.patch drm-ttm-fix-a-memory-leak.patch dts64-mt7622-fix-slow-sd-card-access.patch erofs-initialized-fields-can-only-be-observed-after-bit-is-set.patch hid-logitech-dj-add-support-for-keyboard-events-in-equad-step-4-gaming.patch hid-wacom-ignore-attempts-to-overwrite-the-touch_max-value-from-hid.patch input-i8042-add-asus-zenbook-flip-to-noselftest-list.patch input-joydev-prevent-potential-read-overflow-in-ioctl.patch input-raydium_ts_i2c-do-not-send-zero-length.patch input-xpad-add-support-for-powera-enhanced-wired-controller-for-xbox-series-x-s.patch keys-trusted-fix-incorrect-handling-of-tpm_get_random.patch keys-trusted-fix-migratable-1-failing.patch keys-trusted-reserve-tpm-for-seal-and-unseal-operations.patch media-mceusb-fix-potential-out-of-bounds-shift.patch mips-compressed-fix-build-with-enabled-ubsan.patch mips-ingenic-disable-hptlb-for-d0-xburst-cpus-too.patch mips-support-binutils-configured-with-enable-mips-fix-loongson3-llsc-yes.patch mips-vdso-use-clang_flags-instead-of-filtering-out-target.patch misc-rtsx-init-of-rts522a-add-ocp-power-off-when-no-card-is-present.patch phy-lantiq-rcu-usb2-wait-after-clock-enable.patch pstore-fix-typo-in-compression-option-name.patch revert-bcache-kill-btree_io_wq.patch revert-drm-amd-display-reuse-current-context-instead-of-recreating-one.patch revert-drm-amd-display-update-nv1x-sr-latency-values.patch revert-mips-octeon-remove-special-handling-of-config_mips_elf_appended_dtb-y.patch scsi-sd-fix-opal-support.patch seccomp-add-missing-return-in-non-void-function.patch selinux-fix-inconsistency-between-inode_getxattr-and-inode_listsecurity.patch soc-samsung-exynos-asv-don-t-defer-early-on-not-supported-socs.patch soc-samsung-exynos-asv-handle-reading-revision-register-error.patch soundwire-intel-fix-possible-crash-when-no-device-is-detected.patch staging-gdm724x-fix-dma-from-stack.patch staging-mt7621-dma-mtk-hsdma.c-hsdma-mt7621.c.patch staging-rtl8188eu-add-edimax-ew-7811un-v2-to-device-table.patch tpm_tis-clean-up-locality-release.patch tpm_tis-fix-check_locality-for-correct-locality-acquisition.patch usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch usb-musb-fix-runtime-pm-race-in-musb_queue_resume_work.patch usb-serial-ftdi_sio-fix-ftx-sub-integer-prescaler.patch usb-serial-mos7720-fix-error-code-in-mos7720_write.patch usb-serial-mos7840-fix-error-code-in-mos7840_write.patch usb-serial-option-update-interface-mapping-for-zte-p685m.patch usb-serial-pl2303-fix-line-speed-handling-on-newer-chips.patch --- ...fter-configfs_register_default_group.patch | 53 + ...ix-fwnode-string-properties-matching.patch | 146 ++ ...c-status-register-of-latter-protocol.patch | 212 +++ ...a-hda-add-another-cometlake-h-pci-id.patch | 32 + ...drop-bogus-check-at-closing-a-stream.patch | 42 + ...da-realtek-modify-eapd-in-the-alc886.patch | 54 + ...irk-for-hp-spectre-x360-14-amp-setup.patch | 92 + ...add-implicit-fb-quirk-for-boss-gp-10.patch | 39 + ...cument-for-snd_usb_endpoint_free_all.patch | 33 + ...stopping-the-stream-at-disconnection.patch | 51 + ...nvalid-running-state-at-releasing-ep.patch | 150 ++ ...audio-more-strict-state-change-in-ep.patch | 161 ++ ...erface-bit-shift-for-gmac1-and-gmac2.patch | 40 + ...ccomp-of-traced-syscall-1-no_syscall.patch | 52 + ...-build-error-by-a-wrong-const-prefix.patch | 52 + ...-btree_io_wq-correct-semantics-again.patch | 38 + ...he-move-journal-work-to-new-flush-wq.patch | 98 ++ ...ctors-on-logical_block_size-boundary.patch | 68 + ...e-fail-to-inc-ref-in-btrfs_copy_root.patch | 56 + ...-being-deleted-in-total_bytes_pinned.patch | 122 ++ ...rts-for-deleting-backref-cache-nodes.patch | 179 ++ ...-nodes-in-btrfs_backref_cleanup_node.patch | 123 ++ ...e-reloc-root-when-looking-up-backref.patch | 42 + ...-buffer-leak-on-failure-to-copy-root.patch | 37 + ...k-with-0-ref-reloc-roots-on-recovery.patch | 48 + ...pinned-inside-the-delayed-ref-itself.patch | 489 +++++ ...s-onto-the-transaction-dirty-bg-list.patch | 115 ++ ..._freq-directly-if-max-boost-is-known.patch | 194 ++ ...vent-misaligned-buffers-on-the-stack.patch | 124 ++ ...arm64-sha-add-missing-module-aliases.patch | 77 + ...mic-fix-broken-misalignment-handling.patch | 141 ++ ...checking-sg-length-is-not-sufficient.patch | 40 + ...sun4i-ss-handle-bigendian-for-cipher.patch | 57 + ...to-sun4i-ss-initialize-need_fallback.patch | 32 + ...egister-does-not-work-on-a10-and-a13.patch | 101 ++ ...ig-queue-size-in-qp_host_alloc_queue.patch | 50 + ...wrappers-to-dcn21_validate_bandwidth.patch | 79 + ...update_no_lock-interrupts-for-dcn2.1.patch | 72 + ...e-assert-from-dcn10_get_dig_frontend.patch | 50 + ...c_disable-register-offset-on-gfx10.3.patch | 71 + ...nd-poweroff-process-failed-with-s0ix.patch | 89 + ...ference-clock-to-100mhz-on-renoir-v2.patch | 37 + ...m-amdkfd-fix-recursive-lock-warnings.patch | 40 + ...surface-base-address-for-renderclear.patch | 40 + ...flush-before-changing-register-state.patch | 42 + ...4bit-maths-to-avoid-integer-overflow.patch | 47 + ...rm-nouveau-kms-handle-mdp-connectors.patch | 50 + ...allow-using-non-continuous-dsi-clock.patch | 42 + ...ip-require-the-ytr-modifier-for-afbc.patch | 61 + ...h-all-outstanding-jobs-before-finish.patch | 36 + queue-5.11/drm-ttm-fix-a-memory-leak.patch | 62 + ...dts64-mt7622-fix-slow-sd-card-access.patch | 33 + ...an-only-be-observed-after-bit-is-set.patch | 82 + ...yboard-events-in-equad-step-4-gaming.patch | 44 + ...erwrite-the-touch_max-value-from-hid.patch | 67 + ...asus-zenbook-flip-to-noselftest-list.patch | 41 + ...ent-potential-read-overflow-in-ioctl.patch | 53 + ...ydium_ts_i2c-do-not-send-zero-length.patch | 40 + ...wired-controller-for-xbox-series-x-s.patch | 31 + ...incorrect-handling-of-tpm_get_random.patch | 91 + ...eys-trusted-fix-migratable-1-failing.patch | 46 + ...e-tpm-for-seal-and-unseal-operations.patch | 148 ++ ...sb-fix-potential-out-of-bounds-shift.patch | 36 + ...pressed-fix-build-with-enabled-ubsan.patch | 49 + ...disable-hptlb-for-d0-xburst-cpus-too.patch | 55 + ...h-enable-mips-fix-loongson3-llsc-yes.patch | 90 + ...lags-instead-of-filtering-out-target.patch | 63 + ...cp-power-off-when-no-card-is-present.patch | 34 + ...tiq-rcu-usb2-wait-after-clock-enable.patch | 49 + ...-fix-typo-in-compression-option-name.patch | 47 + .../revert-bcache-kill-btree_io_wq.patch | 115 ++ ...nt-context-instead-of-recreating-one.patch | 179 ++ ...isplay-update-nv1x-sr-latency-values.patch | 38 + ...ng-of-config_mips_elf_appended_dtb-y.patch | 51 + queue-5.11/scsi-sd-fix-opal-support.patch | 50 + ...-missing-return-in-non-void-function.patch | 34 + ...node_getxattr-and-inode_listsecurity.patch | 52 + queue-5.11/series | 93 + ...-t-defer-early-on-not-supported-socs.patch | 50 + ...ndle-reading-revision-register-error.patch | 40 + ...ble-crash-when-no-device-is-detected.patch | 100 ++ .../staging-gdm724x-fix-dma-from-stack.patch | 52 + ...t7621-dma-mtk-hsdma.c-hsdma-mt7621.c.patch | 1565 +++++++++++++++++ ...-edimax-ew-7811un-v2-to-device-table.patch | 30 + .../tpm_tis-clean-up-locality-release.patch | 95 + ...ity-for-correct-locality-acquisition.patch | 41 + ...dep-interval-for-fullspeed-interrupt.patch | 41 + ...t-fix-setting-of-depcfg.binterval_m1.patch | 43 + ...me-pm-race-in-musb_queue_resume_work.patch | 88 + ...di_sio-fix-ftx-sub-integer-prescaler.patch | 37 + ...7720-fix-error-code-in-mos7720_write.patch | 35 + ...7840-fix-error-code-in-mos7840_write.patch | 34 + ...date-interface-mapping-for-zte-p685m.patch | 78 + ...x-line-speed-handling-on-newer-chips.patch | 57 + 94 files changed, 8355 insertions(+) create mode 100644 queue-5.11/acpi-configfs-add-missing-check-after-configfs_register_default_group.patch create mode 100644 queue-5.11/acpi-property-fix-fwnode-string-properties-matching.patch create mode 100644 queue-5.11/alsa-fireface-fix-to-parse-sync-status-register-of-latter-protocol.patch create mode 100644 queue-5.11/alsa-hda-add-another-cometlake-h-pci-id.patch create mode 100644 queue-5.11/alsa-hda-hdmi-drop-bogus-check-at-closing-a-stream.patch create mode 100644 queue-5.11/alsa-hda-realtek-modify-eapd-in-the-alc886.patch create mode 100644 queue-5.11/alsa-hda-realtek-quirk-for-hp-spectre-x360-14-amp-setup.patch create mode 100644 queue-5.11/alsa-usb-audio-add-implicit-fb-quirk-for-boss-gp-10.patch create mode 100644 queue-5.11/alsa-usb-audio-correct-document-for-snd_usb_endpoint_free_all.patch create mode 100644 queue-5.11/alsa-usb-audio-don-t-avoid-stopping-the-stream-at-disconnection.patch create mode 100644 queue-5.11/alsa-usb-audio-handle-invalid-running-state-at-releasing-ep.patch create mode 100644 queue-5.11/alsa-usb-audio-more-strict-state-change-in-ep.patch create mode 100644 queue-5.11/arm64-dts-agilex-fix-phy-interface-bit-shift-for-gmac1-and-gmac2.patch create mode 100644 queue-5.11/arm64-ptrace-fix-seccomp-of-traced-syscall-1-no_syscall.patch create mode 100644 queue-5.11/asoc-siu-fix-build-error-by-a-wrong-const-prefix.patch create mode 100644 queue-5.11/bcache-give-btree_io_wq-correct-semantics-again.patch create mode 100644 queue-5.11/bcache-move-journal-work-to-new-flush-wq.patch create mode 100644 queue-5.11/blk-settings-align-max_sectors-on-logical_block_size-boundary.patch create mode 100644 queue-5.11/btrfs-abort-the-transaction-if-we-fail-to-inc-ref-in-btrfs_copy_root.patch create mode 100644 queue-5.11/btrfs-account-for-new-extents-being-deleted-in-total_bytes_pinned.patch create mode 100644 queue-5.11/btrfs-add-asserts-for-deleting-backref-cache-nodes.patch create mode 100644 queue-5.11/btrfs-do-not-cleanup-upper-nodes-in-btrfs_backref_cleanup_node.patch create mode 100644 queue-5.11/btrfs-do-not-warn-if-we-can-t-find-the-reloc-root-when-looking-up-backref.patch create mode 100644 queue-5.11/btrfs-fix-extent-buffer-leak-on-failure-to-copy-root.patch create mode 100644 queue-5.11/btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch create mode 100644 queue-5.11/btrfs-handle-space_info-total_bytes_pinned-inside-the-delayed-ref-itself.patch create mode 100644 queue-5.11/btrfs-splice-remaining-dirty_bg-s-onto-the-transaction-dirty-bg-list.patch create mode 100644 queue-5.11/cpufreq-acpi-set-cpuinfo.max_freq-directly-if-max-boost-is-known.patch create mode 100644 queue-5.11/crypto-aesni-prevent-misaligned-buffers-on-the-stack.patch create mode 100644 queue-5.11/crypto-arm64-sha-add-missing-module-aliases.patch create mode 100644 queue-5.11/crypto-michael_mic-fix-broken-misalignment-handling.patch create mode 100644 queue-5.11/crypto-sun4i-ss-checking-sg-length-is-not-sufficient.patch create mode 100644 queue-5.11/crypto-sun4i-ss-handle-bigendian-for-cipher.patch create mode 100644 queue-5.11/crypto-sun4i-ss-initialize-need_fallback.patch create mode 100644 queue-5.11/crypto-sun4i-ss-iv-register-does-not-work-on-a10-and-a13.patch create mode 100644 queue-5.11/drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch create mode 100644 queue-5.11/drm-amd-display-add-fpu-wrappers-to-dcn21_validate_bandwidth.patch create mode 100644 queue-5.11/drm-amd-display-add-vupdate_no_lock-interrupts-for-dcn2.1.patch create mode 100644 queue-5.11/drm-amd-display-remove-assert-from-dcn10_get_dig_frontend.patch create mode 100644 queue-5.11/drm-amdgpu-fix-cgts_tcc_disable-register-offset-on-gfx10.3.patch create mode 100644 queue-5.11/drm-amdgpu-fix-shutdown-and-poweroff-process-failed-with-s0ix.patch create mode 100644 queue-5.11/drm-amdgpu-set-reference-clock-to-100mhz-on-renoir-v2.patch create mode 100644 queue-5.11/drm-amdkfd-fix-recursive-lock-warnings.patch create mode 100644 queue-5.11/drm-i915-gt-correct-surface-base-address-for-renderclear.patch create mode 100644 queue-5.11/drm-i915-gt-flush-before-changing-register-state.patch create mode 100644 queue-5.11/drm-modes-switch-to-64bit-maths-to-avoid-integer-overflow.patch create mode 100644 queue-5.11/drm-nouveau-kms-handle-mdp-connectors.patch create mode 100644 queue-5.11/drm-panel-kd35t133-allow-using-non-continuous-dsi-clock.patch create mode 100644 queue-5.11/drm-rockchip-require-the-ytr-modifier-for-afbc.patch create mode 100644 queue-5.11/drm-sched-cancel-and-flush-all-outstanding-jobs-before-finish.patch create mode 100644 queue-5.11/drm-ttm-fix-a-memory-leak.patch create mode 100644 queue-5.11/dts64-mt7622-fix-slow-sd-card-access.patch create mode 100644 queue-5.11/erofs-initialized-fields-can-only-be-observed-after-bit-is-set.patch create mode 100644 queue-5.11/hid-logitech-dj-add-support-for-keyboard-events-in-equad-step-4-gaming.patch create mode 100644 queue-5.11/hid-wacom-ignore-attempts-to-overwrite-the-touch_max-value-from-hid.patch create mode 100644 queue-5.11/input-i8042-add-asus-zenbook-flip-to-noselftest-list.patch create mode 100644 queue-5.11/input-joydev-prevent-potential-read-overflow-in-ioctl.patch create mode 100644 queue-5.11/input-raydium_ts_i2c-do-not-send-zero-length.patch create mode 100644 queue-5.11/input-xpad-add-support-for-powera-enhanced-wired-controller-for-xbox-series-x-s.patch create mode 100644 queue-5.11/keys-trusted-fix-incorrect-handling-of-tpm_get_random.patch create mode 100644 queue-5.11/keys-trusted-fix-migratable-1-failing.patch create mode 100644 queue-5.11/keys-trusted-reserve-tpm-for-seal-and-unseal-operations.patch create mode 100644 queue-5.11/media-mceusb-fix-potential-out-of-bounds-shift.patch create mode 100644 queue-5.11/mips-compressed-fix-build-with-enabled-ubsan.patch create mode 100644 queue-5.11/mips-ingenic-disable-hptlb-for-d0-xburst-cpus-too.patch create mode 100644 queue-5.11/mips-support-binutils-configured-with-enable-mips-fix-loongson3-llsc-yes.patch create mode 100644 queue-5.11/mips-vdso-use-clang_flags-instead-of-filtering-out-target.patch create mode 100644 queue-5.11/misc-rtsx-init-of-rts522a-add-ocp-power-off-when-no-card-is-present.patch create mode 100644 queue-5.11/phy-lantiq-rcu-usb2-wait-after-clock-enable.patch create mode 100644 queue-5.11/pstore-fix-typo-in-compression-option-name.patch create mode 100644 queue-5.11/revert-bcache-kill-btree_io_wq.patch create mode 100644 queue-5.11/revert-drm-amd-display-reuse-current-context-instead-of-recreating-one.patch create mode 100644 queue-5.11/revert-drm-amd-display-update-nv1x-sr-latency-values.patch create mode 100644 queue-5.11/revert-mips-octeon-remove-special-handling-of-config_mips_elf_appended_dtb-y.patch create mode 100644 queue-5.11/scsi-sd-fix-opal-support.patch create mode 100644 queue-5.11/seccomp-add-missing-return-in-non-void-function.patch create mode 100644 queue-5.11/selinux-fix-inconsistency-between-inode_getxattr-and-inode_listsecurity.patch create mode 100644 queue-5.11/soc-samsung-exynos-asv-don-t-defer-early-on-not-supported-socs.patch create mode 100644 queue-5.11/soc-samsung-exynos-asv-handle-reading-revision-register-error.patch create mode 100644 queue-5.11/soundwire-intel-fix-possible-crash-when-no-device-is-detected.patch create mode 100644 queue-5.11/staging-gdm724x-fix-dma-from-stack.patch create mode 100644 queue-5.11/staging-mt7621-dma-mtk-hsdma.c-hsdma-mt7621.c.patch create mode 100644 queue-5.11/staging-rtl8188eu-add-edimax-ew-7811un-v2-to-device-table.patch create mode 100644 queue-5.11/tpm_tis-clean-up-locality-release.patch create mode 100644 queue-5.11/tpm_tis-fix-check_locality-for-correct-locality-acquisition.patch create mode 100644 queue-5.11/usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch create mode 100644 queue-5.11/usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch create mode 100644 queue-5.11/usb-musb-fix-runtime-pm-race-in-musb_queue_resume_work.patch create mode 100644 queue-5.11/usb-serial-ftdi_sio-fix-ftx-sub-integer-prescaler.patch create mode 100644 queue-5.11/usb-serial-mos7720-fix-error-code-in-mos7720_write.patch create mode 100644 queue-5.11/usb-serial-mos7840-fix-error-code-in-mos7840_write.patch create mode 100644 queue-5.11/usb-serial-option-update-interface-mapping-for-zte-p685m.patch create mode 100644 queue-5.11/usb-serial-pl2303-fix-line-speed-handling-on-newer-chips.patch diff --git a/queue-5.11/acpi-configfs-add-missing-check-after-configfs_register_default_group.patch b/queue-5.11/acpi-configfs-add-missing-check-after-configfs_register_default_group.patch new file mode 100644 index 00000000000..3a6b605fd90 --- /dev/null +++ b/queue-5.11/acpi-configfs-add-missing-check-after-configfs_register_default_group.patch @@ -0,0 +1,53 @@ +From 67e40054de86aae520ddc2a072d7f6951812a14f Mon Sep 17 00:00:00 2001 +From: Qinglang Miao +Date: Fri, 15 Jan 2021 10:22:50 +0800 +Subject: ACPI: configfs: add missing check after configfs_register_default_group() + +From: Qinglang Miao + +commit 67e40054de86aae520ddc2a072d7f6951812a14f upstream. + +A list_add corruption is reported by Hulk Robot like this: +============== +list_add corruption. +Call Trace: +link_obj+0xc0/0x1c0 +link_group+0x21/0x140 +configfs_register_subsystem+0xdb/0x380 +acpi_configfs_init+0x25/0x1000 [acpi_configfs] +do_one_initcall+0x149/0x820 +do_init_module+0x1ef/0x720 +load_module+0x35c8/0x4380 +__do_sys_finit_module+0x10d/0x1a0 +do_syscall_64+0x34/0x80 + +It's because of the missing check after configfs_register_default_group, +where configfs_unregister_subsystem should be called once failure. + +Fixes: 612bd01fc6e0 ("ACPI: add support for loading SSDTs via configfs") +Reported-by: Hulk Robot +Suggested-by: Hanjun Guo +Signed-off-by: Qinglang Miao +Cc: 4.10+ # 4.10+ +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/acpi_configfs.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/acpi/acpi_configfs.c ++++ b/drivers/acpi/acpi_configfs.c +@@ -268,7 +268,12 @@ static int __init acpi_configfs_init(voi + + acpi_table_group = configfs_register_default_group(root, "table", + &acpi_tables_type); +- return PTR_ERR_OR_ZERO(acpi_table_group); ++ if (IS_ERR(acpi_table_group)) { ++ configfs_unregister_subsystem(&acpi_configfs); ++ return PTR_ERR(acpi_table_group); ++ } ++ ++ return 0; + } + module_init(acpi_configfs_init); + diff --git a/queue-5.11/acpi-property-fix-fwnode-string-properties-matching.patch b/queue-5.11/acpi-property-fix-fwnode-string-properties-matching.patch new file mode 100644 index 00000000000..9446d731341 --- /dev/null +++ b/queue-5.11/acpi-property-fix-fwnode-string-properties-matching.patch @@ -0,0 +1,146 @@ +From e1e6bd2995ac0e1ad0c2a2d906a06f59ce2ed293 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Thu, 11 Feb 2021 19:30:01 +0100 +Subject: ACPI: property: Fix fwnode string properties matching + +From: Rafael J. Wysocki + +commit e1e6bd2995ac0e1ad0c2a2d906a06f59ce2ed293 upstream. + +Property matching does not work for ACPI fwnodes if the value of the +given property is not represented as a package in the _DSD package +containing it. For example, the "compatible" property in the _DSD +below + + Name (_DSD, Package () { + ToUUID("daffd814-6eba-4d8c-8a91-bc9bbf4aa301"), + Package () { + Package () {"compatible", "ethernet-phy-ieee802.3-c45"} + } + }) + +will not be found by fwnode_property_match_string(), because the ACPI +code handling device properties does not regard the single value as a +"list" in that case. + +Namely, fwnode_property_match_string() invoked to match a given +string property value first calls fwnode_property_read_string_array() +with the last two arguments equal to NULL and 0, respectively, in +order to count the items in the value of the given property, with the +assumption that this value may be an array. For ACPI fwnodes, that +operation is carried out by acpi_node_prop_read() which calls +acpi_data_prop_read() for this purpose. However, when the return +(val) pointer is NULL, that function only looks for a property whose +value is a package without checking the single-value case at all. + +To fix that, make acpi_data_prop_read() check the single-value +case if its return pointer argument is NULL and modify +acpi_data_prop_read_single() handling that case to attempt to +read the value of the property if the return pointer is NULL +and return 1 if that succeeds. + +Fixes: 3708184afc77 ("device property: Move FW type specific functionality to FW specific files") +Reported-by: Calvin Johnson +Cc: 4.13+ # 4.13+ +Signed-off-by: Rafael J. Wysocki +Reviewed-by: Sakari Ailus +Reviewed-by: Mika Westerberg +Reviewed-by: Andy Shevchenko +Signed-off-by: Greg Kroah-Hartman +--- + drivers/acpi/property.c | 44 +++++++++++++++++++++++++++++++++----------- + 1 file changed, 33 insertions(+), 11 deletions(-) + +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -787,9 +787,6 @@ static int acpi_data_prop_read_single(co + const union acpi_object *obj; + int ret; + +- if (!val) +- return -EINVAL; +- + if (proptype >= DEV_PROP_U8 && proptype <= DEV_PROP_U64) { + ret = acpi_data_get_property(data, propname, ACPI_TYPE_INTEGER, &obj); + if (ret) +@@ -799,28 +796,43 @@ static int acpi_data_prop_read_single(co + case DEV_PROP_U8: + if (obj->integer.value > U8_MAX) + return -EOVERFLOW; +- *(u8 *)val = obj->integer.value; ++ ++ if (val) ++ *(u8 *)val = obj->integer.value; ++ + break; + case DEV_PROP_U16: + if (obj->integer.value > U16_MAX) + return -EOVERFLOW; +- *(u16 *)val = obj->integer.value; ++ ++ if (val) ++ *(u16 *)val = obj->integer.value; ++ + break; + case DEV_PROP_U32: + if (obj->integer.value > U32_MAX) + return -EOVERFLOW; +- *(u32 *)val = obj->integer.value; ++ ++ if (val) ++ *(u32 *)val = obj->integer.value; ++ + break; + default: +- *(u64 *)val = obj->integer.value; ++ if (val) ++ *(u64 *)val = obj->integer.value; ++ + break; + } ++ ++ if (!val) ++ return 1; + } else if (proptype == DEV_PROP_STRING) { + ret = acpi_data_get_property(data, propname, ACPI_TYPE_STRING, &obj); + if (ret) + return ret; + +- *(char **)val = obj->string.pointer; ++ if (val) ++ *(char **)val = obj->string.pointer; + + return 1; + } else { +@@ -834,7 +846,7 @@ int acpi_dev_prop_read_single(struct acp + { + int ret; + +- if (!adev) ++ if (!adev || !val) + return -EINVAL; + + ret = acpi_data_prop_read_single(&adev->data, propname, proptype, val); +@@ -928,10 +940,20 @@ static int acpi_data_prop_read(const str + const union acpi_object *items; + int ret; + +- if (val && nval == 1) { ++ if (nval == 1 || !val) { + ret = acpi_data_prop_read_single(data, propname, proptype, val); +- if (ret >= 0) ++ /* ++ * The overflow error means that the property is there and it is ++ * single-value, but its type does not match, so return. ++ */ ++ if (ret >= 0 || ret == -EOVERFLOW) + return ret; ++ ++ /* ++ * Reading this property as a single-value one failed, but its ++ * value may still be represented as one-element array, so ++ * continue. ++ */ + } + + ret = acpi_data_get_property_array(data, propname, ACPI_TYPE_ANY, &obj); diff --git a/queue-5.11/alsa-fireface-fix-to-parse-sync-status-register-of-latter-protocol.patch b/queue-5.11/alsa-fireface-fix-to-parse-sync-status-register-of-latter-protocol.patch new file mode 100644 index 00000000000..005ace3cd22 --- /dev/null +++ b/queue-5.11/alsa-fireface-fix-to-parse-sync-status-register-of-latter-protocol.patch @@ -0,0 +1,212 @@ +From c50bfc8a6866775be39d7e747e83e8a5a9051e2e Mon Sep 17 00:00:00 2001 +From: Takashi Sakamoto +Date: Mon, 8 Feb 2021 00:47:36 +0900 +Subject: ALSA: fireface: fix to parse sync status register of latter protocol + +From: Takashi Sakamoto + +commit c50bfc8a6866775be39d7e747e83e8a5a9051e2e upstream. + +Fireface UCX, UFX, and FF802 are categorized for latter protocol of the +series. Current support for FF802 (and UFX) includes failure to parse +sync status register and results in EIO. + +Further investigation figures out that the content of register differs +depending on models. This commit adds tables specific to FF802 and UFX +to fix it. + +Fixes: 062bb452b078b ("ALSA: fireface: add support for RME FireFace 802") +Cc: +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210207154736.229551-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/firewire/fireface/ff-protocol-latter.c | 118 ++++++++++++++++++++++----- + 1 file changed, 100 insertions(+), 18 deletions(-) + +--- a/sound/firewire/fireface/ff-protocol-latter.c ++++ b/sound/firewire/fireface/ff-protocol-latter.c +@@ -15,6 +15,61 @@ + #define LATTER_FETCH_MODE 0xffff00000010ULL + #define LATTER_SYNC_STATUS 0x0000801c0000ULL + ++// The content of sync status register differs between models. ++// ++// Fireface UCX: ++// 0xf0000000: (unidentified) ++// 0x0f000000: effective rate of sampling clock ++// 0x00f00000: detected rate of word clock on BNC interface ++// 0x000f0000: detected rate of ADAT or S/PDIF on optical interface ++// 0x0000f000: detected rate of S/PDIF on coaxial interface ++// 0x00000e00: effective source of sampling clock ++// 0x00000e00: Internal ++// 0x00000800: (unidentified) ++// 0x00000600: Word clock on BNC interface ++// 0x00000400: ADAT on optical interface ++// 0x00000200: S/PDIF on coaxial or optical interface ++// 0x00000100: Optical interface is used for ADAT signal ++// 0x00000080: (unidentified) ++// 0x00000040: Synchronized to word clock on BNC interface ++// 0x00000020: Synchronized to ADAT or S/PDIF on optical interface ++// 0x00000010: Synchronized to S/PDIF on coaxial interface ++// 0x00000008: (unidentified) ++// 0x00000004: Lock word clock on BNC interface ++// 0x00000002: Lock ADAT or S/PDIF on optical interface ++// 0x00000001: Lock S/PDIF on coaxial interface ++// ++// Fireface 802 (and perhaps UFX): ++// 0xf0000000: effective rate of sampling clock ++// 0x0f000000: detected rate of ADAT-B on 2nd optical interface ++// 0x00f00000: detected rate of ADAT-A on 1st optical interface ++// 0x000f0000: detected rate of AES/EBU on XLR or coaxial interface ++// 0x0000f000: detected rate of word clock on BNC interface ++// 0x00000e00: effective source of sampling clock ++// 0x00000e00: internal ++// 0x00000800: ADAT-B ++// 0x00000600: ADAT-A ++// 0x00000400: AES/EBU ++// 0x00000200: Word clock ++// 0x00000080: Synchronized to ADAT-B on 2nd optical interface ++// 0x00000040: Synchronized to ADAT-A on 1st optical interface ++// 0x00000020: Synchronized to AES/EBU on XLR or 2nd optical interface ++// 0x00000010: Synchronized to word clock on BNC interface ++// 0x00000008: Lock ADAT-B on 2nd optical interface ++// 0x00000004: Lock ADAT-A on 1st optical interface ++// 0x00000002: Lock AES/EBU on XLR or 2nd optical interface ++// 0x00000001: Lock word clock on BNC interface ++// ++// The pattern for rate bits: ++// 0x00: 32.0 kHz ++// 0x01: 44.1 kHz ++// 0x02: 48.0 kHz ++// 0x04: 64.0 kHz ++// 0x05: 88.2 kHz ++// 0x06: 96.0 kHz ++// 0x08: 128.0 kHz ++// 0x09: 176.4 kHz ++// 0x0a: 192.0 kHz + static int parse_clock_bits(u32 data, unsigned int *rate, + enum snd_ff_clock_src *src, + enum snd_ff_unit_version unit_version) +@@ -23,35 +78,48 @@ static int parse_clock_bits(u32 data, un + unsigned int rate; + u32 flag; + } *rate_entry, rate_entries[] = { +- { 32000, 0x00000000, }, +- { 44100, 0x01000000, }, +- { 48000, 0x02000000, }, +- { 64000, 0x04000000, }, +- { 88200, 0x05000000, }, +- { 96000, 0x06000000, }, +- { 128000, 0x08000000, }, +- { 176400, 0x09000000, }, +- { 192000, 0x0a000000, }, ++ { 32000, 0x00, }, ++ { 44100, 0x01, }, ++ { 48000, 0x02, }, ++ { 64000, 0x04, }, ++ { 88200, 0x05, }, ++ { 96000, 0x06, }, ++ { 128000, 0x08, }, ++ { 176400, 0x09, }, ++ { 192000, 0x0a, }, + }; + static const struct { + enum snd_ff_clock_src src; + u32 flag; +- } *clk_entry, clk_entries[] = { ++ } *clk_entry, *clk_entries, ucx_clk_entries[] = { + { SND_FF_CLOCK_SRC_SPDIF, 0x00000200, }, + { SND_FF_CLOCK_SRC_ADAT1, 0x00000400, }, + { SND_FF_CLOCK_SRC_WORD, 0x00000600, }, + { SND_FF_CLOCK_SRC_INTERNAL, 0x00000e00, }, ++ }, ufx_ff802_clk_entries[] = { ++ { SND_FF_CLOCK_SRC_WORD, 0x00000200, }, ++ { SND_FF_CLOCK_SRC_SPDIF, 0x00000400, }, ++ { SND_FF_CLOCK_SRC_ADAT1, 0x00000600, }, ++ { SND_FF_CLOCK_SRC_ADAT2, 0x00000800, }, ++ { SND_FF_CLOCK_SRC_INTERNAL, 0x00000e00, }, + }; ++ u32 rate_bits; ++ unsigned int clk_entry_count; + int i; + +- if (unit_version != SND_FF_UNIT_VERSION_UCX) { +- // e.g. 0x00fe0f20 but expected 0x00eff002. +- data = ((data & 0xf0f0f0f0) >> 4) | ((data & 0x0f0f0f0f) << 4); ++ if (unit_version == SND_FF_UNIT_VERSION_UCX) { ++ rate_bits = (data & 0x0f000000) >> 24; ++ clk_entries = ucx_clk_entries; ++ clk_entry_count = ARRAY_SIZE(ucx_clk_entries); ++ } else { ++ rate_bits = (data & 0xf0000000) >> 28; ++ clk_entries = ufx_ff802_clk_entries; ++ clk_entry_count = ARRAY_SIZE(ufx_ff802_clk_entries); + } + + for (i = 0; i < ARRAY_SIZE(rate_entries); ++i) { + rate_entry = rate_entries + i; +- if ((data & 0x0f000000) == rate_entry->flag) { ++ if (rate_bits == rate_entry->flag) { + *rate = rate_entry->rate; + break; + } +@@ -59,14 +127,14 @@ static int parse_clock_bits(u32 data, un + if (i == ARRAY_SIZE(rate_entries)) + return -EIO; + +- for (i = 0; i < ARRAY_SIZE(clk_entries); ++i) { ++ for (i = 0; i < clk_entry_count; ++i) { + clk_entry = clk_entries + i; + if ((data & 0x000e00) == clk_entry->flag) { + *src = clk_entry->src; + break; + } + } +- if (i == ARRAY_SIZE(clk_entries)) ++ if (i == clk_entry_count) + return -EIO; + + return 0; +@@ -249,16 +317,22 @@ static void latter_dump_status(struct sn + char *const label; + u32 locked_mask; + u32 synced_mask; +- } *clk_entry, clk_entries[] = { ++ } *clk_entry, *clk_entries, ucx_clk_entries[] = { + { "S/PDIF", 0x00000001, 0x00000010, }, + { "ADAT", 0x00000002, 0x00000020, }, + { "WDClk", 0x00000004, 0x00000040, }, ++ }, ufx_ff802_clk_entries[] = { ++ { "WDClk", 0x00000001, 0x00000010, }, ++ { "AES/EBU", 0x00000002, 0x00000020, }, ++ { "ADAT-A", 0x00000004, 0x00000040, }, ++ { "ADAT-B", 0x00000008, 0x00000080, }, + }; + __le32 reg; + u32 data; + unsigned int rate; + enum snd_ff_clock_src src; + const char *label; ++ unsigned int clk_entry_count; + int i; + int err; + +@@ -270,7 +344,15 @@ static void latter_dump_status(struct sn + + snd_iprintf(buffer, "External source detection:\n"); + +- for (i = 0; i < ARRAY_SIZE(clk_entries); ++i) { ++ if (ff->unit_version == SND_FF_UNIT_VERSION_UCX) { ++ clk_entries = ucx_clk_entries; ++ clk_entry_count = ARRAY_SIZE(ucx_clk_entries); ++ } else { ++ clk_entries = ufx_ff802_clk_entries; ++ clk_entry_count = ARRAY_SIZE(ufx_ff802_clk_entries); ++ } ++ ++ for (i = 0; i < clk_entry_count; ++i) { + clk_entry = clk_entries + i; + snd_iprintf(buffer, "%s: ", clk_entry->label); + if (data & clk_entry->locked_mask) { diff --git a/queue-5.11/alsa-hda-add-another-cometlake-h-pci-id.patch b/queue-5.11/alsa-hda-add-another-cometlake-h-pci-id.patch new file mode 100644 index 00000000000..a0e192c43b8 --- /dev/null +++ b/queue-5.11/alsa-hda-add-another-cometlake-h-pci-id.patch @@ -0,0 +1,32 @@ +From 0d3070f5e6551d8a759619e85736e49a3bf40398 Mon Sep 17 00:00:00 2001 +From: Kai Vehmanen +Date: Fri, 12 Feb 2021 17:10:22 +0200 +Subject: ALSA: hda: Add another CometLake-H PCI ID + +From: Kai Vehmanen + +commit 0d3070f5e6551d8a759619e85736e49a3bf40398 upstream. + +Add one more HD Audio PCI ID for CometLake-H PCH. + +Signed-off-by: Kai Vehmanen +Reviewed-by: Pierre-Louis Bossart +Cc: +Link: https://lore.kernel.org/r/20210212151022.2568567-1-kai.vehmanen@linux.intel.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/hda_intel.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2481,6 +2481,8 @@ static const struct pci_device_id azx_id + /* CometLake-H */ + { PCI_DEVICE(0x8086, 0x06C8), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, ++ { PCI_DEVICE(0x8086, 0xf1c8), ++ .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, + /* CometLake-S */ + { PCI_DEVICE(0x8086, 0xa3f0), + .driver_data = AZX_DRIVER_SKL | AZX_DCAPS_INTEL_SKYLAKE}, diff --git a/queue-5.11/alsa-hda-hdmi-drop-bogus-check-at-closing-a-stream.patch b/queue-5.11/alsa-hda-hdmi-drop-bogus-check-at-closing-a-stream.patch new file mode 100644 index 00000000000..fdfaf0bb936 --- /dev/null +++ b/queue-5.11/alsa-hda-hdmi-drop-bogus-check-at-closing-a-stream.patch @@ -0,0 +1,42 @@ +From 056a3da5d07fc5d3ceacfa2cdf013c9d8df630bd Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Thu, 11 Feb 2021 09:31:39 +0100 +Subject: ALSA: hda/hdmi: Drop bogus check at closing a stream + +From: Takashi Iwai + +commit 056a3da5d07fc5d3ceacfa2cdf013c9d8df630bd upstream. + +Some users reported the kernel WARNING with stack traces from +hdmi_pcm_close(), and it's the line checking the per_cvt->assigned +flag. This used to be a valid check in the past because the flag was +turned on/off only at opening and closing a PCM stream. Meanwhile, +since the introduction of the silent-stream mode, this flag may be +turned on/off at the monitor connection/disconnection time, which +isn't always associated with the PCM open/close. Hence this may lead +to the inconsistent per_cvt->assigned flag at closing. + +As the check itself became almost useless and confuses users as if it +were a serious problem, just drop the check. + +Fixes: b1a5039759cb ("ALSA: hda/hdmi: fix silent stream for first playback to DP") +Cc: +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210987 +Reviewed-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20210211083139.29531-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_hdmi.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -2130,7 +2130,6 @@ static int hdmi_pcm_close(struct hda_pcm + goto unlock; + } + per_cvt = get_cvt(spec, cvt_idx); +- snd_BUG_ON(!per_cvt->assigned); + per_cvt->assigned = 0; + hinfo->nid = 0; + diff --git a/queue-5.11/alsa-hda-realtek-modify-eapd-in-the-alc886.patch b/queue-5.11/alsa-hda-realtek-modify-eapd-in-the-alc886.patch new file mode 100644 index 00000000000..bcb7ba7ee88 --- /dev/null +++ b/queue-5.11/alsa-hda-realtek-modify-eapd-in-the-alc886.patch @@ -0,0 +1,54 @@ +From 4841b8e6318a7f0ae57c4e5ec09032ea057c97a8 Mon Sep 17 00:00:00 2001 +From: PeiSen Hou +Date: Tue, 2 Feb 2021 10:30:22 +0100 +Subject: ALSA: hda/realtek: modify EAPD in the ALC886 + +From: PeiSen Hou + +commit 4841b8e6318a7f0ae57c4e5ec09032ea057c97a8 upstream. + +Modify 0x20 index 7 bit 5 to 1, make the 0x15 EAPD the same as 0x14. + +Signed-off-by: PeiSen Hou +Cc: +Link: https://lore.kernel.org/r/e62c5058957f48d8b8953e97135ff108@realtek.com +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -1905,6 +1905,7 @@ enum { + ALC889_FIXUP_FRONT_HP_NO_PRESENCE, + ALC889_FIXUP_VAIO_TT, + ALC888_FIXUP_EEE1601, ++ ALC886_FIXUP_EAPD, + ALC882_FIXUP_EAPD, + ALC883_FIXUP_EAPD, + ALC883_FIXUP_ACER_EAPD, +@@ -2238,6 +2239,15 @@ static const struct hda_fixup alc882_fix + { } + } + }, ++ [ALC886_FIXUP_EAPD] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ /* change to EAPD mode */ ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x07 }, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x0068 }, ++ { } ++ } ++ }, + [ALC882_FIXUP_EAPD] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -2510,6 +2520,7 @@ static const struct snd_pci_quirk alc882 + SND_PCI_QUIRK(0x106b, 0x4a00, "Macbook 5,2", ALC889_FIXUP_MBA11_VREF), + + SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC882_FIXUP_EAPD), ++ SND_PCI_QUIRK(0x13fe, 0x1009, "Advantech MIT-W101", ALC886_FIXUP_EAPD), + SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte EP45-DS3/Z87X-UD3H", ALC889_FIXUP_FRONT_HP_NO_PRESENCE), + SND_PCI_QUIRK(0x1458, 0xa0b8, "Gigabyte AZ370-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS), + SND_PCI_QUIRK(0x1458, 0xa0cd, "Gigabyte X570 Aorus Master", ALC1220_FIXUP_CLEVO_P950), diff --git a/queue-5.11/alsa-hda-realtek-quirk-for-hp-spectre-x360-14-amp-setup.patch b/queue-5.11/alsa-hda-realtek-quirk-for-hp-spectre-x360-14-amp-setup.patch new file mode 100644 index 00000000000..5a8f5593b93 --- /dev/null +++ b/queue-5.11/alsa-hda-realtek-quirk-for-hp-spectre-x360-14-amp-setup.patch @@ -0,0 +1,92 @@ +From c3bb2b521944ffbbc8c24b849f81977a9915fb5e Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Mon, 15 Feb 2021 09:25:40 +0100 +Subject: ALSA: hda/realtek: Quirk for HP Spectre x360 14 amp setup + +From: Takashi Iwai + +commit c3bb2b521944ffbbc8c24b849f81977a9915fb5e upstream. + +HP Spectre x360 14 model (PCI SSID 103c:87f7) seems requiring a unique +setup for its external amp: the GPIO0 needs to be toggled on and off +shortly at each device initialization via runtime PM. + +This patch implements that workaround as well as the model option +string, so that users with other devices may try the same workaround +more easily. + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=210633 +Cc: +Link: https://lore.kernel.org/r/20210215082540.4520-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/pci/hda/patch_realtek.c | 29 +++++++++++++++++++++++++++++ + 1 file changed, 29 insertions(+) + +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4291,6 +4291,28 @@ static void alc280_fixup_hp_gpio4(struct + } + } + ++/* HP Spectre x360 14 model needs a unique workaround for enabling the amp; ++ * it needs to toggle the GPIO0 once on and off at each time (bko#210633) ++ */ ++static void alc245_fixup_hp_x360_amp(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ struct alc_spec *spec = codec->spec; ++ ++ switch (action) { ++ case HDA_FIXUP_ACT_PRE_PROBE: ++ spec->gpio_mask |= 0x01; ++ spec->gpio_dir |= 0x01; ++ break; ++ case HDA_FIXUP_ACT_INIT: ++ /* need to toggle GPIO to enable the amp */ ++ alc_update_gpio_data(codec, 0x01, true); ++ msleep(100); ++ alc_update_gpio_data(codec, 0x01, false); ++ break; ++ } ++} ++ + static void alc_update_coef_led(struct hda_codec *codec, + struct alc_coef_led *led, + bool polarity, bool on) +@@ -6277,6 +6299,7 @@ enum { + ALC280_FIXUP_HP_DOCK_PINS, + ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, + ALC280_FIXUP_HP_9480M, ++ ALC245_FIXUP_HP_X360_AMP, + ALC288_FIXUP_DELL_HEADSET_MODE, + ALC288_FIXUP_DELL1_MIC_NO_PRESENCE, + ALC288_FIXUP_DELL_XPS_13, +@@ -6982,6 +7005,10 @@ static const struct hda_fixup alc269_fix + .type = HDA_FIXUP_FUNC, + .v.func = alc280_fixup_hp_9480m, + }, ++ [ALC245_FIXUP_HP_X360_AMP] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc245_fixup_hp_x360_amp, ++ }, + [ALC288_FIXUP_DELL_HEADSET_MODE] = { + .type = HDA_FIXUP_FUNC, + .v.func = alc_fixup_headset_mode_dell_alc288, +@@ -7996,6 +8023,7 @@ static const struct snd_pci_quirk alc269 + SND_PCI_QUIRK(0x103c, 0x87c8, "HP", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87f4, "HP", ALC287_FIXUP_HP_GPIO_LED), + SND_PCI_QUIRK(0x103c, 0x87f5, "HP", ALC287_FIXUP_HP_GPIO_LED), ++ SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP), + SND_PCI_QUIRK(0x1043, 0x103e, "ASUS X540SA", ALC256_FIXUP_ASUS_MIC), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), +@@ -8368,6 +8396,7 @@ static const struct hda_model_fixup alc2 + {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, + {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"}, + {.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"}, ++ {.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"}, + {} + }; + #define ALC225_STANDARD_PINS \ diff --git a/queue-5.11/alsa-usb-audio-add-implicit-fb-quirk-for-boss-gp-10.patch b/queue-5.11/alsa-usb-audio-add-implicit-fb-quirk-for-boss-gp-10.patch new file mode 100644 index 00000000000..96b83db13c4 --- /dev/null +++ b/queue-5.11/alsa-usb-audio-add-implicit-fb-quirk-for-boss-gp-10.patch @@ -0,0 +1,39 @@ +From 15447b64789d9ade71eb374d5ae1f37d0bbce0bd Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sun, 14 Feb 2021 16:42:51 +0100 +Subject: ALSA: usb-audio: Add implicit fb quirk for BOSS GP-10 + +From: Takashi Iwai + +commit 15447b64789d9ade71eb374d5ae1f37d0bbce0bd upstream. + +BOSS GP-10 with 0582:0185 requires the similar quirk to make the +implicit feedback working like other BOSS devices. + +Reported-by: Keith Milner +Cc: +Link: https://lore.kernel.org/r/20210214154251.10750-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/implicit.