From: Sasha Levin Date: Sun, 15 Nov 2020 14:34:29 +0000 (-0500) Subject: Fixes for 5.9 X-Git-Tag: v4.4.244~63^2~5 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=388373e375fa3878e1a6a98a9fc3ed5e2c07cfe4;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.9 Signed-off-by: Sasha Levin --- diff --git a/queue-5.9/alsa-hda-reinstate-runtime_allow-for-all-hda-control.patch b/queue-5.9/alsa-hda-reinstate-runtime_allow-for-all-hda-control.patch new file mode 100644 index 00000000000..e91be41e6e1 --- /dev/null +++ b/queue-5.9/alsa-hda-reinstate-runtime_allow-for-all-hda-control.patch @@ -0,0 +1,36 @@ +From 64c85a6cd38b98ed58164bdf1448cd7902eaf107 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 21:00:38 +0800 +Subject: ALSA: hda: Reinstate runtime_allow() for all hda controllers + +From: Kai-Heng Feng + +[ Upstream commit 9fc149c3bce7bdbb94948a8e6bd025e3b3538603 ] + +The broken jack detection should be fixed by commit a6e7d0a4bdb0 ("ALSA: +hda: fix jack detection with Realtek codecs when in D3"), let's try +enabling runtime PM by default again. + +Signed-off-by: Kai-Heng Feng +Link: https://lore.kernel.org/r/20201027130038.16463-4-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_intel.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 268e9ead9795f..0ae0290eb2bfd 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2361,6 +2361,7 @@ static int azx_probe_continue(struct azx *chip) + + if (azx_has_pm_runtime(chip)) { + pm_runtime_use_autosuspend(&pci->dev); ++ pm_runtime_allow(&pci->dev); + pm_runtime_put_autosuspend(&pci->dev); + } + +-- +2.27.0 + diff --git a/queue-5.9/alsa-hda-separate-runtime-and-system-suspend.patch b/queue-5.9/alsa-hda-separate-runtime-and-system-suspend.patch new file mode 100644 index 00000000000..809e9dbe887 --- /dev/null +++ b/queue-5.9/alsa-hda-separate-runtime-and-system-suspend.patch @@ -0,0 +1,194 @@ +From 38d7bbb04dc0b4db81dc62caa0e4be0ca7f33b75 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 21:00:37 +0800 +Subject: ALSA: hda: Separate runtime and system suspend + +From: Kai-Heng Feng + +[ Upstream commit f5dac54d9d93826a776dffc848df76746f7135bb ] + +Both pm_runtime_force_suspend() and pm_runtime_force_resume() have +some implicit checks, so it can make code flow more straightforward if +we separate runtime and system suspend callbacks. + +High Definition Audio Specification, 4.5.9.3 Codec Wake From System S3 +states that codec can wake the system up from S3 if WAKEEN is toggled. +Since HDA controller has different wakeup settings for runtime and +system susend, we also need to explicitly disable direct-complete which +can be enabled automatically by PCI core. In addition to that, avoid +waking up codec if runtime resume is for system suspend, to not break +direct-complete for codecs. + +While at it, also remove AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP, as the +original bug commit a6630529aecb ("ALSA: hda: Workaround for spurious +wakeups on some Intel platforms") solves doesn't happen with this +patch. + +Signed-off-by: Kai-Heng Feng +Link: https://lore.kernel.org/r/20201027130038.16463-3-kai.heng.feng@canonical.com +Signed-off-by: Takashi Iwai +Signed-off-by: Sasha Levin +--- + sound/pci/hda/hda_controller.h | 3 +- + sound/pci/hda/hda_intel.c | 62 +++++++++++++++++++--------------- + 2 files changed, 36 insertions(+), 29 deletions(-) + +diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h +index be63ead8161f8..68f9668788ea2 100644 +--- a/sound/pci/hda/hda_controller.h ++++ b/sound/pci/hda/hda_controller.h +@@ -41,7 +41,7 @@ + /* 24 unused */ + #define AZX_DCAPS_COUNT_LPIB_DELAY (1 << 25) /* Take LPIB as delay */ + #define AZX_DCAPS_PM_RUNTIME (1 << 26) /* runtime PM support */ +-#define AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP (1 << 27) /* Workaround for spurious wakeups after suspend */ ++/* 27 unused */ + #define AZX_DCAPS_CORBRP_SELF_CLEAR (1 << 28) /* CORBRP clears itself after reset */ + #define AZX_DCAPS_NO_MSI64 (1 << 29) /* Stick to 32-bit MSIs */ + #define AZX_DCAPS_SEPARATE_STREAM_TAG (1 << 30) /* capture and playback use separate stream tag */ +@@ -143,6 +143,7 @@ struct azx { + unsigned int align_buffer_size:1; + unsigned int region_requested:1; + unsigned int disabled:1; /* disabled by vga_switcheroo */ ++ unsigned int pm_prepared:1; + + /* GTS present */ + unsigned int gts_present:1; +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 476a8b871daa1..268e9ead9795f 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -297,8 +297,7 @@ enum { + /* PCH for HSW/BDW; with runtime PM */ + /* no i915 binding for this as HSW/BDW has another controller for HDMI */ + #define AZX_DCAPS_INTEL_PCH \ +- (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME |\ +- AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP) ++ (AZX_DCAPS_INTEL_PCH_BASE | AZX_DCAPS_PM_RUNTIME) + + /* HSW HDMI */ + #define AZX_DCAPS_INTEL_HASWELL \ +@@ -984,7 +983,7 @@ static void __azx_runtime_suspend(struct azx *chip) + display_power(chip, false); + } + +-static void __azx_runtime_resume(struct azx *chip, bool from_rt) ++static void __azx_runtime_resume(struct azx *chip) + { + struct hda_intel *hda = container_of(chip, struct hda_intel, chip); + struct hdac_bus *bus = azx_bus(chip); +@@ -1001,7 +1000,8 @@ static void __azx_runtime_resume(struct azx *chip, bool from_rt) + azx_init_pci(chip); + hda_intel_init_chip(chip, true); + +- if (from_rt) { ++ /* Avoid codec resume if runtime resume is for system suspend */ ++ if (!chip->pm_prepared) { + list_for_each_codec(codec, &chip->bus) { + if (codec->relaxed_resume) + continue; +@@ -1017,6 +1017,29 @@ static void __azx_runtime_resume(struct azx *chip, bool from_rt) + } + + #ifdef CONFIG_PM_SLEEP ++static int azx_prepare(struct device *dev) ++{ ++ struct snd_card *card = dev_get_drvdata(dev); ++ struct azx *chip; ++ ++ chip = card->private_data; ++ chip->pm_prepared = 1; ++ ++ /* HDA controller always requires different WAKEEN for runtime suspend ++ * and system suspend, so don't use direct-complete here. ++ */ ++ return 0; ++} ++ ++static void azx_complete(struct device *dev) ++{ ++ struct snd_card *card = dev_get_drvdata(dev); ++ struct azx *chip; ++ ++ chip = card->private_data; ++ chip->pm_prepared = 0; ++} ++ + static int azx_suspend(struct device *dev) + { + struct snd_card *card = dev_get_drvdata(dev); +@@ -1028,15 +1051,7 @@ static int azx_suspend(struct device *dev) + + chip = card->private_data; + bus = azx_bus(chip); +- snd_power_change_state(card, SNDRV_CTL_POWER_D3hot); +- /* An ugly workaround: direct call of __azx_runtime_suspend() and +- * __azx_runtime_resume() for old Intel platforms that suffer from +- * spurious wakeups after S3 suspend +- */ +- if (chip->driver_caps & AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP) +- __azx_runtime_suspend(chip); +- else +- pm_runtime_force_suspend(dev); ++ __azx_runtime_suspend(chip); + if (bus->irq >= 0) { + free_irq(bus->irq, chip); + bus->irq = -1; +@@ -1065,11 +1080,7 @@ static int azx_resume(struct device *dev) + if (azx_acquire_irq(chip, 1) < 0) + return -EIO; + +- if (chip->driver_caps & AZX_DCAPS_SUSPEND_SPURIOUS_WAKEUP) +- __azx_runtime_resume(chip, false); +- else +- pm_runtime_force_resume(dev); +- snd_power_change_state(card, SNDRV_CTL_POWER_D0); ++ __azx_runtime_resume(chip); + + trace_azx_resume(chip); + return 0; +@@ -1117,10 +1128,7 @@ static int azx_runtime_suspend(struct device *dev) + chip = card->private_data; + + /* enable controller wake up event */ +- if (snd_power_get_state(card) == SNDRV_CTL_POWER_D0) { +- azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) | +- STATESTS_INT_MASK); +- } ++ azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) | STATESTS_INT_MASK); + + __azx_runtime_suspend(chip); + trace_azx_runtime_suspend(chip); +@@ -1131,18 +1139,14 @@ static int azx_runtime_resume(struct device *dev) + { + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip; +- bool from_rt = snd_power_get_state(card) == SNDRV_CTL_POWER_D0; + + if (!azx_is_pm_ready(card)) + return 0; + chip = card->private_data; +- __azx_runtime_resume(chip, from_rt); ++ __azx_runtime_resume(chip); + + /* disable controller Wake Up event*/ +- if (from_rt) { +- azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) & +- ~STATESTS_INT_MASK); +- } ++ azx_writew(chip, WAKEEN, azx_readw(chip, WAKEEN) & ~STATESTS_INT_MASK); + + trace_azx_runtime_resume(chip); + return 0; +@@ -1176,6 +1180,8 @@ static int azx_runtime_idle(struct device *dev) + static const struct dev_pm_ops azx_pm = { + SET_SYSTEM_SLEEP_PM_OPS(azx_suspend, azx_resume) + #ifdef CONFIG_PM_SLEEP ++ .prepare = azx_prepare, ++ .complete = azx_complete, + .freeze_noirq = azx_freeze_noirq, + .thaw_noirq = azx_thaw_noirq, + #endif +-- +2.27.0 + diff --git a/queue-5.9/amd-amdgpu-disable-vcn-dpg-mode-for-picasso.patch b/queue-5.9/amd-amdgpu-disable-vcn-dpg-mode-for-picasso.patch new file mode 100644 index 00000000000..266bd5b8146 --- /dev/null +++ b/queue-5.9/amd-amdgpu-disable-vcn-dpg-mode-for-picasso.patch @@ -0,0 +1,37 @@ +From 84a346233b714309debd06c3af94832a40107592 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 19:59:46 +0530 +Subject: amd/amdgpu: Disable VCN DPG mode for Picasso + +From: Veerabadhran Gopalakrishnan + +[ Upstream commit c6d2b0fbb893d5c7dda405aa0e7bcbecf1c75f98 ] + +Concurrent operation of VCN and JPEG decoder in DPG mode is +causing ring timeout due to power state. + +Signed-off-by: Veerabadhran Gopalakrishnan +Reviewed-by: Leo Liu +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/soc15.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index c28ebf41530aa..254ab2ada70a0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -1220,8 +1220,7 @@ static int soc15_common_early_init(void *handle) + + adev->pg_flags = AMD_PG_SUPPORT_SDMA | + AMD_PG_SUPPORT_MMHUB | +- AMD_PG_SUPPORT_VCN | +- AMD_PG_SUPPORT_VCN_DPG; ++ AMD_PG_SUPPORT_VCN; + } else { + adev->cg_flags = AMD_CG_SUPPORT_GFX_MGCG | + AMD_CG_SUPPORT_GFX_MGLS | +-- +2.27.0 + diff --git a/queue-5.9/arc-plat-hsdk-remap-ccms-super-early-in-asm-boot-tra.patch b/queue-5.9/arc-plat-hsdk-remap-ccms-super-early-in-asm-boot-tra.patch new file mode 100644 index 00000000000..a29ef5181b5 --- /dev/null +++ b/queue-5.9/arc-plat-hsdk-remap-ccms-super-early-in-asm-boot-tra.patch @@ -0,0 +1,108 @@ +From 84c9a77a0a14a1ddd37840b25f9a8c51ee7f9a0c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 19:18:34 -0700 +Subject: ARC: [plat-hsdk] Remap CCMs super early in asm boot trampoline + +From: Vineet Gupta + +[ Upstream commit 3b57533b460c8dc22a432684b7e8d22571f34d2e ] + +ARC HSDK platform stopped booting on released v5.10-rc1, getting stuck +in startup of non master SMP cores. + +This was bisected to upstream commit 7fef431be9c9ac25 +"(mm/page_alloc: place pages to tail in __free_pages_core())" +That commit itself is harmless, it just exposed a subtle assumption in +our platform code (hence CC'ing linux-mm just as FYI in case some other +arches / platforms trip on it). + +The upstream commit is semantically disruptive as it reverses the order +of page allocations (actually it can be good test for hardware +verification to exercise different memory patterns altogether). +For ARC HSDK platform that meant a remapped memory region (pertaining to +unused Closely Coupled Memory) started getting used early for dynamice +allocations, while not effectively remapped on all the cores, triggering +memory error exception on those cores. + +The fix is to move the CCM remapping from early platform code to to early core +boot code. And while it is undesirable to riddle common boot code with +platform quirks, there is no other way to do this since the faltering code +involves setting up stack itself so even function calls are not allowed at +that point. + +If anyone is interested, all the gory details can be found at Link below. + +Link: https://github.com/foss-for-synopsys-dwc-arc-processors/linux/issues/32 +Cc: David Hildenbrand +Cc: linux-mm@kvack.org +Signed-off-by: Vineet Gupta +Signed-off-by: Sasha Levin +--- + arch/arc/kernel/head.S | 17 ++++++++++++++++- + arch/arc/plat-hsdk/platform.c | 17 ----------------- + 2 files changed, 16 insertions(+), 18 deletions(-) + +diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S +index 17fd1ed700cca..9152782444b55 100644 +--- a/arch/arc/kernel/head.S ++++ b/arch/arc/kernel/head.S +@@ -67,7 +67,22 @@ + sr r5, [ARC_REG_LPB_CTRL] + 1: + #endif /* CONFIG_ARC_LPB_DISABLE */ +-#endif ++ ++ /* On HSDK, CCMs need to remapped super early */ ++#ifdef CONFIG_ARC_SOC_HSDK ++ mov r6, 0x60000000 ++ lr r5, [ARC_REG_ICCM_BUILD] ++ breq r5, 0, 1f ++ sr r6, [ARC_REG_AUX_ICCM] ++1: ++ lr r5, [ARC_REG_DCCM_BUILD] ++ breq r5, 0, 2f ++ sr r6, [ARC_REG_AUX_DCCM] ++2: ++#endif /* CONFIG_ARC_SOC_HSDK */ ++ ++#endif /* CONFIG_ISA_ARCV2 */ ++ + ; Config DSP_CTRL properly, so kernel may use integer multiply, + ; multiply-accumulate, and divide operations + DSP_EARLY_INIT +diff --git a/arch/arc/plat-hsdk/platform.c b/arch/arc/plat-hsdk/platform.c +index 0b961a2a10b8e..22c9e2c9c0283 100644 +--- a/arch/arc/plat-hsdk/platform.c ++++ b/arch/arc/plat-hsdk/platform.c +@@ -17,22 +17,6 @@ int arc_hsdk_axi_dmac_coherent __section(.data) = 0; + + #define ARC_CCM_UNUSED_ADDR 0x60000000 + +-static void __init hsdk_init_per_cpu(unsigned int cpu) +-{ +- /* +- * By default ICCM is mapped to 0x7z while this area is used for +- * kernel virtual mappings, so move it to currently unused area. +- */ +- if (cpuinfo_arc700[cpu].iccm.sz) +- write_aux_reg(ARC_REG_AUX_ICCM, ARC_CCM_UNUSED_ADDR); +- +- /* +- * By default DCCM is mapped to 0x8z while this area is used by kernel, +- * so move it to currently unused area. +- */ +- if (cpuinfo_arc700[cpu].dccm.sz) +- write_aux_reg(ARC_REG_AUX_DCCM, ARC_CCM_UNUSED_ADDR); +-} + + #define ARC_PERIPHERAL_BASE 0xf0000000 + #define CREG_BASE (ARC_PERIPHERAL_BASE + 0x1000) +@@ -339,5 +323,4 @@ static const char *hsdk_compat[] __initconst = { + MACHINE_START(SIMULATION, "hsdk") + .dt_compat = hsdk_compat, + .init_early = hsdk_init_early, +- .init_per_cpu = hsdk_init_per_cpu, + MACHINE_END +-- +2.27.0 + diff --git a/queue-5.9/arm64-kexec_file-try-more-regions-if-loading-segment.patch b/queue-5.9/arm64-kexec_file-try-more-regions-if-loading-segment.patch new file mode 100644 index 00000000000..6cb37d7aec9 --- /dev/null +++ b/queue-5.9/arm64-kexec_file-try-more-regions-if-loading-segment.patch @@ -0,0 +1,131 @@ +From 5dc60295d0fde638a5b62803703cda4daf411a67 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 12:11:06 -0800 +Subject: arm64: kexec_file: try more regions if loading segments fails + +From: Benjamin Gwin + +[ Upstream commit 108aa503657ee2fe8aa071dc620d96372c252ecd ] + +It's possible that the first region picked for the new kernel will make +it impossible to fit the other segments in the required 32GB window, +especially if we have a very large initrd. + +Instead of giving up, we can keep testing other regions for the kernel +until we find one that works. + +Suggested-by: Ryan O'Leary +Signed-off-by: Benjamin Gwin +Link: https://lore.kernel.org/r/20201103201106.2397844-1-bgwin@google.com +Signed-off-by: Will Deacon +Signed-off-by: Sasha Levin +--- + arch/arm64/kernel/kexec_image.c | 41 +++++++++++++++++++------- + arch/arm64/kernel/machine_kexec_file.c | 9 +++++- + 2 files changed, 39 insertions(+), 11 deletions(-) + +diff --git a/arch/arm64/kernel/kexec_image.c b/arch/arm64/kernel/kexec_image.c +index af9987c154cab..66adee8b5fc81 100644 +--- a/arch/arm64/kernel/kexec_image.c ++++ b/arch/arm64/kernel/kexec_image.c +@@ -43,7 +43,7 @@ static void *image_load(struct kimage *image, + u64 flags, value; + bool be_image, be_kernel; + struct kexec_buf kbuf; +- unsigned long text_offset; ++ unsigned long text_offset, kernel_segment_number; + struct kexec_segment *kernel_segment; + int ret; + +@@ -88,11 +88,37 @@ static void *image_load(struct kimage *image, + /* Adjust kernel segment with TEXT_OFFSET */ + kbuf.memsz += text_offset; + +- ret = kexec_add_buffer(&kbuf); +- if (ret) ++ kernel_segment_number = image->nr_segments; ++ ++ /* ++ * The location of the kernel segment may make it impossible to satisfy ++ * the other segment requirements, so we try repeatedly to find a ++ * location that will work. ++ */ ++ while ((ret = kexec_add_buffer(&kbuf)) == 0) { ++ /* Try to load additional data */ ++ kernel_segment = &image->segment[kernel_segment_number]; ++ ret = load_other_segments(image, kernel_segment->mem, ++ kernel_segment->memsz, initrd, ++ initrd_len, cmdline); ++ if (!ret) ++ break; ++ ++ /* ++ * We couldn't find space for the other segments; erase the ++ * kernel segment and try the next available hole. ++ */ ++ image->nr_segments -= 1; ++ kbuf.buf_min = kernel_segment->mem + kernel_segment->memsz; ++ kbuf.mem = KEXEC_BUF_MEM_UNKNOWN; ++ } ++ ++ if (ret) { ++ pr_err("Could not find any suitable kernel location!"); + return ERR_PTR(ret); ++ } + +- kernel_segment = &image->segment[image->nr_segments - 1]; ++ kernel_segment = &image->segment[kernel_segment_number]; + kernel_segment->mem += text_offset; + kernel_segment->memsz -= text_offset; + image->start = kernel_segment->mem; +@@ -101,12 +127,7 @@ static void *image_load(struct kimage *image, + kernel_segment->mem, kbuf.bufsz, + kernel_segment->memsz); + +- /* Load additional data */ +- ret = load_other_segments(image, +- kernel_segment->mem, kernel_segment->memsz, +- initrd, initrd_len, cmdline); +- +- return ERR_PTR(ret); ++ return 0; + } + + #ifdef CONFIG_KEXEC_IMAGE_VERIFY_SIG +diff --git a/arch/arm64/kernel/machine_kexec_file.c b/arch/arm64/kernel/machine_kexec_file.c +index 361a1143e09ee..e443df8569881 100644 +--- a/arch/arm64/kernel/machine_kexec_file.c ++++ b/arch/arm64/kernel/machine_kexec_file.c +@@ -242,6 +242,11 @@ static int prepare_elf_headers(void **addr, unsigned long *sz) + return ret; + } + ++/* ++ * Tries to add the initrd and DTB to the image. If it is not possible to find ++ * valid locations, this function will undo changes to the image and return non ++ * zero. ++ */ + int load_other_segments(struct kimage *image, + unsigned long kernel_load_addr, + unsigned long kernel_size, +@@ -250,7 +255,8 @@ int load_other_segments(struct kimage *image, + { + struct kexec_buf kbuf; + void *headers, *dtb = NULL; +- unsigned long headers_sz, initrd_load_addr = 0, dtb_len; ++ unsigned long headers_sz, initrd_load_addr = 0, dtb_len, ++ orig_segments = image->nr_segments; + int ret = 0; + + kbuf.image = image; +@@ -336,6 +342,7 @@ int load_other_segments(struct kimage *image, + return 0; + + out_err: ++ image->nr_segments = orig_segments; + vfree(dtb); + return ret; + } +-- +2.27.0 + diff --git a/queue-5.9/asoc-cs42l51-manage-mclk-shutdown-delay.patch b/queue-5.9/asoc-cs42l51-manage-mclk-shutdown-delay.patch new file mode 100644 index 00000000000..70fff07a7c6 --- /dev/null +++ b/queue-5.9/asoc-cs42l51-manage-mclk-shutdown-delay.patch @@ -0,0 +1,63 @@ +From 343299b8ef7aa0638e6aaf4cacb6a4ab22a72c1d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 20 Oct 2020 17:01:09 +0200 +Subject: ASoC: cs42l51: manage mclk shutdown delay + +From: Olivier Moysan + +[ Upstream commit 20afe581c9b980848ad097c4d54dde9bec7593ef ] + +A delay must be introduced before the shutdown down of the mclk, +as stated in CS42L51 datasheet. Otherwise the codec may +produce some noise after the end of DAPM power down sequence. +The delay between DAC and CLOCK_SUPPLY widgets is too short. +Add a delay in mclk shutdown request to manage the shutdown delay +explicitly. From experiments, at least 10ms delay is necessary. +Set delay to 20ms as recommended in Documentation/timers/timers-howto.rst +when using msleep(). + +Signed-off-by: Olivier Moysan +Link: https://lore.kernel.org/r/20201020150109.482-1-olivier.moysan@st.