From e84c5ac912b1c02252c1e3a2517ecbc91ab3a6a4 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 13 Nov 2021 16:35:55 +0100 Subject: [PATCH] 5.14-stable patches added patches: asoc-tegra-restore-ac97-support.patch asoc-tegra-set-default-card-name-for-trimslice.patch iio-core-check-return-value-when-calling-dev_set_name.patch iio-core-fix-double-free-in-iio_device_unregister_sysfs.patch memory-renesas-rpc-if-correct-qspi-data-transfer-in-manual-mode.patch mtd-rawnand-socrates-keep-the-driver-compatible-with-on-die-ecc-engines.patch perf-x86-intel-uncore-fix-intel-icx-iio-event-constraints.patch perf-x86-intel-uncore-fix-invalid-unit-check.patch perf-x86-intel-uncore-support-extra-imc-channel-on-ice-lake-server.patch power-supply-max17042_battery-prevent-int-underflow-in-set_soc_threshold.patch power-supply-max17042_battery-use-vfsoc-for-capacity-when-no-rsns.patch rdma-qedr-fix-null-deref-for-query_qp-on-the-gsi-qp.patch signal-mips-update-_save-_restore-_fp_context-to-fail-with-efault.patch signal-remove-the-bogus-sigkill_pending-in-ptrace_stop.patch soc-fsl-dpio-replace-smp_processor_id-with-raw_smp_processor_id.patch soc-fsl-dpio-use-the-combined-functions-to-protect-critical-zone.patch soc-samsung-exynos-pmu-fix-compilation-when-nothing-selects-config_mfd_core.patch --- .../asoc-tegra-restore-ac97-support.patch | 123 ++++++++ ...-set-default-card-name-for-trimslice.patch | 33 +++ ...turn-value-when-calling-dev_set_name.patch | 53 ++++ ...-free-in-iio_device_unregister_sysfs.patch | 47 +++ ...ct-qspi-data-transfer-in-manual-mode.patch | 273 ++++++++++++++++++ ...r-compatible-with-on-die-ecc-engines.patch | 71 +++++ ...-fix-intel-icx-iio-event-constraints.patch | 36 +++ ...-intel-uncore-fix-invalid-unit-check.patch | 39 +++ ...extra-imc-channel-on-ice-lake-server.patch | 47 +++ ...t-int-underflow-in-set_soc_threshold.patch | 35 +++ ...-use-vfsoc-for-capacity-when-no-rsns.patch | 45 +++ ...ull-deref-for-query_qp-on-the-gsi-qp.patch | 91 ++++++ queue-5.14/series | 17 ++ ...tore-_fp_context-to-fail-with-efault.patch | 68 +++++ ...bogus-sigkill_pending-in-ptrace_stop.patch | 78 +++++ ...ocessor_id-with-raw_smp_processor_id.patch | 57 ++++ ...d-functions-to-protect-critical-zone.patch | 87 ++++++ ...when-nothing-selects-config_mfd_core.patch | 39 +++ 18 files changed, 1239 insertions(+) create mode 100644 queue-5.14/asoc-tegra-restore-ac97-support.patch create mode 100644 queue-5.14/asoc-tegra-set-default-card-name-for-trimslice.patch create mode 100644 queue-5.14/iio-core-check-return-value-when-calling-dev_set_name.patch create mode 100644 queue-5.14/iio-core-fix-double-free-in-iio_device_unregister_sysfs.patch create mode 100644 queue-5.14/memory-renesas-rpc-if-correct-qspi-data-transfer-in-manual-mode.patch create mode 100644 queue-5.14/mtd-rawnand-socrates-keep-the-driver-compatible-with-on-die-ecc-engines.patch create mode 100644 queue-5.14/perf-x86-intel-uncore-fix-intel-icx-iio-event-constraints.patch create mode 100644 queue-5.14/perf-x86-intel-uncore-fix-invalid-unit-check.patch create mode 100644 queue-5.14/perf-x86-intel-uncore-support-extra-imc-channel-on-ice-lake-server.patch create mode 100644 queue-5.14/power-supply-max17042_battery-prevent-int-underflow-in-set_soc_threshold.patch create mode 100644 queue-5.14/power-supply-max17042_battery-use-vfsoc-for-capacity-when-no-rsns.patch create mode 100644 queue-5.14/rdma-qedr-fix-null-deref-for-query_qp-on-the-gsi-qp.patch create mode 100644 queue-5.14/signal-mips-update-_save-_restore-_fp_context-to-fail-with-efault.patch create mode 100644 queue-5.14/signal-remove-the-bogus-sigkill_pending-in-ptrace_stop.patch create mode 100644 queue-5.14/soc-fsl-dpio-replace-smp_processor_id-with-raw_smp_processor_id.patch create mode 100644 queue-5.14/soc-fsl-dpio-use-the-combined-functions-to-protect-critical-zone.patch create mode 100644 queue-5.14/soc-samsung-exynos-pmu-fix-compilation-when-nothing-selects-config_mfd_core.patch diff --git a/queue-5.14/asoc-tegra-restore-ac97-support.patch b/queue-5.14/asoc-tegra-restore-ac97-support.patch new file mode 100644 index 00000000000..f334fe86794 --- /dev/null +++ b/queue-5.14/asoc-tegra-restore-ac97-support.patch @@ -0,0 +1,123 @@ +From de8fc2b0a3f9930f3cbe801d40758bb1d80b0ad8 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Sun, 24 Oct 2021 22:28:52 +0300 +Subject: ASoC: tegra: Restore AC97 support + +From: Dmitry Osipenko + +commit de8fc2b0a3f9930f3cbe801d40758bb1d80b0ad8 upstream. + +The device-tree of AC97 codecs need to be parsed differently from I2S +codecs, plus codec device may need to be created. This was missed by the +patch that unified machine drivers into a single driver, fix it. It should +restore audio on Toradex Colibri board. + +Cc: +Fixes: cc8f70f56039 ("ASoC: tegra: Unify ASoC machine drivers") +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20211024192853.21957-1-digetx@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/tegra/tegra_asoc_machine.c | 63 ++++++++++++++++++++++++++++------- + sound/soc/tegra/tegra_asoc_machine.h | 1 + 2 files changed, 52 insertions(+), 12 deletions(-) + +--- a/sound/soc/tegra/tegra_asoc_machine.c ++++ b/sound/soc/tegra/tegra_asoc_machine.c +@@ -341,9 +341,34 @@ tegra_machine_parse_phandle(struct devic + return np; + } + ++static void tegra_machine_unregister_codec(void *pdev) ++{ ++ platform_device_unregister(pdev); ++} ++ ++static int tegra_machine_register_codec(struct device *dev, const char *name) ++{ ++ struct platform_device *pdev; ++ int err; ++ ++ if (!name) ++ return 0; ++ ++ pdev = platform_device_register_simple(name, -1, NULL, 0); ++ if (IS_ERR(pdev)) ++ return PTR_ERR(pdev); ++ ++ err = devm_add_action_or_reset(dev, tegra_machine_unregister_codec, ++ pdev); ++ if (err) ++ return err; ++ ++ return 0; ++} ++ + int tegra_asoc_machine_probe(struct platform_device *pdev) + { +- struct device_node *np_codec, *np_i2s; ++ struct device_node *np_codec, *np_i2s, *np_ac97; + const struct tegra_asoc_data *asoc; + struct device *dev = &pdev->dev; + struct tegra_machine *machine; +@@ -404,17 +429,30 @@ int tegra_asoc_machine_probe(struct plat + return err; + } + +- np_codec = tegra_machine_parse_phandle(dev, "nvidia,audio-codec"); +- if (IS_ERR(np_codec)) +- return PTR_ERR(np_codec); +- +- np_i2s = tegra_machine_parse_phandle(dev, "nvidia,i2s-controller"); +- if (IS_ERR(np_i2s)) +- return PTR_ERR(np_i2s); +- +- card->dai_link->cpus->of_node = np_i2s; +- card->dai_link->codecs->of_node = np_codec; +- card->dai_link->platforms->of_node = np_i2s; ++ if (asoc->set_ac97) { ++ err = tegra_machine_register_codec(dev, asoc->codec_dev_name); ++ if (err) ++ return err; ++ ++ np_ac97 = tegra_machine_parse_phandle(dev, "nvidia,ac97-controller"); ++ if (IS_ERR(np_ac97)) ++ return PTR_ERR(np_ac97); ++ ++ card->dai_link->cpus->of_node = np_ac97; ++ card->dai_link->platforms->of_node = np_ac97; ++ } else { ++ np_codec = tegra_machine_parse_phandle(dev, "nvidia,audio-codec"); ++ if (IS_ERR(np_codec)) ++ return PTR_ERR(np_codec); ++ ++ np_i2s = tegra_machine_parse_phandle(dev, "nvidia,i2s-controller"); ++ if (IS_ERR(np_i2s)) ++ return PTR_ERR(np_i2s); ++ ++ card->dai_link->cpus->of_node = np_i2s; ++ card->dai_link->codecs->of_node = np_codec; ++ card->dai_link->platforms->of_node = np_i2s; ++ } + + if (asoc->add_common_controls) { + card->controls = tegra_machine_controls; +@@ -589,6 +627,7 @@ static struct snd_soc_card snd_soc_tegra + static const struct tegra_asoc_data tegra_wm9712_data = { + .card = &snd_soc_tegra_wm9712, + .add_common_dapm_widgets = true, ++ .codec_dev_name = "wm9712-codec", + .set_ac97 = true, + }; + +--- a/sound/soc/tegra/tegra_asoc_machine.h ++++ b/sound/soc/tegra/tegra_asoc_machine.h +@@ -13,6 +13,7 @@ struct snd_soc_pcm_runtime; + + struct tegra_asoc_data { + unsigned int (*mclk_rate)(unsigned int srate); ++ const char *codec_dev_name; + struct snd_soc_card *card; + unsigned int mclk_id; + bool hp_jack_gpio_active_low; diff --git a/queue-5.14/asoc-tegra-set-default-card-name-for-trimslice.patch b/queue-5.14/asoc-tegra-set-default-card-name-for-trimslice.patch new file mode 100644 index 00000000000..adc8c8b8b1b --- /dev/null +++ b/queue-5.14/asoc-tegra-set-default-card-name-for-trimslice.patch @@ -0,0 +1,33 @@ +From 824edd866a13db7dbb0d8e26d2142f10271b6460 Mon Sep 17 00:00:00 2001 +From: Dmitry Osipenko +Date: Sun, 24 Oct 2021 22:28:53 +0300 +Subject: ASoC: tegra: Set default card name for Trimslice + +From: Dmitry Osipenko + +commit 824edd866a13db7dbb0d8e26d2142f10271b6460 upstream. + +The default card name for Trimslice device should be "tegra-trimslice". +It got lost by accident during unification of machine sound drivers, +fix it. + +Cc: +Fixes: cc8f70f56039 ("ASoC: tegra: Unify ASoC machine drivers") +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20211024192853.21957-2-digetx@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Greg Kroah-Hartman +--- + sound/soc/tegra/tegra_asoc_machine.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/sound/soc/tegra/tegra_asoc_machine.c ++++ b/sound/soc/tegra/tegra_asoc_machine.c +@@ -686,6 +686,7 @@ static struct snd_soc_dai_link tegra_tlv + }; + + static struct snd_soc_card snd_soc_tegra_trimslice = { ++ .name = "tegra-trimslice", + .components = "codec:tlv320aic23", + .dai_link = &tegra_tlv320aic23_dai, + .num_links = 1, diff --git a/queue-5.14/iio-core-check-return-value-when-calling-dev_set_name.patch b/queue-5.14/iio-core-check-return-value-when-calling-dev_set_name.patch new file mode 100644 index 00000000000..74e8bd64350 --- /dev/null +++ b/queue-5.14/iio-core-check-return-value-when-calling-dev_set_name.patch @@ -0,0 +1,53 @@ +From fe6f45f6ba22d625a8500cbad0237c60dd3117ee Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Tue, 12 Oct 2021 14:36:24 +0800 +Subject: iio: core: check return value when calling dev_set_name() + +From: Yang Yingliang + +commit fe6f45f6ba22d625a8500cbad0237c60dd3117ee upstream. + +I got a null-ptr-deref report when doing fault injection test: + +BUG: kernel NULL pointer dereference, address: 0000000000000000 +RIP: 0010:strlen+0x0/0x20 +Call Trace: + start_creating+0x199/0x2f0 + debugfs_create_dir+0x25/0x430 + __iio_device_register+0x4da/0x1b40 [industrialio] + __devm_iio_device_register+0x22/0x80 [industrialio] + max1027_probe+0x639/0x860 [max1027] + spi_probe+0x183/0x210 + really_probe+0x285/0xc30 + +If dev_set_name() fails, the dev_name() is null, check the return +value of dev_set_name() to avoid the null-ptr-deref. + +Reported-by: Hulk Robot +Fixes: e553f182d55b ("staging: iio: core: Introduce debugfs support...") +Signed-off-by: Yang Yingliang +Cc: +Link: https://lore.kernel.org/r/20211012063624.3167460-1-yangyingliang@huawei.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/industrialio-core.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +--- a/drivers/iio/industrialio-core.c ++++ b/drivers/iio/industrialio-core.c +@@ -1662,7 +1662,13 @@ struct iio_dev *iio_device_alloc(struct + kfree(iio_dev_opaque); + return NULL; + } +- dev_set_name(&indio_dev->dev, "iio:device%d", iio_dev_opaque->id); ++ ++ if (dev_set_name(&indio_dev->dev, "iio:device%d", iio_dev_opaque->id)) { ++ ida_simple_remove(&iio_ida, iio_dev_opaque->id); ++ kfree(iio_dev_opaque); ++ return NULL; ++ } ++ + INIT_LIST_HEAD(&iio_dev_opaque->buffer_list); + INIT_LIST_HEAD(&iio_dev_opaque->ioctl_handlers); + diff --git a/queue-5.14/iio-core-fix-double-free-in-iio_device_unregister_sysfs.patch b/queue-5.14/iio-core-fix-double-free-in-iio_device_unregister_sysfs.patch new file mode 100644 index 00000000000..8b9219a59d3 --- /dev/null +++ b/queue-5.14/iio-core-fix-double-free-in-iio_device_unregister_sysfs.patch @@ -0,0 +1,47 @@ +From 19833c40d0415d6fe4340b5b9c46239abbf718f6 Mon Sep 17 00:00:00 2001 +From: Yang Yingliang +Date: Wed, 13 Oct 2021 11:05:32 +0800 +Subject: iio: core: fix double free in iio_device_unregister_sysfs() + +From: Yang Yingliang + +commit 19833c40d0415d6fe4340b5b9c46239abbf718f6 upstream. + +I got the double free report: + +BUG: KASAN: double-free or invalid-free in kfree+0xce/0x390 + iio_device_unregister_sysfs+0x108/0x13b [industrialio] + iio_dev_release+0x9e/0x10e [industrialio] + device_release+0xa5/0x240 + +If __iio_device_register() fails, iio_dev_opaque->groups will be freed +in error path in iio_device_unregister_sysfs(), then iio_dev_release() +will call iio_device_unregister_sysfs() again, it causes double free. +Set iio_dev_opaque->groups to NULL when it's freed to fix this double free. + +Not this is a local work around for a more general mess around life time +management that will get cleaned up and should make this handling +unnecesarry. + +Fixes: 32f171724e5c ("iio: core: rework iio device group creation") +Reported-by: Hulk Robot +Reviewed-by: Alexandru Ardelean +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20211013030532.956133-1-yangyingliang@huawei.com +Cc: +Signed-off-by: Jonathan Cameron +Signed-off-by: Greg Kroah-Hartman +--- + drivers/iio/industrialio-core.