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/sound/usb/implicit.c ++++ b/sound/usb/implicit.c +@@ -73,6 +73,7 @@ static const struct snd_usb_implicit_fb_ + /* No quirk for playback but with capture quirk (see below) */ + IMPLICIT_FB_SKIP_DEV(0x0582, 0x0130), /* BOSS BR-80 */ + IMPLICIT_FB_SKIP_DEV(0x0582, 0x0171), /* BOSS RC-505 */ ++ IMPLICIT_FB_SKIP_DEV(0x0582, 0x0185), /* BOSS GP-10 */ + IMPLICIT_FB_SKIP_DEV(0x0582, 0x0189), /* BOSS GT-100v2 */ + IMPLICIT_FB_SKIP_DEV(0x0582, 0x01d6), /* BOSS GT-1 */ + IMPLICIT_FB_SKIP_DEV(0x0582, 0x01d8), /* BOSS Katana */ +@@ -86,6 +87,7 @@ static const struct snd_usb_implicit_fb_ + static const struct snd_usb_implicit_fb_match capture_implicit_fb_quirks[] = { + IMPLICIT_FB_FIXED_DEV(0x0582, 0x0130, 0x0d, 0x01), /* BOSS BR-80 */ + IMPLICIT_FB_FIXED_DEV(0x0582, 0x0171, 0x0d, 0x01), /* BOSS RC-505 */ ++ IMPLICIT_FB_FIXED_DEV(0x0582, 0x0185, 0x0d, 0x01), /* BOSS GP-10 */ + IMPLICIT_FB_FIXED_DEV(0x0582, 0x0189, 0x0d, 0x01), /* BOSS GT-100v2 */ + IMPLICIT_FB_FIXED_DEV(0x0582, 0x01d6, 0x0d, 0x01), /* BOSS GT-1 */ + IMPLICIT_FB_FIXED_DEV(0x0582, 0x01d8, 0x0d, 0x01), /* BOSS Katana */ diff --git a/queue-5.11/alsa-usb-audio-correct-document-for-snd_usb_endpoint_free_all.patch b/queue-5.11/alsa-usb-audio-correct-document-for-snd_usb_endpoint_free_all.patch new file mode 100644 index 00000000000..5024ad02c93 --- /dev/null +++ b/queue-5.11/alsa-usb-audio-correct-document-for-snd_usb_endpoint_free_all.patch @@ -0,0 +1,33 @@ +From 036f90dd92bb0aac66fdeec8386401dd396c6079 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Fri, 5 Feb 2021 09:28:37 +0100 +Subject: ALSA: usb-audio: Correct document for snd_usb_endpoint_free_all() + +From: Takashi Iwai + +commit 036f90dd92bb0aac66fdeec8386401dd396c6079 upstream. + +The kerndoc comment for the new function snd_usb_endpoint_free_all() +had a typo wrt the argument name. Fix it. + +Fixes: 00272c61827e ("ALSA: usb-audio: Avoid unnecessary interface re-setup") +Reported-by: Pierre-Louis Bossart +Cc: +Link: https://lore.kernel.org/r/20210205082837.6327-1-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/endpoint.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -1451,7 +1451,7 @@ void snd_usb_endpoint_release(struct snd + + /** + * snd_usb_endpoint_free_all: Free the resources of an snd_usb_endpoint +- * @card: The chip ++ * @chip: The chip + * + * This free all endpoints and those resources + */ diff --git a/queue-5.11/alsa-usb-audio-don-t-avoid-stopping-the-stream-at-disconnection.patch b/queue-5.11/alsa-usb-audio-don-t-avoid-stopping-the-stream-at-disconnection.patch new file mode 100644 index 00000000000..28d982ae8bd --- /dev/null +++ b/queue-5.11/alsa-usb-audio-don-t-avoid-stopping-the-stream-at-disconnection.patch @@ -0,0 +1,51 @@ +From 257d2d7e9e798305d65825cb82b0a7d1c0511e89 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 6 Feb 2021 21:30:52 +0100 +Subject: ALSA: usb-audio: Don't avoid stopping the stream at disconnection + +From: Takashi Iwai + +commit 257d2d7e9e798305d65825cb82b0a7d1c0511e89 upstream. + +In the later patch, we're going to issue the PCM sync_stop calls at +disconnection. But currently the USB-audio driver can't handle it +because it has a check of shutdown flag for stopping the URBs. This +is basically superfluous (the stopping URBs are safe at disconnection +state), so let's drop the check. + +Fixes: dc5eafe7787c ("ALSA: usb-audio: Support PCM sync_stop") +Cc: +Link: https://lore.kernel.org/r/20210206203052.15606-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/endpoint.c | 3 --- + sound/usb/pcm.c | 5 +---- + 2 files changed, 1 insertion(+), 7 deletions(-) + +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -890,9 +890,6 @@ static int stop_urbs(struct snd_usb_endp + { + unsigned int i; + +- if (!force && atomic_read(&ep->chip->shutdown)) /* to be sure... */ +- return -EBADFD; +- + if (!force && atomic_read(&ep->running)) + return -EBUSY; + +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -270,10 +270,7 @@ static int snd_usb_pcm_sync_stop(struct + { + struct snd_usb_substream *subs = substream->runtime->private_data; + +- if (!snd_usb_lock_shutdown(subs->stream->chip)) { +- sync_pending_stops(subs); +- snd_usb_unlock_shutdown(subs->stream->chip); +- } ++ sync_pending_stops(subs); + return 0; + } + diff --git a/queue-5.11/alsa-usb-audio-handle-invalid-running-state-at-releasing-ep.patch b/queue-5.11/alsa-usb-audio-handle-invalid-running-state-at-releasing-ep.patch new file mode 100644 index 00000000000..1d593da5ce6 --- /dev/null +++ b/queue-5.11/alsa-usb-audio-handle-invalid-running-state-at-releasing-ep.patch @@ -0,0 +1,150 @@ +From d6cda4655e2a7612a1e48c49795a5330abc01c5a Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 6 Feb 2021 21:30:50 +0100 +Subject: ALSA: usb-audio: Handle invalid running state at releasing EP + +From: Takashi Iwai + +commit d6cda4655e2a7612a1e48c49795a5330abc01c5a upstream. + +When we stop an endpoint in release_urbs(), it ignores the +inconsistent endpoint state and tries to release the resources. +This shouldn't happen in theory, but it's still safer to abort the +release and let the caller proper error handling. + +Also, stop_and_unlink_urbs() called from release_urbs() does two step +works, and it's more straightforward to split this to two functions +again, so that the call from the PCM trigger won't take the path with +sleeping. + +This patch modifies the EP management code to adapt two points above. + +Fixes: d0f09d1e4a88 ("ALSA: usb-audio: Refactoring endpoint URB deactivation") +Cc: +Link: https://lore.kernel.org/r/20210206203052.15606-2-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/endpoint.c | 40 +++++++++++++++++++++------------------- + 1 file changed, 21 insertions(+), 19 deletions(-) + +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -868,24 +868,22 @@ void snd_usb_endpoint_sync_pending_stop( + } + + /* +- * Stop and unlink active urbs. ++ * Stop active urbs + * +- * This function checks and clears EP_FLAG_RUNNING state. +- * When @wait_sync is set, it waits until all pending URBs are killed. ++ * This function moves the EP to STOPPING state if it's being RUNNING. + */ +-static int stop_and_unlink_urbs(struct snd_usb_endpoint *ep, bool force, +- bool wait_sync) ++static int stop_urbs(struct snd_usb_endpoint *ep, bool force) + { + unsigned int i; + + if (!force && atomic_read(&ep->chip->shutdown)) /* to be sure... */ + return -EBADFD; + +- if (atomic_read(&ep->running)) ++ if (!force && atomic_read(&ep->running)) + return -EBUSY; + + if (!test_and_clear_bit(EP_FLAG_RUNNING, &ep->flags)) +- goto out; ++ return 0; + + set_bit(EP_FLAG_STOPPING, &ep->flags); + INIT_LIST_HEAD(&ep->ready_playback_urbs); +@@ -901,24 +899,25 @@ static int stop_and_unlink_urbs(struct s + } + } + +- out: +- if (wait_sync) +- return wait_clear_urbs(ep); + return 0; + } + + /* + * release an endpoint's urbs + */ +-static void release_urbs(struct snd_usb_endpoint *ep, int force) ++static int release_urbs(struct snd_usb_endpoint *ep, bool force) + { +- int i; ++ int i, err; + + /* route incoming urbs to nirvana */ + snd_usb_endpoint_set_callback(ep, NULL, NULL, NULL); + +- /* stop urbs */ +- stop_and_unlink_urbs(ep, force, true); ++ /* stop and unlink urbs */ ++ err = stop_urbs(ep, force); ++ if (err) ++ return err; ++ ++ wait_clear_urbs(ep); + + for (i = 0; i < ep->nurbs; i++) + release_urb_ctx(&ep->urb[i]); +@@ -928,6 +927,7 @@ static void release_urbs(struct snd_usb_ + + ep->syncbuf = NULL; + ep->nurbs = 0; ++ return 0; + } + + /* +@@ -1118,7 +1118,7 @@ static int data_ep_set_params(struct snd + return 0; + + out_of_memory: +- release_urbs(ep, 0); ++ release_urbs(ep, false); + return -ENOMEM; + } + +@@ -1162,7 +1162,7 @@ static int sync_ep_set_params(struct snd + return 0; + + out_of_memory: +- release_urbs(ep, 0); ++ release_urbs(ep, false); + return -ENOMEM; + } + +@@ -1180,7 +1180,9 @@ static int snd_usb_endpoint_set_params(s + int err; + + /* release old buffers, if any */ +- release_urbs(ep, 0); ++ err = release_urbs(ep, false); ++ if (err < 0) ++ return err; + + ep->datainterval = fmt->datainterval; + ep->maxpacksize = fmt->maxpacksize; +@@ -1433,7 +1435,7 @@ void snd_usb_endpoint_stop(struct snd_us + WRITE_ONCE(ep->sync_source->sync_sink, NULL); + + if (!atomic_dec_return(&ep->running)) +- stop_and_unlink_urbs(ep, false, false); ++ stop_urbs(ep, false); + } + + /** +@@ -1446,7 +1448,7 @@ void snd_usb_endpoint_stop(struct snd_us + */ + void snd_usb_endpoint_release(struct snd_usb_endpoint *ep) + { +- release_urbs(ep, 1); ++ release_urbs(ep, true); + } + + /** diff --git a/queue-5.11/alsa-usb-audio-more-strict-state-change-in-ep.patch b/queue-5.11/alsa-usb-audio-more-strict-state-change-in-ep.patch new file mode 100644 index 00000000000..98edb1390dd --- /dev/null +++ b/queue-5.11/alsa-usb-audio-more-strict-state-change-in-ep.patch @@ -0,0 +1,161 @@ +From 5c2b301476ec493be15546f05e23414e2aa9d472 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Sat, 6 Feb 2021 21:30:51 +0100 +Subject: ALSA: usb-audio: More strict state change in EP + +From: Takashi Iwai + +commit 5c2b301476ec493be15546f05e23414e2aa9d472 upstream. + +The endpoint management has bit flags to indicate the current state, +and we're dealing two things: the running bit and the stopping bit. +There is a thin window in transition from the running to the stopping +in stop_urbs(), and as long as the bit flags are used, it's difficult +to plug. + +This patch modifies the state management code to use the atomic int +and follow the explicit three states, STOPPED, RUNNING and STOPPING. +The state change is done via atomic_cmpxhg() for avoiding possible +races, and check the state change more strictly. The unexpected state +change is now handled as an error. + +Fixes: d0f09d1e4a88 ("ALSA: usb-audio: Refactoring endpoint URB deactivation") +Cc: +Link: https://lore.kernel.org/r/20210206203052.15606-3-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Greg Kroah-Hartman +--- + sound/usb/card.h | 2 +- + sound/usb/endpoint.c | 42 ++++++++++++++++++++++++++++-------------- + 2 files changed, 29 insertions(+), 15 deletions(-) + +--- a/sound/usb/card.h ++++ b/sound/usb/card.h +@@ -71,7 +71,7 @@ struct snd_usb_endpoint { + unsigned char altsetting; /* corresponding alternate setting */ + unsigned char ep_idx; /* endpoint array index */ + +- unsigned long flags; /* running bit flags */ ++ atomic_t state; /* running state */ + + void (*prepare_data_urb) (struct snd_usb_substream *subs, + struct urb *urb); +--- a/sound/usb/endpoint.c ++++ b/sound/usb/endpoint.c +@@ -21,8 +21,11 @@ + #include "clock.h" + #include "quirks.h" + +-#define EP_FLAG_RUNNING 1 +-#define EP_FLAG_STOPPING 2 ++enum { ++ EP_STATE_STOPPED, ++ EP_STATE_RUNNING, ++ EP_STATE_STOPPING, ++}; + + /* interface refcounting */ + struct snd_usb_iface_ref { +@@ -115,6 +118,16 @@ static const char *usb_error_string(int + } + } + ++static inline bool ep_state_running(struct snd_usb_endpoint *ep) ++{ ++ return atomic_read(&ep->state) == EP_STATE_RUNNING; ++} ++ ++static inline bool ep_state_update(struct snd_usb_endpoint *ep, int old, int new) ++{ ++ return atomic_cmpxchg(&ep->state, old, new) == old; ++} ++ + /** + * snd_usb_endpoint_implicit_feedback_sink: Report endpoint usage type + * +@@ -393,7 +406,7 @@ next_packet_fifo_dequeue(struct snd_usb_ + */ + static void queue_pending_output_urbs(struct snd_usb_endpoint *ep) + { +- while (test_bit(EP_FLAG_RUNNING, &ep->flags)) { ++ while (ep_state_running(ep)) { + + unsigned long flags; + struct snd_usb_packet_info *packet; +@@ -454,13 +467,13 @@ static void snd_complete_urb(struct urb + if (unlikely(atomic_read(&ep->chip->shutdown))) + goto exit_clear; + +- if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags))) ++ if (unlikely(!ep_state_running(ep))) + goto exit_clear; + + if (usb_pipeout(ep->pipe)) { + retire_outbound_urb(ep, ctx); + /* can be stopped during retire callback */ +- if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags))) ++ if (unlikely(!ep_state_running(ep))) + goto exit_clear; + + if (snd_usb_endpoint_implicit_feedback_sink(ep)) { +@@ -474,12 +487,12 @@ static void snd_complete_urb(struct urb + + prepare_outbound_urb(ep, ctx); + /* can be stopped during prepare callback */ +- if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags))) ++ if (unlikely(!ep_state_running(ep))) + goto exit_clear; + } else { + retire_inbound_urb(ep, ctx); + /* can be stopped during retire callback */ +- if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags))) ++ if (unlikely(!ep_state_running(ep))) + goto exit_clear; + + prepare_inbound_urb(ep, ctx); +@@ -835,7 +848,7 @@ static int wait_clear_urbs(struct snd_us + unsigned long end_time = jiffies + msecs_to_jiffies(1000); + int alive; + +- if (!test_bit(EP_FLAG_STOPPING, &ep->flags)) ++ if (atomic_read(&ep->state) != EP_STATE_STOPPING) + return 0; + + do { +@@ -850,10 +863,11 @@ static int wait_clear_urbs(struct snd_us + usb_audio_err(ep->chip, + "timeout: still %d active urbs on EP #%x\n", + alive, ep->ep_num); +- clear_bit(EP_FLAG_STOPPING, &ep->flags); + +- ep->sync_sink = NULL; +- snd_usb_endpoint_set_callback(ep, NULL, NULL, NULL); ++ if (ep_state_update(ep, EP_STATE_STOPPING, EP_STATE_STOPPED)) { ++ ep->sync_sink = NULL; ++ snd_usb_endpoint_set_callback(ep, NULL, NULL, NULL); ++ } + + return 0; + } +@@ -882,10 +896,9 @@ static int stop_urbs(struct snd_usb_endp + if (!force && atomic_read(&ep->running)) + return -EBUSY; + +- if (!test_and_clear_bit(EP_FLAG_RUNNING, &ep->flags)) ++ if (!ep_state_update(ep, EP_STATE_RUNNING, EP_STATE_STOPPING)) + return 0; + +- set_bit(EP_FLAG_STOPPING, &ep->flags); + INIT_LIST_HEAD(&ep->ready_playback_urbs); + ep->next_packet_head = 0; + ep->next_packet_queued = 0; +@@ -1362,7 +1375,8 @@ int snd_usb_endpoint_start(struct snd_us + * from that context. + */ + +- set_bit(EP_FLAG_RUNNING, &ep->flags); ++ if (!ep_state_update(ep, EP_STATE_STOPPED, EP_STATE_RUNNING)) ++ goto __error; + + if (snd_usb_endpoint_implicit_feedback_sink(ep)) { + for (i = 0; i < ep->nurbs; i++) { diff --git a/queue-5.11/arm64-dts-agilex-fix-phy-interface-bit-shift-for-gmac1-and-gmac2.patch b/queue-5.11/arm64-dts-agilex-fix-phy-interface-bit-shift-for-gmac1-and-gmac2.patch new file mode 100644 index 00000000000..27d26642652 --- /dev/null +++ b/queue-5.11/arm64-dts-agilex-fix-phy-interface-bit-shift-for-gmac1-and-gmac2.patch @@ -0,0 +1,40 @@ +From b7ff3a447d100c999d9848353ef8a4046831d893 Mon Sep 17 00:00:00 2001 +From: Dinh Nguyen +Date: Thu, 4 Feb 2021 14:24:33 -0600 +Subject: arm64: dts: agilex: fix phy interface bit shift for gmac1 and gmac2 + +From: Dinh Nguyen + +commit b7ff3a447d100c999d9848353ef8a4046831d893 upstream. + +The shift for the phy_intf_sel bit in the system manager for gmac1 and +gmac2 should be 0. + +Fixes: 2f804ba7aa9ee ("arm64: dts: agilex: Add SysMgr to Ethernet nodes") +Cc: stable@vger.kernel.org +Signed-off-by: Dinh Nguyen +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/intel/socfpga_agilex.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi ++++ b/arch/arm64/boot/dts/intel/socfpga_agilex.dtsi +@@ -166,7 +166,7 @@ + rx-fifo-depth = <16384>; + snps,multicast-filter-bins = <256>; + iommus = <&smmu 2>; +- altr,sysmgr-syscon = <&sysmgr 0x48 8>; ++ altr,sysmgr-syscon = <&sysmgr 0x48 0>; + clocks = <&clkmgr AGILEX_EMAC1_CLK>, <&clkmgr AGILEX_EMAC_PTP_CLK>; + clock-names = "stmmaceth", "ptp_ref"; + status = "disabled"; +@@ -184,7 +184,7 @@ + rx-fifo-depth = <16384>; + snps,multicast-filter-bins = <256>; + iommus = <&smmu 3>; +- altr,sysmgr-syscon = <&sysmgr 0x4c 16>; ++ altr,sysmgr-syscon = <&sysmgr 0x4c 0>; + clocks = <&clkmgr AGILEX_EMAC2_CLK>, <&clkmgr AGILEX_EMAC_PTP_CLK>; + clock-names = "stmmaceth", "ptp_ref"; + status = "disabled"; diff --git a/queue-5.11/arm64-ptrace-fix-seccomp-of-traced-syscall-1-no_syscall.patch b/queue-5.11/arm64-ptrace-fix-seccomp-of-traced-syscall-1-no_syscall.patch new file mode 100644 index 00000000000..42f918c751e --- /dev/null +++ b/queue-5.11/arm64-ptrace-fix-seccomp-of-traced-syscall-1-no_syscall.patch @@ -0,0 +1,52 @@ +From df84fe94708985cdfb78a83148322bcd0a699472 Mon Sep 17 00:00:00 2001 +From: Timothy E Baldwin +Date: Sat, 16 Jan 2021 15:18:54 +0000 +Subject: arm64: ptrace: Fix seccomp of traced syscall -1 (NO_SYSCALL) + +From: Timothy E Baldwin + +commit df84fe94708985cdfb78a83148322bcd0a699472 upstream. + +Since commit f086f67485c5 ("arm64: ptrace: add support for syscall +emulation"), if system call number -1 is called and the process is being +traced with PTRACE_SYSCALL, for example by strace, the seccomp check is +skipped and -ENOSYS is returned unconditionally (unless altered by the +tracer) rather than carrying out action specified in the seccomp filter. + +The consequence of this is that it is not possible to reliably strace +a seccomp based implementation of a foreign system call interface in +which r7/x8 is permitted to be -1 on entry to a system call. + +Also trace_sys_enter and audit_syscall_entry are skipped if a system +call is skipped. + +Fix by removing the in_syscall(regs) check restoring the previous +behaviour which is like AArch32, x86 (which uses generic code) and +everything else. + +Cc: Oleg Nesterov +Cc: Catalin Marinas +Cc: +Fixes: f086f67485c5 ("arm64: ptrace: add support for syscall emulation") +Reviewed-by: Kees Cook +Reviewed-by: Sudeep Holla +Tested-by: Sudeep Holla +Signed-off-by: Timothy E Baldwin +Link: https://lore.kernel.org/r/90edd33b-6353-1228-791f-0336d94d5f8c@majoroak.me.uk +Signed-off-by: Will Deacon +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/kernel/ptrace.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -1796,7 +1796,7 @@ int syscall_trace_enter(struct pt_regs * + + if (flags & (_TIF_SYSCALL_EMU | _TIF_SYSCALL_TRACE)) { + tracehook_report_syscall(regs, PTRACE_SYSCALL_ENTER); +- if (!in_syscall(regs) || (flags & _TIF_SYSCALL_EMU)) ++ if (flags & _TIF_SYSCALL_EMU) + return NO_SYSCALL; + } + diff --git a/queue-5.11/asoc-siu-fix-build-error-by-a-wrong-const-prefix.patch b/queue-5.11/asoc-siu-fix-build-error-by-a-wrong-const-prefix.patch new file mode 100644 index 00000000000..f0825c5530c --- /dev/null +++ b/queue-5.11/asoc-siu-fix-build-error-by-a-wrong-const-prefix.patch @@ -0,0 +1,52 @@ +From ae07f5c7c5e9ebca5b9d6471bb4b99a9da5c6d88 Mon Sep 17 00:00:00 2001 +From: Takashi Iwai +Date: Tue, 26 Jan 2021 16:47:02 +0100 +Subject: ASoC: siu: Fix build error by a wrong const prefix + +From: Takashi Iwai + +commit ae07f5c7c5e9ebca5b9d6471bb4b99a9da5c6d88 upstream. + +A const prefix was put wrongly in the middle at the code refactoring +commit 932eaf7c7904 ("ASoC: sh: siu_pcm: remove snd_pcm_ops"), which +leads to a build error as: + sound/soc/sh/siu_pcm.c:546:8: error: expected '{' before 'const' + +Also, another inconsistency is that the declaration of siu_component +misses the const prefix. + +This patch corrects both failures. + +Fixes: 932eaf7c7904 ("ASoC: sh: siu_pcm: remove snd_pcm_ops") +Cc: +Signed-off-by: Takashi Iwai +Link: https://lore.kernel.org/r/20210126154702.3974-1-tiwai@suse.de +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/sh/siu.h | 2 +- + sound/soc/sh/siu_pcm.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +--- a/sound/soc/sh/siu.h ++++ b/sound/soc/sh/siu.h +@@ -169,7 +169,7 @@ static inline u32 siu_read32(u32 __iomem + #define SIU_BRGBSEL (0x108 / sizeof(u32)) + #define SIU_BRRB (0x10c / sizeof(u32)) + +-extern struct snd_soc_component_driver siu_component; ++extern const struct snd_soc_component_driver siu_component; + extern struct siu_info *siu_i2s_data; + + int siu_init_port(int port, struct siu_port **port_info, struct snd_card *card); +--- a/sound/soc/sh/siu_pcm.c ++++ b/sound/soc/sh/siu_pcm.c +@@ -543,7 +543,7 @@ static void siu_pcm_free(struct snd_soc_ + dev_dbg(pcm->card->dev, "%s\n", __func__); + } + +-struct const snd_soc_component_driver siu_component = { ++const struct snd_soc_component_driver siu_component = { + .name = DRV_NAME, + .open = siu_pcm_open, + .close = siu_pcm_close, diff --git a/queue-5.11/bcache-give-btree_io_wq-correct-semantics-again.patch b/queue-5.11/bcache-give-btree_io_wq-correct-semantics-again.patch new file mode 100644 index 00000000000..e1728882b7a --- /dev/null +++ b/queue-5.11/bcache-give-btree_io_wq-correct-semantics-again.patch @@ -0,0 +1,38 @@ +From d797bd9897e3559eb48d68368550d637d32e468c Mon Sep 17 00:00:00 2001 +From: Kai Krakow +Date: Wed, 10 Feb 2021 13:07:26 +0800 +Subject: bcache: Give btree_io_wq correct semantics again + +From: Kai Krakow + +commit d797bd9897e3559eb48d68368550d637d32e468c upstream. + +Before killing `btree_io_wq`, the queue was allocated using +`create_singlethread_workqueue()` which has `WQ_MEM_RECLAIM`. After +killing it, it no longer had this property but `system_wq` is not +single threaded. + +Let's combine both worlds and make it multi threaded but able to +reclaim memory. + +Cc: Coly Li +Cc: stable@vger.kernel.org # 5.4+ +Signed-off-by: Kai Krakow +Signed-off-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/bcache/btree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -2775,7 +2775,7 @@ void bch_btree_exit(void) + + int __init bch_btree_init(void) + { +- btree_io_wq = create_singlethread_workqueue("bch_btree_io"); ++ btree_io_wq = alloc_workqueue("bch_btree_io", WQ_MEM_RECLAIM, 0); + if (!btree_io_wq) + return -ENOMEM; + diff --git a/queue-5.11/bcache-move-journal-work-to-new-flush-wq.patch b/queue-5.11/bcache-move-journal-work-to-new-flush-wq.patch new file mode 100644 index 00000000000..8318144d6a3 --- /dev/null +++ b/queue-5.11/bcache-move-journal-work-to-new-flush-wq.patch @@ -0,0 +1,98 @@ +From afe78ab46f638ecdf80a35b122ffc92c20d9ae5d Mon Sep 17 00:00:00 2001 +From: Kai Krakow +Date: Wed, 10 Feb 2021 13:07:27 +0800 +Subject: bcache: Move journal work to new flush wq + +From: Kai Krakow + +commit afe78ab46f638ecdf80a35b122ffc92c20d9ae5d upstream. + +This is potentially long running and not latency sensitive, let's get +it out of the way of other latency sensitive events. + +As observed in the previous commit, the `system_wq` comes easily +congested by bcache, and this fixes a few more stalls I was observing +every once in a while. + +Let's not make this `WQ_MEM_RECLAIM` as it showed to reduce performance +of boot and file system operations in my tests. Also, without +`WQ_MEM_RECLAIM`, I no longer see desktop stalls. This matches the +previous behavior as `system_wq` also does no memory reclaim: + +> // workqueue.c: +> system_wq = alloc_workqueue("events", 0, 0); + +Cc: Coly Li +Cc: stable@vger.kernel.org # 5.4+ +Signed-off-by: Kai Krakow +Signed-off-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/bcache/bcache.h | 1 + + drivers/md/bcache/journal.c | 4 ++-- + drivers/md/bcache/super.c | 16 ++++++++++++++++ + 3 files changed, 19 insertions(+), 2 deletions(-) + +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -1001,6 +1001,7 @@ void bch_write_bdev_super(struct cached_ + + extern struct workqueue_struct *bcache_wq; + extern struct workqueue_struct *bch_journal_wq; ++extern struct workqueue_struct *bch_flush_wq; + extern struct mutex bch_register_lock; + extern struct list_head bch_cache_sets; + +--- a/drivers/md/bcache/journal.c ++++ b/drivers/md/bcache/journal.c +@@ -932,8 +932,8 @@ atomic_t *bch_journal(struct cache_set * + journal_try_write(c); + } else if (!w->dirty) { + w->dirty = true; +- schedule_delayed_work(&c->journal.work, +- msecs_to_jiffies(c->journal_delay_ms)); ++ queue_delayed_work(bch_flush_wq, &c->journal.work, ++ msecs_to_jiffies(c->journal_delay_ms)); + spin_unlock(&c->journal.lock); + } else { + spin_unlock(&c->journal.lock); +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -49,6 +49,7 @@ static int bcache_major; + static DEFINE_IDA(bcache_device_idx); + static wait_queue_head_t unregister_wait; + struct workqueue_struct *bcache_wq; ++struct workqueue_struct *bch_flush_wq; + struct workqueue_struct *bch_journal_wq; + + +@@ -2821,6 +2822,8 @@ static void bcache_exit(void) + destroy_workqueue(bcache_wq); + if (bch_journal_wq) + destroy_workqueue(bch_journal_wq); ++ if (bch_flush_wq) ++ destroy_workqueue(bch_flush_wq); + bch_btree_exit(); + + if (bcache_major) +@@ -2884,6 +2887,19 @@ static int __init bcache_init(void) + if (!bcache_wq) + goto err; + ++ /* ++ * Let's not make this `WQ_MEM_RECLAIM` for the following reasons: ++ * ++ * 1. It used `system_wq` before which also does no memory reclaim. ++ * 2. With `WQ_MEM_RECLAIM` desktop stalls, increased boot times, and ++ * reduced throughput can be observed. ++ * ++ * We still want to user our own queue to not congest the `system_wq`. ++ */ ++ bch_flush_wq = alloc_workqueue("bch_flush", 0, 0); ++ if (!bch_flush_wq) ++ goto err; ++ + bch_journal_wq = alloc_workqueue("bch_journal", WQ_MEM_RECLAIM, 0); + if (!bch_journal_wq) + goto err; diff --git a/queue-5.11/blk-settings-align-max_sectors-on-logical_block_size-boundary.patch b/queue-5.11/blk-settings-align-max_sectors-on-logical_block_size-boundary.patch new file mode 100644 index 00000000000..01998929f51 --- /dev/null +++ b/queue-5.11/blk-settings-align-max_sectors-on-logical_block_size-boundary.patch @@ -0,0 +1,68 @@ +From 97f433c3601a24d3513d06f575a389a2ca4e11e4 Mon Sep 17 00:00:00 2001 +From: Mikulas Patocka +Date: Tue, 23 Feb 2021 19:25:30 -0700 +Subject: blk-settings: align max_sectors on "logical_block_size" boundary + +From: Mikulas Patocka + +commit 97f433c3601a24d3513d06f575a389a2ca4e11e4 upstream. + +We get I/O errors when we run md-raid1 on the top of dm-integrity on the +top of ramdisk. +device-mapper: integrity: Bio not aligned on 8 sectors: 0xff00, 0xff +device-mapper: integrity: Bio not aligned on 8 sectors: 0xff00, 0xff +device-mapper: integrity: Bio not aligned on 8 sectors: 0xffff, 0x1 +device-mapper: integrity: Bio not aligned on 8 sectors: 0xffff, 0x1 +device-mapper: integrity: Bio not aligned on 8 sectors: 0x8048, 0xff +device-mapper: integrity: Bio not aligned on 8 sectors: 0x8147, 0xff +device-mapper: integrity: Bio not aligned on 8 sectors: 0x8246, 0xff +device-mapper: integrity: Bio not aligned on 8 sectors: 0x8345, 0xbb + +The ramdisk device has logical_block_size 512 and max_sectors 255. The +dm-integrity device uses logical_block_size 4096 and it doesn't affect the +"max_sectors" value - thus, it inherits 255 from the ramdisk. So, we have +a device with max_sectors not aligned on logical_block_size. + +The md-raid device sees that the underlying leg has max_sectors 255 and it +will split the bios on 255-sector boundary, making the bios unaligned on +logical_block_size. + +In order to fix the bug, we round down max_sectors to logical_block_size. + +Cc: stable@vger.kernel.org +Reviewed-by: Ming Lei +Signed-off-by: Mikulas Patocka +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + block/blk-settings.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/block/blk-settings.c ++++ b/block/blk-settings.c +@@ -481,6 +481,14 @@ void blk_queue_io_opt(struct request_que + } + EXPORT_SYMBOL(blk_queue_io_opt); + ++static unsigned int blk_round_down_sectors(unsigned int sectors, unsigned int lbs) ++{ ++ sectors = round_down(sectors, lbs >> SECTOR_SHIFT); ++ if (sectors < PAGE_SIZE >> SECTOR_SHIFT) ++ sectors = PAGE_SIZE >> SECTOR_SHIFT; ++ return sectors; ++} ++ + /** + * blk_stack_limits - adjust queue_limits for stacked devices + * @t: the stacking driver limits (top device) +@@ -607,6 +615,10 @@ int blk_stack_limits(struct queue_limits + ret = -1; + } + ++ t->max_sectors = blk_round_down_sectors(t->max_sectors, t->logical_block_size); ++ t->max_hw_sectors = blk_round_down_sectors(t->max_hw_sectors, t->logical_block_size); ++ t->max_dev_sectors = blk_round_down_sectors(t->max_dev_sectors, t->logical_block_size); ++ + /* Discard alignment and granularity */ + if (b->discard_granularity) { + alignment = queue_limit_discard_alignment(b, start); diff --git a/queue-5.11/btrfs-abort-the-transaction-if-we-fail-to-inc-ref-in-btrfs_copy_root.patch b/queue-5.11/btrfs-abort-the-transaction-if-we-fail-to-inc-ref-in-btrfs_copy_root.patch new file mode 100644 index 00000000000..79f27df6375 --- /dev/null +++ b/queue-5.11/btrfs-abort-the-transaction-if-we-fail-to-inc-ref-in-btrfs_copy_root.patch @@ -0,0 +1,56 @@ +From 867ed321f90d06aaba84e2c91de51cd3038825ef Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Thu, 14 Jan 2021 14:02:46 -0500 +Subject: btrfs: abort the transaction if we fail to inc ref in btrfs_copy_root + +From: Josef Bacik + +commit 867ed321f90d06aaba84e2c91de51cd3038825ef upstream. + +While testing my error handling patches, I added a error injection site +at btrfs_inc_extent_ref, to validate the error handling I added was +doing the correct thing. However I hit a pretty ugly corruption while +doing this check, with the following error injection stack trace: + +btrfs_inc_extent_ref + btrfs_copy_root + create_reloc_root + btrfs_init_reloc_root + btrfs_record_root_in_trans + btrfs_start_transaction + btrfs_update_inode + btrfs_update_time + touch_atime + file_accessed + btrfs_file_mmap + +This is because we do not catch the error from btrfs_inc_extent_ref, +which in practice would be ENOMEM, which means we lose the extent +references for a root that has already been allocated and inserted, +which is the problem. Fix this by aborting the transaction if we fail +to do the reference modification. + +CC: stable@vger.kernel.org # 4.4+ +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/ctree.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -221,9 +221,10 @@ int btrfs_copy_root(struct btrfs_trans_h + ret = btrfs_inc_ref(trans, root, cow, 1); + else + ret = btrfs_inc_ref(trans, root, cow, 0); +- +- if (ret) ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); + return ret; ++ } + + btrfs_mark_buffer_dirty(cow); + *cow_ret = cow; diff --git a/queue-5.11/btrfs-account-for-new-extents-being-deleted-in-total_bytes_pinned.patch b/queue-5.11/btrfs-account-for-new-extents-being-deleted-in-total_bytes_pinned.patch new file mode 100644 index 00000000000..079f42c2315 --- /dev/null +++ b/queue-5.11/btrfs-account-for-new-extents-being-deleted-in-total_bytes_pinned.patch @@ -0,0 +1,122 @@ +From 81e75ac74ecba929d1e922bf93f9fc467232e39f Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Fri, 15 Jan 2021 16:48:56 -0500 +Subject: btrfs: account for new extents being deleted in total_bytes_pinned + +From: Josef Bacik + +commit 81e75ac74ecba929d1e922bf93f9fc467232e39f upstream. + +My recent patch set "A variety of lock contention fixes", found here + +https://lore.kernel.org/linux-btrfs/cover.1608319304.git.josef@toxicpanda.com/ +(Tracked in https://github.com/btrfs/linux/issues/86) + +that reduce lock contention on the extent root by running delayed refs +less often resulted in a regression in generic/371. This test +fallocate()'s the fs until it's full, deletes all the files, and then +tries to fallocate() until full again. + +Before these patches we would run all of the delayed refs during +flushing, and then would commit the transaction because we had plenty of +pinned space to recover in order to allocate. However my patches made +it so we weren't running the delayed refs as aggressively, which meant +that we appeared to have less pinned space when we were deciding to +commit the transaction. + +We use the space_info->total_bytes_pinned to approximate how much space +we have pinned. It's approximate because if we remove a reference to an +extent we may free it, but there may be more references to it than we +know of at that point, but we account it as pinned at the creation time, +and then it's properly accounted when the delayed ref runs. + +The way we account for pinned space is if the +delayed_ref_head->total_ref_mod is < 0, because that is clearly a +freeing option. However there is another case, and that is where +->total_ref_mod == 0 && ->must_insert_reserved == 1. + +When we allocate a new extent, we have ->total_ref_mod == 1 and we have +->must_insert_reserved == 1. This is used to indicate that it is a +brand new extent and will need to have its extent entry added before we +modify any references on the delayed ref head. But if we subsequently +remove that extent reference, our ->total_ref_mod will be 0, and that +space will be pinned and freed. Accounting for this case properly +allows for generic/371 to pass with my delayed refs patches applied. + +It's important to note that this problem exists without the referenced +patches, it just was uncovered by them. + +CC: stable@vger.kernel.org # 5.10 +Reviewed-by: Nikolay Borisov +Signed-off-by: Josef Bacik +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/delayed-ref.c | 5 +++++ + fs/btrfs/extent-tree.c | 33 +++++++++++++++++++-------------- + 2 files changed, 24 insertions(+), 14 deletions(-) + +--- a/fs/btrfs/delayed-ref.c ++++ b/fs/btrfs/delayed-ref.c +@@ -732,11 +732,16 @@ static noinline void update_existing_hea + * 2. We were negative and went to 0 or positive, so no longer can say + * that the space would be pinned, decrement our counter from the + * total_bytes_pinned counter. ++ * 3. We are now at 0 and have ->must_insert_reserved set, which means ++ * this was a new allocation and then we dropped it, and thus must ++ * add our space to the total_bytes_pinned counter. + */ + if (existing->total_ref_mod < 0 && old_ref_mod >= 0) + btrfs_mod_total_bytes_pinned(fs_info, flags, existing->num_bytes); + else if (existing->total_ref_mod >= 0 && old_ref_mod < 0) + btrfs_mod_total_bytes_pinned(fs_info, flags, -existing->num_bytes); ++ else if (existing->total_ref_mod == 0 && existing->must_insert_reserved) ++ btrfs_mod_total_bytes_pinned(fs_info, flags, existing->num_bytes); + + spin_unlock(&existing->lock); + } +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -1754,23 +1754,28 @@ void btrfs_cleanup_ref_head_accounting(s + { + int nr_items = 1; /* Dropping this ref head update. */ + +- if (head->total_ref_mod < 0) { ++ /* ++ * We had csum deletions accounted for in our delayed refs rsv, we need ++ * to drop the csum leaves for this update from our delayed_refs_rsv. ++ */ ++ if (head->total_ref_mod < 0 && head->is_data) { ++ spin_lock(&delayed_refs->lock); ++ delayed_refs->pending_csums -= head->num_bytes; ++ spin_unlock(&delayed_refs->lock); ++ nr_items += btrfs_csum_bytes_to_leaves(fs_info, head->num_bytes); ++ } ++ ++ /* ++ * We were dropping refs, or had a new ref and dropped it, and thus must ++ * adjust down our total_bytes_pinned, the space may or may not have ++ * been pinned and so is accounted for properly in the pinned space by ++ * now. ++ */ ++ if (head->total_ref_mod < 0 || ++ (head->total_ref_mod == 0 && head->must_insert_reserved)) { + u64 flags = btrfs_ref_head_to_space_flags(head); + + btrfs_mod_total_bytes_pinned(fs_info, flags, -head->num_bytes); +- +- /* +- * We had csum deletions accounted for in our delayed refs rsv, +- * we need to drop the csum leaves for this update from our +- * delayed_refs_rsv. +- */ +- if (head->is_data) { +- spin_lock(&delayed_refs->lock); +- delayed_refs->pending_csums -= head->num_bytes; +- spin_unlock(&delayed_refs->lock); +- nr_items += btrfs_csum_bytes_to_leaves(fs_info, +- head->num_bytes); +- } + } + + btrfs_delayed_refs_rsv_release(fs_info, nr_items); diff --git a/queue-5.11/btrfs-add-asserts-for-deleting-backref-cache-nodes.patch b/queue-5.11/btrfs-add-asserts-for-deleting-backref-cache-nodes.patch new file mode 100644 index 00000000000..f319fd3ad26 --- /dev/null +++ b/queue-5.11/btrfs-add-asserts-for-deleting-backref-cache-nodes.patch @@ -0,0 +1,179 @@ +From eddda68d97732ce05ca145f8e85e8a447f65cdad Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Thu, 14 Jan 2021 14:02:45 -0500 +Subject: btrfs: add asserts for deleting backref cache nodes + +From: Josef Bacik + +commit eddda68d97732ce05ca145f8e85e8a447f65cdad upstream. + +A weird KASAN problem that Zygo reported could have been easily caught +if we checked for basic things in our backref freeing code. We have two +methods of freeing a backref node + +- btrfs_backref_free_node: this just is kfree() essentially. +- btrfs_backref_drop_node: this actually unlinks the node and cleans up + everything and then calls btrfs_backref_free_node(). + +We should mostly be using btrfs_backref_drop_node(), to make sure the +node is properly unlinked from the backref cache, and only use +btrfs_backref_free_node() when we know the node isn't actually linked to +the backref cache. We made a mistake here and thus got the KASAN splat. + +Make this style of issue easier to find by adding some ASSERT()'s to +btrfs_backref_free_node() and adjusting our deletion stuff to properly +init the list so we can rely on list_empty() checks working properly. + + BUG: KASAN: use-after-free in btrfs_backref_cleanup_node+0x18a/0x420 + Read of size 8 at addr ffff888112402950 by task btrfs/28836 + + CPU: 0 PID: 28836 Comm: btrfs Tainted: G W 5.10.0-e35f27394290-for-next+ #23 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 + Call Trace: + dump_stack+0xbc/0xf9 + ? btrfs_backref_cleanup_node+0x18a/0x420 + print_address_description.constprop.8+0x21/0x210 + ? record_print_text.cold.34+0x11/0x11 + ? btrfs_backref_cleanup_node+0x18a/0x420 + ? btrfs_backref_cleanup_node+0x18a/0x420 + kasan_report.cold.10+0x20/0x37 + ? btrfs_backref_cleanup_node+0x18a/0x420 + __asan_load8+0x69/0x90 + btrfs_backref_cleanup_node+0x18a/0x420 + btrfs_backref_release_cache+0x83/0x1b0 + relocate_block_group+0x394/0x780 + ? merge_reloc_roots+0x4a0/0x4a0 + btrfs_relocate_block_group+0x26e/0x4c0 + btrfs_relocate_chunk+0x52/0x120 + btrfs_balance+0xe2e/0x1900 + ? check_flags.part.50+0x6c/0x1e0 + ? btrfs_relocate_chunk+0x120/0x120 + ? kmem_cache_alloc_trace+0xa06/0xcb0 + ? _copy_from_user+0x83/0xc0 + btrfs_ioctl_balance+0x3a7/0x460 + btrfs_ioctl+0x24c8/0x4360 + ? __kasan_check_read+0x11/0x20 + ? check_chain_key+0x1f4/0x2f0 + ? __asan_loadN+0xf/0x20 + ? btrfs_ioctl_get_supported_features+0x30/0x30 + ? kvm_sched_clock_read+0x18/0x30 + ? check_chain_key+0x1f4/0x2f0 + ? lock_downgrade+0x3f0/0x3f0 + ? handle_mm_fault+0xad6/0x2150 + ? do_vfs_ioctl+0xfc/0x9d0 + ? ioctl_file_clone+0xe0/0xe0 + ? check_flags.part.50+0x6c/0x1e0 + ? check_flags.part.50+0x6c/0x1e0 + ? check_flags+0x26/0x30 + ? lock_is_held_type+0xc3/0xf0 + ? syscall_enter_from_user_mode+0x1b/0x60 + ? do_syscall_64+0x13/0x80 + ? rcu_read_lock_sched_held+0xa1/0xd0 + ? __kasan_check_read+0x11/0x20 + ? __fget_light+0xae/0x110 + __x64_sys_ioctl+0xc3/0x100 + do_syscall_64+0x37/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + RIP: 0033:0x7f4c4bdfe427 + RSP: 002b:00007fff33ee6df8 EFLAGS: 00000202 ORIG_RAX: 0000000000000010 + RAX: ffffffffffffffda RBX: 00007fff33ee6e98 RCX: 00007f4c4bdfe427 + RDX: 00007fff33ee6e98 RSI: 00000000c4009420 RDI: 0000000000000003 + RBP: 0000000000000003 R08: 0000000000000003 R09: 0000000000000078 + R10: fffffffffffff59d R11: 0000000000000202 R12: 0000000000000001 + R13: 0000000000000000 R14: 00007fff33ee8a34 R15: 0000000000000001 + + Allocated by task 28836: + kasan_save_stack+0x21/0x50 + __kasan_kmalloc.constprop.18+0xbe/0xd0 + kasan_kmalloc+0x9/0x10 + kmem_cache_alloc_trace+0x410/0xcb0 + btrfs_backref_alloc_node+0x46/0xf0 + btrfs_backref_add_tree_node+0x60d/0x11d0 + build_backref_tree+0xc5/0x700 + relocate_tree_blocks+0x2be/0xb90 + relocate_block_group+0x2eb/0x780 + btrfs_relocate_block_group+0x26e/0x4c0 + btrfs_relocate_chunk+0x52/0x120 + btrfs_balance+0xe2e/0x1900 + btrfs_ioctl_balance+0x3a7/0x460 + btrfs_ioctl+0x24c8/0x4360 + __x64_sys_ioctl+0xc3/0x100 + do_syscall_64+0x37/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + + Freed by task 28836: + kasan_save_stack+0x21/0x50 + kasan_set_track+0x20/0x30 + kasan_set_free_info+0x1f/0x30 + __kasan_slab_free+0xf3/0x140 + kasan_slab_free+0xe/0x10 + kfree+0xde/0x200 + btrfs_backref_error_cleanup+0x452/0x530 + build_backref_tree+0x1a5/0x700 + relocate_tree_blocks+0x2be/0xb90 + relocate_block_group+0x2eb/0x780 + btrfs_relocate_block_group+0x26e/0x4c0 + btrfs_relocate_chunk+0x52/0x120 + btrfs_balance+0xe2e/0x1900 + btrfs_ioctl_balance+0x3a7/0x460 + btrfs_ioctl+0x24c8/0x4360 + __x64_sys_ioctl+0xc3/0x100 + do_syscall_64+0x37/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + + The buggy address belongs to the object at ffff888112402900 + which belongs to the cache kmalloc-128 of size 128 + The buggy address is located 80 bytes inside of + 128-byte region [ffff888112402900, ffff888112402980) + The buggy address belongs to the page: + page:0000000028b1cd08 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888131c810c0 pfn:0x112402 + flags: 0x17ffe0000000200(slab) + raw: 017ffe0000000200 ffffea000424f308 ffffea0007d572c8 ffff888100040440 + raw: ffff888131c810c0 ffff888112402000 0000000100000009 0000000000000000 + page dumped because: kasan: bad access detected + + Memory state around the buggy address: + ffff888112402800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ffff888112402880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + >ffff888112402900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff888112402980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc + ffff888112402a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + +Link: https://lore.kernel.org/linux-btrfs/20201208194607.GI31381@hungrycats.org/ +CC: stable@vger.kernel.org # 5.10+ +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/backref.h | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/fs/btrfs/backref.h ++++ b/fs/btrfs/backref.h +@@ -296,6 +296,9 @@ static inline void btrfs_backref_free_no + struct btrfs_backref_node *node) + { + if (node) { ++ ASSERT(list_empty(&node->list)); ++ ASSERT(list_empty(&node->lower)); ++ ASSERT(node->eb == NULL); + cache->nr_nodes--; + btrfs_put_root(node->root); + kfree(node); +@@ -340,11 +343,11 @@ static inline void btrfs_backref_drop_no + static inline void btrfs_backref_drop_node(struct btrfs_backref_cache *tree, + struct btrfs_backref_node *node) + { +- BUG_ON(!list_empty(&node->upper)); ++ ASSERT(list_empty(&node->upper)); + + btrfs_backref_drop_node_buffer(node); +- list_del(&node->list); +- list_del(&node->lower); ++ list_del_init(&node->list); ++ list_del_init(&node->lower); + if (!RB_EMPTY_NODE(&node->rb_node)) + rb_erase(&node->rb_node, &tree->rb_root); + btrfs_backref_free_node(tree, node); diff --git a/queue-5.11/btrfs-do-not-cleanup-upper-nodes-in-btrfs_backref_cleanup_node.patch b/queue-5.11/btrfs-do-not-cleanup-upper-nodes-in-btrfs_backref_cleanup_node.patch new file mode 100644 index 00000000000..f879c36e28f --- /dev/null +++ b/queue-5.11/btrfs-do-not-cleanup-upper-nodes-in-btrfs_backref_cleanup_node.patch @@ -0,0 +1,123 @@ +From 7e2a870a599d4699a626ec26430c7a1ab14a2a49 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Wed, 16 Dec 2020 11:22:16 -0500 +Subject: btrfs: do not cleanup upper nodes in btrfs_backref_cleanup_node + +From: Josef Bacik + +commit 7e2a870a599d4699a626ec26430c7a1ab14a2a49 upstream. + +Zygo reported the following panic when testing my error handling patches +for relocation: + + kernel BUG at fs/btrfs/backref.c:2545! + invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 3 PID: 8472 Comm: btrfs Tainted: G W 14 + Hardware name: QEMU Standard PC (i440FX + PIIX, + + Call Trace: + btrfs_backref_error_cleanup+0x4df/0x530 + build_backref_tree+0x1a5/0x700 + ? _raw_spin_unlock+0x22/0x30 + ? release_extent_buffer+0x225/0x280 + ? free_extent_buffer.part.52+0xd7/0x140 + relocate_tree_blocks+0x2a6/0xb60 + ? kasan_unpoison_shadow+0x35/0x50 + ? do_relocation+0xc10/0xc10 + ? kasan_kmalloc+0x9/0x10 + ? kmem_cache_alloc_trace+0x6a3/0xcb0 + ? free_extent_buffer.part.52+0xd7/0x140 + ? rb_insert_color+0x342/0x360 + ? add_tree_block.isra.36+0x236/0x2b0 + relocate_block_group+0x2eb/0x780 + ? merge_reloc_roots+0x470/0x470 + btrfs_relocate_block_group+0x26e/0x4c0 + btrfs_relocate_chunk+0x52/0x120 + btrfs_balance+0xe2e/0x18f0 + ? pvclock_clocksource_read+0xeb/0x190 + ? btrfs_relocate_chunk+0x120/0x120 + ? lock_contended+0x620/0x6e0 + ? do_raw_spin_lock+0x1e0/0x1e0 + ? do_raw_spin_unlock+0xa8/0x140 + btrfs_ioctl_balance+0x1f9/0x460 + btrfs_ioctl+0x24c8/0x4380 + ? __kasan_check_read+0x11/0x20 + ? check_chain_key+0x1f4/0x2f0 + ? __asan_loadN+0xf/0x20 + ? btrfs_ioctl_get_supported_features+0x30/0x30 + ? kvm_sched_clock_read+0x18/0x30 + ? check_chain_key+0x1f4/0x2f0 + ? lock_downgrade+0x3f0/0x3f0 + ? handle_mm_fault+0xad6/0x2150 + ? do_vfs_ioctl+0xfc/0x9d0 + ? ioctl_file_clone+0xe0/0xe0 + ? check_flags.part.50+0x6c/0x1e0 + ? check_flags.part.50+0x6c/0x1e0 + ? check_flags+0x26/0x30 + ? lock_is_held_type+0xc3/0xf0 + ? syscall_enter_from_user_mode+0x1b/0x60 + ? do_syscall_64+0x13/0x80 + ? rcu_read_lock_sched_held+0xa1/0xd0 + ? __kasan_check_read+0x11/0x20 + ? __fget_light+0xae/0x110 + __x64_sys_ioctl+0xc3/0x100 + do_syscall_64+0x37/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +This occurs because of this check + + if (RB_EMPTY_NODE(&upper->rb_node)) + BUG_ON(!list_empty(&node->upper)); + +As we are dropping the backref node, if we discover that our upper node +in the edge we just cleaned up isn't linked into the cache that we are +now done with this node, thus the BUG_ON(). + +However this is an erroneous assumption, as we will look up all the +references for a node first, and then process the pending edges. All of +the 'upper' nodes in our pending edges won't be in the cache's rb_tree +yet, because they haven't been processed. We could very well have many +edges still left to cleanup on this node. + +The fact is we simply do not need this check, we can just process all of +the edges only for this node, because below this check we do the +following + + if (list_empty(&upper->lower)) { + list_add_tail(&upper->lower, &cache->leaves); + upper->lowest = 1; + } + +If the upper node truly isn't used yet, then we add it to the +cache->leaves list to be cleaned up later. If it is still used then the +last child node that has it linked into its node will add it to the +leaves list and then it will be cleaned up. + +Fix this problem by dropping this logic altogether. With this fix I no +longer see the panic when testing with error injection in the backref +code. + +CC: stable@vger.kernel.org # 4.4+ +Reviewed-by: Qu Wenruo +Signed-off-by: Josef Bacik +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/backref.c | 7 ------- + 1 file changed, 7 deletions(-) + +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -2541,13 +2541,6 @@ void btrfs_backref_cleanup_node(struct b + list_del(&edge->list[UPPER]); + btrfs_backref_free_edge(cache, edge); + +- if (RB_EMPTY_NODE(&upper->rb_node)) { +- BUG_ON(!list_empty(&node->upper)); +- btrfs_backref_drop_node(cache, node); +- node = upper; +- node->lowest = 1; +- continue; +- } + /* + * Add the node to leaf node list if no other child block + * cached. diff --git a/queue-5.11/btrfs-do-not-warn-if-we-can-t-find-the-reloc-root-when-looking-up-backref.patch b/queue-5.11/btrfs-do-not-warn-if-we-can-t-find-the-reloc-root-when-looking-up-backref.patch new file mode 100644 index 00000000000..0851bc1043e --- /dev/null +++ b/queue-5.11/btrfs-do-not-warn-if-we-can-t-find-the-reloc-root-when-looking-up-backref.patch @@ -0,0 +1,42 @@ +From f78743fbdae1bb31bc9c9233c3590a5048782381 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Thu, 14 Jan 2021 14:02:44 -0500 +Subject: btrfs: do not warn if we can't find the reloc root when looking up backref + +From: Josef Bacik + +commit f78743fbdae1bb31bc9c9233c3590a5048782381 upstream. + +The backref code is looking for a reloc_root that corresponds to the +given fs root. However any number of things could have gone wrong while +initializing that reloc_root, like ENOMEM while trying to allocate the +root itself, or EIO while trying to write the root item. This would +result in no corresponding reloc_root being in the reloc root cache, and +thus would return NULL when we do the find_reloc_root() call. + +Because of this we do not want to WARN_ON(). This presumably was meant +to catch developer errors, cases where we messed up adding the reloc +root. However we can easily hit this case with error injection, and +thus should not do a WARN_ON(). + +CC: stable@vger.kernel.org # 5.10+ +Reported-by: Zygo Blaxell +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/backref.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -2617,7 +2617,7 @@ static int handle_direct_tree_backref(st + /* Only reloc backref cache cares about a specific root */ + if (cache->is_reloc) { + root = find_reloc_root(cache->fs_info, cur->bytenr); +- if (WARN_ON(!root)) ++ if (!root) + return -ENOENT; + cur->root = root; + } else { diff --git a/queue-5.11/btrfs-fix-extent-buffer-leak-on-failure-to-copy-root.patch b/queue-5.11/btrfs-fix-extent-buffer-leak-on-failure-to-copy-root.patch new file mode 100644 index 00000000000..857c0420e6d --- /dev/null +++ b/queue-5.11/btrfs-fix-extent-buffer-leak-on-failure-to-copy-root.patch @@ -0,0 +1,37 @@ +From 72c9925f87c8b74f36f8e75a4cd93d964538d3ca Mon Sep 17 00:00:00 2001 +From: Filipe Manana +Date: Thu, 4 Feb 2021 14:35:44 +0000 +Subject: btrfs: fix extent buffer leak on failure to copy root + +From: Filipe Manana + +commit 72c9925f87c8b74f36f8e75a4cd93d964538d3ca upstream. + +At btrfs_copy_root(), if the call to btrfs_inc_ref() fails we end up +returning without unlocking and releasing our reference on the extent +buffer named "cow" we previously allocated with btrfs_alloc_tree_block(). + +So fix that by unlocking the extent buffer and dropping our reference on +it before returning. + +Fixes: be20aa9dbadc8c ("Btrfs: Add mount option to turn off data cow") +CC: stable@vger.kernel.org # 4.4+ +Signed-off-by: Filipe Manana +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/ctree.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -222,6 +222,8 @@ int btrfs_copy_root(struct btrfs_trans_h + else + ret = btrfs_inc_ref(trans, root, cow, 0); + if (ret) { ++ btrfs_tree_unlock(cow); ++ free_extent_buffer(cow); + btrfs_abort_transaction(trans, ret); + return ret; + } diff --git a/queue-5.11/btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch b/queue-5.11/btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch new file mode 100644 index 00000000000..0419d66de3a --- /dev/null +++ b/queue-5.11/btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch @@ -0,0 +1,48 @@ +From c78a10aebb275c38d0cfccae129a803fe622e305 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Thu, 14 Jan 2021 14:02:42 -0500 +Subject: btrfs: fix reloc root leak with 0 ref reloc roots on recovery + +From: Josef Bacik + +commit c78a10aebb275c38d0cfccae129a803fe622e305 upstream. + +When recovering a relocation, if we run into a reloc root that has 0 +refs we simply add it to the reloc_control->reloc_roots list, and then +clean it up later. The problem with this is __del_reloc_root() doesn't +do anything if the root isn't in the radix tree, which in this case it +won't be because we never call __add_reloc_root() on the reloc_root. + +This exit condition simply isn't correct really. During normal +operation we can remove ourselves from the rb tree and then we're meant +to clean up later at merge_reloc_roots() time, and this happens +correctly. During recovery we're depending on free_reloc_roots() to +drop our references, but we're short-circuiting. + +Fix this by continuing to check if we're on the list and dropping +ourselves from the reloc_control root list and dropping our reference +appropriately. Change the corresponding BUG_ON() to an ASSERT() that +does the correct thing if we aren't in the rb tree. + +CC: stable@vger.kernel.org # 4.4+ +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/relocation.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -668,9 +668,7 @@ static void __del_reloc_root(struct btrf + RB_CLEAR_NODE(&node->rb_node); + } + spin_unlock(&rc->reloc_root_tree.lock); +- if (!node) +- return; +- BUG_ON((struct btrfs_root *)node->data != root); ++ ASSERT(!node || (struct btrfs_root *)node->data == root); + } + + /* diff --git a/queue-5.11/btrfs-handle-space_info-total_bytes_pinned-inside-the-delayed-ref-itself.patch b/queue-5.11/btrfs-handle-space_info-total_bytes_pinned-inside-the-delayed-ref-itself.patch new file mode 100644 index 00000000000..6f5cfa76b9d --- /dev/null +++ b/queue-5.11/btrfs-handle-space_info-total_bytes_pinned-inside-the-delayed-ref-itself.patch @@ -0,0 +1,489 @@ +From 2187374f35fe9cadbddaa9fcf0c4121365d914e8 Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Fri, 15 Jan 2021 16:48:55 -0500 +Subject: btrfs: handle space_info::total_bytes_pinned inside the delayed ref itself + +From: Josef Bacik + +commit 2187374f35fe9cadbddaa9fcf0c4121365d914e8 upstream. + +Currently we pass things around to figure out if we maybe freeing data +based on the state of the delayed refs head. This makes the accounting +sort of confusing and hard to follow, as it's distinctly separate from +the delayed ref heads stuff, but also depends on it entirely. + +Fix this by explicitly adjusting the space_info->total_bytes_pinned in +the delayed refs code. We now have two places where we modify this +counter, once where we create the delayed and destroy the delayed refs, +and once when we pin and unpin the extents. This means there is a +slight overlap between delayed refs and the pin/unpin mechanisms, but +this is simply used by the ENOSPC infrastructure to determine if we need +to commit the transaction, so there's no adverse affect from this, we +might simply commit thinking it will give us enough space when it might +not. + +CC: stable@vger.kernel.org # 5.10 +Reviewed-by: Nikolay Borisov +Signed-off-by: Josef Bacik +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/block-group.c | 10 +---- + fs/btrfs/delayed-ref.c | 51 +++++++++++++++---------- + fs/btrfs/delayed-ref.h | 16 ++++++-- + fs/btrfs/extent-tree.c | 97 ++++++------------------------------------------- + fs/btrfs/space-info.h | 17 ++++++++ + 5 files changed, 74 insertions(+), 117 deletions(-) + +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -1371,9 +1371,7 @@ void btrfs_delete_unused_bgs(struct btrf + btrfs_space_info_update_bytes_pinned(fs_info, space_info, + -block_group->pinned); + space_info->bytes_readonly += block_group->pinned; +- percpu_counter_add_batch(&space_info->total_bytes_pinned, +- -block_group->pinned, +- BTRFS_TOTAL_BYTES_PINNED_BATCH); ++ __btrfs_mod_total_bytes_pinned(space_info, -block_group->pinned); + block_group->pinned = 0; + + spin_unlock(&block_group->lock); +@@ -2901,10 +2899,8 @@ int btrfs_update_block_group(struct btrf + spin_unlock(&cache->lock); + spin_unlock(&cache->space_info->lock); + +- percpu_counter_add_batch( +- &cache->space_info->total_bytes_pinned, +- num_bytes, +- BTRFS_TOTAL_BYTES_PINNED_BATCH); ++ __btrfs_mod_total_bytes_pinned(cache->space_info, ++ num_bytes); + set_extent_dirty(&trans->transaction->pinned_extents, + bytenr, bytenr + num_bytes - 1, + GFP_NOFS | __GFP_NOFAIL); +--- a/fs/btrfs/delayed-ref.c ++++ b/fs/btrfs/delayed-ref.c +@@ -648,12 +648,12 @@ inserted: + */ + static noinline void update_existing_head_ref(struct btrfs_trans_handle *trans, + struct btrfs_delayed_ref_head *existing, +- struct btrfs_delayed_ref_head *update, +- int *old_ref_mod_ret) ++ struct btrfs_delayed_ref_head *update) + { + struct btrfs_delayed_ref_root *delayed_refs = + &trans->transaction->delayed_refs; + struct btrfs_fs_info *fs_info = trans->fs_info; ++ u64 flags = btrfs_ref_head_to_space_flags(existing); + int old_ref_mod; + + BUG_ON(existing->is_data != update->is_data); +@@ -701,8 +701,6 @@ static noinline void update_existing_hea + * currently, for refs we just added we know we're a-ok. + */ + old_ref_mod = existing->total_ref_mod; +- if (old_ref_mod_ret) +- *old_ref_mod_ret = old_ref_mod; + existing->ref_mod += update->ref_mod; + existing->total_ref_mod += update->ref_mod; + +@@ -724,6 +722,22 @@ static noinline void update_existing_hea + trans->delayed_ref_updates += csum_leaves; + } + } ++ ++ /* ++ * This handles the following conditions: ++ * ++ * 1. We had a ref mod of 0 or more and went negative, indicating that ++ * we may be freeing space, so add our space to the ++ * total_bytes_pinned counter. ++ * 2. We were negative and went to 0 or positive, so no longer can say ++ * that the space would be pinned, decrement our counter from the ++ * total_bytes_pinned counter. ++ */ ++ if (existing->total_ref_mod < 0 && old_ref_mod >= 0) ++ btrfs_mod_total_bytes_pinned(fs_info, flags, existing->num_bytes); ++ else if (existing->total_ref_mod >= 0 && old_ref_mod < 0) ++ btrfs_mod_total_bytes_pinned(fs_info, flags, -existing->num_bytes); ++ + spin_unlock(&existing->lock); + } + +@@ -798,8 +812,7 @@ static noinline struct btrfs_delayed_ref + add_delayed_ref_head(struct btrfs_trans_handle *trans, + struct btrfs_delayed_ref_head *head_ref, + struct btrfs_qgroup_extent_record *qrecord, +- int action, int *qrecord_inserted_ret, +- int *old_ref_mod, int *new_ref_mod) ++ int action, int *qrecord_inserted_ret) + { + struct btrfs_delayed_ref_head *existing; + struct btrfs_delayed_ref_root *delayed_refs; +@@ -821,8 +834,7 @@ add_delayed_ref_head(struct btrfs_trans_ + existing = htree_insert(&delayed_refs->href_root, + &head_ref->href_node); + if (existing) { +- update_existing_head_ref(trans, existing, head_ref, +- old_ref_mod); ++ update_existing_head_ref(trans, existing, head_ref); + /* + * we've updated the existing ref, free the newly + * allocated ref +@@ -830,14 +842,17 @@ add_delayed_ref_head(struct btrfs_trans_ + kmem_cache_free(btrfs_delayed_ref_head_cachep, head_ref); + head_ref = existing; + } else { +- if (old_ref_mod) +- *old_ref_mod = 0; ++ u64 flags = btrfs_ref_head_to_space_flags(head_ref); ++ + if (head_ref->is_data && head_ref->ref_mod < 0) { + delayed_refs->pending_csums += head_ref->num_bytes; + trans->delayed_ref_updates += + btrfs_csum_bytes_to_leaves(trans->fs_info, + head_ref->num_bytes); + } ++ if (head_ref->ref_mod < 0) ++ btrfs_mod_total_bytes_pinned(trans->fs_info, flags, ++ head_ref->num_bytes); + delayed_refs->num_heads++; + delayed_refs->num_heads_ready++; + atomic_inc(&delayed_refs->num_entries); +@@ -845,8 +860,6 @@ add_delayed_ref_head(struct btrfs_trans_ + } + if (qrecord_inserted_ret) + *qrecord_inserted_ret = qrecord_inserted; +- if (new_ref_mod) +- *new_ref_mod = head_ref->total_ref_mod; + + return head_ref; + } +@@ -909,8 +922,7 @@ static void init_delayed_ref_common(stru + */ + int btrfs_add_delayed_tree_ref(struct btrfs_trans_handle *trans, + struct btrfs_ref *generic_ref, +- struct btrfs_delayed_extent_op *extent_op, +- int *old_ref_mod, int *new_ref_mod) ++ struct btrfs_delayed_extent_op *extent_op) + { + struct btrfs_fs_info *fs_info = trans->fs_info; + struct btrfs_delayed_tree_ref *ref; +@@ -977,8 +989,7 @@ int btrfs_add_delayed_tree_ref(struct bt + * the spin lock + */ + head_ref = add_delayed_ref_head(trans, head_ref, record, +- action, &qrecord_inserted, +- old_ref_mod, new_ref_mod); ++ action, &qrecord_inserted); + + ret = insert_delayed_ref(trans, delayed_refs, head_ref, &ref->node); + spin_unlock(&delayed_refs->lock); +@@ -1006,8 +1017,7 @@ int btrfs_add_delayed_tree_ref(struct bt + */ + int btrfs_add_delayed_data_ref(struct btrfs_trans_handle *trans, + struct btrfs_ref *generic_ref, +- u64 reserved, int *old_ref_mod, +- int *new_ref_mod) ++ u64 reserved) + { + struct btrfs_fs_info *fs_info = trans->fs_info; + struct btrfs_delayed_data_ref *ref; +@@ -1073,8 +1083,7 @@ int btrfs_add_delayed_data_ref(struct bt + * the spin lock + */ + head_ref = add_delayed_ref_head(trans, head_ref, record, +- action, &qrecord_inserted, +- old_ref_mod, new_ref_mod); ++ action, &qrecord_inserted); + + ret = insert_delayed_ref(trans, delayed_refs, head_ref, &ref->node); + spin_unlock(&delayed_refs->lock); +@@ -1117,7 +1126,7 @@ int btrfs_add_delayed_extent_op(struct b + spin_lock(&delayed_refs->lock); + + add_delayed_ref_head(trans, head_ref, NULL, BTRFS_UPDATE_DELAYED_HEAD, +- NULL, NULL, NULL); ++ NULL); + + spin_unlock(&delayed_refs->lock); + +--- a/fs/btrfs/delayed-ref.h ++++ b/fs/btrfs/delayed-ref.h +@@ -326,6 +326,16 @@ static inline void btrfs_put_delayed_ref + } + } + ++static inline u64 btrfs_ref_head_to_space_flags( ++ struct btrfs_delayed_ref_head *head_ref) ++{ ++ if (head_ref->is_data) ++ return BTRFS_BLOCK_GROUP_DATA; ++ else if (head_ref->is_system) ++ return BTRFS_BLOCK_GROUP_SYSTEM; ++ return BTRFS_BLOCK_GROUP_METADATA; ++} ++ + static inline void btrfs_put_delayed_ref_head(struct btrfs_delayed_ref_head *head) + { + if (refcount_dec_and_test(&head->refs)) +@@ -334,12 +344,10 @@ static inline void btrfs_put_delayed_ref + + int btrfs_add_delayed_tree_ref(struct btrfs_trans_handle *trans, + struct btrfs_ref *generic_ref, +- struct btrfs_delayed_extent_op *extent_op, +- int *old_ref_mod, int *new_ref_mod); ++ struct btrfs_delayed_extent_op *extent_op); + int btrfs_add_delayed_data_ref(struct btrfs_trans_handle *trans, + struct btrfs_ref *generic_ref, +- u64 reserved, int *old_ref_mod, +- int *new_ref_mod); ++ u64 reserved); + int btrfs_add_delayed_extent_op(struct btrfs_trans_handle *trans, + u64 bytenr, u64 num_bytes, + struct btrfs_delayed_extent_op *extent_op); +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -82,41 +82,6 @@ void btrfs_free_excluded_extents(struct + EXTENT_UPTODATE); + } + +-static u64 generic_ref_to_space_flags(struct btrfs_ref *ref) +-{ +- if (ref->type == BTRFS_REF_METADATA) { +- if (ref->tree_ref.root == BTRFS_CHUNK_TREE_OBJECTID) +- return BTRFS_BLOCK_GROUP_SYSTEM; +- else +- return BTRFS_BLOCK_GROUP_METADATA; +- } +- return BTRFS_BLOCK_GROUP_DATA; +-} +- +-static void add_pinned_bytes(struct btrfs_fs_info *fs_info, +- struct btrfs_ref *ref) +-{ +- struct btrfs_space_info *space_info; +- u64 flags = generic_ref_to_space_flags(ref); +- +- space_info = btrfs_find_space_info(fs_info, flags); +- ASSERT(space_info); +- percpu_counter_add_batch(&space_info->total_bytes_pinned, ref->len, +- BTRFS_TOTAL_BYTES_PINNED_BATCH); +-} +- +-static void sub_pinned_bytes(struct btrfs_fs_info *fs_info, +- struct btrfs_ref *ref) +-{ +- struct btrfs_space_info *space_info; +- u64 flags = generic_ref_to_space_flags(ref); +- +- space_info = btrfs_find_space_info(fs_info, flags); +- ASSERT(space_info); +- percpu_counter_add_batch(&space_info->total_bytes_pinned, -ref->len, +- BTRFS_TOTAL_BYTES_PINNED_BATCH); +-} +- + /* simple helper to search for an existing data extent at a given offset */ + int btrfs_lookup_data_extent(struct btrfs_fs_info *fs_info, u64 start, u64 len) + { +@@ -1388,7 +1353,6 @@ int btrfs_inc_extent_ref(struct btrfs_tr + struct btrfs_ref *generic_ref) + { + struct btrfs_fs_info *fs_info = trans->fs_info; +- int old_ref_mod, new_ref_mod; + int ret; + + ASSERT(generic_ref->type != BTRFS_REF_NOT_SET && +@@ -1397,17 +1361,12 @@ int btrfs_inc_extent_ref(struct btrfs_tr + generic_ref->tree_ref.root == BTRFS_TREE_LOG_OBJECTID); + + if (generic_ref->type == BTRFS_REF_METADATA) +- ret = btrfs_add_delayed_tree_ref(trans, generic_ref, +- NULL, &old_ref_mod, &new_ref_mod); ++ ret = btrfs_add_delayed_tree_ref(trans, generic_ref, NULL); + else +- ret = btrfs_add_delayed_data_ref(trans, generic_ref, 0, +- &old_ref_mod, &new_ref_mod); ++ ret = btrfs_add_delayed_data_ref(trans, generic_ref, 0); + + btrfs_ref_tree_mod(fs_info, generic_ref); + +- if (ret == 0 && old_ref_mod < 0 && new_ref_mod >= 0) +- sub_pinned_bytes(fs_info, generic_ref); +- + return ret; + } + +@@ -1796,20 +1755,9 @@ void btrfs_cleanup_ref_head_accounting(s + int nr_items = 1; /* Dropping this ref head update. */ + + if (head->total_ref_mod < 0) { +- struct btrfs_space_info *space_info; +- u64 flags; ++ u64 flags = btrfs_ref_head_to_space_flags(head); + +- if (head->is_data) +- flags = BTRFS_BLOCK_GROUP_DATA; +- else if (head->is_system) +- flags = BTRFS_BLOCK_GROUP_SYSTEM; +- else +- flags = BTRFS_BLOCK_GROUP_METADATA; +- space_info = btrfs_find_space_info(fs_info, flags); +- ASSERT(space_info); +- percpu_counter_add_batch(&space_info->total_bytes_pinned, +- -head->num_bytes, +- BTRFS_TOTAL_BYTES_PINNED_BATCH); ++ btrfs_mod_total_bytes_pinned(fs_info, flags, -head->num_bytes); + + /* + * We had csum deletions accounted for in our delayed refs rsv, +@@ -2572,8 +2520,7 @@ static int pin_down_extent(struct btrfs_ + spin_unlock(&cache->lock); + spin_unlock(&cache->space_info->lock); + +- percpu_counter_add_batch(&cache->space_info->total_bytes_pinned, +- num_bytes, BTRFS_TOTAL_BYTES_PINNED_BATCH); ++ __btrfs_mod_total_bytes_pinned(cache->space_info, num_bytes); + set_extent_dirty(&trans->transaction->pinned_extents, bytenr, + bytenr + num_bytes - 1, GFP_NOFS | __GFP_NOFAIL); + return 0; +@@ -2784,8 +2731,7 @@ static int unpin_extent_range(struct btr + cache->pinned -= len; + btrfs_space_info_update_bytes_pinned(fs_info, space_info, -len); + space_info->max_extent_size = 0; +- percpu_counter_add_batch(&space_info->total_bytes_pinned, +- -len, BTRFS_TOTAL_BYTES_PINNED_BATCH); ++ __btrfs_mod_total_bytes_pinned(space_info, -len); + if (cache->ro) { + space_info->bytes_readonly += len; + readonly = true; +@@ -3318,7 +3264,6 @@ void btrfs_free_tree_block(struct btrfs_ + { + struct btrfs_fs_info *fs_info = root->fs_info; + struct btrfs_ref generic_ref = { 0 }; +- int pin = 1; + int ret; + + btrfs_init_generic_ref(&generic_ref, BTRFS_DROP_DELAYED_REF, +@@ -3327,13 +3272,9 @@ void btrfs_free_tree_block(struct btrfs_ + root->root_key.objectid); + + if (root->root_key.objectid != BTRFS_TREE_LOG_OBJECTID) { +- int old_ref_mod, new_ref_mod; +- + btrfs_ref_tree_mod(fs_info, &generic_ref); +- ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, NULL, +- &old_ref_mod, &new_ref_mod); ++ ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, NULL); + BUG_ON(ret); /* -ENOMEM */ +- pin = old_ref_mod >= 0 && new_ref_mod < 0; + } + + if (last_ref && btrfs_header_generation(buf) == trans->transid) { +@@ -3345,7 +3286,6 @@ void btrfs_free_tree_block(struct btrfs_ + goto out; + } + +- pin = 0; + cache = btrfs_lookup_block_group(fs_info, buf->start); + + if (btrfs_header_flag(buf, BTRFS_HEADER_FLAG_WRITTEN)) { +@@ -3362,9 +3302,6 @@ void btrfs_free_tree_block(struct btrfs_ + trace_btrfs_reserved_extent_free(fs_info, buf->start, buf->len); + } + out: +- if (pin) +- add_pinned_bytes(fs_info, &generic_ref); +- + if (last_ref) { + /* + * Deleting the buffer, clear the corrupt flag since it doesn't +@@ -3378,7 +3315,6 @@ out: + int btrfs_free_extent(struct btrfs_trans_handle *trans, struct btrfs_ref *ref) + { + struct btrfs_fs_info *fs_info = trans->fs_info; +- int old_ref_mod, new_ref_mod; + int ret; + + if (btrfs_is_testing(fs_info)) +@@ -3394,14 +3330,11 @@ int btrfs_free_extent(struct btrfs_trans + ref->data_ref.ref_root == BTRFS_TREE_LOG_OBJECTID)) { + /* unlocks the pinned mutex */ + btrfs_pin_extent(trans, ref->bytenr, ref->len, 1); +- old_ref_mod = new_ref_mod = 0; + ret = 0; + } else if (ref->type == BTRFS_REF_METADATA) { +- ret = btrfs_add_delayed_tree_ref(trans, ref, NULL, +- &old_ref_mod, &new_ref_mod); ++ ret = btrfs_add_delayed_tree_ref(trans, ref, NULL); + } else { +- ret = btrfs_add_delayed_data_ref(trans, ref, 0, +- &old_ref_mod, &new_ref_mod); ++ ret = btrfs_add_delayed_data_ref(trans, ref, 0); + } + + if (!((ref->type == BTRFS_REF_METADATA && +@@ -3410,9 +3343,6 @@ int btrfs_free_extent(struct btrfs_trans + ref->data_ref.ref_root == BTRFS_TREE_LOG_OBJECTID))) + btrfs_ref_tree_mod(fs_info, ref); + +- if (ret == 0 && old_ref_mod >= 0 && new_ref_mod < 0) +- add_pinned_bytes(fs_info, ref); +- + return ret; + } + +@@ -4528,7 +4458,6 @@ int btrfs_alloc_reserved_file_extent(str + struct btrfs_key *ins) + { + struct btrfs_ref generic_ref = { 0 }; +- int ret; + + BUG_ON(root->root_key.objectid == BTRFS_TREE_LOG_OBJECTID); + +@@ -4536,9 +4465,8 @@ int btrfs_alloc_reserved_file_extent(str + ins->objectid, ins->offset, 0); + btrfs_init_data_ref(&generic_ref, root->root_key.objectid, owner, offset); + btrfs_ref_tree_mod(root->fs_info, &generic_ref); +- ret = btrfs_add_delayed_data_ref(trans, &generic_ref, +- ram_bytes, NULL, NULL); +- return ret; ++ ++ return btrfs_add_delayed_data_ref(trans, &generic_ref, ram_bytes); + } + + /* +@@ -4730,8 +4658,7 @@ struct extent_buffer *btrfs_alloc_tree_b + generic_ref.real_root = root->root_key.objectid; + btrfs_init_tree_ref(&generic_ref, level, root_objectid); + btrfs_ref_tree_mod(fs_info, &generic_ref); +- ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, +- extent_op, NULL, NULL); ++ ret = btrfs_add_delayed_tree_ref(trans, &generic_ref, extent_op); + if (ret) + goto out_free_delayed; + } +--- a/fs/btrfs/space-info.h ++++ b/fs/btrfs/space-info.h +@@ -152,4 +152,21 @@ static inline void btrfs_space_info_free + int btrfs_reserve_data_bytes(struct btrfs_fs_info *fs_info, u64 bytes, + enum btrfs_reserve_flush_enum flush); + ++static inline void __btrfs_mod_total_bytes_pinned( ++ struct btrfs_space_info *space_info, ++ s64 mod) ++{ ++ percpu_counter_add_batch(&space_info->total_bytes_pinned, mod, ++ BTRFS_TOTAL_BYTES_PINNED_BATCH); ++} ++ ++static inline void btrfs_mod_total_bytes_pinned(struct btrfs_fs_info *fs_info, ++ u64 flags, s64 mod) ++{ ++ struct btrfs_space_info *space_info = btrfs_find_space_info(fs_info, flags); ++ ++ ASSERT(space_info); ++ __btrfs_mod_total_bytes_pinned(space_info, mod); ++} ++ + #endif /* BTRFS_SPACE_INFO_H */ diff --git a/queue-5.11/btrfs-splice-remaining-dirty_bg-s-onto-the-transaction-dirty-bg-list.patch b/queue-5.11/btrfs-splice-remaining-dirty_bg-s-onto-the-transaction-dirty-bg-list.patch new file mode 100644 index 00000000000..3126ab9187e --- /dev/null +++ b/queue-5.11/btrfs-splice-remaining-dirty_bg-s-onto-the-transaction-dirty-bg-list.patch @@ -0,0 +1,115 @@ +From 938fcbfb0cbcf532a1869efab58e6009446b1ced Mon Sep 17 00:00:00 2001 +From: Josef Bacik +Date: Thu, 14 Jan 2021 14:02:43 -0500 +Subject: btrfs: splice remaining dirty_bg's onto the transaction dirty bg list + +From: Josef Bacik + +commit 938fcbfb0cbcf532a1869efab58e6009446b1ced upstream. + +While doing error injection testing with my relocation patches I hit the +following assert: + + assertion failed: list_empty(&block_group->dirty_list), in fs/btrfs/block-group.c:3356 + ------------[ cut here ]------------ + kernel BUG at fs/btrfs/ctree.h:3357! + invalid opcode: 0000 [#1] SMP NOPTI + CPU: 0 PID: 24351 Comm: umount Tainted: G W 5.10.0-rc3+ #193 + Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-2.fc32 04/01/2014 + RIP: 0010:assertfail.constprop.0+0x18/0x1a + RSP: 0018:ffffa09b019c7e00 EFLAGS: 00010282 + RAX: 0000000000000056 RBX: ffff8f6492c18000 RCX: 0000000000000000 + RDX: ffff8f64fbc27c60 RSI: ffff8f64fbc19050 RDI: ffff8f64fbc19050 + RBP: ffff8f6483bbdc00 R08: 0000000000000000 R09: 0000000000000000 + R10: ffffa09b019c7c38 R11: ffffffff85d70928 R12: ffff8f6492c18100 + R13: ffff8f6492c18148 R14: ffff8f6483bbdd70 R15: dead000000000100 + FS: 00007fbfda4cdc40(0000) GS:ffff8f64fbc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00007fbfda666fd0 CR3: 000000013cf66002 CR4: 0000000000370ef0 + Call Trace: + btrfs_free_block_groups.cold+0x55/0x55 + close_ctree+0x2c5/0x306 + ? fsnotify_destroy_marks+0x14/0x100 + generic_shutdown_super+0x6c/0x100 + kill_anon_super+0x14/0x30 + btrfs_kill_super+0x12/0x20 + deactivate_locked_super+0x36/0xa0 + cleanup_mnt+0x12d/0x190 + task_work_run+0x5c/0xa0 + exit_to_user_mode_prepare+0x1b1/0x1d0 + syscall_exit_to_user_mode+0x54/0x280 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +This happened because I injected an error in btrfs_cow_block() while +running the dirty block groups. When we run the dirty block groups, we +splice the list onto a local list to process. However if an error +occurs, we only cleanup the transactions dirty block group list, not any +pending block groups we have on our locally spliced list. + +In fact if we fail to allocate a path in this function we'll also fail +to clean up the splice list. + +Fix this by splicing the list back onto the transaction dirty block +group list so that the block groups are cleaned up. Then add a 'out' +label and have the error conditions jump to out so that the errors are +handled properly. This also has the side-effect of fixing a problem +where we would clear 'ret' on error because we unconditionally ran +btrfs_run_delayed_refs(). + +CC: stable@vger.kernel.org # 4.4+ +Signed-off-by: Josef Bacik +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/block-group.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +--- a/fs/btrfs/block-group.c ++++ b/fs/btrfs/block-group.c +@@ -2564,8 +2564,10 @@ again: + + if (!path) { + path = btrfs_alloc_path(); +- if (!path) +- return -ENOMEM; ++ if (!path) { ++ ret = -ENOMEM; ++ goto out; ++ } + } + + /* +@@ -2659,16 +2661,14 @@ again: + btrfs_put_block_group(cache); + if (drop_reserve) + btrfs_delayed_refs_rsv_release(fs_info, 1); +- +- if (ret) +- break; +- + /* + * Avoid blocking other tasks for too long. It might even save + * us from writing caches for block groups that are going to be + * removed. + */ + mutex_unlock(&trans->transaction->cache_write_mutex); ++ if (ret) ++ goto out; + mutex_lock(&trans->transaction->cache_write_mutex); + } + mutex_unlock(&trans->transaction->cache_write_mutex); +@@ -2692,7 +2692,12 @@ again: + goto again; + } + spin_unlock(&cur_trans->dirty_bgs_lock); +- } else if (ret < 0) { ++ } ++out: ++ if (ret < 0) { ++ spin_lock(&cur_trans->dirty_bgs_lock); ++ list_splice_init(&dirty, &cur_trans->dirty_bgs); ++ spin_unlock(&cur_trans->dirty_bgs_lock); + btrfs_cleanup_dirty_bgs(cur_trans, fs_info); + } + diff --git a/queue-5.11/cpufreq-acpi-set-cpuinfo.max_freq-directly-if-max-boost-is-known.patch b/queue-5.11/cpufreq-acpi-set-cpuinfo.max_freq-directly-if-max-boost-is-known.patch new file mode 100644 index 00000000000..b1668ee122b --- /dev/null +++ b/queue-5.11/cpufreq-acpi-set-cpuinfo.max_freq-directly-if-max-boost-is-known.patch @@ -0,0 +1,194 @@ +From 538b0188da4653b9f4511a114f014354fb6fb7a5 Mon Sep 17 00:00:00 2001 +From: "Rafael J. Wysocki" +Date: Mon, 15 Feb 2021 20:24:46 +0100 +Subject: cpufreq: ACPI: Set cpuinfo.max_freq directly if max boost is known + +From: Rafael J. Wysocki + +commit 538b0188da4653b9f4511a114f014354fb6fb7a5 upstream. + +Commit 3c55e94c0ade ("cpufreq: ACPI: Extend frequency tables to cover +boost frequencies") attempted to address a performance issue involving +acpi-cpufreq, the schedutil governor and scale-invariance on x86 by +extending the frequency tables created by acpi-cpufreq to cover the +entire range of "turbo" (or "boost") frequencies, but that caused +frequencies reported via /proc/cpuinfo and the scaling_cur_freq +attribute in sysfs to change which may confuse users and monitoring +tools. + +For this reason, revert the part of commit 3c55e94c0ade adding the +extra entry to the frequency table and use the observation that +in principle cpuinfo.max_freq need not be equal to the maximum +frequency listed in the frequency table for the given policy. + +Namely, modify cpufreq_frequency_table_cpuinfo() to allow cpufreq +drivers to set their own cpuinfo.max_freq above that frequency and +change acpi-cpufreq to set cpuinfo.max_freq to the maximum boost +frequency found via CPPC. + +This should be sufficient to let all of the cpufreq subsystem know +the real maximum frequency of the CPU without changing frequency +reporting. + +Link: https://bugzilla.kernel.org/show_bug.cgi?id=211305 +Fixes: 3c55e94c0ade ("cpufreq: ACPI: Extend frequency tables to cover boost frequencies") +Reported-by: Matt McDonald +Tested-by: Matt McDonald +Signed-off-by: Rafael J. Wysocki +Tested-by: Giovanni Gherdovich +Tested-by: Michael Larabel +Cc: 5.11+ # 5.11+ +Signed-off-by: Greg Kroah-Hartman +--- + drivers/cpufreq/acpi-cpufreq.c | 62 ++++++++++------------------------------- + drivers/cpufreq/freq_table.c | 8 ++++- + 2 files changed, 23 insertions(+), 47 deletions(-) + +--- a/drivers/cpufreq/acpi-cpufreq.c ++++ b/drivers/cpufreq/acpi-cpufreq.c +@@ -54,7 +54,6 @@ struct acpi_cpufreq_data { + unsigned int resume; + unsigned int cpu_feature; + unsigned int acpi_perf_cpu; +- unsigned int first_perf_state; + cpumask_var_t freqdomain_cpus; + void (*cpu_freq_write)(struct acpi_pct_register *reg, u32 val); + u32 (*cpu_freq_read)(struct acpi_pct_register *reg); +@@ -223,10 +222,10 @@ static unsigned extract_msr(struct cpufr + + perf = to_perf_data(data); + +- cpufreq_for_each_entry(pos, policy->freq_table + data->first_perf_state) ++ cpufreq_for_each_entry(pos, policy->freq_table) + if (msr == perf->states[pos->driver_data].status) + return pos->frequency; +- return policy->freq_table[data->first_perf_state].frequency; ++ return policy->freq_table[0].frequency; + } + + static unsigned extract_freq(struct cpufreq_policy *policy, u32 val) +@@ -365,7 +364,6 @@ static unsigned int get_cur_freq_on_cpu( + struct cpufreq_policy *policy; + unsigned int freq; + unsigned int cached_freq; +- unsigned int state; + + pr_debug("%s (%d)\n", __func__, cpu); + +@@ -377,11 +375,7 @@ static unsigned int get_cur_freq_on_cpu( + if (unlikely(!data || !policy->freq_table)) + return 0; + +- state = to_perf_data(data)->state; +- if (state < data->first_perf_state) +- state = data->first_perf_state; +- +- cached_freq = policy->freq_table[state].frequency; ++ cached_freq = policy->freq_table[to_perf_data(data)->state].frequency; + freq = extract_freq(policy, get_cur_val(cpumask_of(cpu), data)); + if (freq != cached_freq) { + /* +@@ -680,7 +674,6 @@ static int acpi_cpufreq_cpu_init(struct + struct cpuinfo_x86 *c = &cpu_data(cpu); + unsigned int valid_states = 0; + unsigned int result = 0; +- unsigned int state_count; + u64 max_boost_ratio; + unsigned int i; + #ifdef CONFIG_SMP +@@ -795,28 +788,8 @@ static int acpi_cpufreq_cpu_init(struct + goto err_unreg; + } + +- state_count = perf->state_count + 1; +- +- max_boost_ratio = get_max_boost_ratio(cpu); +- if (max_boost_ratio) { +- /* +- * Make a room for one more entry to represent the highest +- * available "boost" frequency. +- */ +- state_count++; +- valid_states++; +- data->first_perf_state = valid_states; +- } else { +- /* +- * If the maximum "boost" frequency is unknown, ask the arch +- * scale-invariance code to use the "nominal" performance for +- * CPU utilization scaling so as to prevent the schedutil +- * governor from selecting inadequate CPU frequencies. +- */ +- arch_set_max_freq_ratio(true); +- } +- +- freq_table = kcalloc(state_count, sizeof(*freq_table), GFP_KERNEL); ++ freq_table = kcalloc(perf->state_count + 1, sizeof(*freq_table), ++ GFP_KERNEL); + if (!freq_table) { + result = -ENOMEM; + goto err_unreg; +@@ -851,27 +824,25 @@ static int acpi_cpufreq_cpu_init(struct + } + freq_table[valid_states].frequency = CPUFREQ_TABLE_END; + ++ max_boost_ratio = get_max_boost_ratio(cpu); + if (max_boost_ratio) { +- unsigned int