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/cs42l51.c | 22 +++++++++++++++++++++- + 1 file changed, 21 insertions(+), 1 deletion(-) + +diff --git a/sound/soc/codecs/cs42l51.c b/sound/soc/codecs/cs42l51.c +index 764f2ef8f59df..2b617993b0adb 100644 +--- a/sound/soc/codecs/cs42l51.c ++++ b/sound/soc/codecs/cs42l51.c +@@ -245,8 +245,28 @@ static const struct snd_soc_dapm_widget cs42l51_dapm_widgets[] = { + &cs42l51_adcr_mux_controls), + }; + ++static int mclk_event(struct snd_soc_dapm_widget *w, ++ struct snd_kcontrol *kcontrol, int event) ++{ ++ struct snd_soc_component *comp = snd_soc_dapm_to_component(w->dapm); ++ struct cs42l51_private *cs42l51 = snd_soc_component_get_drvdata(comp); ++ ++ switch (event) { ++ case SND_SOC_DAPM_PRE_PMU: ++ return clk_prepare_enable(cs42l51->mclk_handle); ++ case SND_SOC_DAPM_POST_PMD: ++ /* Delay mclk shutdown to fulfill power-down sequence requirements */ ++ msleep(20); ++ clk_disable_unprepare(cs42l51->mclk_handle); ++ break; ++ } ++ ++ return 0; ++} ++ + static const struct snd_soc_dapm_widget cs42l51_dapm_mclk_widgets[] = { +- SND_SOC_DAPM_CLOCK_SUPPLY("MCLK") ++ SND_SOC_DAPM_SUPPLY("MCLK", SND_SOC_NOPM, 0, 0, mclk_event, ++ SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), + }; + + static const struct snd_soc_dapm_route cs42l51_routes[] = { +-- +2.27.0 + diff --git a/queue-5.9/asoc-mediatek-mt8183-da7219-fix-dapm-paths-for-rt101.patch b/queue-5.9/asoc-mediatek-mt8183-da7219-fix-dapm-paths-for-rt101.patch new file mode 100644 index 00000000000..eaf02502f47 --- /dev/null +++ b/queue-5.9/asoc-mediatek-mt8183-da7219-fix-dapm-paths-for-rt101.patch @@ -0,0 +1,68 @@ +From 9c10ef4dde874347ec05b7cb1b5cefaefe279964 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Oct 2020 12:47:24 +0800 +Subject: ASoC: mediatek: mt8183-da7219: fix DAPM paths for rt1015 + +From: Tzung-Bi Shih + +[ Upstream commit eb5a558705c7f63d06b4ddd072898b1ca894e053 ] + +RT1015's output widget name is "SPO" instead of "Speaker". Fixes it to +use the correct names. + +Signed-off-by: Tzung-Bi Shih +Link: https://lore.kernel.org/r/20201019044724.1601476-1-tzungbi@google.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + .../mediatek/mt8183/mt8183-da7219-max98357.c | 31 +++++++++++++++---- + 1 file changed, 25 insertions(+), 6 deletions(-) + +diff --git a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c +index a6c690c5308d3..58b76e985f7f3 100644 +--- a/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c ++++ b/sound/soc/mediatek/mt8183/mt8183-da7219-max98357.c +@@ -624,15 +624,34 @@ static struct snd_soc_codec_conf mt8183_da7219_rt1015_codec_conf[] = { + }, + }; + ++static const struct snd_kcontrol_new mt8183_da7219_rt1015_snd_controls[] = { ++ SOC_DAPM_PIN_SWITCH("Left Spk"), ++ SOC_DAPM_PIN_SWITCH("Right Spk"), ++}; ++ ++static const ++struct snd_soc_dapm_widget mt8183_da7219_rt1015_dapm_widgets[] = { ++ SND_SOC_DAPM_SPK("Left Spk", NULL), ++ SND_SOC_DAPM_SPK("Right Spk", NULL), ++ SND_SOC_DAPM_PINCTRL("TDM_OUT_PINCTRL", ++ "aud_tdm_out_on", "aud_tdm_out_off"), ++}; ++ ++static const struct snd_soc_dapm_route mt8183_da7219_rt1015_dapm_routes[] = { ++ {"Left Spk", NULL, "Left SPO"}, ++ {"Right Spk", NULL, "Right SPO"}, ++ {"I2S Playback", NULL, "TDM_OUT_PINCTRL"}, ++}; ++ + static struct snd_soc_card mt8183_da7219_rt1015_card = { + .name = "mt8183_da7219_rt1015", + .owner = THIS_MODULE, +- .controls = mt8183_da7219_max98357_snd_controls, +- .num_controls = ARRAY_SIZE(mt8183_da7219_max98357_snd_controls), +- .dapm_widgets = mt8183_da7219_max98357_dapm_widgets, +- .num_dapm_widgets = ARRAY_SIZE(mt8183_da7219_max98357_dapm_widgets), +- .dapm_routes = mt8183_da7219_max98357_dapm_routes, +- .num_dapm_routes = ARRAY_SIZE(mt8183_da7219_max98357_dapm_routes), ++ .controls = mt8183_da7219_rt1015_snd_controls, ++ .num_controls = ARRAY_SIZE(mt8183_da7219_rt1015_snd_controls), ++ .dapm_widgets = mt8183_da7219_rt1015_dapm_widgets, ++ .num_dapm_widgets = ARRAY_SIZE(mt8183_da7219_rt1015_dapm_widgets), ++ .dapm_routes = mt8183_da7219_rt1015_dapm_routes, ++ .num_dapm_routes = ARRAY_SIZE(mt8183_da7219_rt1015_dapm_routes), + .dai_link = mt8183_da7219_dai_links, + .num_links = ARRAY_SIZE(mt8183_da7219_dai_links), + .aux_dev = &mt8183_da7219_max98357_headset_dev, +-- +2.27.0 + diff --git a/queue-5.9/asoc-qcom-sdm845-set-driver-name-correctly.patch b/queue-5.9/asoc-qcom-sdm845-set-driver-name-correctly.patch new file mode 100644 index 00000000000..67477b149d1 --- /dev/null +++ b/queue-5.9/asoc-qcom-sdm845-set-driver-name-correctly.patch @@ -0,0 +1,75 @@ +From b42aeeb040cb44771d39aef5dd8b36cb4c42cfdd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 23 Oct 2020 10:58:49 +0100 +Subject: ASoC: qcom: sdm845: set driver name correctly + +From: Srinivas Kandagatla + +[ Upstream commit 3f48b6eba15ea342ef4cb420b580f5ed6605669f ] + +With the current state of code, we would endup with something like +below in /proc/asound/cards for 2 machines based on this driver. + +Machine 1: + 0 [DB845c ]: DB845c - DB845c + DB845c +Machine 2: + 0 [LenovoYOGAC6301]: Lenovo-YOGA-C63 - Lenovo-YOGA-C630-13Q50 + LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216 + +This is not very UCM friendly both w.r.t to common up configs and +card identification, and UCM2 became totally not usefull with just +one ucm sdm845.conf for two machines which have different setups +w.r.t HDMI and other dais. + +Reasons for such thing is partly because Qualcomm machine drivers never +cared to set driver_name. + +This patch sets up driver name for the this driver to sort out the +UCM integration issues! + +after this patch contents of /proc/asound/cards: + +Machine 1: + 0 [DB845c ]: sdm845 - DB845c + DB845c +Machine 2: + 0 [LenovoYOGAC6301]: sdm845 - Lenovo-YOGA-C630-13Q50 + LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216 + +with this its possible to align with what UCM2 expects and we can have +sdm845/DB845.conf +sdm845/LENOVO-81JL-LenovoYOGAC630_13Q50-LNVNB161216.conf +... for board variants. This should scale much better! + +Signed-off-by: Srinivas Kandagatla +Link: https://lore.kernel.org/r/20201023095849.22894-1-srinivas.kandagatla@linaro.org +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/qcom/sdm845.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/sound/soc/qcom/sdm845.c b/sound/soc/qcom/sdm845.c +index ab1bf23c21a68..6c2760e27ea6f 100644 +--- a/sound/soc/qcom/sdm845.c ++++ b/sound/soc/qcom/sdm845.c +@@ -17,6 +17,7 @@ + #include "qdsp6/q6afe.h" + #include "../codecs/rt5663.h" + ++#define DRIVER_NAME "sdm845" + #define DEFAULT_SAMPLE_RATE_48K 48000 + #define DEFAULT_MCLK_RATE 24576000 + #define TDM_BCLK_RATE 6144000 +@@ -552,6 +553,7 @@ static int sdm845_snd_platform_probe(struct platform_device *pdev) + if (!data) + return -ENOMEM; + ++ card->driver_name = DRIVER_NAME; + card->dapm_widgets = sdm845_snd_widgets; + card->num_dapm_widgets = ARRAY_SIZE(sdm845_snd_widgets); + card->dev = dev; +-- +2.27.0 + diff --git a/queue-5.9/asoc-sof-loader-handle-all-sof_ipc_ext-types.patch b/queue-5.9/asoc-sof-loader-handle-all-sof_ipc_ext-types.patch new file mode 100644 index 00000000000..f3c095ed5d5 --- /dev/null +++ b/queue-5.9/asoc-sof-loader-handle-all-sof_ipc_ext-types.patch @@ -0,0 +1,46 @@ +From 5fa00326c4bf28ad9af8a17bd3d613405f132419 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Oct 2020 21:24:19 +0300 +Subject: ASoC: SOF: loader: handle all SOF_IPC_EXT types + +From: Bard Liao + +[ Upstream commit 6e5329c6e6032cd997400b43b8299f607a61883e ] + +Do not emit a warning for extended firmware header fields that are +not used by kernel. This creates unnecessary noise to kernel logs like: + +sof-audio-pci 0000:00:1f.3: warning: unknown ext header type 3 size 0x1c +sof-audio-pci 0000:00:1f.3: warning: unknown ext header type 4 size 0x10 + +Signed-off-by: Bard Liao +Reviewed-by: Pierre-Louis Bossart +Reviewed-by: Ranjani Sridharan +Reviewed-by: Guennadi Liakhovetski +Signed-off-by: Kai Vehmanen +Link: https://lore.kernel.org/r/20201021182419.1160391-1-kai.vehmanen@linux.intel.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/sof/loader.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/sound/soc/sof/loader.c b/sound/soc/sof/loader.c +index b94fa5f5d4808..c90c3f3a3b3ee 100644 +--- a/sound/soc/sof/loader.c ++++ b/sound/soc/sof/loader.c +@@ -118,6 +118,11 @@ int snd_sof_fw_parse_ext_data(struct snd_sof_dev *sdev, u32 bar, u32 offset) + case SOF_IPC_EXT_CC_INFO: + ret = get_cc_info(sdev, ext_hdr); + break; ++ case SOF_IPC_EXT_UNUSED: ++ case SOF_IPC_EXT_PROBE_INFO: ++ case SOF_IPC_EXT_USER_ABI_INFO: ++ /* They are supported but we don't do anything here */ ++ break; + default: + dev_warn(sdev->dev, "warning: unknown ext header type %d size 0x%x\n", + ext_hdr->type, ext_hdr->hdr.size); +-- +2.27.0 + diff --git a/queue-5.9/cfg80211-initialize-wdev-data-earlier.patch b/queue-5.9/cfg80211-initialize-wdev-data-earlier.patch new file mode 100644 index 00000000000..f52b5634151 --- /dev/null +++ b/queue-5.9/cfg80211-initialize-wdev-data-earlier.patch @@ -0,0 +1,164 @@ +From 1b2395def3462663ffa4457aa9469f6f98bfc1d1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 13:58:22 +0200 +Subject: cfg80211: initialize wdev data earlier + +From: Johannes Berg + +[ Upstream commit 9bdaf3b91efd229dd272b228e13df10310c80d19 ] + +There's a race condition in the netdev registration in that +NETDEV_REGISTER actually happens after the netdev is available, +and so if we initialize things only there, we might get called +with an uninitialized wdev through nl80211 - not using a wdev +but using a netdev interface index. + +I found this while looking into a syzbot report, but it doesn't +really seem to be related, and unfortunately there's no repro +for it (yet). I can't (yet) explain how it managed to get into +cfg80211_release_pmsr() from nl80211_netlink_notify() without +the wdev having been initialized, as the latter only iterates +the wdevs that are linked into the rdev, which even without the +change here happened after init. + +However, looking at this, it seems fairly clear that the init +needs to be done earlier, otherwise we might even re-init on a +netns move, when data might still be pending. + +Signed-off-by: Johannes Berg +Link: https://lore.kernel.org/r/20201009135821.fdcbba3aad65.Ie9201d91dbcb7da32318812effdc1561aeaf4cdc@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/core.c | 57 +++++++++++++++++++++++------------------- + net/wireless/core.h | 5 ++-- + net/wireless/nl80211.c | 3 ++- + 3 files changed, 36 insertions(+), 29 deletions(-) + +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 354b0ccbdc240..e025493171262 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -1248,8 +1248,7 @@ void cfg80211_stop_iface(struct wiphy *wiphy, struct wireless_dev *wdev, + } + EXPORT_SYMBOL(cfg80211_stop_iface); + +-void cfg80211_init_wdev(struct cfg80211_registered_device *rdev, +- struct wireless_dev *wdev) ++void cfg80211_init_wdev(struct wireless_dev *wdev) + { + mutex_init(&wdev->mtx); + INIT_LIST_HEAD(&wdev->event_list); +@@ -1260,6 +1259,30 @@ void cfg80211_init_wdev(struct cfg80211_registered_device *rdev, + spin_lock_init(&wdev->pmsr_lock); + INIT_WORK(&wdev->pmsr_free_wk, cfg80211_pmsr_free_wk); + ++#ifdef CONFIG_CFG80211_WEXT ++ wdev->wext.default_key = -1; ++ wdev->wext.default_mgmt_key = -1; ++ wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; ++#endif ++ ++ if (wdev->wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT) ++ wdev->ps = true; ++ else ++ wdev->ps = false; ++ /* allow mac80211 to determine the timeout */ ++ wdev->ps_timeout = -1; ++ ++ if ((wdev->iftype == NL80211_IFTYPE_STATION || ++ wdev->iftype == NL80211_IFTYPE_P2P_CLIENT || ++ wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr) ++ wdev->netdev->priv_flags |= IFF_DONT_BRIDGE; ++ ++ INIT_WORK(&wdev->disconnect_wk, cfg80211_autodisconnect_wk); ++} ++ ++void cfg80211_register_wdev(struct cfg80211_registered_device *rdev, ++ struct wireless_dev *wdev) ++{ + /* + * We get here also when the interface changes network namespaces, + * as it's registered into the new one, but we don't want it to +@@ -1293,6 +1316,11 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb, + switch (state) { + case NETDEV_POST_INIT: + SET_NETDEV_DEVTYPE(dev, &wiphy_type); ++ wdev->netdev = dev; ++ /* can only change netns with wiphy */ ++ dev->features |= NETIF_F_NETNS_LOCAL; ++ ++ cfg80211_init_wdev(wdev); + break; + case NETDEV_REGISTER: + /* +@@ -1300,35 +1328,12 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb, + * called within code protected by it when interfaces + * are added with nl80211. + */ +- /* can only change netns with wiphy */ +- dev->features |= NETIF_F_NETNS_LOCAL; +- + if (sysfs_create_link(&dev->dev.kobj, &rdev->wiphy.dev.kobj, + "phy80211")) { + pr_err("failed to add phy80211 symlink to netdev!\n"); + } +- wdev->netdev = dev; +-#ifdef CONFIG_CFG80211_WEXT +- wdev->wext.default_key = -1; +- wdev->wext.default_mgmt_key = -1; +- wdev->wext.connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC; +-#endif +- +- if (wdev->wiphy->flags & WIPHY_FLAG_PS_ON_BY_DEFAULT) +- wdev->ps = true; +- else +- wdev->ps = false; +- /* allow mac80211 to determine the timeout */ +- wdev->ps_timeout = -1; +- +- if ((wdev->iftype == NL80211_IFTYPE_STATION || +- wdev->iftype == NL80211_IFTYPE_P2P_CLIENT || +- wdev->iftype == NL80211_IFTYPE_ADHOC) && !wdev->use_4addr) +- dev->priv_flags |= IFF_DONT_BRIDGE; +- +- INIT_WORK(&wdev->disconnect_wk, cfg80211_autodisconnect_wk); + +- cfg80211_init_wdev(rdev, wdev); ++ cfg80211_register_wdev(rdev, wdev); + break; + case NETDEV_GOING_DOWN: + cfg80211_leave(rdev, wdev); +diff --git a/net/wireless/core.h b/net/wireless/core.h +index 67b0389fca4dc..8cd4a9793298e 100644 +--- a/net/wireless/core.h ++++ b/net/wireless/core.h +@@ -208,8 +208,9 @@ struct wiphy *wiphy_idx_to_wiphy(int wiphy_idx); + int cfg80211_switch_netns(struct cfg80211_registered_device *rdev, + struct net *net); + +-void cfg80211_init_wdev(struct cfg80211_registered_device *rdev, +- struct wireless_dev *wdev); ++void cfg80211_init_wdev(struct wireless_dev *wdev); ++void cfg80211_register_wdev(struct cfg80211_registered_device *rdev, ++ struct wireless_dev *wdev); + + static inline void wdev_lock(struct wireless_dev *wdev) + __acquires(wdev) +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index e14307f2bddcc..8eb43c47e582a 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -3801,7 +3801,8 @@ static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info) + * P2P Device and NAN do not have a netdev, so don't go + * through the netdev notifier and must be added here + */ +- cfg80211_init_wdev(rdev, wdev); ++ cfg80211_init_wdev(wdev); ++ cfg80211_register_wdev(rdev, wdev); + break; + default: + break; +-- +2.27.0 + diff --git a/queue-5.9/cfg80211-regulatory-fix-inconsistent-format-argument.patch b/queue-5.9/cfg80211-regulatory-fix-inconsistent-format-argument.patch new file mode 100644 index 00000000000..4276f0f69e4 --- /dev/null +++ b/queue-5.9/cfg80211-regulatory-fix-inconsistent-format-argument.patch @@ -0,0 +1,38 @@ +From 599ecb6156d8c0c269227e8afd0421182bb0152e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 15:02:15 +0800 +Subject: cfg80211: regulatory: Fix inconsistent format argument + +From: Ye Bin + +[ Upstream commit db18d20d1cb0fde16d518fb5ccd38679f174bc04 ] + +Fix follow warning: +[net/wireless/reg.c:3619]: (warning) %d in format string (no. 2) +requires 'int' but the argument type is 'unsigned int'. + +Reported-by: Hulk Robot +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20201009070215.63695-1-yebin10@huawei.com +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/wireless/reg.