From: Sasha Levin Date: Mon, 28 Dec 2020 04:33:21 +0000 (-0500) Subject: Fixes for 5.4 X-Git-Tag: v4.4.249~34 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0dc6854f0871f26566790cf689c6aa81c997419e;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/arm-dts-aspeed-s2600wf-fix-vga-memory-region-locatio.patch b/queue-5.4/arm-dts-aspeed-s2600wf-fix-vga-memory-region-locatio.patch new file mode 100644 index 00000000000..8f4f268b292 --- /dev/null +++ b/queue-5.4/arm-dts-aspeed-s2600wf-fix-vga-memory-region-locatio.patch @@ -0,0 +1,49 @@ +From cae1de6e289aeb302a6417d12ac3fbde1f017f05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Sep 2020 16:12:34 +0930 +Subject: ARM: dts: aspeed: s2600wf: Fix VGA memory region location + +From: Joel Stanley + +[ Upstream commit 9e1cc9679776f5b9e42481d392b1550753ebd084 ] + +The VGA memory region is always from the top of RAM. On this board, that +is 0x80000000 + 0x20000000 - 0x01000000 = 0x9f000000. + +This was not an issue in practice as the region is "reserved" by the +vendor's u-boot reducing the amount of available RAM, and the only user +is the host VGA device poking at RAM over PCIe. That is, nothing from +the ARM touches it. + +It is worth fixing as developers copy existing device trees when +building their machines, and the XDMA driver does use the memory region +from the ARM side. + +Fixes: c4043ecac34a ("ARM: dts: aspeed: Add S2600WF BMC Machine") +Reported-by: John Wang +Link: https://lore.kernel.org/r/20200922064234.163799-1-joel@jms.id.au +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts +index 22dade6393d06..d1dbe3b6ad5a7 100644 +--- a/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts ++++ b/arch/arm/boot/dts/aspeed-bmc-intel-s2600wf.dts +@@ -22,9 +22,9 @@ + #size-cells = <1>; + ranges; + +- vga_memory: framebuffer@7f000000 { ++ vga_memory: framebuffer@9f000000 { + no-map; +- reg = <0x7f000000 0x01000000>; ++ reg = <0x9f000000 0x01000000>; /* 16M */ + }; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-aspeed-tiogapass-remove-vuart.patch b/queue-5.4/arm-dts-aspeed-tiogapass-remove-vuart.patch new file mode 100644 index 00000000000..6bce1c31e27 --- /dev/null +++ b/queue-5.4/arm-dts-aspeed-tiogapass-remove-vuart.patch @@ -0,0 +1,41 @@ +From af9ec2085c43d6fe3f5a7263f167aa9f18fa251f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Aug 2020 12:04:30 -0700 +Subject: ARM: dts: aspeed: tiogapass: Remove vuart + +From: Vijay Khemka + +[ Upstream commit 14f100c00f1e35e5890340d4c6a64bda5dff4320 ] + +Removed vuart for facebook tiogapass platform as it uses uart2 and +uart3 pin with aspeed uart routing feature. + +Signed-off-by: Vijay Khemka +Reviewed-by: Joel Stanley +Fixes: ffdbf494821d ("ARM: dts: aspeed: tiogapass: Enable VUART") +Link: https://lore.kernel.org/r/20200813190431.3331026-1-vijaykhemka@fb.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts b/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts +index 682f729ea25e1..c58230fea45f8 100644 +--- a/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts ++++ b/arch/arm/boot/dts/aspeed-bmc-facebook-tiogapass.dts +@@ -81,11 +81,6 @@ + status = "okay"; + }; + +-&vuart { +- // VUART Host Console +- status = "okay"; +-}; +- + &uart1 { + // Host Console + status = "okay"; +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-at91-at91sam9rl-fix-adc-triggers.patch b/queue-5.4/arm-dts-at91-at91sam9rl-fix-adc-triggers.patch new file mode 100644 index 00000000000..c8dd4f5c314 --- /dev/null +++ b/queue-5.4/arm-dts-at91-at91sam9rl-fix-adc-triggers.patch @@ -0,0 +1,62 @@ +From 0504502896cadf4cda8c817ac548d86913ca6444 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Nov 2020 23:28:17 +0100 +Subject: ARM: dts: at91: at91sam9rl: fix ADC triggers + +From: Alexandre Belloni + +[ Upstream commit 851a95da583c26e2ddeb7281e9b61f0d76ea5aba ] + +The triggers for the ADC were taken from at91sam9260 dtsi but are not +correct. + +Fixes: a4c1d6c75822 ("ARM: at91/dt: sam9rl: add lcd, adc, usb gadget and pwm support") +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20201128222818.1910764-10-alexandre.belloni@bootlin.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91sam9rl.dtsi | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/arch/arm/boot/dts/at91sam9rl.dtsi b/arch/arm/boot/dts/at91sam9rl.dtsi +index ea024e4b6e095..0121bb0ecde16 100644 +--- a/arch/arm/boot/dts/at91sam9rl.dtsi ++++ b/arch/arm/boot/dts/at91sam9rl.dtsi +@@ -278,23 +278,26 @@ + atmel,adc-use-res = "highres"; + + trigger0 { +- trigger-name = "timer-counter-0"; ++ trigger-name = "external-rising"; + trigger-value = <0x1>; ++ trigger-external; + }; ++ + trigger1 { +- trigger-name = "timer-counter-1"; +- trigger-value = <0x3>; ++ trigger-name = "external-falling"; ++ trigger-value = <0x2>; ++ trigger-external; + }; + + trigger2 { +- trigger-name = "timer-counter-2"; +- trigger-value = <0x5>; ++ trigger-name = "external-any"; ++ trigger-value = <0x3>; ++ trigger-external; + }; + + trigger3 { +- trigger-name = "external"; +- trigger-value = <0x13>; +- trigger-external; ++ trigger-name = "continuous"; ++ trigger-value = <0x6>; + }; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-at91-sama5d2-map-securam-as-device.patch b/queue-5.4/arm-dts-at91-sama5d2-map-securam-as-device.patch new file mode 100644 index 00000000000..e1811b5e640 --- /dev/null +++ b/queue-5.4/arm-dts-at91-sama5d2-map-securam-as-device.patch @@ -0,0 +1,39 @@ +From 69a9c49ba07c80689a3971b4509369b23dd13a6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 11:57:05 +0200 +Subject: ARM: dts: at91: sama5d2: map securam as device + +From: Claudiu Beznea + +[ Upstream commit 9b5dcc8d427e2bcb84c49eb03ffefe11e7537a55 ] + +Due to strobe signal not being propagated from CPU to securam +the securam needs to be mapped as device or strongly ordered memory +to work properly. Otherwise, updating to one offset may affect +the adjacent locations in securam. + +Fixes: d4ce5f44d4409 ("ARM: dts: at91: sama5d2: Add securam node") +Signed-off-by: Claudiu Beznea +Signed-off-by: Alexandre Belloni +Acked-by: Nicolas Ferre +Link: https://lore.kernel.org/r/1606903025-14197-3-git-send-email-claudiu.beznea@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sama5d2.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi +index 2e2c1a7b1d1dc..5ea9aa9c060a0 100644 +--- a/arch/arm/boot/dts/sama5d2.dtsi ++++ b/arch/arm/boot/dts/sama5d2.dtsi +@@ -648,6 +648,7 @@ + clocks = <&pmc PMC_TYPE_PERIPHERAL 51>; + #address-cells = <1>; + #size-cells = <1>; ++ no-memory-wc; + ranges = <0 0xf8044000 0x1420>; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch b/queue-5.4/arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch new file mode 100644 index 00000000000..8accb6b38e7 --- /dev/null +++ b/queue-5.4/arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch @@ -0,0 +1,51 @@ +From 6262961df460535d2d3c62fb01ee15dba09681cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 14:00:19 +0200 +Subject: ARM: dts: at91: sama5d3_xplained: add pincontrol for USB Host + +From: Cristian Birsan + +[ Upstream commit e1062fa7292f1e3744db0a487c4ac0109e09b03d ] + +The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without +it the driver probes but VBus is not powered because of wrong pincontrol +configuration. + +Fixes: b7c2b61570798 ("ARM: at91: add Atmel's SAMA5D3 Xplained board") +Signed-off-by: Cristian Birsan +Signed-off-by: Alexandre Belloni +Acked-by: Ludovic Desroches +Link: https://lore.kernel.org/r/20201118120019.1257580-4-cristian.birsan@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama5d3_xplained.dts | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +index 61f068a7b362a..400eaf640fe42 100644 +--- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts +@@ -242,6 +242,11 @@ + atmel,pins = + ; /* PE9, conflicts with A9 */ + }; ++ pinctrl_usb_default: usb_default { ++ atmel,pins = ++ ; ++ }; + }; + }; + }; +@@ -259,6 +264,8 @@ + &pioE 3 GPIO_ACTIVE_LOW + &pioE 4 GPIO_ACTIVE_LOW + >; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usb_default>; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch b/queue-5.4/arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch new file mode 100644 index 00000000000..65cd727feef --- /dev/null +++ b/queue-5.4/arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch @@ -0,0 +1,51 @@ +From a6b385d227ba99b9be603a3c17c74b40148afae4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 14:00:18 +0200 +Subject: ARM: dts: at91: sama5d4_xplained: add pincontrol for USB Host + +From: Cristian Birsan + +[ Upstream commit be4dd2d448816a27c1446f8f37fce375daf64148 ] + +The pincontrol node is needed for USB Host since Linux v5.7-rc1. Without +it the driver probes but VBus is not powered because of wrong pincontrol +configuration. + +Fixes: 38153a017896f ("ARM: at91/dt: sama5d4: add dts for sama5d4 xplained board") +Signed-off-by: Cristian Birsan +Signed-off-by: Alexandre Belloni +Acked-by: Ludovic Desroches +Link: https://lore.kernel.org/r/20201118120019.1257580-3-cristian.birsan@microchip.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91-sama5d4_xplained.dts | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +index fdfc37d716e01..1d101067371b4 100644 +--- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts ++++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts +@@ -133,6 +133,11 @@ + atmel,pins = + ; + }; ++ pinctrl_usb_default: usb_default { ++ atmel,pins = ++ ; ++ }; + pinctrl_key_gpio: key_gpio_0 { + atmel,pins = + ; +@@ -158,6 +163,8 @@ + &pioE 11 GPIO_ACTIVE_HIGH + &pioE 14 GPIO_ACTIVE_HIGH + >; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_usb_default>; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-meson-fix-phy-deassert-timing-requirements.patch b/queue-5.4/arm-dts-meson-fix-phy-deassert-timing-requirements.patch new file mode 100644 index 00000000000..97511021e58 --- /dev/null +++ b/queue-5.4/arm-dts-meson-fix-phy-deassert-timing-requirements.patch @@ -0,0 +1,55 @@ +From 031479ede854e5f8277717e0704cbec256c7d627 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 18:58:01 +0100 +Subject: ARM: dts: meson: fix PHY deassert timing requirements + +From: Stefan Agner + +[ Upstream commit 656ab1bdcd2b755dc161a9774201100d5bf74b8d ] + +According to the datasheet (Rev. 1.9) the RTL8211F requires at least +72ms "for internal circuits settling time" before accessing the PHY +registers. On similar boards with the same PHY this fixes an issue where +Ethernet link would not come up when using ip link set down/up. + +Fixes: a2c6e82e5341 ("ARM: dts: meson: switch to the generic Ethernet PHY reset bindings") +Reviewed-by: Martin Blumenstingl +Tested-by: Martin Blumenstingl # on Odroid-C1+ +Signed-off-by: Stefan Agner +Signed-off-by: Kevin Hilman +Link: https://lore.kernel.org/r/ff78772b306411e145769c46d4090554344db41e.1607363522.git.stefan@agner.ch +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/meson8b-odroidc1.dts | 2 +- + arch/arm/boot/dts/meson8m2-mxiii-plus.dts | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/meson8b-odroidc1.dts b/arch/arm/boot/dts/meson8b-odroidc1.dts +index a24eccc354b95..0f9c71137bed5 100644 +--- a/arch/arm/boot/dts/meson8b-odroidc1.dts ++++ b/arch/arm/boot/dts/meson8b-odroidc1.dts +@@ -219,7 +219,7 @@ + reg = <0>; + + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOH_4 GPIO_ACTIVE_LOW>; + + interrupt-parent = <&gpio_intc>; +diff --git a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts +index d54477b1001ca..84b6ed51099db 100644 +--- a/arch/arm/boot/dts/meson8m2-mxiii-plus.dts ++++ b/arch/arm/boot/dts/meson8m2-mxiii-plus.dts +@@ -83,7 +83,7 @@ + reg = <0>; + + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOH_4 GPIO_ACTIVE_LOW>; + }; + }; +-- +2.27.0 + diff --git a/queue-5.4/arm-dts-remove-non-existent-i2c1-from-98dx3236.patch b/queue-5.4/arm-dts-remove-non-existent-i2c1-from-98dx3236.patch new file mode 100644 index 00000000000..0635dc78845 --- /dev/null +++ b/queue-5.4/arm-dts-remove-non-existent-i2c1-from-98dx3236.patch @@ -0,0 +1,40 @@ +From 265483bc43bdbbbbd60eb51bf1a5922ec2727f76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Sep 2020 09:17:11 +1200 +Subject: ARM: dts: Remove non-existent i2c1 from 98dx3236 + +From: Chris Packham + +[ Upstream commit 7f24479ead579459106bb55c2320a000135731f9 ] + +The switches with integrated CPUs have only got a single i2c controller. +They incorrectly gained one when they were split from the Armada-XP. + +Fixes: 43e28ba87708 ("ARM: dts: Use armada-370-xp as a base for armada-xp-98dx3236") +Signed-off-by: Chris Packham +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/armada-xp-98dx3236.dtsi | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi +index 267d0c178e55c..30abb4b64a1b6 100644 +--- a/arch/arm/boot/dts/armada-xp-98dx3236.dtsi ++++ b/arch/arm/boot/dts/armada-xp-98dx3236.dtsi +@@ -266,11 +266,6 @@ + reg = <0x11000 0x100>; + }; + +-&i2c1 { +- compatible = "marvell,mv78230-i2c", "marvell,mv64xxx-i2c"; +- reg = <0x11100 0x100>; +-}; +- + &mpic { + reg = <0x20a00 0x2d0>, <0x21070 0x58>; + }; +-- +2.27.0 + diff --git a/queue-5.4/arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch b/queue-5.4/arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch new file mode 100644 index 00000000000..ec3d00c1fb0 --- /dev/null +++ b/queue-5.4/arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch @@ -0,0 +1,55 @@ +From f45b87b5d807432f93f8012ff921b87debb7d177 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Sep 2020 00:10:16 +0200 +Subject: ARM: p2v: fix handling of LPAE translation in BE mode + +From: Ard Biesheuvel + +[ Upstream commit 4e79f0211b473f8e1eab8211a9fd50cc41a3a061 ] + +When running in BE mode on LPAE hardware with a PA-to-VA translation +that exceeds 4 GB, we patch bits 39:32 of the offset into the wrong +byte of the opcode. So fix that, by rotating the offset in r0 to the +right by 8 bits, which will put the 8-bit immediate in bits 31:24. + +Note that this will also move bit #22 in its correct place when +applying the rotation to the constant #0x400000. + +Fixes: d9a790df8e984 ("ARM: 7883/1: fix mov to mvn conversion in case of 64 bit phys_addr_t and BE") +Acked-by: Nicolas Pitre +Reviewed-by: Linus Walleij +Signed-off-by: Ard Biesheuvel +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/head.S | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/arch/arm/kernel/head.S b/arch/arm/kernel/head.S +index c49b39340ddbd..f1cdc1f369575 100644 +--- a/arch/arm/kernel/head.S ++++ b/arch/arm/kernel/head.S +@@ -671,12 +671,8 @@ ARM_BE8(rev16 ip, ip) + ldrcc r7, [r4], #4 @ use branch for delay slot + bcc 1b + bx lr +-#else +-#ifdef CONFIG_CPU_ENDIAN_BE8 +- moveq r0, #0x00004000 @ set bit 22, mov to mvn instruction + #else + moveq r0, #0x400000 @ set bit 22, mov to mvn instruction +-#endif + b 2f + 1: ldr ip, [r7, r3] + #ifdef CONFIG_CPU_ENDIAN_BE8 +@@ -685,7 +681,7 @@ ARM_BE8(rev16 ip, ip) + tst ip, #0x000f0000 @ check the rotation field + orrne ip, ip, r6, lsl #24 @ mask in offset bits 31-24 + biceq ip, ip, #0x00004000 @ clear bit 22 +- orreq ip, ip, r0 @ mask in offset bits 7-0 ++ orreq ip, ip, r0, ror #8 @ mask in offset bits 7-0 + #else + bic ip, ip, #0x000000ff + tst ip, #0xf00 @ check the rotation field +-- +2.27.0 + diff --git a/queue-5.4/arm-sunxi-add-machine-match-for-the-allwinner-v3-soc.patch b/queue-5.4/arm-sunxi-add-machine-match-for-the-allwinner-v3-soc.patch new file mode 100644 index 00000000000..9540b9d4b6e --- /dev/null +++ b/queue-5.4/arm-sunxi-add-machine-match-for-the-allwinner-v3-soc.patch @@ -0,0 +1,36 @@ +From eff065f8a71edd7564fec21aae7068c2f84fa72f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Oct 2020 19:21:29 +0100 +Subject: ARM: sunxi: Add machine match for the Allwinner V3 SoC + +From: Paul Kocialkowski + +[ Upstream commit ad2091f893bd5dfe2824f0d6819600d120698e9f ] + +The Allwinner V3 SoC shares the same base as the V3s but comes with +extra pins and features available. As a result, it has its dedicated +compatible string (already used in device trees), which is added here. + +Signed-off-by: Paul Kocialkowski +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201031182137.1879521-2-contact@paulk.fr +Signed-off-by: Sasha Levin +--- + arch/arm/mach-sunxi/sunxi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-sunxi/sunxi.c b/arch/arm/mach-sunxi/sunxi.c +index 933b6930f024f..a0ca5e7a68de2 100644 +--- a/arch/arm/mach-sunxi/sunxi.c ++++ b/arch/arm/mach-sunxi/sunxi.c +@@ -66,6 +66,7 @@ static const char * const sun8i_board_dt_compat[] = { + "allwinner,sun8i-h2-plus", + "allwinner,sun8i-h3", + "allwinner,sun8i-r40", ++ "allwinner,sun8i-v3", + "allwinner,sun8i-v3s", + NULL, + }; +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-armada-3720-turris-mox-update-ethernet-phy.patch b/queue-5.4/arm64-dts-armada-3720-turris-mox-update-ethernet-phy.patch new file mode 100644 index 00000000000..9fef3c15229 --- /dev/null +++ b/queue-5.4/arm64-dts-armada-3720-turris-mox-update-ethernet-phy.patch @@ -0,0 +1,44 @@ +From 9ccfc9f8d89bd07f4e25bde88f3de12ef86ab285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 21:42:53 +0100 +Subject: arm64: dts: armada-3720-turris-mox: update ethernet-phy handle name +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Marek Behún + +[ Upstream commit 3aa669a994c9110a2dc7e08a5c0958a9ea5eb17c ] + +Use property name `phy-handle` instead of the deprecated `phy` to +connect eth2 to the PHY. + +Signed-off-by: Marek Behún +Fixes: 7109d817db2e ("arm64: dts: marvell: add DTS for Turris Mox") +Cc: Gregory CLEMENT +Cc: Andrew Lunn +Cc: Rob Herring +Cc: devicetree@vger.kernel.org +Reviewed-by: Andrew Lunn +Signed-off-by: Gregory CLEMENT +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +index c3668187b8446..aa52927e2e9c2 100644 +--- a/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts ++++ b/arch/arm64/boot/dts/marvell/armada-3720-turris-mox.dts +@@ -144,7 +144,7 @@ + pinctrl-names = "default"; + pinctrl-0 = <&rgmii_pins>; + phy-mode = "rgmii-id"; +- phy = <&phy1>; ++ phy-handle = <&phy1>; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch b/queue-5.4/arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch new file mode 100644 index 00000000000..cffba23a2f8 --- /dev/null +++ b/queue-5.4/arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch @@ -0,0 +1,50 @@ +From eb48017065c1746a423d55325c40baa9259d7a34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 14:39:26 +0100 +Subject: arm64: dts: exynos: Correct psci compatible used on Exynos7 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paweł Chmiel + +[ Upstream commit e1e47fbca668507a81bb388fcae044b89d112ecc ] + +It's not possible to reboot or poweroff Exynos7420 using PSCI. Instead +we need to use syscon reboot/poweroff drivers, like it's done for other +Exynos SoCs. This was confirmed by checking vendor source and testing it +on Samsung Galaxy S6 device based on this SoC. + +To be able to use custom restart/poweroff handlers instead of PSCI +functions, we need to correct psci compatible. This also requires us to +provide function ids for CPU_ON and CPU_OFF. + +Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7") +Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7") +Signed-off-by: Paweł Chmiel +Link: https://lore.kernel.org/r/20201107133926.37187-2-pawel.mikolaj.chmiel@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/exynos/exynos7.dtsi | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi +index c5be82d48c986..25549d9552ae2 100644 +--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi ++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi +@@ -90,8 +90,10 @@ + }; + + psci { +- compatible = "arm,psci-0.2"; ++ compatible = "arm,psci"; + method = "smc"; ++ cpu_off = <0x84000002>; ++ cpu_on = <0xC4000003>; + }; + + soc: soc { +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-exynos-include-common-syscon-restart-power.patch b/queue-5.4/arm64-dts-exynos-include-common-syscon-restart-power.patch new file mode 100644 index 00000000000..8b175fb0f17 --- /dev/null +++ b/queue-5.4/arm64-dts-exynos-include-common-syscon-restart-power.patch @@ -0,0 +1,55 @@ +From c48f09592ec2bbc5c3650de2c2b9d2af397a9463 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 14:39:25 +0100 +Subject: arm64: dts: exynos: Include common syscon restart/poweroff for + Exynos7 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paweł Chmiel + +[ Upstream commit 73bc7510ea0dafb4ff1ae6808759627a8ec51f5a ] + +Exynos7 uses the same syscon reboot and poweroff nodes as other Exynos +SoCs, so instead of duplicating code we can just include common dtsi +file, which already contains definitions of them. After this change, +poweroff node will be also available, previously this dts file did +contain only reboot node. + +Fixes: fb026cb65247 ("arm64: dts: Add reboot node for exynos7") +Fixes: b9024cbc937d ("arm64: dts: Add initial device tree support for exynos7") +Signed-off-by: Paweł Chmiel +Link: https://lore.kernel.org/r/20201107133926.37187-1-pawel.mikolaj.chmiel@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/exynos/exynos7.dtsi | 8 +------- + 1 file changed, 1 insertion(+), 7 deletions(-) + +diff --git a/arch/arm64/boot/dts/exynos/exynos7.dtsi b/arch/arm64/boot/dts/exynos/exynos7.dtsi +index 0821489a874de..c5be82d48c986 100644 +--- a/arch/arm64/boot/dts/exynos/exynos7.dtsi ++++ b/arch/arm64/boot/dts/exynos/exynos7.dtsi +@@ -494,13 +494,6 @@ + pmu_system_controller: system-controller@105c0000 { + compatible = "samsung,exynos7-pmu", "syscon"; + reg = <0x105c0000 0x5000>; +- +- reboot: syscon-reboot { +- compatible = "syscon-reboot"; +- regmap = <&pmu_system_controller>; +- offset = <0x0400>; +- mask = <0x1>; +- }; + }; + + rtc: rtc@10590000 { +@@ -650,3 +643,4 @@ + }; + + #include "exynos7-pinctrl.dtsi" ++#include "arm/exynos-syscon-restart.dtsi" +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-ls1028a-fix-enetc-ptp-clock-input.patch b/queue-5.4/arm64-dts-ls1028a-fix-enetc-ptp-clock-input.patch new file mode 100644 index 00000000000..b5dd3f35380 --- /dev/null +++ b/queue-5.4/arm64-dts-ls1028a-fix-enetc-ptp-clock-input.patch @@ -0,0 +1,41 @@ +From c6c46e75f2784deb300352b0dddef6afb8b8dc6e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 19:51:05 +0100 +Subject: arm64: dts: ls1028a: fix ENETC PTP clock input + +From: Michael Walle + +[ Upstream commit d0570a575aa83116bd0f6a99c4de548af773d950 ] + +On the LS1028A the ENETC reference clock is connected to 4th HWA output, +see Figure 7 "Clock subsystem block diagram". + +The PHC may run with a wrong frequency. ptp_qoriq_auto_config() will read +the clock speed of the clock given in the device tree. It is likely that, +on the reference board this wasn't noticed because both clocks have the +same frequency. But this must not be always the case. Fix it. + +Fixes: 49401003e260 ("arm64: dts: fsl: ls1028a: add ENETC 1588 timer node") +Signed-off-by: Michael Walle +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +index 9589b15693d6e..795d6ca4bbd1f 100644 +--- a/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi ++++ b/arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi +@@ -673,7 +673,7 @@ + ethernet@0,4 { + compatible = "fsl,enetc-ptp"; + reg = <0x000400 0 0 0 0>; +- clocks = <&clockgen 4 0>; ++ clocks = <&clockgen 2 3>; + little-endian; + }; + }; +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-meson-fix-phy-deassert-timing-requirements.patch b/queue-5.4/arm64-dts-meson-fix-phy-deassert-timing-requirements.patch new file mode 100644 index 00000000000..45aef022376 --- /dev/null +++ b/queue-5.4/arm64-dts-meson-fix-phy-deassert-timing-requirements.patch @@ -0,0 +1,157 @@ +From 0a69fe7adb610aca3637c732ded99cf9820bfd30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 18:58:00 +0100 +Subject: arm64: dts: meson: fix PHY deassert timing requirements + +From: Stefan Agner + +[ Upstream commit c183c406c4321002fe85b345b51bc1a3a04b6d33 ] + +According to the datasheet (Rev. 1.9) the RTL8211F requires at least +72ms "for internal circuits settling time" before accessing the PHY +registers. This fixes an issue seen on ODROID-C2 where the Ethernet +link doesn't come up when using ip link set down/up: + [ 6630.714855] meson8b-dwmac c9410000.ethernet eth0: Link is Down + [ 6630.785775] meson8b-dwmac c9410000.ethernet eth0: PHY [stmmac-0:00] driver [RTL8211F Gigabit Ethernet] (irq=36) + [ 6630.893071] meson8b-dwmac c9410000.ethernet: Failed to reset the dma + [ 6630.893800] meson8b-dwmac c9410000.ethernet eth0: stmmac_hw_setup: DMA engine initialization failed + [ 6630.902835] meson8b-dwmac c9410000.ethernet eth0: stmmac_open: Hw setup failed + +Fixes: f29cabf240ed ("arm64: dts: meson: use the generic Ethernet PHY reset GPIO bindings") +Reviewed-by: Martin Blumenstingl +Signed-off-by: Stefan Agner +Signed-off-by: Kevin Hilman +Link: https://lore.kernel.org/r/4a322c198b86e4c8b3dda015560a683babea4d63.1607363522.git.stefan@agner.ch +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts | 2 +- + arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts | 2 +- + arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi | 2 +- + arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi | 2 +- + arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts | 2 +- + arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +- + arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts | 2 +- + arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts | 2 +- + arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts | 2 +- + 9 files changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts +index 233eb1cd79671..d94b695916a35 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-nanopi-k2.dts +@@ -165,7 +165,7 @@ + reg = <0>; + + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>; + + interrupt-parent = <&gpio_intc>; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +index b0b12e3898350..8828acb3fd4c5 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +@@ -138,7 +138,7 @@ + reg = <0>; + + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>; + + interrupt-parent = <&gpio_intc>; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi +index 43b11e3dfe119..29976215e1446 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-vega-s95.dtsi +@@ -126,7 +126,7 @@ + reg = <0>; + + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>; + + interrupt-parent = <&gpio_intc>; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +index 4c539881fbb73..e3d17569d98ad 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-wetek.dtsi +@@ -147,7 +147,7 @@ + reg = <0>; + + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>; + }; + }; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts +index b08c4537f260d..b2ab05c220903 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905d-p230.dts +@@ -82,7 +82,7 @@ + + /* External PHY reset is shared with internal PHY Led signal */ + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>; + + interrupt-parent = <&gpio_intc>; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts +index fa8bd0690e89a..c8a4205117f15 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts +@@ -251,7 +251,7 @@ + reg = <0>; + + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>; + + interrupt-parent = <&gpio_intc>; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts +index c2bd4dbbf38c5..8dccf91d68da7 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-nexbox-a1.dts +@@ -112,7 +112,7 @@ + max-speed = <1000>; + + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>; + }; + }; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts +index ea45ae0c71b7f..8edbfe040805c 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-q200.dts +@@ -64,7 +64,7 @@ + + /* External PHY reset is shared with internal PHY Led signal */ + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>; + + interrupt-parent = <&gpio_intc>; +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts +index 5cd4d35006d09..f72d29e33a9e4 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-rbox-pro.dts +@@ -114,7 +114,7 @@ + max-speed = <1000>; + + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOZ_14 GPIO_ACTIVE_LOW>; + }; + }; +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-meson-fix-spi-max-frequency-on-khadas-vim2.patch b/queue-5.4/arm64-dts-meson-fix-spi-max-frequency-on-khadas-vim2.patch new file mode 100644 index 00000000000..742e557aeea --- /dev/null +++ b/queue-5.4/arm64-dts-meson-fix-spi-max-frequency-on-khadas-vim2.patch @@ -0,0 +1,38 @@ +From d864387a54b98e5587220529ba20c9385972c7d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 02:40:01 +0000 +Subject: arm64: dts: meson: fix spi-max-frequency on Khadas VIM2 + +From: Artem Lapkin + +[ Upstream commit b6c605e00ce8910d7ec3d9a54725d78b14db49b9 ] + +The max frequency for the w25q32 (VIM v1.2) and w25q128 (VIM v1.4) spifc +chip should be 104Mhz not 30MHz. + +Fixes: b8b74dda3908 ("ARM64: dts: meson-gxm: Add support for Khadas VIM2") +Signed-off-by: Artem Lapkin +Reviewed-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Link: https://lore.kernel.org/r/20201125024001.19036-1-christianshewitt@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts +index 3f43716d5c453..fa8bd0690e89a 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxm-khadas-vim2.dts +@@ -395,7 +395,7 @@ + #size-cells = <1>; + compatible = "winbond,w25q16", "jedec,spi-nor"; + reg = <0>; +- spi-max-frequency = <3000000>; ++ spi-max-frequency = <104000000>; + }; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-meson-g12a-x96-max-fix-phy-deassert-timing.patch b/queue-5.4/arm64-dts-meson-g12a-x96-max-fix-phy-deassert-timing.patch new file mode 100644 index 00000000000..0179887b90c --- /dev/null +++ b/queue-5.4/arm64-dts-meson-g12a-x96-max-fix-phy-deassert-timing.patch @@ -0,0 +1,41 @@ +From 279fd9c8490baef59089697611273d75caad0fff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 18:58:02 +0100 +Subject: arm64: dts: meson: g12a: x96-max: fix PHY deassert timing + requirements + +From: Stefan Agner + +[ Upstream commit 3d07c3b3a886fefd583c1b485b5e4e3c4e2da493 ] + +According to the datasheet (Rev. 1.9) the RTL8211F requires at least +72ms "for internal circuits settling time" before accessing the PHY +registers. On similar boards with the same PHY this fixes an issue where +Ethernet link would not come up when using ip link set down/up. + +Fixes: ed5e8f689154 ("arm64: dts: meson: g12a: x96-max: fix the Ethernet PHY reset line") +Reviewed-by: Martin Blumenstingl +Signed-off-by: Stefan Agner +Signed-off-by: Kevin Hilman +Link: https://lore.kernel.org/r/12506964ca5d5f936579a280ad0a7e7f9a0a2d4c.1607363522.git.stefan@agner.ch +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts +index 17155fb73fce9..c48125bf9d1e3 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-g12a-x96-max.dts +@@ -340,7 +340,7 @@ + eee-broken-1000t; + + reset-assert-us = <10000>; +- reset-deassert-us = <30000>; ++ reset-deassert-us = <80000>; + reset-gpios = <&gpio GPIOZ_15 (GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)>; + + interrupt-parent = <&gpio_intc>; +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-meson-sm1-fix-typo-in-opp-table.patch b/queue-5.4/arm64-dts-meson-sm1-fix-typo-in-opp-table.patch new file mode 100644 index 00000000000..b4bf6588c5f --- /dev/null +++ b/queue-5.4/arm64-dts-meson-sm1-fix-typo-in-opp-table.patch @@ -0,0 +1,37 @@ +From 6244de8794464a9009db0d5a28b3f593aa311598 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 15:03:20 +0900 +Subject: arm64: dts: meson-sm1: fix typo in opp table + +From: Dongjin Kim + +[ Upstream commit b6a1c8a1eaa73b1e2ae251399308e9445d74cef7 ] + +The freqency 1512000000 should be 1500000000. + +Signed-off-by: Dongjin Kim +Fixes: 3d9e76483049 ("arm64: dts: meson-sm1-sei610: enable DVFS") +Reviewed-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Link: https://lore.kernel.org/r/20201130060320.GA30098@anyang-linuxfactory-or-kr +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/amlogic/meson-sm1.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi +index 521573f3a5bab..8ba3555ca3693 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi ++++ b/arch/arm64/boot/dts/amlogic/meson-sm1.dtsi +@@ -90,7 +90,7 @@ + opp-microvolt = <790000>; + }; + +- opp-1512000000 { ++ opp-1500000000 { + opp-hz = /bits/ 64 <1500000000>; + opp-microvolt = <800000>; + }; +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-qcom-c630-polish-i2c-hid-devices.patch b/queue-5.4/arm64-dts-qcom-c630-polish-i2c-hid-devices.patch new file mode 100644 index 00000000000..dbd70637c48 --- /dev/null +++ b/queue-5.4/arm64-dts-qcom-c630-polish-i2c-hid-devices.patch @@ -0,0 +1,131 @@ +From 7af8aa59ea2d85889cb8f955db22fd559c1d0e1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 10:59:24 -0600 +Subject: arm64: dts: qcom: c630: Polish i2c-hid devices + +From: Bjorn Andersson + +[ Upstream commit 11d0e4f281565ef757479764ce7fd8d35eeb01b0 ] + +The numbering of the i2c busses differs from ACPI and a number of typos +was made in the original patch. Further more the irq flags for the +various resources was not correct and i2c3 only has one of the two +client devices active in any one device. + +Also label the various devices, for easier comparison with the ACPI +tables. + +Tested-by: Steev Klimaszewski +Fixes: 44acee207844 ("arm64: dts: qcom: Add Lenovo Yoga C630") +Link: https://lore.kernel.org/r/20201130165924.319708-1-bjorn.andersson@linaro.org +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + .../boot/dts/qcom/sdm850-lenovo-yoga-c630.dts | 31 +++++++++++-------- + 1 file changed, 18 insertions(+), 13 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts +index ded120d3aef58..f539b3655f6b9 100644 +--- a/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts ++++ b/arch/arm64/boot/dts/qcom/sdm850-lenovo-yoga-c630.dts +@@ -244,23 +244,28 @@ + status = "okay"; + clock-frequency = <400000>; + +- hid@15 { ++ tsel: hid@15 { + compatible = "hid-over-i2c"; + reg = <0x15>; + hid-descr-addr = <0x1>; + +- interrupts-extended = <&tlmm 37 IRQ_TYPE_EDGE_RISING>; ++ interrupts-extended = <&tlmm 37 IRQ_TYPE_LEVEL_HIGH>; ++ ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c3_hid_active>; + }; + +- hid@2c { ++ tsc2: hid@2c { + compatible = "hid-over-i2c"; + reg = <0x2c>; + hid-descr-addr = <0x20>; + +- interrupts-extended = <&tlmm 37 IRQ_TYPE_EDGE_RISING>; ++ interrupts-extended = <&tlmm 37 IRQ_TYPE_LEVEL_HIGH>; + + pinctrl-names = "default"; +- pinctrl-0 = <&i2c2_hid_active>; ++ pinctrl-0 = <&i2c3_hid_active>; ++ ++ status = "disabled"; + }; + }; + +@@ -268,15 +273,15 @@ + status = "okay"; + clock-frequency = <400000>; + +- hid@10 { ++ tsc1: hid@10 { + compatible = "hid-over-i2c"; + reg = <0x10>; + hid-descr-addr = <0x1>; + +- interrupts-extended = <&tlmm 125 IRQ_TYPE_EDGE_FALLING>; ++ interrupts-extended = <&tlmm 125 IRQ_TYPE_LEVEL_LOW>; + + pinctrl-names = "default"; +- pinctrl-0 = <&i2c6_hid_active>; ++ pinctrl-0 = <&i2c5_hid_active>; + }; + }; + +@@ -284,7 +289,7 @@ + status = "okay"; + clock-frequency = <400000>; + +- hid@5c { ++ ecsh: hid@5c { + compatible = "hid-over-i2c"; + reg = <0x5c>; + hid-descr-addr = <0x1>; +@@ -292,7 +297,7 @@ + interrupts-extended = <&tlmm 92 IRQ_TYPE_LEVEL_LOW>; + + pinctrl-names = "default"; +- pinctrl-0 = <&i2c12_hid_active>; ++ pinctrl-0 = <&i2c11_hid_active>; + }; + }; + +@@ -335,7 +340,7 @@ + &tlmm { + gpio-reserved-ranges = <0 4>, <81 4>; + +- i2c2_hid_active: i2c2-hid-active { ++ i2c3_hid_active: i2c2-hid-active { + pins = <37>; + function = "gpio"; + +@@ -344,7 +349,7 @@ + drive-strength = <2>; + }; + +- i2c6_hid_active: i2c6-hid-active { ++ i2c5_hid_active: i2c5-hid-active { + pins = <125>; + function = "gpio"; + +@@ -353,7 +358,7 @@ + drive-strength = <2>; + }; + +- i2c12_hid_active: i2c12-hid-active { ++ i2c11_hid_active: i2c11-hid-active { + pins = <92>; + function = "gpio"; + +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-renesas-cat875-remove-rxc-skew-ps-from-eth.patch b/queue-5.4/arm64-dts-renesas-cat875-remove-rxc-skew-ps-from-eth.patch new file mode 100644 index 00000000000..a2e81446d12 --- /dev/null +++ b/queue-5.4/arm64-dts-renesas-cat875-remove-rxc-skew-ps-from-eth.patch @@ -0,0 +1,38 @@ +From ccf45a24f52a1681c13d59985cd79153d5178b16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 14:23:50 +0100 +Subject: arm64: dts: renesas: cat875: Remove rxc-skew-ps from ethernet-phy + node + +From: Biju Das + +[ Upstream commit 53e573dc39fba1834f3e4fa002cb754b61a30701 ] + +The CAT875 sub board from Silicon Linux uses Realtek phy and the driver +does not support rxc-skew-ps property. + +Fixes: 6b170cd3ed02949f ("arm64: dts: renesas: cat875: Add ethernet support") +Signed-off-by: Biju Das +Reviewed-by: Lad Prabhakar +Link: https://lore.kernel.org/r/20201015132350.8360-2-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/cat875.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/cat875.dtsi b/arch/arm64/boot/dts/renesas/cat875.dtsi +index aaefc3ae56d50..dbdb8b093e733 100644 +--- a/arch/arm64/boot/dts/renesas/cat875.dtsi ++++ b/arch/arm64/boot/dts/renesas/cat875.dtsi +@@ -22,7 +22,6 @@ + status = "okay"; + + phy0: ethernet-phy@0 { +- rxc-skew-ps = <1500>; + reg = <0>; + interrupt-parent = <&gpio2>; + interrupts = <21 IRQ_TYPE_LEVEL_LOW>; +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-renesas-hihope-rzg2-ex-drop-rxc-skew-ps-fr.patch b/queue-5.4/arm64-dts-renesas-hihope-rzg2-ex-drop-rxc-skew-ps-fr.patch new file mode 100644 index 00000000000..d5843510d30 --- /dev/null +++ b/queue-5.4/arm64-dts-renesas-hihope-rzg2-ex-drop-rxc-skew-ps-fr.patch @@ -0,0 +1,38 @@ +From d4a266996f9b073807831ed325297064321b4315 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 14:23:49 +0100 +Subject: arm64: dts: renesas: hihope-rzg2-ex: Drop rxc-skew-ps from + ethernet-phy node + +From: Biju Das + +[ Upstream commit 67d3dcf12a3d245b6fd6ca5672893f7ae4e137ed ] + +HiHope RZG2[HMN] boards uses Realtek phy and the driver does not support +rxc-skew-ps property. So remove rxc-skew-ps from ethernet-phy node. + +Fixes: 7433f1fb8ec8fe ("arm64: dts: renesas: Add HiHope RZ/G2M sub board support") +Signed-off-by: Biju Das +Reviewed-by: Lad Prabhakar +Link: https://lore.kernel.org/r/20201015132350.8360-1-biju.das.jz@bp.renesas.com +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi +index 4280b190dc682..6a001cdfd38e2 100644 +--- a/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi ++++ b/arch/arm64/boot/dts/renesas/hihope-rzg2-ex.dtsi +@@ -23,7 +23,6 @@ + status = "okay"; + + phy0: ethernet-phy@0 { +- rxc-skew-ps = <1500>; + reg = <0>; + interrupt-parent = <&gpio2>; + interrupts = <11 IRQ_TYPE_LEVEL_LOW>; +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch b/queue-5.4/arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch new file mode 100644 index 00000000000..c38ac10f3bb --- /dev/null +++ b/queue-5.4/arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch @@ -0,0 +1,75 @@ +From 35f8c459c2528aeed981316b34e580e64b19f279 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 14:48:05 +0800 +Subject: arm64: dts: rockchip: Fix UART pull-ups on rk3328 + +From: Chen-Yu Tsai + +[ Upstream commit 94dad6bed3c86c00050bf7c2b2ad6b630facae31 ] + +For UARTs, the local pull-ups should be on the RX pin, not the TX pin. +UARTs transmit active-low, so a disconnected RX pin should be pulled +high instead of left floating to prevent noise being interpreted as +transmissions. + +This gets rid of bogus sysrq events when the UART console is not +connected. + +Fixes: 52e02d377a72 ("arm64: dts: rockchip: add core dtsi file for RK3328 SoCs") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20201204064805.6480-1-wens@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328.dtsi | 16 ++++++++-------- + 1 file changed, 8 insertions(+), 8 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index 31cc1541f1f59..e0ed323935a4d 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -1190,8 +1190,8 @@ + + uart0 { + uart0_xfer: uart0-xfer { +- rockchip,pins = <1 RK_PB1 1 &pcfg_pull_up>, +- <1 RK_PB0 1 &pcfg_pull_none>; ++ rockchip,pins = <1 RK_PB1 1 &pcfg_pull_none>, ++ <1 RK_PB0 1 &pcfg_pull_up>; + }; + + uart0_cts: uart0-cts { +@@ -1209,8 +1209,8 @@ + + uart1 { + uart1_xfer: uart1-xfer { +- rockchip,pins = <3 RK_PA4 4 &pcfg_pull_up>, +- <3 RK_PA6 4 &pcfg_pull_none>; ++ rockchip,pins = <3 RK_PA4 4 &pcfg_pull_none>, ++ <3 RK_PA6 4 &pcfg_pull_up>; + }; + + uart1_cts: uart1-cts { +@@ -1228,15 +1228,15 @@ + + uart2-0 { + uart2m0_xfer: uart2m0-xfer { +- rockchip,pins = <1 RK_PA0 2 &pcfg_pull_up>, +- <1 RK_PA1 2 &pcfg_pull_none>; ++ rockchip,pins = <1 RK_PA0 2 &pcfg_pull_none>, ++ <1 RK_PA1 2 &pcfg_pull_up>; + }; + }; + + uart2-1 { + uart2m1_xfer: uart2m1-xfer { +- rockchip,pins = <2 RK_PA0 1 &pcfg_pull_up>, +- <2 RK_PA1 1 &pcfg_pull_none>; ++ rockchip,pins = <2 RK_PA0 1 &pcfg_pull_none>, ++ <2 RK_PA1 1 &pcfg_pull_up>; + }; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm64-dts-rockchip-set-dr_mode-to-host-for-otg-on-rk.patch b/queue-5.4/arm64-dts-rockchip-set-dr_mode-to-host-for-otg-on-rk.patch new file mode 100644 index 00000000000..da30977d82e --- /dev/null +++ b/queue-5.4/arm64-dts-rockchip-set-dr_mode-to-host-for-otg-on-rk.patch @@ -0,0 +1,37 @@ +From d5e56a14d3f2c3602542532907e2cc93e39b2e29 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 15:33:34 +0800 +Subject: arm64: dts: rockchip: Set dr_mode to "host" for OTG on rk3328-roc-cc + +From: Chen-Yu Tsai + +[ Upstream commit 4076a007bd0f6171434bdb119a0b8797749b0502 ] + +The board has a standard USB A female port connected to the USB OTG +controller's data pins. Set dr_mode in the OTG controller node to +indicate this usage, instead of having the implementation guess. + +Fixes: 2171f4fdac06 ("arm64: dts: rockchip: add roc-rk3328-cc board") +Signed-off-by: Chen-Yu Tsai +Link: https://lore.kernel.org/r/20201126073336.30794-2-wens@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts +index bb40c163b05dc..6c3368f795ca3 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-roc-cc.dts +@@ -333,6 +333,7 @@ + }; + + &usb20_otg { ++ dr_mode = "host"; + status = "okay"; + }; + +-- +2.27.0 + diff --git a/queue-5.4/arm64-tegra-fix-dt-binding-for-io-high-voltage-entry.patch b/queue-5.4/arm64-tegra-fix-dt-binding-for-io-high-voltage-entry.patch new file mode 100644 index 00000000000..a94af402e82 --- /dev/null +++ b/queue-5.4/arm64-tegra-fix-dt-binding-for-io-high-voltage-entry.patch @@ -0,0 +1,46 @@ +From c1ffbbf696dbce8551a849b48531c680f0419322 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 12:09:02 +0530 +Subject: arm64: tegra: Fix DT binding for IO High Voltage entry + +From: Vidya Sagar + +[ Upstream commit 6b26c1a034885923822f6c4d94f8644d32bc2481 ] + +Fix the device-tree entry that represents I/O High Voltage property +by replacing 'nvidia,io-high-voltage' with 'nvidia,io-hv' as the former +entry is deprecated. + +Fixes: dbb72e2c305b ("arm64: tegra: Add configuration for PCIe C5 sideband signals") +Signed-off-by: Vidya Sagar +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/nvidia/tegra194.dtsi | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/nvidia/tegra194.dtsi b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +index 78f7e6e50beb0..0821754f0fd6d 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra194.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra194.dtsi +@@ -144,7 +144,7 @@ + nvidia,schmitt = ; + nvidia,lpdr = ; + nvidia,enable-input = ; +- nvidia,io-high-voltage = ; ++ nvidia,io-hv = ; + nvidia,tristate = ; + nvidia,pull = ; + }; +@@ -156,7 +156,7 @@ + nvidia,schmitt = ; + nvidia,lpdr = ; + nvidia,enable-input = ; +- nvidia,io-high-voltage = ; ++ nvidia,io-hv = ; + nvidia,tristate = ; + nvidia,pull = ; + }; +-- +2.27.0 + diff --git a/queue-5.4/asoc-amd-change-clk_get-to-devm_clk_get-and-add-miss.patch b/queue-5.4/asoc-amd-change-clk_get-to-devm_clk_get-and-add-miss.patch new file mode 100644 index 00000000000..13dcccd00f6 --- /dev/null +++ b/queue-5.4/asoc-amd-change-clk_get-to-devm_clk_get-and-add-miss.patch @@ -0,0 +1,48 @@ +From 2676055e25d8cc3386541ac520e77a0910bf6369 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 14:36:10 +0800 +Subject: ASoC: amd: change clk_get() to devm_clk_get() and add missed checks + +From: Chuhong Yuan + +[ Upstream commit 95d3befbc5e1ee39fc8a78713924cf7ed2b3cabe ] + +cz_da7219_init() does not check the return values of clk_get(), +while da7219_clk_enable() calls clk_set_rate() to dereference +the pointers. +Add checks to fix the problems. +Also, change clk_get() to devm_clk_get() to avoid data leak after +failures. + +Fixes: bb24a31ed584 ("ASoC: AMD: Configure wclk and bclk of master codec") +Signed-off-by: Chuhong Yuan +Link: https://lore.kernel.org/r/20201204063610.513556-1-hslester96@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/amd/acp-da7219-max98357a.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/amd/acp-da7219-max98357a.c b/sound/soc/amd/acp-da7219-max98357a.c +index f4ee6798154af..1612ec65aaf66 100644 +--- a/sound/soc/amd/acp-da7219-max98357a.c ++++ b/sound/soc/amd/acp-da7219-max98357a.c +@@ -73,8 +73,13 @@ static int cz_da7219_init(struct snd_soc_pcm_runtime *rtd) + return ret; + } + +- da7219_dai_wclk = clk_get(component->dev, "da7219-dai-wclk"); +- da7219_dai_bclk = clk_get(component->dev, "da7219-dai-bclk"); ++ da7219_dai_wclk = devm_clk_get(component->dev, "da7219-dai-wclk"); ++ if (IS_ERR(da7219_dai_wclk)) ++ return PTR_ERR(da7219_dai_wclk); ++ ++ da7219_dai_bclk = devm_clk_get(component->dev, "da7219-dai-bclk"); ++ if (IS_ERR(da7219_dai_bclk)) ++ return PTR_ERR(da7219_dai_bclk); + + ret = snd_soc_card_jack_new(card, "Headset Jack", + SND_JACK_HEADSET | SND_JACK_LINEOUT | +-- +2.27.0 + diff --git a/queue-5.4/asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch b/queue-5.4/asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch new file mode 100644 index 00000000000..59581882c8e --- /dev/null +++ b/queue-5.4/asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch @@ -0,0 +1,40 @@ +From ebf67687febceb7e5063b59b4734b1afad63f95c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 21:09:20 +0800 +Subject: ASoC: arizona: Fix a wrong free in wm8997_probe + +From: Zhang Qilong + +[ Upstream commit 5e7aace13df24ff72511f29c14ebbfe638ef733c ] + +In the normal path, we should not free the arizona, +we should return immediately. It will be free when +call remove operation. + +Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe") +Reported-by: Richard Fitzgerald +Signed-off-by: Zhang Qilong +Acked-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20201111130923.220186-2-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8997.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/wm8997.c b/sound/soc/codecs/wm8997.c +index 37e4bb3dbd8a9..229f2986cd96b 100644 +--- a/sound/soc/codecs/wm8997.c ++++ b/sound/soc/codecs/wm8997.c +@@ -1177,6 +1177,8 @@ static int wm8997_probe(struct platform_device *pdev) + goto err_spk_irqs; + } + ++ return ret; ++ + err_spk_irqs: + arizona_free_spk_irqs(arizona); + +-- +2.27.0 + diff --git a/queue-5.4/asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch b/queue-5.4/asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch new file mode 100644 index 00000000000..bbbfd69f9ea --- /dev/null +++ b/queue-5.4/asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch @@ -0,0 +1,44 @@ +From 15d22935756fe16322de88fba73fb684c40d7385 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 22:42:27 +0800 +Subject: ASoC: jz4740-i2s: add missed checks for clk_get() + +From: Chuhong Yuan + +[ Upstream commit 1c1fb2653a0c2e3f310c07eacd8fc3a10e08c97a ] + +jz4740_i2s_set_sysclk() does not check the return values of clk_get(), +while the file dereferences the pointers in clk_put(). +Add the missed checks to fix it. + +Fixes: 11bd3dd1b7c2 ("ASoC: Add JZ4740 ASoC support") +Signed-off-by: Chuhong Yuan +Link: https://lore.kernel.org/r/20201203144227.418194-1-hslester96@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/jz4740/jz4740-i2s.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c +index 0bbd86390be59..9bfd2aabbfe63 100644 +--- a/sound/soc/jz4740/jz4740-i2s.c ++++ b/sound/soc/jz4740/jz4740-i2s.c +@@ -309,10 +309,14 @@ static int jz4740_i2s_set_sysclk(struct snd_soc_dai *dai, int clk_id, + switch (clk_id) { + case JZ4740_I2S_CLKSRC_EXT: + parent = clk_get(NULL, "ext"); ++ if (IS_ERR(parent)) ++ return PTR_ERR(parent); + clk_set_parent(i2s->clk_i2s, parent); + break; + case JZ4740_I2S_CLKSRC_PLL: + parent = clk_get(NULL, "pll half"); ++ if (IS_ERR(parent)) ++ return PTR_ERR(parent); + clk_set_parent(i2s->clk_i2s, parent); + ret = clk_set_rate(i2s->clk_i2s, freq); + break; +-- +2.27.0 + diff --git a/queue-5.4/asoc-meson-fix-compile_test-error.patch b/queue-5.4/asoc-meson-fix-compile_test-error.patch new file mode 100644 index 00000000000..c21035a49f3 --- /dev/null +++ b/queue-5.4/asoc-meson-fix-compile_test-error.patch @@ -0,0 +1,45 @@ +From 4a20f6ae4dd08f36eca30a96a2193204776ad381 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 18:24:23 +0100 +Subject: ASoC: meson: fix COMPILE_TEST error + +From: Jerome Brunet + +[ Upstream commit 299fe9937dbd1a4d9a1da6a2b6f222298534ca57 ] + +When compiled with CONFIG_HAVE_CLK, the kernel need to get provider for the +clock API. This is usually selected by the platform and the sound drivers +should not really care about this. However COMPILE_TEST is special and the +platform required may not have been selected, leading to this type of +error: + +> aiu-encoder-spdif.c:(.text+0x3a0): undefined reference to `clk_set_parent' + +Since we need a sane provider of the API with COMPILE_TEST, depends on +COMMON_CLK. + +Fixes: 6dc4fa179fb8 ("ASoC: meson: add axg fifo base driver") +Reported-by: kernel test robot +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20201116172423.546855-1-jbrunet@baylibre.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/meson/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/meson/Kconfig b/sound/soc/meson/Kconfig +index 2e3676147ceaf..e0d24592ebd70 100644 +--- a/sound/soc/meson/Kconfig ++++ b/sound/soc/meson/Kconfig +@@ -1,6 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0-only + menu "ASoC support for Amlogic platforms" +- depends on ARCH_MESON || COMPILE_TEST ++ depends on ARCH_MESON || (COMPILE_TEST && COMMON_CLK) + + config SND_MESON_AXG_FIFO + tristate +-- +2.27.0 + diff --git a/queue-5.4/asoc-pcm-drain-support-reactivation.patch b/queue-5.4/asoc-pcm-drain-support-reactivation.patch new file mode 100644 index 00000000000..be72a286aa0 --- /dev/null +++ b/queue-5.4/asoc-pcm-drain-support-reactivation.patch @@ -0,0 +1,51 @@ +From bffd610461da991630844eac4c46664e6023d95a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 11:01:29 +0100 +Subject: ASoC: pcm: DRAIN support reactivation + +From: Cezary Rojewski + +[ Upstream commit 4c22b80f61540ea99d9b4af0127315338755f05b ] + +soc-pcm's dpcm_fe_dai_do_trigger() supported DRAIN commnad up to kernel +v5.4 where explicit switch(cmd) has been introduced which takes into +account all SNDRV_PCM_TRIGGER_xxx but SNDRV_PCM_TRIGGER_DRAIN. Update +switch statement to reactive support for it. + +As DRAIN is somewhat unique by lacking negative/stop counterpart, bring +behaviour of dpcm_fe_dai_do_trigger() for said command back to its +pre-v5.4 state by adding it to START/RESUME/PAUSE_RELEASE group. + +Fixes: acbf27746ecf ("ASoC: pcm: update FE/BE trigger order based on the command") +Signed-off-by: Cezary Rojewski +Reviewed-by: Ranjani Sridharan +Link: https://lore.kernel.org/r/20201026100129.8216-1-cezary.rojewski@intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-pcm.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index cc4e9aa80fb0d..1196167364d48 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -2346,6 +2346,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd) + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: ++ case SNDRV_PCM_TRIGGER_DRAIN: + ret = dpcm_dai_trigger_fe_be(substream, cmd, true); + break; + case SNDRV_PCM_TRIGGER_STOP: +@@ -2363,6 +2364,7 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd) + case SNDRV_PCM_TRIGGER_START: + case SNDRV_PCM_TRIGGER_RESUME: + case SNDRV_PCM_TRIGGER_PAUSE_RELEASE: ++ case SNDRV_PCM_TRIGGER_DRAIN: + ret = dpcm_dai_trigger_fe_be(substream, cmd, false); + break; + case SNDRV_PCM_TRIGGER_STOP: +-- +2.27.0 + diff --git a/queue-5.4/asoc-sun4i-i2s-fix-lrck_period-computation-for-i2s-j.patch b/queue-5.4/asoc-sun4i-i2s-fix-lrck_period-computation-for-i2s-j.patch new file mode 100644 index 00000000000..5696cc068e3 --- /dev/null +++ b/queue-5.4/asoc-sun4i-i2s-fix-lrck_period-computation-for-i2s-j.patch @@ -0,0 +1,54 @@ +From 97486782968049dc5a888ea5591f02c140cd08d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 15:46:34 +0100 +Subject: ASoC: sun4i-i2s: Fix lrck_period computation for I2S justified mode +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Clément Péron + +[ Upstream commit 93c0210671d8f3ec2262da703fab93a1497158a8 ] + +Left and Right justified mode are computed using the same formula +as DSP_A and DSP_B mode. +Which is wrong and the user manual explicitly says: + +LRCK_PERDIOD: +PCM Mode: Number of BCLKs within (Left + Right) channel width. +I2S/Left-Justified/Right-Justified Mode: Number of BCLKs within each +individual channel width(Left or Right) + +Fix this by using the same formula as the I2S mode. + +Fixes: 7ae7834ec446 ("ASoC: sun4i-i2s: Add support for DSP formats") +Signed-off-by: Clément Péron +Acked-by: Maxime Ripard +Link: https://lore.kernel.org/r/20201030144648.397824-2-peron.clem@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sunxi/sun4i-i2s.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c +index d0a8d5810c0a5..9655dec4166b6 100644 +--- a/sound/soc/sunxi/sun4i-i2s.c ++++ b/sound/soc/sunxi/sun4i-i2s.c +@@ -442,11 +442,11 @@ static int sun8i_i2s_set_chan_cfg(const struct sun4i_i2s *i2s, + switch (i2s->format & SND_SOC_DAIFMT_FORMAT_MASK) { + case SND_SOC_DAIFMT_DSP_A: + case SND_SOC_DAIFMT_DSP_B: +- case SND_SOC_DAIFMT_LEFT_J: +- case SND_SOC_DAIFMT_RIGHT_J: + lrck_period = params_physical_width(params) * slots; + break; + ++ case SND_SOC_DAIFMT_LEFT_J: ++ case SND_SOC_DAIFMT_RIGHT_J: + case SND_SOC_DAIFMT_I2S: + lrck_period = params_physical_width(params); + break; +-- +2.27.0 + diff --git a/queue-5.4/asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch b/queue-5.4/asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch new file mode 100644 index 00000000000..691e39e8dd8 --- /dev/null +++ b/queue-5.4/asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch @@ -0,0 +1,48 @@ +From 953e5c969d13394bfba5228574d9810bae2a54e8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 12:13:26 +0800 +Subject: ASoC: wm8998: Fix PM disable depth imbalance on error + +From: Zhang Qilong + +[ Upstream commit 193aa0a043645220d2a2f783ba06ae13d4601078 ] + +The pm_runtime_enable will increase power disable depth. Thus +a pairing decrement is needed on the error handling path to +keep it balanced according to context. + +Fixes: 31833ead95c2c ("ASoC: arizona: Move request of speaker IRQs into bus probe") +Signed-off-by: Zhang Qilong +Reviewed-by: Richard Fitzgerald +Link: https://lore.kernel.org/r/20201111041326.1257558-4-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8998.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wm8998.c b/sound/soc/codecs/wm8998.c +index 7c18992195733..817ccddd63448 100644 +--- a/sound/soc/codecs/wm8998.c ++++ b/sound/soc/codecs/wm8998.c +@@ -1375,7 +1375,7 @@ static int wm8998_probe(struct platform_device *pdev) + + ret = arizona_init_spk_irqs(arizona); + if (ret < 0) +- return ret; ++ goto err_pm_disable; + + ret = devm_snd_soc_register_component(&pdev->dev, + &soc_component_dev_wm8998, +@@ -1390,6 +1390,8 @@ static int wm8998_probe(struct platform_device *pdev) + + err_spk_irqs: + arizona_free_spk_irqs(arizona); ++err_pm_disable: ++ pm_runtime_disable(&pdev->dev); + + return ret; + } +-- +2.27.0 + diff --git a/queue-5.4/asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch b/queue-5.4/asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch new file mode 100644 index 00000000000..039ae591a31 --- /dev/null +++ b/queue-5.4/asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch @@ -0,0 +1,50 @@ +From ff7b771c93cbea2fff5ce31354bab1c92f54f013 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 09:54:09 +0300 +Subject: ASoC: wm_adsp: remove "ctl" from list on error in + wm_adsp_create_control() + +From: Dan Carpenter + +[ Upstream commit 85a7555575a0e48f9b73db310d0d762a08a46d63 ] + +The error handling frees "ctl" but it's still on the "dsp->ctl_list" +list so that could result in a use after free. Remove it from the list +before returning. + +Fixes: 2323736dca72 ("ASoC: wm_adsp: Add basic support for rev 1 firmware file format") +Signed-off-by: Dan Carpenter +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/X9B0keV/02wrx9Xs@mwanda +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm_adsp.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index 4c56b782500db..13672928da997 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -1496,7 +1496,7 @@ static int wm_adsp_create_control(struct wm_adsp *dsp, + ctl_work = kzalloc(sizeof(*ctl_work), GFP_KERNEL); + if (!ctl_work) { + ret = -ENOMEM; +- goto err_ctl_cache; ++ goto err_list_del; + } + + ctl_work->dsp = dsp; +@@ -1506,7 +1506,8 @@ static int wm_adsp_create_control(struct wm_adsp *dsp, + + return 0; + +-err_ctl_cache: ++err_list_del: ++ list_del(&ctl->list); + kfree(ctl->cache); + err_ctl_name: + kfree(ctl->name); +-- +2.27.0 + diff --git a/queue-5.4/ath10k-fix-an-error-handling-path.patch b/queue-5.4/ath10k-fix-an-error-handling-path.patch new file mode 100644 index 00000000000..0f21f864fbe --- /dev/null +++ b/queue-5.4/ath10k-fix-an-error-handling-path.patch @@ -0,0 +1,37 @@ +From 9bb3aacc4e809eab391ad3a0a142b8487e1e6300 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 17:59:18 +0200 +Subject: ath10k: Fix an error handling path + +From: Christophe JAILLET + +[ Upstream commit ed3573bc3943c27d2d8e405a242f87ed14572ca1 ] + +If 'ath10k_usb_create()' fails, we should release some resources and report +an error instead of silently continuing. + +Fixes: 4db66499df91 ("ath10k: add initial USB support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201122170342.1346011-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/usb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c +index 1e0343081be91..3f3675aa782fb 100644 +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -1009,6 +1009,8 @@ static int ath10k_usb_probe(struct usb_interface *interface, + + ar_usb = ath10k_usb_priv(ar); + ret = ath10k_usb_create(ar, interface); ++ if (ret) ++ goto err; + ar_usb->ar = ar; + + ar->dev_id = product_id; +-- +2.27.0 + diff --git a/queue-5.4/ath10k-fix-the-parsing-error-in-service-available-ev.patch b/queue-5.4/ath10k-fix-the-parsing-error-in-service-available-ev.patch new file mode 100644 index 00000000000..0647818397a --- /dev/null +++ b/queue-5.4/ath10k-fix-the-parsing-error-in-service-available-ev.patch @@ -0,0 +1,92 @@ +From d067b41311fae36b8dffc9c03f0a2723b255a805 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 17:59:17 +0200 +Subject: ath10k: Fix the parsing error in service available event + +From: Rakesh Pillai + +[ Upstream commit c7cee9c0f499f27ec6de06bea664b61320534768 ] + +The wmi service available event has been +extended to contain extra 128 bit for new services +to be indicated by firmware. + +Currently the presence of any optional TLVs in +the wmi service available event leads to a parsing +error with the below error message: +ath10k_snoc 18800000.wifi: failed to parse svc_avail tlv: -71 + +The wmi service available event parsing should +not return error for the newly added optional TLV. +Fix this parsing for service available event message. + +Tested-on: WCN3990 hw1.0 SNOC WLAN.HL.3.2.2-00720-QCAHLSWMTPL-1 + +Fixes: cea19a6ce8bf ("ath10k: add WMI_SERVICE_AVAILABLE_EVENT support") +Signed-off-by: Rakesh Pillai +Reviewed-by: Douglas Anderson +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1605501291-23040-1-git-send-email-pillair@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wmi-tlv.c | 4 +++- + drivers/net/wireless/ath/ath10k/wmi.c | 9 +++++++-- + drivers/net/wireless/ath/ath10k/wmi.h | 1 + + 3 files changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +index 9d5b9df29c352..3ec71f52e8fe1 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c ++++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c +@@ -1260,13 +1260,15 @@ static int ath10k_wmi_tlv_svc_avail_parse(struct ath10k *ar, u16 tag, u16 len, + + switch (tag) { + case WMI_TLV_TAG_STRUCT_SERVICE_AVAILABLE_EVENT: ++ arg->service_map_ext_valid = true; + arg->service_map_ext_len = *(__le32 *)ptr; + arg->service_map_ext = ptr + sizeof(__le32); + return 0; + default: + break; + } +- return -EPROTO; ++ ++ return 0; + } + + static int ath10k_wmi_tlv_op_pull_svc_avail(struct ath10k *ar, +diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c +index 2675174cc4fec..91604a14a8f46 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.c ++++ b/drivers/net/wireless/ath/ath10k/wmi.c +@@ -5659,8 +5659,13 @@ void ath10k_wmi_event_service_available(struct ath10k *ar, struct sk_buff *skb) + ret); + } + +- ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map, +- __le32_to_cpu(arg.service_map_ext_len)); ++ /* ++ * Initialization of "arg.service_map_ext_valid" to ZERO is necessary ++ * for the below logic to work. ++ */ ++ if (arg.service_map_ext_valid) ++ ath10k_wmi_map_svc_ext(ar, arg.service_map_ext, ar->wmi.svc_map, ++ __le32_to_cpu(arg.service_map_ext_len)); + } + + static int ath10k_wmi_event_temperature(struct ath10k *ar, struct sk_buff *skb) +diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h +index e80dbe7e8f4cf..761bc4a7064df 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -6857,6 +6857,7 @@ struct wmi_svc_rdy_ev_arg { + }; + + struct wmi_svc_avail_ev_arg { ++ bool service_map_ext_valid; + __le32 service_map_ext_len; + const __le32 *service_map_ext; + }; +-- +2.27.0 + diff --git a/queue-5.4/ath10k-release-some-resources-in-an-error-handling-p.patch b/queue-5.4/ath10k-release-some-resources-in-an-error-handling-p.patch new file mode 100644 index 00000000000..cf16b493fc6 --- /dev/null +++ b/queue-5.4/ath10k-release-some-resources-in-an-error-handling-p.patch @@ -0,0 +1,47 @@ +From 09c9e00a89fa0e6523937a0cb6d6ee52029456a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 17:59:18 +0200 +Subject: ath10k: Release some resources in an error handling path + +From: Christophe JAILLET + +[ Upstream commit 6364e693f4a7a89a2fb3dd2cbd6cc06d5fd6e26d ] + +Should an error occur after calling 'ath10k_usb_create()', it should be +undone by a corresponding 'ath10k_usb_destroy()' call + +Fixes: 4db66499df91 ("ath10k: add initial USB support") +Signed-off-by: Christophe JAILLET +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201122170358.1346065-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/usb.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c +index 3f3675aa782fb..05c0d5e92475e 100644 +--- a/drivers/net/wireless/ath/ath10k/usb.c ++++ b/drivers/net/wireless/ath/ath10k/usb.c +@@ -1023,7 +1023,7 @@ static int ath10k_usb_probe(struct usb_interface *interface, + ret = ath10k_core_register(ar, &bus_params); + if (ret) { + ath10k_warn(ar, "failed to register driver core: %d\n", ret); +- goto err; ++ goto err_usb_destroy; + } + + /* TODO: remove this once USB support is fully implemented */ +@@ -1031,6 +1031,9 @@ static int ath10k_usb_probe(struct usb_interface *interface, + + return 0; + ++err_usb_destroy: ++ ath10k_usb_destroy(ar); ++ + err: + ath10k_core_destroy(ar); + +-- +2.27.0 + diff --git a/queue-5.4/bluetooth-btmtksdio-add-the-missed-release_firmware-.patch b/queue-5.4/bluetooth-btmtksdio-add-the-missed-release_firmware-.patch new file mode 100644 index 00000000000..47ad1882d81 --- /dev/null +++ b/queue-5.4/bluetooth-btmtksdio-add-the-missed-release_firmware-.patch @@ -0,0 +1,38 @@ +From 7b6a018eb53ba76f44964d676b6af75bf0fa0a0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 10:43:32 +0800 +Subject: Bluetooth: btmtksdio: Add the missed release_firmware() in + mtk_setup_firmware() + +From: Jing Xiangfeng + +[ Upstream commit b73b5781a85c03113476f62346c390f0277baa4b ] + +mtk_setup_firmware() misses to call release_firmware() in an error +path. Jump to free_fw to fix it. + +Fixes: 737cd06072a7 ("Bluetooth: btmtksdio: fix up firmware download sequence") +Signed-off-by: Jing Xiangfeng +Signed-off-by: Marcel Holtmann +Signed-off-by: Johan Hedberg +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtksdio.