From e5c7c79e6ec58e112a33fa93d0bb50664b9ebfd5 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 17 Feb 2022 20:33:52 +0100 Subject: [PATCH] 5.15-stable patches added patches: btrfs-send-in-case-of-io-error-log-it.patch btrfs-zoned-cache-reported-zone-during-mount.patch drm-nouveau-pmu-gm200-use-alternate-falcon-reset-sequence.patch fs-proc-task_mmu.c-don-t-read-mapcount-for-migration-entry.patch hid-add-support-for-ugtablet-wp5540.patch hid-amd_sfh-add-illuminance-mask-to-limit-als-max-value.patch hid-amd_sfh-correct-the-structure-field-name.patch hid-amd_sfh-increase-sensor-command-timeout.patch hid-i2c-hid-goodix-fix-a-lockdep-splat.patch mm-don-t-try-to-numa-migrate-cow-pages-that-have-other-uses.patch mmc-block-fix-read-single-on-recovery-logic.patch parisc-add-ioread64_lo_hi-and-iowrite64_lo_hi.patch parisc-drop-__init-from-map_pages-declaration.patch parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch parisc-fix-sglist-access-in-ccio-dma.c.patch parisc-show-error-if-wrong-32-64-bit-compiler-is-being-used.patch pci-hv-fix-numa-node-assignment-when-kernel-boots-with-custom-numa-topology.patch revert-svm-add-warning-message-for-avic-ipi-invalid-target.patch scsi-lpfc-fix-mailbox-command-failure-during-driver-initialization.patch serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch --- ...trfs-send-in-case-of-io-error-log-it.patch | 38 +++ ...ned-cache-reported-zone-during-mount.patch | 290 ++++++++++++++++++ ...-use-alternate-falcon-reset-sequence.patch | 126 ++++++++ ...-t-read-mapcount-for-migration-entry.patch | 231 ++++++++++++++ .../hid-add-support-for-ugtablet-wp5540.patch | 43 +++ ...uminance-mask-to-limit-als-max-value.patch | 41 +++ ...sfh-correct-the-structure-field-name.patch | 31 ++ ..._sfh-increase-sensor-command-timeout.patch | 36 +++ ...d-i2c-hid-goodix-fix-a-lockdep-splat.patch | 176 +++++++++++ ...grate-cow-pages-that-have-other-uses.patch | 75 +++++ ...ck-fix-read-single-on-recovery-logic.patch | 83 +++++ ...d-ioread64_lo_hi-and-iowrite64_lo_hi.patch | 70 +++++ ...op-__init-from-map_pages-declaration.patch | 61 ++++ ...sc-fix-data-tlb-miss-in-sba_unmap_sg.patch | 86 ++++++ ...risc-fix-sglist-access-in-ccio-dma.c.patch | 39 +++ ...ong-32-64-bit-compiler-is-being-used.patch | 42 +++ ...rnel-boots-with-custom-numa-topology.patch | 49 +++ ...-message-for-avic-ipi-invalid-target.patch | 38 +++ ...failure-during-driver-initialization.patch | 77 +++++ ...sc-fix-build-when-iosapic-is-not-set.patch | 54 ++++ queue-5.15/series | 20 ++ 21 files changed, 1706 insertions(+) create mode 100644 queue-5.15/btrfs-send-in-case-of-io-error-log-it.patch create mode 100644 queue-5.15/btrfs-zoned-cache-reported-zone-during-mount.patch create mode 100644 queue-5.15/drm-nouveau-pmu-gm200-use-alternate-falcon-reset-sequence.patch create mode 100644 queue-5.15/fs-proc-task_mmu.c-don-t-read-mapcount-for-migration-entry.patch create mode 100644 queue-5.15/hid-add-support-for-ugtablet-wp5540.patch create mode 100644 queue-5.15/hid-amd_sfh-add-illuminance-mask-to-limit-als-max-value.patch create mode 100644 queue-5.15/hid-amd_sfh-correct-the-structure-field-name.patch create mode 100644 queue-5.15/hid-amd_sfh-increase-sensor-command-timeout.patch create mode 100644 queue-5.15/hid-i2c-hid-goodix-fix-a-lockdep-splat.patch create mode 100644 queue-5.15/mm-don-t-try-to-numa-migrate-cow-pages-that-have-other-uses.patch create mode 100644 queue-5.15/mmc-block-fix-read-single-on-recovery-logic.patch create mode 100644 queue-5.15/parisc-add-ioread64_lo_hi-and-iowrite64_lo_hi.patch create mode 100644 queue-5.15/parisc-drop-__init-from-map_pages-declaration.patch create mode 100644 queue-5.15/parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch create mode 100644 queue-5.15/parisc-fix-sglist-access-in-ccio-dma.c.patch create mode 100644 queue-5.15/parisc-show-error-if-wrong-32-64-bit-compiler-is-being-used.patch create mode 100644 queue-5.15/pci-hv-fix-numa-node-assignment-when-kernel-boots-with-custom-numa-topology.patch create mode 100644 queue-5.15/revert-svm-add-warning-message-for-avic-ipi-invalid-target.patch create mode 100644 queue-5.15/scsi-lpfc-fix-mailbox-command-failure-during-driver-initialization.patch create mode 100644 queue-5.15/serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch create mode 100644 queue-5.15/series diff --git a/queue-5.15/btrfs-send-in-case-of-io-error-log-it.patch b/queue-5.15/btrfs-send-in-case-of-io-error-log-it.patch new file mode 100644 index 00000000000..cf89d85e8d5 --- /dev/null +++ b/queue-5.15/btrfs-send-in-case-of-io-error-log-it.patch @@ -0,0 +1,38 @@ +From 2e7be9db125a0bf940c5d65eb5c40d8700f738b5 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?D=C4=81vis=20Mos=C4=81ns?= +Date: Sat, 5 Feb 2022 20:48:23 +0200 +Subject: btrfs: send: in case of IO error log it +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dāvis Mosāns + +commit 2e7be9db125a0bf940c5d65eb5c40d8700f738b5 upstream. + +Currently if we get IO error while doing send then we abort without +logging information about which file caused issue. So log it to help +with debugging. + +CC: stable@vger.kernel.org # 4.9+ +Signed-off-by: Dāvis Mosāns +Reviewed-by: David Sterba +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/send.c | 4 ++++ + 1 file changed, 4 insertions(+) + +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -4978,6 +4978,10 @@ static int put_file_data(struct send_ctx + lock_page(page); + if (!PageUptodate(page)) { + unlock_page(page); ++ btrfs_err(fs_info, ++ "send: IO error at offset %llu for inode %llu root %llu", ++ page_offset(page), sctx->cur_ino, ++ sctx->send_root->root_key.objectid); + put_page(page); + ret = -EIO; + break; diff --git a/queue-5.15/btrfs-zoned-cache-reported-zone-during-mount.patch b/queue-5.15/btrfs-zoned-cache-reported-zone-during-mount.patch new file mode 100644 index 00000000000..db038234f5c --- /dev/null +++ b/queue-5.15/btrfs-zoned-cache-reported-zone-during-mount.patch @@ -0,0 +1,290 @@ +From 16beac87e95e2fb278b552397c8260637f8a63f7 Mon Sep 17 00:00:00 2001 +From: Naohiro Aota +Date: Thu, 11 Nov 2021 14:14:38 +0900 +Subject: btrfs: zoned: cache reported zone during mount + +From: Naohiro Aota + +commit 16beac87e95e2fb278b552397c8260637f8a63f7 upstream. + +When mounting a device, we are reporting the zones twice: once for +checking the zone attributes in btrfs_get_dev_zone_info and once for +loading block groups' zone info in +btrfs_load_block_group_zone_info(). With a lot of block groups, that +leads to a lot of REPORT ZONE commands and slows down the mount +process. + +This patch introduces a zone info cache in struct +btrfs_zoned_device_info. The cache is populated while in +btrfs_get_dev_zone_info() and used for +btrfs_load_block_group_zone_info() to reduce the number of REPORT ZONE +commands. The zone cache is then released after loading the block +groups, as it will not be much effective during the run time. + +Benchmark: Mount an HDD with 57,007 block groups +Before patch: 171.368 seconds +After patch: 64.064 seconds + +While it still takes a minute due to the slowness of loading all the +block groups, the patch reduces the mount time by 1/3. + +Link: https://lore.kernel.org/linux-btrfs/CAHQ7scUiLtcTqZOMMY5kbWUBOhGRwKo6J6wYPT5WY+C=cD49nQ@mail.gmail.com/ +Fixes: 5b316468983d ("btrfs: get zone information of zoned block devices") +CC: stable@vger.kernel.org +Signed-off-by: Naohiro Aota +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman +--- + fs/btrfs/dev-replace.c | 2 - + fs/btrfs/disk-io.c | 2 + + fs/btrfs/volumes.c | 2 - + fs/btrfs/zoned.c | 85 ++++++++++++++++++++++++++++++++++++++++++++----- + fs/btrfs/zoned.h | 8 +++- + 5 files changed, 87 insertions(+), 12 deletions(-) + +--- a/fs/btrfs/dev-replace.c ++++ b/fs/btrfs/dev-replace.c +@@ -325,7 +325,7 @@ static int btrfs_init_dev_replace_tgtdev + set_blocksize(device->bdev, BTRFS_BDEV_BLOCKSIZE); + device->fs_devices = fs_info->fs_devices; + +- ret = btrfs_get_dev_zone_info(device); ++ ret = btrfs_get_dev_zone_info(device, false); + if (ret) + goto error; + +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -3565,6 +3565,8 @@ int __cold open_ctree(struct super_block + goto fail_sysfs; + } + ++ btrfs_free_zone_cache(fs_info); ++ + if (!sb_rdonly(sb) && fs_info->fs_devices->missing_devices && + !btrfs_check_rw_degradable(fs_info, NULL)) { + btrfs_warn(fs_info, +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -2596,7 +2596,7 @@ int btrfs_init_new_device(struct btrfs_f + device->fs_info = fs_info; + device->bdev = bdev; + +- ret = btrfs_get_dev_zone_info(device); ++ ret = btrfs_get_dev_zone_info(device, false); + if (ret) + goto error_free_device; + +--- a/fs/btrfs/zoned.c ++++ b/fs/btrfs/zoned.c +@@ -4,6 +4,7 @@ + #include + #include + #include ++#include + #include "ctree.h" + #include "volumes.h" + #include "zoned.h" +@@ -195,6 +196,8 @@ static int emulate_report_zones(struct b + static int btrfs_get_dev_zones(struct btrfs_device *device, u64 pos, + struct blk_zone *zones, unsigned int *nr_zones) + { ++ struct btrfs_zoned_device_info *zinfo = device->zone_info; ++ u32 zno; + int ret; + + if (!