From: Sasha Levin Date: Mon, 19 Jul 2021 13:16:46 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v5.13.4~29^2~4 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=07d3f46449b5525b997137b9fd303c0907c3e1fb;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/acpi-amba-fix-resource-name-in-proc-iomem.patch b/queue-5.4/acpi-amba-fix-resource-name-in-proc-iomem.patch new file mode 100644 index 00000000000..018dc2e8fcd --- /dev/null +++ b/queue-5.4/acpi-amba-fix-resource-name-in-proc-iomem.patch @@ -0,0 +1,36 @@ +From 6c9f907b98334c64ca8d99da2ec6b5e5ae3210c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 19:27:48 +0800 +Subject: ACPI: AMBA: Fix resource name in /proc/iomem + +From: Liguang Zhang + +[ Upstream commit 7718629432676b5ebd9a32940782fe297a0abf8d ] + +In function amba_handler_attach(), dev->res.name is initialized by +amba_device_alloc. But when address_found is false, dev->res.name is +assigned to null value, which leads to wrong resource name display in +/proc/iomem, "" is seen for those resources. + +Signed-off-by: Liguang Zhang +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_amba.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/acpi/acpi_amba.c b/drivers/acpi/acpi_amba.c +index 49b781a9cd97..ab8a4e0191b1 100644 +--- a/drivers/acpi/acpi_amba.c ++++ b/drivers/acpi/acpi_amba.c +@@ -76,6 +76,7 @@ static int amba_handler_attach(struct acpi_device *adev, + case IORESOURCE_MEM: + if (!address_found) { + dev->res = *rentry->res; ++ dev->res.name = dev_name(&dev->dev); + address_found = true; + } + break; +-- +2.30.2 + diff --git a/queue-5.4/acpi-video-add-quirk-for-the-dell-vostro-3350.patch b/queue-5.4/acpi-video-add-quirk-for-the-dell-vostro-3350.patch new file mode 100644 index 00000000000..c2317a27318 --- /dev/null +++ b/queue-5.4/acpi-video-add-quirk-for-the-dell-vostro-3350.patch @@ -0,0 +1,49 @@ +From 8818bc7cc55e595f677f77033142da6aab168730 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 17:23:16 +0200 +Subject: ACPI: video: Add quirk for the Dell Vostro 3350 + +From: Hans de Goede + +[ Upstream commit 9249c32ec9197e8d34fe5179c9e31668a205db04 ] + +The Dell Vostro 3350 ACPI video-bus device reports spurious +ACPI_VIDEO_NOTIFY_CYCLE events resulting in spurious KEY_SWITCHVIDEOMODE +events being reported to userspace (and causing trouble there). + +Add a quirk setting the report_key_events mask to +REPORT_BRIGHTNESS_KEY_EVENTS so that the ACPI_VIDEO_NOTIFY_CYCLE +events will be ignored, while still reporting brightness up/down +hotkey-presses to userspace normally. + +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1911763 +Signed-off-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_video.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index 4f325e47519f..81cd47d29932 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -543,6 +543,15 @@ static const struct dmi_system_id video_dmi_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V131"), + }, + }, ++ { ++ .callback = video_set_report_key_events, ++ .driver_data = (void *)((uintptr_t)REPORT_BRIGHTNESS_KEY_EVENTS), ++ .ident = "Dell Vostro 3350", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 3350"), ++ }, ++ }, + /* + * Some machines change the brightness themselves when a brightness + * hotkey gets pressed, despite us telling them not to. In this case +-- +2.30.2 + diff --git a/queue-5.4/alsa-ac97-fix-pm-reference-leak-in-ac97_bus_remove.patch b/queue-5.4/alsa-ac97-fix-pm-reference-leak-in-ac97_bus_remove.patch new file mode 100644 index 00000000000..5b02d580cb2 --- /dev/null +++ b/queue-5.4/alsa-ac97-fix-pm-reference-leak-in-ac97_bus_remove.patch @@ -0,0 +1,39 @@ +From 418ff5f08cf3424f1a833719fbeb9e22fe9fc9ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 05:38:11 -0400 +Subject: ALSA: ac97: fix PM reference leak in ac97_bus_remove() + +From: Yufen Yu + +[ Upstream commit a38e93302ee25b2ca6f4ee76c6c974cf3637985e ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Reported-by: Hulk Robot +Signed-off-by: Yufen Yu +Link: https://lore.kernel.org/r/20210524093811.612302-1-yuyufen@huawei.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/ac97/bus.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/ac97/bus.c b/sound/ac97/bus.c +index 7985dd8198b6..99e1728b52ae 100644 +--- a/sound/ac97/bus.c ++++ b/sound/ac97/bus.c +@@ -520,7 +520,7 @@ static int ac97_bus_remove(struct device *dev) + struct ac97_codec_driver *adrv = to_ac97_driver(dev->driver); + int ret; + +- ret = pm_runtime_get_sync(dev); ++ ret = pm_runtime_resume_and_get(dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.4/alsa-bebob-add-support-for-toneweal-fw66.patch b/queue-5.4/alsa-bebob-add-support-for-toneweal-fw66.patch new file mode 100644 index 00000000000..5d5bbf18456 --- /dev/null +++ b/queue-5.4/alsa-bebob-add-support-for-toneweal-fw66.patch @@ -0,0 +1,105 @@ +From 5b24da1a0b119d96bdf435dc8c8f7a1fe1a505f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 17:39:22 +0900 +Subject: ALSA: bebob: add support for ToneWeal FW66 + +From: Takashi Sakamoto + +[ Upstream commit 50ebe56222bfa0911a932930f9229ee5995508d9 ] + +A user of FFADO project reported the issue of ToneWeal FW66. As a result, +the device is identified as one of applications of BeBoB solution. + +I note that in the report the device returns contradictory result in plug +discovery process for audio subunit. Fortunately ALSA BeBoB driver doesn't +perform it thus it's likely to handle the device without issues. + +I receive no reaction to test request for this patch yet, however it would +be worth to add support for it. + +daniel@gibbonmoon:/sys/bus/firewire/devices/fw1$ grep -r . * +Binary file config_rom matches +dev:244:1 +guid:0x0023270002000000 +hardware_version:0x000002 +is_local:0 +model:0x020002 +model_name:FW66 +power/runtime_active_time:0 +power/runtime_active_kids:0 +power/runtime_usage:0 +power/runtime_status:unsupported +power/async:disabled +power/runtime_suspended_time:0 +power/runtime_enabled:disabled +power/control:auto +subsystem/drivers_autoprobe:1 +uevent:MAJOR=244 +uevent:MINOR=1 +uevent:DEVNAME=fw1 +units:0x00a02d:0x010001 +vendor:0x002327 +vendor_name:ToneWeal +fw1.0/uevent:MODALIAS=ieee1394:ven00002327mo00020002sp0000A02Dver00010001 +fw1.0/power/runtime_active_time:0 +fw1.0/power/runtime_active_kids:0 +fw1.0/power/runtime_usage:0 +fw1.0/power/runtime_status:unsupported +fw1.0/power/async:disabled +fw1.0/power/runtime_suspended_time:0 +fw1.0/power/runtime_enabled:disabled +fw1.0/power/control:auto +fw1.0/model:0x020002 +fw1.0/rom_index:15 +fw1.0/specifier_id:0x00a02d +fw1.0/model_name:FW66 +fw1.0/version:0x010001 +fw1.0/modalias:ieee1394:ven00002327mo00020002sp0000A02Dver00010001 + +Cc: Daniel Jozsef +Reference: https://lore.kernel.org/alsa-devel/20200119164335.GA11974@workstation/ +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210619083922.16060-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/Kconfig | 1 + + sound/firewire/bebob/bebob.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index c16d2dd9a66f..e469375e2f2a 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -110,6 +110,7 @@ config SND_BEBOB + * M-Audio Ozonic/NRV10/ProfireLightBridge + * M-Audio FireWire 1814/ProjectMix IO + * Digidesign Mbox 2 Pro ++ * ToneWeal FW66 + + To compile this driver as a module, choose M here: the module + will be called snd-bebob. +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index eeb0e4b2f77a..d58f4fe2be8c 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -59,6 +59,7 @@ static DECLARE_BITMAP(devices_used, SNDRV_CARDS); + #define VEN_MAUDIO1 0x00000d6c + #define VEN_MAUDIO2 0x000007f5 + #define VEN_DIGIDESIGN 0x00a07e ++#define OUI_SHOUYO 0x002327 + + #define MODEL_FOCUSRITE_SAFFIRE_BOTH 0x00000000 + #define MODEL_MAUDIO_AUDIOPHILE_BOTH 0x00010060 +@@ -486,6 +487,8 @@ static const struct ieee1394_device_id bebob_id_table[] = { + &maudio_special_spec), + /* Digidesign Mbox 2 Pro */ + SND_BEBOB_DEV_ENTRY(VEN_DIGIDESIGN, 0x0000a9, &spec_normal), ++ // Toneweal FW66. ++ SND_BEBOB_DEV_ENTRY(OUI_SHOUYO, 0x020002, &spec_normal), + /* IDs are unknown but able to be supported */ + /* Apogee, Mini-ME Firewire */ + /* Apogee, Mini-DAC Firewire */ +-- +2.30.2 + diff --git a/queue-5.4/alsa-hda-add-irq-check-for-platform_get_irq.patch b/queue-5.4/alsa-hda-add-irq-check-for-platform_get_irq.patch new file mode 100644 index 00000000000..a87fbd9fd6a --- /dev/null +++ b/queue-5.4/alsa-hda-add-irq-check-for-platform_get_irq.patch @@ -0,0 +1,45 @@ +From ed1cd37351752dd180b8dc7f5c9435458add7636 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 21:19:42 +0800 +Subject: ALSA: hda: Add IRQ check for platform_get_irq() + +From: Jiajun Cao + +[ Upstream commit 8c13212443230d03ff25014514ec0d53498c0912 ] + +The function hda_tegra_first_init() neglects to check the return +value after executing platform_get_irq(). + +hda_tegra_first_init() should check the return value (if negative +error number) for errors so as to not pass a negative value to +the devm_request_irq(). + +Fix it by adding a check for the return value irq_id. + +Signed-off-by: Jiajun Cao +Signed-off-by: Xin Tan +Reviewed-by: Thierry Reding +Link: https://lore.kernel.org/r/20210622131947.94346-1-jjcao20@fudan.edu.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_tegra.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c +index e378cb33c69d..2971b34c87c1 100644 +--- a/sound/pci/hda/hda_tegra.c ++++ b/sound/pci/hda/hda_tegra.c +@@ -292,6 +292,9 @@ static int hda_tegra_first_init(struct azx *chip, struct platform_device *pdev) + const char *sname, *drv_name = "tegra-hda"; + struct device_node *np = pdev->dev.of_node; + ++ if (irq_id < 0) ++ return irq_id; ++ + err = hda_tegra_init_chip(chip, pdev); + if (err) + return err; +-- +2.30.2 + diff --git a/queue-5.4/alsa-isa-fix-error-return-code-in-snd_cmi8330_probe.patch b/queue-5.4/alsa-isa-fix-error-return-code-in-snd_cmi8330_probe.patch new file mode 100644 index 00000000000..127d01177c7 --- /dev/null +++ b/queue-5.4/alsa-isa-fix-error-return-code-in-snd_cmi8330_probe.patch @@ -0,0 +1,39 @@ +From fb07b39ca18331c6520c1e44f61ea1da97a7d42e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 15:40:51 +0800 +Subject: ALSA: isa: Fix error return code in snd_cmi8330_probe() + +From: Zhen Lei + +[ Upstream commit 31028cbed26a8afa25533a10425ffa2ab794c76c ] + +When 'SB_HW_16' check fails, the error code -ENODEV instead of 0 should be +returned, which is the same as that returned when 'WSS_HW_CMI8330' check +fails. + +Fixes: 43bcd973d6d0 ("[ALSA] Add snd_card_set_generic_dev() call to ISA drivers") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210707074051.2663-1-thunder.leizhen@huawei.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/isa/cmi8330.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/isa/cmi8330.c b/sound/isa/cmi8330.c +index bb7d4940ac25..281ecd0eea48 100644 +--- a/sound/isa/cmi8330.c ++++ b/sound/isa/cmi8330.c +@@ -549,7 +549,7 @@ static int snd_cmi8330_probe(struct snd_card *card, int dev) + } + if (acard->sb->hardware != SB_HW_16) { + snd_printk(KERN_ERR PFX "SB16 not found during probe\n"); +- return err; ++ return -ENODEV; + } + + snd_wss_out(acard->wss, CS4231_MISC_INFO, 0x40); /* switch on MODE2 */ +-- +2.30.2 + diff --git a/queue-5.4/alsa-ppc-fix-error-return-code-in-snd_pmac_probe.patch b/queue-5.4/alsa-ppc-fix-error-return-code-in-snd_pmac_probe.patch new file mode 100644 index 00000000000..982243a106a --- /dev/null +++ b/queue-5.4/alsa-ppc-fix-error-return-code-in-snd_pmac_probe.patch @@ -0,0 +1,41 @@ +From 7dbd49558454fbfe96e8b90255c92aa6906409f0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 10:11:21 +0800 +Subject: ALSA: ppc: fix error return code in snd_pmac_probe() + +From: Yang Yingliang + +[ Upstream commit 80b9c1be567c3c6bbe0d4b290af578e630485b5d ] + +If snd_pmac_tumbler_init() or snd_pmac_tumbler_post_init() fails, +snd_pmac_probe() need return error code. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210616021121.1991502-1-yangyingliang@huawei.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/ppc/powermac.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/sound/ppc/powermac.c b/sound/ppc/powermac.c +index 96ef55082bf9..b135d114ce89 100644 +--- a/sound/ppc/powermac.c ++++ b/sound/ppc/powermac.c +@@ -77,7 +77,11 @@ static int snd_pmac_probe(struct platform_device *devptr) + sprintf(card->shortname, "PowerMac %s", name_ext); + sprintf(card->longname, "%s (Dev %d) Sub-frame %d", + card->shortname, chip->device_id, chip->subframe); +- if ( snd_pmac_tumbler_init(chip) < 0 || snd_pmac_tumbler_post_init() < 0) ++ err = snd_pmac_tumbler_init(chip); ++ if (err < 0) ++ goto __error; ++ err = snd_pmac_tumbler_post_init(); ++ if (err < 0) + goto __error; + break; + case PMAC_AWACS: +-- +2.30.2 + diff --git a/queue-5.4/alsa-sb-fix-potential-double-free-of-csp-mixer-eleme.patch b/queue-5.4/alsa-sb-fix-potential-double-free-of-csp-mixer-eleme.patch new file mode 100644 index 00000000000..875a840a87c --- /dev/null +++ b/queue-5.4/alsa-sb-fix-potential-double-free-of-csp-mixer-eleme.patch @@ -0,0 +1,47 @@ +From 4979358fd09e8f2edfbf8d38bec6893f2088db9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 16:04:37 +0200 +Subject: ALSA: sb: Fix potential double-free of CSP mixer elements + +From: Takashi Iwai + +[ Upstream commit c305366a37441c2ac90b08711cb6f032b43672f2 ] + +snd_sb_qsound_destroy() contains the calls of removing the previously +created mixer controls, but it doesn't clear the pointers. As +snd_sb_qsound_destroy() itself may be repeatedly called via ioctl, +this could lead to double-free potentially. + +Fix it by clearing the struct fields properly afterwards. + +Link: https://lore.kernel.org/r/20210608140540.17885-4-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/isa/sb/sb16_csp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/sound/isa/sb/sb16_csp.c b/sound/isa/sb/sb16_csp.c +index 69960cf1bb51..ef1289cc78a4 100644 +--- a/sound/isa/sb/sb16_csp.c ++++ b/sound/isa/sb/sb16_csp.c +@@ -1072,10 +1072,14 @@ static void snd_sb_qsound_destroy(struct snd_sb_csp * p) + card = p->chip->card; + + down_write(&card->controls_rwsem); +- if (p->qsound_switch) ++ if (p->qsound_switch) { + snd_ctl_remove(card, p->qsound_switch); +- if (p->qsound_space) ++ p->qsound_switch = NULL; ++ } ++ if (p->qsound_space) { + snd_ctl_remove(card, p->qsound_space); ++ p->qsound_space = NULL; ++ } + up_write(&card->controls_rwsem); + + /* cancel pending transfer of QSound parameters */ +-- +2.30.2 + diff --git a/queue-5.4/alsa-usb-audio-scarlett2-fix-18i8-gen-2-pcm-input-co.patch b/queue-5.4/alsa-usb-audio-scarlett2-fix-18i8-gen-2-pcm-input-co.patch new file mode 100644 index 00000000000..5ee17bdfcb6 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-scarlett2-fix-18i8-gen-2-pcm-input-co.patch @@ -0,0 +1,36 @@ +From 28ab4f0338f276177eee5124382417fb4cc3cc2b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 02:16:25 +0930 +Subject: ALSA: usb-audio: scarlett2: Fix 18i8 Gen 2 PCM Input count + +From: Geoffrey D. Bennett + +[ Upstream commit c5210f213456383482b4a77c5310282a89a106b5 ] + +The 18i8 Gen 2 has 8 PCM Inputs, not 20. Fix the ports entry in +s18i8_gen2_info. + +Signed-off-by: Geoffrey D. Bennett +Link: https://lore.kernel.org/r/20210620164625.GA9165@m.b4.vu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_scarlett_gen2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index 54bcf1c14bc2..a66c796ce139 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -356,7 +356,7 @@ static const struct scarlett2_device_info s18i8_gen2_info = { + }, + [SCARLETT2_PORT_TYPE_PCM] = { + .id = 0x600, +- .num = { 20, 18, 18, 14, 10 }, ++ .num = { 8, 18, 18, 14, 10 }, + .src_descr = "PCM %d", + .src_num_offset = 1, + .dst_descr = "PCM %02d Capture" +-- +2.30.2 + diff --git a/queue-5.4/alsa-usb-audio-scarlett2-fix-6i6-gen-2-line-out-desc.patch b/queue-5.4/alsa-usb-audio-scarlett2-fix-6i6-gen-2-line-out-desc.patch new file mode 100644 index 00000000000..fc9e57b24a1 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-scarlett2-fix-6i6-gen-2-line-out-desc.patch @@ -0,0 +1,42 @@ +From 4ab561c15ddaf47f9f2f40bcd4aa7424929ae58b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 03:39:18 +0930 +Subject: ALSA: usb-audio: scarlett2: Fix 6i6 Gen 2 line out descriptions + +From: Geoffrey D. Bennett + +[ Upstream commit c712c6c0ff2d60478582e337185bcdd520a7dc2e ] + +There are two headphone outputs, and they map to the four analogue +outputs. + +Signed-off-by: Geoffrey D. Bennett +Link: https://lore.kernel.org/r/205e5e5348f08ded0cc4da5446f604d4b91db5bf.1624294591.git.g@b4.vu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_scarlett_gen2.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index 322dc5b6be63..ab7abe360fcf 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -254,10 +254,10 @@ static const struct scarlett2_device_info s6i6_gen2_info = { + .pad_input_count = 2, + + .line_out_descrs = { +- "Monitor L", +- "Monitor R", +- "Headphones L", +- "Headphones R", ++ "Headphones 1 L", ++ "Headphones 1 R", ++ "Headphones 2 L", ++ "Headphones 2 R", + }, + + .ports = { +-- +2.30.2 + diff --git a/queue-5.4/alsa-usb-audio-scarlett2-fix-data_mutex-lock.patch b/queue-5.4/alsa-usb-audio-scarlett2-fix-data_mutex-lock.patch new file mode 100644 index 00000000000..7c1bc36cade --- /dev/null +++ b/queue-5.4/alsa-usb-audio-scarlett2-fix-data_mutex-lock.patch @@ -0,0 +1,77 @@ +From 6d4981ccc46d9d51b70d35a77e27c3bca575d889 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 02:16:43 +0930 +Subject: ALSA: usb-audio: scarlett2: Fix data_mutex lock + +From: Geoffrey D. Bennett + +[ Upstream commit 9b5ddea9ce5a68d7d2bedcb69901ac2a86c96c7b ] + +The private->vol_updated flag was being checked outside of the +mutex_lock/unlock() of private->data_mutex leading to the volume data +being fetched twice from the device unnecessarily or old volume data +being returned. + +Update scarlett2_*_ctl_get() and include the private->vol_updated flag +check inside the critical region. + +Signed-off-by: Geoffrey D. Bennett +Link: https://lore.kernel.org/r/20210620164643.GA9216@m.b4.vu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_scarlett_gen2.c | 21 +++++++++------------ + 1 file changed, 9 insertions(+), 12 deletions(-) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index a66c796ce139..9c98d5b79011 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -1033,11 +1033,10 @@ static int scarlett2_master_volume_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_mixer_data *private = mixer->private_data; + +- if (private->vol_updated) { +- mutex_lock(&private->data_mutex); ++ mutex_lock(&private->data_mutex); ++ if (private->vol_updated) + scarlett2_update_volumes(mixer); +- mutex_unlock(&private->data_mutex); +- } ++ mutex_unlock(&private->data_mutex); + + ucontrol->value.integer.value[0] = private->master_vol; + return 0; +@@ -1051,11 +1050,10 @@ static int scarlett2_volume_ctl_get(struct snd_kcontrol *kctl, + struct scarlett2_mixer_data *private = mixer->private_data; + int index = elem->control; + +- if (private->vol_updated) { +- mutex_lock(&private->data_mutex); ++ mutex_lock(&private->data_mutex); ++ if (private->vol_updated) + scarlett2_update_volumes(mixer); +- mutex_unlock(&private->data_mutex); +- } ++ mutex_unlock(&private->data_mutex); + + ucontrol->value.integer.value[0] = private->vol[index]; + return 0; +@@ -1319,11 +1317,10 @@ static int scarlett2_button_ctl_get(struct snd_kcontrol *kctl, + struct usb_mixer_interface *mixer = elem->head.mixer; + struct scarlett2_mixer_data *private = mixer->private_data; + +- if (private->vol_updated) { +- mutex_lock(&private->data_mutex); ++ mutex_lock(&private->data_mutex); ++ if (private->vol_updated) + scarlett2_update_volumes(mixer); +- mutex_unlock(&private->data_mutex); +- } ++ mutex_unlock(&private->data_mutex); + + ucontrol->value.enumerated.item[0] = private->buttons[elem->control]; + return 0; +-- +2.30.2 + diff --git a/queue-5.4/alsa-usb-audio-scarlett2-fix-scarlett2_-_ctl_put-ret.patch b/queue-5.4/alsa-usb-audio-scarlett2-fix-scarlett2_-_ctl_put-ret.patch new file mode 100644 index 00000000000..6c0c52e1621 --- /dev/null +++ b/queue-5.4/alsa-usb-audio-scarlett2-fix-scarlett2_-_ctl_put-ret.patch @@ -0,0 +1,63 @@ +From 4d3a7ad121d9a066db80cdfa9d1d4d306ccf3ac8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 02:16:45 +0930 +Subject: ALSA: usb-audio: scarlett2: Fix scarlett2_*_ctl_put() return values + +From: Geoffrey D. Bennett + +[ Upstream commit c5d8e008032f3cd5f266d552732973a960b0bd4b ] + +Mixer control put callbacks should return 1 if the value is changed. +Fix the sw_hw, level, pad, and button controls accordingly. + +Signed-off-by: Geoffrey D. Bennett +Link: https://lore.kernel.org/r/20210620164645.GA9221@m.b4.vu +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/mixer_scarlett_gen2.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c +index 9c98d5b79011..322dc5b6be63 100644 +--- a/sound/usb/mixer_scarlett_gen2.c ++++ b/sound/usb/mixer_scarlett_gen2.c +@@ -1184,6 +1184,8 @@ static int scarlett2_sw_hw_enum_ctl_put(struct snd_kcontrol *kctl, + /* Send SW/HW switch change to the device */ + err = scarlett2_usb_set_config(mixer, SCARLETT2_CONFIG_SW_HW_SWITCH, + index, val); ++ if (err == 0) ++ err = 1; + + unlock: + mutex_unlock(&private->data_mutex); +@@ -1244,6 +1246,8 @@ static int scarlett2_level_enum_ctl_put(struct snd_kcontrol *kctl, + /* Send switch change to the device */ + err = scarlett2_usb_set_config(mixer, SCARLETT2_CONFIG_LEVEL_SWITCH, + index, val); ++ if (err == 0) ++ err = 1; + + unlock: + mutex_unlock(&private->data_mutex); +@@ -1294,6 +1298,8 @@ static int scarlett2_pad_ctl_put(struct snd_kcontrol *kctl, + /* Send switch change to the device */ + err = scarlett2_usb_set_config(mixer, SCARLETT2_CONFIG_PAD_SWITCH, + index, val); ++ if (err == 0) ++ err = 1; + + unlock: + mutex_unlock(&private->data_mutex); +@@ -1349,6 +1355,8 @@ static int scarlett2_button_ctl_put(struct snd_kcontrol *kctl, + /* Send switch change to the device */ + err = scarlett2_usb_set_config(mixer, SCARLETT2_CONFIG_BUTTONS, + index, val); ++ if (err == 0) ++ err = 1; + + unlock: + mutex_unlock(&private->data_mutex); +-- +2.30.2 + diff --git a/queue-5.4/alsa-usx2y-don-t-call-free_pages_exact-with-null-add.patch b/queue-5.4/alsa-usx2y-don-t-call-free_pages_exact-with-null-add.patch new file mode 100644 index 00000000000..482c9f48903 --- /dev/null +++ b/queue-5.4/alsa-usx2y-don-t-call-free_pages_exact-with-null-add.patch @@ -0,0 +1,41 @@ +From 5b59f0421f770c2f1a821618c692ac39ebd6e313 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 15:15:43 +0200 +Subject: ALSA: usx2y: Don't call free_pages_exact() with NULL address + +From: Takashi Iwai + +[ Upstream commit cae0cf651adccee2c3f376e78f30fbd788d0829f ] + +Unlike some other functions, we can't pass NULL pointer to +free_pages_exact(). Add a proper NULL check for avoiding possible +Oops. + +Link: https://lore.kernel.org/r/20210517131545.27252-10-tiwai@suse.de +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/usb/usx2y/usb_stream.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c +index 091c071b270a..cff684942c4f 100644 +--- a/sound/usb/usx2y/usb_stream.c ++++ b/sound/usb/usx2y/usb_stream.c +@@ -142,8 +142,11 @@ void usb_stream_free(struct usb_stream_kernel *sk) + if (!s) + return; + +- free_pages_exact(sk->write_page, s->write_size); +- sk->write_page = NULL; ++ if (sk->write_page) { ++ free_pages_exact(sk->write_page, s->write_size); ++ sk->write_page = NULL; ++ } ++ + free_pages_exact(s, s->read_size); + sk->s = NULL; + } +-- +2.30.2 + diff --git a/queue-5.4/arm-9087-1-kprobes-test-thumb-fix-for-llvm_ias-1.patch b/queue-5.4/arm-9087-1-kprobes-test-thumb-fix-for-llvm_ias-1.patch new file mode 100644 index 00000000000..0f66845ee31 --- /dev/null +++ b/queue-5.4/arm-9087-1-kprobes-test-thumb-fix-for-llvm_ias-1.patch @@ -0,0 +1,71 @@ +From b9007a4adc34399a6864a19eb92771c05a08c12b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 20:29:26 +0100 +Subject: ARM: 9087/1: kprobes: test-thumb: fix for LLVM_IAS=1 + +From: Nick Desaulniers + +[ Upstream commit 8b95a7d90ce8160ac5cffd5bace6e2eba01a871e ] + +There's a few instructions that GAS infers operands but Clang doesn't; +from what I can tell the Arm ARM doesn't say these are optional. + +F5.1.257 TBB, TBH T1 Halfword variant +F5.1.238 STREXD T1 variant +F5.1.84 LDREXD T1 variant + +Link: https://github.com/ClangBuiltLinux/linux/issues/1309 + +Signed-off-by: Nick Desaulniers +Reviewed-by: Jian Cai +Signed-off-by: Russell King +Signed-off-by: Sasha Levin +--- + arch/arm/probes/kprobes/test-thumb.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/arch/arm/probes/kprobes/test-thumb.c b/arch/arm/probes/kprobes/test-thumb.c +index 456c181a7bfe..4e11f0b760f8 100644 +--- a/arch/arm/probes/kprobes/test-thumb.c ++++ b/arch/arm/probes/kprobes/test-thumb.c +@@ -441,21 +441,21 @@ void kprobe_thumb32_test_cases(void) + "3: mvn r0, r0 \n\t" + "2: nop \n\t") + +- TEST_RX("tbh [pc, r",7, (9f-(1f+4))>>1,"]", ++ TEST_RX("tbh [pc, r",7, (9f-(1f+4))>>1,", lsl #1]", + "9: \n\t" + ".short (2f-1b-4)>>1 \n\t" + ".short (3f-1b-4)>>1 \n\t" + "3: mvn r0, r0 \n\t" + "2: nop \n\t") + +- TEST_RX("tbh [pc, r",12, ((9f-(1f+4))>>1)+1,"]", ++ TEST_RX("tbh [pc, r",12, ((9f-(1f+4))>>1)+1,", lsl #1]", + "9: \n\t" + ".short (2f-1b-4)>>1 \n\t" + ".short (3f-1b-4)>>1 \n\t" + "3: mvn r0, r0 \n\t" + "2: nop \n\t") + +- TEST_RRX("tbh [r",1,9f, ", r",14,1,"]", ++ TEST_RRX("tbh [r",1,9f, ", r",14,1,", lsl #1]", + "9: \n\t" + ".short (2f-1b-4)>>1 \n\t" + ".short (3f-1b-4)>>1 \n\t" +@@ -468,10 +468,10 @@ void kprobe_thumb32_test_cases(void) + + TEST_UNSUPPORTED("strexb r0, r1, [r2]") + TEST_UNSUPPORTED("strexh r0, r1, [r2]") +- TEST_UNSUPPORTED("strexd r0, r1, [r2]") ++ TEST_UNSUPPORTED("strexd r0, r1, r2, [r2]") + TEST_UNSUPPORTED("ldrexb r0, [r1]") + TEST_UNSUPPORTED("ldrexh r0, [r1]") +- TEST_UNSUPPORTED("ldrexd r0, [r1]") ++ TEST_UNSUPPORTED("ldrexd r0, r1, [r1]") + + TEST_GROUP("Data-processing (shifted register) and (modified immediate)") + +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-am335x-align-ti-pindir-d0-out-d1-in-property.patch b/queue-5.4/arm-dts-am335x-align-ti-pindir-d0-out-d1-in-property.patch new file mode 100644 index 00000000000..e8c5df4fcc6 --- /dev/null +++ b/queue-5.4/arm-dts-am335x-align-ti-pindir-d0-out-d1-in-property.patch @@ -0,0 +1,36 @@ +From 753c0f3a63b6cb93e7ad84ddf80a8f9368e9c852 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 10:39:51 +0530 +Subject: ARM: dts: am335x: align ti,pindir-d0-out-d1-in property with dt-shema + +From: Aswath Govindraju + +[ Upstream commit 414bfe1d26b60ef20b58e36efd5363188a694bab ] + +ti,pindir-d0-out-d1-in property is expected to be of type boolean. +Therefore, fix the property accordingly. + +Fixes: 444d66fafab8 ("ARM: dts: add spi wifi support to cm-t335") +Signed-off-by: Aswath Govindraju +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am335x-cm-t335.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/am335x-cm-t335.dts b/arch/arm/boot/dts/am335x-cm-t335.dts +index 1fe3b566ba3d..09b36df140e5 100644 +--- a/arch/arm/boot/dts/am335x-cm-t335.dts ++++ b/arch/arm/boot/dts/am335x-cm-t335.dts +@@ -516,7 +516,7 @@ status = "okay"; + status = "okay"; + pinctrl-names = "default"; + pinctrl-0 = <&spi0_pins>; +- ti,pindir-d0-out-d1-in = <1>; ++ ti,pindir-d0-out-d1-in; + /* WLS1271 WiFi */ + wlcore: wlcore@1 { + compatible = "ti,wl1271"; +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-am437x-align-ti-pindir-d0-out-d1-in-property.patch b/queue-5.4/arm-dts-am437x-align-ti-pindir-d0-out-d1-in-property.patch new file mode 100644 index 00000000000..ada3e296b11 --- /dev/null +++ b/queue-5.4/arm-dts-am437x-align-ti-pindir-d0-out-d1-in-property.patch @@ -0,0 +1,45 @@ +From be766d405426f18a9700c55b84e33f5ce4ddb057 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Jun 2021 10:39:52 +0530 +Subject: ARM: dts: am437x: align ti,pindir-d0-out-d1-in property with dt-shema + +From: Aswath Govindraju + +[ Upstream commit 9b11fec7345f21995f4ea4bafb0e108b9a620238 ] + +ti,pindir-d0-out-d1-in property is expected to be of type boolean. +Therefore, fix the property accordingly. + +Fixes: b0b039515445 ("ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1") +Signed-off-by: Aswath Govindraju +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/am43x-epos-evm.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/am43x-epos-evm.dts b/arch/arm/boot/dts/am43x-epos-evm.dts +index a6fbc088daa8..a9f191d78b54 100644 +--- a/arch/arm/boot/dts/am43x-epos-evm.dts ++++ b/arch/arm/boot/dts/am43x-epos-evm.dts +@@ -848,7 +848,7 @@ + pinctrl-names = "default", "sleep"; + pinctrl-0 = <&spi0_pins_default>; + pinctrl-1 = <&spi0_pins_sleep>; +- ti,pindir-d0-out-d1-in = <1>; ++ ti,pindir-d0-out-d1-in; + }; + + &spi1 { +@@ -856,7 +856,7 @@ + pinctrl-names = "default", "sleep"; + pinctrl-0 = <&spi1_pins_default>; + pinctrl-1 = <&spi1_pins_sleep>; +- ti,pindir-d0-out-d1-in = <1>; ++ ti,pindir-d0-out-d1-in; + }; + + &usb2_phy1 { +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-bcm5301x-fixup-spi-binding.patch b/queue-5.4/arm-dts-bcm5301x-fixup-spi-binding.patch new file mode 100644 index 00000000000..347a62b4e19 --- /dev/null +++ b/queue-5.4/arm-dts-bcm5301x-fixup-spi-binding.patch @@ -0,0 +1,83 @@ +From a7e75a8439ee224beb1c0c619e016ee7231cfdfb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 15:07:09 +0200 +Subject: ARM: dts: BCM5301X: Fixup SPI binding +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki + +[ Upstream commit d5aede3e6dd1b8ca574600a1ecafe1e580c53f2f ] + +1. Reorder interrupts +2. Fix typo: s/spi_lr_overhead/spi_lr_overread/ +3. Rename node: s/spi-nor@0/flash@0/ + +This fixes: +arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dt.yaml: spi@18029200: interrupt-names: 'oneOf' conditional failed, one must be fixed: + ['spi_lr_fullness_reached', 'spi_lr_session_aborted', 'spi_lr_impatient', 'spi_lr_session_done', 'spi_lr_overhead', 'mspi_done', 'mspi_halted'] is too long + Additional items are not allowed ('spi_lr_session_aborted', 'spi_lr_impatient', 'spi_lr_session_done', 'spi_lr_overhead', 'mspi_done', 'mspi_halted' were unexpected) + 'mspi_done' was expected + 'spi_l1_intr' was expected + 'mspi_halted' was expected + 'spi_lr_fullness_reached' was expected + 'spi_lr_session_aborted' was expected + 'spi_lr_impatient' was expected + 'spi_lr_session_done' was expected + 'spi_lr_overread' was expected + From schema: Documentation/devicetree/bindings/spi/brcm,spi-bcm-qspi.yaml +arch/arm/boot/dts/bcm4709-buffalo-wxr-1900dhp.dt.yaml: spi-nor@0: $nodename:0: 'spi-nor@0' does not match '^flash(@.*)?$' + From schema: Documentation/devicetree/bindings/mtd/jedec,spi-nor.yaml + +Signed-off-by: Rafał Miłecki +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm5301x.dtsi | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 0016720ce530..9711170649b6 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -494,27 +494,27 @@ + <0x1811b408 0x004>, + <0x180293a0 0x01c>; + reg-names = "mspi", "bspi", "intr_regs", "intr_status_reg"; +- interrupts = , ++ interrupts = , ++ , ++ , + , + , + , +- , +- , +- ; +- interrupt-names = "spi_lr_fullness_reached", ++ ; ++ interrupt-names = "mspi_done", ++ "mspi_halted", ++ "spi_lr_fullness_reached", + "spi_lr_session_aborted", + "spi_lr_impatient", + "spi_lr_session_done", +- "spi_lr_overhead", +- "mspi_done", +- "mspi_halted"; ++ "spi_lr_overread"; + clocks = <&iprocmed>; + clock-names = "iprocmed"; + num-cs = <2>; + #address-cells = <1>; + #size-cells = <0>; + +- spi_nor: spi-nor@0 { ++ spi_nor: flash@0 { + compatible = "jedec,spi-nor"; + reg = <0>; + spi-max-frequency = <20000000>; +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch b/queue-5.4/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch new file mode 100644 index 00000000000..7442a761490 --- /dev/null +++ b/queue-5.4/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch @@ -0,0 +1,47 @@ +From 6b886729dbe33de08ef704d0d9324da7501d8b63 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 09:59:39 -0400 +Subject: ARM: dts: exynos: fix PWM LED max brightness on Odroid XU/XU3 + +From: Krzysztof Kozlowski + +[ Upstream commit 75121e1dc9fe4def41e63d57f6a53749b88006ed ] + +There is no "max_brightness" property. This brings the intentional +brightness reduce of green LED and dtschema checks as well: + + arch/arm/boot/dts/exynos5410-odroidxu.dt.yaml: led-controller-1: led-1: 'max-brightness' is a required property + +Fixes: 719f39fec586 ("ARM: dts: exynos5422-odroidxu3: Hook up PWM and use it for LEDs") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210505135941.59898-3-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi b/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi +index 56acd832f0b3..16e1087ec717 100644 +--- a/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi ++++ b/arch/arm/boot/dts/exynos54xx-odroidxu-leds.dtsi +@@ -22,7 +22,7 @@ + * Green LED is much brighter than the others + * so limit its max brightness + */ +- max_brightness = <127>; ++ max-brightness = <127>; + linux,default-trigger = "mmc0"; + }; + +@@ -30,7 +30,7 @@ + label = "blue:heartbeat"; + pwms = <&pwm 2 2000000 0>; + pwm-names = "pwm2"; +- max_brightness = <255>; ++ max-brightness = <255>; + linux,default-trigger = "heartbeat"; + }; + }; +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-1539 b/queue-5.4/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-1539 new file mode 100644 index 00000000000..3d0c8a02809 --- /dev/null +++ b/queue-5.4/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-1539 @@ -0,0 +1,37 @@ +From 1983c0886672c65cdddcd26f11cdae1bc6d31d7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 09:59:41 -0400 +Subject: ARM: dts: exynos: fix PWM LED max brightness on Odroid XU4 + +From: Krzysztof Kozlowski + +[ Upstream commit fd2f1717966535b7d0b6fe45cf0d79e94330da5f ] + +There is no "max_brightness" property as pointed out by dtschema: + + arch/arm/boot/dts/exynos5422-odroidxu4.dt.yaml: led-controller: led-1: 'max-brightness' is a required property + +Fixes: 6658356014cb ("ARM: dts: Add support Odroid XU4 board for exynos5422-odroidxu4") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210505135941.59898-5-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5422-odroidxu4.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroidxu4.dts b/arch/arm/boot/dts/exynos5422-odroidxu4.dts +index 892d389d6d09..1fc354485403 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidxu4.dts ++++ b/arch/arm/boot/dts/exynos5422-odroidxu4.dts +@@ -24,7 +24,7 @@ + label = "blue:heartbeat"; + pwms = <&pwm 2 2000000 0>; + pwm-names = "pwm2"; +- max_brightness = <255>; ++ max-brightness = <255>; + linux,default-trigger = "heartbeat"; + }; + }; +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-17224 b/queue-5.4/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-17224 new file mode 100644 index 00000000000..d3d4e0886dd --- /dev/null +++ b/queue-5.4/arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-17224 @@ -0,0 +1,37 @@ +From d10436be35a39cef2b89d783c9f7d278511af4a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 May 2021 09:59:40 -0400 +Subject: ARM: dts: exynos: fix PWM LED max brightness on Odroid HC1 + +From: Krzysztof Kozlowski + +[ Upstream commit a7e59c84cf2055a1894f45855c8319191f2fa59e ] + +There is no "max_brightness" property as pointed out by dtschema: + + arch/arm/boot/dts/exynos5422-odroidhc1.dt.yaml: led-controller: led-1: 'max-brightness' is a required property + +Fixes: 1ac49427b566 ("ARM: dts: exynos: Add support for Hardkernel's Odroid HC1 board") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210505135941.59898-4-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/exynos5422-odroidhc1.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/exynos5422-odroidhc1.dts b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +index d271e7548826..fce5a4579693 100644 +--- a/arch/arm/boot/dts/exynos5422-odroidhc1.dts ++++ b/arch/arm/boot/dts/exynos5422-odroidhc1.dts +@@ -22,7 +22,7 @@ + label = "blue:heartbeat"; + pwms = <&pwm 2 2000000 0>; + pwm-names = "pwm2"; +- max_brightness = <255>; ++ max-brightness = <255>; + linux,default-trigger = "heartbeat"; + }; + }; +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-gemini-rut1xx-remove-duplicate-ethernet-node.patch b/queue-5.4/arm-dts-gemini-rut1xx-remove-duplicate-ethernet-node.patch new file mode 100644 index 00000000000..ef77d57a1f2 --- /dev/null +++ b/queue-5.4/arm-dts-gemini-rut1xx-remove-duplicate-ethernet-node.patch @@ -0,0 +1,49 @@ +From 6fbdf605620ceabb09f5cad92207f103453e59dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 18:54:57 +0000 +Subject: ARM: dts: gemini-rut1xx: remove duplicate ethernet node + +From: Corentin Labbe + +[ Upstream commit 3d3bb3d27cd371d3edb43eeb1beb8ae4e92a356d ] + +Two ethernet node was added by +commit 95220046a62c ("ARM: dts: Add ethernet to a bunch of platforms") +and commit d6d0cef55e5b ("ARM: dts: Add the FOTG210 USB host to Gemini boards") + +This patch removes the duplicate one. + +Fixes: d6d0cef55e5b ("ARM: dts: Add the FOTG210 USB host to Gemini boards") +Signed-off-by: Corentin Labbe +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/gemini-rut1xx.dts | 12 ------------ + 1 file changed, 12 deletions(-) + +diff --git a/arch/arm/boot/dts/gemini-rut1xx.dts b/arch/arm/boot/dts/gemini-rut1xx.dts +index 9611ddf06792..08091d2a64e1 100644 +--- a/arch/arm/boot/dts/gemini-rut1xx.dts ++++ b/arch/arm/boot/dts/gemini-rut1xx.dts +@@ -125,18 +125,6 @@ + }; + }; + +- ethernet@60000000 { +- status = "okay"; +- +- ethernet-port@0 { +- phy-mode = "rgmii"; +- phy-handle = <&phy0>; +- }; +- ethernet-port@1 { +- /* Not used in this platform */ +- }; +- }; +- + usb@68000000 { + status = "okay"; + }; +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-imx6q-dhcom-add-gpios-pinctrl-for-i2c-bus-re.patch b/queue-5.4/arm-dts-imx6q-dhcom-add-gpios-pinctrl-for-i2c-bus-re.patch new file mode 100644 index 00000000000..f2652c8e904 --- /dev/null +++ b/queue-5.4/arm-dts-imx6q-dhcom-add-gpios-pinctrl-for-i2c-bus-re.patch @@ -0,0 +1,111 @@ +From b5bd2a9b4b698e8b62049b565d696df3892ad956 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 12:54:00 +0200 +Subject: ARM: dts: imx6q-dhcom: Add gpios pinctrl for i2c bus recovery + +From: Christoph Niedermaier + +[ Upstream commit ddc873cd3c0af4faad6a00bffda21c3f775126dd ] + +The i2c bus can freeze at the end of transaction so the bus can no longer work. +This scenario is improved by adding scl/sda gpios definitions to implement the +i2c bus recovery mechanism. + +Fixes: 52c7a088badd ("ARM: dts: imx6q: Add support for the DHCOM iMX6 SoM and PDK2") +Signed-off-by: Christoph Niedermaier +Cc: Shawn Guo +Cc: Fabio Estevam +Cc: Marek Vasut +Cc: NXP Linux Team +Cc: kernel@dh-electronics.