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index b7de7cb8cca90..304178be1ef40 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -703,7 +703,7 @@ static int mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) + err = mtk_hci_wmt_sync(hdev, &wmt_params); + if (err < 0) { + bt_dev_err(hdev, "Failed to power on data RAM (%d)", err); +- return err; ++ goto free_fw; + } + + fw_ptr = fw->data; +-- +2.27.0 + diff --git a/queue-5.4/bluetooth-btusb-add-the-missed-release_firmware-in-b.patch b/queue-5.4/bluetooth-btusb-add-the-missed-release_firmware-in-b.patch new file mode 100644 index 00000000000..512ed05d932 --- /dev/null +++ b/queue-5.4/bluetooth-btusb-add-the-missed-release_firmware-in-b.patch @@ -0,0 +1,38 @@ +From 4e80b93fe316c10b1ed7403aafea6615b59654f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 10:59:17 +0800 +Subject: Bluetooth: btusb: Add the missed release_firmware() in + btusb_mtk_setup_firmware() + +From: Jing Xiangfeng + +[ Upstream commit d1e9d232e1e60fa63df1b836ec3ecba5abd3fa9d ] + +btusb_mtk_setup_firmware() misses to call release_firmware() in an error +path. Jump to err_release_fw to fix it. + +Fixes: f645125711c8 ("Bluetooth: btusb: fix up firmware download sequence") +Signed-off-by: Jing Xiangfeng +Signed-off-by: Marcel Holtmann +Signed-off-by: Johan Hedberg +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btusb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index b326eeddaadf0..b92bd97b1c399 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -2812,7 +2812,7 @@ static int btusb_mtk_setup_firmware(struct hci_dev *hdev, const char *fwname) + err = btusb_mtk_hci_wmt_sync(hdev, &wmt_params); + if (err < 0) { + bt_dev_err(hdev, "Failed to power on data RAM (%d)", err); +- return err; ++ goto err_release_fw; + } + + fw_ptr = fw->data; +-- +2.27.0 + diff --git a/queue-5.4/bluetooth-fix-null-pointer-dereference-in-hci_event_.patch b/queue-5.4/bluetooth-fix-null-pointer-dereference-in-hci_event_.patch new file mode 100644 index 00000000000..ce4e3673dee --- /dev/null +++ b/queue-5.4/bluetooth-fix-null-pointer-dereference-in-hci_event_.patch @@ -0,0 +1,49 @@ +From c37c82c1e6d4e59bb16bafd39832d0b04b10a6d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 30 Sep 2020 19:48:13 +0530 +Subject: Bluetooth: Fix null pointer dereference in hci_event_packet() + +From: Anmol Karn + +[ Upstream commit 6dfccd13db2ff2b709ef60a50163925d477549aa ] + +AMP_MGR is getting derefernced in hci_phy_link_complete_evt(), when called +from hci_event_packet() and there is a possibility, that hcon->amp_mgr may +not be found when accessing after initialization of hcon. + +- net/bluetooth/hci_event.c:4945 +The bug seems to get triggered in this line: + +bredr_hcon = hcon->amp_mgr->l2cap_conn->hcon; + +Fix it by adding a NULL check for the hcon->amp_mgr before checking the ev-status. + +Fixes: d5e911928bd8 ("Bluetooth: AMP: Process Physical Link Complete evt") +Reported-and-tested-by: syzbot+0bef568258653cff272f@syzkaller.appspotmail.com +Link: https://syzkaller.appspot.com/bug?extid=0bef568258653cff272f +Signed-off-by: Anmol Karn +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_event.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index ada778bbbec97..0a88645f103f0 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4791,6 +4791,11 @@ static void hci_phy_link_complete_evt(struct hci_dev *hdev, + return; + } + ++ if (!hcon->amp_mgr) { ++ hci_dev_unlock(hdev); ++ return; ++ } ++ + if (ev->status) { + hci_conn_del(hcon); + hci_dev_unlock(hdev); +-- +2.27.0 + diff --git a/queue-5.4/bluetooth-hci_h5-fix-memory-leak-in-h5_close.patch b/queue-5.4/bluetooth-hci_h5-fix-memory-leak-in-h5_close.patch new file mode 100644 index 00000000000..46d80e5f8cb --- /dev/null +++ b/queue-5.4/bluetooth-hci_h5-fix-memory-leak-in-h5_close.patch @@ -0,0 +1,42 @@ +From 14358dfd9a29554a7fc56497bd4d73ed3c760a22 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Oct 2020 18:44:47 +0530 +Subject: Bluetooth: hci_h5: fix memory leak in h5_close + +From: Anant Thazhemadam + +[ Upstream commit 855af2d74c870d747bf53509f8b2d7b9dc9ee2c3 ] + +When h5_close() is called, h5 is directly freed when !hu->serdev. +However, h5->rx_skb is not freed, which causes a memory leak. + +Freeing h5->rx_skb and setting it to NULL, fixes this memory leak. + +Fixes: ce945552fde4 ("Bluetooth: hci_h5: Add support for serdev enumerated devices") +Reported-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com +Tested-by: syzbot+6ce141c55b2f7aafd1c4@syzkaller.appspotmail.com +Signed-off-by: Anant Thazhemadam +Reviewed-by: Hans de Goede +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_h5.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c +index 5df0651b6cd55..e11af747395dd 100644 +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -244,6 +244,9 @@ static int h5_close(struct hci_uart *hu) + skb_queue_purge(&h5->rel); + skb_queue_purge(&h5->unrel); + ++ kfree_skb(h5->rx_skb); ++ h5->rx_skb = NULL; ++ + if (h5->vnd && h5->vnd->close) + h5->vnd->close(h5); + +-- +2.27.0 + diff --git a/queue-5.4/bpf-fix-bpf_put_raw_tracepoint-s-use-of-__module_add.patch b/queue-5.4/bpf-fix-bpf_put_raw_tracepoint-s-use-of-__module_add.patch new file mode 100644 index 00000000000..5118fee8031 --- /dev/null +++ b/queue-5.4/bpf-fix-bpf_put_raw_tracepoint-s-use-of-__module_add.patch @@ -0,0 +1,47 @@ +From 1b765f42c201ca1e2e6ad0d25b171b7b5bf6fad7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 12:46:21 -0800 +Subject: bpf: Fix bpf_put_raw_tracepoint()'s use of __module_address() + +From: Andrii Nakryiko + +[ Upstream commit 12cc126df82c96c89706aa207ad27c56f219047c ] + +__module_address() needs to be called with preemption disabled or with +module_mutex taken. preempt_disable() is enough for read-only uses, which is +what this fix does. Also, module_put() does internal check for NULL, so drop +it as well. + +Fixes: a38d1107f937 ("bpf: support raw tracepoints in modules") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Acked-by: Martin KaFai Lau +Link: https://lore.kernel.org/bpf/20201203204634.1325171-2-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/trace/bpf_trace.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c +index 2372b861f2cfa..74c1db7178cff 100644 +--- a/kernel/trace/bpf_trace.c ++++ b/kernel/trace/bpf_trace.c +@@ -1320,10 +1320,12 @@ struct bpf_raw_event_map *bpf_get_raw_tracepoint(const char *name) + + void bpf_put_raw_tracepoint(struct bpf_raw_event_map *btp) + { +- struct module *mod = __module_address((unsigned long)btp); ++ struct module *mod; + +- if (mod) +- module_put(mod); ++ preempt_disable(); ++ mod = __module_address((unsigned long)btp); ++ module_put(mod); ++ preempt_enable(); + } + + static __always_inline +-- +2.27.0 + diff --git a/queue-5.4/brcmfmac-fix-memory-leak-for-unpaired-brcmf_-alloc-f.patch b/queue-5.4/brcmfmac-fix-memory-leak-for-unpaired-brcmf_-alloc-f.patch new file mode 100644 index 00000000000..e5f8519dfa0 --- /dev/null +++ b/queue-5.4/brcmfmac-fix-memory-leak-for-unpaired-brcmf_-alloc-f.patch @@ -0,0 +1,64 @@ +From 5b53d94d1a430cb4dab200e3f31b626b7ab4165a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 10:52:47 +0900 +Subject: brcmfmac: Fix memory leak for unpaired brcmf_{alloc/free} + +From: Seung-Woo Kim + +[ Upstream commit 9db946284e07bb27309dd546b7fee528664ba82a ] + +There are missig brcmf_free() for brcmf_alloc(). Fix memory leak +by adding missed brcmf_free(). + +Reported-by: Jaehoon Chung +Fixes: a1f5aac1765a ("brcmfmac: don't realloc wiphy during PCIe reset") +Signed-off-by: Seung-Woo Kim +Reviewed-by: Arend van Spriel +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1603849967-22817-1-git-send-email-sw0312.kim@samsung.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 6 ++++-- + drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 + + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index 3be60aef54650..cb68f54a9c56e 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -1936,16 +1936,18 @@ brcmf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id) + fwreq = brcmf_pcie_prepare_fw_request(devinfo); + if (!fwreq) { + ret = -ENOMEM; +- goto fail_bus; ++ goto fail_brcmf; + } + + ret = brcmf_fw_get_firmwares(bus->dev, fwreq, brcmf_pcie_setup); + if (ret < 0) { + kfree(fwreq); +- goto fail_bus; ++ goto fail_brcmf; + } + return 0; + ++fail_brcmf: ++ brcmf_free(&devinfo->pdev->dev); + fail_bus: + kfree(bus->msgbuf); + kfree(bus); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +index 38e6809f16c75..ef5521b9b3577 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c +@@ -4433,6 +4433,7 @@ void brcmf_sdio_remove(struct brcmf_sdio *bus) + brcmf_sdiod_intr_unregister(bus->sdiodev); + + brcmf_detach(bus->sdiodev->dev); ++ brcmf_free(bus->sdiodev->dev); + + cancel_work_sync(&bus->datawork); + if (bus->brcmf_wq) +-- +2.27.0 + diff --git a/queue-5.4/bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch b/queue-5.4/bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch new file mode 100644 index 00000000000..150cd67a5d7 --- /dev/null +++ b/queue-5.4/bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch @@ -0,0 +1,42 @@ +From 699b006bb69e6a0a1fc39bee3eb18a7bb82d62d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 16:02:47 +0800 +Subject: bus: fsl-mc: fix error return code in fsl_mc_object_allocate() + +From: Zhang Changzhong + +[ Upstream commit 3d70fb03711c37bc64e8e9aea5830f498835f6bf ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 197f4d6a4a00 ("staging: fsl-mc: fsl-mc object allocator driver") +Reported-by: Hulk Robot +Acked-by: Laurentiu Tudor +Signed-off-by: Zhang Changzhong +Link: https://lore.kernel.org/r/1607068967-31991-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/bus/fsl-mc/fsl-mc-allocator.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/bus/fsl-mc/fsl-mc-allocator.c b/drivers/bus/fsl-mc/fsl-mc-allocator.c +index cc7bb900f5249..95672306d3714 100644 +--- a/drivers/bus/fsl-mc/fsl-mc-allocator.c ++++ b/drivers/bus/fsl-mc/fsl-mc-allocator.c +@@ -292,8 +292,10 @@ int __must_check fsl_mc_object_allocate(struct fsl_mc_device *mc_dev, + goto error; + + mc_adev = resource->data; +- if (!mc_adev) ++ if (!mc_adev) { ++ error = -EINVAL; + goto error; ++ } + + mc_adev->consumer_link = device_link_add(&mc_dev->dev, + &mc_adev->dev, +-- +2.27.0 + diff --git a/queue-5.4/can-m_can-m_can_config_endisable-remove-double-clear.patch b/queue-5.4/can-m_can-m_can_config_endisable-remove-double-clear.patch new file mode 100644 index 00000000000..6078dcde89d --- /dev/null +++ b/queue-5.4/can-m_can-m_can_config_endisable-remove-double-clear.patch @@ -0,0 +1,45 @@ +From 034e4c86d69aea921b985409e015a45dce70567f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Dec 2019 07:32:27 +0100 +Subject: can: m_can: m_can_config_endisable(): remove double clearing of clock + stop request bit + +From: Sean Nyekjaer + +[ Upstream commit c9f4cad6cdfe350ce2637e57f7f2aa7ff326bcc6 ] + +The CSR bit is already cleared when arriving here so remove this section of +duplicate code. + +The registers set in m_can_config_endisable() is set to same exact values as +before this patch. + +Signed-off-by: Sean Nyekjaer +Acked-by: Sriram Dash +Acked-by: Dan Murphy +Link: https://lore.kernel.org/r/20191211063227.84259-1-sean@geanix.com +Fixes: f524f829b75a ("can: m_can: Create a m_can platform framework") +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/m_can/m_can.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index c84114b44ee07..d2bb9a87eff9a 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -379,10 +379,6 @@ void m_can_config_endisable(struct m_can_classdev *cdev, bool enable) + cccr &= ~CCCR_CSR; + + if (enable) { +- /* Clear the Clock stop request if it was set */ +- if (cccr & CCCR_CSR) +- cccr &= ~CCCR_CSR; +- + /* enable m_can configuration */ + m_can_write(cdev, M_CAN_CCCR, cccr | CCCR_INIT); + udelay(5); +-- +2.27.0 + diff --git a/queue-5.4/cfg80211-initialize-rekey_data.patch b/queue-5.4/cfg80211-initialize-rekey_data.patch new file mode 100644 index 00000000000..831e2c87a01 --- /dev/null +++ b/queue-5.4/cfg80211-initialize-rekey_data.patch @@ -0,0 +1,36 @@ +From 3edec39e052563cf3a7546579e9c7f8468f23a6c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Nov 2020 17:30:44 +0200 +Subject: cfg80211: initialize rekey_data + +From: Sara Sharon + +[ Upstream commit f495acd8851d7b345e5f0e521b2645b1e1f928a0 ] + +In case we have old supplicant, the akm field is uninitialized. + +Signed-off-by: Sara Sharon +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20201129172929.930f0ab7ebee.Ic546e384efab3f4a89f318eafddc3eb7d556aecb@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/nl80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index dbac5c0995a0f..5bb2316befb98 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -12033,7 +12033,7 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) + struct net_device *dev = info->user_ptr[1]; + struct wireless_dev *wdev = dev->ieee80211_ptr; + struct nlattr *tb[NUM_NL80211_REKEY_DATA]; +- struct cfg80211_gtk_rekey_data rekey_data; ++ struct cfg80211_gtk_rekey_data rekey_data = {}; + int err; + + if (!info->attrs[NL80211_ATTR_REKEY_DATA]) +-- +2.27.0 + diff --git a/queue-5.4/checkpatch-fix-unescaped-left-brace.patch b/queue-5.4/checkpatch-fix-unescaped-left-brace.patch new file mode 100644 index 00000000000..052f4358e11 --- /dev/null +++ b/queue-5.4/checkpatch-fix-unescaped-left-brace.patch @@ -0,0 +1,42 @@ +From 1b476327ad21506fd7456139c107854b1ee84588 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Dec 2020 20:45:02 -0800 +Subject: checkpatch: fix unescaped left brace + +From: Dwaipayan Ray + +[ Upstream commit 03f4935135b9efeb780b970ba023c201f81cf4e6 ] + +There is an unescaped left brace in a regex in OPEN_BRACE check. This +throws a runtime error when checkpatch is run with --fix flag and the +OPEN_BRACE check is executed. + +Fix it by escaping the left brace. + +Link: https://lkml.kernel.org/r/20201115202928.81955-1-dwaipayanray1@gmail.com +Fixes: 8d1824780f2f ("checkpatch: add --fix option for a couple OPEN_BRACE misuses") +Signed-off-by: Dwaipayan Ray +Acked-by: Joe Perches +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/checkpatch.pl | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl +index 0c9b114202796..a358af93cd7fc 100755 +--- a/scripts/checkpatch.pl ++++ b/scripts/checkpatch.pl +@@ -4150,7 +4150,7 @@ sub process { + $fix) { + fix_delete_line($fixlinenr, $rawline); + my $fixed_line = $rawline; +- $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*){(.*)$/; ++ $fixed_line =~ /(^..*$Type\s*$Ident\(.*\)\s*)\{(.*)$/; + my $line1 = $1; + my $line2 = $2; + fix_insert_line($fixlinenr, ltrim($line1)); +-- +2.27.0 + diff --git a/queue-5.4/clk-at91-sam9x60-remove-atmel-osc-bypass-support.patch b/queue-5.4/clk-at91-sam9x60-remove-atmel-osc-bypass-support.patch new file mode 100644 index 00000000000..140a5393799 --- /dev/null +++ b/queue-5.4/clk-at91-sam9x60-remove-atmel-osc-bypass-support.patch @@ -0,0 +1,51 @@ +From 3c5b36d9978f018fccd519ac21e6399e82c9a85b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 13:58:15 +0100 +Subject: clk: at91: sam9x60: remove atmel,osc-bypass support + +From: Alexandre Belloni + +[ Upstream commit 01324f9e88b5cfc1f4c26eef66bdcb52596c9af8 ] + +The sam9x60 doesn't have the MOSCXTBY bit to enable the crystal oscillator +bypass. + +Fixes: 01e2113de9a5 ("clk: at91: add sam9x60 pmc driver") +Reported-by: Claudiu Beznea +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20201202125816.168618-1-alexandre.belloni@bootlin.com +Reviewed-by: Claudiu Beznea +Tested-by: Claudiu Beznea +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/sam9x60.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/drivers/clk/at91/sam9x60.c b/drivers/clk/at91/sam9x60.c +index 7338a3bc71eb1..e3f4c8f20223a 100644 +--- a/drivers/clk/at91/sam9x60.c ++++ b/drivers/clk/at91/sam9x60.c +@@ -162,7 +162,6 @@ static void __init sam9x60_pmc_setup(struct device_node *np) + struct regmap *regmap; + struct clk_hw *hw; + int i; +- bool bypass; + + i = of_property_match_string(np, "clock-names", "td_slck"); + if (i < 0) +@@ -197,10 +196,7 @@ static void __init sam9x60_pmc_setup(struct device_node *np) + if (IS_ERR(hw)) + goto err_free; + +- bypass = of_property_read_bool(np, "atmel,osc-bypass"); +- +- hw = at91_clk_register_main_osc(regmap, "main_osc", mainxtal_name, +- bypass); ++ hw = at91_clk_register_main_osc(regmap, "main_osc", mainxtal_name, 0); + if (IS_ERR(hw)) + goto err_free; + +-- +2.27.0 + diff --git a/queue-5.4/clk-meson-kconfig-fix-dependency-for-g12a.patch b/queue-5.4/clk-meson-kconfig-fix-dependency-for-g12a.patch new file mode 100644 index 00000000000..0c12e1afd10 --- /dev/null +++ b/queue-5.4/clk-meson-kconfig-fix-dependency-for-g12a.patch @@ -0,0 +1,38 @@ +From e45683177cf88eac711976bc0941f7476f6f71ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 11:09:30 -0800 +Subject: clk: meson: Kconfig: fix dependency for G12A + +From: Kevin Hilman + +[ Upstream commit bae69bfa3a586493469078ec4ca35499b754ba5c ] + +When building only G12A, ensure that VID_PLL_DIV clock driver is +selected, otherwise results in this build error: + +ERROR: modpost: "meson_vid_pll_div_ro_ops" [drivers/clk/meson/g12a.ko] undefined! + +Fixes: 085a4ea93d54 ("clk: meson: g12a: add peripheral clock controller") +Signed-off-by: Kevin Hilman +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20201118190930.34352-1-khilman@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/clk/meson/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/meson/Kconfig b/drivers/clk/meson/Kconfig +index dabeb435d0678..3f8dcdcdde499 100644 +--- a/drivers/clk/meson/Kconfig ++++ b/drivers/clk/meson/Kconfig +@@ -103,6 +103,7 @@ config COMMON_CLK_G12A + select COMMON_CLK_MESON_AO_CLKC + select COMMON_CLK_MESON_EE_CLKC + select COMMON_CLK_MESON_CPU_DYNDIV ++ select COMMON_CLK_MESON_VID_PLL_DIV + select MFD_SYSCON + help + Support for the clock controller on Amlogic S905D2, S905X2 and S905Y2 +-- +2.27.0 + diff --git a/queue-5.4/clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch b/queue-5.4/clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch new file mode 100644 index 00000000000..522077a8cdb --- /dev/null +++ b/queue-5.4/clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch @@ -0,0 +1,41 @@ +From fa2da8e6ab302523769c91a869a39254c79107f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 13:28:18 +0100 +Subject: clk: s2mps11: Fix a resource leak in error handling paths in the + probe function + +From: Christophe JAILLET + +[ Upstream commit d2d94fc567624f96187e8b52083795620f93e69f ] + +Some resource should be released in the error handling path of the probe +function, as already done in the remove function. + +The remove function was fixed in commit bf416bd45738 ("clk: s2mps11: Add +missing of_node_put and of_clk_del_provider") + +Fixes: 7cc560dea415 ("clk: s2mps11: Add support for s2mps11") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20201212122818.86195-1-christophe.jaillet@wanadoo.fr +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-s2mps11.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c +index 2ce370c804aae..f19994ce7ca15 100644 +--- a/drivers/clk/clk-s2mps11.c ++++ b/drivers/clk/clk-s2mps11.c +@@ -195,6 +195,7 @@ static int s2mps11_clk_probe(struct platform_device *pdev) + return ret; + + err_reg: ++ of_node_put(s2mps11_clks[0].clk_np); + while (--i >= 0) + clkdev_drop(s2mps11_clks[i].lookup); + +-- +2.27.0 + diff --git a/queue-5.4/clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch b/queue-5.4/clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch new file mode 100644 index 00000000000..8397f5af5db --- /dev/null +++ b/queue-5.4/clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch @@ -0,0 +1,54 @@ +From efc3639d10ea5a74dc1dd2b0df37ce5bf39f2037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 21:38:17 +0100 +Subject: clk: sunxi-ng: Make sure divider tables have sentinel + +From: Jernej Skrabec + +[ Upstream commit 48f68de00c1405351fa0e7bc44bca067c49cd0a3 ] + +Two clock divider tables are missing sentinel at the end. Effect of that +is that clock framework reads past the last entry. Fix that with adding +sentinel at the end. + +Issue was discovered with KASan. + +Fixes: 0577e4853bfb ("clk: sunxi-ng: Add H3 clocks") +Fixes: c6a0637460c2 ("clk: sunxi-ng: Add A64 clocks") +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20201202203817.438713-1-jernej.skrabec@siol.net +Acked-by: Maxime Ripard +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi-ng/ccu-sun50i-a64.c | 1 + + drivers/clk/sunxi-ng/ccu-sun8i-h3.c | 1 + + 2 files changed, 2 insertions(+) + +diff --git a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +index 5f66bf8797723..149cfde817cba 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun50i-a64.c ++++ b/drivers/clk/sunxi-ng/ccu-sun50i-a64.c +@@ -389,6 +389,7 @@ static struct clk_div_table ths_div_table[] = { + { .val = 1, .div = 2 }, + { .val = 2, .div = 4 }, + { .val = 3, .div = 6 }, ++ { /* Sentinel */ }, + }; + static const char * const ths_parents[] = { "osc24M" }; + static struct ccu_div ths_clk = { +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +index 6b636362379ee..7e629a4493afd 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-h3.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-h3.c +@@ -322,6 +322,7 @@ static struct clk_div_table ths_div_table[] = { + { .val = 1, .div = 2 }, + { .val = 2, .div = 4 }, + { .val = 3, .div = 6 }, ++ { /* Sentinel */ }, + }; + static SUNXI_CCU_DIV_TABLE_WITH_GATE(ths_clk, "ths", "osc24M", + 0x074, 0, 2, ths_div_table, BIT(31), 0); +-- +2.27.0 + diff --git a/queue-5.4/clk-tegra-fix-duplicated-se-clock-entry.patch b/queue-5.4/clk-tegra-fix-duplicated-se-clock-entry.patch new file mode 100644 index 00000000000..526bac46e64 --- /dev/null +++ b/queue-5.4/clk-tegra-fix-duplicated-se-clock-entry.patch @@ -0,0 +1,55 @@ +From 74e78662fb2d08e8b952b742c3ddeb180bad43ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 01:42:12 +0300 +Subject: clk: tegra: Fix duplicated SE clock entry + +From: Dmitry Osipenko + +[ Upstream commit 5bf5861d6ea6c3f4b38fc8fda2062b2dc44ac63d ] + +The periph_clks[] array contains duplicated entry for Security Engine +clock which was meant to be defined for T210, but it wasn't added +properly. This patch corrects the T210 SE entry and fixes the following +error message on T114/T124: "Tegra clk 127: register failed with -17". + +Fixes: dc37fec48314 ("clk: tegra: periph: Add new periph clks and muxes for Tegra210") +Tested-by Nicolas Chauvet +Reported-by Nicolas Chauvet +Signed-off-by: Dmitry Osipenko +Link: https://lore.kernel.org/r/20201025224212.7790-1-digetx@gmail.com +Acked-by: Thierry Reding +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-id.h | 1 + + drivers/clk/tegra/clk-tegra-periph.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/tegra/clk-id.h b/drivers/clk/tegra/clk-id.h +index de466b4446da9..0efcb200dde5a 100644 +--- a/drivers/clk/tegra/clk-id.h ++++ b/drivers/clk/tegra/clk-id.h +@@ -233,6 +233,7 @@ enum clk_id { + tegra_clk_sdmmc4, + tegra_clk_sdmmc4_8, + tegra_clk_se, ++ tegra_clk_se_10, + tegra_clk_soc_therm, + tegra_clk_soc_therm_8, + tegra_clk_sor0, +diff --git a/drivers/clk/tegra/clk-tegra-periph.c b/drivers/clk/tegra/clk-tegra-periph.c +index 49b9f2f85bad6..4dc11e1e61ba8 100644 +--- a/drivers/clk/tegra/clk-tegra-periph.c ++++ b/drivers/clk/tegra/clk-tegra-periph.c +@@ -636,7 +636,7 @@ static struct tegra_periph_init_data periph_clks[] = { + INT8("host1x", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_8), + INT8("host1x", mux_pllc4_out1_pllc_pllc4_out2_pllp_clkm_plla_pllc4_out0, CLK_SOURCE_HOST1X, 28, 0, tegra_clk_host1x_9), + INT8("se", mux_pllp_pllc2_c_c3_pllm_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se), +- INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se), ++ INT8("se", mux_pllp_pllc2_c_c3_clkm, CLK_SOURCE_SE, 127, TEGRA_PERIPH_ON_APB, tegra_clk_se_10), + INT8("2d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_2D, 21, 0, tegra_clk_gr2d_8), + INT8("3d", mux_pllm_pllc2_c_c3_pllp_plla, CLK_SOURCE_3D, 24, 0, tegra_clk_gr3d_8), + INT8("vic03", mux_pllm_pllc_pllp_plla_pllc2_c3_clkm, CLK_SOURCE_VIC03, 178, 0, tegra_clk_vic03), +-- +2.27.0 + diff --git a/queue-5.4/clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch b/queue-5.4/clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch new file mode 100644 index 00000000000..a5e547301d6 --- /dev/null +++ b/queue-5.4/clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch @@ -0,0 +1,60 @@ +From 89c061e1820f05f18ff862264bb01f69f12950f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 21:16:23 +0800 +Subject: clk: ti: Fix memleak in ti_fapll_synth_setup + +From: Zhang Qilong + +[ Upstream commit 8c6239f6e95f583bb763d0228e02d4dd0fb3d492 ] + +If clk_register fails, we should goto free branch +before function returns to prevent memleak. + +Fixes: 163152cbbe321 ("clk: ti: Add support for FAPLL on dm816x") +Reported-by: Hulk Robot +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201113131623.2098222-1-zhangqilong3@huawei.com +Acked-by: Tony Lindgren +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/ti/fapll.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/ti/fapll.c b/drivers/clk/ti/fapll.c +index 95e36ba64accf..8024c6d2b9e95 100644 +--- a/drivers/clk/ti/fapll.c ++++ b/drivers/clk/ti/fapll.c +@@ -498,6 +498,7 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd, + { + struct clk_init_data *init; + struct fapll_synth *synth; ++ struct clk *clk = ERR_PTR(-ENOMEM); + + init = kzalloc(sizeof(*init), GFP_KERNEL); + if (!init) +@@ -520,13 +521,19 @@ static struct clk * __init ti_fapll_synth_setup(struct fapll_data *fd, + synth->hw.init = init; + synth->clk_pll = pll_clk; + +- return clk_register(NULL, &synth->hw); ++ clk = clk_register(NULL, &synth->hw); ++ if (IS_ERR(clk)) { ++ pr_err("failed to register clock\n"); ++ goto free; ++ } ++ ++ return clk; + + free: + kfree(synth); + kfree(init); + +- return ERR_PTR(-ENOMEM); ++ return clk; + } + + static void __init ti_fapll_setup(struct device_node *node) +-- +2.27.0 + diff --git a/queue-5.4/clocksource-drivers-arm_arch_timer-correct-fault-pro.patch b/queue-5.4/clocksource-drivers-arm_arch_timer-correct-fault-pro.patch new file mode 100644 index 00000000000..1e1e552f559 --- /dev/null +++ b/queue-5.4/clocksource-drivers-arm_arch_timer-correct-fault-pro.patch @@ -0,0 +1,70 @@ +From 28c8635252309d8934c7cb00192668a993596aca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 15:31:26 +0800 +Subject: clocksource/drivers/arm_arch_timer: Correct fault programming of + CNTKCTL_EL1.EVNTI + +From: Keqian Zhu + +[ Upstream commit 8b7770b877d187bfdae1eaf587bd2b792479a31c ] + +ARM virtual counter supports event stream, it can only trigger an event +when the trigger bit (the value of CNTKCTL_EL1.EVNTI) of CNTVCT_EL0 changes, +so the actual period of event stream is 2^(cntkctl_evnti + 1). For example, +when the trigger bit is 0, then virtual counter trigger an event for every +two cycles. + +While we're at it, rework the way we compute the trigger bit position +by making it more obvious that when bits [n:n-1] are both set (with n +being the most significant bit), we pick bit (n + 1). + +Fixes: 037f637767a8 ("drivers: clocksource: add support for ARM architected timer event stream") +Suggested-by: Marc Zyngier +Signed-off-by: Keqian Zhu +Acked-by: Marc Zyngier +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20201204073126.6920-3-zhukeqian1@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/arm_arch_timer.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c +index d2120fcf1f3f6..39cdda2c9a98b 100644 +--- a/drivers/clocksource/arm_arch_timer.c ++++ b/drivers/clocksource/arm_arch_timer.c +@@ -818,15 +818,24 @@ static void arch_timer_evtstrm_enable(int divider) + + static void arch_timer_configure_evtstream(void) + { +- int evt_stream_div, pos; ++ int evt_stream_div, lsb; ++ ++ /* ++ * As the event stream can at most be generated at half the frequency ++ * of the counter, use half the frequency when computing the divider. ++ */ ++ evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ / 2; ++ ++ /* ++ * Find the closest power of two to the divisor. If the adjacent bit ++ * of lsb (last set bit, starts from 0) is set, then we use (lsb + 1). ++ */ ++ lsb = fls(evt_stream_div) - 1; ++ if (lsb > 0 && (evt_stream_div & BIT(lsb - 1))) ++ lsb++; + +- /* Find the closest power of two to the divisor */ +- evt_stream_div = arch_timer_rate / ARCH_TIMER_EVT_STREAM_FREQ; +- pos = fls(evt_stream_div); +- if (pos > 1 && !(evt_stream_div & (1 << (pos - 2)))) +- pos--; + /* enable event stream */ +- arch_timer_evtstrm_enable(min(pos, 15)); ++ arch_timer_evtstrm_enable(max(0, min(lsb, 15))); + } + + static void arch_counter_set_user_access(void) +-- +2.27.0 + diff --git a/queue-5.4/clocksource-drivers-arm_arch_timer-use-stable-count-.patch b/queue-5.4/clocksource-drivers-arm_arch_timer-use-stable-count-.patch new file mode 100644 index 00000000000..8a2ede8a1ae --- /dev/null +++ b/queue-5.4/clocksource-drivers-arm_arch_timer-use-stable-count-.patch @@ -0,0 +1,47 @@ +From 8b31b3873aa9a42e2582a7727a033fb11787c90a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 15:31:25 +0800 +Subject: clocksource/drivers/arm_arch_timer: Use stable count reader in + erratum sne + +From: Keqian Zhu + +[ Upstream commit d8cc3905b8073c7cfbff94af889fa8dc71f21dd5 ] + +In commit 0ea415390cd3 ("clocksource/arm_arch_timer: Use arch_timer_read_counter +to access stable counters"), we separate stable and normal count reader to omit +unnecessary overhead on systems that have no timer erratum. + +However, in erratum_set_next_event_tval_generic(), count reader becomes normal +reader. This converts it to stable reader. + +Fixes: 0ea415390cd3 ("clocksource/arm_arch_timer: Use arch_timer_read_counter to access stable counters") +Acked-by: Marc Zyngier +Signed-off-by: Keqian Zhu +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20201204073126.6920-2-zhukeqian1@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/arm_arch_timer.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c +index 4be83b4de2a0a..d2120fcf1f3f6 100644 +--- a/drivers/clocksource/arm_arch_timer.c ++++ b/drivers/clocksource/arm_arch_timer.c +@@ -392,10 +392,10 @@ static void erratum_set_next_event_tval_generic(const int access, unsigned long + ctrl &= ~ARCH_TIMER_CTRL_IT_MASK; + + if (access == ARCH_TIMER_PHYS_ACCESS) { +- cval = evt + arch_counter_get_cntpct(); ++ cval = evt + arch_counter_get_cntpct_stable(); + write_sysreg(cval, cntp_cval_el0); + } else { +- cval = evt + arch_counter_get_cntvct(); ++ cval = evt + arch_counter_get_cntvct_stable(); + write_sysreg(cval, cntv_cval_el0); + } + +-- +2.27.0 + diff --git a/queue-5.4/clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch b/queue-5.4/clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch new file mode 100644 index 00000000000..75d3f2cc975 --- /dev/null +++ b/queue-5.4/clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch @@ -0,0 +1,74 @@ +From 2b34e6ab70504879e6faea2d29f634523bf32a01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Nov 2020 21:51:23 +0800 +Subject: clocksource/drivers/cadence_ttc: Fix memory leak in + ttc_setup_clockevent() + +From: Yu Kuai + +[ Upstream commit eee422c46e6840a81c9db18a497b74387a557b29 ] + +If clk_notifier_register() failed, ttc_setup_clockevent() will return +without freeing 'ttcce', which will leak memory. + +Fixes: 70504f311d4b ("clocksource/drivers/cadence_ttc: Convert init function to return error") +Reported-by: Hulk Robot +Signed-off-by: Yu Kuai +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20201116135123.2164033-1-yukuai3@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-cadence-ttc.c | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/drivers/clocksource/timer-cadence-ttc.c b/drivers/clocksource/timer-cadence-ttc.c +index 88fe2e9ba9a35..160bc6597de5b 100644 +--- a/drivers/clocksource/timer-cadence-ttc.c ++++ b/drivers/clocksource/timer-cadence-ttc.c +@@ -411,10 +411,8 @@ static int __init ttc_setup_clockevent(struct clk *clk, + ttcce->ttc.clk = clk; + + err = clk_prepare_enable(ttcce->ttc.clk); +- if (err) { +- kfree(ttcce); +- return err; +- } ++ if (err) ++ goto out_kfree; + + ttcce->ttc.clk_rate_change_nb.notifier_call = + ttc_rate_change_clockevent_cb; +@@ -424,7 +422,7 @@ static int __init ttc_setup_clockevent(struct clk *clk, + &ttcce->ttc.clk_rate_change_nb); + if (err) { + pr_warn("Unable to register clock notifier.\n"); +- return err; ++ goto out_kfree; + } + + ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk); +@@ -453,15 +451,17 @@ static int __init ttc_setup_clockevent(struct clk *clk, + + err = request_irq(irq, ttc_clock_event_interrupt, + IRQF_TIMER, ttcce->ce.name, ttcce); +- if (err) { +- kfree(ttcce); +- return err; +- } ++ if (err) ++ goto out_kfree; + + clockevents_config_and_register(&ttcce->ce, + ttcce->ttc.freq / PRESCALE, 1, 0xfffe); + + return 0; ++ ++out_kfree: ++ kfree(ttcce); ++ return err; + } + + /** +-- +2.27.0 + diff --git a/queue-5.4/clocksource-drivers-orion-add-missing-clk_disable_un.patch b/queue-5.4/clocksource-drivers-orion-add-missing-clk_disable_un.patch new file mode 100644 index 00000000000..1703dc2c15f --- /dev/null +++ b/queue-5.4/clocksource-drivers-orion-add-missing-clk_disable_un.patch @@ -0,0 +1,68 @@ +From 84b9b197ce48567020d790e682a908660ad338a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 14:47:06 +0800 +Subject: clocksource/drivers/orion: Add missing clk_disable_unprepare() on + error path + +From: Yang Yingliang + +[ Upstream commit c1e6cad00aa2f17845e7270e38ff3cc82c7b022a ] + +After calling clk_prepare_enable(), clk_disable_unprepare() need +be called on error path. + +Fixes: fbe4b3566ddc ("clocksource/drivers/orion: Convert init function...") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Daniel Lezcano +Link: https://lore.kernel.org/r/20201111064706.3397156-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-orion.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/drivers/clocksource/timer-orion.c b/drivers/clocksource/timer-orion.c +index 7d487107e3cd8..32b2563e2ad1b 100644 +--- a/drivers/clocksource/timer-orion.c ++++ b/drivers/clocksource/timer-orion.c +@@ -149,7 +149,8 @@ static int __init orion_timer_init(struct device_node *np) + irq = irq_of_parse_and_map(np, 1); + if (irq <= 0) { + pr_err("%pOFn: unable to parse timer1 irq\n", np); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out_unprep_clk; + } + + rate = clk_get_rate(clk); +@@ -166,7 +167,7 @@ static int __init orion_timer_init(struct device_node *np) + clocksource_mmio_readl_down); + if (ret) { + pr_err("Failed to initialize mmio timer\n"); +- return ret; ++ goto out_unprep_clk; + } + + sched_clock_register(orion_read_sched_clock, 32, rate); +@@ -175,7 +176,7 @@ static int __init orion_timer_init(struct device_node *np) + ret = setup_irq(irq, &orion_clkevt_irq); + if (ret) { + pr_err("%pOFn: unable to setup irq\n", np); +- return ret; ++ goto out_unprep_clk; + } + + ticks_per_jiffy = (clk_get_rate(clk) + HZ/2) / HZ; +@@ -188,5 +189,9 @@ static int __init orion_timer_init(struct device_node *np) + orion_delay_timer_init(rate); + + return 0; ++ ++out_unprep_clk: ++ clk_disable_unprepare(clk); ++ return ret; + } + TIMER_OF_DECLARE(orion_timer, "marvell,orion-timer", orion_timer_init); +-- +2.27.0 + diff --git a/queue-5.4/cpufreq-ap806-add-missing-module_device_table.patch b/queue-5.4/cpufreq-ap806-add-missing-module_device_table.patch new file mode 100644 index 00000000000..91562864ab4 --- /dev/null +++ b/queue-5.4/cpufreq-ap806-add-missing-module_device_table.patch @@ -0,0 +1,44 @@ +From 2092c6ae61b6ab635958ffd63c49e8e6d9a38949 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:31 +0100 +Subject: cpufreq: ap806: Add missing MODULE_DEVICE_TABLE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 925a5bcefe105f2790ecbdc252eb2315573f309d ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this cpufreq driver when it is +compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: f525a670533d9 ("cpufreq: ap806: add cpufreq driver for Armada 8K") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/armada-8k-cpufreq.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/cpufreq/armada-8k-cpufreq.c b/drivers/cpufreq/armada-8k-cpufreq.c +index 39e34f5066d3d..b0fc5e84f8570 100644 +--- a/drivers/cpufreq/armada-8k-cpufreq.c ++++ b/drivers/cpufreq/armada-8k-cpufreq.c +@@ -204,6 +204,12 @@ static void __exit armada_8k_cpufreq_exit(void) + } + module_exit(armada_8k_cpufreq_exit); + ++static const struct of_device_id __maybe_unused armada_8k_cpufreq_of_match[] = { ++ { .compatible = "marvell,ap806-cpu-clock" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, armada_8k_cpufreq_of_match); ++ + MODULE_AUTHOR("Gregory Clement "); + MODULE_DESCRIPTION("Armada 8K cpufreq driver"); + MODULE_LICENSE("GPL"); +-- +2.27.0 + diff --git a/queue-5.4/cpufreq-highbank-add-missing-module_device_table.patch b/queue-5.4/cpufreq-highbank-add-missing-module_device_table.patch new file mode 100644 index 00000000000..d963f973e65 --- /dev/null +++ b/queue-5.4/cpufreq-highbank-add-missing-module_device_table.patch @@ -0,0 +1,45 @@ +From d1248b1be9d79d3ba8e8ac501fe3acc1db387859 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:32 +0100 +Subject: cpufreq: highbank: Add missing MODULE_DEVICE_TABLE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 9433777a6e0aae27468d3434b75cd51bb88ff711 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this cpufreq driver when it is +compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: 6754f556103be ("cpufreq / highbank: add support for highbank cpufreq") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/highbank-cpufreq.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/cpufreq/highbank-cpufreq.c b/drivers/cpufreq/highbank-cpufreq.c +index 5a7f6dafcddb6..ac57cddc5f2fe 100644 +--- a/drivers/cpufreq/highbank-cpufreq.c ++++ b/drivers/cpufreq/highbank-cpufreq.c +@@ -101,6 +101,13 @@ out_put_node: + } + module_init(hb_cpufreq_driver_init); + ++static const struct of_device_id __maybe_unused hb_cpufreq_of_match[] = { ++ { .compatible = "calxeda,highbank" }, ++ { .compatible = "calxeda,ecx-2000" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, hb_cpufreq_of_match); ++ + MODULE_AUTHOR("Mark Langsdorf "); + MODULE_DESCRIPTION("Calxeda Highbank cpufreq driver"); + MODULE_LICENSE("GPL"); +-- +2.27.0 + diff --git a/queue-5.4/cpufreq-loongson1-add-missing-module_alias.patch b/queue-5.4/cpufreq-loongson1-add-missing-module_alias.patch new file mode 100644 index 00000000000..09db5f35822 --- /dev/null +++ b/queue-5.4/cpufreq-loongson1-add-missing-module_alias.patch @@ -0,0 +1,38 @@ +From 306eb26549a2f279ff6e49085809304bbd00a350 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:37 +0100 +Subject: cpufreq: loongson1: Add missing MODULE_ALIAS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit b9acab091842ca8b288882798bb809f7abf5408a ] + +This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq +driver when it is compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: a0a22cf14472f ("cpufreq: Loongson1: Add cpufreq driver for Loongson1B") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/loongson1-cpufreq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/loongson1-cpufreq.c b/drivers/cpufreq/loongson1-cpufreq.c +index 0ea88778882ac..86f612593e497 100644 +--- a/drivers/cpufreq/loongson1-cpufreq.c ++++ b/drivers/cpufreq/loongson1-cpufreq.c +@@ -216,6 +216,7 @@ static struct platform_driver ls1x_cpufreq_platdrv = { + + module_platform_driver(ls1x_cpufreq_platdrv); + ++MODULE_ALIAS("platform:ls1x-cpufreq"); + MODULE_AUTHOR("Kelvin Cheung "); + MODULE_DESCRIPTION("Loongson1 CPUFreq driver"); + MODULE_LICENSE("GPL"); +-- +2.27.0 + diff --git a/queue-5.4/cpufreq-mediatek-add-missing-module_device_table.patch b/queue-5.4/cpufreq-mediatek-add-missing-module_device_table.patch new file mode 100644 index 00000000000..77f0c30bcd0 --- /dev/null +++ b/queue-5.4/cpufreq-mediatek-add-missing-module_device_table.patch @@ -0,0 +1,39 @@ +From c14c0b972075b4363b0cf1ee537d50a442caec23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:33 +0100 +Subject: cpufreq: mediatek: Add missing MODULE_DEVICE_TABLE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit af6eca06501118af3e2ad46eee8edab20624b74e ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this cpufreq driver when it is +compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: 501c574f4e3a5 ("cpufreq: mediatek: Add support of cpufreq to MT2701/MT7623 SoC") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/mediatek-cpufreq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/mediatek-cpufreq.c b/drivers/cpufreq/mediatek-cpufreq.c +index 0c98dd08273d0..927ebc582a385 100644 +--- a/drivers/cpufreq/mediatek-cpufreq.c ++++ b/drivers/cpufreq/mediatek-cpufreq.c +@@ -540,6 +540,7 @@ static const struct of_device_id mtk_cpufreq_machines[] __initconst = { + + { } + }; ++MODULE_DEVICE_TABLE(of, mtk_cpufreq_machines); + + static int __init mtk_cpufreq_driver_init(void) + { +-- +2.27.0 + diff --git a/queue-5.4/cpufreq-qcom-add-missing-module_device_table.patch b/queue-5.4/cpufreq-qcom-add-missing-module_device_table.patch new file mode 100644 index 00000000000..db582b6a913 --- /dev/null +++ b/queue-5.4/cpufreq-qcom-add-missing-module_device_table.patch @@ -0,0 +1,39 @@ +From b2394e531974d303030ec1a8fd85456a896f5c20 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:34 +0100 +Subject: cpufreq: qcom: Add missing MODULE_DEVICE_TABLE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit a5a6031663bc1dd0a10babd49d1bcb3153a8327f ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this cpufreq driver when it is +compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: 46e2856b8e188 ("cpufreq: Add Kryo CPU scaling driver") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/qcom-cpufreq-nvmem.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/qcom-cpufreq-nvmem.c b/drivers/cpufreq/qcom-cpufreq-nvmem.c +index f0d2d5035413b..1e77d190f19f9 100644 +--- a/drivers/cpufreq/qcom-cpufreq-nvmem.c ++++ b/drivers/cpufreq/qcom-cpufreq-nvmem.c +@@ -305,6 +305,7 @@ static const struct of_device_id qcom_cpufreq_match_list[] __initconst = { + { .compatible = "qcom,qcs404", .data = &match_data_qcs404 }, + {}, + }; ++MODULE_DEVICE_TABLE(of, qcom_cpufreq_match_list); + + /* + * Since the driver depends on smem and nvmem drivers, which may +-- +2.27.0 + diff --git a/queue-5.4/cpufreq-scpi-add-missing-module_alias.patch b/queue-5.4/cpufreq-scpi-add-missing-module_alias.patch new file mode 100644 index 00000000000..a1da86d6fe0 --- /dev/null +++ b/queue-5.4/cpufreq-scpi-add-missing-module_alias.patch @@ -0,0 +1,38 @@ +From 5134b2a154614a10e6af5aa95942ecd5d6c3804f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:38 +0100 +Subject: cpufreq: scpi: Add missing MODULE_ALIAS +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit c0382d049d2def37b81e907a8b22661a4a4a6eb5 ] + +This patch adds missing MODULE_ALIAS for automatic loading of this cpufreq +driver when it is compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: 8def31034d033 ("cpufreq: arm_big_little: add SCPI interface driver") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/scpi-cpufreq.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/scpi-cpufreq.c b/drivers/cpufreq/scpi-cpufreq.c +index 2b51e0718c9f6..b341ffbf56bc3 100644 +--- a/drivers/cpufreq/scpi-cpufreq.c ++++ b/drivers/cpufreq/scpi-cpufreq.c +@@ -239,6 +239,7 @@ static struct platform_driver scpi_cpufreq_platdrv = { + }; + module_platform_driver(scpi_cpufreq_platdrv); + ++MODULE_ALIAS("platform:scpi-cpufreq"); + MODULE_AUTHOR("Sudeep Holla "); + MODULE_DESCRIPTION("ARM SCPI CPUFreq interface driver"); + MODULE_LICENSE("GPL v2"); +-- +2.27.0 + diff --git a/queue-5.4/cpufreq-st-add-missing-module_device_table.patch b/queue-5.4/cpufreq-st-add-missing-module_device_table.patch new file mode 100644 index 00000000000..fb635fe36f9 --- /dev/null +++ b/queue-5.4/cpufreq-st-add-missing-module_device_table.patch @@ -0,0 +1,45 @@ +From e69e9c7c4345155965d195abc6a6cfa8d6367615 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:35 +0100 +Subject: cpufreq: st: Add missing MODULE_DEVICE_TABLE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 183747ab52654eb406fc6b5bfb40806b75d31811 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this cpufreq driver when it is +compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: ab0ea257fc58d ("cpufreq: st: Provide runtime initialised driver for ST's platforms") +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/sti-cpufreq.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/cpufreq/sti-cpufreq.c b/drivers/cpufreq/sti-cpufreq.c +index 2855b7878a204..7ade4070ca827 100644 +--- a/drivers/cpufreq/sti-cpufreq.c ++++ b/drivers/cpufreq/sti-cpufreq.c +@@ -292,6 +292,13 @@ register_cpufreq_dt: + } + module_init(sti_cpufreq_init); + ++static const struct of_device_id __maybe_unused sti_cpufreq_of_match[] = { ++ { .compatible = "st,stih407" }, ++ { .compatible = "st,stih410" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, sti_cpufreq_of_match); ++ + MODULE_DESCRIPTION("STMicroelectronics CPUFreq/OPP driver"); + MODULE_AUTHOR("Ajitpal Singh "); + MODULE_AUTHOR("Lee Jones "); +-- +2.27.0 + diff --git a/queue-5.4/cpufreq-sun50i-add-missing-module_device_table.patch b/queue-5.4/cpufreq-sun50i-add-missing-module_device_table.patch new file mode 100644 index 00000000000..8a04da495c2 --- /dev/null +++ b/queue-5.4/cpufreq-sun50i-add-missing-module_device_table.patch @@ -0,0 +1,40 @@ +From 49c94144f23afb1fe153553279b8b9ceb3f851a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 16:11:36 +0100 +Subject: cpufreq: sun50i: Add missing MODULE_DEVICE_TABLE +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit af2096f285077e3339eb835ad06c50bdd59f01b5 ] + +This patch adds missing MODULE_DEVICE_TABLE definition which generates +correct modalias for automatic loading of this cpufreq driver when it is +compiled as an external module. + +Signed-off-by: Pali Rohár +Fixes: f328584f7bff8 ("cpufreq: Add sun50i nvmem based CPU scaling driver") +Reviewed-by: Yangtao Li +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/sun50i-cpufreq-nvmem.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/cpufreq/sun50i-cpufreq-nvmem.c b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +index 9907a165135b7..2deed8d8773fa 100644 +--- a/drivers/cpufreq/sun50i-cpufreq-nvmem.c ++++ b/drivers/cpufreq/sun50i-cpufreq-nvmem.c +@@ -167,6 +167,7 @@ static const struct of_device_id sun50i_cpufreq_match_list[] = { + { .compatible = "allwinner,sun50i-h6" }, + {} + }; ++MODULE_DEVICE_TABLE(of, sun50i_cpufreq_match_list); + + static const struct of_device_id *sun50i_cpufreq_match_node(void) + { +-- +2.27.0 + diff --git a/queue-5.4/crypto-atmel-i2c-select-config_bitreverse.patch b/queue-5.4/crypto-atmel-i2c-select-config_bitreverse.patch new file mode 100644 index 00000000000..06ccce0b205 --- /dev/null +++ b/queue-5.4/crypto-atmel-i2c-select-config_bitreverse.patch @@ -0,0 +1,42 @@ +From ee0be5d79db414c1abe68f1a3fd28881189d36b8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 00:20:04 +0100 +Subject: crypto: atmel-i2c - select CONFIG_BITREVERSE + +From: Arnd Bergmann + +[ Upstream commit d33a23b0532d5d1b5b700e8641661261e7dbef61 ] + +The bitreverse helper is almost always built into the kernel, +but in a rare randconfig build it is possible to hit a case +in which it is a loadable module while the atmel-i2c driver +is built-in: + +arm-linux-gnueabi-ld: drivers/crypto/atmel-i2c.o: in function `atmel_i2c_checksum': +atmel-i2c.c:(.text+0xa0): undefined reference to `byte_rev_table' + +Add one more 'select' statement to prevent this. + +Fixes: 11105693fa05 ("crypto: atmel-ecc - introduce Microchip / Atmel ECC driver") +Signed-off-by: Arnd Bergmann +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig +index 0952f059d967c..1f6308cdf79a2 100644 +--- a/drivers/crypto/Kconfig ++++ b/drivers/crypto/Kconfig +@@ -544,6 +544,7 @@ config CRYPTO_DEV_ATMEL_SHA + + config CRYPTO_DEV_ATMEL_I2C + tristate ++ select BITREVERSE + + config CRYPTO_DEV_ATMEL_ECC + tristate "Support for Microchip / Atmel ECC hw accelerator" +-- +2.27.0 + diff --git a/queue-5.4/crypto-crypto4xx-replace-bitwise-or-with-logical-or-.patch b/queue-5.4/crypto-crypto4xx-replace-bitwise-or-with-logical-or-.patch new file mode 100644 index 00000000000..ea325fe5acf --- /dev/null +++ b/queue-5.4/crypto-crypto4xx-replace-bitwise-or-with-logical-or-.patch @@ -0,0 +1,60 @@ +From 95b63117848580aece0d94d5f985cdc3234672a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 13:07:02 -0700 +Subject: crypto: crypto4xx - Replace bitwise OR with logical OR in + crypto4xx_build_pd + +From: Nathan Chancellor + +[ Upstream commit 5bdad829c31a09069fd508534f03c2ea1576ac75 ] + +Clang warns: + +drivers/crypto/amcc/crypto4xx_core.c:921:60: warning: operator '?:' has +lower precedence than '|'; '|' will be evaluated first +[-Wbitwise-conditional-parentheses] + (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ? + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ^ +drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses +around the '|' expression to silence this warning + (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ? + ^ + ) +drivers/crypto/amcc/crypto4xx_core.c:921:60: note: place parentheses +around the '?:' expression to evaluate it first + (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ? + ^ + ( +1 warning generated. + +It looks like this should have been a logical OR so that +PD_CTL_HASH_FINAL gets added to the w bitmask if crypto_tfm_alg_type +is either CRYPTO_ALG_TYPE_AHASH or CRYPTO_ALG_TYPE_AEAD. Change the +operator so that everything works properly. + +Fixes: 4b5b79998af6 ("crypto: crypto4xx - fix stalls under heavy load") +Link: https://github.com/ClangBuiltLinux/linux/issues/1198 +Signed-off-by: Nathan Chancellor +Reviewed-by: Christian Lamparter +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/amcc/crypto4xx_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c +index 7d6b695c4ab3f..230e8902c727c 100644 +--- a/drivers/crypto/amcc/crypto4xx_core.c ++++ b/drivers/crypto/amcc/crypto4xx_core.c +@@ -916,7 +916,7 @@ int crypto4xx_build_pd(struct crypto_async_request *req, + } + + pd->pd_ctl.w = PD_CTL_HOST_READY | +- ((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) | ++ ((crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AHASH) || + (crypto_tfm_alg_type(req->tfm) == CRYPTO_ALG_TYPE_AEAD) ? + PD_CTL_HASH_FINAL : 0); + pd->pd_ctl_len.w = 0x00400000 | (assoclen + datalen); +-- +2.27.0 + diff --git a/queue-5.4/crypto-inside-secure-fix-sizeof-mismatch.patch b/queue-5.4/crypto-inside-secure-fix-sizeof-mismatch.patch new file mode 100644 index 00000000000..568af8edf74 --- /dev/null +++ b/queue-5.4/crypto-inside-secure-fix-sizeof-mismatch.patch @@ -0,0 +1,40 @@ +From 2a430c6857abf9c1f2f486b81c6d7d4ae5a4a65b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 10 Oct 2020 17:47:36 +0100 +Subject: crypto: inside-secure - Fix sizeof() mismatch + +From: Colin Ian King + +[ Upstream commit c98e233062cd9d0e2f10e445a671f0799daaef67 ] + +An incorrect sizeof() is being used, sizeof(priv->ring[i].rdr_req) is +not correct, it should be sizeof(*priv->ring[i].rdr_req). Note that +since the size of ** is the same size as * this is not causing any +issues. + +Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)") +Fixes: 9744fec95f06 ("crypto: inside-secure - remove request list to improve performance") +Signed-off-by: Colin Ian King +Acked-by: Antoine Tenart +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/inside-secure/safexcel.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c +index 991a4425f006a..4d9d97c59ee36 100644 +--- a/drivers/crypto/inside-secure/safexcel.c ++++ b/drivers/crypto/inside-secure/safexcel.c +@@ -1467,7 +1467,7 @@ static int safexcel_probe_generic(void *pdev, + + priv->ring[i].rdr_req = devm_kcalloc(dev, + EIP197_DEFAULT_RING_SIZE, +- sizeof(priv->ring[i].rdr_req), ++ sizeof(*priv->ring[i].rdr_req), + GFP_KERNEL); + if (!priv->ring[i].rdr_req) + return -ENOMEM; +-- +2.27.0 + diff --git a/queue-5.4/crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch b/queue-5.4/crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch new file mode 100644 index 00000000000..867703c7535 --- /dev/null +++ b/queue-5.4/crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch @@ -0,0 +1,45 @@ +From bc1476b1fd72e6241f39e468d456e46292ebcf52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 21:17:28 +0800 +Subject: crypto: omap-aes - Fix PM disable depth imbalance in omap_aes_probe + +From: Zhang Qilong + +[ Upstream commit ff8107200367f4abe0e5bce66a245e8d0f2d229e ] + +The pm_runtime_enable will increase power disable depth. +Thus a pairing decrement is needed on the error handling +path to keep it balanced according to context. + +Fixes: f7b2b5dd6a62a ("crypto: omap-aes - add error check for pm_runtime_get_sync") +Signed-off-by: Zhang Qilong +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/omap-aes.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/crypto/omap-aes.c b/drivers/crypto/omap-aes.c +index 2f53fbb741001..103e704c14697 100644 +--- a/drivers/crypto/omap-aes.c ++++ b/drivers/crypto/omap-aes.c +@@ -1157,7 +1157,7 @@ static int omap_aes_probe(struct platform_device *pdev) + if (err < 0) { + dev_err(dev, "%s: failed to get_sync(%d)\n", + __func__, err); +- goto err_res; ++ goto err_pm_disable; + } + + omap_aes_dma_stop(dd); +@@ -1267,6 +1267,7 @@ err_engine: + omap_aes_dma_cleanup(dd); + err_irq: + tasklet_kill(&dd->done_task); ++err_pm_disable: + pm_runtime_disable(dev); + err_res: + dd = NULL; +-- +2.27.0 + diff --git a/queue-5.4/crypto-qat-fix-status-check-in-qat_hal_put_rel_rd_xf.patch b/queue-5.4/crypto-qat-fix-status-check-in-qat_hal_put_rel_rd_xf.patch new file mode 100644 index 00000000000..97db7938ee7 --- /dev/null +++ b/queue-5.4/crypto-qat-fix-status-check-in-qat_hal_put_rel_rd_xf.patch @@ -0,0 +1,44 @@ +From 74d3ef52aefedda7ecb9e23156008e12b99fd117 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 19:27:40 +0800 +Subject: crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() + +From: Jack Xu + +[ Upstream commit 3b5c130fb2e4c045369791c33c83b59f6e84f7d6 ] + +The return value of qat_hal_rd_ae_csr() is always a CSR value and never +a status and should not be stored in the status variable of +qat_hal_put_rel_rd_xfer(). + +This removes the assignment as qat_hal_rd_ae_csr() is not expected to +fail. +A more comprehensive handling of the theoretical corner case which could +result in a fail will be submitted in a separate patch. + +Fixes: 8c9478a400b7 ("crypto: qat - reduce stack size with KASAN") +Signed-off-by: Jack Xu +Reviewed-by: Giovanni Cabiddu +Reviewed-by: Fiona Trahe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/qat/qat_common/qat_hal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/qat/qat_common/qat_hal.c b/drivers/crypto/qat/qat_common/qat_hal.c +index ff149e176f649..dac130bb807ae 100644 +--- a/drivers/crypto/qat/qat_common/qat_hal.c ++++ b/drivers/crypto/qat/qat_common/qat_hal.c +@@ -1189,7 +1189,7 @@ static int qat_hal_put_rel_rd_xfer(struct icp_qat_fw_loader_handle *handle, + unsigned short mask; + unsigned short dr_offset = 0x10; + +- status = ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES); ++ ctx_enables = qat_hal_rd_ae_csr(handle, ae, CTX_ENABLES); + if (CE_INUSE_CONTEXTS & ctx_enables) { + if (ctx & 0x1) { + pr_err("QAT: bad 4-ctx mode,ctx=0x%x\n", ctx); +-- +2.27.0 + diff --git a/queue-5.4/crypto-talitos-endianess-in-current_desc_hdr.patch b/queue-5.4/crypto-talitos-endianess-in-current_desc_hdr.patch new file mode 100644 index 00000000000..ea27a271e8e --- /dev/null +++ b/queue-5.4/crypto-talitos-endianess-in-current_desc_hdr.patch @@ -0,0 +1,53 @@ +From cef39378d276a1b6ce889ae04adeb8c4a5329122 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 09:34:55 +0000 +Subject: crypto: talitos - Endianess in current_desc_hdr() + +From: Christophe Leroy + +[ Upstream commit 195404db27f9533c71fdcb78d32a77075c2cb4a2 ] + +current_desc_hdr() compares the value of the current descriptor +with the next_desc member of the talitos_desc struct. + +While the current descriptor is obtained from in_be32() which +return CPU ordered bytes, next_desc member is in big endian order. + +Convert the current descriptor into big endian before comparing it +with next_desc. + +This fixes a sparse warning. + +Fixes: 37b5e8897eb5 ("crypto: talitos - chain in buffered data for ahash on SEC1") +Signed-off-by: Christophe Leroy +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/talitos.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index 56e3068c9947a..261c0bfa8f185 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -478,7 +478,7 @@ static u32 current_desc_hdr(struct device *dev, int ch) + + iter = tail; + while (priv->chan[ch].fifo[iter].dma_desc != cur_desc && +- priv->chan[ch].fifo[iter].desc->next_desc != cur_desc) { ++ priv->chan[ch].fifo[iter].desc->next_desc != cpu_to_be32(cur_desc)) { + iter = (iter + 1) & (priv->fifo_len - 1); + if (iter == tail) { + dev_err(dev, "couldn't locate current descriptor\n"); +@@ -486,7 +486,7 @@ static u32 current_desc_hdr(struct device *dev, int ch) + } + } + +- if (priv->chan[ch].fifo[iter].desc->next_desc == cur_desc) { ++ if (priv->chan[ch].fifo[iter].desc->next_desc == cpu_to_be32(cur_desc)) { + struct talitos_edesc *edesc; + + edesc = container_of(priv->chan[ch].fifo[iter].desc, +-- +2.27.0 + diff --git a/queue-5.4/crypto-talitos-fix-return-type-of-current_desc_hdr.patch b/queue-5.4/crypto-talitos-fix-return-type-of-current_desc_hdr.patch new file mode 100644 index 00000000000..0ca8c53d734 --- /dev/null +++ b/queue-5.4/crypto-talitos-fix-return-type-of-current_desc_hdr.patch @@ -0,0 +1,55 @@ +From 66d036010492bc43c4bbe502d2189e6919d55e81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 09:34:56 +0000 +Subject: crypto: talitos - Fix return type of current_desc_hdr() + +From: Christophe Leroy + +[ Upstream commit 0237616173fd363a54bd272aa3bd376faa1d7caa ] + +current_desc_hdr() returns a u32 but in fact this is a __be32, +leading to a lot of sparse warnings. + +Change the return type to __be32 and ensure it is handled as +sure by the caller. + +Fixes: 3e721aeb3df3 ("crypto: talitos - handle descriptor not found in error path") +Signed-off-by: Christophe Leroy +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/talitos.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index 261c0bfa8f185..b7c66fc0ae0c2 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -460,7 +460,7 @@ DEF_TALITOS2_DONE(ch1_3, TALITOS2_ISR_CH_1_3_DONE) + /* + * locate current (offending) descriptor + */ +-static u32 current_desc_hdr(struct device *dev, int ch) ++static __be32 current_desc_hdr(struct device *dev, int ch) + { + struct talitos_private *priv = dev_get_drvdata(dev); + int tail, iter; +@@ -501,13 +501,13 @@ static u32 current_desc_hdr(struct device *dev, int ch) + /* + * user diagnostics; report root cause of error based on execution unit status + */ +-static void report_eu_error(struct device *dev, int ch, u32 desc_hdr) ++static void report_eu_error(struct device *dev, int ch, __be32 desc_hdr) + { + struct talitos_private *priv = dev_get_drvdata(dev); + int i; + + if (!desc_hdr) +- desc_hdr = in_be32(priv->chan[ch].reg + TALITOS_DESCBUF); ++ desc_hdr = cpu_to_be32(in_be32(priv->chan[ch].reg + TALITOS_DESCBUF)); + + switch (desc_hdr & DESC_HDR_SEL0_MASK) { + case DESC_HDR_SEL0_AFEU: +-- +2.27.0 + diff --git a/queue-5.4/cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch b/queue-5.4/cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch new file mode 100644 index 00000000000..7e9db23db3a --- /dev/null +++ b/queue-5.4/cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch @@ -0,0 +1,46 @@ +From 3329825e0c233236fcc80389f832fb43718b0953 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 15:08:42 +0800 +Subject: cw1200: fix missing destroy_workqueue() on error in + cw1200_init_common + +From: Qinglang Miao + +[ Upstream commit 7ec8a926188eb8e7a3cbaca43ec44f2d7146d71b ] + +Add the missing destroy_workqueue() before return from +cw1200_init_common in the error handling case. + +Fixes: a910e4a94f69 ("cw1200: add driver for the ST-E CW1100 & CW1200 WLAN chipsets") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201119070842.1011-1-miaoqinglang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/st/cw1200/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/st/cw1200/main.c b/drivers/net/wireless/st/cw1200/main.c +index f7fe56affbcd2..326b1cc1d2bcb 100644 +--- a/drivers/net/wireless/st/cw1200/main.c ++++ b/drivers/net/wireless/st/cw1200/main.c +@@ -381,6 +381,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr, + CW1200_LINK_ID_MAX, + cw1200_skb_dtor, + priv)) { ++ destroy_workqueue(priv->workqueue); + ieee80211_free_hw(hw); + return NULL; + } +@@ -392,6 +393,7 @@ static struct ieee80211_hw *cw1200_init_common(const u8 *macaddr, + for (; i > 0; i--) + cw1200_queue_deinit(&priv->tx_queue[i - 1]); + cw1200_queue_stats_deinit(&priv->tx_queue_stats); ++ destroy_workqueue(priv->workqueue); + ieee80211_free_hw(hw); + return NULL; + } +-- +2.27.0 + diff --git a/queue-5.4/dm-ioctl-fix-error-return-code-in-target_message.patch b/queue-5.4/dm-ioctl-fix-error-return-code-in-target_message.patch new file mode 100644 index 00000000000..e5dcffa4037 --- /dev/null +++ b/queue-5.4/dm-ioctl-fix-error-return-code-in-target_message.patch @@ -0,0 +1,36 @@ +From 7e3182b7570717a4c1085c0065bc298ed2aba618 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Nov 2020 18:19:59 +0800 +Subject: dm ioctl: fix error return code in target_message + +From: Qinglang Miao + +[ Upstream commit 4d7659bfbe277a43399a4a2d90fca141e70f29e1 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 2ca4c92f58f9 ("dm ioctl: prevent empty message") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index ac83f5002ce5f..1c5133f71af39 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -1600,6 +1600,7 @@ static int target_message(struct file *filp, struct dm_ioctl *param, size_t para + + if (!argc) { + DMWARN("Empty message received."); ++ r = -EINVAL; + goto out_argv; + } + +-- +2.27.0 + diff --git a/queue-5.4/dmaengine-mv_xor_v2-fix-error-return-code-in-mv_xor_.patch b/queue-5.4/dmaengine-mv_xor_v2-fix-error-return-code-in-mv_xor_.patch new file mode 100644 index 00000000000..1b64deb2b3f --- /dev/null +++ b/queue-5.4/dmaengine-mv_xor_v2-fix-error-return-code-in-mv_xor_.patch @@ -0,0 +1,41 @@ +From f58e0ab72fcfed9cfc1746190debcb0cf8c10611 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 09:08:13 +0800 +Subject: dmaengine: mv_xor_v2: Fix error return code in mv_xor_v2_probe() + +From: Zhihao Cheng + +[ Upstream commit c95e6515a8c065862361f7e0e452978ade7f94ec ] + +Return the corresponding error code when first_msi_entry() returns +NULL in mv_xor_v2_probe(). + +Fixes: 19a340b1a820430 ("dmaengine: mv_xor_v2: new driver") +Reported-by: Hulk Robot +Signed-off-by: Zhihao Cheng +Link: https://lore.kernel.org/r/20201124010813.1939095-1-chengzhihao1@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/mv_xor_v2.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c +index e3850f04f6763..889a94af4c851 100644 +--- a/drivers/dma/mv_xor_v2.c ++++ b/drivers/dma/mv_xor_v2.c +@@ -766,8 +766,10 @@ static int mv_xor_v2_probe(struct platform_device *pdev) + goto disable_clk; + + msi_desc = first_msi_entry(&pdev->dev); +- if (!msi_desc) ++ if (!msi_desc) { ++ ret = -ENODEV; + goto free_msi_irqs; ++ } + xor_dev->msi_desc = msi_desc; + + ret = devm_request_irq(&pdev->dev, msi_desc->irq, +-- +2.27.0 + diff --git a/queue-5.4/drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch b/queue-5.4/drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch new file mode 100644 index 00000000000..284822694c0 --- /dev/null +++ b/queue-5.4/drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch @@ -0,0 +1,41 @@ +From cff34207706c7edfe554d45be69918fb8c055308 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 19:22:38 -0800 +Subject: drivers: soc: ti: knav_qmss_queue: Fix error return code in + knav_queue_probe + +From: Zhihao Cheng + +[ Upstream commit 4cba398f37f868f515ff12868418dc28574853a1 ] + +Fix to return the error code from of_get_child_by_name() instaed of 0 +in knav_queue_probe(). + +Fixes: 41f93af900a20d1a0a ("soc: ti: add Keystone Navigator QMSS driver") +Reported-by: Hulk Robot +Signed-off-by: Zhihao Cheng +Signed-off-by: Santosh Shilimkar +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/knav_qmss_queue.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c +index dbbf15e7ef6e1..b8210479ec997 100644 +--- a/drivers/soc/ti/knav_qmss_queue.c ++++ b/drivers/soc/ti/knav_qmss_queue.c +@@ -1859,9 +1859,10 @@ static int knav_queue_probe(struct platform_device *pdev) + if (ret) + goto err; + +- regions = of_get_child_by_name(node, "descriptor-regions"); ++ regions = of_get_child_by_name(node, "descriptor-regions"); + if (!regions) { + dev_err(dev, "descriptor-regions not specified\n"); ++ ret = -ENODEV; + goto err; + } + ret = knav_queue_setup_regions(kdev, regions); +-- +2.27.0 + diff --git a/queue-5.4/drm-amd-display-prevent-bandwidth-overflow.patch b/queue-5.4/drm-amd-display-prevent-bandwidth-overflow.patch new file mode 100644 index 00000000000..ca257584045 --- /dev/null +++ b/queue-5.4/drm-amd-display-prevent-bandwidth-overflow.patch @@ -0,0 +1,51 @@ +From bad63840f1248941899aa982f292890e3aef74c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 20:11:25 -0500 +Subject: drm/amd/display: Prevent bandwidth overflow + +From: Chris Park + +[ Upstream commit 80089dd8410f356d5104496d5ab71a66a4f4646b ] + +[Why] +At very high pixel clock, bandwidth calculation exceeds 32 bit size +and overflow value. This causes the resulting selection of link rate +to be inaccurate. + +[How] +Change order of operation and use fixed point to deal with integer +accuracy. Also address bug found when forcing link rate. + +Signed-off-by: Chris Park +Reviewed-by: Wenjing Liu +Acked-by: Eryk Brol +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +index 47cefc05fd3f5..f933791f1fbbb 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c +@@ -2906,11 +2906,14 @@ uint32_t dc_bandwidth_in_kbps_from_timing( + { + uint32_t bits_per_channel = 0; + uint32_t kbps; ++ struct fixed31_32 link_bw_kbps; + + #ifdef CONFIG_DRM_AMD_DC_DSC_SUPPORT + if (timing->flags.DSC) { +- kbps = (timing->pix_clk_100hz * timing->dsc_cfg.bits_per_pixel); +- kbps = kbps / 160 + ((kbps % 160) ? 