*nr_zones) +@@ -206,6 +209,34 @@ static int btrfs_get_dev_zones(struct bt + return 0; + } + ++ /* Check cache */ ++ if (zinfo->zone_cache) { ++ unsigned int i; ++ ++ ASSERT(IS_ALIGNED(pos, zinfo->zone_size)); ++ zno = pos >> zinfo->zone_size_shift; ++ /* ++ * We cannot report zones beyond the zone end. So, it is OK to ++ * cap *nr_zones to at the end. ++ */ ++ *nr_zones = min_t(u32, *nr_zones, zinfo->nr_zones - zno); ++ ++ for (i = 0; i < *nr_zones; i++) { ++ struct blk_zone *zone_info; ++ ++ zone_info = &zinfo->zone_cache[zno + i]; ++ if (!zone_info->len) ++ break; ++ } ++ ++ if (i == *nr_zones) { ++ /* Cache hit on all the zones */ ++ memcpy(zones, zinfo->zone_cache + zno, ++ sizeof(*zinfo->zone_cache) * *nr_zones); ++ return 0; ++ } ++ } ++ + ret = blkdev_report_zones(device->bdev, pos >> SECTOR_SHIFT, *nr_zones, + copy_zone_info_cb, zones); + if (ret < 0) { +@@ -219,6 +250,11 @@ static int btrfs_get_dev_zones(struct bt + if (!ret) + return -EIO; + ++ /* Populate cache */ ++ if (zinfo->zone_cache) ++ memcpy(zinfo->zone_cache + zno, zones, ++ sizeof(*zinfo->zone_cache) * *nr_zones); ++ + return 0; + } + +@@ -282,7 +318,7 @@ int btrfs_get_dev_zone_info_all_devices( + if (!device->bdev) + continue; + +- ret = btrfs_get_dev_zone_info(device); ++ ret = btrfs_get_dev_zone_info(device, true); + if (ret) + break; + } +@@ -291,7 +327,7 @@ int btrfs_get_dev_zone_info_all_devices( + return ret; + } + +-int btrfs_get_dev_zone_info(struct btrfs_device *device) ++int btrfs_get_dev_zone_info(struct btrfs_device *device, bool populate_cache) + { + struct btrfs_fs_info *fs_info = device->fs_info; + struct btrfs_zoned_device_info *zone_info = NULL; +@@ -318,6 +354,8 @@ int btrfs_get_dev_zone_info(struct btrfs + if (!zone_info) + return -ENOMEM; + ++ device->zone_info = zone_info; ++ + if (!bdev_is_zoned(bdev)) { + if (!fs_info->zone_size) { + ret = calculate_emulated_zone_size(fs_info); +@@ -369,6 +407,23 @@ int btrfs_get_dev_zone_info(struct btrfs + goto out; + } + ++ /* ++ * Enable zone cache only for a zoned device. On a non-zoned device, we ++ * fill the zone info with emulated CONVENTIONAL zones, so no need to ++ * use the cache. ++ */ ++ if (populate_cache && bdev_is_zoned(device->bdev)) { ++ zone_info->zone_cache = vzalloc(sizeof(struct blk_zone) * ++ zone_info->nr_zones); ++ if (!zone_info->zone_cache) { ++ btrfs_err_in_rcu(device->fs_info, ++ "zoned: failed to allocate zone cache for %s", ++ rcu_str_deref(device->name)); ++ ret = -ENOMEM; ++ goto out; ++ } ++ } ++ + /* Get zones type */ + while (sector < nr_sectors) { + nr_zones = BTRFS_REPORT_NR_ZONES; +@@ -444,8 +499,6 @@ int btrfs_get_dev_zone_info(struct btrfs + + kfree(zones); + +- device->zone_info = zone_info; +- + switch (bdev_zoned_model(bdev)) { + case BLK_ZONED_HM: + model = "host-managed zoned"; +@@ -478,10 +531,7 @@ int btrfs_get_dev_zone_info(struct btrfs + out: + kfree(zones); + out_free_zone_info: +- bitmap_free(zone_info->empty_zones); +- bitmap_free(zone_info->seq_zones); +- kfree(zone_info); +- device->zone_info = NULL; ++ btrfs_destroy_dev_zone_info(device); + + return ret; + } +@@ -495,6 +545,7 @@ void btrfs_destroy_dev_zone_info(struct + + bitmap_free(zone_info->seq_zones); + bitmap_free(zone_info->empty_zones); ++ vfree(zone_info->zone_cache); + kfree(zone_info); + device->zone_info = NULL; + } +@@ -1551,3 +1602,21 @@ void btrfs_clear_data_reloc_bg(struct bt + fs_info->data_reloc_bg = 0; + spin_unlock(&fs_info->relocation_bg_lock); + } ++ ++void btrfs_free_zone_cache(struct btrfs_fs_info *fs_info) ++{ ++ struct btrfs_fs_devices *fs_devices = fs_info->fs_devices; ++ struct btrfs_device *device; ++ ++ if (!btrfs_is_zoned(fs_info)) ++ return; ++ ++ mutex_lock(&fs_devices->device_list_mutex); ++ list_for_each_entry(device, &fs_devices->devices, dev_list) { ++ if (device->zone_info) { ++ vfree(device->zone_info->zone_cache); ++ device->zone_info->zone_cache = NULL; ++ } ++ } ++ mutex_unlock(&fs_devices->device_list_mutex); ++} +--- a/fs/btrfs/zoned.h ++++ b/fs/btrfs/zoned.h +@@ -25,6 +25,7 @@ struct btrfs_zoned_device_info { + u32 nr_zones; + unsigned long *seq_zones; + unsigned long *empty_zones; ++ struct blk_zone *zone_cache; + struct blk_zone sb_zones[2 * BTRFS_SUPER_MIRROR_MAX]; + }; + +@@ -32,7 +33,7 @@ struct btrfs_zoned_device_info { + int btrfs_get_dev_zone(struct btrfs_device *device, u64 pos, + struct blk_zone *zone); + int btrfs_get_dev_zone_info_all_devices(struct btrfs_fs_info *fs_info); +-int btrfs_get_dev_zone_info(struct btrfs_device *device); ++int btrfs_get_dev_zone_info(struct btrfs_device *device, bool populate_cache); + void btrfs_destroy_dev_zone_info(struct btrfs_device *device); + int btrfs_check_zoned_mode(struct btrfs_fs_info *fs_info); + int btrfs_check_mountopts_zoned(struct btrfs_fs_info *info); +@@ -67,6 +68,7 @@ int btrfs_sync_zone_write_pointer(struct + struct btrfs_device *btrfs_zoned_get_device(struct btrfs_fs_info *fs_info, + u64 logical, u64 length); + void btrfs_clear_data_reloc_bg(struct btrfs_block_group *bg); ++void btrfs_free_zone_cache(struct btrfs_fs_info *fs_info); + #else /* CONFIG_BLK_DEV_ZONED */ + static inline int btrfs_get_dev_zone(struct btrfs_device *device, u64 pos, + struct blk_zone *zone) +@@ -79,7 +81,8 @@ static inline int btrfs_get_dev_zone_inf + return 0; + } + +-static inline int btrfs_get_dev_zone_info(struct btrfs_device *device) ++static inline int btrfs_get_dev_zone_info(struct btrfs_device *device, ++ bool populate_cache) + { + return 0; + } +@@ -202,6 +205,7 @@ static inline struct btrfs_device *btrfs + + static inline void btrfs_clear_data_reloc_bg(struct btrfs_block_group *bg) { } + ++static inline void btrfs_free_zone_cache(struct btrfs_fs_info *fs_info) { } + #endif + + static inline bool btrfs_dev_is_sequential(struct btrfs_device *device, u64 pos) diff --git a/queue-5.15/drm-nouveau-pmu-gm200-use-alternate-falcon-reset-sequence.patch b/queue-5.15/drm-nouveau-pmu-gm200-use-alternate-falcon-reset-sequence.patch new file mode 100644 index 00000000000..3ea24c844f1 --- /dev/null +++ b/queue-5.15/drm-nouveau-pmu-gm200-use-alternate-falcon-reset-sequence.patch @@ -0,0 +1,126 @@ +From 4cdd2450bf739bada353e82d27b00db9af8c3001 Mon Sep 17 00:00:00 2001 +From: Ben Skeggs +Date: Thu, 25 Feb 2021 14:54:59 +1000 +Subject: drm/nouveau/pmu/gm200-: use alternate falcon reset sequence + +From: Ben Skeggs + +commit 4cdd2450bf739bada353e82d27b00db9af8c3001 upstream. + +Signed-off-by: Ben Skeggs +Reviewed-by: Karol Herbst +Signed-off-by: Karol Herbst +Link: https://gitlab.freedesktop.org/drm/nouveau/-/merge_requests/10 +Signed-off-by: Greg Kroah-Hartman +--- + drivers/gpu/drm/nouveau/nvkm/falcon/base.c | 8 ++++-- + drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm200.c | 31 +++++++++++++++++++++++- + drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c | 2 - + drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c | 2 - + drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c | 2 - + drivers/gpu/drm/nouveau/nvkm/subdev/pmu/priv.h | 2 + + 6 files changed, 41 insertions(+), 6 deletions(-) + +--- a/drivers/gpu/drm/nouveau/nvkm/falcon/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/falcon/base.c +@@ -117,8 +117,12 @@ nvkm_falcon_disable(struct nvkm_falcon * + int + nvkm_falcon_reset(struct nvkm_falcon *falcon) + { +- nvkm_falcon_disable(falcon); +- return nvkm_falcon_enable(falcon); ++ if (!falcon->func->reset) { ++ nvkm_falcon_disable(falcon); ++ return nvkm_falcon_enable(falcon); ++ } ++ ++ return falcon->func->reset(falcon); + } + + int +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm200.