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6q-dhcom-som.dtsi | 36 +++++++++++++++++++++++--- + 1 file changed, 33 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi +index 0824051a98f8..3233927d33b4 100644 +--- a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi +@@ -107,22 +107,31 @@ + + &i2c1 { + clock-frequency = <100000>; +- pinctrl-names = "default"; ++ pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c1>; ++ pinctrl-1 = <&pinctrl_i2c1_gpio>; ++ scl-gpios = <&gpio3 21 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; ++ sda-gpios = <&gpio3 28 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + status = "okay"; + }; + + &i2c2 { + clock-frequency = <100000>; +- pinctrl-names = "default"; ++ pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c2>; ++ pinctrl-1 = <&pinctrl_i2c2_gpio>; ++ scl-gpios = <&gpio4 12 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; ++ sda-gpios = <&gpio4 13 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + status = "okay"; + }; + + &i2c3 { + clock-frequency = <100000>; +- pinctrl-names = "default"; ++ pinctrl-names = "default", "gpio"; + pinctrl-0 = <&pinctrl_i2c3>; ++ pinctrl-1 = <&pinctrl_i2c3_gpio>; ++ scl-gpios = <&gpio1 3 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; ++ sda-gpios = <&gpio1 6 (GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)>; + status = "okay"; + + ltc3676: pmic@3c { +@@ -288,6 +297,13 @@ + >; + }; + ++ pinctrl_i2c1_gpio: i2c1-gpio-grp { ++ fsl,pins = < ++ MX6QDL_PAD_EIM_D21__GPIO3_IO21 0x4001b8b1 ++ MX6QDL_PAD_EIM_D28__GPIO3_IO28 0x4001b8b1 ++ >; ++ }; ++ + pinctrl_i2c2: i2c2-grp { + fsl,pins = < + MX6QDL_PAD_KEY_COL3__I2C2_SCL 0x4001b8b1 +@@ -295,6 +311,13 @@ + >; + }; + ++ pinctrl_i2c2_gpio: i2c2-gpio-grp { ++ fsl,pins = < ++ MX6QDL_PAD_KEY_COL3__GPIO4_IO12 0x4001b8b1 ++ MX6QDL_PAD_KEY_ROW3__GPIO4_IO13 0x4001b8b1 ++ >; ++ }; ++ + pinctrl_i2c3: i2c3-grp { + fsl,pins = < + MX6QDL_PAD_GPIO_3__I2C3_SCL 0x4001b8b1 +@@ -302,6 +325,13 @@ + >; + }; + ++ pinctrl_i2c3_gpio: i2c3-gpio-grp { ++ fsl,pins = < ++ MX6QDL_PAD_GPIO_3__GPIO1_IO03 0x4001b8b1 ++ MX6QDL_PAD_GPIO_6__GPIO1_IO06 0x4001b8b1 ++ >; ++ }; ++ + pinctrl_pmic_hw300: pmic-hw300-grp { + fsl,pins = < + MX6QDL_PAD_EIM_A25__GPIO5_IO02 0x1B0B0 +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-imx6q-dhcom-fix-ethernet-plugin-detection-pr.patch b/queue-5.4/arm-dts-imx6q-dhcom-fix-ethernet-plugin-detection-pr.patch new file mode 100644 index 00000000000..6e023fd1dfc --- /dev/null +++ b/queue-5.4/arm-dts-imx6q-dhcom-fix-ethernet-plugin-detection-pr.patch @@ -0,0 +1,41 @@ +From be1b33ae2196dcde603116da412828b3d34749d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 12:53:59 +0200 +Subject: ARM: dts: imx6q-dhcom: Fix ethernet plugin detection problems + +From: Christoph Niedermaier + +[ Upstream commit e2bdd3484890441b9cc2560413a86e8f2aa04157 ] + +To make the ethernet cable plugin detection reliable the +power detection of the smsc phy has been disabled. + +Fixes: 52c7a088badd ("ARM: dts: imx6q: Add support for the DHCOM iMX6 SoM and PDK2") +Signed-off-by: Christoph Niedermaier +Cc: Shawn Guo +Cc: Fabio Estevam +Cc: Marek Vasut +Cc: NXP Linux Team +Cc: kernel@dh-electronics.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6q-dhcom-som.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi +index d347c8db0ab7..0824051a98f8 100644 +--- a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi +@@ -100,6 +100,7 @@ + reset-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>; + reset-assert-us = <1000>; + reset-deassert-us = <1000>; ++ smsc,disable-energy-detect; /* Make plugin detection reliable */ + }; + }; + }; +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-imx6q-dhcom-fix-ethernet-reset-time-properti.patch b/queue-5.4/arm-dts-imx6q-dhcom-fix-ethernet-reset-time-properti.patch new file mode 100644 index 00000000000..078808b384f --- /dev/null +++ b/queue-5.4/arm-dts-imx6q-dhcom-fix-ethernet-reset-time-properti.patch @@ -0,0 +1,44 @@ +From b1f3111709960810ee1f0ae242eee6a695df1827 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 12:53:58 +0200 +Subject: ARM: dts: imx6q-dhcom: Fix ethernet reset time properties + +From: Christoph Niedermaier + +[ Upstream commit c016c26c1631f539c652b5d82242a3ca402545c1 ] + +Fix ethernet reset time properties as described in +Documentation/devicetree/bindings/net/ethernet-phy.yaml + +Fixes: 52c7a088badd ("ARM: dts: imx6q: Add support for the DHCOM iMX6 SoM and PDK2") +Signed-off-by: Christoph Niedermaier +Cc: Shawn Guo +Cc: Fabio Estevam +Cc: Marek Vasut +Cc: NXP Linux Team +Cc: kernel@dh-electronics.com +To: linux-arm-kernel@lists.infradead.org +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6q-dhcom-som.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi +index 621894d13dcb..d347c8db0ab7 100644 +--- a/arch/arm/boot/dts/imx6q-dhcom-som.dtsi ++++ b/arch/arm/boot/dts/imx6q-dhcom-som.dtsi +@@ -98,8 +98,8 @@ + reg = <0>; + max-speed = <100>; + reset-gpios = <&gpio5 0 GPIO_ACTIVE_LOW>; +- reset-delay-us = <1000>; +- reset-post-delay-us = <1000>; ++ reset-assert-us = <1000>; ++ reset-deassert-us = <1000>; + }; + }; + }; +-- +2.30.2 + diff --git a/queue-5.4/arm-dts-r8a7779-marzen-fix-du-clock-names.patch b/queue-5.4/arm-dts-r8a7779-marzen-fix-du-clock-names.patch new file mode 100644 index 00000000000..fc6be5ad925 --- /dev/null +++ b/queue-5.4/arm-dts-r8a7779-marzen-fix-du-clock-names.patch @@ -0,0 +1,56 @@ +From 6fb78744fa693804a58266472797db113c78d466 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Apr 2021 14:41:15 +0200 +Subject: ARM: dts: r8a7779, marzen: Fix DU clock names + +From: Geert Uytterhoeven + +[ Upstream commit 6ab8c23096a29b69044209a5925758a6f88bd450 ] + +"make dtbs_check" complains: + + arch/arm/boot/dts/r8a7779-marzen.dt.yaml: display@fff80000: clock-names:0: 'du.0' was expected + +Change the first clock name to match the DT bindings. +This has no effect on actual operation, as the Display Unit driver in +Linux does not use the first clock name on R-Car H1, but just grabs the +first clock. + +Fixes: 665d79aa47cb3983 ("ARM: shmobile: marzen: Add DU external pixel clock to DT") +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Laurent Pinchart +Link: https://lore.kernel.org/r/9d5e1b371121883b3b3e10a3df43802a29c6a9da.1619699965.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/r8a7779-marzen.dts | 2 +- + arch/arm/boot/dts/r8a7779.dtsi | 1 + + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/r8a7779-marzen.dts b/arch/arm/boot/dts/r8a7779-marzen.dts +index c755f0b8fd0d..29599adea2ab 100644 +--- a/arch/arm/boot/dts/r8a7779-marzen.dts ++++ b/arch/arm/boot/dts/r8a7779-marzen.dts +@@ -146,7 +146,7 @@ + status = "okay"; + + clocks = <&mstp1_clks R8A7779_CLK_DU>, <&x3_clk>; +- clock-names = "du", "dclkin.0"; ++ clock-names = "du.0", "dclkin.0"; + + ports { + port@0 { +diff --git a/arch/arm/boot/dts/r8a7779.dtsi b/arch/arm/boot/dts/r8a7779.dtsi +index 63341635bddf..b3cb6492fc27 100644 +--- a/arch/arm/boot/dts/r8a7779.dtsi ++++ b/arch/arm/boot/dts/r8a7779.dtsi +@@ -463,6 +463,7 @@ + reg = <0xfff80000 0x40000>; + interrupts = ; + clocks = <&mstp1_clks R8A7779_CLK_DU>; ++ clock-names = "du.0"; + power-domains = <&sysc R8A7779_PD_ALWAYS_ON>; + status = "disabled"; + +-- +2.30.2 + diff --git a/queue-5.4/arm-exynos-add-missing-of_node_put-for-loop-iteratio.patch b/queue-5.4/arm-exynos-add-missing-of_node_put-for-loop-iteratio.patch new file mode 100644 index 00000000000..c8da9212d10 --- /dev/null +++ b/queue-5.4/arm-exynos-add-missing-of_node_put-for-loop-iteratio.patch @@ -0,0 +1,47 @@ +From 7d787b1d5b198e7c679d09aa4b571e066675c899 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Apr 2021 19:49:45 +0200 +Subject: ARM: exynos: add missing of_node_put for loop iteration + +From: Krzysztof Kozlowski + +[ Upstream commit 48d551bf20858240f38a0276be3016ff379918ac ] + +Early exits from for_each_compatible_node() should decrement the +node reference counter. Reported by Coccinelle: + + arch/arm/mach-exynos/exynos.c:52:1-25: WARNING: + Function "for_each_compatible_node" should have of_node_put() before break around line 58. + +Fixes: b3205dea8fbf ("ARM: EXYNOS: Map SYSRAM through generic DT bindings") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Arnd Bergmann +Link: https://lore.kernel.org/r/20210425174945.164612-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + arch/arm/mach-exynos/exynos.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/mach-exynos/exynos.c b/arch/arm/mach-exynos/exynos.c +index 9aa483366ebc..f226d4f57bf4 100644 +--- a/arch/arm/mach-exynos/exynos.c ++++ b/arch/arm/mach-exynos/exynos.c +@@ -46,6 +46,7 @@ void __init exynos_sysram_init(void) + sysram_base_addr = of_iomap(node, 0); + sysram_base_phys = of_translate_address(node, + of_get_address(node, 0, NULL, NULL)); ++ of_node_put(node); + break; + } + +@@ -53,6 +54,7 @@ void __init exynos_sysram_init(void) + if (!of_device_is_available(node)) + continue; + sysram_ns_base_addr = of_iomap(node, 0); ++ of_node_put(node); + break; + } + } +-- +2.30.2 + diff --git a/queue-5.4/arm64-dts-qcom-msm8994-angler-fix-gpio-reserved-rang.patch b/queue-5.4/arm64-dts-qcom-msm8994-angler-fix-gpio-reserved-rang.patch new file mode 100644 index 00000000000..4f7847ff89f --- /dev/null +++ b/queue-5.4/arm64-dts-qcom-msm8994-angler-fix-gpio-reserved-rang.patch @@ -0,0 +1,40 @@ +From b839cbb4d6da5c2d3b8f5778b7bda27062bba2b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Apr 2021 21:39:13 +0200 +Subject: arm64: dts: qcom: msm8994-angler: Fix gpio-reserved-ranges 85-88 + +From: Petr Vorel + +[ Upstream commit f890f89d9a80fffbfa7ca791b78927e5b8aba869 ] + +Reserve GPIO pins 85-88 as these aren't meant to be accessible from the +application CPUs (causes reboot). Yet another fix similar to +9134586715e3, 5f8d3ab136d0, which is needed to allow angler to boot after +3edfb7bd76bd ("gpiolib: Show correct direction from the beginning"). + +Fixes: feeaf56ac78d ("arm64: dts: msm8994 SoC and Huawei Angler (Nexus 6P) support") + +Signed-off-by: Petr Vorel +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20210415193913.1836153-1-petr.vorel@gmail.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts +index a5f9a6ab512c..136784dc72ca 100644 +--- a/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts ++++ b/arch/arm64/boot/dts/qcom/msm8994-angler-rev-101.dts +@@ -30,3 +30,7 @@ + }; + }; + }; ++ ++&tlmm { ++ gpio-reserved-ranges = <85 4>; ++}; +-- +2.30.2 + diff --git a/queue-5.4/arm64-dts-renesas-v3msk-fix-memory-size.patch b/queue-5.4/arm64-dts-renesas-v3msk-fix-memory-size.patch new file mode 100644 index 00000000000..9e2b2785ad8 --- /dev/null +++ b/queue-5.4/arm64-dts-renesas-v3msk-fix-memory-size.patch @@ -0,0 +1,37 @@ +From 9ba87e5358cb391eb9d81a6a7919e6a4936d592e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 26 Mar 2021 13:10:50 +0100 +Subject: arm64: dts: renesas: v3msk: Fix memory size + +From: Valentine Barshak + +[ Upstream commit a422ec20caef6a50cf3c1efa93538888ebd576a6 ] + +The V3MSK board has 2 GiB RAM according to the datasheet and schematics. + +Signed-off-by: Valentine Barshak +[geert: Verified schematics] +Fixes: cc3e267e9bb0ce7f ("arm64: dts: renesas: initial V3MSK board device tree") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/20210326121050.1578460-1-geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts b/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts +index d7c7b9156e08..5c391248ddb3 100644 +--- a/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts ++++ b/arch/arm64/boot/dts/renesas/r8a77970-v3msk.dts +@@ -59,7 +59,7 @@ + memory@48000000 { + device_type = "memory"; + /* first 128MB is reserved for secure area. */ +- reg = <0x0 0x48000000 0x0 0x38000000>; ++ reg = <0x0 0x48000000 0x0 0x78000000>; + }; + + osc5_clk: osc5-clock { +-- +2.30.2 + diff --git a/queue-5.4/asoc-img-fix-pm-reference-leak-in-img_i2s_in_probe.patch b/queue-5.4/asoc-img-fix-pm-reference-leak-in-img_i2s_in_probe.patch new file mode 100644 index 00000000000..21c30144f46 --- /dev/null +++ b/queue-5.4/asoc-img-fix-pm-reference-leak-in-img_i2s_in_probe.patch @@ -0,0 +1,39 @@ +From b76aadb307a64534c4cadd2591475d0a8ec31421 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 May 2021 05:35:21 -0400 +Subject: ASoC: img: Fix PM reference leak in img_i2s_in_probe() + +From: Yufen Yu + +[ Upstream commit 81aad47278539f02de808bcc8251fed0ad3d6f55 ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Reported-by: Hulk Robot +Signed-off-by: Yufen Yu +Link: https://lore.kernel.org/r/20210524093521.612176-1-yuyufen@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/img/img-i2s-in.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/img/img-i2s-in.c b/sound/soc/img/img-i2s-in.c +index bb668551dd4b..243f916355ee 100644 +--- a/sound/soc/img/img-i2s-in.c ++++ b/sound/soc/img/img-i2s-in.c +@@ -464,7 +464,7 @@ static int img_i2s_in_probe(struct platform_device *pdev) + if (ret) + goto err_pm_disable; + } +- ret = pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_resume_and_get(&pdev->dev); + if (ret < 0) + goto err_suspend; + +-- +2.30.2 + diff --git a/queue-5.4/asoc-intel-kbl_da7219_max98357a-shrink-platform_id-b.patch b/queue-5.4/asoc-intel-kbl_da7219_max98357a-shrink-platform_id-b.patch new file mode 100644 index 00000000000..0e19ad873dc --- /dev/null +++ b/queue-5.4/asoc-intel-kbl_da7219_max98357a-shrink-platform_id-b.patch @@ -0,0 +1,64 @@ +From d7b8a333942ea4e3d61c7423fb4dbca38af9be10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 14:40:52 -0500 +Subject: ASoC: Intel: kbl_da7219_max98357a: shrink platform_id below 20 + characters + +From: Pierre-Louis Bossart + +[ Upstream commit 94efd726b947f265bd313605c9f73edec5469d65 ] + +Sparse throws the following warnings: + +sound/soc/intel/boards/kbl_da7219_max98357a.c:647:25: error: too long +initializer-string for array of char(no space for nul char) + +Fix by using the 'mx' acronym for Maxim. + +Signed-off-by: Pierre-Louis Bossart +Reviewed-by: Paul Olaru +Reviewed-by: Guennadi Liakhovetski +Reviewed-by: Rander Wang +Link: https://lore.kernel.org/r/20210621194057.21711-6-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/intel/boards/kbl_da7219_max98357a.c | 4 ++-- + sound/soc/intel/common/soc-acpi-intel-kbl-match.c | 2 +- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/intel/boards/kbl_da7219_max98357a.c b/sound/soc/intel/boards/kbl_da7219_max98357a.c +index 537a88932bb6..69362eae65be 100644 +--- a/sound/soc/intel/boards/kbl_da7219_max98357a.c ++++ b/sound/soc/intel/boards/kbl_da7219_max98357a.c +@@ -607,7 +607,7 @@ static int kabylake_audio_probe(struct platform_device *pdev) + + static const struct platform_device_id kbl_board_ids[] = { + { +- .name = "kbl_da7219_max98357a", ++ .name = "kbl_da7219_mx98357a", + .driver_data = + (kernel_ulong_t)&kabylake_audio_card_da7219_m98357a, + }, +@@ -629,4 +629,4 @@ module_platform_driver(kabylake_audio) + MODULE_DESCRIPTION("Audio Machine driver-DA7219 & MAX98357A in I2S mode"); + MODULE_AUTHOR("Naveen Manohar "); + MODULE_LICENSE("GPL v2"); +-MODULE_ALIAS("platform:kbl_da7219_max98357a"); ++MODULE_ALIAS("platform:kbl_da7219_mx98357a"); +diff --git a/sound/soc/intel/common/soc-acpi-intel-kbl-match.c b/sound/soc/intel/common/soc-acpi-intel-kbl-match.c +index e200baa11011..df7f82e55a5a 100644 +--- a/sound/soc/intel/common/soc-acpi-intel-kbl-match.c ++++ b/sound/soc/intel/common/soc-acpi-intel-kbl-match.c +@@ -113,7 +113,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_kbl_machines[] = { + }, + { + .id = "DLGS7219", +- .drv_name = "kbl_da7219_max98373", ++ .drv_name = "kbl_da7219_mx98373", + .fw_filename = "intel/dsp_fw_kbl.bin", + .machine_quirk = snd_soc_acpi_codec_list, + .quirk_data = &kbl_7219_98373_codecs, +-- +2.30.2 + diff --git a/queue-5.4/asoc-soc-core-fix-the-error-return-code-in-snd_soc_o.patch b/queue-5.4/asoc-soc-core-fix-the-error-return-code-in-snd_soc_o.patch new file mode 100644 index 00000000000..661885a3f68 --- /dev/null +++ b/queue-5.4/asoc-soc-core-fix-the-error-return-code-in-snd_soc_o.patch @@ -0,0 +1,37 @@ +From 69d1f0cc7db6aead07934a6a27f1763c16043786 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 18:37:29 +0800 +Subject: ASoC: soc-core: Fix the error return code in + snd_soc_of_parse_audio_routing() + +From: Zhen Lei + +[ Upstream commit 7d3865a10b9ff2669c531d5ddd60bf46b3d48f1e ] + +When devm_kcalloc() fails, the error code -ENOMEM should be returned +instead of -EINVAL. + +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210617103729.1918-1-thunder.leizhen@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index 9df20768a8f2..c0e03cc8ea82 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -3178,7 +3178,7 @@ int snd_soc_of_parse_audio_routing(struct snd_soc_card *card, + if (!routes) { + dev_err(card->dev, + "ASoC: Could not allocate DAPM route table\n"); +- return -EINVAL; ++ return -ENOMEM; + } + + for (i = 0; i < num_routes; i++) { +-- +2.30.2 + diff --git a/queue-5.4/backlight-lm3630a-fix-return-code-of-.update_status-.patch b/queue-5.4/backlight-lm3630a-fix-return-code-of-.update_status-.patch new file mode 100644 index 00000000000..cbc0ef93984 --- /dev/null +++ b/queue-5.4/backlight-lm3630a-fix-return-code-of-.update_status-.patch @@ -0,0 +1,74 @@ +From 22be2cff6468ef3a773ce2b78f82465b2f1156b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 14:21:47 +0200 +Subject: backlight: lm3630a: Fix return code of .update_status() callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit b9481a667a90ec739995e85f91f3672ca44d6ffa ] + +According to .update_status() is supposed to +return 0 on success and a negative error code otherwise. Adapt +lm3630a_bank_a_update_status() and lm3630a_bank_b_update_status() to +actually do it. + +While touching that also add the error code to the failure message. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Daniel Thompson +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/video/backlight/lm3630a_bl.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/video/backlight/lm3630a_bl.c b/drivers/video/backlight/lm3630a_bl.c +index f03ffe2bb237..8096202fbe5d 100644 +--- a/drivers/video/backlight/lm3630a_bl.c ++++ b/drivers/video/backlight/lm3630a_bl.c +@@ -188,7 +188,7 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl) + if ((pwm_ctrl & LM3630A_PWM_BANK_A) != 0) { + lm3630a_pwm_ctrl(pchip, bl->props.brightness, + bl->props.max_brightness); +- return bl->props.brightness; ++ return 0; + } + + /* disable sleep */ +@@ -208,8 +208,8 @@ static int lm3630a_bank_a_update_status(struct backlight_device *bl) + return 0; + + out_i2c_err: +- dev_err(pchip->dev, "i2c failed to access\n"); +- return bl->props.brightness; ++ dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret)); ++ return ret; + } + + static int lm3630a_bank_a_get_brightness(struct backlight_device *bl) +@@ -265,7 +265,7 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl) + if ((pwm_ctrl & LM3630A_PWM_BANK_B) != 0) { + lm3630a_pwm_ctrl(pchip, bl->props.brightness, + bl->props.max_brightness); +- return bl->props.brightness; ++ return 0; + } + + /* disable sleep */ +@@ -285,8 +285,8 @@ static int lm3630a_bank_b_update_status(struct backlight_device *bl) + return 0; + + out_i2c_err: +- dev_err(pchip->dev, "i2c failed to access REG_CTRL\n"); +- return bl->props.brightness; ++ dev_err(pchip->dev, "i2c failed to access (%pe)\n", ERR_PTR(ret)); ++ return ret; + } + + static int lm3630a_bank_b_get_brightness(struct backlight_device *bl) +-- +2.30.2 + diff --git a/queue-5.4/ceph-remove-bogus-checks-and-warn_ons-from-ceph_set_.patch b/queue-5.4/ceph-remove-bogus-checks-and-warn_ons-from-ceph_set_.patch new file mode 100644 index 00000000000..fb08f996485 --- /dev/null +++ b/queue-5.4/ceph-remove-bogus-checks-and-warn_ons-from-ceph_set_.patch @@ -0,0 +1,56 @@ +From ed831243f5da9f67513dd49b71c27638d6d76ac4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 4 May 2021 10:08:30 -0400 +Subject: ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty + +From: Jeff Layton + +[ Upstream commit 22d41cdcd3cfd467a4af074165357fcbea1c37f5 ] + +The checks for page->mapping are odd, as set_page_dirty is an +address_space operation, and I don't see where it would be called on a +non-pagecache page. + +The warning about the page lock also seems bogus. The comment over +set_page_dirty() says that it can be called without the page lock in +some rare cases. I don't think we want to warn if that's the case. + +Reported-by: Matthew Wilcox +Signed-off-by: Jeff Layton +Signed-off-by: Ilya Dryomov +Signed-off-by: Sasha Levin +--- + fs/ceph/addr.c | 10 +--------- + 1 file changed, 1 insertion(+), 9 deletions(-) + +diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c +index a02e845eb0fb..34ab7b892b70 100644 +--- a/fs/ceph/addr.c ++++ b/fs/ceph/addr.c +@@ -76,10 +76,6 @@ static int ceph_set_page_dirty(struct page *page) + struct inode *inode; + struct ceph_inode_info *ci; + struct ceph_snap_context *snapc; +- int ret; +- +- if (unlikely(!mapping)) +- return !TestSetPageDirty(page); + + if (PageDirty(page)) { + dout("%p set_page_dirty %p idx %lu -- already dirty\n", +@@ -125,11 +121,7 @@ static int ceph_set_page_dirty(struct page *page) + page->private = (unsigned long)snapc; + SetPagePrivate(page); + +- ret = __set_page_dirty_nobuffers(page); +- WARN_ON(!PageLocked(page)); +- WARN_ON(!page->mapping); +- +- return ret; ++ return __set_page_dirty_nobuffers(page); + } + + /* +-- +2.30.2 + diff --git a/queue-5.4/dmaengine-fsl-qdma-check-dma_set_mask-return-value.patch b/queue-5.4/dmaengine-fsl-qdma-check-dma_set_mask-return-value.patch new file mode 100644 index 00000000000..268ad269388 --- /dev/null +++ b/queue-5.4/dmaengine-fsl-qdma-check-dma_set_mask-return-value.patch @@ -0,0 +1,41 @@ +From 816f4a23a5b379151b826f60a42450d5a7ce3e83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 16:59:09 +0800 +Subject: dmaengine: fsl-qdma: check dma_set_mask return value + +From: Robin Gong + +[ Upstream commit f0c07993af0acf5545d5c1445798846565f4f147 ] + +For fix below warning reported by static code analysis tool like Coverity +from Synopsys: + +Signed-off-by: Robin Gong +Addresses-Coverity-ID: 12285639 ("Unchecked return value") +Link: https://lore.kernel.org/r/1619427549-20498-1-git-send-email-yibin.gong@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/fsl-qdma.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/fsl-qdma.c b/drivers/dma/fsl-qdma.c +index 95cc0256b387..f5a1ae164193 100644 +--- a/drivers/dma/fsl-qdma.c ++++ b/drivers/dma/fsl-qdma.c +@@ -1184,7 +1184,11 @@ static int fsl_qdma_probe(struct platform_device *pdev) + fsl_qdma->dma_dev.device_synchronize = fsl_qdma_synchronize; + fsl_qdma->dma_dev.device_terminate_all = fsl_qdma_terminate_all; + +- dma_set_mask(&pdev->dev, DMA_BIT_MASK(40)); ++ ret = dma_set_mask(&pdev->dev, DMA_BIT_MASK(40)); ++ if (ret) { ++ dev_err(&pdev->dev, "dma_set_mask failure.\n"); ++ return ret; ++ } + + platform_set_drvdata(pdev, fsl_qdma); + +-- +2.30.2 + diff --git a/queue-5.4/f2fs-add-module_softdep-to-ensure-crc32-is-included-.patch b/queue-5.4/f2fs-add-module_softdep-to-ensure-crc32-is-included-.patch new file mode 100644 index 00000000000..5eecf078760 --- /dev/null +++ b/queue-5.4/f2fs-add-module_softdep-to-ensure-crc32-is-included-.patch @@ -0,0 +1,43 @@ +From bec0dde421bbc13ed78cf610efe2b4aa5b6f1fb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 09:57:54 +0800 +Subject: f2fs: add MODULE_SOFTDEP to ensure crc32 is included in the initramfs + +From: Chao Yu + +[ Upstream commit 0dd571785d61528d62cdd8aa49d76bc6085152fe ] + +As marcosfrm reported in bugzilla: + +https://bugzilla.kernel.org/show_bug.cgi?id=213089 + +Initramfs generators rely on "pre" softdeps (and "depends") to include +additional required modules. + +F2FS does not declare "pre: crc32" softdep. Then every generator (dracut, +mkinitcpio...) has to maintain a hardcoded list for this purpose. + +Hence let's use MODULE_SOFTDEP("pre: crc32") in f2fs code. + +Fixes: 43b6573bac95 ("f2fs: use cryptoapi crc32 functions") +Reported-by: marcosfrm +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/super.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index a9a083232bcf..6d904dc9bd19 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -3804,4 +3804,5 @@ module_exit(exit_f2fs_fs) + MODULE_AUTHOR("Samsung Electronics's Praesto Team"); + MODULE_DESCRIPTION("Flash Friendly File System"); + MODULE_LICENSE("GPL"); ++MODULE_SOFTDEP("pre: crc32"); + +-- +2.30.2 + diff --git a/queue-5.4/firmware-arm_scmi-reset-rx-buffer-to-max-size-during.patch b/queue-5.4/firmware-arm_scmi-reset-rx-buffer-to-max-size-during.patch new file mode 100644 index 00000000000..f2cf573e36d --- /dev/null +++ b/queue-5.4/firmware-arm_scmi-reset-rx-buffer-to-max-size-during.patch @@ -0,0 +1,50 @@ +From 2d3dea42bbbb0bb8599c77c4b70532b80b2a60c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 11:24:17 +0100 +Subject: firmware: arm_scmi: Reset Rx buffer to max size during async commands + +From: Cristian Marussi + +[ Upstream commit 0cb7af474e0dbb2f500c67aa62b6db9fafa74de2 ] + +During an async commands execution the Rx buffer length is at first set +to max_msg_sz when the synchronous part of the command is first sent. +However once the synchronous part completes the transport layer waits +for the delayed response which will be processed using the same xfer +descriptor initially allocated. Since synchronous response received at +the end of the xfer will shrink the Rx buffer length to the effective +payload response length, it needs to be reset again. + +Raise the Rx buffer length again to max_msg_sz before fetching the +delayed response to ensure full response is read correctly from the +shared memory. + +Link: https://lore.kernel.org/r/20210601102421.26581-2-cristian.marussi@arm.com +Fixes: 58ecdf03dbb9 ("firmware: arm_scmi: Add support for asynchronous commands and delayed response") +Signed-off-by: Cristian Marussi +[sudeep.holla: moved reset to scmi_handle_response as it could race with + do_xfer_with_response] +Signed-off-by: Sudeep Holla +Signed-off-by: Sasha Levin +--- + drivers/firmware/arm_scmi/driver.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c +index 11078199abed..7b6903bad408 100644 +--- a/drivers/firmware/arm_scmi/driver.c ++++ b/drivers/firmware/arm_scmi/driver.c +@@ -370,6 +370,10 @@ static void scmi_rx_callback(struct mbox_client *cl, void *m) + + xfer = &minfo->xfer_block[xfer_id]; + ++ /* rx.len could be shrunk in the sync do_xfer, so reset to maxsz */ ++ if (msg_type == MSG_TYPE_DELAYED_RESP) ++ xfer->rx.len = info->desc->max_msg_size; ++ + scmi_dump_header_dbg(dev, &xfer->hdr); + + scmi_fetch_response(xfer, mem); +-- +2.30.2 + diff --git a/queue-5.4/firmware-tegra-fix-error-return-code-in-tegra210_bpm.patch b/queue-5.4/firmware-tegra-fix-error-return-code-in-tegra210_bpm.patch new file mode 100644 index 00000000000..d44dacf77a3 --- /dev/null +++ b/queue-5.4/firmware-tegra-fix-error-return-code-in-tegra210_bpm.patch @@ -0,0 +1,38 @@ +From a8be6d2d80d113cb725c6e8b6b20d0a12ef6ade0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 May 2021 21:26:46 +0800 +Subject: firmware: tegra: Fix error return code in tegra210_bpmp_init() + +From: Zhen Lei + +[ Upstream commit 7fea67710e9f6a111a2c9440576f2396ccd92d57 ] + +When call irq_get_irq_data() to get the IRQ's irq_data failed, an +appropriate error code -ENOENT should be returned. However, we directly +return 'err', which records the IRQ number instead of the error code. + +Fixes: 139251fc2208 ("firmware: tegra: add bpmp driver for Tegra210") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/firmware/tegra/bpmp-tegra210.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/tegra/bpmp-tegra210.c b/drivers/firmware/tegra/bpmp-tegra210.c +index ae15940a078e..c32754055c60 100644 +--- a/drivers/firmware/tegra/bpmp-tegra210.c ++++ b/drivers/firmware/tegra/bpmp-tegra210.c +@@ -210,7 +210,7 @@ static int tegra210_bpmp_init(struct tegra_bpmp *bpmp) + priv->tx_irq_data = irq_get_irq_data(err); + if (!priv->tx_irq_data) { + dev_err(&pdev->dev, "failed to get IRQ data for TX IRQ\n"); +- return err; ++ return -ENOENT; + } + + err = platform_get_irq_byname(pdev, "rx"); +-- +2.30.2 + diff --git a/queue-5.4/firmware-turris-mox-rwtm-fail-probing-when-firmware-.patch b/queue-5.4/firmware-turris-mox-rwtm-fail-probing-when-firmware-.patch new file mode 100644 index 00000000000..5b727e66f0c --- /dev/null +++ b/queue-5.4/firmware-turris-mox-rwtm-fail-probing-when-firmware-.patch @@ -0,0 +1,80 @@ +From 62f802ae753963899c39e3b4d7bacbed27201c15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 13:35:19 +0200 +Subject: firmware: turris-mox-rwtm: fail probing when firmware does not + support hwrng +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 2eab59cf0d2036a5a9e264f719b71c21ccf679c2 ] + +When Marvell's rWTM firmware, which does not support the GET_RANDOM +command, is used, kernel prints an error message + hwrng: no data available +every 10 seconds. + +Fail probing of this driver if the rWTM firmware does not support the +GET_RANDOM command. + +Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") +Signed-off-by: Pali Rohár +Signed-off-by: Marek Behún +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/firmware/turris-mox-rwtm.c | 28 ++++++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/drivers/firmware/turris-mox-rwtm.c b/drivers/firmware/turris-mox-rwtm.c +index e22ad73d4c86..9a6cf5af27a3 100644 +--- a/drivers/firmware/turris-mox-rwtm.c ++++ b/drivers/firmware/turris-mox-rwtm.c +@@ -247,6 +247,27 @@ static int mox_get_board_info(struct mox_rwtm *rwtm) + return 0; + } + ++static int check_get_random_support(struct mox_rwtm *rwtm) ++{ ++ struct armada_37xx_rwtm_tx_msg msg; ++ int ret; ++ ++ msg.command = MBOX_CMD_GET_RANDOM; ++ msg.args[0] = 1; ++ msg.args[1] = rwtm->buf_phys; ++ msg.args[2] = 4; ++ ++ ret = mbox_send_message(rwtm->mbox, &msg); ++ if (ret < 0) ++ return ret; ++ ++ ret = wait_for_completion_timeout(&rwtm->cmd_done, HZ / 2); ++ if (ret < 0) ++ return ret; ++ ++ return mox_get_status(MBOX_CMD_GET_RANDOM, rwtm->reply.retval); ++} ++ + static int mox_hwrng_read(struct hwrng *rng, void *data, size_t max, bool wait) + { + struct mox_rwtm *rwtm = (struct mox_rwtm *) rng->priv; +@@ -338,6 +359,13 @@ static int turris_mox_rwtm_probe(struct platform_device *pdev) + if (ret < 0) + dev_warn(dev, "Cannot read board information: %i\n", ret); + ++ ret = check_get_random_support(rwtm); ++ if (ret < 0) { ++ dev_notice(dev, ++ "Firmware does not support the GET_RANDOM command\n"); ++ goto free_channel; ++ } ++ + rwtm->hwrng.name = DRIVER_NAME "_hwrng"; + rwtm->hwrng.read = mox_hwrng_read; + rwtm->hwrng.priv = (unsigned long) rwtm; +-- +2.30.2 + diff --git a/queue-5.4/firmware-turris-mox-rwtm-fix-reply-status-decoding-f.patch b/queue-5.4/firmware-turris-mox-rwtm-fix-reply-status-decoding-f.patch new file mode 100644 index 00000000000..c4cd6c02993 --- /dev/null +++ b/queue-5.4/firmware-turris-mox-rwtm-fix-reply-status-decoding-f.patch @@ -0,0 +1,53 @@ +From 2c3b01db376dcc9d1d565265b2063350eff59c91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 13:35:17 +0200 +Subject: firmware: turris-mox-rwtm: fix reply status decoding function +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit e34e60253d9272311831daed8a2d967cf80ca3dc ] + +The status decoding function mox_get_status() currently contains an +incorrect check: if the error status is not MBOX_STS_SUCCESS, it always +returns -EIO, so the comparison to MBOX_STS_FAIL is never executed and +we don't get the actual error code sent by the firmware. + +Fix this. + +Signed-off-by: Marek Behún +Reviewed-by: Pali Rohár +Reviewed-by: Andrew Lunn +Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/firmware/turris-mox-rwtm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/firmware/turris-mox-rwtm.c b/drivers/firmware/turris-mox-rwtm.c +index 72be58960e54..ecc9e2de6492 100644 +--- a/drivers/firmware/turris-mox-rwtm.c ++++ b/drivers/firmware/turris-mox-rwtm.c +@@ -134,11 +134,14 @@ MOX_ATTR_RO(pubkey, "%s\n", pubkey); + + static int mox_get_status(enum mbox_cmd cmd, u32 retval) + { +- if (MBOX_STS_CMD(retval) != cmd || +- MBOX_STS_ERROR(retval) != MBOX_STS_SUCCESS) ++ if (MBOX_STS_CMD(retval) != cmd) + return -EIO; + else if (MBOX_STS_ERROR(retval) == MBOX_STS_FAIL) + return -(int)MBOX_STS_VALUE(retval); ++ else if (MBOX_STS_ERROR(retval) == MBOX_STS_BADCMD) ++ return -ENOSYS; ++ else if (MBOX_STS_ERROR(retval) != MBOX_STS_SUCCESS) ++ return -EIO; + else + return MBOX_STS_VALUE(retval); + } +-- +2.30.2 + diff --git a/queue-5.4/firmware-turris-mox-rwtm-report-failures-better.patch b/queue-5.4/firmware-turris-mox-rwtm-report-failures-better.patch new file mode 100644 index 00000000000..c825833731d --- /dev/null +++ b/queue-5.4/firmware-turris-mox-rwtm-report-failures-better.patch @@ -0,0 +1,70 @@ +From 40f48d2911b2cffd98c3e52243dd2b0eeb888532 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 May 2021 13:35:18 +0200 +Subject: firmware: turris-mox-rwtm: report failures better +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 72f99888944c44de1c899bbe44db1e53bdc9d994 ] + +Report a notice level message if a command is not supported by the rWTM +firmware. + +This should not be an error, merely a notice, because the firmware can +be used on boards that do not have manufacturing information burned. + +Fixes: 389711b37493 ("firmware: Add Turris Mox rWTM firmware driver") +Signed-off-by: Marek Behún +Reviewed-by: Pali Rohár +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + drivers/firmware/turris-mox-rwtm.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/firmware/turris-mox-rwtm.c b/drivers/firmware/turris-mox-rwtm.c +index ecc9e2de6492..e22ad73d4c86 100644 +--- a/drivers/firmware/turris-mox-rwtm.c ++++ b/drivers/firmware/turris-mox-rwtm.c +@@ -191,11 +191,14 @@ static int mox_get_board_info(struct mox_rwtm *rwtm) + return ret; + + ret = mox_get_status(MBOX_CMD_BOARD_INFO, reply->retval); +- if (ret < 0 && ret != -ENODATA) { +- return ret; +- } else if (ret == -ENODATA) { ++ if (ret == -ENODATA) { + dev_warn(rwtm->dev, + "Board does not have manufacturing information burned!\n"); ++ } else if (ret == -ENOSYS) { ++ dev_notice(rwtm->dev, ++ "Firmware does not support the BOARD_INFO command\n"); ++ } else if (ret < 0) { ++ return ret; + } else { + rwtm->serial_number = reply->status[1]; + rwtm->serial_number <<= 32; +@@ -224,10 +227,13 @@ static int mox_get_board_info(struct mox_rwtm *rwtm) + return ret; + + ret = mox_get_status(MBOX_CMD_ECDSA_PUB_KEY, reply->retval); +- if (ret < 0 && ret != -ENODATA) { +- return ret; +- } else if (ret == -ENODATA) { ++ if (ret == -ENODATA) { + dev_warn(rwtm->dev, "Board has no public key burned!\n"); ++ } else if (ret == -ENOSYS) { ++ dev_notice(rwtm->dev, ++ "Firmware does not support the ECDSA_PUB_KEY command\n"); ++ } else if (ret < 0) { ++ return ret; + } else { + u32 *s = reply->status; + +-- +2.30.2 + diff --git a/queue-5.4/fs-jfs-fix-missing-error-code-in-lmloginit.patch b/queue-5.4/fs-jfs-fix-missing-error-code-in-lmloginit.patch new file mode 100644 index 00000000000..082e9b06f10 --- /dev/null +++ b/queue-5.4/fs-jfs-fix-missing-error-code-in-lmloginit.patch @@ -0,0 +1,39 @@ +From 3ba58b0ec009fa5965014b793485cce6a963e423 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Jun 2021 19:07:10 +0800 +Subject: fs/jfs: Fix missing error code in lmLogInit() + +From: Jiapeng Chong + +[ Upstream commit 492109333c29e1bb16d8732e1d597b02e8e0bf2e ] + +The error code is missing in this code scenario, add the error code +'-EINVAL' to the return value 'rc. + +Eliminate the follow smatch warning: + +fs/jfs/jfs_logmgr.c:1327 lmLogInit() warn: missing error code 'rc'. + +Reported-by: Abaci Robot +Signed-off-by: Jiapeng Chong +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_logmgr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c +index 9330eff210e0..78fd136ac13b 100644 +--- a/fs/jfs/jfs_logmgr.c ++++ b/fs/jfs/jfs_logmgr.c +@@ -1324,6 +1324,7 @@ int lmLogInit(struct jfs_log * log) + } else { + if (!uuid_equal(&logsuper->uuid, &log->uuid)) { + jfs_warn("wrong uuid on JFS log device"); ++ rc = -EINVAL; + goto errout20; + } + log->size = le32_to_cpu(logsuper->size); +-- +2.30.2 + diff --git a/queue-5.4/gpio-pca953x-add-support-for-the-on-semi-pca9655.patch b/queue-5.4/gpio-pca953x-add-support-for-the-on-semi-pca9655.patch new file mode 100644 index 00000000000..63475ded225 --- /dev/null +++ b/queue-5.4/gpio-pca953x-add-support-for-the-on-semi-pca9655.patch @@ -0,0 +1,35 @@ +From 74050bfd76af57b463d244edc2336452b2c37c5c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Jun 2021 23:03:26 +0100 +Subject: gpio: pca953x: Add support for the On Semi pca9655 + +From: Peter Robinson + +[ Upstream commit 6d49b3a0f351925b5ea5047166c112b7590b918a ] + +The On Semi pca9655 is a 16 bit variant of the On Semi pca9654 GPIO +expander, with 16 GPIOs and interrupt functionality. + +Signed-off-by: Peter Robinson +[Bartosz: fixed indentation as noted by Andy] +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-pca953x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpio/gpio-pca953x.c b/drivers/gpio/gpio-pca953x.c +index 9a24dce3c262..d9193ffa17a1 100644 +--- a/drivers/gpio/gpio-pca953x.c ++++ b/drivers/gpio/gpio-pca953x.c +@@ -1272,6 +1272,7 @@ static const struct of_device_id pca953x_dt_ids[] = { + + { .compatible = "onnn,cat9554", .data = OF_953X( 8, PCA_INT), }, + { .compatible = "onnn,pca9654", .data = OF_953X( 8, PCA_INT), }, ++ { .compatible = "onnn,pca9655", .data = OF_953X(16, PCA_INT), }, + + { .compatible = "exar,xra1202", .data = OF_953X( 8, 0), }, + { } +-- +2.30.2 + diff --git a/queue-5.4/gpio-zynq-check-return-value-of-pm_runtime_get_sync.patch b/queue-5.4/gpio-zynq-check-return-value-of-pm_runtime_get_sync.patch new file mode 100644 index 00000000000..4aec11e9879 --- /dev/null +++ b/queue-5.4/gpio-zynq-check-return-value-of-pm_runtime_get_sync.patch @@ -0,0 +1,40 @@ +From b8daf347be2a3ebe0bca2b5745eb8775846aecb4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Apr 2021 19:38:05 +0530 +Subject: gpio: zynq: Check return value of pm_runtime_get_sync + +From: Srinivas Neeli + +[ Upstream commit a51b2fb94b04ab71e53a71b9fad03fa826941254 ] + +Return value of "pm_runtime_get_sync" API was neither captured nor checked. +Fixed it by capturing the return value and then checking for any warning. + +Addresses-Coverity: "check_return" +Signed-off-by: Srinivas Neeli +Signed-off-by: Bartosz Golaszewski +Signed-off-by: Sasha Levin +--- + drivers/gpio/gpio-zynq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpio/gpio-zynq.c b/drivers/gpio/gpio-zynq.c +index 88b04d8a7fa7..25a42605aa81 100644 +--- a/drivers/gpio/gpio-zynq.c ++++ b/drivers/gpio/gpio-zynq.c +@@ -938,8 +938,11 @@ err_pm_dis: + static int zynq_gpio_remove(struct platform_device *pdev) + { + struct zynq_gpio *gpio = platform_get_drvdata(pdev); ++ int ret; + +- pm_runtime_get_sync(&pdev->dev); ++ ret = pm_runtime_get_sync(&pdev->dev); ++ if (ret < 0) ++ dev_warn(&pdev->dev, "pm_runtime_get_sync() Failed\n"); + gpiochip_remove(&gpio->chip); + clk_disable_unprepare(gpio->clk); + device_set_wakeup_capable(&pdev->dev, 0); +-- +2.30.2 + diff --git a/queue-5.4/hexagon-use-common-discards-macro.patch b/queue-5.4/hexagon-use-common-discards-macro.patch new file mode 100644 index 00000000000..2329da69352 --- /dev/null +++ b/queue-5.4/hexagon-use-common-discards-macro.patch @@ -0,0 +1,62 @@ +From 70595de430e41e87ef0a28e43c12590acec5d363 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 7 Jul 2021 18:07:41 -0700 +Subject: hexagon: use common DISCARDS macro + +From: Nathan Chancellor + +[ Upstream commit 681ba73c72302214686401e707e2087ed11a6556 ] + +ld.lld warns that the '.modinfo' section is not currently handled: + +ld.lld: warning: kernel/built-in.a(workqueue.o):(.modinfo) is being placed in '.modinfo' +ld.lld: warning: kernel/built-in.a(printk/printk.o):(.modinfo) is being placed in '.modinfo' +ld.lld: warning: kernel/built-in.a(irq/spurious.o):(.modinfo) is being placed in '.modinfo' +ld.lld: warning: kernel/built-in.a(rcu/update.o):(.modinfo) is being placed in '.modinfo' + +The '.modinfo' section was added in commit 898490c010b5 ("moduleparam: +Save information about built-in modules in separate file") to the DISCARDS +macro but Hexagon has never used that macro. The unification of DISCARDS +happened in commit 023bf6f1b8bf ("linker script: unify usage of discard +definition") in 2009, prior to Hexagon being added in 2011. + +Switch Hexagon over to the DISCARDS macro so that anything that is +expected to be discarded gets discarded. + +Link: https://lkml.kernel.org/r/20210521011239.1332345-3-nathan@kernel.org +Fixes: e95bf452a9e2 ("Hexagon: Add configuration and makefiles for the Hexagon architecture.") +Signed-off-by: Nathan Chancellor +Reviewed-by: Nick Desaulniers +Acked-by: Brian Cain +Cc: David Rientjes +Cc: Oliver Glitta +Cc: Vlastimil Babka +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/hexagon/kernel/vmlinux.lds.S | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/arch/hexagon/kernel/vmlinux.lds.S b/arch/hexagon/kernel/vmlinux.lds.S +index 78f2418e97c8..3c6b7abf0080 100644 +--- a/arch/hexagon/kernel/vmlinux.lds.S ++++ b/arch/hexagon/kernel/vmlinux.lds.S +@@ -60,13 +60,8 @@ SECTIONS + + _end = .; + +- /DISCARD/ : { +- EXIT_TEXT +- EXIT_DATA +- EXIT_CALL +- } +- + STABS_DEBUG + DWARF_DEBUG + ++ DISCARDS + } +-- +2.30.2 + diff --git a/queue-5.4/i2c-core-disable-client-irq-on-reboot-shutdown.patch b/queue-5.4/i2c-core-disable-client-irq-on-reboot-shutdown.patch new file mode 100644 index 00000000000..58295701a22 --- /dev/null +++ b/queue-5.4/i2c-core-disable-client-irq-on-reboot-shutdown.patch @@ -0,0 +1,59 @@ +From 017e796ed667032af96ae2eb8d2aed115702ad2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Jun 2021 16:27:44 -0700 +Subject: i2c: core: Disable client irq on reboot/shutdown + +From: Dmitry Torokhov + +[ Upstream commit b64210f2f7c11c757432ba3701d88241b2b98fb1 ] + +If an i2c client receives an interrupt during reboot or shutdown it may +be too late to service it by making an i2c transaction on the bus +because the i2c controller has already been shutdown. This can lead to +system hangs if the i2c controller tries to make a transfer that is +doomed to fail because the access to the i2c pins is already shut down, +or an iommu translation has been torn down so i2c controller register +access doesn't work. + +Let's simply disable the irq if there isn't a shutdown callback for an +i2c client when there is an irq associated with the device. This will +make sure that irqs don't come in later than the time that we can handle +it. We don't do this if the i2c client device already has a shutdown +callback because presumably they're doing the right thing and quieting +the device so irqs don't come in after the shutdown callback returns. + +Reported-by: kernel test robot +[swboyd@chromium.org: Dropped newline, added commit text, added +interrupt.h for robot build error] +Signed-off-by: Stephen Boyd +Signed-off-by: Dmitry Torokhov +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/i2c-core-base.