1 : 0); ++ link_bw_kbps = dc_fixpt_from_int(timing->pix_clk_100hz); ++ link_bw_kbps = dc_fixpt_div_int(link_bw_kbps, 160); ++ link_bw_kbps = dc_fixpt_mul_int(link_bw_kbps, timing->dsc_cfg.bits_per_pixel); ++ kbps = dc_fixpt_ceil(link_bw_kbps); + return kbps; + } + #endif +-- +2.27.0 + diff --git a/queue-5.4/drm-amdgpu-fix-build_coefficients-argument.patch b/queue-5.4/drm-amdgpu-fix-build_coefficients-argument.patch new file mode 100644 index 00000000000..41b0979eb88 --- /dev/null +++ b/queue-5.4/drm-amdgpu-fix-build_coefficients-argument.patch @@ -0,0 +1,45 @@ +From 284f8c77d5622b42aa7da517c3e0d3ca065fc303 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 22:00:32 +0100 +Subject: drm/amdgpu: fix build_coefficients() argument + +From: Arnd Bergmann + +[ Upstream commit dbb60031dd0c2b85f10ce4c12ae604c28d3aaca4 ] + +gcc -Wextra warns about a function taking an enum argument +being called with a bool: + +drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c: In function 'apply_degamma_for_user_regamma': +drivers/gpu/drm/amd/amdgpu/../display/modules/color/color_gamma.c:1617:29: warning: implicit conversion from 'enum ' to 'enum dc_transfer_func_predefined' [-Wenum-conversion] + 1617 | build_coefficients(&coeff, true); + +It appears that a patch was added using the old calling conventions +after the type was changed, and the value should actually be 0 +(TRANSFER_FUNCTION_SRGB) here instead of 1 (true). + +Fixes: 55a01d4023ce ("drm/amd/display: Add user_regamma to color module") +Reviewed-by: Harry Wentland +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/modules/color/color_gamma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c +index 51d07a4561ce9..e042d8ce05b4a 100644 +--- a/drivers/gpu/drm/amd/display/modules/color/color_gamma.c ++++ b/drivers/gpu/drm/amd/display/modules/color/color_gamma.c +@@ -1576,7 +1576,7 @@ static void apply_degamma_for_user_regamma(struct pwl_float_data_ex *rgb_regamma + struct pwl_float_data_ex *rgb = rgb_regamma; + const struct hw_x_point *coord_x = coordinates_x; + +- build_coefficients(&coeff, true); ++ build_coefficients(&coeff, TRANSFER_FUNCTION_SRGB); + + i = 0; + while (i != hw_points_num + 1) { +-- +2.27.0 + diff --git a/queue-5.4/drm-amdgpu-fix-incorrect-enum-type.patch b/queue-5.4/drm-amdgpu-fix-incorrect-enum-type.patch new file mode 100644 index 00000000000..0c0a509ceba --- /dev/null +++ b/queue-5.4/drm-amdgpu-fix-incorrect-enum-type.patch @@ -0,0 +1,50 @@ +From d9d4bc58fda4687e03937d4446681c9616ab8910 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 22:00:30 +0100 +Subject: drm/amdgpu: fix incorrect enum type + +From: Arnd Bergmann + +[ Upstream commit a110f3750bf8b93764f13bd1402c7cba03d15d61 ] + +core_link_write_dpcd() returns enum dc_status, not ddc_result: + +display/dc/core/dc_link_dp.c: In function 'dp_set_panel_mode': +display/dc/core/dc_link_dp.c:4237:11: warning: implicit conversion from 'enum dc_status' to 'enum ddc_result' +[-Wenum-conversion] + +Avoid the warning by using the correct enum in the caller. + +Fixes: 0b226322434c ("drm/amd/display: Synchronous DisplayPort Link Training") +Signed-off-by: Arnd Bergmann +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +index 6dd2334dd5e60..959eb075d11ed 100644 +--- a/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c ++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link_dp.c +@@ -3378,7 +3378,7 @@ void dp_set_panel_mode(struct dc_link *link, enum dp_panel_mode panel_mode) + + if (edp_config_set.bits.PANEL_MODE_EDP + != panel_mode_edp) { +- enum ddc_result result = DDC_RESULT_UNKNOWN; ++ enum dc_status result = DC_ERROR_UNEXPECTED; + + edp_config_set.bits.PANEL_MODE_EDP = + panel_mode_edp; +@@ -3388,7 +3388,7 @@ void dp_set_panel_mode(struct dc_link *link, enum dp_panel_mode panel_mode) + &edp_config_set.raw, + sizeof(edp_config_set.raw)); + +- ASSERT(result == DDC_RESULT_SUCESSFULL); ++ ASSERT(result == DC_OK); + } + } + DC_LOG_DETECTION_DP_CAPS("Link: %d eDP panel mode supported: %d " +-- +2.27.0 + diff --git a/queue-5.4/drm-amdkfd-fix-leak-in-dmabuf-import.patch b/queue-5.4/drm-amdkfd-fix-leak-in-dmabuf-import.patch new file mode 100644 index 00000000000..b29b180b504 --- /dev/null +++ b/queue-5.4/drm-amdkfd-fix-leak-in-dmabuf-import.patch @@ -0,0 +1,44 @@ +From 68e7840f9b0ec54c62a73cd5f6bb7a6fdc6ea4c5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 12:23:15 -0500 +Subject: drm/amdkfd: Fix leak in dmabuf import + +From: Felix Kuehling + +[ Upstream commit c897934da15f182ce99536007f8ef61c4748c07e ] + +Release dmabuf reference before returning from kfd_ioctl_import_dmabuf. +amdgpu_amdkfd_gpuvm_import_dmabuf takes a reference to the underlying +GEM BO and doesn't keep the reference to the dmabuf wrapper. + +Signed-off-by: Felix Kuehling +Reviewed-by: Kent Russell +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +index 1d3cd5c50d5f2..4a0ef9268918c 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +@@ -1664,6 +1664,7 @@ static int kfd_ioctl_import_dmabuf(struct file *filep, + } + + mutex_unlock(&p->mutex); ++ dma_buf_put(dmabuf); + + args->handle = MAKE_HANDLE(args->gpu_id, idr_handle); + +@@ -1673,6 +1674,7 @@ err_free: + amdgpu_amdkfd_gpuvm_free_memory_of_gpu(dev->kgd, (struct kgd_mem *)mem); + err_unlock: + mutex_unlock(&p->mutex); ++ dma_buf_put(dmabuf); + return r; + } + +-- +2.27.0 + diff --git a/queue-5.4/drm-aspeed-fix-kconfig-warning-subsequent-build-erro.patch b/queue-5.4/drm-aspeed-fix-kconfig-warning-subsequent-build-erro.patch new file mode 100644 index 00000000000..f223461da17 --- /dev/null +++ b/queue-5.4/drm-aspeed-fix-kconfig-warning-subsequent-build-erro.patch @@ -0,0 +1,63 @@ +From 25c9246e9fc5cbdb9cd88978b1bf9e977f11fda2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 11 Oct 2020 16:01:31 -0700 +Subject: drm/aspeed: Fix Kconfig warning & subsequent build errors + +From: Randy Dunlap + +[ Upstream commit bf296b35489b46780b73b74ad984d06750ed5479 ] + +Kernel test robot reported build errors (undefined references) +that didn't make much sense. After reproducing them, there is also +a Kconfig warning that is the root cause of the build errors, so +fix that Kconfig problem. + +Fixes this Kconfig warning: +WARNING: unmet direct dependencies detected for CMA + Depends on [n]: MMU [=n] + Selected by [m]: + - DRM_ASPEED_GFX [=m] && HAS_IOMEM [=y] && DRM [=m] && OF [=y] && (COMPILE_TEST [=y] || ARCH_ASPEED) && HAVE_DMA_CONTIGUOUS [=y] + +and these dependent build errors: +(.text+0x10c8c): undefined reference to `start_isolate_page_range' +microblaze-linux-ld: (.text+0x10f14): undefined reference to `test_pages_isolated' +microblaze-linux-ld: (.text+0x10fd0): undefined reference to `undo_isolate_page_range' + +Fixes: 76356a966e33 ("drm: aspeed: Clean up Kconfig options") +Reported-by: kernel test robot +Signed-off-by: Randy Dunlap +Reviewed-by: Joel Stanley +Cc: Joel Stanley +Cc: Andrew Jeffery +Cc: Daniel Vetter +Cc: Michal Simek +Cc: Andrew Morton +Cc: Mike Rapoport +Cc: linux-mm@kvack.org +Cc: linux-aspeed@lists.ozlabs.org +Cc: linux-arm-kernel@lists.infradead.org +Cc: David Airlie +Cc: dri-devel@lists.freedesktop.org +Signed-off-by: Joel Stanley +Link: https://patchwork.freedesktop.org/patch/msgid/20201011230131.4922-1-rdunlap@infradead.org +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/aspeed/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/aspeed/Kconfig b/drivers/gpu/drm/aspeed/Kconfig +index 018383cfcfa79..5e95bcea43e92 100644 +--- a/drivers/gpu/drm/aspeed/Kconfig ++++ b/drivers/gpu/drm/aspeed/Kconfig +@@ -3,6 +3,7 @@ config DRM_ASPEED_GFX + tristate "ASPEED BMC Display Controller" + depends on DRM && OF + depends on (COMPILE_TEST || ARCH_ASPEED) ++ depends on MMU + select DRM_KMS_HELPER + select DRM_KMS_CMA_HELPER + select DMA_CMA if HAVE_DMA_CONTIGUOUS +-- +2.27.0 + diff --git a/queue-5.4/drm-gma500-fix-double-free-of-gma_connector.patch b/queue-5.4/drm-gma500-fix-double-free-of-gma_connector.patch new file mode 100644 index 00000000000..1a0a470da9a --- /dev/null +++ b/queue-5.4/drm-gma500-fix-double-free-of-gma_connector.patch @@ -0,0 +1,45 @@ +From 4750d1ecf821d46f22d48da9890d0b49cc3fcf9d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 3 Oct 2020 12:39:28 -0700 +Subject: drm/gma500: fix double free of gma_connector + +From: Tom Rix + +[ Upstream commit 4e19d51ca5b28a1d435a844c7b2a8e1b1b6fa237 ] + +clang static analysis reports this problem: + +cdv_intel_dp.c:2101:2: warning: Attempt to free released memory + kfree(gma_connector); + ^~~~~~~~~~~~~~~~~~~~ + +In cdv_intel_dp_init() when the call to cdv_intel_edp_panel_vdd_off() +fails, the handler calls cdv_intel_dp_destroy(connector) which does +the first free of gma_connector. So adjust the goto label and skip +the second free. + +Fixes: d112a8163f83 ("gma500/cdv: Add eDP support") +Signed-off-by: Tom Rix +Signed-off-by: Daniel Vetter +Link: https://patchwork.freedesktop.org/patch/msgid/20201003193928.18869-1-trix@redhat.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c +index 2ff4b35151bf8..87738650dd90b 100644 +--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c ++++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c +@@ -2125,7 +2125,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev + DRM_INFO("failed to retrieve link info, disabling eDP\n"); + cdv_intel_dp_encoder_destroy(encoder); + cdv_intel_dp_destroy(connector); +- goto err_priv; ++ goto err_connector; + } else { + DRM_DEBUG_KMS("DPCD: Rev=%x LN_Rate=%x LN_CNT=%x LN_DOWNSP=%x\n", + intel_dp->dpcd[0], intel_dp->dpcd[1], +-- +2.27.0 + diff --git a/queue-5.4/drm-mcde-fix-handling-of-platform_get_irq-error.patch b/queue-5.4/drm-mcde-fix-handling-of-platform_get_irq-error.patch new file mode 100644 index 00000000000..0ac4d14dd44 --- /dev/null +++ b/queue-5.4/drm-mcde-fix-handling-of-platform_get_irq-error.patch @@ -0,0 +1,40 @@ +From d67d89703630c22e67bf50cfd52b96da49f8830a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 09:11:06 +0200 +Subject: drm/mcde: Fix handling of platform_get_irq() error + +From: Krzysztof Kozlowski + +[ Upstream commit e2dae672a9d5e11856fe30ede63467c65f999a81 ] + +platform_get_irq() returns -ERRNO on error. In such case comparison +to 0 would pass the check. + +Fixes: 5fc537bfd000 ("drm/mcde: Add new driver for ST-Ericsson MCDE") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Linus Walleij +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20200827071107.27429-1-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mcde/mcde_drv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/mcde/mcde_drv.c b/drivers/gpu/drm/mcde/mcde_drv.c +index 16e5fb9ec784d..82946ffcb6d21 100644 +--- a/drivers/gpu/drm/mcde/mcde_drv.c ++++ b/drivers/gpu/drm/mcde/mcde_drv.c +@@ -410,8 +410,8 @@ static int mcde_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (!irq) { +- ret = -EINVAL; ++ if (irq < 0) { ++ ret = irq; + goto clk_disable; + } + +-- +2.27.0 + diff --git a/queue-5.4/drm-mediatek-avoid-dereferencing-a-null-hdmi_phy-on-.patch b/queue-5.4/drm-mediatek-avoid-dereferencing-a-null-hdmi_phy-on-.patch new file mode 100644 index 00000000000..50bc5d12f78 --- /dev/null +++ b/queue-5.4/drm-mediatek-avoid-dereferencing-a-null-hdmi_phy-on-.patch @@ -0,0 +1,47 @@ +From e811c4aeac75fb094c9804ed88809c3da474986f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 15:09:37 +0000 +Subject: drm/mediatek: avoid dereferencing a null hdmi_phy on an error message + +From: Colin Ian King + +[ Upstream commit b097efba9580d1f7cbc80cda84e768983e3de541 ] + +Currently there is a null pointer check for hdmi_phy that implies it +may be null, however a dev_err messages dereferences this potential null +pointer. Avoid a null pointer dereference by only emitting the dev_err +message if hdmi_phy is non-null. It is a moot point if the error message +needs to be printed at all, but since this is a relatively new piece of +code it may be useful to keep the message in for the moment in case there +are unforseen errors that need to be reported. + +Fixes: be28b6507c46 ("drm/mediatek: separate hdmi phy to different file") +Signed-off-by: Colin Ian King +Addresses-Coverity: ("Dereference after null check") +Link: https://lore.kernel.org/r/20201207150937.170435-1-colin.king@canonical.com +[vkoul: fix indent of return call] +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/mediatek/mtk_hdmi_phy.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c +index 5223498502c49..23a74eb5d7f81 100644 +--- a/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c ++++ b/drivers/gpu/drm/mediatek/mtk_hdmi_phy.c +@@ -84,8 +84,9 @@ mtk_hdmi_phy_dev_get_ops(const struct mtk_hdmi_phy *hdmi_phy) + hdmi_phy->conf->hdmi_phy_disable_tmds) + return &mtk_hdmi_phy_dev_ops; + +- dev_err(hdmi_phy->dev, "Failed to get dev ops of phy\n"); +- return NULL; ++ if (hdmi_phy) ++ dev_err(hdmi_phy->dev, "Failed to get dev ops of phy\n"); ++ return NULL; + } + + static void mtk_hdmi_phy_clk_get_data(struct mtk_hdmi_phy *hdmi_phy, +-- +2.27.0 + diff --git a/queue-5.4/drm-msm-dsi_pll_10nm-restore-vco-rate-during-restore.patch b/queue-5.4/drm-msm-dsi_pll_10nm-restore-vco-rate-during-restore.patch new file mode 100644 index 00000000000..e13051d8c6d --- /dev/null +++ b/queue-5.4/drm-msm-dsi_pll_10nm-restore-vco-rate-during-restore.patch @@ -0,0 +1,50 @@ +From 9a8f649a5e85a25b3464921fd0201654747e5fc7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 22:03:30 +0300 +Subject: drm/msm/dsi_pll_10nm: restore VCO rate during restore_state + +From: Dmitry Baryshkov + +[ Upstream commit a4ccc37693a271330a46208afbeaed939d54fdbb ] + +PHY disable/enable resets PLL registers to default values. Thus in +addition to restoring several registers we also need to restore VCO rate +settings. + +Signed-off-by: Dmitry Baryshkov +Fixes: c6659785dfb3 ("drm/msm/dsi/pll: call vco set rate explicitly") +Signed-off-by: Rob Clark +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c +index aa9385d5bfff9..33033b94935ed 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_10nm.c +@@ -559,6 +559,7 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll) + struct pll_10nm_cached_state *cached = &pll_10nm->cached_state; + void __iomem *phy_base = pll_10nm->phy_cmn_mmio; + u32 val; ++ int ret; + + val = pll_read(pll_10nm->mmio + REG_DSI_10nm_PHY_PLL_PLL_OUTDIV_RATE); + val &= ~0x3; +@@ -573,6 +574,13 @@ static int dsi_pll_10nm_restore_state(struct msm_dsi_pll *pll) + val |= cached->pll_mux; + pll_write(phy_base + REG_DSI_10nm_PHY_CMN_CLK_CFG1, val); + ++ ret = dsi_pll_10nm_vco_set_rate(&pll->clk_hw, pll_10nm->vco_current_rate, pll_10nm->vco_ref_clk_rate); ++ if (ret) { ++ DRM_DEV_ERROR(&pll_10nm->pdev->dev, ++ "restore vco rate failed. ret=%d\n", ret); ++ return ret; ++ } ++ + DBG("DSI PLL%d", pll_10nm->id); + + return 0; +-- +2.27.0 + diff --git a/queue-5.4/drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch b/queue-5.4/drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch new file mode 100644 index 00000000000..1e0eaa15cb3 --- /dev/null +++ b/queue-5.4/drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch @@ -0,0 +1,36 @@ +From 86f88743158d8ace8a474b14224e182f0003f825 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 14:10:45 +0800 +Subject: drm/omap: dmm_tiler: fix return error code in omap_dmm_probe() + +From: Yang Yingliang + +[ Upstream commit 723ae803218da993143387bf966042eccefac077 ] + +Return -ENOMEM when allocating refill memory failed. + +Fixes: 71e8831f6407 ("drm/omap: DMM/TILER support for OMAP4+ platform") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20201117061045.3452287-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/omapdrm/omap_dmm_tiler.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +index 252f5ebb1acc4..3dd6c0087edb6 100644 +--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c ++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +@@ -891,6 +891,7 @@ static int omap_dmm_probe(struct platform_device *dev) + &omap_dmm->refill_pa, GFP_KERNEL); + if (!omap_dmm->refill_va) { + dev_err(&dev->dev, "could not allocate refill memory\n"); ++ ret = -ENOMEM; + goto fail; + } + +-- +2.27.0 + diff --git a/queue-5.4/drm-tve200-fix-handling-of-platform_get_irq-error.patch b/queue-5.4/drm-tve200-fix-handling-of-platform_get_irq-error.patch new file mode 100644 index 00000000000..fe23070b210 --- /dev/null +++ b/queue-5.4/drm-tve200-fix-handling-of-platform_get_irq-error.patch @@ -0,0 +1,40 @@ +From c981aac797ef67d23efa931365847e08b859a4bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Aug 2020 09:11:07 +0200 +Subject: drm/tve200: Fix handling of platform_get_irq() error + +From: Krzysztof Kozlowski + +[ Upstream commit 77bb5aaf2bb8180e7d1bb70b4df306f511707a7d ] + +platform_get_irq() returns -ERRNO on error. In such case comparison +to 0 would pass the check. + +Fixes: 179c02fe90a4 ("drm/tve200: Add new driver for TVE200") +Signed-off-by: Krzysztof Kozlowski +Acked-by: Linus Walleij +Signed-off-by: Sam Ravnborg +Link: https://patchwork.freedesktop.org/patch/msgid/20200827071107.27429-2-krzk@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tve200/tve200_drv.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/tve200/tve200_drv.c b/drivers/gpu/drm/tve200/tve200_drv.c +index 416f24823c0aa..02836d4e80237 100644 +--- a/drivers/gpu/drm/tve200/tve200_drv.c ++++ b/drivers/gpu/drm/tve200/tve200_drv.c +@@ -210,8 +210,8 @@ static int tve200_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (!irq) { +- ret = -EINVAL; ++ if (irq < 0) { ++ ret = irq; + goto clk_disable; + } + +-- +2.27.0 + diff --git a/queue-5.4/edac-mce_amd-use-struct-cpuinfo_x86.cpu_die_id-for-a.patch b/queue-5.4/edac-mce_amd-use-struct-cpuinfo_x86.cpu_die_id-for-a.patch new file mode 100644 index 00000000000..d3981cb4ad5 --- /dev/null +++ b/queue-5.4/edac-mce_amd-use-struct-cpuinfo_x86.cpu_die_id-for-a.patch @@ -0,0 +1,55 @@ +From 1f74931576583fad964da8b6dbc6683c69a3e5c1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 21:06:58 +0000 +Subject: EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId + +From: Yazen Ghannam + +[ Upstream commit 8de0c9917cc1297bc5543b61992d5bdee4ce621a ] + +The edac_mce_amd module calls decode_dram_ecc() on AMD Family17h and +later systems. This function is used in amd64_edac_mod to do +system-specific decoding for DRAM ECC errors. The function takes a +"NodeId" as a parameter. + +In AMD documentation, NodeId is used to identify a physical die in a +system. This can be used to identify a node in the AMD_NB code and also +it is used with umc_normaddr_to_sysaddr(). + +However, the input used for decode_dram_ecc() is currently the NUMA node +of a logical CPU. In the default configuration, the NUMA node and +physical die will be equivalent, so this doesn't have an impact. + +But the NUMA node configuration can be adjusted with optional memory +interleaving modes. This will cause the NUMA node enumeration to not +match the physical die enumeration. The mismatch will cause the address +translation function to fail or report incorrect results. + +Use struct cpuinfo_x86.cpu_die_id for the node_id parameter to ensure the +physical ID is used. + +Fixes: fbe63acf62f5 ("EDAC, mce_amd: Use cpu_to_node() to find the node ID") +Signed-off-by: Yazen Ghannam +Signed-off-by: Borislav Petkov +Link: https://lkml.kernel.org/r/20201109210659.754018-4-Yazen.Ghannam@amd.com +Signed-off-by: Sasha Levin +--- + drivers/edac/mce_amd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c +index ea622c6f3a393..c19640a453f22 100644 +--- a/drivers/edac/mce_amd.c ++++ b/drivers/edac/mce_amd.c +@@ -975,7 +975,7 @@ static void decode_smca_error(struct mce *m) + } + + if (bank_type == SMCA_UMC && xec == 0 && decode_dram_ecc) +- decode_dram_ecc(cpu_to_node(m->extcpu), m); ++ decode_dram_ecc(topology_die_id(m->extcpu), m); + } + + static inline void amd_decode_err_code(u16 ec) +-- +2.27.0 + diff --git a/queue-5.4/erofs-avoid-using-generic_block_bmap.patch b/queue-5.4/erofs-avoid-using-generic_block_bmap.patch new file mode 100644 index 00000000000..dd9dc3c5878 --- /dev/null +++ b/queue-5.4/erofs-avoid-using-generic_block_bmap.patch @@ -0,0 +1,78 @@ +From 1cee3b605d608bf122529039043d595ca4813e51 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 19:57:40 +0800 +Subject: erofs: avoid using generic_block_bmap + +From: Huang Jianan + +[ Upstream commit d8b3df8b1048405e73558b88cba2adf29490d468 ] + +Surprisingly, `block' in sector_t indicates the number of +i_blkbits-sized blocks rather than sectors for bmap. + +In addition, considering buffer_head limits mapped size to 32-bits, +should avoid using generic_block_bmap. + +Link: https://lore.kernel.org/r/20201209115740.18802-1-huangjianan@oppo.com +Fixes: 9da681e017a3 ("staging: erofs: support bmap") +Reviewed-by: Chao Yu +Reviewed-by: Gao Xiang +Signed-off-by: Huang Jianan +Signed-off-by: Guo Weichao +[ Gao Xiang: slightly update the commit message description. ] +Signed-off-by: Gao Xiang +Signed-off-by: Sasha Levin +--- + fs/erofs/data.c | 26 +++++++------------------- + 1 file changed, 7 insertions(+), 19 deletions(-) + +diff --git a/fs/erofs/data.c b/fs/erofs/data.c +index fc3a8d8064f84..b22a08ac53a23 100644 +--- a/fs/erofs/data.c ++++ b/fs/erofs/data.c +@@ -323,27 +323,12 @@ static int erofs_raw_access_readpages(struct file *filp, + return 0; + } + +-static int erofs_get_block(struct inode *inode, sector_t iblock, +- struct buffer_head *bh, int create) +-{ +- struct erofs_map_blocks map = { +- .m_la = iblock << 9, +- }; +- int err; +- +- err = erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW); +- if (err) +- return err; +- +- if (map.m_flags & EROFS_MAP_MAPPED) +- bh->b_blocknr = erofs_blknr(map.m_pa); +- +- return err; +-} +- + static sector_t erofs_bmap(struct address_space *mapping, sector_t block) + { + struct inode *inode = mapping->host; ++ struct erofs_map_blocks map = { ++ .m_la = blknr_to_addr(block), ++ }; + + if (EROFS_I(inode)->datalayout == EROFS_INODE_FLAT_INLINE) { + erofs_blk_t blks = i_size_read(inode) >> LOG_BLOCK_SIZE; +@@ -352,7 +337,10 @@ static sector_t erofs_bmap(struct address_space *mapping, sector_t block) + return 0; + } + +- return generic_block_bmap(mapping, block, erofs_get_block); ++ if (!erofs_map_blocks(inode, &map, EROFS_GET_BLOCKS_RAW)) ++ return erofs_blknr(map.m_pa); ++ ++ return 0; + } + + /* for uncompressed (aligned) files and raw access for other files */ +-- +2.27.0 + diff --git a/queue-5.4/extcon-max77693-fix-modalias-string.patch b/queue-5.4/extcon-max77693-fix-modalias-string.patch new file mode 100644 index 00000000000..97c15fd19fb --- /dev/null +++ b/queue-5.4/extcon-max77693-fix-modalias-string.patch @@ -0,0 +1,34 @@ +From ff42a1510267c9863b57c2c7aecf6a0c742a6b62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 14:36:27 +0100 +Subject: extcon: max77693: Fix modalias string + +From: Marek Szyprowski + +[ Upstream commit e1efdb604f5c9903a5d92ef42244009d3c04880f ] + +The platform device driver name is "max77693-muic", so advertise it +properly in the modalias string. This fixes automated module loading when +this driver is compiled as a module. + +Fixes: db1b9037424b ("extcon: MAX77693: Add extcon-max77693 driver to support Maxim MAX77693 MUIC device") +Signed-off-by: Marek Szyprowski +Signed-off-by: Chanwoo Choi +Signed-off-by: Sasha Levin +--- + drivers/extcon/extcon-max77693.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c +index 32fc5a66ffa98..26c7041f70698 100644 +--- a/drivers/extcon/extcon-max77693.c ++++ b/drivers/extcon/extcon-max77693.c +@@ -1277,4 +1277,4 @@ module_platform_driver(max77693_muic_driver); + MODULE_DESCRIPTION("Maxim MAX77693 Extcon driver"); + MODULE_AUTHOR("Chanwoo Choi "); + MODULE_LICENSE("GPL"); +-MODULE_ALIAS("platform:extcon-max77693"); ++MODULE_ALIAS("platform:max77693-muic"); +-- +2.27.0 + diff --git a/queue-5.4/f2fs-call-f2fs_get_meta_page_retry-for-nat-page.patch b/queue-5.4/f2fs-call-f2fs_get_meta_page_retry-for-nat-page.patch new file mode 100644 index 00000000000..037a4cb7bf5 --- /dev/null +++ b/queue-5.4/f2fs-call-f2fs_get_meta_page_retry-for-nat-page.patch @@ -0,0 +1,36 @@ +From 99bb43291e04a28730db2c7f43ce5f832cbdf6d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 25 Oct 2020 07:35:47 -0700 +Subject: f2fs: call f2fs_get_meta_page_retry for nat page + +From: Jaegeuk Kim + +[ Upstream commit 3acc4522d89e0a326db69e9d0afaad8cf763a54c ] + +When running fault injection test, if we don't stop checkpoint, some stale +NAT entries were flushed which breaks consistency. + +Fixes: 86f33603f8c5 ("f2fs: handle errors of f2fs_get_meta_page_nofail") +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/node.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 2a4a382f28fed..3ac2a4b32375d 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -109,7 +109,7 @@ static void clear_node_page_dirty(struct page *page) + + static struct page *get_current_nat_page(struct f2fs_sb_info *sbi, nid_t nid) + { +- return f2fs_get_meta_page(sbi, current_nat_addr(sbi, nid)); ++ return f2fs_get_meta_page_retry(sbi, current_nat_addr(sbi, nid)); + } + + static struct page *get_next_nat_page(struct f2fs_sb_info *sbi, nid_t nid) +-- +2.27.0 + diff --git a/queue-5.4/genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch b/queue-5.4/genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch new file mode 100644 index 00000000000..b5d14f696ec --- /dev/null +++ b/queue-5.4/genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch @@ -0,0 +1,55 @@ +From 71640ab4fcc3b96b4bbf58ebcc14fc0dce8a67bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Nov 2020 13:55:51 +0000 +Subject: genirq/irqdomain: Don't try to free an interrupt that has no mapping + +From: Marc Zyngier + +[ Upstream commit 4615fbc3788ddc8e7c6d697714ad35a53729aa2c ] + +When an interrupt allocation fails for N interrupts, it is pretty +common for the error handling code to free the same number of interrupts, +no matter how many interrupts have actually been allocated. + +This may result in the domain freeing code to be unexpectedly called +for interrupts that have no mapping in that domain. Things end pretty +badly. + +Instead, add some checks to irq_domain_free_irqs_hierarchy() to make sure +that thiss does not follow the hierarchy if no mapping exists for a given +interrupt. + +Fixes: 6a6544e520abe ("genirq/irqdomain: Remove auto-recursive hierarchy support") +Signed-off-by: Marc Zyngier +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20201129135551.396777-1-maz@kernel.org +Signed-off-by: Sasha Levin +--- + kernel/irq/irqdomain.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/kernel/irq/irqdomain.c b/kernel/irq/irqdomain.c +index 5a60de39457c7..5e03cbee70d67 100644 +--- a/kernel/irq/irqdomain.c ++++ b/kernel/irq/irqdomain.c +@@ -1288,8 +1288,15 @@ static void irq_domain_free_irqs_hierarchy(struct irq_domain *domain, + unsigned int irq_base, + unsigned int nr_irqs) + { +- if (domain->ops->free) +- domain->ops->free(domain, irq_base, nr_irqs); ++ unsigned int i; ++ ++ if (!domain->ops->free) ++ return; ++ ++ for (i = 0; i < nr_irqs; i++) { ++ if (irq_domain_get_irq_data(domain, irq_base + i)) ++ domain->ops->free(domain, irq_base + i, 1); ++ } + } + + int irq_domain_alloc_irqs_hierarchy(struct irq_domain *domain, +-- +2.27.0 + diff --git a/queue-5.4/hid-i2c-hid-add-vero-k147-to-descriptor-override.patch-25904 b/queue-5.4/hid-i2c-hid-add-vero-k147-to-descriptor-override.patch-25904 new file mode 100644 index 00000000000..5a3503f7447 --- /dev/null +++ b/queue-5.4/hid-i2c-hid-add-vero-k147-to-descriptor-override.patch-25904 @@ -0,0 +1,43 @@ +From 3c0de4b6c68f57899a26846f9fdb5d5264790c42 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 18:51:58 +0100 +Subject: HID: i2c-hid: add Vero K147 to descriptor override + +From: Julian Sax + +commit c870d50ce387d84b6438211a7044c60afbd5d60a upstream. + +This device uses the SIPODEV SP1064 touchpad, which does not +supply descriptors, so it has to be added to the override list. + +Cc: stable@vger.kernel.org +Signed-off-by: Julian Sax +Reviewed-by: Hans de Goede +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman +--- + drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +index 8e0f67455c098..d5b2efcea87fd 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c ++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c +@@ -413,6 +413,14 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = { + }, + .driver_data = (void *)&sipodev_desc + }, ++ { ++ .ident = "Vero K147", ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "VERO"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "K147"), ++ }, ++ .driver_data = (void *)&sipodev_desc ++ }, + { } /* Terminate list */ + }; + +-- +2.27.0 + diff --git a/queue-5.4/hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch b/queue-5.4/hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch new file mode 100644 index 00000000000..edbe3c65688 --- /dev/null +++ b/queue-5.4/hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch @@ -0,0 +1,36 @@ +From 01294255193b67e909c24171b79bfe0057c38ae1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Oct 2020 10:56:43 +0800 +Subject: HSI: omap_ssi: Don't jump to free ID in ssi_add_controller() + +From: Jing Xiangfeng + +[ Upstream commit 41fff6e19bc8d6d8bca79ea388427c426e72e097 ] + +In current code, it jumps to ida_simple_remove() when ida_simple_get() +failes to allocate an ID. Just return to fix it. + +Fixes: 0fae198988b8 ("HSI: omap_ssi: built omap_ssi and omap_ssi_port into one module") +Signed-off-by: Jing Xiangfeng +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/hsi/controllers/omap_ssi_core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hsi/controllers/omap_ssi_core.c b/drivers/hsi/controllers/omap_ssi_core.c +index 4bc4a201f0f6c..2be9c01e175ca 100644 +--- a/drivers/hsi/controllers/omap_ssi_core.c ++++ b/drivers/hsi/controllers/omap_ssi_core.c +@@ -355,7 +355,7 @@ static int ssi_add_controller(struct hsi_controller *ssi, + + err = ida_simple_get(&platform_omap_ssi_ida, 0, 0, GFP_KERNEL); + if (err < 0) +- goto out_err; ++ return err; + ssi->id = err; + + ssi->owner = THIS_MODULE; +-- +2.27.0 + diff --git a/queue-5.4/hwmon-ina3221-fix-pm-usage-counter-unbalance-in-ina3.patch b/queue-5.4/hwmon-ina3221-fix-pm-usage-counter-unbalance-in-ina3.patch new file mode 100644 index 00000000000..e9a5558b63c --- /dev/null +++ b/queue-5.4/hwmon-ina3221-fix-pm-usage-counter-unbalance-in-ina3.patch @@ -0,0 +1,42 @@ +From de1c4851dda90b5c24187c6537f60e5eccf01e1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Dec 2020 22:53:20 +0800 +Subject: hwmon: (ina3221) Fix PM usage counter unbalance in + ina3221_write_enable + +From: Zhang Qilong + +[ Upstream commit bce776f10069c806290eaac712ba73432ae8ecd7 ] + +pm_runtime_get_sync will increment pm usage counter +even it failed. Forgetting to putting operation will +result in reference leak here. We fix it by replacing +it with pm_runtime_resume_and_get to keep usage counter +balanced. It depends on the mainline commit[PM: runtime: +Add pm_runtime_resume_and_get to deal with usagecounter]. + +Fixes: 323aeb0eb5d9a ("hwmon: (ina3221) Add PM runtime support") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201202145320.1135614-1-zhangqilong3@huawei.com +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/ina3221.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/ina3221.c b/drivers/hwmon/ina3221.c +index 8a51dcf055eab..026f70d7c5a43 100644 +--- a/drivers/hwmon/ina3221.c ++++ b/drivers/hwmon/ina3221.c +@@ -403,7 +403,7 @@ static int ina3221_write_enable(struct device *dev, int channel, bool enable) + + /* For enabling routine, increase refcount and resume() at first */ + if (enable) { +- ret = pm_runtime_get_sync(ina->pm_dev); ++ ret = pm_runtime_resume_and_get(ina->pm_dev); + if (ret < 0) { + dev_err(dev, "Failed to get PM runtime\n"); + return ret; +-- +2.27.0 + diff --git a/queue-5.4/iio-hrtimer-trigger-mark-hrtimer-to-expire-in-hard-i.patch b/queue-5.4/iio-hrtimer-trigger-mark-hrtimer-to-expire-in-hard-i.patch new file mode 100644 index 00000000000..059351bbb6f --- /dev/null +++ b/queue-5.4/iio-hrtimer-trigger-mark-hrtimer-to-expire-in-hard-i.patch @@ -0,0 +1,56 @@ +From 447d5456aadd0716d1df59db5bbc8598e1401b9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 11:37:50 +0100 +Subject: iio: hrtimer-trigger: Mark hrtimer to expire in hard interrupt + context + +From: Lars-Peter Clausen + +[ Upstream commit 0178297c1e6898e2197fe169ef3be723e019b971 ] + +On PREEMPT_RT enabled kernels unmarked hrtimers are moved into soft +interrupt expiry mode by default. + +The IIO hrtimer-trigger needs to run in hard interrupt context since it +will end up calling generic_handle_irq() which has the requirement to run +in hard interrupt context. + +Explicitly specify that the timer needs to run in hard interrupt context by +using the HRTIMER_MODE_REL_HARD flag. + +Fixes: f5c2f0215e36 ("hrtimer: Move unmarked hrtimers to soft interrupt expiry on RT") +Reported-by: Christian Eggers +Signed-off-by: Lars-Peter Clausen +Acked-by: Sebastian Andrzej Siewior +Link: https://lore.kernel.org/r/20201117103751.16131-1-lars@metafoo.de +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/trigger/iio-trig-hrtimer.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/iio/trigger/iio-trig-hrtimer.c b/drivers/iio/trigger/iio-trig-hrtimer.c +index a5e670726717f..58c1c30d5612b 100644 +--- a/drivers/iio/trigger/iio-trig-hrtimer.c ++++ b/drivers/iio/trigger/iio-trig-hrtimer.c +@@ -102,7 +102,7 @@ static int iio_trig_hrtimer_set_state(struct iio_trigger *trig, bool state) + + if (state) + hrtimer_start(&trig_info->timer, trig_info->period, +- HRTIMER_MODE_REL); ++ HRTIMER_MODE_REL_HARD); + else + hrtimer_cancel(&trig_info->timer); + +@@ -132,7 +132,7 @@ static struct iio_sw_trigger *iio_trig_hrtimer_probe(const char *name) + trig_info->swt.trigger->ops = &iio_hrtimer_trigger_ops; + trig_info->swt.trigger->dev.groups = iio_hrtimer_attr_groups; + +- hrtimer_init(&trig_info->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL); ++ hrtimer_init(&trig_info->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL_HARD); + trig_info->timer.function = iio_hrtimer_trig_handler; + + trig_info->sampling_frequency = HRTIMER_DEFAULT_SAMPLING_FREQUENCY; +-- +2.27.0 + diff --git a/queue-5.4/initramfs-fix-clang-build-failure.patch b/queue-5.4/initramfs-fix-clang-build-failure.patch new file mode 100644 index 00000000000..e33b2af5367 --- /dev/null +++ b/queue-5.4/initramfs-fix-clang-build-failure.patch @@ -0,0 +1,50 @@ +From 06e41bb9d2e68f8b4d5e1861495fc864b21f0309 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Dec 2020 13:36:42 -0800 +Subject: initramfs: fix clang build failure + +From: Arnd Bergmann + +[ Upstream commit 55d5b7dd6451b58489ce384282ca5a4a289eb8d5 ] + +There is only one function in init/initramfs.c that is in the .text +section, and it is marked __weak. When building with clang-12 and the +integrated assembler, this leads to a bug with recordmcount: + + ./scripts/recordmcount "init/initramfs.o" + Cannot find symbol for section 2: .text. + init/initramfs.o: failed + +I'm not quite sure what exactly goes wrong, but I notice that this +function is only ever called from an __init function, and normally +inlined. Marking it __init as well is clearly correct and it leads to +recordmcount no longer complaining. + +Link: https://lkml.kernel.org/r/20201204165742.3815221-1-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Cc: Nathan Chancellor +Cc: Nick Desaulniers +Cc: Barret Rhoden +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + init/initramfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/init/initramfs.c b/init/initramfs.c +index 5feee4f616d55..00a32799a38b0 100644 +--- a/init/initramfs.c ++++ b/init/initramfs.c +@@ -527,7 +527,7 @@ extern unsigned long __initramfs_size; + #include + #include + +-void __weak free_initrd_mem(unsigned long start, unsigned long end) ++void __weak __init free_initrd_mem(unsigned long start, unsigned long end) + { + free_reserved_area((void *)start, (void *)end, POISON_FREE_INITMEM, + "initrd"); +-- +2.27.0 + diff --git a/queue-5.4/input-ads7846-fix-integer-overflow-on-rt-calculation.patch b/queue-5.4/input-ads7846-fix-integer-overflow-on-rt-calculation.patch new file mode 100644 index 00000000000..9a29412bd20 --- /dev/null +++ b/queue-5.4/input-ads7846-fix-integer-overflow-on-rt-calculation.patch @@ -0,0 +1,52 @@ +From dfbc2db4f485a907a4552c09b53cb47ebfc2b148 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 15:33:24 -0800 +Subject: Input: ads7846 - fix integer overflow on Rt calculation + +From: Oleksij Rempel + +[ Upstream commit 820830ec918f6c3dcd77a54a1c6198ab57407916 ] + +In some rare cases the 32 bit Rt value will overflow if z2 and x is max, +z1 is minimal value and x_plate_ohms is relatively high (for example 800 +ohm). This would happen on some screen age with low pressure. + +There are two possible fixes: +- make Rt 64bit +- reorder calculation to avoid overflow + +The second variant seems to be preferable, since 64 bit calculation on +32 bit system is a bit more expensive. + +Fixes: ffa458c1bd9b6f653008d450f337602f3d52a646 ("spi: ads7846 driver") +Co-developed-by: David Jander +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Link: https://lore.kernel.org/r/20201113112240.1360-1-o.rempel@pengutronix.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/ads7846.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index 1e19af0da13a3..a5b1b41464f99 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -801,10 +801,11 @@ static void ads7846_report_state(struct ads7846 *ts) + /* compute touch pressure resistance using equation #2 */ + Rt = z2; + Rt -= z1; +- Rt *= x; + Rt *= ts->x_plate_ohms; ++ Rt = DIV_ROUND_CLOSEST(Rt, 16); ++ Rt *= x; + Rt /= z1; +- Rt = (Rt + 2047) >> 12; ++ Rt = DIV_ROUND_CLOSEST(Rt, 256); + } else { + Rt = 0; + } +-- +2.27.0 + diff --git a/queue-5.4/input-ads7846-fix-race-that-causes-missing-releases.patch b/queue-5.4/input-ads7846-fix-race-that-causes-missing-releases.patch new file mode 100644 index 00000000000..ff1888420c5 --- /dev/null +++ b/queue-5.4/input-ads7846-fix-race-that-causes-missing-releases.patch @@ -0,0 +1,103 @@ +From 70a3151b68ff5c5038fbf8648a9847d754a9ddbb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 11:00:59 -0800 +Subject: Input: ads7846 - fix race that causes missing releases + +From: David Jander + +[ Upstream commit e52cd628a03f72a547dbf90ccb703ee64800504a ] + +If touchscreen is released while busy reading HWMON device, the release +can be missed. The IRQ thread is not started because no touch is active +and BTN_TOUCH release event is never sent. + +Fixes: f5a28a7d4858f94a ("Input: ads7846 - avoid pen up/down when reading hwmon") +Co-developed-by: Oleksij Rempel +Signed-off-by: David Jander +Signed-off-by: Oleksij Rempel +Link: https://lore.kernel.org/r/20201027105416.18773-1-o.rempel@pengutronix.de +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/ads7846.c | 44 +++++++++++++++++------------ + 1 file changed, 26 insertions(+), 18 deletions(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index 51ddb204ca1ba..1e19af0da13a3 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -199,6 +199,26 @@ struct ads7846 { + #define REF_ON (READ_12BIT_DFR(x, 1, 1)) + #define REF_OFF (READ_12BIT_DFR(y, 0, 0)) + ++static int get_pendown_state(struct ads7846 *ts) ++{ ++ if (ts->get_pendown_state) ++ return ts->get_pendown_state(); ++ ++ return !gpio_get_value(ts->gpio_pendown); ++} ++ ++static void ads7846_report_pen_up(struct ads7846 *ts) ++{ ++ struct input_dev *input = ts->input; ++ ++ input_report_key(input, BTN_TOUCH, 0); ++ input_report_abs(input, ABS_PRESSURE, 0); ++ input_sync(input); ++ ++ ts->pendown = false; ++ dev_vdbg(&ts->spi->dev, "UP\n"); ++} ++ + /* Must be called with ts->lock held */ + static void ads7846_stop(struct ads7846 *ts) + { +@@ -215,6 +235,10 @@ static void ads7846_stop(struct ads7846 *ts) + static void ads7846_restart(struct ads7846 *ts) + { + if (!ts->disabled && !ts->suspended) { ++ /* Check if pen was released since last stop */ ++ if (ts->pendown && !get_pendown_state(ts)) ++ ads7846_report_pen_up(ts); ++ + /* Tell IRQ thread that it may poll the device. */ + ts->stopped = false; + mb(); +@@ -605,14 +629,6 @@ static const struct attribute_group ads784x_attr_group = { + + /*--------------------------------------------------------------------------*/ + +-static int get_pendown_state(struct ads7846 *ts) +-{ +- if (ts->get_pendown_state) +- return ts->get_pendown_state(); +- +- return !gpio_get_value(ts->gpio_pendown); +-} +- + static void null_wait_for_sync(void) + { + } +@@ -867,16 +883,8 @@ static irqreturn_t ads7846_irq(int irq, void *handle) + msecs_to_jiffies(TS_POLL_PERIOD)); + } + +- if (ts->pendown && !ts->stopped) { +- struct input_dev *input = ts->input; +- +- input_report_key(input, BTN_TOUCH, 0); +- input_report_abs(input, ABS_PRESSURE, 0); +- input_sync(input); +- +- ts->pendown = false; +- dev_vdbg(&ts->spi->dev, "UP\n"); +- } ++ if (ts->pendown && !ts->stopped) ++ ads7846_report_pen_up(ts); + + return IRQ_HANDLED; + } +-- +2.27.0 + diff --git a/queue-5.4/input-ads7846-fix-unaligned-access-on-7845.patch b/queue-5.4/input-ads7846-fix-unaligned-access-on-7845.patch new file mode 100644 index 00000000000..c1232bb107a --- /dev/null +++ b/queue-5.4/input-ads7846-fix-unaligned-access-on-7845.patch @@ -0,0 +1,43 @@ +From 87c4f7b6a445acc27b662fb884bcfc8e78ba6196 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 17:17:11 -0800 +Subject: Input: ads7846 - fix unaligned access on 7845 + +From: Dmitry Torokhov + +[ Upstream commit 03e2c9c782f721b661a0e42b1b58f394b5298544 ] + +req->sample[1] is not naturally aligned at word boundary, and therefore we +should use get_unaligned_be16() when accessing it. + +Fixes: 3eac5c7e44f3 ("Input: ads7846 - extend the driver for ads7845 controller support") +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/ads7846.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/input/touchscreen/ads7846.c b/drivers/input/touchscreen/ads7846.c +index a5b1b41464f99..d247d0ae82d26 100644 +--- a/drivers/input/touchscreen/ads7846.c ++++ b/drivers/input/touchscreen/ads7846.c +@@ -33,6 +33,7 @@ + #include + #include + #include ++#include + + /* + * This code has been heavily tested on a Nokia 770, and lightly +@@ -434,7 +435,7 @@ static int ads7845_read12_ser(struct device *dev, unsigned command) + + if (status == 0) { + /* BE12 value, then padding */ +- status = be16_to_cpu(*((u16 *)&req->sample[1])); ++ status = get_unaligned_be16(&req->sample[1]); + status = status >> 3; + status &= 0x0fff; + } +-- +2.27.0 + diff --git a/queue-5.4/input-cros_ec_keyb-send-scancodes-in-addition-to-key.patch b/queue-5.4/input-cros_ec_keyb-send-scancodes-in-addition-to-key.patch new file mode 100644 index 00000000000..3f0b731db65 --- /dev/null +++ b/queue-5.4/input-cros_ec_keyb-send-scancodes-in-addition-to-key.patch @@ -0,0 +1,37 @@ +From f038bd82ee29e03f94388146ec7d22b592103a18 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 17:59:53 -0800 +Subject: Input: cros_ec_keyb - send 'scancodes' in addition to key events + +From: Dmitry Torokhov + +[ Upstream commit 80db2a087f425b63f0163bc95217abd01c637cb5 ] + +To let userspace know what 'scancodes' should be used in EVIOCGKEYCODE +and EVIOCSKEYCODE ioctls, we should send EV_MSC/MSC_SCAN events in +addition to EV_KEY/KEY_* events. The driver already declared MSC_SCAN +capability, so it is only matter of actually sending the events. + +Link: https://lore.kernel.org/r/X87aOaSptPTvZ3nZ@google.com +Acked-by: Rajat Jain +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/cros_ec_keyb.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/input/keyboard/cros_ec_keyb.c b/drivers/input/keyboard/cros_ec_keyb.c +index 8d4d9786cc745..cae262b6ff398 100644 +--- a/drivers/input/keyboard/cros_ec_keyb.c ++++ b/drivers/input/keyboard/cros_ec_keyb.c +@@ -183,6 +183,7 @@ static void cros_ec_keyb_process(struct cros_ec_keyb *ckdev, + "changed: [r%d c%d]: byte %02x\n", + row, col, new_state); + ++ input_event(idev, EV_MSC, MSC_SCAN, pos); + input_report_key(idev, keycodes[pos], + new_state); + } +-- +2.27.0 + diff --git a/queue-5.4/input-goodix-add-upside-down-quirk-for-teclast-x98-p.patch b/queue-5.4/input-goodix-add-upside-down-quirk-for-teclast-x98-p.patch new file mode 100644 index 00000000000..7a1828d1549 --- /dev/null +++ b/queue-5.4/input-goodix-add-upside-down-quirk-for-teclast-x98-p.patch @@ -0,0 +1,47 @@ +From 0b5bf13166bbf86e74ac3942de6d1d72e8a90a85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Dec 2020 16:17:32 -0800 +Subject: Input: goodix - add upside-down quirk for Teclast X98 Pro tablet + +From: Simon Beginn + +[ Upstream commit cffdd6d90482316e18d686060a4397902ea04bd2 ] + +The touchscreen on the Teclast x98 Pro is also mounted upside-down in +relation to the display orientation. + +Signed-off-by: Simon Beginn +Signed-off-by: Bastien Nocera +Link: https://lore.kernel.org/r/20201117004253.27A5A27EFD@localhost +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/touchscreen/goodix.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index 37b35ab97beb2..bfb945fc33a17 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -137,6 +137,18 @@ static const struct dmi_system_id rotated_screen[] = { + DMI_MATCH(DMI_BIOS_DATE, "12/19/2014"), + }, + }, ++ { ++ .ident = "Teclast X98 Pro", ++ .matches = { ++ /* ++ * Only match BIOS date, because the manufacturers ++ * BIOS does not report the board name at all ++ * (sometimes)... ++ */ ++ DMI_MATCH(DMI_BOARD_VENDOR, "TECLAST"), ++ DMI_MATCH(DMI_BIOS_DATE, "10/28/2015"), ++ }, ++ }, + { + .ident = "WinBook TW100", + .matches = { +-- +2.27.0 + diff --git a/queue-5.4/input-omap4-keypad-fix-runtime-pm-error-handling.patch b/queue-5.4/input-omap4-keypad-fix-runtime-pm-error-handling.patch new file mode 100644 index 00000000000..b4083eb67e5 --- /dev/null +++ b/queue-5.4/input-omap4-keypad-fix-runtime-pm-error-handling.patch @@ -0,0 +1,202 @@ +From 5814644530ce34830f5c6510a004a6e2ce9c4ba0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 16:36:49 -0800 +Subject: Input: omap4-keypad - fix runtime PM error handling + +From: Zhang Qilong + +[ Upstream commit 59bbf83835f591b95c3bdd09d900f3584fa227af ] + +In omap4_keypad_probe, the patch fix several bugs. + + 1) pm_runtime_get_sync will increment pm usage counter even it + failed. Forgetting to pm_runtime_put_noidle will result in + reference leak. + + 2) In err_unmap, forget to disable runtime of device, + pm_runtime_enable will increase power disable depth. Thus a + pairing decrement is needed on the error handling path to keep + it balanced. + + 3) In err_pm_disable, it will call pm_runtime_put_sync twice not + one time. + +To fix this we factor out code reading revision and disabling touchpad, and +drop PM reference once we are done talking to the device. + +Fixes: f77621cc640a7 ("Input: omap-keypad - dynamically handle register offsets") +Fixes: 5ad567ffbaf20 ("Input: omap4-keypad - wire up runtime PM handling") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201120133918.2559681-1-zhangqilong3@huawei.com +Signed-off-by: Dmitry Torokhov +Signed-off-by: Sasha Levin +--- + drivers/input/keyboard/omap4-keypad.c | 89 ++++++++++++++++----------- + 1 file changed, 53 insertions(+), 36 deletions(-) + +diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c +index d6c924032aaa8..dd16f7b3c7ef6 100644 +--- a/drivers/input/keyboard/omap4-keypad.c ++++ b/drivers/input/keyboard/omap4-keypad.c +@@ -186,12 +186,8 @@ static int omap4_keypad_open(struct input_dev *input) + return 0; + } + +-static void omap4_keypad_close(struct input_dev *input) ++static void omap4_keypad_stop(struct omap4_keypad *keypad_data) + { +- struct omap4_keypad *keypad_data = input_get_drvdata(input); +- +- disable_irq(keypad_data->irq); +- + /* Disable interrupts and wake-up events */ + kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQENABLE, + OMAP4_VAL_IRQDISABLE); +@@ -200,7 +196,15 @@ static void omap4_keypad_close(struct input_dev *input) + /* clear pending interrupts */ + kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS, + kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS)); ++} ++ ++static void omap4_keypad_close(struct input_dev *input) ++{ ++ struct omap4_keypad *keypad_data; + ++ keypad_data = input_get_drvdata(input); ++ disable_irq(keypad_data->irq); ++ omap4_keypad_stop(keypad_data); + enable_irq(keypad_data->irq); + + pm_runtime_put_sync(input->dev.parent); +@@ -223,13 +227,37 @@ static int omap4_keypad_parse_dt(struct device *dev, + return 0; + } + ++static int omap4_keypad_check_revision(struct device *dev, ++ struct omap4_keypad *keypad_data) ++{ ++ unsigned int rev; ++ ++ rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION); ++ rev &= 0x03 << 30; ++ rev >>= 30; ++ switch (rev) { ++ case KBD_REVISION_OMAP4: ++ keypad_data->reg_offset = 0x00; ++ keypad_data->irqreg_offset = 0x00; ++ break; ++ case KBD_REVISION_OMAP5: ++ keypad_data->reg_offset = 0x10; ++ keypad_data->irqreg_offset = 0x0c; ++ break; ++ default: ++ dev_err(dev, "Keypad reports unsupported revision %d", rev); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + static int omap4_keypad_probe(struct platform_device *pdev) + { + struct omap4_keypad *keypad_data; + struct input_dev *input_dev; + struct resource *res; + unsigned int max_keys; +- int rev; + int irq; + int error; + +@@ -269,41 +297,33 @@ static int omap4_keypad_probe(struct platform_device *pdev) + goto err_release_mem; + } + ++ pm_runtime_enable(&pdev->dev); + + /* + * Enable clocks for the keypad module so that we can read + * revision register. + */ +- pm_runtime_enable(&pdev->dev); + error = pm_runtime_get_sync(&pdev->dev); + if (error) { + dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n"); +- goto err_unmap; +- } +- rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION); +- rev &= 0x03 << 30; +- rev >>= 30; +- switch (rev) { +- case KBD_REVISION_OMAP4: +- keypad_data->reg_offset = 0x00; +- keypad_data->irqreg_offset = 0x00; +- break; +- case KBD_REVISION_OMAP5: +- keypad_data->reg_offset = 0x10; +- keypad_data->irqreg_offset = 0x0c; +- break; +- default: +- dev_err(&pdev->dev, +- "Keypad reports unsupported revision %d", rev); +- error = -EINVAL; +- goto err_pm_put_sync; ++ pm_runtime_put_noidle(&pdev->dev); ++ } else { ++ error = omap4_keypad_check_revision(&pdev->dev, ++ keypad_data); ++ if (!error) { ++ /* Ensure device does not raise interrupts */ ++ omap4_keypad_stop(keypad_data); ++ } ++ pm_runtime_put_sync(&pdev->dev); + } ++ if (error) ++ goto err_pm_disable; + + /* input device allocation */ + keypad_data->input = input_dev = input_allocate_device(); + if (!input_dev) { + error = -ENOMEM; +- goto err_pm_put_sync; ++ goto err_pm_disable; + } + + input_dev->name = pdev->name; +@@ -349,28 +369,25 @@ static int omap4_keypad_probe(struct platform_device *pdev) + goto err_free_keymap; + } + +- device_init_wakeup(&pdev->dev, true); +- pm_runtime_put_sync(&pdev->dev); +- + error = input_register_device(keypad_data->input); + if (error < 0) { + dev_err(&pdev->dev, "failed to register input device\n"); +- goto err_pm_disable; ++ goto err_free_irq; + } + ++ device_init_wakeup(&pdev->dev, true); + platform_set_drvdata(pdev, keypad_data); ++ + return 0; + +-err_pm_disable: +- pm_runtime_disable(&pdev->dev); ++err_free_irq: + free_irq(keypad_data->irq, keypad_data); + err_free_keymap: + kfree(keypad_data->keymap); + err_free_input: + input_free_device(input_dev); +-err_pm_put_sync: +- pm_runtime_put_sync(&pdev->dev); +-err_unmap: ++err_pm_disable: ++ pm_runtime_disable(&pdev->dev); + iounmap(keypad_data->base); + err_release_mem: + release_mem_region(res->start, resource_size(res)); +-- +2.27.0 + diff --git a/queue-5.4/irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch b/queue-5.4/irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch new file mode 100644 index 00000000000..60104bcb46d --- /dev/null +++ b/queue-5.4/irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch @@ -0,0 +1,43 @@ +From f87741ffd1d2264192f3d514a17ffd28591bcd01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Nov 2020 13:55:25 +0000 +Subject: irqchip/alpine-msi: Fix freeing of interrupts on allocation error + path + +From: Marc Zyngier + +[ Upstream commit 3841245e8498a789c65dedd7ffa8fb2fee2c0684 ] + +The alpine-msi driver has an interesting allocation error handling, +where it frees the same interrupts repeatedly. Hilarity follows. + +This code is probably never executed, but let's fix it nonetheless. + +Fixes: e6b78f2c3e14 ("irqchip: Add the Alpine MSIX interrupt controller") +Signed-off-by: Marc Zyngier +Reviewed-by: Antoine Tenart +Cc: Tsahee Zidenberg +Cc: Antoine Tenart +Link: https://lore.kernel.org/r/20201129135525.396671-1-maz@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-alpine-msi.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c +index 23a3b877f7f1d..ede02dc2bcd0b 100644 +--- a/drivers/irqchip/irq-alpine-msi.c ++++ b/drivers/irqchip/irq-alpine-msi.c +@@ -165,8 +165,7 @@ static int alpine_msix_middle_domain_alloc(struct irq_domain *domain, + return 0; + + err_sgi: +- while (--i >= 0) +- irq_domain_free_irqs_parent(domain, virq, i); ++ irq_domain_free_irqs_parent(domain, virq, i - 1); + alpine_msix_free_sgi(priv, sgi, nr_irqs); + return err; + } +-- +2.27.0 + diff --git a/queue-5.4/iwlwifi-mvm-hook-up-missing-rx-handlers.patch b/queue-5.4/iwlwifi-mvm-hook-up-missing-rx-handlers.patch new file mode 100644 index 00000000000..60e975782c5 --- /dev/null +++ b/queue-5.4/iwlwifi-mvm-hook-up-missing-rx-handlers.patch @@ -0,0 +1,43 @@ +From 6b5d3e27e043d3579344fd02d45c604a31bbe03c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 23:16:47 +0200 +Subject: iwlwifi: mvm: hook up missing RX handlers + +From: Johannes Berg + +[ Upstream commit 8a59d39033c35bb484f6bd91891db86ebe07fdc2 ] + +The RX handlers for probe response data and channel switch weren't +hooked up properly, fix that. + +Fixes: 86e177d80ff7 ("iwlwifi: mvm: add NOA and CSA to a probe response") +Fixes: d3a108a48dc6 ("iwlwifi: mvm: Support CSA countdown offloading") +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20201209231352.2d07dcee0d35.I07a61b5d734478db57d9434ff303e4c90bf6c32b@changeid +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/ops.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +index 3acbd5b7ab4b2..b04cc6214bac8 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +@@ -316,6 +316,12 @@ static const struct iwl_rx_handlers iwl_mvm_rx_handlers[] = { + iwl_mvm_mu_mimo_grp_notif, RX_HANDLER_SYNC), + RX_HANDLER_GRP(DATA_PATH_GROUP, STA_PM_NOTIF, + iwl_mvm_sta_pm_notif, RX_HANDLER_SYNC), ++ RX_HANDLER_GRP(MAC_CONF_GROUP, PROBE_RESPONSE_DATA_NOTIF, ++ iwl_mvm_probe_resp_data_notif, ++ RX_HANDLER_ASYNC_LOCKED), ++ RX_HANDLER_GRP(MAC_CONF_GROUP, CHANNEL_SWITCH_NOA_NOTIF, ++ iwl_mvm_channel_switch_noa_notif, ++ RX_HANDLER_SYNC), + }; + #undef RX_HANDLER + #undef RX_HANDLER_GRP +-- +2.27.0 + diff --git a/queue-5.4/kconfig-fix-return-value-of-do_error_if.patch b/queue-5.4/kconfig-fix-return-value-of-do_error_if.patch new file mode 100644 index 00000000000..11fc2eaea5f --- /dev/null +++ b/queue-5.4/kconfig-fix-return-value-of-do_error_if.patch @@ -0,0 +1,36 @@ +From c824e71d882d05e8a5fa02a5dab642d88c2adb9a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Dec 2020 03:18:42 +0900 +Subject: kconfig: fix return value of do_error_if() + +From: Masahiro Yamada + +[ Upstream commit 135b4957eac43af2aedf8e2a277b9540f33c2558 ] + +$(error-if,...) is expanded to an empty string. Currently, it relies on +eval_clause() returning xstrdup("") when all attempts for expansion fail, +but the correct implementation is to make do_error_if() return xstrdup(""). + +Fixes: 1d6272e6fe43 ("kconfig: add 'info', 'warning-if', and 'error-if' built-in functions") +Signed-off-by: Masahiro Yamada +Signed-off-by: Sasha Levin +--- + scripts/kconfig/preprocess.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c +index 0243086fb1685..0590f86df6e40 100644 +--- a/scripts/kconfig/preprocess.c ++++ b/scripts/kconfig/preprocess.c +@@ -114,7 +114,7 @@ static char *do_error_if(int argc, char *argv[]) + if (!strcmp(argv[0], "y")) + pperror("%s", argv[1]); + +- return NULL; ++ return xstrdup(""); + } + + static char *do_filename(int argc, char *argv[]) +-- +2.27.0 + diff --git a/queue-5.4/lan743x-fix-rx_napi_poll-interrupt-ping-pong.patch b/queue-5.4/lan743x-fix-rx_napi_poll-interrupt-ping-pong.patch new file mode 100644 index 00000000000..b8ac31de748 --- /dev/null +++ b/queue-5.4/lan743x-fix-rx_napi_poll-interrupt-ping-pong.patch @@ -0,0 +1,148 @@ +From 4e17d3b469f9cfb0cdd757994e881467febbf3be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Dec 2020 11:19:54 -0500 +Subject: lan743x: fix rx_napi_poll/interrupt ping-pong + +From: Sven Van Asbroeck + +[ Upstream commit 57030a0b620f735bf557696e5ceb9f32c2b3bb8f ] + +Even if there is more rx data waiting on the chip, the rx napi poll fn +will never run more than once - it will always read a few buffers, then +bail out and re-arm interrupts. Which results in ping-pong between napi +and interrupt. + +This defeats the purpose of napi, and is bad for performance. + +Fix by making the rx napi poll behave identically to other ethernet +drivers: +1. initialize rx napi polling with an arbitrary budget (64). +2. in the polling fn, return full weight if rx queue is not depleted, + this tells the napi core to "keep polling". +3. update the rx tail ("ring the doorbell") once for every 8 processed + rx ring buffers. + +Thanks to Jakub Kicinski, Eric Dumazet and Andrew Lunn for their expert +opinions and suggestions. + +Tested with 20 seconds of full bandwidth receive (iperf3): + rx irqs softirqs(NET_RX) + ----------------------------- +before 23827 33620 +after 129 4081 + +Tested-by: Sven Van Asbroeck # lan7430 +Fixes: 23f0703c125be ("lan743x: Add main source files for new lan743x driver") +Signed-off-by: Sven Van Asbroeck +Link: https://lore.kernel.org/r/20201215161954.5950-1-TheSven73@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/microchip/lan743x_main.c | 43 ++++++++++--------- + 1 file changed, 23 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c +index 7526af27a59da..4bbdc53eaf3f3 100644 +--- a/drivers/net/ethernet/microchip/lan743x_main.c ++++ b/drivers/net/ethernet/microchip/lan743x_main.c +@@ -1899,6 +1899,14 @@ static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx) + length, GFP_ATOMIC | GFP_DMA); + } + ++static void lan743x_rx_update_tail(struct lan743x_rx *rx, int index) ++{ ++ /* update the tail once per 8 descriptors */ ++ if ((index & 7) == 7) ++ lan743x_csr_write(rx->adapter, RX_TAIL(rx->channel_number), ++ index); ++} ++ + static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index, + struct sk_buff *skb) + { +@@ -1929,6 +1937,7 @@ static int lan743x_rx_init_ring_element(struct lan743x_rx *rx, int index, + descriptor->data0 = (RX_DESC_DATA0_OWN_ | + (length & RX_DESC_DATA0_BUF_LENGTH_MASK_)); + skb_reserve(buffer_info->skb, RX_HEAD_PADDING); ++ lan743x_rx_update_tail(rx, index); + + return 0; + } +@@ -1947,6 +1956,7 @@ static void lan743x_rx_reuse_ring_element(struct lan743x_rx *rx, int index) + descriptor->data0 = (RX_DESC_DATA0_OWN_ | + ((buffer_info->buffer_length) & + RX_DESC_DATA0_BUF_LENGTH_MASK_)); ++ lan743x_rx_update_tail(rx, index); + } + + static void lan743x_rx_release_ring_element(struct lan743x_rx *rx, int index) +@@ -2158,6 +2168,7 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight) + { + struct lan743x_rx *rx = container_of(napi, struct lan743x_rx, napi); + struct lan743x_adapter *adapter = rx->adapter; ++ int result = RX_PROCESS_RESULT_NOTHING_TO_DO; + u32 rx_tail_flags = 0; + int count; + +@@ -2166,27 +2177,19 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight) + lan743x_csr_write(adapter, DMAC_INT_STS, + DMAC_INT_BIT_RXFRM_(rx->channel_number)); + } +- count = 0; +- while (count < weight) { +- int rx_process_result = lan743x_rx_process_packet(rx); +- +- if (rx_process_result == RX_PROCESS_RESULT_PACKET_RECEIVED) { +- count++; +- } else if (rx_process_result == +- RX_PROCESS_RESULT_NOTHING_TO_DO) { ++ for (count = 0; count < weight; count++) { ++ result = lan743x_rx_process_packet(rx); ++ if (result == RX_PROCESS_RESULT_NOTHING_TO_DO) + break; +- } else if (rx_process_result == +- RX_PROCESS_RESULT_PACKET_DROPPED) { +- continue; +- } + } + rx->frame_count += count; +- if (count == weight) +- goto done; ++ if (count == weight || result == RX_PROCESS_RESULT_PACKET_RECEIVED) ++ return weight; + + if (!napi_complete_done(napi, count)) +- goto done; ++ return count; + ++ /* re-arm interrupts, must write to rx tail on some chip variants */ + if (rx->vector_flags & LAN743X_VECTOR_FLAG_VECTOR_ENABLE_AUTO_SET) + rx_tail_flags |= RX_TAIL_SET_TOP_INT_VEC_EN_; + if (rx->vector_flags & LAN743X_VECTOR_FLAG_SOURCE_ENABLE_AUTO_SET) { +@@ -2196,10 +2199,10 @@ static int lan743x_rx_napi_poll(struct napi_struct *napi, int weight) + INT_BIT_DMA_RX_(rx->channel_number)); + } + +- /* update RX_TAIL */ +- lan743x_csr_write(adapter, RX_TAIL(rx->channel_number), +- rx_tail_flags | rx->last_tail); +-done: ++ if (rx_tail_flags) ++ lan743x_csr_write(adapter, RX_TAIL(rx->channel_number), ++ rx_tail_flags | rx->last_tail); ++ + return count; + } + +@@ -2344,7 +2347,7 @@ static int lan743x_rx_open(struct lan743x_rx *rx) + + netif_napi_add(adapter->netdev, + &rx->napi, lan743x_rx_napi_poll, +- rx->ring_size - 1); ++ NAPI_POLL_WEIGHT); + + lan743x_csr_write(adapter, DMAC_CMD, + DMAC_CMD_RX_SWR_(rx->channel_number)); +-- +2.27.0 + diff --git a/queue-5.4/leds-netxbig-add-missing-put_device-call-in-netxbig_.patch b/queue-5.4/leds-netxbig-add-missing-put_device-call-in-netxbig_.patch new file mode 100644 index 00000000000..6e336020cd5 --- /dev/null +++ b/queue-5.4/leds-netxbig-add-missing-put_device-call-in-netxbig_.patch @@ -0,0 +1,105 @@ +From 751c2f6e336e9779748c95cd3252b2c183c2dff0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 17:23:05 +0800 +Subject: leds: netxbig: add missing put_device() call in + netxbig_leds_get_of_pdata() + +From: Yu Kuai + +[ Upstream commit 311066aa9ebcd6f1789c829da5039ca02f2dfe46 ] + +if of_find_device_by_node() succeed, netxbig_leds_get_of_pdata() doesn't +have a corresponding put_device(). Thus add jump target to fix the +exception handling for this function implementation. + +Fixes: 2976b1798909 ("leds: netxbig: add device tree binding") +Signed-off-by: Yu Kuai +Signed-off-by: Pavel Machek +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-netxbig.c | 35 ++++++++++++++++++++++++----------- + 1 file changed, 24 insertions(+), 11 deletions(-) + +diff --git a/drivers/leds/leds-netxbig.c b/drivers/leds/leds-netxbig.c +index 14ef4ccdda3a8..c8699454418df 100644 +--- a/drivers/leds/leds-netxbig.c ++++ b/drivers/leds/leds-netxbig.c +@@ -430,31 +430,39 @@ static int netxbig_leds_get_of_pdata(struct device *dev, + gpio_ext = devm_kzalloc(dev, sizeof(*gpio_ext), GFP_KERNEL); + if (!gpio_ext) { + of_node_put(gpio_ext_np); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto put_device; + } + ret = gpio_ext_get_of_pdata(dev, gpio_ext_np, gpio_ext); + of_node_put(gpio_ext_np); + if (ret) +- return ret; ++ goto put_device; + pdata->gpio_ext = gpio_ext; + + /* Timers (optional) */ + ret = of_property_count_u32_elems(np, "timers"); + if (ret > 0) { +- if (ret % 3) +- return -EINVAL; ++ if (ret % 3) { ++ ret = -EINVAL; ++ goto put_device; ++ } ++ + num_timers = ret / 3; + timers = devm_kcalloc(dev, num_timers, sizeof(*timers), + GFP_KERNEL); +- if (!timers) +- return -ENOMEM; ++ if (!timers) { ++ ret = -ENOMEM; ++ goto put_device; ++ } + for (i = 0; i < num_timers; i++) { + u32 tmp; + + of_property_read_u32_index(np, "timers", 3 * i, + &timers[i].mode); +- if (timers[i].mode >= NETXBIG_LED_MODE_NUM) +- return -EINVAL; ++ if (timers[i].mode >= NETXBIG_LED_MODE_NUM) { ++ ret = -EINVAL; ++ goto put_device; ++ } + of_property_read_u32_index(np, "timers", + 3 * i + 1, &tmp); + timers[i].delay_on = tmp; +@@ -470,12 +478,15 @@ static int netxbig_leds_get_of_pdata(struct device *dev, + num_leds = of_get_child_count(np); + if (!num_leds) { + dev_err(dev, "No LED subnodes found in DT\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto put_device; + } + + leds = devm_kcalloc(dev, num_leds, sizeof(*leds), GFP_KERNEL); +- if (!leds) +- return -ENOMEM; ++ if (!leds) { ++ ret = -ENOMEM; ++ goto put_device; ++ } + + led = leds; + for_each_child_of_node(np, child) { +@@ -556,6 +567,8 @@ static int netxbig_leds_get_of_pdata(struct device *dev, + + err_node_put: + of_node_put(child); ++put_device: ++ put_device(gpio_ext_dev); + return ret; + } + +-- +2.27.0 + diff --git a/queue-5.4/libbpf-fix-btf-data-layout-checks-and-allow-empty-bt.patch b/queue-5.4/libbpf-fix-btf-data-layout-checks-and-allow-empty-bt.patch new file mode 100644 index 00000000000..30878080cfb --- /dev/null +++ b/queue-5.4/libbpf-fix-btf-data-layout-checks-and-allow-empty-bt.patch @@ -0,0 +1,64 @@ +From 1f2d746c4fb643b5e9a7394a8df008b8ed56afc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Nov 2020 20:33:57 -0800 +Subject: libbpf: Fix BTF data layout checks and allow empty BTF + +From: Andrii Nakryiko + +[ Upstream commit d8123624506cd62730c9cd9c7672c698e462703d ] + +Make data section layout checks stricter, disallowing overlap of types and +strings data. + +Additionally, allow BTFs with no type data. There is nothing inherently wrong +with having BTF with no types (put potentially with some strings). This could +be a situation with kernel module BTFs, if module doesn't introduce any new +type information. + +Also fix invalid offset alignment check for btf->hdr->type_off. + +Fixes: 8a138aed4a80 ("bpf: btf: Add BTF support to libbpf") +Signed-off-by: Andrii Nakryiko +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20201105043402.2530976-8-andrii@kernel.org +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/tools/lib/bpf/btf.c b/tools/lib/bpf/btf.c +index d606a358480da..3380aadb74655 100644 +--- a/tools/lib/bpf/btf.c ++++ b/tools/lib/bpf/btf.c +@@ -100,22 +100,18 @@ static int btf_parse_hdr(struct btf *btf) + return -EINVAL; + } + +- if (meta_left < hdr->type_off) { +- pr_debug("Invalid BTF type section offset:%u\n", hdr->type_off); ++ if (meta_left < hdr->str_off + hdr->str_len) { ++ pr_debug("Invalid BTF total size:%u\n", btf->raw_size); + return -EINVAL; + } + +- if (meta_left < hdr->str_off) { +- pr_debug("Invalid BTF string section offset:%u\n", hdr->str_off); ++ if (hdr->type_off + hdr->type_len > hdr->str_off) { ++ pr_debug("Invalid BTF data sections layout: type data at %u + %u, strings data at %u + %u\n", ++ hdr->type_off, hdr->type_len, hdr->str_off, hdr->str_len); + return -EINVAL; + } + +- if (hdr->type_off >= hdr->str_off) { +- pr_debug("BTF type section offset >= string section offset. No type?