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm200.c +@@ -23,9 +23,38 @@ + */ + #include "priv.h" + ++static int ++gm200_pmu_flcn_reset(struct nvkm_falcon *falcon) ++{ ++ struct nvkm_pmu *pmu = container_of(falcon, typeof(*pmu), falcon); ++ ++ nvkm_falcon_wr32(falcon, 0x014, 0x0000ffff); ++ pmu->func->reset(pmu); ++ return nvkm_falcon_enable(falcon); ++} ++ ++const struct nvkm_falcon_func ++gm200_pmu_flcn = { ++ .debug = 0xc08, ++ .fbif = 0xe00, ++ .load_imem = nvkm_falcon_v1_load_imem, ++ .load_dmem = nvkm_falcon_v1_load_dmem, ++ .read_dmem = nvkm_falcon_v1_read_dmem, ++ .bind_context = nvkm_falcon_v1_bind_context, ++ .wait_for_halt = nvkm_falcon_v1_wait_for_halt, ++ .clear_interrupt = nvkm_falcon_v1_clear_interrupt, ++ .set_start_addr = nvkm_falcon_v1_set_start_addr, ++ .start = nvkm_falcon_v1_start, ++ .enable = nvkm_falcon_v1_enable, ++ .disable = nvkm_falcon_v1_disable, ++ .reset = gm200_pmu_flcn_reset, ++ .cmdq = { 0x4a0, 0x4b0, 4 }, ++ .msgq = { 0x4c8, 0x4cc, 0 }, ++}; ++ + static const struct nvkm_pmu_func + gm200_pmu = { +- .flcn = >215_pmu_flcn, ++ .flcn = &gm200_pmu_flcn, + .enabled = gf100_pmu_enabled, + .reset = gf100_pmu_reset, + }; +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gm20b.c +@@ -211,7 +211,7 @@ gm20b_pmu_recv(struct nvkm_pmu *pmu) + + static const struct nvkm_pmu_func + gm20b_pmu = { +- .flcn = >215_pmu_flcn, ++ .flcn = &gm200_pmu_flcn, + .enabled = gf100_pmu_enabled, + .intr = gt215_pmu_intr, + .recv = gm20b_pmu_recv, +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp102.c +@@ -39,7 +39,7 @@ gp102_pmu_enabled(struct nvkm_pmu *pmu) + + static const struct nvkm_pmu_func + gp102_pmu = { +- .flcn = >215_pmu_flcn, ++ .flcn = &gm200_pmu_flcn, + .enabled = gp102_pmu_enabled, + .reset = gp102_pmu_reset, + }; +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/gp10b.c +@@ -78,7 +78,7 @@ gp10b_pmu_acr = { + + static const struct nvkm_pmu_func + gp10b_pmu = { +- .flcn = >215_pmu_flcn, ++ .flcn = &gm200_pmu_flcn, + .enabled = gf100_pmu_enabled, + .intr = gt215_pmu_intr, + .recv = gm20b_pmu_recv, +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/priv.h ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/priv.h +@@ -44,6 +44,8 @@ void gf100_pmu_reset(struct nvkm_pmu *); + + void gk110_pmu_pgob(struct nvkm_pmu *, bool); + ++extern const struct nvkm_falcon_func gm200_pmu_flcn; ++ + void gm20b_pmu_acr_bld_patch(struct nvkm_acr *, u32, s64); + void gm20b_pmu_acr_bld_write(struct nvkm_acr *, u32, struct nvkm_acr_lsfw *); + int gm20b_pmu_acr_boot(struct nvkm_falcon *); diff --git a/queue-5.15/fs-proc-task_mmu.c-don-t-read-mapcount-for-migration-entry.patch b/queue-5.15/fs-proc-task_mmu.c-don-t-read-mapcount-for-migration-entry.patch new file mode 100644 index 00000000000..49badf3282a --- /dev/null +++ b/queue-5.15/fs-proc-task_mmu.c-don-t-read-mapcount-for-migration-entry.patch @@ -0,0 +1,231 @@ +From 24d7275ce2791829953ed4e72f68277ceb2571c6 Mon Sep 17 00:00:00 2001 +From: Yang Shi +Date: Fri, 11 Feb 2022 16:32:26 -0800 +Subject: fs/proc: task_mmu.c: don't read mapcount for migration entry + +From: Yang Shi + +commit 24d7275ce2791829953ed4e72f68277ceb2571c6 upstream. + +The syzbot reported the below BUG: + + kernel BUG at include/linux/page-flags.h:785! + invalid opcode: 0000 [#1] PREEMPT SMP KASAN + CPU: 1 PID: 4392 Comm: syz-executor560 Not tainted 5.16.0-rc6-syzkaller #0 + Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 + RIP: 0010:PageDoubleMap include/linux/page-flags.h:785 [inline] + RIP: 0010:__page_mapcount+0x2d2/0x350 mm/util.c:744 + Call Trace: + page_mapcount include/linux/mm.h:837 [inline] + smaps_account+0x470/0xb10 fs/proc/task_mmu.c:466 + smaps_pte_entry fs/proc/task_mmu.c:538 [inline] + smaps_pte_range+0x611/0x1250 fs/proc/task_mmu.c:601 + walk_pmd_range mm/pagewalk.c:128 [inline] + walk_pud_range mm/pagewalk.c:205 [inline] + walk_p4d_range mm/pagewalk.c:240 [inline] + walk_pgd_range mm/pagewalk.c:277 [inline] + __walk_page_range+0xe23/0x1ea0 mm/pagewalk.c:379 + walk_page_vma+0x277/0x350 mm/pagewalk.c:530 + smap_gather_stats.part.0+0x148/0x260 fs/proc/task_mmu.c:768 + smap_gather_stats fs/proc/task_mmu.c:741 [inline] + show_smap+0xc6/0x440 fs/proc/task_mmu.c:822 + seq_read_iter+0xbb0/0x1240 fs/seq_file.c:272 + seq_read+0x3e0/0x5b0 fs/seq_file.c:162 + vfs_read+0x1b5/0x600 fs/read_write.c:479 + ksys_read+0x12d/0x250 fs/read_write.c:619 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +The reproducer was trying to read /proc/$PID/smaps when calling +MADV_FREE at the mean time. MADV_FREE may split THPs if it is called +for partial THP. It may trigger the below race: + + CPU A CPU B + ----- ----- + smaps walk: MADV_FREE: + page_mapcount() + PageCompound() + split_huge_page() + page = compound_head(page) + PageDoubleMap(page) + +When calling PageDoubleMap() this page is not a tail page of THP anymore +so the BUG is triggered. + +This could be fixed by elevated refcount of the page before calling +mapcount, but that would prevent it from counting migration entries, and +it seems overkilling because the race just could happen when PMD is +split so all PTE entries of tail pages are actually migration entries, +and smaps_account() does treat migration entries as mapcount == 1 as +Kirill pointed out. + +Add a new parameter for smaps_account() to tell this entry is migration +entry then skip calling page_mapcount(). Don't skip getting mapcount +for device private entries since they do track references with mapcount. + +Pagemap also has the similar issue although it was not reported. Fixed +it as well. + +[shy828301@gmail.com: v4] + Link: https://lkml.kernel.org/r/20220203182641.824731-1-shy828301@gmail.com +[nathan@kernel.org: avoid unused variable warning in pagemap_pmd_range()] + Link: https://lkml.kernel.org/r/20220207171049.1102239-1-nathan@kernel.org +Link: https://lkml.kernel.org/r/20220120202805.3369-1-shy828301@gmail.com +Fixes: e9b61f19858a ("thp: reintroduce split_huge_page()") +Signed-off-by: Yang Shi +Signed-off-by: Nathan Chancellor +Reported-by: syzbot+1f52b3a18d5633fa7f82@syzkaller.appspotmail.com +Acked-by: David Hildenbrand +Cc: "Kirill A. Shutemov" +Cc: Jann Horn +Cc: Matthew Wilcox +Cc: Alexey Dobriyan +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + fs/proc/task_mmu.c | 40 +++++++++++++++++++++++++++++++--------- + 1 file changed, 31 insertions(+), 9 deletions(-) + +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -430,7 +430,8 @@ static void smaps_page_accumulate(struct + } + + static void smaps_account(struct mem_size_stats *mss, struct page *page, +- bool compound, bool young, bool dirty, bool locked) ++ bool compound, bool young, bool dirty, bool locked, ++ bool migration) + { + int i, nr = compound ? compound_nr(page) : 1; + unsigned long size = nr * PAGE_SIZE; +@@ -457,8 +458,15 @@ static void smaps_account(struct mem_siz + * page_count(page) == 1 guarantees the page is mapped exactly once. + * If any subpage of the compound page mapped with PTE it would elevate + * page_count(). ++ * ++ * The page_mapcount() is called to get a snapshot of the mapcount. ++ * Without holding the page lock this snapshot can be slightly wrong as ++ * we cannot always read the mapcount atomically. It is not safe to ++ * call page_mapcount() even with PTL held if the page is not mapped, ++ * especially for migration entries. Treat regular migration entries ++ * as mapcount == 1. + */ +- if (page_count(page) == 1) { ++ if ((page_count(page) == 1) || migration) { + smaps_page_accumulate(mss, page, size, size << PSS_SHIFT, dirty, + locked, true); + return; +@@ -495,6 +503,7 @@ static void smaps_pte_entry(pte_t *pte, + struct vm_area_struct *vma = walk->vma; + bool locked = !!(vma->vm_flags & VM_LOCKED); + struct page *page = NULL; ++ bool migration = false; + + if (pte_present(*pte)) { + page = vm_normal_page(vma, addr, *pte); +@@ -514,8 +523,11 @@ static void smaps_pte_entry(pte_t *pte, + } else { + mss->swap_pss += (u64)PAGE_SIZE << PSS_SHIFT; + } +- } else if (is_pfn_swap_entry(swpent)) ++ } else if (is_pfn_swap_entry(swpent)) { ++ if (is_migration_entry(swpent)) ++ migration = true; + page = pfn_swap_entry_to_page(swpent); ++ } + } else if (unlikely(IS_ENABLED(CONFIG_SHMEM) && mss->check_shmem_swap + && pte_none(*pte))) { + page = xa_load(&vma->vm_file->f_mapping->i_pages, +@@ -528,7 +540,8 @@ static void smaps_pte_entry(pte_t *pte, + if (!page) + return; + +- smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte), locked); ++ smaps_account(mss, page, false, pte_young(*pte), pte_dirty(*pte), ++ locked, migration); + } + + #ifdef CONFIG_TRANSPARENT_HUGEPAGE +@@ -539,6 +552,7 @@ static void smaps_pmd_entry(pmd_t *pmd, + struct vm_area_struct *vma = walk->vma; + bool locked = !!