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 840f59650c7c..1b93fae58ec7 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -459,6 +460,8 @@ static void i2c_device_shutdown(struct device *dev) + driver = to_i2c_driver(dev->driver); + if (driver->shutdown) + driver->shutdown(client); ++ else if (client->irq > 0) ++ disable_irq(client->irq); + } + + static void i2c_client_dev_release(struct device *dev) +-- +2.30.2 + diff --git a/queue-5.4/iio-gyro-fxa21002c-balance-runtime-pm-use-pm_runtime.patch b/queue-5.4/iio-gyro-fxa21002c-balance-runtime-pm-use-pm_runtime.patch new file mode 100644 index 00000000000..4b99e70777d --- /dev/null +++ b/queue-5.4/iio-gyro-fxa21002c-balance-runtime-pm-use-pm_runtime.patch @@ -0,0 +1,71 @@ +From 7407f0c141f8038dc34a422d7639757b8628cbbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 May 2021 12:33:27 +0100 +Subject: iio: gyro: fxa21002c: Balance runtime pm + use + pm_runtime_resume_and_get(). + +From: Jonathan Cameron + +[ Upstream commit 41120ebbb1eb5e9dec93320e259d5b2c93226073 ] + +In both the probe() error path and remove() pm_runtime_put_noidle() +is called which will decrement the runtime pm reference count. +However, there is no matching function to have raised the reference count. +Not this isn't a fix as the runtime pm core will stop the reference count +going negative anyway. + +An alternative would have been to raise the count in these paths, but +it is not clear why that would be necessary. + +Whilst we are here replace some boilerplate with pm_runtime_resume_and_get() +Found using coccicheck script under review at: +https://lore.kernel.org/lkml/20210427141946.2478411-1-Julia.Lawall@inria.fr/ + +Signed-off-by: Jonathan Cameron +Reviewed-by: Rui Miguel Silva +Reviewed-by: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/20210509113354.660190-2-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/gyro/fxas21002c_core.c | 11 +---------- + 1 file changed, 1 insertion(+), 10 deletions(-) + +diff --git a/drivers/iio/gyro/fxas21002c_core.c b/drivers/iio/gyro/fxas21002c_core.c +index 958cf8b6002c..45e2b5b33072 100644 +--- a/drivers/iio/gyro/fxas21002c_core.c ++++ b/drivers/iio/gyro/fxas21002c_core.c +@@ -300,14 +300,7 @@ out_unlock: + + static int fxas21002c_pm_get(struct fxas21002c_data *data) + { +- struct device *dev = regmap_get_device(data->regmap); +- int ret; +- +- ret = pm_runtime_get_sync(dev); +- if (ret < 0) +- pm_runtime_put_noidle(dev); +- +- return ret; ++ return pm_runtime_resume_and_get(regmap_get_device(data->regmap)); + } + + static int fxas21002c_pm_put(struct fxas21002c_data *data) +@@ -940,7 +933,6 @@ int fxas21002c_core_probe(struct device *dev, struct regmap *regmap, int irq, + pm_disable: + pm_runtime_disable(dev); + pm_runtime_set_suspended(dev); +- pm_runtime_put_noidle(dev); + + return ret; + } +@@ -954,7 +946,6 @@ void fxas21002c_core_remove(struct device *dev) + + pm_runtime_disable(dev); + pm_runtime_set_suspended(dev); +- pm_runtime_put_noidle(dev); + } + EXPORT_SYMBOL_GPL(fxas21002c_core_remove); + +-- +2.30.2 + diff --git a/queue-5.4/iio-magn-bmc150-balance-runtime-pm-use-pm_runtime_re.patch b/queue-5.4/iio-magn-bmc150-balance-runtime-pm-use-pm_runtime_re.patch new file mode 100644 index 00000000000..e05bd7cf11f --- /dev/null +++ b/queue-5.4/iio-magn-bmc150-balance-runtime-pm-use-pm_runtime_re.patch @@ -0,0 +1,78 @@ +From 115660d0ba12b3b72e0f40b60bb4d87be7a972ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 May 2021 12:33:37 +0100 +Subject: iio: magn: bmc150: Balance runtime pm + use + pm_runtime_resume_and_get() + +From: Jonathan Cameron + +[ Upstream commit 264da512431495e542fcaf56ffe75e7df0e7db74 ] + +probe() error paths after runtime pm is enabled, should disable it. +remove() should not call pm_runtime_put_noidle() as there is no +matching get() to have raised the reference count. This case +has no affect a the runtime pm core protects against going negative. + +Whilst here use pm_runtime_resume_and_get() to tidy things up a little. +coccicheck script didn't get this one due to complex code structure so +found by inspection. + +Signed-off-by: Jonathan Cameron +Cc: Linus Walleij +Reviewed-by: Mauro Carvalho Chehab +Link: https://lore.kernel.org/r/20210509113354.660190-12-jic23@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/iio/magnetometer/bmc150_magn.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/iio/magnetometer/bmc150_magn.c b/drivers/iio/magnetometer/bmc150_magn.c +index 48685d785c1b..087dc16c2185 100644 +--- a/drivers/iio/magnetometer/bmc150_magn.c ++++ b/drivers/iio/magnetometer/bmc150_magn.c +@@ -263,7 +263,7 @@ static int bmc150_magn_set_power_state(struct bmc150_magn_data *data, bool on) + int ret; + + if (on) { +- ret = pm_runtime_get_sync(data->dev); ++ ret = pm_runtime_resume_and_get(data->dev); + } else { + pm_runtime_mark_last_busy(data->dev); + ret = pm_runtime_put_autosuspend(data->dev); +@@ -272,9 +272,6 @@ static int bmc150_magn_set_power_state(struct bmc150_magn_data *data, bool on) + if (ret < 0) { + dev_err(data->dev, + "failed to change power state to %d\n", on); +- if (on) +- pm_runtime_put_noidle(data->dev); +- + return ret; + } + #endif +@@ -947,12 +944,14 @@ int bmc150_magn_probe(struct device *dev, struct regmap *regmap, + ret = iio_device_register(indio_dev); + if (ret < 0) { + dev_err(dev, "unable to register iio device\n"); +- goto err_buffer_cleanup; ++ goto err_disable_runtime_pm; + } + + dev_dbg(dev, "Registered device %s\n", name); + return 0; + ++err_disable_runtime_pm: ++ pm_runtime_disable(dev); + err_buffer_cleanup: + iio_triggered_buffer_cleanup(indio_dev); + err_free_irq: +@@ -976,7 +975,6 @@ int bmc150_magn_remove(struct device *dev) + + pm_runtime_disable(dev); + pm_runtime_set_suspended(dev); +- pm_runtime_put_noidle(dev); + + iio_triggered_buffer_cleanup(indio_dev); + +-- +2.30.2 + diff --git a/queue-5.4/input-hideep-fix-the-uninitialized-use-in-hideep_nvm.patch b/queue-5.4/input-hideep-fix-the-uninitialized-use-in-hideep_nvm.patch new file mode 100644 index 00000000000..976714af260 --- /dev/null +++ b/queue-5.4/input-hideep-fix-the-uninitialized-use-in-hideep_nvm.patch @@ -0,0 +1,67 @@ +From b7bf9bb5b5c7952677e219da06eb7496b076d3c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Jun 2021 22:26:50 -0700 +Subject: Input: hideep - fix the uninitialized use in hideep_nvm_unlock() + +From: Yizhuo Zhai + +[ Upstream commit cac7100d4c51c04979dacdfe6c9a5e400d3f0a27 ] + +Inside function hideep_nvm_unlock(), variable "unmask_code" could +be uninitialized if hideep_pgm_r_reg() returns error, however, it +is used in the later if statement after an "and" operation, which +is potentially unsafe. + +Signed-off-by: Yizhuo +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/hideep.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/input/touchscreen/hideep.c b/drivers/input/touchscreen/hideep.c +index ddad4a82a5e5..e9547ee29756 100644 +--- a/drivers/input/touchscreen/hideep.c ++++ b/drivers/input/touchscreen/hideep.c +@@ -361,13 +361,16 @@ static int hideep_enter_pgm(struct hideep_ts *ts) + return -EIO; + } + +-static void hideep_nvm_unlock(struct hideep_ts *ts) ++static int hideep_nvm_unlock(struct hideep_ts *ts) + { + u32 unmask_code; ++ int error; + + hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_SFR_RPAGE); +- hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code); ++ error = hideep_pgm_r_reg(ts, 0x0000000C, &unmask_code); + hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE); ++ if (error) ++ return error; + + /* make it unprotected code */ + unmask_code &= ~HIDEEP_PROT_MODE; +@@ -384,6 +387,8 @@ static void hideep_nvm_unlock(struct hideep_ts *ts) + NVM_W_SFR(HIDEEP_NVM_MASK_OFS, ts->nvm_mask); + SET_FLASH_HWCONTROL(); + hideep_pgm_w_reg(ts, HIDEEP_FLASH_CFG, HIDEEP_NVM_DEFAULT_PAGE); ++ ++ return 0; + } + + static int hideep_check_status(struct hideep_ts *ts) +@@ -462,7 +467,9 @@ static int hideep_program_nvm(struct hideep_ts *ts, + u32 addr = 0; + int error; + +- hideep_nvm_unlock(ts); ++ error = hideep_nvm_unlock(ts); ++ if (error) ++ return error; + + while (ucode_len > 0) { + xfer_len = min_t(size_t, ucode_len, HIDEEP_NVM_PAGE_SIZE); +-- +2.30.2 + diff --git a/queue-5.4/intel_th-wait-until-port-is-in-reset-before-programm.patch b/queue-5.4/intel_th-wait-until-port-is-in-reset-before-programm.patch new file mode 100644 index 00000000000..8eab4927c4f --- /dev/null +++ b/queue-5.4/intel_th-wait-until-port-is-in-reset-before-programm.patch @@ -0,0 +1,119 @@ +From ae164d86aebf34cbe7201994d3198e8cdb5f11ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Jun 2021 18:12:46 +0300 +Subject: intel_th: Wait until port is in reset before programming it + +From: Alexander Shishkin + +[ Upstream commit ab1afed701d2db7eb35c1a2526a29067a38e93d1 ] + +Some devices don't drain their pipelines if we don't make sure that +the corresponding output port is in reset before programming it for +a new trace capture, resulting in bits of old trace appearing in the +new trace capture. Fix that by explicitly making sure the reset is +asserted before programming new trace capture. + +Reviewed-by: Andy Shevchenko +Signed-off-by: Alexander Shishkin +Link: https://lore.kernel.org/r/20210621151246.31891-5-alexander.shishkin@linux.intel.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/hwtracing/intel_th/core.c | 17 +++++++++++++++++ + drivers/hwtracing/intel_th/gth.c | 16 ++++++++++++++++ + drivers/hwtracing/intel_th/intel_th.h | 3 +++ + 3 files changed, 36 insertions(+) + +diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c +index c9ac3dc65113..9cb8c7d13d46 100644 +--- a/drivers/hwtracing/intel_th/core.c ++++ b/drivers/hwtracing/intel_th/core.c +@@ -215,6 +215,22 @@ static ssize_t port_show(struct device *dev, struct device_attribute *attr, + + static DEVICE_ATTR_RO(port); + ++static void intel_th_trace_prepare(struct intel_th_device *thdev) ++{ ++ struct intel_th_device *hub = to_intel_th_hub(thdev); ++ struct intel_th_driver *hubdrv = to_intel_th_driver(hub->dev.driver); ++ ++ if (hub->type != INTEL_TH_SWITCH) ++ return; ++ ++ if (thdev->type != INTEL_TH_OUTPUT) ++ return; ++ ++ pm_runtime_get_sync(&thdev->dev); ++ hubdrv->prepare(hub, &thdev->output); ++ pm_runtime_put(&thdev->dev); ++} ++ + static int intel_th_output_activate(struct intel_th_device *thdev) + { + struct intel_th_driver *thdrv = +@@ -235,6 +251,7 @@ static int intel_th_output_activate(struct intel_th_device *thdev) + if (ret) + goto fail_put; + ++ intel_th_trace_prepare(thdev); + if (thdrv->activate) + ret = thdrv->activate(thdev); + else +diff --git a/drivers/hwtracing/intel_th/gth.c b/drivers/hwtracing/intel_th/gth.c +index 28509b02a0b5..b3308934a687 100644 +--- a/drivers/hwtracing/intel_th/gth.c ++++ b/drivers/hwtracing/intel_th/gth.c +@@ -564,6 +564,21 @@ static void gth_tscu_resync(struct gth_device *gth) + iowrite32(reg, gth->base + REG_TSCU_TSUCTRL); + } + ++static void intel_th_gth_prepare(struct intel_th_device *thdev, ++ struct intel_th_output *output) ++{ ++ struct gth_device *gth = dev_get_drvdata(&thdev->dev); ++ int count; ++ ++ /* ++ * Wait until the output port is in reset before we start ++ * programming it. ++ */ ++ for (count = GTH_PLE_WAITLOOP_DEPTH; ++ count && !(gth_output_get(gth, output->port) & BIT(5)); count--) ++ cpu_relax(); ++} ++ + /** + * intel_th_gth_enable() - enable tracing to an output device + * @thdev: GTH device +@@ -815,6 +830,7 @@ static struct intel_th_driver intel_th_gth_driver = { + .assign = intel_th_gth_assign, + .unassign = intel_th_gth_unassign, + .set_output = intel_th_gth_set_output, ++ .prepare = intel_th_gth_prepare, + .enable = intel_th_gth_enable, + .trig_switch = intel_th_gth_switch, + .disable = intel_th_gth_disable, +diff --git a/drivers/hwtracing/intel_th/intel_th.h b/drivers/hwtracing/intel_th/intel_th.h +index 5fe694708b7a..595615b79108 100644 +--- a/drivers/hwtracing/intel_th/intel_th.h ++++ b/drivers/hwtracing/intel_th/intel_th.h +@@ -143,6 +143,7 @@ intel_th_output_assigned(struct intel_th_device *thdev) + * @remove: remove method + * @assign: match a given output type device against available outputs + * @unassign: deassociate an output type device from an output port ++ * @prepare: prepare output port for tracing + * @enable: enable tracing for a given output device + * @disable: disable tracing for a given output device + * @irq: interrupt callback +@@ -164,6 +165,8 @@ struct intel_th_driver { + struct intel_th_device *othdev); + void (*unassign)(struct intel_th_device *thdev, + struct intel_th_device *othdev); ++ void (*prepare)(struct intel_th_device *thdev, ++ struct intel_th_output *output); + void (*enable)(struct intel_th_device *thdev, + struct intel_th_output *output); + void (*trig_switch)(struct intel_th_device *thdev, +-- +2.30.2 + diff --git a/queue-5.4/iommu-arm-smmu-fix-arm_smmu_device-refcount-leak-in-.patch b/queue-5.4/iommu-arm-smmu-fix-arm_smmu_device-refcount-leak-in-.patch new file mode 100644 index 00000000000..98e6bf0460a --- /dev/null +++ b/queue-5.4/iommu-arm-smmu-fix-arm_smmu_device-refcount-leak-in-.patch @@ -0,0 +1,68 @@ +From 5644bab403344336fd9e7cdb61fab615950680c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 10:49:20 +0800 +Subject: iommu/arm-smmu: Fix arm_smmu_device refcount leak in address + translation + +From: Xiyu Yang + +[ Upstream commit 7c8f176d6a3fa18aa0f8875da6f7c672ed2a8554 ] + +The reference counting issue happens in several exception handling paths +of arm_smmu_iova_to_phys_hard(). When those error scenarios occur, the +function forgets to decrease the refcount of "smmu" increased by +arm_smmu_rpm_get(), causing a refcount leak. + +Fix this issue by jumping to "out" label when those error scenarios +occur. + +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Reviewed-by: Rob Clark +Link: https://lore.kernel.org/r/1623293391-17261-1-git-send-email-xiyuyang19@fudan.edu.cn +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm-smmu.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c +index abf4cf285548..2185ea5191c1 100644 +--- a/drivers/iommu/arm-smmu.c ++++ b/drivers/iommu/arm-smmu.c +@@ -1231,6 +1231,7 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain, + u64 phys; + unsigned long va, flags; + int ret, idx = cfg->cbndx; ++ phys_addr_t addr = 0; + + ret = arm_smmu_rpm_get(smmu); + if (ret < 0) +@@ -1249,6 +1250,7 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain, + dev_err(dev, + "iova to phys timed out on %pad. Falling back to software table walk.\n", + &iova); ++ arm_smmu_rpm_put(smmu); + return ops->iova_to_phys(ops, iova); + } + +@@ -1257,12 +1259,14 @@ static phys_addr_t arm_smmu_iova_to_phys_hard(struct iommu_domain *domain, + if (phys & CB_PAR_F) { + dev_err(dev, "translation fault!\n"); + dev_err(dev, "PAR = 0x%llx\n", phys); +- return 0; ++ goto out; + } + ++ addr = (phys & GENMASK_ULL(39, 12)) | (iova & 0xfff); ++out: + arm_smmu_rpm_put(smmu); + +- return (phys & GENMASK_ULL(39, 12)) | (iova & 0xfff); ++ return addr; + } + + static phys_addr_t arm_smmu_iova_to_phys(struct iommu_domain *domain, +-- +2.30.2 + diff --git a/queue-5.4/iommu-arm-smmu-fix-arm_smmu_device-refcount-leak-whe.patch b/queue-5.4/iommu-arm-smmu-fix-arm_smmu_device-refcount-leak-whe.patch new file mode 100644 index 00000000000..186c774c68a --- /dev/null +++ b/queue-5.4/iommu-arm-smmu-fix-arm_smmu_device-refcount-leak-whe.patch @@ -0,0 +1,47 @@ +From 53822b940bb18d22fefcdd136ed0031acf15f36b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 10:54:29 +0800 +Subject: iommu/arm-smmu: Fix arm_smmu_device refcount leak when + arm_smmu_rpm_get fails + +From: Xiyu Yang + +[ Upstream commit 1adf30f198c26539a62d761e45af72cde570413d ] + +arm_smmu_rpm_get() invokes pm_runtime_get_sync(), which increases the +refcount of the "smmu" even though the return value is less than 0. + +The reference counting issue happens in some error handling paths of +arm_smmu_rpm_get() in its caller functions. When arm_smmu_rpm_get() +fails, the caller functions forget to decrease the refcount of "smmu" +increased by arm_smmu_rpm_get(), causing a refcount leak. + +Fix this issue by calling pm_runtime_resume_and_get() instead of +pm_runtime_get_sync() in arm_smmu_rpm_get(), which can keep the refcount +balanced in case of failure. + +Signed-off-by: Xiyu Yang +Signed-off-by: Xin Tan +Link: https://lore.kernel.org/r/1623293672-17954-1-git-send-email-xiyuyang19@fudan.edu.cn +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + drivers/iommu/arm-smmu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/arm-smmu.c b/drivers/iommu/arm-smmu.c +index 7c503a6bc585..abf4cf285548 100644 +--- a/drivers/iommu/arm-smmu.c ++++ b/drivers/iommu/arm-smmu.c +@@ -114,7 +114,7 @@ static bool using_legacy_binding, using_generic_binding; + static inline int arm_smmu_rpm_get(struct arm_smmu_device *smmu) + { + if (pm_runtime_enabled(smmu->dev)) +- return pm_runtime_get_sync(smmu->dev); ++ return pm_runtime_resume_and_get(smmu->dev); + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.4/lib-decompress_unlz4.c-correctly-handle-zero-padding.patch b/queue-5.4/lib-decompress_unlz4.c-correctly-handle-zero-padding.patch new file mode 100644 index 00000000000..827ea16215b --- /dev/null +++ b/queue-5.4/lib-decompress_unlz4.c-correctly-handle-zero-padding.patch @@ -0,0 +1,99 @@ +From a6dc922a2baf3dfd87703f440df543e28b57fa0a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Jun 2021 18:56:16 -0700 +Subject: lib/decompress_unlz4.c: correctly handle zero-padding around initrds. + +From: Dimitri John Ledkov + +[ Upstream commit 2c484419efc09e7234c667aa72698cb79ba8d8ed ] + +lz4 compatible decompressor is simple. The format is underspecified and +relies on EOF notification to determine when to stop. Initramfs buffer +format[1] explicitly states that it can have arbitrary number of zero +padding. Thus when operating without a fill function, be extra careful to +ensure that sizes less than 4, or apperantly empty chunksizes are treated +as EOF. + +To test this I have created two cpio initrds, first a normal one, +main.cpio. And second one with just a single /test-file with content +"second" second.cpio. Then i compressed both of them with gzip, and with +lz4 -l. Then I created a padding of 4 bytes (dd if=/dev/zero of=pad4 bs=1 +count=4). To create four testcase initrds: + + 1) main.cpio.gzip + extra.cpio.gzip = pad0.gzip + 2) main.cpio.lz4 + extra.cpio.lz4 = pad0.lz4 + 3) main.cpio.gzip + pad4 + extra.cpio.gzip = pad4.gzip + 4) main.cpio.lz4 + pad4 + extra.cpio.lz4 = pad4.lz4 + +The pad4 test-cases replicate the initrd load by grub, as it pads and +aligns every initrd it loads. + +All of the above boot, however /test-file was not accessible in the initrd +for the testcase #4, as decoding in lz4 decompressor failed. Also an +error message printed which usually is harmless. + +Whith a patched kernel, all of the above testcases now pass, and +/test-file is accessible. + +This fixes lz4 initrd decompress warning on every boot with grub. And +more importantly this fixes inability to load multiple lz4 compressed +initrds with grub. This patch has been shipping in Ubuntu kernels since +January 2021. + +[1] ./Documentation/driver-api/early-userspace/buffer-format.rst + +BugLink: https://bugs.launchpad.net/bugs/1835660 +Link: https://lore.kernel.org/lkml/20210114200256.196589-1-xnox@ubuntu.com/ # v0 +Link: https://lkml.kernel.org/r/20210513104831.432975-1-dimitri.ledkov@canonical.com +Signed-off-by: Dimitri John Ledkov +Cc: Kyungsik Lee +Cc: Yinghai Lu +Cc: Bongkyu Kim +Cc: Kees Cook +Cc: Sven Schmidt <4sschmid@informatik.uni-hamburg.de> +Cc: Rajat Asthana +Cc: Nick Terrell +Cc: Gao Xiang +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/decompress_unlz4.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/lib/decompress_unlz4.c b/lib/decompress_unlz4.c +index c0cfcfd486be..e6327391b6b6 100644 +--- a/lib/decompress_unlz4.c ++++ b/lib/decompress_unlz4.c +@@ -112,6 +112,9 @@ STATIC inline int INIT unlz4(u8 *input, long in_len, + error("data corrupted"); + goto exit_2; + } ++ } else if (size < 4) { ++ /* empty or end-of-file */ ++ goto exit_3; + } + + chunksize = get_unaligned_le32(inp); +@@ -125,6 +128,10 @@ STATIC inline int INIT unlz4(u8 *input, long in_len, + continue; + } + ++ if (!fill && chunksize == 0) { ++ /* empty or end-of-file */ ++ goto exit_3; ++ } + + if (posp) + *posp += 4; +@@ -184,6 +191,7 @@ STATIC inline int INIT unlz4(u8 *input, long in_len, + } + } + ++exit_3: + ret = 0; + exit_2: + if (!input) +-- +2.30.2 + diff --git a/queue-5.4/memory-atmel-ebi-add-missing-of_node_put-for-loop-it.patch b/queue-5.4/memory-atmel-ebi-add-missing-of_node_put-for-loop-it.patch new file mode 100644 index 00000000000..e135cee0cd4 --- /dev/null +++ b/queue-5.4/memory-atmel-ebi-add-missing-of_node_put-for-loop-it.patch @@ -0,0 +1,42 @@ +From 4f763975d2a442f4a546921066c3852e08d4f5d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Apr 2021 12:18:15 +0200 +Subject: memory: atmel-ebi: add missing of_node_put for loop iteration + +From: Krzysztof Kozlowski + +[ Upstream commit 907c5bbb514a4676160e79764522fff56ce3448e ] + +Early exits from for_each_available_child_of_node() should decrement the +node reference counter. Reported by Coccinelle: + + drivers/memory/atmel-ebi.c:593:1-33: WARNING: + Function "for_each_available_child_of_node" should have of_node_put() before return around line 604. + +Fixes: 6a4ec4cd0888 ("memory: add Atmel EBI (External Bus Interface) driver") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210423101815.119341-2-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/memory/atmel-ebi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c +index 0322df9dc249..89646896a183 100644 +--- a/drivers/memory/atmel-ebi.c ++++ b/drivers/memory/atmel-ebi.c +@@ -601,8 +601,10 @@ static int atmel_ebi_probe(struct platform_device *pdev) + child); + + ret = atmel_ebi_dev_disable(ebi, child); +- if (ret) ++ if (ret) { ++ of_node_put(child); + return ret; ++ } + } + } + +-- +2.30.2 + diff --git a/queue-5.4/memory-fsl_ifc-fix-leak-of-io-mapping-on-probe-failu.patch b/queue-5.4/memory-fsl_ifc-fix-leak-of-io-mapping-on-probe-failu.patch new file mode 100644 index 00000000000..a949ba365ab --- /dev/null +++ b/queue-5.4/memory-fsl_ifc-fix-leak-of-io-mapping-on-probe-failu.patch @@ -0,0 +1,48 @@ +From 95c41d61aa6c744ae86d30601969aeaf16837440 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 11:43:21 -0400 +Subject: memory: fsl_ifc: fix leak of IO mapping on probe failure + +From: Krzysztof Kozlowski + +[ Upstream commit 3b132ab67fc7a358fff35e808fa65d4bea452521 ] + +On probe error the driver should unmap the IO memory. Smatch reports: + + drivers/memory/fsl_ifc.c:298 fsl_ifc_ctrl_probe() warn: 'fsl_ifc_ctrl_dev->gregs' not released on lines: 298. + +Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210527154322.81253-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/memory/fsl_ifc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c +index a2c971743ffe..90aa658797af 100644 +--- a/drivers/memory/fsl_ifc.c ++++ b/drivers/memory/fsl_ifc.c +@@ -218,8 +218,7 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + fsl_ifc_ctrl_dev->gregs = of_iomap(dev->dev.of_node, 0); + if (!fsl_ifc_ctrl_dev->gregs) { + dev_err(&dev->dev, "failed to get memory region\n"); +- ret = -ENODEV; +- goto err; ++ return -ENODEV; + } + + if (of_property_read_bool(dev->dev.of_node, "little-endian")) { +@@ -295,6 +294,7 @@ err_irq: + free_irq(fsl_ifc_ctrl_dev->irq, fsl_ifc_ctrl_dev); + irq_dispose_mapping(fsl_ifc_ctrl_dev->irq); + err: ++ iounmap(fsl_ifc_ctrl_dev->gregs); + return ret; + } + +-- +2.30.2 + diff --git a/queue-5.4/memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch b/queue-5.4/memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch new file mode 100644 index 00000000000..10b13857a57 --- /dev/null +++ b/queue-5.4/memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch @@ -0,0 +1,45 @@ +From 026392d547c431c057904264d1b485c6d3a89bac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 May 2021 11:43:22 -0400 +Subject: memory: fsl_ifc: fix leak of private memory on probe failure + +From: Krzysztof Kozlowski + +[ Upstream commit 8e0d09b1232d0538066c40ed4c13086faccbdff6 ] + +On probe error the driver should free the memory allocated for private +structure. Fix this by using resource-managed allocation. + +Fixes: a20cbdeffce2 ("powerpc/fsl: Add support for Integrated Flash Controller") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210527154322.81253-2-krzysztof.kozlowski@canonical.com +Signed-off-by: Sasha Levin +--- + drivers/memory/fsl_ifc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/memory/fsl_ifc.c b/drivers/memory/fsl_ifc.c +index 90aa658797af..279025834607 100644 +--- a/drivers/memory/fsl_ifc.c ++++ b/drivers/memory/fsl_ifc.c +@@ -96,7 +96,6 @@ static int fsl_ifc_ctrl_remove(struct platform_device *dev) + iounmap(ctrl->gregs); + + dev_set_drvdata(&dev->dev, NULL); +- kfree(ctrl); + + return 0; + } +@@ -208,7 +207,8 @@ static int fsl_ifc_ctrl_probe(struct platform_device *dev) + + dev_info(&dev->dev, "Freescale Integrated Flash Controller\n"); + +- fsl_ifc_ctrl_dev = kzalloc(sizeof(*fsl_ifc_ctrl_dev), GFP_KERNEL); ++ fsl_ifc_ctrl_dev = devm_kzalloc(&dev->dev, sizeof(*fsl_ifc_ctrl_dev), ++ GFP_KERNEL); + if (!fsl_ifc_ctrl_dev) + return -ENOMEM; + +-- +2.30.2 + diff --git a/queue-5.4/memory-pl353-fix-error-return-code-in-pl353_smc_prob.patch b/queue-5.4/memory-pl353-fix-error-return-code-in-pl353_smc_prob.patch new file mode 100644 index 00000000000..996a9f25c21 --- /dev/null +++ b/queue-5.4/memory-pl353-fix-error-return-code-in-pl353_smc_prob.patch @@ -0,0 +1,38 @@ +From 7b31e58d3f6ebaae8edc1656fc18c4b41bea7d5b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 May 2021 12:00:04 +0800 +Subject: memory: pl353: Fix error return code in pl353_smc_probe() + +From: Zhen Lei + +[ Upstream commit 76e5624f3f9343a621dd3f4006f4e4d9c3f91e33 ] + +When no child nodes are matched, an appropriate error code -ENODEV should +be returned. However, we currently do not explicitly assign this error +code to 'err'. As a result, 0 was incorrectly returned. + +Fixes: fee10bd22678 ("memory: pl353: Add driver for arm pl353 static memory controller") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Link: https://lore.kernel.org/r/20210515040004.6983-1-thunder.leizhen@huawei.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/pl353-smc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/memory/pl353-smc.c b/drivers/memory/pl353-smc.c +index b42804b1801e..cc01979780d8 100644 +--- a/drivers/memory/pl353-smc.c ++++ b/drivers/memory/pl353-smc.c +@@ -407,6 +407,7 @@ static int pl353_smc_probe(struct amba_device *adev, const struct amba_id *id) + break; + } + if (!match) { ++ err = -ENODEV; + dev_err(&adev->dev, "no matching children\n"); + goto out_clk_disable; + } +-- +2.30.2 + diff --git a/queue-5.4/mfd-cpcap-fix-cpcap-dmamask-not-set-warnings.patch b/queue-5.4/mfd-cpcap-fix-cpcap-dmamask-not-set-warnings.patch new file mode 100644 index 00000000000..327c7138120 --- /dev/null +++ b/queue-5.4/mfd-cpcap-fix-cpcap-dmamask-not-set-warnings.patch @@ -0,0 +1,62 @@ +From 3b974643ac1caa644340d6b8bea6762d971bfcaa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 May 2021 08:10:01 +0300 +Subject: mfd: cpcap: Fix cpcap dmamask not set warnings + +From: Tony Lindgren + +[ Upstream commit 0b7cbe811ca524295ea43d9a4d73d3427e419c54 ] + +We have started to get a bunch of pointless dmamask not set warnings +that makes the output of dmesg -l err,warn hard to read with many +extra warnings: + +cpcap-regulator cpcap-regulator.0: DMA mask not set +cpcap_adc cpcap_adc.0: DMA mask not set +cpcap_battery cpcap_battery.0: DMA mask not set +cpcap-charger cpcap-charger.0: DMA mask not set +cpcap-pwrbutton cpcap-pwrbutton.0: DMA mask not set +cpcap-led cpcap-led.0: DMA mask not set +cpcap-led cpcap-led.1: DMA mask not set +cpcap-led cpcap-led.2: DMA mask not set +cpcap-led cpcap-led.3: DMA mask not set +cpcap-led cpcap-led.4: DMA mask not set +cpcap-rtc cpcap-rtc.0: DMA mask not set +cpcap-usb-phy cpcap-usb-phy.0: DMA mask not set + +This seems to have started with commit 4d8bde883bfb ("OF: Don't set +default coherent DMA mask"). We have the parent SPI controller use +DMA, while CPCAP driver and it's children do not. For audio, the +DMA is handled over I2S bus with the McBSP driver. + +Cc: Carl Philipp Klemm +Cc: Ivan Jelincic +Cc: Merlijn Wajer +Cc: Pavel Machek +Cc: Sebastian Reichel +Cc: Sicelo A. Mhlongo +Signed-off-by: Tony Lindgren +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/motorola-cpcap.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/mfd/motorola-cpcap.c b/drivers/mfd/motorola-cpcap.c +index 52f38e57cdc1..1ae58c977e1b 100644 +--- a/drivers/mfd/motorola-cpcap.c ++++ b/drivers/mfd/motorola-cpcap.c +@@ -305,6 +305,10 @@ static int cpcap_probe(struct spi_device *spi) + if (ret) + return ret; + ++ /* Parent SPI controller uses DMA, CPCAP and child devices do not */ ++ spi->dev.coherent_dma_mask = 0; ++ spi->dev.dma_mask = &spi->dev.coherent_dma_mask; ++ + return devm_mfd_add_devices(&spi->dev, 0, cpcap_mfd_devices, + ARRAY_SIZE(cpcap_mfd_devices), NULL, 0, NULL); + } +-- +2.30.2 + diff --git a/queue-5.4/mfd-da9052-stmpe-add-and-modify-module_device_table.patch b/queue-5.4/mfd-da9052-stmpe-add-and-modify-module_device_table.patch new file mode 100644 index 00000000000..f2326e789cf --- /dev/null +++ b/queue-5.4/mfd-da9052-stmpe-add-and-modify-module_device_table.patch @@ -0,0 +1,50 @@ +From 7a1a4aff4fd2539980397f06d9f1eb903c2d0ef8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 14:33:46 +0800 +Subject: mfd: da9052/stmpe: Add and modify MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit 4700ef326556ed74aba188f12396740a8c1c21dd ] + +This patch adds/modifies MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/da9052-i2c.c | 1 + + drivers/mfd/stmpe-i2c.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/da9052-i2c.c b/drivers/mfd/da9052-i2c.c +index 47556d2d9abe..8ebfc7bbe4e0 100644 +--- a/drivers/mfd/da9052-i2c.c ++++ b/drivers/mfd/da9052-i2c.c +@@ -113,6 +113,7 @@ static const struct i2c_device_id da9052_i2c_id[] = { + {"da9053-bc", DA9053_BC}, + {} + }; ++MODULE_DEVICE_TABLE(i2c, da9052_i2c_id); + + #ifdef CONFIG_OF + static const struct of_device_id dialog_dt_ids[] = { +diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c +index 61aa020199f5..cd2f45257dc1 100644 +--- a/drivers/mfd/stmpe-i2c.c ++++ b/drivers/mfd/stmpe-i2c.c +@@ -109,7 +109,7 @@ static const struct i2c_device_id stmpe_i2c_id[] = { + { "stmpe2403", STMPE2403 }, + { } + }; +-MODULE_DEVICE_TABLE(i2c, stmpe_id); ++MODULE_DEVICE_TABLE(i2c, stmpe_i2c_id); + + static struct i2c_driver stmpe_i2c_driver = { + .driver = { +-- +2.30.2 + diff --git a/queue-5.4/mips-always-link-byteswap-helpers-into-decompressor.patch b/queue-5.4/mips-always-link-byteswap-helpers-into-decompressor.patch new file mode 100644 index 00000000000..0e037e79d23 --- /dev/null +++ b/queue-5.4/mips-always-link-byteswap-helpers-into-decompressor.patch @@ -0,0 +1,65 @@ +From 86f56507f28bbe058d960bda025391def3262937 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jul 2021 16:28:37 +0200 +Subject: mips: always link byteswap helpers into decompressor + +From: Arnd Bergmann + +[ Upstream commit cddc40f5617e53f97ef019d5b29c1bd6cbb031ec ] + +My series to clean up the unaligned access implementation +across architectures caused some mips randconfig builds to +fail with: + + mips64-linux-ld: arch/mips/boot/compressed/decompress.o: in function `decompress_kernel': + decompress.c:(.text.decompress_kernel+0x54): undefined reference to `__bswapsi2' + +It turns out that this problem has already been fixed for the XZ +decompressor but now it also shows up in (at least) LZO and LZ4. From my +analysis I concluded that the compiler could always have emitted those +calls, but the different implementation allowed it to make otherwise +better decisions about not inlining the byteswap, which results in the +link error when the out-of-line code is missing. + +While it could be addressed by adding it to the two decompressor +implementations that are known to be affected, but as this only adds +112 bytes to the kernel, the safer choice is to always add them. + +Fixes: c50ec6787536 ("MIPS: zboot: Fix the build with XZ compression on older GCC versions") +Fixes: 0652035a5794 ("asm-generic: unaligned: remove byteshift helpers") +Link: https://lore.kernel.org/linux-mm/202106301304.gz2wVY9w-lkp@intel.com/ +Link: https://lore.kernel.org/linux-mm/202106260659.TyMe8mjr-lkp@intel.com/ +Link: https://lore.kernel.org/linux-mm/202106172016.onWT6Tza-lkp@intel.com/ +Link: https://lore.kernel.org/linux-mm/202105231743.JJcALnhS-lkp@intel.com/ +Signed-off-by: Arnd Bergmann +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/compressed/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile +index 378cbfb31ee7..1d6ebbc2a5d0 100644 +--- a/arch/mips/boot/compressed/Makefile ++++ b/arch/mips/boot/compressed/Makefile +@@ -33,7 +33,7 @@ KBUILD_AFLAGS := $(KBUILD_AFLAGS) -D__ASSEMBLY__ \ + KCOV_INSTRUMENT := n + + # decompressor objects (linked with vmlinuz) +-vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o ++vmlinuzobjs-y := $(obj)/head.o $(obj)/decompress.o $(obj)/string.o $(obj)/bswapsi.o + + ifdef CONFIG_DEBUG_ZBOOT + vmlinuzobjs-$(CONFIG_DEBUG_ZBOOT) += $(obj)/dbg.o +@@ -47,7 +47,7 @@ extra-y += uart-ath79.c + $(obj)/uart-ath79.c: $(srctree)/arch/mips/ath79/early_printk.c + $(call cmd,shipped) + +-vmlinuzobjs-$(CONFIG_KERNEL_XZ) += $(obj)/ashldi3.o $(obj)/bswapsi.o ++vmlinuzobjs-$(CONFIG_KERNEL_XZ) += $(obj)/ashldi3.o + + extra-y += ashldi3.c + $(obj)/ashldi3.c: $(obj)/%.c: $(srctree)/lib/%.c FORCE +-- +2.30.2 + diff --git a/queue-5.4/mips-disable-branch-profiling-in-boot-decompress.o.patch b/queue-5.4/mips-disable-branch-profiling-in-boot-decompress.o.patch new file mode 100644 index 00000000000..2ae74ab5101 --- /dev/null +++ b/queue-5.4/mips-disable-branch-profiling-in-boot-decompress.o.patch @@ -0,0 +1,48 @@ +From 57731258f2a2f5896cd59cee2cf05f58c5ce45d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jul 2021 16:02:11 -0700 +Subject: mips: disable branch profiling in boot/decompress.o + +From: Randy Dunlap + +[ Upstream commit 97e488073cfca0eea84450169ca4cbfcc64e33e3 ] + +Use DISABLE_BRANCH_PROFILING for arch/mips/boot/compressed/decompress.o +to prevent linkage errors. + +mips64-linux-ld: arch/mips/boot/compressed/decompress.o: in function `LZ4_decompress_fast_extDict': +decompress.c:(.text+0x8c): undefined reference to `ftrace_likely_update' +mips64-linux-ld: decompress.c:(.text+0xf4): undefined reference to `ftrace_likely_update' +mips64-linux-ld: decompress.c:(.text+0x200): undefined reference to `ftrace_likely_update' +mips64-linux-ld: decompress.c:(.text+0x230): undefined reference to `ftrace_likely_update' +mips64-linux-ld: decompress.c:(.text+0x320): undefined reference to `ftrace_likely_update' +mips64-linux-ld: arch/mips/boot/compressed/decompress.o:decompress.c:(.text+0x3f4): more undefined references to `ftrace_likely_update' follow + +Fixes: e76e1fdfa8f8 ("lib: add support for LZ4-compressed kernel") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Cc: Thomas Bogendoerfer +Cc: linux-mips@vger.kernel.org +Cc: Kyungsik Lee +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/boot/compressed/decompress.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/mips/boot/compressed/decompress.c b/arch/mips/boot/compressed/decompress.c +index a52e929381ea..281e922e5c65 100644 +--- a/arch/mips/boot/compressed/decompress.c ++++ b/arch/mips/boot/compressed/decompress.c +@@ -7,6 +7,8 @@ + * Author: Wu Zhangjin + */ + ++#define DISABLE_BRANCH_PROFILING ++ + #include + #include + #include +-- +2.30.2 + diff --git a/queue-5.4/mips-vdso-invalid-gic-access-through-vdso.patch b/queue-5.4/mips-vdso-invalid-gic-access-through-vdso.patch new file mode 100644 index 00000000000..a86b9966ce3 --- /dev/null +++ b/queue-5.4/mips-vdso-invalid-gic-access-through-vdso.patch @@ -0,0 +1,65 @@ +From 255f0d90a1e5ccd93e08403144f09fa175c7d784 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 5 Jul 2021 02:03:54 +0200 +Subject: MIPS: vdso: Invalid GIC access through VDSO +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Martin Fäcknitz + +[ Upstream commit 47ce8527fbba145a7723685bc9a27d9855e06491 ] + +Accessing raw timers (currently only CLOCK_MONOTONIC_RAW) through VDSO +doesn't return the correct time when using the GIC as clock source. +The address of the GIC mapped page is in this case not calculated +correctly. The GIC mapped page is calculated from the VDSO data by +subtracting PAGE_SIZE: + + void *get_gic(const struct vdso_data *data) { + return (void __iomem *)data - PAGE_SIZE; + } + +However, the data pointer is not page aligned for raw clock sources. +This is because the VDSO data for raw clock sources (CS_RAW = 1) is +stored after the VDSO data for coarse clock sources (CS_HRES_COARSE = 0). +Therefore, only the VDSO data for CS_HRES_COARSE is page aligned: + + +--------------------+ + | | + | vd[CS_RAW] | ---+ + | vd[CS_HRES_COARSE] | | + +--------------------+ | -PAGE_SIZE + | | | + | GIC mapped page | <--+ + | | + +--------------------+ + +When __arch_get_hw_counter() is called with &vd[CS_RAW], get_gic returns +the wrong address (somewhere inside the GIC mapped page). The GIC counter +values are not returned which results in an invalid time. + +Fixes: a7f4df4e21dd ("MIPS: VDSO: Add implementations of gettimeofday() and clock_gettime()") +Signed-off-by: Martin Fäcknitz +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/vdso/vdso.