From: Sasha Levin Date: Sat, 2 Apr 2022 12:59:30 +0000 (-0400) Subject: Fixes for 5.10 X-Git-Tag: v5.17.2~173^2~4 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=2bb40bf4a121159da79469440482f957e1e16767;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.10 Signed-off-by: Sasha Levin --- diff --git a/queue-5.10/acpi-apei-fix-return-value-of-__setup-handlers.patch b/queue-5.10/acpi-apei-fix-return-value-of-__setup-handlers.patch new file mode 100644 index 00000000000..ec4c663a11b --- /dev/null +++ b/queue-5.10/acpi-apei-fix-return-value-of-__setup-handlers.patch @@ -0,0 +1,86 @@ +From 2ba1acb3db9eedfd89151e7913a66336b79ffa54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Mar 2022 18:46:20 -0800 +Subject: ACPI: APEI: fix return value of __setup handlers + +From: Randy Dunlap + +[ Upstream commit f3303ff649dbf7dcdc6a6e1a922235b12b3028f4 ] + +__setup() handlers should return 1 to indicate that the boot option +has been handled. Returning 0 causes a boot option to be listed in +the Unknown kernel command line parameters and also added to init's +arg list (if no '=' sign) or environment list (if of the form 'a=b'). + +Unknown kernel command line parameters "erst_disable + bert_disable hest_disable BOOT_IMAGE=/boot/bzImage-517rc6", will be + passed to user space. + + Run /sbin/init as init process + with arguments: + /sbin/init + erst_disable + bert_disable + hest_disable + with environment: + HOME=/ + TERM=linux + BOOT_IMAGE=/boot/bzImage-517rc6 + +Fixes: a3e2acc5e37b ("ACPI / APEI: Add Boot Error Record Table (BERT) support") +Fixes: a08f82d08053 ("ACPI, APEI, Error Record Serialization Table (ERST) support") +Fixes: 9dc966641677 ("ACPI, APEI, HEST table parsing") +Signed-off-by: Randy Dunlap +Reported-by: Igor Zhbanov +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Reviewed-by: "Huang, Ying" +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/bert.c | 2 +- + drivers/acpi/apei/erst.c | 2 +- + drivers/acpi/apei/hest.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c +index 19e50fcbf4d6..86211422f4ee 100644 +--- a/drivers/acpi/apei/bert.c ++++ b/drivers/acpi/apei/bert.c +@@ -77,7 +77,7 @@ static int __init setup_bert_disable(char *str) + { + bert_disable = 1; + +- return 0; ++ return 1; + } + __setup("bert_disable", setup_bert_disable); + +diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c +index 2e0b0fcad960..83efb52a3f31 100644 +--- a/drivers/acpi/apei/erst.c ++++ b/drivers/acpi/apei/erst.c +@@ -891,7 +891,7 @@ EXPORT_SYMBOL_GPL(erst_clear); + static int __init setup_erst_disable(char *str) + { + erst_disable = 1; +- return 0; ++ return 1; + } + + __setup("erst_disable", setup_erst_disable); +diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c +index 6e980fe16772..7bf48c2776fb 100644 +--- a/drivers/acpi/apei/hest.c ++++ b/drivers/acpi/apei/hest.c +@@ -219,7 +219,7 @@ static int __init hest_ghes_dev_register(unsigned int ghes_count) + static int __init setup_hest_disable(char *str) + { + hest_disable = HEST_DISABLED; +- return 0; ++ return 1; + } + + __setup("hest_disable", setup_hest_disable); +-- +2.34.1 + diff --git a/queue-5.10/acpi-apei-limit-printable-size-of-bert-table-data.patch b/queue-5.10/acpi-apei-limit-printable-size-of-bert-table-data.patch new file mode 100644 index 00000000000..f54dff86eae --- /dev/null +++ b/queue-5.10/acpi-apei-limit-printable-size-of-bert-table-data.patch @@ -0,0 +1,72 @@ +From 7a8507c974a2ff4b4af7b045c7fe2f60759a3eca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 10:50:48 -0800 +Subject: ACPI/APEI: Limit printable size of BERT table data + +From: Darren Hart + +[ Upstream commit 3f8dec116210ca649163574ed5f8df1e3b837d07 ] + +Platforms with large BERT table data can trigger soft lockup errors +while attempting to print the entire BERT table data to the console at +boot: + + watchdog: BUG: soft lockup - CPU#160 stuck for 23s! [swapper/0:1] + +Observed on Ampere Altra systems with a single BERT record of ~250KB. + +The original bert driver appears to have assumed relatively small table +data. Since it is impractical to reassemble large table data from +interwoven console messages, and the table data is available in + + /sys/firmware/acpi/tables/data/BERT + +limit the size for tables printed to the console to 1024 (for no reason +other than it seemed like a good place to kick off the discussion, would +appreciate feedback from existing users in terms of what size would +maintain their current usage model). + +Alternatively, we could make printing a CONFIG option, use the +bert_disable boot arg (or something similar), or use a debug log level. +However, all those solutions require extra steps or change the existing +behavior for small table data. Limiting the size preserves existing +behavior on existing platforms with small table data, and eliminates the +soft lockups for platforms with large table data, while still making it +available. + +Signed-off-by: Darren Hart +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/apei/bert.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c +index 86211422f4ee..598fd19b65fa 100644 +--- a/drivers/acpi/apei/bert.c ++++ b/drivers/acpi/apei/bert.c +@@ -29,6 +29,7 @@ + + #undef pr_fmt + #define pr_fmt(fmt) "BERT: " fmt ++#define ACPI_BERT_PRINT_MAX_LEN 1024 + + static int bert_disable; + +@@ -58,8 +59,11 @@ static void __init bert_print_all(struct acpi_bert_region *region, + } + + pr_info_once("Error records from previous boot:\n"); +- +- cper_estatus_print(KERN_INFO HW_ERR, estatus); ++ if (region_len < ACPI_BERT_PRINT_MAX_LEN) ++ cper_estatus_print(KERN_INFO HW_ERR, estatus); ++ else ++ pr_info_once("Max print length exceeded, table data is available at:\n" ++ "/sys/firmware/acpi/tables/data/BERT"); + + /* + * Because the boot error source is "one-time polled" type, +-- +2.34.1 + diff --git a/queue-5.10/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch b/queue-5.10/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch new file mode 100644 index 00000000000..f019137ee3e --- /dev/null +++ b/queue-5.10/acpica-avoid-walking-the-acpi-namespace-if-it-is-not.patch @@ -0,0 +1,44 @@ +From 9936358575d595f6034668b58b2587fcf379622c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 20:28:26 +0100 +Subject: ACPICA: Avoid walking the ACPI Namespace if it is not there + +From: Rafael J. Wysocki + +[ Upstream commit 0c9992315e738e7d6e927ef36839a466b080dba6 ] + +ACPICA commit b1c3656ef4950098e530be68d4b589584f06cddc + +Prevent acpi_ns_walk_namespace() from crashing when called with +start_node equal to ACPI_ROOT_OBJECT if the Namespace has not been +instantiated yet and acpi_gbl_root_node is NULL. + +For instance, this can happen if the kernel is run with "acpi=off" +in the command line. + +Link: https://github.com/acpica/acpica/commit/b1c3656ef4950098e530be68d4b589584f06cddc +Link: https://lore.kernel.org/linux-acpi/CAJZ5v0hJWW_vZ3wwajE7xT38aWjY7cZyvqMJpXHzUL98-SiCVQ@mail.gmail.com/ +Reported-by: Hans de Goede +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpica/nswalk.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c +index b7f3e8603ad8..901fa5ca284d 100644 +--- a/drivers/acpi/acpica/nswalk.c ++++ b/drivers/acpi/acpica/nswalk.c +@@ -169,6 +169,9 @@ acpi_ns_walk_namespace(acpi_object_type type, + + if (start_node == ACPI_ROOT_OBJECT) { + start_node = acpi_gbl_root_node; ++ if (!start_node) { ++ return_ACPI_STATUS(AE_NO_NAMESPACE); ++ } + } + + /* Null child means "get first node" */ +-- +2.34.1 + diff --git a/queue-5.10/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch b/queue-5.10/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch new file mode 100644 index 00000000000..f6480f02602 --- /dev/null +++ b/queue-5.10/af_netlink-fix-shift-out-of-bounds-in-group-mask-cal.patch @@ -0,0 +1,62 @@ +From 8329ce7eefa3f3ed5627aed0d30b660627780587 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 15:53:06 +0100 +Subject: af_netlink: Fix shift out of bounds in group mask calculation + +From: Petr Machata + +[ Upstream commit 0caf6d9922192dd1afa8dc2131abfb4df1443b9f ] + +When a netlink message is received, netlink_recvmsg() fills in the address +of the sender. One of the fields is the 32-bit bitfield nl_groups, which +carries the multicast group on which the message was received. The least +significant bit corresponds to group 1, and therefore the highest group +that the field can represent is 32. Above that, the UB sanitizer flags the +out-of-bounds shift attempts. + +Which bits end up being set in such case is implementation defined, but +it's either going to be a wrong non-zero value, or zero, which is at least +not misleading. Make the latter choice deterministic by always setting to 0 +for higher-numbered multicast groups. + +To get information about membership in groups >= 32, userspace is expected +to use nl_pktinfo control messages[0], which are enabled by NETLINK_PKTINFO +socket option. +[0] https://lwn.net/Articles/147608/ + +The way to trigger this issue is e.g. through monitoring the BRVLAN group: + + # bridge monitor vlan & + # ip link add name br type bridge + +Which produces the following citation: + + UBSAN: shift-out-of-bounds in net/netlink/af_netlink.c:162:19 + shift exponent 32 is too large for 32-bit type 'int' + +Fixes: f7fa9b10edbb ("[NETLINK]: Support dynamic number of multicast groups per netlink family") +Signed-off-by: Petr Machata +Reviewed-by: Ido Schimmel +Link: https://lore.kernel.org/r/2bef6aabf201d1fc16cca139a744700cff9dcb04.1647527635.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/netlink/af_netlink.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index e55af5c078ac..f37916156ca5 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -149,6 +149,8 @@ static const struct rhashtable_params netlink_rhashtable_params; + + static inline u32 netlink_group_mask(u32 group) + { ++ if (group > 32) ++ return 0; + return group ? 1 << (group - 1) : 0; + } + +-- +2.34.1 + diff --git a/queue-5.10/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch b/queue-5.10/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch new file mode 100644 index 00000000000..c06561d1c0c --- /dev/null +++ b/queue-5.10/alsa-firewire-lib-fix-uninitialized-flag-for-av-c-de.patch @@ -0,0 +1,84 @@ +From 38d7297b04429da1e824cd91aa7baf53baeecde1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 21:56:47 +0900 +Subject: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred + transaction + +From: Takashi Sakamoto + +[ Upstream commit bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d ] + +AV/C deferred transaction was supported at a commit 00a7bb81c20f ("ALSA: +firewire-lib: Add support for deferred transaction") while 'deferrable' +flag can be uninitialized for non-control/notify AV/C transactions. +UBSAN reports it: + +kernel: ================================================================================ +kernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9 +kernel: load of value 158 is not a valid value for type '_Bool' +kernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P OE 5.15.0-18-generic #18-Ubuntu +kernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019 +kernel: Call Trace: +kernel: +kernel: show_stack+0x52/0x58 +kernel: dump_stack_lvl+0x4a/0x5f +kernel: dump_stack+0x10/0x12 +kernel: ubsan_epilogue+0x9/0x45 +kernel: __ubsan_handle_load_invalid_value.cold+0x44/0x49 +kernel: fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib] +kernel: fcp_response+0x28/0x30 [snd_firewire_lib] +kernel: fw_core_handle_request+0x230/0x3d0 [firewire_core] +kernel: handle_ar_packet+0x1d9/0x200 [firewire_ohci] +kernel: ? handle_ar_packet+0x1d9/0x200 [firewire_ohci] +kernel: ? transmit_complete_callback+0x9f/0x120 [firewire_core] +kernel: ar_context_tasklet+0xa8/0x2e0 [firewire_ohci] +kernel: tasklet_action_common.constprop.0+0xea/0xf0 +kernel: tasklet_action+0x22/0x30 +kernel: __do_softirq+0xd9/0x2e3 +kernel: ? irq_finalize_oneshot.part.0+0xf0/0xf0 +kernel: do_softirq+0x75/0xa0 +kernel: +kernel: +kernel: __local_bh_enable_ip+0x50/0x60 +kernel: irq_forced_thread_fn+0x7e/0x90 +kernel: irq_thread+0xba/0x190 +kernel: ? irq_thread_fn+0x60/0x60 +kernel: kthread+0x11e/0x140 +kernel: ? irq_thread_check_affinity+0xf0/0xf0 +kernel: ? set_kthread_struct+0x50/0x50 +kernel: ret_from_fork+0x22/0x30 +kernel: +kernel: ================================================================================ + +This commit fixes the bug. The bug has no disadvantage for the non- +control/notify AV/C transactions since the flag has an effect for AV/C +response with INTERIM (0x0f) status which is not used for the transactions +in AV/C general specification. + +Fixes: 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction") +Signed-off-by: Takashi Sakamoto +Link: https://lore.kernel.org/r/20220304125647.78430-1-o-takashi@sakamocchi.jp +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/firewire/fcp.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c +index bbfbebf4affb..df44dd5dc4b2 100644 +--- a/sound/firewire/fcp.c ++++ b/sound/firewire/fcp.c +@@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit, + t.response_match_bytes = response_match_bytes; + t.state = STATE_PENDING; + init_waitqueue_head(&t.wait); +- +- if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03) +- t.deferrable = true; ++ t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03); + + spin_lock_irq(&transactions_lock); + list_add_tail(&t.list, &transactions); +-- +2.34.1 + diff --git a/queue-5.10/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch b/queue-5.10/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch new file mode 100644 index 00000000000..332231cc1ca --- /dev/null +++ b/queue-5.10/alsa-hda-realtek-add-alc256-samsung-headphone-fixup.patch @@ -0,0 +1,85 @@ +From 17c4c19bec5a233457cb32447da7532d91f435e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Mar 2022 13:48:17 -0700 +Subject: ALSA: hda/realtek: Add alc256-samsung-headphone fixup + +From: Matt Kramer + +[ Upstream commit ef248d9bd616b04df8be25539a4dc5db4b6c56f4 ] + +This fixes the near-silence of the headphone jack on the ALC256-based +Samsung Galaxy Book Flex Alpha (NP730QCJ). The magic verbs were found +through trial and error, using known ALC298 hacks as inspiration. The +fixup is auto-enabled only when the NP730QCJ is detected. It can be +manually enabled using model=alc256-samsung-headphone. + +Signed-off-by: Matt Kramer +Link: https://lore.kernel.org/r/3168355.aeNJFYEL58@linus +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + Documentation/sound/hd-audio/models.rst | 4 ++++ + sound/pci/hda/patch_realtek.c | 11 +++++++++++ + 2 files changed, 15 insertions(+) + +diff --git a/Documentation/sound/hd-audio/models.rst b/Documentation/sound/hd-audio/models.rst +index d25335993e55..9b52f50a6854 100644 +--- a/Documentation/sound/hd-audio/models.rst ++++ b/Documentation/sound/hd-audio/models.rst +@@ -261,6 +261,10 @@ alc-sense-combo + huawei-mbx-stereo + Enable initialization verbs for Huawei MBX stereo speakers; + might be risky, try this at your own risk ++alc298-samsung-headphone ++ Samsung laptops with ALC298 ++alc256-samsung-headphone ++ Samsung laptops with ALC256 + + ALC66x/67x/892 + ============== +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 54e56caa0d95..b886326ce9b9 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6762,6 +6762,7 @@ enum { + ALC236_FIXUP_HP_MUTE_LED, + ALC236_FIXUP_HP_MUTE_LED_MICMUTE_VREF, + ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, ++ ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, + ALC295_FIXUP_ASUS_MIC_NO_PRESENCE, + ALC269VC_FIXUP_ACER_VCOPPERBOX_PINS, + ALC269VC_FIXUP_ACER_HEADSET_MIC, +@@ -8083,6 +8084,14 @@ static const struct hda_fixup alc269_fixups[] = { + { } + }, + }, ++ [ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET] = { ++ .type = HDA_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ { 0x20, AC_VERB_SET_COEF_INDEX, 0x08}, ++ { 0x20, AC_VERB_SET_PROC_COEF, 0x2fcf}, ++ { } ++ }, ++ }, + [ALC295_FIXUP_ASUS_MIC_NO_PRESENCE] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -8835,6 +8844,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), + SND_PCI_QUIRK(0x144d, 0xc812, "Samsung Notebook Pen S (NT950SBE-X58)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), + SND_PCI_QUIRK(0x144d, 0xc830, "Samsung Galaxy Book Ion (NT950XCJ-X716A)", ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), ++ SND_PCI_QUIRK(0x144d, 0xc832, "Samsung Galaxy Book Flex Alpha (NP730QCJ)", ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET), + SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1462, 0xb120, "MSI Cubi MS-B120", ALC283_FIXUP_HEADSET_MIC), + SND_PCI_QUIRK(0x1462, 0xb171, "Cubi N 8GL (MS-B171)", ALC283_FIXUP_HEADSET_MIC), +@@ -9177,6 +9187,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { + {.id = ALC298_FIXUP_HUAWEI_MBX_STEREO, .name = "huawei-mbx-stereo"}, + {.id = ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE, .name = "alc256-medion-headset"}, + {.id = ALC298_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc298-samsung-headphone"}, ++ {.id = ALC256_FIXUP_SAMSUNG_HEADPHONE_VERY_QUIET, .name = "alc256-samsung-headphone"}, + {.id = ALC255_FIXUP_XIAOMI_HEADSET_MIC, .name = "alc255-xiaomi-headset"}, + {.id = ALC274_FIXUP_HP_MIC, .name = "alc274-hp-mic-detect"}, + {.id = ALC245_FIXUP_HP_X360_AMP, .name = "alc245-hp-x360-amp"}, +-- +2.34.1 + diff --git a/queue-5.10/alsa-spi-add-check-for-clk_enable.patch b/queue-5.10/alsa-spi-add-check-for-clk_enable.patch new file mode 100644 index 00000000000..549e70bf437 --- /dev/null +++ b/queue-5.10/alsa-spi-add-check-for-clk_enable.patch @@ -0,0 +1,92 @@ +From b150e141055e958d90b90adc4a8078ff9dd52c1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 10:28:39 +0800 +Subject: ALSA: spi: Add check for clk_enable() + +From: Jiasheng Jiang + +[ Upstream commit ca1697eb09208f0168d94b88b72f57505339cbe5 ] + +As the potential failure of the clk_enable(), +it should be better to check it and return error +if fails. + +Fixes: 3568459a5113 ("ALSA: at73c213: manage SSC clock") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220228022839.3547266-1-jiasheng@iscas.ac.cn +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/spi/at73c213.c | 27 +++++++++++++++++++++------ + 1 file changed, 21 insertions(+), 6 deletions(-) + +diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c +index 76c0e37a838c..8a2da6b1012e 100644 +--- a/sound/spi/at73c213.c ++++ b/sound/spi/at73c213.c +@@ -218,7 +218,9 @@ static int snd_at73c213_pcm_open(struct snd_pcm_substream *substream) + runtime->hw = snd_at73c213_playback_hw; + chip->substream = substream; + +- clk_enable(chip->ssc->clk); ++ err = clk_enable(chip->ssc->clk); ++ if (err) ++ return err; + + return 0; + } +@@ -776,7 +778,9 @@ static int snd_at73c213_chip_init(struct snd_at73c213 *chip) + goto out; + + /* Enable DAC master clock. */ +- clk_enable(chip->board->dac_clk); ++ retval = clk_enable(chip->board->dac_clk); ++ if (retval) ++ goto out; + + /* Initialize at73c213 on SPI bus. */ + retval = snd_at73c213_write_reg(chip, DAC_RST, 0x04); +@@ -889,7 +893,9 @@ static int snd_at73c213_dev_init(struct snd_card *card, + chip->card = card; + chip->irq = -1; + +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) ++ return retval; + + retval = request_irq(irq, snd_at73c213_interrupt, 0, "at73c213", chip); + if (retval) { +@@ -1008,7 +1014,9 @@ static int snd_at73c213_remove(struct spi_device *spi) + int retval; + + /* Stop playback. */ +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) ++ goto out; + ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXDIS)); + clk_disable(chip->ssc->clk); + +@@ -1088,9 +1096,16 @@ static int snd_at73c213_resume(struct device *dev) + { + struct snd_card *card = dev_get_drvdata(dev); + struct snd_at73c213 *chip = card->private_data; ++ int retval; + +- clk_enable(chip->board->dac_clk); +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->board->dac_clk); ++ if (retval) ++ return retval; ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) { ++ clk_disable(chip->board->dac_clk); ++ return retval; ++ } + ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXEN)); + + return 0; +-- +2.34.1 + diff --git a/queue-5.10/amba-make-the-remove-callback-return-void.patch b/queue-5.10/amba-make-the-remove-callback-return-void.patch new file mode 100644 index 00000000000..815b021e313 --- /dev/null +++ b/queue-5.10/amba-make-the-remove-callback-return-void.patch @@ -0,0 +1,696 @@ +From 996efe1843bb5db74d0ce06956e46b1dec0d286e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Jan 2021 17:58:34 +0100 +Subject: amba: Make the remove callback return void +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 3fd269e74f2feec973f45ee11d822faeda4fe284 ] + +All amba drivers return 0 in their remove callback. Together with the +driver core ignoring the return value anyhow, it doesn't make sense to +return a value here. + +Change the remove prototype to return void, which makes it explicit that +returning an error value doesn't work as expected. This simplifies changing +the core remove callback to return void, too. + +Reviewed-by: Ulf Hansson +Reviewed-by: Arnd Bergmann +Acked-by: Alexandre Belloni +Acked-by: Dmitry Torokhov +Acked-by: Krzysztof Kozlowski # for drivers/memory +Acked-by: Mark Brown +Acked-by: Linus Walleij +Acked-by: Suzuki K Poulose # for hwtracing/coresight +Acked-By: Vinod Koul # for dmaengine +Acked-by: Guenter Roeck # for watchdog +Acked-by: Wolfram Sang # for I2C +Acked-by: Takashi Iwai # for sound +Acked-by: Vladimir Zapolskiy # for memory/pl172 +Acked-by: Greg Kroah-Hartman +Link: https://lore.kernel.org/r/20210126165835.687514-5-u.kleine-koenig@pengutronix.de +Signed-off-by: Uwe Kleine-König +Signed-off-by: Sasha Levin +--- + drivers/amba/bus.c | 5 ++--- + drivers/char/hw_random/nomadik-rng.c | 3 +-- + drivers/dma/pl330.c | 3 +-- + drivers/gpu/drm/pl111/pl111_drv.c | 4 +--- + drivers/hwtracing/coresight/coresight-catu.c | 3 +-- + drivers/hwtracing/coresight/coresight-cpu-debug.c | 4 +--- + drivers/hwtracing/coresight/coresight-cti-core.c | 4 +--- + drivers/hwtracing/coresight/coresight-etb10.c | 4 +--- + drivers/hwtracing/coresight/coresight-etm3x-core.c | 4 +--- + drivers/hwtracing/coresight/coresight-etm4x-core.c | 4 +--- + drivers/hwtracing/coresight/coresight-funnel.c | 4 ++-- + drivers/hwtracing/coresight/coresight-replicator.c | 4 ++-- + drivers/hwtracing/coresight/coresight-stm.c | 4 +--- + drivers/hwtracing/coresight/coresight-tmc-core.c | 4 +--- + drivers/hwtracing/coresight/coresight-tpiu.c | 4 +--- + drivers/i2c/busses/i2c-nomadik.c | 4 +--- + drivers/input/serio/ambakmi.c | 3 +-- + drivers/memory/pl172.c | 4 +--- + drivers/memory/pl353-smc.c | 4 +--- + drivers/mmc/host/mmci.c | 4 +--- + drivers/rtc/rtc-pl030.c | 4 +--- + drivers/rtc/rtc-pl031.c | 4 +--- + drivers/spi/spi-pl022.c | 5 ++--- + drivers/tty/serial/amba-pl010.c | 4 +--- + drivers/tty/serial/amba-pl011.c | 3 +-- + drivers/vfio/platform/vfio_amba.c | 3 +-- + drivers/video/fbdev/amba-clcd.c | 4 +--- + drivers/watchdog/sp805_wdt.c | 4 +--- + include/linux/amba/bus.h | 2 +- + sound/arm/aaci.c | 4 +--- + 30 files changed, 34 insertions(+), 80 deletions(-) + +diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c +index 8f4ae6e967e3..47c72447ccd5 100644 +--- a/drivers/amba/bus.c ++++ b/drivers/amba/bus.c +@@ -299,11 +299,10 @@ static int amba_remove(struct device *dev) + { + struct amba_device *pcdev = to_amba_device(dev); + struct amba_driver *drv = to_amba_driver(dev->driver); +- int ret = 0; + + pm_runtime_get_sync(dev); + if (drv->remove) +- ret = drv->remove(pcdev); ++ drv->remove(pcdev); + pm_runtime_put_noidle(dev); + + /* Undo the runtime PM settings in amba_probe() */ +@@ -314,7 +313,7 @@ static int amba_remove(struct device *dev) + amba_put_disable_pclk(pcdev); + dev_pm_domain_detach(dev, true); + +- return ret; ++ return 0; + } + + static void amba_shutdown(struct device *dev) +diff --git a/drivers/char/hw_random/nomadik-rng.c b/drivers/char/hw_random/nomadik-rng.c +index b0ded41eb865..67947a19aa22 100644 +--- a/drivers/char/hw_random/nomadik-rng.c ++++ b/drivers/char/hw_random/nomadik-rng.c +@@ -69,11 +69,10 @@ static int nmk_rng_probe(struct amba_device *dev, const struct amba_id *id) + return ret; + } + +-static int nmk_rng_remove(struct amba_device *dev) ++static void nmk_rng_remove(struct amba_device *dev) + { + amba_release_regions(dev); + clk_disable(rng_clk); +- return 0; + } + + static const struct amba_id nmk_rng_ids[] = { +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index dfbf514188f3..6dca548f4dab 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -3199,7 +3199,7 @@ pl330_probe(struct amba_device *adev, const struct amba_id *id) + return ret; + } + +-static int pl330_remove(struct amba_device *adev) ++static void pl330_remove(struct amba_device *adev) + { + struct pl330_dmac *pl330 = amba_get_drvdata(adev); + struct dma_pl330_chan *pch, *_p; +@@ -3239,7 +3239,6 @@ static int pl330_remove(struct amba_device *adev) + + if (pl330->rstc) + reset_control_assert(pl330->rstc); +- return 0; + } + + static const struct amba_id pl330_ids[] = { +diff --git a/drivers/gpu/drm/pl111/pl111_drv.c b/drivers/gpu/drm/pl111/pl111_drv.c +index 46b0d1c4a16c..d5e8e3a8bff3 100644 +--- a/drivers/gpu/drm/pl111/pl111_drv.c ++++ b/drivers/gpu/drm/pl111/pl111_drv.c +@@ -324,7 +324,7 @@ static int pl111_amba_probe(struct amba_device *amba_dev, + return ret; + } + +-static int pl111_amba_remove(struct amba_device *amba_dev) ++static void pl111_amba_remove(struct amba_device *amba_dev) + { + struct device *dev = &amba_dev->dev; + struct drm_device *drm = amba_get_drvdata(amba_dev); +@@ -335,8 +335,6 @@ static int pl111_amba_remove(struct amba_device *amba_dev) + drm_panel_bridge_remove(priv->bridge); + drm_dev_put(drm); + of_reserved_mem_device_release(dev); +- +- return 0; + } + + /* +diff --git a/drivers/hwtracing/coresight/coresight-catu.c b/drivers/hwtracing/coresight/coresight-catu.c +index a61313f320bd..8e19e8cdcce5 100644 +--- a/drivers/hwtracing/coresight/coresight-catu.c ++++ b/drivers/hwtracing/coresight/coresight-catu.c +@@ -567,12 +567,11 @@ static int catu_probe(struct amba_device *adev, const struct amba_id *id) + return ret; + } + +-static int catu_remove(struct amba_device *adev) ++static void catu_remove(struct amba_device *adev) + { + struct catu_drvdata *drvdata = dev_get_drvdata(&adev->dev); + + coresight_unregister(drvdata->csdev); +- return 0; + } + + static struct amba_id catu_ids[] = { +diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c +index e1d232411d8d..2dcf13de751f 100644 +--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c ++++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c +@@ -627,7 +627,7 @@ static int debug_probe(struct amba_device *adev, const struct amba_id *id) + return ret; + } + +-static int debug_remove(struct amba_device *adev) ++static void debug_remove(struct amba_device *adev) + { + struct device *dev = &adev->dev; + struct debug_drvdata *drvdata = amba_get_drvdata(adev); +@@ -642,8 +642,6 @@ static int debug_remove(struct amba_device *adev) + + if (!--debug_count) + debug_func_exit(); +- +- return 0; + } + + static const struct amba_cs_uci_id uci_id_debug[] = { +diff --git a/drivers/hwtracing/coresight/coresight-cti-core.c b/drivers/hwtracing/coresight/coresight-cti-core.c +index 7ea93598f0ee..0276700c246d 100644 +--- a/drivers/hwtracing/coresight/coresight-cti-core.c ++++ b/drivers/hwtracing/coresight/coresight-cti-core.c +@@ -836,7 +836,7 @@ static void cti_device_release(struct device *dev) + if (drvdata->csdev_release) + drvdata->csdev_release(dev); + } +-static int cti_remove(struct amba_device *adev) ++static void cti_remove(struct amba_device *adev) + { + struct cti_drvdata *drvdata = dev_get_drvdata(&adev->dev); + +@@ -845,8 +845,6 @@ static int cti_remove(struct amba_device *adev) + mutex_unlock(&ect_mutex); + + coresight_unregister(drvdata->csdev); +- +- return 0; + } + + static int cti_probe(struct amba_device *adev, const struct amba_id *id) +diff --git a/drivers/hwtracing/coresight/coresight-etb10.c b/drivers/hwtracing/coresight/coresight-etb10.c +index 0cf6f0b947b6..51c801c05e5c 100644 +--- a/drivers/hwtracing/coresight/coresight-etb10.c ++++ b/drivers/hwtracing/coresight/coresight-etb10.c +@@ -803,7 +803,7 @@ static int etb_probe(struct amba_device *adev, const struct amba_id *id) + return ret; + } + +-static int etb_remove(struct amba_device *adev) ++static void etb_remove(struct amba_device *adev) + { + struct etb_drvdata *drvdata = dev_get_drvdata(&adev->dev); + +@@ -814,8 +814,6 @@ static int etb_remove(struct amba_device *adev) + */ + misc_deregister(&drvdata->miscdev); + coresight_unregister(drvdata->csdev); +- +- return 0; + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-etm3x-core.c b/drivers/hwtracing/coresight/coresight-etm3x-core.c +index 5bf5a5a4ce6d..683a69e88efd 100644 +--- a/drivers/hwtracing/coresight/coresight-etm3x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm3x-core.c +@@ -909,7 +909,7 @@ static void clear_etmdrvdata(void *info) + etmdrvdata[cpu] = NULL; + } + +-static int etm_remove(struct amba_device *adev) ++static void etm_remove(struct amba_device *adev) + { + struct etm_drvdata *drvdata = dev_get_drvdata(&adev->dev); + +@@ -932,8 +932,6 @@ static int etm_remove(struct amba_device *adev) + cpus_read_unlock(); + + coresight_unregister(drvdata->csdev); +- +- return 0; + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c +index 74d3e2fe43d4..99df453575f5 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-core.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c +@@ -1582,7 +1582,7 @@ static void clear_etmdrvdata(void *info) + etmdrvdata[cpu] = NULL; + } + +-static int etm4_remove(struct amba_device *adev) ++static void etm4_remove(struct amba_device *adev) + { + struct etmv4_drvdata *drvdata = dev_get_drvdata(&adev->dev); + +@@ -1605,8 +1605,6 @@ static int etm4_remove(struct amba_device *adev) + cpus_read_unlock(); + + coresight_unregister(drvdata->csdev); +- +- return 0; + } + + static const struct amba_id etm4_ids[] = { +diff --git a/drivers/hwtracing/coresight/coresight-funnel.c b/drivers/hwtracing/coresight/coresight-funnel.c +index 3fc6c678b51d..b2fb853776d7 100644 +--- a/drivers/hwtracing/coresight/coresight-funnel.c ++++ b/drivers/hwtracing/coresight/coresight-funnel.c +@@ -370,9 +370,9 @@ static int dynamic_funnel_probe(struct amba_device *adev, + return funnel_probe(&adev->dev, &adev->res); + } + +-static int dynamic_funnel_remove(struct amba_device *adev) ++static void dynamic_funnel_remove(struct amba_device *adev) + { +- return funnel_remove(&adev->dev); ++ funnel_remove(&adev->dev); + } + + static const struct amba_id dynamic_funnel_ids[] = { +diff --git a/drivers/hwtracing/coresight/coresight-replicator.c b/drivers/hwtracing/coresight/coresight-replicator.c +index 38008aca2c0f..da2bfeeabc1b 100644 +--- a/drivers/hwtracing/coresight/coresight-replicator.c ++++ b/drivers/hwtracing/coresight/coresight-replicator.c +@@ -388,9 +388,9 @@ static int dynamic_replicator_probe(struct amba_device *adev, + return replicator_probe(&adev->dev, &adev->res); + } + +-static int dynamic_replicator_remove(struct amba_device *adev) ++static void dynamic_replicator_remove(struct amba_device *adev) + { +- return replicator_remove(&adev->dev); ++ replicator_remove(&adev->dev); + } + + static const struct amba_id dynamic_replicator_ids[] = { +diff --git a/drivers/hwtracing/coresight/coresight-stm.c b/drivers/hwtracing/coresight/coresight-stm.c +index 587c1d7f2520..0ecca9f93f3a 100644 +--- a/drivers/hwtracing/coresight/coresight-stm.c ++++ b/drivers/hwtracing/coresight/coresight-stm.c +@@ -951,15 +951,13 @@ static int stm_probe(struct amba_device *adev, const struct amba_id *id) + return ret; + } + +-static int stm_remove(struct amba_device *adev) ++static void stm_remove(struct amba_device *adev) + { + struct stm_drvdata *drvdata = dev_get_drvdata(&adev->dev); + + coresight_unregister(drvdata->csdev); + + stm_unregister_device(&drvdata->stm); +- +- return 0; + } + + #ifdef CONFIG_PM +diff --git a/drivers/hwtracing/coresight/coresight-tmc-core.c b/drivers/hwtracing/coresight/coresight-tmc-core.c +index 8169dff5a9f6..e29b3914fc0f 100644 +--- a/drivers/hwtracing/coresight/coresight-tmc-core.c ++++ b/drivers/hwtracing/coresight/coresight-tmc-core.c +@@ -559,7 +559,7 @@ static void tmc_shutdown(struct amba_device *adev) + spin_unlock_irqrestore(&drvdata->spinlock, flags); + } + +-static int tmc_remove(struct amba_device *adev) ++static void tmc_remove(struct amba_device *adev) + { + struct tmc_drvdata *drvdata = dev_get_drvdata(&adev->dev); + +@@ -570,8 +570,6 @@ static int tmc_remove(struct amba_device *adev) + */ + misc_deregister(&drvdata->miscdev); + coresight_unregister(drvdata->csdev); +- +- return 0; + } + + static const struct amba_id tmc_ids[] = { +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index 5b35029461a0..0ca39d905d0b 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -173,13 +173,11 @@ static int tpiu_probe(struct amba_device *adev, const struct amba_id *id) + return PTR_ERR(drvdata->csdev); + } + +-static int tpiu_remove(struct amba_device *adev) ++static void tpiu_remove(struct amba_device *adev) + { + struct tpiu_drvdata *drvdata = dev_get_drvdata(&adev->dev); + + coresight_unregister(drvdata->csdev); +- +- return 0; + } + + #ifdef CONFIG_PM +diff --git a/drivers/i2c/busses/i2c-nomadik.c b/drivers/i2c/busses/i2c-nomadik.c +index d4b1b0865f67..a3363b20f168 100644 +--- a/drivers/i2c/busses/i2c-nomadik.c ++++ b/drivers/i2c/busses/i2c-nomadik.c +@@ -1055,7 +1055,7 @@ static int nmk_i2c_probe(struct amba_device *adev, const struct amba_id *id) + return ret; + } + +-static int nmk_i2c_remove(struct amba_device *adev) ++static void nmk_i2c_remove(struct amba_device *adev) + { + struct resource *res = &adev->res; + struct nmk_i2c_dev *dev = amba_get_drvdata(adev); +@@ -1068,8 +1068,6 @@ static int nmk_i2c_remove(struct amba_device *adev) + i2c_clr_bit(dev->virtbase + I2C_CR, I2C_CR_PE); + clk_disable_unprepare(dev->clk); + release_mem_region(res->start, resource_size(res)); +- +- return 0; + } + + static struct i2c_vendor_data vendor_stn8815 = { +diff --git a/drivers/input/serio/ambakmi.c b/drivers/input/serio/ambakmi.c +index ecdeca147ed7..4408245b61d2 100644 +--- a/drivers/input/serio/ambakmi.c ++++ b/drivers/input/serio/ambakmi.c +@@ -159,7 +159,7 @@ static int amba_kmi_probe(struct amba_device *dev, + return ret; + } + +-static int amba_kmi_remove(struct amba_device *dev) ++static void amba_kmi_remove(struct amba_device *dev) + { + struct amba_kmi_port *kmi = amba_get_drvdata(dev); + +@@ -168,7 +168,6 @@ static int amba_kmi_remove(struct amba_device *dev) + iounmap(kmi->base); + kfree(kmi); + amba_release_regions(dev); +- return 0; + } + + static int __maybe_unused amba_kmi_resume(struct device *dev) +diff --git a/drivers/memory/pl172.c b/drivers/memory/pl172.c +index 575fadbffa30..9eb8cc7de494 100644 +--- a/drivers/memory/pl172.c ++++ b/drivers/memory/pl172.c +@@ -273,14 +273,12 @@ static int pl172_probe(struct amba_device *adev, const struct amba_id *id) + return ret; + } + +-static int pl172_remove(struct amba_device *adev) ++static void pl172_remove(struct amba_device *adev) + { + struct pl172_data *pl172 = amba_get_drvdata(adev); + + clk_disable_unprepare(pl172->clk); + amba_release_regions(adev); +- +- return 0; + } + + static const struct amba_id pl172_ids[] = { +diff --git a/drivers/memory/pl353-smc.c b/drivers/memory/pl353-smc.c +index cc01979780d8..b0b251bb207f 100644 +--- a/drivers/memory/pl353-smc.c ++++ b/drivers/memory/pl353-smc.c +@@ -427,14 +427,12 @@ static int pl353_smc_probe(struct amba_device *adev, const struct amba_id *id) + return err; + } + +-static int pl353_smc_remove(struct amba_device *adev) ++static void pl353_smc_remove(struct amba_device *adev) + { + struct pl353_smc_data *pl353_smc = amba_get_drvdata(adev); + + clk_disable_unprepare(pl353_smc->memclk); + clk_disable_unprepare(pl353_smc->aclk); +- +- return 0; + } + + static const struct amba_id pl353_ids[] = { +diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c +index 9bde0def114b..b5684e5d79e6 100644 +--- a/drivers/mmc/host/mmci.c ++++ b/drivers/mmc/host/mmci.c +@@ -2203,7 +2203,7 @@ static int mmci_probe(struct amba_device *dev, + return ret; + } + +-static int mmci_remove(struct amba_device *dev) ++static void mmci_remove(struct amba_device *dev) + { + struct mmc_host *mmc = amba_get_drvdata(dev); + +@@ -2231,8 +2231,6 @@ static int mmci_remove(struct amba_device *dev) + clk_disable_unprepare(host->clk); + mmc_free_host(mmc); + } +- +- return 0; + } + + #ifdef CONFIG_PM +diff --git a/drivers/rtc/rtc-pl030.c b/drivers/rtc/rtc-pl030.c +index ebe03eba8f5f..87c93843d62a 100644 +--- a/drivers/rtc/rtc-pl030.c ++++ b/drivers/rtc/rtc-pl030.c +@@ -137,7 +137,7 @@ static int pl030_probe(struct amba_device *dev, const struct amba_id *id) + return ret; + } + +-static int pl030_remove(struct amba_device *dev) ++static void pl030_remove(struct amba_device *dev) + { + struct pl030_rtc *rtc = amba_get_drvdata(dev); + +@@ -146,8 +146,6 @@ static int pl030_remove(struct amba_device *dev) + free_irq(dev->irq[0], rtc); + iounmap(rtc->base); + amba_release_regions(dev); +- +- return 0; + } + + static struct amba_id pl030_ids[] = { +diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c +index d4b2ab786126..2f5581ea26fe 100644 +--- a/drivers/rtc/rtc-pl031.c ++++ b/drivers/rtc/rtc-pl031.c +@@ -280,7 +280,7 @@ static int pl031_set_alarm(struct device *dev, struct rtc_wkalrm *alarm) + return 0; + } + +-static int pl031_remove(struct amba_device *adev) ++static void pl031_remove(struct amba_device *adev) + { + struct pl031_local *ldata = dev_get_drvdata(&adev->dev); + +@@ -289,8 +289,6 @@ static int pl031_remove(struct amba_device *adev) + if (adev->irq[0]) + free_irq(adev->irq[0], ldata); + amba_release_regions(adev); +- +- return 0; + } + + static int pl031_probe(struct amba_device *adev, const struct amba_id *id) +diff --git a/drivers/spi/spi-pl022.c b/drivers/spi/spi-pl022.c +index e4ee8b084799..f7603c209e9d 100644 +--- a/drivers/spi/spi-pl022.c ++++ b/drivers/spi/spi-pl022.c +@@ -2315,13 +2315,13 @@ static int pl022_probe(struct amba_device *adev, const struct amba_id *id) + return status; + } + +-static int ++static void + pl022_remove(struct amba_device *adev) + { + struct pl022 *pl022 = amba_get_drvdata(adev); + + if (!pl022) +- return 0; ++ return; + + /* + * undo pm_runtime_put() in probe. I assume that we're not +@@ -2336,7 +2336,6 @@ pl022_remove(struct amba_device *adev) + clk_disable_unprepare(pl022->clk); + amba_release_regions(adev); + tasklet_disable(&pl022->pump_transfers); +- return 0; + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/tty/serial/amba-pl010.c b/drivers/tty/serial/amba-pl010.c +index 75d61e038a77..e538d6d75155 100644 +--- a/drivers/tty/serial/amba-pl010.c ++++ b/drivers/tty/serial/amba-pl010.c +@@ -751,7 +751,7 @@ static int pl010_probe(struct amba_device *dev, const struct amba_id *id) + return ret; + } + +-static int pl010_remove(struct amba_device *dev) ++static void pl010_remove(struct amba_device *dev) + { + struct uart_amba_port *uap = amba_get_drvdata(dev); + int i; +@@ -767,8 +767,6 @@ static int pl010_remove(struct amba_device *dev) + + if (!busy) + uart_unregister_driver(&amba_reg); +- +- return 0; + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c +index 61183e7ff009..07b19e97f850 100644 +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -2658,13 +2658,12 @@ static int pl011_probe(struct amba_device *dev, const struct amba_id *id) + return pl011_register_port(uap); + } + +-static int pl011_remove(struct amba_device *dev) ++static void pl011_remove(struct amba_device *dev) + { + struct uart_amba_port *uap = amba_get_drvdata(dev); + + uart_remove_one_port(&amba_reg, &uap->port); + pl011_unregister_port(uap); +- return 0; + } + + #ifdef CONFIG_PM_SLEEP +diff --git a/drivers/vfio/platform/vfio_amba.c b/drivers/vfio/platform/vfio_amba.c +index 7b3ebf1558e1..3626c2150101 100644 +--- a/drivers/vfio/platform/vfio_amba.c ++++ b/drivers/vfio/platform/vfio_amba.c +@@ -71,14 +71,13 @@ static int vfio_amba_probe(struct amba_device *adev, const struct amba_id *id) + return ret; + } + +-static int vfio_amba_remove(struct amba_device *adev) ++static void vfio_amba_remove(struct amba_device *adev) + { + struct vfio_platform_device *vdev = + vfio_platform_remove_common(&adev->dev); + + kfree(vdev->name); + kfree(vdev); +- return 0; + } + + static const struct amba_id pl330_ids[] = { +diff --git a/drivers/video/fbdev/amba-clcd.c b/drivers/video/fbdev/amba-clcd.c +index b7682de412d8..33595cc4778e 100644 +--- a/drivers/video/fbdev/amba-clcd.c ++++ b/drivers/video/fbdev/amba-clcd.c +@@ -925,7 +925,7 @@ static int clcdfb_probe(struct amba_device *dev, const struct amba_id *id) + return ret; + } + +-static int clcdfb_remove(struct amba_device *dev) ++static void clcdfb_remove(struct amba_device *dev) + { + struct clcd_fb *fb = amba_get_drvdata(dev); + +@@ -942,8 +942,6 @@ static int clcdfb_remove(struct amba_device *dev) + kfree(fb); + + amba_release_regions(dev); +- +- return 0; + } + + static const struct amba_id clcdfb_id_table[] = { +diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c +index 190d26e2e75f..2815f78d22bb 100644 +--- a/drivers/watchdog/sp805_wdt.c ++++ b/drivers/watchdog/sp805_wdt.c +@@ -304,14 +304,12 @@ sp805_wdt_probe(struct amba_device *adev, const struct amba_id *id) + return ret; + } + +-static int sp805_wdt_remove(struct amba_device *adev) ++static void sp805_wdt_remove(struct amba_device *adev) + { + struct sp805_wdt *wdt = amba_get_drvdata(adev); + + watchdog_unregister_device(&wdt->wdd); + watchdog_set_drvdata(&wdt->wdd, NULL); +- +- return 0; + } + + static int __maybe_unused sp805_wdt_suspend(struct device *dev) +diff --git a/include/linux/amba/bus.h b/include/linux/amba/bus.h +index 0bbfd647f5c6..6cc93ab5b809 100644 +--- a/include/linux/amba/bus.h ++++ b/include/linux/amba/bus.h +@@ -76,7 +76,7 @@ struct amba_device { + struct amba_driver { + struct device_driver drv; + int (*probe)(struct amba_device *, const struct amba_id *); +- int (*remove)(struct amba_device *); ++ void (*remove)(struct amba_device *); + void (*shutdown)(struct amba_device *); + const struct amba_id *id_table; + }; +diff --git a/sound/arm/aaci.c b/sound/arm/aaci.c +index a0996c47e58f..b326a5f5f0d5 100644 +--- a/sound/arm/aaci.c ++++ b/sound/arm/aaci.c +@@ -1055,7 +1055,7 @@ static int aaci_probe(struct amba_device *dev, + return ret; + } + +-static int aaci_remove(struct amba_device *dev) ++static void aaci_remove(struct amba_device *dev) + { + struct snd_card *card = amba_get_drvdata(dev); + +@@ -1066,8 +1066,6 @@ static int aaci_remove(struct amba_device *dev) + snd_card_free(card); + amba_release_regions(dev); + } +- +- return 0; + } + + static struct amba_id aaci_ids[] = { +-- +2.34.1 + diff --git a/queue-5.10/arm-configs-multi_v5_defconfig-re-enable-config_v4l_.patch b/queue-5.10/arm-configs-multi_v5_defconfig-re-enable-config_v4l_.patch new file mode 100644 index 00000000000..eeac200bed1 --- /dev/null +++ b/queue-5.10/arm-configs-multi_v5_defconfig-re-enable-config_v4l_.patch @@ -0,0 +1,44 @@ +From a76502c5d2350122dbed3c05fc2ac66e39deb0ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 18:30:40 +0000 +Subject: ARM: configs: multi_v5_defconfig: re-enable + CONFIG_V4L_PLATFORM_DRIVERS + +From: Andre Przywara + +[ Upstream commit f5eb04d7a0e419d61f784de3ced708259ddb71d7 ] + +Commit 06b93644f4d1 ("media: Kconfig: add an option to filter in/out +platform drivers") introduced CONFIG_MEDIA_PLATFORM_SUPPORT, to allow +more fine grained control over the inclusion of certain Kconfig files. +multi_v5_defconfig was selecting some drivers described in +drivers/media/platform/Kconfig, which now wasn't included anymore. + +Explicitly set the new symbol in multi_v5_defconfig to bring those +drivers back. +This enables some new V4L2 and VIDEOBUF2 features, but as modules only. + +Fixes: 06b93644f4d1 ("media: Kconfig: add an option to filter in/out platform drivers") +Signed-off-by: Andre Przywara +Link: https://lore.kernel.org/r/20220317183043.948432-3-andre.przywara@arm.com' +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/configs/multi_v5_defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/configs/multi_v5_defconfig b/arch/arm/configs/multi_v5_defconfig +index e00be9faa23b..4393e689f235 100644 +--- a/arch/arm/configs/multi_v5_defconfig ++++ b/arch/arm/configs/multi_v5_defconfig +@@ -187,6 +187,7 @@ CONFIG_REGULATOR=y + CONFIG_REGULATOR_FIXED_VOLTAGE=y + CONFIG_MEDIA_SUPPORT=y + CONFIG_MEDIA_CAMERA_SUPPORT=y ++CONFIG_MEDIA_PLATFORM_SUPPORT=y + CONFIG_V4L_PLATFORM_DRIVERS=y + CONFIG_VIDEO_ASPEED=m + CONFIG_VIDEO_ATMEL_ISI=m +-- +2.34.1 + diff --git a/queue-5.10/arm-dts-bcm2711-add-the-missing-l1-l2-cache-informat.patch b/queue-5.10/arm-dts-bcm2711-add-the-missing-l1-l2-cache-informat.patch new file mode 100644 index 00000000000..d647aa4710a --- /dev/null +++ b/queue-5.10/arm-dts-bcm2711-add-the-missing-l1-l2-cache-informat.patch @@ -0,0 +1,113 @@ +From 536b743fc8bfd13468943600045a1bbf79455327 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Dec 2021 23:48:30 +0100 +Subject: ARM: dts: bcm2711: Add the missing L1/L2 cache information + +From: Richard Schleich + +[ Upstream commit 618682b350990f8f1bee718949c4b3858711eb58 ] + +This patch fixes the kernel warning +"cacheinfo: Unable to detect cache hierarchy for CPU 0" +for the bcm2711 on newer kernel versions. + +Signed-off-by: Richard Schleich +Tested-by: Stefan Wahren +[florian: Align and remove comments matching property values] +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2711.dtsi | 50 ++++++++++++++++++++++++++++++++++ + 1 file changed, 50 insertions(+) + +diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi +index e46a3f4ad350..b50229c3102f 100644 +--- a/arch/arm/boot/dts/bcm2711.dtsi ++++ b/arch/arm/boot/dts/bcm2711.dtsi +@@ -433,12 +433,26 @@ + #size-cells = <0>; + enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit + ++ /* Source for d/i-cache-line-size and d/i-cache-sets ++ * https://developer.arm.com/documentation/100095/0003 ++ * /Level-1-Memory-System/About-the-L1-memory-system?lang=en ++ * Source for d/i-cache-size ++ * https://www.raspberrypi.com/documentation/computers ++ * /processors.html#bcm2711 ++ */ + cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a72"; + reg = <0>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000d8>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ i-cache-size = <0xc000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 48KiB(size)/64(line-size)=768ways/3-way set ++ next-level-cache = <&l2>; + }; + + cpu1: cpu@1 { +@@ -447,6 +461,13 @@ + reg = <1>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000e0>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ i-cache-size = <0xc000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 48KiB(size)/64(line-size)=768ways/3-way set ++ next-level-cache = <&l2>; + }; + + cpu2: cpu@2 { +@@ -455,6 +476,13 @@ + reg = <2>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000e8>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ i-cache-size = <0xc000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 48KiB(size)/64(line-size)=768ways/3-way set ++ next-level-cache = <&l2>; + }; + + cpu3: cpu@3 { +@@ -463,6 +491,28 @@ + reg = <3>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000f0>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ i-cache-size = <0xc000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 48KiB(size)/64(line-size)=768ways/3-way set ++ next-level-cache = <&l2>; ++ }; ++ ++ /* Source for d/i-cache-line-size and d/i-cache-sets ++ * https://developer.arm.com/documentation/100095/0003 ++ * /Level-2-Memory-System/About-the-L2-memory-system?lang=en ++ * Source for d/i-cache-size ++ * https://www.raspberrypi.com/documentation/computers ++ * /processors.html#bcm2711 ++ */ ++ l2: l2-cache0 { ++ compatible = "cache"; ++ cache-size = <0x100000>; ++ cache-line-size = <64>; ++ cache-sets = <1024>; // 1MiB(size)/64(line-size)=16384ways/16-way set ++ cache-level = <2>; + }; + }; + +-- +2.34.1 + diff --git a/queue-5.10/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch b/queue-5.10/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch new file mode 100644 index 00000000000..8e91d7db0a7 --- /dev/null +++ b/queue-5.10/arm-dts-bcm2837-add-the-missing-l1-l2-cache-informat.patch @@ -0,0 +1,112 @@ +From 72c25f5abdee2caff2752079a970f0e3a778e94c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 18 Dec 2021 21:00:09 +0100 +Subject: ARM: dts: bcm2837: Add the missing L1/L2 cache information + +From: Richard Schleich + +[ Upstream commit bdf8762da268d2a34abf517c36528413906e9cd5 ] + +This patch fixes the kernel warning +"cacheinfo: Unable to detect cache hierarchy for CPU 0" +for the bcm2837 on newer kernel versions. + +Signed-off-by: Richard Schleich +Tested-by: Stefan Wahren +[florian: Align and remove comments matching property values] +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2837.dtsi | 49 ++++++++++++++++++++++++++++++++++ + 1 file changed, 49 insertions(+) + +diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi +index 0199ec98cd61..5dbdebc46259 100644 +--- a/arch/arm/boot/dts/bcm2837.dtsi ++++ b/arch/arm/boot/dts/bcm2837.dtsi +@@ -40,12 +40,26 @@ + #size-cells = <0>; + enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit + ++ /* Source for d/i-cache-line-size and d/i-cache-sets ++ * https://developer.arm.com/documentation/ddi0500/e/level-1-memory-system ++ * /about-the-l1-memory-system?lang=en ++ * ++ * Source for d/i-cache-size ++ * https://magpi.raspberrypi.com/articles/raspberry-pi-3-specs-benchmarks ++ */ + cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a53"; + reg = <0>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000d8>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu1: cpu@1 { +@@ -54,6 +68,13 @@ + reg = <1>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000e0>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu2: cpu@2 { +@@ -62,6 +83,13 @@ + reg = <2>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000e8>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu3: cpu@3 { +@@ -70,6 +98,27 @@ + reg = <3>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000f0>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; ++ }; ++ ++ /* Source for cache-line-size + cache-sets ++ * https://developer.arm.com/documentation/ddi0500 ++ * /e/level-2-memory-system/about-the-l2-memory-system?lang=en ++ * Source for cache-size ++ * https://datasheets.raspberrypi.com/cm/cm1-and-cm3-datasheet.pdf ++ */ ++ l2: l2-cache0 { ++ compatible = "cache"; ++ cache-size = <0x80000>; ++ cache-line-size = <64>; ++ cache-sets = <512>; // 512KiB(size)/64(line-size)=8192ways/16-way set ++ cache-level = <2>; + }; + }; + }; +-- +2.34.1 + diff --git a/queue-5.10/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch b/queue-5.10/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch new file mode 100644 index 00000000000..3f3e5076c2e --- /dev/null +++ b/queue-5.10/arm-dts-imx-add-missing-lvds-decoder-on-m53menlo.patch @@ -0,0 +1,81 @@ +From 20cede6bd247b6a30effa6a6552afe9b9bd13178 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Feb 2022 23:11:23 +0100 +Subject: ARM: dts: imx: Add missing LVDS decoder on M53Menlo + +From: Marek Vasut + +[ Upstream commit 0c6f71176ea43d6f4003a4d57f7bb518c5ad6145 ] + +The M53Menlo display unit uses an LVDS-to-DPI bridge, TI DS90CF364A. +Describe this bridge in DT, otherwise the DT incorrectly describes +DPI panel attached directly to LVDS source. + +Fixes: 716be61d1869 ("ARM: dts: imx53: Add Menlosystems M53 board") +Signed-off-by: Marek Vasut +Cc: Shawn Guo +Cc: Fabio Estevam +Cc: NXP Linux Team +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx53-m53menlo.dts | 29 ++++++++++++++++++++++++++-- + 1 file changed, 27 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx53-m53menlo.dts b/arch/arm/boot/dts/imx53-m53menlo.dts +index 4f88e96d81dd..d5c68d1ea707 100644 +--- a/arch/arm/boot/dts/imx53-m53menlo.dts ++++ b/arch/arm/boot/dts/imx53-m53menlo.dts +@@ -53,6 +53,31 @@ + }; + }; + ++ lvds-decoder { ++ compatible = "ti,ds90cf364a", "lvds-decoder"; ++ ++ ports { ++ #address-cells = <1>; ++ #size-cells = <0>; ++ ++ port@0 { ++ reg = <0>; ++ ++ lvds_decoder_in: endpoint { ++ remote-endpoint = <&lvds0_out>; ++ }; ++ }; ++ ++ port@1 { ++ reg = <1>; ++ ++ lvds_decoder_out: endpoint { ++ remote-endpoint = <&panel_in>; ++ }; ++ }; ++ }; ++ }; ++ + panel { + compatible = "edt,etm0700g0dh6"; + pinctrl-0 = <&pinctrl_display_gpio>; +@@ -61,7 +86,7 @@ + + port { + panel_in: endpoint { +- remote-endpoint = <&lvds0_out>; ++ remote-endpoint = <&lvds_decoder_out>; + }; + }; + }; +@@ -450,7 +475,7 @@ + reg = <2>; + + lvds0_out: endpoint { +- remote-endpoint = <&panel_in>; ++ remote-endpoint = <&lvds_decoder_in>; + }; + }; + }; +-- +2.34.1 + diff --git a/queue-5.10/arm-dts-imx7-use-audio_mclk_post_div-instead-audio_m.patch b/queue-5.10/arm-dts-imx7-use-audio_mclk_post_div-instead-audio_m.patch new file mode 100644 index 00000000000..345cc777bcf --- /dev/null +++ b/queue-5.10/arm-dts-imx7-use-audio_mclk_post_div-instead-audio_m.patch @@ -0,0 +1,166 @@ +From 2b9b9b6f9a5d2df4c75ac256917ccb85968adc62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 16:10:51 +0200 +Subject: ARM: dts: imx7: Use audio_mclk_post_div instead audio_mclk_root_clk + +From: Abel Vesa + +[ Upstream commit 4cb7df64c732b2b9918424095c11660c2a8c4a33 ] + +The audio_mclk_root_clk was added as a gate with the CCGR121 (0x4790), +but according to the reference manual, there is no such gate. Moreover, +the consumer driver of the mentioned clock might gate it and leave +the ECSPI2 (the true owner of that gate) hanging. So lets use the +audio_mclk_post_div, which is the parent. + +Signed-off-by: Abel Vesa +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx7-colibri.dtsi | 4 ++-- + arch/arm/boot/dts/imx7-mba7.dtsi | 2 +- + arch/arm/boot/dts/imx7d-nitrogen7.dts | 2 +- + arch/arm/boot/dts/imx7d-pico-hobbit.dts | 4 ++-- + arch/arm/boot/dts/imx7d-pico-pi.dts | 4 ++-- + arch/arm/boot/dts/imx7d-sdb.dts | 4 ++-- + arch/arm/boot/dts/imx7s-warp.dts | 4 ++-- + 7 files changed, 12 insertions(+), 12 deletions(-) + +diff --git a/arch/arm/boot/dts/imx7-colibri.dtsi b/arch/arm/boot/dts/imx7-colibri.dtsi +index 62b771c1d5a9..f1c60b0cb143 100644 +--- a/arch/arm/boot/dts/imx7-colibri.dtsi ++++ b/arch/arm/boot/dts/imx7-colibri.dtsi +@@ -40,7 +40,7 @@ + + dailink_master: simple-audio-card,codec { + sound-dai = <&codec>; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + }; + }; + }; +@@ -293,7 +293,7 @@ + compatible = "fsl,sgtl5000"; + #sound-dai-cells = <0>; + reg = <0x0a>; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai1_mclk>; + VDDA-supply = <®_module_3v3_avdd>; +diff --git a/arch/arm/boot/dts/imx7-mba7.dtsi b/arch/arm/boot/dts/imx7-mba7.dtsi +index 50abf18ad30b..887497e3bb4b 100644 +--- a/arch/arm/boot/dts/imx7-mba7.dtsi ++++ b/arch/arm/boot/dts/imx7-mba7.dtsi +@@ -250,7 +250,7 @@ + tlv320aic32x4: audio-codec@18 { + compatible = "ti,tlv320aic32x4"; + reg = <0x18>; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + clock-names = "mclk"; + ldoin-supply = <®_audio_3v3>; + iov-supply = <®_audio_3v3>; +diff --git a/arch/arm/boot/dts/imx7d-nitrogen7.dts b/arch/arm/boot/dts/imx7d-nitrogen7.dts +index e0751e6ba3c0..a31de900139d 100644 +--- a/arch/arm/boot/dts/imx7d-nitrogen7.dts ++++ b/arch/arm/boot/dts/imx7d-nitrogen7.dts +@@ -288,7 +288,7 @@ + codec: wm8960@1a { + compatible = "wlf,wm8960"; + reg = <0x1a>; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + clock-names = "mclk"; + wlf,shared-lrclk; + }; +diff --git a/arch/arm/boot/dts/imx7d-pico-hobbit.dts b/arch/arm/boot/dts/imx7d-pico-hobbit.dts +index 7b2198a9372c..d917dc4f2f22 100644 +--- a/arch/arm/boot/dts/imx7d-pico-hobbit.dts ++++ b/arch/arm/boot/dts/imx7d-pico-hobbit.dts +@@ -31,7 +31,7 @@ + + dailink_master: simple-audio-card,codec { + sound-dai = <&sgtl5000>; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + }; + }; + }; +@@ -41,7 +41,7 @@ + #sound-dai-cells = <0>; + reg = <0x0a>; + compatible = "fsl,sgtl5000"; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + VDDA-supply = <®_2p5v>; + VDDIO-supply = <®_vref_1v8>; + }; +diff --git a/arch/arm/boot/dts/imx7d-pico-pi.dts b/arch/arm/boot/dts/imx7d-pico-pi.dts +index 70bea95c06d8..f263e391e24c 100644 +--- a/arch/arm/boot/dts/imx7d-pico-pi.dts ++++ b/arch/arm/boot/dts/imx7d-pico-pi.dts +@@ -31,7 +31,7 @@ + + dailink_master: simple-audio-card,codec { + sound-dai = <&sgtl5000>; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + }; + }; + }; +@@ -41,7 +41,7 @@ + #sound-dai-cells = <0>; + reg = <0x0a>; + compatible = "fsl,sgtl5000"; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + VDDA-supply = <®_2p5v>; + VDDIO-supply = <®_vref_1v8>; + }; +diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts +index ac0751bc1177..6823b9f1a2a3 100644 +--- a/arch/arm/boot/dts/imx7d-sdb.dts ++++ b/arch/arm/boot/dts/imx7d-sdb.dts +@@ -378,14 +378,14 @@ + codec: wm8960@1a { + compatible = "wlf,wm8960"; + reg = <0x1a>; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + clock-names = "mclk"; + wlf,shared-lrclk; + wlf,hp-cfg = <2 2 3>; + wlf,gpio-cfg = <1 3>; + assigned-clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_SRC>, + <&clks IMX7D_PLL_AUDIO_POST_DIV>, +- <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + assigned-clock-parents = <&clks IMX7D_PLL_AUDIO_POST_DIV>; + assigned-clock-rates = <0>, <884736000>, <12288000>; + }; +diff --git a/arch/arm/boot/dts/imx7s-warp.dts b/arch/arm/boot/dts/imx7s-warp.dts +index d6b4888fa686..e035dd5bf4f6 100644 +--- a/arch/arm/boot/dts/imx7s-warp.dts ++++ b/arch/arm/boot/dts/imx7s-warp.dts +@@ -75,7 +75,7 @@ + + dailink_master: simple-audio-card,codec { + sound-dai = <&codec>; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + }; + }; + }; +@@ -232,7 +232,7 @@ + #sound-dai-cells = <0>; + reg = <0x0a>; + compatible = "fsl,sgtl5000"; +- clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_CLK>; ++ clocks = <&clks IMX7D_AUDIO_MCLK_ROOT_DIV>; + pinctrl-names = "default"; + pinctrl-0 = <&pinctrl_sai1_mclk>; + VDDA-supply = <&vgen4_reg>; +-- +2.34.1 + diff --git a/queue-5.10/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch b/queue-5.10/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch new file mode 100644 index 00000000000..6b644a9b4ae --- /dev/null +++ b/queue-5.10/arm-dts-qcom-fix-gic_irq_domain_translate-warnings-f.patch @@ -0,0 +1,60 @@ +From c9f43af7b38199864ac297d9b4f4a1e4de78f1dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jan 2022 18:42:28 +0100 +Subject: ARM: dts: qcom: fix gic_irq_domain_translate warnings for msm8960 + +From: David Heidelberg + +[ Upstream commit 6f7e221e7a5cfc3299616543fce42b36e631497b ] + +IRQ types blindly copied from very similar APQ8064. + +Fixes warnings as: +WARNING: CPU: 0 PID: 1 at drivers/irqchip/irq-gic.c:1080 gic_irq_domain_translate+0x118/0x120 +... + +Tested-by: LogicalErzor # boot-tested on Samsung S3 +Signed-off-by: David Heidelberg +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220108174229.60384-1-david@ixit.cz +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-msm8960.dtsi | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/qcom-msm8960.dtsi b/arch/arm/boot/dts/qcom-msm8960.dtsi +index 172ea3c70eac..c197927e7435 100644 +--- a/arch/arm/boot/dts/qcom-msm8960.dtsi ++++ b/arch/arm/boot/dts/qcom-msm8960.dtsi +@@ -146,7 +146,9 @@ + reg = <0x108000 0x1000>; + qcom,ipc = <&l2cc 0x8 2>; + +- interrupts = <0 19 0>, <0 21 0>, <0 22 0>; ++ interrupts = , ++ , ++ ; + interrupt-names = "ack", "err", "wakeup"; + + regulators { +@@ -192,7 +194,7 @@ + compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm"; + reg = <0x16440000 0x1000>, + <0x16400000 0x1000>; +- interrupts = <0 154 0x0>; ++ interrupts = ; + clocks = <&gcc GSBI5_UART_CLK>, <&gcc GSBI5_H_CLK>; + clock-names = "core", "iface"; + status = "disabled"; +@@ -318,7 +320,7 @@ + #address-cells = <1>; + #size-cells = <0>; + reg = <0x16080000 0x1000>; +- interrupts = <0 147 0>; ++ interrupts = ; + spi-max-frequency = <24000000>; + cs-gpios = <&msmgpio 8 0>; + +-- +2.34.1 + diff --git a/queue-5.10/arm-dts-qcom-ipq4019-fix-sleep-clock.patch b/queue-5.10/arm-dts-qcom-ipq4019-fix-sleep-clock.patch new file mode 100644 index 00000000000..c9134ebdad4 --- /dev/null +++ b/queue-5.10/arm-dts-qcom-ipq4019-fix-sleep-clock.patch @@ -0,0 +1,42 @@ +From 2a0dec176587982a979f2983afda942806a0bb7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Dec 2021 18:03:52 +0100 +Subject: ARM: dts: qcom: ipq4019: fix sleep clock + +From: Pavel Kubelun + +[ Upstream commit 3d7e7980993d2c1ae42d3d314040fc2de6a9c45f ] + +It seems like sleep_clk was copied from ipq806x. +Fix ipq40xx sleep_clk to the value QSDK defines. + +Link: https://source.codeaurora.org/quic/qsdk/oss/kernel/linux-msm/commit/?id=d92ec59973484acc86dd24b67f10f8911b4b4b7d +Link: https://patchwork.kernel.org/comment/22721613/ +Fixes: bec6ba4cdf2a ("qcom: ipq4019: Add basic board/dts support for IPQ4019 SoC") +Suggested-by: Bjorn Andersson (clock-output-names) +Signed-off-by: Pavel Kubelun +Signed-off-by: Christian Lamparter (removed clock rename) +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211220170352.34591-1-chunkeey@gmail.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/qcom-ipq4019.dtsi | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi +index 74d8e2c8e4b3..3defd47fd8fa 100644 +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -142,7 +142,8 @@ + clocks { + sleep_clk: sleep_clk { + compatible = "fixed-clock"; +- clock-frequency = <32768>; ++ clock-frequency = <32000>; ++ clock-output-names = "gcc_sleep_clk_src"; + #clock-cells = <0>; + }; + +-- +2.34.1 + diff --git a/queue-5.10/arm-dts-sun8i-v3s-move-the-csi1-block-to-follow-addr.patch b/queue-5.10/arm-dts-sun8i-v3s-move-the-csi1-block-to-follow-addr.patch new file mode 100644 index 00000000000..c2085714450 --- /dev/null +++ b/queue-5.10/arm-dts-sun8i-v3s-move-the-csi1-block-to-follow-addr.patch @@ -0,0 +1,64 @@ +From a83c235c96bf9069154a561571f3fea765fe36bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Feb 2022 19:53:24 +0100 +Subject: ARM: dts: sun8i: v3s: Move the csi1 block to follow address order + +From: Paul Kocialkowski + +[ Upstream commit c4af51698c4fb4fc683f2ac67f482cdf9ba2cd13 ] + +The csi1 block node was mistakenly added before the gic node, although +its address comes after the gic's. Move the node to its correct +position. + +Fixes: 90e048101fa1 ("ARM: dts: sun8i: V3/V3s/S3/S3L: add CSI1 device node") +Signed-off-by: Paul Kocialkowski +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20220205185429.2278860-2-paul.kocialkowski@bootlin.com +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/sun8i-v3s.dtsi | 22 +++++++++++----------- + 1 file changed, 11 insertions(+), 11 deletions(-) + +diff --git a/arch/arm/boot/dts/sun8i-v3s.dtsi b/arch/arm/boot/dts/sun8i-v3s.dtsi +index 89abd4cc7e23..b21ecb820b13 100644 +--- a/arch/arm/boot/dts/sun8i-v3s.dtsi ++++ b/arch/arm/boot/dts/sun8i-v3s.dtsi +@@ -524,6 +524,17 @@ + #size-cells = <0>; + }; + ++ gic: interrupt-controller@1c81000 { ++ compatible = "arm,gic-400"; ++ reg = <0x01c81000 0x1000>, ++ <0x01c82000 0x2000>, ++ <0x01c84000 0x2000>, ++ <0x01c86000 0x2000>; ++ interrupt-controller; ++ #interrupt-cells = <3>; ++ interrupts = ; ++ }; ++ + csi1: camera@1cb4000 { + compatible = "allwinner,sun8i-v3s-csi"; + reg = <0x01cb4000 0x3000>; +@@ -535,16 +546,5 @@ + resets = <&ccu RST_BUS_CSI>; + status = "disabled"; + }; +- +- gic: interrupt-controller@1c81000 { +- compatible = "arm,gic-400"; +- reg = <0x01c81000 0x1000>, +- <0x01c82000 0x2000>, +- <0x01c84000 0x2000>, +- <0x01c86000 0x2000>; +- interrupt-controller; +- #interrupt-cells = <3>; +- interrupts = ; +- }; + }; + }; +-- +2.34.1 + diff --git a/queue-5.10/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch b/queue-5.10/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch new file mode 100644 index 00000000000..5e452aa71cb --- /dev/null +++ b/queue-5.10/arm-ftrace-avoid-redundant-loads-or-clobbering-ip.patch @@ -0,0 +1,135 @@ +From 28bd628693f704cdbd74b3c10e1d06520bc72efa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jan 2022 20:18:33 +0100 +Subject: ARM: ftrace: avoid redundant loads or clobbering IP + +From: Ard Biesheuvel + +[ Upstream commit d11967870815b5ab89843980e35aab616c97c463 ] + +Tweak the ftrace return paths to avoid redundant loads of SP, as well as +unnecessary clobbering of IP. + +This also fixes the inconsistency of using MOV to perform a function +return, which is sub-optimal on recent micro-architectures but more +importantly, does not perform an interworking return, unlike compiler +generated function returns in Thumb2 builds. + +Let's fix this by popping PC from the stack like most ordinary code +does. + +Signed-off-by: Ard Biesheuvel +Reviewed-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/entry-ftrace.S | 51 +++++++++++++++------------------- + 1 file changed, 22 insertions(+), 29 deletions(-) + +diff --git a/arch/arm/kernel/entry-ftrace.S b/arch/arm/kernel/entry-ftrace.S +index f4886fb6e9ba..f33c171e3090 100644 +--- a/arch/arm/kernel/entry-ftrace.S ++++ b/arch/arm/kernel/entry-ftrace.S +@@ -22,10 +22,7 @@ + * mcount can be thought of as a function called in the middle of a subroutine + * call. As such, it needs to be transparent for both the caller and the + * callee: the original lr needs to be restored when leaving mcount, and no +- * registers should be clobbered. (In the __gnu_mcount_nc implementation, we +- * clobber the ip register. This is OK because the ARM calling convention +- * allows it to be clobbered in subroutines and doesn't use it to hold +- * parameters.) ++ * registers should be clobbered. + * + * When using dynamic ftrace, we patch out the mcount call by a "pop {lr}" + * instead of the __gnu_mcount_nc call (see arch/arm/kernel/ftrace.c). +@@ -70,26 +67,25 @@ + + .macro __ftrace_regs_caller + +- sub sp, sp, #8 @ space for PC and CPSR OLD_R0, ++ str lr, [sp, #-8]! @ store LR as PC and make space for CPSR/OLD_R0, + @ OLD_R0 will overwrite previous LR + +- add ip, sp, #12 @ move in IP the value of SP as it was +- @ before the push {lr} of the mcount mechanism ++ ldr lr, [sp, #8] @ get previous LR + +- str lr, [sp, #0] @ store LR instead of PC ++ str r0, [sp, #8] @ write r0 as OLD_R0 over previous LR + +- ldr lr, [sp, #8] @ get previous LR ++ str lr, [sp, #-4]! @ store previous LR as LR + +- str r0, [sp, #8] @ write r0 as OLD_R0 over previous LR ++ add lr, sp, #16 @ move in LR the value of SP as it was ++ @ before the push {lr} of the mcount mechanism + +- stmdb sp!, {ip, lr} +- stmdb sp!, {r0-r11, lr} ++ push {r0-r11, ip, lr} + + @ stack content at this point: + @ 0 4 48 52 56 60 64 68 72 +- @ R0 | R1 | ... | LR | SP + 4 | previous LR | LR | PSR | OLD_R0 | ++ @ R0 | R1 | ... | IP | SP + 4 | previous LR | LR | PSR | OLD_R0 | + +- mov r3, sp @ struct pt_regs* ++ mov r3, sp @ struct pt_regs* + + ldr r2, =function_trace_op + ldr r2, [r2] @ pointer to the current +@@ -112,11 +108,9 @@ ftrace_graph_regs_call: + #endif + + @ pop saved regs +- ldmia sp!, {r0-r12} @ restore r0 through r12 +- ldr ip, [sp, #8] @ restore PC +- ldr lr, [sp, #4] @ restore LR +- ldr sp, [sp, #0] @ restore SP +- mov pc, ip @ return ++ pop {r0-r11, ip, lr} @ restore r0 through r12 ++ ldr lr, [sp], #4 @ restore LR ++ ldr pc, [sp], #12 + .endm + + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +@@ -132,11 +126,9 @@ ftrace_graph_regs_call: + bl prepare_ftrace_return + + @ pop registers saved in ftrace_regs_caller +- ldmia sp!, {r0-r12} @ restore r0 through r12 +- ldr ip, [sp, #8] @ restore PC +- ldr lr, [sp, #4] @ restore LR +- ldr sp, [sp, #0] @ restore SP +- mov pc, ip @ return ++ pop {r0-r11, ip, lr} @ restore r0 through r12 ++ ldr lr, [sp], #4 @ restore LR ++ ldr pc, [sp], #12 + + .endm + #endif +@@ -202,16 +194,17 @@ ftrace_graph_call\suffix: + .endm + + .macro mcount_exit +- ldmia sp!, {r0-r3, ip, lr} +- ret ip ++ ldmia sp!, {r0-r3} ++ ldr lr, [sp, #4] ++ ldr pc, [sp], #8 + .endm + + ENTRY(__gnu_mcount_nc) + UNWIND(.fnstart) + #ifdef CONFIG_DYNAMIC_FTRACE +- mov ip, lr +- ldmia sp!, {lr} +- ret ip ++ push {lr} ++ ldr lr, [sp, #4] ++ ldr pc, [sp], #8 + #else + __mcount + #endif +-- +2.34.1 + diff --git a/queue-5.10/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch b/queue-5.10/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch new file mode 100644 index 00000000000..442cea049b2 --- /dev/null +++ b/queue-5.10/arm-ftrace-ensure-that-adr-takes-the-thumb-bit-into-.patch @@ -0,0 +1,40 @@ +From 717f7718233c4bd781b6222e876979ae487c0c35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 10:38:15 +0100 +Subject: ARM: ftrace: ensure that ADR takes the Thumb bit into account + +From: Ard Biesheuvel + +[ Upstream commit dd88b03ff0c84f4bcbe1419b93a4bed429fed3be ] + +Using ADR to take the address of 'ftrace_stub' via a local label +produces an address that has the Thumb bit cleared, which means the +subsequent comparison is guaranteed to fail. Instead, use the badr +macro, which forces the Thumb bit to be set. + +Fixes: a3ba87a61499 ("ARM: 6316/1: ftrace: add Thumb-2 support") +Signed-off-by: Ard Biesheuvel +Reviewed-by: Nick Desaulniers +Reviewed-by: Steven Rostedt (Google) +Reviewed-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + arch/arm/kernel/entry-ftrace.S | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm/kernel/entry-ftrace.S b/arch/arm/kernel/entry-ftrace.S +index a74289ebc803..f4886fb6e9ba 100644 +--- a/arch/arm/kernel/entry-ftrace.S ++++ b/arch/arm/kernel/entry-ftrace.S +@@ -40,7 +40,7 @@ + mcount_enter + ldr r0, =ftrace_trace_function + ldr r2, [r0] +- adr r0, .Lftrace_stub ++ badr r0, .Lftrace_stub + cmp r0, r2 + bne 1f + +-- +2.34.1 + diff --git a/queue-5.10/arm-mmp-fix-failure-to-remove-sram-device.patch b/queue-5.10/arm-mmp-fix-failure-to-remove-sram-device.patch new file mode 100644 index 00000000000..49ae691ff48 --- /dev/null +++ b/queue-5.10/arm-mmp-fix-failure-to-remove-sram-device.patch @@ -0,0 +1,79 @@ +From e45173403b0d880bc7c6f477224f0c61086bde5f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 26 Jul 2021 22:01:58 +0200 +Subject: ARM: mmp: Fix failure to remove sram device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Uwe Kleine-König + +[ Upstream commit 4036b29a146b2749af3bb213b003eb69f3e5ecc4 ] + +Make sure in .probe() to set driver data before the function is left to +make it possible in .remove() to undo the actions done. + +This fixes a potential memory leak and stops returning an error code in +.remove() that is ignored by the driver core anyhow. + +Signed-off-by: Uwe Kleine-König +Reviewed-by: Greg Kroah-Hartman +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-mmp/sram.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/arch/arm/mach-mmp/sram.c b/arch/arm/mach-mmp/sram.c +index 6794e2db1ad5..ecc46c31004f 100644 +--- a/arch/arm/mach-mmp/sram.c ++++ b/arch/arm/mach-mmp/sram.c +@@ -72,6 +72,8 @@ static int sram_probe(struct platform_device *pdev) + if (!info) + return -ENOMEM; + ++ platform_set_drvdata(pdev, info); ++ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (res == NULL) { + dev_err(&pdev->dev, "no memory resource defined\n"); +@@ -107,8 +109,6 @@ static int sram_probe(struct platform_device *pdev) + list_add(&info->node, &sram_bank_list); + mutex_unlock(&sram_lock); + +- platform_set_drvdata(pdev, info); +- + dev_info(&pdev->dev, "initialized\n"); + return 0; + +@@ -127,17 +127,19 @@ static int sram_remove(struct platform_device *pdev) + struct sram_bank_info *info; + + info = platform_get_drvdata(pdev); +- if (info == NULL) +- return -ENODEV; + +- mutex_lock(&sram_lock); +- list_del(&info->node); +- mutex_unlock(&sram_lock); ++ if (info->sram_size) { ++ mutex_lock(&sram_lock); ++ list_del(&info->node); ++ mutex_unlock(&sram_lock); ++ ++ gen_pool_destroy(info->gpool); ++ iounmap(info->sram_virt); ++ kfree(info->pool_name); ++ } + +- gen_pool_destroy(info->gpool); +- iounmap(info->sram_virt); +- kfree(info->pool_name); + kfree(info); ++ + return 0; + } + +-- +2.34.1 + diff --git a/queue-5.10/arm-tegra-tamonten-fix-i2c3-pad-setting.patch b/queue-5.10/arm-tegra-tamonten-fix-i2c3-pad-setting.patch new file mode 100644 index 00000000000..1c3b879f140 --- /dev/null +++ b/queue-5.10/arm-tegra-tamonten-fix-i2c3-pad-setting.patch @@ -0,0 +1,46 @@ +From 34d0cb3b574d5cceec8609ead464041ccd4b91d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 1 Dec 2021 17:11:48 +0100 +Subject: ARM: tegra: tamonten: Fix I2C3 pad setting + +From: Richard Leitner + +[ Upstream commit 0092c25b541a5422d7e71892a13c55ee91abc34b ] + +This patch fixes the tristate configuration for i2c3 function assigned +to the dtf pins on the Tamonten Tegra20 SoM. + +Signed-off-by: Richard Leitner +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/tegra20-tamonten.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi +index dd4d506683de..7f14f0d005c3 100644 +--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi ++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi +@@ -183,8 +183,8 @@ + }; + conf_ata { + nvidia,pins = "ata", "atb", "atc", "atd", "ate", +- "cdev1", "cdev2", "dap1", "dtb", "gma", +- "gmb", "gmc", "gmd", "gme", "gpu7", ++ "cdev1", "cdev2", "dap1", "dtb", "dtf", ++ "gma", "gmb", "gmc", "gmd", "gme", "gpu7", + "gpv", "i2cp", "irrx", "irtx", "pta", + "rm", "slxa", "slxk", "spia", "spib", + "uac"; +@@ -203,7 +203,7 @@ + }; + conf_crtp { + nvidia,pins = "crtp", "dap2", "dap3", "dap4", +- "dtc", "dte", "dtf", "gpu", "sdio1", ++ "dtc", "dte", "gpu", "sdio1", + "slxc", "slxd", "spdi", "spdo", "spig", + "uda"; + nvidia,pull = ; +-- +2.34.1 + diff --git a/queue-5.10/arm64-defconfig-build-imx-sdma-as-a-module.patch b/queue-5.10/arm64-defconfig-build-imx-sdma-as-a-module.patch new file mode 100644 index 00000000000..e1359dfc8a6 --- /dev/null +++ b/queue-5.10/arm64-defconfig-build-imx-sdma-as-a-module.patch @@ -0,0 +1,39 @@ +From f209a63d5ae24f8666c8a95773860eb53d0d3314 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jan 2022 17:00:56 +0100 +Subject: arm64: defconfig: build imx-sdma as a module + +From: Marcel Ziswiler + +[ Upstream commit e95622289f263662240544a9f0009b25c19e64d4 ] + +This avoids firmware load error and sysfs fallback reported as follows: + +[ 0.199448] imx-sdma 302c0000.dma-controller: Direct firmware load + for imx/sdma/sdma-imx7d.bin failed with error -2 +[ 0.199487] imx-sdma 302c0000.dma-controller: Falling back to sysfs + fallback for: imx/sdma/sdma-imx7d.bin + +Signed-off-by: Marcel Ziswiler +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm64/configs/defconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig +index 5cfe3cf6f2ac..2bdf38d05fa5 100644 +--- a/arch/arm64/configs/defconfig ++++ b/arch/arm64/configs/defconfig +@@ -837,7 +837,7 @@ CONFIG_DMADEVICES=y + CONFIG_DMA_BCM2835=y + CONFIG_DMA_SUN6I=m + CONFIG_FSL_EDMA=y +-CONFIG_IMX_SDMA=y ++CONFIG_IMX_SDMA=m + CONFIG_K3_DMA=y + CONFIG_MV_XOR=y + CONFIG_MV_XOR_V2=y +-- +2.34.1 + diff --git a/queue-5.10/arm64-dts-broadcom-fix-sata-nodename.patch b/queue-5.10/arm64-dts-broadcom-fix-sata-nodename.patch new file mode 100644 index 00000000000..ad2650edfe0 --- /dev/null +++ b/queue-5.10/arm64-dts-broadcom-fix-sata-nodename.patch @@ -0,0 +1,41 @@ +From dc9161d540532f7ca77d64c5ba36d2a251bb20c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 16:24:18 +0100 +Subject: arm64: dts: broadcom: Fix sata nodename + +From: Frank Wunderlich + +[ Upstream commit 55927cb44db43a57699fa652e2437a91620385dc ] + +After converting ahci-platform txt binding to yaml nodename is reported +as not matching the standard: + +arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dt.yaml: +ahci@663f2000: $nodename:0: 'ahci@663f2000' does not match '^sata(@.*)?$' + +Fix it to match binding. + +Fixes: ac9aae00f0fc ("arm64: dts: Add SATA3 AHCI and SATA3 PHY DT nodes for NS2") +Signed-off-by: Frank Wunderlich +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +index 2cfeaf3b0a87..8c218689fef7 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +@@ -687,7 +687,7 @@ + }; + }; + +- sata: ahci@663f2000 { ++ sata: sata@663f2000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; + reg = <0x663f2000 0x1000>; + dma-coherent; +-- +2.34.1 + diff --git a/queue-5.10/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch b/queue-5.10/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch new file mode 100644 index 00000000000..dfd4ec02a81 --- /dev/null +++ b/queue-5.10/arm64-dts-ns2-fix-spi-cpol-and-spi-cpha-property.patch @@ -0,0 +1,52 @@ +From 2d784caeeab0050ee189b3b70c7569b20276b2f6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 16:39:03 +0530 +Subject: arm64: dts: ns2: Fix spi-cpol and spi-cpha property + +From: Kuldeep Singh + +[ Upstream commit c953c764e505428f59ffe6afb1c73b89b5b1ac35 ] + +Broadcom ns2 platform has spi-cpol and spi-cpho properties set +incorrectly. As per spi-slave-peripheral-prop.yaml, these properties are +of flag or boolean type and not integer type. Fix the values. + +Fixes: d69dbd9f41a7c (arm64: dts: Add ARM PL022 SPI DT nodes for NS2) +Signed-off-by: Kuldeep Singh +CC: Ray Jui +CC: Scott Branden +CC: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts +index ec19fbf928a1..12a4b1c03390 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts +@@ -111,8 +111,8 @@ + compatible = "silabs,si3226x"; + reg = <0>; + spi-max-frequency = <5000000>; +- spi-cpha = <1>; +- spi-cpol = <1>; ++ spi-cpha; ++ spi-cpol; + pl022,hierarchy = <0>; + pl022,interface = <0>; + pl022,slave-tx-disable = <0>; +@@ -135,8 +135,8 @@ + at25,byte-len = <0x8000>; + at25,addr-mode = <2>; + at25,page-size = <64>; +- spi-cpha = <1>; +- spi-cpol = <1>; ++ spi-cpha; ++ spi-cpol; + pl022,hierarchy = <0>; + pl022,interface = <0>; + pl022,slave-tx-disable = <0>; +-- +2.34.1 + diff --git a/queue-5.10/arm64-dts-qcom-sdm845-fix-microphone-bias-properties.patch b/queue-5.10/arm64-dts-qcom-sdm845-fix-microphone-bias-properties.patch new file mode 100644 index 00000000000..aeed4b9c3a5 --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-sdm845-fix-microphone-bias-properties.patch @@ -0,0 +1,58 @@ +From 891dc443914576ef5d8c21f998f0d8ebb7697527 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 13 Dec 2021 20:51:04 +0100 +Subject: arm64: dts: qcom: sdm845: fix microphone bias properties and values + +From: David Heidelberg + +[ Upstream commit 625c24460dbbc3b6c9a148c0a30f0830893fc909 ] + +replace millivolt with correct microvolt and adjust value to +the minimal value allowed by documentation. + +Found with `make qcom/sdm845-oneplus-fajita.dtb`. + +Fixes: +arch/arm64/boot/dts/qcom/sdm845-oneplus-fajita.dt.yaml: codec@1: 'qcom,micbias1-microvolt' is a required property + From schema: Documentation/devicetree/bindings/sound/qcom,wcd934x.yaml +arch/arm64/boot/dts/qcom/sdm845-oneplus-fajita.dt.yaml: codec@1: 'qcom,micbias2-microvolt' is a required property + From schema: Documentation/devicetree/bindings/sound/qcom,wcd934x.yaml +arch/arm64/boot/dts/qcom/sdm845-oneplus-fajita.dt.yaml: codec@1: 'qcom,micbias3-microvolt' is a required property + From schema: Documentation/devicetree/bindings/sound/qcom,wcd934x.yaml +arch/arm64/boot/dts/qcom/sdm845-oneplus-fajita.dt.yaml: codec@1: 'qcom,micbias4-microvolt' is a required property + From schema: Documentation/devicetree/bindings/sound/qcom,wcd934x.yaml +arch/arm64/boot/dts/qcom/sdm845-oneplus-fajita.dt.yaml: codec@1: 'qcom,micbias1-millivolt', 'qcom,micbias2-millivolt', 'qcom,micbias3-millivolt', 'qcom,micbias4-millivolt' do not match any of the regexes: '^.*@[0-9a-f]+$', 'pinctrl-[0-9]+' + +Fixes: 27ca1de07dc3 ("arm64: dts: qcom: sdm845: add slimbus nodes") + +Signed-off-by: David Heidelberg +Tested-by: Steev Klimaszewski +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211213195105.114596-1-david@ixit.cz +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sdm845.dtsi | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi +index ea6e3a11e641..9beb3c34fcdb 100644 +--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi ++++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi +@@ -3406,10 +3406,10 @@ + #clock-cells = <0>; + clock-frequency = <9600000>; + clock-output-names = "mclk"; +- qcom,micbias1-millivolt = <1800>; +- qcom,micbias2-millivolt = <1800>; +- qcom,micbias3-millivolt = <1800>; +- qcom,micbias4-millivolt = <1800>; ++ qcom,micbias1-microvolt = <1800000>; ++ qcom,micbias2-microvolt = <1800000>; ++ qcom,micbias3-microvolt = <1800000>; ++ qcom,micbias4-microvolt = <1800000>; + + #address-cells = <1>; + #size-cells = <1>; +-- +2.34.1 + diff --git a/queue-5.10/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch b/queue-5.10/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch new file mode 100644 index 00000000000..d0b66a452b1 --- /dev/null +++ b/queue-5.10/arm64-dts-qcom-sm8150-correct-tcs-configuration-for-.patch @@ -0,0 +1,41 @@ +From 0bf5360adaeb5dd36ef908363b0b36209a4d6af7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jan 2022 22:54:58 +0530 +Subject: arm64: dts: qcom: sm8150: Correct TCS configuration for apps rsc + +From: Maulik Shah + +[ Upstream commit 17ac8af678b6da6a8f1df7da8ebf2c5198741827 ] + +Correct the TCS config by updating the number of TCSes for each type. + +Cc: devicetree@vger.kernel.org +Fixes: d8cf9372b654 ("arm64: dts: qcom: sm8150: Add apps shared nodes") +Signed-off-by: Maulik Shah +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/1641749107-31979-2-git-send-email-quic_mkshah@quicinc.com +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/qcom/sm8150.dtsi | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi +index 1aec54590a11..a8a47378ba68 100644 +--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi ++++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi +@@ -1114,9 +1114,9 @@ + qcom,tcs-offset = <0xd00>; + qcom,drv-id = <2>; + qcom,tcs-config = , +- , +- , +- ; ++ , ++ , ++ ; + + rpmhcc: clock-controller { + compatible = "qcom,sm8150-rpmh-clk"; +-- +2.34.1 + diff --git a/queue-5.10/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch b/queue-5.10/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch new file mode 100644 index 00000000000..f5ef04ca49e --- /dev/null +++ b/queue-5.10/arm64-dts-rockchip-fix-sdio-regulator-supply-propert.patch @@ -0,0 +1,40 @@ +From 7cd510ba41ae9d9ecc387883b89b182e3268ff3c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 14:25:58 -0600 +Subject: arm64: dts: rockchip: Fix SDIO regulator supply properties on + rk3399-firefly + +From: Rob Herring + +[ Upstream commit 37cbd3c522869247ed4525b5042ff4c6a276c813 ] + +A label reference without brackets is a path string, not a phandle as +intended. Add the missing brackets. + +Fixes: a5002c41c383 ("arm64: dts: rockchip: add WiFi module support for Firefly-RK3399") +Signed-off-by: Rob Herring +Link: https://lore.kernel.org/r/20220304202559.317749-1-robh@kernel.org +Signed-off-by: Heiko Stuebner +Signed-off-by: Sasha Levin +--- + arch/arm64/boot/dts/rockchip/rk3399-firefly.dts | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts +index 6db18808b9c5..dc45ec372ada 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-firefly.dts +@@ -665,8 +665,8 @@ + sd-uhs-sdr104; + + /* Power supply */ +- vqmmc-supply = &vcc1v8_s3; /* IO line */ +- vmmc-supply = &vcc_sdio; /* card's power */ ++ vqmmc-supply = <&vcc1v8_s3>; /* IO line */ ++ vmmc-supply = <&vcc_sdio>; /* card's power */ + + #address-cells = <1>; + #size-cells = <0>; +-- +2.34.1 + diff --git a/queue-5.10/arm64-mm-avoid-fixmap-race-condition-when-create-pud.patch b/queue-5.10/arm64-mm-avoid-fixmap-race-condition-when-create-pud.patch new file mode 100644 index 00000000000..35fcf31e0bd --- /dev/null +++ b/queue-5.10/arm64-mm-avoid-fixmap-race-condition-when-create-pud.patch @@ -0,0 +1,75 @@ +From 40dc70e76cc5c9747eaff673c49bcabd743ccfdc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Feb 2022 19:44:00 +0800 +Subject: arm64/mm: avoid fixmap race condition when create pud mapping + +From: Jianyong Wu + +[ Upstream commit ee017ee353506fcec58e481673e4331ff198a80e ] + +The 'fixmap' is a global resource and is used recursively by +create pud mapping(), leading to a potential race condition in the +presence of a concurrent call to alloc_init_pud(): + +kernel_init thread virtio-mem workqueue thread +================== =========================== + + alloc_init_pud(...) alloc_init_pud(...) + pudp = pud_set_fixmap_offset(...) pudp = pud_set_fixmap_offset(...) + READ_ONCE(*pudp) + pud_clear_fixmap(...) + READ_ONCE(*pudp) // CRASH! + +As kernel may sleep during creating pud mapping, introduce a mutex lock to +serialise use of the fixmap entries by alloc_init_pud(). However, there is +no need for locking in early boot stage and it doesn't work well with +KASLR enabled when early boot. So, enable lock when system_state doesn't +equal to "SYSTEM_BOOTING". + +Signed-off-by: Jianyong Wu +Reviewed-by: Catalin Marinas +Fixes: f4710445458c ("arm64: mm: use fixmap when creating page tables") +Link: https://lore.kernel.org/r/20220201114400.56885-1-jianyong.wu@arm.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/mm/mmu.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index 991e599f7057..a9ec8c739d37 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -61,6 +61,7 @@ static pmd_t bm_pmd[PTRS_PER_PMD] __page_aligned_bss __maybe_unused; + static pud_t bm_pud[PTRS_PER_PUD] __page_aligned_bss __maybe_unused; + + static DEFINE_SPINLOCK(swapper_pgdir_lock); ++static DEFINE_MUTEX(fixmap_lock); + + void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd) + { +@@ -314,6 +315,12 @@ static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end, + } + BUG_ON(p4d_bad(p4d)); + ++ /* ++ * No need for locking during early boot. And it doesn't work as ++ * expected with KASLR enabled. ++ */ ++ if (system_state != SYSTEM_BOOTING) ++ mutex_lock(&fixmap_lock); + pudp = pud_set_fixmap_offset(p4dp, addr); + do { + pud_t old_pud = READ_ONCE(*pudp); +@@ -344,6 +351,8 @@ static void alloc_init_pud(pgd_t *pgdp, unsigned long addr, unsigned long end, + } while (pudp++, addr = next, addr != end); + + pud_clear_fixmap(); ++ if (system_state != SYSTEM_BOOTING) ++ mutex_unlock(&fixmap_lock); + } + + static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys, +-- +2.34.1 + diff --git a/queue-5.10/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch b/queue-5.10/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch new file mode 100644 index 00000000000..b94a65640b9 --- /dev/null +++ b/queue-5.10/asoc-atmel-add-missing-of_node_put-in-at91sam9g20ek_.patch @@ -0,0 +1,38 @@ +From e91331f3907cddb29605d752db364427ac19fcd0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 12:45:39 +0000 +Subject: ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe + +From: Miaoqian Lin + +[ Upstream commit f590797fa3c1bccdd19e55441592a23b46aef449 ] + +This node pointer is returned by of_parse_phandle() with refcount +incremented in this function. +Calling of_node_put() to avoid the refcount leak. + +Fixes: 531f67e41dcd ("ASoC: at91sam9g20ek-wm8731: convert to dt support") +Signed-off-by: Miaoqian Lin +Reviewed-by: Codrin Ciubotariu +Link: https://lore.kernel.org/r/20220307124539.1743-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/sam9g20_wm8731.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c +index ed1f69b57024..8a55d59a6c2a 100644 +--- a/sound/soc/atmel/sam9g20_wm8731.c ++++ b/sound/soc/atmel/sam9g20_wm8731.c +@@ -214,6 +214,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) + cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0); + if (!cpu_np) { + dev_err(&pdev->dev, "dai and pcm info missing\n"); ++ of_node_put(codec_np); + return -EINVAL; + } + at91sam9g20ek_dai.cpus->of_node = cpu_np; +-- +2.34.1 + diff --git a/queue-5.10/asoc-atmel-fix-error-handling-in-sam9x5_wm8731_drive.patch b/queue-5.10/asoc-atmel-fix-error-handling-in-sam9x5_wm8731_drive.patch new file mode 100644 index 00000000000..a33ff210de7 --- /dev/null +++ b/queue-5.10/asoc-atmel-fix-error-handling-in-sam9x5_wm8731_drive.patch @@ -0,0 +1,71 @@ +From ef22efb1b0cab1e604e4b74703682dc589b82ab0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 11:15:30 +0000 +Subject: ASoC: atmel: Fix error handling in sam9x5_wm8731_driver_probe + +From: Miaoqian Lin + +[ Upstream commit 740dc3e846537c3743da98bf106f376023fd085c ] + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. + +This function only calls of_node_put() in the regular path. +And it will cause refcount leak in error path. + +Fixes: fdbcb3cba54b ("ASoC: atmel: machine driver for at91sam9x5-wm8731 boards") +Signed-off-by: Miaoqian Lin +Reviewed-by: Codrin Ciubotariu +Link: https://lore.kernel.org/r/20220316111530.4551-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/sam9x5_wm8731.