(vma->vm_flags & VM_LOCKED); + struct page *page = NULL; ++ bool migration = false; + + if (pmd_present(*pmd)) { + /* FOLL_DUMP will return -EFAULT on huge zero page */ +@@ -546,8 +560,10 @@ static void smaps_pmd_entry(pmd_t *pmd, + } else if (unlikely(thp_migration_supported() && is_swap_pmd(*pmd))) { + swp_entry_t entry = pmd_to_swp_entry(*pmd); + +- if (is_migration_entry(entry)) ++ if (is_migration_entry(entry)) { ++ migration = true; + page = pfn_swap_entry_to_page(entry); ++ } + } + if (IS_ERR_OR_NULL(page)) + return; +@@ -559,7 +575,9 @@ static void smaps_pmd_entry(pmd_t *pmd, + /* pass */; + else + mss->file_thp += HPAGE_PMD_SIZE; +- smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd), locked); ++ ++ smaps_account(mss, page, true, pmd_young(*pmd), pmd_dirty(*pmd), ++ locked, migration); + } + #else + static void smaps_pmd_entry(pmd_t *pmd, unsigned long addr, +@@ -1363,6 +1381,7 @@ static pagemap_entry_t pte_to_pagemap_en + { + u64 frame = 0, flags = 0; + struct page *page = NULL; ++ bool migration = false; + + if (pte_present(pte)) { + if (pm->show_pfn) +@@ -1384,13 +1403,14 @@ static pagemap_entry_t pte_to_pagemap_en + frame = swp_type(entry) | + (swp_offset(entry) << MAX_SWAPFILES_SHIFT); + flags |= PM_SWAP; ++ migration = is_migration_entry(entry); + if (is_pfn_swap_entry(entry)) + page = pfn_swap_entry_to_page(entry); + } + + if (page && !PageAnon(page)) + flags |= PM_FILE; +- if (page && page_mapcount(page) == 1) ++ if (page && !migration && page_mapcount(page) == 1) + flags |= PM_MMAP_EXCLUSIVE; + if (vma->vm_flags & VM_SOFTDIRTY) + flags |= PM_SOFT_DIRTY; +@@ -1406,8 +1426,9 @@ static int pagemap_pmd_range(pmd_t *pmdp + spinlock_t *ptl; + pte_t *pte, *orig_pte; + int err = 0; +- + #ifdef CONFIG_TRANSPARENT_HUGEPAGE ++ bool migration = false; ++ + ptl = pmd_trans_huge_lock(pmdp, vma); + if (ptl) { + u64 flags = 0, frame = 0; +@@ -1446,11 +1467,12 @@ static int pagemap_pmd_range(pmd_t *pmdp + if (pmd_swp_uffd_wp(pmd)) + flags |= PM_UFFD_WP; + VM_BUG_ON(!is_pmd_migration_entry(pmd)); ++ migration = is_migration_entry(entry); + page = pfn_swap_entry_to_page(entry); + } + #endif + +- if (page && page_mapcount(page) == 1) ++ if (page && !migration && page_mapcount(page) == 1) + flags |= PM_MMAP_EXCLUSIVE; + + for (; addr != end; addr += PAGE_SIZE) { diff --git a/queue-5.15/hid-add-support-for-ugtablet-wp5540.patch b/queue-5.15/hid-add-support-for-ugtablet-wp5540.patch new file mode 100644 index 00000000000..c2c5446cbbd --- /dev/null +++ b/queue-5.15/hid-add-support-for-ugtablet-wp5540.patch @@ -0,0 +1,43 @@ +From fd5dd6acd8f823ea804f76d3af64fa1be9d5fb78 Mon Sep 17 00:00:00 2001 +From: Sergio Costas +Date: Fri, 4 Feb 2022 10:01:17 +0100 +Subject: HID:Add support for UGTABLET WP5540 + +From: Sergio Costas + +commit fd5dd6acd8f823ea804f76d3af64fa1be9d5fb78 upstream. + +This patch adds support for the UGTABLET WP5540 digitizer tablet +devices. Without it, the pen moves the cursor, but neither the +buttons nor the tap sensor in the tip do work. + +Signed-off-by: Sergio Costas +Link: https://lore.kernel.org/r/63dece1d-91ca-1b1b-d90d-335be66896be@gmail.com +Cc: stable@vger.kernel.org +Signed-off-by: Benjamin Tissoires +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-quirks.c | 1 + + 2 files changed, 2 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -1353,6 +1353,7 @@ + #define USB_VENDOR_ID_UGTIZER 0x2179 + #define USB_DEVICE_ID_UGTIZER_TABLET_GP0610 0x0053 + #define USB_DEVICE_ID_UGTIZER_TABLET_GT5040 0x0077 ++#define USB_DEVICE_ID_UGTIZER_TABLET_WP5540 0x0004 + + #define USB_VENDOR_ID_VIEWSONIC 0x0543 + #define USB_DEVICE_ID_VIEWSONIC_PD1011 0xe621 +--- a/drivers/hid/hid-quirks.c ++++ b/drivers/hid/hid-quirks.c +@@ -187,6 +187,7 @@ static const struct hid_device_id hid_qu + { HID_USB_DEVICE(USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_KEYBOARD), HID_QUIRK_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_KNA5), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_UCLOGIC, USB_DEVICE_ID_UCLOGIC_TABLET_TWA60), HID_QUIRK_MULTI_INPUT }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_UGTIZER, USB_DEVICE_ID_UGTIZER_TABLET_WP5540), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_10_6_INCH), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_MEDIA_TABLET_14_1_INCH), HID_QUIRK_MULTI_INPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET), HID_QUIRK_MULTI_INPUT }, diff --git a/queue-5.15/hid-amd_sfh-add-illuminance-mask-to-limit-als-max-value.patch b/queue-5.15/hid-amd_sfh-add-illuminance-mask-to-limit-als-max-value.patch new file mode 100644 index 00000000000..f8456403093 --- /dev/null +++ b/queue-5.15/hid-amd_sfh-add-illuminance-mask-to-limit-als-max-value.patch @@ -0,0 +1,41 @@ +From 91aaea527bc3b707c5d3208cde035421ed54f79c Mon Sep 17 00:00:00 2001 +From: Basavaraj Natikar +Date: Mon, 31 Jan 2022 22:48:33 +0530 +Subject: HID: amd_sfh: Add illuminance mask to limit ALS max value + +From: Basavaraj Natikar + +commit 91aaea527bc3b707c5d3208cde035421ed54f79c upstream. + +ALS illuminance value present only in first 15 bits from SFH firmware +for V2 platforms. Hence added a mask of 15 bit to limit ALS max +illuminance values to get correct illuminance value. + +Fixes: 0aad9c95eb9a ("HID: amd_sfh: Extend ALS support for newer AMD platform") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.c ++++ b/drivers/hid/amd-sfh-hid/hid_descriptor/amd_sfh_hid_desc.c +@@ -26,6 +26,7 @@ + #define HID_USAGE_SENSOR_STATE_READY_ENUM 0x02 + #define HID_USAGE_SENSOR_STATE_INITIALIZING_ENUM 0x05 + #define HID_USAGE_SENSOR_EVENT_DATA_UPDATED_ENUM 0x04 ++#define ILLUMINANCE_MASK GENMASK(14, 0) + + int get_report_descriptor(int sensor_idx, u8 *rep_desc) + { +@@ -245,7 +246,8 @@ u8 get_input_report(u8 current_index, in + get_common_inputs(&als_input.common_property, report_id); + /* For ALS ,V2 Platforms uses C2P_MSG5 register instead of DRAM access method */ + if (supported_input == V2_STATUS) +- als_input.illuminance_value = (int)readl(privdata->mmio + AMD_C2P_MSG(5)); ++ als_input.illuminance_value = ++ readl(privdata->mmio + AMD_C2P_MSG(5)) & ILLUMINANCE_MASK; + else + als_input.illuminance_value = + (int)sensor_virt_addr[0] / AMD_SFH_FW_MULTIPLIER; diff --git a/queue-5.15/hid-amd_sfh-correct-the-structure-field-name.patch b/queue-5.15/hid-amd_sfh-correct-the-structure-field-name.patch new file mode 100644 index 00000000000..d98c292b9c2 --- /dev/null +++ b/queue-5.15/hid-amd_sfh-correct-the-structure-field-name.patch @@ -0,0 +1,31 @@ +From aa0b724a2bf041036e56cbb3b4b3afde7c5e7c9e Mon Sep 17 00:00:00 2001 +From: Basavaraj Natikar +Date: Tue, 8 Feb 2022 17:51:09 +0530 +Subject: HID: amd_sfh: Correct the structure field name + +From: Basavaraj Natikar + +commit aa0b724a2bf041036e56cbb3b4b3afde7c5e7c9e upstream. + +Misinterpreted intr_enable field name. Hence correct the structure +field name accordingly to reflect the functionality. + +Fixes: f264481ad614 ("HID: amd_sfh: Extend driver capabilities for multi-generation support") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/amd-sfh-hid/amd_sfh_pcie.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h ++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.h +@@ -48,7 +48,7 @@ union sfh_cmd_base { + } s; + struct { + u32 cmd_id : 4; +- u32 intr_enable : 1; ++ u32 intr_disable : 1; + u32 rsvd1 : 3; + u32 length : 7; + u32 mem_type : 1; diff --git a/queue-5.15/hid-amd_sfh-increase-sensor-command-timeout.patch b/queue-5.15/hid-amd_sfh-increase-sensor-command-timeout.patch new file mode 100644 index 00000000000..6e412764cb4 --- /dev/null +++ b/queue-5.15/hid-amd_sfh-increase-sensor-command-timeout.patch @@ -0,0 +1,36 @@ +From a7072c01c3ac3ae6ecd08fa7b43431cfc8ed331f Mon Sep 17 00:00:00 2001 +From: Basavaraj Natikar +Date: Mon, 31 Jan 2022 22:48:32 +0530 +Subject: HID: amd_sfh: Increase sensor command timeout + +From: Basavaraj Natikar + +commit a7072c01c3ac3ae6ecd08fa7b43431cfc8ed331f upstream. + +HPD sensors take more time to initialize. Hence increasing sensor +command timeout to get response with status within a max timeout. + +Fixes: 173709f50e98 ("HID: amd_sfh: Add command response to check command status") +Signed-off-by: Basavaraj Natikar +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/amd-sfh-hid/amd_sfh_pcie.