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/wireless/reg.c b/net/wireless/reg.c +index d8a90d3974235..763a45655ac21 100644 +--- a/net/wireless/reg.c ++++ b/net/wireless/reg.c +@@ -3411,7 +3411,7 @@ static void print_rd_rules(const struct ieee80211_regdomain *rd) + power_rule = ®_rule->power_rule; + + if (reg_rule->flags & NL80211_RRF_AUTO_BW) +- snprintf(bw, sizeof(bw), "%d KHz, %d KHz AUTO", ++ snprintf(bw, sizeof(bw), "%d KHz, %u KHz AUTO", + freq_range->max_bandwidth_khz, + reg_get_max_bandwidth(rd, reg_rule)); + else +-- +2.27.0 + diff --git a/queue-5.9/drm-amd-pm-correct-the-baco-reset-sequence-for-ci-as.patch b/queue-5.9/drm-amd-pm-correct-the-baco-reset-sequence-for-ci-as.patch new file mode 100644 index 00000000000..22f39ba1989 --- /dev/null +++ b/queue-5.9/drm-amd-pm-correct-the-baco-reset-sequence-for-ci-as.patch @@ -0,0 +1,52 @@ +From 5cadea7d848bc25afbf066c736d963ff148715ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 15:34:29 +0800 +Subject: drm/amd/pm: correct the baco reset sequence for CI ASICs + +From: Evan Quan + +[ Upstream commit c108725ef589af462be6b957f63c7925e38213eb ] + +Correct some registers bitmasks and add mmBIOS_SCRATCH_7 +reset. + +Signed-off-by: Evan Quan +Tested-by: Sandeep Raghuraman +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c b/drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c +index 3be40114e63d2..45f608838f6eb 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/ci_baco.c +@@ -142,12 +142,12 @@ static const struct baco_cmd_entry exit_baco_tbl[] = + { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_BCLK_OFF_MASK, BACO_CNTL__BACO_BCLK_OFF__SHIFT, 0, 0x00 }, + { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_POWER_OFF_MASK, BACO_CNTL__BACO_POWER_OFF__SHIFT, 0, 0x00 }, + { CMD_DELAY_MS, 0, 0, 0, 20, 0 }, +- { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_BF_MASK, 0, 0xffffffff, 0x20 }, ++ { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_BF_MASK, 0, 0xffffffff, 0x200 }, + { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_ISO_DIS_MASK, BACO_CNTL__BACO_ISO_DIS__SHIFT, 0, 0x01 }, +- { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_MASK, 0, 5, 0x1c }, ++ { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__PWRGOOD_MASK, 0, 5, 0x1c00 }, + { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_ANA_ISO_DIS_MASK, BACO_CNTL__BACO_ANA_ISO_DIS__SHIFT, 0, 0x01 }, + { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_RESET_EN_MASK, BACO_CNTL__BACO_RESET_EN__SHIFT, 0, 0x00 }, +- { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__RCU_BIF_CONFIG_DONE_MASK, 0, 5, 0x10 }, ++ { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__RCU_BIF_CONFIG_DONE_MASK, 0, 5, 0x100 }, + { CMD_READMODIFYWRITE, mmBACO_CNTL, BACO_CNTL__BACO_EN_MASK, BACO_CNTL__BACO_EN__SHIFT, 0, 0x00 }, + { CMD_WAITFOR, mmBACO_CNTL, BACO_CNTL__BACO_MODE_MASK, 0, 0xffffffff, 0x00 } + }; +@@ -155,6 +155,7 @@ static const struct baco_cmd_entry exit_baco_tbl[] = + static const struct baco_cmd_entry clean_baco_tbl[] = + { + { CMD_WRITE, mmBIOS_SCRATCH_6, 0, 0, 0, 0 }, ++ { CMD_WRITE, mmBIOS_SCRATCH_7, 0, 0, 0, 0 }, + { CMD_WRITE, mmCP_PFP_UCODE_ADDR, 0, 0, 0, 0 } + }; + +-- +2.27.0 + diff --git a/queue-5.9/drm-amd-pm-do-not-use-ixfeature_status-for-checking-.patch b/queue-5.9/drm-amd-pm-do-not-use-ixfeature_status-for-checking-.patch new file mode 100644 index 00000000000..a9eb552d6f7 --- /dev/null +++ b/queue-5.9/drm-amd-pm-do-not-use-ixfeature_status-for-checking-.patch @@ -0,0 +1,44 @@ +From db9d866179553f0386e8311bd5123e70da37e97d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 10:24:18 +0800 +Subject: drm/amd/pm: do not use ixFEATURE_STATUS for checking smc running + +From: Evan Quan + +[ Upstream commit 786436b453001dafe81025389f96bf9dac1e9690 ] + +This reverts commit f87812284172a9809820d10143b573d833cd3f75 ("drm/amdgpu: +Fix bug where DPM is not enabled after hibernate and resume"). +It was intended to fix Hawaii S4(hibernation) issue but break S3. As +ixFEATURE_STATUS is filled with garbage data on resume which can be +only cleared by reloading smc firmware(but that will involve many +changes). So, we will revert this S4 fix and seek a new way. + +Signed-off-by: Evan Quan +Tested-by: Sandeep Raghuraman +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +index 09128122b4932..329bf4d44bbce 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +@@ -2726,10 +2726,7 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr *hwmgr) + + static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr) + { +- return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device, +- CGS_IND_REG__SMC, FEATURE_STATUS, +- VOLTAGE_CONTROLLER_ON)) +- ? true : false; ++ return ci_is_smc_ram_running(hwmgr); + } + + static int ci_smu_init(struct pp_hwmgr *hwmgr) +-- +2.27.0 + diff --git a/queue-5.9/drm-amd-pm-perform-smc-reset-on-suspend-hibernation.patch b/queue-5.9/drm-amd-pm-perform-smc-reset-on-suspend-hibernation.patch new file mode 100644 index 00000000000..97103cd2246 --- /dev/null +++ b/queue-5.9/drm-amd-pm-perform-smc-reset-on-suspend-hibernation.patch @@ -0,0 +1,122 @@ +From a5c204b1e398d925745791dac2b8fea47f38f6c4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Oct 2020 10:45:26 +0800 +Subject: drm/amd/pm: perform SMC reset on suspend/hibernation + +From: Evan Quan + +[ Upstream commit 277b080f98803cb73a83fb234f0be83a10e63958 ] + +So that the succeeding resume can be performed based on +a clean state. + +Signed-off-by: Evan Quan +Tested-by: Sandeep Raghuraman +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + .../gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c | 4 ++++ + drivers/gpu/drm/amd/powerplay/inc/hwmgr.h | 1 + + drivers/gpu/drm/amd/powerplay/inc/smumgr.h | 2 ++ + .../gpu/drm/amd/powerplay/smumgr/ci_smumgr.c | 24 +++++++++++++++++++ + drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c | 8 +++++++ + 5 files changed, 39 insertions(+) + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +index fc63d9e32e1f8..c8ee931075e52 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +@@ -1541,6 +1541,10 @@ static int smu7_disable_dpm_tasks(struct pp_hwmgr *hwmgr) + PP_ASSERT_WITH_CODE((tmp_result == 0), + "Failed to reset to default!", result = tmp_result); + ++ tmp_result = smum_stop_smc(hwmgr); ++ PP_ASSERT_WITH_CODE((tmp_result == 0), ++ "Failed to stop smc!", result = tmp_result); ++ + tmp_result = smu7_force_switch_to_arbf0(hwmgr); + PP_ASSERT_WITH_CODE((tmp_result == 0), + "Failed to force to switch arbf0!", result = tmp_result); +diff --git a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h +index 15ed6cbdf3660..91cdc53472f01 100644 +--- a/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h ++++ b/drivers/gpu/drm/amd/powerplay/inc/hwmgr.h +@@ -229,6 +229,7 @@ struct pp_smumgr_func { + bool (*is_hw_avfs_present)(struct pp_hwmgr *hwmgr); + int (*update_dpm_settings)(struct pp_hwmgr *hwmgr, void *profile_setting); + int (*smc_table_manager)(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t table_id, bool rw); /*rw: true for read, false for write */ ++ int (*stop_smc)(struct pp_hwmgr *hwmgr); + }; + + struct pp_hwmgr_func { +diff --git a/drivers/gpu/drm/amd/powerplay/inc/smumgr.h b/drivers/gpu/drm/amd/powerplay/inc/smumgr.h +index ad100b533d049..5f46f1a4f38ef 100644 +--- a/drivers/gpu/drm/amd/powerplay/inc/smumgr.h ++++ b/drivers/gpu/drm/amd/powerplay/inc/smumgr.h +@@ -113,4 +113,6 @@ extern int smum_update_dpm_settings(struct pp_hwmgr *hwmgr, void *profile_settin + + extern int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t table_id, bool rw); + ++extern int smum_stop_smc(struct pp_hwmgr *hwmgr); ++ + #endif +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +index e4d1f3d66ef48..09128122b4932 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c +@@ -2939,6 +2939,29 @@ static int ci_update_smc_table(struct pp_hwmgr *hwmgr, uint32_t type) + return 0; + } + ++static void ci_reset_smc(struct pp_hwmgr *hwmgr) ++{ ++ PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC, ++ SMC_SYSCON_RESET_CNTL, ++ rst_reg, 1); ++} ++ ++ ++static void ci_stop_smc_clock(struct pp_hwmgr *hwmgr) ++{ ++ PHM_WRITE_INDIRECT_FIELD(hwmgr->device, CGS_IND_REG__SMC, ++ SMC_SYSCON_CLOCK_CNTL_0, ++ ck_disable, 1); ++} ++ ++static int ci_stop_smc(struct pp_hwmgr *hwmgr) ++{ ++ ci_reset_smc(hwmgr); ++ ci_stop_smc_clock(hwmgr); ++ ++ return 0; ++} ++ + const struct pp_smumgr_func ci_smu_funcs = { + .name = "ci_smu", + .smu_init = ci_smu_init, +@@ -2964,4 +2987,5 @@ const struct pp_smumgr_func ci_smu_funcs = { + .is_dpm_running = ci_is_dpm_running, + .update_dpm_settings = ci_update_dpm_settings, + .update_smc_table = ci_update_smc_table, ++ .stop_smc = ci_stop_smc, + }; +diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c +index b6fb480668416..b6921db3c1305 100644 +--- a/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c ++++ b/drivers/gpu/drm/amd/powerplay/smumgr/smumgr.c +@@ -245,3 +245,11 @@ int smum_smc_table_manager(struct pp_hwmgr *hwmgr, uint8_t *table, uint16_t tabl + + return -EINVAL; + } ++ ++int smum_stop_smc(struct pp_hwmgr *hwmgr) ++{ ++ if (hwmgr->smumgr_funcs->stop_smc) ++ return hwmgr->smumgr_funcs->stop_smc(hwmgr); ++ ++ return 0; ++} +-- +2.27.0 + diff --git a/queue-5.9/drm-amdgpu-perform-srbm-soft-reset-always-on-sdma-re.patch b/queue-5.9/drm-amdgpu-perform-srbm-soft-reset-always-on-sdma-re.patch new file mode 100644 index 00000000000..9256b289ebb --- /dev/null +++ b/queue-5.9/drm-amdgpu-perform-srbm-soft-reset-always-on-sdma-re.patch @@ -0,0 +1,63 @@ +From 425607224445908732ca6824e4dbab92a20d42ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 15:29:59 +0800 +Subject: drm/amdgpu: perform srbm soft reset always on SDMA resume + +From: Evan Quan + +[ Upstream commit 253475c455eb5f8da34faa1af92709e7bb414624 ] + +This can address the random SDMA hang after pci config reset +seen on Hawaii. + +Signed-off-by: Evan Quan +Tested-by: Sandeep Raghuraman +Reviewed-by: Alex Deucher +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/cik_sdma.c | 27 ++++++++++++--------------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c +index 20f108818b2b9..a3c3fe96515f2 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c +@@ -1071,22 +1071,19 @@ static int cik_sdma_soft_reset(void *handle) + { + u32 srbm_soft_reset = 0; + struct amdgpu_device *adev = (struct amdgpu_device *)handle; +- u32 tmp = RREG32(mmSRBM_STATUS2); ++ u32 tmp; + +- if (tmp & SRBM_STATUS2__SDMA_BUSY_MASK) { +- /* sdma0 */ +- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET); +- tmp |= SDMA0_F32_CNTL__HALT_MASK; +- WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp); +- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK; +- } +- if (tmp & SRBM_STATUS2__SDMA1_BUSY_MASK) { +- /* sdma1 */ +- tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET); +- tmp |= SDMA0_F32_CNTL__HALT_MASK; +- WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp); +- srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK; +- } ++ /* sdma0 */ ++ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET); ++ tmp |= SDMA0_F32_CNTL__HALT_MASK; ++ WREG32(mmSDMA0_F32_CNTL + SDMA0_REGISTER_OFFSET, tmp); ++ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA_MASK; ++ ++ /* sdma1 */ ++ tmp = RREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET); ++ tmp |= SDMA0_F32_CNTL__HALT_MASK; ++ WREG32(mmSDMA0_F32_CNTL + SDMA1_REGISTER_OFFSET, tmp); ++ srbm_soft_reset |= SRBM_SOFT_RESET__SOFT_RESET_SDMA1_MASK; + + if (srbm_soft_reset) { + tmp = RREG32(mmSRBM_SOFT_RESET); +-- +2.27.0 + diff --git a/queue-5.9/gfs2-add-missing-truncate_inode_pages_final-for-sd_a.patch b/queue-5.9/gfs2-add-missing-truncate_inode_pages_final-for-sd_a.patch new file mode 100644 index 00000000000..c3f0fe1c2cb --- /dev/null +++ b/queue-5.9/gfs2-add-missing-truncate_inode_pages_final-for-sd_a.patch @@ -0,0 +1,39 @@ +From 43a11325435ce9909491e1031c4fd6d1f5f29a7d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 10:10:02 -0500 +Subject: gfs2: Add missing truncate_inode_pages_final for sd_aspace + +From: Bob Peterson + +[ Upstream commit a9dd945ccef07a904e412f208f8de708a3d7159e ] + +Gfs2 creates an address space for its rgrps called sd_aspace, but it never +called truncate_inode_pages_final on it. This confused vfs greatly which +tried to reference the address space after gfs2 had freed the superblock +that contained it. + +This patch adds a call to truncate_inode_pages_final for sd_aspace, thus +avoiding the use-after-free. + +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/super.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c +index 32ae1a7cdaed8..831f6e31d6821 100644 +--- a/fs/gfs2/super.c ++++ b/fs/gfs2/super.c +@@ -732,6 +732,7 @@ restart: + gfs2_jindex_free(sdp); + /* Take apart glock structures and buffer lists */ + gfs2_gl_hash_clear(sdp); ++ truncate_inode_pages_final(&sdp->sd_aspace); + gfs2_delete_debugfs_file(sdp); + /* Unmount the locking protocol */ + gfs2_lm_unmount(sdp); +-- +2.27.0 + diff --git a/queue-5.9/gfs2-check-for-live-vs.-read-only-file-system-in-gfs.patch b/queue-5.9/gfs2-check-for-live-vs.-read-only-file-system-in-gfs.patch new file mode 100644 index 00000000000..2df988a1534 --- /dev/null +++ b/queue-5.9/gfs2-check-for-live-vs.-read-only-file-system-in-gfs.patch @@ -0,0 +1,49 @@ +From e37895752ed08f8d8901267c40d9426908ecaecf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 13:42:18 -0500 +Subject: gfs2: check for live vs. read-only file system in gfs2_fitrim + +From: Bob Peterson + +[ Upstream commit c5c68724696e7d2f8db58a5fce3673208d35c485 ] + +Before this patch, gfs2_fitrim was not properly checking for a "live" file +system. If the file system had something to trim and the file system +was read-only (or spectator) it would start the trim, but when it starts +the transaction, gfs2_trans_begin returns -EROFS (read-only file system) +and it errors out. However, if the file system was already trimmed so +there's no work to do, it never called gfs2_trans_begin. That code is +bypassed so it never returns the error. Instead, it returns a good +return code with 0 work. All this makes for inconsistent behavior: +The same fstrim command can return -EROFS in one case and 0 in another. +This tripped up xfstests generic/537 which reports the error as: + + +fstrim with unrecovered metadata just ate your filesystem + +This patch adds a check for a "live" (iow, active journal, iow, RW) +file system, and if not, returns the error properly. + +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/rgrp.