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/iio/industrialio-core.c ++++ b/drivers/iio/industrialio-core.c +@@ -1597,6 +1597,7 @@ static void iio_device_unregister_sysfs( + kfree(iio_dev_opaque->chan_attr_group.attrs); + iio_dev_opaque->chan_attr_group.attrs = NULL; + kfree(iio_dev_opaque->groups); ++ iio_dev_opaque->groups = NULL; + } + + static void iio_dev_release(struct device *device) diff --git a/queue-5.14/memory-renesas-rpc-if-correct-qspi-data-transfer-in-manual-mode.patch b/queue-5.14/memory-renesas-rpc-if-correct-qspi-data-transfer-in-manual-mode.patch new file mode 100644 index 00000000000..38a131637df --- /dev/null +++ b/queue-5.14/memory-renesas-rpc-if-correct-qspi-data-transfer-in-manual-mode.patch @@ -0,0 +1,273 @@ +From fff53a551db50f5edecaa0b29a64056ab8d2bbca Mon Sep 17 00:00:00 2001 +From: Wolfram Sang +Date: Wed, 22 Sep 2021 11:10:06 +0200 +Subject: memory: renesas-rpc-if: Correct QSPI data transfer in Manual mode + +From: Wolfram Sang + +commit fff53a551db50f5edecaa0b29a64056ab8d2bbca upstream. + +This patch fixes 2 problems: +[1] The output warning logs and data loss when performing +mount/umount then remount the device with jffs2 format. +[2] The access width of SMWDR[0:1]/SMRDR[0:1] register is wrong. + +This is the sample warning logs when performing mount/umount then +remount the device with jffs2 format: +jffs2: jffs2_scan_inode_node(): CRC failed on node at 0x031c51d4: +Read 0x00034e00, calculated 0xadb272a7 + +The reason for issue [1] is that the writing data seems to +get messed up. +Data is only completed when the number of bytes is divisible by 4. +If you only have 3 bytes of data left to write, 1 garbage byte +is inserted after the end of the write stream. +If you only have 2 bytes of data left to write, 2 bytes of '00' +are added into the write stream. +If you only have 1 byte of data left to write, 2 bytes of '00' +are added into the write stream. 1 garbage byte is inserted after +the end of the write stream. + +To solve problem [1], data must be written continuously in serial +and the write stream ends when data is out. + +Following HW manual 62.2.15, access to SMWDR0 register should be +in the same size as the transfer size specified in the SPIDE[3:0] +bits in the manual mode enable setting register (SMENR). +Be sure to access from address 0. + +So, in 16-bit transfer (SPIDE[3:0]=b'1100), SMWDR0 should be +accessed by 16-bit width. +Similar to SMWDR1, SMDDR0/1 registers. +In current code, SMWDR0 register is accessed by regmap_write() +that only set up to do 32-bit width. + +To solve problem [2], data must be written 16-bit or 8-bit when +transferring 1-byte or 2-byte. + +Fixes: ca7d8b980b67 ("memory: add Renesas RPC-IF driver") +Cc: +Signed-off-by: Duc Nguyen +[wsa: refactored to use regmap only via reg_read/reg_write] +Signed-off-by: Wolfram Sang +Tested-by: Lad Prabhakar +Link: https://lore.kernel.org/r/20210922091007.5516-1-wsa+renesas@sang-engineering.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/memory/renesas-rpc-if.c | 113 +++++++++++++++++++++++++++------------- + include/memory/renesas-rpc-if.h | 1 + 2 files changed, 79 insertions(+), 35 deletions(-) + +--- a/drivers/memory/renesas-rpc-if.c ++++ b/drivers/memory/renesas-rpc-if.c +@@ -160,10 +160,62 @@ static const struct regmap_access_table + .n_yes_ranges = ARRAY_SIZE(rpcif_volatile_ranges), + }; + ++ ++/* ++ * Custom accessor functions to ensure SMRDR0 and SMWDR0 are always accessed ++ * with proper width. Requires SMENR_SPIDE to be correctly set before! ++ */ ++static int rpcif_reg_read(void *context, unsigned int reg, unsigned int *val) ++{ ++ struct rpcif *rpc = context; ++ ++ if (reg == RPCIF_SMRDR0 || reg == RPCIF_SMWDR0) { ++ u32 spide = readl(rpc->base + RPCIF_SMENR) & RPCIF_SMENR_SPIDE(0xF); ++ ++ if (spide == 0x8) { ++ *val = readb(rpc->base + reg); ++ return 0; ++ } else if (spide == 0xC) { ++ *val = readw(rpc->base + reg); ++ return 0; ++ } else if (spide != 0xF) { ++ return -EILSEQ; ++ } ++ } ++ ++ *val = readl(rpc->base + reg); ++ return 0; ++ ++} ++ ++static int rpcif_reg_write(void *context, unsigned int reg, unsigned int val) ++{ ++ struct rpcif *rpc = context; ++ ++ if (reg == RPCIF_SMRDR0 || reg == RPCIF_SMWDR0) { ++ u32 spide = readl(rpc->base + RPCIF_SMENR) & RPCIF_SMENR_SPIDE(0xF); ++ ++ if (spide == 0x8) { ++ writeb(val, rpc->base + reg); ++ return 0; ++ } else if (spide == 0xC) { ++ writew(val, rpc->base + reg); ++ return 0; ++ } else if (spide != 0xF) { ++ return -EILSEQ; ++ } ++ } ++ ++ writel(val, rpc->base + reg); ++ return 0; ++} ++ + static const struct regmap_config rpcif_regmap_config = { + .reg_bits = 32, + .val_bits = 32, + .reg_stride = 4, ++ .reg_read = rpcif_reg_read, ++ .reg_write = rpcif_reg_write, + .fast_io = true, + .max_register = RPCIF_PHYINT, + .volatile_table = &rpcif_volatile_table, +@@ -173,17 +225,15 @@ int rpcif_sw_init(struct rpcif *rpc, str + { + struct platform_device *pdev = to_platform_device(dev); + struct resource *res; +- void __iomem *base; + + rpc->dev = dev; + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "regs"); +- base = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(base)) +- return PTR_ERR(base); ++ rpc->base = devm_ioremap_resource(&pdev->dev, res); ++ if (IS_ERR(rpc->base)) ++ return PTR_ERR(rpc->base); + +- rpc->regmap = devm_regmap_init_mmio(&pdev->dev, base, +- &rpcif_regmap_config); ++ rpc->regmap = devm_regmap_init(&pdev->dev, NULL, rpc, &rpcif_regmap_config); + if (IS_ERR(rpc->regmap)) { + dev_err(&pdev->dev, + "failed to init regmap for rpcif, error %ld\n", +@@ -354,20 +404,16 @@ void rpcif_prepare(struct rpcif *rpc, co + nbytes = op->data.nbytes; + rpc->xferlen = nbytes; + +- rpc->enable |= RPCIF_SMENR_SPIDE(rpcif_bits_set(rpc, nbytes)) | +- RPCIF_SMENR_SPIDB(rpcif_bit_size(op->data.buswidth)); ++ rpc->enable |= RPCIF_SMENR_SPIDB(rpcif_bit_size(op->data.buswidth)); + } + } + EXPORT_SYMBOL(rpcif_prepare); + + int rpcif_manual_xfer(struct rpcif *rpc) + { +- u32 smenr, smcr, pos = 0, max = 4; ++ u32 smenr, smcr, pos = 0, max = rpc->bus_size == 2 ? 