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c ++++ b/drivers/hid/amd-sfh-hid/amd_sfh_pcie.c +@@ -36,11 +36,11 @@ static int amd_sfh_wait_response_v2(stru + { + union cmd_response cmd_resp; + +- /* Get response with status within a max of 800 ms timeout */ ++ /* Get response with status within a max of 1600 ms timeout */ + if (!readl_poll_timeout(mp2->mmio + AMD_P2C_MSG(0), cmd_resp.resp, + (cmd_resp.response_v2.response == sensor_sts && + cmd_resp.response_v2.status == 0 && (sid == 0xff || +- cmd_resp.response_v2.sensor_id == sid)), 500, 800000)) ++ cmd_resp.response_v2.sensor_id == sid)), 500, 1600000)) + return cmd_resp.response_v2.response; + + return SENSOR_DISABLED; diff --git a/queue-5.15/hid-i2c-hid-goodix-fix-a-lockdep-splat.patch b/queue-5.15/hid-i2c-hid-goodix-fix-a-lockdep-splat.patch new file mode 100644 index 00000000000..9448e8a8471 --- /dev/null +++ b/queue-5.15/hid-i2c-hid-goodix-fix-a-lockdep-splat.patch @@ -0,0 +1,176 @@ +From 2787710f73fcce4a9bdab540aaf1aef778a27462 Mon Sep 17 00:00:00 2001 +From: Daniel Thompson +Date: Fri, 28 Jan 2022 17:46:25 +0000 +Subject: HID: i2c-hid: goodix: Fix a lockdep splat + +From: Daniel Thompson + +commit 2787710f73fcce4a9bdab540aaf1aef778a27462 upstream. + +I'm was on the receiving end of a lockdep splat from this driver and after +scratching my head I couldn't be entirely sure it was a false positive +given we would also have to think about whether the regulator locking is +safe (since the notifier is called whilst holding regulator locks which +are also needed for regulator_is_enabled() ). + +Regardless of whether it is a real bug or not, the mutex isn't needed. +We can use reference counting tricks instead to avoid races with the +notifier calls. + +The observed splat follows: + +------------------------------------------------------ +kworker/u16:3/127 is trying to acquire lock: +ffff00008021fb20 (&ihid_goodix->regulator_mutex){+.+.}-{4:4}, at: ihid_goodix_vdd_notify+0x30/0x94 + +but task is already holding lock: +ffff0000835c60c0 (&(&rdev->notifier)->rwsem){++++}-{4:4}, at: blocking_notifier_call_chain+0x30/0x70 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (&(&rdev->notifier)->rwsem){++++}-{4:4}: + down_write+0x68/0x8c + blocking_notifier_chain_register+0x54/0x70 + regulator_register_notifier+0x1c/0x24 + devm_regulator_register_notifier+0x58/0x98 + i2c_hid_of_goodix_probe+0xdc/0x158 + i2c_device_probe+0x25d/0x270 + really_probe+0x174/0x2cc + __driver_probe_device+0xc0/0xd8 + driver_probe_device+0x50/0xe4 + __device_attach_driver+0xa8/0xc0 + bus_for_each_drv+0x9c/0xc0 + __device_attach_async_helper+0x6c/0xbc + async_run_entry_fn+0x38/0x100 + process_one_work+0x294/0x438 + worker_thread+0x180/0x258 + kthread+0x120/0x130 + ret_from_fork+0x10/0x20 + +-> #0 (&ihid_goodix->regulator_mutex){+.+.}-{4:4}: + __lock_acquire+0xd24/0xfe8 + lock_acquire+0x288/0x2f4 + __mutex_lock+0xa0/0x338 + mutex_lock_nested+0x3c/0x5c + ihid_goodix_vdd_notify+0x30/0x94 + notifier_call_chain+0x6c/0x8c + blocking_notifier_call_chain+0x48/0x70 + _notifier_call_chain.isra.0+0x18/0x20 + _regulator_enable+0xc0/0x178 + regulator_enable+0x40/0x7c + goodix_i2c_hid_power_up+0x18/0x20 + i2c_hid_core_power_up.isra.0+0x1c/0x2c + i2c_hid_core_probe+0xd8/0x3d4 + i2c_hid_of_goodix_probe+0x14c/0x158 + i2c_device_probe+0x25c/0x270 + really_probe+0x174/0x2cc + __driver_probe_device+0xc0/0xd8 + driver_probe_device+0x50/0xe4 + __device_attach_driver+0xa8/0xc0 + bus_for_each_drv+0x9c/0xc0 + __device_attach_async_helper+0x6c/0xbc + async_run_entry_fn+0x38/0x100 + process_one_work+0x294/0x438 + worker_thread+0x180/0x258 + kthread+0x120/0x130 + ret_from_fork+0x10/0x20 + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&(&rdev->notifier)->rwsem); + lock(&ihid_goodix->regulator_mutex); + lock(&(&rdev->notifier)->rwsem); + lock(&ihid_goodix->regulator_mutex); + + *** DEADLOCK *** + +Signed-off-by: Daniel Thompson +Fixes: 18eeef46d359 ("HID: i2c-hid: goodix: Tie the reset line to true state of the regulator") +Reviewed-by: Douglas Anderson +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/i2c-hid/i2c-hid-of-goodix.c | 28 ++++++++++++---------------- + 1 file changed, 12 insertions(+), 16 deletions(-) + +--- a/drivers/hid/i2c-hid/i2c-hid-of-goodix.c ++++ b/drivers/hid/i2c-hid/i2c-hid-of-goodix.c +@@ -27,7 +27,6 @@ struct i2c_hid_of_goodix { + + struct regulator *vdd; + struct notifier_block nb; +- struct mutex regulator_mutex; + struct gpio_desc *reset_gpio; + const struct goodix_i2c_hid_timing_data *timings; + }; +@@ -67,8 +66,6 @@ static int ihid_goodix_vdd_notify(struct + container_of(nb, struct i2c_hid_of_goodix, nb); + int ret = NOTIFY_OK; + +- mutex_lock(&ihid_goodix->regulator_mutex); +- + switch (event) { + case REGULATOR_EVENT_PRE_DISABLE: + gpiod_set_value_cansleep(ihid_goodix->reset_gpio, 1); +@@ -87,8 +84,6 @@ static int ihid_goodix_vdd_notify(struct + break; + } + +- mutex_unlock(&ihid_goodix->regulator_mutex); +- + return ret; + } + +@@ -102,8 +97,6 @@ static int i2c_hid_of_goodix_probe(struc + if (!ihid_goodix) + return -ENOMEM; + +- mutex_init(&ihid_goodix->regulator_mutex); +- + ihid_goodix->ops.power_up = goodix_i2c_hid_power_up; + ihid_goodix->ops.power_down = goodix_i2c_hid_power_down; + +@@ -130,25 +123,28 @@ static int i2c_hid_of_goodix_probe(struc + * long. Holding the controller in reset apparently draws extra + * power. + */ +- mutex_lock(&ihid_goodix->regulator_mutex); + ihid_goodix->nb.notifier_call = ihid_goodix_vdd_notify; + ret = devm_regulator_register_notifier(ihid_goodix->vdd, &ihid_goodix->nb); +- if (ret) { +- mutex_unlock(&ihid_goodix->regulator_mutex); ++ if (ret) + return dev_err_probe(&client->dev, ret, + "regulator notifier request failed\n"); +- } + + /* + * If someone else is holding the regulator on (or the regulator is + * an always-on one) we might never be told to deassert reset. Do it +- * now. Here we'll assume that someone else might have _just +- * barely_ turned the regulator on so we'll do the full +- * "post_power_delay" just in case. ++ * now... and temporarily bump the regulator reference count just to ++ * make sure it is impossible for this to race with our own notifier! ++ * We also assume that someone else might have _just barely_ turned ++ * the regulator on so we'll do the full "post_power_delay" just in ++ * case. + */ +- if (ihid_goodix->reset_gpio && regulator_is_enabled(ihid_goodix->vdd)) ++ if (ihid_goodix->reset_gpio && regulator_is_enabled(ihid_goodix->vdd)) { ++ ret = regulator_enable(ihid_goodix->vdd); ++ if (ret) ++ return ret; + goodix_i2c_hid_deassert_reset(ihid_goodix, true); +- mutex_unlock(&ihid_goodix->regulator_mutex); ++ regulator_disable(ihid_goodix->vdd); ++ } + + return i2c_hid_core_probe(client, &ihid_goodix->ops, 0x0001, 0); + } diff --git a/queue-5.15/mm-don-t-try-to-numa-migrate-cow-pages-that-have-other-uses.patch b/queue-5.15/mm-don-t-try-to-numa-migrate-cow-pages-that-have-other-uses.patch new file mode 100644 index 00000000000..73c9725d99b --- /dev/null +++ b/queue-5.15/mm-don-t-try-to-numa-migrate-cow-pages-that-have-other-uses.patch @@ -0,0 +1,75 @@ +From 80d47f5de5e311cbc0d01ebb6ee684e8f4c196c6 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Thu, 17 Feb 2022 08:57:47 -0800 +Subject: mm: don't try to NUMA-migrate COW pages that have other uses + +From: Linus Torvalds + +commit 80d47f5de5e311cbc0d01ebb6ee684e8f4c196c6 upstream. + +Oded Gabbay reports that enabling NUMA balancing causes corruption with +his Gaudi accelerator test load: + + "All the details are in the bug, but the bottom line is that somehow, + this patch causes corruption when the numa balancing feature is + enabled AND we don't use process affinity AND we use GUP to pin pages + so our accelerator can DMA to/from system memory. + + Either disabling numa balancing, using process affinity to bind to + specific numa-node or reverting this patch causes the bug to + disappear" + +and Oded bisected the issue to commit 09854ba94c6a ("mm: do_wp_page() +simplification"). + +Now, the NUMA balancing shouldn't actually be changing the writability +of a page, and as such shouldn't matter for COW. But it appears it +does. Suspicious. + +However, regardless of that, the condition for enabling NUMA faults in +change_pte_range() is nonsensical. It uses "page_mapcount(page)" to +decide if a COW page should be NUMA-protected or not, and that makes +absolutely no sense. + +The number of mappings a page has is irrelevant: not only does GUP get a +reference to a page as in Oded's case, but the other mappings migth be +paged out and the only reference to them would be in the page count. + +Since we should never try to NUMA-balance a page that we can't move +anyway due to other references, just fix the code to use 'page_count()'. +Oded confirms that that fixes his issue. + +Now, this does imply that something in NUMA balancing ends up changing +page protections (other than the obvious one of making the page +inaccessible to get the NUMA faulting information). Otherwise the COW +simplification wouldn't matter - since doing the GUP on the page would +make sure it's writable. + +The cause of that permission change would be good to figure out too, +since it clearly results in spurious COW events - but fixing the +nonsensical test that just happened to work before is obviously the +CorrectThing(tm) to do regardless. + +Fixes: 09854ba94c6a ("mm: do_wp_page() simplification") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215616 +Link: https://lore.kernel.org/all/CAFCwf10eNmwq2wD71xjUhqkvv5+_pJMR1nPug2RqNDcFT4H86Q@mail.gmail.com/ +Reported-and-tested-by: Oded Gabbay +Cc: David Hildenbrand +Cc: Peter Xu +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + mm/mprotect.