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 1d65db1b3914a..ac306895bbbcc 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -1374,6 +1374,9 @@ int gfs2_fitrim(struct file *filp, void __user *argp) + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + ++ if (!test_bit(SDF_JOURNAL_LIVE, &sdp->sd_flags)) ++ return -EROFS; ++ + if (!blk_queue_discard(q)) + return -EOPNOTSUPP; + +-- +2.27.0 + diff --git a/queue-5.9/gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch b/queue-5.9/gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch new file mode 100644 index 00000000000..64883c658e2 --- /dev/null +++ b/queue-5.9/gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch @@ -0,0 +1,39 @@ +From 518e6dbc2f87363e6e4029d8fc482e25697b60de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 10:10:01 -0500 +Subject: gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix use-after-free + +From: Bob Peterson + +[ Upstream commit d0f17d3883f1e3f085d38572c2ea8edbd5150172 ] + +Function gfs2_clear_rgrpd calls kfree(rgd->rd_bits) before calling +return_all_reservations, but return_all_reservations still dereferences +rgd->rd_bits in __rs_deltree. Fix that by moving the call to kfree below the +call to return_all_reservations. + +Signed-off-by: Bob Peterson +Signed-off-by: Andreas Gruenbacher +Signed-off-by: Sasha Levin +--- + fs/gfs2/rgrp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 1bba5a9d45fa3..1d65db1b3914a 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -719,9 +719,9 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) + } + + gfs2_free_clones(rgd); ++ return_all_reservations(rgd); + kfree(rgd->rd_bits); + rgd->rd_bits = NULL; +- return_all_reservations(rgd); + kmem_cache_free(gfs2_rgrpd_cachep, rgd); + } + } +-- +2.27.0 + diff --git a/queue-5.9/i2c-designware-call-i2c_dw_read_clear_intrbits_slave.patch b/queue-5.9/i2c-designware-call-i2c_dw_read_clear_intrbits_slave.patch new file mode 100644 index 00000000000..ba7899c3a90 --- /dev/null +++ b/queue-5.9/i2c-designware-call-i2c_dw_read_clear_intrbits_slave.patch @@ -0,0 +1,84 @@ +From ee2c868f29ea65c901b0e0e7caa1fcc9e7bf8d1f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 16:04:19 +0800 +Subject: i2c: designware: call i2c_dw_read_clear_intrbits_slave() once + +From: Michael Wu + +[ Upstream commit 66b92313e2ca9208b5f3ebf5d86e9a818299d8fa ] + +If some bits were cleared by i2c_dw_read_clear_intrbits_slave() in +i2c_dw_isr_slave() and not handled immediately, those cleared bits would +not be shown again by later i2c_dw_read_clear_intrbits_slave(). They +therefore were forgotten to be handled. + +i2c_dw_read_clear_intrbits_slave() should be called once in an ISR and take +its returned state for all later handlings. + +Signed-off-by: Michael Wu +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-slave.c | 7 +------ + 1 file changed, 1 insertion(+), 6 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c +index 44974b53a6268..13de01a0f75f0 100644 +--- a/drivers/i2c/busses/i2c-designware-slave.c ++++ b/drivers/i2c/busses/i2c-designware-slave.c +@@ -159,7 +159,6 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev) + u32 raw_stat, stat, enabled, tmp; + u8 val = 0, slave_activity; + +- regmap_read(dev->map, DW_IC_INTR_STAT, &stat); + regmap_read(dev->map, DW_IC_ENABLE, &enabled); + regmap_read(dev->map, DW_IC_RAW_INTR_STAT, &raw_stat); + regmap_read(dev->map, DW_IC_STATUS, &tmp); +@@ -168,6 +167,7 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev) + if (!enabled || !(raw_stat & ~DW_IC_INTR_ACTIVITY) || !dev->slave) + return 0; + ++ stat = i2c_dw_read_clear_intrbits_slave(dev); + dev_dbg(dev->dev, + "%#x STATUS SLAVE_ACTIVITY=%#x : RAW_INTR_STAT=%#x : INTR_STAT=%#x\n", + enabled, slave_activity, raw_stat, stat); +@@ -188,11 +188,9 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev) + val); + } + regmap_read(dev->map, DW_IC_CLR_RD_REQ, &tmp); +- stat = i2c_dw_read_clear_intrbits_slave(dev); + } else { + regmap_read(dev->map, DW_IC_CLR_RD_REQ, &tmp); + regmap_read(dev->map, DW_IC_CLR_RX_UNDER, &tmp); +- stat = i2c_dw_read_clear_intrbits_slave(dev); + } + if (!i2c_slave_event(dev->slave, + I2C_SLAVE_READ_REQUESTED, +@@ -207,7 +205,6 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev) + regmap_read(dev->map, DW_IC_CLR_RX_DONE, &tmp); + + i2c_slave_event(dev->slave, I2C_SLAVE_STOP, &val); +- stat = i2c_dw_read_clear_intrbits_slave(dev); + return 1; + } + +@@ -219,7 +216,6 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev) + dev_vdbg(dev->dev, "Byte %X acked!", val); + } else { + i2c_slave_event(dev->slave, I2C_SLAVE_STOP, &val); +- stat = i2c_dw_read_clear_intrbits_slave(dev); + } + + return 1; +@@ -230,7 +226,6 @@ static irqreturn_t i2c_dw_isr_slave(int this_irq, void *dev_id) + struct dw_i2c_dev *dev = dev_id; + int ret; + +- i2c_dw_read_clear_intrbits_slave(dev); + ret = i2c_dw_irq_handler_slave(dev); + if (ret > 0) + complete(&dev->cmd_complete); +-- +2.27.0 + diff --git a/queue-5.9/i2c-designware-slave-should-do-write_requested-befor.patch b/queue-5.9/i2c-designware-slave-should-do-write_requested-befor.patch new file mode 100644 index 00000000000..0269630ebe3 --- /dev/null +++ b/queue-5.9/i2c-designware-slave-should-do-write_requested-befor.patch @@ -0,0 +1,111 @@ +From 1cee90a40bb26ca9e46830c2b617b655d3c9bc85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 16:04:20 +0800 +Subject: i2c: designware: slave should do WRITE_REQUESTED before + WRITE_RECEIVED + +From: Michael Wu + +[ Upstream commit 3b5f7f10ff6e6b66f553e12cc50d9bb751ce60ad ] + +Sometimes we would get the following flow when doing an i2cset: + +0x1 STATUS SLAVE_ACTIVITY=0x1 : RAW_INTR_STAT=0x514 : INTR_STAT=0x4 +I2C_SLAVE_WRITE_RECEIVED +0x1 STATUS SLAVE_ACTIVITY=0x0 : RAW_INTR_STAT=0x714 : INTR_STAT=0x204 +I2C_SLAVE_WRITE_REQUESTED +I2C_SLAVE_WRITE_RECEIVED + +Documentation/i2c/slave-interface.rst says that I2C_SLAVE_WRITE_REQUESTED, +which is mandatory, should be sent while the data did not arrive yet. It +means in a write-request I2C_SLAVE_WRITE_REQUESTED should be reported +before any I2C_SLAVE_WRITE_RECEIVED. + +By the way, I2C_SLAVE_STOP didn't be reported in the above case because +DW_IC_INTR_STAT was not 0x200. + +dev->status can be used to record the current state, especially Designware +I2C controller has no interrupts to identify a write-request. This patch +makes not only I2C_SLAVE_WRITE_REQUESTED been reported first when +IC_INTR_RX_FULL is rising and dev->status isn't STATUS_WRITE_IN_PROGRESS +but also I2C_SLAVE_STOP been reported when a STOP condition is received. + +Signed-off-by: Michael Wu +Acked-by: Jarkko Nikula +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-designware-slave.c | 45 +++++++++-------------- + 1 file changed, 18 insertions(+), 27 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c +index 13de01a0f75f0..0d15f4c1e9f7e 100644 +--- a/drivers/i2c/busses/i2c-designware-slave.c ++++ b/drivers/i2c/busses/i2c-designware-slave.c +@@ -172,26 +172,25 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev) + "%#x STATUS SLAVE_ACTIVITY=%#x : RAW_INTR_STAT=%#x : INTR_STAT=%#x\n", + enabled, slave_activity, raw_stat, stat); + +- if ((stat & DW_IC_INTR_RX_FULL) && (stat & DW_IC_INTR_STOP_DET)) +- i2c_slave_event(dev->slave, I2C_SLAVE_WRITE_REQUESTED, &val); ++ if (stat & DW_IC_INTR_RX_FULL) { ++ if (dev->status != STATUS_WRITE_IN_PROGRESS) { ++ dev->status = STATUS_WRITE_IN_PROGRESS; ++ i2c_slave_event(dev->slave, I2C_SLAVE_WRITE_REQUESTED, ++ &val); ++ } ++ ++ regmap_read(dev->map, DW_IC_DATA_CMD, &tmp); ++ val = tmp; ++ if (!i2c_slave_event(dev->slave, I2C_SLAVE_WRITE_RECEIVED, ++ &val)) ++ dev_vdbg(dev->dev, "Byte %X acked!", val); ++ } + + if (stat & DW_IC_INTR_RD_REQ) { + if (slave_activity) { +- if (stat & DW_IC_INTR_RX_FULL) { +- regmap_read(dev->map, DW_IC_DATA_CMD, &tmp); +- val = tmp; +- +- if (!i2c_slave_event(dev->slave, +- I2C_SLAVE_WRITE_RECEIVED, +- &val)) { +- dev_vdbg(dev->dev, "Byte %X acked!", +- val); +- } +- regmap_read(dev->map, DW_IC_CLR_RD_REQ, &tmp); +- } else { +- regmap_read(dev->map, DW_IC_CLR_RD_REQ, &tmp); +- regmap_read(dev->map, DW_IC_CLR_RX_UNDER, &tmp); +- } ++ regmap_read(dev->map, DW_IC_CLR_RD_REQ, &tmp); ++ ++ dev->status = STATUS_READ_IN_PROGRESS; + if (!i2c_slave_event(dev->slave, + I2C_SLAVE_READ_REQUESTED, + &val)) +@@ -203,18 +202,10 @@ static int i2c_dw_irq_handler_slave(struct dw_i2c_dev *dev) + if (!i2c_slave_event(dev->slave, I2C_SLAVE_READ_PROCESSED, + &val)) + regmap_read(dev->map, DW_IC_CLR_RX_DONE, &tmp); +- +- i2c_slave_event(dev->slave, I2C_SLAVE_STOP, &val); +- return 1; + } + +- if (stat & DW_IC_INTR_RX_FULL) { +- regmap_read(dev->map, DW_IC_DATA_CMD, &tmp); +- val = tmp; +- if (!i2c_slave_event(dev->slave, I2C_SLAVE_WRITE_RECEIVED, +- &val)) +- dev_vdbg(dev->dev, "Byte %X acked!", val); +- } else { ++ if (stat & DW_IC_INTR_STOP_DET) { ++ dev->status = STATUS_IDLE; + i2c_slave_event(dev->slave, I2C_SLAVE_STOP, &val); + } + +-- +2.27.0 + diff --git a/queue-5.9/i2c-mediatek-move-dma-reset-before-i2c-reset.patch b/queue-5.9/i2c-mediatek-move-dma-reset-before-i2c-reset.patch new file mode 100644 index 00000000000..571a3600d39 --- /dev/null +++ b/queue-5.9/i2c-mediatek-move-dma-reset-before-i2c-reset.patch @@ -0,0 +1,50 @@ +From 7f3c26999d98e00f80c0c7af2c277976dcbdf622 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 19:58:01 +0800 +Subject: i2c: mediatek: move dma reset before i2c reset + +From: Qii Wang + +[ Upstream commit aafced673c06b7c77040c1df42e2e965be5d0376 ] + +The i2c driver default do dma reset after i2c reset, but sometimes +i2c reset will trigger dma tx2rx, then apdma write data to dram +which has been i2c_put_dma_safe_msg_buf(kfree). Move dma reset +before i2c reset in mtk_i2c_init_hw to fix it. + +Signed-off-by: Qii Wang +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-mt65xx.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-mt65xx.c b/drivers/i2c/busses/i2c-mt65xx.c +index 0cbdfbe605b55..33de99b7bc20c 100644 +--- a/drivers/i2c/busses/i2c-mt65xx.c ++++ b/drivers/i2c/busses/i2c-mt65xx.c +@@ -475,6 +475,10 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c) + { + u16 control_reg; + ++ writel(I2C_DMA_HARD_RST, i2c->pdmabase + OFFSET_RST); ++ udelay(50); ++ writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_RST); ++ + mtk_i2c_writew(i2c, I2C_SOFT_RST, OFFSET_SOFTRESET); + + /* Set ioconfig */ +@@ -529,10 +533,6 @@ static void mtk_i2c_init_hw(struct mtk_i2c *i2c) + + mtk_i2c_writew(i2c, control_reg, OFFSET_CONTROL); + mtk_i2c_writew(i2c, I2C_DELAY_LEN, OFFSET_DELAY_LEN); +- +- writel(I2C_DMA_HARD_RST, i2c->pdmabase + OFFSET_RST); +- udelay(50); +- writel(I2C_DMA_CLR_FLAG, i2c->pdmabase + OFFSET_RST); + } + + static const struct i2c_spec_values *mtk_i2c_get_spec(unsigned int speed) +-- +2.27.0 + diff --git a/queue-5.9/i2c-sh_mobile-implement-atomic-transfers.patch b/queue-5.9/i2c-sh_mobile-implement-atomic-transfers.patch new file mode 100644 index 00000000000..fb2766effce --- /dev/null +++ b/queue-5.9/i2c-sh_mobile-implement-atomic-transfers.patch @@ -0,0 +1,178 @@ +From 9b681df6078b9a1d762249129b316b5b54ffb7d0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 28 Sep 2020 17:59:50 +0200 +Subject: i2c: sh_mobile: implement atomic transfers + +From: Ulrich Hecht + +[ Upstream commit a49cc1fe9d64a2dc4e19b599204f403e5d25f44b ] + +Implements atomic transfers to fix reboot/shutdown on r8a7790 Lager and +similar boards. + +Signed-off-by: Ulrich Hecht +Tested-by: Wolfram Sang +Tested-by: Geert Uytterhoeven +[wsa: some whitespace fixing] +Signed-off-by: Wolfram Sang +Signed-off-by: Sasha Levin +--- + drivers/i2c/busses/i2c-sh_mobile.c | 86 +++++++++++++++++++++++------- + 1 file changed, 66 insertions(+), 20 deletions(-) + +diff --git a/drivers/i2c/busses/i2c-sh_mobile.c b/drivers/i2c/busses/i2c-sh_mobile.c +index cab7255599991..bdd60770779ad 100644 +--- a/drivers/i2c/busses/i2c-sh_mobile.c ++++ b/drivers/i2c/busses/i2c-sh_mobile.c +@@ -129,6 +129,7 @@ struct sh_mobile_i2c_data { + int sr; + bool send_stop; + bool stop_after_dma; ++ bool atomic_xfer; + + struct resource *res; + struct dma_chan *dma_tx; +@@ -330,13 +331,15 @@ static unsigned char i2c_op(struct sh_mobile_i2c_data *pd, enum sh_mobile_i2c_op + ret = iic_rd(pd, ICDR); + break; + case OP_RX_STOP: /* enable DTE interrupt, issue stop */ +- iic_wr(pd, ICIC, +- ICIC_DTEE | ICIC_WAITE | ICIC_ALE | ICIC_TACKE); ++ if (!pd->atomic_xfer) ++ iic_wr(pd, ICIC, ++ ICIC_DTEE | ICIC_WAITE | ICIC_ALE | ICIC_TACKE); + iic_wr(pd, ICCR, ICCR_ICE | ICCR_RACK); + break; + case OP_RX_STOP_DATA: /* enable DTE interrupt, read data, issue stop */ +- iic_wr(pd, ICIC, +- ICIC_DTEE | ICIC_WAITE | ICIC_ALE | ICIC_TACKE); ++ if (!pd->atomic_xfer) ++ iic_wr(pd, ICIC, ++ ICIC_DTEE | ICIC_WAITE | ICIC_ALE | ICIC_TACKE); + ret = iic_rd(pd, ICDR); + iic_wr(pd, ICCR, ICCR_ICE | ICCR_RACK); + break; +@@ -429,7 +432,8 @@ static irqreturn_t sh_mobile_i2c_isr(int irq, void *dev_id) + + if (wakeup) { + pd->sr |= SW_DONE; +- wake_up(&pd->wait); ++ if (!pd->atomic_xfer) ++ wake_up(&pd->wait); + } + + /* defeat write posting to avoid spurious WAIT interrupts */ +@@ -581,6 +585,9 @@ static void start_ch(struct sh_mobile_i2c_data *pd, struct i2c_msg *usr_msg, + pd->pos = -1; + pd->sr = 0; + ++ if (pd->atomic_xfer) ++ return; ++ + pd->dma_buf = i2c_get_dma_safe_msg_buf(pd->msg, 8); + if (pd->dma_buf) + sh_mobile_i2c_xfer_dma(pd); +@@ -637,15 +644,13 @@ static int poll_busy(struct sh_mobile_i2c_data *pd) + return i ? 0 : -ETIMEDOUT; + } + +-static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter, +- struct i2c_msg *msgs, +- int num) ++static int sh_mobile_xfer(struct sh_mobile_i2c_data *pd, ++ struct i2c_msg *msgs, int num) + { +- struct sh_mobile_i2c_data *pd = i2c_get_adapdata(adapter); + struct i2c_msg *msg; + int err = 0; + int i; +- long timeout; ++ long time_left; + + /* Wake up device and enable clock */ + pm_runtime_get_sync(pd->dev); +@@ -662,15 +667,35 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter, + if (do_start) + i2c_op(pd, OP_START); + +- /* The interrupt handler takes care of the rest... */ +- timeout = wait_event_timeout(pd->wait, +- pd->sr & (ICSR_TACK | SW_DONE), +- adapter->timeout); +- +- /* 'stop_after_dma' tells if DMA transfer was complete */ +- i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg, pd->stop_after_dma); ++ if (pd->atomic_xfer) { ++ unsigned long j = jiffies + pd->adap.timeout; ++ ++ time_left = time_before_eq(jiffies, j); ++ while (time_left && ++ !(pd->sr & (ICSR_TACK | SW_DONE))) { ++ unsigned char sr = iic_rd(pd, ICSR); ++ ++ if (sr & (ICSR_AL | ICSR_TACK | ++ ICSR_WAIT | ICSR_DTE)) { ++ sh_mobile_i2c_isr(0, pd); ++ udelay(150); ++ } else { ++ cpu_relax(); ++ } ++ time_left = time_before_eq(jiffies, j); ++ } ++ } else { ++ /* The interrupt handler takes care of the rest... */ ++ time_left = wait_event_timeout(pd->wait, ++ pd->sr & (ICSR_TACK | SW_DONE), ++ pd->adap.timeout); ++ ++ /* 'stop_after_dma' tells if DMA xfer was complete */ ++ i2c_put_dma_safe_msg_buf(pd->dma_buf, pd->msg, ++ pd->stop_after_dma); ++ } + +- if (!timeout) { ++ if (!time_left) { + dev_err(pd->dev, "Transfer request timed out\n"); + if (pd->dma_direction != DMA_NONE) + sh_mobile_i2c_cleanup_dma(pd); +@@ -696,14 +721,35 @@ static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter, + return err ?: num; + } + ++static int sh_mobile_i2c_xfer(struct i2c_adapter *adapter, ++ struct i2c_msg *msgs, ++ int num) ++{ ++ struct sh_mobile_i2c_data *pd = i2c_get_adapdata(adapter); ++ ++ pd->atomic_xfer = false; ++ return sh_mobile_xfer(pd, msgs, num); ++} ++ ++static int sh_mobile_i2c_xfer_atomic(struct i2c_adapter *adapter, ++ struct i2c_msg *msgs, ++ int num) ++{ ++ struct sh_mobile_i2c_data *pd = i2c_get_adapdata(adapter); ++ ++ pd->atomic_xfer = true; ++ return sh_mobile_xfer(pd, msgs, num); ++} ++ + static u32 sh_mobile_i2c_func(struct i2c_adapter *adapter) + { + return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL | I2C_FUNC_PROTOCOL_MANGLING; + } + + static const struct i2c_algorithm sh_mobile_i2c_algorithm = { +- .functionality = sh_mobile_i2c_func, +- .master_xfer = sh_mobile_i2c_xfer, ++ .functionality = sh_mobile_i2c_func, ++ .master_xfer = sh_mobile_i2c_xfer, ++ .master_xfer_atomic = sh_mobile_i2c_xfer_atomic, + }; + + static const struct i2c_adapter_quirks sh_mobile_i2c_quirks = { +-- +2.27.0 + diff --git a/queue-5.9/iomap-clean-up-writeback-state-logic-on-writepage-er.patch b/queue-5.9/iomap-clean-up-writeback-state-logic-on-writepage-er.patch new file mode 100644 index 00000000000..e32b40e086a --- /dev/null +++ b/queue-5.9/iomap-clean-up-writeback-state-logic-on-writepage-er.patch @@ -0,0 +1,95 @@ +From 143eb402ac77dcfb633f2d1021fed200a2e9a0da Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 14:30:49 -0700 +Subject: iomap: clean up writeback state logic on writepage error + +From: Brian Foster + +[ Upstream commit 50e7d6c7a5210063b9a6f0d8799d9d1440907fcf ] + +The iomap writepage error handling logic is a mash of old and +slightly broken XFS writepage logic. When keepwrite writeback state +tracking was introduced in XFS in commit 0d085a529b42 ("xfs: ensure +WB_SYNC_ALL writeback handles partial pages correctly"), XFS had an +additional cluster writeback context that scanned ahead of +->writepage() to process dirty pages over the current ->writepage() +extent mapping. This context expected a dirty page and required +retention of the TOWRITE tag on partial page processing so the +higher level writeback context would revisit the page (in contrast +to ->writepage(), which passes a page with the dirty bit already +cleared). + +The cluster writeback mechanism was eventually removed and some of +the error handling logic folded into the primary writeback path in +commit 150d5be09ce4 ("xfs: remove xfs_cancel_ioend"). This patch +accidentally conflated the two contexts by using the keepwrite logic +in ->writepage() without accounting for the fact that the page is +not dirty. Further, the keepwrite logic has no practical effect on +the core ->writepage() caller (write_cache_pages()) because it never +revisits a page in the current function invocation. + +Technically, the page should be redirtied for the keepwrite logic to +have any effect. Otherwise, write_cache_pages() may find the tagged +page but will skip it since it is clean. Even if the page was +redirtied, however, there is still no practical effect to keepwrite +since write_cache_pages() does not wrap around within a single +invocation of the function. Therefore, the dirty page would simply +end up retagged on the next writeback sequence over the associated +range. + +All that being said, none of this really matters because redirtying +a partially processed page introduces a potential infinite redirty +-> writeback failure loop that deviates from the current design +principle of clearing the