\n"); +- return -EINVAL; +- } +- +- if (hdr->type_off & 0x02) { ++ if (hdr->type_off % 4) { + pr_debug("BTF type section is not aligned to 4 bytes\n"); + return -EINVAL; + } +-- +2.27.0 + diff --git a/queue-5.4/libnvdimm-label-return-enxio-for-no-slot-in-__blk_la.patch b/queue-5.4/libnvdimm-label-return-enxio-for-no-slot-in-__blk_la.patch new file mode 100644 index 00000000000..5205a78add9 --- /dev/null +++ b/queue-5.4/libnvdimm-label-return-enxio-for-no-slot-in-__blk_la.patch @@ -0,0 +1,40 @@ +From cb73678805d9cdd42189a63acff9b78ad1663064 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Dec 2020 19:50:56 +0800 +Subject: libnvdimm/label: Return -ENXIO for no slot in __blk_label_update + +From: Zhang Qilong + +[ Upstream commit 4c46764733c85b82c07e9559b39da4d00a7dd659 ] + +Forget to set error code when nd_label_alloc_slot failed, and we +add it to avoid overwritten error code. + +Fixes: 0ba1c634892b ("libnvdimm: write blk label set") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201205115056.2076523-1-zhangqilong3@huawei.com +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/nvdimm/label.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c +index 47a4828b8b310..05c1f186a6be8 100644 +--- a/drivers/nvdimm/label.c ++++ b/drivers/nvdimm/label.c +@@ -999,8 +999,10 @@ static int __blk_label_update(struct nd_region *nd_region, + if (is_old_resource(res, old_res_list, old_num_resources)) + continue; /* carry-over */ + slot = nd_label_alloc_slot(ndd); +- if (slot == UINT_MAX) ++ if (slot == UINT_MAX) { ++ rc = -ENXIO; + goto abort; ++ } + dev_dbg(ndd->dev, "allocated: %d\n", slot); + + nd_label = to_label(ndd, slot); +-- +2.27.0 + diff --git a/queue-5.4/lockd-don-t-use-interval-based-rebinding-over-tcp.patch b/queue-5.4/lockd-don-t-use-interval-based-rebinding-over-tcp.patch new file mode 100644 index 00000000000..5295c85d381 --- /dev/null +++ b/queue-5.4/lockd-don-t-use-interval-based-rebinding-over-tcp.patch @@ -0,0 +1,99 @@ +From 8183dc5559c4e9771656e470c8153cd78ea70525 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 20:16:27 +0000 +Subject: lockd: don't use interval-based rebinding over TCP + +From: Calum Mackay + +[ Upstream commit 9b82d88d5976e5f2b8015d58913654856576ace5 ] + +NLM uses an interval-based rebinding, i.e. it clears the transport's +binding under certain conditions if more than 60 seconds have elapsed +since the connection was last bound. + +This rebinding is not necessary for an autobind RPC client over a +connection-oriented protocol like TCP. + +It can also cause problems: it is possible for nlm_bind_host() to clear +XPRT_BOUND whilst a connection worker is in the middle of trying to +reconnect, after it had already been checked in xprt_connect(). + +When the connection worker notices that XPRT_BOUND has been cleared +under it, in xs_tcp_finish_connecting(), that results in: + + xs_tcp_setup_socket: connect returned unhandled error -107 + +Worse, it's possible that the two can get into lockstep, resulting in +the same behaviour repeated indefinitely, with the above error every +300 seconds, without ever recovering, and the connection never being +established. This has been seen in practice, with a large number of NLM +client tasks, following a server restart. + +The existing callers of nlm_bind_host & nlm_rebind_host should not need +to force the rebind, for TCP, so restrict the interval-based rebinding +to UDP only. + +For TCP, we will still rebind when needed, e.g. on timeout, and connection +error (including closure), since connection-related errors on an existing +connection, ECONNREFUSED when trying to connect, and rpc_check_timeout(), +already unconditionally clear XPRT_BOUND. + +To avoid having to add the fix, and explanation, to both nlm_bind_host() +and nlm_rebind_host(), remove the duplicate code from the former, and +have it call the latter. + +Drop the dprintk, which adds no value over a trace. + +Signed-off-by: Calum Mackay +Fixes: 35f5a422ce1a ("SUNRPC: new interface to force an RPC rebind") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/lockd/host.c | 20 +++++++++++--------- + 1 file changed, 11 insertions(+), 9 deletions(-) + +diff --git a/fs/lockd/host.c b/fs/lockd/host.c +index 7d46fafdbbe5a..584c03e11844e 100644 +--- a/fs/lockd/host.c ++++ b/fs/lockd/host.c +@@ -439,12 +439,7 @@ nlm_bind_host(struct nlm_host *host) + * RPC rebind is required + */ + if ((clnt = host->h_rpcclnt) != NULL) { +- if (time_after_eq(jiffies, host->h_nextrebind)) { +- rpc_force_rebind(clnt); +- host->h_nextrebind = jiffies + NLM_HOST_REBIND; +- dprintk("lockd: next rebind in %lu jiffies\n", +- host->h_nextrebind - jiffies); +- } ++ nlm_rebind_host(host); + } else { + unsigned long increment = nlmsvc_timeout; + struct rpc_timeout timeparms = { +@@ -493,13 +488,20 @@ nlm_bind_host(struct nlm_host *host) + return clnt; + } + +-/* +- * Force a portmap lookup of the remote lockd port ++/** ++ * nlm_rebind_host - If needed, force a portmap lookup of the peer's lockd port ++ * @host: NLM host handle for peer ++ * ++ * This is not needed when using a connection-oriented protocol, such as TCP. ++ * The existing autobind mechanism is sufficient to force a rebind when ++ * required, e.g. on connection state transitions. + */ + void + nlm_rebind_host(struct nlm_host *host) + { +- dprintk("lockd: rebind host %s\n", host->h_name); ++ if (host->h_proto != IPPROTO_UDP) ++ return; ++ + if (host->h_rpcclnt && time_after_eq(jiffies, host->h_nextrebind)) { + rpc_force_rebind(host->h_rpcclnt); + host->h_nextrebind = jiffies + NLM_HOST_REBIND; +-- +2.27.0 + diff --git a/queue-5.4/lwt-disable-bh-too-in-run_lwt_bpf.patch b/queue-5.4/lwt-disable-bh-too-in-run_lwt_bpf.patch new file mode 100644 index 00000000000..21aba659a7b --- /dev/null +++ b/queue-5.4/lwt-disable-bh-too-in-run_lwt_bpf.patch @@ -0,0 +1,65 @@ +From 77628f3369d6b9a9d1527cff7e6db236a49f8178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 23:59:45 -0800 +Subject: lwt: Disable BH too in run_lwt_bpf() + +From: Dongdong Wang + +[ Upstream commit d9054a1ff585ba01029584ab730efc794603d68f ] + +The per-cpu bpf_redirect_info is shared among all skb_do_redirect() +and BPF redirect helpers. Callers on RX path are all in BH context, +disabling preemption is not sufficient to prevent BH interruption. + +In production, we observed strange packet drops because of the race +condition between LWT xmit and TC ingress, and we verified this issue +is fixed after we disable BH. + +Although this bug was technically introduced from the beginning, that +is commit 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure"), +at that time call_rcu() had to be call_rcu_bh() to match the RCU context. +So this patch may not work well before RCU flavor consolidation has been +completed around v5.0. + +Update the comments above the code too, as call_rcu() is now BH friendly. + +Signed-off-by: Dongdong Wang +Signed-off-by: Alexei Starovoitov +Reviewed-by: Cong Wang +Link: https://lore.kernel.org/bpf/20201205075946.497763-1-xiyou.wangcong@gmail.com +Signed-off-by: Sasha Levin +--- + net/core/lwt_bpf.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c +index 99a6de52b21da..a5502c5aa44e7 100644 +--- a/net/core/lwt_bpf.c ++++ b/net/core/lwt_bpf.c +@@ -39,12 +39,11 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt, + { + int ret; + +- /* Preempt disable is needed to protect per-cpu redirect_info between +- * BPF prog and skb_do_redirect(). The call_rcu in bpf_prog_put() and +- * access to maps strictly require a rcu_read_lock() for protection, +- * mixing with BH RCU lock doesn't work. ++ /* Preempt disable and BH disable are needed to protect per-cpu ++ * redirect_info between BPF prog and skb_do_redirect(). + */ + preempt_disable(); ++ local_bh_disable(); + bpf_compute_data_pointers(skb); + ret = bpf_prog_run_save_cb(lwt->prog, skb); + +@@ -78,6 +77,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt, + break; + } + ++ local_bh_enable(); + preempt_enable(); + + return ret; +-- +2.27.0 + diff --git a/queue-5.4/mac80211-don-t-set-set-tdls-sta-bandwidth-wider-than.patch b/queue-5.4/mac80211-don-t-set-set-tdls-sta-bandwidth-wider-than.patch new file mode 100644 index 00000000000..afa1d3f257d --- /dev/null +++ b/queue-5.4/mac80211-don-t-set-set-tdls-sta-bandwidth-wider-than.patch @@ -0,0 +1,71 @@ +From 003df4e919f22cf2331135a049cebac10853f4cf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Dec 2020 14:54:44 +0200 +Subject: mac80211: don't set set TDLS STA bandwidth wider than possible + +From: Johannes Berg + +[ Upstream commit f65607cdbc6b0da356ef5a22552ddd9313cf87a0 ] + +When we set up a TDLS station, we set sta->sta.bandwidth solely based +on the capabilities, because the "what's the current bandwidth" check +is bypassed and only applied for other types of stations. + +This leads to the unfortunate scenario that the sta->sta.bandwidth is +160 MHz if both stations support it, but we never actually configure +this bandwidth unless the AP is already using 160 MHz; even for wider +bandwidth support we only go up to 80 MHz (at least right now.) + +For iwlwifi, this can also lead to firmware asserts, telling us that +we've configured the TX rates for a higher bandwidth than is actually +available due to the PHY configuration. + +For non-TDLS, we check against the interface's requested bandwidth, +but we explicitly skip this check for TDLS to cope with the wider BW +case. Change this to + (a) still limit to the TDLS peer's own chandef, which gets factored + into the overall PHY configuration we request from the driver, + and + (b) limit it to when the TDLS peer is authorized, because it's only + factored into the channel context in this case. + +Fixes: 504871e602d9 ("mac80211: fix bandwidth computation for TDLS peers") +Signed-off-by: Johannes Berg +Signed-off-by: Luca Coelho +Link: https://lore.kernel.org/r/iwlwifi.20201206145305.fcc7d29c4590.I11f77e9e25ddf871a3c8d5604650c763e2c5887a@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/vht.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c +index aabc63dadf176..cea83fa5fc5b9 100644 +--- a/net/mac80211/vht.c ++++ b/net/mac80211/vht.c +@@ -446,12 +446,18 @@ enum ieee80211_sta_rx_bandwidth ieee80211_sta_cur_vht_bw(struct sta_info *sta) + * IEEE80211-2016 specification makes higher bandwidth operation + * possible on the TDLS link if the peers have wider bandwidth + * capability. ++ * ++ * However, in this case, and only if the TDLS peer is authorized, ++ * limit to the tdls_chandef so that the configuration here isn't ++ * wider than what's actually requested on the channel context. + */ + if (test_sta_flag(sta, WLAN_STA_TDLS_PEER) && +- test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW)) +- return bw; +- +- bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width)); ++ test_sta_flag(sta, WLAN_STA_TDLS_WIDER_BW) && ++ test_sta_flag(sta, WLAN_STA_AUTHORIZED) && ++ sta->tdls_chandef.chan) ++ bw = min(bw, ieee80211_chan_width_to_rx_bw(sta->tdls_chandef.width)); ++ else ++ bw = min(bw, ieee80211_chan_width_to_rx_bw(bss_width)); + + return bw; + } +-- +2.27.0 + diff --git a/queue-5.4/media-imx214-fix-stop-streaming.patch b/queue-5.4/media-imx214-fix-stop-streaming.patch new file mode 100644 index 00000000000..f1864134ae9 --- /dev/null +++ b/queue-5.4/media-imx214-fix-stop-streaming.patch @@ -0,0 +1,39 @@ +From 3a75066b2f9c9bc5402e5ec50e6ffc6429ddd5fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Oct 2019 16:46:24 +0200 +Subject: media: imx214: Fix stop streaming + +From: Daniel Gomez + +[ Upstream commit eeb76afbe8d91e112396c6281cd020725160f006 ] + +Stop video streaming when requested. + +When s_stream is called to stop the video streaming, if/else condition calls +start_streaming function instead of the one for stopping it. + +Fixes: 436190596241 ("media: imx214: Add imx214 camera sensor driver") +Signed-off-by: Daniel Gomez +Signed-off-by: Ricardo Ribalda +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/imx214.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/imx214.c b/drivers/media/i2c/imx214.c +index 159a3a604f0ed..24659cb0d0833 100644 +--- a/drivers/media/i2c/imx214.c ++++ b/drivers/media/i2c/imx214.c +@@ -785,7 +785,7 @@ static int imx214_s_stream(struct v4l2_subdev *subdev, int enable) + if (ret < 0) + goto err_rpm_put; + } else { +- ret = imx214_start_streaming(imx214); ++ ret = imx214_stop_streaming(imx214); + if (ret < 0) + goto err_rpm_put; + pm_runtime_put(imx214->dev); +-- +2.27.0 + diff --git a/queue-5.4/media-max2175-fix-max2175_set_csm_mode-error-code.patch b/queue-5.4/media-max2175-fix-max2175_set_csm_mode-error-code.patch new file mode 100644 index 00000000000..1dea9673d42 --- /dev/null +++ b/queue-5.4/media-max2175-fix-max2175_set_csm_mode-error-code.patch @@ -0,0 +1,36 @@ +From 7f0eac48fb9e1eb7caf04d0eb15bd97c244c4bf8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 4 Mar 2020 15:23:12 +0100 +Subject: media: max2175: fix max2175_set_csm_mode() error code + +From: Dan Carpenter + +[ Upstream commit 9b1b0cb0636166187478ef68d5b95f5caea062ec ] + +This is supposed to return negative error codes but the type is bool so +it returns true instead. + +Fixes: b47b79d8a231 ("[media] media: i2c: max2175: Add MAX2175 support") +Signed-off-by: Dan Carpenter +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/max2175.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/i2c/max2175.c b/drivers/media/i2c/max2175.c +index 19a3ceea3bc20..a62d7e2ac3567 100644 +--- a/drivers/media/i2c/max2175.c ++++ b/drivers/media/i2c/max2175.c +@@ -503,7 +503,7 @@ static void max2175_set_bbfilter(struct max2175 *ctx) + } + } + +-static bool max2175_set_csm_mode(struct max2175 *ctx, ++static int max2175_set_csm_mode(struct max2175 *ctx, + enum max2175_csm_mode new_mode) + { + int ret = max2175_poll_csm_ready(ctx); +-- +2.27.0 + diff --git a/queue-5.4/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch b/queue-5.4/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch new file mode 100644 index 00000000000..ea8d13e0af0 --- /dev/null +++ b/queue-5.4/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch @@ -0,0 +1,74 @@ +From 7057f339315b51daed37ecf95aeaf5ac1428afdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 14:38:01 +0200 +Subject: media: mtk-vcodec: add missing put_device() call in + mtk_vcodec_init_dec_pm() + +From: Yu Kuai + +[ Upstream commit 5d4fa2c50125c9cda9e380d89268757cc5fa743d ] + +if of_find_device_by_node() succeed, mtk_vcodec_init_dec_pm() doesn't have +a corresponding put_device(). Thus add jump target to fix the exception +handling for this function implementation. + +Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver") +Signed-off-by: Yu Kuai +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 18 ++++++++++++------ + 1 file changed, 12 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c +index 5a6ec8fb52daa..01e680ede9bd5 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c +@@ -48,11 +48,14 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev) + dec_clk->clk_info = devm_kcalloc(&pdev->dev, + dec_clk->clk_num, sizeof(*clk_info), + GFP_KERNEL); +- if (!dec_clk->clk_info) +- return -ENOMEM; ++ if (!dec_clk->clk_info) { ++ ret = -ENOMEM; ++ goto put_device; ++ } + } else { + mtk_v4l2_err("Failed to get vdec clock count"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_device; + } + + for (i = 0; i < dec_clk->clk_num; i++) { +@@ -61,19 +64,22 @@ int mtk_vcodec_init_dec_pm(struct mtk_vcodec_dev *mtkdev) + "clock-names", i, &clk_info->clk_name); + if (ret) { + mtk_v4l2_err("Failed to get clock name id = %d", i); +- return ret; ++ goto put_device; + } + clk_info->vcodec_clk = devm_clk_get(&pdev->dev, + clk_info->clk_name); + if (IS_ERR(clk_info->vcodec_clk)) { + mtk_v4l2_err("devm_clk_get (%d)%s fail", i, + clk_info->clk_name); +- return PTR_ERR(clk_info->vcodec_clk); ++ ret = PTR_ERR(clk_info->vcodec_clk); ++ goto put_device; + } + } + + pm_runtime_enable(&pdev->dev); +- ++ return 0; ++put_device: ++ put_device(pm->larbvdec); + return ret; + } + +-- +2.27.0 + diff --git a/queue-5.4/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-14782 b/queue-5.4/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-14782 new file mode 100644 index 00000000000..c1e2202707a --- /dev/null +++ b/queue-5.4/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-14782 @@ -0,0 +1,44 @@ +From 32259908933d00bc48cb55f0aa98a46ec52093f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 14:38:02 +0200 +Subject: media: mtk-vcodec: add missing put_device() call in + mtk_vcodec_release_dec_pm() + +From: Yu Kuai + +[ Upstream commit 27c3943683f74e35e1d390ceb2e3639eff616ad6 ] + +mtk_vcodec_release_dec_pm() will be called in two places: + +a. mtk_vcodec_init_dec_pm() succeed while mtk_vcodec_probe() return error. +b. mtk_vcodec_dec_remove(). + +In both cases put_device() call is needed, since of_find_device_by_node() +was called in mtk_vcodec_init_dec_pm() previously. + +Thus add put_devices() call in mtk_vcodec_release_dec_pm() + +Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver") +Signed-off-by: Yu Kuai +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c +index 01e680ede9bd5..f9bbd0000bf3e 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_dec_pm.c +@@ -86,6 +86,7 @@ put_device: + void mtk_vcodec_release_dec_pm(struct mtk_vcodec_dev *dev) + { + pm_runtime_disable(dev->pm.dev); ++ put_device(dev->pm.larbvdec); + } + + void mtk_vcodec_dec_pw_on(struct mtk_vcodec_pm *pm) +-- +2.27.0 + diff --git a/queue-5.4/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-28026 b/queue-5.4/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-28026 new file mode 100644 index 00000000000..da551e48af7 --- /dev/null +++ b/queue-5.4/media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-28026 @@ -0,0 +1,94 @@ +From 91618e48665ac00025cbb290d0adad3bcfb23568 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 14:38:03 +0200 +Subject: media: mtk-vcodec: add missing put_device() call in + mtk_vcodec_init_enc_pm() + +From: Yu Kuai + +[ Upstream commit 4affafd7bec7c65da31777f18bd20420f1aeb5f8 ] + +if of_find_device_by_node() succeed, mtk_vcodec_init_enc_pm() doesn't have +a corresponding put_device(). Thus add jump target to fix the exception +handling for this function implementation. + +Fixes: 4e855a6efa54 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Encoder Driver") +Signed-off-by: Yu Kuai +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../platform/mtk-vcodec/mtk_vcodec_enc_pm.c | 26 ++++++++++++++----- + 1 file changed, 19 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c +index 3e2bfded79a66..e682bdb1ed453 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_enc_pm.c +@@ -49,14 +49,16 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev) + node = of_parse_phandle(dev->of_node, "mediatek,larb", 1); + if (!node) { + mtk_v4l2_err("no mediatek,larb found"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto put_larbvenc; + } + + pdev = of_find_device_by_node(node); + of_node_put(node); + if (!pdev) { + mtk_v4l2_err("no mediatek,larb device found"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto put_larbvenc; + } + + pm->larbvenclt = &pdev->dev; +@@ -69,11 +71,14 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev) + enc_clk->clk_info = devm_kcalloc(&pdev->dev, + enc_clk->clk_num, sizeof(*clk_info), + GFP_KERNEL); +- if (!enc_clk->clk_info) +- return -ENOMEM; ++ if (!enc_clk->clk_info) { ++ ret = -ENOMEM; ++ goto put_larbvenclt; ++ } + } else { + mtk_v4l2_err("Failed to get venc clock count"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_larbvenclt; + } + + for (i = 0; i < enc_clk->clk_num; i++) { +@@ -82,17 +87,24 @@ int mtk_vcodec_init_enc_pm(struct mtk_vcodec_dev *mtkdev) + "clock-names", i, &clk_info->clk_name); + if (ret) { + mtk_v4l2_err("venc failed to get clk name %d", i); +- return ret; ++ goto put_larbvenclt; + } + clk_info->vcodec_clk = devm_clk_get(&pdev->dev, + clk_info->clk_name); + if (IS_ERR(clk_info->vcodec_clk)) { + mtk_v4l2_err("venc devm_clk_get (%d)%s fail", i, + clk_info->clk_name); +- return PTR_ERR(clk_info->vcodec_clk); ++ ret = PTR_ERR(clk_info->vcodec_clk); ++ goto put_larbvenclt; + } + } + ++ return 0; ++ ++put_larbvenclt: ++ put_device(pm->larbvenclt); ++put_larbvenc: ++ put_device(pm->larbvenc); + return ret; + } + +-- +2.27.0 + diff --git a/queue-5.4/media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch b/queue-5.4/media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch new file mode 100644 index 00000000000..bcc566c5dd3 --- /dev/null +++ b/queue-5.4/media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch @@ -0,0 +1,56 @@ +From e71a86f003dc08c5196f29dc9e3f42a29804e977 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 08:23:40 +0100 +Subject: media: saa7146: fix array overflow in vidioc_s_audio() + +From: Dan Carpenter + +[ Upstream commit 8e4d86e241cf035d6d3467cd346e7ce490681937 ] + +The "a->index" value comes from the user via the ioctl. The problem is +that the shift can wrap resulting in setting "mxb->cur_audinput" to an +invalid value, which later results in an array overflow. + +Fixes: 6680427791c9 ("[media] mxb: fix audio handling") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7146/mxb.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/media/pci/saa7146/mxb.c b/drivers/media/pci/saa7146/mxb.c +index e6a71c17566d2..952ea250feda0 100644 +--- a/drivers/media/pci/saa7146/mxb.c ++++ b/drivers/media/pci/saa7146/mxb.c +@@ -641,16 +641,17 @@ static int vidioc_s_audio(struct file *file, void *fh, const struct v4l2_audio * + struct mxb *mxb = (struct mxb *)dev->ext_priv; + + DEB_D("VIDIOC_S_AUDIO %d\n", a->index); +- if (mxb_inputs[mxb->cur_input].audioset & (1 << a->index)) { +- if (mxb->cur_audinput != a->index) { +- mxb->cur_audinput = a->index; +- tea6420_route(mxb, a->index); +- if (mxb->cur_audinput == 0) +- mxb_update_audmode(mxb); +- } +- return 0; ++ if (a->index >= 32 || ++ !(mxb_inputs[mxb->cur_input].audioset & (1 << a->index))) ++ return -EINVAL; ++ ++ if (mxb->cur_audinput != a->index) { ++ mxb->cur_audinput = a->index; ++ tea6420_route(mxb, a->index); ++ if (mxb->cur_audinput == 0) ++ mxb_update_audmode(mxb); + } +- return -EINVAL; ++ return 0; + } + + #ifdef CONFIG_VIDEO_ADV_DEBUG +-- +2.27.0 + diff --git a/queue-5.4/media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch b/queue-5.4/media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch new file mode 100644 index 00000000000..1059c4503d2 --- /dev/null +++ b/queue-5.4/media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch @@ -0,0 +1,47 @@ +From ea87727af053e6709716d2f3e5a5322d193f63b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Sep 2020 14:56:57 +0200 +Subject: media: siano: fix memory leak of debugfs members in smsdvb_hotplug + +From: Keita Suzuki + +[ Upstream commit abf287eeff4c6da6aa804bbd429dfd9d0dfb6ea7 ] + +When dvb_create_media_graph fails, the debugfs kept inside client should +be released. However, the current implementation does not release them. + +Fix this by adding a new goto label to call smsdvb_debugfs_release. + +Fixes: 0d3ab8410dcb ("[media] dvb core: must check dvb_create_media_graph()") +Signed-off-by: Keita Suzuki +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/common/siano/smsdvb-main.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/common/siano/smsdvb-main.c b/drivers/media/common/siano/smsdvb-main.c +index 88f90dfd368b1..ae17407e477a4 100644 +--- a/drivers/media/common/siano/smsdvb-main.c ++++ b/drivers/media/common/siano/smsdvb-main.c +@@ -1169,12 +1169,15 @@ static int smsdvb_hotplug(struct smscore_device_t *coredev, + rc = dvb_create_media_graph(&client->adapter, true); + if (rc < 0) { + pr_err("dvb_create_media_graph failed %d\n", rc); +- goto client_error; ++ goto media_graph_error; + } + + pr_info("DVB interface registered.\n"); + return 0; + ++media_graph_error: ++ smsdvb_debugfs_release(client); ++ + client_error: + dvb_unregister_frontend(&client->frontend); + +-- +2.27.0 + diff --git a/queue-5.4/media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch b/queue-5.4/media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch new file mode 100644 index 00000000000..b03ee253dac --- /dev/null +++ b/queue-5.4/media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch @@ -0,0 +1,38 @@ +From 1c6f843aa21156bad35e35eb79c26c2c3901a504 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Nov 2020 04:22:01 +0100 +Subject: media: solo6x10: fix missing snd_card_free in error handling case + +From: Qinglang Miao + +[ Upstream commit dcdff74fa6bc00c32079d0bebd620764c26f2d89 ] + +Fix to goto snd_error in error handling case when fails +to do snd_ctl_add, as done elsewhere in this function. + +Fixes: 28cae868cd24 ("[media] solo6x10: move out of staging into drivers/media/pci.") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/solo6x10/solo6x10-g723.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/pci/solo6x10/solo6x10-g723.c b/drivers/media/pci/solo6x10/solo6x10-g723.c +index 30c8f2ec9c3cc..809e4e65bb6e7 100644 +--- a/drivers/media/pci/solo6x10/solo6x10-g723.c ++++ b/drivers/media/pci/solo6x10/solo6x10-g723.c +@@ -399,7 +399,7 @@ int solo_g723_init(struct solo_dev *solo_dev) + + ret = snd_ctl_add(card, snd_ctl_new1(&kctl, solo_dev)); + if (ret < 0) +- return ret; ++ goto snd_error; + + ret = solo_snd_pcm_init(solo_dev); + if (ret < 0) +-- +2.27.0 + diff --git a/queue-5.4/media-tm6000-fix-sizeof-mismatches.patch b/queue-5.4/media-tm6000-fix-sizeof-mismatches.patch new file mode 100644 index 00000000000..63c965119f7 --- /dev/null +++ b/queue-5.4/media-tm6000-fix-sizeof-mismatches.patch @@ -0,0 +1,49 @@ +From ec0d14fe5a757f805bed1456484fc7dbef94aec1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 23:12:23 +0200 +Subject: media: tm6000: Fix sizeof() mismatches + +From: Colin Ian King + +[ Upstream commit a08ad6339e0441ca12533969ed94a87e3655426e ] + +The are two instances of sizeof() being used incorrectly. The +sizeof(void *) is incorrect because urb_buffer is a char ** pointer, +fix this by using sizeof(*dev->urb_buffer). The sizeof(dma_addr_t *) +is incorrect, it should be sizeof(*dev->urb_dma), which is a dma_addr_t +and not a dma_addr_t *. This errors did not cause any issues because +it just so happens the sizes are the same. + +Addresses-Coverity: ("Sizeof not portable (SIZEOF_MISMATCH)") + +Fixes: 16427faf2867 ("[media] tm6000: Add parameter to keep urb bufs allocated") +Signed-off-by: Colin Ian King +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/tm6000/tm6000-video.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/usb/tm6000/tm6000-video.c b/drivers/media/usb/tm6000/tm6000-video.c +index c07a81a6cbe29..c46cbcfafab3f 100644 +--- a/drivers/media/usb/tm6000/tm6000-video.c ++++ b/drivers/media/usb/tm6000/tm6000-video.c +@@ -461,11 +461,12 @@ static int tm6000_alloc_urb_buffers(struct tm6000_core *dev) + if (dev->urb_buffer) + return 0; + +- dev->urb_buffer = kmalloc_array(num_bufs, sizeof(void *), GFP_KERNEL); ++ dev->urb_buffer = kmalloc_array(num_bufs, sizeof(*dev->urb_buffer), ++ GFP_KERNEL); + if (!dev->urb_buffer) + return -ENOMEM; + +- dev->urb_dma = kmalloc_array(num_bufs, sizeof(dma_addr_t *), ++ dev->urb_dma = kmalloc_array(num_bufs, sizeof(*dev->urb_dma), + GFP_KERNEL); + if (!dev->urb_dma) + return -ENOMEM; +-- +2.27.0 + diff --git a/queue-5.4/media-v4l2-fwnode-return-einval-for-invalid-bus-type.patch b/queue-5.4/media-v4l2-fwnode-return-einval-for-invalid-bus-type.patch new file mode 100644 index 00000000000..ebe740a21f2 --- /dev/null +++ b/queue-5.4/media-v4l2-fwnode-return-einval-for-invalid-bus-type.patch @@ -0,0 +1,68 @@ +From d967a223958adcbf47f7df6060656e04310521c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Sep 2020 18:08:47 +0200 +Subject: media: v4l2-fwnode: Return -EINVAL for invalid bus-type + +From: Lad Prabhakar + +[ Upstream commit 69baf338fc16a4d55c78da8874ce3f06feb38c78 ] + +Return -EINVAL if invalid bus-type is detected while parsing endpoints. + +Fixes: 26c1126c9b56 ("media: v4l: fwnode: Use media bus type for bus parser selection") +Signed-off-by: Lad Prabhakar +Signed-off-by: Sakari Ailus +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-fwnode.c | 6 +++++- + include/media/v4l2-mediabus.h | 2 ++ + 2 files changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c +index 3bd1888787eb3..48c3b9f72722a 100644 +--- a/drivers/media/v4l2-core/v4l2-fwnode.c ++++ b/drivers/media/v4l2-core/v4l2-fwnode.c +@@ -93,7 +93,7 @@ v4l2_fwnode_bus_type_to_mbus(enum v4l2_fwnode_bus_type type) + const struct v4l2_fwnode_bus_conv *conv = + get_v4l2_fwnode_bus_conv_by_fwnode_bus(type); + +- return conv ? conv->mbus_type : V4L2_MBUS_UNKNOWN; ++ return conv ? conv->mbus_type : V4L2_MBUS_INVALID; + } + + static const char * +@@ -436,6 +436,10 @@ static int __v4l2_fwnode_endpoint_parse(struct fwnode_handle *fwnode, + v4l2_fwnode_mbus_type_to_string(vep->bus_type), + vep->bus_type); + mbus_type = v4l2_fwnode_bus_type_to_mbus(bus_type); ++ if (mbus_type == V4L2_MBUS_INVALID) { ++ pr_debug("unsupported bus type %u\n", bus_type); ++ return -EINVAL; ++ } + + if (vep->bus_type != V4L2_MBUS_UNKNOWN) { + if (mbus_type != V4L2_MBUS_UNKNOWN && +diff --git a/include/media/v4l2-mediabus.h b/include/media/v4l2-mediabus.h +index 45f88f0248c4e..c072ed1418113 100644 +--- a/include/media/v4l2-mediabus.h ++++ b/include/media/v4l2-mediabus.h +@@ -78,6 +78,7 @@ + * @V4L2_MBUS_CCP2: CCP2 (Compact Camera Port 2) + * @V4L2_MBUS_CSI2_DPHY: MIPI CSI-2 serial interface, with D-PHY + * @V4L2_MBUS_CSI2_CPHY: MIPI CSI-2 serial interface, with C-PHY ++ * @V4L2_MBUS_INVALID: invalid bus type (keep as last) + */ + enum v4l2_mbus_type { + V4L2_MBUS_UNKNOWN, +@@ -87,6 +88,7 @@ enum v4l2_mbus_type { + V4L2_MBUS_CCP2, + V4L2_MBUS_CSI2_DPHY, + V4L2_MBUS_CSI2_CPHY, ++ V4L2_MBUS_INVALID, + }; + + /** +-- +2.27.0 + diff --git a/queue-5.4/memstick-fix-a-double-free-bug-in-memstick_check.patch b/queue-5.4/memstick-fix-a-double-free-bug-in-memstick_check.patch new file mode 100644 index 00000000000..e6b99ecbf78 --- /dev/null +++ b/queue-5.4/memstick-fix-a-double-free-bug-in-memstick_check.patch @@ -0,0 +1,37 @@ +From 2822578a967b25d8577c771330b7aac17937a373 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 15:48:46 +0800 +Subject: memstick: fix a double-free bug in memstick_check + +From: Qinglang Miao + +[ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ] + +kfree(host->card) has been called in put_device so that +another kfree would raise cause a double-free bug. + +Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/memstick/core/memstick.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c +index ef03d6fafc5ce..12bc3f5a6cbbd 100644 +--- a/drivers/memstick/core/memstick.c ++++ b/drivers/memstick/core/memstick.c +@@ -468,7 +468,6 @@ static void memstick_check(struct work_struct *work) + host->card = card; + if (device_register(&card->dev)) { + put_device(&card->dev); +- kfree(host->card); + host->card = NULL; + } + } else +-- +2.27.0 + diff --git a/queue-5.4/memstick-r592-fix-error-return-in-r592_probe.patch b/queue-5.4/memstick-r592-fix-error-return-in-r592_probe.patch new file mode 100644 index 00000000000..2a88ac1dc0c --- /dev/null +++ b/queue-5.4/memstick-r592-fix-error-return-in-r592_probe.patch @@ -0,0 +1,57 @@ +From 0d2f196a398639ab542f41cd4b35857430f43ad7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 09:47:18 +0800 +Subject: memstick: r592: Fix error return in r592_probe() + +From: Jing Xiangfeng + +[ Upstream commit db29d3d1c2451e673e29c7257471e3ce9d50383a ] + +Fix to return a error code from the error handling case instead of 0. + +Fixes: 926341250102 ("memstick: add driver for Ricoh R5C592 card reader") +Signed-off-by: Jing Xiangfeng +Link: https://lore.kernel.org/r/20201125014718.153563-1-jingxiangfeng@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/memstick/host/r592.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/memstick/host/r592.c b/drivers/memstick/host/r592.c +index dd3a1f3dcc191..d2ef46337191c 100644 +--- a/drivers/memstick/host/r592.c ++++ b/drivers/memstick/host/r592.c +@@ -759,8 +759,10 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id) + goto error3; + + dev->mmio = pci_ioremap_bar(pdev, 0); +- if (!dev->mmio) ++ if (!dev->mmio) { ++ error = -ENOMEM; + goto error4; ++ } + + dev->irq = pdev->irq; + spin_lock_init(&dev->irq_lock); +@@ -786,12 +788,14 @@ static int r592_probe(struct pci_dev *pdev, const struct pci_device_id *id) + &dev->dummy_dma_page_physical_address, GFP_KERNEL); + r592_stop_dma(dev , 0); + +- if (request_irq(dev->irq, &r592_irq, IRQF_SHARED, +- DRV_NAME, dev)) ++ error = request_irq(dev->irq, &r592_irq, IRQF_SHARED, ++ DRV_NAME, dev); ++ if (error) + goto error6; + + r592_update_card_detect(dev); +- if (memstick_add_host(host)) ++ error = memstick_add_host(host); ++ if (error) + goto error7; + + message("driver successfully loaded"); +-- +2.27.0 + diff --git a/queue-5.4/mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch b/queue-5.4/mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch new file mode 100644 index 00000000000..dbe28ee1851 --- /dev/null +++ b/queue-5.4/mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch @@ -0,0 +1,48 @@ +From db361ae3818c300c49bce00c3158471bf1142dca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 00:34:01 +0300 +Subject: MIPS: BCM47XX: fix kconfig dependency bug for BCM47XX_BCMA + +From: Necip Fazil Yildiran + +[ Upstream commit 3a5fe2fb9635c43359c9729352f45044f3c8df6b ] + +When BCM47XX_BCMA is enabled and BCMA_DRIVER_PCI is disabled, it results +in the following Kbuild warning: + +WARNING: unmet direct dependencies detected for BCMA_DRIVER_PCI_HOSTMODE + Depends on [n]: MIPS [=y] && BCMA_DRIVER_PCI [=n] && PCI_DRIVERS_LEGACY [=y] && BCMA [=y]=y + Selected by [y]: + - BCM47XX_BCMA [=y] && BCM47XX [=y] && PCI [=y] + +The reason is that BCM47XX_BCMA selects BCMA_DRIVER_PCI_HOSTMODE without +depending on or selecting BCMA_DRIVER_PCI while BCMA_DRIVER_PCI_HOSTMODE +depends on BCMA_DRIVER_PCI. This can also fail building the kernel. + +Honor the kconfig dependency to remove unmet direct dependency warnings +and avoid any potential build failures. + +Fixes: c1d1c5d4213e ("bcm47xx: add support for bcma bus") +Link: https://bugzilla.kernel.org/show_bug.cgi?id=209879 +Signed-off-by: Necip Fazil Yildiran +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/bcm47xx/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/bcm47xx/Kconfig b/arch/mips/bcm47xx/Kconfig +index 6889f74e06f54..490bb6da74b7e 100644 +--- a/arch/mips/bcm47xx/Kconfig ++++ b/arch/mips/bcm47xx/Kconfig +@@ -27,6 +27,7 @@ config BCM47XX_BCMA + select BCMA + select BCMA_HOST_SOC + select BCMA_DRIVER_MIPS ++ select BCMA_DRIVER_PCI if PCI + select BCMA_DRIVER_PCI_HOSTMODE if PCI + select BCMA_DRIVER_GPIO + default y +-- +2.27.0 + diff --git a/queue-5.4/mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch b/queue-5.4/mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch new file mode 100644 index 00000000000..ef1e504fc68 --- /dev/null +++ b/queue-5.4/mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch @@ -0,0 +1,41 @@ +From e0ae96ededda59f9e8cf36366dec0b2e6ae67c6f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Nov 2020 15:48:47 +0800 +Subject: mips: cdmm: fix use-after-free in mips_cdmm_bus_discover + +From: Qinglang Miao + +[ Upstream commit f0e82242b16826077a2775eacfe201d803bb7a22 ] + +kfree(dev) has been called inside put_device so anther +kfree would cause a use-after-free bug/ + +Fixes: 8286ae03308c ("MIPS: Add CDMM bus support") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Acked-by: Serge Semin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + drivers/bus/mips_cdmm.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c +index 1b14256376d24..7c1da45be166e 100644 +--- a/drivers/bus/mips_cdmm.c ++++ b/drivers/bus/mips_cdmm.c +@@ -544,10 +544,8 @@ static void mips_cdmm_bus_discover(struct mips_cdmm_bus *bus) + dev_set_name(&dev->dev, "cdmm%u-%u", cpu, id); + ++id; + ret = device_register(&dev->dev); +- if (ret) { ++ if (ret) + put_device(&dev->dev); +- kfree(dev); +- } + } + } + +-- +2.27.0 + diff --git a/queue-5.4/mips-don-t-round-up-kernel-sections-size-for-membloc.patch b/queue-5.4/mips-don-t-round-up-kernel-sections-size-for-membloc.patch new file mode 100644 index 00000000000..653a4f7f5b6 --- /dev/null +++ b/queue-5.4/mips-don-t-round-up-kernel-sections-size-for-membloc.patch @@ -0,0 +1,44 @@ +From ec2b4596bfe5fc58fe5b4e69c39df98d6f259b0f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 13:36:48 +0100 +Subject: MIPS: Don't round up kernel sections size for memblock_add() + +From: Alexander Sverdlin + +[ Upstream commit d121f125af22a16f0f679293756d28a9691fa46d ] + +Linux doesn't own the memory immediately after the kernel image. On Octeon +bootloader places a shared structure right close after the kernel _end, +refer to "struct cvmx_bootinfo *octeon_bootinfo" in cavium-octeon/setup.c. + +If check_kernel_sections_mem() rounds the PFNs up, first memblock_alloc() +inside early_init_dt_alloc_memory_arch() <= device_tree_init() returns +memory block overlapping with the above octeon_bootinfo structure, which +is being overwritten afterwards. + +Fixes: a94e4f24ec83 ("MIPS: init: Drop boot_mem_map") +Signed-off-by: Alexander Sverdlin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/kernel/setup.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c +index b8884de89c81e..82e44b31aad59 100644 +--- a/arch/mips/kernel/setup.c ++++ b/arch/mips/kernel/setup.c +@@ -529,8 +529,8 @@ static void __init request_crashkernel(struct resource *res) + + static void __init check_kernel_sections_mem(void) + { +- phys_addr_t start = PFN_PHYS(PFN_DOWN(__pa_symbol(&_text))); +- phys_addr_t size = PFN_PHYS(PFN_UP(__pa_symbol(&_end))) - start; ++ phys_addr_t start = __pa_symbol(&_text); ++ phys_addr_t size = __pa_symbol(&_end) - start; + + if (!memblock_is_region_memory(start, size)) { + pr_info("Kernel sections are not in the memory maps\n"); +-- +2.27.0 + diff --git a/queue-5.4/mm-don-t-wake-kswapd-prematurely-when-watermark-boos.patch b/queue-5.4/mm-don-t-wake-kswapd-prematurely-when-watermark-boos.patch new file mode 100644 index 00000000000..21535abbf68 --- /dev/null +++ b/queue-5.4/mm-don-t-wake-kswapd-prematurely-when-watermark-boos.patch @@ -0,0 +1,94 @@ +From 12bddb4e1465f6f9a4850d2555aa645dcd71ea9c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 19:12:15 -0800 +Subject: mm: don't wake kswapd prematurely when watermark boosting is disabled + +From: Johannes Weiner + +[ Upstream commit 597c892038e08098b17ccfe65afd9677e6979800 ] + +On 2-node NUMA hosts we see bursts of kswapd reclaim and subsequent +pressure spikes and stalls from cache refaults while there is plenty of +free memory in the system. + +Usually, kswapd is woken up when all eligible nodes in an allocation are +full. But the code related to watermark boosting can wake kswapd on one +full node while the other one is mostly empty. This may be justified to +fight fragmentation, but is currently unconditionally done whether +watermark boosting is occurring or not. + +In our case, many of our workloads' throughput scales with available +memory, and pure utilization is a more tangible concern than trends +around longer-term fragmentation. As a result we generally disable +watermark boosting. + +Wake kswapd only woken when watermark boosting is requested. + +Link: https://lkml.kernel.org/r/20201020175833.397286-1-hannes@cmpxchg.org +Fixes: 1c30844d2dfe ("mm: reclaim small amounts of memory when an external fragmentation event occurs") +Signed-off-by: Johannes Weiner +Acked-by: Mel Gorman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + mm/page_alloc.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 1c869c6b825f3..4357f5475a504 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -2346,12 +2346,12 @@ static bool can_steal_fallback(unsigned int order, int start_mt) + return false; + } + +-static inline void boost_watermark(struct zone *zone) ++static inline bool boost_watermark(struct zone *zone) + { + unsigned long max_boost; + + if (!watermark_boost_factor) +- return; ++ return false; + /* + * Don't bother in zones that are unlikely to produce results. + * On small machines, including kdump capture kernels running +@@ -2359,7 +2359,7 @@ static inline void boost_watermark(struct zone *zone) + * memory situation immediately. + */ + if ((pageblock_nr_pages * 4) > zone_managed_pages(zone)) +- return; ++ return false; + + max_boost = mult_frac(zone->_watermark[WMARK_HIGH], + watermark_boost_factor, 10000); +@@ -2373,12 +2373,14 @@ static inline void boost_watermark(struct zone *zone) + * boosted watermark resulting in a hang. + */ + if (!max_boost) +- return; ++ return false; + + max_boost = max(pageblock_nr_pages, max_boost); + + zone->watermark_boost = min(zone->watermark_boost + pageblock_nr_pages, + max_boost); ++ ++ return true; + } + + /* +@@ -2417,8 +2419,7 @@ static void steal_suitable_fallback(struct zone *zone, struct page *page, + * likelihood of future fallbacks. Wake kswapd now as the node + * may be balanced overall and kswapd will not wake naturally. + */ +- boost_watermark(zone); +- if (alloc_flags & ALLOC_KSWAPD) ++ if (boost_watermark(zone) && (alloc_flags & ALLOC_KSWAPD)) + set_bit(ZONE_BOOSTED_WATERMARK, &zone->flags); + + /* We are not allowed to try stealing from the whole block */ +-- +2.27.0 + diff --git a/queue-5.4/mmc-pxamci-fix-error-return-code-in-pxamci_probe.patch b/queue-5.4/mmc-pxamci-fix-error-return-code-in-pxamci_probe.patch new file mode 100644 index 00000000000..0ff5e8c037a --- /dev/null +++ b/queue-5.4/mmc-pxamci-fix-error-return-code-in-pxamci_probe.patch @@ -0,0 +1,37 @@ +From 4b5dddc34caa972db13f8874b4e9b1f0fa4a0550 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 10:14:31 +0800 +Subject: mmc: pxamci: Fix error return code in pxamci_probe + +From: Zhihao Cheng + +[ Upstream commit d7b819b5d33869d41bdaa427aeb98ae24c57a38b ] + +Fix to return the error code from devm_gpiod_get_optional() instaed +of 0 in pxamci_probe(). + +Fixes: f54005b508b9a9d9c ("mmc: pxa: Use GPIO descriptor for power") +Reported-by: Hulk Robot +Signed-off-by: Zhihao Cheng +Link: https://lore.kernel.org/r/20201121021431.3168506-1-chengzhihao1@huawei.com +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/pxamci.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c +index b2bbcb09a49e6..953e7457137a2 100644 +--- a/drivers/mmc/host/pxamci.c ++++ b/drivers/mmc/host/pxamci.c +@@ -729,6 +729,7 @@ static int pxamci_probe(struct platform_device *pdev) + + host->power = devm_gpiod_get_optional(dev, "power", GPIOD_OUT_LOW); + if (IS_ERR(host->power)) { ++ ret = PTR_ERR(host->power); + dev_err(dev, "Failed requesting gpio_power\n"); + goto out; + } +-- +2.27.0 + diff --git a/queue-5.4/mtd-rawnand-gpmi-fix-reference-count-leak-in-gpmi-op.patch b/queue-5.4/mtd-rawnand-gpmi-fix-reference-count-leak-in-gpmi-op.patch new file mode 100644 index 00000000000..64686dcb1a6 --- /dev/null +++ b/queue-5.4/mtd-rawnand-gpmi-fix-reference-count-leak-in-gpmi-op.patch @@ -0,0 +1,60 @@ +From ca70f6355da10310a7e3db221a4f51665c5ef99d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 19:05:52 +0800 +Subject: mtd: rawnand: gpmi: fix reference count leak in gpmi ops + +From: Zhang Qilong + +[ Upstream commit 1b391c7f2e863985668d705f525af3ceb55bc800 ] + +pm_runtime_get_sync() will increment pm usage at first and it +will resume the device later. If runtime of the device has +error or device is in inaccessible state(or other error state), +resume operation will fail. If we do not call put operation to +decrease the reference, it will result in reference leak in +the two functions(gpmi_init and gpmi_nfc_exec_op). Moreover, +this device cannot enter the idle state and always stay busy or +other non-idle state later. So we fixed it through adding +pm_runtime_put_noidle. + +Fixes: 5bc6bb603b4d0 ("mtd: rawnand: gpmi: Fix suspend/resume problem") +Signed-off-by: Zhang Qilong +Acked-by: Han Xu +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20201107110552.1568742-1-zhangqilong3@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +index ef89947ee3191..89239d9c4ea63 100644 +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -149,8 +149,10 @@ static int gpmi_init(struct gpmi_nand_data *this) + int ret; + + ret = pm_runtime_get_sync(this->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(this->dev); + return ret; ++ } + + ret = gpmi_reset_block(r->gpmi_regs, false); + if (ret) +@@ -2414,8 +2416,10 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip, + this->transfers[i].direction = DMA_NONE; + + ret = pm_runtime_get_sync(this->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(this->dev); + return ret; ++ } + + /* + * This driver currently supports only one NAND chip. Plus, dies share +-- +2.27.0 + diff --git a/queue-5.4/mtd-rawnand-gpmi-fix-the-random-dma-timeout-issue.patch b/queue-5.4/mtd-rawnand-gpmi-fix-the-random-dma-timeout-issue.patch new file mode 100644 index 00000000000..8601adc2f60 --- /dev/null +++ b/queue-5.4/mtd-rawnand-gpmi-fix-the-random-dma-timeout-issue.patch @@ -0,0 +1,216 @@ +From 059f2570f7138af4eda7d021429aee78046bdc3d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 21:51:04 -0600 +Subject: mtd: rawnand: gpmi: Fix the random DMA timeout issue + +From: Han Xu + +[ Upstream commit 7671edeb193910482a9b0c22cd32176e7de7b2ed ] + +To get better performance, current gpmi driver collected and chained all +small DMA transfers in gpmi_nfc_exec_op, the whole chain triggered and +wait for complete at the end. + +But some random DMA timeout found in this new driver, with the help of +ftrace, we found the root cause is as follows: + +Take gpmi_ecc_read_page() as an example, gpmi_nfc_exec_op collected 6 +DMA transfers and the DMA chain triggered at the end. It waits for bch +completion and check jiffies if it's timeout. The typical function graph +shown below, + + 63.216351 | 1) | gpmi_ecc_read_page() { + 63.216352 | 1) 0.750 us | gpmi_bch_layout_std(); + 63.216354 | 1) | gpmi_nfc_exec_op() { + 63.216355 | 1) | gpmi_chain_command() { + 63.216356 | 1) | mxs_dma_prep_slave_sg() { + 63.216357 | 1) | /* mxs chan ccw idx: 0 */ + 63.216358 | 1) 1.750 us | } + 63.216359 | 1) | mxs_dma_prep_slave_sg() { + 63.216360 | 1) | /* mxs chan ccw idx: 1 */ + 63.216361 | 1) 2.000 us | } + 63.216361 | 1) 6.500 us | } + 63.216362 | 1) | gpmi_chain_command() { + 63.216363 | 1) | mxs_dma_prep_slave_sg() { + 63.216364 | 1) | /* mxs chan ccw idx: 2 */ + 63.216365 | 1) 1.750 us | } + 63.216366 | 1) | mxs_dma_prep_slave_sg() { + 63.216367 | 1) | /* mxs chan ccw idx: 3 */ + 63.216367 | 1) 1.750 us | } + 63.216368 | 1) 5.875 us | } + 63.216369 | 1) | /* gpmi_chain_wait_ready */ + 63.216370 | 1) | mxs_dma_prep_slave_sg() { + 63.216372 | 1) | /* mxs chan ccw idx: 4 */ + 63.216373 | 1) 3.000 us | } + 63.216374 | 1) | /* gpmi_chain_data_read */ + 63.216376 | 1) | mxs_dma_prep_slave_sg() { + 63.216377 | 1) | /* mxs chan ccw idx: 5 */ + 63.216378 | 1) 2.000 us | } + 63.216379 | 1) 1.125 us | mxs_dma_tx_submit(); + 63.216381 | 1) 1.000 us | mxs_dma_enable_chan(); + 63.216712 | 0) 2.625 us | mxs_dma_int_handler(); + 63.216717 | 0) 4.250 us | bch_irq(); + 63.216723 | 0) 1.250 us | mxs_dma_tasklet(); + 63.216723 | 1) | /* jiffies left 250 */ + 63.216725 | 1) ! 372.000 us | } + 63.216726 | 1) 2.625 us | gpmi_count_bitflips(); + 63.216730 | 1) ! 379.125 us | } + +but it's not gurantee that bch irq handled always after dma irq handled, +sometimes bch_irq comes first and gpmi_nfc_exec_op won't wait anymore, +another gpmi_nfc_exec_op may get invoked before last DMA chain IRQ +handled, this messed up the next DMA chain and causes DMA timeout. Check +the trace log when issue happened. + + 63.218923 | 1) | gpmi_ecc_read_page() { + 63.218924 | 1) 0.625 us | gpmi_bch_layout_std(); + 63.218926 | 1) | gpmi_nfc_exec_op() { + 63.218927 | 1) | gpmi_chain_command() { + 63.218928 | 1) | mxs_dma_prep_slave_sg() { + 63.218929 | 1) | /* mxs chan ccw idx: 0 */ + 63.218929 | 1) 1.625 us | } + 63.218931 | 1) | mxs_dma_prep_slave_sg() { + 63.218931 | 1) | /* mxs chan ccw idx: 1 */ + 63.218932 | 1) 1.750 us | } + 63.218933 | 1) 5.875 us | } + 63.218934 | 1) | gpmi_chain_command() { + 63.218934 | 1) | mxs_dma_prep_slave_sg() { + 63.218935 | 1) | /* mxs chan ccw idx: 2 */ + 63.218936 | 1) 1.875 us | } + 63.218937 | 1) | mxs_dma_prep_slave_sg() { + 63.218938 | 1) | /* mxs chan ccw idx: 3 */ + 63.218939 | 1) 1.625 us | } + 63.218939 | 1) 5.875 us | } + 63.218940 | 1) | /* gpmi_chain_wait_ready */ + 63.218941 | 1) | mxs_dma_prep_slave_sg() { + 63.218942 | 1) | /* mxs chan ccw idx: 4 */ + 63.218942 | 1) 1.625 us | } + 63.218943 | 1) | /* gpmi_chain_data_read */ + 63.218944 | 1) | mxs_dma_prep_slave_sg() { + 63.218945 | 1) | /* mxs chan ccw idx: 5 */ + 63.218947 | 1) 2.375 us | } + 63.218948 | 1) 0.625 us | mxs_dma_tx_submit(); + 63.218949 | 1) 1.000 us | mxs_dma_enable_chan(); + 63.219276 | 0) 5.125 us | bch_irq(); <---- + 63.219283 | 1) | /* jiffies left 250 */ + 63.219285 | 1) ! 358.625 us | } + 63.219286 | 1) 2.750 us | gpmi_count_bitflips(); + 63.219289 | 1) ! 366.000 us | } + 63.219290 | 1) | gpmi_ecc_read_page() { + 63.219291 | 1) 0.750 us | gpmi_bch_layout_std(); + 63.219293 | 1) | gpmi_nfc_exec_op() { + 63.219294 | 1) | gpmi_chain_command() { + 63.219295 | 1) | mxs_dma_prep_slave_sg() { + 63.219295 | 0) 1.875 us | mxs_dma_int_handler(); <---- + 63.219296 | 1) | /* mxs chan ccw idx: 6 */ + 63.219297 | 1) 2.250 us | } + 63.219298 | 1) | mxs_dma_prep_slave_sg() { + 63.219298 | 0) 1.000 us | mxs_dma_tasklet(); + 63.219299 | 1) | /* mxs chan ccw idx: 0 */ + 63.219300 | 1) 1.625 us | } + 63.219300 | 1) 6.375 us | } + 63.219301 | 1) | gpmi_chain_command() { + 63.219302 | 1) | mxs_dma_prep_slave_sg() { + 63.219303 | 1) | /* mxs chan ccw idx: 1 */ + 63.219304 | 1) 1.625 us | } + 63.219305 | 1) | mxs_dma_prep_slave_sg() { + 63.219306 | 1) | /* mxs chan ccw idx: 2 */ + 63.219306 | 1) 1.875 us | } + 63.219307 | 1) 6.000 us | } + 63.219308 | 1) | /* gpmi_chain_wait_ready */ + 63.219308 | 1) | mxs_dma_prep_slave_sg() { + 63.219309 | 1) | /* mxs chan ccw idx: 3 */ + 63.219310 | 1) 2.000 us | } + 63.219311 | 1) | /* gpmi_chain_data_read */ + 63.219312 | 1) | mxs_dma_prep_slave_sg() { + 63.219313 | 1) | /* mxs chan ccw idx: 4 */ + 63.219314 | 1) 1.750 us | } + 63.219315 | 1) 0.625 us | mxs_dma_tx_submit(); + 63.219316 | 1) 0.875 us | mxs_dma_enable_chan(); + 64.224227 | 1) | /* jiffies left 0 */ + +In the first gpmi_nfc_exec_op, bch_irq comes first and gpmi_nfc_exec_op +exits, but DMA IRQ still not happened yet until the middle of following +gpmi_nfc_exec_op, the first DMA transfer index get messed and DMA get +timeout. + +To fix the issue, when there is bch ops in DMA chain, the +gpmi_nfc_exec_op should wait for both completions rather than bch +completion only. + +Fixes: ef347c0cfd61 ("mtd: rawnand: gpmi: Implement exec_op") +Signed-off-by: Han Xu +Reviewed-by: Sascha Hauer +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20201209035104.22679-3-han.xu@nxp.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 30 +++++++++++++++------- + 1 file changed, 21 insertions(+), 9 deletions(-) + +diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +index 89239d9c4ea63..2390ed077a2fc 100644 +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -2408,7 +2408,7 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip, + void *buf_read = NULL; + const void *buf_write = NULL; + bool direct = false; +- struct completion *completion; ++ struct completion *dma_completion, *bch_completion; + unsigned long to; + + this->ntransfers = 0; +@@ -2502,22 +2502,24 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip, + this->resources.bch_regs + HW_BCH_FLASH0LAYOUT1); + } + ++ desc->callback = dma_irq_callback; ++ desc->callback_param = this; ++ dma_completion = &this->dma_done; ++ bch_completion = NULL; ++ ++ init_completion(dma_completion); ++ + if (this->bch && buf_read) { + writel(BM_BCH_CTRL_COMPLETE_IRQ_EN, + this->resources.bch_regs + HW_BCH_CTRL_SET); +- completion = &this->bch_done; +- } else { +- desc->callback = dma_irq_callback; +- desc->callback_param = this; +- completion = &this->dma_done; ++ bch_completion = &this->bch_done; ++ init_completion(bch_completion); + } + +- init_completion(completion); +- + dmaengine_submit(desc); + dma_async_issue_pending(get_dma_chan(this)); + +- to = wait_for_completion_timeout(completion, msecs_to_jiffies(1000)); ++ to = wait_for_completion_timeout(dma_completion, msecs_to_jiffies(1000)); + if (!to) { + dev_err(this->dev, "DMA timeout, last DMA\n"); + gpmi_dump_info(this); +@@ -2525,6 +2527,16 @@ static int gpmi_nfc_exec_op(struct nand_chip *chip, + goto unmap; + } + ++ if (this->bch && buf_read) { ++ to = wait_for_completion_timeout(bch_completion, msecs_to_jiffies(1000)); ++ if (!to) { ++ dev_err(this->dev, "BCH timeout, last DMA\n"); ++ gpmi_dump_info(this); ++ ret = -ETIMEDOUT; ++ goto unmap; ++ } ++ } ++ + writel(BM_BCH_CTRL_COMPLETE_IRQ_EN, + this->resources.bch_regs + HW_BCH_CTRL_CLR); + gpmi_clear_bch(this); +-- +2.27.0 + diff --git a/queue-5.4/mtd-rawnand-meson-fix-a-resource-leak-in-init.patch b/queue-5.4/mtd-rawnand-meson-fix-a-resource-leak-in-init.patch new file mode 100644 index 00000000000..dd3a39c56c4 --- /dev/null +++ b/queue-5.4/mtd-rawnand-meson-fix-a-resource-leak-in-init.patch @@ -0,0 +1,42 @@ +From f042f22d8e0314763b3f66870ff75270e1664169 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 11:39:48 +0300 +Subject: mtd: rawnand: meson: Fix a resource leak in init + +From: Dan Carpenter + +[ Upstream commit ad8566d3555c4731e6b48823b92d3929b0394c14 ] + +Call clk_disable_unprepare(nfc->phase_rx) if the clk_set_rate() function +fails to avoid a resource leak. + +Fixes: 8fae856c5350 ("mtd: rawnand: meson: add support for Amlogic NAND flash controller") +Signed-off-by: Dan Carpenter +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/X8ikVCnUsfTpffFB@mwanda +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/meson_nand.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c +index 1b82b687e5a50..58eaa3845da4d 100644 +--- a/drivers/mtd/nand/raw/meson_nand.c ++++ b/drivers/mtd/nand/raw/meson_nand.c +@@ -1041,9 +1041,12 @@ static int meson_nfc_clk_init(struct meson_nfc *nfc) + + ret = clk_set_rate(nfc->device_clk, 24000000); + if (ret) +- goto err_phase_rx; ++ goto err_disable_rx; + + return 0; ++ ++err_disable_rx: ++ clk_disable_unprepare(nfc->phase_rx); + err_phase_rx: + clk_disable_unprepare(nfc->phase_tx); + err_phase_tx: +-- +2.27.0 + diff --git a/queue-5.4/mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch b/queue-5.4/mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch new file mode 100644 index 00000000000..f9eea58308d --- /dev/null +++ b/queue-5.4/mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch @@ -0,0 +1,78 @@ +From ab0b09e2dd52b7686e03eaabc5e03b371cbdb275 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 23:21:09 +0900 +Subject: mwifiex: fix mwifiex_shutdown_sw() causing sw reset failure + +From: Tsuchiya Yuto + +[ Upstream commit fa74cb1dc0f4da46c441b735ca865ac52de42c0e ] + +When a PCIe function level reset (FLR) is performed but without fw reset for +some reasons (e.g., on Microsoft Surface devices, fw reset requires other +quirks), it fails to reset wifi properly. You can trigger the issue on such +devices via debugfs entry for reset: + + $ echo 1 | sudo tee /sys/kernel/debug/mwifiex/mlan0/reset + +and the resulting dmesg log: + + [ 45.740508] mwifiex_pcie 0000:03:00.0: Resetting per request + [ 45.742937] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 3 + [ 45.744666] mwifiex_pcie 0000:03:00.0: info: shutdown mwifiex... + [ 45.751530] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.751539] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771691] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771695] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 45.771697] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771698] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 45.771699] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771701] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 45.771702] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771703] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 45.771704] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771705] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 45.771707] mwifiex_pcie 0000:03:00.0: PREP_CMD: card is removed + [ 45.771708] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 53.099343] mwifiex_pcie 0000:03:00.0: info: trying to associate to '[SSID]' bssid [BSSID] + [ 53.241870] mwifiex_pcie 0000:03:00.0: info: associated to bssid [BSSID] successfully + [ 75.377942] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110 + [ 85.385491] mwifiex_pcie 0000:03:00.0: info: successfully disconnected from [BSSID]: reason code 15 + [ 87.539408] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110 + [ 87.539412] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 99.699917] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110 + [ 99.699925] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [ 111.859802] mwifiex_pcie 0000:03:00.0: cmd_wait_q terminated: -110 + [ 111.859808] mwifiex_pcie 0000:03:00.0: deleting the crypto keys + [...] + +When comparing mwifiex_shutdown_sw() with mwifiex_pcie_remove(), it +lacks mwifiex_init_shutdown_fw(). + +This commit fixes mwifiex_shutdown_sw() by adding the missing +mwifiex_init_shutdown_fw(). + +Fixes: 4c5dae59d2e9 ("mwifiex: add PCIe function level reset support") +Signed-off-by: Tsuchiya Yuto +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201028142110.18144-2-kitakar@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/marvell/mwifiex/main.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/marvell/mwifiex/main.c b/drivers/net/wireless/marvell/mwifiex/main.c +index d14e55e3c9dad..5894566ec4805 100644 +--- a/drivers/net/wireless/marvell/mwifiex/main.c ++++ b/drivers/net/wireless/marvell/mwifiex/main.c +@@ -1469,6 +1469,8 @@ int mwifiex_shutdown_sw(struct mwifiex_adapter *adapter) + priv = mwifiex_get_priv(adapter, MWIFIEX_BSS_ROLE_ANY); + mwifiex_deauthenticate(priv, NULL); + ++ mwifiex_init_shutdown_fw(priv, MWIFIEX_FUNC_SHUTDOWN); ++ + mwifiex_uninit_sw(adapter); + adapter->is_up = false; + +-- +2.27.0 + diff --git a/queue-5.4/net-allwinner-fix-some-resources-leak-in-the-error-h.patch b/queue-5.4/net-allwinner-fix-some-resources-leak-in-the-error-h.patch new file mode 100644 index 00000000000..c755435ee9a --- /dev/null +++ b/queue-5.4/net-allwinner-fix-some-resources-leak-in-the-error-h.patch @@ -0,0 +1,65 @@ +From 0c7dc07ac40cd428003eb6dec80293bd92fbb741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 21:21:17 +0100 +Subject: net: allwinner: Fix some resources leak in the error handling path of + the probe and in the remove function + +From: Christophe JAILLET + +[ Upstream commit 322e53d1e2529ae9d501f5e0f20604a79b873aef ] + +'irq_of_parse_and_map()' should be balanced by a corresponding +'irq_dispose_mapping()' call. Otherwise, there is some resources leaks. + +Add such a call in the error handling path of the probe function and in the +remove function. + +Fixes: 492205050d77 ("net: Add EMAC ethernet driver found on Allwinner A10 SoC's") +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/20201214202117.146293-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/allwinner/sun4i-emac.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/allwinner/sun4i-emac.c b/drivers/net/ethernet/allwinner/sun4i-emac.c +index ff318472a3eef..95155a1f9f9dc 100644 +--- a/drivers/net/ethernet/allwinner/sun4i-emac.c ++++ b/drivers/net/ethernet/allwinner/sun4i-emac.c +@@ -845,13 +845,13 @@ static int emac_probe(struct platform_device *pdev) + db->clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(db->clk)) { + ret = PTR_ERR(db->clk); +- goto out_iounmap; ++ goto out_dispose_mapping; + } + + ret = clk_prepare_enable(db->clk); + if (ret) { + dev_err(&pdev->dev, "Error couldn't enable clock (%d)\n", ret); +- goto out_iounmap; ++ goto out_dispose_mapping; + } + + ret = sunxi_sram_claim(&pdev->dev); +@@ -910,6 +910,8 @@ out_release_sram: + sunxi_sram_release(&pdev->dev); + out_clk_disable_unprepare: + clk_disable_unprepare(db->clk); ++out_dispose_mapping: ++ irq_dispose_mapping(ndev->irq); + out_iounmap: + iounmap(db->membase); + out: +@@ -928,6 +930,7 @@ static int emac_remove(struct platform_device *pdev) + unregister_netdev(ndev); + sunxi_sram_release(&pdev->dev); + clk_disable_unprepare(db->clk); ++ irq_dispose_mapping(ndev->irq); + iounmap(db->membase); + free_netdev(ndev); + +-- +2.27.0 + diff --git a/queue-5.4/net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch b/queue-5.4/net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch new file mode 100644 index 00000000000..d3430649d9f --- /dev/null +++ b/queue-5.4/net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch @@ -0,0 +1,42 @@ +From 1137c48ded0bc87d454c3d8839f4022cb143b1b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Dec 2020 19:20:05 +0100 +Subject: net: bcmgenet: Fix a resource leak in an error handling path in the + probe functin + +From: Christophe JAILLET + +[ Upstream commit 4375ada01963d1ebf733d60d1bb6e5db401e1ac6 ] + +If the 'register_netdev()' call fails, we must undo a previous +'bcmgenet_mii_init()' call. + +Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file") +Signed-off-by: Christophe JAILLET +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20201212182005.120437-1-christophe.jaillet@wanadoo.fr +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index 03f82786c0b98..b27da024aa9d9 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -3584,8 +3584,10 @@ static int bcmgenet_probe(struct platform_device *pdev) + clk_disable_unprepare(priv->clk); + + err = register_netdev(dev); +- if (err) ++ if (err) { ++ bcmgenet_mii_exit(dev); + goto err; ++ } + + return err; + +-- +2.27.0 + diff --git a/queue-5.4/net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch b/queue-5.4/net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch new file mode 100644 index 00000000000..a08c4c584d9 --- /dev/null +++ b/queue-5.4/net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch @@ -0,0 +1,38 @@ +From 5bbb656709fe0bfa56334220d3f40c7bd28bee2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 20:35:14 +0100 +Subject: net: evaluate net.ipv4.conf.all.proxy_arp_pvlan + +From: Vincent Bernat + +[ Upstream commit 1af5318c00a8acc33a90537af49b3f23f72a2c4b ] + +Introduced in 65324144b50b, the "proxy_arp_vlan" sysctl is a +per-interface sysctl to tune proxy ARP support for private VLANs. +While the "all" variant is exposed, it was a noop and never evaluated. +We use the usual "or" logic for this kind of sysctls. + +Fixes: 65324144b50b ("net: RFC3069, private VLAN proxy arp support") +Signed-off-by: Vincent Bernat +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/linux/inetdevice.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h +index 3bbcddd22df8c..53aa0343bf694 100644 +--- a/include/linux/inetdevice.h ++++ b/include/linux/inetdevice.h +@@ -105,7 +105,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev) + + #define IN_DEV_LOG_MARTIANS(in_dev) IN_DEV_ORCONF((in_dev), LOG_MARTIANS) + #define IN_DEV_PROXY_ARP(in_dev) IN_DEV_ORCONF((in_dev), PROXY_ARP) +-#define IN_DEV_PROXY_ARP_PVLAN(in_dev) IN_DEV_CONF_GET(in_dev, PROXY_ARP_PVLAN) ++#define IN_DEV_PROXY_ARP_PVLAN(in_dev) IN_DEV_ORCONF((in_dev), PROXY_ARP_PVLAN) + #define IN_DEV_SHARED_MEDIA(in_dev) IN_DEV_ORCONF((in_dev), SHARED_MEDIA) + #define IN_DEV_TX_REDIRECTS(in_dev) IN_DEV_ORCONF((in_dev), SEND_REDIRECTS) + #define IN_DEV_SEC_REDIRECTS(in_dev) IN_DEV_ORCONF((in_dev), \ +-- +2.27.0 + diff --git a/queue-5.4/net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch b/queue-5.4/net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch new file mode 100644 index 00000000000..8f8d92dc3f0 --- /dev/null +++ b/queue-5.4/net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch @@ -0,0 +1,111 @@ +From 82b00110454a3059ddd8faea96a8bfd0b4aa2b71 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 7 Nov 2020 20:35:13 +0100 +Subject: net: evaluate net.ipvX.conf.all.ignore_routes_with_linkdown + +From: Vincent Bernat + +[ Upstream commit c0c5a60f0f1311bcf08bbe735122096d6326fb5b ] + +Introduced in 0eeb075fad73, the "ignore_routes_with_linkdown" sysctl +ignores a route whose interface is down. It is provided as a +per-interface sysctl. However, while a "all" variant is exposed, it +was a noop since it was never evaluated. We use the usual "or" logic +for this kind of sysctls. + +Tested with: + + ip link add type veth # veth0 + veth1 + ip link add type veth # veth1 + veth2 + ip link set up dev veth0 + ip link set up dev veth1 # link-status paired with veth0 + ip link set up dev veth2 + ip link set up dev veth3 # link-status paired with veth2 + + # First available path + ip -4 addr add 203.0.113.