8 : 4; + int ret = 0; + +- if (rpc->bus_size == 2) +- max = 8; +- + pm_runtime_get_sync(rpc->dev); + + regmap_update_bits(rpc->regmap, RPCIF_PHYCNT, +@@ -378,37 +424,36 @@ int rpcif_manual_xfer(struct rpcif *rpc) + regmap_write(rpc->regmap, RPCIF_SMOPR, rpc->option); + regmap_write(rpc->regmap, RPCIF_SMDMCR, rpc->dummy); + regmap_write(rpc->regmap, RPCIF_SMDRENR, rpc->ddr); ++ regmap_write(rpc->regmap, RPCIF_SMADR, rpc->smadr); + smenr = rpc->enable; + + switch (rpc->dir) { + case RPCIF_DATA_OUT: + while (pos < rpc->xferlen) { +- u32 nbytes = rpc->xferlen - pos; +- u32 data[2]; ++ u32 bytes_left = rpc->xferlen - pos; ++ u32 nbytes, data[2]; + + smcr = rpc->smcr | RPCIF_SMCR_SPIE; +- if (nbytes > max) { +- nbytes = max; ++ ++ /* nbytes may only be 1, 2, 4, or 8 */ ++ nbytes = bytes_left >= max ? max : (1 << ilog2(bytes_left)); ++ if (bytes_left > nbytes) + smcr |= RPCIF_SMCR_SSLKP; +- } ++ ++ smenr |= RPCIF_SMENR_SPIDE(rpcif_bits_set(rpc, nbytes)); ++ regmap_write(rpc->regmap, RPCIF_SMENR, smenr); + + memcpy(data, rpc->buffer + pos, nbytes); +- if (nbytes > 4) { ++ if (nbytes == 8) { + regmap_write(rpc->regmap, RPCIF_SMWDR1, + data[0]); + regmap_write(rpc->regmap, RPCIF_SMWDR0, + data[1]); +- } else if (nbytes > 2) { ++ } else { + regmap_write(rpc->regmap, RPCIF_SMWDR0, + data[0]); +- } else { +- regmap_write(rpc->regmap, RPCIF_SMWDR0, +- data[0] << 16); + } + +- regmap_write(rpc->regmap, RPCIF_SMADR, +- rpc->smadr + pos); +- regmap_write(rpc->regmap, RPCIF_SMENR, smenr); + regmap_write(rpc->regmap, RPCIF_SMCR, smcr); + ret = wait_msg_xfer_end(rpc); + if (ret) +@@ -448,14 +493,16 @@ int rpcif_manual_xfer(struct rpcif *rpc) + break; + } + while (pos < rpc->xferlen) { +- u32 nbytes = rpc->xferlen - pos; +- u32 data[2]; ++ u32 bytes_left = rpc->xferlen - pos; ++ u32 nbytes, data[2]; + +- if (nbytes > max) +- nbytes = max; ++ /* nbytes may only be 1, 2, 4, or 8 */ ++ nbytes = bytes_left >= max ? max : (1 << ilog2(bytes_left)); + + regmap_write(rpc->regmap, RPCIF_SMADR, + rpc->smadr + pos); ++ smenr &= ~RPCIF_SMENR_SPIDE(0xF); ++ smenr |= RPCIF_SMENR_SPIDE(rpcif_bits_set(rpc, nbytes)); + regmap_write(rpc->regmap, RPCIF_SMENR, smenr); + regmap_write(rpc->regmap, RPCIF_SMCR, + rpc->smcr | RPCIF_SMCR_SPIE); +@@ -463,18 +510,14 @@ int rpcif_manual_xfer(struct rpcif *rpc) + if (ret) + goto err_out; + +- if (nbytes > 4) { ++ if (nbytes == 8) { + regmap_read(rpc->regmap, RPCIF_SMRDR1, + &data[0]); + regmap_read(rpc->regmap, RPCIF_SMRDR0, + &data[1]); +- } else if (nbytes > 2) { +- regmap_read(rpc->regmap, RPCIF_SMRDR0, +- &data[0]); +- } else { ++ } else { + regmap_read(rpc->regmap, RPCIF_SMRDR0, + &data[0]); +- data[0] >>= 16; + } + memcpy(rpc->buffer + pos, data, nbytes); + +--- a/include/memory/renesas-rpc-if.h ++++ b/include/memory/renesas-rpc-if.h +@@ -59,6 +59,7 @@ struct rpcif_op { + + struct rpcif { + struct device *dev; ++ void __iomem *base; + void __iomem *dirmap; + struct regmap *regmap; + struct reset_control *rstc; diff --git a/queue-5.14/mtd-rawnand-socrates-keep-the-driver-compatible-with-on-die-ecc-engines.patch b/queue-5.14/mtd-rawnand-socrates-keep-the-driver-compatible-with-on-die-ecc-engines.patch new file mode 100644 index 00000000000..3e94a91d102 --- /dev/null +++ b/queue-5.14/mtd-rawnand-socrates-keep-the-driver-compatible-with-on-die-ecc-engines.patch @@ -0,0 +1,71 @@ +From b4ebddd6540d78a7f977b3fea0261bd575c6ffe2 Mon Sep 17 00:00:00 2001 +From: Miquel Raynal +Date: Wed, 29 Sep 2021 00:22:47 +0200 +Subject: mtd: rawnand: socrates: Keep the driver compatible with on-die ECC engines + +From: Miquel Raynal + +commit b4ebddd6540d78a7f977b3fea0261bd575c6ffe2 upstream. + +Following the introduction of the generic ECC engine infrastructure, it +was necessary to reorganize the code and move the ECC configuration in +the ->attach_chip() hook. Failing to do that properly lead to a first +series of fixes supposed to stabilize the situation. Unfortunately, this +only fixed the use of software ECC engines, preventing any other kind of +engine to be used, including on-die ones. + +It is now time to (finally) fix the situation by ensuring that we still +provide a default (eg. software ECC) but will still support different +ECC engines such as on-die ECC engines if properly described in the +device tree. + +There are no changes needed on the core side in order to do this, but we +just need to leverage the logic there which allows: +1- a subsystem default (set to Host engines in the raw NAND world) +2- a driver specific default (here set to software ECC engines) +3- any type of engine requested by the user (ie. described in the DT) + +As the raw NAND subsystem has not yet been fully converted to the ECC +engine infrastructure, in order to provide a default ECC engine for this +driver we need to set chip->ecc.engine_type *before* calling +nand_scan(). During the initialization step, the core will consider this +entry as the default engine for this driver. This value may of course +be overloaded by the user if the usual DT properties are provided. + +Fixes: b36bf0a0fe5d ("mtd: rawnand: socrates: Move the ECC initialization to ->attach_chip()") +Cc: stable@vger.kernel.org +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20210928222258.199726-9-miquel.raynal@bootlin.com +Signed-off-by: Greg Kroah-Hartman +--- + drivers/mtd/nand/raw/socrates_nand.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +--- a/drivers/mtd/nand/raw/socrates_nand.c ++++ b/drivers/mtd/nand/raw/socrates_nand.c +@@ -119,9 +119,8 @@ static int socrates_nand_device_ready(st + + static int socrates_attach_chip(struct nand_chip *chip) + { +- chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT; +- +- if (chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN) ++ if (chip->ecc.engine_type == NAND_ECC_ENGINE_TYPE_SOFT && ++ chip->ecc.algo == NAND_ECC_ALGO_UNKNOWN) + chip->ecc.algo = NAND_ECC_ALGO_HAMMING; + + return 0; +@@ -175,6 +174,13 @@ static int socrates_nand_probe(struct pl + /* TODO: I have no idea what real delay is. */ + nand_chip->legacy.chip_delay = 20; /* 20us command delay time */ + ++ /* ++ * This driver assumes that the default ECC engine should be TYPE_SOFT. ++ * Set ->engine_type before registering the NAND devices in order to ++ * provide a driver specific default value. ++ */ ++ nand_chip->ecc.engine_type = NAND_ECC_ENGINE_TYPE_SOFT; ++ + dev_set_drvdata(&ofdev->dev, host); + + res = nand_scan(nand_chip, 1); diff --git a/queue-5.14/perf-x86-intel-uncore-fix-intel-icx-iio-event-constraints.patch b/queue-5.14/perf-x86-intel-uncore-fix-intel-icx-iio-event-constraints.patch new file mode 100644 index 00000000000..e56787be113 --- /dev/null +++ b/queue-5.14/perf-x86-intel-uncore-fix-intel-icx-iio-event-constraints.patch @@ -0,0 +1,36 @@ +From f42e8a603c88f72bf047a710b9fc1d3579f31e71 Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Thu, 26 Aug 2021 08:32:39 -0700 +Subject: perf/x86/intel/uncore: Fix Intel ICX IIO event constraints + +From: Kan Liang + +commit f42e8a603c88f72bf047a710b9fc1d3579f31e71 upstream. + +According to the latest uncore document, both NUM_OUTSTANDING_REQ_OF_CPU +(0x88) event and COMP_BUF_OCCUPANCY(0xd5) event also have constraints. Add +them into the event constraints table. + +Fixes: 2b3b76b5ec67 ("perf/x86/intel/uncore: Add Ice Lake server uncore support") +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/1629991963-102621-4-git-send-email-kan.liang@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/intel/uncore_snbep.