dirty state on writepage failure to avoid +building up too much dirty, unreclaimable memory on the system. +Therefore, drop the spurious keepwrite usage and dirty state +clearing logic from iomap_writepage_map(), treat the partially +processed page the same as a fully processed page, and let the +imminent ioend failure clean up the writeback state. + +Signed-off-by: Brian Foster +Reviewed-by: Darrick J. Wong +Signed-off-by: Darrick J. Wong +Signed-off-by: Sasha Levin +--- + fs/iomap/buffered-io.c | 15 ++------------- + 1 file changed, 2 insertions(+), 13 deletions(-) + +diff --git a/fs/iomap/buffered-io.c b/fs/iomap/buffered-io.c +index b115e7d47fcec..238613443bec2 100644 +--- a/fs/iomap/buffered-io.c ++++ b/fs/iomap/buffered-io.c +@@ -1395,6 +1395,7 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, + WARN_ON_ONCE(!wpc->ioend && !list_empty(&submit_list)); + WARN_ON_ONCE(!PageLocked(page)); + WARN_ON_ONCE(PageWriteback(page)); ++ WARN_ON_ONCE(PageDirty(page)); + + /* + * We cannot cancel the ioend directly here on error. We may have +@@ -1415,21 +1416,9 @@ iomap_writepage_map(struct iomap_writepage_ctx *wpc, + unlock_page(page); + goto done; + } +- +- /* +- * If the page was not fully cleaned, we need to ensure that the +- * higher layers come back to it correctly. That means we need +- * to keep the page dirty, and for WB_SYNC_ALL writeback we need +- * to ensure the PAGECACHE_TAG_TOWRITE index mark is not removed +- * so another attempt to write this page in this writeback sweep +- * will be made. +- */ +- set_page_writeback_keepwrite(page); +- } else { +- clear_page_dirty_for_io(page); +- set_page_writeback(page); + } + ++ set_page_writeback(page); + unlock_page(page); + + /* +-- +2.27.0 + diff --git a/queue-5.9/iommu-amd-increase-interrupt-remapping-table-limit-t.patch b/queue-5.9/iommu-amd-increase-interrupt-remapping-table-limit-t.patch new file mode 100644 index 00000000000..3be4eabdacf --- /dev/null +++ b/queue-5.9/iommu-amd-increase-interrupt-remapping-table-limit-t.patch @@ -0,0 +1,53 @@ +From f0d1db9949f5bf17ad9a42c7a4737146e97c1d39 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 02:50:02 +0000 +Subject: iommu/amd: Increase interrupt remapping table limit to 512 entries + +From: Suravee Suthikulpanit + +[ Upstream commit 73db2fc595f358460ce32bcaa3be1f0cce4a2db1 ] + +Certain device drivers allocate IO queues on a per-cpu basis. +On AMD EPYC platform, which can support up-to 256 cpu threads, +this can exceed the current MAX_IRQ_PER_TABLE limit of 256, +and result in the error message: + + AMD-Vi: Failed to allocate IRTE + +This has been observed with certain NVME devices. + +AMD IOMMU hardware can actually support upto 512 interrupt +remapping table entries. Therefore, update the driver to +match the hardware limit. + +Please note that this also increases the size of interrupt remapping +table to 8KB per device when using the 128-bit IRTE format. + +Signed-off-by: Suravee Suthikulpanit +Link: https://lore.kernel.org/r/20201015025002.87997-1-suravee.suthikulpanit@amd.com +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/amd/amd_iommu_types.h | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/iommu/amd/amd_iommu_types.h b/drivers/iommu/amd/amd_iommu_types.h +index 30a5d412255a4..427484c455891 100644 +--- a/drivers/iommu/amd/amd_iommu_types.h ++++ b/drivers/iommu/amd/amd_iommu_types.h +@@ -406,7 +406,11 @@ extern bool amd_iommu_np_cache; + /* Only true if all IOMMUs support device IOTLBs */ + extern bool amd_iommu_iotlb_sup; + +-#define MAX_IRQS_PER_TABLE 256 ++/* ++ * AMD IOMMU hardware only support 512 IRTEs despite ++ * the architectural limitation of 2048 entries. ++ */ ++#define MAX_IRQS_PER_TABLE 512 + #define IRQ_TABLE_ALIGNMENT 128 + + struct irq_remap_table { +-- +2.27.0 + diff --git a/queue-5.9/mac80211-always-wind-down-sta-state.patch b/queue-5.9/mac80211-always-wind-down-sta-state.patch new file mode 100644 index 00000000000..1cfd0debe89 --- /dev/null +++ b/queue-5.9/mac80211-always-wind-down-sta-state.patch @@ -0,0 +1,64 @@ +From 294d3cf1f74513ca42906ed9243c9f43bffb7034 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 14:17:11 +0200 +Subject: mac80211: always wind down STA state + +From: Johannes Berg + +[ Upstream commit dcd479e10a0510522a5d88b29b8f79ea3467d501 ] + +When (for example) an IBSS station is pre-moved to AUTHORIZED +before it's inserted, and then the insertion fails, we don't +clean up the fast RX/TX states that might already have been +created, since we don't go through all the state transitions +again on the way down. + +Do that, if it hasn't been done already, when the station is +freed. I considered only freeing the fast TX/RX state there, +but we might add more state so it's more robust to wind down +the state properly. + +Note that we warn if the station was ever inserted, it should +have been properly cleaned up in that case, and the driver +will probably not like things happening out of order. + +Reported-by: syzbot+2e293dbd67de2836ba42@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/20201009141710.7223b322a955.I95bd08b9ad0e039c034927cce0b75beea38e059b@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/sta_info.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index fb4f2b9b294f0..4fe284ff1ea3d 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -258,6 +258,24 @@ struct sta_info *sta_info_get_by_idx(struct ieee80211_sub_if_data *sdata, + */ + void sta_info_free(struct ieee80211_local *local, struct sta_info *sta) + { ++ /* ++ * If we had used sta_info_pre_move_state() then we might not ++ * have gone through the state transitions down again, so do ++ * it here now (and warn if it's inserted). ++ * ++ * This will clear state such as fast TX/RX that may have been ++ * allocated during state transitions. ++ */ ++ while (sta->sta_state > IEEE80211_STA_NONE) { ++ int ret; ++ ++ WARN_ON_ONCE(test_sta_flag(sta, WLAN_STA_INSERTED)); ++ ++ ret = sta_info_move_state(sta, sta->sta_state - 1); ++ if (WARN_ONCE(ret, "sta_info_move_state() returned %d\n", ret)) ++ break; ++ } ++ + if (sta->rate_ctrl) + rate_control_free_sta(sta); + +-- +2.27.0 + diff --git a/queue-5.9/mac80211-fix-use-of-skb-payload-instead-of-header.patch b/queue-5.9/mac80211-fix-use-of-skb-payload-instead-of-header.patch new file mode 100644 index 00000000000..8959c7a4105 --- /dev/null +++ b/queue-5.9/mac80211-fix-use-of-skb-payload-instead-of-header.patch @@ -0,0 +1,127 @@ +From be2e3da130f4fe0c634884fb7e92432966f4cddf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 9 Oct 2020 13:25:41 +0200 +Subject: mac80211: fix use of skb payload instead of header + +From: Johannes Berg + +[ Upstream commit 14f46c1e5108696ec1e5a129e838ecedf108c7bf ] + +When ieee80211_skb_resize() is called from ieee80211_build_hdr() +the skb has no 802.11 header yet, in fact it consist only of the +payload as the ethernet frame is removed. As such, we're using +the payload data for ieee80211_is_mgmt(), which is of course +completely wrong. This didn't really hurt us because these are +always data frames, so we could only have added more tailroom +than we needed if we determined it was a management frame and +sdata->crypto_tx_tailroom_needed_cnt was false. + +However, syzbot found that of course there need not be any payload, +so we're using at best uninitialized memory for the check. + +Fix this to pass explicitly the kind of frame that we have instead +of checking there, by replacing the "bool may_encrypt" argument +with an argument that can carry the three possible states - it's +not going to be encrypted, it's a management frame, or it's a data +frame (and then we check sdata->crypto_tx_tailroom_needed_cnt). + +Reported-by: syzbot+32fd1a1bfe355e93f1e2@syzkaller.appspotmail.com +Signed-off-by: Johannes Berg +Link: https://lore.kernel.org/r/20201009132538.e1fd7f802947.I799b288466ea2815f9d4c84349fae697dca2f189@changeid +Signed-off-by: Johannes Berg +Signed-off-by: Sasha Levin +--- + net/mac80211/tx.c | 37 ++++++++++++++++++++++++------------- + 1 file changed, 24 insertions(+), 13 deletions(-) + +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index aa486e202a57c..ca1e8cd75b22b 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -1938,19 +1938,24 @@ static bool ieee80211_tx(struct ieee80211_sub_if_data *sdata, + + /* device xmit handlers */ + ++enum ieee80211_encrypt { ++ ENCRYPT_NO, ++ ENCRYPT_MGMT, ++ ENCRYPT_DATA, ++}; ++ + static int ieee80211_skb_resize(struct ieee80211_sub_if_data *sdata, + struct sk_buff *skb, +- int head_need, bool may_encrypt) ++ int head_need, ++ enum ieee80211_encrypt encrypt) + { + struct ieee80211_local *local = sdata->local; +- struct ieee80211_hdr *hdr; + bool enc_tailroom; + int tail_need = 0; + +- hdr = (struct ieee80211_hdr *) skb->data; +- enc_tailroom = may_encrypt && +- (sdata->crypto_tx_tailroom_needed_cnt || +- ieee80211_is_mgmt(hdr->frame_control)); ++ enc_tailroom = encrypt == ENCRYPT_MGMT || ++ (encrypt == ENCRYPT_DATA && ++ sdata->crypto_tx_tailroom_needed_cnt); + + if (enc_tailroom) { + tail_need = IEEE80211_ENCRYPT_TAILROOM; +@@ -1981,23 +1986,29 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata, + { + struct ieee80211_local *local = sdata->local; + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); +- struct ieee80211_hdr *hdr; ++ struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data; + int headroom; +- bool may_encrypt; ++ enum ieee80211_encrypt encrypt; + +- may_encrypt = !(info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT); ++ if (info->flags & IEEE80211_TX_INTFL_DONT_ENCRYPT) ++ encrypt = ENCRYPT_NO; ++ else if (ieee80211_is_mgmt(hdr->frame_control)) ++ encrypt = ENCRYPT_MGMT; ++ else ++ encrypt = ENCRYPT_DATA; + + headroom = local->tx_headroom; +- if (may_encrypt) ++ if (encrypt != ENCRYPT_NO) + headroom += sdata->encrypt_headroom; + headroom -= skb_headroom(skb); + headroom = max_t(int, 0, headroom); + +- if (ieee80211_skb_resize(sdata, skb, headroom, may_encrypt)) { ++ if (ieee80211_skb_resize(sdata, skb, headroom, encrypt)) { + ieee80211_free_txskb(&local->hw, skb); + return; + } + ++ /* reload after potential resize */ + hdr = (struct ieee80211_hdr *) skb->data; + info->control.vif = &sdata->vif; + +@@ -2822,7 +2833,7 @@ static struct sk_buff *ieee80211_build_hdr(struct ieee80211_sub_if_data *sdata, + head_need += sdata->encrypt_headroom; + head_need += local->tx_headroom; + head_need = max_t(int, 0, head_need); +- if (ieee80211_skb_resize(sdata, skb, head_need, true)) { ++ if (ieee80211_skb_resize(sdata, skb, head_need, ENCRYPT_DATA)) { + ieee80211_free_txskb(&local->hw, skb); + skb = NULL; + return ERR_PTR(-ENOMEM); +@@ -3496,7 +3507,7 @@ static bool ieee80211_xmit_fast(struct ieee80211_sub_if_data *sdata, + if (unlikely(ieee80211_skb_resize(sdata, skb, + max_t(int, extra_head + hw_headroom - + skb_headroom(skb), 0), +- false))) { ++ ENCRYPT_NO))) { + kfree_skb(skb); + return true; + } +-- +2.27.0 + diff --git a/queue-5.9/nvme-introduce-nvme_sync_io_queues.patch b/queue-5.9/nvme-introduce-nvme_sync_io_queues.patch new file mode 100644 index 00000000000..8c3418365a1 --- /dev/null +++ b/queue-5.9/nvme-introduce-nvme_sync_io_queues.patch @@ -0,0 +1,63 @@ +From 2e3d68c20cd392093df3461a63ef7c83b21930c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 10:15:00 +0800 +Subject: nvme: introduce nvme_sync_io_queues + +From: Chao Leng + +[ Upstream commit 04800fbff4764ab7b32c49d19628605a5d4cb85c ] + +Introduce sync io queues for some scenarios which just only need sync +io queues not sync all queues. + +Signed-off-by: Chao Leng +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 8 ++++++-- + drivers/nvme/host/nvme.h | 1 + + 2 files changed, 7 insertions(+), 2 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 893e29624c16b..59040bab5d6fa 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -4641,8 +4641,7 @@ void nvme_start_queues(struct nvme_ctrl *ctrl) + } + EXPORT_SYMBOL_GPL(nvme_start_queues); + +- +-void nvme_sync_queues(struct nvme_ctrl *ctrl) ++void nvme_sync_io_queues(struct nvme_ctrl *ctrl) + { + struct nvme_ns *ns; + +@@ -4650,7 +4649,12 @@ void nvme_sync_queues(struct nvme_ctrl *ctrl) + list_for_each_entry(ns, &ctrl->namespaces, list) + blk_sync_queue(ns->queue); + up_read(&ctrl->namespaces_rwsem); ++} ++EXPORT_SYMBOL_GPL(nvme_sync_io_queues); + ++void nvme_sync_queues(struct nvme_ctrl *ctrl) ++{ ++ nvme_sync_io_queues(ctrl); + if (ctrl->admin_q) + blk_sync_queue(ctrl->admin_q); + } +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 2aaedfa43ed86..97fbd61191b33 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -602,6 +602,7 @@ void nvme_stop_queues(struct nvme_ctrl *ctrl); + void nvme_start_queues(struct nvme_ctrl *ctrl); + void nvme_kill_queues(struct nvme_ctrl *ctrl); + void nvme_sync_queues(struct nvme_ctrl *ctrl); ++void nvme_sync_io_queues(struct nvme_ctrl *ctrl); + void nvme_unfreeze(struct nvme_ctrl *ctrl); + void nvme_wait_freeze(struct nvme_ctrl *ctrl); + int nvme_wait_freeze_timeout(struct nvme_ctrl *ctrl, long timeout); +-- +2.27.0 + diff --git a/queue-5.9/nvme-rdma-avoid-race-between-time-out-and-tear-down.patch b/queue-5.9/nvme-rdma-avoid-race-between-time-out-and-tear-down.patch new file mode 100644 index 00000000000..76d077d383e --- /dev/null +++ b/queue-5.9/nvme-rdma-avoid-race-between-time-out-and-tear-down.patch @@ -0,0 +1,103 @@ +From 05a3cc3a59c3283dad31ca0c031f37481235d446 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 10:15:08 +0800 +Subject: nvme-rdma: avoid race between time out and tear down + +From: Chao Leng + +[ Upstream commit 3017013dcc82a4862bd1e140f8b762cfc594008d ] + +Now use teardown_lock to serialize for time out and tear down. This may +cause abnormal: first cancel all request in tear down, then time out may +complete the request again, but the request may already be freed or +restarted. + +To avoid race between time out and tear down, in tear down process, +first we quiesce the queue, and then delete the timer and cancel +the time out work for the queue. At the same time we need to delete +teardown_lock. + +Signed-off-by: Chao Leng +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 12 ++---------- + 1 file changed, 2 insertions(+), 10 deletions(-) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 3a598e91e816d..73961cc1e9799 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -122,7 +122,6 @@ struct nvme_rdma_ctrl { + struct sockaddr_storage src_addr; + + struct nvme_ctrl ctrl; +- struct mutex teardown_lock; + bool use_inline_data; + u32 io_queues[HCTX_MAX_TYPES]; + }; +@@ -1010,8 +1009,8 @@ out_free_io_queues: + static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl, + bool remove) + { +- mutex_lock(&ctrl->teardown_lock); + blk_mq_quiesce_queue(ctrl->ctrl.admin_q); ++ blk_sync_queue(ctrl->ctrl.admin_q); + nvme_rdma_stop_queue(&ctrl->queues[0]); + if (ctrl->ctrl.admin_tagset) { + blk_mq_tagset_busy_iter(ctrl->ctrl.admin_tagset, +@@ -1021,16 +1020,15 @@ static void nvme_rdma_teardown_admin_queue(struct nvme_rdma_ctrl *ctrl, + if (remove) + blk_mq_unquiesce_queue(ctrl->ctrl.admin_q); + nvme_rdma_destroy_admin_queue(ctrl, remove); +- mutex_unlock(&ctrl->teardown_lock); + } + + static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl, + bool remove) + { +- mutex_lock(&ctrl->teardown_lock); + if (ctrl->ctrl.queue_count > 1) { + nvme_start_freeze(&ctrl->ctrl); + nvme_stop_queues(&ctrl->ctrl); ++ nvme_sync_io_queues(&ctrl->ctrl); + nvme_rdma_stop_io_queues(ctrl); + if (ctrl->ctrl.tagset) { + blk_mq_tagset_busy_iter(ctrl->ctrl.tagset, +@@ -1041,7 +1039,6 @@ static void nvme_rdma_teardown_io_queues(struct nvme_rdma_ctrl *ctrl, + nvme_start_queues(&ctrl->ctrl); + nvme_rdma_destroy_io_queues(ctrl, remove); + } +- mutex_unlock(&ctrl->teardown_lock); + } + + static void nvme_rdma_free_ctrl(struct nvme_ctrl *nctrl) +@@ -1975,16 +1972,12 @@ static void nvme_rdma_complete_timed_out(struct request *rq) + { + struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq); + struct nvme_rdma_queue *queue = req->queue; +- struct nvme_rdma_ctrl *ctrl = queue->ctrl; + +- /* fence other contexts that may complete the command */ +- mutex_lock(&ctrl->teardown_lock); + nvme_rdma_stop_queue(queue); + if (!blk_mq_request_completed(rq)) { + nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD; + blk_mq_complete_request(rq); + } +- mutex_unlock(&ctrl->teardown_lock); + } + + static enum blk_eh_timer_return +@@ -2319,7 +2312,6 @@ static struct nvme_ctrl *nvme_rdma_create_ctrl(struct device *dev, + return ERR_PTR(-ENOMEM); + ctrl->ctrl.opts = opts; + INIT_LIST_HEAD(&ctrl->list); +- mutex_init(&ctrl->teardown_lock); + + if (!(opts->mask & NVMF_OPT_TRSVCID)) { + opts->trsvcid = +-- +2.27.0 + diff --git a/queue-5.9/nvme-rdma-avoid-repeated-request-completion.patch b/queue-5.9/nvme-rdma-avoid-repeated-request-completion.patch new file mode 100644 index 00000000000..7c6e9ffa55f --- /dev/null +++ b/queue-5.9/nvme-rdma-avoid-repeated-request-completion.patch @@ -0,0 +1,38 @@ +From 7dcdebaab2113d7f2ed2ca383eb42678f4c931b2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 10:15:23 +0800 +Subject: nvme-rdma: avoid repeated request completion + +From: Sagi Grimberg + +[ Upstream commit fdf58e02adecbef4c7cbb2073d8ea225e6fd5f26 ] + +The request may be executed asynchronously, and rq->state may be +changed to IDLE. To avoid repeated request completion, only +MQ_RQ_COMPLETE of rq->state is checked in nvme_rdma_complete_timed_out. +It is not safe, so need adding check IDLE for rq->state. + +Signed-off-by: Sagi Grimberg +Signed-off-by: Chao Leng +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/rdma.