${uts#H}/24 dev veth0 + ip -6 addr add 2001:db8:1::${uts#H}/64 dev veth0 + + # Second available path + ip -4 addr add 192.0.2.${uts#H}/24 dev veth2 + ip -6 addr add 2001:db8:2::${uts#H}/64 dev veth2 + + # More specific route through first path + ip -4 route add 198.51.100.0/25 via 203.0.113.254 # via veth0 + ip -6 route add 2001:db8:3::/56 via 2001:db8:1::ff # via veth0 + + # Less specific route through second path + ip -4 route add 198.51.100.0/24 via 192.0.2.254 # via veth2 + ip -6 route add 2001:db8:3::/48 via 2001:db8:2::ff # via veth2 + + # H1: enable on "all" + # H2: enable on "veth0" + for v in ipv4 ipv6; do + case $uts in + H1) + sysctl -qw net.${v}.conf.all.ignore_routes_with_linkdown=1 + ;; + H2) + sysctl -qw net.${v}.conf.veth0.ignore_routes_with_linkdown=1 + ;; + esac + done + + set -xe + # When veth0 is up, best route is through veth0 + ip -o route get 198.51.100.1 | grep -Fw veth0 + ip -o route get 2001:db8:3::1 | grep -Fw veth0 + + # When veth0 is down, best route should be through veth2 on H1/H2, + # but on veth0 on H2 + ip link set down dev veth1 # down veth0 + ip route show + [ $uts != H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth0 + [ $uts != H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth0 + [ $uts = H3 ] || ip -o route get 198.51.100.1 | grep -Fw veth2 + [ $uts = H3 ] || ip -o route get 2001:db8:3::1 | grep -Fw veth2 + +Without this patch, the two last lines would fail on H1 (the one using +the "all" sysctl). With the patch, everything succeeds as expected. + +Also document the sysctl in `ip-sysctl.rst`. + +Fixes: 0eeb075fad73 ("net: ipv4 sysctl option to ignore routes when nexthop link is down") +Signed-off-by: Vincent Bernat +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + Documentation/networking/ip-sysctl.txt | 3 +++ + include/linux/inetdevice.h | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt +index 8af3771a3ebf2..784988bab7181 100644 +--- a/Documentation/networking/ip-sysctl.txt ++++ b/Documentation/networking/ip-sysctl.txt +@@ -1366,6 +1366,9 @@ igmpv3_unsolicited_report_interval - INTEGER + IGMPv3 report retransmit will take place. + Default: 1000 (1 seconds) + ++ignore_routes_with_linkdown - BOOLEAN ++ Ignore routes whose link is down when performing a FIB lookup. ++ + promote_secondaries - BOOLEAN + When a primary IP address is removed from this interface + promote a corresponding secondary IP address instead of +diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h +index 3515ca64e638a..3bbcddd22df8c 100644 +--- a/include/linux/inetdevice.h ++++ b/include/linux/inetdevice.h +@@ -126,7 +126,7 @@ static inline void ipv4_devconf_setall(struct in_device *in_dev) + IN_DEV_ORCONF((in_dev), ACCEPT_REDIRECTS))) + + #define IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) \ +- IN_DEV_CONF_GET((in_dev), IGNORE_ROUTES_WITH_LINKDOWN) ++ IN_DEV_ORCONF((in_dev), IGNORE_ROUTES_WITH_LINKDOWN) + + #define IN_DEV_ARPFILTER(in_dev) IN_DEV_ORCONF((in_dev), ARPFILTER) + #define IN_DEV_ARP_ACCEPT(in_dev) IN_DEV_ORCONF((in_dev), ARP_ACCEPT) +-- +2.27.0 + diff --git a/queue-5.4/net-korina-fix-return-value.patch b/queue-5.4/net-korina-fix-return-value.patch new file mode 100644 index 00000000000..097e9ac8735 --- /dev/null +++ b/queue-5.4/net-korina-fix-return-value.patch @@ -0,0 +1,43 @@ +From a42d95a50663c5fc24fd4b3d4ed541c39ae17c01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 23:09:52 +0100 +Subject: net: korina: fix return value +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vincent Stehlé + +[ Upstream commit 7eb000bdbe7c7da811ef51942b356f6e819b13ba ] + +The ndo_start_xmit() method must not attempt to free the skb to transmit +when returning NETDEV_TX_BUSY. Therefore, make sure the +korina_send_packet() function returns NETDEV_TX_OK when it frees a packet. + +Fixes: ef11291bcd5f ("Add support the Korina (IDT RC32434) Ethernet MAC") +Suggested-by: Jakub Kicinski +Signed-off-by: Vincent Stehlé +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20201214220952.19935-1-vincent.stehle@laposte.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/korina.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c +index 993f495e2bf7b..9f804e2aba359 100644 +--- a/drivers/net/ethernet/korina.c ++++ b/drivers/net/ethernet/korina.c +@@ -219,7 +219,7 @@ static int korina_send_packet(struct sk_buff *skb, struct net_device *dev) + dev_kfree_skb_any(skb); + spin_unlock_irqrestore(&lp->lock, flags); + +- return NETDEV_TX_BUSY; ++ return NETDEV_TX_OK; + } + } + +-- +2.27.0 + diff --git a/queue-5.4/net-mlx5-properly-convey-driver-version-to-firmware.patch b/queue-5.4/net-mlx5-properly-convey-driver-version-to-firmware.patch new file mode 100644 index 00000000000..dc5b87951eb --- /dev/null +++ b/queue-5.4/net-mlx5-properly-convey-driver-version-to-firmware.patch @@ -0,0 +1,47 @@ +From 9b9a25786c50be7cc1d0c5c1c44f30fd0eed65a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 14:52:00 +0300 +Subject: net/mlx5: Properly convey driver version to firmware + +From: Leon Romanovsky + +[ Upstream commit 907af0f0cab4ee5d5604f182ecec2c5b5119d294 ] + +mlx5 firmware expects driver version in specific format X.X.X, so +make it always correct and based on real kernel version aligned with +the driver. + +Fixes: 012e50e109fd ("net/mlx5: Set driver version into firmware") +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 7c0a726277b00..f2657cd3ffa4f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -50,6 +50,7 @@ + #ifdef CONFIG_RFS_ACCEL + #include + #endif ++#include + #include + #include "mlx5_core.h" + #include "lib/eq.h" +@@ -227,7 +228,10 @@ static void mlx5_set_driver_version(struct mlx5_core_dev *dev) + strncat(string, ",", remaining_size); + + remaining_size = max_t(int, 0, driver_ver_sz - strlen(string)); +- strncat(string, DRIVER_VERSION, remaining_size); ++ ++ snprintf(string + strlen(string), remaining_size, "%u.%u.%u", ++ (u8)((LINUX_VERSION_CODE >> 16) & 0xff), (u8)((LINUX_VERSION_CODE >> 8) & 0xff), ++ (u16)(LINUX_VERSION_CODE & 0xffff)); + + /*Send the command*/ + MLX5_SET(set_driver_version_in, in, opcode, +-- +2.27.0 + diff --git a/queue-5.4/net-sunrpc-fix-snprintf-return-value-check-in-do_xpr.patch b/queue-5.4/net-sunrpc-fix-snprintf-return-value-check-in-do_xpr.patch new file mode 100644 index 00000000000..9bec39246d3 --- /dev/null +++ b/queue-5.4/net-sunrpc-fix-snprintf-return-value-check-in-do_xpr.patch @@ -0,0 +1,45 @@ +From 1958b96fc7c3f3e69032f3958eb5f73ad34282f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 16:59:08 +0300 +Subject: net: sunrpc: Fix 'snprintf' return value check in 'do_xprt_debugfs' + +From: Fedor Tokarev + +[ Upstream commit 35a6d396721e28ba161595b0fc9e8896c00399bb ] + +'snprintf' returns the number of characters which would have been written +if enough space had been available, excluding the terminating null byte. +Thus, the return value of 'sizeof(buf)' means that the last character +has been dropped. + +Signed-off-by: Fedor Tokarev +Fixes: 2f34b8bfae19 ("SUNRPC: add links for all client xprts to debugfs") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/debugfs.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/sunrpc/debugfs.c b/net/sunrpc/debugfs.c +index fd9bca2427242..56029e3af6ff0 100644 +--- a/net/sunrpc/debugfs.c ++++ b/net/sunrpc/debugfs.c +@@ -128,13 +128,13 @@ static int do_xprt_debugfs(struct rpc_clnt *clnt, struct rpc_xprt *xprt, void *n + return 0; + len = snprintf(name, sizeof(name), "../../rpc_xprt/%s", + xprt->debugfs->d_name.name); +- if (len > sizeof(name)) ++ if (len >= sizeof(name)) + return -1; + if (*nump == 0) + strcpy(link, "xprt"); + else { + len = snprintf(link, sizeof(link), "xprt%d", *nump); +- if (len > sizeof(link)) ++ if (len >= sizeof(link)) + return -1; + } + debugfs_create_symlink(link, clnt->cl_debugfs, name); +-- +2.27.0 + diff --git a/queue-5.4/nfc-s3fwrn5-release-the-nfc-firmware.patch b/queue-5.4/nfc-s3fwrn5-release-the-nfc-firmware.patch new file mode 100644 index 00000000000..40fb9574c36 --- /dev/null +++ b/queue-5.4/nfc-s3fwrn5-release-the-nfc-firmware.patch @@ -0,0 +1,41 @@ +From 72728c482abb3d127861632b3274a758a7db7c8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Dec 2020 18:58:50 +0900 +Subject: nfc: s3fwrn5: Release the nfc firmware + +From: Bongsu Jeon + +[ Upstream commit a4485baefa1efa596702ebffd5a9c760d42b14b5 ] + +add the code to release the nfc firmware when the firmware image size is +wrong. + +Fixes: c04c674fadeb ("nfc: s3fwrn5: Add driver for Samsung S3FWRN5 NFC Chip") +Signed-off-by: Bongsu Jeon +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20201213095850.28169-1-bongsu.jeon@samsung.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/nfc/s3fwrn5/firmware.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/nfc/s3fwrn5/firmware.c b/drivers/nfc/s3fwrn5/firmware.c +index be110d9cef022..310773a4ca66e 100644 +--- a/drivers/nfc/s3fwrn5/firmware.c ++++ b/drivers/nfc/s3fwrn5/firmware.c +@@ -293,8 +293,10 @@ static int s3fwrn5_fw_request_firmware(struct s3fwrn5_fw_info *fw_info) + if (ret < 0) + return ret; + +- if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) ++ if (fw->fw->size < S3FWRN5_FW_IMAGE_HEADER_SIZE) { ++ release_firmware(fw->fw); + return -EINVAL; ++ } + + memcpy(fw->date, fw->fw->data + 0x00, 12); + fw->date[12] = '\0'; +-- +2.27.0 + diff --git a/queue-5.4/nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch b/queue-5.4/nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch new file mode 100644 index 00000000000..8d0b87059d9 --- /dev/null +++ b/queue-5.4/nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch @@ -0,0 +1,52 @@ +From b120bb5f4fd5f88f40708ec371b54a98e4deff09 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 11:24:33 +1100 +Subject: NFS: switch nfsiod to be an UNBOUND workqueue. + +From: NeilBrown + +[ Upstream commit bf701b765eaa82dd164d65edc5747ec7288bb5c3 ] + +nfsiod is currently a concurrency-managed workqueue (CMWQ). +This means that workitems scheduled to nfsiod on a given CPU are queued +behind all other work items queued on any CMWQ on the same CPU. This +can introduce unexpected latency. + +Occaionally nfsiod can even cause excessive latency. If the work item +to complete a CLOSE request calls the final iput() on an inode, the +address_space of that inode will be dismantled. This takes time +proportional to the number of in-memory pages, which on a large host +working on large files (e.g.. 5TB), can be a large number of pages +resulting in a noticable number of seconds. + +We can avoid these latency problems by switching nfsiod to WQ_UNBOUND. +This causes each concurrent work item to gets a dedicated thread which +can be scheduled to an idle CPU. + +There is precedent for this as several other filesystems use WQ_UNBOUND +workqueue for handling various async events. + +Signed-off-by: NeilBrown +Fixes: ada609ee2ac2 ("workqueue: use WQ_MEM_RECLAIM instead of WQ_RESCUER") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/inode.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index 6de41f7412808..53604cc090ca5 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -2151,7 +2151,7 @@ static int nfsiod_start(void) + { + struct workqueue_struct *wq; + dprintk("RPC: creating workqueue nfsiod\n"); +- wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM, 0); ++ wq = alloc_workqueue("nfsiod", WQ_MEM_RECLAIM | WQ_UNBOUND, 0); + if (wq == NULL) + return -ENOMEM; + nfsiod_workqueue = wq; +-- +2.27.0 + diff --git a/queue-5.4/nfs_common-need-lock-during-iterate-through-the-list.patch b/queue-5.4/nfs_common-need-lock-during-iterate-through-the-list.patch new file mode 100644 index 00000000000..07dd8f8129b --- /dev/null +++ b/queue-5.4/nfs_common-need-lock-during-iterate-through-the-list.patch @@ -0,0 +1,79 @@ +From 09113760286ffe6167ba6efa0353b217912d43dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 07:06:35 -0500 +Subject: nfs_common: need lock during iterate through the list +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Cheng Lin + +[ Upstream commit 4a9d81caf841cd2c0ae36abec9c2963bf21d0284 ] + +If the elem is deleted during be iterated on it, the iteration +process will fall into an endless loop. + +kernel: NMI watchdog: BUG: soft lockup - CPU#4 stuck for 22s! [nfsd:17137] + +PID: 17137  TASK: ffff8818d93c0000  CPU: 4   COMMAND: "nfsd" +    [exception RIP: __state_in_grace+76] +    RIP: ffffffffc00e817c  RSP: ffff8818d3aefc98  RFLAGS: 00000246 +    RAX: ffff881dc0c38298  RBX: ffffffff81b03580  RCX: ffff881dc02c9f50 +    RDX: ffff881e3fce8500  RSI: 0000000000000001  RDI: ffffffff81b03580 +    RBP: ffff8818d3aefca0   R8: 0000000000000020   R9: ffff8818d3aefd40 +    R10: ffff88017fc03800  R11: ffff8818e83933c0  R12: ffff8818d3aefd40 +    R13: 0000000000000000  R14: ffff8818e8391068  R15: ffff8818fa6e4000 +    CS: 0010  SS: 0018 + #0 [ffff8818d3aefc98] opens_in_grace at ffffffffc00e81e3 [grace] + #1 [ffff8818d3aefca8] nfs4_preprocess_stateid_op at ffffffffc02a3e6c [nfsd] + #2 [ffff8818d3aefd18] nfsd4_write at ffffffffc028ed5b [nfsd] + #3 [ffff8818d3aefd80] nfsd4_proc_compound at ffffffffc0290a0d [nfsd] + #4 [ffff8818d3aefdd0] nfsd_dispatch at ffffffffc027b800 [nfsd] + #5 [ffff8818d3aefe08] svc_process_common at ffffffffc02017f3 [sunrpc] + #6 [ffff8818d3aefe70] svc_process at ffffffffc0201ce3 [sunrpc] + #7 [ffff8818d3aefe98] nfsd at ffffffffc027b117 [nfsd] + #8 [ffff8818d3aefec8] kthread at ffffffff810b88c1 + #9 [ffff8818d3aeff50] ret_from_fork at ffffffff816d1607 + +The troublemake elem: +crash> lock_manager ffff881dc0c38298 +struct lock_manager { +  list = { +    next = 0xffff881dc0c38298, +    prev = 0xffff881dc0c38298 +  }, +  block_opens = false +} + +Fixes: c87fb4a378f9 ("lockd: NLM grace period shouldn't block NFSv4 opens") +Signed-off-by: Cheng Lin  +Signed-off-by: Yi Wang  +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfs_common/grace.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c +index b73d9dd37f73c..26f2a50eceac9 100644 +--- a/fs/nfs_common/grace.c ++++ b/fs/nfs_common/grace.c +@@ -69,10 +69,14 @@ __state_in_grace(struct net *net, bool open) + if (!open) + return !list_empty(grace_list); + ++ spin_lock(&grace_lock); + list_for_each_entry(lm, grace_list, list) { +- if (lm->block_opens) ++ if (lm->block_opens) { ++ spin_unlock(&grace_lock); + return true; ++ } + } ++ spin_unlock(&grace_lock); + return false; + } + +-- +2.27.0 + diff --git a/queue-5.4/nfsd-fix-message-level-for-normal-termination.patch b/queue-5.4/nfsd-fix-message-level-for-normal-termination.patch new file mode 100644 index 00000000000..ef18168abc1 --- /dev/null +++ b/queue-5.4/nfsd-fix-message-level-for-normal-termination.patch @@ -0,0 +1,41 @@ +From 29023ffb6c666636cc50eb93e4f91421d36d9dd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 15:26:59 +0900 +Subject: nfsd: Fix message level for normal termination + +From: kazuo ito + +[ Upstream commit 4420440c57892779f265108f46f83832a88ca795 ] + +The warning message from nfsd terminating normally +can confuse system adminstrators or monitoring software. + +Though it's not exactly fair to pin-point a commit where it +originated, the current form in the current place started +to appear in: + +Fixes: e096bbc6488d ("knfsd: remove special handling for SIGHUP") +Signed-off-by: kazuo ito +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfssvc.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index e8bee8ff30c59..155a4e43b24ee 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -516,8 +516,7 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net) + return; + + nfsd_shutdown_net(net); +- printk(KERN_WARNING "nfsd: last server has exited, flushing export " +- "cache\n"); ++ pr_info("nfsd: last server has exited, flushing export cache\n"); + nfsd_export_flush(net); + } + +-- +2.27.0 + diff --git a/queue-5.4/nfsv4-fix-the-alignment-of-page-data-in-the-getdevic.patch b/queue-5.4/nfsv4-fix-the-alignment-of-page-data-in-the-getdevic.patch new file mode 100644 index 00000000000..c1919dcebb2 --- /dev/null +++ b/queue-5.4/nfsv4-fix-the-alignment-of-page-data-in-the-getdevic.patch @@ -0,0 +1,48 @@ +From a9093f700d765cc223ba3e1b5dce100b4f60307d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 21:42:16 -0500 +Subject: NFSv4: Fix the alignment of page data in the getdeviceinfo reply + +From: Trond Myklebust + +[ Upstream commit 046e5ccb4198b990190e11fb52fd9cfd264402eb ] + +We can fit the device_addr4 opaque data padding in the pages. + +Fixes: cf500bac8fd4 ("SUNRPC: Introduce rpc_prepare_reply_pages()") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4xdr.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c +index 677751bc3a334..9a022a4fb9643 100644 +--- a/fs/nfs/nfs4xdr.c ++++ b/fs/nfs/nfs4xdr.c +@@ -3012,15 +3012,19 @@ static void nfs4_xdr_enc_getdeviceinfo(struct rpc_rqst *req, + struct compound_hdr hdr = { + .minorversion = nfs4_xdr_minorversion(&args->seq_args), + }; ++ uint32_t replen; + + encode_compound_hdr(xdr, req, &hdr); + encode_sequence(xdr, &args->seq_args, &hdr); ++ ++ replen = hdr.replen + op_decode_hdr_maxsz; ++ + encode_getdeviceinfo(xdr, args, &hdr); + +- /* set up reply kvec. Subtract notification bitmap max size (2) +- * so that notification bitmap is put in xdr_buf tail */ ++ /* set up reply kvec. device_addr4 opaque data is read into the ++ * pages */ + rpc_prepare_reply_pages(req, args->pdev->pages, args->pdev->pgbase, +- args->pdev->pglen, hdr.replen - 2); ++ args->pdev->pglen, replen + 2 + 1); + encode_nops(&hdr); + } + +-- +2.27.0 + diff --git a/queue-5.4/nfsv4.2-condition-readdir-s-mask-for-security-label-.patch b/queue-5.4/nfsv4.2-condition-readdir-s-mask-for-security-label-.patch new file mode 100644 index 00000000000..35e3379a60a --- /dev/null +++ b/queue-5.4/nfsv4.2-condition-readdir-s-mask-for-security-label-.patch @@ -0,0 +1,74 @@ +From 05c9104e1b9b62ad2cc5166a0bff72818a80e048 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 16:03:38 -0500 +Subject: NFSv4.2: condition READDIR's mask for security label based on LSM + state + +From: Olga Kornievskaia + +[ Upstream commit 05ad917561fca39a03338cb21fe9622f998b0f9c ] + +Currently, the client will always ask for security_labels if the server +returns that it supports that feature regardless of any LSM modules +(such as Selinux) enforcing security policy. This adds performance +penalty to the READDIR operation. + +Client adjusts superblock's support of the security_label based on +the server's support but also current client's configuration of the +LSM modules. Thus, prior to using the default bitmask in READDIR, +this patch checks the server's capabilities and then instructs +READDIR to remove FATTR4_WORD2_SECURITY_LABEL from the bitmask. + +v5: fixing silly mistakes of the rushed v4 +v4: simplifying logic +v3: changing label's initialization per Ondrej's comment +v2: dropping selinux hook and using the sb cap. + +Suggested-by: Ondrej Mosnacek +Suggested-by: Scott Mayhew +Signed-off-by: Olga Kornievskaia +Fixes: 2b0143b5c986 ("VFS: normal filesystems (and lustre): d_inode() annotations") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index ddc900df461c8..8598eba3fc234 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -4899,12 +4899,12 @@ static int _nfs4_proc_readdir(struct dentry *dentry, const struct cred *cred, + u64 cookie, struct page **pages, unsigned int count, bool plus) + { + struct inode *dir = d_inode(dentry); ++ struct nfs_server *server = NFS_SERVER(dir); + struct nfs4_readdir_arg args = { + .fh = NFS_FH(dir), + .pages = pages, + .pgbase = 0, + .count = count, +- .bitmask = NFS_SERVER(d_inode(dentry))->attr_bitmask, + .plus = plus, + }; + struct nfs4_readdir_res res; +@@ -4919,9 +4919,15 @@ static int _nfs4_proc_readdir(struct dentry *dentry, const struct cred *cred, + dprintk("%s: dentry = %pd2, cookie = %Lu\n", __func__, + dentry, + (unsigned long long)cookie); ++ if (!(server->caps & NFS_CAP_SECURITY_LABEL)) ++ args.bitmask = server->attr_bitmask_nl; ++ else ++ args.bitmask = server->attr_bitmask; ++ + nfs4_setup_readdir(cookie, NFS_I(dir)->cookieverf, dentry, &args); + res.pgbase = args.pgbase; +- status = nfs4_call_sync(NFS_SERVER(dir)->client, NFS_SERVER(dir), &msg, &args.seq_args, &res.seq_res, 0); ++ status = nfs4_call_sync(server->client, server, &msg, &args.seq_args, ++ &res.seq_res, 0); + if (status >= 0) { + memcpy(NFS_I(dir)->cookieverf, res.verifier.data, NFS4_VERIFIER_SIZE); + status += args.pgbase; +-- +2.27.0 + diff --git a/queue-5.4/orinoco-move-context-allocation-after-processing-the.patch b/queue-5.4/orinoco-move-context-allocation-after-processing-the.patch new file mode 100644 index 00000000000..22f9a9b0e84 --- /dev/null +++ b/queue-5.4/orinoco-move-context-allocation-after-processing-the.patch @@ -0,0 +1,60 @@ +From 578c09020e4b974a1003d01cc3e60844ea5772d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 13 Nov 2020 22:22:43 +0100 +Subject: orinoco: Move context allocation after processing the skb + +From: Sebastian Andrzej Siewior + +[ Upstream commit a31eb615646a63370aa1da1053c45439c7653d83 ] + +ezusb_xmit() allocates a context which is leaked if +orinoco_process_xmit_skb() returns an error. + +Move ezusb_alloc_ctx() after the invocation of +orinoco_process_xmit_skb() because the context is not needed so early. +ezusb_access_ltv() will cleanup the context in case of an error. + +Fixes: bac6fafd4d6a0 ("orinoco: refactor xmit path") +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201113212252.2243570-2-bigeasy@linutronix.de +Signed-off-by: Sasha Levin +--- + .../net/wireless/intersil/orinoco/orinoco_usb.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c +index e753f43e0162f..e2368bfe3e468 100644 +--- a/drivers/net/wireless/intersil/orinoco/orinoco_usb.c ++++ b/drivers/net/wireless/intersil/orinoco/orinoco_usb.c +@@ -1234,13 +1234,6 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev) + if (skb->len < ETH_HLEN) + goto drop; + +- ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0); +- if (!ctx) +- goto busy; +- +- memset(ctx->buf, 0, BULK_BUF_SIZE); +- buf = ctx->buf->data; +- + tx_control = 0; + + err = orinoco_process_xmit_skb(skb, dev, priv, &tx_control, +@@ -1248,6 +1241,13 @@ static netdev_tx_t ezusb_xmit(struct sk_buff *skb, struct net_device *dev) + if (err) + goto drop; + ++ ctx = ezusb_alloc_ctx(upriv, EZUSB_RID_TX, 0); ++ if (!ctx) ++ goto drop; ++ ++ memset(ctx->buf, 0, BULK_BUF_SIZE); ++ buf = ctx->buf->data; ++ + { + __le16 *tx_cntl = (__le16 *)buf; + *tx_cntl = cpu_to_le16(tx_control); +-- +2.27.0 + diff --git a/queue-5.4/pci-bounds-check-command-line-resource-alignment-req.patch b/queue-5.4/pci-bounds-check-command-line-resource-alignment-req.patch new file mode 100644 index 00000000000..4347535ed48 --- /dev/null +++ b/queue-5.4/pci-bounds-check-command-line-resource-alignment-req.patch @@ -0,0 +1,56 @@ +From f0b2f3a6d67b018f2605b28c9df1b34291ab0094 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 14:51:36 -0600 +Subject: PCI: Bounds-check command-line resource alignment requests + +From: Bjorn Helgaas + +[ Upstream commit 6534aac198b58309ff2337981d3f893e0be1d19d ] + +32-bit BARs are limited to 2GB size (2^31). By extension, I assume 64-bit +BARs are limited to 2^63 bytes. Limit the alignment requested by the +"pci=resource_alignment=" command-line parameter to 2^63. + +Link: https://lore.kernel.org/r/20201007123045.GS4282@kadam +Reported-by: Dan Carpenter +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index b1b2c8ddbc927..158a7aa2a8e6e 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -6129,19 +6129,21 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev, + while (*p) { + count = 0; + if (sscanf(p, "%d%n", &align_order, &count) == 1 && +- p[count] == '@') { ++ p[count] == '@') { + p += count + 1; ++ if (align_order > 63) { ++ pr_err("PCI: Invalid requested alignment (order %d)\n", ++ align_order); ++ align_order = PAGE_SHIFT; ++ } + } else { +- align_order = -1; ++ align_order = PAGE_SHIFT; + } + + ret = pci_dev_str_match(dev, p, &p); + if (ret == 1) { + *resize = true; +- if (align_order == -1) +- align = PAGE_SIZE; +- else +- align = 1 << align_order; ++ align = 1 << align_order; + break; + } else if (ret < 0) { + pr_err("PCI: Can't parse resource_alignment parameter: %s\n", +-- +2.27.0 + diff --git a/queue-5.4/pci-fix-overflow-in-command-line-resource-alignment-.patch b/queue-5.4/pci-fix-overflow-in-command-line-resource-alignment-.patch new file mode 100644 index 00000000000..5d457d49f11 --- /dev/null +++ b/queue-5.4/pci-fix-overflow-in-command-line-resource-alignment-.patch @@ -0,0 +1,40 @@ +From 104580bf6d363ea7c2274da3dc4c180365c03c79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 15:48:04 -0600 +Subject: PCI: Fix overflow in command-line resource alignment requests + +From: Colin Ian King + +[ Upstream commit cc73eb321d246776e5a9f7723d15708809aa3699 ] + +The shift of 1 by align_order is evaluated using 32 bit arithmetic and the +result is assigned to a resource_size_t type variable that is a 64 bit +unsigned integer on 64 bit platforms. Fix an overflow before widening issue +by making the 1 a ULL. + +Addresses-Coverity: ("Unintentional integer overflow") +Fixes: 32a9a682bef2 ("PCI: allow assignment of memory resources with a specified alignment") +Signed-off-by: Colin Ian King +Signed-off-by: Bjorn Helgaas +Reviewed-by: Logan Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/pci/pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 158a7aa2a8e6e..89dece8a41321 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -6143,7 +6143,7 @@ static resource_size_t pci_specified_resource_alignment(struct pci_dev *dev, + ret = pci_dev_str_match(dev, p, &p); + if (ret == 1) { + *resize = true; +- align = 1 << align_order; ++ align = 1ULL << align_order; + break; + } else if (ret < 0) { + pr_err("PCI: Can't parse resource_alignment parameter: %s\n", +-- +2.27.0 + diff --git a/queue-5.4/pci-iproc-fix-out-of-bound-array-accesses.patch b/queue-5.4/pci-iproc-fix-out-of-bound-array-accesses.patch new file mode 100644 index 00000000000..7498e1fc870 --- /dev/null +++ b/queue-5.4/pci-iproc-fix-out-of-bound-array-accesses.patch @@ -0,0 +1,74 @@ +From 6db52bb11610884a0880c12ca372176e855cf53b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Oct 2020 11:30:52 +0530 +Subject: PCI: iproc: Fix out-of-bound array accesses + +From: Bharat Gooty + +[ Upstream commit a3ff529f5d368a17ff35ada8009e101162ebeaf9 ] + +Declare the full size array for all revisions of PAX register sets +to avoid potentially out of bound access of the register array +when they are being initialized in iproc_pcie_rev_init(). + +Link: https://lore.kernel.org/r/20201001060054.6616-2-srinath.mannam@broadcom.com +Fixes: 06324ede76cdf ("PCI: iproc: Improve core register population") +Signed-off-by: Bharat Gooty +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pcie-iproc.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/pci/controller/pcie-iproc.c b/drivers/pci/controller/pcie-iproc.c +index 933a4346ae5d6..c6b1c18165e5c 100644 +--- a/drivers/pci/controller/pcie-iproc.c ++++ b/drivers/pci/controller/pcie-iproc.c +@@ -307,7 +307,7 @@ enum iproc_pcie_reg { + }; + + /* iProc PCIe PAXB BCMA registers */ +-static const u16 iproc_pcie_reg_paxb_bcma[] = { ++static const u16 iproc_pcie_reg_paxb_bcma[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x120, + [IPROC_PCIE_CFG_IND_DATA] = 0x124, +@@ -318,7 +318,7 @@ static const u16 iproc_pcie_reg_paxb_bcma[] = { + }; + + /* iProc PCIe PAXB registers */ +-static const u16 iproc_pcie_reg_paxb[] = { ++static const u16 iproc_pcie_reg_paxb[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x120, + [IPROC_PCIE_CFG_IND_DATA] = 0x124, +@@ -334,7 +334,7 @@ static const u16 iproc_pcie_reg_paxb[] = { + }; + + /* iProc PCIe PAXB v2 registers */ +-static const u16 iproc_pcie_reg_paxb_v2[] = { ++static const u16 iproc_pcie_reg_paxb_v2[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x120, + [IPROC_PCIE_CFG_IND_DATA] = 0x124, +@@ -363,7 +363,7 @@ static const u16 iproc_pcie_reg_paxb_v2[] = { + }; + + /* iProc PCIe PAXC v1 registers */ +-static const u16 iproc_pcie_reg_paxc[] = { ++static const u16 iproc_pcie_reg_paxc[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_CLK_CTRL] = 0x000, + [IPROC_PCIE_CFG_IND_ADDR] = 0x1f0, + [IPROC_PCIE_CFG_IND_DATA] = 0x1f4, +@@ -372,7 +372,7 @@ static const u16 iproc_pcie_reg_paxc[] = { + }; + + /* iProc PCIe PAXC v2 registers */ +-static const u16 iproc_pcie_reg_paxc_v2[] = { ++static const u16 iproc_pcie_reg_paxc_v2[IPROC_PCIE_MAX_NUM_REG] = { + [IPROC_PCIE_MSI_GIC_MODE] = 0x050, + [IPROC_PCIE_MSI_BASE_ADDR] = 0x074, + [IPROC_PCIE_MSI_WINDOW_SIZE] = 0x078, +-- +2.27.0 + diff --git a/queue-5.4/perf-probe-fix-memory-leak-when-synthesizing-sdt-pro.patch b/queue-5.4/perf-probe-fix-memory-leak-when-synthesizing-sdt-pro.patch new file mode 100644 index 00000000000..2257dd4bb33 --- /dev/null +++ b/queue-5.4/perf-probe-fix-memory-leak-when-synthesizing-sdt-pro.patch @@ -0,0 +1,77 @@ +From a88462621e09d6d59e81293b99f97697caf61560 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Dec 2020 10:52:10 -0300 +Subject: perf probe: Fix memory leak when synthesizing SDT probes + +From: Arnaldo Carvalho de Melo + +[ Upstream commit 5149303fdfe5c67ddb51c911e23262f781cd75eb ] + +The argv_split() function must be paired with argv_free(), else we must +keep a reference to the argv array received or do the freeing ourselves, +in synthesize_sdt_probe_command() we were simply leaking that argv[] +array. + +Fixes: 3b1f8311f6963cd1 ("perf probe: Add sdt probes arguments into the uprobe cmd string") +Cc: Adrian Hunter +Cc: Alexander Shishkin +Cc: Alexandre Truong +Cc: Alexis Berlemont +Cc: He Zhe +Cc: Ian Rogers +Cc: Ingo Molnar +Cc: Jiri Olsa +Cc: John Garry +Cc: Mark Rutland +Cc: Masami Hiramatsu +Cc: Mathieu Poirier +Cc: Namhyung Kim +Cc: Peter Zijlstra +Cc: Sumanth Korikkar +Cc: Thomas Richter +Cc: Will Deacon +Link: https://lore.kernel.org/r/20201224135139.GF477817@kernel.org +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/probe-file.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/tools/perf/util/probe-file.c b/tools/perf/util/probe-file.c +index bf50f464234fe..f778f8e7e65a3 100644 +--- a/tools/perf/util/probe-file.c ++++ b/tools/perf/util/probe-file.c +@@ -777,7 +777,7 @@ static char *synthesize_sdt_probe_command(struct sdt_note *note, + const char *sdtgrp) + { + struct strbuf buf; +- char *ret = NULL, **args; ++ char *ret = NULL; + int i, args_count, err; + unsigned long long ref_ctr_offset; + +@@ -799,12 +799,19 @@ static char *synthesize_sdt_probe_command(struct sdt_note *note, + goto out; + + if (note->args) { +- args = argv_split(note->args, &args_count); ++ char **args = argv_split(note->args, &args_count); ++ ++ if (args == NULL) ++ goto error; + + for (i = 0; i < args_count; ++i) { +- if (synthesize_sdt_probe_arg(&buf, i, args[i]) < 0) ++ if (synthesize_sdt_probe_arg(&buf, i, args[i]) < 0) { ++ argv_free(args); + goto error; ++ } + } ++ ++ argv_free(args); + } + + out: +-- +2.27.0 + diff --git a/queue-5.4/perf-record-fix-memory-leak-when-using-user-regs-to-.patch b/queue-5.4/perf-record-fix-memory-leak-when-using-user-regs-to-.patch new file mode 100644 index 00000000000..1c5a0c41cac --- /dev/null +++ b/queue-5.4/perf-record-fix-memory-leak-when-using-user-regs-to-.patch @@ -0,0 +1,45 @@ +From bf7b4f0d9f6acb11db2cd1c0ccb6d0296e416c11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 3 Jul 2020 17:33:44 +0800 +Subject: =?UTF-8?q?perf=20record:=20Fix=20memory=20leak=20when=20using=20'?= + =?UTF-8?q?--user-regs=3D=3F'=20to=20list=20registers?= + +From: Zheng Zengkai + +[ Upstream commit 2eb5dd418034ecea2f7031e3d33f2991a878b148 ] + +When using 'perf record's option '-I' or '--user-regs=' along with +argument '?' to list available register names, memory of variable 'os' +allocated by strdup() needs to be released before __parse_regs() +returns, otherwise memory leak will occur. + +Fixes: bcc84ec65ad1 ("perf record: Add ability to name registers to record") +Signed-off-by: Zheng Zengkai +Acked-by: Jiri Olsa +Cc: Alexander Shishkin +Cc: Li Bin +Cc: Mark Rutland +Cc: Namhyung Kim +Link: https://lore.kernel.org/r/20200703093344.189450-1-zhengzengkai@huawei.com +Signed-off-by: Arnaldo Carvalho de Melo +Signed-off-by: Sasha Levin +--- + tools/perf/util/parse-regs-options.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/perf/util/parse-regs-options.c b/tools/perf/util/parse-regs-options.c +index ef46c28488085..869ef7e22bd91 100644 +--- a/tools/perf/util/parse-regs-options.c ++++ b/tools/perf/util/parse-regs-options.c +@@ -52,7 +52,7 @@ __parse_regs(const struct option *opt, const char *str, int unset, bool intr) + } + fputc('\n', stderr); + /* just printing available regs */ +- return -1; ++ goto error; + } + for (r = sample_reg_masks; r->name; r++) { + if ((r->mask & mask) && !strcasecmp(s, r->name)) +-- +2.27.0 + diff --git a/queue-5.4/phy-renesas-rcar-gen3-usb2-disable-runtime-pm-in-cas.patch b/queue-5.4/phy-renesas-rcar-gen3-usb2-disable-runtime-pm-in-cas.patch new file mode 100644 index 00000000000..a312fa3bd7d --- /dev/null +++ b/queue-5.4/phy-renesas-rcar-gen3-usb2-disable-runtime-pm-in-cas.patch @@ -0,0 +1,42 @@ +From c68046a4a391dafed382eae58450cd88f360afd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Nov 2020 10:44:12 +0800 +Subject: phy: renesas: rcar-gen3-usb2: disable runtime pm in case of failure + +From: Wang Li + +[ Upstream commit 51e339deab1e51443f6ac3b1bd5cd6cc8e8fe1d9 ] + +pm_runtime_enable() will decrease power disable depth. Thus a pairing +increment is needed on the error handling path to keep it balanced. + +Fixes: 5d8042e95fd4 ("phy: rcar-gen3-usb2: Add support for r8a77470") +Reported-by: Hulk Robot +Signed-off-by: Wang Li +Link: https://lore.kernel.org/r/20201126024412.4046845-1-wangli74@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/renesas/phy-rcar-gen3-usb2.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +index 5087b7c44d55b..cfb98bba7715b 100644 +--- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c ++++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c +@@ -654,8 +654,10 @@ static int rcar_gen3_phy_usb2_probe(struct platform_device *pdev) + */ + pm_runtime_enable(dev); + phy_usb2_ops = of_device_get_match_data(dev); +- if (!phy_usb2_ops) +- return -EINVAL; ++ if (!phy_usb2_ops) { ++ ret = -EINVAL; ++ goto error; ++ } + + mutex_init(&channel->lock); + for (i = 0; i < NUM_OF_PHYS; i++) { +-- +2.27.0 + diff --git a/queue-5.4/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch b/queue-5.4/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch new file mode 100644 index 00000000000..39d1b036b37 --- /dev/null +++ b/queue-5.4/pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch @@ -0,0 +1,64 @@ +From 0d3fb9a184f1314c84414d1d7280da98ae016e23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 09:12:19 +0800 +Subject: pinctrl: falcon: add missing put_device() call in + pinctrl_falcon_probe() + +From: Yu Kuai + +[ Upstream commit 89cce2b3f247a434ee174ab6803698041df98014 ] + +if of_find_device_by_node() succeed, pinctrl_falcon_probe() doesn't have +a corresponding put_device(). Thus add put_device() to fix the exception +handling for this function implementation. + +Fixes: e316cb2b16bb ("OF: pinctrl: MIPS: lantiq: adds support for FALCON SoC") +Signed-off-by: Yu Kuai +Link: https://lore.kernel.org/r/20201119011219.2248232-1-yukuai3@huawei.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-falcon.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-falcon.c b/drivers/pinctrl/pinctrl-falcon.c +index 62c02b969327f..7521a924dffb0 100644 +--- a/drivers/pinctrl/pinctrl-falcon.c ++++ b/drivers/pinctrl/pinctrl-falcon.c +@@ -431,24 +431,28 @@ static int pinctrl_falcon_probe(struct platform_device *pdev) + + /* load and remap the pad resources of the different banks */ + for_each_compatible_node(np, NULL, "lantiq,pad-falcon") { +- struct platform_device *ppdev = of_find_device_by_node(np); + const __be32 *bank = of_get_property(np, "lantiq,bank", NULL); + struct resource res; ++ struct platform_device *ppdev; + u32 avail; + int pins; + + if (!of_device_is_available(np)) + continue; + +- if (!ppdev) { +- dev_err(&pdev->dev, "failed to find pad pdev\n"); +- continue; +- } + if (!bank || *bank >= PORTS) + continue; + if (of_address_to_resource(np, 0, &res)) + continue; ++ ++ ppdev = of_find_device_by_node(np); ++ if (!ppdev) { ++ dev_err(&pdev->dev, "failed to find pad pdev\n"); ++ continue; ++ } ++ + falcon_info.clk[*bank] = clk_get(&ppdev->dev, NULL); ++ put_device(&ppdev->dev); + if (IS_ERR(falcon_info.clk[*bank])) { + dev_err(&ppdev->dev, "failed to get clock\n"); + of_node_put(np); +-- +2.27.0 + diff --git a/queue-5.4/platform-chrome-cros_ec_spi-don-t-overwrite-spi-mode.patch b/queue-5.4/platform-chrome-cros_ec_spi-don-t-overwrite-spi-mode.patch new file mode 100644 index 00000000000..62868e74896 --- /dev/null +++ b/queue-5.4/platform-chrome-cros_ec_spi-don-t-overwrite-spi-mode.patch @@ -0,0 +1,49 @@ +From 315c4d5ba3b79b24b6ca37a6c453c18b277de4d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 11:35:38 -0800 +Subject: platform/chrome: cros_ec_spi: Don't overwrite spi::mode + +From: Stephen Boyd + +[ Upstream commit 74639cbf51d7c0304342544a83dfda354a6bd208 ] + +There isn't any need to overwrite the mode here in the driver with what +has been detected by the firmware, such as DT or ACPI. In fact, if we +use the SPI CS gpio descriptor feature we will overwrite the mode with +SPI_MODE_0 where it already contains SPI_MODE_0 and more importantly +SPI_CS_HIGH. Clearing the SPI_CS_HIGH bit causes the CS line to toggle +when the device is probed when it shouldn't change, confusing the driver +and making it fail to probe. Drop the assignment and let the spi core +take care of it. + +Fixes: a17d94f0b6e1 ("mfd: Add ChromeOS EC SPI driver") +Cc: Simon Glass +Cc: Gwendal Grignou +Reviewed-by: Douglas Anderson +Tested-by: Douglas Anderson +Acked-by: Enric Balletbo i Serra +Cc: Alexandru M Stan +Signed-off-by: Stephen Boyd +Reviewed-by: Simon Glass +Link: https://lore.kernel.org/r/20201204193540.3047030-2-swboyd@chromium.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/platform/chrome/cros_ec_spi.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/platform/chrome/cros_ec_spi.c b/drivers/platform/chrome/cros_ec_spi.c +index a831bd5a5b2ff..5e4521b014280 100644 +--- a/drivers/platform/chrome/cros_ec_spi.c ++++ b/drivers/platform/chrome/cros_ec_spi.c +@@ -739,7 +739,6 @@ static int cros_ec_spi_probe(struct spi_device *spi) + int err; + + spi->bits_per_word = 8; +- spi->mode = SPI_MODE_0; + spi->rt = true; + err = spi_setup(spi); + if (err < 0) +-- +2.27.0 + diff --git a/queue-5.4/platform-x86-dell-smbios-base-fix-error-return-code-.patch b/queue-5.4/platform-x86-dell-smbios-base-fix-error-return-code-.patch new file mode 100644 index 00000000000..872c3767dda --- /dev/null +++ b/queue-5.4/platform-x86-dell-smbios-base-fix-error-return-code-.patch @@ -0,0 +1,39 @@ +From cbf1b4aa7558df242854b46edd677d65952a01a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 14:50:32 +0800 +Subject: platform/x86: dell-smbios-base: Fix error return code in + dell_smbios_init + +From: Qinglang Miao + +[ Upstream commit 2425ccd30fd78ce35237350fe8baac31dc18bd45 ] + +Fix to return the error code -ENODEV when fails to init wmi and +smm. + +Fixes: 41e36f2f85af ("platform/x86: dell-smbios: Link all dell-smbios-* modules together") +Reported-by: Hulk Robot +Signed-off-by: Qinglang Miao +Reviewed-by: Mario Limonciello +Link: https://lore.kernel.org/r/20201125065032.154125-1-miaoqinglang@huawei.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/dell-smbios-base.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/platform/x86/dell-smbios-base.c b/drivers/platform/x86/dell-smbios-base.c +index fe59b0ebff314..ceb8e701028df 100644 +--- a/drivers/platform/x86/dell-smbios-base.c ++++ b/drivers/platform/x86/dell-smbios-base.c +@@ -594,6 +594,7 @@ static int __init dell_smbios_init(void) + if (wmi && smm) { + pr_err("No SMBIOS backends available (wmi: %d, smm: %d)\n", + wmi, smm); ++ ret = -ENODEV; + goto fail_create_group; + } + +-- +2.27.0 + diff --git a/queue-5.4/platform-x86-mlx-platform-fix-item-counter-assignmen.patch b/queue-5.4/platform-x86-mlx-platform-fix-item-counter-assignmen.patch new file mode 100644 index 00000000000..dc9c5d50ffa --- /dev/null +++ b/queue-5.4/platform-x86-mlx-platform-fix-item-counter-assignmen.patch @@ -0,0 +1,58 @@ +From 632d316ef6e8b253286eae4b749b382dd016aa8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 19:47:44 +0200 +Subject: platform/x86: mlx-platform: Fix item counter assignment for MSN2700, + MSN24xx systems + +From: Vadim Pasternak + +[ Upstream commit ba4939f1dd46dde08c2f9b9d7ac86ed3ea7ead86 ] + +Fix array names to match assignments for data items and data items +counter in 'mlxplat_mlxcpld_default_items' structure for: + .data = mlxplat_mlxcpld_default_pwr_items_data, + .count = ARRAY_SIZE(mlxplat_mlxcpld_pwr), +and + .data = mlxplat_mlxcpld_default_fan_items_data, + .count = ARRAY_SIZE(mlxplat_mlxcpld_fan), + +Replace: +- 'mlxplat_mlxcpld_pwr' by 'mlxplat_mlxcpld_default_pwr_items_data' for + ARRAY_SIZE() calculation. +- 'mlxplat_mlxcpld_fan' by 'mlxplat_mlxcpld_default_fan_items_data' + for ARRAY_SIZE() calculation. + +Fixes: c6acad68eb2d ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20201207174745.22889-2-vadimp@nvidia.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/mlx-platform.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c +index 4b3d94c4a939a..acb094ddf8e61 100644 +--- a/drivers/platform/x86/mlx-platform.c ++++ b/drivers/platform/x86/mlx-platform.c +@@ -355,7 +355,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = { + .aggr_mask = MLXPLAT_CPLD_AGGR_PWR_MASK_DEF, + .reg = MLXPLAT_CPLD_LPC_REG_PWR_OFFSET, + .mask = MLXPLAT_CPLD_PWR_MASK, +- .count = ARRAY_SIZE(mlxplat_mlxcpld_pwr), ++ .count = ARRAY_SIZE(mlxplat_mlxcpld_default_pwr_items_data), + .inversed = 0, + .health = false, + }, +@@ -364,7 +364,7 @@ static struct mlxreg_core_item mlxplat_mlxcpld_default_items[] = { + .aggr_mask = MLXPLAT_CPLD_AGGR_FAN_MASK_DEF, + .reg = MLXPLAT_CPLD_LPC_REG_FAN_OFFSET, + .mask = MLXPLAT_CPLD_FAN_MASK, +- .count = ARRAY_SIZE(mlxplat_mlxcpld_fan), ++ .count = ARRAY_SIZE(mlxplat_mlxcpld_default_fan_items_data), + .inversed = 1, + .health = false, + }, +-- +2.27.0 + diff --git a/queue-5.4/platform-x86-mlx-platform-remove-psu-eeprom-from-def.patch b/queue-5.4/platform-x86-mlx-platform-remove-psu-eeprom-from-def.patch new file mode 100644 index 00000000000..dcff0e3919a --- /dev/null +++ b/queue-5.4/platform-x86-mlx-platform-remove-psu-eeprom-from-def.patch @@ -0,0 +1,57 @@ +From d8064d122cb3013d422938ed17eedd96c546e1ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 12:10:55 +0200 +Subject: platform/x86: mlx-platform: Remove PSU EEPROM from default platform + configuration + +From: Vadim Pasternak + +[ Upstream commit 2bf5046bdb649908df8bcc0a012c56eee931a9af ] + +Remove PSU EEPROM configuration for systems class equipped with +Mellanox chip Spectrum and Celeron CPU - system types MSN2700, MSN2100. +Till now all the systems from this class used few types of power units, +all equipped with EEPROM device with address space two bytes. Thus, all +these devices have been handled by EEPROM driver "24c02". + +There is a new requirement is to support power unit replacement by "off +the shelf" device, matching electrical required parameters. Such device +can be equipped with different EEPROM type, which could be one byte +address space addressing or even could be not equipped with EEPROM. +In such case "24c02" will not work. + +Fixes: c6acad68e ("platform/mellanox: mlxreg-hotplug: Modify to use a regmap interface") +Fixes: ba814fdd0 ("platform/x86: mlx-platform: Use defines for bus assignment") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20201125101056.174708-2-vadimp@nvidia.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/mlx-platform.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c +index 59b5b7eebb05a..bd57d3bbaa432 100644 +--- a/drivers/platform/x86/mlx-platform.c ++++ b/drivers/platform/x86/mlx-platform.c +@@ -273,15 +273,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_default_psu_items_data[] = { + .label = "psu1", + .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, + .mask = BIT(0), +- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[0], +- .hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR, ++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE, + }, + { + .label = "psu2", + .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, + .mask = BIT(1), +- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[1], +- .hpdev.nr = MLXPLAT_CPLD_PSU_DEFAULT_NR, ++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE, + }, + }; + +-- +2.27.0 + diff --git a/queue-5.4/platform-x86-mlx-platform-remove-psu-eeprom-from-msn.patch b/queue-5.4/platform-x86-mlx-platform-remove-psu-eeprom-from-msn.patch new file mode 100644 index 00000000000..de67dcb3a55 --- /dev/null +++ b/queue-5.4/platform-x86-mlx-platform-remove-psu-eeprom-from-msn.patch @@ -0,0 +1,56 @@ +From e7647a24cb71887c0a86c56a3a05ae5f7c3a71a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Nov 2020 12:10:56 +0200 +Subject: platform/x86: mlx-platform: Remove PSU EEPROM from MSN274x platform + configuration + +From: Vadim Pasternak + +[ Upstream commit 912b341585e302ee44fc5a2733f7bcf505e2c86f ] + +Remove PSU EEPROM configuration for systems class equipped with +Mellanox chip Spectrum and ATOM CPU - system types MSN274x. Till now +all the systems from this class used few types of power units, all +equipped with EEPROM device with address space two bytes. Thus, all +these devices have been handled by EEPROM driver "24c02". + +There is a new requirement is to support power unit replacement by "off +the shelf" device, matching electrical required parameters. Such device +can be equipped with different EEPROM type, which could be one byte +address space addressing or even could be not equipped with EEPROM. +In such case "24c02" will not work. + +Fixes: ef08e14a3 ("platform/x86: mlx-platform: Add support for new msn274x system type") +Signed-off-by: Vadim Pasternak +Link: https://lore.kernel.org/r/20201125101056.174708-3-vadimp@nvidia.com +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/mlx-platform.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/x86/mlx-platform.c b/drivers/platform/x86/mlx-platform.c +index bd57d3bbaa432..4b3d94c4a939a 100644 +--- a/drivers/platform/x86/mlx-platform.c ++++ b/drivers/platform/x86/mlx-platform.c +@@ -442,15 +442,13 @@ static struct mlxreg_core_data mlxplat_mlxcpld_msn274x_psu_items_data[] = { + .label = "psu1", + .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, + .mask = BIT(0), +- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[0], +- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR, ++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE, + }, + { + .label = "psu2", + .reg = MLXPLAT_CPLD_LPC_REG_PSU_OFFSET, + .mask = BIT(1), +- .hpdev.brdinfo = &mlxplat_mlxcpld_psu[1], +- .hpdev.nr = MLXPLAT_CPLD_PSU_MSNXXXX_NR, ++ .hpdev.nr = MLXPLAT_CPLD_NR_NONE, + }, + }; + +-- +2.27.0 + diff --git a/queue-5.4/power-supply-axp288_charger-fix-hp-pavilion-x2-10-dm.patch b/queue-5.4/power-supply-axp288_charger-fix-hp-pavilion-x2-10-dm.patch new file mode 100644 index 00000000000..6ed09c4c734 --- /dev/null +++ b/queue-5.4/power-supply-axp288_charger-fix-hp-pavilion-x2-10-dm.patch @@ -0,0 +1,102 @@ +From 243651c347b7523d4297b44d0c23cc243b283dc1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 13:13:12 +0100 +Subject: power: supply: axp288_charger: Fix HP Pavilion x2 10 DMI matching + +From: Hans de Goede + +[ Upstream commit a0f1ccd96c7049377d892a4299b6d5e47ec9179d ] + +Commit 9c80662a74cd ("power: supply: axp288_charger: Add special handling +for HP Pavilion x2 10") added special handling for HP Pavilion x2 10 +models which use the weird combination of a Type-C connector and the +non Type-C aware AXP288 PMIC. + +This special handling was activated by a DMI match a the product-name +of "HP Pavilion x2 Detachable". Recently I've learned that there are +also older "HP Pavilion x2 Detachable" models with an AXP288 PMIC + +a micro-usb connector where we should not activate the special handling +for the Type-C connectors. + +Extend the matching to also match on the DMI board-name and match on the +2 boards (one Bay Trail based one Cherry Trail based) of which we are +certain that they use the AXP288 + Type-C connector combination. + +Note the DSDT code from these older (AXP288 + micro-USB) models contains +some AML code (which never runs under Linux) which reads the micro-USB +connector id-pin and if it is pulled to ground, which would normally mean +the port is in host mode!, then it sets the input-current-limit to 3A, +it seems HP is using the micro-USB port as a charging only connector +and identifies their own 3A capable charger though this hack which is a +major violation of the USB specs. Note HP also hardcodes a 2A limit +when the id-pin is not pulled to ground, which is also in violation +of the specs. + +I've no intention to add support for HP's hack to support 3A charging +on these older models. By making the DMI matches for the Type-C equipped +models workaround more tighter, these older models will be treated just +like any other AXP288 + micro-USB equipped device and the input-current +limit will follow the BC 1.2 spec (using the defacto standard values +there where the BC 1.2 spec defines a range). + +Fixes: 9c80662a74cd ("power: supply: axp288_charger: Add special handling for HP Pavilion x2 10") +BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=1896924 +Signed-off-by: Hans de Goede +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/axp288_charger.c | 28 ++++++++++++++++----------- + 1 file changed, 17 insertions(+), 11 deletions(-) + +diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c +index cf4c67b2d2359..7d09e49f04d3b 100644 +--- a/drivers/power/supply/axp288_charger.c ++++ b/drivers/power/supply/axp288_charger.c +@@ -548,14 +548,15 @@ out: + + /* + * The HP Pavilion x2 10 series comes in a number of variants: +- * Bay Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "815D" +- * Cherry Trail SoC + AXP288 PMIC, DMI_BOARD_NAME: "813E" +- * Cherry Trail SoC + TI PMIC, DMI_BOARD_NAME: "827C" or "82F4" ++ * Bay Trail SoC + AXP288 PMIC, Micro-USB, DMI_BOARD_NAME: "8021" ++ * Bay Trail SoC + AXP288 PMIC, Type-C, DMI_BOARD_NAME: "815D" ++ * Cherry Trail SoC + AXP288 PMIC, Type-C, DMI_BOARD_NAME: "813E" ++ * Cherry Trail SoC + TI PMIC, Type-C, DMI_BOARD_NAME: "827C" or "82F4" + * +- * The variants with the AXP288 PMIC are all kinds of special: ++ * The variants with the AXP288 + Type-C connector are all kinds of special: + * +- * 1. All variants use a Type-C connector which the AXP288 does not support, so +- * when using a Type-C charger it is not recognized. Unlike most AXP288 devices, ++ * 1. They use a Type-C connector which the AXP288 does not support, so when ++ * using a Type-C charger it is not recognized. Unlike most AXP288 devices, + * this model actually has mostly working ACPI AC / Battery code, the ACPI code + * "solves" this by simply setting the input_current_limit to 3A. + * There are still some issues with the ACPI code, so we use this native driver, +@@ -578,12 +579,17 @@ out: + */ + static const struct dmi_system_id axp288_hp_x2_dmi_ids[] = { + { +- /* +- * Bay Trail model has "Hewlett-Packard" as sys_vendor, Cherry +- * Trail model has "HP", so we only match on product_name. +- */ + .matches = { +- DMI_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"), ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "815D"), ++ }, ++ }, ++ { ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "HP"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "HP Pavilion x2 Detachable"), ++ DMI_EXACT_MATCH(DMI_BOARD_NAME, "813E"), + }, + }, + {} /* Terminating entry */ +-- +2.27.0 + diff --git a/queue-5.4/power-supply-bq24190_charger-fix-reference-leak.patch b/queue-5.4/power-supply-bq24190_charger-fix-reference-leak.patch new file mode 100644 index 00000000000..3b24f18bd97 --- /dev/null +++ b/queue-5.4/power-supply-bq24190_charger-fix-reference-leak.patch @@ -0,0 +1,91 @@ +From 1192b1824dc9d54231dc69b2d4fc540f13668ce5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 22:33:21 +0800 +Subject: power: supply: bq24190_charger: fix reference leak + +From: Zhang Qilong + +[ Upstream commit b2f6cb78eaa1cad57dd3fe11d0458cd4fae9a584 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to call pm_runtime_put_noidle will result +in reference leak in callers(bq24190_sysfs_show, +bq24190_charger_get_property, bq24190_charger_set_property, +bq24190_battery_get_property, bq24190_battery_set_property), +so we should fix it. + +Fixes: f385e6e2a1532 ("power: bq24190_charger: Use PM runtime autosuspend") +Signed-off-by: Zhang Qilong +Signed-off-by: Sebastian Reichel +Signed-off-by: Sasha Levin +--- + drivers/power/supply/bq24190_charger.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c +index 453d6332d43a7..1ae5d6d42c9e3 100644 +--- a/drivers/power/supply/bq24190_charger.c ++++ b/drivers/power/supply/bq24190_charger.c +@@ -448,8 +448,10 @@ static ssize_t bq24190_sysfs_show(struct device *dev, + return -EINVAL; + + ret = pm_runtime_get_sync(bdi->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(bdi->dev); + return ret; ++ } + + ret = bq24190_read_mask(bdi, info->reg, info->mask, info->shift, &v); + if (ret) +@@ -1075,8 +1077,10 @@ static int bq24190_charger_get_property(struct power_supply *psy, + dev_dbg(bdi->dev, "prop: %d\n", psp); + + ret = pm_runtime_get_sync(bdi->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(bdi->dev); + return ret; ++ } + + switch (psp) { + case POWER_SUPPLY_PROP_CHARGE_TYPE: +@@ -1147,8 +1151,10 @@ static int bq24190_charger_set_property(struct power_supply *psy, + dev_dbg(bdi->dev, "prop: %d\n", psp); + + ret = pm_runtime_get_sync(bdi->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(bdi->dev); + return ret; ++ } + + switch (psp) { + case POWER_SUPPLY_PROP_ONLINE: +@@ -1408,8 +1414,10 @@ static int bq24190_battery_get_property(struct power_supply *psy, + dev_dbg(bdi->dev, "prop: %d\n", psp); + + ret = pm_runtime_get_sync(bdi->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(bdi->dev); + return ret; ++ } + + switch (psp) { + case POWER_SUPPLY_PROP_STATUS: +@@ -1454,8 +1462,10 @@ static int bq24190_battery_set_property(struct power_supply *psy, + dev_dbg(bdi->dev, "prop: %d\n", psp); + + ret = pm_runtime_get_sync(bdi->dev); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(bdi->dev); + return ret; ++ } + + switch (psp) { + case POWER_SUPPLY_PROP_ONLINE: +-- +2.27.0 + diff --git a/queue-5.4/powerpc-64-fix-an-emit_bug_entry-in-head_64.s.patch b/queue-5.4/powerpc-64-fix-an-emit_bug_entry-in-head_64.s.patch new file mode 100644 index 00000000000..05c6b8e7b18 --- /dev/null +++ b/queue-5.4/powerpc-64-fix-an-emit_bug_entry-in-head_64.s.patch @@ -0,0 +1,41 @@ +From 1752eb831c0c5d102193fd02a17c2bb0988ac17c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Nov 2020 11:44:04 +1100 +Subject: powerpc/64: Fix an EMIT_BUG_ENTRY in head_64.S + +From: Jordan Niethe + +[ Upstream commit fe18a35e685c9bdabc8b11b3e19deb85a068b75d ] + +Commit 63ce271b5e37 ("powerpc/prom: convert PROM_BUG() to standard +trap") added an EMIT_BUG_ENTRY for the trap after the branch to +start_kernel(). The EMIT_BUG_ENTRY was for the address "0b", however the +trap was not labeled with "0". Hence the address used for bug is in +relative_toc() where the previous "0" label is. Label the trap as "0" so +the correct address is used. + +Fixes: 63ce271b5e37 ("powerpc/prom: convert PROM_BUG() to standard trap") +Signed-off-by: Jordan Niethe +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201130004404.30953-1-jniethe5@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_64.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S +index d61b3b13a6ec8..9019f1395d39a 100644 +--- a/arch/powerpc/kernel/head_64.S ++++ b/arch/powerpc/kernel/head_64.S +@@ -992,7 +992,7 @@ start_here_common: + bl start_kernel + + /* Not reached */ +- trap ++0: trap + EMIT_BUG_ENTRY 0b, __FILE__, __LINE__, 0 + + /* +-- +2.27.0 + diff --git a/queue-5.4/powerpc-64-set-up-a-kernel-stack-for-secondaries-bef.patch b/queue-5.4/powerpc-64-set-up-a-kernel-stack-for-secondaries-bef.patch new file mode 100644 index 00000000000..e6ece37e6e0 --- /dev/null +++ b/queue-5.4/powerpc-64-set-up-a-kernel-stack-for-secondaries-bef.patch @@ -0,0 +1,105 @@ +From ea55dd33669d9e058b799813a5ce1145949a3495 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 14 Oct 2020 18:28:36 +1100 +Subject: powerpc/64: Set up a kernel stack for secondaries before + cpu_restore() + +From: Jordan Niethe + +[ Upstream commit 3c0b976bf20d236c57adcefa80f86a0a1d737727 ] + +Currently in generic_secondary_smp_init(), cur_cpu_spec->cpu_restore() +is called before a stack has been set up in r1. This was previously fine +as the cpu_restore() functions were implemented in assembly and did not +use a stack. However commit 5a61ef74f269 ("powerpc/64s: Support new +device tree binding for discovering CPU features") used +__restore_cpu_cpufeatures() as the cpu_restore() function for a +device-tree features based cputable entry. This is a C function and +hence uses a stack in r1. + +generic_secondary_smp_init() is entered on the secondary cpus via the +primary cpu using the OPAL call opal_start_cpu(). In OPAL, each hardware +thread has its own stack. The OPAL call is ran in the primary's hardware +thread. During the call, a job is scheduled on a secondary cpu that will +start executing at the address of generic_secondary_smp_init(). Hence +the value that will be left in r1 when the secondary cpu enters the +kernel is part of that secondary cpu's individual OPAL stack. This means +that __restore_cpu_cpufeatures() will write to that OPAL stack. This is +not horribly bad as each hardware thread has its own stack and the call +that enters the kernel from OPAL never returns, but it is still wrong +and should be corrected. + +Create the temp kernel stack before calling cpu_restore(). + +As noted by mpe, for a kexec boot, the secondary CPUs are released from +the spin loop at address 0x60 by smp_release_cpus() and then jump to +generic_secondary_smp_init(). The call to smp_release_cpus() is in +setup_arch(), and it comes before the call to emergency_stack_init(). +emergency_stack_init() allocates an emergency stack in the PACA for each +CPU. This address in the PACA is what is used to set up the temp kernel +stack in generic_secondary_smp_init(). Move releasing the secondary CPUs +to after the PACAs have been allocated an emergency stack, otherwise the +PACA stack pointer will contain garbage and hence the temp kernel stack +created from it will be broken. + +Fixes: 5a61ef74f269 ("powerpc/64s: Support new device tree binding for discovering CPU features") +Signed-off-by: Jordan Niethe +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201014072837.24539-1-jniethe5@gmail.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/head_64.S | 8 ++++---- + arch/powerpc/kernel/setup-common.c | 4 ++-- + 2 files changed, 6 insertions(+), 6 deletions(-) + +diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S +index 780f527eabd2c..d61b3b13a6ec8 100644 +--- a/arch/powerpc/kernel/head_64.S ++++ b/arch/powerpc/kernel/head_64.S +@@ -420,6 +420,10 @@ generic_secondary_common_init: + /* From now on, r24 is expected to be logical cpuid */ + mr r24,r5 + ++ /* Create a temp kernel stack for use before relocation is on. */ ++ ld r1,PACAEMERGSP(r13) ++ subi r1,r1,STACK_FRAME_OVERHEAD ++ + /* See if we need to call a cpu state restore handler */ + LOAD_REG_ADDR(r23, cur_cpu_spec) + ld r23,0(r23) +@@ -448,10 +452,6 @@ generic_secondary_common_init: + sync /* order paca.run and cur_cpu_spec */ + isync /* In case code patching happened */ + +- /* Create a temp kernel stack for use before relocation is on. */ +- ld r1,PACAEMERGSP(r13) +- subi r1,r1,STACK_FRAME_OVERHEAD +- + b __secondary_start + #endif /* SMP */ + +diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c +index 25aaa39030009..f281d011f4b97 100644 +--- a/arch/powerpc/kernel/setup-common.c ++++ b/arch/powerpc/kernel/setup-common.c +@@ -903,8 +903,6 @@ void __init setup_arch(char **cmdline_p) + + /* On BookE, setup per-core TLB data structures. */ + setup_tlb_core_data(); +- +- smp_release_cpus(); + #endif + + /* Print various info about the machine that has been gathered so far. */ +@@ -925,6 +923,8 @@ void __init setup_arch(char **cmdline_p) + exc_lvl_early_init(); + emergency_stack_init(); + ++ smp_release_cpus(); ++ + initmem_init(); + + early_memtest(min_low_pfn << PAGE_SHIFT, max_low_pfn << PAGE_SHIFT); +-- +2.27.0 + diff --git a/queue-5.4/powerpc-avoid-broken-gcc-__attribute__-optimize.patch b/queue-5.4/powerpc-avoid-broken-gcc-__attribute__-optimize.patch new file mode 100644 index 00000000000..dba613f7ebe --- /dev/null +++ b/queue-5.4/powerpc-avoid-broken-gcc-__attribute__-optimize.patch @@ -0,0 +1,108 @@ +From 0359cfd544d09f07cba5e40d8fb85bf46168ec47 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 09:04:33 +0100 +Subject: powerpc: Avoid broken GCC __attribute__((optimize)) + +From: Ard Biesheuvel + +[ Upstream commit a7223f5bfcaeade4a86d35263493bcda6c940891 ] + +Commit 7053f80d9696 ("powerpc/64: Prevent stack protection in early +boot") introduced a couple of uses of __attribute__((optimize)) with +function scope, to disable the stack protector in some early boot +code. + +Unfortunately, and this is documented in the GCC man pages [0], +overriding function attributes for optimization is broken, and is only +supported for debug scenarios, not for production: the problem appears +to be that setting GCC -f flags using this method will cause it to +forget about some or all other optimization settings that have been +applied. + +So the only safe way to disable the stack protector is to disable it +for the entire source file. + +[0] https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html + +Fixes: 7053f80d9696 ("powerpc/64: Prevent stack protection in early boot") +Signed-off-by: Ard Biesheuvel +[mpe: Drop one remaining use of __nostackprotector, reported by snowpatch] +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201028080433.26799-1-ardb@kernel.org +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/Makefile | 3 +++ + arch/powerpc/kernel/paca.c | 4 ++-- + arch/powerpc/kernel/setup.h | 6 ------ + arch/powerpc/kernel/setup_64.c | 2 +- + 4 files changed, 6 insertions(+), 9 deletions(-) + +diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile +index 59260eb962916..afbd47b0a75cc 100644 +--- a/arch/powerpc/kernel/Makefile ++++ b/arch/powerpc/kernel/Makefile +@@ -181,6 +181,9 @@ KCOV_INSTRUMENT_cputable.o := n + KCOV_INSTRUMENT_setup_64.o := n + KCOV_INSTRUMENT_paca.o := n + ++CFLAGS_setup_64.o += -fno-stack-protector ++CFLAGS_paca.o += -fno-stack-protector ++ + extra-$(CONFIG_PPC_FPU) += fpu.o + extra-$(CONFIG_ALTIVEC) += vector.o + extra-$(CONFIG_PPC64) += entry_64.o +diff --git a/arch/powerpc/kernel/paca.c b/arch/powerpc/kernel/paca.c +index 4ea0cca52e162..c786adfb9413f 100644 +--- a/arch/powerpc/kernel/paca.c ++++ b/arch/powerpc/kernel/paca.c +@@ -176,7 +176,7 @@ static struct slb_shadow * __init new_slb_shadow(int cpu, unsigned long limit) + struct paca_struct **paca_ptrs __read_mostly; + EXPORT_SYMBOL(paca_ptrs); + +-void __init __nostackprotector initialise_paca(struct paca_struct *new_paca, int cpu) ++void __init initialise_paca(struct paca_struct *new_paca, int cpu) + { + #ifdef CONFIG_PPC_PSERIES + new_paca->lppaca_ptr = NULL; +@@ -205,7 +205,7 @@ void __init __nostackprotector initialise_paca(struct paca_struct *new_paca, int + } + + /* Put the paca pointer into r13 and SPRG_PACA */ +-void __nostackprotector setup_paca(struct paca_struct *new_paca) ++void setup_paca(struct paca_struct *new_paca) + { + /* Setup r13 */ + local_paca = new_paca; +diff --git a/arch/powerpc/kernel/setup.h b/arch/powerpc/kernel/setup.h +index 1b02d338a5f55..c82577c4b15d3 100644 +--- a/arch/powerpc/kernel/setup.h ++++ b/arch/powerpc/kernel/setup.h +@@ -8,12 +8,6 @@ + #ifndef __ARCH_POWERPC_KERNEL_SETUP_H + #define __ARCH_POWERPC_KERNEL_SETUP_H + +-#ifdef CONFIG_CC_IS_CLANG +-#define __nostackprotector +-#else +-#define __nostackprotector __attribute__((__optimize__("no-stack-protector"))) +-#endif +- + void initialize_cache_info(void); + void irqstack_early_init(void); + +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index 480c236724da2..5bc7e753df4d0 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -284,7 +284,7 @@ void __init record_spr_defaults(void) + * device-tree is not accessible via normal means at this point. + */ + +-void __init __nostackprotector early_setup(unsigned long dt_ptr) ++void __init early_setup(unsigned long dt_ptr) + { + static __initdata struct paca_struct boot_paca; + +-- +2.27.0 + diff --git a/queue-5.4/powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch b/queue-5.4/powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch new file mode 100644 index 00000000000..66f6998b1fc --- /dev/null +++ b/queue-5.4/powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch @@ -0,0 +1,68 @@ +From 58cb09bb8e349bf20c98c73a3091aa355e5dcf49 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 18:07:12 +0000 +Subject: powerpc/feature: Fix CPU_FTRS_ALWAYS by removing CPU_FTRS_GENERIC_32 + +From: Christophe Leroy + +[ Upstream commit 78665179e569c7e1fe102fb6c21d0f5b6951f084 ] + +On 8xx, we get the following features: + +[ 0.000000] cpu_features = 0x0000000000000100 +[ 0.000000] possible = 0x0000000000000120 +[ 0.000000] always = 0x0000000000000000 + +This is not correct. As CONFIG_PPC_8xx is mutually exclusive with all +other configurations, the three lines should be equal. + +The problem is due to CPU_FTRS_GENERIC_32 which is taken when +CONFIG_BOOK3S_32 is NOT selected. This CPU_FTRS_GENERIC_32 is +pointless because there is no generic configuration supporting +all 32 bits but book3s/32. + +Remove this pointless generic features definition to unbreak the +calculation of 'possible' features and 'always' features. + +Fixes: 76bc080ef5a3 ("[POWERPC] Make default cputable entries reflect selected CPU family") +Signed-off-by: Christophe Leroy +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/76a85f30bf981d1aeaae00df99321235494da254.1604426550.