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/atmel/sam9x5_wm8731.c b/sound/soc/atmel/sam9x5_wm8731.c +index 7745250fd743..529604a06c53 100644 +--- a/sound/soc/atmel/sam9x5_wm8731.c ++++ b/sound/soc/atmel/sam9x5_wm8731.c +@@ -142,7 +142,7 @@ static int sam9x5_wm8731_driver_probe(struct platform_device *pdev) + if (!cpu_np) { + dev_err(&pdev->dev, "atmel,ssc-controller node missing\n"); + ret = -EINVAL; +- goto out; ++ goto out_put_codec_np; + } + dai->cpus->of_node = cpu_np; + dai->platforms->of_node = cpu_np; +@@ -153,12 +153,9 @@ static int sam9x5_wm8731_driver_probe(struct platform_device *pdev) + if (ret != 0) { + dev_err(&pdev->dev, "Failed to set SSC %d for audio: %d\n", + ret, priv->ssc_id); +- goto out; ++ goto out_put_cpu_np; + } + +- of_node_put(codec_np); +- of_node_put(cpu_np); +- + ret = devm_snd_soc_register_card(&pdev->dev, card); + if (ret) { + dev_err(&pdev->dev, "Platform device allocation failed\n"); +@@ -167,10 +164,14 @@ static int sam9x5_wm8731_driver_probe(struct platform_device *pdev) + + dev_dbg(&pdev->dev, "%s ok\n", __func__); + +- return ret; ++ goto out_put_cpu_np; + + out_put_audio: + atmel_ssc_put_audio(priv->ssc_id); ++out_put_cpu_np: ++ of_node_put(cpu_np); ++out_put_codec_np: ++ of_node_put(codec_np); + out: + return ret; + } +-- +2.34.1 + diff --git a/queue-5.10/asoc-atmel-sam9x5_wm8731-use-devm_snd_soc_register_c.patch b/queue-5.10/asoc-atmel-sam9x5_wm8731-use-devm_snd_soc_register_c.patch new file mode 100644 index 00000000000..7db38075544 --- /dev/null +++ b/queue-5.10/asoc-atmel-sam9x5_wm8731-use-devm_snd_soc_register_c.patch @@ -0,0 +1,44 @@ +From 6dd2efe093c91c9b201fabc1bcd61c7cbd93b162 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Jun 2021 22:16:19 +0800 +Subject: ASoC: atmel: sam9x5_wm8731: use devm_snd_soc_register_card() + +From: Yang Yingliang + +[ Upstream commit 6522a8486c00d130a32a57c6c8a365572958b4df ] + +Using devm_snd_soc_register_card() can make the code +shorter and cleaner. + +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210602141619.323286-1-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/sam9x5_wm8731.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/sound/soc/atmel/sam9x5_wm8731.c b/sound/soc/atmel/sam9x5_wm8731.c +index 9fbc3c1113cc..7745250fd743 100644 +--- a/sound/soc/atmel/sam9x5_wm8731.c ++++ b/sound/soc/atmel/sam9x5_wm8731.c +@@ -159,7 +159,7 @@ static int sam9x5_wm8731_driver_probe(struct platform_device *pdev) + of_node_put(codec_np); + of_node_put(cpu_np); + +- ret = snd_soc_register_card(card); ++ ret = devm_snd_soc_register_card(&pdev->dev, card); + if (ret) { + dev_err(&pdev->dev, "Platform device allocation failed\n"); + goto out_put_audio; +@@ -180,7 +180,6 @@ static int sam9x5_wm8731_driver_remove(struct platform_device *pdev) + struct snd_soc_card *card = platform_get_drvdata(pdev); + struct sam9x5_drvdata *priv = card->drvdata; + +- snd_soc_unregister_card(card); + atmel_ssc_put_audio(priv->ssc_id); + + return 0; +-- +2.34.1 + diff --git a/queue-5.10/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch b/queue-5.10/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch new file mode 100644 index 00000000000..6c0be31b0fd --- /dev/null +++ b/queue-5.10/asoc-atmel_ssc_dai-handle-errors-for-clk_enable.patch @@ -0,0 +1,40 @@ +From fb31e1961f14c85cab5fada9353296c9711aa7ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 17:06:37 +0800 +Subject: ASoC: atmel_ssc_dai: Handle errors for clk_enable + +From: Jiasheng Jiang + +[ Upstream commit f9e2ca0640e59d19af0ff285ee5591ed39069b09 ] + +As the potential failure of the clk_enable(), +it should be better to check it and return error if fals. + +Fixes: cbaadf0f90d6 ("ASoC: atmel_ssc_dai: refactor the startup and shutdown") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220301090637.3776558-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/atmel/atmel_ssc_dai.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c +index 6a63e8797a0b..97533412ce11 100644 +--- a/sound/soc/atmel/atmel_ssc_dai.c ++++ b/sound/soc/atmel/atmel_ssc_dai.c +@@ -280,7 +280,10 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream, + + /* Enable PMC peripheral clock for this SSC */ + pr_debug("atmel_ssc_dai: Starting clock\n"); +- clk_enable(ssc_p->ssc->clk); ++ ret = clk_enable(ssc_p->ssc->clk); ++ if (ret) ++ return ret; ++ + ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk); + + /* Reset the SSC unless initialized to keep it in a clean state */ +-- +2.34.1 + diff --git a/queue-5.10/asoc-codecs-wcd934x-add-missing-of_node_put-in-wcd93.patch b/queue-5.10/asoc-codecs-wcd934x-add-missing-of_node_put-in-wcd93.patch new file mode 100644 index 00000000000..2ea6b0237f7 --- /dev/null +++ b/queue-5.10/asoc-codecs-wcd934x-add-missing-of_node_put-in-wcd93.patch @@ -0,0 +1,39 @@ +From 2cf5d13289f646df22ee7bb9215bd51c33f80eac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 08:36:31 +0000 +Subject: ASoC: codecs: wcd934x: Add missing of_node_put() in + wcd934x_codec_parse_data + +From: Miaoqian Lin + +[ Upstream commit 9531a631379169d57756b2411178c6238655df88 ] + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. +This is similar to commit 64b92de9603f +("ASoC: wcd9335: fix a leaked reference by adding missing of_node_put") + +Fixes: a61f3b4f476e ("ASoC: wcd934x: add support to wcd9340/wcd9341 codec") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220316083631.14103-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd934x.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c +index f07dea0bc27e..8540ac230d0e 100644 +--- a/sound/soc/codecs/wcd934x.c ++++ b/sound/soc/codecs/wcd934x.c +@@ -5047,6 +5047,7 @@ static int wcd934x_codec_parse_data(struct wcd934x_codec *wcd) + } + + wcd->sidev = of_slim_get_device(wcd->sdev->ctrl, ifc_dev_np); ++ of_node_put(ifc_dev_np); + if (!wcd->sidev) { + dev_err(dev, "Unable to get SLIM Interface device\n"); + return -EINVAL; +-- +2.34.1 + diff --git a/queue-5.10/asoc-codecs-wcd934x-fix-return-value-of-wcd934x_rx_h.patch b/queue-5.10/asoc-codecs-wcd934x-fix-return-value-of-wcd934x_rx_h.patch new file mode 100644 index 00000000000..7006f5ff04e --- /dev/null +++ b/queue-5.10/asoc-codecs-wcd934x-fix-return-value-of-wcd934x_rx_h.patch @@ -0,0 +1,46 @@ +From e8b2ada19a8a1ebacce030b3827466ece4158171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 18:32:12 +0000 +Subject: ASoC: codecs: wcd934x: fix return value of wcd934x_rx_hph_mode_put + +From: Srinivas Kandagatla + +[ Upstream commit 4b0bec6088588a120d33db85b1f0d9f096d1df71 ] + +wcd934x_rx_hph_mode_put currently returns zero eventhough it changes the value. +Fix this, so that change notifications are sent correctly. + +Fixes: 1cde8b822332 ("ASoC: wcd934x: add basic controls") +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20220222183212.11580-10-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wcd934x.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/wcd934x.c b/sound/soc/codecs/wcd934x.c +index 01df3f4e045a..f07dea0bc27e 100644 +--- a/sound/soc/codecs/wcd934x.c ++++ b/sound/soc/codecs/wcd934x.c +@@ -2522,13 +2522,16 @@ static int wcd934x_rx_hph_mode_put(struct snd_kcontrol *kc, + + mode_val = ucontrol->value.enumerated.item[0]; + ++ if (mode_val == wcd->hph_mode) ++ return 0; ++ + if (mode_val == 0) { + dev_err(wcd->dev, "Invalid HPH Mode, default to ClSH HiFi\n"); + mode_val = CLS_H_LOHIFI; + } + wcd->hph_mode = mode_val; + +- return 0; ++ return 1; + } + + static int slim_rx_mux_get(struct snd_kcontrol *kc, +-- +2.34.1 + diff --git a/queue-5.10/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch b/queue-5.10/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch new file mode 100644 index 00000000000..12a90f14701 --- /dev/null +++ b/queue-5.10/asoc-dmaengine-do-not-use-a-null-prepare_slave_confi.patch @@ -0,0 +1,42 @@ +From f23e712a30b3a8cfc5cbc0e10b2319a57f608b93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 14:21:57 +0200 +Subject: ASoC: dmaengine: do not use a NULL prepare_slave_config() callback + +From: Codrin Ciubotariu + +[ Upstream commit 9a1e13440a4f2e7566fd4c5eae6a53e6400e08a4 ] + +Even if struct snd_dmaengine_pcm_config is used, prepare_slave_config() +callback might not be set. Check if this callback is set before using it. + +Fixes: fa654e085300 ("ASoC: dmaengine-pcm: Provide default config") +Signed-off-by: Codrin Ciubotariu +Link: https://lore.kernel.org/r/20220307122202.2251639-2-codrin.ciubotariu@microchip.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-generic-dmaengine-pcm.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c +index 9ef80a48707e..0d100b4e43f7 100644 +--- a/sound/soc/soc-generic-dmaengine-pcm.c ++++ b/sound/soc/soc-generic-dmaengine-pcm.c +@@ -83,10 +83,10 @@ static int dmaengine_pcm_hw_params(struct snd_soc_component *component, + + memset(&slave_config, 0, sizeof(slave_config)); + +- if (!pcm->config) +- prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; +- else ++ if (pcm->config && pcm->config->prepare_slave_config) + prepare_slave_config = pcm->config->prepare_slave_config; ++ else ++ prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; + + if (prepare_slave_config) { + ret = prepare_slave_config(substream, params, &slave_config); +-- +2.34.1 + diff --git a/queue-5.10/asoc-dwc-i2s-handle-errors-for-clk_enable.patch b/queue-5.10/asoc-dwc-i2s-handle-errors-for-clk_enable.patch new file mode 100644 index 00000000000..922392a9575 --- /dev/null +++ b/queue-5.10/asoc-dwc-i2s-handle-errors-for-clk_enable.patch @@ -0,0 +1,61 @@ +From fa5ca34e100348a0f8031739a97a2e91dc8fc914 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 16:47:42 +0800 +Subject: ASoC: dwc-i2s: Handle errors for clk_enable + +From: Jiasheng Jiang + +[ Upstream commit 45ea97d74313bae681328b0c36fa348036777644 ] + +As the potential failure of the clk_enable(), +it should be better to check it, as same as clk_prepare_enable(). + +Fixes: c9afc1834e81 ("ASoC: dwc: Disallow building designware_pcm as a module") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220301084742.3751939-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/dwc/dwc-i2s.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/dwc/dwc-i2s.c b/sound/soc/dwc/dwc-i2s.c +index fd4160289fac..36da0f01571a 100644 +--- a/sound/soc/dwc/dwc-i2s.c ++++ b/sound/soc/dwc/dwc-i2s.c +@@ -403,9 +403,13 @@ static int dw_i2s_runtime_suspend(struct device *dev) + static int dw_i2s_runtime_resume(struct device *dev) + { + struct dw_i2s_dev *dw_dev = dev_get_drvdata(dev); ++ int ret; + +- if (dw_dev->capability & DW_I2S_MASTER) +- clk_enable(dw_dev->clk); ++ if (dw_dev->capability & DW_I2S_MASTER) { ++ ret = clk_enable(dw_dev->clk); ++ if (ret) ++ return ret; ++ } + return 0; + } + +@@ -422,10 +426,13 @@ static int dw_i2s_resume(struct snd_soc_component *component) + { + struct dw_i2s_dev *dev = snd_soc_component_get_drvdata(component); + struct snd_soc_dai *dai; +- int stream; ++ int stream, ret; + +- if (dev->capability & DW_I2S_MASTER) +- clk_enable(dev->clk); ++ if (dev->capability & DW_I2S_MASTER) { ++ ret = clk_enable(dev->clk); ++ if (ret) ++ return ret; ++ } + + for_each_component_dais(component, dai) { + for_each_pcm_streams(stream) +-- +2.34.1 + diff --git a/queue-5.10/asoc-fsi-add-check-for-clk_enable.patch b/queue-5.10/asoc-fsi-add-check-for-clk_enable.patch new file mode 100644 index 00000000000..b8f956d383a --- /dev/null +++ b/queue-5.10/asoc-fsi-add-check-for-clk_enable.patch @@ -0,0 +1,60 @@ +From 561d6e26864e9e0225dc03c1e848fa3be6e4beb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 14:28:44 +0800 +Subject: ASoC: fsi: Add check for clk_enable + +From: Jiasheng Jiang + +[ Upstream commit 405afed8a728f23cfaa02f75bbc8bdd6b7322123 ] + +As the potential failure of the clk_enable(), +it should be better to check it and return error +if fails. + +Fixes: ab6f6d85210c ("ASoC: fsi: add master clock control functions") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220302062844.46869-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sh/fsi.c | 19 ++++++++++++++++--- + 1 file changed, 16 insertions(+), 3 deletions(-) + +diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c +index 3c574792231b..0fa72907d5bf 100644 +--- a/sound/soc/sh/fsi.c ++++ b/sound/soc/sh/fsi.c +@@ -816,14 +816,27 @@ static int fsi_clk_enable(struct device *dev, + return ret; + } + +- clk_enable(clock->xck); +- clk_enable(clock->ick); +- clk_enable(clock->div); ++ ret = clk_enable(clock->xck); ++ if (ret) ++ goto err; ++ ret = clk_enable(clock->ick); ++ if (ret) ++ goto disable_xck; ++ ret = clk_enable(clock->div); ++ if (ret) ++ goto disable_ick; + + clock->count++; + } + + return ret; ++ ++disable_ick: ++ clk_disable(clock->ick); ++disable_xck: ++ clk_disable(clock->xck); ++err: ++ return ret; + } + + static int fsi_clk_disable(struct device *dev, +-- +2.34.1 + diff --git a/queue-5.10/asoc-fsl_spdif-disable-tx-clock-when-stop.patch b/queue-5.10/asoc-fsl_spdif-disable-tx-clock-when-stop.patch new file mode 100644 index 00000000000..6e07d12ed07 --- /dev/null +++ b/queue-5.10/asoc-fsl_spdif-disable-tx-clock-when-stop.patch @@ -0,0 +1,41 @@ +From 7344e797e107890d8be1827b3e561bce2e601386 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Mar 2022 10:37:43 +0800 +Subject: ASoC: fsl_spdif: Disable TX clock when stop + +From: Shengjiu Wang + +[ Upstream commit 6ddf611219ba8f7c8fa0d26b39710a641e7d37a5 ] + +The TX clock source may be changed in next case, need to +disable it when stop, otherwise the TX may not work after +changing the clock source, error log is: + +aplay: pcm_write:2058: write error: Input/output error + +Fixes: a2388a498ad2 ("ASoC: fsl: Add S/PDIF CPU DAI driver") +Signed-off-by: Shengjiu Wang +Reviewed-by: Fabio Estevam +Link: https://lore.kernel.org/r/1646879863-27711-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/fsl_spdif.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/fsl/fsl_spdif.c b/sound/soc/fsl/fsl_spdif.c +index 15bcb0f38ec9..d01e8d516df1 100644 +--- a/sound/soc/fsl/fsl_spdif.c ++++ b/sound/soc/fsl/fsl_spdif.c +@@ -544,6 +544,8 @@ static void fsl_spdif_shutdown(struct snd_pcm_substream *substream, + mask = SCR_TXFIFO_AUTOSYNC_MASK | SCR_TXFIFO_CTRL_MASK | + SCR_TXSEL_MASK | SCR_USRC_SEL_MASK | + SCR_TXFIFO_FSEL_MASK; ++ /* Disable TX clock */ ++ regmap_update_bits(regmap, REG_SPDIF_STC, STC_TXCLK_ALL_EN_MASK, 0); + } else { + scr = SCR_RXFIFO_OFF | SCR_RXFIFO_CTL_ZERO; + mask = SCR_RXFIFO_FSEL_MASK | SCR_RXFIFO_AUTOSYNC_MASK| +-- +2.34.1 + diff --git a/queue-5.10/asoc-generic-simple-card-utils-remove-useless-assign.patch b/queue-5.10/asoc-generic-simple-card-utils-remove-useless-assign.patch new file mode 100644 index 00000000000..d11b38aaefa --- /dev/null +++ b/queue-5.10/asoc-generic-simple-card-utils-remove-useless-assign.patch @@ -0,0 +1,40 @@ +From 0a42fc09c7f5af0beaa5a1f1158fc72899aa2467 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 18 Feb 2021 16:19:21 -0600 +Subject: ASoC: generic: simple-card-utils: remove useless assignment + +From: Pierre-Louis Bossart + +[ Upstream commit bd029fc86834760276171bd2301d6c43e45a65b0 ] + +cppcheck warning: + +sound/soc/generic/simple-card-utils.c:258:10: style: Variable 'ret' is +assigned a value that is never used. [unreadVariable] + int ret = 0; + ^ + +Signed-off-by: Pierre-Louis Bossart +Link: https://lore.kernel.org/r/20210218221921.88991-7-pierre-louis.bossart@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/generic/simple-card-utils.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/generic/simple-card-utils.c b/sound/soc/generic/simple-card-utils.c +index 6cada4c1e283..d0d79f47bfdd 100644 +--- a/sound/soc/generic/simple-card-utils.c ++++ b/sound/soc/generic/simple-card-utils.c +@@ -255,7 +255,7 @@ int asoc_simple_hw_params(struct snd_pcm_substream *substream, + struct simple_dai_props *dai_props = + simple_priv_to_props(priv, rtd->num); + unsigned int mclk, mclk_fs = 0; +- int ret = 0; ++ int ret; + + if (dai_props->mclk_fs) + mclk_fs = dai_props->mclk_fs; +-- +2.34.1 + diff --git a/queue-5.10/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch b/queue-5.10/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch new file mode 100644 index 00000000000..fb06cf019d4 --- /dev/null +++ b/queue-5.10/asoc-imx-es8328-fix-error-return-code-in-imx_es8328_.patch @@ -0,0 +1,36 @@ +From 287d7b7c4d31526e0001b4af557ff2e009bb15ff Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Mar 2022 09:19:02 +0000 +Subject: ASoC: imx-es8328: Fix error return code in imx_es8328_probe() + +From: Wang Wensheng + +[ Upstream commit 3b891513f95cba3944e72c1139ea706d04f3781b ] + +Fix to return a negative error code from the error handling case instead +of 0, as done elsewhere in this function. + +Fixes: 7e7292dba215 ("ASoC: fsl: add imx-es8328 machine driver") +Signed-off-by: Wang Wensheng +Link: https://lore.kernel.org/r/20220310091902.129299-1-wangwensheng4@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/fsl/imx-es8328.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/fsl/imx-es8328.c b/sound/soc/fsl/imx-es8328.c +index fad1eb6253d5..9e602c345619 100644 +--- a/sound/soc/fsl/imx-es8328.c ++++ b/sound/soc/fsl/imx-es8328.c +@@ -87,6 +87,7 @@ static int imx_es8328_probe(struct platform_device *pdev) + if (int_port > MUX_PORT_MAX || int_port == 0) { + dev_err(dev, "mux-int-port: hardware only has %d mux ports\n", + MUX_PORT_MAX); ++ ret = -EINVAL; + goto fail; + } + +-- +2.34.1 + diff --git a/queue-5.10/asoc-madera-add-dependencies-on-mfd.patch b/queue-5.10/asoc-madera-add-dependencies-on-mfd.patch new file mode 100644 index 00000000000..7d2807361c1 --- /dev/null +++ b/queue-5.10/asoc-madera-add-dependencies-on-mfd.patch @@ -0,0 +1,60 @@ +From 8a0b2772ff0decdace550aea2285c1e10ad39f88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Feb 2022 11:50:25 +0000 +Subject: ASoC: madera: Add dependencies on MFD + +From: Charles Keepax + +[ Upstream commit ec29170c724ca30305fc3a19ba2ee73ecac65509 ] + +The Madera CODECs use regmap_irq functions but nothing ensures that +regmap_irq is built into the kernel. Add dependencies on the ASoC +symbols for the relevant MFD component. There is no point in building +the ASoC driver if the MFD doesn't support it and the MFD part contains +the necessary dependencies to ensure everything is built into the +kernel. + +Reported-by: Mark Brown +Signed-off-by: Charles Keepax +Link: https://lore.kernel.org/r/20220203115025.16464-1-ckeepax@opensource.cirrus.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/Kconfig | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig +index 34c6dd04b85a..52c89a6f54e9 100644 +--- a/sound/soc/codecs/Kconfig ++++ b/sound/soc/codecs/Kconfig +@@ -659,6 +659,7 @@ config SND_SOC_CS4349 + + config SND_SOC_CS47L15 + tristate ++ depends on MFD_CS47L15 + + config SND_SOC_CS47L24 + tristate +@@ -666,15 +667,19 @@ config SND_SOC_CS47L24 + + config SND_SOC_CS47L35 + tristate ++ depends on MFD_CS47L35 + + config SND_SOC_CS47L85 + tristate ++ depends on MFD_CS47L85 + + config SND_SOC_CS47L90 + tristate ++ depends on MFD_CS47L90 + + config SND_SOC_CS47L92 + tristate ++ depends on MFD_CS47L92 + + # Cirrus Logic Quad-Channel ADC + config SND_SOC_CS53L30 +-- +2.34.1 + diff --git a/queue-5.10/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch b/queue-5.10/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch new file mode 100644 index 00000000000..b6958f232e8 --- /dev/null +++ b/queue-5.10/asoc-msm8916-wcd-analog-fix-error-handling-in-pm8916.patch @@ -0,0 +1,80 @@ +From 5122031a72b69e71b5722f1b70f650cd0d7f7570 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 04:19:24 +0000 +Subject: ASoC: msm8916-wcd-analog: Fix error handling in + pm8916_wcd_analog_spmi_probe + +From: Miaoqian Lin + +[ Upstream commit 9ebd62d60edcd4d9c75485e5ccd0b79581ad3c49 ] + +In the error handling path, the clk_prepare_enable() function +call should be balanced by a corresponding 'clk_disable_unprepare()' +call , as already done in the remove function. + +Fixes: de66b3455023 ("ASoC: codecs: msm8916-wcd-analog: add MBHC support") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220316041924.17560-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/msm8916-wcd-analog.c | 22 ++++++++++++++++------ + 1 file changed, 16 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c +index 3ddd822240e3..971b8360b5b1 100644 +--- a/sound/soc/codecs/msm8916-wcd-analog.c ++++ b/sound/soc/codecs/msm8916-wcd-analog.c +@@ -1221,8 +1221,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + } + + irq = platform_get_irq_byname(pdev, "mbhc_switch_int"); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto err_disable_clk; ++ } + + ret = devm_request_threaded_irq(dev, irq, NULL, + pm8916_mbhc_switch_irq_handler, +@@ -1234,8 +1236,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + + if (priv->mbhc_btn_enabled) { + irq = platform_get_irq_byname(pdev, "mbhc_but_press_det"); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto err_disable_clk; ++ } + + ret = devm_request_threaded_irq(dev, irq, NULL, + mbhc_btn_press_irq_handler, +@@ -1246,8 +1250,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + dev_err(dev, "cannot request mbhc button press irq\n"); + + irq = platform_get_irq_byname(pdev, "mbhc_but_rel_det"); +- if (irq < 0) +- return irq; ++ if (irq < 0) { ++ ret = irq; ++ goto err_disable_clk; ++ } + + ret = devm_request_threaded_irq(dev, irq, NULL, + mbhc_btn_release_irq_handler, +@@ -1264,6 +1270,10 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + return devm_snd_soc_register_component(dev, &pm8916_wcd_analog, + pm8916_wcd_analog_dai, + ARRAY_SIZE(pm8916_wcd_analog_dai)); ++ ++err_disable_clk: ++ clk_disable_unprepare(priv->mclk); ++ return ret; + } + + static int pm8916_wcd_analog_spmi_remove(struct platform_device *pdev) +-- +2.34.1 + diff --git a/queue-5.10/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch b/queue-5.10/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch new file mode 100644 index 00000000000..4ced888f601 --- /dev/null +++ b/queue-5.10/asoc-msm8916-wcd-digital-fix-missing-clk_disable_unp.patch @@ -0,0 +1,48 @@ +From c10e1357fc434a1e22278aa08ca8b942e10c4059 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 08:45:22 +0000 +Subject: ASoC: msm8916-wcd-digital: Fix missing clk_disable_unprepare() in + msm8916_wcd_digital_probe + +From: Miaoqian Lin + +[ Upstream commit 375a347da4889f64d86e1ab7f4e6702b6e9bf299 ] + +Fix the missing clk_disable_unprepare() before return +from msm8916_wcd_digital_probe in the error handling case. + +Fixes: 150db8c5afa1 ("ASoC: codecs: Add msm8916-wcd digital codec") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220307084523.28687-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/msm8916-wcd-digital.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c +index fcc10c8bc625..9ad7fc0baf07 100644 +--- a/sound/soc/codecs/msm8916-wcd-digital.c ++++ b/sound/soc/codecs/msm8916-wcd-digital.c +@@ -1201,7 +1201,7 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) + ret = clk_prepare_enable(priv->mclk); + if (ret < 0) { + dev_err(dev, "failed to enable mclk %d\n", ret); +- return ret; ++ goto err_clk; + } + + dev_set_drvdata(dev, priv); +@@ -1209,6 +1209,9 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) + return devm_snd_soc_register_component(dev, &msm8916_wcd_digital, + msm8916_wcd_digital_dai, + ARRAY_SIZE(msm8916_wcd_digital_dai)); ++err_clk: ++ clk_disable_unprepare(priv->ahbclk); ++ return ret; + } + + static int msm8916_wcd_digital_remove(struct platform_device *pdev) +-- +2.34.1 + diff --git a/queue-5.10/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch b/queue-5.10/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch new file mode 100644 index 00000000000..3ae8d127b19 --- /dev/null +++ b/queue-5.10/asoc-mxs-fix-error-handling-in-mxs_sgtl5000_probe.patch @@ -0,0 +1,43 @@ +From f8a005eab4f96ff8b914e77b6105aff7db8a99ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 02:01:44 +0000 +Subject: ASoC: mxs: Fix error handling in mxs_sgtl5000_probe + +From: Miaoqian Lin + +[ Upstream commit 6ae0a4d8fec551ec581d620f0eb1fe31f755551c ] + +This function only calls of_node_put() in the regular path. +And it will cause refcount leak in error paths. +For example, when codec_np is NULL, saif_np[0] and saif_np[1] +are not NULL, it will cause leaks. + +of_node_put() will check if the node pointer is NULL, so we can +call it directly to release the refcount of regular pointers. + +Fixes: e968194b45c4 ("ASoC: mxs: add device tree support for mxs-sgtl5000") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220308020146.26496-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mxs/mxs-sgtl5000.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/sound/soc/mxs/mxs-sgtl5000.c b/sound/soc/mxs/mxs-sgtl5000.c +index a6407f4388de..fb721bc49949 100644 +--- a/sound/soc/mxs/mxs-sgtl5000.c ++++ b/sound/soc/mxs/mxs-sgtl5000.c +@@ -118,6 +118,9 @@ static int mxs_sgtl5000_probe(struct platform_device *pdev) + codec_np = of_parse_phandle(np, "audio-codec", 0); + if (!saif_np[0] || !saif_np[1] || !codec_np) { + dev_err(&pdev->dev, "phandle missing or invalid\n"); ++ of_node_put(codec_np); ++ of_node_put(saif_np[0]); ++ of_node_put(saif_np[1]); + return -EINVAL; + } + +-- +2.34.1 + diff --git a/queue-5.10/asoc-mxs-saif-handle-errors-for-clk_enable.patch b/queue-5.10/asoc-mxs-saif-handle-errors-for-clk_enable.patch new file mode 100644 index 00000000000..ead9c2f6df5 --- /dev/null +++ b/queue-5.10/asoc-mxs-saif-handle-errors-for-clk_enable.patch @@ -0,0 +1,40 @@ +From 6a603939cd63f04874201e7c9f4b9ae2aa7ed903 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 16:17:17 +0800 +Subject: ASoC: mxs-saif: Handle errors for clk_enable + +From: Jiasheng Jiang + +[ Upstream commit 2ecf362d220317debf5da376e0390e9f7a3f7b29 ] + +As the potential failure of the clk_enable(), +it should be better to check it, like mxs_saif_trigger(). + +Fixes: d0ba4c014934 ("ASoC: mxs-saif: set a base clock rate for EXTMASTER mode work") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220301081717.3727190-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/mxs/mxs-saif.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c +index 07f8cf9980e3..f2eda81985e2 100644 +--- a/sound/soc/mxs/mxs-saif.c ++++ b/sound/soc/mxs/mxs-saif.c +@@ -455,7 +455,10 @@ static int mxs_saif_hw_params(struct snd_pcm_substream *substream, + * basic clock which should be fast enough for the internal + * logic. + */ +- clk_enable(saif->clk); ++ ret = clk_enable(saif->clk); ++ if (ret) ++ return ret; ++ + ret = clk_set_rate(saif->clk, 24000000); + clk_disable(saif->clk); + if (ret) +-- +2.34.1 + diff --git a/queue-5.10/asoc-rockchip-i2s-fix-missing-clk_disable_unprepare-.patch b/queue-5.10/asoc-rockchip-i2s-fix-missing-clk_disable_unprepare-.patch new file mode 100644 index 00000000000..0067e822a18 --- /dev/null +++ b/queue-5.10/asoc-rockchip-i2s-fix-missing-clk_disable_unprepare-.patch @@ -0,0 +1,67 @@ +From f37bf07c6650595655e4d3c1e4a0003a07d7eff4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 08:35:52 +0000 +Subject: ASoC: rockchip: i2s: Fix missing clk_disable_unprepare() in + rockchip_i2s_probe + +From: Miaoqian Lin + +[ Upstream commit f725d20579807a68afbe5dba69e78b8fa05f5ef0 ] + +Fix the missing clk_disable_unprepare() before return +from rockchip_i2s_probe() in the error handling case. + +Fixes: 01605ad12875 ("ASoC: rockchip-i2s: enable "hclk" for rockchip I2S controller") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220307083553.26009-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/rockchip/rockchip_i2s.c | 15 ++++++++++----- + 1 file changed, 10 insertions(+), 5 deletions(-) + +diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c +index 18f13bf1021c..785baf98f9da 100644 +--- a/sound/soc/rockchip/rockchip_i2s.c ++++ b/sound/soc/rockchip/rockchip_i2s.c +@@ -624,19 +624,23 @@ static int rockchip_i2s_probe(struct platform_device *pdev) + i2s->mclk = devm_clk_get(&pdev->dev, "i2s_clk"); + if (IS_ERR(i2s->mclk)) { + dev_err(&pdev->dev, "Can't retrieve i2s master clock\n"); +- return PTR_ERR(i2s->mclk); ++ ret = PTR_ERR(i2s->mclk); ++ goto err_clk; + } + + regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res); +- if (IS_ERR(regs)) +- return PTR_ERR(regs); ++ if (IS_ERR(regs)) { ++ ret = PTR_ERR(regs); ++ goto err_clk; ++ } + + i2s->regmap = devm_regmap_init_mmio(&pdev->dev, regs, + &rockchip_i2s_regmap_config); + if (IS_ERR(i2s->regmap)) { + dev_err(&pdev->dev, + "Failed to initialise managed register map\n"); +- return PTR_ERR(i2s->regmap); ++ ret = PTR_ERR(i2s->regmap); ++ goto err_clk; + } + + i2s->playback_dma_data.addr = res->start + I2S_TXDR; +@@ -695,7 +699,8 @@ static int rockchip_i2s_probe(struct platform_device *pdev) + i2s_runtime_suspend(&pdev->dev); + err_pm_disable: + pm_runtime_disable(&pdev->dev); +- ++err_clk: ++ clk_disable_unprepare(i2s->hclk); + return ret; + } + +-- +2.34.1 + diff --git a/queue-5.10/asoc-rockchip-i2s-use-devm_platform_get_and_ioremap_.patch b/queue-5.10/asoc-rockchip-i2s-use-devm_platform_get_and_ioremap_.patch new file mode 100644 index 00000000000..434fec90e66 --- /dev/null +++ b/queue-5.10/asoc-rockchip-i2s-use-devm_platform_get_and_ioremap_.patch @@ -0,0 +1,37 @@ +From a90e6aa76d86f9836686a43708911a264a327b4e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Jun 2021 22:15:00 +0800 +Subject: ASoC: rockchip: i2s: Use devm_platform_get_and_ioremap_resource() + +From: Yang Yingliang + +[ Upstream commit 4ffbcd4ab0b6f77d29acde69dc25bd95318fae5e ] + +Use devm_platform_get_and_ioremap_resource() to simplify +code. + +Signed-off-by: Yang Yingliang +Link: https://lore.kernel.org/r/20210615141502.1683686-1-yangyingliang@huawei.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/rockchip/rockchip_i2s.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/sound/soc/rockchip/rockchip_i2s.c b/sound/soc/rockchip/rockchip_i2s.c +index fa84ec695b52..18f13bf1021c 100644 +--- a/sound/soc/rockchip/rockchip_i2s.c ++++ b/sound/soc/rockchip/rockchip_i2s.c +@@ -627,8 +627,7 @@ static int rockchip_i2s_probe(struct platform_device *pdev) + return PTR_ERR(i2s->mclk); + } + +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- regs = devm_ioremap_resource(&pdev->dev, res); ++ regs = devm_platform_get_and_ioremap_resource(pdev, 0, &res); + if (IS_ERR(regs)) + return PTR_ERR(regs); + +-- +2.34.1 + diff --git a/queue-5.10/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch b/queue-5.10/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch new file mode 100644 index 00000000000..7bff48de3b2 --- /dev/null +++ b/queue-5.10/asoc-rt5663-check-the-return-value-of-devm_kzalloc-i.patch @@ -0,0 +1,39 @@ +From 2d1c4d9005bc6505a0b0e6b32a27232601130425 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Feb 2022 05:10:30 -0800 +Subject: ASoC: rt5663: check the return value of devm_kzalloc() in + rt5663_parse_dp() + +From: Jia-Ju Bai + +[ Upstream commit 4d06f92f38b799295ae22c98be7a20cac3e2a1a7 ] + +The function devm_kzalloc() in rt5663_parse_dp() can fail, so its return +value should be checked. + +Fixes: 457c25efc592 ("ASoC: rt5663: Add the function of impedance sensing") +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Link: https://lore.kernel.org/r/20220225131030.27248-1-baijiaju1990@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/rt5663.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c +index db8a41aaa385..4423e61bf1ab 100644 +--- a/sound/soc/codecs/rt5663.c ++++ b/sound/soc/codecs/rt5663.c +@@ -3478,6 +3478,8 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) + table_size = sizeof(struct impedance_mapping_table) * + rt5663->pdata.impedance_sensing_num; + rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL); ++ if (!rt5663->imp_table) ++ return -ENOMEM; + ret = device_property_read_u32_array(dev, + "realtek,impedance_sensing_table", + (u32 *)rt5663->imp_table, table_size); +-- +2.34.1 + diff --git a/queue-5.10/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch b/queue-5.10/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch new file mode 100644 index 00000000000..14c05a11911 --- /dev/null +++ b/queue-5.10/asoc-soc-compress-prevent-the-potentially-use-of-nul.patch @@ -0,0 +1,65 @@ +From 5a3b18302a0d3b49c54677b817a1b00ad5f36d3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 15 Oct 2021 08:13:53 +0000 +Subject: ASoC: soc-compress: prevent the potentially use of null pointer + +From: Jiasheng Jiang + +[ Upstream commit de2c6f98817fa5decb9b7d3b3a8a3ab864c10588 ] + +There is one call trace that snd_soc_register_card() +->snd_soc_bind_card()->soc_init_pcm_runtime() +->snd_soc_dai_compress_new()->snd_soc_new_compress(). +In the trace the 'codec_dai' transfers from card->dai_link, +and we can see from the snd_soc_add_pcm_runtime() in +snd_soc_bind_card() that, if value of card->dai_link->num_codecs +is 0, then 'codec_dai' could be null pointer caused +by index out of bound in 'asoc_rtd_to_codec(rtd, 0)'. +And snd_soc_register_card() is called by various platforms. +Therefore, it is better to add the check in the case of misusing. +And because 'cpu_dai' has already checked in soc_init_pcm_runtime(), +there is no need to check again. +Adding the check as follow, then if 'codec_dai' is null, +snd_soc_new_compress() will not pass through the check +'if (playback + capture != 1)', avoiding the leftover use of +'codec_dai'. + +Fixes: 467fece ("ASoC: soc-dai: move snd_soc_dai_stream_valid() to soc-dai.c") +Signed-off-by: Jiasheng Jiang +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/r/1634285633-529368-1-git-send-email-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-compress.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c +index 3a6a60215e81..5a1702d926ae 100644 +--- a/sound/soc/soc-compress.c ++++ b/sound/soc/soc-compress.c +@@ -767,12 +767,14 @@ int snd_soc_new_compress(struct snd_soc_pcm_runtime *rtd, int num) + } + + /* check client and interface hw capabilities */ +- if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_PLAYBACK) && +- snd_soc_dai_stream_valid(cpu_dai, SNDRV_PCM_STREAM_PLAYBACK)) +- playback = 1; +- if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_CAPTURE) && +- snd_soc_dai_stream_valid(cpu_dai, SNDRV_PCM_STREAM_CAPTURE)) +- capture = 1; ++ if (codec_dai) { ++ if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_PLAYBACK) && ++ snd_soc_dai_stream_valid(cpu_dai, SNDRV_PCM_STREAM_PLAYBACK)) ++ playback = 1; ++ if (snd_soc_dai_stream_valid(codec_dai, SNDRV_PCM_STREAM_CAPTURE) && ++ snd_soc_dai_stream_valid(cpu_dai, SNDRV_PCM_STREAM_CAPTURE)) ++ capture = 1; ++ } + + /* + * Compress devices are unidirectional so only one of the directions +-- +2.34.1 + diff --git a/queue-5.10/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch b/queue-5.10/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch new file mode 100644 index 00000000000..21f6fab792b --- /dev/null +++ b/queue-5.10/asoc-soc-core-skip-zero-num_dai-component-in-searchi.patch @@ -0,0 +1,47 @@ +From 03983e45a782e4cb91c0a9d3bdd8101e485f933a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Feb 2022 19:19:12 +0800 +Subject: ASoC: soc-core: skip zero num_dai component in searching dai name + +From: Shengjiu Wang + +[ Upstream commit f7d344a2bd5ec81fbd1ce76928fd059e57ec9bea ] + +In the case like dmaengine which's not a dai but as a component, the +num_dai is zero, dmaengine component has the same component_of_node +as cpu dai, when cpu dai component is not ready, but dmaengine component +is ready, try to get cpu dai name, the snd_soc_get_dai_name() return +-EINVAL, not -EPROBE_DEFER, that cause below error: + +asoc-simple-card : parse error -22 +asoc-simple-card: probe of failed with error -22 + +The sound card failed to probe. + +So this patch fixes the issue above by skipping the zero num_dai +component in searching dai name. + +Signed-off-by: Shengjiu Wang +Link: https://lore.kernel.org/r/1644491952-7457-1-git-send-email-shengjiu.wang@nxp.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/soc-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index 133296596864..a6d6d10cd471 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -3020,7 +3020,7 @@ int snd_soc_get_dai_name(struct of_phandle_args *args, + for_each_component(pos) { + component_of_node = soc_component_to_node(pos); + +- if (component_of_node != args->np) ++ if (component_of_node != args->np || !pos->num_dai) + continue; + + ret = snd_soc_component_of_xlate_dai_name(pos, args, dai_name); +-- +2.34.1 + diff --git a/queue-5.10/asoc-sof-add-missing-of_node_put-in-imx8m_probe.patch b/queue-5.10/asoc-sof-add-missing-of_node_put-in-imx8m_probe.patch new file mode 100644 index 00000000000..c778e4fddfa --- /dev/null +++ b/queue-5.10/asoc-sof-add-missing-of_node_put-in-imx8m_probe.patch @@ -0,0 +1,37 @@ +From d04e24ece8b8d64508ffd0f3c6abf40f232ea2ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 02:33:23 +0000 +Subject: ASoC: SOF: Add missing of_node_put() in imx8m_probe + +From: Miaoqian Lin + +[ Upstream commit 5575f7f49134c7386a684335c9007737c606d3b5 ] + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. + +Fixes: afb93d716533 ("ASoC: SOF: imx: Add i.MX8M HW support") +Signed-off-by: Miaoqian Lin +Reviewed-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20220308023325.31702-1-linmq006@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/imx/imx8m.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/soc/sof/imx/imx8m.c b/sound/soc/sof/imx/imx8m.c +index cb822d953767..6943c05273ae 100644 +--- a/sound/soc/sof/imx/imx8m.c ++++ b/sound/soc/sof/imx/imx8m.c +@@ -191,6 +191,7 @@ static int imx8m_probe(struct snd_sof_dev *sdev) + } + + ret = of_address_to_resource(res_node, 0, &res); ++ of_node_put(res_node); + if (ret) { + dev_err(&pdev->dev, "failed to get reserved region address\n"); + goto exit_pdev_unregister; +-- +2.34.1 + diff --git a/queue-5.10/asoc-sof-intel-hda-remove-link-assignment-limitation.patch b/queue-5.10/asoc-sof-intel-hda-remove-link-assignment-limitation.patch new file mode 100644 index 00000000000..711be55fd93 --- /dev/null +++ b/queue-5.10/asoc-sof-intel-hda-remove-link-assignment-limitation.patch @@ -0,0 +1,65 @@ +From 23c7144bf867298e4ac8f90ef2ea3fbc709b738a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jan 2022 15:00:17 +0200 +Subject: ASoC: SOF: Intel: hda: Remove link assignment limitation + +From: Ranjani Sridharan + +[ Upstream commit 2ce0d008dcc59f9c01f43277b9f9743af7b01dad ] + +The limitation to assign a link DMA channel for a BE iff the +corresponding host DMA channel is assigned to a connected FE is only +applicable if the PROCEN_FMT_QUIRK is set. So, remove it for platforms +that do not enable the quirk. + +Complements: a792bfc1c2bc ("ASoC: SOF: Intel: hda-stream: limit PROCEN workaround") +Signed-off-by: Ranjani Sridharan +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Rander Wang +Reviewed-by: Kai Vehmanen +Reviewed-by: Peter Ujfalusi +Signed-off-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20220128130017.28508-1-peter.ujfalusi@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/intel/hda-dai.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/sound/soc/sof/intel/hda-dai.c b/sound/soc/sof/intel/hda-dai.c +index ef316311e959..99e62cb3a051 100644 +--- a/sound/soc/sof/intel/hda-dai.c ++++ b/sound/soc/sof/intel/hda-dai.c +@@ -58,6 +58,8 @@ static struct hdac_ext_stream * + { + struct snd_soc_pcm_runtime *rtd = asoc_substream_to_rtd(substream); + struct sof_intel_hda_stream *hda_stream; ++ const struct sof_intel_dsp_desc *chip; ++ struct snd_sof_dev *sdev; + struct hdac_ext_stream *res = NULL; + struct hdac_stream *stream = NULL; + +@@ -76,9 +78,20 @@ static struct hdac_ext_stream * + continue; + + hda_stream = hstream_to_sof_hda_stream(hstream); ++ sdev = hda_stream->sdev; ++ chip = get_chip_info(sdev->pdata); + + /* check if link is available */ + if (!hstream->link_locked) { ++ /* ++ * choose the first available link for platforms that do not have the ++ * PROCEN_FMT_QUIRK set. ++ */ ++ if (!(chip->quirks & SOF_INTEL_PROCEN_FMT_QUIRK)) { ++ res = hstream; ++ break; ++ } ++ + if (stream->opened) { + /* + * check if the stream tag matches the stream +-- +2.34.1 + diff --git a/queue-5.10/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch b/queue-5.10/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch new file mode 100644 index 00000000000..da1b4d003bc --- /dev/null +++ b/queue-5.10/asoc-ti-davinci-i2s-add-check-for-clk_enable.patch @@ -0,0 +1,49 @@ +From 8741fe99f21b00fde8ce5c0b1785cb10ed9d54b7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 11:15:40 +0800 +Subject: ASoC: ti: davinci-i2s: Add check for clk_enable() + +From: Jiasheng Jiang + +[ Upstream commit ed7c9fef11931fc5d32a83d68017ff390bf5c280 ] + +As the potential failure of the clk_enable(), +it should be better to check it and return error +if fails. + +Fixes: 5f9a50c3e55e ("ASoC: Davinci: McBSP: add device tree support for McBSP") +Signed-off-by: Jiasheng Jiang +Acked-by: Peter Ujfalusi +Link: https://lore.kernel.org/r/20220228031540.3571959-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/ti/davinci-i2s.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/ti/davinci-i2s.c b/sound/soc/ti/davinci-i2s.c +index dd34504c09ba..4895bcee1f55 100644 +--- a/sound/soc/ti/davinci-i2s.c ++++ b/sound/soc/ti/davinci-i2s.c +@@ -708,7 +708,9 @@ static int davinci_i2s_probe(struct platform_device *pdev) + dev->clk = clk_get(&pdev->dev, NULL); + if (IS_ERR(dev->clk)) + return -ENODEV; +- clk_enable(dev->clk); ++ ret = clk_enable(dev->clk); ++ if (ret) ++ goto err_put_clk; + + dev->dev = &pdev->dev; + dev_set_drvdata(&pdev->dev, dev); +@@ -730,6 +732,7 @@ static int davinci_i2s_probe(struct platform_device *pdev) + snd_soc_unregister_component(&pdev->dev); + err_release_clk: + clk_disable(dev->clk); ++err_put_clk: + clk_put(dev->clk); + return ret; + } +-- +2.34.1 + diff --git a/queue-5.10/asoc-wm8350-handle-error-for-wm8350_register_irq.patch b/queue-5.10/asoc-wm8350-handle-error-for-wm8350_register_irq.patch new file mode 100644 index 00000000000..102f3fa4816 --- /dev/null +++ b/queue-5.10/asoc-wm8350-handle-error-for-wm8350_register_irq.patch @@ -0,0 +1,73 @@ +From 9a5f09d59d9fcb07dee5f0901bdd51b15ed8785c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 10:38:21 +0800 +Subject: ASoC: wm8350: Handle error for wm8350_register_irq + +From: Jiasheng Jiang + +[ Upstream commit db0350da8084ad549bca16cc0486c11cc70a1f9b ] + +As the potential failure of the wm8350_register_irq(), +it should be better to check it and return error if fails. +Also, use 'free_' in order to avoid the same code. + +Fixes: a6ba2b2dabb5 ("ASoC: Implement WM8350 headphone jack detection") +Signed-off-by: Jiasheng Jiang +Acked-by: Charles Keepax +Link: https://lore.kernel.org/r/20220304023821.391936-1-jiasheng@iscas.ac.cn +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8350.c | 28 ++++++++++++++++++++++++---- + 1 file changed, 24 insertions(+), 4 deletions(-) + +diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c +index a6aa212fa0c8..ec5d997725b9 100644 +--- a/sound/soc/codecs/wm8350.c ++++ b/sound/soc/codecs/wm8350.c +@@ -1536,18 +1536,38 @@ static int wm8350_component_probe(struct snd_soc_component *component) + wm8350_clear_bits(wm8350, WM8350_JACK_DETECT, + WM8350_JDL_ENA | WM8350_JDR_ENA); + +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, + wm8350_hpl_jack_handler, 0, "Left jack detect", + priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, ++ if (ret != 0) ++ goto err; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, + wm8350_hpr_jack_handler, 0, "Right jack detect", + priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, ++ if (ret != 0) ++ goto free_jck_det_l; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, + wm8350_mic_handler, 0, "Microphone short", priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD, ++ if (ret != 0) ++ goto free_jck_det_r; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD, + wm8350_mic_handler, 0, "Microphone detect", priv); ++ if (ret != 0) ++ goto free_micscd; + + return 0; ++ ++free_micscd: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, priv); ++free_jck_det_r: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, priv); ++free_jck_det_l: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, priv); ++err: ++ return ret; + } + + static void wm8350_component_remove(struct snd_soc_component *component) +-- +2.34.1 + diff --git a/queue-5.10/asoc-xilinx-xlnx_formatter_pcm-handle-sysclk-setting.patch b/queue-5.10/asoc-xilinx-xlnx_formatter_pcm-handle-sysclk-setting.patch new file mode 100644 index 00000000000..4e461da8ac0 --- /dev/null +++ b/queue-5.10/asoc-xilinx-xlnx_formatter_pcm-handle-sysclk-setting.patch @@ -0,0 +1,92 @@ +From fff678d3691cebff5690e9d9d3cf925329e280b1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 13:58:27 -0600 +Subject: ASoC: xilinx: xlnx_formatter_pcm: Handle sysclk setting + +From: Robert Hancock + +[ Upstream commit 1c5091fbe7e0d0804158200b7feac5123f7b4fbd ] + +This driver did not set the MM2S Fs Multiplier Register to the proper +value for playback streams. This needs to be set to the sample rate to +MCLK multiplier, or random stream underflows can occur on the downstream +I2S transmitter. + +Store the sysclk value provided via the set_sysclk callback and use that +in conjunction with the sample rate in the hw_params callback to calculate +the proper value to set for this register. + +Fixes: 6f6c3c36f091 ("ASoC: xlnx: add pcm formatter platform driver") +Signed-off-by: Robert Hancock +Link: https://lore.kernel.org/r/20220120195832.1742271-2-robert.hancock@calian.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/xilinx/xlnx_formatter_pcm.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/sound/soc/xilinx/xlnx_formatter_pcm.c b/sound/soc/xilinx/xlnx_formatter_pcm.c +index ce19a6058b27..5c4158069a5a 100644 +--- a/sound/soc/xilinx/xlnx_formatter_pcm.c ++++ b/sound/soc/xilinx/xlnx_formatter_pcm.c +@@ -84,6 +84,7 @@ struct xlnx_pcm_drv_data { + struct snd_pcm_substream *play_stream; + struct snd_pcm_substream *capture_stream; + struct clk *axi_clk; ++ unsigned int sysclk; + }; + + /* +@@ -314,6 +315,15 @@ static irqreturn_t xlnx_s2mm_irq_handler(int irq, void *arg) + return IRQ_NONE; + } + ++static int xlnx_formatter_set_sysclk(struct snd_soc_component *component, ++ int clk_id, int source, unsigned int freq, int dir) ++{ ++ struct xlnx_pcm_drv_data *adata = dev_get_drvdata(component->dev); ++ ++ adata->sysclk = freq; ++ return 0; ++} ++ + static int xlnx_formatter_pcm_open(struct snd_soc_component *component, + struct snd_pcm_substream *substream) + { +@@ -450,11 +460,25 @@ static int xlnx_formatter_pcm_hw_params(struct snd_soc_component *component, + u64 size; + struct snd_pcm_runtime *runtime = substream->runtime; + struct xlnx_pcm_stream_param *stream_data = runtime->private_data; ++ struct xlnx_pcm_drv_data *adata = dev_get_drvdata(component->dev); + + active_ch = params_channels(params); + if (active_ch > stream_data->ch_limit) + return -EINVAL; + ++ if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK && ++ adata->sysclk) { ++ unsigned int mclk_fs = adata->sysclk / params_rate(params); ++ ++ if (adata->sysclk % params_rate(params) != 0) { ++ dev_warn(component->dev, "sysclk %u not divisible by rate %u\n", ++ adata->sysclk, params_rate(params)); ++ return -EINVAL; ++ } ++ ++ writel(mclk_fs, stream_data->mmio + XLNX_AUD_FS_MULTIPLIER); ++ } ++ + if (substream->stream == SNDRV_PCM_STREAM_CAPTURE && + stream_data->xfer_mode == AES_TO_PCM) { + val = readl(stream_data->mmio + XLNX_AUD_STS); +@@ -552,6 +576,7 @@ static int xlnx_formatter_pcm_new(struct snd_soc_component *component, + + static const struct snd_soc_component_driver xlnx_asoc_component = { + .name = DRV_NAME, ++ .set_sysclk = xlnx_formatter_set_sysclk, + .open = xlnx_formatter_pcm_open, + .close = xlnx_formatter_pcm_close, + .hw_params = xlnx_formatter_pcm_hw_params, +-- +2.34.1 + diff --git a/queue-5.10/ath10k-fix-error-handling-in-ath10k_setup_msa_resour.patch b/queue-5.10/ath10k-fix-error-handling-in-ath10k_setup_msa_resour.patch new file mode 100644 index 00000000000..276cf379e2d --- /dev/null +++ b/queue-5.10/ath10k-fix-error-handling-in-ath10k_setup_msa_resour.patch @@ -0,0 +1,45 @@ +From 90c4b98128b7686d8819200261d7e7ad98c9233d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 07:02:38 +0000 +Subject: ath10k: Fix error handling in ath10k_setup_msa_resources + +From: Miaoqian Lin + +[ Upstream commit 9747a78d5f758a5284751a10aee13c30d02bd5f1 ] + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. + +This function only calls of_node_put() in the regular path. +And it will cause refcount leak in error path. + +Fixes: 727fec790ead ("ath10k: Setup the msa resources before qmi init") +Signed-off-by: Miaoqian Lin +Reviewed-by: Jeff Johnson +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220308070238.19295-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/snoc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/ath/ath10k/snoc.c b/drivers/net/wireless/ath/ath10k/snoc.c +index daae470ecf5a..e5a296039f71 100644 +--- a/drivers/net/wireless/ath/ath10k/snoc.c ++++ b/drivers/net/wireless/ath/ath10k/snoc.c +@@ -1477,11 +1477,11 @@ static int ath10k_setup_msa_resources(struct ath10k *ar, u32 msa_size) + node = of_parse_phandle(dev->of_node, "memory-region", 0); + if (node) { + ret = of_address_to_resource(node, 0, &r); ++ of_node_put(node); + if (ret) { + dev_err(dev, "failed to resolve msa fixed region\n"); + return ret; + } +- of_node_put(node); + + ar->msa.paddr = r.start; + ar->msa.mem_size = resource_size(&r); +-- +2.34.1 + diff --git a/queue-5.10/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch b/queue-5.10/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch new file mode 100644 index 00000000000..415b65cf2d5 --- /dev/null +++ b/queue-5.10/ath10k-fix-memory-overwrite-of-the-wowlan-wakeup-pac.patch @@ -0,0 +1,56 @@ +From 402bb41b88004abe4c489d5b64a4c7b8dd043c3a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jan 2022 16:24:13 +0200 +Subject: ath10k: fix memory overwrite of the WoWLAN wakeup packet pattern + +From: Wen Gong + +[ Upstream commit e3fb3d4418fce5484dfe7995fcd94c18b10a431a ] + +In function ath10k_wow_convert_8023_to_80211(), it will do memcpy for +the new->pattern, and currently the new->pattern and new->mask is same +with the old, then the memcpy of new->pattern will also overwrite the +old->pattern, because the header format of new->pattern is 802.11, +its length is larger than the old->pattern which is 802.3. Then the +operation of "Copy frame body" will copy a mistake value because the +body memory has been overwrite when memcpy the new->pattern. + +Assign another empty value to new_pattern to avoid the overwrite issue. + +Tested-on: QCA6174 hw3.2 SDIO WLAN.RMH.4.4.1-00049 + +Fixes: fa3440fa2fa1 ("ath10k: convert wow pattern from 802.3 to 802.11") +Signed-off-by: Wen Gong +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211222031347.25463-1-quic_wgong@quicinc.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath10k/wow.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c +index 7d65c115669f..20b9aa8ddf7d 100644 +--- a/drivers/net/wireless/ath/ath10k/wow.c ++++ b/drivers/net/wireless/ath/ath10k/wow.c +@@ -337,14 +337,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif, + if (patterns[i].mask[j / 8] & BIT(j % 8)) + bitmask[j] = 0xff; + old_pattern.mask = bitmask; +- new_pattern = old_pattern; + + if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) { +- if (patterns[i].pkt_offset < ETH_HLEN) ++ if (patterns[i].pkt_offset < ETH_HLEN) { + ath10k_wow_convert_8023_to_80211(&new_pattern, + &old_pattern); +- else ++ } else { ++ new_pattern = old_pattern; + new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN; ++ } + } + + if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE)) +-- +2.34.1 + diff --git a/queue-5.10/ath9k_htc-fix-uninit-value-bugs.patch b/queue-5.10/ath9k_htc-fix-uninit-value-bugs.patch new file mode 100644 index 00000000000..8c8069e0242 --- /dev/null +++ b/queue-5.10/ath9k_htc-fix-uninit-value-bugs.patch @@ -0,0 +1,100 @@ +From 5ffe6c61ad8cfab755810c5c3a7bcf21892c6ca0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jan 2022 10:52:37 +0200 +Subject: ath9k_htc: fix uninit value bugs + +From: Pavel Skripkin + +[ Upstream commit d1e0df1c57bd30871dd1c855742a7c346dbca853 ] + +Syzbot reported 2 KMSAN bugs in ath9k. All of them are caused by missing +field initialization. + +In htc_connect_service() svc_meta_len and pad are not initialized. Based +on code it looks like in current skb there is no service data, so simply +initialize svc_meta_len to 0. + +htc_issue_send() does not initialize htc_frame_hdr::control array. Based +on firmware code, it will initialize it by itself, so simply zero whole +array to make KMSAN happy + +Fail logs: + +BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 + usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 + hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] + hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 + htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] + htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 +... + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:524 [inline] + slab_alloc_node mm/slub.c:3251 [inline] + __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 + kmalloc_reserve net/core/skbuff.c:354 [inline] + __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 + alloc_skb include/linux/skbuff.h:1126 [inline] + htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 +... + +Bytes 4-7 of 18 are uninitialized +Memory access of size 18 starts at ffff888027377e00 + +BUG: KMSAN: kernel-usb-infoleak in usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 + usb_submit_urb+0x6c1/0x2aa0 drivers/usb/core/urb.c:430 + hif_usb_send_regout drivers/net/wireless/ath/ath9k/hif_usb.c:127 [inline] + hif_usb_send+0x5f0/0x16f0 drivers/net/wireless/ath/ath9k/hif_usb.c:479 + htc_issue_send drivers/net/wireless/ath/ath9k/htc_hst.c:34 [inline] + htc_connect_service+0x143e/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:275 +... + +Uninit was created at: + slab_post_alloc_hook mm/slab.h:524 [inline] + slab_alloc_node mm/slub.c:3251 [inline] + __kmalloc_node_track_caller+0xe0c/0x1510 mm/slub.c:4974 + kmalloc_reserve net/core/skbuff.c:354 [inline] + __alloc_skb+0x545/0xf90 net/core/skbuff.c:426 + alloc_skb include/linux/skbuff.h:1126 [inline] + htc_connect_service+0x1029/0x1960 drivers/net/wireless/ath/ath9k/htc_hst.c:258 +... + +Bytes 16-17 of 18 are uninitialized +Memory access of size 18 starts at ffff888027377e00 + +Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.") +Reported-by: syzbot+f83a1df1ed4f67e8d8ad@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20220115122733.11160-1-paskripkin@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/ath/ath9k/htc_hst.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index 510e61e97dbc..994ec48b2f66 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -30,6 +30,7 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb, + hdr->endpoint_id = epid; + hdr->flags = flags; + hdr->payload_len = cpu_to_be16(len); ++ memset(hdr->control, 0, sizeof(hdr->control)); + + status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb); + +@@ -272,6 +273,10 @@ int htc_connect_service(struct htc_target *target, + conn_msg->dl_pipeid = endpoint->dl_pipeid; + conn_msg->ul_pipeid = endpoint->ul_pipeid; + ++ /* To prevent infoleak */ ++ conn_msg->svc_meta_len = 0; ++ conn_msg->pad = 0; ++ + ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0); + if (ret) + goto err; +-- +2.34.1 + diff --git a/queue-5.10/audit-log-audit_time_-records-only-from-rules.patch b/queue-5.10/audit-log-audit_time_-records-only-from-rules.patch new file mode 100644 index 00000000000..589ab3cd27e --- /dev/null +++ b/queue-5.10/audit-log-audit_time_-records-only-from-rules.patch @@ -0,0 +1,167 @@ +From 967febe27684d745d44f2de4076021180006572d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 11:44:51 -0500 +Subject: audit: log AUDIT_TIME_* records only from rules + +From: Richard Guy Briggs + +[ Upstream commit 272ceeaea355214b301530e262a0df8600bfca95 ] + +AUDIT_TIME_* events are generated when there are syscall rules present +that are not related to time keeping. This will produce noisy log +entries that could flood the logs and hide events we really care about. + +Rather than immediately produce the AUDIT_TIME_* records, store the data +in the context and log it at syscall exit time respecting the filter +rules. + +Note: This eats the audit_buffer, unlike any others in show_special(). + +Please see https://bugzilla.redhat.com/show_bug.cgi?id=1991919 + +Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment") +Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments") +Signed-off-by: Richard Guy Briggs +[PM: fixed style/whitespace issues] +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + kernel/audit.h | 4 +++ + kernel/auditsc.c | 87 +++++++++++++++++++++++++++++++++++++----------- + 2 files changed, 71 insertions(+), 20 deletions(-) + +diff --git a/kernel/audit.h b/kernel/audit.h +index 3b9c0945225a..1918019e6aaf 100644 +--- a/kernel/audit.h ++++ b/kernel/audit.h +@@ -191,6 +191,10 @@ struct audit_context { + struct { + char *name; + } module; ++ struct { ++ struct audit_ntp_data ntp_data; ++ struct timespec64 tk_injoffset; ++ } time; + }; + int fds[2]; + struct audit_proctitle proctitle; +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index 638f424859ed..07e2788bbbf1 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -1214,6 +1214,53 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) + from_kuid(&init_user_ns, name->fcap.rootid)); + } + ++static void audit_log_time(struct audit_context *context, struct audit_buffer **ab) ++{ ++ const struct audit_ntp_data *ntp = &context->time.ntp_data; ++ const struct timespec64 *tk = &context->time.tk_injoffset; ++ static const char * const ntp_name[] = { ++ "offset", ++ "freq", ++ "status", ++ "tai", ++ "tick", ++ "adjust", ++ }; ++ int type; ++ ++ if (context->type == AUDIT_TIME_ADJNTPVAL) { ++ for (type = 0; type < AUDIT_NTP_NVALS; type++) { ++ if (ntp->vals[type].newval != ntp->vals[type].oldval) { ++ if (!*ab) { ++ *ab = audit_log_start(context, ++ GFP_KERNEL, ++ AUDIT_TIME_ADJNTPVAL); ++ if (!*ab) ++ return; ++ } ++ audit_log_format(*ab, "op=%s old=%lli new=%lli", ++ ntp_name[type], ++ ntp->vals[type].oldval, ++ ntp->vals[type].newval); ++ audit_log_end(*ab); ++ *ab = NULL; ++ } ++ } ++ } ++ if (tk->tv_sec != 0 || tk->tv_nsec != 0) { ++ if (!*ab) { ++ *ab = audit_log_start(context, GFP_KERNEL, ++ AUDIT_TIME_INJOFFSET); ++ if (!*ab) ++ return; ++ } ++ audit_log_format(*ab, "sec=%lli nsec=%li", ++ (long long)tk->tv_sec, tk->tv_nsec); ++ audit_log_end(*ab); ++ *ab = NULL; ++ } ++} ++ + static void show_special(struct audit_context *context, int *call_panic) + { + struct audit_buffer *ab; +@@ -1319,6 +1366,11 @@ static void show_special(struct audit_context *context, int *call_panic) + audit_log_format(ab, "(null)"); + + break; ++ case AUDIT_TIME_ADJNTPVAL: ++ case AUDIT_TIME_INJOFFSET: ++ /* this call deviates from the rest, eating the buffer */ ++ audit_log_time(context, &ab); ++ break; + } + audit_log_end(ab); + } +@@ -2560,31 +2612,26 @@ void __audit_fanotify(unsigned int response) + + void __audit_tk_injoffset(struct timespec64 offset) + { +- audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET, +- "sec=%lli nsec=%li", +- (long long)offset.tv_sec, offset.tv_nsec); +-} +- +-static void audit_log_ntp_val(const struct audit_ntp_data *ad, +- const char *op, enum audit_ntp_type type) +-{ +- const struct audit_ntp_val *val = &ad->vals[type]; +- +- if (val->newval == val->oldval) +- return; ++ struct audit_context *context = audit_context(); + +- audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL, +- "op=%s old=%lli new=%lli", op, val->oldval, val->newval); ++ /* only set type if not already set by NTP */ ++ if (!context->type) ++ context->type = AUDIT_TIME_INJOFFSET; ++ memcpy(&context->time.tk_injoffset, &offset, sizeof(offset)); + } + + void __audit_ntp_log(const struct audit_ntp_data *ad) + { +- audit_log_ntp_val(ad, "offset", AUDIT_NTP_OFFSET); +- audit_log_ntp_val(ad, "freq", AUDIT_NTP_FREQ); +- audit_log_ntp_val(ad, "status", AUDIT_NTP_STATUS); +- audit_log_ntp_val(ad, "tai", AUDIT_NTP_TAI); +- audit_log_ntp_val(ad, "tick", AUDIT_NTP_TICK); +- audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST); ++ struct audit_context *context = audit_context(); ++ int type; ++ ++ for (type = 0; type < AUDIT_NTP_NVALS; type++) ++ if (ad->vals[type].newval != ad->vals[type].oldval) { ++ /* unconditionally set type, overwriting TK */ ++ context->type = AUDIT_TIME_ADJNTPVAL; ++ memcpy(&context->time.ntp_data, ad, sizeof(*ad)); ++ break; ++ } + } + + void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries, +-- +2.34.1 + diff --git a/queue-5.10/bareudp-use-ipv6_mod_enabled-to-check-if-ipv6-enable.patch b/queue-5.10/bareudp-use-ipv6_mod_enabled-to-check-if-ipv6-enable.patch new file mode 100644 index 00000000000..7b65fbdecd9 --- /dev/null +++ b/queue-5.10/bareudp-use-ipv6_mod_enabled-to-check-if-ipv6-enable.patch @@ -0,0 +1,92 @@ +From f042b4dc0fcb413dee1ce52d2670c8d44f48e462 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Mar 2022 14:26:18 +0800 +Subject: bareudp: use ipv6_mod_enabled to check if IPv6 enabled + +From: Hangbin Liu + +[ Upstream commit e077ed58c243afc197bc2a2ba0e1ff61135e4ec2 ] + +bareudp_create_sock() use AF_INET6 by default if IPv6 CONFIG enabled. +But if user start kernel with ipv6.disable=1, the bareudp sock will +created failed, which cause the interface open failed even with ethertype +ip. e.g. + + # ip link add bareudp1 type bareudp dstport 2 ethertype ip + # ip link set bareudp1 up + RTNETLINK answers: Address family not supported by protocol + +Fix it by using ipv6_mod_enabled() to check if IPv6 enabled. There is +no need to check IS_ENABLED(CONFIG_IPV6) as ipv6_mod_enabled() will +return false when CONFIG_IPV6 no enabled in include/linux/ipv6.h. + +Reported-by: Jianlin Shi +Fixes: 571912c69f0e ("net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.") +Signed-off-by: Hangbin Liu +Link: https://lore.kernel.org/r/20220315062618.156230-1-liuhangbin@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/bareudp.c | 19 ++++++++++--------- + 1 file changed, 10 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/bareudp.c b/drivers/net/bareudp.c +index 39b128205f25..9bb2567f410b 100644 +--- a/drivers/net/bareudp.c ++++ b/drivers/net/bareudp.c +@@ -140,14 +140,14 @@ static int bareudp_udp_encap_recv(struct sock *sk, struct sk_buff *skb) + oiph = skb_network_header(skb); + skb_reset_network_header(skb); + +- if (!IS_ENABLED(CONFIG_IPV6) || family == AF_INET) ++ if (!ipv6_mod_enabled() || family == AF_INET) + err = IP_ECN_decapsulate(oiph, skb); + else + err = IP6_ECN_decapsulate(oiph, skb); + + if (unlikely(err)) { + if (log_ecn_error) { +- if (!IS_ENABLED(CONFIG_IPV6) || family == AF_INET) ++ if (!ipv6_mod_enabled() || family == AF_INET) + net_info_ratelimited("non-ECT from %pI4 " + "with TOS=%#x\n", + &((struct iphdr *)oiph)->saddr, +@@ -213,11 +213,12 @@ static struct socket *bareudp_create_sock(struct net *net, __be16 port) + int err; + + memset(&udp_conf, 0, sizeof(udp_conf)); +-#if IS_ENABLED(CONFIG_IPV6) +- udp_conf.family = AF_INET6; +-#else +- udp_conf.family = AF_INET; +-#endif ++ ++ if (ipv6_mod_enabled()) ++ udp_conf.family = AF_INET6; ++ else ++ udp_conf.family = AF_INET; ++ + udp_conf.local_udp_port = port; + /* Open UDP socket */ + err = udp_sock_create(net, &udp_conf, &sock); +@@ -445,7 +446,7 @@ static netdev_tx_t bareudp_xmit(struct sk_buff *skb, struct net_device *dev) + } + + rcu_read_lock(); +- if (IS_ENABLED(CONFIG_IPV6) && info->mode & IP_TUNNEL_INFO_IPV6) ++ if (ipv6_mod_enabled() && info->mode & IP_TUNNEL_INFO_IPV6) + err = bareudp6_xmit_skb(skb, dev, bareudp, info); + else + err = bareudp_xmit_skb(skb, dev, bareudp, info); +@@ -475,7 +476,7 @@ static int bareudp_fill_metadata_dst(struct net_device *dev, + + use_cache = ip_tunnel_dst_cache_usable(skb, info); + +- if (!IS_ENABLED(CONFIG_IPV6) || ip_tunnel_info_af(info) == AF_INET) { ++ if (!ipv6_mod_enabled() || ip_tunnel_info_af(info) == AF_INET) { + struct rtable *rt; + __be32 saddr; + +-- +2.34.1 + diff --git a/queue-5.10/bfq-fix-use-after-free-in-bfq_dispatch_request.patch b/queue-5.10/bfq-fix-use-after-free-in-bfq_dispatch_request.patch new file mode 100644 index 00000000000..52533f02b59 --- /dev/null +++ b/queue-5.10/bfq-fix-use-after-free-in-bfq_dispatch_request.patch @@ -0,0 +1,183 @@ +From 88217a32b029d7dccf88be3409a4744105f6d73b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 15:03:34 +0800 +Subject: bfq: fix use-after-free in bfq_dispatch_request + +From: Zhang Wensheng + +[ Upstream commit ab552fcb17cc9e4afe0e4ac4df95fc7b30e8490a ] + +KASAN reports a use-after-free report when doing normal scsi-mq test + +[69832.239032] ================================================================== +[69832.241810] BUG: KASAN: use-after-free in bfq_dispatch_request+0x1045/0x44b0 +[69832.243267] Read of size 8 at addr ffff88802622ba88 by task kworker/3:1H/155 +[69832.244656] +[69832.245007] CPU: 3 PID: 155 Comm: kworker/3:1H Not tainted 5.10.0-10295-g576c6382529e #8 +[69832.246626] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 +[69832.249069] Workqueue: kblockd blk_mq_run_work_fn +[69832.250022] Call Trace: +[69832.250541] dump_stack+0x9b/0xce +[69832.251232] ? bfq_dispatch_request+0x1045/0x44b0 +[69832.252243] print_address_description.constprop.6+0x3e/0x60 +[69832.253381] ? __cpuidle_text_end+0x5/0x5 +[69832.254211] ? vprintk_func+0x6b/0x120 +[69832.254994] ? bfq_dispatch_request+0x1045/0x44b0 +[69832.255952] ? bfq_dispatch_request+0x1045/0x44b0 +[69832.256914] kasan_report.cold.9+0x22/0x3a +[69832.257753] ? bfq_dispatch_request+0x1045/0x44b0 +[69832.258755] check_memory_region+0x1c1/0x1e0 +[69832.260248] bfq_dispatch_request+0x1045/0x44b0 +[69832.261181] ? bfq_bfqq_expire+0x2440/0x2440 +[69832.262032] ? blk_mq_delay_run_hw_queues+0xf9/0x170 +[69832.263022] __blk_mq_do_dispatch_sched+0x52f/0x830 +[69832.264011] ? blk_mq_sched_request_inserted+0x100/0x100 +[69832.265101] __blk_mq_sched_dispatch_requests+0x398/0x4f0 +[69832.266206] ? blk_mq_do_dispatch_ctx+0x570/0x570 +[69832.267147] ? __switch_to+0x5f4/0xee0 +[69832.267898] blk_mq_sched_dispatch_requests+0xdf/0x140 +[69832.268946] __blk_mq_run_hw_queue+0xc0/0x270 +[69832.269840] blk_mq_run_work_fn+0x51/0x60 +[69832.278170] process_one_work+0x6d4/0xfe0 +[69832.278984] worker_thread+0x91/0xc80 +[69832.279726] ? __kthread_parkme+0xb0/0x110 +[69832.280554] ? process_one_work+0xfe0/0xfe0 +[69832.281414] kthread+0x32d/0x3f0 +[69832.282082] ? kthread_park+0x170/0x170 +[69832.282849] ret_from_fork+0x1f/0x30 +[69832.283573] +[69832.283886] Allocated by task 7725: +[69832.284599] kasan_save_stack+0x19/0x40 +[69832.285385] __kasan_kmalloc.constprop.2+0xc1/0xd0 +[69832.286350] kmem_cache_alloc_node+0x13f/0x460 +[69832.287237] bfq_get_queue+0x3d4/0x1140 +[69832.287993] bfq_get_bfqq_handle_split+0x103/0x510 +[69832.289015] bfq_init_rq+0x337/0x2d50 +[69832.289749] bfq_insert_requests+0x304/0x4e10 +[69832.290634] blk_mq_sched_insert_requests+0x13e/0x390 +[69832.291629] blk_mq_flush_plug_list+0x4b4/0x760 +[69832.292538] blk_flush_plug_list+0x2c5/0x480 +[69832.293392] io_schedule_prepare+0xb2/0xd0 +[69832.294209] io_schedule_timeout+0x13/0x80 +[69832.295014] wait_for_common_io.constprop.1+0x13c/0x270 +[69832.296137] submit_bio_wait+0x103/0x1a0 +[69832.296932] blkdev_issue_discard+0xe6/0x160 +[69832.297794] blk_ioctl_discard+0x219/0x290 +[69832.298614] blkdev_common_ioctl+0x50a/0x1750 +[69832.304715] blkdev_ioctl+0x470/0x600 +[69832.305474] block_ioctl+0xde/0x120 +[69832.306232] vfs_ioctl+0x6c/0xc0 +[69832.306877] __se_sys_ioctl+0x90/0xa0 +[69832.307629] do_syscall_64+0x2d/0x40 +[69832.308362] entry_SYSCALL_64_after_hwframe+0x44/0xa9 +[69832.309382] +[69832.309701] Freed by task 155: +[69832.310328] kasan_save_stack+0x19/0x40 +[69832.311121] kasan_set_track+0x1c/0x30 +[69832.311868] kasan_set_free_info+0x1b/0x30 +[69832.312699] __kasan_slab_free+0x111/0x160 +[69832.313524] kmem_cache_free+0x94/0x460 +[69832.314367] bfq_put_queue+0x582/0x940 +[69832.315112] __bfq_bfqd_reset_in_service+0x166/0x1d0 +[69832.317275] bfq_bfqq_expire+0xb27/0x2440 +[69832.318084] bfq_dispatch_request+0x697/0x44b0 +[69832.318991] __blk_mq_do_dispatch_sched+0x52f/0x830 +[69832.319984] __blk_mq_sched_dispatch_requests+0x398/0x4f0 +[69832.321087] blk_mq_sched_dispatch_requests+0xdf/0x140 +[69832.322225] __blk_mq_run_hw_queue+0xc0/0x270 +[69832.323114] blk_mq_run_work_fn+0x51/0x60 +[69832.323942] process_one_work+0x6d4/0xfe0 +[69832.324772] worker_thread+0x91/0xc80 +[69832.325518] kthread+0x32d/0x3f0 +[69832.326205] ret_from_fork+0x1f/0x30 +[69832.326932] +[69832.338297] The buggy address belongs to the object at ffff88802622b968 +[69832.338297] which belongs to the cache bfq_queue of size 512 +[69832.340766] The buggy address is located 288 bytes inside of +[69832.340766] 512-byte region [ffff88802622b968, ffff88802622bb68) +[69832.343091] The buggy address belongs to the page: +[69832.344097] page:ffffea0000988a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802622a528 pfn:0x26228 +[69832.346214] head:ffffea0000988a00 order:2 compound_mapcount:0 compound_pincount:0 +[69832.347719] flags: 0x1fffff80010200(slab|head) +[69832.348625] raw: 001fffff80010200 ffffea0000dbac08 ffff888017a57650 ffff8880179fe840 +[69832.354972] raw: ffff88802622a528 0000000000120008 00000001ffffffff 0000000000000000 +[69832.356547] page dumped because: kasan: bad access detected +[69832.357652] +[69832.357970] Memory state around the buggy address: +[69832.358926] ffff88802622b980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[69832.360358] ffff88802622ba00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[69832.361810] >ffff88802622ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[69832.363273] ^ +[69832.363975] ffff88802622bb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc +[69832.375960] ffff88802622bb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc +[69832.377405] ================================================================== + +In bfq_dispatch_requestfunction, it may have function call: + +bfq_dispatch_request + __bfq_dispatch_request + bfq_select_queue + bfq_bfqq_expire + __bfq_bfqd_reset_in_service + bfq_put_queue + kmem_cache_free +In this function call, in_serv_queue has beed expired and meet the +conditions to free. In the function bfq_dispatch_request, the address +of in_serv_queue pointing to has been released. For getting the value +of idle_timer_disabled, it will get flags value from the address which +in_serv_queue pointing to, then the problem of use-after-free happens; + +Fix the problem by check in_serv_queue == bfqd->in_service_queue, to +get the value of idle_timer_disabled if in_serve_queue is equel to +bfqd->in_service_queue. If the space of in_serv_queue pointing has +been released, this judge will aviod use-after-free problem. +And if in_serv_queue may be expired or finished, the idle_timer_disabled +will be false which would not give effects to bfq_update_dispatch_stats. + +Reported-by: Hulk Robot +Signed-off-by: Zhang Wensheng +Link: https://lore.kernel.org/r/20220303070334.3020168-1-zhangwensheng5@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-iosched.c | 15 ++++++++------- + 1 file changed, 8 insertions(+), 7 deletions(-) + +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 8d95bf7765b1..138541996dd5 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -4799,7 +4799,7 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx) + struct bfq_data *bfqd = hctx->queue->elevator->elevator_data; + struct request *rq; + struct bfq_queue *in_serv_queue; +- bool waiting_rq, idle_timer_disabled; ++ bool waiting_rq, idle_timer_disabled = false; + + spin_lock_irq(&bfqd->lock); + +@@ -4807,14 +4807,15 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx) + waiting_rq = in_serv_queue && bfq_bfqq_wait_request(in_serv_queue); + + rq = __bfq_dispatch_request(hctx); +- +- idle_timer_disabled = +- waiting_rq && !bfq_bfqq_wait_request(in_serv_queue); ++ if (in_serv_queue == bfqd->in_service_queue) { ++ idle_timer_disabled = ++ waiting_rq && !bfq_bfqq_wait_request(in_serv_queue); ++ } + + spin_unlock_irq(&bfqd->lock); +- +- bfq_update_dispatch_stats(hctx->queue, rq, in_serv_queue, +- idle_timer_disabled); ++ bfq_update_dispatch_stats(hctx->queue, rq, ++ idle_timer_disabled ? in_serv_queue : NULL, ++ idle_timer_disabled); + + return rq; + } +-- +2.34.1 + diff --git a/queue-5.10/block-bfq-don-t-move-oom_bfqq.patch b/queue-5.10/block-bfq-don-t-move-oom_bfqq.patch new file mode 100644 index 00000000000..ffd82f5a06b --- /dev/null +++ b/queue-5.10/block-bfq-don-t-move-oom_bfqq.patch @@ -0,0 +1,142 @@ +From 934670e04341b1ede0173ac2f68e6cffc2e9d64a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 29 Jan 2022 09:59:24 +0800 +Subject: block, bfq: don't move oom_bfqq + +From: Yu Kuai + +[ Upstream commit 8410f70977734f21b8ed45c37e925d311dfda2e7 ] + +Our test report a UAF: + +[ 2073.019181] ================================================================== +[ 2073.019188] BUG: KASAN: use-after-free in __bfq_put_async_bfqq+0xa0/0x168 +[ 2073.019191] Write of size 8 at addr ffff8000ccf64128 by task rmmod/72584 +[ 2073.019192] +[ 2073.019196] CPU: 0 PID: 72584 Comm: rmmod Kdump: loaded Not tainted 4.19.90-yk #5 +[ 2073.019198] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 +[ 2073.019200] Call trace: +[ 2073.019203] dump_backtrace+0x0/0x310 +[ 2073.019206] show_stack+0x28/0x38 +[ 2073.019210] dump_stack+0xec/0x15c +[ 2073.019216] print_address_description+0x68/0x2d0 +[ 2073.019220] kasan_report+0x238/0x2f0 +[ 2073.019224] __asan_store8+0x88/0xb0 +[ 2073.019229] __bfq_put_async_bfqq+0xa0/0x168 +[ 2073.019233] bfq_put_async_queues+0xbc/0x208 +[ 2073.019236] bfq_pd_offline+0x178/0x238 +[ 2073.019240] blkcg_deactivate_policy+0x1f0/0x420 +[ 2073.019244] bfq_exit_queue+0x128/0x178 +[ 2073.019249] blk_mq_exit_sched+0x12c/0x160 +[ 2073.019252] elevator_exit+0xc8/0xd0 +[ 2073.019256] blk_exit_queue+0x50/0x88 +[ 2073.019259] blk_cleanup_queue+0x228/0x3d8 +[ 2073.019267] null_del_dev+0xfc/0x1e0 [null_blk] +[ 2073.019274] null_exit+0x90/0x114 [null_blk] +[ 2073.019278] __arm64_sys_delete_module+0x358/0x5a0 +[ 2073.019282] el0_svc_common+0xc8/0x320 +[ 2073.019287] el0_svc_handler+0xf8/0x160 +[ 2073.019290] el0_svc+0x10/0x218 +[ 2073.019291] +[ 2073.019294] Allocated by task 14163: +[ 2073.019301] kasan_kmalloc+0xe0/0x190 +[ 2073.019305] kmem_cache_alloc_node_trace+0x1cc/0x418 +[ 2073.019308] bfq_pd_alloc+0x54/0x118 +[ 2073.019313] blkcg_activate_policy+0x250/0x460 +[ 2073.019317] bfq_create_group_hierarchy+0x38/0x110 +[ 2073.019321] bfq_init_queue+0x6d0/0x948 +[ 2073.019325] blk_mq_init_sched+0x1d8/0x390 +[ 2073.019330] elevator_switch_mq+0x88/0x170 +[ 2073.019334] elevator_switch+0x140/0x270 +[ 2073.019338] elv_iosched_store+0x1a4/0x2a0 +[ 2073.019342] queue_attr_store+0x90/0xe0 +[ 2073.019348] sysfs_kf_write+0xa8/0xe8 +[ 2073.019351] kernfs_fop_write+0x1f8/0x378 +[ 2073.019359] __vfs_write+0xe0/0x360 +[ 2073.019363] vfs_write+0xf0/0x270 +[ 2073.019367] ksys_write+0xdc/0x1b8 +[ 2073.019371] __arm64_sys_write+0x50/0x60 +[ 2073.019375] el0_svc_common+0xc8/0x320 +[ 2073.019380] el0_svc_handler+0xf8/0x160 +[ 2073.019383] el0_svc+0x10/0x218 +[ 2073.019385] +[ 2073.019387] Freed by task 72584: +[ 2073.019391] __kasan_slab_free+0x120/0x228 +[ 2073.019394] kasan_slab_free+0x10/0x18 +[ 2073.019397] kfree+0x94/0x368 +[ 2073.019400] bfqg_put+0x64/0xb0 +[ 2073.019404] bfqg_and_blkg_put+0x90/0xb0 +[ 2073.019408] bfq_put_queue+0x220/0x228 +[ 2073.019413] __bfq_put_async_bfqq+0x98/0x168 +[ 2073.019416] bfq_put_async_queues+0xbc/0x208 +[ 2073.019420] bfq_pd_offline+0x178/0x238 +[ 2073.019424] blkcg_deactivate_policy+0x1f0/0x420 +[ 2073.019429] bfq_exit_queue+0x128/0x178 +[ 2073.019433] blk_mq_exit_sched+0x12c/0x160 +[ 2073.019437] elevator_exit+0xc8/0xd0 +[ 2073.019440] blk_exit_queue+0x50/0x88 +[ 2073.019443] blk_cleanup_queue+0x228/0x3d8 +[ 2073.019451] null_del_dev+0xfc/0x1e0 [null_blk] +[ 2073.019459] null_exit+0x90/0x114 [null_blk] +[ 2073.019462] __arm64_sys_delete_module+0x358/0x5a0 +[ 2073.019467] el0_svc_common+0xc8/0x320 +[ 2073.019471] el0_svc_handler+0xf8/0x160 +[ 2073.019474] el0_svc+0x10/0x218 +[ 2073.019475] +[ 2073.019479] The buggy address belongs to the object at ffff8000ccf63f00 + which belongs to the cache kmalloc-1024 of size 1024 +[ 2073.019484] The buggy address is located 552 bytes inside of + 1024-byte region [ffff8000ccf63f00, ffff8000ccf64300) +[ 2073.019486] The buggy address belongs to the page: +[ 2073.019492] page:ffff7e000333d800 count:1 mapcount:0 mapping:ffff8000c0003a00 index:0x0 compound_mapcount: 0 +[ 2073.020123] flags: 0x7ffff0000008100(slab|head) +[ 2073.020403] raw: 07ffff0000008100 ffff7e0003334c08 ffff7e00001f5a08 ffff8000c0003a00 +[ 2073.020409] raw: 0000000000000000 00000000001c001c 00000001ffffffff 0000000000000000 +[ 2073.020411] page dumped because: kasan: bad access detected +[ 2073.020412] +[ 2073.020414] Memory state around the buggy address: +[ 2073.020420] ffff8000ccf64000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 2073.020424] ffff8000ccf64080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 2073.020428] >ffff8000ccf64100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 2073.020430] ^ +[ 2073.020434] ffff8000ccf64180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 2073.020438] ffff8000ccf64200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb +[ 2073.020439] ================================================================== + +The same problem exist in mainline as well. + +This is because oom_bfqq is moved to a non-root group, thus root_group +is freed earlier. + +Thus fix the problem by don't move oom_bfqq. + +Signed-off-by: Yu Kuai +Reviewed-by: Jan Kara +Acked-by: Paolo Valente +Link: https://lore.kernel.org/r/20220129015924.3958918-4-yukuai3@huawei.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/bfq-cgroup.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index b791e2041e49..c2fdd6fcdaee 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -642,6 +642,12 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, + { + struct bfq_entity *entity = &bfqq->entity; + ++ /* ++ * oom_bfqq is not allowed to move, oom_bfqq will hold ref to root_group ++ * until elevator exit. ++ */ ++ if (bfqq == &bfqd->oom_bfqq) ++ return; + /* + * Get extra reference to prevent bfqq from being freed in + * next possible expire or deactivate. +-- +2.34.1 + diff --git a/queue-5.10/block-don-t-delete-queue-kobject-before-its-children.patch b/queue-5.10/block-don-t-delete-queue-kobject-before-its-children.patch new file mode 100644 index 00000000000..a1c7217f148 --- /dev/null +++ b/queue-5.10/block-don-t-delete-queue-kobject-before-its-children.patch @@ -0,0 +1,71 @@ +From 2b12f8c96d2ad176399e8fe8bfc53780fec7cdc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 13:59:37 -0800 +Subject: block: don't delete queue kobject before its children + +From: Eric Biggers + +[ Upstream commit 0f69288253e9fc7c495047720e523b9f1aba5712 ] + +kobjects aren't supposed to be deleted before their child kobjects are +deleted. Apparently this is usually benign; however, a WARN will be +triggered if one of the child kobjects has a named attribute group: + + sysfs group 'modes' not found for kobject 'crypto' + WARNING: CPU: 0 PID: 1 at fs/sysfs/group.c:278 sysfs_remove_group+0x72/0x80 + ... + Call Trace: + sysfs_remove_groups+0x29/0x40 fs/sysfs/group.c:312 + __kobject_del+0x20/0x80 lib/kobject.c:611 + kobject_cleanup+0xa4/0x140 lib/kobject.c:696 + kobject_release lib/kobject.c:736 [inline] + kref_put include/linux/kref.h:65 [inline] + kobject_put+0x53/0x70 lib/kobject.c:753 + blk_crypto_sysfs_unregister+0x10/0x20 block/blk-crypto-sysfs.c:159 + blk_unregister_queue+0xb0/0x110 block/blk-sysfs.c:962 + del_gendisk+0x117/0x250 block/genhd.c:610 + +Fix this by moving the kobject_del() and the corresponding +kobject_uevent() to the correct place. + +Fixes: 2c2086afc2b8 ("block: Protect less code with sysfs_lock in blk_{un,}register_queue()") +Reviewed-by: Hannes Reinecke +Reviewed-by: Greg Kroah-Hartman +Reviewed-by: Bart Van Assche +Signed-off-by: Eric Biggers +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220124215938.2769-3-ebiggers@kernel.org +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-sysfs.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index b513f1683af0..8c5816364dd1 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -958,15 +958,17 @@ void blk_unregister_queue(struct gendisk *disk) + */ + if (queue_is_mq(q)) + blk_mq_unregister_dev(disk_to_dev(disk), q); +- +- kobject_uevent(&q->kobj, KOBJ_REMOVE); +- kobject_del(&q->kobj); + blk_trace_remove_sysfs(disk_to_dev(disk)); + + mutex_lock(&q->sysfs_lock); + if (q->elevator) + elv_unregister_queue(q); + mutex_unlock(&q->sysfs_lock); ++ ++ /* Now that we've deleted all child objects, we can delete the queue. */ ++ kobject_uevent(&q->kobj, KOBJ_REMOVE); ++ kobject_del(&q->kobj); ++ + mutex_unlock(&q->sysfs_dir_lock); + + kobject_put(&disk_to_dev(disk)->kobj); +-- +2.34.1 + diff --git a/queue-5.10/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch b/queue-5.10/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch new file mode 100644 index 00000000000..ed99384d3c1 --- /dev/null +++ b/queue-5.10/bluetooth-btmtksdio-fix-kernel-oops-in-btmtksdio_int.patch @@ -0,0 +1,72 @@ +From 4628de0ba9d8ad1da5428f5d7901e18e14c9738c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 07:15:19 +0800 +Subject: Bluetooth: btmtksdio: Fix kernel oops in btmtksdio_interrupt + +From: Yake Yang + +[ Upstream commit b062a0b9c1dc1ff63094337dccfe1568d5b62023 ] + +Fix the following kernel oops in btmtksdio_interrrupt + +[ 14.339134] btmtksdio_interrupt+0x28/0x54 +[ 14.339139] process_sdio_pending_irqs+0x68/0x1a0 +[ 14.339144] sdio_irq_work+0x40/0x70 +[ 14.339154] process_one_work+0x184/0x39c +[ 14.339160] worker_thread+0x228/0x3e8 +[ 14.339168] kthread+0x148/0x3ac +[ 14.339176] ret_from_fork+0x10/0x30 + +That happened because hdev->power_on is already called before +sdio_set_drvdata which btmtksdio_interrupt handler relies on is not +properly set up. + +The details are shown as the below: hci_register_dev would run +queue_work(hdev->req_workqueue, &hdev->power_on) as WQ_HIGHPRI +workqueue_struct to complete the power-on sequeunce and thus hci_power_on +may run before sdio_set_drvdata is done in btmtksdio_probe. + +The hci_dev_do_open in hci_power_on would initialize the device and enable +the interrupt and thus it is possible that btmtksdio_interrupt is being +called right before sdio_set_drvdata is filled out. + +When btmtksdio_interrupt is being called and sdio_set_drvdata is not filled +, the kernel oops is going to happen because btmtksdio_interrupt access an +uninitialized pointer. + +Fixes: 9aebfd4a2200 ("Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices") +Reviewed-by: Mark Chen +Co-developed-by: Sean Wang +Signed-off-by: Sean Wang +Signed-off-by: Yake Yang +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/btmtksdio.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/bluetooth/btmtksdio.c b/drivers/bluetooth/btmtksdio.c +index 74856a586216..c41560be39fb 100644 +--- a/drivers/bluetooth/btmtksdio.c ++++ b/drivers/bluetooth/btmtksdio.c +@@ -981,6 +981,8 @@ static int btmtksdio_probe(struct sdio_func *func, + hdev->manufacturer = 70; + set_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks); + ++ sdio_set_drvdata(func, bdev); ++ + err = hci_register_dev(hdev); + if (err < 0) { + dev_err(&func->dev, "Can't register HCI device\n"); +@@ -988,8 +990,6 @@ static int btmtksdio_probe(struct sdio_func *func, + return err; + } + +- sdio_set_drvdata(func, bdev); +- + /* pm_runtime_enable would be done after the firmware is being + * downloaded because the core layer probably already enables + * runtime PM for this func such as the case host->caps & +-- +2.34.1 + diff --git a/queue-5.10/bluetooth-call-hci_le_conn_failed-with-hdev-lock-in-.patch b/queue-5.10/bluetooth-call-hci_le_conn_failed-with-hdev-lock-in-.patch new file mode 100644 index 00000000000..2bc74ab128a --- /dev/null +++ b/queue-5.10/bluetooth-call-hci_le_conn_failed-with-hdev-lock-in-.patch @@ -0,0 +1,41 @@ +From 118be6bf4dd69d48bc46650b64976f6f0a9d35f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 16:33:50 +0100 +Subject: Bluetooth: call hci_le_conn_failed with hdev lock in + hci_le_conn_failed + +From: Niels Dossche + +[ Upstream commit 9fa6b4cda3b414e990f008f45f9bcecbcb54d4d1 ] + +hci_le_conn_failed function's documentation says that the caller must +hold hdev->lock. The only callsite that does not hold that lock is +hci_le_conn_failed. The other 3 callsites hold the hdev->lock very +locally. The solution is to hold the lock during the call to +hci_le_conn_failed. + +Fixes: 3c857757ef6e ("Bluetooth: Add directed advertising support through connect()") +Signed-off-by: Niels Dossche +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + net/bluetooth/hci_conn.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index 1c5a0a60292d..ecd2ffcf2ba2 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -508,7 +508,9 @@ static void le_conn_timeout(struct work_struct *work) + if (conn->role == HCI_ROLE_SLAVE) { + /* Disable LE Advertising */ + le_disable_advertising(hdev); ++ hci_dev_lock(hdev); + hci_le_conn_failed(conn, HCI_ERROR_ADVERTISING_TIMEOUT); ++ hci_dev_unlock(hdev); + return; + } + +-- +2.34.1 + diff --git a/queue-5.10/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch b/queue-5.10/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch new file mode 100644 index 00000000000..7ec6d8302eb --- /dev/null +++ b/queue-5.10/bluetooth-hci_serdev-call-init_rwsem-before-p-open.patch @@ -0,0 +1,71 @@ +From e186b5216db6399c40fd07116183ce4b09e89867 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jan 2022 16:27:04 +0300 +Subject: Bluetooth: hci_serdev: call init_rwsem() before p->open() + +From: Pavel Skripkin + +[ Upstream commit 9d7cbe2b9cf5f650067df4f402fdd799d4bbb4e1 ] + +kvartet reported, that hci_uart_tx_wakeup() uses uninitialized rwsem. +The problem was in wrong place for percpu_init_rwsem() call. + +hci_uart_proto::open() may register a timer whose callback may call +hci_uart_tx_wakeup(). There is a chance, that hci_uart_register_device() +thread won't be fast enough to call percpu_init_rwsem(). + +Fix it my moving percpu_init_rwsem() call before p->open(). + +INFO: trying to register non-static key. +The code is fine but needs lockdep annotation, or maybe +you didn't initialize this object before use? +turning off the locking correctness validator. +CPU: 2 PID: 18524 Comm: syz-executor.5 Not tainted 5.16.0-rc6 #9 +... +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 + assign_lock_key kernel/locking/lockdep.c:951 [inline] + register_lock_class+0x148d/0x1950 kernel/locking/lockdep.c:1263 + __lock_acquire+0x106/0x57e0 kernel/locking/lockdep.c:4906 + lock_acquire kernel/locking/lockdep.c:5637 [inline] + lock_acquire+0x1ab/0x520 kernel/locking/lockdep.c:5602 + percpu_down_read_trylock include/linux/percpu-rwsem.h:92 [inline] + hci_uart_tx_wakeup+0x12e/0x490 drivers/bluetooth/hci_ldisc.c:124 + h5_timed_event+0x32f/0x6a0 drivers/bluetooth/hci_h5.c:188 + call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 + +Fixes: d73e17281665 ("Bluetooth: hci_serdev: Init hci_uart proto_lock to avoid oops") +Reported-by: Yiru Xu +Signed-off-by: Pavel Skripkin +Signed-off-by: Marcel Holtmann +Signed-off-by: Sasha Levin +--- + drivers/bluetooth/hci_serdev.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index 9e03402ef1b3..e9a44ab3812d 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -305,6 +305,8 @@ int hci_uart_register_device(struct hci_uart *hu, + if (err) + return err; + ++ percpu_init_rwsem(&hu->proto_lock); ++ + err = p->open(hu); + if (err) + goto err_open; +@@ -327,7 +329,6 @@ int hci_uart_register_device(struct hci_uart *hu, + + INIT_WORK(&hu->init_ready, hci_uart_init_work); + INIT_WORK(&hu->write_work, hci_uart_write_work); +- percpu_init_rwsem(&hu->proto_lock); + + /* Only when vendor specific setup callback is provided, consider + * the manufacturer information valid. This avoids filling in the +-- +2.34.1 + diff --git a/queue-5.10/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch b/queue-5.10/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch new file mode 100644 index 00000000000..6a2e287bb10 --- /dev/null +++ b/queue-5.10/bpf-arm64-call-build_prologue-first-in-first-jit-pas.patch @@ -0,0 +1,53 @@ +From e42a2374e331c2f7c0a3f64be1f60cd98cf61146 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Feb 2022 20:19:05 +0800 +Subject: bpf, arm64: Call build_prologue() first in first JIT pass + +From: Hou Tao + +[ Upstream commit 68e4f238b0e9d3670a1612ad900a6e98b2b3f7dd ] + +BPF line info needs ctx->offset to be the instruction offset in the whole JITed +image instead of the body itself, so also call build_prologue() first in first +JIT pass. + +Fixes: 37ab566c178d ("bpf: arm64: Enable arm64 jit to provide bpf_line_info") +Signed-off-by: Hou Tao +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20220226121906.5709-2-houtao1@huawei.com +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 13 ++++++++----- + 1 file changed, 8 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 064577ff9ff5..880f50c53086 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -1040,15 +1040,18 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + goto out_off; + } + +- /* 1. Initial fake pass to compute ctx->idx. */ +- +- /* Fake pass to fill in ctx->offset. */ +- if (build_body(&ctx, extra_pass)) { ++ /* ++ * 1. Initial fake pass to compute ctx->idx and ctx->offset. ++ * ++ * BPF line info needs ctx->offset[i] to be the offset of ++ * instruction[i] in jited image, so build prologue first. ++ */ ++ if (build_prologue(&ctx, was_classic)) { + prog = orig_prog; + goto out_off; + } + +- if (build_prologue(&ctx, was_classic)) { ++ if (build_body(&ctx, extra_pass)) { + prog = orig_prog; + goto out_off; + } +-- +2.34.1 + diff --git a/queue-5.10/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch b/queue-5.10/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch new file mode 100644 index 00000000000..c0e03e77072 --- /dev/null +++ b/queue-5.10/bpf-arm64-feed-byte-offset-into-bpf-line-info.patch @@ -0,0 +1,46 @@ +From bc283e0a33bf796029cecdef64670f7fd4608908 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Feb 2022 20:19:06 +0800 +Subject: bpf, arm64: Feed byte-offset into bpf line info + +From: Hou Tao + +[ Upstream commit dda7596c109fc382876118627e29db7607cde35d ] + +insn_to_jit_off passed to bpf_prog_fill_jited_linfo() is calculated in +instruction granularity instead of bytes granularity, but BPF line info +requires byte offset. + +bpf_prog_fill_jited_linfo() will be the last user of ctx.offset before +it is freed, so convert the offset into byte-offset before calling into +bpf_prog_fill_jited_linfo() in order to fix the line info dump on arm64. + +Fixes: 37ab566c178d ("bpf: arm64: Enable arm64 jit to provide bpf_line_info") +Suggested-by: Daniel Borkmann +Signed-off-by: Hou Tao +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20220226121906.5709-3-houtao1@huawei.com +Signed-off-by: Sasha Levin +--- + arch/arm64/net/bpf_jit_comp.