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 73961cc1e9799..f91c20e3daf7b 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -1974,7 +1974,7 @@ static void nvme_rdma_complete_timed_out(struct request *rq) + struct nvme_rdma_queue *queue = req->queue; + + nvme_rdma_stop_queue(queue); +- if (!blk_mq_request_completed(rq)) { ++ if (blk_mq_request_started(rq) && !blk_mq_request_completed(rq)) { + nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD; + blk_mq_complete_request(rq); + } +-- +2.27.0 + diff --git a/queue-5.9/nvme-tcp-avoid-race-between-time-out-and-tear-down.patch b/queue-5.9/nvme-tcp-avoid-race-between-time-out-and-tear-down.patch new file mode 100644 index 00000000000..7252b28c131 --- /dev/null +++ b/queue-5.9/nvme-tcp-avoid-race-between-time-out-and-tear-down.patch @@ -0,0 +1,105 @@ +From 6fdaeb36d7fec2495feeab3e50d0bdf6bf40c829 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 10:15:15 +0800 +Subject: nvme-tcp: avoid race between time out and tear down + +From: Chao Leng + +[ Upstream commit d6f66210f4b1aa2f5944f0e34e0f8db44f499f92 ] + +Now use teardown_lock to serialize for time out and tear down. This may +cause abnormal: first cancel all request in tear down, then time out may +complete the request again, but the request may already be freed or +restarted. + +To avoid race between time out and tear down, in tear down process, +first we quiesce the queue, and then delete the timer and cancel +the time out work for the queue. At the same time we need to delete +teardown_lock. + +Signed-off-by: Chao Leng +Reviewed-by: Sagi Grimberg +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 14 +++----------- + 1 file changed, 3 insertions(+), 11 deletions(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index d6a3e14873542..19f86ea547bbc 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -124,7 +124,6 @@ struct nvme_tcp_ctrl { + struct sockaddr_storage src_addr; + struct nvme_ctrl ctrl; + +- struct mutex teardown_lock; + struct work_struct err_work; + struct delayed_work connect_work; + struct nvme_tcp_request async_req; +@@ -1886,8 +1885,8 @@ out_free_queue: + static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl, + bool remove) + { +- mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock); + blk_mq_quiesce_queue(ctrl->admin_q); ++ blk_sync_queue(ctrl->admin_q); + nvme_tcp_stop_queue(ctrl, 0); + if (ctrl->admin_tagset) { + blk_mq_tagset_busy_iter(ctrl->admin_tagset, +@@ -1897,18 +1896,17 @@ static void nvme_tcp_teardown_admin_queue(struct nvme_ctrl *ctrl, + if (remove) + blk_mq_unquiesce_queue(ctrl->admin_q); + nvme_tcp_destroy_admin_queue(ctrl, remove); +- mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock); + } + + static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl, + bool remove) + { +- mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock); + if (ctrl->queue_count <= 1) +- goto out; ++ return; + blk_mq_quiesce_queue(ctrl->admin_q); + nvme_start_freeze(ctrl); + nvme_stop_queues(ctrl); ++ nvme_sync_io_queues(ctrl); + nvme_tcp_stop_io_queues(ctrl); + if (ctrl->tagset) { + blk_mq_tagset_busy_iter(ctrl->tagset, +@@ -1918,8 +1916,6 @@ static void nvme_tcp_teardown_io_queues(struct nvme_ctrl *ctrl, + if (remove) + nvme_start_queues(ctrl); + nvme_tcp_destroy_io_queues(ctrl, remove); +-out: +- mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock); + } + + static void nvme_tcp_reconnect_or_remove(struct nvme_ctrl *ctrl) +@@ -2171,14 +2167,11 @@ static void nvme_tcp_complete_timed_out(struct request *rq) + struct nvme_tcp_request *req = blk_mq_rq_to_pdu(rq); + struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl; + +- /* fence other contexts that may complete the command */ +- mutex_lock(&to_tcp_ctrl(ctrl)->teardown_lock); + nvme_tcp_stop_queue(ctrl, nvme_tcp_queue_id(req->queue)); + if (!blk_mq_request_completed(rq)) { + nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD; + blk_mq_complete_request(rq); + } +- mutex_unlock(&to_tcp_ctrl(ctrl)->teardown_lock); + } + + static enum blk_eh_timer_return +@@ -2455,7 +2448,6 @@ static struct nvme_ctrl *nvme_tcp_create_ctrl(struct device *dev, + nvme_tcp_reconnect_ctrl_work); + INIT_WORK(&ctrl->err_work, nvme_tcp_error_recovery_work); + INIT_WORK(&ctrl->ctrl.reset_work, nvme_reset_ctrl_work); +- mutex_init(&ctrl->teardown_lock); + + if (!(opts->mask & NVMF_OPT_TRSVCID)) { + opts->trsvcid = +-- +2.27.0 + diff --git a/queue-5.9/nvme-tcp-avoid-repeated-request-completion.patch b/queue-5.9/nvme-tcp-avoid-repeated-request-completion.patch new file mode 100644 index 00000000000..448e1a2f932 --- /dev/null +++ b/queue-5.9/nvme-tcp-avoid-repeated-request-completion.patch @@ -0,0 +1,38 @@ +From 6b2f8598ac83b60ec7112613380adfda579b99f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 10:15:31 +0800 +Subject: nvme-tcp: avoid repeated request completion + +From: Sagi Grimberg + +[ Upstream commit 0a8a2c85b83589a5c10bc5564b796836bf4b4984 ] + +The request may be executed asynchronously, and rq->state may be +changed to IDLE. To avoid repeated request completion, only +MQ_RQ_COMPLETE of rq->state is checked in nvme_tcp_complete_timed_out. +It is not safe, so need adding check IDLE for rq->state. + +Signed-off-by: Sagi Grimberg +Signed-off-by: Chao Leng +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/tcp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c +index 19f86ea547bbc..c0c33320fe659 100644 +--- a/drivers/nvme/host/tcp.c ++++ b/drivers/nvme/host/tcp.c +@@ -2168,7 +2168,7 @@ static void nvme_tcp_complete_timed_out(struct request *rq) + struct nvme_ctrl *ctrl = &req->queue->ctrl->ctrl; + + nvme_tcp_stop_queue(ctrl, nvme_tcp_queue_id(req->queue)); +- if (!blk_mq_request_completed(rq)) { ++ if (blk_mq_request_started(rq) && !blk_mq_request_completed(rq)) { + nvme_req(rq)->status = NVME_SC_HOST_ABORTED_CMD; + blk_mq_complete_request(rq); + } +-- +2.27.0 + diff --git a/queue-5.9/opp-reduce-the-size-of-critical-section-in-_opp_tabl.patch b/queue-5.9/opp-reduce-the-size-of-critical-section-in-_opp_tabl.patch new file mode 100644 index 00000000000..0fb7540d97c --- /dev/null +++ b/queue-5.9/opp-reduce-the-size-of-critical-section-in-_opp_tabl.patch @@ -0,0 +1,50 @@ +From 65b09615b85c95f3f0e620c8ecd2f5a95ba97991 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 12:26:08 +0530 +Subject: opp: Reduce the size of critical section in _opp_table_kref_release() + +From: Viresh Kumar + +[ Upstream commit e0df59de670b48a923246fae1f972317b84b2764 ] + +There is a lot of stuff here which can be done outside of the big +opp_table_lock, do that. This helps avoiding few circular dependency +lockdeps around debugfs and interconnects. + +Reported-by: Rob Clark +Reported-by: Dmitry Osipenko +Signed-off-by: Viresh Kumar +Signed-off-by: Sasha Levin +--- + drivers/opp/core.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/opp/core.c b/drivers/opp/core.c +index 1a95ad40795be..a963df7bd2749 100644 +--- a/drivers/opp/core.c ++++ b/drivers/opp/core.c +@@ -1160,6 +1160,10 @@ static void _opp_table_kref_release(struct kref *kref) + struct opp_device *opp_dev, *temp; + int i; + ++ /* Drop the lock as soon as we can */ ++ list_del(&opp_table->node); ++ mutex_unlock(&opp_table_lock); ++ + _of_clear_opp_table(opp_table); + + /* Release clk */ +@@ -1187,10 +1191,7 @@ static void _opp_table_kref_release(struct kref *kref) + + mutex_destroy(&opp_table->genpd_virt_dev_lock); + mutex_destroy(&opp_table->lock); +- list_del(&opp_table->node); + kfree(opp_table); +- +- mutex_unlock(&opp_table_lock); + } + + void dev_pm_opp_put_opp_table(struct opp_table *opp_table) +-- +2.27.0 + diff --git a/queue-5.9/revert-nvme-pci-remove-last_sq_tail.patch b/queue-5.9/revert-nvme-pci-remove-last_sq_tail.patch new file mode 100644 index 00000000000..0f0cb821335 --- /dev/null +++ b/queue-5.9/revert-nvme-pci-remove-last_sq_tail.patch @@ -0,0 +1,93 @@ +From 60378037bfad2b5196671a6e6031edb56d73c037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Oct 2020 10:28:54 -0700 +Subject: Revert "nvme-pci: remove last_sq_tail" + +From: Keith Busch + +[ Upstream commit 38210800bf66d7302da1bb5b624ad68638da1562 ] + +Multiple CPUs may be mapped to the same hctx, allowing mulitple +submission contexts to attempt commit_rqs(). We need to verify we're +not writing the same doorbell value multiple times since that's a spec +violation. + +Revert commit 54b2fcee1db041a83b52b51752dade6090cf952f. + +Link: https://bugzilla.redhat.com/show_bug.cgi?id=1878596 +Reported-by: "B.L. Jones" +Signed-off-by: Keith Busch +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/pci.c | 23 +++++++++++++++++++---- + 1 file changed, 19 insertions(+), 4 deletions(-) + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 8984796db0c80..a6af96aaa0eb7 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -198,6 +198,7 @@ struct nvme_queue { + u32 q_depth; + u16 cq_vector; + u16 sq_tail; ++ u16 last_sq_tail; + u16 cq_head; + u16 qid; + u8 cq_phase; +@@ -455,11 +456,24 @@ static int nvme_pci_map_queues(struct blk_mq_tag_set *set) + return 0; + } + +-static inline void nvme_write_sq_db(struct nvme_queue *nvmeq) ++/* ++ * Write sq tail if we are asked to, or if the next command would wrap. ++ */ ++static inline void nvme_write_sq_db(struct nvme_queue *nvmeq, bool write_sq) + { ++ if (!write_sq) { ++ u16 next_tail = nvmeq->sq_tail + 1; ++ ++ if (next_tail == nvmeq->q_depth) ++ next_tail = 0; ++ if (next_tail != nvmeq->last_sq_tail) ++ return; ++ } ++ + if (nvme_dbbuf_update_and_check_event(nvmeq->sq_tail, + nvmeq->dbbuf_sq_db, nvmeq->dbbuf_sq_ei)) + writel(nvmeq->sq_tail, nvmeq->q_db); ++ nvmeq->last_sq_tail = nvmeq->sq_tail; + } + + /** +@@ -476,8 +490,7 @@ static void nvme_submit_cmd(struct nvme_queue *nvmeq, struct nvme_command *cmd, + cmd, sizeof(*cmd)); + if (++nvmeq->sq_tail == nvmeq->q_depth) + nvmeq->sq_tail = 0; +- if (write_sq) +- nvme_write_sq_db(nvmeq); ++ nvme_write_sq_db(nvmeq, write_sq); + spin_unlock(&nvmeq->sq_lock); + } + +@@ -486,7 +499,8 @@ static void nvme_commit_rqs(struct blk_mq_hw_ctx *hctx) + struct nvme_queue *nvmeq = hctx->driver_data; + + spin_lock(&nvmeq->sq_lock); +- nvme_write_sq_db(nvmeq); ++ if (nvmeq->sq_tail != nvmeq->last_sq_tail) ++ nvme_write_sq_db(nvmeq, true); + spin_unlock(&nvmeq->sq_lock); + } + +@@ -1496,6 +1510,7 @@ static void nvme_init_queue(struct nvme_queue *nvmeq, u16 qid) + struct nvme_dev *dev = nvmeq->dev; + + nvmeq->sq_tail = 0; ++ nvmeq->last_sq_tail = 0; + nvmeq->cq_head = 0; + nvmeq->cq_phase = 1; + nvmeq->q_db = &dev->dbs[qid * 2 * dev->db_stride]; +-- +2.27.0 + diff --git a/queue-5.9/riscv-set-text_offset-correctly-for-m-mode.patch b/queue-5.9/riscv-set-text_offset-correctly-for-m-mode.patch new file mode 100644 index 00000000000..95f5708dec4 --- /dev/null +++ b/queue-5.9/riscv-set-text_offset-correctly-for-m-mode.patch @@ -0,0 +1,45 @@ +From a4db88c1b687437fb25f734ebb7c5383a197c6e6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Oct 2020 16:30:12 -0400 +Subject: riscv: Set text_offset correctly for M-Mode + +From: Sean Anderson + +[ Upstream commit 79605f1394261995c2b955c906a5a20fb27cdc84 ] + +M-Mode Linux is loaded at the start of RAM, not 2MB later. Perhaps this +should be calculated based on PAGE_OFFSET somehow? Even better would be to +deprecate text_offset and instead introduce something absolute. + +Signed-off-by: Sean Anderson +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/head.S | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/riscv/kernel/head.S b/arch/riscv/kernel/head.S +index 0a4e81b8dc795..5a0ae2eaf5e2f 100644 +--- a/arch/riscv/kernel/head.S ++++ b/arch/riscv/kernel/head.S +@@ -27,12 +27,17 @@ ENTRY(_start) + /* reserved */ + .word 0 + .balign 8 ++#ifdef CONFIG_RISCV_M_MODE ++ /* Image load offset (0MB) from start of RAM for M-mode */ ++ .dword 0 ++#else + #if __riscv_xlen == 64 + /* Image load offset(2MB) from start of RAM */ + .dword 0x200000 + #else + /* Image load offset(4MB) from start of RAM */ + .dword 0x400000 ++#endif + #endif + /* Effective size of kernel image */ + .dword _end - _start +-- +2.27.0 + diff --git a/queue-5.9/s390-smp-move-rcu_cpu_starting-earlier.patch b/queue-5.9/s390-smp-move-rcu_cpu_starting-earlier.patch new file mode 100644 index 00000000000..c308c6e2451 --- /dev/null +++ b/queue-5.9/s390-smp-move-rcu_cpu_starting-earlier.patch @@ -0,0 +1,71 @@ +From 90ae06bd083cc66f3dd1b7d91c4d636ac1ee881d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 14:27:42 -0400 +Subject: s390/smp: move rcu_cpu_starting() earlier + +From: Qian Cai + +[ Upstream commit de5d9dae150ca1c1b5c7676711a9ca139d1a8dec ] + +The call to rcu_cpu_starting() in smp_init_secondary() is not early +enough in the CPU-hotplug onlining process, which results in lockdep +splats as follows: + + WARNING: suspicious RCU usage + ----------------------------- + kernel/locking/lockdep.c:3497 RCU-list traversed in non-reader section!! + + other info that might help us debug this: + + RCU used illegally from offline CPU! + rcu_scheduler_active = 1, debug_locks = 1 + no locks held by swapper/1/0. + + Call Trace: + show_stack+0x158/0x1f0 + dump_stack+0x1f2/0x238 + __lock_acquire+0x2640/0x4dd0 + lock_acquire+0x3a8/0xd08 + _raw_spin_lock_irqsave+0xc0/0xf0 + clockevents_register_device+0xa8/0x528 + init_cpu_timer+0x33e/0x468 + smp_init_secondary+0x11a/0x328 + smp_start_secondary+0x82/0x88 + +This is avoided by moving the call to rcu_cpu_starting up near the +beginning of the smp_init_secondary() function. Note that the +raw_smp_processor_id() is required in order to avoid calling into +lockdep before RCU has declared the CPU to be watched for readers. + +Link: https://lore.kernel.org/lkml/160223032121.7002.1269740091547117869.tip-bot2@tip-bot2/ +Signed-off-by: Qian Cai +Acked-by: Paul E. McKenney +Signed-off-by: Heiko Carstens +Signed-off-by: Sasha Levin +--- + arch/s390/kernel/smp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 85700bd85f98d..3b4c3140c18e7 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -855,13 +855,14 @@ void __init smp_detect_cpus(void) + + static void smp_init_secondary(void) + { +- int cpu = smp_processor_id(); ++ int cpu = raw_smp_processor_id(); + + S390_lowcore.last_update_clock = get_tod_clock(); + restore_access_regs(S390_lowcore.access_regs_save_area); + set_cpu_flag(CIF_ASCE_PRIMARY); + set_cpu_flag(CIF_ASCE_SECONDARY); + cpu_init(); ++ rcu_cpu_starting(cpu); + preempt_disable(); + init_cpu_timer(); + vtime_init(); +-- +2.27.0 + diff --git a/queue-5.9/scsi-hpsa-fix-memory-leak-in-hpsa_init_one.patch b/queue-5.9/scsi-hpsa-fix-memory-leak-in-hpsa_init_one.patch new file mode 100644 index 00000000000..2586f5d6285 --- /dev/null +++ b/queue-5.9/scsi-hpsa-fix-memory-leak-in-hpsa_init_one.patch @@ -0,0 +1,49 @@ +From 95720677107f8d53d247f035669af338be754e5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 07:31:24 +0000 +Subject: scsi: hpsa: Fix memory leak in hpsa_init_one() + +From: Keita Suzuki + +[ Upstream commit af61bc1e33d2c0ec22612b46050f5b58ac56a962 ] + +When hpsa_scsi_add_host() fails, h->lastlogicals is leaked since it is +missing a free() in the error handler. + +Fix this by adding free() when hpsa_scsi_add_host() fails. + +Link: https://lore.kernel.org/r/20201027073125.14229-1-keitasuzuki.park@sslab.ics.keio.ac.jp +Tested-by: Don Brace +Acked-by: Don Brace +Signed-off-by: Keita Suzuki +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/hpsa.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 48d5da59262b4..aed59ec20ad9e 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -8854,7 +8854,7 @@ reinit_after_soft_reset: + /* hook into SCSI subsystem */ + rc = hpsa_scsi_add_host(h); + if (rc) +- goto clean7; /* perf, sg, cmd, irq, shost, pci, lu, aer/h */ ++ goto clean8; /* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */ + + /* Monitor the controller for firmware lockups */ + h->heartbeat_sample_interval = HEARTBEAT_SAMPLE_INTERVAL; +@@ -8869,6 +8869,8 @@ reinit_after_soft_reset: + HPSA_EVENT_MONITOR_INTERVAL); + return 0; + ++clean8: /* lastlogicals, perf, sg, cmd, irq, shost, pci, lu, aer/h */ ++ kfree(h->lastlogicals); + clean7: /* perf, sg, cmd, irq, shost, pci, lu, aer/h */ + hpsa_free_performant_mode(h); + h->access.set_intr_mask(h, HPSA_INTR_OFF); +-- +2.27.0 + diff --git a/queue-5.9/scsi-mpt3sas-fix-timeouts-observed-while-reenabling-.patch b/queue-5.9/scsi-mpt3sas-fix-timeouts-observed-while-reenabling-.patch new file mode 100644 index 00000000000..4e8557d4841 --- /dev/null +++ b/queue-5.9/scsi-mpt3sas-fix-timeouts-observed-while-reenabling-.patch @@ -0,0 +1,49 @@ +From 5860ee528a285e6464820e61170093cb2245b975 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 2 Nov 2020 12:57:46 +0530 +Subject: scsi: mpt3sas: Fix timeouts observed while reenabling IRQ + +From: Sreekanth Reddy + +[ Upstream commit 5feed64f9199ff90c4239971733f23f30aeb2484 ] + +While reenabling the IRQ after irq poll there may be small time window +where HBA firmware has posted some replies and raise the interrupts but +driver has not received the interrupts. So we may observe I/O timeouts as +the driver has not processed the replies as interrupts got missed while +reenabling the IRQ. + +To fix this issue the driver has to go for one more round of processing the +reply descriptors from reply descriptor post queue after enabling the IRQ. + +Link: https://lore.kernel.org/r/20201102072746.27410-1-sreekanth.reddy@broadcom.com +Reported-by: Tomas Henzl +Reviewed-by: Tomas Henzl +Signed-off-by: Sreekanth Reddy +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/mpt3sas/mpt3sas_base.