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/include/asm/cputable.h | 5 ----- + 1 file changed, 5 deletions(-) + +diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h +index cf00ff0d121de..dc8e8552bd487 100644 +--- a/arch/powerpc/include/asm/cputable.h ++++ b/arch/powerpc/include/asm/cputable.h +@@ -407,7 +407,6 @@ static inline void cpu_feature_keys_init(void) { } + CPU_FTR_DBELL | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \ + CPU_FTR_DEBUG_LVL_EXC | CPU_FTR_EMB_HV | CPU_FTR_ALTIVEC_COMP | \ + CPU_FTR_CELL_TB_BUG | CPU_FTR_SMT) +-#define CPU_FTRS_GENERIC_32 (CPU_FTR_COMMON | CPU_FTR_NODSISRALIGN) + + /* 64-bit CPUs */ + #define CPU_FTRS_PPC970 (CPU_FTR_LWSYNC | \ +@@ -507,8 +506,6 @@ enum { + CPU_FTRS_7447 | CPU_FTRS_7447A | CPU_FTRS_82XX | + CPU_FTRS_G2_LE | CPU_FTRS_E300 | CPU_FTRS_E300C2 | + CPU_FTRS_CLASSIC32 | +-#else +- CPU_FTRS_GENERIC_32 | + #endif + #ifdef CONFIG_PPC_8xx + CPU_FTRS_8XX | +@@ -585,8 +582,6 @@ enum { + CPU_FTRS_7447 & CPU_FTRS_7447A & CPU_FTRS_82XX & + CPU_FTRS_G2_LE & CPU_FTRS_E300 & CPU_FTRS_E300C2 & + CPU_FTRS_CLASSIC32 & +-#else +- CPU_FTRS_GENERIC_32 & + #endif + #ifdef CONFIG_PPC_8xx + CPU_FTRS_8XX & +-- +2.27.0 + diff --git a/queue-5.4/powerpc-mm-sanity_check_fault-should-work-for-all-no.patch b/queue-5.4/powerpc-mm-sanity_check_fault-should-work-for-all-no.patch new file mode 100644 index 00000000000..b76fa233f5e --- /dev/null +++ b/queue-5.4/powerpc-mm-sanity_check_fault-should-work-for-all-no.patch @@ -0,0 +1,62 @@ +From 0416bfd99b06f2a12fcb5112b1572dd3348439b0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Dec 2020 05:29:21 +0000 +Subject: powerpc/mm: sanity_check_fault() should work for all, not only BOOK3S + +From: Christophe Leroy + +[ Upstream commit 7ceb40027e19567a0a066e3b380cc034cdd9a124 ] + +The verification and message introduced by commit 374f3f5979f9 +("powerpc/mm/hash: Handle user access of kernel address gracefully") +applies to all platforms, it should not be limited to BOOK3S. + +Make the BOOK3S version of sanity_check_fault() the one for all, +and bail out earlier if not BOOK3S. + +Fixes: 374f3f5979f9 ("powerpc/mm/hash: Handle user access of kernel address gracefully") +Signed-off-by: Christophe Leroy +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/fe199d5af3578d3bf80035d203a94d742a7a28af.1607491748.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + arch/powerpc/mm/fault.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c +index 187047592d53c..bb01a862aaf8d 100644 +--- a/arch/powerpc/mm/fault.c ++++ b/arch/powerpc/mm/fault.c +@@ -349,7 +349,6 @@ static inline void cmo_account_page_fault(void) + static inline void cmo_account_page_fault(void) { } + #endif /* CONFIG_PPC_SMLPAR */ + +-#ifdef CONFIG_PPC_BOOK3S + static void sanity_check_fault(bool is_write, bool is_user, + unsigned long error_code, unsigned long address) + { +@@ -366,6 +365,9 @@ static void sanity_check_fault(bool is_write, bool is_user, + return; + } + ++ if (!IS_ENABLED(CONFIG_PPC_BOOK3S)) ++ return; ++ + /* + * For hash translation mode, we should never get a + * PROTFAULT. Any update to pte to reduce access will result in us +@@ -400,10 +402,6 @@ static void sanity_check_fault(bool is_write, bool is_user, + + WARN_ON_ONCE(error_code & DSISR_PROTFAULT); + } +-#else +-static void sanity_check_fault(bool is_write, bool is_user, +- unsigned long error_code, unsigned long address) { } +-#endif /* CONFIG_PPC_BOOK3S */ + + /* + * Define the correct "is_write" bit in error_code based +-- +2.27.0 + diff --git a/queue-5.4/powerpc-perf-fix-crash-with-is_sier_available-when-p.patch b/queue-5.4/powerpc-perf-fix-crash-with-is_sier_available-when-p.patch new file mode 100644 index 00000000000..0b9594bf72b --- /dev/null +++ b/queue-5.4/powerpc-perf-fix-crash-with-is_sier_available-when-p.patch @@ -0,0 +1,71 @@ +From 2ddd7094933b767eca8f90d6cc62f96582123109 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 21:40:40 -0500 +Subject: powerpc/perf: Fix crash with is_sier_available when pmu is not set +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Athira Rajeev + +[ Upstream commit f75e7d73bdf73f07b0701a6d21c111ef5d9021dd ] + +On systems without any specific PMU driver support registered, running +'perf record' with —intr-regs will crash ( perf record -I ). + +The relevant portion from crash logs and Call Trace: + +Unable to handle kernel paging request for data at address 0x00000068 +Faulting instruction address: 0xc00000000013eb18 +Oops: Kernel access of bad area, sig: 11 [#1] +CPU: 2 PID: 13435 Comm: kill Kdump: loaded Not tainted 4.18.0-193.el8.ppc64le #1 +NIP: c00000000013eb18 LR: c000000000139f2c CTR: c000000000393d80 +REGS: c0000004a07ab4f0 TRAP: 0300 Not tainted (4.18.0-193.el8.ppc64le) +NIP [c00000000013eb18] is_sier_available+0x18/0x30 +LR [c000000000139f2c] perf_reg_value+0x6c/0xb0 +Call Trace: +[c0000004a07ab770] [c0000004a07ab7c8] 0xc0000004a07ab7c8 (unreliable) +[c0000004a07ab7a0] [c0000000003aa77c] perf_output_sample+0x60c/0xac0 +[c0000004a07ab840] [c0000000003ab3f0] perf_event_output_forward+0x70/0xb0 +[c0000004a07ab8c0] [c00000000039e208] __perf_event_overflow+0x88/0x1a0 +[c0000004a07ab910] [c00000000039e42c] perf_swevent_hrtimer+0x10c/0x1d0 +[c0000004a07abc50] [c000000000228b9c] __hrtimer_run_queues+0x17c/0x480 +[c0000004a07abcf0] [c00000000022aaf4] hrtimer_interrupt+0x144/0x520 +[c0000004a07abdd0] [c00000000002a864] timer_interrupt+0x104/0x2f0 +[c0000004a07abe30] [c0000000000091c4] decrementer_common+0x114/0x120 + +When perf record session is started with "-I" option, capturing registers +on each sample calls is_sier_available() to check for the +SIER (Sample Instruction Event Register) availability in the platform. +This function in core-book3s accesses 'ppmu->flags'. If a platform specific +PMU driver is not registered, ppmu is set to NULL and accessing its +members results in a crash. Fix the crash by returning false in +is_sier_available() if ppmu is not set. + +Fixes: 333804dc3b7a ("powerpc/perf: Update perf_regs structure to include SIER") +Reported-by: Sachin Sant +Signed-off-by: Athira Rajeev +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/1606185640-1720-1-git-send-email-atrajeev@linux.vnet.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/perf/core-book3s.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index f582aa2d98078..7bf1adcdfdaa1 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -133,6 +133,9 @@ static void pmao_restore_workaround(bool ebb) { } + + bool is_sier_available(void) + { ++ if (!ppmu) ++ return false; ++ + if (ppmu->flags & PPMU_HAS_SIER) + return true; + +-- +2.27.0 + diff --git a/queue-5.4/powerpc-ps3-use-dma_mapping_error.patch b/queue-5.4/powerpc-ps3-use-dma_mapping_error.patch new file mode 100644 index 00000000000..9ea57721105 --- /dev/null +++ b/queue-5.4/powerpc-ps3-use-dma_mapping_error.patch @@ -0,0 +1,41 @@ +From 0198d74d6bad77f65c9331deef91bfe5ab14ed7e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Dec 2020 19:26:22 +0100 +Subject: powerpc/ps3: use dma_mapping_error() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Vincent Stehlé + +[ Upstream commit d0edaa28a1f7830997131cbce87b6c52472825d1 ] + +The DMA address returned by dma_map_single() should be checked with +dma_mapping_error(). Fix the ps3stor_setup() function accordingly. + +Fixes: 80071802cb9c ("[POWERPC] PS3: Storage Driver Core") +Signed-off-by: Vincent Stehlé +Reviewed-by: Geert Uytterhoeven +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201213182622.23047-1-vincent.stehle@laposte.net +Signed-off-by: Sasha Levin +--- + drivers/ps3/ps3stor_lib.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/ps3/ps3stor_lib.c b/drivers/ps3/ps3stor_lib.c +index 333ba83006e48..a12a1ad9b5fe3 100644 +--- a/drivers/ps3/ps3stor_lib.c ++++ b/drivers/ps3/ps3stor_lib.c +@@ -189,7 +189,7 @@ int ps3stor_setup(struct ps3_storage_device *dev, irq_handler_t handler) + dev->bounce_lpar = ps3_mm_phys_to_lpar(__pa(dev->bounce_buf)); + dev->bounce_dma = dma_map_single(&dev->sbd.core, dev->bounce_buf, + dev->bounce_size, DMA_BIDIRECTIONAL); +- if (!dev->bounce_dma) { ++ if (dma_mapping_error(&dev->sbd.core, dev->bounce_dma)) { + dev_err(&dev->sbd.core, "%s:%u: map DMA region failed\n", + __func__, __LINE__); + error = -ENODEV; +-- +2.27.0 + diff --git a/queue-5.4/powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch b/queue-5.4/powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch new file mode 100644 index 00000000000..e95ee238ddf --- /dev/null +++ b/queue-5.4/powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch @@ -0,0 +1,73 @@ +From 2e808ac62db2434faadd4908d834b05297a3d7fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 15:51:49 -0600 +Subject: powerpc/pseries/hibernation: drop pseries_suspend_begin() from + suspend ops + +From: Nathan Lynch + +[ Upstream commit 52719fce3f4c7a8ac9eaa191e8d75a697f9fbcbc ] + +There are three ways pseries_suspend_begin() can be reached: + +1. When "mem" is written to /sys/power/state: + +kobj_attr_store() +-> state_store() + -> pm_suspend() + -> suspend_devices_and_enter() + -> pseries_suspend_begin() + +This never works because there is no way to supply a valid stream id +using this interface, and H_VASI_STATE is called with a stream id of +zero. So this call path is useless at best. + +2. When a stream id is written to /sys/devices/system/power/hibernate. +pseries_suspend_begin() is polled directly from store_hibernate() +until the stream is in the "Suspending" state (i.e. the platform is +ready for the OS to suspend execution): + +dev_attr_store() +-> store_hibernate() + -> pseries_suspend_begin() + +3. When a stream id is written to /sys/devices/system/power/hibernate +(continued). After #2, pseries_suspend_begin() is called once again +from the pm core: + +dev_attr_store() +-> store_hibernate() + -> pm_suspend() + -> suspend_devices_and_enter() + -> pseries_suspend_begin() + +This is redundant because the VASI suspend state is already known to +be Suspending. + +The begin() callback of platform_suspend_ops is optional, so we can +simply remove that assignment with no loss of function. + +Fixes: 32d8ad4e621d ("powerpc/pseries: Partition hibernation support") +Signed-off-by: Nathan Lynch +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201207215200.1785968-18-nathanl@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/suspend.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c +index f789693f61f40..0749ccb994002 100644 +--- a/arch/powerpc/platforms/pseries/suspend.c ++++ b/arch/powerpc/platforms/pseries/suspend.c +@@ -190,7 +190,6 @@ static struct bus_type suspend_subsys = { + + static const struct platform_suspend_ops pseries_suspend_ops = { + .valid = suspend_valid_only_mem, +- .begin = pseries_suspend_begin, + .prepare_late = pseries_prepare_late, + .enter = pseries_suspend_enter, + }; +-- +2.27.0 + diff --git a/queue-5.4/powerpc-pseries-hibernation-remove-redundant-cachein.patch b/queue-5.4/powerpc-pseries-hibernation-remove-redundant-cachein.patch new file mode 100644 index 00000000000..092a33f14ec --- /dev/null +++ b/queue-5.4/powerpc-pseries-hibernation-remove-redundant-cachein.patch @@ -0,0 +1,53 @@ +From 63cf6ff579755082928ac8ff77ebd3e624e1bc00 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 15:51:56 -0600 +Subject: powerpc/pseries/hibernation: remove redundant cacheinfo update + +From: Nathan Lynch + +[ Upstream commit b866459489fe8ef0e92cde3cbd6bbb1af6c4e99b ] + +Partitions with cache nodes in the device tree can encounter the +following warning on resume: + +CPU 0 already accounted in PowerPC,POWER9@0(Data) +WARNING: CPU: 0 PID: 3177 at arch/powerpc/kernel/cacheinfo.c:197 cacheinfo_cpu_online+0x640/0x820 + +These calls to cacheinfo_cpu_offline/online have been redundant since +commit e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo +hierarchy post-migration"). + +Fixes: e610a466d16a ("powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration") +Signed-off-by: Nathan Lynch +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20201207215200.1785968-25-nathanl@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/platforms/pseries/suspend.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c +index 0749ccb994002..e5ecadfb5dea2 100644 +--- a/arch/powerpc/platforms/pseries/suspend.c ++++ b/arch/powerpc/platforms/pseries/suspend.c +@@ -13,7 +13,6 @@ + #include + #include + #include +-#include "../../kernel/cacheinfo.h" + + static u64 stream_id; + static struct device suspend_dev; +@@ -78,9 +77,7 @@ static void pseries_suspend_enable_irqs(void) + * Update configuration which can be modified based on device tree + * changes during resume. + */ +- cacheinfo_cpu_offline(smp_processor_id()); + post_mobility_fixup(); +- cacheinfo_cpu_online(smp_processor_id()); + } + + /** +-- +2.27.0 + diff --git a/queue-5.4/pwm-lp3943-dynamically-allocate-pwm-chip-base.patch b/queue-5.4/pwm-lp3943-dynamically-allocate-pwm-chip-base.patch new file mode 100644 index 00000000000..5396b5e42cb --- /dev/null +++ b/queue-5.4/pwm-lp3943-dynamically-allocate-pwm-chip-base.patch @@ -0,0 +1,44 @@ +From 8d3eb8d9b83153738a81eddc3be64d505d832922 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 19:11:35 +0530 +Subject: pwm: lp3943: Dynamically allocate PWM chip base +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Lokesh Vutla + +[ Upstream commit 1f0f1e80fdd3aa9631f6c22cda4f8550cfcfcc3e ] + +When there are other PWM controllers enabled along with pwm-lp3943, +pwm-lp3942 is failing to probe with -EEXIST error. This is because +other PWM controllers are probed first and assigned PWM base 0 and +pwm-lp3943 is requesting for 0 again. + +In order to avoid this, assign the chip base with -1, so that it is +dynamically allocated. + +Fixes: af66b3c0934e ("pwm: Add LP3943 PWM driver") +Signed-off-by: Lokesh Vutla +Reviewed-by: Uwe Kleine-König +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-lp3943.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-lp3943.c b/drivers/pwm/pwm-lp3943.c +index 7551253ada32b..bf3f14fb5f244 100644 +--- a/drivers/pwm/pwm-lp3943.c ++++ b/drivers/pwm/pwm-lp3943.c +@@ -275,6 +275,7 @@ static int lp3943_pwm_probe(struct platform_device *pdev) + lp3943_pwm->chip.dev = &pdev->dev; + lp3943_pwm->chip.ops = &lp3943_pwm_ops; + lp3943_pwm->chip.npwm = LP3943_NUM_PWMS; ++ lp3943_pwm->chip.base = -1; + + platform_set_drvdata(pdev, lp3943_pwm); + +-- +2.27.0 + diff --git a/queue-5.4/pwm-zx-add-missing-cleanup-in-error-path.patch b/queue-5.4/pwm-zx-add-missing-cleanup-in-error-path.patch new file mode 100644 index 00000000000..ca2f3beaeef --- /dev/null +++ b/queue-5.4/pwm-zx-add-missing-cleanup-in-error-path.patch @@ -0,0 +1,39 @@ +From a65792602b0a0c6d9dac5bd3246c603c05a12218 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 10:13:21 +0200 +Subject: pwm: zx: Add missing cleanup in error path +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 269effd03f6142df4c74814cfdd5f0b041b30bf9 ] + +zx_pwm_probe() called clk_prepare_enable() before; this must be undone +in the error path. + +Fixes: 4836193c435c ("pwm: Add ZTE ZX PWM device driver") +Signed-off-by: Uwe Kleine-König +Acked-by: Shawn Guo +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/pwm/pwm-zx.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/pwm/pwm-zx.c b/drivers/pwm/pwm-zx.c +index e2c21cc34a96a..3763ce5311ac2 100644 +--- a/drivers/pwm/pwm-zx.c ++++ b/drivers/pwm/pwm-zx.c +@@ -238,6 +238,7 @@ static int zx_pwm_probe(struct platform_device *pdev) + ret = pwmchip_add(&zpc->chip); + if (ret < 0) { + dev_err(&pdev->dev, "failed to add PWM chip: %d\n", ret); ++ clk_disable_unprepare(zpc->pclk); + return ret; + } + +-- +2.27.0 + diff --git a/queue-5.4/qlcnic-fix-error-code-in-probe.patch b/queue-5.4/qlcnic-fix-error-code-in-probe.patch new file mode 100644 index 00000000000..47c59df7e96 --- /dev/null +++ b/queue-5.4/qlcnic-fix-error-code-in-probe.patch @@ -0,0 +1,36 @@ +From 6d401e75bae5085ec390659f26e5e7bec349fc12 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Dec 2020 11:38:04 +0300 +Subject: qlcnic: Fix error code in probe + +From: Dan Carpenter + +[ Upstream commit 0d52848632a357948028eab67ff9b7cc0c12a0fb ] + +Return -EINVAL if we can't find the correct device. Currently it +returns success. + +Fixes: 13159183ec7a ("qlcnic: 83xx base driver") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X9nHbMqEyI/xPfGd@mwanda +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c +index c07438db30ba1..f2e5f494462b3 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c +@@ -2509,6 +2509,7 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + qlcnic_sriov_vf_register_map(ahw); + break; + default: ++ err = -EINVAL; + goto err_out_free_hw_res; + } + +-- +2.27.0 + diff --git a/queue-5.4/qtnfmac-fix-error-return-code-in-qtnf_pcie_probe.patch b/queue-5.4/qtnfmac-fix-error-return-code-in-qtnf_pcie_probe.patch new file mode 100644 index 00000000000..470989bfb8c --- /dev/null +++ b/queue-5.4/qtnfmac-fix-error-return-code-in-qtnf_pcie_probe.patch @@ -0,0 +1,52 @@ +From ddea495447d1d0a1b8055f87631441d59ef251f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 14 Nov 2020 20:33:47 +0800 +Subject: qtnfmac: fix error return code in qtnf_pcie_probe() + +From: Wang Hai + +[ Upstream commit 31e07aa33fa7cdc93fa91c3f78f031e8d38862c2 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: b7da53cd6cd1 ("qtnfmac_pcie: use single PCIe driver for all platforms") +Reported-by: Hulk Robot +Signed-off-by: Wang Hai +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20201114123347.29632-1-wanghai38@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c +index 4824be0c6231e..2b8db3f73d00b 100644 +--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c ++++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/pcie.c +@@ -299,19 +299,19 @@ static int qtnf_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id) + sysctl_bar = qtnf_map_bar(pdev, QTN_SYSCTL_BAR); + if (IS_ERR(sysctl_bar)) { + pr_err("failed to map BAR%u\n", QTN_SYSCTL_BAR); +- return ret; ++ return PTR_ERR(sysctl_bar); + } + + dmareg_bar = qtnf_map_bar(pdev, QTN_DMA_BAR); + if (IS_ERR(dmareg_bar)) { + pr_err("failed to map BAR%u\n", QTN_DMA_BAR); +- return ret; ++ return PTR_ERR(dmareg_bar); + } + + epmem_bar = qtnf_map_bar(pdev, QTN_SHMEM_BAR); + if (IS_ERR(epmem_bar)) { + pr_err("failed to map BAR%u\n", QTN_SHMEM_BAR); +- return ret; ++ return PTR_ERR(epmem_bar); + } + + chipid = qtnf_chip_id_get(sysctl_bar); +-- +2.27.0 + diff --git a/queue-5.4/rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch b/queue-5.4/rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch new file mode 100644 index 00000000000..cab840e7abe --- /dev/null +++ b/queue-5.4/rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch @@ -0,0 +1,37 @@ +From 3a634b849b249264f27d45d31667959b00dd71c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 14:49:52 +0300 +Subject: RDMA/bnxt_re: Set queue pair state when being queried + +From: Kamal Heib + +[ Upstream commit 53839b51a7671eeb3fb44d479d541cf3a0f2dd45 ] + +The API for ib_query_qp requires the driver to set cur_qp_state on return, +add the missing set. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Link: https://lore.kernel.org/r/20201021114952.38876-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Acked-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 3b05c0640338f..58c021648b7c8 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1793,6 +1793,7 @@ int bnxt_re_query_qp(struct ib_qp *ib_qp, struct ib_qp_attr *qp_attr, + goto out; + } + qp_attr->qp_state = __to_ib_qp_state(qplib_qp->state); ++ qp_attr->cur_qp_state = __to_ib_qp_state(qplib_qp->cur_qp_state); + qp_attr->en_sqd_async_notify = qplib_qp->en_sqd_async_notify ? 1 : 0; + qp_attr->qp_access_flags = __to_ib_access_flags(qplib_qp->access); + qp_attr->pkey_index = qplib_qp->pkey_index; +-- +2.27.0 + diff --git a/queue-5.4/rdma-cma-don-t-overwrite-sgid_attr-after-device-is-r.patch b/queue-5.4/rdma-cma-don-t-overwrite-sgid_attr-after-device-is-r.patch new file mode 100644 index 00000000000..b7730587736 --- /dev/null +++ b/queue-5.4/rdma-cma-don-t-overwrite-sgid_attr-after-device-is-r.patch @@ -0,0 +1,78 @@ +From 6eecccf06fe6c013b81d822de8cbe7ed498f67d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 13 Dec 2020 15:29:39 +0200 +Subject: RDMA/cma: Don't overwrite sgid_attr after device is released + +From: Leon Romanovsky + +[ Upstream commit e246b7c035d74abfb3507fa10082d0c42cc016c3 ] + +As part of the cma_dev release, that pointer will be set to NULL. In case +it happens in rdma_bind_addr() (part of an error flow), the next call to +addr_handler() will have a call to cma_acquire_dev_by_src_ip() which will +overwrite sgid_attr without releasing it. + + WARNING: CPU: 2 PID: 108 at drivers/infiniband/core/cma.c:606 cma_bind_sgid_attr drivers/infiniband/core/cma.c:606 [inline] + WARNING: CPU: 2 PID: 108 at drivers/infiniband/core/cma.c:606 cma_acquire_dev_by_src_ip+0x470/0x4b0 drivers/infiniband/core/cma.c:649 + CPU: 2 PID: 108 Comm: kworker/u8:1 Not tainted 5.10.0-rc6+ #257 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 + Workqueue: ib_addr process_one_req + RIP: 0010:cma_bind_sgid_attr drivers/infiniband/core/cma.c:606 [inline] + RIP: 0010:cma_acquire_dev_by_src_ip+0x470/0x4b0 drivers/infiniband/core/cma.c:649 + Code: 66 d9 4a ff 4d 8b 6e 10 49 8d bd 1c 08 00 00 e8 b6 d6 4a ff 45 0f b6 bd 1c 08 00 00 41 83 e7 01 e9 49 fd ff ff e8 90 c5 29 ff <0f> 0b e9 80 fe ff ff e8 84 c5 29 ff 4c 89 f7 e8 2c d9 4a ff 4d 8b + RSP: 0018:ffff8881047c7b40 EFLAGS: 00010293 + RAX: ffff888104789c80 RBX: 0000000000000001 RCX: ffffffff820b8ef8 + RDX: 0000000000000000 RSI: ffffffff820b9080 RDI: ffff88810cd4c998 + RBP: ffff8881047c7c08 R08: ffff888104789c80 R09: ffffed10209f4036 + R10: ffff888104fa01ab R11: ffffed10209f4035 R12: ffff88810cd4c800 + R13: ffff888105750e28 R14: ffff888108f0a100 R15: ffff88810cd4c998 + FS: 0000000000000000(0000) GS:ffff888119c00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 0000000000000000 CR3: 0000000104e60005 CR4: 0000000000370ea0 + DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 + Call Trace: + addr_handler+0x266/0x350 drivers/infiniband/core/cma.c:3190 + process_one_req+0xa3/0x300 drivers/infiniband/core/addr.c:645 + process_one_work+0x54c/0x930 kernel/workqueue.c:2272 + worker_thread+0x82/0x830 kernel/workqueue.c:2418 + kthread+0x1ca/0x220 kernel/kthread.c:292 + ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 + +Fixes: ff11c6cd521f ("RDMA/cma: Introduce and use cma_acquire_dev_by_src_ip()") +Link: https://lore.kernel.org/r/20201213132940.345554-5-leon@kernel.org +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 98d2d74b96f78..ecac62a7b59e8 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -530,6 +530,10 @@ static void cma_release_dev(struct rdma_id_private *id_priv) + list_del(&id_priv->list); + cma_deref_dev(id_priv->cma_dev); + id_priv->cma_dev = NULL; ++ if (id_priv->id.route.addr.dev_addr.sgid_attr) { ++ rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr); ++ id_priv->id.route.addr.dev_addr.sgid_attr = NULL; ++ } + mutex_unlock(&lock); + } + +@@ -1879,9 +1883,6 @@ void rdma_destroy_id(struct rdma_cm_id *id) + + kfree(id_priv->id.route.path_rec); + +- if (id_priv->id.route.addr.dev_addr.sgid_attr) +- rdma_put_gid_attr(id_priv->id.route.addr.dev_addr.sgid_attr); +- + put_net(id_priv->id.route.addr.dev_addr.net); + kfree(id_priv); + } +-- +2.27.0 + diff --git a/queue-5.4/rdma-core-do-not-indicate-device-ready-when-device-e.patch b/queue-5.4/rdma-core-do-not-indicate-device-ready-when-device-e.patch new file mode 100644 index 00000000000..15b7e900fb7 --- /dev/null +++ b/queue-5.4/rdma-core-do-not-indicate-device-ready-when-device-e.patch @@ -0,0 +1,60 @@ +From 9e36ada985438ababc5a36d0cb80ff942033b8d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 09:35:44 +0200 +Subject: RDMA/core: Do not indicate device ready when device enablement fails + +From: Jack Morgenstein + +[ Upstream commit 779e0bf47632c609c59f527f9711ecd3214dccb0 ] + +In procedure ib_register_device, procedure kobject_uevent is called +(advertising that the device is ready for userspace usage) even when +device_enable_and_get() returned an error. + +As a result, various RDMA modules attempted to register for the device +even while the device driver was preparing to unregister the device. + +Fix this by advertising the device availability only after enabling the +device succeeds. + +Fixes: e7a5b4aafd82 ("RDMA/device: Don't fire uevent before device is fully initialized") +Link: https://lore.kernel.org/r/20201208073545.9723-3-leon@kernel.org +Suggested-by: Leon Romanovsky +Signed-off-by: Jack Morgenstein +Signed-off-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/device.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index 59dc9f3cfb376..256d379bba676 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -1387,9 +1387,6 @@ int ib_register_device(struct ib_device *device, const char *name) + } + + ret = enable_device_and_get(device); +- dev_set_uevent_suppress(&device->dev, false); +- /* Mark for userspace that device is ready */ +- kobject_uevent(&device->dev.kobj, KOBJ_ADD); + if (ret) { + void (*dealloc_fn)(struct ib_device *); + +@@ -1409,8 +1406,12 @@ int ib_register_device(struct ib_device *device, const char *name) + ib_device_put(device); + __ib_unregister_device(device); + device->ops.dealloc_driver = dealloc_fn; ++ dev_set_uevent_suppress(&device->dev, false); + return ret; + } ++ dev_set_uevent_suppress(&device->dev, false); ++ /* Mark for userspace that device is ready */ ++ kobject_uevent(&device->dev.kobj, KOBJ_ADD); + ib_device_put(device); + + return 0; +-- +2.27.0 + diff --git a/queue-5.4/rdma-cxgb4-validate-the-number-of-cqes.patch b/queue-5.4/rdma-cxgb4-validate-the-number-of-cqes.patch new file mode 100644 index 00000000000..d6f9fbf088c --- /dev/null +++ b/queue-5.4/rdma-cxgb4-validate-the-number-of-cqes.patch @@ -0,0 +1,38 @@ +From 016ce77babdebd9d3740ec4d817be171a77ce297 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 15:20:07 +0200 +Subject: RDMA/cxgb4: Validate the number of CQEs + +From: Kamal Heib + +[ Upstream commit 6d8285e604e0221b67bd5db736921b7ddce37d00 ] + +Before create CQ, make sure that the requested number of CQEs is in the +supported range. + +Fixes: cfdda9d76436 ("RDMA/cxgb4: Add driver for Chelsio T4 RNIC") +Link: https://lore.kernel.org/r/20201108132007.67537-1-kamalheib1@gmail.com +Signed-off-by: Kamal Heib +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/cxgb4/cq.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c +index b1bb61c65f4f6..16b74591a68db 100644 +--- a/drivers/infiniband/hw/cxgb4/cq.c ++++ b/drivers/infiniband/hw/cxgb4/cq.c +@@ -1007,6 +1007,9 @@ int c4iw_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, + if (attr->flags) + return -EINVAL; + ++ if (entries < 1 || entries > ibdev->attrs.max_cqe) ++ return -EINVAL; ++ + if (vector >= rhp->rdev.lldi.nciq) + return -EINVAL; + +-- +2.27.0 + diff --git a/queue-5.4/rdma-mthca-work-around-wenum-conversion-warning.patch b/queue-5.4/rdma-mthca-work-around-wenum-conversion-warning.patch new file mode 100644 index 00000000000..e55ad5459e2 --- /dev/null +++ b/queue-5.4/rdma-mthca-work-around-wenum-conversion-warning.patch @@ -0,0 +1,61 @@ +From 0f74d53b3fded37ac96bad18a9bcfd9f32e0b92c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 22:12:30 +0100 +Subject: RDMa/mthca: Work around -Wenum-conversion warning + +From: Arnd Bergmann + +[ Upstream commit fbb7dc5db6dee553b5a07c27e86364a5223e244c ] + +gcc points out a suspicious mixing of enum types in a function that +converts from MTHCA_OPCODE_* values to IB_WC_* values: + +drivers/infiniband/hw/mthca/mthca_cq.c: In function 'mthca_poll_one': +drivers/infiniband/hw/mthca/mthca_cq.c:607:21: warning: implicit conversion from 'enum ' to 'enum ib_wc_opcode' [-Wenum-conversion] + 607 | entry->opcode = MTHCA_OPCODE_INVALID; + +Nothing seems to ever check for MTHCA_OPCODE_INVALID again, no idea if +this is meaningful, but it seems harmless as it deals with an invalid +input. + +Remove MTHCA_OPCODE_INVALID and set the ib_wc_opcode to 0xFF, which is +still bogus, but at least doesn't make compiler warnings. + +Fixes: 2a4443a69934 ("[PATCH] IB/mthca: fill in opcode field for send completions") +Link: https://lore.kernel.org/r/20201026211311.3887003-1-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/mthca/mthca_cq.c | 2 +- + drivers/infiniband/hw/mthca/mthca_dev.h | 1 - + 2 files changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c +index 119b2573c9a08..26c3408dcacae 100644 +--- a/drivers/infiniband/hw/mthca/mthca_cq.c ++++ b/drivers/infiniband/hw/mthca/mthca_cq.c +@@ -604,7 +604,7 @@ static inline int mthca_poll_one(struct mthca_dev *dev, + entry->byte_len = MTHCA_ATOMIC_BYTE_LEN; + break; + default: +- entry->opcode = MTHCA_OPCODE_INVALID; ++ entry->opcode = 0xFF; + break; + } + } else { +diff --git a/drivers/infiniband/hw/mthca/mthca_dev.h b/drivers/infiniband/hw/mthca/mthca_dev.h +index bfd4eebc1182f..58d46449b0e86 100644 +--- a/drivers/infiniband/hw/mthca/mthca_dev.h ++++ b/drivers/infiniband/hw/mthca/mthca_dev.h +@@ -105,7 +105,6 @@ enum { + MTHCA_OPCODE_ATOMIC_CS = 0x11, + MTHCA_OPCODE_ATOMIC_FA = 0x12, + MTHCA_OPCODE_BIND_MW = 0x18, +- MTHCA_OPCODE_INVALID = 0xff + }; + + enum { +-- +2.27.0 + diff --git a/queue-5.4/rdma-rxe-compute-psn-windows-correctly.patch b/queue-5.4/rdma-rxe-compute-psn-windows-correctly.patch new file mode 100644 index 00000000000..efae944b723 --- /dev/null +++ b/queue-5.4/rdma-rxe-compute-psn-windows-correctly.patch @@ -0,0 +1,43 @@ +From 1bf7ba212ac2b4768e827edc594e833854f61a7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 12:07:42 -0500 +Subject: RDMA/rxe: Compute PSN windows correctly + +From: Bob Pearson + +[ Upstream commit bb3ab2979fd69db23328691cb10067861df89037 ] + +The code which limited the number of unacknowledged PSNs was incorrect. +The PSNs are limited to 24 bits and wrap back to zero from 0x00ffffff. +The test was computing a 32 bit value which wraps at 32 bits so that +qp->req.psn can appear smaller than the limit when it is actually larger. + +Replace '>' test with psn_compare which is used for other PSN comparisons +and correctly handles the 24 bit size. + +Fixes: 8700e3e7c485 ("Soft RoCE driver") +Link: https://lore.kernel.org/r/20201013170741.3590-1-rpearson@hpe.com +Signed-off-by: Bob Pearson +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/sw/rxe/rxe_req.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index e5031172c0193..a4d6e0b7901e9 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -664,7 +664,8 @@ next_wqe: + } + + if (unlikely(qp_type(qp) == IB_QPT_RC && +- qp->req.psn > (qp->comp.psn + RXE_MAX_UNACKED_PSNS))) { ++ psn_compare(qp->req.psn, (qp->comp.psn + ++ RXE_MAX_UNACKED_PSNS)) > 0)) { + qp->req.wait_psn = 1; + goto exit; + } +-- +2.27.0 + diff --git a/queue-5.4/remoteproc-q6v5-mss-fix-error-handling-in-q6v5_pds_e.patch b/queue-5.4/remoteproc-q6v5-mss-fix-error-handling-in-q6v5_pds_e.patch new file mode 100644 index 00000000000..ae530ffa1a9 --- /dev/null +++ b/queue-5.4/remoteproc-q6v5-mss-fix-error-handling-in-q6v5_pds_e.patch @@ -0,0 +1,50 @@ +From a60b55b17fea26247a425e0e973d9a418819d460 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 22:34:33 +0800 +Subject: remoteproc: q6v5-mss: fix error handling in q6v5_pds_enable + +From: Zhang Qilong + +[ Upstream commit a24723050037303e4008b37f1f8dcc99c58901aa ] + +If the pm_runtime_get_sync failed in q6v5_pds_enable when +loop (i), The unroll_pd_votes will start from (i - 1), and +it will resulted in following problems: + + 1) pm_runtime_get_sync will increment pm usage counter even it + failed. Forgetting to pm_runtime_put_noidle will result in + reference leak. + + 2) Have not reset pds[i] performance state. + +Then we fix it. + +Fixes: 4760a896be88e ("remoteproc: q6v5-mss: Vote for rpmh power domains") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201102143433.143996-1-zhangqilong3@huawei.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5_mss.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c +index a67c55785b4de..5e54e6f5edb1a 100644 +--- a/drivers/remoteproc/qcom_q6v5_mss.c ++++ b/drivers/remoteproc/qcom_q6v5_mss.c +@@ -331,8 +331,11 @@ static int q6v5_pds_enable(struct q6v5 *qproc, struct device **pds, + for (i = 0; i < pd_count; i++) { + dev_pm_genpd_set_performance_state(pds[i], INT_MAX); + ret = pm_runtime_get_sync(pds[i]); +- if (ret < 0) ++ if (ret < 0) { ++ pm_runtime_put_noidle(pds[i]); ++ dev_pm_genpd_set_performance_state(pds[i], 0); + goto unroll_pd_votes; ++ } + } + + return 0; +-- +2.27.0 + diff --git a/queue-5.4/remoteproc-qcom-fix-potential-null-dereference-in-ad.patch b/queue-5.4/remoteproc-qcom-fix-potential-null-dereference-in-ad.patch new file mode 100644 index 00000000000..e11c0679504 --- /dev/null +++ b/queue-5.4/remoteproc-qcom-fix-potential-null-dereference-in-ad.patch @@ -0,0 +1,63 @@ +From 122c450576bc85621935c12d631407c4f1a0953e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Dec 2020 09:54:20 +0800 +Subject: remoteproc: qcom: Fix potential NULL dereference in adsp_init_mmio() + +From: Zhang Changzhong + +[ Upstream commit c3d4e5b12672bbdf63f4cc933e3169bc6bbec8da ] + +platform_get_resource() may fail and in this case a NULL dereference +will occur. + +Fix it to use devm_platform_ioremap_resource() instead of calling +platform_get_resource() and devm_ioremap(). + +This is detected by Coccinelle semantic patch. + +@@ +expression pdev, res, n, t, e, e1, e2; +@@ + +res = \(platform_get_resource\|platform_get_resource_byname\)(pdev, t, +n); ++ if (!res) ++ return -EINVAL; +... when != res == NULL +e = devm_ioremap(e1, res->start, e2); + +Fixes: dc160e449122 ("remoteproc: qcom: Introduce Non-PAS ADSP PIL driver") +Signed-off-by: Zhang Changzhong +Link: https://lore.kernel.org/r/1607392460-20516-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5_adsp.c | 9 +++------ + 1 file changed, 3 insertions(+), 6 deletions(-) + +diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c +index cd88ceabf03e9..24e8b7e271773 100644 +--- a/drivers/remoteproc/qcom_q6v5_adsp.c ++++ b/drivers/remoteproc/qcom_q6v5_adsp.c +@@ -347,15 +347,12 @@ static int adsp_init_mmio(struct qcom_adsp *adsp, + struct platform_device *pdev) + { + struct device_node *syscon; +- struct resource *res; + int ret; + +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- adsp->qdsp6ss_base = devm_ioremap(&pdev->dev, res->start, +- resource_size(res)); +- if (!adsp->qdsp6ss_base) { ++ adsp->qdsp6ss_base = devm_platform_ioremap_resource(pdev, 0); ++ if (IS_ERR(adsp->qdsp6ss_base)) { + dev_err(adsp->dev, "failed to map QDSP6SS registers\n"); +- return -ENOMEM; ++ return PTR_ERR(adsp->qdsp6ss_base); + } + + syscon = of_parse_phandle(pdev->dev.of_node, "qcom,halt-regs", 0); +-- +2.27.0 + diff --git a/queue-5.4/remoteproc-qcom-fix-reference-leak-in-adsp_start.patch b/queue-5.4/remoteproc-qcom-fix-reference-leak-in-adsp_start.patch new file mode 100644 index 00000000000..506b50bf8b6 --- /dev/null +++ b/queue-5.4/remoteproc-qcom-fix-reference-leak-in-adsp_start.patch @@ -0,0 +1,41 @@ +From c2ed6952ef4c0ff8dfca431931c1e210e94059a0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 22:35:34 +0800 +Subject: remoteproc: qcom: fix reference leak in adsp_start + +From: Zhang Qilong + +[ Upstream commit aa37448f597c09844942da87d042fc6793f989c2 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in adsp_start, so we should fix it. + +Fixes: dc160e4491222 ("remoteproc: qcom: Introduce Non-PAS ADSP PIL driver") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201102143534.144484-1-zhangqilong3@huawei.com +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/remoteproc/qcom_q6v5_adsp.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/remoteproc/qcom_q6v5_adsp.c b/drivers/remoteproc/qcom_q6v5_adsp.c +index e953886b2eb77..cd88ceabf03e9 100644 +--- a/drivers/remoteproc/qcom_q6v5_adsp.c ++++ b/drivers/remoteproc/qcom_q6v5_adsp.c +@@ -184,8 +184,10 @@ static int adsp_start(struct rproc *rproc) + + dev_pm_genpd_set_performance_state(adsp->dev, INT_MAX); + ret = pm_runtime_get_sync(adsp->dev); +- if (ret) ++ if (ret) { ++ pm_runtime_put_noidle(adsp->dev); + goto disable_xo_clk; ++ } + + ret = clk_bulk_prepare_enable(adsp->num_clks, adsp->clks); + if (ret) { +-- +2.27.0 + diff --git a/queue-5.4/revert-i2c-i2c-qcom-geni-fix-dma-transfer-race.patch b/queue-5.4/revert-i2c-i2c-qcom-geni-fix-dma-transfer-race.patch new file mode 100644 index 00000000000..04169cecfbc --- /dev/null +++ b/queue-5.4/revert-i2c-i2c-qcom-geni-fix-dma-transfer-race.patch @@ -0,0 +1,75 @@ +From 4886a12c906c99554ef9f1b75a5611edf593ddea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 14:25:29 -0700 +Subject: Revert "i2c: i2c-qcom-geni: Fix DMA transfer race" + +From: Douglas Anderson + +[ Upstream commit 9cb4c67d7717135d6f4600a49ab07b470ea4ee2f ] + +This reverts commit 02b9aec59243c6240fc42884acc958602146ddf6. + +As talked about in the patch ("soc: qcom: geni: More properly switch +to DMA mode"), swapping the order of geni_se_setup_m_cmd() and +geni_se_xx_dma_prep() can sometimes cause corrupted transfers. Thus +we traded one problem for another. Now that we've debugged the +problem further and fixed the geni helper functions to more disable +FIFO interrupts when we move to DMA mode we can revert it and end up +with (hopefully) zero problems! + +To be explicit, the patch ("soc: qcom: geni: More properly switch +to DMA mode") is a prerequisite for this one. + +Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race") +Signed-off-by: Douglas Anderson +Reviewed-by: Stephen Boyd +Reviewed-by: Akash Asthana +Tested-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20201013142448.v2.2.I7b22281453b8a18ab16ef2bfd4c641fb1cc6a92c@changeid +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-qcom-geni.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c +index aafc76ee93e02..17abf60c94aeb 100644 +--- a/drivers/i2c/busses/i2c-qcom-geni.c ++++ b/drivers/i2c/busses/i2c-qcom-geni.c +@@ -368,6 +368,7 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, + geni_se_select_mode(se, GENI_SE_FIFO); + + writel_relaxed(len, se->base + SE_I2C_RX_TRANS_LEN); ++ geni_se_setup_m_cmd(se, I2C_READ, m_param); + + if (dma_buf && geni_se_rx_dma_prep(se, dma_buf, len, &rx_dma)) { + geni_se_select_mode(se, GENI_SE_FIFO); +@@ -375,8 +376,6 @@ static int geni_i2c_rx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, + dma_buf = NULL; + } + +- geni_se_setup_m_cmd(se, I2C_READ, m_param); +- + time_left = wait_for_completion_timeout(&gi2c->done, XFER_TIMEOUT); + if (!time_left) + geni_i2c_abort_xfer(gi2c); +@@ -410,6 +409,7 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, + geni_se_select_mode(se, GENI_SE_FIFO); + + writel_relaxed(len, se->base + SE_I2C_TX_TRANS_LEN); ++ geni_se_setup_m_cmd(se, I2C_WRITE, m_param); + + if (dma_buf && geni_se_tx_dma_prep(se, dma_buf, len, &tx_dma)) { + geni_se_select_mode(se, GENI_SE_FIFO); +@@ -417,8 +417,6 @@ static int geni_i2c_tx_one_msg(struct geni_i2c_dev *gi2c, struct i2c_msg *msg, + dma_buf = NULL; + } + +- geni_se_setup_m_cmd(se, I2C_WRITE, m_param); +- + if (!dma_buf) /* Get FIFO IRQ */ + writel_relaxed(1, se->base + SE_GENI_TX_WATERMARK_REG); + +-- +2.27.0 + diff --git a/queue-5.4/rsi-fix-error-return-code-in-rsi_reset_card.patch b/queue-5.4/rsi-fix-error-return-code-in-rsi_reset_card.patch new file mode 100644 index 00000000000..a6c1d0b0033 --- /dev/null +++ b/queue-5.4/rsi-fix-error-return-code-in-rsi_reset_card.patch @@ -0,0 +1,69 @@ +From 5cfc152828b8b8a0b42fe63fa9837efdbe67eea1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 11:07:34 +0800 +Subject: rsi: fix error return code in rsi_reset_card() + +From: Zhang Changzhong + +[ Upstream commit fb21d14694bd46a538258d86498736490b3ba855 ] + +Fix to return a negative error code from the error handling +case instead of 0, as done elsewhere in this function. + +Fixes: 17ff2c794f39 ("rsi: reset device changes for 9116") +Reported-by: Hulk Robot +Signed-off-by: Zhang Changzhong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/1605582454-39649-1-git-send-email-zhangchangzhong@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/rsi/rsi_91x_usb.c | 30 +++++++++++++------------- + 1 file changed, 15 insertions(+), 15 deletions(-) + +diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c +index 4b9e406b84612..a296f4e0d324a 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_usb.c ++++ b/drivers/net/wireless/rsi/rsi_91x_usb.c +@@ -733,24 +733,24 @@ static int rsi_reset_card(struct rsi_hw *adapter) + if (ret < 0) + goto fail; + } else { +- if ((rsi_usb_master_reg_write(adapter, +- NWP_WWD_INTERRUPT_TIMER, +- NWP_WWD_INT_TIMER_CLKS, +- RSI_9116_REG_SIZE)) < 0) { ++ ret = rsi_usb_master_reg_write(adapter, ++ NWP_WWD_INTERRUPT_TIMER, ++ NWP_WWD_INT_TIMER_CLKS, ++ RSI_9116_REG_SIZE); ++ if (ret < 0) + goto fail; +- } +- if ((rsi_usb_master_reg_write(adapter, +- NWP_WWD_SYSTEM_RESET_TIMER, +- NWP_WWD_SYS_RESET_TIMER_CLKS, +- RSI_9116_REG_SIZE)) < 0) { ++ ret = rsi_usb_master_reg_write(adapter, ++ NWP_WWD_SYSTEM_RESET_TIMER, ++ NWP_WWD_SYS_RESET_TIMER_CLKS, ++ RSI_9116_REG_SIZE); ++ if (ret < 0) + goto fail; +- } +- if ((rsi_usb_master_reg_write(adapter, +- NWP_WWD_MODE_AND_RSTART, +- NWP_WWD_TIMER_DISABLE, +- RSI_9116_REG_SIZE)) < 0) { ++ ret = rsi_usb_master_reg_write(adapter, ++ NWP_WWD_MODE_AND_RSTART, ++ NWP_WWD_TIMER_DISABLE, ++ RSI_9116_REG_SIZE); ++ if (ret < 0) + goto fail; +- } + } + + rsi_dbg(INFO_ZONE, "Reset card done\n"); +-- +2.27.0 + diff --git a/queue-5.4/rtc-pcf2127-fix-pcf2127_nvmem_read-write-returns.patch b/queue-5.4/rtc-pcf2127-fix-pcf2127_nvmem_read-write-returns.patch new file mode 100644 index 00000000000..8122585d497 --- /dev/null +++ b/queue-5.4/rtc-pcf2127-fix-pcf2127_nvmem_read-write-returns.patch @@ -0,0 +1,56 @@ +From a6345a571a2f7a802046f753e8abb0e7fd8f0cee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 10:04:51 +0300 +Subject: rtc: pcf2127: fix pcf2127_nvmem_read/write() returns + +From: Dan Carpenter + +[ Upstream commit ba1c30bf3f2536f248d262c6f257b5a787305991 ] + +These functions should return zero on success. Non-zero returns are +treated as error. On some paths, this doesn't matter but in +nvmem_cell_read() a non-zero return would be passed to ERR_PTR() and +lead to an Oops. + +Fixes: d6c3029f32f7 ("rtc: pcf2127: add support for accessing internal static RAM") +Signed-off-by: Dan Carpenter +Signed-off-by: Alexandre Belloni +Link: https://lore.kernel.org/r/20201022070451.GA2817669@mwanda +Signed-off-by: Sasha Levin +--- + drivers/rtc/rtc-pcf2127.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +diff --git a/drivers/rtc/rtc-pcf2127.c b/drivers/rtc/rtc-pcf2127.c +index 02b069caffd57..d1d37a204264c 100644 +--- a/drivers/rtc/rtc-pcf2127.c ++++ b/drivers/rtc/rtc-pcf2127.c +@@ -230,10 +230,8 @@ static int pcf2127_nvmem_read(void *priv, unsigned int offset, + if (ret) + return ret; + +- ret = regmap_bulk_read(pcf2127->regmap, PCF2127_REG_RAM_RD_CMD, +- val, bytes); +- +- return ret ?: bytes; ++ return regmap_bulk_read(pcf2127->regmap, PCF2127_REG_RAM_RD_CMD, ++ val, bytes); + } + + static int pcf2127_nvmem_write(void *priv, unsigned int offset, +@@ -248,10 +246,8 @@ static int pcf2127_nvmem_write(void *priv, unsigned int offset, + if (ret) + return ret; + +- ret = regmap_bulk_write(pcf2127->regmap, PCF2127_REG_RAM_WRT_CMD, +- val, bytes); +- +- return ret ?: bytes; ++ return regmap_bulk_write(pcf2127->regmap, PCF2127_REG_RAM_WRT_CMD, ++ val, bytes); + } + + /* watchdog driver */ +-- +2.27.0 + diff --git a/queue-5.4/s390-cio-fix-use-after-free-in-ccw_device_destroy_co.patch b/queue-5.4/s390-cio-fix-use-after-free-in-ccw_device_destroy_co.patch new file mode 100644 index 00000000000..e9e1e5830e1 --- /dev/null +++ b/queue-5.4/s390-cio-fix-use-after-free-in-ccw_device_destroy_co.patch @@ -0,0 +1,48 @@ +From c8f41247fc1adb55656d85608449c090c3da5efe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Dec 2020 14:31:50 +0800 +Subject: s390/cio: fix use-after-free in ccw_device_destroy_console + +From: Qinglang Miao + +[ Upstream commit 14d4c4fa46eeaa3922e8e1c4aa727eb0a1412804 ] + +Use of sch->dev reference after the put_device() call could trigger +the use-after-free bugs. + +Fix this by simply adjusting the position of put_device. + +Fixes: 37db8985b211 ("s390/cio: add basic protected virtualization support") +Reported-by: Hulk Robot +Suggested-by: Cornelia Huck +Signed-off-by: Qinglang Miao +Reviewed-by: Cornelia Huck +Reviewed-by: Vineeth Vijayan +[vneethv@linux.ibm.com: Slight modification in the commit-message] +Signed-off-by: Vineeth Vijayan +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + drivers/s390/cio/device.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c +index 983f9c9e08deb..23e9227e60fd7 100644 +--- a/drivers/s390/cio/device.c ++++ b/drivers/s390/cio/device.c +@@ -1664,10 +1664,10 @@ void __init ccw_device_destroy_console(struct ccw_device *cdev) + struct io_subchannel_private *io_priv = to_io_private(sch); + + set_io_private(sch, NULL); +- put_device(&sch->dev); +- put_device(&cdev->dev); + dma_free_coherent(&sch->dev, sizeof(*io_priv->dma_area), + io_priv->dma_area, io_priv->dma_area_dma); ++ put_device(&sch->dev); ++ put_device(&cdev->dev); + kfree(io_priv); + } + +-- +2.27.0 + diff --git a/queue-5.4/samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch b/queue-5.4/samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch new file mode 100644 index 00000000000..2af8d240cdb --- /dev/null +++ b/queue-5.4/samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch @@ -0,0 +1,50 @@ +From cf4ad5695fa08afa904fe872c8e1c3958e67e117 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 09:03:09 +0000 +Subject: samples: bpf: Fix lwt_len_hist reusing previous BPF map + +From: Daniel T. Lee + +[ Upstream commit 0afe0a998c40085a6342e1aeb4c510cccba46caf ] + +Currently, lwt_len_hist's map lwt_len_hist_map is uses pinning, and the +map isn't cleared on test end. This leds to reuse of that map for +each test, which prevents the results of the test from being accurate. + +This commit fixes the problem by removing of pinned map from bpffs. +Also, this commit add the executable permission to shell script +files. + +Fixes: f74599f7c5309 ("bpf: Add tests and samples for LWT-BPF") +Signed-off-by: Daniel T. Lee +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20201124090310.24374-7-danieltimlee@gmail.com +Signed-off-by: Sasha Levin +--- + samples/bpf/lwt_len_hist.sh | 2 ++ + samples/bpf/test_lwt_bpf.sh | 0 + 2 files changed, 2 insertions(+) + mode change 100644 => 100755 samples/bpf/lwt_len_hist.sh + mode change 100644 => 100755 samples/bpf/test_lwt_bpf.sh + +diff --git a/samples/bpf/lwt_len_hist.sh b/samples/bpf/lwt_len_hist.sh +old mode 100644 +new mode 100755 +index 090b96eaf7f76..0eda9754f50b8 +--- a/samples/bpf/lwt_len_hist.sh ++++ b/samples/bpf/lwt_len_hist.sh +@@ -8,6 +8,8 @@ VETH1=tst_lwt1b + TRACE_ROOT=/sys/kernel/debug/tracing + + function cleanup { ++ # To reset saved histogram, remove pinned map ++ rm /sys/fs/bpf/tc/globals/lwt_len_hist_map + ip route del 192.168.253.2/32 dev $VETH0 2> /dev/null + ip link del $VETH0 2> /dev/null + ip link del $VETH1 2> /dev/null +diff --git a/samples/bpf/test_lwt_bpf.sh b/samples/bpf/test_lwt_bpf.sh +old mode 100644 +new mode 100755 +-- +2.27.0 + diff --git a/queue-5.4/sched-deadline-fix-sched_dl_global_validate.patch b/queue-5.4/sched-deadline-fix-sched_dl_global_validate.patch new file mode 100644 index 00000000000..1bc20309748 --- /dev/null +++ b/queue-5.4/sched-deadline-fix-sched_dl_global_validate.patch @@ -0,0 +1,143 @@ +From 5508cb40d7149ef52432b44bc2cdee7c9fa3886f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 23:49:42 +0800 +Subject: sched/deadline: Fix sched_dl_global_validate() + +From: Peng Liu + +[ Upstream commit a57415f5d1e43c3a5c5d412cd85e2792d7ed9b11 ] + +When change sched_rt_{runtime, period}_us, we validate that the new +settings should at least accommodate the currently allocated -dl +bandwidth: + + sched_rt_handler() + --> sched_dl_bandwidth_validate() + { + new_bw = global_rt_runtime()/global_rt_period(); + + for_each_possible_cpu(cpu) { + dl_b = dl_bw_of(cpu); + if (new_bw < dl_b->total_bw) <------- + ret = -EBUSY; + } + } + +But under CONFIG_SMP, dl_bw is per root domain , but not per CPU, +dl_b->total_bw is the allocated bandwidth of the whole root domain. +Instead, we should compare dl_b->total_bw against "cpus*new_bw", +where 'cpus' is the number of CPUs of the root domain. + +Also, below annotation(in kernel/sched/sched.h) implied implementation +only appeared in SCHED_DEADLINE v2[1], then deadline scheduler kept +evolving till got merged(v9), but the annotation remains unchanged, +meaningless and misleading, update it. + +* With respect to SMP, the bandwidth is given on a per-CPU basis, +* meaning that: +* - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU; +* - dl_total_bw array contains, in the i-eth element, the currently +* allocated bandwidth on the i-eth CPU. + +[1]: https://lore.kernel.org/lkml/1267385230.13676.101.camel@Palantir/ + +Fixes: 332ac17ef5bf ("sched/deadline: Add bandwidth management for SCHED_DEADLINE tasks") +Signed-off-by: Peng Liu +Signed-off-by: Peter Zijlstra (Intel) +Reviewed-by: Daniel Bristot de Oliveira +Acked-by: Juri Lelli +Link: https://lkml.kernel.org/r/db6bbda316048cda7a1bbc9571defde193a8d67e.1602171061.git.iwtbavbm@gmail.com +Signed-off-by: Sasha Levin +--- + kernel/sched/deadline.c | 5 +++-- + kernel/sched/sched.h | 42 ++++++++++++++++++----------------------- + 2 files changed, 21 insertions(+), 26 deletions(-) + +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 4cb00538a207b..4ce8c11e5e4ae 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -2469,7 +2469,7 @@ int sched_dl_global_validate(void) + u64 period = global_rt_period(); + u64 new_bw = to_ratio(period, runtime); + struct dl_bw *dl_b; +- int cpu, ret = 0; ++ int cpu, cpus, ret = 0; + unsigned long flags; + + /* +@@ -2484,9 +2484,10 @@ int sched_dl_global_validate(void) + for_each_possible_cpu(cpu) { + rcu_read_lock_sched(); + dl_b = dl_bw_of(cpu); ++ cpus = dl_bw_cpus(cpu); + + raw_spin_lock_irqsave(&dl_b->lock, flags); +- if (new_bw < dl_b->total_bw) ++ if (new_bw * cpus < dl_b->total_bw) + ret = -EBUSY; + raw_spin_unlock_irqrestore(&dl_b->lock, flags); + +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 3e7590813844f..e10fb9bf2988c 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -247,30 +247,6 @@ struct rt_bandwidth { + + void __dl_clear_params(struct task_struct *p); + +-/* +- * To keep the bandwidth of -deadline tasks and groups under control +- * we need some place where: +- * - store the maximum -deadline bandwidth of the system (the group); +- * - cache the fraction of that bandwidth that is currently allocated. +- * +- * This is all done in the data structure below. It is similar to the +- * one used for RT-throttling (rt_bandwidth), with the main difference +- * that, since here we are only interested in admission control, we +- * do not decrease any runtime while the group "executes", neither we +- * need a timer to replenish it. +- * +- * With respect to SMP, the bandwidth is given on a per-CPU basis, +- * meaning that: +- * - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU; +- * - dl_total_bw array contains, in the i-eth element, the currently +- * allocated bandwidth on the i-eth CPU. +- * Moreover, groups consume bandwidth on each CPU, while tasks only +- * consume bandwidth on the CPU they're running on. +- * Finally, dl_total_bw_cpu is used to cache the index of dl_total_bw +- * that will be shown the next time the proc or cgroup controls will +- * be red. It on its turn can be changed by writing on its own +- * control. +- */ + struct dl_bandwidth { + raw_spinlock_t dl_runtime_lock; + u64 dl_runtime; +@@ -282,6 +258,24 @@ static inline int dl_bandwidth_enabled(void) + return sysctl_sched_rt_runtime >= 0; + } + ++/* ++ * To keep the bandwidth of -deadline tasks under control ++ * we need some place where: ++ * - store the maximum -deadline bandwidth of each cpu; ++ * - cache the fraction of bandwidth that is currently allocated in ++ * each root domain; ++ * ++ * This is all done in the data structure below. It is similar to the ++ * one used for RT-throttling (rt_bandwidth), with the main difference ++ * that, since here we are only interested in admission control, we ++ * do not decrease any runtime while the group "executes", neither we ++ * need a timer to replenish it. ++ * ++ * With respect to SMP, bandwidth is given on a per root domain basis, ++ * meaning that: ++ * - bw (< 100%) is the deadline bandwidth of each CPU; ++ * - total_bw is the currently allocated bandwidth in each root domain; ++ */ + struct dl_bw { + raw_spinlock_t lock; + u64 bw; +-- +2.27.0 + diff --git a/queue-5.4/sched-reenable-interrupts-in-do_sched_yield.patch b/queue-5.4/sched-reenable-interrupts-in-do_sched_yield.patch new file mode 100644 index 00000000000..d6451565581 --- /dev/null +++ b/queue-5.4/sched-reenable-interrupts-in-do_sched_yield.patch @@ -0,0 +1,45 @@ +From 5dad570448d9242962e310d8b87b1d818e1be9b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Oct 2020 16:46:55 +0200 +Subject: sched: Reenable interrupts in do_sched_yield() + +From: Thomas Gleixner + +[ Upstream commit 345a957fcc95630bf5535d7668a59ed983eb49a7 ] + +do_sched_yield() invokes schedule() with interrupts disabled which is +not allowed. This goes back to the pre git era to commit a6efb709806c +("[PATCH] irqlock patch 2.5.27-H6") in the history tree. + +Reenable interrupts and remove the misleading comment which "explains" it. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Thomas Gleixner +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/87r1pt7y5c.fsf@nanos.tec.linutronix.de +Signed-off-by: Sasha Levin +--- + kernel/sched/core.c | 6 +----- + 1 file changed, 1 insertion(+), 5 deletions(-) + +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 4511532b08b84..7841e738e38f0 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5679,12 +5679,8 @@ static void do_sched_yield(void) + schedstat_inc(rq->yld_count); + current->sched_class->yield_task(rq); + +- /* +- * Since we are going to call schedule() anyway, there's +- * no need to preempt or enable interrupts: +- */ + preempt_disable(); +- rq_unlock(rq, &rf); ++ rq_unlock_irq(rq, &rf); + sched_preempt_enable_no_resched(); + + schedule(); +-- +2.27.0 + diff --git a/queue-5.4/scsi-core-fix-vpd-lun-id-designator-priorities.patch b/queue-5.4/scsi-core-fix-vpd-lun-id-designator-priorities.patch new file mode 100644 index 00000000000..0db24ddafc7 --- /dev/null +++ b/queue-5.4/scsi-core-fix-vpd-lun-id-designator-priorities.patch @@ -0,0 +1,261 @@ +From 9c155e7765d02d9417f2ebbd2f580c789652fa3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 18:08:45 +0100 +Subject: scsi: core: Fix VPD LUN ID designator priorities + +From: Martin Wilck + +[ Upstream commit 2e4209b3806cda9b89c30fd5e7bfecb7044ec78b ] + +The current implementation of scsi_vpd_lun_id() uses the designator length +as an implicit measure of priority. This works most of the time, but not +always. For example, some Hitachi storage arrays return this in VPD 0x83: + +VPD INQUIRY: Device Identification page + Designation descriptor number 1, descriptor length: 24 + designator_type: T10 vendor identification, code_set: ASCII + associated with the Addressed logical unit + vendor id: HITACHI + vendor specific: 5030C3502025 + Designation descriptor number 2, descriptor length: 6 + designator_type: vendor specific [0x0], code_set: Binary + associated with the Target port + vendor specific: 08 03 + Designation descriptor number 3, descriptor length: 20 + designator_type: NAA, code_set: Binary + associated with the Addressed logical unit + NAA 6, IEEE Company_id: 0x60e8 + Vendor Specific Identifier: 0x7c35000 + Vendor Specific Identifier Extension: 0x30c35000002025 + [0x60060e8007c350000030c35000002025] + +The current code would use the first descriptor because it's longer than +the NAA descriptor. But this is wrong, the kernel is supposed to prefer NAA +descriptors over T10 vendor ID. Designator length should only be used to +compare designators of the same type. + +This patch addresses the issue by separating designator priority and +length. + +Link: https://lore.kernel.org/r/20201029170846.14786-1-mwilck@suse.com +Fixes: 9983bed3907c ("scsi: Add scsi_vpd_lun_id()") +Reviewed-by: Hannes Reinecke +Signed-off-by: Martin Wilck +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/scsi_lib.c | 126 +++++++++++++++++++++++++++------------- + 1 file changed, 86 insertions(+), 40 deletions(-) + +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index e6944e1cba2ba..b5867e1566f42 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -2930,6 +2930,78 @@ void sdev_enable_disk_events(struct scsi_device *sdev) + } + EXPORT_SYMBOL(sdev_enable_disk_events); + ++static unsigned char designator_prio(const unsigned char *d) ++{ ++ if (d[1] & 0x30) ++ /* not associated with LUN */ ++ return 0; ++ ++ if (d[3] == 0) ++ /* invalid length */ ++ return 0; ++ ++ /* ++ * Order of preference for lun descriptor: ++ * - SCSI name string ++ * - NAA IEEE Registered Extended ++ * - EUI-64 based 16-byte ++ * - EUI-64 based 12-byte ++ * - NAA IEEE Registered ++ * - NAA IEEE Extended ++ * - EUI-64 based 8-byte ++ * - SCSI name string (truncated) ++ * - T10 Vendor ID ++ * as longer descriptors reduce the likelyhood ++ * of identification clashes. ++ */ ++ ++ switch (d[1] & 0xf) { ++ case 8: ++ /* SCSI name string, variable-length UTF-8 */ ++ return 9; ++ case 3: ++ switch (d[4] >> 4) { ++ case 6: ++ /* NAA registered extended */ ++ return 8; ++ case 5: ++ /* NAA registered */ ++ return 5; ++ case 4: ++ /* NAA extended */ ++ return 4; ++ case 3: ++ /* NAA locally assigned */ ++ return 1; ++ default: ++ break; ++ } ++ break; ++ case 2: ++ switch (d[3]) { ++ case 16: ++ /* EUI64-based, 16 byte */ ++ return 7; ++ case 12: ++ /* EUI64-based, 12 byte */ ++ return 6; ++ case 8: ++ /* EUI64-based, 8 byte */ ++ return 3; ++ default: ++ break; ++ } ++ break; ++ case 1: ++ /* T10 vendor ID */ ++ return 1; ++ default: ++ break; ++ } ++ ++ return 0; ++} ++ + /** + * scsi_vpd_lun_id - return a unique device identification + * @sdev: SCSI device +@@ -2946,7 +3018,7 @@ EXPORT_SYMBOL(sdev_enable_disk_events); + */ + int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + { +- u8 cur_id_type = 0xff; ++ u8 cur_id_prio = 0; + u8 cur_id_size = 0; + const unsigned char *d, *cur_id_str; + const struct scsi_vpd *vpd_pg83; +@@ -2959,20 +3031,6 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + return -ENXIO; + } + +- /* +- * Look for the correct descriptor. +- * Order of preference for lun descriptor: +- * - SCSI name string +- * - NAA IEEE Registered Extended +- * - EUI-64 based 16-byte +- * - EUI-64 based 12-byte +- * - NAA IEEE Registered +- * - NAA IEEE Extended +- * - T10 Vendor ID +- * as longer descriptors reduce the likelyhood +- * of identification clashes. +- */ +- + /* The id string must be at least 20 bytes + terminating NULL byte */ + if (id_len < 21) { + rcu_read_unlock(); +@@ -2982,8 +3040,9 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + memset(id, 0, id_len); + d = vpd_pg83->data + 4; + while (d < vpd_pg83->data + vpd_pg83->len) { +- /* Skip designators not referring to the LUN */ +- if ((d[1] & 0x30) != 0x00) ++ u8 prio = designator_prio(d); ++ ++ if (prio == 0 || cur_id_prio > prio) + goto next_desig; + + switch (d[1] & 0xf) { +@@ -2991,28 +3050,19 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + /* T10 Vendor ID */ + if (cur_id_size > d[3]) + break; +- /* Prefer anything */ +- if (cur_id_type > 0x01 && cur_id_type != 0xff) +- break; ++ cur_id_prio = prio; + cur_id_size = d[3]; + if (cur_id_size + 4 > id_len) + cur_id_size = id_len - 4; + cur_id_str = d + 4; +- cur_id_type = d[1] & 0xf; + id_size = snprintf(id, id_len, "t10.%*pE", + cur_id_size, cur_id_str); + break; + case 0x2: + /* EUI-64 */ +- if (cur_id_size > d[3]) +- break; +- /* Prefer NAA IEEE Registered Extended */ +- if (cur_id_type == 0x3 && +- cur_id_size == d[3]) +- break; ++ cur_id_prio = prio; + cur_id_size = d[3]; + cur_id_str = d + 4; +- cur_id_type = d[1] & 0xf; + switch (cur_id_size) { + case 8: + id_size = snprintf(id, id_len, +@@ -3030,17 +3080,14 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + cur_id_str); + break; + default: +- cur_id_size = 0; + break; + } + break; + case 0x3: + /* NAA */ +- if (cur_id_size > d[3]) +- break; ++ cur_id_prio = prio; + cur_id_size = d[3]; + cur_id_str = d + 4; +- cur_id_type = d[1] & 0xf; + switch (cur_id_size) { + case 8: + id_size = snprintf(id, id_len, +@@ -3053,26 +3100,25 @@ int scsi_vpd_lun_id(struct scsi_device *sdev, char *id, size_t id_len) + cur_id_str); + break; + default: +- cur_id_size = 0; + break; + } + break; + case 0x8: + /* SCSI name string */ +- if (cur_id_size + 4 > d[3]) ++ if (cur_id_size > d[3]) + break; + /* Prefer others for truncated descriptor */ +- if (cur_id_size && d[3] > id_len) +- break; ++ if (d[3] > id_len) { ++ prio = 2; ++ if (cur_id_prio > prio) ++ break; ++ } ++ cur_id_prio = prio; + cur_id_size = id_size = d[3]; + cur_id_str = d + 4; +- cur_id_type = d[1] & 0xf; + if (cur_id_size >= id_len) + cur_id_size = id_len - 1; + memcpy(id, cur_id_str, cur_id_size); +- /* Decrease priority for truncated descriptor */ +- if (cur_id_size != id_size) +- cur_id_size = 6; + break; + default: + break; +-- +2.27.0 + diff --git a/queue-5.4/scsi-fnic-fix-error-return-code-in-fnic_probe.patch b/queue-5.4/scsi-fnic-fix-error-return-code-in-fnic_probe.patch new file mode 100644 index 00000000000..2805b12ebbd --- /dev/null +++ b/queue-5.4/scsi-fnic-fix-error-return-code-in-fnic_probe.patch @@ -0,0 +1,38 @@ +From 91e06ac81d72123422b814743604e761d066b8f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 15:47:39 +0800 +Subject: scsi: fnic: Fix error return code in fnic_probe() + +From: Zhang Changzhong + +[ Upstream commit d4fc94fe65578738ded138e9fce043db6bfc3241 ] + +Return a negative error code from the error handling case instead of 0 as +done elsewhere in this function. + +Link: https://lore.kernel.org/r/1607068060-31203-1-git-send-email-zhangchangzhong@huawei.com +Fixes: 5df6d737dd4b ("[SCSI] fnic: Add new Cisco PCI-Express FCoE HBA") +Reported-by: Hulk Robot +Reviewed-by: Karan Tilak Kumar +Signed-off-by: Zhang Changzhong +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/fnic/fnic_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c +index 18584ab27c329..3a2618bcce67b 100644 +--- a/drivers/scsi/fnic/fnic_main.c ++++ b/drivers/scsi/fnic/fnic_main.c +@@ -741,6 +741,7 @@ static int fnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + for (i = 0; i < FNIC_IO_LOCKS; i++) + spin_lock_init(&fnic->io_req_lock[i]); + ++ err = -ENOMEM; + fnic->io_req_pool = mempool_create_slab_pool(2, fnic_io_req_cache); + if (!fnic->io_req_pool) + goto err_out_free_resources; +-- +2.27.0 + diff --git a/queue-5.4/scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch b/queue-5.4/scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch new file mode 100644 index 00000000000..9355a6de766 --- /dev/null +++ b/queue-5.4/scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch @@ -0,0 +1,41 @@ +From cde330f239b4b96b7d3b0ed607909207efb73aa8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Dec 2020 19:55:51 +0800 +Subject: scsi: pm80xx: Fix error return in pm8001_pci_probe() + +From: Zhang Qilong + +[ Upstream commit 97031ccffa4f62728602bfea8439dd045cd3aeb2 ] + +The driver did not return an error in the case where +pm8001_configure_phy_settings() failed. + +Use rc to store the return value of pm8001_configure_phy_settings(). + +Link: https://lore.kernel.org/r/20201205115551.2079471-1-zhangqilong3@huawei.com +Fixes: 279094079a44 ("[SCSI] pm80xx: Phy settings support for motherboard controller.") +Acked-by: Jack Wang +Signed-off-by: Zhang Qilong +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/pm8001/pm8001_init.