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index 880f50c53086..9c6cab71ba98 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -1124,6 +1124,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + prog->jited_len = prog_size; + + if (!prog->is_func || extra_pass) { ++ int i; ++ ++ /* offset[prog->len] is the size of program */ ++ for (i = 0; i <= prog->len; i++) ++ ctx.offset[i] *= AARCH64_INSN_SIZE; + bpf_prog_fill_jited_linfo(prog, ctx.offset + 1); + out_off: + kfree(ctx.offset); +-- +2.34.1 + diff --git a/queue-5.10/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch b/queue-5.10/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch new file mode 100644 index 00000000000..5221dd51638 --- /dev/null +++ b/queue-5.10/bpf-sockmap-fix-double-uncharge-the-mem-of-sk_msg.patch @@ -0,0 +1,72 @@ +From 8acbf5d09757439cf9f7d33a13da0e86bd94b1ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 16:11:45 +0800 +Subject: bpf, sockmap: Fix double uncharge the mem of sk_msg + +From: Wang Yufen + +[ Upstream commit 2486ab434b2c2a14e9237296db00b1e1b7ae3273 ] + +If tcp_bpf_sendmsg is running during a tear down operation, psock may be +freed. + +tcp_bpf_sendmsg() + tcp_bpf_send_verdict() + sk_msg_return() + tcp_bpf_sendmsg_redir() + unlikely(!psock)) + sk_msg_free() + +The mem of msg has been uncharged in tcp_bpf_send_verdict() by +sk_msg_return(), and would be uncharged by sk_msg_free() again. When psock +is null, we can simply returning an error code, this would then trigger +the sk_msg_free_nocharge in the error path of __SK_REDIRECT and would have +the side effect of throwing an error up to user space. This would be a +slight change in behavior from user side but would look the same as an +error if the redirect on the socket threw an error. + +This issue can cause the following info: +WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260 +Call Trace: + + __sk_destruct+0x24/0x1f0 + sk_psock_destroy+0x19b/0x1c0 + process_one_work+0x1b3/0x3c0 + worker_thread+0x30/0x350 + ? process_one_work+0x3c0/0x3c0 + kthread+0xe6/0x110 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x22/0x30 + + +Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: Wang Yufen +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20220304081145.2037182-5-wangyufen@huawei.com +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_bpf.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c +index c089e8166fa9..eaf2308c355a 100644 +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -218,10 +218,9 @@ int tcp_bpf_sendmsg_redir(struct sock *sk, struct sk_msg *msg, + struct sk_psock *psock = sk_psock_get(sk); + int ret; + +- if (unlikely(!psock)) { +- sk_msg_free(sk, msg); +- return 0; +- } ++ if (unlikely(!psock)) ++ return -EPIPE; ++ + ret = ingress ? bpf_tcp_ingress(sk, psock, msg, bytes, flags) : + tcp_bpf_push_locked(sk, msg, bytes, flags, false); + sk_psock_put(sk, psock); +-- +2.34.1 + diff --git a/queue-5.10/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch b/queue-5.10/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch new file mode 100644 index 00000000000..cd04a1a8bf9 --- /dev/null +++ b/queue-5.10/bpf-sockmap-fix-memleak-in-tcp_bpf_sendmsg-while-sk-.patch @@ -0,0 +1,109 @@ +From 93a2dda9b203a05d8c77cf037be3681ba9cfa94b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 16:11:43 +0800 +Subject: bpf, sockmap: Fix memleak in tcp_bpf_sendmsg while sk msg is full + +From: Wang Yufen + +[ Upstream commit 9c34e38c4a870eb30b13f42f5b44f42e9d19ccb8 ] + +If tcp_bpf_sendmsg() is running while sk msg is full. When sk_msg_alloc() +returns -ENOMEM error, tcp_bpf_sendmsg() goes to wait_for_memory. If partial +memory has been alloced by sk_msg_alloc(), that is, msg_tx->sg.size is +greater than osize after sk_msg_alloc(), memleak occurs. To fix we use +sk_msg_trim() to release the allocated memory, then goto wait for memory. + +Other call paths of sk_msg_alloc() have the similar issue, such as +tls_sw_sendmsg(), so handle sk_msg_trim logic inside sk_msg_alloc(), +as Cong Wang suggested. + +This issue can cause the following info: +WARNING: CPU: 3 PID: 7950 at net/core/stream.c:208 sk_stream_kill_queues+0xd4/0x1a0 +Call Trace: + + inet_csk_destroy_sock+0x55/0x110 + __tcp_close+0x279/0x470 + tcp_close+0x1f/0x60 + inet_release+0x3f/0x80 + __sock_release+0x3d/0xb0 + sock_close+0x11/0x20 + __fput+0x92/0x250 + task_work_run+0x6a/0xa0 + do_exit+0x33b/0xb60 + do_group_exit+0x2f/0xa0 + get_signal+0xb6/0x950 + arch_do_signal_or_restart+0xac/0x2a0 + exit_to_user_mode_prepare+0xa9/0x200 + syscall_exit_to_user_mode+0x12/0x30 + do_syscall_64+0x46/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + +WARNING: CPU: 3 PID: 2094 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260 +Call Trace: + + __sk_destruct+0x24/0x1f0 + sk_psock_destroy+0x19b/0x1c0 + process_one_work+0x1b3/0x3c0 + kthread+0xe6/0x110 + ret_from_fork+0x22/0x30 + + +Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: Wang Yufen +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20220304081145.2037182-3-wangyufen@huawei.com +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index e4bb89599b44..545181a1ae04 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -27,6 +27,7 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, + int elem_first_coalesce) + { + struct page_frag *pfrag = sk_page_frag(sk); ++ u32 osize = msg->sg.size; + int ret = 0; + + len -= msg->sg.size; +@@ -35,13 +36,17 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, + u32 orig_offset; + int use, i; + +- if (!sk_page_frag_refill(sk, pfrag)) +- return -ENOMEM; ++ if (!sk_page_frag_refill(sk, pfrag)) { ++ ret = -ENOMEM; ++ goto msg_trim; ++ } + + orig_offset = pfrag->offset; + use = min_t(int, len, pfrag->size - orig_offset); +- if (!sk_wmem_schedule(sk, use)) +- return -ENOMEM; ++ if (!sk_wmem_schedule(sk, use)) { ++ ret = -ENOMEM; ++ goto msg_trim; ++ } + + i = msg->sg.end; + sk_msg_iter_var_prev(i); +@@ -71,6 +76,10 @@ int sk_msg_alloc(struct sock *sk, struct sk_msg *msg, int len, + } + + return ret; ++ ++msg_trim: ++ sk_msg_trim(sk, msg, osize); ++ return ret; + } + EXPORT_SYMBOL_GPL(sk_msg_alloc); + +-- +2.34.1 + diff --git a/queue-5.10/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch b/queue-5.10/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch new file mode 100644 index 00000000000..100518c95d6 --- /dev/null +++ b/queue-5.10/bpf-sockmap-fix-more-uncharged-while-msg-has-more_da.patch @@ -0,0 +1,100 @@ +From 7909ec6d88bc9816df1e921f5bb92073f3cf75ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 16:11:44 +0800 +Subject: bpf, sockmap: Fix more uncharged while msg has more_data + +From: Wang Yufen + +[ Upstream commit 84472b436e760ba439e1969a9e3c5ae7c86de39d ] + +In tcp_bpf_send_verdict(), if msg has more data after +tcp_bpf_sendmsg_redir(): + +tcp_bpf_send_verdict() + tosend = msg->sg.size //msg->sg.size = 22220 + case __SK_REDIRECT: + sk_msg_return() //uncharged msg->sg.size(22220) sk->sk_forward_alloc + tcp_bpf_sendmsg_redir() //after tcp_bpf_sendmsg_redir, msg->sg.size=11000 + goto more_data; + tosend = msg->sg.size //msg->sg.size = 11000 + case __SK_REDIRECT: + sk_msg_return() //uncharged msg->sg.size(11000) to sk->sk_forward_alloc + +The msg->sg.size(11000) has been uncharged twice, to fix we can charge the +remaining msg->sg.size before goto more data. + +This issue can cause the following info: +WARNING: CPU: 0 PID: 9860 at net/core/stream.c:208 sk_stream_kill_queues+0xd4/0x1a0 +Call Trace: + + inet_csk_destroy_sock+0x55/0x110 + __tcp_close+0x279/0x470 + tcp_close+0x1f/0x60 + inet_release+0x3f/0x80 + __sock_release+0x3d/0xb0 + sock_close+0x11/0x20 + __fput+0x92/0x250 + task_work_run+0x6a/0xa0 + do_exit+0x33b/0xb60 + do_group_exit+0x2f/0xa0 + get_signal+0xb6/0x950 + arch_do_signal_or_restart+0xac/0x2a0 + ? vfs_write+0x237/0x290 + exit_to_user_mode_prepare+0xa9/0x200 + syscall_exit_to_user_mode+0x12/0x30 + do_syscall_64+0x46/0x80 + entry_SYSCALL_64_after_hwframe+0x44/0xae + + +WARNING: CPU: 0 PID: 2136 at net/ipv4/af_inet.c:155 inet_sock_destruct+0x13c/0x260 +Call Trace: + + __sk_destruct+0x24/0x1f0 + sk_psock_destroy+0x19b/0x1c0 + process_one_work+0x1b3/0x3c0 + worker_thread+0x30/0x350 + ? process_one_work+0x3c0/0x3c0 + kthread+0xe6/0x110 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x22/0x30 + + +Fixes: 604326b41a6f ("bpf, sockmap: convert to generic sk_msg interface") +Signed-off-by: Wang Yufen +Signed-off-by: Daniel Borkmann +Acked-by: John Fastabend +Link: https://lore.kernel.org/bpf/20220304081145.2037182-4-wangyufen@huawei.com +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_bpf.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c +index 6b745ce4108c..c089e8166fa9 100644 +--- a/net/ipv4/tcp_bpf.c ++++ b/net/ipv4/tcp_bpf.c +@@ -371,7 +371,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, + cork = true; + psock->cork = NULL; + } +- sk_msg_return(sk, msg, tosend); ++ sk_msg_return(sk, msg, msg->sg.size); + release_sock(sk); + + ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags); +@@ -411,8 +411,11 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock, + } + if (msg && + msg->sg.data[msg->sg.start].page_link && +- msg->sg.data[msg->sg.start].length) ++ msg->sg.data[msg->sg.start].length) { ++ if (eval == __SK_REDIRECT) ++ sk_mem_charge(sk, msg->sg.size); + goto more_data; ++ } + } + return ret; + } +-- +2.34.1 + diff --git a/queue-5.10/btrfs-fix-unexpected-error-path-when-reflinking-an-i.patch b/queue-5.10/btrfs-fix-unexpected-error-path-when-reflinking-an-i.patch new file mode 100644 index 00000000000..c55a118897a --- /dev/null +++ b/queue-5.10/btrfs-fix-unexpected-error-path-when-reflinking-an-i.patch @@ -0,0 +1,50 @@ +From f6b3f8ddae7b65cf926b90377fb4b1ff081be432 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Feb 2022 12:12:07 +0000 +Subject: btrfs: fix unexpected error path when reflinking an inline extent + +From: Filipe Manana + +[ Upstream commit 1f4613cdbe7739ce291554b316bff8e551383389 ] + +When reflinking an inline extent, we assert that its file offset is 0 and +that its uncompressed length is not greater than the sector size. We then +return an error if one of those conditions is not satisfied. However we +use a return statement, which results in returning from btrfs_clone() +without freeing the path and buffer that were allocated before, as well as +not clearing the flag BTRFS_INODE_NO_DELALLOC_FLUSH for the destination +inode. + +Fix that by jumping to the 'out' label instead, and also add a WARN_ON() +for each condition so that in case assertions are disabled, we get to +known which of the unexpected conditions triggered the error. + +Fixes: a61e1e0df9f321 ("Btrfs: simplify inline extent handling when doing reflinks") +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/reflink.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/btrfs/reflink.c b/fs/btrfs/reflink.c +index 3a3102bc15a0..4b3ae0faf548 100644 +--- a/fs/btrfs/reflink.c ++++ b/fs/btrfs/reflink.c +@@ -503,8 +503,11 @@ static int btrfs_clone(struct inode *src, struct inode *inode, + */ + ASSERT(key.offset == 0); + ASSERT(datal <= fs_info->sectorsize); +- if (key.offset != 0 || datal > fs_info->sectorsize) +- return -EUCLEAN; ++ if (WARN_ON(key.offset != 0) || ++ WARN_ON(datal > fs_info->sectorsize)) { ++ ret = -EUCLEAN; ++ goto out; ++ } + + ret = clone_copy_inline_extent(inode, path, &new_key, + drop_start, datal, size, +-- +2.34.1 + diff --git a/queue-5.10/can-isotp-return-eaddrnotavail-when-reading-from-unb.patch b/queue-5.10/can-isotp-return-eaddrnotavail-when-reading-from-unb.patch new file mode 100644 index 00000000000..805f4360432 --- /dev/null +++ b/queue-5.10/can-isotp-return-eaddrnotavail-when-reading-from-unb.patch @@ -0,0 +1,49 @@ +From 833ddbc1b8d120a1c16e12e0c46812105123dcad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 17:42:57 +0100 +Subject: can: isotp: return -EADDRNOTAVAIL when reading from unbound socket + +From: Oliver Hartkopp + +[ Upstream commit 30ffd5332e06316bd69a654c06aa033872979b7c ] + +When reading from an unbound can-isotp socket the syscall blocked +indefinitely. As unbound sockets (without given CAN address information) +do not make sense anyway we directly return -EADDRNOTAVAIL on read() +analogue to the known behavior from sendmsg(). + +Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") +Link: https://github.com/linux-can/can-utils/issues/349 +Link: https://lore.kernel.org/all/20220316164258.54155-2-socketcan@hartkopp.net +Suggested-by: Derek Will +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/isotp.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index d0581dc6a65f..cb5546c186bc 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -1003,12 +1003,16 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + { + struct sock *sk = sock->sk; + struct sk_buff *skb; ++ struct isotp_sock *so = isotp_sk(sk); + int err = 0; + int noblock; + + noblock = flags & MSG_DONTWAIT; + flags &= ~MSG_DONTWAIT; + ++ if (!so->bound) ++ return -EADDRNOTAVAIL; ++ + skb = skb_recv_datagram(sk, flags, noblock, &err); + if (!skb) + return err; +-- +2.34.1 + diff --git a/queue-5.10/can-isotp-support-msg_trunc-flag-when-reading-from-s.patch b/queue-5.10/can-isotp-support-msg_trunc-flag-when-reading-from-s.patch new file mode 100644 index 00000000000..d9283644e6e --- /dev/null +++ b/queue-5.10/can-isotp-support-msg_trunc-flag-when-reading-from-s.patch @@ -0,0 +1,86 @@ +From a6d27ea600b1e04ce29fbe3f1f8c0be628050ab6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 17:42:58 +0100 +Subject: can: isotp: support MSG_TRUNC flag when reading from socket + +From: Oliver Hartkopp + +[ Upstream commit 42bf50a1795a1854d48717b7361dbdbce496b16b ] + +When providing the MSG_TRUNC flag via recvmsg() syscall the return value +provides the real length of the packet or datagram, even when it was longer +than the passed buffer. + +Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") +Link: https://github.com/linux-can/can-utils/issues/347#issuecomment-1065932671 +Link: https://lore.kernel.org/all/20220316164258.54155-3-socketcan@hartkopp.net +Suggested-by: Derek Will +Signed-off-by: Oliver Hartkopp +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + net/can/isotp.c | 27 +++++++++++++++------------ + 1 file changed, 15 insertions(+), 12 deletions(-) + +diff --git a/net/can/isotp.c b/net/can/isotp.c +index cb5546c186bc..518014506fff 100644 +--- a/net/can/isotp.c ++++ b/net/can/isotp.c +@@ -1004,29 +1004,28 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + struct sock *sk = sock->sk; + struct sk_buff *skb; + struct isotp_sock *so = isotp_sk(sk); +- int err = 0; +- int noblock; ++ int noblock = flags & MSG_DONTWAIT; ++ int ret = 0; + +- noblock = flags & MSG_DONTWAIT; +- flags &= ~MSG_DONTWAIT; ++ if (flags & ~(MSG_DONTWAIT | MSG_TRUNC)) ++ return -EINVAL; + + if (!so->bound) + return -EADDRNOTAVAIL; + +- skb = skb_recv_datagram(sk, flags, noblock, &err); ++ flags &= ~MSG_DONTWAIT; ++ skb = skb_recv_datagram(sk, flags, noblock, &ret); + if (!skb) +- return err; ++ return ret; + + if (size < skb->len) + msg->msg_flags |= MSG_TRUNC; + else + size = skb->len; + +- err = memcpy_to_msg(msg, skb->data, size); +- if (err < 0) { +- skb_free_datagram(sk, skb); +- return err; +- } ++ ret = memcpy_to_msg(msg, skb->data, size); ++ if (ret < 0) ++ goto out_err; + + sock_recv_timestamp(msg, sk, skb); + +@@ -1036,9 +1035,13 @@ static int isotp_recvmsg(struct socket *sock, struct msghdr *msg, size_t size, + memcpy(msg->msg_name, skb->cb, msg->msg_namelen); + } + ++ /* set length of return value */ ++ ret = (flags & MSG_TRUNC) ? skb->len : size; ++ ++out_err: + skb_free_datagram(sk, skb); + +- return size; ++ return ret; + } + + static int isotp_release(struct socket *sock) +-- +2.34.1 + diff --git a/queue-5.10/clk-actions-terminate-clk_div_table-with-sentinel-el.patch b/queue-5.10/clk-actions-terminate-clk_div_table-with-sentinel-el.patch new file mode 100644 index 00000000000..1da6b8dc960 --- /dev/null +++ b/queue-5.10/clk-actions-terminate-clk_div_table-with-sentinel-el.patch @@ -0,0 +1,58 @@ +From b1579eff8a1b42c89eaf611cb0bd68a95067a98a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Feb 2022 01:09:17 +0100 +Subject: clk: actions: Terminate clk_div_table with sentinel element +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Neuschäfer + +[ Upstream commit d8a441e53e2434b1401e52dfd66b05263e442edc ] + +In order that the end of a clk_div_table can be detected, it must be +terminated with a sentinel element (.div = 0). + +In owl-s900.s, the { 0, 8 } element was probably meant to be just that, +so this patch changes { 0, 8 } to { 0, 0 }. + +Fixes: d47317ca4ade1 ("clk: actions: Add S700 SoC clock support") +Fixes: d85d20053e195 ("clk: actions: Add S900 SoC clock support") +Signed-off-by: Jonathan Neuschäfer +Reviewed-by: Manivannan Sadhasivam +Link: https://lore.kernel.org/r/20220218000922.134857-2-j.neuschaefer@gmx.net +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/actions/owl-s700.c | 1 + + drivers/clk/actions/owl-s900.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/clk/actions/owl-s700.c b/drivers/clk/actions/owl-s700.c +index a2f34d13fb54..6ea7da1d6d75 100644 +--- a/drivers/clk/actions/owl-s700.c ++++ b/drivers/clk/actions/owl-s700.c +@@ -162,6 +162,7 @@ static struct clk_div_table hdmia_div_table[] = { + + static struct clk_div_table rmii_div_table[] = { + {0, 4}, {1, 10}, ++ {0, 0} + }; + + /* divider clocks */ +diff --git a/drivers/clk/actions/owl-s900.c b/drivers/clk/actions/owl-s900.c +index 790890978424..5144ada2c7e1 100644 +--- a/drivers/clk/actions/owl-s900.c ++++ b/drivers/clk/actions/owl-s900.c +@@ -140,7 +140,7 @@ static struct clk_div_table rmii_ref_div_table[] = { + + static struct clk_div_table usb3_mac_div_table[] = { + { 1, 2 }, { 2, 3 }, { 3, 4 }, +- { 0, 8 }, ++ { 0, 0 } + }; + + static struct clk_div_table i2s_div_table[] = { +-- +2.34.1 + diff --git a/queue-5.10/clk-at91-sama7g5-fix-parents-of-pdmcs-gclk.patch b/queue-5.10/clk-at91-sama7g5-fix-parents-of-pdmcs-gclk.patch new file mode 100644 index 00000000000..594f7eb5f68 --- /dev/null +++ b/queue-5.10/clk-at91-sama7g5-fix-parents-of-pdmcs-gclk.patch @@ -0,0 +1,49 @@ +From 7810101ceb29d7c8b80571d1a47c93283320e553 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 20:26:16 +0200 +Subject: clk: at91: sama7g5: fix parents of PDMCs' GCLK + +From: Codrin Ciubotariu + +[ Upstream commit 1a944729d8635fa59638f24e8727d5ccaa0c8c19 ] + +Audio PLL can be used as parent by the GCLKs of PDMCs. + +Fixes: cb783bbbcf54 ("clk: at91: sama7g5: add clock support for sama7g5") +Signed-off-by: Codrin Ciubotariu +Reviewed-by: Claudiu Beznea +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20220304182616.1920392-1-codrin.ciubotariu@microchip.com +Signed-off-by: Sasha Levin +--- + drivers/clk/at91/sama7g5.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/clk/at91/sama7g5.c b/drivers/clk/at91/sama7g5.c +index a092a940baa4..9d25b23fb99d 100644 +--- a/drivers/clk/at91/sama7g5.c ++++ b/drivers/clk/at91/sama7g5.c +@@ -606,16 +606,16 @@ static const struct { + { .n = "pdmc0_gclk", + .id = 68, + .r = { .max = 50000000 }, +- .pp = { "syspll_divpmcck", "baudpll_divpmcck", }, +- .pp_mux_table = { 5, 8, }, ++ .pp = { "syspll_divpmcck", "audiopll_divpmcck", }, ++ .pp_mux_table = { 5, 9, }, + .pp_count = 2, + .pp_chg_id = INT_MIN, }, + + { .n = "pdmc1_gclk", + .id = 69, + .r = { .max = 50000000, }, +- .pp = { "syspll_divpmcck", "baudpll_divpmcck", }, +- .pp_mux_table = { 5, 8, }, ++ .pp = { "syspll_divpmcck", "audiopll_divpmcck", }, ++ .pp_mux_table = { 5, 9, }, + .pp_count = 2, + .pp_chg_id = INT_MIN, }, + +-- +2.34.1 + diff --git a/queue-5.10/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch b/queue-5.10/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch new file mode 100644 index 00000000000..1c366d7f081 --- /dev/null +++ b/queue-5.10/clk-clps711x-terminate-clk_div_table-with-sentinel-e.patch @@ -0,0 +1,45 @@ +From ef0895509369deea64ca82e8b4cbe01fc5cba860 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Feb 2022 01:09:20 +0100 +Subject: clk: clps711x: Terminate clk_div_table with sentinel element +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Neuschäfer + +[ Upstream commit 8bed4ed5aa3431085d9d27afc35d684856460eda ] + +In order that the end of a clk_div_table can be detected, it must be +terminated with a sentinel element (.div = 0). + +Fixes: 631c53478973d ("clk: Add CLPS711X clk driver") +Signed-off-by: Jonathan Neuschäfer +Link: https://lore.kernel.org/r/20220218000922.134857-5-j.neuschaefer@gmx.net +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk-clps711x.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/clk-clps711x.c b/drivers/clk/clk-clps711x.c +index a2c6486ef170..f8417ee2961a 100644 +--- a/drivers/clk/clk-clps711x.c ++++ b/drivers/clk/clk-clps711x.c +@@ -28,11 +28,13 @@ static const struct clk_div_table spi_div_table[] = { + { .val = 1, .div = 8, }, + { .val = 2, .div = 2, }, + { .val = 3, .div = 1, }, ++ { /* sentinel */ } + }; + + static const struct clk_div_table timer_div_table[] = { + { .val = 0, .div = 256, }, + { .val = 1, .div = 1, }, ++ { /* sentinel */ } + }; + + struct clps711x_clk { +-- +2.34.1 + diff --git a/queue-5.10/clk-imx7d-remove-audio_mclk_root_clk.patch b/queue-5.10/clk-imx7d-remove-audio_mclk_root_clk.patch new file mode 100644 index 00000000000..fbfd7a940e2 --- /dev/null +++ b/queue-5.10/clk-imx7d-remove-audio_mclk_root_clk.patch @@ -0,0 +1,38 @@ +From 26b66b625879f5a06d955350f06240653a7fbe2e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 16:10:52 +0200 +Subject: clk: imx7d: Remove audio_mclk_root_clk + +From: Abel Vesa + +[ Upstream commit eccac77ede3946c90143447cdc785dc16aec4b24 ] + +The audio_mclk_root_clk was added as a gate with the CCGR121 (0x4790), +but according to the reference manual, there is no such gate. The +CCGR121 belongs to ECSPI2 and it is not shared. + +Fixes: 8f6d8094b215b57 ("ARM: imx: add imx7d clk tree support") +Reported-by: David Wolfe +Signed-off-by: Abel Vesa +Reviewed-by: Peng Fan +Link: https://lore.kernel.org/r/20220127141052.1900174-2-abel.vesa@nxp.com +Signed-off-by: Sasha Levin +--- + drivers/clk/imx/clk-imx7d.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/clk/imx/clk-imx7d.c b/drivers/clk/imx/clk-imx7d.c +index c4e0f1c07192..3f6fd7ef2a68 100644 +--- a/drivers/clk/imx/clk-imx7d.c ++++ b/drivers/clk/imx/clk-imx7d.c +@@ -849,7 +849,6 @@ static void __init imx7d_clocks_init(struct device_node *ccm_node) + hws[IMX7D_WDOG4_ROOT_CLK] = imx_clk_hw_gate4("wdog4_root_clk", "wdog_post_div", base + 0x49f0, 0); + hws[IMX7D_KPP_ROOT_CLK] = imx_clk_hw_gate4("kpp_root_clk", "ipg_root_clk", base + 0x4aa0, 0); + hws[IMX7D_CSI_MCLK_ROOT_CLK] = imx_clk_hw_gate4("csi_mclk_root_clk", "csi_mclk_post_div", base + 0x4490, 0); +- hws[IMX7D_AUDIO_MCLK_ROOT_CLK] = imx_clk_hw_gate4("audio_mclk_root_clk", "audio_mclk_post_div", base + 0x4790, 0); + hws[IMX7D_WRCLK_ROOT_CLK] = imx_clk_hw_gate4("wrclk_root_clk", "wrclk_post_div", base + 0x47a0, 0); + hws[IMX7D_USB_CTRL_CLK] = imx_clk_hw_gate4("usb_ctrl_clk", "ahb_root_clk", base + 0x4680, 0); + hws[IMX7D_USB_PHY1_CLK] = imx_clk_hw_gate4("usb_phy1_clk", "pll_usb1_main_clk", base + 0x46a0, 0); +-- +2.34.1 + diff --git a/queue-5.10/clk-initialize-orphan-req_rate.patch b/queue-5.10/clk-initialize-orphan-req_rate.patch new file mode 100644 index 00000000000..0cd0632e9b6 --- /dev/null +++ b/queue-5.10/clk-initialize-orphan-req_rate.patch @@ -0,0 +1,68 @@ +From 2b52a6fe76d704a454443bc0e723a7f5bf5b48ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Mar 2022 17:11:42 +0100 +Subject: clk: Initialize orphan req_rate + +From: Maxime Ripard + +[ Upstream commit 5f7e2af00807f2117650e711a58b7f0e986ce1df ] + +When registering a clock that doesn't have a recalc_rate implementation, +and doesn't have its parent registered yet, we initialize the clk_core +rate and 'req_rate' fields to 0. + +The rate field is later updated when the parent is registered in +clk_core_reparent_orphans_nolock() using __clk_recalc_rates(), but the +'req_rate' field is never updated. + +This leads to an issue in clk_set_rate_range() and clk_put(), since +those functions will call clk_set_rate() with the content of 'req_rate' +to provide drivers with the opportunity to change the rate based on the +new boundaries. In this case, we would call clk_set_rate() with a rate +of 0, effectively enforcing the minimum allowed for this clock whenever +we would call one of those two functions, even though the actual rate +might be within range. + +Let's fix this by setting 'req_rate' in +clk_core_reparent_orphans_nolock() with the rate field content just +updated by the call to __clk_recalc_rates(). + +Fixes: 1c8e600440c7 ("clk: Add rate constraints to clocks") +Reported-by: Dmitry Osipenko +Tested-by: Dmitry Osipenko # T30 Nexus7 +Signed-off-by: Maxime Ripard +Link: https://lore.kernel.org/r/20220325161144.1901695-2-maxime@cerno.tech +[sboyd@kernel.org: Reword comment] +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/clk.c | 13 +++++++++++++ + 1 file changed, 13 insertions(+) + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index b8a0e3d23698..92fc084203b7 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -3384,6 +3384,19 @@ static void clk_core_reparent_orphans_nolock(void) + __clk_set_parent_after(orphan, parent, NULL); + __clk_recalc_accuracies(orphan); + __clk_recalc_rates(orphan, 0); ++ ++ /* ++ * __clk_init_parent() will set the initial req_rate to ++ * 0 if the clock doesn't have clk_ops::recalc_rate and ++ * is an orphan when it's registered. ++ * ++ * 'req_rate' is used by clk_set_rate_range() and ++ * clk_put() to trigger a clk_set_rate() call whenever ++ * the boundaries are modified. Let's make sure ++ * 'req_rate' is set to something non-zero so that ++ * clk_set_rate_range() doesn't drop the frequency. ++ */ ++ orphan->req_rate = orphan->rate; + } + } + } +-- +2.34.1 + diff --git a/queue-5.10/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch b/queue-5.10/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch new file mode 100644 index 00000000000..c434bb1330b --- /dev/null +++ b/queue-5.10/clk-loongson1-terminate-clk_div_table-with-sentinel-.patch @@ -0,0 +1,40 @@ +From 5a749e280cb03015a15120ca7e9740356ee65dd7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Feb 2022 01:09:18 +0100 +Subject: clk: loongson1: Terminate clk_div_table with sentinel element +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Neuschäfer + +[ Upstream commit 3eb00f89162e80083dfcaa842468b510462cfeaa ] + +In order that the end of a clk_div_table can be detected, it must be +terminated with a sentinel element (.div = 0). + +Fixes: b4626a7f4892 ("CLK: Add Loongson1C clock support") +Signed-off-by: Jonathan Neuschäfer +Reviewed-by: Philippe Mathieu-Daudé +Link: https://lore.kernel.org/r/20220218000922.134857-3-j.neuschaefer@gmx.net +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/loongson1/clk-loongson1c.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/loongson1/clk-loongson1c.c b/drivers/clk/loongson1/clk-loongson1c.c +index 703f87622cf5..1ebf740380ef 100644 +--- a/drivers/clk/loongson1/clk-loongson1c.c ++++ b/drivers/clk/loongson1/clk-loongson1c.c +@@ -37,6 +37,7 @@ static const struct clk_div_table ahb_div_table[] = { + [1] = { .val = 1, .div = 4 }, + [2] = { .val = 2, .div = 3 }, + [3] = { .val = 3, .div = 3 }, ++ [4] = { /* sentinel */ } + }; + + void __init ls1x_clk_init(void) +-- +2.34.1 + diff --git a/queue-5.10/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch b/queue-5.10/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch new file mode 100644 index 00000000000..ddec1ca85f4 --- /dev/null +++ b/queue-5.10/clk-qcom-clk-rcg2-update-logic-to-calculate-d-value-.patch @@ -0,0 +1,60 @@ +From f064b57bf9daaee8f6e3abfc444fe48986f137cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Feb 2022 23:25:35 +0530 +Subject: clk: qcom: clk-rcg2: Update logic to calculate D value for RCG + +From: Taniya Das + +[ Upstream commit 58922910add18583d5273c2edcdb9fd7bf4eca02 ] + +The display pixel clock has a requirement on certain newer platforms to +support M/N as (2/3) and the final D value calculated results in +underflow errors. +As the current implementation does not check for D value is within +the accepted range for a given M & N value. Update the logic to +calculate the final D value based on the range. + +Fixes: 99cbd064b059f ("clk: qcom: Support display RCG clocks") +Signed-off-by: Taniya Das +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220227175536.3131-1-tdas@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-rcg2.c | 13 +++++++++++-- + 1 file changed, 11 insertions(+), 2 deletions(-) + +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c +index 59a5a0f261f3..ec2746fd00da 100644 +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -264,7 +264,7 @@ static int clk_rcg2_determine_floor_rate(struct clk_hw *hw, + + static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f) + { +- u32 cfg, mask; ++ u32 cfg, mask, d_val, not2d_val, n_minus_m; + struct clk_hw *hw = &rcg->clkr.hw; + int ret, index = qcom_find_src_index(hw, rcg->parent_map, f->src); + +@@ -283,8 +283,17 @@ static int __clk_rcg2_configure(struct clk_rcg2 *rcg, const struct freq_tbl *f) + if (ret) + return ret; + ++ /* Calculate 2d value */ ++ d_val = f->n; ++ ++ n_minus_m = f->n - f->m; ++ n_minus_m *= 2; ++ ++ d_val = clamp_t(u32, d_val, f->m, n_minus_m); ++ not2d_val = ~d_val & mask; ++ + ret = regmap_update_bits(rcg->clkr.regmap, +- RCG_D_OFFSET(rcg), mask, ~f->n); ++ RCG_D_OFFSET(rcg), mask, not2d_val); + if (ret) + return ret; + } +-- +2.34.1 + diff --git a/queue-5.10/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch b/queue-5.10/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch new file mode 100644 index 00000000000..345cfb4dc28 --- /dev/null +++ b/queue-5.10/clk-qcom-clk-rcg2-update-the-frac-table-for-pixel-cl.patch @@ -0,0 +1,37 @@ +From 4d8ee9e458520e642c6be21690df91b2a10e195c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 27 Feb 2022 23:25:36 +0530 +Subject: clk: qcom: clk-rcg2: Update the frac table for pixel clock + +From: Taniya Das + +[ Upstream commit b527358cb4cd58a8279c9062b0786f1fab628fdc ] + +Support the new numerator and denominator for pixel clock on SM8350 and +support rgb101010, RGB888 use cases on SM8450. + +Fixes: 99cbd064b059f ("clk: qcom: Support display RCG clocks") +Signed-off-by: Taniya Das +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220227175536.3131-2-tdas@codeaurora.org +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/clk-rcg2.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c +index ec2746fd00da..71a0d30cf44d 100644 +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -648,6 +648,7 @@ static const struct frac_entry frac_table_pixel[] = { + { 2, 9 }, + { 4, 9 }, + { 1, 1 }, ++ { 2, 3 }, + { } + }; + +-- +2.34.1 + diff --git a/queue-5.10/clk-qcom-gcc-msm8994-fix-gpll4-width.patch b/queue-5.10/clk-qcom-gcc-msm8994-fix-gpll4-width.patch new file mode 100644 index 00000000000..eb7e9730429 --- /dev/null +++ b/queue-5.10/clk-qcom-gcc-msm8994-fix-gpll4-width.patch @@ -0,0 +1,43 @@ +From fedc5f3f5374af3c2ce882610a7f011a05e86747 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Mar 2022 18:49:40 +0100 +Subject: clk: qcom: gcc-msm8994: Fix gpll4 width + +From: Konrad Dybcio + +[ Upstream commit 71021db1c532c2545ae53b9ee85b37b7154f51d4 ] + +The gpll4 postdiv is actually a div4, so make sure that Linux is aware of +this. + +This fixes the following error messages: + + mmc1: Card appears overclocked; req 200000000 Hz, actual 343999999 Hz + mmc1: Card appears overclocked; req 400000000 Hz, actual 687999999 Hz + +Fixes: aec89f78cf01 ("clk: qcom: Add support for msm8994 global clock controller") +Signed-off-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20220319174940.341137-1-konrad.dybcio@somainline.org +Tested-by: Petr Vorel +Reviewed-by: Petr Vorel +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-msm8994.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/qcom/gcc-msm8994.c b/drivers/clk/qcom/gcc-msm8994.c +index 144d2ba7a9be..463a444c8a7e 100644 +--- a/drivers/clk/qcom/gcc-msm8994.c ++++ b/drivers/clk/qcom/gcc-msm8994.c +@@ -108,6 +108,7 @@ static struct clk_alpha_pll gpll4_early = { + + static struct clk_alpha_pll_postdiv gpll4 = { + .offset = 0x1dc0, ++ .width = 4, + .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data) + { +-- +2.34.1 + diff --git a/queue-5.10/clk-qcom-ipq8074-fix-pci-e-clock-oops.patch b/queue-5.10/clk-qcom-ipq8074-fix-pci-e-clock-oops.patch new file mode 100644 index 00000000000..01cde9ff07b --- /dev/null +++ b/queue-5.10/clk-qcom-ipq8074-fix-pci-e-clock-oops.patch @@ -0,0 +1,163 @@ +From 492d24accfa3d4dedfc30d90adf6ac21919ae8a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Dec 2021 12:41:19 +0100 +Subject: clk: qcom: ipq8074: fix PCI-E clock oops + +From: Robert Marko + +[ Upstream commit bf8f5182b8f59309809b41c1d1730ed9ca6134b1 ] + +Fix PCI-E clock related kernel oops that are caused by a missing clock +parent. + +pcie0_rchng_clk_src has num_parents set to 2 but only one parent is +actually set via parent_hws, it should also have "XO" defined. +This will cause the kernel to panic on a NULL pointer in +clk_core_get_parent_by_index(). + +So, to fix this utilize clk_parent_data to provide gcc_xo_gpll0 parent +data. +Since there is already an existing static const char * const gcc_xo_gpll0[] +used to provide the same parents via parent_names convert those users to +clk_parent_data as well. + +Without this earlycon is needed to even catch the OOPS as it will reset +the board before serial is initialized with the following: + +[ 0.232279] Unable to handle kernel paging request at virtual address 0000a00000000000 +[ 0.232322] Mem abort info: +[ 0.239094] ESR = 0x96000004 +[ 0.241778] EC = 0x25: DABT (current EL), IL = 32 bits +[ 0.244908] SET = 0, FnV = 0 +[ 0.250377] EA = 0, S1PTW = 0 +[ 0.253236] FSC = 0x04: level 0 translation fault +[ 0.256277] Data abort info: +[ 0.261141] ISV = 0, ISS = 0x00000004 +[ 0.264262] CM = 0, WnR = 0 +[ 0.267820] [0000a00000000000] address between user and kernel address ranges +[ 0.270954] Internal error: Oops: 96000004 [#1] SMP +[ 0.278067] Modules linked in: +[ 0.282751] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 5.15.10 #0 +[ 0.285882] Hardware name: Xiaomi AX3600 (DT) +[ 0.292043] pstate: 20400005 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 0.296299] pc : clk_core_get_parent_by_index+0x68/0xec +[ 0.303067] lr : __clk_register+0x1d8/0x820 +[ 0.308273] sp : ffffffc01111b7d0 +[ 0.312438] x29: ffffffc01111b7d0 x28: 0000000000000000 x27: 0000000000000040 +[ 0.315919] x26: 0000000000000002 x25: 0000000000000000 x24: ffffff8000308800 +[ 0.323037] x23: ffffff8000308850 x22: ffffff8000308880 x21: ffffff8000308828 +[ 0.330155] x20: 0000000000000028 x19: ffffff8000309700 x18: 0000000000000020 +[ 0.337272] x17: 000000005cc86990 x16: 0000000000000004 x15: ffffff80001d9d0a +[ 0.344391] x14: 0000000000000000 x13: 0000000000000000 x12: 0000000000000006 +[ 0.351508] x11: 0000000000000003 x10: 0101010101010101 x9 : 0000000000000000 +[ 0.358626] x8 : 7f7f7f7f7f7f7f7f x7 : 6468626f5e626266 x6 : 17000a3a403c1b06 +[ 0.365744] x5 : 061b3c403a0a0017 x4 : 0000000000000000 x3 : 0000000000000001 +[ 0.372863] x2 : 0000a00000000000 x1 : 0000000000000001 x0 : ffffff8000309700 +[ 0.379982] Call trace: +[ 0.387091] clk_core_get_parent_by_index+0x68/0xec +[ 0.389351] __clk_register+0x1d8/0x820 +[ 0.394210] devm_clk_hw_register+0x5c/0xe0 +[ 0.398030] devm_clk_register_regmap+0x44/0x8c +[ 0.402198] qcom_cc_really_probe+0x17c/0x1d0 +[ 0.406711] qcom_cc_probe+0x34/0x44 +[ 0.411224] gcc_ipq8074_probe+0x18/0x30 +[ 0.414869] platform_probe+0x68/0xe0 +[ 0.418776] really_probe.part.0+0x9c/0x30c +[ 0.422336] __driver_probe_device+0x98/0x144 +[ 0.426329] driver_probe_device+0x44/0x11c +[ 0.430842] __device_attach_driver+0xb4/0x120 +[ 0.434836] bus_for_each_drv+0x68/0xb0 +[ 0.439349] __device_attach+0xb0/0x170 +[ 0.443081] device_initial_probe+0x14/0x20 +[ 0.446901] bus_probe_device+0x9c/0xa4 +[ 0.451067] device_add+0x35c/0x834 +[ 0.454886] of_device_add+0x54/0x64 +[ 0.458360] of_platform_device_create_pdata+0xc0/0x100 +[ 0.462181] of_platform_bus_create+0x114/0x370 +[ 0.467128] of_platform_bus_create+0x15c/0x370 +[ 0.471641] of_platform_populate+0x50/0xcc +[ 0.476155] of_platform_default_populate_init+0xa8/0xc8 +[ 0.480324] do_one_initcall+0x50/0x1b0 +[ 0.485877] kernel_init_freeable+0x234/0x29c +[ 0.489436] kernel_init+0x24/0x120 +[ 0.493948] ret_from_fork+0x10/0x20 +[ 0.497253] Code: d50323bf d65f03c0 f94002a2 b4000302 (f9400042) +[ 0.501079] ---[ end trace 4ca7e1129da2abce ]--- + +Fixes: f0cfcf1a ("clk: qcom: ipq8074: Add missing clocks for pcie") +Signed-off-by: Robert Marko +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211220114119.465247-1-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq8074.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index 108fe27bee10..b09d99343e09 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -60,11 +60,6 @@ static const struct parent_map gcc_xo_gpll0_gpll0_out_main_div2_map[] = { + { P_GPLL0_DIV2, 4 }, + }; + +-static const char * const gcc_xo_gpll0[] = { +- "xo", +- "gpll0", +-}; +- + static const struct parent_map gcc_xo_gpll0_map[] = { + { P_XO, 0 }, + { P_GPLL0, 1 }, +@@ -956,6 +951,11 @@ static struct clk_rcg2 blsp1_uart6_apps_clk_src = { + }, + }; + ++static const struct clk_parent_data gcc_xo_gpll0[] = { ++ { .fw_name = "xo" }, ++ { .hw = &gpll0.clkr.hw }, ++}; ++ + static const struct freq_tbl ftbl_pcie_axi_clk_src[] = { + F(19200000, P_XO, 1, 0, 0), + F(200000000, P_GPLL0, 4, 0, 0), +@@ -969,7 +969,7 @@ static struct clk_rcg2 pcie0_axi_clk_src = { + .parent_map = gcc_xo_gpll0_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "pcie0_axi_clk_src", +- .parent_names = gcc_xo_gpll0, ++ .parent_data = gcc_xo_gpll0, + .num_parents = 2, + .ops = &clk_rcg2_ops, + }, +@@ -1016,7 +1016,7 @@ static struct clk_rcg2 pcie1_axi_clk_src = { + .parent_map = gcc_xo_gpll0_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "pcie1_axi_clk_src", +- .parent_names = gcc_xo_gpll0, ++ .parent_data = gcc_xo_gpll0, + .num_parents = 2, + .ops = &clk_rcg2_ops, + }, +@@ -1330,7 +1330,7 @@ static struct clk_rcg2 nss_ce_clk_src = { + .parent_map = gcc_xo_gpll0_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "nss_ce_clk_src", +- .parent_names = gcc_xo_gpll0, ++ .parent_data = gcc_xo_gpll0, + .num_parents = 2, + .ops = &clk_rcg2_ops, + }, +@@ -4329,8 +4329,7 @@ static struct clk_rcg2 pcie0_rchng_clk_src = { + .parent_map = gcc_xo_gpll0_map, + .clkr.hw.init = &(struct clk_init_data){ + .name = "pcie0_rchng_clk_src", +- .parent_hws = (const struct clk_hw *[]) { +- &gpll0.clkr.hw }, ++ .parent_data = gcc_xo_gpll0, + .num_parents = 2, + .ops = &clk_rcg2_ops, + }, +-- +2.34.1 + diff --git a/queue-5.10/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch b/queue-5.10/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch new file mode 100644 index 00000000000..59accec7d0d --- /dev/null +++ b/queue-5.10/clk-qcom-ipq8074-use-floor-ops-for-sdcc1-clock.patch @@ -0,0 +1,49 @@ +From 9765672a1a4efe13635c7e150eed9a5c13666616 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Feb 2022 18:31:00 +0100 +Subject: clk: qcom: ipq8074: Use floor ops for SDCC1 clock + +From: Dirk Buchwalder + +[ Upstream commit b77d8306d84f83d1da68028a68c91da9c867b6f6 ] + +Use floor ops on SDCC1 APPS clock in order to round down selected clock +frequency and avoid overclocking SD/eMMC cards. + +For example, currently HS200 cards were failling tuning as they were +actually being clocked at 384MHz instead of 192MHz. +This caused some boards to disable 1.8V I/O and force the eMMC into the +standard HS mode (50MHz) and that appeared to work despite the eMMC being +overclocked to 96Mhz in that case. + +There was a previous commit to use floor ops on SDCC clocks, but it looks +to have only covered SDCC2 clock. + +Fixes: 9607f6224b39 ("clk: qcom: ipq8074: add PCIE, USB and SDCC clocks") + +Signed-off-by: Dirk Buchwalder +Signed-off-by: Robert Marko +Reviewed-by: Stephen Boyd +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20220210173100.505128-1-robimarko@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/clk/qcom/gcc-ipq8074.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index b09d99343e09..541016db3c4b 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -1074,7 +1074,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { + .name = "sdcc1_apps_clk_src", + .parent_names = gcc_xo_gpll0_gpll2_gpll0_out_main_div2, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +-- +2.34.1 + diff --git a/queue-5.10/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch b/queue-5.10/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch new file mode 100644 index 00000000000..ebda34eab0a --- /dev/null +++ b/queue-5.10/clk-tegra-tegra124-emc-fix-missing-put_device-call-i.patch @@ -0,0 +1,39 @@ +From 46125783581fa5b1b5ec539ceae46c7e33a97325 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jan 2022 10:45:01 +0000 +Subject: clk: tegra: tegra124-emc: Fix missing put_device() call in + emc_ensure_emc_driver + +From: Miaoqian Lin + +[ Upstream commit 6d6ef58c2470da85a99119f74d34216c8074b9f0 ] + +The reference taken by 'of_find_device_by_node()' must be released when +not needed anymore. +Add the corresponding 'put_device()' in the error handling path. + +Fixes: 2db04f16b589 ("clk: tegra: Add EMC clock driver") +Signed-off-by: Miaoqian Lin +Acked-by: Thierry Reding +Link: https://lore.kernel.org/r/20220112104501.30655-1-linmq006@gmail.com +Signed-off-by: Stephen Boyd +Signed-off-by: Sasha Levin +--- + drivers/clk/tegra/clk-tegra124-emc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/clk/tegra/clk-tegra124-emc.c b/drivers/clk/tegra/clk-tegra124-emc.c +index 745f9faa98d8..733a962ff521 100644 +--- a/drivers/clk/tegra/clk-tegra124-emc.c ++++ b/drivers/clk/tegra/clk-tegra124-emc.c +@@ -191,6 +191,7 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra) + + tegra->emc = platform_get_drvdata(pdev); + if (!tegra->emc) { ++ put_device(&pdev->dev); + pr_err("%s: cannot find EMC driver\n", __func__); + return NULL; + } +-- +2.34.1 + diff --git a/queue-5.10/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch b/queue-5.10/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch new file mode 100644 index 00000000000..e6704f7b9e5 --- /dev/null +++ b/queue-5.10/clocksource-acpi_pm-fix-return-value-of-__setup-hand.patch @@ -0,0 +1,50 @@ +From 460f0ef2671e375d20c7e3f4813fbc109190d3ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 08:39:39 -0700 +Subject: clocksource: acpi_pm: fix return value of __setup handler + +From: Randy Dunlap + +[ Upstream commit 6a861abceecb68497dd82a324fee45a5332dcece ] + +__setup() handlers should return 1 to obsolete_checksetup() in +init/main.c to indicate that the boot option has been handled. +A return of 0 causes the boot option/value to be listed as an Unknown +kernel parameter and added to init's (limited) environment strings. + +The __setup() handler interface isn't meant to handle negative return +values -- they are non-zero, so they mean "handled" (like a return +value of 1 does), but that's just a quirk. So return 1 from +parse_pmtmr(). Also print a warning message if kstrtouint() returns +an error. + +Fixes: 6b148507d3d0 ("pmtmr: allow command line override of ioport") +Signed-off-by: Randy Dunlap +Reported-by: Igor Zhbanov +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/clocksource/acpi_pm.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c +index eb596ff9e7bb..279ddff81ab4 100644 +--- a/drivers/clocksource/acpi_pm.c ++++ b/drivers/clocksource/acpi_pm.c +@@ -229,8 +229,10 @@ static int __init parse_pmtmr(char *arg) + int ret; + + ret = kstrtouint(arg, 16, &base); +- if (ret) +- return ret; ++ if (ret) { ++ pr_warn("PMTMR: invalid 'pmtmr=' value: '%s'\n", arg); ++ return 1; ++ } + + pr_info("PMTMR IOPort override: 0x%04x -> 0x%04x\n", pmtmr_ioport, + base); +-- +2.34.1 + diff --git a/queue-5.10/clocksource-drivers-exynos_mct-handle-dts-with-highe.patch b/queue-5.10/clocksource-drivers-exynos_mct-handle-dts-with-highe.patch new file mode 100644 index 00000000000..d28294d6917 --- /dev/null +++ b/queue-5.10/clocksource-drivers-exynos_mct-handle-dts-with-highe.patch @@ -0,0 +1,65 @@ +From f79a7e55fd6309c6a5fd02280d65e30d18917bea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Feb 2022 11:38:15 +0100 +Subject: clocksource/drivers/exynos_mct: Handle DTS with higher number of + interrupts + +From: Krzysztof Kozlowski + +[ Upstream commit ab8da93dc06d82f464c47ab30e6c75190702f369 ] + +The driver statically defines maximum number of interrupts it can +handle, however it does not respect that limit when configuring them. +When provided with a DTS with more interrupts than assumed, the driver +will overwrite static array mct_irqs leading to silent memory +corruption. + +Validate the interrupts coming from DTS to avoid this. This does not +change the fact that such DTS might not boot at all, because it is +simply incompatible, however at least some warning will be printed. + +Fixes: 36ba5d527e95 ("ARM: EXYNOS: add device tree support for MCT controller driver") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20220220103815.135380-1-krzysztof.kozlowski@canonical.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/exynos_mct.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c +index 5533c9afc088..df194b05e944 100644 +--- a/drivers/clocksource/exynos_mct.c ++++ b/drivers/clocksource/exynos_mct.c +@@ -531,6 +531,11 @@ static int __init exynos4_timer_interrupts(struct device_node *np, + * irqs are specified. + */ + nr_irqs = of_irq_count(np); ++ if (nr_irqs > ARRAY_SIZE(mct_irqs)) { ++ pr_err("exynos-mct: too many (%d) interrupts configured in DT\n", ++ nr_irqs); ++ nr_irqs = ARRAY_SIZE(mct_irqs); ++ } + for (i = MCT_L0_IRQ; i < nr_irqs; i++) + mct_irqs[i] = irq_of_parse_and_map(np, i); + +@@ -543,11 +548,14 @@ static int __init exynos4_timer_interrupts(struct device_node *np, + mct_irqs[MCT_L0_IRQ], err); + } else { + for_each_possible_cpu(cpu) { +- int mct_irq = mct_irqs[MCT_L0_IRQ + cpu]; ++ int mct_irq; + struct mct_clock_event_device *pcpu_mevt = + per_cpu_ptr(&percpu_mct_tick, cpu); + + pcpu_mevt->evt.irq = -1; ++ if (MCT_L0_IRQ + cpu >= ARRAY_SIZE(mct_irqs)) ++ break; ++ mct_irq = mct_irqs[MCT_L0_IRQ + cpu]; + + irq_set_status_flags(mct_irq, IRQ_NOAUTOEN); + if (request_irq(mct_irq, +-- +2.34.1 + diff --git a/queue-5.10/clocksource-drivers-exynos_mct-refactor-resources-al.patch b/queue-5.10/clocksource-drivers-exynos_mct-refactor-resources-al.patch new file mode 100644 index 00000000000..9d983f5b0e5 --- /dev/null +++ b/queue-5.10/clocksource-drivers-exynos_mct-refactor-resources-al.patch @@ -0,0 +1,111 @@ +From d50f0cb4041a52085d5a6c1720370ffd67c6886b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 1 Nov 2021 21:35:30 +0200 +Subject: clocksource/drivers/exynos_mct: Refactor resources allocation + +From: Marek Szyprowski + +[ Upstream commit 7cd925a8823d16de5614d3f0aabea9948747accd ] + +Move interrupts allocation from exynos4_timer_resources() into separate +function together with the interrupt number parsing code from +mct_init_dt(), so the code for managing interrupts is kept together. +While touching exynos4_timer_resources() function, move of_iomap() to it. +No functional changes. + +Signed-off-by: Marek Szyprowski +Reviewed-by: Chanwoo Choi +Tested-by: Chanwoo Choi +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Sam Protsenko +Link: https://lore.kernel.org/r/20211101193531.15078-2-semen.protsenko@linaro.org +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/exynos_mct.c | 50 +++++++++++++++++++------------- + 1 file changed, 30 insertions(+), 20 deletions(-) + +diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c +index fabad79baafc..5533c9afc088 100644 +--- a/drivers/clocksource/exynos_mct.c ++++ b/drivers/clocksource/exynos_mct.c +@@ -494,11 +494,14 @@ static int exynos4_mct_dying_cpu(unsigned int cpu) + return 0; + } + +-static int __init exynos4_timer_resources(struct device_node *np, void __iomem *base) ++static int __init exynos4_timer_resources(struct device_node *np) + { +- int err, cpu; + struct clk *mct_clk, *tick_clk; + ++ reg_base = of_iomap(np, 0); ++ if (!reg_base) ++ panic("%s: unable to ioremap mct address space\n", __func__); ++ + tick_clk = of_clk_get_by_name(np, "fin_pll"); + if (IS_ERR(tick_clk)) + panic("%s: unable to determine tick clock rate\n", __func__); +@@ -509,9 +512,27 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem * + panic("%s: unable to retrieve mct clock instance\n", __func__); + clk_prepare_enable(mct_clk); + +- reg_base = base; +- if (!reg_base) +- panic("%s: unable to ioremap mct address space\n", __func__); ++ return 0; ++} ++ ++static int __init exynos4_timer_interrupts(struct device_node *np, ++ unsigned int int_type) ++{ ++ int nr_irqs, i, err, cpu; ++ ++ mct_int_type = int_type; ++ ++ /* This driver uses only one global timer interrupt */ ++ mct_irqs[MCT_G0_IRQ] = irq_of_parse_and_map(np, MCT_G0_IRQ); ++ ++ /* ++ * Find out the number of local irqs specified. The local ++ * timer irqs are specified after the four global timer ++ * irqs are specified. ++ */ ++ nr_irqs = of_irq_count(np); ++ for (i = MCT_L0_IRQ; i < nr_irqs; i++) ++ mct_irqs[i] = irq_of_parse_and_map(np, i); + + if (mct_int_type == MCT_INT_PPI) { + +@@ -571,24 +592,13 @@ static int __init exynos4_timer_resources(struct device_node *np, void __iomem * + + static int __init mct_init_dt(struct device_node *np, unsigned int int_type) + { +- u32 nr_irqs, i; + int ret; + +- mct_int_type = int_type; +- +- /* This driver uses only one global timer interrupt */ +- mct_irqs[MCT_G0_IRQ] = irq_of_parse_and_map(np, MCT_G0_IRQ); +- +- /* +- * Find out the number of local irqs specified. The local +- * timer irqs are specified after the four global timer +- * irqs are specified. +- */ +- nr_irqs = of_irq_count(np); +- for (i = MCT_L0_IRQ; i < nr_irqs; i++) +- mct_irqs[i] = irq_of_parse_and_map(np, i); ++ ret = exynos4_timer_resources(np); ++ if (ret) ++ return ret; + +- ret = exynos4_timer_resources(np, of_iomap(np, 0)); ++ ret = exynos4_timer_interrupts(np, int_type); + if (ret) + return ret; + +-- +2.34.1 + diff --git a/queue-5.10/clocksource-drivers-timer-microchip-pit64b-use-notra.patch b/queue-5.10/clocksource-drivers-timer-microchip-pit64b-use-notra.patch new file mode 100644 index 00000000000..4fa83ef9701 --- /dev/null +++ b/queue-5.10/clocksource-drivers-timer-microchip-pit64b-use-notra.patch @@ -0,0 +1,38 @@ +From dc09a84b4f368444cb82a6385fbe9a6258cb07f1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 15:35:57 +0200 +Subject: clocksource/drivers/timer-microchip-pit64b: Use notrace + +From: Claudiu Beznea + +[ Upstream commit ff10ee97cb203262e88d9c8bc87369cbd4004a0c ] + +Use notrace for mchp_pit64b_sched_read_clk() to avoid recursive call of +prepare_ftrace_return() when issuing: +echo function_graph > /sys/kernel/debug/tracing/current_tracer + +Fixes: 625022a5f160 ("clocksource/drivers/timer-microchip-pit64b: Add Microchip PIT64B support") +Signed-off-by: Claudiu Beznea +Link: https://lore.kernel.org/r/20220304133601.2404086-3-claudiu.beznea@microchip.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-microchip-pit64b.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/clocksource/timer-microchip-pit64b.c b/drivers/clocksource/timer-microchip-pit64b.c +index 59e11ca8ee73..5c9485cb4e05 100644 +--- a/drivers/clocksource/timer-microchip-pit64b.c ++++ b/drivers/clocksource/timer-microchip-pit64b.c +@@ -121,7 +121,7 @@ static u64 mchp_pit64b_clksrc_read(struct clocksource *cs) + return mchp_pit64b_cnt_read(mchp_pit64b_cs_base); + } + +-static u64 mchp_pit64b_sched_read_clk(void) ++static u64 notrace mchp_pit64b_sched_read_clk(void) + { + return mchp_pit64b_cnt_read(mchp_pit64b_cs_base); + } +-- +2.34.1 + diff --git a/queue-5.10/clocksource-drivers-timer-of-check-return-value-of-o.patch b/queue-5.10/clocksource-drivers-timer-of-check-return-value-of-o.patch new file mode 100644 index 00000000000..5611018b729 --- /dev/null +++ b/queue-5.10/clocksource-drivers-timer-of-check-return-value-of-o.patch @@ -0,0 +1,45 @@ +From 736fe8cb7a4c941fba1ccd1d2f9bfe83487cfd57 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 18:26:56 +0100 +Subject: clocksource/drivers/timer-of: Check return value of of_iomap in + timer_of_base_init() + +From: Guillaume Ranquet + +[ Upstream commit 4467b8bad2401794fb89a0268c8c8257180bf60f ] + +of_base->base can either be iomapped using of_io_request_and_map() or +of_iomap() depending whether or not an of_base->name has been set. + +Thus check of_base->base against NULL as of_iomap() does not return a +PTR_ERR() in case of error. + +Fixes: 9aea417afa6b ("clocksource/drivers/timer-of: Don't request the resource by name") +Signed-off-by: Guillaume Ranquet +Link: https://lore.kernel.org/r/20220307172656.4836-1-granquet@baylibre.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + drivers/clocksource/timer-of.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c +index 572da477c6d3..b965f20174e3 100644 +--- a/drivers/clocksource/timer-of.c ++++ b/drivers/clocksource/timer-of.c +@@ -157,9 +157,9 @@ static __init int timer_of_base_init(struct device_node *np, + of_base->base = of_base->name ? + of_io_request_and_map(np, of_base->index, of_base->name) : + of_iomap(np, of_base->index); +- if (IS_ERR(of_base->base)) { +- pr_err("Failed to iomap (%s)\n", of_base->name); +- return PTR_ERR(of_base->base); ++ if (IS_ERR_OR_NULL(of_base->base)) { ++ pr_err("Failed to iomap (%s:%s)\n", np->name, of_base->name); ++ return of_base->base ? PTR_ERR(of_base->base) : -ENOMEM; + } + + return 0; +-- +2.34.1 + diff --git a/queue-5.10/clocksource-drivers-timer-ti-dm-fix-regression-from-.patch b/queue-5.10/clocksource-drivers-timer-ti-dm-fix-regression-from-.patch new file mode 100644 index 00000000000..e25f8aa2231 --- /dev/null +++ b/queue-5.10/clocksource-drivers-timer-ti-dm-fix-regression-from-.patch @@ -0,0 +1,133 @@ +From 5a5a022df41f42f72494d5d2e74dee22f1b85027 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Feb 2022 21:35:05 -0800 +Subject: clocksource/drivers/timer-ti-dm: Fix regression from errata i940 fix + +From: Drew Fustini + +[ Upstream commit bceaae3bac0ce27c549bb050336d8d08abc2ee54 ] + +The existing fix for errata i940 causes a conflict for IPU2 which is +using timer 3 and 4. From arch/arm/boot/dts/dra7-ipu-dsp-common.dtsi: + + &ipu2 { + mboxes = <&mailbox6 &mbox_ipu2_ipc3x>; + ti,timers = <&timer3>; + ti,watchdog-timers = <&timer4>, <&timer9>; + }; + +The conflict was noticed when booting mainline on the BeagleBoard X15 +which has a TI AM5728 SoC: + + remoteproc remoteproc1: 55020000.ipu is available + remoteproc remoteproc1: powering up 55020000.ipu + remoteproc remoteproc1: Booting fw image dra7-ipu2-fw.xem4 + omap-rproc 55020000.ipu: could not get timer platform device + omap-rproc 55020000.ipu: omap_rproc_enable_timers failed: -19 + remoteproc remoteproc1: can't start rproc 55020000.ipu: -19 + +This change modifies the errata fix to instead use timer 15 and 16 which +resolves the timer conflict. + +It does not appear to introduce any latency regression. Results from +cyclictest with original errata fix using dmtimer 3 and 4: + + # cyclictest --mlockall --smp --priority=80 --interval=200 --distance=0 + policy: fifo: loadavg: 0.02 0.03 0.05 + + T: 0 ( 1449) P:80 I:200 C: 800368 Min: 0 Act: 32 Avg: 22 Max: 128 + T: 1 ( 1450) P:80 I:200 C: 800301 Min: 0 Act: 12 Avg: 23 Max: 70 + +The results after the change to dmtimer 15 and 16: + + # cyclictest --mlockall --smp --priority=80 --interval=200 --distance=0 + policy: fifo: loadavg: 0.36 0.19 0.07 + + T: 0 ( 1711) P:80 I:200 C: 759599 Min: 0 Act: 6 Avg: 22 Max: 108 + T: 1 ( 1712) P:80 I:200 C: 759539 Min: 0 Act: 19 Avg: 23 Max: 79 + +Fixes: 25de4ce5ed02 ("clocksource/drivers/timer-ti-dm: Handle dra7 timer wrap errata i940") +Link: https://lore.kernel.org/linux-omap/YfWsG0p6to3IJuvE@x1/ +Suggested-by: Suman Anna +Reviewed-by: Tony Lindgren +Signed-off-by: Drew Fustini +Link: https://lore.kernel.org/r/20220204053503.1409162-1-dfustini@baylibre.com +Signed-off-by: Daniel Lezcano +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/dra7-l4.dtsi | 5 ++--- + arch/arm/boot/dts/dra7.dtsi | 8 ++++---- + drivers/clocksource/timer-ti-dm-systimer.c | 4 ++-- + 3 files changed, 8 insertions(+), 9 deletions(-) + +diff --git a/arch/arm/boot/dts/dra7-l4.dtsi b/arch/arm/boot/dts/dra7-l4.dtsi +index 30b72f431850..f8c0eee7a62b 100644 +--- a/arch/arm/boot/dts/dra7-l4.dtsi ++++ b/arch/arm/boot/dts/dra7-l4.dtsi +@@ -3448,8 +3448,7 @@ + ti,timer-pwm; + }; + }; +- +- target-module@2c000 { /* 0x4882c000, ap 17 02.0 */ ++ timer15_target: target-module@2c000 { /* 0x4882c000, ap 17 02.0 */ + compatible = "ti,sysc-omap4-timer", "ti,sysc"; + reg = <0x2c000 0x4>, + <0x2c010 0x4>; +@@ -3477,7 +3476,7 @@ + }; + }; + +- target-module@2e000 { /* 0x4882e000, ap 19 14.0 */ ++ timer16_target: target-module@2e000 { /* 0x4882e000, ap 19 14.0 */ + compatible = "ti,sysc-omap4-timer", "ti,sysc"; + reg = <0x2e000 0x4>, + <0x2e010 0x4>; +diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi +index 7ecf8f86ac74..998932136656 100644 +--- a/arch/arm/boot/dts/dra7.dtsi ++++ b/arch/arm/boot/dts/dra7.dtsi +@@ -1093,20 +1093,20 @@ + }; + + /* Local timers, see ARM architected timer wrap erratum i940 */ +-&timer3_target { ++&timer15_target { + ti,no-reset-on-init; + ti,no-idle; + timer@0 { +- assigned-clocks = <&l4per_clkctrl DRA7_L4PER_TIMER3_CLKCTRL 24>; ++ assigned-clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER15_CLKCTRL 24>; + assigned-clock-parents = <&timer_sys_clk_div>; + }; + }; + +-&timer4_target { ++&timer16_target { + ti,no-reset-on-init; + ti,no-idle; + timer@0 { +- assigned-clocks = <&l4per_clkctrl DRA7_L4PER_TIMER4_CLKCTRL 24>; ++ assigned-clocks = <&l4per3_clkctrl DRA7_L4PER3_TIMER16_CLKCTRL 24>; + assigned-clock-parents = <&timer_sys_clk_div>; + }; + }; +diff --git a/drivers/clocksource/timer-ti-dm-systimer.c b/drivers/clocksource/timer-ti-dm-systimer.c +index 1fccb457fcc5..2737407ff069 100644 +--- a/drivers/clocksource/timer-ti-dm-systimer.c ++++ b/drivers/clocksource/timer-ti-dm-systimer.c +@@ -694,9 +694,9 @@ static int __init dmtimer_percpu_quirk_init(struct device_node *np, u32 pa) + return 0; + } + +- if (pa == 0x48034000) /* dra7 dmtimer3 */ ++ if (pa == 0x4882c000) /* dra7 dmtimer15 */ + return dmtimer_percpu_timer_init(np, 0); +- else if (pa == 0x48036000) /* dra7 dmtimer4 */ ++ else if (pa == 0x4882e000) /* dra7 dmtimer16 */ + return dmtimer_percpu_timer_init(np, 1); + + return 0; +-- +2.34.1 + diff --git a/queue-5.10/cpufreq-qcom-cpufreq-nvmem-fix-reading-of-pvs-valid-.patch b/queue-5.10/cpufreq-qcom-cpufreq-nvmem-fix-reading-of-pvs-valid-.patch new file mode 100644 index 00000000000..cc76aba57cd --- /dev/null +++ b/queue-5.10/cpufreq-qcom-cpufreq-nvmem-fix-reading-of-pvs-valid-.patch @@ -0,0 +1,38 @@ +From 70494021694a84f37a806e38e65c0f0cc5347754 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 30 Jan 2022 12:45:35 +0100 +Subject: cpufreq: qcom-cpufreq-nvmem: fix reading of PVS Valid fuse + +From: Luca Weiss + +[ Upstream commit 4a8a77abf0e2b6468ba0281e33384cbec5fb476a ] + +The fuse consists of 64 bits, with this statement we're supposed to get +the upper 32 bits but it actually read out of bounds and got 0 instead +of the desired value which lead to the "PVS bin not set." codepath being +run resetting our pvs value. + +Fixes: a8811ec764f9 ("cpufreq: qcom: Add support for krait based socs") +Signed-off-by: Luca Weiss +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/cpufreq/qcom-cpufreq-nvmem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/cpufreq/qcom-cpufreq-nvmem.c b/drivers/cpufreq/qcom-cpufreq-nvmem.c +index fba9937a406b..7fdd30e92e42 100644 +--- a/drivers/cpufreq/qcom-cpufreq-nvmem.c ++++ b/drivers/cpufreq/qcom-cpufreq-nvmem.c +@@ -130,7 +130,7 @@ static void get_krait_bin_format_b(struct device *cpu_dev, + } + + /* Check PVS_BLOW_STATUS */ +- pte_efuse = *(((u32 *)buf) + 4); ++ pte_efuse = *(((u32 *)buf) + 1); + pte_efuse &= BIT(21); + if (pte_efuse) { + dev_dbg(cpu_dev, "PVS bin: %d\n", *pvs); +-- +2.34.1 + diff --git a/queue-5.10/crypto-amlogic-call-finalize-with-bh-disabled.patch b/queue-5.10/crypto-amlogic-call-finalize-with-bh-disabled.patch new file mode 100644 index 00000000000..56f97a25161 --- /dev/null +++ b/queue-5.10/crypto-amlogic-call-finalize-with-bh-disabled.patch @@ -0,0 +1,37 @@ +From a4d05db87ca317c6e55683ea97dcecc1f0db0948 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Feb 2022 12:08:31 +0000 +Subject: crypto: amlogic - call finalize with bh disabled + +From: Corentin Labbe + +[ Upstream commit dba633342994ce47d347bcf5522ba28301247b79 ] + +Doing ipsec produces a spinlock recursion warning. +This is due to not disabling BH during crypto completion function. + +Fixes: 48fe583fe541 ("crypto: amlogic - Add crypto accelerator for amlogic GXL") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/amlogic/amlogic-gxl-cipher.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/crypto/amlogic/amlogic-gxl-cipher.c b/drivers/crypto/amlogic/amlogic-gxl-cipher.c +index 8b5e07316352..652e72d030bb 100644 +--- a/drivers/crypto/amlogic/amlogic-gxl-cipher.c ++++ b/drivers/crypto/amlogic/amlogic-gxl-cipher.c +@@ -265,7 +265,9 @@ static int meson_handle_cipher_request(struct crypto_engine *engine, + struct skcipher_request *breq = container_of(areq, struct skcipher_request, base); + + err = meson_cipher(breq); ++ local_bh_disable(); + crypto_finalize_skcipher_request(engine, breq, err); ++ local_bh_enable(); + + return 0; + } +-- +2.34.1 + diff --git a/queue-5.10/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch b/queue-5.10/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch new file mode 100644 index 00000000000..ca7b4115ba6 --- /dev/null +++ b/queue-5.10/crypto-authenc-fix-sleep-in-atomic-context-in-decryp.patch @@ -0,0 +1,42 @@ +From b464fa805bad2b4ad1fd9c82c1281c6e4688580a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jan 2022 17:58:40 +1100 +Subject: crypto: authenc - Fix sleep in atomic context in decrypt_tail + +From: Herbert Xu + +[ Upstream commit 66eae850333d639fc278d6f915c6fc01499ea893 ] + +The function crypto_authenc_decrypt_tail discards its flags +argument and always relies on the flags from the original request +when starting its sub-request. + +This is clearly wrong as it may cause the SLEEPABLE flag to be +set when it shouldn't. + +Fixes: 92d95ba91772 ("crypto: authenc - Convert to new AEAD interface") +Reported-by: Corentin Labbe +Signed-off-by: Herbert Xu +Tested-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + crypto/authenc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/crypto/authenc.c b/crypto/authenc.c +index 670bf1a01d00..17f674a7cdff 100644 +--- a/crypto/authenc.c ++++ b/crypto/authenc.c +@@ -253,7 +253,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req, + dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen); + + skcipher_request_set_tfm(skreq, ctx->enc); +- skcipher_request_set_callback(skreq, aead_request_flags(req), ++ skcipher_request_set_callback(skreq, flags, + req->base.complete, req->base.data); + skcipher_request_set_crypt(skreq, src, dst, + req->cryptlen - authsize, req->iv); +-- +2.34.1 + diff --git a/queue-5.10/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch b/queue-5.10/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch new file mode 100644 index 00000000000..2d223284672 --- /dev/null +++ b/queue-5.10/crypto-ccp-ccp_dmaengine_unregister-release-dma-chan.patch @@ -0,0 +1,69 @@ +From 427407fbb0a672cbfbdb63374e149c58a7edb571 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 05:15:45 +0200 +Subject: crypto: ccp - ccp_dmaengine_unregister release dma channels +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Dāvis Mosāns + +[ Upstream commit 54cce8ecb9254f971b40a72911c6da403720a2d2 ] + +ccp_dmaengine_register adds dma_chan->device_node to dma_dev->channels list +but ccp_dmaengine_unregister didn't remove them. +That can cause crashes in various dmaengine methods that tries to use dma_dev->channels + +Fixes: 58ea8abf4904 ("crypto: ccp - Register the CCP as a DMA...") +Signed-off-by: Dāvis Mosāns +Acked-by: John Allen +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccp/ccp-dmaengine.c | 16 ++++++++++++++++ + 1 file changed, 16 insertions(+) + +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index 0770a83bf1a5..b3eea329f840 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -633,6 +633,20 @@ static int ccp_terminate_all(struct dma_chan *dma_chan) + return 0; + } + ++static void ccp_dma_release(struct ccp_device *ccp) ++{ ++ struct ccp_dma_chan *chan; ++ struct dma_chan *dma_chan; ++ unsigned int i; ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) { ++ chan = ccp->ccp_dma_chan + i; ++ dma_chan = &chan->dma_chan; ++ tasklet_kill(&chan->cleanup_tasklet); ++ list_del_rcu(&dma_chan->device_node); ++ } ++} ++ + int ccp_dmaengine_register(struct ccp_device *ccp) + { + struct ccp_dma_chan *chan; +@@ -737,6 +751,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp) + return 0; + + err_reg: ++ ccp_dma_release(ccp); + kmem_cache_destroy(ccp->dma_desc_cache); + + err_cache: +@@ -753,6 +768,7 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp) + return; + + dma_async_device_unregister(dma_dev); ++ ccp_dma_release(ccp); + + kmem_cache_destroy(ccp->dma_desc_cache); + kmem_cache_destroy(ccp->dma_cmd_cache); +-- +2.34.1 + diff --git a/queue-5.10/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch b/queue-5.10/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch new file mode 100644 index 00000000000..89604f91420 --- /dev/null +++ b/queue-5.10/crypto-ccree-don-t-attempt-0-len-dma-mappings.patch @@ -0,0 +1,45 @@ +From d928df9a49f70bdb273f10009f6ff0061667b894 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Feb 2022 21:27:26 +0200 +Subject: crypto: ccree - don't attempt 0 len DMA mappings + +From: Gilad Ben-Yossef + +[ Upstream commit 1fb37b5692c915edcc2448a6b37255738c7c77e0 ] + +Refuse to try mapping zero bytes as this may cause a fault +on some configurations / platforms and it seems the prev. +attempt is not enough and we need to be more explicit. + +Signed-off-by: Gilad Ben-Yossef +Reported-by: Corentin Labbe +Fixes: ce0fc6db38de ("crypto: ccree - protect against empty or NULL +scatterlists") +Tested-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccree/cc_buffer_mgr.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc_buffer_mgr.c +index a5e041d9d2cf..11e0278c8631 100644 +--- a/drivers/crypto/ccree/cc_buffer_mgr.c ++++ b/drivers/crypto/ccree/cc_buffer_mgr.c +@@ -258,6 +258,13 @@ static int cc_map_sg(struct device *dev, struct scatterlist *sg, + { + int ret = 0; + ++ if (!nbytes) { ++ *mapped_nents = 0; ++ *lbytes = 0; ++ *nents = 0; ++ return 0; ++ } ++ + *nents = cc_get_sgl_nents(dev, sg, nbytes, lbytes); + if (*nents > max_sg_nents) { + *nents = 0; +-- +2.34.1 + diff --git a/queue-5.10/crypto-ccree-fix-use-after-free-in-cc_cipher_exit.patch b/queue-5.10/crypto-ccree-fix-use-after-free-in-cc_cipher_exit.patch new file mode 100644 index 00000000000..e7d452ebc5d --- /dev/null +++ b/queue-5.10/crypto-ccree-fix-use-after-free-in-cc_cipher_exit.patch @@ -0,0 +1,40 @@ +From dc30cccb4ca53b6ffe30629dc49bb44440fb6827 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 10:23:37 +0800 +Subject: crypto: ccree - Fix use after free in cc_cipher_exit() + +From: Jianglei Nie + +[ Upstream commit 3d950c34074ed74d2713c3856ba01264523289e6 ] + +kfree_sensitive(ctx_p->user.key) will free the ctx_p->user.key. But +ctx_p->user.key is still used in the next line, which will lead to a +use after free. + +We can call kfree_sensitive() after dev_dbg() to avoid the uaf. + +Fixes: 63ee04c8b491 ("crypto: ccree - add skcipher support") +Signed-off-by: Jianglei Nie +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/ccree/cc_cipher.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/ccree/cc_cipher.c b/drivers/crypto/ccree/cc_cipher.c +index dafa6577a845..c289e4d5cbdc 100644 +--- a/drivers/crypto/ccree/cc_cipher.c ++++ b/drivers/crypto/ccree/cc_cipher.c +@@ -254,8 +254,8 @@ static void cc_cipher_exit(struct crypto_tfm *tfm) + &ctx_p->user.key_dma_addr); + + /* Free key buffer in context */ +- kfree_sensitive(ctx_p->user.key); + dev_dbg(dev, "Free key buffer in context. key=@%p\n", ctx_p->user.key); ++ kfree_sensitive(ctx_p->user.key); + } + + struct tdes_keys { +-- +2.34.1 + diff --git a/queue-5.10/crypto-mxs-dcp-fix-scatterlist-processing.patch b/queue-5.10/crypto-mxs-dcp-fix-scatterlist-processing.patch new file mode 100644 index 00000000000..c4dd1a22fcb --- /dev/null +++ b/queue-5.10/crypto-mxs-dcp-fix-scatterlist-processing.patch @@ -0,0 +1,35 @@ +From b88b4d6a17dfc408b6f3fe771ef38ee8d66bc973 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jan 2022 18:07:53 +0100 +Subject: crypto: mxs-dcp - Fix scatterlist processing + +From: Tomas Paukrt + +[ Upstream commit 28e9b6d8199a3f124682b143800c2dacdc3d70dd ] + +This patch fixes a bug in scatterlist processing that may cause incorrect AES block encryption/decryption. + +Fixes: 2e6d793e1bf0 ("crypto: mxs-dcp - Use sg_mapping_iter to copy data") +Signed-off-by: Tomas Paukrt +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/mxs-dcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index 5edc91cdb4e6..a9d3e675f7ff 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -330,7 +330,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128); + } + +- for_each_sg(req->src, src, sg_nents(src), i) { ++ for_each_sg(req->src, src, sg_nents(req->src), i) { + src_buf = sg_virt(src); + len = sg_dma_len(src); + tlen += len; +-- +2.34.1 + diff --git a/queue-5.10/crypto-rockchip-ecb-does-not-need-iv.patch b/queue-5.10/crypto-rockchip-ecb-does-not-need-iv.patch new file mode 100644 index 00000000000..92ccb3be71b --- /dev/null +++ b/queue-5.10/crypto-rockchip-ecb-does-not-need-iv.patch @@ -0,0 +1,36 @@ +From 3530ea774532d17d29cf15df7e8780e59859feec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Feb 2022 12:16:17 +0000 +Subject: crypto: rockchip - ECB does not need IV + +From: Corentin Labbe + +[ Upstream commit 973d74e93820d99d8ea203882631c76edab699c9 ] + +When loading rockchip crypto module, testmgr complains that ivsize of ecb-des3-ede-rk +is not the same than generic implementation. +In fact ECB does not use an IV. + +Fixes: ce0183cb6464b ("crypto: rockchip - switch to skcipher API") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/rockchip/rk3288_crypto_skcipher.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/crypto/rockchip/rk3288_crypto_skcipher.c b/drivers/crypto/rockchip/rk3288_crypto_skcipher.c +index 1cece1a7d3f0..5bbf0d2722e1 100644 +--- a/drivers/crypto/rockchip/rk3288_crypto_skcipher.c ++++ b/drivers/crypto/rockchip/rk3288_crypto_skcipher.c +@@ -506,7 +506,6 @@ struct rk_crypto_tmp rk_ecb_des3_ede_alg = { + .exit = rk_ablk_exit_tfm, + .min_keysize = DES3_EDE_KEY_SIZE, + .max_keysize = DES3_EDE_KEY_SIZE, +- .ivsize = DES_BLOCK_SIZE, + .setkey = rk_tdes_setkey, + .encrypt = rk_des3_ede_ecb_encrypt, + .decrypt = rk_des3_ede_ecb_decrypt, +-- +2.34.1 + diff --git a/queue-5.10/crypto-sun8i-ce-call-finalize-with-bh-disabled.patch b/queue-5.10/crypto-sun8i-ce-call-finalize-with-bh-disabled.patch new file mode 100644 index 00000000000..597def81125 --- /dev/null +++ b/queue-5.10/crypto-sun8i-ce-call-finalize-with-bh-disabled.patch @@ -0,0 +1,67 @@ +From 775e3bafb46366ce5eebe87a32cae10418c02088 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Feb 2022 12:08:30 +0000 +Subject: crypto: sun8i-ce - call finalize with bh disabled + +From: Corentin Labbe + +[ Upstream commit f75a749b6d78aeae2ce90e14fcc4b7b3ba46126d ] + +Doing ipsec produces a spinlock recursion warning. +This is due to not disabling BH during crypto completion function. + +Fixes: 06f751b61329 ("crypto: allwinner - Add sun8i-ce Crypto Engine") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c | 3 +++ + drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c +index 33707a2e55ff..64133d4da3d5 100644 +--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c ++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-cipher.c +@@ -11,6 +11,7 @@ + * You could find a link for the datasheet in Documentation/arm/sunxi.rst + */ + ++#include + #include + #include + #include +@@ -280,7 +281,9 @@ static int sun8i_ce_cipher_run(struct crypto_engine *engine, void *areq) + + flow = rctx->flow; + err = sun8i_ce_run_task(ce, flow, crypto_tfm_alg_name(breq->base.tfm)); ++ local_bh_disable(); + crypto_finalize_skcipher_request(engine, breq, err); ++ local_bh_enable(); + return 0; + } + +diff --git a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c +index 4c5a2c11d714..62c07a724d40 100644 +--- a/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c ++++ b/drivers/crypto/allwinner/sun8i-ce/sun8i-ce-hash.c +@@ -9,6 +9,7 @@ + * + * You could find the datasheet in Documentation/arm/sunxi.rst + */ ++#include + #include + #include + #include +@@ -412,6 +413,8 @@ int sun8i_ce_hash_run(struct crypto_engine *engine, void *breq) + theend: + kfree(buf); + kfree(result); ++ local_bh_disable(); + crypto_finalize_hash_request(engine, breq, err); ++ local_bh_enable(); + return 0; + } +-- +2.34.1 + diff --git a/queue-5.10/crypto-sun8i-ss-call-finalize-with-bh-disabled.patch b/queue-5.10/crypto-sun8i-ss-call-finalize-with-bh-disabled.patch new file mode 100644 index 00000000000..4bd2000ed78 --- /dev/null +++ b/queue-5.10/crypto-sun8i-ss-call-finalize-with-bh-disabled.patch @@ -0,0 +1,67 @@ +From 7230f99f4c7d0dce2af2c0cdb4d780c2335d80a3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Feb 2022 12:08:29 +0000 +Subject: crypto: sun8i-ss - call finalize with bh disabled + +From: Corentin Labbe + +[ Upstream commit b169b3766242b6f3336e24a6c8ee1522978b57a7 ] + +Doing ipsec produces a spinlock recursion warning. +This is due to not disabling BH during crypto completion function. + +Fixes: f08fcced6d00 ("crypto: allwinner - Add sun8i-ss cryptographic offloader") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c | 3 +++ + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 3 +++ + 2 files changed, 6 insertions(+) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +index 7c355bc2fb06..f783748462f9 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-cipher.c +@@ -11,6 +11,7 @@ + * You could find a link for the datasheet in Documentation/arm/sunxi.rst + */ + ++#include + #include + #include + #include +@@ -271,7 +272,9 @@ static int sun8i_ss_handle_cipher_request(struct crypto_engine *engine, void *ar + struct skcipher_request *breq = container_of(areq, struct skcipher_request, base); + + err = sun8i_ss_cipher(breq); ++ local_bh_disable(); + crypto_finalize_skcipher_request(engine, breq, err); ++ local_bh_enable(); + + return 0; + } +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +index 756d5a783548..c9edecd43ef9 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-hash.c +@@ -9,6 +9,7 @@ + * + * You could find the datasheet in Documentation/arm/sunxi.rst + */ ++#include + #include + #include + #include +@@ -440,6 +441,8 @@ int sun8i_ss_hash_run(struct crypto_engine *engine, void *breq) + theend: + kfree(pad); + kfree(result); ++ local_bh_disable(); + crypto_finalize_hash_request(engine, breq, err); ++ local_bh_enable(); + return 0; + } +-- +2.34.1 + diff --git a/queue-5.10/crypto-sun8i-ss-really-disable-hash-on-a80.patch b/queue-5.10/crypto-sun8i-ss-really-disable-hash-on-a80.patch new file mode 100644 index 00000000000..7096d8a0252 --- /dev/null +++ b/queue-5.10/crypto-sun8i-ss-really-disable-hash-on-a80.patch @@ -0,0 +1,40 @@ +From e94df82f082b8e21d266352a11921ef2fabca115 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Jan 2022 10:07:14 +0000 +Subject: crypto: sun8i-ss - really disable hash on A80 + +From: Corentin Labbe + +[ Upstream commit 881fc7fba6c3e7d77d608b9a50b01a89d5e0c61b ] + +When adding hashes support to sun8i-ss, I have added them only on A83T. +But I forgot that 0 is a valid algorithm ID, so hashes are enabled on A80 but +with an incorrect ID. +Anyway, even with correct IDs, hashes do not work on A80 and I cannot +find why. +So let's disable all of them on A80. + +Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms") +Signed-off-by: Corentin Labbe +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +index 80e89066dbd1..319fe3279a71 100644 +--- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c ++++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +@@ -30,6 +30,8 @@ + static const struct ss_variant ss_a80_variant = { + .alg_cipher = { SS_ALG_AES, SS_ALG_DES, SS_ALG_3DES, + }, ++ .alg_hash = { SS_ID_NOTSUPP, SS_ID_NOTSUPP, SS_ID_NOTSUPP, SS_ID_NOTSUPP, ++ }, + .op_mode = { SS_OP_ECB, SS_OP_CBC, + }, + .ss_clks = { +-- +2.34.1 + diff --git a/queue-5.10/crypto-vmx-add-missing-dependencies.patch b/queue-5.10/crypto-vmx-add-missing-dependencies.patch new file mode 100644 index 00000000000..65cda65306c --- /dev/null +++ b/queue-5.10/crypto-vmx-add-missing-dependencies.patch @@ -0,0 +1,62 @@ +From 416ddef28b37ca11d50aef804838840b6089c447 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 23 Feb 2022 16:11:15 +0100 +Subject: crypto: vmx - add missing dependencies + +From: Petr Vorel + +[ Upstream commit 647d41d3952d726d4ae49e853a9eff68ebad3b3f ] + +vmx-crypto module depends on CRYPTO_AES, CRYPTO_CBC, CRYPTO_CTR or +CRYPTO_XTS, thus add them. + +These dependencies are likely to be enabled, but if +CRYPTO_DEV_VMX=y && !CRYPTO_MANAGER_DISABLE_TESTS +and either of CRYPTO_AES, CRYPTO_CBC, CRYPTO_CTR or CRYPTO_XTS is built +as module or disabled, alg_test() from crypto/testmgr.c complains during +boot about failing to allocate the generic fallback implementations +(2 == ENOENT): + +[ 0.540953] Failed to allocate xts(aes) fallback: -2 +[ 0.541014] alg: skcipher: failed to allocate transform for p8_aes_xts: -2 +[ 0.541120] alg: self-tests for p8_aes_xts (xts(aes)) failed (rc=-2) +[ 0.544440] Failed to allocate ctr(aes) fallback: -2 +[ 0.544497] alg: skcipher: failed to allocate transform for p8_aes_ctr: -2 +[ 0.544603] alg: self-tests for p8_aes_ctr (ctr(aes)) failed (rc=-2) +[ 0.547992] Failed to allocate cbc(aes) fallback: -2 +[ 0.548052] alg: skcipher: failed to allocate transform for p8_aes_cbc: -2 +[ 0.548156] alg: self-tests for p8_aes_cbc (cbc(aes)) failed (rc=-2) +[ 0.550745] Failed to allocate transformation for 'aes': -2 +[ 0.550801] alg: cipher: Failed to load transform for p8_aes: -2 +[ 0.550892] alg: self-tests for p8_aes (aes) failed (rc=-2) + +Fixes: c07f5d3da643 ("crypto: vmx - Adding support for XTS") +Fixes: d2e3ae6f3aba ("crypto: vmx - Enabling VMX module for PPC64") + +Suggested-by: Nicolai Stange +Signed-off-by: Petr Vorel +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/crypto/vmx/Kconfig | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/crypto/vmx/Kconfig b/drivers/crypto/vmx/Kconfig +index c85fab7ef0bd..b2c28b87f14b 100644 +--- a/drivers/crypto/vmx/Kconfig ++++ b/drivers/crypto/vmx/Kconfig +@@ -2,7 +2,11 @@ + config CRYPTO_DEV_VMX_ENCRYPT + tristate "Encryption acceleration support on P8 CPU" + depends on CRYPTO_DEV_VMX ++ select CRYPTO_AES ++ select CRYPTO_CBC ++ select CRYPTO_CTR + select CRYPTO_GHASH ++ select CRYPTO_XTS + default m + help + Support for VMX cryptographic acceleration instructions on Power8 CPU. +-- +2.34.1 + diff --git a/queue-5.10/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch b/queue-5.10/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch new file mode 100644 index 00000000000..3e858c97c36 --- /dev/null +++ b/queue-5.10/dax-make-sure-inodes-are-flushed-before-destroy-cach.patch @@ -0,0 +1,51 @@ +From b04c5b6791854c1750475d78d1b31be3f277e033 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Feb 2022 23:11:11 -0800 +Subject: dax: make sure inodes are flushed before destroy cache + +From: Tong Zhang + +[ Upstream commit a7e8de822e0b1979f08767c751f6c8a9c1d4ad86 ] + +A bug can be triggered by following command + +$ modprobe nd_pmem && modprobe -r nd_pmem + +[ 10.060014] BUG dax_cache (Not tainted): Objects remaining in dax_cache on __kmem_cache_shutdown() +[ 10.060938] Slab 0x0000000085b729ac objects=9 used=1 fp=0x000000004f5ae469 flags=0x200000000010200(slab|head|node) +[ 10.062433] Call Trace: +[ 10.062673] dump_stack_lvl+0x34/0x44 +[ 10.062865] slab_err+0x90/0xd0 +[ 10.063619] __kmem_cache_shutdown+0x13b/0x2f0 +[ 10.063848] kmem_cache_destroy+0x4a/0x110 +[ 10.064058] __x64_sys_delete_module+0x265/0x300 + +This is caused by dax_fs_exit() not flushing inodes before destroy cache. +To fix this issue, call rcu_barrier() before destroy cache. + +Signed-off-by: Tong Zhang +Reviewed-by: Ira Weiny +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20220212071111.148575-1-ztong0001@gmail.com +Fixes: 7b6be8444e0f ("dax: refactor dax-fs into a generic provider of 'struct dax_device' instances") +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/dax/super.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/dax/super.c b/drivers/dax/super.c +index cadbd0a1a1ef..260a247c60d2 100644 +--- a/drivers/dax/super.c ++++ b/drivers/dax/super.c +@@ -723,6 +723,7 @@ static int dax_fs_init(void) + static void dax_fs_exit(void) + { + kern_unmount(dax_mnt); ++ rcu_barrier(); + kmem_cache_destroy(dax_cache); + } + +-- +2.34.1 + diff --git a/queue-5.10/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch b/queue-5.10/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch new file mode 100644 index 00000000000..5d7d1eb72dc --- /dev/null +++ b/queue-5.10/dm-crypt-fix-get_key_size-compiler-warning-if-config.patch @@ -0,0 +1,40 @@ +From 386277fc8a2d1ee583d1230bc48f4dd9952ea666 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Feb 2022 12:15:38 +0000 +Subject: dm crypt: fix get_key_size compiler warning if !CONFIG_KEYS + +From: Aashish Sharma + +[ Upstream commit 6fc51504388c1a1a53db8faafe9fff78fccc7c87 ] + +Explicitly convert unsigned int in the right of the conditional +expression to int to match the left side operand and the return type, +fixing the following compiler warning: + +drivers/md/dm-crypt.c:2593:43: warning: signed and unsigned +type in conditional expression [-Wsign-compare] + +Fixes: c538f6ec9f56 ("dm crypt: add ability to use keys from the kernel key retention service") +Signed-off-by: Aashish Sharma +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm-crypt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 2aa4acd33af3..b9677f701b6a 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -2561,7 +2561,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string + + static int get_key_size(char **key_string) + { +- return (*key_string[0] == ':') ? -EINVAL : strlen(*key_string) >> 1; ++ return (*key_string[0] == ':') ? -EINVAL : (int)(strlen(*key_string) >> 1); + } + + #endif /* CONFIG_KEYS */ +-- +2.34.1 + diff --git a/queue-5.10/dma-debug-fix-return-value-of-__setup-handlers.patch b/queue-5.10/dma-debug-fix-return-value-of-__setup-handlers.patch new file mode 100644 index 00000000000..296905d3c28 --- /dev/null +++ b/queue-5.10/dma-debug-fix-return-value-of-__setup-handlers.patch @@ -0,0 +1,72 @@ +From abfe311bf64d77b927e444ead8ca8077629ca592 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 14:04:53 -0800 +Subject: dma-debug: fix return value of __setup handlers + +From: Randy Dunlap + +[ Upstream commit 80e4390981618e290616dbd06ea190d4576f219d ] + +When valid kernel command line parameters + dma_debug=off dma_debug_entries=100 +are used, they are reported as Unknown parameters and added to init's +environment strings, polluting it. + + Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc5 + dma_debug=off dma_debug_entries=100", will be passed to user space. + +and + + Run /sbin/init as init process + with arguments: + /sbin/init + with environment: + HOME=/ + TERM=linux + BOOT_IMAGE=/boot/bzImage-517rc5 + dma_debug=off + dma_debug_entries=100 + +Return 1 from these __setup handlers to indicate that the command line +option has been handled. + +Fixes: 59d3daafa1726 ("dma-debug: add kernel command line parameters") +Signed-off-by: Randy Dunlap +Reported-by: Igor Zhbanov +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Cc: Joerg Roedel +Cc: Christoph Hellwig +Cc: Marek Szyprowski +Cc: iommu@lists.linux-foundation.org +Cc: Robin Murphy +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + kernel/dma/debug.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index 10d07ace46c1..f8ae54679865 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -928,7 +928,7 @@ static __init int dma_debug_cmdline(char *str) + global_disable = true; + } + +- return 0; ++ return 1; + } + + static __init int dma_debug_entries_cmdline(char *str) +@@ -937,7 +937,7 @@ static __init int dma_debug_entries_cmdline(char *str) + return -EINVAL; + if (!get_option(&str, &nr_prealloc_entries)) + nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES; +- return 0; ++ return 1; + } + + __setup("dma_debug=", dma_debug_cmdline); +-- +2.34.1 + diff --git a/queue-5.10/dmaengine-hisi_dma-fix-msi-allocate-fail-when-reload.patch b/queue-5.10/dmaengine-hisi_dma-fix-msi-allocate-fail-when-reload.patch new file mode 100644 index 00000000000..ec1ed2c0c2a --- /dev/null +++ b/queue-5.10/dmaengine-hisi_dma-fix-msi-allocate-fail-when-reload.patch @@ -0,0 +1,53 @@ +From e248441cfaed8a9df95d1bb67f0206eb59a6de30 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Feb 2022 15:21:01 +0800 +Subject: dmaengine: hisi_dma: fix MSI allocate fail when reload hisi_dma + +From: Jie Hai + +[ Upstream commit b95044b38425f563404234d96bbb20cc6360c7e1 ] + +Remove the loaded hisi_dma driver and reload it, the driver fails +to work properly. The following error is reported in the kernel log: + +[ 1475.597609] hisi_dma 0000:7b:00.0: Failed to allocate MSI vectors! +[ 1475.604915] hisi_dma: probe of 0000:7b:00.0 failed with error -28 + +As noted in "The MSI Driver Guide HOWTO"[1], the number of MSI +interrupt must be a power of two. The Kunpeng DMA driver allocates 30 +MSI interrupts. As a result, no space left on device is reported +when the driver is reloaded and allocates interrupt vectors from the +interrupt domain. + +This patch changes the number of interrupt vectors allocated by +hisi_dma driver to 32 to avoid this problem. + +[1] https://www.kernel.org/doc/html/latest/PCI/msi-howto.html + +Fixes: e9f08b65250d ("dmaengine: hisilicon: Add Kunpeng DMA engine support") + +Signed-off-by: Jie Hai +Acked-by: Zhou Wang +Link: https://lore.kernel.org/r/20220216072101.34473-1-haijie1@huawei.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/dma/hisi_dma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/dma/hisi_dma.c b/drivers/dma/hisi_dma.c +index e1a958ae7925..3e83769615d1 100644 +--- a/drivers/dma/hisi_dma.c ++++ b/drivers/dma/hisi_dma.c +@@ -30,7 +30,7 @@ + #define HISI_DMA_MODE 0x217c + #define HISI_DMA_OFFSET 0x100 + +-#define HISI_DMA_MSI_NUM 30 ++#define HISI_DMA_MSI_NUM 32 + #define HISI_DMA_CHAN_NUM 30 + #define HISI_DMA_Q_DEPTH_VAL 1024 + +-- +2.34.1 + diff --git a/queue-5.10/driver-core-dd-fix-return-value-of-__setup-handler.patch b/queue-5.10/driver-core-dd-fix-return-value-of-__setup-handler.patch new file mode 100644 index 00000000000..e58ad8fa823 --- /dev/null +++ b/queue-5.10/driver-core-dd-fix-return-value-of-__setup-handler.patch @@ -0,0 +1,59 @@ +From e9c09563a51f2d5dd2c32aa9454de053af4838f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 20:18:29 -0800 +Subject: driver core: dd: fix return value of __setup handler + +From: Randy Dunlap + +[ Upstream commit f2aad54703dbe630f9d8b235eb58e8c8cc78f37d ] + +When "driver_async_probe=nulltty" is used on the kernel boot command line, +it causes an Unknown parameter message and the string is added to init's +environment strings, polluting them. + + Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc6 + driver_async_probe=nulltty", will be passed to user space. + + Run /sbin/init as init process + with arguments: + /sbin/init + with environment: + HOME=/ + TERM=linux + BOOT_IMAGE=/boot/bzImage-517rc6 + driver_async_probe=nulltty + +Change the return value of the __setup function to 1 to indicate +that the __setup option has been handled. + +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Fixes: 1ea61b68d0f8 ("async: Add cmdline option to specify drivers to be async probed") +Cc: Feng Tang +Cc: Greg Kroah-Hartman +Cc: "Rafael J. Wysocki" +Reported-by: Igor Zhbanov +Reviewed-by: Feng Tang +Signed-off-by: Randy Dunlap +Link: https://lore.kernel.org/r/20220301041829.15137-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/base/dd.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index 64ff137408b8..2728223c1fbc 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -771,7 +771,7 @@ static int __init save_async_options(char *buf) + pr_warn("Too long list of driver names for 'driver_async_probe'!