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/mips/include/asm/vdso/vdso.h b/arch/mips/include/asm/vdso/vdso.h +index 737ddfc3411c..a327ca21270e 100644 +--- a/arch/mips/include/asm/vdso/vdso.h ++++ b/arch/mips/include/asm/vdso/vdso.h +@@ -67,7 +67,7 @@ static inline const struct vdso_data *get_vdso_data(void) + + static inline void __iomem *get_gic(const struct vdso_data *data) + { +- return (void __iomem *)data - PAGE_SIZE; ++ return (void __iomem *)((unsigned long)data & PAGE_MASK) - PAGE_SIZE; + } + + #endif /* CONFIG_CLKSRC_MIPS_GIC */ +-- +2.30.2 + diff --git a/queue-5.4/misc-alcor_pci-fix-null-ptr-deref-when-there-is-no-p.patch b/queue-5.4/misc-alcor_pci-fix-null-ptr-deref-when-there-is-no-p.patch new file mode 100644 index 00000000000..8bdef3a4b72 --- /dev/null +++ b/queue-5.4/misc-alcor_pci-fix-null-ptr-deref-when-there-is-no-p.patch @@ -0,0 +1,56 @@ +From 055f46c1efc401d263e3c5f0cdf39ba264461099 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 May 2021 00:07:33 -0400 +Subject: misc: alcor_pci: fix null-ptr-deref when there is no PCI bridge + +From: Tong Zhang + +[ Upstream commit 3ce3e45cc333da707d4d6eb433574b990bcc26f5 ] + +There is an issue with the ASPM(optional) capability checking function. +A device might be attached to root complex directly, in this case, +bus->self(bridge) will be NULL, thus priv->parent_pdev is NULL. +Since alcor_pci_init_check_aspm(priv->parent_pdev) checks the PCI link's +ASPM capability and populate parent_cap_off, which will be used later by +alcor_pci_aspm_ctrl() to dynamically turn on/off device, what we can do +here is to avoid checking the capability if we are on the root complex. +This will make pdev_cap_off 0 and alcor_pci_aspm_ctrl() will simply +return when bring called, effectively disable ASPM for the device. + +[ 1.246492] BUG: kernel NULL pointer dereference, address: 00000000000000c0 +[ 1.248731] RIP: 0010:pci_read_config_byte+0x5/0x40 +[ 1.253998] Call Trace: +[ 1.254131] ? alcor_pci_find_cap_offset.isra.0+0x3a/0x100 [alcor_pci] +[ 1.254476] alcor_pci_probe+0x169/0x2d5 [alcor_pci] + +Co-developed-by: Greg Kroah-Hartman +Signed-off-by: Tong Zhang +Link: https://lore.kernel.org/r/20210513040732.1310159-1-ztong0001@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/cardreader/alcor_pci.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/misc/cardreader/alcor_pci.c b/drivers/misc/cardreader/alcor_pci.c +index 259fe1dfec03..afd409a5efae 100644 +--- a/drivers/misc/cardreader/alcor_pci.c ++++ b/drivers/misc/cardreader/alcor_pci.c +@@ -133,7 +133,13 @@ static void alcor_pci_init_check_aspm(struct alcor_pci_priv *priv) + u32 val32; + + priv->pdev_cap_off = alcor_pci_find_cap_offset(priv, priv->pdev); +- priv->parent_cap_off = alcor_pci_find_cap_offset(priv, ++ /* ++ * A device might be attached to root complex directly and ++ * priv->parent_pdev will be NULL. In this case we don't check its ++ * capability and disable ASPM completely. ++ */ ++ if (!priv->parent_pdev) ++ priv->parent_cap_off = alcor_pci_find_cap_offset(priv, + priv->parent_pdev); + + if ((priv->pdev_cap_off == 0) || (priv->parent_cap_off == 0)) { +-- +2.30.2 + diff --git a/queue-5.4/misc-libmasm-module-fix-two-use-after-free-in-ibmasm.patch b/queue-5.4/misc-libmasm-module-fix-two-use-after-free-in-ibmasm.patch new file mode 100644 index 00000000000..9a9f6f54d8b --- /dev/null +++ b/queue-5.4/misc-libmasm-module-fix-two-use-after-free-in-ibmasm.patch @@ -0,0 +1,58 @@ +From 0006b6f134bfc549bedc78dda10c981aed9d1803 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Apr 2021 10:06:20 -0700 +Subject: misc/libmasm/module: Fix two use after free in ibmasm_init_one + +From: Lv Yunlong + +[ Upstream commit 7272b591c4cb9327c43443f67b8fbae7657dd9ae ] + +In ibmasm_init_one, it calls ibmasm_init_remote_input_dev(). +Inside ibmasm_init_remote_input_dev, mouse_dev and keybd_dev are +allocated by input_allocate_device(), and assigned to +sp->remote.mouse_dev and sp->remote.keybd_dev respectively. + +In the err_free_devices error branch of ibmasm_init_one, +mouse_dev and keybd_dev are freed by input_free_device(), and return +error. Then the execution runs into error_send_message error branch +of ibmasm_init_one, where ibmasm_free_remote_input_dev(sp) is called +to unregister the freed sp->remote.mouse_dev and sp->remote.keybd_dev. + +My patch add a "error_init_remote" label to handle the error of +ibmasm_init_remote_input_dev(), to avoid the uaf bugs. + +Signed-off-by: Lv Yunlong +Link: https://lore.kernel.org/r/20210426170620.10546-1-lyl2019@mail.ustc.edu.cn +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/ibmasm/module.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/ibmasm/module.c b/drivers/misc/ibmasm/module.c +index 4edad6c445d3..dc8a06c06c63 100644 +--- a/drivers/misc/ibmasm/module.c ++++ b/drivers/misc/ibmasm/module.c +@@ -111,7 +111,7 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + result = ibmasm_init_remote_input_dev(sp); + if (result) { + dev_err(sp->dev, "Failed to initialize remote queue\n"); +- goto error_send_message; ++ goto error_init_remote; + } + + result = ibmasm_send_driver_vpd(sp); +@@ -131,8 +131,9 @@ static int ibmasm_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + return 0; + + error_send_message: +- disable_sp_interrupts(sp->base_address); + ibmasm_free_remote_input_dev(sp); ++error_init_remote: ++ disable_sp_interrupts(sp->base_address); + free_irq(sp->irq, (void *)sp); + error_request_irq: + iounmap(sp->base_address); +-- +2.30.2 + diff --git a/queue-5.4/nfs-fix-acl-memory-leak-of-posix_acl_create.patch b/queue-5.4/nfs-fix-acl-memory-leak-of-posix_acl_create.patch new file mode 100644 index 00000000000..7610cdf110c --- /dev/null +++ b/queue-5.4/nfs-fix-acl-memory-leak-of-posix_acl_create.patch @@ -0,0 +1,50 @@ +From 0074844d2fed82d87fa557354b4a53a7b7f02b36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 12:20:55 +0800 +Subject: nfs: fix acl memory leak of posix_acl_create() + +From: Gao Xiang + +[ Upstream commit 1fcb6fcd74a222d9ead54d405842fc763bb86262 ] + +When looking into another nfs xfstests report, I found acl and +default_acl in nfs3_proc_create() and nfs3_proc_mknod() error +paths are possibly leaked. Fix them in advance. + +Fixes: 013cdf1088d7 ("nfs: use generic posix ACL infrastructure for v3 Posix ACLs") +Cc: Trond Myklebust +Cc: Anna Schumaker +Cc: Christoph Hellwig +Cc: Joseph Qi +Signed-off-by: Gao Xiang +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs3proc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs3proc.c b/fs/nfs/nfs3proc.c +index 9eb2f1a503ab..01a03ca36659 100644 +--- a/fs/nfs/nfs3proc.c ++++ b/fs/nfs/nfs3proc.c +@@ -350,7 +350,7 @@ nfs3_proc_create(struct inode *dir, struct dentry *dentry, struct iattr *sattr, + break; + + case NFS3_CREATE_UNCHECKED: +- goto out; ++ goto out_release_acls; + } + nfs_fattr_init(data->res.dir_attr); + nfs_fattr_init(data->res.fattr); +@@ -717,7 +717,7 @@ nfs3_proc_mknod(struct inode *dir, struct dentry *dentry, struct iattr *sattr, + break; + default: + status = -EINVAL; +- goto out; ++ goto out_release_acls; + } + + d_alias = nfs3_do_create(dir, dentry, data); +-- +2.30.2 + diff --git a/queue-5.4/nfs-nfs_find_open_context-may-only-select-open-files.patch b/queue-5.4/nfs-nfs_find_open_context-may-only-select-open-files.patch new file mode 100644 index 00000000000..99ffb6dd410 --- /dev/null +++ b/queue-5.4/nfs-nfs_find_open_context-may-only-select-open-files.patch @@ -0,0 +1,64 @@ +From 156d0c741f72ca35732050723a8bb76f65854afa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 23:41:10 -0400 +Subject: NFS: nfs_find_open_context() may only select open files + +From: Trond Myklebust + +[ Upstream commit e97bc66377bca097e1f3349ca18ca17f202ff659 ] + +If a file has already been closed, then it should not be selected to +support further I/O. + +Signed-off-by: Trond Myklebust +[Trond: Fix an invalid pointer deref reported by Colin Ian King] +Signed-off-by: Sasha Levin +--- + fs/nfs/inode.c | 4 ++++ + include/linux/nfs_fs.h | 1 + + 2 files changed, 5 insertions(+) + +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index 8c0f916380c4..209263c0c537 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1048,6 +1048,7 @@ EXPORT_SYMBOL_GPL(nfs_inode_attach_open_context); + void nfs_file_set_open_context(struct file *filp, struct nfs_open_context *ctx) + { + filp->private_data = get_nfs_open_context(ctx); ++ set_bit(NFS_CONTEXT_FILE_OPEN, &ctx->flags); + if (list_empty(&ctx->list)) + nfs_inode_attach_open_context(ctx); + } +@@ -1067,6 +1068,8 @@ struct nfs_open_context *nfs_find_open_context(struct inode *inode, const struct + continue; + if ((pos->mode & (FMODE_READ|FMODE_WRITE)) != mode) + continue; ++ if (!test_bit(NFS_CONTEXT_FILE_OPEN, &pos->flags)) ++ continue; + ctx = get_nfs_open_context(pos); + if (ctx) + break; +@@ -1082,6 +1085,7 @@ void nfs_file_clear_open_context(struct file *filp) + if (ctx) { + struct inode *inode = d_inode(ctx->dentry); + ++ clear_bit(NFS_CONTEXT_FILE_OPEN, &ctx->flags); + /* + * We fatal error on write before. Try to writeback + * every page again. +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index ad09c0cc5464..978ef674f038 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -79,6 +79,7 @@ struct nfs_open_context { + #define NFS_CONTEXT_RESEND_WRITES (1) + #define NFS_CONTEXT_BAD (2) + #define NFS_CONTEXT_UNLOCK (3) ++#define NFS_CONTEXT_FILE_OPEN (4) + int error; + + struct list_head list; +-- +2.30.2 + diff --git a/queue-5.4/nfsv4-initialise-connection-to-the-server-in-nfs4_al.patch b/queue-5.4/nfsv4-initialise-connection-to-the-server-in-nfs4_al.patch new file mode 100644 index 00000000000..ef2aad3a02a --- /dev/null +++ b/queue-5.4/nfsv4-initialise-connection-to-the-server-in-nfs4_al.patch @@ -0,0 +1,140 @@ +From 62a35f5ed856628995a2eb47304228ba222b8b93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Jun 2021 10:04:46 -0400 +Subject: NFSv4: Initialise connection to the server in nfs4_alloc_client() + +From: Trond Myklebust + +[ Upstream commit dd99e9f98fbf423ff6d365b37a98e8879170f17c ] + +Set up the connection to the NFSv4 server in nfs4_alloc_client(), before +we've added the struct nfs_client to the net-namespace's nfs_client_list +so that a downed server won't cause other mounts to hang in the trunking +detection code. + +Reported-by: Michael Wakabayashi +Fixes: 5c6e5b60aae4 ("NFS: Fix an Oops in the pNFS files and flexfiles connection setup to the DS") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4client.c | 82 +++++++++++++++++++++++---------------------- + 1 file changed, 42 insertions(+), 40 deletions(-) + +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 5a69dbd01a6c..8cace8350fa3 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -197,8 +197,11 @@ void nfs40_shutdown_client(struct nfs_client *clp) + + struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + { +- int err; ++ char buf[INET6_ADDRSTRLEN + 1]; ++ const char *ip_addr = cl_init->ip_addr; + struct nfs_client *clp = nfs_alloc_client(cl_init); ++ int err; ++ + if (IS_ERR(clp)) + return clp; + +@@ -222,6 +225,44 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init) + init_waitqueue_head(&clp->cl_lock_waitq); + #endif + INIT_LIST_HEAD(&clp->pending_cb_stateids); ++ ++ if (cl_init->minorversion != 0) ++ __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags); ++ __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags); ++ __set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags); ++ ++ /* ++ * Set up the connection to the server before we add add to the ++ * global list. ++ */ ++ err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I); ++ if (err == -EINVAL) ++ err = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX); ++ if (err < 0) ++ goto error; ++ ++ /* If no clientaddr= option was specified, find a usable cb address */ ++ if (ip_addr == NULL) { ++ struct sockaddr_storage cb_addr; ++ struct sockaddr *sap = (struct sockaddr *)&cb_addr; ++ ++ err = rpc_localaddr(clp->cl_rpcclient, sap, sizeof(cb_addr)); ++ if (err < 0) ++ goto error; ++ err = rpc_ntop(sap, buf, sizeof(buf)); ++ if (err < 0) ++ goto error; ++ ip_addr = (const char *)buf; ++ } ++ strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr)); ++ ++ err = nfs_idmap_new(clp); ++ if (err < 0) { ++ dprintk("%s: failed to create idmapper. Error = %d\n", ++ __func__, err); ++ goto error; ++ } ++ __set_bit(NFS_CS_IDMAP, &clp->cl_res_state); + return clp; + + error: +@@ -372,8 +413,6 @@ static int nfs4_init_client_minor_version(struct nfs_client *clp) + struct nfs_client *nfs4_init_client(struct nfs_client *clp, + const struct nfs_client_initdata *cl_init) + { +- char buf[INET6_ADDRSTRLEN + 1]; +- const char *ip_addr = cl_init->ip_addr; + struct nfs_client *old; + int error; + +@@ -381,43 +420,6 @@ struct nfs_client *nfs4_init_client(struct nfs_client *clp, + /* the client is initialised already */ + return clp; + +- /* Check NFS protocol revision and initialize RPC op vector */ +- clp->rpc_ops = &nfs_v4_clientops; +- +- if (clp->cl_minorversion != 0) +- __set_bit(NFS_CS_INFINITE_SLOTS, &clp->cl_flags); +- __set_bit(NFS_CS_DISCRTRY, &clp->cl_flags); +- __set_bit(NFS_CS_NO_RETRANS_TIMEOUT, &clp->cl_flags); +- +- error = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_GSS_KRB5I); +- if (error == -EINVAL) +- error = nfs_create_rpc_client(clp, cl_init, RPC_AUTH_UNIX); +- if (error < 0) +- goto error; +- +- /* If no clientaddr= option was specified, find a usable cb address */ +- if (ip_addr == NULL) { +- struct sockaddr_storage cb_addr; +- struct sockaddr *sap = (struct sockaddr *)&cb_addr; +- +- error = rpc_localaddr(clp->cl_rpcclient, sap, sizeof(cb_addr)); +- if (error < 0) +- goto error; +- error = rpc_ntop(sap, buf, sizeof(buf)); +- if (error < 0) +- goto error; +- ip_addr = (const char *)buf; +- } +- strlcpy(clp->cl_ipaddr, ip_addr, sizeof(clp->cl_ipaddr)); +- +- error = nfs_idmap_new(clp); +- if (error < 0) { +- dprintk("%s: failed to create idmapper. Error = %d\n", +- __func__, error); +- goto error; +- } +- __set_bit(NFS_CS_IDMAP, &clp->cl_res_state); +- + error = nfs4_init_client_minor_version(clp); + if (error < 0) + goto error; +-- +2.30.2 + diff --git a/queue-5.4/nfsv4-pnfs-don-t-call-_nfs4_pnfs_v3_ds_connect-multi.patch b/queue-5.4/nfsv4-pnfs-don-t-call-_nfs4_pnfs_v3_ds_connect-multi.patch new file mode 100644 index 00000000000..3937275dcb3 --- /dev/null +++ b/queue-5.4/nfsv4-pnfs-don-t-call-_nfs4_pnfs_v3_ds_connect-multi.patch @@ -0,0 +1,104 @@ +From 76bc9f660e87dabb73ae51cd83ee47df9ee827eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Jul 2021 14:34:20 -0400 +Subject: NFSv4/pNFS: Don't call _nfs4_pnfs_v3_ds_connect multiple times + +From: Trond Myklebust + +[ Upstream commit f46f84931a0aa344678efe412d4b071d84d8a805 ] + +After we grab the lock in nfs4_pnfs_ds_connect(), there is no check for +whether or not ds->ds_clp has already been initialised, so we can end up +adding the same transports multiple times. + +Fixes: fc821d59209d ("pnfs/NFSv4.1: Add multipath capabilities to pNFS flexfiles servers over NFSv3") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/pnfs_nfs.c | 52 +++++++++++++++++++++++------------------------ + 1 file changed, 26 insertions(+), 26 deletions(-) + +diff --git a/fs/nfs/pnfs_nfs.c b/fs/nfs/pnfs_nfs.c +index 8b37e7f8e789..249cf9037dbd 100644 +--- a/fs/nfs/pnfs_nfs.c ++++ b/fs/nfs/pnfs_nfs.c +@@ -556,19 +556,16 @@ out: + } + EXPORT_SYMBOL_GPL(nfs4_pnfs_ds_add); + +-static void nfs4_wait_ds_connect(struct nfs4_pnfs_ds *ds) ++static int nfs4_wait_ds_connect(struct nfs4_pnfs_ds *ds) + { + might_sleep(); +- wait_on_bit(&ds->ds_state, NFS4DS_CONNECTING, +- TASK_KILLABLE); ++ return wait_on_bit(&ds->ds_state, NFS4DS_CONNECTING, TASK_KILLABLE); + } + + static void nfs4_clear_ds_conn_bit(struct nfs4_pnfs_ds *ds) + { + smp_mb__before_atomic(); +- clear_bit(NFS4DS_CONNECTING, &ds->ds_state); +- smp_mb__after_atomic(); +- wake_up_bit(&ds->ds_state, NFS4DS_CONNECTING); ++ clear_and_wake_up_bit(NFS4DS_CONNECTING, &ds->ds_state); + } + + static struct nfs_client *(*get_v3_ds_connect)( +@@ -734,30 +731,33 @@ int nfs4_pnfs_ds_connect(struct nfs_server *mds_srv, struct nfs4_pnfs_ds *ds, + { + int err; + +-again: +- err = 0; +- if (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) == 0) { +- if (version == 3) { +- err = _nfs4_pnfs_v3_ds_connect(mds_srv, ds, timeo, +- retrans); +- } else if (version == 4) { +- err = _nfs4_pnfs_v4_ds_connect(mds_srv, ds, timeo, +- retrans, minor_version); +- } else { +- dprintk("%s: unsupported DS version %d\n", __func__, +- version); +- err = -EPROTONOSUPPORT; +- } ++ do { ++ err = nfs4_wait_ds_connect(ds); ++ if (err || ds->ds_clp) ++ goto out; ++ if (nfs4_test_deviceid_unavailable(devid)) ++ return -ENODEV; ++ } while (test_and_set_bit(NFS4DS_CONNECTING, &ds->ds_state) != 0); + +- nfs4_clear_ds_conn_bit(ds); +- } else { +- nfs4_wait_ds_connect(ds); ++ if (ds->ds_clp) ++ goto connect_done; + +- /* what was waited on didn't connect AND didn't mark unavail */ +- if (!ds->ds_clp && !nfs4_test_deviceid_unavailable(devid)) +- goto again; ++ switch (version) { ++ case 3: ++ err = _nfs4_pnfs_v3_ds_connect(mds_srv, ds, timeo, retrans); ++ break; ++ case 4: ++ err = _nfs4_pnfs_v4_ds_connect(mds_srv, ds, timeo, retrans, ++ minor_version); ++ break; ++ default: ++ dprintk("%s: unsupported DS version %d\n", __func__, version); ++ err = -EPROTONOSUPPORT; + } + ++connect_done: ++ nfs4_clear_ds_conn_bit(ds); ++out: + /* + * At this point the ds->ds_clp should be ready, but it might have + * hit an error. +-- +2.30.2 + diff --git a/queue-5.4/nvme-tcp-can-t-set-sk_user_data-without-write_lock.patch b/queue-5.4/nvme-tcp-can-t-set-sk_user_data-without-write_lock.patch new file mode 100644 index 00000000000..3a7fab72800 --- /dev/null +++ b/queue-5.4/nvme-tcp-can-t-set-sk_user_data-without-write_lock.patch @@ -0,0 +1,43 @@ +From 2122006e2a6527d752ab675c36bf9f5cf9db6551 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Jul 2021 10:11:21 +0200 +Subject: nvme-tcp: can't set sk_user_data without write_lock + +From: Maurizio Lombardi + +[ Upstream commit 0755d3be2d9bb6ea38598ccd30d6bbaa1a5c3a50 ] + +The sk_user_data pointer is supposed to be modified only while +holding the write_lock "sk_callback_lock", otherwise +we could race with other threads and crash the kernel. + +we can't take the write_lock in nvmet_tcp_state_change() +because it would cause a deadlock, but the release_work queue +will set the pointer to NULL later so we can simply remove +the assignment. + +Fixes: b5332a9f3f3d ("nvmet-tcp: fix incorrect locking in state_change sk callback") + +Signed-off-by: Maurizio Lombardi +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/tcp.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c +index 9bfd92b6677b..2ae846297d7c 100644 +--- a/drivers/nvme/target/tcp.c ++++ b/drivers/nvme/target/tcp.c +@@ -1412,7 +1412,6 @@ static void nvmet_tcp_state_change(struct sock *sk) + case TCP_CLOSE_WAIT: + case TCP_CLOSE: + /* FALLTHRU */ +- sk->sk_user_data = NULL; + nvmet_tcp_schedule_release_queue(queue); + break; + default: +-- +2.30.2 + diff --git a/queue-5.4/orangefs-fix-orangefs-df-output.patch b/queue-5.4/orangefs-fix-orangefs-df-output.patch new file mode 100644 index 00000000000..deff1adb02b --- /dev/null +++ b/queue-5.4/orangefs-fix-orangefs-df-output.patch @@ -0,0 +1,34 @@ +From 380e62570e0181badfc3cff7c4f853e30ce2c63d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 08:09:13 -0400 +Subject: orangefs: fix orangefs df output. + +From: Mike Marshall + +[ Upstream commit 0fdec1b3c9fbb5e856a40db5993c9eaf91c74a83 ] + +Orangefs df output is whacky. Walt Ligon suggested this might fix it. +It seems way more in line with reality now... + +Signed-off-by: Mike Marshall +Signed-off-by: Sasha Levin +--- + fs/orangefs/super.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c +index ee5efdc35cc1..2f2e430461b2 100644 +--- a/fs/orangefs/super.c ++++ b/fs/orangefs/super.c +@@ -209,7 +209,7 @@ static int orangefs_statfs(struct dentry *dentry, struct kstatfs *buf) + buf->f_bavail = (sector_t) new_op->downcall.resp.statfs.blocks_avail; + buf->f_files = (sector_t) new_op->downcall.resp.statfs.files_total; + buf->f_ffree = (sector_t) new_op->downcall.resp.statfs.files_avail; +- buf->f_frsize = sb->s_blocksize; ++ buf->f_frsize = 0; + + out_op_release: + op_release(new_op); +-- +2.30.2 + diff --git a/queue-5.4/pci-iproc-fix-multi-msi-base-vector-number-allocatio.patch b/queue-5.4/pci-iproc-fix-multi-msi-base-vector-number-allocatio.patch new file mode 100644 index 00000000000..4ea983dd950 --- /dev/null +++ b/queue-5.4/pci-iproc-fix-multi-msi-base-vector-number-allocatio.patch @@ -0,0 +1,75 @@ +From 06e371cf2085f276da6c6c54977b565e4861684d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 17:26:29 +0200 +Subject: PCI: iproc: Fix multi-MSI base vector number allocation +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sandor Bodo-Merle + +[ Upstream commit e673d697b9a234fc3544ac240e173cef8c82b349 ] + +Commit fc54bae28818 ("PCI: iproc: Allow allocation of multiple MSIs") +introduced multi-MSI support with a broken allocation mechanism (it failed +to reserve the proper number of bits from the inner domain). Natural +alignment of the base vector number was also not guaranteed. + +Link: https://lore.kernel.org/r/20210622152630.40842-1-sbodomerle@gmail.com +Fixes: fc54bae28818 ("PCI: iproc: Allow allocation of multiple MSIs") +Reported-by: Pali Rohár +Signed-off-by: Sandor Bodo-Merle +Signed-off-by: Lorenzo Pieralisi +Acked-by: Marc Zyngier +Acked-by: Pali Rohár +Acked-by: Ray Jui +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-iproc-msi.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/pci/controller/pcie-iproc-msi.c b/drivers/pci/controller/pcie-iproc-msi.c +index f40d17b285c5..b77811dcead1 100644 +--- a/drivers/pci/controller/pcie-iproc-msi.c ++++ b/drivers/pci/controller/pcie-iproc-msi.c +@@ -252,18 +252,18 @@ static int iproc_msi_irq_domain_alloc(struct irq_domain *domain, + + mutex_lock(&msi->bitmap_lock); + +- /* Allocate 'nr_cpus' number of MSI vectors each time */ +- hwirq = bitmap_find_next_zero_area(msi->bitmap, msi->nr_msi_vecs, 0, +- msi->nr_cpus, 0); +- if (hwirq < msi->nr_msi_vecs) { +- bitmap_set(msi->bitmap, hwirq, msi->nr_cpus); +- } else { +- mutex_unlock(&msi->bitmap_lock); +- return -ENOSPC; +- } ++ /* ++ * Allocate 'nr_irqs' multiplied by 'nr_cpus' number of MSI vectors ++ * each time ++ */ ++ hwirq = bitmap_find_free_region(msi->bitmap, msi->nr_msi_vecs, ++ order_base_2(msi->nr_cpus * nr_irqs)); + + mutex_unlock(&msi->bitmap_lock); + ++ if (hwirq < 0) ++ return -ENOSPC; ++ + for (i = 0; i < nr_irqs; i++) { + irq_domain_set_info(domain, virq + i, hwirq + i, + &iproc_msi_bottom_irq_chip, +@@ -284,7 +284,8 @@ static void iproc_msi_irq_domain_free(struct irq_domain *domain, + mutex_lock(&msi->bitmap_lock); + + hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq); +- bitmap_clear(msi->bitmap, hwirq, msi->nr_cpus); ++ bitmap_release_region(msi->bitmap, hwirq, ++ order_base_2(msi->nr_cpus * nr_irqs)); + + mutex_unlock(&msi->bitmap_lock); + +-- +2.30.2 + diff --git a/queue-5.4/pci-iproc-support-multi-msi-only-on-uniprocessor-ker.patch b/queue-5.4/pci-iproc-support-multi-msi-only-on-uniprocessor-ker.patch new file mode 100644 index 00000000000..ffa94dc542d --- /dev/null +++ b/queue-5.4/pci-iproc-support-multi-msi-only-on-uniprocessor-ker.patch @@ -0,0 +1,67 @@ +From f16b909c53831aac50f75482e83bd328543b8854 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 17:26:30 +0200 +Subject: PCI: iproc: Support multi-MSI only on uniprocessor kernel +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Sandor Bodo-Merle + +[ Upstream commit 2dc0a201d0f59e6818ef443609f0850a32910844 ] + +The interrupt affinity scheme used by this driver is incompatible with +multi-MSI as it implies moving the doorbell address to that of another MSI +group. This isn't possible for multi-MSI, as all the MSIs must have the +same doorbell address. As such it is restricted to systems with a single +CPU. + +Link: https://lore.kernel.org/r/20210622152630.40842-2-sbodomerle@gmail.com +Fixes: fc54bae28818 ("PCI: iproc: Allow allocation of multiple MSIs") +Reported-by: Marc Zyngier +Signed-off-by: Sandor Bodo-Merle +Signed-off-by: Lorenzo Pieralisi +Acked-by: Marc Zyngier +Acked-by: Pali Rohár +Acked-by: Ray Jui +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-iproc-msi.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pcie-iproc-msi.c b/drivers/pci/controller/pcie-iproc-msi.c +index b77811dcead1..0cb2fa1e0af4 100644 +--- a/drivers/pci/controller/pcie-iproc-msi.c ++++ b/drivers/pci/controller/pcie-iproc-msi.c +@@ -171,7 +171,7 @@ static struct irq_chip iproc_msi_irq_chip = { + + static struct msi_domain_info iproc_msi_domain_info = { + .flags = MSI_FLAG_USE_DEF_DOM_OPS | MSI_FLAG_USE_DEF_CHIP_OPS | +- MSI_FLAG_MULTI_PCI_MSI | MSI_FLAG_PCI_MSIX, ++ MSI_FLAG_PCI_MSIX, + .chip = &iproc_msi_irq_chip, + }; + +@@ -250,6 +250,9 @@ static int iproc_msi_irq_domain_alloc(struct irq_domain *domain, + struct iproc_msi *msi = domain->host_data; + int hwirq, i; + ++ if (msi->nr_cpus > 1 && nr_irqs > 1) ++ return -EINVAL; ++ + mutex_lock(&msi->bitmap_lock); + + /* +@@ -539,6 +542,9 @@ int iproc_msi_init(struct iproc_pcie *pcie, struct device_node *node) + mutex_init(&msi->bitmap_lock); + msi->nr_cpus = num_possible_cpus(); + ++ if (msi->nr_cpus == 1) ++ iproc_msi_domain_info.flags |= MSI_FLAG_MULTI_PCI_MSI; ++ + msi->nr_irqs = of_irq_count(node); + if (!msi->nr_irqs) { + dev_err(pcie->dev, "found no MSI GIC interrupt\n"); +-- +2.30.2 + diff --git a/queue-5.4/pci-p2pdma-avoid-pci_get_slot-which-may-sleep.patch b/queue-5.4/pci-p2pdma-avoid-pci_get_slot-which-may-sleep.patch new file mode 100644 index 00000000000..ec8badc93e7 --- /dev/null +++ b/queue-5.4/pci-p2pdma-avoid-pci_get_slot-which-may-sleep.patch @@ -0,0 +1,87 @@ +From 902efe7ca8554e51411f72ee3762709219827d7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 10:06:09 -0600 +Subject: PCI/P2PDMA: Avoid pci_get_slot(), which may sleep + +From: Logan Gunthorpe + +[ Upstream commit 3ec0c3ec2d92c09465534a1ff9c6f9d9506ffef6 ] + +In order to use upstream_bridge_distance_warn() from a dma_map function, it +must not sleep. However, pci_get_slot() takes the pci_bus_sem so it might +sleep. + +In order to avoid this, try to get the host bridge's device from the first +element in the device list. It should be impossible for the host bridge's +device to go away while references are held on child devices, so the first +element should not be able to change and, thus, this should be safe. + +Introduce a static function called pci_host_bridge_dev() to obtain the host +bridge's root device. + +Link: https://lore.kernel.org/r/20210610160609.28447-7-logang@deltatee.com +Signed-off-by: Logan Gunthorpe +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/p2pdma.c | 34 ++++++++++++++++++++++++++++++++-- + 1 file changed, 32 insertions(+), 2 deletions(-) + +diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c +index 0608aae72ccc..0153abdbbc8d 100644 +--- a/drivers/pci/p2pdma.c ++++ b/drivers/pci/p2pdma.c +@@ -292,10 +292,41 @@ static const struct pci_p2pdma_whitelist_entry { + {} + }; + ++/* ++ * This lookup function tries to find the PCI device corresponding to a given ++ * host bridge. ++ * ++ * It assumes the host bridge device is the first PCI device in the ++ * bus->devices list and that the devfn is 00.0. These assumptions should hold ++ * for all the devices in the whitelist above. ++ * ++ * This function is equivalent to pci_get_slot(host->bus, 0), however it does ++ * not take the pci_bus_sem lock seeing __host_bridge_whitelist() must not ++ * sleep. ++ * ++ * For this to be safe, the caller should hold a reference to a device on the ++ * bridge, which should ensure the host_bridge device will not be freed ++ * or removed from the head of the devices list. ++ */ ++static struct pci_dev *pci_host_bridge_dev(struct pci_host_bridge *host) ++{ ++ struct pci_dev *root; ++ ++ root = list_first_entry_or_null(&host->bus->devices, ++ struct pci_dev, bus_list); ++ ++ if (!root) ++ return NULL; ++ if (root->devfn != PCI_DEVFN(0, 0)) ++ return NULL; ++ ++ return root; ++} ++ + static bool __host_bridge_whitelist(struct pci_host_bridge *host, + bool same_host_bridge) + { +- struct pci_dev *root = pci_get_slot(host->bus, PCI_DEVFN(0, 0)); ++ struct pci_dev *root = pci_host_bridge_dev(host); + const struct pci_p2pdma_whitelist_entry *entry; + unsigned short vendor, device; + +@@ -304,7 +335,6 @@ static bool __host_bridge_whitelist(struct pci_host_bridge *host, + + vendor = root->vendor; + device = root->device; +- pci_dev_put(root); + + for (entry = pci_p2pdma_whitelist; entry->vendor; entry++) { + if (vendor != entry->vendor || device != entry->device) +-- +2.30.2 + diff --git a/queue-5.4/pci-sysfs-fix-dsm_label_utf16s_to_utf8s-buffer-overr.patch b/queue-5.4/pci-sysfs-fix-dsm_label_utf16s_to_utf8s-buffer-overr.patch new file mode 100644 index 00000000000..9cea63501ee --- /dev/null +++ b/queue-5.4/pci-sysfs-fix-dsm_label_utf16s_to_utf8s-buffer-overr.patch @@ -0,0 +1,47 @@ +From 2d12acd59a55ebd6e30e4ee8eec0d08a57af6a05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 00:01:12 +0000 +Subject: PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Wilczyński + +[ Upstream commit bdcdaa13ad96f1a530711c29e6d4b8311eff767c ] + +"utf16s_to_utf8s(..., buf, PAGE_SIZE)" puts up to PAGE_SIZE bytes into +"buf" and returns the number of bytes it actually put there. If it wrote +PAGE_SIZE bytes, the newline added by dsm_label_utf16s_to_utf8s() would +overrun "buf". + +Reduce the size available for utf16s_to_utf8s() to use so there is always +space for the newline. + +[bhelgaas: reorder patch in series, commit log] +Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs") +Link: https://lore.kernel.org/r/20210603000112.703037-7-kw@linux.com +Reported-by: Joe Perches +Signed-off-by: Krzysztof Wilczyński +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/pci-label.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c +index a5910f942857..9fb4ef568f40 100644 +--- a/drivers/pci/pci-label.c ++++ b/drivers/pci/pci-label.c +@@ -162,7 +162,7 @@ static void dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf) + len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer, + obj->buffer.length, + UTF16_LITTLE_ENDIAN, +- buf, PAGE_SIZE); ++ buf, PAGE_SIZE - 1); + buf[len] = '\n'; + } + +-- +2.30.2 + diff --git a/queue-5.4/pci-tegra-add-missing-module_device_table.patch b/queue-5.4/pci-tegra-add-missing-module_device_table.patch new file mode 100644 index 00000000000..0142dd4d284 --- /dev/null +++ b/queue-5.4/pci-tegra-add-missing-module_device_table.patch @@ -0,0 +1,39 @@ +From 8decdc240252146884df9b5db6ca26742ac972fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 12:07:02 +0800 +Subject: PCI: tegra: Add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit 7bf475a4614a9722b9b989e53184a02596cf16d1 ] + +Add missing MODULE_DEVICE_TABLE definition so we generate correct modalias +for automatic loading of this driver when it is built as a module. + +Link: https://lore.kernel.org/r/1620792422-16535-1-git-send-email-zou_wei@huawei.com +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Bjorn Helgaas +Reviewed-by: Vidya Sagar +Acked-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-tegra.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c +index cfa3c83d6cc7..99d505a85067 100644 +--- a/drivers/pci/controller/pci-tegra.c ++++ b/drivers/pci/controller/pci-tegra.c +@@ -2613,6 +2613,7 @@ static const struct of_device_id tegra_pcie_of_match[] = { + { .compatible = "nvidia,tegra20-pcie", .data = &tegra20_pcie }, + { }, + }; ++MODULE_DEVICE_TABLE(of, tegra_pcie_of_match); + + static void *tegra_pcie_ports_seq_start(struct seq_file *s, loff_t *pos) + { +-- +2.30.2 + diff --git a/queue-5.4/perf-report-fix-task-and-stat-with-pipe-input.patch b/queue-5.4/perf-report-fix-task-and-stat-with-pipe-input.patch new file mode 100644 index 00000000000..a5f0e1175f3 --- /dev/null +++ b/queue-5.4/perf-report-fix-task-and-stat-with-pipe-input.patch @@ -0,0 +1,104 @@ +From a044fe34a5c7ef2fe5298261b9297f88e75849a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Jun 2021 21:30:58 -0700 +Subject: perf report: Fix --task and --stat with pipe input + +From: Namhyung Kim + +[ Upstream commit 892ba7f18621a02af4428c58d97451f64685dba4 ] + +Current 'perf report' fails to process a pipe input when --task or +--stat options are used. This is because they reset all the tool +callbacks and fails to find a matching event for a sample. + +When pipe input is used, the event info is passed via ATTR records so it +needs to handle that operation. Otherwise the following error occurs. +Note, -14 (= -EFAULT) comes from evlist__parse_sample(): + + # perf record -a -o- sleep 1 | perf report -i- --stat + Can't parse sample, err = -14 + 0x271044 [0x38]: failed to process type: 9 + Error: + failed to process sample + # + +Committer testing: + +Before: + + $ perf record -o- sleep 1 | perf report -i- --stat + Can't parse sample, err = -14 + [ perf record: Woken up 1 times to write data ] + 0x1350 [0x30]: failed to process type: 9 + Error: + failed to process sample + [ perf record: Captured and wrote 0.000 MB - ] + $ + +After: + + $ perf record -o- sleep 1 | perf report -i- --stat + [ perf record: Woken up 1 times to write data ] + [ perf record: Captured and wrote 0.000 MB - ] + + Aggregated stats: + TOTAL events: 41 + COMM events: 2 ( 4.9%) + EXIT events: 1 ( 2.4%) + SAMPLE events: 9 (22.0%) + MMAP2 events: 4 ( 9.8%) + ATTR events: 1 ( 2.4%) + FINISHED_ROUND events: 1 ( 2.4%) + THREAD_MAP events: 1 ( 2.4%) + CPU_MAP events: 1 ( 2.4%) + EVENT_UPDATE events: 1 ( 2.4%) + TIME_CONV events: 1 ( 2.4%) + FEATURE events: 19 (46.3%) + cycles:uhH stats: + SAMPLE events: 9 + $ + +Fixes: a4a4d0a7a2b20f78 ("perf report: Add --stats option to display quick data statistics") +Signed-off-by: Namhyung Kim +Acked-by: Jiri Olsa +Tested-by: Arnaldo Carvalho de Melo +Cc: Andi Kleen +Cc: Ian Rogers +Cc: Peter Zijlstra +Link: http://lore.kernel.org/lkml/20210630043058.1131295-1-namhyung@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/builtin-report.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index d3c0b04e2e22..60beb2d5b164 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -666,9 +666,14 @@ static void report__output_resort(struct report *rep) + ui_progress__finish(); + } + ++static int process_attr(struct perf_tool *tool __maybe_unused, ++ union perf_event *event, ++ struct evlist **pevlist); ++ + static void stats_setup(struct report *rep) + { + memset(&rep->tool, 0, sizeof(rep->tool)); ++ rep->tool.attr = process_attr; + rep->tool.no_warn = true; + } + +@@ -688,6 +693,7 @@ static void tasks_setup(struct report *rep) + rep->tool.mmap = perf_event__process_mmap; + rep->tool.mmap2 = perf_event__process_mmap2; + } ++ rep->tool.attr = process_attr; + rep->tool.comm = perf_event__process_comm; + rep->tool.exit = perf_event__process_exit; + rep->tool.fork = perf_event__process_fork; +-- +2.30.2 + diff --git a/queue-5.4/power-reset-gpio-poweroff-add-missing-module_device_.patch b/queue-5.4/power-reset-gpio-poweroff-add-missing-module_device_.patch new file mode 100644 index 00000000000..9653ac1b621 --- /dev/null +++ b/queue-5.4/power-reset-gpio-poweroff-add-missing-module_device_.patch @@ -0,0 +1,36 @@ +From b810dc48bc8f4a4d853e4f19eae6fa1dc276dd3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:14:59 +0800 +Subject: power: reset: gpio-poweroff: add missing MODULE_DEVICE_TABLE + +From: Bixuan Cui + +[ Upstream commit ed3443fb4df4e140a22f65144546c8a8e1e27f4e ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Bixuan Cui +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/reset/gpio-poweroff.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/reset/gpio-poweroff.c b/drivers/power/reset/gpio-poweroff.c +index 6a4bbb506551..97d1f58efef4 100644 +--- a/drivers/power/reset/gpio-poweroff.c ++++ b/drivers/power/reset/gpio-poweroff.c +@@ -90,6 +90,7 @@ static const struct of_device_id of_gpio_poweroff_match[] = { + { .compatible = "gpio-poweroff", }, + {}, + }; ++MODULE_DEVICE_TABLE(of, of_gpio_poweroff_match); + + static struct platform_driver gpio_poweroff_driver = { + .probe = gpio_poweroff_probe, +-- +2.30.2 + diff --git a/queue-5.4/power-supply-ab8500-add-missing-module_device_table.patch b/queue-5.4/power-supply-ab8500-add-missing-module_device_table.patch new file mode 100644 index 00000000000..29f8d0da256 --- /dev/null +++ b/queue-5.4/power-supply-ab8500-add-missing-module_device_table.patch @@ -0,0 +1,62 @@ +From f57f11f9101095de8b75a3547cfc38066c3bb901 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Jun 2021 09:21:41 +0800 +Subject: power: supply: ab8500: add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit dfe52db13ab8d24857a9840ec7ca75eef800c26c ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/ab8500_btemp.c | 1 + + drivers/power/supply/ab8500_charger.c | 1 + + drivers/power/supply/ab8500_fg.c | 1 + + 3 files changed, 3 insertions(+) + +diff --git a/drivers/power/supply/ab8500_btemp.c b/drivers/power/supply/ab8500_btemp.c +index 8fe81259bfd9..c8a22df65036 100644 +--- a/drivers/power/supply/ab8500_btemp.c ++++ b/drivers/power/supply/ab8500_btemp.c +@@ -1120,6 +1120,7 @@ static const struct of_device_id ab8500_btemp_match[] = { + { .compatible = "stericsson,ab8500-btemp", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, ab8500_btemp_match); + + static struct platform_driver ab8500_btemp_driver = { + .probe = ab8500_btemp_probe, +diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c +index 90dbf3760e83..28e9d4f9ab8c 100644 +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -3633,6 +3633,7 @@ static const struct of_device_id ab8500_charger_match[] = { + { .compatible = "stericsson,ab8500-charger", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, ab8500_charger_match); + + static struct platform_driver ab8500_charger_driver = { + .probe = ab8500_charger_probe, +diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c +index 6fc4bc30644c..69452fc085b9 100644 +--- a/drivers/power/supply/ab8500_fg.c ++++ b/drivers/power/supply/ab8500_fg.c +@@ -3230,6 +3230,7 @@ static const struct of_device_id ab8500_fg_match[] = { + { .compatible = "stericsson,ab8500-fg", }, + { }, + }; ++MODULE_DEVICE_TABLE(of, ab8500_fg_match); + + static struct platform_driver ab8500_fg_driver = { + .probe = ab8500_fg_probe, +-- +2.30.2 + diff --git a/queue-5.4/power-supply-ab8500-avoid-null-pointers.patch b/queue-5.4/power-supply-ab8500-avoid-null-pointers.patch new file mode 100644 index 00000000000..0f04d6e156a --- /dev/null +++ b/queue-5.4/power-supply-ab8500-avoid-null-pointers.patch @@ -0,0 +1,60 @@ +From fec5a08e50d2643a60630ca67c32799a315d75f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 May 2021 00:50:41 +0200 +Subject: power: supply: ab8500: Avoid NULL pointers + +From: Linus Walleij + +[ Upstream commit 5bcb5087c9dd3dca1ff0ebd8002c5313c9332b56 ] + +Sometimes the code will crash because we haven't enabled +AC or USB charging and thus not created the corresponding +psy device. Fix it by checking that it is there before +notifying. + +Signed-off-by: Linus Walleij +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/ab8500_charger.c | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c +index e51d0e72beea..90dbf3760e83 100644 +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -407,6 +407,14 @@ disable_otp: + static void ab8500_power_supply_changed(struct ab8500_charger *di, + struct power_supply *psy) + { ++ /* ++ * This happens if we get notifications or interrupts and ++ * the platform has been configured not to support one or ++ * other type of charging. ++ */ ++ if (!psy) ++ return; ++ + if (di->autopower_cfg) { + if (!di->usb.charger_connected && + !di->ac.charger_connected && +@@ -433,7 +441,15 @@ static void ab8500_charger_set_usb_connected(struct ab8500_charger *di, + if (!connected) + di->flags.vbus_drop_end = false; + +- sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL, "present"); ++ /* ++ * Sometimes the platform is configured not to support ++ * USB charging and no psy has been created, but we still ++ * will get these notifications. ++ */ ++ if (di->usb_chg.psy) { ++ sysfs_notify(&di->usb_chg.psy->dev.kobj, NULL, ++ "present"); ++ } + + if (connected) { + mutex_lock(&di->charger_attached_mutex); +-- +2.30.2 + diff --git a/queue-5.4/power-supply-charger-manager-add-missing-module_devi.patch b/queue-5.4/power-supply-charger-manager-add-missing-module_devi.patch new file mode 100644 index 00000000000..6ca4cd5a5cc --- /dev/null +++ b/queue-5.4/power-supply-charger-manager-add-missing-module_devi.patch @@ -0,0 +1,36 @@ +From fb337335793bfc4aff3e4cac0bfad2ee13e327b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Jun 2021 09:21:54 +0800 +Subject: power: supply: charger-manager: add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit 073b5d5b1f9cc94a3eea25279fbafee3f4f5f097 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/charger-manager.