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -5051,8 +5051,10 @@ static struct event_constraint icx_uncor + UNCORE_EVENT_CONSTRAINT(0x02, 0x3), + UNCORE_EVENT_CONSTRAINT(0x03, 0x3), + UNCORE_EVENT_CONSTRAINT(0x83, 0x3), ++ UNCORE_EVENT_CONSTRAINT(0x88, 0xc), + UNCORE_EVENT_CONSTRAINT(0xc0, 0xc), + UNCORE_EVENT_CONSTRAINT(0xc5, 0xc), ++ UNCORE_EVENT_CONSTRAINT(0xd5, 0xc), + EVENT_CONSTRAINT_END + }; + diff --git a/queue-5.14/perf-x86-intel-uncore-fix-invalid-unit-check.patch b/queue-5.14/perf-x86-intel-uncore-fix-invalid-unit-check.patch new file mode 100644 index 00000000000..08c826e449d --- /dev/null +++ b/queue-5.14/perf-x86-intel-uncore-fix-invalid-unit-check.patch @@ -0,0 +1,39 @@ +From e2bb9fab08cbcc7922050c7eb0bd650807abfa4e Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Thu, 26 Aug 2021 08:32:38 -0700 +Subject: perf/x86/intel/uncore: Fix invalid unit check + +From: Kan Liang + +commit e2bb9fab08cbcc7922050c7eb0bd650807abfa4e upstream. + +The uncore unit with the type ID 0 and the unit ID 0 is missed. + +The table3 of the uncore unit maybe 0. The +uncore_discovery_invalid_unit() mistakenly treated it as an invalid +value. + +Remove the !unit.table3 check. + +Fixes: edae1f06c2cd ("perf/x86/intel/uncore: Parse uncore discovery tables") +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Andi Kleen +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/1629991963-102621-3-git-send-email-kan.liang@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/intel/uncore_discovery.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/arch/x86/events/intel/uncore_discovery.h ++++ b/arch/x86/events/intel/uncore_discovery.h +@@ -30,7 +30,7 @@ + + + #define uncore_discovery_invalid_unit(unit) \ +- (!unit.table1 || !unit.ctl || !unit.table3 || \ ++ (!unit.table1 || !unit.ctl || \ + unit.table1 == -1ULL || unit.ctl == -1ULL || \ + unit.table3 == -1ULL) + diff --git a/queue-5.14/perf-x86-intel-uncore-support-extra-imc-channel-on-ice-lake-server.patch b/queue-5.14/perf-x86-intel-uncore-support-extra-imc-channel-on-ice-lake-server.patch new file mode 100644 index 00000000000..8d89451558b --- /dev/null +++ b/queue-5.14/perf-x86-intel-uncore-support-extra-imc-channel-on-ice-lake-server.patch @@ -0,0 +1,47 @@ +From 496a18f09374ad89b3ab4366019bc3975db90234 Mon Sep 17 00:00:00 2001 +From: Kan Liang +Date: Thu, 26 Aug 2021 08:32:37 -0700 +Subject: perf/x86/intel/uncore: Support extra IMC channel on Ice Lake server + +From: Kan Liang + +commit 496a18f09374ad89b3ab4366019bc3975db90234 upstream. + +There are three channels on a Ice Lake server, but only two channels +will ever be active. Current perf only enables two channels. + +Support the extra IMC channel, which may be activated on some Ice Lake +machines. For a non-activated channel, the SW can still access it. The +write will be ignored by the HW. 0 is always returned for the reading. + +Fixes: 2b3b76b5ec67 ("perf/x86/intel/uncore: Add Ice Lake server uncore support") +Signed-off-by: Kan Liang +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Andi Kleen +Cc: stable@vger.kernel.org +Link: https://lkml.kernel.org/r/1629991963-102621-2-git-send-email-kan.liang@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +--- + arch/x86/events/intel/uncore_snbep.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -451,7 +451,7 @@ + #define ICX_M3UPI_PCI_PMON_BOX_CTL 0xa0 + + /* ICX IMC */ +-#define ICX_NUMBER_IMC_CHN 2 ++#define ICX_NUMBER_IMC_CHN 3 + #define ICX_IMC_MEM_STRIDE 0x4 + + DEFINE_UNCORE_FORMAT_ATTR(event, event, "config:0-7"); +@@ -5437,7 +5437,7 @@ static struct intel_uncore_ops icx_uncor + static struct intel_uncore_type icx_uncore_imc = { + .name = "imc", + .num_counters = 4, +- .num_boxes = 8, ++ .num_boxes = 12, + .perf_ctr_bits = 48, + .fixed_ctr_bits = 48, + .fixed_ctr = SNR_IMC_MMIO_PMON_FIXED_CTR, diff --git a/queue-5.14/power-supply-max17042_battery-prevent-int-underflow-in-set_soc_threshold.patch b/queue-5.14/power-supply-max17042_battery-prevent-int-underflow-in-set_soc_threshold.patch new file mode 100644 index 00000000000..14288b1ffa3 --- /dev/null +++ b/queue-5.14/power-supply-max17042_battery-prevent-int-underflow-in-set_soc_threshold.patch @@ -0,0 +1,35 @@ +From e660dbb68c6b3f7b9eb8b9775846a44f9798b719 Mon Sep 17 00:00:00 2001 +From: Sebastian Krzyszkowiak +Date: Tue, 14 Sep 2021 14:18:06 +0200 +Subject: power: supply: max17042_battery: Prevent int underflow in set_soc_threshold + +From: Sebastian Krzyszkowiak + +commit e660dbb68c6b3f7b9eb8b9775846a44f9798b719 upstream. + +max17042_set_soc_threshold gets called with offset set to 1, which means +that minimum threshold value would underflow once SOC got down to 0, +causing invalid alerts from the gauge. + +Fixes: e5f3872d2044 ("max17042: Add support for signalling change in SOC") +Cc: +Signed-off-by: Sebastian Krzyszkowiak +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/max17042_battery.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/power/supply/max17042_battery.c ++++ b/drivers/power/supply/max17042_battery.c +@@ -861,7 +861,8 @@ static void max17042_set_soc_threshold(s + regmap_read(map, MAX17042_RepSOC, &soc); + soc >>= 8; + soc_tr = (soc + off) << 8; +- soc_tr |= (soc - off); ++ if (off < soc) ++ soc_tr |= soc - off; + regmap_write(map, MAX17042_SALRT_Th, soc_tr); + } + diff --git a/queue-5.14/power-supply-max17042_battery-use-vfsoc-for-capacity-when-no-rsns.patch b/queue-5.14/power-supply-max17042_battery-use-vfsoc-for-capacity-when-no-rsns.patch new file mode 100644 index 00000000000..656c5bd0bd2 --- /dev/null +++ b/queue-5.14/power-supply-max17042_battery-use-vfsoc-for-capacity-when-no-rsns.patch @@ -0,0 +1,45 @@ +From 223a3b82834f036a62aa831f67cbf1f1d644c6e2 Mon Sep 17 00:00:00 2001 +From: Henrik Grimler +Date: Wed, 29 Sep 2021 20:14:17 +0200 +Subject: power: supply: max17042_battery: use VFSOC for capacity when no rsns + +From: Henrik Grimler + +commit 223a3b82834f036a62aa831f67cbf1f1d644c6e2 upstream. + +On Galaxy S3 (i9300/i9305), which has the max17047 fuel gauge and no +current sense resistor (rsns), the RepSOC register does not provide an +accurate state of charge value. The reported value is wrong, and does +not change over time. VFSOC however, which uses the voltage fuel gauge +to determine the state of charge, always shows an accurate value. + +For devices without current sense, VFSOC is already used for the +soc-alert (0x0003 is written to MiscCFG register), so with this change +the source of the alert and the PROP_CAPACITY value match. + +Fixes: 359ab9f5b154 ("power_supply: Add MAX17042 Fuel Gauge Driver") +Cc: +Reviewed-by: Krzysztof Kozlowski +Suggested-by: Wolfgang Wiedmeyer +Signed-off-by: Henrik Grimler +Reviewed-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Signed-off-by: Greg Kroah-Hartman +--- + drivers/power/supply/max17042_battery.