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index e86682dc34eca..87d05c1950870 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -1742,6 +1742,13 @@ _base_irqpoll(struct irq_poll *irqpoll, int budget) + reply_q->irq_poll_scheduled = false; + reply_q->irq_line_enable = true; + enable_irq(reply_q->os_irq); ++ /* ++ * Go for one more round of processing the ++ * reply descriptor post queue incase if HBA ++ * Firmware has posted some reply descriptors ++ * while reenabling the IRQ. ++ */ ++ _base_process_reply_queue(reply_q); + } + + return num_entries; +-- +2.27.0 + diff --git a/queue-5.9/scsi-scsi_dh_alua-avoid-crash-during-alua_bus_detach.patch b/queue-5.9/scsi-scsi_dh_alua-avoid-crash-during-alua_bus_detach.patch new file mode 100644 index 00000000000..0ff2d4e096a --- /dev/null +++ b/queue-5.9/scsi-scsi_dh_alua-avoid-crash-during-alua_bus_detach.patch @@ -0,0 +1,73 @@ +From 155c6785c00343acf0ce76e984728a2ca44c60ed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 24 Sep 2020 12:45:59 +0200 +Subject: scsi: scsi_dh_alua: Avoid crash during alua_bus_detach() + +From: Hannes Reinecke + +[ Upstream commit 5faf50e9e9fdc2117c61ff7e20da49cd6a29e0ca ] + +alua_bus_detach() might be running concurrently with alua_rtpg_work(), so +we might trip over h->sdev == NULL and call BUG_ON(). The correct way of +handling it is to not set h->sdev to NULL in alua_bus_detach(), and call +rcu_synchronize() before the final delete to ensure that all concurrent +threads have left the critical section. Then we can get rid of the +BUG_ON() and replace it with a simple if condition. + +Link: https://lore.kernel.org/r/1600167537-12509-1-git-send-email-jitendra.khasdev@oracle.com +Link: https://lore.kernel.org/r/20200924104559.26753-1-hare@suse.de +Cc: Brian Bunker +Acked-by: Brian Bunker +Tested-by: Jitendra Khasdev +Reviewed-by: Jitendra Khasdev +Signed-off-by: Hannes Reinecke +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/device_handler/scsi_dh_alua.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/scsi/device_handler/scsi_dh_alua.c b/drivers/scsi/device_handler/scsi_dh_alua.c +index f32da0ca529e0..308bda2e9c000 100644 +--- a/drivers/scsi/device_handler/scsi_dh_alua.c ++++ b/drivers/scsi/device_handler/scsi_dh_alua.c +@@ -658,8 +658,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + rcu_read_lock(); + list_for_each_entry_rcu(h, + &tmp_pg->dh_list, node) { +- /* h->sdev should always be valid */ +- BUG_ON(!h->sdev); ++ if (!h->sdev) ++ continue; + h->sdev->access_state = desc[0]; + } + rcu_read_unlock(); +@@ -705,7 +705,8 @@ static int alua_rtpg(struct scsi_device *sdev, struct alua_port_group *pg) + pg->expiry = 0; + rcu_read_lock(); + list_for_each_entry_rcu(h, &pg->dh_list, node) { +- BUG_ON(!h->sdev); ++ if (!h->sdev) ++ continue; + h->sdev->access_state = + (pg->state & SCSI_ACCESS_STATE_MASK); + if (pg->pref) +@@ -1147,7 +1148,6 @@ static void alua_bus_detach(struct scsi_device *sdev) + spin_lock(&h->pg_lock); + pg = rcu_dereference_protected(h->pg, lockdep_is_held(&h->pg_lock)); + rcu_assign_pointer(h->pg, NULL); +- h->sdev = NULL; + spin_unlock(&h->pg_lock); + if (pg) { + spin_lock_irq(&pg->lock); +@@ -1156,6 +1156,7 @@ static void alua_bus_detach(struct scsi_device *sdev) + kref_put(&pg->kref, release_port_group); + } + sdev->handler_data = NULL; ++ synchronize_rcu(); + kfree(h); + } + +-- +2.27.0 + diff --git a/queue-5.9/selftests-ftrace-check-for-do_sys_openat2-in-user-me.patch b/queue-5.9/selftests-ftrace-check-for-do_sys_openat2-in-user-me.patch new file mode 100644 index 00000000000..e3a845be369 --- /dev/null +++ b/queue-5.9/selftests-ftrace-check-for-do_sys_openat2-in-user-me.patch @@ -0,0 +1,49 @@ +From 829626165a5aba1e713dee85cba170f3a2a56e11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Oct 2020 14:25:01 +0100 +Subject: selftests/ftrace: check for do_sys_openat2 in user-memory test + +From: Colin Ian King + +[ Upstream commit e3e40312567087fbe6880f316cb2b0e1f3d8a82c ] + +More recent libc implementations are now using openat/openat2 system +calls so also add do_sys_openat2 to the tracing so that the test +passes on these systems because do_sys_open may not be called. + +Thanks to Masami Hiramatsu for the help on getting this fix to work +correctly. + +Signed-off-by: Colin Ian King +Acked-by: Masami Hiramatsu +Acked-by: Steven Rostedt (VMware) +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + .../selftests/ftrace/test.d/kprobe/kprobe_args_user.tc | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_user.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_user.tc +index a30a9c07290d0..d25d01a197781 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_user.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_user.tc +@@ -9,12 +9,16 @@ grep -A10 "fetcharg:" README | grep -q '\[u\]' || exit_unsupported + :;: "user-memory access syntax and ustring working on user memory";: + echo 'p:myevent do_sys_open path=+0($arg2):ustring path2=+u0($arg2):string' \ + > kprobe_events ++echo 'p:myevent2 do_sys_openat2 path=+0($arg2):ustring path2=+u0($arg2):string' \ ++ >> kprobe_events + + grep myevent kprobe_events | \ + grep -q 'path=+0($arg2):ustring path2=+u0($arg2):string' + echo 1 > events/kprobes/myevent/enable ++echo 1 > events/kprobes/myevent2/enable + echo > /dev/null + echo 0 > events/kprobes/myevent/enable ++echo 0 > events/kprobes/myevent2/enable + + grep myevent trace | grep -q 'path="/dev/null" path2="/dev/null"' + +-- +2.27.0 + diff --git a/queue-5.9/selftests-pidfd-fix-compilation-errors-due-to-wait.h.patch b/queue-5.9/selftests-pidfd-fix-compilation-errors-due-to-wait.h.patch new file mode 100644 index 00000000000..5f5c7b1886b --- /dev/null +++ b/queue-5.9/selftests-pidfd-fix-compilation-errors-due-to-wait.h.patch @@ -0,0 +1,54 @@ +From ebd61e6f4d9a000a0f9f7184ea9313c29b038044 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 15:26:22 +0300 +Subject: selftests: pidfd: fix compilation errors due to wait.h + +From: Tommi Rantala + +[ Upstream commit 1948172fdba5ad643529ddcd00a601c0caa913ed ] + +Drop unneeded header inclusion to fix pidfd compilation +errors seen in Fedora 32: + +In file included from pidfd_open_test.c:9: +../../../../usr/include/linux/wait.h:17:16: error: expected identifier before numeric constant + 17 | #define P_ALL 0 + | ^ + +Signed-off-by: Tommi Rantala +Reviewed-by: Kees Cook +Acked-by: Christian Brauner +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/pidfd/pidfd_open_test.c | 1 - + tools/testing/selftests/pidfd/pidfd_poll_test.c | 1 - + 2 files changed, 2 deletions(-) + +diff --git a/tools/testing/selftests/pidfd/pidfd_open_test.c b/tools/testing/selftests/pidfd/pidfd_open_test.c +index b9fe75fc3e517..8a59438ccc78b 100644 +--- a/tools/testing/selftests/pidfd/pidfd_open_test.c ++++ b/tools/testing/selftests/pidfd/pidfd_open_test.c +@@ -6,7 +6,6 @@ + #include + #include + #include +-#include + #include + #include + #include +diff --git a/tools/testing/selftests/pidfd/pidfd_poll_test.c b/tools/testing/selftests/pidfd/pidfd_poll_test.c +index 4b115444dfe90..6108112753573 100644 +--- a/tools/testing/selftests/pidfd/pidfd_poll_test.c ++++ b/tools/testing/selftests/pidfd/pidfd_poll_test.c +@@ -3,7 +3,6 @@ + #define _GNU_SOURCE + #include + #include +-#include + #include + #include + #include +-- +2.27.0 + diff --git a/queue-5.9/selftests-proc-fix-warning-_gnu_source-redefined.patch b/queue-5.9/selftests-proc-fix-warning-_gnu_source-redefined.patch new file mode 100644 index 00000000000..e7e5185fed3 --- /dev/null +++ b/queue-5.9/selftests-proc-fix-warning-_gnu_source-redefined.patch @@ -0,0 +1,60 @@ +From 9026ff8f72cb4ed625f68b1b41486c93a5bf90a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 8 Oct 2020 15:26:30 +0300 +Subject: selftests: proc: fix warning: _GNU_SOURCE redefined + +From: Tommi Rantala + +[ Upstream commit f3ae6c6e8a3ea49076d826c64e63ea78fbf9db43 ] + +Makefile already contains -D_GNU_SOURCE, so we can remove it from the +*.c files. + +Signed-off-by: Tommi Rantala +Signed-off-by: Shuah Khan +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/proc/proc-loadavg-001.c | 1 - + tools/testing/selftests/proc/proc-self-syscall.c | 1 - + tools/testing/selftests/proc/proc-uptime-002.c | 1 - + 3 files changed, 3 deletions(-) + +diff --git a/tools/testing/selftests/proc/proc-loadavg-001.c b/tools/testing/selftests/proc/proc-loadavg-001.c +index 471e2aa280776..fb4fe9188806e 100644 +--- a/tools/testing/selftests/proc/proc-loadavg-001.c ++++ b/tools/testing/selftests/proc/proc-loadavg-001.c +@@ -14,7 +14,6 @@ + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ + /* Test that /proc/loadavg correctly reports last pid in pid namespace. */ +-#define _GNU_SOURCE + #include + #include + #include +diff --git a/tools/testing/selftests/proc/proc-self-syscall.c b/tools/testing/selftests/proc/proc-self-syscall.c +index 9f6d000c02455..8511dcfe67c75 100644 +--- a/tools/testing/selftests/proc/proc-self-syscall.c ++++ b/tools/testing/selftests/proc/proc-self-syscall.c +@@ -13,7 +13,6 @@ + * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF + * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. + */ +-#define _GNU_SOURCE + #include + #include + #include +diff --git a/tools/testing/selftests/proc/proc-uptime-002.c b/tools/testing/selftests/proc/proc-uptime-002.c +index 30e2b78490898..e7ceabed7f51f 100644 +--- a/tools/testing/selftests/proc/proc-uptime-002.c ++++ b/tools/testing/selftests/proc/proc-uptime-002.c +@@ -15,7 +15,6 @@ + */ + // Test that values in /proc/uptime increment monotonically + // while shifting across CPUs. +-#define _GNU_SOURCE + #undef NDEBUG + #include + #include +-- +2.27.0 + diff --git a/queue-5.9/series b/queue-5.9/series index b7ddc51ae17..6be71c42eb0 100644 --- a/queue-5.9/series +++ b/queue-5.9/series @@ -72,3 +72,53 @@ usb-apple-mfi-fastcharge-fix-reference-leak-in-apple.patch tpm-efi-don-t-create-binary_bios_measurements-file-f.patch kvm-arm64-arm_smccc_arch_workaround_1-doesn-t-return-smccc_ret_not_required.patch ath9k_htc-use-appropriate-rs_datalen-type.patch +asoc-mediatek-mt8183-da7219-fix-dapm-paths-for-rt101.patch +asoc-qcom-sdm845-set-driver-name-correctly.patch +asoc-cs42l51-manage-mclk-shutdown-delay.patch +asoc-sof-loader-handle-all-sof_ipc_ext-types.patch +usb-dwc3-pci-add-support-for-the-intel-alder-lake-s.patch +opp-reduce-the-size-of-critical-section-in-_opp_tabl.patch +usb-gadget-goku_udc-fix-potential-crashes-in-probe.patch +usb-raw-gadget-fix-memory-leak-in-gadget_setup.patch +selftests-ftrace-check-for-do_sys_openat2-in-user-me.patch +selftests-pidfd-fix-compilation-errors-due-to-wait.h.patch +alsa-hda-separate-runtime-and-system-suspend.patch +alsa-hda-reinstate-runtime_allow-for-all-hda-control.patch +x86-boot-compressed-64-introduce-sev_status.patch +gfs2-free-rd_bits-later-in-gfs2_clear_rgrpd-to-fix-u.patch +gfs2-add-missing-truncate_inode_pages_final-for-sd_a.patch +gfs2-check-for-live-vs.-read-only-file-system-in-gfs.patch +scsi-hpsa-fix-memory-leak-in-hpsa_init_one.patch +drm-amdgpu-perform-srbm-soft-reset-always-on-sdma-re.patch +drm-amd-pm-correct-the-baco-reset-sequence-for-ci-as.patch +drm-amd-pm-perform-smc-reset-on-suspend-hibernation.patch +drm-amd-pm-do-not-use-ixfeature_status-for-checking-.patch +mac80211-fix-use-of-skb-payload-instead-of-header.patch +cfg80211-initialize-wdev-data-earlier.patch +mac80211-always-wind-down-sta-state.patch +cfg80211-regulatory-fix-inconsistent-format-argument.patch +wireguard-selftests-check-that-route_me_harder-packe.patch +tracing-fix-the-checking-of-stackidx-in-__ftrace_tra.patch +revert-nvme-pci-remove-last_sq_tail.patch +arc-plat-hsdk-remap-ccms-super-early-in-asm-boot-tra.patch +scsi-scsi_dh_alua-avoid-crash-during-alua_bus_detach.patch +scsi-mpt3sas-fix-timeouts-observed-while-reenabling-.patch +nvme-introduce-nvme_sync_io_queues.patch +nvme-rdma-avoid-race-between-time-out-and-tear-down.patch +nvme-tcp-avoid-race-between-time-out-and-tear-down.patch +nvme-rdma-avoid-repeated-request-completion.patch +nvme-tcp-avoid-repeated-request-completion.patch +iommu-amd-increase-interrupt-remapping-table-limit-t.patch +s390-smp-move-rcu_cpu_starting-earlier.patch +vfio-platform-fix-reference-leak-in-vfio_platform_op.patch +vfio-pci-bypass-igd-init-in-case-of-enodev.patch +i2c-mediatek-move-dma-reset-before-i2c-reset.patch +amd-amdgpu-disable-vcn-dpg-mode-for-picasso.patch +iomap-clean-up-writeback-state-logic-on-writepage-er.patch +selftests-proc-fix-warning-_gnu_source-redefined.patch +arm64-kexec_file-try-more-regions-if-loading-segment.patch +riscv-set-text_offset-correctly-for-m-mode.patch +i2c-sh_mobile-implement-atomic-transfers.patch +i2c-designware-call-i2c_dw_read_clear_intrbits_slave.patch +i2c-designware-slave-should-do-write_requested-befor.patch +tpm_tis-disable-interrupts-on-thinkpad-t490s.patch diff --git a/queue-5.9/tpm_tis-disable-interrupts-on-thinkpad-t490s.patch b/queue-5.9/tpm_tis-disable-interrupts-on-thinkpad-t490s.patch new file mode 100644 index 00000000000..d79948175b6 --- /dev/null +++ b/queue-5.9/tpm_tis-disable-interrupts-on-thinkpad-t490s.patch @@ -0,0 +1,99 @@ +From d26006c9369fec9bfb7b59261a559f5a792f165e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 15 Oct 2020 14:44:30 -0700 +Subject: tpm_tis: Disable interrupts on ThinkPad T490s + +From: Jerry Snitselaar + +[ Upstream commit b154ce11ead925de6a94feb3b0317fafeefa0ebc ] + +There is a misconfiguration in the bios of the gpio pin used for the +interrupt in the T490s. When interrupts are enabled in the tpm_tis +driver code this results in an interrupt storm. This was initially +reported when we attempted to enable the interrupt code in the tpm_tis +driver, which previously wasn't setting a flag to enable it. Due to +the reports of the interrupt storm that code was reverted and we went back +to polling instead of using interrupts. Now that we know the T490s problem +is a firmware issue, add code to check if the system is a T490s and +disable interrupts if that is the case. This will allow us to enable +interrupts for everyone else. If the user has a fixed bios they can +force the enabling of interrupts with tpm_tis.interrupts=1 on the +kernel command line. + +Cc: Peter Huewe +Cc: Jason Gunthorpe +Cc: Hans de Goede +Signed-off-by: Jerry Snitselaar +Reviewed-by: James Bottomley +Reviewed-by: Hans de Goede +Reviewed-by: Jarkko Sakkinen +Signed-off-by: Jarkko Sakkinen +Signed-off-by: Sasha Levin +--- + drivers/char/tpm/tpm_tis.c | 29 +++++++++++++++++++++++++++-- + 1 file changed, 27 insertions(+), 2 deletions(-) + +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index 0b214963539de..4ed6e660273a4 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include "tpm.h" + #include "tpm_tis_core.h" + +@@ -49,8 +50,8 @@ static inline struct tpm_tis_tcg_phy *to_tpm_tis_tcg_phy(struct tpm_tis_data *da + return container_of(data, struct tpm_tis_tcg_phy, priv); + } + +-static bool interrupts = true; +-module_param(interrupts, bool, 0444); ++static int interrupts = -1; ++module_param(interrupts, int, 0444); + MODULE_PARM_DESC(interrupts, "Enable interrupts"); + + static bool itpm; +@@ -63,6 +64,28 @@ module_param(force, bool, 0444); + MODULE_PARM_DESC(force, "Force device probe rather than using ACPI entry"); + #endif + ++static int tpm_tis_disable_irq(const struct dmi_system_id *d) ++{ ++ if (interrupts == -1) { ++ pr_notice("tpm_tis: %s detected: disabling interrupts.\n", d->ident); ++ interrupts = 0; ++ } ++ ++ return 0; ++} ++ ++static const struct dmi_system_id tpm_tis_dmi_table[] = { ++ { ++ .callback = tpm_tis_disable_irq, ++ .ident = "ThinkPad T490s", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T490s"), ++ }, ++ }, ++ {} ++}; ++ + #if defined(CONFIG_PNP) && defined(CONFIG_ACPI) + static int has_hid(struct acpi_device *dev, const char *hid) + { +@@ -192,6 +215,8 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info) + int irq = -1; + int rc; + ++ dmi_check_system(tpm_tis_dmi_table); ++ + rc = check_acpi_tpm2(dev); + if (rc) + return rc; +-- +2.27.0 + diff --git a/queue-5.9/tracing-fix-the-checking-of-stackidx-in-__ftrace_tra.patch b/queue-5.9/tracing-fix-the-checking-of-stackidx-in-__ftrace_tra.patch new file mode 100644 index 00000000000..8501e40727f --- /dev/null +++ b/queue-5.9/tracing-fix-the-checking-of-stackidx-in-__ftrace_tra.patch @@ -0,0 +1,46 @@ +From 3d3697189d496aacb9f0f45729f3d13806360577 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Oct 2020 16:57:14 +0800 +Subject: tracing: Fix the checking of stackidx in __ftrace_trace_stack + +From: Qiujun Huang + +[ Upstream commit 906695e59324635c62b5ae59df111151a546ca66 ] + +The array size is FTRACE_KSTACK_NESTING, so the index FTRACE_KSTACK_NESTING +is illegal too. And fix two typos by the way. + +Link: https://lkml.kernel.org/r/20201031085714.2147-1-hqjagain@gmail.com + +Signed-off-by: Qiujun Huang +Signed-off-by: Steven Rostedt (VMware) +Signed-off-by: Sasha Levin +--- + kernel/trace/trace.