state = data->first_perf_state; +- unsigned int freq = freq_table[state].frequency; ++ unsigned int freq = freq_table[0].frequency; + + /* + * Because the loop above sorts the freq_table entries in the + * descending order, freq is the maximum frequency in the table. + * Assume that it corresponds to the CPPC nominal frequency and +- * use it to populate the frequency field of the extra "boost" +- * frequency entry. ++ * use it to set cpuinfo.max_freq. + */ +- freq_table[0].frequency = freq * max_boost_ratio >> SCHED_CAPACITY_SHIFT; ++ policy->cpuinfo.max_freq = freq * max_boost_ratio >> SCHED_CAPACITY_SHIFT; ++ } else { + /* +- * The purpose of the extra "boost" frequency entry is to make +- * the rest of cpufreq aware of the real maximum frequency, but +- * the way to request it is the same as for the first_perf_state +- * entry that is expected to cover the entire range of "boost" +- * frequencies of the CPU, so copy the driver_data value from +- * that entry. ++ * If the maximum "boost" frequency is unknown, ask the arch ++ * scale-invariance code to use the "nominal" performance for ++ * CPU utilization scaling so as to prevent the schedutil ++ * governor from selecting inadequate CPU frequencies. + */ +- freq_table[0].driver_data = freq_table[state].driver_data; ++ arch_set_max_freq_ratio(true); + } + + policy->freq_table = freq_table; +@@ -947,8 +918,7 @@ static void acpi_cpufreq_cpu_ready(struc + { + struct acpi_processor_performance *perf = per_cpu_ptr(acpi_perf_data, + policy->cpu); +- struct acpi_cpufreq_data *data = policy->driver_data; +- unsigned int freq = policy->freq_table[data->first_perf_state].frequency; ++ unsigned int freq = policy->freq_table[0].frequency; + + if (perf->states[0].core_frequency * 1000 != freq) + pr_warn(FW_WARN "P-state 0 is not max freq\n"); +--- a/drivers/cpufreq/freq_table.c ++++ b/drivers/cpufreq/freq_table.c +@@ -52,7 +52,13 @@ int cpufreq_frequency_table_cpuinfo(stru + } + + policy->min = policy->cpuinfo.min_freq = min_freq; +- policy->max = policy->cpuinfo.max_freq = max_freq; ++ policy->max = max_freq; ++ /* ++ * If the driver has set its own cpuinfo.max_freq above max_freq, leave ++ * it as is. ++ */ ++ if (policy->cpuinfo.max_freq < max_freq) ++ policy->max = policy->cpuinfo.max_freq = max_freq; + + if (policy->min == ~0) + return -EINVAL; diff --git a/queue-5.11/crypto-aesni-prevent-misaligned-buffers-on-the-stack.patch b/queue-5.11/crypto-aesni-prevent-misaligned-buffers-on-the-stack.patch new file mode 100644 index 00000000000..28760c331c0 --- /dev/null +++ b/queue-5.11/crypto-aesni-prevent-misaligned-buffers-on-the-stack.patch @@ -0,0 +1,124 @@ +From a13ed1d15b07a04b1f74b2df61ff7a5e47f45dd8 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Mon, 4 Jan 2021 16:55:46 +0100 +Subject: crypto: aesni - prevent misaligned buffers on the stack + +From: Ard Biesheuvel + +commit a13ed1d15b07a04b1f74b2df61ff7a5e47f45dd8 upstream. + +The GCM mode driver uses 16 byte aligned buffers on the stack to pass +the IV to the asm helpers, but unfortunately, the x86 port does not +guarantee that the stack pointer is 16 byte aligned upon entry in the +first place. Since the compiler is not aware of this, it will not emit +the additional stack realignment sequence that is needed, and so the +alignment is not guaranteed to be more than 8 bytes. + +So instead, allocate some padding on the stack, and realign the IV +pointer by hand. + +Cc: +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/crypto/aesni-intel_glue.c | 28 ++++++++++++++++------------ + 1 file changed, 16 insertions(+), 12 deletions(-) + +--- a/arch/x86/crypto/aesni-intel_glue.c ++++ b/arch/x86/crypto/aesni-intel_glue.c +@@ -686,7 +686,8 @@ static int gcmaes_crypt_by_sg(bool enc, + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + unsigned long auth_tag_len = crypto_aead_authsize(tfm); + const struct aesni_gcm_tfm_s *gcm_tfm = aesni_gcm_tfm; +- struct gcm_context_data data AESNI_ALIGN_ATTR; ++ u8 databuf[sizeof(struct gcm_context_data) + (AESNI_ALIGN - 8)] __aligned(8); ++ struct gcm_context_data *data = PTR_ALIGN((void *)databuf, AESNI_ALIGN); + struct scatter_walk dst_sg_walk = {}; + unsigned long left = req->cryptlen; + unsigned long len, srclen, dstlen; +@@ -735,8 +736,7 @@ static int gcmaes_crypt_by_sg(bool enc, + } + + kernel_fpu_begin(); +- gcm_tfm->init(aes_ctx, &data, iv, +- hash_subkey, assoc, assoclen); ++ gcm_tfm->init(aes_ctx, data, iv, hash_subkey, assoc, assoclen); + if (req->src != req->dst) { + while (left) { + src = scatterwalk_map(&src_sg_walk); +@@ -746,10 +746,10 @@ static int gcmaes_crypt_by_sg(bool enc, + len = min(srclen, dstlen); + if (len) { + if (enc) +- gcm_tfm->enc_update(aes_ctx, &data, ++ gcm_tfm->enc_update(aes_ctx, data, + dst, src, len); + else +- gcm_tfm->dec_update(aes_ctx, &data, ++ gcm_tfm->dec_update(aes_ctx, data, + dst, src, len); + } + left -= len; +@@ -767,10 +767,10 @@ static int gcmaes_crypt_by_sg(bool enc, + len = scatterwalk_clamp(&src_sg_walk, left); + if (len) { + if (enc) +- gcm_tfm->enc_update(aes_ctx, &data, ++ gcm_tfm->enc_update(aes_ctx, data, + src, src, len); + else +- gcm_tfm->dec_update(aes_ctx, &data, ++ gcm_tfm->dec_update(aes_ctx, data, + src, src, len); + } + left -= len; +@@ -779,7 +779,7 @@ static int gcmaes_crypt_by_sg(bool enc, + scatterwalk_done(&src_sg_walk, 1, left); + } + } +- gcm_tfm->finalize(aes_ctx, &data, authTag, auth_tag_len); ++ gcm_tfm->finalize(aes_ctx, data, authTag, auth_tag_len); + kernel_fpu_end(); + + if (!assocmem) +@@ -828,7 +828,8 @@ static int helper_rfc4106_encrypt(struct + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm); + void *aes_ctx = &(ctx->aes_key_expanded); +- u8 iv[16] __attribute__ ((__aligned__(AESNI_ALIGN))); ++ u8 ivbuf[16 + (AESNI_ALIGN - 8)] __aligned(8); ++ u8 *iv = PTR_ALIGN(&ivbuf[0], AESNI_ALIGN); + unsigned int i; + __be32 counter = cpu_to_be32(1); + +@@ -855,7 +856,8 @@ static int helper_rfc4106_decrypt(struct + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct aesni_rfc4106_gcm_ctx *ctx = aesni_rfc4106_gcm_ctx_get(tfm); + void *aes_ctx = &(ctx->aes_key_expanded); +- u8 iv[16] __attribute__ ((__aligned__(AESNI_ALIGN))); ++ u8 ivbuf[16 + (AESNI_ALIGN - 8)] __aligned(8); ++ u8 *iv = PTR_ALIGN(&ivbuf[0], AESNI_ALIGN); + unsigned int i; + + if (unlikely(req->assoclen != 16 && req->assoclen != 20)) +@@ -985,7 +987,8 @@ static int generic_gcmaes_encrypt(struct + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct generic_gcmaes_ctx *ctx = generic_gcmaes_ctx_get(tfm); + void *aes_ctx = &(ctx->aes_key_expanded); +- u8 iv[16] __attribute__ ((__aligned__(AESNI_ALIGN))); ++ u8 ivbuf[16 + (AESNI_ALIGN - 8)] __aligned(8); ++ u8 *iv = PTR_ALIGN(&ivbuf[0], AESNI_ALIGN); + __be32 counter = cpu_to_be32(1); + + memcpy(iv, req->iv, 12); +@@ -1001,7 +1004,8 @@ static int generic_gcmaes_decrypt(struct + struct crypto_aead *tfm = crypto_aead_reqtfm(req); + struct generic_gcmaes_ctx *ctx = generic_gcmaes_ctx_get(tfm); + void *aes_ctx = &(ctx->aes_key_expanded); +- u8 iv[16] __attribute__ ((__aligned__(AESNI_ALIGN))); ++ u8 ivbuf[16 + (AESNI_ALIGN - 8)] __aligned(8); ++ u8 *iv = PTR_ALIGN(&ivbuf[0], AESNI_ALIGN); + + memcpy(iv, req->iv, 12); + *((__be32 *)(iv+12)) = counter; diff --git a/queue-5.11/crypto-arm64-sha-add-missing-module-aliases.patch b/queue-5.11/crypto-arm64-sha-add-missing-module-aliases.patch new file mode 100644 index 00000000000..5a91f6db68f --- /dev/null +++ b/queue-5.11/crypto-arm64-sha-add-missing-module-aliases.patch @@ -0,0 +1,77 @@ +From 0df07d8117c3576f1603b05b84089742a118d10a Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Thu, 14 Jan 2021 19:10:10 +0100 +Subject: crypto: arm64/sha - add missing module aliases + +From: Ard Biesheuvel + +commit 0df07d8117c3576f1603b05b84089742a118d10a upstream. + +The accelerated, instruction based implementations of SHA1, SHA2 and +SHA3 are autoloaded based on CPU capabilities, given that the code is +modest in size, and widely used, which means that resolving the algo +name, loading all compatible modules and picking the one with the +highest priority is taken to be suboptimal. + +However, if these algorithms are requested before this CPU feature +based matching and autoloading occurs, these modules are not even +considered, and we end up with suboptimal performance. + +So add the missing module aliases for the various SHA implementations. + +Cc: +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/crypto/sha1-ce-glue.c | 1 + + arch/arm64/crypto/sha2-ce-glue.c | 2 ++ + arch/arm64/crypto/sha3-ce-glue.c | 4 ++++ + arch/arm64/crypto/sha512-ce-glue.c | 2 ++ + 4 files changed, 9 insertions(+) + +--- a/arch/arm64/crypto/sha1-ce-glue.c ++++ b/arch/arm64/crypto/sha1-ce-glue.c +@@ -19,6 +19,7 @@ + MODULE_DESCRIPTION("SHA1 secure hash using ARMv8 Crypto Extensions"); + MODULE_AUTHOR("Ard Biesheuvel "); + MODULE_LICENSE("GPL v2"); ++MODULE_ALIAS_CRYPTO("sha1"); + + struct sha1_ce_state { + struct sha1_state sst; +--- a/arch/arm64/crypto/sha2-ce-glue.c ++++ b/arch/arm64/crypto/sha2-ce-glue.c +@@ -19,6 +19,8 @@ + MODULE_DESCRIPTION("SHA-224/SHA-256 secure hash using ARMv8 Crypto Extensions"); + MODULE_AUTHOR("Ard Biesheuvel "); + MODULE_LICENSE("GPL v2"); ++MODULE_ALIAS_CRYPTO("sha224"); ++MODULE_ALIAS_CRYPTO("sha256"); + + struct sha256_ce_state { + struct sha256_state sst; +--- a/arch/arm64/crypto/sha3-ce-glue.c ++++ b/arch/arm64/crypto/sha3-ce-glue.c +@@ -23,6 +23,10 @@ + MODULE_DESCRIPTION("SHA3 secure hash using ARMv8 Crypto Extensions"); + MODULE_AUTHOR("Ard Biesheuvel "); + MODULE_LICENSE("GPL v2"); ++MODULE_ALIAS_CRYPTO("sha3-224"); ++MODULE_ALIAS_CRYPTO("sha3-256"); ++MODULE_ALIAS_CRYPTO("sha3-384"); ++MODULE_ALIAS_CRYPTO("sha3-512"); + + asmlinkage void sha3_ce_transform(u64 *st, const u8 *data, int blocks, + int md_len); +--- a/arch/arm64/crypto/sha512-ce-glue.c ++++ b/arch/arm64/crypto/sha512-ce-glue.c +@@ -23,6 +23,8 @@ + MODULE_DESCRIPTION("SHA-384/SHA-512 secure hash using ARMv8 Crypto Extensions"); + MODULE_AUTHOR("Ard Biesheuvel "); + MODULE_LICENSE("GPL v2"); ++MODULE_ALIAS_CRYPTO("sha384"); ++MODULE_ALIAS_CRYPTO("sha512"); + + asmlinkage void sha512_ce_transform(struct sha512_state *sst, u8 const *src, + int blocks); diff --git a/queue-5.11/crypto-michael_mic-fix-broken-misalignment-handling.patch b/queue-5.11/crypto-michael_mic-fix-broken-misalignment-handling.patch new file mode 100644 index 00000000000..1ddf5fe9601 --- /dev/null +++ b/queue-5.11/crypto-michael_mic-fix-broken-misalignment-handling.patch @@ -0,0 +1,141 @@ +From e1b2d980f03b833442768c1987d5ad0b9a58cfe7 Mon Sep 17 00:00:00 2001 +From: Ard Biesheuvel +Date: Mon, 1 Feb 2021 19:02:29 +0100 +Subject: crypto: michael_mic - fix broken misalignment handling + +From: Ard Biesheuvel + +commit e1b2d980f03b833442768c1987d5ad0b9a58cfe7 upstream. + +The Michael MIC driver uses the cra_alignmask to ensure that pointers +presented to its update and finup/final methods are 32-bit aligned. +However, due to the way the shash API works, this is no guarantee that +the 32-bit reads occurring in the update method are also aligned, as the +size of the buffer presented to update may be of uneven length. For +instance, an update() of 3 bytes followed by a misaligned update() of 4 +or more bytes will result in a misaligned access using an accessor that +is not suitable for this. + +On most architectures, this does not matter, and so setting the +cra_alignmask is pointless. On architectures where this does matter, +setting the cra_alignmask does not actually solve the problem. + +So let's get rid of the cra_alignmask, and use unaligned accessors +instead, where appropriate. + +Cc: +Signed-off-by: Ard Biesheuvel +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + crypto/michael_mic.c | 31 ++++++++++++------------------- + 1 file changed, 12 insertions(+), 19 deletions(-) + +--- a/crypto/michael_mic.c ++++ b/crypto/michael_mic.c +@@ -7,7 +7,7 @@ + * Copyright (c) 2004 Jouni Malinen + */ + #include +-#include ++#include + #include + #include + #include +@@ -19,7 +19,7 @@ struct michael_mic_ctx { + }; + + struct michael_mic_desc_ctx { +- u8 pending[4]; ++ __le32 pending; + size_t pending_len; + + u32 l, r; +@@ -60,13 +60,12 @@ static int michael_update(struct shash_d + unsigned int len) + { + struct michael_mic_desc_ctx *mctx = shash_desc_ctx(desc); +- const __le32 *src; + + if (mctx->pending_len) { + int flen = 4 - mctx->pending_len; + if (flen > len) + flen = len; +- memcpy(&mctx->pending[mctx->pending_len], data, flen); ++ memcpy((u8 *)&mctx->pending + mctx->pending_len, data, flen); + mctx->pending_len += flen; + data += flen; + len -= flen; +@@ -74,23 +73,21 @@ static int michael_update(struct shash_d + if (mctx->pending_len < 4) + return 0; + +- src = (const __le32 *)mctx->pending; +- mctx->l ^= le32_to_cpup(src); ++ mctx->l ^= le32_to_cpu(mctx->pending); + michael_block(mctx->l, mctx->r); + mctx->pending_len = 0; + } + +- src = (const __le32 *)data; +- + while (len >= 4) { +- mctx->l ^= le32_to_cpup(src++); ++ mctx->l ^= get_unaligned_le32(data); + michael_block(mctx->l, mctx->r); ++ data += 4; + len -= 4; + } + + if (len > 0) { + mctx->pending_len = len; +- memcpy(mctx->pending, src, len); ++ memcpy(&mctx->pending, data, len); + } + + return 0; +@@ -100,8 +97,7 @@ static int michael_update(struct shash_d + static int michael_final(struct shash_desc *desc, u8 *out) + { + struct michael_mic_desc_ctx *mctx = shash_desc_ctx(desc); +- u8 *data = mctx->pending; +- __le32 *dst = (__le32 *)out; ++ u8 *data = (u8 *)&mctx->pending; + + /* Last block and padding (0x5a, 4..7 x 0) */ + switch (mctx->pending_len) { +@@ -123,8 +119,8 @@ static int michael_final(struct shash_de + /* l ^= 0; */ + michael_block(mctx->l, mctx->r); + +- dst[0] = cpu_to_le32(mctx->l); +- dst[1] = cpu_to_le32(mctx->r); ++ put_unaligned_le32(mctx->l, out); ++ put_unaligned_le32(mctx->r, out + 4); + + return 0; + } +@@ -135,13 +131,11 @@ static int michael_setkey(struct crypto_ + { + struct michael_mic_ctx *mctx = crypto_shash_ctx(tfm); + +- const __le32 *data = (const __le32 *)key; +- + if (keylen != 8) + return -EINVAL; + +- mctx->l = le32_to_cpu(data[0]); +- mctx->r = le32_to_cpu(data[1]); ++ mctx->l = get_unaligned_le32(key); ++ mctx->r = get_unaligned_le32(key + 4); + return 0; + } + +@@ -156,7 +150,6 @@ static struct shash_alg alg = { + .cra_name = "michael_mic", + .cra_driver_name = "michael_mic-generic", + .cra_blocksize = 8, +- .cra_alignmask = 3, + .cra_ctxsize = sizeof(struct michael_mic_ctx), + .cra_module = THIS_MODULE, + } diff --git a/queue-5.11/crypto-sun4i-ss-checking-sg-length-is-not-sufficient.patch b/queue-5.11/crypto-sun4i-ss-checking-sg-length-is-not-sufficient.patch new file mode 100644 index 00000000000..066bec8842d --- /dev/null +++ b/queue-5.11/crypto-sun4i-ss-checking-sg-length-is-not-sufficient.patch @@ -0,0 +1,40 @@ +From 7bdcd851fa7eb66e8922aa7f6cba9e2f2427a7cf Mon Sep 17 00:00:00 2001 +From: Corentin Labbe +Date: Mon, 14 Dec 2020 20:02:26 +0000 +Subject: crypto: sun4i-ss - checking sg length is not sufficient + +From: Corentin Labbe + +commit 7bdcd851fa7eb66e8922aa7f6cba9e2f2427a7cf upstream. + +The optimized cipher function need length multiple of 4 bytes. +But it get sometimes odd length. +This is due to SG data could be stored with an offset. + +So the fix is to check also if the offset is aligned with 4 bytes. +Fixes: 6298e948215f2 ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator") +Cc: +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c +@@ -201,12 +201,12 @@ static int sun4i_ss_cipher_poll(struct s + * we can use the SS optimized function + */ + while (in_sg && no_chunk == 1) { +- if (in_sg->length % 4) ++ if ((in_sg->length | in_sg->offset) & 3u) + no_chunk = 0; + in_sg = sg_next(in_sg); + } + while (out_sg && no_chunk == 1) { +- if (out_sg->length % 4) ++ if ((out_sg->length | out_sg->offset) & 3u) + no_chunk = 0; + out_sg = sg_next(out_sg); + } diff --git a/queue-5.11/crypto-sun4i-ss-handle-bigendian-for-cipher.patch b/queue-5.11/crypto-sun4i-ss-handle-bigendian-for-cipher.patch new file mode 100644 index 00000000000..6dea250c2f8 --- /dev/null +++ b/queue-5.11/crypto-sun4i-ss-handle-bigendian-for-cipher.patch @@ -0,0 +1,57 @@ +From 5ab6177fa02df15cd8a02a1f1fb361d2d5d8b946 Mon Sep 17 00:00:00 2001 +From: Corentin Labbe +Date: Mon, 14 Dec 2020 20:02:28 +0000 +Subject: crypto: sun4i-ss - handle BigEndian for cipher + +From: Corentin Labbe + +commit 5ab6177fa02df15cd8a02a1f1fb361d2d5d8b946 upstream. + +Ciphers produce invalid results on BE. +Key and IV need to be written in LE. + +Fixes: 6298e948215f2 ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator") +Cc: +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c +@@ -54,13 +54,13 @@ static int noinline_for_stack sun4i_ss_o + + spin_lock_irqsave(&ss->slock, flags); + +- for (i = 0; i < op->keylen; i += 4) +- writel(*(op->key + i / 4), ss->base + SS_KEY0 + i); ++ for (i = 0; i < op->keylen / 4; i++) ++ writesl(ss->base + SS_KEY0 + i * 4, &op->key[i], 1); + + if (areq->iv) { + for (i = 0; i < 4 && i < ivsize / 4; i++) { + v = *(u32 *)(areq->iv + i * 4); +- writel(v, ss->base + SS_IV0 + i * 4); ++ writesl(ss->base + SS_IV0 + i * 4, &v, 1); + } + } + writel(mode, ss->base + SS_CTL); +@@ -238,13 +238,13 @@ static int sun4i_ss_cipher_poll(struct s + + spin_lock_irqsave(&ss->slock, flags); + +- for (i = 0; i < op->keylen; i += 4) +- writel(*(op->key + i / 4), ss->base + SS_KEY0 + i); ++ for (i = 0; i < op->keylen / 4; i++) ++ writesl(ss->base + SS_KEY0 + i * 4, &op->key[i], 1); + + if (areq->iv) { + for (i = 0; i < 4 && i < ivsize / 4; i++) { + v = *(u32 *)(areq->iv + i * 4); +- writel(v, ss->base + SS_IV0 + i * 4); ++ writesl(ss->base + SS_IV0 + i * 4, &v, 1); + } + } + writel(mode, ss->base + SS_CTL); diff --git a/queue-5.11/crypto-sun4i-ss-initialize-need_fallback.patch b/queue-5.11/crypto-sun4i-ss-initialize-need_fallback.patch new file mode 100644 index 00000000000..4d8db12155f --- /dev/null +++ b/queue-5.11/crypto-sun4i-ss-initialize-need_fallback.patch @@ -0,0 +1,32 @@ +From 4ec8977b921fd9d512701e009ce8082cb94b5c1c Mon Sep 17 00:00:00 2001 +From: Corentin Labbe +Date: Mon, 14 Dec 2020 20:02:29 +0000 +Subject: crypto: sun4i-ss - initialize need_fallback + +From: Corentin Labbe + +commit 4ec8977b921fd9d512701e009ce8082cb94b5c1c upstream. + +The need_fallback is never initialized and seem to be always true at runtime. +So all hardware operations are always bypassed. + +Fixes: 0ae1f46c55f87 ("crypto: sun4i-ss - fallback when length is not multiple of blocksize") +Cc: +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c +@@ -194,7 +194,7 @@ static int sun4i_ss_cipher_poll(struct s + unsigned int obo = 0; /* offset in bufo*/ + unsigned int obl = 0; /* length of data in bufo */ + unsigned long flags; +- bool need_fallback; ++ bool need_fallback = false; + + if (!areq->cryptlen) + return 0; diff --git a/queue-5.11/crypto-sun4i-ss-iv-register-does-not-work-on-a10-and-a13.patch b/queue-5.11/crypto-sun4i-ss-iv-register-does-not-work-on-a10-and-a13.patch new file mode 100644 index 00000000000..ff93ed9f073 --- /dev/null +++ b/queue-5.11/crypto-sun4i-ss-iv-register-does-not-work-on-a10-and-a13.patch @@ -0,0 +1,101 @@ +From b756f1c8fc9d84e3f546d7ffe056c5352f4aab05 Mon Sep 17 00:00:00 2001 +From: Corentin Labbe +Date: Mon, 14 Dec 2020 20:02:27 +0000 +Subject: crypto: sun4i-ss - IV register does not work on A10 and A13 + +From: Corentin Labbe + +commit b756f1c8fc9d84e3f546d7ffe056c5352f4aab05 upstream. + +Allwinner A10 and A13 SoC have a version of the SS which produce +invalid IV in IVx register. + +Instead of adding a variant for those, let's convert SS to produce IV +directly from data. +Fixes: 6298e948215f2 ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator") +Cc: +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c | 34 ++++++++++++++++---- + 1 file changed, 28 insertions(+), 6 deletions(-) + +--- a/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c ++++ b/drivers/crypto/allwinner/sun4i-ss/sun4i-ss-cipher.c +@@ -20,6 +20,7 @@ static int noinline_for_stack sun4i_ss_o + unsigned int ivsize = crypto_skcipher_ivsize(tfm); + struct sun4i_cipher_req_ctx *ctx = skcipher_request_ctx(areq); + u32 mode = ctx->mode; ++ void *backup_iv = NULL; + /* when activating SS, the default FIFO space is SS_RX_DEFAULT(32) */ + u32 rx_cnt = SS_RX_DEFAULT; + u32 tx_cnt = 0; +@@ -44,6 +45,13 @@ static int noinline_for_stack sun4i_ss_o + return -EINVAL; + } + ++ if (areq->iv && ivsize > 0 && mode & SS_DECRYPTION) { ++ backup_iv = kzalloc(ivsize, GFP_KERNEL); ++ if (!backup_iv) ++ return -ENOMEM; ++ scatterwalk_map_and_copy(backup_iv, areq->src, areq->cryptlen - ivsize, ivsize, 0); ++ } ++ + spin_lock_irqsave(&ss->slock, flags); + + for (i = 0; i < op->keylen; i += 4) +@@ -117,9 +125,12 @@ static int noinline_for_stack sun4i_ss_o + } while (oleft); + + if (areq->iv) { +- for (i = 0; i < 4 && i < ivsize / 4; i++) { +- v = readl(ss->base + SS_IV0 + i * 4); +- *(u32 *)(areq->iv + i * 4) = v; ++ if (mode & SS_DECRYPTION) { ++ memcpy(areq->iv, backup_iv, ivsize); ++ kfree_sensitive(backup_iv); ++ } else { ++ scatterwalk_map_and_copy(areq->iv, areq->dst, areq->cryptlen - ivsize, ++ ivsize, 0); + } + } + +@@ -174,6 +185,7 @@ static int sun4i_ss_cipher_poll(struct s + unsigned int ileft = areq->cryptlen; + unsigned int oleft = areq->cryptlen; + unsigned int todo; ++ void *backup_iv = NULL; + struct sg_mapping_iter mi, mo; + unsigned long pi = 0, po = 0; /* progress for in and out */ + bool miter_err; +@@ -217,6 +229,13 @@ static int sun4i_ss_cipher_poll(struct s + if (need_fallback) + return sun4i_ss_cipher_poll_fallback(areq); + ++ if (areq->iv && ivsize > 0 && mode & SS_DECRYPTION) { ++ backup_iv = kzalloc(ivsize, GFP_KERNEL); ++ if (!backup_iv) ++ return -ENOMEM; ++ scatterwalk_map_and_copy(backup_iv, areq->src, areq->cryptlen - ivsize, ivsize, 0); ++ } ++ + spin_lock_irqsave(&ss->slock, flags); + + for (i = 0; i < op->keylen; i += 4) +@@ -345,9 +364,12 @@ static int sun4i_ss_cipher_poll(struct s + sg_miter_stop(&mo); + } + if (areq->iv) { +- for (i = 0; i < 4 && i < ivsize / 4; i++) { +- v = readl(ss->base + SS_IV0 + i * 4); +- *(u32 *)(areq->iv + i * 4) = v; ++ if (mode & SS_DECRYPTION) { ++ memcpy(areq->iv, backup_iv, ivsize); ++ kfree_sensitive(backup_iv); ++ } else { ++ scatterwalk_map_and_copy(areq->iv, areq->dst, areq->cryptlen - ivsize, ++ ivsize, 0); + } + } + diff --git a/queue-5.11/drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch b/queue-5.11/drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch new file mode 100644 index 00000000000..787f6ccd4df --- /dev/null +++ b/queue-5.11/drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch @@ -0,0 +1,50 @@ +From 2fd10bcf0310b9525b2af9e1f7aa9ddd87c3772e Mon Sep 17 00:00:00 2001 +From: Sabyrzhan Tasbolatov +Date: Tue, 9 Feb 2021 16:26:12 +0600 +Subject: drivers/misc/vmw_vmci: restrict too big queue size in qp_host_alloc_queue + +From: Sabyrzhan Tasbolatov + +commit 2fd10bcf0310b9525b2af9e1f7aa9ddd87c3772e upstream. + +syzbot found WARNING in qp_broker_alloc[1] in qp_host_alloc_queue() +when num_pages is 0x100001, giving queue_size + queue_page_size +bigger than KMALLOC_MAX_SIZE for kzalloc(), resulting order >= MAX_ORDER +condition. + +queue_size + queue_page_size=0x8000d8, where KMALLOC_MAX_SIZE=0x400000. + +[1] +Call Trace: + alloc_pages include/linux/gfp.h:547 [inline] + kmalloc_order+0x40/0x130 mm/slab_common.c:837 + kmalloc_order_trace+0x15/0x70 mm/slab_common.c:853 + kmalloc_large include/linux/slab.h:481 [inline] + __kmalloc+0x257/0x330 mm/slub.c:3959 + kmalloc include/linux/slab.h:557 [inline] + kzalloc include/linux/slab.h:682 [inline] + qp_host_alloc_queue drivers/misc/vmw_vmci/vmci_queue_pair.c:540 [inline] + qp_broker_create drivers/misc/vmw_vmci/vmci_queue_pair.c:1351 [inline] + qp_broker_alloc+0x936/0x2740 drivers/misc/vmw_vmci/vmci_queue_pair.c:1739 + +Reported-by: syzbot+15ec7391f3d6a1a7cc7d@syzkaller.appspotmail.com +Signed-off-by: Sabyrzhan Tasbolatov +Link: https://lore.kernel.org/r/20210209102612.2112247-1-snovitoll@gmail.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/vmw_vmci/vmci_queue_pair.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c +@@ -537,6 +537,9 @@ static struct vmci_queue *qp_host_alloc_ + + queue_page_size = num_pages * sizeof(*queue->kernel_if->u.h.page); + ++ if (queue_size + queue_page_size > KMALLOC_MAX_SIZE) ++ return NULL; ++ + queue = kzalloc(queue_size + queue_page_size, GFP_KERNEL); + if (queue) { + queue->q_header = NULL; diff --git a/queue-5.11/drm-amd-display-add-fpu-wrappers-to-dcn21_validate_bandwidth.patch b/queue-5.11/drm-amd-display-add-fpu-wrappers-to-dcn21_validate_bandwidth.patch new file mode 100644 index 00000000000..4722cb7cc9f --- /dev/null +++ b/queue-5.11/drm-amd-display-add-fpu-wrappers-to-dcn21_validate_bandwidth.patch @@ -0,0 +1,79 @@ +From 41401ac67791810dd880345962339aa1bedd3c0d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Jan=20Kokem=C3=BCller?= +Date: Thu, 11 Feb 2021 19:28:43 +0100 +Subject: drm/amd/display: Add FPU wrappers to dcn21_validate_bandwidth() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jan Kokemüller + +commit 41401ac67791810dd880345962339aa1bedd3c0d upstream. + +dcn21_validate_bandwidth() calls functions that use floating point math. +On my machine this sometimes results in simd exceptions when there are +other FPU users such as KVM virtual machines running. The screen freezes +completely in this case. + +Wrapping the function with DC_FP_START()/DC_FP_END() seems to solve the +problem. This mirrors the approach used for dcn20_validate_bandwidth. + +Tested on a AMD Ryzen 7 PRO 4750U (Renoir). + +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=206987 +Signed-off-by: Jan Kokemüller +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 2 - + drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c | 20 ++++++++++++++++-- + 2 files changed, 19 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -3245,7 +3245,7 @@ restore_dml_state: + bool dcn20_validate_bandwidth(struct dc *dc, struct dc_state *context, + bool fast_validate) + { +- bool voltage_supported = false; ++ bool voltage_supported; + DC_FP_START(); + voltage_supported = dcn20_validate_bandwidth_fp(dc, context, fast_validate); + DC_FP_END(); +--- a/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn21/dcn21_resource.c +@@ -1329,8 +1329,8 @@ validate_out: + return out; + } + +-bool dcn21_validate_bandwidth(struct dc *dc, struct dc_state *context, +- bool fast_validate) ++static noinline bool dcn21_validate_bandwidth_fp(struct dc *dc, ++ struct dc_state *context, bool fast_validate) + { + bool out = false; + +@@ -1383,6 +1383,22 @@ validate_out: + + return out; + } ++ ++/* ++ * Some of the functions further below use the FPU, so we need to wrap this ++ * with DC_FP_START()/DC_FP_END(). Use the same approach as for ++ * dcn20_validate_bandwidth in dcn20_resource.c. ++ */ ++bool dcn21_validate_bandwidth(struct dc *dc, struct dc_state *context, ++ bool fast_validate) ++{ ++ bool voltage_supported; ++ DC_FP_START(); ++ voltage_supported = dcn21_validate_bandwidth_fp(dc, context, fast_validate); ++ DC_FP_END(); ++ return voltage_supported; ++} ++ + static void dcn21_destroy_resource_pool(struct resource_pool **pool) + { + struct dcn21_resource_pool *dcn21_pool = TO_DCN21_RES_POOL(*pool); diff --git a/queue-5.11/drm-amd-display-add-vupdate_no_lock-interrupts-for-dcn2.1.patch b/queue-5.11/drm-amd-display-add-vupdate_no_lock-interrupts-for-dcn2.1.patch new file mode 100644 index 00000000000..c9ea58602e7 --- /dev/null +++ b/queue-5.11/drm-amd-display-add-vupdate_no_lock-interrupts-for-dcn2.1.patch @@ -0,0 +1,72 @@ +From 688f97ed3f5e339c0c2c09d9ee7ff23d5807b0a7 Mon Sep 17 00:00:00 2001 +From: Rodrigo Siqueira +Date: Fri, 5 Feb 2021 14:15:11 -0500 +Subject: drm/amd/display: Add vupdate_no_lock interrupts for DCN2.1 + +From: Rodrigo Siqueira + +commit 688f97ed3f5e339c0c2c09d9ee7ff23d5807b0a7 upstream. + +When run igt@kms_vrr in a device that uses DCN2.1 architecture, we +noticed multiple failures. Furthermore, when we tested a VRR demo, we +noticed a system hang where the mouse pointer still works, but the +entire system freezes; in this case, we don't see any dmesg warning or +failure messages kernel. This happens due to a lack of vupdate_no_lock +interrupt, making the userspace wait eternally to get the event back. +For fixing this issue, we need to add the vupdate_no_lock interrupt in +the interrupt list. + +Signed-off-by: Rodrigo Siqueira +Acked-by: Bindu Ramamurthy +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c | 22 +++++++++++ + 1 file changed, 22 insertions(+) + +--- a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c ++++ b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c +@@ -168,6 +168,11 @@ static const struct irq_source_info_func + .ack = NULL + }; + ++static const struct irq_source_info_funcs vupdate_no_lock_irq_info_funcs = { ++ .set = NULL, ++ .ack = NULL ++}; ++ + #undef BASE_INNER + #define BASE_INNER(seg) DMU_BASE__INST0_SEG ## seg + +@@ -230,6 +235,17 @@ static const struct irq_source_info_func + .funcs = &vblank_irq_info_funcs\ + } + ++/* vupdate_no_lock_int_entry maps to DC_IRQ_SOURCE_VUPDATEx, to match semantic ++ * of DCE's DC_IRQ_SOURCE_VUPDATEx. ++ */ ++#define vupdate_no_lock_int_entry(reg_num)\ ++ [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ ++ IRQ_REG_ENTRY(OTG, reg_num,\ ++ OTG_GLOBAL_SYNC_STATUS, VUPDATE_NO_LOCK_INT_EN,\ ++ OTG_GLOBAL_SYNC_STATUS, VUPDATE_NO_LOCK_EVENT_CLEAR),\ ++ .funcs = &vupdate_no_lock_irq_info_funcs\ ++ } ++ + #define vblank_int_entry(reg_num)\ + [DC_IRQ_SOURCE_VBLANK1 + reg_num] = {\ + IRQ_REG_ENTRY(OTG, reg_num,\ +@@ -338,6 +354,12 @@ irq_source_info_dcn21[DAL_IRQ_SOURCES_NU + vupdate_int_entry(3), + vupdate_int_entry(4), + vupdate_int_entry(5), ++ vupdate_no_lock_int_entry(0), ++ vupdate_no_lock_int_entry(1), ++ vupdate_no_lock_int_entry(2), ++ vupdate_no_lock_int_entry(3), ++ vupdate_no_lock_int_entry(4), ++ vupdate_no_lock_int_entry(5), + vblank_int_entry(0), + vblank_int_entry(1), + vblank_int_entry(2), diff --git a/queue-5.11/drm-amd-display-remove-assert-from-dcn10_get_dig_frontend.patch b/queue-5.11/drm-amd-display-remove-assert-from-dcn10_get_dig_frontend.patch new file mode 100644 index 00000000000..0e57094ac4a --- /dev/null +++ b/queue-5.11/drm-amd-display-remove-assert-from-dcn10_get_dig_frontend.patch @@ -0,0 +1,50 @@ +From 83e6667b675f101fb66659dfa72e45d08773d763 Mon Sep 17 00:00:00 2001 +From: Eric Bernstein +Date: Fri, 5 Feb 2021 13:53:31 -0500 +Subject: drm/amd/display: Remove Assert from dcn10_get_dig_frontend + +From: Eric Bernstein + +commit 83e6667b675f101fb66659dfa72e45d08773d763 upstream. + +[Why] +In some cases, this function is called when DIG BE is not +connected to DIG FE, in which case a value of zero isn't +invalid and assert should not be hit. + +[How] +Remove assert and handle ENGINE_ID_UNKNOWN result in calling +function. + +Signed-off-by: Eric Bernstein +Acked-by: Bindu Ramamurthy +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.c | 1 - + drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c | 2 ++ + 2 files changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_link_encoder.c +@@ -480,7 +480,6 @@ unsigned int dcn10_get_dig_frontend(stru + break; + default: + // invalid source select DIG +- ASSERT(false); + result = ENGINE_ID_UNKNOWN; + } + +--- a/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn30/dcn30_hwseq.c +@@ -539,6 +539,8 @@ void dcn30_init_hw(struct dc *dc) + + fe = dc->links[i]->link_enc->funcs->get_dig_frontend( + dc->links[i]->link_enc); ++ if (fe == ENGINE_ID_UNKNOWN) ++ continue; + + for (j = 0; j < dc->res_pool->stream_enc_count; j++) { + if (fe == dc->res_pool->stream_enc[j]->id) { diff --git a/queue-5.11/drm-amdgpu-fix-cgts_tcc_disable-register-offset-on-gfx10.3.patch b/queue-5.11/drm-amdgpu-fix-cgts_tcc_disable-register-offset-on-gfx10.3.patch new file mode 100644 index 00000000000..c577c2ecb03 --- /dev/null +++ b/queue-5.11/drm-amdgpu-fix-cgts_tcc_disable-register-offset-on-gfx10.3.patch @@ -0,0 +1,71 @@ +From 4112c00354004cbb1bf56f0114fa9951bf6b13ed Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marek=20Ol=C5=A1=C3=A1k?= +Date: Thu, 4 Feb 2021 02:46:20 -0500 +Subject: drm/amdgpu: fix CGTS_TCC_DISABLE register offset on gfx10.3 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Olšák + +commit 4112c00354004cbb1bf56f0114fa9951bf6b13ed upstream. + +This fixes incorrect TCC harvesting info reported to userspace. +The impact was a very very tiny performance degradation (unnecessary +GL2 cache flushes). + +Signed-off-by: Marek Olšák +Reviewed-by: Hawking Zhang +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c | 22 ++++++++++------------ + 1 file changed, 10 insertions(+), 12 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v10_0.c +@@ -71,6 +71,11 @@ + #define GB_ADDR_CONFIG__NUM_PKRS__SHIFT 0x8 + #define GB_ADDR_CONFIG__NUM_PKRS_MASK 0x00000700L + ++#define mmCGTS_TCC_DISABLE_gc_10_3 0x5006 ++#define mmCGTS_TCC_DISABLE_gc_10_3_BASE_IDX 1 ++#define mmCGTS_USER_TCC_DISABLE_gc_10_3 0x5007 ++#define mmCGTS_USER_TCC_DISABLE_gc_10_3_BASE_IDX 1 ++ + #define mmCP_MEC_CNTL_Sienna_Cichlid 0x0f55 + #define mmCP_MEC_CNTL_Sienna_Cichlid_BASE_IDX 0 + #define mmRLC_SAFE_MODE_Sienna_Cichlid 0x4ca0 +@@ -99,10 +104,6 @@ + #define mmGCR_GENERAL_CNTL_Sienna_Cichlid 0x1580 + #define mmGCR_GENERAL_CNTL_Sienna_Cichlid_BASE_IDX 0 + +-#define mmCGTS_TCC_DISABLE_Vangogh 0x5006 +-#define mmCGTS_TCC_DISABLE_Vangogh_BASE_IDX 1 +-#define mmCGTS_USER_TCC_DISABLE_Vangogh 0x5007 +-#define mmCGTS_USER_TCC_DISABLE_Vangogh_BASE_IDX 1 + #define mmGOLDEN_TSC_COUNT_UPPER_Vangogh 0x0025 + #define mmGOLDEN_TSC_COUNT_UPPER_Vangogh_BASE_IDX 1 + #define mmGOLDEN_TSC_COUNT_LOWER_Vangogh 0x0026 +@@ -4942,15 +4943,12 @@ static void gfx_v10_0_get_tcc_info(struc + /* TCCs are global (not instanced). */ + uint32_t tcc_disable; + +- switch (adev->asic_type) { +- case CHIP_VANGOGH: +- tcc_disable = RREG32_SOC15(GC, 0, mmCGTS_TCC_DISABLE_Vangogh) | +- RREG32_SOC15(GC, 0, mmCGTS_USER_TCC_DISABLE_Vangogh); +- break; +- default: ++ if (adev->asic_type >= CHIP_SIENNA_CICHLID) { ++ tcc_disable = RREG32_SOC15(GC, 0, mmCGTS_TCC_DISABLE_gc_10_3) | ++ RREG32_SOC15(GC, 0, mmCGTS_USER_TCC_DISABLE_gc_10_3); ++ } else { + tcc_disable = RREG32_SOC15(GC, 0, mmCGTS_TCC_DISABLE) | +- RREG32_SOC15(GC, 0, mmCGTS_USER_TCC_DISABLE); +- break; ++ RREG32_SOC15(GC, 0, mmCGTS_USER_TCC_DISABLE); + } + + adev->gfx.config.tcc_disabled_mask = diff --git a/queue-5.11/drm-amdgpu-fix-shutdown-and-poweroff-process-failed-with-s0ix.patch b/queue-5.11/drm-amdgpu-fix-shutdown-and-poweroff-process-failed-with-s0ix.patch new file mode 100644 index 00000000000..672e46a2819 --- /dev/null +++ b/queue-5.11/drm-amdgpu-fix-shutdown-and-poweroff-process-failed-with-s0ix.patch @@ -0,0 +1,89 @@ +From b092b19602cfd47de1eeeb3a1b03822afd86b136 Mon Sep 17 00:00:00 2001 +From: Prike Liang +Date: Mon, 22 Feb 2021 14:04:12 +0800 +Subject: drm/amdgpu: fix shutdown and poweroff process failed with s0ix + +From: Prike Liang + +commit b092b19602cfd47de1eeeb3a1b03822afd86b136 upstream. + +In the shutdown and poweroff opt on the s0i3 system we still need +un-gate the gfx clock gating and power gating before destory amdgpu device. + +Fixes: 628c36d7b238e2 ("drm/amdgpu: update amdgpu device suspend/resume sequence for s0i3 support") +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1499 +Signed-off-by: Alex Deucher +Signed-off-by: Prike Liang +Reviewed-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/amdgpu.h | 6 ++++++ + drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++++-- + drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 9 ++++++++- + 3 files changed, 18 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -1003,6 +1003,12 @@ struct amdgpu_device { + bool in_suspend; + bool in_hibernate; + ++ /* ++ * The combination flag in_poweroff_reboot_com used to identify the poweroff ++ * and reboot opt in the s0i3 system-wide suspend. ++ */ ++ bool in_poweroff_reboot_com; ++ + atomic_t in_gpu_reset; + enum pp_mp1_state mp1_state; + struct rw_semaphore reset_sem; +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2666,7 +2666,8 @@ static int amdgpu_device_ip_suspend_phas + { + int i, r; + +- if (!amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) { ++ if (adev->in_poweroff_reboot_com || ++ !amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) { + amdgpu_device_set_pg_state(adev, AMD_PG_STATE_UNGATE); + amdgpu_device_set_cg_state(adev, AMD_CG_STATE_UNGATE); + } +@@ -3726,7 +3727,8 @@ int amdgpu_device_suspend(struct drm_dev + + amdgpu_fence_driver_suspend(adev); + +- if (!amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) ++ if (adev->in_poweroff_reboot_com || ++ !amdgpu_acpi_is_s0ix_supported(adev) || amdgpu_in_reset(adev)) + r = amdgpu_device_ip_suspend_phase2(adev); + else + amdgpu_gfx_state_change_set(adev, sGpuChangeState_D3Entry); +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -1266,7 +1266,9 @@ amdgpu_pci_shutdown(struct pci_dev *pdev + */ + if (!amdgpu_passthrough(adev)) + adev->mp1_state = PP_MP1_STATE_UNLOAD; ++ adev->in_poweroff_reboot_com = true; + amdgpu_device_ip_suspend(adev); ++ adev->in_poweroff_reboot_com = false; + adev->mp1_state = PP_MP1_STATE_NONE; + } + +@@ -1308,8 +1310,13 @@ static int amdgpu_pmops_thaw(struct devi + static int amdgpu_pmops_poweroff(struct device *dev) + { + struct drm_device *drm_dev = dev_get_drvdata(dev); ++ struct amdgpu_device *adev = drm_to_adev(drm_dev); ++ int r; + +- return amdgpu_device_suspend(drm_dev, true); ++ adev->in_poweroff_reboot_com = true; ++ r = amdgpu_device_suspend(drm_dev, true); ++ adev->in_poweroff_reboot_com = false; ++ return r; + } + + static int amdgpu_pmops_restore(struct device *dev) diff --git a/queue-5.11/drm-amdgpu-set-reference-clock-to-100mhz-on-renoir-v2.patch b/queue-5.11/drm-amdgpu-set-reference-clock-to-100mhz-on-renoir-v2.patch new file mode 100644 index 00000000000..fbd8998965a --- /dev/null +++ b/queue-5.11/drm-amdgpu-set-reference-clock-to-100mhz-on-renoir-v2.patch @@ -0,0 +1,37 @@ +From 6e80fb8ab04f6c4f377e2fd422bdd1855beb7371 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Tue, 16 Feb 2021 10:57:00 -0500 +Subject: drm/amdgpu: Set reference clock to 100Mhz on Renoir (v2) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Alex Deucher + +commit 6e80fb8ab04f6c4f377e2fd422bdd1855beb7371 upstream. + +Fixes the rlc reference clock used for GPU timestamps. +Value is 100Mhz. Confirmed with hardware team. + +v2: reword commit message. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1480 +Acked-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -241,6 +241,8 @@ static u32 soc15_get_xclk(struct amdgpu_ + { + u32 reference_clock = adev->clock.spll.reference_freq; + ++ if (adev->asic_type == CHIP_RENOIR) ++ return 10000; + if (adev->asic_type == CHIP_RAVEN) + return reference_clock / 4; + diff --git a/queue-5.11/drm-amdkfd-fix-recursive-lock-warnings.patch b/queue-5.11/drm-amdkfd-fix-recursive-lock-warnings.patch new file mode 100644 index 00000000000..43b3abf2520 --- /dev/null +++ b/queue-5.11/drm-amdkfd-fix-recursive-lock-warnings.patch @@ -0,0 +1,40 @@ +From 1fb8b1fc4dd1035a264c81d15d41f05884cc8058 Mon Sep 17 00:00:00 2001 +From: Felix Kuehling +Date: Thu, 4 Feb 2021 00:11:17 -0500 +Subject: drm/amdkfd: Fix recursive lock warnings + +From: Felix Kuehling + +commit 1fb8b1fc4dd1035a264c81d15d41f05884cc8058 upstream. + +memalloc_nofs_save/restore are no longer sufficient to prevent recursive +lock warnings when holding locks that can be taken in MMU notifiers. Use +memalloc_noreclaim_save/restore instead. + +Fixes: f920e413ff9c ("mm: track mmu notifiers in fs_reclaim_acquire/release") +CC: Daniel Vetter +Reviewed-by: Philip Yang +Signed-off-by: Felix Kuehling +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org # 5.10.x +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.h +@@ -243,11 +243,11 @@ get_sh_mem_bases_nybble_64(struct kfd_pr + static inline void dqm_lock(struct device_queue_manager *dqm) + { + mutex_lock(&dqm->lock_hidden); +- dqm->saved_flags = memalloc_nofs_save(); ++ dqm->saved_flags = memalloc_noreclaim_save(); + } + static inline void dqm_unlock(struct device_queue_manager *dqm) + { +- memalloc_nofs_restore(dqm->saved_flags); ++ memalloc_noreclaim_restore(dqm->saved_flags); + mutex_unlock(&dqm->lock_hidden); + } + diff --git a/queue-5.11/drm-i915-gt-correct-surface-base-address-for-renderclear.patch b/queue-5.11/drm-i915-gt-correct-surface-base-address-for-renderclear.patch new file mode 100644 index 00000000000..090a4ddf29c --- /dev/null +++ b/queue-5.11/drm-i915-gt-correct-surface-base-address-for-renderclear.patch @@ -0,0 +1,40 @@ +From 81ce8f04aa96f7f6cae05770f68b5d15be91f5a2 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Wed, 10 Feb 2021 12:27:28 +0000 +Subject: drm/i915/gt: Correct surface base address for renderclear + +From: Chris Wilson + +commit 81ce8f04aa96f7f6cae05770f68b5d15be91f5a2 upstream. + +The surface_state_base is an offset into the batch, so we need to pass +the correct batch address for STATE_BASE_ADDRESS. + +Fixes: 47f8253d2b89 ("drm/i915/gen7: Clear all EU/L3 residual contexts") +Signed-off-by: Chris Wilson +Cc: Mika Kuoppala +Cc: Prathap Kumar Valsan +Cc: Akeem G Abodunrin +Cc: Hans de Goede +Cc: Hans de Goede +Reviewed-by: Mika Kuoppala +Cc: # v5.7+ +Link: https://patchwork.freedesktop.org/patch/msgid/20210210122728.20097-1-chris@chris-wilson.co.uk +(cherry picked from commit 1914911f4aa08ddc05bae71d3516419463e0c567) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gt/gen7_renderclear.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c ++++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c +@@ -240,7 +240,7 @@ gen7_emit_state_base_address(struct batc + /* general */ + *cs++ = batch_addr(batch) | BASE_ADDRESS_MODIFY; + /* surface */ +- *cs++ = batch_addr(batch) | surface_state_base | BASE_ADDRESS_MODIFY; ++ *cs++ = (batch_addr(batch) + surface_state_base) | BASE_ADDRESS_MODIFY; + /* dynamic */ + *cs++ = batch_addr(batch) | BASE_ADDRESS_MODIFY; + /* indirect */ diff --git a/queue-5.11/drm-i915-gt-flush-before-changing-register-state.patch b/queue-5.11/drm-i915-gt-flush-before-changing-register-state.patch new file mode 100644 index 00000000000..988c6feb42f --- /dev/null +++ b/queue-5.11/drm-i915-gt-flush-before-changing-register-state.patch @@ -0,0 +1,42 @@ +From d5109f739c9f14a3bda249cb48b16de1065932f0 Mon Sep 17 00:00:00 2001 +From: Chris Wilson +Date: Mon, 25 Jan 2021 22:02:47 +0000 +Subject: drm/i915/gt: Flush before changing register state + +From: Chris Wilson + +commit d5109f739c9f14a3bda249cb48b16de1065932f0 upstream. + +Flush; invalidate; change registers; invalidate; flush. + +Will this finally work on every device? Or will Baytrail complain again? + +On the positive side, we immediately see the benefit of having hsw-gt1 in +CI. + +Fixes: ace44e13e577 ("drm/i915/gt: Clear CACHE_MODE prior to clearing residuals") +Testcase: igt/gem_render_tiled_blits # hsw-gt1 +Signed-off-by: Chris Wilson +Cc: Mika Kuoppala +Cc: Akeem G Abodunrin +Acked-by: Mika Kuoppala +Link: https://patchwork.freedesktop.org/patch/msgid/20210125220247.31701-1-chris@chris-wilson.co.uk +(cherry picked from commit d30bbd62b1bfd9e0a33c3583c5a9e5d66f60cbd7) +Signed-off-by: Rodrigo Vivi +Cc: Diego Calleja +Cc: Hans de Goede +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/i915/gt/gen7_renderclear.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/gpu/drm/i915/gt/gen7_renderclear.c ++++ b/drivers/gpu/drm/i915/gt/gen7_renderclear.c +@@ -393,6 +393,7 @@ static void emit_batch(struct i915_vma * + desc_count); + + /* Reset inherited context registers */ ++ gen7_emit_pipeline_flush(&cmds); + gen7_emit_pipeline_invalidate(&cmds); + batch_add(&cmds, MI_LOAD_REGISTER_IMM(2)); + batch_add(&cmds, i915_mmio_reg_offset(CACHE_MODE_0_GEN7)); diff --git a/queue-5.11/drm-modes-switch-to-64bit-maths-to-avoid-integer-overflow.patch b/queue-5.11/drm-modes-switch-to-64bit-maths-to-avoid-integer-overflow.patch new file mode 100644 index 00000000000..92d05a928bf --- /dev/null +++ b/queue-5.11/drm-modes-switch-to-64bit-maths-to-avoid-integer-overflow.patch @@ -0,0 +1,47 @@ +From 5b34ab52401f0f1f191bcb83a182c83b506f4763 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= +Date: Thu, 22 Oct 2020 22:42:56 +0300 +Subject: drm/modes: Switch to 64bit maths to avoid integer overflow +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Ville Syrjälä + +commit 5b34ab52401f0f1f191bcb83a182c83b506f4763 upstream. + +The new >8k CEA modes have dotclocks reaching 5.94 GHz, which +means our clock*1000 will now overflow the 32bit unsigned +integer. Switch to 64bit maths to avoid it. + +Cc: stable@vger.kernel.org +Reported-by: Randy Dunlap +Signed-off-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20201022194256.30978-1-ville.syrjala@linux.intel.com +Tested-by: Randy Dunlap +Reviewed-by: Chris Wilson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/drm_modes.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/drm_modes.c ++++ b/drivers/gpu/drm/drm_modes.c +@@ -762,7 +762,7 @@ int drm_mode_vrefresh(const struct drm_d + if (mode->htotal == 0 || mode->vtotal == 0) + return 0; + +- num = mode->clock * 1000; ++ num = mode->clock; + den = mode->htotal * mode->vtotal; + + if (mode->flags & DRM_MODE_FLAG_INTERLACE) +@@ -772,7 +772,7 @@ int drm_mode_vrefresh(const struct drm_d + if (mode->vscan > 1) + den *= mode->vscan; + +- return DIV_ROUND_CLOSEST(num, den); ++ return DIV_ROUND_CLOSEST_ULL(mul_u32_u32(num, 1000), den); + } + EXPORT_SYMBOL(drm_mode_vrefresh); + diff --git a/queue-5.11/drm-nouveau-kms-handle-mdp-connectors.patch b/queue-5.11/drm-nouveau-kms-handle-mdp-connectors.patch new file mode 100644 index 00000000000..c88f3c9ea8d --- /dev/null +++ b/queue-5.11/drm-nouveau-kms-handle-mdp-connectors.patch @@ -0,0 +1,50 @@ +From d1f5a3fc85566e9ddce9361ef180f070367e6eab Mon Sep 17 00:00:00 2001 +From: Karol Herbst +Date: Fri, 27 Nov 2020 19:39:09 +0100 +Subject: drm/nouveau/kms: handle mDP connectors + +From: Karol Herbst + +commit d1f5a3fc85566e9ddce9361ef180f070367e6eab upstream. + +In some cases we have the handle those explicitly as the fallback +connector type detection fails and marks those as eDP connectors. + +Attempting to use such a connector with mutter leads to a crash of mutter +as it ends up with two eDP displays. + +Information is taken from the official DCB documentation. + +Cc: stable@vger.kernel.org +Cc: dri-devel@lists.freedesktop.org +Cc: Ben Skeggs +Reported-by: Mark Pearson +Tested-by: Mark Pearson +Signed-off-by: Karol Herbst +Signed-off-by: Ben Skeggs +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h | 1 + + drivers/gpu/drm/nouveau/nouveau_connector.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h ++++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/bios/conn.h +@@ -14,6 +14,7 @@ enum dcb_connector_type { + DCB_CONNECTOR_LVDS_SPWG = 0x41, + DCB_CONNECTOR_DP = 0x46, + DCB_CONNECTOR_eDP = 0x47, ++ DCB_CONNECTOR_mDP = 0x48, + DCB_CONNECTOR_HDMI_0 = 0x60, + DCB_CONNECTOR_HDMI_1 = 0x61, + DCB_CONNECTOR_HDMI_C = 0x63, +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -1210,6 +1210,7 @@ drm_conntype_from_dcb(enum dcb_connector + case DCB_CONNECTOR_DMS59_DP0: + case DCB_CONNECTOR_DMS59_DP1: + case DCB_CONNECTOR_DP : ++ case DCB_CONNECTOR_mDP : + case DCB_CONNECTOR_USB_C : return DRM_MODE_CONNECTOR_DisplayPort; + case DCB_CONNECTOR_eDP : return DRM_MODE_CONNECTOR_eDP; + case DCB_CONNECTOR_HDMI_0 : diff --git a/queue-5.11/drm-panel-kd35t133-allow-using-non-continuous-dsi-clock.patch b/queue-5.11/drm-panel-kd35t133-allow-using-non-continuous-dsi-clock.patch new file mode 100644 index 00000000000..d5677cb9fb8 --- /dev/null +++ b/queue-5.11/drm-panel-kd35t133-allow-using-non-continuous-dsi-clock.patch @@ -0,0 +1,42 @@ +From d922d58fedcd98ba625e89b625a98e222b090b10 Mon Sep 17 00:00:00 2001 +From: Heiko Stuebner +Date: Sat, 6 Feb 2021 14:50:20 +0100 +Subject: drm/panel: kd35t133: allow using non-continuous dsi clock + +From: Heiko Stuebner + +commit d922d58fedcd98ba625e89b625a98e222b090b10 upstream. + +The panel is able to work when dsi clock is non-continuous, thus +the system power consumption can be reduced using such feature. + +Add MIPI_DSI_CLOCK_NON_CONTINUOUS to panel's mode_flags. + +Also the flag actually becomes necessary after +commit c6d94e37bdbb ("drm/bridge/synopsys: dsi: add support for non-continuous HS clock") +and without it the panel only emits stripes instead of output. + +Fixes: c6d94e37bdbb ("drm/bridge/synopsys: dsi: add support for non-continuous HS clock") +Cc: stable@vger.kernel.org # 5.10+ +Signed-off-by: Heiko Stuebner +Tested-by: Ezequiel Garcia +Reviewed-by: Christopher Morgan +Link: https://patchwork.freedesktop.org/patch/msgid/20210206135020.1991820-1-heiko@sntech.de +Signed-off-by: Maarten Lankhorst +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/panel/panel-elida-kd35t133.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/gpu/drm/panel/panel-elida-kd35t133.c ++++ b/drivers/gpu/drm/panel/panel-elida-kd35t133.c +@@ -265,7 +265,8 @@ static int kd35t133_probe(struct mipi_ds + dsi->lanes = 1; + dsi->format = MIPI_DSI_FMT_RGB888; + dsi->mode_flags = MIPI_DSI_MODE_VIDEO | MIPI_DSI_MODE_VIDEO_BURST | +- MIPI_DSI_MODE_LPM | MIPI_DSI_MODE_EOT_PACKET; ++ MIPI_DSI_MODE_LPM | MIPI_DSI_MODE_EOT_PACKET | ++ MIPI_DSI_CLOCK_NON_CONTINUOUS; + + drm_panel_init(&ctx->panel, &dsi->dev, &kd35t133_funcs, + DRM_MODE_CONNECTOR_DSI); diff --git a/queue-5.11/drm-rockchip-require-the-ytr-modifier-for-afbc.patch b/queue-5.11/drm-rockchip-require-the-ytr-modifier-for-afbc.patch new file mode 100644 index 00000000000..b4ce116d1e4 --- /dev/null +++ b/queue-5.11/drm-rockchip-require-the-ytr-modifier-for-afbc.patch @@ -0,0 +1,61 @@ +From 5f94e3571459abb626077aedb65d71264c2a58c0 Mon Sep 17 00:00:00 2001 +From: Alyssa Rosenzweig +Date: Tue, 11 Aug 2020 16:26:31 -0400 +Subject: drm/rockchip: Require the YTR modifier for AFBC + +From: Alyssa Rosenzweig + +commit 5f94e3571459abb626077aedb65d71264c2a58c0 upstream. + +The AFBC decoder used in the Rockchip VOP assumes the use of the +YUV-like colourspace transform (YTR). YTR is lossless for RGB(A) +buffers, which covers the RGBA8 and RGB565 formats supported in +vop_convert_afbc_format. Use of YTR is signaled with the +AFBC_FORMAT_MOD_YTR modifier, which prior to this commit was missing. As +such, a producer would have to generate buffers that do not use YTR, +which the VOP would erroneously decode as YTR, leading to severe visual +corruption. + +The upstream AFBC support was developed against a captured frame, which +failed to exercise modifier support. Prior to bring-up of AFBC in Mesa +(in the Panfrost driver), no open userspace respected modifier +reporting. As such, this change is not expected to affect broken +userspaces. + +Tested on RK3399 with Panfrost and Weston. + +Fixes: 7707f7227f09 ("drm/rockchip: Add support for afbc") +Cc: stable@vger.kernel.org +Signed-off-by: Alyssa Rosenzweig +Acked-by: Daniel Stone +Signed-off-by: Heiko Stuebner +Link: https://patchwork.freedesktop.org/patch/msgid/20200811202631.3603-1-alyssa.rosenzweig@collabora.com +Signed-off-by: Maarten Lankhorst +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/rockchip/rockchip_drm_vop.h | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.h ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.h +@@ -17,9 +17,20 @@ + + #define NUM_YUV2YUV_COEFFICIENTS 12 + ++/* AFBC supports a number of configurable modes. Relevant to us is block size ++ * (16x16 or 32x8), storage modifiers (SPARSE, SPLIT), and the YUV-like ++ * colourspace transform (YTR). 16x16 SPARSE mode is always used. SPLIT mode ++ * could be enabled via the hreg_block_split register, but is not currently ++ * handled. The colourspace transform is implicitly always assumed by the ++ * decoder, so consumers must use this transform as well. ++ * ++ * Failure to match modifiers will cause errors displaying AFBC buffers ++ * produced by conformant AFBC producers, including Mesa. ++ */ + #define ROCKCHIP_AFBC_MOD \ + DRM_FORMAT_MOD_ARM_AFBC( \ + AFBC_FORMAT_MOD_BLOCK_SIZE_16x16 | AFBC_FORMAT_MOD_SPARSE \ ++ | AFBC_FORMAT_MOD_YTR \ + ) + + enum vop_data_format { diff --git a/queue-5.11/drm-sched-cancel-and-flush-all-outstanding-jobs-before-finish.patch b/queue-5.11/drm-sched-cancel-and-flush-all-outstanding-jobs-before-finish.patch new file mode 100644 index 00000000000..c32ff1d153a --- /dev/null +++ b/queue-5.11/drm-sched-cancel-and-flush-all-outstanding-jobs-before-finish.patch @@ -0,0 +1,36 @@ +From e582951baabba3e278c97169d0acc1e09b24a72e Mon Sep 17 00:00:00 2001 +From: Andrey Grodzovsky +Date: Mon, 18 Jan 2021 16:01:13 -0500 +Subject: drm/sched: Cancel and flush all outstanding jobs before finish. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andrey Grodzovsky + +commit e582951baabba3e278c97169d0acc1e09b24a72e upstream. + +To avoid any possible use after free. + +Signed-off-by: Andrey Grodzovsky +Reviewed-by: Christian König +Link: https://patchwork.freedesktop.org/patch/414814/ +CC: stable@vger.kernel.org +Signed-off-by: Christian König +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/scheduler/sched_main.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/gpu/drm/scheduler/sched_main.c ++++ b/drivers/gpu/drm/scheduler/sched_main.c +@@ -891,6 +891,9 @@ void drm_sched_fini(struct drm_gpu_sched + if (sched->thread) + kthread_stop(sched->thread); + ++ /* Confirm no work left behind accessing device structures */ ++ cancel_delayed_work_sync(&sched->work_tdr); ++ + sched->ready = false; + } + EXPORT_SYMBOL(drm_sched_fini); diff --git a/queue-5.11/drm-ttm-fix-a-memory-leak.patch b/queue-5.11/drm-ttm-fix-a-memory-leak.patch new file mode 100644 index 00000000000..d507a27b509 --- /dev/null +++ b/queue-5.11/drm-ttm-fix-a-memory-leak.patch @@ -0,0 +1,62 @@ +From 7a8a4b0729a8807e37196e44629b31ee03f88872 Mon Sep 17 00:00:00 2001 +From: xinhui pan +Date: Fri, 19 Feb 2021 12:25:47 +0800 +Subject: drm/ttm: Fix a memory leak +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: xinhui pan + +commit 7a8a4b0729a8807e37196e44629b31ee03f88872 upstream. + +Free the memory on failure. +Also no need to re-alloc memory on retry. + +Signed-off-by: xinhui pan +Link: https://patchwork.freedesktop.org/patch/msgid/20210219042547.44855-1-xinhui.pan@amd.com +Reviewed-by: Christian König +CC: stable@vger.kernel.org # 5.11 +Signed-off-by: Christian König +Signed-off-by: Maarten Lankhorst +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/ttm/ttm_bo.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/drivers/gpu/drm/ttm/ttm_bo.c ++++ b/drivers/gpu/drm/ttm/ttm_bo.c +@@ -967,8 +967,10 @@ static int ttm_bo_bounce_temp_buffer(str + return ret; + /* move to the bounce domain */ + ret = ttm_bo_handle_move_mem(bo, &hop_mem, false, ctx, NULL); +- if (ret) ++ if (ret) { ++ ttm_resource_free(bo, &hop_mem); + return ret; ++ } + return 0; + } + +@@ -1000,18 +1002,19 @@ static int ttm_bo_move_buffer(struct ttm + * stop and the driver will be called to make + * the second hop. + */ +-bounce: + ret = ttm_bo_mem_space(bo, placement, &mem, ctx); + if (ret) + return ret; ++bounce: + ret = ttm_bo_handle_move_mem(bo, &mem, false, ctx, &hop); + if (ret == -EMULTIHOP) { + ret = ttm_bo_bounce_temp_buffer(bo, &mem, ctx, &hop); + if (ret) +- return ret; ++ goto out; + /* try and move to final place now. */ + goto bounce; + } ++out: + if (ret) + ttm_resource_free(bo, &mem); + return ret; diff --git a/queue-5.11/dts64-mt7622-fix-slow-sd-card-access.patch b/queue-5.11/dts64-mt7622-fix-slow-sd-card-access.patch new file mode 100644 index 00000000000..585f862c952 --- /dev/null +++ b/queue-5.11/dts64-mt7622-fix-slow-sd-card-access.patch @@ -0,0 +1,33 @@ +From dc2e76175417e69c41d927dba75a966399f18354 Mon Sep 17 00:00:00 2001 +From: Frank Wunderlich +Date: Wed, 13 Jan 2021 19:09:19 +0100 +Subject: dts64: mt7622: fix slow sd card access + +From: Frank Wunderlich + +commit dc2e76175417e69c41d927dba75a966399f18354 upstream. + +Fix extreme slow speed (200MB takes ~20 min) on writing sdcard on +bananapi-r64 by adding reset-control for mmc1 like it's done for mmc0/emmc. + +Fixes: 2c002a3049f7 ("arm64: dts: mt7622: add mmc related device nodes") +Signed-off-by: Frank Wunderlich +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20210113180919.49523-1-linux@fw-web.de +Signed-off-by: Matthias Brugger +Signed-off-by: Greg Kroah-Hartman +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -698,6 +698,8 @@ + clocks = <&pericfg CLK_PERI_MSDC30_1_PD>, + <&topckgen CLK_TOP_AXI_SEL>; + clock-names = "source", "hclk"; ++ resets = <&pericfg MT7622_PERI_MSDC1_SW_RST>; ++ reset-names = "hrst"; + status = "disabled"; + }; + diff --git a/queue-5.11/erofs-initialized-fields-can-only-be-observed-after-bit-is-set.patch b/queue-5.11/erofs-initialized-fields-can-only-be-observed-after-bit-is-set.patch new file mode 100644 index 00000000000..a099f36c18c --- /dev/null +++ b/queue-5.11/erofs-initialized-fields-can-only-be-observed-after-bit-is-set.patch @@ -0,0 +1,82 @@ +From ce063129181312f8781a047a50be439c5859747b Mon Sep 17 00:00:00 2001 +From: Gao Xiang +Date: Tue, 9 Feb 2021 21:06:18 +0800 +Subject: erofs: initialized fields can only be observed after bit is set + +From: Gao Xiang + +commit ce063129181312f8781a047a50be439c5859747b upstream. + +Currently, although set_bit() & test_bit() pairs are used as a fast- +path for initialized configurations. However, these atomic ops are +actually relaxed forms. Instead, load-acquire & store-release form is +needed to make sure uninitialized fields won't be observed in advance +here (yet no such corresponding bitops so use full barriers instead.) + +Link: https://lore.kernel.org/r/20210209130618.15838-1-hsiangkao@aol.com +Fixes: 62dc45979f3f ("staging: erofs: fix race of initializing xattrs of a inode at the same time") +Fixes: 152a333a5895 ("staging: erofs: add compacted compression indexes support") +Cc: # 5.3+ +Reported-by: Huang Jianan +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Signed-off-by: Greg Kroah-Hartman +--- + fs/erofs/xattr.c | 10 +++++++++- + fs/erofs/zmap.c | 10 +++++++++- + 2 files changed, 18 insertions(+), 2 deletions(-) + +--- a/fs/erofs/xattr.c ++++ b/fs/erofs/xattr.c +@@ -48,8 +48,14 @@ static int init_inode_xattrs(struct inod + int ret = 0; + + /* the most case is that xattrs of this inode are initialized. */ +- if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) ++ if (test_bit(EROFS_I_EA_INITED_BIT, &vi->flags)) { ++ /* ++ * paired with smp_mb() at the end of the function to ensure ++ * fields will only be observed after the bit is set. ++ */ ++ smp_mb(); + return 0; ++ } + + if (wait_on_bit_lock(&vi->flags, EROFS_I_BL_XATTR_BIT, TASK_KILLABLE)) + return -ERESTARTSYS; +@@ -137,6 +143,8 @@ static int init_inode_xattrs(struct inod + } + xattr_iter_end(&it, atomic_map); + ++ /* paired with smp_mb() at the beginning of the function. */ ++ smp_mb(); + set_bit(EROFS_I_EA_INITED_BIT, &vi->flags); + + out_unlock: +--- a/fs/erofs/zmap.c ++++ b/fs/erofs/zmap.c +@@ -36,8 +36,14 @@ static int z_erofs_fill_inode_lazy(struc + void *kaddr; + struct z_erofs_map_header *h; + +- if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags)) ++ if (test_bit(EROFS_I_Z_INITED_BIT, &vi->flags)) { ++ /* ++ * paired with smp_mb() at the end of the function to ensure ++ * fields will only be observed after the bit is set. ++ */ ++ smp_mb(); + return 0; ++ } + + if (wait_on_bit_lock(&vi->flags, EROFS_I_BL_Z_BIT, TASK_KILLABLE)) + return -ERESTARTSYS; +@@ -83,6 +89,8 @@ static int z_erofs_fill_inode_lazy(struc + + vi->z_physical_clusterbits[1] = vi->z_logical_clusterbits + + ((h->h_clusterbits >> 5) & 7); ++ /* paired with smp_mb() at the beginning of the function */ ++ smp_mb(); + set_bit(EROFS_I_Z_INITED_BIT, &vi->flags); + unmap_done: + kunmap_atomic(kaddr); diff --git a/queue-5.11/hid-logitech-dj-add-support-for-keyboard-events-in-equad-step-4-gaming.patch b/queue-5.11/hid-logitech-dj-add-support-for-keyboard-events-in-equad-step-4-gaming.patch new file mode 100644 index 00000000000..b462fa672c9 --- /dev/null +++ b/queue-5.11/hid-logitech-dj-add-support-for-keyboard-events-in-equad-step-4-gaming.patch @@ -0,0 +1,44 @@ +From ef07c116d98772952807492bd32a61f5af172a94 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Filipe=20La=C3=ADns?= +Date: Fri, 5 Feb 2021 14:34:44 +0000 +Subject: HID: logitech-dj: add support for keyboard events in eQUAD step 4 Gaming +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Filipe Laíns + +commit ef07c116d98772952807492bd32a61f5af172a94 upstream. + +In e400071a805d6229223a98899e9da8c6233704a1 I added support for the +receiver that comes with the G602 device, but unfortunately I screwed up +during testing and it seems the keyboard events were actually not being +sent to userspace. +This resulted in keyboard events being broken in userspace, please +backport the fix. + +The receiver uses the normal 0x01 Logitech keyboard report descriptor, +as expected, so it is just a matter of flagging it as supported. + +Reported in +https://github.com/libratbag/libratbag/issues/1124 + +Fixes: e400071a805d6 ("HID: logitech-dj: add the G602 receiver") +Cc: +Signed-off-by: Filipe Laíns +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-logitech-dj.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -980,6 +980,7 @@ static void logi_hidpp_recv_queue_notif( + case 0x07: + device_type = "eQUAD step 4 Gaming"; + logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem); ++ workitem.reports_supported |= STD_KEYBOARD; + break; + case 0x08: + device_type = "eQUAD step 4 for gamepads"; diff --git a/queue-5.11/hid-wacom-ignore-attempts-to-overwrite-the-touch_max-value-from-hid.patch b/queue-5.11/hid-wacom-ignore-attempts-to-overwrite-the-touch_max-value-from-hid.patch new file mode 100644 index 00000000000..671551f076a --- /dev/null +++ b/queue-5.11/hid-wacom-ignore-attempts-to-overwrite-the-touch_max-value-from-hid.patch @@ -0,0 +1,67 @@ +From 88f38846bfb1a452a3d47e38aeab20a4ceb74294 Mon Sep 17 00:00:00 2001 +From: Jason Gerecke +Date: Tue, 16 Feb 2021 11:41:54 -0800 +Subject: HID: wacom: Ignore attempts to overwrite the touch_max value from HID + +From: Jason Gerecke + +commit 88f38846bfb1a452a3d47e38aeab20a4ceb74294 upstream. + +The `wacom_feature_mapping` function is careful to only set the the +touch_max value a single time, but this care does not extend to the +`wacom_wac_finger_event` function. In particular, if a device sends +multiple HID_DG_CONTACTMAX items in a single feature report, the +driver will end up retaining the value of last item. + +The HID descriptor for the Cintiq Companion 2 does exactly this. It +incorrectly sets a "Report Count" of 2, which will cause the driver +to process two HID_DG_CONTACTCOUNT items. The first item has the actual +count, while the second item should have been declared as a constant +zero. The constant zero is the value the driver ends up using, however, +since it is the last HID_DG_CONTACTCOUNT in the report. + + Report ID (16), + Usage (Contact Count Maximum), ; Contact count maximum (55h, static value) + Report Count (2), + Logical Maximum (10), + Feature (Variable), + +To address this, we add a check that the touch_max is not already set +within the `wacom_wac_finger_event` function that processes the +HID_DG_TOUCHMAX item. We emit a warning if the value is set and ignore +the updated value. + +This could potentially cause problems if there is a tablet which has +a similar issue but requires the last item to be used. This is unlikely, +however, since it would have to have a different non-zero value for +HID_DG_CONTACTMAX earlier in the same report, which makes no sense +except in the case of a firmware bug. Note that cases where the +HID_DG_CONTACTMAX items are in different reports is already handled +(and similarly ignored) by `wacom_feature_mapping` as mentioned above. + +Link: https://github.com/linuxwacom/input-wacom/issues/223 +Fixes: 184eccd40389 ("HID: wacom: generic: read HID_DG_CONTACTMAX from any feature report") +Signed-off-by: Jason Gerecke +CC: stable@vger.kernel.org +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/wacom_wac.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -2600,7 +2600,12 @@ static void wacom_wac_finger_event(struc + wacom_wac->is_invalid_bt_frame = !value; + return; + case HID_DG_CONTACTMAX: +- features->touch_max = value; ++ if (!features->touch_max) { ++ features->touch_max = value; ++ } else { ++ hid_warn(hdev, "%s: ignoring attempt to overwrite non-zero touch_max " ++ "%d -> %d\n", __func__, features->touch_max, value); ++ } + return; + } + diff --git a/queue-5.11/input-i8042-add-asus-zenbook-flip-to-noselftest-list.patch b/queue-5.11/input-i8042-add-asus-zenbook-flip-to-noselftest-list.patch new file mode 100644 index 00000000000..579e9197e02 --- /dev/null +++ b/queue-5.11/input-i8042-add-asus-zenbook-flip-to-noselftest-list.patch @@ -0,0 +1,41 @@ +From b5d6e7ab7fe7d186878142e9fc1a05e4c3b65eb9 Mon Sep 17 00:00:00 2001 +From: Marcos Paulo de Souza +Date: Fri, 19 Feb 2021 10:37:13 -0800 +Subject: Input: i8042 - add ASUS Zenbook Flip to noselftest list + +From: Marcos Paulo de Souza + +commit b5d6e7ab7fe7d186878142e9fc1a05e4c3b65eb9 upstream. + +After commit 77b425399f6d ("Input: i8042 - use chassis info to skip +selftest on Asus laptops"), all modern Asus laptops have the i8042 +selftest disabled. It has done by using chassys type "10" (laptop). + +The Asus Zenbook Flip suffers from similar suspend/resume issues, but +it _sometimes_ work and sometimes it doesn't. Setting noselftest makes +it work reliably. In this case, we need to add chassis type "31" +(convertible) in order to avoid selftest in this device. + +Reported-by: Ludvig Norgren Guldhag +Signed-off-by: Marcos Paulo de Souza +Link: https://lore.kernel.org/r/20210219164638.761-1-mpdesouza@suse.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/serio/i8042-x86ia64io.h | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -588,6 +588,10 @@ static const struct dmi_system_id i8042_ + DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), + DMI_MATCH(DMI_CHASSIS_TYPE, "10"), /* Notebook */ + }, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_CHASSIS_TYPE, "31"), /* Convertible Notebook */ ++ }, + }, + { } + }; diff --git a/queue-5.11/input-joydev-prevent-potential-read-overflow-in-ioctl.patch b/queue-5.11/input-joydev-prevent-potential-read-overflow-in-ioctl.patch new file mode 100644 index 00000000000..ba773570859 --- /dev/null +++ b/queue-5.11/input-joydev-prevent-potential-read-overflow-in-ioctl.patch @@ -0,0 +1,53 @@ +From 182d679b2298d62bf42bb14b12a8067b8e17b617 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 17 Feb 2021 12:21:10 -0800 +Subject: Input: joydev - prevent potential read overflow in ioctl + +From: Dan Carpenter + +commit 182d679b2298d62bf42bb14b12a8067b8e17b617 upstream. + +The problem here is that "len" might be less than "joydev->nabs" so the +loops which verfy abspam[i] and keypam[] might read beyond the buffer. + +Fixes: 999b874f4aa3 ("Input: joydev - validate axis/button maps before clobbering current ones") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/YCyzR8WvFRw4HWw6@mwanda +[dtor: additional check for len being even in joydev_handle_JSIOCSBTNMAP] +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joydev.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/input/joydev.c ++++ b/drivers/input/joydev.c +@@ -456,7 +456,7 @@ static int joydev_handle_JSIOCSAXMAP(str + if (IS_ERR(abspam)) + return PTR_ERR(abspam); + +- for (i = 0; i < joydev->nabs; i++) { ++ for (i = 0; i < len && i < joydev->nabs; i++) { + if (abspam[i] > ABS_MAX) { + retval = -EINVAL; + goto out; +@@ -480,6 +480,9 @@ static int joydev_handle_JSIOCSBTNMAP(st + int i; + int retval = 0; + ++ if (len % sizeof(*keypam)) ++ return -EINVAL; ++ + len = min(len, sizeof(joydev->keypam)); + + /* Validate the map. */ +@@ -487,7 +490,7 @@ static int joydev_handle_JSIOCSBTNMAP(st + if (IS_ERR(keypam)) + return PTR_ERR(keypam); + +- for (i = 0; i < joydev->nkey; i++) { ++ for (i = 0; i < (len / 2) && i < joydev->nkey; i++) { + if (keypam[i] > KEY_MAX || keypam[i] < BTN_MISC) { + retval = -EINVAL; + goto out; diff --git a/queue-5.11/input-raydium_ts_i2c-do-not-send-zero-length.patch b/queue-5.11/input-raydium_ts_i2c-do-not-send-zero-length.patch new file mode 100644 index 00000000000..878a245891d --- /dev/null +++ b/queue-5.11/input-raydium_ts_i2c-do-not-send-zero-length.patch @@ -0,0 +1,40 @@ +From fafd320ae51b9c72d371585b2501f86640ea7b7d Mon Sep 17 00:00:00 2001 +From: "jeffrey.lin" +Date: Tue, 15 Dec 2020 10:50:12 -0800 +Subject: Input: raydium_ts_i2c - do not send zero length + +From: jeffrey.lin + +commit fafd320ae51b9c72d371585b2501f86640ea7b7d upstream. + +Add default write command package to prevent i2c quirk error of zero +data length as Raydium touch firmware update is executed. + +Signed-off-by: jeffrey.lin +Link: https://lore.kernel.org/r/1608031217-7247-1-git-send-email-jeffrey.lin@raydium.corp-partner.google.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/touchscreen/raydium_i2c_ts.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/input/touchscreen/raydium_i2c_ts.c ++++ b/drivers/input/touchscreen/raydium_i2c_ts.c +@@ -445,6 +445,7 @@ static int raydium_i2c_write_object(stru + enum raydium_bl_ack state) + { + int error; ++ static const u8 cmd[] = { 0xFF, 0x39 }; + + error = raydium_i2c_send(client, RM_CMD_BOOT_WRT, data, len); + if (error) { +@@ -453,7 +454,7 @@ static int raydium_i2c_write_object(stru + return error; + } + +- error = raydium_i2c_send(client, RM_CMD_BOOT_ACK, NULL, 0); ++ error = raydium_i2c_send(client, RM_CMD_BOOT_ACK, cmd, sizeof(cmd)); + if (error) { + dev_err(&client->dev, "Ack obj command failed: %d\n", error); + return error; diff --git a/queue-5.11/input-xpad-add-support-for-powera-enhanced-wired-controller-for-xbox-series-x-s.patch b/queue-5.11/input-xpad-add-support-for-powera-enhanced-wired-controller-for-xbox-series-x-s.patch new file mode 100644 index 00000000000..3cbaaf57113 --- /dev/null +++ b/queue-5.11/input-xpad-add-support-for-powera-enhanced-wired-controller-for-xbox-series-x-s.patch @@ -0,0 +1,31 @@ +From 42ffcd1dba1796bcda386eb6f260df9fc23c90af Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Olivier=20Cr=C3=AAte?= +Date: Fri, 5 Feb 2021 11:59:08 -0800 +Subject: Input: xpad - add support for PowerA Enhanced Wired Controller for Xbox Series X|S +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Olivier Crête + +commit 42ffcd1dba1796bcda386eb6f260df9fc23c90af upstream. + +Signed-off-by: Olivier Crête +Link: https://lore.kernel.org/r/20210204005318.615647-1-olivier.crete@collabora.com +Cc: stable@vger.kernel.org +Signed-off-by: Dmitry Torokhov +Signed-off-by: Greg Kroah-Hartman +--- + drivers/input/joystick/xpad.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -305,6 +305,7 @@ static const struct xpad_device { + { 0x1bad, 0xfd00, "Razer Onza TE", 0, XTYPE_XBOX360 }, + { 0x1bad, 0xfd01, "Razer Onza", 0, XTYPE_XBOX360 }, + { 0x20d6, 0x2001, "BDA Xbox Series X Wired Controller", 0, XTYPE_XBOXONE }, ++ { 0x20d6, 0x2009, "PowerA Enhanced Wired Controller for Xbox Series X|S", 0, XTYPE_XBOXONE }, + { 0x20d6, 0x281f, "PowerA Wired Controller For Xbox 360", 0, XTYPE_XBOX360 }, + { 0x2e24, 0x0652, "Hyperkin Duke X-Box One pad", 0, XTYPE_XBOXONE }, + { 0x24c6, 0x5000, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, diff --git a/queue-5.11/keys-trusted-fix-incorrect-handling-of-tpm_get_random.patch b/queue-5.11/keys-trusted-fix-incorrect-handling-of-tpm_get_random.patch new file mode 100644 index 00000000000..84b14e458c0 --- /dev/null +++ b/queue-5.11/keys-trusted-fix-incorrect-handling-of-tpm_get_random.patch @@ -0,0 +1,91 @@ +From 5df16caada3fba3b21cb09b85cdedf99507f4ec1 Mon Sep 17 00:00:00 2001 +From: Jarkko Sakkinen +Date: Fri, 29 Jan 2021 01:56:19 +0200 +Subject: KEYS: trusted: Fix incorrect handling of tpm_get_random() + +From: Jarkko Sakkinen + +commit 5df16caada3fba3b21cb09b85cdedf99507f4ec1 upstream. + +When tpm_get_random() was introduced, it defined the following API for the +return value: + +1. A positive value tells how many bytes of random data was generated. +2. A negative value on error. + +However, in the call sites the API was used incorrectly, i.e. as it would +only return negative values and otherwise zero. Returning he positive read +counts to the user space does not make any possible sense. + +Fix this by returning -EIO when tpm_get_random() returns a positive value. + +Fixes: 41ab999c80f1 ("tpm: Move tpm_get_random api into the TPM device driver") +Cc: stable@vger.kernel.org +Cc: Mimi Zohar +Cc: "James E.J. Bottomley" +Cc: David Howells +Cc: Kent Yoder +Signed-off-by: Jarkko Sakkinen +Reviewed-by: Mimi Zohar +Signed-off-by: Greg Kroah-Hartman +--- + security/keys/trusted-keys/trusted_tpm1.c | 20 +++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +--- a/security/keys/trusted-keys/trusted_tpm1.c ++++ b/security/keys/trusted-keys/trusted_tpm1.c +@@ -403,9 +403,12 @@ static int osap(struct tpm_buf *tb, stru + int ret; + + ret = tpm_get_random(chip, ononce, TPM_NONCE_SIZE); +- if (ret != TPM_NONCE_SIZE) ++ if (ret < 0) + return ret; + ++ if (ret != TPM_NONCE_SIZE) ++ return -EIO; ++ + tpm_buf_reset(tb, TPM_TAG_RQU_COMMAND, TPM_ORD_OSAP); + tpm_buf_append_u16(tb, type); + tpm_buf_append_u32(tb, handle); +@@ -496,8 +499,12 @@ static int tpm_seal(struct tpm_buf *tb, + goto out; + + ret = tpm_get_random(chip, td->nonceodd, TPM_NONCE_SIZE); ++ if (ret < 0) ++ return ret; ++ + if (ret != TPM_NONCE_SIZE) +- goto out; ++ return -EIO; ++ + ordinal = htonl(TPM_ORD_SEAL); + datsize = htonl(datalen); + pcrsize = htonl(pcrinfosize); +@@ -601,9 +608,12 @@ static int tpm_unseal(struct tpm_buf *tb + + ordinal = htonl(TPM_ORD_UNSEAL); + ret = tpm_get_random(chip, nonceodd, TPM_NONCE_SIZE); ++ if (ret < 0) ++ return ret; ++ + if (ret != TPM_NONCE_SIZE) { + pr_info("trusted_key: tpm_get_random failed (%d)\n", ret); +- return ret; ++ return -EIO; + } + ret = TSS_authhmac(authdata1, keyauth, TPM_NONCE_SIZE, + enonce1, nonceodd, cont, sizeof(uint32_t), +@@ -1013,8 +1023,12 @@ static int trusted_instantiate(struct ke + case Opt_new: + key_len = payload->key_len; + ret = tpm_get_random(chip, payload->key, key_len); ++ if (ret < 0) ++ goto out; ++ + if (ret != key_len) { + pr_info("trusted_key: key_create failed (%d)\n", ret); ++ ret = -EIO; + goto out; + } + if (tpm2) diff --git a/queue-5.11/keys-trusted-fix-migratable-1-failing.patch b/queue-5.11/keys-trusted-fix-migratable-1-failing.patch new file mode 100644 index 00000000000..e808df04c28 --- /dev/null +++ b/queue-5.11/keys-trusted-fix-migratable-1-failing.patch @@ -0,0 +1,46 @@ +From 8da7520c80468c48f981f0b81fc1be6599e3b0ad Mon Sep 17 00:00:00 2001 +From: Jarkko Sakkinen +Date: Fri, 29 Jan 2021 01:56:20 +0200 +Subject: KEYS: trusted: Fix migratable=1 failing + +From: Jarkko Sakkinen + +commit 8da7520c80468c48f981f0b81fc1be6599e3b0ad upstream. + +Consider the following transcript: + +$ keyctl add trusted kmk "new 32 blobauth=helloworld keyhandle=80000000 migratable=1" @u +add_key: Invalid argument + +The documentation has the following description: + + migratable= 0|1 indicating permission to reseal to new PCR values, + default 1 (resealing allowed) + +The consequence is that "migratable=1" should succeed. Fix this by +allowing this condition to pass instead of return -EINVAL. + +[*] Documentation/security/keys/trusted-encrypted.rst + +Cc: stable@vger.kernel.org +Cc: "James E.J. Bottomley" +Cc: Mimi Zohar +Cc: David Howells +Fixes: d00a1c72f7f4 ("keys: add new trusted key-type") +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + security/keys/trusted-keys/trusted_tpm1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/security/keys/trusted-keys/trusted_tpm1.c ++++ b/security/keys/trusted-keys/trusted_tpm1.c +@@ -801,7 +801,7 @@ static int getoptions(char *c, struct tr + case Opt_migratable: + if (*args[0].from == '0') + pay->migratable = 0; +- else ++ else if (*args[0].from != '1') + return -EINVAL; + break; + case Opt_pcrlock: diff --git a/queue-5.11/keys-trusted-reserve-tpm-for-seal-and-unseal-operations.patch b/queue-5.11/keys-trusted-reserve-tpm-for-seal-and-unseal-operations.patch new file mode 100644 index 00000000000..961467e01f1 --- /dev/null +++ b/queue-5.11/keys-trusted-reserve-tpm-for-seal-and-unseal-operations.patch @@ -0,0 +1,148 @@ +From 8c657a0590de585b1115847c17b34a58025f2f4b Mon Sep 17 00:00:00 2001 +From: Jarkko Sakkinen +Date: Fri, 29 Jan 2021 01:56:21 +0200 +Subject: KEYS: trusted: Reserve TPM for seal and unseal operations + +From: Jarkko Sakkinen + +commit 8c657a0590de585b1115847c17b34a58025f2f4b upstream. + +When TPM 2.0 trusted keys code was moved to the trusted keys subsystem, +the operations were unwrapped from tpm_try_get_ops() and tpm_put_ops(), +which are used to take temporarily the ownership of the TPM chip. The +ownership is only taken inside tpm_send(), but this is not sufficient, +as in the key load TPM2_CC_LOAD, TPM2_CC_UNSEAL and TPM2_FLUSH_CONTEXT +need to be done as a one single atom. + +Take the TPM chip ownership before sending anything with +tpm_try_get_ops() and tpm_put_ops(), and use tpm_transmit_cmd() to send +TPM commands instead of tpm_send(), reverting back to the old behaviour. + +Fixes: 2e19e10131a0 ("KEYS: trusted: Move TPM2 trusted keys code") +Reported-by: "James E.J. Bottomley" +Cc: stable@vger.kernel.org +Cc: David Howells +Cc: Mimi Zohar +Cc: Sumit Garg +Acked-by Sumit Garg +Tested-by: Mimi Zohar +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/tpm/tpm.h | 4 ---- + include/linux/tpm.h | 5 ++++- + security/keys/trusted-keys/trusted_tpm2.c | 22 ++++++++++++++++++---- + 3 files changed, 22 insertions(+), 9 deletions(-) + +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -164,8 +164,6 @@ extern const struct file_operations tpmr + extern struct idr dev_nums_idr; + + ssize_t tpm_transmit(struct tpm_chip *chip, u8 *buf, size_t bufsiz); +-ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf, +- size_t min_rsp_body_length, const char *desc); + int tpm_get_timeouts(struct tpm_chip *); + int tpm_auto_startup(struct tpm_chip *chip); + +@@ -194,8 +192,6 @@ static inline void tpm_msleep(unsigned i + int tpm_chip_start(struct tpm_chip *chip); + void tpm_chip_stop(struct tpm_chip *chip); + struct tpm_chip *tpm_find_get_ops(struct tpm_chip *chip); +-__must_check int tpm_try_get_ops(struct tpm_chip *chip); +-void tpm_put_ops(struct tpm_chip *chip); + + struct tpm_chip *tpm_chip_alloc(struct device *dev, + const struct tpm_class_ops *ops); +--- a/include/linux/tpm.h ++++ b/include/linux/tpm.h +@@ -397,6 +397,10 @@ static inline u32 tpm2_rc_value(u32 