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/power/supply/max17042_battery.c ++++ b/drivers/power/supply/max17042_battery.c +@@ -317,7 +317,10 @@ static int max17042_get_property(struct + val->intval = data * 625 / 8; + break; + case POWER_SUPPLY_PROP_CAPACITY: +- ret = regmap_read(map, MAX17042_RepSOC, &data); ++ if (chip->pdata->enable_current_sense) ++ ret = regmap_read(map, MAX17042_RepSOC, &data); ++ else ++ ret = regmap_read(map, MAX17042_VFSOC, &data); + if (ret < 0) + return ret; + diff --git a/queue-5.14/rdma-qedr-fix-null-deref-for-query_qp-on-the-gsi-qp.patch b/queue-5.14/rdma-qedr-fix-null-deref-for-query_qp-on-the-gsi-qp.patch new file mode 100644 index 00000000000..b734eb6779d --- /dev/null +++ b/queue-5.14/rdma-qedr-fix-null-deref-for-query_qp-on-the-gsi-qp.patch @@ -0,0 +1,91 @@ +From 4f960393a0ee9a39469ceb7c8077ae8db665cc12 Mon Sep 17 00:00:00 2001 +From: Alok Prasad +Date: Wed, 27 Oct 2021 18:43:29 +0000 +Subject: RDMA/qedr: Fix NULL deref for query_qp on the GSI QP + +From: Alok Prasad + +commit 4f960393a0ee9a39469ceb7c8077ae8db665cc12 upstream. + +This patch fixes a crash caused by querying the QP via netlink, and +corrects the state of GSI qp. GSI qp's have a NULL qed_qp. + +The call trace is generated by: + $ rdma res show + + BUG: kernel NULL pointer dereference, address: 0000000000000034 + Hardware name: Dell Inc. PowerEdge R720/0M1GCR, BIOS 1.2.6 05/10/2012 + RIP: 0010:qed_rdma_query_qp+0x33/0x1a0 [qed] + RSP: 0018:ffffba560a08f580 EFLAGS: 00010206 + RAX: 0000000200000000 RBX: ffffba560a08f5b8 RCX: 0000000000000000 + RDX: ffffba560a08f5b8 RSI: 0000000000000000 RDI: ffff9807ee458090 + RBP: ffffba560a08f5a0 R08: 0000000000000000 R09: ffff9807890e7048 + R10: ffffba560a08f658 R11: 0000000000000000 R12: 0000000000000000 + R13: ffff9807ee458090 R14: ffff9807f0afb000 R15: ffffba560a08f7ec + FS: 00007fbbf8bfe740(0000) GS:ffff980aafa00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000034 CR3: 00000001720ba001 CR4: 00000000000606f0 + Call Trace: + qedr_query_qp+0x82/0x360 [qedr] + ib_query_qp+0x34/0x40 [ib_core] + ? ib_query_qp+0x34/0x40 [ib_core] + fill_res_qp_entry_query.isra.26+0x47/0x1d0 [ib_core] + ? __nla_put+0x20/0x30 + ? nla_put+0x33/0x40 + fill_res_qp_entry+0xe3/0x120 [ib_core] + res_get_common_dumpit+0x3f8/0x5d0 [ib_core] + ? fill_res_cm_id_entry+0x1f0/0x1f0 [ib_core] + nldev_res_get_qp_dumpit+0x1a/0x20 [ib_core] + netlink_dump+0x156/0x2f0 + __netlink_dump_start+0x1ab/0x260 + rdma_nl_rcv+0x1de/0x330 [ib_core] + ? nldev_res_get_cm_id_dumpit+0x20/0x20 [ib_core] + netlink_unicast+0x1b8/0x270 + netlink_sendmsg+0x33e/0x470 + sock_sendmsg+0x63/0x70 + __sys_sendto+0x13f/0x180 + ? setup_sgl.isra.12+0x70/0xc0 + __x64_sys_sendto+0x28/0x30 + do_syscall_64+0x3a/0xb0 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Cc: stable@vger.kernel.org +Fixes: cecbcddf6461 ("qedr: Add support for QP verbs") +Link: https://lore.kernel.org/r/20211027184329.18454-1-palok@marvell.com +Signed-off-by: Ariel Elior +Signed-off-by: Shai Malin +Signed-off-by: Prabhakar Kushwaha +Signed-off-by: Alok Prasad +Signed-off-by: Jason Gunthorpe +Signed-off-by: Greg Kroah-Hartman +--- + drivers/infiniband/hw/qedr/verbs.c | 15 +++++++++------ + 1 file changed, 9 insertions(+), 6 deletions(-) + +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -2758,15 +2758,18 @@ int qedr_query_qp(struct ib_qp *ibqp, + int rc = 0; + + memset(¶ms, 0, sizeof(params)); +- +- rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms); +- if (rc) +- goto err; +- + memset(qp_attr, 0, sizeof(*qp_attr)); + memset(qp_init_attr, 0, sizeof(*qp_init_attr)); + +- qp_attr->qp_state = qedr_get_ibqp_state(params.state); ++ if (qp->qp_type != IB_QPT_GSI) { ++ rc = dev->ops->rdma_query_qp(dev->rdma_ctx, qp->qed_qp, ¶ms); ++ if (rc) ++ goto err; ++ qp_attr->qp_state = qedr_get_ibqp_state(params.state); ++ } else { ++ qp_attr->qp_state = qedr_get_ibqp_state(QED_ROCE_QP_STATE_RTS); ++ } ++ + qp_attr->cur_qp_state = qedr_get_ibqp_state(params.state); + qp_attr->path_mtu = ib_mtu_int_to_enum(params.mtu); + qp_attr->path_mig_state = IB_MIG_MIGRATED; diff --git a/queue-5.14/series b/queue-5.14/series index ec6a6bac2cb..d056469db63 100644 --- a/queue-5.14/series +++ b/queue-5.14/series @@ -134,3 +134,20 @@ rsi-fix-occasional-initialisation-failure-with-bt-coex.patch rsi-fix-key-enabled-check-causing-unwanted-encryption-for-vap_id-0.patch rsi-fix-rate-mask-set-leading-to-p2p-failure.patch rsi-fix-module-dev_oper_mode-parameter-description.patch +perf-x86-intel-uncore-support-extra-imc-channel-on-ice-lake-server.patch +perf-x86-intel-uncore-fix-invalid-unit-check.patch +perf-x86-intel-uncore-fix-intel-icx-iio-event-constraints.patch +rdma-qedr-fix-null-deref-for-query_qp-on-the-gsi-qp.patch +asoc-tegra-set-default-card-name-for-trimslice.patch +asoc-tegra-restore-ac97-support.patch +signal-remove-the-bogus-sigkill_pending-in-ptrace_stop.patch +memory-renesas-rpc-if-correct-qspi-data-transfer-in-manual-mode.patch +signal-mips-update-_save-_restore-_fp_context-to-fail-with-efault.patch +soc-samsung-exynos-pmu-fix-compilation-when-nothing-selects-config_mfd_core.patch +soc-fsl-dpio-replace-smp_processor_id-with-raw_smp_processor_id.patch +soc-fsl-dpio-use-the-combined-functions-to-protect-critical-zone.patch +mtd-rawnand-socrates-keep-the-driver-compatible-with-on-die-ecc-engines.patch +power-supply-max17042_battery-prevent-int-underflow-in-set_soc_threshold.patch +power-supply-max17042_battery-use-vfsoc-for-capacity-when-no-rsns.patch +iio-core-fix-double-free-in-iio_device_unregister_sysfs.patch +iio-core-check-return-value-when-calling-dev_set_name.patch diff --git a/queue-5.14/signal-mips-update-_save-_restore-_fp_context-to-fail-with-efault.patch