\n"); + + strlcpy(async_probe_drv_names, buf, ASYNC_DRV_NAMES_MAX_LEN); +- return 0; ++ return 1; + } + __setup("driver_async_probe=", save_async_options); + +-- +2.34.1 + diff --git a/queue-5.10/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch b/queue-5.10/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch new file mode 100644 index 00000000000..8211945dbce --- /dev/null +++ b/queue-5.10/drm-amd-display-add-affected-crtcs-to-atomic-state-f.patch @@ -0,0 +1,58 @@ +From 6fcc9821545d2845325b85570d81c4d589c36fa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Dec 2021 17:39:57 -0500 +Subject: drm/amd/display: Add affected crtcs to atomic state for dsc mst + unplug + +From: Roman Li + +[ Upstream commit 128f8ed5902a287a6bb4afe0ffdae8a80b2a64ec ] + +[Why] +When display topology changed on DSC hub we add all crtcs with dsc support to +atomic state. +Refer to patch:"drm/amd/display: Trigger modesets on MST DSC connectors" +However the original implementation may skip crtc if the topology change +caused by unplug. +That potentially could lead to no-lightup or corruption on DSC hub after +unplug event on one of the connectors. + +[How] +Update add_affected_mst_dsc_crtcs() to use old connector state +if new connector state has no crtc (undergoes modeset due to unplug) + +Fixes: 44be939ff7ac58 ("drm/amd/display: Trigger modesets on MST DSC connectors") + +Reviewed-by: Hersen Wu +Acked-by: Jasdeep Dhillon +Signed-off-by: Roman Li +Tested-by: Daniel Wheeler +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index b65364695219..e828f9414ba2 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -8615,10 +8615,13 @@ static int dm_update_plane_state(struct dc *dc, + static int add_affected_mst_dsc_crtcs(struct drm_atomic_state *state, struct drm_crtc *crtc) + { + struct drm_connector *connector; +- struct drm_connector_state *conn_state; ++ struct drm_connector_state *conn_state, *old_conn_state; + struct amdgpu_dm_connector *aconnector = NULL; + int i; +- for_each_new_connector_in_state(state, connector, conn_state, i) { ++ for_each_oldnew_connector_in_state(state, connector, old_conn_state, conn_state, i) { ++ if (!conn_state->crtc) ++ conn_state = old_conn_state; ++ + if (conn_state->crtc != crtc) + continue; + +-- +2.34.1 + diff --git a/queue-5.10/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch b/queue-5.10/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch new file mode 100644 index 00000000000..3a09e30646a --- /dev/null +++ b/queue-5.10/drm-amd-display-fix-a-null-pointer-dereference-in-am.patch @@ -0,0 +1,49 @@ +From 72bfe24e3dc2b01b72d9b9d9ecfa09c3605b69b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 00:57:29 +0800 +Subject: drm/amd/display: Fix a NULL pointer dereference in + amdgpu_dm_connector_add_common_modes() + +From: Zhou Qingyang + +[ Upstream commit 588a70177df3b1777484267584ef38ab2ca899a2 ] + +In amdgpu_dm_connector_add_common_modes(), amdgpu_dm_create_common_mode() +is assigned to mode and is passed to drm_mode_probed_add() directly after +that. drm_mode_probed_add() passes &mode->head to list_add_tail(), and +there is a dereference of it in list_add_tail() without recoveries, which +could lead to NULL pointer dereference on failure of +amdgpu_dm_create_common_mode(). + +Fix this by adding a NULL check of mode. + +This bug was found by a static analyzer. + +Builds with 'make allyesconfig' show no new warnings, +and our static analyzer no longer warns about this code. + +Fixes: e7b07ceef2a6 ("drm/amd/display: Merge amdgpu_dm_types and amdgpu_dm") +Signed-off-by: Zhou Qingyang +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index 6c8f141103da..b65364695219 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -6396,6 +6396,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder, + mode = amdgpu_dm_create_common_mode(encoder, + common_modes[i].name, common_modes[i].w, + common_modes[i].h); ++ if (!mode) ++ continue; ++ + drm_mode_probed_add(connector, mode); + amdgpu_dm_connector->num_modes++; + } +-- +2.34.1 + diff --git a/queue-5.10/drm-amd-display-remove-vupdate_int_entry-definition.patch b/queue-5.10/drm-amd-display-remove-vupdate_int_entry-definition.patch new file mode 100644 index 00000000000..66e5da0782c --- /dev/null +++ b/queue-5.10/drm-amd-display-remove-vupdate_int_entry-definition.patch @@ -0,0 +1,162 @@ +From 5644b3915ab99e83cfb31c885755852816993df9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 10:16:57 -0300 +Subject: drm/amd/display: Remove vupdate_int_entry definition +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maíra Canal + +[ Upstream commit 3679b8518cd213c25d555553ef212e233faf698c ] + +Remove the vupdate_int_entry definition and utilization to avoid the +following warning by Clang: + +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:410:2: +warning: initializer overrides prior initialization of this subobject +[-Winitializer-overrides] + vupdate_no_lock_int_entry(0), + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39: +note: expanded from macro 'vupdate_no_lock_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:404:2: +note: previous initialization is here + vupdate_int_entry(0), + ^~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39: +note: expanded from macro 'vupdate_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:411:2: +warning: initializer overrides prior initialization of this subobject +[-Winitializer-overrides] + vupdate_no_lock_int_entry(1), + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39: +note: expanded from macro 'vupdate_no_lock_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:405:2: +note: previous initialization is here + vupdate_int_entry(1), + ^~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39: +note: expanded from macro 'vupdate_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:412:2: +warning: initializer overrides prior initialization of this subobject +[-Winitializer-overrides] + vupdate_no_lock_int_entry(2), + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39: +note: expanded from macro 'vupdate_no_lock_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:406:2: +note: previous initialization is here + vupdate_int_entry(2), + ^~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39: +note: expanded from macro 'vupdate_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:413:2: +warning: initializer overrides prior initialization of this subobject +[-Winitializer-overrides] + vupdate_no_lock_int_entry(3), + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39: +note: expanded from macro 'vupdate_no_lock_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:407:2: +note: previous initialization is here + vupdate_int_entry(3), + ^~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39: +note: expanded from macro 'vupdate_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:414:2: +warning: initializer overrides prior initialization of this subobject +[-Winitializer-overrides] + vupdate_no_lock_int_entry(4), + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39: +note: expanded from macro 'vupdate_no_lock_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:408:2: +note: previous initialization is here + vupdate_int_entry(4), + ^~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39: +note: expanded from macro 'vupdate_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:415:2: +warning: initializer overrides prior initialization of this subobject +[-Winitializer-overrides] + vupdate_no_lock_int_entry(5), + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:280:39: +note: expanded from macro 'vupdate_no_lock_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:409:2: +note: previous initialization is here + vupdate_int_entry(5), + ^~~~~~~~~~~~~~~~~~~~ +drivers/gpu/drm/amd/amdgpu/../display/dc/irq/dcn21/irq_service_dcn21.c:269:39: +note: expanded from macro 'vupdate_int_entry' + [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ + ^~ +6 warnings generated. + +Fixes: 688f97ed3f5e ("drm/amd/display: Add vupdate_no_lock interrupts for DCN2.1") +Signed-off-by: Maíra Canal +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../amd/display/dc/irq/dcn21/irq_service_dcn21.c | 14 -------------- + 1 file changed, 14 deletions(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c +index 0e0f494fbb5e..b037fd57fd36 100644 +--- a/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c ++++ b/drivers/gpu/drm/amd/display/dc/irq/dcn21/irq_service_dcn21.c +@@ -227,14 +227,6 @@ static const struct irq_source_info_funcs vupdate_no_lock_irq_info_funcs = { + .funcs = &pflip_irq_info_funcs\ + } + +-#define vupdate_int_entry(reg_num)\ +- [DC_IRQ_SOURCE_VUPDATE1 + reg_num] = {\ +- IRQ_REG_ENTRY(OTG, reg_num,\ +- OTG_GLOBAL_SYNC_STATUS, VUPDATE_INT_EN,\ +- OTG_GLOBAL_SYNC_STATUS, VUPDATE_EVENT_CLEAR),\ +- .funcs = &vblank_irq_info_funcs\ +- } +- + /* vupdate_no_lock_int_entry maps to DC_IRQ_SOURCE_VUPDATEx, to match semantic + * of DCE's DC_IRQ_SOURCE_VUPDATEx. + */ +@@ -348,12 +340,6 @@ irq_source_info_dcn21[DAL_IRQ_SOURCES_NUMBER] = { + dc_underflow_int_entry(6), + [DC_IRQ_SOURCE_DMCU_SCP] = dummy_irq_entry(), + [DC_IRQ_SOURCE_VBIOS_SW] = dummy_irq_entry(), +- vupdate_int_entry(0), +- vupdate_int_entry(1), +- vupdate_int_entry(2), +- vupdate_int_entry(3), +- vupdate_int_entry(4), +- vupdate_int_entry(5), + vupdate_no_lock_int_entry(0), + vupdate_no_lock_int_entry(1), + vupdate_no_lock_int_entry(2), +-- +2.34.1 + diff --git a/queue-5.10/drm-amd-pm-enable-pm-sysfs-write-for-one-vf-mode.patch b/queue-5.10/drm-amd-pm-enable-pm-sysfs-write-for-one-vf-mode.patch new file mode 100644 index 00000000000..e941c4a82de --- /dev/null +++ b/queue-5.10/drm-amd-pm-enable-pm-sysfs-write-for-one-vf-mode.patch @@ -0,0 +1,42 @@ +From 5a9df652aac7f0c1039b6c290424c5e5063b3831 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 16:11:20 +0800 +Subject: drm/amd/pm: enable pm sysfs write for one VF mode + +From: Yiqing Yao + +[ Upstream commit e610941c45bad75aa839af015c27d236ab6749e5 ] + +[why] +pm sysfs should be writable in one VF mode as is in passthrough + +[how] +do not remove write access on pm sysfs if device is in one VF mode + +Fixes: 11c9cc95f818 ("amdgpu/pm: Make sysfs pm attributes as read-only for VFs") +Signed-off-by: Yiqing Yao +Reviewed-by: Monk Liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/amdgpu_pm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c +index 49109614510b..5abb68017f6e 100644 +--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c ++++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c +@@ -2098,8 +2098,8 @@ static int default_attr_update(struct amdgpu_device *adev, struct amdgpu_device_ + } + } + +- /* setting should not be allowed from VF */ +- if (amdgpu_sriov_vf(adev)) { ++ /* setting should not be allowed from VF if not in one VF mode */ ++ if (amdgpu_sriov_vf(adev) && !amdgpu_sriov_is_pp_one_vf(adev)) { + dev_attr->attr.mode &= ~S_IWUGO; + dev_attr->store = NULL; + } +-- +2.34.1 + diff --git a/queue-5.10/drm-amd-pm-return-enotsupp-if-there-is-no-get_dpm_ul.patch b/queue-5.10/drm-amd-pm-return-enotsupp-if-there-is-no-get_dpm_ul.patch new file mode 100644 index 00000000000..15fffb8d7c5 --- /dev/null +++ b/queue-5.10/drm-amd-pm-return-enotsupp-if-there-is-no-get_dpm_ul.patch @@ -0,0 +1,43 @@ +From 66e47b0c371f3ae5b9e17b0956a79c75c19198b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 12:18:12 -0800 +Subject: drm/amd/pm: return -ENOTSUPP if there is no get_dpm_ultimate_freq + function + +From: Tom Rix + +[ Upstream commit 430e6a0212b2a0eb1de5e9d47a016fa79edf3978 ] + +clang static analysis reports this represenative problem +amdgpu_smu.c:144:18: warning: The left operand of '*' is a garbage value + return clk_freq * 100; + ~~~~~~~~ ^ + +If there is no get_dpm_ultimate_freq function, +smu_get_dpm_freq_range returns success without setting the +output min,max parameters. So return an -ENOTSUPP error. + +Fixes: e5ef784b1e17 ("drm/amd/powerplay: revise calling chain on retrieving frequency range") +Signed-off-by: Tom Rix +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +index e5893218fa4b..ee27970cfff9 100644 +--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c ++++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c +@@ -115,7 +115,7 @@ int smu_get_dpm_freq_range(struct smu_context *smu, + uint32_t *min, + uint32_t *max) + { +- int ret = 0; ++ int ret = -ENOTSUPP; + + if (!min && !max) + return -EINVAL; +-- +2.34.1 + diff --git a/queue-5.10/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch b/queue-5.10/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch new file mode 100644 index 00000000000..9a2b8fc050b --- /dev/null +++ b/queue-5.10/drm-bridge-add-missing-pm_runtime_disable-in-__dw_mi.patch @@ -0,0 +1,38 @@ +From 8395a316fab4f9b7b11ba2a533110dbb346f8e95 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jan 2022 10:41:09 +0000 +Subject: drm/bridge: Add missing pm_runtime_disable() in __dw_mipi_dsi_probe + +From: Miaoqian Lin + +[ Upstream commit 96211b7c56b109a52768e6cc5e23a1f79316eca0 ] + +If the probe fails, we should use pm_runtime_disable() to balance +pm_runtime_enable(). +Add missing pm_runtime_disable() for __dw_mipi_dsi_probe. + +Fixes: 46fc51546d44 ("drm/bridge/synopsys: Add MIPI DSI host controller bridge") +Signed-off-by: Miaoqian Lin +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220105104113.31415-1-linmq006@gmail.com +Reviewed-by: Robert Foss +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c +index 6b268f9445b3..376fa6eb46f6 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-mipi-dsi.c +@@ -1172,6 +1172,7 @@ __dw_mipi_dsi_probe(struct platform_device *pdev, + ret = mipi_dsi_host_register(&dsi->dsi_host); + if (ret) { + dev_err(dev, "Failed to register MIPI host: %d\n", ret); ++ pm_runtime_disable(dev); + dw_mipi_dsi_debugfs_remove(dsi); + return ERR_PTR(ret); + } +-- +2.34.1 + diff --git a/queue-5.10/drm-bridge-adv7511-fix-adv7535-hpd-enablement.patch b/queue-5.10/drm-bridge-adv7511-fix-adv7535-hpd-enablement.patch new file mode 100644 index 00000000000..214cd390c26 --- /dev/null +++ b/queue-5.10/drm-bridge-adv7511-fix-adv7535-hpd-enablement.patch @@ -0,0 +1,100 @@ +From d6ca55f68df070121c1cf0911411e09d5be16378 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jan 2022 22:59:49 +0530 +Subject: drm: bridge: adv7511: Fix ADV7535 HPD enablement + +From: Jagan Teki + +[ Upstream commit 3dbc84a595d17f64f14fcea00120d31e33e98880 ] + +Existing HPD enablement logic is not compatible with ADV7535 +bridge, thus any runtime plug-in of HDMI cable is not working +on these bridge designs. + +Unlike other ADV7511 family of bridges, the ADV7535 require +HPD_OVERRIDE bit to set and reset for proper handling of HPD +functionality. + +Fix it. + +Fixes: 8501fe4b14a3 ("drm: bridge: adv7511: Add support for ADV7535") +Signed-off-by: Jagan Teki +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220109172949.168167-1-jagan@amarulasolutions.com +Reviewed-by: Robert Foss +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/adv7511/adv7511.h | 1 + + drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 29 +++++++++++++++----- + 2 files changed, 23 insertions(+), 7 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511.h b/drivers/gpu/drm/bridge/adv7511/adv7511.h +index a9bb734366ae..a0f6ee15c248 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511.h ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511.h +@@ -169,6 +169,7 @@ + #define ADV7511_PACKET_ENABLE_SPARE2 BIT(1) + #define ADV7511_PACKET_ENABLE_SPARE1 BIT(0) + ++#define ADV7535_REG_POWER2_HPD_OVERRIDE BIT(6) + #define ADV7511_REG_POWER2_HPD_SRC_MASK 0xc0 + #define ADV7511_REG_POWER2_HPD_SRC_BOTH 0x00 + #define ADV7511_REG_POWER2_HPD_SRC_HPD 0x40 +diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +index a0d392c338da..c6f059be4b89 100644 +--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c ++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c +@@ -351,11 +351,17 @@ static void __adv7511_power_on(struct adv7511 *adv7511) + * from standby or are enabled. When the HPD goes low the adv7511 is + * reset and the outputs are disabled which might cause the monitor to + * go to standby again. To avoid this we ignore the HPD pin for the +- * first few seconds after enabling the output. ++ * first few seconds after enabling the output. On the other hand ++ * adv7535 require to enable HPD Override bit for proper HPD. + */ +- regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2, +- ADV7511_REG_POWER2_HPD_SRC_MASK, +- ADV7511_REG_POWER2_HPD_SRC_NONE); ++ if (adv7511->type == ADV7535) ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2, ++ ADV7535_REG_POWER2_HPD_OVERRIDE, ++ ADV7535_REG_POWER2_HPD_OVERRIDE); ++ else ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2, ++ ADV7511_REG_POWER2_HPD_SRC_MASK, ++ ADV7511_REG_POWER2_HPD_SRC_NONE); + } + + static void adv7511_power_on(struct adv7511 *adv7511) +@@ -375,6 +381,10 @@ static void adv7511_power_on(struct adv7511 *adv7511) + static void __adv7511_power_off(struct adv7511 *adv7511) + { + /* TODO: setup additional power down modes */ ++ if (adv7511->type == ADV7535) ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2, ++ ADV7535_REG_POWER2_HPD_OVERRIDE, 0); ++ + regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER, + ADV7511_POWER_POWER_DOWN, + ADV7511_POWER_POWER_DOWN); +@@ -672,9 +682,14 @@ adv7511_detect(struct adv7511 *adv7511, struct drm_connector *connector) + status = connector_status_disconnected; + } else { + /* Renable HPD sensing */ +- regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2, +- ADV7511_REG_POWER2_HPD_SRC_MASK, +- ADV7511_REG_POWER2_HPD_SRC_BOTH); ++ if (adv7511->type == ADV7535) ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2, ++ ADV7535_REG_POWER2_HPD_OVERRIDE, ++ ADV7535_REG_POWER2_HPD_OVERRIDE); ++ else ++ regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER2, ++ ADV7511_REG_POWER2_HPD_SRC_MASK, ++ ADV7511_REG_POWER2_HPD_SRC_BOTH); + } + + adv7511->status = status; +-- +2.34.1 + diff --git a/queue-5.10/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch b/queue-5.10/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch new file mode 100644 index 00000000000..4de2d23c6d8 --- /dev/null +++ b/queue-5.10/drm-bridge-cdns-dsi-make-sure-to-to-create-proper-al.patch @@ -0,0 +1,38 @@ +From 0a45d11b119407751651c2662ace82f7c78e9911 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Sep 2021 12:40:59 -0500 +Subject: drm/bridge: cdns-dsi: Make sure to to create proper aliases for dt + +From: Nishanth Menon + +[ Upstream commit ffb5c099aaa13ab7f73c29ea6ae26bce8d7575ae ] + +Add MODULE_DEVICE_TABLE to the device tree table to create required +aliases needed for module to be loaded with device tree based platform. + +Fixes: e19233955d9e ("drm/bridge: Add Cadence DSI driver") +Signed-off-by: Nishanth Menon +Reviewed-by: Tomi Valkeinen +Reviewed-by: Laurent Pinchart +Signed-off-by: Tomi Valkeinen +Link: https://patchwork.freedesktop.org/patch/msgid/20210921174059.17946-1-nm@ti.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/cdns-dsi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/cdns-dsi.c b/drivers/gpu/drm/bridge/cdns-dsi.c +index b31281f76117..0ced08d81d7a 100644 +--- a/drivers/gpu/drm/bridge/cdns-dsi.c ++++ b/drivers/gpu/drm/bridge/cdns-dsi.c +@@ -1286,6 +1286,7 @@ static const struct of_device_id cdns_dsi_of_match[] = { + { .compatible = "cdns,dsi" }, + { }, + }; ++MODULE_DEVICE_TABLE(of, cdns_dsi_of_match); + + static struct platform_driver cdns_dsi_platform_driver = { + .probe = cdns_dsi_drm_probe, +-- +2.34.1 + diff --git a/queue-5.10/drm-bridge-dw-hdmi-use-safe-format-when-first-in-bri.patch b/queue-5.10/drm-bridge-dw-hdmi-use-safe-format-when-first-in-bri.patch new file mode 100644 index 00000000000..bff3e0d9534 --- /dev/null +++ b/queue-5.10/drm-bridge-dw-hdmi-use-safe-format-when-first-in-bri.patch @@ -0,0 +1,58 @@ +From 188d4b143c49ed7169b83c2a1ea70d2a098169dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Feb 2022 15:33:37 +0100 +Subject: drm/bridge: dw-hdmi: use safe format when first in bridge chain + +From: Neil Armstrong + +[ Upstream commit 1528038385c0a706aac9ac165eeb24044fef6825 ] + +When the dw-hdmi bridge is in first place of the bridge chain, this +means there is no way to select an input format of the dw-hdmi HW +component. + +Since introduction of display-connector, negotiation was broken since +the dw-hdmi negotiation code only worked when the dw-hdmi bridge was +in last position of the bridge chain or behind another bridge also +supporting input & output format negotiation. + +Commit 7cd70656d128 ("drm/bridge: display-connector: implement bus fmts callbacks") +was introduced to make negotiation work again by making display-connector +act as a pass-through concerning input & output format negotiation. + +But in the case where the dw-hdmi is single in the bridge chain, for +example on Renesas SoCs, with the display-connector bridge the dw-hdmi +is no more single, breaking output format. + +Reported-by: Biju Das +Bisected-by: Kieran Bingham +Tested-by: Kieran Bingham +Fixes: 6c3c719936da ("drm/bridge: synopsys: dw-hdmi: add bus format negociation") +Signed-off-by: Neil Armstrong +[narmstrong: add proper fixes commit] +Reviewed-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220204143337.89221-1-narmstrong@baylibre.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/synopsys/dw-hdmi.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index 29c0eb4bd754..b10228b9e3a9 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -2566,8 +2566,9 @@ static u32 *dw_hdmi_bridge_atomic_get_output_bus_fmts(struct drm_bridge *bridge, + if (!output_fmts) + return NULL; + +- /* If dw-hdmi is the only bridge, avoid negociating with ourselves */ +- if (list_is_singular(&bridge->encoder->bridge_chain)) { ++ /* If dw-hdmi is the first or only bridge, avoid negociating with ourselves */ ++ if (list_is_singular(&bridge->encoder->bridge_chain) || ++ list_is_first(&bridge->chain_node, &bridge->encoder->bridge_chain)) { + *num_output_fmts = 1; + output_fmts[0] = MEDIA_BUS_FMT_FIXED; + +-- +2.34.1 + diff --git a/queue-5.10/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch b/queue-5.10/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch new file mode 100644 index 00000000000..c1d30cbbc3c --- /dev/null +++ b/queue-5.10/drm-bridge-fix-free-wrong-object-in-sii8620_init_rcp.patch @@ -0,0 +1,39 @@ +From a6b67bcfad8039fc47a8da16881d0a61c1c0b96b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 27 Dec 2021 09:25:22 +0000 +Subject: drm/bridge: Fix free wrong object in sii8620_init_rcp_input_dev + +From: Miaoqian Lin + +[ Upstream commit 7c442e76c06cb1bef16a6c523487438175584eea ] + +rc_dev is allocated by rc_allocate_device(), and doesn't assigned to +ctx->rc_dev before calling rc_free_device(ctx->rc_dev). +So it should call rc_free_device(rc_dev); + +Fixes: e25f1f7c94e1 ("drm/bridge/sii8620: add remote control support") +Signed-off-by: Miaoqian Lin +Reviewed-by: Robert Foss +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20211227092522.21755-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/sil-sii8620.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index 843265d7f1b1..ec7745c31da0 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -2120,7 +2120,7 @@ static void sii8620_init_rcp_input_dev(struct sii8620 *ctx) + if (ret) { + dev_err(ctx->dev, "Failed to register RC device\n"); + ctx->error = ret; +- rc_free_device(ctx->rc_dev); ++ rc_free_device(rc_dev); + return; + } + ctx->rc_dev = rc_dev; +-- +2.34.1 + diff --git a/queue-5.10/drm-bridge-nwl-dsi-fix-pm-disable-depth-imbalance-in.patch b/queue-5.10/drm-bridge-nwl-dsi-fix-pm-disable-depth-imbalance-in.patch new file mode 100644 index 00000000000..3987a6d4c03 --- /dev/null +++ b/queue-5.10/drm-bridge-nwl-dsi-fix-pm-disable-depth-imbalance-in.patch @@ -0,0 +1,38 @@ +From f3012f040b042add9e523e32ca0dd0f5b109f7a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jan 2022 10:48:26 +0000 +Subject: drm/bridge: nwl-dsi: Fix PM disable depth imbalance in nwl_dsi_probe + +From: Miaoqian Lin + +[ Upstream commit b146e343a9e05605b491b1bf4a2b62a39d5638d8 ] + +The pm_runtime_enable will increase power disable depth. +Thus a pairing decrement is needed on the error handling +path to keep it balanced according to context. + +Fixes: 44cfc6233447 ("drm/bridge: Add NWL MIPI DSI host controller support") +Signed-off-by: Miaoqian Lin +Signed-off-by: Robert Foss +Link: https://patchwork.freedesktop.org/patch/msgid/20220105104826.1418-1-linmq006@gmail.com +Reviewed-by: Robert Foss +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/bridge/nwl-dsi.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/bridge/nwl-dsi.c b/drivers/gpu/drm/bridge/nwl-dsi.c +index 6cac2e58cd15..b68d33598158 100644 +--- a/drivers/gpu/drm/bridge/nwl-dsi.c ++++ b/drivers/gpu/drm/bridge/nwl-dsi.c +@@ -1188,6 +1188,7 @@ static int nwl_dsi_probe(struct platform_device *pdev) + + ret = nwl_dsi_select_input(dsi); + if (ret < 0) { ++ pm_runtime_disable(dev); + mipi_dsi_host_unregister(&dsi->dsi_host); + return ret; + } +-- +2.34.1 + diff --git a/queue-5.10/drm-edid-don-t-clear-formats-if-using-deep-color.patch b/queue-5.10/drm-edid-don-t-clear-formats-if-using-deep-color.patch new file mode 100644 index 00000000000..3679a82f75e --- /dev/null +++ b/queue-5.10/drm-edid-don-t-clear-formats-if-using-deep-color.patch @@ -0,0 +1,76 @@ +From 7cf638083dfb3817910072548590648fbbde4ab6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 16:16:11 +0100 +Subject: drm/edid: Don't clear formats if using deep color +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maxime Ripard + +[ Upstream commit 75478b3b393bcbdca4e6da76fe3a9f1a4133ec5d ] + +The current code, when parsing the EDID Deep Color depths, that the +YUV422 cannot be used, referring to the HDMI 1.3 Specification. + +This specification, in its section 6.2.4, indeed states: + + For each supported Deep Color mode, RGB 4:4:4 shall be supported and + optionally YCBCR 4:4:4 may be supported. + + YCBCR 4:2:2 is not permitted for any Deep Color mode. + +This indeed can be interpreted like the code does, but the HDMI 1.4 +specification further clarifies that statement in its section 6.2.4: + + For each supported Deep Color mode, RGB 4:4:4 shall be supported and + optionally YCBCR 4:4:4 may be supported. + + YCBCR 4:2:2 is also 36-bit mode but does not require the further use + of the Deep Color modes described in section 6.5.2 and 6.5.3. + +This means that, even though YUV422 can be used with 12 bit per color, +it shouldn't be treated as a deep color mode. + +This is also broken with YUV444 if it's supported by the display, but +DRM_EDID_HDMI_DC_Y444 isn't set. In such a case, the code will clear +color_formats of the YUV444 support set previously in +drm_parse_cea_ext(), but will not set it back. + +Since the formats supported are already setup properly in +drm_parse_cea_ext(), let's just remove the code modifying the formats in +drm_parse_hdmi_deep_color_info() + +Fixes: d0c94692e0a3 ("drm/edid: Parse and handle HDMI deep color modes.") +Signed-off-by: Maxime Ripard +Reviewed-by: Ville Syrjälä +Link: https://patchwork.freedesktop.org/patch/msgid/20220120151625.594595-3-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/drm_edid.c | 8 -------- + 1 file changed, 8 deletions(-) + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 3d7593ea79f1..d41a4826c192 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -4959,16 +4959,8 @@ static void drm_parse_hdmi_deep_color_info(struct drm_connector *connector, + connector->name, dc_bpc); + info->bpc = dc_bpc; + +- /* +- * Deep color support mandates RGB444 support for all video +- * modes and forbids YCRCB422 support for all video modes per +- * HDMI 1.3 spec. +- */ +- info->color_formats = DRM_COLOR_FORMAT_RGB444; +- + /* YCRCB444 is optional according to spec. */ + if (hdmi[6] & DRM_EDID_HDMI_DC_Y444) { +- info->color_formats |= DRM_COLOR_FORMAT_YCRCB444; + DRM_DEBUG("%s: HDMI sink does YCRCB444 in deep color.\n", + connector->name); + } +-- +2.34.1 + diff --git a/queue-5.10/drm-meson-osd_afbcd-add-an-exit-callback-to-struct-m.patch b/queue-5.10/drm-meson-osd_afbcd-add-an-exit-callback-to-struct-m.patch new file mode 100644 index 00000000000..20b5dd68806 --- /dev/null +++ b/queue-5.10/drm-meson-osd_afbcd-add-an-exit-callback-to-struct-m.patch @@ -0,0 +1,144 @@ +From dc831026903e1cf30b612d151f4bd618f6d2462e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 31 Dec 2021 00:55:14 +0100 +Subject: drm/meson: osd_afbcd: Add an exit callback to struct meson_afbcd_ops + +From: Martin Blumenstingl + +[ Upstream commit 04b8a5d9cfd171f65df75f444b5617a372649edd ] + +Use this to simplify the driver shutdown. It will also come handy when +fixing the error handling in meson_drv_bind_master(). + +Signed-off-by: Martin Blumenstingl +Fixes: d1b5e41e13a7e9 ("drm/meson: Add AFBCD module driver") +Acked-by: Neil Armstrong +Signed-off-by: Neil Armstrong +Link: https://patchwork.freedesktop.org/patch/msgid/20211230235515.1627522-2-martin.blumenstingl@googlemail.com +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/meson/meson_drv.c | 6 ++-- + drivers/gpu/drm/meson/meson_osd_afbcd.c | 41 ++++++++++++++++--------- + drivers/gpu/drm/meson/meson_osd_afbcd.h | 1 + + 3 files changed, 30 insertions(+), 18 deletions(-) + +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 2753067c08e6..728fea509412 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -396,10 +396,8 @@ static void meson_drv_unbind(struct device *dev) + drm_irq_uninstall(drm); + drm_dev_put(drm); + +- if (priv->afbcd.ops) { +- priv->afbcd.ops->reset(priv); +- meson_rdma_free(priv); +- } ++ if (priv->afbcd.ops) ++ priv->afbcd.ops->exit(priv); + } + + static const struct component_master_ops meson_drv_master_ops = { +diff --git a/drivers/gpu/drm/meson/meson_osd_afbcd.c b/drivers/gpu/drm/meson/meson_osd_afbcd.c +index ffc6b584dbf8..0cdbe899402f 100644 +--- a/drivers/gpu/drm/meson/meson_osd_afbcd.c ++++ b/drivers/gpu/drm/meson/meson_osd_afbcd.c +@@ -79,11 +79,6 @@ static bool meson_gxm_afbcd_supported_fmt(u64 modifier, uint32_t format) + return meson_gxm_afbcd_pixel_fmt(modifier, format) >= 0; + } + +-static int meson_gxm_afbcd_init(struct meson_drm *priv) +-{ +- return 0; +-} +- + static int meson_gxm_afbcd_reset(struct meson_drm *priv) + { + writel_relaxed(VIU_SW_RESET_OSD1_AFBCD, +@@ -93,6 +88,16 @@ static int meson_gxm_afbcd_reset(struct meson_drm *priv) + return 0; + } + ++static int meson_gxm_afbcd_init(struct meson_drm *priv) ++{ ++ return 0; ++} ++ ++static void meson_gxm_afbcd_exit(struct meson_drm *priv) ++{ ++ meson_gxm_afbcd_reset(priv); ++} ++ + static int meson_gxm_afbcd_enable(struct meson_drm *priv) + { + writel_relaxed(FIELD_PREP(OSD1_AFBCD_ID_FIFO_THRD, 0x40) | +@@ -172,6 +177,7 @@ static int meson_gxm_afbcd_setup(struct meson_drm *priv) + + struct meson_afbcd_ops meson_afbcd_gxm_ops = { + .init = meson_gxm_afbcd_init, ++ .exit = meson_gxm_afbcd_exit, + .reset = meson_gxm_afbcd_reset, + .enable = meson_gxm_afbcd_enable, + .disable = meson_gxm_afbcd_disable, +@@ -269,6 +275,18 @@ static bool meson_g12a_afbcd_supported_fmt(u64 modifier, uint32_t format) + return meson_g12a_afbcd_pixel_fmt(modifier, format) >= 0; + } + ++static int meson_g12a_afbcd_reset(struct meson_drm *priv) ++{ ++ meson_rdma_reset(priv); ++ ++ meson_rdma_writel_sync(priv, VIU_SW_RESET_G12A_AFBC_ARB | ++ VIU_SW_RESET_G12A_OSD1_AFBCD, ++ VIU_SW_RESET); ++ meson_rdma_writel_sync(priv, 0, VIU_SW_RESET); ++ ++ return 0; ++} ++ + static int meson_g12a_afbcd_init(struct meson_drm *priv) + { + int ret; +@@ -286,16 +304,10 @@ static int meson_g12a_afbcd_init(struct meson_drm *priv) + return 0; + } + +-static int meson_g12a_afbcd_reset(struct meson_drm *priv) ++static void meson_g12a_afbcd_exit(struct meson_drm *priv) + { +- meson_rdma_reset(priv); +- +- meson_rdma_writel_sync(priv, VIU_SW_RESET_G12A_AFBC_ARB | +- VIU_SW_RESET_G12A_OSD1_AFBCD, +- VIU_SW_RESET); +- meson_rdma_writel_sync(priv, 0, VIU_SW_RESET); +- +- return 0; ++ meson_g12a_afbcd_reset(priv); ++ meson_rdma_free(priv); + } + + static int meson_g12a_afbcd_enable(struct meson_drm *priv) +@@ -380,6 +392,7 @@ static int meson_g12a_afbcd_setup(struct meson_drm *priv) + + struct meson_afbcd_ops meson_afbcd_g12a_ops = { + .init = meson_g12a_afbcd_init, ++ .exit = meson_g12a_afbcd_exit, + .reset = meson_g12a_afbcd_reset, + .enable = meson_g12a_afbcd_enable, + .disable = meson_g12a_afbcd_disable, +diff --git a/drivers/gpu/drm/meson/meson_osd_afbcd.h b/drivers/gpu/drm/meson/meson_osd_afbcd.h +index 5e5523304f42..e77ddeb6416f 100644 +--- a/drivers/gpu/drm/meson/meson_osd_afbcd.h ++++ b/drivers/gpu/drm/meson/meson_osd_afbcd.h +@@ -14,6 +14,7 @@ + + struct meson_afbcd_ops { + int (*init)(struct meson_drm *priv); ++ void (*exit)(struct meson_drm *priv); + int (*reset)(struct meson_drm *priv); + int (*enable)(struct meson_drm *priv); + int (*disable)(struct meson_drm *priv); +-- +2.34.1 + diff --git a/queue-5.10/drm-msm-dp-populate-connector-of-struct-dp_panel.patch b/queue-5.10/drm-msm-dp-populate-connector-of-struct-dp_panel.patch new file mode 100644 index 00000000000..78c772d9ab6 --- /dev/null +++ b/queue-5.10/drm-msm-dp-populate-connector-of-struct-dp_panel.patch @@ -0,0 +1,82 @@ +From c5602f326194525ebd523db61037e97a7bb764ac Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 10:47:26 -0800 +Subject: drm/msm/dp: populate connector of struct dp_panel + +From: Kuogee Hsieh + +[ Upstream commit 5e602f5156910c7b19661699896cb6e3fb94fab9 ] + +DP CTS test case 4.2.2.6 has valid edid with bad checksum on purpose +and expect DP source return correct checksum. During drm edid read, +correct edid checksum is calculated and stored at +connector::real_edid_checksum. + +The problem is struct dp_panel::connector never be assigned, instead the +connector is stored in struct msm_dp::connector. When we run compliance +testing test case 4.2.2.6 dp_panel_handle_sink_request() won't have a valid +edid set in struct dp_panel::edid so we'll try to use the connectors +real_edid_checksum and hit a NULL pointer dereference error because the +connector pointer is never assigned. + +Changes in V2: +-- populate panel connector at msm_dp_modeset_init() instead of at dp_panel_read_sink_caps() + +Changes in V3: +-- remove unhelpful kernel crash trace commit text +-- remove renaming dp_display parameter to dp + +Changes in V4: +-- add more details to commit text + +Changes in v10: +-- group into one series + +Changes in v11: +-- drop drm/msm/dp: dp_link_parse_sink_count() return immediately if aux read + +Fixes: 7948fe12d47 ("drm/msm/dp: return correct edid checksum after corrupted edid checksum read") +Signee-off-by: Kuogee Hsieh + +Reviewed-by: Bjorn Andersson +Reviewed-by: Stephen Boyd +Link: https://lore.kernel.org/r/1642531648-8448-3-git-send-email-quic_khsieh@quicinc.com +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/dp/dp_display.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/gpu/drm/msm/dp/dp_display.c b/drivers/gpu/drm/msm/dp/dp_display.c +index 66f2ea3d42fc..6cd6934c8c9f 100644 +--- a/drivers/gpu/drm/msm/dp/dp_display.c ++++ b/drivers/gpu/drm/msm/dp/dp_display.c +@@ -1336,6 +1336,7 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev, + struct drm_encoder *encoder) + { + struct msm_drm_private *priv; ++ struct dp_display_private *dp_priv; + int ret; + + if (WARN_ON(!encoder) || WARN_ON(!dp_display) || WARN_ON(!dev)) +@@ -1344,6 +1345,8 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev, + priv = dev->dev_private; + dp_display->drm_dev = dev; + ++ dp_priv = container_of(dp_display, struct dp_display_private, dp_display); ++ + ret = dp_display_request_irq(dp_display); + if (ret) { + DRM_ERROR("request_irq failed, ret=%d\n", ret); +@@ -1361,6 +1364,8 @@ int msm_dp_modeset_init(struct msm_dp *dp_display, struct drm_device *dev, + return ret; + } + ++ dp_priv->panel->connector = dp_display->connector; ++ + priv->connectors[priv->num_connectors++] = dp_display->connector; + return 0; + } +-- +2.34.1 + diff --git a/queue-5.10/drm-msm-dpu-add-dspp-blocks-teardown.patch b/queue-5.10/drm-msm-dpu-add-dspp-blocks-teardown.patch new file mode 100644 index 00000000000..dc75a086505 --- /dev/null +++ b/queue-5.10/drm-msm-dpu-add-dspp-blocks-teardown.patch @@ -0,0 +1,45 @@ +From 248d6aaa323341f05a447e0adb70e61506a17bda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jan 2022 00:06:14 +0300 +Subject: drm/msm/dpu: add DSPP blocks teardown + +From: Dmitry Baryshkov + +[ Upstream commit d5c5e78f217172e87d8fb2c3418dd8b58b4adfcb ] + +Add missing calls to dpu_hw_dspp_destroy() to free resources allocated +for DSPP hardware blocks. + +Fixes: e47616df008b ("drm/msm/dpu: add support for color processing blocks in dpu driver") +Signed-off-by: Dmitry Baryshkov +Reviewed-by: Stephen Boyd +Reviewed-by: Abhinav Kumar +Link: https://lore.kernel.org/r/20220121210618.3482550-3-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c +index 9b2b5044e8e0..74a13ccad34c 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_rm.c +@@ -34,6 +34,14 @@ int dpu_rm_destroy(struct dpu_rm *rm) + { + int i; + ++ for (i = 0; i < ARRAY_SIZE(rm->dspp_blks); i++) { ++ struct dpu_hw_dspp *hw; ++ ++ if (rm->dspp_blks[i]) { ++ hw = to_dpu_hw_dspp(rm->dspp_blks[i]); ++ dpu_hw_dspp_destroy(hw); ++ } ++ } + for (i = 0; i < ARRAY_SIZE(rm->pingpong_blks); i++) { + struct dpu_hw_pingpong *hw; + +-- +2.34.1 + diff --git a/queue-5.10/drm-msm-dpu-fix-dp-audio-condition.patch b/queue-5.10/drm-msm-dpu-fix-dp-audio-condition.patch new file mode 100644 index 00000000000..ed618ad68ff --- /dev/null +++ b/queue-5.10/drm-msm-dpu-fix-dp-audio-condition.patch @@ -0,0 +1,41 @@ +From 5011bb92b0309d98662c063a7c498596128e6fef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Feb 2022 06:53:52 +0300 +Subject: drm/msm/dpu: fix dp audio condition + +From: Dmitry Baryshkov + +[ Upstream commit 1e0505a5a7a2fea243f8e6d7e13fcde65f9e41bc ] + +DP audio enablement code which is comparing intf_type, +DRM_MODE_ENCODER_TMDS (= 2) with DRM_MODE_CONNECTOR_DisplayPort (= 10). +Which would never succeed. Fix it to check for DRM_MODE_ENCODER_TMDS. + +Fixes: d13e36d7d222 ("drm/msm/dp: add audio support for Display Port on MSM") +Reviewed-by: Abhinav Kumar +Reviewed-by: Bjorn Andersson +Reviewed-by: Stephen Boyd +Signed-off-by: Dmitry Baryshkov +Link: https://lore.kernel.org/r/20220217035358.465904-2-dmitry.baryshkov@linaro.org +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +index f7f5c258b553..a0274fcfe9c9 100644 +--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c ++++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_encoder.c +@@ -1113,7 +1113,7 @@ static void _dpu_encoder_virt_enable_helper(struct drm_encoder *drm_enc) + } + + +- if (dpu_enc->disp_info.intf_type == DRM_MODE_CONNECTOR_DisplayPort && ++ if (dpu_enc->disp_info.intf_type == DRM_MODE_ENCODER_TMDS && + dpu_enc->cur_master->hw_mdptop && + dpu_enc->cur_master->hw_mdptop->ops.intf_audio_select) + dpu_enc->cur_master->hw_mdptop->ops.intf_audio_select( +-- +2.34.1 + diff --git a/queue-5.10/drm-nouveau-acr-fix-undefined-behavior-in-nvkm_acr_h.patch b/queue-5.10/drm-nouveau-acr-fix-undefined-behavior-in-nvkm_acr_h.patch new file mode 100644 index 00000000000..9d0cd26caa0 --- /dev/null +++ b/queue-5.10/drm-nouveau-acr-fix-undefined-behavior-in-nvkm_acr_h.patch @@ -0,0 +1,54 @@ +From 0a114e6b4f620984c85b0ee5ab86c0e03a82f7b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 00:58:55 +0800 +Subject: drm/nouveau/acr: Fix undefined behavior in nvkm_acr_hsfw_load_bl() + +From: Zhou Qingyang + +[ Upstream commit 2343bcdb4747d4f418a4daf2e898b94f86c24a59 ] + +In nvkm_acr_hsfw_load_bl(), the return value of kmalloc() is directly +passed to memcpy(), which could lead to undefined behavior on failure +of kmalloc(). + +Fix this bug by using kmemdup() instead of kmalloc()+memcpy(). + +This bug was found by a static analyzer. + +Builds with 'make allyesconfig' show no new warnings, +and our static analyzer no longer warns about this code. + +Fixes: 22dcda45a3d1 ("drm/nouveau/acr: implement new subdev to replace "secure boot"") +Signed-off-by: Zhou Qingyang +Reviewed-by: Lyude Paul +Signed-off-by: Lyude Paul +Link: https://patchwork.freedesktop.org/patch/msgid/20220124165856.57022-1-zhou1615@umn.edu +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c +index 667fa016496e..a6ea89a5d51a 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/acr/hsfw.c +@@ -142,11 +142,12 @@ nvkm_acr_hsfw_load_bl(struct nvkm_acr *acr, const char *name, int ver, + + hsfw->imem_size = desc->code_size; + hsfw->imem_tag = desc->start_tag; +- hsfw->imem = kmalloc(desc->code_size, GFP_KERNEL); +- memcpy(hsfw->imem, data + desc->code_off, desc->code_size); +- ++ hsfw->imem = kmemdup(data + desc->code_off, desc->code_size, GFP_KERNEL); + nvkm_firmware_put(fw); +- return 0; ++ if (!hsfw->imem) ++ return -ENOMEM; ++ else ++ return 0; + } + + int +-- +2.34.1 + diff --git a/queue-5.10/drm-panfrost-check-for-error-num-after-setting-mask.patch b/queue-5.10/drm-panfrost-check-for-error-num-after-setting-mask.patch new file mode 100644 index 00000000000..212e8d79da0 --- /dev/null +++ b/queue-5.10/drm-panfrost-check-for-error-num-after-setting-mask.patch @@ -0,0 +1,45 @@ +From 29b336a03e5eb4d2bc338754e57ecf7a2efedbd6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jan 2022 11:03:26 +0800 +Subject: drm/panfrost: Check for error num after setting mask + +From: Jiasheng Jiang + +[ Upstream commit 44ab30b056149bd59dd7989a593dd25ead6007fd ] + +Because of the possible failure of the dma_supported(), the +dma_set_mask_and_coherent() may return error num. +Therefore, it should be better to check it and return the error if +fails. + +Fixes: f3ba91228e8e ("drm/panfrost: Add initial panfrost driver") +Signed-off-by: Jiasheng Jiang +[Steve: fix Fixes: line] +Reviewed-by: Steven Price +Signed-off-by: Steven Price +Link: https://patchwork.freedesktop.org/patch/msgid/20220106030326.2620942-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/panfrost/panfrost_gpu.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/panfrost/panfrost_gpu.c b/drivers/gpu/drm/panfrost/panfrost_gpu.c +index 2aae636f1cf5..107ad2d764ec 100644 +--- a/drivers/gpu/drm/panfrost/panfrost_gpu.c ++++ b/drivers/gpu/drm/panfrost/panfrost_gpu.c +@@ -359,8 +359,11 @@ int panfrost_gpu_init(struct panfrost_device *pfdev) + + panfrost_gpu_init_features(pfdev); + +- dma_set_mask_and_coherent(pfdev->dev, ++ err = dma_set_mask_and_coherent(pfdev->dev, + DMA_BIT_MASK(FIELD_GET(0xff00, pfdev->features.mmu_features))); ++ if (err) ++ return err; ++ + dma_set_max_seg_size(pfdev->dev, UINT_MAX); + + irq = platform_get_irq_byname(to_platform_device(pfdev->dev), "gpu"); +-- +2.34.1 + diff --git a/queue-5.10/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch b/queue-5.10/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch new file mode 100644 index 00000000000..c72a83e47a8 --- /dev/null +++ b/queue-5.10/drm-tegra-fix-reference-leak-in-tegra_dsi_ganged_pro.patch @@ -0,0 +1,39 @@ +From abba752811a1529cf32753fc1e8e831ad22c7793 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jan 2022 06:53:16 +0000 +Subject: drm/tegra: Fix reference leak in tegra_dsi_ganged_probe + +From: Miaoqian Lin + +[ Upstream commit 221e3638feb8bc42143833c9a704fa89b6c366bb ] + +The reference taken by 'of_find_device_by_node()' must be released when +not needed anymore. Add put_device() call to fix this. + +Fixes: e94236cde4d5 ("drm/tegra: dsi: Add ganged mode support") +Signed-off-by: Miaoqian Lin +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/tegra/dsi.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c +index f46d377f0c30..de1333dc0d86 100644 +--- a/drivers/gpu/drm/tegra/dsi.c ++++ b/drivers/gpu/drm/tegra/dsi.c +@@ -1538,8 +1538,10 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi) + dsi->slave = platform_get_drvdata(gangster); + of_node_put(np); + +- if (!dsi->slave) ++ if (!dsi->slave) { ++ put_device(&gangster->dev); + return -EPROBE_DEFER; ++ } + + dsi->slave->master = dsi; + } +-- +2.34.1 + diff --git a/queue-5.10/evm-fix-the-evm-__setup-handler-return-value.patch b/queue-5.10/evm-fix-the-evm-__setup-handler-return-value.patch new file mode 100644 index 00000000000..bf4a7e6bdf9 --- /dev/null +++ b/queue-5.10/evm-fix-the-evm-__setup-handler-return-value.patch @@ -0,0 +1,58 @@ +From 8b58d1967afef67a2a274e04ab6df0d8e4f1fa25 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 13:45:18 -0800 +Subject: EVM: fix the evm= __setup handler return value + +From: Randy Dunlap + +[ Upstream commit f2544f5e6c691679d56bb38637d2f347075b36fa ] + +__setup() handlers should return 1 if the parameter is handled. +Returning 0 causes the entire string to be added to init's +environment strings (limited to 32 strings), unnecessarily polluting it. + +Using the documented string "evm=fix" causes an Unknown parameter message: + Unknown kernel command line parameters + "BOOT_IMAGE=/boot/bzImage-517rc5 evm=fix", will be passed to user space. + +and that string is added to init's environment string space: + Run /sbin/init as init process + with arguments: + /sbin/init + with environment: + HOME=/ + TERM=linux + BOOT_IMAGE=/boot/bzImage-517rc5 + evm=fix + +With this change, using "evm=fix" acts as expected and an invalid +option ("evm=evm") causes a warning to be printed: + evm: invalid "evm" mode +but init's environment is not polluted with this string, as expected. + +Fixes: 7102ebcd65c1 ("evm: permit only valid security.evm xattrs to be updated") +Signed-off-by: Randy Dunlap +Reported-by: Igor Zhbanov +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Signed-off-by: Mimi Zohar +Signed-off-by: Sasha Levin +--- + security/integrity/evm/evm_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index b929c683aba1..0033364ac404 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -62,7 +62,7 @@ static int __init evm_set_fixmode(char *str) + else + pr_err("invalid \"%s\" mode", str); + +- return 0; ++ return 1; + } + __setup("evm=", evm_set_fixmode); + +-- +2.34.1 + diff --git a/queue-5.10/ext2-correct-max-file-size-computing.patch b/queue-5.10/ext2-correct-max-file-size-computing.patch new file mode 100644 index 00000000000..6ca6522953f --- /dev/null +++ b/queue-5.10/ext2-correct-max-file-size-computing.patch @@ -0,0 +1,58 @@ +From 50d31291012512d51b5e77f923750da2c4d55bcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Feb 2022 13:05:32 +0800 +Subject: ext2: correct max file size computing + +From: Zhang Yi + +[ Upstream commit 50b3a818991074177a56c87124c7a7bdf5fa4f67 ] + +We need to calculate the max file size accurately if the total blocks +that can address by block tree exceed the upper_limit. But this check is +not correct now, it only compute the total data blocks but missing +metadata blocks are needed. So in the case of "data blocks < upper_limit +&& total blocks > upper_limit", we will get wrong result. Fortunately, +this case could not happen in reality, but it's confused and better to +correct the computing. + + bits data blocks metadatablocks upper_limit + 10 16843020 66051 2147483647 + 11 134480396 263171 1073741823 + 12 1074791436 1050627 536870911 (*) + 13 8594130956 4198403 268435455 (*) + 14 68736258060 16785411 134217727 (*) + 15 549822930956 67125251 67108863 (*) + 16 4398314962956 268468227 33554431 (*) + + [*] Need to calculate in depth. + +Fixes: 1c2d14212b15 ("ext2: Fix underflow in ext2_max_size()") +Link: https://lore.kernel.org/r/20220212050532.179055-1-yi.zhang@huawei.com +Signed-off-by: Zhang Yi +Signed-off-by: Jan Kara +Signed-off-by: Sasha Levin +--- + fs/ext2/super.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/fs/ext2/super.c b/fs/ext2/super.c +index 09f1fe676972..b6314d3c6a87 100644 +--- a/fs/ext2/super.c ++++ b/fs/ext2/super.c +@@ -756,8 +756,12 @@ static loff_t ext2_max_size(int bits) + res += 1LL << (bits-2); + res += 1LL << (2*(bits-2)); + res += 1LL << (3*(bits-2)); ++ /* Compute how many metadata blocks are needed */ ++ meta_blocks = 1; ++ meta_blocks += 1 + ppb; ++ meta_blocks += 1 + ppb + ppb * ppb; + /* Does block tree limit file size? */ +- if (res < upper_limit) ++ if (res + meta_blocks <= upper_limit) + goto check_lfs; + + res = upper_limit; +-- +2.34.1 + diff --git a/queue-5.10/ext4-correct-cluster-len-and-clusters-changed-accoun.patch b/queue-5.10/ext4-correct-cluster-len-and-clusters-changed-accoun.patch new file mode 100644 index 00000000000..213d28f1571 --- /dev/null +++ b/queue-5.10/ext4-correct-cluster-len-and-clusters-changed-accoun.patch @@ -0,0 +1,82 @@ +From 9238de7826704d4b75687a7135967afcc03fff0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Feb 2022 12:32:43 +0530 +Subject: ext4: correct cluster len and clusters changed accounting in + ext4_mb_mark_bb + +From: Ritesh Harjani + +[ Upstream commit a5c0e2fdf7cea535ba03259894dc184e5a4c2800 ] + +ext4_mb_mark_bb() currently wrongly calculates cluster len (clen) and +flex_group->free_clusters. This patch fixes that. + +Identified based on code review of ext4_mb_mark_bb() function. + +Signed-off-by: Ritesh Harjani +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/a0b035d536bafa88110b74456853774b64c8ac40.1644992609.git.riteshh@linux.ibm.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 19 ++++++++++++------- + 1 file changed, 12 insertions(+), 7 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 110c25824a67..41a115c53bf6 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -3320,10 +3320,11 @@ void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block, + struct ext4_sb_info *sbi = EXT4_SB(sb); + ext4_group_t group; + ext4_grpblk_t blkoff; +- int i, clen, err; ++ int i, err; + int already; ++ unsigned int clen, clen_changed; + +- clen = EXT4_B2C(sbi, len); ++ clen = EXT4_NUM_B2C(sbi, len); + + ext4_get_group_no_and_offset(sb, block, &group, &blkoff); + bitmap_bh = ext4_read_block_bitmap(sb, group); +@@ -3344,6 +3345,7 @@ void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block, + if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state) + already++; + ++ clen_changed = clen - already; + if (state) + ext4_set_bits(bitmap_bh->b_data, blkoff, clen); + else +@@ -3356,9 +3358,9 @@ void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block, + group, gdp)); + } + if (state) +- clen = ext4_free_group_clusters(sb, gdp) - clen + already; ++ clen = ext4_free_group_clusters(sb, gdp) - clen_changed; + else +- clen = ext4_free_group_clusters(sb, gdp) + clen - already; ++ clen = ext4_free_group_clusters(sb, gdp) + clen_changed; + + ext4_free_group_clusters_set(sb, gdp, clen); + ext4_block_bitmap_csum_set(sb, group, gdp, bitmap_bh); +@@ -3368,10 +3370,13 @@ void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block, + + if (sbi->s_log_groups_per_flex) { + ext4_group_t flex_group = ext4_flex_group(sbi, group); ++ struct flex_groups *fg = sbi_array_rcu_deref(sbi, ++ s_flex_groups, flex_group); + +- atomic64_sub(len, +- &sbi_array_rcu_deref(sbi, s_flex_groups, +- flex_group)->free_clusters); ++ if (state) ++ atomic64_sub(clen_changed, &fg->free_clusters); ++ else ++ atomic64_add(clen_changed, &fg->free_clusters); + } + + err = ext4_handle_dirty_metadata(NULL, NULL, bitmap_bh); +-- +2.34.1 + diff --git a/queue-5.10/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch b/queue-5.10/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch new file mode 100644 index 00000000000..d67031b9da1 --- /dev/null +++ b/queue-5.10/ext4-don-t-bug-if-someone-dirty-pages-without-asking.patch @@ -0,0 +1,84 @@ +From a67d80f994c2ceca9623680a26496ba5b25f8a55 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 09:38:47 -0500 +Subject: ext4: don't BUG if someone dirty pages without asking ext4 first + +From: Theodore Ts'o + +[ Upstream commit cc5095747edfb054ca2068d01af20be3fcc3634f ] + +[un]pin_user_pages_remote is dirtying pages without properly warning +the file system in advance. A related race was noted by Jan Kara in +2018[1]; however, more recently instead of it being a very hard-to-hit +race, it could be reliably triggered by process_vm_writev(2) which was +discovered by Syzbot[2]. + +This is technically a bug in mm/gup.c, but arguably ext4 is fragile in +that if some other kernel subsystem dirty pages without properly +notifying the file system using page_mkwrite(), ext4 will BUG, while +other file systems will not BUG (although data will still be lost). + +So instead of crashing with a BUG, issue a warning (since there may be +potential data loss) and just mark the page as clean to avoid +unprivileged denial of service attacks until the problem can be +properly fixed. More discussion and background can be found in the +thread starting at [2]. + +[1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz +[2] https://lore.kernel.org/r/Yg0m6IjcNmfaSokM@google.com + +Reported-by: syzbot+d59332e2db681cf18f0318a06e994ebbb529a8db@syzkaller.appspotmail.com +Reported-by: Lee Jones +Signed-off-by: Theodore Ts'o +Link: https://lore.kernel.org/r/YiDS9wVfq4mM2jGK@mit.edu +Signed-off-by: Sasha Levin +--- + fs/ext4/inode.c | 25 +++++++++++++++++++++++++ + 1 file changed, 25 insertions(+) + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index d59474a54189..96546df39bcf 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -2023,6 +2023,15 @@ static int ext4_writepage(struct page *page, + else + len = PAGE_SIZE; + ++ /* Should never happen but for bugs in other kernel subsystems */ ++ if (!page_has_buffers(page)) { ++ ext4_warning_inode(inode, ++ "page %lu does not have buffers attached", page->index); ++ ClearPageDirty(page); ++ unlock_page(page); ++ return 0; ++ } ++ + page_bufs = page_buffers(page); + /* + * We cannot do block allocation or other extent handling in this +@@ -2626,6 +2635,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd) + wait_on_page_writeback(page); + BUG_ON(PageWriteback(page)); + ++ /* ++ * Should never happen but for buggy code in ++ * other subsystems that call ++ * set_page_dirty() without properly warning ++ * the file system first. See [1] for more ++ * information. ++ * ++ * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz ++ */ ++ if (!page_has_buffers(page)) { ++ ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index); ++ ClearPageDirty(page); ++ unlock_page(page); ++ continue; ++ } ++ + if (mpd->map.m_len == 0) + mpd->first_page = page->index; + mpd->next_page = page->index + 1; +-- +2.34.1 + diff --git a/queue-5.10/ext4-fix-ext4_mb_mark_bb-with-flex_bg-with-fast_comm.patch b/queue-5.10/ext4-fix-ext4_mb_mark_bb-with-flex_bg-with-fast_comm.patch new file mode 100644 index 00000000000..bcbbc8552fd --- /dev/null +++ b/queue-5.10/ext4-fix-ext4_mb_mark_bb-with-flex_bg-with-fast_comm.patch @@ -0,0 +1,224 @@ +From cac146409b7767e1ecde73e564a07c9835c984f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Feb 2022 12:32:44 +0530 +Subject: ext4: fix ext4_mb_mark_bb() with flex_bg with fast_commit + +From: Ritesh Harjani + +[ Upstream commit bfdc502a4a4c058bf4cbb1df0c297761d528f54d ] + +In case of flex_bg feature (which is by default enabled), extents for +any given inode might span across blocks from two different block group. +ext4_mb_mark_bb() only reads the buffer_head of block bitmap once for the +starting block group, but it fails to read it again when the extent length +boundary overflows to another block group. Then in this below loop it +accesses memory beyond the block group bitmap buffer_head and results +into a data abort. + + for (i = 0; i < clen; i++) + if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state) + already++; + +This patch adds this functionality for checking block group boundary in +ext4_mb_mark_bb() and update the buffer_head(bitmap_bh) for every different +block group. + +w/o this patch, I was easily able to hit a data access abort using Power platform. + +<...> +[ 74.327662] EXT4-fs error (device loop3): ext4_mb_generate_buddy:1141: group 11, block bitmap and bg descriptor inconsistent: 21248 vs 23294 free clusters +[ 74.533214] EXT4-fs (loop3): shut down requested (2) +[ 74.536705] Aborting journal on device loop3-8. +[ 74.702705] BUG: Unable to handle kernel data access on read at 0xc00000005e980000 +[ 74.703727] Faulting instruction address: 0xc0000000007bffb8 +cpu 0xd: Vector: 300 (Data Access) at [c000000015db7060] + pc: c0000000007bffb8: ext4_mb_mark_bb+0x198/0x5a0 + lr: c0000000007bfeec: ext4_mb_mark_bb+0xcc/0x5a0 + sp: c000000015db7300 + msr: 800000000280b033 + dar: c00000005e980000 + dsisr: 40000000 + current = 0xc000000027af6880 + paca = 0xc00000003ffd5200 irqmask: 0x03 irq_happened: 0x01 + pid = 5167, comm = mount +<...> +enter ? for help +[c000000015db7380] c000000000782708 ext4_ext_clear_bb+0x378/0x410 +[c000000015db7400] c000000000813f14 ext4_fc_replay+0x1794/0x2000 +[c000000015db7580] c000000000833f7c do_one_pass+0xe9c/0x12a0 +[c000000015db7710] c000000000834504 jbd2_journal_recover+0x184/0x2d0 +[c000000015db77c0] c000000000841398 jbd2_journal_load+0x188/0x4a0 +[c000000015db7880] c000000000804de8 ext4_fill_super+0x2638/0x3e10 +[c000000015db7a40] c0000000005f8404 get_tree_bdev+0x2b4/0x350 +[c000000015db7ae0] c0000000007ef058 ext4_get_tree+0x28/0x40 +[c000000015db7b00] c0000000005f6344 vfs_get_tree+0x44/0x100 +[c000000015db7b70] c00000000063c408 path_mount+0xdd8/0xe70 +[c000000015db7c40] c00000000063c8f0 sys_mount+0x450/0x550 +[c000000015db7d50] c000000000035770 system_call_exception+0x4a0/0x4e0 +[c000000015db7e10] c00000000000c74c system_call_common+0xec/0x250 + +Signed-off-by: Ritesh Harjani +Reviewed-by: Jan Kara +Link: https://lore.kernel.org/r/2609bc8f66fc15870616ee416a18a3d392a209c4.1644992609.git.riteshh@linux.ibm.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/mballoc.c | 131 +++++++++++++++++++++++++++------------------- + 1 file changed, 76 insertions(+), 55 deletions(-) + +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 41a115c53bf6..15223b5a3af9 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -3322,72 +3322,93 @@ void ext4_mb_mark_bb(struct super_block *sb, ext4_fsblk_t block, + ext4_grpblk_t blkoff; + int i, err; + int already; +- unsigned int clen, clen_changed; ++ unsigned int clen, clen_changed, thisgrp_len; + +- clen = EXT4_NUM_B2C(sbi, len); +- +- ext4_get_group_no_and_offset(sb, block, &group, &blkoff); +- bitmap_bh = ext4_read_block_bitmap(sb, group); +- if (IS_ERR(bitmap_bh)) { +- err = PTR_ERR(bitmap_bh); +- bitmap_bh = NULL; +- goto out_err; +- } +- +- err = -EIO; +- gdp = ext4_get_group_desc(sb, group, &gdp_bh); +- if (!gdp) +- goto out_err; ++ while (len > 0) { ++ ext4_get_group_no_and_offset(sb, block, &group, &blkoff); + +- ext4_lock_group(sb, group); +- already = 0; +- for (i = 0; i < clen; i++) +- if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == !state) +- already++; +- +- clen_changed = clen - already; +- if (state) +- ext4_set_bits(bitmap_bh->b_data, blkoff, clen); +- else +- mb_test_and_clear_bits(bitmap_bh->b_data, blkoff, clen); +- if (ext4_has_group_desc_csum(sb) && +- (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) { +- gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT); +- ext4_free_group_clusters_set(sb, gdp, +- ext4_free_clusters_after_init(sb, +- group, gdp)); +- } +- if (state) +- clen = ext4_free_group_clusters(sb, gdp) - clen_changed; +- else +- clen = ext4_free_group_clusters(sb, gdp) + clen_changed; ++ /* ++ * Check to see if we are freeing blocks across a group ++ * boundary. ++ * In case of flex_bg, this can happen that (block, len) may ++ * span across more than one group. In that case we need to ++ * get the corresponding group metadata to work with. ++ * For this we have goto again loop. ++ */ ++ thisgrp_len = min_t(unsigned int, (unsigned int)len, ++ EXT4_BLOCKS_PER_GROUP(sb) - EXT4_C2B(sbi, blkoff)); ++ clen = EXT4_NUM_B2C(sbi, thisgrp_len); + +- ext4_free_group_clusters_set(sb, gdp, clen); +- ext4_block_bitmap_csum_set(sb, group, gdp, bitmap_bh); +- ext4_group_desc_csum_set(sb, group, gdp); ++ bitmap_bh = ext4_read_block_bitmap(sb, group); ++ if (IS_ERR(bitmap_bh)) { ++ err = PTR_ERR(bitmap_bh); ++ bitmap_bh = NULL; ++ break; ++ } + +- ext4_unlock_group(sb, group); ++ err = -EIO; ++ gdp = ext4_get_group_desc(sb, group, &gdp_bh); ++ if (!gdp) ++ break; + +- if (sbi->s_log_groups_per_flex) { +- ext4_group_t flex_group = ext4_flex_group(sbi, group); +- struct flex_groups *fg = sbi_array_rcu_deref(sbi, +- s_flex_groups, flex_group); ++ ext4_lock_group(sb, group); ++ already = 0; ++ for (i = 0; i < clen; i++) ++ if (!mb_test_bit(blkoff + i, bitmap_bh->b_data) == ++ !state) ++ already++; + ++ clen_changed = clen - already; + if (state) +- atomic64_sub(clen_changed, &fg->free_clusters); ++ ext4_set_bits(bitmap_bh->b_data, blkoff, clen); + else +- atomic64_add(clen_changed, &fg->free_clusters); ++ mb_test_and_clear_bits(bitmap_bh->b_data, blkoff, clen); ++ if (ext4_has_group_desc_csum(sb) && ++ (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) { ++ gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT); ++ ext4_free_group_clusters_set(sb, gdp, ++ ext4_free_clusters_after_init(sb, group, gdp)); ++ } ++ if (state) ++ clen = ext4_free_group_clusters(sb, gdp) - clen_changed; ++ else ++ clen = ext4_free_group_clusters(sb, gdp) + clen_changed; ++ ++ ext4_free_group_clusters_set(sb, gdp, clen); ++ ext4_block_bitmap_csum_set(sb, group, gdp, bitmap_bh); ++ ext4_group_desc_csum_set(sb, group, gdp); ++ ++ ext4_unlock_group(sb, group); ++ ++ if (sbi->s_log_groups_per_flex) { ++ ext4_group_t flex_group = ext4_flex_group(sbi, group); ++ struct flex_groups *fg = sbi_array_rcu_deref(sbi, ++ s_flex_groups, flex_group); ++ ++ if (state) ++ atomic64_sub(clen_changed, &fg->free_clusters); ++ else ++ atomic64_add(clen_changed, &fg->free_clusters); ++ ++ } ++ ++ err = ext4_handle_dirty_metadata(NULL, NULL, bitmap_bh); ++ if (err) ++ break; ++ sync_dirty_buffer(bitmap_bh); ++ err = ext4_handle_dirty_metadata(NULL, NULL, gdp_bh); ++ sync_dirty_buffer(gdp_bh); ++ if (err) ++ break; ++ ++ block += thisgrp_len; ++ len -= thisgrp_len; ++ brelse(bitmap_bh); ++ BUG_ON(len < 0); + } + +- err = ext4_handle_dirty_metadata(NULL, NULL, bitmap_bh); + if (err) +- goto out_err; +- sync_dirty_buffer(bitmap_bh); +- err = ext4_handle_dirty_metadata(NULL, NULL, gdp_bh); +- sync_dirty_buffer(gdp_bh); +- +-out_err: +- brelse(bitmap_bh); ++ brelse(bitmap_bh); + } + + /* +-- +2.34.1 + diff --git a/queue-5.10/f2fs-compress-fix-to-print-raw-data-size-in-error-pa.patch b/queue-5.10/f2fs-compress-fix-to-print-raw-data-size-in-error-pa.patch new file mode 100644 index 00000000000..cd1d30838c3 --- /dev/null +++ b/queue-5.10/f2fs-compress-fix-to-print-raw-data-size-in-error-pa.patch @@ -0,0 +1,41 @@ +From cd35839a5a861e436f9cc8b6337135bf40b93ae7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 18:20:00 +0800 +Subject: f2fs: compress: fix to print raw data size in error path of lz4 + decompression + +From: Chao Yu + +[ Upstream commit d284af43f703760e261b1601378a0c13a19d5f1f ] + +In lz4_decompress_pages(), if size of decompressed data is not equal to +expected one, we should print the size rather than size of target buffer +for decompressed data, fix it. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/compress.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c +index ec542e8c46cc..1541da5ace85 100644 +--- a/fs/f2fs/compress.c ++++ b/fs/f2fs/compress.c +@@ -286,10 +286,9 @@ static int lz4_decompress_pages(struct decompress_io_ctx *dic) + } + + if (ret != PAGE_SIZE << dic->log_cluster_size) { +- printk_ratelimited("%sF2FS-fs (%s): lz4 invalid rlen:%zu, " ++ printk_ratelimited("%sF2FS-fs (%s): lz4 invalid ret:%d, " + "expected:%lu\n", KERN_ERR, +- F2FS_I_SB(dic->inode)->sb->s_id, +- dic->rlen, ++ F2FS_I_SB(dic->inode)->sb->s_id, ret, + PAGE_SIZE << dic->log_cluster_size); + return -EIO; + } +-- +2.34.1 + diff --git a/queue-5.10/f2fs-compress-remove-unneeded-read-when-rewrite-whol.patch b/queue-5.10/f2fs-compress-remove-unneeded-read-when-rewrite-whol.patch new file mode 100644 index 00000000000..b1ad98551a9 --- /dev/null +++ b/queue-5.10/f2fs-compress-remove-unneeded-read-when-rewrite-whol.patch @@ -0,0 +1,39 @@ +From 6d37efd2e7c56bfe2885dafb834530c3e69298c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Jun 2021 19:50:59 +0800 +Subject: f2fs: compress: remove unneeded read when rewrite whole cluster + +From: Fengnan Chang + +[ Upstream commit 7eab7a6968278c735b1ca6387056a408f7960265 ] + +when we overwrite the whole page in cluster, we don't need read original +data before write, because after write_end(), writepages() can help to +load left data in that cluster. + +Signed-off-by: Fengnan Chang +Signed-off-by: Chao Yu +Acked-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index d27a92a54447..04e980c58319 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -3461,6 +3461,9 @@ static int f2fs_write_begin(struct file *file, struct address_space *mapping, + + *fsdata = NULL; + ++ if (len == PAGE_SIZE) ++ goto repeat; ++ + ret = f2fs_prepare_compress_overwrite(inode, pagep, + index, fsdata); + if (ret < 0) { +-- +2.34.1 + diff --git a/queue-5.10/f2fs-fix-compressed-file-start-atomic-write-may-caus.patch b/queue-5.10/f2fs-fix-compressed-file-start-atomic-write-may-caus.patch new file mode 100644 index 00000000000..d674973d0a0 --- /dev/null +++ b/queue-5.10/f2fs-fix-compressed-file-start-atomic-write-may-caus.patch @@ -0,0 +1,79 @@ +From 9745959c3b2f5c83a5812883961791cb76da4871 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Mar 2022 09:23:04 +0800 +Subject: f2fs: fix compressed file start atomic write may cause data + corruption + +From: Fengnan Chang + +[ Upstream commit 9b56adcf525522e9ffa52471260298d91fc1d395 ] + +When compressed file has blocks, f2fs_ioc_start_atomic_write will succeed, +but compressed flag will be remained in inode. If write partial compreseed +cluster and commit atomic write will cause data corruption. + +This is the reproduction process: +Step 1: +create a compressed file ,write 64K data , call fsync(), then the blocks +are write as compressed cluster. +Step2: +iotcl(F2FS_IOC_START_ATOMIC_WRITE) --- this should be fail, but not. +write page 0 and page 3. +iotcl(F2FS_IOC_COMMIT_ATOMIC_WRITE) -- page 0 and 3 write as normal file, +Step3: +drop cache. +read page 0-4 -- Since page 0 has a valid block address, read as +non-compressed cluster, page 1 and 2 will be filled with compressed data +or zero. + +The root cause is, after commit 7eab7a696827 ("f2fs: compress: remove +unneeded read when rewrite whole cluster"), in step 2, f2fs_write_begin() +only set target page dirty, and in f2fs_commit_inmem_pages(), we will write +partial raw pages into compressed cluster, result in corrupting compressed +cluster layout. + +Fixes: 4c8ff7095bef ("f2fs: support data compression") +Fixes: 7eab7a696827 ("f2fs: compress: remove unneeded read when rewrite whole cluster") +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Fengnan Chang +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 2 +- + fs/f2fs/file.c | 5 ++++- + 2 files changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 04e980c58319..b2016fd3a7ca 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -3461,7 +3461,7 @@ static int f2fs_write_begin(struct file *file, struct address_space *mapping, + + *fsdata = NULL; + +- if (len == PAGE_SIZE) ++ if (len == PAGE_SIZE && !(f2fs_is_atomic_file(inode))) + goto repeat; + + ret = f2fs_prepare_compress_overwrite(inode, pagep, +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 1fbaab1f7aba..792f9059d897 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2035,7 +2035,10 @@ static int f2fs_ioc_start_atomic_write(struct file *filp) + + inode_lock(inode); + +- f2fs_disable_compressed_file(inode); ++ if (!f2fs_disable_compressed_file(inode)) { ++ ret = -EINVAL; ++ goto out; ++ } + + if (f2fs_is_atomic_file(inode)) { + if (is_inode_flag_set(inode, FI_ATOMIC_REVOKE_REQUEST)) +-- +2.34.1 + diff --git a/queue-5.10/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch b/queue-5.10/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch new file mode 100644 index 00000000000..d133dc491cb --- /dev/null +++ b/queue-5.10/f2fs-fix-missing-free-nid-in-f2fs_handle_failed_inod.patch @@ -0,0 +1,109 @@ +From 87b7956f2b8c13bbe8cc80f4c376c58764004f3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Feb 2022 18:56:46 -0800 +Subject: f2fs: fix missing free nid in f2fs_handle_failed_inode + +From: Jaegeuk Kim + +[ Upstream commit 2fef99b8372c1ae3d8445ab570e888b5a358dbe9 ] + +This patch fixes xfstests/generic/475 failure. + +[ 293.680694] F2FS-fs (dm-1): May loss orphan inode, run fsck to fix. +[ 293.685358] Buffer I/O error on dev dm-1, logical block 8388592, async page read +[ 293.691527] Buffer I/O error on dev dm-1, logical block 8388592, async page read +[ 293.691764] sh (7615): drop_caches: 3 +[ 293.691819] sh (7616): drop_caches: 3 +[ 293.694017] Buffer I/O error on dev dm-1, logical block 1, async page read +[ 293.695659] sh (7618): drop_caches: 3 +[ 293.696979] sh (7617): drop_caches: 3 +[ 293.700290] sh (7623): drop_caches: 3 +[ 293.708621] sh (7626): drop_caches: 3 +[ 293.711386] sh (7628): drop_caches: 3 +[ 293.711825] sh (7627): drop_caches: 3 +[ 293.716738] sh (7630): drop_caches: 3 +[ 293.719613] sh (7632): drop_caches: 3 +[ 293.720971] sh (7633): drop_caches: 3 +[ 293.727741] sh (7634): drop_caches: 3 +[ 293.730783] sh (7636): drop_caches: 3 +[ 293.732681] sh (7635): drop_caches: 3 +[ 293.732988] sh (7637): drop_caches: 3 +[ 293.738836] sh (7639): drop_caches: 3 +[ 293.740568] sh (7641): drop_caches: 3 +[ 293.743053] sh (7640): drop_caches: 3 +[ 293.821889] ------------[ cut here ]------------ +[ 293.824654] kernel BUG at fs/f2fs/node.c:3334! +[ 293.826226] invalid opcode: 0000 [#1] PREEMPT SMP PTI +[ 293.828713] CPU: 0 PID: 7653 Comm: umount Tainted: G OE 5.17.0-rc1-custom #1 +[ 293.830946] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +[ 293.832526] RIP: 0010:f2fs_destroy_node_manager+0x33f/0x350 [f2fs] +[ 293.833905] Code: e8 d6 3d f9 f9 48 8b 45 d0 65 48 2b 04 25 28 00 00 00 75 1a 48 81 c4 28 03 00 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 0f 0b +[ 293.837783] RSP: 0018:ffffb04ec31e7a20 EFLAGS: 00010202 +[ 293.839062] RAX: 0000000000000001 RBX: ffff9df947db2eb8 RCX: 0000000080aa0072 +[ 293.840666] RDX: 0000000000000000 RSI: ffffe86c0432a140 RDI: ffffffffc0b72a21 +[ 293.842261] RBP: ffffb04ec31e7d70 R08: ffff9df94ca85780 R09: 0000000080aa0072 +[ 293.843909] R10: ffff9df94ca85700 R11: ffff9df94e1ccf58 R12: ffff9df947db2e00 +[ 293.845594] R13: ffff9df947db2ed0 R14: ffff9df947db2eb8 R15: ffff9df947db2eb8 +[ 293.847855] FS: 00007f5a97379800(0000) GS:ffff9dfa77c00000(0000) knlGS:0000000000000000 +[ 293.850647] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ 293.852940] CR2: 00007f5a97528730 CR3: 000000010bc76005 CR4: 0000000000370ef0 +[ 293.854680] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +[ 293.856423] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +[ 293.858380] Call Trace: +[ 293.859302] +[ 293.860311] ? ttwu_do_wakeup+0x1c/0x170 +[ 293.861800] ? ttwu_do_activate+0x6d/0xb0 +[ 293.863057] ? _raw_spin_unlock_irqrestore+0x29/0x40 +[ 293.864411] ? try_to_wake_up+0x9d/0x5e0 +[ 293.865618] ? debug_smp_processor_id+0x17/0x20 +[ 293.866934] ? debug_smp_processor_id+0x17/0x20 +[ 293.868223] ? free_unref_page+0xbf/0x120 +[ 293.869470] ? __free_slab+0xcb/0x1c0 +[ 293.870614] ? preempt_count_add+0x7a/0xc0 +[ 293.871811] ? __slab_free+0xa0/0x2d0 +[ 293.872918] ? __wake_up_common_lock+0x8a/0xc0 +[ 293.874186] ? __slab_free+0xa0/0x2d0 +[ 293.875305] ? free_inode_nonrcu+0x20/0x20 +[ 293.876466] ? free_inode_nonrcu+0x20/0x20 +[ 293.877650] ? debug_smp_processor_id+0x17/0x20 +[ 293.878949] ? call_rcu+0x11a/0x240 +[ 293.880060] ? f2fs_destroy_stats+0x59/0x60 [f2fs] +[ 293.881437] ? kfree+0x1fe/0x230 +[ 293.882674] f2fs_put_super+0x160/0x390 [f2fs] +[ 293.883978] generic_shutdown_super+0x7a/0x120 +[ 293.885274] kill_block_super+0x27/0x50 +[ 293.886496] kill_f2fs_super+0x7f/0x100 [f2fs] +[ 293.887806] deactivate_locked_super+0x35/0xa0 +[ 293.889271] deactivate_super+0x40/0x50 +[ 293.890513] cleanup_mnt+0x139/0x190 +[ 293.891689] __cleanup_mnt+0x12/0x20 +[ 293.892850] task_work_run+0x64/0xa0 +[ 293.894035] exit_to_user_mode_prepare+0x1b7/0x1c0 +[ 293.895409] syscall_exit_to_user_mode+0x27/0x50 +[ 293.896872] do_syscall_64+0x48/0xc0 +[ 293.898090] entry_SYSCALL_64_after_hwframe+0x44/0xae +[ 293.899517] RIP: 0033:0x7f5a975cd25b + +Fixes: 7735730d39d7 ("f2fs: fix to propagate error from __get_meta_page()") +Reviewed-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/inode.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index a35fcf43ad5a..98483f50e5e9 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -848,6 +848,7 @@ void f2fs_handle_failed_inode(struct inode *inode) + err = f2fs_get_node_info(sbi, inode->i_ino, &ni); + if (err) { + set_sbi_flag(sbi, SBI_NEED_FSCK); ++ set_inode_flag(inode, FI_FREE_NID); + f2fs_warn(sbi, "May loss orphan inode, run fsck to fix."); + goto out; + } +-- +2.34.1 + diff --git a/queue-5.10/f2fs-fix-to-avoid-potential-deadlock.patch b/queue-5.10/f2fs-fix-to-avoid-potential-deadlock.patch new file mode 100644 index 00000000000..5d413bec817 --- /dev/null +++ b/queue-5.10/f2fs-fix-to-avoid-potential-deadlock.patch @@ -0,0 +1,88 @@ +From f94e2f6103f9dd7cc1280dd5c0ee73c05c018fa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 13:44:49 +0800 +Subject: f2fs: fix to avoid potential deadlock + +From: Chao Yu + +[ Upstream commit 344150999b7fc88502a65bbb147a47503eca2033 ] + +Quoted from Jing Xia's report, there is a potential deadlock may happen +between kworker and checkpoint as below: + +[T:writeback] [T:checkpoint] +- wb_writeback + - blk_start_plug +bio contains NodeA was plugged in writeback threads + - do_writepages -- sync write inodeB, inc wb_sync_req[DATA] + - f2fs_write_data_pages + - f2fs_write_single_data_page -- write last dirty page + - f2fs_do_write_data_page + - set_page_writeback -- clear page dirty flag and + PAGECACHE_TAG_DIRTY tag in radix tree + - f2fs_outplace_write_data + - f2fs_update_data_blkaddr + - f2fs_wait_on_page_writeback -- wait NodeA to writeback here + - inode_dec_dirty_pages + - writeback_sb_inodes + - writeback_single_inode + - do_writepages + - f2fs_write_data_pages -- skip writepages due to wb_sync_req[DATA] + - wbc->pages_skipped += get_dirty_pages() -- PAGECACHE_TAG_DIRTY is not set but get_dirty_pages() returns one + - requeue_inode -- requeue inode to wb->b_dirty queue due to non-zero.pages_skipped + - blk_finish_plug + +Let's try to avoid deadlock condition by forcing unplugging previous bio via +blk_finish_plug(current->plug) once we'v skipped writeback in writepages() +due to valid sbi->wb_sync_req[DATA/NODE]. + +Fixes: 687de7f1010c ("f2fs: avoid IO split due to mixed WB_SYNC_ALL and WB_SYNC_NONE") +Signed-off-by: Zhiguo Niu +Signed-off-by: Jing Xia +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/data.c | 6 +++++- + fs/f2fs/node.c | 6 +++++- + 2 files changed, 10 insertions(+), 2 deletions(-) + +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 1b11a42847c4..d27a92a54447 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -3264,8 +3264,12 @@ static int __f2fs_write_data_pages(struct address_space *mapping, + /* to avoid spliting IOs due to mixed WB_SYNC_ALL and WB_SYNC_NONE */ + if (wbc->sync_mode == WB_SYNC_ALL) + atomic_inc(&sbi->wb_sync_req[DATA]); +- else if (atomic_read(&sbi->wb_sync_req[DATA])) ++ else if (atomic_read(&sbi->wb_sync_req[DATA])) { ++ /* to avoid potential deadlock */ ++ if (current->plug) ++ blk_finish_plug(current->plug); + goto skip_write; ++ } + + if (__should_serialize_io(inode, wbc)) { + mutex_lock(&sbi->writepages); +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index 7e625806bd4a..5fa10d0b0068 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -2055,8 +2055,12 @@ static int f2fs_write_node_pages(struct address_space *mapping, + + if (wbc->sync_mode == WB_SYNC_ALL) + atomic_inc(&sbi->wb_sync_req[NODE]); +- else if (atomic_read(&sbi->wb_sync_req[NODE])) ++ else if (atomic_read(&sbi->wb_sync_req[NODE])) { ++ /* to avoid potential deadlock */ ++ if (current->plug) ++ blk_finish_plug(current->plug); + goto skip_write; ++ } + + trace_f2fs_writepages(mapping->host, wbc, NODE); + +-- +2.34.1 + diff --git a/queue-5.10/f2fs-fix-to-do-sanity-check-on-curseg-alloc_type.patch b/queue-5.10/f2fs-fix-to-do-sanity-check-on-curseg-alloc_type.patch new file mode 100644 index 00000000000..e28cae1f0eb --- /dev/null +++ b/queue-5.10/f2fs-fix-to-do-sanity-check-on-curseg-alloc_type.patch @@ -0,0 +1,86 @@ +From f705ace4909318db402a3ca30a0b178ae08ebcc4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 09:49:13 +0800 +Subject: f2fs: fix to do sanity check on curseg->alloc_type + +From: Chao Yu + +[ Upstream commit f41ee8b91c00770d718be2ff4852a80017ae9ab3 ] + +As Wenqing Liu reported in bugzilla: + +https://bugzilla.kernel.org/show_bug.cgi?id=215657 + +- Overview +UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 when mount and operate a corrupted image + +- Reproduce +tested on kernel 5.17-rc4, 5.17-rc6 + +1. mkdir test_crash +2. cd test_crash +3. unzip tmp2.zip +4. mkdir mnt +5. ./single_test.sh f2fs 2 + +- Kernel dump +[ 46.434454] loop0: detected capacity change from 0 to 131072 +[ 46.529839] F2FS-fs (loop0): Mounted with checkpoint version = 7548c2d9 +[ 46.738319] ================================================================================ +[ 46.738412] UBSAN: array-index-out-of-bounds in fs/f2fs/segment.c:3460:2 +[ 46.738475] index 231 is out of range for type 'unsigned int [2]' +[ 46.738539] CPU: 2 PID: 939 Comm: umount Not tainted 5.17.0-rc6 #1 +[ 46.738547] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.13.0-1ubuntu1.1 04/01/2014 +[ 46.738551] Call Trace: +[ 46.738556] +[ 46.738563] dump_stack_lvl+0x47/0x5c +[ 46.738581] ubsan_epilogue+0x5/0x50 +[ 46.738592] __ubsan_handle_out_of_bounds+0x68/0x80 +[ 46.738604] f2fs_allocate_data_block+0xdff/0xe60 [f2fs] +[ 46.738819] do_write_page+0xef/0x210 [f2fs] +[ 46.738934] f2fs_do_write_node_page+0x3f/0x80 [f2fs] +[ 46.739038] __write_node_page+0x2b7/0x920 [f2fs] +[ 46.739162] f2fs_sync_node_pages+0x943/0xb00 [f2fs] +[ 46.739293] f2fs_write_checkpoint+0x7bb/0x1030 [f2fs] +[ 46.739405] kill_f2fs_super+0x125/0x150 [f2fs] +[ 46.739507] deactivate_locked_super+0x60/0xc0 +[ 46.739517] deactivate_super+0x70/0xb0 +[ 46.739524] cleanup_mnt+0x11a/0x200 +[ 46.739532] __cleanup_mnt+0x16/0x20 +[ 46.739538] task_work_run+0x67/0xa0 +[ 46.739547] exit_to_user_mode_prepare+0x18c/0x1a0 +[ 46.739559] syscall_exit_to_user_mode+0x26/0x40 +[ 46.739568] do_syscall_64+0x46/0xb0 +[ 46.739584] entry_SYSCALL_64_after_hwframe+0x44/0xae + +The root cause is we missed to do sanity check on curseg->alloc_type, +result in out-of-bound accessing on sbi->block_count[] array, fix it. + +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/segment.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index d04b449978aa..49f5cb532738 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -4650,6 +4650,13 @@ static int sanity_check_curseg(struct f2fs_sb_info *sbi) + + sanity_check_seg_type(sbi, curseg->seg_type); + ++ if (curseg->alloc_type != LFS && curseg->alloc_type != SSR) { ++ f2fs_err(sbi, ++ "Current segment has invalid alloc_type:%d", ++ curseg->alloc_type); ++ return -EFSCORRUPTED; ++ } ++ + if (f2fs_test_bit(blkofs, se->cur_valid_map)) + goto out; + +-- +2.34.1 + diff --git a/queue-5.10/f2fs-fix-to-enable-atgc-correctly-via-gc_idle-sysfs-.patch b/queue-5.10/f2fs-fix-to-enable-atgc-correctly-via-gc_idle-sysfs-.patch new file mode 100644 index 00000000000..38f5232f8af --- /dev/null +++ b/queue-5.10/f2fs-fix-to-enable-atgc-correctly-via-gc_idle-sysfs-.patch @@ -0,0 +1,38 @@ +From 3a46b53c6855fc203481feb2a7a470755f78da75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 11:48:02 +0800 +Subject: f2fs: fix to enable ATGC correctly via gc_idle sysfs interface + +From: Chao Yu + +[ Upstream commit 7d19e3dab0002e527052b0aaf986e8c32e5537bf ] + +It needs to assign sbi->gc_mode with GC_IDLE_AT rather than GC_AT when +user tries to enable ATGC via gc_idle sysfs interface, fix it. + +Fixes: 093749e296e2 ("f2fs: support age threshold based garbage collection") +Cc: Zhipeng Tan +Signed-off-by: Jicheng Shao +Signed-off-by: Chao Yu +Signed-off-by: Jaegeuk Kim +Signed-off-by: Sasha Levin +--- + fs/f2fs/sysfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c +index 7ffd4bb398b0..a7e7d68256e0 100644 +--- a/fs/f2fs/sysfs.c ++++ b/fs/f2fs/sysfs.c +@@ -386,7 +386,7 @@ static ssize_t __sbi_store(struct f2fs_attr *a, + } else if (t == GC_IDLE_AT) { + if (!sbi->am.atgc_enabled) + return -EINVAL; +- sbi->gc_mode = GC_AT; ++ sbi->gc_mode = GC_IDLE_AT; + } else { + sbi->gc_mode = GC_NORMAL; + } +-- +2.34.1 + diff --git a/queue-5.10/firmware-google-properly-state-iomem-dependency.patch b/queue-5.10/firmware-google-properly-state-iomem-dependency.patch new file mode 100644 index 00000000000..3d6ea20b54b --- /dev/null +++ b/queue-5.10/firmware-google-properly-state-iomem-dependency.patch @@ -0,0 +1,58 @@ +From 9fdf0823c0f771581caebe83a1f2ff836c269729 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Feb 2022 12:15:02 +0800 +Subject: firmware: google: Properly state IOMEM dependency + +From: David Gow + +[ Upstream commit 37fd83916da2e4cae03d350015c82a67b1b334c4 ] + +The Google Coreboot implementation requires IOMEM functions +(memmremap, memunmap, devm_memremap), but does not specify this is its +Kconfig. This results in build errors when HAS_IOMEM is not set, such as +on some UML configurations: + +/usr/bin/ld: drivers/firmware/google/coreboot_table.o: in function `coreboot_table_probe': +coreboot_table.c:(.text+0x311): undefined reference to `memremap' +/usr/bin/ld: coreboot_table.c:(.text+0x34e): undefined reference to `memunmap' +/usr/bin/ld: drivers/firmware/google/memconsole-coreboot.o: in function `memconsole_probe': +memconsole-coreboot.c:(.text+0x12d): undefined reference to `memremap' +/usr/bin/ld: memconsole-coreboot.c:(.text+0x17e): undefined reference to `devm_memremap' +/usr/bin/ld: memconsole-coreboot.c:(.text+0x191): undefined reference to `memunmap' +/usr/bin/ld: drivers/firmware/google/vpd.o: in function `vpd_section_destroy.isra.0': +vpd.c:(.text+0x300): undefined reference to `memunmap' +/usr/bin/ld: drivers/firmware/google/vpd.o: in function `vpd_section_init': +vpd.c:(.text+0x382): undefined reference to `memremap' +/usr/bin/ld: vpd.c:(.text+0x459): undefined reference to `memunmap' +/usr/bin/ld: drivers/firmware/google/vpd.o: in function `vpd_probe': +vpd.c:(.text+0x59d): undefined reference to `memremap' +/usr/bin/ld: vpd.c:(.text+0x5d3): undefined reference to `memunmap' +collect2: error: ld returned 1 exit status + +Fixes: a28aad66da8b ("firmware: coreboot: Collapse platform drivers into bus core") +Acked-By: anton ivanov +Acked-By: Julius Werner +Signed-off-by: David Gow +Link: https://lore.kernel.org/r/20220225041502.1901806-1-davidgow@google.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/firmware/google/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/firmware/google/Kconfig b/drivers/firmware/google/Kconfig +index 931544c9f63d..983e07dc022e 100644 +--- a/drivers/firmware/google/Kconfig ++++ b/drivers/firmware/google/Kconfig +@@ -21,7 +21,7 @@ config GOOGLE_SMI + + config GOOGLE_COREBOOT_TABLE + tristate "Coreboot Table Access" +- depends on ACPI || OF ++ depends on HAS_IOMEM && (ACPI || OF) + help + This option enables the coreboot_table module, which provides other + firmware modules access to the coreboot table. The coreboot table +-- +2.34.1 + diff --git a/queue-5.10/firmware-qcom-scm-remove-reassignment-to-desc-follow.patch b/queue-5.10/firmware-qcom-scm-remove-reassignment-to-desc-follow.patch new file mode 100644 index 00000000000..8485d0bdaf4 --- /dev/null +++ b/queue-5.10/firmware-qcom-scm-remove-reassignment-to-desc-follow.patch @@ -0,0 +1,47 @@ +From adac6d14f1f9c1eb1473f7439bd141e9e01d7921 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Dec 2021 09:34:21 +0100 +Subject: firmware: qcom: scm: Remove reassignment to desc following + initializer + +From: Marijn Suijten + +[ Upstream commit 7823e5aa5d1dd9ed5849923c165eb8f29ad23c54 ] + +Member assignments to qcom_scm_desc were moved into struct initializers +in 57d3b816718c ("firmware: qcom_scm: Remove thin wrappers") including +the case in qcom_scm_iommu_secure_ptbl_init, except that the - now +duplicate - assignment to desc was left in place. While not harmful, +remove this unnecessary extra reassignment. + +Fixes: 57d3b816718c ("firmware: qcom_scm: Remove thin wrappers") +Signed-off-by: Marijn Suijten +Reviewed-by: AngeloGioacchino Del Regno +Reviewed-by: Alex Elder +Signed-off-by: Bjorn Andersson +Link: https://lore.kernel.org/r/20211208083423.22037-2-marijn.suijten@somainline.org +Signed-off-by: Sasha Levin +--- + drivers/firmware/qcom_scm.c | 6 ------ + 1 file changed, 6 deletions(-) + +diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c +index e10a99860ca4..d417199f8fe9 100644 +--- a/drivers/firmware/qcom_scm.c ++++ b/drivers/firmware/qcom_scm.c +@@ -749,12 +749,6 @@ int qcom_scm_iommu_secure_ptbl_init(u64 addr, u32 size, u32 spare) + }; + int ret; + +- desc.args[0] = addr; +- desc.args[1] = size; +- desc.args[2] = spare; +- desc.arginfo = QCOM_SCM_ARGS(3, QCOM_SCM_RW, QCOM_SCM_VAL, +- QCOM_SCM_VAL); +- + ret = qcom_scm_call(__scm->dev, &desc, NULL); + + /* the pg table has been initialized already, ignore the error */ +-- +2.34.1 + diff --git a/queue-5.10/firmware-ti_sci-fix-compilation-failure-when-config_.patch b/queue-5.10/firmware-ti_sci-fix-compilation-failure-when-config_.patch new file mode 100644 index 00000000000..10b57c4ce04 --- /dev/null +++ b/queue-5.10/firmware-ti_sci-fix-compilation-failure-when-config_.patch @@ -0,0 +1,37 @@ +From a249355c1a232602379f2023631b4be22a7b0815 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Dec 2021 17:23:00 +0100 +Subject: firmware: ti_sci: Fix compilation failure when CONFIG_TI_SCI_PROTOCOL + is not defined + +From: Christophe JAILLET + +[ Upstream commit 043cfff99a18933fda2fb2e163daee73cc07910b ] + +Remove an extra ";" which breaks compilation. + +Fixes: 53bf2b0e4e4c ("firmware: ti_sci: Add support for getting resource with subtype") +Signed-off-by: Christophe JAILLET +Signed-off-by: Nishanth Menon +Link: https://lore.kernel.org/r/e6c3cb793e1a6a2a0ae2528d5a5650dfe6a4b6ff.1640276505.