rc) + #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE) + + extern int tpm_is_tpm2(struct tpm_chip *chip); ++extern __must_check int tpm_try_get_ops(struct tpm_chip *chip); ++extern void tpm_put_ops(struct tpm_chip *chip); ++extern ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf, ++ size_t min_rsp_body_length, const char *desc); + extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx, + struct tpm_digest *digest); + extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, +@@ -410,7 +414,6 @@ static inline int tpm_is_tpm2(struct tpm + { + return -ENODEV; + } +- + static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, + struct tpm_digest *digest) + { +--- a/security/keys/trusted-keys/trusted_tpm2.c ++++ b/security/keys/trusted-keys/trusted_tpm2.c +@@ -83,6 +83,12 @@ int tpm2_seal_trusted(struct tpm_chip *c + if (rc) + return rc; + ++ rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE); ++ if (rc) { ++ tpm_put_ops(chip); ++ return rc; ++ } ++ + tpm_buf_append_u32(&buf, options->keyhandle); + tpm2_buf_append_auth(&buf, TPM2_RS_PW, + NULL /* nonce */, 0, +@@ -130,7 +136,7 @@ int tpm2_seal_trusted(struct tpm_chip *c + goto out; + } + +- rc = tpm_send(chip, buf.data, tpm_buf_length(&buf)); ++ rc = tpm_transmit_cmd(chip, &buf, 4, "sealing data"); + if (rc) + goto out; + +@@ -157,6 +163,7 @@ out: + rc = -EPERM; + } + ++ tpm_put_ops(chip); + return rc; + } + +@@ -211,7 +218,7 @@ static int tpm2_load_cmd(struct tpm_chip + goto out; + } + +- rc = tpm_send(chip, buf.data, tpm_buf_length(&buf)); ++ rc = tpm_transmit_cmd(chip, &buf, 4, "loading blob"); + if (!rc) + *blob_handle = be32_to_cpup( + (__be32 *) &buf.data[TPM_HEADER_SIZE]); +@@ -260,7 +267,7 @@ static int tpm2_unseal_cmd(struct tpm_ch + options->blobauth /* hmac */, + TPM_DIGEST_SIZE); + +- rc = tpm_send(chip, buf.data, tpm_buf_length(&buf)); ++ rc = tpm_transmit_cmd(chip, &buf, 6, "unsealing"); + if (rc > 0) + rc = -EPERM; + +@@ -304,12 +311,19 @@ int tpm2_unseal_trusted(struct tpm_chip + u32 blob_handle; + int rc; + +- rc = tpm2_load_cmd(chip, payload, options, &blob_handle); ++ rc = tpm_try_get_ops(chip); + if (rc) + return rc; + ++ rc = tpm2_load_cmd(chip, payload, options, &blob_handle); ++ if (rc) ++ goto out; ++ + rc = tpm2_unseal_cmd(chip, payload, options, blob_handle); + tpm2_flush_context(chip, blob_handle); + ++out: ++ tpm_put_ops(chip); ++ + return rc; + } diff --git a/queue-5.11/media-mceusb-fix-potential-out-of-bounds-shift.patch b/queue-5.11/media-mceusb-fix-potential-out-of-bounds-shift.patch new file mode 100644 index 00000000000..9a50ec806b9 --- /dev/null +++ b/queue-5.11/media-mceusb-fix-potential-out-of-bounds-shift.patch @@ -0,0 +1,36 @@ +From 1b43bad31fb0e00f45baf5b05bd21eb8d8ce7f58 Mon Sep 17 00:00:00 2001 +From: James Reynolds +Date: Tue, 22 Dec 2020 13:07:04 +0100 +Subject: media: mceusb: Fix potential out-of-bounds shift + +From: James Reynolds + +commit 1b43bad31fb0e00f45baf5b05bd21eb8d8ce7f58 upstream. + +When processing a MCE_RSP_GETPORTSTATUS command, the bit index to set in +ir->txports_cabled comes from response data, and isn't validated. + +As ir->txports_cabled is a u8, nothing should be done if the bit index +is greater than 7. + +Cc: stable@vger.kernel.org +Reported-by: syzbot+ec3b3128c576e109171d@syzkaller.appspotmail.com +Signed-off-by: James Reynolds +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Greg Kroah-Hartman +--- + drivers/media/rc/mceusb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/media/rc/mceusb.c ++++ b/drivers/media/rc/mceusb.c +@@ -1169,7 +1169,7 @@ static void mceusb_handle_command(struct + switch (subcmd) { + /* the one and only 5-byte return value command */ + case MCE_RSP_GETPORTSTATUS: +- if (buf_in[5] == 0) ++ if (buf_in[5] == 0 && *hi < 8) + ir->txports_cabled |= 1 << *hi; + break; + diff --git a/queue-5.11/mips-compressed-fix-build-with-enabled-ubsan.patch b/queue-5.11/mips-compressed-fix-build-with-enabled-ubsan.patch new file mode 100644 index 00000000000..f389750fb7c --- /dev/null +++ b/queue-5.11/mips-compressed-fix-build-with-enabled-ubsan.patch @@ -0,0 +1,49 @@ +From fc4cac4cfc437659ce445c3c47b807e1cc625b66 Mon Sep 17 00:00:00 2001 +From: Alexander Lobakin +Date: Mon, 8 Feb 2021 12:37:42 +0000 +Subject: MIPS: compressed: fix build with enabled UBSAN + +From: Alexander Lobakin + +commit fc4cac4cfc437659ce445c3c47b807e1cc625b66 upstream. + +Commit 1e35918ad9d1 ("MIPS: Enable Undefined Behavior Sanitizer +UBSAN") added a possibility to build the entire kernel with UBSAN +instrumentation for MIPS, with the exception for VDSO. +However, self-extracting head wasn't been added to exceptions, so +this occurs: + +mips-alpine-linux-musl-ld: arch/mips/boot/compressed/decompress.o: +in function `FSE_buildDTable_wksp': +decompress.c:(.text.FSE_buildDTable_wksp+0x278): undefined reference +to `__ubsan_handle_shift_out_of_bounds' +mips-alpine-linux-musl-ld: decompress.c:(.text.FSE_buildDTable_wksp+0x2a8): +undefined reference to `__ubsan_handle_shift_out_of_bounds' +mips-alpine-linux-musl-ld: decompress.c:(.text.FSE_buildDTable_wksp+0x2c4): +undefined reference to `__ubsan_handle_shift_out_of_bounds' +mips-alpine-linux-musl-ld: arch/mips/boot/compressed/decompress.o: +decompress.c:(.text.FSE_buildDTable_raw+0x9c): more undefined references +to `__ubsan_handle_shift_out_of_bounds' follow + +Add UBSAN_SANITIZE := n to mips/boot/compressed/Makefile to exclude +it from instrumentation scope and fix this issue. + +Fixes: 1e35918ad9d1 ("MIPS: Enable Undefined Behavior Sanitizer UBSAN") +Cc: stable@vger.kernel.org # 5.0+ +Signed-off-by: Alexander Lobakin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/boot/compressed/Makefile | 1 + + 1 file changed, 1 insertion(+) + +--- a/arch/mips/boot/compressed/Makefile ++++ b/arch/mips/boot/compressed/Makefile +@@ -37,6 +37,7 @@ KBUILD_AFLAGS := $(KBUILD_AFLAGS) -D__AS + # Prevents link failures: __sanitizer_cov_trace_pc() is not linked in. + KCOV_INSTRUMENT := n + GCOV_PROFILE := n ++UBSAN_SANITIZE := n + + # decompressor objects (linked with vmlinuz) + vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o diff --git a/queue-5.11/mips-ingenic-disable-hptlb-for-d0-xburst-cpus-too.patch b/queue-5.11/mips-ingenic-disable-hptlb-for-d0-xburst-cpus-too.patch new file mode 100644 index 00000000000..c68f97e74e6 --- /dev/null +++ b/queue-5.11/mips-ingenic-disable-hptlb-for-d0-xburst-cpus-too.patch @@ -0,0 +1,55 @@ +From a5360958a3cd1d876aae1f504ae014658513e1af Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Sat, 12 Dec 2020 00:03:54 +0000 +Subject: MIPS: Ingenic: Disable HPTLB for D0 XBurst CPUs too +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paul Cercueil + +commit a5360958a3cd1d876aae1f504ae014658513e1af upstream. + +The JZ4760 has the HPTLB as well, but has a XBurst CPU with a D0 CPUID. + +Disable the HPTLB for all XBurst CPUs with a D0 CPUID. In the case where +there is no HPTLB (e.g. for older SoCs), this won't have any side +effect. + +Fixes: b02efeb05699 ("MIPS: Ingenic: Disable abandoned HPTLB function.") +Cc: # 5.4 +Signed-off-by: Paul Cercueil +Reviewed-by: 周琰杰 (Zhou Yanjie) +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/kernel/cpu-probe.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +--- a/arch/mips/kernel/cpu-probe.c ++++ b/arch/mips/kernel/cpu-probe.c +@@ -1830,16 +1830,17 @@ static inline void cpu_probe_ingenic(str + */ + case PRID_COMP_INGENIC_D0: + c->isa_level &= ~MIPS_CPU_ISA_M32R2; +- break; ++ fallthrough; + + /* + * The config0 register in the XBurst CPUs with a processor ID of +- * PRID_COMP_INGENIC_D1 has an abandoned huge page tlb mode, this +- * mode is not compatible with the MIPS standard, it will cause +- * tlbmiss and into an infinite loop (line 21 in the tlb-funcs.S) +- * when starting the init process. After chip reset, the default +- * is HPTLB mode, Write 0xa9000000 to cp0 register 5 sel 4 to +- * switch back to VTLB mode to prevent getting stuck. ++ * PRID_COMP_INGENIC_D0 or PRID_COMP_INGENIC_D1 has an abandoned ++ * huge page tlb mode, this mode is not compatible with the MIPS ++ * standard, it will cause tlbmiss and into an infinite loop ++ * (line 21 in the tlb-funcs.S) when starting the init process. ++ * After chip reset, the default is HPTLB mode, Write 0xa9000000 ++ * to cp0 register 5 sel 4 to switch back to VTLB mode to prevent ++ * getting stuck. + */ + case PRID_COMP_INGENIC_D1: + write_c0_page_ctrl(XBURST_PAGECTRL_HPTLB_DIS); diff --git a/queue-5.11/mips-support-binutils-configured-with-enable-mips-fix-loongson3-llsc-yes.patch b/queue-5.11/mips-support-binutils-configured-with-enable-mips-fix-loongson3-llsc-yes.patch new file mode 100644 index 00000000000..e3dc86f19bf --- /dev/null +++ b/queue-5.11/mips-support-binutils-configured-with-enable-mips-fix-loongson3-llsc-yes.patch @@ -0,0 +1,90 @@ +From 5373ae67c3aad1ab306cc722b5a80b831eb4d4d1 Mon Sep 17 00:00:00 2001 +From: Aurelien Jarno +Date: Sat, 9 Jan 2021 20:30:47 +0100 +Subject: MIPS: Support binutils configured with --enable-mips-fix-loongson3-llsc=yes + +From: Aurelien Jarno + +commit 5373ae67c3aad1ab306cc722b5a80b831eb4d4d1 upstream. + +From version 2.35, binutils can be configured with +--enable-mips-fix-loongson3-llsc=yes, which means it defaults to +-mfix-loongson3-llsc. This breaks labels which might then point at the +wrong instruction. + +The workaround to explicitly pass -mno-fix-loongson3-llsc has been +added in Linux version 5.1, but is only enabled when building a Loongson +64 kernel. As vendors might use a common toolchain for building Loongson +and non-Loongson kernels, just move that workaround to +arch/mips/Makefile. At the same time update the comments to reflect the +current status. + +Cc: stable@vger.kernel.org # 5.1+ +Cc: YunQiang Su +Signed-off-by: Aurelien Jarno +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/Makefile | 19 +++++++++++++++++++ + arch/mips/loongson64/Platform | 22 ---------------------- + 2 files changed, 19 insertions(+), 22 deletions(-) + +--- a/arch/mips/Makefile ++++ b/arch/mips/Makefile +@@ -136,6 +136,25 @@ cflags-$(CONFIG_SB1XXX_CORELIS) += $(cal + # + cflags-y += -fno-stack-check + ++# binutils from v2.35 when built with --enable-mips-fix-loongson3-llsc=yes, ++# supports an -mfix-loongson3-llsc flag which emits a sync prior to each ll ++# instruction to work around a CPU bug (see __SYNC_loongson3_war in asm/sync.h ++# for a description). ++# ++# We disable this in order to prevent the assembler meddling with the ++# instruction that labels refer to, ie. if we label an ll instruction: ++# ++# 1: ll v0, 0(a0) ++# ++# ...then with the assembler fix applied the label may actually point at a sync ++# instruction inserted by the assembler, and if we were using the label in an ++# exception table the table would no longer contain the address of the ll ++# instruction. ++# ++# Avoid this by explicitly disabling that assembler behaviour. ++# ++cflags-y += $(call as-option,-Wa$(comma)-mno-fix-loongson3-llsc,) ++ + # + # CPU-dependent compiler/assembler options for optimization. + # +--- a/arch/mips/loongson64/Platform ++++ b/arch/mips/loongson64/Platform +@@ -6,28 +6,6 @@ + cflags-$(CONFIG_CPU_LOONGSON64) += -Wa,--trap + + # +-# Some versions of binutils, not currently mainline as of 2019/02/04, support +-# an -mfix-loongson3-llsc flag which emits a sync prior to each ll instruction +-# to work around a CPU bug (see __SYNC_loongson3_war in asm/sync.h for a +-# description). +-# +-# We disable this in order to prevent the assembler meddling with the +-# instruction that labels refer to, ie. if we label an ll instruction: +-# +-# 1: ll v0, 0(a0) +-# +-# ...then with the assembler fix applied the label may actually point at a sync +-# instruction inserted by the assembler, and if we were using the label in an +-# exception table the table would no longer contain the address of the ll +-# instruction. +-# +-# Avoid this by explicitly disabling that assembler behaviour. If upstream +-# binutils does not merge support for the flag then we can revisit & remove +-# this later - for now it ensures vendor toolchains don't cause problems. +-# +-cflags-$(CONFIG_CPU_LOONGSON64) += $(call as-option,-Wa$(comma)-mno-fix-loongson3-llsc,) +- +-# + # binutils from v2.25 on and gcc starting from v4.9.0 treat -march=loongson3a + # as MIPS64 R2; older versions as just R1. This leaves the possibility open + # that GCC might generate R2 code for -march=loongson3a which then is rejected diff --git a/queue-5.11/mips-vdso-use-clang_flags-instead-of-filtering-out-target.patch b/queue-5.11/mips-vdso-use-clang_flags-instead-of-filtering-out-target.patch new file mode 100644 index 00000000000..f35442f98ca --- /dev/null +++ b/queue-5.11/mips-vdso-use-clang_flags-instead-of-filtering-out-target.patch @@ -0,0 +1,63 @@ +From 76d7fff22be3e4185ee5f9da2eecbd8188e76b2c Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Fri, 15 Jan 2021 12:26:22 -0700 +Subject: MIPS: VDSO: Use CLANG_FLAGS instead of filtering out '--target=' + +From: Nathan Chancellor + +commit 76d7fff22be3e4185ee5f9da2eecbd8188e76b2c upstream. + +Commit ee67855ecd9d ("MIPS: vdso: Allow clang's --target flag in VDSO +cflags") allowed the '--target=' flag from the main Makefile to filter +through to the vDSO. However, it did not bring any of the other clang +specific flags for controlling the integrated assembler and the GNU +tools locations (--prefix=, --gcc-toolchain=, and -no-integrated-as). +Without these, we will get a warning (visible with tinyconfig): + +arch/mips/vdso/elf.S:14:1: warning: DWARF2 only supports one section per +compilation unit +.pushsection .note.Linux, "a",@note ; .balign 4 ; .long 2f - 1f ; .long +4484f - 3f ; .long 0 ; 1:.asciz "Linux" ; 2:.balign 4 ; 3: +^ +arch/mips/vdso/elf.S:34:2: warning: DWARF2 only supports one section per +compilation unit + .section .mips_abiflags, "a" + ^ + +All of these flags are bundled up under CLANG_FLAGS in the main Makefile +and exported so that they can be added to Makefiles that set their own +CFLAGS. Use this value instead of filtering out '--target=' so there is +no warning and all of the tools are properly used. + +Cc: stable@vger.kernel.org +Fixes: ee67855ecd9d ("MIPS: vdso: Allow clang's --target flag in VDSO cflags") +Link: https://github.com/ClangBuiltLinux/linux/issues/1256 +Reported-by: Anders Roxell +Signed-off-by: Nathan Chancellor +Tested-by: Anders Roxell +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/vdso/Makefile | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +--- a/arch/mips/vdso/Makefile ++++ b/arch/mips/vdso/Makefile +@@ -16,16 +16,13 @@ ccflags-vdso := \ + $(filter -march=%,$(KBUILD_CFLAGS)) \ + $(filter -m%-float,$(KBUILD_CFLAGS)) \ + $(filter -mno-loongson-%,$(KBUILD_CFLAGS)) \ ++ $(CLANG_FLAGS) \ + -D__VDSO__ + + ifndef CONFIG_64BIT + ccflags-vdso += -DBUILD_VDSO32 + endif + +-ifdef CONFIG_CC_IS_CLANG +-ccflags-vdso += $(filter --target=%,$(KBUILD_CFLAGS)) +-endif +- + # + # The -fno-jump-tables flag only prevents the compiler from generating + # jump tables but does not prevent the compiler from emitting absolute diff --git a/queue-5.11/misc-rtsx-init-of-rts522a-add-ocp-power-off-when-no-card-is-present.patch b/queue-5.11/misc-rtsx-init-of-rts522a-add-ocp-power-off-when-no-card-is-present.patch new file mode 100644 index 00000000000..4bebccd2843 --- /dev/null +++ b/queue-5.11/misc-rtsx-init-of-rts522a-add-ocp-power-off-when-no-card-is-present.patch @@ -0,0 +1,34 @@ +From 920fd8a70619074eac7687352c8f1c6f3c2a64a5 Mon Sep 17 00:00:00 2001 +From: Ricky Wu +Date: Thu, 4 Feb 2021 16:31:15 +0800 +Subject: misc: rtsx: init of rts522a add OCP power off when no card is present + +From: Ricky Wu + +commit 920fd8a70619074eac7687352c8f1c6f3c2a64a5 upstream. + +Power down OCP for power consumption +when no SD/MMC card is present + +Cc: stable@vger.kernel.org +Signed-off-by: Ricky Wu +Link: https://lore.kernel.org/r/20210204083115.9471-1-ricky_wu@realtek.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/cardreader/rts5227.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/drivers/misc/cardreader/rts5227.c ++++ b/drivers/misc/cardreader/rts5227.c +@@ -398,6 +398,11 @@ static int rts522a_extra_init_hw(struct + { + rts5227_extra_init_hw(pcr); + ++ /* Power down OCP for power consumption */ ++ if (!pcr->card_exist) ++ rtsx_pci_write_register(pcr, FPDCTL, OC_POWER_DOWN, ++ OC_POWER_DOWN); ++ + rtsx_pci_write_register(pcr, FUNC_FORCE_CTL, FUNC_FORCE_UPME_XMT_DBG, + FUNC_FORCE_UPME_XMT_DBG); + rtsx_pci_write_register(pcr, PCLK_CTL, 0x04, 0x04); diff --git a/queue-5.11/phy-lantiq-rcu-usb2-wait-after-clock-enable.patch b/queue-5.11/phy-lantiq-rcu-usb2-wait-after-clock-enable.patch new file mode 100644 index 00000000000..843aae772eb --- /dev/null +++ b/queue-5.11/phy-lantiq-rcu-usb2-wait-after-clock-enable.patch @@ -0,0 +1,49 @@ +From 36acd5e24e3000691fb8d1ee31cf959cb1582d35 Mon Sep 17 00:00:00 2001 +From: Mathias Kresin +Date: Thu, 7 Jan 2021 23:49:01 +0100 +Subject: phy: lantiq: rcu-usb2: wait after clock enable + +From: Mathias Kresin + +commit 36acd5e24e3000691fb8d1ee31cf959cb1582d35 upstream. + +Commit 65dc2e725286 ("usb: dwc2: Update Core Reset programming flow.") +revealed that the phy isn't ready immediately after enabling it's +clocks. The dwc2_check_core_version() fails and the dwc2 usb driver +errors out. + +Add a short delay to let the phy get up and running. There isn't any +documentation how much time is required, the value was chosen based on +tests. + +Signed-off-by: Mathias Kresin +Acked-by: Hauke Mehrtens +Acked-by: Martin Blumenstingl +Cc: # v5.7+ +Link: https://lore.kernel.org/r/20210107224901.2102479-1-dev@kresin.me +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/phy/lantiq/phy-lantiq-rcu-usb2.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +--- a/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c ++++ b/drivers/phy/lantiq/phy-lantiq-rcu-usb2.c +@@ -124,8 +124,16 @@ static int ltq_rcu_usb2_phy_power_on(str + reset_control_deassert(priv->phy_reset); + + ret = clk_prepare_enable(priv->phy_gate_clk); +- if (ret) ++ if (ret) { + dev_err(dev, "failed to enable PHY gate\n"); ++ return ret; ++ } ++ ++ /* ++ * at least the xrx200 usb2 phy requires some extra time to be ++ * operational after enabling the clock ++ */ ++ usleep_range(100, 200); + + return ret; + } diff --git a/queue-5.11/pstore-fix-typo-in-compression-option-name.patch b/queue-5.11/pstore-fix-typo-in-compression-option-name.patch new file mode 100644 index 00000000000..01d2ee35443 --- /dev/null +++ b/queue-5.11/pstore-fix-typo-in-compression-option-name.patch @@ -0,0 +1,47 @@ +From 19d8e9149c27b689c6224f5c84b96a159342195a Mon Sep 17 00:00:00 2001 +From: Jiri Bohac +Date: Thu, 18 Feb 2021 12:15:47 +0100 +Subject: pstore: Fix typo in compression option name + +From: Jiri Bohac + +commit 19d8e9149c27b689c6224f5c84b96a159342195a upstream. + +Both pstore_compress() and decompress_record() use a mistyped config +option name ("PSTORE_COMPRESSION" instead of "PSTORE_COMPRESS"). As +a result compression and decompression of pstore records was always +disabled. + +Use the correct config option name. + +Signed-off-by: Jiri Bohac +Fixes: fd49e03280e5 ("pstore: Fix linking when crypto API disabled") +Acked-by: Matteo Croce +Signed-off-by: Kees Cook +Cc: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20210218111547.johvp5klpv3xrpnn@dwarf.suse.cz +Signed-off-by: Greg Kroah-Hartman +--- + fs/pstore/platform.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/fs/pstore/platform.c ++++ b/fs/pstore/platform.c +@@ -269,7 +269,7 @@ static int pstore_compress(const void *i + { + int ret; + +- if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION)) ++ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESS)) + return -EINVAL; + + ret = crypto_comp_compress(tfm, in, inlen, out, &outlen); +@@ -671,7 +671,7 @@ static void decompress_record(struct pst + int unzipped_len; + char *unzipped, *workspace; + +- if (!IS_ENABLED(CONFIG_PSTORE_COMPRESSION) || !record->compressed) ++ if (!IS_ENABLED(CONFIG_PSTORE_COMPRESS) || !record->compressed) + return; + + /* Only PSTORE_TYPE_DMESG support compression. */ diff --git a/queue-5.11/revert-bcache-kill-btree_io_wq.patch b/queue-5.11/revert-bcache-kill-btree_io_wq.patch new file mode 100644 index 00000000000..b35504d12b6 --- /dev/null +++ b/queue-5.11/revert-bcache-kill-btree_io_wq.patch @@ -0,0 +1,115 @@ +From 9f233ffe02e5cef611100cd8c5bcf4de26ca7bef Mon Sep 17 00:00:00 2001 +From: Kai Krakow +Date: Wed, 10 Feb 2021 13:07:25 +0800 +Subject: Revert "bcache: Kill btree_io_wq" + +From: Kai Krakow + +commit 9f233ffe02e5cef611100cd8c5bcf4de26ca7bef upstream. + +This reverts commit 56b30770b27d54d68ad51eccc6d888282b568cee. + +With the btree using the `system_wq`, I seem to see a lot more desktop +latency than I should. + +After some more investigation, it looks like the original assumption +of 56b3077 no longer is true, and bcache has a very high potential of +congesting the `system_wq`. In turn, this introduces laggy desktop +performance, IO stalls (at least with btrfs), and input events may be +delayed. + +So let's revert this. It's important to note that the semantics of +using `system_wq` previously mean that `btree_io_wq` should be created +before and destroyed after other bcache wqs to keep the same +assumptions. + +Cc: Coly Li +Cc: stable@vger.kernel.org # 5.4+ +Signed-off-by: Kai Krakow +Signed-off-by: Coly Li +Signed-off-by: Jens Axboe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/md/bcache/bcache.h | 2 ++ + drivers/md/bcache/btree.c | 21 +++++++++++++++++++-- + drivers/md/bcache/super.c | 4 ++++ + 3 files changed, 25 insertions(+), 2 deletions(-) + +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -1042,5 +1042,7 @@ void bch_debug_exit(void); + void bch_debug_init(void); + void bch_request_exit(void); + int bch_request_init(void); ++void bch_btree_exit(void); ++int bch_btree_init(void); + + #endif /* _BCACHE_H */ +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -99,6 +99,8 @@ + #define PTR_HASH(c, k) \ + (((k)->ptr[0] >> c->bucket_bits) | PTR_GEN(k, 0)) + ++static struct workqueue_struct *btree_io_wq; ++ + #define insert_lock(s, b) ((b)->level <= (s)->lock) + + +@@ -308,7 +310,7 @@ static void __btree_node_write_done(stru + btree_complete_write(b, w); + + if (btree_node_dirty(b)) +- schedule_delayed_work(&b->work, 30 * HZ); ++ queue_delayed_work(btree_io_wq, &b->work, 30 * HZ); + + closure_return_with_destructor(cl, btree_node_write_unlock); + } +@@ -481,7 +483,7 @@ static void bch_btree_leaf_dirty(struct + BUG_ON(!i->keys); + + if (!btree_node_dirty(b)) +- schedule_delayed_work(&b->work, 30 * HZ); ++ queue_delayed_work(btree_io_wq, &b->work, 30 * HZ); + + set_btree_node_dirty(b); + +@@ -2764,3 +2766,18 @@ void bch_keybuf_init(struct keybuf *buf) + spin_lock_init(&buf->lock); + array_allocator_init(&buf->freelist); + } ++ ++void bch_btree_exit(void) ++{ ++ if (btree_io_wq) ++ destroy_workqueue(btree_io_wq); ++} ++ ++int __init bch_btree_init(void) ++{ ++ btree_io_wq = create_singlethread_workqueue("bch_btree_io"); ++ if (!btree_io_wq) ++ return -ENOMEM; ++ ++ return 0; ++} +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -2821,6 +2821,7 @@ static void bcache_exit(void) + destroy_workqueue(bcache_wq); + if (bch_journal_wq) + destroy_workqueue(bch_journal_wq); ++ bch_btree_exit(); + + if (bcache_major) + unregister_blkdev(bcache_major, "bcache"); +@@ -2876,6 +2877,9 @@ static int __init bcache_init(void) + return bcache_major; + } + ++ if (bch_btree_init()) ++ goto err; ++ + bcache_wq = alloc_workqueue("bcache", WQ_MEM_RECLAIM, 0); + if (!bcache_wq) + goto err; diff --git a/queue-5.11/revert-drm-amd-display-reuse-current-context-instead-of-recreating-one.patch b/queue-5.11/revert-drm-amd-display-reuse-current-context-instead-of-recreating-one.patch new file mode 100644 index 00000000000..132e98b0b84 --- /dev/null +++ b/queue-5.11/revert-drm-amd-display-reuse-current-context-instead-of-recreating-one.patch @@ -0,0 +1,179 @@ +From efc8278eecfd5e6fa36c5d41e71d038f534fe107 Mon Sep 17 00:00:00 2001 +From: Anson Jacob +Date: Thu, 18 Feb 2021 19:42:57 -0500 +Subject: Revert "drm/amd/display: reuse current context instead of recreating one" + +From: Anson Jacob + +commit efc8278eecfd5e6fa36c5d41e71d038f534fe107 upstream. + +This reverts commit 8866a67ab86cc0812e65c04f1ef02bcc41e24d68. + +Reason for revert: This breaks hotplug of HDMI on some systems, +resulting in a blank screen. Caused general hangs on boot/hotplugs. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1487 +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1492 +Bug: https://bugzilla.kernel.org/show_bug.cgi?id=211649 +Signed-off-by: Anson Jacob +Reviewed-by: Bhawanpreet Lakha +Acked-by: Alex Deucher +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 23 ++++++++++-------- + drivers/gpu/drm/amd/display/dc/core/dc.c | 27 ++++++---------------- + drivers/gpu/drm/amd/display/dc/dc_stream.h | 3 +- + 3 files changed, 23 insertions(+), 30 deletions(-) + +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -1934,7 +1934,7 @@ static void dm_gpureset_commit_state(str + dc_commit_updates_for_stream( + dm->dc, bundle->surface_updates, + dc_state->stream_status->plane_count, +- dc_state->streams[k], &bundle->stream_update); ++ dc_state->streams[k], &bundle->stream_update, dc_state); + } + + cleanup: +@@ -1965,7 +1965,8 @@ static void dm_set_dpms_off(struct dc_li + + stream_update.stream = stream_state; + dc_commit_updates_for_stream(stream_state->ctx->dc, NULL, 0, +- stream_state, &stream_update); ++ stream_state, &stream_update, ++ stream_state->ctx->dc->current_state); + mutex_unlock(&adev->dm.dc_lock); + } + +@@ -7548,7 +7549,7 @@ static void amdgpu_dm_commit_planes(stru + struct drm_crtc *pcrtc, + bool wait_for_vblank) + { +- int i; ++ uint32_t i; + uint64_t timestamp_ns; + struct drm_plane *plane; + struct drm_plane_state *old_plane_state, *new_plane_state; +@@ -7589,7 +7590,7 @@ static void amdgpu_dm_commit_planes(stru + amdgpu_dm_commit_cursors(state); + + /* update planes when needed */ +- for_each_oldnew_plane_in_state_reverse(state, plane, old_plane_state, new_plane_state, i) { ++ for_each_oldnew_plane_in_state(state, plane, old_plane_state, new_plane_state, i) { + struct drm_crtc *crtc = new_plane_state->crtc; + struct drm_crtc_state *new_crtc_state; + struct drm_framebuffer *fb = new_plane_state->fb; +@@ -7812,7 +7813,8 @@ static void amdgpu_dm_commit_planes(stru + bundle->surface_updates, + planes_count, + acrtc_state->stream, +- &bundle->stream_update); ++ &bundle->stream_update, ++ dc_state); + + /** + * Enable or disable the interrupts on the backend. +@@ -8148,13 +8150,13 @@ static void amdgpu_dm_atomic_commit_tail + struct dm_connector_state *dm_new_con_state = to_dm_connector_state(new_con_state); + struct dm_connector_state *dm_old_con_state = to_dm_connector_state(old_con_state); + struct amdgpu_crtc *acrtc = to_amdgpu_crtc(dm_new_con_state->base.crtc); +- struct dc_surface_update surface_updates[MAX_SURFACES]; ++ struct dc_surface_update dummy_updates[MAX_SURFACES]; + struct dc_stream_update stream_update; + struct dc_info_packet hdr_packet; + struct dc_stream_status *status = NULL; + bool abm_changed, hdr_changed, scaling_changed; + +- memset(&surface_updates, 0, sizeof(surface_updates)); ++ memset(&dummy_updates, 0, sizeof(dummy_updates)); + memset(&stream_update, 0, sizeof(stream_update)); + + if (acrtc) { +@@ -8211,15 +8213,16 @@ static void amdgpu_dm_atomic_commit_tail + * To fix this, DC should permit updating only stream properties. + */ + for (j = 0; j < status->plane_count; j++) +- surface_updates[j].surface = status->plane_states[j]; ++ dummy_updates[j].surface = status->plane_states[0]; + + + mutex_lock(&dm->dc_lock); + dc_commit_updates_for_stream(dm->dc, +- surface_updates, ++ dummy_updates, + status->plane_count, + dm_new_crtc_state->stream, +- &stream_update); ++ &stream_update, ++ dc_state); + mutex_unlock(&dm->dc_lock); + } + +--- a/drivers/gpu/drm/amd/display/dc/core/dc.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc.c +@@ -2679,7 +2679,8 @@ void dc_commit_updates_for_stream(struct + struct dc_surface_update *srf_updates, + int surface_count, + struct dc_stream_state *stream, +- struct dc_stream_update *stream_update) ++ struct dc_stream_update *stream_update, ++ struct dc_state *state) + { + const struct dc_stream_status *stream_status; + enum surface_update_type update_type; +@@ -2698,12 +2699,6 @@ void dc_commit_updates_for_stream(struct + + + if (update_type >= UPDATE_TYPE_FULL) { +- struct dc_plane_state *new_planes[MAX_SURFACES]; +- +- memset(new_planes, 0, sizeof(new_planes)); +- +- for (i = 0; i < surface_count; i++) +- new_planes[i] = srf_updates[i].surface; + + /* initialize scratch memory for building context */ + context = dc_create_state(dc); +@@ -2712,21 +2707,15 @@ void dc_commit_updates_for_stream(struct + return; + } + +- dc_resource_state_copy_construct( +- dc->current_state, context); ++ dc_resource_state_copy_construct(state, context); + +- /*remove old surfaces from context */ +- if (!dc_rem_all_planes_for_stream(dc, stream, context)) { +- DC_ERROR("Failed to remove streams for new validate context!\n"); +- return; +- } ++ for (i = 0; i < dc->res_pool->pipe_count; i++) { ++ struct pipe_ctx *new_pipe = &context->res_ctx.pipe_ctx[i]; ++ struct pipe_ctx *old_pipe = &dc->current_state->res_ctx.pipe_ctx[i]; + +- /* add surface to context */ +- if (!dc_add_all_planes_for_stream(dc, stream, new_planes, surface_count, context)) { +- DC_ERROR("Failed to add streams for new validate context!\n"); +- return; ++ if (new_pipe->plane_state && new_pipe->plane_state != old_pipe->plane_state) ++ new_pipe->plane_state->force_full_update = true; + } +- + } + + +--- a/drivers/gpu/drm/amd/display/dc/dc_stream.h ++++ b/drivers/gpu/drm/amd/display/dc/dc_stream.h +@@ -283,7 +283,8 @@ void dc_commit_updates_for_stream(struct + struct dc_surface_update *srf_updates, + int surface_count, + struct dc_stream_state *stream, +- struct dc_stream_update *stream_update); ++ struct dc_stream_update *stream_update, ++ struct dc_state *state); + /* + * Log the current stream state. + */ diff --git a/queue-5.11/revert-drm-amd-display-update-nv1x-sr-latency-values.patch b/queue-5.11/revert-drm-amd-display-update-nv1x-sr-latency-values.patch new file mode 100644 index 00000000000..c7f33fdabfc --- /dev/null +++ b/queue-5.11/revert-drm-amd-display-update-nv1x-sr-latency-values.patch @@ -0,0 +1,38 @@ +From 910f1601addae3e430fc7d3cd589d7622c5df693 Mon Sep 17 00:00:00 2001 +From: Alex Deucher +Date: Wed, 3 Feb 2021 14:03:50 -0500 +Subject: Revert "drm/amd/display: Update NV1x SR latency values" + +From: Alex Deucher + +commit 910f1601addae3e430fc7d3cd589d7622c5df693 upstream. + +This reverts commit 4a3dea8932d3b1199680d2056dd91d31d94d70b7. + +This causes blank screens for some users. + +Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1388 +Cc: Alvin Lee +Cc: Jun Lei +Cc: Rodrigo Siqueira +Reviewed-by: Rodrigo Siqueira +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_resource.c +@@ -408,8 +408,8 @@ static struct _vcs_dpi_soc_bounding_box_ + }, + }, + .num_states = 5, +- .sr_exit_time_us = 11.6, +- .sr_enter_plus_exit_time_us = 13.9, ++ .sr_exit_time_us = 8.6, ++ .sr_enter_plus_exit_time_us = 10.9, + .urgent_latency_us = 4.0, + .urgent_latency_pixel_data_only_us = 4.0, + .urgent_latency_pixel_mixed_with_vm_data_us = 4.0, diff --git a/queue-5.11/revert-mips-octeon-remove-special-handling-of-config_mips_elf_appended_dtb-y.patch b/queue-5.11/revert-mips-octeon-remove-special-handling-of-config_mips_elf_appended_dtb-y.patch new file mode 100644 index 00000000000..1d9c986fbb2 --- /dev/null +++ b/queue-5.11/revert-mips-octeon-remove-special-handling-of-config_mips_elf_appended_dtb-y.patch @@ -0,0 +1,51 @@ +From fe82de91af83a9212b6c704b1ce6cf6d129a108b Mon Sep 17 00:00:00 2001 +From: Kevin Hao +Date: Tue, 19 Jan 2021 19:15:31 +0800 +Subject: Revert "MIPS: Octeon: Remove special handling of CONFIG_MIPS_ELF_APPENDED_DTB=y" + +From: Kevin Hao + +commit fe82de91af83a9212b6c704b1ce6cf6d129a108b upstream. + +This reverts commit d9df9fb901d25b941ab2cfb5b570d91fb2abf7a3. + +For the OCTEON boards, it need to patch the built-in DTB before using +it. Previously it judges if it is a built-in DTB by checking +fw_passed_dtb. But after commit 37e5c69ffd41 ("MIPS: head.S: Init +fw_passed_dtb to builtin DTB", the fw_passed_dtb is initialized even +when using built-in DTB. This causes the OCTEON boards boot broken due +to an unpatched built-in DTB is used. Revert the commit d9df9fb901d2 to +restore the codes before the fw_passed_dtb is used and then fix this +issue. + +Fixed: 37e5c69ffd41 ("MIPS: head.S: Init fw_passed_dtb to builtin DTB") +Cc: stable@vger.kernel.org +Suggested-by: Thomas Bogendoerfer +Signed-off-by: Kevin Hao +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/cavium-octeon/setup.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +--- a/arch/mips/cavium-octeon/setup.c ++++ b/arch/mips/cavium-octeon/setup.c +@@ -1149,12 +1149,15 @@ void __init device_tree_init(void) + bool do_prune; + bool fill_mac; + +- if (fw_passed_dtb) { +- fdt = (void *)fw_passed_dtb; ++#ifdef CONFIG_MIPS_ELF_APPENDED_DTB ++ if (!fdt_check_header(&__appended_dtb)) { ++ fdt = &__appended_dtb; + do_prune = false; + fill_mac = true; + pr_info("Using appended Device Tree.\n"); +- } else if (octeon_bootinfo->minor_version >= 3 && octeon_bootinfo->fdt_addr) { ++ } else ++#endif ++ if (octeon_bootinfo->minor_version >= 3 && octeon_bootinfo->fdt_addr) { + fdt = phys_to_virt(octeon_bootinfo->fdt_addr); + if (fdt_check_header(fdt)) + panic("Corrupt Device Tree passed to kernel."); diff --git a/queue-5.11/scsi-sd-fix-opal-support.patch b/queue-5.11/scsi-sd-fix-opal-support.patch new file mode 100644 index 00000000000..92b42f61599 --- /dev/null +++ b/queue-5.11/scsi-sd-fix-opal-support.patch @@ -0,0 +1,50 @@ +From aaf15f8c6de932861f1fce6aeec6a89ac0e354b6 Mon Sep 17 00:00:00 2001 +From: Bart Van Assche +Date: Sun, 21 Feb 2021 18:10:42 -0800 +Subject: scsi: sd: Fix Opal support + +From: Bart Van Assche + +commit aaf15f8c6de932861f1fce6aeec6a89ac0e354b6 upstream. + +The SCSI core has been modified recently such that it only processes PM +requests if rpm_status != RPM_ACTIVE. Since some Opal requests are +submitted while rpm_status != RPM_ACTIVE, set flag RQF_PM for Opal +requests. + +See also https://bugzilla.kernel.org/show_bug.cgi?id=211227. + +[mkp: updated sha for PM patch] + +Link: https://lore.kernel.org/r/20210222021042.3534-1-bvanassche@acm.org +Fixes: d80210f25ff0 ("sd: add support for TCG OPAL self encrypting disks") +Fixes: e6044f714b25 ("scsi: core: Only process PM requests if rpm_status != RPM_ACTIVE") +Cc: chriscjsus@yahoo.com +Cc: Jens Axboe +Cc: Alan Stern +Cc: stable@vger.kernel.org +Reported-by: chriscjsus@yahoo.com +Tested-by: chriscjsus@yahoo.com +Reviewed-by: Christoph Hellwig +Signed-off-by: Bart Van Assche +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/sd.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -707,9 +707,9 @@ static int sd_sec_submit(void *data, u16 + put_unaligned_be16(spsp, &cdb[2]); + put_unaligned_be32(len, &cdb[6]); + +- ret = scsi_execute_req(sdev, cdb, +- send ? DMA_TO_DEVICE : DMA_FROM_DEVICE, +- buffer, len, NULL, SD_TIMEOUT, sdkp->max_retries, NULL); ++ ret = scsi_execute(sdev, cdb, send ? DMA_TO_DEVICE : DMA_FROM_DEVICE, ++ buffer, len, NULL, NULL, SD_TIMEOUT, sdkp->max_retries, 0, ++ RQF_PM, NULL); + return ret <= 0 ? ret : -EIO; + } + #endif /* CONFIG_BLK_SED_OPAL */ diff --git a/queue-5.11/seccomp-add-missing-return-in-non-void-function.patch b/queue-5.11/seccomp-add-missing-return-in-non-void-function.patch new file mode 100644 index 00000000000..d76d4a465b1 --- /dev/null +++ b/queue-5.11/seccomp-add-missing-return-in-non-void-function.patch @@ -0,0 +1,34 @@ +From 04b38d012556199ba4c31195940160e0c44c64f0 Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Mon, 11 Jan 2021 17:28:39 +0000 +Subject: seccomp: Add missing return in non-void function + +From: Paul Cercueil + +commit 04b38d012556199ba4c31195940160e0c44c64f0 upstream. + +We don't actually care about the value, since the kernel will panic +before that; but a value should nonetheless be returned, otherwise the +compiler will complain. + +Fixes: 8112c4f140fa ("seccomp: remove 2-phase API") +Cc: stable@vger.kernel.org # 4.7+ +Signed-off-by: Paul Cercueil +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20210111172839.640914-1-paul@crapouillou.net +Signed-off-by: Greg Kroah-Hartman +--- + kernel/seccomp.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -1284,6 +1284,8 @@ static int __seccomp_filter(int this_sys + const bool recheck_after_trace) + { + BUG(); ++ ++ return -1; + } + #endif + diff --git a/queue-5.11/selinux-fix-inconsistency-between-inode_getxattr-and-inode_listsecurity.patch b/queue-5.11/selinux-fix-inconsistency-between-inode_getxattr-and-inode_listsecurity.patch new file mode 100644 index 00000000000..5064054ed6e --- /dev/null +++ b/queue-5.11/selinux-fix-inconsistency-between-inode_getxattr-and-inode_listsecurity.patch @@ -0,0 +1,52 @@ +From a9ffe682c58aaff643764547f5420e978b6e0830 Mon Sep 17 00:00:00 2001 +From: Amir Goldstein +Date: Sat, 19 Dec 2020 12:05:27 +0200 +Subject: selinux: fix inconsistency between inode_getxattr and inode_listsecurity + +From: Amir Goldstein + +commit a9ffe682c58aaff643764547f5420e978b6e0830 upstream. + +When inode has no listxattr op of its own (e.g. squashfs) vfs_listxattr +calls the LSM inode_listsecurity hooks to list the xattrs that LSMs will +intercept in inode_getxattr hooks. + +When selinux LSM is installed but not initialized, it will list the +security.selinux xattr in inode_listsecurity, but will not intercept it +in inode_getxattr. This results in -ENODATA for a getxattr call for an +xattr returned by listxattr. + +This situation was manifested as overlayfs failure to copy up lower +files from squashfs when selinux is built-in but not initialized, +because ovl_copy_xattr() iterates the lower inode xattrs by +vfs_listxattr() and vfs_getxattr(). + +Match the logic of inode_listsecurity to that of inode_getxattr and +do not list the security.selinux xattr if selinux is not initialized. + +Reported-by: Michael Labriola +Tested-by: Michael Labriola +Link: https://lore.kernel.org/linux-unionfs/2nv9d47zt7.fsf@aldarion.sourceruckus.org/ +Fixes: c8e222616c7e ("selinux: allow reading labels before policy is loaded") +Cc: stable@vger.kernel.org#v5.9+ +Signed-off-by: Amir Goldstein +Reviewed-by: Ondrej Mosnacek +Signed-off-by: Paul Moore +Signed-off-by: Greg Kroah-Hartman +--- + security/selinux/hooks.