b/queue-5.14/signal-mips-update-_save-_restore-_fp_context-to-fail-with-efault.patch new file mode 100644 index 00000000000..26f6a6777ac --- /dev/null +++ b/queue-5.14/signal-mips-update-_save-_restore-_fp_context-to-fail-with-efault.patch @@ -0,0 +1,68 @@ +From 95bf9d646c3c3f95cb0be7e703b371db8da5be68 Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Wed, 20 Oct 2021 12:43:51 -0500 +Subject: signal/mips: Update (_save|_restore)_fp_context to fail with -EFAULT + +From: Eric W. Biederman + +commit 95bf9d646c3c3f95cb0be7e703b371db8da5be68 upstream. + +When an instruction to save or restore a register from the stack fails +in _save_fp_context or _restore_fp_context return with -EFAULT. This +change was made to r2300_fpu.S[1] but it looks like it got lost with +the introduction of EX2[2]. This is also what the other implementation +of _save_fp_context and _restore_fp_context in r4k_fpu.S does, and +what is needed for the callers to be able to handle the error. + +Furthermore calling do_exit(SIGSEGV) from bad_stack is wrong because +it does not terminate the entire process it just terminates a single +thread. + +As the changed code was the only caller of arch/mips/kernel/syscall.c:bad_stack +remove the problematic and now unused helper function. + +Cc: Thomas Bogendoerfer +Cc: Maciej Rozycki +Cc: linux-mips@vger.kernel.org +[1] 35938a00ba86 ("MIPS: Fix ISA I FP sigcontext access violation handling") +[2] f92722dc4545 ("MIPS: Correct MIPS I FP sigcontext layout") +Cc: stable@vger.kernel.org +Fixes: f92722dc4545 ("MIPS: Correct MIPS I FP sigcontext layout") +Acked-by: Maciej W. Rozycki +Acked-by: Thomas Bogendoerfer +Link: https://lkml.kernel.org/r/20211020174406.17889-5-ebiederm@xmission.com +Signed-off-by: Eric W. Biederman +Signed-off-by: Greg Kroah-Hartman +--- + arch/mips/kernel/r2300_fpu.S | 4 ++-- + arch/mips/kernel/syscall.c | 9 --------- + 2 files changed, 2 insertions(+), 11 deletions(-) + +--- a/arch/mips/kernel/r2300_fpu.S ++++ b/arch/mips/kernel/r2300_fpu.S +@@ -29,8 +29,8 @@ + #define EX2(a,b) \ + 9: a,##b; \ + .section __ex_table,"a"; \ +- PTR 9b,bad_stack; \ +- PTR 9b+4,bad_stack; \ ++ PTR 9b,fault; \ ++ PTR 9b+4,fault; \ + .previous + + .set mips1 +--- a/arch/mips/kernel/syscall.c ++++ b/arch/mips/kernel/syscall.c +@@ -240,12 +240,3 @@ SYSCALL_DEFINE3(cachectl, char *, addr, + { + return -ENOSYS; + } +- +-/* +- * If we ever come here the user sp is bad. Zap the process right away. +- * Due to the bad stack signaling wouldn't work. +- */ +-asmlinkage void bad_stack(void) +-{ +- do_exit(SIGSEGV); +-} diff --git a/queue-5.14/signal-remove-the-bogus-sigkill_pending-in-ptrace_stop.patch b/queue-5.14/signal-remove-the-bogus-sigkill_pending-in-ptrace_stop.patch new file mode 100644 index 00000000000..f250f701819 --- /dev/null +++ b/queue-5.14/signal-remove-the-bogus-sigkill_pending-in-ptrace_stop.patch @@ -0,0 +1,78 @@ +From 7d613f9f72ec8f90ddefcae038fdae5adb8404b3 Mon Sep 17 00:00:00 2001 +From: "Eric W. Biederman" +Date: Wed, 1 Sep 2021 13:21:34 -0500 +Subject: signal: Remove the bogus sigkill_pending in ptrace_stop + +From: Eric W. Biederman + +commit 7d613f9f72ec8f90ddefcae038fdae5adb8404b3 upstream. + +The existence of sigkill_pending is a little silly as it is +functionally a duplicate of fatal_signal_pending that is used in +exactly one place. + +Checking for pending fatal signals and returning early in ptrace_stop +is actively harmful. It casues the ptrace_stop called by +ptrace_signal to return early before setting current->exit_code. +Later when ptrace_signal reads the signal number from +current->exit_code is undefined, making it unpredictable what will +happen. + +Instead rely on the fact that schedule will not sleep if there is a +pending signal that can awaken a task. + +Removing the explict sigkill_pending test fixes fixes ptrace_signal +when ptrace_stop does not stop because current->exit_code is always +set to to signr. + +Cc: stable@vger.kernel.org +Fixes: 3d749b9e676b ("ptrace: simplify ptrace_stop()->sigkill_pending() path") +Fixes: 1a669c2f16d4 ("Add arch_ptrace_stop") +Link: https://lkml.kernel.org/r/87pmsyx29t.fsf@disp2133 +Reviewed-by: Kees Cook +Signed-off-by: "Eric W. Biederman" +Signed-off-by: Greg Kroah-Hartman +--- + kernel/signal.c | 18 ++++-------------- + 1 file changed, 4 insertions(+), 14 deletions(-) + +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -2109,15 +2109,6 @@ static inline bool may_ptrace_stop(void) + return true; + } + +-/* +- * Return non-zero if there is a SIGKILL that should be waking us up. +- * Called with the siglock held. +- */ +-static bool sigkill_pending(struct task_struct *tsk) +-{ +- return sigismember(&tsk->pending.signal, SIGKILL) || +- sigismember(&tsk->signal->shared_pending.signal, SIGKILL); +-} + + /* + * This must be called with current->sighand->siglock held. +@@ -2144,17 +2135,16 @@ static void ptrace_stop(int exit_code, i + * calling arch_ptrace_stop, so we must release it now. + * To preserve proper semantics, we must do this before + * any signal bookkeeping like checking group_stop_count. +- * Meanwhile, a SIGKILL could come in before we retake the +- * siglock. That must prevent us from sleeping in TASK_TRACED. +- * So after regaining the lock, we must check for SIGKILL. + */ + spin_unlock_irq(¤t->sighand->siglock); + arch_ptrace_stop(exit_code, info); + spin_lock_irq(¤t->sighand->siglock); +- if (sigkill_pending(current)) +- return; + } + ++ /* ++ * schedule() will not sleep if there is a pending signal that ++ * can awaken the task. ++ */ + set_special_state(TASK_TRACED); + + /* diff --git a/queue-5.14/soc-fsl-dpio-replace-smp_processor_id-with-raw_smp_processor_id.patch b/queue-5.14/soc-fsl-dpio-replace-smp_processor_id-with-raw_smp_processor_id.patch new file mode 100644 index 00000000000..b498517625b --- /dev/null +++ b/queue-5.14/soc-fsl-dpio-replace-smp_processor_id-with-raw_smp_processor_id.patch @@ -0,0 +1,57 @@ +From e775eb9fc2a4107f03222fa48bc95c2c82427e64 Mon Sep 17 00:00:00 2001 +From: Meng Li +Date: Tue, 19 Oct 2021 10:32:41 +0800 +Subject: soc: fsl: dpio: replace smp_processor_id with raw_smp_processor_id + +From: Meng Li + +commit e775eb9fc2a4107f03222fa48bc95c2c82427e64 upstream. + +When enable debug kernel configs,there will be calltrace as below: + +BUG: using smp_processor_id() in preemptible [00000000] code: swapper/0/1 +caller is debug_smp_processor_id+0x20/0x30 +CPU: 6 PID: 1 Comm: swapper/0 Not tainted 5.10.63-yocto-standard #1 +Hardware name: NXP Layerscape LX2160ARDB (DT) +Call trace: + dump_backtrace+0x0/0x1a0 + show_stack+0x24/0x30 + dump_stack+0xf0/0x13c + check_preemption_disabled+0x100/0x110 + debug_smp_processor_id+0x20/0x30 + dpaa2_io_query_fq_count+0xdc/0x154 + dpaa2_eth_stop+0x144/0x314 + __dev_close_many+0xdc/0x160 + __dev_change_flags+0xe8/0x220 + dev_change_flags+0x30/0x70 + ic_close_devs+0x50/0x78 + ip_auto_config+0xed0/0xf10 + do_one_initcall+0xac/0x460 + kernel_init_freeable+0x30c/0x378 + kernel_init+0x20/0x128 + ret_from_fork+0x10/0x38 + +Based on comment in the context, it doesn't matter whether +preemption is disable or not. So, replace smp_processor_id() +with raw_smp_processor_id() to avoid above call trace. + +Fixes: c89105c9b390 ("staging: fsl-mc: Move DPIO from staging to drivers/soc/fsl") +Cc: stable@vger.kernel.org +Signed-off-by: Meng Li +Signed-off-by: Li Yang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/fsl/dpio/dpio-service.