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + include/linux/soc/ti/ti_sci_protocol.h | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/include/linux/soc/ti/ti_sci_protocol.h b/include/linux/soc/ti/ti_sci_protocol.h +index cf27b080e148..b1af87330f86 100644 +--- a/include/linux/soc/ti/ti_sci_protocol.h ++++ b/include/linux/soc/ti/ti_sci_protocol.h +@@ -618,7 +618,7 @@ devm_ti_sci_get_of_resource(const struct ti_sci_handle *handle, + + static inline struct ti_sci_resource * + devm_ti_sci_get_resource(const struct ti_sci_handle *handle, struct device *dev, +- u32 dev_id, u32 sub_type); ++ u32 dev_id, u32 sub_type) + { + return ERR_PTR(-EINVAL); + } +-- +2.34.1 + diff --git a/queue-5.10/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch b/queue-5.10/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch new file mode 100644 index 00000000000..996590bf514 --- /dev/null +++ b/queue-5.10/fix-incorrect-type-in-assignment-of-ipv6-port-for-au.patch @@ -0,0 +1,35 @@ +From daebf018aa1700a62cbfbb1ebfa657f0102daaeb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 15:45:32 -0800 +Subject: Fix incorrect type in assignment of ipv6 port for audit + +From: Casey Schaufler + +[ Upstream commit a5cd1ab7ab679d252a6d2f483eee7d45ebf2040c ] + +Remove inappropriate use of ntohs() and assign the +port value directly. + +Reported-by: kernel test robot +Signed-off-by: Casey Schaufler +Signed-off-by: Sasha Levin +--- + security/smack/smack_lsm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 5c90b9fa4d40..b36b8668f1f4 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2506,7 +2506,7 @@ static int smk_ipv6_check(struct smack_known *subject, + #ifdef CONFIG_AUDIT + smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); + ad.a.u.net->family = PF_INET6; +- ad.a.u.net->dport = ntohs(address->sin6_port); ++ ad.a.u.net->dport = address->sin6_port; + if (act == SMK_RECEIVING) + ad.a.u.net->v6info.saddr = address->sin6_addr; + else +-- +2.34.1 + diff --git a/queue-5.10/fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch b/queue-5.10/fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch new file mode 100644 index 00000000000..e8b1964aa1c --- /dev/null +++ b/queue-5.10/fs-binfmt_elf-fix-at_phdr-for-unusual-elf-files.patch @@ -0,0 +1,119 @@ +From ad9c60e967697833d946b5910a7585c2faaca690 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 21:40:16 +0900 +Subject: fs/binfmt_elf: Fix AT_PHDR for unusual ELF files + +From: Akira Kawata + +[ Upstream commit 0da1d5002745cdc721bc018b582a8a9704d56c42 ] + +BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=197921 + +As pointed out in the discussion of buglink, we cannot calculate AT_PHDR +as the sum of load_addr and exec->e_phoff. + +: The AT_PHDR of ELF auxiliary vectors should point to the memory address +: of program header. But binfmt_elf.c calculates this address as follows: +: +: NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); +: +: which is wrong since e_phoff is the file offset of program header and +: load_addr is the memory base address from PT_LOAD entry. +: +: The ld.so uses AT_PHDR as the memory address of program header. In normal +: case, since the e_phoff is usually 64 and in the first PT_LOAD region, it +: is the correct program header address. +: +: But if the address of program header isn't equal to the first PT_LOAD +: address + e_phoff (e.g. Put the program header in other non-consecutive +: PT_LOAD region), ld.so will try to read program header from wrong address +: then crash or use incorrect program header. + +This is because exec->e_phoff +is the offset of PHDRs in the file and the address of PHDRs in the +memory may differ from it. This patch fixes the bug by calculating the +address of program headers from PT_LOADs directly. + +Signed-off-by: Akira Kawata +Reported-by: kernel test robot +Acked-by: Kees Cook +Signed-off-by: Kees Cook +Link: https://lore.kernel.org/r/20220127124014.338760-2-akirakawata1@gmail.com +Signed-off-by: Sasha Levin +--- + fs/binfmt_elf.c | 24 ++++++++++++++++++------ + 1 file changed, 18 insertions(+), 6 deletions(-) + +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 04c4aa7a1df2..ed507d27034b 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -170,8 +170,8 @@ static int padzero(unsigned long elf_bss) + + static int + create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, +- unsigned long load_addr, unsigned long interp_load_addr, +- unsigned long e_entry) ++ unsigned long interp_load_addr, ++ unsigned long e_entry, unsigned long phdr_addr) + { + struct mm_struct *mm = current->mm; + unsigned long p = bprm->p; +@@ -256,7 +256,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, + NEW_AUX_ENT(AT_HWCAP, ELF_HWCAP); + NEW_AUX_ENT(AT_PAGESZ, ELF_EXEC_PAGESIZE); + NEW_AUX_ENT(AT_CLKTCK, CLOCKS_PER_SEC); +- NEW_AUX_ENT(AT_PHDR, load_addr + exec->e_phoff); ++ NEW_AUX_ENT(AT_PHDR, phdr_addr); + NEW_AUX_ENT(AT_PHENT, sizeof(struct elf_phdr)); + NEW_AUX_ENT(AT_PHNUM, exec->e_phnum); + NEW_AUX_ENT(AT_BASE, interp_load_addr); +@@ -820,7 +820,7 @@ static int parse_elf_properties(struct file *f, const struct elf_phdr *phdr, + static int load_elf_binary(struct linux_binprm *bprm) + { + struct file *interpreter = NULL; /* to shut gcc up */ +- unsigned long load_addr = 0, load_bias = 0; ++ unsigned long load_addr, load_bias = 0, phdr_addr = 0; + int load_addr_set = 0; + unsigned long error; + struct elf_phdr *elf_ppnt, *elf_phdata, *interp_elf_phdata = NULL; +@@ -1153,6 +1153,17 @@ static int load_elf_binary(struct linux_binprm *bprm) + reloc_func_desc = load_bias; + } + } ++ ++ /* ++ * Figure out which segment in the file contains the Program ++ * Header table, and map to the associated memory address. ++ */ ++ if (elf_ppnt->p_offset <= elf_ex->e_phoff && ++ elf_ex->e_phoff < elf_ppnt->p_offset + elf_ppnt->p_filesz) { ++ phdr_addr = elf_ex->e_phoff - elf_ppnt->p_offset + ++ elf_ppnt->p_vaddr; ++ } ++ + k = elf_ppnt->p_vaddr; + if ((elf_ppnt->p_flags & PF_X) && k < start_code) + start_code = k; +@@ -1188,6 +1199,7 @@ static int load_elf_binary(struct linux_binprm *bprm) + } + + e_entry = elf_ex->e_entry + load_bias; ++ phdr_addr += load_bias; + elf_bss += load_bias; + elf_brk += load_bias; + start_code += load_bias; +@@ -1251,8 +1263,8 @@ static int load_elf_binary(struct linux_binprm *bprm) + goto out; + #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */ + +- retval = create_elf_tables(bprm, elf_ex, +- load_addr, interp_load_addr, e_entry); ++ retval = create_elf_tables(bprm, elf_ex, interp_load_addr, ++ e_entry, phdr_addr); + if (retval < 0) + goto out; + +-- +2.34.1 + diff --git a/queue-5.10/fs-fd-tables-have-to-be-multiples-of-bits_per_long.patch b/queue-5.10/fs-fd-tables-have-to-be-multiples-of-bits_per_long.patch new file mode 100644 index 00000000000..dce2c353981 --- /dev/null +++ b/queue-5.10/fs-fd-tables-have-to-be-multiples-of-bits_per_long.patch @@ -0,0 +1,128 @@ +From 10ceec562efce60fb9825c7565c57889a69c25eb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Mar 2022 15:06:39 -0700 +Subject: fs: fd tables have to be multiples of BITS_PER_LONG + +From: Linus Torvalds + +[ Upstream commit 1c24a186398f59c80adb9a967486b65c1423a59d ] + +This has always been the rule: fdtables have several bitmaps in them, +and as a result they have to be sized properly for bitmaps. We walk +those bitmaps in chunks of 'unsigned long' in serveral cases, but even +when we don't, we use the regular kernel bitops that are defined to work +on arrays of 'unsigned long', not on some byte array. + +Now, the distinction between arrays of bytes and 'unsigned long' +normally only really ends up being noticeable on big-endian systems, but +Fedor Pchelkin and Alexey Khoroshilov reported that copy_fd_bitmaps() +could be called with an argument that wasn't even a multiple of +BITS_PER_BYTE. And then it fails to do the proper copy even on +little-endian machines. + +The bug wasn't in copy_fd_bitmap(), but in sane_fdtable_size(), which +didn't actually sanitize the fdtable size sufficiently, and never made +sure it had the proper BITS_PER_LONG alignment. + +That's partly because the alignment historically came not from having to +explicitly align things, but simply from previous fdtable sizes, and +from count_open_files(), which counts the file descriptors by walking +them one 'unsigned long' word at a time and thus naturally ends up doing +sizing in the proper 'chunks of unsigned long'. + +But with the introduction of close_range(), we now have an external +source of "this is how many files we want to have", and so +sane_fdtable_size() needs to do a better job. + +This also adds that explicit alignment to alloc_fdtable(), although +there it is mainly just for documentation at a source code level. The +arithmetic we do there to pick a reasonable fdtable size already aligns +the result sufficiently. + +In fact,clang notices that the added ALIGN() in that function doesn't +actually do anything, and does not generate any extra code for it. + +It turns out that gcc ends up confusing itself by combining a previous +constant-sized shift operation with the variable-sized shift operations +in roundup_pow_of_two(). And probably due to that doesn't notice that +the ALIGN() is a no-op. But that's a (tiny) gcc misfeature that doesn't +matter. Having the explicit alignment makes sense, and would actually +matter on a 128-bit architecture if we ever go there. + +This also adds big comments above both functions about how fdtable sizes +have to have that BITS_PER_LONG alignment. + +Fixes: 60997c3d45d9 ("close_range: add CLOSE_RANGE_UNSHARE") +Reported-by: Fedor Pchelkin +Reported-by: Alexey Khoroshilov +Link: https://lore.kernel.org/all/20220326114009.1690-1-aissur0002@gmail.com/ +Tested-and-acked-by: Christian Brauner +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/file.c | 30 ++++++++++++++++++++++++++++++ + 1 file changed, 30 insertions(+) + +diff --git a/fs/file.c b/fs/file.c +index 79a76d04c7c3..a47a1edb9404 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -85,6 +85,21 @@ static void copy_fdtable(struct fdtable *nfdt, struct fdtable *ofdt) + copy_fd_bitmaps(nfdt, ofdt, ofdt->max_fds); + } + ++/* ++ * Note how the fdtable bitmap allocations very much have to be a multiple of ++ * BITS_PER_LONG. This is not only because we walk those things in chunks of ++ * 'unsigned long' in some places, but simply because that is how the Linux ++ * kernel bitmaps are defined to work: they are not "bits in an array of bytes", ++ * they are very much "bits in an array of unsigned long". ++ * ++ * The ALIGN(nr, BITS_PER_LONG) here is for clarity: since we just multiplied ++ * by that "1024/sizeof(ptr)" before, we already know there are sufficient ++ * clear low bits. Clang seems to realize that, gcc ends up being confused. ++ * ++ * On a 128-bit machine, the ALIGN() would actually matter. In the meantime, ++ * let's consider it documentation (and maybe a test-case for gcc to improve ++ * its code generation ;) ++ */ + static struct fdtable * alloc_fdtable(unsigned int nr) + { + struct fdtable *fdt; +@@ -100,6 +115,7 @@ static struct fdtable * alloc_fdtable(unsigned int nr) + nr /= (1024 / sizeof(struct file *)); + nr = roundup_pow_of_two(nr + 1); + nr *= (1024 / sizeof(struct file *)); ++ nr = ALIGN(nr, BITS_PER_LONG); + /* + * Note that this can drive nr *below* what we had passed if sysctl_nr_open + * had been set lower between the check in expand_files() and here. Deal +@@ -267,11 +283,25 @@ static unsigned int count_open_files(struct fdtable *fdt) + return i; + } + ++/* ++ * Note that a sane fdtable size always has to be a multiple of ++ * BITS_PER_LONG, since we have bitmaps that are sized by this. ++ * ++ * 'max_fds' will normally already be properly aligned, but it ++ * turns out that in the close_range() -> __close_range() -> ++ * unshare_fd() -> dup_fd() -> sane_fdtable_size() we can end ++ * up having a 'max_fds' value that isn't already aligned. ++ * ++ * Rather than make close_range() have to worry about this, ++ * just make that BITS_PER_LONG alignment be part of a sane ++ * fdtable size. Becuase that's really what it is. ++ */ + static unsigned int sane_fdtable_size(struct fdtable *fdt, unsigned int max_fds) + { + unsigned int count; + + count = count_open_files(fdt); ++ max_fds = ALIGN(max_fds, BITS_PER_LONG); + if (max_fds < NR_OPEN_DEFAULT) + max_fds = NR_OPEN_DEFAULT; + return min(count, max_fds); +-- +2.34.1 + diff --git a/queue-5.10/fs-fix-fd-table-size-alignment-properly.patch b/queue-5.10/fs-fix-fd-table-size-alignment-properly.patch new file mode 100644 index 00000000000..de854742219 --- /dev/null +++ b/queue-5.10/fs-fix-fd-table-size-alignment-properly.patch @@ -0,0 +1,55 @@ +From b56492041d76c398d883cd130cdb705d9e4d73fb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 29 Mar 2022 23:29:18 -0700 +Subject: fs: fix fd table size alignment properly + +From: Linus Torvalds + +[ Upstream commit d888c83fcec75194a8a48ccd283953bdba7b2550 ] + +Jason Donenfeld reports that my commit 1c24a186398f ("fs: fd tables have +to be multiples of BITS_PER_LONG") doesn't work, and the reason is an +embarrassing brown-paper-bag bug. + +Yes, we want to align the number of fds to BITS_PER_LONG, and yes, the +reason they might not be aligned is because the incoming 'max_fd' +argument might not be aligned. + +But aligining the argument - while simple - will cause a "infinitely +big" maxfd (eg NR_OPEN_MAX) to just overflow to zero. Which most +definitely isn't what we want either. + +The obvious fix was always just to do the alignment last, but I had +moved it earlier just to make the patch smaller and the code look +simpler. Duh. It certainly made _me_ look simple. + +Fixes: 1c24a186398f ("fs: fd tables have to be multiples of BITS_PER_LONG") +Reported-and-tested-by: Jason A. Donenfeld +Cc: Fedor Pchelkin +Cc: Alexey Khoroshilov +Cc: Christian Brauner +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/file.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/fs/file.c b/fs/file.c +index a47a1edb9404..8431dfde036c 100644 +--- a/fs/file.c ++++ b/fs/file.c +@@ -301,10 +301,9 @@ static unsigned int sane_fdtable_size(struct fdtable *fdt, unsigned int max_fds) + unsigned int count; + + count = count_open_files(fdt); +- max_fds = ALIGN(max_fds, BITS_PER_LONG); + if (max_fds < NR_OPEN_DEFAULT) + max_fds = NR_OPEN_DEFAULT; +- return min(count, max_fds); ++ return ALIGN(min(count, max_fds), BITS_PER_LONG); + } + + /* +-- +2.34.1 + diff --git a/queue-5.10/fsi-aspeed-convert-to-devm_platform_ioremap_resource.patch b/queue-5.10/fsi-aspeed-convert-to-devm_platform_ioremap_resource.patch new file mode 100644 index 00000000000..cab22b10067 --- /dev/null +++ b/queue-5.10/fsi-aspeed-convert-to-devm_platform_ioremap_resource.patch @@ -0,0 +1,45 @@ +From 9d1528b593d647587393d187c7452f27b48d01ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 28 Dec 2019 19:06:31 +0000 +Subject: fsi: aspeed: convert to devm_platform_ioremap_resource + +From: Yangtao Li + +[ Upstream commit a3469912f4caeea32ecbe0bf472b14634fecb38e ] + +Use devm_platform_ioremap_resource() to simplify code. + +Signed-off-by: Yangtao Li +Reviewed-by: Andrew Jeffery +Link: https://lore.kernel.org/r/20191228190631.26777-1-tiny.windzz@gmail.com +Signed-off-by: Joel Stanley +Signed-off-by: Sasha Levin +--- + drivers/fsi/fsi-master-aspeed.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c +index dbad73162c83..5d2469d44607 100644 +--- a/drivers/fsi/fsi-master-aspeed.c ++++ b/drivers/fsi/fsi-master-aspeed.c +@@ -525,7 +525,6 @@ static int tacoma_cabled_fsi_fixup(struct device *dev) + static int fsi_master_aspeed_probe(struct platform_device *pdev) + { + struct fsi_master_aspeed *aspeed; +- struct resource *res; + int rc, links, reg; + __be32 raw; + +@@ -541,8 +540,7 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev) + + aspeed->dev = &pdev->dev; + +- res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- aspeed->base = devm_ioremap_resource(&pdev->dev, res); ++ aspeed->base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(aspeed->base)) + return PTR_ERR(aspeed->base); + +-- +2.34.1 + diff --git a/queue-5.10/fsi-aspeed-fix-a-potential-double-free.patch b/queue-5.10/fsi-aspeed-fix-a-potential-double-free.patch new file mode 100644 index 00000000000..29eeb1b6843 --- /dev/null +++ b/queue-5.10/fsi-aspeed-fix-a-potential-double-free.patch @@ -0,0 +1,95 @@ +From 1b1c5d3470f75799c549584ee4a93567c4fe54fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Jan 2022 22:56:10 +0100 +Subject: fsi: Aspeed: Fix a potential double free + +From: Christophe JAILLET + +[ Upstream commit 83ba7e895debc529803a7a258653f2fe9bf3bf40 ] + +A struct device can never be devm_alloc()'ed. +Here, it is embedded in "struct fsi_master", and "struct fsi_master" is +embedded in "struct fsi_master_aspeed". + +Since "struct device" is embedded, the data structure embedding it must be +released with the release function, as is already done here. + +So use kzalloc() instead of devm_kzalloc() when allocating "aspeed" and +update all error handling branches accordingly. + +This prevent a potential double free(). + +This also fix another issue if opb_readl() fails. Instead of a direct +return, it now jumps in the error handling path. + +Fixes: 606397d67f41 ("fsi: Add ast2600 master driver") +Suggested-by: Greg KH +Suggested-by: Guenter Roeck +Reviewed-by: Guenter Roeck +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/2c123f8b0a40dc1a061fae982169fe030b4f47e6.1641765339.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/fsi/fsi-master-aspeed.c | 17 +++++++++++------ + 1 file changed, 11 insertions(+), 6 deletions(-) + +diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c +index 5d2469d44607..87edc77260d2 100644 +--- a/drivers/fsi/fsi-master-aspeed.c ++++ b/drivers/fsi/fsi-master-aspeed.c +@@ -534,25 +534,28 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev) + return rc; + } + +- aspeed = devm_kzalloc(&pdev->dev, sizeof(*aspeed), GFP_KERNEL); ++ aspeed = kzalloc(sizeof(*aspeed), GFP_KERNEL); + if (!aspeed) + return -ENOMEM; + + aspeed->dev = &pdev->dev; + + aspeed->base = devm_platform_ioremap_resource(pdev, 0); +- if (IS_ERR(aspeed->base)) +- return PTR_ERR(aspeed->base); ++ if (IS_ERR(aspeed->base)) { ++ rc = PTR_ERR(aspeed->base); ++ goto err_free_aspeed; ++ } + + aspeed->clk = devm_clk_get(aspeed->dev, NULL); + if (IS_ERR(aspeed->clk)) { + dev_err(aspeed->dev, "couldn't get clock\n"); +- return PTR_ERR(aspeed->clk); ++ rc = PTR_ERR(aspeed->clk); ++ goto err_free_aspeed; + } + rc = clk_prepare_enable(aspeed->clk); + if (rc) { + dev_err(aspeed->dev, "couldn't enable clock\n"); +- return rc; ++ goto err_free_aspeed; + } + + rc = setup_cfam_reset(aspeed); +@@ -587,7 +590,7 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev) + rc = opb_readl(aspeed, ctrl_base + FSI_MVER, &raw); + if (rc) { + dev_err(&pdev->dev, "failed to read hub version\n"); +- return rc; ++ goto err_release; + } + + reg = be32_to_cpu(raw); +@@ -626,6 +629,8 @@ static int fsi_master_aspeed_probe(struct platform_device *pdev) + + err_release: + clk_disable_unprepare(aspeed->clk); ++err_free_aspeed: ++ kfree(aspeed); + return rc; + } + +-- +2.34.1 + diff --git a/queue-5.10/gcc-plugins-stackleak-exactly-match-strings-instead-.patch b/queue-5.10/gcc-plugins-stackleak-exactly-match-strings-instead-.patch new file mode 100644 index 00000000000..a6a195cd49d --- /dev/null +++ b/queue-5.10/gcc-plugins-stackleak-exactly-match-strings-instead-.patch @@ -0,0 +1,70 @@ +From fe48e02c0cac87c9c211006856e23363b816fa4b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Feb 2022 09:08:20 -0800 +Subject: gcc-plugins/stackleak: Exactly match strings instead of prefixes + +From: Kees Cook + +[ Upstream commit 27e9faf415dbf94af19b9c827842435edbc1fbbc ] + +Since STRING_CST may not be NUL terminated, strncmp() was used for check +for equality. However, this may lead to mismatches for longer section +names where the start matches the tested-for string. Test for exact +equality by checking for the presences of NUL termination. + +Cc: Alexander Popov +Signed-off-by: Kees Cook +Signed-off-by: Sasha Levin +--- + scripts/gcc-plugins/stackleak_plugin.c | 25 +++++++++++++++++++++---- + 1 file changed, 21 insertions(+), 4 deletions(-) + +diff --git a/scripts/gcc-plugins/stackleak_plugin.c b/scripts/gcc-plugins/stackleak_plugin.c +index 48e141e07956..dacd697ffd38 100644 +--- a/scripts/gcc-plugins/stackleak_plugin.c ++++ b/scripts/gcc-plugins/stackleak_plugin.c +@@ -431,6 +431,23 @@ static unsigned int stackleak_cleanup_execute(void) + return 0; + } + ++/* ++ * STRING_CST may or may not be NUL terminated: ++ * https://gcc.gnu.org/onlinedocs/gccint/Constant-expressions.html ++ */ ++static inline bool string_equal(tree node, const char *string, int length) ++{ ++ if (TREE_STRING_LENGTH(node) < length) ++ return false; ++ if (TREE_STRING_LENGTH(node) > length + 1) ++ return false; ++ if (TREE_STRING_LENGTH(node) == length + 1 && ++ TREE_STRING_POINTER(node)[length] != '\0') ++ return false; ++ return !memcmp(TREE_STRING_POINTER(node), string, length); ++} ++#define STRING_EQUAL(node, str) string_equal(node, str, strlen(str)) ++ + static bool stackleak_gate(void) + { + tree section; +@@ -440,13 +457,13 @@ static bool stackleak_gate(void) + if (section && TREE_VALUE(section)) { + section = TREE_VALUE(TREE_VALUE(section)); + +- if (!strncmp(TREE_STRING_POINTER(section), ".init.text", 10)) ++ if (STRING_EQUAL(section, ".init.text")) + return false; +- if (!strncmp(TREE_STRING_POINTER(section), ".devinit.text", 13)) ++ if (STRING_EQUAL(section, ".devinit.text")) + return false; +- if (!strncmp(TREE_STRING_POINTER(section), ".cpuinit.text", 13)) ++ if (STRING_EQUAL(section, ".cpuinit.text")) + return false; +- if (!strncmp(TREE_STRING_POINTER(section), ".meminit.text", 13)) ++ if (STRING_EQUAL(section, ".meminit.text")) + return false; + } + +-- +2.34.1 + diff --git a/queue-5.10/gpu-host1x-fix-a-memory-leak-in-host1x_remove.patch b/queue-5.10/gpu-host1x-fix-a-memory-leak-in-host1x_remove.patch new file mode 100644 index 00000000000..f3176633941 --- /dev/null +++ b/queue-5.10/gpu-host1x-fix-a-memory-leak-in-host1x_remove.patch @@ -0,0 +1,35 @@ +From 116e80ca336e6eaa04c17ccd3e2afeaca3989a15 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 Nov 2021 22:16:36 +0100 +Subject: gpu: host1x: Fix a memory leak in 'host1x_remove()' + +From: Christophe JAILLET + +[ Upstream commit 025c6643a81564f066d8381b9e2f4603e0f8438f ] + +Add a missing 'host1x_channel_list_free()' call in the remove function, +as already done in the error handling path of the probe function. + +Fixes: 8474b02531c4 ("gpu: host1x: Refactor channel allocation code") +Signed-off-by: Christophe JAILLET +Signed-off-by: Thierry Reding +Signed-off-by: Sasha Levin +--- + drivers/gpu/host1x/dev.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c +index a2c09dca4eef..8659558b518d 100644 +--- a/drivers/gpu/host1x/dev.c ++++ b/drivers/gpu/host1x/dev.c +@@ -520,6 +520,7 @@ static int host1x_remove(struct platform_device *pdev) + host1x_syncpt_deinit(host); + reset_control_assert(host->rst); + clk_disable_unprepare(host->clk); ++ host1x_channel_list_free(&host->channel_list); + host1x_iommu_exit(host); + + return 0; +-- +2.34.1 + diff --git a/queue-5.10/habanalabs-add-check-for-pci_enable_device.patch b/queue-5.10/habanalabs-add-check-for-pci_enable_device.patch new file mode 100644 index 00000000000..b1d67644413 --- /dev/null +++ b/queue-5.10/habanalabs-add-check-for-pci_enable_device.patch @@ -0,0 +1,38 @@ +From b03d7a6389d7d25565a447a804a2aece53ae193a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 14:58:05 +0800 +Subject: habanalabs: Add check for pci_enable_device + +From: Jiasheng Jiang + +[ Upstream commit 9c27896ac1bb83ea5c461ce6f7089d02102a2b21 ] + +As the potential failure of the pci_enable_device(), +it should be better to check the return value and return +error if fails. + +Fixes: 70b2f993ea4a ("habanalabs: create common folder") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Oded Gabbay +Signed-off-by: Oded Gabbay +Signed-off-by: Sasha Levin +--- + drivers/misc/habanalabs/common/debugfs.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/misc/habanalabs/common/debugfs.c b/drivers/misc/habanalabs/common/debugfs.c +index 912ddfa360b1..9716b0728b30 100644 +--- a/drivers/misc/habanalabs/common/debugfs.c ++++ b/drivers/misc/habanalabs/common/debugfs.c +@@ -859,6 +859,8 @@ static ssize_t hl_set_power_state(struct file *f, const char __user *buf, + pci_set_power_state(hdev->pdev, PCI_D0); + pci_restore_state(hdev->pdev); + rc = pci_enable_device(hdev->pdev); ++ if (rc < 0) ++ return rc; + } else if (value == 2) { + pci_save_state(hdev->pdev); + pci_disable_device(hdev->pdev); +-- +2.34.1 + diff --git a/queue-5.10/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch b/queue-5.10/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch new file mode 100644 index 00000000000..b5cdae553b7 --- /dev/null +++ b/queue-5.10/hid-i2c-hid-fix-get-set_report-for-unnumbered-report.patch @@ -0,0 +1,91 @@ +From c437a392833201df93aa00a234a45e23a248c259 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Jan 2022 23:26:18 -0800 +Subject: HID: i2c-hid: fix GET/SET_REPORT for unnumbered reports + +From: Dmitry Torokhov + +[ Upstream commit a5e5e03e94764148a01757b2fa4737d3445c13a6 ] + +Internally kernel prepends all report buffers, for both numbered and +unnumbered reports, with report ID, therefore to properly handle unnumbered +reports we should prepend it ourselves. + +For the same reason we should skip the first byte of the buffer when +calling i2c_hid_set_or_send_report() which then will take care of properly +formatting the transfer buffer based on its separate report ID argument +along with report payload. + +[jkosina@suse.cz: finalize trimmed sentence in changelog as spotted by Benjamin] +Fixes: 9b5a9ae88573 ("HID: i2c-hid: implement ll_driver transport-layer callbacks") +Signed-off-by: Dmitry Torokhov +Tested-by: Benjamin Tissoires +Signed-off-by: Jiri Kosina +Signed-off-by: Sasha Levin +--- + drivers/hid/i2c-hid/i2c-hid-core.c | 32 ++++++++++++++++++++++-------- + 1 file changed, 24 insertions(+), 8 deletions(-) + +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 998aad8a9e60..14811d42a5a9 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -620,6 +620,17 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, + if (report_type == HID_OUTPUT_REPORT) + return -EINVAL; + ++ /* ++ * In case of unnumbered reports the response from the device will ++ * not have the report ID that the upper layers expect, so we need ++ * to stash it the buffer ourselves and adjust the data size. ++ */ ++ if (!report_number) { ++ buf[0] = 0; ++ buf++; ++ count--; ++ } ++ + /* +2 bytes to include the size of the reply in the query buffer */ + ask_count = min(count + 2, (size_t)ihid->bufsize); + +@@ -641,6 +652,9 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, + count = min(count, ret_count - 2); + memcpy(buf, ihid->rawbuf + 2, count); + ++ if (!report_number) ++ count++; ++ + return count; + } + +@@ -657,17 +671,19 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf, + + mutex_lock(&ihid->reset_lock); + +- if (report_id) { +- buf++; +- count--; +- } +- ++ /* ++ * Note that both numbered and unnumbered reports passed here ++ * are supposed to have report ID stored in the 1st byte of the ++ * buffer, so we strip it off unconditionally before passing payload ++ * to i2c_hid_set_or_send_report which takes care of encoding ++ * everything properly. ++ */ + ret = i2c_hid_set_or_send_report(client, + report_type == HID_FEATURE_REPORT ? 0x03 : 0x02, +- report_id, buf, count, use_data); ++ report_id, buf + 1, count - 1, use_data); + +- if (report_id && ret >= 0) +- ret++; /* add report_id to the number of transfered bytes */ ++ if (ret >= 0) ++ ret++; /* add report_id to the number of transferred bytes */ + + mutex_unlock(&ihid->reset_lock); + +-- +2.34.1 + diff --git a/queue-5.10/hv_balloon-rate-limit-unhandled-message-warning.patch b/queue-5.10/hv_balloon-rate-limit-unhandled-message-warning.patch new file mode 100644 index 00000000000..e64b5cae721 --- /dev/null +++ b/queue-5.10/hv_balloon-rate-limit-unhandled-message-warning.patch @@ -0,0 +1,51 @@ +From b0fe9a075b3f3d7c5d1bb1c2f70a29814a5b2c1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Feb 2022 16:14:00 +0200 +Subject: hv_balloon: rate-limit "Unhandled message" warning + +From: Anssi Hannula + +[ Upstream commit 1d7286729aa616772be334eb908e11f527e1e291 ] + +For a couple of times I have encountered a situation where + + hv_balloon: Unhandled message: type: 12447 + +is being flooded over 1 million times per second with various values, +filling the log and consuming cycles, making debugging difficult. + +Add rate limiting to the message. + +Most other Hyper-V drivers already have similar rate limiting in their +message callbacks. + +The cause of the floods in my case was probably fixed by 96d9d1fa5cd5 +("Drivers: hv: balloon: account for vmbus packet header in +max_pkt_size"). + +Fixes: 9aa8b50b2b3d ("Drivers: hv: Add Hyper-V balloon driver") +Signed-off-by: Anssi Hannula +Reviewed-by: Michael Kelley +Link: https://lore.kernel.org/r/20220222141400.98160-1-anssi.hannula@bitwise.fi +Signed-off-by: Wei Liu +Signed-off-by: Sasha Levin +--- + drivers/hv/hv_balloon.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c +index eb56e09ae15f..6a716996a625 100644 +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -1558,7 +1558,7 @@ static void balloon_onchannelcallback(void *context) + break; + + default: +- pr_warn("Unhandled message: type: %d\n", dm_hdr->type); ++ pr_warn_ratelimited("Unhandled message: type: %d\n", dm_hdr->type); + + } + } +-- +2.34.1 + diff --git a/queue-5.10/hwmon-pmbus-add-mutex-to-regulator-ops.patch b/queue-5.10/hwmon-pmbus-add-mutex-to-regulator-ops.patch new file mode 100644 index 00000000000..8ac0ced4f45 --- /dev/null +++ b/queue-5.10/hwmon-pmbus-add-mutex-to-regulator-ops.patch @@ -0,0 +1,71 @@ +From 6c8f2237c19aa2482de8f39319ce0d36f685a01e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Feb 2022 17:06:09 +0100 +Subject: hwmon: (pmbus) Add mutex to regulator ops + +From: Patrick Rudolph + +[ Upstream commit 686d303ee6301261b422ea51e64833d7909a2c36 ] + +On PMBUS devices with multiple pages, the regulator ops need to be +protected with the update mutex. This prevents accidentally changing +the page in a separate thread while operating on the PMBUS_OPERATION +register. + +Tested on Infineon xdpe11280 while a separate thread polls for sensor +data. + +Signed-off-by: Patrick Rudolph +Signed-off-by: Marcello Sylvester Bauer +Link: https://lore.kernel.org/r/b991506bcbf665f7af185945f70bf9d5cf04637c.1645804976.git.sylv@sylv.io +Fixes: ddbb4db4ced1b ("hwmon: (pmbus) Add regulator support") +Cc: Alan Tull +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/pmbus_core.c | 16 +++++++++++++--- + 1 file changed, 13 insertions(+), 3 deletions(-) + +diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c +index 71798fde2ef0..7a13057007d9 100644 +--- a/drivers/hwmon/pmbus/pmbus_core.c ++++ b/drivers/hwmon/pmbus/pmbus_core.c +@@ -2255,10 +2255,14 @@ static int pmbus_regulator_is_enabled(struct regulator_dev *rdev) + { + struct device *dev = rdev_get_dev(rdev); + struct i2c_client *client = to_i2c_client(dev->parent); ++ struct pmbus_data *data = i2c_get_clientdata(client); + u8 page = rdev_get_id(rdev); + int ret; + ++ mutex_lock(&data->update_lock); + ret = pmbus_read_byte_data(client, page, PMBUS_OPERATION); ++ mutex_unlock(&data->update_lock); ++ + if (ret < 0) + return ret; + +@@ -2269,11 +2273,17 @@ static int _pmbus_regulator_on_off(struct regulator_dev *rdev, bool enable) + { + struct device *dev = rdev_get_dev(rdev); + struct i2c_client *client = to_i2c_client(dev->parent); ++ struct pmbus_data *data = i2c_get_clientdata(client); + u8 page = rdev_get_id(rdev); ++ int ret; + +- return pmbus_update_byte_data(client, page, PMBUS_OPERATION, +- PB_OPERATION_CONTROL_ON, +- enable ? PB_OPERATION_CONTROL_ON : 0); ++ mutex_lock(&data->update_lock); ++ ret = pmbus_update_byte_data(client, page, PMBUS_OPERATION, ++ PB_OPERATION_CONTROL_ON, ++ enable ? PB_OPERATION_CONTROL_ON : 0); ++ mutex_unlock(&data->update_lock); ++ ++ return ret; + } + + static int pmbus_regulator_enable(struct regulator_dev *rdev) +-- +2.34.1 + diff --git a/queue-5.10/hwmon-pmbus-add-vin-unit-off-handling.patch b/queue-5.10/hwmon-pmbus-add-vin-unit-off-handling.patch new file mode 100644 index 00000000000..31d089f692f --- /dev/null +++ b/queue-5.10/hwmon-pmbus-add-vin-unit-off-handling.patch @@ -0,0 +1,61 @@ +From 15e4372f9bd172e38fdf216fedfb0a6ec7e16be8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 23:21:23 +0000 +Subject: hwmon: (pmbus) Add Vin unit off handling + +From: Brandon Wyman + +[ Upstream commit a5436af598779219b375c1977555c82def1c35d0 ] + +If there is an input undervoltage fault, reported in STATUS_INPUT +command response, there is quite likely a "Unit Off For Insufficient +Input Voltage" condition as well. + +Add a constant for bit 3 of STATUS_INPUT. Update the Vin limit +attributes to include both bits in the mask for clearing faults. + +If an input undervoltage fault occurs, causing a unit off for +insufficient input voltage, but the unit is off bit is not cleared, the +STATUS_WORD will not be updated to clear the input fault condition. +Including the unit is off bit (bit 3) allows for the input fault +condition to completely clear. + +Signed-off-by: Brandon Wyman +Link: https://lore.kernel.org/r/20220317232123.2103592-1-bjwyman@gmail.com +Fixes: b4ce237b7f7d3 ("hwmon: (pmbus) Introduce infrastructure to detect sensors and limit registers") +[groeck: Dropped unnecessary ()] +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/pmbus/pmbus.h | 1 + + drivers/hwmon/pmbus/pmbus_core.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h +index 88a5df2633fb..de27837e8527 100644 +--- a/drivers/hwmon/pmbus/pmbus.h ++++ b/drivers/hwmon/pmbus/pmbus.h +@@ -319,6 +319,7 @@ enum pmbus_fan_mode { percent = 0, rpm }; + /* + * STATUS_VOUT, STATUS_INPUT + */ ++#define PB_VOLTAGE_VIN_OFF BIT(3) + #define PB_VOLTAGE_UV_FAULT BIT(4) + #define PB_VOLTAGE_UV_WARNING BIT(5) + #define PB_VOLTAGE_OV_WARNING BIT(6) +diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c +index 7a13057007d9..117e3ce9c76a 100644 +--- a/drivers/hwmon/pmbus/pmbus_core.c ++++ b/drivers/hwmon/pmbus/pmbus_core.c +@@ -1360,7 +1360,7 @@ static const struct pmbus_limit_attr vin_limit_attrs[] = { + .reg = PMBUS_VIN_UV_FAULT_LIMIT, + .attr = "lcrit", + .alarm = "lcrit_alarm", +- .sbit = PB_VOLTAGE_UV_FAULT, ++ .sbit = PB_VOLTAGE_UV_FAULT | PB_VOLTAGE_VIN_OFF, + }, { + .reg = PMBUS_VIN_OV_WARN_LIMIT, + .attr = "max", +-- +2.34.1 + diff --git a/queue-5.10/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch b/queue-5.10/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch new file mode 100644 index 00000000000..4e7a3fcd8b3 --- /dev/null +++ b/queue-5.10/hwmon-sch56xx-common-replace-wdog_active-with-wdog_h.patch @@ -0,0 +1,45 @@ +From cc836de07d171cad82cbef249268d391f1874eef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jan 2022 22:19:35 +0100 +Subject: hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING + +From: Armin Wolf + +[ Upstream commit 647d6f09bea7dacf4cdb6d4ea7e3051883955297 ] + +If the watchdog was already enabled by the BIOS after booting, the +watchdog infrastructure needs to regularly send keepalives to +prevent a unexpected reset. +WDOG_ACTIVE only serves as an status indicator for userspace, +we want to use WDOG_HW_RUNNING instead. + +Since my Fujitsu Esprimo P720 does not support the watchdog, +this change is compile-tested only. + +Suggested-by: Guenter Roeck +Fixes: fb551405c0f8 (watchdog: sch56xx: Use watchdog core) +Signed-off-by: Armin Wolf +Link: https://lore.kernel.org/r/20220131211935.3656-5-W_Armin@gmx.de +Reviewed-by: Hans de Goede +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/sch56xx-common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c +index 6c84780e358e..066b12990fbf 100644 +--- a/drivers/hwmon/sch56xx-common.c ++++ b/drivers/hwmon/sch56xx-common.c +@@ -424,7 +424,7 @@ struct sch56xx_watchdog_data *sch56xx_watchdog_register(struct device *parent, + if (nowayout) + set_bit(WDOG_NO_WAY_OUT, &data->wddev.status); + if (output_enable & SCH56XX_WDOG_OUTPUT_ENABLE) +- set_bit(WDOG_ACTIVE, &data->wddev.status); ++ set_bit(WDOG_HW_RUNNING, &data->wddev.status); + + /* Since the watchdog uses a downcounter there is no register to read + the BIOS set timeout from (if any was set at all) -> +-- +2.34.1 + diff --git a/queue-5.10/hwrng-atmel-disable-trng-on-failure-path.patch b/queue-5.10/hwrng-atmel-disable-trng-on-failure-path.patch new file mode 100644 index 00000000000..fd4bff8eb67 --- /dev/null +++ b/queue-5.10/hwrng-atmel-disable-trng-on-failure-path.patch @@ -0,0 +1,34 @@ +From afc2b7b2206c7d6a25645718eea2c27645401d6b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Feb 2022 09:59:23 +0200 +Subject: hwrng: atmel - disable trng on failure path + +From: Claudiu Beznea + +[ Upstream commit a223ea9f89ab960eb254ba78429efd42eaf845eb ] + +Call atmel_trng_disable() on failure path of probe. + +Fixes: a1fa98d8116f ("hwrng: atmel - disable TRNG during suspend") +Signed-off-by: Claudiu Beznea +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/atmel-rng.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c +index ecb71c4317a5..8cf0ef501341 100644 +--- a/drivers/char/hw_random/atmel-rng.c ++++ b/drivers/char/hw_random/atmel-rng.c +@@ -114,6 +114,7 @@ static int atmel_trng_probe(struct platform_device *pdev) + + err_register: + clk_disable_unprepare(trng->clk); ++ atmel_trng_disable(trng); + return ret; + } + +-- +2.34.1 + diff --git a/queue-5.10/hwrng-cavium-check-health-status-while-reading-rando.patch b/queue-5.10/hwrng-cavium-check-health-status-while-reading-rando.patch new file mode 100644 index 00000000000..e72a1043903 --- /dev/null +++ b/queue-5.10/hwrng-cavium-check-health-status-while-reading-rando.patch @@ -0,0 +1,339 @@ +From 09dc8565a79786cc5718a4b4fb764398a847e046 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 29 Oct 2021 22:49:59 +0530 +Subject: hwrng: cavium - Check health status while reading random data + +From: Sunil Goutham + +[ Upstream commit 680efb33546be8960ccbb2f4e0e43034d9c93b30 ] + +This RNG device is present on Marvell OcteonTx2 silicons as well and +also provides entropy health status. + +HW continuously checks health condition of entropy and reports +faults. Fault is in terms of co-processor cycles since last fault +detected. This doesn't get cleared and only updated when new fault +is detected. Also there are chances of detecting false positives. +So to detect a entropy failure SW has to check if failures are +persistent ie cycles elapsed is frequently updated by HW. + +This patch adds support to detect health failures using below algo. +1. Consider any fault detected before 10ms as a false positive and ignore. + 10ms is chosen randomly, no significance. +2. Upon first failure detection make a note of cycles elapsed and when this + error happened in realtime (cntvct). +3. Upon subsequent failure, check if this is new or a old one by comparing + current cycles with the ones since last failure. cycles or time since + last failure is calculated using cycles and time info captured at (2). + +HEALTH_CHECK status register is not available to VF, hence had to map +PF registers. Also since cycles are in terms of co-processor cycles, +had to retrieve co-processor clock rate from RST device. + +Signed-off-by: Sunil Goutham +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/Kconfig | 2 +- + drivers/char/hw_random/cavium-rng-vf.c | 194 +++++++++++++++++++++++-- + drivers/char/hw_random/cavium-rng.c | 11 +- + 3 files changed, 190 insertions(+), 17 deletions(-) + +diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig +index 5952210526aa..31d367949fad 100644 +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -427,7 +427,7 @@ config HW_RANDOM_MESON + + config HW_RANDOM_CAVIUM + tristate "Cavium ThunderX Random Number Generator support" +- depends on HW_RANDOM && PCI && (ARM64 || (COMPILE_TEST && 64BIT)) ++ depends on HW_RANDOM && PCI && ARM64 + default HW_RANDOM + help + This driver provides kernel-side support for the Random Number +diff --git a/drivers/char/hw_random/cavium-rng-vf.c b/drivers/char/hw_random/cavium-rng-vf.c +index 3de4a6a443ef..6f66919652bf 100644 +--- a/drivers/char/hw_random/cavium-rng-vf.c ++++ b/drivers/char/hw_random/cavium-rng-vf.c +@@ -1,10 +1,7 @@ ++// SPDX-License-Identifier: GPL-2.0 + /* +- * Hardware Random Number Generator support for Cavium, Inc. +- * Thunder processor family. +- * +- * This file is subject to the terms and conditions of the GNU General Public +- * License. See the file "COPYING" in the main directory of this archive +- * for more details. ++ * Hardware Random Number Generator support. ++ * Cavium Thunder, Marvell OcteonTx/Tx2 processor families. + * + * Copyright (C) 2016 Cavium, Inc. + */ +@@ -15,16 +12,146 @@ + #include + #include + ++#include ++ ++/* PCI device IDs */ ++#define PCI_DEVID_CAVIUM_RNG_PF 0xA018 ++#define PCI_DEVID_CAVIUM_RNG_VF 0xA033 ++ ++#define HEALTH_STATUS_REG 0x38 ++ ++/* RST device info */ ++#define PCI_DEVICE_ID_RST_OTX2 0xA085 ++#define RST_BOOT_REG 0x1600ULL ++#define CLOCK_BASE_RATE 50000000ULL ++#define MSEC_TO_NSEC(x) (x * 1000000) ++ + struct cavium_rng { + struct hwrng ops; + void __iomem *result; ++ void __iomem *pf_regbase; ++ struct pci_dev *pdev; ++ u64 clock_rate; ++ u64 prev_error; ++ u64 prev_time; + }; + ++static inline bool is_octeontx(struct pci_dev *pdev) ++{ ++ if (midr_is_cpu_model_range(read_cpuid_id(), MIDR_THUNDERX_83XX, ++ MIDR_CPU_VAR_REV(0, 0), ++ MIDR_CPU_VAR_REV(3, 0)) || ++ midr_is_cpu_model_range(read_cpuid_id(), MIDR_THUNDERX_81XX, ++ MIDR_CPU_VAR_REV(0, 0), ++ MIDR_CPU_VAR_REV(3, 0)) || ++ midr_is_cpu_model_range(read_cpuid_id(), MIDR_THUNDERX, ++ MIDR_CPU_VAR_REV(0, 0), ++ MIDR_CPU_VAR_REV(3, 0))) ++ return true; ++ ++ return false; ++} ++ ++static u64 rng_get_coprocessor_clkrate(void) ++{ ++ u64 ret = CLOCK_BASE_RATE * 16; /* Assume 800Mhz as default */ ++ struct pci_dev *pdev; ++ void __iomem *base; ++ ++ pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM, ++ PCI_DEVICE_ID_RST_OTX2, NULL); ++ if (!pdev) ++ goto error; ++ ++ base = pci_ioremap_bar(pdev, 0); ++ if (!base) ++ goto error_put_pdev; ++ ++ /* RST: PNR_MUL * 50Mhz gives clockrate */ ++ ret = CLOCK_BASE_RATE * ((readq(base + RST_BOOT_REG) >> 33) & 0x3F); ++ ++ iounmap(base); ++ ++error_put_pdev: ++ pci_dev_put(pdev); ++ ++error: ++ return ret; ++} ++ ++static int check_rng_health(struct cavium_rng *rng) ++{ ++ u64 cur_err, cur_time; ++ u64 status, cycles; ++ u64 time_elapsed; ++ ++ ++ /* Skip checking health for OcteonTx */ ++ if (!rng->pf_regbase) ++ return 0; ++ ++ status = readq(rng->pf_regbase + HEALTH_STATUS_REG); ++ if (status & BIT_ULL(0)) { ++ dev_err(&rng->pdev->dev, "HWRNG: Startup health test failed\n"); ++ return -EIO; ++ } ++ ++ cycles = status >> 1; ++ if (!cycles) ++ return 0; ++ ++ cur_time = arch_timer_read_counter(); ++ ++ /* RNM_HEALTH_STATUS[CYCLES_SINCE_HEALTH_FAILURE] ++ * Number of coprocessor cycles times 2 since the last failure. ++ * This field doesn't get cleared/updated until another failure. ++ */ ++ cycles = cycles / 2; ++ cur_err = (cycles * 1000000000) / rng->clock_rate; /* In nanosec */ ++ ++ /* Ignore errors that happenned a long time ago, these ++ * are most likely false positive errors. ++ */ ++ if (cur_err > MSEC_TO_NSEC(10)) { ++ rng->prev_error = 0; ++ rng->prev_time = 0; ++ return 0; ++ } ++ ++ if (rng->prev_error) { ++ /* Calculate time elapsed since last error ++ * '1' tick of CNTVCT is 10ns, since it runs at 100Mhz. ++ */ ++ time_elapsed = (cur_time - rng->prev_time) * 10; ++ time_elapsed += rng->prev_error; ++ ++ /* Check if current error is a new one or the old one itself. ++ * If error is a new one then consider there is a persistent ++ * issue with entropy, declare hardware failure. ++ */ ++ if (cur_err < time_elapsed) { ++ dev_err(&rng->pdev->dev, "HWRNG failure detected\n"); ++ rng->prev_error = cur_err; ++ rng->prev_time = cur_time; ++ return -EIO; ++ } ++ } ++ ++ rng->prev_error = cur_err; ++ rng->prev_time = cur_time; ++ return 0; ++} ++ + /* Read data from the RNG unit */ + static int cavium_rng_read(struct hwrng *rng, void *dat, size_t max, bool wait) + { + struct cavium_rng *p = container_of(rng, struct cavium_rng, ops); + unsigned int size = max; ++ int err = 0; ++ ++ err = check_rng_health(p); ++ if (err) ++ return err; + + while (size >= 8) { + *((u64 *)dat) = readq(p->result); +@@ -39,6 +166,39 @@ static int cavium_rng_read(struct hwrng *rng, void *dat, size_t max, bool wait) + return max; + } + ++static int cavium_map_pf_regs(struct cavium_rng *rng) ++{ ++ struct pci_dev *pdev; ++ ++ /* Health status is not supported on 83xx, skip mapping PF CSRs */ ++ if (is_octeontx(rng->pdev)) { ++ rng->pf_regbase = NULL; ++ return 0; ++ } ++ ++ pdev = pci_get_device(PCI_VENDOR_ID_CAVIUM, ++ PCI_DEVID_CAVIUM_RNG_PF, NULL); ++ if (!pdev) { ++ dev_err(&pdev->dev, "Cannot find RNG PF device\n"); ++ return -EIO; ++ } ++ ++ rng->pf_regbase = ioremap(pci_resource_start(pdev, 0), ++ pci_resource_len(pdev, 0)); ++ if (!rng->pf_regbase) { ++ dev_err(&pdev->dev, "Failed to map PF CSR region\n"); ++ pci_dev_put(pdev); ++ return -ENOMEM; ++ } ++ ++ pci_dev_put(pdev); ++ ++ /* Get co-processor clock rate */ ++ rng->clock_rate = rng_get_coprocessor_clkrate(); ++ ++ return 0; ++} ++ + /* Map Cavium RNG to an HWRNG object */ + static int cavium_rng_probe_vf(struct pci_dev *pdev, + const struct pci_device_id *id) +@@ -50,6 +210,8 @@ static int cavium_rng_probe_vf(struct pci_dev *pdev, + if (!rng) + return -ENOMEM; + ++ rng->pdev = pdev; ++ + /* Map the RNG result */ + rng->result = pcim_iomap(pdev, 0, 0); + if (!rng->result) { +@@ -67,6 +229,11 @@ static int cavium_rng_probe_vf(struct pci_dev *pdev, + + pci_set_drvdata(pdev, rng); + ++ /* Health status is available only at PF, hence map PF registers. */ ++ ret = cavium_map_pf_regs(rng); ++ if (ret) ++ return ret; ++ + ret = devm_hwrng_register(&pdev->dev, &rng->ops); + if (ret) { + dev_err(&pdev->dev, "Error registering device as HWRNG.\n"); +@@ -76,10 +243,18 @@ static int cavium_rng_probe_vf(struct pci_dev *pdev, + return 0; + } + ++/* Remove the VF */ ++static void cavium_rng_remove_vf(struct pci_dev *pdev) ++{ ++ struct cavium_rng *rng; ++ ++ rng = pci_get_drvdata(pdev); ++ iounmap(rng->pf_regbase); ++} + + static const struct pci_device_id cavium_rng_vf_id_table[] = { +- { PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, 0xa033), 0, 0, 0}, +- {0,}, ++ { PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CAVIUM_RNG_VF) }, ++ { 0, } + }; + MODULE_DEVICE_TABLE(pci, cavium_rng_vf_id_table); + +@@ -87,8 +262,9 @@ static struct pci_driver cavium_rng_vf_driver = { + .name = "cavium_rng_vf", + .id_table = cavium_rng_vf_id_table, + .probe = cavium_rng_probe_vf, ++ .remove = cavium_rng_remove_vf, + }; + module_pci_driver(cavium_rng_vf_driver); + + MODULE_AUTHOR("Omer Khaliq "); +-MODULE_LICENSE("GPL"); ++MODULE_LICENSE("GPL v2"); +diff --git a/drivers/char/hw_random/cavium-rng.c b/drivers/char/hw_random/cavium-rng.c +index 63d6e68c24d2..b96579222408 100644 +--- a/drivers/char/hw_random/cavium-rng.c ++++ b/drivers/char/hw_random/cavium-rng.c +@@ -1,10 +1,7 @@ ++// SPDX-License-Identifier: GPL-2.0 + /* +- * Hardware Random Number Generator support for Cavium Inc. +- * Thunder processor family. +- * +- * This file is subject to the terms and conditions of the GNU General Public +- * License. See the file "COPYING" in the main directory of this archive +- * for more details. ++ * Hardware Random Number Generator support. ++ * Cavium Thunder, Marvell OcteonTx/Tx2 processor families. + * + * Copyright (C) 2016 Cavium, Inc. + */ +@@ -91,4 +88,4 @@ static struct pci_driver cavium_rng_pf_driver = { + + module_pci_driver(cavium_rng_pf_driver); + MODULE_AUTHOR("Omer Khaliq "); +-MODULE_LICENSE("GPL"); ++MODULE_LICENSE("GPL v2"); +-- +2.34.1 + diff --git a/queue-5.10/hwrng-cavium-hw_random_cavium-should-depend-on-arch_.patch b/queue-5.10/hwrng-cavium-hw_random_cavium-should-depend-on-arch_.patch new file mode 100644 index 00000000000..3281c509f87 --- /dev/null +++ b/queue-5.10/hwrng-cavium-hw_random_cavium-should-depend-on-arch_.patch @@ -0,0 +1,38 @@ +From 184d63820695cbfe2137727af9c2da72c3ddc61d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jan 2022 15:05:03 +0100 +Subject: hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER + +From: Geert Uytterhoeven + +[ Upstream commit ab7d88549e2f7ae116afd303f32e1950cb790a1d ] + +The Cavium ThunderX Random Number Generator is only present on Cavium +ThunderX SoCs, and not available as an independent PCIe endpoint. Hence +add a dependency on ARCH_THUNDER, to prevent asking the user about this +driver when configuring a kernel without Cavium Thunder SoC support. + +Fixes: cc2f1908c6b8f625 ("hwrng: cavium - Add Cavium HWRNG driver for ThunderX SoC.") +Signed-off-by: Geert Uytterhoeven +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/Kconfig | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig +index 31d367949fad..a7d9e4600d40 100644 +--- a/drivers/char/hw_random/Kconfig ++++ b/drivers/char/hw_random/Kconfig +@@ -427,7 +427,7 @@ config HW_RANDOM_MESON + + config HW_RANDOM_CAVIUM + tristate "Cavium ThunderX Random Number Generator support" +- depends on HW_RANDOM && PCI && ARM64 ++ depends on HW_RANDOM && PCI && ARCH_THUNDER + default HW_RANDOM + help + This driver provides kernel-side support for the Random Number +-- +2.34.1 + diff --git a/queue-5.10/hwrng-nomadik-change-clk_disable-to-clk_disable_unpr.patch b/queue-5.10/hwrng-nomadik-change-clk_disable-to-clk_disable_unpr.patch new file mode 100644 index 00000000000..064b5d6c23b --- /dev/null +++ b/queue-5.10/hwrng-nomadik-change-clk_disable-to-clk_disable_unpr.patch @@ -0,0 +1,47 @@ +From fc653c5a89eae14244311b6fec71ade23b2a3828 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 11:07:24 +0000 +Subject: hwrng: nomadik - Change clk_disable to clk_disable_unprepare + +From: Miaoqian Lin + +[ Upstream commit 7f0f1f3ef62ed7a40e30aff28115bd94c4211d1d ] + +The corresponding API for clk_prepare_enable is clk_disable_unprepare, +other than clk_disable_unprepare. + +Fix this by changing clk_disable to clk_disable_unprepare. + +Fixes: beca35d05cc2 ("hwrng: nomadik - use clk_prepare_enable()") +Signed-off-by: Miaoqian Lin +Reviewed-by: Linus Walleij +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin +--- + drivers/char/hw_random/nomadik-rng.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/hw_random/nomadik-rng.c b/drivers/char/hw_random/nomadik-rng.c +index 67947a19aa22..e8f9621e7954 100644 +--- a/drivers/char/hw_random/nomadik-rng.c ++++ b/drivers/char/hw_random/nomadik-rng.c +@@ -65,14 +65,14 @@ static int nmk_rng_probe(struct amba_device *dev, const struct amba_id *id) + out_release: + amba_release_regions(dev); + out_clk: +- clk_disable(rng_clk); ++ clk_disable_unprepare(rng_clk); + return ret; + } + + static void nmk_rng_remove(struct amba_device *dev) + { + amba_release_regions(dev); +- clk_disable(rng_clk); ++ clk_disable_unprepare(rng_clk); + } + + static const struct amba_id nmk_rng_ids[] = { +-- +2.34.1 + diff --git a/queue-5.10/i2c-meson-fix-wrong-speed-use-from-probe.patch b/queue-5.10/i2c-meson-fix-wrong-speed-use-from-probe.patch new file mode 100644 index 00000000000..5a7e58272f8 --- /dev/null +++ b/queue-5.10/i2c-meson-fix-wrong-speed-use-from-probe.patch @@ -0,0 +1,59 @@ +From d613fd212ff0680c77414f2a1f845ee6ee45352e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 07:26:00 +0000 +Subject: i2c: meson: Fix wrong speed use from probe + +From: Lucas Tanure + +[ Upstream commit cb13aa16f34f794a9cee2626862af8a95f0f0ee9 ] + +Having meson_i2c_set_clk_div after i2c_add_adapter +causes issues for client drivers that try to use +the bus before the requested speed is applied. + +The bus can be used just after i2c_add_adapter, so +move i2c_add_adapter to the final step as +meson_i2c_set_clk_div needs to be called before +the bus is used. + +Fixes: 09af1c2fa490 ("i2c: meson: set clock divider in probe instead of setting it for each transfer") +Signed-off-by: Lucas Tanure +Reviewed-by: Neil Armstrong +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-meson.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c +index ef73a42577cc..07eb819072c4 100644 +--- a/drivers/i2c/busses/i2c-meson.c ++++ b/drivers/i2c/busses/i2c-meson.c +@@ -465,18 +465,18 @@ static int meson_i2c_probe(struct platform_device *pdev) + */ + meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_START, 0); + +- ret = i2c_add_adapter(&i2c->adap); +- if (ret < 0) { +- clk_disable_unprepare(i2c->clk); +- return ret; +- } +- + /* Disable filtering */ + meson_i2c_set_mask(i2c, REG_SLAVE_ADDR, + REG_SLV_SDA_FILTER | REG_SLV_SCL_FILTER, 0); + + meson_i2c_set_clk_div(i2c, timings.bus_freq_hz); + ++ ret = i2c_add_adapter(&i2c->adap); ++ if (ret < 0) { ++ clk_disable_unprepare(i2c->clk); ++ return ret; ++ } ++ + return 0; + } + +-- +2.34.1 + diff --git a/queue-5.10/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch b/queue-5.10/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch new file mode 100644 index 00000000000..c6288be54ba --- /dev/null +++ b/queue-5.10/i2c-mux-demux-pinctrl-do-not-deactivate-a-master-tha.patch @@ -0,0 +1,53 @@ +From e863ab785585aae3f0f24531cd6bd39b96e2a0ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 12:22:35 +0100 +Subject: i2c: mux: demux-pinctrl: do not deactivate a master that is not + active + +From: Peter Rosin + +[ Upstream commit 1a22aabf20adf89cb216f566913196128766f25b ] + +Attempting to rollback the activation of the current master when +the current master has not been activated is bad. priv->cur_chan +and priv->cur_adap are both still zeroed out and the rollback +may result in attempts to revert an of changeset that has not been +applied and do result in calls to both del and put the zeroed out +i2c_adapter. Maybe it crashes, or whatever, but it's bad in any +case. + +Fixes: e9d1a0a41d44 ("i2c: mux: demux-pinctrl: Fix an error handling path in 'i2c_demux_pinctrl_probe()'") +Signed-off-by: Peter Rosin +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/muxes/i2c-demux-pinctrl.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c +index 5365199a31f4..f7a7405d4350 100644 +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -261,7 +261,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + + err = device_create_file(&pdev->dev, &dev_attr_available_masters); + if (err) +- goto err_rollback; ++ goto err_rollback_activation; + + err = device_create_file(&pdev->dev, &dev_attr_current_master); + if (err) +@@ -271,8 +271,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + + err_rollback_available: + device_remove_file(&pdev->dev, &dev_attr_available_masters); +-err_rollback: ++err_rollback_activation: + i2c_demux_deactivate_master(priv); ++err_rollback: + for (j = 0; j < i; j++) { + of_node_put(priv->chan[j].parent_np); + of_changeset_destroy(&priv->chan[j].chgset); +-- +2.34.1 + diff --git a/queue-5.10/i2c-xiic-make-bus-names-unique.patch b/queue-5.10/i2c-xiic-make-bus-names-unique.patch new file mode 100644 index 00000000000..8ef900c006a --- /dev/null +++ b/queue-5.10/i2c-xiic-make-bus-names-unique.patch @@ -0,0 +1,49 @@ +From a2fb83d0851d94602bde5aa0ef462d1ea58153ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 11:50:13 -0600 +Subject: i2c: xiic: Make bus names unique + +From: Robert Hancock + +[ Upstream commit 1d366c2f9df8279df2adbb60471f86fc40a1c39e ] + +This driver is for an FPGA logic core, so there can be arbitrarily many +instances of the bus on a given system. Previously all of the I2C bus +names were "xiic-i2c" which caused issues with lm_sensors when trying to +map human-readable names to sensor inputs because it could not properly +distinguish the busses, for example. Append the platform device name to +the I2C bus name so it is unique between different instances. + +Fixes: e1d5b6598cdc ("i2c: Add support for Xilinx XPS IIC Bus Interface") +Signed-off-by: Robert Hancock +Tested-by: Michal Simek +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-xiic.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 2a8568b97c14..8dabb6ffb1a4 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -756,7 +756,6 @@ static const struct i2c_adapter_quirks xiic_quirks = { + + static const struct i2c_adapter xiic_adapter = { + .owner = THIS_MODULE, +- .name = DRIVER_NAME, + .class = I2C_CLASS_DEPRECATED, + .algo = &xiic_algorithm, + .quirks = &xiic_quirks, +@@ -793,6 +792,8 @@ static int xiic_i2c_probe(struct platform_device *pdev) + i2c_set_adapdata(&i2c->adap, i2c); + i2c->adap.dev.parent = &pdev->dev; + i2c->adap.dev.of_node = pdev->dev.of_node; ++ snprintf(i2c->adap.name, sizeof(i2c->adap.name), ++ DRIVER_NAME " %s", pdev->name); + + mutex_init(&i2c->lock); + init_waitqueue_head(&i2c->wait); +-- +2.34.1 + diff --git a/queue-5.10/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch b/queue-5.10/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch new file mode 100644 index 00000000000..5637ed2ed94 --- /dev/null +++ b/queue-5.10/i40e-don-t-reserve-excessive-xdp_packet_headroom-on-.patch @@ -0,0 +1,53 @@ +From eeb025d9e50b044888d73b50eabddcabc01de079 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Dec 2021 15:06:54 +0100 +Subject: i40e: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx to skb + +From: Alexander Lobakin + +[ Upstream commit bc97f9c6f988b31b728eb47a94ca825401dbeffe ] + +{__,}napi_alloc_skb() allocates and reserves additional NET_SKB_PAD ++ NET_IP_ALIGN for any skb. +OTOH, i40e_construct_skb_zc() currently allocates and reserves +additional `xdp->data - xdp->data_hard_start`, which is +XDP_PACKET_HEADROOM for XSK frames. +There's no need for that at all as the frame is post-XDP and will +go only to the networking stack core. +Pass the size of the actual data only to __napi_alloc_skb() and +don't reserve anything. This will give enough headroom for stack +processing. + +Fixes: 0a714186d3c0 ("i40e: add AF_XDP zero-copy Rx support") +Signed-off-by: Alexander Lobakin +Reviewed-by: Michal Swiatkowski +Acked-by: Jesper Dangaard Brouer +Tested-by: Kiran Bhandare +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_xsk.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +index 86c79f71c685..d444e38360c1 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +@@ -252,13 +252,11 @@ static struct sk_buff *i40e_construct_skb_zc(struct i40e_ring *rx_ring, + struct sk_buff *skb; + + /* allocate a skb to store the frags */ +- skb = __napi_alloc_skb(&rx_ring->q_vector->napi, +- xdp->data_end - xdp->data_hard_start, ++ skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize, + GFP_ATOMIC | __GFP_NOWARN); + if (unlikely(!skb)) + return NULL; + +- skb_reserve(skb, xdp->data - xdp->data_hard_start); + memcpy(__skb_put(skb, datasize), xdp->data, datasize); + if (metasize) + skb_metadata_set(skb, metasize); +-- +2.34.1 + diff --git a/queue-5.10/i40e-respect-metadata-on-xsk-rx-to-skb.patch b/queue-5.10/i40e-respect-metadata-on-xsk-rx-to-skb.patch new file mode 100644 index 00000000000..b0038e0b26b --- /dev/null +++ b/queue-5.10/i40e-respect-metadata-on-xsk-rx-to-skb.patch @@ -0,0 +1,68 @@ +From f7ebe29703074a5257f86a6032c2aac003bf2dfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 8 Dec 2021 15:06:55 +0100 +Subject: i40e: respect metadata on XSK Rx to skb + +From: Alexander Lobakin + +[ Upstream commit 6dba29537c0f639b482bd8f8bbd50ab4ae74b48d ] + +For now, if the XDP prog returns XDP_PASS on XSK, the metadata will +be lost as it doesn't get copied to the skb. + +Copy it along with the frame headers. Account its size on skb +allocation, and when copying just treat it as a part of the frame +and do a pull after to "move" it to the "reserved" zone. + +net_prefetch() xdp->data_meta and align the copy size to speed-up +memcpy() a little and better match i40e_construct_skb(). + +Fixes: 0a714186d3c0 ("i40e: add AF_XDP zero-copy Rx support") +Suggested-by: Jesper Dangaard Brouer +Suggested-by: Maciej Fijalkowski +Signed-off-by: Alexander Lobakin +Reviewed-by: Michal Swiatkowski +Tested-by: Kiran Bhandare +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_xsk.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +index d444e38360c1..75e4a698c3db 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +@@ -247,19 +247,25 @@ bool i40e_alloc_rx_buffers_zc(struct i40e_ring *rx_ring, u16 count) + static struct sk_buff *i40e_construct_skb_zc(struct i40e_ring *rx_ring, + struct xdp_buff *xdp) + { ++ unsigned int totalsize = xdp->data_end - xdp->data_meta; + unsigned int metasize = xdp->data - xdp->data_meta; +- unsigned int datasize = xdp->data_end - xdp->data; + struct sk_buff *skb; + ++ net_prefetch(xdp->data_meta); ++ + /* allocate a skb to store the frags */ +- skb = __napi_alloc_skb(&rx_ring->q_vector->napi, datasize, ++ skb = __napi_alloc_skb(&rx_ring->q_vector->napi, totalsize, + GFP_ATOMIC | __GFP_NOWARN); + if (unlikely(!skb)) + return NULL; + +- memcpy(__skb_put(skb, datasize), xdp->data, datasize); +- if (metasize) ++ memcpy(__skb_put(skb, totalsize), xdp->data_meta, ++ ALIGN(totalsize, sizeof(long))); ++ ++ if (metasize) { + skb_metadata_set(skb, metasize); ++ __skb_pull(skb, metasize); ++ } + + xsk_buff_free(xdp); + return skb; +-- +2.34.1 + diff --git a/queue-5.10/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch b/queue-5.10/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch new file mode 100644 index 00000000000..a9a58b7a032 --- /dev/null +++ b/queue-5.10/ib-cma-allow-xrc-ini-qps-to-set-their-local-ack-time.patch @@ -0,0 +1,41 @@ +From d6730fab363458e1c8338b11f9cb08ccd00a28f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Feb 2022 16:39:35 +0100 +Subject: IB/cma: Allow XRC INI QPs to set their local ACK timeout +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: HÃ¥kon Bugge + +[ Upstream commit 748663c8ccf6b2e5a800de19127c2cc1c4423fd2 ] + +XRC INI QPs should be able to adjust their local ACK timeout. + +Fixes: 2c1619edef61 ("IB/cma: Define option to set ack timeout and pack tos_set") +Link: https://lore.kernel.org/r/1644421175-31943-1-git-send-email-haakon.bugge@oracle.com +Signed-off-by: HÃ¥kon Bugge +Suggested-by: Avneesh Pant +Reviewed-by: Leon Romanovsky +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/core/cma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index fbb0efbe25f8..3c40aa50cd60 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -2635,7 +2635,7 @@ int rdma_set_ack_timeout(struct rdma_cm_id *id, u8 timeout) + { + struct rdma_id_private *id_priv; + +- if (id->qp_type != IB_QPT_RC) ++ if (id->qp_type != IB_QPT_RC && id->qp_type != IB_QPT_XRC_INI) + return -EINVAL; + + id_priv = container_of(id, struct rdma_id_private, id); +-- +2.34.1 + diff --git a/queue-5.10/ib-hfi1-allow-larger-mtu-without-aip.patch b/queue-5.10/ib-hfi1-allow-larger-mtu-without-aip.patch new file mode 100644 index 00000000000..02ad382b5be --- /dev/null +++ b/queue-5.10/ib-hfi1-allow-larger-mtu-without-aip.patch @@ -0,0 +1,46 @@ +From f215dece20e412a6a97a8852e32b4fff3b99b468 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 14:25:09 -0500 +Subject: IB/hfi1: Allow larger MTU without AIP + +From: Mike Marciniszyn + +[ Upstream commit b135e324d7a2e7fa0a7ef925076136e799b79f44 ] + +The AIP code signals the phys_mtu in the following query_port() +fragment: + + props->phys_mtu = HFI1_CAP_IS_KSET(AIP) ? hfi1_max_mtu : + ib_mtu_enum_to_int(props->max_mtu); + +Using the largest MTU possible should not depend on AIP. + +Fix by unconditionally using the hfi1_max_mtu value. + +Fixes: 6d72344cf6c4 ("IB/ipoib: Increase ipoib Datagram mode MTU's upper limit") +Link: https://lore.kernel.org/r/1644348309-174874-1-git-send-email-mike.marciniszyn@cornelisnetworks.com +Reviewed-by: Dennis Dalessandro +Signed-off-by: Mike Marciniszyn +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/verbs.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c +index 3591923abebb..5f3edd255ca3 100644 +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -1439,8 +1439,7 @@ static int query_port(struct rvt_dev_info *rdi, u8 port_num, + 4096 : hfi1_max_mtu), IB_MTU_4096); + props->active_mtu = !valid_ib_mtu(ppd->ibmtu) ? props->max_mtu : + mtu_to_enum(ppd->ibmtu, IB_MTU_4096); +- props->phys_mtu = HFI1_CAP_IS_KSET(AIP) ? hfi1_max_mtu : +- ib_mtu_enum_to_int(props->max_mtu); ++ props->phys_mtu = hfi1_max_mtu; + + return 0; + } +-- +2.34.1 + diff --git a/queue-5.10/iio-adc-add-check-for-devm_request_threaded_irq.patch b/queue-5.10/iio-adc-add-check-for-devm_request_threaded_irq.patch new file mode 100644 index 00000000000..a1a37ac4165 --- /dev/null +++ b/queue-5.10/iio-adc-add-check-for-devm_request_threaded_irq.patch @@ -0,0 +1,38 @@ +From 7b9aba61dff3c0055c693ce901175a22c9cc7b82 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 14:28:49 +0800 +Subject: iio: adc: Add check for devm_request_threaded_irq + +From: Jiasheng Jiang + +[ Upstream commit b30537a4cedcacf0ade2f33ebb7610178ed1e7d7 ] + +As the potential failure of the devm_request_threaded_irq(), +it should be better to check the return value and return +error if fails. + +Fixes: fa659a40b80b ("iio: adc: twl6030-gpadc: Use devm_* API family") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220224062849.3280966-1-jiasheng@iscas.ac.cn +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/adc/twl6030-gpadc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c +index c6416ad795ca..256177b15c51 100644 +--- a/drivers/iio/adc/twl6030-gpadc.c ++++ b/drivers/iio/adc/twl6030-gpadc.c +@@ -911,6 +911,8 @@ static int twl6030_gpadc_probe(struct platform_device *pdev) + ret = devm_request_threaded_irq(dev, irq, NULL, + twl6030_gpadc_irq_handler, + IRQF_ONESHOT, "twl6030_gpadc", indio_dev); ++ if (ret) ++ return ret; + + ret = twl6030_gpadc_enable_irq(TWL6030_GPADC_RT_SW1_EOC_MASK); + if (ret < 0) { +-- +2.34.1 + diff --git a/queue-5.10/iio-mma8452-fix-probe-failing-when-an-i2c_device_id-.patch b/queue-5.10/iio-mma8452-fix-probe-failing-when-an-i2c_device_id-.patch new file mode 100644 index 00000000000..3034fde6e68 --- /dev/null +++ b/queue-5.10/iio-mma8452-fix-probe-failing-when-an-i2c_device_id-.patch @@ -0,0 +1,143 @@ +From f3e74436851eaccffc85789076b844882bd6552d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 13:43:35 +0100 +Subject: iio: mma8452: Fix probe failing when an i2c_device_id is used + +From: Hans de Goede + +[ Upstream commit a47ac019e7e8129b93a0b991e04b2a59872e053d ] + +The mma8452_driver declares both of_match_table and i2c_driver.id_table +match-tables, but its probe() function only checked for of matches. + +Add support for i2c_device_id matches. This fixes the driver not loading +on some x86 tablets (e.g. the Nextbook Ares 8) where the i2c_client is +instantiated by platform code using an i2c_device_id. + +Drop of_match_ptr() protection to avoid unused warning. + +Fixes: c3cdd6e48e35 ("iio: mma8452: refactor for seperating chip specific data") +Signed-off-by: Hans de Goede +Link: https://lore.kernel.org/r/20220208124336.511884-1-hdegoede@redhat.com +Signed-off-by: Jonathan Cameron +Signed-off-by: Sasha Levin +--- + drivers/iio/accel/mma8452.c | 29 ++++++++++++++++++----------- + 1 file changed, 18 insertions(+), 11 deletions(-) + +diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c +index a7208704d31c..e7e280282774 100644 +--- a/drivers/iio/accel/mma8452.c ++++ b/drivers/iio/accel/mma8452.c +@@ -176,6 +176,7 @@ static const struct mma8452_event_regs trans_ev_regs = { + * @enabled_events: event flags enabled and handled by this driver + */ + struct mma_chip_info { ++ const char *name; + u8 chip_id; + const struct iio_chan_spec *channels; + int num_channels; +@@ -1303,6 +1304,7 @@ enum { + + static const struct mma_chip_info mma_chip_info_table[] = { + [mma8451] = { ++ .name = "mma8451", + .chip_id = MMA8451_DEVICE_ID, + .channels = mma8451_channels, + .num_channels = ARRAY_SIZE(mma8451_channels), +@@ -1327,6 +1329,7 @@ static const struct mma_chip_info mma_chip_info_table[] = { + MMA8452_INT_FF_MT, + }, + [mma8452] = { ++ .name = "mma8452", + .chip_id = MMA8452_DEVICE_ID, + .channels = mma8452_channels, + .num_channels = ARRAY_SIZE(mma8452_channels), +@@ -1343,6 +1346,7 @@ static const struct mma_chip_info mma_chip_info_table[] = { + MMA8452_INT_FF_MT, + }, + [mma8453] = { ++ .name = "mma8453", + .chip_id = MMA8453_DEVICE_ID, + .channels = mma8453_channels, + .num_channels = ARRAY_SIZE(mma8453_channels), +@@ -1359,6 +1363,7 @@ static const struct mma_chip_info mma_chip_info_table[] = { + MMA8452_INT_FF_MT, + }, + [mma8652] = { ++ .name = "mma8652", + .chip_id = MMA8652_DEVICE_ID, + .channels = mma8652_channels, + .num_channels = ARRAY_SIZE(mma8652_channels), +@@ -1368,6 +1373,7 @@ static const struct mma_chip_info mma_chip_info_table[] = { + .enabled_events = MMA8452_INT_FF_MT, + }, + [mma8653] = { ++ .name = "mma8653", + .chip_id = MMA8653_DEVICE_ID, + .channels = mma8653_channels, + .num_channels = ARRAY_SIZE(mma8653_channels), +@@ -1382,6 +1388,7 @@ static const struct mma_chip_info mma_chip_info_table[] = { + .enabled_events = MMA8452_INT_FF_MT, + }, + [fxls8471] = { ++ .name = "fxls8471", + .chip_id = FXLS8471_DEVICE_ID, + .channels = mma8451_channels, + .num_channels = ARRAY_SIZE(mma8451_channels), +@@ -1525,13 +1532,6 @@ static int mma8452_probe(struct i2c_client *client, + struct mma8452_data *data; + struct iio_dev *indio_dev; + int ret; +- const struct of_device_id *match; +- +- match = of_match_device(mma8452_dt_ids, &client->dev); +- if (!match) { +- dev_err(&client->dev, "unknown device model\n"); +- return -ENODEV; +- } + + indio_dev = devm_iio_device_alloc(&client->dev, sizeof(*data)); + if (!indio_dev) +@@ -1540,7 +1540,14 @@ static int mma8452_probe(struct i2c_client *client, + data = iio_priv(indio_dev); + data->client = client; + mutex_init(&data->lock); +- data->chip_info = match->data; ++ ++ data->chip_info = device_get_match_data(&client->dev); ++ if (!data->chip_info && id) { ++ data->chip_info = &mma_chip_info_table[id->driver_data]; ++ } else { ++ dev_err(&client->dev, "unknown device model\n"); ++ return -ENODEV; ++ } + + data->vdd_reg = devm_regulator_get(&client->dev, "vdd"); + if (IS_ERR(data->vdd_reg)) +@@ -1584,11 +1591,11 @@ static int mma8452_probe(struct i2c_client *client, + } + + dev_info(&client->dev, "registering %s accelerometer; ID 0x%x\n", +- match->compatible, data->chip_info->chip_id); ++ data->chip_info->name, data->chip_info->chip_id); + + i2c_set_clientdata(client, indio_dev); + indio_dev->info = &mma8452_info; +- indio_dev->name = id->name; ++ indio_dev->name = data->chip_info->name; + indio_dev->modes = INDIO_DIRECT_MODE; + indio_dev->channels = data->chip_info->channels; + indio_dev->num_channels = data->chip_info->num_channels; +@@ -1814,7 +1821,7 @@ MODULE_DEVICE_TABLE(i2c, mma8452_id); + static struct i2c_driver mma8452_driver = { + .driver = { + .name = "mma8452", +- .of_match_table = of_match_ptr(mma8452_dt_ids), ++ .of_match_table = mma8452_dt_ids, + .pm = &mma8452_pm_ops, + }, + .probe = mma8452_probe, +-- +2.34.1 + diff --git a/queue-5.10/io_uring-terminate-manual-loop-iterator-loop-correct.patch b/queue-5.10/io_uring-terminate-manual-loop-iterator-loop-correct.patch new file mode 100644 index 00000000000..030a2dd1cd5 --- /dev/null +++ b/queue-5.10/io_uring-terminate-manual-loop-iterator-loop-correct.patch @@ -0,0 +1,48 @@ +From 069e238b02b0c7202b11ae2c3608e721ecdfc4e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Mar 2022 11:28:13 -0600 +Subject: io_uring: terminate manual loop iterator loop correctly for non-vecs + +From: Jens Axboe + +[ Upstream commit 5e929367468c8f97cd1ffb0417316cecfebef94b ] + +The fix for not advancing the iterator if we're using fixed buffers is +broken in that it can hit a condition where we don't terminate the loop. +This results in io-wq looping forever, asking to read (or write) 0 bytes +for every subsequent loop. + +Reported-by: Joel Jaeschke +Link: https://github.com/axboe/liburing/issues/549 +Fixes: 16c8d2df7ec0 ("io_uring: ensure symmetry in handling iter types in loop_rw_iter()") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index fd188b972151..82f1311dab8e 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -3220,13 +3220,15 @@ static ssize_t loop_rw_iter(int rw, struct io_kiocb *req, struct iov_iter *iter) + ret = nr; + break; + } ++ ret += nr; + if (!iov_iter_is_bvec(iter)) { + iov_iter_advance(iter, nr); + } else { +- req->rw.len -= nr; + req->rw.addr += nr; ++ req->rw.len -= nr; ++ if (!req->rw.len) ++ break; + } +- ret += nr; + if (nr != iovec.iov_len) + break; + } +-- +2.34.1 + diff --git a/queue-5.10/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch b/queue-5.10/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch new file mode 100644 index 00000000000..b7f30c1fb51 --- /dev/null +++ b/queue-5.10/iommu-ipmmu-vmsa-check-for-error-num-after-setting-m.patch @@ -0,0 +1,42 @@ +From 4036ac81cb7b01860bcd23e30f36b56335a72468 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Jan 2022 10:43:02 +0800 +Subject: iommu/ipmmu-vmsa: Check for error num after setting mask + +From: Jiasheng Jiang + +[ Upstream commit 1fdbbfd5099f797a4dac05e7ef0192ba4a9c39b4 ] + +Because of the possible failure of the dma_supported(), the +dma_set_mask_and_coherent() may return error num. +Therefore, it should be better to check it and return the error if +fails. + +Fixes: 1c894225bf5b ("iommu/ipmmu-vmsa: IPMMU device is 40-bit bus master") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Nikita Yushchenko +Link: https://lore.kernel.org/r/20220106024302.2574180-1-jiasheng@iscas.ac.cn +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/ipmmu-vmsa.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index 0f18abda0e20..bae6c7078ec9 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -1013,7 +1013,9 @@ static int ipmmu_probe(struct platform_device *pdev) + bitmap_zero(mmu->ctx, IPMMU_CTX_MAX); + mmu->features = of_device_get_match_data(&pdev->dev); + memset(mmu->utlb_ctx, IPMMU_CTX_INVALID, mmu->features->num_utlbs); +- dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)); ++ ret = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)); ++ if (ret) ++ return ret; + + /* Map I/O memory and request IRQ. */ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +-- +2.34.1 + diff --git a/queue-5.10/ionic-fix-type-complaint-in-ionic_dev_cmd_clean.patch b/queue-5.10/ionic-fix-type-complaint-in-ionic_dev_cmd_clean.patch new file mode 100644 index 00000000000..8741292711d --- /dev/null +++ b/queue-5.10/ionic-fix-type-complaint-in-ionic_dev_cmd_clean.patch @@ -0,0 +1,51 @@ +From ca8f09575b181c7cbf26ab239c178b67674c8ca1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 10:52:57 -0800 +Subject: ionic: fix type complaint in ionic_dev_cmd_clean() + +From: Shannon Nelson + +[ Upstream commit bc0bf9de6f48268f4ee59e57fb42ac751be3ecda ] + +Sparse seems to have gotten a little more picky lately and +we need to revisit this bit of code to make sparse happy. + +warning: incorrect type in initializer (different address spaces) + expected union ionic_dev_cmd_regs *regs + got union ionic_dev_cmd_regs [noderef] __iomem *dev_cmd_regs +warning: incorrect type in argument 2 (different address spaces) + expected void [noderef] __iomem * + got unsigned int * +warning: incorrect type in argument 1 (different address spaces) + expected void volatile [noderef] __iomem * + got union ionic_dev_cmd * + +Fixes: d701ec326a31 ("ionic: clean up sparse complaints") +Signed-off-by: Shannon Nelson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_main.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_main.c b/drivers/net/ethernet/pensando/ionic/ionic_main.c +index d355676f6c16..e14869a2e24a 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_main.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_main.c +@@ -311,10 +311,10 @@ int ionic_adminq_post_wait(struct ionic_lif *lif, struct ionic_admin_ctx *ctx) + + static void ionic_dev_cmd_clean(struct ionic *ionic) + { +- union __iomem ionic_dev_cmd_regs *regs = ionic->idev.dev_cmd_regs; ++ struct ionic_dev *idev = &ionic->idev; + +- iowrite32(0, ®s->doorbell); +- memset_io(®s->cmd, 0, sizeof(regs->cmd)); ++ iowrite32(0, &idev->dev_cmd_regs->doorbell); ++ memset_io(&idev->dev_cmd_regs->cmd, 0, sizeof(idev->dev_cmd_regs->cmd)); + } + + int ionic_dev_cmd_wait(struct ionic *ionic, unsigned long max_seconds) +-- +2.34.1 + diff --git a/queue-5.10/ipv4-fix-route-lookups-when-handling-icmp-redirects-.patch b/queue-5.10/ipv4-fix-route-lookups-when-handling-icmp-redirects-.patch new file mode 100644 index 00000000000..d40d7e945e6 --- /dev/null +++ b/queue-5.10/ipv4-fix-route-lookups-when-handling-icmp-redirects-.patch @@ -0,0 +1,115 @@ +From 6f3443136937ed4992568be127fbf5f6f4285044 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Mar 2022 13:45:09 +0100 +Subject: ipv4: Fix route lookups when handling ICMP redirects and PMTU updates + +From: Guillaume Nault + +[ Upstream commit 544b4dd568e3b09c1ab38a759d3187e7abda11a0 ] + +The PMTU update and ICMP redirect helper functions initialise their fl4 +variable with either __build_flow_key() or build_sk_flow_key(). These +initialisation functions always set ->flowi4_scope with +RT_SCOPE_UNIVERSE and might set the ECN bits of ->flowi4_tos. This is +not a problem when the route lookup is later done via +ip_route_output_key_hash(), which properly clears the ECN bits from +->flowi4_tos and initialises ->flowi4_scope based on the RTO_ONLINK +flag. However, some helpers call fib_lookup() directly, without +sanitising the tos and scope fields, so the route lookup can fail and, +as a result, the ICMP redirect or PMTU update aren't taken into +account. + +Fix this by extracting the ->flowi4_tos and ->flowi4_scope sanitisation +code into ip_rt_fix_tos(), then use this function in handlers that call +fib_lookup() directly. + +Note 1: We can't sanitise ->flowi4_tos and ->flowi4_scope in a central +place (like __build_flow_key() or flowi4_init_output()), because +ip_route_output_key_hash() expects non-sanitised values. When called +with sanitised values, it can erroneously overwrite RT_SCOPE_LINK with +RT_SCOPE_UNIVERSE in ->flowi4_scope. Therefore we have to be careful to +sanitise the values only for those paths that don't call +ip_route_output_key_hash(). + +Note 2: The problem is mostly about sanitising ->flowi4_tos. Having +->flowi4_scope initialised with RT_SCOPE_UNIVERSE instead of +RT_SCOPE_LINK probably wasn't really a problem: sockets with the +SOCK_LOCALROUTE flag set (those that'd result in RTO_ONLINK being set) +normally shouldn't receive ICMP redirects or PMTU updates. + +Fixes: 4895c771c7f0 ("ipv4: Add FIB nexthop exceptions.") +Signed-off-by: Guillaume Nault +Reviewed-by: David Ahern +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/route.c | 18 ++++++++++++++---- + 1 file changed, 14 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index ce787c386793..c72d0de8bf71 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -529,6 +529,15 @@ void __ip_select_ident(struct net *net, struct iphdr *iph, int segs) + } + EXPORT_SYMBOL(__ip_select_ident); + ++static void ip_rt_fix_tos(struct flowi4 *fl4) ++{ ++ __u8 tos = RT_FL_TOS(fl4); ++ ++ fl4->flowi4_tos = tos & IPTOS_RT_MASK; ++ fl4->flowi4_scope = tos & RTO_ONLINK ? ++ RT_SCOPE_LINK : RT_SCOPE_UNIVERSE; ++} ++ + static void __build_flow_key(const struct net *net, struct flowi4 *fl4, + const struct sock *sk, + const struct iphdr *iph, +@@ -853,6 +862,7 @@ static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buf + rt = (struct rtable *) dst; + + __build_flow_key(net, &fl4, sk, iph, oif, tos, prot, mark, 0); ++ ip_rt_fix_tos(&fl4); + __ip_do_redirect(rt, skb, &fl4, true); + } + +@@ -1077,6 +1087,7 @@ static void ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk, + struct flowi4 fl4; + + ip_rt_build_flow_key(&fl4, sk, skb); ++ ip_rt_fix_tos(&fl4); + + /* Don't make lookup fail for bridged encapsulations */ + if (skb && netif_is_any_bridge_port(skb->dev)) +@@ -1151,6 +1162,8 @@ void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu) + goto out; + + new = true; ++ } else { ++ ip_rt_fix_tos(&fl4); + } + + __ip_rt_update_pmtu((struct rtable *)xfrm_dst_path(&rt->dst), &fl4, mtu); +@@ -2524,7 +2537,6 @@ static struct rtable *__mkroute_output(const struct fib_result *res, + struct rtable *ip_route_output_key_hash(struct net *net, struct flowi4 *fl4, + const struct sk_buff *skb) + { +- __u8 tos = RT_FL_TOS(fl4); + struct fib_result res = { + .type = RTN_UNSPEC, + .fi = NULL, +@@ -2534,9 +2546,7 @@ struct rtable *ip_route_output_key_hash(struct net *net, struct flowi4 *fl4, + struct rtable *rth; + + fl4->flowi4_iif = LOOPBACK_IFINDEX; +- fl4->flowi4_tos = tos & IPTOS_RT_MASK; +- fl4->flowi4_scope = ((tos & RTO_ONLINK) ? +- RT_SCOPE_LINK : RT_SCOPE_UNIVERSE); ++ ip_rt_fix_tos(fl4); + + rcu_read_lock(); + rth = ip_route_output_key_hash_rcu(net, fl4, &res, skb); +-- +2.34.1 + diff --git a/queue-5.10/irqchip-nvic-release-nvic_base-upon-failure.patch b/queue-5.10/irqchip-nvic-release-nvic_base-upon-failure.patch new file mode 100644 index 00000000000..e52d8f875a7 --- /dev/null +++ b/queue-5.10/irqchip-nvic-release-nvic_base-upon-failure.patch @@ -0,0 +1,50 @@ +From e7e26ce31517d71e6c23627c96b7595ae6e01118 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Feb 2022 22:03:03 +0530 +Subject: irqchip/nvic: Release nvic_base upon failure + +From: Souptick Joarder (HPE) + +[ Upstream commit e414c25e3399b2b3d7337dc47abccab5c71b7c8f ] + +smatch warning was reported as below -> + +smatch warnings: +drivers/irqchip/irq-nvic.c:131 nvic_of_init() +warn: 'nvic_base' not released on lines: 97. + +Release nvic_base upon failure. + +Reported-by: kernel test robot +Reported-by: Dan Carpenter +Signed-off-by: Souptick Joarder (HPE) +Signed-off-by: Marc Zyngier +Link: https://lore.kernel.org/r/20220218163303.33344-1-jrdr.linux@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/irqchip/irq-nvic.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/irqchip/irq-nvic.c b/drivers/irqchip/irq-nvic.c +index 21cb31ff2bbf..e903c44edb64 100644 +--- a/drivers/irqchip/irq-nvic.c ++++ b/drivers/irqchip/irq-nvic.c +@@ -94,6 +94,7 @@ static int __init nvic_of_init(struct device_node *node, + + if (!nvic_irq_domain) { + pr_warn("Failed to allocate irq domain\n"); ++ iounmap(nvic_base); + return -ENOMEM; + } + +@@ -103,6 +104,7 @@ static int __init nvic_of_init(struct device_node *node, + if (ret) { + pr_warn("Failed to allocate irq chips\n"); + irq_domain_remove(nvic_irq_domain); ++ iounmap(nvic_base); + return ret; + } + +-- +2.34.1 + diff --git a/queue-5.10/irqchip-qcom-pdc-fix-broken-locking.patch b/queue-5.10/irqchip-qcom-pdc-fix-broken-locking.patch new file mode 100644 index 00000000000..979c30c6669 --- /dev/null +++ b/queue-5.10/irqchip-qcom-pdc-fix-broken-locking.patch @@ -0,0 +1,56 @@ +From b543f64d7eb912b05123b7a216cec733b165ad7b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 10:12:25 +0000 +Subject: irqchip/qcom-pdc: Fix broken locking + +From: Marc Zyngier + +[ Upstream commit a6aca2f460e203781dc41391913cc5b54f4bc0ce ] + +pdc_enable_intr() serves as a primitive to qcom_pdc_gic_{en,dis}able, +and has a raw spinlock for mutual exclusion, which is uses with +interruptible primitives. + +This means that this critical section can itself be interrupted. +Should the interrupt also be a PDC interrupt, and the endpoint driver +perform an irq_disable() on that interrupt, we end-up in a deadlock. + +Fix this by using the irqsave/irqrestore variants of the locking +primitives. + +Signed-off-by: Marc Zyngier +Reviewed-by: Maulik Shah +Link: https://lore.kernel.org/r/20220224101226.88373-5-maz@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/irqchip/qcom-pdc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c +index 5dc63c20b67e..fc747b7f4983 100644 +--- a/drivers/irqchip/qcom-pdc.c ++++ b/drivers/irqchip/qcom-pdc.c +@@ -74,17 +74,18 @@ static int qcom_pdc_gic_set_irqchip_state(struct irq_data *d, + static void pdc_enable_intr(struct irq_data *d, bool on) + { + int pin_out = d->hwirq; ++ unsigned long flags; + u32 index, mask; + u32 enable; + + index = pin_out / 32; + mask = pin_out % 32; + +- raw_spin_lock(&pdc_lock); ++ raw_spin_lock_irqsave(&pdc_lock, flags); + enable = pdc_reg_read(IRQ_ENABLE_BANK, index); + enable = on ? ENABLE_INTR(enable, mask) : CLEAR_INTR(enable, mask); + pdc_reg_write(IRQ_ENABLE_BANK, index, enable); +- raw_spin_unlock(&pdc_lock); ++ raw_spin_unlock_irqrestore(&pdc_lock, flags); + } + + static void qcom_pdc_gic_disable(struct irq_data *d) +-- +2.34.1 + diff --git a/queue-5.10/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch b/queue-5.10/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch new file mode 100644 index 00000000000..1c5e5ddc3c3 --- /dev/null +++ b/queue-5.10/ivtv-fix-incorrect-device_caps-for-ivtvfb.patch @@ -0,0 +1,123 @@ +From 46ead7cba17e2e6cbcb97baf0de613f91177dda2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Mar 2022 12:29:11 +0100 +Subject: ivtv: fix incorrect device_caps for ivtvfb + +From: Hans Verkuil + +[ Upstream commit 25e94139218c0293b4375233c14f2256d7dcfaa8 ] + +The VIDIOC_G_FBUF and related overlay ioctls no longer worked (-ENOTTY was +returned). + +The root cause was the introduction of the caps field in ivtv-driver.h. +While loading the ivtvfb module would update the video_device device_caps +field with V4L2_CAP_VIDEO_OUTPUT_OVERLAY it would not update that caps +field, and that's what the overlay ioctls would look at. + +It's a bad idea to keep information in two places, so drop the caps field +and only use vdev.device_caps. + +Signed-off-by: Hans Verkuil +Reported-by: Martin Dauskardt +Fixes: 2161536516ed (media: media/pci: set device_caps in struct video_device) +Signed-off-by: Sasha Levin +--- + drivers/media/pci/ivtv/ivtv-driver.h | 1 - + drivers/media/pci/ivtv/ivtv-ioctl.c | 10 +++++----- + drivers/media/pci/ivtv/ivtv-streams.c | 11 ++++------- + 3 files changed, 9 insertions(+), 13 deletions(-) + +diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h +index e5efe525ad7b..00caf60ff989 100644 +--- a/drivers/media/pci/ivtv/ivtv-driver.h ++++ b/drivers/media/pci/ivtv/ivtv-driver.h +@@ -332,7 +332,6 @@ struct ivtv_stream { + struct ivtv *itv; /* for ease of use */ + const char *name; /* name of the stream */ + int type; /* stream type */ +- u32 caps; /* V4L2 capabilities */ + + struct v4l2_fh *fh; /* pointer to the streaming filehandle */ + spinlock_t qlock; /* locks access to the queues */ +diff --git a/drivers/media/pci/ivtv/ivtv-ioctl.c b/drivers/media/pci/ivtv/ivtv-ioctl.c +index 35dccb31174c..a9d69b253516 100644 +--- a/drivers/media/pci/ivtv/ivtv-ioctl.c ++++ b/drivers/media/pci/ivtv/ivtv-ioctl.c +@@ -443,7 +443,7 @@ static int ivtv_g_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2_f + struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; + struct v4l2_window *winfmt = &fmt->fmt.win; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -EINVAL; + if (!itv->osd_video_pbase) + return -EINVAL; +@@ -554,7 +554,7 @@ static int ivtv_try_fmt_vid_out_overlay(struct file *file, void *fh, struct v4l2 + u32 chromakey = fmt->fmt.win.chromakey; + u8 global_alpha = fmt->fmt.win.global_alpha; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -EINVAL; + if (!itv->osd_video_pbase) + return -EINVAL; +@@ -1388,7 +1388,7 @@ static int ivtv_g_fbuf(struct file *file, void *fh, struct v4l2_framebuffer *fb) + 0, + }; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -ENOTTY; + if (!itv->osd_video_pbase) + return -ENOTTY; +@@ -1455,7 +1455,7 @@ static int ivtv_s_fbuf(struct file *file, void *fh, const struct v4l2_framebuffe + struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; + struct yuv_playback_info *yi = &itv->yuv_info; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -ENOTTY; + if (!itv->osd_video_pbase) + return -ENOTTY; +@@ -1475,7 +1475,7 @@ static int ivtv_overlay(struct file *file, void *fh, unsigned int on) + struct ivtv *itv = id->itv; + struct ivtv_stream *s = &itv->streams[fh2id(fh)->type]; + +- if (!(s->caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) ++ if (!(s->vdev.device_caps & V4L2_CAP_VIDEO_OUTPUT_OVERLAY)) + return -ENOTTY; + if (!itv->osd_video_pbase) + return -ENOTTY; +diff --git a/drivers/media/pci/ivtv/ivtv-streams.c b/drivers/media/pci/ivtv/ivtv-streams.c +index f04ee84bab5f..f9de5d1605fe 100644 +--- a/drivers/media/pci/ivtv/ivtv-streams.c ++++ b/drivers/media/pci/ivtv/ivtv-streams.c +@@ -176,7 +176,7 @@ static void ivtv_stream_init(struct ivtv *itv, int type) + s->itv = itv; + s->type = type; + s->name = ivtv_stream_info[type].name; +- s->caps = ivtv_stream_info[type].v4l2_caps; ++ s->vdev.device_caps = ivtv_stream_info[type].v4l2_caps; + + if (ivtv_stream_info[type].pio) + s->dma = PCI_DMA_NONE; +@@ -299,12 +299,9 @@ static int ivtv_reg_dev(struct ivtv *itv, int type) + if (s_mpg->vdev.v4l2_dev) + num = s_mpg->vdev.num + ivtv_stream_info[type].num_offset; + } +- s->vdev.device_caps = s->caps; +- if (itv->osd_video_pbase) { +- itv->streams[IVTV_DEC_STREAM_TYPE_YUV].vdev.device_caps |= +- V4L2_CAP_VIDEO_OUTPUT_OVERLAY; +- itv->streams[IVTV_DEC_STREAM_TYPE_MPG].vdev.device_caps |= +- V4L2_CAP_VIDEO_OUTPUT_OVERLAY; ++ if (itv->osd_video_pbase && (type == IVTV_DEC_STREAM_TYPE_YUV || ++ type == IVTV_DEC_STREAM_TYPE_MPG)) { ++ s->vdev.device_caps |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY; + itv->v4l2_cap |= V4L2_CAP_VIDEO_OUTPUT_OVERLAY; + } + video_set_drvdata(&s->vdev, s); +-- +2.34.1 + diff --git a/queue-5.10/iwlwifi-fix-eio-error-code-that-is-never-returned.patch b/queue-5.10/iwlwifi-fix-eio-error-code-that-is-never-returned.patch new file mode 100644 index 00000000000..389e52399b8 --- /dev/null +++ b/queue-5.10/iwlwifi-fix-eio-error-code-that-is-never-returned.patch @@ -0,0 +1,39 @@ +From 766f7188234d126860dbda1866e82785cd725e0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Sep 2021 11:46:58 +0100 +Subject: iwlwifi: Fix -EIO error code that is never returned + +From: Colin Ian King + +[ Upstream commit c305c94bdc18e45b5ad1db54da4269f8cbfdff6b ] + +Currently the error -EIO is being assinged to variable ret when +the READY_BIT is not set but the function iwlagn_mac_start returns +0 rather than ret. Fix this by returning ret instead of 0. + +Addresses-Coverity: ("Unused value") +Fixes: 7335613ae27a ("iwlwifi: move all mac80211 related functions to one place") +Signed-off-by: Colin Ian King +Link: https://lore.kernel.org/r/20210907104658.14706-1-colin.king@canonical.com +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c +index 423d3c396b2d..1e21cdbb7313 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c +@@ -304,7 +304,7 @@ static int iwlagn_mac_start(struct ieee80211_hw *hw) + + priv->is_open = 1; + IWL_DEBUG_MAC80211(priv, "leave\n"); +- return 0; ++ return ret; + } + + static void iwlagn_mac_stop(struct ieee80211_hw *hw) +-- +2.34.1 + diff --git a/queue-5.10/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch b/queue-5.10/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch new file mode 100644 index 00000000000..4ba492e871f --- /dev/null +++ b/queue-5.10/iwlwifi-mvm-fix-an-error-code-in-iwl_mvm_up.patch @@ -0,0 +1,39 @@ +From 0b066b1244dbc75ccec858f0e031c2097701e15a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 16 Aug 2021 21:39:30 +0300 +Subject: iwlwifi: mvm: Fix an error code in iwl_mvm_up() + +From: Dan Carpenter + +[ Upstream commit 583d18336abdfb1b355270289ff8f6a2608ba905 ] + +Return -ENODEV instead of success on this error path. + +Fixes: dd36a507c806 ("iwlwifi: mvm: look for the first supported channel when add/remove phy ctxt") +Signed-off-by: Dan Carpenter +Link: https://lore.kernel.org/r/20210816183930.GA2068@kili +Signed-off-by: Luca Coelho +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 6348dfa61724..54b28f0932e2 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -1495,8 +1495,10 @@ int iwl_mvm_up(struct iwl_mvm *mvm) + while (!sband && i < NUM_NL80211_BANDS) + sband = mvm->hw->wiphy->bands[i++]; + +- if (WARN_ON_ONCE(!sband)) ++ if (WARN_ON_ONCE(!sband)) { ++ ret = -ENODEV; + goto error; ++ } + + chan = &sband->channels[0]; + +-- +2.34.1 + diff --git a/queue-5.10/jfs-fix-divide-error-in-dbnextag.patch b/queue-5.10/jfs-fix-divide-error-in-dbnextag.patch new file mode 100644 index 00000000000..81b12bfbd17 --- /dev/null +++ b/queue-5.10/jfs-fix-divide-error-in-dbnextag.patch @@ -0,0 +1,56 @@ +From 50719d211c8624bb25f6c208ec9e6d43fe2a4efa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 19 Mar 2022 22:30:00 +0300 +Subject: jfs: fix divide error in dbNextAG + +From: Pavel Skripkin + +[ Upstream commit 2cc7cc01c15f57d056318c33705647f87dcd4aab ] + +Syzbot reported divide error in dbNextAG(). The problem was in missing +validation check for malicious image. + +Syzbot crafted an image with bmp->db_numag equal to 0. There wasn't any +validation checks, but dbNextAG() blindly use bmp->db_numag in divide +expression + +Fix it by validating bmp->db_numag in dbMount() and return an error if +image is malicious + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Reported-and-tested-by: syzbot+46f5c25af73eb8330eb6@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: Dave Kleikamp +Signed-off-by: Sasha Levin +--- + fs/jfs/jfs_dmap.