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/mprotect.c ++++ b/mm/mprotect.c +@@ -94,7 +94,7 @@ static unsigned long change_pte_range(st + + /* Also skip shared copy-on-write pages */ + if (is_cow_mapping(vma->vm_flags) && +- page_mapcount(page) != 1) ++ page_count(page) != 1) + continue; + + /* diff --git a/queue-5.15/mmc-block-fix-read-single-on-recovery-logic.patch b/queue-5.15/mmc-block-fix-read-single-on-recovery-logic.patch new file mode 100644 index 00000000000..f2d614bf6e3 --- /dev/null +++ b/queue-5.15/mmc-block-fix-read-single-on-recovery-logic.patch @@ -0,0 +1,83 @@ +From 54309fde1a352ad2674ebba004a79f7d20b9f037 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Christian=20L=C3=B6hle?= +Date: Fri, 4 Feb 2022 15:11:37 +0000 +Subject: mmc: block: fix read single on recovery logic + +From: Christian Löhle + +commit 54309fde1a352ad2674ebba004a79f7d20b9f037 upstream. + +On reads with MMC_READ_MULTIPLE_BLOCK that fail, +the recovery handler will use MMC_READ_SINGLE_BLOCK for +each of the blocks, up to MMC_READ_SINGLE_RETRIES times each. +The logic for this is fixed to never report unsuccessful reads +as success to the block layer. + +On command error with retries remaining, blk_update_request was +called with whatever value error was set last to. +In case it was last set to BLK_STS_OK (default), the read will be +reported as success, even though there was no data read from the device. +This could happen on a CRC mismatch for the response, +a card rejecting the command (e.g. again due to a CRC mismatch). +In case it was last set to BLK_STS_IOERR, the error is reported correctly, +but no retries will be attempted. + +Fixes: 81196976ed946c ("mmc: block: Add blk-mq support") +Cc: stable@vger.kernel.org +Signed-off-by: Christian Loehle +Reviewed-by: Adrian Hunter +Link: https://lore.kernel.org/r/bc706a6ab08c4fe2834ba0c05a804672@hyperstone.com +Signed-off-by: Ulf Hansson +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mmc/core/block.c | 28 ++++++++++++++-------------- + 1 file changed, 14 insertions(+), 14 deletions(-) + +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -1682,31 +1682,31 @@ static void mmc_blk_read_single(struct m + struct mmc_card *card = mq->card; + struct mmc_host *host = card->host; + blk_status_t error = BLK_STS_OK; +- int retries = 0; + + do { + u32 status; + int err; ++ int retries = 0; + +- mmc_blk_rw_rq_prep(mqrq, card, 1, mq); ++ while (retries++ <= MMC_READ_SINGLE_RETRIES) { ++ mmc_blk_rw_rq_prep(mqrq, card, 1, mq); + +- mmc_wait_for_req(host, mrq); ++ mmc_wait_for_req(host, mrq); + +- err = mmc_send_status(card, &status); +- if (err) +- goto error_exit; +- +- if (!mmc_host_is_spi(host) && +- !mmc_ready_for_data(status)) { +- err = mmc_blk_fix_state(card, req); ++ err = mmc_send_status(card, &status); + if (err) + goto error_exit; +- } + +- if (mrq->cmd->error && retries++ < MMC_READ_SINGLE_RETRIES) +- continue; ++ if (!mmc_host_is_spi(host) && ++ !mmc_ready_for_data(status)) { ++ err = mmc_blk_fix_state(card, req); ++ if (err) ++ goto error_exit; ++ } + +- retries = 0; ++ if (!mrq->cmd->error) ++ break; ++ } + + if (mrq->cmd->error || + mrq->data->error || diff --git a/queue-5.15/parisc-add-ioread64_lo_hi-and-iowrite64_lo_hi.patch b/queue-5.15/parisc-add-ioread64_lo_hi-and-iowrite64_lo_hi.patch new file mode 100644 index 00000000000..73cbb376806 --- /dev/null +++ b/queue-5.15/parisc-add-ioread64_lo_hi-and-iowrite64_lo_hi.patch @@ -0,0 +1,70 @@ +From 18a1d5e1945385d9b5adc3fe11427ce4a9d2826e Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Mon, 7 Feb 2022 17:16:39 +0200 +Subject: parisc: Add ioread64_lo_hi() and iowrite64_lo_hi() + +From: Andy Shevchenko + +commit 18a1d5e1945385d9b5adc3fe11427ce4a9d2826e upstream. + +It's a followup to the previous commit f15309d7ad5d ("parisc: Add +ioread64_hi_lo() and iowrite64_hi_lo()") which does only half of +the job. Add the rest, so we won't get a new kernel test robot +reports. + +Fixes: f15309d7ad5d ("parisc: Add ioread64_hi_lo() and iowrite64_hi_lo()") +Signed-off-by: Andy Shevchenko +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/lib/iomap.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/arch/parisc/lib/iomap.c ++++ b/arch/parisc/lib/iomap.c +@@ -346,6 +346,16 @@ u64 ioread64be(const void __iomem *addr) + return *((u64 *)addr); + } + ++u64 ioread64_lo_hi(const void __iomem *addr) ++{ ++ u32 low, high; ++ ++ low = ioread32(addr); ++ high = ioread32(addr + sizeof(u32)); ++ ++ return low + ((u64)high << 32); ++} ++ + u64 ioread64_hi_lo(const void __iomem *addr) + { + u32 low, high; +@@ -419,6 +429,12 @@ void iowrite64be(u64 datum, void __iomem + } + } + ++void iowrite64_lo_hi(u64 val, void __iomem *addr) ++{ ++ iowrite32(val, addr); ++ iowrite32(val >> 32, addr + sizeof(u32)); ++} ++ + void iowrite64_hi_lo(u64 val, void __iomem *addr) + { + iowrite32(val >> 32, addr + sizeof(u32)); +@@ -530,6 +546,7 @@ EXPORT_SYMBOL(ioread32); + EXPORT_SYMBOL(ioread32be); + EXPORT_SYMBOL(ioread64); + EXPORT_SYMBOL(ioread64be); ++EXPORT_SYMBOL(ioread64_lo_hi); + EXPORT_SYMBOL(ioread64_hi_lo); + EXPORT_SYMBOL(iowrite8); + EXPORT_SYMBOL(iowrite16); +@@ -538,6 +555,7 @@ EXPORT_SYMBOL(iowrite32); + EXPORT_SYMBOL(iowrite32be); + EXPORT_SYMBOL(iowrite64); + EXPORT_SYMBOL(iowrite64be); ++EXPORT_SYMBOL(iowrite64_lo_hi); + EXPORT_SYMBOL(iowrite64_hi_lo); + EXPORT_SYMBOL(ioread8_rep); + EXPORT_SYMBOL(ioread16_rep); diff --git a/queue-5.15/parisc-drop-__init-from-map_pages-declaration.patch b/queue-5.15/parisc-drop-__init-from-map_pages-declaration.patch new file mode 100644 index 00000000000..c0e7fa76fa7 --- /dev/null +++ b/queue-5.15/parisc-drop-__init-from-map_pages-declaration.patch @@ -0,0 +1,61 @@ +From 9129886b88185962538180625ca8051362b01327 Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Sat, 22 Jan 2022 18:19:49 +0000 +Subject: parisc: Drop __init from map_pages declaration + +From: John David Anglin + +commit 9129886b88185962538180625ca8051362b01327 upstream. + +With huge kernel pages, we randomly eat a SPARC in map_pages(). This +is fixed by dropping __init from the declaration. + +However, map_pages references the __init routine memblock_alloc_try_nid +via memblock_alloc. Thus, it needs to be marked with __ref. + +memblock_alloc is only called before the kernel text is set to readonly. + +The __ref on free_initmem is no longer needed. + +Comment regarding map_pages being in the init section is removed. + +Signed-off-by: John David Anglin +Cc: stable@vger.kernel.org # v5.4+ +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/mm/init.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/arch/parisc/mm/init.c ++++ b/arch/parisc/mm/init.c +@@ -341,9 +341,9 @@ static void __init setup_bootmem(void) + + static bool kernel_set_to_readonly; + +-static void __init map_pages(unsigned long start_vaddr, +- unsigned long start_paddr, unsigned long size, +- pgprot_t pgprot, int force) ++static void __ref map_pages(unsigned long start_vaddr, ++ unsigned long start_paddr, unsigned long size, ++ pgprot_t pgprot, int force) + { + pmd_t *pmd; + pte_t *pg_table; +@@ -453,7 +453,7 @@ void __init set_kernel_text_rw(int enabl + flush_tlb_all(); + } + +-void __ref free_initmem(void) ++void free_initmem(void) + { + unsigned long init_begin = (unsigned long)__init_begin; + unsigned long init_end = (unsigned long)__init_end; +@@ -467,7 +467,6 @@ void __ref free_initmem(void) + /* The init text pages are marked R-X. We have to + * flush the icache and mark them RW- + * +- * This is tricky, because map_pages is in the init section. + * Do a dummy remap of the data section first (the data + * section is already PAGE_KERNEL) to pull in the TLB entries + * for map_kernel */ diff --git a/queue-5.15/parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch b/queue-5.15/parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch new file mode 100644 index 00000000000..fe311d21443 --- /dev/null +++ b/queue-5.15/parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch @@ -0,0 +1,86 @@ +From