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/supply/charger-manager.c b/drivers/power/supply/charger-manager.c +index a21e1a2673f8..1a215b6d9447 100644 +--- a/drivers/power/supply/charger-manager.c ++++ b/drivers/power/supply/charger-manager.c +@@ -1470,6 +1470,7 @@ static const struct of_device_id charger_manager_match[] = { + }, + {}, + }; ++MODULE_DEVICE_TABLE(of, charger_manager_match); + + static struct charger_desc *of_cm_parse_desc(struct device *dev) + { +-- +2.30.2 + diff --git a/queue-5.4/power-supply-max17042-do-not-enforce-incorrect-inter.patch b/queue-5.4/power-supply-max17042-do-not-enforce-incorrect-inter.patch new file mode 100644 index 00000000000..4705aec4e5a --- /dev/null +++ b/queue-5.4/power-supply-max17042-do-not-enforce-incorrect-inter.patch @@ -0,0 +1,47 @@ +From ea8ccd1d3e2c5507309fefd66d21c307d66fe93b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 May 2021 13:20:35 -0400 +Subject: power: supply: max17042: Do not enforce (incorrect) interrupt trigger + type + +From: Krzysztof Kozlowski + +[ Upstream commit 7fbf6b731bca347700e460d94b130f9d734b33e9 ] + +Interrupt line can be configured on different hardware in different way, +even inverted. Therefore driver should not enforce specific trigger +type - edge falling - but instead rely on Devicetree to configure it. + +The Maxim 17047/77693 datasheets describe the interrupt line as active +low with a requirement of acknowledge from the CPU therefore the edge +falling is not correct. + +The interrupt line is shared between PMIC and RTC driver, so using level +sensitive interrupt is here especially important to avoid races. With +an edge configuration in case if first PMIC signals interrupt followed +shortly after by the RTC, the interrupt might not be yet cleared/acked +thus the second one would not be noticed. + +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/max17042_battery.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c +index 0dfad2cf13fe..fa862f0380c4 100644 +--- a/drivers/power/supply/max17042_battery.c ++++ b/drivers/power/supply/max17042_battery.c +@@ -1076,7 +1076,7 @@ static int max17042_probe(struct i2c_client *client, + } + + if (client->irq) { +- unsigned int flags = IRQF_TRIGGER_FALLING | IRQF_ONESHOT; ++ unsigned int flags = IRQF_ONESHOT; + + /* + * On ACPI systems the IRQ may be handled by ACPI-event code, +-- +2.30.2 + diff --git a/queue-5.4/power-supply-rt5033_battery-fix-device-tree-enumerat.patch b/queue-5.4/power-supply-rt5033_battery-fix-device-tree-enumerat.patch new file mode 100644 index 00000000000..5e7237ca41e --- /dev/null +++ b/queue-5.4/power-supply-rt5033_battery-fix-device-tree-enumerat.patch @@ -0,0 +1,67 @@ +From b467f1b5546c84023b3627a585b72b60cca4eba3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 12:51:12 +0200 +Subject: power: supply: rt5033_battery: Fix device tree enumeration + +From: Stephan Gerhold + +[ Upstream commit f3076cd8d1d5fa64b5e1fa5affc045c2fc123baa ] + +The fuel gauge in the RT5033 PMIC has its own I2C bus and interrupt +line. Therefore, it is not actually part of the RT5033 MFD and needs +its own of_match_table to probe properly. + +Also, given that it's independent of the MFD, there is actually +no need to make the Kconfig depend on MFD_RT5033. Although the driver +uses the shared header, there is no compile +or runtime dependency on the RT5033 MFD driver. + +Cc: Beomho Seo +Cc: Chanwoo Choi +Fixes: b847dd96e659 ("power: rt5033_battery: Add RT5033 Fuel gauge device driver") +Signed-off-by: Stephan Gerhold +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/Kconfig | 3 ++- + drivers/power/supply/rt5033_battery.c | 7 +++++++ + 2 files changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/power/supply/Kconfig b/drivers/power/supply/Kconfig +index d6fdc10c29f0..ffdb15278c10 100644 +--- a/drivers/power/supply/Kconfig ++++ b/drivers/power/supply/Kconfig +@@ -643,7 +643,8 @@ config BATTERY_GOLDFISH + + config BATTERY_RT5033 + tristate "RT5033 fuel gauge support" +- depends on MFD_RT5033 ++ depends on I2C ++ select REGMAP_I2C + help + This adds support for battery fuel gauge in Richtek RT5033 PMIC. + The fuelgauge calculates and determines the battery state of charge +diff --git a/drivers/power/supply/rt5033_battery.c b/drivers/power/supply/rt5033_battery.c +index d8667a9fc49b..6609f8cb8ca0 100644 +--- a/drivers/power/supply/rt5033_battery.c ++++ b/drivers/power/supply/rt5033_battery.c +@@ -164,9 +164,16 @@ static const struct i2c_device_id rt5033_battery_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, rt5033_battery_id); + ++static const struct of_device_id rt5033_battery_of_match[] = { ++ { .compatible = "richtek,rt5033-battery", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, rt5033_battery_of_match); ++ + static struct i2c_driver rt5033_battery_driver = { + .driver = { + .name = "rt5033-battery", ++ .of_match_table = rt5033_battery_of_match, + }, + .probe = rt5033_battery_probe, + .remove = rt5033_battery_remove, +-- +2.30.2 + diff --git a/queue-5.4/power-supply-sc2731_charger-add-missing-module_devic.patch b/queue-5.4/power-supply-sc2731_charger-add-missing-module_devic.patch new file mode 100644 index 00000000000..a2e52930a55 --- /dev/null +++ b/queue-5.4/power-supply-sc2731_charger-add-missing-module_devic.patch @@ -0,0 +1,36 @@ +From 3795a4a6af6eaac7ac0a3bc44a6b8348360302c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 14:17:12 +0800 +Subject: power: supply: sc2731_charger: Add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit 2aac79d14d76879c8e307820b31876e315b1b242 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/sc2731_charger.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/supply/sc2731_charger.c b/drivers/power/supply/sc2731_charger.c +index 335cb857ef30..288b79836c13 100644 +--- a/drivers/power/supply/sc2731_charger.c ++++ b/drivers/power/supply/sc2731_charger.c +@@ -524,6 +524,7 @@ static const struct of_device_id sc2731_charger_of_match[] = { + { .compatible = "sprd,sc2731-charger", }, + { } + }; ++MODULE_DEVICE_TABLE(of, sc2731_charger_of_match); + + static struct platform_driver sc2731_charger_driver = { + .driver = { +-- +2.30.2 + diff --git a/queue-5.4/power-supply-sc27xx-add-missing-module_device_table.patch b/queue-5.4/power-supply-sc27xx-add-missing-module_device_table.patch new file mode 100644 index 00000000000..13dc5c29f7e --- /dev/null +++ b/queue-5.4/power-supply-sc27xx-add-missing-module_device_table.patch @@ -0,0 +1,36 @@ +From d97ba6edcc74f6c8d4b2f7f78603e81daa9ee14e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 11:37:45 +0800 +Subject: power: supply: sc27xx: Add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit 603fcfb9d4ec1cad8d66d3bb37f3613afa8a661a ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/sc27xx_fuel_gauge.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/power/supply/sc27xx_fuel_gauge.c b/drivers/power/supply/sc27xx_fuel_gauge.c +index bc8f5bda5762..5e5bcdbf2e69 100644 +--- a/drivers/power/supply/sc27xx_fuel_gauge.c ++++ b/drivers/power/supply/sc27xx_fuel_gauge.c +@@ -1215,6 +1215,7 @@ static const struct of_device_id sc27xx_fgu_of_match[] = { + { .compatible = "sprd,sc2731-fgu", }, + { } + }; ++MODULE_DEVICE_TABLE(of, sc27xx_fgu_of_match); + + static struct platform_driver sc27xx_fgu_driver = { + .probe = sc27xx_fgu_probe, +-- +2.30.2 + diff --git a/queue-5.4/powerpc-boot-fixup-device-tree-on-little-endian.patch b/queue-5.4/powerpc-boot-fixup-device-tree-on-little-endian.patch new file mode 100644 index 00000000000..e700ad96cab --- /dev/null +++ b/queue-5.4/powerpc-boot-fixup-device-tree-on-little-endian.patch @@ -0,0 +1,243 @@ +From fe9155269846dde1a25b78a739706d261e2fcc6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 13:49:00 +1000 +Subject: powerpc/boot: Fixup device-tree on little endian + +From: Benjamin Herrenschmidt + +[ Upstream commit c93f80849bdd9b45d834053ae1336e28f0026c84 ] + +This fixes the core devtree.c functions and the ns16550 UART backend. + +Signed-off-by: Benjamin Herrenschmidt +Signed-off-by: Paul Mackerras +Reviewed-by: Segher Boessenkool +Acked-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/YMwXrPT8nc4YUdJ9@thinks.paulus.ozlabs.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/boot/devtree.c | 59 +++++++++++++++++++++---------------- + arch/powerpc/boot/ns16550.c | 9 ++++-- + 2 files changed, 41 insertions(+), 27 deletions(-) + +diff --git a/arch/powerpc/boot/devtree.c b/arch/powerpc/boot/devtree.c +index 5d91036ad626..58fbcfcc98c9 100644 +--- a/arch/powerpc/boot/devtree.c ++++ b/arch/powerpc/boot/devtree.c +@@ -13,6 +13,7 @@ + #include "string.h" + #include "stdio.h" + #include "ops.h" ++#include "of.h" + + void dt_fixup_memory(u64 start, u64 size) + { +@@ -23,21 +24,25 @@ void dt_fixup_memory(u64 start, u64 size) + root = finddevice("/"); + if (getprop(root, "#address-cells", &naddr, sizeof(naddr)) < 0) + naddr = 2; ++ else ++ naddr = be32_to_cpu(naddr); + if (naddr < 1 || naddr > 2) + fatal("Can't cope with #address-cells == %d in /\n\r", naddr); + + if (getprop(root, "#size-cells", &nsize, sizeof(nsize)) < 0) + nsize = 1; ++ else ++ nsize = be32_to_cpu(nsize); + if (nsize < 1 || nsize > 2) + fatal("Can't cope with #size-cells == %d in /\n\r", nsize); + + i = 0; + if (naddr == 2) +- memreg[i++] = start >> 32; +- memreg[i++] = start & 0xffffffff; ++ memreg[i++] = cpu_to_be32(start >> 32); ++ memreg[i++] = cpu_to_be32(start & 0xffffffff); + if (nsize == 2) +- memreg[i++] = size >> 32; +- memreg[i++] = size & 0xffffffff; ++ memreg[i++] = cpu_to_be32(size >> 32); ++ memreg[i++] = cpu_to_be32(size & 0xffffffff); + + memory = finddevice("/memory"); + if (! memory) { +@@ -45,9 +50,9 @@ void dt_fixup_memory(u64 start, u64 size) + setprop_str(memory, "device_type", "memory"); + } + +- printf("Memory <- <0x%x", memreg[0]); ++ printf("Memory <- <0x%x", be32_to_cpu(memreg[0])); + for (i = 1; i < (naddr + nsize); i++) +- printf(" 0x%x", memreg[i]); ++ printf(" 0x%x", be32_to_cpu(memreg[i])); + printf("> (%ldMB)\n\r", (unsigned long)(size >> 20)); + + setprop(memory, "reg", memreg, (naddr + nsize)*sizeof(u32)); +@@ -65,10 +70,10 @@ void dt_fixup_cpu_clocks(u32 cpu, u32 tb, u32 bus) + printf("CPU bus-frequency <- 0x%x (%dMHz)\n\r", bus, MHZ(bus)); + + while ((devp = find_node_by_devtype(devp, "cpu"))) { +- setprop_val(devp, "clock-frequency", cpu); +- setprop_val(devp, "timebase-frequency", tb); ++ setprop_val(devp, "clock-frequency", cpu_to_be32(cpu)); ++ setprop_val(devp, "timebase-frequency", cpu_to_be32(tb)); + if (bus > 0) +- setprop_val(devp, "bus-frequency", bus); ++ setprop_val(devp, "bus-frequency", cpu_to_be32(bus)); + } + + timebase_period_ns = 1000000000 / tb; +@@ -80,7 +85,7 @@ void dt_fixup_clock(const char *path, u32 freq) + + if (devp) { + printf("%s: clock-frequency <- %x (%dMHz)\n\r", path, freq, MHZ(freq)); +- setprop_val(devp, "clock-frequency", freq); ++ setprop_val(devp, "clock-frequency", cpu_to_be32(freq)); + } + } + +@@ -133,8 +138,12 @@ void dt_get_reg_format(void *node, u32 *naddr, u32 *nsize) + { + if (getprop(node, "#address-cells", naddr, 4) != 4) + *naddr = 2; ++ else ++ *naddr = be32_to_cpu(*naddr); + if (getprop(node, "#size-cells", nsize, 4) != 4) + *nsize = 1; ++ else ++ *nsize = be32_to_cpu(*nsize); + } + + static void copy_val(u32 *dest, u32 *src, int naddr) +@@ -163,9 +172,9 @@ static int add_reg(u32 *reg, u32 *add, int naddr) + int i, carry = 0; + + for (i = MAX_ADDR_CELLS - 1; i >= MAX_ADDR_CELLS - naddr; i--) { +- u64 tmp = (u64)reg[i] + add[i] + carry; ++ u64 tmp = (u64)be32_to_cpu(reg[i]) + be32_to_cpu(add[i]) + carry; + carry = tmp >> 32; +- reg[i] = (u32)tmp; ++ reg[i] = cpu_to_be32((u32)tmp); + } + + return !carry; +@@ -180,18 +189,18 @@ static int compare_reg(u32 *reg, u32 *range, u32 *rangesize) + u32 end; + + for (i = 0; i < MAX_ADDR_CELLS; i++) { +- if (reg[i] < range[i]) ++ if (be32_to_cpu(reg[i]) < be32_to_cpu(range[i])) + return 0; +- if (reg[i] > range[i]) ++ if (be32_to_cpu(reg[i]) > be32_to_cpu(range[i])) + break; + } + + for (i = 0; i < MAX_ADDR_CELLS; i++) { +- end = range[i] + rangesize[i]; ++ end = be32_to_cpu(range[i]) + be32_to_cpu(rangesize[i]); + +- if (reg[i] < end) ++ if (be32_to_cpu(reg[i]) < end) + break; +- if (reg[i] > end) ++ if (be32_to_cpu(reg[i]) > end) + return 0; + } + +@@ -240,7 +249,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + return 0; + + dt_get_reg_format(parent, &naddr, &nsize); +- + if (nsize > 2) + return 0; + +@@ -252,10 +260,10 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + + copy_val(last_addr, prop_buf + offset, naddr); + +- ret_size = prop_buf[offset + naddr]; ++ ret_size = be32_to_cpu(prop_buf[offset + naddr]); + if (nsize == 2) { + ret_size <<= 32; +- ret_size |= prop_buf[offset + naddr + 1]; ++ ret_size |= be32_to_cpu(prop_buf[offset + naddr + 1]); + } + + for (;;) { +@@ -278,7 +286,6 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + + offset = find_range(last_addr, prop_buf, prev_naddr, + naddr, prev_nsize, buflen / 4); +- + if (offset < 0) + return 0; + +@@ -296,8 +303,7 @@ static int dt_xlate(void *node, int res, int reglen, unsigned long *addr, + if (naddr > 2) + return 0; + +- ret_addr = ((u64)last_addr[2] << 32) | last_addr[3]; +- ++ ret_addr = ((u64)be32_to_cpu(last_addr[2]) << 32) | be32_to_cpu(last_addr[3]); + if (sizeof(void *) == 4 && + (ret_addr >= 0x100000000ULL || ret_size > 0x100000000ULL || + ret_addr + ret_size > 0x100000000ULL)) +@@ -350,11 +356,14 @@ int dt_is_compatible(void *node, const char *compat) + int dt_get_virtual_reg(void *node, void **addr, int nres) + { + unsigned long xaddr; +- int n; ++ int n, i; + + n = getprop(node, "virtual-reg", addr, nres * 4); +- if (n > 0) ++ if (n > 0) { ++ for (i = 0; i < n/4; i ++) ++ ((u32 *)addr)[i] = be32_to_cpu(((u32 *)addr)[i]); + return n / 4; ++ } + + for (n = 0; n < nres; n++) { + if (!dt_xlate_reg(node, n, &xaddr, NULL)) +diff --git a/arch/powerpc/boot/ns16550.c b/arch/powerpc/boot/ns16550.c +index b0da4466d419..f16d2be1d0f3 100644 +--- a/arch/powerpc/boot/ns16550.c ++++ b/arch/powerpc/boot/ns16550.c +@@ -15,6 +15,7 @@ + #include "stdio.h" + #include "io.h" + #include "ops.h" ++#include "of.h" + + #define UART_DLL 0 /* Out: Divisor Latch Low */ + #define UART_DLM 1 /* Out: Divisor Latch High */ +@@ -58,16 +59,20 @@ int ns16550_console_init(void *devp, struct serial_console_data *scdp) + int n; + u32 reg_offset; + +- if (dt_get_virtual_reg(devp, (void **)®_base, 1) < 1) ++ if (dt_get_virtual_reg(devp, (void **)®_base, 1) < 1) { ++ printf("virt reg parse fail...\r\n"); + return -1; ++ } + + n = getprop(devp, "reg-offset", ®_offset, sizeof(reg_offset)); + if (n == sizeof(reg_offset)) +- reg_base += reg_offset; ++ reg_base += be32_to_cpu(reg_offset); + + n = getprop(devp, "reg-shift", ®_shift, sizeof(reg_shift)); + if (n != sizeof(reg_shift)) + reg_shift = 0; ++ else ++ reg_shift = be32_to_cpu(reg_shift); + + scdp->open = ns16550_open; + scdp->putc = ns16550_putc; +-- +2.30.2 + diff --git a/queue-5.4/powerpc-ps3-add-dma_mask-to-ps3_dma_region.patch b/queue-5.4/powerpc-ps3-add-dma_mask-to-ps3_dma_region.patch new file mode 100644 index 00000000000..9e0a6a2d3e6 --- /dev/null +++ b/queue-5.4/powerpc-ps3-add-dma_mask-to-ps3_dma_region.patch @@ -0,0 +1,93 @@ +From 0a78137a344627fb8895fc407e6c83298f11a326 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Jun 2021 19:17:02 +0000 +Subject: powerpc/ps3: Add dma_mask to ps3_dma_region + +From: Geoff Levand + +[ Upstream commit 9733862e50fdba55e7f1554e4286fcc5302ff28e ] + +Commit f959dcd6ddfd29235030e8026471ac1b022ad2b0 (dma-direct: Fix +potential NULL pointer dereference) added a null check on the +dma_mask pointer of the kernel's device structure. + +Add a dma_mask variable to the ps3_dma_region structure and set +the device structure's dma_mask pointer to point to this new variable. + +Fixes runtime errors like these: +# WARNING: Fixes tag on line 10 doesn't match correct format +# WARNING: Fixes tag on line 10 doesn't match correct format + + ps3_system_bus_match:349: dev=8.0(sb_01), drv=8.0(ps3flash): match + WARNING: CPU: 0 PID: 1 at kernel/dma/mapping.c:151 .dma_map_page_attrs+0x34/0x1e0 + ps3flash sb_01: ps3stor_setup:193: map DMA region failed + +Signed-off-by: Geoff Levand +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/562d0c9ea0100a30c3b186bcc7adb34b0bbd2cd7.1622746428.git.geoff@infradead.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/ps3.h | 2 ++ + arch/powerpc/platforms/ps3/mm.c | 12 ++++++++++++ + 2 files changed, 14 insertions(+) + +diff --git a/arch/powerpc/include/asm/ps3.h b/arch/powerpc/include/asm/ps3.h +index cb89e4bf55ce..964063765662 100644 +--- a/arch/powerpc/include/asm/ps3.h ++++ b/arch/powerpc/include/asm/ps3.h +@@ -71,6 +71,7 @@ struct ps3_dma_region_ops; + * @bus_addr: The 'translated' bus address of the region. + * @len: The length in bytes of the region. + * @offset: The offset from the start of memory of the region. ++ * @dma_mask: Device dma_mask. + * @ioid: The IOID of the device who owns this region + * @chunk_list: Opaque variable used by the ioc page manager. + * @region_ops: struct ps3_dma_region_ops - dma region operations +@@ -85,6 +86,7 @@ struct ps3_dma_region { + enum ps3_dma_region_type region_type; + unsigned long len; + unsigned long offset; ++ u64 dma_mask; + + /* driver variables (set by ps3_dma_region_create) */ + unsigned long bus_addr; +diff --git a/arch/powerpc/platforms/ps3/mm.c b/arch/powerpc/platforms/ps3/mm.c +index f42fe4e86ce5..c3e374669400 100644 +--- a/arch/powerpc/platforms/ps3/mm.c ++++ b/arch/powerpc/platforms/ps3/mm.c +@@ -6,6 +6,7 @@ + * Copyright 2006 Sony Corp. + */ + ++#include + #include + #include + #include +@@ -1118,6 +1119,7 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev, + enum ps3_dma_region_type region_type, void *addr, unsigned long len) + { + unsigned long lpar_addr; ++ int result; + + lpar_addr = addr ? ps3_mm_phys_to_lpar(__pa(addr)) : 0; + +@@ -1129,6 +1131,16 @@ int ps3_dma_region_init(struct ps3_system_bus_device *dev, + r->offset -= map.r1.offset; + r->len = len ? len : _ALIGN_UP(map.total, 1 << r->page_size); + ++ dev->core.dma_mask = &r->dma_mask; ++ ++ result = dma_set_mask_and_coherent(&dev->core, DMA_BIT_MASK(32)); ++ ++ if (result < 0) { ++ dev_err(&dev->core, "%s:%d: dma_set_mask_and_coherent failed: %d\n", ++ __func__, __LINE__, result); ++ return result; ++ } ++ + switch (dev->dev_type) { + case PS3_DEVICE_TYPE_SB: + r->region_ops = (USE_DYNAMIC_DMA) +-- +2.30.2 + diff --git a/queue-5.4/pwm-img-fix-pm-reference-leak-in-img_pwm_enable.patch b/queue-5.4/pwm-img-fix-pm-reference-leak-in-img_pwm_enable.patch new file mode 100644 index 00000000000..209ad0124f1 --- /dev/null +++ b/queue-5.4/pwm-img-fix-pm-reference-leak-in-img_pwm_enable.patch @@ -0,0 +1,38 @@ +From f91d7795082fa9e7758f5f22ad89a762354c4a64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 11:57:17 +0800 +Subject: pwm: img: Fix PM reference leak in img_pwm_enable() + +From: Zou Wei + +[ Upstream commit fde25294dfd8e36e4e30b693c27a86232864002a ] + +pm_runtime_get_sync will increment pm usage counter even it failed. +Forgetting to putting operation will result in reference leak here. +Fix it by replacing it with pm_runtime_resume_and_get to keep usage +counter balanced. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-img.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pwm/pwm-img.c b/drivers/pwm/pwm-img.c +index a34d95ed70b2..22c002e685b3 100644 +--- a/drivers/pwm/pwm-img.c ++++ b/drivers/pwm/pwm-img.c +@@ -156,7 +156,7 @@ static int img_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm) + struct img_pwm_chip *pwm_chip = to_img_pwm_chip(chip); + int ret; + +- ret = pm_runtime_get_sync(chip->dev); ++ ret = pm_runtime_resume_and_get(chip->dev); + if (ret < 0) + return ret; + +-- +2.30.2 + diff --git a/queue-5.4/pwm-imx1-don-t-disable-clocks-at-device-remove-time.patch b/queue-5.4/pwm-imx1-don-t-disable-clocks-at-device-remove-time.patch new file mode 100644 index 00000000000..7819e2f1485 --- /dev/null +++ b/queue-5.4/pwm-imx1-don-t-disable-clocks-at-device-remove-time.patch @@ -0,0 +1,44 @@ +From c4c87d51ae2764f57a0f226e87dea9fcbe4df98a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 08:35:27 +0200 +Subject: pwm: imx1: Don't disable clocks at device remove time +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 1bc6ea31cb41d50302a3c9b401964cf0a88d41f9 ] + +The .remove() callback disables clocks that were not enabled in +.probe(). So just probing and then unbinding the driver results in a clk +enable imbalance. + +So just drop the call to disable the clocks. (Which BTW was also in the +wrong order because the call makes the PWM unfunctional and so should +have come only after pwmchip_remove()). + +Fixes: 9f4c8f9607c3 ("pwm: imx: Add ipg clock operation") +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-imx1.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/pwm/pwm-imx1.c b/drivers/pwm/pwm-imx1.c +index f8b2c2e001a7..c17652c40e14 100644 +--- a/drivers/pwm/pwm-imx1.c ++++ b/drivers/pwm/pwm-imx1.c +@@ -180,8 +180,6 @@ static int pwm_imx1_remove(struct platform_device *pdev) + { + struct pwm_imx1_chip *imx = platform_get_drvdata(pdev); + +- pwm_imx1_clk_disable_unprepare(&imx->chip); +- + return pwmchip_remove(&imx->chip); + } + +-- +2.30.2 + diff --git a/queue-5.4/pwm-spear-don-t-modify-hw-state-in-.remove-callback.patch b/queue-5.4/pwm-spear-don-t-modify-hw-state-in-.remove-callback.patch new file mode 100644 index 00000000000..7959aadc724 --- /dev/null +++ b/queue-5.4/pwm-spear-don-t-modify-hw-state-in-.remove-callback.patch @@ -0,0 +1,45 @@ +From e03a263cc0acbc3065fefd469b69c221ea2a1d39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Apr 2021 11:05:24 +0200 +Subject: pwm: spear: Don't modify HW state in .remove callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit b601a18f12383001e7a8da238de7ca1559ebc450 ] + +A consumer is expected to disable a PWM before calling pwm_put(). And if +they didn't there is hopefully a good reason (or the consumer needs +fixing). Also if disabling an enabled PWM was the right thing to do, +this should better be done in the framework instead of in each low level +driver. + +So drop the hardware modification from the .remove() callback. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-spear.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/pwm/pwm-spear.c b/drivers/pwm/pwm-spear.c +index 6c6b44fd3f43..2d11ac277de8 100644 +--- a/drivers/pwm/pwm-spear.c ++++ b/drivers/pwm/pwm-spear.c +@@ -231,10 +231,6 @@ static int spear_pwm_probe(struct platform_device *pdev) + static int spear_pwm_remove(struct platform_device *pdev) + { + struct spear_pwm_chip *pc = platform_get_drvdata(pdev); +- int i; +- +- for (i = 0; i < NUM_PWM; i++) +- pwm_disable(&pc->chip.pwms[i]); + + /* clk was prepared in probe, hence unprepare it here */ + clk_unprepare(pc->clk); +-- +2.30.2 + diff --git a/queue-5.4/pwm-tegra-don-t-modify-hw-state-in-.remove-callback.patch b/queue-5.4/pwm-tegra-don-t-modify-hw-state-in-.remove-callback.patch new file mode 100644 index 00000000000..b770ed7da1f --- /dev/null +++ b/queue-5.4/pwm-tegra-don-t-modify-hw-state-in-.remove-callback.patch @@ -0,0 +1,61 @@ +From d2a4916dc1085ee813541bd928b2e28262c89148 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 11:51:41 +0200 +Subject: pwm: tegra: Don't modify HW state in .remove callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 86f7fa71cd830d18d7ebcaf719dffd5ddfe1acdd ] + +A consumer is expected to disable a PWM before calling pwm_put(). And if +they didn't there is hopefully a good reason (or the consumer needs +fixing). Also if disabling an enabled PWM was the right thing to do, +this should better be done in the framework instead of in each low level +driver. + +So drop the hardware modification from the .remove() callback. + +Signed-off-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-tegra.c | 13 ------------- + 1 file changed, 13 deletions(-) + +diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c +index aa12fb3ed92e..3d55e30a6866 100644 +--- a/drivers/pwm/pwm-tegra.c ++++ b/drivers/pwm/pwm-tegra.c +@@ -232,7 +232,6 @@ static int tegra_pwm_probe(struct platform_device *pdev) + static int tegra_pwm_remove(struct platform_device *pdev) + { + struct tegra_pwm_chip *pc = platform_get_drvdata(pdev); +- unsigned int i; + int err; + + if (WARN_ON(!pc)) +@@ -242,18 +241,6 @@ static int tegra_pwm_remove(struct platform_device *pdev) + if (err < 0) + return err; + +- for (i = 0; i < pc->chip.npwm; i++) { +- struct pwm_device *pwm = &pc->chip.pwms[i]; +- +- if (!pwm_is_enabled(pwm)) +- if (clk_prepare_enable(pc->clk) < 0) +- continue; +- +- pwm_writel(pc, i, 0); +- +- clk_disable_unprepare(pc->clk); +- } +- + reset_control_assert(pc->rst); + clk_disable_unprepare(pc->clk); + +-- +2.30.2 + diff --git a/queue-5.4/reset-a10sr-add-missing-of_match_table-reference.patch b/queue-5.4/reset-a10sr-add-missing-of_match_table-reference.patch new file mode 100644 index 00000000000..35b504266f7 --- /dev/null +++ b/queue-5.4/reset-a10sr-add-missing-of_match_table-reference.patch @@ -0,0 +1,44 @@ +From 2fc94e99ffd0cfef4c38c0da9cf4efc05db8fa36 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 May 2021 07:28:03 -0400 +Subject: reset: a10sr: add missing of_match_table reference +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Kozlowski + +[ Upstream commit 466ba3c8ff4fae39e455ff8d080b3d5503302765 ] + +The driver defined of_device_id table but did not use it with +of_match_table. This prevents usual matching via devicetree and causes +a W=1 warning: + + drivers/reset/reset-a10sr.c:111:34: warning: + ‘a10sr_reset_of_match’ defined but not used [-Wunused-const-variable=] + +Reported-by: kernel test robot +Fixes: 627006820268 ("reset: Add Altera Arria10 SR Reset Controller") +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20210507112803.20012-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/reset-a10sr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/reset/reset-a10sr.c b/drivers/reset/reset-a10sr.c +index 7eacc89382f8..99b3bc8382f3 100644 +--- a/drivers/reset/reset-a10sr.c ++++ b/drivers/reset/reset-a10sr.c +@@ -118,6 +118,7 @@ static struct platform_driver a10sr_reset_driver = { + .probe = a10sr_reset_probe, + .driver = { + .name = "altr_a10sr_reset", ++ .of_match_table = a10sr_reset_of_match, + }, + }; + module_platform_driver(a10sr_reset_driver); +-- +2.30.2 + diff --git a/queue-5.4/reset-bail-if-try_module_get-fails.patch b/queue-5.4/reset-bail-if-try_module_get-fails.patch new file mode 100644 index 00000000000..6d4f46dcf33 --- /dev/null +++ b/queue-5.4/reset-bail-if-try_module_get-fails.patch @@ -0,0 +1,44 @@ +From 327d7106ad96124c9193e6c6b5dcc25eac55855d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Jun 2021 10:26:15 +0200 +Subject: reset: bail if try_module_get() fails +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Philipp Zabel + +[ Upstream commit 4fb26fb83f0def3d39c14e268bcd4003aae8fade ] + +Abort instead of returning a new reset control for a reset controller +device that is going to have its module unloaded. + +Reported-by: Uwe Kleine-König +Fixes: 61fc41317666 ("reset: Add reset controller API") +Acked-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20210607082615.15160-1-p.zabel@pengutronix.de +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/core.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/reset/core.c b/drivers/reset/core.c +index 76c0dc7f165d..688b4f6227fc 100644 +--- a/drivers/reset/core.c ++++ b/drivers/reset/core.c +@@ -565,7 +565,10 @@ static struct reset_control *__reset_control_get_internal( + if (!rstc) + return ERR_PTR(-ENOMEM); + +- try_module_get(rcdev->owner); ++ if (!try_module_get(rcdev->owner)) { ++ kfree(rstc); ++ return ERR_PTR(-ENODEV); ++ } + + rstc->rcdev = rcdev; + list_add(&rstc->list, &rcdev->reset_control_head); +-- +2.30.2 + diff --git a/queue-5.4/reset-brcmstb-add-missing-module_device_table.patch b/queue-5.4/reset-brcmstb-add-missing-module_device_table.patch new file mode 100644 index 00000000000..130ee4ded32 --- /dev/null +++ b/queue-5.4/reset-brcmstb-add-missing-module_device_table.patch @@ -0,0 +1,38 @@ +From 8a65cb15b455f4390001d9cbe87137794cf86e07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 11:14:43 +0800 +Subject: reset: brcmstb: Add missing MODULE_DEVICE_TABLE + +From: Zou Wei + +[ Upstream commit e207457f9045343a24d936fbb67eb4b412f1c6ad ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this driver when it is built +as an external module. + +Reported-by: Hulk Robot +Fixes: 77750bc089e4 ("reset: Add Broadcom STB SW_INIT reset controller driver") +Signed-off-by: Zou Wei +Link: https://lore.kernel.org/r/1620789283-15048-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Philipp Zabel +Signed-off-by: Sasha Levin +--- + drivers/reset/reset-brcmstb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/reset/reset-brcmstb.c b/drivers/reset/reset-brcmstb.c +index f213264c8567..42c9d5241c53 100644 +--- a/drivers/reset/reset-brcmstb.c ++++ b/drivers/reset/reset-brcmstb.c +@@ -111,6 +111,7 @@ static const struct of_device_id brcmstb_reset_of_match[] = { + { .compatible = "brcm,brcmstb-reset" }, + { /* sentinel */ } + }; ++MODULE_DEVICE_TABLE(of, brcmstb_reset_of_match); + + static struct platform_driver brcmstb_reset_driver = { + .probe = brcmstb_reset_probe, +-- +2.30.2 + diff --git a/queue-5.4/revert-alsa-bebob-oxfw-fix-kconfig-entry-for-mackie-.patch b/queue-5.4/revert-alsa-bebob-oxfw-fix-kconfig-entry-for-mackie-.patch new file mode 100644 index 00000000000..4db0032c4c9 --- /dev/null +++ b/queue-5.4/revert-alsa-bebob-oxfw-fix-kconfig-entry-for-mackie-.patch @@ -0,0 +1,80 @@ +From 3d9dcdaa8df005c83c51f9e872f1733b009c8cfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 17:45:47 +0900 +Subject: Revert "ALSA: bebob/oxfw: fix Kconfig entry for Mackie d.2 Pro" + +From: Takashi Sakamoto + +[ Upstream commit 5d6fb80a142b5994355ce675c517baba6089d199 ] + +This reverts commit 0edabdfe89581669609eaac5f6a8d0ae6fe95e7f. + +I've explained that optional FireWire card for d.2 is also built-in to +d.2 Pro, however it's wrong. The optional card uses DM1000 ASIC and has +'Mackie DJ Mixer' in its model name of configuration ROM. On the other +hand, built-in FireWire card for d.2 Pro and d.4 Pro uses OXFW971 ASIC +and has 'd.Pro' in its model name according to manuals and user +experiences. The former card is not the card for d.2 Pro. They are similar +in appearance but different internally. + +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20210518084557.102681-2-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/Kconfig | 4 ++-- + sound/firewire/bebob/bebob.c | 2 +- + sound/firewire/oxfw/oxfw.c | 2 +- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/sound/firewire/Kconfig b/sound/firewire/Kconfig +index e6b4ca469b2a..c16d2dd9a66f 100644 +--- a/sound/firewire/Kconfig ++++ b/sound/firewire/Kconfig +@@ -38,7 +38,7 @@ config SND_OXFW + * Mackie(Loud) Onyx 1640i (former model) + * Mackie(Loud) Onyx Satellite + * Mackie(Loud) Tapco Link.Firewire +- * Mackie(Loud) d.4 pro ++ * Mackie(Loud) d.2 pro/d.4 pro (built-in FireWire card with OXFW971 ASIC) + * Mackie(Loud) U.420/U.420d + * TASCAM FireOne + * Stanton Controllers & Systems 1 Deck/Mixer +@@ -84,7 +84,7 @@ config SND_BEBOB + * PreSonus FIREBOX/FIREPOD/FP10/Inspire1394 + * BridgeCo RDAudio1/Audio5 + * Mackie Onyx 1220/1620/1640 (FireWire I/O Card) +- * Mackie d.2 (FireWire Option) and d.2 Pro ++ * Mackie d.2 (optional FireWire card with DM1000 ASIC) + * Stanton FinalScratch 2 (ScratchAmp) + * Tascam IF-FW/DM + * Behringer XENIX UFX 1204/1604 +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index 441c58283b47..eeb0e4b2f77a 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -387,7 +387,7 @@ static const struct ieee1394_device_id bebob_id_table[] = { + SND_BEBOB_DEV_ENTRY(VEN_BRIDGECO, 0x00010049, &spec_normal), + /* Mackie, Onyx 1220/1620/1640 (Firewire I/O Card) */ + SND_BEBOB_DEV_ENTRY(VEN_MACKIE2, 0x00010065, &spec_normal), +- // Mackie, d.2 (Firewire option card) and d.2 Pro (the card is built-in). ++ // Mackie, d.2 (optional Firewire card with DM1000). + SND_BEBOB_DEV_ENTRY(VEN_MACKIE1, 0x00010067, &spec_normal), + /* Stanton, ScratchAmp */ + SND_BEBOB_DEV_ENTRY(VEN_STANTON, 0x00000001, &spec_normal), +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index 6184a7c8f2b3..bebb2b8296cb 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -350,7 +350,7 @@ static const struct ieee1394_device_id oxfw_id_table[] = { + * Onyx-i series (former models): 0x081216 + * Mackie Onyx Satellite: 0x00200f + * Tapco LINK.firewire 4x6: 0x000460 +- * d.4 pro: Unknown ++ * d.2 pro/d.4 pro (built-in card): Unknown + * U.420: Unknown + * U.420d: Unknown + */ +-- +2.30.2 + diff --git a/queue-5.4/rtc-fix-snprintf-checking-in-is_rtc_hctosys.patch b/queue-5.4/rtc-fix-snprintf-checking-in-is_rtc_hctosys.patch new file mode 100644 index 00000000000..f978876ae8f --- /dev/null +++ b/queue-5.4/rtc-fix-snprintf-checking-in-is_rtc_hctosys.patch @@ -0,0 +1,44 @@ +From 92220500c18634c1fedba8d59b66514696fd0c19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 10:19:26 +0300 +Subject: rtc: fix snprintf() checking in is_rtc_hctosys() + +From: Dan Carpenter + +[ Upstream commit 54b909436ede47e0ee07f1765da27ec2efa41e84 ] + +The scnprintf() function silently truncates the printf() and returns +the number bytes that it was able to copy (not counting the NUL +terminator). Thus, the highest value it can return here is +"NAME_SIZE - 1" and the overflow check is dead code. Fix this by +using the snprintf() function which returns the number of bytes that +would have been copied if there was enough space and changing the +condition from "> NAME_SIZE" to ">= NAME_SIZE". + +Fixes: 92589c986b33 ("rtc-proc: permit the /proc/driver/rtc device to use other devices") +Signed-off-by: Dan Carpenter +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/YJov/pcGmhLi2pEl@mwanda +Signed-off-by: Sasha Levin +--- + drivers/rtc/proc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/rtc/proc.c b/drivers/rtc/proc.c +index 73344598fc1b..cbcdbb19d848 100644 +--- a/drivers/rtc/proc.c ++++ b/drivers/rtc/proc.c +@@ -23,8 +23,8 @@ static bool is_rtc_hctosys(struct rtc_device *rtc) + int size; + char name[NAME_SIZE]; + +- size = scnprintf(name, NAME_SIZE, "rtc%d", rtc->id); +- if (size > NAME_SIZE) ++ size = snprintf(name, NAME_SIZE, "rtc%d", rtc->id); ++ if (size >= NAME_SIZE) + return false; + + return !strncmp(name, CONFIG_RTC_HCTOSYS_DEVICE, NAME_SIZE); +-- +2.30.2 + diff --git a/queue-5.4/s390-ipl_parm-fix-program-check-new-psw-handling.patch b/queue-5.4/s390-ipl_parm-fix-program-check-new-psw-handling.patch new file mode 100644 index 00000000000..e79937b1e7c --- /dev/null +++ b/queue-5.4/s390-ipl_parm-fix-program-check-new-psw-handling.patch @@ -0,0 +1,71 @@ +From 81de9c724a7c6458c56df96f58a66b1799a60051 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 14:49:31 +0200 +Subject: s390/ipl_parm: fix program check new psw handling + +From: Heiko Carstens + +[ Upstream commit 88c2510cecb7e2b518e3c4fdf3cf0e13ebe9377c ] + +The __diag308() inline asm temporarily changes the program check new +psw to redirect a potential program check on the diag instruction. +Restoring of the program check new psw is done in C code behind the +inline asm. + +This can be problematic, especially if the function is inlined, since +the compiler can reorder instructions in such a way that a different +instruction, which may result in a program check, might be executed +before the program check new psw has been restored. + +To avoid such a scenario move restoring into the inline asm. For +consistency reasons move also saving of the original program check new +psw into the inline asm. + +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/boot/ipl_parm.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/arch/s390/boot/ipl_parm.c b/arch/s390/boot/ipl_parm.c +index 24ef67eb1cef..75905b548f69 100644 +--- a/arch/s390/boot/ipl_parm.c ++++ b/arch/s390/boot/ipl_parm.c +@@ -27,22 +27,25 @@ static inline int __diag308(unsigned long subcode, void *addr) + register unsigned long _addr asm("0") = (unsigned long)addr; + register unsigned long _rc asm("1") = 0; + unsigned long reg1, reg2; +- psw_t old = S390_lowcore.program_new_psw; ++ psw_t old; + + asm volatile( ++ " mvc 0(16,%[psw_old]),0(%[psw_pgm])\n" + " epsw %0,%1\n" +- " st %0,%[psw_pgm]\n" +- " st %1,%[psw_pgm]+4\n" ++ " st %0,0(%[psw_pgm])\n" ++ " st %1,4(%[psw_pgm])\n" + " larl %0,1f\n" +- " stg %0,%[psw_pgm]+8\n" ++ " stg %0,8(%[psw_pgm])\n" + " diag %[addr],%[subcode],0x308\n" +- "1: nopr %%r7\n" ++ "1: mvc 0(16,%[psw_pgm]),0(%[psw_old])\n" + : "=&d" (reg1), "=&a" (reg2), +- [psw_pgm] "=Q" (S390_lowcore.program_new_psw), ++ "+Q" (S390_lowcore.program_new_psw), ++ "=Q" (old), + [addr] "+d" (_addr), "+d" (_rc) +- : [subcode] "d" (subcode) ++ : [subcode] "d" (subcode), ++ [psw_old] "a" (&old), ++ [psw_pgm] "a" (&S390_lowcore.program_new_psw) + : "cc", "memory"); +- S390_lowcore.program_new_psw = old; + return _rc; + } + +-- +2.30.2 + diff --git a/queue-5.4/s390-mem_detect-fix-diag260-program-check-new-psw-ha.patch b/queue-5.4/s390-mem_detect-fix-diag260-program-check-new-psw-ha.patch new file mode 100644 index 00000000000..869ffe176dd --- /dev/null +++ b/queue-5.4/s390-mem_detect-fix-diag260-program-check-new-psw-ha.patch @@ -0,0 +1,73 @@ +From f84212686e49c251a21585b46e2ff5018db5012e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 21:40:43 +0200 +Subject: s390/mem_detect: fix diag260() program check new psw handling + +From: Heiko Carstens + +[ Upstream commit 86807f348f418a84970eebb8f9912a7eea16b497 ] + +The __diag260() inline asm temporarily changes the program check new +psw to redirect a potential program check on the diag instruction. +Restoring of the program check new psw is done in C code behind the +inline asm. + +This can be problematic, especially if the function is inlined, since +the compiler can reorder instructions in such a way that a different +instruction, which may result in a program check, might be executed +before the program check new psw has been restored. + +To avoid such a scenario move restoring into the inline asm. For +consistency reasons move also saving of the original program check new +psw into the inline asm. + +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/boot/mem_detect.