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index aedad59f8a45..e58ae29a223d 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -148,6 +148,7 @@ static const s8 budtab[256] = { + * 0 - success + * -ENOMEM - insufficient memory + * -EIO - i/o error ++ * -EINVAL - wrong bmap data + */ + int dbMount(struct inode *ipbmap) + { +@@ -179,6 +180,12 @@ int dbMount(struct inode *ipbmap) + bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree); + bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage); + bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag); ++ if (!bmp->db_numag) { ++ release_metapage(mp); ++ kfree(bmp); ++ return -EINVAL; ++ } ++ + bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel); + bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag); + bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref); +-- +2.34.1 + diff --git a/queue-5.10/kdb-fix-the-putarea-helper-function.patch b/queue-5.10/kdb-fix-the-putarea-helper-function.patch new file mode 100644 index 00000000000..bc2b07d27e5 --- /dev/null +++ b/queue-5.10/kdb-fix-the-putarea-helper-function.patch @@ -0,0 +1,47 @@ +From 1295cb993c79910b397d2928b05855225d4699a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 28 Jan 2022 14:40:55 +0000 +Subject: kdb: Fix the putarea helper function + +From: Daniel Thompson + +[ Upstream commit c1cb81429df462eca1b6ba615cddd21dd3103c46 ] + +Currently kdb_putarea_size() uses copy_from_kernel_nofault() to write *to* +arbitrary kernel memory. This is obviously wrong and means the memory +modify ('mm') command is a serious risk to debugger stability: if we poke +to a bad address we'll double-fault and lose our debug session. + +Fix this the (very) obvious way. + +Note that there are two Fixes: tags because the API was renamed and this +patch will only trivially backport as far as the rename (and this is +probably enough). Nevertheless Christoph's rename did not introduce this +problem so I wanted to record that! + +Fixes: fe557319aa06 ("maccess: rename probe_kernel_{read,write} to copy_{from,to}_kernel_nofault") +Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)") +Signed-off-by: Daniel Thompson +Reviewed-by: Douglas Anderson +Link: https://lore.kernel.org/r/20220128144055.207267-1-daniel.thompson@linaro.org +Signed-off-by: Sasha Levin +--- + kernel/debug/kdb/kdb_support.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c +index 6226502ce049..13417f0045f0 100644 +--- a/kernel/debug/kdb/kdb_support.c ++++ b/kernel/debug/kdb/kdb_support.c +@@ -350,7 +350,7 @@ int kdb_getarea_size(void *res, unsigned long addr, size_t size) + */ + int kdb_putarea_size(unsigned long addr, void *res, size_t size) + { +- int ret = copy_from_kernel_nofault((char *)addr, (char *)res, size); ++ int ret = copy_to_kernel_nofault((char *)addr, (char *)res, size); + if (ret) { + if (!KDB_STATE(SUPPRESS)) { + kdb_printf("kdb_putarea: Bad address 0x%lx\n", addr); +-- +2.34.1 + diff --git a/queue-5.10/kgdboc-fix-return-value-of-__setup-handler.patch b/queue-5.10/kgdboc-fix-return-value-of-__setup-handler.patch new file mode 100644 index 00000000000..5a8a67c3c4c --- /dev/null +++ b/queue-5.10/kgdboc-fix-return-value-of-__setup-handler.patch @@ -0,0 +1,76 @@ +From b0c27393f2d033ca65b70ff3a658c98f42972a8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 19:30:18 -0800 +Subject: kgdboc: fix return value of __setup handler + +From: Randy Dunlap + +[ Upstream commit ab818c7aa7544bf8d2dd4bdf68878b17a02eb332 ] + +__setup() handlers should return 1 to obsolete_checksetup() in +init/main.c to indicate that the boot option has been handled. +A return of 0 causes the boot option/value to be listed as an Unknown +kernel parameter and added to init's (limited) environment strings. +So return 1 from kgdboc_option_setup(). + +Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc7 + kgdboc=kbd kgdbts=", will be passed to user space. + + Run /sbin/init as init process + with arguments: + /sbin/init + with environment: + HOME=/ + TERM=linux + BOOT_IMAGE=/boot/bzImage-517rc7 + kgdboc=kbd + kgdbts= + +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Fixes: 1bd54d851f50 ("kgdboc: Passing ekgdboc to command line causes panic") +Fixes: f2d937f3bf00 ("consoles: polling support, kgdboc") +Cc: He Zhe +Cc: Greg Kroah-Hartman +Cc: Jiri Slaby +Cc: kgdb-bugreport@lists.sourceforge.net +Cc: Jason Wessel +Cc: Daniel Thompson +Cc: Douglas Anderson +Cc: linux-serial@vger.kernel.org +Reported-by: Igor Zhbanov +Reviewed-by: Douglas Anderson +Signed-off-by: Randy Dunlap +Link: https://lore.kernel.org/r/20220309033018.17936-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/kgdboc.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c +index 49d0c7f2b29b..79b7db8580e0 100644 +--- a/drivers/tty/serial/kgdboc.c ++++ b/drivers/tty/serial/kgdboc.c +@@ -403,16 +403,16 @@ static int kgdboc_option_setup(char *opt) + { + if (!opt) { + pr_err("config string not provided\n"); +- return -EINVAL; ++ return 1; + } + + if (strlen(opt) >= MAX_CONFIG_LEN) { + pr_err("config string too long\n"); +- return -ENOSPC; ++ return 1; + } + strcpy(config, opt); + +- return 0; ++ return 1; + } + + __setup("kgdboc=", kgdboc_option_setup); +-- +2.34.1 + diff --git a/queue-5.10/kgdbts-fix-return-value-of-__setup-handler.patch b/queue-5.10/kgdbts-fix-return-value-of-__setup-handler.patch new file mode 100644 index 00000000000..3a84203f824 --- /dev/null +++ b/queue-5.10/kgdbts-fix-return-value-of-__setup-handler.patch @@ -0,0 +1,65 @@ +From 06cbb782cb4c62a2cfd0f49170639a95ed9285d8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 19:32:55 -0800 +Subject: kgdbts: fix return value of __setup handler + +From: Randy Dunlap + +[ Upstream commit 96c9e802c64014a7716865332d732cc9c7f24593 ] + +__setup() handlers should return 1 to indicate that the boot option +has been handled. A return of 0 causes the boot option/value to be +listed as an Unknown kernel parameter and added to init's (limited) +environment strings. So return 1 from kgdbts_option_setup(). + +Unknown kernel command line parameters "BOOT_IMAGE=/boot/bzImage-517rc7 + kgdboc=kbd kgdbts=", will be passed to user space. + + Run /sbin/init as init process + with arguments: + /sbin/init + with environment: + HOME=/ + TERM=linux + BOOT_IMAGE=/boot/bzImage-517rc7 + kgdboc=kbd + kgdbts= + +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Fixes: e8d31c204e36 ("kgdb: add kgdb internal test suite") +Cc: kgdb-bugreport@lists.sourceforge.net +Cc: Jason Wessel +Cc: Daniel Thompson +Cc: Douglas Anderson +Cc: Arnd Bergmann +Cc: Greg Kroah-Hartman +Reported-by: Igor Zhbanov +Reviewed-by: Douglas Anderson +Signed-off-by: Randy Dunlap +Link: https://lore.kernel.org/r/20220308033255.22118-1-rdunlap@infradead.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/kgdbts.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c +index 49489153cd16..3e4d89471938 100644 +--- a/drivers/misc/kgdbts.c ++++ b/drivers/misc/kgdbts.c +@@ -1060,10 +1060,10 @@ static int kgdbts_option_setup(char *opt) + { + if (strlen(opt) >= MAX_CONFIG_LEN) { + printk(KERN_ERR "kgdbts: config string too long\n"); +- return -ENOSPC; ++ return 1; + } + strcpy(config, opt); +- return 0; ++ return 1; + } + + __setup("kgdbts=", kgdbts_option_setup); +-- +2.34.1 + diff --git a/queue-5.10/kunit-make-kunit_test_timeout-compatible-with-commen.patch b/queue-5.10/kunit-make-kunit_test_timeout-compatible-with-commen.patch new file mode 100644 index 00000000000..1cd02db5cfd --- /dev/null +++ b/queue-5.10/kunit-make-kunit_test_timeout-compatible-with-commen.patch @@ -0,0 +1,48 @@ +From e2141cccd67ddefa9d9f8a0a0514556303e20996 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Mar 2022 14:48:19 -0700 +Subject: kunit: make kunit_test_timeout compatible with comment + +From: Peng Liu + +[ Upstream commit bdd015f7b71b92c2e4ecabac689642cc72553e04 ] + +In function kunit_test_timeout, it is declared "300 * MSEC_PER_SEC" +represent 5min. However, it is wrong when dealing with arm64 whose +default HZ = 250, or some other situations. Use msecs_to_jiffies to fix +this, and kunit_test_timeout will work as desired. + +Link: https://lkml.kernel.org/r/20220309083753.1561921-3-liupeng256@huawei.com +Fixes: 5f3e06208920 ("kunit: test: add support for test abort") +Signed-off-by: Peng Liu +Reviewed-by: Marco Elver +Reviewed-by: Daniel Latypov +Reviewed-by: Brendan Higgins +Tested-by: Brendan Higgins +Cc: Alexander Potapenko +Cc: Dmitry Vyukov +Cc: Wang Kefeng +Cc: David Gow +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + lib/kunit/try-catch.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/lib/kunit/try-catch.c b/lib/kunit/try-catch.c +index 0dd434e40487..71e5c5853099 100644 +--- a/lib/kunit/try-catch.c ++++ b/lib/kunit/try-catch.c +@@ -52,7 +52,7 @@ static unsigned long kunit_test_timeout(void) + * If tests timeout due to exceeding sysctl_hung_task_timeout_secs, + * the task will be killed and an oops generated. + */ +- return 300 * MSEC_PER_SEC; /* 5 min */ ++ return 300 * msecs_to_jiffies(MSEC_PER_SEC); /* 5 min */ + } + + void kunit_try_catch_run(struct kunit_try_catch *try_catch, void *context) +-- +2.34.1 + diff --git a/queue-5.10/kvm-ppc-book3s-hv-check-return-value-of-kvmppc_radix.patch b/queue-5.10/kvm-ppc-book3s-hv-check-return-value-of-kvmppc_radix.patch new file mode 100644 index 00000000000..9cc7904a413 --- /dev/null +++ b/queue-5.10/kvm-ppc-book3s-hv-check-return-value-of-kvmppc_radix.patch @@ -0,0 +1,42 @@ +From 4703f2254ccf068841f4b914159854ffb821f80f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 12:57:32 -0300 +Subject: KVM: PPC: Book3S HV: Check return value of kvmppc_radix_init + +From: Fabiano Rosas + +[ Upstream commit 69ab6ac380a00244575de02c406dcb9491bf3368 ] + +The return of the function is being shadowed by the call to +kvmppc_uvmem_init. + +Fixes: ca9f4942670c ("KVM: PPC: Book3S HV: Support for running secure guests") +Signed-off-by: Fabiano Rosas +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220125155735.1018683-2-farosas@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/book3s_hv.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index 527c205d5a5f..38b7a3491aac 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -5752,8 +5752,11 @@ static int kvmppc_book3s_init_hv(void) + if (r) + return r; + +- if (kvmppc_radix_possible()) ++ if (kvmppc_radix_possible()) { + r = kvmppc_radix_init(); ++ if (r) ++ return r; ++ } + + /* + * POWER9 chips before version 2.02 can't have some threads in +-- +2.34.1 + diff --git a/queue-5.10/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch b/queue-5.10/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch new file mode 100644 index 00000000000..4a382265a84 --- /dev/null +++ b/queue-5.10/kvm-ppc-fix-vmx-vsx-mixup-in-mmio-emulation.patch @@ -0,0 +1,48 @@ +From 71731ae4a388a18edeee326aca9e2f46afd3c9d2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 18:56:52 -0300 +Subject: KVM: PPC: Fix vmx/vsx mixup in mmio emulation + +From: Fabiano Rosas + +[ Upstream commit b99234b918c6e36b9aa0a5b2981e86b6bd11f8e2 ] + +The MMIO emulation code for vector instructions is duplicated between +VSX and VMX. When emulating VMX we should check the VMX copy size +instead of the VSX one. + +Fixes: acc9eb9305fe ("KVM: PPC: Reimplement LOAD_VMX/STORE_VMX instruction ...") +Signed-off-by: Fabiano Rosas +Reviewed-by: Nicholas Piggin +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/20220125215655.1026224-3-farosas@linux.ibm.com +Signed-off-by: Sasha Levin +--- + arch/powerpc/kvm/powerpc.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c +index 543db9157f3b..ef8077a739b8 100644 +--- a/arch/powerpc/kvm/powerpc.c ++++ b/arch/powerpc/kvm/powerpc.c +@@ -1500,7 +1500,7 @@ int kvmppc_handle_vmx_load(struct kvm_vcpu *vcpu, + { + enum emulation_result emulated = EMULATE_DONE; + +- if (vcpu->arch.mmio_vsx_copy_nums > 2) ++ if (vcpu->arch.mmio_vmx_copy_nums > 2) + return EMULATE_FAIL; + + while (vcpu->arch.mmio_vmx_copy_nums) { +@@ -1597,7 +1597,7 @@ int kvmppc_handle_vmx_store(struct kvm_vcpu *vcpu, + unsigned int index = rs & KVM_MMIO_REG_MASK; + enum emulation_result emulated = EMULATE_DONE; + +- if (vcpu->arch.mmio_vsx_copy_nums > 2) ++ if (vcpu->arch.mmio_vmx_copy_nums > 2) + return EMULATE_FAIL; + + vcpu->arch.io_gpr = rs; +-- +2.34.1 + diff --git a/queue-5.10/kvm-x86-emulator-defer-not-present-segment-check-in-.patch b/queue-5.10/kvm-x86-emulator-defer-not-present-segment-check-in-.patch new file mode 100644 index 00000000000..702d2e83466 --- /dev/null +++ b/queue-5.10/kvm-x86-emulator-defer-not-present-segment-check-in-.patch @@ -0,0 +1,69 @@ +From 0ab24ad734d93b170da6f62257911a2c9215c6f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 17:34:03 +0800 +Subject: KVM: x86/emulator: Defer not-present segment check in + __load_segment_descriptor() + +From: Hou Wenlong + +[ Upstream commit ca85f002258fdac3762c57d12d5e6e401b6a41af ] + +Per Intel's SDM on the "Instruction Set Reference", when +loading segment descriptor, not-present segment check should +be after all type and privilege checks. But the emulator checks +it first, then #NP is triggered instead of #GP if privilege fails +and segment is not present. Put not-present segment check after +type and privilege checks in __load_segment_descriptor(). + +Fixes: 38ba30ba51a00 (KVM: x86 emulator: Emulate task switch in emulator.c) +Reviewed-by: Sean Christopherson +Signed-off-by: Hou Wenlong +Message-Id: <52573c01d369f506cadcf7233812427cf7db81a7.1644292363.git.houwenlong.hwl@antgroup.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/emulate.c | 14 +++++++++----- + 1 file changed, 9 insertions(+), 5 deletions(-) + +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index e82151ba95c0..a63df19ef4da 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -1718,11 +1718,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + goto exception; + } + +- if (!seg_desc.p) { +- err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR; +- goto exception; +- } +- + dpl = seg_desc.dpl; + + switch (seg) { +@@ -1762,6 +1757,10 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + case VCPU_SREG_TR: + if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9)) + goto exception; ++ if (!seg_desc.p) { ++ err_vec = NP_VECTOR; ++ goto exception; ++ } + old_desc = seg_desc; + seg_desc.type |= 2; /* busy */ + ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc, +@@ -1786,6 +1785,11 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + break; + } + ++ if (!seg_desc.p) { ++ err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR; ++ goto exception; ++ } ++ + if (seg_desc.s) { + /* mark segment as accessed */ + if (!(seg_desc.type & 1)) { +-- +2.34.1 + diff --git a/queue-5.10/kvm-x86-fix-emulation-in-writing-cr8.patch b/queue-5.10/kvm-x86-fix-emulation-in-writing-cr8.patch new file mode 100644 index 00000000000..d5bc023d5fe --- /dev/null +++ b/queue-5.10/kvm-x86-fix-emulation-in-writing-cr8.patch @@ -0,0 +1,65 @@ +From 93be9c842ca8cd04ace926aa603869882477ddd2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Feb 2022 17:45:06 +0800 +Subject: KVM: x86: Fix emulation in writing cr8 + +From: Zhenzhong Duan + +[ Upstream commit f66af9f222f08d5b11ea41c1bd6c07a0f12daa07 ] + +In emulation of writing to cr8, one of the lowest four bits in TPR[3:0] +is kept. + +According to Intel SDM 10.8.6.1(baremetal scenario): +"APIC.TPR[bits 7:4] = CR8[bits 3:0], APIC.TPR[bits 3:0] = 0"; + +and SDM 28.3(use TPR shadow): +"MOV to CR8. The instruction stores bits 3:0 of its source operand into +bits 7:4 of VTPR; the remainder of VTPR (bits 3:0 and bits 31:8) are +cleared."; + +and AMD's APM 16.6.4: +"Task Priority Sub-class (TPS)-Bits 3 : 0. The TPS field indicates the +current sub-priority to be used when arbitrating lowest-priority messages. +This field is written with zero when TPR is written using the architectural +CR8 register."; + +so in KVM emulated scenario, clear TPR[3:0] to make a consistent behavior +as in other scenarios. + +This doesn't impact evaluation and delivery of pending virtual interrupts +because processor does not use the processor-priority sub-class to +determine which interrupts to delivery and which to inhibit. + +Sub-class is used by hardware to arbitrate lowest priority interrupts, +but KVM just does a round-robin style delivery. + +Fixes: b93463aa59d6 ("KVM: Accelerated apic support") +Signed-off-by: Zhenzhong Duan +Reviewed-by: Sean Christopherson +Message-Id: <20220210094506.20181-1-zhenzhong.duan@intel.com> +Signed-off-by: Paolo Bonzini +Signed-off-by: Sasha Levin +--- + arch/x86/kvm/lapic.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 677d21082454..de11149e28e0 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2227,10 +2227,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data) + + void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8) + { +- struct kvm_lapic *apic = vcpu->arch.apic; +- +- apic_set_tpr(apic, ((cr8 & 0x0f) << 4) +- | (kvm_lapic_get_reg(apic, APIC_TASKPRI) & 4)); ++ apic_set_tpr(vcpu->arch.apic, (cr8 & 0x0f) << 4); + } + + u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu) +-- +2.34.1 + diff --git a/queue-5.10/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch b/queue-5.10/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch new file mode 100644 index 00000000000..ded2339c9ad --- /dev/null +++ b/queue-5.10/lib-raid6-test-makefile-use-pound-instead-of-for-mak.patch @@ -0,0 +1,85 @@ +From 61eafff855a5a4cb25a9bfc7730edcc5346c13df Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Feb 2022 16:21:48 +0100 +Subject: lib/raid6/test/Makefile: Use $(pound) instead of \# for Make 4.3 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Paul Menzel + +[ Upstream commit 633174a7046ec3b4572bec24ef98e6ee89bce14b ] + +Buidling raid6test on Ubuntu 21.10 (ppc64le) with GNU Make 4.3 shows the +errors below: + + $ cd lib/raid6/test/ + $ make + :1:1: error: stray ‘\’ in program + :1:2: error: stray ‘#’ in program + :1:11: error: expected ‘=’, ‘,’, ‘;’, ‘asm’ or ‘__attribute__’ \ + before ‘<’ token + + [...] + +The errors come from the HAS_ALTIVEC test, which fails, and the POWER +optimized versions are not built. That’s also reason nobody noticed on the +other architectures. + +GNU Make 4.3 does not remove the backslash anymore. From the 4.3 release +announcment: + +> * WARNING: Backward-incompatibility! +> Number signs (#) appearing inside a macro reference or function invocation +> no longer introduce comments and should not be escaped with backslashes: +> thus a call such as: +> foo := $(shell echo '#') +> is legal. Previously the number sign needed to be escaped, for example: +> foo := $(shell echo '\#') +> Now this latter will resolve to "\#". If you want to write makefiles +> portable to both versions, assign the number sign to a variable: +> H := \# +> foo := $(shell echo '$H') +> This was claimed to be fixed in 3.81, but wasn't, for some reason. +> To detect this change search for 'nocomment' in the .FEATURES variable. + +So, do the same as commit 9564a8cf422d ("Kbuild: fix # escaping in .cmd +files for future Make") and commit 929bef467771 ("bpf: Use $(pound) instead +of \# in Makefiles") and define and use a $(pound) variable. + +Reference for the change in make: +https://git.savannah.gnu.org/cgit/make.git/commit/?id=c6966b323811c37acedff05b57 + +Cc: Matt Brown +Signed-off-by: Paul Menzel +Signed-off-by: Song Liu +Signed-off-by: Sasha Levin +--- + lib/raid6/test/Makefile | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile +index a4c7cd74cff5..4fb7700a741b 100644 +--- a/lib/raid6/test/Makefile ++++ b/lib/raid6/test/Makefile +@@ -4,6 +4,8 @@ + # from userspace. + # + ++pound := \# ++ + CC = gcc + OPTFLAGS = -O2 # Adjust as desired + CFLAGS = -I.. -I ../../../include -g $(OPTFLAGS) +@@ -42,7 +44,7 @@ else ifeq ($(HAS_NEON),yes) + OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o + CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1 + else +- HAS_ALTIVEC := $(shell printf '\#include \nvector int a;\n' |\ ++ HAS_ALTIVEC := $(shell printf '$(pound)include \nvector int a;\n' |\ + gcc -c -x c - >/dev/null && rm ./-.o && echo yes) + ifeq ($(HAS_ALTIVEC),yes) + CFLAGS += -I../../../arch/powerpc/include +-- +2.34.1 + diff --git a/queue-5.10/lib-test-use-after-free-in-register_test_dev_kmod.patch b/queue-5.10/lib-test-use-after-free-in-register_test_dev_kmod.patch new file mode 100644 index 00000000000..36bc9ddc852 --- /dev/null +++ b/queue-5.10/lib-test-use-after-free-in-register_test_dev_kmod.patch @@ -0,0 +1,34 @@ +From 3aaa86a2dceb92baeb3e3c8e73f83764ae7972b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Mar 2022 08:52:07 +0300 +Subject: lib/test: use after free in register_test_dev_kmod() + +From: Dan Carpenter + +[ Upstream commit dc0ce6cc4b133f5f2beb8b47dacae13a7d283c2c ] + +The "test_dev" pointer is freed but then returned to the caller. + +Fixes: d9c6a72d6fa2 ("kmod: add test driver to stress test the module loader") +Signed-off-by: Dan Carpenter +Signed-off-by: Luis Chamberlain +Signed-off-by: Sasha Levin +--- + lib/test_kmod.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/lib/test_kmod.c b/lib/test_kmod.c +index eab52770070d..c637f6b5053a 100644 +--- a/lib/test_kmod.c ++++ b/lib/test_kmod.c +@@ -1155,6 +1155,7 @@ static struct kmod_test_device *register_test_dev_kmod(void) + if (ret) { + pr_err("could not register misc device: %d\n", ret); + free_test_dev_kmod(test_dev); ++ test_dev = NULL; + goto out; + } + +-- +2.34.1 + diff --git a/queue-5.10/lib-test_lockup-fix-kernel-pointer-check-for-separat.patch b/queue-5.10/lib-test_lockup-fix-kernel-pointer-check-for-separat.patch new file mode 100644 index 00000000000..ccd89768901 --- /dev/null +++ b/queue-5.10/lib-test_lockup-fix-kernel-pointer-check-for-separat.patch @@ -0,0 +1,48 @@ +From f89affdf0cb66d608339ec6b8743ea82ed1fa3be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Feb 2022 13:48:06 +0100 +Subject: lib/test_lockup: fix kernel pointer check for separate address spaces + +From: Arnd Bergmann + +[ Upstream commit 5a06fcb15b43d1f7bf740c672950122331cb5655 ] + +test_kernel_ptr() uses access_ok() to figure out if a given address +points to user space instead of kernel space. However on architectures +that set CONFIG_ALTERNATE_USER_ADDRESS_SPACE, a pointer can be valid +for both, and the check always fails because access_ok() returns true. + +Make the check for user space pointers conditional on the type of +address space layout. + +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + lib/test_lockup.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/lib/test_lockup.c b/lib/test_lockup.c +index 07f476317187..78a630bbd03d 100644 +--- a/lib/test_lockup.c ++++ b/lib/test_lockup.c +@@ -417,9 +417,14 @@ static bool test_kernel_ptr(unsigned long addr, int size) + return false; + + /* should be at least readable kernel address */ +- if (access_ok((void __user *)ptr, 1) || +- access_ok((void __user *)ptr + size - 1, 1) || +- get_kernel_nofault(buf, ptr) || ++ if (!IS_ENABLED(CONFIG_ALTERNATE_USER_ADDRESS_SPACE) && ++ (access_ok((void __user *)ptr, 1) || ++ access_ok((void __user *)ptr + size - 1, 1))) { ++ pr_err("user space ptr invalid in kernel: %#lx\n", addr); ++ return true; ++ } ++ ++ if (get_kernel_nofault(buf, ptr) || + get_kernel_nofault(buf, ptr + size - 1)) { + pr_err("invalid kernel ptr: %#lx\n", addr); + return true; +-- +2.34.1 + diff --git a/queue-5.10/libbpf-fix-possible-null-pointer-dereference-when-de.patch b/queue-5.10/libbpf-fix-possible-null-pointer-dereference-when-de.patch new file mode 100644 index 00000000000..b65f2949d9c --- /dev/null +++ b/queue-5.10/libbpf-fix-possible-null-pointer-dereference-when-de.patch @@ -0,0 +1,59 @@ +From f4100bf692353082e2cc56153615cc67d54912e9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 8 Jan 2022 13:47:39 +0000 +Subject: libbpf: Fix possible NULL pointer dereference when destroying + skeleton + +From: Yafang Shao + +[ Upstream commit a32ea51a3f17ce6524c9fc19d311e708331c8b5f ] + +When I checked the code in skeleton header file generated with my own +bpf prog, I found there may be possible NULL pointer dereference when +destroying skeleton. Then I checked the in-tree bpf progs, finding that is +a common issue. Let's take the generated samples/bpf/xdp_redirect_cpu.skel.h +for example. Below is the generated code in +xdp_redirect_cpu__create_skeleton(): + + xdp_redirect_cpu__create_skeleton + struct bpf_object_skeleton *s; + s = (struct bpf_object_skeleton *)calloc(1, sizeof(*s)); + if (!s) + goto error; + ... + error: + bpf_object__destroy_skeleton(s); + return -ENOMEM; + +After goto error, the NULL 's' will be deferenced in +bpf_object__destroy_skeleton(). + +We can simply fix this issue by just adding a NULL check in +bpf_object__destroy_skeleton(). + +Fixes: d66562fba1ce ("libbpf: Add BPF object skeleton support") +Signed-off-by: Yafang Shao +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20220108134739.32541-1-laoar.shao@gmail.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/libbpf.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index b337d6f29098..61df26f048d9 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -10923,6 +10923,9 @@ void bpf_object__detach_skeleton(struct bpf_object_skeleton *s) + + void bpf_object__destroy_skeleton(struct bpf_object_skeleton *s) + { ++ if (!s) ++ return; ++ + if (s->progs) + bpf_object__detach_skeleton(s); + if (s->obj) +-- +2.34.1 + diff --git a/queue-5.10/libbpf-skip-forward-declaration-when-counting-duplic.patch b/queue-5.10/libbpf-skip-forward-declaration-when-counting-duplic.patch new file mode 100644 index 00000000000..2dd83e6d61f --- /dev/null +++ b/queue-5.10/libbpf-skip-forward-declaration-when-counting-duplic.patch @@ -0,0 +1,54 @@ +From 99598c202b2ad01fbec71592c458cbd86b230577 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 00:32:49 -0500 +Subject: libbpf: Skip forward declaration when counting duplicated type names + +From: Xu Kuohai + +[ Upstream commit 4226961b0019b2e1612029e8950a9e911affc995 ] + +Currently if a declaration appears in the BTF before the definition, the +definition is dumped as a conflicting name, e.g.: + + $ bpftool btf dump file vmlinux format raw | grep "'unix_sock'" + [81287] FWD 'unix_sock' fwd_kind=struct + [89336] STRUCT 'unix_sock' size=1024 vlen=14 + + $ bpftool btf dump file vmlinux format c | grep "struct unix_sock" + struct unix_sock; + struct unix_sock___2 { <--- conflict, the "___2" is unexpected + struct unix_sock___2 *unix_sk; + +This causes a compilation error if the dump output is used as a header file. + +Fix it by skipping declaration when counting duplicated type names. + +Fixes: 351131b51c7a ("libbpf: add btf_dump API for BTF-to-C conversion") +Signed-off-by: Xu Kuohai +Signed-off-by: Daniel Borkmann +Acked-by: Song Liu +Link: https://lore.kernel.org/bpf/20220301053250.1464204-2-xukuohai@huawei.com +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/btf_dump.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/tools/lib/bpf/btf_dump.c b/tools/lib/bpf/btf_dump.c +index 0911aea4cdbe..bd22853be4a6 100644 +--- a/tools/lib/bpf/btf_dump.c ++++ b/tools/lib/bpf/btf_dump.c +@@ -1416,6 +1416,11 @@ static const char *btf_dump_resolve_name(struct btf_dump *d, __u32 id, + if (s->name_resolved) + return *cached_name ? *cached_name : orig_name; + ++ if (btf_is_fwd(t) || (btf_is_enum(t) && btf_vlen(t) == 0)) { ++ s->name_resolved = 1; ++ return orig_name; ++ } ++ + dup_cnt = btf_dump_name_dups(d, name_map, orig_name); + if (dup_cnt > 1) { + const size_t max_len = 256; +-- +2.34.1 + diff --git a/queue-5.10/libbpf-unmap-rings-when-umem-deleted.patch b/queue-5.10/libbpf-unmap-rings-when-umem-deleted.patch new file mode 100644 index 00000000000..a998a3bf39a --- /dev/null +++ b/queue-5.10/libbpf-unmap-rings-when-umem-deleted.patch @@ -0,0 +1,60 @@ +From 20c88c2f45e4f98e7d578cf0cb8babac55468645 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 13:26:23 +0000 +Subject: libbpf: Unmap rings when umem deleted + +From: lic121 + +[ Upstream commit 9c6e6a80ee741adf6cb3cfd8eef7d1554f91fceb ] + +xsk_umem__create() does mmap for fill/comp rings, but xsk_umem__delete() +doesn't do the unmap. This works fine for regular cases, because +xsk_socket__delete() does unmap for the rings. But for the case that +xsk_socket__create_shared() fails, umem rings are not unmapped. + +fill_save/comp_save are checked to determine if rings have already be +unmapped by xsk. If fill_save and comp_save are NULL, it means that the +rings have already been used by xsk. Then they are supposed to be +unmapped by xsk_socket__delete(). Otherwise, xsk_umem__delete() does the +unmap. + +Fixes: 2f6324a3937f ("libbpf: Support shared umems between queues and devices") +Signed-off-by: Cheng Li +Signed-off-by: Andrii Nakryiko +Link: https://lore.kernel.org/bpf/20220301132623.GA19995@vscode.7~ +Signed-off-by: Sasha Levin +--- + tools/lib/bpf/xsk.c | 11 +++++++++++ + 1 file changed, 11 insertions(+) + +diff --git a/tools/lib/bpf/xsk.c b/tools/lib/bpf/xsk.c +index 3028f932e10c..c4390ef98b19 100644 +--- a/tools/lib/bpf/xsk.c ++++ b/tools/lib/bpf/xsk.c +@@ -895,12 +895,23 @@ int xsk_socket__create(struct xsk_socket **xsk_ptr, const char *ifname, + + int xsk_umem__delete(struct xsk_umem *umem) + { ++ struct xdp_mmap_offsets off; ++ int err; ++ + if (!umem) + return 0; + + if (umem->refcount) + return -EBUSY; + ++ err = xsk_get_mmap_offsets(umem->fd, &off); ++ if (!err && umem->fill_save && umem->comp_save) { ++ munmap(umem->fill_save->ring - off.fr.desc, ++ off.fr.desc + umem->config.fill_size * sizeof(__u64)); ++ munmap(umem->comp_save->ring - off.cr.desc, ++ off.cr.desc + umem->config.comp_size * sizeof(__u64)); ++ } ++ + close(umem->fd); + free(umem); + +-- +2.34.1 + diff --git a/queue-5.10/livepatch-fix-build-failure-on-32-bits-processors.patch b/queue-5.10/livepatch-fix-build-failure-on-32-bits-processors.patch new file mode 100644 index 00000000000..6547a4c6281 --- /dev/null +++ b/queue-5.10/livepatch-fix-build-failure-on-32-bits-processors.patch @@ -0,0 +1,67 @@ +From 0844324deb0a21af435b7c8024947827282851f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 20 Dec 2021 16:38:02 +0000 +Subject: livepatch: Fix build failure on 32 bits processors + +From: Christophe Leroy + +[ Upstream commit 2f293651eca3eacaeb56747dede31edace7329d2 ] + +Trying to build livepatch on powerpc/32 results in: + + kernel/livepatch/core.c: In function 'klp_resolve_symbols': + kernel/livepatch/core.c:221:23: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] + 221 | sym = (Elf64_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info); + | ^ + kernel/livepatch/core.c:221:21: error: assignment to 'Elf32_Sym *' {aka 'struct elf32_sym *'} from incompatible pointer type 'Elf64_Sym *' {aka 'struct elf64_sym *'} [-Werror=incompatible-pointer-types] + 221 | sym = (Elf64_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info); + | ^ + kernel/livepatch/core.c: In function 'klp_apply_section_relocs': + kernel/livepatch/core.c:312:35: error: passing argument 1 of 'klp_resolve_symbols' from incompatible pointer type [-Werror=incompatible-pointer-types] + 312 | ret = klp_resolve_symbols(sechdrs, strtab, symndx, sec, sec_objname); + | ^~~~~~~ + | | + | Elf32_Shdr * {aka struct elf32_shdr *} + kernel/livepatch/core.c:193:44: note: expected 'Elf64_Shdr *' {aka 'struct elf64_shdr *'} but argument is of type 'Elf32_Shdr *' {aka 'struct elf32_shdr *'} + 193 | static int klp_resolve_symbols(Elf64_Shdr *sechdrs, const char *strtab, + | ~~~~~~~~~~~~^~~~~~~ + +Fix it by using the right types instead of forcing 64 bits types. + +Fixes: 7c8e2bdd5f0d ("livepatch: Apply vmlinux-specific KLP relocations early") +Signed-off-by: Christophe Leroy +Acked-by: Petr Mladek +Acked-by: Joe Lawrence +Acked-by: Miroslav Benes +Signed-off-by: Michael Ellerman +Link: https://lore.kernel.org/r/5288e11b018a762ea3351cc8fb2d4f15093a4457.1640017960.git.christophe.leroy@csgroup.eu +Signed-off-by: Sasha Levin +--- + kernel/livepatch/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c +index f76fdb925532..e8bdce6fdd64 100644 +--- a/kernel/livepatch/core.c ++++ b/kernel/livepatch/core.c +@@ -191,7 +191,7 @@ static int klp_find_object_symbol(const char *objname, const char *name, + return -EINVAL; + } + +-static int klp_resolve_symbols(Elf64_Shdr *sechdrs, const char *strtab, ++static int klp_resolve_symbols(Elf_Shdr *sechdrs, const char *strtab, + unsigned int symndx, Elf_Shdr *relasec, + const char *sec_objname) + { +@@ -219,7 +219,7 @@ static int klp_resolve_symbols(Elf64_Shdr *sechdrs, const char *strtab, + relas = (Elf_Rela *) relasec->sh_addr; + /* For each rela in this klp relocation section */ + for (i = 0; i < relasec->sh_size / sizeof(Elf_Rela); i++) { +- sym = (Elf64_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info); ++ sym = (Elf_Sym *)sechdrs[symndx].sh_addr + ELF_R_SYM(relas[i].r_info); + if (sym->st_shndx != SHN_LIVEPATCH) { + pr_err("symbol %s is not marked as a livepatch symbol\n", + strtab + sym->st_name); +-- +2.34.1 + diff --git a/queue-5.10/locking-lockdep-iterate-lock_classes-directly-when-r.patch b/queue-5.10/locking-lockdep-iterate-lock_classes-directly-when-r.patch new file mode 100644 index 00000000000..96863f4b4ed --- /dev/null +++ b/queue-5.10/locking-lockdep-iterate-lock_classes-directly-when-r.patch @@ -0,0 +1,255 @@ +From 40eeaeaa68afc0b0287e830870fa54269a65b780 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Feb 2022 22:55:26 -0500 +Subject: locking/lockdep: Iterate lock_classes directly when reading lockdep + files + +From: Waiman Long + +[ Upstream commit fb7275acd6fb988313dddd8d3d19efa70d9015ad ] + +When dumping lock_classes information via /proc/lockdep, we can't take +the lockdep lock as the lock hold time is indeterminate. Iterating +over all_lock_classes without holding lock can be dangerous as there +is a slight chance that it may branch off to other lists leading to +infinite loop or even access invalid memory if changes are made to +all_lock_classes list in parallel. + +To avoid this problem, iteration of lock classes is now done directly +on the lock_classes array itself. The lock_classes_in_use bitmap is +checked to see if the lock class is being used. To avoid iterating +the full array all the times, a new max_lock_class_idx value is added +to track the maximum lock_class index that is currently being used. + +We can theoretically take the lockdep lock for iterating all_lock_classes +when other lockdep files (lockdep_stats and lock_stat) are accessed as +the lock hold time will be shorter for them. For consistency, they are +also modified to iterate the lock_classes array directly. + +Signed-off-by: Waiman Long +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20220211035526.1329503-2-longman@redhat.com +Signed-off-by: Sasha Levin +--- + kernel/locking/lockdep.c | 14 +++++--- + kernel/locking/lockdep_internals.h | 6 ++-- + kernel/locking/lockdep_proc.c | 51 +++++++++++++++++++++++++----- + 3 files changed, 56 insertions(+), 15 deletions(-) + +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index aa758236ff6a..b6683cefe19a 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -182,11 +182,9 @@ static DECLARE_BITMAP(list_entries_in_use, MAX_LOCKDEP_ENTRIES); + static struct hlist_head lock_keys_hash[KEYHASH_SIZE]; + unsigned long nr_lock_classes; + unsigned long nr_zapped_classes; +-#ifndef CONFIG_DEBUG_LOCKDEP +-static +-#endif ++unsigned long max_lock_class_idx; + struct lock_class lock_classes[MAX_LOCKDEP_KEYS]; +-static DECLARE_BITMAP(lock_classes_in_use, MAX_LOCKDEP_KEYS); ++DECLARE_BITMAP(lock_classes_in_use, MAX_LOCKDEP_KEYS); + + static inline struct lock_class *hlock_class(struct held_lock *hlock) + { +@@ -337,7 +335,7 @@ static inline void lock_release_holdtime(struct held_lock *hlock) + * elements. These elements are linked together by the lock_entry member in + * struct lock_class. + */ +-LIST_HEAD(all_lock_classes); ++static LIST_HEAD(all_lock_classes); + static LIST_HEAD(free_lock_classes); + + /** +@@ -1239,6 +1237,7 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force) + struct lockdep_subclass_key *key; + struct hlist_head *hash_head; + struct lock_class *class; ++ int idx; + + DEBUG_LOCKS_WARN_ON(!irqs_disabled()); + +@@ -1304,6 +1303,9 @@ register_lock_class(struct lockdep_map *lock, unsigned int subclass, int force) + * of classes. + */ + list_move_tail(&class->lock_entry, &all_lock_classes); ++ idx = class - lock_classes; ++ if (idx > max_lock_class_idx) ++ max_lock_class_idx = idx; + + if (verbose(class)) { + graph_unlock(); +@@ -5919,6 +5921,8 @@ static void zap_class(struct pending_free *pf, struct lock_class *class) + WRITE_ONCE(class->name, NULL); + nr_lock_classes--; + __clear_bit(class - lock_classes, lock_classes_in_use); ++ if (class - lock_classes == max_lock_class_idx) ++ max_lock_class_idx--; + } else { + WARN_ONCE(true, "%s() failed for class %s\n", __func__, + class->name); +diff --git a/kernel/locking/lockdep_internals.h b/kernel/locking/lockdep_internals.h +index de49f9e1c11b..a19b01635347 100644 +--- a/kernel/locking/lockdep_internals.h ++++ b/kernel/locking/lockdep_internals.h +@@ -121,7 +121,6 @@ static const unsigned long LOCKF_USED_IN_IRQ_READ = + + #define MAX_LOCKDEP_CHAIN_HLOCKS (MAX_LOCKDEP_CHAINS*5) + +-extern struct list_head all_lock_classes; + extern struct lock_chain lock_chains[]; + + #define LOCK_USAGE_CHARS (2*XXX_LOCK_USAGE_STATES + 1) +@@ -151,6 +150,10 @@ extern unsigned int nr_large_chain_blocks; + + extern unsigned int max_lockdep_depth; + extern unsigned int max_bfs_queue_depth; ++extern unsigned long max_lock_class_idx; ++ ++extern struct lock_class lock_classes[MAX_LOCKDEP_KEYS]; ++extern unsigned long lock_classes_in_use[]; + + #ifdef CONFIG_PROVE_LOCKING + extern unsigned long lockdep_count_forward_deps(struct lock_class *); +@@ -205,7 +208,6 @@ struct lockdep_stats { + }; + + DECLARE_PER_CPU(struct lockdep_stats, lockdep_stats); +-extern struct lock_class lock_classes[MAX_LOCKDEP_KEYS]; + + #define __debug_atomic_inc(ptr) \ + this_cpu_inc(lockdep_stats.ptr); +diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c +index 02ef87f50df2..ccb5292d1e19 100644 +--- a/kernel/locking/lockdep_proc.c ++++ b/kernel/locking/lockdep_proc.c +@@ -24,14 +24,33 @@ + + #include "lockdep_internals.h" + ++/* ++ * Since iteration of lock_classes is done without holding the lockdep lock, ++ * it is not safe to iterate all_lock_classes list directly as the iteration ++ * may branch off to free_lock_classes or the zapped list. Iteration is done ++ * directly on the lock_classes array by checking the lock_classes_in_use ++ * bitmap and max_lock_class_idx. ++ */ ++#define iterate_lock_classes(idx, class) \ ++ for (idx = 0, class = lock_classes; idx <= max_lock_class_idx; \ ++ idx++, class++) ++ + static void *l_next(struct seq_file *m, void *v, loff_t *pos) + { +- return seq_list_next(v, &all_lock_classes, pos); ++ struct lock_class *class = v; ++ ++ ++class; ++ *pos = class - lock_classes; ++ return (*pos > max_lock_class_idx) ? NULL : class; + } + + static void *l_start(struct seq_file *m, loff_t *pos) + { +- return seq_list_start_head(&all_lock_classes, *pos); ++ unsigned long idx = *pos; ++ ++ if (idx > max_lock_class_idx) ++ return NULL; ++ return lock_classes + idx; + } + + static void l_stop(struct seq_file *m, void *v) +@@ -57,14 +76,16 @@ static void print_name(struct seq_file *m, struct lock_class *class) + + static int l_show(struct seq_file *m, void *v) + { +- struct lock_class *class = list_entry(v, struct lock_class, lock_entry); ++ struct lock_class *class = v; + struct lock_list *entry; + char usage[LOCK_USAGE_CHARS]; ++ int idx = class - lock_classes; + +- if (v == &all_lock_classes) { ++ if (v == lock_classes) + seq_printf(m, "all lock classes:\n"); ++ ++ if (!test_bit(idx, lock_classes_in_use)) + return 0; +- } + + seq_printf(m, "%p", class->key); + #ifdef CONFIG_DEBUG_LOCKDEP +@@ -218,8 +239,11 @@ static int lockdep_stats_show(struct seq_file *m, void *v) + + #ifdef CONFIG_PROVE_LOCKING + struct lock_class *class; ++ unsigned long idx; + +- list_for_each_entry(class, &all_lock_classes, lock_entry) { ++ iterate_lock_classes(idx, class) { ++ if (!test_bit(idx, lock_classes_in_use)) ++ continue; + + if (class->usage_mask == 0) + nr_unused++; +@@ -252,6 +276,7 @@ static int lockdep_stats_show(struct seq_file *m, void *v) + + sum_forward_deps += lockdep_count_forward_deps(class); + } ++ + #ifdef CONFIG_DEBUG_LOCKDEP + DEBUG_LOCKS_WARN_ON(debug_atomic_read(nr_unused_locks) != nr_unused); + #endif +@@ -343,6 +368,8 @@ static int lockdep_stats_show(struct seq_file *m, void *v) + seq_printf(m, " max bfs queue depth: %11u\n", + max_bfs_queue_depth); + #endif ++ seq_printf(m, " max lock class index: %11lu\n", ++ max_lock_class_idx); + lockdep_stats_debug_show(m); + seq_printf(m, " debug_locks: %11u\n", + debug_locks); +@@ -620,12 +647,16 @@ static int lock_stat_open(struct inode *inode, struct file *file) + if (!res) { + struct lock_stat_data *iter = data->stats; + struct seq_file *m = file->private_data; ++ unsigned long idx; + +- list_for_each_entry(class, &all_lock_classes, lock_entry) { ++ iterate_lock_classes(idx, class) { ++ if (!test_bit(idx, lock_classes_in_use)) ++ continue; + iter->class = class; + iter->stats = lock_stats(class); + iter++; + } ++ + data->iter_end = iter; + + sort(data->stats, data->iter_end - data->stats, +@@ -643,6 +674,7 @@ static ssize_t lock_stat_write(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) + { + struct lock_class *class; ++ unsigned long idx; + char c; + + if (count) { +@@ -652,8 +684,11 @@ static ssize_t lock_stat_write(struct file *file, const char __user *buf, + if (c != '0') + return count; + +- list_for_each_entry(class, &all_lock_classes, lock_entry) ++ iterate_lock_classes(idx, class) { ++ if (!test_bit(idx, lock_classes_in_use)) ++ continue; + clear_lock_stats(class); ++ } + } + return count; + } +-- +2.34.1 + diff --git a/queue-5.10/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch b/queue-5.10/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch new file mode 100644 index 00000000000..78fa8c4de07 --- /dev/null +++ b/queue-5.10/loop-use-sysfs_emit-in-the-sysfs-xxx-show.patch @@ -0,0 +1,73 @@ +From e7d14a6496e0e5c43f051ae89899ff4505c22025 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Feb 2022 13:33:07 -0800 +Subject: loop: use sysfs_emit() in the sysfs xxx show() + +From: Chaitanya Kulkarni + +[ Upstream commit b27824d31f09ea7b4a6ba2c1b18bd328df3e8bed ] + +sprintf does not know the PAGE_SIZE maximum of the temporary buffer +used for outputting sysfs content and it's possible to overrun the +PAGE_SIZE buffer length. + +Use a generic sysfs_emit function that knows the size of the +temporary buffer and ensures that no overrun is done for offset +attribute in +loop_attr_[offset|sizelimit|autoclear|partscan|dio]_show() callbacks. + +Signed-off-by: Chaitanya Kulkarni +Reviewed-by: Himanshu Madhani +Link: https://lore.kernel.org/r/20220215213310.7264-2-kch@nvidia.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/loop.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index ee537a9f1d1a..e4517d483bdc 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -797,33 +797,33 @@ static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf) + + static ssize_t loop_attr_offset_show(struct loop_device *lo, char *buf) + { +- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_offset); ++ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_offset); + } + + static ssize_t loop_attr_sizelimit_show(struct loop_device *lo, char *buf) + { +- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); ++ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); + } + + static ssize_t loop_attr_autoclear_show(struct loop_device *lo, char *buf) + { + int autoclear = (lo->lo_flags & LO_FLAGS_AUTOCLEAR); + +- return sprintf(buf, "%s\n", autoclear ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", autoclear ? "1" : "0"); + } + + static ssize_t loop_attr_partscan_show(struct loop_device *lo, char *buf) + { + int partscan = (lo->lo_flags & LO_FLAGS_PARTSCAN); + +- return sprintf(buf, "%s\n", partscan ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", partscan ? "1" : "0"); + } + + static ssize_t loop_attr_dio_show(struct loop_device *lo, char *buf) + { + int dio = (lo->lo_flags & LO_FLAGS_DIRECT_IO); + +- return sprintf(buf, "%s\n", dio ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", dio ? "1" : "0"); + } + + LOOP_ATTR_RO(backing_file); +-- +2.34.1 + diff --git a/queue-5.10/lsm-general-protection-fault-in-legacy_parse_param.patch b/queue-5.10/lsm-general-protection-fault-in-legacy_parse_param.patch new file mode 100644 index 00000000000..74e9bc3f8ea --- /dev/null +++ b/queue-5.10/lsm-general-protection-fault-in-legacy_parse_param.patch @@ -0,0 +1,79 @@ +From 5dfc7e97345c117d1e569c70f6fb10bf44bfe15f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 27 Jan 2022 04:51:00 +0000 +Subject: LSM: general protection fault in legacy_parse_param + +From: Casey Schaufler + +[ Upstream commit ecff30575b5ad0eda149aadad247b7f75411fd47 ] + +The usual LSM hook "bail on fail" scheme doesn't work for cases where +a security module may return an error code indicating that it does not +recognize an input. In this particular case Smack sees a mount option +that it recognizes, and returns 0. A call to a BPF hook follows, which +returns -ENOPARAM, which confuses the caller because Smack has processed +its data. + +The SELinux hook incorrectly returns 1 on success. There was a time +when this was correct, however the current expectation is that it +return 0 on success. This is repaired. + +Reported-by: syzbot+d1e3b1d92d25abf97943@syzkaller.appspotmail.com +Signed-off-by: Casey Schaufler +Acked-by: James Morris +Signed-off-by: Paul Moore +Signed-off-by: Sasha Levin +--- + security/security.c | 17 +++++++++++++++-- + security/selinux/hooks.c | 5 ++--- + 2 files changed, 17 insertions(+), 5 deletions(-) + +diff --git a/security/security.c b/security/security.c +index a864ff824dd3..d9d42d64f89f 100644 +--- a/security/security.c ++++ b/security/security.c +@@ -860,9 +860,22 @@ int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc) + return call_int_hook(fs_context_dup, 0, fc, src_fc); + } + +-int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param) ++int security_fs_context_parse_param(struct fs_context *fc, ++ struct fs_parameter *param) + { +- return call_int_hook(fs_context_parse_param, -ENOPARAM, fc, param); ++ struct security_hook_list *hp; ++ int trc; ++ int rc = -ENOPARAM; ++ ++ hlist_for_each_entry(hp, &security_hook_heads.fs_context_parse_param, ++ list) { ++ trc = hp->hook.fs_context_parse_param(fc, param); ++ if (trc == 0) ++ rc = 0; ++ else if (trc != -ENOPARAM) ++ return trc; ++ } ++ return rc; + } + + int security_sb_alloc(struct super_block *sb) +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 86159b32921c..63e61f2f1ad6 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -2820,10 +2820,9 @@ static int selinux_fs_context_parse_param(struct fs_context *fc, + return opt; + + rc = selinux_add_opt(opt, param->string, &fc->security); +- if (!rc) { ++ if (!rc) + param->string = NULL; +- rc = 1; +- } ++ + return rc; + } + +-- +2.34.1 + diff --git a/queue-5.10/m68k-coldfire-device.c-only-build-for-mcf_edma-when-.patch b/queue-5.10/m68k-coldfire-device.c-only-build-for-mcf_edma-when-.patch new file mode 100644 index 00000000000..5257443a1e2 --- /dev/null +++ b/queue-5.10/m68k-coldfire-device.c-only-build-for-mcf_edma-when-.patch @@ -0,0 +1,84 @@ +From cea1998907c2b3e826bdb931366dde7f6fbab1a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 22:40:36 -0800 +Subject: m68k: coldfire/device.c: only build for MCF_EDMA when h/w macros are + defined + +From: Randy Dunlap + +[ Upstream commit e6e1e7b19fa132d23d09c465942aab4c110d3da9 ] + +When CONFIG_MCF_EDMA is set (due to COMPILE_TEST, not due to +CONFIG_M5441x), coldfire/device.c has compile errors due to +missing MCFEDMA_* symbols. In the .config file that was provided, +CONFIG_M5206=y, not CONFIG_M5441x, so is not +included in coldfire/device.c. + +Only build the MCF_EDMA code in coldfire/device.c if the MCFEDMA_* +hardware macros are defined. + +Fixes these build errors: + +../arch/m68k/coldfire/device.c:512:35: error: 'MCFEDMA_BASE' undeclared here (not in a function); did you mean 'MCFDMA_BASE1'? + 512 | .start = MCFEDMA_BASE, +../arch/m68k/coldfire/device.c:513:50: error: 'MCFEDMA_SIZE' undeclared here (not in a function) + 513 | .end = MCFEDMA_BASE + MCFEDMA_SIZE - 1, +../arch/m68k/coldfire/device.c:517:35: error: 'MCFEDMA_IRQ_INTR0' undeclared here (not in a function) + 517 | .start = MCFEDMA_IRQ_INTR0, +../arch/m68k/coldfire/device.c:523:35: error: 'MCFEDMA_IRQ_INTR16' undeclared here (not in a function) + 523 | .start = MCFEDMA_IRQ_INTR16, +../arch/m68k/coldfire/device.c:529:35: error: 'MCFEDMA_IRQ_INTR56' undeclared here (not in a function) + 529 | .start = MCFEDMA_IRQ_INTR56, +../arch/m68k/coldfire/device.c:535:35: error: 'MCFEDMA_IRQ_ERR' undeclared here (not in a function) + 535 | .start = MCFEDMA_IRQ_ERR, + +Fixes: d7e9d01ac292 ("m68k: add ColdFire mcf5441x eDMA platform support") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Link: lore.kernel.org/r/202203030252.P752DK46-lkp@intel.com +Cc: Angelo Dureghello +Cc: Greg Ungerer +Cc: Greg Ungerer +Cc: Geert Uytterhoeven +Cc: linux-m68k@lists.linux-m68k.org +Cc: uclinux-dev@uclinux.org +Signed-off-by: Greg Ungerer +Signed-off-by: Sasha Levin +--- + arch/m68k/coldfire/device.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/arch/m68k/coldfire/device.c b/arch/m68k/coldfire/device.c +index 59f7dfe50a4d..a055616942a1 100644 +--- a/arch/m68k/coldfire/device.c ++++ b/arch/m68k/coldfire/device.c +@@ -480,7 +480,7 @@ static struct platform_device mcf_i2c5 = { + #endif /* MCFI2C_BASE5 */ + #endif /* IS_ENABLED(CONFIG_I2C_IMX) */ + +-#if IS_ENABLED(CONFIG_MCF_EDMA) ++#ifdef MCFEDMA_BASE + + static const struct dma_slave_map mcf_edma_map[] = { + { "dreq0", "rx-tx", MCF_EDMA_FILTER_PARAM(0) }, +@@ -552,7 +552,7 @@ static struct platform_device mcf_edma = { + .platform_data = &mcf_edma_data, + } + }; +-#endif /* IS_ENABLED(CONFIG_MCF_EDMA) */ ++#endif /* MCFEDMA_BASE */ + + #ifdef MCFSDHC_BASE + static struct mcf_esdhc_platform_data mcf_esdhc_data = { +@@ -610,7 +610,7 @@ static struct platform_device *mcf_devices[] __initdata = { + &mcf_i2c5, + #endif + #endif +-#if IS_ENABLED(CONFIG_MCF_EDMA) ++#ifdef MCFEDMA_BASE + &mcf_edma, + #endif + #ifdef MCFSDHC_BASE +-- +2.34.1 + diff --git a/queue-5.10/media-aspeed-correct-value-for-h-total-pixels.patch b/queue-5.10/media-aspeed-correct-value-for-h-total-pixels.patch new file mode 100644 index 00000000000..c755cef0a83 --- /dev/null +++ b/queue-5.10/media-aspeed-correct-value-for-h-total-pixels.patch @@ -0,0 +1,74 @@ +From b0439eb838842c2ab29a45c055afec4a4e61c104 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 07:44:07 +0100 +Subject: media: aspeed: Correct value for h-total-pixels + +From: Jammy Huang + +[ Upstream commit 4b732a0016853eaff35944f900b0db66f3914374 ] + +Previous reg-field, 0x98[11:0], stands for the period of the detected +hsync signal. +Use the correct reg, 0xa0, to get h-total in pixels. + +Fixes: d2b4387f3bdf ("media: platform: Add Aspeed Video Engine driver") +Signed-off-by: Jammy Huang +Reviewed-by: Joel Stanley +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/aspeed-video.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/platform/aspeed-video.c b/drivers/media/platform/aspeed-video.c +index debc7509c173..757a58829a51 100644 +--- a/drivers/media/platform/aspeed-video.c ++++ b/drivers/media/platform/aspeed-video.c +@@ -151,7 +151,7 @@ + #define VE_SRC_TB_EDGE_DET_BOT GENMASK(28, VE_SRC_TB_EDGE_DET_BOT_SHF) + + #define VE_MODE_DETECT_STATUS 0x098 +-#define VE_MODE_DETECT_H_PIXELS GENMASK(11, 0) ++#define VE_MODE_DETECT_H_PERIOD GENMASK(11, 0) + #define VE_MODE_DETECT_V_LINES_SHF 16 + #define VE_MODE_DETECT_V_LINES GENMASK(27, VE_MODE_DETECT_V_LINES_SHF) + #define VE_MODE_DETECT_STATUS_VSYNC BIT(28) +@@ -162,6 +162,8 @@ + #define VE_SYNC_STATUS_VSYNC_SHF 16 + #define VE_SYNC_STATUS_VSYNC GENMASK(27, VE_SYNC_STATUS_VSYNC_SHF) + ++#define VE_H_TOTAL_PIXELS 0x0A0 ++ + #define VE_INTERRUPT_CTRL 0x304 + #define VE_INTERRUPT_STATUS 0x308 + #define VE_INTERRUPT_MODE_DETECT_WD BIT(0) +@@ -765,6 +767,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + u32 src_lr_edge; + u32 src_tb_edge; + u32 sync; ++ u32 htotal; + struct v4l2_bt_timings *det = &video->detected_timings; + + det->width = MIN_WIDTH; +@@ -809,6 +812,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + src_tb_edge = aspeed_video_read(video, VE_SRC_TB_EDGE_DET); + mds = aspeed_video_read(video, VE_MODE_DETECT_STATUS); + sync = aspeed_video_read(video, VE_SYNC_STATUS); ++ htotal = aspeed_video_read(video, VE_H_TOTAL_PIXELS); + + video->frame_bottom = (src_tb_edge & VE_SRC_TB_EDGE_DET_BOT) >> + VE_SRC_TB_EDGE_DET_BOT_SHF; +@@ -825,8 +829,7 @@ static void aspeed_video_get_resolution(struct aspeed_video *video) + VE_SRC_LR_EDGE_DET_RT_SHF; + video->frame_left = src_lr_edge & VE_SRC_LR_EDGE_DET_LEFT; + det->hfrontporch = video->frame_left; +- det->hbackporch = (mds & VE_MODE_DETECT_H_PIXELS) - +- video->frame_right; ++ det->hbackporch = htotal - video->frame_right; + det->hsync = sync & VE_SYNC_STATUS_HSYNC; + if (video->frame_left > video->frame_right) + continue; +-- +2.34.1 + diff --git a/queue-5.10/media-atomisp-fix-bad-usage-at-error-handling-logic.patch b/queue-5.10/media-atomisp-fix-bad-usage-at-error-handling-logic.patch new file mode 100644 index 00000000000..05fa87f7ff1 --- /dev/null +++ b/queue-5.10/media-atomisp-fix-bad-usage-at-error-handling-logic.patch @@ -0,0 +1,95 @@ +From 50fbcefb3a430c2efd65ba1fb3bd9049e9599254 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Mar 2022 18:11:38 +0100 +Subject: media: atomisp: fix bad usage at error handling logic + +From: Mauro Carvalho Chehab + +[ Upstream commit fc0b582c858ed73f94c8f3375c203ea46f1f7402 ] + +As warned by sparse: + atomisp: drivers/staging/media/atomisp/pci/atomisp_acc.c:508 atomisp_acc_load_extensions() warn: iterator used outside loop: 'acc_fw' + +The acc_fw interactor is used outside the loop, at the error handling +logic. On most cases, this is actually safe there, but, if +atomisp_css_set_acc_parameters() has an error, an attempt to use it +will pick an invalid value for acc_fw. + +Reported-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../staging/media/atomisp/pci/atomisp_acc.c | 28 +++++++++++++------ + 1 file changed, 19 insertions(+), 9 deletions(-) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_acc.c b/drivers/staging/media/atomisp/pci/atomisp_acc.c +index f638d0bd09fe..b1614cce2dfb 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_acc.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_acc.c +@@ -439,6 +439,18 @@ int atomisp_acc_s_mapped_arg(struct atomisp_sub_device *asd, + return 0; + } + ++static void atomisp_acc_unload_some_extensions(struct atomisp_sub_device *asd, ++ int i, ++ struct atomisp_acc_fw *acc_fw) ++{ ++ while (--i >= 0) { ++ if (acc_fw->flags & acc_flag_to_pipe[i].flag) { ++ atomisp_css_unload_acc_extension(asd, acc_fw->fw, ++ acc_flag_to_pipe[i].pipe_id); ++ } ++ } ++} ++ + /* + * Appends the loaded acceleration binary extensions to the + * current ISP mode. Must be called just before sh_css_start(). +@@ -477,16 +489,20 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd) + acc_fw->fw, + acc_flag_to_pipe[i].pipe_id, + acc_fw->type); +- if (ret) ++ if (ret) { ++ atomisp_acc_unload_some_extensions(asd, i, acc_fw); + goto error; ++ } + + ext_loaded = true; + } + } + + ret = atomisp_css_set_acc_parameters(acc_fw); +- if (ret < 0) ++ if (ret < 0) { ++ atomisp_acc_unload_some_extensions(asd, i, acc_fw); + goto error; ++ } + } + + if (!ext_loaded) +@@ -495,6 +511,7 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd) + ret = atomisp_css_update_stream(asd); + if (ret) { + dev_err(isp->dev, "%s: update stream failed.\n", __func__); ++ atomisp_acc_unload_extensions(asd); + goto error; + } + +@@ -502,13 +519,6 @@ int atomisp_acc_load_extensions(struct atomisp_sub_device *asd) + return 0; + + error: +- while (--i >= 0) { +- if (acc_fw->flags & acc_flag_to_pipe[i].flag) { +- atomisp_css_unload_acc_extension(asd, acc_fw->fw, +- acc_flag_to_pipe[i].pipe_id); +- } +- } +- + list_for_each_entry_continue_reverse(acc_fw, &asd->acc.fw, list) { + if (acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_OUTPUT && + acc_fw->type != ATOMISP_ACC_FW_LOAD_TYPE_VIEWFINDER) +-- +2.34.1 + diff --git a/queue-5.10/media-atomisp-fix-dummy_ptr-check-to-avoid-duplicate.patch b/queue-5.10/media-atomisp-fix-dummy_ptr-check-to-avoid-duplicate.patch new file mode 100644 index 00000000000..e037609de94 --- /dev/null +++ b/queue-5.10/media-atomisp-fix-dummy_ptr-check-to-avoid-duplicate.patch @@ -0,0 +1,116 @@ +From 790312c59eb85edb5e902258b9f9edeca0b9de3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Oct 2021 18:23:33 +0200 +Subject: media: atomisp: fix dummy_ptr check to avoid duplicate active_bo + +From: Tsuchiya Yuto + +[ Upstream commit 127efdbc51fe6064336c0452ce9c910b3e107cf0 ] + +The dummy_ptr check in hmm_init() [1] results in the following +"hmm_init Failed to create sysfs" error exactly once every +two times on atomisp reload by rmmod/insmod (although atomisp module +loads and works fine regardless of this error): + + [ 140.230662] sysfs: cannot create duplicate filename '/devices/pci0000:00/0000:00:03.0/active_bo' + [ 140.230668] CPU: 1 PID: 2502 Comm: insmod Tainted: G C OE 5.15.0-rc4-1-surface-mainline #1 b8acf6eb64994414b2e20bad312a7a2c45f748f9 + [ 140.230675] Hardware name: OEMB OEMB/OEMB, BIOS 1.51116.238 03/09/2015 + [ 140.230678] Call Trace: + [ 140.230687] dump_stack_lvl+0x46/0x5a + [ 140.230702] sysfs_warn_dup.cold+0x17/0x24 + [ 140.230710] sysfs_add_file_mode_ns+0x160/0x170 + [ 140.230717] internal_create_group+0x126/0x390 + [ 140.230723] hmm_init+0x5c/0x70 [atomisp 7a6a680bf400629363d2a6f58fd10e7299678b99] + [ 140.230811] atomisp_pci_probe.cold+0x1136/0x148e [atomisp 7a6a680bf400629363d2a6f58fd10e7299678b99] + [ 140.230875] local_pci_probe+0x45/0x80 + [ 140.230882] ? pci_match_device+0xd7/0x130 + [ 140.230887] pci_device_probe+0xfa/0x1b0 + [ 140.230892] really_probe+0x1f5/0x3f0 + [ 140.230899] __driver_probe_device+0xfe/0x180 + [ 140.230903] driver_probe_device+0x1e/0x90 + [ 140.230908] __driver_attach+0xc0/0x1c0 + [ 140.230912] ? __device_attach_driver+0xe0/0xe0 + [ 140.230915] ? __device_attach_driver+0xe0/0xe0 + [ 140.230919] bus_for_each_dev+0x89/0xd0 + [ 140.230924] bus_add_driver+0x12b/0x1e0 + [ 140.230929] driver_register+0x8f/0xe0 + [ 140.230933] ? 0xffffffffc153f000 + [ 140.230937] do_one_initcall+0x57/0x220 + [ 140.230945] do_init_module+0x5c/0x260 + [ 140.230952] load_module+0x24bd/0x26a0 + [ 140.230962] ? __do_sys_finit_module+0xae/0x110 + [ 140.230966] __do_sys_finit_module+0xae/0x110 + [ 140.230972] do_syscall_64+0x5c/0x80 + [ 140.230979] ? syscall_exit_to_user_mode+0x23/0x40 + [ 140.230983] ? do_syscall_64+0x69/0x80 + [ 140.230988] ? exc_page_fault+0x72/0x170 + [ 140.230991] entry_SYSCALL_64_after_hwframe+0x44/0xae + [ 140.230997] RIP: 0033:0x7f7fd5d8718d + [ 140.231003] Code: b4 0c 00 0f 05 eb a9 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b3 6c 0c 00 f7 d8 64 89 01 48 + [ 140.231006] RSP: 002b:00007ffefc25f0e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 + [ 140.231012] RAX: ffffffffffffffda RBX: 000055ac3edcd7f0 RCX: 00007f7fd5d8718d + [ 140.231015] RDX: 0000000000000000 RSI: 000055ac3d723270 RDI: 0000000000000003 + [ 140.231017] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007f7fd5e52380 + [ 140.231019] R10: 0000000000000003 R11: 0000000000000246 R12: 000055ac3d723270 + [ 140.231021] R13: 0000000000000000 R14: 000055ac3edd06e0 R15: 0000000000000000 + [ 140.231038] atomisp-isp2 0000:00:03.0: hmm_init Failed to create sysfs + +The problem is that dummy_ptr == 0 is a valid value. So, change the logic +which checks if dummy_ptr was allocated. + +At this point, atomisp now gives WARN_ON() in hmm_free() [2] on atomisp +reload by rmmod/insmod. Again, the check is wrong there. + +So, change both checks for mmgr_EXCEPTION, which is the error value when +HMM allocation fails, and initialize dummy_ptr with such value. + +[1] added on commit + d9ab83953fa7 ("media: atomisp: don't cause a warn if probe failed") +[2] added on commit + b83cc378dfc4 ("atomisp: clean up the hmm init/cleanup indirections") + +Link: https://lore.kernel.org/linux-media/20211017162337.44860-3-kitakar@gmail.com + +Signed-off-by: Tsuchiya Yuto +Co-developed-by: Mauro Carvalho Chehab +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/pci/hmm/hmm.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/staging/media/atomisp/pci/hmm/hmm.c b/drivers/staging/media/atomisp/pci/hmm/hmm.c +index 6a5ee4607089..c1cda16f2dc0 100644 +--- a/drivers/staging/media/atomisp/pci/hmm/hmm.c ++++ b/drivers/staging/media/atomisp/pci/hmm/hmm.c +@@ -39,7 +39,7 @@ + struct hmm_bo_device bo_device; + struct hmm_pool dynamic_pool; + struct hmm_pool reserved_pool; +-static ia_css_ptr dummy_ptr; ++static ia_css_ptr dummy_ptr = mmgr_EXCEPTION; + static bool hmm_initialized; + struct _hmm_mem_stat hmm_mem_stat; + +@@ -209,7 +209,7 @@ int hmm_init(void) + + void hmm_cleanup(void) + { +- if (!dummy_ptr) ++ if (dummy_ptr == mmgr_EXCEPTION) + return; + sysfs_remove_group(&atomisp_dev->kobj, atomisp_attribute_group); + +@@ -288,7 +288,8 @@ void hmm_free(ia_css_ptr virt) + + dev_dbg(atomisp_dev, "%s: free 0x%08x\n", __func__, virt); + +- WARN_ON(!virt); ++ if (WARN_ON(virt == mmgr_EXCEPTION)) ++ return; + + bo = hmm_bo_device_search_start(&bo_device, (unsigned int)virt); + +-- +2.34.1 + diff --git a/queue-5.10/media-atomisp_gmin_platform-add-dmi-quirk-to-not-tur.patch b/queue-5.10/media-atomisp_gmin_platform-add-dmi-quirk-to-not-tur.patch new file mode 100644 index 00000000000..4d5867d3fa7 --- /dev/null +++ b/queue-5.10/media-atomisp_gmin_platform-add-dmi-quirk-to-not-tur.patch @@ -0,0 +1,68 @@ +From 3131e7c84707af8f31896a5cbabe6bd5c1a65a8e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Jan 2022 22:52:04 +0100 +Subject: media: atomisp_gmin_platform: Add DMI quirk to not turn AXP ELDO2 + regulator off on some boards + +From: Hans de Goede + +[ Upstream commit 2c39a01154ea57d596470afa1d278e3be3b37f6a ] + +The TrekStor SurfTab duo W1 10.1 has a hw bug where turning eldo2 back on +after having turned it off causes the CPLM3218 ambient-light-sensor on +the front camera sensor's I2C bus to crash, hanging the bus. + +Add a DMI quirk table for systems on which to leave eldo2 on. + +Note an alternative fix is to turn off the CPLM3218 ambient-light-sensor +as long as the camera sensor is being used, this is what Windows seems +to do as a workaround (based on analyzing the DSDT). But that is not +easy to do cleanly under Linux. + +Link: https://lore.kernel.org/linux-media/20220116215204.307649-10-hdegoede@redhat.com +Signed-off-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + .../media/atomisp/pci/atomisp_gmin_platform.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +index 34480ca16474..c9ee85037644 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c ++++ b/drivers/staging/media/atomisp/pci/atomisp_gmin_platform.c +@@ -729,6 +729,21 @@ static int axp_regulator_set(struct device *dev, struct gmin_subdev *gs, + return 0; + } + ++/* ++ * Some boards contain a hw-bug where turning eldo2 back on after having turned ++ * it off causes the CPLM3218 ambient-light-sensor on the image-sensor's I2C bus ++ * to crash, hanging the bus. Do not turn eldo2 off on these systems. ++ */ ++static const struct dmi_system_id axp_leave_eldo2_on_ids[] = { ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "TrekStor"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "SurfTab duo W1 10.1 (VT4)"), ++ }, ++ }, ++ { } ++}; ++ + static int axp_v1p8_on(struct device *dev, struct gmin_subdev *gs) + { + int ret; +@@ -763,6 +778,9 @@ static int axp_v1p8_off(struct device *dev, struct gmin_subdev *gs) + if (ret) + return ret; + ++ if (dmi_check_system(axp_leave_eldo2_on_ids)) ++ return 0; ++ + ret = axp_regulator_set(dev, gs, gs->eldo2_sel_reg, gs->eldo2_1p8v, + ELDO_CTRL_REG, gs->eldo2_ctrl_shift, false); + return ret; +-- +2.34.1 + diff --git a/queue-5.10/media-bttv-fix-warning-regression-on-tunerless-devic.patch b/queue-5.10/media-bttv-fix-warning-regression-on-tunerless-devic.patch new file mode 100644 index 00000000000..b57bde5cb70 --- /dev/null +++ b/queue-5.10/media-bttv-fix-warning-regression-on-tunerless-devic.patch @@ -0,0 +1,50 @@ +From f918f49d4524b7473b63ff03008dac34977dd905 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 25 Dec 2021 22:58:44 +0100 +Subject: media: bttv: fix WARNING regression on tunerless devices + +From: Ondrej Zary + +[ Upstream commit ef058cc8b7193d15a771272359c7454839ae74ee ] + +Commit 2161536516ed ("media: media/pci: set device_caps in struct video_device") +introduced a regression: V4L2_CAP_TUNER is always present in device_caps, +even when the device has no tuner. + +This causes a warning: +WARNING: CPU: 0 PID: 249 at drivers/media/v4l2-core/v4l2-ioctl.c:1102 v4l_querycap+0xa0/0xb0 [videodev] + +Fixes: 2161536516ed ("media: media/pci: set device_caps in struct video_device") +Signed-off-by: Ondrej Zary +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/bt8xx/bttv-driver.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c +index 35a51e9b539d..1f0e4b913a05 100644 +--- a/drivers/media/pci/bt8xx/bttv-driver.c ++++ b/drivers/media/pci/bt8xx/bttv-driver.c +@@ -3898,7 +3898,7 @@ static int bttv_register_video(struct bttv *btv) + + /* video */ + vdev_init(btv, &btv->video_dev, &bttv_video_template, "video"); +- btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE | V4L2_CAP_TUNER | ++ btv->video_dev.device_caps = V4L2_CAP_VIDEO_CAPTURE | + V4L2_CAP_READWRITE | V4L2_CAP_STREAMING; + if (btv->tuner_type != TUNER_ABSENT) + btv->video_dev.device_caps |= V4L2_CAP_TUNER; +@@ -3919,7 +3919,7 @@ static int bttv_register_video(struct bttv *btv) + /* vbi */ + vdev_init(btv, &btv->vbi_dev, &bttv_video_template, "vbi"); + btv->vbi_dev.device_caps = V4L2_CAP_VBI_CAPTURE | V4L2_CAP_READWRITE | +- V4L2_CAP_STREAMING | V4L2_CAP_TUNER; ++ V4L2_CAP_STREAMING; + if (btv->tuner_type != TUNER_ABSENT) + btv->vbi_dev.device_caps |= V4L2_CAP_TUNER; + +-- +2.34.1 + diff --git a/queue-5.10/media-cedrus-h264-fix-neighbour-info-buffer-size.patch b/queue-5.10/media-cedrus-h264-fix-neighbour-info-buffer-size.patch new file mode 100644 index 00000000000..39a354e2ee9 --- /dev/null +++ b/queue-5.10/media-cedrus-h264-fix-neighbour-info-buffer-size.patch @@ -0,0 +1,44 @@ +From 679963a6fe820a10d7a5b50ab28e77bc07c53171 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Feb 2022 20:08:39 +0100 +Subject: media: cedrus: h264: Fix neighbour info buffer size + +From: Jernej Skrabec + +[ Upstream commit fecd363ae2d5042553370b0adf60c47e35c34a83 ] + +According to BSP library source, H264 neighbour info buffer size needs +to be 32 kiB for H6. This is similar to H265 decoding, which also needs +double buffer size in comparison to older Cedrus core generations. + +Increase buffer size to cover H6 needs. Since increase is not that big +in absolute numbers, it doesn't make sense to complicate logic for older +generations. + +Issue was discovered using iommu and cross checked with BSP library +source. + +Fixes: 6eb9b758e307 ("media: cedrus: Add H264 decoding support") +Signed-off-by: Jernej Skrabec +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/sunxi/cedrus/cedrus_h264.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c +index de7442d4834d..d3e26bfe6c90 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus_h264.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h264.c +@@ -38,7 +38,7 @@ struct cedrus_h264_sram_ref_pic { + + #define CEDRUS_H264_FRAME_NUM 18 + +-#define CEDRUS_NEIGHBOR_INFO_BUF_SIZE (16 * SZ_1K) ++#define CEDRUS_NEIGHBOR_INFO_BUF_SIZE (32 * SZ_1K) + #define CEDRUS_MIN_PIC_INFO_BUF_SIZE (130 * SZ_1K) + + static void cedrus_h264_write_sram(struct cedrus_dev *dev, +-- +2.34.1 + diff --git a/queue-5.10/media-cedrus-h265-fix-neighbour-info-buffer-size.patch b/queue-5.10/media-cedrus-h265-fix-neighbour-info-buffer-size.patch new file mode 100644 index 00000000000..093d308485d --- /dev/null +++ b/queue-5.10/media-cedrus-h265-fix-neighbour-info-buffer-size.patch @@ -0,0 +1,44 @@ +From 40e6c230b11e119eb79e72fe557331a187962715 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 12 Feb 2022 08:42:41 +0100 +Subject: media: cedrus: H265: Fix neighbour info buffer size + +From: Jernej Skrabec + +[ Upstream commit ee8b887329c78971967506f3ac79b9302c9f83c1 ] + +Neighbour info buffer size needs to be 794 kiB in H6. This is actually +already indirectly mentioned in the comment, but smaller size is used +nevertheless. + +Increase buffer size to cover H6 needs. Since increase is not that big +in absolute numbers, it doesn't make sense to complicate logic for older +generations. + +Bug was discovered using iommu, which reported access error when trying +to play H265 video. + +Fixes: 86caab29da78 ("media: cedrus: Add HEVC/H.265 decoding support") +Signed-off-by: Jernej Skrabec +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/staging/media/sunxi/cedrus/cedrus_h265.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c +index 10744fab7cea..368439cf5e17 100644 +--- a/drivers/staging/media/sunxi/cedrus/cedrus_h265.c ++++ b/drivers/staging/media/sunxi/cedrus/cedrus_h265.c +@@ -23,7 +23,7 @@ + * Subsequent BSP implementations seem to double the neighbor info buffer size + * for the H6 SoC, which may be related to 10 bit H265 support. + */ +-#define CEDRUS_H265_NEIGHBOR_INFO_BUF_SIZE (397 * SZ_1K) ++#define CEDRUS_H265_NEIGHBOR_INFO_BUF_SIZE (794 * SZ_1K) + #define CEDRUS_H265_ENTRY_POINTS_BUF_SIZE (4 * SZ_1K) + #define CEDRUS_H265_MV_COL_BUF_UNIT_CTB_SIZE 160 + +-- +2.34.1 + diff --git a/queue-5.10/media-coda-fix-missing-put_device-call-in-coda_get_v.patch b/queue-5.10/media-coda-fix-missing-put_device-call-in-coda_get_v.patch new file mode 100644 index 00000000000..f25e94522eb --- /dev/null +++ b/queue-5.10/media-coda-fix-missing-put_device-call-in-coda_get_v.patch @@ -0,0 +1,37 @@ +From 04d04f22205c4ad4a6ff2b80f842f6a0a71713f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Jan 2022 12:05:54 +0100 +Subject: media: coda: Fix missing put_device() call in coda_get_vdoa_data + +From: Miaoqian Lin + +[ Upstream commit ca85d271531a1e1c86f24b892f57b7d0a3ddb5a6 ] + +The reference taken by 'of_find_device_by_node()' must be released when +not needed anymore. +Add the corresponding 'put_device()' in the error handling path. + +Fixes: e7f3c5481035 ("[media] coda: use VDOA for un-tiling custom macroblock format") +Signed-off-by: Miaoqian Lin +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/coda/coda-common.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index 1eed69d29149..2333079a83c7 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -408,6 +408,7 @@ static struct vdoa_data *coda_get_vdoa_data(void) + if (!vdoa_data) + vdoa_data = ERR_PTR(-EPROBE_DEFER); + ++ put_device(&vdoa_pdev->dev); + out: + of_node_put(vdoa_node); + +-- +2.34.1 + diff --git a/queue-5.10/media-cx88-mpeg-clear-interrupt-status-register-befo.patch b/queue-5.10/media-cx88-mpeg-clear-interrupt-status-register-befo.patch new file mode 100644 index 00000000000..b170bc2abd9 --- /dev/null +++ b/queue-5.10/media-cx88-mpeg-clear-interrupt-status-register-befo.patch @@ -0,0 +1,47 @@ +From ff8213e3eda73e24b67745ac2fbc692dc022d5dd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 20 Feb 2022 19:19:50 +0100 +Subject: media: cx88-mpeg: clear interrupt status register before streaming + video +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Daniel González Cabanelas + +[ Upstream commit 56cb61f70e547e1b0cdfe6ff5a1f1ce6242e6d96 ] + +Some cx88 video cards may have transport stream status interrupts set +to 1 from cold start, causing errors like this: + + cx88xx: cx88_print_irqbits: core:irq mpeg [0x100000] ts_err?* + cx8802: cx8802_mpeg_irq: mpeg:general errors: 0x00100000 + +According to CX2388x datasheet, the interrupt status register should be +cleared before enabling IRQs to stream video. + +Fix it by clearing the Transport Stream Interrupt Status register. + +Signed-off-by: Daniel González Cabanelas +Signed-off-by: Sasha Levin +--- + drivers/media/pci/cx88/cx88-mpeg.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c +index a57c991b165b..10d2971ef062 100644 +--- a/drivers/media/pci/cx88/cx88-mpeg.c ++++ b/drivers/media/pci/cx88/cx88-mpeg.c +@@ -162,6 +162,9 @@ int cx8802_start_dma(struct cx8802_dev *dev, + cx_write(MO_TS_GPCNTRL, GP_COUNT_CONTROL_RESET); + q->count = 0; + ++ /* clear interrupt status register */ ++ cx_write(MO_TS_INTSTAT, 0x1f1111); ++ + /* enable irqs */ + dprintk(1, "setting the interrupt mask\n"); + cx_set(MO_PCI_INTMSK, core->pci_irqmask | PCI_INT_TSINT); +-- +2.34.1 + diff --git a/queue-5.10/media-em28xx-initialize-refcount-before-kref_get.patch b/queue-5.10/media-em28xx-initialize-refcount-before-kref_get.patch new file mode 100644 index 00000000000..60273bb0a19 --- /dev/null +++ b/queue-5.10/media-em28xx-initialize-refcount-before-kref_get.patch @@ -0,0 +1,66 @@ +From dad66e6ba720f20b6a42022fe593f9729952ee1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jan 2022 15:44:59 +0800 +Subject: media: em28xx: initialize refcount before kref_get + +From: Dongliang Mu + +[ Upstream commit c08eadca1bdfa099e20a32f8fa4b52b2f672236d ] + +The commit 47677e51e2a4("[media] em28xx: Only deallocate struct +em28xx after finishing all extensions") adds kref_get to many init +functions (e.g., em28xx_audio_init). However, kref_init is called too +late in em28xx_usb_probe, since em28xx_init_dev before will invoke +those init functions and call kref_get function. Then refcount bug +occurs in my local syzkaller instance. + +Fix it by moving kref_init before em28xx_init_dev. This issue occurs +not only in dev but also dev->dev_next. + +Fixes: 47677e51e2a4 ("[media] em28xx: Only deallocate struct em28xx after finishing all extensions") +Reported-by: syzkaller +Signed-off-by: Dongliang Mu +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/em28xx/em28xx-cards.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c +index 87e375562dbb..b6490f611687 100644 +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -3881,6 +3881,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + goto err_free; + } + ++ kref_init(&dev->ref); ++ + dev->devno = nr; + dev->model = id->driver_info; + dev->alt = -1; +@@ -3981,6 +3983,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + } + + if (dev->board.has_dual_ts && em28xx_duplicate_dev(dev) == 0) { ++ kref_init(&dev->dev_next->ref); ++ + dev->dev_next->ts = SECONDARY_TS; + dev->dev_next->alt = -1; + dev->dev_next->is_audio_only = has_vendor_audio && +@@ -4035,12 +4039,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + em28xx_write_reg(dev, 0x0b, 0x82); + mdelay(100); + } +- +- kref_init(&dev->dev_next->ref); + } + +- kref_init(&dev->ref); +- + request_modules(dev); + + /* +-- +2.34.1 + diff --git a/queue-5.10/media-hantro-fix-overfill-bottom-register-field-name.patch b/queue-5.10/media-hantro-fix-overfill-bottom-register-field-name.patch new file mode 100644 index 00000000000..2114fc86be1 --- /dev/null +++ b/queue-5.10/media-hantro-fix-overfill-bottom-register-field-name.patch @@ -0,0 +1,64 @@ +From 562b8b51616758deb9fd3c46af5f2d939f51b9dc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 Jan 2022 10:34:49 +0100 +Subject: media: hantro: Fix overfill bottom register field name + +From: Chen-Yu Tsai + +[ Upstream commit 89d78e0133e71ba324fb67ca776223fba4353418 ] + +The Hantro H1 hardware can crop off pixels from the right and bottom of +the source frame. These are controlled with the H1_REG_IN_IMG_CTRL_OVRFLB +and H1_REG_IN_IMG_CTRL_OVRFLR in the H1_REG_IN_IMG_CTRL register. + +The ChromeOS kernel driver that this was based on incorrectly added the +_D4 suffix H1_REG_IN_IMG_CTRL_OVRFLB. This field crops the bottom of the +input frame, and the number is _not_ divided by 4. [1] + +Correct the name to avoid confusion when crop support with the selection +API is added. + +[1] https://chromium.googlesource.com/chromiumos/third_party/kernel/+/refs/ \ + heads/chromeos-4.19/drivers/staging/media/hantro/hantro_h1_vp8_enc.c#377 + +Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver") +Fixes: a29add8c9bb2 ("media: rockchip/vpu: rename from rockchip to hantro") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/hantro/hantro_h1_jpeg_enc.c | 2 +- + drivers/staging/media/hantro/hantro_h1_regs.h | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c +index b88dc4ed06db..ed244aee196c 100644 +--- a/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c ++++ b/drivers/staging/media/hantro/hantro_h1_jpeg_enc.c +@@ -23,7 +23,7 @@ static void hantro_h1_set_src_img_ctrl(struct hantro_dev *vpu, + + reg = H1_REG_IN_IMG_CTRL_ROW_LEN(pix_fmt->width) + | H1_REG_IN_IMG_CTRL_OVRFLR_D4(0) +- | H1_REG_IN_IMG_CTRL_OVRFLB_D4(0) ++ | H1_REG_IN_IMG_CTRL_OVRFLB(0) + | H1_REG_IN_IMG_CTRL_FMT(ctx->vpu_src_fmt->enc_fmt); + vepu_write_relaxed(vpu, reg, H1_REG_IN_IMG_CTRL); + } +diff --git a/drivers/staging/media/hantro/hantro_h1_regs.h b/drivers/staging/media/hantro/hantro_h1_regs.h +index d6e9825bb5c7..30e7e7b920b5 100644 +--- a/drivers/staging/media/hantro/hantro_h1_regs.h ++++ b/drivers/staging/media/hantro/hantro_h1_regs.h +@@ -47,7 +47,7 @@ + #define H1_REG_IN_IMG_CTRL 0x03c + #define H1_REG_IN_IMG_CTRL_ROW_LEN(x) ((x) << 12) + #define H1_REG_IN_IMG_CTRL_OVRFLR_D4(x) ((x) << 10) +-#define H1_REG_IN_IMG_CTRL_OVRFLB_D4(x) ((x) << 6) ++#define H1_REG_IN_IMG_CTRL_OVRFLB(x) ((x) << 6) + #define H1_REG_IN_IMG_CTRL_FMT(x) ((x) << 2) + #define H1_REG_ENC_CTRL0 0x040 + #define H1_REG_ENC_CTRL0_INIT_QP(x) ((x) << 26) +-- +2.34.1 + diff --git a/queue-5.10/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch b/queue-5.10/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch new file mode 100644 index 00000000000..242cdbd04cb --- /dev/null +++ b/queue-5.10/media-hdpvr-initialize-dev-worker-at-hdpvr_register_.patch @@ -0,0 +1,61 @@ +From f009bdfa4b579c725f88615fff7a16839624f2ad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Feb 2022 10:41:30 +0100 +Subject: media: hdpvr: initialize dev->worker at hdpvr_register_videodev + +From: Dongliang Mu + +[ Upstream commit 07922937e9a580825f9965c46fd15e23ba5754b6 ] + +hdpvr_register_videodev is responsible to initialize a worker in +hdpvr_device. However, the worker is only initialized at +hdpvr_start_streaming other than hdpvr_register_videodev. +When hdpvr_probe does not initialize its worker, the hdpvr_disconnect +will encounter one WARN in flush_work.The stack trace is as follows: + + hdpvr_disconnect+0xb8/0xf2 drivers/media/usb/hdpvr/hdpvr-core.c:425 + usb_unbind_interface+0xbf/0x3a0 drivers/usb/core/driver.c:458 + __device_release_driver drivers/base/dd.c:1206 [inline] + device_release_driver_internal+0x22a/0x230 drivers/base/dd.c:1237 + bus_remove_device+0x108/0x160 drivers/base/bus.c:529 + device_del+0x1fe/0x510 drivers/base/core.c:3592 + usb_disable_device+0xd1/0x1d0 drivers/usb/core/message.c:1419 + usb_disconnect+0x109/0x330 drivers/usb/core/hub.c:2228 + +Fix this by moving the initialization of dev->worker to the starting of +hdpvr_register_videodev + +Reported-by: syzkaller +Signed-off-by: Dongliang Mu +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/hdpvr/hdpvr-video.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c +index 563128d11731..60e57e0f1927 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-video.c ++++ b/drivers/media/usb/hdpvr/hdpvr-video.c +@@ -308,7 +308,6 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev) + + dev->status = STATUS_STREAMING; + +- INIT_WORK(&dev->worker, hdpvr_transmit_buffers); + schedule_work(&dev->worker); + + v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev, +@@ -1165,6 +1164,9 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent, + bool ac3 = dev->flags & HDPVR_FLAG_AC3_CAP; + int res; + ++ // initialize dev->worker ++ INIT_WORK(&dev->worker, hdpvr_transmit_buffers); ++ + dev->cur_std = V4L2_STD_525_60; + dev->width = 720; + dev->height = 480; +-- +2.34.1 + diff --git a/queue-5.10/media-ir_toy-free-before-error-exiting.patch b/queue-5.10/media-ir_toy-free-before-error-exiting.patch new file mode 100644 index 00000000000..266074e35e3 --- /dev/null +++ b/queue-5.10/media-ir_toy-free-before-error-exiting.patch @@ -0,0 +1,35 @@ +From 8430f203d5be28e4868ca266eb4f773ec3a97155 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 29 Dec 2021 02:15:18 +0100 +Subject: media: ir_toy: free before error exiting + +From: Peiwei Hu + +[ Upstream commit 52cdb013036391d9d87aba5b4fc49cdfc6ea4b23 ] + +Fix leak in error path. + +Signed-off-by: Peiwei Hu +Signed-off-by: Sean Young +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/rc/ir_toy.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/media/rc/ir_toy.c b/drivers/media/rc/ir_toy.c +index 1aa7989e756c..7f394277478b 100644 +--- a/drivers/media/rc/ir_toy.c ++++ b/drivers/media/rc/ir_toy.c +@@ -429,7 +429,7 @@ static int irtoy_probe(struct usb_interface *intf, + err = usb_submit_urb(irtoy->urb_in, GFP_KERNEL); + if (err != 0) { + dev_err(irtoy->dev, "fail to submit in urb: %d\n", err); +- return err; ++ goto free_rcdev; + } + + err = irtoy_setup(irtoy); +-- +2.34.1 + diff --git a/queue-5.10/media-meson-vdec-potential-dereference-of-null-point.patch b/queue-5.10/media-meson-vdec-potential-dereference-of-null-point.patch new file mode 100644 index 00000000000..5616be39e06 --- /dev/null +++ b/queue-5.10/media-meson-vdec-potential-dereference-of-null-point.patch @@ -0,0 +1,96 @@ +From 590c0fbb98edd253e306e3056519d225b1aaca79 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jan 2022 07:59:28 +0100 +Subject: media: meson: vdec: potential dereference of null pointer + +From: Jiasheng Jiang + +[ Upstream commit c8c80c996182239ff9b05eda4db50184cf3b2e99 ] + +As the possible failure of the kzalloc(), the 'new_ts' could be NULL +pointer. +Therefore, it should be better to check it in order to avoid the +dereference of the NULL pointer. +Also, the caller esparser_queue() needs to deal with the return value of +the amvdec_add_ts(). + +Fixes: 876f123b8956 ("media: meson: vdec: bring up to compliance") +Signed-off-by: Jiasheng Jiang +Suggested-by: Neil Armstrong +Reviewed-by: Neil Armstrong +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/meson/vdec/esparser.c | 7 ++++++- + drivers/staging/media/meson/vdec/vdec_helpers.c | 8 ++++++-- + drivers/staging/media/meson/vdec/vdec_helpers.h | 4 ++-- + 3 files changed, 14 insertions(+), 5 deletions(-) + +diff --git a/drivers/staging/media/meson/vdec/esparser.c b/drivers/staging/media/meson/vdec/esparser.c +index db7022707ff8..86ccc8937afc 100644 +--- a/drivers/staging/media/meson/vdec/esparser.c ++++ b/drivers/staging/media/meson/vdec/esparser.c +@@ -328,7 +328,12 @@ esparser_queue(struct amvdec_session *sess, struct vb2_v4l2_buffer *vbuf) + + offset = esparser_get_offset(sess); + +- amvdec_add_ts(sess, vb->timestamp, vbuf->timecode, offset, vbuf->flags); ++ ret = amvdec_add_ts(sess, vb->timestamp, vbuf->timecode, offset, vbuf->flags); ++ if (ret) { ++ v4l2_m2m_buf_done(vbuf, VB2_BUF_STATE_ERROR); ++ return ret; ++ } ++ + dev_dbg(core->dev, "esparser: ts = %llu pld_size = %u offset = %08X flags = %08X\n", + vb->timestamp, payload_size, offset, vbuf->flags); + +diff --git a/drivers/staging/media/meson/vdec/vdec_helpers.c b/drivers/staging/media/meson/vdec/vdec_helpers.c +index 7f07a9175815..db4a854e59a3 100644 +--- a/drivers/staging/media/meson/vdec/vdec_helpers.c ++++ b/drivers/staging/media/meson/vdec/vdec_helpers.c +@@ -227,13 +227,16 @@ int amvdec_set_canvases(struct amvdec_session *sess, + } + EXPORT_SYMBOL_GPL(amvdec_set_canvases); + +-void amvdec_add_ts(struct amvdec_session *sess, u64 ts, +- struct v4l2_timecode tc, u32 offset, u32 vbuf_flags) ++int amvdec_add_ts(struct amvdec_session *sess, u64 ts, ++ struct v4l2_timecode tc, u32 offset, u32 vbuf_flags) + { + struct amvdec_timestamp *new_ts; + unsigned long flags; + + new_ts = kzalloc(sizeof(*new_ts), GFP_KERNEL); ++ if (!new_ts) ++ return -ENOMEM; ++ + new_ts->ts = ts; + new_ts->tc = tc; + new_ts->offset = offset; +@@ -242,6 +245,7 @@ void amvdec_add_ts(struct amvdec_session *sess, u64 ts, + spin_lock_irqsave(&sess->ts_spinlock, flags); + list_add_tail(&new_ts->list, &sess->timestamps); + spin_unlock_irqrestore(&sess->ts_spinlock, flags); ++ return 0; + } + EXPORT_SYMBOL_GPL(amvdec_add_ts); + +diff --git a/drivers/staging/media/meson/vdec/vdec_helpers.h b/drivers/staging/media/meson/vdec/vdec_helpers.h +index cfaed52ab526..798e5a8a9b3f 100644 +--- a/drivers/staging/media/meson/vdec/vdec_helpers.h ++++ b/drivers/staging/media/meson/vdec/vdec_helpers.h +@@ -55,8 +55,8 @@ void amvdec_dst_buf_done_offset(struct amvdec_session *sess, + * @offset: offset in the VIFIFO where the associated packet was written + * @flags the vb2_v4l2_buffer flags + */ +-void amvdec_add_ts(struct amvdec_session *sess, u64 ts, +- struct v4l2_timecode tc, u32 offset, u32 flags); ++int amvdec_add_ts(struct amvdec_session *sess, u64 ts, ++ struct v4l2_timecode tc, u32 offset, u32 flags); + void amvdec_remove_ts(struct amvdec_session *sess, u64 ts); + + /** +-- +2.34.1 + diff --git a/queue-5.10/media-mtk-vcodec-potential-dereference-of-null-point.patch b/queue-5.10/media-mtk-vcodec-potential-dereference-of-null-point.patch new file mode 100644 index 00000000000..cd5a7f0d0cf --- /dev/null +++ b/queue-5.10/media-mtk-vcodec-potential-dereference-of-null-point.patch @@ -0,0 +1,38 @@ +From b222b95323a4a8c5bfe40d95a855e824f774a384 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 15 Dec 2021 06:21:57 +0100 +Subject: media: mtk-vcodec: potential dereference of null pointer + +From: Jiasheng Jiang + +[ Upstream commit e25a89f743b18c029bfbe5e1663ae0c7190912b0 ] + +The return value of devm_kzalloc() needs to be checked. +To avoid use of null pointer in case of thefailure of alloc. + +Fixes: 46233e91fa24 ("media: mtk-vcodec: move firmware implementations into their own files") +Signed-off-by: Jiasheng Jiang +Reviewed-by: Tzung-Bi Shih +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c +index cd27f637dbe7..cfc7ebed8fb7 100644 +--- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c ++++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c +@@ -102,6 +102,8 @@ struct mtk_vcodec_fw *mtk_vcodec_fw_vpu_init(struct mtk_vcodec_dev *dev, + vpu_wdt_reg_handler(fw_pdev, mtk_vcodec_vpu_reset_handler, dev, rst_id); + + fw = devm_kzalloc(&dev->plat_dev->dev, sizeof(*fw), GFP_KERNEL); ++ if (!fw) ++ return ERR_PTR(-ENOMEM); + fw->type = VPU; + fw->ops = &mtk_vcodec_vpu_msg; + fw->pdev = fw_pdev; +-- +2.34.1 + diff --git a/queue-5.10/media-revert-media-em28xx-add-missing-em28xx_close_e.patch b/queue-5.10/media-revert-media-em28xx-add-missing-em28xx_close_e.patch new file mode 100644 index 00000000000..733c9a9bef4 --- /dev/null +++ b/queue-5.10/media-revert-media-em28xx-add-missing-em28xx_close_e.patch @@ -0,0 +1,50 @@ +From 04e40562a993c098c4e9c00a1044bd5721cf25f9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jan 2022 20:37:30 +0100 +Subject: media: Revert "media: em28xx: add missing em28xx_close_extension" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pavel Skripkin + +[ Upstream commit fde18c3bac3f964d8333ae53b304d8fee430502b ] + +This reverts commit 2c98b8a3458df03abdc6945bbef67ef91d181938. + +Reverted patch causes problems with Hauppauge WinTV dualHD as Maximilian +reported [1]. Since quick solution didn't come up let's just revert it +to make this device work with upstream kernels. + +Link: https://lore.kernel.org/all/6a72a37b-e972-187d-0322-16336e12bdc5@elbmurf.de/ [1] + +Reported-by: Maximilian Böhm +Tested-by: Maximilian Böhm +Signed-off-by: Pavel Skripkin +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/em28xx/em28xx-cards.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c +index b6490f611687..26408a972b44 100644 +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -4095,11 +4095,8 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) + + em28xx_close_extension(dev); + +- if (dev->dev_next) { +- em28xx_close_extension(dev->dev_next); ++ if (dev->dev_next) + em28xx_release_resources(dev->dev_next); +- } +- + em28xx_release_resources(dev); + + if (dev->dev_next) { +-- +2.34.1 + diff --git a/queue-5.10/media-saa7134-convert-list_for_each-to-entry-variant.patch b/queue-5.10/media-saa7134-convert-list_for_each-to-entry-variant.patch new file mode 100644 index 00000000000..904585e8b04 --- /dev/null +++ b/queue-5.10/media-saa7134-convert-list_for_each-to-entry-variant.patch @@ -0,0 +1,44 @@ +From 6cc0d83af79498fe73c717e85c6877d9b9b03a52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Jun 2021 10:36:45 +0200 +Subject: media: saa7134: convert list_for_each to entry variant + +From: Yang Yingliang + +[ Upstream commit 3f3475a5c77e9eabab43537f713b90f1d19258b7 ] + +Convert list_for_each() to list_for_each_entry() where +applicable. + +Signed-off-by: Yang Yingliang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-alsa.