b7d6f44a0fa716a82969725516dc0b16bc7cd514 Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Wed, 26 Jan 2022 20:39:05 +0000 +Subject: parisc: Fix data TLB miss in sba_unmap_sg + +From: John David Anglin + +commit b7d6f44a0fa716a82969725516dc0b16bc7cd514 upstream. + +Rolf Eike Beer reported the following bug: + +[1274934.746891] Bad Address (null pointer deref?): Code=15 (Data TLB miss fault) at addr 0000004140000018 +[1274934.746891] CPU: 3 PID: 5549 Comm: cmake Not tainted 5.15.4-gentoo-parisc64 #4 +[1274934.746891] Hardware name: 9000/785/C8000 +[1274934.746891] +[1274934.746891] YZrvWESTHLNXBCVMcbcbcbcbOGFRQPDI +[1274934.746891] PSW: 00001000000001001111111000001110 Not tainted +[1274934.746891] r00-03 000000ff0804fe0e 0000000040bc9bc0 00000000406760e4 0000004140000000 +[1274934.746891] r04-07 0000000040b693c0 0000004140000000 000000004a2b08b0 0000000000000001 +[1274934.746891] r08-11 0000000041f98810 0000000000000000 000000004a0a7000 0000000000000001 +[1274934.746891] r12-15 0000000040bddbc0 0000000040c0cbc0 0000000040bddbc0 0000000040bddbc0 +[1274934.746891] r16-19 0000000040bde3c0 0000000040bddbc0 0000000040bde3c0 0000000000000007 +[1274934.746891] r20-23 0000000000000006 000000004a368950 0000000000000000 0000000000000001 +[1274934.746891] r24-27 0000000000001fff 000000000800000e 000000004a1710f0 0000000040b693c0 +[1274934.746891] r28-31 0000000000000001 0000000041f988b0 0000000041f98840 000000004a171118 +[1274934.746891] sr00-03 00000000066e5800 0000000000000000 0000000000000000 00000000066e5800 +[1274934.746891] sr04-07 0000000000000000 0000000000000000 0000000000000000 0000000000000000 +[1274934.746891] +[1274934.746891] IASQ: 0000000000000000 0000000000000000 IAOQ: 00000000406760e8 00000000406760ec +[1274934.746891] IIR: 48780030 ISR: 0000000000000000 IOR: 0000004140000018 +[1274934.746891] CPU: 3 CR30: 00000040e3a9c000 CR31: ffffffffffffffff +[1274934.746891] ORIG_R28: 0000000040acdd58 +[1274934.746891] IAOQ[0]: sba_unmap_sg+0xb0/0x118 +[1274934.746891] IAOQ[1]: sba_unmap_sg+0xb4/0x118 +[1274934.746891] RP(r2): sba_unmap_sg+0xac/0x118 +[1274934.746891] Backtrace: +[1274934.746891] [<00000000402740cc>] dma_unmap_sg_attrs+0x6c/0x70 +[1274934.746891] [<000000004074d6bc>] scsi_dma_unmap+0x54/0x60 +[1274934.746891] [<00000000407a3488>] mptscsih_io_done+0x150/0xd70 +[1274934.746891] [<0000000040798600>] mpt_interrupt+0x168/0xa68 +[1274934.746891] [<0000000040255a48>] __handle_irq_event_percpu+0xc8/0x278 +[1274934.746891] [<0000000040255c34>] handle_irq_event_percpu+0x3c/0xd8 +[1274934.746891] [<000000004025ecb4>] handle_percpu_irq+0xb4/0xf0 +[1274934.746891] [<00000000402548e0>] generic_handle_irq+0x50/0x70 +[1274934.746891] [<000000004019a254>] call_on_stack+0x18/0x24 +[1274934.746891] +[1274934.746891] Kernel panic - not syncing: Bad Address (null pointer deref?) + +The bug is caused by overrunning the sglist and incorrectly testing +sg_dma_len(sglist) before nents. Normally this doesn't cause a crash, +but in this case sglist crossed a page boundary. This occurs in the +following code: + + while (sg_dma_len(sglist) && nents--) { + +The fix is simply to test nents first and move the decrement of nents +into the loop. + +Reported-by: Rolf Eike Beer +Signed-off-by: John David Anglin +Cc: stable@vger.kernel.org +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/parisc/sba_iommu.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/parisc/sba_iommu.c ++++ b/drivers/parisc/sba_iommu.c +@@ -1047,7 +1047,7 @@ sba_unmap_sg(struct device *dev, struct + spin_unlock_irqrestore(&ioc->res_lock, flags); + #endif + +- while (sg_dma_len(sglist) && nents--) { ++ while (nents && sg_dma_len(sglist)) { + + sba_unmap_page(dev, sg_dma_address(sglist), sg_dma_len(sglist), + direction, 0); +@@ -1056,6 +1056,7 @@ sba_unmap_sg(struct device *dev, struct + ioc->usingle_calls--; /* kluge since call is unmap_sg() */ + #endif + ++sglist; ++ nents--; + } + + DBG_RUN_SG("%s() DONE (nents %d)\n", __func__, nents); diff --git a/queue-5.15/parisc-fix-sglist-access-in-ccio-dma.c.patch b/queue-5.15/parisc-fix-sglist-access-in-ccio-dma.c.patch new file mode 100644 index 00000000000..b0ae31b66dd --- /dev/null +++ b/queue-5.15/parisc-fix-sglist-access-in-ccio-dma.c.patch @@ -0,0 +1,39 @@ +From d7da660cab47183cded65e11b64497d0f56c6edf Mon Sep 17 00:00:00 2001 +From: John David Anglin +Date: Thu, 27 Jan 2022 22:33:41 +0000 +Subject: parisc: Fix sglist access in ccio-dma.c + +From: John David Anglin + +commit d7da660cab47183cded65e11b64497d0f56c6edf upstream. + +This patch implements the same bug fix to ccio-dma.c as to sba_iommu.c. +It ensures that only the allocated entries of the sglist are accessed. + +Signed-off-by: John David Anglin +Cc: stable@vger.kernel.org +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/parisc/ccio-dma.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/parisc/ccio-dma.c ++++ b/drivers/parisc/ccio-dma.c +@@ -1003,7 +1003,7 @@ ccio_unmap_sg(struct device *dev, struct + ioc->usg_calls++; + #endif + +- while(sg_dma_len(sglist) && nents--) { ++ while (nents && sg_dma_len(sglist)) { + + #ifdef CCIO_COLLECT_STATS + ioc->usg_pages += sg_dma_len(sglist) >> PAGE_SHIFT; +@@ -1011,6 +1011,7 @@ ccio_unmap_sg(struct device *dev, struct + ccio_unmap_page(dev, sg_dma_address(sglist), + sg_dma_len(sglist), direction, 0); + ++sglist; ++ nents--; + } + + DBG_RUN_SG("%s() DONE (nents %d)\n", __func__, nents); diff --git a/queue-5.15/parisc-show-error-if-wrong-32-64-bit-compiler-is-being-used.patch b/queue-5.15/parisc-show-error-if-wrong-32-64-bit-compiler-is-being-used.patch new file mode 100644 index 00000000000..ee1d36a2534 --- /dev/null +++ b/queue-5.15/parisc-show-error-if-wrong-32-64-bit-compiler-is-being-used.patch @@ -0,0 +1,42 @@ +From b160628e9ebcdc85d0db9d7f423c26b3c7c179d0 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 13 Feb 2022 22:29:25 +0100 +Subject: parisc: Show error if wrong 32/64-bit compiler is being used + +From: Helge Deller + +commit b160628e9ebcdc85d0db9d7f423c26b3c7c179d0 upstream. + +It happens quite often that people use the wrong compiler to build the +kernel: + +make ARCH=parisc -> builds the 32-bit kernel +make ARCH=parisc64 -> builds the 64-bit kernel + +This patch adds a sanity check which errors out with an instruction how +use the correct ARCH= option. + +Signed-off-by: Helge Deller +Cc: stable@vger.kernel.org # v5.15+ +Signed-off-by: Greg Kroah-Hartman +--- + arch/parisc/include/asm/bitops.h | 8 ++++++++ + 1 file changed, 8 insertions(+) + +--- a/arch/parisc/include/asm/bitops.h ++++ b/arch/parisc/include/asm/bitops.h +@@ -12,6 +12,14 @@ + #include + #include + ++/* compiler build environment sanity checks: */ ++#if !defined(CONFIG_64BIT) && defined(__LP64__) ++#error "Please use 'ARCH=parisc' to build the 32-bit kernel." ++#endif ++#if defined(CONFIG_64BIT) && !defined(__LP64__) ++#error "Please use 'ARCH=parisc64' to build the 64-bit kernel." ++#endif ++ + /* See http://marc.theaimsgroup.com/?t=108826637900003 for discussion + * on use of volatile and __*_bit() (set/clear/change): + * *_bit() want use of volatile. diff --git a/queue-5.15/pci-hv-fix-numa-node-assignment-when-kernel-boots-with-custom-numa-topology.patch b/queue-5.15/pci-hv-fix-numa-node-assignment-when-kernel-boots-with-custom-numa-topology.patch new file mode 100644 index 00000000000..06e0d44b43e --- /dev/null +++ b/queue-5.15/pci-hv-fix-numa-node-assignment-when-kernel-boots-with-custom-numa-topology.patch @@ -0,0 +1,49 @@ +From 3149efcdf2c6314420c418dfc94de53bfd076b1f Mon Sep 17 00:00:00 2001 +From: Long Li +Date: Wed, 26 Jan 2022 17:43:34 -0800 +Subject: PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology + +From: Long Li + +commit 3149efcdf2c6314420c418dfc94de53bfd076b1f upstream. + +When kernel boots with a NUMA topology with some NUMA nodes offline, the PCI +driver should only set an online NUMA node on the device. This can happen +during KDUMP where some NUMA nodes are not made online by the KDUMP kernel. + +This patch also fixes the case where kernel is booting with "numa=off". + +Fixes: 999dd956d838 ("PCI: hv: Add support for protocol 1.3 and support PCI_BUS_RELATIONS2") +Signed-off-by: Long Li +Reviewed-by: Michael Kelley +Tested-by: Purna Pavan Chandra Aekkaladevi +Acked-by: Lorenzo Pieralisi +Link: https://lore.kernel.org/r/1643247814-15184-1-git-send-email-longli@linuxonhyperv.com +Signed-off-by: Wei Liu +Signed-off-by: Greg Kroah-Hartman +--- + drivers/pci/controller/pci-hyperv.