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c +index 3374f553c617a..8882ba33ca87c 100644 +--- a/drivers/scsi/pm8001/pm8001_init.c ++++ b/drivers/scsi/pm8001/pm8001_init.c +@@ -1040,7 +1040,8 @@ static int pm8001_pci_probe(struct pci_dev *pdev, + + pm8001_init_sas_add(pm8001_ha); + /* phy setting support for motherboard controller */ +- if (pm8001_configure_phy_settings(pm8001_ha)) ++ rc = pm8001_configure_phy_settings(pm8001_ha); ++ if (rc) + goto err_out_shost; + + pm8001_post_sas_ha_init(shost, chip); +-- +2.27.0 + diff --git a/queue-5.4/scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch b/queue-5.4/scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch new file mode 100644 index 00000000000..cd0c98cbf39 --- /dev/null +++ b/queue-5.4/scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch @@ -0,0 +1,47 @@ +From 518ee18ff8b37ed5ced024afbfb30063fcf28fa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 17:15:18 +0800 +Subject: scsi: qedi: Fix missing destroy_workqueue() on error in __qedi_probe + +From: Qinglang Miao + +[ Upstream commit 62eebd5247c4e4ce08826ad5995cf4dd7ce919dd ] + +Add the missing destroy_workqueue() before return from __qedi_probe in the +error handling case when fails to create workqueue qedi->offload_thread. + +Link: https://lore.kernel.org/r/20201109091518.55941-1-miaoqinglang@huawei.com +Fixes: ace7f46ba5fd ("scsi: qedi: Add QLogic FastLinQ offload iSCSI driver framework.") +Reviewed-by: Mike Christie +Signed-off-by: Qinglang Miao +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qedi/qedi_main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index acb930b8c6a64..35c96ea2653be 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -2630,7 +2630,7 @@ static int __qedi_probe(struct pci_dev *pdev, int mode) + QEDI_ERR(&qedi->dbg_ctx, + "Unable to start offload thread!\n"); + rc = -ENODEV; +- goto free_cid_que; ++ goto free_tmf_thread; + } + + /* F/w needs 1st task context memory entry for performance */ +@@ -2650,6 +2650,8 @@ static int __qedi_probe(struct pci_dev *pdev, int mode) + + return 0; + ++free_tmf_thread: ++ destroy_workqueue(qedi->tmf_thread); + free_cid_que: + qedi_release_cid_que(qedi); + free_uio: +-- +2.27.0 + diff --git a/queue-5.4/security-fix-namespaced-fscaps-when-config_security.patch b/queue-5.4/security-fix-namespaced-fscaps-when-config_security.patch new file mode 100644 index 00000000000..8231303223c --- /dev/null +++ b/queue-5.4/security-fix-namespaced-fscaps-when-config_security.patch @@ -0,0 +1,71 @@ +From 797dfdbd9c96606c90231da4f1e7a96a746f47be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 15 Nov 2020 21:55:31 -0600 +Subject: [SECURITY] fix namespaced fscaps when !CONFIG_SECURITY +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Serge Hallyn + +[ Upstream commit ed9b25d1970a4787ac6a39c2091e63b127ecbfc1 ] + +Namespaced file capabilities were introduced in 8db6c34f1dbc . +When userspace reads an xattr for a namespaced capability, a +virtualized representation of it is returned if the caller is +in a user namespace owned by the capability's owning rootid. +The function which performs this virtualization was not hooked +up if CONFIG_SECURITY=n. Therefore in that case the original +xattr was shown instead of the virtualized one. + +To test this using libcap-bin (*1), + +$ v=$(mktemp) +$ unshare -Ur setcap cap_sys_admin-eip $v +$ unshare -Ur setcap -v cap_sys_admin-eip $v +/tmp/tmp.lSiIFRvt8Y: OK + +"setcap -v" verifies the values instead of setting them, and +will check whether the rootid value is set. Therefore, with +this bug un-fixed, and with CONFIG_SECURITY=n, setcap -v will +fail: + +$ v=$(mktemp) +$ unshare -Ur setcap cap_sys_admin=eip $v +$ unshare -Ur setcap -v cap_sys_admin=eip $v +nsowner[got=1000, want=0],/tmp/tmp.HHDiOOl9fY differs in [] + +Fix this bug by calling cap_inode_getsecurity() in +security_inode_getsecurity() instead of returning +-EOPNOTSUPP, when CONFIG_SECURITY=n. + +*1 - note, if libcap is too old for getcap to have the '-n' +option, then use verify-caps instead. + +Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=209689 +Cc: Hervé Guillemet +Acked-by: Casey Schaufler +Signed-off-by: Serge Hallyn +Signed-off-by: Andrew G. Morgan +Signed-off-by: James Morris +Signed-off-by: Sasha Levin +--- + include/linux/security.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/security.h b/include/linux/security.h +index fd022768e91df..df90399a8af98 100644 +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -852,7 +852,7 @@ static inline int security_inode_killpriv(struct dentry *dentry) + + static inline int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc) + { +- return -EOPNOTSUPP; ++ return cap_inode_getsecurity(inode, name, buffer, alloc); + } + + static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags) +-- +2.27.0 + diff --git a/queue-5.4/selftest-bpf-add-missed-ip6ip6-test-back.patch b/queue-5.4/selftest-bpf-add-missed-ip6ip6-test-back.patch new file mode 100644 index 00000000000..d2e2b2289a6 --- /dev/null +++ b/queue-5.4/selftest-bpf-add-missed-ip6ip6-test-back.patch @@ -0,0 +1,242 @@ +From fcc9137abcdca4f8c3b47a1c373aa73af54fe6f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 10 Nov 2020 09:50:12 +0800 +Subject: selftest/bpf: Add missed ip6ip6 test back + +From: Hangbin Liu + +[ Upstream commit 58cfa49c2ba7f815adccc27a775e7cf8a8f7f539 ] + +In comment 173ca26e9b51 ("samples/bpf: add comprehensive ipip, ipip6, +ip6ip6 test") we added ip6ip6 test for bpf tunnel testing. But in commit +933a741e3b82 ("selftests/bpf: bpf tunnel test.") when we moved it to +the current folder, we didn't add it. + +This patch add the ip6ip6 test back to bpf tunnel test. Update the ipip6's +topology for both IPv4 and IPv6 testing. Since iperf test is removed as +currect framework simplified it in purpose, I also removed unused tcp +checkings in test_tunnel_kern.c. + +Fixes: 933a741e3b82 ("selftests/bpf: bpf tunnel test.") +Signed-off-by: Hangbin Liu +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/20201110015013.1570716-2-liuhangbin@gmail.com +Signed-off-by: Sasha Levin +--- + .../selftests/bpf/progs/test_tunnel_kern.c | 42 +++--------------- + tools/testing/selftests/bpf/test_tunnel.sh | 43 +++++++++++++++++-- + 2 files changed, 46 insertions(+), 39 deletions(-) + +diff --git a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +index 504df69c83df4..0f98724120deb 100644 +--- a/tools/testing/selftests/bpf/progs/test_tunnel_kern.c ++++ b/tools/testing/selftests/bpf/progs/test_tunnel_kern.c +@@ -15,7 +15,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -528,12 +527,11 @@ int _ipip_set_tunnel(struct __sk_buff *skb) + struct bpf_tunnel_key key = {}; + void *data = (void *)(long)skb->data; + struct iphdr *iph = data; +- struct tcphdr *tcp = data + sizeof(*iph); + void *data_end = (void *)(long)skb->data_end; + int ret; + + /* single length check */ +- if (data + sizeof(*iph) + sizeof(*tcp) > data_end) { ++ if (data + sizeof(*iph) > data_end) { + ERROR(1); + return TC_ACT_SHOT; + } +@@ -541,16 +539,6 @@ int _ipip_set_tunnel(struct __sk_buff *skb) + key.tunnel_ttl = 64; + if (iph->protocol == IPPROTO_ICMP) { + key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */ +- } else { +- if (iph->protocol != IPPROTO_TCP || iph->ihl != 5) +- return TC_ACT_SHOT; +- +- if (tcp->dest == bpf_htons(5200)) +- key.remote_ipv4 = 0xac100164; /* 172.16.1.100 */ +- else if (tcp->dest == bpf_htons(5201)) +- key.remote_ipv4 = 0xac100165; /* 172.16.1.101 */ +- else +- return TC_ACT_SHOT; + } + + ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), 0); +@@ -585,19 +573,20 @@ int _ipip6_set_tunnel(struct __sk_buff *skb) + struct bpf_tunnel_key key = {}; + void *data = (void *)(long)skb->data; + struct iphdr *iph = data; +- struct tcphdr *tcp = data + sizeof(*iph); + void *data_end = (void *)(long)skb->data_end; + int ret; + + /* single length check */ +- if (data + sizeof(*iph) + sizeof(*tcp) > data_end) { ++ if (data + sizeof(*iph) > data_end) { + ERROR(1); + return TC_ACT_SHOT; + } + + __builtin_memset(&key, 0x0, sizeof(key)); +- key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */ + key.tunnel_ttl = 64; ++ if (iph->protocol == IPPROTO_ICMP) { ++ key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */ ++ } + + ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), + BPF_F_TUNINFO_IPV6); +@@ -634,35 +623,18 @@ int _ip6ip6_set_tunnel(struct __sk_buff *skb) + struct bpf_tunnel_key key = {}; + void *data = (void *)(long)skb->data; + struct ipv6hdr *iph = data; +- struct tcphdr *tcp = data + sizeof(*iph); + void *data_end = (void *)(long)skb->data_end; + int ret; + + /* single length check */ +- if (data + sizeof(*iph) + sizeof(*tcp) > data_end) { ++ if (data + sizeof(*iph) > data_end) { + ERROR(1); + return TC_ACT_SHOT; + } + +- key.remote_ipv6[0] = bpf_htonl(0x2401db00); + key.tunnel_ttl = 64; +- + if (iph->nexthdr == 58 /* NEXTHDR_ICMP */) { +- key.remote_ipv6[3] = bpf_htonl(1); +- } else { +- if (iph->nexthdr != 6 /* NEXTHDR_TCP */) { +- ERROR(iph->nexthdr); +- return TC_ACT_SHOT; +- } +- +- if (tcp->dest == bpf_htons(5200)) { +- key.remote_ipv6[3] = bpf_htonl(1); +- } else if (tcp->dest == bpf_htons(5201)) { +- key.remote_ipv6[3] = bpf_htonl(2); +- } else { +- ERROR(tcp->dest); +- return TC_ACT_SHOT; +- } ++ key.remote_ipv6[3] = bpf_htonl(0x11); /* ::11 */ + } + + ret = bpf_skb_set_tunnel_key(skb, &key, sizeof(key), +diff --git a/tools/testing/selftests/bpf/test_tunnel.sh b/tools/testing/selftests/bpf/test_tunnel.sh +index bd12ec97a44df..1ccbe804e8e1c 100755 +--- a/tools/testing/selftests/bpf/test_tunnel.sh ++++ b/tools/testing/selftests/bpf/test_tunnel.sh +@@ -24,12 +24,12 @@ + # Root namespace with metadata-mode tunnel + BPF + # Device names and addresses: + # veth1 IP: 172.16.1.200, IPv6: 00::22 (underlay) +-# tunnel dev 11, ex: gre11, IPv4: 10.1.1.200 (overlay) ++# tunnel dev 11, ex: gre11, IPv4: 10.1.1.200, IPv6: 1::22 (overlay) + # + # Namespace at_ns0 with native tunnel + # Device names and addresses: + # veth0 IPv4: 172.16.1.100, IPv6: 00::11 (underlay) +-# tunnel dev 00, ex: gre00, IPv4: 10.1.1.100 (overlay) ++# tunnel dev 00, ex: gre00, IPv4: 10.1.1.100, IPv6: 1::11 (overlay) + # + # + # End-to-end ping packet flow +@@ -250,7 +250,7 @@ add_ipip_tunnel() + ip addr add dev $DEV 10.1.1.200/24 + } + +-add_ipip6tnl_tunnel() ++add_ip6tnl_tunnel() + { + ip netns exec at_ns0 ip addr add ::11/96 dev veth0 + ip netns exec at_ns0 ip link set dev veth0 up +@@ -262,11 +262,13 @@ add_ipip6tnl_tunnel() + ip link add dev $DEV_NS type $TYPE \ + local ::11 remote ::22 + ip netns exec at_ns0 ip addr add dev $DEV_NS 10.1.1.100/24 ++ ip netns exec at_ns0 ip addr add dev $DEV_NS 1::11/96 + ip netns exec at_ns0 ip link set dev $DEV_NS up + + # root namespace + ip link add dev $DEV type $TYPE external + ip addr add dev $DEV 10.1.1.200/24 ++ ip addr add dev $DEV 1::22/96 + ip link set dev $DEV up + } + +@@ -534,7 +536,7 @@ test_ipip6() + + check $TYPE + config_device +- add_ipip6tnl_tunnel ++ add_ip6tnl_tunnel + ip link set dev veth1 mtu 1500 + attach_bpf $DEV ipip6_set_tunnel ipip6_get_tunnel + # underlay +@@ -553,6 +555,34 @@ test_ipip6() + echo -e ${GREEN}"PASS: $TYPE"${NC} + } + ++test_ip6ip6() ++{ ++ TYPE=ip6tnl ++ DEV_NS=ip6ip6tnl00 ++ DEV=ip6ip6tnl11 ++ ret=0 ++ ++ check $TYPE ++ config_device ++ add_ip6tnl_tunnel ++ ip link set dev veth1 mtu 1500 ++ attach_bpf $DEV ip6ip6_set_tunnel ip6ip6_get_tunnel ++ # underlay ++ ping6 $PING_ARG ::11 ++ # ip6 over ip6 ++ ping6 $PING_ARG 1::11 ++ check_err $? ++ ip netns exec at_ns0 ping6 $PING_ARG 1::22 ++ check_err $? ++ cleanup ++ ++ if [ $ret -ne 0 ]; then ++ echo -e ${RED}"FAIL: ip6$TYPE"${NC} ++ return 1 ++ fi ++ echo -e ${GREEN}"PASS: ip6$TYPE"${NC} ++} ++ + setup_xfrm_tunnel() + { + auth=0x$(printf '1%.0s' {1..40}) +@@ -646,6 +676,7 @@ cleanup() + ip link del veth1 2> /dev/null + ip link del ipip11 2> /dev/null + ip link del ipip6tnl11 2> /dev/null ++ ip link del ip6ip6tnl11 2> /dev/null + ip link del gretap11 2> /dev/null + ip link del ip6gre11 2> /dev/null + ip link del ip6gretap11 2> /dev/null +@@ -742,6 +773,10 @@ bpf_tunnel_test() + test_ipip6 + errors=$(( $errors + $? )) + ++ echo "Testing IP6IP6 tunnel..." ++ test_ip6ip6 ++ errors=$(( $errors + $? )) ++ + echo "Testing IPSec tunnel..." + test_xfrm_tunnel + errors=$(( $errors + $? )) +-- +2.27.0 + diff --git a/queue-5.4/selftests-bpf-fix-broken-riscv-build.patch b/queue-5.4/selftests-bpf-fix-broken-riscv-build.patch new file mode 100644 index 00000000000..bbefba1977f --- /dev/null +++ b/queue-5.4/selftests-bpf-fix-broken-riscv-build.patch @@ -0,0 +1,48 @@ +From b26d39c13e1d531283edd78cc0e742f66f8a56e3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Nov 2020 08:16:38 +0100 +Subject: selftests/bpf: Fix broken riscv build +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Björn Töpel + +[ Upstream commit 6016df8fe874e1cf36f6357d71438b384198ce06 ] + +The selftests/bpf Makefile includes system include directories from +the host, when building BPF programs. On RISC-V glibc requires that +__riscv_xlen is defined. This is not the case for "clang -target bpf", +which messes up __WORDSIZE (errno.h -> ... -> wordsize.h) and breaks +the build. + +By explicitly defining __risc_xlen correctly for riscv, we can +workaround this. + +Fixes: 167381f3eac0 ("selftests/bpf: Makefile fix "missing" headers on build with -idirafter") +Signed-off-by: Björn Töpel +Signed-off-by: Andrii Nakryiko +Acked-by: Luke Nelson +Link: https://lore.kernel.org/bpf/20201118071640.83773-2-bjorn.topel@gmail.com +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/bpf/Makefile | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile +index 6889c19a628c2..544bd1028baee 100644 +--- a/tools/testing/selftests/bpf/Makefile ++++ b/tools/testing/selftests/bpf/Makefile +@@ -144,7 +144,8 @@ endif + # build would have failed anyways. + define get_sys_includes + $(shell $(1) -v -E - &1 \ +- | sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }') ++ | sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }') \ ++$(shell $(1) -dM -E - +Date: Wed, 2 Dec 2020 17:26:43 +0100 +Subject: selftests/seccomp: Update kernel config +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Mickaël Salaün + +[ Upstream commit 2c07343abd8932200a45ff7b10950e71081e9e77 ] + +seccomp_bpf.c uses unshare(CLONE_NEWPID), which requires CONFIG_PID_NS +to be set. + +Cc: Kees Cook +Cc: Shuah Khan +Fixes: 6a21cc50f0c7 ("seccomp: add a return code to trap to userspace") +Signed-off-by: Mickaël Salaün +Acked-by: Tycho Andersen +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20201202162643.249276-1-mic@digikod.net +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/seccomp/config | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/tools/testing/selftests/seccomp/config b/tools/testing/selftests/seccomp/config +index db1e11b08c8a4..764af1f853f95 100644 +--- a/tools/testing/selftests/seccomp/config ++++ b/tools/testing/selftests/seccomp/config +@@ -1,2 +1,3 @@ ++CONFIG_PID_NS=y + CONFIG_SECCOMP=y + CONFIG_SECCOMP_FILTER=y +-- +2.27.0 + diff --git a/queue-5.4/selinux-fix-error-initialization-in-inode_doinit_wit.patch b/queue-5.4/selinux-fix-error-initialization-in-inode_doinit_wit.patch new file mode 100644 index 00000000000..9b5ccba4e2e --- /dev/null +++ b/queue-5.4/selinux-fix-error-initialization-in-inode_doinit_wit.patch @@ -0,0 +1,62 @@ +From ce654968f0f29623d3baf4a1b3fd2d09907e9c64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 09:36:30 +0800 +Subject: selinux: fix error initialization in inode_doinit_with_dentry() + +From: Tianyue Ren + +[ Upstream commit 83370b31a915493231e5b9addc72e4bef69f8d31 ] + +Mark the inode security label as invalid if we cannot find +a dentry so that we will retry later rather than marking it +initialized with the unlabeled SID. + +Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock") +Signed-off-by: Tianyue Ren +[PM: minor comment tweaks] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/hooks.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 212f48025db81..76f7eb5690c8e 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -1499,7 +1499,13 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + * inode_doinit with a dentry, before these inodes could + * be used again by userspace. + */ +- goto out; ++ isec->initialized = LABEL_INVALID; ++ /* ++ * There is nothing useful to jump to the "out" ++ * label, except a needless spin lock/unlock ++ * cycle. ++ */ ++ return 0; + } + + rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid, +@@ -1553,8 +1559,15 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + * inode_doinit() with a dentry, before these inodes + * could be used again by userspace. + */ +- if (!dentry) +- goto out; ++ if (!dentry) { ++ isec->initialized = LABEL_INVALID; ++ /* ++ * There is nothing useful to jump to the "out" ++ * label, except a needless spin lock/unlock ++ * cycle. ++ */ ++ return 0; ++ } + rc = selinux_genfs_get_sid(dentry, sclass, + sbsec->flags, &sid); + if (rc) { +-- +2.27.0 + diff --git a/queue-5.4/selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch b/queue-5.4/selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch new file mode 100644 index 00000000000..ad378bc0760 --- /dev/null +++ b/queue-5.4/selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch @@ -0,0 +1,101 @@ +From bd9e69c7e7c21ab11fd700cd6714c5a8e86fd22e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 11:49:38 -0500 +Subject: selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling + +From: Paul Moore + +[ Upstream commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 ] + +A previous fix, commit 83370b31a915 ("selinux: fix error initialization +in inode_doinit_with_dentry()"), changed how failures were handled +before a SELinux policy was loaded. Unfortunately that patch was +potentially problematic for two reasons: it set the isec->initialized +state without holding a lock, and it didn't set the inode's SELinux +label to the "default" for the particular filesystem. The later can +be a problem if/when a later attempt to revalidate the inode fails +and SELinux reverts to the existing inode label. + +This patch should restore the default inode labeling that existed +before the original fix, without affecting the LABEL_INVALID marking +such that revalidation will still be attempted in the future. + +Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()") +Reported-by: Sven Schnelle +Tested-by: Sven Schnelle +Reviewed-by: Ondrej Mosnacek +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/selinux/hooks.c | 31 +++++++++++++------------------ + 1 file changed, 13 insertions(+), 18 deletions(-) + +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 76f7eb5690c8e..717a398ef4d05 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -1499,13 +1499,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + * inode_doinit with a dentry, before these inodes could + * be used again by userspace. + */ +- isec->initialized = LABEL_INVALID; +- /* +- * There is nothing useful to jump to the "out" +- * label, except a needless spin lock/unlock +- * cycle. +- */ +- return 0; ++ goto out_invalid; + } + + rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid, +@@ -1559,15 +1553,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + * inode_doinit() with a dentry, before these inodes + * could be used again by userspace. + */ +- if (!dentry) { +- isec->initialized = LABEL_INVALID; +- /* +- * There is nothing useful to jump to the "out" +- * label, except a needless spin lock/unlock +- * cycle. +- */ +- return 0; +- } ++ if (!dentry) ++ goto out_invalid; + rc = selinux_genfs_get_sid(dentry, sclass, + sbsec->flags, &sid); + if (rc) { +@@ -1592,11 +1579,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent + out: + spin_lock(&isec->lock); + if (isec->initialized == LABEL_PENDING) { +- if (!sid || rc) { ++ if (rc) { + isec->initialized = LABEL_INVALID; + goto out_unlock; + } +- + isec->initialized = LABEL_INITIALIZED; + isec->sid = sid; + } +@@ -1604,6 +1590,15 @@ out: + out_unlock: + spin_unlock(&isec->lock); + return rc; ++ ++out_invalid: ++ spin_lock(&isec->lock); ++ if (isec->initialized == LABEL_PENDING) { ++ isec->initialized = LABEL_INVALID; ++ isec->sid = sid; ++ } ++ spin_unlock(&isec->lock); ++ return 0; + } + + /* Convert a Linux signal to an access vector. */ +-- +2.27.0 + diff --git a/queue-5.4/seq_buf-avoid-type-mismatch-for-seq_buf_init.patch b/queue-5.4/seq_buf-avoid-type-mismatch-for-seq_buf_init.patch new file mode 100644 index 00000000000..f61dd3ab5eb --- /dev/null +++ b/queue-5.4/seq_buf-avoid-type-mismatch-for-seq_buf_init.patch @@ -0,0 +1,68 @@ +From 3f60486b06df06de4e153ae04d9b1125c4c19670 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Oct 2020 17:10:58 +0100 +Subject: seq_buf: Avoid type mismatch for seq_buf_init + +From: Arnd Bergmann + +[ Upstream commit d9a9280a0d0ae51dc1d4142138b99242b7ec8ac6 ] + +Building with W=2 prints a number of warnings for one function that +has a pointer type mismatch: + +linux/seq_buf.h: In function 'seq_buf_init': +linux/seq_buf.h:35:12: warning: pointer targets in assignment from 'unsigned char *' to 'char *' differ in signedness [-Wpointer-sign] + +Change the type in the function prototype according to the type in +the structure. + +Link: https://lkml.kernel.org/r/20201026161108.3707783-1-arnd@kernel.org + +Fixes: 9a7777935c34 ("tracing: Convert seq_buf fields to be like seq_file fields") +Reviewed-by: Cezary Rojewski +Signed-off-by: Arnd Bergmann +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + include/linux/seq_buf.h | 2 +- + include/linux/trace_seq.h | 4 ++-- + 2 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/include/linux/seq_buf.h b/include/linux/seq_buf.h +index aa5deb041c25d..7cc952282e8be 100644 +--- a/include/linux/seq_buf.h ++++ b/include/linux/seq_buf.h +@@ -30,7 +30,7 @@ static inline void seq_buf_clear(struct seq_buf *s) + } + + static inline void +-seq_buf_init(struct seq_buf *s, unsigned char *buf, unsigned int size) ++seq_buf_init(struct seq_buf *s, char *buf, unsigned int size) + { + s->buffer = buf; + s->size = size; +diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h +index 6609b39a72326..6db257466af68 100644 +--- a/include/linux/trace_seq.h ++++ b/include/linux/trace_seq.h +@@ -12,7 +12,7 @@ + */ + + struct trace_seq { +- unsigned char buffer[PAGE_SIZE]; ++ char buffer[PAGE_SIZE]; + struct seq_buf seq; + int full; + }; +@@ -51,7 +51,7 @@ static inline int trace_seq_used(struct trace_seq *s) + * that is about to be written to and then return the result + * of that write. + */ +-static inline unsigned char * ++static inline char * + trace_seq_buffer_ptr(struct trace_seq *s) + { + return s->buffer + seq_buf_used(&s->seq); +-- +2.27.0 + diff --git a/queue-5.4/series b/queue-5.4/series index 889cd7e0b50..4bb3aedc591 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -70,3 +70,251 @@ quota-sanity-check-quota-file-headers-on-load.patch media-msi2500-assign-spi-bus-number-dynamically.patch crypto-af_alg-avoid-undefined-behavior-accessing-salg_name.patch md-fix-a-warning-caused-by-a-race-between-concurrent-md_ioctl-s.patch +hid-i2c-hid-add-vero-k147-to-descriptor-override.patch-25904 +drm-gma500-fix-double-free-of-gma_connector.patch +drm-aspeed-fix-kconfig-warning-subsequent-build-erro.patch +drm-mcde-fix-handling-of-platform_get_irq-error.patch +drm-tve200-fix-handling-of-platform_get_irq-error.patch +arm64-dts-renesas-hihope-rzg2-ex-drop-rxc-skew-ps-fr.patch +arm64-dts-renesas-cat875-remove-rxc-skew-ps-from-eth.patch +soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch +soc-mediatek-check-if-power-domains-can-be-powered-o.patch +soc-qcom-geni-more-properly-switch-to-dma-mode.patch +revert-i2c-i2c-qcom-geni-fix-dma-transfer-race.patch +rdma-bnxt_re-set-queue-pair-state-when-being-queried.patch +rtc-pcf2127-fix-pcf2127_nvmem_read-write-returns.patch +selinux-fix-error-initialization-in-inode_doinit_wit.patch +arm-dts-aspeed-s2600wf-fix-vga-memory-region-locatio.patch +rdma-rxe-compute-psn-windows-correctly.patch +x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch +arm-p2v-fix-handling-of-lpae-translation-in-be-mode.patch +x86-apic-fix-x2apic-enablement-without-interrupt-rem.patch +sched-deadline-fix-sched_dl_global_validate.patch +sched-reenable-interrupts-in-do_sched_yield.patch +drm-amdgpu-fix-incorrect-enum-type.patch +crypto-talitos-endianess-in-current_desc_hdr.patch +crypto-talitos-fix-return-type-of-current_desc_hdr.patch +crypto-inside-secure-fix-sizeof-mismatch.patch +asoc-sun4i-i2s-fix-lrck_period-computation-for-i2s-j.patch +arm-dts-aspeed-tiogapass-remove-vuart.patch +drm-amdgpu-fix-build_coefficients-argument.patch +powerpc-64-set-up-a-kernel-stack-for-secondaries-bef.patch +spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch +f2fs-call-f2fs_get_meta_page_retry-for-nat-page.patch +drm-msm-dsi_pll_10nm-restore-vco-rate-during-restore.patch +spi-spi-mem-fix-reference-leak-in-spi_mem_access_sta.patch +asoc-pcm-drain-support-reactivation.patch +libbpf-fix-btf-data-layout-checks-and-allow-empty-bt.patch +selinux-fix-inode_doinit_with_dentry-label_invalid-e.patch +spi-stm32-fix-reference-leak-in-stm32_spi_resume.patch +brcmfmac-fix-memory-leak-for-unpaired-brcmf_-alloc-f.patch +arm64-dts-exynos-include-common-syscon-restart-power.patch +arm64-dts-exynos-correct-psci-compatible-used-on-exy.patch +bluetooth-fix-null-pointer-dereference-in-hci_event_.patch +bluetooth-hci_h5-fix-memory-leak-in-h5_close.patch +spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch +spi-mt7621-fix-missing-clk_disable_unprepare-on-erro.patch +spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch +spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch +spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch +spi-bcm63xx-hsspi-fix-missing-clk_disable_unprepare-.patch +mwifiex-fix-mwifiex_shutdown_sw-causing-sw-reset-fai.patch +selftest-bpf-add-missed-ip6ip6-test-back.patch +asoc-wm8998-fix-pm-disable-depth-imbalance-on-error.patch +spi-sprd-fix-reference-leak-in-sprd_spi_remove.patch +net-evaluate-net.ipvx.conf.all.ignore_routes_with_li.patch +net-evaluate-net.ipv4.conf.all.proxy_arp_pvlan.patch +asoc-arizona-fix-a-wrong-free-in-wm8997_probe.patch +rdma-mthca-work-around-wenum-conversion-warning.patch +mips-bcm47xx-fix-kconfig-dependency-bug-for-bcm47xx_.patch +crypto-qat-fix-status-check-in-qat_hal_put_rel_rd_xf.patch +staging-greybus-codecs-fix-reference-counter-leak-in.patch +staging-gasket-interrupt-fix-the-missed-eventfd_ctx_.patch +media-tm6000-fix-sizeof-mismatches.patch +media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch +media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-14782 +media-mtk-vcodec-add-missing-put_device-call-in-mtk_.patch-28026 +media-v4l2-fwnode-return-einval-for-invalid-bus-type.patch +asoc-meson-fix-compile_test-error.patch +scsi-core-fix-vpd-lun-id-designator-priorities.patch +media-solo6x10-fix-missing-snd_card_free-in-error-ha.patch +video-fbdev-atmel_lcdfb-fix-return-error-code-in-atm.patch +drm-omap-dmm_tiler-fix-return-error-code-in-omap_dmm.patch +input-ads7846-fix-race-that-causes-missing-releases.patch +input-ads7846-fix-integer-overflow-on-rt-calculation.patch +input-ads7846-fix-unaligned-access-on-7845.patch +usb-max3421-fix-return-error-code-in-max3421_probe.patch +spi-mxs-fix-reference-leak-in-mxs_spi_probe.patch +selftests-bpf-fix-broken-riscv-build.patch +powerpc-avoid-broken-gcc-__attribute__-optimize.patch +powerpc-feature-fix-cpu_ftrs_always-by-removing-cpu_.patch +edac-mce_amd-use-struct-cpuinfo_x86.cpu_die_id-for-a.patch +crypto-crypto4xx-replace-bitwise-or-with-logical-or-.patch +crypto-omap-aes-fix-pm-disable-depth-imbalance-in-om.patch +spi-fix-resource-leak-for-drivers-without-.remove-ca.patch +soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch +soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch +drivers-soc-ti-knav_qmss_queue-fix-error-return-code.patch +input-omap4-keypad-fix-runtime-pm-error-handling.patch +clk-meson-kconfig-fix-dependency-for-g12a.patch +rdma-cxgb4-validate-the-number-of-cqes.patch +memstick-fix-a-double-free-bug-in-memstick_check.patch +arm-dts-at91-sama5d4_xplained-add-pincontrol-for-usb.patch +arm-dts-at91-sama5d3_xplained-add-pincontrol-for-usb.patch +mmc-pxamci-fix-error-return-code-in-pxamci_probe.patch +orinoco-move-context-allocation-after-processing-the.patch +qtnfmac-fix-error-return-code-in-qtnf_pcie_probe.patch +rsi-fix-error-return-code-in-rsi_reset_card.patch +cw1200-fix-missing-destroy_workqueue-on-error-in-cw1.patch +dmaengine-mv_xor_v2-fix-error-return-code-in-mv_xor_.patch +leds-netxbig-add-missing-put_device-call-in-netxbig_.patch +arm64-tegra-fix-dt-binding-for-io-high-voltage-entry.patch +media-siano-fix-memory-leak-of-debugfs-members-in-sm.patch +platform-x86-mlx-platform-remove-psu-eeprom-from-def.patch +platform-x86-mlx-platform-remove-psu-eeprom-from-msn.patch +samples-bpf-fix-lwt_len_hist-reusing-previous-bpf-ma.patch +media-imx214-fix-stop-streaming.patch +mips-cdmm-fix-use-after-free-in-mips_cdmm_bus_discov.patch +media-max2175-fix-max2175_set_csm_mode-error-code.patch +slimbus-qcom-ngd-ctrl-avoid-sending-power-requests-w.patch +hsi-omap_ssi-don-t-jump-to-free-id-in-ssi_add_contro.patch +arm-dts-remove-non-existent-i2c1-from-98dx3236.patch +arm64-dts-armada-3720-turris-mox-update-ethernet-phy.patch +arm64-dts-rockchip-set-dr_mode-to-host-for-otg-on-rk.patch +power-supply-axp288_charger-fix-hp-pavilion-x2-10-dm.patch +power-supply-bq24190_charger-fix-reference-leak.patch +genirq-irqdomain-don-t-try-to-free-an-interrupt-that.patch +arm64-dts-ls1028a-fix-enetc-ptp-clock-input.patch +arm64-dts-qcom-c630-polish-i2c-hid-devices.patch +pci-bounds-check-command-line-resource-alignment-req.patch +pci-fix-overflow-in-command-line-resource-alignment-.patch +pci-iproc-fix-out-of-bound-array-accesses.patch +arm64-dts-meson-fix-spi-max-frequency-on-khadas-vim2.patch +arm64-dts-meson-sm1-fix-typo-in-opp-table.patch +soc-amlogic-canvas-add-missing-put_device-call-in-me.patch +arm-dts-at91-at91sam9rl-fix-adc-triggers.patch +platform-x86-dell-smbios-base-fix-error-return-code-.patch +ath10k-fix-the-parsing-error-in-service-available-ev.patch +ath10k-fix-an-error-handling-path.patch +ath10k-release-some-resources-in-an-error-handling-p.patch +sunrpc-rpc_wake_up-should-wake-up-tasks-in-the-corre.patch +nfsv4.2-condition-readdir-s-mask-for-security-label-.patch +sunrpc-xprt_load_transport-needs-to-support-the-neti.patch +nfsv4-fix-the-alignment-of-page-data-in-the-getdevic.patch +net-sunrpc-fix-snprintf-return-value-check-in-do_xpr.patch +lockd-don-t-use-interval-based-rebinding-over-tcp.patch +nfs-switch-nfsiod-to-be-an-unbound-workqueue.patch +selftests-seccomp-update-kernel-config.patch +vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch +hwmon-ina3221-fix-pm-usage-counter-unbalance-in-ina3.patch +media-saa7146-fix-array-overflow-in-vidioc_s_audio.patch +powerpc-perf-fix-crash-with-is_sier_available-when-p.patch +powerpc-64-fix-an-emit_bug_entry-in-head_64.s.patch +clocksource-drivers-orion-add-missing-clk_disable_un.patch +clocksource-drivers-cadence_ttc-fix-memory-leak-in-t.patch +iio-hrtimer-trigger-mark-hrtimer-to-expire-in-hard-i.patch +arm-dts-at91-sama5d2-map-securam-as-device.patch +bpf-fix-bpf_put_raw_tracepoint-s-use-of-__module_add.patch +pinctrl-falcon-add-missing-put_device-call-in-pinctr.patch +arm64-dts-rockchip-fix-uart-pull-ups-on-rk3328.patch +memstick-r592-fix-error-return-in-r592_probe.patch +mips-don-t-round-up-kernel-sections-size-for-membloc.patch +net-mlx5-properly-convey-driver-version-to-firmware.patch +asoc-jz4740-i2s-add-missed-checks-for-clk_get.patch +dm-ioctl-fix-error-return-code-in-target_message.patch +phy-renesas-rcar-gen3-usb2-disable-runtime-pm-in-cas.patch +clocksource-drivers-arm_arch_timer-use-stable-count-.patch +clocksource-drivers-arm_arch_timer-correct-fault-pro.patch +cpufreq-ap806-add-missing-module_device_table.patch +cpufreq-highbank-add-missing-module_device_table.patch +cpufreq-mediatek-add-missing-module_device_table.patch +cpufreq-qcom-add-missing-module_device_table.patch +cpufreq-st-add-missing-module_device_table.patch +cpufreq-sun50i-add-missing-module_device_table.patch +cpufreq-loongson1-add-missing-module_alias.patch +cpufreq-scpi-add-missing-module_alias.patch +bluetooth-btusb-add-the-missed-release_firmware-in-b.patch +bluetooth-btmtksdio-add-the-missed-release_firmware-.patch +arm64-dts-meson-fix-phy-deassert-timing-requirements.patch +arm-dts-meson-fix-phy-deassert-timing-requirements.patch +arm64-dts-meson-g12a-x96-max-fix-phy-deassert-timing.patch +scsi-qedi-fix-missing-destroy_workqueue-on-error-in-.patch +scsi-pm80xx-fix-error-return-in-pm8001_pci_probe.patch +seq_buf-avoid-type-mismatch-for-seq_buf_init.patch +scsi-fnic-fix-error-return-code-in-fnic_probe.patch +platform-x86-mlx-platform-fix-item-counter-assignmen.patch +powerpc-pseries-hibernation-drop-pseries_suspend_beg.patch +powerpc-pseries-hibernation-remove-redundant-cachein.patch +drm-mediatek-avoid-dereferencing-a-null-hdmi_phy-on-.patch +asoc-amd-change-clk_get-to-devm_clk_get-and-add-miss.patch +powerpc-mm-sanity_check_fault-should-work-for-all-no.patch +usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch +usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch +speakup-fix-uninitialized-flush_lock.patch +nfsd-fix-message-level-for-normal-termination.patch +nfs_common-need-lock-during-iterate-through-the-list.patch +x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch +platform-chrome-cros_ec_spi-don-t-overwrite-spi-mode.patch +bus-fsl-mc-fix-error-return-code-in-fsl_mc_object_al.patch +s390-cio-fix-use-after-free-in-ccw_device_destroy_co.patch +iwlwifi-mvm-hook-up-missing-rx-handlers.patch +erofs-avoid-using-generic_block_bmap.patch +can-m_can-m_can_config_endisable-remove-double-clear.patch +rdma-core-do-not-indicate-device-ready-when-device-e.patch +remoteproc-q6v5-mss-fix-error-handling-in-q6v5_pds_e.patch +remoteproc-qcom-fix-reference-leak-in-adsp_start.patch +remoteproc-qcom-fix-potential-null-dereference-in-ad.patch +clk-tegra-fix-duplicated-se-clock-entry.patch +mtd-rawnand-gpmi-fix-reference-count-leak-in-gpmi-op.patch +mtd-rawnand-meson-fix-a-resource-leak-in-init.patch +mtd-rawnand-gpmi-fix-the-random-dma-timeout-issue.patch +extcon-max77693-fix-modalias-string.patch +crypto-atmel-i2c-select-config_bitreverse.patch +mac80211-don-t-set-set-tdls-sta-bandwidth-wider-than.patch +asoc-wm_adsp-remove-ctl-from-list-on-error-in-wm_ads.patch +irqchip-alpine-msi-fix-freeing-of-interrupts-on-allo.patch +watchdog-armada_37xx-add-missing-dependency-on-has_i.patch +watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch +watchdog-sprd-remove-watchdog-disable-from-resume-fa.patch +watchdog-sprd-check-busy-bit-before-new-loading-rath.patch +watchdog-fix-potential-dereferencing-of-null-pointer.patch +ubifs-fix-error-return-code-in-ubifs_init_authentica.patch +um-monitor-error-events-in-irq-controller.patch +um-tty-fix-handling-of-close-in-tty-lines.patch +um-chan_xterm-fix-fd-leak.patch +sunrpc-fix-xs_read_xdr_buf-for-partial-pages-receive.patch +rdma-cma-don-t-overwrite-sgid_attr-after-device-is-r.patch +nfc-s3fwrn5-release-the-nfc-firmware.patch +powerpc-ps3-use-dma_mapping_error.patch +sparc-fix-handling-of-page-table-constructor-failure.patch +mm-don-t-wake-kswapd-prematurely-when-watermark-boos.patch +checkpatch-fix-unescaped-left-brace.patch +lan743x-fix-rx_napi_poll-interrupt-ping-pong.patch +net-bcmgenet-fix-a-resource-leak-in-an-error-handlin.patch +net-allwinner-fix-some-resources-leak-in-the-error-h.patch +net-korina-fix-return-value.patch +libnvdimm-label-return-enxio-for-no-slot-in-__blk_la.patch +watchdog-qcom-avoid-context-switch-in-restart-handle.patch +watchdog-coh901327-add-common_clk-dependency.patch +clk-ti-fix-memleak-in-ti_fapll_synth_setup.patch +pwm-zx-add-missing-cleanup-in-error-path.patch +pwm-lp3943-dynamically-allocate-pwm-chip-base.patch +perf-record-fix-memory-leak-when-using-user-regs-to-.patch +qlcnic-fix-error-code-in-probe.patch +virtio_ring-cut-and-paste-bugs-in-vring_create_virtq.patch +virtio_net-fix-error-code-in-probe.patch +virtio_ring-fix-two-use-after-free-bugs.patch +clk-at91-sam9x60-remove-atmel-osc-bypass-support.patch +clk-s2mps11-fix-a-resource-leak-in-error-handling-pa.patch +clk-sunxi-ng-make-sure-divider-tables-have-sentinel.patch +kconfig-fix-return-value-of-do_error_if.patch +perf-probe-fix-memory-leak-when-synthesizing-sdt-pro.patch +arm-sunxi-add-machine-match-for-the-allwinner-v3-soc.patch +cfg80211-initialize-rekey_data.patch +security-fix-namespaced-fscaps-when-config_security.patch +lwt-disable-bh-too-in-run_lwt_bpf.patch +drm-amd-display-prevent-bandwidth-overflow.patch +drm-amdkfd-fix-leak-in-dmabuf-import.patch +input-cros_ec_keyb-send-scancodes-in-addition-to-key.patch +initramfs-fix-clang-build-failure.patch +input-goodix-add-upside-down-quirk-for-teclast-x98-p.patch diff --git a/queue-5.4/slimbus-qcom-ngd-ctrl-avoid-sending-power-requests-w.patch b/queue-5.4/slimbus-qcom-ngd-ctrl-avoid-sending-power-requests-w.patch new file mode 100644 index 00000000000..bc5fa4e4a25 --- /dev/null +++ b/queue-5.4/slimbus-qcom-ngd-ctrl-avoid-sending-power-requests-w.patch @@ -0,0 +1,51 @@ +From b8508882c2dda1eebc85c9276e813c024e974cb6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Nov 2020 10:24:50 +0000 +Subject: slimbus: qcom-ngd-ctrl: Avoid sending power requests without QMI + +From: Bjorn Andersson + +[ Upstream commit 39014ce6d6028614a46395923a2c92d058b6fa87 ] + +Attempting to send a power request during PM operations, when the QMI +handle isn't initialized results in a NULL pointer dereference. So check +if the QMI handle has been initialized before attempting to post the +power requests. + +Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver") +Signed-off-by: Bjorn Andersson +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20201127102451.17114-7-srinivas.kandagatla@linaro.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/slimbus/qcom-ngd-ctrl.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/drivers/slimbus/qcom-ngd-ctrl.c b/drivers/slimbus/qcom-ngd-ctrl.c +index ce265bf7de868..b60541c3f72da 100644 +--- a/drivers/slimbus/qcom-ngd-ctrl.c ++++ b/drivers/slimbus/qcom-ngd-ctrl.c +@@ -1201,6 +1201,9 @@ static int qcom_slim_ngd_runtime_resume(struct device *dev) + struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev); + int ret = 0; + ++ if (!ctrl->qmi.handle) ++ return 0; ++ + if (ctrl->state >= QCOM_SLIM_NGD_CTRL_ASLEEP) + ret = qcom_slim_ngd_power_up(ctrl); + if (ret) { +@@ -1497,6 +1500,9 @@ static int __maybe_unused qcom_slim_ngd_runtime_suspend(struct device *dev) + struct qcom_slim_ngd_ctrl *ctrl = dev_get_drvdata(dev); + int ret = 0; + ++ if (!ctrl->qmi.handle) ++ return 0; ++ + ret = qcom_slim_qmi_power_request(ctrl, false); + if (ret && ret != -EBUSY) + dev_info(ctrl->dev, "slim resource not idle:%d\n", ret); +-- +2.27.0 + diff --git a/queue-5.4/soc-amlogic-canvas-add-missing-put_device-call-in-me.patch b/queue-5.4/soc-amlogic-canvas-add-missing-put_device-call-in-me.patch new file mode 100644 index 00000000000..88ba3450d19 --- /dev/null +++ b/queue-5.4/soc-amlogic-canvas-add-missing-put_device-call-in-me.patch @@ -0,0 +1,43 @@ +From 28ee8c5c1048ef86248f9547102ef08013c7e88f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 09:13:22 +0800 +Subject: soc: amlogic: canvas: add missing put_device() call in + meson_canvas_get() + +From: Yu Kuai + +[ Upstream commit 28f851e6afa858f182802e23ac60c3ed7d1c04a1 ] + +if of_find_device_by_node() succeed, meson_canvas_get() doesn't have +a corresponding put_device(). Thus add put_device() to fix the exception +handling for this function implementation. + +Fixes: 382f8be04551 ("soc: amlogic: canvas: Fix meson_canvas_get when probe failed") +Signed-off-by: Yu Kuai +Reviewed-by: Neil Armstrong +Signed-off-by: Kevin Hilman +Link: https://lore.kernel.org/r/20201117011322.522477-1-yukuai3@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/soc/amlogic/meson-canvas.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/soc/amlogic/meson-canvas.c b/drivers/soc/amlogic/meson-canvas.c +index c655f5f92b124..d0329ad170d13 100644 +--- a/drivers/soc/amlogic/meson-canvas.c ++++ b/drivers/soc/amlogic/meson-canvas.c +@@ -72,8 +72,10 @@ struct meson_canvas *meson_canvas_get(struct device *dev) + * current state, this driver probe cannot return -EPROBE_DEFER + */ + canvas = dev_get_drvdata(&canvas_pdev->dev); +- if (!canvas) ++ if (!canvas) { ++ put_device(&canvas_pdev->dev); + return ERR_PTR(-EINVAL); ++ } + + return canvas; + } +-- +2.27.0 + diff --git a/queue-5.4/soc-mediatek-check-if-power-domains-can-be-powered-o.patch b/queue-5.4/soc-mediatek-check-if-power-domains-can-be-powered-o.patch new file mode 100644 index 00000000000..51dfbdce78c --- /dev/null +++ b/queue-5.4/soc-mediatek-check-if-power-domains-can-be-powered-o.patch @@ -0,0 +1,55 @@ +From 80542e2b45f9165b508991a8c3e1ac22aceb0318 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 11:31:35 +0800 +Subject: soc: mediatek: Check if power domains can be powered on at boot time + +From: Nicolas Boichat + +[ Upstream commit 4007844b05815717f522c7ea9914e24ad0ff6c79 ] + +In the error case, where a power domain cannot be powered on +successfully at boot time (in mtk_register_power_domains), +pm_genpd_init would still be called with is_off=false, and the +system would later try to disable the power domain again, triggering +warnings as disabled clocks are disabled again (and other potential +issues). + +Also print a warning splat in that case, as this should never +happen. + +Fixes: c84e358718a66f7 ("soc: Mediatek: Add SCPSYS power domain driver") +Signed-off-by: Nicolas Boichat +Link: https://lore.kernel.org/r/20200928113107.v2.1.I5e6f8c262031d0451fe7241b744f4f3111c1ce71@changeid +Signed-off-by: Matthias Brugger +Signed-off-by: Sasha Levin +--- + drivers/soc/mediatek/mtk-scpsys.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c +index 503222d0d0da1..75f25f08245fd 100644 +--- a/drivers/soc/mediatek/mtk-scpsys.c ++++ b/drivers/soc/mediatek/mtk-scpsys.c +@@ -446,6 +446,7 @@ static void mtk_register_power_domains(struct platform_device *pdev, + for (i = 0; i < num; i++) { + struct scp_domain *scpd = &scp->domains[i]; + struct generic_pm_domain *genpd = &scpd->genpd; ++ bool on; + + /* + * Initially turn on all domains to make the domains usable +@@ -453,9 +454,9 @@ static void mtk_register_power_domains(struct platform_device *pdev, + * software. The unused domains will be switched off during + * late_init time. + */ +- genpd->power_on(genpd); ++ on = !WARN_ON(genpd->power_on(genpd) < 0); + +- pm_genpd_init(genpd, NULL, false); ++ pm_genpd_init(genpd, NULL, !on); + } + + /* +-- +2.27.0 + diff --git a/queue-5.4/soc-qcom-geni-more-properly-switch-to-dma-mode.patch b/queue-5.4/soc-qcom-geni-more-properly-switch-to-dma-mode.patch new file mode 100644 index 00000000000..886b3e38866 --- /dev/null +++ b/queue-5.4/soc-qcom-geni-more-properly-switch-to-dma-mode.patch @@ -0,0 +1,107 @@ +From 45f927d2facb37e7590c725ad4a46c9df996d84d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Oct 2020 14:25:28 -0700 +Subject: soc: qcom: geni: More properly switch to DMA mode + +From: Douglas Anderson + +[ Upstream commit 4b6ea87be44ef34732846fc71e44c41125f0c4fa ] + +On geni-i2c transfers using DMA, it was seen that if you program the +command (I2C_READ) before calling geni_se_rx_dma_prep() that it could +cause interrupts to fire. If we get unlucky, these interrupts can +just keep firing (and not be handled) blocking further progress and +hanging the system. + +In commit 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race") +we avoided that by making sure we didn't program the command until +after geni_se_rx_dma_prep() was called. While that avoided the +problems, it also turns out to be invalid. At least in the TX case we +started seeing sporadic corrupted transfers. This is easily seen by +adding an msleep() between the DMA prep and the writing of the +command, which makes the problem worse. That means we need to revert +that commit and find another way to fix the bogus IRQs. + +Specifically, after reverting commit 02b9aec59243 ("i2c: +i2c-qcom-geni: Fix DMA transfer race"), I put some traces in. I found +that the when the interrupts were firing like crazy: +- "m_stat" had bits for M_RX_IRQ_EN, M_RX_FIFO_WATERMARK_EN set. +- "dma" was set. + +Further debugging showed that I could make the problem happen more +reliably by adding an "msleep(1)" any time after geni_se_setup_m_cmd() +ran up until geni_se_rx_dma_prep() programmed the length. + +A rather simple fix is to change geni_se_select_dma_mode() so it's a +true inverse of geni_se_select_fifo_mode() and disables all the FIFO +related interrupts. Now the problematic interrupts can't fire and we +can program things in the correct order without worrying. + +As part of this, let's also change the writel_relaxed() in the prepare +function to a writel() so that our DMA is guaranteed to be prepared +now that we can't rely on geni_se_setup_m_cmd()'s writel(). + +NOTE: the only current user of GENI_SE_DMA in mainline is i2c. + +Fixes: 37692de5d523 ("i2c: i2c-qcom-geni: Add bus driver for the Qualcomm GENI I2C controller") +Fixes: 02b9aec59243 ("i2c: i2c-qcom-geni: Fix DMA transfer race") +Signed-off-by: Douglas Anderson +Reviewed-by: Stephen Boyd +Reviewed-by: Akash Asthana +Tested-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20201013142448.v2.1.Ifdb1b69fa3367b81118e16e9e4e63299980ca798@changeid +Signed-off-by: Bjorn Andersson +Signed-off-by: Sasha Levin +--- + drivers/soc/qcom/qcom-geni-se.c | 17 +++++++++++++++-- + 1 file changed, 15 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c +index 7d622ea1274eb..2e66098e82975 100644 +--- a/drivers/soc/qcom/qcom-geni-se.c ++++ b/drivers/soc/qcom/qcom-geni-se.c +@@ -282,10 +282,23 @@ static void geni_se_select_fifo_mode(struct geni_se *se) + + static void geni_se_select_dma_mode(struct geni_se *se) + { ++ u32 proto = geni_se_read_proto(se); + u32 val; + + geni_se_irq_clear(se); + ++ val = readl_relaxed(se->base + SE_GENI_M_IRQ_EN); ++ if (proto != GENI_SE_UART) { ++ val &= ~(M_CMD_DONE_EN | M_TX_FIFO_WATERMARK_EN); ++ val &= ~(M_RX_FIFO_WATERMARK_EN | M_RX_FIFO_LAST_EN); ++ } ++ writel_relaxed(val, se->base + SE_GENI_M_IRQ_EN); ++ ++ val = readl_relaxed(se->base + SE_GENI_S_IRQ_EN); ++ if (proto != GENI_SE_UART) ++ val &= ~S_CMD_DONE_EN; ++ writel_relaxed(val, se->base + SE_GENI_S_IRQ_EN); ++ + val = readl_relaxed(se->base + SE_GENI_DMA_MODE_EN); + val |= GENI_DMA_MODE_EN; + writel_relaxed(val, se->base + SE_GENI_DMA_MODE_EN); +@@ -644,7 +657,7 @@ int geni_se_tx_dma_prep(struct geni_se *se, void *buf, size_t len, + writel_relaxed(lower_32_bits(*iova), se->base + SE_DMA_TX_PTR_L); + writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_TX_PTR_H); + writel_relaxed(GENI_SE_DMA_EOT_BUF, se->base + SE_DMA_TX_ATTR); +- writel_relaxed(len, se->base + SE_DMA_TX_LEN); ++ writel(len, se->base + SE_DMA_TX_LEN); + return 0; + } + EXPORT_SYMBOL(geni_se_tx_dma_prep); +@@ -681,7 +694,7 @@ int geni_se_rx_dma_prep(struct geni_se *se, void *buf, size_t len, + writel_relaxed(upper_32_bits(*iova), se->base + SE_DMA_RX_PTR_H); + /* RX does not have EOT buffer type bit. So just reset RX_ATTR */ + writel_relaxed(0, se->base + SE_DMA_RX_ATTR); +- writel_relaxed(len, se->base + SE_DMA_RX_LEN); ++ writel(len, se->base + SE_DMA_RX_LEN); + return 0; + } + EXPORT_SYMBOL(geni_se_rx_dma_prep); +-- +2.27.0 + diff --git a/queue-5.4/soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch b/queue-5.4/soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch new file mode 100644 index 00000000000..31f25fcb698 --- /dev/null +++ b/queue-5.4/soc-renesas-rmobile-sysc-fix-some-leaks-in-rmobile_i.patch @@ -0,0 +1,36 @@ +From edcb4dde1a4004f2276ce03195daba90614fd403 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Sep 2020 14:31:42 +0300 +Subject: soc: renesas: rmobile-sysc: Fix some leaks in + rmobile_init_pm_domains() + +From: Dan Carpenter + +[ Upstream commit cf25d802e029c31efac8bdc979236927f37183bd ] + +This code needs to call iounmap() on one error path. + +Fixes: 2173fc7cb681 ("ARM: shmobile: R-Mobile: Add DT support for PM domains") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20200923113142.GC1473821@mwanda +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Sasha Levin +--- + drivers/soc/renesas/rmobile-sysc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soc/renesas/rmobile-sysc.c b/drivers/soc/renesas/rmobile-sysc.c +index 54b616ad4a62a..beb1c7211c3d6 100644 +--- a/drivers/soc/renesas/rmobile-sysc.c ++++ b/drivers/soc/renesas/rmobile-sysc.c +@@ -327,6 +327,7 @@ static int __init rmobile_init_pm_domains(void) + + pmd = of_get_child_by_name(np, "pm-domains"); + if (!pmd) { ++ iounmap(base); + pr_warn("%pOF lacks pm-domains node\n", np); + continue; + } +-- +2.27.0 + diff --git a/queue-5.4/soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch b/queue-5.4/soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch new file mode 100644 index 00000000000..50fbdfcb155 --- /dev/null +++ b/queue-5.4/soc-ti-fix-reference-imbalance-in-knav_dma_probe.patch @@ -0,0 +1,73 @@ +From 38a69a3f4058498ea66dac53cb0966bd57588c7c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 19:22:37 -0800 +Subject: soc: ti: Fix reference imbalance in knav_dma_probe + +From: Zhang Qilong + +[ Upstream commit b4fa73358c306d747a2200aec6f7acb97e5750e6 ] + +The patch fix two reference leak. + + 1) pm_runtime_get_sync will increment pm usage counter even it + failed. Forgetting to call put operation will result in + reference leak. + + 2) The pm_runtime_enable will increase power disable depth. Thus + a pairing decrement is needed on the error handling path to + keep it balanced. + +We fix it by: 1) adding call pm_runtime_put_noidle or +pm_runtime_put_sync in error handling. 2) adding pm_runtime_disable +in error handling, to keep usage counter and disable depth balanced. + +Fixes: 88139ed030583 ("soc: ti: add Keystone Navigator DMA support") +Signed-off-by: Zhang Qilong +Signed-off-by: Santosh Shilimkar +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/knav_dma.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c +index 6285cd8efb21b..981a9014c9c4e 100644 +--- a/drivers/soc/ti/knav_dma.c ++++ b/drivers/soc/ti/knav_dma.c +@@ -759,8 +759,9 @@ static int knav_dma_probe(struct platform_device *pdev) + pm_runtime_enable(kdev->dev); + ret = pm_runtime_get_sync(kdev->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(kdev->dev); + dev_err(kdev->dev, "unable to enable pktdma, err %d\n", ret); +- return ret; ++ goto err_pm_disable; + } + + /* Initialise all packet dmas */ +@@ -774,7 +775,8 @@ static int knav_dma_probe(struct platform_device *pdev) + + if (list_empty(&kdev->list)) { + dev_err(dev, "no valid dma instance\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_put_sync; + } + + debugfs_create_file("knav_dma", S_IFREG | S_IRUGO, NULL, NULL, +@@ -782,6 +784,13 @@ static int knav_dma_probe(struct platform_device *pdev) + + device_ready = true; + return ret; ++ ++err_put_sync: ++ pm_runtime_put_sync(kdev->dev); ++err_pm_disable: ++ pm_runtime_disable(kdev->dev); ++ ++ return ret; + } + + static int knav_dma_remove(struct platform_device *pdev) +-- +2.27.0 + diff --git a/queue-5.4/soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch b/queue-5.4/soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch new file mode 100644 index 00000000000..ac2211cbb9b --- /dev/null +++ b/queue-5.4/soc-ti-knav_qmss-fix-reference-leak-in-knav_queue_pr.patch @@ -0,0 +1,36 @@ +From d742029254cfaeff6c3c5bfdd3c8d2e259bd369f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Nov 2020 19:22:00 -0800 +Subject: soc: ti: knav_qmss: fix reference leak in knav_queue_probe + +From: Zhang Qilong + +[ Upstream commit ec8684847d8062496c4619bc3fcff31c19d56847 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in knav_queue_probe, so we should fix it. + +Fixes: 41f93af900a20 ("soc: ti: add Keystone Navigator QMSS driver") +Signed-off-by: Zhang Qilong +Signed-off-by: Santosh Shilimkar +Signed-off-by: Sasha Levin +--- + drivers/soc/ti/knav_qmss_queue.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c +index 1ccc9064e1eb5..dbbf15e7ef6e1 100644 +--- a/drivers/soc/ti/knav_qmss_queue.c ++++ b/drivers/soc/ti/knav_qmss_queue.c +@@ -1791,6 +1791,7 @@ static int knav_queue_probe(struct platform_device *pdev) + pm_runtime_enable(&pdev->dev); + ret = pm_runtime_get_sync(&pdev->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(&pdev->dev); + dev_err(dev, "Failed to enable QMSS\n"); + return ret; + } +-- +2.27.0 + diff --git a/queue-5.4/sparc-fix-handling-of-page-table-constructor-failure.patch b/queue-5.4/sparc-fix-handling-of-page-table-constructor-failure.patch new file mode 100644 index 00000000000..8fcf6643e1f --- /dev/null +++ b/queue-5.4/sparc-fix-handling-of-page-table-constructor-failure.patch @@ -0,0 +1,43 @@ +From 5b691c2553b36419f381910c77e0be9d7496f4ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Dec 2020 19:07:59 -0800 +Subject: sparc: fix handling of page table constructor failure + +From: Matthew Wilcox (Oracle) + +[ Upstream commit 06517c9a336f4c20f2064611bf4b1e7881a95fe1 ] + +The page has just been allocated, so its refcount is 1. free_unref_page() +is for use on pages which have a zero refcount. Use __free_page() like +the other implementations of pte_alloc_one(). + +Link: https://lkml.kernel.org/r/20201125034655.27687-1-willy@infradead.org +Fixes: 1ae9ae5f7df7 ("sparc: handle pgtable_page_ctor() fail") +Signed-off-by: Matthew Wilcox (Oracle) +Reviewed-by: David Hildenbrand +Reviewed-by: Mike Rapoport +Acked-by: Vlastimil Babka +Cc: David Miller +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + arch/sparc/mm/init_64.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c +index e6d91819da921..28b9ffd85db0b 100644 +--- a/arch/sparc/mm/init_64.c ++++ b/arch/sparc/mm/init_64.c +@@ -2904,7 +2904,7 @@ pgtable_t pte_alloc_one(struct mm_struct *mm) + if (!page) + return NULL; + if (!pgtable_pte_page_ctor(page)) { +- free_unref_page(page); ++ __free_page(page); + return NULL; + } + return (pte_t *) page_address(page); +-- +2.27.0 + diff --git a/queue-5.4/speakup-fix-uninitialized-flush_lock.patch b/queue-5.4/speakup-fix-uninitialized-flush_lock.patch new file mode 100644 index 00000000000..96460cae79c --- /dev/null +++ b/queue-5.4/speakup-fix-uninitialized-flush_lock.patch @@ -0,0 +1,39 @@ +From 2aa11067cdfbc39a887ed32371704e906193dc5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 09:22:29 +0800 +Subject: speakup: fix uninitialized flush_lock + +From: Yang Yingliang + +[ Upstream commit d1b928ee1cfa965a3327bbaa59bfa005d97fa0fe ] + +The flush_lock is uninitialized, use DEFINE_SPINLOCK +to define and initialize flush_lock. + +Fixes: c6e3fd22cd53 ("Staging: add speakup to the staging directory") +Reported-by: Hulk Robot +Reviewed-by: Samuel Thibault +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20201117012229.3395186-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/speakup/speakup_dectlk.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/speakup/speakup_dectlk.c b/drivers/staging/speakup/speakup_dectlk.c +index dccb4ea29d379..45ac48d031805 100644 +--- a/drivers/staging/speakup/speakup_dectlk.c ++++ b/drivers/staging/speakup/speakup_dectlk.c +@@ -37,7 +37,7 @@ static unsigned char get_index(struct spk_synth *synth); + static int in_escape; + static int is_flushing; + +-static spinlock_t flush_lock; ++static DEFINE_SPINLOCK(flush_lock); + static DECLARE_WAIT_QUEUE_HEAD(flush); + + static struct var_t vars[] = { +-- +2.27.0 + diff --git a/queue-5.4/spi-bcm63xx-hsspi-fix-missing-clk_disable_unprepare-.patch b/queue-5.4/spi-bcm63xx-hsspi-fix-missing-clk_disable_unprepare-.patch new file mode 100644 index 00000000000..4405be8fa4a --- /dev/null +++ b/queue-5.4/spi-bcm63xx-hsspi-fix-missing-clk_disable_unprepare-.patch @@ -0,0 +1,42 @@ +From 497cbb4e1dd19294b4f87fac0f480c7b1c216ff5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 15:49:11 +0800 +Subject: spi: bcm63xx-hsspi: fix missing clk_disable_unprepare() on error in + bcm63xx_hsspi_resume + +From: Qinglang Miao + +[ Upstream commit 9bb9ef2b3e5d9d012876e7e2d7757eb30e865bee ] + +Fix the missing clk_disable_unprepare() before return +from bcm63xx_hsspi_resume in the error handling case when +fails to prepare and enable bs->pll_clk. + +Fixes: 0fd85869c2a9 ("spi/bcm63xx-hsspi: keep pll clk enabled") +Signed-off-by: Qinglang Miao +Link: https://lore.kernel.org/r/20201103074911.195530-1-miaoqinglang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-bcm63xx-hsspi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-bcm63xx-hsspi.c b/drivers/spi/spi-bcm63xx-hsspi.c +index 36f7eb8ab2df1..509476a2d79bb 100644 +--- a/drivers/spi/spi-bcm63xx-hsspi.c ++++ b/drivers/spi/spi-bcm63xx-hsspi.c +@@ -483,8 +483,10 @@ static int bcm63xx_hsspi_resume(struct device *dev) + + if (bs->pll_clk) { + ret = clk_prepare_enable(bs->pll_clk); +- if (ret) ++ if (ret) { ++ clk_disable_unprepare(bs->clk); + return ret; ++ } + } + + spi_master_resume(master); +-- +2.27.0 + diff --git a/queue-5.4/spi-fix-resource-leak-for-drivers-without-.remove-ca.patch b/queue-5.4/spi-fix-resource-leak-for-drivers-without-.remove-ca.patch new file mode 100644 index 00000000000..a54d84810ad --- /dev/null +++ b/queue-5.4/spi-fix-resource-leak-for-drivers-without-.remove-ca.patch @@ -0,0 +1,80 @@ +From 03ee721baae6dd720a6b652f4b7f7f253139e080 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 19 Nov 2020 17:16:02 +0100 +Subject: spi: fix resource leak for drivers without .remove callback +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 440408dbadfe47a615afd0a0a4a402e629be658a ] + +Consider an spi driver with a .probe but without a .remove callback (e.g. +rtc-ds1347). The function spi_drv_probe() is called to bind a device and +so dev_pm_domain_attach() is called. As there is no remove callback +spi_drv_remove() isn't called at unbind time however and so calling +dev_pm_domain_detach() is missed and the pm domain keeps active. + +To fix this always use both spi_drv_probe() and spi_drv_remove() and +make them handle the respective callback not being set. This has the +side effect that for a (hypothetical) driver that has neither .probe nor +remove the clk and pm domain setup is done. + +Fixes: 33cf00e57082 ("spi: attach/detach SPI device to the ACPI power domain") +Signed-off-by: Uwe Kleine-König +Link: https://lore.kernel.org/r/20201119161604.2633521-1-u.kleine-koenig@pengutronix.de +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 4c96c7c9e335e..e1205d72be523 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -405,9 +405,11 @@ static int spi_drv_probe(struct device *dev) + if (ret) + return ret; + +- ret = sdrv->probe(spi); +- if (ret) +- dev_pm_domain_detach(dev, true); ++ if (sdrv->probe) { ++ ret = sdrv->probe(spi); ++ if (ret) ++ dev_pm_domain_detach(dev, true); ++ } + + return ret; + } +@@ -415,9 +417,10 @@ static int spi_drv_probe(struct device *dev) + static int spi_drv_remove(struct device *dev) + { + const struct spi_driver *sdrv = to_spi_driver(dev->driver); +- int ret; ++ int ret = 0; + +- ret = sdrv->remove(to_spi_device(dev)); ++ if (sdrv->remove) ++ ret = sdrv->remove(to_spi_device(dev)); + dev_pm_domain_detach(dev, true); + + return ret; +@@ -442,10 +445,8 @@ int __spi_register_driver(struct module *owner, struct spi_driver *sdrv) + { + sdrv->driver.owner = owner; + sdrv->driver.bus = &spi_bus_type; +- if (sdrv->probe) +- sdrv->driver.probe = spi_drv_probe; +- if (sdrv->remove) +- sdrv->driver.remove = spi_drv_remove; ++ sdrv->driver.probe = spi_drv_probe; ++ sdrv->driver.remove = spi_drv_remove; + if (sdrv->shutdown) + sdrv->driver.shutdown = spi_drv_shutdown; + return driver_register(&sdrv->driver); +-- +2.27.0 + diff --git a/queue-5.4/spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch b/queue-5.4/spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch new file mode 100644 index 00000000000..fc93fadba35 --- /dev/null +++ b/queue-5.4/spi-img-spfi-fix-reference-leak-in-img_spfi_resume.patch @@ -0,0 +1,41 @@ +From 415df69553db8df72805746f6cfd182a293088b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 22:56:51 +0800 +Subject: spi: img-spfi: fix reference leak in img_spfi_resume + +From: Zhang Qilong + +[ Upstream commit ee5558a9084584015c8754ffd029ce14a5827fa8 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in img_spfi_resume, so we should fix it. + +Fixes: deba25800a12b ("spi: Add driver for IMG SPFI controller") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201102145651.3875-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-img-spfi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/spi/spi-img-spfi.c b/drivers/spi/spi-img-spfi.c +index f4a8f470aecc2..e9ef80983b791 100644 +--- a/drivers/spi/spi-img-spfi.c ++++ b/drivers/spi/spi-img-spfi.c +@@ -771,8 +771,10 @@ static int img_spfi_resume(struct device *dev) + int ret; + + ret = pm_runtime_get_sync(dev); +- if (ret) ++ if (ret) { ++ pm_runtime_put_noidle(dev); + return ret; ++ } + spfi_reset(spfi); + pm_runtime_put(dev); + +-- +2.27.0 + diff --git a/queue-5.4/spi-mt7621-fix-missing-clk_disable_unprepare-on-erro.patch b/queue-5.4/spi-mt7621-fix-missing-clk_disable_unprepare-on-erro.patch new file mode 100644 index 00000000000..2ac67719b34 --- /dev/null +++ b/queue-5.4/spi-mt7621-fix-missing-clk_disable_unprepare-on-erro.patch @@ -0,0 +1,45 @@ +From 64507cb994bf959f65a051ee078217f4ea83940a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 15:49:12 +0800 +Subject: spi: mt7621: fix missing clk_disable_unprepare() on error in + mt7621_spi_probe + +From: Qinglang Miao + +[ Upstream commit 702b15cb97123cedcec56a39d9a21c5288eb9ae1 ] + +Fix the missing clk_disable_unprepare() before return +from mt7621_spi_probe in the error handling case. + +Fixes: cbd66c626e16 ("spi: mt7621: Move SPI driver out of staging") +Signed-off-by: Qinglang Miao +Link: https://lore.kernel.org/r/20201103074912.195576-1-miaoqinglang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mt7621.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-mt7621.c b/drivers/spi/spi-mt7621.c +index 2c3b7a2a1ec77..2cdae7994e2aa 100644 +--- a/drivers/spi/spi-mt7621.c ++++ b/drivers/spi/spi-mt7621.c +@@ -353,6 +353,7 @@ static int mt7621_spi_probe(struct platform_device *pdev) + master = spi_alloc_master(&pdev->dev, sizeof(*rs)); + if (!master) { + dev_info(&pdev->dev, "master allocation failed\n"); ++ clk_disable_unprepare(clk); + return -ENOMEM; + } + +@@ -377,6 +378,7 @@ static int mt7621_spi_probe(struct platform_device *pdev) + ret = device_reset(&pdev->dev); + if (ret) { + dev_err(&pdev->dev, "SPI reset failed!\n"); ++ clk_disable_unprepare(clk); + return ret; + } + +-- +2.27.0 + diff --git a/queue-5.4/spi-mxs-fix-reference-leak-in-mxs_spi_probe.patch b/queue-5.4/spi-mxs-fix-reference-leak-in-mxs_spi_probe.patch new file mode 100644 index 00000000000..4927680d62c --- /dev/null +++ b/queue-5.4/spi-mxs-fix-reference-leak-in-mxs_spi_probe.patch @@ -0,0 +1,37 @@ +From 2fc571df33e80099c3f251dbc687c0cc46c13a06 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 09:24:21 +0800 +Subject: spi: mxs: fix reference leak in mxs_spi_probe + +From: Zhang Qilong + +[ Upstream commit 03fc41afaa6549baa2dab7a84e1afaf5cadb5b18 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in mxs_spi_probe, so we should fix it. + +Fixes: b7969caf41a1d ("spi: mxs: implement runtime pm") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201106012421.95420-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mxs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-mxs.c b/drivers/spi/spi-mxs.c +index 996c1c8a9c719..34856c9ad931a 100644 +--- a/drivers/spi/spi-mxs.c ++++ b/drivers/spi/spi-mxs.c +@@ -608,6 +608,7 @@ static int mxs_spi_probe(struct platform_device *pdev) + + ret = pm_runtime_get_sync(ssp->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(ssp->dev); + dev_err(ssp->dev, "runtime_get_sync failed\n"); + goto out_pm_runtime_disable; + } +-- +2.27.0 + diff --git a/queue-5.4/spi-spi-mem-fix-reference-leak-in-spi_mem_access_sta.patch b/queue-5.4/spi-spi-mem-fix-reference-leak-in-spi_mem_access_sta.patch new file mode 100644 index 00000000000..e58974ffbc7 --- /dev/null +++ b/queue-5.4/spi-spi-mem-fix-reference-leak-in-spi_mem_access_sta.patch @@ -0,0 +1,37 @@ +From 32715d2abd7c734a072aae14eaa234346c4a63bd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 22:09:10 +0800 +Subject: spi: spi-mem: fix reference leak in spi_mem_access_start + +From: Zhang Qilong + +[ Upstream commit c02bb16b0e826bf0e19aa42c3ae60ea339f32cf5 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in spi_mem_access_start, so we should fix it. + +Fixes: f86c24f479530 ("spi: spi-mem: Split spi_mem_exec_op() code") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201103140910.3482-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-mem.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-mem.c b/drivers/spi/spi-mem.c +index de0ba3e5449fa..33115bcfc787e 100644 +--- a/drivers/spi/spi-mem.c ++++ b/drivers/spi/spi-mem.c +@@ -237,6 +237,7 @@ static int spi_mem_access_start(struct spi_mem *mem) + + ret = pm_runtime_get_sync(ctlr->dev.parent); + if (ret < 0) { ++ pm_runtime_put_noidle(ctlr->dev.parent); + dev_err(&ctlr->dev, "Failed to power device: %d\n", + ret); + return ret; +-- +2.27.0 + diff --git a/queue-5.4/spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch b/queue-5.4/spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch new file mode 100644 index 00000000000..b69ad03f004 --- /dev/null +++ b/queue-5.4/spi-spi-ti-qspi-fix-reference-leak-in-ti_qspi_setup.patch @@ -0,0 +1,37 @@ +From 1444369a561e47e1b5ee3032857d37a86bebe3e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 22:09:47 +0800 +Subject: spi: spi-ti-qspi: fix reference leak in ti_qspi_setup + +From: Zhang Qilong + +[ Upstream commit 45c0cba753641e5d7c3207f04241bd0e7a021698 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in ti_qspi_setup, so we should fix it. + +Fixes: 505a14954e2d7 ("spi/qspi: Add qspi flash controller") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201103140947.3815-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-ti-qspi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-ti-qspi.c b/drivers/spi/spi-ti-qspi.c +index 66dcb61285392..cad2abcbd9c78 100644 +--- a/drivers/spi/spi-ti-qspi.c ++++ b/drivers/spi/spi-ti-qspi.c +@@ -176,6 +176,7 @@ static int ti_qspi_setup(struct spi_device *spi) + + ret = pm_runtime_get_sync(qspi->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(qspi->dev); + dev_err(qspi->dev, "pm_runtime_get_sync() failed\n"); + return ret; + } +-- +2.27.0 + diff --git a/queue-5.4/spi-sprd-fix-reference-leak-in-sprd_spi_remove.patch b/queue-5.4/spi-sprd-fix-reference-leak-in-sprd_spi_remove.patch new file mode 100644 index 00000000000..0565a49bc0c --- /dev/null +++ b/queue-5.4/spi-sprd-fix-reference-leak-in-sprd_spi_remove.patch @@ -0,0 +1,38 @@ +From 7fa0da7ec1b6f08bccb74fd346aa297343c70741 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 09:50:35 +0800 +Subject: spi: sprd: fix reference leak in sprd_spi_remove + +From: Zhang Qilong + +[ Upstream commit e4062765bc2a41e025e29dd56bad798505036427 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in sprd_spi_remove, so we should fix it. + +Fixes: e7d973a31c24b ("spi: sprd: Add SPI driver for Spreadtrum SC9860") +Signed-off-by: Zhang Qilong +Acked-by: Chunyan Zhang +Link: https://lore.kernel.org/r/20201106015035.139574-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-sprd.