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c +index 7a1fb067b0e0..fb24d2ed3621 100644 +--- a/drivers/media/pci/saa7134/saa7134-alsa.c ++++ b/drivers/media/pci/saa7134/saa7134-alsa.c +@@ -1215,15 +1215,13 @@ static int alsa_device_exit(struct saa7134_dev *dev) + static int saa7134_alsa_init(void) + { + struct saa7134_dev *dev = NULL; +- struct list_head *list; + + saa7134_dmasound_init = alsa_device_init; + saa7134_dmasound_exit = alsa_device_exit; + + pr_info("saa7134 ALSA driver for DMA sound loaded\n"); + +- list_for_each(list,&saa7134_devlist) { +- dev = list_entry(list, struct saa7134_dev, devlist); ++ list_for_each_entry(dev, &saa7134_devlist, devlist) { + if (dev->pci->device == PCI_DEVICE_ID_PHILIPS_SAA7130) + pr_info("%s/alsa: %s doesn't support digital audio\n", + dev->name, saa7134_boards[dev->board].name); +-- +2.34.1 + diff --git a/queue-5.10/media-saa7134-fix-incorrect-use-to-determine-if-list.patch b/queue-5.10/media-saa7134-fix-incorrect-use-to-determine-if-list.patch new file mode 100644 index 00000000000..6225c8e92b0 --- /dev/null +++ b/queue-5.10/media-saa7134-fix-incorrect-use-to-determine-if-list.patch @@ -0,0 +1,49 @@ +From c2457c4adc15079842cf0669a35eb1188a2293b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 15:26:26 +0100 +Subject: media: saa7134: fix incorrect use to determine if list is empty + +From: Jakob Koschel + +[ Upstream commit 9f1f4b642451d35667a4dc6a9c0a89d954b530a3 ] + +'dev' will *always* be set by list_for_each_entry(). +It is incorrect to assume that the iterator value will be NULL if the +list is empty. + +Instead of checking the pointer it should be checked if +the list is empty. + +Fixes: 79dd0c69f05f ("V4L: 925: saa7134 alsa is now a standalone module") +Signed-off-by: Jakob Koschel +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/pci/saa7134/saa7134-alsa.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/media/pci/saa7134/saa7134-alsa.c b/drivers/media/pci/saa7134/saa7134-alsa.c +index fb24d2ed3621..d3cde05a6eba 100644 +--- a/drivers/media/pci/saa7134/saa7134-alsa.c ++++ b/drivers/media/pci/saa7134/saa7134-alsa.c +@@ -1214,7 +1214,7 @@ static int alsa_device_exit(struct saa7134_dev *dev) + + static int saa7134_alsa_init(void) + { +- struct saa7134_dev *dev = NULL; ++ struct saa7134_dev *dev; + + saa7134_dmasound_init = alsa_device_init; + saa7134_dmasound_exit = alsa_device_exit; +@@ -1229,7 +1229,7 @@ static int saa7134_alsa_init(void) + alsa_device_init(dev); + } + +- if (dev == NULL) ++ if (list_empty(&saa7134_devlist)) + pr_info("saa7134 ALSA: no saa7134 cards found\n"); + + return 0; +-- +2.34.1 + diff --git a/queue-5.10/media-staging-media-zoran-calculate-the-right-buffer.patch b/queue-5.10/media-staging-media-zoran-calculate-the-right-buffer.patch new file mode 100644 index 00000000000..9bb9e436aab --- /dev/null +++ b/queue-5.10/media-staging-media-zoran-calculate-the-right-buffer.patch @@ -0,0 +1,51 @@ +From 7c9b2ad6bfa03193414820967f8d3889d5099ee9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Dec 2021 17:16:32 +0100 +Subject: media: staging: media: zoran: calculate the right buffer number for + zoran_reap_stat_com + +From: Corentin Labbe + +[ Upstream commit e3b86f4e558cea9eed71d894df2f19b10d60a207 ] + +On the case tmp_dcim=1, the index of buffer is miscalculated. +This generate a NULL pointer dereference later. + +So let's fix the calcul and add a check to prevent this to reappear. + +Signed-off-by: Corentin Labbe +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/zoran/zoran_device.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/staging/media/zoran/zoran_device.c b/drivers/staging/media/zoran/zoran_device.c +index e569a1341d01..913f5a3c5bfc 100644 +--- a/drivers/staging/media/zoran/zoran_device.c ++++ b/drivers/staging/media/zoran/zoran_device.c +@@ -879,7 +879,7 @@ static void zoran_reap_stat_com(struct zoran *zr) + if (zr->jpg_settings.tmp_dcm == 1) + i = (zr->jpg_dma_tail - zr->jpg_err_shift) & BUZ_MASK_STAT_COM; + else +- i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2 + 1; ++ i = ((zr->jpg_dma_tail - zr->jpg_err_shift) & 1) * 2; + + stat_com = le32_to_cpu(zr->stat_com[i]); + if ((stat_com & 1) == 0) { +@@ -891,6 +891,11 @@ static void zoran_reap_stat_com(struct zoran *zr) + size = (stat_com & GENMASK(22, 1)) >> 1; + + buf = zr->inuse[i]; ++ if (!buf) { ++ spin_unlock_irqrestore(&zr->queued_bufs_lock, flags); ++ pci_err(zr->pci_dev, "No buffer at slot %d\n", i); ++ return; ++ } + buf->vbuf.vb2_buf.timestamp = ktime_get_ns(); + + if (zr->codec_mode == BUZ_MODE_MOTION_COMPRESS) { +-- +2.34.1 + diff --git a/queue-5.10/media-staging-media-zoran-fix-usage-of-vb2_dma_conti.patch b/queue-5.10/media-staging-media-zoran-fix-usage-of-vb2_dma_conti.patch new file mode 100644 index 00000000000..358dc5a9202 --- /dev/null +++ b/queue-5.10/media-staging-media-zoran-fix-usage-of-vb2_dma_conti.patch @@ -0,0 +1,45 @@ +From 3cea70a670f0bb569c72087ccc0701012a8ff5bc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Dec 2021 17:16:29 +0100 +Subject: media: staging: media: zoran: fix usage of + vb2_dma_contig_set_max_seg_size + +From: Corentin Labbe + +[ Upstream commit 241f5b67fb48def58643f279dfb8468bdd54b443 ] + +vb2_dma_contig_set_max_seg_size need to have a size in parameter and not +a DMA_BIT_MASK(). +While fixing this issue, also fix error handling of all DMA size +setting. + +Reported-by: kernel test robot +Fixes: d4ae3689226e5 ("media: zoran: device support only 32bit DMA address") +Signed-off-by: Corentin Labbe +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/zoran/zoran_card.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/staging/media/zoran/zoran_card.c b/drivers/staging/media/zoran/zoran_card.c +index dfc60e2e9dd7..721f1decb0a7 100644 +--- a/drivers/staging/media/zoran/zoran_card.c ++++ b/drivers/staging/media/zoran/zoran_card.c +@@ -1068,8 +1068,10 @@ static int zoran_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); + if (err) +- return -ENODEV; +- vb2_dma_contig_set_max_seg_size(&pdev->dev, DMA_BIT_MASK(32)); ++ return err; ++ err = vb2_dma_contig_set_max_seg_size(&pdev->dev, U32_MAX); ++ if (err) ++ return err; + + nr = zoran_num++; + if (nr >= BUZ_MAX) { +-- +2.34.1 + diff --git a/queue-5.10/media-staging-media-zoran-fix-various-v4l2-complianc.patch b/queue-5.10/media-staging-media-zoran-fix-various-v4l2-complianc.patch new file mode 100644 index 00000000000..367490648b8 --- /dev/null +++ b/queue-5.10/media-staging-media-zoran-fix-various-v4l2-complianc.patch @@ -0,0 +1,102 @@ +From 272764964837dad3d54379b715020fb4f5f3eeee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Dec 2021 17:16:33 +0100 +Subject: media: staging: media: zoran: fix various V4L2 compliance errors + +From: Hans Verkuil + +[ Upstream commit 914941827aad5ecddf9bf3a6dee67fbec1af1fff ] + +This fixes several issues found with 'v4l2-compliance -s': + +1) read()/write() is supported, but not reported in the capabilities +2) S_STD(G_STD()) failed: setting the same standard should just return 0. +3) G_PARM failed to set readbuffers. +4) different field values in the format vs. what v4l2_buffer reported. +5) zero the sequence number when starting streaming. +6) drop VB_USERPTR: makes no sense with dma_contig streaming. + +Signed-off-by: Hans Verkuil +Signed-off-by: Corentin Labbe +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/zoran/zoran_card.c | 2 +- + drivers/staging/media/zoran/zoran_driver.c | 13 ++++++++++--- + 2 files changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/staging/media/zoran/zoran_card.c b/drivers/staging/media/zoran/zoran_card.c +index 782bb4443fc1..fe0cca12119c 100644 +--- a/drivers/staging/media/zoran/zoran_card.c ++++ b/drivers/staging/media/zoran/zoran_card.c +@@ -810,7 +810,7 @@ static int zoran_init_video_device(struct zoran *zr, struct video_device *video_ + *video_dev = zoran_template; + video_dev->v4l2_dev = &zr->v4l2_dev; + video_dev->lock = &zr->lock; +- video_dev->device_caps = V4L2_CAP_STREAMING | dir; ++ video_dev->device_caps = V4L2_CAP_STREAMING | V4L2_CAP_READWRITE | dir; + + strscpy(video_dev->name, ZR_DEVNAME(zr), sizeof(video_dev->name)); + /* +diff --git a/drivers/staging/media/zoran/zoran_driver.c b/drivers/staging/media/zoran/zoran_driver.c +index 7f22596cc630..ea04f6c732b2 100644 +--- a/drivers/staging/media/zoran/zoran_driver.c ++++ b/drivers/staging/media/zoran/zoran_driver.c +@@ -255,8 +255,6 @@ static int zoran_querycap(struct file *file, void *__fh, struct v4l2_capability + strscpy(cap->card, ZR_DEVNAME(zr), sizeof(cap->card)); + strscpy(cap->driver, "zoran", sizeof(cap->driver)); + snprintf(cap->bus_info, sizeof(cap->bus_info), "PCI:%s", pci_name(zr->pci_dev)); +- cap->device_caps = zr->video_dev->device_caps; +- cap->capabilities = cap->device_caps | V4L2_CAP_DEVICE_CAPS; + return 0; + } + +@@ -582,6 +580,9 @@ static int zoran_s_std(struct file *file, void *__fh, v4l2_std_id std) + struct zoran *zr = video_drvdata(file); + int res = 0; + ++ if (zr->norm == std) ++ return 0; ++ + if (zr->running != ZORAN_MAP_MODE_NONE) + return -EBUSY; + +@@ -737,6 +738,7 @@ static int zoran_g_parm(struct file *file, void *priv, struct v4l2_streamparm *p + if (parm->type != V4L2_BUF_TYPE_VIDEO_CAPTURE) + return -EINVAL; + ++ parm->parm.capture.readbuffers = 9; + return 0; + } + +@@ -867,6 +869,10 @@ int zr_set_buf(struct zoran *zr) + vbuf = &buf->vbuf; + + buf->vbuf.field = V4L2_FIELD_INTERLACED; ++ if (BUZ_MAX_HEIGHT < (zr->v4l_settings.height * 2)) ++ buf->vbuf.field = V4L2_FIELD_INTERLACED; ++ else ++ buf->vbuf.field = V4L2_FIELD_TOP; + vb2_set_plane_payload(&buf->vbuf.vb2_buf, 0, zr->buffer_size); + vb2_buffer_done(&buf->vbuf.vb2_buf, VB2_BUF_STATE_DONE); + zr->inuse[0] = NULL; +@@ -926,6 +932,7 @@ static int zr_vb2_start_streaming(struct vb2_queue *vq, unsigned int count) + zr->stat_com[j] = cpu_to_le32(1); + zr->inuse[j] = NULL; + } ++ zr->vbseq = 0; + + if (zr->map_mode != ZORAN_MAP_MODE_RAW) { + pci_info(zr->pci_dev, "START JPG\n"); +@@ -1016,7 +1023,7 @@ int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq, int dir) + vq->dev = &zr->pci_dev->dev; + vq->type = dir; + +- vq->io_modes = VB2_USERPTR | VB2_DMABUF | VB2_MMAP | VB2_READ | VB2_WRITE; ++ vq->io_modes = VB2_DMABUF | VB2_MMAP | VB2_READ | VB2_WRITE; + vq->drv_priv = zr; + vq->buf_struct_size = sizeof(struct zr_buffer); + vq->ops = &zr_video_qops; +-- +2.34.1 + diff --git a/queue-5.10/media-staging-media-zoran-move-videodev-alloc.patch b/queue-5.10/media-staging-media-zoran-move-videodev-alloc.patch new file mode 100644 index 00000000000..802d9e8a27b --- /dev/null +++ b/queue-5.10/media-staging-media-zoran-move-videodev-alloc.patch @@ -0,0 +1,185 @@ +From ff082ebe94cdb6a225463fe135dd23a54c2ad0f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 14 Dec 2021 17:16:26 +0100 +Subject: media: staging: media: zoran: move videodev alloc + +From: Corentin Labbe + +[ Upstream commit 82e3a496eb56da0b9f29fdc5b63cedb3289e91de ] + +Move some code out of zr36057_init() and create new functions for handling +zr->video_dev. This permit to ease code reading and fix a zr->video_dev +memory leak. + +Signed-off-by: Corentin Labbe +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/zoran/zoran.h | 2 +- + drivers/staging/media/zoran/zoran_card.c | 80 ++++++++++++++-------- + drivers/staging/media/zoran/zoran_driver.c | 5 +- + 3 files changed, 54 insertions(+), 33 deletions(-) + +diff --git a/drivers/staging/media/zoran/zoran.h b/drivers/staging/media/zoran/zoran.h +index e7fe8da7732c..3f223e5b1872 100644 +--- a/drivers/staging/media/zoran/zoran.h ++++ b/drivers/staging/media/zoran/zoran.h +@@ -314,6 +314,6 @@ static inline struct zoran *to_zoran(struct v4l2_device *v4l2_dev) + + #endif + +-int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq); ++int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq, int dir); + void zoran_queue_exit(struct zoran *zr); + int zr_set_buf(struct zoran *zr); +diff --git a/drivers/staging/media/zoran/zoran_card.c b/drivers/staging/media/zoran/zoran_card.c +index 721f1decb0a7..782bb4443fc1 100644 +--- a/drivers/staging/media/zoran/zoran_card.c ++++ b/drivers/staging/media/zoran/zoran_card.c +@@ -802,6 +802,52 @@ int zoran_check_jpg_settings(struct zoran *zr, + return 0; + } + ++static int zoran_init_video_device(struct zoran *zr, struct video_device *video_dev, int dir) ++{ ++ int err; ++ ++ /* Now add the template and register the device unit. */ ++ *video_dev = zoran_template; ++ video_dev->v4l2_dev = &zr->v4l2_dev; ++ video_dev->lock = &zr->lock; ++ video_dev->device_caps = V4L2_CAP_STREAMING | dir; ++ ++ strscpy(video_dev->name, ZR_DEVNAME(zr), sizeof(video_dev->name)); ++ /* ++ * It's not a mem2mem device, but you can both capture and output from one and the same ++ * device. This should really be split up into two device nodes, but that's a job for ++ * another day. ++ */ ++ video_dev->vfl_dir = VFL_DIR_M2M; ++ zoran_queue_init(zr, &zr->vq, V4L2_BUF_TYPE_VIDEO_CAPTURE); ++ ++ err = video_register_device(video_dev, VFL_TYPE_VIDEO, video_nr[zr->id]); ++ if (err < 0) ++ return err; ++ video_set_drvdata(video_dev, zr); ++ return 0; ++} ++ ++static void zoran_exit_video_devices(struct zoran *zr) ++{ ++ video_unregister_device(zr->video_dev); ++ kfree(zr->video_dev); ++} ++ ++static int zoran_init_video_devices(struct zoran *zr) ++{ ++ int err; ++ ++ zr->video_dev = video_device_alloc(); ++ if (!zr->video_dev) ++ return -ENOMEM; ++ ++ err = zoran_init_video_device(zr, zr->video_dev, V4L2_CAP_VIDEO_CAPTURE); ++ if (err) ++ kfree(zr->video_dev); ++ return err; ++} ++ + void zoran_open_init_params(struct zoran *zr) + { + int i; +@@ -873,17 +919,11 @@ static int zr36057_init(struct zoran *zr) + zoran_open_init_params(zr); + + /* allocate memory *before* doing anything to the hardware in case allocation fails */ +- zr->video_dev = video_device_alloc(); +- if (!zr->video_dev) { +- err = -ENOMEM; +- goto exit; +- } + zr->stat_com = dma_alloc_coherent(&zr->pci_dev->dev, + BUZ_NUM_STAT_COM * sizeof(u32), + &zr->p_sc, GFP_KERNEL); + if (!zr->stat_com) { +- err = -ENOMEM; +- goto exit_video; ++ return -ENOMEM; + } + for (j = 0; j < BUZ_NUM_STAT_COM; j++) + zr->stat_com[j] = cpu_to_le32(1); /* mark as unavailable to zr36057 */ +@@ -896,26 +936,9 @@ static int zr36057_init(struct zoran *zr) + goto exit_statcom; + } + +- /* Now add the template and register the device unit. */ +- *zr->video_dev = zoran_template; +- zr->video_dev->v4l2_dev = &zr->v4l2_dev; +- zr->video_dev->lock = &zr->lock; +- zr->video_dev->device_caps = V4L2_CAP_STREAMING | V4L2_CAP_VIDEO_CAPTURE; +- +- strscpy(zr->video_dev->name, ZR_DEVNAME(zr), sizeof(zr->video_dev->name)); +- /* +- * It's not a mem2mem device, but you can both capture and output from one and the same +- * device. This should really be split up into two device nodes, but that's a job for +- * another day. +- */ +- zr->video_dev->vfl_dir = VFL_DIR_M2M; +- +- zoran_queue_init(zr, &zr->vq); +- +- err = video_register_device(zr->video_dev, VFL_TYPE_VIDEO, video_nr[zr->id]); +- if (err < 0) ++ err = zoran_init_video_devices(zr); ++ if (err) + goto exit_statcomb; +- video_set_drvdata(zr->video_dev, zr); + + zoran_init_hardware(zr); + if (!pass_through) { +@@ -930,9 +953,6 @@ static int zr36057_init(struct zoran *zr) + dma_free_coherent(&zr->pci_dev->dev, BUZ_NUM_STAT_COM * sizeof(u32) * 2, zr->stat_comb, zr->p_scb); + exit_statcom: + dma_free_coherent(&zr->pci_dev->dev, BUZ_NUM_STAT_COM * sizeof(u32), zr->stat_com, zr->p_sc); +-exit_video: +- kfree(zr->video_dev); +-exit: + return err; + } + +@@ -964,7 +984,7 @@ static void zoran_remove(struct pci_dev *pdev) + dma_free_coherent(&zr->pci_dev->dev, BUZ_NUM_STAT_COM * sizeof(u32) * 2, zr->stat_comb, zr->p_scb); + pci_release_regions(pdev); + pci_disable_device(zr->pci_dev); +- video_unregister_device(zr->video_dev); ++ zoran_exit_video_devices(zr); + exit_free: + v4l2_ctrl_handler_free(&zr->hdl); + v4l2_device_unregister(&zr->v4l2_dev); +diff --git a/drivers/staging/media/zoran/zoran_driver.c b/drivers/staging/media/zoran/zoran_driver.c +index 808196ea5b81..7f22596cc630 100644 +--- a/drivers/staging/media/zoran/zoran_driver.c ++++ b/drivers/staging/media/zoran/zoran_driver.c +@@ -1006,7 +1006,7 @@ static const struct vb2_ops zr_video_qops = { + .wait_finish = vb2_ops_wait_finish, + }; + +-int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq) ++int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq, int dir) + { + int err; + +@@ -1014,7 +1014,8 @@ int zoran_queue_init(struct zoran *zr, struct vb2_queue *vq) + INIT_LIST_HEAD(&zr->queued_bufs); + + vq->dev = &zr->pci_dev->dev; +- vq->type = V4L2_BUF_TYPE_VIDEO_CAPTURE; ++ vq->type = dir; ++ + vq->io_modes = VB2_USERPTR | VB2_DMABUF | VB2_MMAP | VB2_READ | VB2_WRITE; + vq->drv_priv = zr; + vq->buf_struct_size = sizeof(struct zr_buffer); +-- +2.34.1 + diff --git a/queue-5.10/media-stk1160-if-start-stream-fails-return-buffers-w.patch b/queue-5.10/media-stk1160-if-start-stream-fails-return-buffers-w.patch new file mode 100644 index 00000000000..7ba2b38f0f7 --- /dev/null +++ b/queue-5.10/media-stk1160-if-start-stream-fails-return-buffers-w.patch @@ -0,0 +1,143 @@ +From 5b26364eb55178fd912f48052e990474349a49b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jan 2022 09:02:11 +0100 +Subject: media: stk1160: If start stream fails, return buffers with + VB2_BUF_STATE_QUEUED + +From: Dafna Hirschfeld + +[ Upstream commit fbe04b49a54e31f4321d632270207f0e6304cd16 ] + +If the callback 'start_streaming' fails, then all +queued buffers in the driver should be returned with +state 'VB2_BUF_STATE_QUEUED'. Currently, they are +returned with 'VB2_BUF_STATE_ERROR' which is wrong. +Fix this. This also fixes the warning: + +[ 65.583633] WARNING: CPU: 5 PID: 593 at drivers/media/common/videobuf2/videobuf2-core.c:1612 vb2_start_streaming+0xd4/0x160 [videobuf2_common] +[ 65.585027] Modules linked in: snd_usb_audio snd_hwdep snd_usbmidi_lib snd_rawmidi snd_soc_hdmi_codec dw_hdmi_i2s_audio saa7115 stk1160 videobuf2_vmalloc videobuf2_memops videobuf2_v4l2 videobuf2_common videodev mc crct10dif_ce panfrost snd_soc_simple_card snd_soc_audio_graph_card snd_soc_spdif_tx snd_soc_simple_card_utils gpu_sched phy_rockchip_pcie snd_soc_rockchip_i2s rockchipdrm analogix_dp dw_mipi_dsi dw_hdmi cec drm_kms_helper drm rtc_rk808 rockchip_saradc industrialio_triggered_buffer kfifo_buf rockchip_thermal pcie_rockchip_host ip_tables x_tables ipv6 +[ 65.589383] CPU: 5 PID: 593 Comm: v4l2src0:src Tainted: G W 5.16.0-rc4-62408-g32447129cb30-dirty #14 +[ 65.590293] Hardware name: Radxa ROCK Pi 4B (DT) +[ 65.590696] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 65.591304] pc : vb2_start_streaming+0xd4/0x160 [videobuf2_common] +[ 65.591850] lr : vb2_start_streaming+0x6c/0x160 [videobuf2_common] +[ 65.592395] sp : ffff800012bc3ad0 +[ 65.592685] x29: ffff800012bc3ad0 x28: 0000000000000000 x27: ffff800012bc3cd8 +[ 65.593312] x26: 0000000000000000 x25: ffff00000d8a7800 x24: 0000000040045612 +[ 65.593938] x23: ffff800011323000 x22: ffff800012bc3cd8 x21: ffff00000908a8b0 +[ 65.594562] x20: ffff00000908a8c8 x19: 00000000fffffff4 x18: ffffffffffffffff +[ 65.595188] x17: 000000040044ffff x16: 00400034b5503510 x15: ffff800011323f78 +[ 65.595813] x14: ffff000013163886 x13: ffff000013163885 x12: 00000000000002ce +[ 65.596439] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228 +[ 65.597064] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff726c5e78 +[ 65.597690] x5 : ffff800012bc3990 x4 : 0000000000000000 x3 : ffff000009a34880 +[ 65.598315] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000007cd99f0 +[ 65.598940] Call trace: +[ 65.599155] vb2_start_streaming+0xd4/0x160 [videobuf2_common] +[ 65.599672] vb2_core_streamon+0x17c/0x1a8 [videobuf2_common] +[ 65.600179] vb2_streamon+0x54/0x88 [videobuf2_v4l2] +[ 65.600619] vb2_ioctl_streamon+0x54/0x60 [videobuf2_v4l2] +[ 65.601103] v4l_streamon+0x3c/0x50 [videodev] +[ 65.601521] __video_do_ioctl+0x1a4/0x428 [videodev] +[ 65.601977] video_usercopy+0x320/0x828 [videodev] +[ 65.602419] video_ioctl2+0x3c/0x58 [videodev] +[ 65.602830] v4l2_ioctl+0x60/0x90 [videodev] +[ 65.603227] __arm64_sys_ioctl+0xa8/0xe0 +[ 65.603576] invoke_syscall+0x54/0x118 +[ 65.603911] el0_svc_common.constprop.3+0x84/0x100 +[ 65.604332] do_el0_svc+0x34/0xa0 +[ 65.604625] el0_svc+0x1c/0x50 +[ 65.604897] el0t_64_sync_handler+0x88/0xb0 +[ 65.605264] el0t_64_sync+0x16c/0x170 +[ 65.605587] ---[ end trace 578e0ba07742170d ]--- + +Fixes: 8ac456495a33d ("[media] stk1160: Stop device and unqueue buffers when start_streaming() fails") +Signed-off-by: Dafna Hirschfeld +Reviewed-by: Ezequiel Garcia +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/usb/stk1160/stk1160-core.c | 2 +- + drivers/media/usb/stk1160/stk1160-v4l.c | 10 +++++----- + drivers/media/usb/stk1160/stk1160.h | 2 +- + 3 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c +index 4e1698f78818..ce717502ea4c 100644 +--- a/drivers/media/usb/stk1160/stk1160-core.c ++++ b/drivers/media/usb/stk1160/stk1160-core.c +@@ -403,7 +403,7 @@ static void stk1160_disconnect(struct usb_interface *interface) + /* Here is the only place where isoc get released */ + stk1160_uninit_isoc(dev); + +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); + + video_unregister_device(&dev->vdev); + v4l2_device_disconnect(&dev->v4l2_dev); +diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c +index 6a4eb616d516..1aa953469402 100644 +--- a/drivers/media/usb/stk1160/stk1160-v4l.c ++++ b/drivers/media/usb/stk1160/stk1160-v4l.c +@@ -258,7 +258,7 @@ static int stk1160_start_streaming(struct stk1160 *dev) + stk1160_uninit_isoc(dev); + out_stop_hw: + usb_set_interface(dev->udev, 0, 0); +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED); + + mutex_unlock(&dev->v4l_lock); + +@@ -306,7 +306,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev) + + stk1160_stop_hw(dev); + +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); + + stk1160_dbg("streaming stopped\n"); + +@@ -745,7 +745,7 @@ static const struct video_device v4l_template = { + /********************************************************************/ + + /* Must be called with both v4l_lock and vb_queue_lock hold */ +-void stk1160_clear_queue(struct stk1160 *dev) ++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state) + { + struct stk1160_buffer *buf; + unsigned long flags; +@@ -756,7 +756,7 @@ void stk1160_clear_queue(struct stk1160 *dev) + buf = list_first_entry(&dev->avail_bufs, + struct stk1160_buffer, list); + list_del(&buf->list); +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); + stk1160_dbg("buffer [%p/%d] aborted\n", + buf, buf->vb.vb2_buf.index); + } +@@ -766,7 +766,7 @@ void stk1160_clear_queue(struct stk1160 *dev) + buf = dev->isoc_ctl.buf; + dev->isoc_ctl.buf = NULL; + +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); + stk1160_dbg("buffer [%p/%d] aborted\n", + buf, buf->vb.vb2_buf.index); + } +diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h +index a31ea1c80f25..a70963ce8753 100644 +--- a/drivers/media/usb/stk1160/stk1160.h ++++ b/drivers/media/usb/stk1160/stk1160.h +@@ -166,7 +166,7 @@ struct regval { + int stk1160_vb2_setup(struct stk1160 *dev); + int stk1160_video_register(struct stk1160 *dev); + void stk1160_video_unregister(struct stk1160 *dev); +-void stk1160_clear_queue(struct stk1160 *dev); ++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state); + + /* Provided by stk1160-video.c */ + int stk1160_alloc_isoc(struct stk1160 *dev); +-- +2.34.1 + diff --git a/queue-5.10/media-usb-go7007-s2250-board-fix-leak-in-probe.patch b/queue-5.10/media-usb-go7007-s2250-board-fix-leak-in-probe.patch new file mode 100644 index 00000000000..b0d01dbe4af --- /dev/null +++ b/queue-5.10/media-usb-go7007-s2250-board-fix-leak-in-probe.patch @@ -0,0 +1,57 @@ +From c0be984864c57f33f655e23035bced9008d81739 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Feb 2022 20:52:01 +0300 +Subject: media: usb: go7007: s2250-board: fix leak in probe() + +From: Dan Carpenter + +[ Upstream commit 67e4550ecd6164bfbdff54c169e5bbf9ccfaf14d ] + +Call i2c_unregister_device(audio) on this error path. + +Fixes: d3b2ccd9e307 ("[media] s2250: convert to the control framework") +Signed-off-by: Dan Carpenter +Signed-off-by: Hans Verkuil +Signed-off-by: Sasha Levin +--- + drivers/media/usb/go7007/s2250-board.c | 10 ++++------ + 1 file changed, 4 insertions(+), 6 deletions(-) + +diff --git a/drivers/media/usb/go7007/s2250-board.c b/drivers/media/usb/go7007/s2250-board.c +index b9e45124673b..2e5913bccb38 100644 +--- a/drivers/media/usb/go7007/s2250-board.c ++++ b/drivers/media/usb/go7007/s2250-board.c +@@ -504,6 +504,7 @@ static int s2250_probe(struct i2c_client *client, + u8 *data; + struct go7007 *go = i2c_get_adapdata(adapter); + struct go7007_usb *usb = go->hpi_context; ++ int err = -EIO; + + audio = i2c_new_dummy_device(adapter, TLV320_ADDRESS >> 1); + if (IS_ERR(audio)) +@@ -532,11 +533,8 @@ static int s2250_probe(struct i2c_client *client, + V4L2_CID_HUE, -512, 511, 1, 0); + sd->ctrl_handler = &state->hdl; + if (state->hdl.error) { +- int err = state->hdl.error; +- +- v4l2_ctrl_handler_free(&state->hdl); +- kfree(state); +- return err; ++ err = state->hdl.error; ++ goto fail; + } + + state->std = V4L2_STD_NTSC; +@@ -600,7 +598,7 @@ static int s2250_probe(struct i2c_client *client, + i2c_unregister_device(audio); + v4l2_ctrl_handler_free(&state->hdl); + kfree(state); +- return -EIO; ++ return err; + } + + static int s2250_remove(struct i2c_client *client) +-- +2.34.1 + diff --git a/queue-5.10/media-v4l2-mem2mem-apply-dst_queue_off_base-on-mmap-.patch b/queue-5.10/media-v4l2-mem2mem-apply-dst_queue_off_base-on-mmap-.patch new file mode 100644 index 00000000000..dfeada1098a --- /dev/null +++ b/queue-5.10/media-v4l2-mem2mem-apply-dst_queue_off_base-on-mmap-.patch @@ -0,0 +1,136 @@ +From 65d2b53ebcc5b1ca0d20d712fe924968bfee428c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 9 Dec 2021 17:38:03 +0100 +Subject: media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across + ioctls + +From: Chen-Yu Tsai + +[ Upstream commit 8310ca94075e784bbb06593cd6c068ee6b6e4ca6 ] + +DST_QUEUE_OFF_BASE is applied to offset/mem_offset on MMAP capture buffers +only for the VIDIOC_QUERYBUF ioctl, while the userspace fields (including +offset/mem_offset) are filled in for VIDIOC_{QUERY,PREPARE,Q,DQ}BUF +ioctls. This leads to differences in the values presented to userspace. +If userspace attempts to mmap the capture buffer directly using values +from DQBUF, it will fail. + +Move the code that applies the magic offset into a helper, and call +that helper from all four ioctl entry points. + +[hverkuil: drop unnecessary '= 0' in v4l2_m2m_querybuf() for ret] + +Fixes: 7f98639def42 ("V4L/DVB: add memory-to-memory device helper framework for videobuf") +Fixes: 908a0d7c588e ("[media] v4l: mem2mem: port to videobuf2") +Signed-off-by: Chen-Yu Tsai +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/v4l2-core/v4l2-mem2mem.c | 53 ++++++++++++++++++++------ + 1 file changed, 41 insertions(+), 12 deletions(-) + +diff --git a/drivers/media/v4l2-core/v4l2-mem2mem.c b/drivers/media/v4l2-core/v4l2-mem2mem.c +index b221b4e438a1..73190652c267 100644 +--- a/drivers/media/v4l2-core/v4l2-mem2mem.c ++++ b/drivers/media/v4l2-core/v4l2-mem2mem.c +@@ -585,19 +585,14 @@ int v4l2_m2m_reqbufs(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, + } + EXPORT_SYMBOL_GPL(v4l2_m2m_reqbufs); + +-int v4l2_m2m_querybuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, +- struct v4l2_buffer *buf) ++static void v4l2_m2m_adjust_mem_offset(struct vb2_queue *vq, ++ struct v4l2_buffer *buf) + { +- struct vb2_queue *vq; +- int ret = 0; +- unsigned int i; +- +- vq = v4l2_m2m_get_vq(m2m_ctx, buf->type); +- ret = vb2_querybuf(vq, buf); +- + /* Adjust MMAP memory offsets for the CAPTURE queue */ + if (buf->memory == V4L2_MEMORY_MMAP && V4L2_TYPE_IS_CAPTURE(vq->type)) { + if (V4L2_TYPE_IS_MULTIPLANAR(vq->type)) { ++ unsigned int i; ++ + for (i = 0; i < buf->length; ++i) + buf->m.planes[i].m.mem_offset + += DST_QUEUE_OFF_BASE; +@@ -605,8 +600,23 @@ int v4l2_m2m_querybuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, + buf->m.offset += DST_QUEUE_OFF_BASE; + } + } ++} + +- return ret; ++int v4l2_m2m_querybuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, ++ struct v4l2_buffer *buf) ++{ ++ struct vb2_queue *vq; ++ int ret; ++ ++ vq = v4l2_m2m_get_vq(m2m_ctx, buf->type); ++ ret = vb2_querybuf(vq, buf); ++ if (ret) ++ return ret; ++ ++ /* Adjust MMAP memory offsets for the CAPTURE queue */ ++ v4l2_m2m_adjust_mem_offset(vq, buf); ++ ++ return 0; + } + EXPORT_SYMBOL_GPL(v4l2_m2m_querybuf); + +@@ -763,6 +773,9 @@ int v4l2_m2m_qbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, + if (ret) + return ret; + ++ /* Adjust MMAP memory offsets for the CAPTURE queue */ ++ v4l2_m2m_adjust_mem_offset(vq, buf); ++ + /* + * If the capture queue is streaming, but streaming hasn't started + * on the device, but was asked to stop, mark the previously queued +@@ -784,9 +797,17 @@ int v4l2_m2m_dqbuf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, + struct v4l2_buffer *buf) + { + struct vb2_queue *vq; ++ int ret; + + vq = v4l2_m2m_get_vq(m2m_ctx, buf->type); +- return vb2_dqbuf(vq, buf, file->f_flags & O_NONBLOCK); ++ ret = vb2_dqbuf(vq, buf, file->f_flags & O_NONBLOCK); ++ if (ret) ++ return ret; ++ ++ /* Adjust MMAP memory offsets for the CAPTURE queue */ ++ v4l2_m2m_adjust_mem_offset(vq, buf); ++ ++ return 0; + } + EXPORT_SYMBOL_GPL(v4l2_m2m_dqbuf); + +@@ -795,9 +816,17 @@ int v4l2_m2m_prepare_buf(struct file *file, struct v4l2_m2m_ctx *m2m_ctx, + { + struct video_device *vdev = video_devdata(file); + struct vb2_queue *vq; ++ int ret; + + vq = v4l2_m2m_get_vq(m2m_ctx, buf->type); +- return vb2_prepare_buf(vq, vdev->v4l2_dev->mdev, buf); ++ ret = vb2_prepare_buf(vq, vdev->v4l2_dev->mdev, buf); ++ if (ret) ++ return ret; ++ ++ /* Adjust MMAP memory offsets for the CAPTURE queue */ ++ v4l2_m2m_adjust_mem_offset(vq, buf); ++ ++ return 0; + } + EXPORT_SYMBOL_GPL(v4l2_m2m_prepare_buf); + +-- +2.34.1 + diff --git a/queue-5.10/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch b/queue-5.10/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch new file mode 100644 index 00000000000..fc5d4536220 --- /dev/null +++ b/queue-5.10/media-video-hdmi-handle-short-reads-of-hdmi-info-fra.patch @@ -0,0 +1,66 @@ +From 237378f1bdd0ee89987ac0c2a8ee2ff2f316d000 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 12 Aug 2021 19:01:46 +0200 +Subject: media: video/hdmi: handle short reads of hdmi info frame. + +From: Tom Rix + +[ Upstream commit 4a92fc6e55da5b87cecb572275deaff6ac9dd27e ] + +Calling hdmi_infoframe_unpack() with static sizeof(buffer) skips all +the size checking done later in hdmi_infoframe_unpack(). A better +value is the amount of data read into buffer. + +Fixes: 480b8b3e42c3 ("video/hdmi: Pass buffer size to infoframe unpack functions") +Signed-off-by: Tom Rix +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/i2c/adv7511-v4l2.c | 2 +- + drivers/media/i2c/adv7604.c | 2 +- + drivers/media/i2c/adv7842.c | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/media/i2c/adv7511-v4l2.c b/drivers/media/i2c/adv7511-v4l2.c +index ab7883cff8b2..9f5713b76794 100644 +--- a/drivers/media/i2c/adv7511-v4l2.c ++++ b/drivers/media/i2c/adv7511-v4l2.c +@@ -555,7 +555,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7511_cfg_read_ + buffer[3] = 0; + buffer[3] = hdmi_infoframe_checksum(buffer, len + 4); + +- if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) { ++ if (hdmi_infoframe_unpack(&frame, buffer, len + 4) < 0) { + v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); + return; + } +diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c +index d1f58795794f..8cf1704308bf 100644 +--- a/drivers/media/i2c/adv7604.c ++++ b/drivers/media/i2c/adv7604.c +@@ -2454,7 +2454,7 @@ static int adv76xx_read_infoframe(struct v4l2_subdev *sd, int index, + buffer[i + 3] = infoframe_read(sd, + adv76xx_cri[index].payload_addr + i); + +- if (hdmi_infoframe_unpack(frame, buffer, sizeof(buffer)) < 0) { ++ if (hdmi_infoframe_unpack(frame, buffer, len + 3) < 0) { + v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, + adv76xx_cri[index].desc); + return -ENOENT; +diff --git a/drivers/media/i2c/adv7842.c b/drivers/media/i2c/adv7842.c +index f7d2b6cd3008..a870117feb44 100644 +--- a/drivers/media/i2c/adv7842.c ++++ b/drivers/media/i2c/adv7842.c +@@ -2574,7 +2574,7 @@ static void log_infoframe(struct v4l2_subdev *sd, const struct adv7842_cfg_read_ + for (i = 0; i < len; i++) + buffer[i + 3] = infoframe_read(sd, cri->payload_addr + i); + +- if (hdmi_infoframe_unpack(&frame, buffer, sizeof(buffer)) < 0) { ++ if (hdmi_infoframe_unpack(&frame, buffer, len + 3) < 0) { + v4l2_err(sd, "%s: unpack of %s infoframe failed\n", __func__, cri->desc); + return; + } +-- +2.34.1 + diff --git a/queue-5.10/media-vidtv-check-for-null-return-of-vzalloc.patch b/queue-5.10/media-vidtv-check-for-null-return-of-vzalloc.patch new file mode 100644 index 00000000000..8e621766af9 --- /dev/null +++ b/queue-5.10/media-vidtv-check-for-null-return-of-vzalloc.patch @@ -0,0 +1,70 @@ +From fa8a007d8de8350b0c25408d7644a575adebcf1b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Jan 2022 07:28:40 +0100 +Subject: media: vidtv: Check for null return of vzalloc + +From: Jiasheng Jiang + +[ Upstream commit e6a21a14106d9718aa4f8e115b1e474888eeba44 ] + +As the possible failure of the vzalloc(), e->encoder_buf might be NULL. +Therefore, it should be better to check it in order +to guarantee the success of the initialization. +If fails, we need to free not only 'e' but also 'e->name'. +Also, if the allocation for ctx fails, we need to free 'e->encoder_buf' +else. + +Fixes: f90cf6079bf6 ("media: vidtv: add a bridge driver") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Hans Verkuil +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/test-drivers/vidtv/vidtv_s302m.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/drivers/media/test-drivers/vidtv/vidtv_s302m.c b/drivers/media/test-drivers/vidtv/vidtv_s302m.c +index d79b65854627..4676083cee3b 100644 +--- a/drivers/media/test-drivers/vidtv/vidtv_s302m.c ++++ b/drivers/media/test-drivers/vidtv/vidtv_s302m.c +@@ -455,6 +455,9 @@ struct vidtv_encoder + e->name = kstrdup(args.name, GFP_KERNEL); + + e->encoder_buf = vzalloc(VIDTV_S302M_BUF_SZ); ++ if (!e->encoder_buf) ++ goto out_kfree_e; ++ + e->encoder_buf_sz = VIDTV_S302M_BUF_SZ; + e->encoder_buf_offset = 0; + +@@ -467,10 +470,8 @@ struct vidtv_encoder + e->is_video_encoder = false; + + ctx = kzalloc(priv_sz, GFP_KERNEL); +- if (!ctx) { +- kfree(e); +- return NULL; +- } ++ if (!ctx) ++ goto out_kfree_buf; + + e->ctx = ctx; + ctx->last_duration = 0; +@@ -498,6 +499,14 @@ struct vidtv_encoder + e->next = NULL; + + return e; ++ ++out_kfree_buf: ++ kfree(e->encoder_buf); ++ ++out_kfree_e: ++ kfree(e->name); ++ kfree(e); ++ return NULL; + } + + void vidtv_s302m_encoder_destroy(struct vidtv_encoder *e) +-- +2.34.1 + diff --git a/queue-5.10/memory-emif-add-check-for-setup_interrupts.patch b/queue-5.10/memory-emif-add-check-for-setup_interrupts.patch new file mode 100644 index 00000000000..55f3913c616 --- /dev/null +++ b/queue-5.10/memory-emif-add-check-for-setup_interrupts.patch @@ -0,0 +1,49 @@ +From 334466412da906f8bea2b3b7075922054275fdb1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 10:54:44 +0800 +Subject: memory: emif: Add check for setup_interrupts + +From: Jiasheng Jiang + +[ Upstream commit fd7bd80b46373887b390852f490f21b07e209498 ] + +As the potential failure of the devm_request_threaded_irq(), +it should be better to check the return value of the +setup_interrupts() and return error if fails. + +Fixes: 68b4aee35d1f ("memory: emif: add interrupt and temperature handling") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220224025444.3256530-1-jiasheng@iscas.ac.cn +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/emif.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c +index ddb1879f07d3..55d4c842fcd9 100644 +--- a/drivers/memory/emif.c ++++ b/drivers/memory/emif.c +@@ -1495,7 +1495,7 @@ static int __init_or_module emif_probe(struct platform_device *pdev) + { + struct emif_data *emif; + struct resource *res; +- int irq; ++ int irq, ret; + + if (pdev->dev.of_node) + emif = of_get_memory_device_details(pdev->dev.of_node, &pdev->dev); +@@ -1526,7 +1526,9 @@ static int __init_or_module emif_probe(struct platform_device *pdev) + emif_onetime_settings(emif); + emif_debugfs_init(emif); + disable_and_clear_all_interrupts(emif); +- setup_interrupts(emif, irq); ++ ret = setup_interrupts(emif, irq); ++ if (ret) ++ goto error; + + /* One-time actions taken on probing the first device */ + if (!emif1) { +-- +2.34.1 + diff --git a/queue-5.10/memory-emif-check-the-pointer-temp-in-get_device_det.patch b/queue-5.10/memory-emif-check-the-pointer-temp-in-get_device_det.patch new file mode 100644 index 00000000000..47a8fea5198 --- /dev/null +++ b/queue-5.10/memory-emif-check-the-pointer-temp-in-get_device_det.patch @@ -0,0 +1,37 @@ +From 08e5aee191581a5425bb8d16808778c4aa0da963 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 25 Feb 2022 05:25:52 -0800 +Subject: memory: emif: check the pointer temp in get_device_details() + +From: Jia-Ju Bai + +[ Upstream commit 5b5ab1bfa1898c6d52936a57c25c5ceba2cb2f87 ] + +The pointer temp is allocated by devm_kzalloc(), so it should be +checked for error handling. + +Fixes: 7ec944538dde ("memory: emif: add basic infrastructure for EMIF driver") +Signed-off-by: Jia-Ju Bai +Link: https://lore.kernel.org/r/20220225132552.27894-1-baijiaju1990@gmail.com +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Sasha Levin +--- + drivers/memory/emif.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c +index 55d4c842fcd9..5a059be3516c 100644 +--- a/drivers/memory/emif.c ++++ b/drivers/memory/emif.c +@@ -1403,7 +1403,7 @@ static struct emif_data *__init_or_module get_device_details( + temp = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL); + dev_info = devm_kzalloc(dev, sizeof(*dev_info), GFP_KERNEL); + +- if (!emif || !pd || !dev_info) { ++ if (!emif || !temp || !dev_info) { + dev_err(dev, "%s:%d: allocation error\n", __func__, __LINE__); + goto error; + } +-- +2.34.1 + diff --git a/queue-5.10/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch b/queue-5.10/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch new file mode 100644 index 00000000000..6a7133d194a --- /dev/null +++ b/queue-5.10/mfd-asic3-add-missing-iounmap-on-error-asic3_mfd_pro.patch @@ -0,0 +1,59 @@ +From d0db5dbd2fd1bfdb5e4d9d5425d0e1caab7bfb45 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 07:29:47 +0000 +Subject: mfd: asic3: Add missing iounmap() on error asic3_mfd_probe + +From: Miaoqian Lin + +[ Upstream commit e84ee1a75f944a0fe3c277aaa10c426603d2b0bc ] + +Add the missing iounmap() before return from asic3_mfd_probe +in the error handling case. + +Fixes: 64e8867ba809 ("mfd: tmio_mmc hardware abstraction for CNF area") +Signed-off-by: Miaoqian Lin +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20220307072947.5369-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mfd/asic3.c | 10 +++++++--- + 1 file changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c +index a6bd2134cea2..14e4bbe6a9da 100644 +--- a/drivers/mfd/asic3.c ++++ b/drivers/mfd/asic3.c +@@ -914,14 +914,14 @@ static int __init asic3_mfd_probe(struct platform_device *pdev, + ret = mfd_add_devices(&pdev->dev, pdev->id, + &asic3_cell_ds1wm, 1, mem, asic->irq_base, NULL); + if (ret < 0) +- goto out; ++ goto out_unmap; + } + + if (mem_sdio && (irq >= 0)) { + ret = mfd_add_devices(&pdev->dev, pdev->id, + &asic3_cell_mmc, 1, mem_sdio, irq, NULL); + if (ret < 0) +- goto out; ++ goto out_unmap; + } + + ret = 0; +@@ -935,8 +935,12 @@ static int __init asic3_mfd_probe(struct platform_device *pdev, + ret = mfd_add_devices(&pdev->dev, 0, + asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0, NULL); + } ++ return ret; + +- out: ++out_unmap: ++ if (asic->tmio_cnf) ++ iounmap(asic->tmio_cnf); ++out: + return ret; + } + +-- +2.34.1 + diff --git a/queue-5.10/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch b/queue-5.10/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch new file mode 100644 index 00000000000..0dc17f23aef --- /dev/null +++ b/queue-5.10/mfd-mc13xxx-add-check-for-mc13xxx_irq_request.patch @@ -0,0 +1,41 @@ +From 5ef5241fd7e21b05ea54b3b2cb50404d8e868b76 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 10:23:31 +0800 +Subject: mfd: mc13xxx: Add check for mc13xxx_irq_request + +From: Jiasheng Jiang + +[ Upstream commit e477e51a41cb5d6034f3c5ea85a71ad4613996b9 ] + +As the potential failure of the devm_request_threaded_irq(), +it should be better to check the return value of the +mc13xxx_irq_request() and return error if fails. + +Fixes: 8e00593557c3 ("mfd: Add mc13892 support to mc13xxx") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Lee Jones +Link: https://lore.kernel.org/r/20220224022331.3208275-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/mfd/mc13xxx-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c +index 1abe7432aad8..e281a9202f11 100644 +--- a/drivers/mfd/mc13xxx-core.c ++++ b/drivers/mfd/mc13xxx-core.c +@@ -323,8 +323,10 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, + adc1 |= MC13783_ADC1_ATOX; + + dev_dbg(mc13xxx->dev, "%s: request irq\n", __func__); +- mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE, ++ ret = mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE, + mc13xxx_handler_adcdone, __func__, &adcdone_data); ++ if (ret) ++ goto out; + + mc13xxx_reg_write(mc13xxx, MC13XXX_ADC0, adc0); + mc13xxx_reg_write(mc13xxx, MC13XXX_ADC1, adc1); +-- +2.34.1 + diff --git a/queue-5.10/mips-cdmm-fix-refcount-leak-in-mips_cdmm_phys_base.patch b/queue-5.10/mips-cdmm-fix-refcount-leak-in-mips_cdmm_phys_base.patch new file mode 100644 index 00000000000..ec8f9a6eb36 --- /dev/null +++ b/queue-5.10/mips-cdmm-fix-refcount-leak-in-mips_cdmm_phys_base.patch @@ -0,0 +1,37 @@ +From 64856a1ce05997a7a6997ddc5be639ba844f3dbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 09:17:10 +0000 +Subject: mips: cdmm: Fix refcount leak in mips_cdmm_phys_base + +From: Miaoqian Lin + +[ Upstream commit 4528668ca331f7ce5999b7746657b46db5b3b785 ] + +The of_find_compatible_node() function returns a node pointer with +refcount incremented, We should use of_node_put() on it when done +Add the missing of_node_put() to release the refcount. + +Fixes: 2121aa3e2312 ("mips: cdmm: Add mti,mips-cdmm dtb node support") +Signed-off-by: Miaoqian Lin +Acked-by: Serge Semin +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + drivers/bus/mips_cdmm.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/bus/mips_cdmm.c b/drivers/bus/mips_cdmm.c +index 626dedd110cb..fca0d0669aa9 100644 +--- a/drivers/bus/mips_cdmm.c ++++ b/drivers/bus/mips_cdmm.c +@@ -351,6 +351,7 @@ phys_addr_t __weak mips_cdmm_phys_base(void) + np = of_find_compatible_node(NULL, NULL, "mti,mips-cdmm"); + if (np) { + err = of_address_to_resource(np, 0, &res); ++ of_node_put(np); + if (!err) + return res.start; + } +-- +2.34.1 + diff --git a/queue-5.10/mips-dec-honor-config_mips_fp_support-n.patch b/queue-5.10/mips-dec-honor-config_mips_fp_support-n.patch new file mode 100644 index 00000000000..1b13cafc6a9 --- /dev/null +++ b/queue-5.10/mips-dec-honor-config_mips_fp_support-n.patch @@ -0,0 +1,80 @@ +From 22d664a42aa7c265be83ff9c042864de307c6055 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 08:24:27 -0800 +Subject: mips: DEC: honor CONFIG_MIPS_FP_SUPPORT=n + +From: Randy Dunlap + +[ Upstream commit 97bf0395c226907e1a9b908511a35192bf1e09bb ] + +Include the DECstation interrupt handler in opting out of +FPU support. + +Fixes a linker error: + +mips-linux-ld: arch/mips/dec/int-handler.o: in function `fpu': +(.text+0x148): undefined reference to `handle_fpe_int' + +Fixes: 183b40f992c8 ("MIPS: Allow FP support to be disabled") +Signed-off-by: Randy Dunlap +Reported-by: kernel test robot +Cc: Paul Burton +Cc: Thomas Bogendoerfer +Cc: Maciej W. Rozycki +Cc: linux-mips@vger.kernel.org +Acked-by: Maciej W. Rozycki +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/dec/int-handler.S | 6 +++--- + arch/mips/dec/setup.c | 3 ++- + 2 files changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S +index ea5b5a83f1e1..011d1d678840 100644 +--- a/arch/mips/dec/int-handler.S ++++ b/arch/mips/dec/int-handler.S +@@ -131,7 +131,7 @@ + */ + mfc0 t0,CP0_CAUSE # get pending interrupts + mfc0 t1,CP0_STATUS +-#ifdef CONFIG_32BIT ++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) + lw t2,cpu_fpu_mask + #endif + andi t0,ST0_IM # CAUSE.CE may be non-zero! +@@ -139,7 +139,7 @@ + + beqz t0,spurious + +-#ifdef CONFIG_32BIT ++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) + and t2,t0 + bnez t2,fpu # handle FPU immediately + #endif +@@ -280,7 +280,7 @@ handle_it: + j dec_irq_dispatch + nop + +-#ifdef CONFIG_32BIT ++#if defined(CONFIG_32BIT) && defined(CONFIG_MIPS_FP_SUPPORT) + fpu: + lw t0,fpu_kstat_irq + nop +diff --git a/arch/mips/dec/setup.c b/arch/mips/dec/setup.c +index eaad0ed4b523..99b9b29750db 100644 +--- a/arch/mips/dec/setup.c ++++ b/arch/mips/dec/setup.c +@@ -746,7 +746,8 @@ void __init arch_init_irq(void) + dec_interrupt[DEC_IRQ_HALT] = -1; + + /* Register board interrupts: FPU and cascade. */ +- if (dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) { ++ if (IS_ENABLED(CONFIG_MIPS_FP_SUPPORT) && ++ dec_interrupt[DEC_IRQ_FPU] >= 0 && cpu_has_fpu) { + struct irq_desc *desc_fpu; + int irq_fpu; + +-- +2.34.1 + diff --git a/queue-5.10/mips-pgalloc-fix-memory-leak-caused-by-pgd_free.patch b/queue-5.10/mips-pgalloc-fix-memory-leak-caused-by-pgd_free.patch new file mode 100644 index 00000000000..e5fd77f8461 --- /dev/null +++ b/queue-5.10/mips-pgalloc-fix-memory-leak-caused-by-pgd_free.patch @@ -0,0 +1,57 @@ +From aabc1ced648249d223e84c51b47d2a119c01dbda Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 10 Mar 2022 19:31:16 +0800 +Subject: MIPS: pgalloc: fix memory leak caused by pgd_free() + +From: Yaliang Wang + +[ Upstream commit 2bc5bab9a763d520937e4f3fe8df51c6a1eceb97 ] + +pgd page is freed by generic implementation pgd_free() since commit +f9cb654cb550 ("asm-generic: pgalloc: provide generic pgd_free()"), +however, there are scenarios that the system uses more than one page as +the pgd table, in such cases the generic implementation pgd_free() won't +be applicable anymore. For example, when PAGE_SIZE_4KB is enabled and +MIPS_VA_BITS_48 is not enabled in a 64bit system, the macro "PGD_ORDER" +will be set as "1", which will cause allocating two pages as the pgd +table. Well, at the same time, the generic implementation pgd_free() +just free one pgd page, which will result in the memory leak. + +The memory leak can be easily detected by executing shell command: +"while true; do ls > /dev/null; grep MemFree /proc/meminfo; done" + +Fixes: f9cb654cb550 ("asm-generic: pgalloc: provide generic pgd_free()") +Signed-off-by: Yaliang Wang +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/pgalloc.h | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/mips/include/asm/pgalloc.h b/arch/mips/include/asm/pgalloc.h +index 139b4050259f..71153c369f29 100644 +--- a/arch/mips/include/asm/pgalloc.h ++++ b/arch/mips/include/asm/pgalloc.h +@@ -15,6 +15,7 @@ + + #define __HAVE_ARCH_PMD_ALLOC_ONE + #define __HAVE_ARCH_PUD_ALLOC_ONE ++#define __HAVE_ARCH_PGD_FREE + #include + + static inline void pmd_populate_kernel(struct mm_struct *mm, pmd_t *pmd, +@@ -49,6 +50,11 @@ static inline void pud_populate(struct mm_struct *mm, pud_t *pud, pmd_t *pmd) + extern void pgd_init(unsigned long page); + extern pgd_t *pgd_alloc(struct mm_struct *mm); + ++static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd) ++{ ++ free_pages((unsigned long)pgd, PGD_ORDER); ++} ++ + #define __pte_free_tlb(tlb,pte,address) \ + do { \ + pgtable_pte_page_dtor(pte); \ +-- +2.34.1 + diff --git a/queue-5.10/mips-rb532-fix-return-value-of-__setup-handler.patch b/queue-5.10/mips-rb532-fix-return-value-of-__setup-handler.patch new file mode 100644 index 00000000000..22170c69bb2 --- /dev/null +++ b/queue-5.10/mips-rb532-fix-return-value-of-__setup-handler.patch @@ -0,0 +1,57 @@ +From 9474bc3f4b2c268f791e27fd56652059986b8dc0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 11 Mar 2022 20:20:26 -0800 +Subject: MIPS: RB532: fix return value of __setup handler + +From: Randy Dunlap + +[ Upstream commit 8755d57ba1ff910666572fab9e32890e8cc6ed3b ] + +__setup() handlers should return 1 to obsolete_checksetup() in +init/main.c to indicate that the boot option has been handled. +A return of 0 causes the boot option/value to be listed as an Unknown +kernel parameter and added to init's (limited) argument or environment +strings. Also, error return codes don't mean anything to +obsolete_checksetup() -- only non-zero (usually 1) or zero. +So return 1 from setup_kmac(). + +Fixes: 9e21c7e40b7e ("MIPS: RB532: Replace parse_mac_addr() with mac_pton().") +Fixes: 73b4390fb234 ("[MIPS] Routerboard 532: Support for base system") +Signed-off-by: Randy Dunlap +From: Igor Zhbanov +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Cc: Thomas Bogendoerfer +Cc: linux-mips@vger.kernel.org +Cc: "David S. Miller" +Cc: Jakub Kicinski +Cc: Phil Sutter +Cc: Florian Fainelli +Cc: Ralf Baechle +Cc: Daniel Walter +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Sasha Levin +--- + arch/mips/rb532/devices.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c +index dd34f1b32b79..0e3c8d761a45 100644 +--- a/arch/mips/rb532/devices.c ++++ b/arch/mips/rb532/devices.c +@@ -310,11 +310,9 @@ static int __init plat_setup_devices(void) + static int __init setup_kmac(char *s) + { + printk(KERN_INFO "korina mac = %s\n", s); +- if (!mac_pton(s, korina_dev0_data.mac)) { ++ if (!mac_pton(s, korina_dev0_data.mac)) + printk(KERN_ERR "Invalid mac\n"); +- return -EINVAL; +- } +- return 0; ++ return 1; + } + + __setup("kmac=", setup_kmac); +-- +2.34.1 + diff --git a/queue-5.10/misc-alcor_pci-fix-an-error-handling-path.patch b/queue-5.10/misc-alcor_pci-fix-an-error-handling-path.patch new file mode 100644 index 00000000000..55ccaa88019 --- /dev/null +++ b/queue-5.10/misc-alcor_pci-fix-an-error-handling-path.patch @@ -0,0 +1,72 @@ +From 3b7ed02cc32f895307b2f8560e5ba2b165830fed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 6 Feb 2022 09:39:54 +0100 +Subject: misc: alcor_pci: Fix an error handling path + +From: Christophe JAILLET + +[ Upstream commit 5b3dc949f554379edcb8ef6111aa5ecb78feb798 ] + +A successful ida_simple_get() should be balanced by a corresponding +ida_simple_remove(). + +Add the missing call in the error handling path of the probe. + +While at it, switch to ida_alloc()/ida_free() instead to +ida_simple_get()/ida_simple_remove(). +The latter is deprecated and more verbose. + +Fixes: 4f556bc04e3c ("misc: cardreader: add new Alcor Micro Cardreader PCI driver") +Reviewed-by: Oleksij Rempel +Signed-off-by: Christophe JAILLET +Link: https://lore.kernel.org/r/918a9875b7f67b7f8f123c4446452603422e8c5e.1644136776.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/misc/cardreader/alcor_pci.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/drivers/misc/cardreader/alcor_pci.c b/drivers/misc/cardreader/alcor_pci.c +index de6d44a158bb..3f514d77a843 100644 +--- a/drivers/misc/cardreader/alcor_pci.c ++++ b/drivers/misc/cardreader/alcor_pci.c +@@ -266,7 +266,7 @@ static int alcor_pci_probe(struct pci_dev *pdev, + if (!priv) + return -ENOMEM; + +- ret = ida_simple_get(&alcor_pci_idr, 0, 0, GFP_KERNEL); ++ ret = ida_alloc(&alcor_pci_idr, GFP_KERNEL); + if (ret < 0) + return ret; + priv->id = ret; +@@ -280,7 +280,8 @@ static int alcor_pci_probe(struct pci_dev *pdev, + ret = pci_request_regions(pdev, DRV_NAME_ALCOR_PCI); + if (ret) { + dev_err(&pdev->dev, "Cannot request region\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto error_free_ida; + } + + if (!(pci_resource_flags(pdev, bar) & IORESOURCE_MEM)) { +@@ -324,6 +325,8 @@ static int alcor_pci_probe(struct pci_dev *pdev, + + error_release_regions: + pci_release_regions(pdev); ++error_free_ida: ++ ida_free(&alcor_pci_idr, priv->id); + return ret; + } + +@@ -337,7 +340,7 @@ static void alcor_pci_remove(struct pci_dev *pdev) + + mfd_remove_devices(&pdev->dev); + +- ida_simple_remove(&alcor_pci_idr, priv->id); ++ ida_free(&alcor_pci_idr, priv->id); + + pci_release_regions(pdev); + pci_set_drvdata(pdev, NULL); +-- +2.34.1 + diff --git a/queue-5.10/mmc-davinci_mmc-handle-error-for-clk_enable.patch b/queue-5.10/mmc-davinci_mmc-handle-error-for-clk_enable.patch new file mode 100644 index 00000000000..bcd94395461 --- /dev/null +++ b/queue-5.10/mmc-davinci_mmc-handle-error-for-clk_enable.patch @@ -0,0 +1,43 @@ +From fcf99994fb0bb037f28256ab92e09dab0c9edf11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 15:14:15 +0800 +Subject: mmc: davinci_mmc: Handle error for clk_enable + +From: Jiasheng Jiang + +[ Upstream commit 09e7af76db02c74f2a339b3cb2d95460fa2ddbe4 ] + +As the potential failure of the clk_enable(), +it should be better to check it and return error +if fails. + +Fixes: bbce5802afc5 ("davinci: mmc: updates to suspend/resume implementation") +Signed-off-by: Jiasheng Jiang +Link: https://lore.kernel.org/r/20220308071415.1093393-1-jiasheng@iscas.ac.cn +Signed-off-by: Ulf Hansson +Signed-off-by: Sasha Levin +--- + drivers/mmc/host/davinci_mmc.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c +index 90cd179625fc..647928ab00a3 100644 +--- a/drivers/mmc/host/davinci_mmc.c ++++ b/drivers/mmc/host/davinci_mmc.c +@@ -1375,8 +1375,12 @@ static int davinci_mmcsd_suspend(struct device *dev) + static int davinci_mmcsd_resume(struct device *dev) + { + struct mmc_davinci_host *host = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_enable(host->clk); ++ if (ret) ++ return ret; + +- clk_enable(host->clk); + mmc_davinci_reset_ctrl(host, 0); + + return 0; +-- +2.34.1 + diff --git a/queue-5.10/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch b/queue-5.10/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch new file mode 100644 index 00000000000..8a9da768fd0 --- /dev/null +++ b/queue-5.10/mmc-host-return-an-error-when-enable_sdio_irq-ops-is.patch @@ -0,0 +1,60 @@ +From 6ddffd9916db6b10c69c2a06758bfd6482b2a25a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Mar 2022 17:51:42 +0100 +Subject: mmc: host: Return an error when ->enable_sdio_irq() ops is missing + +From: Ulf Hansson + +[ Upstream commit d6c9219ca1139b74541b2a98cee47a3426d754a9 ] + +Even if the current WARN() notifies the user that something is severely +wrong, we can still end up in a PANIC() when trying to invoke the missing +->enable_sdio_irq() ops. Therefore, let's also return an error code and +prevent the host from being added. + +While at it, move the code into a separate function to prepare for +subsequent changes and for further host caps validations. + +Signed-off-by: Ulf Hansson +Link: https://lore.kernel.org/r/20220303165142.129745-1-ulf.hansson@linaro.org +Signed-off-by: Sasha Levin +--- + drivers/mmc/core/host.c | 15 +++++++++++++-- + 1 file changed, 13 insertions(+), 2 deletions(-) + +diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c +index 864c8c205ff7..03e2f965a96a 100644 +--- a/drivers/mmc/core/host.c ++++ b/drivers/mmc/core/host.c +@@ -513,6 +513,16 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev) + + EXPORT_SYMBOL(mmc_alloc_host); + ++static int mmc_validate_host_caps(struct mmc_host *host) ++{ ++ if (host->caps & MMC_CAP_SDIO_IRQ && !host->ops->enable_sdio_irq) { ++ dev_warn(host->parent, "missing ->enable_sdio_irq() ops\n"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + /** + * mmc_add_host - initialise host hardware + * @host: mmc host +@@ -525,8 +535,9 @@ int mmc_add_host(struct mmc_host *host) + { + int err; + +- WARN_ON((host->caps & MMC_CAP_SDIO_IRQ) && +- !host->ops->enable_sdio_irq); ++ err = mmc_validate_host_caps(host); ++ if (err) ++ return err; + + err = device_add(&host->class_dev); + if (err) +-- +2.34.1 + diff --git a/queue-5.10/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch b/queue-5.10/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch new file mode 100644 index 00000000000..a93c39ec5be --- /dev/null +++ b/queue-5.10/mt76-mt7603-check-sta_rates-pointer-in-mt7603_sta_ra.patch @@ -0,0 +1,37 @@ +From f998441c9a869d44acacf449bbc23e590f7bd6a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jan 2022 15:58:57 +0100 +Subject: mt76: mt7603: check sta_rates pointer in mt7603_sta_rate_tbl_update + +From: Lorenzo Bianconi + +[ Upstream commit fc8e2c707ce11c8ec2e992885b0d53a5e04031ac ] + +Check sta_rates pointer value in mt7603_sta_rate_tbl_update routine +since minstrel_ht_update_rates can fail allocating rates array. + +Fixes: c8846e1015022 ("mt76: add driver for MT7603E and MT7628/7688") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7603/main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7603/main.c b/drivers/net/wireless/mediatek/mt76/mt7603/main.c +index c9226dceb510..bdff89cc3105 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7603/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7603/main.c +@@ -618,6 +618,9 @@ mt7603_sta_rate_tbl_update(struct ieee80211_hw *hw, struct ieee80211_vif *vif, + struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates); + int i; + ++ if (!sta_rates) ++ return; ++ + spin_lock_bh(&dev->mt76.lock); + for (i = 0; i < ARRAY_SIZE(msta->rates); i++) { + msta->rates[i].idx = sta_rates->rate[i].idx; +-- +2.34.1 + diff --git a/queue-5.10/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch b/queue-5.10/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch new file mode 100644 index 00000000000..ce742457be7 --- /dev/null +++ b/queue-5.10/mt76-mt7615-check-sta_rates-pointer-in-mt7615_sta_ra.patch @@ -0,0 +1,37 @@ +From f443082672c2298d1cdd5b63c5eee32f131d18c0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Jan 2022 15:58:58 +0100 +Subject: mt76: mt7615: check sta_rates pointer in mt7615_sta_rate_tbl_update + +From: Lorenzo Bianconi + +[ Upstream commit 6a6f457ed5fdf6777536c20644a9e42128a50ec2 ] + +Check sta_rates pointer value in mt7615_sta_rate_tbl_update routine +since minstrel_ht_update_rates can fail allocating rates array. + +Fixes: 04b8e65922f63 ("mt76: add mac80211 driver for MT7615 PCIe-based chipsets") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7615/main.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/main.c b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +index 88cdc2badeae..defa207f53d6 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7615/main.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7615/main.c +@@ -673,6 +673,9 @@ static void mt7615_sta_rate_tbl_update(struct ieee80211_hw *hw, + struct ieee80211_sta_rates *sta_rates = rcu_dereference(sta->rates); + int i; + ++ if (!sta_rates) ++ return; ++ + spin_lock_bh(&dev->mt76.lock); + for (i = 0; i < ARRAY_SIZE(msta->rates); i++) { + msta->rates[i].idx = sta_rates->rate[i].idx; +-- +2.34.1 + diff --git a/queue-5.10/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_sta_b.patch b/queue-5.10/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_sta_b.patch new file mode 100644 index 00000000000..37bf85db3b4 --- /dev/null +++ b/queue-5.10/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_sta_b.patch @@ -0,0 +1,51 @@ +From 96dbdb5bed37a8c0b005486ba9a97a9fd85e3576 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 17:06:36 +0100 +Subject: mt76: mt7915: use proper aid value in mt7915_mcu_sta_basic_tlv + +From: Lorenzo Bianconi + +[ Upstream commit abdb8bc94be4cf68aa71c9a8ee0bad9b3e6f52d3 ] + +Similar to mt7915_mcu_wtbl_generic_tlv, rely on vif->bss_conf.aid for +aid in sta mode and not on sta->aid. + +Fixes: e57b7901469fc ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index 6e73964b8b0a..41054ee43dbf 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -1317,12 +1317,15 @@ mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, + case NL80211_IFTYPE_MESH_POINT: + case NL80211_IFTYPE_AP: + basic->conn_type = cpu_to_le32(CONNECTION_INFRA_STA); ++ basic->aid = cpu_to_le16(sta->aid); + break; + case NL80211_IFTYPE_STATION: + basic->conn_type = cpu_to_le32(CONNECTION_INFRA_AP); ++ basic->aid = cpu_to_le16(vif->bss_conf.aid); + break; + case NL80211_IFTYPE_ADHOC: + basic->conn_type = cpu_to_le32(CONNECTION_IBSS_ADHOC); ++ basic->aid = cpu_to_le16(sta->aid); + break; + default: + WARN_ON(1); +@@ -1330,7 +1333,6 @@ mt7915_mcu_sta_basic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, + } + + memcpy(basic->peer_addr, sta->addr, ETH_ALEN); +- basic->aid = cpu_to_le16(sta->aid); + basic->qos = sta->wme; + } + +-- +2.34.1 + diff --git a/queue-5.10/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_wtbl_.patch b/queue-5.10/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_wtbl_.patch new file mode 100644 index 00000000000..eab87adb3ef --- /dev/null +++ b/queue-5.10/mt76-mt7915-use-proper-aid-value-in-mt7915_mcu_wtbl_.patch @@ -0,0 +1,42 @@ +From 852dcc89be6e951d77eb7c5bdd7ef9134e52a3ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 22 Dec 2021 12:52:17 +0100 +Subject: mt76: mt7915: use proper aid value in mt7915_mcu_wtbl_generic_tlv in + sta mode + +From: Lorenzo Bianconi + +[ Upstream commit a56b1b0f145ef2d6bb9312dedf3ab8558ef50a5b ] + +mac80211 provides aid in vif->bss_conf.aid for sta mode and not in +sta->aid. Fix mt7915_mcu_wtbl_generic_tlv routine using proper value for +aid in sta mode. + +Fixes: e57b7901469fc ("mt76: add mac80211 driver for MT7915 PCIe-based chipsets") +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +index 9a7f317a098f..6e73964b8b0a 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +@@ -1259,8 +1259,11 @@ mt7915_mcu_wtbl_generic_tlv(struct sk_buff *skb, struct ieee80211_vif *vif, + generic = (struct wtbl_generic *)tlv; + + if (sta) { ++ if (vif->type == NL80211_IFTYPE_STATION) ++ generic->partial_aid = cpu_to_le16(vif->bss_conf.aid); ++ else ++ generic->partial_aid = cpu_to_le16(sta->aid); + memcpy(generic->peer_addr, sta->addr, ETH_ALEN); +- generic->partial_aid = cpu_to_le16(sta->aid); + generic->muar_idx = mvif->omac_idx; + generic->qos = sta->wme; + } else { +-- +2.34.1 + diff --git a/queue-5.10/mtd-onenand-check-for-error-irq.patch b/queue-5.10/mtd-onenand-check-for-error-irq.patch new file mode 100644 index 00000000000..8fb5162f629 --- /dev/null +++ b/queue-5.10/mtd-onenand-check-for-error-irq.patch @@ -0,0 +1,47 @@ +From 886877a7d70eb95ac439e6e5a32ec7039de8c003 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Jan 2022 00:26:58 +0800 +Subject: mtd: onenand: Check for error irq + +From: Jiasheng Jiang + +[ Upstream commit 3e68f331c8c759c0daa31cc92c3449b23119a215 ] + +For the possible failure of the platform_get_irq(), the returned irq +could be error number and will finally cause the failure of the +request_irq(). +Consider that platform_get_irq() can now in certain cases return +-EPROBE_DEFER, and the consequences of letting request_irq() effectively +convert that into -EINVAL, even at probe time rather than later on. +So it might be better to check just now. + +Fixes: 2c22120fbd01 ("MTD: OneNAND: interrupt based wait support") +Signed-off-by: Jiasheng Jiang +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220104162658.1988142-1-jiasheng@iscas.ac.cn +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/onenand/generic.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/drivers/mtd/nand/onenand/generic.c b/drivers/mtd/nand/onenand/generic.c +index 8b6f4da5d720..a4b8b65fe15f 100644 +--- a/drivers/mtd/nand/onenand/generic.c ++++ b/drivers/mtd/nand/onenand/generic.c +@@ -53,7 +53,12 @@ static int generic_onenand_probe(struct platform_device *pdev) + } + + info->onenand.mmcontrol = pdata ? pdata->mmcontrol : NULL; +- info->onenand.irq = platform_get_irq(pdev, 0); ++ ++ err = platform_get_irq(pdev, 0); ++ if (err < 0) ++ goto out_iounmap; ++ ++ info->onenand.irq = err; + + info->mtd.dev.parent = &pdev->dev; + info->mtd.priv = &info->onenand; +-- +2.34.1 + diff --git a/queue-5.10/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch b/queue-5.10/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch new file mode 100644 index 00000000000..1fb20b8ca76 --- /dev/null +++ b/queue-5.10/mtd-rawnand-atmel-fix-refcount-issue-in-atmel_nand_c.patch @@ -0,0 +1,75 @@ +From d6e3aab15bae7a3600c871a719a6da89de40b775 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 16:53:32 +0800 +Subject: mtd: rawnand: atmel: fix refcount issue in atmel_nand_controller_init + +From: Xin Xiong + +[ Upstream commit fecbd4a317c95d73c849648c406bcf1b6a0ec1cf ] + +The reference counting issue happens in several error handling paths +on a refcounted object "nc->dmac". In these paths, the function simply +returns the error code, forgetting to balance the reference count of +"nc->dmac", increased earlier by dma_request_channel(), which may +cause refcount leaks. + +Fix it by decrementing the refcount of specific object in those error +paths. + +Fixes: f88fc122cc34 ("mtd: nand: Cleanup/rework the atmel_nand driver") +Co-developed-by: Xiyu Yang +Signed-off-by: Xiyu Yang +Co-developed-by: Xin Tan +Signed-off-by: Xin Tan +Signed-off-by: Xin Xiong +Reviewed-by: Claudiu Beznea +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220304085330.3610-1-xiongx18@fudan.edu.cn +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/atmel/nand-controller.c | 14 +++++++++++--- + 1 file changed, 11 insertions(+), 3 deletions(-) + +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index 8aab1017b460..c048e826746a 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -2057,13 +2057,15 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, + nc->mck = of_clk_get(dev->parent->of_node, 0); + if (IS_ERR(nc->mck)) { + dev_err(dev, "Failed to retrieve MCK clk\n"); +- return PTR_ERR(nc->mck); ++ ret = PTR_ERR(nc->mck); ++ goto out_release_dma; + } + + np = of_parse_phandle(dev->parent->of_node, "atmel,smc", 0); + if (!np) { + dev_err(dev, "Missing or invalid atmel,smc property\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out_release_dma; + } + + nc->smc = syscon_node_to_regmap(np); +@@ -2071,10 +2073,16 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, + if (IS_ERR(nc->smc)) { + ret = PTR_ERR(nc->smc); + dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret); +- return ret; ++ goto out_release_dma; + } + + return 0; ++ ++out_release_dma: ++ if (nc->dmac) ++ dma_release_channel(nc->dmac); ++ ++ return ret; + } + + static int +-- +2.34.1 + diff --git a/queue-5.10/mtd-rawnand-gpmi-fix-controller-timings-setting.patch b/queue-5.10/mtd-rawnand-gpmi-fix-controller-timings-setting.patch new file mode 100644 index 00000000000..a623db5b429 --- /dev/null +++ b/queue-5.10/mtd-rawnand-gpmi-fix-controller-timings-setting.patch @@ -0,0 +1,59 @@ +From fd2e96a71e0bff0968d69ee8ad4ffef6e4bd054f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Jan 2022 10:54:32 +0100 +Subject: mtd: rawnand: gpmi: fix controller timings setting + +From: Dario Binacchi + +[ Upstream commit 2970bf5a32f079e1e9197411db4fe9faccb1503a ] + +Set the controller registers according to the real clock rate. The +controller registers configuration (setup, hold, timeout, ... cycles) +depends on the clock rate of the GPMI. Using the real rate instead of +the ideal one, avoids that this inaccuracy (required_rate - real_rate) +affects the registers setting. + +This patch has been tested on two custom boards with i.MX28 and i.MX6 +SOCs: +- i.MX28: + required rate 100MHz, real rate 99.3MHz +- i.MX6 + required rate 100MHz, real rate 99MHz + +Fixes: b1206122069a ("mtd: rawnand: gpmi: use core timings instead of an empirical derivation") +Co-developed-by: Michael Trimarchi +Signed-off-by: Michael Trimarchi +Signed-off-by: Dario Binacchi +Tested-by: Sascha Hauer +Reviewed-by: Sascha Hauer +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220118095434.35081-3-dario.binacchi@amarulasolutions.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +index cb7631145700..92e8ca56f566 100644 +--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c +@@ -646,6 +646,7 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, + const struct nand_sdr_timings *sdr) + { + struct gpmi_nfc_hardware_timing *hw = &this->hw; ++ struct resources *r = &this->resources; + unsigned int dll_threshold_ps = this->devdata->max_chain_delay; + unsigned int period_ps, reference_period_ps; + unsigned int data_setup_cycles, data_hold_cycles, addr_setup_cycles; +@@ -669,6 +670,8 @@ static void gpmi_nfc_compute_timings(struct gpmi_nand_data *this, + wrn_dly_sel = BV_GPMI_CTRL1_WRN_DLY_SEL_NO_DELAY; + } + ++ hw->clk_rate = clk_round_rate(r->clock[0], hw->clk_rate); ++ + /* SDR core timings are given in picoseconds */ + period_ps = div_u64((u64)NSEC_PER_SEC * 1000, hw->clk_rate); + +-- +2.34.1 + diff --git a/queue-5.10/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch b/queue-5.10/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch new file mode 100644 index 00000000000..ebd71991728 --- /dev/null +++ b/queue-5.10/mxser-fix-xmit_buf-leak-in-activate-when-lsr-0xff.patch @@ -0,0 +1,76 @@ +From f749bbfa31c185722d56e492a27cba55de277025 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 24 Jan 2022 08:14:24 +0100 +Subject: mxser: fix xmit_buf leak in activate when LSR == 0xff + +From: Jiri Slaby + +[ Upstream commit cd3a4907ee334b40d7aa880c7ab310b154fd5cd4 ] + +When LSR is 0xff in ->activate() (rather unlike), we return an error. +Provided ->shutdown() is not called when ->activate() fails, nothing +actually frees the buffer in this case. + +Fix this by properly freeing the buffer in a designated label. We jump +there also from the "!info->type" if now too. + +Fixes: 6769140d3047 ("tty: mxser: use the tty_port_open method") +Signed-off-by: Jiri Slaby +Link: https://lore.kernel.org/r/20220124071430.14907-6-jslaby@suse.cz +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/mxser.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c +index 3703987c4666..8344265a1948 100644 +--- a/drivers/tty/mxser.c ++++ b/drivers/tty/mxser.c +@@ -858,6 +858,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + struct mxser_port *info = container_of(port, struct mxser_port, port); + unsigned long page; + unsigned long flags; ++ int ret; + + page = __get_free_page(GFP_KERNEL); + if (!page) +@@ -867,9 +868,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + + if (!info->ioaddr || !info->type) { + set_bit(TTY_IO_ERROR, &tty->flags); +- free_page(page); + spin_unlock_irqrestore(&info->slock, flags); +- return 0; ++ ret = 0; ++ goto err_free_xmit; + } + info->port.xmit_buf = (unsigned char *) page; + +@@ -895,8 +896,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + if (capable(CAP_SYS_ADMIN)) { + set_bit(TTY_IO_ERROR, &tty->flags); + return 0; +- } else +- return -ENODEV; ++ } ++ ++ ret = -ENODEV; ++ goto err_free_xmit; + } + + /* +@@ -941,6 +944,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + spin_unlock_irqrestore(&info->slock, flags); + + return 0; ++err_free_xmit: ++ free_page(page); ++ info->port.xmit_buf = NULL; ++ return ret; + } + + /* +-- +2.34.1 + diff --git a/queue-5.10/net-axienet-fix-rx-ring-refill-allocation-failure-ha.patch b/queue-5.10/net-axienet-fix-rx-ring-refill-allocation-failure-ha.patch new file mode 100644 index 00000000000..1a4b04d6bbf --- /dev/null +++ b/queue-5.10/net-axienet-fix-rx-ring-refill-allocation-failure-ha.patch @@ -0,0 +1,141 @@ +From c82a7edc1d1497a5b6c175f5fa6324cc0675c615 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 4 Mar 2022 20:24:37 -0600 +Subject: net: axienet: fix RX ring refill allocation failure handling + +From: Robert Hancock + +[ Upstream commit 7a7d340ba4d9351e4c8847b898a2b996727a922a ] + +If a memory allocation error occurred during an attempt to refill a slot +in the RX ring after the packet was received, the hardware tail pointer +would still have been updated to point to or past the slot which remained +marked as previously completed. This would likely result in the DMA engine +raising an error when it eventually tried to use that slot again. + +If a slot cannot be refilled, then just stop processing and do not move +the tail pointer past it. On the next attempt, we should skip receiving +the packet from the empty slot and just try to refill it again. + +This failure mode has not actually been observed, but was found as part +of other driver updates. + +Fixes: 8a3b7a252dca ("drivers/net/ethernet/xilinx: added Xilinx AXI Ethernet driver") +Signed-off-by: Robert Hancock +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/xilinx/xilinx_axienet_main.c | 72 +++++++++++-------- + 1 file changed, 42 insertions(+), 30 deletions(-) + +diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +index 0baf85122f5a..bbdcba88c021 100644 +--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c ++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +@@ -857,46 +857,53 @@ static void axienet_recv(struct net_device *ndev) + while ((cur_p->status & XAXIDMA_BD_STS_COMPLETE_MASK)) { + dma_addr_t phys; + +- tail_p = lp->rx_bd_p + sizeof(*lp->rx_bd_v) * lp->rx_bd_ci; +- + /* Ensure we see complete descriptor update */ + dma_rmb(); +- phys = desc_get_phys_addr(lp, cur_p); +- dma_unmap_single(ndev->dev.parent, phys, lp->max_frm_size, +- DMA_FROM_DEVICE); + + skb = cur_p->skb; + cur_p->skb = NULL; +- length = cur_p->app4 & 0x0000FFFF; +- +- skb_put(skb, length); +- skb->protocol = eth_type_trans(skb, ndev); +- /*skb_checksum_none_assert(skb);*/ +- skb->ip_summed = CHECKSUM_NONE; +- +- /* if we're doing Rx csum offload, set it up */ +- if (lp->features & XAE_FEATURE_FULL_RX_CSUM) { +- csumstatus = (cur_p->app2 & +- XAE_FULL_CSUM_STATUS_MASK) >> 3; +- if ((csumstatus == XAE_IP_TCP_CSUM_VALIDATED) || +- (csumstatus == XAE_IP_UDP_CSUM_VALIDATED)) { +- skb->ip_summed = CHECKSUM_UNNECESSARY; ++ ++ /* skb could be NULL if a previous pass already received the ++ * packet for this slot in the ring, but failed to refill it ++ * with a newly allocated buffer. In this case, don't try to ++ * receive it again. ++ */ ++ if (likely(skb)) { ++ length = cur_p->app4 & 0x0000FFFF; ++ ++ phys = desc_get_phys_addr(lp, cur_p); ++ dma_unmap_single(ndev->dev.parent, phys, lp->max_frm_size, ++ DMA_FROM_DEVICE); ++ ++ skb_put(skb, length); ++ skb->protocol = eth_type_trans(skb, ndev); ++ /*skb_checksum_none_assert(skb);*/ ++ skb->ip_summed = CHECKSUM_NONE; ++ ++ /* if we're doing Rx csum offload, set it up */ ++ if (lp->features & XAE_FEATURE_FULL_RX_CSUM) { ++ csumstatus = (cur_p->app2 & ++ XAE_FULL_CSUM_STATUS_MASK) >> 3; ++ if (csumstatus == XAE_IP_TCP_CSUM_VALIDATED || ++ csumstatus == XAE_IP_UDP_CSUM_VALIDATED) { ++ skb->ip_summed = CHECKSUM_UNNECESSARY; ++ } ++ } else if ((lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) != 0 && ++ skb->protocol == htons(ETH_P_IP) && ++ skb->len > 64) { ++ skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF); ++ skb->ip_summed = CHECKSUM_COMPLETE; + } +- } else if ((lp->features & XAE_FEATURE_PARTIAL_RX_CSUM) != 0 && +- skb->protocol == htons(ETH_P_IP) && +- skb->len > 64) { +- skb->csum = be32_to_cpu(cur_p->app3 & 0xFFFF); +- skb->ip_summed = CHECKSUM_COMPLETE; +- } + +- netif_rx(skb); ++ netif_rx(skb); + +- size += length; +- packets++; ++ size += length; ++ packets++; ++ } + + new_skb = netdev_alloc_skb_ip_align(ndev, lp->max_frm_size); + if (!new_skb) +- return; ++ break; + + phys = dma_map_single(ndev->dev.parent, new_skb->data, + lp->max_frm_size, +@@ -905,7 +912,7 @@ static void axienet_recv(struct net_device *ndev) + if (net_ratelimit()) + netdev_err(ndev, "RX DMA mapping error\n"); + dev_kfree_skb(new_skb); +- return; ++ break; + } + desc_set_phys_addr(lp, phys, cur_p); + +@@ -913,6 +920,11 @@ static void axienet_recv(struct net_device *ndev) + cur_p->status = 0; + cur_p->skb = new_skb; + ++ /* Only update tail_p to mark this slot as usable after it has ++ * been successfully refilled. ++ */ ++ tail_p = lp->rx_bd_p + sizeof(*lp->rx_bd_v) * lp->rx_bd_ci; ++ + if (++lp->rx_bd_ci >= lp->rx_bd_num) + lp->rx_bd_ci = 0; + cur_p = &lp->rx_bd_v[lp->rx_bd_ci]; +-- +2.34.1 + diff --git a/queue-5.10/net-bcmgenet-use-stronger-register-read-writes-to-as.patch b/queue-5.10/net-bcmgenet-use-stronger-register-read-writes-to-as.patch new file mode 100644 index 00000000000..212696bdf55 --- /dev/null +++ b/queue-5.10/net-bcmgenet-use-stronger-register-read-writes-to-as.patch @@ -0,0 +1,115 @@ +From 644586a801e1690e93eab6aa3b3aff1430535a62 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 22:53:58 -0600 +Subject: net: bcmgenet: Use stronger register read/writes to assure ordering + +From: Jeremy Linton + +[ Upstream commit 8d3ea3d402db94b61075617e71b67459a714a502 ] + +GCC12 appears to be much smarter about its dependency tracking and is +aware that the relaxed variants are just normal loads and stores and +this is causing problems like: + +[ 210.074549] ------------[ cut here ]------------ +[ 210.079223] NETDEV WATCHDOG: enabcm6e4ei0 (bcmgenet): transmit queue 1 timed out +[ 210.086717] WARNING: CPU: 1 PID: 0 at net/sched/sch_generic.c:529 dev_watchdog+0x234/0x240 +[ 210.095044] Modules linked in: genet(E) nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat] +[ 210.146561] ACPI CPPC: PCC check channel failed for ss: 0. ret=-110 +[ 210.146927] CPU: 1 PID: 0 Comm: swapper/1 Tainted: G E 5.17.0-rc7G12+ #58 +[ 210.153226] CPPC Cpufreq:cppc_scale_freq_workfn: failed to read perf counters +[ 210.161349] Hardware name: Raspberry Pi Foundation Raspberry Pi 4 Model B/Raspberry Pi 4 Model B, BIOS EDK2-DEV 02/08/2022 +[ 210.161353] pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 210.161358] pc : dev_watchdog+0x234/0x240 +[ 210.161364] lr : dev_watchdog+0x234/0x240 +[ 210.161368] sp : ffff8000080a3a40 +[ 210.161370] x29: ffff8000080a3a40 x28: ffffcd425af87000 x27: ffff8000080a3b20 +[ 210.205150] x26: ffffcd425aa00000 x25: 0000000000000001 x24: ffffcd425af8ec08 +[ 210.212321] x23: 0000000000000100 x22: ffffcd425af87000 x21: ffff55b142688000 +[ 210.219491] x20: 0000000000000001 x19: ffff55b1426884c8 x18: ffffffffffffffff +[ 210.226661] x17: 64656d6974203120 x16: 0000000000000001 x15: 6d736e617274203a +[ 210.233831] x14: 2974656e65676d63 x13: ffffcd4259c300d8 x12: ffffcd425b07d5f0 +[ 210.241001] x11: 00000000ffffffff x10: ffffcd425b07d5f0 x9 : ffffcd4258bdad9c +[ 210.248171] x8 : 00000000ffffdfff x7 : 000000000000003f x6 : 0000000000000000 +[ 210.255341] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000001000 +[ 210.262511] x2 : 0000000000001000 x1 : 0000000000000005 x0 : 0000000000000044 +[ 210.269682] Call trace: +[ 210.272133] dev_watchdog+0x234/0x240 +[ 210.275811] call_timer_fn+0x3c/0x15c +[ 210.279489] __run_timers.part.0+0x288/0x310 +[ 210.283777] run_timer_softirq+0x48/0x80 +[ 210.287716] __do_softirq+0x128/0x360 +[ 210.291392] __irq_exit_rcu+0x138/0x140 +[ 210.295243] irq_exit_rcu+0x1c/0x30 +[ 210.298745] el1_interrupt+0x38/0x54 +[ 210.302334] el1h_64_irq_handler+0x18/0x24 +[ 210.306445] el1h_64_irq+0x7c/0x80 +[ 210.309857] arch_cpu_idle+0x18/0x2c +[ 210.313445] default_idle_call+0x4c/0x140 +[ 210.317470] cpuidle_idle_call+0x14c/0x1a0 +[ 210.321584] do_idle+0xb0/0x100 +[ 210.324737] cpu_startup_entry+0x30/0x8c +[ 210.328675] secondary_start_kernel+0xe4/0x110 +[ 210.333138] __secondary_switched+0x94/0x98 + +The assumption when these were relaxed seems to be that device memory +would be mapped non reordering, and that other constructs +(spinlocks/etc) would provide the barriers to assure that packet data +and in memory rings/queues were ordered with respect to device +register reads/writes. This itself seems a bit sketchy, but the real +problem with GCC12 is that it is moving the actual reads/writes around +at will as though they were independent operations when in truth they +are not, but the compiler can't know that. When looking at the +assembly dumps for many of these routines its possible to see very +clean, but not strictly in program order operations occurring as the +compiler would be free to do if these weren't actually register +reads/write operations. + +Its possible to suppress the timeout with a liberal bit of dma_mb()'s +sprinkled around but the device still seems unable to reliably +send/receive data. A better plan is to use the safer readl/writel +everywhere. + +Since this partially reverts an older commit, which notes the use of +the relaxed variants for performance reasons. I would suggest that +any performance problems with this commit are targeted at relaxing only +the performance critical code paths after assuring proper barriers. + +Fixes: 69d2ea9c79898 ("net: bcmgenet: Use correct I/O accessors") +Reported-by: Peter Robinson +Signed-off-by: Jeremy Linton +Acked-by: Peter Robinson +Tested-by: Peter Robinson +Acked-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220310045358.224350-1-jeremy.linton@arm.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index a2062144d7ca..7dcd5613ee56 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -76,7 +76,7 @@ static inline void bcmgenet_writel(u32 value, void __iomem *offset) + if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) + __raw_writel(value, offset); + else +- writel_relaxed(value, offset); ++ writel(value, offset); + } + + static inline u32 bcmgenet_readl(void __iomem *offset) +@@ -84,7 +84,7 @@ static inline u32 bcmgenet_readl(void __iomem *offset) + if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) + return __raw_readl(offset); + else +- return readl_relaxed(offset); ++ return readl(offset); + } + + static inline void dmadesc_set_length_status(struct bcmgenet_priv *priv, +-- +2.34.1 + diff --git a/queue-5.10/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch b/queue-5.10/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch new file mode 100644 index 00000000000..51222063882 --- /dev/null +++ b/queue-5.10/net-dsa-bcm_sf2_cfp-fix-an-incorrect-null-check-on-l.patch @@ -0,0 +1,55 @@ +From fbb9c1bc799def1b2cb7f26090f80d72b77b995e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Mar 2022 11:24:31 +0800 +Subject: net: dsa: bcm_sf2_cfp: fix an incorrect NULL check on list iterator + +From: Xiaomeng Tong + +[ Upstream commit 6da69b1da130e7d96766042750cd9f902e890eba ] + +The bug is here: + return rule; + +The list iterator value 'rule' will *always* be set and non-NULL +by list_for_each_entry(), so it is incorrect to assume that the +iterator value will be NULL if the list is empty or no element +is found. + +To fix the bug, return 'rule' when found, otherwise return NULL. + +Fixes: ae7a5aff783c7 ("net: dsa: bcm_sf2: Keep copy of inserted rules") +Reviewed-by: Vladimir Oltean +Reviewed-by: Florian Fainelli +Signed-off-by: Xiaomeng Tong +Link: https://lore.kernel.org/r/20220328032431.22538-1-xiam0nd.tong@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/bcm_sf2_cfp.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/dsa/bcm_sf2_cfp.c b/drivers/net/dsa/bcm_sf2_cfp.c +index d82cee5d9202..cbf44fc7d03a 100644 +--- a/drivers/net/dsa/bcm_sf2_cfp.c ++++ b/drivers/net/dsa/bcm_sf2_cfp.c +@@ -567,14 +567,14 @@ static void bcm_sf2_cfp_slice_ipv6(struct bcm_sf2_priv *priv, + static struct cfp_rule *bcm_sf2_cfp_rule_find(struct bcm_sf2_priv *priv, + int port, u32 location) + { +- struct cfp_rule *rule = NULL; ++ struct cfp_rule *rule; + + list_for_each_entry(rule, &priv->cfp.rules_list, next) { + if (rule->port == port && rule->fs.location == location) +- break; ++ return rule; + } + +- return rule; ++ return NULL; + } + + static int bcm_sf2_cfp_rule_cmp(struct bcm_sf2_priv *priv, int port, +-- +2.34.1 + diff --git a/queue-5.10/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch b/queue-5.10/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch new file mode 100644 index 00000000000..b40072c99df --- /dev/null +++ b/queue-5.10/net-dsa-mv88e6xxx-enable-port-policy-support-on-6097.patch @@ -0,0 +1,35 @@ +From f58f5e5003efd6ca20b2eccbb4447a4fe91bb880 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 3 Feb 2022 11:16:55 +0100 +Subject: net: dsa: mv88e6xxx: Enable port policy support on 6097 + +From: Tobias Waldekranz + +[ Upstream commit 585d42bb57bb358d48906660a8de273b078810b1 ] + +This chip has support for the same per-port policy actions found in +later versions of LinkStreet devices. + +Fixes: f3a2cd326e44 ("net: dsa: mv88e6xxx: introduce .port_set_policy") +Signed-off-by: Tobias Waldekranz +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/mv88e6xxx/chip.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c +index 1992be77522a..e79a808375fc 100644 +--- a/drivers/net/dsa/mv88e6xxx/chip.c ++++ b/drivers/net/dsa/mv88e6xxx/chip.c +@@ -3297,6 +3297,7 @@ static const struct mv88e6xxx_ops mv88e6097_ops = { + .port_set_link = mv88e6xxx_port_set_link, + .port_set_speed_duplex = mv88e6185_port_set_speed_duplex, + .port_tag_remap = mv88e6095_port_tag_remap, ++ .port_set_policy = mv88e6352_port_set_policy, + .port_set_frame_mode = mv88e6351_port_set_frame_mode, + .port_set_egress_floods = mv88e6352_port_set_egress_floods, + .port_set_ether_type = mv88e6351_port_set_ether_type, +-- +2.34.1 + diff --git a/queue-5.10/net-enetc-report-software-timestamping-via-so_timest.patch b/queue-5.10/net-enetc-report-software-timestamping-via-so_timest.patch new file mode 100644 index 00000000000..d37cf31bb1d --- /dev/null +++ b/queue-5.10/net-enetc-report-software-timestamping-via-so_timest.patch @@ -0,0 +1,41 @@ +From 701d723b0b9487767b146ed2a544bb533c4358ae Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Mar 2022 18:12:10 +0200 +Subject: net: enetc: report software timestamping via SO_TIMESTAMPING + +From: Vladimir Oltean + +[ Upstream commit feb13dcb1818b775fbd9191f797be67cd605f03e ] + +Let user space properly determine that the enetc driver provides +software timestamps. + +Fixes: 4caefbce06d1 ("enetc: add software timestamping") +Signed-off-by: Vladimir Oltean +Reviewed-by: Claudiu Manoil +Link: https://lore.kernel.org/r/20220324161210.4122281-1-vladimir.oltean@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/enetc/enetc_ethtool.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +index 9c1690f64a02..cf98a00296ed 100644 +--- a/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c ++++ b/drivers/net/ethernet/freescale/enetc/enetc_ethtool.c +@@ -651,7 +651,10 @@ static int enetc_get_ts_info(struct net_device *ndev, + #ifdef CONFIG_FSL_ENETC_PTP_CLOCK + info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE | + SOF_TIMESTAMPING_RX_HARDWARE | +- SOF_TIMESTAMPING_RAW_HARDWARE; ++ SOF_TIMESTAMPING_RAW_HARDWARE | ++ SOF_TIMESTAMPING_TX_SOFTWARE | ++ SOF_TIMESTAMPING_RX_SOFTWARE | ++ SOF_TIMESTAMPING_SOFTWARE; + + info->tx_types = (1 << HWTSTAMP_TX_OFF) | + (1 << HWTSTAMP_TX_ON); +-- +2.34.1 + diff --git a/queue-5.10/net-hns3-fix-bug-when-pf-set-the-duplicate-mac-addre.patch b/queue-5.10/net-hns3-fix-bug-when-pf-set-the-duplicate-mac-addre.patch new file mode 100644 index 00000000000..f79721d60d0 --- /dev/null +++ b/queue-5.10/net-hns3-fix-bug-when-pf-set-the-duplicate-mac-addre.patch @@ -0,0 +1,51 @@ +From 6f647862f931dfacc5195c1200e0ec93e9d73ff7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Mar 2022 20:54:47 +0800 +Subject: net: hns3: fix bug when PF set the duplicate MAC address for VFs + +From: Jian Shen + +[ Upstream commit ccb18f05535c96d26e2d559d402acb87700fc5a7 ] + +If the MAC address A is configured to vport A and then vport B. The MAC +address of vport A in the hardware becomes invalid. If the address of +vport A is changed to MAC address B, the driver needs to delete the MAC +address A of vport A. Due to the MAC address A of vport A has become +invalid in the hardware entry, so "-ENOENT" is returned. In this case, the +"used_umv_size" value recorded in driver is not updated. As a result, the +MAC entry status of the software is inconsistent with that of the hardware. + +Therefore, the driver updates the umv size even if the MAC entry cannot be +found. Ensure that the software and hardware status is consistent. + +Fixes: ee4bcd3b7ae4 ("net: hns3: refactor the MAC address configure") +Signed-off-by: Jian Shen +Signed-off-by: Guangbin Huang +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 7b94764b4f5d..49129e8002fc 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -7616,12 +7616,11 @@ int hclge_rm_uc_addr_common(struct hclge_vport *vport, + hnae3_set_bit(req.entry_type, HCLGE_MAC_VLAN_BIT0_EN_B, 0); + hclge_prepare_mac_addr(&req, addr, false); + ret = hclge_remove_mac_vlan_tbl(vport, &req); +- if (!ret) { ++ if (!ret || ret == -ENOENT) { + mutex_lock(&hdev->vport_lock); + hclge_update_umv_space(vport, true); + mutex_unlock(&hdev->vport_lock); +- } else if (ret == -ENOENT) { +- ret = 0; ++ return 0; + } + + return ret; +-- +2.34.1 + diff --git a/queue-5.10/net-phy-broadcom-fix-brcm_fet_config_init.patch b/queue-5.10/net-phy-broadcom-fix-brcm_fet_config_init.patch new file mode 100644 index 00000000000..bbb1052e26e --- /dev/null +++ b/queue-5.10/net-phy-broadcom-fix-brcm_fet_config_init.patch @@ -0,0 +1,79 @@ +From ef898438ed7a10c3da7275e111f63ed80c6bcbb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Mar 2022 16:24:38 -0700 +Subject: net: phy: broadcom: Fix brcm_fet_config_init() + +From: Florian Fainelli + +[ Upstream commit bf8bfc4336f7a34e48b3bbd19b1542bf085bdc3d ] + +A Broadcom AC201 PHY (same entry as 5241) would be flagged by the +Broadcom UniMAC MDIO controller as not completing the turn around +properly since the PHY expects 65 MDC clock cycles to complete a write +cycle, and the MDIO controller was only sending 64 MDC clock cycles as +determined by looking at a scope shot. + +This would make the subsequent read fail with the UniMAC MDIO controller +command field having MDIO_READ_FAIL set and we would abort the +brcm_fet_config_init() function and thus not probe the PHY at all. + +After issuing a software reset, wait for at least 1ms which is well +above the 1us reset delay advertised by the datasheet and issue a dummy +read to let the PHY turn around the line properly. This read +specifically ignores -EIO which would be returned by MDIO controllers +checking for the line being turned around. + +If we have a genuine reaad failure, the next read of the interrupt +status register would pick it up anyway. + +Fixes: d7a2ed9248a3 ("broadcom: Add AC131 phy support") +Signed-off-by: Florian Fainelli +Link: https://lore.kernel.org/r/20220324232438.1156812-1-f.fainelli@gmail.