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/soc/fsl/dpio/dpio-service.c ++++ b/drivers/soc/fsl/dpio/dpio-service.c +@@ -59,7 +59,7 @@ static inline struct dpaa2_io *service_s + * potentially being migrated away. + */ + if (cpu < 0) +- cpu = smp_processor_id(); ++ cpu = raw_smp_processor_id(); + + /* If a specific cpu was requested, pick it up immediately */ + return dpio_by_cpu[cpu]; diff --git a/queue-5.14/soc-fsl-dpio-use-the-combined-functions-to-protect-critical-zone.patch b/queue-5.14/soc-fsl-dpio-use-the-combined-functions-to-protect-critical-zone.patch new file mode 100644 index 00000000000..88c72c13ace --- /dev/null +++ b/queue-5.14/soc-fsl-dpio-use-the-combined-functions-to-protect-critical-zone.patch @@ -0,0 +1,87 @@ +From dc7e5940aad6641bd5ab33ea8b21c4b3904d989f Mon Sep 17 00:00:00 2001 +From: Meng Li +Date: Tue, 19 Oct 2021 11:05:55 +0800 +Subject: soc: fsl: dpio: use the combined functions to protect critical zone + +From: Meng Li + +commit dc7e5940aad6641bd5ab33ea8b21c4b3904d989f upstream. + +In orininal code, use 2 function spin_lock() and local_irq_save() to +protect the critical zone. But when enable the kernel debug config, +there are below inconsistent lock state detected. +================================ +WARNING: inconsistent lock state +5.10.63-yocto-standard #1 Not tainted +-------------------------------- +inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. +lock_torture_wr/226 [HC0[0]:SC1[5]:HE1:SE0] takes: +ffff002005b2dd80 (&p->access_spinlock){+.?.}-{3:3}, at: qbman_swp_enqueue_multiple_mem_back+0x44/0x270 +{SOFTIRQ-ON-W} state was registered at: + lock_acquire.part.0+0xf8/0x250 + lock_acquire+0x68/0x84 + _raw_spin_lock+0x68/0x90 + qbman_swp_enqueue_multiple_mem_back+0x44/0x270 + ...... + cryptomgr_test+0x38/0x60 + kthread+0x158/0x164 + ret_from_fork+0x10/0x38 +irq event stamp: 4498 +hardirqs last enabled at (4498): [] _raw_spin_unlock_irqrestore+0x90/0xb0 +hardirqs last disabled at (4497): [] _raw_spin_lock_irqsave+0xd4/0xe0 +softirqs last enabled at (4458): [] __do_softirq+0x674/0x724 +softirqs last disabled at (4465): [] __irq_exit_rcu+0x190/0x19c + +other info that might help us debug this: + Possible unsafe locking scenario: + CPU0 + ---- + lock(&p->access_spinlock); + + lock(&p->access_spinlock); + *** DEADLOCK *** + +So, in order to avoid deadlock, use the combined functions +spin_lock_irqsave/spin_unlock_irqrestore() to protect critical zone. + +Fixes: 3b2abda7d28c ("soc: fsl: dpio: Replace QMAN array mode with ring mode enqueue") +Cc: stable@vger.kernel.org +Signed-off-by: Meng Li +Signed-off-by: Li Yang +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/fsl/dpio/qbman-portal.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +--- a/drivers/soc/fsl/dpio/qbman-portal.c ++++ b/drivers/soc/fsl/dpio/qbman-portal.c +@@ -732,8 +732,7 @@ int qbman_swp_enqueue_multiple_mem_back( + int i, num_enqueued = 0; + unsigned long irq_flags; + +- spin_lock(&s->access_spinlock); +- local_irq_save(irq_flags); ++ spin_lock_irqsave(&s->access_spinlock, irq_flags); + + half_mask = (s->eqcr.pi_ci_mask>>1); + full_mask = s->eqcr.pi_ci_mask; +@@ -744,8 +743,7 @@ int qbman_swp_enqueue_multiple_mem_back( + s->eqcr.available = qm_cyc_diff(s->eqcr.pi_ring_size, + eqcr_ci, s->eqcr.ci); + if (!s->eqcr.available) { +- local_irq_restore(irq_flags); +- spin_unlock(&s->access_spinlock); ++ spin_unlock_irqrestore(&s->access_spinlock, irq_flags); + return 0; + } + } +@@ -784,8 +782,7 @@ int qbman_swp_enqueue_multiple_mem_back( + dma_wmb(); + qbman_write_register(s, QBMAN_CINH_SWP_EQCR_PI, + (QB_RT_BIT)|(s->eqcr.pi)|s->eqcr.pi_vb); +- local_irq_restore(irq_flags); +- spin_unlock(&s->access_spinlock); ++ spin_unlock_irqrestore(&s->access_spinlock, irq_flags); + + return num_enqueued; + } diff --git a/queue-5.14/soc-samsung-exynos-pmu-fix-compilation-when-nothing-selects-config_mfd_core.patch b/queue-5.14/soc-samsung-exynos-pmu-fix-compilation-when-nothing-selects-config_mfd_core.patch new file mode 100644 index 00000000000..74b5836268b --- /dev/null +++ b/queue-5.14/soc-samsung-exynos-pmu-fix-compilation-when-nothing-selects-config_mfd_core.patch @@ -0,0 +1,39 @@ +From e37ef6dcdb1f4738b01cec7fb7be46af07816af9 Mon Sep 17 00:00:00 2001 +From: David Virag +Date: Fri, 10 Sep 2021 00:28:12 +0200 +Subject: soc: samsung: exynos-pmu: Fix compilation when nothing selects CONFIG_MFD_CORE + +From: David Virag + +commit e37ef6dcdb1f4738b01cec7fb7be46af07816af9 upstream. + +Commit 93618e344a5e ("soc: samsung: exynos-pmu: instantiate clkout +driver as MFD") adds a "devm_mfd_add_devices" call in the exynos-pmu +driver which depends on CONFIG_MFD_CORE. If no driver selects that +config, the build will fail if CONFIG_EXYNOS_PMU is enabled with the +following error: + + drivers/soc/samsung/exynos-pmu.c:137: undefined reference to `devm_mfd_add_devices' + +Fix this by making CONFIG_EXYNOS_PMU select CONFIG_MFD_CORE. + +Fixes: 93618e344a5e ("soc: samsung: exynos-pmu: instantiate clkout driver as MFD") +Cc: +Signed-off-by: David Virag +Link: https://lore.kernel.org/r/20210909222812.108614-1-virag.david003@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman +--- + drivers/soc/samsung/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/soc/samsung/Kconfig ++++ b/drivers/soc/samsung/Kconfig +@@ -25,6 +25,7 @@ config EXYNOS_PMU + bool "Exynos PMU controller driver" if COMPILE_TEST + depends on ARCH_EXYNOS || ((ARM || ARM64) && COMPILE_TEST) + select EXYNOS_PMU_ARM_DRIVERS if ARM && ARCH_EXYNOS ++ select MFD_CORE + + # There is no need to enable these drivers for ARMv8 + config EXYNOS_PMU_ARM_DRIVERS -- 2.47.2