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-sprd.c b/drivers/spi/spi-sprd.c +index e60aff9903951..c2bdf19ccdd26 100644 +--- a/drivers/spi/spi-sprd.c ++++ b/drivers/spi/spi-sprd.c +@@ -1008,6 +1008,7 @@ static int sprd_spi_remove(struct platform_device *pdev) + + ret = pm_runtime_get_sync(ss->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(ss->dev); + dev_err(ss->dev, "failed to resume SPI controller\n"); + return ret; + } +-- +2.27.0 + diff --git a/queue-5.4/spi-stm32-fix-reference-leak-in-stm32_spi_resume.patch b/queue-5.4/spi-stm32-fix-reference-leak-in-stm32_spi_resume.patch new file mode 100644 index 00000000000..d53039bc4eb --- /dev/null +++ b/queue-5.4/spi-stm32-fix-reference-leak-in-stm32_spi_resume.patch @@ -0,0 +1,38 @@ +From fe9db7356e62c2d9f21f27af26e83866d6cf5ab2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 09:52:17 +0800 +Subject: spi: stm32: fix reference leak in stm32_spi_resume + +From: Zhang Qilong + +[ Upstream commit 900ccdcb79bb61471df1566a70b2b39687a628d5 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in stm32_spi_resume, so we should fix it. + +Fixes: db96bf976a4fc ("spi: stm32: fixes suspend/resume management") +Signed-off-by: Zhang Qilong +Reviewed-by: Alain Volmat +Link: https://lore.kernel.org/r/20201106015217.140476-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-stm32.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-stm32.c b/drivers/spi/spi-stm32.c +index 9d8ceb63f7db1..ed20ad2950885 100644 +--- a/drivers/spi/spi-stm32.c ++++ b/drivers/spi/spi-stm32.c +@@ -2055,6 +2055,7 @@ static int stm32_spi_resume(struct device *dev) + + ret = pm_runtime_get_sync(dev); + if (ret < 0) { ++ pm_runtime_put_noidle(dev); + dev_err(dev, "Unable to power device:%d\n", ret); + return ret; + } +-- +2.27.0 + diff --git a/queue-5.4/spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch b/queue-5.4/spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch new file mode 100644 index 00000000000..82a0eb42388 --- /dev/null +++ b/queue-5.4/spi-tegra114-fix-reference-leak-in-tegra-spi-ops.patch @@ -0,0 +1,46 @@ +From a413ffaab9d9b1f9a3095c647d15120060396123 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 22:13:06 +0800 +Subject: spi: tegra114: fix reference leak in tegra spi ops + +From: Zhang Qilong + +[ Upstream commit a042184c7fb99961ea083d4ec192614bec671969 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in two callers(tegra_spi_setup and +tegra_spi_resume), so we should fix it. + +Fixes: f333a331adfac ("spi/tegra114: add spi driver") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201103141306.5607-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra114.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index 39374c2edcf3b..594905bf89aa8 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -954,6 +954,7 @@ static int tegra_spi_setup(struct spi_device *spi) + + ret = pm_runtime_get_sync(tspi->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(tspi->dev); + dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret); + if (cdata) + tegra_spi_cleanup(spi); +@@ -1472,6 +1473,7 @@ static int tegra_spi_resume(struct device *dev) + + ret = pm_runtime_get_sync(dev); + if (ret < 0) { ++ pm_runtime_put_noidle(dev); + dev_err(dev, "pm runtime failed, e = %d\n", ret); + return ret; + } +-- +2.27.0 + diff --git a/queue-5.4/spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch b/queue-5.4/spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch new file mode 100644 index 00000000000..b5befa88e96 --- /dev/null +++ b/queue-5.4/spi-tegra20-sflash-fix-reference-leak-in-tegra_sflas.patch @@ -0,0 +1,37 @@ +From 8d4e7211f2a9f54c33e019c551980d7bdcd6f8a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 22:13:23 +0800 +Subject: spi: tegra20-sflash: fix reference leak in tegra_sflash_resume + +From: Zhang Qilong + +[ Upstream commit 3482e797ab688da6703fe18d8bad52f94199f4f2 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in tegra_sflash_resume, so we should fix it. + +Fixes: 8528547bcc336 ("spi: tegra: add spi driver for sflash controller") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201103141323.5841-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra20-sflash.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c +index a841a7250d14b..ecb620169753a 100644 +--- a/drivers/spi/spi-tegra20-sflash.c ++++ b/drivers/spi/spi-tegra20-sflash.c +@@ -551,6 +551,7 @@ static int tegra_sflash_resume(struct device *dev) + + ret = pm_runtime_get_sync(dev); + if (ret < 0) { ++ pm_runtime_put_noidle(dev); + dev_err(dev, "pm runtime failed, e = %d\n", ret); + return ret; + } +-- +2.27.0 + diff --git a/queue-5.4/spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch b/queue-5.4/spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch new file mode 100644 index 00000000000..66373fcab13 --- /dev/null +++ b/queue-5.4/spi-tegra20-slink-fix-reference-leak-in-slink-ops-of.patch @@ -0,0 +1,46 @@ +From 0e73b972693ebb2b51c13949e33a7f2d9ae7082b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 22:13:45 +0800 +Subject: spi: tegra20-slink: fix reference leak in slink ops of tegra20 + +From: Zhang Qilong + +[ Upstream commit 763eab7074f6e71babd85d796156f05a675f9510 ] + +pm_runtime_get_sync will increment pm usage counter even it +failed. Forgetting to pm_runtime_put_noidle will result in +reference leak in two callers(tegra_slink_setup and +tegra_slink_resume), so we should fix it. + +Fixes: dc4dc36056392 ("spi: tegra: add spi driver for SLINK controller") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201103141345.6188-1-zhangqilong3@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + drivers/spi/spi-tegra20-slink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 374a2a32edcd3..2a1905c43a0b7 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -756,6 +756,7 @@ static int tegra_slink_setup(struct spi_device *spi) + + ret = pm_runtime_get_sync(tspi->dev); + if (ret < 0) { ++ pm_runtime_put_noidle(tspi->dev); + dev_err(tspi->dev, "pm runtime failed, e = %d\n", ret); + return ret; + } +@@ -1192,6 +1193,7 @@ static int tegra_slink_resume(struct device *dev) + + ret = pm_runtime_get_sync(dev); + if (ret < 0) { ++ pm_runtime_put_noidle(dev); + dev_err(dev, "pm runtime failed, e = %d\n", ret); + return ret; + } +-- +2.27.0 + diff --git a/queue-5.4/staging-gasket-interrupt-fix-the-missed-eventfd_ctx_.patch b/queue-5.4/staging-gasket-interrupt-fix-the-missed-eventfd_ctx_.patch new file mode 100644 index 00000000000..2a3c013ec34 --- /dev/null +++ b/queue-5.4/staging-gasket-interrupt-fix-the-missed-eventfd_ctx_.patch @@ -0,0 +1,65 @@ +From bbc335a02e287ebb04f8a5fcd2fed241ea7ace07 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Nov 2020 14:49:24 +0800 +Subject: staging: gasket: interrupt: fix the missed eventfd_ctx_put() in + gasket_interrupt.c + +From: Jing Xiangfeng + +[ Upstream commit ab5b769a23af12a675b9f3d7dd529250c527f5ac ] + +gasket_interrupt_set_eventfd() misses to call eventfd_ctx_put() in an +error path. We check interrupt is valid before calling +eventfd_ctx_fdget() to fix it. + +There is the same issue in gasket_interrupt_clear_eventfd(), Add the +missed function call to fix it. + +Fixes: 9a69f5087ccc ("drivers/staging: Gasket driver framework + Apex driver") +Signed-off-by: Jing Xiangfeng +Link: https://lore.kernel.org/r/20201112064924.99680-1-jingxiangfeng@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/gasket/gasket_interrupt.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/drivers/staging/gasket/gasket_interrupt.c b/drivers/staging/gasket/gasket_interrupt.c +index 2d6195f7300e9..864342acfd86e 100644 +--- a/drivers/staging/gasket/gasket_interrupt.c ++++ b/drivers/staging/gasket/gasket_interrupt.c +@@ -487,14 +487,16 @@ int gasket_interrupt_system_status(struct gasket_dev *gasket_dev) + int gasket_interrupt_set_eventfd(struct gasket_interrupt_data *interrupt_data, + int interrupt, int event_fd) + { +- struct eventfd_ctx *ctx = eventfd_ctx_fdget(event_fd); +- +- if (IS_ERR(ctx)) +- return PTR_ERR(ctx); ++ struct eventfd_ctx *ctx; + + if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts) + return -EINVAL; + ++ ctx = eventfd_ctx_fdget(event_fd); ++ ++ if (IS_ERR(ctx)) ++ return PTR_ERR(ctx); ++ + interrupt_data->eventfd_ctxs[interrupt] = ctx; + return 0; + } +@@ -505,6 +507,9 @@ int gasket_interrupt_clear_eventfd(struct gasket_interrupt_data *interrupt_data, + if (interrupt < 0 || interrupt >= interrupt_data->num_interrupts) + return -EINVAL; + +- interrupt_data->eventfd_ctxs[interrupt] = NULL; ++ if (interrupt_data->eventfd_ctxs[interrupt]) { ++ eventfd_ctx_put(interrupt_data->eventfd_ctxs[interrupt]); ++ interrupt_data->eventfd_ctxs[interrupt] = NULL; ++ } + return 0; + } +-- +2.27.0 + diff --git a/queue-5.4/staging-greybus-codecs-fix-reference-counter-leak-in.patch b/queue-5.4/staging-greybus-codecs-fix-reference-counter-leak-in.patch new file mode 100644 index 00000000000..1aa70464f1f --- /dev/null +++ b/queue-5.4/staging-greybus-codecs-fix-reference-counter-leak-in.patch @@ -0,0 +1,47 @@ +From 8c2fe576df013546fb7fed36b1e5477133840835 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 21:13:46 +0800 +Subject: staging: greybus: codecs: Fix reference counter leak in error + handling + +From: Zhang Qilong + +[ Upstream commit 3952659a6108f77a0d062d8e8487bdbdaf52a66c ] + +gb_pm_runtime_get_sync has increased the usage counter of the device here. +Forgetting to call gb_pm_runtime_put_noidle will result in usage counter +leak in the error branch of (gbcodec_hw_params and gbcodec_prepare). We +fixed it by adding it. + +Fixes: c388ae7696992 ("greybus: audio: Update pm runtime support in dai_ops callback") +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201109131347.1725288-2-zhangqilong3@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/staging/greybus/audio_codec.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/staging/greybus/audio_codec.c b/drivers/staging/greybus/audio_codec.c +index 08746c85dea6d..3259bf02ba25e 100644 +--- a/drivers/staging/greybus/audio_codec.c ++++ b/drivers/staging/greybus/audio_codec.c +@@ -489,6 +489,7 @@ static int gbcodec_hw_params(struct snd_pcm_substream *substream, + if (ret) { + dev_err_ratelimited(dai->dev, "%d: Error during set_config\n", + ret); ++ gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + return ret; + } +@@ -565,6 +566,7 @@ static int gbcodec_prepare(struct snd_pcm_substream *substream, + break; + } + if (ret) { ++ gb_pm_runtime_put_noidle(bundle); + mutex_unlock(&codec->lock); + dev_err_ratelimited(dai->dev, "set_data_size failed:%d\n", + ret); +-- +2.27.0 + diff --git a/queue-5.4/sunrpc-fix-xs_read_xdr_buf-for-partial-pages-receive.patch b/queue-5.4/sunrpc-fix-xs_read_xdr_buf-for-partial-pages-receive.patch new file mode 100644 index 00000000000..d88941093d5 --- /dev/null +++ b/queue-5.4/sunrpc-fix-xs_read_xdr_buf-for-partial-pages-receive.patch @@ -0,0 +1,55 @@ +From 47cfc8a859fa42f20aa62cee36ed20cfccaa6e64 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Dec 2020 11:28:35 +0200 +Subject: sunrpc: fix xs_read_xdr_buf for partial pages receive + +From: Dan Aloni + +[ Upstream commit ac9645c87380e39a8fa87a1b51721efcdea89dbf ] + +When receiving pages data, return value 'ret' when positive includes +`buf->page_base`, so we should subtract that before it is used for +changing `offset` and comparing against `want`. + +This was discovered on the very rare cases where the server returned a +chunk of bytes that when added to the already received amount of bytes +for the pages happened to match the current `recv.len`, for example +on this case: + + buf->page_base : 258356 + actually received from socket: 1740 + ret : 260096 + want : 260096 + +In this case neither of the two 'if ... goto out' trigger, and we +continue to tail parsing. + +Worth to mention that the ensuing EMSGSIZE from the continued execution of +`xs_read_xdr_buf` may be observed by an application due to 4 superfluous +bytes being added to the pages data. + +Fixes: 277e4ab7d530 ("SUNRPC: Simplify TCP receive code by switching to using iterators") +Signed-off-by: Dan Aloni +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/xprtsock.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 449f193b5a886..8ffc54b6661f8 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -432,7 +432,8 @@ xs_read_xdr_buf(struct socket *sock, struct msghdr *msg, int flags, + if (ret <= 0) + goto sock_err; + xs_flush_bvec(buf->bvec, ret, seek + buf->page_base); +- offset += ret - buf->page_base; ++ ret -= buf->page_base; ++ offset += ret; + if (offset == count || msg->msg_flags & (MSG_EOR|MSG_TRUNC)) + goto out; + if (ret != want) +-- +2.27.0 + diff --git a/queue-5.4/sunrpc-rpc_wake_up-should-wake-up-tasks-in-the-corre.patch b/queue-5.4/sunrpc-rpc_wake_up-should-wake-up-tasks-in-the-corre.patch new file mode 100644 index 00000000000..86af3864980 --- /dev/null +++ b/queue-5.4/sunrpc-rpc_wake_up-should-wake-up-tasks-in-the-corre.patch @@ -0,0 +1,118 @@ +From 6cc133d45f9e3ce9d01bcc874d35587af87d7978 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 17:40:33 -0400 +Subject: SUNRPC: rpc_wake_up() should wake up tasks in the correct order + +From: Trond Myklebust + +[ Upstream commit e4c72201b6ec3173dfe13fa2e2335a3ad78d4921 ] + +Currently, we wake up the tasks by priority queue ordering, which means +that we ignore the batching that is supposed to help with QoS issues. + +Fixes: c049f8ea9a0d ("SUNRPC: Remove the bh-safe lock requirement on the rpc_wait_queue->lock") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + net/sunrpc/sched.c | 65 +++++++++++++++++++++++++--------------------- + 1 file changed, 35 insertions(+), 30 deletions(-) + +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index 53d8b82eda006..7afbf15bcbd9a 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -699,6 +699,23 @@ struct rpc_task *rpc_wake_up_next(struct rpc_wait_queue *queue) + } + EXPORT_SYMBOL_GPL(rpc_wake_up_next); + ++/** ++ * rpc_wake_up_locked - wake up all rpc_tasks ++ * @queue: rpc_wait_queue on which the tasks are sleeping ++ * ++ */ ++static void rpc_wake_up_locked(struct rpc_wait_queue *queue) ++{ ++ struct rpc_task *task; ++ ++ for (;;) { ++ task = __rpc_find_next_queued(queue); ++ if (task == NULL) ++ break; ++ rpc_wake_up_task_queue_locked(queue, task); ++ } ++} ++ + /** + * rpc_wake_up - wake up all rpc_tasks + * @queue: rpc_wait_queue on which the tasks are sleeping +@@ -707,25 +724,28 @@ EXPORT_SYMBOL_GPL(rpc_wake_up_next); + */ + void rpc_wake_up(struct rpc_wait_queue *queue) + { +- struct list_head *head; +- + spin_lock(&queue->lock); +- head = &queue->tasks[queue->maxpriority]; ++ rpc_wake_up_locked(queue); ++ spin_unlock(&queue->lock); ++} ++EXPORT_SYMBOL_GPL(rpc_wake_up); ++ ++/** ++ * rpc_wake_up_status_locked - wake up all rpc_tasks and set their status value. ++ * @queue: rpc_wait_queue on which the tasks are sleeping ++ * @status: status value to set ++ */ ++static void rpc_wake_up_status_locked(struct rpc_wait_queue *queue, int status) ++{ ++ struct rpc_task *task; ++ + for (;;) { +- while (!list_empty(head)) { +- struct rpc_task *task; +- task = list_first_entry(head, +- struct rpc_task, +- u.tk_wait.list); +- rpc_wake_up_task_queue_locked(queue, task); +- } +- if (head == &queue->tasks[0]) ++ task = __rpc_find_next_queued(queue); ++ if (task == NULL) + break; +- head--; ++ rpc_wake_up_task_queue_set_status_locked(queue, task, status); + } +- spin_unlock(&queue->lock); + } +-EXPORT_SYMBOL_GPL(rpc_wake_up); + + /** + * rpc_wake_up_status - wake up all rpc_tasks and set their status value. +@@ -736,23 +756,8 @@ EXPORT_SYMBOL_GPL(rpc_wake_up); + */ + void rpc_wake_up_status(struct rpc_wait_queue *queue, int status) + { +- struct list_head *head; +- + spin_lock(&queue->lock); +- head = &queue->tasks[queue->maxpriority]; +- for (;;) { +- while (!list_empty(head)) { +- struct rpc_task *task; +- task = list_first_entry(head, +- struct rpc_task, +- u.tk_wait.list); +- task->tk_status = status; +- rpc_wake_up_task_queue_locked(queue, task); +- } +- if (head == &queue->tasks[0]) +- break; +- head--; +- } ++ rpc_wake_up_status_locked(queue, status); + spin_unlock(&queue->lock); + } + EXPORT_SYMBOL_GPL(rpc_wake_up_status); +-- +2.27.0 + diff --git a/queue-5.4/sunrpc-xprt_load_transport-needs-to-support-the-neti.patch b/queue-5.4/sunrpc-xprt_load_transport-needs-to-support-the-neti.patch new file mode 100644 index 00000000000..7c3d3c18d34 --- /dev/null +++ b/queue-5.4/sunrpc-xprt_load_transport-needs-to-support-the-neti.patch @@ -0,0 +1,185 @@ +From 5446cb529ada459c87fd4bb8d7ced88bb3d8f0d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Nov 2020 16:33:38 -0500 +Subject: SUNRPC: xprt_load_transport() needs to support the netid "rdma6" + +From: Trond Myklebust + +[ Upstream commit d5aa6b22e2258f05317313ecc02efbb988ed6d38 ] + +According to RFC5666, the correct netid for an IPv6 addressed RDMA +transport is "rdma6", which we've supported as a mount option since +Linux-4.7. The problem is when we try to load the module "xprtrdma6", +that will fail, since there is no modulealias of that name. + +Fixes: 181342c5ebe8 ("xprtrdma: Add rdma6 option to support NFS/RDMA IPv6") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + include/linux/sunrpc/xprt.h | 1 + + net/sunrpc/xprt.c | 65 +++++++++++++++++++++++++-------- + net/sunrpc/xprtrdma/module.c | 1 + + net/sunrpc/xprtrdma/transport.c | 1 + + net/sunrpc/xprtsock.c | 4 ++ + 5 files changed, 56 insertions(+), 16 deletions(-) + +diff --git a/include/linux/sunrpc/xprt.h b/include/linux/sunrpc/xprt.h +index d783e15ba898c..d7ef5b97174ce 100644 +--- a/include/linux/sunrpc/xprt.h ++++ b/include/linux/sunrpc/xprt.h +@@ -330,6 +330,7 @@ struct xprt_class { + struct rpc_xprt * (*setup)(struct xprt_create *); + struct module *owner; + char name[32]; ++ const char * netid[]; + }; + + /* +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index a6fee86f400ec..639837b3a5d90 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -151,31 +151,64 @@ out: + } + EXPORT_SYMBOL_GPL(xprt_unregister_transport); + ++static void ++xprt_class_release(const struct xprt_class *t) ++{ ++ module_put(t->owner); ++} ++ ++static const struct xprt_class * ++xprt_class_find_by_netid_locked(const char *netid) ++{ ++ const struct xprt_class *t; ++ unsigned int i; ++ ++ list_for_each_entry(t, &xprt_list, list) { ++ for (i = 0; t->netid[i][0] != '\0'; i++) { ++ if (strcmp(t->netid[i], netid) != 0) ++ continue; ++ if (!try_module_get(t->owner)) ++ continue; ++ return t; ++ } ++ } ++ return NULL; ++} ++ ++static const struct xprt_class * ++xprt_class_find_by_netid(const char *netid) ++{ ++ const struct xprt_class *t; ++ ++ spin_lock(&xprt_list_lock); ++ t = xprt_class_find_by_netid_locked(netid); ++ if (!t) { ++ spin_unlock(&xprt_list_lock); ++ request_module("rpc%s", netid); ++ spin_lock(&xprt_list_lock); ++ t = xprt_class_find_by_netid_locked(netid); ++ } ++ spin_unlock(&xprt_list_lock); ++ return t; ++} ++ + /** + * xprt_load_transport - load a transport implementation +- * @transport_name: transport to load ++ * @netid: transport to load + * + * Returns: + * 0: transport successfully loaded + * -ENOENT: transport module not available + */ +-int xprt_load_transport(const char *transport_name) ++int xprt_load_transport(const char *netid) + { +- struct xprt_class *t; +- int result; ++ const struct xprt_class *t; + +- result = 0; +- spin_lock(&xprt_list_lock); +- list_for_each_entry(t, &xprt_list, list) { +- if (strcmp(t->name, transport_name) == 0) { +- spin_unlock(&xprt_list_lock); +- goto out; +- } +- } +- spin_unlock(&xprt_list_lock); +- result = request_module("xprt%s", transport_name); +-out: +- return result; ++ t = xprt_class_find_by_netid(netid); ++ if (!t) ++ return -ENOENT; ++ xprt_class_release(t); ++ return 0; + } + EXPORT_SYMBOL_GPL(xprt_load_transport); + +diff --git a/net/sunrpc/xprtrdma/module.c b/net/sunrpc/xprtrdma/module.c +index 620327c01302c..45c5b41ac8dc9 100644 +--- a/net/sunrpc/xprtrdma/module.c ++++ b/net/sunrpc/xprtrdma/module.c +@@ -24,6 +24,7 @@ MODULE_DESCRIPTION("RPC/RDMA Transport"); + MODULE_LICENSE("Dual BSD/GPL"); + MODULE_ALIAS("svcrdma"); + MODULE_ALIAS("xprtrdma"); ++MODULE_ALIAS("rpcrdma6"); + + static void __exit rpc_rdma_cleanup(void) + { +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index c67d465dc0620..2f21e3c52bfc1 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -827,6 +827,7 @@ static struct xprt_class xprt_rdma = { + .owner = THIS_MODULE, + .ident = XPRT_TRANSPORT_RDMA, + .setup = xprt_setup_rdma, ++ .netid = { "rdma", "rdma6", "" }, + }; + + void xprt_rdma_cleanup(void) +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 934e30e675375..449f193b5a886 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -3204,6 +3204,7 @@ static struct xprt_class xs_local_transport = { + .owner = THIS_MODULE, + .ident = XPRT_TRANSPORT_LOCAL, + .setup = xs_setup_local, ++ .netid = { "" }, + }; + + static struct xprt_class xs_udp_transport = { +@@ -3212,6 +3213,7 @@ static struct xprt_class xs_udp_transport = { + .owner = THIS_MODULE, + .ident = XPRT_TRANSPORT_UDP, + .setup = xs_setup_udp, ++ .netid = { "udp", "udp6", "" }, + }; + + static struct xprt_class xs_tcp_transport = { +@@ -3220,6 +3222,7 @@ static struct xprt_class xs_tcp_transport = { + .owner = THIS_MODULE, + .ident = XPRT_TRANSPORT_TCP, + .setup = xs_setup_tcp, ++ .netid = { "tcp", "tcp6", "" }, + }; + + static struct xprt_class xs_bc_tcp_transport = { +@@ -3228,6 +3231,7 @@ static struct xprt_class xs_bc_tcp_transport = { + .owner = THIS_MODULE, + .ident = XPRT_TRANSPORT_BC_TCP, + .setup = xs_setup_bc_tcp, ++ .netid = { "" }, + }; + + /** +-- +2.27.0 + diff --git a/queue-5.4/ubifs-fix-error-return-code-in-ubifs_init_authentica.patch b/queue-5.4/ubifs-fix-error-return-code-in-ubifs_init_authentica.patch new file mode 100644 index 00000000000..e6955631e20 --- /dev/null +++ b/queue-5.4/ubifs-fix-error-return-code-in-ubifs_init_authentica.patch @@ -0,0 +1,41 @@ +From 809b14c85da43e21c67060057f0d35e50d962bdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Nov 2020 14:33:20 +0800 +Subject: ubifs: Fix error return code in ubifs_init_authentication() + +From: Wang ShaoBo + +[ Upstream commit 3cded66330591cfd2554a3fd5edca8859ea365a2 ] + +Fix to return PTR_ERR() error code from the error handling case where +ubifs_hash_get_desc() failed instead of 0 in ubifs_init_authentication(), +as done elsewhere in this function. + +Fixes: 49525e5eecca5 ("ubifs: Add helper functions for authentication support") +Signed-off-by: Wang ShaoBo +Reviewed-by: Sascha Hauer +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + fs/ubifs/auth.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/fs/ubifs/auth.c b/fs/ubifs/auth.c +index f985a3fbbb36a..b10418b5fb719 100644 +--- a/fs/ubifs/auth.c ++++ b/fs/ubifs/auth.c +@@ -352,8 +352,10 @@ int ubifs_init_authentication(struct ubifs_info *c) + c->authenticated = true; + + c->log_hash = ubifs_hash_get_desc(c); +- if (IS_ERR(c->log_hash)) ++ if (IS_ERR(c->log_hash)) { ++ err = PTR_ERR(c->log_hash); + goto out_free_hmac; ++ } + + err = 0; + +-- +2.27.0 + diff --git a/queue-5.4/um-chan_xterm-fix-fd-leak.patch b/queue-5.4/um-chan_xterm-fix-fd-leak.patch new file mode 100644 index 00000000000..9f8bad0d01c --- /dev/null +++ b/queue-5.4/um-chan_xterm-fix-fd-leak.patch @@ -0,0 +1,66 @@ +From 098355e678a99ee5707d835941ee6a0fe6a8bff9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 17:19:40 +0000 +Subject: um: chan_xterm: Fix fd leak + +From: Anton Ivanov + +[ Upstream commit 9431f7c199ab0d02da1482d62255e0b4621cb1b5 ] + +xterm serial channel was leaking a fd used in setting up the +port helper + +This bug is prehistoric - it predates switching to git. The "fixes" +header here is really just to mark all the versions we would like this to +apply to which is "Anything from the Cretaceous period onwards". + +No dinosaurs were harmed in fixing this bug. + +Fixes: b40997b872cd ("um: drivers/xterm.c: fix a file descriptor leak") +Signed-off-by: Anton Ivanov +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/xterm.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/um/drivers/xterm.c b/arch/um/drivers/xterm.c +index fc7f1e7467032..87ca4a47cd66e 100644 +--- a/arch/um/drivers/xterm.c ++++ b/arch/um/drivers/xterm.c +@@ -18,6 +18,7 @@ + struct xterm_chan { + int pid; + int helper_pid; ++ int chan_fd; + char *title; + int device; + int raw; +@@ -33,6 +34,7 @@ static void *xterm_init(char *str, int device, const struct chan_opts *opts) + return NULL; + *data = ((struct xterm_chan) { .pid = -1, + .helper_pid = -1, ++ .chan_fd = -1, + .device = device, + .title = opts->xterm_title, + .raw = opts->raw } ); +@@ -149,6 +151,7 @@ static int xterm_open(int input, int output, int primary, void *d, + goto out_kill; + } + ++ data->chan_fd = fd; + new = xterm_fd(fd, &data->helper_pid); + if (new < 0) { + err = new; +@@ -206,6 +209,8 @@ static void xterm_close(int fd, void *d) + os_kill_process(data->helper_pid, 0); + data->helper_pid = -1; + ++ if (data->chan_fd != -1) ++ os_close_file(data->chan_fd); + os_close_file(fd); + } + +-- +2.27.0 + diff --git a/queue-5.4/um-monitor-error-events-in-irq-controller.patch b/queue-5.4/um-monitor-error-events-in-irq-controller.patch new file mode 100644 index 00000000000..412abe3a622 --- /dev/null +++ b/queue-5.4/um-monitor-error-events-in-irq-controller.patch @@ -0,0 +1,36 @@ +From e4d0ef9ff4601df4f4641f660a366d877a5a1442 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 17:19:38 +0000 +Subject: um: Monitor error events in IRQ controller + +From: Anton Ivanov + +[ Upstream commit e3a01cbee9c5f2c6fc813dd6af007716e60257e7 ] + +Ensure that file closes, connection closes, etc are propagated +as interrupts in the interrupt controller. + +Fixes: ff6a17989c08 ("Epoll based IRQ controller") +Signed-off-by: Anton Ivanov +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/os-Linux/irq.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/um/os-Linux/irq.c b/arch/um/os-Linux/irq.c +index d508310ee5e1e..f1732c308c615 100644 +--- a/arch/um/os-Linux/irq.c ++++ b/arch/um/os-Linux/irq.c +@@ -48,7 +48,7 @@ int os_epoll_triggered(int index, int events) + int os_event_mask(int irq_type) + { + if (irq_type == IRQ_READ) +- return EPOLLIN | EPOLLPRI; ++ return EPOLLIN | EPOLLPRI | EPOLLERR | EPOLLHUP | EPOLLRDHUP; + if (irq_type == IRQ_WRITE) + return EPOLLOUT; + return 0; +-- +2.27.0 + diff --git a/queue-5.4/um-tty-fix-handling-of-close-in-tty-lines.patch b/queue-5.4/um-tty-fix-handling-of-close-in-tty-lines.patch new file mode 100644 index 00000000000..0bfe679b878 --- /dev/null +++ b/queue-5.4/um-tty-fix-handling-of-close-in-tty-lines.patch @@ -0,0 +1,49 @@ +From 2dc4aa5cce4862930d5f7f43fde7509553bebec3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 17:19:39 +0000 +Subject: um: tty: Fix handling of close in tty lines + +From: Anton Ivanov + +[ Upstream commit 9b1c0c0e25dcccafd30e7d4c150c249cc65550eb ] + +Fix a logical error in tty reading. We get 0 and errno == EAGAIN +on the first attempt to read from a closed file descriptor. + +Compared to that a true EAGAIN is EAGAIN and -1. + +If we check errno for EAGAIN first, before checking the return +value we miss the fact that the descriptor is closed. + +This bug is as old as the driver. It was not showing up with +the original POLL based IRQ controller, because it was +producing multiple events. Switching to EPOLL unmasked it. + +Fixes: ff6a17989c08 ("Epoll based IRQ controller") +Signed-off-by: Anton Ivanov +Signed-off-by: Richard Weinberger +Signed-off-by: Sasha Levin +--- + arch/um/drivers/chan_user.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/um/drivers/chan_user.c b/arch/um/drivers/chan_user.c +index 4d80526a4236e..d8845d4aac6a7 100644 +--- a/arch/um/drivers/chan_user.c ++++ b/arch/um/drivers/chan_user.c +@@ -26,10 +26,10 @@ int generic_read(int fd, char *c_out, void *unused) + n = read(fd, c_out, sizeof(*c_out)); + if (n > 0) + return n; +- else if (errno == EAGAIN) +- return 0; + else if (n == 0) + return -EIO; ++ else if (errno == EAGAIN) ++ return 0; + return -errno; + } + +-- +2.27.0 + diff --git a/queue-5.4/usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch b/queue-5.4/usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch new file mode 100644 index 00000000000..6c18ec49886 --- /dev/null +++ b/queue-5.4/usb-ehci-omap-fix-pm-disable-depth-umbalance-in-ehci.patch @@ -0,0 +1,39 @@ +From 902be63d8fa86254678436912872b340956d02d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 22:57:19 +0800 +Subject: usb: ehci-omap: Fix PM disable depth umbalance in ehci_hcd_omap_probe + +From: Zhang Qilong + +[ Upstream commit d6ff32478d7e95d6ca199b5c852710d6964d5811 ] + +The pm_runtime_enable will decrement the power disable depth. Imbalance +depth will resulted in enabling runtime PM of device fails later. Thus +a pairing decrement must be needed on the error handling path to keep it +balanced. + +Fixes: 6c984b066d84b ("ARM: OMAP: USBHOST: Replace usbhs core driver APIs by Runtime pm APIs") +Acked-by: Alan Stern +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201123145719.1455849-1-zhangqilong3@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/ehci-omap.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c +index fc125b3d06e7d..03122dc332eda 100644 +--- a/drivers/usb/host/ehci-omap.c ++++ b/drivers/usb/host/ehci-omap.c +@@ -220,6 +220,7 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev) + + err_pm_runtime: + pm_runtime_put_sync(dev); ++ pm_runtime_disable(dev); + + err_phy: + for (i = 0; i < omap->nports; i++) { +-- +2.27.0 + diff --git a/queue-5.4/usb-max3421-fix-return-error-code-in-max3421_probe.patch b/queue-5.4/usb-max3421-fix-return-error-code-in-max3421_probe.patch new file mode 100644 index 00000000000..22b479a41a3 --- /dev/null +++ b/queue-5.4/usb-max3421-fix-return-error-code-in-max3421_probe.patch @@ -0,0 +1,47 @@ +From a9e4ef7bcea1b104ad389b5a9e0d60950d84b422 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 14:15:00 +0800 +Subject: usb/max3421: fix return error code in max3421_probe() + +From: Yang Yingliang + +[ Upstream commit 5a569343e8a618dc73edebe0957eb42f2ab476bd ] + +retval may be reassigned to 0 after max3421_of_vbus_en_pin(), +if allocate memory failed after this, max3421_probe() cann't +return ENOMEM, fix this by moving assign retval afther max3421_probe(). + +Fixes: 721fdc83b31b ("usb: max3421: Add devicetree support") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20201117061500.3454223-1-yangyingliang@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/max3421-hcd.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c +index 8819f502b6a68..903abdf30b5a0 100644 +--- a/drivers/usb/host/max3421-hcd.c ++++ b/drivers/usb/host/max3421-hcd.c +@@ -1847,7 +1847,7 @@ max3421_probe(struct spi_device *spi) + struct max3421_hcd *max3421_hcd; + struct usb_hcd *hcd = NULL; + struct max3421_hcd_platform_data *pdata = NULL; +- int retval = -ENOMEM; ++ int retval; + + if (spi_setup(spi) < 0) { + dev_err(&spi->dev, "Unable to setup SPI bus"); +@@ -1889,6 +1889,7 @@ max3421_probe(struct spi_device *spi) + goto error; + } + ++ retval = -ENOMEM; + hcd = usb_create_hcd(&max3421_hcd_desc, &spi->dev, + dev_name(&spi->dev)); + if (!hcd) { +-- +2.27.0 + diff --git a/queue-5.4/usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch b/queue-5.4/usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch new file mode 100644 index 00000000000..caea0c96db6 --- /dev/null +++ b/queue-5.4/usb-oxu210hp-hcd-fix-memory-leak-in-oxu_create.patch @@ -0,0 +1,42 @@ +From 8e53c7dbda87ac5e6fc788edd37dec9113a2aa10 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 23 Nov 2020 22:58:09 +0800 +Subject: usb: oxu210hp-hcd: Fix memory leak in oxu_create + +From: Zhang Qilong + +[ Upstream commit e5548b05631ec3e6bfdaef1cad28c799545b791b ] + +usb_create_hcd will alloc memory for hcd, and we should +call usb_put_hcd to free it when adding fails to prevent +memory leak. + +Fixes: b92a78e582b1a ("usb host: Oxford OXU210HP HCD driver") +Reported-by: Hulk Robot +Signed-off-by: Zhang Qilong +Link: https://lore.kernel.org/r/20201123145809.1456541-1-zhangqilong3@huawei.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/host/oxu210hp-hcd.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c +index e67242e437edc..65985247fc00f 100644 +--- a/drivers/usb/host/oxu210hp-hcd.c ++++ b/drivers/usb/host/oxu210hp-hcd.c +@@ -4149,8 +4149,10 @@ static struct usb_hcd *oxu_create(struct platform_device *pdev, + oxu->is_otg = otg; + + ret = usb_add_hcd(hcd, irq, IRQF_SHARED); +- if (ret < 0) ++ if (ret < 0) { ++ usb_put_hcd(hcd); + return ERR_PTR(ret); ++ } + + device_wakeup_enable(hcd->self.controller); + return hcd; +-- +2.27.0 + diff --git a/queue-5.4/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch b/queue-5.4/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch new file mode 100644 index 00000000000..03de790684e --- /dev/null +++ b/queue-5.4/vfio-pci-use-io_remap_pfn_range-for-pci-io-memory.patch @@ -0,0 +1,46 @@ +From ce301f3afd226c16294c5056c51437b70bb47993 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 5 Nov 2020 12:34:58 -0400 +Subject: vfio-pci: Use io_remap_pfn_range() for PCI IO memory + +From: Jason Gunthorpe + +[ Upstream commit 7b06a56d468b756ad6bb43ac21b11e474ebc54a0 ] + +commit f8f6ae5d077a ("mm: always have io_remap_pfn_range() set +pgprot_decrypted()") allows drivers using mmap to put PCI memory mapped +BAR space into userspace to work correctly on AMD SME systems that default +to all memory encrypted. + +Since vfio_pci_mmap_fault() is working with PCI memory mapped BAR space it +should be calling io_remap_pfn_range() otherwise it will not work on SME +systems. + +Fixes: 11c4cd07ba11 ("vfio-pci: Fault mmaps to enable vma tracking") +Signed-off-by: Jason Gunthorpe +Acked-by: Peter Xu +Tested-by: Tom Lendacky +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index 443a35dde7f52..632653cd70e3b 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -1451,8 +1451,8 @@ static vm_fault_t vfio_pci_mmap_fault(struct vm_fault *vmf) + + mutex_unlock(&vdev->vma_lock); + +- if (remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, +- vma->vm_end - vma->vm_start, vma->vm_page_prot)) ++ if (io_remap_pfn_range(vma, vma->vm_start, vma->vm_pgoff, ++ vma->vm_end - vma->vm_start, vma->vm_page_prot)) + ret = VM_FAULT_SIGBUS; + + up_out: +-- +2.27.0 + diff --git a/queue-5.4/video-fbdev-atmel_lcdfb-fix-return-error-code-in-atm.patch b/queue-5.4/video-fbdev-atmel_lcdfb-fix-return-error-code-in-atm.patch new file mode 100644 index 00000000000..19716afc90f --- /dev/null +++ b/queue-5.4/video-fbdev-atmel_lcdfb-fix-return-error-code-in-atm.patch @@ -0,0 +1,40 @@ +From a452d7b9321e98eeaa42cae6b5952bcda5083a8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 17 Nov 2020 14:13:50 +0800 +Subject: video: fbdev: atmel_lcdfb: fix return error code in + atmel_lcdfb_of_init() + +From: Yang Yingliang + +[ Upstream commit ba236455ee750270f33998df57f982433cea4d8e ] + +If devm_kzalloc() failed after the first time, atmel_lcdfb_of_init() +can't return -ENOMEM, fix this by putting the error code in loop. + +Fixes: b985172b328a ("video: atmel_lcdfb: add device tree suport") +Reported-by: Hulk Robot +Signed-off-by: Yang Yingliang +Signed-off-by: Thomas Zimmermann +Link: https://patchwork.freedesktop.org/patch/msgid/20201117061350.3453742-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/video/fbdev/atmel_lcdfb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c +index 5ff8e0320d95b..cf2bfff2efbf1 100644 +--- a/drivers/video/fbdev/atmel_lcdfb.c ++++ b/drivers/video/fbdev/atmel_lcdfb.c +@@ -987,8 +987,8 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo) + } + + INIT_LIST_HEAD(&pdata->pwr_gpios); +- ret = -ENOMEM; + for (i = 0; i < gpiod_count(dev, "atmel,power-control"); i++) { ++ ret = -ENOMEM; + gpiod = devm_gpiod_get_index(dev, "atmel,power-control", + i, GPIOD_ASIS); + if (IS_ERR(gpiod)) +-- +2.27.0 + diff --git a/queue-5.4/virtio_net-fix-error-code-in-probe.patch b/queue-5.4/virtio_net-fix-error-code-in-probe.patch new file mode 100644 index 00000000000..e82e1c975ff --- /dev/null +++ b/queue-5.4/virtio_net-fix-error-code-in-probe.patch @@ -0,0 +1,39 @@ +From d99c607fc5b7ec9a6e37939b82babc9b62ac53fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 17:23:16 +0300 +Subject: virtio_net: Fix error code in probe() + +From: Dan Carpenter + +[ Upstream commit 411ea23a76526e6efed0b601abb603d3c981b333 ] + +Set a negative error code intead of returning success if the MTU has +been changed to something invalid. + +Fixes: fe36cbe0671e ("virtio_net: clear MTU when out of range") +Reported-by: Robert Buhren +Reported-by: Felicitas Hetzelt +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X8pGVJSeeCdII1Ys@mwanda +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/net/virtio_net.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 99e1a7bc06886..7cc8f405be1ad 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -3114,6 +3114,7 @@ static int virtnet_probe(struct virtio_device *vdev) + dev_err(&vdev->dev, + "device MTU appears to have changed it is now %d < %d", + mtu, dev->min_mtu); ++ err = -EINVAL; + goto free; + } + +-- +2.27.0 + diff --git a/queue-5.4/virtio_ring-cut-and-paste-bugs-in-vring_create_virtq.patch b/queue-5.4/virtio_ring-cut-and-paste-bugs-in-vring_create_virtq.patch new file mode 100644 index 00000000000..af3b8d8efdb --- /dev/null +++ b/queue-5.4/virtio_ring-cut-and-paste-bugs-in-vring_create_virtq.patch @@ -0,0 +1,44 @@ +From ba3157377d270fedfe1d7bc295a2ced8dd171f8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 17:23:00 +0300 +Subject: virtio_ring: Cut and paste bugs in vring_create_virtqueue_packed() + +From: Dan Carpenter + +[ Upstream commit ae93d8ea0fa701e84ab9df0db9fb60ec6c80d7b8 ] + +There is a copy and paste bug in the error handling of this code and +it uses "ring_dma_addr" three times instead of "device_event_dma_addr" +and "driver_event_dma_addr". + +Fixes: 1ce9e6055fa0 (" virtio_ring: introduce packed ring support") +Reported-by: Robert Buhren +Reported-by: Felicitas Hetzelt +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X8pGRJlEzyn+04u2@mwanda +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_ring.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index 4f7c73e6052f6..e3e8cab81abdf 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -1676,9 +1676,9 @@ err_desc_extra: + err_desc_state: + kfree(vq); + err_vq: +- vring_free_queue(vdev, event_size_in_bytes, device, ring_dma_addr); ++ vring_free_queue(vdev, event_size_in_bytes, device, device_event_dma_addr); + err_device: +- vring_free_queue(vdev, event_size_in_bytes, driver, ring_dma_addr); ++ vring_free_queue(vdev, event_size_in_bytes, driver, driver_event_dma_addr); + err_driver: + vring_free_queue(vdev, ring_size_in_bytes, ring, ring_dma_addr); + err_ring: +-- +2.27.0 + diff --git a/queue-5.4/virtio_ring-fix-two-use-after-free-bugs.patch b/queue-5.4/virtio_ring-fix-two-use-after-free-bugs.patch new file mode 100644 index 00000000000..4bf94404bfe --- /dev/null +++ b/queue-5.4/virtio_ring-fix-two-use-after-free-bugs.patch @@ -0,0 +1,64 @@ +From d611b49839eb13bfc37c457a4baf3b0e78defc82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Dec 2020 17:23:36 +0300 +Subject: virtio_ring: Fix two use after free bugs + +From: Dan Carpenter + +[ Upstream commit e152d8af4220a05c9797591609151d404866beaa ] + +The "vq" struct is added to the "vdev->vqs" list prematurely. If we +encounter an error later in the function then the "vq" is freed, but +since it is still on the list that could lead to a use after free bug. + +Fixes: cbeedb72b97a ("virtio_ring: allocate desc state for split ring separately") +Reported-by: Robert Buhren +Reported-by: Felicitas Hetzelt +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/X8pGaG/zkI3jk8mk@mwanda +Signed-off-by: Michael S. Tsirkin +Acked-by: Jason Wang +Signed-off-by: Sasha Levin +--- + drivers/virtio/virtio_ring.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index e3e8cab81abdf..97e8a195e18f5 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -1608,7 +1608,6 @@ static struct virtqueue *vring_create_virtqueue_packed( + vq->num_added = 0; + vq->packed_ring = true; + vq->use_dma_api = vring_use_dma_api(vdev); +- list_add_tail(&vq->vq.list, &vdev->vqs); + #ifdef DEBUG + vq->in_use = false; + vq->last_add_time_valid = false; +@@ -1669,6 +1668,7 @@ static struct virtqueue *vring_create_virtqueue_packed( + cpu_to_le16(vq->packed.event_flags_shadow); + } + ++ list_add_tail(&vq->vq.list, &vdev->vqs); + return &vq->vq; + + err_desc_extra: +@@ -2085,7 +2085,6 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index, + vq->last_used_idx = 0; + vq->num_added = 0; + vq->use_dma_api = vring_use_dma_api(vdev); +- list_add_tail(&vq->vq.list, &vdev->vqs); + #ifdef DEBUG + vq->in_use = false; + vq->last_add_time_valid = false; +@@ -2127,6 +2126,7 @@ struct virtqueue *__vring_new_virtqueue(unsigned int index, + memset(vq->split.desc_state, 0, vring.num * + sizeof(struct vring_desc_state_split)); + ++ list_add_tail(&vq->vq.list, &vdev->vqs); + return &vq->vq; + } + EXPORT_SYMBOL_GPL(__vring_new_virtqueue); +-- +2.27.0 + diff --git a/queue-5.4/watchdog-armada_37xx-add-missing-dependency-on-has_i.patch b/queue-5.4/watchdog-armada_37xx-add-missing-dependency-on-has_i.patch new file mode 100644 index 00000000000..eb4bdce963f --- /dev/null +++ b/queue-5.4/watchdog-armada_37xx-add-missing-dependency-on-has_i.patch @@ -0,0 +1,48 @@ +From bfde000f1287bffd76e4558d6e93a83963ac4bde Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 08:25:49 -0800 +Subject: watchdog: armada_37xx: Add missing dependency on HAS_IOMEM + +From: Guenter Roeck + +[ Upstream commit 7f6f1dfb2dcbe5d2bfa213f2df5d74c147cd5954 ] + +The following kbuild warning is seen on a system without HAS_IOMEM. + +WARNING: unmet direct dependencies detected for MFD_SYSCON + Depends on [n]: HAS_IOMEM [=n] + Selected by [y]: + - ARMADA_37XX_WATCHDOG [=y] && WATCHDOG [=y] && (ARCH_MVEBU || COMPILE_TEST + +This results in a subsequent compile error. + +drivers/watchdog/armada_37xx_wdt.o: in function `armada_37xx_wdt_probe': +armada_37xx_wdt.c:(.text+0xdc): undefined reference to `devm_ioremap' + +Add the missing dependency. + +Reported-by: Necip Fazil Yildiran +Fixes: 54e3d9b518c8 ("watchdog: Add support for Armada 37xx CPU watchdog") +Link: https://lore.kernel.org/r/20201108162550.27660-1-linux@roeck-us.net +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig +index e2745f6861960..fce2f5e3ac51d 100644 +--- a/drivers/watchdog/Kconfig ++++ b/drivers/watchdog/Kconfig +@@ -374,6 +374,7 @@ config ARM_SBSA_WATCHDOG + config ARMADA_37XX_WATCHDOG + tristate "Armada 37xx watchdog" + depends on ARCH_MVEBU || COMPILE_TEST ++ depends on HAS_IOMEM + select MFD_SYSCON + select WATCHDOG_CORE + help +-- +2.27.0 + diff --git a/queue-5.4/watchdog-coh901327-add-common_clk-dependency.patch b/queue-5.4/watchdog-coh901327-add-common_clk-dependency.patch new file mode 100644 index 00000000000..1eb51e7fb77 --- /dev/null +++ b/queue-5.4/watchdog-coh901327-add-common_clk-dependency.patch @@ -0,0 +1,45 @@ +From 4c6301547dcb4a653488c083efdea22198404917 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Dec 2020 23:33:42 +0100 +Subject: watchdog: coh901327: add COMMON_CLK dependency + +From: Arnd Bergmann + +[ Upstream commit 36c47df85ee8e1f8a35366ac11324f8875de00eb ] + +clang produces a build failure in configurations without COMMON_CLK +when a timeout calculation goes wrong: + +arm-linux-gnueabi-ld: drivers/watchdog/coh901327_wdt.o: in function `coh901327_enable': +coh901327_wdt.c:(.text+0x50): undefined reference to `__bad_udelay' + +Add a Kconfig dependency to only do build testing when COMMON_CLK +is enabled. + +Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible") +Signed-off-by: Arnd Bergmann +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20201203223358.1269372-1-arnd@kernel.org +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig +index 6cdffbdaf98a5..1aa42e879e633 100644 +--- a/drivers/watchdog/Kconfig ++++ b/drivers/watchdog/Kconfig +@@ -618,7 +618,7 @@ config SUNXI_WATCHDOG + + config COH901327_WATCHDOG + bool "ST-Ericsson COH 901 327 watchdog" +- depends on ARCH_U300 || (ARM && COMPILE_TEST) ++ depends on ARCH_U300 || (ARM && COMMON_CLK && COMPILE_TEST) + default y if MACH_U300 + select WATCHDOG_CORE + help +-- +2.27.0 + diff --git a/queue-5.4/watchdog-fix-potential-dereferencing-of-null-pointer.patch b/queue-5.4/watchdog-fix-potential-dereferencing-of-null-pointer.patch new file mode 100644 index 00000000000..d8b780acfa6 --- /dev/null +++ b/queue-5.4/watchdog-fix-potential-dereferencing-of-null-pointer.patch @@ -0,0 +1,71 @@ +From bfa1cd74b2496fa6e92c895417410766c3908a78 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 13:05:12 +0000 +Subject: watchdog: Fix potential dereferencing of null pointer + +From: Wang Wensheng + +[ Upstream commit 6f733cb2e7db38f8141b14740bcde577844a03b7 ] + +A reboot notifier, which stops the WDT by calling the stop hook without +any check, would be registered when we set WDOG_STOP_ON_REBOOT flag. + +Howerer we allow the WDT driver to omit the stop hook since commit +"d0684c8a93549" ("watchdog: Make stop function optional") and provide +a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag +in commit 9232c80659e94 ("watchdog: Add stop_on_reboot parameter to +control reboot policy"). Together that commits make user potential to +insert a watchdog driver that don't provide a stop hook but with the +stop_on_reboot parameter set, then dereferencing of null pointer occurs +on system reboot. + +Check the stop hook before registering the reboot notifier to fix the +issue. + +Fixes: d0684c8a9354 ("watchdog: Make stop function optional") +Signed-off-by: Wang Wensheng +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20201109130512.28121-1-wangwensheng4@huawei.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/watchdog_core.c | 22 +++++++++++++--------- + 1 file changed, 13 insertions(+), 9 deletions(-) + +diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c +index 861daf4f37b28..faa46a666f4c5 100644 +--- a/drivers/watchdog/watchdog_core.c ++++ b/drivers/watchdog/watchdog_core.c +@@ -255,15 +255,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd) + } + + if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) { +- wdd->reboot_nb.notifier_call = watchdog_reboot_notifier; +- +- ret = register_reboot_notifier(&wdd->reboot_nb); +- if (ret) { +- pr_err("watchdog%d: Cannot register reboot notifier (%d)\n", +- wdd->id, ret); +- watchdog_dev_unregister(wdd); +- ida_simple_remove(&watchdog_ida, id); +- return ret; ++ if (!wdd->ops->stop) ++ pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id); ++ else { ++ wdd->reboot_nb.notifier_call = watchdog_reboot_notifier; ++ ++ ret = register_reboot_notifier(&wdd->reboot_nb); ++ if (ret) { ++ pr_err("watchdog%d: Cannot register reboot notifier (%d)\n", ++ wdd->id, ret); ++ watchdog_dev_unregister(wdd); ++ ida_simple_remove(&watchdog_ida, id); ++ return ret; ++ } + } + } + +-- +2.27.0 + diff --git a/queue-5.4/watchdog-qcom-avoid-context-switch-in-restart-handle.patch b/queue-5.4/watchdog-qcom-avoid-context-switch-in-restart-handle.patch new file mode 100644 index 00000000000..fa26b22b632 --- /dev/null +++ b/queue-5.4/watchdog-qcom-avoid-context-switch-in-restart-handle.patch @@ -0,0 +1,69 @@ +From c7e95b7db1fc45ab52faf02e79de78a310327a8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Dec 2020 11:30:05 +0530 +Subject: watchdog: qcom: Avoid context switch in restart handler + +From: Manivannan Sadhasivam + +[ Upstream commit 7948fab26bcc468aa2a76462f441291b5fb0d5c7 ] + +The use of msleep() in the restart handler will cause scheduler to +induce a context switch which is not desirable. This generates below +warning on SDX55 when WDT is the only available restart source: + +[ 39.800188] reboot: Restarting system +[ 39.804115] ------------[ cut here ]------------ +[ 39.807855] WARNING: CPU: 0 PID: 678 at kernel/rcu/tree_plugin.h:297 rcu_note_context_switch+0x190/0x764 +[ 39.812538] Modules linked in: +[ 39.821954] CPU: 0 PID: 678 Comm: reboot Not tainted 5.10.0-rc1-00063-g33a9990d1d66-dirty #47 +[ 39.824854] Hardware name: Generic DT based system +[ 39.833470] [] (unwind_backtrace) from [] (show_stack+0x10/0x14) +[ 39.838154] [] (show_stack) from [] (dump_stack+0x8c/0xa0) +[ 39.846049] [] (dump_stack) from [] (__warn+0xd8/0xf0) +[ 39.853058] [] (__warn) from [] (warn_slowpath_fmt+0x64/0xc8) +[ 39.859925] [] (warn_slowpath_fmt) from [] (rcu_note_context_switch+0x190/0x764) +[ 39.867503] [] (rcu_note_context_switch) from [] (__schedule+0x84/0x640) +[ 39.876685] [] (__schedule) from [] (schedule+0x58/0x10c) +[ 39.885095] [] (schedule) from [] (schedule_timeout+0x1e8/0x3d4) +[ 39.892135] [] (schedule_timeout) from [] (msleep+0x2c/0x38) +[ 39.899947] [] (msleep) from [] (qcom_wdt_restart+0xc4/0xcc) +[ 39.907319] [] (qcom_wdt_restart) from [] (watchdog_restart_notifier+0x18/0x28) +[ 39.914715] [] (watchdog_restart_notifier) from [] (atomic_notifier_call_chain+0x60/0x84) +[ 39.923487] [] (atomic_notifier_call_chain) from [] (machine_restart+0x78/0x7c) +[ 39.933551] [] (machine_restart) from [] (__do_sys_reboot+0xdc/0x1e0) +[ 39.942397] [] (__do_sys_reboot) from [] (ret_fast_syscall+0x0/0x54) +[ 39.950721] Exception stack(0xc3e0bfa8 to 0xc3e0bff0) +[ 39.958855] bfa0: 0001221c bed2fe24 fee1dead 28121969 01234567 00000000 +[ 39.963832] bfc0: 0001221c bed2fe24 00000003 00000058 000225e0 00000000 00000000 00000000 +[ 39.971985] bfe0: b6e62560 bed2fc84 00010fd8 b6e62580 +[ 39.980124] ---[ end trace 3f578288bad866e4 ]--- + +Hence, replace msleep() with mdelay() to fix this issue. + +Fixes: 05e487d905ab ("watchdog: qcom: register a restart notifier") +Signed-off-by: Manivannan Sadhasivam +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20201207060005.21293-1-manivannan.sadhasivam@linaro.org +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/qcom-wdt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c +index eb47fe5ed2805..ea8a6abd64ecb 100644 +--- a/drivers/watchdog/qcom-wdt.c ++++ b/drivers/watchdog/qcom-wdt.c +@@ -143,7 +143,7 @@ static int qcom_wdt_restart(struct watchdog_device *wdd, unsigned long action, + */ + wmb(); + +- msleep(150); ++ mdelay(150); + return 0; + } + +-- +2.27.0 + diff --git a/queue-5.4/watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch b/queue-5.4/watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch new file mode 100644 index 00000000000..bf4fa393a80 --- /dev/null +++ b/queue-5.4/watchdog-sirfsoc-add-missing-dependency-on-has_iomem.patch @@ -0,0 +1,41 @@ +From e98942355df43f6c05a95c349ad63872f699dbfa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 8 Nov 2020 08:25:50 -0800 +Subject: watchdog: sirfsoc: Add missing dependency on HAS_IOMEM + +From: Guenter Roeck + +[ Upstream commit 8ae2511112d2e18bc7d324b77f965d34083a25a2 ] + +If HAS_IOMEM is not defined and SIRFSOC_WATCHDOG is enabled, +the build fails with the following error. + +drivers/watchdog/sirfsoc_wdt.o: in function `sirfsoc_wdt_probe': +sirfsoc_wdt.c:(.text+0x112): + undefined reference to `devm_platform_ioremap_resource' + +Reported-by: Necip Fazil Yildiran +Fixes: da2a68b3eb47 ("watchdog: Enable COMPILE_TEST where possible") +Link: https://lore.kernel.org/r/20201108162550.27660-2-linux@roeck-us.net +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/watchdog/Kconfig b/drivers/watchdog/Kconfig +index fce2f5e3ac51d..6cdffbdaf98a5 100644 +--- a/drivers/watchdog/Kconfig ++++ b/drivers/watchdog/Kconfig +@@ -775,6 +775,7 @@ config MOXART_WDT + + config SIRFSOC_WATCHDOG + tristate "SiRFSOC watchdog" ++ depends on HAS_IOMEM + depends on ARCH_SIRF || COMPILE_TEST + select WATCHDOG_CORE + default y +-- +2.27.0 + diff --git a/queue-5.4/watchdog-sprd-check-busy-bit-before-new-loading-rath.patch b/queue-5.4/watchdog-sprd-check-busy-bit-before-new-loading-rath.patch new file mode 100644 index 00000000000..8367833aa10 --- /dev/null +++ b/queue-5.4/watchdog-sprd-check-busy-bit-before-new-loading-rath.patch @@ -0,0 +1,74 @@ +From 702d6755b7a06f6c17845420ded41e078a83803a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 9 Nov 2020 11:00:54 +0800 +Subject: watchdog: sprd: check busy bit before new loading rather than after + that + +From: Lingling Xu + +[ Upstream commit 3e07d240939803bed9feb2a353d94686a411a7ca ] + +As the specification described, users must check busy bit before start +a new loading operation to make sure that the previous loading is done +and the device is ready to accept a new one. + +[ chunyan: Massaged changelog ] + +Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver") +Signed-off-by: Lingling Xu +Signed-off-by: Chunyan Zhang +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20201029023933.24548-3-zhang.lyra@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/sprd_wdt.c | 25 +++++++++++++------------ + 1 file changed, 13 insertions(+), 12 deletions(-) + +diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c +index f3c90b4afead1..b9b1daa9e2a4c 100644 +--- a/drivers/watchdog/sprd_wdt.c ++++ b/drivers/watchdog/sprd_wdt.c +@@ -108,18 +108,6 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout, + u32 tmr_step = timeout * SPRD_WDT_CNT_STEP; + u32 prtmr_step = pretimeout * SPRD_WDT_CNT_STEP; + +- sprd_wdt_unlock(wdt->base); +- writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) & +- SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH); +- writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK), +- wdt->base + SPRD_WDT_LOAD_LOW); +- writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) & +- SPRD_WDT_LOW_VALUE_MASK, +- wdt->base + SPRD_WDT_IRQ_LOAD_HIGH); +- writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK, +- wdt->base + SPRD_WDT_IRQ_LOAD_LOW); +- sprd_wdt_lock(wdt->base); +- + /* + * Waiting the load value operation done, + * it needs two or three RTC clock cycles. +@@ -134,6 +122,19 @@ static int sprd_wdt_load_value(struct sprd_wdt *wdt, u32 timeout, + + if (delay_cnt >= SPRD_WDT_LOAD_TIMEOUT) + return -EBUSY; ++ ++ sprd_wdt_unlock(wdt->base); ++ writel_relaxed((tmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) & ++ SPRD_WDT_LOW_VALUE_MASK, wdt->base + SPRD_WDT_LOAD_HIGH); ++ writel_relaxed((tmr_step & SPRD_WDT_LOW_VALUE_MASK), ++ wdt->base + SPRD_WDT_LOAD_LOW); ++ writel_relaxed((prtmr_step >> SPRD_WDT_CNT_HIGH_SHIFT) & ++ SPRD_WDT_LOW_VALUE_MASK, ++ wdt->base + SPRD_WDT_IRQ_LOAD_HIGH); ++ writel_relaxed(prtmr_step & SPRD_WDT_LOW_VALUE_MASK, ++ wdt->base + SPRD_WDT_IRQ_LOAD_LOW); ++ sprd_wdt_lock(wdt->base); ++ + return 0; + } + +-- +2.27.0 + diff --git a/queue-5.4/watchdog-sprd-remove-watchdog-disable-from-resume-fa.patch b/queue-5.4/watchdog-sprd-remove-watchdog-disable-from-resume-fa.patch new file mode 100644 index 00000000000..a65f287d5ac --- /dev/null +++ b/queue-5.4/watchdog-sprd-remove-watchdog-disable-from-resume-fa.patch @@ -0,0 +1,54 @@ +From b25530512351467a982a8d0395fc3c63b6f418ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 10:39:31 +0800 +Subject: watchdog: sprd: remove watchdog disable from resume fail path + +From: Lingling Xu + +[ Upstream commit f61a59acb462840bebcc192f754fe71b6a16ff99 ] + +sprd_wdt_start() would return fail if the loading operation is not completed +in a certain time, disabling watchdog for that case would probably cause +the kernel crash when kick watchdog later, that's too bad, so remove the +watchdog disable operation for the fail case to make sure other parts in +the kernel can run normally. + +[ chunyan: Massaged changelog ] + +Fixes: 477603467009 ("watchdog: Add Spreadtrum watchdog driver") +Signed-off-by: Lingling Xu +Signed-off-by: Chunyan Zhang +Reviewed-by: Guenter Roeck +Link: https://lore.kernel.org/r/20201029023933.24548-2-zhang.lyra@gmail.com +Signed-off-by: Guenter Roeck +Signed-off-by: Wim Van Sebroeck +Signed-off-by: Sasha Levin +--- + drivers/watchdog/sprd_wdt.c | 9 ++------- + 1 file changed, 2 insertions(+), 7 deletions(-) + +diff --git a/drivers/watchdog/sprd_wdt.c b/drivers/watchdog/sprd_wdt.c +index 65cb55f3916fc..f3c90b4afead1 100644 +--- a/drivers/watchdog/sprd_wdt.c ++++ b/drivers/watchdog/sprd_wdt.c +@@ -345,15 +345,10 @@ static int __maybe_unused sprd_wdt_pm_resume(struct device *dev) + if (ret) + return ret; + +- if (watchdog_active(&wdt->wdd)) { ++ if (watchdog_active(&wdt->wdd)) + ret = sprd_wdt_start(&wdt->wdd); +- if (ret) { +- sprd_wdt_disable(wdt); +- return ret; +- } +- } + +- return 0; ++ return ret; + } + + static const struct dev_pm_ops sprd_wdt_pm_ops = { +-- +2.27.0 + diff --git a/queue-5.4/x86-apic-fix-x2apic-enablement-without-interrupt-rem.patch b/queue-5.4/x86-apic-fix-x2apic-enablement-without-interrupt-rem.patch new file mode 100644 index 00000000000..ba200497cec --- /dev/null +++ b/queue-5.4/x86-apic-fix-x2apic-enablement-without-interrupt-rem.patch @@ -0,0 +1,105 @@ +From db7dbb2ba633b0c465a91a7f4230c81021bd8e1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Oct 2020 22:35:01 +0100 +Subject: x86/apic: Fix x2apic enablement without interrupt remapping + +From: David Woodhouse + +[ Upstream commit 26573a97746c7a99f394f9d398ce91a8853b3b89 ] + +Currently, Linux as a hypervisor guest will enable x2apic only if there are +no CPUs present at boot time with an APIC ID above 255. + +Hotplugging a CPU later with a higher APIC ID would result in a CPU which +cannot be targeted by external interrupts. + +Add a filter in x2apic_apic_id_valid() which can be used to prevent such +CPUs from coming online, and allow x2apic to be enabled even if they are +present at boot time. + +Fixes: ce69a784504 ("x86/apic: Enable x2APIC without interrupt remapping under KVM") +Signed-off-by: David Woodhouse +Signed-off-by: Thomas Gleixner +Link: https://lore.kernel.org/r/20201024213535.443185-2-dwmw2@infradead.org +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/apic.h | 1 + + arch/x86/kernel/apic/apic.c | 14 ++++++++------ + arch/x86/kernel/apic/x2apic_phys.c | 9 +++++++++ + 3 files changed, 18 insertions(+), 6 deletions(-) + +diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h +index 19e94af9cc5d7..6016559ed1713 100644 +--- a/arch/x86/include/asm/apic.h ++++ b/arch/x86/include/asm/apic.h +@@ -259,6 +259,7 @@ static inline u64 native_x2apic_icr_read(void) + + extern int x2apic_mode; + extern int x2apic_phys; ++extern void __init x2apic_set_max_apicid(u32 apicid); + extern void __init check_x2apic(void); + extern void x2apic_setup(void); + static inline int x2apic_enabled(void) +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index fce94c799f015..06fa808d72032 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1886,20 +1886,22 @@ static __init void try_to_enable_x2apic(int remap_mode) + return; + + if (remap_mode != IRQ_REMAP_X2APIC_MODE) { +- /* IR is required if there is APIC ID > 255 even when running +- * under KVM ++ /* ++ * Using X2APIC without IR is not architecturally supported ++ * on bare metal but may be supported in guests. + */ +- if (max_physical_apicid > 255 || +- !x86_init.hyper.x2apic_available()) { ++ if (!x86_init.hyper.x2apic_available()) { + pr_info("x2apic: IRQ remapping doesn't support X2APIC mode\n"); + x2apic_disable(); + return; + } + + /* +- * without IR all CPUs can be addressed by IOAPIC/MSI +- * only in physical mode ++ * Without IR, all CPUs can be addressed by IOAPIC/MSI only ++ * in physical mode, and CPUs with an APIC ID that cannnot ++ * be addressed must not be brought online. + */ ++ x2apic_set_max_apicid(255); + x2apic_phys = 1; + } + x2apic_enable(); +diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c +index bc9693841353c..e14eae6d6ea71 100644 +--- a/arch/x86/kernel/apic/x2apic_phys.c ++++ b/arch/x86/kernel/apic/x2apic_phys.c +@@ -8,6 +8,12 @@ + int x2apic_phys; + + static struct apic apic_x2apic_phys; ++static u32 x2apic_max_apicid __ro_after_init; ++ ++void __init x2apic_set_max_apicid(u32 apicid) ++{ ++ x2apic_max_apicid = apicid; ++} + + static int __init set_x2apic_phys_mode(char *arg) + { +@@ -98,6 +104,9 @@ static int x2apic_phys_probe(void) + /* Common x2apic functions, also used by x2apic_cluster */ + int x2apic_apic_id_valid(u32 apicid) + { ++ if (x2apic_max_apicid && apicid > x2apic_max_apicid) ++ return 0; ++ + return 1; + } + +-- +2.27.0 + diff --git a/queue-5.4/x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch b/queue-5.4/x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch new file mode 100644 index 00000000000..a02bd85d30d --- /dev/null +++ b/queue-5.4/x86-kprobes-restore-btf-if-the-single-stepping-is-ca.patch @@ -0,0 +1,46 @@ +From a494c40010bf8df33f17a42262ce9f2ae388fcb9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 23:31:10 +0900 +Subject: x86/kprobes: Restore BTF if the single-stepping is cancelled + +From: Masami Hiramatsu + +[ Upstream commit 78ff2733ff352175eb7f4418a34654346e1b6cd2 ] + +Fix to restore BTF if single-stepping causes a page fault and +it is cancelled. + +Usually the BTF flag was restored when the single stepping is done +(in resume_execution()). However, if a page fault happens on the +single stepping instruction, the fault handler is invoked and +the single stepping is cancelled. Thus, the BTF flag is not +restored. + +Fixes: 1ecc798c6764 ("x86: debugctlmsr kprobes") +Signed-off-by: Masami Hiramatsu +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/160389546985.106936.12727996109376240993.stgit@devnote2 +Signed-off-by: Sasha Levin +--- + arch/x86/kernel/kprobes/core.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index 62c39baea39e3..5294018535d0c 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -1019,6 +1019,11 @@ int kprobe_fault_handler(struct pt_regs *regs, int trapnr) + * So clear it by resetting the current kprobe: + */ + regs->flags &= ~X86_EFLAGS_TF; ++ /* ++ * Since the single step (trap) has been cancelled, ++ * we need to restore BTF here. ++ */ ++ restore_btf(); + + /* + * If the TF flag was set before the kprobe hit, +-- +2.27.0 + diff --git a/queue-5.4/x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch b/queue-5.4/x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch new file mode 100644 index 00000000000..ec630d0b055 --- /dev/null +++ b/queue-5.4/x86-mm-ident_map-check-for-errors-from-ident_pud_ini.patch @@ -0,0 +1,73 @@ +From c26524fe0b3aeec35321b294212e6798de2bff26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 19:06:48 -0400 +Subject: x86/mm/ident_map: Check for errors from ident_pud_init() + +From: Arvind Sankar + +[ Upstream commit 1fcd009102ee02e217f2e7635ab65517d785da8e ] + +Commit + + ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support") + +added ident_p4d_init() to support 5-level paging, but this function +doesn't check and return errors from ident_pud_init(). + +For example, the decompressor stub uses this code to create an identity +mapping. If it runs out of pages while trying to allocate a PMD +pagetable, the error will be currently ignored. + +Fix this to propagate errors. + + [ bp: Space out statements for better readability. ] + +Fixes: ea3b5e60ce80 ("x86/mm/ident_map: Add 5-level paging support") +Signed-off-by: Arvind Sankar +Signed-off-by: Borislav Petkov +Reviewed-by: Joerg Roedel +Acked-by: Kirill A. Shutemov +Link: https://lkml.kernel.org/r/20201027230648.1885111-1-nivedita@alum.mit.edu +Signed-off-by: Sasha Levin +--- + arch/x86/mm/ident_map.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/arch/x86/mm/ident_map.c b/arch/x86/mm/ident_map.c +index fe7a12599d8eb..968d7005f4a72 100644 +--- a/arch/x86/mm/ident_map.c ++++ b/arch/x86/mm/ident_map.c +@@ -62,6 +62,7 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page, + unsigned long addr, unsigned long end) + { + unsigned long next; ++ int result; + + for (; addr < end; addr = next) { + p4d_t *p4d = p4d_page + p4d_index(addr); +@@ -73,13 +74,20 @@ static int ident_p4d_init(struct x86_mapping_info *info, p4d_t *p4d_page, + + if (p4d_present(*p4d)) { + pud = pud_offset(p4d, 0); +- ident_pud_init(info, pud, addr, next); ++ result = ident_pud_init(info, pud, addr, next); ++ if (result) ++ return result; ++ + continue; + } + pud = (pud_t *)info->alloc_pgt_page(info->context); + if (!pud) + return -ENOMEM; +- ident_pud_init(info, pud, addr, next); ++ ++ result = ident_pud_init(info, pud, addr, next); ++ if (result) ++ return result; ++ + set_p4d(p4d, __p4d(__pa(pud) | info->kernpg_flag)); + } + +-- +2.27.0 +