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c +index 62e7c13ce85c..032d68165216 100644 +--- a/arch/s390/boot/mem_detect.c ++++ b/arch/s390/boot/mem_detect.c +@@ -70,24 +70,27 @@ static int __diag260(unsigned long rx1, unsigned long rx2) + register unsigned long _ry asm("4") = 0x10; /* storage configuration */ + int rc = -1; /* fail */ + unsigned long reg1, reg2; +- psw_t old = S390_lowcore.program_new_psw; ++ psw_t old; + + asm volatile( ++ " mvc 0(16,%[psw_old]),0(%[psw_pgm])\n" + " epsw %0,%1\n" +- " st %0,%[psw_pgm]\n" +- " st %1,%[psw_pgm]+4\n" ++ " st %0,0(%[psw_pgm])\n" ++ " st %1,4(%[psw_pgm])\n" + " larl %0,1f\n" +- " stg %0,%[psw_pgm]+8\n" ++ " stg %0,8(%[psw_pgm])\n" + " diag %[rx],%[ry],0x260\n" + " ipm %[rc]\n" + " srl %[rc],28\n" +- "1:\n" ++ "1: mvc 0(16,%[psw_pgm]),0(%[psw_old])\n" + : "=&d" (reg1), "=&a" (reg2), +- [psw_pgm] "=Q" (S390_lowcore.program_new_psw), ++ "+Q" (S390_lowcore.program_new_psw), ++ "=Q" (old), + [rc] "+&d" (rc), [ry] "+d" (_ry) +- : [rx] "d" (_rx1), "d" (_rx2) ++ : [rx] "d" (_rx1), "d" (_rx2), ++ [psw_old] "a" (&old), ++ [psw_pgm] "a" (&S390_lowcore.program_new_psw) + : "cc", "memory"); +- S390_lowcore.program_new_psw = old; + return rc == 0 ? _ry : -1; + } + +-- +2.30.2 + diff --git a/queue-5.4/s390-mem_detect-fix-tprot-program-check-new-psw-hand.patch b/queue-5.4/s390-mem_detect-fix-tprot-program-check-new-psw-hand.patch new file mode 100644 index 00000000000..1bbec3dd5d9 --- /dev/null +++ b/queue-5.4/s390-mem_detect-fix-tprot-program-check-new-psw-hand.patch @@ -0,0 +1,79 @@ +From 80243bc35e62f167571798c6a346a873559a616d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Jun 2021 22:09:20 +0200 +Subject: s390/mem_detect: fix tprot() program check new psw handling + +From: Heiko Carstens + +[ Upstream commit da9057576785aaab52e706e76c0475c85b77ec14 ] + +The tprot() inline asm temporarily changes the program check new psw +to redirect a potential program check on the diag instruction. +Restoring of the program check new psw is done in C code behind the +inline asm. + +This can be problematic, especially if the function is inlined, since +the compiler can reorder instructions in such a way that a different +instruction, which may result in a program check, might be executed +before the program check new psw has been restored. + +To avoid such a scenario move restoring into the inline asm. For +consistency reasons move also saving of the original program check new +psw into the inline asm. + +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/boot/mem_detect.c | 28 +++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +diff --git a/arch/s390/boot/mem_detect.c b/arch/s390/boot/mem_detect.c +index 032d68165216..85049541c191 100644 +--- a/arch/s390/boot/mem_detect.c ++++ b/arch/s390/boot/mem_detect.c +@@ -115,24 +115,30 @@ static int diag260(void) + + static int tprot(unsigned long addr) + { +- unsigned long pgm_addr; ++ unsigned long reg1, reg2; + int rc = -EFAULT; +- psw_t old = S390_lowcore.program_new_psw; ++ psw_t old; + +- S390_lowcore.program_new_psw.mask = __extract_psw(); + asm volatile( +- " larl %[pgm_addr],1f\n" +- " stg %[pgm_addr],%[psw_pgm_addr]\n" ++ " mvc 0(16,%[psw_old]),0(%[psw_pgm])\n" ++ " epsw %[reg1],%[reg2]\n" ++ " st %[reg1],0(%[psw_pgm])\n" ++ " st %[reg2],4(%[psw_pgm])\n" ++ " larl %[reg1],1f\n" ++ " stg %[reg1],8(%[psw_pgm])\n" + " tprot 0(%[addr]),0\n" + " ipm %[rc]\n" + " srl %[rc],28\n" +- "1:\n" +- : [pgm_addr] "=&d"(pgm_addr), +- [psw_pgm_addr] "=Q"(S390_lowcore.program_new_psw.addr), +- [rc] "+&d"(rc) +- : [addr] "a"(addr) ++ "1: mvc 0(16,%[psw_pgm]),0(%[psw_old])\n" ++ : [reg1] "=&d" (reg1), ++ [reg2] "=&a" (reg2), ++ [rc] "+&d" (rc), ++ "=Q" (S390_lowcore.program_new_psw.addr), ++ "=Q" (old) ++ : [psw_old] "a" (&old), ++ [psw_pgm] "a" (&S390_lowcore.program_new_psw), ++ [addr] "a" (addr) + : "cc", "memory"); +- S390_lowcore.program_new_psw = old; + return rc; + } + +-- +2.30.2 + diff --git a/queue-5.4/s390-processor-always-inline-stap-and-__load_psw_mas.patch b/queue-5.4/s390-processor-always-inline-stap-and-__load_psw_mas.patch new file mode 100644 index 00000000000..bc16f3fd828 --- /dev/null +++ b/queue-5.4/s390-processor-always-inline-stap-and-__load_psw_mas.patch @@ -0,0 +1,48 @@ +From 1f81e71db8ecde606ce19362017dc472afe7186c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Jun 2021 17:50:25 +0200 +Subject: s390/processor: always inline stap() and __load_psw_mask() + +From: Heiko Carstens + +[ Upstream commit 9c9a915afd90f7534c16a71d1cd44b58596fddf3 ] + +s390 is the only architecture which makes use of the __no_kasan_or_inline +attribute for two functions. Given that both stap() and __load_psw_mask() +are very small functions they can and should be always inlined anyway. + +Therefore get rid of __no_kasan_or_inline and always inline these +functions. + +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/include/asm/processor.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h +index 560d8b77b1d1..48d6ccdef5f7 100644 +--- a/arch/s390/include/asm/processor.h ++++ b/arch/s390/include/asm/processor.h +@@ -215,7 +215,7 @@ static inline unsigned long current_stack_pointer(void) + return sp; + } + +-static __no_kasan_or_inline unsigned short stap(void) ++static __always_inline unsigned short stap(void) + { + unsigned short cpu_address; + +@@ -254,7 +254,7 @@ static inline void __load_psw(psw_t psw) + * Set PSW mask to specified value, while leaving the + * PSW addr pointing to the next instruction. + */ +-static __no_kasan_or_inline void __load_psw_mask(unsigned long mask) ++static __always_inline void __load_psw_mask(unsigned long mask) + { + unsigned long addr; + psw_t psw; +-- +2.30.2 + diff --git a/queue-5.4/s390-sclp_vt220-fix-console-name-to-match-device.patch b/queue-5.4/s390-sclp_vt220-fix-console-name-to-match-device.patch new file mode 100644 index 00000000000..c860d84da6a --- /dev/null +++ b/queue-5.4/s390-sclp_vt220-fix-console-name-to-match-device.patch @@ -0,0 +1,63 @@ +From 0b3c091a0dbcb0936a8c7bc8644027784f1d6450 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 21:40:10 +0200 +Subject: s390/sclp_vt220: fix console name to match device + +From: Valentin Vidic + +[ Upstream commit b7d91d230a119fdcc334d10c9889ce9c5e15118b ] + +Console name reported in /proc/consoles: + + ttyS1 -W- (EC p ) 4:65 + +does not match the char device name: + + crw--w---- 1 root root 4, 65 May 17 12:18 /dev/ttysclp0 + +so debian-installer inside a QEMU s390x instance gets confused and fails +to start with the following error: + + steal-ctty: No such file or directory + +Signed-off-by: Valentin Vidic +Link: https://lore.kernel.org/r/20210427194010.9330-1-vvidic@valentin-vidic.from.hr +Signed-off-by: Christian Borntraeger +Signed-off-by: Vasily Gorbik +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/setup.c | 2 +- + drivers/s390/char/sclp_vt220.c | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index 3588f4c65a4d..f661f176966f 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -162,7 +162,7 @@ static void __init set_preferred_console(void) + else if (CONSOLE_IS_3270) + add_preferred_console("tty3270", 0, NULL); + else if (CONSOLE_IS_VT220) +- add_preferred_console("ttyS", 1, NULL); ++ add_preferred_console("ttysclp", 0, NULL); + else if (CONSOLE_IS_HVC) + add_preferred_console("hvc", 0, NULL); + } +diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c +index 3f9a6ef650fa..3c2ed6d01387 100644 +--- a/drivers/s390/char/sclp_vt220.c ++++ b/drivers/s390/char/sclp_vt220.c +@@ -35,8 +35,8 @@ + #define SCLP_VT220_MINOR 65 + #define SCLP_VT220_DRIVER_NAME "sclp_vt220" + #define SCLP_VT220_DEVICE_NAME "ttysclp" +-#define SCLP_VT220_CONSOLE_NAME "ttyS" +-#define SCLP_VT220_CONSOLE_INDEX 1 /* console=ttyS1 */ ++#define SCLP_VT220_CONSOLE_NAME "ttysclp" ++#define SCLP_VT220_CONSOLE_INDEX 0 /* console=ttysclp0 */ + + /* Representation of a single write request */ + struct sclp_vt220_request { +-- +2.30.2 + diff --git a/queue-5.4/scsi-be2iscsi-fix-an-error-handling-path-in-beiscsi_.patch b/queue-5.4/scsi-be2iscsi-fix-an-error-handling-path-in-beiscsi_.patch new file mode 100644 index 00000000000..6e416712c83 --- /dev/null +++ b/queue-5.4/scsi-be2iscsi-fix-an-error-handling-path-in-beiscsi_.patch @@ -0,0 +1,37 @@ +From cb343750d5a10891cb5fc8a383d2fc0fd85e2c02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Jun 2021 09:18:34 +0200 +Subject: scsi: be2iscsi: Fix an error handling path in beiscsi_dev_probe() + +From: Christophe JAILLET + +[ Upstream commit 030e4138d11fced3b831c2761e4cecf347bae99c ] + +If an error occurs after a pci_enable_pcie_error_reporting() call, it must +be undone by a corresponding pci_disable_pcie_error_reporting() call, as +already done in the remove function. + +Link: https://lore.kernel.org/r/77adb02cfea7f1364e5603ecf3930d8597ae356e.1623482155.git.christophe.jaillet@wanadoo.fr +Fixes: 3567f36a09d1 ("[SCSI] be2iscsi: Fix AER handling in driver") +Signed-off-by: Christophe JAILLET +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/be2iscsi/be_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index 6fcd413c2ac9..53b33f146f82 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -5745,6 +5745,7 @@ free_hba: + pci_disable_msix(phba->pcidev); + pci_dev_put(phba->pcidev); + iscsi_host_free(phba->shost); ++ pci_disable_pcie_error_reporting(pcidev); + pci_set_drvdata(pcidev, NULL); + disable_pci: + pci_release_regions(pcidev); +-- +2.30.2 + diff --git a/queue-5.4/scsi-core-cap-scsi_host-cmd_per_lun-at-can_queue.patch b/queue-5.4/scsi-core-cap-scsi_host-cmd_per_lun-at-can_queue.patch new file mode 100644 index 00000000000..016eb356f7c --- /dev/null +++ b/queue-5.4/scsi-core-cap-scsi_host-cmd_per_lun-at-can_queue.patch @@ -0,0 +1,51 @@ +From 5b81f4a269165d387153e7d22fcbfbf297a43640 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 22:31:02 +0800 +Subject: scsi: core: Cap scsi_host cmd_per_lun at can_queue + +From: John Garry + +[ Upstream commit ea2f0f77538c50739b9fb4de4700cee5535e1f77 ] + +The sysfs handling function sdev_store_queue_depth() enforces that the sdev +queue depth cannot exceed shost can_queue. The initial sdev queue depth +comes from shost cmd_per_lun. However, the LLDD may manually set +cmd_per_lun to be larger than can_queue, which leads to an initial sdev +queue depth greater than can_queue. + +Such an issue was reported in [0], which caused a hang. That has since been +fixed in commit fc09acb7de31 ("scsi: scsi_debug: Fix cmd_per_lun, set to +max_queue"). + +Stop this possibly happening for other drivers by capping shost cmd_per_lun +at shost can_queue. + +[0] https://lore.kernel.org/linux-scsi/YHaez6iN2HHYxYOh@T590/ + +Link: https://lore.kernel.org/r/1621434662-173079-1-git-send-email-john.garry@huawei.com +Reviewed-by: Ming Lei +Reviewed-by: Bart Van Assche +Signed-off-by: John Garry +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hosts.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index 119c292cdb8f..7c736e4ddafe 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -219,6 +219,9 @@ int scsi_add_host_with_dma(struct Scsi_Host *shost, struct device *dev, + goto fail; + } + ++ shost->cmd_per_lun = min_t(short, shost->cmd_per_lun, ++ shost->can_queue); ++ + error = scsi_init_sense_cache(shost); + if (error) + goto fail; +-- +2.30.2 + diff --git a/queue-5.4/scsi-hisi_sas-propagate-errors-in-interrupt_init_v1_.patch b/queue-5.4/scsi-hisi_sas-propagate-errors-in-interrupt_init_v1_.patch new file mode 100644 index 00000000000..74ecd01d6e9 --- /dev/null +++ b/queue-5.4/scsi-hisi_sas-propagate-errors-in-interrupt_init_v1_.patch @@ -0,0 +1,85 @@ +From 3a33127cdb868274cb6c3c45d8b3d5e493ec99c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 22:20:15 +0300 +Subject: scsi: hisi_sas: Propagate errors in interrupt_init_v1_hw() + +From: Sergey Shtylyov + +[ Upstream commit ab17122e758ef68fb21033e25c041144067975f5 ] + +After commit 6c11dc060427 ("scsi: hisi_sas: Fix IRQ checks") we have the +error codes returned by platform_get_irq() ready for the propagation +upsream in interrupt_init_v1_hw() -- that will fix still broken deferred +probing. Let's propagate the error codes from devm_request_irq() as well +since I don't see the reason to override them with -ENOENT... + +Link: https://lore.kernel.org/r/49ba93a3-d427-7542-d85a-b74fe1a33a73@omp.ru +Acked-by: John Garry +Signed-off-by: Sergey Shtylyov +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +index 3364ae0b9bfe..9f6534bd354b 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c +@@ -1648,7 +1648,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba) + if (irq < 0) { + dev_err(dev, "irq init: fail map phy interrupt %d\n", + idx); +- return -ENOENT; ++ return irq; + } + + rc = devm_request_irq(dev, irq, phy_interrupts[j], 0, +@@ -1656,7 +1656,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba) + if (rc) { + dev_err(dev, "irq init: could not request phy interrupt %d, rc=%d\n", + irq, rc); +- return -ENOENT; ++ return rc; + } + } + } +@@ -1667,7 +1667,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba) + if (irq < 0) { + dev_err(dev, "irq init: could not map cq interrupt %d\n", + idx); +- return -ENOENT; ++ return irq; + } + + rc = devm_request_irq(dev, irq, cq_interrupt_v1_hw, 0, +@@ -1675,7 +1675,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba) + if (rc) { + dev_err(dev, "irq init: could not request cq interrupt %d, rc=%d\n", + irq, rc); +- return -ENOENT; ++ return rc; + } + } + +@@ -1685,7 +1685,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba) + if (irq < 0) { + dev_err(dev, "irq init: could not map fatal interrupt %d\n", + idx); +- return -ENOENT; ++ return irq; + } + + rc = devm_request_irq(dev, irq, fatal_interrupts[i], 0, +@@ -1693,7 +1693,7 @@ static int interrupt_init_v1_hw(struct hisi_hba *hisi_hba) + if (rc) { + dev_err(dev, "irq init: could not request fatal interrupt %d, rc=%d\n", + irq, rc); +- return -ENOENT; ++ return rc; + } + } + +-- +2.30.2 + diff --git a/queue-5.4/scsi-iscsi-add-iscsi_cls_conn-refcount-helpers.patch b/queue-5.4/scsi-iscsi-add-iscsi_cls_conn-refcount-helpers.patch new file mode 100644 index 00000000000..7c6f9a48ef2 --- /dev/null +++ b/queue-5.4/scsi-iscsi-add-iscsi_cls_conn-refcount-helpers.patch @@ -0,0 +1,97 @@ +From d7e0215e633f6b6d5fd999983b6753b8687f92ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:18:03 -0500 +Subject: scsi: iscsi: Add iscsi_cls_conn refcount helpers + +From: Mike Christie + +[ Upstream commit b1d19e8c92cfb0ded180ef3376c20e130414e067 ] + +There are a couple places where we could free the iscsi_cls_conn while it's +still in use. This adds some helpers to get/put a refcount on the struct +and converts an exiting user. Subsequent commits will then use the helpers +to fix 2 bugs in the eh code. + +Link: https://lore.kernel.org/r/20210525181821.7617-11-michael.christie@oracle.com +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libiscsi.c | 7 ++----- + drivers/scsi/scsi_transport_iscsi.c | 12 ++++++++++++ + include/scsi/scsi_transport_iscsi.h | 2 ++ + 3 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index c5b7d18513b6..b9981078375d 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1348,7 +1348,6 @@ void iscsi_session_failure(struct iscsi_session *session, + enum iscsi_err err) + { + struct iscsi_conn *conn; +- struct device *dev; + + spin_lock_bh(&session->frwd_lock); + conn = session->leadconn; +@@ -1357,10 +1356,8 @@ void iscsi_session_failure(struct iscsi_session *session, + return; + } + +- dev = get_device(&conn->cls_conn->dev); ++ iscsi_get_conn(conn->cls_conn); + spin_unlock_bh(&session->frwd_lock); +- if (!dev) +- return; + /* + * if the host is being removed bypass the connection + * recovery initialization because we are going to kill +@@ -1370,7 +1367,7 @@ void iscsi_session_failure(struct iscsi_session *session, + iscsi_conn_error_event(conn->cls_conn, err); + else + iscsi_conn_failure(conn, err); +- put_device(dev); ++ iscsi_put_conn(conn->cls_conn); + } + EXPORT_SYMBOL_GPL(iscsi_session_failure); + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index a26df7d6d5d1..2f1553d0a10e 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2308,6 +2308,18 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn) + } + EXPORT_SYMBOL_GPL(iscsi_destroy_conn); + ++void iscsi_put_conn(struct iscsi_cls_conn *conn) ++{ ++ put_device(&conn->dev); ++} ++EXPORT_SYMBOL_GPL(iscsi_put_conn); ++ ++void iscsi_get_conn(struct iscsi_cls_conn *conn) ++{ ++ get_device(&conn->dev); ++} ++EXPORT_SYMBOL_GPL(iscsi_get_conn); ++ + /* + * iscsi interface functions + */ +diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transport_iscsi.h +index 325ae731d9ad..71c78410e6ab 100644 +--- a/include/scsi/scsi_transport_iscsi.h ++++ b/include/scsi/scsi_transport_iscsi.h +@@ -423,6 +423,8 @@ extern void iscsi_remove_session(struct iscsi_cls_session *session); + extern void iscsi_free_session(struct iscsi_cls_session *session); + extern struct iscsi_cls_conn *iscsi_create_conn(struct iscsi_cls_session *sess, + int dd_size, uint32_t cid); ++extern void iscsi_put_conn(struct iscsi_cls_conn *conn); ++extern void iscsi_get_conn(struct iscsi_cls_conn *conn); + extern int iscsi_destroy_conn(struct iscsi_cls_conn *conn); + extern void iscsi_unblock_session(struct iscsi_cls_session *session); + extern void iscsi_block_session(struct iscsi_cls_session *session); +-- +2.30.2 + diff --git a/queue-5.4/scsi-iscsi-fix-conn-use-after-free-during-resets.patch b/queue-5.4/scsi-iscsi-fix-conn-use-after-free-during-resets.patch new file mode 100644 index 00000000000..e926a9a15e0 --- /dev/null +++ b/queue-5.4/scsi-iscsi-fix-conn-use-after-free-during-resets.patch @@ -0,0 +1,412 @@ +From de3e2196fabfd842466551addb45fd92ae77fdb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:18:06 -0500 +Subject: scsi: iscsi: Fix conn use after free during resets + +From: Mike Christie + +[ Upstream commit ec29d0ac29be366450a7faffbcf8cba3a6a3b506 ] + +If we haven't done a unbind target call we can race where +iscsi_conn_teardown wakes up the EH thread and then frees the conn while +those threads are still accessing the conn ehwait. + +We can only do one TMF per session so this just moves the TMF fields from +the conn to the session. We can then rely on the +iscsi_session_teardown->iscsi_remove_session->__iscsi_unbind_session call +to remove the target and it's devices, and know after that point there is +no device or scsi-ml callout trying to access the session. + +Link: https://lore.kernel.org/r/20210525181821.7617-14-michael.christie@oracle.com +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/libiscsi.c | 115 +++++++++++++++++++--------------------- + include/scsi/libiscsi.h | 11 ++-- + 2 files changed, 60 insertions(+), 66 deletions(-) + +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index b9981078375d..eeba6180711c 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -230,11 +230,11 @@ static int iscsi_prep_ecdb_ahs(struct iscsi_task *task) + */ + static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode) + { +- struct iscsi_conn *conn = task->conn; +- struct iscsi_tm *tmf = &conn->tmhdr; ++ struct iscsi_session *session = task->conn->session; ++ struct iscsi_tm *tmf = &session->tmhdr; + u64 hdr_lun; + +- if (conn->tmf_state == TMF_INITIAL) ++ if (session->tmf_state == TMF_INITIAL) + return 0; + + if ((tmf->opcode & ISCSI_OPCODE_MASK) != ISCSI_OP_SCSI_TMFUNC) +@@ -254,24 +254,19 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode) + * Fail all SCSI cmd PDUs + */ + if (opcode != ISCSI_OP_SCSI_DATA_OUT) { +- iscsi_conn_printk(KERN_INFO, conn, +- "task [op %x itt " +- "0x%x/0x%x] " +- "rejected.\n", +- opcode, task->itt, +- task->hdr_itt); ++ iscsi_session_printk(KERN_INFO, session, ++ "task [op %x itt 0x%x/0x%x] rejected.\n", ++ opcode, task->itt, task->hdr_itt); + return -EACCES; + } + /* + * And also all data-out PDUs in response to R2T + * if fast_abort is set. + */ +- if (conn->session->fast_abort) { +- iscsi_conn_printk(KERN_INFO, conn, +- "task [op %x itt " +- "0x%x/0x%x] fast abort.\n", +- opcode, task->itt, +- task->hdr_itt); ++ if (session->fast_abort) { ++ iscsi_session_printk(KERN_INFO, session, ++ "task [op %x itt 0x%x/0x%x] fast abort.\n", ++ opcode, task->itt, task->hdr_itt); + return -EACCES; + } + break; +@@ -284,7 +279,7 @@ static int iscsi_check_tmf_restrictions(struct iscsi_task *task, int opcode) + */ + if (opcode == ISCSI_OP_SCSI_DATA_OUT && + task->hdr_itt == tmf->rtt) { +- ISCSI_DBG_SESSION(conn->session, ++ ISCSI_DBG_SESSION(session, + "Preventing task %x/%x from sending " + "data-out due to abort task in " + "progress\n", task->itt, +@@ -923,20 +918,21 @@ iscsi_data_in_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr, + static void iscsi_tmf_rsp(struct iscsi_conn *conn, struct iscsi_hdr *hdr) + { + struct iscsi_tm_rsp *tmf = (struct iscsi_tm_rsp *)hdr; ++ struct iscsi_session *session = conn->session; + + conn->exp_statsn = be32_to_cpu(hdr->statsn) + 1; + conn->tmfrsp_pdus_cnt++; + +- if (conn->tmf_state != TMF_QUEUED) ++ if (session->tmf_state != TMF_QUEUED) + return; + + if (tmf->response == ISCSI_TMF_RSP_COMPLETE) +- conn->tmf_state = TMF_SUCCESS; ++ session->tmf_state = TMF_SUCCESS; + else if (tmf->response == ISCSI_TMF_RSP_NO_TASK) +- conn->tmf_state = TMF_NOT_FOUND; ++ session->tmf_state = TMF_NOT_FOUND; + else +- conn->tmf_state = TMF_FAILED; +- wake_up(&conn->ehwait); ++ session->tmf_state = TMF_FAILED; ++ wake_up(&session->ehwait); + } + + static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr) +@@ -1784,15 +1780,14 @@ EXPORT_SYMBOL_GPL(iscsi_target_alloc); + + static void iscsi_tmf_timedout(struct timer_list *t) + { +- struct iscsi_conn *conn = from_timer(conn, t, tmf_timer); +- struct iscsi_session *session = conn->session; ++ struct iscsi_session *session = from_timer(session, t, tmf_timer); + + spin_lock(&session->frwd_lock); +- if (conn->tmf_state == TMF_QUEUED) { +- conn->tmf_state = TMF_TIMEDOUT; ++ if (session->tmf_state == TMF_QUEUED) { ++ session->tmf_state = TMF_TIMEDOUT; + ISCSI_DBG_EH(session, "tmf timedout\n"); + /* unblock eh_abort() */ +- wake_up(&conn->ehwait); ++ wake_up(&session->ehwait); + } + spin_unlock(&session->frwd_lock); + } +@@ -1815,8 +1810,8 @@ static int iscsi_exec_task_mgmt_fn(struct iscsi_conn *conn, + return -EPERM; + } + conn->tmfcmd_pdus_cnt++; +- conn->tmf_timer.expires = timeout * HZ + jiffies; +- add_timer(&conn->tmf_timer); ++ session->tmf_timer.expires = timeout * HZ + jiffies; ++ add_timer(&session->tmf_timer); + ISCSI_DBG_EH(session, "tmf set timeout\n"); + + spin_unlock_bh(&session->frwd_lock); +@@ -1830,12 +1825,12 @@ static int iscsi_exec_task_mgmt_fn(struct iscsi_conn *conn, + * 3) session is terminated or restarted or userspace has + * given up on recovery + */ +- wait_event_interruptible(conn->ehwait, age != session->age || ++ wait_event_interruptible(session->ehwait, age != session->age || + session->state != ISCSI_STATE_LOGGED_IN || +- conn->tmf_state != TMF_QUEUED); ++ session->tmf_state != TMF_QUEUED); + if (signal_pending(current)) + flush_signals(current); +- del_timer_sync(&conn->tmf_timer); ++ del_timer_sync(&session->tmf_timer); + + mutex_lock(&session->eh_mutex); + spin_lock_bh(&session->frwd_lock); +@@ -2195,17 +2190,17 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) + } + + /* only have one tmf outstanding at a time */ +- if (conn->tmf_state != TMF_INITIAL) ++ if (session->tmf_state != TMF_INITIAL) + goto failed; +- conn->tmf_state = TMF_QUEUED; ++ session->tmf_state = TMF_QUEUED; + +- hdr = &conn->tmhdr; ++ hdr = &session->tmhdr; + iscsi_prep_abort_task_pdu(task, hdr); + + if (iscsi_exec_task_mgmt_fn(conn, hdr, age, session->abort_timeout)) + goto failed; + +- switch (conn->tmf_state) { ++ switch (session->tmf_state) { + case TMF_SUCCESS: + spin_unlock_bh(&session->frwd_lock); + /* +@@ -2220,7 +2215,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) + */ + spin_lock_bh(&session->frwd_lock); + fail_scsi_task(task, DID_ABORT); +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + memset(hdr, 0, sizeof(*hdr)); + spin_unlock_bh(&session->frwd_lock); + iscsi_start_tx(conn); +@@ -2231,7 +2226,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) + goto failed_unlocked; + case TMF_NOT_FOUND: + if (!sc->SCp.ptr) { +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + memset(hdr, 0, sizeof(*hdr)); + /* task completed before tmf abort response */ + ISCSI_DBG_EH(session, "sc completed while abort in " +@@ -2240,7 +2235,7 @@ int iscsi_eh_abort(struct scsi_cmnd *sc) + } + /* fall through */ + default: +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + goto failed; + } + +@@ -2297,11 +2292,11 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc) + conn = session->leadconn; + + /* only have one tmf outstanding at a time */ +- if (conn->tmf_state != TMF_INITIAL) ++ if (session->tmf_state != TMF_INITIAL) + goto unlock; +- conn->tmf_state = TMF_QUEUED; ++ session->tmf_state = TMF_QUEUED; + +- hdr = &conn->tmhdr; ++ hdr = &session->tmhdr; + iscsi_prep_lun_reset_pdu(sc, hdr); + + if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age, +@@ -2310,7 +2305,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc) + goto unlock; + } + +- switch (conn->tmf_state) { ++ switch (session->tmf_state) { + case TMF_SUCCESS: + break; + case TMF_TIMEDOUT: +@@ -2318,7 +2313,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc) + iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST); + goto done; + default: +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + goto unlock; + } + +@@ -2330,7 +2325,7 @@ int iscsi_eh_device_reset(struct scsi_cmnd *sc) + spin_lock_bh(&session->frwd_lock); + memset(hdr, 0, sizeof(*hdr)); + fail_scsi_tasks(conn, sc->device->lun, DID_ERROR); +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + spin_unlock_bh(&session->frwd_lock); + + iscsi_start_tx(conn); +@@ -2353,8 +2348,7 @@ void iscsi_session_recovery_timedout(struct iscsi_cls_session *cls_session) + spin_lock_bh(&session->frwd_lock); + if (session->state != ISCSI_STATE_LOGGED_IN) { + session->state = ISCSI_STATE_RECOVERY_FAILED; +- if (session->leadconn) +- wake_up(&session->leadconn->ehwait); ++ wake_up(&session->ehwait); + } + spin_unlock_bh(&session->frwd_lock); + } +@@ -2399,7 +2393,7 @@ failed: + iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST); + + ISCSI_DBG_EH(session, "wait for relogin\n"); +- wait_event_interruptible(conn->ehwait, ++ wait_event_interruptible(session->ehwait, + session->state == ISCSI_STATE_TERMINATE || + session->state == ISCSI_STATE_LOGGED_IN || + session->state == ISCSI_STATE_RECOVERY_FAILED); +@@ -2460,11 +2454,11 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc) + conn = session->leadconn; + + /* only have one tmf outstanding at a time */ +- if (conn->tmf_state != TMF_INITIAL) ++ if (session->tmf_state != TMF_INITIAL) + goto unlock; +- conn->tmf_state = TMF_QUEUED; ++ session->tmf_state = TMF_QUEUED; + +- hdr = &conn->tmhdr; ++ hdr = &session->tmhdr; + iscsi_prep_tgt_reset_pdu(sc, hdr); + + if (iscsi_exec_task_mgmt_fn(conn, hdr, session->age, +@@ -2473,7 +2467,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc) + goto unlock; + } + +- switch (conn->tmf_state) { ++ switch (session->tmf_state) { + case TMF_SUCCESS: + break; + case TMF_TIMEDOUT: +@@ -2481,7 +2475,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc) + iscsi_conn_failure(conn, ISCSI_ERR_SCSI_EH_SESSION_RST); + goto done; + default: +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + goto unlock; + } + +@@ -2493,7 +2487,7 @@ static int iscsi_eh_target_reset(struct scsi_cmnd *sc) + spin_lock_bh(&session->frwd_lock); + memset(hdr, 0, sizeof(*hdr)); + fail_scsi_tasks(conn, -1, DID_ERROR); +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + spin_unlock_bh(&session->frwd_lock); + + iscsi_start_tx(conn); +@@ -2798,7 +2792,10 @@ iscsi_session_setup(struct iscsi_transport *iscsit, struct Scsi_Host *shost, + session->tt = iscsit; + session->dd_data = cls_session->dd_data + sizeof(*session); + ++ session->tmf_state = TMF_INITIAL; ++ timer_setup(&session->tmf_timer, iscsi_tmf_timedout, 0); + mutex_init(&session->eh_mutex); ++ + spin_lock_init(&session->frwd_lock); + spin_lock_init(&session->back_lock); + +@@ -2902,7 +2899,6 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size, + conn->c_stage = ISCSI_CONN_INITIAL_STAGE; + conn->id = conn_idx; + conn->exp_statsn = 0; +- conn->tmf_state = TMF_INITIAL; + + timer_setup(&conn->transport_timer, iscsi_check_transport_timeouts, 0); + +@@ -2928,8 +2924,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size, + goto login_task_data_alloc_fail; + conn->login_task->data = conn->data = data; + +- timer_setup(&conn->tmf_timer, iscsi_tmf_timedout, 0); +- init_waitqueue_head(&conn->ehwait); ++ init_waitqueue_head(&session->ehwait); + + return cls_conn; + +@@ -2964,7 +2959,7 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) + * leading connection? then give up on recovery. + */ + session->state = ISCSI_STATE_TERMINATE; +- wake_up(&conn->ehwait); ++ wake_up(&session->ehwait); + } + spin_unlock_bh(&session->frwd_lock); + +@@ -3039,7 +3034,7 @@ int iscsi_conn_start(struct iscsi_cls_conn *cls_conn) + * commands after successful recovery + */ + conn->stop_stage = 0; +- conn->tmf_state = TMF_INITIAL; ++ session->tmf_state = TMF_INITIAL; + session->age++; + if (session->age == 16) + session->age = 0; +@@ -3053,7 +3048,7 @@ int iscsi_conn_start(struct iscsi_cls_conn *cls_conn) + spin_unlock_bh(&session->frwd_lock); + + iscsi_unblock_session(session->cls_session); +- wake_up(&conn->ehwait); ++ wake_up(&session->ehwait); + return 0; + } + EXPORT_SYMBOL_GPL(iscsi_conn_start); +@@ -3140,7 +3135,7 @@ static void iscsi_start_session_recovery(struct iscsi_session *session, + spin_lock_bh(&session->frwd_lock); + fail_scsi_tasks(conn, -1, DID_TRANSPORT_DISRUPTED); + fail_mgmt_tasks(session, conn); +- memset(&conn->tmhdr, 0, sizeof(conn->tmhdr)); ++ memset(&session->tmhdr, 0, sizeof(session->tmhdr)); + spin_unlock_bh(&session->frwd_lock); + mutex_unlock(&session->eh_mutex); + } +diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h +index b3bbd10eb3f0..2b5f97224f69 100644 +--- a/include/scsi/libiscsi.h ++++ b/include/scsi/libiscsi.h +@@ -195,12 +195,6 @@ struct iscsi_conn { + unsigned long suspend_tx; /* suspend Tx */ + unsigned long suspend_rx; /* suspend Rx */ + +- /* abort */ +- wait_queue_head_t ehwait; /* used in eh_abort() */ +- struct iscsi_tm tmhdr; +- struct timer_list tmf_timer; +- int tmf_state; /* see TMF_INITIAL, etc.*/ +- + /* negotiated params */ + unsigned max_recv_dlength; /* initiator_max_recv_dsl*/ + unsigned max_xmit_dlength; /* target_max_recv_dsl */ +@@ -270,6 +264,11 @@ struct iscsi_session { + * and recv lock. + */ + struct mutex eh_mutex; ++ /* abort */ ++ wait_queue_head_t ehwait; /* used in eh_abort() */ ++ struct iscsi_tm tmhdr; ++ struct timer_list tmf_timer; ++ int tmf_state; /* see TMF_INITIAL, etc.*/ + + /* iSCSI session-wide sequencing */ + uint32_t cmdsn; +-- +2.30.2 + diff --git a/queue-5.4/scsi-iscsi-fix-shost-max_id-use.patch b/queue-5.4/scsi-iscsi-fix-shost-max_id-use.patch new file mode 100644 index 00000000000..c5184ace817 --- /dev/null +++ b/queue-5.4/scsi-iscsi-fix-shost-max_id-use.patch @@ -0,0 +1,100 @@ +From e1ab334188d08821de43b22434bb55c53f1f55f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:18:07 -0500 +Subject: scsi: iscsi: Fix shost->max_id use + +From: Mike Christie + +[ Upstream commit bdd4aad7ff92ae39c2e93c415bb6761cb8b584da ] + +The iscsi offload drivers are setting the shost->max_id to the max number +of sessions they support. The problem is that max_id is not the max number +of targets but the highest identifier the targets can have. To use it to +limit the number of targets we need to set it to max sessions - 1, or we +can end up with a session we might not have preallocated resources for. + +Link: https://lore.kernel.org/r/20210525181821.7617-15-michael.christie@oracle.com +Reviewed-by: Lee Duncan +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/be2iscsi/be_main.c | 4 ++-- + drivers/scsi/bnx2i/bnx2i_iscsi.c | 2 +- + drivers/scsi/cxgbi/libcxgbi.c | 4 ++-- + drivers/scsi/qedi/qedi_main.c | 2 +- + 4 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c +index 0760d0bd8a10..6fcd413c2ac9 100644 +--- a/drivers/scsi/be2iscsi/be_main.c ++++ b/drivers/scsi/be2iscsi/be_main.c +@@ -416,7 +416,7 @@ static struct beiscsi_hba *beiscsi_hba_alloc(struct pci_dev *pcidev) + "beiscsi_hba_alloc - iscsi_host_alloc failed\n"); + return NULL; + } +- shost->max_id = BE2_MAX_SESSIONS; ++ shost->max_id = BE2_MAX_SESSIONS - 1; + shost->max_channel = 0; + shost->max_cmd_len = BEISCSI_MAX_CMD_LEN; + shost->max_lun = BEISCSI_NUM_MAX_LUN; +@@ -5318,7 +5318,7 @@ static int beiscsi_enable_port(struct beiscsi_hba *phba) + /* Re-enable UER. If different TPE occurs then it is recoverable. */ + beiscsi_set_uer_feature(phba); + +- phba->shost->max_id = phba->params.cxns_per_ctrl; ++ phba->shost->max_id = phba->params.cxns_per_ctrl - 1; + phba->shost->can_queue = phba->params.ios_per_ctrl; + ret = beiscsi_init_port(phba); + if (ret < 0) { +diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c +index 0b28d44d3573..949d20b72ec4 100644 +--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c ++++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c +@@ -793,7 +793,7 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic) + return NULL; + shost->dma_boundary = cnic->pcidev->dma_mask; + shost->transportt = bnx2i_scsi_xport_template; +- shost->max_id = ISCSI_MAX_CONNS_PER_HBA; ++ shost->max_id = ISCSI_MAX_CONNS_PER_HBA - 1; + shost->max_channel = 0; + shost->max_lun = 512; + shost->max_cmd_len = 16; +diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c +index 2cd2761bd249..40d93fadd206 100644 +--- a/drivers/scsi/cxgbi/libcxgbi.c ++++ b/drivers/scsi/cxgbi/libcxgbi.c +@@ -337,7 +337,7 @@ void cxgbi_hbas_remove(struct cxgbi_device *cdev) + EXPORT_SYMBOL_GPL(cxgbi_hbas_remove); + + int cxgbi_hbas_add(struct cxgbi_device *cdev, u64 max_lun, +- unsigned int max_id, struct scsi_host_template *sht, ++ unsigned int max_conns, struct scsi_host_template *sht, + struct scsi_transport_template *stt) + { + struct cxgbi_hba *chba; +@@ -357,7 +357,7 @@ int cxgbi_hbas_add(struct cxgbi_device *cdev, u64 max_lun, + + shost->transportt = stt; + shost->max_lun = max_lun; +- shost->max_id = max_id; ++ shost->max_id = max_conns - 1; + shost->max_channel = 0; + shost->max_cmd_len = 16; + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index 4498add3d4d6..1ec42c5f0b2a 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -631,7 +631,7 @@ static struct qedi_ctx *qedi_host_alloc(struct pci_dev *pdev) + goto exit_setup_shost; + } + +- shost->max_id = QEDI_MAX_ISCSI_CONNS_PER_HBA; ++ shost->max_id = QEDI_MAX_ISCSI_CONNS_PER_HBA - 1; + shost->max_channel = 0; + shost->max_lun = ~0; + shost->max_cmd_len = 16; +-- +2.30.2 + diff --git a/queue-5.4/scsi-lpfc-fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch b/queue-5.4/scsi-lpfc-fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch new file mode 100644 index 00000000000..dc10960fcce --- /dev/null +++ b/queue-5.4/scsi-lpfc-fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch @@ -0,0 +1,55 @@ +From df0bdbb8c91e9049b329b1f43f62fc5b503ef89a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 12:55:56 -0700 +Subject: scsi: lpfc: Fix crash when lpfc_sli4_hba_setup() fails to initialize + the SGLs + +From: James Smart + +[ Upstream commit 5aa615d195f1e142c662cb2253f057c9baec7531 ] + +The driver is encountering a crash in lpfc_free_iocb_list() while +performing initial attachment. + +Code review found this to be an errant failure path that was taken, jumping +to a tag that then referenced structures that were uninitialized. + +Fix the failure path. + +Link: https://lore.kernel.org/r/20210514195559.119853-9-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_sli.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 795460eda6a5..4a7ceaa34341 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -7602,7 +7602,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) + "0393 Error %d during rpi post operation\n", + rc); + rc = -ENODEV; +- goto out_destroy_queue; ++ goto out_free_iocblist; + } + lpfc_sli4_node_prep(phba); + +@@ -7765,8 +7765,9 @@ out_io_buff_free: + out_unset_queue: + /* Unset all the queues set up in this routine when error out */ + lpfc_sli4_queue_unset(phba); +-out_destroy_queue: ++out_free_iocblist: + lpfc_free_iocb_list(phba); ++out_destroy_queue: + lpfc_sli4_queue_destroy(phba); + out_stop_timers: + lpfc_stop_hba_timers(phba); +-- +2.30.2 + diff --git a/queue-5.4/scsi-lpfc-fix-unexpected-timeout-error-in-direct-att.patch b/queue-5.4/scsi-lpfc-fix-unexpected-timeout-error-in-direct-att.patch new file mode 100644 index 00000000000..a0f09e518a2 --- /dev/null +++ b/queue-5.4/scsi-lpfc-fix-unexpected-timeout-error-in-direct-att.patch @@ -0,0 +1,53 @@ +From 18a70ee501d99908f32b6b188959fe15c0bccdae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 May 2021 12:55:51 -0700 +Subject: scsi: lpfc: Fix "Unexpected timeout" error in direct attach topology + +From: James Smart + +[ Upstream commit e30d55137edef47434c40d7570276a0846fe922c ] + +An 'unexpected timeout' message may be seen in a point-2-point topology. +The message occurs when a PLOGI is received before the driver is notified +of FLOGI completion. The FLOGI completion failure causes discovery to be +triggered for a second time. The discovery timer is restarted but no new +discovery activity is initiated, thus the timeout message eventually +appears. + +In point-2-point, when discovery has progressed before the FLOGI completion +is processed, it is not a failure. Add code to FLOGI completion to detect +that discovery has progressed and exit the FLOGI handling (noop'ing it). + +Link: https://lore.kernel.org/r/20210514195559.119853-4-jsmart2021@gmail.com +Co-developed-by: Justin Tee +Signed-off-by: Justin Tee +Signed-off-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_els.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 4e994a693e3f..2040affa0887 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -1179,6 +1179,15 @@ stop_rr_fcf_flogi: + phba->fcf.fcf_redisc_attempted = 0; /* reset */ + goto out; + } ++ } else if (vport->port_state > LPFC_FLOGI && ++ vport->fc_flag & FC_PT2PT) { ++ /* ++ * In a p2p topology, it is possible that discovery has ++ * already progressed, and this completion can be ignored. ++ * Recheck the indicated topology. ++ */ ++ if (!sp->cmn.fPort) ++ goto out; + } + + flogifail: +-- +2.30.2 + diff --git a/queue-5.4/scsi-megaraid_sas-early-detection-of-vd-deletion-thr.patch b/queue-5.4/scsi-megaraid_sas-early-detection-of-vd-deletion-thr.patch new file mode 100644 index 00000000000..1fb1be5e6a1 --- /dev/null +++ b/queue-5.4/scsi-megaraid_sas-early-detection-of-vd-deletion-thr.patch @@ -0,0 +1,270 @@ +From 9926243b52dd18b6788a12e596ecc706e65d6842 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 18:43:05 +0530 +Subject: scsi: megaraid_sas: Early detection of VD deletion through RaidMap + update + +From: Kashyap Desai + +[ Upstream commit ae6874ba4b43c5a00065f48599811a09d33b873d ] + +Consider the case where a VD is deleted and the targetID of that VD is +assigned to a newly created VD. If the sequence of deletion/addition of VD +happens very quickly there is a possibility that second event (VD add) +occurs even before the driver processes the first event (VD delete). As +event processing is done in deferred context the device list remains the +same (but targetID is re-used) so driver will not learn the VD +deletion/additon. I/Os meant for the older VD will be directed to new VD +which may lead to data corruption. + +Make driver detect the deleted VD as soon as possible based on the RaidMap +update and block further I/O to that device. + +Link: https://lore.kernel.org/r/20210528131307.25683-4-chandrakanth.patil@broadcom.com +Reported-by: kernel test robot +Signed-off-by: Kashyap Desai +Signed-off-by: Chandrakanth Patil +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas.h | 12 ++++ + drivers/scsi/megaraid/megaraid_sas_base.c | 83 ++++++++++++++++++++--- + drivers/scsi/megaraid/megaraid_sas_fp.c | 6 +- + 3 files changed, 92 insertions(+), 9 deletions(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h +index a6e788c02ff4..3d43ac9772f7 100644 +--- a/drivers/scsi/megaraid/megaraid_sas.h ++++ b/drivers/scsi/megaraid/megaraid_sas.h +@@ -2256,6 +2256,15 @@ enum MR_PERF_MODE { + (mode) == MR_LATENCY_PERF_MODE ? "Latency" : \ + "Unknown") + ++enum MEGASAS_LD_TARGET_ID_STATUS { ++ LD_TARGET_ID_INITIAL, ++ LD_TARGET_ID_ACTIVE, ++ LD_TARGET_ID_DELETED, ++}; ++ ++#define MEGASAS_TARGET_ID(sdev) \ ++ (((sdev->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) + sdev->id) ++ + struct megasas_instance { + + unsigned int *reply_map; +@@ -2320,6 +2329,9 @@ struct megasas_instance { + struct megasas_pd_list pd_list[MEGASAS_MAX_PD]; + struct megasas_pd_list local_pd_list[MEGASAS_MAX_PD]; + u8 ld_ids[MEGASAS_MAX_LD_IDS]; ++ u8 ld_tgtid_status[MEGASAS_MAX_LD_IDS]; ++ u8 ld_ids_prev[MEGASAS_MAX_LD_IDS]; ++ u8 ld_ids_from_raidmap[MEGASAS_MAX_LD_IDS]; + s8 init_id; + + u16 max_num_sge; +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 418178c2b548..6700d43b12ff 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -127,6 +127,8 @@ static int megasas_register_aen(struct megasas_instance *instance, + u32 seq_num, u32 class_locale_word); + static void megasas_get_pd_info(struct megasas_instance *instance, + struct scsi_device *sdev); ++static void ++megasas_set_ld_removed_by_fw(struct megasas_instance *instance); + + /* + * PCI ID table for all supported controllers +@@ -425,6 +427,12 @@ megasas_decode_evt(struct megasas_instance *instance) + (class_locale.members.locale), + format_class(class_locale.members.class), + evt_detail->description); ++ ++ if (megasas_dbg_lvl & LD_PD_DEBUG) ++ dev_info(&instance->pdev->dev, ++ "evt_detail.args.ld.target_id/index %d/%d\n", ++ evt_detail->args.ld.target_id, evt_detail->args.ld.ld_index); ++ + } + + /** +@@ -1759,6 +1767,7 @@ megasas_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + { + struct megasas_instance *instance; + struct MR_PRIV_DEVICE *mr_device_priv_data; ++ u32 ld_tgt_id; + + instance = (struct megasas_instance *) + scmd->device->host->hostdata; +@@ -1785,17 +1794,21 @@ megasas_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + } + } + +- if (atomic_read(&instance->adprecovery) == MEGASAS_HW_CRITICAL_ERROR) { ++ mr_device_priv_data = scmd->device->hostdata; ++ if (!mr_device_priv_data || ++ (atomic_read(&instance->adprecovery) == MEGASAS_HW_CRITICAL_ERROR)) { + scmd->result = DID_NO_CONNECT << 16; + scmd->scsi_done(scmd); + return 0; + } + +- mr_device_priv_data = scmd->device->hostdata; +- if (!mr_device_priv_data) { +- scmd->result = DID_NO_CONNECT << 16; +- scmd->scsi_done(scmd); +- return 0; ++ if (MEGASAS_IS_LOGICAL(scmd->device)) { ++ ld_tgt_id = MEGASAS_TARGET_ID(scmd->device); ++ if (instance->ld_tgtid_status[ld_tgt_id] == LD_TARGET_ID_DELETED) { ++ scmd->result = DID_NO_CONNECT << 16; ++ scmd->scsi_done(scmd); ++ return 0; ++ } + } + + if (atomic_read(&instance->adprecovery) != MEGASAS_HBA_OPERATIONAL) +@@ -2071,7 +2084,7 @@ static int megasas_slave_configure(struct scsi_device *sdev) + + static int megasas_slave_alloc(struct scsi_device *sdev) + { +- u16 pd_index = 0; ++ u16 pd_index = 0, ld_tgt_id; + struct megasas_instance *instance ; + struct MR_PRIV_DEVICE *mr_device_priv_data; + +@@ -2096,6 +2109,14 @@ scan_target: + GFP_KERNEL); + if (!mr_device_priv_data) + return -ENOMEM; ++ ++ if (MEGASAS_IS_LOGICAL(sdev)) { ++ ld_tgt_id = MEGASAS_TARGET_ID(sdev); ++ instance->ld_tgtid_status[ld_tgt_id] = LD_TARGET_ID_ACTIVE; ++ if (megasas_dbg_lvl & LD_PD_DEBUG) ++ sdev_printk(KERN_INFO, sdev, "LD target ID %d created.