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/broadcom.c | 21 +++++++++++++++++++++ + 1 file changed, 21 insertions(+) + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index 644861366d54..0cde17bd743f 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -11,6 +11,7 @@ + */ + + #include "bcm-phy-lib.h" ++#include + #include + #include + #include +@@ -622,6 +623,26 @@ static int brcm_fet_config_init(struct phy_device *phydev) + if (err < 0) + return err; + ++ /* The datasheet indicates the PHY needs up to 1us to complete a reset, ++ * build some slack here. ++ */ ++ usleep_range(1000, 2000); ++ ++ /* The PHY requires 65 MDC clock cycles to complete a write operation ++ * and turnaround the line properly. ++ * ++ * We ignore -EIO here as the MDIO controller (e.g.: mdio-bcm-unimac) ++ * may flag the lack of turn-around as a read failure. This is ++ * particularly true with this combination since the MDIO controller ++ * only used 64 MDC cycles. This is not a critical failure in this ++ * specific case and it has no functional impact otherwise, so we let ++ * that one go through. If there is a genuine bus error, the next read ++ * of MII_BRCM_FET_INTREG will error out. ++ */ ++ err = phy_read(phydev, MII_BMCR); ++ if (err < 0 && err != -EIO) ++ return err; ++ + reg = phy_read(phydev, MII_BRCM_FET_INTREG); + if (reg < 0) + return reg; +-- +2.34.1 + diff --git a/queue-5.10/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch b/queue-5.10/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch new file mode 100644 index 00000000000..0988e05f609 --- /dev/null +++ b/queue-5.10/net-x25-fix-null-ptr-deref-caused-by-x25_disconnect.patch @@ -0,0 +1,65 @@ +From bcbd82d10a3154a1f6086feb0281f07e983c9123 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Mar 2022 18:43:46 +0800 +Subject: net/x25: Fix null-ptr-deref caused by x25_disconnect + +From: Duoming Zhou + +[ Upstream commit 7781607938c8371d4c2b243527430241c62e39c2 ] + +When the link layer is terminating, x25->neighbour will be set to NULL +in x25_disconnect(). As a result, it could cause null-ptr-deref bugs in +x25_sendmsg(),x25_recvmsg() and x25_connect(). One of the bugs is +shown below. + + (Thread 1) | (Thread 2) +x25_link_terminated() | x25_recvmsg() + x25_kill_by_neigh() | ... + x25_disconnect() | lock_sock(sk) + ... | ... + x25->neighbour = NULL //(1) | + ... | x25->neighbour->extended //(2) + +The code sets NULL to x25->neighbour in position (1) and dereferences +x25->neighbour in position (2), which could cause null-ptr-deref bug. + +This patch adds lock_sock() in x25_kill_by_neigh() in order to synchronize +with x25_sendmsg(), x25_recvmsg() and x25_connect(). What`s more, the +sock held by lock_sock() is not NULL, because it is extracted from x25_list +and uses x25_list_lock to synchronize. + +Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect") +Signed-off-by: Duoming Zhou +Reviewed-by: Lin Ma +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/x25/af_x25.c | 11 ++++++++--- + 1 file changed, 8 insertions(+), 3 deletions(-) + +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index 03ed170b8125..d231d4620c38 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -1775,10 +1775,15 @@ void x25_kill_by_neigh(struct x25_neigh *nb) + + write_lock_bh(&x25_list_lock); + +- sk_for_each(s, &x25_list) +- if (x25_sk(s)->neighbour == nb) ++ sk_for_each(s, &x25_list) { ++ if (x25_sk(s)->neighbour == nb) { ++ write_unlock_bh(&x25_list_lock); ++ lock_sock(s); + x25_disconnect(s, ENETUNREACH, 0, 0); +- ++ release_sock(s); ++ write_lock_bh(&x25_list_lock); ++ } ++ } + write_unlock_bh(&x25_list_lock); + + /* Remove any related forwards */ +-- +2.34.1 + diff --git a/queue-5.10/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch b/queue-5.10/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch new file mode 100644 index 00000000000..acb0e90bcd7 --- /dev/null +++ b/queue-5.10/netfilter-nf_conntrack_tcp-preserve-liberal-flag-in-.patch @@ -0,0 +1,71 @@ +From e640015581512e905c38624db3ce1a1a9c438f93 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 11:38:32 +0100 +Subject: netfilter: nf_conntrack_tcp: preserve liberal flag in tcp options + +From: Pablo Neira Ayuso + +[ Upstream commit f2dd495a8d589371289981d5ed33e6873df94ecc ] + +Do not reset IP_CT_TCP_FLAG_BE_LIBERAL flag in out-of-sync scenarios +coming before the TCP window tracking, otherwise such connections will +fail in the window check. + +Update tcp_options() to leave this flag in place and add a new helper +function to reset the tcp window state. + +Based on patch from Sven Auhagen. + +Fixes: c4832c7bbc3f ("netfilter: nf_ct_tcp: improve out-of-sync situation in TCP tracking") +Tested-by: Sven Auhagen +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_conntrack_proto_tcp.c | 17 +++++++++++++---- + 1 file changed, 13 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index c8fb2187ad4b..3f785bdfa942 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -354,8 +354,8 @@ static void tcp_options(const struct sk_buff *skb, + length, buff); + BUG_ON(ptr == NULL); + +- state->td_scale = +- state->flags = 0; ++ state->td_scale = 0; ++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; + + while (length > 0) { + int opcode=*ptr++; +@@ -840,6 +840,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct) + test_bit(IPS_ASSURED_BIT, &ct->status); + } + ++static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state) ++{ ++ state->td_end = 0; ++ state->td_maxend = 0; ++ state->td_maxwin = 0; ++ state->td_maxack = 0; ++ state->td_scale = 0; ++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; ++} ++ + /* Returns verdict for packet, or -1 for invalid. */ + int nf_conntrack_tcp_packet(struct nf_conn *ct, + struct sk_buff *skb, +@@ -946,8 +956,7 @@ int nf_conntrack_tcp_packet(struct nf_conn *ct, + ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK; + ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags = + ct->proto.tcp.last_flags; +- memset(&ct->proto.tcp.seen[dir], 0, +- sizeof(struct ip_ct_tcp_state)); ++ nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]); + break; + } + ct->proto.tcp.last_index = index; +-- +2.34.1 + diff --git a/queue-5.10/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch b/queue-5.10/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch new file mode 100644 index 00000000000..e5ec6aff15a --- /dev/null +++ b/queue-5.10/netfilter-nf_nat_h323-eliminate-anonymous-module_ini.patch @@ -0,0 +1,74 @@ +From f90b1db8f5190c3f503d1fdc14a114ebc993b9d6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Mar 2022 12:20:05 -0700 +Subject: netfilter: nf_nat_h323: eliminate anonymous module_init & module_exit + +From: Randy Dunlap + +[ Upstream commit fd4213929053bb58b0b2a080ca17f2dd1a9b6df4 ] + +Eliminate anonymous module_init() and module_exit(), which can lead to +confusion or ambiguity when reading System.map, crashes/oops/bugs, +or an initcall_debug log. + +Give each of these init and exit functions unique driver-specific +names to eliminate the anonymous names. + +Example 1: (System.map) + ffffffff832fc78c t init + ffffffff832fc79e t init + ffffffff832fc8f8 t init + +Example 2: (initcall_debug log) + calling init+0x0/0x12 @ 1 + initcall init+0x0/0x12 returned 0 after 15 usecs + calling init+0x0/0x60 @ 1 + initcall init+0x0/0x60 returned 0 after 2 usecs + calling init+0x0/0x9a @ 1 + initcall init+0x0/0x9a returned 0 after 74 usecs + +Fixes: f587de0e2feb ("[NETFILTER]: nf_conntrack/nf_nat: add H.323 helper port") +Signed-off-by: Randy Dunlap +Acked-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv4/netfilter/nf_nat_h323.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/ipv4/netfilter/nf_nat_h323.c b/net/ipv4/netfilter/nf_nat_h323.c +index 3e2685c120c7..76a411ae9fe6 100644 +--- a/net/ipv4/netfilter/nf_nat_h323.c ++++ b/net/ipv4/netfilter/nf_nat_h323.c +@@ -580,7 +580,7 @@ static struct nf_ct_helper_expectfn callforwarding_nat = { + }; + + /****************************************************************************/ +-static int __init init(void) ++static int __init nf_nat_h323_init(void) + { + BUG_ON(set_h245_addr_hook != NULL); + BUG_ON(set_h225_addr_hook != NULL); +@@ -607,7 +607,7 @@ static int __init init(void) + } + + /****************************************************************************/ +-static void __exit fini(void) ++static void __exit nf_nat_h323_fini(void) + { + RCU_INIT_POINTER(set_h245_addr_hook, NULL); + RCU_INIT_POINTER(set_h225_addr_hook, NULL); +@@ -624,8 +624,8 @@ static void __exit fini(void) + } + + /****************************************************************************/ +-module_init(init); +-module_exit(fini); ++module_init(nf_nat_h323_init); ++module_exit(nf_nat_h323_fini); + + MODULE_AUTHOR("Jing Min Zhao "); + MODULE_DESCRIPTION("H.323 NAT helper"); +-- +2.34.1 + diff --git a/queue-5.10/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch b/queue-5.10/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch new file mode 100644 index 00000000000..0b7d3306077 --- /dev/null +++ b/queue-5.10/nfs-remove-unneeded-check-in-decode_devicenotify_arg.patch @@ -0,0 +1,39 @@ +From 5c925a5a51cfa7d774cf4a5d85ea763f38e3489d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Feb 2022 13:17:04 +0300 +Subject: NFS: remove unneeded check in decode_devicenotify_args() + +From: Alexey Khoroshilov + +[ Upstream commit cb8fac6d2727f79f211e745b16c9abbf4d8be652 ] + +[You don't often get email from khoroshilov@ispras.ru. Learn why this is important at http://aka.ms/LearnAboutSenderIdentification.] + +Overflow check in not needed anymore after we switch to kmalloc_array(). + +Signed-off-by: Alexey Khoroshilov +Fixes: a4f743a6bb20 ("NFSv4.1: Convert open-coded array allocation calls to kmalloc_array()") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/callback_xdr.c | 4 ---- + 1 file changed, 4 deletions(-) + +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index 1725079a0527..ca8a4aa351dc 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -272,10 +272,6 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp, + n = ntohl(*p++); + if (n == 0) + goto out; +- if (n > ULONG_MAX / sizeof(*args->devs)) { +- status = htonl(NFS4ERR_BADXDR); +- goto out; +- } + + args->devs = kmalloc_array(n, sizeof(*args->devs), GFP_KERNEL); + if (!args->devs) { +-- +2.34.1 + diff --git a/queue-5.10/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch b/queue-5.10/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch new file mode 100644 index 00000000000..5537c34954c --- /dev/null +++ b/queue-5.10/nfs-return-valid-errors-from-nfs2-3_decode_dirent.patch @@ -0,0 +1,106 @@ +From b98486b95fae2130342b09a8a5ac1ccbebb4cd19 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 10:59:37 -0500 +Subject: NFS: Return valid errors from nfs2/3_decode_dirent() + +From: Trond Myklebust + +[ Upstream commit 64cfca85bacde54caa64e0ab855c48734894fa37 ] + +Valid return values for decode_dirent() callback functions are: + 0: Success + -EBADCOOKIE: End of directory + -EAGAIN: End of xdr_stream + +All errors need to map into one of those three values. + +Fixes: 573c4e1ef53a ("NFS: Simplify ->decode_dirent() calling sequence") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs2xdr.c | 2 +- + fs/nfs/nfs3xdr.c | 21 ++++++--------------- + 2 files changed, 7 insertions(+), 16 deletions(-) + +diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c +index f6676af37d5d..5e6453e9b307 100644 +--- a/fs/nfs/nfs2xdr.c ++++ b/fs/nfs/nfs2xdr.c +@@ -948,7 +948,7 @@ int nfs2_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_filename_inline(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + /* + * The type (size and byte order) of nfscookie isn't defined in +diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c +index dff6b52d26a8..b5a9379b1450 100644 +--- a/fs/nfs/nfs3xdr.c ++++ b/fs/nfs/nfs3xdr.c +@@ -1964,7 +1964,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + bool plus) + { + struct user_namespace *userns = rpc_userns(entry->server->client); +- struct nfs_entry old = *entry; + __be32 *p; + int error; + u64 new_cookie; +@@ -1984,15 +1983,15 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + + error = decode_fileid3(xdr, &entry->ino); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + error = decode_inline_filename3(xdr, &entry->name, &entry->len); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + error = decode_cookie3(xdr, &new_cookie); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + + entry->d_type = DT_UNKNOWN; + +@@ -2000,7 +1999,7 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + entry->fattr->valid = 0; + error = decode_post_op_attr(xdr, entry->fattr, userns); + if (unlikely(error)) +- return error; ++ return -EAGAIN; + if (entry->fattr->valid & NFS_ATTR_FATTR_V3) + entry->d_type = nfs_umode_to_dtype(entry->fattr->mode); + +@@ -2015,11 +2014,8 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + return -EAGAIN; + if (*p != xdr_zero) { + error = decode_nfs_fh3(xdr, entry->fh); +- if (unlikely(error)) { +- if (error == -E2BIG) +- goto out_truncated; +- return error; +- } ++ if (unlikely(error)) ++ return -EAGAIN; + } else + zero_nfs_fh3(entry->fh); + } +@@ -2028,11 +2024,6 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry, + entry->cookie = new_cookie; + + return 0; +- +-out_truncated: +- dprintk("NFS: directory entry contains invalid file handle\n"); +- *entry = old; +- return -EAGAIN; + } + + /* +-- +2.34.1 + diff --git a/queue-5.10/nfs-use-of-mapping_set_error-results-in-spurious-err.patch b/queue-5.10/nfs-use-of-mapping_set_error-results-in-spurious-err.patch new file mode 100644 index 00000000000..22cc1e932d6 --- /dev/null +++ b/queue-5.10/nfs-use-of-mapping_set_error-results-in-spurious-err.patch @@ -0,0 +1,41 @@ +From 1984d45d1f0e43c54ef9144e61b9bdc8e466967b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Feb 2022 15:58:38 -0500 +Subject: NFS: Use of mapping_set_error() results in spurious errors + +From: Trond Myklebust + +[ Upstream commit 6c984083ec2453dfd3fcf98f392f34500c73e3f2 ] + +The use of mapping_set_error() in conjunction with calls to +filemap_check_errors() is problematic because every error gets reported +as either an EIO or an ENOSPC by filemap_check_errors() in functions +such as filemap_write_and_wait() or filemap_write_and_wait_range(). +In almost all cases, we prefer to use the more nuanced wb errors. + +Fixes: b8946d7bfb94 ("NFS: Revalidate the file mapping on all fatal writeback errors") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/write.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index bde4c362841f..cc926e69ee9b 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -314,7 +314,10 @@ static void nfs_mapping_set_error(struct page *page, int error) + struct address_space *mapping = page_file_mapping(page); + + SetPageError(page); +- mapping_set_error(mapping, error); ++ filemap_set_wb_err(mapping, error); ++ if (mapping->host) ++ errseq_set(&mapping->host->i_sb->s_wb_err, ++ error == -ENOSPC ? -ENOSPC : -EIO); + nfs_set_pageerror(mapping); + } + +-- +2.34.1 + diff --git a/queue-5.10/nfsd-fix-nfsd_breaker_owns_lease-return-values.patch b/queue-5.10/nfsd-fix-nfsd_breaker_owns_lease-return-values.patch new file mode 100644 index 00000000000..c14b33230c8 --- /dev/null +++ b/queue-5.10/nfsd-fix-nfsd_breaker_owns_lease-return-values.patch @@ -0,0 +1,57 @@ +From 120c65189985e445e2be4502b5a9ca2ccc24add6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 14 Feb 2022 15:30:13 -0500 +Subject: NFSD: Fix nfsd_breaker_owns_lease() return values + +From: Chuck Lever + +[ Upstream commit 50719bf3442dd6cd05159e9c98d020b3919ce978 ] + +These have been incorrect since the function was introduced. + +A proper kerneldoc comment is added since this function, though +static, is part of an external interface. + +Reported-by: Dai Ngo +Signed-off-by: Chuck Lever +Signed-off-by: Sasha Levin +--- + fs/nfsd/nfs4state.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index d01d7929753e..84dd68091f42 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -4607,6 +4607,14 @@ nfsd_break_deleg_cb(struct file_lock *fl) + return ret; + } + ++/** ++ * nfsd_breaker_owns_lease - Check if lease conflict was resolved ++ * @fl: Lock state to check ++ * ++ * Return values: ++ * %true: Lease conflict was resolved ++ * %false: Lease conflict was not resolved. ++ */ + static bool nfsd_breaker_owns_lease(struct file_lock *fl) + { + struct nfs4_delegation *dl = fl->fl_owner; +@@ -4614,11 +4622,11 @@ static bool nfsd_breaker_owns_lease(struct file_lock *fl) + struct nfs4_client *clp; + + if (!i_am_nfsd()) +- return NULL; ++ return false; + rqst = kthread_data(current); + /* Note rq_prog == NFS_ACL_PROGRAM is also possible: */ + if (rqst->rq_prog != NFS_PROGRAM || rqst->rq_vers < 4) +- return NULL; ++ return false; + clp = *(rqst->rq_lease_breaker); + return dl->dl_stid.sc_client == clp; + } +-- +2.34.1 + diff --git a/queue-5.10/nfsd-more-robust-allocation-failure-handling-in-nfsd.patch b/queue-5.10/nfsd-more-robust-allocation-failure-handling-in-nfsd.patch new file mode 100644 index 00000000000..dd27e1ed957 --- /dev/null +++ b/queue-5.10/nfsd-more-robust-allocation-failure-handling-in-nfsd.patch @@ -0,0 +1,63 @@ +From e0685a8205efb3830a9e5259dbbdc73b0c1fc01a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 18:17:05 +0200 +Subject: nfsd: more robust allocation failure handling in nfsd_file_cache_init + +From: Amir Goldstein + +[ Upstream commit 4d2eeafecd6c83b4444db3dc0ada201c89b1aa44 ] + +The nfsd file cache table can be pretty large and its allocation +may require as many as 80 contigious pages. + +Employ the same fix that was employed for similar issue that was +reported for the reply cache hash table allocation several years ago +by commit 8f97514b423a ("nfsd: more robust allocation failure handling +in nfsd_reply_cache_init"). + +Fixes: 65294c1f2c5e ("nfsd: add a new struct file caching facility to nfsd") +Link: https://lore.kernel.org/linux-nfs/e3cdaeec85a6cfec980e87fc294327c0381c1778.camel@kernel.org/ +Suggested-by: Jeff Layton +Signed-off-by: Amir Goldstein +Reviewed-by: Jeff Layton +Signed-off-by: Chuck Lever +Tested-by: Amir Goldstein +Signed-off-by: Sasha Levin +--- + fs/nfsd/filecache.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/fs/nfsd/filecache.c b/fs/nfsd/filecache.c +index e5aad1c10ea3..acd0898e3866 100644 +--- a/fs/nfsd/filecache.c ++++ b/fs/nfsd/filecache.c +@@ -641,7 +641,7 @@ nfsd_file_cache_init(void) + if (!nfsd_filecache_wq) + goto out; + +- nfsd_file_hashtbl = kcalloc(NFSD_FILE_HASH_SIZE, ++ nfsd_file_hashtbl = kvcalloc(NFSD_FILE_HASH_SIZE, + sizeof(*nfsd_file_hashtbl), GFP_KERNEL); + if (!nfsd_file_hashtbl) { + pr_err("nfsd: unable to allocate nfsd_file_hashtbl\n"); +@@ -708,7 +708,7 @@ nfsd_file_cache_init(void) + nfsd_file_slab = NULL; + kmem_cache_destroy(nfsd_file_mark_slab); + nfsd_file_mark_slab = NULL; +- kfree(nfsd_file_hashtbl); ++ kvfree(nfsd_file_hashtbl); + nfsd_file_hashtbl = NULL; + destroy_workqueue(nfsd_filecache_wq); + nfsd_filecache_wq = NULL; +@@ -854,7 +854,7 @@ nfsd_file_cache_shutdown(void) + fsnotify_wait_marks_destroyed(); + kmem_cache_destroy(nfsd_file_mark_slab); + nfsd_file_mark_slab = NULL; +- kfree(nfsd_file_hashtbl); ++ kvfree(nfsd_file_hashtbl); + nfsd_file_hashtbl = NULL; + destroy_workqueue(nfsd_filecache_wq); + nfsd_filecache_wq = NULL; +-- +2.34.1 + diff --git a/queue-5.10/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch b/queue-5.10/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch new file mode 100644 index 00000000000..ee369cb1b39 --- /dev/null +++ b/queue-5.10/nfsv4-pnfs-fix-another-issue-with-a-list-iterator-po.patch @@ -0,0 +1,120 @@ +From d2d4f35471fde30fbf92113601a7ffb3398a0967 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Mar 2022 08:36:34 -0400 +Subject: NFSv4/pNFS: Fix another issue with a list iterator pointing to the + head + +From: Trond Myklebust + +[ Upstream commit 7c9d845f0612e5bcd23456a2ec43be8ac43458f1 ] + +In nfs4_callback_devicenotify(), if we don't find a matching entry for +the deviceid, we're left with a pointer to 'struct nfs_server' that +actually points to the list of super blocks associated with our struct +nfs_client. +Furthermore, even if we have a valid pointer, nothing pins the super +block, and so the struct nfs_server could end up getting freed while +we're using it. + +Since all we want is a pointer to the struct pnfs_layoutdriver_type, +let's skip all the iteration over super blocks, and just use APIs to +find the layout driver directly. + +Reported-by: Xiaomeng Tong +Fixes: 1be5683b03a7 ("pnfs: CB_NOTIFY_DEVICEID") +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/callback_proc.c | 27 +++++++++------------------ + fs/nfs/pnfs.c | 11 +++++++++++ + fs/nfs/pnfs.h | 2 ++ + 3 files changed, 22 insertions(+), 18 deletions(-) + +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index b44219ce60b8..a5209643ac36 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -353,12 +353,11 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, + struct cb_process_state *cps) + { + struct cb_devicenotifyargs *args = argp; ++ const struct pnfs_layoutdriver_type *ld = NULL; + uint32_t i; + __be32 res = 0; +- struct nfs_client *clp = cps->clp; +- struct nfs_server *server = NULL; + +- if (!clp) { ++ if (!cps->clp) { + res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION); + goto out; + } +@@ -366,23 +365,15 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, + for (i = 0; i < args->ndevs; i++) { + struct cb_devicenotifyitem *dev = &args->devs[i]; + +- if (!server || +- server->pnfs_curr_ld->id != dev->cbd_layout_type) { +- rcu_read_lock(); +- list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) +- if (server->pnfs_curr_ld && +- server->pnfs_curr_ld->id == dev->cbd_layout_type) { +- rcu_read_unlock(); +- goto found; +- } +- rcu_read_unlock(); +- continue; ++ if (!ld || ld->id != dev->cbd_layout_type) { ++ pnfs_put_layoutdriver(ld); ++ ld = pnfs_find_layoutdriver(dev->cbd_layout_type); ++ if (!ld) ++ continue; + } +- +- found: +- nfs4_delete_deviceid(server->pnfs_curr_ld, clp, &dev->cbd_dev_id); ++ nfs4_delete_deviceid(ld, cps->clp, &dev->cbd_dev_id); + } +- ++ pnfs_put_layoutdriver(ld); + out: + kfree(args->devs); + return res; +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 5370e082aded..b3b9eff5d572 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -92,6 +92,17 @@ find_pnfs_driver(u32 id) + return local; + } + ++const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id) ++{ ++ return find_pnfs_driver(id); ++} ++ ++void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld) ++{ ++ if (ld) ++ module_put(ld->owner); ++} ++ + void + unset_pnfs_layoutdriver(struct nfs_server *nfss) + { +diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h +index 0212fe32e63a..11d9ed9addc0 100644 +--- a/fs/nfs/pnfs.h ++++ b/fs/nfs/pnfs.h +@@ -236,6 +236,8 @@ struct pnfs_devicelist { + + extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *); + extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *); ++extern const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id); ++extern void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld); + + /* nfs4proc.c */ + extern size_t max_response_pages(struct nfs_server *server); +-- +2.34.1 + diff --git a/queue-5.10/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch b/queue-5.10/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch new file mode 100644 index 00000000000..3fdcb0e3e63 --- /dev/null +++ b/queue-5.10/nfsv4.1-don-t-retry-bind_conn_to_session-on-session-.patch @@ -0,0 +1,35 @@ +From f33d2b16fb72f3671b6cb7848aee9eb44bd28e37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Mar 2022 10:38:42 -0400 +Subject: NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error + +From: Olga Kornievskaia + +[ Upstream commit 1d15d121cc2ad4d016a7dc1493132a9696f91fc5 ] + +There is no reason to retry the operation if a session error had +occurred in such case result structure isn't filled out. + +Fixes: dff58530c4ca ("NFSv4.1: fix handling of backchannel binding in BIND_CONN_TO_SESSION") +Signed-off-by: Olga Kornievskaia +Signed-off-by: Trond Myklebust +Signed-off-by: Sasha Levin +--- + fs/nfs/nfs4proc.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index d222a980164b..77199d356042 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -8205,6 +8205,7 @@ nfs4_bind_one_conn_to_session_done(struct rpc_task *task, void *calldata) + case -NFS4ERR_DEADSESSION: + nfs4_schedule_session_recovery(clp->cl_session, + task->tk_status); ++ return; + } + if (args->dir == NFS4_CDFC4_FORE_OR_BOTH && + res->dir != NFS4_CDFS4_BOTH) { +-- +2.34.1 + diff --git a/queue-5.10/ntfs-add-sanity-check-on-allocation-size.patch b/queue-5.10/ntfs-add-sanity-check-on-allocation-size.patch new file mode 100644 index 00000000000..5d782193d4a --- /dev/null +++ b/queue-5.10/ntfs-add-sanity-check-on-allocation-size.patch @@ -0,0 +1,43 @@ +From 5bb5f6901aac49632507d77f312341e62cf51bcf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 22 Mar 2022 14:38:39 -0700 +Subject: ntfs: add sanity check on allocation size + +From: Dongliang Mu + +[ Upstream commit 714fbf2647b1a33d914edd695d4da92029c7e7c0 ] + +ntfs_read_inode_mount invokes ntfs_malloc_nofs with zero allocation +size. It triggers one BUG in the __ntfs_malloc function. + +Fix this by adding sanity check on ni->attr_list_size. + +Link: https://lkml.kernel.org/r/20220120094914.47736-1-dzm91@hust.edu.cn +Reported-by: syzbot+3c765c5248797356edaa@syzkaller.appspotmail.com +Signed-off-by: Dongliang Mu +Acked-by: Anton Altaparmakov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + fs/ntfs/inode.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c +index ea18e4a2a691..cf222c9225d6 100644 +--- a/fs/ntfs/inode.c ++++ b/fs/ntfs/inode.c +@@ -1881,6 +1881,10 @@ int ntfs_read_inode_mount(struct inode *vi) + } + /* Now allocate memory for the attribute list. */ + ni->attr_list_size = (u32)ntfs_attr_size(a); ++ if (!ni->attr_list_size) { ++ ntfs_error(sb, "Attr_list_size is zero"); ++ goto put_err_out; ++ } + ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size); + if (!ni->attr_list) { + ntfs_error(sb, "Not enough memory to allocate buffer " +-- +2.34.1 + diff --git a/queue-5.10/nvdimm-region-fix-default-alignment-for-small-region.patch b/queue-5.10/nvdimm-region-fix-default-alignment-for-small-region.patch new file mode 100644 index 00000000000..4b079007ee3 --- /dev/null +++ b/queue-5.10/nvdimm-region-fix-default-alignment-for-small-region.patch @@ -0,0 +1,41 @@ +From 75759aa256de9c902acfec384fe4e01f24e7db81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 19:49:21 -0800 +Subject: nvdimm/region: Fix default alignment for small regions + +From: Dan Williams + +[ Upstream commit d9d290d7e659e9db3e4518040cc18b97f5535f4a ] + +In preparation for removing BLK aperture support the NVDIMM unit tests +discovered that the default alignment can be set higher than the +capacity of the region. Fall back to PAGE_SIZE in that case. + +Given this has not been seen in the wild, elide notifying -stable. + +Fixes: 2522afb86a8c ("libnvdimm/region: Introduce an 'align' attribute") +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/164688416128.2879318.17890707310125575258.stgit@dwillia2-desk3.amr.corp.intel.com +Signed-off-by: Dan Williams +Signed-off-by: Sasha Levin +--- + drivers/nvdimm/region_devs.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c +index e05cc9f8a9fd..1d72653b5c8d 100644 +--- a/drivers/nvdimm/region_devs.c ++++ b/drivers/nvdimm/region_devs.c +@@ -1018,6 +1018,9 @@ static unsigned long default_align(struct nd_region *nd_region) + } + } + ++ if (nd_region->ndr_size < MEMREMAP_COMPAT_ALIGN_MAX) ++ align = PAGE_SIZE; ++ + mappings = max_t(u16, 1, nd_region->ndr_mappings); + div_u64_rem(align, mappings, &remainder); + if (remainder) +-- +2.34.1 + diff --git a/queue-5.10/nvme-cleanup-__nvme_check_ids.patch b/queue-5.10/nvme-cleanup-__nvme_check_ids.patch new file mode 100644 index 00000000000..6817e616ce8 --- /dev/null +++ b/queue-5.10/nvme-cleanup-__nvme_check_ids.patch @@ -0,0 +1,56 @@ +From b90489c6af5d27e397e0ecf962b52ccb555c1259 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Feb 2022 10:57:15 +0100 +Subject: nvme: cleanup __nvme_check_ids + +From: Christoph Hellwig + +[ Upstream commit fd8099e7918cd2df39ef306dd1d1af7178a15b81 ] + +Pass the actual nvme_ns_ids used for the comparison instead of the +ns_head that isn't needed and use a more descriptive function name. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Keith Busch +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 71c85c99e86c..853b9a24f744 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3681,16 +3681,15 @@ static struct nvme_ns_head *nvme_find_ns_head(struct nvme_subsystem *subsys, + return NULL; + } + +-static int __nvme_check_ids(struct nvme_subsystem *subsys, +- struct nvme_ns_head *new) ++static int nvme_subsys_check_duplicate_ids(struct nvme_subsystem *subsys, ++ struct nvme_ns_ids *ids) + { + struct nvme_ns_head *h; + + lockdep_assert_held(&subsys->lock); + + list_for_each_entry(h, &subsys->nsheads, entry) { +- if (nvme_ns_ids_valid(&new->ids) && +- nvme_ns_ids_equal(&new->ids, &h->ids)) ++ if (nvme_ns_ids_valid(ids) && nvme_ns_ids_equal(ids, &h->ids)) + return -EINVAL; + } + +@@ -3724,7 +3723,7 @@ static struct nvme_ns_head *nvme_alloc_ns_head(struct nvme_ctrl *ctrl, + head->ids = *ids; + kref_init(&head->ref); + +- ret = __nvme_check_ids(ctrl->subsys, head); ++ ret = nvme_subsys_check_duplicate_ids(ctrl->subsys, &head->ids); + if (ret) { + dev_err(ctrl->device, + "duplicate IDs for nsid %d\n", nsid); +-- +2.34.1 + diff --git a/queue-5.10/nvme-tcp-lockdep-annotate-in-kernel-sockets.patch b/queue-5.10/nvme-tcp-lockdep-annotate-in-kernel-sockets.patch new file mode 100644 index 00000000000..e358b9d8b27 --- /dev/null +++ b/queue-5.10/nvme-tcp-lockdep-annotate-in-kernel-sockets.patch @@ -0,0 +1,127 @@ +From c1b4ce383ec5f455856be6e4377336184288013d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 15 Feb 2022 18:22:49 -0800 +Subject: nvme-tcp: lockdep: annotate in-kernel sockets + +From: Chris Leech + +[ Upstream commit 841aee4d75f18fdfb53935080b03de0c65e9b92c ] + +Put NVMe/TCP sockets in their own class to avoid some lockdep warnings. +Sockets created by nvme-tcp are not exposed to user-space, and will not +trigger certain code paths that the general socket API exposes. + +Lockdep complains about a circular dependency between the socket and +filesystem locks, because setsockopt can trigger a page fault with a +socket lock held, but nvme-tcp sends requests on the socket while file +system locks are held. + + ====================================================== + WARNING: possible circular locking dependency detected + 5.15.0-rc3 #1 Not tainted + ------------------------------------------------------ + fio/1496 is trying to acquire lock: + (sk_lock-AF_INET){+.+.}-{0:0}, at: tcp_sendpage+0x23/0x80 + + but task is already holding lock: + (&xfs_dir_ilock_class/5){+.+.}-{3:3}, at: xfs_ilock+0xcf/0x290 [xfs] + + which lock already depends on the new lock. + + other info that might help us debug this: + + chain exists of: + sk_lock-AF_INET --> sb_internal --> &xfs_dir_ilock_class/5 + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&xfs_dir_ilock_class/5); + lock(sb_internal); + lock(&xfs_dir_ilock_class/5); + lock(sk_lock-AF_INET); + + *** DEADLOCK *** + + 6 locks held by fio/1496: + #0: (sb_writers#13){.+.+}-{0:0}, at: path_openat+0x9fc/0xa20 + #1: (&inode->i_sb->s_type->i_mutex_dir_key){++++}-{3:3}, at: path_openat+0x296/0xa20 + #2: (sb_internal){.+.+}-{0:0}, at: xfs_trans_alloc_icreate+0x41/0xd0 [xfs] + #3: (&xfs_dir_ilock_class/5){+.+.}-{3:3}, at: xfs_ilock+0xcf/0x290 [xfs] + #4: (hctx->srcu){....}-{0:0}, at: hctx_lock+0x51/0xd0 + #5: (&queue->send_mutex){+.+.}-{3:3}, at: nvme_tcp_queue_rq+0x33e/0x380 [nvme_tcp] + +This annotation lets lockdep analyze nvme-tcp controlled sockets +independently of what the user-space sockets API does. + +Link: https://lore.kernel.org/linux-nvme/CAHj4cs9MDYLJ+q+2_GXUK9HxFizv2pxUryUR0toX974M040z7g@mail.gmail.com/ + +Signed-off-by: Chris Leech +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 40 ++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 40 insertions(+) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 6105894a218a..7e3932033707 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -30,6 +30,44 @@ static int so_priority; + module_param(so_priority, int, 0644); + MODULE_PARM_DESC(so_priority, "nvme tcp socket optimize priority"); + ++#ifdef CONFIG_DEBUG_LOCK_ALLOC ++/* lockdep can detect a circular dependency of the form ++ * sk_lock -> mmap_lock (page fault) -> fs locks -> sk_lock ++ * because dependencies are tracked for both nvme-tcp and user contexts. Using ++ * a separate class prevents lockdep from conflating nvme-tcp socket use with ++ * user-space socket API use. ++ */ ++static struct lock_class_key nvme_tcp_sk_key[2]; ++static struct lock_class_key nvme_tcp_slock_key[2]; ++ ++static void nvme_tcp_reclassify_socket(struct socket *sock) ++{ ++ struct sock *sk = sock->sk; ++ ++ if (WARN_ON_ONCE(!sock_allow_reclassification(sk))) ++ return; ++ ++ switch (sk->sk_family) { ++ case AF_INET: ++ sock_lock_init_class_and_name(sk, "slock-AF_INET-NVME", ++ &nvme_tcp_slock_key[0], ++ "sk_lock-AF_INET-NVME", ++ &nvme_tcp_sk_key[0]); ++ break; ++ case AF_INET6: ++ sock_lock_init_class_and_name(sk, "slock-AF_INET6-NVME", ++ &nvme_tcp_slock_key[1], ++ "sk_lock-AF_INET6-NVME", ++ &nvme_tcp_sk_key[1]); ++ break; ++ default: ++ WARN_ON_ONCE(1); ++ } ++} ++#else ++static void nvme_tcp_reclassify_socket(struct socket *sock) { } ++#endif ++ + enum nvme_tcp_send_state { + NVME_TCP_SEND_CMD_PDU = 0, + NVME_TCP_SEND_H2C_PDU, +@@ -1422,6 +1460,8 @@ static int nvme_tcp_alloc_queue(struct nvme_ctrl *nctrl, + goto err_destroy_mutex; + } + ++ nvme_tcp_reclassify_socket(queue->sock); ++ + /* Single syn retry */ + tcp_sock_set_syncnt(queue->sock->sk, 1); + +-- +2.34.1 + diff --git a/queue-5.10/openvswitch-always-update-flow-key-after-nat.patch b/queue-5.10/openvswitch-always-update-flow-key-after-nat.patch new file mode 100644 index 00000000000..37713ebd5e9 --- /dev/null +++ b/queue-5.10/openvswitch-always-update-flow-key-after-nat.patch @@ -0,0 +1,200 @@ +From 13a98c573ff7dcf050aeaa8a4470132531afa4ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 18 Mar 2022 08:43:19 -0400 +Subject: openvswitch: always update flow key after nat + +From: Aaron Conole + +[ Upstream commit 60b44ca6bd7518dd38fa2719bc9240378b6172c3 ] + +During NAT, a tuple collision may occur. When this happens, openvswitch +will make a second pass through NAT which will perform additional packet +modification. This will update the skb data, but not the flow key that +OVS uses. This means that future flow lookups, and packet matches will +have incorrect data. This has been supported since +5d50aa83e2c8 ("openvswitch: support asymmetric conntrack"). + +That commit failed to properly update the sw_flow_key attributes, since +it only called the ovs_ct_nat_update_key once, rather than each time +ovs_ct_nat_execute was called. As these two operations are linked, the +ovs_ct_nat_execute() function should always make sure that the +sw_flow_key is updated after a successful call through NAT infrastructure. + +Fixes: 5d50aa83e2c8 ("openvswitch: support asymmetric conntrack") +Cc: Dumitru Ceara +Cc: Numan Siddique +Signed-off-by: Aaron Conole +Acked-by: Eelco Chaudron +Link: https://lore.kernel.org/r/20220318124319.3056455-1-aconole@redhat.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/openvswitch/conntrack.c | 118 ++++++++++++++++++------------------ + 1 file changed, 59 insertions(+), 59 deletions(-) + +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index a11b558813c1..7ff98d39ec94 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -730,6 +730,57 @@ static bool skb_nfct_cached(struct net *net, + } + + #if IS_ENABLED(CONFIG_NF_NAT) ++static void ovs_nat_update_key(struct sw_flow_key *key, ++ const struct sk_buff *skb, ++ enum nf_nat_manip_type maniptype) ++{ ++ if (maniptype == NF_NAT_MANIP_SRC) { ++ __be16 src; ++ ++ key->ct_state |= OVS_CS_F_SRC_NAT; ++ if (key->eth.type == htons(ETH_P_IP)) ++ key->ipv4.addr.src = ip_hdr(skb)->saddr; ++ else if (key->eth.type == htons(ETH_P_IPV6)) ++ memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, ++ sizeof(key->ipv6.addr.src)); ++ else ++ return; ++ ++ if (key->ip.proto == IPPROTO_UDP) ++ src = udp_hdr(skb)->source; ++ else if (key->ip.proto == IPPROTO_TCP) ++ src = tcp_hdr(skb)->source; ++ else if (key->ip.proto == IPPROTO_SCTP) ++ src = sctp_hdr(skb)->source; ++ else ++ return; ++ ++ key->tp.src = src; ++ } else { ++ __be16 dst; ++ ++ key->ct_state |= OVS_CS_F_DST_NAT; ++ if (key->eth.type == htons(ETH_P_IP)) ++ key->ipv4.addr.dst = ip_hdr(skb)->daddr; ++ else if (key->eth.type == htons(ETH_P_IPV6)) ++ memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, ++ sizeof(key->ipv6.addr.dst)); ++ else ++ return; ++ ++ if (key->ip.proto == IPPROTO_UDP) ++ dst = udp_hdr(skb)->dest; ++ else if (key->ip.proto == IPPROTO_TCP) ++ dst = tcp_hdr(skb)->dest; ++ else if (key->ip.proto == IPPROTO_SCTP) ++ dst = sctp_hdr(skb)->dest; ++ else ++ return; ++ ++ key->tp.dst = dst; ++ } ++} ++ + /* Modelled after nf_nat_ipv[46]_fn(). + * range is only used for new, uninitialized NAT state. + * Returns either NF_ACCEPT or NF_DROP. +@@ -737,7 +788,7 @@ static bool skb_nfct_cached(struct net *net, + static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, + enum ip_conntrack_info ctinfo, + const struct nf_nat_range2 *range, +- enum nf_nat_manip_type maniptype) ++ enum nf_nat_manip_type maniptype, struct sw_flow_key *key) + { + int hooknum, nh_off, err = NF_ACCEPT; + +@@ -810,58 +861,11 @@ static int ovs_ct_nat_execute(struct sk_buff *skb, struct nf_conn *ct, + skb_push(skb, nh_off); + skb_postpush_rcsum(skb, skb->data, nh_off); + +- return err; +-} +- +-static void ovs_nat_update_key(struct sw_flow_key *key, +- const struct sk_buff *skb, +- enum nf_nat_manip_type maniptype) +-{ +- if (maniptype == NF_NAT_MANIP_SRC) { +- __be16 src; +- +- key->ct_state |= OVS_CS_F_SRC_NAT; +- if (key->eth.type == htons(ETH_P_IP)) +- key->ipv4.addr.src = ip_hdr(skb)->saddr; +- else if (key->eth.type == htons(ETH_P_IPV6)) +- memcpy(&key->ipv6.addr.src, &ipv6_hdr(skb)->saddr, +- sizeof(key->ipv6.addr.src)); +- else +- return; +- +- if (key->ip.proto == IPPROTO_UDP) +- src = udp_hdr(skb)->source; +- else if (key->ip.proto == IPPROTO_TCP) +- src = tcp_hdr(skb)->source; +- else if (key->ip.proto == IPPROTO_SCTP) +- src = sctp_hdr(skb)->source; +- else +- return; +- +- key->tp.src = src; +- } else { +- __be16 dst; +- +- key->ct_state |= OVS_CS_F_DST_NAT; +- if (key->eth.type == htons(ETH_P_IP)) +- key->ipv4.addr.dst = ip_hdr(skb)->daddr; +- else if (key->eth.type == htons(ETH_P_IPV6)) +- memcpy(&key->ipv6.addr.dst, &ipv6_hdr(skb)->daddr, +- sizeof(key->ipv6.addr.dst)); +- else +- return; +- +- if (key->ip.proto == IPPROTO_UDP) +- dst = udp_hdr(skb)->dest; +- else if (key->ip.proto == IPPROTO_TCP) +- dst = tcp_hdr(skb)->dest; +- else if (key->ip.proto == IPPROTO_SCTP) +- dst = sctp_hdr(skb)->dest; +- else +- return; ++ /* Update the flow key if NAT successful. */ ++ if (err == NF_ACCEPT) ++ ovs_nat_update_key(key, skb, maniptype); + +- key->tp.dst = dst; +- } ++ return err; + } + + /* Returns NF_DROP if the packet should be dropped, NF_ACCEPT otherwise. */ +@@ -903,7 +907,7 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, + } else { + return NF_ACCEPT; /* Connection is not NATed. */ + } +- err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype); ++ err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype, key); + + if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) { + if (ct->status & IPS_SRC_NAT) { +@@ -913,17 +917,13 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key, + maniptype = NF_NAT_MANIP_SRC; + + err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, +- maniptype); ++ maniptype, key); + } else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) { + err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL, +- NF_NAT_MANIP_SRC); ++ NF_NAT_MANIP_SRC, key); + } + } + +- /* Mark NAT done if successful and update the flow key. */ +- if (err == NF_ACCEPT) +- ovs_nat_update_key(key, skb, maniptype); +- + return err; + } + #else /* !CONFIG_NF_NAT */ +-- +2.34.1 + diff --git a/queue-5.10/parisc-fix-handling-off-probe-non-access-faults.patch b/queue-5.10/parisc-fix-handling-off-probe-non-access-faults.patch new file mode 100644 index 00000000000..1e2bffdbc33 --- /dev/null +++ b/queue-5.10/parisc-fix-handling-off-probe-non-access-faults.patch @@ -0,0 +1,168 @@ +From 7353b9e8774cfa30ccc7f0332ccc74d94be62c11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 21:14:36 +0000 +Subject: parisc: Fix handling off probe non-access faults + +From: John David Anglin + +[ Upstream commit e00b0a2ab8ec019c344e53bfc76e31c18bb587b7 ] + +Currently, the parisc kernel does not fully support non-access TLB +fault handling for probe instructions. In the fast path, we set the +target register to zero if it is not a shadowed register. The slow +path is not implemented, so we call do_page_fault. The architecture +indicates that non-access faults should not cause a page fault from +disk. + +This change adds to code to provide non-access fault support for +probe instructions. It also modifies the handling of faults on +userspace so that if the address lies in a valid VMA and the access +type matches that for the VMA, the probe target register is set to +one. Otherwise, the target register is set to zero. + +This was done to make probe instructions more useful for userspace. +Probe instructions are not very useful if they set the target register +to zero whenever a page is not present in memory. Nominally, the +purpose of the probe instruction is determine whether read or write +access to a given address is allowed. + +This fixes a problem in function pointer comparison noticed in the +glibc testsuite (stdio-common/tst-vfprintf-user-type). The same +problem is likely in glibc (_dl_lookup_address). + +V2 adds flush and lpa instruction support to handle_nadtlb_fault. + +Signed-off-by: John David Anglin +Signed-off-by: Helge Deller +Signed-off-by: Sasha Levin +--- + arch/parisc/include/asm/traps.h | 1 + + arch/parisc/kernel/traps.c | 2 + + arch/parisc/mm/fault.c | 89 +++++++++++++++++++++++++++++++++ + 3 files changed, 92 insertions(+) + +diff --git a/arch/parisc/include/asm/traps.h b/arch/parisc/include/asm/traps.h +index 8ecc1f0c0483..d0e090a2c000 100644 +--- a/arch/parisc/include/asm/traps.h ++++ b/arch/parisc/include/asm/traps.h +@@ -17,6 +17,7 @@ void die_if_kernel(char *str, struct pt_regs *regs, long err); + const char *trap_name(unsigned long code); + void do_page_fault(struct pt_regs *regs, unsigned long code, + unsigned long address); ++int handle_nadtlb_fault(struct pt_regs *regs); + #endif + + #endif +diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c +index 269b737d2629..bce47e0fb692 100644 +--- a/arch/parisc/kernel/traps.c ++++ b/arch/parisc/kernel/traps.c +@@ -661,6 +661,8 @@ void notrace handle_interruption(int code, struct pt_regs *regs) + by hand. Technically we need to emulate: + fdc,fdce,pdc,"fic,4f",prober,probeir,probew, probeiw + */ ++ if (code == 17 && handle_nadtlb_fault(regs)) ++ return; + fault_address = regs->ior; + fault_space = regs->isr; + break; +diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c +index 716960f5d92e..5faa3cff4738 100644 +--- a/arch/parisc/mm/fault.c ++++ b/arch/parisc/mm/fault.c +@@ -424,3 +424,92 @@ void do_page_fault(struct pt_regs *regs, unsigned long code, + goto no_context; + pagefault_out_of_memory(); + } ++ ++/* Handle non-access data TLB miss faults. ++ * ++ * For probe instructions, accesses to userspace are considered allowed ++ * if they lie in a valid VMA and the access type matches. We are not ++ * allowed to handle MM faults here so there may be situations where an ++ * actual access would fail even though a probe was successful. ++ */ ++int ++handle_nadtlb_fault(struct pt_regs *regs) ++{ ++ unsigned long insn = regs->iir; ++ int breg, treg, xreg, val = 0; ++ struct vm_area_struct *vma, *prev_vma; ++ struct task_struct *tsk; ++ struct mm_struct *mm; ++ unsigned long address; ++ unsigned long acc_type; ++ ++ switch (insn & 0x380) { ++ case 0x280: ++ /* FDC instruction */ ++ fallthrough; ++ case 0x380: ++ /* PDC and FIC instructions */ ++ if (printk_ratelimit()) { ++ pr_warn("BUG: nullifying cache flush/purge instruction\n"); ++ show_regs(regs); ++ } ++ if (insn & 0x20) { ++ /* Base modification */ ++ breg = (insn >> 21) & 0x1f; ++ xreg = (insn >> 16) & 0x1f; ++ if (breg && xreg) ++ regs->gr[breg] += regs->gr[xreg]; ++ } ++ regs->gr[0] |= PSW_N; ++ return 1; ++ ++ case 0x180: ++ /* PROBE instruction */ ++ treg = insn & 0x1f; ++ if (regs->isr) { ++ tsk = current; ++ mm = tsk->mm; ++ if (mm) { ++ /* Search for VMA */ ++ address = regs->ior; ++ mmap_read_lock(mm); ++ vma = find_vma_prev(mm, address, &prev_vma); ++ mmap_read_unlock(mm); ++ ++ /* ++ * Check if access to the VMA is okay. ++ * We don't allow for stack expansion. ++ */ ++ acc_type = (insn & 0x40) ? VM_WRITE : VM_READ; ++ if (vma ++ && address >= vma->vm_start ++ && (vma->vm_flags & acc_type) == acc_type) ++ val = 1; ++ } ++ } ++ if (treg) ++ regs->gr[treg] = val; ++ regs->gr[0] |= PSW_N; ++ return 1; ++ ++ case 0x300: ++ /* LPA instruction */ ++ if (insn & 0x20) { ++ /* Base modification */ ++ breg = (insn >> 21) & 0x1f; ++ xreg = (insn >> 16) & 0x1f; ++ if (breg && xreg) ++ regs->gr[breg] += regs->gr[xreg]; ++ } ++ treg = insn & 0x1f; ++ if (treg) ++ regs->gr[treg] = 0; ++ regs->gr[0] |= PSW_N; ++ return 1; ++ ++ default: ++ break; ++ } ++ ++ return 0; ++} +-- +2.34.1 + diff --git a/queue-5.10/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch b/queue-5.10/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch new file mode 100644 index 00000000000..6f1f4ff0384 --- /dev/null +++ b/queue-5.10/pci-aardvark-fix-reading-pci_exp_rtsta_pme-bit-on-em.patch @@ -0,0 +1,55 @@ +From bd701cbd2b39635fc122a5aeceda7cd83c34a19f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Jan 2022 02:50:09 +0100 +Subject: PCI: aardvark: Fix reading PCI_EXP_RTSTA_PME bit on emulated bridge +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Pali Rohár + +[ Upstream commit 735f5ae49e1b44742cc63ca9b5c1ffde3e94ba91 ] + +The emulated bridge returns incorrect value for PCI_EXP_RTSTA register +during readout in advk_pci_bridge_emul_pcie_conf_read() function: the +correct bit is BIT(16), but we are setting BIT(23), because the code +does + *value = (isr0 & PCIE_MSG_PM_PME_MASK) << 16 +where + PCIE_MSG_PM_PME_MASK +is + BIT(7). + +The code should probably have been something like + *value = (!!(isr0 & PCIE_MSG_PM_PME_MASK)) << 16, +but we are better of using an if() and using the proper macro for this +bit. + +Link: https://lore.kernel.org/r/20220110015018.26359-15-kabel@kernel.org +Fixes: 8a3ebd8de328 ("PCI: aardvark: Implement emulated root PCI bridge config space") +Signed-off-by: Pali Rohár +Signed-off-by: Marek Behún +Signed-off-by: Lorenzo Pieralisi +Signed-off-by: Sasha Levin +--- + drivers/pci/controller/pci-aardvark.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index f30144c8c0bd..49ff8bf10c74 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -851,7 +851,9 @@ advk_pci_bridge_emul_pcie_conf_read(struct pci_bridge_emul *bridge, + case PCI_EXP_RTSTA: { + u32 isr0 = advk_readl(pcie, PCIE_ISR0_REG); + u32 msglog = advk_readl(pcie, PCIE_MSG_LOG_REG); +- *value = (isr0 & PCIE_MSG_PM_PME_MASK) << 16 | (msglog >> 16); ++ *value = msglog >> 16; ++ if (isr0 & PCIE_MSG_PM_PME_MASK) ++ *value |= PCI_EXP_RTSTA_PME; + return PCI_BRIDGE_EMUL_HANDLED; + } + +-- +2.34.1 + diff --git a/queue-5.10/pci-avoid-broken-msi-on-sb600-usb-devices.patch b/queue-5.10/pci-avoid-broken-msi-on-sb600-usb-devices.patch new file mode 100644 index 00000000000..f726176695c --- /dev/null +++ b/queue-5.10/pci-avoid-broken-msi-on-sb600-usb-devices.patch @@ -0,0 +1,61 @@ +From 4ce31c151a5fb0fe017321f73e76e5b1df9171fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Mar 2022 13:34:46 -0500 +Subject: PCI: Avoid broken MSI on SB600 USB devices + +From: Bjorn Helgaas + +[ Upstream commit 63cd736f449445edcd7f0bcc7d84453e9beec0aa ] + +Some ATI SB600 USB adapters advertise MSI, but if INTx is disabled by +setting PCI_COMMAND_INTX_DISABLE, MSI doesn't work either. The PCI/PCIe +specs do not require software to set PCI_COMMAND_INTX_DISABLE when enabling +MSI, but Linux has done that for many years. + +Mick reported that 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI +devices") broke these devices. Prior to 306c54d0edb6, they used INTx. +Starting with 306c54d0edb6, they use MSI, and and the fact that Linux sets +PCI_COMMAND_INTX_DISABLE means both INTx and MSI are disabled on these +devices. + +Avoid this SB600 defect by disabling MSI so we use INTx as before. + +Fixes: 306c54d0edb6 ("usb: hcd: Try MSI interrupts on PCI devices") +Link: https://lore.kernel.org/r/20220321183446.1108325-1-helgaas@kernel.org +Link: https://bugzilla.kernel.org/show_bug.cgi?id=215690 +Link: https://lore.kernel.org/all/PxIByDyBRcsbpcmVhGSNDFAoUcMmb78ctXCkw6fbpx25TGlCHvA6SJjjFkNr1FfQZMntYPTNyvEnblxzAZ8a6jP9ddLpKeCN6Chi_2FuexU=@protonmail.com/ +Link: https://lore.kernel.org/r/20220314101448.90074-1-andriy.shevchenko@linux.intel.com +BugLink: https://lore.kernel.org/all/20200702143045.23429-1-andriy.shevchenko@linux.intel.com/ +Reported-by: Mick Lorain +Signed-off-by: Bjorn Helgaas +Signed-off-by: Sasha Levin +--- + drivers/pci/quirks.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 95fcc735c88e..1be2894ada70 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -1816,6 +1816,18 @@ static void quirk_alder_ioapic(struct pci_dev *pdev) + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_EESSC, quirk_alder_ioapic); + #endif + ++static void quirk_no_msi(struct pci_dev *dev) ++{ ++ pci_info(dev, "avoiding MSI to work around a hardware defect\n"); ++ dev->no_msi = 1; ++} ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4386, quirk_no_msi); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4387, quirk_no_msi); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4388, quirk_no_msi); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x4389, quirk_no_msi); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438a, quirk_no_msi); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x438b, quirk_no_msi); ++ + static void quirk_pcie_mch(struct pci_dev *pdev) + { + pdev->no_msi = 1; +-- +2.34.1 + diff --git a/queue-5.10/pci-reduce-warnings-on-possible-rw1c-corruption.patch b/queue-5.10/pci-reduce-warnings-on-possible-rw1c-corruption.patch new file mode 100644 index 00000000000..d44b97007a0 --- /dev/null +++ b/queue-5.10/pci-reduce-warnings-on-possible-rw1c-corruption.patch @@ -0,0 +1,71 @@ +From 7b33644096a709151c170d9f3137cea78c565848 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 6 Aug 2020 16:14:55 +1200 +Subject: PCI: Reduce warnings on possible RW1C corruption + +From: Mark Tomlinson + +[ Upstream commit 92c45b63ce22c8898aa41806e8d6692bcd577510 ] + +For hardware that only supports 32-bit writes to PCI there is the +possibility of clearing RW1C (write-one-to-clear) bits. A rate-limited +messages was introduced by fb2659230120, but rate-limiting is not the best +choice here. Some devices may not show the warnings they should if another +device has just produced a bunch of warnings. Also, the number of messages +can be a nuisance on devices which are otherwise working fine. + +Change the ratelimit to a single warning per bus. This ensures no bus is +'starved' of emitting a warning and also that there isn't a continuous +stream of warnings. It would be preferable to have a warning per device, +but the pci_dev structure is not available here, and a lookup from devfn +would be far too slow. + +Suggested-by: Bjorn Helgaas +Fixes: fb2659230120 ("PCI: Warn on possible RW1C corruption for sub-32 bit config writes") +Link: https://lore.kernel.org/r/20200806041455.11070-1-mark.tomlinson@alliedtelesis.co.nz +Signed-off-by: Mark Tomlinson +Signed-off-by: Bjorn Helgaas +Reviewed-by: Florian Fainelli +Reviewed-by: Rob Herring +Acked-by: Scott Branden +Signed-off-by: Sasha Levin +--- + drivers/pci/access.c | 9 ++++++--- + include/linux/pci.h | 1 + + 2 files changed, 7 insertions(+), 3 deletions(-) + +diff --git a/drivers/pci/access.c b/drivers/pci/access.c +index 46935695cfb9..8d0d1f61c650 100644 +--- a/drivers/pci/access.c ++++ b/drivers/pci/access.c +@@ -160,9 +160,12 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn, + * write happen to have any RW1C (write-one-to-clear) bits set, we + * just inadvertently cleared something we shouldn't have. + */ +- dev_warn_ratelimited(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n", +- size, pci_domain_nr(bus), bus->number, +- PCI_SLOT(devfn), PCI_FUNC(devfn), where); ++ if (!bus->unsafe_warn) { ++ dev_warn(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n", ++ size, pci_domain_nr(bus), bus->number, ++ PCI_SLOT(devfn), PCI_FUNC(devfn), where); ++ bus->unsafe_warn = 1; ++ } + + mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8)); + tmp = readl(addr) & mask; +diff --git a/include/linux/pci.h b/include/linux/pci.h +index 4519bd12643f..bc5a1150f072 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -638,6 +638,7 @@ struct pci_bus { + struct bin_attribute *legacy_io; /* Legacy I/O for this bus */ + struct bin_attribute *legacy_mem; /* Legacy mem */ + unsigned int is_added:1; ++ unsigned int unsafe_warn:1; /* warned about RW1C config write */ + }; + + #define to_pci_bus(n) container_of(n, struct pci_bus, dev) +-- +2.34.1 + diff --git a/queue-5.10/perf-core-fix-address-filter-parser-for-multiple-fil.patch b/queue-5.10/perf-core-fix-address-filter-parser-for-multiple-fil.patch new file mode 100644 index 00000000000..a9dec3bf2ae --- /dev/null +++ b/queue-5.10/perf-core-fix-address-filter-parser-for-multiple-fil.patch @@ -0,0 +1,40 @@ +From 11abea2e6836e0c89df401d6a8666ecc16d9b967 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jan 2022 09:24:51 +0200 +Subject: perf/core: Fix address filter parser for multiple filters + +From: Adrian Hunter + +[ Upstream commit d680ff24e9e14444c63945b43a37ede7cd6958f9 ] + +Reset appropriate variables in the parser loop between parsing separate +filters, so that they do not interfere with parsing the next filter. + +Fixes: 375637bc524952 ("perf/core: Introduce address range filtering") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20220131072453.2839535-4-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + kernel/events/core.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index c8b3f94f0dbb..79d8b27cf2fc 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -10265,8 +10265,11 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, + } + + /* ready to consume more filters */ ++ kfree(filename); ++ filename = NULL; + state = IF_STATE_ACTION; + filter = NULL; ++ kernel = 0; + } + } + +-- +2.34.1 + diff --git a/queue-5.10/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch b/queue-5.10/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch new file mode 100644 index 00000000000..c2915aa7187 --- /dev/null +++ b/queue-5.10/perf-x86-intel-pt-fix-address-filter-config-for-32-b.patch @@ -0,0 +1,37 @@ +From 8d8bef8405e3c640cd91b0d7005b7761bdcb23ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 31 Jan 2022 09:24:52 +0200 +Subject: perf/x86/intel/pt: Fix address filter config for 32-bit kernel + +From: Adrian Hunter + +[ Upstream commit e5524bf1047eb3b3f3f33b5f59897ba67b3ade87 ] + +Change from shifting 'unsigned long' to 'u64' to prevent the config bits +being lost on a 32-bit kernel. + +Fixes: eadf48cab4b6b0 ("perf/x86/intel/pt: Add support for address range filtering in PT") +Signed-off-by: Adrian Hunter +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lore.kernel.org/r/20220131072453.2839535-5-adrian.hunter@intel.com +Signed-off-by: Sasha Levin +--- + arch/x86/events/intel/pt.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c +index c084899e9582..cc3b79c06685 100644 +--- a/arch/x86/events/intel/pt.c ++++ b/arch/x86/events/intel/pt.c +@@ -472,7 +472,7 @@ static u64 pt_config_filters(struct perf_event *event) + pt->filters.filter[range].msr_b = filter->msr_b; + } + +- rtit_ctl |= filter->config << pt_address_ranges[range].reg_off; ++ rtit_ctl |= (u64)filter->config << pt_address_ranges[range].reg_off; + } + + return rtit_ctl; +-- +2.34.1 + diff --git a/queue-5.10/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch b/queue-5.10/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch new file mode 100644 index 00000000000..f697c3c14b4 --- /dev/null +++ b/queue-5.10/phy-dphy-correct-lpx-parameter-and-its-derivatives-t.patch @@ -0,0 +1,70 @@ +From c81f47b7a71e941d76e7de74c50f19fc41f26a8d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 16 Feb 2022 15:12:57 +0800 +Subject: phy: dphy: Correct lpx parameter and its + derivatives(ta_{get,go,sure}) +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Liu Ying + +[ Upstream commit 3153fa38e38af566cf6454a03b1dbadaf6f323c0 ] + +According to the comment of the function phy_mipi_dphy_get_default_config(), +it uses minimum D-PHY timings based on MIPI D-PHY specification. They are +derived from the valid ranges specified in Section 6.9, Table 14, Page 41 +of the D-PHY specification (v1.2). The table 14 explicitly mentions that +the minimum T-LPX parameter is 50 nanoseconds and the minimum TA-SURE +parameter is T-LPX nanoseconds. Likewise, the kernel doc of the 'lpx' and +'ta_sure' members of struct phy_configure_opts_mipi_dphy mentions that +the minimum values are 50000 picoseconds and @lpx picoseconds respectively. +Also, the function phy_mipi_dphy_config_validate() checks if cfg->lpx is +less than 50000 picoseconds and if cfg->ta_sure is less than cfg->lpx, +which hints the same minimum values. + +Without this patch, the function phy_mipi_dphy_get_default_config() +wrongly sets cfg->lpx to 60000 picoseconds and cfg->ta_sure to 2 * cfg->lpx. +So, let's correct them to 50000 picoseconds and cfg->lpx respectively. + +Note that I've only tested the patch with RM67191 DSI panel on i.MX8mq EVK. +Help is needed to test with other i.MX8mq, Meson and Rockchip platforms, +as I don't have the hardwares. + +Fixes: dddc97e82303 ("phy: dphy: Add configuration helpers") +Cc: Andrzej Hajda +Cc: Neil Armstrong +Cc: Laurent Pinchart +Cc: Kishon Vijay Abraham I +Cc: Vinod Koul +Cc: Heiko Stuebner +Cc: Maxime Ripard +Cc: Guido Günther +Signed-off-by: Liu Ying +Link: https://lore.kernel.org/r/20220216071257.1647703-1-victor.liu@nxp.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/phy-core-mipi-dphy.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/phy/phy-core-mipi-dphy.c b/drivers/phy/phy-core-mipi-dphy.c +index 14e0551cd319..0aa740b73d0d 100644 +--- a/drivers/phy/phy-core-mipi-dphy.c ++++ b/drivers/phy/phy-core-mipi-dphy.c +@@ -66,10 +66,10 @@ int phy_mipi_dphy_get_default_config(unsigned long pixel_clock, + cfg->hs_trail = max(4 * 8 * ui, 60000 + 4 * 4 * ui); + + cfg->init = 100; +- cfg->lpx = 60000; ++ cfg->lpx = 50000; + cfg->ta_get = 5 * cfg->lpx; + cfg->ta_go = 4 * cfg->lpx; +- cfg->ta_sure = 2 * cfg->lpx; ++ cfg->ta_sure = cfg->lpx; + cfg->wakeup = 1000; + + cfg->hs_clk_rate = hs_clk_rate; +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch b/queue-5.10/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch new file mode 100644 index 00000000000..64ca3c4dd1c --- /dev/null +++ b/queue-5.10/pinctrl-mediatek-fix-missing-of_node_put-in-mtk_pctr.patch @@ -0,0 +1,45 @@ +From 042cd50fd36162d3dd435ce67318e8881846de6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 07:11:54 +0000 +Subject: pinctrl: mediatek: Fix missing of_node_put() in mtk_pctrl_init + +From: Miaoqian Lin + +[ Upstream commit dab4df9ca919f59e5b9dd84385eaf34d4f20dbb0 ] + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. + +Fixes: a6df410d420a ("pinctrl: mediatek: Add Pinctrl/GPIO driver for mt8135.") +Signed-off-by: Miaoqian Lin +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220308071155.21114-1-linmq006@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-mtk-common.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c +index a02ad10ec6fa..730581d13064 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c +@@ -1039,6 +1039,7 @@ int mtk_pctrl_init(struct platform_device *pdev, + node = of_parse_phandle(np, "mediatek,pctl-regmap", 0); + if (node) { + pctl->regmap1 = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(pctl->regmap1)) + return PTR_ERR(pctl->regmap1); + } else if (regmap) { +@@ -1052,6 +1053,7 @@ int mtk_pctrl_init(struct platform_device *pdev, + node = of_parse_phandle(np, "mediatek,pctl-regmap", 1); + if (node) { + pctl->regmap2 = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(pctl->regmap2)) + return PTR_ERR(pctl->regmap2); + } +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch b/queue-5.10/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch new file mode 100644 index 00000000000..3f787382242 --- /dev/null +++ b/queue-5.10/pinctrl-mediatek-paris-fix-argument-argument-type-fo.patch @@ -0,0 +1,45 @@ +From b4c5d575a1fdf54d8e1347aa96e6476aa947280a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 18:09:48 +0800 +Subject: pinctrl: mediatek: paris: Fix "argument" argument type for + mtk_pinconf_get() + +From: Chen-Yu Tsai + +[ Upstream commit 19bce7ce0a593c7024030a0cda9e23facea3c93d ] + +For mtk_pinconf_get(), the "argument" argument is typically returned by +pinconf_to_config_argument(), which holds the value for a given pinconf +parameter. It certainly should not have the type of "enum pin_config_param", +which describes the type of the pinconf parameter itself. + +Change the type to u32, which matches the return type of +pinconf_to_config_argument(). + +Fixes: 805250982bb5 ("pinctrl: mediatek: add pinctrl-paris that implements the vendor dt-bindings") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220308100956.2750295-4-wenst@chromium.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-paris.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index 4dd5bd2f135e..9b268ad4e1b8 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -184,8 +184,7 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, + } + + static int mtk_pinconf_set(struct pinctrl_dev *pctldev, unsigned int pin, +- enum pin_config_param param, +- enum pin_config_param arg) ++ enum pin_config_param param, u32 arg) + { + struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); + const struct mtk_pin_desc *desc; +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-mediatek-paris-fix-pin_config_bias_-readback.patch b/queue-5.10/pinctrl-mediatek-paris-fix-pin_config_bias_-readback.patch new file mode 100644 index 00000000000..b5caac0024d --- /dev/null +++ b/queue-5.10/pinctrl-mediatek-paris-fix-pin_config_bias_-readback.patch @@ -0,0 +1,60 @@ +From 31c72f3fb3a95af21d22dbe3b31fd53188177be6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 18:09:47 +0800 +Subject: pinctrl: mediatek: paris: Fix PIN_CONFIG_BIAS_* readback + +From: Chen-Yu Tsai + +[ Upstream commit 3e8c6bc608480010f360c4a59578d7841726137d ] + +When reading back pin bias settings, if the pin is not in the +corresponding bias state, the function should return -EINVAL. + +Fix this in the mediatek-paris pinctrl library so that the read back +state is not littered with bogus a "input bias disabled" combined with +"pull up" or "pull down" states. + +Fixes: 805250982bb5 ("pinctrl: mediatek: add pinctrl-paris that implements the vendor dt-bindings") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220308100956.2750295-3-wenst@chromium.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-paris.c | 16 ++++++---------- + 1 file changed, 6 insertions(+), 10 deletions(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index 623af4410b07..4dd5bd2f135e 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -96,20 +96,16 @@ static int mtk_pinconf_get(struct pinctrl_dev *pctldev, + err = hw->soc->bias_get_combo(hw, desc, &pullup, &ret); + if (err) + goto out; ++ if (ret == MTK_PUPD_SET_R1R0_00) ++ ret = MTK_DISABLE; + if (param == PIN_CONFIG_BIAS_DISABLE) { +- if (ret == MTK_PUPD_SET_R1R0_00) +- ret = MTK_DISABLE; ++ if (ret != MTK_DISABLE) ++ err = -EINVAL; + } else if (param == PIN_CONFIG_BIAS_PULL_UP) { +- /* When desire to get pull-up value, return +- * error if current setting is pull-down +- */ +- if (!pullup) ++ if (!pullup || ret == MTK_DISABLE) + err = -EINVAL; + } else if (param == PIN_CONFIG_BIAS_PULL_DOWN) { +- /* When desire to get pull-down value, return +- * error if current setting is pull-up +- */ +- if (pullup) ++ if (pullup || ret == MTK_DISABLE) + err = -EINVAL; + } + } else { +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch b/queue-5.10/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch new file mode 100644 index 00000000000..8d8d9aebba6 --- /dev/null +++ b/queue-5.10/pinctrl-mediatek-paris-fix-pingroup-pin-config-state.patch @@ -0,0 +1,61 @@ +From 3e5ebe7239b032b5bf9e41c5119450aa3352562a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 18:09:49 +0800 +Subject: pinctrl: mediatek: paris: Fix pingroup pin config state readback + +From: Chen-Yu Tsai + +[ Upstream commit 54fe55fb384ade630ef20b9a8b8f3b2a89ad97f2 ] + +mtk_pconf_group_get(), used to read back pingroup pin config state, +simply returns a set of configs saved from a previous invocation of +mtk_pconf_group_set(). This is an unfiltered, unvalidated set passed +in from the pinconf core, which does not match the current hardware +state. + +Since the driver library is designed to have one pin per group, pass +through mtk_pconf_group_get() to mtk_pinconf_get(), to read back the +current pin config state of the only pin in the group. + +Also drop the assignment of pin config state to the group. + +Fixes: 805250982bb5 ("pinctrl: mediatek: add pinctrl-paris that implements the vendor dt-bindings") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220308100956.2750295-5-wenst@chromium.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-paris.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index 9b268ad4e1b8..2f3c65265e23 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -714,10 +714,10 @@ static int mtk_pconf_group_get(struct pinctrl_dev *pctldev, unsigned group, + unsigned long *config) + { + struct mtk_pinctrl *hw = pinctrl_dev_get_drvdata(pctldev); ++ struct mtk_pinctrl_group *grp = &hw->groups[group]; + +- *config = hw->groups[group].config; +- +- return 0; ++ /* One pin per group only */ ++ return mtk_pinconf_get(pctldev, grp->pin, config); + } + + static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group, +@@ -733,8 +733,6 @@ static int mtk_pconf_group_set(struct pinctrl_dev *pctldev, unsigned group, + pinconf_to_config_argument(configs[i])); + if (ret < 0) + return ret; +- +- grp->config = configs[i]; + } + + return 0; +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-mediatek-paris-skip-custom-extra-pin-config-.patch b/queue-5.10/pinctrl-mediatek-paris-skip-custom-extra-pin-config-.patch new file mode 100644 index 00000000000..b6a8a59730a --- /dev/null +++ b/queue-5.10/pinctrl-mediatek-paris-skip-custom-extra-pin-config-.patch @@ -0,0 +1,43 @@ +From b1b3a632925b4c4cb8122c45a3027109b209c55a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 18:09:51 +0800 +Subject: pinctrl: mediatek: paris: Skip custom extra pin config dump for + virtual GPIOs + +From: Chen-Yu Tsai + +[ Upstream commit 1763933d377ecb05454f8d20e3c8922480db2ac0 ] + +Virtual GPIOs do not have any hardware state associated with them. Any +attempt to read back hardware state for these pins result in error +codes. + +Skip dumping extra pin config information for these virtual GPIOs. + +Fixes: 184d8e13f9b1 ("pinctrl: mediatek: Add support for pin configuration dump via debugfs.") +Signed-off-by: Chen-Yu Tsai +Reviewed-by: AngeloGioacchino Del Regno +Link: https://lore.kernel.org/r/20220308100956.2750295-7-wenst@chromium.org +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/mediatek/pinctrl-paris.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c +index 2f3c65265e23..d0a4ebbe1e7e 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-paris.c ++++ b/drivers/pinctrl/mediatek/pinctrl-paris.c +@@ -580,6 +580,9 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, + if (gpio >= hw->soc->npins) + return -EINVAL; + ++ if (mtk_is_virt_gpio(hw, gpio)) ++ return -EINVAL; ++ + desc = (const struct mtk_pin_desc *)&hw->soc->pins[gpio]; + pinmux = mtk_pctrl_get_pinmux(hw, gpio); + if (pinmux >= hw->soc->nfuncs) +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch b/queue-5.10/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch new file mode 100644 index 00000000000..d7a9b98d606 --- /dev/null +++ b/queue-5.10/pinctrl-nomadik-add-missing-of_node_put-in-nmk_pinct.patch @@ -0,0 +1,41 @@ +From 9ed063b5c9c5986b300d084c4b7a8b33fef75d3b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 11:51:16 +0000 +Subject: pinctrl: nomadik: Add missing of_node_put() in nmk_pinctrl_probe + +From: Miaoqian Lin + +[ Upstream commit c09ac191b1f97cfa06f394dbfd7a5db07986cefc ] + +This node pointer is returned by of_parse_phandle() with refcount +incremented in this function. Calling of_node_put() to avoid +the refcount leak. + +Fixes: 32e67eee670e ("pinctrl: nomadik: Allow prcm_base to be extracted from Device Tree") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220307115116.25316-1-linmq006@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +index 657e35a75d84..6d77feda9090 100644 +--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c ++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +@@ -1883,8 +1883,10 @@ static int nmk_pinctrl_probe(struct platform_device *pdev) + } + + prcm_np = of_parse_phandle(np, "prcm", 0); +- if (prcm_np) ++ if (prcm_np) { + npct->prcm_base = of_iomap(prcm_np, 0); ++ of_node_put(prcm_np); ++ } + if (!npct->prcm_base) { + if (version == PINCTRL_NMK_STN8815) { + dev_info(&pdev->dev, +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch b/queue-5.10/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch new file mode 100644 index 00000000000..8408e0f2def --- /dev/null +++ b/queue-5.10/pinctrl-npcm-fix-broken-references-to-chip-parent_de.patch @@ -0,0 +1,125 @@ +From 509c3ff5bd2b442dc27f01bd2e7566e27e7ac4d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Feb 2022 12:03:08 +0000 +Subject: pinctrl: npcm: Fix broken references to chip->parent_device + +From: Marc Zyngier + +[ Upstream commit f7e53e2255808ca3abcc8f38d18ad0823425e771 ] + +The npcm driver has a bunch of references to the irq_chip parent_device +field, but never sets it. + +Fix it by fishing that reference from somewhere else, but it is +obvious that these debug statements were never used. Also remove +an unused field in a local data structure. + +Signed-off-by: Marc Zyngier +Acked-by: Bartosz Golaszewski +Link: https://lore.kernel.org/r/20220201120310.878267-11-maz@kernel.org +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c | 25 +++++++++++------------ + 1 file changed, 12 insertions(+), 13 deletions(-) + +diff --git a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +index 6de31b5ee358..c359e25519f8 100644 +--- a/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c ++++ b/drivers/pinctrl/nuvoton/pinctrl-npcm7xx.c +@@ -78,7 +78,6 @@ struct npcm7xx_gpio { + struct gpio_chip gc; + int irqbase; + int irq; +- void *priv; + struct irq_chip irq_chip; + u32 pinctrl_id; + int (*direction_input)(struct gpio_chip *chip, unsigned offset); +@@ -226,7 +225,7 @@ static void npcmgpio_irq_handler(struct irq_desc *desc) + chained_irq_enter(chip, desc); + sts = ioread32(bank->base + NPCM7XX_GP_N_EVST); + en = ioread32(bank->base + NPCM7XX_GP_N_EVEN); +- dev_dbg(chip->parent_device, "==> got irq sts %.8x %.8x\n", sts, ++ dev_dbg(bank->gc.parent, "==> got irq sts %.8x %.8x\n", sts, + en); + + sts &= en; +@@ -241,33 +240,33 @@ static int npcmgpio_set_irq_type(struct irq_data *d, unsigned int type) + gpiochip_get_data(irq_data_get_irq_chip_data(d)); + unsigned int gpio = BIT(d->hwirq); + +- dev_dbg(d->chip->parent_device, "setirqtype: %u.%u = %u\n", gpio, ++ dev_dbg(bank->gc.parent, "setirqtype: %u.%u = %u\n", gpio, + d->irq, type); + switch (type) { + case IRQ_TYPE_EDGE_RISING: +- dev_dbg(d->chip->parent_device, "edge.rising\n"); ++ dev_dbg(bank->gc.parent, "edge.rising\n"); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + case IRQ_TYPE_EDGE_FALLING: +- dev_dbg(d->chip->parent_device, "edge.falling\n"); ++ dev_dbg(bank->gc.parent, "edge.falling\n"); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); + npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + case IRQ_TYPE_EDGE_BOTH: +- dev_dbg(d->chip->parent_device, "edge.both\n"); ++ dev_dbg(bank->gc.parent, "edge.both\n"); + npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_EVBE, gpio); + break; + case IRQ_TYPE_LEVEL_LOW: +- dev_dbg(d->chip->parent_device, "level.low\n"); ++ dev_dbg(bank->gc.parent, "level.low\n"); + npcm_gpio_set(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + case IRQ_TYPE_LEVEL_HIGH: +- dev_dbg(d->chip->parent_device, "level.high\n"); ++ dev_dbg(bank->gc.parent, "level.high\n"); + npcm_gpio_clr(&bank->gc, bank->base + NPCM7XX_GP_N_POL, gpio); + break; + default: +- dev_dbg(d->chip->parent_device, "invalid irq type\n"); ++ dev_dbg(bank->gc.parent, "invalid irq type\n"); + return -EINVAL; + } + +@@ -289,7 +288,7 @@ static void npcmgpio_irq_ack(struct irq_data *d) + gpiochip_get_data(irq_data_get_irq_chip_data(d)); + unsigned int gpio = d->hwirq; + +- dev_dbg(d->chip->parent_device, "irq_ack: %u.%u\n", gpio, d->irq); ++ dev_dbg(bank->gc.parent, "irq_ack: %u.%u\n", gpio, d->irq); + iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVST); + } + +@@ -301,7 +300,7 @@ static void npcmgpio_irq_mask(struct irq_data *d) + unsigned int gpio = d->hwirq; + + /* Clear events */ +- dev_dbg(d->chip->parent_device, "irq_mask: %u.%u\n", gpio, d->irq); ++ dev_dbg(bank->gc.parent, "irq_mask: %u.%u\n", gpio, d->irq); + iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENC); + } + +@@ -313,7 +312,7 @@ static void npcmgpio_irq_unmask(struct irq_data *d) + unsigned int gpio = d->hwirq; + + /* Enable events */ +- dev_dbg(d->chip->parent_device, "irq_unmask: %u.%u\n", gpio, d->irq); ++ dev_dbg(bank->gc.parent, "irq_unmask: %u.%u\n", gpio, d->irq); + iowrite32(BIT(gpio), bank->base + NPCM7XX_GP_N_EVENS); + } + +@@ -323,7 +322,7 @@ static unsigned int npcmgpio_irq_startup(struct irq_data *d) + unsigned int gpio = d->hwirq; + + /* active-high, input, clear interrupt, enable interrupt */ +- dev_dbg(d->chip->parent_device, "startup: %u.%u\n", gpio, d->irq); ++ dev_dbg(gc->parent, "startup: %u.%u\n", gpio, d->irq); + npcmgpio_direction_input(gc, gpio); + npcmgpio_irq_ack(d); + npcmgpio_irq_unmask(d); +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-renesas-checker-fix-miscalculation-of-number.patch b/queue-5.10/pinctrl-renesas-checker-fix-miscalculation-of-number.patch new file mode 100644 index 00000000000..eba6fcc3002 --- /dev/null +++ b/queue-5.10/pinctrl-renesas-checker-fix-miscalculation-of-number.patch @@ -0,0 +1,51 @@ +From a3803831d8d172825748e7396e892db41c1376b5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 21 Feb 2022 17:21:58 +0100 +Subject: pinctrl: renesas: checker: Fix miscalculation of number of states + +From: Geert Uytterhoeven + +[ Upstream commit de9b861018d46af27a5edff8b6baef35c0c0ad4f ] + +The checker failed to validate all enum IDs in the description of a +register with fixed-width register fields, due to a miscalculation of +the number of described states: each register field of n bits can have +"1 << n" possible states, not "1". + +Increase SH_PFC_MAX_ENUMS accordingly, now more enum IDs are checked +(SH-Mobile AG5 has more than 4000 enum IDs defined). + +Fixes: 12d057bad683b1c6 ("pinctrl: sh-pfc: checker: Add check for enum ID conflicts") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/6d8a6a05564f38f9d20464c1c17f96e52740cf6a.1645460429.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/core.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/renesas/core.c b/drivers/pinctrl/renesas/core.c +index 9d168b90cd28..258972672eda 100644 +--- a/drivers/pinctrl/renesas/core.c ++++ b/drivers/pinctrl/renesas/core.c +@@ -739,7 +739,7 @@ static int sh_pfc_suspend_init(struct sh_pfc *pfc) { return 0; } + + #ifdef DEBUG + #define SH_PFC_MAX_REGS 300 +-#define SH_PFC_MAX_ENUMS 3000 ++#define SH_PFC_MAX_ENUMS 5000 + + static unsigned int sh_pfc_errors __initdata = 0; + static unsigned int sh_pfc_warnings __initdata = 0; +@@ -851,7 +851,8 @@ static void __init sh_pfc_check_cfg_reg(const char *drvname, + sh_pfc_check_reg(drvname, cfg_reg->reg); + + if (cfg_reg->field_width) { +- n = cfg_reg->reg_width / cfg_reg->field_width; ++ fw = cfg_reg->field_width; ++ n = (cfg_reg->reg_width / fw) << fw; + /* Skip field checks (done at build time) */ + goto check_enum_ids; + } +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch b/queue-5.10/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch new file mode 100644 index 00000000000..b3eb47acb9c --- /dev/null +++ b/queue-5.10/pinctrl-renesas-r8a77470-reduce-size-for-narrow-vin1.patch @@ -0,0 +1,50 @@ +From 4f7f9e085caed8ae979f01254f39f324724cd28b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 23 Dec 2021 15:41:11 +0100 +Subject: pinctrl: renesas: r8a77470: Reduce size for narrow VIN1 channel + +From: Geert Uytterhoeven + +[ Upstream commit 9e04a0eda84fccab0ac22a33825ad53f47c968c7 ] + +The second video-in channel on RZ/G1C has only 12 data lanes, but the +pin control driver uses the vin_data union, which is meant for 24 data +lanes, thus wasting space. + +Fix this by using the vin_data12 union instead. + +This reduces kernel size by 96 bytes. + +Fixes: 50f3f2d73e3426ba ("pinctrl: sh-pfc: Reduce kernel size for narrow VIN channels") +Signed-off-by: Geert Uytterhoeven +Link: https://lore.kernel.org/r/52716fa89139f6f92592633edb52804d4c5e18f0.1640269757.git.geert+renesas@glider.be +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/renesas/pfc-r8a77470.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/pinctrl/renesas/pfc-r8a77470.c b/drivers/pinctrl/renesas/pfc-r8a77470.c +index b3b116da1bb0..14005725a726 100644 +--- a/drivers/pinctrl/renesas/pfc-r8a77470.c ++++ b/drivers/pinctrl/renesas/pfc-r8a77470.c +@@ -2121,7 +2121,7 @@ static const unsigned int vin0_clk_mux[] = { + VI0_CLK_MARK, + }; + /* - VIN1 ------------------------------------------------------------------- */ +-static const union vin_data vin1_data_pins = { ++static const union vin_data12 vin1_data_pins = { + .data12 = { + RCAR_GP_PIN(3, 1), RCAR_GP_PIN(3, 2), + RCAR_GP_PIN(3, 3), RCAR_GP_PIN(3, 4), +@@ -2131,7 +2131,7 @@ static const union vin_data vin1_data_pins = { + RCAR_GP_PIN(3, 15), RCAR_GP_PIN(3, 16), + }, + }; +-static const union vin_data vin1_data_mux = { ++static const union vin_data12 vin1_data_mux = { + .data12 = { + VI1_DATA0_MARK, VI1_DATA1_MARK, + VI1_DATA2_MARK, VI1_DATA3_MARK, +-- +2.34.1 + diff --git a/queue-5.10/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch b/queue-5.10/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch new file mode 100644 index 00000000000..72f6de0f9ec --- /dev/null +++ b/queue-5.10/pinctrl-rockchip-add-missing-of_node_put-in-rockchip.patch @@ -0,0 +1,45 @@ +From 562ae09ed550496b8c14ea6fd2a3dc4dd5ac5847 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 7 Mar 2022 12:02:34 +0000 +Subject: pinctrl/rockchip: Add missing of_node_put() in rockchip_pinctrl_probe + +From: Miaoqian Lin + +[ Upstream commit 89388f8730699c259f8090ec435fb43569efe4ac ] + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. + +Fixes: 1e747e59cc4d ("pinctrl: rockchip: base regmap supplied by a syscon") +Fixes: 14dee8677e19 ("pinctrl: rockchip: let pmu registers be supplied by a syscon") +Signed-off-by: Miaoqian Lin +Link: https://lore.kernel.org/r/20220307120234.28657-1-linmq006@gmail.com +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-rockchip.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index 53a0badc6b03..9df48e0cf4cb 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -3774,6 +3774,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) + node = of_parse_phandle(np, "rockchip,grf", 0); + if (node) { + info->regmap_base = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(info->regmap_base)) + return PTR_ERR(info->regmap_base); + } else { +@@ -3810,6 +3811,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) + node = of_parse_phandle(np, "rockchip,pmu", 0); + if (node) { + info->regmap_pmu = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(info->regmap_pmu)) + return PTR_ERR(info->regmap_pmu); + } +-- +2.34.1 + diff --git a/queue-5.10/platform-x86-huawei-wmi-check-the-return-value-of-de.patch b/queue-5.10/platform-x86-huawei-wmi-check-the-return-value-of-de.patch new file mode 100644 index 00000000000..0139b584171 --- /dev/null +++ b/queue-5.10/platform-x86-huawei-wmi-check-the-return-value-of-de.patch @@ -0,0 +1,52 @@ +From 836ac392b4de5774842f3b1d9a4c87a0fd7f4172 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 2 Mar 2022 18:24:21 -0800 +Subject: platform/x86: huawei-wmi: check the return value of + device_create_file() + +From: Jia-Ju Bai + +[ Upstream commit c91a5b1c221a58d008485cf7d02ccce73108b119 ] + +The function device_create_file() in huawei_wmi_battery_add() can fail, +so its return value should be checked. + +Fixes: 355a070b09ab ("platform/x86: huawei-wmi: Add battery charging thresholds") +Reported-by: TOTE Robot +Signed-off-by: Jia-Ju Bai +Link: https://lore.kernel.org/r/20220303022421.313-1-baijiaju1990@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/huawei-wmi.c | 13 ++++++++++--- + 1 file changed, 10 insertions(+), 3 deletions(-) + +diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c +index a2d846c4a7ee..eac3e6b4ea11 100644 +--- a/drivers/platform/x86/huawei-wmi.c ++++ b/drivers/platform/x86/huawei-wmi.c +@@ -470,10 +470,17 @@ static DEVICE_ATTR_RW(charge_control_thresholds); + + static int huawei_wmi_battery_add(struct power_supply *battery) + { +- device_create_file(&battery->dev, &dev_attr_charge_control_start_threshold); +- device_create_file(&battery->dev, &dev_attr_charge_control_end_threshold); ++ int err = 0; + +- return 0; ++ err = device_create_file(&battery->dev, &dev_attr_charge_control_start_threshold); ++ if (err) ++ return err; ++ ++ err = device_create_file(&battery->dev, &dev_attr_charge_control_end_threshold); ++ if (err) ++ device_remove_file(&battery->dev, &dev_attr_charge_control_start_threshold); ++ ++ return err; + } + + static int huawei_wmi_battery_remove(struct power_supply *battery) +-- +2.34.1 + diff --git a/queue-5.10/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch b/queue-5.10/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch new file mode 100644 index 00000000000..912b003fa9e --- /dev/null +++ b/queue-5.10/pm-core-keep-irq-flags-in-device_pm_check_callbacks.patch @@ -0,0 +1,107 @@ +From f5dfbb801cbf9b292e59a91ea508be956bd7d070 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 5 Mar 2022 14:02:14 +0300 +Subject: PM: core: keep irq flags in device_pm_check_callbacks() + +From: Dmitry Baryshkov + +[ Upstream commit 524bb1da785a7ae43dd413cd392b5071c6c367f8 ] + +The function device_pm_check_callbacks() can be called under the spin +lock (in the reported case it happens from genpd_add_device() -> +dev_pm_domain_set(), when the genpd uses spinlocks rather than mutexes. + +However this function uncoditionally uses spin_lock_irq() / +spin_unlock_irq(), thus not preserving the CPU flags. Use the +irqsave/irqrestore instead. + +The backtrace for the reference: +[ 2.752010] ------------[ cut here ]------------ +[ 2.756769] raw_local_irq_restore() called with IRQs enabled +[ 2.762596] WARNING: CPU: 4 PID: 1 at kernel/locking/irqflag-debug.c:10 warn_bogus_irq_restore+0x34/0x50 +[ 2.772338] Modules linked in: +[ 2.775487] CPU: 4 PID: 1 Comm: swapper/0 Tainted: G S 5.17.0-rc6-00384-ge330d0d82eff-dirty #684 +[ 2.781384] Freeing initrd memory: 46024K +[ 2.785839] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) +[ 2.785841] pc : warn_bogus_irq_restore+0x34/0x50 +[ 2.785844] lr : warn_bogus_irq_restore+0x34/0x50 +[ 2.785846] sp : ffff80000805b7d0 +[ 2.785847] x29: ffff80000805b7d0 x28: 0000000000000000 x27: 0000000000000002 +[ 2.785850] x26: ffffd40e80930b18 x25: ffff7ee2329192b8 x24: ffff7edfc9f60800 +[ 2.785853] x23: ffffd40e80930b18 x22: ffffd40e80930d30 x21: ffff7edfc0dffa00 +[ 2.785856] x20: ffff7edfc09e3768 x19: 0000000000000000 x18: ffffffffffffffff +[ 2.845775] x17: 6572206f74206465 x16: 6c696166203a3030 x15: ffff80008805b4f7 +[ 2.853108] x14: 0000000000000000 x13: ffffd40e809550b0 x12: 00000000000003d8 +[ 2.860441] x11: 0000000000000148 x10: ffffd40e809550b0 x9 : ffffd40e809550b0 +[ 2.867774] x8 : 00000000ffffefff x7 : ffffd40e809ad0b0 x6 : ffffd40e809ad0b0 +[ 2.875107] x5 : 000000000000bff4 x4 : 0000000000000000 x3 : 0000000000000000 +[ 2.882440] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff7edfc03a8000 +[ 2.889774] Call trace: +[ 2.892290] warn_bogus_irq_restore+0x34/0x50 +[ 2.896770] _raw_spin_unlock_irqrestore+0x94/0xa0 +[ 2.901690] genpd_unlock_spin+0x20/0x30 +[ 2.905724] genpd_add_device+0x100/0x2d0 +[ 2.909850] __genpd_dev_pm_attach+0xa8/0x23c +[ 2.914329] genpd_dev_pm_attach_by_id+0xc4/0x190 +[ 2.919167] genpd_dev_pm_attach_by_name+0x3c/0xd0 +[ 2.924086] dev_pm_domain_attach_by_name+0x24/0x30 +[ 2.929102] psci_dt_attach_cpu+0x24/0x90 +[ 2.933230] psci_cpuidle_probe+0x2d4/0x46c +[ 2.937534] platform_probe+0x68/0xe0 +[ 2.941304] really_probe.part.0+0x9c/0x2fc +[ 2.945605] __driver_probe_device+0x98/0x144 +[ 2.950085] driver_probe_device+0x44/0x15c +[ 2.954385] __device_attach_driver+0xb8/0x120 +[ 2.958950] bus_for_each_drv+0x78/0xd0 +[ 2.962896] __device_attach+0xd8/0x180 +[ 2.966843] device_initial_probe+0x14/0x20 +[ 2.971144] bus_probe_device+0x9c/0xa4 +[ 2.975092] device_add+0x380/0x88c +[ 2.978679] platform_device_add+0x114/0x234 +[ 2.983067] platform_device_register_full+0x100/0x190 +[ 2.988344] psci_idle_init+0x6c/0xb0 +[ 2.992113] do_one_initcall+0x74/0x3a0 +[ 2.996060] kernel_init_freeable+0x2fc/0x384 +[ 3.000543] kernel_init+0x28/0x130 +[ 3.004132] ret_from_fork+0x10/0x20 +[ 3.007817] irq event stamp: 319826 +[ 3.011404] hardirqs last enabled at (319825): [] __up_console_sem+0x78/0x84 +[ 3.020332] hardirqs last disabled at (319826): [] el1_dbg+0x24/0x8c +[ 3.028458] softirqs last enabled at (318312): [] _stext+0x410/0x588 +[ 3.036678] softirqs last disabled at (318299): [] __irq_exit_rcu+0x158/0x174 +[ 3.045607] ---[ end trace 0000000000000000 ]--- + +Signed-off-by: Dmitry Baryshkov +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/base/power/main.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index 4167e2aef397..1dbaaddf540e 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -1994,7 +1994,9 @@ static bool pm_ops_is_empty(const struct dev_pm_ops *ops) + + void device_pm_check_callbacks(struct device *dev) + { +- spin_lock_irq(&dev->power.lock); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&dev->power.lock, flags); + dev->power.no_pm_callbacks = + (!dev->bus || (pm_ops_is_empty(dev->bus->pm) && + !dev->bus->suspend && !dev->bus->resume)) && +@@ -2003,7 +2005,7 @@ void device_pm_check_callbacks(struct device *dev) + (!dev->pm_domain || pm_ops_is_empty(&dev->pm_domain->ops)) && + (!dev->driver || (pm_ops_is_empty(dev->driver->pm) && + !dev->driver->suspend && !dev->driver->resume)); +- spin_unlock_irq(&dev->power.lock); ++ spin_unlock_irqrestore(&dev->power.lock, flags); + } + + bool dev_pm_skip_suspend(struct device *dev) +-- +2.34.1 + diff --git a/queue-5.10/pm-hibernate-fix-__setup-handler-error-handling.patch b/queue-5.10/pm-hibernate-fix-__setup-handler-error-handling.patch new file mode 100644 index 00000000000..2674c381a64 --- /dev/null +++ b/queue-5.10/pm-hibernate-fix-__setup-handler-error-handling.patch @@ -0,0 +1,40 @@ +From 68df4b83629023a96a57ee9e5549428fcd181fc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 14:05:32 -0800 +Subject: PM: hibernate: fix __setup handler error handling + +From: Randy Dunlap + +[ Upstream commit ba7ffcd4c4da374b0f64666354eeeda7d3827131 ] + +If an invalid value is used in "resumedelay=", it is +silently ignored. Add a warning message and then let the __setup +handler return 1 to indicate that the kernel command line option +has been handled. + +Fixes: 317cf7e5e85e3 ("PM / hibernate: convert simple_strtoul to kstrtoul") +Signed-off-by: Randy Dunlap +Reported-by: Igor Zhbanov +Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + kernel/power/hibernate.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index bf640fd6142a..522cb1387462 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -1323,7 +1323,7 @@ static int __init resumedelay_setup(char *str) + int rc = kstrtouint(str, 0, &resume_delay); + + if (rc) +- return rc; ++ pr_warn("resumedelay: bad option string '%s'\n", str); + return 1; + } + +-- +2.34.1 + diff --git a/queue-5.10/pm-suspend-fix-return-value-of-__setup-handler.patch b/queue-5.10/pm-suspend-fix-return-value-of-__setup-handler.patch new file mode 100644 index 00000000000..e18498976b7 --- /dev/null +++ b/queue-5.10/pm-suspend-fix-return-value-of-__setup-handler.patch @@ -0,0 +1,73 @@ +From 0c648547fd69c0ef55192511e22558ac7742888d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Feb 2022 14:05:44 -0800 +Subject: PM: suspend: fix return value of __setup handler + +From: Randy Dunlap + +[ Upstream commit 7a64ca17e4dd50d5f910769167f3553902777844 ] + +If an invalid option is given for "test_suspend=