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 6e2fb7dc41bf3..1c76a0faf3cd1 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -2611,7 +2611,7 @@ trace_event_buffer_lock_reserve(struct trace_buffer **current_rb, + /* + * If tracing is off, but we have triggers enabled + * we still need to look at the event data. Use the temp_buffer +- * to store the trace event for the tigger to use. It's recusive ++ * to store the trace event for the trigger to use. It's recursive + * safe and will not be recorded anywhere. + */ + if (!entry && trace_file->flags & EVENT_FILE_FL_TRIGGER_COND) { +@@ -2934,7 +2934,7 @@ static void __ftrace_trace_stack(struct trace_buffer *buffer, + stackidx = __this_cpu_inc_return(ftrace_stack_reserve) - 1; + + /* This should never happen. If it does, yell once and skip */ +- if (WARN_ON_ONCE(stackidx > FTRACE_KSTACK_NESTING)) ++ if (WARN_ON_ONCE(stackidx >= FTRACE_KSTACK_NESTING)) + goto out; + + /* +-- +2.27.0 + diff --git a/queue-5.9/usb-dwc3-pci-add-support-for-the-intel-alder-lake-s.patch b/queue-5.9/usb-dwc3-pci-add-support-for-the-intel-alder-lake-s.patch new file mode 100644 index 00000000000..1eb95a5fbf8 --- /dev/null +++ b/queue-5.9/usb-dwc3-pci-add-support-for-the-intel-alder-lake-s.patch @@ -0,0 +1,44 @@ +From 80ae9de4c4729274480f935dca35154aced6588e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 6 Oct 2020 16:02:50 +0300 +Subject: usb: dwc3: pci: add support for the Intel Alder Lake-S + +From: Heikki Krogerus + +[ Upstream commit 1384ab4fee12c4c4f8bd37bc9f8686881587b286 ] + +This patch adds the necessary PCI ID for Intel Alder Lake-S +devices. + +Signed-off-by: Heikki Krogerus +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/dwc3/dwc3-pci.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 242b6210380a4..bae6a70664c80 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -40,6 +40,7 @@ + #define PCI_DEVICE_ID_INTEL_TGPLP 0xa0ee + #define PCI_DEVICE_ID_INTEL_TGPH 0x43ee + #define PCI_DEVICE_ID_INTEL_JSP 0x4dee ++#define PCI_DEVICE_ID_INTEL_ADLS 0x7ae1 + + #define PCI_INTEL_BXT_DSM_GUID "732b85d5-b7a7-4a1b-9ba0-4bbd00ffd511" + #define PCI_INTEL_BXT_FUNC_PMU_PWR 4 +@@ -367,6 +368,9 @@ static const struct pci_device_id dwc3_pci_id_table[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_JSP), + (kernel_ulong_t) &dwc3_pci_intel_properties, }, + ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_ADLS), ++ (kernel_ulong_t) &dwc3_pci_intel_properties, }, ++ + { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_NL_USB), + (kernel_ulong_t) &dwc3_pci_amd_properties, }, + { } /* Terminating Entry */ +-- +2.27.0 + diff --git a/queue-5.9/usb-gadget-goku_udc-fix-potential-crashes-in-probe.patch b/queue-5.9/usb-gadget-goku_udc-fix-potential-crashes-in-probe.patch new file mode 100644 index 00000000000..80707c6ac1e --- /dev/null +++ b/queue-5.9/usb-gadget-goku_udc-fix-potential-crashes-in-probe.patch @@ -0,0 +1,51 @@ +From 9874c4547de8af2e6ad8c8d3c52bc18f616c3eb5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Oct 2020 18:01:55 +0300 +Subject: usb: gadget: goku_udc: fix potential crashes in probe + +From: Evgeny Novikov + +[ Upstream commit 0d66e04875c5aae876cf3d4f4be7978fa2b00523 ] + +goku_probe() goes to error label "err" and invokes goku_remove() +in case of failures of pci_enable_device(), pci_resource_start() +and ioremap(). goku_remove() gets a device from +pci_get_drvdata(pdev) and works with it without any checks, in +particular it dereferences a corresponding pointer. But +goku_probe() did not set this device yet. So, one can expect +various crashes. The patch moves setting the device just after +allocation of memory for it. + +Found by Linux Driver Verification project (linuxtesting.org). + +Reported-by: Pavel Andrianov +Signed-off-by: Evgeny Novikov +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/udc/goku_udc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/udc/goku_udc.c b/drivers/usb/gadget/udc/goku_udc.c +index 25c1d6ab5adb4..3e1267d38774f 100644 +--- a/drivers/usb/gadget/udc/goku_udc.c ++++ b/drivers/usb/gadget/udc/goku_udc.c +@@ -1760,6 +1760,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) + goto err; + } + ++ pci_set_drvdata(pdev, dev); + spin_lock_init(&dev->lock); + dev->pdev = pdev; + dev->gadget.ops = &goku_ops; +@@ -1793,7 +1794,6 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id) + } + dev->regs = (struct goku_udc_regs __iomem *) base; + +- pci_set_drvdata(pdev, dev); + INFO(dev, "%s\n", driver_desc); + INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr()); + INFO(dev, "irq %d, pci mem %p\n", pdev->irq, base); +-- +2.27.0 + diff --git a/queue-5.9/usb-raw-gadget-fix-memory-leak-in-gadget_setup.patch b/queue-5.9/usb-raw-gadget-fix-memory-leak-in-gadget_setup.patch new file mode 100644 index 00000000000..e914df706b5 --- /dev/null +++ b/queue-5.9/usb-raw-gadget-fix-memory-leak-in-gadget_setup.patch @@ -0,0 +1,80 @@ +From 0e7c907d81c827eb220e62a5d247cd66c7287a68 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Oct 2020 15:30:44 +0800 +Subject: usb: raw-gadget: fix memory leak in gadget_setup + +From: Zqiang + +[ Upstream commit 129aa9734559a17990ee933351c7b6956f1dba62 ] + +When fetch 'event' from event queue, after copy its address +space content to user space, the 'event' the memory space +pointed to by the 'event' pointer need be freed. + +BUG: memory leak +unreferenced object 0xffff888110622660 (size 32): + comm "softirq", pid 0, jiffies 4294941981 (age 12.480s) + hex dump (first 32 bytes): + 02 00 00 00 08 00 00 00 80 06 00 01 00 00 40 00 ..............@. + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<00000000efd29abd>] kmalloc include/linux/slab.h:554 [inline] + [<00000000efd29abd>] raw_event_queue_add drivers/usb/gadget/legacy/raw_gadget.c:66 [inline] + [<00000000efd29abd>] raw_queue_event drivers/usb/gadget/legacy/raw_gadget.c:225 [inline] + [<00000000efd29abd>] gadget_setup+0xf6/0x220 drivers/usb/gadget/legacy/raw_gadget.c:343 + [<00000000952c4a46>] dummy_timer+0xb9f/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1899 + [<0000000074ac2c54>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1415 + [<00000000560a3a79>] expire_timers kernel/time/timer.c:1460 [inline] + [<00000000560a3a79>] __run_timers.part.0+0x319/0x400 kernel/time/timer.c:1757 + [<000000009d9503d0>] __run_timers kernel/time/timer.c:1738 [inline] + [<000000009d9503d0>] run_timer_softirq+0x3d/0x80 kernel/time/timer.c:1770 + [<000000009df27c89>] __do_softirq+0xcc/0x2c2 kernel/softirq.c:298 + [<000000007a3f1a47>] asm_call_irq_on_stack+0xf/0x20 + [<000000004a62cc2e>] __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] + [<000000004a62cc2e>] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] + [<000000004a62cc2e>] do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77 + [<00000000b0086800>] invoke_softirq kernel/softirq.c:393 [inline] + [<00000000b0086800>] __irq_exit_rcu kernel/softirq.c:423 [inline] + [<00000000b0086800>] irq_exit_rcu+0x91/0xc0 kernel/softirq.c:435 + [<00000000175f9523>] sysvec_apic_timer_interrupt+0x36/0x80 arch/x86/kernel/apic/apic.c:1091 + [<00000000a348e847>] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631 + [<0000000060661100>] native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline] + [<0000000060661100>] arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline] + [<0000000060661100>] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline] + [<0000000060661100>] acpi_idle_do_entry+0xc3/0xd0 drivers/acpi/processor_idle.c:517 + [<000000003f413b99>] acpi_idle_enter+0x128/0x1f0 drivers/acpi/processor_idle.c:648 + [<00000000f5e5afb8>] cpuidle_enter_state+0xc9/0x650 drivers/cpuidle/cpuidle.c:237 + [<00000000d50d51fc>] cpuidle_enter+0x29/0x40 drivers/cpuidle/cpuidle.c:351 + [<00000000d674baed>] call_cpuidle kernel/sched/idle.c:132 [inline] + [<00000000d674baed>] cpuidle_idle_call kernel/sched/idle.c:213 [inline] + [<00000000d674baed>] do_idle+0x1c8/0x250 kernel/sched/idle.c:273 + +Reported-by: syzbot+bd38200f53df6259e6bf@syzkaller.appspotmail.com +Signed-off-by: Zqiang +Signed-off-by: Felipe Balbi +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/legacy/raw_gadget.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c +index e01e366d89cd5..062dfac303996 100644 +--- a/drivers/usb/gadget/legacy/raw_gadget.c ++++ b/drivers/usb/gadget/legacy/raw_gadget.c +@@ -564,9 +564,12 @@ static int raw_ioctl_event_fetch(struct raw_dev *dev, unsigned long value) + return -ENODEV; + } + length = min(arg.length, event->length); +- if (copy_to_user((void __user *)value, event, sizeof(*event) + length)) ++ if (copy_to_user((void __user *)value, event, sizeof(*event) + length)) { ++ kfree(event); + return -EFAULT; ++ } + ++ kfree(event); + return 0; + } + +-- +2.27.0 + diff --git a/queue-5.9/vfio-pci-bypass-igd-init-in-case-of-enodev.patch b/queue-5.9/vfio-pci-bypass-igd-init-in-case-of-enodev.patch new file mode 100644 index 00000000000..2058a987fa0 --- /dev/null +++ b/queue-5.9/vfio-pci-bypass-igd-init-in-case-of-enodev.patch @@ -0,0 +1,45 @@ +From 88bab345d4dbce340b5e5160e009901df8184f5e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 3 Nov 2020 02:01:20 +0800 +Subject: vfio/pci: Bypass IGD init in case of -ENODEV + +From: Fred Gao + +[ Upstream commit e4eccb853664de7bcf9518fb658f35e748bf1f68 ] + +Bypass the IGD initialization when -ENODEV returns, +that should be the case if opregion is not available for IGD +or within discrete graphics device's option ROM, +or host/lpc bridge is not found. + +Then use of -ENODEV here means no special device resources found +which needs special care for VFIO, but we still allow other normal +device resource access. + +Cc: Zhenyu Wang +Cc: Xiong Zhang +Cc: Hang Yuan +Cc: Stuart Summers +Signed-off-by: Fred Gao +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/pci/vfio_pci.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index 1ab1f5cda4ac2..bfdc010a6b043 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -385,7 +385,7 @@ static int vfio_pci_enable(struct vfio_pci_device *vdev) + pdev->vendor == PCI_VENDOR_ID_INTEL && + IS_ENABLED(CONFIG_VFIO_PCI_IGD)) { + ret = vfio_pci_igd_init(vdev); +- if (ret) { ++ if (ret && ret != -ENODEV) { + pci_warn(pdev, "Failed to setup Intel IGD regions\n"); + goto disable_exit; + } +-- +2.27.0 + diff --git a/queue-5.9/vfio-platform-fix-reference-leak-in-vfio_platform_op.patch b/queue-5.9/vfio-platform-fix-reference-leak-in-vfio_platform_op.patch new file mode 100644 index 00000000000..7e54863e1e7 --- /dev/null +++ b/queue-5.9/vfio-platform-fix-reference-leak-in-vfio_platform_op.patch @@ -0,0 +1,45 @@ +From 2af31f1f7bb567420a7709c52b68a04af4022843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 31 Oct 2020 11:03:53 +0800 +Subject: vfio: platform: fix reference leak in vfio_platform_open + +From: Zhang Qilong + +[ Upstream commit bb742ad01961a3b9d1f9d19375487b879668b6b2 ] + +pm_runtime_get_sync() will increment pm usage counter even it +failed. Forgetting to call pm_runtime_put will result in +reference leak in vfio_platform_open, so we should fix it. + +Signed-off-by: Zhang Qilong +Acked-by: Eric Auger +Signed-off-by: Alex Williamson +Signed-off-by: Sasha Levin +--- + drivers/vfio/platform/vfio_platform_common.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c +index c0771a9567fb5..fb4b385191f28 100644 +--- a/drivers/vfio/platform/vfio_platform_common.c ++++ b/drivers/vfio/platform/vfio_platform_common.c +@@ -267,7 +267,7 @@ static int vfio_platform_open(void *device_data) + + ret = pm_runtime_get_sync(vdev->device); + if (ret < 0) +- goto err_pm; ++ goto err_rst; + + ret = vfio_platform_call_reset(vdev, &extra_dbg); + if (ret && vdev->reset_required) { +@@ -284,7 +284,6 @@ static int vfio_platform_open(void *device_data) + + err_rst: + pm_runtime_put(vdev->device); +-err_pm: + vfio_platform_irq_cleanup(vdev); + err_irq: + vfio_platform_regions_cleanup(vdev); +-- +2.27.0 + diff --git a/queue-5.9/wireguard-selftests-check-that-route_me_harder-packe.patch b/queue-5.9/wireguard-selftests-check-that-route_me_harder-packe.patch new file mode 100644 index 00000000000..0444ce93bee --- /dev/null +++ b/queue-5.9/wireguard-selftests-check-that-route_me_harder-packe.patch @@ -0,0 +1,65 @@ +From 9806655417e5ce976e5b84b245910b3764d40dc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Oct 2020 03:56:05 +0100 +Subject: wireguard: selftests: check that route_me_harder packets use the + right sk + +From: Jason A. Donenfeld + +[ Upstream commit af8afcf1fdd5f365f70e2386c2d8c7a1abd853d7 ] + +If netfilter changes the packet mark, the packet is rerouted. The +ip_route_me_harder family of functions fails to use the right sk, opting +to instead use skb->sk, resulting in a routing loop when used with +tunnels. With the next change fixing this issue in netfilter, test for +the relevant condition inside our test suite, since wireguard was where +the bug was discovered. + +Reported-by: Chen Minqiang +Signed-off-by: Jason A. Donenfeld +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + tools/testing/selftests/wireguard/netns.sh | 8 ++++++++ + tools/testing/selftests/wireguard/qemu/kernel.config | 2 ++ + 2 files changed, 10 insertions(+) + +diff --git a/tools/testing/selftests/wireguard/netns.sh b/tools/testing/selftests/wireguard/netns.sh +index d77f4829f1e07..74c69b75f6f5a 100755 +--- a/tools/testing/selftests/wireguard/netns.sh ++++ b/tools/testing/selftests/wireguard/netns.sh +@@ -316,6 +316,14 @@ pp sleep 3 + n2 ping -W 1 -c 1 192.168.241.1 + n1 wg set wg0 peer "$pub2" persistent-keepalive 0 + ++# Test that sk_bound_dev_if works ++n1 ping -I wg0 -c 1 -W 1 192.168.241.2 ++# What about when the mark changes and the packet must be rerouted? ++n1 iptables -t mangle -I OUTPUT -j MARK --set-xmark 1 ++n1 ping -c 1 -W 1 192.168.241.2 # First the boring case ++n1 ping -I wg0 -c 1 -W 1 192.168.241.2 # Then the sk_bound_dev_if case ++n1 iptables -t mangle -D OUTPUT -j MARK --set-xmark 1 ++ + # Test that onion routing works, even when it loops + n1 wg set wg0 peer "$pub3" allowed-ips 192.168.242.2/32 endpoint 192.168.241.2:5 + ip1 addr add 192.168.242.1/24 dev wg0 +diff --git a/tools/testing/selftests/wireguard/qemu/kernel.config b/tools/testing/selftests/wireguard/qemu/kernel.config +index d531de13c95b0..4eecb432a66c1 100644 +--- a/tools/testing/selftests/wireguard/qemu/kernel.config ++++ b/tools/testing/selftests/wireguard/qemu/kernel.config +@@ -18,10 +18,12 @@ CONFIG_NF_NAT=y + CONFIG_NETFILTER_XTABLES=y + CONFIG_NETFILTER_XT_NAT=y + CONFIG_NETFILTER_XT_MATCH_LENGTH=y ++CONFIG_NETFILTER_XT_MARK=y + CONFIG_NF_CONNTRACK_IPV4=y + CONFIG_NF_NAT_IPV4=y + CONFIG_IP_NF_IPTABLES=y + CONFIG_IP_NF_FILTER=y ++CONFIG_IP_NF_MANGLE=y + CONFIG_IP_NF_NAT=y + CONFIG_IP_ADVANCED_ROUTER=y + CONFIG_IP_MULTIPLE_TABLES=y +-- +2.27.0 + diff --git a/queue-5.9/x86-boot-compressed-64-introduce-sev_status.patch b/queue-5.9/x86-boot-compressed-64-introduce-sev_status.patch new file mode 100644 index 00000000000..da0a995aaed --- /dev/null +++ b/queue-5.9/x86-boot-compressed-64-introduce-sev_status.patch @@ -0,0 +1,56 @@ +From d1fef12fa6284c24ba55e73fa9019adfcad190a8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Oct 2020 17:46:55 +0100 +Subject: x86/boot/compressed/64: Introduce sev_status + +From: Joerg Roedel + +[ Upstream commit 3ad84246a4097010f3ae3d6944120c0be00e9e7a ] + +Introduce sev_status and initialize it together with sme_me_mask to have +an indicator which SEV features are enabled. + +Signed-off-by: Joerg Roedel +Signed-off-by: Borislav Petkov +Reviewed-by: Tom Lendacky +Link: https://lkml.kernel.org/r/20201028164659.27002-2-joro@8bytes.org +Signed-off-by: Sasha Levin +--- + arch/x86/boot/compressed/mem_encrypt.S | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/boot/compressed/mem_encrypt.S b/arch/x86/boot/compressed/mem_encrypt.S +index dd07e7b41b115..3092ae173f94e 100644 +--- a/arch/x86/boot/compressed/mem_encrypt.S ++++ b/arch/x86/boot/compressed/mem_encrypt.S +@@ -81,6 +81,19 @@ SYM_FUNC_START(set_sev_encryption_mask) + + bts %rax, sme_me_mask(%rip) /* Create the encryption mask */ + ++ /* ++ * Read MSR_AMD64_SEV again and store it to sev_status. Can't do this in ++ * get_sev_encryption_bit() because this function is 32-bit code and ++ * shared between 64-bit and 32-bit boot path. ++ */ ++ movl $MSR_AMD64_SEV, %ecx /* Read the SEV MSR */ ++ rdmsr ++ ++ /* Store MSR value in sev_status */ ++ shlq $32, %rdx ++ orq %rdx, %rax ++ movq %rax, sev_status(%rip) ++ + .Lno_sev_mask: + movq %rbp, %rsp /* Restore original stack pointer */ + +@@ -96,5 +109,6 @@ SYM_FUNC_END(set_sev_encryption_mask) + + #ifdef CONFIG_AMD_MEM_ENCRYPT + .balign 8 +-SYM_DATA(sme_me_mask, .quad 0) ++SYM_DATA(sme_me_mask, .quad 0) ++SYM_DATA(sev_status, .quad 0) + #endif +-- +2.27.0 +