\n", ld_tgt_id); ++ } ++ + sdev->hostdata = mr_device_priv_data; + + atomic_set(&mr_device_priv_data->r1_ldio_hint, +@@ -2105,6 +2126,19 @@ scan_target: + + static void megasas_slave_destroy(struct scsi_device *sdev) + { ++ u16 ld_tgt_id; ++ struct megasas_instance *instance; ++ ++ instance = megasas_lookup_instance(sdev->host->host_no); ++ ++ if (MEGASAS_IS_LOGICAL(sdev)) { ++ ld_tgt_id = MEGASAS_TARGET_ID(sdev); ++ instance->ld_tgtid_status[ld_tgt_id] = LD_TARGET_ID_DELETED; ++ if (megasas_dbg_lvl & LD_PD_DEBUG) ++ sdev_printk(KERN_INFO, sdev, ++ "LD target ID %d removed from OS stack\n", ld_tgt_id); ++ } ++ + kfree(sdev->hostdata); + sdev->hostdata = NULL; + } +@@ -3456,6 +3490,22 @@ megasas_complete_abort(struct megasas_instance *instance, + } + } + ++static void ++megasas_set_ld_removed_by_fw(struct megasas_instance *instance) ++{ ++ uint i; ++ ++ for (i = 0; (i < MEGASAS_MAX_LD_IDS); i++) { ++ if (instance->ld_ids_prev[i] != 0xff && ++ instance->ld_ids_from_raidmap[i] == 0xff) { ++ if (megasas_dbg_lvl & LD_PD_DEBUG) ++ dev_info(&instance->pdev->dev, ++ "LD target ID %d removed from RAID map\n", i); ++ instance->ld_tgtid_status[i] = LD_TARGET_ID_DELETED; ++ } ++ } ++} ++ + /** + * megasas_complete_cmd - Completes a command + * @instance: Adapter soft state +@@ -3618,9 +3668,13 @@ megasas_complete_cmd(struct megasas_instance *instance, struct megasas_cmd *cmd, + fusion->fast_path_io = 0; + } + ++ if (instance->adapter_type >= INVADER_SERIES) ++ megasas_set_ld_removed_by_fw(instance); ++ + megasas_sync_map_info(instance); + spin_unlock_irqrestore(instance->host->host_lock, + flags); ++ + break; + } + if (opcode == MR_DCMD_CTRL_EVENT_GET_INFO || +@@ -8711,8 +8765,10 @@ megasas_aen_polling(struct work_struct *work) + union megasas_evt_class_locale class_locale; + int event_type = 0; + u32 seq_num; ++ u16 ld_target_id; + int error; + u8 dcmd_ret = DCMD_SUCCESS; ++ struct scsi_device *sdev1; + + if (!instance) { + printk(KERN_ERR "invalid instance!\n"); +@@ -8735,12 +8791,23 @@ megasas_aen_polling(struct work_struct *work) + break; + + case MR_EVT_LD_OFFLINE: +- case MR_EVT_CFG_CLEARED: + case MR_EVT_LD_DELETED: ++ ld_target_id = instance->evt_detail->args.ld.target_id; ++ sdev1 = scsi_device_lookup(instance->host, ++ MEGASAS_MAX_PD_CHANNELS + ++ (ld_target_id / MEGASAS_MAX_DEV_PER_CHANNEL), ++ (ld_target_id - MEGASAS_MAX_DEV_PER_CHANNEL), ++ 0); ++ if (sdev1) ++ megasas_remove_scsi_device(sdev1); ++ ++ event_type = SCAN_VD_CHANNEL; ++ break; + case MR_EVT_LD_CREATED: + event_type = SCAN_VD_CHANNEL; + break; + ++ case MR_EVT_CFG_CLEARED: + case MR_EVT_CTRL_HOST_BUS_SCAN_REQUESTED: + case MR_EVT_FOREIGN_CFG_IMPORTED: + case MR_EVT_LD_STATE_CHANGE: +diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c +index 50b8c1b12767..8bfb46dbbed3 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fp.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c +@@ -350,6 +350,10 @@ u8 MR_ValidateMapInfo(struct megasas_instance *instance, u64 map_id) + + num_lds = le16_to_cpu(drv_map->raidMap.ldCount); + ++ memcpy(instance->ld_ids_prev, ++ instance->ld_ids_from_raidmap, ++ sizeof(instance->ld_ids_from_raidmap)); ++ memset(instance->ld_ids_from_raidmap, 0xff, MEGASAS_MAX_LD_IDS); + /*Convert Raid capability values to CPU arch */ + for (i = 0; (num_lds > 0) && (i < MAX_LOGICAL_DRIVES_EXT); i++) { + ld = MR_TargetIdToLdGet(i, drv_map); +@@ -360,7 +364,7 @@ u8 MR_ValidateMapInfo(struct megasas_instance *instance, u64 map_id) + + raid = MR_LdRaidGet(ld, drv_map); + le32_to_cpus((u32 *)&raid->capability); +- ++ instance->ld_ids_from_raidmap[i] = i; + num_lds--; + } + +-- +2.30.2 + diff --git a/queue-5.4/scsi-megaraid_sas-fix-resource-leak-in-case-of-probe.patch b/queue-5.4/scsi-megaraid_sas-fix-resource-leak-in-case-of-probe.patch new file mode 100644 index 00000000000..6f71063bbbe --- /dev/null +++ b/queue-5.4/scsi-megaraid_sas-fix-resource-leak-in-case-of-probe.patch @@ -0,0 +1,78 @@ +From 4b1ac560a5d7d6dd24706897635b25dac7f46faa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 18:43:04 +0530 +Subject: scsi: megaraid_sas: Fix resource leak in case of probe failure + +From: Chandrakanth Patil + +[ Upstream commit b5438f48fdd8e1c3f130d32637511efd32038152 ] + +The driver doesn't clean up all the allocated resources properly when +scsi_add_host(), megasas_start_aen() function fails during the PCI device +probe. + +Clean up all those resources. + +Link: https://lore.kernel.org/r/20210528131307.25683-3-chandrakanth.patil@broadcom.com +Signed-off-by: Chandrakanth Patil +Signed-off-by: Sumit Saxena +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_base.c | 13 +++++++++++++ + drivers/scsi/megaraid/megaraid_sas_fusion.c | 1 + + 2 files changed, 14 insertions(+) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index b9c1f722f1de..418178c2b548 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -7415,11 +7415,16 @@ static int megasas_probe_one(struct pci_dev *pdev, + return 0; + + fail_start_aen: ++ instance->unload = 1; ++ scsi_remove_host(instance->host); + fail_io_attach: + megasas_mgmt_info.count--; + megasas_mgmt_info.max_index--; + megasas_mgmt_info.instance[megasas_mgmt_info.max_index] = NULL; + ++ if (instance->requestorId && !instance->skip_heartbeat_timer_del) ++ del_timer_sync(&instance->sriov_heartbeat_timer); ++ + instance->instancet->disable_intr(instance); + megasas_destroy_irqs(instance); + +@@ -7427,8 +7432,16 @@ fail_io_attach: + megasas_release_fusion(instance); + else + megasas_release_mfi(instance); ++ + if (instance->msix_vectors) + pci_free_irq_vectors(instance->pdev); ++ instance->msix_vectors = 0; ++ ++ if (instance->fw_crash_state != UNAVAILABLE) ++ megasas_free_host_crash_buffer(instance); ++ ++ if (instance->adapter_type != MFI_SERIES) ++ megasas_fusion_stop_watchdog(instance); + fail_init_mfi: + scsi_host_put(host); + fail_alloc_instance: +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 5dcd7b9b72ce..ae7a3e154bb2 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -5177,6 +5177,7 @@ megasas_alloc_fusion_context(struct megasas_instance *instance) + if (!fusion->log_to_span) { + dev_err(&instance->pdev->dev, "Failed from %s %d\n", + __func__, __LINE__); ++ kfree(instance->ctrl_context); + return -ENOMEM; + } + } +-- +2.30.2 + diff --git a/queue-5.4/scsi-megaraid_sas-handle-missing-interrupts-while-re.patch b/queue-5.4/scsi-megaraid_sas-handle-missing-interrupts-while-re.patch new file mode 100644 index 00000000000..9ded37c8dcf --- /dev/null +++ b/queue-5.4/scsi-megaraid_sas-handle-missing-interrupts-while-re.patch @@ -0,0 +1,76 @@ +From 0a20274b94b074aabaf1c8db081dea8f6c4fded4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 18:43:06 +0530 +Subject: scsi: megaraid_sas: Handle missing interrupts while re-enabling IRQs + +From: Chandrakanth Patil + +[ Upstream commit 9bedd36e9146b34dda4d6994e3aa1d72bc6442c1 ] + +While reenabling the IRQ after IRQ poll there may be a small window for the +firmware to post the replies with interrupts raised. In that case the +driver will not see the interrupts which leads to I/O timeout. + +This issue only happens when there are many I/O completions on a single +reply queue. This forces the driver to switch between the interrupt and IRQ +context. + +Make the driver process the reply queue one more time after enabling the +IRQ. + +Link: https://lore.kernel.org/linux-scsi/20201102072746.27410-1-sreekanth.reddy@broadcom.com/ +Link: https://lore.kernel.org/r/20210528131307.25683-5-chandrakanth.patil@broadcom.com +Cc: Tomas Henzl +Reported-by: kernel test robot +Signed-off-by: Chandrakanth Patil +Signed-off-by: Sumit Saxena +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/megaraid/megaraid_sas_fusion.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index ae7a3e154bb2..a78a702511fa 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -3716,6 +3716,7 @@ static void megasas_sync_irqs(unsigned long instance_addr) + if (irq_ctx->irq_poll_scheduled) { + irq_ctx->irq_poll_scheduled = false; + enable_irq(irq_ctx->os_irq); ++ complete_cmd_fusion(instance, irq_ctx->MSIxIndex, irq_ctx); + } + } + } +@@ -3747,6 +3748,7 @@ int megasas_irqpoll(struct irq_poll *irqpoll, int budget) + irq_poll_complete(irqpoll); + irq_ctx->irq_poll_scheduled = false; + enable_irq(irq_ctx->os_irq); ++ complete_cmd_fusion(instance, irq_ctx->MSIxIndex, irq_ctx); + } + + return num_entries; +@@ -3763,6 +3765,7 @@ megasas_complete_cmd_dpc_fusion(unsigned long instance_addr) + { + struct megasas_instance *instance = + (struct megasas_instance *)instance_addr; ++ struct megasas_irq_context *irq_ctx = NULL; + u32 count, MSIxIndex; + + count = instance->msix_vectors > 0 ? instance->msix_vectors : 1; +@@ -3771,8 +3774,10 @@ megasas_complete_cmd_dpc_fusion(unsigned long instance_addr) + if (atomic_read(&instance->adprecovery) == MEGASAS_HW_CRITICAL_ERROR) + return; + +- for (MSIxIndex = 0 ; MSIxIndex < count; MSIxIndex++) +- complete_cmd_fusion(instance, MSIxIndex, NULL); ++ for (MSIxIndex = 0 ; MSIxIndex < count; MSIxIndex++) { ++ irq_ctx = &instance->irq_context[MSIxIndex]; ++ complete_cmd_fusion(instance, MSIxIndex, irq_ctx); ++ } + } + + /** +-- +2.30.2 + diff --git a/queue-5.4/scsi-qedi-fix-null-ref-during-abort-handling.patch b/queue-5.4/scsi-qedi-fix-null-ref-during-abort-handling.patch new file mode 100644 index 00000000000..288e684ae3b --- /dev/null +++ b/queue-5.4/scsi-qedi-fix-null-ref-during-abort-handling.patch @@ -0,0 +1,38 @@ +From 27b7625bad51997263b2e8cbcb2bc597dd1728b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 13:18:12 -0500 +Subject: scsi: qedi: Fix null ref during abort handling + +From: Mike Christie + +[ Upstream commit 5777b7f0f03ce49372203b6521631f62f2810c8f ] + +If qedi_process_cmd_cleanup_resp finds the cmd it frees the work and sets +list_tmf_work to NULL, so qedi_tmf_work should check if list_tmf_work is +non-NULL when it wants to force cleanup. + +Link: https://lore.kernel.org/r/20210525181821.7617-20-michael.christie@oracle.com +Reviewed-by: Manish Rangankar +Signed-off-by: Mike Christie +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_fw.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c +index 90aa64604ad7..37b8f08d5020 100644 +--- a/drivers/scsi/qedi/qedi_fw.c ++++ b/drivers/scsi/qedi/qedi_fw.c +@@ -1451,7 +1451,7 @@ abort_ret: + + ldel_exit: + spin_lock_bh(&qedi_conn->tmf_work_lock); +- if (!qedi_cmd->list_tmf_work) { ++ if (qedi_cmd->list_tmf_work) { + list_del_init(&list_work->list); + qedi_cmd->list_tmf_work = NULL; + kfree(list_work); +-- +2.30.2 + diff --git a/queue-5.4/scsi-scsi_dh_alua-check-for-negative-result-value.patch b/queue-5.4/scsi-scsi_dh_alua-check-for-negative-result-value.patch new file mode 100644 index 00000000000..1d94efac5eb --- /dev/null +++ b/queue-5.4/scsi-scsi_dh_alua-check-for-negative-result-value.patch @@ -0,0 +1,58 @@ +From e89ef9168b1040d3f53136fe5eea144e60c58d4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 10:30:11 +0200 +Subject: scsi: scsi_dh_alua: Check for negative result value + +From: Hannes Reinecke + +[ Upstream commit 7e26e3ea028740f934477ec01ba586ab033c35aa ] + +scsi_execute() will now return a negative error if there was an error prior +to command submission; evaluate that instead if checking for DRIVER_ERROR. + +[mkp: build fix] + +Link: https://lore.kernel.org/r/20210427083046.31620-6-hare@suse.de +Signed-off-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index df5a3bbeba5e..4743317a269a 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -548,12 +548,12 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + kfree(buff); + return SCSI_DH_OK; + } +- if (!scsi_sense_valid(&sense_hdr)) { ++ if (retval < 0 || !scsi_sense_valid(&sense_hdr)) { + sdev_printk(KERN_INFO, sdev, + "%s: rtpg failed, result %d\n", + ALUA_DH_NAME, retval); + kfree(buff); +- if (driver_byte(retval) == DRIVER_ERROR) ++ if (retval < 0) + return SCSI_DH_DEV_TEMP_BUSY; + return SCSI_DH_IO; + } +@@ -775,11 +775,11 @@ static unsigned alua_stpg(struct scsi_device *sdev, struct alua_port_group *pg) + retval = submit_stpg(sdev, pg->group_id, &sense_hdr); + + if (retval) { +- if (!scsi_sense_valid(&sense_hdr)) { ++ if (retval < 0 || !scsi_sense_valid(&sense_hdr)) { + sdev_printk(KERN_INFO, sdev, + "%s: stpg failed, result %d", + ALUA_DH_NAME, retval); +- if (driver_byte(retval) == DRIVER_ERROR) ++ if (retval < 0) + return SCSI_DH_DEV_TEMP_BUSY; + } else { + sdev_printk(KERN_INFO, sdev, "%s: stpg failed\n", +-- +2.30.2 + diff --git a/queue-5.4/selftests-powerpc-fix-no_handler-ebb-selftest.patch b/queue-5.4/selftests-powerpc-fix-no_handler-ebb-selftest.patch new file mode 100644 index 00000000000..fe3f8e36d4e --- /dev/null +++ b/queue-5.4/selftests-powerpc-fix-no_handler-ebb-selftest.patch @@ -0,0 +1,45 @@ +From ee5cf3636d9e95cdd0ee3dfe6d8c914ccf8f6af9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 09:51:42 -0400 +Subject: selftests/powerpc: Fix "no_handler" EBB selftest + +From: Athira Rajeev + +[ Upstream commit 45677c9aebe926192e59475b35a1ff35ff2d4217 ] + +The "no_handler_test" in ebb selftests attempts to read the PMU +registers twice via helper function "dump_ebb_state". First dump is +just before closing of event and the second invocation is done after +closing of the event. The original intention of second +dump_ebb_state was to dump the state of registers at the end of +the test when the counters are frozen. But this will be achieved +with the first call itself since sample period is set to low value +and PMU will be frozen by then. Hence patch removes the +dump which was done before closing of the event. + +Reported-by: Shirisha Ganta +Signed-off-by: Athira Rajeev +Tested-by: Nageswara R Sastry > +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1621950703-1532-2-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c +index fc5bf4870d8e..01e827c31169 100644 +--- a/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c ++++ b/tools/testing/selftests/powerpc/pmu/ebb/no_handler_test.c +@@ -50,8 +50,6 @@ static int no_handler_test(void) + + event_close(&event); + +- dump_ebb_state(); +- + /* The real test is that we never took an EBB at 0x0 */ + + return 0; +-- +2.30.2 + diff --git a/queue-5.4/selftests-timers-rtcpie-skip-test-if-default-rtc-dev.patch b/queue-5.4/selftests-timers-rtcpie-skip-test-if-default-rtc-dev.patch new file mode 100644 index 00000000000..6187d2cc2d6 --- /dev/null +++ b/queue-5.4/selftests-timers-rtcpie-skip-test-if-default-rtc-dev.patch @@ -0,0 +1,67 @@ +From 186378968f2444f0e9a89af3112556143645989d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 10:36:14 +0800 +Subject: selftests: timers: rtcpie: skip test if default RTC device does not + exist + +From: Po-Hsu Lin + +[ Upstream commit 0d3e5a057992bdc66e4dca2ca50b77fa4a7bd90e ] + +This test will require /dev/rtc0, the default RTC device, or one +specified by user to run. Since this default RTC is not guaranteed to +exist on all of the devices, so check its existence first, otherwise +skip this test with the kselftest skip code 4. + +Without this patch this test will fail like this on a s390x zVM: +$ selftests: timers: rtcpie +$ /dev/rtc0: No such file or directory +not ok 1 selftests: timers: rtcpie # exit=22 + +With this patch: +$ selftests: timers: rtcpie +$ Default RTC /dev/rtc0 does not exist. Test Skipped! +not ok 9 selftests: timers: rtcpie # SKIP + +Fixed up change log so "With this patch" text doesn't get dropped. +Shuah Khan + +Signed-off-by: Po-Hsu Lin +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/timers/rtcpie.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/timers/rtcpie.c b/tools/testing/selftests/timers/rtcpie.c +index 47b5bad1b393..4ef2184f1558 100644 +--- a/tools/testing/selftests/timers/rtcpie.c ++++ b/tools/testing/selftests/timers/rtcpie.c +@@ -18,6 +18,8 @@ + #include + #include + ++#include "../kselftest.h" ++ + /* + * This expects the new RTC class driver framework, working with + * clocks that will often not be clones of what the PC-AT had. +@@ -35,8 +37,14 @@ int main(int argc, char **argv) + switch (argc) { + case 2: + rtc = argv[1]; +- /* FALLTHROUGH */ ++ break; + case 1: ++ fd = open(default_rtc, O_RDONLY); ++ if (fd == -1) { ++ printf("Default RTC %s does not exist. Test Skipped!\n", default_rtc); ++ exit(KSFT_SKIP); ++ } ++ close(fd); + break; + default: + fprintf(stderr, "usage: rtctest [rtcdev] [d]\n"); +-- +2.30.2 + diff --git a/queue-5.4/serial-tty-uartlite-fix-console-setup.patch b/queue-5.4/serial-tty-uartlite-fix-console-setup.patch new file mode 100644 index 00000000000..50ba35c170e --- /dev/null +++ b/queue-5.4/serial-tty-uartlite-fix-console-setup.patch @@ -0,0 +1,92 @@ +From 89c2e2a1da1dec75a8b5ffef7f2cfa4a73846d02 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 May 2021 15:33:20 +0200 +Subject: serial: tty: uartlite: fix console setup + +From: Daniel Mack + +[ Upstream commit d157fca711ad42e75efef3444c83d2e1a17be27a ] + +Remove the hack to assign the global console_port variable at probe time. +This assumption that cons->index is -1 is wrong for systems that specify +'console=' in the cmdline (or 'stdout-path' in dts). Hence, on such system +the actual console assignment is ignored, and the first UART that happens +to be probed is used as console instead. + +Move the logic to console_setup() and map the console to the correct port +through the array of available ports instead. + +Signed-off-by: Daniel Mack +Link: https://lore.kernel.org/r/20210528133321.1859346-1-daniel@zonque.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/uartlite.c | 27 ++++++--------------------- + 1 file changed, 6 insertions(+), 21 deletions(-) + +diff --git a/drivers/tty/serial/uartlite.c b/drivers/tty/serial/uartlite.c +index 06e79c11141d..56066d93a65b 100644 +--- a/drivers/tty/serial/uartlite.c ++++ b/drivers/tty/serial/uartlite.c +@@ -508,21 +508,23 @@ static void ulite_console_write(struct console *co, const char *s, + + static int ulite_console_setup(struct console *co, char *options) + { +- struct uart_port *port; ++ struct uart_port *port = NULL; + int baud = 9600; + int bits = 8; + int parity = 'n'; + int flow = 'n'; + +- +- port = console_port; ++ if (co->index >= 0 && co->index < ULITE_NR_UARTS) ++ port = ulite_ports + co->index; + + /* Has the device been initialized yet? */ +- if (!port->mapbase) { ++ if (!port || !port->mapbase) { + pr_debug("console on ttyUL%i not present\n", co->index); + return -ENODEV; + } + ++ console_port = port; ++ + /* not initialized yet? */ + if (!port->membase) { + if (ulite_request_port(port)) +@@ -658,17 +660,6 @@ static int ulite_assign(struct device *dev, int id, u32 base, int irq, + + dev_set_drvdata(dev, port); + +-#ifdef CONFIG_SERIAL_UARTLITE_CONSOLE +- /* +- * If console hasn't been found yet try to assign this port +- * because it is required to be assigned for console setup function. +- * If register_console() don't assign value, then console_port pointer +- * is cleanup. +- */ +- if (ulite_uart_driver.cons->index == -1) +- console_port = port; +-#endif +- + /* Register the port */ + rc = uart_add_one_port(&ulite_uart_driver, port); + if (rc) { +@@ -678,12 +669,6 @@ static int ulite_assign(struct device *dev, int id, u32 base, int irq, + return rc; + } + +-#ifdef CONFIG_SERIAL_UARTLITE_CONSOLE +- /* This is not port which is used for console that's why clean it up */ +- if (ulite_uart_driver.cons->index == -1) +- console_port = NULL; +-#endif +- + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.4/series b/queue-5.4/series index 82433b7cfc6..286e9b4ccbf 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -6,3 +6,142 @@ tracing-do-not-reference-char-as-a-string-in-histograms.patch cgroup-verify-that-source-is-a-string.patch fbmem-do-not-delete-the-mode-that-is-still-in-use.patch net-moxa-use-devm_platform_get_and_ioremap_resource.patch +dmaengine-fsl-qdma-check-dma_set_mask-return-value.patch +srcu-fix-broken-node-geometry-after-early-ssp-init.patch +tty-serial-fsl_lpuart-fix-the-potential-risk-of-divi.patch +misc-libmasm-module-fix-two-use-after-free-in-ibmasm.patch +misc-alcor_pci-fix-null-ptr-deref-when-there-is-no-p.patch +iio-gyro-fxa21002c-balance-runtime-pm-use-pm_runtime.patch +iio-magn-bmc150-balance-runtime-pm-use-pm_runtime_re.patch +alsa-usx2y-don-t-call-free_pages_exact-with-null-add.patch +revert-alsa-bebob-oxfw-fix-kconfig-entry-for-mackie-.patch +w1-ds2438-fixing-bug-that-would-always-get-page0.patch +scsi-hisi_sas-propagate-errors-in-interrupt_init_v1_.patch +scsi-lpfc-fix-unexpected-timeout-error-in-direct-att.patch +scsi-lpfc-fix-crash-when-lpfc_sli4_hba_setup-fails-t.patch +scsi-core-cap-scsi_host-cmd_per_lun-at-can_queue.patch +alsa-ac97-fix-pm-reference-leak-in-ac97_bus_remove.patch +tty-serial-8250-serial_cs-fix-a-memory-leak-in-error.patch +scsi-scsi_dh_alua-check-for-negative-result-value.patch +fs-jfs-fix-missing-error-code-in-lmloginit.patch +scsi-megaraid_sas-fix-resource-leak-in-case-of-probe.patch +scsi-megaraid_sas-early-detection-of-vd-deletion-thr.patch +scsi-megaraid_sas-handle-missing-interrupts-while-re.patch +scsi-iscsi-add-iscsi_cls_conn-refcount-helpers.patch +scsi-iscsi-fix-conn-use-after-free-during-resets.patch +scsi-iscsi-fix-shost-max_id-use.patch +scsi-qedi-fix-null-ref-during-abort-handling.patch +mfd-da9052-stmpe-add-and-modify-module_device_table.patch +mfd-cpcap-fix-cpcap-dmamask-not-set-warnings.patch +asoc-img-fix-pm-reference-leak-in-img_i2s_in_probe.patch +serial-tty-uartlite-fix-console-setup.patch +s390-sclp_vt220-fix-console-name-to-match-device.patch +selftests-timers-rtcpie-skip-test-if-default-rtc-dev.patch +alsa-sb-fix-potential-double-free-of-csp-mixer-eleme.patch +powerpc-ps3-add-dma_mask-to-ps3_dma_region.patch +iommu-arm-smmu-fix-arm_smmu_device-refcount-leak-whe.patch +iommu-arm-smmu-fix-arm_smmu_device-refcount-leak-in-.patch +gpio-zynq-check-return-value-of-pm_runtime_get_sync.patch +alsa-ppc-fix-error-return-code-in-snd_pmac_probe.patch +selftests-powerpc-fix-no_handler-ebb-selftest.patch +gpio-pca953x-add-support-for-the-on-semi-pca9655.patch +asoc-soc-core-fix-the-error-return-code-in-snd_soc_o.patch +s390-processor-always-inline-stap-and-__load_psw_mas.patch +s390-ipl_parm-fix-program-check-new-psw-handling.patch +s390-mem_detect-fix-diag260-program-check-new-psw-ha.patch +s390-mem_detect-fix-tprot-program-check-new-psw-hand.patch +input-hideep-fix-the-uninitialized-use-in-hideep_nvm.patch +alsa-bebob-add-support-for-toneweal-fw66.patch +alsa-usb-audio-scarlett2-fix-18i8-gen-2-pcm-input-co.patch +alsa-usb-audio-scarlett2-fix-data_mutex-lock.patch +alsa-usb-audio-scarlett2-fix-scarlett2_-_ctl_put-ret.patch +usb-gadget-f_hid-fix-endianness-issue-with-descripto.patch +usb-gadget-hid-fix-error-return-code-in-hid_bind.patch +powerpc-boot-fixup-device-tree-on-little-endian.patch +asoc-intel-kbl_da7219_max98357a-shrink-platform_id-b.patch +backlight-lm3630a-fix-return-code-of-.update_status-.patch +alsa-hda-add-irq-check-for-platform_get_irq.patch +alsa-usb-audio-scarlett2-fix-6i6-gen-2-line-out-desc.patch +staging-rtl8723bs-fix-macro-value-for-2.4ghz-only-de.patch +intel_th-wait-until-port-is-in-reset-before-programm.patch +i2c-core-disable-client-irq-on-reboot-shutdown.patch +lib-decompress_unlz4.c-correctly-handle-zero-padding.patch +power-supply-sc27xx-add-missing-module_device_table.patch +power-supply-sc2731_charger-add-missing-module_devic.patch +pwm-spear-don-t-modify-hw-state-in-.remove-callback.patch +power-supply-ab8500-avoid-null-pointers.patch +power-supply-max17042-do-not-enforce-incorrect-inter.patch +power-reset-gpio-poweroff-add-missing-module_device_.patch +arm-9087-1-kprobes-test-thumb-fix-for-llvm_ias-1.patch +pci-p2pdma-avoid-pci_get_slot-which-may-sleep.patch +watchdog-fix-possible-use-after-free-in-wdt_startup.patch +watchdog-sc520_wdt-fix-possible-use-after-free-in-wd.patch +watchdog-fix-possible-use-after-free-by-calling-del_.patch +watchdog-imx_sc_wdt-fix-pretimeout.patch +watchdog-itco_wdt-account-for-rebooting-on-second-ti.patch +x86-fpu-return-proper-error-codes-from-user-access-f.patch +pci-tegra-add-missing-module_device_table.patch +orangefs-fix-orangefs-df-output.patch +ceph-remove-bogus-checks-and-warn_ons-from-ceph_set_.patch +nfs-nfs_find_open_context-may-only-select-open-files.patch +power-supply-charger-manager-add-missing-module_devi.patch +power-supply-ab8500-add-missing-module_device_table.patch +pwm-img-fix-pm-reference-leak-in-img_pwm_enable.patch +pwm-tegra-don-t-modify-hw-state-in-.remove-callback.patch +acpi-amba-fix-resource-name-in-proc-iomem.patch +acpi-video-add-quirk-for-the-dell-vostro-3350.patch +virtio-blk-fix-memory-leak-among-suspend-resume-proc.patch +virtio_net-fix-error-handling-in-virtnet_restore.patch +virtio_console-assure-used-length-from-device-is-lim.patch +x86-signal-detect-and-prevent-an-alternate-signal-st.patch +f2fs-add-module_softdep-to-ensure-crc32-is-included-.patch +pci-sysfs-fix-dsm_label_utf16s_to_utf8s-buffer-overr.patch +power-supply-rt5033_battery-fix-device-tree-enumerat.patch +nfsv4-initialise-connection-to-the-server-in-nfs4_al.patch +um-fix-error-return-code-in-slip_open.patch +um-fix-error-return-code-in-winch_tramp.patch +watchdog-aspeed-fix-hardware-timeout-calculation.patch +nfs-fix-acl-memory-leak-of-posix_acl_create.patch +ubifs-set-clear-i_linkable-under-i_lock-for-whiteout.patch +pci-iproc-fix-multi-msi-base-vector-number-allocatio.patch +pci-iproc-support-multi-msi-only-on-uniprocessor-ker.patch +x86-fpu-limit-xstate-copy-size-in-xstateregs_set.patch +pwm-imx1-don-t-disable-clocks-at-device-remove-time.patch +virtio_net-move-tx-vq-operation-under-tx-queue-lock.patch +nvme-tcp-can-t-set-sk_user_data-without-write_lock.patch +alsa-isa-fix-error-return-code-in-snd_cmi8330_probe.patch +nfsv4-pnfs-don-t-call-_nfs4_pnfs_v3_ds_connect-multi.patch +hexagon-use-common-discards-macro.patch +arm-dts-gemini-rut1xx-remove-duplicate-ethernet-node.patch +reset-a10sr-add-missing-of_match_table-reference.patch +arm-exynos-add-missing-of_node_put-for-loop-iteratio.patch +arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch +arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-17224 +arm-dts-exynos-fix-pwm-led-max-brightness-on-odroid-.patch-1539 +memory-atmel-ebi-add-missing-of_node_put-for-loop-it.patch +reset-brcmstb-add-missing-module_device_table.patch +memory-pl353-fix-error-return-code-in-pl353_smc_prob.patch +rtc-fix-snprintf-checking-in-is_rtc_hctosys.patch +arm64-dts-renesas-v3msk-fix-memory-size.patch +arm-dts-r8a7779-marzen-fix-du-clock-names.patch +arm64-dts-qcom-msm8994-angler-fix-gpio-reserved-rang.patch +firmware-tegra-fix-error-return-code-in-tegra210_bpm.patch +firmware-arm_scmi-reset-rx-buffer-to-max-size-during.patch +arm-dts-bcm5301x-fixup-spi-binding.patch +reset-bail-if-try_module_get-fails.patch +memory-fsl_ifc-fix-leak-of-io-mapping-on-probe-failu.patch +memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch +arm-dts-am335x-align-ti-pindir-d0-out-d1-in-property.patch +arm-dts-am437x-align-ti-pindir-d0-out-d1-in-property.patch +arm-dts-imx6q-dhcom-fix-ethernet-reset-time-properti.patch +arm-dts-imx6q-dhcom-fix-ethernet-plugin-detection-pr.patch +arm-dts-imx6q-dhcom-add-gpios-pinctrl-for-i2c-bus-re.patch +thermal-drivers-rcar_gen3_thermal-fix-coefficient-ca.patch +firmware-turris-mox-rwtm-fix-reply-status-decoding-f.patch +firmware-turris-mox-rwtm-report-failures-better.patch +firmware-turris-mox-rwtm-fail-probing-when-firmware-.patch +scsi-be2iscsi-fix-an-error-handling-path-in-beiscsi_.patch +mips-always-link-byteswap-helpers-into-decompressor.patch +mips-disable-branch-profiling-in-boot-decompress.o.patch +perf-report-fix-task-and-stat-with-pipe-input.patch +mips-vdso-invalid-gic-access-through-vdso.patch diff --git a/queue-5.4/srcu-fix-broken-node-geometry-after-early-ssp-init.patch b/queue-5.4/srcu-fix-broken-node-geometry-after-early-ssp-init.patch new file mode 100644 index 00000000000..f5efc3cba9a --- /dev/null +++ b/queue-5.4/srcu-fix-broken-node-geometry-after-early-ssp-init.patch @@ -0,0 +1,151 @@ +From 7880645ede087f752f0cfc83ab41c431c5667d21 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 17 Apr 2021 15:16:49 +0200 +Subject: srcu: Fix broken node geometry after early ssp init + +From: Frederic Weisbecker + +[ Upstream commit b5befe842e6612cf894cf4a199924ee872d8b7d8 ] + +An srcu_struct structure that is initialized before rcu_init_geometry() +will have its srcu_node hierarchy based on CONFIG_NR_CPUS. Once +rcu_init_geometry() is called, this hierarchy is compressed as needed +for the actual maximum number of CPUs for this system. + +Later on, that srcu_struct structure is confused, sometimes referring +to its initial CONFIG_NR_CPUS-based hierarchy, and sometimes instead +to the new num_possible_cpus() hierarchy. For example, each of its +->mynode fields continues to reference the original leaf rcu_node +structures, some of which might no longer exist. On the other hand, +srcu_for_each_node_breadth_first() traverses to the new node hierarchy. + +There are at least two bad possible outcomes to this: + +1) a) A callback enqueued early on an srcu_data structure (call it + *sdp) is recorded pending on sdp->mynode->srcu_data_have_cbs in + srcu_funnel_gp_start() with sdp->mynode pointing to a deep leaf + (say 3 levels). + + b) The grace period ends after rcu_init_geometry() shrinks the + nodes level to a single one. srcu_gp_end() walks through the new + srcu_node hierarchy without ever reaching the old leaves so the + callback is never executed. + + This is easily reproduced on an 8 CPUs machine with CONFIG_NR_CPUS >= 32 + and "rcupdate.rcu_self_test=1". The srcu_barrier() after early tests + verification never completes and the boot hangs: + + [ 5413.141029] INFO: task swapper/0:1 blocked for more than 4915 seconds. + [ 5413.147564] Not tainted 5.12.0-rc4+ #28 + [ 5413.151927] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. + [ 5413.159753] task:swapper/0 state:D stack: 0 pid: 1 ppid: 0 flags:0x00004000 + [ 5413.168099] Call Trace: + [ 5413.170555] __schedule+0x36c/0x930 + [ 5413.174057] ? wait_for_completion+0x88/0x110 + [ 5413.178423] schedule+0x46/0xf0 + [ 5413.181575] schedule_timeout+0x284/0x380 + [ 5413.185591] ? wait_for_completion+0x88/0x110 + [ 5413.189957] ? mark_held_locks+0x61/0x80 + [ 5413.193882] ? mark_held_locks+0x61/0x80 + [ 5413.197809] ? _raw_spin_unlock_irq+0x24/0x50 + [ 5413.202173] ? wait_for_completion+0x88/0x110 + [ 5413.206535] wait_for_completion+0xb4/0x110 + [ 5413.210724] ? srcu_torture_stats_print+0x110/0x110 + [ 5413.215610] srcu_barrier+0x187/0x200 + [ 5413.219277] ? rcu_tasks_verify_self_tests+0x50/0x50 + [ 5413.224244] ? rdinit_setup+0x2b/0x2b + [ 5413.227907] rcu_verify_early_boot_tests+0x2d/0x40 + [ 5413.232700] do_one_initcall+0x63/0x310 + [ 5413.236541] ? rdinit_setup+0x2b/0x2b + [ 5413.240207] ? rcu_read_lock_sched_held+0x52/0x80 + [ 5413.244912] kernel_init_freeable+0x253/0x28f + [ 5413.249273] ? rest_init+0x250/0x250 + [ 5413.252846] kernel_init+0xa/0x110 + [ 5413.256257] ret_from_fork+0x22/0x30 + +2) An srcu_struct structure that is initialized before rcu_init_geometry() + and used afterward will always have stale rdp->mynode references, + resulting in callbacks to be missed in srcu_gp_end(), just like in + the previous scenario. + +This commit therefore causes init_srcu_struct_nodes to initialize the +geometry, if needed. This ensures that the srcu_node hierarchy is +properly built and distributed from the get-go. + +Suggested-by: Paul E. McKenney +Signed-off-by: Frederic Weisbecker +Cc: Boqun Feng +Cc: Lai Jiangshan +Cc: Neeraj Upadhyay +Cc: Josh Triplett +Cc: Joel Fernandes +Cc: Uladzislau Rezki +Signed-off-by: Paul E. McKenney +Signed-off-by: Sasha Levin +--- + kernel/rcu/rcu.h | 2 ++ + kernel/rcu/srcutree.c | 3 +++ + kernel/rcu/tree.c | 16 +++++++++++++++- + 3 files changed, 20 insertions(+), 1 deletion(-) + +diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h +index 8fd4f82c9b3d..7fd1c18b7cf1 100644 +--- a/kernel/rcu/rcu.h ++++ b/kernel/rcu/rcu.h +@@ -316,6 +316,8 @@ static inline void rcu_init_levelspread(int *levelspread, const int *levelcnt) + } + } + ++extern void rcu_init_geometry(void); ++ + /* Returns a pointer to the first leaf rcu_node structure. */ + #define rcu_first_leaf_node() (rcu_state.level[rcu_num_lvls - 1]) + +diff --git a/kernel/rcu/srcutree.c b/kernel/rcu/srcutree.c +index 21acdff3bd27..21115ffb6c44 100644 +--- a/kernel/rcu/srcutree.c ++++ b/kernel/rcu/srcutree.c +@@ -90,6 +90,9 @@ static void init_srcu_struct_nodes(struct srcu_struct *ssp, bool is_static) + struct srcu_node *snp; + struct srcu_node *snp_first; + ++ /* Initialize geometry if it has not already been initialized. */ ++ rcu_init_geometry(); ++ + /* Work out the overall tree geometry. */ + ssp->level[0] = &ssp->node[0]; + for (i = 1; i < rcu_num_lvls; i++) +diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c +index fd37827eca5b..11ae2747701b 100644 +--- a/kernel/rcu/tree.c ++++ b/kernel/rcu/tree.c +@@ -3425,11 +3425,25 @@ static void __init rcu_init_one(void) + * replace the definitions in tree.h because those are needed to size + * the ->node array in the rcu_state structure. + */ +-static void __init rcu_init_geometry(void) ++void rcu_init_geometry(void) + { + ulong d; + int i; ++ static unsigned long old_nr_cpu_ids; + int rcu_capacity[RCU_NUM_LVLS]; ++ static bool initialized; ++ ++ if (initialized) { ++ /* ++ * Warn if setup_nr_cpu_ids() had not yet been invoked, ++ * unless nr_cpus_ids == NR_CPUS, in which case who cares? ++ */ ++ WARN_ON_ONCE(old_nr_cpu_ids != nr_cpu_ids); ++ return; ++ } ++ ++ old_nr_cpu_ids = nr_cpu_ids; ++ initialized = true; + + /* + * Initialize any unspecified boot parameters. +-- +2.30.2 + diff --git a/queue-5.4/staging-rtl8723bs-fix-macro-value-for-2.4ghz-only-de.patch b/queue-5.4/staging-rtl8723bs-fix-macro-value-for-2.4ghz-only-de.patch new file mode 100644 index 00000000000..e528182c132 --- /dev/null +++ b/queue-5.4/staging-rtl8723bs-fix-macro-value-for-2.4ghz-only-de.patch @@ -0,0 +1,40 @@ +From 3405f8162bc6a4f48b3ed8c375a4b694760cbcd4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 15:09:58 +0200 +Subject: staging: rtl8723bs: fix macro value for 2.4Ghz only device + +From: Fabio Aiuto + +[ Upstream commit 6d490a27e23c5fb79b766530016ab8665169498e ] + +fix IQK_Matrix_Settings_NUM macro value to 14 which is +the max channel number value allowed in a 2.4Ghz device. + +Acked-by: Hans de Goede +Signed-off-by: Fabio Aiuto +Link: https://lore.kernel.org/r/0b4a876929949248aa18cb919da3583c65e4ee4e.1624367072.git.fabioaiuto83@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/rtl8723bs/hal/odm.h | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/staging/rtl8723bs/hal/odm.h b/drivers/staging/rtl8723bs/hal/odm.h +index fba3b9e1491b..ee867621aed9 100644 +--- a/drivers/staging/rtl8723bs/hal/odm.h ++++ b/drivers/staging/rtl8723bs/hal/odm.h +@@ -197,10 +197,7 @@ typedef struct _ODM_RATE_ADAPTIVE { + + #define AVG_THERMAL_NUM 8 + #define IQK_Matrix_REG_NUM 8 +-#define IQK_Matrix_Settings_NUM (14 + 24 + 21) /* Channels_2_4G_NUM +- * + Channels_5G_20M_NUM +- * + Channels_5G +- */ ++#define IQK_Matrix_Settings_NUM 14 /* Channels_2_4G_NUM */ + + #define DM_Type_ByFW 0 + #define DM_Type_ByDriver 1 +-- +2.30.2 + diff --git a/queue-5.4/thermal-drivers-rcar_gen3_thermal-fix-coefficient-ca.patch b/queue-5.4/thermal-drivers-rcar_gen3_thermal-fix-coefficient-ca.patch new file mode 100644 index 00000000000..4a45d2daad9 --- /dev/null +++ b/queue-5.4/thermal-drivers-rcar_gen3_thermal-fix-coefficient-ca.patch @@ -0,0 +1,45 @@ +From b498a598ed38437d1fbdcd3e95c6c9e536aa7183 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Jun 2021 10:52:11 +0200 +Subject: thermal/drivers/rcar_gen3_thermal: Fix coefficient calculations +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Niklas Söderlund + +[ Upstream commit 8946187ab57ffd02088e50256c73dd31f49db06d ] + +The fixed value of 157 used in the calculations are only correct for +M3-W, on other Gen3 SoC it should be 167. The constant can be derived +correctly from the static TJ_3 constant and the SoC specific TJ_1 value. +Update the calculation be correct on all Gen3 SoCs. + +Fixes: 4eb39f79ef44 ("thermal: rcar_gen3_thermal: Update value of Tj_1") +Reported-by: Yoshihiro Shimoda +Signed-off-by: Niklas Söderlund +Reviewed-by: Yoshihiro Shimoda +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20210605085211.564909-1-niklas.soderlund+renesas@ragnatech.se +Signed-off-by: Sasha Levin +--- + drivers/thermal/rcar_gen3_thermal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/thermal/rcar_gen3_thermal.c b/drivers/thermal/rcar_gen3_thermal.c +index 1ab2ffff4e7c..a0673059bd4a 100644 +--- a/drivers/thermal/rcar_gen3_thermal.c ++++ b/drivers/thermal/rcar_gen3_thermal.c +@@ -143,7 +143,7 @@ static void rcar_gen3_thermal_calc_coefs(struct rcar_gen3_thermal_tsc *tsc, + * Division is not scaled in BSP and if scaled it might overflow + * the dividend (4095 * 4095 << 14 > INT_MAX) so keep it unscaled + */ +- tsc->tj_t = (FIXPT_INT((ptat[1] - ptat[2]) * 157) ++ tsc->tj_t = (FIXPT_INT((ptat[1] - ptat[2]) * (ths_tj_1 - TJ_3)) + / (ptat[0] - ptat[2])) + FIXPT_INT(TJ_3); + + tsc->coef.a1 = FIXPT_DIV(FIXPT_INT(thcode[1] - thcode[2]), +-- +2.30.2 + diff --git a/queue-5.4/tty-serial-8250-serial_cs-fix-a-memory-leak-in-error.patch b/queue-5.4/tty-serial-8250-serial_cs-fix-a-memory-leak-in-error.patch new file mode 100644 index 00000000000..cb585097aaf --- /dev/null +++ b/queue-5.4/tty-serial-8250-serial_cs-fix-a-memory-leak-in-error.patch @@ -0,0 +1,55 @@ +From 7158b729bcbd026a65fc425eb258f51b8cea48ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 21:44:04 +0200 +Subject: tty: serial: 8250: serial_cs: Fix a memory leak in error handling + path + +From: Christophe JAILLET + +[ Upstream commit fad92b11047a748c996ebd6cfb164a63814eeb2e ] + +In the probe function, if the final 'serial_config()' fails, 'info' is +leaking. + +Add a resource handling path to free this memory. + +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/dc25f96b7faebf42e60fe8d02963c941cf4d8124.1621971720.