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +--- a/drivers/pci/controller/pci-hyperv.c ++++ b/drivers/pci/controller/pci-hyperv.c +@@ -1899,8 +1899,17 @@ static void hv_pci_assign_numa_node(stru + if (!hv_dev) + continue; + +- if (hv_dev->desc.flags & HV_PCI_DEVICE_FLAG_NUMA_AFFINITY) +- set_dev_node(&dev->dev, hv_dev->desc.virtual_numa_node); ++ if (hv_dev->desc.flags & HV_PCI_DEVICE_FLAG_NUMA_AFFINITY && ++ hv_dev->desc.virtual_numa_node < num_possible_nodes()) ++ /* ++ * The kernel may boot with some NUMA nodes offline ++ * (e.g. in a KDUMP kernel) or with NUMA disabled via ++ * "numa=off". In those cases, adjust the host provided ++ * NUMA node to a valid NUMA node used by the kernel. ++ */ ++ set_dev_node(&dev->dev, ++ numa_map_to_online_node( ++ hv_dev->desc.virtual_numa_node)); + + put_pcichild(hv_dev); + } diff --git a/queue-5.15/revert-svm-add-warning-message-for-avic-ipi-invalid-target.patch b/queue-5.15/revert-svm-add-warning-message-for-avic-ipi-invalid-target.patch new file mode 100644 index 00000000000..93a9a2ea4c9 --- /dev/null +++ b/queue-5.15/revert-svm-add-warning-message-for-avic-ipi-invalid-target.patch @@ -0,0 +1,38 @@ +From dd4589eee99db8f61f7b8f7df1531cad3f74a64d Mon Sep 17 00:00:00 2001 +From: Sean Christopherson +Date: Fri, 4 Feb 2022 21:41:55 +0000 +Subject: Revert "svm: Add warning message for AVIC IPI invalid target" + +From: Sean Christopherson + +commit dd4589eee99db8f61f7b8f7df1531cad3f74a64d upstream. + +Remove a WARN on an "AVIC IPI invalid target" exit, the WARN is trivial +to trigger from guest as it will fail on any destination APIC ID that +doesn't exist from the guest's perspective. + +Don't bother recording anything in the kernel log, the common tracepoint +for kvm_avic_incomplete_ipi() is sufficient for debugging. + +This reverts commit 37ef0c4414c9743ba7f1af4392f0a27a99649f2a. + +Cc: stable@vger.kernel.org +Signed-off-by: Sean Christopherson +Message-Id: <20220204214205.3306634-2-seanjc@google.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/kvm/svm/avic.c | 2 -- + 1 file changed, 2 deletions(-) + +--- a/arch/x86/kvm/svm/avic.c ++++ b/arch/x86/kvm/svm/avic.c +@@ -342,8 +342,6 @@ int avic_incomplete_ipi_interception(str + avic_kick_target_vcpus(vcpu->kvm, apic, icrl, icrh); + break; + case AVIC_IPI_FAILURE_INVALID_TARGET: +- WARN_ONCE(1, "Invalid IPI target: index=%u, vcpu=%d, icr=%#0x:%#0x\n", +- index, vcpu->vcpu_id, icrh, icrl); + break; + case AVIC_IPI_FAILURE_INVALID_BACKING_PAGE: + WARN_ONCE(1, "Invalid backing page\n"); diff --git a/queue-5.15/scsi-lpfc-fix-mailbox-command-failure-during-driver-initialization.patch b/queue-5.15/scsi-lpfc-fix-mailbox-command-failure-during-driver-initialization.patch new file mode 100644 index 00000000000..fc0ab2a3089 --- /dev/null +++ b/queue-5.15/scsi-lpfc-fix-mailbox-command-failure-during-driver-initialization.patch @@ -0,0 +1,77 @@ +From efe1dc571a5b808baa26682eef16561be2e356fd Mon Sep 17 00:00:00 2001 +From: James Smart +Date: Tue, 21 Sep 2021 07:30:08 -0700 +Subject: scsi: lpfc: Fix mailbox command failure during driver initialization + +From: James Smart + +commit efe1dc571a5b808baa26682eef16561be2e356fd upstream. + +Contention for the mailbox interface may occur during driver initialization +(immediately after a function reset), between mailbox commands initiated +via ioctl (bsg) and those driver requested by the driver. + +After setting SLI_ACTIVE flag for a port, there is a window in which the +driver will allow an ioctl to be initiated while the adapter is +initializing and issuing mailbox commands via polling. The polling logic +then gets confused. + +Correct by having thread setting SLI_ACTIVE spot an active mailbox command +and allow it complete before proceeding. + +Link: https://lore.kernel.org/r/20210921143008.64212-1-jsmart2021@gmail.com +Co-developed-by: Nigel Kirkland +Signed-off-by: Nigel Kirkland +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman +--- + drivers/scsi/lpfc/lpfc_sli.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -8147,6 +8147,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phb + struct lpfc_vport *vport = phba->pport; + struct lpfc_dmabuf *mp; + struct lpfc_rqb *rqbp; ++ u32 flg; + + /* Perform a PCI function reset to start from clean */ + rc = lpfc_pci_function_reset(phba); +@@ -8160,7 +8161,17 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phb + else { + spin_lock_irq(&phba->hbalock); + phba->sli.sli_flag |= LPFC_SLI_ACTIVE; ++ flg = phba->sli.sli_flag; + spin_unlock_irq(&phba->hbalock); ++ /* Allow a little time after setting SLI_ACTIVE for any polled ++ * MBX commands to complete via BSG. ++ */ ++ for (i = 0; i < 50 && (flg & LPFC_SLI_MBOX_ACTIVE); i++) { ++ msleep(20); ++ spin_lock_irq(&phba->hbalock); ++ flg = phba->sli.sli_flag; ++ spin_unlock_irq(&phba->hbalock); ++ } + } + + lpfc_sli4_dip(phba); +@@ -9744,7 +9755,7 @@ lpfc_sli_issue_mbox_s4(struct lpfc_hba * + "(%d):2541 Mailbox command x%x " + "(x%x/x%x) failure: " + "mqe_sta: x%x mcqe_sta: x%x/x%x " +- "Data: x%x x%x\n,", ++ "Data: x%x x%x\n", + mboxq->vport ? mboxq->vport->vpi : 0, + mboxq->u.mb.mbxCommand, + lpfc_sli_config_mbox_subsys_get(phba, +@@ -9778,7 +9789,7 @@ lpfc_sli_issue_mbox_s4(struct lpfc_hba * + "(%d):2597 Sync Mailbox command " + "x%x (x%x/x%x) failure: " + "mqe_sta: x%x mcqe_sta: x%x/x%x " +- "Data: x%x x%x\n,", ++ "Data: x%x x%x\n", + mboxq->vport ? mboxq->vport->vpi : 0, + mboxq->u.mb.mbxCommand, + lpfc_sli_config_mbox_subsys_get(phba, diff --git a/queue-5.15/serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch b/queue-5.15/serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch new file mode 100644 index 00000000000..10812286ca8 --- /dev/null +++ b/queue-5.15/serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch @@ -0,0 +1,54 @@ +From 6e8793674bb0d1135ca0e5c9f7e16fecbf815926 Mon Sep 17 00:00:00 2001 +From: Randy Dunlap +Date: Mon, 14 Feb 2022 10:00:19 -0800 +Subject: serial: parisc: GSC: fix build when IOSAPIC is not set + +From: Randy Dunlap + +commit 6e8793674bb0d1135ca0e5c9f7e16fecbf815926 upstream. + +There is a build error when using a kernel .config file from +'kernel test robot' for a different build problem: + +hppa64-linux-ld: drivers/tty/serial/8250/8250_gsc.o: in function `.LC3': +(.data.rel.ro+0x18): undefined reference to `iosapic_serial_irq' + +when: + CONFIG_GSC=y + CONFIG_SERIO_GSCPS2=y + CONFIG_SERIAL_8250_GSC=y + CONFIG_PCI is not set + and hence PCI_LBA is not set. + IOSAPIC depends on PCI_LBA, so IOSAPIC is not set/enabled. + +Make the use of iosapic_serial_irq() conditional to fix the build error. + +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: "James E.J. Bottomley" +Cc: Helge Deller +Cc: linux-parisc@vger.kernel.org +Cc: Greg Kroah-Hartman +Cc: linux-serial@vger.kernel.org +Cc: Jiri Slaby +Cc: Johan Hovold +Suggested-by: Helge Deller +Signed-off-by: Helge Deller +Cc: stable@vger.kernel.org +Signed-off-by: Helge Deller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_gsc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_gsc.c ++++ b/drivers/tty/serial/8250/8250_gsc.c +@@ -26,7 +26,7 @@ static int __init serial_init_chip(struc + unsigned long address; + int err; + +-#ifdef CONFIG_64BIT ++#if defined(CONFIG_64BIT) && defined(CONFIG_IOSAPIC) + if (!dev->irq && (dev->id.sversion == 0xad)) + dev->irq = iosapic_serial_irq(dev); + #endif diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 00000000000..d8bbaed8e4b --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,20 @@ +drm-nouveau-pmu-gm200-use-alternate-falcon-reset-sequence.patch +fs-proc-task_mmu.c-don-t-read-mapcount-for-migration-entry.patch +btrfs-zoned-cache-reported-zone-during-mount.patch +scsi-lpfc-fix-mailbox-command-failure-during-driver-initialization.patch +hid-add-support-for-ugtablet-wp5540.patch +revert-svm-add-warning-message-for-avic-ipi-invalid-target.patch +parisc-show-error-if-wrong-32-64-bit-compiler-is-being-used.patch +serial-parisc-gsc-fix-build-when-iosapic-is-not-set.patch +parisc-drop-__init-from-map_pages-declaration.patch +parisc-fix-data-tlb-miss-in-sba_unmap_sg.patch +parisc-fix-sglist-access-in-ccio-dma.c.patch +mmc-block-fix-read-single-on-recovery-logic.patch +mm-don-t-try-to-numa-migrate-cow-pages-that-have-other-uses.patch +hid-amd_sfh-add-illuminance-mask-to-limit-als-max-value.patch +hid-i2c-hid-goodix-fix-a-lockdep-splat.patch +hid-amd_sfh-increase-sensor-command-timeout.patch +hid-amd_sfh-correct-the-structure-field-name.patch +pci-hv-fix-numa-node-assignment-when-kernel-boots-with-custom-numa-topology.patch +parisc-add-ioread64_lo_hi-and-iowrite64_lo_hi.patch +btrfs-send-in-case-of-io-error-log-it.patch -- 2.47.3