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -3413,6 +3413,10 @@ static int selinux_inode_setsecurity(str + static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size) + { + const int len = sizeof(XATTR_NAME_SELINUX); ++ ++ if (!selinux_initialized(&selinux_state)) ++ return 0; ++ + if (buffer && len <= buffer_size) + memcpy(buffer, XATTR_NAME_SELINUX, len); + return len; diff --git a/queue-5.11/series b/queue-5.11/series index c157ca9f73c..a00154e591b 100644 --- a/queue-5.11/series +++ b/queue-5.11/series @@ -568,3 +568,96 @@ scsi-sd-sd_zbc-don-t-pass-gfp_noio-to-kvcalloc.patch block-reopen-the-device-in-blkdev_reread_part.patch block-fix-logging-on-capacity-change.patch ide-falconide-fix-module-unload.patch +scsi-sd-fix-opal-support.patch +blk-settings-align-max_sectors-on-logical_block_size-boundary.patch +soundwire-intel-fix-possible-crash-when-no-device-is-detected.patch +acpi-property-fix-fwnode-string-properties-matching.patch +acpi-configfs-add-missing-check-after-configfs_register_default_group.patch +cpufreq-acpi-set-cpuinfo.max_freq-directly-if-max-boost-is-known.patch +hid-logitech-dj-add-support-for-keyboard-events-in-equad-step-4-gaming.patch +hid-wacom-ignore-attempts-to-overwrite-the-touch_max-value-from-hid.patch +input-raydium_ts_i2c-do-not-send-zero-length.patch +input-xpad-add-support-for-powera-enhanced-wired-controller-for-xbox-series-x-s.patch +input-joydev-prevent-potential-read-overflow-in-ioctl.patch +input-i8042-add-asus-zenbook-flip-to-noselftest-list.patch +media-mceusb-fix-potential-out-of-bounds-shift.patch +usb-serial-option-update-interface-mapping-for-zte-p685m.patch +usb-musb-fix-runtime-pm-race-in-musb_queue_resume_work.patch +usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch +usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch +usb-serial-ftdi_sio-fix-ftx-sub-integer-prescaler.patch +usb-serial-pl2303-fix-line-speed-handling-on-newer-chips.patch +usb-serial-mos7840-fix-error-code-in-mos7840_write.patch +usb-serial-mos7720-fix-error-code-in-mos7720_write.patch +phy-lantiq-rcu-usb2-wait-after-clock-enable.patch +alsa-usb-audio-correct-document-for-snd_usb_endpoint_free_all.patch +alsa-usb-audio-handle-invalid-running-state-at-releasing-ep.patch +alsa-usb-audio-more-strict-state-change-in-ep.patch +alsa-usb-audio-don-t-avoid-stopping-the-stream-at-disconnection.patch +alsa-usb-audio-add-implicit-fb-quirk-for-boss-gp-10.patch +alsa-fireface-fix-to-parse-sync-status-register-of-latter-protocol.patch +alsa-hda-add-another-cometlake-h-pci-id.patch +alsa-hda-hdmi-drop-bogus-check-at-closing-a-stream.patch +alsa-hda-realtek-modify-eapd-in-the-alc886.patch +alsa-hda-realtek-quirk-for-hp-spectre-x360-14-amp-setup.patch +mips-ingenic-disable-hptlb-for-d0-xburst-cpus-too.patch +mips-support-binutils-configured-with-enable-mips-fix-loongson3-llsc-yes.patch +mips-vdso-use-clang_flags-instead-of-filtering-out-target.patch +revert-mips-octeon-remove-special-handling-of-config_mips_elf_appended_dtb-y.patch +mips-compressed-fix-build-with-enabled-ubsan.patch +revert-bcache-kill-btree_io_wq.patch +bcache-give-btree_io_wq-correct-semantics-again.patch +bcache-move-journal-work-to-new-flush-wq.patch +revert-drm-amd-display-update-nv1x-sr-latency-values.patch +drm-amd-display-add-fpu-wrappers-to-dcn21_validate_bandwidth.patch +drm-amd-display-remove-assert-from-dcn10_get_dig_frontend.patch +drm-amd-display-add-vupdate_no_lock-interrupts-for-dcn2.1.patch +revert-drm-amd-display-reuse-current-context-instead-of-recreating-one.patch +drm-amdkfd-fix-recursive-lock-warnings.patch +drm-amdgpu-fix-cgts_tcc_disable-register-offset-on-gfx10.3.patch +drm-amdgpu-set-reference-clock-to-100mhz-on-renoir-v2.patch +drm-amdgpu-fix-shutdown-and-poweroff-process-failed-with-s0ix.patch +drm-ttm-fix-a-memory-leak.patch +drm-nouveau-kms-handle-mdp-connectors.patch +drm-modes-switch-to-64bit-maths-to-avoid-integer-overflow.patch +drm-sched-cancel-and-flush-all-outstanding-jobs-before-finish.patch +drm-panel-kd35t133-allow-using-non-continuous-dsi-clock.patch +drm-rockchip-require-the-ytr-modifier-for-afbc.patch +asoc-siu-fix-build-error-by-a-wrong-const-prefix.patch +selinux-fix-inconsistency-between-inode_getxattr-and-inode_listsecurity.patch +erofs-initialized-fields-can-only-be-observed-after-bit-is-set.patch +tpm_tis-fix-check_locality-for-correct-locality-acquisition.patch +tpm_tis-clean-up-locality-release.patch +keys-trusted-fix-incorrect-handling-of-tpm_get_random.patch +keys-trusted-fix-migratable-1-failing.patch +keys-trusted-reserve-tpm-for-seal-and-unseal-operations.patch +btrfs-do-not-cleanup-upper-nodes-in-btrfs_backref_cleanup_node.patch +btrfs-do-not-warn-if-we-can-t-find-the-reloc-root-when-looking-up-backref.patch +btrfs-add-asserts-for-deleting-backref-cache-nodes.patch +btrfs-abort-the-transaction-if-we-fail-to-inc-ref-in-btrfs_copy_root.patch +btrfs-fix-reloc-root-leak-with-0-ref-reloc-roots-on-recovery.patch +btrfs-splice-remaining-dirty_bg-s-onto-the-transaction-dirty-bg-list.patch +btrfs-handle-space_info-total_bytes_pinned-inside-the-delayed-ref-itself.patch +btrfs-account-for-new-extents-being-deleted-in-total_bytes_pinned.patch +btrfs-fix-extent-buffer-leak-on-failure-to-copy-root.patch +drm-i915-gt-flush-before-changing-register-state.patch +drm-i915-gt-correct-surface-base-address-for-renderclear.patch +crypto-arm64-sha-add-missing-module-aliases.patch +crypto-aesni-prevent-misaligned-buffers-on-the-stack.patch +crypto-michael_mic-fix-broken-misalignment-handling.patch +crypto-sun4i-ss-checking-sg-length-is-not-sufficient.patch +crypto-sun4i-ss-iv-register-does-not-work-on-a10-and-a13.patch +crypto-sun4i-ss-handle-bigendian-for-cipher.patch +crypto-sun4i-ss-initialize-need_fallback.patch +soc-samsung-exynos-asv-don-t-defer-early-on-not-supported-socs.patch +soc-samsung-exynos-asv-handle-reading-revision-register-error.patch +seccomp-add-missing-return-in-non-void-function.patch +arm64-ptrace-fix-seccomp-of-traced-syscall-1-no_syscall.patch +misc-rtsx-init-of-rts522a-add-ocp-power-off-when-no-card-is-present.patch +drivers-misc-vmw_vmci-restrict-too-big-queue-size-in-qp_host_alloc_queue.patch +pstore-fix-typo-in-compression-option-name.patch +dts64-mt7622-fix-slow-sd-card-access.patch +arm64-dts-agilex-fix-phy-interface-bit-shift-for-gmac1-and-gmac2.patch +staging-mt7621-dma-mtk-hsdma.c-hsdma-mt7621.c.patch +staging-gdm724x-fix-dma-from-stack.patch +staging-rtl8188eu-add-edimax-ew-7811un-v2-to-device-table.patch diff --git a/queue-5.11/soc-samsung-exynos-asv-don-t-defer-early-on-not-supported-socs.patch b/queue-5.11/soc-samsung-exynos-asv-don-t-defer-early-on-not-supported-socs.patch new file mode 100644 index 00000000000..0a82c505e83 --- /dev/null +++ b/queue-5.11/soc-samsung-exynos-asv-don-t-defer-early-on-not-supported-socs.patch @@ -0,0 +1,50 @@ +From 0458b88267c637fb872b0359da9ff0b243081e9e Mon Sep 17 00:00:00 2001 +From: Marek Szyprowski +Date: Mon, 7 Dec 2020 20:05:14 +0100 +Subject: soc: samsung: exynos-asv: don't defer early on not-supported SoCs + +From: Marek Szyprowski + +commit 0458b88267c637fb872b0359da9ff0b243081e9e upstream. + +Check if the SoC is really supported before gathering the needed +resources. This fixes endless deferred probe on some SoCs other than +Exynos5422 (like Exynos5410). + +Fixes: 5ea428595cc5 ("soc: samsung: Add Exynos Adaptive Supply Voltage driver") +Cc: +Signed-off-by: Marek Szyprowski +Reviewed-by: Pankaj Dubey +Link: https://lore.kernel.org/r/20201207190517.262051-2-krzk@kernel.org +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/samsung/exynos-asv.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/soc/samsung/exynos-asv.c ++++ b/drivers/soc/samsung/exynos-asv.c +@@ -119,11 +119,6 @@ static int exynos_asv_probe(struct platf + u32 product_id = 0; + int ret, i; + +- cpu_dev = get_cpu_device(0); +- ret = dev_pm_opp_get_opp_count(cpu_dev); +- if (ret < 0) +- return -EPROBE_DEFER; +- + asv = devm_kzalloc(&pdev->dev, sizeof(*asv), GFP_KERNEL); + if (!asv) + return -ENOMEM; +@@ -144,6 +139,11 @@ static int exynos_asv_probe(struct platf + return -ENODEV; + } + ++ cpu_dev = get_cpu_device(0); ++ ret = dev_pm_opp_get_opp_count(cpu_dev); ++ if (ret < 0) ++ return -EPROBE_DEFER; ++ + ret = of_property_read_u32(pdev->dev.of_node, "samsung,asv-bin", + &asv->of_bin); + if (ret < 0) diff --git a/queue-5.11/soc-samsung-exynos-asv-handle-reading-revision-register-error.patch b/queue-5.11/soc-samsung-exynos-asv-handle-reading-revision-register-error.patch new file mode 100644 index 00000000000..c32230e333a --- /dev/null +++ b/queue-5.11/soc-samsung-exynos-asv-handle-reading-revision-register-error.patch @@ -0,0 +1,40 @@ +From 4561560dfb4f847a0b327d48bdd1f45bf1b6261f Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Mon, 7 Dec 2020 20:05:15 +0100 +Subject: soc: samsung: exynos-asv: handle reading revision register error + +From: Krzysztof Kozlowski + +commit 4561560dfb4f847a0b327d48bdd1f45bf1b6261f upstream. + +If regmap_read() fails, the product_id local variable will contain +random value from the stack. Do not try to parse such value and fail +the ASV driver probe. + +Fixes: 5ea428595cc5 ("soc: samsung: Add Exynos Adaptive Supply Voltage driver") +Cc: +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Pankaj Dubey +Link: https://lore.kernel.org/r/20201207190517.262051-3-krzk@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/samsung/exynos-asv.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/soc/samsung/exynos-asv.c ++++ b/drivers/soc/samsung/exynos-asv.c +@@ -129,7 +129,13 @@ static int exynos_asv_probe(struct platf + return PTR_ERR(asv->chipid_regmap); + } + +- regmap_read(asv->chipid_regmap, EXYNOS_CHIPID_REG_PRO_ID, &product_id); ++ ret = regmap_read(asv->chipid_regmap, EXYNOS_CHIPID_REG_PRO_ID, ++ &product_id); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "Cannot read revision from ChipID: %d\n", ++ ret); ++ return -ENODEV; ++ } + + switch (product_id & EXYNOS_MASK) { + case 0xE5422000: diff --git a/queue-5.11/soundwire-intel-fix-possible-crash-when-no-device-is-detected.patch b/queue-5.11/soundwire-intel-fix-possible-crash-when-no-device-is-detected.patch new file mode 100644 index 00000000000..0b715e10eec --- /dev/null +++ b/queue-5.11/soundwire-intel-fix-possible-crash-when-no-device-is-detected.patch @@ -0,0 +1,100 @@ +From 957e3f797917b36355766807b1d8a54a1ba0cfc9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Marcin=20=C5=9Alusarz?= +Date: Mon, 8 Feb 2021 13:01:03 +0100 +Subject: soundwire: intel: fix possible crash when no device is detected +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marcin Ślusarz + +commit 957e3f797917b36355766807b1d8a54a1ba0cfc9 upstream. + +acpi_walk_namespace can return success without executing our +callback which initializes info->handle. +If the random value in this structure is a valid address (which +is on the stack, so it's quite possible), then nothing bad will +happen, because: +sdw_intel_scan_controller + -> acpi_bus_get_device + -> acpi_get_device_data + -> acpi_get_data_full + -> acpi_ns_validate_handle +will reject this handle. + +However, if the value from the stack doesn't point to a valid +address, we get this: + +BUG: kernel NULL pointer dereference, address: 0000000000000050 +PGD 0 P4D 0 +Oops: 0000 [#1] SMP NOPTI +CPU: 6 PID: 472 Comm: systemd-udevd Tainted: G W 5.10.0-1-amd64 #1 Debian 5.10.4-1 +Hardware name: HP HP Pavilion Laptop 15-cs3xxx/86E2, BIOS F.05 01/01/2020 +RIP: 0010:acpi_ns_validate_handle+0x1a/0x23 +Code: 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 44 00 00 48 8d 57 ff 48 89 f8 48 83 fa fd 76 08 48 8b 05 0c b8 67 01 c3 <80> 7f 08 0f 74 02 31 c0 c3 0f 1f 44 00 00 48 8b 3d f6 b7 67 01 e8 +RSP: 0000:ffffc388807c7b20 EFLAGS: 00010213 +RAX: 0000000000000048 RBX: ffffc388807c7b70 RCX: 0000000000000000 +RDX: 0000000000000047 RSI: 0000000000000246 RDI: 0000000000000048 +RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 +R10: ffffffffc0f5f4d1 R11: ffffffff8f0cb268 R12: 0000000000001001 +R13: ffffffff8e33b160 R14: 0000000000000048 R15: 0000000000000000 +FS: 00007f24548288c0(0000) GS:ffff9f781fb80000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 0000000000000050 CR3: 0000000106158004 CR4: 0000000000770ee0 +PKRU: 55555554 +Call Trace: + acpi_get_data_full+0x4d/0x92 + acpi_bus_get_device+0x1f/0x40 + sdw_intel_acpi_scan+0x59/0x230 [soundwire_intel] + ? strstr+0x22/0x60 + ? dmi_matches+0x76/0xe0 + snd_intel_dsp_driver_probe.cold+0xaf/0x163 [snd_intel_dspcfg] + azx_probe+0x7a/0x970 [snd_hda_intel] + local_pci_probe+0x42/0x80 + ? _cond_resched+0x16/0x40 + pci_device_probe+0xfd/0x1b0 + really_probe+0x205/0x460 + driver_probe_device+0xe1/0x150 + device_driver_attach+0xa1/0xb0 + __driver_attach+0x8a/0x150 + ? device_driver_attach+0xb0/0xb0 + ? device_driver_attach+0xb0/0xb0 + bus_for_each_dev+0x78/0xc0 + bus_add_driver+0x12b/0x1e0 + driver_register+0x8b/0xe0 + ? 0xffffffffc0f65000 + do_one_initcall+0x44/0x1d0 + ? do_init_module+0x23/0x250 + ? kmem_cache_alloc_trace+0xf5/0x200 + do_init_module+0x5c/0x250 + __do_sys_finit_module+0xb1/0x110 + do_syscall_64+0x33/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Signed-off-by: Marcin Ślusarz +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Rafael J. Wysocki +CC: stable@vger.kernel.org +Link: https://lore.kernel.org/r/20210208120104.204761-1-marcin.slusarz@gmail.com +Signed-off-by: Vinod Koul +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soundwire/intel_init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/soundwire/intel_init.c ++++ b/drivers/soundwire/intel_init.c +@@ -405,11 +405,12 @@ int sdw_intel_acpi_scan(acpi_handle *par + { + acpi_status status; + ++ info->handle = NULL; + status = acpi_walk_namespace(ACPI_TYPE_DEVICE, + parent_handle, 1, + sdw_intel_acpi_cb, + NULL, info, NULL); +- if (ACPI_FAILURE(status)) ++ if (ACPI_FAILURE(status) || info->handle == NULL) + return -ENODEV; + + return sdw_intel_scan_controller(info); diff --git a/queue-5.11/staging-gdm724x-fix-dma-from-stack.patch b/queue-5.11/staging-gdm724x-fix-dma-from-stack.patch new file mode 100644 index 00000000000..7af77266fe5 --- /dev/null +++ b/queue-5.11/staging-gdm724x-fix-dma-from-stack.patch @@ -0,0 +1,52 @@ +From 7c3a0635cd008eaca9a734dc802709ee0b81cac5 Mon Sep 17 00:00:00 2001 +From: Amey Narkhede +Date: Thu, 11 Feb 2021 11:08:19 +0530 +Subject: staging: gdm724x: Fix DMA from stack + +From: Amey Narkhede + +commit 7c3a0635cd008eaca9a734dc802709ee0b81cac5 upstream. + +Stack allocated buffers cannot be used for DMA +on all architectures so allocate hci_packet buffer +using kmalloc. + +Reviewed-by: Dan Carpenter +Signed-off-by: Amey Narkhede +Link: https://lore.kernel.org/r/20210211053819.34858-1-ameynarkhede03@gmail.com +Cc: stable +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/gdm724x/gdm_usb.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +--- a/drivers/staging/gdm724x/gdm_usb.c ++++ b/drivers/staging/gdm724x/gdm_usb.c +@@ -56,20 +56,24 @@ static int gdm_usb_recv(void *priv_dev, + + static int request_mac_address(struct lte_udev *udev) + { +- u8 buf[16] = {0,}; +- struct hci_packet *hci = (struct hci_packet *)buf; ++ struct hci_packet *hci; + struct usb_device *usbdev = udev->usbdev; + int actual; + int ret = -1; + ++ hci = kmalloc(struct_size(hci, data, 1), GFP_KERNEL); ++ if (!hci) ++ return -ENOMEM; ++ + hci->cmd_evt = gdm_cpu_to_dev16(udev->gdm_ed, LTE_GET_INFORMATION); + hci->len = gdm_cpu_to_dev16(udev->gdm_ed, 1); + hci->data[0] = MAC_ADDRESS; + +- ret = usb_bulk_msg(usbdev, usb_sndbulkpipe(usbdev, 2), buf, 5, ++ ret = usb_bulk_msg(usbdev, usb_sndbulkpipe(usbdev, 2), hci, 5, + &actual, 1000); + + udev->request_mac_addr = 1; ++ kfree(hci); + + return ret; + } diff --git a/queue-5.11/staging-mt7621-dma-mtk-hsdma.c-hsdma-mt7621.c.patch b/queue-5.11/staging-mt7621-dma-mtk-hsdma.c-hsdma-mt7621.c.patch new file mode 100644 index 00000000000..debcfbf8794 --- /dev/null +++ b/queue-5.11/staging-mt7621-dma-mtk-hsdma.c-hsdma-mt7621.c.patch @@ -0,0 +1,1565 @@ +From 1f92798cbe7fe923479cff754dd06dd23d352e36 Mon Sep 17 00:00:00 2001 +From: Ilya Lipnitskiy +Date: Fri, 29 Jan 2021 19:45:07 -0800 +Subject: staging/mt7621-dma: mtk-hsdma.c->hsdma-mt7621.c + +From: Ilya Lipnitskiy + +commit 1f92798cbe7fe923479cff754dd06dd23d352e36 upstream. + +Also use KBUILD_MODNAME for module name. + +This driver is only used by RALINK MIPS MT7621 SoCs. Tested by building +against that target using OpenWrt with Linux 5.10.10. + +Fixes the following error: +error: the following would cause module name conflict: + drivers/dma/mediatek/mtk-hsdma.ko + drivers/staging/mt7621-dma/mtk-hsdma.ko + +Cc: stable@vger.kernel.org +Cc: Masahiro Yamada +Signed-off-by: Ilya Lipnitskiy +Link: https://lore.kernel.org/r/20210130034507.2115280-1-ilya.lipnitskiy@gmail.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/mt7621-dma/Makefile | 2 + drivers/staging/mt7621-dma/hsdma-mt7621.c | 760 ++++++++++++++++++++++++++++++ + drivers/staging/mt7621-dma/mtk-hsdma.c | 760 ------------------------------ + 3 files changed, 761 insertions(+), 761 deletions(-) + rename drivers/staging/mt7621-dma/{mtk-hsdma.c => hsdma-mt7621.c} (99%) + +--- a/drivers/staging/mt7621-dma/Makefile ++++ b/drivers/staging/mt7621-dma/Makefile +@@ -1,4 +1,4 @@ + # SPDX-License-Identifier: GPL-2.0 +-obj-$(CONFIG_MTK_HSDMA) += mtk-hsdma.o ++obj-$(CONFIG_MTK_HSDMA) += hsdma-mt7621.o + + ccflags-y += -I$(srctree)/drivers/dma +--- /dev/null ++++ b/drivers/staging/mt7621-dma/hsdma-mt7621.c +@@ -0,0 +1,760 @@ ++// SPDX-License-Identifier: GPL-2.0+ ++/* ++ * Copyright (C) 2015, Michael Lee ++ * MTK HSDMA support ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include "virt-dma.h" ++ ++#define HSDMA_BASE_OFFSET 0x800 ++ ++#define HSDMA_REG_TX_BASE 0x00 ++#define HSDMA_REG_TX_CNT 0x04 ++#define HSDMA_REG_TX_CTX 0x08 ++#define HSDMA_REG_TX_DTX 0x0c ++#define HSDMA_REG_RX_BASE 0x100 ++#define HSDMA_REG_RX_CNT 0x104 ++#define HSDMA_REG_RX_CRX 0x108 ++#define HSDMA_REG_RX_DRX 0x10c ++#define HSDMA_REG_INFO 0x200 ++#define HSDMA_REG_GLO_CFG 0x204 ++#define HSDMA_REG_RST_CFG 0x208 ++#define HSDMA_REG_DELAY_INT 0x20c ++#define HSDMA_REG_FREEQ_THRES 0x210 ++#define HSDMA_REG_INT_STATUS 0x220 ++#define HSDMA_REG_INT_MASK 0x228 ++#define HSDMA_REG_SCH_Q01 0x280 ++#define HSDMA_REG_SCH_Q23 0x284 ++ ++#define HSDMA_DESCS_MAX 0xfff ++#define HSDMA_DESCS_NUM 8 ++#define HSDMA_DESCS_MASK (HSDMA_DESCS_NUM - 1) ++#define HSDMA_NEXT_DESC(x) (((x) + 1) & HSDMA_DESCS_MASK) ++ ++/* HSDMA_REG_INFO */ ++#define HSDMA_INFO_INDEX_MASK 0xf ++#define HSDMA_INFO_INDEX_SHIFT 24 ++#define HSDMA_INFO_BASE_MASK 0xff ++#define HSDMA_INFO_BASE_SHIFT 16 ++#define HSDMA_INFO_RX_MASK 0xff ++#define HSDMA_INFO_RX_SHIFT 8 ++#define HSDMA_INFO_TX_MASK 0xff ++#define HSDMA_INFO_TX_SHIFT 0 ++ ++/* HSDMA_REG_GLO_CFG */ ++#define HSDMA_GLO_TX_2B_OFFSET BIT(31) ++#define HSDMA_GLO_CLK_GATE BIT(30) ++#define HSDMA_GLO_BYTE_SWAP BIT(29) ++#define HSDMA_GLO_MULTI_DMA BIT(10) ++#define HSDMA_GLO_TWO_BUF BIT(9) ++#define HSDMA_GLO_32B_DESC BIT(8) ++#define HSDMA_GLO_BIG_ENDIAN BIT(7) ++#define HSDMA_GLO_TX_DONE BIT(6) ++#define HSDMA_GLO_BT_MASK 0x3 ++#define HSDMA_GLO_BT_SHIFT 4 ++#define HSDMA_GLO_RX_BUSY BIT(3) ++#define HSDMA_GLO_RX_DMA BIT(2) ++#define HSDMA_GLO_TX_BUSY BIT(1) ++#define HSDMA_GLO_TX_DMA BIT(0) ++ ++#define HSDMA_BT_SIZE_16BYTES (0 << HSDMA_GLO_BT_SHIFT) ++#define HSDMA_BT_SIZE_32BYTES (1 << HSDMA_GLO_BT_SHIFT) ++#define HSDMA_BT_SIZE_64BYTES (2 << HSDMA_GLO_BT_SHIFT) ++#define HSDMA_BT_SIZE_128BYTES (3 << HSDMA_GLO_BT_SHIFT) ++ ++#define HSDMA_GLO_DEFAULT (HSDMA_GLO_MULTI_DMA | \ ++ HSDMA_GLO_RX_DMA | HSDMA_GLO_TX_DMA | HSDMA_BT_SIZE_32BYTES) ++ ++/* HSDMA_REG_RST_CFG */ ++#define HSDMA_RST_RX_SHIFT 16 ++#define HSDMA_RST_TX_SHIFT 0 ++ ++/* HSDMA_REG_DELAY_INT */ ++#define HSDMA_DELAY_INT_EN BIT(15) ++#define HSDMA_DELAY_PEND_OFFSET 8 ++#define HSDMA_DELAY_TIME_OFFSET 0 ++#define HSDMA_DELAY_TX_OFFSET 16 ++#define HSDMA_DELAY_RX_OFFSET 0 ++ ++#define HSDMA_DELAY_INIT(x) (HSDMA_DELAY_INT_EN | \ ++ ((x) << HSDMA_DELAY_PEND_OFFSET)) ++#define HSDMA_DELAY(x) ((HSDMA_DELAY_INIT(x) << \ ++ HSDMA_DELAY_TX_OFFSET) | HSDMA_DELAY_INIT(x)) ++ ++/* HSDMA_REG_INT_STATUS */ ++#define HSDMA_INT_DELAY_RX_COH BIT(31) ++#define HSDMA_INT_DELAY_RX_INT BIT(30) ++#define HSDMA_INT_DELAY_TX_COH BIT(29) ++#define HSDMA_INT_DELAY_TX_INT BIT(28) ++#define HSDMA_INT_RX_MASK 0x3 ++#define HSDMA_INT_RX_SHIFT 16 ++#define HSDMA_INT_RX_Q0 BIT(16) ++#define HSDMA_INT_TX_MASK 0xf ++#define HSDMA_INT_TX_SHIFT 0 ++#define HSDMA_INT_TX_Q0 BIT(0) ++ ++/* tx/rx dma desc flags */ ++#define HSDMA_PLEN_MASK 0x3fff ++#define HSDMA_DESC_DONE BIT(31) ++#define HSDMA_DESC_LS0 BIT(30) ++#define HSDMA_DESC_PLEN0(_x) (((_x) & HSDMA_PLEN_MASK) << 16) ++#define HSDMA_DESC_TAG BIT(15) ++#define HSDMA_DESC_LS1 BIT(14) ++#define HSDMA_DESC_PLEN1(_x) ((_x) & HSDMA_PLEN_MASK) ++ ++/* align 4 bytes */ ++#define HSDMA_ALIGN_SIZE 3 ++/* align size 128bytes */ ++#define HSDMA_MAX_PLEN 0x3f80 ++ ++struct hsdma_desc { ++ u32 addr0; ++ u32 flags; ++ u32 addr1; ++ u32 unused; ++}; ++ ++struct mtk_hsdma_sg { ++ dma_addr_t src_addr; ++ dma_addr_t dst_addr; ++ u32 len; ++}; ++ ++struct mtk_hsdma_desc { ++ struct virt_dma_desc vdesc; ++ unsigned int num_sgs; ++ struct mtk_hsdma_sg sg[1]; ++}; ++ ++struct mtk_hsdma_chan { ++ struct virt_dma_chan vchan; ++ unsigned int id; ++ dma_addr_t desc_addr; ++ int tx_idx; ++ int rx_idx; ++ struct hsdma_desc *tx_ring; ++ struct hsdma_desc *rx_ring; ++ struct mtk_hsdma_desc *desc; ++ unsigned int next_sg; ++}; ++ ++struct mtk_hsdam_engine { ++ struct dma_device ddev; ++ struct device_dma_parameters dma_parms; ++ void __iomem *base; ++ struct tasklet_struct task; ++ volatile unsigned long chan_issued; ++ ++ struct mtk_hsdma_chan chan[1]; ++}; ++ ++static inline struct mtk_hsdam_engine *mtk_hsdma_chan_get_dev( ++ struct mtk_hsdma_chan *chan) ++{ ++ return container_of(chan->vchan.chan.device, struct mtk_hsdam_engine, ++ ddev); ++} ++ ++static inline struct mtk_hsdma_chan *to_mtk_hsdma_chan(struct dma_chan *c) ++{ ++ return container_of(c, struct mtk_hsdma_chan, vchan.chan); ++} ++ ++static inline struct mtk_hsdma_desc *to_mtk_hsdma_desc( ++ struct virt_dma_desc *vdesc) ++{ ++ return container_of(vdesc, struct mtk_hsdma_desc, vdesc); ++} ++ ++static inline u32 mtk_hsdma_read(struct mtk_hsdam_engine *hsdma, u32 reg) ++{ ++ return readl(hsdma->base + reg); ++} ++ ++static inline void mtk_hsdma_write(struct mtk_hsdam_engine *hsdma, ++ unsigned int reg, u32 val) ++{ ++ writel(val, hsdma->base + reg); ++} ++ ++static void mtk_hsdma_reset_chan(struct mtk_hsdam_engine *hsdma, ++ struct mtk_hsdma_chan *chan) ++{ ++ chan->tx_idx = 0; ++ chan->rx_idx = HSDMA_DESCS_NUM - 1; ++ ++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx); ++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx); ++ ++ mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG, ++ 0x1 << (chan->id + HSDMA_RST_TX_SHIFT)); ++ mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG, ++ 0x1 << (chan->id + HSDMA_RST_RX_SHIFT)); ++} ++ ++static void hsdma_dump_reg(struct mtk_hsdam_engine *hsdma) ++{ ++ dev_dbg(hsdma->ddev.dev, ++ "tbase %08x, tcnt %08x, tctx %08x, tdtx: %08x, rbase %08x, rcnt %08x, rctx %08x, rdtx %08x\n", ++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_BASE), ++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_CNT), ++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_CTX), ++ mtk_hsdma_read(hsdma, HSDMA_REG_TX_DTX), ++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_BASE), ++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_CNT), ++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_CRX), ++ mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX)); ++ ++ dev_dbg(hsdma->ddev.dev, ++ "info %08x, glo %08x, delay %08x, intr_stat %08x, intr_mask %08x\n", ++ mtk_hsdma_read(hsdma, HSDMA_REG_INFO), ++ mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG), ++ mtk_hsdma_read(hsdma, HSDMA_REG_DELAY_INT), ++ mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS), ++ mtk_hsdma_read(hsdma, HSDMA_REG_INT_MASK)); ++} ++ ++static void hsdma_dump_desc(struct mtk_hsdam_engine *hsdma, ++ struct mtk_hsdma_chan *chan) ++{ ++ struct hsdma_desc *tx_desc; ++ struct hsdma_desc *rx_desc; ++ int i; ++ ++ dev_dbg(hsdma->ddev.dev, "tx idx: %d, rx idx: %d\n", ++ chan->tx_idx, chan->rx_idx); ++ ++ for (i = 0; i < HSDMA_DESCS_NUM; i++) { ++ tx_desc = &chan->tx_ring[i]; ++ rx_desc = &chan->rx_ring[i]; ++ ++ dev_dbg(hsdma->ddev.dev, ++ "%d tx addr0: %08x, flags %08x, tx addr1: %08x, rx addr0 %08x, flags %08x\n", ++ i, tx_desc->addr0, tx_desc->flags, ++ tx_desc->addr1, rx_desc->addr0, rx_desc->flags); ++ } ++} ++ ++static void mtk_hsdma_reset(struct mtk_hsdam_engine *hsdma, ++ struct mtk_hsdma_chan *chan) ++{ ++ int i; ++ ++ /* disable dma */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0); ++ ++ /* disable intr */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0); ++ ++ /* init desc value */ ++ for (i = 0; i < HSDMA_DESCS_NUM; i++) { ++ chan->tx_ring[i].addr0 = 0; ++ chan->tx_ring[i].flags = HSDMA_DESC_LS0 | HSDMA_DESC_DONE; ++ } ++ for (i = 0; i < HSDMA_DESCS_NUM; i++) { ++ chan->rx_ring[i].addr0 = 0; ++ chan->rx_ring[i].flags = 0; ++ } ++ ++ /* reset */ ++ mtk_hsdma_reset_chan(hsdma, chan); ++ ++ /* enable intr */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0); ++ ++ /* enable dma */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT); ++} ++ ++static int mtk_hsdma_terminate_all(struct dma_chan *c) ++{ ++ struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c); ++ struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan); ++ unsigned long timeout; ++ LIST_HEAD(head); ++ ++ spin_lock_bh(&chan->vchan.lock); ++ chan->desc = NULL; ++ clear_bit(chan->id, &hsdma->chan_issued); ++ vchan_get_all_descriptors(&chan->vchan, &head); ++ spin_unlock_bh(&chan->vchan.lock); ++ ++ vchan_dma_desc_free_list(&chan->vchan, &head); ++ ++ /* wait dma transfer complete */ ++ timeout = jiffies + msecs_to_jiffies(2000); ++ while (mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG) & ++ (HSDMA_GLO_RX_BUSY | HSDMA_GLO_TX_BUSY)) { ++ if (time_after_eq(jiffies, timeout)) { ++ hsdma_dump_desc(hsdma, chan); ++ mtk_hsdma_reset(hsdma, chan); ++ dev_err(hsdma->ddev.dev, "timeout, reset it\n"); ++ break; ++ } ++ cpu_relax(); ++ } ++ ++ return 0; ++} ++ ++static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma, ++ struct mtk_hsdma_chan *chan) ++{ ++ dma_addr_t src, dst; ++ size_t len, tlen; ++ struct hsdma_desc *tx_desc, *rx_desc; ++ struct mtk_hsdma_sg *sg; ++ unsigned int i; ++ int rx_idx; ++ ++ sg = &chan->desc->sg[0]; ++ len = sg->len; ++ chan->desc->num_sgs = DIV_ROUND_UP(len, HSDMA_MAX_PLEN); ++ ++ /* tx desc */ ++ src = sg->src_addr; ++ for (i = 0; i < chan->desc->num_sgs; i++) { ++ tx_desc = &chan->tx_ring[chan->tx_idx]; ++ ++ if (len > HSDMA_MAX_PLEN) ++ tlen = HSDMA_MAX_PLEN; ++ else ++ tlen = len; ++ ++ if (i & 0x1) { ++ tx_desc->addr1 = src; ++ tx_desc->flags |= HSDMA_DESC_PLEN1(tlen); ++ } else { ++ tx_desc->addr0 = src; ++ tx_desc->flags = HSDMA_DESC_PLEN0(tlen); ++ ++ /* update index */ ++ chan->tx_idx = HSDMA_NEXT_DESC(chan->tx_idx); ++ } ++ ++ src += tlen; ++ len -= tlen; ++ } ++ if (i & 0x1) ++ tx_desc->flags |= HSDMA_DESC_LS0; ++ else ++ tx_desc->flags |= HSDMA_DESC_LS1; ++ ++ /* rx desc */ ++ rx_idx = HSDMA_NEXT_DESC(chan->rx_idx); ++ len = sg->len; ++ dst = sg->dst_addr; ++ for (i = 0; i < chan->desc->num_sgs; i++) { ++ rx_desc = &chan->rx_ring[rx_idx]; ++ if (len > HSDMA_MAX_PLEN) ++ tlen = HSDMA_MAX_PLEN; ++ else ++ tlen = len; ++ ++ rx_desc->addr0 = dst; ++ rx_desc->flags = HSDMA_DESC_PLEN0(tlen); ++ ++ dst += tlen; ++ len -= tlen; ++ ++ /* update index */ ++ rx_idx = HSDMA_NEXT_DESC(rx_idx); ++ } ++ ++ /* make sure desc and index all up to date */ ++ wmb(); ++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx); ++ ++ return 0; ++} ++ ++static int gdma_next_desc(struct mtk_hsdma_chan *chan) ++{ ++ struct virt_dma_desc *vdesc; ++ ++ vdesc = vchan_next_desc(&chan->vchan); ++ if (!vdesc) { ++ chan->desc = NULL; ++ return 0; ++ } ++ chan->desc = to_mtk_hsdma_desc(vdesc); ++ chan->next_sg = 0; ++ ++ return 1; ++} ++ ++static void mtk_hsdma_chan_done(struct mtk_hsdam_engine *hsdma, ++ struct mtk_hsdma_chan *chan) ++{ ++ struct mtk_hsdma_desc *desc; ++ int chan_issued; ++ ++ chan_issued = 0; ++ spin_lock_bh(&chan->vchan.lock); ++ desc = chan->desc; ++ if (likely(desc)) { ++ if (chan->next_sg == desc->num_sgs) { ++ list_del(&desc->vdesc.node); ++ vchan_cookie_complete(&desc->vdesc); ++ chan_issued = gdma_next_desc(chan); ++ } ++ } else { ++ dev_dbg(hsdma->ddev.dev, "no desc to complete\n"); ++ } ++ ++ if (chan_issued) ++ set_bit(chan->id, &hsdma->chan_issued); ++ spin_unlock_bh(&chan->vchan.lock); ++} ++ ++static irqreturn_t mtk_hsdma_irq(int irq, void *devid) ++{ ++ struct mtk_hsdam_engine *hsdma = devid; ++ u32 status; ++ ++ status = mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS); ++ if (unlikely(!status)) ++ return IRQ_NONE; ++ ++ if (likely(status & HSDMA_INT_RX_Q0)) ++ tasklet_schedule(&hsdma->task); ++ else ++ dev_dbg(hsdma->ddev.dev, "unhandle irq status %08x\n", status); ++ /* clean intr bits */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_STATUS, status); ++ ++ return IRQ_HANDLED; ++} ++ ++static void mtk_hsdma_issue_pending(struct dma_chan *c) ++{ ++ struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c); ++ struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan); ++ ++ spin_lock_bh(&chan->vchan.lock); ++ if (vchan_issue_pending(&chan->vchan) && !chan->desc) { ++ if (gdma_next_desc(chan)) { ++ set_bit(chan->id, &hsdma->chan_issued); ++ tasklet_schedule(&hsdma->task); ++ } else { ++ dev_dbg(hsdma->ddev.dev, "no desc to issue\n"); ++ } ++ } ++ spin_unlock_bh(&chan->vchan.lock); ++} ++ ++static struct dma_async_tx_descriptor *mtk_hsdma_prep_dma_memcpy( ++ struct dma_chan *c, dma_addr_t dest, dma_addr_t src, ++ size_t len, unsigned long flags) ++{ ++ struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c); ++ struct mtk_hsdma_desc *desc; ++ ++ if (len <= 0) ++ return NULL; ++ ++ desc = kzalloc(sizeof(*desc), GFP_ATOMIC); ++ if (!desc) { ++ dev_err(c->device->dev, "alloc memcpy decs error\n"); ++ return NULL; ++ } ++ ++ desc->sg[0].src_addr = src; ++ desc->sg[0].dst_addr = dest; ++ desc->sg[0].len = len; ++ ++ return vchan_tx_prep(&chan->vchan, &desc->vdesc, flags); ++} ++ ++static enum dma_status mtk_hsdma_tx_status(struct dma_chan *c, ++ dma_cookie_t cookie, ++ struct dma_tx_state *state) ++{ ++ return dma_cookie_status(c, cookie, state); ++} ++ ++static void mtk_hsdma_free_chan_resources(struct dma_chan *c) ++{ ++ vchan_free_chan_resources(to_virt_chan(c)); ++} ++ ++static void mtk_hsdma_desc_free(struct virt_dma_desc *vdesc) ++{ ++ kfree(container_of(vdesc, struct mtk_hsdma_desc, vdesc)); ++} ++ ++static void mtk_hsdma_tx(struct mtk_hsdam_engine *hsdma) ++{ ++ struct mtk_hsdma_chan *chan; ++ ++ if (test_and_clear_bit(0, &hsdma->chan_issued)) { ++ chan = &hsdma->chan[0]; ++ if (chan->desc) ++ mtk_hsdma_start_transfer(hsdma, chan); ++ else ++ dev_dbg(hsdma->ddev.dev, "chan 0 no desc to issue\n"); ++ } ++} ++ ++static void mtk_hsdma_rx(struct mtk_hsdam_engine *hsdma) ++{ ++ struct mtk_hsdma_chan *chan; ++ int next_idx, drx_idx, cnt; ++ ++ chan = &hsdma->chan[0]; ++ next_idx = HSDMA_NEXT_DESC(chan->rx_idx); ++ drx_idx = mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX); ++ ++ cnt = (drx_idx - next_idx) & HSDMA_DESCS_MASK; ++ if (!cnt) ++ return; ++ ++ chan->next_sg += cnt; ++ chan->rx_idx = (chan->rx_idx + cnt) & HSDMA_DESCS_MASK; ++ ++ /* update rx crx */ ++ wmb(); ++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx); ++ ++ mtk_hsdma_chan_done(hsdma, chan); ++} ++ ++static void mtk_hsdma_tasklet(struct tasklet_struct *t) ++{ ++ struct mtk_hsdam_engine *hsdma = from_tasklet(hsdma, t, task); ++ ++ mtk_hsdma_rx(hsdma); ++ mtk_hsdma_tx(hsdma); ++} ++ ++static int mtk_hsdam_alloc_desc(struct mtk_hsdam_engine *hsdma, ++ struct mtk_hsdma_chan *chan) ++{ ++ int i; ++ ++ chan->tx_ring = dma_alloc_coherent(hsdma->ddev.dev, ++ 2 * HSDMA_DESCS_NUM * ++ sizeof(*chan->tx_ring), ++ &chan->desc_addr, GFP_ATOMIC | __GFP_ZERO); ++ if (!chan->tx_ring) ++ goto no_mem; ++ ++ chan->rx_ring = &chan->tx_ring[HSDMA_DESCS_NUM]; ++ ++ /* init tx ring value */ ++ for (i = 0; i < HSDMA_DESCS_NUM; i++) ++ chan->tx_ring[i].flags = HSDMA_DESC_LS0 | HSDMA_DESC_DONE; ++ ++ return 0; ++no_mem: ++ return -ENOMEM; ++} ++ ++static void mtk_hsdam_free_desc(struct mtk_hsdam_engine *hsdma, ++ struct mtk_hsdma_chan *chan) ++{ ++ if (chan->tx_ring) { ++ dma_free_coherent(hsdma->ddev.dev, ++ 2 * HSDMA_DESCS_NUM * sizeof(*chan->tx_ring), ++ chan->tx_ring, chan->desc_addr); ++ chan->tx_ring = NULL; ++ chan->rx_ring = NULL; ++ } ++} ++ ++static int mtk_hsdma_init(struct mtk_hsdam_engine *hsdma) ++{ ++ struct mtk_hsdma_chan *chan; ++ int ret; ++ u32 reg; ++ ++ /* init desc */ ++ chan = &hsdma->chan[0]; ++ ret = mtk_hsdam_alloc_desc(hsdma, chan); ++ if (ret) ++ return ret; ++ ++ /* tx */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, chan->desc_addr); ++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, HSDMA_DESCS_NUM); ++ /* rx */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, chan->desc_addr + ++ (sizeof(struct hsdma_desc) * HSDMA_DESCS_NUM)); ++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, HSDMA_DESCS_NUM); ++ /* reset */ ++ mtk_hsdma_reset_chan(hsdma, chan); ++ ++ /* enable rx intr */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0); ++ ++ /* enable dma */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT); ++ ++ /* hardware info */ ++ reg = mtk_hsdma_read(hsdma, HSDMA_REG_INFO); ++ dev_info(hsdma->ddev.dev, "rx: %d, tx: %d\n", ++ (reg >> HSDMA_INFO_RX_SHIFT) & HSDMA_INFO_RX_MASK, ++ (reg >> HSDMA_INFO_TX_SHIFT) & HSDMA_INFO_TX_MASK); ++ ++ hsdma_dump_reg(hsdma); ++ ++ return ret; ++} ++ ++static void mtk_hsdma_uninit(struct mtk_hsdam_engine *hsdma) ++{ ++ struct mtk_hsdma_chan *chan; ++ ++ /* disable dma */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0); ++ ++ /* disable intr */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0); ++ ++ /* free desc */ ++ chan = &hsdma->chan[0]; ++ mtk_hsdam_free_desc(hsdma, chan); ++ ++ /* tx */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, 0); ++ mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, 0); ++ /* rx */ ++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, 0); ++ mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, 0); ++ /* reset */ ++ mtk_hsdma_reset_chan(hsdma, chan); ++} ++ ++static const struct of_device_id mtk_hsdma_of_match[] = { ++ { .compatible = "mediatek,mt7621-hsdma" }, ++ { }, ++}; ++ ++static int mtk_hsdma_probe(struct platform_device *pdev) ++{ ++ const struct of_device_id *match; ++ struct mtk_hsdma_chan *chan; ++ struct mtk_hsdam_engine *hsdma; ++ struct dma_device *dd; ++ int ret; ++ int irq; ++ void __iomem *base; ++ ++ ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); ++ if (ret) ++ return ret; ++ ++ match = of_match_device(mtk_hsdma_of_match, &pdev->dev); ++ if (!match) ++ return -EINVAL; ++ ++ hsdma = devm_kzalloc(&pdev->dev, sizeof(*hsdma), GFP_KERNEL); ++ if (!hsdma) ++ return -EINVAL; ++ ++ base = devm_platform_ioremap_resource(pdev, 0); ++ if (IS_ERR(base)) ++ return PTR_ERR(base); ++ hsdma->base = base + HSDMA_BASE_OFFSET; ++ tasklet_setup(&hsdma->task, mtk_hsdma_tasklet); ++ ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) ++ return -EINVAL; ++ ret = devm_request_irq(&pdev->dev, irq, mtk_hsdma_irq, ++ 0, dev_name(&pdev->dev), hsdma); ++ if (ret) { ++ dev_err(&pdev->dev, "failed to request irq\n"); ++ return ret; ++ } ++ ++ device_reset(&pdev->dev); ++ ++ dd = &hsdma->ddev; ++ dma_cap_set(DMA_MEMCPY, dd->cap_mask); ++ dd->copy_align = HSDMA_ALIGN_SIZE; ++ dd->device_free_chan_resources = mtk_hsdma_free_chan_resources; ++ dd->device_prep_dma_memcpy = mtk_hsdma_prep_dma_memcpy; ++ dd->device_terminate_all = mtk_hsdma_terminate_all; ++ dd->device_tx_status = mtk_hsdma_tx_status; ++ dd->device_issue_pending = mtk_hsdma_issue_pending; ++ dd->dev = &pdev->dev; ++ dd->dev->dma_parms = &hsdma->dma_parms; ++ dma_set_max_seg_size(dd->dev, HSDMA_MAX_PLEN); ++ INIT_LIST_HEAD(&dd->channels); ++ ++ chan = &hsdma->chan[0]; ++ chan->id = 0; ++ chan->vchan.desc_free = mtk_hsdma_desc_free; ++ vchan_init(&chan->vchan, dd); ++ ++ /* init hardware */ ++ ret = mtk_hsdma_init(hsdma); ++ if (ret) { ++ dev_err(&pdev->dev, "failed to alloc ring descs\n"); ++ return ret; ++ } ++ ++ ret = dma_async_device_register(dd); ++ if (ret) { ++ dev_err(&pdev->dev, "failed to register dma device\n"); ++ goto err_uninit_hsdma; ++ } ++ ++ ret = of_dma_controller_register(pdev->dev.of_node, ++ of_dma_xlate_by_chan_id, hsdma); ++ if (ret) { ++ dev_err(&pdev->dev, "failed to register of dma controller\n"); ++ goto err_unregister; ++ } ++ ++ platform_set_drvdata(pdev, hsdma); ++ ++ return 0; ++ ++err_unregister: ++ dma_async_device_unregister(dd); ++err_uninit_hsdma: ++ mtk_hsdma_uninit(hsdma); ++ return ret; ++} ++ ++static int mtk_hsdma_remove(struct platform_device *pdev) ++{ ++ struct mtk_hsdam_engine *hsdma = platform_get_drvdata(pdev); ++ ++ mtk_hsdma_uninit(hsdma); ++ ++ of_dma_controller_free(pdev->dev.of_node); ++ dma_async_device_unregister(&hsdma->ddev); ++ ++ return 0; ++} ++ ++static struct platform_driver mtk_hsdma_driver = { ++ .probe = mtk_hsdma_probe, ++ .remove = mtk_hsdma_remove, ++ .driver = { ++ .name = KBUILD_MODNAME, ++ .of_match_table = mtk_hsdma_of_match, ++ }, ++}; ++module_platform_driver(mtk_hsdma_driver); ++ ++MODULE_AUTHOR("Michael Lee "); ++MODULE_DESCRIPTION("MTK HSDMA driver"); ++MODULE_LICENSE("GPL v2"); +--- a/drivers/staging/mt7621-dma/mtk-hsdma.c ++++ /dev/null +@@ -1,760 +0,0 @@ +-// SPDX-License-Identifier: GPL-2.0+ +-/* +- * Copyright (C) 2015, Michael Lee +- * MTK HSDMA support +- */ +- +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-#include "virt-dma.h" +- +-#define HSDMA_BASE_OFFSET 0x800 +- +-#define HSDMA_REG_TX_BASE 0x00 +-#define HSDMA_REG_TX_CNT 0x04 +-#define HSDMA_REG_TX_CTX 0x08 +-#define HSDMA_REG_TX_DTX 0x0c +-#define HSDMA_REG_RX_BASE 0x100 +-#define HSDMA_REG_RX_CNT 0x104 +-#define HSDMA_REG_RX_CRX 0x108 +-#define HSDMA_REG_RX_DRX 0x10c +-#define HSDMA_REG_INFO 0x200 +-#define HSDMA_REG_GLO_CFG 0x204 +-#define HSDMA_REG_RST_CFG 0x208 +-#define HSDMA_REG_DELAY_INT 0x20c +-#define HSDMA_REG_FREEQ_THRES 0x210 +-#define HSDMA_REG_INT_STATUS 0x220 +-#define HSDMA_REG_INT_MASK 0x228 +-#define HSDMA_REG_SCH_Q01 0x280 +-#define HSDMA_REG_SCH_Q23 0x284 +- +-#define HSDMA_DESCS_MAX 0xfff +-#define HSDMA_DESCS_NUM 8 +-#define HSDMA_DESCS_MASK (HSDMA_DESCS_NUM - 1) +-#define HSDMA_NEXT_DESC(x) (((x) + 1) & HSDMA_DESCS_MASK) +- +-/* HSDMA_REG_INFO */ +-#define HSDMA_INFO_INDEX_MASK 0xf +-#define HSDMA_INFO_INDEX_SHIFT 24 +-#define HSDMA_INFO_BASE_MASK 0xff +-#define HSDMA_INFO_BASE_SHIFT 16 +-#define HSDMA_INFO_RX_MASK 0xff +-#define HSDMA_INFO_RX_SHIFT 8 +-#define HSDMA_INFO_TX_MASK 0xff +-#define HSDMA_INFO_TX_SHIFT 0 +- +-/* HSDMA_REG_GLO_CFG */ +-#define HSDMA_GLO_TX_2B_OFFSET BIT(31) +-#define HSDMA_GLO_CLK_GATE BIT(30) +-#define HSDMA_GLO_BYTE_SWAP BIT(29) +-#define HSDMA_GLO_MULTI_DMA BIT(10) +-#define HSDMA_GLO_TWO_BUF BIT(9) +-#define HSDMA_GLO_32B_DESC BIT(8) +-#define HSDMA_GLO_BIG_ENDIAN BIT(7) +-#define HSDMA_GLO_TX_DONE BIT(6) +-#define HSDMA_GLO_BT_MASK 0x3 +-#define HSDMA_GLO_BT_SHIFT 4 +-#define HSDMA_GLO_RX_BUSY BIT(3) +-#define HSDMA_GLO_RX_DMA BIT(2) +-#define HSDMA_GLO_TX_BUSY BIT(1) +-#define HSDMA_GLO_TX_DMA BIT(0) +- +-#define HSDMA_BT_SIZE_16BYTES (0 << HSDMA_GLO_BT_SHIFT) +-#define HSDMA_BT_SIZE_32BYTES (1 << HSDMA_GLO_BT_SHIFT) +-#define HSDMA_BT_SIZE_64BYTES (2 << HSDMA_GLO_BT_SHIFT) +-#define HSDMA_BT_SIZE_128BYTES (3 << HSDMA_GLO_BT_SHIFT) +- +-#define HSDMA_GLO_DEFAULT (HSDMA_GLO_MULTI_DMA | \ +- HSDMA_GLO_RX_DMA | HSDMA_GLO_TX_DMA | HSDMA_BT_SIZE_32BYTES) +- +-/* HSDMA_REG_RST_CFG */ +-#define HSDMA_RST_RX_SHIFT 16 +-#define HSDMA_RST_TX_SHIFT 0 +- +-/* HSDMA_REG_DELAY_INT */ +-#define HSDMA_DELAY_INT_EN BIT(15) +-#define HSDMA_DELAY_PEND_OFFSET 8 +-#define HSDMA_DELAY_TIME_OFFSET 0 +-#define HSDMA_DELAY_TX_OFFSET 16 +-#define HSDMA_DELAY_RX_OFFSET 0 +- +-#define HSDMA_DELAY_INIT(x) (HSDMA_DELAY_INT_EN | \ +- ((x) << HSDMA_DELAY_PEND_OFFSET)) +-#define HSDMA_DELAY(x) ((HSDMA_DELAY_INIT(x) << \ +- HSDMA_DELAY_TX_OFFSET) | HSDMA_DELAY_INIT(x)) +- +-/* HSDMA_REG_INT_STATUS */ +-#define HSDMA_INT_DELAY_RX_COH BIT(31) +-#define HSDMA_INT_DELAY_RX_INT BIT(30) +-#define HSDMA_INT_DELAY_TX_COH BIT(29) +-#define HSDMA_INT_DELAY_TX_INT BIT(28) +-#define HSDMA_INT_RX_MASK 0x3 +-#define HSDMA_INT_RX_SHIFT 16 +-#define HSDMA_INT_RX_Q0 BIT(16) +-#define HSDMA_INT_TX_MASK 0xf +-#define HSDMA_INT_TX_SHIFT 0 +-#define HSDMA_INT_TX_Q0 BIT(0) +- +-/* tx/rx dma desc flags */ +-#define HSDMA_PLEN_MASK 0x3fff +-#define HSDMA_DESC_DONE BIT(31) +-#define HSDMA_DESC_LS0 BIT(30) +-#define HSDMA_DESC_PLEN0(_x) (((_x) & HSDMA_PLEN_MASK) << 16) +-#define HSDMA_DESC_TAG BIT(15) +-#define HSDMA_DESC_LS1 BIT(14) +-#define HSDMA_DESC_PLEN1(_x) ((_x) & HSDMA_PLEN_MASK) +- +-/* align 4 bytes */ +-#define HSDMA_ALIGN_SIZE 3 +-/* align size 128bytes */ +-#define HSDMA_MAX_PLEN 0x3f80 +- +-struct hsdma_desc { +- u32 addr0; +- u32 flags; +- u32 addr1; +- u32 unused; +-}; +- +-struct mtk_hsdma_sg { +- dma_addr_t src_addr; +- dma_addr_t dst_addr; +- u32 len; +-}; +- +-struct mtk_hsdma_desc { +- struct virt_dma_desc vdesc; +- unsigned int num_sgs; +- struct mtk_hsdma_sg sg[1]; +-}; +- +-struct mtk_hsdma_chan { +- struct virt_dma_chan vchan; +- unsigned int id; +- dma_addr_t desc_addr; +- int tx_idx; +- int rx_idx; +- struct hsdma_desc *tx_ring; +- struct hsdma_desc *rx_ring; +- struct mtk_hsdma_desc *desc; +- unsigned int next_sg; +-}; +- +-struct mtk_hsdam_engine { +- struct dma_device ddev; +- struct device_dma_parameters dma_parms; +- void __iomem *base; +- struct tasklet_struct task; +- volatile unsigned long chan_issued; +- +- struct mtk_hsdma_chan chan[1]; +-}; +- +-static inline struct mtk_hsdam_engine *mtk_hsdma_chan_get_dev( +- struct mtk_hsdma_chan *chan) +-{ +- return container_of(chan->vchan.chan.device, struct mtk_hsdam_engine, +- ddev); +-} +- +-static inline struct mtk_hsdma_chan *to_mtk_hsdma_chan(struct dma_chan *c) +-{ +- return container_of(c, struct mtk_hsdma_chan, vchan.chan); +-} +- +-static inline struct mtk_hsdma_desc *to_mtk_hsdma_desc( +- struct virt_dma_desc *vdesc) +-{ +- return container_of(vdesc, struct mtk_hsdma_desc, vdesc); +-} +- +-static inline u32 mtk_hsdma_read(struct mtk_hsdam_engine *hsdma, u32 reg) +-{ +- return readl(hsdma->base + reg); +-} +- +-static inline void mtk_hsdma_write(struct mtk_hsdam_engine *hsdma, +- unsigned int reg, u32 val) +-{ +- writel(val, hsdma->base + reg); +-} +- +-static void mtk_hsdma_reset_chan(struct mtk_hsdam_engine *hsdma, +- struct mtk_hsdma_chan *chan) +-{ +- chan->tx_idx = 0; +- chan->rx_idx = HSDMA_DESCS_NUM - 1; +- +- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx); +- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx); +- +- mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG, +- 0x1 << (chan->id + HSDMA_RST_TX_SHIFT)); +- mtk_hsdma_write(hsdma, HSDMA_REG_RST_CFG, +- 0x1 << (chan->id + HSDMA_RST_RX_SHIFT)); +-} +- +-static void hsdma_dump_reg(struct mtk_hsdam_engine *hsdma) +-{ +- dev_dbg(hsdma->ddev.dev, +- "tbase %08x, tcnt %08x, tctx %08x, tdtx: %08x, rbase %08x, rcnt %08x, rctx %08x, rdtx %08x\n", +- mtk_hsdma_read(hsdma, HSDMA_REG_TX_BASE), +- mtk_hsdma_read(hsdma, HSDMA_REG_TX_CNT), +- mtk_hsdma_read(hsdma, HSDMA_REG_TX_CTX), +- mtk_hsdma_read(hsdma, HSDMA_REG_TX_DTX), +- mtk_hsdma_read(hsdma, HSDMA_REG_RX_BASE), +- mtk_hsdma_read(hsdma, HSDMA_REG_RX_CNT), +- mtk_hsdma_read(hsdma, HSDMA_REG_RX_CRX), +- mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX)); +- +- dev_dbg(hsdma->ddev.dev, +- "info %08x, glo %08x, delay %08x, intr_stat %08x, intr_mask %08x\n", +- mtk_hsdma_read(hsdma, HSDMA_REG_INFO), +- mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG), +- mtk_hsdma_read(hsdma, HSDMA_REG_DELAY_INT), +- mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS), +- mtk_hsdma_read(hsdma, HSDMA_REG_INT_MASK)); +-} +- +-static void hsdma_dump_desc(struct mtk_hsdam_engine *hsdma, +- struct mtk_hsdma_chan *chan) +-{ +- struct hsdma_desc *tx_desc; +- struct hsdma_desc *rx_desc; +- int i; +- +- dev_dbg(hsdma->ddev.dev, "tx idx: %d, rx idx: %d\n", +- chan->tx_idx, chan->rx_idx); +- +- for (i = 0; i < HSDMA_DESCS_NUM; i++) { +- tx_desc = &chan->tx_ring[i]; +- rx_desc = &chan->rx_ring[i]; +- +- dev_dbg(hsdma->ddev.dev, +- "%d tx addr0: %08x, flags %08x, tx addr1: %08x, rx addr0 %08x, flags %08x\n", +- i, tx_desc->addr0, tx_desc->flags, +- tx_desc->addr1, rx_desc->addr0, rx_desc->flags); +- } +-} +- +-static void mtk_hsdma_reset(struct mtk_hsdam_engine *hsdma, +- struct mtk_hsdma_chan *chan) +-{ +- int i; +- +- /* disable dma */ +- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0); +- +- /* disable intr */ +- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0); +- +- /* init desc value */ +- for (i = 0; i < HSDMA_DESCS_NUM; i++) { +- chan->tx_ring[i].addr0 = 0; +- chan->tx_ring[i].flags = HSDMA_DESC_LS0 | HSDMA_DESC_DONE; +- } +- for (i = 0; i < HSDMA_DESCS_NUM; i++) { +- chan->rx_ring[i].addr0 = 0; +- chan->rx_ring[i].flags = 0; +- } +- +- /* reset */ +- mtk_hsdma_reset_chan(hsdma, chan); +- +- /* enable intr */ +- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0); +- +- /* enable dma */ +- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT); +-} +- +-static int mtk_hsdma_terminate_all(struct dma_chan *c) +-{ +- struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c); +- struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan); +- unsigned long timeout; +- LIST_HEAD(head); +- +- spin_lock_bh(&chan->vchan.lock); +- chan->desc = NULL; +- clear_bit(chan->id, &hsdma->chan_issued); +- vchan_get_all_descriptors(&chan->vchan, &head); +- spin_unlock_bh(&chan->vchan.lock); +- +- vchan_dma_desc_free_list(&chan->vchan, &head); +- +- /* wait dma transfer complete */ +- timeout = jiffies + msecs_to_jiffies(2000); +- while (mtk_hsdma_read(hsdma, HSDMA_REG_GLO_CFG) & +- (HSDMA_GLO_RX_BUSY | HSDMA_GLO_TX_BUSY)) { +- if (time_after_eq(jiffies, timeout)) { +- hsdma_dump_desc(hsdma, chan); +- mtk_hsdma_reset(hsdma, chan); +- dev_err(hsdma->ddev.dev, "timeout, reset it\n"); +- break; +- } +- cpu_relax(); +- } +- +- return 0; +-} +- +-static int mtk_hsdma_start_transfer(struct mtk_hsdam_engine *hsdma, +- struct mtk_hsdma_chan *chan) +-{ +- dma_addr_t src, dst; +- size_t len, tlen; +- struct hsdma_desc *tx_desc, *rx_desc; +- struct mtk_hsdma_sg *sg; +- unsigned int i; +- int rx_idx; +- +- sg = &chan->desc->sg[0]; +- len = sg->len; +- chan->desc->num_sgs = DIV_ROUND_UP(len, HSDMA_MAX_PLEN); +- +- /* tx desc */ +- src = sg->src_addr; +- for (i = 0; i < chan->desc->num_sgs; i++) { +- tx_desc = &chan->tx_ring[chan->tx_idx]; +- +- if (len > HSDMA_MAX_PLEN) +- tlen = HSDMA_MAX_PLEN; +- else +- tlen = len; +- +- if (i & 0x1) { +- tx_desc->addr1 = src; +- tx_desc->flags |= HSDMA_DESC_PLEN1(tlen); +- } else { +- tx_desc->addr0 = src; +- tx_desc->flags = HSDMA_DESC_PLEN0(tlen); +- +- /* update index */ +- chan->tx_idx = HSDMA_NEXT_DESC(chan->tx_idx); +- } +- +- src += tlen; +- len -= tlen; +- } +- if (i & 0x1) +- tx_desc->flags |= HSDMA_DESC_LS0; +- else +- tx_desc->flags |= HSDMA_DESC_LS1; +- +- /* rx desc */ +- rx_idx = HSDMA_NEXT_DESC(chan->rx_idx); +- len = sg->len; +- dst = sg->dst_addr; +- for (i = 0; i < chan->desc->num_sgs; i++) { +- rx_desc = &chan->rx_ring[rx_idx]; +- if (len > HSDMA_MAX_PLEN) +- tlen = HSDMA_MAX_PLEN; +- else +- tlen = len; +- +- rx_desc->addr0 = dst; +- rx_desc->flags = HSDMA_DESC_PLEN0(tlen); +- +- dst += tlen; +- len -= tlen; +- +- /* update index */ +- rx_idx = HSDMA_NEXT_DESC(rx_idx); +- } +- +- /* make sure desc and index all up to date */ +- wmb(); +- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CTX, chan->tx_idx); +- +- return 0; +-} +- +-static int gdma_next_desc(struct mtk_hsdma_chan *chan) +-{ +- struct virt_dma_desc *vdesc; +- +- vdesc = vchan_next_desc(&chan->vchan); +- if (!vdesc) { +- chan->desc = NULL; +- return 0; +- } +- chan->desc = to_mtk_hsdma_desc(vdesc); +- chan->next_sg = 0; +- +- return 1; +-} +- +-static void mtk_hsdma_chan_done(struct mtk_hsdam_engine *hsdma, +- struct mtk_hsdma_chan *chan) +-{ +- struct mtk_hsdma_desc *desc; +- int chan_issued; +- +- chan_issued = 0; +- spin_lock_bh(&chan->vchan.lock); +- desc = chan->desc; +- if (likely(desc)) { +- if (chan->next_sg == desc->num_sgs) { +- list_del(&desc->vdesc.node); +- vchan_cookie_complete(&desc->vdesc); +- chan_issued = gdma_next_desc(chan); +- } +- } else { +- dev_dbg(hsdma->ddev.dev, "no desc to complete\n"); +- } +- +- if (chan_issued) +- set_bit(chan->id, &hsdma->chan_issued); +- spin_unlock_bh(&chan->vchan.lock); +-} +- +-static irqreturn_t mtk_hsdma_irq(int irq, void *devid) +-{ +- struct mtk_hsdam_engine *hsdma = devid; +- u32 status; +- +- status = mtk_hsdma_read(hsdma, HSDMA_REG_INT_STATUS); +- if (unlikely(!status)) +- return IRQ_NONE; +- +- if (likely(status & HSDMA_INT_RX_Q0)) +- tasklet_schedule(&hsdma->task); +- else +- dev_dbg(hsdma->ddev.dev, "unhandle irq status %08x\n", status); +- /* clean intr bits */ +- mtk_hsdma_write(hsdma, HSDMA_REG_INT_STATUS, status); +- +- return IRQ_HANDLED; +-} +- +-static void mtk_hsdma_issue_pending(struct dma_chan *c) +-{ +- struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c); +- struct mtk_hsdam_engine *hsdma = mtk_hsdma_chan_get_dev(chan); +- +- spin_lock_bh(&chan->vchan.lock); +- if (vchan_issue_pending(&chan->vchan) && !chan->desc) { +- if (gdma_next_desc(chan)) { +- set_bit(chan->id, &hsdma->chan_issued); +- tasklet_schedule(&hsdma->task); +- } else { +- dev_dbg(hsdma->ddev.dev, "no desc to issue\n"); +- } +- } +- spin_unlock_bh(&chan->vchan.lock); +-} +- +-static struct dma_async_tx_descriptor *mtk_hsdma_prep_dma_memcpy( +- struct dma_chan *c, dma_addr_t dest, dma_addr_t src, +- size_t len, unsigned long flags) +-{ +- struct mtk_hsdma_chan *chan = to_mtk_hsdma_chan(c); +- struct mtk_hsdma_desc *desc; +- +- if (len <= 0) +- return NULL; +- +- desc = kzalloc(sizeof(*desc), GFP_ATOMIC); +- if (!desc) { +- dev_err(c->device->dev, "alloc memcpy decs error\n"); +- return NULL; +- } +- +- desc->sg[0].src_addr = src; +- desc->sg[0].dst_addr = dest; +- desc->sg[0].len = len; +- +- return vchan_tx_prep(&chan->vchan, &desc->vdesc, flags); +-} +- +-static enum dma_status mtk_hsdma_tx_status(struct dma_chan *c, +- dma_cookie_t cookie, +- struct dma_tx_state *state) +-{ +- return dma_cookie_status(c, cookie, state); +-} +- +-static void mtk_hsdma_free_chan_resources(struct dma_chan *c) +-{ +- vchan_free_chan_resources(to_virt_chan(c)); +-} +- +-static void mtk_hsdma_desc_free(struct virt_dma_desc *vdesc) +-{ +- kfree(container_of(vdesc, struct mtk_hsdma_desc, vdesc)); +-} +- +-static void mtk_hsdma_tx(struct mtk_hsdam_engine *hsdma) +-{ +- struct mtk_hsdma_chan *chan; +- +- if (test_and_clear_bit(0, &hsdma->chan_issued)) { +- chan = &hsdma->chan[0]; +- if (chan->desc) +- mtk_hsdma_start_transfer(hsdma, chan); +- else +- dev_dbg(hsdma->ddev.dev, "chan 0 no desc to issue\n"); +- } +-} +- +-static void mtk_hsdma_rx(struct mtk_hsdam_engine *hsdma) +-{ +- struct mtk_hsdma_chan *chan; +- int next_idx, drx_idx, cnt; +- +- chan = &hsdma->chan[0]; +- next_idx = HSDMA_NEXT_DESC(chan->rx_idx); +- drx_idx = mtk_hsdma_read(hsdma, HSDMA_REG_RX_DRX); +- +- cnt = (drx_idx - next_idx) & HSDMA_DESCS_MASK; +- if (!cnt) +- return; +- +- chan->next_sg += cnt; +- chan->rx_idx = (chan->rx_idx + cnt) & HSDMA_DESCS_MASK; +- +- /* update rx crx */ +- wmb(); +- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CRX, chan->rx_idx); +- +- mtk_hsdma_chan_done(hsdma, chan); +-} +- +-static void mtk_hsdma_tasklet(struct tasklet_struct *t) +-{ +- struct mtk_hsdam_engine *hsdma = from_tasklet(hsdma, t, task); +- +- mtk_hsdma_rx(hsdma); +- mtk_hsdma_tx(hsdma); +-} +- +-static int mtk_hsdam_alloc_desc(struct mtk_hsdam_engine *hsdma, +- struct mtk_hsdma_chan *chan) +-{ +- int i; +- +- chan->tx_ring = dma_alloc_coherent(hsdma->ddev.dev, +- 2 * HSDMA_DESCS_NUM * +- sizeof(*chan->tx_ring), +- &chan->desc_addr, GFP_ATOMIC | __GFP_ZERO); +- if (!chan->tx_ring) +- goto no_mem; +- +- chan->rx_ring = &chan->tx_ring[HSDMA_DESCS_NUM]; +- +- /* init tx ring value */ +- for (i = 0; i < HSDMA_DESCS_NUM; i++) +- chan->tx_ring[i].flags = HSDMA_DESC_LS0 | HSDMA_DESC_DONE; +- +- return 0; +-no_mem: +- return -ENOMEM; +-} +- +-static void mtk_hsdam_free_desc(struct mtk_hsdam_engine *hsdma, +- struct mtk_hsdma_chan *chan) +-{ +- if (chan->tx_ring) { +- dma_free_coherent(hsdma->ddev.dev, +- 2 * HSDMA_DESCS_NUM * sizeof(*chan->tx_ring), +- chan->tx_ring, chan->desc_addr); +- chan->tx_ring = NULL; +- chan->rx_ring = NULL; +- } +-} +- +-static int mtk_hsdma_init(struct mtk_hsdam_engine *hsdma) +-{ +- struct mtk_hsdma_chan *chan; +- int ret; +- u32 reg; +- +- /* init desc */ +- chan = &hsdma->chan[0]; +- ret = mtk_hsdam_alloc_desc(hsdma, chan); +- if (ret) +- return ret; +- +- /* tx */ +- mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, chan->desc_addr); +- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, HSDMA_DESCS_NUM); +- /* rx */ +- mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, chan->desc_addr + +- (sizeof(struct hsdma_desc) * HSDMA_DESCS_NUM)); +- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, HSDMA_DESCS_NUM); +- /* reset */ +- mtk_hsdma_reset_chan(hsdma, chan); +- +- /* enable rx intr */ +- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, HSDMA_INT_RX_Q0); +- +- /* enable dma */ +- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, HSDMA_GLO_DEFAULT); +- +- /* hardware info */ +- reg = mtk_hsdma_read(hsdma, HSDMA_REG_INFO); +- dev_info(hsdma->ddev.dev, "rx: %d, tx: %d\n", +- (reg >> HSDMA_INFO_RX_SHIFT) & HSDMA_INFO_RX_MASK, +- (reg >> HSDMA_INFO_TX_SHIFT) & HSDMA_INFO_TX_MASK); +- +- hsdma_dump_reg(hsdma); +- +- return ret; +-} +- +-static void mtk_hsdma_uninit(struct mtk_hsdam_engine *hsdma) +-{ +- struct mtk_hsdma_chan *chan; +- +- /* disable dma */ +- mtk_hsdma_write(hsdma, HSDMA_REG_GLO_CFG, 0); +- +- /* disable intr */ +- mtk_hsdma_write(hsdma, HSDMA_REG_INT_MASK, 0); +- +- /* free desc */ +- chan = &hsdma->chan[0]; +- mtk_hsdam_free_desc(hsdma, chan); +- +- /* tx */ +- mtk_hsdma_write(hsdma, HSDMA_REG_TX_BASE, 0); +- mtk_hsdma_write(hsdma, HSDMA_REG_TX_CNT, 0); +- /* rx */ +- mtk_hsdma_write(hsdma, HSDMA_REG_RX_BASE, 0); +- mtk_hsdma_write(hsdma, HSDMA_REG_RX_CNT, 0); +- /* reset */ +- mtk_hsdma_reset_chan(hsdma, chan); +-} +- +-static const struct of_device_id mtk_hsdma_of_match[] = { +- { .compatible = "mediatek,mt7621-hsdma" }, +- { }, +-}; +- +-static int mtk_hsdma_probe(struct platform_device *pdev) +-{ +- const struct of_device_id *match; +- struct mtk_hsdma_chan *chan; +- struct mtk_hsdam_engine *hsdma; +- struct dma_device *dd; +- int ret; +- int irq; +- void __iomem *base; +- +- ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); +- if (ret) +- return ret; +- +- match = of_match_device(mtk_hsdma_of_match, &pdev->dev); +- if (!match) +- return -EINVAL; +- +- hsdma = devm_kzalloc(&pdev->dev, sizeof(*hsdma), GFP_KERNEL); +- if (!hsdma) +- return -EINVAL; +- +- base = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(base)) +- return PTR_ERR(base); +- hsdma->base = base + HSDMA_BASE_OFFSET; +- tasklet_setup(&hsdma->task, mtk_hsdma_tasklet); +- +- irq = platform_get_irq(pdev, 0); +- if (irq < 0) +- return -EINVAL; +- ret = devm_request_irq(&pdev->dev, irq, mtk_hsdma_irq, +- 0, dev_name(&pdev->dev), hsdma); +- if (ret) { +- dev_err(&pdev->dev, "failed to request irq\n"); +- return ret; +- } +- +- device_reset(&pdev->dev); +- +- dd = &hsdma->ddev; +- dma_cap_set(DMA_MEMCPY, dd->cap_mask); +- dd->copy_align = HSDMA_ALIGN_SIZE; +- dd->device_free_chan_resources = mtk_hsdma_free_chan_resources; +- dd->device_prep_dma_memcpy = mtk_hsdma_prep_dma_memcpy; +- dd->device_terminate_all = mtk_hsdma_terminate_all; +- dd->device_tx_status = mtk_hsdma_tx_status; +- dd->device_issue_pending = mtk_hsdma_issue_pending; +- dd->dev = &pdev->dev; +- dd->dev->dma_parms = &hsdma->dma_parms; +- dma_set_max_seg_size(dd->dev, HSDMA_MAX_PLEN); +- INIT_LIST_HEAD(&dd->channels); +- +- chan = &hsdma->chan[0]; +- chan->id = 0; +- chan->vchan.desc_free = mtk_hsdma_desc_free; +- vchan_init(&chan->vchan, dd); +- +- /* init hardware */ +- ret = mtk_hsdma_init(hsdma); +- if (ret) { +- dev_err(&pdev->dev, "failed to alloc ring descs\n"); +- return ret; +- } +- +- ret = dma_async_device_register(dd); +- if (ret) { +- dev_err(&pdev->dev, "failed to register dma device\n"); +- goto err_uninit_hsdma; +- } +- +- ret = of_dma_controller_register(pdev->dev.of_node, +- of_dma_xlate_by_chan_id, hsdma); +- if (ret) { +- dev_err(&pdev->dev, "failed to register of dma controller\n"); +- goto err_unregister; +- } +- +- platform_set_drvdata(pdev, hsdma); +- +- return 0; +- +-err_unregister: +- dma_async_device_unregister(dd); +-err_uninit_hsdma: +- mtk_hsdma_uninit(hsdma); +- return ret; +-} +- +-static int mtk_hsdma_remove(struct platform_device *pdev) +-{ +- struct mtk_hsdam_engine *hsdma = platform_get_drvdata(pdev); +- +- mtk_hsdma_uninit(hsdma); +- +- of_dma_controller_free(pdev->dev.of_node); +- dma_async_device_unregister(&hsdma->ddev); +- +- return 0; +-} +- +-static struct platform_driver mtk_hsdma_driver = { +- .probe = mtk_hsdma_probe, +- .remove = mtk_hsdma_remove, +- .driver = { +- .name = "hsdma-mt7621", +- .of_match_table = mtk_hsdma_of_match, +- }, +-}; +-module_platform_driver(mtk_hsdma_driver); +- +-MODULE_AUTHOR("Michael Lee "); +-MODULE_DESCRIPTION("MTK HSDMA driver"); +-MODULE_LICENSE("GPL v2"); diff --git a/queue-5.11/staging-rtl8188eu-add-edimax-ew-7811un-v2-to-device-table.patch b/queue-5.11/staging-rtl8188eu-add-edimax-ew-7811un-v2-to-device-table.patch new file mode 100644 index 00000000000..fede5233944 --- /dev/null +++ b/queue-5.11/staging-rtl8188eu-add-edimax-ew-7811un-v2-to-device-table.patch @@ -0,0 +1,30 @@ +From 7a8d2f1908a59003e55ef8691d09efb7fbc51625 Mon Sep 17 00:00:00 2001 +From: Martin Kaiser +Date: Thu, 4 Feb 2021 09:52:17 +0100 +Subject: staging: rtl8188eu: Add Edimax EW-7811UN V2 to device table + +From: Martin Kaiser + +commit 7a8d2f1908a59003e55ef8691d09efb7fbc51625 upstream. + +The Edimax EW-7811UN V2 uses an RTL8188EU chipset and works with this +driver. + +Signed-off-by: Martin Kaiser +Cc: stable +Link: https://lore.kernel.org/r/20210204085217.9743-1-martin@kaiser.cx +Signed-off-by: Greg Kroah-Hartman +--- + drivers/staging/rtl8188eu/os_dep/usb_intf.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -41,6 +41,7 @@ static const struct usb_device_id rtw_us + {USB_DEVICE(0x2357, 0x0111)}, /* TP-Link TL-WN727N v5.21 */ + {USB_DEVICE(0x2C4E, 0x0102)}, /* MERCUSYS MW150US v2 */ + {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ ++ {USB_DEVICE(0x7392, 0xb811)}, /* Edimax EW-7811UN V2 */ + {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ + {} /* Terminating entry */ + }; diff --git a/queue-5.11/tpm_tis-clean-up-locality-release.patch b/queue-5.11/tpm_tis-clean-up-locality-release.patch new file mode 100644 index 00000000000..092f5ae5d14 --- /dev/null +++ b/queue-5.11/tpm_tis-clean-up-locality-release.patch @@ -0,0 +1,95 @@ +From e42acf104d6e0bd7ccd2f09103d5be5e6d3c637c Mon Sep 17 00:00:00 2001 +From: James Bottomley +Date: Thu, 1 Oct 2020 11:09:22 -0700 +Subject: tpm_tis: Clean up locality release + +From: James Bottomley + +commit e42acf104d6e0bd7ccd2f09103d5be5e6d3c637c upstream. + +The current release locality code seems to be based on the +misunderstanding that the TPM interrupts when a locality is released: +it doesn't, only when the locality is acquired. + +Furthermore, there seems to be no point in waiting for the locality to +be released. All it does is penalize the last TPM user. However, if +there's no next TPM user, this is a pointless wait and if there is a +next TPM user, they'll pay the penalty waiting for the new locality +(or possibly not if it's the same as the old locality). + +Fix the code by making release_locality as simple write to release +with no waiting for completion. + +Cc: stable@ger.kernel.org +Fixes: 33bafe90824b ("tpm_tis: verify locality released before returning from release_locality") +Signed-off-by: James Bottomley +Reviewed-by: Jerry Snitselaar +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/tpm/tpm_tis_core.c | 47 ---------------------------------------- + 1 file changed, 1 insertion(+), 46 deletions(-) + +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -135,58 +135,13 @@ static bool check_locality(struct tpm_ch + return false; + } + +-static bool locality_inactive(struct tpm_chip *chip, int l) +-{ +- struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); +- int rc; +- u8 access; +- +- rc = tpm_tis_read8(priv, TPM_ACCESS(l), &access); +- if (rc < 0) +- return false; +- +- if ((access & (TPM_ACCESS_VALID | TPM_ACCESS_ACTIVE_LOCALITY)) +- == TPM_ACCESS_VALID) +- return true; +- +- return false; +-} +- + static int release_locality(struct tpm_chip *chip, int l) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); +- unsigned long stop, timeout; +- long rc; + + tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY); + +- stop = jiffies + chip->timeout_a; +- +- if (chip->flags & TPM_CHIP_FLAG_IRQ) { +-again: +- timeout = stop - jiffies; +- if ((long)timeout <= 0) +- return -1; +- +- rc = wait_event_interruptible_timeout(priv->int_queue, +- (locality_inactive(chip, l)), +- timeout); +- +- if (rc > 0) +- return 0; +- +- if (rc == -ERESTARTSYS && freezing(current)) { +- clear_thread_flag(TIF_SIGPENDING); +- goto again; +- } +- } else { +- do { +- if (locality_inactive(chip, l)) +- return 0; +- tpm_msleep(TPM_TIMEOUT); +- } while (time_before(jiffies, stop)); +- } +- return -1; ++ return 0; + } + + static int request_locality(struct tpm_chip *chip, int l) diff --git a/queue-5.11/tpm_tis-fix-check_locality-for-correct-locality-acquisition.patch b/queue-5.11/tpm_tis-fix-check_locality-for-correct-locality-acquisition.patch new file mode 100644 index 00000000000..54069870410 --- /dev/null +++ b/queue-5.11/tpm_tis-fix-check_locality-for-correct-locality-acquisition.patch @@ -0,0 +1,41 @@ +From 3d9ae54af1d02a7c0edc55c77d7df2b921e58a87 Mon Sep 17 00:00:00 2001 +From: James Bottomley +Date: Thu, 1 Oct 2020 11:09:21 -0700 +Subject: tpm_tis: Fix check_locality for correct locality acquisition + +From: James Bottomley + +commit 3d9ae54af1d02a7c0edc55c77d7df2b921e58a87 upstream. + +The TPM TIS specification says the TPM signals the acquisition of locality +when the TMP_ACCESS_REQUEST_USE bit goes to one *and* the +TPM_ACCESS_REQUEST_USE bit goes to zero. Currently we only check the +former not the latter, so check both. Adding the check on +TPM_ACCESS_REQUEST_USE should fix the case where the locality is +re-requested before the TPM has released it. In this case the locality may +get released briefly before it is reacquired, which causes all sorts of +problems. However, with the added check, TPM_ACCESS_REQUEST_USE should +remain 1 until the second request for the locality is granted. + +Cc: stable@ger.kernel.org +Fixes: 27084efee0c3 ("[PATCH] tpm: driver for next generation TPM chips") +Signed-off-by: James Bottomley +Reviewed-by: Jerry Snitselaar +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/char/tpm/tpm_tis_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -125,7 +125,8 @@ static bool check_locality(struct tpm_ch + if (rc < 0) + return false; + +- if ((access & (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) == ++ if ((access & (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID ++ | TPM_ACCESS_REQUEST_USE)) == + (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) { + priv->locality = l; + return true; diff --git a/queue-5.11/usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch b/queue-5.11/usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch new file mode 100644 index 00000000000..5a8f79f8c2d --- /dev/null +++ b/queue-5.11/usb-dwc3-gadget-fix-dep-interval-for-fullspeed-interrupt.patch @@ -0,0 +1,41 @@ +From 4b049f55ed95cd889bcdb3034fd75e1f01852b38 Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 8 Feb 2021 13:53:16 -0800 +Subject: usb: dwc3: gadget: Fix dep->interval for fullspeed interrupt + +From: Thinh Nguyen + +commit 4b049f55ed95cd889bcdb3034fd75e1f01852b38 upstream. + +The dep->interval captures the number of frames/microframes per interval +from bInterval. Fullspeed interrupt endpoint bInterval is the number of +frames per interval and not 2^(bInterval - 1). So fix it here. This +change is only for debugging purpose and should not affect the interrupt +endpoint operation. + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/1263b563dedc4ab8b0fb854fba06ce4bc56bd495.1612820995.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -615,8 +615,13 @@ static int dwc3_gadget_set_ep_config(str + if (dwc->gadget->speed == USB_SPEED_FULL) + bInterval_m1 = 0; + ++ if (usb_endpoint_type(desc) == USB_ENDPOINT_XFER_INT && ++ dwc->gadget->speed == USB_SPEED_FULL) ++ dep->interval = desc->bInterval; ++ else ++ dep->interval = 1 << (desc->bInterval - 1); ++ + params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1); +- dep->interval = 1 << (desc->bInterval - 1); + } + + return dwc3_send_gadget_ep_cmd(dep, DWC3_DEPCMD_SETEPCONFIG, ¶ms); diff --git a/queue-5.11/usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch b/queue-5.11/usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch new file mode 100644 index 00000000000..0c088129439 --- /dev/null +++ b/queue-5.11/usb-dwc3-gadget-fix-setting-of-depcfg.binterval_m1.patch @@ -0,0 +1,43 @@ +From a1679af85b2ae35a2b78ad04c18bb069c37330cc Mon Sep 17 00:00:00 2001 +From: Thinh Nguyen +Date: Mon, 8 Feb 2021 13:53:10 -0800 +Subject: usb: dwc3: gadget: Fix setting of DEPCFG.bInterval_m1 + +From: Thinh Nguyen + +commit a1679af85b2ae35a2b78ad04c18bb069c37330cc upstream. + +Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it must be set +to 0 when the controller operates in full-speed. See the programming +guide for DEPCFG command section 3.2.2.1 (v3.30a). + +Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver") +Cc: +Signed-off-by: Thinh Nguyen +Link: https://lore.kernel.org/r/3f57026f993c0ce71498dbb06e49b3a47c4d0265.1612820995.git.Thinh.Nguyen@synopsys.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/dwc3/gadget.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -605,7 +605,17 @@ static int dwc3_gadget_set_ep_config(str + params.param0 |= DWC3_DEPCFG_FIFO_NUMBER(dep->number >> 1); + + if (desc->bInterval) { +- params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(desc->bInterval - 1); ++ u8 bInterval_m1; ++ ++ /* ++ * Valid range for DEPCFG.bInterval_m1 is from 0 to 13, and it ++ * must be set to 0 when the controller operates in full-speed. ++ */ ++ bInterval_m1 = min_t(u8, desc->bInterval - 1, 13); ++ if (dwc->gadget->speed == USB_SPEED_FULL) ++ bInterval_m1 = 0; ++ ++ params.param1 |= DWC3_DEPCFG_BINTERVAL_M1(bInterval_m1); + dep->interval = 1 << (desc->bInterval - 1); + } + diff --git a/queue-5.11/usb-musb-fix-runtime-pm-race-in-musb_queue_resume_work.patch b/queue-5.11/usb-musb-fix-runtime-pm-race-in-musb_queue_resume_work.patch new file mode 100644 index 00000000000..37bbf717d2c --- /dev/null +++ b/queue-5.11/usb-musb-fix-runtime-pm-race-in-musb_queue_resume_work.patch @@ -0,0 +1,88 @@ +From 0eaa1a3714db34a59ce121de5733c3909c529463 Mon Sep 17 00:00:00 2001 +From: Paul Cercueil +Date: Sat, 23 Jan 2021 14:24:59 +0000 +Subject: usb: musb: Fix runtime PM race in musb_queue_resume_work + +From: Paul Cercueil + +commit 0eaa1a3714db34a59ce121de5733c3909c529463 upstream. + +musb_queue_resume_work() would call the provided callback if the runtime +PM status was 'active'. Otherwise, it would enqueue the request if the +hardware was still suspended (musb->is_runtime_suspended is true). + +This causes a race with the runtime PM handlers, as it is possible to be +in the case where the runtime PM status is not yet 'active', but the +hardware has been awaken (PM resume function has been called). + +When hitting the race, the resume work was not enqueued, which probably +triggered other bugs further down the stack. For instance, a telnet +connection on Ingenic SoCs would result in a 50/50 chance of a +segmentation fault somewhere in the musb code. + +Rework the code so that either we call the callback directly if +(musb->is_runtime_suspended == 0), or enqueue the query otherwise. + +Fixes: ea2f35c01d5e ("usb: musb: Fix sleeping function called from invalid context for hdrc glue") +Cc: stable@vger.kernel.org # v4.9+ +Tested-by: Tony Lindgren +Reviewed-by: Tony Lindgren +Signed-off-by: Paul Cercueil +Link: https://lore.kernel.org/r/20210123142502.16980-1-paul@crapouillou.net +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/musb/musb_core.c | 31 +++++++++++++++++-------------- + 1 file changed, 17 insertions(+), 14 deletions(-) + +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -2240,32 +2240,35 @@ int musb_queue_resume_work(struct musb * + { + struct musb_pending_work *w; + unsigned long flags; ++ bool is_suspended; + int error; + + if (WARN_ON(!callback)) + return -EINVAL; + +- if (pm_runtime_active(musb->controller)) +- return callback(musb, data); ++ spin_lock_irqsave(&musb->list_lock, flags); ++ is_suspended = musb->is_runtime_suspended; + +- w = devm_kzalloc(musb->controller, sizeof(*w), GFP_ATOMIC); +- if (!w) +- return -ENOMEM; ++ if (is_suspended) { ++ w = devm_kzalloc(musb->controller, sizeof(*w), GFP_ATOMIC); ++ if (!w) { ++ error = -ENOMEM; ++ goto out_unlock; ++ } ++ ++ w->callback = callback; ++ w->data = data; + +- w->callback = callback; +- w->data = data; +- spin_lock_irqsave(&musb->list_lock, flags); +- if (musb->is_runtime_suspended) { + list_add_tail(&w->node, &musb->pending_list); + error = 0; +- } else { +- dev_err(musb->controller, "could not add resume work %p\n", +- callback); +- devm_kfree(musb->controller, w); +- error = -EINPROGRESS; + } ++ ++out_unlock: + spin_unlock_irqrestore(&musb->list_lock, flags); + ++ if (!is_suspended) ++ error = callback(musb, data); ++ + return error; + } + EXPORT_SYMBOL_GPL(musb_queue_resume_work); diff --git a/queue-5.11/usb-serial-ftdi_sio-fix-ftx-sub-integer-prescaler.patch b/queue-5.11/usb-serial-ftdi_sio-fix-ftx-sub-integer-prescaler.patch new file mode 100644 index 00000000000..db59c4b3031 --- /dev/null +++ b/queue-5.11/usb-serial-ftdi_sio-fix-ftx-sub-integer-prescaler.patch @@ -0,0 +1,37 @@ +From 528222d0c8ce93e435a95cd1e476b60409dd5381 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 26 Jan 2021 14:59:17 +0100 +Subject: USB: serial: ftdi_sio: fix FTX sub-integer prescaler + +From: Johan Hovold + +commit 528222d0c8ce93e435a95cd1e476b60409dd5381 upstream. + +The most-significant bit of the sub-integer-prescaler index is set in +the high byte of the baudrate request wIndex also for FTX devices. + +This fixes rates like 1152000 which got mapped to 1.2 MBd. + +Reported-by: Vladimir +Link: https://bugzilla.kernel.org/show_bug.cgi?id=210351 +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/ftdi_sio.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1386,8 +1386,9 @@ static int change_speed(struct tty_struc + index_value = get_ftdi_divisor(tty, port); + value = (u16)index_value; + index = (u16)(index_value >> 16); +- if ((priv->chip_type == FT2232C) || (priv->chip_type == FT2232H) || +- (priv->chip_type == FT4232H) || (priv->chip_type == FT232H)) { ++ if (priv->chip_type == FT2232C || priv->chip_type == FT2232H || ++ priv->chip_type == FT4232H || priv->chip_type == FT232H || ++ priv->chip_type == FTX) { + /* Probably the BM type needs the MSB of the encoded fractional + * divider also moved like for the chips above. Any infos? */ + index = (u16)((index << 8) | priv->interface); diff --git a/queue-5.11/usb-serial-mos7720-fix-error-code-in-mos7720_write.patch b/queue-5.11/usb-serial-mos7720-fix-error-code-in-mos7720_write.patch new file mode 100644 index 00000000000..4cb2e7e1575 --- /dev/null +++ b/queue-5.11/usb-serial-mos7720-fix-error-code-in-mos7720_write.patch @@ -0,0 +1,35 @@ +From fea7372cbc40869876df0f045e367f6f97a1666c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 28 Jan 2021 12:35:23 +0300 +Subject: USB: serial: mos7720: fix error code in mos7720_write() + +From: Dan Carpenter + +commit fea7372cbc40869876df0f045e367f6f97a1666c upstream. + +This code should return -ENOMEM if the kmalloc() fails but instead +it returns success. + +Signed-off-by: Dan Carpenter +Fixes: 0f64478cbc7a ("USB: add USB serial mos7720 driver") +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/mos7720.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -1092,8 +1092,10 @@ static int mos7720_write(struct tty_stru + if (urb->transfer_buffer == NULL) { + urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, + GFP_ATOMIC); +- if (!urb->transfer_buffer) ++ if (!urb->transfer_buffer) { ++ bytes_sent = -ENOMEM; + goto exit; ++ } + } + transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE); + diff --git a/queue-5.11/usb-serial-mos7840-fix-error-code-in-mos7840_write.patch b/queue-5.11/usb-serial-mos7840-fix-error-code-in-mos7840_write.patch new file mode 100644 index 00000000000..e30101eb5d2 --- /dev/null +++ b/queue-5.11/usb-serial-mos7840-fix-error-code-in-mos7840_write.patch @@ -0,0 +1,34 @@ +From a70aa7dc60099bbdcbd6faca42a915d80f31161e Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Tue, 26 Jan 2021 13:26:54 +0300 +Subject: USB: serial: mos7840: fix error code in mos7840_write() + +From: Dan Carpenter + +commit a70aa7dc60099bbdcbd6faca42a915d80f31161e upstream. + +This should return -ENOMEM instead of 0 if the kmalloc() fails. + +Fixes: 3f5429746d91 ("USB: Moschip 7840 USB-Serial Driver") +Signed-off-by: Dan Carpenter +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/mos7840.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -883,8 +883,10 @@ static int mos7840_write(struct tty_stru + if (urb->transfer_buffer == NULL) { + urb->transfer_buffer = kmalloc(URB_TRANSFER_BUFFER_SIZE, + GFP_ATOMIC); +- if (!urb->transfer_buffer) ++ if (!urb->transfer_buffer) { ++ bytes_sent = -ENOMEM; + goto exit; ++ } + } + transfer_size = min(count, URB_TRANSFER_BUFFER_SIZE); + diff --git a/queue-5.11/usb-serial-option-update-interface-mapping-for-zte-p685m.patch b/queue-5.11/usb-serial-option-update-interface-mapping-for-zte-p685m.patch new file mode 100644 index 00000000000..fb4465055b7 --- /dev/null +++ b/queue-5.11/usb-serial-option-update-interface-mapping-for-zte-p685m.patch @@ -0,0 +1,78 @@ +From 6420a569504e212d618d4a4736e2c59ed80a8478 Mon Sep 17 00:00:00 2001 +From: Lech Perczak +Date: Sun, 7 Feb 2021 01:54:43 +0100 +Subject: USB: serial: option: update interface mapping for ZTE P685M +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lech Perczak + +commit 6420a569504e212d618d4a4736e2c59ed80a8478 upstream. + +This patch prepares for qmi_wwan driver support for the device. +Previously "option" driver mapped itself to interfaces 0 and 3 (matching +ff/ff/ff), while interface 3 is in fact a QMI port. +Interfaces 1 and 2 (matching ff/00/00) expose AT commands, +and weren't supported previously at all. +Without this patch, a possible conflict would exist if device ID was +added to qmi_wwan driver for interface 3. + +Update and simplify device ID to match interfaces 0-2 directly, +to expose QCDM (0), PCUI (1), and modem (2) ports and avoid conflict +with QMI (3), and ADB (4). + +The modem is used inside ZTE MF283+ router and carriers identify it as +such. +Interface mapping is: +0: QCDM, 1: AT (PCUI), 2: AT (Modem), 3: QMI, 4: ADB + +T: Bus=02 Lev=02 Prnt=02 Port=05 Cnt=01 Dev#= 3 Spd=480 MxCh= 0 +D: Ver= 2.01 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1 +P: Vendor=19d2 ProdID=1275 Rev=f0.00 +S: Manufacturer=ZTE,Incorporated +S: Product=ZTE Technologies MSM +S: SerialNumber=P685M510ZTED0000CP&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&0 +C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA +I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option +E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option +E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms +E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan +E: Ad=87(I) Atr=03(Int.) MxPS= 8 Ivl=32ms +E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms +I:* If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none) +E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms +E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms + +Cc: Johan Hovold +Cc: Bjørn Mork +Signed-off-by: Lech Perczak +Link: https://lore.kernel.org/r/20210207005443.12936-1-lech.perczak@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/option.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1569,7 +1569,8 @@ static const struct usb_device_id option + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1272, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1273, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1274, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1275, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE(ZTE_VENDOR_ID, 0x1275), /* ZTE P685M */ ++ .driver_info = RSVD(3) | RSVD(4) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1276, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1277, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1278, 0xff, 0xff, 0xff) }, diff --git a/queue-5.11/usb-serial-pl2303-fix-line-speed-handling-on-newer-chips.patch b/queue-5.11/usb-serial-pl2303-fix-line-speed-handling-on-newer-chips.patch new file mode 100644 index 00000000000..4c82293956f --- /dev/null +++ b/queue-5.11/usb-serial-pl2303-fix-line-speed-handling-on-newer-chips.patch @@ -0,0 +1,57 @@ +From 979d9cbe75b922ab1695b8ad5576115774f72e62 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Mon, 11 Jan 2021 18:00:19 +0100 +Subject: USB: serial: pl2303: fix line-speed handling on newer chips + +From: Johan Hovold + +commit 979d9cbe75b922ab1695b8ad5576115774f72e62 upstream. + +The latest chip family (HXN) apparently does not support setting the +line speed using divisors and instead needs to use the direct encoding +scheme for all rates. + +This specifically enables 50, 110, 134, 200 bps and other rates not +supported by the original chip type. + +Fixes: ebd09f1cd417 ("USB: serial: pl2303: add support for PL2303HXN") +Cc: stable@vger.kernel.org # 5.5 +Cc: Charles Yeh +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman +--- + drivers/usb/serial/pl2303.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -183,6 +183,7 @@ struct pl2303_type_data { + speed_t max_baud_rate; + unsigned long quirks; + unsigned int no_autoxonxoff:1; ++ unsigned int no_divisors:1; + }; + + struct pl2303_serial_private { +@@ -209,6 +210,7 @@ static const struct pl2303_type_data pl2 + }, + [TYPE_HXN] = { + .max_baud_rate = 12000000, ++ .no_divisors = true, + }, + }; + +@@ -571,8 +573,12 @@ static void pl2303_encode_baud_rate(stru + baud = min_t(speed_t, baud, spriv->type->max_baud_rate); + /* + * Use direct method for supported baud rates, otherwise use divisors. ++ * Newer chip types do not support divisor encoding. + */ +- baud_sup = pl2303_get_supported_baud_rate(baud); ++ if (spriv->type->no_divisors) ++ baud_sup = baud; ++ else ++ baud_sup = pl2303_get_supported_baud_rate(baud); + + if (baud == baud_sup) + baud = pl2303_encode_baud_rate_direct(buf, baud); -- 2.47.3