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/8250/serial_cs.c | 11 ++++++++++- + 1 file changed, 10 insertions(+), 1 deletion(-) + +diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c +index ccd1a615305b..a05c2b652040 100644 +--- a/drivers/tty/serial/8250/serial_cs.c ++++ b/drivers/tty/serial/8250/serial_cs.c +@@ -306,6 +306,7 @@ static int serial_resume(struct pcmcia_device *link) + static int serial_probe(struct pcmcia_device *link) + { + struct serial_info *info; ++ int ret; + + dev_dbg(&link->dev, "serial_attach()\n"); + +@@ -320,7 +321,15 @@ static int serial_probe(struct pcmcia_device *link) + if (do_sound) + link->config_flags |= CONF_ENABLE_SPKR; + +- return serial_config(link); ++ ret = serial_config(link); ++ if (ret) ++ goto free_info; ++ ++ return 0; ++ ++free_info: ++ kfree(info); ++ return ret; + } + + static void serial_detach(struct pcmcia_device *link) +-- +2.30.2 + diff --git a/queue-5.4/tty-serial-fsl_lpuart-fix-the-potential-risk-of-divi.patch b/queue-5.4/tty-serial-fsl_lpuart-fix-the-potential-risk-of-divi.patch new file mode 100644 index 00000000000..bb85531e866 --- /dev/null +++ b/queue-5.4/tty-serial-fsl_lpuart-fix-the-potential-risk-of-divi.patch @@ -0,0 +1,41 @@ +From d47a6db7fedb5068a6c7bcbeaf60228da6c37cf4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 10:12:26 +0800 +Subject: tty: serial: fsl_lpuart: fix the potential risk of division or modulo + by zero + +From: Sherry Sun + +[ Upstream commit fcb10ee27fb91b25b68d7745db9817ecea9f1038 ] + +We should be very careful about the register values that will be used +for division or modulo operations, althrough the possibility that the +UARTBAUD register value is zero is very low, but we had better to deal +with the "bad data" of hardware in advance to avoid division or modulo +by zero leading to undefined kernel behavior. + +Signed-off-by: Sherry Sun +Link: https://lore.kernel.org/r/20210427021226.27468-1-sherry.sun@nxp.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/fsl_lpuart.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 6ad985e8dc65..b053345dfd1a 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -2253,6 +2253,9 @@ lpuart32_console_get_options(struct lpuart_port *sport, int *baud, + + bd = lpuart32_read(&sport->port, UARTBAUD); + bd &= UARTBAUD_SBR_MASK; ++ if (!bd) ++ return; ++ + sbr = bd; + uartclk = lpuart_get_baud_clk_rate(sport); + /* +-- +2.30.2 + diff --git a/queue-5.4/ubifs-set-clear-i_linkable-under-i_lock-for-whiteout.patch b/queue-5.4/ubifs-set-clear-i_linkable-under-i_lock-for-whiteout.patch new file mode 100644 index 00000000000..82e7c0ee8ef --- /dev/null +++ b/queue-5.4/ubifs-set-clear-i_linkable-under-i_lock-for-whiteout.patch @@ -0,0 +1,79 @@ +From ab55597cb34b773f8b46f044fa8ca08209e0151d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 16:11:03 +0800 +Subject: ubifs: Set/Clear I_LINKABLE under i_lock for whiteout inode + +From: Zhihao Cheng + +[ Upstream commit a801fcfeef96702fa3f9b22ad56c5eb1989d9221 ] + +xfstests-generic/476 reports a warning message as below: + +WARNING: CPU: 2 PID: 30347 at fs/inode.c:361 inc_nlink+0x52/0x70 +Call Trace: + do_rename+0x502/0xd40 [ubifs] + ubifs_rename+0x8b/0x180 [ubifs] + vfs_rename+0x476/0x1080 + do_renameat2+0x67c/0x7b0 + __x64_sys_renameat2+0x6e/0x90 + do_syscall_64+0x66/0xe0 + entry_SYSCALL_64_after_hwframe+0x44/0xae + +Following race case can cause this: + rename_whiteout(Thread 1) wb_workfn(Thread 2) +ubifs_rename + do_rename + __writeback_single_inode + spin_lock(&inode->i_lock) + whiteout->i_state |= I_LINKABLE + inode->i_state &= ~dirty; +---- How race happens on i_state: + (tmp = whiteout->i_state | I_LINKABLE) + (tmp = inode->i_state & ~dirty) + (whiteout->i_state = tmp) + (inode->i_state = tmp) +---- + spin_unlock(&inode->i_lock) + inc_nlink(whiteout) + WARN_ON(!(inode->i_state & I_LINKABLE)) !!! + +Fix to add i_lock to avoid i_state update race condition. + +Fixes: 9e0a1fff8db56ea ("ubifs: Implement RENAME_WHITEOUT") +Signed-off-by: Zhihao Cheng +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/dir.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c +index a5e5e9b9d4e3..eeb93f009b28 100644 +--- a/fs/ubifs/dir.c ++++ b/fs/ubifs/dir.c +@@ -1343,7 +1343,10 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + goto out_release; + } + ++ spin_lock(&whiteout->i_lock); + whiteout->i_state |= I_LINKABLE; ++ spin_unlock(&whiteout->i_lock); ++ + whiteout_ui = ubifs_inode(whiteout); + whiteout_ui->data = dev; + whiteout_ui->data_len = ubifs_encode_dev(dev, MKDEV(0, 0)); +@@ -1436,7 +1439,11 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + + inc_nlink(whiteout); + mark_inode_dirty(whiteout); ++ ++ spin_lock(&whiteout->i_lock); + whiteout->i_state &= ~I_LINKABLE; ++ spin_unlock(&whiteout->i_lock); ++ + iput(whiteout); + } + +-- +2.30.2 + diff --git a/queue-5.4/um-fix-error-return-code-in-slip_open.patch b/queue-5.4/um-fix-error-return-code-in-slip_open.patch new file mode 100644 index 00000000000..3f34bd706a2 --- /dev/null +++ b/queue-5.4/um-fix-error-return-code-in-slip_open.patch @@ -0,0 +1,39 @@ +From 3ff0de055f04c4d3be5c369b0126decd508949e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:13:54 +0800 +Subject: um: fix error return code in slip_open() + +From: Zhen Lei + +[ Upstream commit b77e81fbe5f5fb4ad9a61ec80f6d1e30b6da093a ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: a3c77c67a443 ("[PATCH] uml: slirp and slip driver cleanups and fixes") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Acked-By: anton.ivanov@cambridgegreys.com +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/slip_user.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/slip_user.c b/arch/um/drivers/slip_user.c +index 8016d32b6809..8d736eb62961 100644 +--- a/arch/um/drivers/slip_user.c ++++ b/arch/um/drivers/slip_user.c +@@ -145,7 +145,8 @@ static int slip_open(void *data) + } + sfd = err; + +- if (set_up_tty(sfd)) ++ err = set_up_tty(sfd); ++ if (err) + goto out_close2; + + pri->slave = sfd; +-- +2.30.2 + diff --git a/queue-5.4/um-fix-error-return-code-in-winch_tramp.patch b/queue-5.4/um-fix-error-return-code-in-winch_tramp.patch new file mode 100644 index 00000000000..cfa300650be --- /dev/null +++ b/queue-5.4/um-fix-error-return-code-in-winch_tramp.patch @@ -0,0 +1,39 @@ +From 3a2da33161d5ce6f6464946739d2de6838b30ae0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 May 2021 11:22:39 +0800 +Subject: um: fix error return code in winch_tramp() + +From: Zhen Lei + +[ Upstream commit ccf1236ecac476d9d2704866d9a476c86e387971 ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 89df6bfc0405 ("uml: DEBUG_SHIRQ fixes") +Reported-by: Hulk Robot +Signed-off-by: Zhen Lei +Acked-By: anton.ivanov@cambridgegreys.com +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/chan_user.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c +index d8845d4aac6a..6040817c036f 100644 +--- a/arch/um/drivers/chan_user.c ++++ b/arch/um/drivers/chan_user.c +@@ -256,7 +256,8 @@ static int winch_tramp(int fd, struct tty_port *port, int *fd_out, + goto out_close; + } + +- if (os_set_fd_block(*fd_out, 0)) { ++ err = os_set_fd_block(*fd_out, 0); ++ if (err) { + printk(UM_KERN_ERR "winch_tramp: failed to set thread_fd " + "non-blocking.\n"); + goto out_close; +-- +2.30.2 + diff --git a/queue-5.4/usb-gadget-f_hid-fix-endianness-issue-with-descripto.patch b/queue-5.4/usb-gadget-f_hid-fix-endianness-issue-with-descripto.patch new file mode 100644 index 00000000000..de5b14730e8 --- /dev/null +++ b/queue-5.4/usb-gadget-f_hid-fix-endianness-issue-with-descripto.patch @@ -0,0 +1,45 @@ +From a62165663408d0f356c0011f2a9264b185f3a416 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Jun 2021 19:27:55 +0300 +Subject: usb: gadget: f_hid: fix endianness issue with descriptors + +From: Ruslan Bilovol + +[ Upstream commit 33cb46c4676d01956811b68a29157ea969a5df70 ] + +Running sparse checker it shows warning message about +incorrect endianness used for descriptor initialization: + +| f_hid.c:91:43: warning: incorrect type in initializer (different base types) +| f_hid.c:91:43: expected restricted __le16 [usertype] bcdHID +| f_hid.c:91:43: got int + +Fixing issue with cpu_to_le16() macro, however this is not a real issue +as the value is the same both endians. + +Cc: Fabien Chouteau +Cc: Segiy Stetsyuk +Signed-off-by: Ruslan Bilovol +Link: https://lore.kernel.org/r/20210617162755.29676-1-ruslan.bilovol@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/f_hid.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c +index 0586229ac83d..3d540b0d9368 100644 +--- a/drivers/usb/gadget/function/f_hid.c ++++ b/drivers/usb/gadget/function/f_hid.c +@@ -88,7 +88,7 @@ static struct usb_interface_descriptor hidg_interface_desc = { + static struct hid_descriptor hidg_desc = { + .bLength = sizeof hidg_desc, + .bDescriptorType = HID_DT_HID, +- .bcdHID = 0x0101, ++ .bcdHID = cpu_to_le16(0x0101), + .bCountryCode = 0x00, + .bNumDescriptors = 0x1, + /*.desc[0].bDescriptorType = DYNAMIC */ +-- +2.30.2 + diff --git a/queue-5.4/usb-gadget-hid-fix-error-return-code-in-hid_bind.patch b/queue-5.4/usb-gadget-hid-fix-error-return-code-in-hid_bind.patch new file mode 100644 index 00000000000..13dbc4fa24c --- /dev/null +++ b/queue-5.4/usb-gadget-hid-fix-error-return-code-in-hid_bind.patch @@ -0,0 +1,40 @@ +From bc16912e7957f154c91a281bd5bff8205edbdee1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Jun 2021 12:38:35 +0800 +Subject: usb: gadget: hid: fix error return code in hid_bind() + +From: Yang Yingliang + +[ Upstream commit 88693f770bb09c196b1eb5f06a484a254ecb9924 ] + +Fix to return a negative error code from the error handling +case instead of 0. + +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210618043835.2641360-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/legacy/hid.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/legacy/hid.c b/drivers/usb/gadget/legacy/hid.c +index c4eda7fe7ab4..5b27d289443f 100644 +--- a/drivers/usb/gadget/legacy/hid.c ++++ b/drivers/usb/gadget/legacy/hid.c +@@ -171,8 +171,10 @@ static int hid_bind(struct usb_composite_dev *cdev) + struct usb_descriptor_header *usb_desc; + + usb_desc = usb_otg_descriptor_alloc(gadget); +- if (!usb_desc) ++ if (!usb_desc) { ++ status = -ENOMEM; + goto put; ++ } + usb_otg_descriptor_init(gadget, usb_desc); + otg_desc[0] = usb_desc; + otg_desc[1] = NULL; +-- +2.30.2 + diff --git a/queue-5.4/virtio-blk-fix-memory-leak-among-suspend-resume-proc.patch b/queue-5.4/virtio-blk-fix-memory-leak-among-suspend-resume-proc.patch new file mode 100644 index 00000000000..d850c9af7aa --- /dev/null +++ b/queue-5.4/virtio-blk-fix-memory-leak-among-suspend-resume-proc.patch @@ -0,0 +1,37 @@ +From 43915ee908443cd3b1fd6e18afdb683607cbb27e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:43:32 +0800 +Subject: virtio-blk: Fix memory leak among suspend/resume procedure + +From: Xie Yongji + +[ Upstream commit b71ba22e7c6c6b279c66f53ee7818709774efa1f ] + +The vblk->vqs should be freed before we call init_vqs() +in virtblk_restore(). + +Signed-off-by: Xie Yongji +Link: https://lore.kernel.org/r/20210517084332.280-1-xieyongji@bytedance.com +Acked-by: Jason Wang +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/block/virtio_blk.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index 2eeb2bcb488d..816eb2db7308 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -1057,6 +1057,8 @@ static int virtblk_freeze(struct virtio_device *vdev) + blk_mq_quiesce_queue(vblk->disk->queue); + + vdev->config->del_vqs(vdev); ++ kfree(vblk->vqs); ++ + return 0; + } + +-- +2.30.2 + diff --git a/queue-5.4/virtio_console-assure-used-length-from-device-is-lim.patch b/queue-5.4/virtio_console-assure-used-length-from-device-is-lim.patch new file mode 100644 index 00000000000..076c88e4225 --- /dev/null +++ b/queue-5.4/virtio_console-assure-used-length-from-device-is-lim.patch @@ -0,0 +1,47 @@ +From 640737266e80003bcea7ca2c0895fe889cdd8a1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 May 2021 20:56:22 +0800 +Subject: virtio_console: Assure used length from device is limited + +From: Xie Yongji + +[ Upstream commit d00d8da5869a2608e97cfede094dfc5e11462a46 ] + +The buf->len might come from an untrusted device. This +ensures the value would not exceed the size of the buffer +to avoid data corruption or loss. + +Signed-off-by: Xie Yongji +Acked-by: Jason Wang +Link: https://lore.kernel.org/r/20210525125622.1203-1-xieyongji@bytedance.com +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/char/virtio_console.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index 5eabbf73fdef..b453029487a1 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -475,7 +475,7 @@ static struct port_buffer *get_inbuf(struct port *port) + + buf = virtqueue_get_buf(port->in_vq, &len); + if (buf) { +- buf->len = len; ++ buf->len = min_t(size_t, len, buf->size); + buf->offset = 0; + port->stats.bytes_received += len; + } +@@ -1714,7 +1714,7 @@ static void control_work_handler(struct work_struct *work) + while ((buf = virtqueue_get_buf(vq, &len))) { + spin_unlock(&portdev->c_ivq_lock); + +- buf->len = len; ++ buf->len = min_t(size_t, len, buf->size); + buf->offset = 0; + + handle_control_message(vq->vdev, portdev, buf); +-- +2.30.2 + diff --git a/queue-5.4/virtio_net-fix-error-handling-in-virtnet_restore.patch b/queue-5.4/virtio_net-fix-error-handling-in-virtnet_restore.patch new file mode 100644 index 00000000000..a4d04499a69 --- /dev/null +++ b/queue-5.4/virtio_net-fix-error-handling-in-virtnet_restore.patch @@ -0,0 +1,40 @@ +From afc321b0a7a3e8daea51fad99f3aac2cfe44aa89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:45:16 +0800 +Subject: virtio_net: Fix error handling in virtnet_restore() + +From: Xie Yongji + +[ Upstream commit 3f2869cace829fb4b80fc53b3ddaa7f4ba9acbf1 ] + +Do some cleanups in virtnet_restore() when virtnet_cpu_notif_add() failed. + +Signed-off-by: Xie Yongji +Link: https://lore.kernel.org/r/20210517084516.332-1-xieyongji@bytedance.com +Acked-by: Jason Wang +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 5cd55f950032..af7d69719c4f 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -3282,8 +3282,11 @@ static __maybe_unused int virtnet_restore(struct virtio_device *vdev) + virtnet_set_queues(vi, vi->curr_queue_pairs); + + err = virtnet_cpu_notif_add(vi); +- if (err) ++ if (err) { ++ virtnet_freeze_down(vdev); ++ remove_vq_common(vi); + return err; ++ } + + return 0; + } +-- +2.30.2 + diff --git a/queue-5.4/virtio_net-move-tx-vq-operation-under-tx-queue-lock.patch b/queue-5.4/virtio_net-move-tx-vq-operation-under-tx-queue-lock.patch new file mode 100644 index 00000000000..b860e678038 --- /dev/null +++ b/queue-5.4/virtio_net-move-tx-vq-operation-under-tx-queue-lock.patch @@ -0,0 +1,71 @@ +From 1c874cddf65e8a85929499328863317305ede1a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Apr 2021 01:35:26 -0400 +Subject: virtio_net: move tx vq operation under tx queue lock + +From: Michael S. Tsirkin + +[ Upstream commit 5a2f966d0f3fa0ef6dada7ab9eda74cacee96b8a ] + +It's unsafe to operate a vq from multiple threads. +Unfortunately this is exactly what we do when invoking +clean tx poll from rx napi. +Same happens with napi-tx even without the +opportunistic cleaning from the receive interrupt: that races +with processing the vq in start_xmit. + +As a fix move everything that deals with the vq to under tx lock. + +Fixes: b92f1e6751a6 ("virtio-net: transmit napi") +Signed-off-by: Michael S. Tsirkin +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index af7d69719c4f..15453d6fcc23 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1504,6 +1504,8 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget) + struct virtnet_info *vi = sq->vq->vdev->priv; + unsigned int index = vq2txq(sq->vq); + struct netdev_queue *txq; ++ int opaque; ++ bool done; + + if (unlikely(is_xdp_raw_buffer_queue(vi, index))) { + /* We don't need to enable cb for XDP */ +@@ -1513,10 +1515,28 @@ static int virtnet_poll_tx(struct napi_struct *napi, int budget) + + txq = netdev_get_tx_queue(vi->dev, index); + __netif_tx_lock(txq, raw_smp_processor_id()); ++ virtqueue_disable_cb(sq->vq); + free_old_xmit_skbs(sq, true); ++ ++ opaque = virtqueue_enable_cb_prepare(sq->vq); ++ ++ done = napi_complete_done(napi, 0); ++ ++ if (!done) ++ virtqueue_disable_cb(sq->vq); ++ + __netif_tx_unlock(txq); + +- virtqueue_napi_complete(napi, sq->vq, 0); ++ if (done) { ++ if (unlikely(virtqueue_poll(sq->vq, opaque))) { ++ if (napi_schedule_prep(napi)) { ++ __netif_tx_lock(txq, raw_smp_processor_id()); ++ virtqueue_disable_cb(sq->vq); ++ __netif_tx_unlock(txq); ++ __napi_schedule(napi); ++ } ++ } ++ } + + if (sq->vq->num_free >= 2 + MAX_SKB_FRAGS) + netif_tx_wake_queue(txq); +-- +2.30.2 + diff --git a/queue-5.4/w1-ds2438-fixing-bug-that-would-always-get-page0.patch b/queue-5.4/w1-ds2438-fixing-bug-that-would-always-get-page0.patch new file mode 100644 index 00000000000..a129b6d016d --- /dev/null +++ b/queue-5.4/w1-ds2438-fixing-bug-that-would-always-get-page0.patch @@ -0,0 +1,45 @@ +From 19fc4d8a780a6c4549c9d834a27f4fd8ea0eb9da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 19:30:44 -0300 +Subject: w1: ds2438: fixing bug that would always get page0 + +From: Luiz Sampaio + +[ Upstream commit 1f5e7518f063728aee0679c5086b92d8ea429e11 ] + +The purpose of the w1_ds2438_get_page function is to get the register +values at the page passed as the pageno parameter. However, the page0 was +hardcoded, such that the function always returned the page0 contents. Fixed +so that the function can retrieve any page. + +Signed-off-by: Luiz Sampaio +Link: https://lore.kernel.org/r/20210519223046.13798-5-sampaio.ime@gmail.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/w1/slaves/w1_ds2438.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/w1/slaves/w1_ds2438.c b/drivers/w1/slaves/w1_ds2438.c +index d199e5a25cc0..404dacb15004 100644 +--- a/drivers/w1/slaves/w1_ds2438.c ++++ b/drivers/w1/slaves/w1_ds2438.c +@@ -62,13 +62,13 @@ static int w1_ds2438_get_page(struct w1_slave *sl, int pageno, u8 *buf) + if (w1_reset_select_slave(sl)) + continue; + w1_buf[0] = W1_DS2438_RECALL_MEMORY; +- w1_buf[1] = 0x00; ++ w1_buf[1] = (u8)pageno; + w1_write_block(sl->master, w1_buf, 2); + + if (w1_reset_select_slave(sl)) + continue; + w1_buf[0] = W1_DS2438_READ_SCRATCH; +- w1_buf[1] = 0x00; ++ w1_buf[1] = (u8)pageno; + w1_write_block(sl->master, w1_buf, 2); + + count = w1_read_block(sl->master, buf, DS2438_PAGE_SIZE + 1); +-- +2.30.2 + diff --git a/queue-5.4/watchdog-aspeed-fix-hardware-timeout-calculation.patch b/queue-5.4/watchdog-aspeed-fix-hardware-timeout-calculation.patch new file mode 100644 index 00000000000..f157ceae59a --- /dev/null +++ b/queue-5.4/watchdog-aspeed-fix-hardware-timeout-calculation.patch @@ -0,0 +1,40 @@ +From e88443de1dd6b7021b53da84fb6bd19cc00dd9c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 20:42:49 -0700 +Subject: watchdog: aspeed: fix hardware timeout calculation + +From: Tao Ren + +[ Upstream commit e7dc481c92060f9ce872878b0b7a08c24713a7e5 ] + +Fix hardware timeout calculation in aspeed_wdt_set_timeout function to +ensure the reload value does not exceed the hardware limit. + +Fixes: efa859f7d786 ("watchdog: Add Aspeed watchdog driver") +Reported-by: Amithash Prasad +Signed-off-by: Tao Ren +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20210417034249.5978-1-rentao.bupt@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/aspeed_wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c +index 7e00960651fa..507fd815d767 100644 +--- a/drivers/watchdog/aspeed_wdt.c ++++ b/drivers/watchdog/aspeed_wdt.c +@@ -147,7 +147,7 @@ static int aspeed_wdt_set_timeout(struct watchdog_device *wdd, + + wdd->timeout = timeout; + +- actual = min(timeout, wdd->max_hw_heartbeat_ms * 1000); ++ actual = min(timeout, wdd->max_hw_heartbeat_ms / 1000); + + writel(actual * WDT_RATE_1MHZ, wdt->base + WDT_RELOAD_VALUE); + writel(WDT_RESTART_MAGIC, wdt->base + WDT_RESTART); +-- +2.30.2 + diff --git a/queue-5.4/watchdog-fix-possible-use-after-free-by-calling-del_.patch b/queue-5.4/watchdog-fix-possible-use-after-free-by-calling-del_.patch new file mode 100644 index 00000000000..555012e8f40 --- /dev/null +++ b/queue-5.4/watchdog-fix-possible-use-after-free-by-calling-del_.patch @@ -0,0 +1,59 @@ +From 8d892934ab44b4e99d1f52fa9d2117a4e4502811 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 May 2021 14:57:56 +0800 +Subject: watchdog: Fix possible use-after-free by calling del_timer_sync() + +From: Zou Wei + +[ Upstream commit d0212f095ab56672f6f36aabc605bda205e1e0bf ] + +This driver's remove path calls del_timer(). However, that function +does not wait until the timer handler finishes. This means that the +timer handler may still be running after the driver's remove function +has finished, which would result in a use-after-free. + +Fix by calling del_timer_sync(), which makes sure the timer handler +has finished, and unable to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Reviewed-by: Guenter Roeck +Acked-by: Vladimir Zapolskiy +Link: https://lore.kernel.org/r/1620802676-19701-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/lpc18xx_wdt.c | 2 +- + drivers/watchdog/w83877f_wdt.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c +index 78cf11c94941..60b6d74f267d 100644 +--- a/drivers/watchdog/lpc18xx_wdt.c ++++ b/drivers/watchdog/lpc18xx_wdt.c +@@ -292,7 +292,7 @@ static int lpc18xx_wdt_remove(struct platform_device *pdev) + struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev); + + dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n"); +- del_timer(&lpc18xx_wdt->timer); ++ del_timer_sync(&lpc18xx_wdt->timer); + + return 0; + } +diff --git a/drivers/watchdog/w83877f_wdt.c b/drivers/watchdog/w83877f_wdt.c +index 6eb5185d6ea6..d9addf06b44d 100644 +--- a/drivers/watchdog/w83877f_wdt.c ++++ b/drivers/watchdog/w83877f_wdt.c +@@ -166,7 +166,7 @@ static void wdt_startup(void) + static void wdt_turnoff(void) + { + /* Stop the timer */ +- del_timer(&timer); ++ del_timer_sync(&timer); + + wdt_change(WDT_DISABLE); + +-- +2.30.2 + diff --git a/queue-5.4/watchdog-fix-possible-use-after-free-in-wdt_startup.patch b/queue-5.4/watchdog-fix-possible-use-after-free-in-wdt_startup.patch new file mode 100644 index 00000000000..d149c26e280 --- /dev/null +++ b/queue-5.4/watchdog-fix-possible-use-after-free-in-wdt_startup.patch @@ -0,0 +1,44 @@ +From 3313d64ea1ddeed07d32d13f8bfc371b24a1f7f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 15:01:35 +0800 +Subject: watchdog: Fix possible use-after-free in wdt_startup() + +From: Zou Wei + +[ Upstream commit c08a6b31e4917034f0ed0cb457c3bb209576f542 ] + +This module's remove path calls del_timer(). However, that function +does not wait until the timer handler finishes. This means that the +timer handler may still be running after the driver's remove function +has finished, which would result in a use-after-free. + +Fix by calling del_timer_sync(), which makes sure the timer handler +has finished, and unable to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/1620716495-108352-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/sbc60xxwdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/sbc60xxwdt.c b/drivers/watchdog/sbc60xxwdt.c +index c3151642694c..de1f7add05c3 100644 +--- a/drivers/watchdog/sbc60xxwdt.c ++++ b/drivers/watchdog/sbc60xxwdt.c +@@ -146,7 +146,7 @@ static void wdt_startup(void) + static void wdt_turnoff(void) + { + /* Stop the timer */ +- del_timer(&timer); ++ del_timer_sync(&timer); + inb_p(wdt_stop); + pr_info("Watchdog timer is now disabled...\n"); + } +-- +2.30.2 + diff --git a/queue-5.4/watchdog-imx_sc_wdt-fix-pretimeout.patch b/queue-5.4/watchdog-imx_sc_wdt-fix-pretimeout.patch new file mode 100644 index 00000000000..e111b9c071c --- /dev/null +++ b/queue-5.4/watchdog-imx_sc_wdt-fix-pretimeout.patch @@ -0,0 +1,69 @@ +From b7ec7d8bbbefb3428f2670edacafb59a0138cd32 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Apr 2021 14:12:47 +0200 +Subject: watchdog: imx_sc_wdt: fix pretimeout + +From: Stefan Eichenberger + +[ Upstream commit 854478a381078ee86ae2a7908a934b1ded399130 ] + +If the WDIOF_PRETIMEOUT flag is not set when registering the device the +driver will not show the sysfs entries or register the default governor. +By moving the registering after the decision whether pretimeout is +supported this gets fixed. + +Signed-off-by: Stefan Eichenberger +Reviewed-by: Guenter Roeck +Reviewed-by: Dong Aisheng +Link: https://lore.kernel.org/r/20210519080311.142928-1-eichest@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/imx_sc_wdt.c | 11 ++++------- + 1 file changed, 4 insertions(+), 7 deletions(-) + +diff --git a/drivers/watchdog/imx_sc_wdt.c b/drivers/watchdog/imx_sc_wdt.c +index e0e62149a6f4..8c9936e78bee 100644 +--- a/drivers/watchdog/imx_sc_wdt.c ++++ b/drivers/watchdog/imx_sc_wdt.c +@@ -185,16 +185,12 @@ static int imx_sc_wdt_probe(struct platform_device *pdev) + watchdog_stop_on_reboot(wdog); + watchdog_stop_on_unregister(wdog); + +- ret = devm_watchdog_register_device(dev, wdog); +- if (ret) +- return ret; +- + ret = imx_scu_irq_group_enable(SC_IRQ_GROUP_WDOG, + SC_IRQ_WDOG, + true); + if (ret) { + dev_warn(dev, "Enable irq failed, pretimeout NOT supported\n"); +- return 0; ++ goto register_device; + } + + imx_sc_wdd->wdt_notifier.notifier_call = imx_sc_wdt_notify; +@@ -205,7 +201,7 @@ static int imx_sc_wdt_probe(struct platform_device *pdev) + false); + dev_warn(dev, + "Register irq notifier failed, pretimeout NOT supported\n"); +- return 0; ++ goto register_device; + } + + ret = devm_add_action_or_reset(dev, imx_sc_wdt_action, +@@ -215,7 +211,8 @@ static int imx_sc_wdt_probe(struct platform_device *pdev) + else + dev_warn(dev, "Add action failed, pretimeout NOT supported\n"); + +- return 0; ++register_device: ++ return devm_watchdog_register_device(dev, wdog); + } + + static int __maybe_unused imx_sc_wdt_suspend(struct device *dev) +-- +2.30.2 + diff --git a/queue-5.4/watchdog-itco_wdt-account-for-rebooting-on-second-ti.patch b/queue-5.4/watchdog-itco_wdt-account-for-rebooting-on-second-ti.patch new file mode 100644 index 00000000000..d1377232d55 --- /dev/null +++ b/queue-5.4/watchdog-itco_wdt-account-for-rebooting-on-second-ti.patch @@ -0,0 +1,71 @@ +From 6ab74fbe296adaf7e091266ed09fc5c226626727 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 May 2021 13:24:23 +0200 +Subject: watchdog: iTCO_wdt: Account for rebooting on second timeout + +From: Jan Kiszka + +[ Upstream commit cb011044e34c293e139570ce5c01aed66a34345c ] + +This was already attempted to fix via 1fccb73011ea: If the BIOS did not +enable TCO SMIs, the timer definitely needs to trigger twice in order to +cause a reboot. If TCO SMIs are on, as well as SMIs in general, we can +continue to assume that the BIOS will perform a reboot on the first +timeout. + +QEMU with its ICH9 and related BIOS falls into the former category, +currently taking twice the configured timeout in order to reboot the +machine. For iTCO version that fall under turn_SMI_watchdog_clear_off, +this is also true and was currently only addressed for v1, irrespective +of the turn_SMI_watchdog_clear_off value. + +Signed-off-by: Jan Kiszka +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/0b8bb307-d08b-41b5-696c-305cdac6789c@siemens.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/iTCO_wdt.c | 12 +++++++++--- + 1 file changed, 9 insertions(+), 3 deletions(-) + +diff --git a/drivers/watchdog/iTCO_wdt.c b/drivers/watchdog/iTCO_wdt.c +index e707c4797f76..08e534fba1bf 100644 +--- a/drivers/watchdog/iTCO_wdt.c ++++ b/drivers/watchdog/iTCO_wdt.c +@@ -72,6 +72,8 @@ + #define TCOBASE(p) ((p)->tco_res->start) + /* SMI Control and Enable Register */ + #define SMI_EN(p) ((p)->smi_res->start) ++#define TCO_EN (1 << 13) ++#define GBL_SMI_EN (1 << 0) + + #define TCO_RLD(p) (TCOBASE(p) + 0x00) /* TCO Timer Reload/Curr. Value */ + #define TCOv1_TMR(p) (TCOBASE(p) + 0x01) /* TCOv1 Timer Initial Value*/ +@@ -344,8 +346,12 @@ static int iTCO_wdt_set_timeout(struct watchdog_device *wd_dev, unsigned int t) + + tmrval = seconds_to_ticks(p, t); + +- /* For TCO v1 the timer counts down twice before rebooting */ +- if (p->iTCO_version == 1) ++ /* ++ * If TCO SMIs are off, the timer counts down twice before rebooting. ++ * Otherwise, the BIOS generally reboots when the SMI triggers. ++ */ ++ if (p->smi_res && ++ (SMI_EN(p) & (TCO_EN | GBL_SMI_EN)) != (TCO_EN | GBL_SMI_EN)) + tmrval /= 2; + + /* from the specs: */ +@@ -510,7 +516,7 @@ static int iTCO_wdt_probe(struct platform_device *pdev) + * Disables TCO logic generating an SMI# + */ + val32 = inl(SMI_EN(p)); +- val32 &= 0xffffdfff; /* Turn off SMI clearing watchdog */ ++ val32 &= ~TCO_EN; /* Turn off SMI clearing watchdog */ + outl(val32, SMI_EN(p)); + } + +-- +2.30.2 + diff --git a/queue-5.4/watchdog-sc520_wdt-fix-possible-use-after-free-in-wd.patch b/queue-5.4/watchdog-sc520_wdt-fix-possible-use-after-free-in-wd.patch new file mode 100644 index 00000000000..1e7b8d658d3 --- /dev/null +++ b/queue-5.4/watchdog-sc520_wdt-fix-possible-use-after-free-in-wd.patch @@ -0,0 +1,44 @@ +From d3837919a43644e522e00d4ad9967e3424303f66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 May 2021 15:04:51 +0800 +Subject: watchdog: sc520_wdt: Fix possible use-after-free in wdt_turnoff() + +From: Zou Wei + +[ Upstream commit 90b7c141132244e8e49a34a4c1e445cce33e07f4 ] + +This module's remove path calls del_timer(). However, that function +does not wait until the timer handler finishes. This means that the +timer handler may still be running after the driver's remove function +has finished, which would result in a use-after-free. + +Fix by calling del_timer_sync(), which makes sure the timer handler +has finished, and unable to re-schedule itself. + +Reported-by: Hulk Robot +Signed-off-by: Zou Wei +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/1620716691-108460-1-git-send-email-zou_wei@huawei.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/sc520_wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/sc520_wdt.c b/drivers/watchdog/sc520_wdt.c +index a612128c5f80..57969564c7f9 100644 +--- a/drivers/watchdog/sc520_wdt.c ++++ b/drivers/watchdog/sc520_wdt.c +@@ -186,7 +186,7 @@ static int wdt_startup(void) + static int wdt_turnoff(void) + { + /* Stop the timer */ +- del_timer(&timer); ++ del_timer_sync(&timer); + + /* Stop the watchdog */ + wdt_config(0); +-- +2.30.2 + diff --git a/queue-5.4/x86-fpu-limit-xstate-copy-size-in-xstateregs_set.patch b/queue-5.4/x86-fpu-limit-xstate-copy-size-in-xstateregs_set.patch new file mode 100644 index 00000000000..98b9514f841 --- /dev/null +++ b/queue-5.4/x86-fpu-limit-xstate-copy-size-in-xstateregs_set.patch @@ -0,0 +1,39 @@ +From ddf66f3563eb904c19bf434515cd17dea6663021 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 14:01:35 +0200 +Subject: x86/fpu: Limit xstate copy size in xstateregs_set() + +From: Thomas Gleixner + +[ Upstream commit 07d6688b22e09be465652cf2da0da6bf86154df6 ] + +If the count argument is larger than the xstate size, this will happily +copy beyond the end of xstate. + +Fixes: 91c3dba7dbc1 ("x86/fpu/xstate: Fix PTRACE frames for XSAVES") +Signed-off-by: Thomas Gleixner +Signed-off-by: Borislav Petkov +Reviewed-by: Andy Lutomirski +Reviewed-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20210623121452.120741557@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/fpu/regset.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c +index d652b939ccfb..68e1fb66e701 100644 +--- a/arch/x86/kernel/fpu/regset.c ++++ b/arch/x86/kernel/fpu/regset.c +@@ -124,7 +124,7 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, + /* + * A whole standard-format XSAVE buffer is needed: + */ +- if ((pos != 0) || (count < fpu_user_xstate_size)) ++ if (pos != 0 || count != fpu_user_xstate_size) + return -EFAULT; + + xsave = &fpu->state.xsave; +-- +2.30.2 + diff --git a/queue-5.4/x86-fpu-return-proper-error-codes-from-user-access-f.patch b/queue-5.4/x86-fpu-return-proper-error-codes-from-user-access-f.patch new file mode 100644 index 00000000000..920124b5940 --- /dev/null +++ b/queue-5.4/x86-fpu-return-proper-error-codes-from-user-access-f.patch @@ -0,0 +1,86 @@ +From ef15c956681f9a7785ff2b0faf2d2b85cffaa1ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Jun 2021 14:02:30 +0200 +Subject: x86/fpu: Return proper error codes from user access functions + +From: Thomas Gleixner + +[ Upstream commit aee8c67a4faa40a8df4e79316dbfc92d123989c1 ] + +When *RSTOR from user memory raises an exception, there is no way to +differentiate them. That's bad because it forces the slow path even when +the failure was not a fault. If the operation raised eg. #GP then going +through the slow path is pointless. + +Use _ASM_EXTABLE_FAULT() which stores the trap number and let the exception +fixup return the negated trap number as error. + +This allows to separate the fast path and let it handle faults directly and +avoid the slow path for all other exceptions. + +Signed-off-by: Thomas Gleixner +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20210623121457.601480369@linutronix.de +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/fpu/internal.h | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/arch/x86/include/asm/fpu/internal.h b/arch/x86/include/asm/fpu/internal.h +index 9f135e5b9cf5..a9d1dd82d820 100644 +--- a/arch/x86/include/asm/fpu/internal.h ++++ b/arch/x86/include/asm/fpu/internal.h +@@ -102,6 +102,7 @@ static inline void fpstate_init_fxstate(struct fxregs_state *fx) + } + extern void fpstate_sanitize_xstate(struct fpu *fpu); + ++/* Returns 0 or the negated trap number, which results in -EFAULT for #PF */ + #define user_insn(insn, output, input...) \ + ({ \ + int err; \ +@@ -109,14 +110,14 @@ extern void fpstate_sanitize_xstate(struct fpu *fpu); + might_fault(); \ + \ + asm volatile(ASM_STAC "\n" \ +- "1:" #insn "\n\t" \ ++ "1: " #insn "\n" \ + "2: " ASM_CLAC "\n" \ + ".section .fixup,\"ax\"\n" \ +- "3: movl $-1,%[err]\n" \ ++ "3: negl %%eax\n" \ + " jmp 2b\n" \ + ".previous\n" \ +- _ASM_EXTABLE(1b, 3b) \ +- : [err] "=r" (err), output \ ++ _ASM_EXTABLE_FAULT(1b, 3b) \ ++ : [err] "=a" (err), output \ + : "0"(0), input); \ + err; \ + }) +@@ -210,16 +211,20 @@ static inline void copy_fxregs_to_kernel(struct fpu *fpu) + #define XRSTOR ".byte " REX_PREFIX "0x0f,0xae,0x2f" + #define XRSTORS ".byte " REX_PREFIX "0x0f,0xc7,0x1f" + ++/* ++ * After this @err contains 0 on success or the negated trap number when ++ * the operation raises an exception. For faults this results in -EFAULT. ++ */ + #define XSTATE_OP(op, st, lmask, hmask, err) \ + asm volatile("1:" op "\n\t" \ + "xor %[err], %[err]\n" \ + "2:\n\t" \ + ".pushsection .fixup,\"ax\"\n\t" \ +- "3: movl $-2,%[err]\n\t" \ ++ "3: negl %%eax\n\t" \ + "jmp 2b\n\t" \ + ".popsection\n\t" \ +- _ASM_EXTABLE(1b, 3b) \ +- : [err] "=r" (err) \ ++ _ASM_EXTABLE_FAULT(1b, 3b) \ ++ : [err] "=a" (err) \ + : "D" (st), "m" (*st), "a" (lmask), "d" (hmask) \ + : "memory") + +-- +2.30.2 + diff --git a/queue-5.4/x86-signal-detect-and-prevent-an-alternate-signal-st.patch b/queue-5.4/x86-signal-detect-and-prevent-an-alternate-signal-st.patch new file mode 100644 index 00000000000..9885baec3d7 --- /dev/null +++ b/queue-5.4/x86-signal-detect-and-prevent-an-alternate-signal-st.patch @@ -0,0 +1,142 @@ +From 3b3264395683987bf8c7ff1da69b2dcdf20f2168 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 May 2021 13:03:19 -0700 +Subject: x86/signal: Detect and prevent an alternate signal stack overflow + +From: Chang S. Bae + +[ Upstream commit 2beb4a53fc3f1081cedc1c1a198c7f56cc4fc60c ] + +The kernel pushes context on to the userspace stack to prepare for the +user's signal handler. When the user has supplied an alternate signal +stack, via sigaltstack(2), it is easy for the kernel to verify that the +stack size is sufficient for the current hardware context. + +Check if writing the hardware context to the alternate stack will exceed +it's size. If yes, then instead of corrupting user-data and proceeding with +the original signal handler, an immediate SIGSEGV signal is delivered. + +Refactor the stack pointer check code from on_sig_stack() and use the new +helper. + +While the kernel allows new source code to discover and use a sufficient +alternate signal stack size, this check is still necessary to protect +binaries with insufficient alternate signal stack size from data +corruption. + +Fixes: c2bc11f10a39 ("x86, AVX-512: Enable AVX-512 States Context Switch") +Reported-by: Florian Weimer +Suggested-by: Jann Horn +Suggested-by: Andy Lutomirski +Signed-off-by: Chang S. Bae +Signed-off-by: Borislav Petkov +Reviewed-by: Len Brown +Acked-by: Thomas Gleixner +Link: https://lkml.kernel.org/r/20210518200320.17239-6-chang.seok.bae@intel.com +Link: https://bugzilla.kernel.org/show_bug.cgi?id=153531 +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/signal.c | 24 ++++++++++++++++++++---- + include/linux/sched/signal.h | 19 ++++++++++++------- + 2 files changed, 32 insertions(+), 11 deletions(-) + +diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c +index 2fdbf5ef8c39..026ce06a24c0 100644 +--- a/arch/x86/kernel/signal.c ++++ b/arch/x86/kernel/signal.c +@@ -241,10 +241,11 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, + void __user **fpstate) + { + /* Default to using normal stack */ ++ bool nested_altstack = on_sig_stack(regs->sp); ++ bool entering_altstack = false; + unsigned long math_size = 0; + unsigned long sp = regs->sp; + unsigned long buf_fx = 0; +- int onsigstack = on_sig_stack(sp); + int ret; + + /* redzone */ +@@ -253,15 +254,23 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, + + /* This is the X/Open sanctioned signal stack switching. */ + if (ka->sa.sa_flags & SA_ONSTACK) { +- if (sas_ss_flags(sp) == 0) ++ /* ++ * This checks nested_altstack via sas_ss_flags(). Sensible ++ * programs use SS_AUTODISARM, which disables that check, and ++ * programs that don't use SS_AUTODISARM get compatible. ++ */ ++ if (sas_ss_flags(sp) == 0) { + sp = current->sas_ss_sp + current->sas_ss_size; ++ entering_altstack = true; ++ } + } else if (IS_ENABLED(CONFIG_X86_32) && +- !onsigstack && ++ !nested_altstack && + regs->ss != __USER_DS && + !(ka->sa.sa_flags & SA_RESTORER) && + ka->sa.sa_restorer) { + /* This is the legacy signal stack switching. */ + sp = (unsigned long) ka->sa.sa_restorer; ++ entering_altstack = true; + } + + sp = fpu__alloc_mathframe(sp, IS_ENABLED(CONFIG_X86_32), +@@ -274,8 +283,15 @@ get_sigframe(struct k_sigaction *ka, struct pt_regs *regs, size_t frame_size, + * If we are on the alternate signal stack and would overflow it, don't. + * Return an always-bogus address instead so we will die with SIGSEGV. + */ +- if (onsigstack && !likely(on_sig_stack(sp))) ++ if (unlikely((nested_altstack || entering_altstack) && ++ !__on_sig_stack(sp))) { ++ ++ if (show_unhandled_signals && printk_ratelimit()) ++ pr_info("%s[%d] overflowed sigaltstack\n", ++ current->comm, task_pid_nr(current)); ++ + return (void __user *)-1L; ++ } + + /* save i387 and extended state */ + ret = copy_fpstate_to_sigframe(*fpstate, (void __user *)buf_fx, math_size); +diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h +index baf58f4cb057..b3f88470cbb5 100644 +--- a/include/linux/sched/signal.h ++++ b/include/linux/sched/signal.h +@@ -509,6 +509,17 @@ static inline int kill_cad_pid(int sig, int priv) + #define SEND_SIG_NOINFO ((struct kernel_siginfo *) 0) + #define SEND_SIG_PRIV ((struct kernel_siginfo *) 1) + ++static inline int __on_sig_stack(unsigned long sp) ++{ ++#ifdef CONFIG_STACK_GROWSUP ++ return sp >= current->sas_ss_sp && ++ sp - current->sas_ss_sp < current->sas_ss_size; ++#else ++ return sp > current->sas_ss_sp && ++ sp - current->sas_ss_sp <= current->sas_ss_size; ++#endif ++} ++ + /* + * True if we are on the alternate signal stack. + */ +@@ -526,13 +537,7 @@ static inline int on_sig_stack(unsigned long sp) + if (current->sas_ss_flags & SS_AUTODISARM) + return 0; + +-#ifdef CONFIG_STACK_GROWSUP +- return sp >= current->sas_ss_sp && +- sp - current->sas_ss_sp < current->sas_ss_size; +-#else +- return sp > current->sas_ss_sp && +- sp - current->sas_ss_sp <= current->sas_ss_size; +-#endif ++ return __on_sig_stack(sp); + } + + static inline int sas_ss_flags(unsigned long sp) +-- +2.30.2 +